912 files changed, 22544 insertions, 12134 deletions

diff --git a/arch/Kconfig b/arch/Kconfig
index 8d2ae24b9f4a..1feb169274fe 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -407,6 +407,12 @@ config CLONE_BACKWARDS2
         help
           Architecture has the first two arguments of clone(2) swapped.
 
+config CLONE_BACKWARDS3
+        bool
+        help
+          Architecture has tls passed as the 3rd argument of clone(2),
+          not the 5th one.
+
 config ODD_RT_SIGACTION
         bool
         help
diff --git a/arch/alpha/oprofile/common.c b/arch/alpha/oprofile/common.c
index b8ce18f485d3..310a4ce1dccc 100644
--- a/arch/alpha/oprofile/common.c
+++ b/arch/alpha/oprofile/common.c
@@ -106,7 +106,7 @@ op_axp_stop(void)
 }
 
 static int
-op_axp_create_files(struct super_block *sb, struct dentry *root)
+op_axp_create_files(struct dentry *root)
 {
         int i;
 
@@ -115,23 +115,23 @@ op_axp_create_files(struct super_block *sb, struct dentry *root)
                 char buf[4];
 
                 snprintf(buf, sizeof buf, "%d", i);
-                dir = oprofilefs_mkdir(sb, root, buf);
+                dir = oprofilefs_mkdir(root, buf);
 
-                oprofilefs_create_ulong(sb, dir, "enabled", &ctr[i].enabled);
-                oprofilefs_create_ulong(sb, dir, "event", &ctr[i].event);
-                oprofilefs_create_ulong(sb, dir, "count", &ctr[i].count);
+                oprofilefs_create_ulong(dir, "enabled", &ctr[i].enabled);
+                oprofilefs_create_ulong(dir, "event", &ctr[i].event);
+                oprofilefs_create_ulong(dir, "count", &ctr[i].count);
                 /* Dummies.  */
-                oprofilefs_create_ulong(sb, dir, "kernel", &ctr[i].kernel);
-                oprofilefs_create_ulong(sb, dir, "user", &ctr[i].user);
-                oprofilefs_create_ulong(sb, dir, "unit_mask", &ctr[i].unit_mask);
+                oprofilefs_create_ulong(dir, "kernel", &ctr[i].kernel);
+                oprofilefs_create_ulong(dir, "user", &ctr[i].user);
+                oprofilefs_create_ulong(dir, "unit_mask", &ctr[i].unit_mask);
         }
 
         if (model->can_set_proc_mode) {
-                oprofilefs_create_ulong(sb, root, "enable_pal",
+                oprofilefs_create_ulong(root, "enable_pal",
                                         &sys.enable_pal);
-                oprofilefs_create_ulong(sb, root, "enable_kernel",
+                oprofilefs_create_ulong(root, "enable_kernel",
                                         &sys.enable_kernel);
-                oprofilefs_create_ulong(sb, root, "enable_user",
+                oprofilefs_create_ulong(root, "enable_user",
                                         &sys.enable_user);
         }
 
diff --git a/arch/arc/lib/strchr-700.S b/arch/arc/lib/strchr-700.S
index 99c10475d477..9c548c7cf001 100644
--- a/arch/arc/lib/strchr-700.S
+++ b/arch/arc/lib/strchr-700.S
@@ -39,9 +39,18 @@ ARC_ENTRY strchr
         ld.a    r2,[r0,4]
         sub     r12,r6,r7
         bic     r12,r12,r6
+#ifdef __LITTLE_ENDIAN__
         and     r7,r12,r4
         breq    r7,0,.Loop ; For speed, we want this branch to be unaligned.
         b       .Lfound_char ; Likewise this one.
+#else
+        and     r12,r12,r4
+        breq    r12,0,.Loop ; For speed, we want this branch to be unaligned.
+        lsr_s   r12,r12,7
+        bic     r2,r7,r6
+        b.d     .Lfound_char_b
+        and_s   r2,r2,r12
+#endif
 ; /* We require this code address to be unaligned for speed...  */
 .Laligned:
         ld_s    r2,[r0]
@@ -95,6 +104,7 @@ ARC_ENTRY strchr
         lsr     r7,r7,7
 
         bic     r2,r7,r6
+.Lfound_char_b:
         norm    r2,r2
         sub_s   r0,r0,4
         asr_s   r2,r2,3
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 39119d64287c..bf7976439c39 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -52,6 +52,7 @@ config ARM
         select HAVE_REGS_AND_STACK_ACCESS_API
         select HAVE_SYSCALL_TRACEPOINTS
         select HAVE_UID16
+        select IRQ_FORCED_THREADING
         select KTIME_SCALAR
         select PERF_USE_VMALLOC
         select RTC_LIB
@@ -1372,6 +1373,15 @@ config ARM_ERRATA_798181
           which sends an IPI to the CPUs that are running the same ASID
           as the one being invalidated.
 
+config ARM_ERRATA_773022
+        bool "ARM errata: incorrect instructions may be executed from loop buffer"
+        depends on CPU_V7
+        help
+          This option enables the workaround for the 773022 Cortex-A15
+          (up to r0p4) erratum. In certain rare sequences of code, the
+          loop buffer may deliver incorrect instructions. This
+          workaround disables the loop buffer to avoid the erratum.
+
 endmenu
 
 source "arch/arm/common/Kconfig"
@@ -1603,13 +1613,49 @@ config ARCH_NR_GPIO
 
 source kernel/Kconfig.preempt
 
-config HZ
+config HZ_FIXED
         int
         default 200 if ARCH_EBSA110 || ARCH_S3C24XX || ARCH_S5P64X0 || \
                 ARCH_S5PV210 || ARCH_EXYNOS4
         default AT91_TIMER_HZ if ARCH_AT91
         default SHMOBILE_TIMER_HZ if ARCH_SHMOBILE
-        default 100
+
+choice
+        depends on !HZ_FIXED
+        prompt "Timer frequency"
+
+config HZ_100
+        bool "100 Hz"
+
+config HZ_200
+        bool "200 Hz"
+
+config HZ_250
+        bool "250 Hz"
+
+config HZ_300
+        bool "300 Hz"
+
+config HZ_500
+        bool "500 Hz"
+
+config HZ_1000
+        bool "1000 Hz"
+
+endchoice
+
+config HZ
+        int
+        default HZ_FIXED if HZ_FIXED
+        default 100 if HZ_100
+        default 200 if HZ_200
+        default 250 if HZ_250
+        default 300 if HZ_300
+        default 500 if HZ_500
+        default 1000
+
+config SCHED_HRTICK
+        def_bool HIGH_RES_TIMERS
 
 config SCHED_HRTICK
         def_bool HIGH_RES_TIMERS
@@ -1746,6 +1792,9 @@ config HAVE_ARCH_TRANSPARENT_HUGEPAGE
        def_bool y
        depends on ARM_LPAE
 
+config ARCH_WANT_GENERAL_HUGETLB
+        def_bool y
+
 source "mm/Kconfig"
 
 config FORCE_MAX_ZONEORDER
@@ -2054,8 +2103,7 @@ config KEXEC
 
           It is an ongoing process to be certain the hardware in a machine
           is properly shutdown, so do not be surprised if this code does not
-          initially work for you.  It may help to enable device hotplugging
-          support.
+          initially work for you.
 
 config ATAGS_PROC
         bool "Export atags in procfs"
@@ -2165,6 +2213,13 @@ config NEON
           Say Y to include support code for NEON, the ARMv7 Advanced SIMD
           Extension.
 
+config KERNEL_MODE_NEON
+        bool "Support for NEON in kernel mode"
+        default n
+        depends on NEON
+        help
+          Say Y to include support for NEON in kernel mode.
+
 endmenu
 
 menu "Userspace binary formats"
@@ -2189,7 +2244,7 @@ source "kernel/power/Kconfig"
 
 config ARCH_SUSPEND_POSSIBLE
         depends on !ARCH_S5PC100
-        depends on CPU_ARM920T || CPU_ARM926T || CPU_SA1100 || \
+        depends on CPU_ARM920T || CPU_ARM926T || CPU_FEROCEON || CPU_SA1100 || \
                 CPU_V6 || CPU_V6K || CPU_V7 || CPU_XSC3 || CPU_XSCALE || CPU_MOHAWK
         def_bool y
 
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index 15337833d05d..9762c84b4198 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -92,6 +92,7 @@ choice
         config DEBUG_BCM2835
                 bool "Kernel low-level debugging on BCM2835 PL011 UART"
                 depends on ARCH_BCM2835
+                select DEBUG_UART_PL01X
 
         config DEBUG_CLPS711X_UART1
                 bool "Kernel low-level debugging messages via UART1"
@@ -110,6 +111,7 @@ choice
         config DEBUG_CNS3XXX
                 bool "Kernel Kernel low-level debugging on Cavium Networks CNS3xxx"
                 depends on ARCH_CNS3XXX
+                select DEBUG_UART_PL01X
                 help
                   Say Y here if you want the debug print routines to direct
                   their output to the CNS3xxx UART0.
@@ -117,6 +119,7 @@ choice
         config DEBUG_DAVINCI_DA8XX_UART1
                 bool "Kernel low-level debugging on DaVinci DA8XX using UART1"
                 depends on ARCH_DAVINCI_DA8XX
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want the debug print routines to direct
                   their output to UART1 serial port on DaVinci DA8XX devices.
@@ -124,6 +127,7 @@ choice
         config DEBUG_DAVINCI_DA8XX_UART2
                 bool "Kernel low-level debugging on DaVinci DA8XX using UART2"
                 depends on ARCH_DAVINCI_DA8XX
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want the debug print routines to direct
                   their output to UART2 serial port on DaVinci DA8XX devices.
@@ -131,6 +135,7 @@ choice
         config DEBUG_DAVINCI_DMx_UART0
                 bool "Kernel low-level debugging on DaVinci DMx using UART0"
                 depends on ARCH_DAVINCI_DMx
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want the debug print routines to direct
                   their output to UART0 serial port on DaVinci DMx devices.
@@ -138,6 +143,7 @@ choice
         config DEBUG_DAVINCI_TNETV107X_UART1
                 bool "Kernel low-level debugging on DaVinci TNETV107x using UART1"
                 depends on ARCH_DAVINCI_TNETV107X
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want the debug print routines to direct
                   their output to UART1 serial port on DaVinci TNETV107X
@@ -174,9 +180,26 @@ choice
                   Say Y here if you want the debug print routines to direct
                   their output to the 8250 at PCI COM1.
 
+        config DEBUG_HI3620_UART
+                bool "Hisilicon HI3620 Debug UART"
+                depends on ARCH_HI3xxx
+                select DEBUG_UART_PL01X
+                help
+                  Say Y here if you want kernel low-level debugging support
+                  on HI3620 UART.
+
+        config DEBUG_HI3716_UART
+                bool "Hisilicon Hi3716 Debug UART"
+                depends on ARCH_HI3xxx
+                select DEBUG_UART_PL01X
+                help
+                  Say Y here if you want kernel low-level debugging support
+                  on HI3716 UART.
+
         config DEBUG_HIGHBANK_UART
                 bool "Kernel low-level debugging messages via Highbank UART"
                 depends on ARCH_HIGHBANK
+                select DEBUG_UART_PL01X
                 help
                   Say Y here if you want the debug print routines to direct
                   their output to the UART on Highbank based devices.
@@ -191,6 +214,7 @@ choice
         config DEBUG_IMX23_UART
                 bool "i.MX23 Debug UART"
                 depends on SOC_IMX23
+                select DEBUG_UART_PL01X
                 help
                   Say Y here if you want kernel low-level debugging support
                   on i.MX23.
@@ -212,6 +236,7 @@ choice
         config DEBUG_IMX28_UART
                 bool "i.MX28 Debug UART"
                 depends on SOC_IMX28
+                select DEBUG_UART_PL01X
                 help
                   Say Y here if you want kernel low-level debugging support
                   on i.MX28.
@@ -261,6 +286,7 @@ choice
         config DEBUG_KEYSTONE_UART0
                 bool "Kernel low-level debugging on KEYSTONE2 using UART0"
                 depends on ARCH_KEYSTONE
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want the debug print routines to direct
                   their output to UART0 serial port on KEYSTONE2 devices.
@@ -268,6 +294,7 @@ choice
         config DEBUG_KEYSTONE_UART1
                 bool "Kernel low-level debugging on KEYSTONE2 using UART1"
                 depends on ARCH_KEYSTONE
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want the debug print routines to direct
                   their output to UART1 serial port on KEYSTONE2 devices.
@@ -275,6 +302,7 @@ choice
         config DEBUG_MMP_UART2
                 bool "Kernel low-level debugging message via MMP UART2"
                 depends on ARCH_MMP
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want kernel low-level debugging support
                   on MMP UART2.
@@ -282,6 +310,7 @@ choice
         config DEBUG_MMP_UART3
                 bool "Kernel low-level debugging message via MMP UART3"
                 depends on ARCH_MMP
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want kernel low-level debugging support
                   on MMP UART3.
@@ -326,6 +355,7 @@ choice
         config DEBUG_MVEBU_UART
                 bool "Kernel low-level debugging messages via MVEBU UART (old bootloaders)"
                 depends on ARCH_MVEBU
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want kernel low-level debugging support
                   on MVEBU based platforms.
@@ -344,6 +374,7 @@ choice
         config DEBUG_MVEBU_UART_ALTERNATE
                 bool "Kernel low-level debugging messages via MVEBU UART (new bootloaders)"
                 depends on ARCH_MVEBU
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want kernel low-level debugging support
                   on MVEBU based platforms.
@@ -358,6 +389,7 @@ choice
         config DEBUG_NOMADIK_UART
                 bool "Kernel low-level debugging messages via NOMADIK UART"
                 depends on ARCH_NOMADIK
+                select DEBUG_UART_PL01X
                 help
                   Say Y here if you want kernel low-level debugging support
                   on NOMADIK based platforms.
@@ -365,6 +397,7 @@ choice
         config DEBUG_NSPIRE_CLASSIC_UART
                 bool "Kernel low-level debugging via TI-NSPIRE 8250 UART"
                 depends on ARCH_NSPIRE
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want kernel low-level debugging support
                   on TI-NSPIRE classic models.
@@ -372,20 +405,82 @@ choice
         config DEBUG_NSPIRE_CX_UART
                 bool "Kernel low-level debugging via TI-NSPIRE PL011 UART"
                 depends on ARCH_NSPIRE
+                select DEBUG_UART_PL01X
                 help
                   Say Y here if you want kernel low-level debugging support
                   on TI-NSPIRE CX models.
 
-        config DEBUG_OMAP2PLUS_UART
-                bool "Kernel low-level debugging messages via OMAP2PLUS UART"
+        config DEBUG_OMAP2UART1
+                bool "OMAP2/3/4 UART1 (omap2/3 sdp boards and some omap3 boards)"
                 depends on ARCH_OMAP2PLUS
+                select DEBUG_OMAP2PLUS_UART
                 help
-                  Say Y here if you want kernel low-level debugging support
-                  on OMAP2PLUS based platforms.
+                  This covers at least h4, 2430sdp, 3430sdp, 3630sdp,
+                  omap3 torpedo and 3530 lv som.
+
+        config DEBUG_OMAP2UART2
+                bool "Kernel low-level debugging messages via OMAP2/3/4 UART2"
+                depends on ARCH_OMAP2PLUS
+                select DEBUG_OMAP2PLUS_UART
+
+        config DEBUG_OMAP2UART3
+                bool "Kernel low-level debugging messages via OMAP2 UART3 (n8x0)"
+                depends on ARCH_OMAP2PLUS
+                select DEBUG_OMAP2PLUS_UART
+
+        config DEBUG_OMAP3UART3
+                bool "Kernel low-level debugging messages via OMAP3 UART3 (most omap3 boards)"
+                depends on ARCH_OMAP2PLUS
+                select DEBUG_OMAP2PLUS_UART
+                help
+                  This covers at least cm_t3x, beagle, crane, devkit8000,
+                  igep00x0, ldp, n900, n9(50), pandora, overo, touchbook,
+                  and 3517evm.
+
+        config DEBUG_OMAP4UART3
+                bool "Kernel low-level debugging messages via OMAP4/5 UART3 (omap4 blaze, panda, omap5 sevm)"
+                depends on ARCH_OMAP2PLUS
+                select DEBUG_OMAP2PLUS_UART
+
+        config DEBUG_OMAP3UART4
+                bool "Kernel low-level debugging messages via OMAP36XX UART4"
+                depends on ARCH_OMAP2PLUS
+                select DEBUG_OMAP2PLUS_UART
+
+        config DEBUG_OMAP4UART4
+                bool "Kernel low-level debugging messages via OMAP4/5 UART4"
+                depends on ARCH_OMAP2PLUS
+                select DEBUG_OMAP2PLUS_UART
+
+        config DEBUG_TI81XXUART1
+                bool "Kernel low-level debugging messages via TI81XX UART1 (ti8148evm)"
+                depends on ARCH_OMAP2PLUS
+                select DEBUG_OMAP2PLUS_UART
+
+        config DEBUG_TI81XXUART2
+                bool "Kernel low-level debugging messages via TI81XX UART2"
+                depends on ARCH_OMAP2PLUS
+                select DEBUG_OMAP2PLUS_UART
+
+        config DEBUG_TI81XXUART3
+                bool "Kernel low-level debugging messages via TI81XX UART3 (ti8168evm)"
+                depends on ARCH_OMAP2PLUS
+                select DEBUG_OMAP2PLUS_UART
+
+        config DEBUG_AM33XXUART1
+                bool "Kernel low-level debugging messages via AM33XX UART1"
+                depends on ARCH_OMAP2PLUS
+                select DEBUG_OMAP2PLUS_UART
+
+        config DEBUG_ZOOM_UART
+                bool "Kernel low-level debugging messages via Zoom2/3 UART"
+                depends on ARCH_OMAP2PLUS
+                select DEBUG_OMAP2PLUS_UART
 
         config DEBUG_PICOXCELL_UART
                 depends on ARCH_PICOXCELL
                 bool "Use PicoXcell UART for low-level debug"
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want kernel low-level debugging support
                   on PicoXcell based platforms.
@@ -393,6 +488,7 @@ choice
         config DEBUG_PXA_UART1
                 depends on ARCH_PXA
                 bool "Use PXA UART1 for low-level debug"
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want kernel low-level debugging support
                   on PXA UART1.
@@ -400,6 +496,7 @@ choice
         config DEBUG_REALVIEW_STD_PORT
                 bool "RealView Default UART"
                 depends on ARCH_REALVIEW
+                select DEBUG_UART_PL01X
                 help
                   Say Y here if you want the debug print routines to direct
                   their output to the serial port on RealView EB, PB11MP, PBA8
@@ -408,14 +505,64 @@ choice
         config DEBUG_REALVIEW_PB1176_PORT
                 bool "RealView PB1176 UART"
                 depends on MACH_REALVIEW_PB1176
+                select DEBUG_UART_PL01X
                 help
                   Say Y here if you want the debug print routines to direct
                   their output to the standard serial port on the RealView
                   PB1176 platform.
 
-        config DEBUG_ROCKCHIP_UART
-                bool "Kernel low-level debugging messages via Rockchip UART"
+        config DEBUG_RK29_UART0
+                bool "Kernel low-level debugging messages via Rockchip RK29 UART0"
+                depends on ARCH_ROCKCHIP
+                select DEBUG_UART_8250
+                help
+                  Say Y here if you want kernel low-level debugging support
+                  on Rockchip based platforms.
+
+        config DEBUG_RK29_UART1
+                bool "Kernel low-level debugging messages via Rockchip RK29 UART1"
+                depends on ARCH_ROCKCHIP
+                select DEBUG_UART_8250
+                help
+                  Say Y here if you want kernel low-level debugging support
+                  on Rockchip based platforms.
+
+        config DEBUG_RK29_UART2
+                bool "Kernel low-level debugging messages via Rockchip RK29 UART2"
+                depends on ARCH_ROCKCHIP
+                select DEBUG_UART_8250
+                help
+                  Say Y here if you want kernel low-level debugging support
+                  on Rockchip based platforms.
+
+        config DEBUG_RK3X_UART0
+                bool "Kernel low-level debugging messages via Rockchip RK3X UART0"
+                depends on ARCH_ROCKCHIP
+                select DEBUG_UART_8250
+                help
+                  Say Y here if you want kernel low-level debugging support
+                  on Rockchip based platforms.
+
+        config DEBUG_RK3X_UART1
+                bool "Kernel low-level debugging messages via Rockchip RK3X UART1"
+                depends on ARCH_ROCKCHIP
+                select DEBUG_UART_8250
+                help
+                  Say Y here if you want kernel low-level debugging support
+                  on Rockchip based platforms.
+
+        config DEBUG_RK3X_UART2
+                bool "Kernel low-level debugging messages via Rockchip RK3X UART2"
+                depends on ARCH_ROCKCHIP
+                select DEBUG_UART_8250
+                help
+                  Say Y here if you want kernel low-level debugging support
+                  on Rockchip based platforms.
+
+        config DEBUG_RK3X_UART3
+                bool "Kernel low-level debugging messages via Rockchip RK3X UART3"
                 depends on ARCH_ROCKCHIP
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want kernel low-level debugging support
                   on Rockchip based platforms.
@@ -471,6 +618,7 @@ choice
         config DEBUG_SOCFPGA_UART
                 depends on ARCH_SOCFPGA
                 bool "Use SOCFPGA UART for low-level debug"
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want kernel low-level debugging support
                   on SOCFPGA based platforms.
@@ -478,6 +626,7 @@ choice
         config DEBUG_SUNXI_UART0
                 bool "Kernel low-level debugging messages via sunXi UART0"
                 depends on ARCH_SUNXI
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want kernel low-level debugging support
                   on Allwinner A1X based platforms on the UART0.
@@ -485,13 +634,59 @@ choice
         config DEBUG_SUNXI_UART1
                 bool "Kernel low-level debugging messages via sunXi UART1"
                 depends on ARCH_SUNXI
+                select DEBUG_UART_8250
                 help
                   Say Y here if you want kernel low-level debugging support
                   on Allwinner A1X based platforms on the UART1.
 
-        config DEBUG_TEGRA_UART
+        config TEGRA_DEBUG_UART_AUTO_ODMDATA
+                bool "Kernel low-level debugging messages via Tegra UART via ODMDATA"
+                depends on ARCH_TEGRA
+                select DEBUG_TEGRA_UART
+                help
+                  Automatically determines which UART to use for low-level
+                  debug based on the ODMDATA value. This value is part of
+                  the BCT, and is written to the boot memory device using
+                  nvflash, or other flashing tool.  When bits 19:18 are 3,
+                  then bits 17:15 indicate which UART to use; 0/1/2/3/4
+                  are UART A/B/C/D/E.
+
+        config TEGRA_DEBUG_UARTA
+                bool "Kernel low-level debugging messages via Tegra UART A"
+                depends on ARCH_TEGRA
+                select DEBUG_TEGRA_UART
+                help
+                  Say Y here if you want kernel low-level debugging support
+                  on Tegra based platforms.
+
+        config TEGRA_DEBUG_UARTB
+                bool "Kernel low-level debugging messages via Tegra UART B"
+                depends on ARCH_TEGRA
+                select DEBUG_TEGRA_UART
+                help
+                  Say Y here if you want kernel low-level debugging support
+                  on Tegra based platforms.
+
+        config TEGRA_DEBUG_UARTC
+                bool "Kernel low-level debugging messages via Tegra UART C"
+                depends on ARCH_TEGRA
+                select DEBUG_TEGRA_UART
+                help
+                  Say Y here if you want kernel low-level debugging support
+                  on Tegra based platforms.
+
+        config TEGRA_DEBUG_UARTD
+                bool "Kernel low-level debugging messages via Tegra UART D"
+                depends on ARCH_TEGRA
+                select DEBUG_TEGRA_UART
+                help
+                  Say Y here if you want kernel low-level debugging support
+                  on Tegra based platforms.
+
+        config TEGRA_DEBUG_UARTE
+                bool "Kernel low-level debugging messages via Tegra UART E"
                 depends on ARCH_TEGRA
-                bool "Use Tegra UART for low-level debug"
+                select DEBUG_TEGRA_UART
                 help
                   Say Y here if you want kernel low-level debugging support
                   on Tegra based platforms.
@@ -510,19 +705,32 @@ choice
                   Say Y here if you want the debug print routines to direct
                   their output to the uart1 port on SiRFmarco devices.
 
-        config DEBUG_STI_UART
+        config STIH41X_DEBUG_ASC2
+                bool "Use StiH415/416 ASC2 UART for low-level debug"
+                depends on ARCH_STI
+                select DEBUG_STI_UART
+                help
+                  Say Y here if you want kernel low-level debugging support
+                  on STiH415/416 based platforms like b2000, which has
+                  default UART wired up to ASC2.
+
+                  If unsure, say N.
+
+        config STIH41X_DEBUG_SBC_ASC1
+                bool "Use StiH415/416 SBC ASC1 UART for low-level debug"
                 depends on ARCH_STI
-                bool "Use StiH415/416 ASC for low-level debug"
+                select DEBUG_STI_UART
                 help
                   Say Y here if you want kernel low-level debugging support
-                  on StiH415/416 based platforms like B2000, B2020.
-                  It support UART2 and SBC_UART1.
+                  on STiH415/416 based platforms like b2020. which has
+                  default UART wired up to SBC ASC1.
 
                   If unsure, say N.
 
         config DEBUG_U300_UART
                 bool "Kernel low-level debugging messages via U300 UART0"
                 depends on ARCH_U300
+                select DEBUG_UART_PL01X
                 help
                   Say Y here if you want the debug print routines to direct
                   their output to the uart port on U300 devices.
@@ -548,6 +756,7 @@ choice
         config DEBUG_VEXPRESS_UART0_CA9
                 bool "Use PL011 UART0 at 0x10009000 (V2P-CA9 core tile)"
                 depends on ARCH_VEXPRESS
+                select DEBUG_UART_PL01X
                 help
                   This option selects UART0 at 0x10009000. Except for custom models,
                   this applies only to the V2P-CA9 tile.
@@ -555,6 +764,7 @@ choice
         config DEBUG_VEXPRESS_UART0_RS1
                 bool "Use PL011 UART0 at 0x1c090000 (RS1 complaint tiles)"
                 depends on ARCH_VEXPRESS
+                select DEBUG_UART_PL01X
                 help
                   This option selects UART0 at 0x1c090000. This applies to most
                   of the tiles using the RS1 memory map, including all new A-class
@@ -563,6 +773,7 @@ choice
         config DEBUG_VEXPRESS_UART0_CRX
                 bool "Use PL011 UART0 at 0xb0090000 (Cortex-R compliant tiles)"
                 depends on ARCH_VEXPRESS && !MMU
+                select DEBUG_UART_PL01X
                 help
                   This option selects UART0 at 0xb0090000. This is appropriate for
                   Cortex-R series tiles and SMMs, such as Cortex-R5 and Cortex-R7
@@ -579,7 +790,7 @@ choice
                 depends on !ARCH_MULTIPLATFORM
                 help
                   Say Y here if your platform doesn't provide a UART option
-                  below. This relies on your platform choosing the right UART
+                  above. This relies on your platform choosing the right UART
                   definition internally in order for low-level debugging to
                   work.
 
@@ -610,11 +821,41 @@ choice
                   For more details about semihosting, please see
                   chapter 8 of DUI0203I_rvct_developer_guide.pdf from ARM Ltd.
 
+        config DEBUG_LL_UART_8250
+                bool "Kernel low-level debugging via 8250 UART"
+                help
+                  Say Y here if you wish the debug print routes to direct
+                  their output to an 8250 UART.  You can use this option
+                  to provide the parameters for the 8250 UART rather than
+                  selecting one of the platform specific options above if
+                  you know the parameters for the port.
+
+                  This option is preferred over the platform specific
+                  options; the platform specific options are deprecated
+                  and will be soon removed.
+
+        config DEBUG_LL_UART_PL01X
+                bool "Kernel low-level debugging via ARM Ltd PL01x Primecell UART"
+                help
+                  Say Y here if you wish the debug print routes to direct
+                  their output to a PL01x Primecell UART.  You can use
+                  this option to provide the parameters for the UART
+                  rather than selecting one of the platform specific
+                  options above if you know the parameters for the port.
+
+                  This option is preferred over the platform specific
+                  options; the platform specific options are deprecated
+                  and will be soon removed.
+
 endchoice
 
 config DEBUG_EXYNOS_UART
         bool
 
+config DEBUG_OMAP2PLUS_UART
+        bool
+        depends on ARCH_OMAP2PLUS
+
 config DEBUG_IMX_UART_PORT
         int "i.MX Debug UART Port Selection" if DEBUG_IMX1_UART || \
                                                 DEBUG_IMX25_UART || \
@@ -631,140 +872,19 @@ config DEBUG_IMX_UART_PORT
           Choose UART port on which kernel low-level debug messages
           should be output.
 
-choice
-        prompt "Low-level debug console UART"
-        depends on DEBUG_OMAP2PLUS_UART
-
-        config DEBUG_OMAP2UART1
-                bool "OMAP2/3/4 UART1 (omap2/3 sdp boards and some omap3 boards)"
-                help
-                  This covers at least h4, 2430sdp, 3430sdp, 3630sdp,
-                  omap3 torpedo and 3530 lv som.
-
-        config DEBUG_OMAP2UART2
-                bool "OMAP2/3/4 UART2"
-
-        config DEBUG_OMAP2UART3
-                bool "OMAP2 UART3 (n8x0)"
-
-        config DEBUG_OMAP3UART3
-                bool "OMAP3 UART3 (most omap3 boards)"
-                help
-                  This covers at least cm_t3x, beagle, crane, devkit8000,
-                  igep00x0, ldp, n900, n9(50), pandora, overo, touchbook,
-                  and 3517evm.
-
-        config DEBUG_OMAP4UART3
-                bool "OMAP4/5 UART3 (omap4 blaze, panda, omap5 sevm)"
-
-        config DEBUG_OMAP3UART4
-                bool "OMAP36XX UART4"
-
-        config DEBUG_OMAP4UART4
-                bool "OMAP4/5 UART4"
-
-        config DEBUG_TI81XXUART1
-                bool "TI81XX UART1 (ti8148evm)"
-
-        config DEBUG_TI81XXUART2
-                bool "TI81XX UART2"
-
-        config DEBUG_TI81XXUART3
-                bool "TI81XX UART3 (ti8168evm)"
-
-        config DEBUG_AM33XXUART1
-                bool "AM33XX UART1"
-
-        config DEBUG_ZOOM_UART
-                bool "Zoom2/3 UART"
-endchoice
-
-choice
-        prompt "Low-level debug console UART"
-        depends on DEBUG_ROCKCHIP_UART
-
-        config DEBUG_RK29_UART0
-                bool "RK29 UART0"
-
-        config DEBUG_RK29_UART1
-                bool "RK29 UART1"
-
-        config DEBUG_RK29_UART2
-                bool "RK29 UART2"
-
-        config DEBUG_RK3X_UART0
-                bool "RK3X UART0"
-
-        config DEBUG_RK3X_UART1
-                bool "RK3X UART1"
-
-        config DEBUG_RK3X_UART2
-                bool "RK3X UART2"
-
-        config DEBUG_RK3X_UART3
-                bool "RK3X UART3"
-endchoice
-
-choice
-        prompt "Low-level debug console UART"
-        depends on DEBUG_LL && DEBUG_TEGRA_UART
-
-        config TEGRA_DEBUG_UART_AUTO_ODMDATA
-        bool "Via ODMDATA"
-        help
-          Automatically determines which UART to use for low-level debug based
-          on the ODMDATA value. This value is part of the BCT, and is written
-          to the boot memory device using nvflash, or other flashing tool.
-          When bits 19:18 are 3, then bits 17:15 indicate which UART to use;
-          0/1/2/3/4 are UART A/B/C/D/E.
-
-        config TEGRA_DEBUG_UARTA
-                bool "UART A"
-
-        config TEGRA_DEBUG_UARTB
-                bool "UART B"
-
-        config TEGRA_DEBUG_UARTC
-                bool "UART C"
-
-        config TEGRA_DEBUG_UARTD
-                bool "UART D"
-
-        config TEGRA_DEBUG_UARTE
-                bool "UART E"
-
-endchoice
-
-choice
-        prompt "Low-level debug console UART"
-        depends on DEBUG_LL && DEBUG_STI_UART
-
-        config STIH41X_DEBUG_ASC2
-                bool "ASC2 UART"
-                help
-                  Say Y here if you want kernel low-level debugging support
-                  on STiH415/416 based platforms like b2000, which has
-                  default UART wired up to ASC2.
-
-                  If unsure, say N.
-
-        config STIH41X_DEBUG_SBC_ASC1
-                bool "SBC ASC1 UART"
-                help
-                  Say Y here if you want kernel low-level debugging support
-                  on STiH415/416 based platforms like b2020. which has
-                  default UART wired up to SBC ASC1.
-
-                  If unsure, say N.
+config DEBUG_TEGRA_UART
+        bool
+        depends on ARCH_TEGRA
 
-endchoice
+config DEBUG_STI_UART
+        bool
+        depends on ARCH_STI
 
 config DEBUG_LL_INCLUDE
         string
-        default "debug/bcm2835.S" if DEBUG_BCM2835
-        default "debug/cns3xxx.S" if DEBUG_CNS3XXX
+        default "debug/8250.S" if DEBUG_LL_UART_8250 || DEBUG_UART_8250
+        default "debug/pl01x.S" if DEBUG_LL_UART_PL01X || DEBUG_UART_PL01X
         default "debug/exynos.S" if DEBUG_EXYNOS_UART
-        default "debug/highbank.S" if DEBUG_HIGHBANK_UART
         default "debug/icedcc.S" if DEBUG_ICEDCC
         default "debug/imx.S" if DEBUG_IMX1_UART || \
                                  DEBUG_IMX25_UART || \
@@ -775,43 +895,175 @@ config DEBUG_LL_INCLUDE
                                  DEBUG_IMX53_UART ||\
                                  DEBUG_IMX6Q_UART || \
                                  DEBUG_IMX6SL_UART
-        default "debug/keystone.S" if DEBUG_KEYSTONE_UART0 || \
-                                      DEBUG_KEYSTONE_UART1
         default "debug/msm.S" if DEBUG_MSM_UART1 || \
                                  DEBUG_MSM_UART2 || \
                                  DEBUG_MSM_UART3 || \
                                  DEBUG_MSM8660_UART || \
                                  DEBUG_MSM8960_UART
-        default "debug/mvebu.S" if DEBUG_MVEBU_UART || \
-                                   DEBUG_MVEBU_UART_ALTERNATE
-        default "debug/mxs.S" if DEBUG_IMX23_UART || DEBUG_IMX28_UART
-        default "debug/nomadik.S" if DEBUG_NOMADIK_UART
-        default "debug/nspire.S" if     DEBUG_NSPIRE_CX_UART || \
-                                        DEBUG_NSPIRE_CLASSIC_UART
         default "debug/omap2plus.S" if DEBUG_OMAP2PLUS_UART
-        default "debug/picoxcell.S" if DEBUG_PICOXCELL_UART
-        default "debug/pxa.S" if DEBUG_PXA_UART1 || DEBUG_MMP_UART2 || \
-                                 DEBUG_MMP_UART3
-        default "debug/rockchip.S" if DEBUG_ROCKCHIP_UART
         default "debug/sirf.S" if DEBUG_SIRFPRIMA2_UART1 || DEBUG_SIRFMARCO_UART1
-        default "debug/socfpga.S" if DEBUG_SOCFPGA_UART
         default "debug/sti.S" if DEBUG_STI_UART
-        default "debug/sunxi.S" if DEBUG_SUNXI_UART0 || DEBUG_SUNXI_UART1
         default "debug/tegra.S" if DEBUG_TEGRA_UART
-        default "debug/u300.S" if DEBUG_U300_UART
         default "debug/ux500.S" if DEBUG_UX500_UART
-        default "debug/vexpress.S" if DEBUG_VEXPRESS_UART0_DETECT || \
-                DEBUG_VEXPRESS_UART0_CA9 || DEBUG_VEXPRESS_UART0_RS1 || \
-                DEBUG_VEXPRESS_UART0_CRX
+        default "debug/vexpress.S" if DEBUG_VEXPRESS_UART0_DETECT
         default "debug/vt8500.S" if DEBUG_VT8500_UART0
         default "debug/zynq.S" if DEBUG_ZYNQ_UART0 || DEBUG_ZYNQ_UART1
         default "mach/debug-macro.S"
 
+# Compatibility options for PL01x
+config DEBUG_UART_PL01X
+        def_bool ARCH_EP93XX || \
+                ARCH_INTEGRATOR || \
+                ARCH_SPEAR3XX || \
+                ARCH_SPEAR6XX || \
+                ARCH_SPEAR13XX || \
+                ARCH_VERSATILE
+
+# Compatibility options for 8250
+config DEBUG_UART_8250
+        def_bool ARCH_DOVE || ARCH_EBSA110 || \
+                (FOOTBRIDGE && !DEBUG_DC21285_PORT) || \
+                ARCH_GEMINI || ARCH_IOP13XX || ARCH_IOP32X || \
+                ARCH_IOP33X || ARCH_IXP4XX || ARCH_KIRKWOOD || \
+                ARCH_LPC32XX || ARCH_MV78XX0 || ARCH_ORION5X || ARCH_RPC
+
+config DEBUG_UART_PHYS
+        hex "Physical base address of debug UART"
+        default 0x01c20000 if DEBUG_DAVINCI_DMx_UART0
+        default 0x01c28000 if DEBUG_SUNXI_UART0
+        default 0x01c28400 if DEBUG_SUNXI_UART1
+        default 0x01d0c000 if DEBUG_DAVINCI_DA8XX_UART1
+        default 0x01d0d000 if DEBUG_DAVINCI_DA8XX_UART2
+        default 0x02530c00 if DEBUG_KEYSTONE_UART0
+        default 0x02531000 if DEBUG_KEYSTONE_UART1
+        default 0x03010fe0 if ARCH_RPC
+        default 0x08108300 if DEBUG_DAVINCI_TNETV107X_UART1
+        default 0x10009000 if DEBUG_REALVIEW_STD_PORT || DEBUG_CNS3XXX || \
+                                DEBUG_VEXPRESS_UART0_CA9
+        default 0x1010c000 if DEBUG_REALVIEW_PB1176_PORT
+        default 0x10124000 if DEBUG_RK3X_UART0
+        default 0x10126000 if DEBUG_RK3X_UART1
+        default 0x101f1000 if ARCH_VERSATILE
+        default 0x101fb000 if DEBUG_NOMADIK_UART
+        default 0x16000000 if ARCH_INTEGRATOR
+        default 0x1c090000 if DEBUG_VEXPRESS_UART0_RS1
+        default 0x20060000 if DEBUG_RK29_UART0
+        default 0x20064000 if DEBUG_RK29_UART1 || DEBUG_RK3X_UART2
+        default 0x20068000 if DEBUG_RK29_UART2 || DEBUG_RK3X_UART3
+        default 0x20201000 if DEBUG_BCM2835
+        default 0x40090000 if ARCH_LPC32XX
+        default 0x40100000 if DEBUG_PXA_UART1
+        default 0x42000000 if ARCH_GEMINI
+        default 0x7c0003f8 if FOOTBRIDGE
+        default 0x80230000 if DEBUG_PICOXCELL_UART
+        default 0x80070000 if DEBUG_IMX23_UART
+        default 0x80074000 if DEBUG_IMX28_UART
+        default 0x808c0000 if ARCH_EP93XX
+        default 0x90020000 if DEBUG_NSPIRE_CLASSIC_UART || DEBUG_NSPIRE_CX_UART
+        default 0xb0090000 if DEBUG_VEXPRESS_UART0_CRX
+        default 0xc0013000 if DEBUG_U300_UART
+        default 0xc8000000 if ARCH_IXP4XX && !CPU_BIG_ENDIAN
+        default 0xc8000003 if ARCH_IXP4XX && CPU_BIG_ENDIAN
+        default 0xd0000000 if ARCH_SPEAR3XX || ARCH_SPEAR6XX
+        default 0xd0012000 if DEBUG_MVEBU_UART
+        default 0xd4017000 if DEBUG_MMP_UART2
+        default 0xd4018000 if DEBUG_MMP_UART3
+        default 0xe0000000 if ARCH_SPEAR13XX
+        default 0xf0000be0 if ARCH_EBSA110
+        default 0xf1012000 if DEBUG_MVEBU_UART_ALTERNATE
+        default 0xf1012000 if ARCH_DOVE || ARCH_KIRKWOOD || ARCH_MV78XX0 || \
+                                ARCH_ORION5X
+        default 0xf8b00000 if DEBUG_HI3716_UART
+        default 0xfcb00000 if DEBUG_HI3620_UART
+        default 0xfe800000 if ARCH_IOP32X
+        default 0xffc02000 if DEBUG_SOCFPGA_UART
+        default 0xffd82340 if ARCH_IOP13XX
+        default 0xfff36000 if DEBUG_HIGHBANK_UART
+        default 0xfffff700 if ARCH_IOP33X
+        depends on DEBUG_LL_UART_8250 || DEBUG_LL_UART_PL01X || \
+                DEBUG_UART_8250 || DEBUG_UART_PL01X
+
+config DEBUG_UART_VIRT
+        hex "Virtual base address of debug UART"
+        default 0xe0010fe0 if ARCH_RPC
+        default 0xf0000be0 if ARCH_EBSA110
+        default 0xf0009000 if DEBUG_CNS3XXX
+        default 0xf01fb000 if DEBUG_NOMADIK_UART
+        default 0xf0201000 if DEBUG_BCM2835
+        default 0xf11f1000 if ARCH_VERSATILE
+        default 0xf1600000 if ARCH_INTEGRATOR
+        default 0xf1c28000 if DEBUG_SUNXI_UART0
+        default 0xf1c28400 if DEBUG_SUNXI_UART1
+        default 0xf2100000 if DEBUG_PXA_UART1
+        default 0xf4090000 if ARCH_LPC32XX
+        default 0xf4200000 if ARCH_GEMINI
+        default 0xf8009000 if DEBUG_VEXPRESS_UART0_CA9
+        default 0xf8090000 if DEBUG_VEXPRESS_UART0_RS1
+        default 0xfb009000 if DEBUG_REALVIEW_STD_PORT
+        default 0xfb10c000 if DEBUG_REALVIEW_PB1176_PORT
+        default 0xfd000000 if ARCH_SPEAR3XX || ARCH_SPEAR6XX
+        default 0xfd000000 if ARCH_SPEAR13XX
+        default 0xfd012000 if ARCH_MV78XX0
+        default 0xfde12000 if ARCH_DOVE
+        default 0xfe012000 if ARCH_ORION5X
+        default 0xfe017000 if DEBUG_MMP_UART2
+        default 0xfe018000 if DEBUG_MMP_UART3
+        default 0xfe100000 if DEBUG_IMX23_UART || DEBUG_IMX28_UART
+        default 0xfe230000 if DEBUG_PICOXCELL_UART
+        default 0xfe800000 if ARCH_IOP32X
+        default 0xfeb00000 if DEBUG_HI3620_UART || DEBUG_HI3716_UART
+        default 0xfeb24000 if DEBUG_RK3X_UART0
+        default 0xfeb26000 if DEBUG_RK3X_UART1
+        default 0xfeb30c00 if DEBUG_KEYSTONE_UART0
+        default 0xfeb31000 if DEBUG_KEYSTONE_UART1
+        default 0xfec12000 if DEBUG_MVEBU_UART || DEBUG_MVEBU_UART_ALTERNATE
+        default 0xfed60000 if DEBUG_RK29_UART0
+        default 0xfed64000 if DEBUG_RK29_UART1 || DEBUG_RK3X_UART2
+        default 0xfed68000 if DEBUG_RK29_UART2 || DEBUG_RK3X_UART3
+        default 0xfec02000 if DEBUG_SOCFPGA_UART
+        default 0xfec20000 if DEBUG_DAVINCI_DMx_UART0
+        default 0xfed0c000 if DEBUG_DAVINCI_DA8XX_UART1
+        default 0xfed0d000 if DEBUG_DAVINCI_DA8XX_UART2
+        default 0xfed12000 if ARCH_KIRKWOOD
+        default 0xfedc0000 if ARCH_EP93XX
+        default 0xfee003f8 if FOOTBRIDGE
+        default 0xfee08300 if DEBUG_DAVINCI_TNETV107X_UART1
+        default 0xfee20000 if DEBUG_NSPIRE_CLASSIC_UART || DEBUG_NSPIRE_CX_UART
+        default 0xfef36000 if DEBUG_HIGHBANK_UART
+        default 0xfee82340 if ARCH_IOP13XX
+        default 0xfef00000 if ARCH_IXP4XX && !CPU_BIG_ENDIAN
+        default 0xfef00003 if ARCH_IXP4XX && CPU_BIG_ENDIAN
+        default 0xfefff700 if ARCH_IOP33X
+        default 0xff003000 if DEBUG_U300_UART
+        default DEBUG_UART_PHYS if !MMU
+        depends on DEBUG_LL_UART_8250 || DEBUG_LL_UART_PL01X || \
+                DEBUG_UART_8250 || DEBUG_UART_PL01X
+
+config DEBUG_UART_8250_SHIFT
+        int "Register offset shift for the 8250 debug UART"
+        depends on DEBUG_LL_UART_8250 || DEBUG_UART_8250
+        default 0 if FOOTBRIDGE || ARCH_IOP32X
+        default 2
+
+config DEBUG_UART_8250_WORD
+        bool "Use 32-bit accesses for 8250 UART"
+        depends on DEBUG_LL_UART_8250 || DEBUG_UART_8250
+        depends on DEBUG_UART_8250_SHIFT >= 2
+        default y if DEBUG_PICOXCELL_UART || DEBUG_SOCFPGA_UART || \
+                ARCH_KEYSTONE || \
+                DEBUG_DAVINCI_DMx_UART0 || DEBUG_DAVINCI_DA8XX_UART1 || \
+                DEBUG_DAVINCI_DA8XX_UART2 || DEBUG_DAVINCI_TNETV107X_UART1
+
+config DEBUG_UART_8250_FLOW_CONTROL
+        bool "Enable flow control for 8250 UART"
+        depends on DEBUG_LL_UART_8250 || DEBUG_UART_8250
+        default y if ARCH_EBSA110 || FOOTBRIDGE || ARCH_GEMINI || ARCH_RPC
+
 config DEBUG_UNCOMPRESS
         bool
         depends on ARCH_MULTIPLATFORM || ARCH_MSM
         default y if DEBUG_LL && !DEBUG_OMAP2PLUS_UART && \
-                     !DEBUG_TEGRA_UART
+                     (!DEBUG_TEGRA_UART || !ZBOOT_ROM)
         help
           This option influences the normal decompressor output for
           multiplatform kernels.  Normally, multiplatform kernels disable
diff --git a/arch/arm/boot/compressed/head-shmobile.S b/arch/arm/boot/compressed/head-shmobile.S
index e2d636336b7c..e7f80928949c 100644
--- a/arch/arm/boot/compressed/head-shmobile.S
+++ b/arch/arm/boot/compressed/head-shmobile.S
@@ -55,12 +55,47 @@ __tmp_stack:
 __continue:
 #endif /* CONFIG_ZBOOT_ROM_MMC || CONFIG_ZBOOT_ROM_SH_MOBILE_SDHI */
 
-        /* Set board ID necessary for boot */
-        ldr     r7, 1f                          @ Set machine type register
-        mov     r8, #0                          @ pass null pointer as atag
+        adr     r0, dtb_info
+        ldmia   r0, {r1, r3, r4, r5, r7}
+
+        sub     r0, r0, r1              @ calculate the delta offset
+        add     r5, r5, r0              @ _edata
+
+        ldr     lr, [r5, #0]            @ check if valid DTB is present
+        cmp     lr, r3
+        bne     0f
+
+        add     r9, r7, #31             @ rounded up to a multiple
+        bic     r9, r9, #31             @ ... of 32 bytes
+
+        add     r6, r9, r5              @ copy from _edata
+        add     r9, r9, r4              @ to MEMORY_START
+
+1:      ldmdb   r6!, {r0 - r3, r10 - r12, lr}
+        cmp     r6, r5
+        stmdb   r9!, {r0 - r3, r10 - r12, lr}
+        bhi     1b
+
+        /* Success: Zero board ID, pointer to start of memory for atag/dtb */
+        mov     r7, #0
+        mov     r8, r4
         b       2f
 
-1 :     .long MACH_TYPE
+        .align  2
+dtb_info:
+        .word   dtb_info
+#ifndef __ARMEB__
+        .word   0xedfe0dd0              @ sig is 0xd00dfeed big endian
+#else
+        .word   0xd00dfeed
+#endif
+        .word   MEMORY_START
+        .word   _edata
+        .word   0x4000                  @ maximum DTB size
+0:
+        /* Failure: Zero board ID, NULL atag/dtb */
+        mov     r7, #0
+        mov     r8, #0                  @ pass null pointer as atag
 2 :
 
 #endif /* CONFIG_ZBOOT_ROM */
diff --git a/arch/arm/boot/dts/am335x-bone.dts b/arch/arm/boot/dts/am335x-bone.dts
index 444b4ede0d60..d318987d44a1 100644
--- a/arch/arm/boot/dts/am335x-bone.dts
+++ b/arch/arm/boot/dts/am335x-bone.dts
@@ -120,6 +120,35 @@
                         status = "okay";
                 };
 
+                musb: usb@47400000 {
+                        status = "okay";
+
+                        control@44e10000 {
+                                status = "okay";
+                        };
+
+                        usb-phy@47401300 {
+                                status = "okay";
+                        };
+
+                        usb-phy@47401b00 {
+                                status = "okay";
+                        };
+
+                        usb@47401000 {
+                                status = "okay";
+                        };
+
+                        usb@47401800 {
+                                status = "okay";
+                                dr_mode = "host";
+                        };
+
+                        dma-controller@07402000  {
+                                status = "okay";
+                        };
+                };
+
                 i2c0: i2c@44e0b000 {
                         pinctrl-names = "default";
                         pinctrl-0 = <&i2c0_pins>;
diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
index 3aee1a43782d..e8ec8756e498 100644
--- a/arch/arm/boot/dts/am335x-evm.dts
+++ b/arch/arm/boot/dts/am335x-evm.dts
@@ -171,6 +171,35 @@
                         };
                 };
 
+                musb: usb@47400000 {
+                        status = "okay";
+
+                        control@44e10000 {
+                                status = "okay";
+                        };
+
+                        usb-phy@47401300 {
+                                status = "okay";
+                        };
+
+                        usb-phy@47401b00 {
+                                status = "okay";
+                        };
+
+                        usb@47401000 {
+                                status = "okay";
+                        };
+
+                        usb@47401800 {
+                                status = "okay";
+                                dr_mode = "host";
+                        };
+
+                        dma-controller@07402000  {
+                                status = "okay";
+                        };
+                };
+
                 i2c1: i2c@4802a000 {
                         pinctrl-names = "default";
                         pinctrl-0 = <&i2c1_pins>;
diff --git a/arch/arm/boot/dts/am335x-evmsk.dts b/arch/arm/boot/dts/am335x-evmsk.dts
index 0c8ad173d2b0..4f339fa91c57 100644
--- a/arch/arm/boot/dts/am335x-evmsk.dts
+++ b/arch/arm/boot/dts/am335x-evmsk.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "am33xx.dtsi"
+#include <dt-bindings/pwm/pwm.h>
 
 / {
         model = "TI AM335x EVM-SK";
@@ -207,6 +208,22 @@
                         };
                 };
 
+                musb: usb@47400000 {
+                        status = "okay";
+
+                        control@44e10000 {
+                                status = "okay";
+                        };
+
+                        usb-phy@47401300 {
+                                status = "okay";
+                        };
+
+                        usb@47401000 {
+                                status = "okay";
+                        };
+                };
+
                 epwmss2: epwmss@48304000 {
                         status = "okay";
 
@@ -298,7 +315,7 @@
 
         backlight {
                 compatible = "pwm-backlight";
-                pwms = <&ecap2 0 50000 1>;
+                pwms = <&ecap2 0 50000 PWM_POLARITY_INVERTED>;
                 brightness-levels = <0 58 61 66 75 90 125 170 255>;
                 default-brightness-level = <8>;
         };
diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi
index 38b446ba1ce1..f9c5da9c7fe1 100644
--- a/arch/arm/boot/dts/am33xx.dtsi
+++ b/arch/arm/boot/dts/am33xx.dtsi
@@ -26,6 +26,10 @@
                 serial5 = &uart5;
                 d_can0 = &dcan0;
                 d_can1 = &dcan1;
+                usb0 = &usb0;
+                usb1 = &usb1;
+                phy0 = &usb0_phy;
+                phy1 = &usb1_phy;
         };
 
         cpus {
@@ -333,21 +337,132 @@
                         status = "disabled";
                 };
 
-                usb@47400000 {
-                        compatible = "ti,musb-am33xx";
-                        reg = <0x47400000 0x1000        /* usbss */
-                               0x47401000 0x800         /* musb instance 0 */
-                               0x47401800 0x800>;       /* musb instance 1 */
-                        interrupts = <17                /* usbss */
-                                      18                /* musb instance 0 */
-                                      19>;              /* musb instance 1 */
-                        multipoint = <1>;
-                        num-eps = <16>;
-                        ram-bits = <12>;
-                        port0-mode = <3>;
-                        port1-mode = <3>;
-                        power = <250>;
+                usb: usb@47400000 {
+                        compatible = "ti,am33xx-usb";
+                        reg = <0x47400000 0x1000>;
+                        ranges;
+                        #address-cells = <1>;
+                        #size-cells = <1>;
                         ti,hwmods = "usb_otg_hs";
+                        status = "disabled";
+
+                        ctrl_mod: control@44e10000 {
+                                compatible = "ti,am335x-usb-ctrl-module";
+                                reg = <0x44e10620 0x10
+                                        0x44e10648 0x4>;
+                                reg-names = "phy_ctrl", "wakeup";
+                                status = "disabled";
+                        };
+
+                        usb0_phy: usb-phy@47401300 {
+                                compatible = "ti,am335x-usb-phy";
+                                reg = <0x47401300 0x100>;
+                                reg-names = "phy";
+                                status = "disabled";
+                                ti,ctrl_mod = <&ctrl_mod>;
+                        };
+
+                        usb0: usb@47401000 {
+                                compatible = "ti,musb-am33xx";
+                                status = "disabled";
+                                reg = <0x47401400 0x400
+                                        0x47401000 0x200>;
+                                reg-names = "mc", "control";
+
+                                interrupts = <18>;
+                                interrupt-names = "mc";
+                                dr_mode = "otg";
+                                mentor,multipoint = <1>;
+                                mentor,num-eps = <16>;
+                                mentor,ram-bits = <12>;
+                                mentor,power = <500>;
+                                phys = <&usb0_phy>;
+
+                                dmas = <&cppi41dma  0 0 &cppi41dma  1 0
+                                        &cppi41dma  2 0 &cppi41dma  3 0
+                                        &cppi41dma  4 0 &cppi41dma  5 0
+                                        &cppi41dma  6 0 &cppi41dma  7 0
+                                        &cppi41dma  8 0 &cppi41dma  9 0
+                                        &cppi41dma 10 0 &cppi41dma 11 0
+                                        &cppi41dma 12 0 &cppi41dma 13 0
+                                        &cppi41dma 14 0 &cppi41dma  0 1
+                                        &cppi41dma  1 1 &cppi41dma  2 1
+                                        &cppi41dma  3 1 &cppi41dma  4 1
+                                        &cppi41dma  5 1 &cppi41dma  6 1
+                                        &cppi41dma  7 1 &cppi41dma  8 1
+                                        &cppi41dma  9 1 &cppi41dma 10 1
+                                        &cppi41dma 11 1 &cppi41dma 12 1
+                                        &cppi41dma 13 1 &cppi41dma 14 1>;
+                                dma-names =
+                                        "rx1", "rx2", "rx3", "rx4", "rx5", "rx6", "rx7",
+                                        "rx8", "rx9", "rx10", "rx11", "rx12", "rx13",
+                                        "rx14", "rx15",
+                                        "tx1", "tx2", "tx3", "tx4", "tx5", "tx6", "tx7",
+                                        "tx8", "tx9", "tx10", "tx11", "tx12", "tx13",
+                                        "tx14", "tx15";
+                        };
+
+                        usb1_phy: usb-phy@47401b00 {
+                                compatible = "ti,am335x-usb-phy";
+                                reg = <0x47401b00 0x100>;
+                                reg-names = "phy";
+                                status = "disabled";
+                                ti,ctrl_mod = <&ctrl_mod>;
+                        };
+
+                        usb1: usb@47401800 {
+                                compatible = "ti,musb-am33xx";
+                                status = "disabled";
+                                reg = <0x47401c00 0x400
+                                        0x47401800 0x200>;
+                                reg-names = "mc", "control";
+                                interrupts = <19>;
+                                interrupt-names = "mc";
+                                dr_mode = "otg";
+                                mentor,multipoint = <1>;
+                                mentor,num-eps = <16>;
+                                mentor,ram-bits = <12>;
+                                mentor,power = <500>;
+                                phys = <&usb1_phy>;
+
+                                dmas = <&cppi41dma 15 0 &cppi41dma 16 0
+                                        &cppi41dma 17 0 &cppi41dma 18 0
+                                        &cppi41dma 19 0 &cppi41dma 20 0
+                                        &cppi41dma 21 0 &cppi41dma 22 0
+                                        &cppi41dma 23 0 &cppi41dma 24 0
+                                        &cppi41dma 25 0 &cppi41dma 26 0
+                                        &cppi41dma 27 0 &cppi41dma 28 0
+                                        &cppi41dma 29 0 &cppi41dma 15 1
+                                        &cppi41dma 16 1 &cppi41dma 17 1
+                                        &cppi41dma 18 1 &cppi41dma 19 1
+                                        &cppi41dma 20 1 &cppi41dma 21 1
+                                        &cppi41dma 22 1 &cppi41dma 23 1
+                                        &cppi41dma 24 1 &cppi41dma 25 1
+                                        &cppi41dma 26 1 &cppi41dma 27 1
+                                        &cppi41dma 28 1 &cppi41dma 29 1>;
+                                dma-names =
+                                        "rx1", "rx2", "rx3", "rx4", "rx5", "rx6", "rx7",
+                                        "rx8", "rx9", "rx10", "rx11", "rx12", "rx13",
+                                        "rx14", "rx15",
+                                        "tx1", "tx2", "tx3", "tx4", "tx5", "tx6", "tx7",
+                                        "tx8", "tx9", "tx10", "tx11", "tx12", "tx13",
+                                        "tx14", "tx15";
+                        };
+
+                        cppi41dma: dma-controller@07402000 {
+                                compatible = "ti,am3359-cppi41";
+                                reg =  <0x47400000 0x1000
+                                        0x47402000 0x1000
+                                        0x47403000 0x1000
+                                        0x47404000 0x4000>;
+                                reg-names = "glue", "controller", "scheduler", "queuemgr";
+                                interrupts = <17>;
+                                interrupt-names = "glue";
+                                #dma-cells = <2>;
+                                #dma-channels = <30>;
+                                #dma-requests = <256>;
+                                status = "disabled";
+                        };
                 };
 
                 epwmss0: epwmss@48300000 {
diff --git a/arch/arm/boot/dts/at91sam9n12ek.dts b/arch/arm/boot/dts/at91sam9n12ek.dts
index d59b70c6a6a0..3d77dbe406f4 100644
--- a/arch/arm/boot/dts/at91sam9n12ek.dts
+++ b/arch/arm/boot/dts/at91sam9n12ek.dts
@@ -14,11 +14,11 @@
         compatible = "atmel,at91sam9n12ek", "atmel,at91sam9n12", "atmel,at91sam9";
 
         chosen {
-                bootargs = "mem=128M console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=jffs2";
+                bootargs = "console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=jffs2";
         };
 
         memory {
-                reg = <0x20000000 0x10000000>;
+                reg = <0x20000000 0x8000000>;
         };
 
         clocks {
diff --git a/arch/arm/boot/dts/at91sam9x5ek.dtsi b/arch/arm/boot/dts/at91sam9x5ek.dtsi
index b753855b2058..49e3c45818c2 100644
--- a/arch/arm/boot/dts/at91sam9x5ek.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5ek.dtsi
@@ -94,8 +94,9 @@
 
                 usb0: ohci@00600000 {
                         status = "okay";
-                        num-ports = <2>;
-                        atmel,vbus-gpio = <&pioD 19 GPIO_ACTIVE_LOW
+                        num-ports = <3>;
+                        atmel,vbus-gpio = <0 /* &pioD 18 GPIO_ACTIVE_LOW *//* Activate to have access to port A */
+                                           &pioD 19 GPIO_ACTIVE_LOW
                                            &pioD 20 GPIO_ACTIVE_LOW
                                           >;
                 };
diff --git a/arch/arm/boot/dts/atlas6.dtsi b/arch/arm/boot/dts/atlas6.dtsi
index a0f2721ea583..8678e0c11119 100644
--- a/arch/arm/boot/dts/atlas6.dtsi
+++ b/arch/arm/boot/dts/atlas6.dtsi
@@ -329,6 +329,12 @@
                                                 sirf,function = "uart0";
                                         };
                                 };
+                                uart0_noflow_pins_a: uart0@1 {
+                                        uart {
+                                                sirf,pins = "uart0_nostreamctrlgrp";
+                                                sirf,function = "uart0_nostreamctrl";
+                                        };
+                                };
                                 uart1_pins_a: uart1@0 {
                                         uart {
                                                 sirf,pins = "uart1grp";
diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
index 24c0888dd409..f2dfa6b1f1a1 100644
--- a/arch/arm/boot/dts/exynos5250.dtsi
+++ b/arch/arm/boot/dts/exynos5250.dtsi
@@ -405,7 +405,7 @@
         };
 
         i2s0: i2s@03830000 {
-                compatible = "samsung,i2s-v5";
+                compatible = "samsung,s5pv210-i2s";
                 reg = <0x03830000 0x100>;
                 dmas = <&pdma0 10
                         &pdma0 9
@@ -415,16 +415,13 @@
                         <&clock_audss EXYNOS_I2S_BUS>,
                         <&clock_audss EXYNOS_SCLK_I2S>;
                 clock-names = "iis", "i2s_opclk0", "i2s_opclk1";
-                samsung,supports-6ch;
-                samsung,supports-rstclr;
-                samsung,supports-secdai;
                 samsung,idma-addr = <0x03000000>;
                 pinctrl-names = "default";
                 pinctrl-0 = <&i2s0_bus>;
         };
 
         i2s1: i2s@12D60000 {
-                compatible = "samsung,i2s-v5";
+                compatible = "samsung,s3c6410-i2s";
                 reg = <0x12D60000 0x100>;
                 dmas = <&pdma1 12
                         &pdma1 11>;
@@ -436,7 +433,7 @@
         };
 
         i2s2: i2s@12D70000 {
-                compatible = "samsung,i2s-v5";
+                compatible = "samsung,s3c6410-i2s";
                 reg = <0x12D70000 0x100>;
                 dmas = <&pdma0 12
                         &pdma0 11>;
diff --git a/arch/arm/boot/dts/exynos5440.dtsi b/arch/arm/boot/dts/exynos5440.dtsi
index 0cedba4d8529..1b81f36896bc 100644
--- a/arch/arm/boot/dts/exynos5440.dtsi
+++ b/arch/arm/boot/dts/exynos5440.dtsi
@@ -248,6 +248,7 @@
                 #interrupt-cells = <1>;
                 interrupt-map-mask = <0 0 0 0>;
                 interrupt-map = <0x0 0 &gic 53>;
+                num-lanes = <4>;
         };
 
         pcie@2a0000 {
@@ -267,5 +268,6 @@
                 #interrupt-cells = <1>;
                 interrupt-map-mask = <0 0 0 0>;
                 interrupt-map = <0x0 0 &gic 56>;
+                num-lanes = <4>;
         };
 };
diff --git a/arch/arm/boot/dts/imx28-evk.dts b/arch/arm/boot/dts/imx28-evk.dts
index e035f4664b97..15715d921d14 100644
--- a/arch/arm/boot/dts/imx28-evk.dts
+++ b/arch/arm/boot/dts/imx28-evk.dts
@@ -220,6 +220,7 @@
                         auart0: serial@8006a000 {
                                 pinctrl-names = "default";
                                 pinctrl-0 = <&auart0_pins_a>;
+                                fsl,uart-has-rtscts;
                                 status = "okay";
                         };
 
diff --git a/arch/arm/boot/dts/keystone.dts b/arch/arm/boot/dts/keystone.dts
index 1334b42c6b77..a68e34bbecb2 100644
--- a/arch/arm/boot/dts/keystone.dts
+++ b/arch/arm/boot/dts/keystone.dts
@@ -7,7 +7,9 @@
  */
 
 /dts-v1/;
-/include/ "skeleton.dtsi"
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+#include "skeleton.dtsi"
 
 / {
         model = "Texas Instruments Keystone 2 SoC";
@@ -67,18 +69,23 @@
 
         timer {
                 compatible = "arm,armv7-timer";
-                interrupts = <1 13 0xf08>,
-                             <1 14 0xf08>,
-                             <1 11 0xf08>,
-                             <1 10 0x308>;
+                interrupts =
+                        <GIC_PPI 13
+                                (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+                        <GIC_PPI 14
+                                (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+                        <GIC_PPI 11
+                                (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+                        <GIC_PPI 10
+                                (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>;
         };
 
         pmu {
                 compatible = "arm,cortex-a15-pmu";
-                interrupts = <0 20 0xf01>,
-                             <0 21 0xf01>,
-                             <0 22 0xf01>,
-                             <0 23 0xf01>;
+                interrupts = <GIC_SPI 20 IRQ_TYPE_EDGE_RISING>,
+                             <GIC_SPI 21 IRQ_TYPE_EDGE_RISING>,
+                             <GIC_SPI 22 IRQ_TYPE_EDGE_RISING>,
+                             <GIC_SPI 23 IRQ_TYPE_EDGE_RISING>;
         };
 
         soc {
@@ -100,7 +107,7 @@
                         reg-io-width = <4>;
                         reg = <0x02530c00 0x100>;
                         clock-frequency = <133120000>;
-                        interrupts = <0 277 0xf01>;
+                        interrupts = <GIC_SPI 277 IRQ_TYPE_EDGE_RISING>;
                 };
 
                 uart1:  serial@02531000 {
@@ -110,7 +117,7 @@
                         reg-io-width = <4>;
                         reg = <0x02531000 0x100>;
                         clock-frequency = <133120000>;
-                        interrupts = <0 280 0xf01>;
+                        interrupts = <GIC_SPI 280 IRQ_TYPE_EDGE_RISING>;
                 };
 
         };
diff --git a/arch/arm/boot/dts/msm8660-surf.dts b/arch/arm/boot/dts/msm8660-surf.dts
index cdc010e0f93e..386d42870215 100644
--- a/arch/arm/boot/dts/msm8660-surf.dts
+++ b/arch/arm/boot/dts/msm8660-surf.dts
@@ -38,7 +38,7 @@
         };
 
         serial@19c40000 {
-                compatible = "qcom,msm-hsuart", "qcom,msm-uart";
+                compatible = "qcom,msm-uartdm-v1.3", "qcom,msm-uartdm";
                 reg = <0x19c40000 0x1000>,
                       <0x19c00000 0x1000>;
                 interrupts = <0 195 0x0>;
diff --git a/arch/arm/boot/dts/msm8960-cdp.dts b/arch/arm/boot/dts/msm8960-cdp.dts
index db2060c46540..93e9f7e0b7ad 100644
--- a/arch/arm/boot/dts/msm8960-cdp.dts
+++ b/arch/arm/boot/dts/msm8960-cdp.dts
@@ -26,7 +26,7 @@
                 cpu-offset = <0x80000>;
         };
 
-        msmgpio: gpio@fd510000 {
+        msmgpio: gpio@800000 {
                 compatible = "qcom,msm-gpio";
                 gpio-controller;
                 #gpio-cells = <2>;
@@ -34,11 +34,11 @@
                 interrupts = <0 32 0x4>;
                 interrupt-controller;
                 #interrupt-cells = <2>;
-                reg = <0xfd510000 0x4000>;
+                reg = <0x800000 0x4000>;
         };
 
         serial@16440000 {
-                compatible = "qcom,msm-hsuart", "qcom,msm-uart";
+                compatible = "qcom,msm-uartdm-v1.3", "qcom,msm-uartdm";
                 reg = <0x16440000 0x1000>,
                       <0x16400000 0x1000>;
                 interrupts = <0 154 0x0>;
diff --git a/arch/arm/boot/dts/omap5-uevm.dts b/arch/arm/boot/dts/omap5-uevm.dts
index 08b72678abff..65d7b601651c 100644
--- a/arch/arm/boot/dts/omap5-uevm.dts
+++ b/arch/arm/boot/dts/omap5-uevm.dts
@@ -235,7 +235,7 @@
 };
 
 &mmc1 {
-        vmmc-supply = <&vmmcsd_fixed>;
+        vmmc-supply = <&ldo9_reg>;
         bus-width = <4>;
 };
 
@@ -282,6 +282,7 @@
 
                         regulators {
                                 smps123_reg: smps123 {
+                                        /* VDD_OPP_MPU */
                                         regulator-name = "smps123";
                                         regulator-min-microvolt = < 600000>;
                                         regulator-max-microvolt = <1500000>;
@@ -290,6 +291,7 @@
                                 };
 
                                 smps45_reg: smps45 {
+                                        /* VDD_OPP_MM */
                                         regulator-name = "smps45";
                                         regulator-min-microvolt = < 600000>;
                                         regulator-max-microvolt = <1310000>;
@@ -298,6 +300,7 @@
                                 };
 
                                 smps6_reg: smps6 {
+                                        /* VDD_DDR3 - over VDD_SMPS6 */
                                         regulator-name = "smps6";
                                         regulator-min-microvolt = <1200000>;
                                         regulator-max-microvolt = <1200000>;
@@ -306,6 +309,7 @@
                                 };
 
                                 smps7_reg: smps7 {
+                                        /* VDDS_1v8_OMAP over VDDS_1v8_MAIN */
                                         regulator-name = "smps7";
                                         regulator-min-microvolt = <1800000>;
                                         regulator-max-microvolt = <1800000>;
@@ -314,6 +318,7 @@
                                 };
 
                                 smps8_reg: smps8 {
+                                        /* VDD_OPP_CORE */
                                         regulator-name = "smps8";
                                         regulator-min-microvolt = < 600000>;
                                         regulator-max-microvolt = <1310000>;
@@ -322,15 +327,15 @@
                                 };
 
                                 smps9_reg: smps9 {
+                                        /* VDDA_2v1_AUD over VDD_2v1 */
                                         regulator-name = "smps9";
                                         regulator-min-microvolt = <2100000>;
                                         regulator-max-microvolt = <2100000>;
-                                        regulator-always-on;
-                                        regulator-boot-on;
                                         ti,smps-range = <0x80>;
                                 };
 
                                 smps10_reg: smps10 {
+                                        /* VBUS_5V_OTG */
                                         regulator-name = "smps10";
                                         regulator-min-microvolt = <5000000>;
                                         regulator-max-microvolt = <5000000>;
@@ -339,38 +344,40 @@
                                 };
 
                                 ldo1_reg: ldo1 {
+                                        /* VDDAPHY_CAM: vdda_csiport */
                                         regulator-name = "ldo1";
-                                        regulator-min-microvolt = <2800000>;
-                                        regulator-max-microvolt = <2800000>;
-                                        regulator-always-on;
-                                        regulator-boot-on;
+                                        regulator-min-microvolt = <1500000>;
+                                        regulator-max-microvolt = <1800000>;
                                 };
 
                                 ldo2_reg: ldo2 {
+                                        /* VCC_2V8_DISP: Does not go anywhere */
                                         regulator-name = "ldo2";
-                                        regulator-min-microvolt = <2900000>;
-                                        regulator-max-microvolt = <2900000>;
-                                        regulator-always-on;
-                                        regulator-boot-on;
+                                        regulator-min-microvolt = <2800000>;
+                                        regulator-max-microvolt = <2800000>;
+                                        /* Unused */
+                                        status = "disabled";
                                 };
 
                                 ldo3_reg: ldo3 {
+                                        /* VDDAPHY_MDM: vdda_lli */
                                         regulator-name = "ldo3";
-                                        regulator-min-microvolt = <3000000>;
-                                        regulator-max-microvolt = <3000000>;
-                                        regulator-always-on;
+                                        regulator-min-microvolt = <1500000>;
+                                        regulator-max-microvolt = <1500000>;
                                         regulator-boot-on;
+                                        /* Only if Modem is used */
+                                        status = "disabled";
                                 };
 
                                 ldo4_reg: ldo4 {
+                                        /* VDDAPHY_DISP: vdda_dsiport/hdmi */
                                         regulator-name = "ldo4";
-                                        regulator-min-microvolt = <2200000>;
-                                        regulator-max-microvolt = <2200000>;
-                                        regulator-always-on;
-                                        regulator-boot-on;
+                                        regulator-min-microvolt = <1500000>;
+                                        regulator-max-microvolt = <1800000>;
                                 };
 
                                 ldo5_reg: ldo5 {
+                                        /* VDDA_1V8_PHY: usb/sata/hdmi.. */
                                         regulator-name = "ldo5";
                                         regulator-min-microvolt = <1800000>;
                                         regulator-max-microvolt = <1800000>;
@@ -379,38 +386,43 @@
                                 };
 
                                 ldo6_reg: ldo6 {
+                                        /* VDDS_1V2_WKUP: hsic/ldo_emu_wkup */
                                         regulator-name = "ldo6";
-                                        regulator-min-microvolt = <1500000>;
-                                        regulator-max-microvolt = <1500000>;
+                                        regulator-min-microvolt = <1200000>;
+                                        regulator-max-microvolt = <1200000>;
                                         regulator-always-on;
                                         regulator-boot-on;
                                 };
 
                                 ldo7_reg: ldo7 {
+                                        /* VDD_VPP: vpp1 */
                                         regulator-name = "ldo7";
-                                        regulator-min-microvolt = <1500000>;
-                                        regulator-max-microvolt = <1500000>;
-                                        regulator-always-on;
-                                        regulator-boot-on;
+                                        regulator-min-microvolt = <2000000>;
+                                        regulator-max-microvolt = <2000000>;
+                                        /* Only for efuse reprograming! */
+                                        status = "disabled";
                                 };
 
                                 ldo8_reg: ldo8 {
+                                        /* VDD_3v0: Does not go anywhere */
                                         regulator-name = "ldo8";
-                                        regulator-min-microvolt = <1500000>;
-                                        regulator-max-microvolt = <1500000>;
-                                        regulator-always-on;
+                                        regulator-min-microvolt = <3000000>;
+                                        regulator-max-microvolt = <3000000>;
                                         regulator-boot-on;
+                                        /* Unused */
+                                        status = "disabled";
                                 };
 
                                 ldo9_reg: ldo9 {
+                                        /* VCC_DV_SDIO: vdds_sdcard */
                                         regulator-name = "ldo9";
                                         regulator-min-microvolt = <1800000>;
-                                        regulator-max-microvolt = <3300000>;
-                                        regulator-always-on;
+                                        regulator-max-microvolt = <3000000>;
                                         regulator-boot-on;
                                 };
 
                                 ldoln_reg: ldoln {
+                                        /* VDDA_1v8_REF: vdds_osc/mm_l4per.. */
                                         regulator-name = "ldoln";
                                         regulator-min-microvolt = <1800000>;
                                         regulator-max-microvolt = <1800000>;
@@ -419,12 +431,20 @@
                                 };
 
                                 ldousb_reg: ldousb {
+                                        /* VDDA_3V_USB: VDDA_USBHS33 */
                                         regulator-name = "ldousb";
                                         regulator-min-microvolt = <3250000>;
                                         regulator-max-microvolt = <3250000>;
                                         regulator-always-on;
                                         regulator-boot-on;
                                 };
+
+                                regen3_reg: regen3 {
+                                        /* REGEN3 controls LDO9 supply to card */
+                                        regulator-name = "regen3";
+                                        regulator-always-on;
+                                        regulator-boot-on;
+                                };
                         };
                 };
         };
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index e643620417a9..07be2cd7b318 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -644,7 +644,7 @@
                         utmi-mode = <2>;
                         ranges;
                         dwc3@4a030000 {
-                                compatible = "synopsys,dwc3";
+                                compatible = "snps,dwc3";
                                 reg = <0x4a030000 0x1000>;
                                 interrupts = <GIC_SPI 92 IRQ_TYPE_LEVEL_HIGH>;
                                 usb-phy = <&usb2_phy>, <&usb3_phy>;
diff --git a/arch/arm/boot/dts/sama5d3xmb.dtsi b/arch/arm/boot/dts/sama5d3xmb.dtsi
index 8a9e05d8a4b8..dba739b6ef36 100644
--- a/arch/arm/boot/dts/sama5d3xmb.dtsi
+++ b/arch/arm/boot/dts/sama5d3xmb.dtsi
@@ -81,6 +81,14 @@
 
                         macb1: ethernet@f802c000 {
                                 phy-mode = "rmii";
+
+                                #address-cells = <1>;
+                                #size-cells = <0>;
+                                phy0: ethernet-phy@1 {
+                                        interrupt-parent = <&pioE>;
+                                        interrupts = <30 IRQ_TYPE_EDGE_FALLING>;
+                                        reg = <1>;
+                                };
                         };
 
                         pinctrl@fffff200 {
diff --git a/arch/arm/boot/dts/skeleton64.dtsi b/arch/arm/boot/dts/skeleton64.dtsi
index 15994158a998..b5d7f36f33de 100644
--- a/arch/arm/boot/dts/skeleton64.dtsi
+++ b/arch/arm/boot/dts/skeleton64.dtsi
@@ -9,5 +9,5 @@
         #size-cells = <2>;
         chosen { };
         aliases { };
-        memory { device_type = "memory"; reg = <0 0>; };
+        memory { device_type = "memory"; reg = <0 0 0 0>; };
 };
diff --git a/arch/arm/boot/dts/stih41x.dtsi b/arch/arm/boot/dts/stih41x.dtsi
index 7321403cab8a..f5b9898d9c6e 100644
--- a/arch/arm/boot/dts/stih41x.dtsi
+++ b/arch/arm/boot/dts/stih41x.dtsi
@@ -6,10 +6,12 @@
                 #address-cells = <1>;
                 #size-cells = <0>;
                 cpu@0 {
+                        device_type = "cpu";
                         compatible = "arm,cortex-a9";
                         reg = <0>;
                 };
                 cpu@1 {
+                        device_type = "cpu";
                         compatible = "arm,cortex-a9";
                         reg = <1>;
                 };
diff --git a/arch/arm/boot/dts/tegra20-colibri-512.dtsi b/arch/arm/boot/dts/tegra20-colibri-512.dtsi
index 2fcb3f2ca160..5592be6f2f7a 100644
--- a/arch/arm/boot/dts/tegra20-colibri-512.dtsi
+++ b/arch/arm/boot/dts/tegra20-colibri-512.dtsi
@@ -457,6 +457,7 @@
         };
 
         usb-phy@c5004000 {
+                status = "okay";
                 nvidia,phy-reset-gpio = <&gpio TEGRA_GPIO(V, 1)
                         GPIO_ACTIVE_LOW>;
         };
diff --git a/arch/arm/boot/dts/tegra20-seaboard.dts b/arch/arm/boot/dts/tegra20-seaboard.dts
index 365760b33a26..c8242533268f 100644
--- a/arch/arm/boot/dts/tegra20-seaboard.dts
+++ b/arch/arm/boot/dts/tegra20-seaboard.dts
@@ -566,7 +566,6 @@
 
         usb@c5000000 {
                 status = "okay";
-                nvidia,vbus-gpio = <&gpio TEGRA_GPIO(D, 0) GPIO_ACTIVE_HIGH>;
                 dr_mode = "otg";
         };
 
@@ -830,6 +829,8 @@
                         regulator-max-microvolt = <5000000>;
                         enable-active-high;
                         gpio = <&gpio 24 0>; /* PD0 */
+                        regulator-always-on;
+                        regulator-boot-on;
                 };
         };
 
diff --git a/arch/arm/boot/dts/tegra20-trimslice.dts b/arch/arm/boot/dts/tegra20-trimslice.dts
index ed4b901b0227..1e9d33adb925 100644
--- a/arch/arm/boot/dts/tegra20-trimslice.dts
+++ b/arch/arm/boot/dts/tegra20-trimslice.dts
@@ -312,7 +312,6 @@
 
         usb@c5000000 {
                 status = "okay";
-                nvidia,vbus-gpio = <&gpio TEGRA_GPIO(V, 2) GPIO_ACTIVE_HIGH>;
         };
 
         usb-phy@c5000000 {
@@ -412,6 +411,8 @@
                         regulator-max-microvolt = <5000000>;
                         enable-active-high;
                         gpio = <&gpio 170 0>; /* PV2 */
+                        regulator-always-on;
+                        regulator-boot-on;
                 };
         };
 
diff --git a/arch/arm/boot/dts/tegra20-whistler.dts b/arch/arm/boot/dts/tegra20-whistler.dts
index ab67c94db280..c703197dca6e 100644
--- a/arch/arm/boot/dts/tegra20-whistler.dts
+++ b/arch/arm/boot/dts/tegra20-whistler.dts
@@ -509,7 +509,6 @@
 
         usb@c5000000 {
                 status = "okay";
-                nvidia,vbus-gpio = <&tca6416 0 GPIO_ACTIVE_HIGH>;
         };
 
         usb-phy@c5000000 {
@@ -519,7 +518,6 @@
 
         usb@c5008000 {
                 status = "okay";
-                nvidia,vbus-gpio = <&tca6416 1 GPIO_ACTIVE_HIGH>;
         };
 
         usb-phy@c5008000 {
@@ -588,6 +586,8 @@
                         regulator-max-microvolt = <5000000>;
                         enable-active-high;
                         gpio = <&tca6416 0 0>; /* GPIO_PMU0 */
+                        regulator-always-on;
+                        regulator-boot-on;
                 };
 
                 vbus3_reg: regulator@3 {
@@ -598,6 +598,8 @@
                         regulator-max-microvolt = <5000000>;
                         enable-active-high;
                         gpio = <&tca6416 1 0>; /* GPIO_PMU1 */
+                        regulator-always-on;
+                        regulator-boot-on;
                 };
         };
 
diff --git a/arch/arm/boot/dts/tegra20.dtsi b/arch/arm/boot/dts/tegra20.dtsi
index 9653fd8288d2..e4570834512e 100644
--- a/arch/arm/boot/dts/tegra20.dtsi
+++ b/arch/arm/boot/dts/tegra20.dtsi
@@ -477,13 +477,13 @@
                          <&tegra_car TEGRA20_CLK_USBD>;
                 clock-names = "reg", "pll_u", "timer", "utmi-pads";
                 nvidia,has-legacy-mode;
-                hssync_start_delay = <9>;
-                idle_wait_delay = <17>;
-                elastic_limit = <16>;
-                term_range_adj = <6>;
-                xcvr_setup = <9>;
-                xcvr_lsfslew = <1>;
-                xcvr_lsrslew = <1>;
+                nvidia,hssync-start-delay = <9>;
+                nvidia,idle-wait-delay = <17>;
+                nvidia,elastic-limit = <16>;
+                nvidia,term-range-adj = <6>;
+                nvidia,xcvr-setup = <9>;
+                nvidia,xcvr-lsfslew = <1>;
+                nvidia,xcvr-lsrslew = <1>;
                 status = "disabled";
         };
 
@@ -527,13 +527,13 @@
                          <&tegra_car TEGRA20_CLK_CLK_M>,
                          <&tegra_car TEGRA20_CLK_USBD>;
                 clock-names = "reg", "pll_u", "timer", "utmi-pads";
-                hssync_start_delay = <9>;
-                idle_wait_delay = <17>;
-                elastic_limit = <16>;
-                term_range_adj = <6>;
-                xcvr_setup = <9>;
-                xcvr_lsfslew = <2>;
-                xcvr_lsrslew = <2>;
+                nvidia,hssync-start-delay = <9>;
+                nvidia,idle-wait-delay = <17>;
+                nvidia,elastic-limit = <16>;
+                nvidia,term-range-adj = <6>;
+                nvidia,xcvr-setup = <9>;
+                nvidia,xcvr-lsfslew = <2>;
+                nvidia,xcvr-lsrslew = <2>;
                 status = "disabled";
         };
 
diff --git a/arch/arm/boot/dts/wm8850-w70v2.dts b/arch/arm/boot/dts/wm8850-w70v2.dts
index 90e913fb64be..7a563d2523b0 100644
--- a/arch/arm/boot/dts/wm8850-w70v2.dts
+++ b/arch/arm/boot/dts/wm8850-w70v2.dts
@@ -11,13 +11,14 @@
 
 /dts-v1/;
 /include/ "wm8850.dtsi"
+#include <dt-bindings/pwm/pwm.h>
 
 / {
         model = "Wondermedia WM8850-W70v2 Tablet";
 
         backlight {
                 compatible = "pwm-backlight";
-                pwms = <&pwm 0 50000 1>;        /* duty inverted */
+                pwms = <&pwm 0 50000 PWM_POLARITY_INVERTED>;
 
                 brightness-levels = <0 40 60 80 100 130 190 255>;
                 default-brightness-level = <5>;
diff --git a/arch/arm/common/mcpm_head.S b/arch/arm/common/mcpm_head.S
index 80f033614a1f..39c96df3477a 100644
--- a/arch/arm/common/mcpm_head.S
+++ b/arch/arm/common/mcpm_head.S
@@ -151,7 +151,7 @@ mcpm_setup_leave:
 
         mov     r0, #INBOUND_NOT_COMING_UP
         strb    r0, [r8, #MCPM_SYNC_CLUSTER_INBOUND]
-        dsb
+        dsb     st
         sev
 
         mov     r0, r11
diff --git a/arch/arm/common/vlock.S b/arch/arm/common/vlock.S
index ff198583f683..8b7df283fedf 100644
--- a/arch/arm/common/vlock.S
+++ b/arch/arm/common/vlock.S
@@ -42,7 +42,7 @@
         dmb
         mov     \rscratch, #0
         strb    \rscratch, [\rbase, \rcpu]
-        dsb
+        dsb     st
         sev
 .endm
 
@@ -102,7 +102,7 @@ ENTRY(vlock_unlock)
         dmb
         mov     r1, #VLOCK_OWNER_NONE
         strb    r1, [r0, #VLOCK_OWNER_OFFSET]
-        dsb
+        dsb     st
         sev
         bx      lr
 ENDPROC(vlock_unlock)
diff --git a/arch/arm/configs/bockw_defconfig b/arch/arm/configs/bockw_defconfig
index 845f5cdf62b5..e7e94948d194 100644
--- a/arch/arm/configs/bockw_defconfig
+++ b/arch/arm/configs/bockw_defconfig
@@ -82,6 +82,13 @@ CONFIG_SERIAL_SH_SCI_CONSOLE=y
 # CONFIG_HWMON is not set
 CONFIG_I2C=y
 CONFIG_I2C_RCAR=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_SOC_CAMERA=y
+CONFIG_VIDEO_RCAR_VIN=y
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+CONFIG_VIDEO_ML86V7667=y
 CONFIG_SPI=y
 CONFIG_SPI_SH_HSPI=y
 CONFIG_USB=y
diff --git a/arch/arm/configs/keystone_defconfig b/arch/arm/configs/keystone_defconfig
index 62e968cac9dc..1f36b823905f 100644
--- a/arch/arm/configs/keystone_defconfig
+++ b/arch/arm/configs/keystone_defconfig
@@ -104,6 +104,7 @@ CONFIG_IP_SCTP=y
 CONFIG_VLAN_8021Q=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_CMA=y
+CONFIG_DMA_CMA=y
 CONFIG_MTD=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_BLOCK=y
diff --git a/arch/arm/configs/marzen_defconfig b/arch/arm/configs/marzen_defconfig
index 494e70aeb9e1..c50e52be4463 100644
--- a/arch/arm/configs/marzen_defconfig
+++ b/arch/arm/configs/marzen_defconfig
@@ -84,6 +84,13 @@ CONFIG_GPIO_RCAR=y
 CONFIG_THERMAL=y
 CONFIG_RCAR_THERMAL=y
 CONFIG_SSB=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_SOC_CAMERA=y
+CONFIG_VIDEO_RCAR_VIN=y
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+CONFIG_VIDEO_ADV7180=y
 CONFIG_USB=y
 CONFIG_USB_RCAR_PHY=y
 CONFIG_MMC=y
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index 5339e6a4d639..056b27aafbe6 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -78,6 +78,7 @@ CONFIG_MAC80211_RC_PID=y
 CONFIG_MAC80211_RC_DEFAULT_PID=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_CMA=y
+CONFIG_DMA_CMA=y
 CONFIG_CONNECTOR=y
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
@@ -185,13 +186,11 @@ CONFIG_OMAP2_DSS_RFBI=y
 CONFIG_OMAP2_DSS_SDI=y
 CONFIG_OMAP2_DSS_DSI=y
 CONFIG_FB_OMAP2=m
-CONFIG_PANEL_GENERIC_DPI=m
-CONFIG_PANEL_TFP410=m
-CONFIG_PANEL_SHARP_LS037V7DW01=m
-CONFIG_PANEL_NEC_NL8048HL11_01B=m
-CONFIG_PANEL_TAAL=m
-CONFIG_PANEL_TPO_TD043MTEA1=m
-CONFIG_PANEL_ACX565AKM=m
+CONFIG_DISPLAY_ENCODER_TFP410=m
+CONFIG_DISPLAY_ENCODER_TPD12S015=m
+CONFIG_DISPLAY_CONNECTOR_DVI=m
+CONFIG_DISPLAY_CONNECTOR_HDMI=m
+CONFIG_DISPLAY_PANEL_DPI=m
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
 CONFIG_LCD_CLASS_DEVICE=y
 CONFIG_LCD_PLATFORM=y
diff --git a/arch/arm/configs/tegra_defconfig b/arch/arm/configs/tegra_defconfig
index 1effb43dab80..92d0a149aeb5 100644
--- a/arch/arm/configs/tegra_defconfig
+++ b/arch/arm/configs/tegra_defconfig
@@ -79,6 +79,7 @@ CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
 CONFIG_CMA=y
+CONFIG_DMA_CMA=y
 CONFIG_MTD=y
 CONFIG_MTD_M25P80=y
 CONFIG_PROC_DEVICETREE=y
diff --git a/arch/arm/include/asm/arch_timer.h b/arch/arm/include/asm/arch_timer.h
index e406d575c94f..5665134bfa3e 100644
--- a/arch/arm/include/asm/arch_timer.h
+++ b/arch/arm/include/asm/arch_timer.h
@@ -17,7 +17,8 @@ int arch_timer_arch_init(void);
  * nicely work out which register we want, and chuck away the rest of
  * the code. At least it does so with a recent GCC (4.6.3).
  */
-static inline void arch_timer_reg_write(const int access, const int reg, u32 val)
+static __always_inline
+void arch_timer_reg_write_cp15(int access, enum arch_timer_reg reg, u32 val)
 {
         if (access == ARCH_TIMER_PHYS_ACCESS) {
                 switch (reg) {
@@ -28,9 +29,7 @@ static inline void arch_timer_reg_write(const int access, const int reg, u32 val
                         asm volatile("mcr p15, 0, %0, c14, c2, 0" : : "r" (val));
                         break;
                 }
-        }
-
-        if (access == ARCH_TIMER_VIRT_ACCESS) {
+        } else if (access == ARCH_TIMER_VIRT_ACCESS) {
                 switch (reg) {
                 case ARCH_TIMER_REG_CTRL:
                         asm volatile("mcr p15, 0, %0, c14, c3, 1" : : "r" (val));
@@ -44,7 +43,8 @@ static inline void arch_timer_reg_write(const int access, const int reg, u32 val
         isb();
 }
 
-static inline u32 arch_timer_reg_read(const int access, const int reg)
+static __always_inline
+u32 arch_timer_reg_read_cp15(int access, enum arch_timer_reg reg)
 {
         u32 val = 0;
 
@@ -57,9 +57,7 @@ static inline u32 arch_timer_reg_read(const int access, const int reg)
                         asm volatile("mrc p15, 0, %0, c14, c2, 0" : "=r" (val));
                         break;
                 }
-        }
-
-        if (access == ARCH_TIMER_VIRT_ACCESS) {
+        } else if (access == ARCH_TIMER_VIRT_ACCESS) {
                 switch (reg) {
                 case ARCH_TIMER_REG_CTRL:
                         asm volatile("mrc p15, 0, %0, c14, c3, 1" : "=r" (val));
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index a5fef710af32..fcc1b5bf6979 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -220,9 +220,9 @@
 #ifdef CONFIG_SMP
 #if __LINUX_ARM_ARCH__ >= 7
         .ifeqs "\mode","arm"
-        ALT_SMP(dmb)
+        ALT_SMP(dmb     ish)
         .else
-        ALT_SMP(W(dmb))
+        ALT_SMP(W(dmb)  ish)
         .endif
 #elif __LINUX_ARM_ARCH__ == 6
         ALT_SMP(mcr     p15, 0, r0, c7, c10, 5) @ dmb
diff --git a/arch/arm/include/asm/barrier.h b/arch/arm/include/asm/barrier.h
index 8dcd9c702d90..60f15e274e6d 100644
--- a/arch/arm/include/asm/barrier.h
+++ b/arch/arm/include/asm/barrier.h
@@ -14,27 +14,27 @@
 #endif
 
 #if __LINUX_ARM_ARCH__ >= 7
-#define isb() __asm__ __volatile__ ("isb" : : : "memory")
-#define dsb() __asm__ __volatile__ ("dsb" : : : "memory")
-#define dmb() __asm__ __volatile__ ("dmb" : : : "memory")
+#define isb(option) __asm__ __volatile__ ("isb " #option : : : "memory")
+#define dsb(option) __asm__ __volatile__ ("dsb " #option : : : "memory")
+#define dmb(option) __asm__ __volatile__ ("dmb " #option : : : "memory")
 #elif defined(CONFIG_CPU_XSC3) || __LINUX_ARM_ARCH__ == 6
-#define isb() __asm__ __volatile__ ("mcr p15, 0, %0, c7, c5, 4" \
+#define isb(x) __asm__ __volatile__ ("mcr p15, 0, %0, c7, c5, 4" \
                                     : : "r" (0) : "memory")
-#define dsb() __asm__ __volatile__ ("mcr p15, 0, %0, c7, c10, 4" \
+#define dsb(x) __asm__ __volatile__ ("mcr p15, 0, %0, c7, c10, 4" \
                                     : : "r" (0) : "memory")
-#define dmb() __asm__ __volatile__ ("mcr p15, 0, %0, c7, c10, 5" \
+#define dmb(x) __asm__ __volatile__ ("mcr p15, 0, %0, c7, c10, 5" \
                                     : : "r" (0) : "memory")
 #elif defined(CONFIG_CPU_FA526)
-#define isb() __asm__ __volatile__ ("mcr p15, 0, %0, c7, c5, 4" \
+#define isb(x) __asm__ __volatile__ ("mcr p15, 0, %0, c7, c5, 4" \
                                     : : "r" (0) : "memory")
-#define dsb() __asm__ __volatile__ ("mcr p15, 0, %0, c7, c10, 4" \
+#define dsb(x) __asm__ __volatile__ ("mcr p15, 0, %0, c7, c10, 4" \
                                     : : "r" (0) : "memory")
-#define dmb() __asm__ __volatile__ ("" : : : "memory")
+#define dmb(x) __asm__ __volatile__ ("" : : : "memory")
 #else
-#define isb() __asm__ __volatile__ ("" : : : "memory")
-#define dsb() __asm__ __volatile__ ("mcr p15, 0, %0, c7, c10, 4" \
+#define isb(x) __asm__ __volatile__ ("" : : : "memory")
+#define dsb(x) __asm__ __volatile__ ("mcr p15, 0, %0, c7, c10, 4" \
                                     : : "r" (0) : "memory")
-#define dmb() __asm__ __volatile__ ("" : : : "memory")
+#define dmb(x) __asm__ __volatile__ ("" : : : "memory")
 #endif
 
 #ifdef CONFIG_ARCH_HAS_BARRIERS
@@ -42,7 +42,7 @@
 #elif defined(CONFIG_ARM_DMA_MEM_BUFFERABLE) || defined(CONFIG_SMP)
 #define mb()            do { dsb(); outer_sync(); } while (0)
 #define rmb()           dsb()
-#define wmb()           mb()
+#define wmb()           do { dsb(st); outer_sync(); } while (0)
 #else
 #define mb()            barrier()
 #define rmb()           barrier()
@@ -54,9 +54,9 @@
 #define smp_rmb()       barrier()
 #define smp_wmb()       barrier()
 #else
-#define smp_mb()        dmb()
-#define smp_rmb()       dmb()
-#define smp_wmb()       dmb()
+#define smp_mb()        dmb(ish)
+#define smp_rmb()       smp_mb()
+#define smp_wmb()       dmb(ishst)
 #endif
 
 #define read_barrier_depends()          do { } while(0)
diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
index 17d0ae8672fa..15f2d5bf8875 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -268,8 +268,7 @@ extern void flush_cache_page(struct vm_area_struct *vma, unsigned long user_addr
  * Harvard caches are synchronised for the user space address range.
  * This is used for the ARM private sys_cacheflush system call.
  */
-#define flush_cache_user_range(start,end) \
-        __cpuc_coherent_user_range((start) & PAGE_MASK, PAGE_ALIGN(end))
+#define flush_cache_user_range(s,e)     __cpuc_coherent_user_range(s,e)
 
 /*
  * Perform necessary cache operations to ensure that data previously
@@ -352,7 +351,7 @@ static inline void flush_cache_vmap(unsigned long start, unsigned long end)
                  * set_pte_at() called from vmap_pte_range() does not
                  * have a DSB after cleaning the cache line.
                  */
-                dsb();
+                dsb(ishst);
 }
 
 static inline void flush_cache_vunmap(unsigned long start, unsigned long end)
diff --git a/arch/arm/include/asm/dma-contiguous.h b/arch/arm/include/asm/dma-contiguous.h
index 3ed37b4d93da..e072bb2ba1b1 100644
--- a/arch/arm/include/asm/dma-contiguous.h
+++ b/arch/arm/include/asm/dma-contiguous.h
@@ -2,7 +2,7 @@
 #define ASMARM_DMA_CONTIGUOUS_H
 
 #ifdef __KERNEL__
-#ifdef CONFIG_CMA
+#ifdef CONFIG_DMA_CMA
 
 #include <linux/types.h>
 #include <asm-generic/dma-contiguous.h>
diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
index 56211f2084ef..f4b46d39b9cf 100644
--- a/arch/arm/include/asm/elf.h
+++ b/arch/arm/include/asm/elf.h
@@ -19,8 +19,6 @@ typedef elf_greg_t elf_gregset_t[ELF_NGREG];
 
 typedef struct user_fp elf_fpregset_t;
 
-#define EM_ARM  40
-
 #define EF_ARM_EABI_MASK        0xff000000
 #define EF_ARM_EABI_UNKNOWN     0x00000000
 #define EF_ARM_EABI_VER1        0x01000000
diff --git a/arch/arm/include/asm/hardware/debug-8250.S b/arch/arm/include/asm/hardware/debug-8250.S
deleted file mode 100644
index 22c689255e6e..000000000000
--- a/arch/arm/include/asm/hardware/debug-8250.S
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * arch/arm/include/asm/hardware/debug-8250.S
- *
- *  Copyright (C) 1994-1999 Russell King
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#include <linux/serial_reg.h>
-
-                .macro  senduart,rd,rx
-                strb    \rd, [\rx, #UART_TX << UART_SHIFT]
-                .endm
-
-                .macro  busyuart,rd,rx
-1002:           ldrb    \rd, [\rx, #UART_LSR << UART_SHIFT]
-                and     \rd, \rd, #UART_LSR_TEMT | UART_LSR_THRE
-                teq     \rd, #UART_LSR_TEMT | UART_LSR_THRE
-                bne     1002b
-                .endm
-
-                .macro  waituart,rd,rx
-#ifdef FLOW_CONTROL
-1001:           ldrb    \rd, [\rx, #UART_MSR << UART_SHIFT]
-                tst     \rd, #UART_MSR_CTS
-                beq     1001b
-#endif
-                .endm
diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
index 472ac7091003..9b28c41f4ba9 100644
--- a/arch/arm/include/asm/kvm_mmu.h
+++ b/arch/arm/include/asm/kvm_mmu.h
@@ -64,7 +64,7 @@ void kvm_clear_hyp_idmap(void);
 
 static inline void kvm_set_pte(pte_t *pte, pte_t new_pte)
 {
-        pte_val(*pte) = new_pte;
+        *pte = new_pte;
         /*
          * flush_pmd_entry just takes a void pointer and cleans the necessary
          * cache entries, so we can reuse the function for ptes.
diff --git a/arch/arm/include/asm/mach/arch.h b/arch/arm/include/asm/mach/arch.h
index 441efc491b50..69b879ac0289 100644
--- a/arch/arm/include/asm/mach/arch.h
+++ b/arch/arm/include/asm/mach/arch.h
@@ -65,12 +65,12 @@ struct machine_desc {
 /*
  * Current machine - only accessible during boot.
  */
-extern struct machine_desc *machine_desc;
+extern const struct machine_desc *machine_desc;
 
 /*
  * Machine type table - also only accessible during boot
  */
-extern struct machine_desc __arch_info_begin[], __arch_info_end[];
+extern const struct machine_desc __arch_info_begin[], __arch_info_end[];
 #define for_each_machine_desc(p)                        \
         for (p = __arch_info_begin; p < __arch_info_end; p++)
 
diff --git a/arch/arm/include/asm/memblock.h b/arch/arm/include/asm/memblock.h
index 00ca5f92648e..c2f5102ae659 100644
--- a/arch/arm/include/asm/memblock.h
+++ b/arch/arm/include/asm/memblock.h
@@ -4,8 +4,7 @@
 struct meminfo;
 struct machine_desc;
 
-extern void arm_memblock_init(struct meminfo *, struct machine_desc *);
-
+void arm_memblock_init(struct meminfo *, const struct machine_desc *);
 phys_addr_t arm_memblock_steal(phys_addr_t size, phys_addr_t align);
 
 #endif
diff --git a/arch/arm/include/asm/module.h b/arch/arm/include/asm/module.h
index 0d3a28dbc8e5..ed690c49ef93 100644
--- a/arch/arm/include/asm/module.h
+++ b/arch/arm/include/asm/module.h
@@ -12,6 +12,8 @@ enum {
         ARM_SEC_CORE,
         ARM_SEC_EXIT,
         ARM_SEC_DEVEXIT,
+        ARM_SEC_HOT,
+        ARM_SEC_UNLIKELY,
         ARM_SEC_MAX,
 };
 
diff --git a/arch/arm/include/asm/neon.h b/arch/arm/include/asm/neon.h
new file mode 100644
index 000000000000..8f730fe70093
--- /dev/null
+++ b/arch/arm/include/asm/neon.h
@@ -0,0 +1,36 @@
+/*
+ * linux/arch/arm/include/asm/neon.h
+ *
+ * Copyright (C) 2013 Linaro Ltd <ard.biesheuvel@linaro.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <asm/hwcap.h>
+
+#define cpu_has_neon()          (!!(elf_hwcap & HWCAP_NEON))
+
+#ifdef __ARM_NEON__
+
+/*
+ * If you are affected by the BUILD_BUG below, it probably means that you are
+ * using NEON code /and/ calling the kernel_neon_begin() function from the same
+ * compilation unit. To prevent issues that may arise from GCC reordering or
+ * generating(1) NEON instructions outside of these begin/end functions, the
+ * only supported way of using NEON code in the kernel is by isolating it in a
+ * separate compilation unit, and calling it from another unit from inside a
+ * kernel_neon_begin/kernel_neon_end pair.
+ *
+ * (1) Current GCC (4.7) might generate NEON instructions at O3 level if
+ *     -mpfu=neon is set.
+ */
+
+#define kernel_neon_begin() \
+        BUILD_BUG_ON_MSG(1, "kernel_neon_begin() called from NEON code")
+
+#else
+void kernel_neon_begin(void);
+#endif
+void kernel_neon_end(void);
diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
index 04aeb02d2e11..be956dbf6bae 100644
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -100,7 +100,7 @@ extern pgprot_t		pgprot_s2_device;
 #define PAGE_HYP                _MOD_PROT(pgprot_kernel, L_PTE_HYP)
 #define PAGE_HYP_DEVICE         _MOD_PROT(pgprot_hyp_device, L_PTE_HYP)
 #define PAGE_S2                 _MOD_PROT(pgprot_s2, L_PTE_S2_RDONLY)
-#define PAGE_S2_DEVICE          _MOD_PROT(pgprot_s2_device, L_PTE_USER | L_PTE_S2_RDONLY)
+#define PAGE_S2_DEVICE          _MOD_PROT(pgprot_s2_device, L_PTE_S2_RDWR)
 
 #define __PAGE_NONE             __pgprot(_L_PTE_DEFAULT | L_PTE_RDONLY | L_PTE_XN | L_PTE_NONE)
 #define __PAGE_SHARED           __pgprot(_L_PTE_DEFAULT | L_PTE_USER | L_PTE_XN)
diff --git a/arch/arm/include/asm/prom.h b/arch/arm/include/asm/prom.h
index a219227c3e43..4a2985e21969 100644
--- a/arch/arm/include/asm/prom.h
+++ b/arch/arm/include/asm/prom.h
@@ -15,13 +15,13 @@
 
 #ifdef CONFIG_OF
 
-extern struct machine_desc *setup_machine_fdt(unsigned int dt_phys);
+extern const struct machine_desc *setup_machine_fdt(unsigned int dt_phys);
 extern void arm_dt_memblock_reserve(void);
 extern void __init arm_dt_init_cpu_maps(void);
 
 #else /* CONFIG_OF */
 
-static inline struct machine_desc *setup_machine_fdt(unsigned int dt_phys)
+static inline const struct machine_desc *setup_machine_fdt(unsigned int dt_phys)
 {
         return NULL;
 }
diff --git a/arch/arm/include/asm/smp_plat.h b/arch/arm/include/asm/smp_plat.h
index 6462a721ebd4..a252c0bfacf5 100644
--- a/arch/arm/include/asm/smp_plat.h
+++ b/arch/arm/include/asm/smp_plat.h
@@ -88,4 +88,7 @@ static inline u32 mpidr_hash_size(void)
 {
         return 1 << mpidr_hash.bits;
 }
+
+extern int platform_can_cpu_hotplug(void);
+
 #endif
diff --git a/arch/arm/include/asm/spinlock.h b/arch/arm/include/asm/spinlock.h
index f8b8965666e9..4f2c28060c9a 100644
--- a/arch/arm/include/asm/spinlock.h
+++ b/arch/arm/include/asm/spinlock.h
@@ -46,7 +46,7 @@ static inline void dsb_sev(void)
 {
 #if __LINUX_ARM_ARCH__ >= 7
         __asm__ __volatile__ (
-                "dsb\n"
+                "dsb ishst\n"
                 SEV
         );
 #else
@@ -107,7 +107,7 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock)
                 "       subs    %1, %0, %0, ror #16\n"
                 "       addeq   %0, %0, %4\n"
                 "       strexeq %2, %0, [%3]"
-                : "=&r" (slock), "=&r" (contended), "=r" (res)
+                : "=&r" (slock), "=&r" (contended), "=&r" (res)
                 : "r" (&lock->slock), "I" (1 << TICKET_SHIFT)
                 : "cc");
         } while (res);
@@ -168,17 +168,20 @@ static inline void arch_write_lock(arch_rwlock_t *rw)
 
 static inline int arch_write_trylock(arch_rwlock_t *rw)
 {
-        unsigned long tmp;
+        unsigned long contended, res;
 
-        __asm__ __volatile__(
-"       ldrex   %0, [%1]\n"
-"       teq     %0, #0\n"
-"       strexeq %0, %2, [%1]"
-        : "=&r" (tmp)
-        : "r" (&rw->lock), "r" (0x80000000)
-        : "cc");
+        do {
+                __asm__ __volatile__(
+                "       ldrex   %0, [%2]\n"
+                "       mov     %1, #0\n"
+                "       teq     %0, #0\n"
+                "       strexeq %1, %3, [%2]"
+                : "=&r" (contended), "=&r" (res)
+                : "r" (&rw->lock), "r" (0x80000000)
+                : "cc");
+        } while (res);
 
-        if (tmp == 0) {
+        if (!contended) {
                 smp_mb();
                 return 1;
         } else {
@@ -254,18 +257,26 @@ static inline void arch_read_unlock(arch_rwlock_t *rw)
 
 static inline int arch_read_trylock(arch_rwlock_t *rw)
 {
-        unsigned long tmp, tmp2 = 1;
+        unsigned long contended, res;
 
-        __asm__ __volatile__(
-"       ldrex   %0, [%2]\n"
-"       adds    %0, %0, #1\n"
-"       strexpl %1, %0, [%2]\n"
-        : "=&r" (tmp), "+r" (tmp2)
-        : "r" (&rw->lock)
-        : "cc");
+        do {
+                __asm__ __volatile__(
+                "       ldrex   %0, [%2]\n"
+                "       mov     %1, #0\n"
+                "       adds    %0, %0, #1\n"
+                "       strexpl %1, %0, [%2]"
+                : "=&r" (contended), "=&r" (res)
+                : "r" (&rw->lock)
+                : "cc");
+        } while (res);
 
-        smp_mb();
-        return tmp2 == 0;
+        /* If the lock is negative, then it is already held for write. */
+        if (contended < 0x80000000) {
+                smp_mb();
+                return 1;
+        } else {
+                return 0;
+        }
 }
 
 /* read_can_lock - would read_trylock() succeed? */
diff --git a/arch/arm/include/asm/switch_to.h b/arch/arm/include/asm/switch_to.h
index fa09e6b49bf1..c99e259469f7 100644
--- a/arch/arm/include/asm/switch_to.h
+++ b/arch/arm/include/asm/switch_to.h
@@ -4,6 +4,16 @@
 #include <linux/thread_info.h>
 
 /*
+ * For v7 SMP cores running a preemptible kernel we may be pre-empted
+ * during a TLB maintenance operation, so execute an inner-shareable dsb
+ * to ensure that the maintenance completes in case we migrate to another
+ * CPU.
+ */
+#if defined(CONFIG_PREEMPT) && defined(CONFIG_SMP) && defined(CONFIG_CPU_V7)
+#define finish_arch_switch(prev)        dsb(ish)
+#endif
+
+/*
  * switch_to(prev, next) should switch from task `prev' to `next'
  * `prev' will never be the same as `next'.  schedule() itself
  * contains the memory barrier to tell GCC not to cache `current'.
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index 2b8114fcba09..df5e13d64f2c 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -43,6 +43,16 @@ struct cpu_context_save {
         __u32   extra[2];               /* Xscale 'acc' register, etc */
 };
 
+struct arm_restart_block {
+        union {
+                /* For user cache flushing */
+                struct {
+                        unsigned long start;
+                        unsigned long end;
+                } cache;
+        };
+};
+
 /*
  * low level task data that entry.S needs immediate access to.
  * __switch_to() assumes cpu_context follows immediately after cpu_domain.
@@ -68,6 +78,7 @@ struct thread_info {
         unsigned long           thumbee_state;  /* ThumbEE Handler Base register */
 #endif
         struct restart_block    restart_block;
+        struct arm_restart_block        arm_restart_block;
 };
 
 #define INIT_THREAD_INFO(tsk)                                           \
diff --git a/arch/arm/include/asm/tlb.h b/arch/arm/include/asm/tlb.h
index 46e7cfb3e721..0baf7f0d9394 100644
--- a/arch/arm/include/asm/tlb.h
+++ b/arch/arm/include/asm/tlb.h
@@ -43,6 +43,7 @@ struct mmu_gather {
         struct mm_struct        *mm;
         unsigned int            fullmm;
         struct vm_area_struct   *vma;
+        unsigned long           start, end;
         unsigned long           range_start;
         unsigned long           range_end;
         unsigned int            nr;
@@ -107,10 +108,12 @@ static inline void tlb_flush_mmu(struct mmu_gather *tlb)
 }
 
 static inline void
-tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned int fullmm)
+tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
 {
         tlb->mm = mm;
-        tlb->fullmm = fullmm;
+        tlb->fullmm = !(start | (end+1));
+        tlb->start = start;
+        tlb->end = end;
         tlb->vma = NULL;
         tlb->max = ARRAY_SIZE(tlb->local);
         tlb->pages = tlb->local;
diff --git a/arch/arm/include/asm/tlbflush.h b/arch/arm/include/asm/tlbflush.h
index f467e9b3f8d5..38960264040c 100644
--- a/arch/arm/include/asm/tlbflush.h
+++ b/arch/arm/include/asm/tlbflush.h
@@ -319,67 +319,110 @@ extern struct cpu_tlb_fns cpu_tlb;
 #define tlb_op(f, regs, arg)    __tlb_op(f, "p15, 0, %0, " regs, arg)
 #define tlb_l2_op(f, regs, arg) __tlb_op(f, "p15, 1, %0, " regs, arg)
 
-static inline void local_flush_tlb_all(void)
+static inline void __local_flush_tlb_all(void)
 {
         const int zero = 0;
         const unsigned int __tlb_flag = __cpu_tlb_flags;
 
-        if (tlb_flag(TLB_WB))
-                dsb();
-
         tlb_op(TLB_V4_U_FULL | TLB_V6_U_FULL, "c8, c7, 0", zero);
         tlb_op(TLB_V4_D_FULL | TLB_V6_D_FULL, "c8, c6, 0", zero);
         tlb_op(TLB_V4_I_FULL | TLB_V6_I_FULL, "c8, c5, 0", zero);
-        tlb_op(TLB_V7_UIS_FULL, "c8, c3, 0", zero);
+}
+
+static inline void local_flush_tlb_all(void)
+{
+        const int zero = 0;
+        const unsigned int __tlb_flag = __cpu_tlb_flags;
+
+        if (tlb_flag(TLB_WB))
+                dsb(nshst);
+
+        __local_flush_tlb_all();
+        tlb_op(TLB_V7_UIS_FULL, "c8, c7, 0", zero);
 
         if (tlb_flag(TLB_BARRIER)) {
-                dsb();
+                dsb(nsh);
                 isb();
         }
 }
 
-static inline void local_flush_tlb_mm(struct mm_struct *mm)
+static inline void __flush_tlb_all(void)
 {
         const int zero = 0;
-        const int asid = ASID(mm);
         const unsigned int __tlb_flag = __cpu_tlb_flags;
 
         if (tlb_flag(TLB_WB))
-                dsb();
+                dsb(ishst);
+
+        __local_flush_tlb_all();
+        tlb_op(TLB_V7_UIS_FULL, "c8, c3, 0", zero);
+
+        if (tlb_flag(TLB_BARRIER)) {
+                dsb(ish);
+                isb();
+        }
+}
+
+static inline void __local_flush_tlb_mm(struct mm_struct *mm)
+{
+        const int zero = 0;
+        const int asid = ASID(mm);
+        const unsigned int __tlb_flag = __cpu_tlb_flags;
 
         if (possible_tlb_flags & (TLB_V4_U_FULL|TLB_V4_D_FULL|TLB_V4_I_FULL)) {
-                if (cpumask_test_cpu(get_cpu(), mm_cpumask(mm))) {
+                if (cpumask_test_cpu(smp_processor_id(), mm_cpumask(mm))) {
                         tlb_op(TLB_V4_U_FULL, "c8, c7, 0", zero);
                         tlb_op(TLB_V4_D_FULL, "c8, c6, 0", zero);
                         tlb_op(TLB_V4_I_FULL, "c8, c5, 0", zero);
                 }
-                put_cpu();
         }
 
         tlb_op(TLB_V6_U_ASID, "c8, c7, 2", asid);
         tlb_op(TLB_V6_D_ASID, "c8, c6, 2", asid);
         tlb_op(TLB_V6_I_ASID, "c8, c5, 2", asid);
+}
+
+static inline void local_flush_tlb_mm(struct mm_struct *mm)
+{
+        const int asid = ASID(mm);
+        const unsigned int __tlb_flag = __cpu_tlb_flags;
+
+        if (tlb_flag(TLB_WB))
+                dsb(nshst);
+
+        __local_flush_tlb_mm(mm);
+        tlb_op(TLB_V7_UIS_ASID, "c8, c7, 2", asid);
+
+        if (tlb_flag(TLB_BARRIER))
+                dsb(nsh);
+}
+
+static inline void __flush_tlb_mm(struct mm_struct *mm)
+{
+        const unsigned int __tlb_flag = __cpu_tlb_flags;
+
+        if (tlb_flag(TLB_WB))
+                dsb(ishst);
+
+        __local_flush_tlb_mm(mm);
 #ifdef CONFIG_ARM_ERRATA_720789
-        tlb_op(TLB_V7_UIS_ASID, "c8, c3, 0", zero);
+        tlb_op(TLB_V7_UIS_ASID, "c8, c3, 0", 0);
 #else
-        tlb_op(TLB_V7_UIS_ASID, "c8, c3, 2", asid);
+        tlb_op(TLB_V7_UIS_ASID, "c8, c3, 2", ASID(mm));
 #endif
 
         if (tlb_flag(TLB_BARRIER))
-                dsb();
+                dsb(ish);
 }
 
 static inline void
-local_flush_tlb_page(struct vm_area_struct *vma, unsigned long uaddr)
+__local_flush_tlb_page(struct vm_area_struct *vma, unsigned long uaddr)
 {
         const int zero = 0;
         const unsigned int __tlb_flag = __cpu_tlb_flags;
 
         uaddr = (uaddr & PAGE_MASK) | ASID(vma->vm_mm);
 
-        if (tlb_flag(TLB_WB))
-                dsb();
-
         if (possible_tlb_flags & (TLB_V4_U_PAGE|TLB_V4_D_PAGE|TLB_V4_I_PAGE|TLB_V4_I_FULL) &&
             cpumask_test_cpu(smp_processor_id(), mm_cpumask(vma->vm_mm))) {
                 tlb_op(TLB_V4_U_PAGE, "c8, c7, 1", uaddr);
@@ -392,6 +435,36 @@ local_flush_tlb_page(struct vm_area_struct *vma, unsigned long uaddr)
         tlb_op(TLB_V6_U_PAGE, "c8, c7, 1", uaddr);
         tlb_op(TLB_V6_D_PAGE, "c8, c6, 1", uaddr);
         tlb_op(TLB_V6_I_PAGE, "c8, c5, 1", uaddr);
+}
+
+static inline void
+local_flush_tlb_page(struct vm_area_struct *vma, unsigned long uaddr)
+{
+        const unsigned int __tlb_flag = __cpu_tlb_flags;
+
+        uaddr = (uaddr & PAGE_MASK) | ASID(vma->vm_mm);
+
+        if (tlb_flag(TLB_WB))
+                dsb(nshst);
+
+        __local_flush_tlb_page(vma, uaddr);
+        tlb_op(TLB_V7_UIS_PAGE, "c8, c7, 1", uaddr);
+
+        if (tlb_flag(TLB_BARRIER))
+                dsb(nsh);
+}
+
+static inline void
+__flush_tlb_page(struct vm_area_struct *vma, unsigned long uaddr)
+{
+        const unsigned int __tlb_flag = __cpu_tlb_flags;
+
+        uaddr = (uaddr & PAGE_MASK) | ASID(vma->vm_mm);
+
+        if (tlb_flag(TLB_WB))
+                dsb(ishst);
+
+        __local_flush_tlb_page(vma, uaddr);
 #ifdef CONFIG_ARM_ERRATA_720789
         tlb_op(TLB_V7_UIS_PAGE, "c8, c3, 3", uaddr & PAGE_MASK);
 #else
@@ -399,19 +472,14 @@ local_flush_tlb_page(struct vm_area_struct *vma, unsigned long uaddr)
 #endif
 
         if (tlb_flag(TLB_BARRIER))
-                dsb();
+                dsb(ish);
 }
 
-static inline void local_flush_tlb_kernel_page(unsigned long kaddr)
+static inline void __local_flush_tlb_kernel_page(unsigned long kaddr)
 {
         const int zero = 0;
         const unsigned int __tlb_flag = __cpu_tlb_flags;
 
-        kaddr &= PAGE_MASK;
-
-        if (tlb_flag(TLB_WB))
-                dsb();
-
         tlb_op(TLB_V4_U_PAGE, "c8, c7, 1", kaddr);
         tlb_op(TLB_V4_D_PAGE, "c8, c6, 1", kaddr);
         tlb_op(TLB_V4_I_PAGE, "c8, c5, 1", kaddr);
@@ -421,26 +489,75 @@ static inline void local_flush_tlb_kernel_page(unsigned long kaddr)
         tlb_op(TLB_V6_U_PAGE, "c8, c7, 1", kaddr);
         tlb_op(TLB_V6_D_PAGE, "c8, c6, 1", kaddr);
         tlb_op(TLB_V6_I_PAGE, "c8, c5, 1", kaddr);
+}
+
+static inline void local_flush_tlb_kernel_page(unsigned long kaddr)
+{
+        const unsigned int __tlb_flag = __cpu_tlb_flags;
+
+        kaddr &= PAGE_MASK;
+
+        if (tlb_flag(TLB_WB))
+                dsb(nshst);
+
+        __local_flush_tlb_kernel_page(kaddr);
+        tlb_op(TLB_V7_UIS_PAGE, "c8, c7, 1", kaddr);
+
+        if (tlb_flag(TLB_BARRIER)) {
+                dsb(nsh);
+                isb();
+        }
+}
+
+static inline void __flush_tlb_kernel_page(unsigned long kaddr)
+{
+        const unsigned int __tlb_flag = __cpu_tlb_flags;
+
+        kaddr &= PAGE_MASK;
+
+        if (tlb_flag(TLB_WB))
+                dsb(ishst);
+
+        __local_flush_tlb_kernel_page(kaddr);
         tlb_op(TLB_V7_UIS_PAGE, "c8, c3, 1", kaddr);
 
         if (tlb_flag(TLB_BARRIER)) {
-                dsb();
+                dsb(ish);
                 isb();
         }
 }
 
+/*
+ * Branch predictor maintenance is paired with full TLB invalidation, so
+ * there is no need for any barriers here.
+ */
+static inline void __local_flush_bp_all(void)
+{
+        const int zero = 0;
+        const unsigned int __tlb_flag = __cpu_tlb_flags;
+
+        if (tlb_flag(TLB_V6_BP))
+                asm("mcr p15, 0, %0, c7, c5, 6" : : "r" (zero));
+}
+
 static inline void local_flush_bp_all(void)
 {
         const int zero = 0;
         const unsigned int __tlb_flag = __cpu_tlb_flags;
 
+        __local_flush_bp_all();
         if (tlb_flag(TLB_V7_UIS_BP))
-                asm("mcr p15, 0, %0, c7, c1, 6" : : "r" (zero));
-        else if (tlb_flag(TLB_V6_BP))
                 asm("mcr p15, 0, %0, c7, c5, 6" : : "r" (zero));
+}
 
-        if (tlb_flag(TLB_BARRIER))
-                isb();
+static inline void __flush_bp_all(void)
+{
+        const int zero = 0;
+        const unsigned int __tlb_flag = __cpu_tlb_flags;
+
+        __local_flush_bp_all();
+        if (tlb_flag(TLB_V7_UIS_BP))
+                asm("mcr p15, 0, %0, c7, c1, 6" : : "r" (zero));
 }
 
 #include <asm/cputype.h>
@@ -461,7 +578,7 @@ static inline void dummy_flush_tlb_a15_erratum(void)
          * Dummy TLBIMVAIS. Using the unmapped address 0 and ASID 0.
          */
         asm("mcr p15, 0, %0, c8, c3, 1" : : "r" (0));
-        dsb();
+        dsb(ish);
 }
 #else
 static inline int erratum_a15_798181(void)
@@ -495,7 +612,7 @@ static inline void flush_pmd_entry(void *pmd)
         tlb_l2_op(TLB_L2CLEAN_FR, "c15, c9, 1  @ L2 flush_pmd", pmd);
 
         if (tlb_flag(TLB_WB))
-                dsb();
+                dsb(ishst);
 }
 
 static inline void clean_pmd_entry(void *pmd)
diff --git a/arch/arm/include/asm/types.h b/arch/arm/include/asm/types.h
new file mode 100644
index 000000000000..a53cdb8f068c
--- /dev/null
+++ b/arch/arm/include/asm/types.h
@@ -0,0 +1,40 @@
+#ifndef _ASM_TYPES_H
+#define _ASM_TYPES_H
+
+#include <asm-generic/int-ll64.h>
+
+/*
+ * The C99 types uintXX_t that are usually defined in 'stdint.h' are not as
+ * unambiguous on ARM as you would expect. For the types below, there is a
+ * difference on ARM between GCC built for bare metal ARM, GCC built for glibc
+ * and the kernel itself, which results in build errors if you try to build with
+ * -ffreestanding and include 'stdint.h' (such as when you include 'arm_neon.h'
+ * in order to use NEON intrinsics)
+ *
+ * As the typedefs for these types in 'stdint.h' are based on builtin defines
+ * supplied by GCC, we can tweak these to align with the kernel's idea of those
+ * types, so 'linux/types.h' and 'stdint.h' can be safely included from the same
+ * source file (provided that -ffreestanding is used).
+ *
+ *                    int32_t         uint32_t               uintptr_t
+ * bare metal GCC     long            unsigned long          unsigned int
+ * glibc GCC          int             unsigned int           unsigned int
+ * kernel             int             unsigned int           unsigned long
+ */
+
+#ifdef __INT32_TYPE__
+#undef __INT32_TYPE__
+#define __INT32_TYPE__          int
+#endif
+
+#ifdef __UINT32_TYPE__
+#undef __UINT32_TYPE__
+#define __UINT32_TYPE__ unsigned int
+#endif
+
+#ifdef __UINTPTR_TYPE__
+#undef __UINTPTR_TYPE__
+#define __UINTPTR_TYPE__        unsigned long
+#endif
+
+#endif /* _ASM_TYPES_H */
diff --git a/arch/arm/include/asm/v7m.h b/arch/arm/include/asm/v7m.h
index fa88d09fa3d9..615781c61627 100644
--- a/arch/arm/include/asm/v7m.h
+++ b/arch/arm/include/asm/v7m.h
@@ -15,6 +15,10 @@
 
 #define V7M_SCB_VTOR                    0x08
 
+#define V7M_SCB_AIRCR                   0x0c
+#define V7M_SCB_AIRCR_VECTKEY                   (0x05fa << 16)
+#define V7M_SCB_AIRCR_SYSRESETREQ               (1 << 2)
+
 #define V7M_SCB_SCR                     0x10
 #define V7M_SCB_SCR_SLEEPDEEP                   (1 << 2)
 
@@ -42,3 +46,11 @@
  */
 #define EXC_RET_STACK_MASK                      0x00000004
 #define EXC_RET_THREADMODE_PROCESSSTACK         0xfffffffd
+
+#ifndef __ASSEMBLY__
+
+enum reboot_mode;
+
+void armv7m_restart(enum reboot_mode mode, const char *cmd);
+
+#endif /* __ASSEMBLY__ */
diff --git a/arch/arm/include/asm/xor.h b/arch/arm/include/asm/xor.h
index 7604673dc427..4ffb26d4cad8 100644
--- a/arch/arm/include/asm/xor.h
+++ b/arch/arm/include/asm/xor.h
@@ -7,7 +7,10 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#include <linux/hardirq.h>
 #include <asm-generic/xor.h>
+#include <asm/hwcap.h>
+#include <asm/neon.h>
 
 #define __XOR(a1, a2) a1 ^= a2
 
@@ -138,4 +141,74 @@ static struct xor_block_template xor_block_arm4regs = {
                 xor_speed(&xor_block_arm4regs); \
                 xor_speed(&xor_block_8regs);    \
                 xor_speed(&xor_block_32regs);   \
+                NEON_TEMPLATES;                 \
         } while (0)
+
+#ifdef CONFIG_KERNEL_MODE_NEON
+
+extern struct xor_block_template const xor_block_neon_inner;
+
+static void
+xor_neon_2(unsigned long bytes, unsigned long *p1, unsigned long *p2)
+{
+        if (in_interrupt()) {
+                xor_arm4regs_2(bytes, p1, p2);
+        } else {
+                kernel_neon_begin();
+                xor_block_neon_inner.do_2(bytes, p1, p2);
+                kernel_neon_end();
+        }
+}
+
+static void
+xor_neon_3(unsigned long bytes, unsigned long *p1, unsigned long *p2,
+                unsigned long *p3)
+{
+        if (in_interrupt()) {
+                xor_arm4regs_3(bytes, p1, p2, p3);
+        } else {
+                kernel_neon_begin();
+                xor_block_neon_inner.do_3(bytes, p1, p2, p3);
+                kernel_neon_end();
+        }
+}
+
+static void
+xor_neon_4(unsigned long bytes, unsigned long *p1, unsigned long *p2,
+                unsigned long *p3, unsigned long *p4)
+{
+        if (in_interrupt()) {
+                xor_arm4regs_4(bytes, p1, p2, p3, p4);
+        } else {
+                kernel_neon_begin();
+                xor_block_neon_inner.do_4(bytes, p1, p2, p3, p4);
+                kernel_neon_end();
+        }
+}
+
+static void
+xor_neon_5(unsigned long bytes, unsigned long *p1, unsigned long *p2,
+                unsigned long *p3, unsigned long *p4, unsigned long *p5)
+{
+        if (in_interrupt()) {
+                xor_arm4regs_5(bytes, p1, p2, p3, p4, p5);
+        } else {
+                kernel_neon_begin();
+                xor_block_neon_inner.do_5(bytes, p1, p2, p3, p4, p5);
+                kernel_neon_end();
+        }
+}
+
+static struct xor_block_template xor_block_neon = {
+        .name   = "neon",
+        .do_2   = xor_neon_2,
+        .do_3   = xor_neon_3,
+        .do_4   = xor_neon_4,
+        .do_5   = xor_neon_5
+};
+
+#define NEON_TEMPLATES  \
+        do { if (cpu_has_neon()) xor_speed(&xor_block_neon); } while (0)
+#else
+#define NEON_TEMPLATES
+#endif
diff --git a/arch/arm/include/debug/8250.S b/arch/arm/include/debug/8250.S
new file mode 100644
index 000000000000..7a2baf913aa0
--- /dev/null
+++ b/arch/arm/include/debug/8250.S
@@ -0,0 +1,54 @@
+/*
+ * arch/arm/include/debug/8250.S
+ *
+ *  Copyright (C) 1994-2013 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/serial_reg.h>
+
+                .macro  addruart, rp, rv, tmp
+                ldr     \rp, =CONFIG_DEBUG_UART_PHYS
+                ldr     \rv, =CONFIG_DEBUG_UART_VIRT
+                .endm
+
+#ifdef CONFIG_DEBUG_UART_8250_WORD
+                .macro  store, rd, rx:vararg
+                str     \rd, \rx
+                .endm
+
+                .macro  load, rd, rx:vararg
+                ldr     \rd, \rx
+                .endm
+#else
+                .macro  store, rd, rx:vararg
+                strb    \rd, \rx
+                .endm
+
+                .macro  load, rd, rx:vararg
+                ldrb    \rd, \rx
+                .endm
+#endif
+
+#define UART_SHIFT CONFIG_DEBUG_UART_8250_SHIFT
+
+                .macro  senduart,rd,rx
+                store   \rd, [\rx, #UART_TX << UART_SHIFT]
+                .endm
+
+                .macro  busyuart,rd,rx
+1002:           load    \rd, [\rx, #UART_LSR << UART_SHIFT]
+                and     \rd, \rd, #UART_LSR_TEMT | UART_LSR_THRE
+                teq     \rd, #UART_LSR_TEMT | UART_LSR_THRE
+                bne     1002b
+                .endm
+
+                .macro  waituart,rd,rx
+#ifdef CONFIG_DEBUG_UART_8250_FLOW_CONTROL
+1001:           load    \rd, [\rx, #UART_MSR << UART_SHIFT]
+                tst     \rd, #UART_MSR_CTS
+                beq     1001b
+#endif
+                .endm
diff --git a/arch/arm/include/debug/8250_32.S b/arch/arm/include/debug/8250_32.S
deleted file mode 100644
index 8db01eeabbb4..000000000000
--- a/arch/arm/include/debug/8250_32.S
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Copyright (c) 2011 Picochip Ltd., Jamie Iles
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * Derived from arch/arm/mach-davinci/include/mach/debug-macro.S to use 32-bit
- * accesses to the 8250.
- */
-
-#include <linux/serial_reg.h>
-
-                .macro  senduart,rd,rx
-                str     \rd, [\rx, #UART_TX << UART_SHIFT]
-                .endm
-
-                .macro  busyuart,rd,rx
-1002:           ldr     \rd, [\rx, #UART_LSR << UART_SHIFT]
-                and     \rd, \rd, #UART_LSR_TEMT | UART_LSR_THRE
-                teq     \rd, #UART_LSR_TEMT | UART_LSR_THRE
-                bne     1002b
-                .endm
-
-                /* The UART's don't have any flow control IO's wired up. */
-                .macro  waituart,rd,rx
-                .endm
diff --git a/arch/arm/include/debug/bcm2835.S b/arch/arm/include/debug/bcm2835.S
deleted file mode 100644
index aed9199bd847..000000000000
--- a/arch/arm/include/debug/bcm2835.S
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Debugging macro include header
- *
- * Copyright (C) 2010 Broadcom
- * Copyright (C) 1994-1999 Russell King
- * Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- */
-
-#define BCM2835_DEBUG_PHYS 0x20201000
-#define BCM2835_DEBUG_VIRT 0xf0201000
-
-        .macro  addruart, rp, rv, tmp
-        ldr     \rp, =BCM2835_DEBUG_PHYS
-        ldr     \rv, =BCM2835_DEBUG_VIRT
-        .endm
-
-#include <asm/hardware/debug-pl01x.S>
diff --git a/arch/arm/include/debug/cns3xxx.S b/arch/arm/include/debug/cns3xxx.S
deleted file mode 100644
index d04c150baa1c..000000000000
--- a/arch/arm/include/debug/cns3xxx.S
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Debugging macro include header
- *
- * Copyright 1994-1999 Russell King
- * Copyright 2008 Cavium Networks
- * Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * This file is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License, Version 2, as
- * published by the Free Software Foundation.
- */
-
-                .macro  addruart,rp,rv,tmp
-                mov     \rp, #0x00009000
-                orr     \rv, \rp, #0xf0000000   @ virtual base
-                orr     \rp, \rp, #0x10000000
-                .endm
-
-#include <asm/hardware/debug-pl01x.S>
diff --git a/arch/arm/include/debug/highbank.S b/arch/arm/include/debug/highbank.S
deleted file mode 100644
index 8cad4322a5a2..000000000000
--- a/arch/arm/include/debug/highbank.S
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Debugging macro include header
- *
- *  Copyright (C) 1994-1999 Russell King
- *  Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-                .macro  addruart,rp,rv,tmp
-                ldr     \rv, =0xfee36000
-                ldr     \rp, =0xfff36000
-                .endm
-
-#include <asm/hardware/debug-pl01x.S>
diff --git a/arch/arm/include/debug/keystone.S b/arch/arm/include/debug/keystone.S
deleted file mode 100644
index 9aef9ba3f4f0..000000000000
--- a/arch/arm/include/debug/keystone.S
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Early serial debug output macro for Keystone SOCs
- *
- * Copyright 2013 Texas Instruments, Inc.
- *      Santosh Shilimkar <santosh.shilimkar@ti.com>
- *
- * Based on RMKs low level debug code.
- *  Copyright (C) 1994-1999 Russell King
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/serial_reg.h>
-
-#define UART_SHIFT 2
-#if defined(CONFIG_DEBUG_KEYSTONE_UART0)
-#define UART_PHYS               0x02530c00
-#define UART_VIRT               0xfeb30c00
-#elif defined(CONFIG_DEBUG_KEYSTONE_UART1)
-#define UART_PHYS               0x02531000
-#define UART_VIRT               0xfeb31000
-#endif
-
-        .macro  addruart, rp, rv, tmp
-        ldr     \rv, =UART_VIRT                 @ physical base address
-        ldr     \rp, =UART_PHYS                 @ virtual base address
-        .endm
-
-        .macro  senduart,rd,rx
-        str     \rd, [\rx, #UART_TX << UART_SHIFT]
-        .endm
-
-        .macro  busyuart,rd,rx
-1002:   ldr     \rd, [\rx, #UART_LSR << UART_SHIFT]
-        and     \rd, \rd, #UART_LSR_TEMT | UART_LSR_THRE
-        teq     \rd, #UART_LSR_TEMT | UART_LSR_THRE
-        bne     1002b
-        .endm
-
-        .macro  waituart,rd,rx
-        .endm
diff --git a/arch/arm/include/debug/mvebu.S b/arch/arm/include/debug/mvebu.S
deleted file mode 100644
index 6517311a1c91..000000000000
--- a/arch/arm/include/debug/mvebu.S
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Early serial output macro for Marvell  SoC
- *
- * Copyright (C) 2012 Marvell
- *
- * Lior Amsalem <alior@marvell.com>
- * Gregory Clement <gregory.clement@free-electrons.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
-*/
-
-#ifdef CONFIG_DEBUG_MVEBU_UART_ALTERNATE
-#define ARMADA_370_XP_REGS_PHYS_BASE    0xf1000000
-#else
-#define ARMADA_370_XP_REGS_PHYS_BASE    0xd0000000
-#endif
-
-#define ARMADA_370_XP_REGS_VIRT_BASE    0xfec00000
-
-        .macro  addruart, rp, rv, tmp
-        ldr     \rp, =ARMADA_370_XP_REGS_PHYS_BASE
-        ldr     \rv, =ARMADA_370_XP_REGS_VIRT_BASE
-        orr     \rp, \rp, #0x00012000
-        orr     \rv, \rv, #0x00012000
-        .endm
-
-#define UART_SHIFT      2
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/include/debug/mxs.S b/arch/arm/include/debug/mxs.S
deleted file mode 100644
index d86951551ca1..000000000000
--- a/arch/arm/include/debug/mxs.S
+++ /dev/null
@@ -1,27 +0,0 @@
-/* arch/arm/mach-mxs/include/mach/debug-macro.S
- *
- * Debugging macro include header
- *
- *  Copyright (C) 1994-1999 Russell King
- *  Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- */
-
-#ifdef CONFIG_DEBUG_IMX23_UART
-#define UART_PADDR      0x80070000
-#elif defined (CONFIG_DEBUG_IMX28_UART)
-#define UART_PADDR      0x80074000
-#endif
-
-#define UART_VADDR      0xfe100000
-
-                .macro  addruart, rp, rv, tmp
-                ldr     \rp, =UART_PADDR        @ physical
-                ldr     \rv, =UART_VADDR        @ virtual
-                .endm
-
-#include <asm/hardware/debug-pl01x.S>
diff --git a/arch/arm/include/debug/nomadik.S b/arch/arm/include/debug/nomadik.S
deleted file mode 100644
index 735417922ce2..000000000000
--- a/arch/arm/include/debug/nomadik.S
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Debugging macro include header
- *
- *  Copyright (C) 1994-1999 Russell King
- *  Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
-*/
-
-                .macro  addruart, rp, rv, tmp
-                mov     \rp, #0x00100000
-                add     \rp, \rp, #0x000fb000
-                add     \rv, \rp, #0xf0000000   @ virtual base
-                add     \rp, \rp, #0x10000000   @ physical base address
-                .endm
-
-#include <asm/hardware/debug-pl01x.S>
diff --git a/arch/arm/include/debug/nspire.S b/arch/arm/include/debug/nspire.S
deleted file mode 100644
index 886fd276fcbc..000000000000
--- a/arch/arm/include/debug/nspire.S
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- *      linux/arch/arm/include/debug/nspire.S
- *
- *      Copyright (C) 2013 Daniel Tang <tangrs@tangrs.id.au>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2, as
- * published by the Free Software Foundation.
- *
- */
-
-#define NSPIRE_EARLY_UART_PHYS_BASE        0x90020000
-#define NSPIRE_EARLY_UART_VIRT_BASE        0xfee20000
-
-.macro  addruart, rp, rv, tmp
-        ldr \rp, =(NSPIRE_EARLY_UART_PHYS_BASE)         @ physical base address
-        ldr \rv, =(NSPIRE_EARLY_UART_VIRT_BASE)         @ virtual base address
-.endm
-
-
-#ifdef CONFIG_DEBUG_NSPIRE_CX_UART
-#include <asm/hardware/debug-pl01x.S>
-#endif
-
-#ifdef CONFIG_DEBUG_NSPIRE_CLASSIC_UART
-#define UART_SHIFT 2
-#include <asm/hardware/debug-8250.S>
-#endif
diff --git a/arch/arm/include/debug/picoxcell.S b/arch/arm/include/debug/picoxcell.S
deleted file mode 100644
index bc1f07c49cd4..000000000000
--- a/arch/arm/include/debug/picoxcell.S
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright (c) 2011 Picochip Ltd., Jamie Iles
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- */
-
-#define UART_SHIFT 2
-#define PICOXCELL_UART1_BASE            0x80230000
-#define PHYS_TO_IO(x)                   (((x) & 0x00ffffff) | 0xfe000000)
-
-                .macro  addruart, rp, rv, tmp
-                ldr     \rv, =PHYS_TO_IO(PICOXCELL_UART1_BASE)
-                ldr     \rp, =PICOXCELL_UART1_BASE
-                .endm
-
-#include "8250_32.S"
diff --git a/arch/arm/include/asm/hardware/debug-pl01x.S b/arch/arm/include/debug/pl01x.S
index f9fd083eff63..37c6895b87e6 100644
--- a/arch/arm/include/asm/hardware/debug-pl01x.S
+++ b/arch/arm/include/debug/pl01x.S
@@ -1,4 +1,4 @@
-/* arch/arm/include/asm/hardware/debug-pl01x.S
+/* arch/arm/include/debug/pl01x.S
  *
  * Debugging macro include header
  *
@@ -12,6 +12,13 @@
 */
 #include <linux/amba/serial.h>
 
+#ifdef CONFIG_DEBUG_UART_PHYS
+                .macro  addruart, rp, rv, tmp
+                ldr     \rp, =CONFIG_DEBUG_UART_PHYS
+                ldr     \rv, =CONFIG_DEBUG_UART_VIRT
+                .endm
+#endif
+
                 .macro  senduart,rd,rx
                 strb    \rd, [\rx, #UART01x_DR]
                 .endm
diff --git a/arch/arm/include/debug/pxa.S b/arch/arm/include/debug/pxa.S
deleted file mode 100644
index e1e795aa3d7f..000000000000
--- a/arch/arm/include/debug/pxa.S
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Early serial output macro for Marvell PXA/MMP SoC
- *
- * Copyright (C) 1994-1999 Russell King
- * Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * Copyright (C) 2013 Haojian Zhuang
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
-*/
-
-#if defined(CONFIG_DEBUG_PXA_UART1)
-#define PXA_UART_REG_PHYS_BASE  0x40100000
-#define PXA_UART_REG_VIRT_BASE  0xf2100000
-#elif defined(CONFIG_DEBUG_MMP_UART2)
-#define PXA_UART_REG_PHYS_BASE  0xd4017000
-#define PXA_UART_REG_VIRT_BASE  0xfe017000
-#elif defined(CONFIG_DEBUG_MMP_UART3)
-#define PXA_UART_REG_PHYS_BASE  0xd4018000
-#define PXA_UART_REG_VIRT_BASE  0xfe018000
-#else
-#error "Select uart for DEBUG_LL"
-#endif
-
-        .macro  addruart, rp, rv, tmp
-        ldr     \rp, =PXA_UART_REG_PHYS_BASE
-        ldr     \rv, =PXA_UART_REG_VIRT_BASE
-        .endm
-
-#define UART_SHIFT      2
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/include/debug/rockchip.S b/arch/arm/include/debug/rockchip.S
deleted file mode 100644
index cfd883e69588..000000000000
--- a/arch/arm/include/debug/rockchip.S
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Early serial output macro for Rockchip SoCs
- *
- * Copyright (C) 2012 Maxime Ripard
- *
- * Maxime Ripard <maxime.ripard@free-electrons.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
-*/
-
-#if defined(CONFIG_DEBUG_RK29_UART0)
-#define ROCKCHIP_UART_DEBUG_PHYS_BASE 0x20060000
-#define ROCKCHIP_UART_DEBUG_VIRT_BASE 0xfed60000
-#elif defined(CONFIG_DEBUG_RK29_UART1)
-#define ROCKCHIP_UART_DEBUG_PHYS_BASE 0x20064000
-#define ROCKCHIP_UART_DEBUG_VIRT_BASE 0xfed64000
-#elif defined(CONFIG_DEBUG_RK29_UART2)
-#define ROCKCHIP_UART_DEBUG_PHYS_BASE 0x20068000
-#define ROCKCHIP_UART_DEBUG_VIRT_BASE 0xfed68000
-#elif defined(CONFIG_DEBUG_RK3X_UART0)
-#define ROCKCHIP_UART_DEBUG_PHYS_BASE 0x10124000
-#define ROCKCHIP_UART_DEBUG_VIRT_BASE 0xfeb24000
-#elif defined(CONFIG_DEBUG_RK3X_UART1)
-#define ROCKCHIP_UART_DEBUG_PHYS_BASE 0x10126000
-#define ROCKCHIP_UART_DEBUG_VIRT_BASE 0xfeb26000
-#elif defined(CONFIG_DEBUG_RK3X_UART2)
-#define ROCKCHIP_UART_DEBUG_PHYS_BASE 0x20064000
-#define ROCKCHIP_UART_DEBUG_VIRT_BASE 0xfed64000
-#elif defined(CONFIG_DEBUG_RK3X_UART3)
-#define ROCKCHIP_UART_DEBUG_PHYS_BASE 0x20068000
-#define ROCKCHIP_UART_DEBUG_VIRT_BASE 0xfed68000
-#endif
-
-        .macro  addruart, rp, rv, tmp
-        ldr     \rp, =ROCKCHIP_UART_DEBUG_PHYS_BASE
-        ldr     \rv, =ROCKCHIP_UART_DEBUG_VIRT_BASE
-        .endm
-
-#define UART_SHIFT      2
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/include/debug/socfpga.S b/arch/arm/include/debug/socfpga.S
deleted file mode 100644
index 966b2f994946..000000000000
--- a/arch/arm/include/debug/socfpga.S
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- *  Copyright (C) 1994-1999 Russell King
- *  Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#define UART_SHIFT 2
-#define DEBUG_LL_UART_OFFSET    0x00002000
-
-                .macro  addruart, rp, rv, tmp
-                mov     \rp, #DEBUG_LL_UART_OFFSET
-                orr     \rp, \rp, #0x00c00000
-                orr     \rv, \rp, #0xfe000000   @ virtual base
-                orr     \rp, \rp, #0xff000000   @ physical base
-                .endm
-
-#include "8250_32.S"
-
diff --git a/arch/arm/include/debug/sunxi.S b/arch/arm/include/debug/sunxi.S
deleted file mode 100644
index 04eb56d5db2c..000000000000
--- a/arch/arm/include/debug/sunxi.S
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Early serial output macro for Allwinner A1X SoCs
- *
- * Copyright (C) 2012 Maxime Ripard
- *
- * Maxime Ripard <maxime.ripard@free-electrons.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
-*/
-
-#if defined(CONFIG_DEBUG_SUNXI_UART0)
-#define SUNXI_UART_DEBUG_PHYS_BASE 0x01c28000
-#define SUNXI_UART_DEBUG_VIRT_BASE 0xf1c28000
-#elif defined(CONFIG_DEBUG_SUNXI_UART1)
-#define SUNXI_UART_DEBUG_PHYS_BASE 0x01c28400
-#define SUNXI_UART_DEBUG_VIRT_BASE 0xf1c28400
-#endif
-
-        .macro  addruart, rp, rv, tmp
-        ldr     \rp, =SUNXI_UART_DEBUG_PHYS_BASE
-        ldr     \rv, =SUNXI_UART_DEBUG_VIRT_BASE
-        .endm
-
-#define UART_SHIFT      2
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/include/debug/tegra.S b/arch/arm/include/debug/tegra.S
index 883d7c22fd9d..be6a720dd183 100644
--- a/arch/arm/include/debug/tegra.S
+++ b/arch/arm/include/debug/tegra.S
@@ -221,3 +221,32 @@
 1002:
 #endif
                 .endm
+
+/*
+ * Storage for the state maintained by the macros above.
+ *
+ * In the kernel proper, this data is located in arch/arm/mach-tegra/common.c.
+ * That's because this header is included from multiple files, and we only
+ * want a single copy of the data. In particular, the UART probing code above
+ * assumes it's running using physical addresses. This is true when this file
+ * is included from head.o, but not when included from debug.o. So we need
+ * to share the probe results between the two copies, rather than having
+ * to re-run the probing again later.
+ *
+ * In the decompressor, we put the symbol/storage right here, since common.c
+ * isn't included in the decompressor build. This symbol gets put in .text
+ * even though it's really data, since .data is discarded from the
+ * decompressor. Luckily, .text is writeable in the decompressor, unless
+ * CONFIG_ZBOOT_ROM. That dependency is handled in arch/arm/Kconfig.debug.
+ */
+#if defined(ZIMAGE)
+tegra_uart_config:
+        /* Debug UART initialization required */
+        .word 1
+        /* Debug UART physical address */
+        .word 0
+        /* Debug UART virtual address */
+        .word 0
+        /* Scratch space for debug macro */
+        .word 0
+#endif
diff --git a/arch/arm/include/debug/u300.S b/arch/arm/include/debug/u300.S
deleted file mode 100644
index 6f04f08a203c..000000000000
--- a/arch/arm/include/debug/u300.S
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright (C) 2006-2013 ST-Ericsson AB
- * License terms: GNU General Public License (GPL) version 2
- * Debugging macro include header.
- * Author: Linus Walleij <linus.walleij@stericsson.com>
- */
-#define U300_SLOW_PER_PHYS_BASE         0xc0010000
-#define U300_SLOW_PER_VIRT_BASE         0xff000000
-
-        .macro  addruart, rp, rv, tmp
-        /* If we move the address using MMU, use this. */
-        ldr     \rp,      = U300_SLOW_PER_PHYS_BASE @ MMU off, physical address
-        ldr     \rv,      = U300_SLOW_PER_VIRT_BASE @ MMU on, virtual address
-        orr     \rp, \rp, #0x00003000
-        orr     \rv, \rv, #0x00003000
-        .endm
-
-#include <asm/hardware/debug-pl01x.S>
diff --git a/arch/arm/include/debug/ux500.S b/arch/arm/include/debug/ux500.S
index fbd24beeb1fa..aa7f63a8b5e0 100644
--- a/arch/arm/include/debug/ux500.S
+++ b/arch/arm/include/debug/ux500.S
@@ -45,4 +45,4 @@
         ldr     \rv, =UART_VIRT_BASE            @ yes, virtual address
         .endm
 
-#include <asm/hardware/debug-pl01x.S>
+#include <debug/pl01x.S>
diff --git a/arch/arm/include/debug/vexpress.S b/arch/arm/include/debug/vexpress.S
index acafb229e2b6..524acd5a223e 100644
--- a/arch/arm/include/debug/vexpress.S
+++ b/arch/arm/include/debug/vexpress.S
@@ -47,51 +47,5 @@
 
                 .endm
 
-#include <asm/hardware/debug-pl01x.S>
-
-#elif defined(CONFIG_DEBUG_VEXPRESS_UART0_CA9)
-
-                .macro  addruart,rp,rv,tmp
-                mov     \rp, #DEBUG_LL_UART_OFFSET
-                orr     \rv, \rp, #DEBUG_LL_VIRT_BASE
-                orr     \rp, \rp, #DEBUG_LL_PHYS_BASE
-                .endm
-
-#include <asm/hardware/debug-pl01x.S>
-
-#elif defined(CONFIG_DEBUG_VEXPRESS_UART0_RS1)
-
-                .macro  addruart,rp,rv,tmp
-                mov     \rp, #DEBUG_LL_UART_OFFSET_RS1
-                orr     \rv, \rp, #DEBUG_LL_VIRT_BASE
-                orr     \rp, \rp, #DEBUG_LL_PHYS_BASE_RS1
-                .endm
-
-#include <asm/hardware/debug-pl01x.S>
-
-#elif defined(CONFIG_DEBUG_VEXPRESS_UART0_CRX)
-
-                .macro  addruart,rp,tmp,tmp2
-                ldr     \rp, =DEBUG_LL_UART_PHYS_CRX
-                .endm
-
-#include <asm/hardware/debug-pl01x.S>
-
-#else /* CONFIG_DEBUG_LL_UART_NONE */
-
-                .macro  addruart, rp, rv, tmp
-                /* Safe dummy values */
-                mov     \rp, #0
-                mov     \rv, #DEBUG_LL_VIRT_BASE
-                .endm
-
-                .macro  senduart,rd,rx
-                .endm
-
-                .macro  waituart,rd,rx
-                .endm
-
-                .macro  busyuart,rd,rx
-                .endm
-
+#include <debug/pl01x.S>
 #endif
diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile
index 86d10dd47dc4..5140df5f23aa 100644
--- a/arch/arm/kernel/Makefile
+++ b/arch/arm/kernel/Makefile
@@ -24,7 +24,7 @@ obj-$(CONFIG_ATAGS_PROC)	+= atags_proc.o
 obj-$(CONFIG_DEPRECATED_PARAM_STRUCT) += atags_compat.o
 
 ifeq ($(CONFIG_CPU_V7M),y)
-obj-y           += entry-v7m.o
+obj-y           += entry-v7m.o v7m.o
 else
 obj-y           += entry-armv.o
 endif
diff --git a/arch/arm/kernel/atags.h b/arch/arm/kernel/atags.h
index 9edc9692332d..ec4164da6e30 100644
--- a/arch/arm/kernel/atags.h
+++ b/arch/arm/kernel/atags.h
@@ -7,9 +7,10 @@ static inline void save_atags(struct tag *tags) { }
 void convert_to_tag_list(struct tag *tags);
 
 #ifdef CONFIG_ATAGS
-struct machine_desc *setup_machine_tags(phys_addr_t __atags_pointer, unsigned int machine_nr);
+const struct machine_desc *setup_machine_tags(phys_addr_t __atags_pointer,
+        unsigned int machine_nr);
 #else
-static inline struct machine_desc *
+static inline const struct machine_desc *
 setup_machine_tags(phys_addr_t __atags_pointer, unsigned int machine_nr)
 {
         early_print("no ATAGS support: can't continue\n");
diff --git a/arch/arm/kernel/atags_parse.c b/arch/arm/kernel/atags_parse.c
index 14512e6931d8..8c14de8180c0 100644
--- a/arch/arm/kernel/atags_parse.c
+++ b/arch/arm/kernel/atags_parse.c
@@ -178,11 +178,11 @@ static void __init squash_mem_tags(struct tag *tag)
                         tag->hdr.tag = ATAG_NONE;
 }
 
-struct machine_desc * __init setup_machine_tags(phys_addr_t __atags_pointer,
-                                                unsigned int machine_nr)
+const struct machine_desc * __init
+setup_machine_tags(phys_addr_t __atags_pointer, unsigned int machine_nr)
 {
         struct tag *tags = (struct tag *)&default_tags;
-        struct machine_desc *mdesc = NULL, *p;
+        const struct machine_desc *mdesc = NULL, *p;
         char *from = default_command_line;
 
         default_tags.mem.start = PHYS_OFFSET;
diff --git a/arch/arm/kernel/bios32.c b/arch/arm/kernel/bios32.c
index 261fcc826169..88e14d74b6de 100644
--- a/arch/arm/kernel/bios32.c
+++ b/arch/arm/kernel/bios32.c
@@ -525,11 +525,6 @@ void pci_common_init_dev(struct device *parent, struct hw_pci *hw)
                          * Assign resources.
                          */
                         pci_bus_assign_resources(bus);
-
-                        /*
-                         * Enable bridges
-                         */
-                        pci_enable_bridges(bus);
                 }
 
                 /*
diff --git a/arch/arm/kernel/devtree.c b/arch/arm/kernel/devtree.c
index 5859c8bc727c..f35906b3d8c9 100644
--- a/arch/arm/kernel/devtree.c
+++ b/arch/arm/kernel/devtree.c
@@ -169,6 +169,11 @@ void __init arm_dt_init_cpu_maps(void)
         }
 }
 
+bool arch_match_cpu_phys_id(int cpu, u64 phys_id)
+{
+        return (phys_id & MPIDR_HWID_BITMASK) == cpu_logical_map(cpu);
+}
+
 /**
  * setup_machine_fdt - Machine setup when an dtb was passed to the kernel
  * @dt_phys: physical address of dt blob
@@ -176,10 +181,10 @@ void __init arm_dt_init_cpu_maps(void)
  * If a dtb was passed to the kernel in r2, then use it to choose the
  * correct machine_desc and to setup the system.
  */
-struct machine_desc * __init setup_machine_fdt(unsigned int dt_phys)
+const struct machine_desc * __init setup_machine_fdt(unsigned int dt_phys)
 {
         struct boot_param_header *devtree;
-        struct machine_desc *mdesc, *mdesc_best = NULL;
+        const struct machine_desc *mdesc, *mdesc_best = NULL;
         unsigned int score, mdesc_score = ~1;
         unsigned long dt_root;
         const char *model;
@@ -188,7 +193,7 @@ struct machine_desc * __init setup_machine_fdt(unsigned int dt_phys)
         DT_MACHINE_START(GENERIC_DT, "Generic DT based system")
         MACHINE_END
 
-        mdesc_best = (struct machine_desc *)&__mach_desc_GENERIC_DT;
+        mdesc_best = &__mach_desc_GENERIC_DT;
 #endif
 
         if (!dt_phys)
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index d40d0ef389db..9cbe70c8b0ef 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -357,7 +357,8 @@ ENDPROC(__pabt_svc)
         .endm
 
         .macro  kuser_cmpxchg_check
-#if !defined(CONFIG_CPU_32v6K) && !defined(CONFIG_NEEDS_SYSCALL_FOR_CMPXCHG)
+#if !defined(CONFIG_CPU_32v6K) && defined(CONFIG_KUSER_HELPERS) && \
+    !defined(CONFIG_NEEDS_SYSCALL_FOR_CMPXCHG)
 #ifndef CONFIG_MMU
 #warning "NPTL on non MMU needs fixing"
 #else
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index 94104bf69719..74ad15d1a065 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -442,10 +442,10 @@ local_restart:
         ldrcc   pc, [tbl, scno, lsl #2]         @ call sys_* routine
 
         add     r1, sp, #S_OFF
-2:      mov     why, #0                         @ no longer a real syscall
         cmp     scno, #(__ARM_NR_BASE - __NR_SYSCALL_BASE)
         eor     r0, scno, #__NR_SYSCALL_BASE    @ put OS number back
-        bcs     arm_syscall     
+        bcs     arm_syscall
+2:      mov     why, #0                         @ no longer a real syscall
         b       sys_ni_syscall                  @ not private func
 
 #if defined(CONFIG_OABI_COMPAT) || !defined(CONFIG_AEABI)
diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
index 25442f451148..918875d96d5d 100644
--- a/arch/arm/kernel/fiq.c
+++ b/arch/arm/kernel/fiq.c
@@ -84,17 +84,14 @@ int show_fiq_list(struct seq_file *p, int prec)
 
 void set_fiq_handler(void *start, unsigned int length)
 {
-#if defined(CONFIG_CPU_USE_DOMAINS)
-        void *base = (void *)0xffff0000;
-#else
         void *base = vectors_page;
-#endif
         unsigned offset = FIQ_OFFSET;
 
         memcpy(base + offset, start, length);
+        if (!cache_is_vipt_nonaliasing())
+                flush_icache_range((unsigned long)base + offset, offset +
+                                   length);
         flush_icache_range(0xffff0000 + offset, 0xffff0000 + offset + length);
-        if (!vectors_high())
-                flush_icache_range(offset, offset + length);
 }
 
 int claim_fiq(struct fiq_handler *f)
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index 4fb074c446bf..57221e349a7c 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -15,6 +15,7 @@
 #include <asm/mmu_context.h>
 #include <asm/cacheflush.h>
 #include <asm/mach-types.h>
+#include <asm/smp_plat.h>
 #include <asm/system_misc.h>
 
 extern const unsigned char relocate_new_kernel[];
@@ -39,6 +40,14 @@ int machine_kexec_prepare(struct kimage *image)
         int i, err;
 
         /*
+         * Validate that if the current HW supports SMP, then the SW supports
+         * and implements CPU hotplug for the current HW. If not, we won't be
+         * able to kexec reliably, so fail the prepare operation.
+         */
+        if (num_possible_cpus() > 1 && !platform_can_cpu_hotplug())
+                return -EINVAL;
+
+        /*
          * No segment at default ATAGs address. try to locate
          * a dtb using magic.
          */
@@ -73,6 +82,7 @@ void machine_crash_nonpanic_core(void *unused)
         crash_save_cpu(&regs, smp_processor_id());
         flush_cache_all();
 
+        set_cpu_online(smp_processor_id(), false);
         atomic_dec(&waiting_for_crash_ipi);
         while (1)
                 cpu_relax();
@@ -134,10 +144,13 @@ void machine_kexec(struct kimage *image)
         unsigned long reboot_code_buffer_phys;
         void *reboot_code_buffer;
 
-        if (num_online_cpus() > 1) {
-                pr_err("kexec: error: multiple CPUs still online\n");
-                return;
-        }
+        /*
+         * This can only happen if machine_shutdown() failed to disable some
+         * CPU, and that can only happen if the checks in
+         * machine_kexec_prepare() were not correct. If this fails, we can't
+         * reliably kexec anyway, so BUG_ON is appropriate.
+         */
+        BUG_ON(num_online_cpus() > 1);
 
         page_list = image->head & PAGE_MASK;
 
diff --git a/arch/arm/kernel/module.c b/arch/arm/kernel/module.c
index 85c3fb6c93c2..084dc8896986 100644
--- a/arch/arm/kernel/module.c
+++ b/arch/arm/kernel/module.c
@@ -292,12 +292,20 @@ int module_finalize(const Elf32_Ehdr *hdr, const Elf_Shdr *sechdrs,
                         maps[ARM_SEC_CORE].unw_sec = s;
                 else if (strcmp(".ARM.exidx.exit.text", secname) == 0)
                         maps[ARM_SEC_EXIT].unw_sec = s;
+                else if (strcmp(".ARM.exidx.text.unlikely", secname) == 0)
+                        maps[ARM_SEC_UNLIKELY].unw_sec = s;
+                else if (strcmp(".ARM.exidx.text.hot", secname) == 0)
+                        maps[ARM_SEC_HOT].unw_sec = s;
                 else if (strcmp(".init.text", secname) == 0)
                         maps[ARM_SEC_INIT].txt_sec = s;
                 else if (strcmp(".text", secname) == 0)
                         maps[ARM_SEC_CORE].txt_sec = s;
                 else if (strcmp(".exit.text", secname) == 0)
                         maps[ARM_SEC_EXIT].txt_sec = s;
+                else if (strcmp(".text.unlikely", secname) == 0)
+                        maps[ARM_SEC_UNLIKELY].txt_sec = s;
+                else if (strcmp(".text.hot", secname) == 0)
+                        maps[ARM_SEC_HOT].txt_sec = s;
         }
 
         for (i = 0; i < ARM_SEC_MAX; i++)
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index d9f5cd4e533f..e186ee1e63f6 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -53,7 +53,12 @@ armpmu_map_cache_event(const unsigned (*cache_map)
 static int
 armpmu_map_hw_event(const unsigned (*event_map)[PERF_COUNT_HW_MAX], u64 config)
 {
-        int mapping = (*event_map)[config];
+        int mapping;
+
+        if (config >= PERF_COUNT_HW_MAX)
+                return -EINVAL;
+
+        mapping = (*event_map)[config];
         return mapping == HW_OP_UNSUPPORTED ? -ENOENT : mapping;
 }
 
@@ -253,6 +258,9 @@ validate_event(struct pmu_hw_events *hw_events,
         struct arm_pmu *armpmu = to_arm_pmu(event->pmu);
         struct pmu *leader_pmu = event->group_leader->pmu;
 
+        if (is_software_event(event))
+                return 1;
+
         if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF)
                 return 1;
 
diff --git a/arch/arm/kernel/perf_event_cpu.c b/arch/arm/kernel/perf_event_cpu.c
index aebe0e99c153..8d6147b2001f 100644
--- a/arch/arm/kernel/perf_event_cpu.c
+++ b/arch/arm/kernel/perf_event_cpu.c
@@ -118,7 +118,8 @@ static int cpu_pmu_request_irq(struct arm_pmu *cpu_pmu, irq_handler_t handler)
                         continue;
                 }
 
-                err = request_irq(irq, handler, IRQF_NOBALANCING, "arm-pmu",
+                err = request_irq(irq, handler,
+                                  IRQF_NOBALANCING | IRQF_NO_THREAD, "arm-pmu",
                                   cpu_pmu);
                 if (err) {
                         pr_err("unable to request IRQ%d for ARM PMU counters\n",
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 536c85fe72a8..94f6b05f9e24 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -462,7 +462,7 @@ int in_gate_area_no_mm(unsigned long addr)
 {
         return in_gate_area(NULL, addr);
 }
-#define is_gate_vma(vma)        ((vma) = &gate_vma)
+#define is_gate_vma(vma)        ((vma) == &gate_vma)
 #else
 #define is_gate_vma(vma)        0
 #endif
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index afc2489ee13b..0e1e2b3afa45 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -72,10 +72,10 @@ static int __init fpe_setup(char *line)
 __setup("fpe=", fpe_setup);
 #endif
 
-extern void paging_init(struct machine_desc *desc);
+extern void paging_init(const struct machine_desc *desc);
 extern void sanity_check_meminfo(void);
 extern enum reboot_mode reboot_mode;
-extern void setup_dma_zone(struct machine_desc *desc);
+extern void setup_dma_zone(const struct machine_desc *desc);
 
 unsigned int processor_id;
 EXPORT_SYMBOL(processor_id);
@@ -139,7 +139,7 @@ EXPORT_SYMBOL(elf_platform);
 static const char *cpu_name;
 static const char *machine_name;
 static char __initdata cmd_line[COMMAND_LINE_SIZE];
-struct machine_desc *machine_desc __initdata;
+const struct machine_desc *machine_desc __initdata;
 
 static union { char c[4]; unsigned long l; } endian_test __initdata = { { 'l', '?', '?', 'b' } };
 #define ENDIANNESS ((char)endian_test.l)
@@ -607,7 +607,7 @@ static void __init setup_processor(void)
 
 void __init dump_machine_table(void)
 {
-        struct machine_desc *p;
+        const struct machine_desc *p;
 
         early_print("Available machine support:\n\nID (hex)\tNAME\n");
         for_each_machine_desc(p)
@@ -694,7 +694,7 @@ static int __init early_mem(char *p)
 }
 early_param("mem", early_mem);
 
-static void __init request_standard_resources(struct machine_desc *mdesc)
+static void __init request_standard_resources(const struct machine_desc *mdesc)
 {
         struct memblock_region *region;
         struct resource *res;
@@ -852,7 +852,7 @@ void __init hyp_mode_check(void)
 
 void __init setup_arch(char **cmdline_p)
 {
-        struct machine_desc *mdesc;
+        const struct machine_desc *mdesc;
 
         setup_processor();
         mdesc = setup_machine_fdt(__atags_pointer);
@@ -994,15 +994,6 @@ static int c_show(struct seq_file *m, void *v)
                 seq_printf(m, "model name\t: %s rev %d (%s)\n",
                            cpu_name, cpuid & 15, elf_platform);
 
-#if defined(CONFIG_SMP)
-                seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
-                           per_cpu(cpu_data, i).loops_per_jiffy / (500000UL/HZ),
-                           (per_cpu(cpu_data, i).loops_per_jiffy / (5000UL/HZ)) % 100);
-#else
-                seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
-                           loops_per_jiffy / (500000/HZ),
-                           (loops_per_jiffy / (5000/HZ)) % 100);
-#endif
                 /* dump out the processor features */
                 seq_puts(m, "Features\t: ");
 
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 3a98192a3118..72024ea8a3a6 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -144,6 +144,16 @@ int boot_secondary(unsigned int cpu, struct task_struct *idle)
         return -ENOSYS;
 }
 
+int platform_can_cpu_hotplug(void)
+{
+#ifdef CONFIG_HOTPLUG_CPU
+        if (smp_ops.cpu_kill)
+                return 1;
+#endif
+
+        return 0;
+}
+
 #ifdef CONFIG_HOTPLUG_CPU
 static int platform_cpu_kill(unsigned int cpu)
 {
@@ -373,17 +383,8 @@ asmlinkage void secondary_start_kernel(void)
 
 void __init smp_cpus_done(unsigned int max_cpus)
 {
-        int cpu;
-        unsigned long bogosum = 0;
-
-        for_each_online_cpu(cpu)
-                bogosum += per_cpu(cpu_data, cpu).loops_per_jiffy;
-
-        printk(KERN_INFO "SMP: Total of %d processors activated "
-               "(%lu.%02lu BogoMIPS).\n",
-               num_online_cpus(),
-               bogosum / (500000/HZ),
-               (bogosum / (5000/HZ)) % 100);
+        printk(KERN_INFO "SMP: Total of %d processors activated.\n",
+               num_online_cpus());
 
         hyp_mode_check();
 }
diff --git a/arch/arm/kernel/smp_tlb.c b/arch/arm/kernel/smp_tlb.c
index c2edfff573c2..83ccca303df8 100644
--- a/arch/arm/kernel/smp_tlb.c
+++ b/arch/arm/kernel/smp_tlb.c
@@ -104,7 +104,7 @@ void flush_tlb_all(void)
         if (tlb_ops_need_broadcast())
                 on_each_cpu(ipi_flush_tlb_all, NULL, 1);
         else
-                local_flush_tlb_all();
+                __flush_tlb_all();
         broadcast_tlb_a15_erratum();
 }
 
@@ -113,7 +113,7 @@ void flush_tlb_mm(struct mm_struct *mm)
         if (tlb_ops_need_broadcast())
                 on_each_cpu_mask(mm_cpumask(mm), ipi_flush_tlb_mm, mm, 1);
         else
-                local_flush_tlb_mm(mm);
+                __flush_tlb_mm(mm);
         broadcast_tlb_mm_a15_erratum(mm);
 }
 
@@ -126,7 +126,7 @@ void flush_tlb_page(struct vm_area_struct *vma, unsigned long uaddr)
                 on_each_cpu_mask(mm_cpumask(vma->vm_mm), ipi_flush_tlb_page,
                                         &ta, 1);
         } else
-                local_flush_tlb_page(vma, uaddr);
+                __flush_tlb_page(vma, uaddr);
         broadcast_tlb_mm_a15_erratum(vma->vm_mm);
 }
 
@@ -137,7 +137,7 @@ void flush_tlb_kernel_page(unsigned long kaddr)
                 ta.ta_start = kaddr;
                 on_each_cpu(ipi_flush_tlb_kernel_page, &ta, 1);
         } else
-                local_flush_tlb_kernel_page(kaddr);
+                __flush_tlb_kernel_page(kaddr);
         broadcast_tlb_a15_erratum();
 }
 
@@ -173,5 +173,5 @@ void flush_bp_all(void)
         if (tlb_ops_need_broadcast())
                 on_each_cpu(ipi_flush_bp_all, NULL, 1);
         else
-                local_flush_bp_all();
+                __flush_bp_all();
 }
diff --git a/arch/arm/kernel/topology.c b/arch/arm/kernel/topology.c
index c5a59546a256..85a87370f144 100644
--- a/arch/arm/kernel/topology.c
+++ b/arch/arm/kernel/topology.c
@@ -74,12 +74,8 @@ struct cpu_efficiency table_efficiency[] = {
         {NULL, },
 };
 
-struct cpu_capacity {
-        unsigned long hwid;
-        unsigned long capacity;
-};
-
-struct cpu_capacity *cpu_capacity;
+unsigned long *__cpu_capacity;
+#define cpu_capacity(cpu)       __cpu_capacity[cpu]
 
 unsigned long middle_capacity = 1;
 
@@ -100,15 +96,19 @@ static void __init parse_dt_topology(void)
         unsigned long capacity = 0;
         int alloc_size, cpu = 0;
 
-        alloc_size = nr_cpu_ids * sizeof(struct cpu_capacity);
-        cpu_capacity = kzalloc(alloc_size, GFP_NOWAIT);
+        alloc_size = nr_cpu_ids * sizeof(*__cpu_capacity);
+        __cpu_capacity = kzalloc(alloc_size, GFP_NOWAIT);
 
-        while ((cn = of_find_node_by_type(cn, "cpu"))) {
-                const u32 *rate, *reg;
+        for_each_possible_cpu(cpu) {
+                const u32 *rate;
                 int len;
 
-                if (cpu >= num_possible_cpus())
-                        break;
+                /* too early to use cpu->of_node */
+                cn = of_get_cpu_node(cpu, NULL);
+                if (!cn) {
+                        pr_err("missing device node for CPU %d\n", cpu);
+                        continue;
+                }
 
                 for (cpu_eff = table_efficiency; cpu_eff->compatible; cpu_eff++)
                         if (of_device_is_compatible(cn, cpu_eff->compatible))
@@ -124,12 +124,6 @@ static void __init parse_dt_topology(void)
                         continue;
                 }
 
-                reg = of_get_property(cn, "reg", &len);
-                if (!reg || len != 4) {
-                        pr_err("%s missing reg property\n", cn->full_name);
-                        continue;
-                }
-
                 capacity = ((be32_to_cpup(rate)) >> 20) * cpu_eff->efficiency;
 
                 /* Save min capacity of the system */
@@ -140,13 +134,9 @@ static void __init parse_dt_topology(void)
                 if (capacity > max_capacity)
                         max_capacity = capacity;
 
-                cpu_capacity[cpu].capacity = capacity;
-                cpu_capacity[cpu++].hwid = be32_to_cpup(reg);
+                cpu_capacity(cpu) = capacity;
         }
 
-        if (cpu < num_possible_cpus())
-                cpu_capacity[cpu].hwid = (unsigned long)(-1);
-
         /* If min and max capacities are equals, we bypass the update of the
          * cpu_scale because all CPUs have the same capacity. Otherwise, we
          * compute a middle_capacity factor that will ensure that the capacity
@@ -154,9 +144,7 @@ static void __init parse_dt_topology(void)
          * SCHED_POWER_SCALE, which is the default value, but with the
          * constraint explained near table_efficiency[].
          */
-        if (min_capacity == max_capacity)
-                cpu_capacity[0].hwid = (unsigned long)(-1);
-        else if (4*max_capacity < (3*(max_capacity + min_capacity)))
+        if (4*max_capacity < (3*(max_capacity + min_capacity)))
                 middle_capacity = (min_capacity + max_capacity)
                                 >> (SCHED_POWER_SHIFT+1);
         else
@@ -170,23 +158,12 @@ static void __init parse_dt_topology(void)
  * boot. The update of all CPUs is in O(n^2) for heteregeneous system but the
  * function returns directly for SMP system.
  */
-void update_cpu_power(unsigned int cpu, unsigned long hwid)
+void update_cpu_power(unsigned int cpu)
 {
-        unsigned int idx = 0;
-
-        /* look for the cpu's hwid in the cpu capacity table */
-        for (idx = 0; idx < num_possible_cpus(); idx++) {
-                if (cpu_capacity[idx].hwid == hwid)
-                        break;
-
-                if (cpu_capacity[idx].hwid == -1)
-                        return;
-        }
-
-        if (idx == num_possible_cpus())
+        if (!cpu_capacity(cpu))
                 return;
 
-        set_power_scale(cpu, cpu_capacity[idx].capacity / middle_capacity);
+        set_power_scale(cpu, cpu_capacity(cpu) / middle_capacity);
 
         printk(KERN_INFO "CPU%u: update cpu_power %lu\n",
                 cpu, arch_scale_freq_power(NULL, cpu));
@@ -194,7 +171,7 @@ void update_cpu_power(unsigned int cpu, unsigned long hwid)
 
 #else
 static inline void parse_dt_topology(void) {}
-static inline void update_cpu_power(unsigned int cpuid, unsigned int mpidr) {}
+static inline void update_cpu_power(unsigned int cpuid) {}
 #endif
 
  /*
@@ -281,7 +258,7 @@ void store_cpu_topology(unsigned int cpuid)
 
         update_siblings_masks(cpuid);
 
-        update_cpu_power(cpuid, mpidr & MPIDR_HWID_BITMASK);
+        update_cpu_power(cpuid);
 
         printk(KERN_INFO "CPU%u: thread %d, cpu %d, socket %d, mpidr %x\n",
                 cpuid, cpu_topology[cpuid].thread_id,
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index ab517fcce21b..8fcda140358d 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -497,28 +497,64 @@ static int bad_syscall(int n, struct pt_regs *regs)
         return regs->ARM_r0;
 }
 
+static long do_cache_op_restart(struct restart_block *);
+
 static inline int
-do_cache_op(unsigned long start, unsigned long end, int flags)
+__do_cache_op(unsigned long start, unsigned long end)
 {
-        struct mm_struct *mm = current->active_mm;
-        struct vm_area_struct *vma;
+        int ret;
+        unsigned long chunk = PAGE_SIZE;
+
+        do {
+                if (signal_pending(current)) {
+                        struct thread_info *ti = current_thread_info();
+
+                        ti->restart_block = (struct restart_block) {
+                                .fn     = do_cache_op_restart,
+                        };
+
+                        ti->arm_restart_block = (struct arm_restart_block) {
+                                {
+                                        .cache = {
+                                                .start  = start,
+                                                .end    = end,
+                                        },
+                                },
+                        };
+
+                        return -ERESTART_RESTARTBLOCK;
+                }
+
+                ret = flush_cache_user_range(start, start + chunk);
+                if (ret)
+                        return ret;
 
+                cond_resched();
+                start += chunk;
+        } while (start < end);
+
+        return 0;
+}
+
+static long do_cache_op_restart(struct restart_block *unused)
+{
+        struct arm_restart_block *restart_block;
+
+        restart_block = &current_thread_info()->arm_restart_block;
+        return __do_cache_op(restart_block->cache.start,
+                             restart_block->cache.end);
+}
+
+static inline int
+do_cache_op(unsigned long start, unsigned long end, int flags)
+{
         if (end < start || flags)
                 return -EINVAL;
 
-        down_read(&mm->mmap_sem);
-        vma = find_vma(mm, start);
-        if (vma && vma->vm_start < end) {
-                if (start < vma->vm_start)
-                        start = vma->vm_start;
-                if (end > vma->vm_end)
-                        end = vma->vm_end;
+        if (!access_ok(VERIFY_READ, start, end - start))
+                return -EFAULT;
 
-                up_read(&mm->mmap_sem);
-                return flush_cache_user_range(start, end);
-        }
-        up_read(&mm->mmap_sem);
-        return -EINVAL;
+        return __do_cache_op(start, end);
 }
 
 /*
diff --git a/arch/arm/kernel/v7m.c b/arch/arm/kernel/v7m.c
new file mode 100644
index 000000000000..4d2cba94f5cc
--- /dev/null
+++ b/arch/arm/kernel/v7m.c
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) 2013 Uwe Kleine-Koenig for Pengutronix
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License version 2 as published by the
+ * Free Software Foundation.
+ */
+#include <linux/io.h>
+#include <linux/reboot.h>
+#include <asm/barrier.h>
+#include <asm/v7m.h>
+
+void armv7m_restart(enum reboot_mode mode, const char *cmd)
+{
+        dsb();
+        __raw_writel(V7M_SCB_AIRCR_VECTKEY | V7M_SCB_AIRCR_SYSRESETREQ,
+                        BASEADDR_V7M_SCB + V7M_SCB_AIRCR);
+        dsb();
+}
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index 741f66a2edbd..9c697db2787e 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -219,6 +219,10 @@ long kvm_arch_dev_ioctl(struct file *filp,
         return -EINVAL;
 }
 
+void kvm_arch_memslots_updated(struct kvm *kvm)
+{
+}
+
 int kvm_arch_prepare_memory_region(struct kvm *kvm,
                                    struct kvm_memory_slot *memslot,
                                    struct kvm_userspace_memory_region *mem,
diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
index 4a5199070430..db9cf692d4dd 100644
--- a/arch/arm/kvm/coproc.c
+++ b/arch/arm/kvm/coproc.c
@@ -146,7 +146,11 @@ static bool pm_fake(struct kvm_vcpu *vcpu,
 #define access_pmintenclr pm_fake
 
 /* Architected CP15 registers.
- * Important: Must be sorted ascending by CRn, CRM, Op1, Op2
+ * CRn denotes the primary register number, but is copied to the CRm in the
+ * user space API for 64-bit register access in line with the terminology used
+ * in the ARM ARM.
+ * Important: Must be sorted ascending by CRn, CRM, Op1, Op2 and with 64-bit
+ *            registers preceding 32-bit ones.
  */
 static const struct coproc_reg cp15_regs[] = {
         /* CSSELR: swapped by interrupt.S. */
@@ -154,8 +158,8 @@ static const struct coproc_reg cp15_regs[] = {
                         NULL, reset_unknown, c0_CSSELR },
 
         /* TTBR0/TTBR1: swapped by interrupt.S. */
-        { CRm( 2), Op1( 0), is64, NULL, reset_unknown64, c2_TTBR0 },
-        { CRm( 2), Op1( 1), is64, NULL, reset_unknown64, c2_TTBR1 },
+        { CRm64( 2), Op1( 0), is64, NULL, reset_unknown64, c2_TTBR0 },
+        { CRm64( 2), Op1( 1), is64, NULL, reset_unknown64, c2_TTBR1 },
 
         /* TTBCR: swapped by interrupt.S. */
         { CRn( 2), CRm( 0), Op1( 0), Op2( 2), is32,
@@ -182,7 +186,7 @@ static const struct coproc_reg cp15_regs[] = {
                         NULL, reset_unknown, c6_IFAR },
 
         /* PAR swapped by interrupt.S */
-        { CRn( 7), Op1( 0), is64, NULL, reset_unknown64, c7_PAR },
+        { CRm64( 7), Op1( 0), is64, NULL, reset_unknown64, c7_PAR },
 
         /*
          * DC{C,I,CI}SW operations:
@@ -399,12 +403,13 @@ static bool index_to_params(u64 id, struct coproc_params *params)
                               | KVM_REG_ARM_OPC1_MASK))
                         return false;
                 params->is_64bit = true;
-                params->CRm = ((id & KVM_REG_ARM_CRM_MASK)
+                /* CRm to CRn: see cp15_to_index for details */
+                params->CRn = ((id & KVM_REG_ARM_CRM_MASK)
                                >> KVM_REG_ARM_CRM_SHIFT);
                 params->Op1 = ((id & KVM_REG_ARM_OPC1_MASK)
                                >> KVM_REG_ARM_OPC1_SHIFT);
                 params->Op2 = 0;
-                params->CRn = 0;
+                params->CRm = 0;
                 return true;
         default:
                 return false;
@@ -898,7 +903,14 @@ static u64 cp15_to_index(const struct coproc_reg *reg)
         if (reg->is_64) {
                 val |= KVM_REG_SIZE_U64;
                 val |= (reg->Op1 << KVM_REG_ARM_OPC1_SHIFT);
-                val |= (reg->CRm << KVM_REG_ARM_CRM_SHIFT);
+                /*
+                 * CRn always denotes the primary coproc. reg. nr. for the
+                 * in-kernel representation, but the user space API uses the
+                 * CRm for the encoding, because it is modelled after the
+                 * MRRC/MCRR instructions: see the ARM ARM rev. c page
+                 * B3-1445
+                 */
+                val |= (reg->CRn << KVM_REG_ARM_CRM_SHIFT);
         } else {
                 val |= KVM_REG_SIZE_U32;
                 val |= (reg->Op1 << KVM_REG_ARM_OPC1_SHIFT);
diff --git a/arch/arm/kvm/coproc.h b/arch/arm/kvm/coproc.h
index b7301d3e4799..0461d5c8d3de 100644
--- a/arch/arm/kvm/coproc.h
+++ b/arch/arm/kvm/coproc.h
@@ -135,6 +135,8 @@ static inline int cmp_reg(const struct coproc_reg *i1,
                 return -1;
         if (i1->CRn != i2->CRn)
                 return i1->CRn - i2->CRn;
+        if (i1->is_64 != i2->is_64)
+                return i2->is_64 - i1->is_64;
         if (i1->CRm != i2->CRm)
                 return i1->CRm - i2->CRm;
         if (i1->Op1 != i2->Op1)
@@ -145,6 +147,7 @@ static inline int cmp_reg(const struct coproc_reg *i1,
 
 #define CRn(_x)         .CRn = _x
 #define CRm(_x)         .CRm = _x
+#define CRm64(_x)       .CRn = _x, .CRm = 0
 #define Op1(_x)         .Op1 = _x
 #define Op2(_x)         .Op2 = _x
 #define is64            .is_64 = true
diff --git a/arch/arm/kvm/coproc_a15.c b/arch/arm/kvm/coproc_a15.c
index 685063a6d0cf..cf93472b9dd6 100644
--- a/arch/arm/kvm/coproc_a15.c
+++ b/arch/arm/kvm/coproc_a15.c
@@ -114,7 +114,11 @@ static bool access_l2ectlr(struct kvm_vcpu *vcpu,
 
 /*
  * A15-specific CP15 registers.
- * Important: Must be sorted ascending by CRn, CRM, Op1, Op2
+ * CRn denotes the primary register number, but is copied to the CRm in the
+ * user space API for 64-bit register access in line with the terminology used
+ * in the ARM ARM.
+ * Important: Must be sorted ascending by CRn, CRM, Op1, Op2 and with 64-bit
+ *            registers preceding 32-bit ones.
  */
 static const struct coproc_reg a15_regs[] = {
         /* MPIDR: we use VMPIDR for guest access. */
diff --git a/arch/arm/kvm/init.S b/arch/arm/kvm/init.S
index f048338135f7..1b9844d369cc 100644
--- a/arch/arm/kvm/init.S
+++ b/arch/arm/kvm/init.S
@@ -142,7 +142,7 @@ target:	@ We're now in the trampoline code, switch page tables
 
         @ Invalidate the old TLBs
         mcr     p15, 4, r0, c8, c7, 0   @ TLBIALLH
-        dsb
+        dsb     ish
 
         eret
 
diff --git a/arch/arm/kvm/interrupts.S b/arch/arm/kvm/interrupts.S
index 16cd4ba5d7fd..ddc15539bad2 100644
--- a/arch/arm/kvm/interrupts.S
+++ b/arch/arm/kvm/interrupts.S
@@ -55,7 +55,7 @@ ENTRY(__kvm_tlb_flush_vmid_ipa)
         mcrr    p15, 6, r2, r3, c2      @ Write VTTBR
         isb
         mcr     p15, 0, r0, c8, c3, 0   @ TLBIALLIS (rt ignored)
-        dsb
+        dsb     ish
         isb
         mov     r2, #0
         mov     r3, #0
@@ -79,7 +79,7 @@ ENTRY(__kvm_flush_vm_context)
         mcr     p15, 4, r0, c8, c3, 4
         /* Invalidate instruction caches Inner Shareable (ICIALLUIS) */
         mcr     p15, 0, r0, c7, c1, 0
-        dsb
+        dsb     ish
         isb                             @ Not necessary if followed by eret
 
         bx      lr
@@ -492,10 +492,10 @@ __kvm_hyp_code_end:
         .section ".rodata"
 
 und_die_str:
-        .ascii  "unexpected undefined exception in Hyp mode at: %#08x"
+        .ascii  "unexpected undefined exception in Hyp mode at: %#08x\n"
 pabt_die_str:
-        .ascii  "unexpected prefetch abort in Hyp mode at: %#08x"
+        .ascii  "unexpected prefetch abort in Hyp mode at: %#08x\n"
 dabt_die_str:
-        .ascii  "unexpected data abort in Hyp mode at: %#08x"
+        .ascii  "unexpected data abort in Hyp mode at: %#08x\n"
 svc_die_str:
-        .ascii  "unexpected HVC/SVC trap in Hyp mode at: %#08x"
+        .ascii  "unexpected HVC/SVC trap in Hyp mode at: %#08x\n"
diff --git a/arch/arm/kvm/mmio.c b/arch/arm/kvm/mmio.c
index b8e06b7a2833..0c25d9487d53 100644
--- a/arch/arm/kvm/mmio.c
+++ b/arch/arm/kvm/mmio.c
@@ -63,7 +63,8 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run)
 static int decode_hsr(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
                       struct kvm_exit_mmio *mmio)
 {
-        unsigned long rt, len;
+        unsigned long rt;
+        int len;
         bool is_write, sign_extend;
 
         if (kvm_vcpu_dabt_isextabt(vcpu)) {
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index ca6bea4859b4..b0de86b56c13 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -85,6 +85,12 @@ static void *mmu_memory_cache_alloc(struct kvm_mmu_memory_cache *mc)
         return p;
 }
 
+static bool page_empty(void *ptr)
+{
+        struct page *ptr_page = virt_to_page(ptr);
+        return page_count(ptr_page) == 1;
+}
+
 static void clear_pud_entry(struct kvm *kvm, pud_t *pud, phys_addr_t addr)
 {
         pmd_t *pmd_table = pmd_offset(pud, 0);
@@ -103,12 +109,6 @@ static void clear_pmd_entry(struct kvm *kvm, pmd_t *pmd, phys_addr_t addr)
         put_page(virt_to_page(pmd));
 }
 
-static bool pmd_empty(pmd_t *pmd)
-{
-        struct page *pmd_page = virt_to_page(pmd);
-        return page_count(pmd_page) == 1;
-}
-
 static void clear_pte_entry(struct kvm *kvm, pte_t *pte, phys_addr_t addr)
 {
         if (pte_present(*pte)) {
@@ -118,12 +118,6 @@ static void clear_pte_entry(struct kvm *kvm, pte_t *pte, phys_addr_t addr)
         }
 }
 
-static bool pte_empty(pte_t *pte)
-{
-        struct page *pte_page = virt_to_page(pte);
-        return page_count(pte_page) == 1;
-}
-
 static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
                         unsigned long long start, u64 size)
 {
@@ -132,37 +126,37 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
         pmd_t *pmd;
         pte_t *pte;
         unsigned long long addr = start, end = start + size;
-        u64 range;
+        u64 next;
 
         while (addr < end) {
                 pgd = pgdp + pgd_index(addr);
                 pud = pud_offset(pgd, addr);
                 if (pud_none(*pud)) {
-                        addr += PUD_SIZE;
+                        addr = pud_addr_end(addr, end);
                         continue;
                 }
 
                 pmd = pmd_offset(pud, addr);
                 if (pmd_none(*pmd)) {
-                        addr += PMD_SIZE;
+                        addr = pmd_addr_end(addr, end);
                         continue;
                 }
 
                 pte = pte_offset_kernel(pmd, addr);
                 clear_pte_entry(kvm, pte, addr);
-                range = PAGE_SIZE;
+                next = addr + PAGE_SIZE;
 
                 /* If we emptied the pte, walk back up the ladder */
-                if (pte_empty(pte)) {
+                if (page_empty(pte)) {
                         clear_pmd_entry(kvm, pmd, addr);
-                        range = PMD_SIZE;
-                        if (pmd_empty(pmd)) {
+                        next = pmd_addr_end(addr, end);
+                        if (page_empty(pmd) && !page_empty(pud)) {
                                 clear_pud_entry(kvm, pud, addr);
-                                range = PUD_SIZE;
+                                next = pud_addr_end(addr, end);
                         }
                 }
 
-                addr += range;
+                addr = next;
         }
 }
 
@@ -495,7 +489,6 @@ int kvm_phys_addr_ioremap(struct kvm *kvm, phys_addr_t guest_ipa,
 
         for (addr = guest_ipa; addr < end; addr += PAGE_SIZE) {
                 pte_t pte = pfn_pte(pfn, PAGE_S2_DEVICE);
-                kvm_set_s2pte_writable(&pte);
 
                 ret = mmu_topup_memory_cache(&cache, 2, 2);
                 if (ret)
diff --git a/arch/arm/kvm/reset.c b/arch/arm/kvm/reset.c
index b7840e7aa452..71e08baee209 100644
--- a/arch/arm/kvm/reset.c
+++ b/arch/arm/kvm/reset.c
@@ -40,7 +40,7 @@ static struct kvm_regs a15_regs_reset = {
 };
 
 static const struct kvm_irq_level a15_vtimer_irq = {
-        .irq = 27,
+        { .irq = 27 },
         .level = 1,
 };
 
diff --git a/arch/arm/kvm/trace.h b/arch/arm/kvm/trace.h
index a8e73ed5ad5b..b1d640f78623 100644
--- a/arch/arm/kvm/trace.h
+++ b/arch/arm/kvm/trace.h
@@ -59,10 +59,9 @@ TRACE_EVENT(kvm_guest_fault,
                 __entry->ipa                    = ipa;
         ),
 
-        TP_printk("guest fault at PC %#08lx (hxfar %#08lx, "
-                  "ipa %#16llx, hsr %#08lx",
-                  __entry->vcpu_pc, __entry->hxfar,
-                  __entry->ipa, __entry->hsr)
+        TP_printk("ipa %#llx, hsr %#08lx, hxfar %#08lx, pc %#08lx",
+                  __entry->ipa, __entry->hsr,
+                  __entry->hxfar, __entry->vcpu_pc)
 );
 
 TRACE_EVENT(kvm_irq_line,
diff --git a/arch/arm/lib/Makefile b/arch/arm/lib/Makefile
index af72969820b4..aaf3a8731136 100644
--- a/arch/arm/lib/Makefile
+++ b/arch/arm/lib/Makefile
@@ -45,3 +45,9 @@ lib-$(CONFIG_ARCH_SHARK)	+= io-shark.o
 
 $(obj)/csumpartialcopy.o:       $(obj)/csumpartialcopygeneric.S
 $(obj)/csumpartialcopyuser.o:   $(obj)/csumpartialcopygeneric.S
+
+ifeq ($(CONFIG_KERNEL_MODE_NEON),y)
+  NEON_FLAGS                    := -mfloat-abi=softfp -mfpu=neon
+  CFLAGS_xor-neon.o             += $(NEON_FLAGS)
+  lib-$(CONFIG_XOR_BLOCKS)      += xor-neon.o
+endif
diff --git a/arch/arm/lib/xor-neon.c b/arch/arm/lib/xor-neon.c
new file mode 100644
index 000000000000..f485e5a2af4b
--- /dev/null
+++ b/arch/arm/lib/xor-neon.c
@@ -0,0 +1,42 @@
+/*
+ * linux/arch/arm/lib/xor-neon.c
+ *
+ * Copyright (C) 2013 Linaro Ltd <ard.biesheuvel@linaro.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/raid/xor.h>
+
+#ifndef __ARM_NEON__
+#error You should compile this file with '-mfloat-abi=softfp -mfpu=neon'
+#endif
+
+/*
+ * Pull in the reference implementations while instructing GCC (through
+ * -ftree-vectorize) to attempt to exploit implicit parallelism and emit
+ * NEON instructions.
+ */
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
+#pragma GCC optimize "tree-vectorize"
+#else
+/*
+ * While older versions of GCC do not generate incorrect code, they fail to
+ * recognize the parallel nature of these functions, and emit plain ARM code,
+ * which is known to be slower than the optimized ARM code in asm-arm/xor.h.
+ */
+#warning This code requires at least version 4.6 of GCC
+#endif
+
+#pragma GCC diagnostic ignored "-Wunused-variable"
+#include <asm-generic/xor.h>
+
+struct xor_block_template const xor_block_neon_inner = {
+        .name   = "__inner_neon__",
+        .do_2   = xor_8regs_2,
+        .do_3   = xor_8regs_3,
+        .do_4   = xor_8regs_4,
+        .do_5   = xor_8regs_5,
+};
diff --git a/arch/arm/mach-at91/at91sam9x5.c b/arch/arm/mach-at91/at91sam9x5.c
index 2abee6626aac..916e5a142917 100644
--- a/arch/arm/mach-at91/at91sam9x5.c
+++ b/arch/arm/mach-at91/at91sam9x5.c
@@ -227,6 +227,8 @@ static struct clk_lookup periph_clocks_lookups[] = {
         CLKDEV_CON_DEV_ID("usart", "f8020000.serial", &usart1_clk),
         CLKDEV_CON_DEV_ID("usart", "f8024000.serial", &usart2_clk),
         CLKDEV_CON_DEV_ID("usart", "f8028000.serial", &usart3_clk),
+        CLKDEV_CON_DEV_ID("usart", "f8040000.serial", &uart0_clk),
+        CLKDEV_CON_DEV_ID("usart", "f8044000.serial", &uart1_clk),
         CLKDEV_CON_DEV_ID("t0_clk", "f8008000.timer", &tcb0_clk),
         CLKDEV_CON_DEV_ID("t0_clk", "f800c000.timer", &tcb0_clk),
         CLKDEV_CON_DEV_ID("mci_clk", "f0008000.mmc", &mmc0_clk),
diff --git a/arch/arm/mach-at91/include/mach/at91_adc.h b/arch/arm/mach-at91/include/mach/at91_adc.h
index 8e7ed5c90817..048a57f76bd3 100644
--- a/arch/arm/mach-at91/include/mach/at91_adc.h
+++ b/arch/arm/mach-at91/include/mach/at91_adc.h
@@ -28,9 +28,12 @@
 #define                 AT91_ADC_TRGSEL_EXTERNAL        (6 << 1)
 #define         AT91_ADC_LOWRES         (1 << 4)        /* Low Resolution */
 #define         AT91_ADC_SLEEP          (1 << 5)        /* Sleep Mode */
-#define         AT91_ADC_PRESCAL        (0x3f << 8)     /* Prescalar Rate Selection */
+#define         AT91_ADC_PRESCAL_9260   (0x3f << 8)     /* Prescalar Rate Selection */
+#define         AT91_ADC_PRESCAL_9G45   (0xff << 8)
 #define                 AT91_ADC_PRESCAL_(x)    ((x) << 8)
-#define         AT91_ADC_STARTUP        (0x1f << 16)    /* Startup Up Time */
+#define         AT91_ADC_STARTUP_9260   (0x1f << 16)    /* Startup Up Time */
+#define         AT91_ADC_STARTUP_9G45   (0x7f << 16)
+#define         AT91_ADC_STARTUP_9X5    (0xf << 16)
 #define                 AT91_ADC_STARTUP_(x)    ((x) << 16)
 #define         AT91_ADC_SHTIM          (0xf  << 24)    /* Sample & Hold Time */
 #define                 AT91_ADC_SHTIM_(x)      ((x) << 24)
@@ -48,6 +51,9 @@
 #define         AT91_ADC_ENDRX          (1 << 18)       /* End of RX Buffer */
 #define         AT91_ADC_RXFUFF         (1 << 19)       /* RX Buffer Full */
 
+#define AT91_ADC_SR_9X5         0x30            /* Status Register for 9x5 */
+#define         AT91_ADC_SR_DRDY_9X5    (1 << 24)       /* Data Ready */
+
 #define AT91_ADC_LCDR           0x20            /* Last Converted Data Register */
 #define         AT91_ADC_LDATA          (0x3ff)
 
@@ -58,4 +64,10 @@
 #define AT91_ADC_CHR(n)         (0x30 + ((n) * 4))      /* Channel Data Register N */
 #define         AT91_ADC_DATA           (0x3ff)
 
+#define AT91_ADC_CDR0_9X5       (0x50)                  /* Channel Data Register 0 for 9X5 */
+
+#define AT91_ADC_TRGR_9260      AT91_ADC_MR
+#define AT91_ADC_TRGR_9G45      0x08
+#define AT91_ADC_TRGR_9X5       0xC0
+
 #endif
diff --git a/arch/arm/mach-clps711x/Kconfig b/arch/arm/mach-clps711x/Kconfig
index 01ad4d41e728..bea6295c8c59 100644
--- a/arch/arm/mach-clps711x/Kconfig
+++ b/arch/arm/mach-clps711x/Kconfig
@@ -33,9 +33,6 @@ config ARCH_P720T
           Say Y here if you intend to run this kernel on the ARM Prospector
           720T.
 
-config ARCH_FORTUNET
-        bool "FORTUNET"
-
 config EP72XX_ROM_BOOT
         bool "EP721x/EP731x ROM boot"
         help
diff --git a/arch/arm/mach-clps711x/Makefile b/arch/arm/mach-clps711x/Makefile
index f30ed2b496fb..f04151efd96a 100644
--- a/arch/arm/mach-clps711x/Makefile
+++ b/arch/arm/mach-clps711x/Makefile
@@ -10,5 +10,4 @@ obj-$(CONFIG_ARCH_AUTCPU12)	+= board-autcpu12.o
 obj-$(CONFIG_ARCH_CDB89712)     += board-cdb89712.o
 obj-$(CONFIG_ARCH_CLEP7312)     += board-clep7312.o
 obj-$(CONFIG_ARCH_EDB7211)      += board-edb7211.o
-obj-$(CONFIG_ARCH_FORTUNET)     += board-fortunet.o
 obj-$(CONFIG_ARCH_P720T)        += board-p720t.o
diff --git a/arch/arm/mach-clps711x/board-autcpu12.c b/arch/arm/mach-clps711x/board-autcpu12.c
index 5867aebd8d0c..f8d71a89644a 100644
--- a/arch/arm/mach-clps711x/board-autcpu12.c
+++ b/arch/arm/mach-clps711x/board-autcpu12.c
@@ -259,11 +259,7 @@ static void __init autcpu12_init(void)
 static void __init autcpu12_init_late(void)
 {
         gpio_request_array(autcpu12_gpios, ARRAY_SIZE(autcpu12_gpios));
-
-        if (IS_ENABLED(MTD_NAND_GPIO) && IS_ENABLED(GPIO_GENERIC_PLATFORM)) {
-                /* We are need both drivers to handle NAND */
-                platform_device_register(&autcpu12_nand_pdev);
-        }
+        platform_device_register(&autcpu12_nand_pdev);
 }
 
 MACHINE_START(AUTCPU12, "autronix autcpu12")
diff --git a/arch/arm/mach-clps711x/board-edb7211.c b/arch/arm/mach-clps711x/board-edb7211.c
index 9dfb990f0801..fe6184ead896 100644
--- a/arch/arm/mach-clps711x/board-edb7211.c
+++ b/arch/arm/mach-clps711x/board-edb7211.c
@@ -126,21 +126,6 @@ static struct gpio edb7211_gpios[] __initconst = {
         { EDB7211_LCDBL,        GPIOF_OUT_INIT_LOW,     "LCD BACKLIGHT" },
 };
 
-static struct map_desc edb7211_io_desc[] __initdata = {
-        {       /* Memory-mapped extra keyboard row */
-                .virtual        = IO_ADDRESS(EDB7211_EXTKBD_BASE),
-                .pfn            = __phys_to_pfn(EDB7211_EXTKBD_BASE),
-                .length         = SZ_1M,
-                .type           = MT_DEVICE,
-        },
-};
-
-void __init edb7211_map_io(void)
-{
-        clps711x_map_io();
-        iotable_init(edb7211_io_desc, ARRAY_SIZE(edb7211_io_desc));
-}
-
 /* Reserve screen memory region at the start of main system memory. */
 static void __init edb7211_reserve(void)
 {
@@ -195,7 +180,7 @@ MACHINE_START(EDB7211, "CL-EDB7211 (EP7211 eval board)")
         .nr_irqs        = CLPS711X_NR_IRQS,
         .fixup          = fixup_edb7211,
         .reserve        = edb7211_reserve,
-        .map_io         = edb7211_map_io,
+        .map_io         = clps711x_map_io,
         .init_early     = clps711x_init_early,
         .init_irq       = clps711x_init_irq,
         .init_time      = clps711x_timer_init,
diff --git a/arch/arm/mach-clps711x/board-fortunet.c b/arch/arm/mach-clps711x/board-fortunet.c
deleted file mode 100644
index b1561e3d7c5c..000000000000
--- a/arch/arm/mach-clps711x/board-fortunet.c
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- *  linux/arch/arm/mach-clps711x/fortunet.c
- *
- *  Derived from linux/arch/arm/mach-integrator/arch.c
- *
- *  Copyright (C) 2000 Deep Blue Solutions Ltd
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-#include <linux/types.h>
-#include <linux/init.h>
-#include <linux/initrd.h>
-
-#include <mach/hardware.h>
-#include <asm/setup.h>
-#include <asm/mach-types.h>
-
-#include <asm/mach/arch.h>
-
-#include <asm/memory.h>
-
-#include "common.h"
-
-struct meminfo memmap = {
-        .nr_banks       = 1,
-        .bank           = {
-                {
-                        .start  = 0xC0000000,
-                        .size   = 0x01000000,
-                },
-        },
-};
-
-typedef struct tag_IMAGE_PARAMS
-{
-        int     ramdisk_ok;
-        int     ramdisk_address;
-        int     ramdisk_size;
-        int     ram_size;
-        int     extra_param_type;
-        int     extra_param_ptr;
-        int     command_line;
-} IMAGE_PARAMS;
-
-#define IMAGE_PARAMS_PHYS       0xC01F0000
-
-static void __init
-fortunet_fixup(struct tag *tags, char **cmdline, struct meminfo *mi)
-{
-        IMAGE_PARAMS *ip = phys_to_virt(IMAGE_PARAMS_PHYS);
-        *cmdline = phys_to_virt(ip->command_line);
-#ifdef CONFIG_BLK_DEV_INITRD
-        if(ip->ramdisk_ok)
-        {
-                initrd_start = __phys_to_virt(ip->ramdisk_address);
-                initrd_end = initrd_start + ip->ramdisk_size;
-        }
-#endif
-        memmap.bank[0].size = ip->ram_size;
-        *mi = memmap;
-}
-
-MACHINE_START(FORTUNET, "ARM-FortuNet")
-        /* Maintainer: FortuNet Inc. */
-        .nr_irqs        = CLPS711X_NR_IRQS,
-        .fixup          = fortunet_fixup,
-        .map_io         = clps711x_map_io,
-        .init_early     = clps711x_init_early,
-        .init_irq       = clps711x_init_irq,
-        .init_time      = clps711x_timer_init,
-        .handle_irq     = clps711x_handle_irq,
-        .restart        = clps711x_restart,
-MACHINE_END
diff --git a/arch/arm/mach-clps711x/devices.c b/arch/arm/mach-clps711x/devices.c
index 856b81cf2f8a..fb77d1448fec 100644
--- a/arch/arm/mach-clps711x/devices.c
+++ b/arch/arm/mach-clps711x/devices.c
@@ -57,7 +57,7 @@ static void __init clps711x_add_syscon(void)
         unsigned i;
 
         for (i = 0; i < ARRAY_SIZE(clps711x_syscon_res); i++)
-                platform_device_register_simple("clps711x-syscon", i + 1,
+                platform_device_register_simple("syscon", i + 1,
                                                 &clps711x_syscon_res[i], 1);
 }
 
diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c
index af6dafbd02ef..f5c228190fdd 100644
--- a/arch/arm/mach-davinci/board-da850-evm.c
+++ b/arch/arm/mach-davinci/board-da850-evm.c
@@ -1249,12 +1249,10 @@ static struct vpif_capture_config da850_vpif_capture_config = {
 
 static struct adv7343_platform_data adv7343_pdata = {
         .mode_config = {
-                .dac_3 = 1,
-                .dac_2 = 1,
-                .dac_1 = 1,
+                .dac = { 1, 1, 1 },
         },
         .sd_config = {
-                .sd_dac_out1 = 1,
+                .sd_dac_out = { 1 },
         },
 };
 
diff --git a/arch/arm/mach-davinci/board-dm355-leopard.c b/arch/arm/mach-davinci/board-dm355-leopard.c
index dff4ddc5ef81..139e42da25f0 100644
--- a/arch/arm/mach-davinci/board-dm355-leopard.c
+++ b/arch/arm/mach-davinci/board-dm355-leopard.c
@@ -75,6 +75,7 @@ static struct davinci_nand_pdata davinci_nand_data = {
         .parts                  = davinci_nand_partitions,
         .nr_parts               = ARRAY_SIZE(davinci_nand_partitions),
         .ecc_mode               = NAND_ECC_HW_SYNDROME,
+        .ecc_bits               = 4,
         .bbt_options            = NAND_BBT_USE_FLASH,
 };
 
diff --git a/arch/arm/mach-davinci/board-dm644x-evm.c b/arch/arm/mach-davinci/board-dm644x-evm.c
index a33686a6fbb2..fa4bfaf952d8 100644
--- a/arch/arm/mach-davinci/board-dm644x-evm.c
+++ b/arch/arm/mach-davinci/board-dm644x-evm.c
@@ -153,6 +153,7 @@ static struct davinci_nand_pdata davinci_evm_nandflash_data = {
         .parts          = davinci_evm_nandflash_partition,
         .nr_parts       = ARRAY_SIZE(davinci_evm_nandflash_partition),
         .ecc_mode       = NAND_ECC_HW,
+        .ecc_bits       = 1,
         .bbt_options    = NAND_BBT_USE_FLASH,
         .timing         = &davinci_evm_nandflash_timing,
 };
diff --git a/arch/arm/mach-davinci/board-dm646x-evm.c b/arch/arm/mach-davinci/board-dm646x-evm.c
index fbb8e5ab1dc1..0c005e876cac 100644
--- a/arch/arm/mach-davinci/board-dm646x-evm.c
+++ b/arch/arm/mach-davinci/board-dm646x-evm.c
@@ -90,6 +90,7 @@ static struct davinci_nand_pdata davinci_nand_data = {
         .parts                  = davinci_nand_partitions,
         .nr_parts               = ARRAY_SIZE(davinci_nand_partitions),
         .ecc_mode               = NAND_ECC_HW,
+        .ecc_bits               = 1,
         .options                = 0,
 };
 
diff --git a/arch/arm/mach-davinci/board-neuros-osd2.c b/arch/arm/mach-davinci/board-neuros-osd2.c
index 2bc112adf565..808233b60e3d 100644
--- a/arch/arm/mach-davinci/board-neuros-osd2.c
+++ b/arch/arm/mach-davinci/board-neuros-osd2.c
@@ -88,6 +88,7 @@ static struct davinci_nand_pdata davinci_ntosd2_nandflash_data = {
         .parts          = davinci_ntosd2_nandflash_partition,
         .nr_parts       = ARRAY_SIZE(davinci_ntosd2_nandflash_partition),
         .ecc_mode       = NAND_ECC_HW,
+        .ecc_bits       = 1,
         .bbt_options    = NAND_BBT_USE_FLASH,
 };
 
diff --git a/arch/arm/mach-davinci/cpuidle.c b/arch/arm/mach-davinci/cpuidle.c
index 36aef3a7dedb..f1ac1c94ac0f 100644
--- a/arch/arm/mach-davinci/cpuidle.c
+++ b/arch/arm/mach-davinci/cpuidle.c
@@ -65,7 +65,7 @@ static struct cpuidle_driver davinci_idle_driver = {
         .states[1]              = {
                 .enter                  = davinci_enter_idle,
                 .exit_latency           = 10,
-                .target_residency       = 100000,
+                .target_residency       = 10000,
                 .flags                  = CPUIDLE_FLAG_TIME_VALID,
                 .name                   = "DDR SR",
                 .desc                   = "WFI and DDR Self Refresh",
diff --git a/arch/arm/mach-davinci/include/mach/debug-macro.S b/arch/arm/mach-davinci/include/mach/debug-macro.S
deleted file mode 100644
index b18b8ebc6508..000000000000
--- a/arch/arm/mach-davinci/include/mach/debug-macro.S
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Debugging macro for DaVinci
- *
- * Author: Kevin Hilman, MontaVista Software, Inc. <source@mvista.com>
- *
- * 2007 (c) MontaVista Software, Inc. This file is licensed under
- * the terms of the GNU General Public License version 2. This program
- * is licensed "as is" without any warranty of any kind, whether express
- * or implied.
- */
-
-/* Modifications
- * Jan 2009     Chaithrika U S  Added senduart, busyuart, waituart
- *                              macros, based on debug-8250.S file
- *                              but using 32-bit accesses required for
- *                              some davinci devices.
- */
-
-#include <linux/serial_reg.h>
-
-#include <mach/serial.h>
-
-#define UART_SHIFT      2
-
-#if defined(CONFIG_DEBUG_DAVINCI_DMx_UART0)
-#define UART_BASE       DAVINCI_UART0_BASE
-#elif defined(CONFIG_DEBUG_DAVINCI_DA8XX_UART1)
-#define UART_BASE       DA8XX_UART1_BASE
-#elif defined(CONFIG_DEBUG_DAVINCI_DA8XX_UART2)
-#define UART_BASE       DA8XX_UART2_BASE
-#elif defined(CONFIG_DEBUG_DAVINCI_TNETV107X_UART1)
-#define UART_BASE       TNETV107X_UART2_BASE
-#define UART_VIRTBASE   TNETV107X_UART2_VIRT
-#else
-#error "Select a specifc port for DEBUG_LL"
-#endif
-
-#ifndef UART_VIRTBASE
-#define UART_VIRTBASE   IO_ADDRESS(UART_BASE)
-#endif
-
-                .macro addruart, rp, rv, tmp
-                ldr     \rp, =UART_BASE
-                ldr     \rv, =UART_VIRTBASE
-                .endm
-
-                .macro  senduart,rd,rx
-                str     \rd, [\rx, #UART_TX << UART_SHIFT]
-                .endm
-
-                .macro  busyuart,rd,rx
-1002:           ldr     \rd, [\rx, #UART_LSR << UART_SHIFT]
-                and     \rd, \rd, #UART_LSR_TEMT | UART_LSR_THRE
-                teq     \rd, #UART_LSR_TEMT | UART_LSR_THRE
-                bne     1002b
-                .endm
-
-                .macro  waituart,rd,rx
-#ifdef FLOW_CONTROL
-1001:           ldr     \rd, [\rx, #UART_MSR << UART_SHIFT]
-                tst     \rd, #UART_MSR_CTS
-                beq     1001b
-#endif
-                .endm
-
diff --git a/arch/arm/mach-dove/common.c b/arch/arm/mach-dove/common.c
index 00247c771313..304f069ebf50 100644
--- a/arch/arm/mach-dove/common.c
+++ b/arch/arm/mach-dove/common.c
@@ -108,8 +108,8 @@ static void __init dove_clk_init(void)
         orion_clkdev_add(NULL, "sdhci-dove.1", sdio1);
         orion_clkdev_add(NULL, "orion_nand", nand);
         orion_clkdev_add(NULL, "cafe1000-ccic.0", camera);
-        orion_clkdev_add(NULL, "kirkwood-i2s.0", i2s0);
-        orion_clkdev_add(NULL, "kirkwood-i2s.1", i2s1);
+        orion_clkdev_add(NULL, "mvebu-audio.0", i2s0);
+        orion_clkdev_add(NULL, "mvebu-audio.1", i2s1);
         orion_clkdev_add(NULL, "mv_crypto", crypto);
         orion_clkdev_add(NULL, "dove-ac97", ac97);
         orion_clkdev_add(NULL, "dove-pdma", pdma);
diff --git a/arch/arm/mach-dove/include/mach/debug-macro.S b/arch/arm/mach-dove/include/mach/debug-macro.S
deleted file mode 100644
index 5929cbc59161..000000000000
--- a/arch/arm/mach-dove/include/mach/debug-macro.S
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * arch/arm/mach-dove/include/mach/debug-macro.S
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
-*/
-
-#include <mach/bridge-regs.h>
-
-        .macro  addruart, rp, rv, tmp
-        ldr     \rp, =DOVE_SB_REGS_PHYS_BASE
-        ldr     \rv, =DOVE_SB_REGS_VIRT_BASE
-        orr     \rp, \rp, #0x00012000
-        orr     \rv, \rv, #0x00012000
-        .endm
-
-#define UART_SHIFT      2
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/mach-dove/mpp.c b/arch/arm/mach-dove/mpp.c
index 60bd729a1ba5..8a433a51289c 100644
--- a/arch/arm/mach-dove/mpp.c
+++ b/arch/arm/mach-dove/mpp.c
@@ -47,7 +47,7 @@ static const struct dove_mpp_grp dove_mpp_grp[] = {
 
 /* Enable gpio for a range of pins. mode should be a combination of
    GPIO_OUTPUT_OK | GPIO_INPUT_OK */
-static void dove_mpp_gpio_mode(int start, int end, int gpio_mode)
+static void __init dove_mpp_gpio_mode(int start, int end, int gpio_mode)
 {
         int i;
 
diff --git a/arch/arm/mach-ebsa110/include/mach/debug-macro.S b/arch/arm/mach-ebsa110/include/mach/debug-macro.S
deleted file mode 100644
index bb02c05e6812..000000000000
--- a/arch/arm/mach-ebsa110/include/mach/debug-macro.S
+++ /dev/null
@@ -1,22 +0,0 @@
-/* arch/arm/mach-ebsa110/include/mach/debug-macro.S
- *
- * Debugging macro include header
- *
- *  Copyright (C) 1994-1999 Russell King
- *  Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
-**/
-
-                .macro  addruart, rp, rv, tmp
-                mov     \rp, #0xf0000000
-                orr     \rp, \rp, #0x00000be0
-                mov     \rp, \rv
-                .endm
-
-#define UART_SHIFT      2
-#define FLOW_CONTROL
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/mach-ep93xx/Kconfig b/arch/arm/mach-ep93xx/Kconfig
index fe3c1fa5462b..93e54fd4e3d5 100644
--- a/arch/arm/mach-ep93xx/Kconfig
+++ b/arch/arm/mach-ep93xx/Kconfig
@@ -194,20 +194,6 @@ config MACH_VISION_EP9307
           Say 'Y' here if you want your kernel to support the
           Vision Engraving Systems EP9307 SoM.
 
-choice
-        prompt "Select a UART for early kernel messages"
-
-config EP93XX_EARLY_UART1
-        bool "UART1"
-
-config EP93XX_EARLY_UART2
-        bool "UART2"
-
-config EP93XX_EARLY_UART3
-        bool "UART3"
-
-endchoice
-
 endmenu
 
 endif
diff --git a/arch/arm/mach-ep93xx/include/mach/debug-macro.S b/arch/arm/mach-ep93xx/include/mach/debug-macro.S
deleted file mode 100644
index af54e43132cf..000000000000
--- a/arch/arm/mach-ep93xx/include/mach/debug-macro.S
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * arch/arm/mach-ep93xx/include/mach/debug-macro.S
- * Debugging macro include header
- *
- * Copyright (C) 2006 Lennert Buytenhek <buytenh@wantstofly.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- */
-#include <mach/ep93xx-regs.h>
-
-                .macro  addruart, rp, rv, tmp
-                ldr     \rp, =EP93XX_APB_PHYS_BASE      @ Physical base
-                ldr     \rv, =EP93XX_APB_VIRT_BASE      @ virtual base
-                orr     \rp, \rp, #0x000c0000
-                orr     \rv, \rv, #0x000c0000
-                .endm
-
-#include <asm/hardware/debug-pl01x.S>
diff --git a/arch/arm/mach-ep93xx/include/mach/uncompress.h b/arch/arm/mach-ep93xx/include/mach/uncompress.h
index b5cc77d2380b..03c42e5400d2 100644
--- a/arch/arm/mach-ep93xx/include/mach/uncompress.h
+++ b/arch/arm/mach-ep93xx/include/mach/uncompress.h
@@ -31,18 +31,8 @@ static void __raw_writel(unsigned int value, unsigned int ptr)
         *((volatile unsigned int *)ptr) = value;
 }
 
-#if defined(CONFIG_EP93XX_EARLY_UART1)
-#define UART_BASE               EP93XX_UART1_PHYS_BASE
-#elif defined(CONFIG_EP93XX_EARLY_UART2)
-#define UART_BASE               EP93XX_UART2_PHYS_BASE
-#elif defined(CONFIG_EP93XX_EARLY_UART3)
-#define UART_BASE               EP93XX_UART3_PHYS_BASE
-#else
-#define UART_BASE               EP93XX_UART1_PHYS_BASE
-#endif
-
-#define PHYS_UART_DATA          (UART_BASE + 0x00)
-#define PHYS_UART_FLAG          (UART_BASE + 0x18)
+#define PHYS_UART_DATA          (CONFIG_DEBUG_UART_PHYS + 0x00)
+#define PHYS_UART_FLAG          (CONFIG_DEBUG_UART_PHYS + 0x18)
 #define UART_FLAG_TXFF          0x20
 
 static inline void putc(int c)
diff --git a/arch/arm/mach-footbridge/include/mach/debug-macro.S b/arch/arm/mach-footbridge/include/mach/debug-macro.S
index c169f0c99b2a..02247f313e94 100644
--- a/arch/arm/mach-footbridge/include/mach/debug-macro.S
+++ b/arch/arm/mach-footbridge/include/mach/debug-macro.S
@@ -13,20 +13,6 @@
 
 #include <asm/hardware/dec21285.h>
 
-#ifndef CONFIG_DEBUG_DC21285_PORT
-        /* For NetWinder debugging */
-                .macro  addruart, rp, rv, tmp
-                mov     \rp, #0x000003f8
-                orr     \rv, \rp, #0xfe000000   @ virtual
-                orr     \rv, \rv, #0x00e00000   @ virtual
-                orr     \rp, \rp, #0x7c000000   @ physical
-                .endm
-
-#define UART_SHIFT      0
-#define FLOW_CONTROL
-#include <asm/hardware/debug-8250.S>
-
-#else
 #include <mach/hardware.h>
         /* For EBSA285 debugging */
                 .equ    dc21285_high, ARMCSR_BASE & 0xff000000
@@ -54,4 +40,3 @@
 
                 .macro  waituart,rd,rx
                 .endm
-#endif
diff --git a/arch/arm/mach-gemini/include/mach/debug-macro.S b/arch/arm/mach-gemini/include/mach/debug-macro.S
deleted file mode 100644
index 837670763b85..000000000000
--- a/arch/arm/mach-gemini/include/mach/debug-macro.S
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Debugging macro include header
- *
- *  Copyright (C) 1994-1999 Russell King
- *  Copyright (C) 2001-2006 Storlink, Corp.
- *  Copyright (C) 2008-2009 Paulius Zaleckas <paulius.zaleckas@teltonika.lt>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#include <mach/hardware.h>
-
-        .macro  addruart, rp, rv, tmp
-        ldr     \rp, =GEMINI_UART_BASE                  @ physical
-        ldr     \rv, =IO_ADDRESS(GEMINI_UART_BASE)      @ virtual
-        .endm
-
-#define UART_SHIFT      2
-#define FLOW_CONTROL
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/mach-imx/mach-imx6q.c b/arch/arm/mach-imx/mach-imx6q.c
index 7be13f8e69a0..a02f275a198d 100644
--- a/arch/arm/mach-imx/mach-imx6q.c
+++ b/arch/arm/mach-imx/mach-imx6q.c
@@ -254,13 +254,12 @@ static void __init imx6q_opp_init(struct device *cpu_dev)
 {
         struct device_node *np;
 
-        np = of_find_node_by_path("/cpus/cpu@0");
+        np = of_node_get(cpu_dev->of_node);
         if (!np) {
                 pr_warn("failed to find cpu0 node\n");
                 return;
         }
 
-        cpu_dev->of_node = np;
         if (of_init_opp_table(cpu_dev)) {
                 pr_warn("failed to init OPP table\n");
                 goto put_node;
diff --git a/arch/arm/mach-integrator/include/mach/debug-macro.S b/arch/arm/mach-integrator/include/mach/debug-macro.S
deleted file mode 100644
index 411b116077e4..000000000000
--- a/arch/arm/mach-integrator/include/mach/debug-macro.S
+++ /dev/null
@@ -1,20 +0,0 @@
-/* arch/arm/mach-integrator/include/mach/debug-macro.S
- *
- * Debugging macro include header
- *
- *  Copyright (C) 1994-1999 Russell King
- *  Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
-*/
-
-                .macro  addruart, rp, rv, tmp
-                mov     \rp, #0x16000000        @ physical base address
-                mov     \rv, #0xf0000000        @ virtual base
-                add     \rv, \rv, #0x16000000 >> 4
-                .endm
-
-#include <asm/hardware/debug-pl01x.S>
diff --git a/arch/arm/mach-iop13xx/include/mach/debug-macro.S b/arch/arm/mach-iop13xx/include/mach/debug-macro.S
deleted file mode 100644
index d869a6f67e5c..000000000000
--- a/arch/arm/mach-iop13xx/include/mach/debug-macro.S
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * arch/arm/mach-iop13xx/include/mach/debug-macro.S
- *
- * Debugging macro include header
- *
- * Copyright (C) 1994-1999 Russell King
- * Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-        .macro  addruart, rp, rv, tmp
-        mov     \rp, #0x00002300
-        orr     \rp, \rp, #0x00000040
-        orr     \rv, \rp, #0xfe000000   @ virtual
-        orr     \rv, \rv, #0x00e80000
-        orr     \rp, \rp, #0xff000000   @ physical
-        orr     \rp, \rp, #0x00d80000
-        .endm
-
-#define UART_SHIFT      2
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/mach-iop32x/include/mach/debug-macro.S b/arch/arm/mach-iop32x/include/mach/debug-macro.S
deleted file mode 100644
index 363bdf90b34d..000000000000
--- a/arch/arm/mach-iop32x/include/mach/debug-macro.S
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * arch/arm/mach-iop32x/include/mach/debug-macro.S
- *
- * Debugging macro include header
- *
- * Copyright (C) 1994-1999 Russell King
- * Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-                .macro  addruart, rp, rv, tmp
-                mov     \rp, #0xfe000000        @ physical as well as virtual
-                orr     \rp, \rp, #0x00800000   @ location of the UART
-                mov     \rv, \rp
-                .endm
-
-#define UART_SHIFT      0
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/mach-iop33x/include/mach/debug-macro.S b/arch/arm/mach-iop33x/include/mach/debug-macro.S
deleted file mode 100644
index 361be1f6026e..000000000000
--- a/arch/arm/mach-iop33x/include/mach/debug-macro.S
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * arch/arm/mach-iop33x/include/mach/debug-macro.S
- *
- * Debugging macro include header
- *
- * Copyright (C) 1994-1999 Russell King
- * Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-                .macro  addruart, rp, rv, tmp
-                mov     \rp, #0x00ff0000
-                orr     \rp, \rp, #0x0000f700
-                orr     \rv, #0xfe000000        @ virtual
-                orr     \rp, #0xff000000        @ physical
-                .endm
-
-#define UART_SHIFT      2
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/mach-ixp4xx/include/mach/debug-macro.S b/arch/arm/mach-ixp4xx/include/mach/debug-macro.S
deleted file mode 100644
index ff686cbc5df4..000000000000
--- a/arch/arm/mach-ixp4xx/include/mach/debug-macro.S
+++ /dev/null
@@ -1,26 +0,0 @@
-/* arch/arm/mach-ixp4xx/include/mach/debug-macro.S
- *
- * Debugging macro include header
- *
- *  Copyright (C) 1994-1999 Russell King
- *  Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
-*/
-
-                .macro  addruart, rp, rv, tmp
-#ifdef __ARMEB__
-                mov     \rp, #3         @ Uart regs are at off set of 3 if
-                                        @ byte writes used - Big Endian.
-#else
-                mov     \rp, #0
-#endif
-                orr     \rv, \rp, #0xfe000000   @ virtual
-                orr     \rv, \rv, #0x00f00000
-                orr     \rp, \rp, #0xc8000000   @ physical
-                .endm
-
-#define UART_SHIFT      2
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/mach-keystone/Kconfig b/arch/arm/mach-keystone/Kconfig
index 51a50e996840..366d1a3b418d 100644
--- a/arch/arm/mach-keystone/Kconfig
+++ b/arch/arm/mach-keystone/Kconfig
@@ -7,7 +7,6 @@ config ARCH_KEYSTONE
         select HAVE_SMP
         select CLKSRC_MMIO
         select GENERIC_CLOCKEVENTS
-        select HAVE_SCHED_CLOCK
         select ARCH_WANT_OPTIONAL_GPIOLIB
         select ARM_ERRATA_798181 if SMP
         help
diff --git a/arch/arm/mach-keystone/platsmp.c b/arch/arm/mach-keystone/platsmp.c
index 14378e3fef16..c12296157d4a 100644
--- a/arch/arm/mach-keystone/platsmp.c
+++ b/arch/arm/mach-keystone/platsmp.c
@@ -38,6 +38,5 @@ static int keystone_smp_boot_secondary(unsigned int cpu,
 }
 
 struct smp_operations keystone_smp_ops __initdata = {
-        .smp_init_cpus          = arm_dt_init_cpu_maps,
         .smp_boot_secondary     = keystone_smp_boot_secondary,
 };
diff --git a/arch/arm/mach-keystone/smc.S b/arch/arm/mach-keystone/smc.S
index 9b9e4f7b241e..d15de8179fab 100644
--- a/arch/arm/mach-keystone/smc.S
+++ b/arch/arm/mach-keystone/smc.S
@@ -22,8 +22,7 @@
  * Return: Non zero value on failure
  */
 ENTRY(keystone_cpu_smc)
-        stmfd   sp!, {r4-r12, lr}
+        stmfd   sp!, {r4-r11, lr}
         smc     #0
-        dsb
-        ldmfd   sp!, {r4-r12, pc}
+        ldmfd   sp!, {r4-r11, pc}
 ENDPROC(keystone_cpu_smc)
diff --git a/arch/arm/mach-kirkwood/common.c b/arch/arm/mach-kirkwood/common.c
index e9238b5567ee..1663de090984 100644
--- a/arch/arm/mach-kirkwood/common.c
+++ b/arch/arm/mach-kirkwood/common.c
@@ -264,7 +264,7 @@ void __init kirkwood_clk_init(void)
         orion_clkdev_add(NULL, MV_XOR_NAME ".1", xor1);
         orion_clkdev_add("0", "pcie", pex0);
         orion_clkdev_add("1", "pcie", pex1);
-        orion_clkdev_add(NULL, "kirkwood-i2s", audio);
+        orion_clkdev_add(NULL, "mvebu-audio", audio);
         orion_clkdev_add(NULL, MV64XXX_I2C_CTLR_NAME ".0", runit);
         orion_clkdev_add(NULL, MV64XXX_I2C_CTLR_NAME ".1", runit);
 
@@ -560,7 +560,7 @@ void __init kirkwood_timer_init(void)
 /*****************************************************************************
  * Audio
  ****************************************************************************/
-static struct resource kirkwood_i2s_resources[] = {
+static struct resource kirkwood_audio_resources[] = {
         [0] = {
                 .start  = AUDIO_PHYS_BASE,
                 .end    = AUDIO_PHYS_BASE + SZ_16K - 1,
@@ -573,29 +573,23 @@ static struct resource kirkwood_i2s_resources[] = {
         },
 };
 
-static struct kirkwood_asoc_platform_data kirkwood_i2s_data = {
+static struct kirkwood_asoc_platform_data kirkwood_audio_data = {
         .burst       = 128,
 };
 
-static struct platform_device kirkwood_i2s_device = {
-        .name           = "kirkwood-i2s",
+static struct platform_device kirkwood_audio_device = {
+        .name           = "mvebu-audio",
         .id             = -1,
-        .num_resources  = ARRAY_SIZE(kirkwood_i2s_resources),
-        .resource       = kirkwood_i2s_resources,
+        .num_resources  = ARRAY_SIZE(kirkwood_audio_resources),
+        .resource       = kirkwood_audio_resources,
         .dev            = {
-                .platform_data  = &kirkwood_i2s_data,
+                .platform_data  = &kirkwood_audio_data,
         },
 };
 
-static struct platform_device kirkwood_pcm_device = {
-        .name           = "kirkwood-pcm-audio",
-        .id             = -1,
-};
-
 void __init kirkwood_audio_init(void)
 {
-        platform_device_register(&kirkwood_i2s_device);
-        platform_device_register(&kirkwood_pcm_device);
+        platform_device_register(&kirkwood_audio_device);
 }
 
 /*****************************************************************************
diff --git a/arch/arm/mach-kirkwood/include/mach/debug-macro.S b/arch/arm/mach-kirkwood/include/mach/debug-macro.S
deleted file mode 100644
index f785d401a607..000000000000
--- a/arch/arm/mach-kirkwood/include/mach/debug-macro.S
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * arch/arm/mach-kirkwood/include/mach/debug-macro.S
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
-*/
-
-#include <mach/bridge-regs.h>
-
-        .macro  addruart, rp, rv, tmp
-        ldr     \rp, =KIRKWOOD_REGS_PHYS_BASE
-        ldr     \rv, =KIRKWOOD_REGS_VIRT_BASE
-        orr     \rp, \rp, #0x00012000
-        orr     \rv, \rv, #0x00012000
-        .endm
-
-#define UART_SHIFT      2
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/mach-lpc32xx/include/mach/debug-macro.S b/arch/arm/mach-lpc32xx/include/mach/debug-macro.S
deleted file mode 100644
index 351bd6c84909..000000000000
--- a/arch/arm/mach-lpc32xx/include/mach/debug-macro.S
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * arch/arm/mach-lpc32xx/include/mach/debug-macro.S
- *
- * Author: Kevin Wells <kevin.wells@nxp.com>
- *
- * Copyright (C) 2010 NXP Semiconductors
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-/*
- * Debug output is hardcoded to standard UART 5
-*/
-
-        .macro  addruart, rp, rv, tmp
-        ldreq   \rp, =0x40090000
-        ldrne   \rv, =0xF4090000
-        .endm
-
-#define UART_SHIFT      2
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/mach-msm/Kconfig b/arch/arm/mach-msm/Kconfig
index 614e41e7881b..905efc8cac79 100644
--- a/arch/arm/mach-msm/Kconfig
+++ b/arch/arm/mach-msm/Kconfig
@@ -121,8 +121,7 @@ config MSM_SMD
         bool
 
 config MSM_GPIOMUX
-        depends on !(ARCH_MSM8X60 || ARCH_MSM8960)
-        bool "MSM V1 TLMM GPIOMUX architecture"
+        bool
         help
           Support for MSM V1 TLMM GPIOMUX architecture.
 
diff --git a/arch/arm/mach-msm/devices-msm7x00.c b/arch/arm/mach-msm/devices-msm7x00.c
index 6d50fb964863..d83404d4b328 100644
--- a/arch/arm/mach-msm/devices-msm7x00.c
+++ b/arch/arm/mach-msm/devices-msm7x00.c
@@ -456,9 +456,9 @@ static struct clk_pcom_desc msm_clocks_7x01a[] = {
         CLK_PCOM("tsif_ref_clk",        TSIF_REF_CLK,   NULL, 0),
         CLK_PCOM("tv_dac_clk",  TV_DAC_CLK,     NULL, 0),
         CLK_PCOM("tv_enc_clk",  TV_ENC_CLK,     NULL, 0),
-        CLK_PCOM("uart_clk",    UART1_CLK,      "msm_serial.0", OFF),
-        CLK_PCOM("uart_clk",    UART2_CLK,      "msm_serial.1", 0),
-        CLK_PCOM("uart_clk",    UART3_CLK,      "msm_serial.2", OFF),
+        CLK_PCOM("core",        UART1_CLK,      "msm_serial.0", OFF),
+        CLK_PCOM("core",        UART2_CLK,      "msm_serial.1", 0),
+        CLK_PCOM("core",        UART3_CLK,      "msm_serial.2", OFF),
         CLK_PCOM("uart1dm_clk", UART1DM_CLK,    NULL, OFF),
         CLK_PCOM("uart2dm_clk", UART2DM_CLK,    NULL, 0),
         CLK_PCOM("usb_hs_clk",  USB_HS_CLK,     "msm_hsusb", OFF),
diff --git a/arch/arm/mach-msm/devices-msm7x30.c b/arch/arm/mach-msm/devices-msm7x30.c
index 6b0e9845e753..c15ea8ab20a7 100644
--- a/arch/arm/mach-msm/devices-msm7x30.c
+++ b/arch/arm/mach-msm/devices-msm7x30.c
@@ -211,7 +211,7 @@ static struct clk_pcom_desc msm_clocks_7x30[] = {
         CLK_PCOM("spi_pclk",    SPI_P_CLK,      NULL, 0),
         CLK_PCOM("tv_dac_clk",  TV_DAC_CLK,     NULL, 0),
         CLK_PCOM("tv_enc_clk",  TV_ENC_CLK,     NULL, 0),
-        CLK_PCOM("uart_clk",    UART2_CLK,      "msm_serial.1", 0),
+        CLK_PCOM("core",        UART2_CLK,      "msm_serial.1", 0),
         CLK_PCOM("usb_phy_clk", USB_PHY_CLK,    NULL, 0),
         CLK_PCOM("usb_hs_clk",          USB_HS_CLK,             NULL, OFF),
         CLK_PCOM("usb_hs_pclk",         USB_HS_P_CLK,           NULL, OFF),
diff --git a/arch/arm/mach-msm/devices-qsd8x50.c b/arch/arm/mach-msm/devices-qsd8x50.c
index c1c45ad2bacb..9e1e9ce07b1a 100644
--- a/arch/arm/mach-msm/devices-qsd8x50.c
+++ b/arch/arm/mach-msm/devices-qsd8x50.c
@@ -358,9 +358,9 @@ static struct clk_pcom_desc msm_clocks_8x50[] = {
         CLK_PCOM("tsif_ref_clk",        TSIF_REF_CLK,   NULL, 0),
         CLK_PCOM("tv_dac_clk",  TV_DAC_CLK,     NULL, 0),
         CLK_PCOM("tv_enc_clk",  TV_ENC_CLK,     NULL, 0),
-        CLK_PCOM("uart_clk",    UART1_CLK,      NULL, OFF),
-        CLK_PCOM("uart_clk",    UART2_CLK,      NULL, 0),
-        CLK_PCOM("uart_clk",    UART3_CLK,      "msm_serial.2", OFF),
+        CLK_PCOM("core",        UART1_CLK,      NULL, OFF),
+        CLK_PCOM("core",        UART2_CLK,      NULL, 0),
+        CLK_PCOM("core",        UART3_CLK,      "msm_serial.2", OFF),
         CLK_PCOM("uartdm_clk",  UART1DM_CLK,    NULL, OFF),
         CLK_PCOM("uartdm_clk",  UART2DM_CLK,    NULL, 0),
         CLK_PCOM("usb_hs_clk",  USB_HS_CLK,     NULL, OFF),
diff --git a/arch/arm/mach-msm/gpiomux-v1.c b/arch/arm/mach-msm/gpiomux-v1.c
deleted file mode 100644
index 27de2abd7144..000000000000
--- a/arch/arm/mach-msm/gpiomux-v1.c
+++ /dev/null
@@ -1,33 +0,0 @@
-/* Copyright (c) 2010, Code Aurora Forum. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 and
- * only version 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-#include <linux/kernel.h>
-#include "gpiomux.h"
-#include "proc_comm.h"
-
-void __msm_gpiomux_write(unsigned gpio, gpiomux_config_t val)
-{
-        unsigned tlmm_config  = (val & ~GPIOMUX_CTL_MASK) |
-                                ((gpio & 0x3ff) << 4);
-        unsigned tlmm_disable = 0;
-        int rc;
-
-        rc = msm_proc_comm(PCOM_RPC_GPIO_TLMM_CONFIG_EX,
-                           &tlmm_config, &tlmm_disable);
-        if (rc)
-                pr_err("%s: unexpected proc_comm failure %d: %08x %08x\n",
-                       __func__, rc, tlmm_config, tlmm_disable);
-}
diff --git a/arch/arm/mach-msm/gpiomux.h b/arch/arm/mach-msm/gpiomux.h
index 8e82f41a8923..4410d7766f93 100644
--- a/arch/arm/mach-msm/gpiomux.h
+++ b/arch/arm/mach-msm/gpiomux.h
@@ -73,16 +73,6 @@ extern struct msm_gpiomux_config msm_gpiomux_configs[GPIOMUX_NGPIOS];
 int msm_gpiomux_write(unsigned gpio,
                       gpiomux_config_t active,
                       gpiomux_config_t suspended);
-
-/* Architecture-internal function for use by the framework only.
- * This function can assume the following:
- * - the gpio value has passed a bounds-check
- * - the gpiomux spinlock has been obtained
- *
- * This function is not for public consumption.  External users
- * should use msm_gpiomux_write.
- */
-void __msm_gpiomux_write(unsigned gpio, gpiomux_config_t val);
 #else
 static inline int msm_gpiomux_write(unsigned gpio,
                                     gpiomux_config_t active,
diff --git a/arch/arm/mach-mv78xx0/include/mach/debug-macro.S b/arch/arm/mach-mv78xx0/include/mach/debug-macro.S
deleted file mode 100644
index a7df02b049b7..000000000000
--- a/arch/arm/mach-mv78xx0/include/mach/debug-macro.S
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * arch/arm/mach-mv78xx0/include/mach/debug-macro.S
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
-*/
-
-#include <mach/mv78xx0.h>
-
-        .macro  addruart, rp, rv, tmp
-        ldr     \rp, =MV78XX0_REGS_PHYS_BASE
-        ldr     \rv, =MV78XX0_REGS_VIRT_BASE
-        orr     \rp, \rp, #0x00012000
-        orr     \rv, \rv, #0x00012000
-        .endm
-
-#define UART_SHIFT      2
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/mach-mvebu/platsmp.c b/arch/arm/mach-mvebu/platsmp.c
index 2e4508a9baf6..f9c09b75d4d7 100644
--- a/arch/arm/mach-mvebu/platsmp.c
+++ b/arch/arm/mach-mvebu/platsmp.c
@@ -29,45 +29,40 @@
 #include "pmsu.h"
 #include "coherency.h"
 
+static struct clk *__init get_cpu_clk(int cpu)
+{
+        struct clk *cpu_clk;
+        struct device_node *np = of_get_cpu_node(cpu, NULL);
+
+        if (WARN(!np, "missing cpu node\n"))
+                return NULL;
+        cpu_clk = of_clk_get(np, 0);
+        if (WARN_ON(IS_ERR(cpu_clk)))
+                return NULL;
+        return cpu_clk;
+}
+
 void __init set_secondary_cpus_clock(void)
 {
-        int thiscpu;
+        int thiscpu, cpu;
         unsigned long rate;
-        struct clk *cpu_clk = NULL;
-        struct device_node *np = NULL;
+        struct clk *cpu_clk;
 
         thiscpu = smp_processor_id();
-        for_each_node_by_type(np, "cpu") {
-                int err;
-                int cpu;
-
-                err = of_property_read_u32(np, "reg", &cpu);
-                if (WARN_ON(err))
-                        return;
-
-                if (cpu == thiscpu) {
-                        cpu_clk = of_clk_get(np, 0);
-                        break;
-                }
-        }
-        if (WARN_ON(IS_ERR(cpu_clk)))
+        cpu_clk = get_cpu_clk(thiscpu);
+        if (!cpu_clk)
                 return;
         clk_prepare_enable(cpu_clk);
         rate = clk_get_rate(cpu_clk);
 
         /* set all the other CPU clk to the same rate than the boot CPU */
-        for_each_node_by_type(np, "cpu") {
-                int err;
-                int cpu;
-
-                err = of_property_read_u32(np, "reg", &cpu);
-                if (WARN_ON(err))
+        for_each_possible_cpu(cpu) {
+                if (cpu == thiscpu)
+                        continue;
+                cpu_clk = get_cpu_clk(cpu);
+                if (!cpu_clk)
                         return;
-
-                if (cpu != thiscpu) {
-                        cpu_clk = of_clk_get(np, 0);
-                        clk_set_rate(cpu_clk, rate);
-                }
+                clk_set_rate(cpu_clk, rate);
         }
 }
 
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 76170dd4d88f..56021c67c89c 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -64,7 +64,7 @@ config SOC_OMAP5
         select ARM_ERRATA_798181 if SMP
 
 config SOC_AM33XX
-        bool "AM33XX support"
+        bool "TI AM33XX"
         depends on ARCH_MULTI_V7
         select ARCH_OMAP2PLUS
         select ARM_CPU_SUSPEND if PM
diff --git a/arch/arm/mach-omap2/am33xx-restart.c b/arch/arm/mach-omap2/am33xx-restart.c
index 1eae96212315..c88d8df753c2 100644
--- a/arch/arm/mach-omap2/am33xx-restart.c
+++ b/arch/arm/mach-omap2/am33xx-restart.c
@@ -24,8 +24,8 @@ void am33xx_restart(enum reboot_mode mode, const char *cmd)
 {
         /* TODO: Handle mode and cmd if necessary */
 
-        am33xx_prm_rmw_reg_bits(AM33XX_GLOBAL_WARM_SW_RST_MASK,
-                                AM33XX_GLOBAL_WARM_SW_RST_MASK,
+        am33xx_prm_rmw_reg_bits(AM33XX_RST_GLOBAL_WARM_SW_MASK,
+                                AM33XX_RST_GLOBAL_WARM_SW_MASK,
                                 AM33XX_PRM_DEVICE_MOD,
                                 AM33XX_PRM_RSTCTRL_OFFSET);
 
diff --git a/arch/arm/mach-omap2/board-2430sdp.c b/arch/arm/mach-omap2/board-2430sdp.c
index 244d8a5aa54b..c711ad6ac067 100644
--- a/arch/arm/mach-omap2/board-2430sdp.c
+++ b/arch/arm/mach-omap2/board-2430sdp.c
@@ -100,39 +100,52 @@ static struct platform_device sdp2430_flash_device = {
         .resource       = &sdp2430_flash_resource,
 };
 
-static struct platform_device *sdp2430_devices[] __initdata = {
-        &sdp2430_flash_device,
-};
-
 /* LCD */
 #define SDP2430_LCD_PANEL_BACKLIGHT_GPIO        91
 #define SDP2430_LCD_PANEL_ENABLE_GPIO           154
 
-static struct panel_generic_dpi_data sdp2430_panel_data = {
-        .name                   = "nec_nl2432dr22-11b",
-        .num_gpios              = 2,
-        .gpios                  = {
-                SDP2430_LCD_PANEL_ENABLE_GPIO,
-                SDP2430_LCD_PANEL_BACKLIGHT_GPIO,
-        },
+static const struct display_timing sdp2430_lcd_videomode = {
+        .pixelclock     = { 0, 5400000, 0 },
+
+        .hactive = { 0, 240, 0 },
+        .hfront_porch = { 0, 3, 0 },
+        .hback_porch = { 0, 39, 0 },
+        .hsync_len = { 0, 3, 0 },
+
+        .vactive = { 0, 320, 0 },
+        .vfront_porch = { 0, 2, 0 },
+        .vback_porch = { 0, 7, 0 },
+        .vsync_len = { 0, 1, 0 },
+
+        .flags = DISPLAY_FLAGS_HSYNC_LOW | DISPLAY_FLAGS_VSYNC_LOW |
+                DISPLAY_FLAGS_DE_HIGH | DISPLAY_FLAGS_PIXDATA_POSEDGE,
 };
 
-static struct omap_dss_device sdp2430_lcd_device = {
-        .name                   = "lcd",
-        .driver_name            = "generic_dpi_panel",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .phy.dpi.data_lines     = 16,
-        .data                   = &sdp2430_panel_data,
+static struct panel_dpi_platform_data sdp2430_lcd_pdata = {
+        .name                   = "lcd",
+        .source                 = "dpi.0",
+
+        .data_lines             = 16,
+
+        .display_timing         = &sdp2430_lcd_videomode,
+
+        .enable_gpio            = SDP2430_LCD_PANEL_ENABLE_GPIO,
+        .backlight_gpio         = SDP2430_LCD_PANEL_BACKLIGHT_GPIO,
 };
 
-static struct omap_dss_device *sdp2430_dss_devices[] = {
-        &sdp2430_lcd_device,
+static struct platform_device sdp2430_lcd_device = {
+        .name                   = "panel-dpi",
+        .id                     = 0,
+        .dev.platform_data      = &sdp2430_lcd_pdata,
 };
 
 static struct omap_dss_board_info sdp2430_dss_data = {
-        .num_devices    = ARRAY_SIZE(sdp2430_dss_devices),
-        .devices        = sdp2430_dss_devices,
-        .default_device = &sdp2430_lcd_device,
+        .default_display_name = "lcd",
+};
+
+static struct platform_device *sdp2430_devices[] __initdata = {
+        &sdp2430_flash_device,
+        &sdp2430_lcd_device,
 };
 
 #if IS_ENABLED(CONFIG_SMC91X)
diff --git a/arch/arm/mach-omap2/board-3430sdp.c b/arch/arm/mach-omap2/board-3430sdp.c
index 23b004afa3f8..d95d0ef1354a 100644
--- a/arch/arm/mach-omap2/board-3430sdp.c
+++ b/arch/arm/mach-omap2/board-3430sdp.c
@@ -126,53 +126,65 @@ static void __init sdp3430_display_init(void)
 
 }
 
-static struct panel_sharp_ls037v7dw01_data sdp3430_lcd_data = {
-        .resb_gpio = SDP3430_LCD_PANEL_ENABLE_GPIO,
-        .ini_gpio = -1,
-        .mo_gpio = -1,
-        .lr_gpio = -1,
-        .ud_gpio = -1,
+static struct panel_sharp_ls037v7dw01_platform_data sdp3430_lcd_pdata = {
+        .name                   = "lcd",
+        .source                 = "dpi.0",
+
+        .data_lines             = 16,
+
+        .resb_gpio              = SDP3430_LCD_PANEL_ENABLE_GPIO,
+        .ini_gpio               = -1,
+        .mo_gpio                = -1,
+        .lr_gpio                = -1,
+        .ud_gpio                = -1,
+};
+
+static struct platform_device sdp3430_lcd_device = {
+        .name                   = "panel-sharp-ls037v7dw01",
+        .id                     = 0,
+        .dev.platform_data      = &sdp3430_lcd_pdata,
 };
 
-static struct omap_dss_device sdp3430_lcd_device = {
-        .name                   = "lcd",
-        .driver_name            = "sharp_ls_panel",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .phy.dpi.data_lines     = 16,
-        .data                   = &sdp3430_lcd_data,
+static struct connector_dvi_platform_data sdp3430_dvi_connector_pdata = {
+        .name                   = "dvi",
+        .source                 = "tfp410.0",
+        .i2c_bus_num            = -1,
 };
 
-static struct tfp410_platform_data dvi_panel = {
-        .power_down_gpio        = -1,
-        .i2c_bus_num            = -1,
+static struct platform_device sdp3430_dvi_connector_device = {
+        .name                   = "connector-dvi",
+        .id                     = 0,
+        .dev.platform_data      = &sdp3430_dvi_connector_pdata,
 };
 
-static struct omap_dss_device sdp3430_dvi_device = {
-        .name                   = "dvi",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .driver_name            = "tfp410",
-        .data                   = &dvi_panel,
-        .phy.dpi.data_lines     = 24,
+static struct encoder_tfp410_platform_data sdp3430_tfp410_pdata = {
+        .name                   = "tfp410.0",
+        .source                 = "dpi.0",
+        .data_lines             = 24,
+        .power_down_gpio        = -1,
 };
 
-static struct omap_dss_device sdp3430_tv_device = {
-        .name                   = "tv",
-        .driver_name            = "venc",
-        .type                   = OMAP_DISPLAY_TYPE_VENC,
-        .phy.venc.type          = OMAP_DSS_VENC_TYPE_SVIDEO,
+static struct platform_device sdp3430_tfp410_device = {
+        .name                   = "tfp410",
+        .id                     = 0,
+        .dev.platform_data      = &sdp3430_tfp410_pdata,
 };
 
+static struct connector_atv_platform_data sdp3430_tv_pdata = {
+        .name = "tv",
+        .source = "venc.0",
+        .connector_type = OMAP_DSS_VENC_TYPE_SVIDEO,
+        .invert_polarity = false,
+};
 
-static struct omap_dss_device *sdp3430_dss_devices[] = {
-        &sdp3430_lcd_device,
-        &sdp3430_dvi_device,
-        &sdp3430_tv_device,
+static struct platform_device sdp3430_tv_connector_device = {
+        .name                   = "connector-analog-tv",
+        .id                     = 0,
+        .dev.platform_data      = &sdp3430_tv_pdata,
 };
 
 static struct omap_dss_board_info sdp3430_dss_data = {
-        .num_devices    = ARRAY_SIZE(sdp3430_dss_devices),
-        .devices        = sdp3430_dss_devices,
-        .default_device = &sdp3430_lcd_device,
+        .default_display_name = "lcd",
 };
 
 static struct omap2_hsmmc_info mmc[] = {
@@ -583,6 +595,11 @@ static void __init omap_3430sdp_init(void)
         omap_hsmmc_init(mmc);
         omap3430_i2c_init();
         omap_display_init(&sdp3430_dss_data);
+        platform_device_register(&sdp3430_lcd_device);
+        platform_device_register(&sdp3430_tfp410_device);
+        platform_device_register(&sdp3430_dvi_connector_device);
+        platform_device_register(&sdp3430_tv_connector_device);
+
         if (omap_rev() > OMAP3430_REV_ES1_0)
                 gpio_pendown = SDP3430_TS_GPIO_IRQ_SDPV2;
         else
diff --git a/arch/arm/mach-omap2/board-am3517crane.c b/arch/arm/mach-omap2/board-am3517crane.c
index fc53911d0d13..0d499a1878f6 100644
--- a/arch/arm/mach-omap2/board-am3517crane.c
+++ b/arch/arm/mach-omap2/board-am3517crane.c
@@ -110,8 +110,6 @@ static void __init am3517_crane_i2c_init(void)
 
 static void __init am3517_crane_init(void)
 {
-        int ret;
-
         omap3_mux_init(board_mux, OMAP_PACKAGE_CBB);
         omap_serial_init();
         omap_sdrc_init(NULL, NULL);
diff --git a/arch/arm/mach-omap2/board-am3517evm.c b/arch/arm/mach-omap2/board-am3517evm.c
index c7196a69ff37..543d9a882de3 100644
--- a/arch/arm/mach-omap2/board-am3517evm.c
+++ b/arch/arm/mach-omap2/board-am3517evm.c
@@ -120,56 +120,95 @@ static int __init am3517_evm_i2c_init(void)
         return 0;
 }
 
-static struct panel_generic_dpi_data lcd_panel = {
-        .name                   = "sharp_lq",
-        .num_gpios              = 3,
-        .gpios                  = {
-                LCD_PANEL_PWR,
-                LCD_PANEL_BKLIGHT_PWR,
-                LCD_PANEL_PWM,
-        },
+static const struct display_timing am3517_evm_lcd_videomode = {
+        .pixelclock     = { 0, 9000000, 0 },
+
+        .hactive = { 0, 480, 0 },
+        .hfront_porch = { 0, 3, 0 },
+        .hback_porch = { 0, 2, 0 },
+        .hsync_len = { 0, 42, 0 },
+
+        .vactive = { 0, 272, 0 },
+        .vfront_porch = { 0, 3, 0 },
+        .vback_porch = { 0, 2, 0 },
+        .vsync_len = { 0, 11, 0 },
+
+        .flags = DISPLAY_FLAGS_HSYNC_LOW | DISPLAY_FLAGS_VSYNC_LOW |
+                DISPLAY_FLAGS_DE_LOW | DISPLAY_FLAGS_PIXDATA_POSEDGE,
+};
+
+static struct panel_dpi_platform_data am3517_evm_lcd_pdata = {
+        .name                   = "lcd",
+        .source                 = "dpi.0",
+
+        .data_lines             = 16,
+
+        .display_timing         = &am3517_evm_lcd_videomode,
+
+        .enable_gpio            = LCD_PANEL_PWR,
+        .backlight_gpio         = LCD_PANEL_BKLIGHT_PWR,
+};
+
+static struct platform_device am3517_evm_lcd_device = {
+        .name                   = "panel-dpi",
+        .id                     = 0,
+        .dev.platform_data      = &am3517_evm_lcd_pdata,
 };
 
-static struct omap_dss_device am3517_evm_lcd_device = {
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .name                   = "lcd",
-        .driver_name            = "generic_dpi_panel",
-        .data                   = &lcd_panel,
-        .phy.dpi.data_lines     = 16,
+static struct connector_dvi_platform_data am3517_evm_dvi_connector_pdata = {
+        .name                   = "dvi",
+        .source                 = "tfp410.0",
+        .i2c_bus_num            = -1,
 };
 
-static struct omap_dss_device am3517_evm_tv_device = {
-        .type                   = OMAP_DISPLAY_TYPE_VENC,
-        .name                   = "tv",
-        .driver_name            = "venc",
-        .phy.venc.type          = OMAP_DSS_VENC_TYPE_SVIDEO,
+static struct platform_device am3517_evm_dvi_connector_device = {
+        .name                   = "connector-dvi",
+        .id                     = 0,
+        .dev.platform_data      = &am3517_evm_dvi_connector_pdata,
 };
 
-static struct tfp410_platform_data dvi_panel = {
-        .power_down_gpio        = -1,
-        .i2c_bus_num            = -1,
+static struct encoder_tfp410_platform_data am3517_evm_tfp410_pdata = {
+        .name                   = "tfp410.0",
+        .source                 = "dpi.0",
+        .data_lines             = 24,
+        .power_down_gpio        = -1,
 };
 
-static struct omap_dss_device am3517_evm_dvi_device = {
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .name                   = "dvi",
-        .driver_name            = "tfp410",
-        .data                   = &dvi_panel,
-        .phy.dpi.data_lines     = 24,
+static struct platform_device am3517_evm_tfp410_device = {
+        .name                   = "tfp410",
+        .id                     = 0,
+        .dev.platform_data      = &am3517_evm_tfp410_pdata,
 };
 
-static struct omap_dss_device *am3517_evm_dss_devices[] = {
-        &am3517_evm_lcd_device,
-        &am3517_evm_tv_device,
-        &am3517_evm_dvi_device,
+static struct connector_atv_platform_data am3517_evm_tv_pdata = {
+        .name = "tv",
+        .source = "venc.0",
+        .connector_type = OMAP_DSS_VENC_TYPE_SVIDEO,
+        .invert_polarity = false,
+};
+
+static struct platform_device am3517_evm_tv_connector_device = {
+        .name                   = "connector-analog-tv",
+        .id                     = 0,
+        .dev.platform_data      = &am3517_evm_tv_pdata,
 };
 
 static struct omap_dss_board_info am3517_evm_dss_data = {
-        .num_devices    = ARRAY_SIZE(am3517_evm_dss_devices),
-        .devices        = am3517_evm_dss_devices,
-        .default_device = &am3517_evm_lcd_device,
+        .default_display_name = "lcd",
 };
 
+static void __init am3517_evm_display_init(void)
+{
+        gpio_request_one(LCD_PANEL_PWM, GPIOF_OUT_INIT_HIGH, "lcd panel pwm");
+
+        omap_display_init(&am3517_evm_dss_data);
+
+        platform_device_register(&am3517_evm_tfp410_device);
+        platform_device_register(&am3517_evm_dvi_connector_device);
+        platform_device_register(&am3517_evm_lcd_device);
+        platform_device_register(&am3517_evm_tv_connector_device);
+}
+
 /*
  * Board initialization
  */
@@ -295,7 +334,9 @@ static void __init am3517_evm_init(void)
         omap3_mux_init(board_mux, OMAP_PACKAGE_CBB);
 
         am3517_evm_i2c_init();
-        omap_display_init(&am3517_evm_dss_data);
+
+        am3517_evm_display_init();
+
         omap_serial_init();
         omap_sdrc_init(NULL, NULL);
 
diff --git a/arch/arm/mach-omap2/board-cm-t35.c b/arch/arm/mach-omap2/board-cm-t35.c
index d4622ed26252..33d159e2386e 100644
--- a/arch/arm/mach-omap2/board-cm-t35.c
+++ b/arch/arm/mach-omap2/board-cm-t35.c
@@ -190,52 +190,81 @@ static inline void cm_t35_init_nand(void) {}
 #define CM_T35_LCD_BL_GPIO 58
 #define CM_T35_DVI_EN_GPIO 54
 
-static struct panel_generic_dpi_data lcd_panel = {
-        .name                   = "toppoly_tdo35s",
-        .num_gpios              = 1,
-        .gpios                  = {
-                CM_T35_LCD_BL_GPIO,
-        },
+static const struct display_timing cm_t35_lcd_videomode = {
+        .pixelclock     = { 0, 26000000, 0 },
+
+        .hactive = { 0, 480, 0 },
+        .hfront_porch = { 0, 104, 0 },
+        .hback_porch = { 0, 8, 0 },
+        .hsync_len = { 0, 8, 0 },
+
+        .vactive = { 0, 640, 0 },
+        .vfront_porch = { 0, 4, 0 },
+        .vback_porch = { 0, 2, 0 },
+        .vsync_len = { 0, 2, 0 },
+
+        .flags = DISPLAY_FLAGS_HSYNC_LOW | DISPLAY_FLAGS_VSYNC_LOW |
+                DISPLAY_FLAGS_DE_HIGH | DISPLAY_FLAGS_PIXDATA_NEGEDGE,
+};
+
+static struct panel_dpi_platform_data cm_t35_lcd_pdata = {
+        .name                   = "lcd",
+        .source                 = "dpi.0",
+
+        .data_lines             = 18,
+
+        .display_timing         = &cm_t35_lcd_videomode,
+
+        .enable_gpio            = -1,
+        .backlight_gpio         = CM_T35_LCD_BL_GPIO,
+};
+
+static struct platform_device cm_t35_lcd_device = {
+        .name                   = "panel-dpi",
+        .id                     = 0,
+        .dev.platform_data      = &cm_t35_lcd_pdata,
 };
 
-static struct omap_dss_device cm_t35_lcd_device = {
-        .name                   = "lcd",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .driver_name            = "generic_dpi_panel",
-        .data                   = &lcd_panel,
-        .phy.dpi.data_lines     = 18,
+static struct connector_dvi_platform_data cm_t35_dvi_connector_pdata = {
+        .name                   = "dvi",
+        .source                 = "tfp410.0",
+        .i2c_bus_num            = -1,
 };
 
-static struct tfp410_platform_data dvi_panel = {
-        .power_down_gpio        = CM_T35_DVI_EN_GPIO,
-        .i2c_bus_num            = -1,
+static struct platform_device cm_t35_dvi_connector_device = {
+        .name                   = "connector-dvi",
+        .id                     = 0,
+        .dev.platform_data      = &cm_t35_dvi_connector_pdata,
 };
 
-static struct omap_dss_device cm_t35_dvi_device = {
-        .name                   = "dvi",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .driver_name            = "tfp410",
-        .data                   = &dvi_panel,
-        .phy.dpi.data_lines     = 24,
+static struct encoder_tfp410_platform_data cm_t35_tfp410_pdata = {
+        .name                   = "tfp410.0",
+        .source                 = "dpi.0",
+        .data_lines             = 24,
+        .power_down_gpio        = CM_T35_DVI_EN_GPIO,
 };
 
-static struct omap_dss_device cm_t35_tv_device = {
-        .name                   = "tv",
-        .driver_name            = "venc",
-        .type                   = OMAP_DISPLAY_TYPE_VENC,
-        .phy.venc.type          = OMAP_DSS_VENC_TYPE_SVIDEO,
+static struct platform_device cm_t35_tfp410_device = {
+        .name                   = "tfp410",
+        .id                     = 0,
+        .dev.platform_data      = &cm_t35_tfp410_pdata,
 };
 
-static struct omap_dss_device *cm_t35_dss_devices[] = {
-        &cm_t35_lcd_device,
-        &cm_t35_dvi_device,
-        &cm_t35_tv_device,
+static struct connector_atv_platform_data cm_t35_tv_pdata = {
+        .name = "tv",
+        .source = "venc.0",
+        .connector_type = OMAP_DSS_VENC_TYPE_SVIDEO,
+        .invert_polarity = false,
+};
+
+static struct platform_device cm_t35_tv_connector_device = {
+        .name                   = "connector-analog-tv",
+        .id                     = 0,
+        .dev.platform_data      = &cm_t35_tv_pdata,
 };
 
 static struct omap_dss_board_info cm_t35_dss_data = {
-        .num_devices    = ARRAY_SIZE(cm_t35_dss_devices),
-        .devices        = cm_t35_dss_devices,
-        .default_device = &cm_t35_dvi_device,
+        .default_display_name = "dvi",
 };
 
 static struct omap2_mcspi_device_config tdo24m_mcspi_config = {
@@ -280,6 +309,11 @@ static void __init cm_t35_init_display(void)
                 pr_err("CM-T35: failed to register DSS device\n");
                 gpio_free(CM_T35_LCD_EN_GPIO);
         }
+
+        platform_device_register(&cm_t35_tfp410_device);
+        platform_device_register(&cm_t35_dvi_connector_device);
+        platform_device_register(&cm_t35_lcd_device);
+        platform_device_register(&cm_t35_tv_connector_device);
 }
 
 static struct regulator_consumer_supply cm_t35_vmmc1_supply[] = {
diff --git a/arch/arm/mach-omap2/board-devkit8000.c b/arch/arm/mach-omap2/board-devkit8000.c
index f1d91ba5d1ac..cdc4fb9960a9 100644
--- a/arch/arm/mach-omap2/board-devkit8000.c
+++ b/arch/arm/mach-omap2/board-devkit8000.c
@@ -112,50 +112,81 @@ static struct regulator_consumer_supply devkit8000_vio_supply[] = {
         REGULATOR_SUPPLY("vcc", "spi2.0"),
 };
 
-static struct panel_generic_dpi_data lcd_panel = {
-        .name                   = "innolux_at070tn83",
-        /* gpios filled in code */
+static const struct display_timing devkit8000_lcd_videomode = {
+        .pixelclock     = { 0, 40000000, 0 },
+
+        .hactive = { 0, 800, 0 },
+        .hfront_porch = { 0, 1, 0 },
+        .hback_porch = { 0, 1, 0 },
+        .hsync_len = { 0, 48, 0 },
+
+        .vactive = { 0, 480, 0 },
+        .vfront_porch = { 0, 12, 0 },
+        .vback_porch = { 0, 25, 0 },
+        .vsync_len = { 0, 3, 0 },
+
+        .flags = DISPLAY_FLAGS_HSYNC_LOW | DISPLAY_FLAGS_VSYNC_LOW |
+                DISPLAY_FLAGS_DE_HIGH | DISPLAY_FLAGS_PIXDATA_POSEDGE,
 };
 
-static struct omap_dss_device devkit8000_lcd_device = {
+static struct panel_dpi_platform_data devkit8000_lcd_pdata = {
         .name                   = "lcd",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .driver_name            = "generic_dpi_panel",
-        .data                   = &lcd_panel,
-        .phy.dpi.data_lines     = 24,
+        .source                 = "dpi.0",
+
+        .data_lines             = 24,
+
+        .display_timing         = &devkit8000_lcd_videomode,
+
+        .enable_gpio            = -1,   /* filled in code */
+        .backlight_gpio         = -1,
 };
 
-static struct tfp410_platform_data dvi_panel = {
-        .power_down_gpio        = -1,
-        .i2c_bus_num            = 1,
+static struct platform_device devkit8000_lcd_device = {
+        .name                   = "panel-dpi",
+        .id                     = 0,
+        .dev.platform_data      = &devkit8000_lcd_pdata,
 };
 
-static struct omap_dss_device devkit8000_dvi_device = {
+static struct connector_dvi_platform_data devkit8000_dvi_connector_pdata = {
         .name                   = "dvi",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .driver_name            = "tfp410",
-        .data                   = &dvi_panel,
-        .phy.dpi.data_lines     = 24,
+        .source                 = "tfp410.0",
+        .i2c_bus_num            = 1,
 };
 
-static struct omap_dss_device devkit8000_tv_device = {
-        .name                   = "tv",
-        .driver_name            = "venc",
-        .type                   = OMAP_DISPLAY_TYPE_VENC,
-        .phy.venc.type          = OMAP_DSS_VENC_TYPE_SVIDEO,
+static struct platform_device devkit8000_dvi_connector_device = {
+        .name                   = "connector-dvi",
+        .id                     = 0,
+        .dev.platform_data      = &devkit8000_dvi_connector_pdata,
 };
 
+static struct encoder_tfp410_platform_data devkit8000_tfp410_pdata = {
+        .name                   = "tfp410.0",
+        .source                 = "dpi.0",
+        .data_lines             = 24,
+        .power_down_gpio        = -1,   /* filled in code */
+};
 
-static struct omap_dss_device *devkit8000_dss_devices[] = {
-        &devkit8000_lcd_device,
-        &devkit8000_dvi_device,
-        &devkit8000_tv_device,
+static struct platform_device devkit8000_tfp410_device = {
+        .name                   = "tfp410",
+        .id                     = 0,
+        .dev.platform_data      = &devkit8000_tfp410_pdata,
+};
+
+static struct connector_atv_platform_data devkit8000_tv_pdata = {
+        .name = "tv",
+        .source = "venc.0",
+        .connector_type = OMAP_DSS_VENC_TYPE_SVIDEO,
+        .invert_polarity = false,
+};
+
+static struct platform_device devkit8000_tv_connector_device = {
+        .name                   = "connector-analog-tv",
+        .id                     = 0,
+        .dev.platform_data      = &devkit8000_tv_pdata,
 };
 
 static struct omap_dss_board_info devkit8000_dss_data = {
-        .num_devices = ARRAY_SIZE(devkit8000_dss_devices),
-        .devices = devkit8000_dss_devices,
-        .default_device = &devkit8000_lcd_device,
+        .default_display_name = "lcd",
 };
 
 static uint32_t board_keymap[] = {
@@ -204,11 +235,10 @@ static int devkit8000_twl_gpio_setup(struct device *dev,
         gpio_leds[2].gpio = gpio + TWL4030_GPIO_MAX + 1;
 
         /* TWL4030_GPIO_MAX + 0 is "LCD_PWREN" (out, active high) */
-        lcd_panel.num_gpios = 1;
-        lcd_panel.gpios[0] = gpio + TWL4030_GPIO_MAX + 0;
+        devkit8000_lcd_pdata.enable_gpio = gpio + TWL4030_GPIO_MAX + 0;
 
         /* gpio + 7 is "DVI_PD" (out, active low) */
-        dvi_panel.power_down_gpio = gpio + 7;
+        devkit8000_tfp410_pdata.power_down_gpio = gpio + 7;
 
         return 0;
 }
@@ -413,6 +443,10 @@ static struct platform_device *devkit8000_devices[] __initdata = {
         &leds_gpio,
         &keys_gpio,
         &omap_dm9000_dev,
+        &devkit8000_lcd_device,
+        &devkit8000_tfp410_device,
+        &devkit8000_dvi_connector_device,
+        &devkit8000_tv_connector_device,
 };
 
 static struct usbhs_omap_platform_data usbhs_bdata __initdata = {
diff --git a/arch/arm/mach-omap2/board-h4.c b/arch/arm/mach-omap2/board-h4.c
index 69c0acf5aa63..87e41a8b8d46 100644
--- a/arch/arm/mach-omap2/board-h4.c
+++ b/arch/arm/mach-omap2/board-h4.c
@@ -194,30 +194,48 @@ static struct platform_device h4_flash_device = {
         .resource       = &h4_flash_resource,
 };
 
-static struct platform_device *h4_devices[] __initdata = {
-        &h4_flash_device,
+static const struct display_timing cm_t35_lcd_videomode = {
+        .pixelclock     = { 0, 6250000, 0 },
+
+        .hactive = { 0, 240, 0 },
+        .hfront_porch = { 0, 15, 0 },
+        .hback_porch = { 0, 60, 0 },
+        .hsync_len = { 0, 15, 0 },
+
+        .vactive = { 0, 320, 0 },
+        .vfront_porch = { 0, 1, 0 },
+        .vback_porch = { 0, 1, 0 },
+        .vsync_len = { 0, 1, 0 },
+
+        .flags = DISPLAY_FLAGS_HSYNC_HIGH | DISPLAY_FLAGS_VSYNC_HIGH |
+                DISPLAY_FLAGS_DE_HIGH | DISPLAY_FLAGS_PIXDATA_POSEDGE,
 };
 
-static struct panel_generic_dpi_data h4_panel_data = {
-        .name                   = "h4",
+static struct panel_dpi_platform_data cm_t35_lcd_pdata = {
+        .name                   = "lcd",
+        .source                 = "dpi.0",
+
+        .data_lines             = 16,
+
+        .display_timing         = &cm_t35_lcd_videomode,
+
+        .enable_gpio            = -1,
+        .backlight_gpio         = -1,
 };
 
-static struct omap_dss_device h4_lcd_device = {
-        .name                   = "lcd",
-        .driver_name            = "generic_dpi_panel",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .phy.dpi.data_lines     = 16,
-        .data                   = &h4_panel_data,
+static struct platform_device cm_t35_lcd_device = {
+        .name                   = "panel-dpi",
+        .id                     = 0,
+        .dev.platform_data      = &cm_t35_lcd_pdata,
 };
 
-static struct omap_dss_device *h4_dss_devices[] = {
-        &h4_lcd_device,
+static struct platform_device *h4_devices[] __initdata = {
+        &h4_flash_device,
+        &cm_t35_lcd_device,
 };
 
 static struct omap_dss_board_info h4_dss_data = {
-        .num_devices    = ARRAY_SIZE(h4_dss_devices),
-        .devices        = h4_dss_devices,
-        .default_device = &h4_lcd_device,
+        .default_display_name = "lcd",
 };
 
 /* 2420 Sysboot setup (2430 is different) */
diff --git a/arch/arm/mach-omap2/board-igep0020.c b/arch/arm/mach-omap2/board-igep0020.c
index 87e65dde8e13..06dbb2d3d38b 100644
--- a/arch/arm/mach-omap2/board-igep0020.c
+++ b/arch/arm/mach-omap2/board-igep0020.c
@@ -429,31 +429,39 @@ static struct twl4030_gpio_platform_data igep_twl4030_gpio_pdata = {
         .setup          = igep_twl_gpio_setup,
 };
 
-static struct tfp410_platform_data dvi_panel = {
-        .i2c_bus_num            = 3,
-        .power_down_gpio        = IGEP2_GPIO_DVI_PUP,
+static struct connector_dvi_platform_data omap3stalker_dvi_connector_pdata = {
+        .name                   = "dvi",
+        .source                 = "tfp410.0",
+        .i2c_bus_num            = 3,
 };
 
-static struct omap_dss_device igep2_dvi_device = {
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .name                   = "dvi",
-        .driver_name            = "tfp410",
-        .data                   = &dvi_panel,
-        .phy.dpi.data_lines     = 24,
+static struct platform_device omap3stalker_dvi_connector_device = {
+        .name                   = "connector-dvi",
+        .id                     = 0,
+        .dev.platform_data      = &omap3stalker_dvi_connector_pdata,
 };
 
-static struct omap_dss_device *igep2_dss_devices[] = {
-        &igep2_dvi_device
+static struct encoder_tfp410_platform_data omap3stalker_tfp410_pdata = {
+        .name                   = "tfp410.0",
+        .source                 = "dpi.0",
+        .data_lines             = 24,
+        .power_down_gpio        = IGEP2_GPIO_DVI_PUP,
+};
+
+static struct platform_device omap3stalker_tfp410_device = {
+        .name                   = "tfp410",
+        .id                     = 0,
+        .dev.platform_data      = &omap3stalker_tfp410_pdata,
 };
 
 static struct omap_dss_board_info igep2_dss_data = {
-        .num_devices    = ARRAY_SIZE(igep2_dss_devices),
-        .devices        = igep2_dss_devices,
-        .default_device = &igep2_dvi_device,
+        .default_display_name = "dvi",
 };
 
 static struct platform_device *igep_devices[] __initdata = {
         &igep_vwlan_device,
+        &omap3stalker_tfp410_device,
+        &omap3stalker_dvi_connector_device,
 };
 
 static int igep2_keymap[] = {
diff --git a/arch/arm/mach-omap2/board-ldp.c b/arch/arm/mach-omap2/board-ldp.c
index 62e4f701b63b..dd8da2c5399f 100644
--- a/arch/arm/mach-omap2/board-ldp.c
+++ b/arch/arm/mach-omap2/board-ldp.c
@@ -184,45 +184,70 @@ static inline void __init ldp_init_smsc911x(void)
 #define LCD_PANEL_RESET_GPIO            55
 #define LCD_PANEL_QVGA_GPIO             56
 
-static struct panel_generic_dpi_data ldp_panel_data = {
-        .name                   = "nec_nl2432dr22-11b",
-        .num_gpios              = 4,
-        /* gpios filled in code */
+static const struct display_timing ldp_lcd_videomode = {
+        .pixelclock     = { 0, 5400000, 0 },
+
+        .hactive = { 0, 240, 0 },
+        .hfront_porch = { 0, 3, 0 },
+        .hback_porch = { 0, 39, 0 },
+        .hsync_len = { 0, 3, 0 },
+
+        .vactive = { 0, 320, 0 },
+        .vfront_porch = { 0, 2, 0 },
+        .vback_porch = { 0, 7, 0 },
+        .vsync_len = { 0, 1, 0 },
+
+        .flags = DISPLAY_FLAGS_HSYNC_LOW | DISPLAY_FLAGS_VSYNC_LOW |
+                DISPLAY_FLAGS_DE_HIGH | DISPLAY_FLAGS_PIXDATA_POSEDGE,
 };
 
-static struct omap_dss_device ldp_lcd_device = {
-        .name                   = "lcd",
-        .driver_name            = "generic_dpi_panel",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .phy.dpi.data_lines     = 18,
-        .data                   = &ldp_panel_data,
+static struct panel_dpi_platform_data ldp_lcd_pdata = {
+        .name                   = "lcd",
+        .source                 = "dpi.0",
+
+        .data_lines             = 18,
+
+        .display_timing         = &ldp_lcd_videomode,
+
+        .enable_gpio            = -1,   /* filled in code */
+        .backlight_gpio         = -1,   /* filled in code */
 };
 
-static struct omap_dss_device *ldp_dss_devices[] = {
-        &ldp_lcd_device,
+static struct platform_device ldp_lcd_device = {
+        .name                   = "panel-dpi",
+        .id                     = 0,
+        .dev.platform_data      = &ldp_lcd_pdata,
 };
 
 static struct omap_dss_board_info ldp_dss_data = {
-        .num_devices    = ARRAY_SIZE(ldp_dss_devices),
-        .devices        = ldp_dss_devices,
-        .default_device = &ldp_lcd_device,
+        .default_display_name = "lcd",
 };
 
 static void __init ldp_display_init(void)
 {
-        ldp_panel_data.gpios[2] = LCD_PANEL_RESET_GPIO;
-        ldp_panel_data.gpios[3] = LCD_PANEL_QVGA_GPIO;
+        int r;
+
+        static struct gpio gpios[] __initdata = {
+                {LCD_PANEL_RESET_GPIO, GPIOF_OUT_INIT_HIGH, "LCD RESET"},
+                {LCD_PANEL_QVGA_GPIO, GPIOF_OUT_INIT_HIGH, "LCD QVGA"},
+        };
+
+        r = gpio_request_array(gpios, ARRAY_SIZE(gpios));
+        if (r) {
+                pr_err("Cannot request LCD GPIOs, error %d\n", r);
+                return;
+        }
 
         omap_display_init(&ldp_dss_data);
 }
 
 static int ldp_twl_gpio_setup(struct device *dev, unsigned gpio, unsigned ngpio)
 {
-        ldp_panel_data.gpios[0] = gpio + 7;
-        ldp_panel_data.gpio_invert[0] = true;
+        /* LCD enable GPIO */
+        ldp_lcd_pdata.enable_gpio = gpio + 7;
 
-        ldp_panel_data.gpios[1] = gpio + 15;
-        ldp_panel_data.gpio_invert[1] = true;
+        /* Backlight enable GPIO */
+        ldp_lcd_pdata.backlight_gpio = gpio + 15;
 
         return 0;
 }
@@ -322,6 +347,7 @@ static struct omap2_hsmmc_info mmc[] __initdata = {
 
 static struct platform_device *ldp_devices[] __initdata = {
         &ldp_gpio_keys_device,
+        &ldp_lcd_device,
 };
 
 #ifdef CONFIG_OMAP_MUX
diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c
index f6eeb87e4e95..827d15009a86 100644
--- a/arch/arm/mach-omap2/board-n8x0.c
+++ b/arch/arm/mach-omap2/board-n8x0.c
@@ -122,11 +122,7 @@ static struct musb_hdrc_config musb_config = {
 };
 
 static struct musb_hdrc_platform_data tusb_data = {
-#ifdef CONFIG_USB_GADGET_MUSB_HDRC
         .mode           = MUSB_OTG,
-#else
-        .mode           = MUSB_HOST,
-#endif
         .set_power      = tusb_set_power,
         .min_power      = 25,   /* x2 = 50 mA drawn from VBUS as peripheral */
         .power          = 100,  /* Max 100 mA VBUS for host mode */
diff --git a/arch/arm/mach-omap2/board-omap3beagle.c b/arch/arm/mach-omap2/board-omap3beagle.c
index 1c6ae5f5bae7..f26918467efc 100644
--- a/arch/arm/mach-omap2/board-omap3beagle.c
+++ b/arch/arm/mach-omap2/board-omap3beagle.c
@@ -225,35 +225,46 @@ static struct mtd_partition omap3beagle_nand_partitions[] = {
 
 /* DSS */
 
-static struct tfp410_platform_data dvi_panel = {
-        .i2c_bus_num = 3,
-        .power_down_gpio = -1,
+static struct connector_dvi_platform_data beagle_dvi_connector_pdata = {
+        .name                   = "dvi",
+        .source                 = "tfp410.0",
+        .i2c_bus_num            = 3,
 };
 
-static struct omap_dss_device beagle_dvi_device = {
-        .type = OMAP_DISPLAY_TYPE_DPI,
-        .name = "dvi",
-        .driver_name = "tfp410",
-        .data = &dvi_panel,
-        .phy.dpi.data_lines = 24,
+static struct platform_device beagle_dvi_connector_device = {
+        .name                   = "connector-dvi",
+        .id                     = 0,
+        .dev.platform_data      = &beagle_dvi_connector_pdata,
 };
 
-static struct omap_dss_device beagle_tv_device = {
+static struct encoder_tfp410_platform_data beagle_tfp410_pdata = {
+        .name                   = "tfp410.0",
+        .source                 = "dpi.0",
+        .data_lines             = 24,
+        .power_down_gpio        = -1,
+};
+
+static struct platform_device beagle_tfp410_device = {
+        .name                   = "tfp410",
+        .id                     = 0,
+        .dev.platform_data      = &beagle_tfp410_pdata,
+};
+
+static struct connector_atv_platform_data beagle_tv_pdata = {
         .name = "tv",
-        .driver_name = "venc",
-        .type = OMAP_DISPLAY_TYPE_VENC,
-        .phy.venc.type = OMAP_DSS_VENC_TYPE_SVIDEO,
+        .source = "venc.0",
+        .connector_type = OMAP_DSS_VENC_TYPE_SVIDEO,
+        .invert_polarity = false,
 };
 
-static struct omap_dss_device *beagle_dss_devices[] = {
-        &beagle_dvi_device,
-        &beagle_tv_device,
+static struct platform_device beagle_tv_connector_device = {
+        .name                   = "connector-analog-tv",
+        .id                     = 0,
+        .dev.platform_data      = &beagle_tv_pdata,
 };
 
 static struct omap_dss_board_info beagle_dss_data = {
-        .num_devices = ARRAY_SIZE(beagle_dss_devices),
-        .devices = beagle_dss_devices,
-        .default_device = &beagle_dvi_device,
+        .default_display_name = "dvi",
 };
 
 #include "sdram-micron-mt46h32m32lf-6.h"
@@ -332,7 +343,11 @@ static int beagle_twl_gpio_setup(struct device *dev,
                 if (gpio_request_one(gpio + 1, GPIOF_IN, "EHCI_nOC"))
                         pr_err("%s: unable to configure EHCI_nOC\n", __func__);
         }
-        dvi_panel.power_down_gpio = beagle_config.dvi_pd_gpio;
+        beagle_tfp410_pdata.power_down_gpio = beagle_config.dvi_pd_gpio;
+
+        platform_device_register(&beagle_tfp410_device);
+        platform_device_register(&beagle_dvi_connector_device);
+        platform_device_register(&beagle_tv_connector_device);
 
         /* TWL4030_GPIO_MAX i.e. LED_GPO controls HS USB Port 2 power */
         phy_data[0].vcc_gpio = gpio + TWL4030_GPIO_MAX;
@@ -547,6 +562,7 @@ static void __init omap3_beagle_init(void)
         if (gpio_is_valid(beagle_config.dvi_pd_gpio))
                 omap_mux_init_gpio(beagle_config.dvi_pd_gpio, OMAP_PIN_OUTPUT);
         omap_display_init(&beagle_dss_data);
+
         omap_serial_init();
         omap_sdrc_init(mt46h32m32lf6_sdrc_params,
                                   mt46h32m32lf6_sdrc_params);
diff --git a/arch/arm/mach-omap2/board-omap3evm.c b/arch/arm/mach-omap2/board-omap3evm.c
index 52bdddd41e0e..18143873346c 100644
--- a/arch/arm/mach-omap2/board-omap3evm.c
+++ b/arch/arm/mach-omap2/board-omap3evm.c
@@ -166,14 +166,6 @@ static inline void __init omap3evm_init_smsc911x(void) { return; }
  */
 #define OMAP3EVM_DVI_PANEL_EN_GPIO      199
 
-static struct panel_sharp_ls037v7dw01_data omap3_evm_lcd_data = {
-        .resb_gpio = OMAP3EVM_LCD_PANEL_RESB,
-        .ini_gpio = OMAP3EVM_LCD_PANEL_INI,
-        .mo_gpio = OMAP3EVM_LCD_PANEL_QVGA,
-        .lr_gpio = OMAP3EVM_LCD_PANEL_LR,
-        .ud_gpio = OMAP3EVM_LCD_PANEL_UD,
-};
-
 #ifdef CONFIG_BROKEN
 static void __init omap3_evm_display_init(void)
 {
@@ -196,44 +188,65 @@ static void __init omap3_evm_display_init(void)
 }
 #endif
 
-static struct omap_dss_device omap3_evm_lcd_device = {
-        .name                   = "lcd",
-        .driver_name            = "sharp_ls_panel",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .phy.dpi.data_lines     = 18,
-        .data                   = &omap3_evm_lcd_data,
+static struct panel_sharp_ls037v7dw01_platform_data omap3_evm_lcd_pdata = {
+        .name                   = "lcd",
+        .source                 = "dpi.0",
+
+        .data_lines             = 18,
+
+        .resb_gpio              = OMAP3EVM_LCD_PANEL_RESB,
+        .ini_gpio               = OMAP3EVM_LCD_PANEL_INI,
+        .mo_gpio                = OMAP3EVM_LCD_PANEL_QVGA,
+        .lr_gpio                = OMAP3EVM_LCD_PANEL_LR,
+        .ud_gpio                = OMAP3EVM_LCD_PANEL_UD,
+};
+
+static struct platform_device omap3_evm_lcd_device = {
+        .name                   = "panel-sharp-ls037v7dw01",
+        .id                     = 0,
+        .dev.platform_data      = &omap3_evm_lcd_pdata,
+};
+
+static struct connector_dvi_platform_data omap3_evm_dvi_connector_pdata = {
+        .name                   = "dvi",
+        .source                 = "tfp410.0",
+        .i2c_bus_num            = -1,
+};
+
+static struct platform_device omap3_evm_dvi_connector_device = {
+        .name                   = "connector-dvi",
+        .id                     = 0,
+        .dev.platform_data      = &omap3_evm_dvi_connector_pdata,
 };
 
-static struct omap_dss_device omap3_evm_tv_device = {
-        .name                   = "tv",
-        .driver_name            = "venc",
-        .type                   = OMAP_DISPLAY_TYPE_VENC,
-        .phy.venc.type          = OMAP_DSS_VENC_TYPE_SVIDEO,
+static struct encoder_tfp410_platform_data omap3_evm_tfp410_pdata = {
+        .name                   = "tfp410.0",
+        .source                 = "dpi.0",
+        .data_lines             = 24,
+        .power_down_gpio        = OMAP3EVM_DVI_PANEL_EN_GPIO,
 };
 
-static struct tfp410_platform_data dvi_panel = {
-        .power_down_gpio        = OMAP3EVM_DVI_PANEL_EN_GPIO,
-        .i2c_bus_num            = -1,
+static struct platform_device omap3_evm_tfp410_device = {
+        .name                   = "tfp410",
+        .id                     = 0,
+        .dev.platform_data      = &omap3_evm_tfp410_pdata,
 };
 
-static struct omap_dss_device omap3_evm_dvi_device = {
-        .name                   = "dvi",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .driver_name            = "tfp410",
-        .data                   = &dvi_panel,
-        .phy.dpi.data_lines     = 24,
+static struct connector_atv_platform_data omap3_evm_tv_pdata = {
+        .name = "tv",
+        .source = "venc.0",
+        .connector_type = OMAP_DSS_VENC_TYPE_SVIDEO,
+        .invert_polarity = false,
 };
 
-static struct omap_dss_device *omap3_evm_dss_devices[] = {
-        &omap3_evm_lcd_device,
-        &omap3_evm_tv_device,
-        &omap3_evm_dvi_device,
+static struct platform_device omap3_evm_tv_connector_device = {
+        .name                   = "connector-analog-tv",
+        .id                     = 0,
+        .dev.platform_data      = &omap3_evm_tv_pdata,
 };
 
 static struct omap_dss_board_info omap3_evm_dss_data = {
-        .num_devices    = ARRAY_SIZE(omap3_evm_dss_devices),
-        .devices        = omap3_evm_dss_devices,
-        .default_device = &omap3_evm_lcd_device,
+        .default_display_name = "lcd",
 };
 
 static struct regulator_consumer_supply omap3evm_vmmc1_supply[] = {
@@ -678,6 +691,10 @@ static void __init omap3_evm_init(void)
         omap3_evm_i2c_init();
 
         omap_display_init(&omap3_evm_dss_data);
+        platform_device_register(&omap3_evm_lcd_device);
+        platform_device_register(&omap3_evm_tfp410_device);
+        platform_device_register(&omap3_evm_dvi_connector_device);
+        platform_device_register(&omap3_evm_tv_connector_device);
 
         omap_serial_init();
         omap_sdrc_init(mt46h32m32lf6_sdrc_params, NULL);
diff --git a/arch/arm/mach-omap2/board-omap3pandora.c b/arch/arm/mach-omap2/board-omap3pandora.c
index d2b455e70486..de1bc6bbe585 100644
--- a/arch/arm/mach-omap2/board-omap3pandora.c
+++ b/arch/arm/mach-omap2/board-omap3pandora.c
@@ -231,34 +231,21 @@ static struct twl4030_keypad_data pandora_kp_data = {
         .rep            = 1,
 };
 
-static struct panel_tpo_td043_data lcd_data = {
-        .nreset_gpio            = 157,
-};
-
-static struct omap_dss_device pandora_lcd_device = {
-        .name                   = "lcd",
-        .driver_name            = "tpo_td043mtea1_panel",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .phy.dpi.data_lines     = 24,
-        .data                   = &lcd_data,
-};
-
-static struct omap_dss_device pandora_tv_device = {
-        .name                   = "tv",
-        .driver_name            = "venc",
-        .type                   = OMAP_DISPLAY_TYPE_VENC,
-        .phy.venc.type          = OMAP_DSS_VENC_TYPE_SVIDEO,
+static struct connector_atv_platform_data pandora_tv_pdata = {
+        .name = "tv",
+        .source = "venc.0",
+        .connector_type = OMAP_DSS_VENC_TYPE_SVIDEO,
+        .invert_polarity = false,
 };
 
-static struct omap_dss_device *pandora_dss_devices[] = {
-        &pandora_lcd_device,
-        &pandora_tv_device,
+static struct platform_device pandora_tv_connector_device = {
+        .name                   = "connector-analog-tv",
+        .id                     = 0,
+        .dev.platform_data      = &pandora_tv_pdata,
 };
 
 static struct omap_dss_board_info pandora_dss_data = {
-        .num_devices    = ARRAY_SIZE(pandora_dss_devices),
-        .devices        = pandora_dss_devices,
-        .default_device = &pandora_lcd_device,
+        .default_display_name = "lcd",
 };
 
 static void pandora_wl1251_init_card(struct mmc_card *card)
@@ -348,7 +335,7 @@ static struct regulator_consumer_supply pandora_vdds_supplies[] = {
 };
 
 static struct regulator_consumer_supply pandora_vcc_lcd_supply[] = {
-        REGULATOR_SUPPLY("vcc", "display0"),
+        REGULATOR_SUPPLY("vcc", "spi1.1"),
 };
 
 static struct regulator_consumer_supply pandora_usb_phy_supply[] = {
@@ -529,13 +516,21 @@ static int __init omap3pandora_i2c_init(void)
         return 0;
 }
 
+static struct panel_tpo_td043mtea1_platform_data pandora_lcd_pdata = {
+        .name                   = "lcd",
+        .source                 = "dpi.0",
+
+        .data_lines             = 24,
+        .nreset_gpio            = 157,
+};
+
 static struct spi_board_info omap3pandora_spi_board_info[] __initdata = {
         {
-                .modalias               = "tpo_td043mtea1_panel_spi",
+                .modalias               = "panel-tpo-td043mtea1",
                 .bus_num                = 1,
                 .chip_select            = 1,
                 .max_speed_hz           = 375000,
-                .platform_data          = &pandora_lcd_device,
+                .platform_data          = &pandora_lcd_pdata,
         }
 };
 
@@ -580,6 +575,7 @@ static struct platform_device *omap3pandora_devices[] __initdata = {
         &pandora_keys_gpio,
         &pandora_vwlan_device,
         &pandora_backlight,
+        &pandora_tv_connector_device,
 };
 
 static struct usbhs_omap_platform_data usbhs_bdata __initdata = {
diff --git a/arch/arm/mach-omap2/board-omap3stalker.c b/arch/arm/mach-omap2/board-omap3stalker.c
index d37e6b187ae4..ba8342fef799 100644
--- a/arch/arm/mach-omap2/board-omap3stalker.c
+++ b/arch/arm/mach-omap2/board-omap3stalker.c
@@ -93,40 +93,50 @@ static void __init omap3_stalker_display_init(void)
 {
         return;
 }
+static struct connector_dvi_platform_data omap3stalker_dvi_connector_pdata = {
+        .name                   = "dvi",
+        .source                 = "tfp410.0",
+        .i2c_bus_num            = -1,
+};
 
-static struct omap_dss_device omap3_stalker_tv_device = {
-        .name                   = "tv",
-        .driver_name            = "venc",
-        .type                   = OMAP_DISPLAY_TYPE_VENC,
-#if defined(CONFIG_OMAP2_VENC_OUT_TYPE_SVIDEO)
-        .phy.venc.type          = OMAP_DSS_VENC_TYPE_SVIDEO,
-#elif defined(CONFIG_OMAP2_VENC_OUT_TYPE_COMPOSITE)
-        .u.venc.type            = OMAP_DSS_VENC_TYPE_COMPOSITE,
-#endif
+static struct platform_device omap3stalker_dvi_connector_device = {
+        .name                   = "connector-dvi",
+        .id                     = 0,
+        .dev.platform_data      = &omap3stalker_dvi_connector_pdata,
 };
 
-static struct tfp410_platform_data dvi_panel = {
-        .power_down_gpio        = DSS_ENABLE_GPIO,
-        .i2c_bus_num            = -1,
+static struct encoder_tfp410_platform_data omap3stalker_tfp410_pdata = {
+        .name                   = "tfp410.0",
+        .source                 = "dpi.0",
+        .data_lines             = 24,
+        .power_down_gpio        = DSS_ENABLE_GPIO,
 };
 
-static struct omap_dss_device omap3_stalker_dvi_device = {
-        .name                   = "dvi",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .driver_name            = "tfp410",
-        .data                   = &dvi_panel,
-        .phy.dpi.data_lines     = 24,
+static struct platform_device omap3stalker_tfp410_device = {
+        .name                   = "tfp410",
+        .id                     = 0,
+        .dev.platform_data      = &omap3stalker_tfp410_pdata,
+};
+
+static struct connector_atv_platform_data omap3stalker_tv_pdata = {
+        .name = "tv",
+        .source = "venc.0",
+#if defined(CONFIG_OMAP2_VENC_OUT_TYPE_SVIDEO)
+        .connector_type = OMAP_DSS_VENC_TYPE_SVIDEO,
+#elif defined(CONFIG_OMAP2_VENC_OUT_TYPE_COMPOSITE)
+        .connector_type = OMAP_DSS_VENC_TYPE_COMPOSITE,
+#endif
+        .invert_polarity = false,
 };
 
-static struct omap_dss_device *omap3_stalker_dss_devices[] = {
-        &omap3_stalker_tv_device,
-        &omap3_stalker_dvi_device,
+static struct platform_device omap3stalker_tv_connector_device = {
+        .name                   = "connector-analog-tv",
+        .id                     = 0,
+        .dev.platform_data      = &omap3stalker_tv_pdata,
 };
 
 static struct omap_dss_board_info omap3_stalker_dss_data = {
-        .num_devices    = ARRAY_SIZE(omap3_stalker_dss_devices),
-        .devices        = omap3_stalker_dss_devices,
-        .default_device = &omap3_stalker_dvi_device,
+        .default_display_name = "dvi",
 };
 
 static struct regulator_consumer_supply omap3stalker_vmmc1_supply[] = {
@@ -356,6 +366,9 @@ static struct usbhs_phy_data phy_data[] __initdata = {
 
 static struct platform_device *omap3_stalker_devices[] __initdata = {
         &keys_gpio,
+        &omap3stalker_tfp410_device,
+        &omap3stalker_dvi_connector_device,
+        &omap3stalker_tv_connector_device,
 };
 
 static struct usbhs_omap_platform_data usbhs_bdata __initdata = {
diff --git a/arch/arm/mach-omap2/board-overo.c b/arch/arm/mach-omap2/board-overo.c
index 5748b5d06c23..f6d384111911 100644
--- a/arch/arm/mach-omap2/board-overo.c
+++ b/arch/arm/mach-omap2/board-overo.c
@@ -72,6 +72,9 @@
 #define OVERO_SMSC911X2_CS     4
 #define OVERO_SMSC911X2_GPIO   65
 
+/* whether to register LCD35 instead of LCD43 */
+static bool overo_use_lcd35;
+
 #if defined(CONFIG_TOUCHSCREEN_ADS7846) || \
         defined(CONFIG_TOUCHSCREEN_ADS7846_MODULE)
 
@@ -149,78 +152,94 @@ static inline void __init overo_init_smsc911x(void) { return; }
 #define OVERO_GPIO_LCD_EN 144
 #define OVERO_GPIO_LCD_BL 145
 
-static struct tfp410_platform_data dvi_panel = {
-        .i2c_bus_num            = 3,
-        .power_down_gpio        = -1,
+static struct connector_atv_platform_data overo_tv_pdata = {
+        .name = "tv",
+        .source = "venc.0",
+        .connector_type = OMAP_DSS_VENC_TYPE_SVIDEO,
+        .invert_polarity = false,
 };
 
-static struct omap_dss_device overo_dvi_device = {
-        .name                   = "dvi",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .driver_name            = "tfp410",
-        .data                   = &dvi_panel,
-        .phy.dpi.data_lines     = 24,
+static struct platform_device overo_tv_connector_device = {
+        .name                   = "connector-analog-tv",
+        .id                     = 0,
+        .dev.platform_data      = &overo_tv_pdata,
 };
 
-static struct omap_dss_device overo_tv_device = {
-        .name = "tv",
-        .driver_name = "venc",
-        .type = OMAP_DISPLAY_TYPE_VENC,
-        .phy.venc.type = OMAP_DSS_VENC_TYPE_SVIDEO,
+static const struct display_timing overo_lcd43_videomode = {
+        .pixelclock     = { 0, 9200000, 0 },
+
+        .hactive = { 0, 480, 0 },
+        .hfront_porch = { 0, 8, 0 },
+        .hback_porch = { 0, 4, 0 },
+        .hsync_len = { 0, 41, 0 },
+
+        .vactive = { 0, 272, 0 },
+        .vfront_porch = { 0, 4, 0 },
+        .vback_porch = { 0, 2, 0 },
+        .vsync_len = { 0, 10, 0 },
+
+        .flags = DISPLAY_FLAGS_HSYNC_LOW | DISPLAY_FLAGS_VSYNC_LOW |
+                DISPLAY_FLAGS_DE_HIGH | DISPLAY_FLAGS_PIXDATA_POSEDGE,
 };
 
-static struct panel_generic_dpi_data lcd43_panel = {
-        .name                   = "samsung_lte430wq_f0c",
-        .num_gpios              = 2,
-        .gpios                  = {
-                OVERO_GPIO_LCD_EN,
-                OVERO_GPIO_LCD_BL
-        },
+static struct panel_dpi_platform_data overo_lcd43_pdata = {
+        .name                   = "lcd43",
+        .source                 = "dpi.0",
+
+        .data_lines             = 24,
+
+        .display_timing         = &overo_lcd43_videomode,
+
+        .enable_gpio            = OVERO_GPIO_LCD_EN,
+        .backlight_gpio         = OVERO_GPIO_LCD_BL,
 };
 
-static struct omap_dss_device overo_lcd43_device = {
-        .name                   = "lcd43",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .driver_name            = "generic_dpi_panel",
-        .data                   = &lcd43_panel,
-        .phy.dpi.data_lines     = 24,
+static struct platform_device overo_lcd43_device = {
+        .name                   = "panel-dpi",
+        .id                     = 0,
+        .dev.platform_data      = &overo_lcd43_pdata,
 };
 
-#if defined(CONFIG_PANEL_LGPHILIPS_LB035Q02) || \
-        defined(CONFIG_PANEL_LGPHILIPS_LB035Q02_MODULE)
-static struct panel_generic_dpi_data lcd35_panel = {
-        .num_gpios              = 2,
-        .gpios                  = {
-                OVERO_GPIO_LCD_EN,
-                OVERO_GPIO_LCD_BL
-        },
+static struct connector_dvi_platform_data overo_dvi_connector_pdata = {
+        .name                   = "dvi",
+        .source                 = "tfp410.0",
+        .i2c_bus_num            = 3,
 };
 
-static struct omap_dss_device overo_lcd35_device = {
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .name                   = "lcd35",
-        .driver_name            = "lgphilips_lb035q02_panel",
-        .phy.dpi.data_lines     = 24,
-        .data                   = &lcd35_panel,
+static struct platform_device overo_dvi_connector_device = {
+        .name                   = "connector-dvi",
+        .id                     = 0,
+        .dev.platform_data      = &overo_dvi_connector_pdata,
 };
-#endif
 
-static struct omap_dss_device *overo_dss_devices[] = {
-        &overo_dvi_device,
-        &overo_tv_device,
-#if defined(CONFIG_PANEL_LGPHILIPS_LB035Q02) || \
-        defined(CONFIG_PANEL_LGPHILIPS_LB035Q02_MODULE)
-        &overo_lcd35_device,
-#endif
-        &overo_lcd43_device,
+static struct encoder_tfp410_platform_data overo_tfp410_pdata = {
+        .name                   = "tfp410.0",
+        .source                 = "dpi.0",
+        .data_lines             = 24,
+        .power_down_gpio        = -1,
+};
+
+static struct platform_device overo_tfp410_device = {
+        .name                   = "tfp410",
+        .id                     = 0,
+        .dev.platform_data      = &overo_tfp410_pdata,
 };
 
 static struct omap_dss_board_info overo_dss_data = {
-        .num_devices    = ARRAY_SIZE(overo_dss_devices),
-        .devices        = overo_dss_devices,
-        .default_device = &overo_dvi_device,
+        .default_display_name = "lcd43",
 };
 
+static void __init overo_display_init(void)
+{
+        omap_display_init(&overo_dss_data);
+
+        if (!overo_use_lcd35)
+                platform_device_register(&overo_lcd43_device);
+        platform_device_register(&overo_tfp410_device);
+        platform_device_register(&overo_dvi_connector_device);
+        platform_device_register(&overo_tv_connector_device);
+}
+
 static struct mtd_partition overo_nand_partitions[] = {
         {
                 .name           = "xloader",
@@ -408,24 +427,41 @@ static int __init overo_i2c_init(void)
         return 0;
 }
 
+static struct panel_lb035q02_platform_data overo_lcd35_pdata = {
+        .name                   = "lcd35",
+        .source                 = "dpi.0",
+
+        .data_lines             = 24,
+
+        .enable_gpio            = OVERO_GPIO_LCD_EN,
+        .backlight_gpio         = OVERO_GPIO_LCD_BL,
+};
+
+/*
+ * NOTE: We need to add either the lgphilips panel, or the lcd43 panel. The
+ * selection is done based on the overo_use_lcd35 field. If new SPI
+ * devices are added here, extra work is needed to make only the lgphilips panel
+ * affected by the overo_use_lcd35 field.
+ */
 static struct spi_board_info overo_spi_board_info[] __initdata = {
-#if defined(CONFIG_PANEL_LGPHILIPS_LB035Q02) || \
-        defined(CONFIG_PANEL_LGPHILIPS_LB035Q02_MODULE)
         {
-                .modalias               = "lgphilips_lb035q02_panel-spi",
+                .modalias               = "panel_lgphilips_lb035q02",
                 .bus_num                = 1,
                 .chip_select            = 1,
                 .max_speed_hz           = 500000,
                 .mode                   = SPI_MODE_3,
+                .platform_data          = &overo_lcd35_pdata,
         },
-#endif
 };
 
 static int __init overo_spi_init(void)
 {
         overo_ads7846_init();
-        spi_register_board_info(overo_spi_board_info,
-                        ARRAY_SIZE(overo_spi_board_info));
+
+        if (overo_use_lcd35) {
+                spi_register_board_info(overo_spi_board_info,
+                                ARRAY_SIZE(overo_spi_board_info));
+        }
         return 0;
 }
 
@@ -463,11 +499,13 @@ static void __init overo_init(void)
 {
         int ret;
 
+        if (strstr(boot_command_line, "omapdss.def_disp=lcd35"))
+                overo_use_lcd35 = true;
+
         regulator_register_fixed(0, dummy_supplies, ARRAY_SIZE(dummy_supplies));
         omap3_mux_init(board_mux, OMAP_PACKAGE_CBB);
         overo_i2c_init();
         omap_hsmmc_init(mmc);
-        omap_display_init(&overo_dss_data);
         omap_serial_init();
         omap_sdrc_init(mt46h32m32lf6_sdrc_params,
                                   mt46h32m32lf6_sdrc_params);
@@ -484,6 +522,8 @@ static void __init overo_init(void)
         overo_init_keys();
         omap_twl4030_audio_init("overo", NULL);
 
+        overo_display_init();
+
         /* Ensure SDRC pins are mux'd for self-refresh */
         omap_mux_init_signal("sdrc_cke0", OMAP_PIN_OUTPUT);
         omap_mux_init_signal("sdrc_cke1", OMAP_PIN_OUTPUT);
diff --git a/arch/arm/mach-omap2/board-rx51-peripherals.c b/arch/arm/mach-omap2/board-rx51-peripherals.c
index 9c2dd102fbbb..c3270c0f1fce 100644
--- a/arch/arm/mach-omap2/board-rx51-peripherals.c
+++ b/arch/arm/mach-omap2/board-rx51-peripherals.c
@@ -45,6 +45,8 @@
 #include <linux/platform_data/tsl2563.h>
 #include <linux/lis3lv02d.h>
 
+#include <video/omap-panel-data.h>
+
 #if defined(CONFIG_IR_RX51) || defined(CONFIG_IR_RX51_MODULE)
 #include <media/ir-rx51.h>
 #endif
@@ -226,6 +228,15 @@ static struct lp55xx_platform_data rx51_lp5523_platform_data = {
 };
 #endif
 
+#define RX51_LCD_RESET_GPIO     90
+
+static struct panel_acx565akm_platform_data acx_pdata = {
+        .name           = "lcd",
+        .source         = "sdi.0",
+        .reset_gpio     = RX51_LCD_RESET_GPIO,
+        .datapairs      = 2,
+};
+
 static struct omap2_mcspi_device_config wl1251_mcspi_config = {
         .turbo_mode     = 0,
 };
@@ -254,6 +265,7 @@ static struct spi_board_info rx51_peripherals_spi_board_info[] __initdata = {
                 .chip_select            = 2,
                 .max_speed_hz           = 6000000,
                 .controller_data        = &mipid_mcspi_config,
+                .platform_data          = &acx_pdata,
         },
         [RX51_SPI_TSC2005] = {
                 .modalias               = "tsc2005",
diff --git a/arch/arm/mach-omap2/board-rx51-video.c b/arch/arm/mach-omap2/board-rx51-video.c
index bdd1e3a179e1..43a90c8d6837 100644
--- a/arch/arm/mach-omap2/board-rx51-video.c
+++ b/arch/arm/mach-omap2/board-rx51-video.c
@@ -29,34 +29,21 @@
 
 #if defined(CONFIG_FB_OMAP2) || defined(CONFIG_FB_OMAP2_MODULE)
 
-static struct panel_acx565akm_data lcd_data = {
-        .reset_gpio     = RX51_LCD_RESET_GPIO,
+static struct connector_atv_platform_data rx51_tv_pdata = {
+        .name = "tv",
+        .source = "venc.0",
+        .connector_type = OMAP_DSS_VENC_TYPE_COMPOSITE,
+        .invert_polarity = false,
 };
 
-static struct omap_dss_device rx51_lcd_device = {
-        .name                   = "lcd",
-        .driver_name            = "panel-acx565akm",
-        .type                   = OMAP_DISPLAY_TYPE_SDI,
-        .phy.sdi.datapairs      = 2,
-        .data                   = &lcd_data,
-};
-
-static struct omap_dss_device  rx51_tv_device = {
-        .name                   = "tv",
-        .type                   = OMAP_DISPLAY_TYPE_VENC,
-        .driver_name            = "venc",
-        .phy.venc.type          = OMAP_DSS_VENC_TYPE_COMPOSITE,
-};
-
-static struct omap_dss_device *rx51_dss_devices[] = {
-        &rx51_lcd_device,
-        &rx51_tv_device,
+static struct platform_device rx51_tv_connector_device = {
+        .name                   = "connector-analog-tv",
+        .id                     = 0,
+        .dev.platform_data      = &rx51_tv_pdata,
 };
 
 static struct omap_dss_board_info rx51_dss_board_info = {
-        .num_devices    = ARRAY_SIZE(rx51_dss_devices),
-        .devices        = rx51_dss_devices,
-        .default_device = &rx51_lcd_device,
+        .default_display_name = "lcd",
 };
 
 static int __init rx51_video_init(void)
@@ -71,6 +58,8 @@ static int __init rx51_video_init(void)
 
         omap_display_init(&rx51_dss_board_info);
 
+        platform_device_register(&rx51_tv_connector_device);
+
         return 0;
 }
 
diff --git a/arch/arm/mach-omap2/board-rx51.c b/arch/arm/mach-omap2/board-rx51.c
index d2ea68ea678a..7735105561d8 100644
--- a/arch/arm/mach-omap2/board-rx51.c
+++ b/arch/arm/mach-omap2/board-rx51.c
@@ -85,7 +85,7 @@ static struct omap_board_mux board_mux[] __initdata = {
 
 static struct omap_musb_board_data musb_board_data = {
         .interface_type         = MUSB_INTERFACE_ULPI,
-        .mode                   = MUSB_PERIPHERAL,
+        .mode                   = MUSB_OTG,
         .power                  = 0,
 };
 
diff --git a/arch/arm/mach-omap2/board-zoom-display.c b/arch/arm/mach-omap2/board-zoom-display.c
index c2a079cb76fc..3d8ecc1e05bd 100644
--- a/arch/arm/mach-omap2/board-zoom-display.c
+++ b/arch/arm/mach-omap2/board-zoom-display.c
@@ -25,32 +25,23 @@
 #define LCD_PANEL_RESET_GPIO_PILOT      55
 #define LCD_PANEL_QVGA_GPIO             56
 
-static struct panel_nec_nl8048_data zoom_lcd_data = {
-        /* res_gpio filled in code */
-        .qvga_gpio = LCD_PANEL_QVGA_GPIO,
-};
+static struct panel_nec_nl8048hl11_platform_data zoom_lcd_pdata = {
+        .name                   = "lcd",
+        .source                 = "dpi.0",
 
-static struct omap_dss_device zoom_lcd_device = {
-        .name                   = "lcd",
-        .driver_name            = "NEC_8048_panel",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .phy.dpi.data_lines     = 24,
-        .data                   = &zoom_lcd_data,
-};
+        .data_lines             = 24,
 
-static struct omap_dss_device *zoom_dss_devices[] = {
-        &zoom_lcd_device,
+        .res_gpio               = -1,   /* filled in code */
+        .qvga_gpio              = LCD_PANEL_QVGA_GPIO,
 };
 
 static struct omap_dss_board_info zoom_dss_data = {
-        .num_devices            = ARRAY_SIZE(zoom_dss_devices),
-        .devices                = zoom_dss_devices,
-        .default_device         = &zoom_lcd_device,
+        .default_display_name = "lcd",
 };
 
 static void __init zoom_lcd_panel_init(void)
 {
-        zoom_lcd_data.res_gpio = (omap_rev() > OMAP3430_REV_ES3_0) ?
+        zoom_lcd_pdata.res_gpio = (omap_rev() > OMAP3430_REV_ES3_0) ?
                         LCD_PANEL_RESET_GPIO_PROD :
                         LCD_PANEL_RESET_GPIO_PILOT;
 }
@@ -61,19 +52,20 @@ static struct omap2_mcspi_device_config dss_lcd_mcspi_config = {
 
 static struct spi_board_info nec_8048_spi_board_info[] __initdata = {
         [0] = {
-                .modalias               = "nec_8048_spi",
+                .modalias               = "panel-nec-nl8048hl11",
                 .bus_num                = 1,
                 .chip_select            = 2,
                 .max_speed_hz           = 375000,
                 .controller_data        = &dss_lcd_mcspi_config,
+                .platform_data          = &zoom_lcd_pdata,
         },
 };
 
 void __init zoom_display_init(void)
 {
         omap_display_init(&zoom_dss_data);
+        zoom_lcd_panel_init();
         spi_register_board_info(nec_8048_spi_board_info,
                                 ARRAY_SIZE(nec_8048_spi_board_info));
-        zoom_lcd_panel_init();
 }
 
diff --git a/arch/arm/mach-omap2/devices.c b/arch/arm/mach-omap2/devices.c
index 3c1279f27d1f..73ae7536a32b 100644
--- a/arch/arm/mach-omap2/devices.c
+++ b/arch/arm/mach-omap2/devices.c
@@ -327,44 +327,6 @@ static void omap_init_audio(void)
 static inline void omap_init_audio(void) {}
 #endif
 
-#if defined(CONFIG_SND_OMAP_SOC_MCPDM) || \
-                defined(CONFIG_SND_OMAP_SOC_MCPDM_MODULE)
-
-static void __init omap_init_mcpdm(void)
-{
-        struct omap_hwmod *oh;
-        struct platform_device *pdev;
-
-        oh = omap_hwmod_lookup("mcpdm");
-        if (!oh)
-                return;
-
-        pdev = omap_device_build("omap-mcpdm", -1, oh, NULL, 0);
-        WARN(IS_ERR(pdev), "Can't build omap_device for omap-mcpdm.\n");
-}
-#else
-static inline void omap_init_mcpdm(void) {}
-#endif
-
-#if defined(CONFIG_SND_OMAP_SOC_DMIC) || \
-                defined(CONFIG_SND_OMAP_SOC_DMIC_MODULE)
-
-static void __init omap_init_dmic(void)
-{
-        struct omap_hwmod *oh;
-        struct platform_device *pdev;
-
-        oh = omap_hwmod_lookup("dmic");
-        if (!oh)
-                return;
-
-        pdev = omap_device_build("omap-dmic", -1, oh, NULL, 0);
-        WARN(IS_ERR(pdev), "Can't build omap_device for omap-dmic.\n");
-}
-#else
-static inline void omap_init_dmic(void) {}
-#endif
-
 #if defined(CONFIG_SND_OMAP_SOC_OMAP_HDMI) || \
                 defined(CONFIG_SND_OMAP_SOC_OMAP_HDMI_MODULE)
 
@@ -565,8 +527,6 @@ static int __init omap2_init_devices(void)
         omap_init_mbox();
         /* If dtb is there, the devices will be created dynamically */
         if (!of_have_populated_dt()) {
-                omap_init_dmic();
-                omap_init_mcpdm();
                 omap_init_mcspi();
                 omap_init_sham();
                 omap_init_aes();
diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c
index ff37be1f6f93..03a0516c7f67 100644
--- a/arch/arm/mach-omap2/display.c
+++ b/arch/arm/mach-omap2/display.c
@@ -400,7 +400,7 @@ int __init omap_display_init(struct omap_dss_board_info *board_data)
 
         /* Create devices for DPI and SDI */
 
-        pdev = create_simple_dss_pdev("omapdss_dpi", -1,
+        pdev = create_simple_dss_pdev("omapdss_dpi", 0,
                         board_data, sizeof(*board_data), dss_pdev);
         if (IS_ERR(pdev)) {
                 pr_err("Could not build platform_device for omapdss_dpi\n");
@@ -408,7 +408,7 @@ int __init omap_display_init(struct omap_dss_board_info *board_data)
         }
 
         if (cpu_is_omap34xx()) {
-                pdev = create_simple_dss_pdev("omapdss_sdi", -1,
+                pdev = create_simple_dss_pdev("omapdss_sdi", 0,
                                 board_data, sizeof(*board_data), dss_pdev);
                 if (IS_ERR(pdev)) {
                         pr_err("Could not build platform_device for omapdss_sdi\n");
diff --git a/arch/arm/mach-omap2/dss-common.c b/arch/arm/mach-omap2/dss-common.c
index 393aeefaebb0..bf89effa4c99 100644
--- a/arch/arm/mach-omap2/dss-common.c
+++ b/arch/arm/mach-omap2/dss-common.c
@@ -25,6 +25,7 @@
 
 #include <linux/kernel.h>
 #include <linux/gpio.h>
+#include <linux/platform_device.h>
 
 #include <video/omapdss.h>
 #include <video/omap-panel-data.h>
@@ -37,70 +38,76 @@
 #define HDMI_GPIO_LS_OE 41 /* Level shifter for HDMI */
 #define HDMI_GPIO_HPD  63 /* Hotplug detect */
 
-/* Display DVI */
 #define PANDA_DVI_TFP410_POWER_DOWN_GPIO        0
 
-/* Using generic display panel */
-static struct tfp410_platform_data omap4_dvi_panel = {
-        .i2c_bus_num            = 3,
-        .power_down_gpio        = PANDA_DVI_TFP410_POWER_DOWN_GPIO,
+/* DVI Connector */
+static struct connector_dvi_platform_data omap4_panda_dvi_connector_pdata = {
+        .name                   = "dvi",
+        .source                 = "tfp410.0",
+        .i2c_bus_num            = 2,
 };
 
-static struct omap_dss_device omap4_panda_dvi_device = {
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .name                   = "dvi",
-        .driver_name            = "tfp410",
-        .data                   = &omap4_dvi_panel,
-        .phy.dpi.data_lines     = 24,
-        .channel                = OMAP_DSS_CHANNEL_LCD2,
+static struct platform_device omap4_panda_dvi_connector_device = {
+        .name                   = "connector-dvi",
+        .id                     = 0,
+        .dev.platform_data      = &omap4_panda_dvi_connector_pdata,
 };
 
-static struct omap_dss_hdmi_data omap4_panda_hdmi_data = {
+/* TFP410 DPI-to-DVI chip */
+static struct encoder_tfp410_platform_data omap4_panda_tfp410_pdata = {
+        .name                   = "tfp410.0",
+        .source                 = "dpi.0",
+        .data_lines             = 24,
+        .power_down_gpio        = PANDA_DVI_TFP410_POWER_DOWN_GPIO,
+};
+
+static struct platform_device omap4_panda_tfp410_device = {
+        .name                   = "tfp410",
+        .id                     = 0,
+        .dev.platform_data      = &omap4_panda_tfp410_pdata,
+};
+
+/* HDMI Connector */
+static struct connector_hdmi_platform_data omap4_panda_hdmi_connector_pdata = {
+        .name                   = "hdmi",
+        .source                 = "tpd12s015.0",
+};
+
+static struct platform_device omap4_panda_hdmi_connector_device = {
+        .name                   = "connector-hdmi",
+        .id                     = 0,
+        .dev.platform_data      = &omap4_panda_hdmi_connector_pdata,
+};
+
+/* TPD12S015 HDMI ESD protection & level shifter chip */
+static struct encoder_tpd12s015_platform_data omap4_panda_tpd_pdata = {
+        .name                   = "tpd12s015.0",
+        .source                 = "hdmi.0",
+
         .ct_cp_hpd_gpio = HDMI_GPIO_CT_CP_HPD,
         .ls_oe_gpio = HDMI_GPIO_LS_OE,
         .hpd_gpio = HDMI_GPIO_HPD,
 };
 
-static struct omap_dss_device  omap4_panda_hdmi_device = {
-        .name = "hdmi",
-        .driver_name = "hdmi_panel",
-        .type = OMAP_DISPLAY_TYPE_HDMI,
-        .channel = OMAP_DSS_CHANNEL_DIGIT,
-        .data = &omap4_panda_hdmi_data,
-};
-
-static struct omap_dss_device *omap4_panda_dss_devices[] = {
-        &omap4_panda_dvi_device,
-        &omap4_panda_hdmi_device,
+static struct platform_device omap4_panda_tpd_device = {
+        .name                   = "tpd12s015",
+        .id                     = 0,
+        .dev.platform_data      = &omap4_panda_tpd_pdata,
 };
 
 static struct omap_dss_board_info omap4_panda_dss_data = {
-        .num_devices    = ARRAY_SIZE(omap4_panda_dss_devices),
-        .devices        = omap4_panda_dss_devices,
-        .default_device = &omap4_panda_dvi_device,
+        .default_display_name = "dvi",
 };
 
-void __init omap4_panda_display_init(void)
+void __init omap4_panda_display_init_of(void)
 {
         omap_display_init(&omap4_panda_dss_data);
 
-        /*
-         * OMAP4460SDP/Blaze and OMAP4430 ES2.3 SDP/Blaze boards and
-         * later have external pull up on the HDMI I2C lines
-         */
-        if (cpu_is_omap446x() || omap_rev() > OMAP4430_REV_ES2_2)
-                omap_hdmi_init(OMAP_HDMI_SDA_SCL_EXTERNAL_PULLUP);
-        else
-                omap_hdmi_init(0);
-
-        omap_mux_init_gpio(HDMI_GPIO_LS_OE, OMAP_PIN_OUTPUT);
-        omap_mux_init_gpio(HDMI_GPIO_CT_CP_HPD, OMAP_PIN_OUTPUT);
-        omap_mux_init_gpio(HDMI_GPIO_HPD, OMAP_PIN_INPUT_PULLDOWN);
-}
+        platform_device_register(&omap4_panda_tfp410_device);
+        platform_device_register(&omap4_panda_dvi_connector_device);
 
-void __init omap4_panda_display_init_of(void)
-{
-        omap_display_init(&omap4_panda_dss_data);
+        platform_device_register(&omap4_panda_tpd_device);
+        platform_device_register(&omap4_panda_hdmi_connector_device);
 }
 
 
@@ -109,93 +116,73 @@ void __init omap4_panda_display_init_of(void)
 #define DISPLAY_SEL_GPIO        59      /* LCD2/PicoDLP switch */
 #define DLP_POWER_ON_GPIO       40
 
-static struct nokia_dsi_panel_data dsi1_panel = {
-                .name           = "taal",
-                .reset_gpio     = 102,
-                .use_ext_te     = false,
-                .ext_te_gpio    = 101,
-                .esd_interval   = 0,
-                .pin_config = {
-                        .num_pins       = 6,
-                        .pins           = { 0, 1, 2, 3, 4, 5 },
-                },
-};
-
-static struct omap_dss_device sdp4430_lcd_device = {
-        .name                   = "lcd",
-        .driver_name            = "taal",
-        .type                   = OMAP_DISPLAY_TYPE_DSI,
-        .data                   = &dsi1_panel,
-        .phy.dsi                = {
-                .module         = 0,
+static struct panel_dsicm_platform_data dsi1_panel = {
+        .name           = "lcd",
+        .source         = "dsi.0",
+        .reset_gpio     = 102,
+        .use_ext_te     = false,
+        .ext_te_gpio    = 101,
+        .pin_config = {
+                .num_pins       = 6,
+                .pins           = { 0, 1, 2, 3, 4, 5 },
         },
-        .channel                = OMAP_DSS_CHANNEL_LCD,
 };
 
-static struct nokia_dsi_panel_data dsi2_panel = {
-                .name           = "taal",
-                .reset_gpio     = 104,
-                .use_ext_te     = false,
-                .ext_te_gpio    = 103,
-                .esd_interval   = 0,
-                .pin_config = {
-                        .num_pins       = 6,
-                        .pins           = { 0, 1, 2, 3, 4, 5 },
-                },
+static struct platform_device sdp4430_lcd_device = {
+        .name                   = "panel-dsi-cm",
+        .id                     = 0,
+        .dev.platform_data      = &dsi1_panel,
 };
 
-static struct omap_dss_device sdp4430_lcd2_device = {
-        .name                   = "lcd2",
-        .driver_name            = "taal",
-        .type                   = OMAP_DISPLAY_TYPE_DSI,
-        .data                   = &dsi2_panel,
-        .phy.dsi                = {
-
-                .module         = 1,
+static struct panel_dsicm_platform_data dsi2_panel = {
+        .name           = "lcd2",
+        .source         = "dsi.1",
+        .reset_gpio     = 104,
+        .use_ext_te     = false,
+        .ext_te_gpio    = 103,
+        .pin_config = {
+                .num_pins       = 6,
+                .pins           = { 0, 1, 2, 3, 4, 5 },
         },
-        .channel                = OMAP_DSS_CHANNEL_LCD2,
 };
 
-static struct omap_dss_hdmi_data sdp4430_hdmi_data = {
-        .ct_cp_hpd_gpio = HDMI_GPIO_CT_CP_HPD,
-        .ls_oe_gpio = HDMI_GPIO_LS_OE,
-        .hpd_gpio = HDMI_GPIO_HPD,
+static struct platform_device sdp4430_lcd2_device = {
+        .name                   = "panel-dsi-cm",
+        .id                     = 1,
+        .dev.platform_data      = &dsi2_panel,
 };
 
-static struct omap_dss_device sdp4430_hdmi_device = {
-        .name = "hdmi",
-        .driver_name = "hdmi_panel",
-        .type = OMAP_DISPLAY_TYPE_HDMI,
-        .channel = OMAP_DSS_CHANNEL_DIGIT,
-        .data = &sdp4430_hdmi_data,
+/* HDMI Connector */
+static struct connector_hdmi_platform_data sdp4430_hdmi_connector_pdata = {
+        .name                   = "hdmi",
+        .source                 = "tpd12s015.0",
 };
 
-static struct picodlp_panel_data sdp4430_picodlp_pdata = {
-        .picodlp_adapter_id     = 2,
-        .emu_done_gpio          = 44,
-        .pwrgood_gpio           = 45,
+static struct platform_device sdp4430_hdmi_connector_device = {
+        .name                   = "connector-hdmi",
+        .id                     = 0,
+        .dev.platform_data      = &sdp4430_hdmi_connector_pdata,
 };
 
-static struct omap_dss_device sdp4430_picodlp_device = {
-        .name                   = "picodlp",
-        .driver_name            = "picodlp_panel",
-        .type                   = OMAP_DISPLAY_TYPE_DPI,
-        .phy.dpi.data_lines     = 24,
-        .channel                = OMAP_DSS_CHANNEL_LCD2,
-        .data                   = &sdp4430_picodlp_pdata,
+/* TPD12S015 HDMI ESD protection & level shifter chip */
+static struct encoder_tpd12s015_platform_data sdp4430_tpd_pdata = {
+        .name                   = "tpd12s015.0",
+        .source                 = "hdmi.0",
+
+        .ct_cp_hpd_gpio = HDMI_GPIO_CT_CP_HPD,
+        .ls_oe_gpio = HDMI_GPIO_LS_OE,
+        .hpd_gpio = HDMI_GPIO_HPD,
 };
 
-static struct omap_dss_device *sdp4430_dss_devices[] = {
-        &sdp4430_lcd_device,
-        &sdp4430_lcd2_device,
-        &sdp4430_hdmi_device,
-        &sdp4430_picodlp_device,
+static struct platform_device sdp4430_tpd_device = {
+        .name                   = "tpd12s015",
+        .id                     = 0,
+        .dev.platform_data      = &sdp4430_tpd_pdata,
 };
 
+
 static struct omap_dss_board_info sdp4430_dss_data = {
-        .num_devices    = ARRAY_SIZE(sdp4430_dss_devices),
-        .devices        = sdp4430_dss_devices,
-        .default_device = &sdp4430_lcd_device,
+        .default_display_name = "lcd",
 };
 
 /*
@@ -204,7 +191,7 @@ static struct omap_dss_board_info sdp4430_dss_data = {
  * used by picodlp on the 4430sdp platform. Keep this gpio disabled as LCD2 is
  * selected by default
  */
-void __init omap_4430sdp_display_init(void)
+void __init omap_4430sdp_display_init_of(void)
 {
         int r;
 
@@ -219,33 +206,10 @@ void __init omap_4430sdp_display_init(void)
                 pr_err("%s: Could not get DLP POWER ON GPIO\n", __func__);
 
         omap_display_init(&sdp4430_dss_data);
-        /*
-         * OMAP4460SDP/Blaze and OMAP4430 ES2.3 SDP/Blaze boards and
-         * later have external pull up on the HDMI I2C lines
-         */
-        if (cpu_is_omap446x() || omap_rev() > OMAP4430_REV_ES2_2)
-                omap_hdmi_init(OMAP_HDMI_SDA_SCL_EXTERNAL_PULLUP);
-        else
-                omap_hdmi_init(0);
-
-        omap_mux_init_gpio(HDMI_GPIO_LS_OE, OMAP_PIN_OUTPUT);
-        omap_mux_init_gpio(HDMI_GPIO_CT_CP_HPD, OMAP_PIN_OUTPUT);
-        omap_mux_init_gpio(HDMI_GPIO_HPD, OMAP_PIN_INPUT_PULLDOWN);
-}
-
-void __init omap_4430sdp_display_init_of(void)
-{
-        int r;
 
-        r = gpio_request_one(DISPLAY_SEL_GPIO, GPIOF_OUT_INIT_HIGH,
-                        "display_sel");
-        if (r)
-                pr_err("%s: Could not get display_sel GPIO\n", __func__);
-
-        r = gpio_request_one(DLP_POWER_ON_GPIO, GPIOF_OUT_INIT_LOW,
-                "DLP POWER ON");
-        if (r)
-                pr_err("%s: Could not get DLP POWER ON GPIO\n", __func__);
+        platform_device_register(&sdp4430_lcd_device);
+        platform_device_register(&sdp4430_lcd2_device);
 
-        omap_display_init(&sdp4430_dss_data);
+        platform_device_register(&sdp4430_tpd_device);
+        platform_device_register(&sdp4430_hdmi_connector_device);
 }
diff --git a/arch/arm/mach-omap2/dss-common.h b/arch/arm/mach-omap2/dss-common.h
index 915f6fff5106..c28fe3c03588 100644
--- a/arch/arm/mach-omap2/dss-common.h
+++ b/arch/arm/mach-omap2/dss-common.h
@@ -6,9 +6,7 @@
  * This file will be removed when DSS supports DT.
  */
 
-void __init omap4_panda_display_init(void);
 void __init omap4_panda_display_init_of(void);
-void __init omap_4430sdp_display_init(void);
 void __init omap_4430sdp_display_init_of(void);
 
 #endif
diff --git a/arch/arm/mach-omap2/gpmc.c b/arch/arm/mach-omap2/gpmc.c
index f3fdd6afa213..9f4795aff48a 100644
--- a/arch/arm/mach-omap2/gpmc.c
+++ b/arch/arm/mach-omap2/gpmc.c
@@ -149,7 +149,7 @@ struct omap3_gpmc_regs {
 
 static struct gpmc_client_irq gpmc_client_irq[GPMC_NR_IRQ];
 static struct irq_chip gpmc_irq_chip;
-static unsigned gpmc_irq_start;
+static int gpmc_irq_start;
 
 static struct resource  gpmc_mem_root;
 static struct resource  gpmc_cs_mem[GPMC_CS_NUM];
diff --git a/arch/arm/mach-omap2/i2c.c b/arch/arm/mach-omap2/i2c.c
index d940e53dd9f2..b456b4471f35 100644
--- a/arch/arm/mach-omap2/i2c.c
+++ b/arch/arm/mach-omap2/i2c.c
@@ -181,7 +181,7 @@ int __init omap_i2c_add_bus(struct omap_i2c_bus_platform_data *i2c_pdata,
                                  sizeof(struct omap_i2c_bus_platform_data));
         WARN(IS_ERR(pdev), "Could not build omap_device for %s\n", name);
 
-        return PTR_RET(pdev);
+        return PTR_ERR_OR_ZERO(pdev);
 }
 
 static  int __init omap_i2c_cmdline(void)
diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
index 5cc92874be7e..f99f68e1e85b 100644
--- a/arch/arm/mach-omap2/omap_device.c
+++ b/arch/arm/mach-omap2/omap_device.c
@@ -129,6 +129,7 @@ static int omap_device_build_from_dt(struct platform_device *pdev)
         struct device_node *node = pdev->dev.of_node;
         const char *oh_name;
         int oh_cnt, i, ret = 0;
+        bool device_active = false;
 
         oh_cnt = of_property_count_strings(node, "ti,hwmods");
         if (oh_cnt <= 0) {
@@ -152,6 +153,8 @@ static int omap_device_build_from_dt(struct platform_device *pdev)
                         goto odbfd_exit1;
                 }
                 hwmods[i] = oh;
+                if (oh->flags & HWMOD_INIT_NO_IDLE)
+                        device_active = true;
         }
 
         od = omap_device_alloc(pdev, hwmods, oh_cnt);
@@ -172,6 +175,11 @@ static int omap_device_build_from_dt(struct platform_device *pdev)
 
         pdev->dev.pm_domain = &omap_device_pm_domain;
 
+        if (device_active) {
+                omap_device_enable(pdev);
+                pm_runtime_set_active(&pdev->dev);
+        }
+
 odbfd_exit1:
         kfree(hwmods);
 odbfd_exit:
@@ -842,6 +850,7 @@ static int __init omap_device_late_idle(struct device *dev, void *data)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct omap_device *od = to_omap_device(pdev);
+        int i;
 
         if (!od)
                 return 0;
@@ -850,6 +859,15 @@ static int __init omap_device_late_idle(struct device *dev, void *data)
          * If omap_device state is enabled, but has no driver bound,
          * idle it.
          */
+
+        /*
+         * Some devices (like memory controllers) are always kept
+         * enabled, and should not be idled even with no drivers.
+         */
+        for (i = 0; i < od->hwmods_cnt; i++)
+                if (od->hwmods[i]->flags & HWMOD_INIT_NO_IDLE)
+                        return 0;
+
         if (od->_driver_status != BUS_NOTIFY_BOUND_DRIVER) {
                 if (od->_state == OMAP_DEVICE_STATE_ENABLED) {
                         dev_warn(dev, "%s: enabled but no driver.  Idling\n",
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 7341eff63f56..7f4db12b1459 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -2386,7 +2386,7 @@ static void __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data)
 
                 np = of_dev_hwmod_lookup(of_find_node_by_name(NULL, "ocp"), oh);
                 if (np)
-                        va_start = of_iomap(np, 0);
+                        va_start = of_iomap(np, oh->mpu_rt_idx);
         } else {
                 va_start = ioremap(mem->pa_start, mem->pa_end - mem->pa_start);
         }
diff --git a/arch/arm/mach-omap2/omap_hwmod.h b/arch/arm/mach-omap2/omap_hwmod.h
index aab33fd814c0..e1482a9b3bc2 100644
--- a/arch/arm/mach-omap2/omap_hwmod.h
+++ b/arch/arm/mach-omap2/omap_hwmod.h
@@ -95,6 +95,54 @@ extern struct omap_hwmod_sysc_fields omap_hwmod_sysc_type3;
 #define MODULEMODE_HWCTRL               1
 #define MODULEMODE_SWCTRL               2
 
+#define DEBUG_OMAP2UART1_FLAGS  0
+#define DEBUG_OMAP2UART2_FLAGS  0
+#define DEBUG_OMAP2UART3_FLAGS  0
+#define DEBUG_OMAP3UART3_FLAGS  0
+#define DEBUG_OMAP3UART4_FLAGS  0
+#define DEBUG_OMAP4UART3_FLAGS  0
+#define DEBUG_OMAP4UART4_FLAGS  0
+#define DEBUG_TI81XXUART1_FLAGS 0
+#define DEBUG_TI81XXUART2_FLAGS 0
+#define DEBUG_TI81XXUART3_FLAGS 0
+#define DEBUG_AM33XXUART1_FLAGS 0
+
+#define DEBUG_OMAPUART_FLAGS    (HWMOD_INIT_NO_IDLE | HWMOD_INIT_NO_RESET)
+
+#if defined(CONFIG_DEBUG_OMAP2UART1)
+#undef DEBUG_OMAP2UART1_FLAGS
+#define DEBUG_OMAP2UART1_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_OMAP2UART2)
+#undef DEBUG_OMAP2UART2_FLAGS
+#define DEBUG_OMAP2UART2_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_OMAP2UART3)
+#undef DEBUG_OMAP2UART3_FLAGS
+#define DEBUG_OMAP2UART3_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_OMAP3UART3)
+#undef DEBUG_OMAP3UART3_FLAGS
+#define DEBUG_OMAP3UART3_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_OMAP3UART4)
+#undef DEBUG_OMAP3UART4_FLAGS
+#define DEBUG_OMAP3UART4_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_OMAP4UART3)
+#undef DEBUG_OMAP4UART3_FLAGS
+#define DEBUG_OMAP4UART3_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_OMAP4UART4)
+#undef DEBUG_OMAP4UART4_FLAGS
+#define DEBUG_OMAP4UART4_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_TI81XXUART1)
+#undef DEBUG_TI81XXUART1_FLAGS
+#define DEBUG_TI81XXUART1_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_TI81XXUART2)
+#undef DEBUG_TI81XXUART2_FLAGS
+#define DEBUG_TI81XXUART2_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_TI81XXUART3)
+#undef DEBUG_TI81XXUART3_FLAGS
+#define DEBUG_TI81XXUART3_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_AM33XXUART1)
+#undef DEBUG_AM33XXUART1_FLAGS
+#define DEBUG_AM33XXUART1_FLAGS DEBUG_OMAPUART_FLAGS
+#endif
 
 /**
  * struct omap_hwmod_mux_info - hwmod specific mux configuration
@@ -568,6 +616,7 @@ struct omap_hwmod_link {
  * @voltdm: pointer to voltage domain (filled in at runtime)
  * @dev_attr: arbitrary device attributes that can be passed to the driver
  * @_sysc_cache: internal-use hwmod flags
+ * @mpu_rt_idx: index of device address space for register target (for DT boot)
  * @_mpu_rt_va: cached register target start address (internal use)
  * @_mpu_port: cached MPU register target slave (internal use)
  * @opt_clks_cnt: number of @opt_clks
@@ -617,6 +666,7 @@ struct omap_hwmod {
         struct list_head                node;
         struct omap_hwmod_ocp_if        *_mpu_port;
         u16                             flags;
+        u8                              mpu_rt_idx;
         u8                              response_lat;
         u8                              rst_lines_cnt;
         u8                              opt_clks_cnt;
diff --git a/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c
index d05fc7b54567..56cebb05509e 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c
@@ -512,7 +512,7 @@ struct omap_hwmod omap2xxx_uart1_hwmod = {
         .mpu_irqs       = omap2_uart1_mpu_irqs,
         .sdma_reqs      = omap2_uart1_sdma_reqs,
         .main_clk       = "uart1_fck",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_OMAP2UART1_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .prcm           = {
                 .omap2 = {
                         .module_offs = CORE_MOD,
@@ -532,7 +532,7 @@ struct omap_hwmod omap2xxx_uart2_hwmod = {
         .mpu_irqs       = omap2_uart2_mpu_irqs,
         .sdma_reqs      = omap2_uart2_sdma_reqs,
         .main_clk       = "uart2_fck",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_OMAP2UART2_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .prcm           = {
                 .omap2 = {
                         .module_offs = CORE_MOD,
@@ -552,7 +552,7 @@ struct omap_hwmod omap2xxx_uart3_hwmod = {
         .mpu_irqs       = omap2_uart3_mpu_irqs,
         .sdma_reqs      = omap2_uart3_sdma_reqs,
         .main_clk       = "uart3_fck",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_OMAP2UART3_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .prcm           = {
                 .omap2 = {
                         .module_offs = CORE_MOD,
diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_data.c
index 28bbd56346a9..eb2f3b93b51c 100644
--- a/arch/arm/mach-omap2/omap_hwmod_33xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_33xx_data.c
@@ -562,6 +562,7 @@ static struct omap_hwmod am33xx_cpgmac0_hwmod = {
         .clkdm_name     = "cpsw_125mhz_clkdm",
         .flags          = (HWMOD_SWSUP_SIDLE | HWMOD_SWSUP_MSTANDBY),
         .main_clk       = "cpsw_125mhz_gclk",
+        .mpu_rt_idx     = 1,
         .prcm           = {
                 .omap4  = {
                         .clkctrl_offs   = AM33XX_CM_PER_CPGMAC0_CLKCTRL_OFFSET,
@@ -1512,7 +1513,7 @@ static struct omap_hwmod am33xx_uart1_hwmod = {
         .name           = "uart1",
         .class          = &uart_class,
         .clkdm_name     = "l4_wkup_clkdm",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_AM33XXUART1_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .main_clk       = "dpll_per_m2_div4_wkupdm_ck",
         .prcm           = {
                 .omap4  = {
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index f7a3df2fb579..0c3a427da544 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -490,7 +490,7 @@ static struct omap_hwmod omap3xxx_uart1_hwmod = {
         .mpu_irqs       = omap2_uart1_mpu_irqs,
         .sdma_reqs      = omap2_uart1_sdma_reqs,
         .main_clk       = "uart1_fck",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_TI81XXUART1_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .prcm           = {
                 .omap2 = {
                         .module_offs = CORE_MOD,
@@ -509,7 +509,7 @@ static struct omap_hwmod omap3xxx_uart2_hwmod = {
         .mpu_irqs       = omap2_uart2_mpu_irqs,
         .sdma_reqs      = omap2_uart2_sdma_reqs,
         .main_clk       = "uart2_fck",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_TI81XXUART2_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .prcm           = {
                 .omap2 = {
                         .module_offs = CORE_MOD,
@@ -528,7 +528,8 @@ static struct omap_hwmod omap3xxx_uart3_hwmod = {
         .mpu_irqs       = omap2_uart3_mpu_irqs,
         .sdma_reqs      = omap2_uart3_sdma_reqs,
         .main_clk       = "uart3_fck",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_OMAP3UART3_FLAGS | DEBUG_TI81XXUART3_FLAGS |
+                                HWMOD_SWSUP_SIDLE_ACT,
         .prcm           = {
                 .omap2 = {
                         .module_offs = OMAP3430_PER_MOD,
@@ -558,7 +559,7 @@ static struct omap_hwmod omap36xx_uart4_hwmod = {
         .mpu_irqs       = uart4_mpu_irqs,
         .sdma_reqs      = uart4_sdma_reqs,
         .main_clk       = "uart4_fck",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_OMAP3UART4_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .prcm           = {
                 .omap2 = {
                         .module_offs = OMAP3430_PER_MOD,
diff --git a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
index d04b5e60fdbe..9c3b504477d7 100644
--- a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -2858,8 +2858,7 @@ static struct omap_hwmod omap44xx_uart3_hwmod = {
         .name           = "uart3",
         .class          = &omap44xx_uart_hwmod_class,
         .clkdm_name     = "l4_per_clkdm",
-        .flags          = HWMOD_INIT_NO_IDLE | HWMOD_INIT_NO_RESET |
-                                HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_OMAP4UART3_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .main_clk       = "func_48m_fclk",
         .prcm = {
                 .omap4 = {
@@ -2875,7 +2874,7 @@ static struct omap_hwmod omap44xx_uart4_hwmod = {
         .name           = "uart4",
         .class          = &omap44xx_uart_hwmod_class,
         .clkdm_name     = "l4_per_clkdm",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_OMAP4UART4_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .main_clk       = "func_48m_fclk",
         .prcm = {
                 .omap4 = {
diff --git a/arch/arm/mach-omap2/omap_hwmod_54xx_data.c b/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
index 5c6bbe5b7fb6..b4d04748576b 100644
--- a/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
@@ -1374,7 +1374,7 @@ static struct omap_hwmod omap54xx_uart3_hwmod = {
         .name           = "uart3",
         .class          = &omap54xx_uart_hwmod_class,
         .clkdm_name     = "l4per_clkdm",
-        .flags          = HWMOD_INIT_NO_IDLE | HWMOD_INIT_NO_RESET,
+        .flags          = DEBUG_OMAP4UART3_FLAGS,
         .main_clk       = "func_48m_fclk",
         .prcm = {
                 .omap4 = {
@@ -1390,6 +1390,7 @@ static struct omap_hwmod omap54xx_uart4_hwmod = {
         .name           = "uart4",
         .class          = &omap54xx_uart_hwmod_class,
         .clkdm_name     = "l4per_clkdm",
+        .flags          = DEBUG_OMAP4UART4_FLAGS,
         .main_clk       = "func_48m_fclk",
         .prcm = {
                 .omap4 = {
diff --git a/arch/arm/mach-omap2/serial.c b/arch/arm/mach-omap2/serial.c
index 3a674de6cb63..a388f8c1bcb3 100644
--- a/arch/arm/mach-omap2/serial.c
+++ b/arch/arm/mach-omap2/serial.c
@@ -208,17 +208,6 @@ static int __init omap_serial_early_init(void)
                                 pr_info("%s used as console in debug mode: uart%d clocks will not be gated",
                                         uart_name, uart->num);
                         }
-
-                        /*
-                         * omap-uart can be used for earlyprintk logs
-                         * So if omap-uart is used as console then prevent
-                         * uart reset and idle to get logs from omap-uart
-                         * until uart console driver is available to take
-                         * care for console messages.
-                         * Idling or resetting omap-uart while printing logs
-                         * early boot logs can stall the boot-up.
-                         */
-                        oh->flags |= HWMOD_INIT_NO_IDLE | HWMOD_INIT_NO_RESET;
                 }
         } while (1);
 
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index 5a9ee0b48b62..801287ee4d98 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -537,7 +537,7 @@ static void __init realtime_counter_init(void)
         reg |= num;
         __raw_writel(reg, base + INCREMENTER_NUMERATOR_OFFSET);
 
-        reg = __raw_readl(base + INCREMENTER_NUMERATOR_OFFSET) &
+        reg = __raw_readl(base + INCREMENTER_DENUMERATOR_RELOAD_OFFSET) &
                         NUMERATOR_DENUMERATOR_MASK;
         reg |= den;
         __raw_writel(reg, base + INCREMENTER_DENUMERATOR_RELOAD_OFFSET);
diff --git a/arch/arm/mach-omap2/usb-musb.c b/arch/arm/mach-omap2/usb-musb.c
index 8c4de2708cf2..bc897231bd10 100644
--- a/arch/arm/mach-omap2/usb-musb.c
+++ b/arch/arm/mach-omap2/usb-musb.c
@@ -38,11 +38,8 @@ static struct musb_hdrc_config musb_config = {
 };
 
 static struct musb_hdrc_platform_data musb_plat = {
-#ifdef CONFIG_USB_GADGET_MUSB_HDRC
         .mode           = MUSB_OTG,
-#else
-        .mode           = MUSB_HOST,
-#endif
+
         /* .clock is set dynamically */
         .config         = &musb_config,
 
diff --git a/arch/arm/mach-orion5x/include/mach/debug-macro.S b/arch/arm/mach-orion5x/include/mach/debug-macro.S
deleted file mode 100644
index f340ed8f8dd0..000000000000
--- a/arch/arm/mach-orion5x/include/mach/debug-macro.S
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * arch/arm/mach-orion5x/include/mach/debug-macro.S
- *
- * Debugging macro include header
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
-*/
-
-#include <mach/orion5x.h>
-
-        .macro  addruart, rp, rv, tmp
-        ldr     \rp, =ORION5X_REGS_PHYS_BASE
-        ldr     \rv, =ORION5X_REGS_VIRT_BASE
-        orr     \rp, \rp, #0x00012000
-        orr     \rv, \rv, #0x00012000
-        .endm
-
-#define UART_SHIFT      2
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/mach-prima2/common.c b/arch/arm/mach-prima2/common.c
index 2c70f74fed5d..e110b6d4ae8c 100644
--- a/arch/arm/mach-prima2/common.c
+++ b/arch/arm/mach-prima2/common.c
@@ -42,7 +42,6 @@ static const char *atlas6_dt_match[] __initdata = {
 
 DT_MACHINE_START(ATLAS6_DT, "Generic ATLAS6 (Flattened Device Tree)")
         /* Maintainer: Barry Song <baohua.song@csr.com> */
-        .nr_irqs        = 128,
         .map_io         = sirfsoc_map_io,
         .init_time      = sirfsoc_init_time,
         .init_late      = sirfsoc_init_late,
@@ -59,7 +58,6 @@ static const char *prima2_dt_match[] __initdata = {
 
 DT_MACHINE_START(PRIMA2_DT, "Generic PRIMA2 (Flattened Device Tree)")
         /* Maintainer: Barry Song <baohua.song@csr.com> */
-        .nr_irqs        = 128,
         .map_io         = sirfsoc_map_io,
         .init_time      = sirfsoc_init_time,
         .dma_zone_size  = SZ_256M,
diff --git a/arch/arm/mach-pxa/icontrol.c b/arch/arm/mach-pxa/icontrol.c
index fe31bfcbb8df..c98511c5abd1 100644
--- a/arch/arm/mach-pxa/icontrol.c
+++ b/arch/arm/mach-pxa/icontrol.c
@@ -73,9 +73,6 @@ static struct pxa2xx_spi_chip mcp251x_chip_info4 = {
 
 static struct mcp251x_platform_data mcp251x_info = {
         .oscillator_frequency = 16E6,
-        .board_specific_setup = NULL,
-        .power_enable         = NULL,
-        .transceiver_enable   = NULL
 };
 
 static struct spi_board_info mcp251x_board_info[] = {
diff --git a/arch/arm/mach-pxa/zeus.c b/arch/arm/mach-pxa/zeus.c
index 126e4a806a07..b19d1c361cab 100644
--- a/arch/arm/mach-pxa/zeus.c
+++ b/arch/arm/mach-pxa/zeus.c
@@ -29,6 +29,8 @@
 #include <linux/platform_data/pca953x.h>
 #include <linux/apm-emulation.h>
 #include <linux/can/platform/mcp251x.h>
+#include <linux/regulator/fixed.h>
+#include <linux/regulator/machine.h>
 
 #include <asm/mach-types.h>
 #include <asm/suspend.h>
@@ -391,33 +393,34 @@ static struct pxa2xx_spi_master pxa2xx_spi_ssp3_master_info = {
 };
 
 /* CAN bus on SPI */
-static int zeus_mcp2515_setup(struct spi_device *sdev)
-{
-        int err;
-
-        err = gpio_request(ZEUS_CAN_SHDN_GPIO, "CAN shutdown");
-        if (err)
-                return err;
+static struct regulator_consumer_supply can_regulator_consumer =
+        REGULATOR_SUPPLY("vdd", "spi3.0");
 
-        err = gpio_direction_output(ZEUS_CAN_SHDN_GPIO, 1);
-        if (err) {
-                gpio_free(ZEUS_CAN_SHDN_GPIO);
-                return err;
-        }
+static struct regulator_init_data can_regulator_init_data = {
+        .constraints    = {
+                .valid_ops_mask = REGULATOR_CHANGE_STATUS,
+        },
+        .consumer_supplies      = &can_regulator_consumer,
+        .num_consumer_supplies  = 1,
+};
 
-        return 0;
-}
+static struct fixed_voltage_config can_regulator_pdata = {
+        .supply_name    = "CAN_SHDN",
+        .microvolts     = 3300000,
+        .gpio           = ZEUS_CAN_SHDN_GPIO,
+        .init_data      = &can_regulator_init_data,
+};
 
-static int zeus_mcp2515_transceiver_enable(int enable)
-{
-        gpio_set_value(ZEUS_CAN_SHDN_GPIO, !enable);
-        return 0;
-}
+static struct platform_device can_regulator_device = {
+        .name   = "reg-fixed-volage",
+        .id     = -1,
+        .dev    = {
+                .platform_data  = &can_regulator_pdata,
+        },
+};
 
 static struct mcp251x_platform_data zeus_mcp2515_pdata = {
         .oscillator_frequency   = 16*1000*1000,
-        .board_specific_setup   = zeus_mcp2515_setup,
-        .power_enable           = zeus_mcp2515_transceiver_enable,
 };
 
 static struct spi_board_info zeus_spi_board_info[] = {
@@ -516,6 +519,7 @@ static struct platform_device *zeus_devices[] __initdata = {
         &zeus_leds_device,
         &zeus_pcmcia_device,
         &zeus_max6369_device,
+        &can_regulator_device,
 };
 
 /* AC'97 */
diff --git a/arch/arm/mach-realview/include/mach/debug-macro.S b/arch/arm/mach-realview/include/mach/debug-macro.S
deleted file mode 100644
index 8cc372dc66a8..000000000000
--- a/arch/arm/mach-realview/include/mach/debug-macro.S
+++ /dev/null
@@ -1,29 +0,0 @@
-/* arch/arm/mach-realview/include/mach/debug-macro.S
- *
- * Debugging macro include header
- *
- *  Copyright (C) 1994-1999 Russell King
- *  Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifdef CONFIG_DEBUG_REALVIEW_STD_PORT
-#define DEBUG_LL_UART_OFFSET    0x00009000
-#elif defined(CONFIG_DEBUG_REALVIEW_PB1176_PORT)
-#define DEBUG_LL_UART_OFFSET    0x0010c000
-#endif
-
-#ifndef DEBUG_LL_UART_OFFSET
-#error "Unknown RealView platform"
-#endif
-
-                .macro  addruart, rp, rv, tmp
-                mov     \rp, #DEBUG_LL_UART_OFFSET
-                orr     \rv, \rp, #0xfb000000   @ virtual base
-                orr     \rp, \rp, #0x10000000   @ physical base
-                .endm
-
-#include <asm/hardware/debug-pl01x.S>
diff --git a/arch/arm/mach-rpc/include/mach/debug-macro.S b/arch/arm/mach-rpc/include/mach/debug-macro.S
deleted file mode 100644
index 6d28cc99b124..000000000000
--- a/arch/arm/mach-rpc/include/mach/debug-macro.S
+++ /dev/null
@@ -1,23 +0,0 @@
-/* arch/arm/mach-rpc/include/mach/debug-macro.S
- *
- * Debugging macro include header
- *
- *  Copyright (C) 1994-1999 Russell King
- *  Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
-*/
-
-                .macro  addruart, rp, rv, tmp
-                mov     \rp, #0x00010000
-                orr     \rp, \rp, #0x00000fe0
-                orr     \rv, \rp, #0xe0000000   @ virtual
-                orr     \rp, \rp, #0x03000000   @ physical
-                .endm
-
-#define UART_SHIFT      2
-#define FLOW_CONTROL
-#include <asm/hardware/debug-8250.S>
diff --git a/arch/arm/mach-shmobile/board-armadillo800eva-reference.c b/arch/arm/mach-shmobile/board-armadillo800eva-reference.c
index 03b85fec2ddb..8f677df2d4c4 100644
--- a/arch/arm/mach-shmobile/board-armadillo800eva-reference.c
+++ b/arch/arm/mach-shmobile/board-armadillo800eva-reference.c
@@ -190,10 +190,10 @@ static void __init eva_init(void)
 }
 
 #define RESCNT2 IOMEM(0xe6188020)
-static void eva_restart(char mode, const char *cmd)
+static void eva_restart(enum reboot_mode mode, const char *cmd)
 {
         /* Do soft power on reset */
-        writel((1 << 31), RESCNT2);
+        writel(1 << 31, RESCNT2);
 }
 
 static const char *eva_boards_compat_dt[] __initdata = {
diff --git a/arch/arm/mach-shmobile/board-armadillo800eva.c b/arch/arm/mach-shmobile/board-armadillo800eva.c
index 66cfd5686578..4e3670a28a7c 100644
--- a/arch/arm/mach-shmobile/board-armadillo800eva.c
+++ b/arch/arm/mach-shmobile/board-armadillo800eva.c
@@ -358,7 +358,6 @@ static struct platform_device usbhsf_device = {
 static struct sh_eth_plat_data sh_eth_platdata = {
         .phy                    = 0x00, /* LAN8710A */
         .edmac_endian           = EDMAC_LITTLE_ENDIAN,
-        .register_type          = SH_ETH_REG_GIGABIT,
         .phy_interface          = PHY_INTERFACE_MODE_MII,
 };
 
@@ -1153,9 +1152,6 @@ static void __init eva_init(void)
         gpio_request_one(61, GPIOF_OUT_INIT_HIGH, NULL); /* LCDDON */
         gpio_request_one(202, GPIOF_OUT_INIT_LOW, NULL); /* LCD0_LED_CONT */
 
-        /* Touchscreen */
-        gpio_request_one(166, GPIOF_OUT_INIT_HIGH, NULL); /* TP_RST_B */
-
         /* GETHER */
         gpio_request_one(18, GPIOF_OUT_INIT_HIGH, NULL); /* PHY_RST */
 
diff --git a/arch/arm/mach-shmobile/board-bockw.c b/arch/arm/mach-shmobile/board-bockw.c
index d5554646916c..35dd7f201a16 100644
--- a/arch/arm/mach-shmobile/board-bockw.c
+++ b/arch/arm/mach-shmobile/board-bockw.c
@@ -3,6 +3,7 @@
  *
  * Copyright (C) 2013  Renesas Solutions Corp.
  * Copyright (C) 2013  Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+ * Copyright (C) 2013  Cogent Embedded, Inc.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -28,6 +29,7 @@
 #include <linux/smsc911x.h>
 #include <linux/spi/spi.h>
 #include <linux/spi/flash.h>
+#include <media/soc_camera.h>
 #include <mach/common.h>
 #include <mach/irqs.h>
 #include <mach/r8a7778.h>
@@ -89,7 +91,6 @@ static struct sh_mobile_sdhi_info sdhi0_info = {
 static struct sh_eth_plat_data ether_platform_data __initdata = {
         .phy            = 0x01,
         .edmac_endian   = EDMAC_LITTLE_ENDIAN,
-        .register_type  = SH_ETH_REG_FAST_RCAR,
         .phy_interface  = PHY_INTERFACE_MODE_RMII,
         /*
          * Although the LINK signal is available on the board, it's connected to
@@ -143,6 +144,25 @@ static struct sh_mmcif_plat_data sh_mmcif_plat = {
                           MMC_CAP_NEEDS_POLL,
 };
 
+static struct rcar_vin_platform_data vin_platform_data __initdata = {
+        .flags  = RCAR_VIN_BT656,
+};
+
+/* In the default configuration both decoders reside on I2C bus 0 */
+#define BOCKW_CAMERA(idx)                                               \
+static struct i2c_board_info camera##idx##_info = {                     \
+        I2C_BOARD_INFO("ml86v7667", 0x41 + 2 * (idx)),                  \
+};                                                                      \
+                                                                        \
+static struct soc_camera_link iclink##idx##_ml86v7667 __initdata = {    \
+        .bus_id         = idx,                                          \
+        .i2c_adapter_id = 0,                                            \
+        .board_info     = &camera##idx##_info,                          \
+}
+
+BOCKW_CAMERA(0);
+BOCKW_CAMERA(1);
+
 static const struct pinctrl_map bockw_pinctrl_map[] = {
         /* Ether */
         PIN_MAP_MUX_GROUP_DEFAULT("r8a777x-ether", "pfc-r8a7778",
@@ -167,7 +187,23 @@ static const struct pinctrl_map bockw_pinctrl_map[] = {
                                   "usb1", "usb1"),
         /* SDHI0 */
         PIN_MAP_MUX_GROUP_DEFAULT("sh_mobile_sdhi.0", "pfc-r8a7778",
-                                  "sdhi0", "sdhi0"),
+                                  "sdhi0_data4", "sdhi0"),
+        PIN_MAP_MUX_GROUP_DEFAULT("sh_mobile_sdhi.0", "pfc-r8a7778",
+                                  "sdhi0_ctrl", "sdhi0"),
+        PIN_MAP_MUX_GROUP_DEFAULT("sh_mobile_sdhi.0", "pfc-r8a7778",
+                                  "sdhi0_cd", "sdhi0"),
+        PIN_MAP_MUX_GROUP_DEFAULT("sh_mobile_sdhi.0", "pfc-r8a7778",
+                                  "sdhi0_wp", "sdhi0"),
+        /* VIN0 */
+        PIN_MAP_MUX_GROUP_DEFAULT("r8a7778-vin.0", "pfc-r8a7778",
+                                  "vin0_clk", "vin0"),
+        PIN_MAP_MUX_GROUP_DEFAULT("r8a7778-vin.0", "pfc-r8a7778",
+                                  "vin0_data8", "vin0"),
+        /* VIN1 */
+        PIN_MAP_MUX_GROUP_DEFAULT("r8a7778-vin.1", "pfc-r8a7778",
+                                  "vin1_clk", "vin1"),
+        PIN_MAP_MUX_GROUP_DEFAULT("r8a7778-vin.1", "pfc-r8a7778",
+                                  "vin1_data8", "vin1"),
 };
 
 #define FPGA    0x18200000
@@ -186,6 +222,16 @@ static void __init bockw_init(void)
         r8a7778_add_i2c_device(0);
         r8a7778_add_hspi_device(0);
         r8a7778_add_mmc_device(&sh_mmcif_plat);
+        r8a7778_add_vin_device(0, &vin_platform_data);
+        /* VIN1 has a pin conflict with Ether */
+        if (!IS_ENABLED(CONFIG_SH_ETH))
+                r8a7778_add_vin_device(1, &vin_platform_data);
+        platform_device_register_data(&platform_bus, "soc-camera-pdrv", 0,
+                                      &iclink0_ml86v7667,
+                                      sizeof(iclink0_ml86v7667));
+        platform_device_register_data(&platform_bus, "soc-camera-pdrv", 1,
+                                      &iclink1_ml86v7667,
+                                      sizeof(iclink1_ml86v7667));
 
         i2c_register_board_info(0, i2c0_devices,
                                 ARRAY_SIZE(i2c0_devices));
diff --git a/arch/arm/mach-shmobile/board-lager.c b/arch/arm/mach-shmobile/board-lager.c
index 1e99b17767bb..78d92d34665d 100644
--- a/arch/arm/mach-shmobile/board-lager.c
+++ b/arch/arm/mach-shmobile/board-lager.c
@@ -58,7 +58,7 @@ static __initdata struct gpio_led_platform_data lager_leds_pdata = {
 #define GPIO_KEY(c, g, d, ...) \
         { .code = c, .gpio = g, .desc = d, .active_low = 1 }
 
-static __initdata struct gpio_keys_button gpio_buttons[] = {
+static struct gpio_keys_button gpio_buttons[] = {
         GPIO_KEY(KEY_4,         RCAR_GP_PIN(1, 28),     "SW2-pin4"),
         GPIO_KEY(KEY_3,         RCAR_GP_PIN(1, 26),     "SW2-pin3"),
         GPIO_KEY(KEY_2,         RCAR_GP_PIN(1, 24),     "SW2-pin2"),
diff --git a/arch/arm/mach-shmobile/board-marzen.c b/arch/arm/mach-shmobile/board-marzen.c
index a7d1010505bf..ca7fb2e63c60 100644
--- a/arch/arm/mach-shmobile/board-marzen.c
+++ b/arch/arm/mach-shmobile/board-marzen.c
@@ -1,8 +1,9 @@
 /*
  * marzen board support
  *
- * Copyright (C) 2011  Renesas Solutions Corp.
+ * Copyright (C) 2011, 2013  Renesas Solutions Corp.
  * Copyright (C) 2011  Magnus Damm
+ * Copyright (C) 2013  Cogent Embedded, Inc.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -37,6 +38,7 @@
 #include <linux/mmc/host.h>
 #include <linux/mmc/sh_mobile_sdhi.h>
 #include <linux/mfd/tmio.h>
+#include <media/soc_camera.h>
 #include <mach/hardware.h>
 #include <mach/r8a7779.h>
 #include <mach/common.h>
@@ -178,12 +180,40 @@ static struct platform_device leds_device = {
         },
 };
 
+static struct rcar_vin_platform_data vin_platform_data __initdata = {
+        .flags  = RCAR_VIN_BT656,
+};
+
+#define MARZEN_CAMERA(idx)                                      \
+static struct i2c_board_info camera##idx##_info = {             \
+        I2C_BOARD_INFO("adv7180", 0x20 + (idx)),                \
+};                                                              \
+                                                                \
+static struct soc_camera_link iclink##idx##_adv7180 = {         \
+        .bus_id         = 1 + 2 * (idx),                        \
+        .i2c_adapter_id = 0,                                    \
+        .board_info     = &camera##idx##_info,                  \
+};                                                              \
+                                                                \
+static struct platform_device camera##idx##_device = {          \
+        .name   = "soc-camera-pdrv",                            \
+        .id     = idx,                                          \
+        .dev    = {                                             \
+                .platform_data  = &iclink##idx##_adv7180,       \
+        },                                                      \
+};
+
+MARZEN_CAMERA(0);
+MARZEN_CAMERA(1);
+
 static struct platform_device *marzen_devices[] __initdata = {
         &eth_device,
         &sdhi0_device,
         &thermal_device,
         &hspi_device,
         &leds_device,
+        &camera0_device,
+        &camera1_device,
 };
 
 static const struct pinctrl_map marzen_pinctrl_map[] = {
@@ -219,6 +249,16 @@ static const struct pinctrl_map marzen_pinctrl_map[] = {
         /* USB2 */
         PIN_MAP_MUX_GROUP_DEFAULT("ehci-platform.1", "pfc-r8a7779",
                                   "usb2", "usb2"),
+        /* VIN1 */
+        PIN_MAP_MUX_GROUP_DEFAULT("r8a7779-vin.1", "pfc-r8a7779",
+                                  "vin1_clk", "vin1"),
+        PIN_MAP_MUX_GROUP_DEFAULT("r8a7779-vin.1", "pfc-r8a7779",
+                                  "vin1_data8", "vin1"),
+        /* VIN3 */
+        PIN_MAP_MUX_GROUP_DEFAULT("r8a7779-vin.3", "pfc-r8a7779",
+                                  "vin3_clk", "vin3"),
+        PIN_MAP_MUX_GROUP_DEFAULT("r8a7779-vin.3", "pfc-r8a7779",
+                                  "vin3_data8", "vin3"),
 };
 
 static void __init marzen_init(void)
@@ -235,6 +275,8 @@ static void __init marzen_init(void)
 
         r8a7779_add_standard_devices();
         r8a7779_add_usb_phy_device(&usb_phy_platform_data);
+        r8a7779_add_vin_device(1, &vin_platform_data);
+        r8a7779_add_vin_device(3, &vin_platform_data);
         platform_add_devices(marzen_devices, ARRAY_SIZE(marzen_devices));
 }
 
diff --git a/arch/arm/mach-shmobile/clock-r8a7740.c b/arch/arm/mach-shmobile/clock-r8a7740.c
index de10fd78bf2b..f4265e52432c 100644
--- a/arch/arm/mach-shmobile/clock-r8a7740.c
+++ b/arch/arm/mach-shmobile/clock-r8a7740.c
@@ -596,7 +596,7 @@ static struct clk_lookup lookups[] = {
         CLKDEV_DEV_ID("e6bd0000.mmcif",         &mstp_clks[MSTP312]),
         CLKDEV_DEV_ID("r8a7740-gether",         &mstp_clks[MSTP309]),
         CLKDEV_DEV_ID("e9a00000.sh-eth",        &mstp_clks[MSTP309]),
-        CLKDEV_DEV_ID("renesas_tpu_pwm",        &mstp_clks[MSTP304]),
+        CLKDEV_DEV_ID("renesas-tpu-pwm",        &mstp_clks[MSTP304]),
 
         CLKDEV_DEV_ID("sh_mobile_sdhi.2",       &mstp_clks[MSTP415]),
         CLKDEV_DEV_ID("e6870000.sdhi",          &mstp_clks[MSTP415]),
diff --git a/arch/arm/mach-shmobile/clock-r8a7778.c b/arch/arm/mach-shmobile/clock-r8a7778.c
index a0e9eb72e46d..c4bf2d8fb111 100644
--- a/arch/arm/mach-shmobile/clock-r8a7778.c
+++ b/arch/arm/mach-shmobile/clock-r8a7778.c
@@ -106,6 +106,7 @@ enum {
         MSTP331,
         MSTP323, MSTP322, MSTP321,
         MSTP114,
+        MSTP110, MSTP109,
         MSTP100,
         MSTP030,
         MSTP029, MSTP028, MSTP027, MSTP026, MSTP025, MSTP024, MSTP023, MSTP022, MSTP021,
@@ -119,6 +120,8 @@ static struct clk mstp_clks[MSTP_NR] = {
         [MSTP322] = SH_CLK_MSTP32(&p_clk, MSTPCR3, 22, 0), /* SDHI1 */
         [MSTP321] = SH_CLK_MSTP32(&p_clk, MSTPCR3, 21, 0), /* SDHI2 */
         [MSTP114] = SH_CLK_MSTP32(&p_clk, MSTPCR1, 14, 0), /* Ether */
+        [MSTP110] = SH_CLK_MSTP32(&s_clk, MSTPCR1, 10, 0), /* VIN0 */
+        [MSTP109] = SH_CLK_MSTP32(&s_clk, MSTPCR1,  9, 0), /* VIN1 */
         [MSTP100] = SH_CLK_MSTP32(&p_clk, MSTPCR1,  0, 0), /* USB0/1 */
         [MSTP030] = SH_CLK_MSTP32(&p_clk, MSTPCR0, 30, 0), /* I2C0 */
         [MSTP029] = SH_CLK_MSTP32(&p_clk, MSTPCR0, 29, 0), /* I2C1 */
@@ -146,6 +149,8 @@ static struct clk_lookup lookups[] = {
         CLKDEV_DEV_ID("sh_mobile_sdhi.1", &mstp_clks[MSTP322]), /* SDHI1 */
         CLKDEV_DEV_ID("sh_mobile_sdhi.2", &mstp_clks[MSTP321]), /* SDHI2 */
         CLKDEV_DEV_ID("r8a777x-ether", &mstp_clks[MSTP114]), /* Ether */
+        CLKDEV_DEV_ID("r8a7778-vin.0", &mstp_clks[MSTP110]), /* VIN0 */
+        CLKDEV_DEV_ID("r8a7778-vin.1", &mstp_clks[MSTP109]), /* VIN1 */
         CLKDEV_DEV_ID("ehci-platform", &mstp_clks[MSTP100]), /* USB EHCI port0/1 */
         CLKDEV_DEV_ID("ohci-platform", &mstp_clks[MSTP100]), /* USB OHCI port0/1 */
         CLKDEV_DEV_ID("i2c-rcar.0", &mstp_clks[MSTP030]), /* I2C0 */
diff --git a/arch/arm/mach-shmobile/clock-r8a7779.c b/arch/arm/mach-shmobile/clock-r8a7779.c
index 10340f5becbb..bd6ad922eb7e 100644
--- a/arch/arm/mach-shmobile/clock-r8a7779.c
+++ b/arch/arm/mach-shmobile/clock-r8a7779.c
@@ -112,7 +112,9 @@ static struct clk *main_clks[] = {
 };
 
 enum { MSTP323, MSTP322, MSTP321, MSTP320,
+        MSTP120,
         MSTP116, MSTP115, MSTP114,
+        MSTP110, MSTP109, MSTP108,
         MSTP103, MSTP101, MSTP100,
         MSTP030,
         MSTP029, MSTP028, MSTP027, MSTP026, MSTP025, MSTP024, MSTP023, MSTP022, MSTP021,
@@ -125,9 +127,13 @@ static struct clk mstp_clks[MSTP_NR] = {
         [MSTP322] = SH_CLK_MSTP32(&clkp_clk, MSTPCR3, 22, 0), /* SDHI1 */
         [MSTP321] = SH_CLK_MSTP32(&clkp_clk, MSTPCR3, 21, 0), /* SDHI2 */
         [MSTP320] = SH_CLK_MSTP32(&clkp_clk, MSTPCR3, 20, 0), /* SDHI3 */
+        [MSTP120] = SH_CLK_MSTP32(&clks_clk, MSTPCR1, 20, 0), /* VIN3 */
         [MSTP116] = SH_CLK_MSTP32(&clkp_clk, MSTPCR1, 16, 0), /* PCIe */
         [MSTP115] = SH_CLK_MSTP32(&clkp_clk, MSTPCR1, 15, 0), /* SATA */
         [MSTP114] = SH_CLK_MSTP32(&clkp_clk, MSTPCR1, 14, 0), /* Ether */
+        [MSTP110] = SH_CLK_MSTP32(&clks_clk, MSTPCR1, 10, 0), /* VIN0 */
+        [MSTP109] = SH_CLK_MSTP32(&clks_clk, MSTPCR1,  9, 0), /* VIN1 */
+        [MSTP108] = SH_CLK_MSTP32(&clks_clk, MSTPCR1,  8, 0), /* VIN2 */
         [MSTP103] = SH_CLK_MSTP32(&clks_clk, MSTPCR1,  3, 0), /* DU */
         [MSTP101] = SH_CLK_MSTP32(&clkp_clk, MSTPCR1,  1, 0), /* USB2 */
         [MSTP100] = SH_CLK_MSTP32(&clkp_clk, MSTPCR1,  0, 0), /* USB0/1 */
@@ -162,10 +168,14 @@ static struct clk_lookup lookups[] = {
         CLKDEV_CON_ID("peripheral_clk", &clkp_clk),
 
         /* MSTP32 clocks */
+        CLKDEV_DEV_ID("r8a7779-vin.3", &mstp_clks[MSTP120]), /* VIN3 */
         CLKDEV_DEV_ID("rcar-pcie", &mstp_clks[MSTP116]), /* PCIe */
         CLKDEV_DEV_ID("sata_rcar", &mstp_clks[MSTP115]), /* SATA */
         CLKDEV_DEV_ID("fc600000.sata", &mstp_clks[MSTP115]), /* SATA w/DT */
         CLKDEV_DEV_ID("r8a777x-ether", &mstp_clks[MSTP114]), /* Ether */
+        CLKDEV_DEV_ID("r8a7779-vin.0", &mstp_clks[MSTP110]), /* VIN0 */
+        CLKDEV_DEV_ID("r8a7779-vin.1", &mstp_clks[MSTP109]), /* VIN1 */
+        CLKDEV_DEV_ID("r8a7779-vin.2", &mstp_clks[MSTP108]), /* VIN2 */
         CLKDEV_DEV_ID("ehci-platform.1", &mstp_clks[MSTP101]), /* USB EHCI port2 */
         CLKDEV_DEV_ID("ohci-platform.1", &mstp_clks[MSTP101]), /* USB OHCI port2 */
         CLKDEV_DEV_ID("ehci-platform.0", &mstp_clks[MSTP100]), /* USB EHCI port0/1 */
diff --git a/arch/arm/mach-shmobile/headsmp-scu.S b/arch/arm/mach-shmobile/headsmp-scu.S
index bfd920083a3b..f45dde701d7b 100644
--- a/arch/arm/mach-shmobile/headsmp-scu.S
+++ b/arch/arm/mach-shmobile/headsmp-scu.S
@@ -37,13 +37,15 @@ ENTRY(shmobile_boot_scu)
         lsl     r1, r1, #3              @ we will shift by cpu_id * 8 bits
         ldr     r2, [r0, #8]            @ SCU Power Status Register
         mov     r3, #3
-        bic     r2, r2, r3, lsl r1      @ Clear bits of our CPU (Run Mode)
+        lsl     r3, r3, r1
+        bic     r2, r2, r3              @ Clear bits of our CPU (Run Mode)
         str     r2, [r0, #8]            @ write back
 
         b       shmobile_invalidate_start
 ENDPROC(shmobile_boot_scu)
 
         .text
+        .align  2
         .globl  shmobile_scu_base
 shmobile_scu_base:
         .space  4
diff --git a/arch/arm/mach-shmobile/headsmp.S b/arch/arm/mach-shmobile/headsmp.S
index a9d212498987..2667db806c39 100644
--- a/arch/arm/mach-shmobile/headsmp.S
+++ b/arch/arm/mach-shmobile/headsmp.S
@@ -24,12 +24,16 @@ ENDPROC(shmobile_invalidate_start)
  * This will be mapped at address 0 by SBAR register.
  * We need _long_ jump to the physical address.
  */
+        .arm
         .align  12
 ENTRY(shmobile_boot_vector)
         ldr     r0, 2f
-        ldr     pc, 1f
+        ldr     r1, 1f
+        bx      r1
+
 ENDPROC(shmobile_boot_vector)
 
+        .align  2
         .globl  shmobile_boot_fn
 shmobile_boot_fn:
 1:      .space  4
diff --git a/arch/arm/mach-shmobile/include/mach/r8a7778.h b/arch/arm/mach-shmobile/include/mach/r8a7778.h
index 9b561bf4229f..2866704e7afd 100644
--- a/arch/arm/mach-shmobile/include/mach/r8a7778.h
+++ b/arch/arm/mach-shmobile/include/mach/r8a7778.h
@@ -22,6 +22,7 @@
 #include <linux/mmc/sh_mobile_sdhi.h>
 #include <linux/sh_eth.h>
 #include <linux/platform_data/usb-rcar-phy.h>
+#include <linux/platform_data/camera-rcar.h>
 
 extern void r8a7778_add_standard_devices(void);
 extern void r8a7778_add_standard_devices_dt(void);
@@ -30,6 +31,8 @@ extern void r8a7778_add_usb_phy_device(struct rcar_phy_platform_data *pdata);
 extern void r8a7778_add_i2c_device(int id);
 extern void r8a7778_add_hspi_device(int id);
 extern void r8a7778_add_mmc_device(struct sh_mmcif_plat_data *info);
+extern void r8a7778_add_vin_device(int id,
+                                   struct rcar_vin_platform_data *pdata);
 
 extern void r8a7778_init_late(void);
 extern void r8a7778_init_delay(void);
diff --git a/arch/arm/mach-shmobile/include/mach/r8a7779.h b/arch/arm/mach-shmobile/include/mach/r8a7779.h
index fc47073c7ba9..6d2b6417fe2a 100644
--- a/arch/arm/mach-shmobile/include/mach/r8a7779.h
+++ b/arch/arm/mach-shmobile/include/mach/r8a7779.h
@@ -5,6 +5,7 @@
 #include <linux/pm_domain.h>
 #include <linux/sh_eth.h>
 #include <linux/platform_data/usb-rcar-phy.h>
+#include <linux/platform_data/camera-rcar.h>
 
 struct platform_device;
 
@@ -35,6 +36,8 @@ extern void r8a7779_add_standard_devices(void);
 extern void r8a7779_add_standard_devices_dt(void);
 extern void r8a7779_add_ether_device(struct sh_eth_plat_data *pdata);
 extern void r8a7779_add_usb_phy_device(struct rcar_phy_platform_data *pdata);
+extern void r8a7779_add_vin_device(int idx,
+                                   struct rcar_vin_platform_data *pdata);
 extern void r8a7779_init_late(void);
 extern void r8a7779_clock_init(void);
 extern void r8a7779_pinmux_init(void);
diff --git a/arch/arm/mach-shmobile/include/mach/zboot.h b/arch/arm/mach-shmobile/include/mach/zboot.h
index f2d8744c1f14..c3c4669a2d72 100644
--- a/arch/arm/mach-shmobile/include/mach/zboot.h
+++ b/arch/arm/mach-shmobile/include/mach/zboot.h
@@ -1,7 +1,6 @@
 #ifndef ZBOOT_H
 #define ZBOOT_H
 
-#include <asm/mach-types.h>
 #include <mach/zboot_macros.h>
 
 /**************************************************
@@ -11,7 +10,6 @@
  **************************************************/
 
 #ifdef CONFIG_MACH_MACKEREL
-#define MACH_TYPE       MACH_TYPE_MACKEREL
 #define MEMORY_START    0x40000000
 #include "mach/head-mackerel.txt"
 #else
diff --git a/arch/arm/mach-shmobile/setup-r8a7778.c b/arch/arm/mach-shmobile/setup-r8a7778.c
index a3a2e37b03f3..203becfc6e31 100644
--- a/arch/arm/mach-shmobile/setup-r8a7778.c
+++ b/arch/arm/mach-shmobile/setup-r8a7778.c
@@ -333,6 +333,40 @@ void __init r8a7778_add_mmc_device(struct sh_mmcif_plat_data *info)
                 info, sizeof(*info));
 }
 
+/* VIN */
+#define R8A7778_VIN(idx)                                                \
+static struct resource vin##idx##_resources[] __initdata = {            \
+        DEFINE_RES_MEM(0xffc50000 + 0x1000 * (idx), 0x1000),            \
+        DEFINE_RES_IRQ(gic_iid(0x5a)),                                  \
+};                                                                      \
+                                                                        \
+static struct platform_device_info vin##idx##_info __initdata = {       \
+        .parent         = &platform_bus,                                \
+        .name           = "r8a7778-vin",                                \
+        .id             = idx,                                          \
+        .res            = vin##idx##_resources,                         \
+        .num_res        = ARRAY_SIZE(vin##idx##_resources),             \
+        .dma_mask       = DMA_BIT_MASK(32),                             \
+}
+
+R8A7778_VIN(0);
+R8A7778_VIN(1);
+
+static struct platform_device_info *vin_info_table[] __initdata = {
+        &vin0_info,
+        &vin1_info,
+};
+
+void __init r8a7778_add_vin_device(int id, struct rcar_vin_platform_data *pdata)
+{
+        BUG_ON(id < 0 || id > 1);
+
+        vin_info_table[id]->data = pdata;
+        vin_info_table[id]->size_data = sizeof(*pdata);
+
+        platform_device_register_full(vin_info_table[id]);
+}
+
 void __init r8a7778_add_standard_devices(void)
 {
         int i;
diff --git a/arch/arm/mach-shmobile/setup-r8a7779.c b/arch/arm/mach-shmobile/setup-r8a7779.c
index 66d38261ecaa..41bab625341e 100644
--- a/arch/arm/mach-shmobile/setup-r8a7779.c
+++ b/arch/arm/mach-shmobile/setup-r8a7779.c
@@ -559,6 +559,33 @@ static struct resource ether_resources[] = {
         },
 };
 
+#define R8A7779_VIN(idx) \
+static struct resource vin##idx##_resources[] __initdata = {            \
+        DEFINE_RES_MEM(0xffc50000 + 0x1000 * (idx), 0x1000),            \
+        DEFINE_RES_IRQ(gic_iid(0x5f + (idx))),                          \
+};                                                                      \
+                                                                        \
+static struct platform_device_info vin##idx##_info __initdata = {       \
+        .parent         = &platform_bus,                                \
+        .name           = "r8a7779-vin",                                \
+        .id             = idx,                                          \
+        .res            = vin##idx##_resources,                         \
+        .num_res        = ARRAY_SIZE(vin##idx##_resources),             \
+        .dma_mask       = DMA_BIT_MASK(32),                             \
+}
+
+R8A7779_VIN(0);
+R8A7779_VIN(1);
+R8A7779_VIN(2);
+R8A7779_VIN(3);
+
+static struct platform_device_info *vin_info_table[] __initdata = {
+        &vin0_info,
+        &vin1_info,
+        &vin2_info,
+        &vin3_info,
+};
+
 static struct platform_device *r8a7779_devices_dt[] __initdata = {
         &scif0_device,
         &scif1_device,
@@ -610,6 +637,16 @@ void __init r8a7779_add_usb_phy_device(struct rcar_phy_platform_data *pdata)
                                           pdata, sizeof(*pdata));
 }
 
+void __init r8a7779_add_vin_device(int id, struct rcar_vin_platform_data *pdata)
+{
+        BUG_ON(id < 0 || id > 3);
+
+        vin_info_table[id]->data = pdata;
+        vin_info_table[id]->size_data = sizeof(*pdata);
+
+        platform_device_register_full(vin_info_table[id]);
+}
+
 /* do nothing for !CONFIG_SMP or !CONFIG_HAVE_TWD */
 void __init __weak r8a7779_register_twd(void) { }
 
diff --git a/arch/arm/mach-shmobile/sleep-sh7372.S b/arch/arm/mach-shmobile/sleep-sh7372.S
index 53f4840e4949..9782862899e8 100644
--- a/arch/arm/mach-shmobile/sleep-sh7372.S
+++ b/arch/arm/mach-shmobile/sleep-sh7372.S
@@ -41,6 +41,7 @@
 sh7372_resume_core_standby_sysc:
         ldr     pc, 1f
 
+        .align  2
         .globl  sh7372_cpu_resume
 sh7372_cpu_resume:
 1:      .space  4
@@ -96,6 +97,7 @@ sh7372_do_idle_sysc:
 1:
         b      1b
 
+        .align  2
 kernel_flush:
         .word v7_flush_dcache_all
 #endif
diff --git a/arch/arm/mach-spear/include/mach/debug-macro.S b/arch/arm/mach-spear/include/mach/debug-macro.S
deleted file mode 100644
index 75b05ad0fbad..000000000000
--- a/arch/arm/mach-spear/include/mach/debug-macro.S
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * arch/arm/plat-spear/include/plat/debug-macro.S
- *
- * Debugging macro include header for spear platform
- *
- * Copyright (C) 2009 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
- *
- * This file is licensed under the terms of the GNU General Public
- * License version 2. This program is licensed "as is" without any
- * warranty of any kind, whether express or implied.
- */
-
-#include <linux/amba/serial.h>
-#include <mach/spear.h>
-
-                .macro  addruart, rp, rv, tmp
-                mov     \rp, #SPEAR_DBG_UART_BASE               @ Physical base
-                mov     \rv, #VA_SPEAR_DBG_UART_BASE            @ Virtual base
-                .endm
-
-                .macro  senduart, rd, rx
-                strb    \rd, [\rx, #UART01x_DR]                 @ ASC_TX_BUFFER
-                .endm
-
-                .macro  waituart, rd, rx
-1001:           ldr     \rd, [\rx, #UART01x_FR]                 @ FLAG REGISTER
-                tst     \rd, #UART01x_FR_TXFF                   @ TX_FULL
-                bne     1001b
-                .endm
-
-                .macro  busyuart, rd, rx
-1002:           ldr     \rd, [\rx, #UART01x_FR]                 @ FLAG REGISTER
-                tst     \rd, #UART011_FR_TXFE                   @ TX_EMPTY
-                beq     1002b
-                .endm
diff --git a/arch/arm/mach-spear/include/mach/spear.h b/arch/arm/mach-spear/include/mach/spear.h
index cf3a5369eeca..5cdc53d9b653 100644
--- a/arch/arm/mach-spear/include/mach/spear.h
+++ b/arch/arm/mach-spear/include/mach/spear.h
@@ -39,7 +39,6 @@
 
 /* Debug uart for linux, will be used for debug and uncompress messages */
 #define SPEAR_DBG_UART_BASE             SPEAR_ICM1_UART_BASE
-#define VA_SPEAR_DBG_UART_BASE          VA_SPEAR_ICM1_UART_BASE
 
 /* Sysctl base for spear platform */
 #define SPEAR_SYS_CTRL_BASE             SPEAR_ICM3_SYS_CTRL_BASE
@@ -86,7 +85,6 @@
 
 /* Debug uart for linux, will be used for debug and uncompress messages */
 #define SPEAR_DBG_UART_BASE                     UART_BASE
-#define VA_SPEAR_DBG_UART_BASE                  VA_UART_BASE
 
 #endif /* SPEAR13XX */
 
diff --git a/arch/arm/mach-sti/headsmp.S b/arch/arm/mach-sti/headsmp.S
index 78ebc7559f53..4c09bae86edf 100644
--- a/arch/arm/mach-sti/headsmp.S
+++ b/arch/arm/mach-sti/headsmp.S
@@ -16,8 +16,6 @@
 #include <linux/linkage.h>
 #include <linux/init.h>
 
-        __INIT
-
 /*
  * ST specific entry point for secondary CPUs.  This provides
  * a "holding pen" into which all secondary cores are held until we're
diff --git a/arch/arm/mach-tegra/tegra.c b/arch/arm/mach-tegra/tegra.c
index 0d1e4128d460..fc97cfd52769 100644
--- a/arch/arm/mach-tegra/tegra.c
+++ b/arch/arm/mach-tegra/tegra.c
@@ -29,7 +29,6 @@
 #include <linux/of_fdt.h>
 #include <linux/of_platform.h>
 #include <linux/pda_power.h>
-#include <linux/platform_data/tegra_usb.h>
 #include <linux/io.h>
 #include <linux/slab.h>
 #include <linux/sys_soc.h>
@@ -46,40 +45,6 @@
 #include "fuse.h"
 #include "iomap.h"
 
-static struct tegra_ehci_platform_data tegra_ehci1_pdata = {
-        .operating_mode = TEGRA_USB_OTG,
-        .power_down_on_bus_suspend = 1,
-        .vbus_gpio = -1,
-};
-
-static struct tegra_ulpi_config tegra_ehci2_ulpi_phy_config = {
-        .reset_gpio = -1,
-        .clk = "cdev2",
-};
-
-static struct tegra_ehci_platform_data tegra_ehci2_pdata = {
-        .phy_config = &tegra_ehci2_ulpi_phy_config,
-        .operating_mode = TEGRA_USB_HOST,
-        .power_down_on_bus_suspend = 1,
-        .vbus_gpio = -1,
-};
-
-static struct tegra_ehci_platform_data tegra_ehci3_pdata = {
-        .operating_mode = TEGRA_USB_HOST,
-        .power_down_on_bus_suspend = 1,
-        .vbus_gpio = -1,
-};
-
-static struct of_dev_auxdata tegra20_auxdata_lookup[] __initdata = {
-        OF_DEV_AUXDATA("nvidia,tegra20-ehci", 0xC5000000, "tegra-ehci.0",
-                       &tegra_ehci1_pdata),
-        OF_DEV_AUXDATA("nvidia,tegra20-ehci", 0xC5004000, "tegra-ehci.1",
-                       &tegra_ehci2_pdata),
-        OF_DEV_AUXDATA("nvidia,tegra20-ehci", 0xC5008000, "tegra-ehci.2",
-                       &tegra_ehci3_pdata),
-        {}
-};
-
 static void __init tegra_dt_init(void)
 {
         struct soc_device_attribute *soc_dev_attr;
@@ -112,8 +77,7 @@ static void __init tegra_dt_init(void)
          * devices
          */
 out:
-        of_platform_populate(NULL, of_default_bus_match_table,
-                                tegra20_auxdata_lookup, parent);
+        of_platform_populate(NULL, of_default_bus_match_table, NULL, parent);
 }
 
 static void __init trimslice_init(void)
diff --git a/arch/arm/mach-ux500/Makefile b/arch/arm/mach-ux500/Makefile
index bf9b6be5b180..fe1f3e26b88b 100644
--- a/arch/arm/mach-ux500/Makefile
+++ b/arch/arm/mach-ux500/Makefile
@@ -4,7 +4,6 @@
 
 obj-y                           := cpu.o devices.o devices-common.o \
                                    id.o usb.o timer.o pm.o
-obj-$(CONFIG_CPU_IDLE)          += cpuidle.o
 obj-$(CONFIG_CACHE_L2X0)        += cache-l2x0.o
 obj-$(CONFIG_UX500_SOC_DB8500)  += cpu-db8500.o devices-db8500.o
 obj-$(CONFIG_MACH_MOP500)       += board-mop500.o board-mop500-sdi.o \
diff --git a/arch/arm/mach-ux500/cpuidle.c b/arch/arm/mach-ux500/cpuidle.c
deleted file mode 100644
index a45dd09daed9..000000000000
--- a/arch/arm/mach-ux500/cpuidle.c
+++ /dev/null
@@ -1,128 +0,0 @@
-/*
- * Copyright (c) 2012 Linaro : Daniel Lezcano <daniel.lezcano@linaro.org> (IBM)
- *
- * Based on the work of Rickard Andersson <rickard.andersson@stericsson.com>
- * and Jonas Aaberg <jonas.aberg@stericsson.com>.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/cpuidle.h>
-#include <linux/spinlock.h>
-#include <linux/atomic.h>
-#include <linux/smp.h>
-#include <linux/mfd/dbx500-prcmu.h>
-#include <linux/platform_data/arm-ux500-pm.h>
-
-#include <asm/cpuidle.h>
-#include <asm/proc-fns.h>
-
-#include "db8500-regs.h"
-#include "id.h"
-
-static atomic_t master = ATOMIC_INIT(0);
-static DEFINE_SPINLOCK(master_lock);
-
-static inline int ux500_enter_idle(struct cpuidle_device *dev,
-                                   struct cpuidle_driver *drv, int index)
-{
-        int this_cpu = smp_processor_id();
-        bool recouple = false;
-
-        if (atomic_inc_return(&master) == num_online_cpus()) {
-
-                /* With this lock, we prevent the other cpu to exit and enter
-                 * this function again and become the master */
-                if (!spin_trylock(&master_lock))
-                        goto wfi;
-
-                /* decouple the gic from the A9 cores */
-                if (prcmu_gic_decouple()) {
-                        spin_unlock(&master_lock);
-                        goto out;
-                }
-
-                /* If an error occur, we will have to recouple the gic
-                 * manually */
-                recouple = true;
-
-                /* At this state, as the gic is decoupled, if the other
-                 * cpu is in WFI, we have the guarantee it won't be wake
-                 * up, so we can safely go to retention */
-                if (!prcmu_is_cpu_in_wfi(this_cpu ? 0 : 1))
-                        goto out;
-
-                /* The prcmu will be in charge of watching the interrupts
-                 * and wake up the cpus */
-                if (prcmu_copy_gic_settings())
-                        goto out;
-
-                /* Check in the meantime an interrupt did
-                 * not occur on the gic ... */
-                if (prcmu_gic_pending_irq())
-                        goto out;
-
-                /* ... and the prcmu */
-                if (prcmu_pending_irq())
-                        goto out;
-
-                /* Go to the retention state, the prcmu will wait for the
-                 * cpu to go WFI and this is what happens after exiting this
-                 * 'master' critical section */
-                if (prcmu_set_power_state(PRCMU_AP_IDLE, true, true))
-                        goto out;
-
-                /* When we switch to retention, the prcmu is in charge
-                 * of recoupling the gic automatically */
-                recouple = false;
-
-                spin_unlock(&master_lock);
-        }
-wfi:
-        cpu_do_idle();
-out:
-        atomic_dec(&master);
-
-        if (recouple) {
-                prcmu_gic_recouple();
-                spin_unlock(&master_lock);
-        }
-
-        return index;
-}
-
-static struct cpuidle_driver ux500_idle_driver = {
-        .name = "ux500_idle",
-        .owner = THIS_MODULE,
-        .states = {
-                ARM_CPUIDLE_WFI_STATE,
-                {
-                        .enter            = ux500_enter_idle,
-                        .exit_latency     = 70,
-                        .target_residency = 260,
-                        .flags            = CPUIDLE_FLAG_TIME_VALID |
-                                            CPUIDLE_FLAG_TIMER_STOP,
-                        .name             = "ApIdle",
-                        .desc             = "ARM Retention",
-                },
-        },
-        .safe_state_index = 0,
-        .state_count = 2,
-};
-
-int __init ux500_idle_init(void)
-{
-        if (!(cpu_is_u8500_family() || cpu_is_ux540_family()))
-                return -ENODEV;
-
-        /* Configure wake up reasons */
-        prcmu_enable_wakeups(PRCMU_WAKEUP(ARM) | PRCMU_WAKEUP(RTC) |
-                             PRCMU_WAKEUP(ABB));
-
-        return cpuidle_register(&ux500_idle_driver, NULL);
-}
-
-device_initcall(ux500_idle_init);
diff --git a/arch/arm/mach-versatile/include/mach/debug-macro.S b/arch/arm/mach-versatile/include/mach/debug-macro.S
deleted file mode 100644
index d0fbd7f1cb00..000000000000
--- a/arch/arm/mach-versatile/include/mach/debug-macro.S
+++ /dev/null
@@ -1,21 +0,0 @@
-/* arch/arm/mach-versatile/include/mach/debug-macro.S
- *
- * Debugging macro include header
- *
- *  Copyright (C) 1994-1999 Russell King
- *  Moved from linux/arch/arm/kernel/debug.S by Ben Dooks
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
-*/
-
-                .macro  addruart, rp, rv, tmp
-                mov     \rp,      #0x001F0000
-                orr     \rp, \rp, #0x00001000
-                orr     \rv, \rp, #0xf1000000   @ virtual base
-                orr     \rp, \rp,  #0x10000000  @ physical base
-                .endm
-
-#include <asm/hardware/debug-pl01x.S>
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index db5c2cab8fda..cd2c88e7a8f7 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -809,15 +809,18 @@ config KUSER_HELPERS
           the CPU type fitted to the system.  This permits binaries to be
           run on ARMv4 through to ARMv7 without modification.
 
+          See Documentation/arm/kernel_user_helpers.txt for details.
+
           However, the fixed address nature of these helpers can be used
           by ROP (return orientated programming) authors when creating
           exploits.
 
           If all of the binaries and libraries which run on your platform
           are built specifically for your platform, and make no use of
-          these helpers, then you can turn this option off.  However,
-          when such an binary or library is run, it will receive a SIGILL
-          signal, which will terminate the program.
+          these helpers, then you can turn this option off to hinder
+          such exploits. However, in that case, if a binary or library
+          relying on those helpers is run, it will receive a SIGILL signal,
+          which will terminate the program.
 
           Say N here only if you are absolutely certain that you do not
           need these helpers; otherwise, the safe option is to say Y.
diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
index d70e0aba0c9d..447da6ffadd5 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -290,7 +290,7 @@ static void l2x0_disable(void)
         raw_spin_lock_irqsave(&l2x0_lock, flags);
         __l2x0_flush_all();
         writel_relaxed(0, l2x0_base + L2X0_CTRL);
-        dsb();
+        dsb(st);
         raw_spin_unlock_irqrestore(&l2x0_lock, flags);
 }
 
@@ -417,9 +417,9 @@ void __init l2x0_init(void __iomem *base, u32 aux_val, u32 aux_mask)
                 outer_cache.disable = l2x0_disable;
         }
 
-        printk(KERN_INFO "%s cache controller enabled\n", type);
-        printk(KERN_INFO "l2x0: %d ways, CACHE_ID 0x%08x, AUX_CTRL 0x%08x, Cache size: %d B\n",
-                        ways, cache_id, aux, l2x0_size);
+        pr_info("%s cache controller enabled\n", type);
+        pr_info("l2x0: %d ways, CACHE_ID 0x%08x, AUX_CTRL 0x%08x, Cache size: %d kB\n",
+                ways, cache_id, aux, l2x0_size >> 10);
 }
 
 #ifdef CONFIG_OF
@@ -929,7 +929,9 @@ static const struct of_device_id l2x0_ids[] __initconst = {
           .data = (void *)&aurora_no_outer_data},
         { .compatible = "marvell,aurora-outer-cache",
           .data = (void *)&aurora_with_outer_data},
-        { .compatible = "bcm,bcm11351-a2-pl310-cache",
+        { .compatible = "brcm,bcm11351-a2-pl310-cache",
+          .data = (void *)&bcm_l2x0_data},
+        { .compatible = "bcm,bcm11351-a2-pl310-cache", /* deprecated name */
           .data = (void *)&bcm_l2x0_data},
         {}
 };
diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
index 515b00064da8..b5c467a65c27 100644
--- a/arch/arm/mm/cache-v7.S
+++ b/arch/arm/mm/cache-v7.S
@@ -282,7 +282,7 @@ ENTRY(v7_coherent_user_range)
         add     r12, r12, r2
         cmp     r12, r1
         blo     1b
-        dsb
+        dsb     ishst
         icache_line_size r2, r3
         sub     r3, r2, #1
         bic     r12, r0, r3
@@ -294,7 +294,7 @@ ENTRY(v7_coherent_user_range)
         mov     r0, #0
         ALT_SMP(mcr     p15, 0, r0, c7, c1, 6)  @ invalidate BTB Inner Shareable
         ALT_UP(mcr      p15, 0, r0, c7, c5, 6)  @ invalidate BTB
-        dsb
+        dsb     ishst
         isb
         mov     pc, lr
 
diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
index 4a0544492f10..84e6f772e204 100644
--- a/arch/arm/mm/context.c
+++ b/arch/arm/mm/context.c
@@ -162,10 +162,7 @@ static void flush_context(unsigned int cpu)
         }
 
         /* Queue a TLB invalidate and flush the I-cache if necessary. */
-        if (!tlb_ops_need_broadcast())
-                cpumask_set_cpu(cpu, &tlb_flush_pending);
-        else
-                cpumask_setall(&tlb_flush_pending);
+        cpumask_setall(&tlb_flush_pending);
 
         if (icache_is_vivt_asid_tagged())
                 __flush_icache_all();
@@ -245,8 +242,6 @@ void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk)
         if (cpumask_test_and_clear_cpu(cpu, &tlb_flush_pending)) {
                 local_flush_bp_all();
                 local_flush_tlb_all();
-                if (erratum_a15_798181())
-                        dummy_flush_tlb_a15_erratum();
         }
 
         atomic64_set(&per_cpu(active_asids, cpu), asid);
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 7f9b1798c6cf..f5e1a8471714 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -358,7 +358,7 @@ static int __init atomic_pool_init(void)
         if (!pages)
                 goto no_pages;
 
-        if (IS_ENABLED(CONFIG_CMA))
+        if (IS_ENABLED(CONFIG_DMA_CMA))
                 ptr = __alloc_from_contiguous(NULL, pool->size, prot, &page,
                                               atomic_pool_init);
         else
@@ -455,7 +455,6 @@ static void __dma_remap(struct page *page, size_t size, pgprot_t prot)
         unsigned end = start + size;
 
         apply_to_page_range(&init_mm, start, size, __dma_update_pte, &prot);
-        dsb();
         flush_tlb_kernel_range(start, end);
 }
 
@@ -670,7 +669,7 @@ static void *__dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
                 addr = __alloc_simple_buffer(dev, size, gfp, &page);
         else if (!(gfp & __GFP_WAIT))
                 addr = __alloc_from_pool(size, &page);
-        else if (!IS_ENABLED(CONFIG_CMA))
+        else if (!IS_ENABLED(CONFIG_DMA_CMA))
                 addr = __alloc_remap_buffer(dev, size, gfp, prot, &page, caller);
         else
                 addr = __alloc_from_contiguous(dev, size, prot, &page, caller);
@@ -759,7 +758,7 @@ static void __arm_dma_free(struct device *dev, size_t size, void *cpu_addr,
                 __dma_free_buffer(page, size);
         } else if (__free_from_pool(cpu_addr, size)) {
                 return;
-        } else if (!IS_ENABLED(CONFIG_CMA)) {
+        } else if (!IS_ENABLED(CONFIG_DMA_CMA)) {
                 __dma_free_remap(cpu_addr, size);
                 __dma_free_buffer(page, size);
         } else {
diff --git a/arch/arm/mm/hugetlbpage.c b/arch/arm/mm/hugetlbpage.c
index 3d1e4a205b0b..66781bf34077 100644
--- a/arch/arm/mm/hugetlbpage.c
+++ b/arch/arm/mm/hugetlbpage.c
@@ -36,22 +36,6 @@
  * of type casting from pmd_t * to pte_t *.
  */
 
-pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
-{
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd = NULL;
-
-        pgd = pgd_offset(mm, addr);
-        if (pgd_present(*pgd)) {
-                pud = pud_offset(pgd, addr);
-                if (pud_present(*pud))
-                        pmd = pmd_offset(pud, addr);
-        }
-
-        return (pte_t *)pmd;
-}
-
 struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
                               int write)
 {
@@ -68,33 +52,6 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
         return 0;
 }
 
-pte_t *huge_pte_alloc(struct mm_struct *mm,
-                        unsigned long addr, unsigned long sz)
-{
-        pgd_t *pgd;
-        pud_t *pud;
-        pte_t *pte = NULL;
-
-        pgd = pgd_offset(mm, addr);
-        pud = pud_alloc(mm, pgd, addr);
-        if (pud)
-                pte = (pte_t *)pmd_alloc(mm, pud, addr);
-
-        return pte;
-}
-
-struct page *
-follow_huge_pmd(struct mm_struct *mm, unsigned long address,
-                pmd_t *pmd, int write)
-{
-        struct page *page;
-
-        page = pte_page(*(pte_t *)pmd);
-        if (page)
-                page += ((address & ~PMD_MASK) >> PAGE_SHIFT);
-        return page;
-}
-
 int pmd_huge(pmd_t pmd)
 {
         return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 15225d829d71..2958e74fc42c 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -231,7 +231,7 @@ static void __init arm_adjust_dma_zone(unsigned long *size, unsigned long *hole,
 }
 #endif
 
-void __init setup_dma_zone(struct machine_desc *mdesc)
+void __init setup_dma_zone(const struct machine_desc *mdesc)
 {
 #ifdef CONFIG_ZONE_DMA
         if (mdesc->dma_zone_size) {
@@ -335,7 +335,8 @@ phys_addr_t __init arm_memblock_steal(phys_addr_t size, phys_addr_t align)
         return phys;
 }
 
-void __init arm_memblock_init(struct meminfo *mi, struct machine_desc *mdesc)
+void __init arm_memblock_init(struct meminfo *mi,
+        const struct machine_desc *mdesc)
 {
         int i;
 
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 53cdbd39ec8e..b1d17eeb59b8 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -1186,7 +1186,7 @@ void __init arm_mm_memblock_reserve(void)
  * called function.  This means you can't use any function or debugging
  * method which may touch any device, otherwise the kernel _will_ crash.
  */
-static void __init devicemaps_init(struct machine_desc *mdesc)
+static void __init devicemaps_init(const struct machine_desc *mdesc)
 {
         struct map_desc map;
         unsigned long addr;
@@ -1319,7 +1319,7 @@ static void __init map_lowmem(void)
  * paging_init() sets up the page tables, initialises the zone memory
  * maps, and sets up the zero page, bad page and bad page tables.
  */
-void __init paging_init(struct machine_desc *mdesc)
+void __init paging_init(const struct machine_desc *mdesc)
 {
         void *zero_page;
 
diff --git a/arch/arm/mm/nommu.c b/arch/arm/mm/nommu.c
index 1fa50100ab6a..34d4ab217bab 100644
--- a/arch/arm/mm/nommu.c
+++ b/arch/arm/mm/nommu.c
@@ -299,7 +299,7 @@ void __init sanity_check_meminfo(void)
  * paging_init() sets up the page tables, initialises the zone memory
  * maps, and sets up the zero page, bad page and bad page tables.
  */
-void __init paging_init(struct machine_desc *mdesc)
+void __init paging_init(const struct machine_desc *mdesc)
 {
         early_trap_init((void *)CONFIG_VECTORS_BASE);
         mpu_setup();
diff --git a/arch/arm/mm/proc-feroceon.S b/arch/arm/mm/proc-feroceon.S
index d5146b98c8d1..db79b62c92fb 100644
--- a/arch/arm/mm/proc-feroceon.S
+++ b/arch/arm/mm/proc-feroceon.S
@@ -514,6 +514,32 @@ ENTRY(cpu_feroceon_set_pte_ext)
 #endif
         mov     pc, lr
 
+/* Suspend/resume support: taken from arch/arm/mm/proc-arm926.S */
+.globl  cpu_feroceon_suspend_size
+.equ    cpu_feroceon_suspend_size, 4 * 3
+#ifdef CONFIG_ARM_CPU_SUSPEND
+ENTRY(cpu_feroceon_do_suspend)
+        stmfd   sp!, {r4 - r6, lr}
+        mrc     p15, 0, r4, c13, c0, 0  @ PID
+        mrc     p15, 0, r5, c3, c0, 0   @ Domain ID
+        mrc     p15, 0, r6, c1, c0, 0   @ Control register
+        stmia   r0, {r4 - r6}
+        ldmfd   sp!, {r4 - r6, pc}
+ENDPROC(cpu_feroceon_do_suspend)
+
+ENTRY(cpu_feroceon_do_resume)
+        mov     ip, #0
+        mcr     p15, 0, ip, c8, c7, 0   @ invalidate I+D TLBs
+        mcr     p15, 0, ip, c7, c7, 0   @ invalidate I+D caches
+        ldmia   r0, {r4 - r6}
+        mcr     p15, 0, r4, c13, c0, 0  @ PID
+        mcr     p15, 0, r5, c3, c0, 0   @ Domain ID
+        mcr     p15, 0, r1, c2, c0, 0   @ TTB address
+        mov     r0, r6                  @ control register
+        b       cpu_resume_mmu
+ENDPROC(cpu_feroceon_do_resume)
+#endif
+
         .type   __feroceon_setup, #function
 __feroceon_setup:
         mov     r0, #0
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 73398bcf9bd8..c63d9bdee51e 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -83,7 +83,7 @@ ENTRY(cpu_v7_dcache_clean_area)
         add     r0, r0, r2
         subs    r1, r1, r2
         bhi     2b
-        dsb
+        dsb     ishst
         mov     pc, lr
 ENDPROC(cpu_v7_dcache_clean_area)
 
@@ -330,7 +330,19 @@ __v7_setup:
 1:
 #endif
 
-3:      mov     r10, #0
+        /* Cortex-A15 Errata */
+3:      ldr     r10, =0x00000c0f                @ Cortex-A15 primary part number
+        teq     r0, r10
+        bne     4f
+
+#ifdef CONFIG_ARM_ERRATA_773022
+        cmp     r6, #0x4                        @ only present up to r0p4
+        mrcle   p15, 0, r10, c1, c0, 1          @ read aux control register
+        orrle   r10, r10, #1 << 1               @ disable loop buffer
+        mcrle   p15, 0, r10, c1, c0, 1          @ write aux control register
+#endif
+
+4:      mov     r10, #0
         mcr     p15, 0, r10, c7, c5, 0          @ I+BTB cache invalidate
         dsb
 #ifdef CONFIG_MMU
diff --git a/arch/arm/mm/tlb-v7.S b/arch/arm/mm/tlb-v7.S
index ea94765acf9a..355308767bae 100644
--- a/arch/arm/mm/tlb-v7.S
+++ b/arch/arm/mm/tlb-v7.S
@@ -35,7 +35,7 @@
 ENTRY(v7wbi_flush_user_tlb_range)
         vma_vm_mm r3, r2                        @ get vma->vm_mm
         mmid    r3, r3                          @ get vm_mm->context.id
-        dsb
+        dsb     ish
         mov     r0, r0, lsr #PAGE_SHIFT         @ align address
         mov     r1, r1, lsr #PAGE_SHIFT
         asid    r3, r3                          @ mask ASID
@@ -56,7 +56,7 @@ ENTRY(v7wbi_flush_user_tlb_range)
         add     r0, r0, #PAGE_SZ
         cmp     r0, r1
         blo     1b
-        dsb
+        dsb     ish
         mov     pc, lr
 ENDPROC(v7wbi_flush_user_tlb_range)
 
@@ -69,7 +69,7 @@ ENDPROC(v7wbi_flush_user_tlb_range)
  *      - end   - end address (exclusive, may not be aligned)
  */
 ENTRY(v7wbi_flush_kern_tlb_range)
-        dsb
+        dsb     ish
         mov     r0, r0, lsr #PAGE_SHIFT         @ align address
         mov     r1, r1, lsr #PAGE_SHIFT
         mov     r0, r0, lsl #PAGE_SHIFT
@@ -84,7 +84,7 @@ ENTRY(v7wbi_flush_kern_tlb_range)
         add     r0, r0, #PAGE_SZ
         cmp     r0, r1
         blo     1b
-        dsb
+        dsb     ish
         isb
         mov     pc, lr
 ENDPROC(v7wbi_flush_kern_tlb_range)
diff --git a/arch/arm/plat-omap/dma.c b/arch/arm/plat-omap/dma.c
index 4d463ca6821f..037660633fa4 100644
--- a/arch/arm/plat-omap/dma.c
+++ b/arch/arm/plat-omap/dma.c
@@ -2083,6 +2083,7 @@ static int omap_system_dma_probe(struct platform_device *pdev)
                 dma_irq = platform_get_irq_byname(pdev, irq_name);
                 if (dma_irq < 0) {
                         dev_err(&pdev->dev, "failed: request IRQ %d", dma_irq);
+                        ret = dma_irq;
                         goto exit_dma_lch_fail;
                 }
                 ret = setup_irq(dma_irq, &omap24xx_dma_irq);
diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c
index 8e11e96eab5e..c83f27b6bdda 100644
--- a/arch/arm/plat-pxa/ssp.c
+++ b/arch/arm/plat-pxa/ssp.c
@@ -30,6 +30,8 @@
 #include <linux/platform_device.h>
 #include <linux/spi/pxa2xx_spi.h>
 #include <linux/io.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
 
 #include <asm/irq.h>
 #include <mach/hardware.h>
@@ -60,6 +62,30 @@ struct ssp_device *pxa_ssp_request(int port, const char *label)
 }
 EXPORT_SYMBOL(pxa_ssp_request);
 
+struct ssp_device *pxa_ssp_request_of(const struct device_node *of_node,
+                                      const char *label)
+{
+        struct ssp_device *ssp = NULL;
+
+        mutex_lock(&ssp_lock);
+
+        list_for_each_entry(ssp, &ssp_list, node) {
+                if (ssp->of_node == of_node && ssp->use_count == 0) {
+                        ssp->use_count++;
+                        ssp->label = label;
+                        break;
+                }
+        }
+
+        mutex_unlock(&ssp_lock);
+
+        if (&ssp->node == &ssp_list)
+                return NULL;
+
+        return ssp;
+}
+EXPORT_SYMBOL(pxa_ssp_request_of);
+
 void pxa_ssp_free(struct ssp_device *ssp)
 {
         mutex_lock(&ssp_lock);
@@ -72,96 +98,126 @@ void pxa_ssp_free(struct ssp_device *ssp)
 }
 EXPORT_SYMBOL(pxa_ssp_free);
 
+#ifdef CONFIG_OF
+static const struct of_device_id pxa_ssp_of_ids[] = {
+        { .compatible = "mrvl,pxa25x-ssp",      .data = (void *) PXA25x_SSP },
+        { .compatible = "mvrl,pxa25x-nssp",     .data = (void *) PXA25x_NSSP },
+        { .compatible = "mrvl,pxa27x-ssp",      .data = (void *) PXA27x_SSP },
+        { .compatible = "mrvl,pxa3xx-ssp",      .data = (void *) PXA3xx_SSP },
+        { .compatible = "mvrl,pxa168-ssp",      .data = (void *) PXA168_SSP },
+        { .compatible = "mrvl,pxa910-ssp",      .data = (void *) PXA910_SSP },
+        { .compatible = "mrvl,ce4100-ssp",      .data = (void *) CE4100_SSP },
+        { .compatible = "mrvl,lpss-ssp",        .data = (void *) LPSS_SSP },
+        { },
+};
+MODULE_DEVICE_TABLE(of, pxa_ssp_of_ids);
+#endif
+
 static int pxa_ssp_probe(struct platform_device *pdev)
 {
-        const struct platform_device_id *id = platform_get_device_id(pdev);
         struct resource *res;
         struct ssp_device *ssp;
-        int ret = 0;
+        struct device *dev = &pdev->dev;
 
-        ssp = kzalloc(sizeof(struct ssp_device), GFP_KERNEL);
-        if (ssp == NULL) {
-                dev_err(&pdev->dev, "failed to allocate memory");
+        ssp = devm_kzalloc(dev, sizeof(struct ssp_device), GFP_KERNEL);
+        if (ssp == NULL)
                 return -ENOMEM;
-        }
-        ssp->pdev = pdev;
 
-        ssp->clk = clk_get(&pdev->dev, NULL);
-        if (IS_ERR(ssp->clk)) {
-                ret = PTR_ERR(ssp->clk);
-                goto err_free;
-        }
+        ssp->pdev = pdev;
 
-        res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
-        if (res == NULL) {
-                dev_err(&pdev->dev, "no SSP RX DRCMR defined\n");
-                ret = -ENODEV;
-                goto err_free_clk;
-        }
-        ssp->drcmr_rx = res->start;
+        ssp->clk = devm_clk_get(dev, NULL);
+        if (IS_ERR(ssp->clk))
+                return PTR_ERR(ssp->clk);
+
+        if (dev->of_node) {
+                struct of_phandle_args dma_spec;
+                struct device_node *np = dev->of_node;
+
+                /*
+                 * FIXME: we should allocate the DMA channel from this
+                 * context and pass the channel down to the ssp users.
+                 * For now, we lookup the rx and tx indices manually
+                 */
+
+                /* rx */
+                of_parse_phandle_with_args(np, "dmas", "#dma-cells",
+                                           0, &dma_spec);
+                ssp->drcmr_rx = dma_spec.args[0];
+                of_node_put(dma_spec.np);
+
+                /* tx */
+                of_parse_phandle_with_args(np, "dmas", "#dma-cells",
+                                           1, &dma_spec);
+                ssp->drcmr_tx = dma_spec.args[0];
+                of_node_put(dma_spec.np);
+        } else {
+                res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
+                if (res == NULL) {
+                        dev_err(dev, "no SSP RX DRCMR defined\n");
+                        return -ENODEV;
+                }
+                ssp->drcmr_rx = res->start;
 
-        res = platform_get_resource(pdev, IORESOURCE_DMA, 1);
-        if (res == NULL) {
-                dev_err(&pdev->dev, "no SSP TX DRCMR defined\n");
-                ret = -ENODEV;
-                goto err_free_clk;
+                res = platform_get_resource(pdev, IORESOURCE_DMA, 1);
+                if (res == NULL) {
+                        dev_err(dev, "no SSP TX DRCMR defined\n");
+                        return -ENODEV;
+                }
+                ssp->drcmr_tx = res->start;
         }
-        ssp->drcmr_tx = res->start;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (res == NULL) {
-                dev_err(&pdev->dev, "no memory resource defined\n");
-                ret = -ENODEV;
-                goto err_free_clk;
+                dev_err(dev, "no memory resource defined\n");
+                return -ENODEV;
         }
 
-        res = request_mem_region(res->start, resource_size(res),
-                        pdev->name);
+        res = devm_request_mem_region(dev, res->start, resource_size(res),
+                                      pdev->name);
         if (res == NULL) {
-                dev_err(&pdev->dev, "failed to request memory resource\n");
-                ret = -EBUSY;
-                goto err_free_clk;
+                dev_err(dev, "failed to request memory resource\n");
+                return -EBUSY;
         }
 
         ssp->phys_base = res->start;
 
-        ssp->mmio_base = ioremap(res->start, resource_size(res));
+        ssp->mmio_base = devm_ioremap(dev, res->start, resource_size(res));
         if (ssp->mmio_base == NULL) {
-                dev_err(&pdev->dev, "failed to ioremap() registers\n");
-                ret = -ENODEV;
-                goto err_free_mem;
+                dev_err(dev, "failed to ioremap() registers\n");
+                return -ENODEV;
         }
 
         ssp->irq = platform_get_irq(pdev, 0);
         if (ssp->irq < 0) {
-                dev_err(&pdev->dev, "no IRQ resource defined\n");
-                ret = -ENODEV;
-                goto err_free_io;
+                dev_err(dev, "no IRQ resource defined\n");
+                return -ENODEV;
+        }
+
+        if (dev->of_node) {
+                const struct of_device_id *id =
+                        of_match_device(of_match_ptr(pxa_ssp_of_ids), dev);
+                ssp->type = (int) id->data;
+        } else {
+                const struct platform_device_id *id =
+                        platform_get_device_id(pdev);
+                ssp->type = (int) id->driver_data;
+
+                /* PXA2xx/3xx SSP ports starts from 1 and the internal pdev->id
+                 * starts from 0, do a translation here
+                 */
+                ssp->port_id = pdev->id + 1;
         }
 
-        /* PXA2xx/3xx SSP ports starts from 1 and the internal pdev->id
-         * starts from 0, do a translation here
-         */
-        ssp->port_id = pdev->id + 1;
         ssp->use_count = 0;
-        ssp->type = (int)id->driver_data;
+        ssp->of_node = dev->of_node;
 
         mutex_lock(&ssp_lock);
         list_add(&ssp->node, &ssp_list);
         mutex_unlock(&ssp_lock);
 
         platform_set_drvdata(pdev, ssp);
-        return 0;
 
-err_free_io:
-        iounmap(ssp->mmio_base);
-err_free_mem:
-        release_mem_region(res->start, resource_size(res));
-err_free_clk:
-        clk_put(ssp->clk);
-err_free:
-        kfree(ssp);
-        return ret;
+        return 0;
 }
 
 static int pxa_ssp_remove(struct platform_device *pdev)
@@ -201,8 +257,9 @@ static struct platform_driver pxa_ssp_driver = {
         .probe          = pxa_ssp_probe,
         .remove         = pxa_ssp_remove,
         .driver         = {
-                .owner  = THIS_MODULE,
-                .name   = "pxa2xx-ssp",
+                .owner          = THIS_MODULE,
+                .name           = "pxa2xx-ssp",
+                .of_match_table = of_match_ptr(pxa_ssp_of_ids),
         },
         .id_table       = ssp_id_table,
 };
diff --git a/arch/arm/plat-samsung/init.c b/arch/arm/plat-samsung/init.c
index 3e5c4619caa5..50a3ea0037db 100644
--- a/arch/arm/plat-samsung/init.c
+++ b/arch/arm/plat-samsung/init.c
@@ -55,12 +55,13 @@ void __init s3c_init_cpu(unsigned long idcode,
 
         printk("CPU %s (id 0x%08lx)\n", cpu->name, idcode);
 
-        if (cpu->map_io == NULL || cpu->init == NULL) {
+        if (cpu->init == NULL) {
                 printk(KERN_ERR "CPU %s support not enabled\n", cpu->name);
                 panic("Unsupported Samsung CPU");
         }
 
-        cpu->map_io();
+        if (cpu->map_io)
+                cpu->map_io();
 }
 
 /* s3c24xx_init_clocks
diff --git a/arch/arm/plat-samsung/s3c-dma-ops.c b/arch/arm/plat-samsung/s3c-dma-ops.c
index 0cc40aea3f5a..98b10ba67dc7 100644
--- a/arch/arm/plat-samsung/s3c-dma-ops.c
+++ b/arch/arm/plat-samsung/s3c-dma-ops.c
@@ -82,7 +82,8 @@ static int s3c_dma_config(unsigned ch, struct samsung_dma_config *param)
 static int s3c_dma_prepare(unsigned ch, struct samsung_dma_prep *param)
 {
         struct cb_data *data;
-        int len = (param->cap == DMA_CYCLIC) ? param->period : param->len;
+        dma_addr_t pos = param->buf;
+        dma_addr_t end = param->buf + param->len;
 
         list_for_each_entry(data, &dma_list, node)
                 if (data->ch == ch)
@@ -94,7 +95,15 @@ static int s3c_dma_prepare(unsigned ch, struct samsung_dma_prep *param)
                 data->fp_param = param->fp_param;
         }
 
-        s3c2410_dma_enqueue(ch, (void *)data, param->buf, len);
+        if (param->cap != DMA_CYCLIC) {
+                s3c2410_dma_enqueue(ch, (void *)data, param->buf, param->len);
+                return 0;
+        }
+
+        while (pos < end) {
+                s3c2410_dma_enqueue(ch, (void *)data, pos, param->period);
+                pos += param->period;
+        }
 
         return 0;
 }
diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
index 8d10dc8a1e17..3e5d3115a2a6 100644
--- a/arch/arm/vfp/vfphw.S
+++ b/arch/arm/vfp/vfphw.S
@@ -78,6 +78,11 @@
 ENTRY(vfp_support_entry)
         DBGSTR3 "instr %08x pc %08x state %p", r0, r2, r10
 
+        ldr     r3, [sp, #S_PSR]        @ Neither lazy restore nor FP exceptions
+        and     r3, r3, #MODE_MASK      @ are supported in kernel mode
+        teq     r3, #USR_MODE
+        bne     vfp_kmode_exception     @ Returns through lr
+
         VFPFMRX r1, FPEXC               @ Is the VFP enabled?
         DBGSTR1 "fpexc %08x", r1
         tst     r1, #FPEXC_EN
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index 5dfbb0b8e7f4..52b8f40b1c73 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -20,6 +20,7 @@
 #include <linux/init.h>
 #include <linux/uaccess.h>
 #include <linux/user.h>
+#include <linux/export.h>
 
 #include <asm/cp15.h>
 #include <asm/cputype.h>
@@ -648,6 +649,72 @@ static int vfp_hotplug(struct notifier_block *b, unsigned long action,
         return NOTIFY_OK;
 }
 
+void vfp_kmode_exception(void)
+{
+        /*
+         * If we reach this point, a floating point exception has been raised
+         * while running in kernel mode. If the NEON/VFP unit was enabled at the
+         * time, it means a VFP instruction has been issued that requires
+         * software assistance to complete, something which is not currently
+         * supported in kernel mode.
+         * If the NEON/VFP unit was disabled, and the location pointed to below
+         * is properly preceded by a call to kernel_neon_begin(), something has
+         * caused the task to be scheduled out and back in again. In this case,
+         * rebuilding and running with CONFIG_DEBUG_ATOMIC_SLEEP enabled should
+         * be helpful in localizing the problem.
+         */
+        if (fmrx(FPEXC) & FPEXC_EN)
+                pr_crit("BUG: unsupported FP instruction in kernel mode\n");
+        else
+                pr_crit("BUG: FP instruction issued in kernel mode with FP unit disabled\n");
+}
+
+#ifdef CONFIG_KERNEL_MODE_NEON
+
+/*
+ * Kernel-side NEON support functions
+ */
+void kernel_neon_begin(void)
+{
+        struct thread_info *thread = current_thread_info();
+        unsigned int cpu;
+        u32 fpexc;
+
+        /*
+         * Kernel mode NEON is only allowed outside of interrupt context
+         * with preemption disabled. This will make sure that the kernel
+         * mode NEON register contents never need to be preserved.
+         */
+        BUG_ON(in_interrupt());
+        cpu = get_cpu();
+
+        fpexc = fmrx(FPEXC) | FPEXC_EN;
+        fmxr(FPEXC, fpexc);
+
+        /*
+         * Save the userland NEON/VFP state. Under UP,
+         * the owner could be a task other than 'current'
+         */
+        if (vfp_state_in_hw(cpu, thread))
+                vfp_save_state(&thread->vfpstate, fpexc);
+#ifndef CONFIG_SMP
+        else if (vfp_current_hw_state[cpu] != NULL)
+                vfp_save_state(vfp_current_hw_state[cpu], fpexc);
+#endif
+        vfp_current_hw_state[cpu] = NULL;
+}
+EXPORT_SYMBOL(kernel_neon_begin);
+
+void kernel_neon_end(void)
+{
+        /* Disable the NEON/VFP unit. */
+        fmxr(FPEXC, fmrx(FPEXC) & ~FPEXC_EN);
+        put_cpu();
+}
+EXPORT_SYMBOL(kernel_neon_end);
+
+#endif /* CONFIG_KERNEL_MODE_NEON */
+
 /*
  * VFP support code initialisation.
  */
@@ -731,4 +798,4 @@ static int __init vfp_init(void)
         return 0;
 }
 
-late_initcall(vfp_init);
+core_initcall(vfp_init);
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index c9770ba5c7df..8a6295c86209 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -170,6 +170,7 @@ static void __init xen_percpu_init(void *unused)
         per_cpu(xen_vcpu, cpu) = vcpup;
 
         enable_percpu_irq(xen_events_irq, 0);
+        put_cpu();
 }
 
 static void xen_restart(enum reboot_mode reboot_mode, const char *cmd)
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 9737e97f9f38..ae323a45c28c 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -96,6 +96,9 @@ config SWIOTLB
 config IOMMU_HELPER
         def_bool SWIOTLB
 
+config KERNEL_MODE_NEON
+        def_bool y
+
 source "init/Kconfig"
 
 source "kernel/Kconfig.freezer"
diff --git a/arch/arm64/include/asm/arch_timer.h b/arch/arm64/include/asm/arch_timer.h
index 98abd476992d..c9f1d2816c2b 100644
--- a/arch/arm64/include/asm/arch_timer.h
+++ b/arch/arm64/include/asm/arch_timer.h
@@ -26,7 +26,13 @@
 
 #include <clocksource/arm_arch_timer.h>
 
-static inline void arch_timer_reg_write(int access, int reg, u32 val)
+/*
+ * These register accessors are marked inline so the compiler can
+ * nicely work out which register we want, and chuck away the rest of
+ * the code.
+ */
+static __always_inline
+void arch_timer_reg_write_cp15(int access, enum arch_timer_reg reg, u32 val)
 {
         if (access == ARCH_TIMER_PHYS_ACCESS) {
                 switch (reg) {
@@ -36,8 +42,6 @@ static inline void arch_timer_reg_write(int access, int reg, u32 val)
                 case ARCH_TIMER_REG_TVAL:
                         asm volatile("msr cntp_tval_el0, %0" : : "r" (val));
                         break;
-                default:
-                        BUILD_BUG();
                 }
         } else if (access == ARCH_TIMER_VIRT_ACCESS) {
                 switch (reg) {
@@ -47,17 +51,14 @@ static inline void arch_timer_reg_write(int access, int reg, u32 val)
                 case ARCH_TIMER_REG_TVAL:
                         asm volatile("msr cntv_tval_el0, %0" : : "r" (val));
                         break;
-                default:
-                        BUILD_BUG();
                 }
-        } else {
-                BUILD_BUG();
         }
 
         isb();
 }
 
-static inline u32 arch_timer_reg_read(int access, int reg)
+static __always_inline
+u32 arch_timer_reg_read_cp15(int access, enum arch_timer_reg reg)
 {
         u32 val;
 
@@ -69,8 +70,6 @@ static inline u32 arch_timer_reg_read(int access, int reg)
                 case ARCH_TIMER_REG_TVAL:
                         asm volatile("mrs %0, cntp_tval_el0" : "=r" (val));
                         break;
-                default:
-                        BUILD_BUG();
                 }
         } else if (access == ARCH_TIMER_VIRT_ACCESS) {
                 switch (reg) {
@@ -80,11 +79,7 @@ static inline u32 arch_timer_reg_read(int access, int reg)
                 case ARCH_TIMER_REG_TVAL:
                         asm volatile("mrs %0, cntv_tval_el0" : "=r" (val));
                         break;
-                default:
-                        BUILD_BUG();
                 }
-        } else {
-                BUILD_BUG();
         }
 
         return val;
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index fe32c0e4ac01..e7fa87f9201b 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -33,8 +33,6 @@ typedef unsigned long elf_greg_t;
 typedef elf_greg_t elf_gregset_t[ELF_NGREG];
 typedef struct user_fpsimd_state elf_fpregset_t;
 
-#define EM_AARCH64              183
-
 /*
  * AArch64 static relocation types.
  */
@@ -151,7 +149,6 @@ extern unsigned long arch_randomize_brk(struct mm_struct *mm);
 #define arch_randomize_brk arch_randomize_brk
 
 #ifdef CONFIG_COMPAT
-#define EM_ARM                          40
 #define COMPAT_ELF_PLATFORM             ("v8l")
 
 #define COMPAT_ELF_ET_DYN_BASE          (randomize_et_dyn(2 * TASK_SIZE_32 / 3))
diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h
index c92de4163eba..b25763bc0ec4 100644
--- a/arch/arm64/include/asm/kvm_asm.h
+++ b/arch/arm64/include/asm/kvm_asm.h
@@ -42,14 +42,15 @@
 #define TPIDR_EL1       18      /* Thread ID, Privileged */
 #define AMAIR_EL1       19      /* Aux Memory Attribute Indirection Register */
 #define CNTKCTL_EL1     20      /* Timer Control Register (EL1) */
+#define PAR_EL1         21      /* Physical Address Register */
 /* 32bit specific registers. Keep them at the end of the range */
-#define DACR32_EL2      21      /* Domain Access Control Register */
-#define IFSR32_EL2      22      /* Instruction Fault Status Register */
-#define FPEXC32_EL2     23      /* Floating-Point Exception Control Register */
-#define DBGVCR32_EL2    24      /* Debug Vector Catch Register */
-#define TEECR32_EL1     25      /* ThumbEE Configuration Register */
-#define TEEHBR32_EL1    26      /* ThumbEE Handler Base Register */
-#define NR_SYS_REGS     27
+#define DACR32_EL2      22      /* Domain Access Control Register */
+#define IFSR32_EL2      23      /* Instruction Fault Status Register */
+#define FPEXC32_EL2     24      /* Floating-Point Exception Control Register */
+#define DBGVCR32_EL2    25      /* Debug Vector Catch Register */
+#define TEECR32_EL1     26      /* ThumbEE Configuration Register */
+#define TEEHBR32_EL1    27      /* ThumbEE Handler Base Register */
+#define NR_SYS_REGS     28
 
 /* 32bit mapping */
 #define c0_MPIDR        (MPIDR_EL1 * 2) /* MultiProcessor ID Register */
@@ -69,6 +70,8 @@
 #define c5_AIFSR        (AFSR1_EL1 * 2) /* Auxiliary Instr Fault Status R */
 #define c6_DFAR         (FAR_EL1 * 2)   /* Data Fault Address Register */
 #define c6_IFAR         (c6_DFAR + 1)   /* Instruction Fault Address Register */
+#define c7_PAR          (PAR_EL1 * 2)   /* Physical Address Register */
+#define c7_PAR_high     (c7_PAR + 1)    /* PAR top 32 bits */
 #define c10_PRRR        (MAIR_EL1 * 2)  /* Primary Region Remap Register */
 #define c10_NMRR        (c10_PRRR + 1)  /* Normal Memory Remap Register */
 #define c12_VBAR        (VBAR_EL1 * 2)  /* Vector Base Address Register */
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 644d73956864..0859a4ddd1e7 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -129,7 +129,7 @@ struct kvm_vcpu_arch {
         struct kvm_mmu_memory_cache mmu_page_cache;
 
         /* Target CPU and feature flags */
-        u32 target;
+        int target;
         DECLARE_BITMAP(features, KVM_VCPU_MAX_FEATURES);
 
         /* Detect first run of a vcpu */
diff --git a/arch/arm64/include/asm/neon.h b/arch/arm64/include/asm/neon.h
new file mode 100644
index 000000000000..b0cc58a97780
--- /dev/null
+++ b/arch/arm64/include/asm/neon.h
@@ -0,0 +1,14 @@
+/*
+ * linux/arch/arm64/include/asm/neon.h
+ *
+ * Copyright (C) 2013 Linaro Ltd <ard.biesheuvel@linaro.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#define cpu_has_neon()          (1)
+
+void kernel_neon_begin(void);
+void kernel_neon_end(void);
diff --git a/arch/arm64/include/asm/pgtable-2level-types.h b/arch/arm64/include/asm/pgtable-2level-types.h
index 3c3ca7d361e4..5f101e63dfc1 100644
--- a/arch/arm64/include/asm/pgtable-2level-types.h
+++ b/arch/arm64/include/asm/pgtable-2level-types.h
@@ -16,6 +16,8 @@
 #ifndef __ASM_PGTABLE_2LEVEL_TYPES_H
 #define __ASM_PGTABLE_2LEVEL_TYPES_H
 
+#include <asm/types.h>
+
 typedef u64 pteval_t;
 typedef u64 pgdval_t;
 typedef pgdval_t pmdval_t;
diff --git a/arch/arm64/include/asm/pgtable-3level-types.h b/arch/arm64/include/asm/pgtable-3level-types.h
index 4489615f14a9..4e94424938a4 100644
--- a/arch/arm64/include/asm/pgtable-3level-types.h
+++ b/arch/arm64/include/asm/pgtable-3level-types.h
@@ -16,6 +16,8 @@
 #ifndef __ASM_PGTABLE_3LEVEL_TYPES_H
 #define __ASM_PGTABLE_3LEVEL_TYPES_H
 
+#include <asm/types.h>
+
 typedef u64 pteval_t;
 typedef u64 pmdval_t;
 typedef u64 pgdval_t;
diff --git a/arch/arm64/include/asm/pgtable-hwdef.h b/arch/arm64/include/asm/pgtable-hwdef.h
index e182a356c979..d57e66845c86 100644
--- a/arch/arm64/include/asm/pgtable-hwdef.h
+++ b/arch/arm64/include/asm/pgtable-hwdef.h
@@ -122,5 +122,6 @@
 #define TCR_TG1_64K             (UL(1) << 30)
 #define TCR_IPS_40BIT           (UL(2) << 32)
 #define TCR_ASID16              (UL(1) << 36)
+#define TCR_TBI0                (UL(1) << 37)
 
 #endif
diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h
index 46b3beb4b773..717031a762c2 100644
--- a/arch/arm64/include/asm/tlb.h
+++ b/arch/arm64/include/asm/tlb.h
@@ -35,6 +35,7 @@ struct mmu_gather {
         struct mm_struct        *mm;
         unsigned int            fullmm;
         struct vm_area_struct   *vma;
+        unsigned long           start, end;
         unsigned long           range_start;
         unsigned long           range_end;
         unsigned int            nr;
@@ -97,10 +98,12 @@ static inline void tlb_flush_mmu(struct mmu_gather *tlb)
 }
 
 static inline void
-tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned int fullmm)
+tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
 {
         tlb->mm = mm;
-        tlb->fullmm = fullmm;
+        tlb->fullmm = !(start | (end+1));
+        tlb->start = start;
+        tlb->end = end;
         tlb->vma = NULL;
         tlb->max = ARRAY_SIZE(tlb->local);
         tlb->pages = tlb->local;
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 6ad781b21c08..3881fd115ebb 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -423,6 +423,7 @@ el0_da:
          * Data abort handling
          */
         mrs     x0, far_el1
+        bic     x0, x0, #(0xff << 56)
         disable_step x1
         isb
         enable_dbg
@@ -476,6 +477,8 @@ el0_undef:
          * Undefined instruction
          */
         mov     x0, sp
+        // enable interrupts before calling the main handler
+        enable_irq
         b       do_undefinstr
 el0_dbg:
         /*
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index e8b8357aedb4..1f2e4d5a5c0f 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -21,6 +21,7 @@
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/signal.h>
+#include <linux/hardirq.h>
 
 #include <asm/fpsimd.h>
 #include <asm/cputype.h>
@@ -83,6 +84,33 @@ void fpsimd_flush_thread(void)
         fpsimd_load_state(&current->thread.fpsimd_state);
 }
 
+#ifdef CONFIG_KERNEL_MODE_NEON
+
+/*
+ * Kernel-side NEON support functions
+ */
+void kernel_neon_begin(void)
+{
+        /* Avoid using the NEON in interrupt context */
+        BUG_ON(in_interrupt());
+        preempt_disable();
+
+        if (current->mm)
+                fpsimd_save_state(&current->thread.fpsimd_state);
+}
+EXPORT_SYMBOL(kernel_neon_begin);
+
+void kernel_neon_end(void)
+{
+        if (current->mm)
+                fpsimd_load_state(&current->thread.fpsimd_state);
+
+        preempt_enable();
+}
+EXPORT_SYMBOL(kernel_neon_end);
+
+#endif /* CONFIG_KERNEL_MODE_NEON */
+
 /*
  * FP/SIMD support code initialisation.
  */
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 53dcae49e729..7090c126797c 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -112,6 +112,14 @@
         .quad   TEXT_OFFSET                     // Image load offset from start of RAM
         .quad   0                               // reserved
         .quad   0                               // reserved
+        .quad   0                               // reserved
+        .quad   0                               // reserved
+        .quad   0                               // reserved
+        .byte   0x41                            // Magic number, "ARM\x64"
+        .byte   0x52
+        .byte   0x4d
+        .byte   0x64
+        .word   0                               // reserved
 
 ENTRY(stext)
         mov     x21, x0                         // x21=FDT
diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
index 9ba33c40cdf8..cea1594ff933 100644
--- a/arch/arm64/kernel/perf_event.c
+++ b/arch/arm64/kernel/perf_event.c
@@ -107,7 +107,12 @@ armpmu_map_cache_event(const unsigned (*cache_map)
 static int
 armpmu_map_event(const unsigned (*event_map)[PERF_COUNT_HW_MAX], u64 config)
 {
-        int mapping = (*event_map)[config];
+        int mapping;
+
+        if (config >= PERF_COUNT_HW_MAX)
+                return -EINVAL;
+
+        mapping = (*event_map)[config];
         return mapping == HW_OP_UNSUPPORTED ? -ENOENT : mapping;
 }
 
@@ -317,7 +322,13 @@ validate_event(struct pmu_hw_events *hw_events,
         struct hw_perf_event fake_event = event->hw;
         struct pmu *leader_pmu = event->group_leader->pmu;
 
-        if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF)
+        if (is_software_event(event))
+                return 1;
+
+        if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF)
+                return 1;
+
+        if (event->state == PERF_EVENT_STATE_OFF && !event->attr.enable_on_exec)
                 return 1;
 
         return armpmu->get_event_idx(hw_events, &fake_event) >= 0;
@@ -773,7 +784,7 @@ static const unsigned armv8_pmuv3_perf_cache_map[PERF_COUNT_HW_CACHE_MAX]
 /*
  * PMXEVTYPER: Event selection reg
  */
-#define ARMV8_EVTYPE_MASK       0xc00000ff      /* Mask for writable bits */
+#define ARMV8_EVTYPE_MASK       0xc80000ff      /* Mask for writable bits */
 #define ARMV8_EVTYPE_EVENT      0xff            /* Mask for EVENT bits */
 
 /*
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index add6ea616843..bca4c1c2052a 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -328,9 +328,6 @@ static int c_show(struct seq_file *m, void *v)
 #ifdef CONFIG_SMP
                 seq_printf(m, "processor\t: %d\n", i);
 #endif
-                seq_printf(m, "BogoMIPS\t: %lu.%02lu\n\n",
-                           loops_per_jiffy / (500000UL/HZ),
-                           loops_per_jiffy / (5000UL/HZ) % 100);
         }
 
         /* dump out the processor features */
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index fee5cce83450..78db90dcc910 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -223,11 +223,7 @@ asmlinkage void secondary_start_kernel(void)
 
 void __init smp_cpus_done(unsigned int max_cpus)
 {
-        unsigned long bogosum = loops_per_jiffy * num_online_cpus();
-
-        pr_info("SMP: Total of %d processors activated (%lu.%02lu BogoMIPS).\n",
-                num_online_cpus(), bogosum / (500000/HZ),
-                (bogosum / (5000/HZ)) % 100);
+        pr_info("SMP: Total of %d processors activated.\n", num_online_cpus());
 }
 
 void __init smp_prepare_boot_cpu(void)
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index f5e55747242f..f8ab9d8e2ea3 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -71,6 +71,7 @@ SECTIONS
 
         RO_DATA(PAGE_SIZE)
         EXCEPTION_TABLE(8)
+        NOTES
         _etext = .;                     /* End of text and rodata section */
 
         . = ALIGN(PAGE_SIZE);
@@ -122,8 +123,6 @@ SECTIONS
         }
         _edata_loc = __data_loc + SIZEOF(.data);
 
-        NOTES
-
         BSS_SECTION(0, 0, 0)
         _end = .;
 
diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S
index ff985e3d8b72..1ac0bbbdddb2 100644
--- a/arch/arm64/kvm/hyp.S
+++ b/arch/arm64/kvm/hyp.S
@@ -214,6 +214,7 @@ __kvm_hyp_code_start:
         mrs     x21,    tpidr_el1
         mrs     x22,    amair_el1
         mrs     x23,    cntkctl_el1
+        mrs     x24,    par_el1
 
         stp     x4, x5, [x3]
         stp     x6, x7, [x3, #16]
@@ -225,6 +226,7 @@ __kvm_hyp_code_start:
         stp     x18, x19, [x3, #112]
         stp     x20, x21, [x3, #128]
         stp     x22, x23, [x3, #144]
+        str     x24, [x3, #160]
 .endm
 
 .macro restore_sysregs
@@ -243,6 +245,7 @@ __kvm_hyp_code_start:
         ldp     x18, x19, [x3, #112]
         ldp     x20, x21, [x3, #128]
         ldp     x22, x23, [x3, #144]
+        ldr     x24, [x3, #160]
 
         msr     vmpidr_el2,     x4
         msr     csselr_el1,     x5
@@ -264,6 +267,7 @@ __kvm_hyp_code_start:
         msr     tpidr_el1,      x21
         msr     amair_el1,      x22
         msr     cntkctl_el1,    x23
+        msr     par_el1,        x24
 .endm
 
 .macro skip_32bit_state tmp, target
@@ -600,6 +604,8 @@ END(__kvm_vcpu_run)
 
 // void __kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa);
 ENTRY(__kvm_tlb_flush_vmid_ipa)
+        dsb     ishst
+
         kern_hyp_va     x0
         ldr     x2, [x0, #KVM_VTTBR]
         msr     vttbr_el2, x2
@@ -621,6 +627,7 @@ ENTRY(__kvm_tlb_flush_vmid_ipa)
 ENDPROC(__kvm_tlb_flush_vmid_ipa)
 
 ENTRY(__kvm_flush_vm_context)
+        dsb     ishst
         tlbi    alle1is
         ic      ialluis
         dsb     sy
@@ -753,6 +760,10 @@ el1_trap:
          */
         tbnz    x1, #7, 1f      // S1PTW is set
 
+        /* Preserve PAR_EL1 */
+        mrs     x3, par_el1
+        push    x3, xzr
+
         /*
          * Permission fault, HPFAR_EL2 is invalid.
          * Resolve the IPA the hard way using the guest VA.
@@ -766,6 +777,8 @@ el1_trap:
 
         /* Read result */
         mrs     x3, par_el1
+        pop     x0, xzr                 // Restore PAR_EL1 from the stack
+        msr     par_el1, x0
         tbnz    x3, #0, 3f              // Bail out if we failed the translation
         ubfx    x3, x3, #12, #36        // Extract IPA
         lsl     x3, x3, #4              // and present it like HPFAR
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 94923609753b..02e9d09e1d80 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -211,6 +211,9 @@ static const struct sys_reg_desc sys_reg_descs[] = {
         /* FAR_EL1 */
         { Op0(0b11), Op1(0b000), CRn(0b0110), CRm(0b0000), Op2(0b000),
           NULL, reset_unknown, FAR_EL1 },
+        /* PAR_EL1 */
+        { Op0(0b11), Op1(0b000), CRn(0b0111), CRm(0b0100), Op2(0b000),
+          NULL, reset_unknown, PAR_EL1 },
 
         /* PMINTENSET_EL1 */
         { Op0(0b11), Op1(0b000), CRn(0b1001), CRm(0b1110), Op2(0b001),
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index a8d1059b91b2..f557ebbe7013 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -296,6 +296,7 @@ void __iomem * __init early_io_map(phys_addr_t phys, unsigned long virt)
 static void __init map_mem(void)
 {
         struct memblock_region *reg;
+        phys_addr_t limit;
 
         /*
          * Temporarily limit the memblock range. We need to do this as
@@ -303,9 +304,11 @@ static void __init map_mem(void)
          * memory addressable from the initial direct kernel mapping.
          *
          * The initial direct kernel mapping, located at swapper_pg_dir,
-         * gives us PGDIR_SIZE memory starting from PHYS_OFFSET (aligned).
+         * gives us PGDIR_SIZE memory starting from PHYS_OFFSET (which must be
+         * aligned to 2MB as per Documentation/arm64/booting.txt).
          */
-        memblock_set_current_limit((PHYS_OFFSET & PGDIR_MASK) + PGDIR_SIZE);
+        limit = PHYS_OFFSET + PGDIR_SIZE;
+        memblock_set_current_limit(limit);
 
         /* map all the memory banks */
         for_each_memblock(memory, reg) {
@@ -315,6 +318,22 @@ static void __init map_mem(void)
                 if (start >= end)
                         break;
 
+#ifndef CONFIG_ARM64_64K_PAGES
+                /*
+                 * For the first memory bank align the start address and
+                 * current memblock limit to prevent create_mapping() from
+                 * allocating pte page tables from unmapped memory.
+                 * When 64K pages are enabled, the pte page table for the
+                 * first PGDIR_SIZE is already present in swapper_pg_dir.
+                 */
+                if (start < limit)
+                        start = ALIGN(start, PMD_SIZE);
+                if (end < limit) {
+                        limit = end & PMD_MASK;
+                        memblock_set_current_limit(limit);
+                }
+#endif
+
                 create_mapping(start, __phys_to_virt(start), end - start);
         }
 
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index a82ae8868077..b1b31bbc967b 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -95,10 +95,6 @@ ENTRY(cpu_do_switch_mm)
         ret
 ENDPROC(cpu_do_switch_mm)
 
-cpu_name:
-        .ascii  "AArch64 Processor"
-        .align
-
         .section ".text.init", #alloc, #execinstr
 
 /*
@@ -151,7 +147,7 @@ ENTRY(__cpu_setup)
          * both user and kernel.
          */
         ldr     x10, =TCR_TxSZ(VA_BITS) | TCR_FLAGS | TCR_IPS_40BIT | \
-                      TCR_ASID16 | (1 << 31)
+                      TCR_ASID16 | TCR_TBI0 | (1 << 31)
 #ifdef CONFIG_ARM64_64K_PAGES
         orr     x10, x10, TCR_TG0_64K
         orr     x10, x10, TCR_TG1_64K
diff --git a/arch/avr32/boards/atngw100/mrmt.c b/arch/avr32/boards/atngw100/mrmt.c
index f91431963452..7de083d19b7e 100644
--- a/arch/avr32/boards/atngw100/mrmt.c
+++ b/arch/avr32/boards/atngw100/mrmt.c
@@ -150,7 +150,6 @@ static struct ac97c_platform_data __initdata ac97c0_data = {
 static struct platform_device rmt_ts_device = {
         .name   = "ucb1400_ts",
         .id     = -1,
-        }
 };
 #endif
 
diff --git a/arch/avr32/oprofile/op_model_avr32.c b/arch/avr32/oprofile/op_model_avr32.c
index f74b7809e089..08308be2c02c 100644
--- a/arch/avr32/oprofile/op_model_avr32.c
+++ b/arch/avr32/oprofile/op_model_avr32.c
@@ -97,8 +97,7 @@ static irqreturn_t avr32_perf_counter_interrupt(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
-static int avr32_perf_counter_create_files(struct super_block *sb,
-                struct dentry *root)
+static int avr32_perf_counter_create_files(struct dentry *root)
 {
         struct dentry *dir;
         unsigned int i;
@@ -106,21 +105,21 @@ static int avr32_perf_counter_create_files(struct super_block *sb,
 
         for (i = 0; i < NR_counter; i++) {
                 snprintf(filename, sizeof(filename), "%u", i);
-                dir = oprofilefs_mkdir(sb, root, filename);
+                dir = oprofilefs_mkdir(root, filename);
 
-                oprofilefs_create_ulong(sb, dir, "enabled",
+                oprofilefs_create_ulong(dir, "enabled",
                                 &counter[i].enabled);
-                oprofilefs_create_ulong(sb, dir, "event",
+                oprofilefs_create_ulong(dir, "event",
                                 &counter[i].event);
-                oprofilefs_create_ulong(sb, dir, "count",
+                oprofilefs_create_ulong(dir, "count",
                                 &counter[i].count);
 
                 /* Dummy entries */
-                oprofilefs_create_ulong(sb, dir, "kernel",
+                oprofilefs_create_ulong(dir, "kernel",
                                 &counter[i].kernel);
-                oprofilefs_create_ulong(sb, dir, "user",
+                oprofilefs_create_ulong(dir, "user",
                                 &counter[i].user);
-                oprofilefs_create_ulong(sb, dir, "unit_mask",
+                oprofilefs_create_ulong(dir, "unit_mask",
                                 &counter[i].unit_mask);
         }
 
diff --git a/arch/frv/mb93090-mb00/pci-vdk.c b/arch/frv/mb93090-mb00/pci-vdk.c
index 0aa35f0eb0db..deb67843693c 100644
--- a/arch/frv/mb93090-mb00/pci-vdk.c
+++ b/arch/frv/mb93090-mb00/pci-vdk.c
@@ -320,7 +320,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, pci_fixup_ide_bases);
  *  are examined.
  */
 
-void __init pcibios_fixup_bus(struct pci_bus *bus)
+void pcibios_fixup_bus(struct pci_bus *bus)
 {
 #if 0
         printk("### PCIBIOS_FIXUP_BUS(%d)\n",bus->number);
diff --git a/arch/hexagon/Kconfig b/arch/hexagon/Kconfig
index 33a97929d055..77d442ab28c8 100644
--- a/arch/hexagon/Kconfig
+++ b/arch/hexagon/Kconfig
@@ -158,6 +158,7 @@ source "kernel/Kconfig.hz"
 endmenu
 
 source "init/Kconfig"
+source "kernel/Kconfig.freezer"
 source "drivers/Kconfig"
 source "fs/Kconfig"
 
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 5a768ad8e893..566642266324 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -43,6 +43,7 @@ config IA64
         select SYSCTL_ARCH_UNALIGN_NO_WARN
         select HAVE_MOD_ARCH_SPECIFIC
         select MODULES_USE_ELF_RELA
+        select ARCH_USE_CMPXCHG_LOCKREF
         default y
         help
           The Itanium Processor Family is Intel's 64-bit successor to
@@ -565,9 +566,9 @@ config KEXEC
 
           It is an ongoing process to be certain the hardware in a machine
           is properly shutdown, so do not be surprised if this code does not
-          initially work for you.  It may help to enable device hotplugging
-          support.  As of this writing the exact hardware interface is
-          strongly in flux, so no good recommendation can be made.
+          initially work for you.  As of this writing the exact hardware
+          interface is strongly in flux, so no good recommendation can be
+          made.
 
 config CRASH_DUMP
           bool "kernel crash dumps"
diff --git a/arch/ia64/include/asm/Kbuild b/arch/ia64/include/asm/Kbuild
index 05b03ecd7933..a3456f34f672 100644
--- a/arch/ia64/include/asm/Kbuild
+++ b/arch/ia64/include/asm/Kbuild
@@ -3,3 +3,4 @@ generic-y += clkdev.h
 generic-y += exec.h
 generic-y += kvm_para.h
 generic-y += trace_clock.h
+generic-y += vtime.h
\ No newline at end of file
diff --git a/arch/ia64/include/asm/bitops.h b/arch/ia64/include/asm/bitops.h
index 8e20bff39f79..c27eccd33349 100644
--- a/arch/ia64/include/asm/bitops.h
+++ b/arch/ia64/include/asm/bitops.h
@@ -425,13 +425,7 @@ __fls (unsigned long x)
 
 #include <asm-generic/bitops/fls64.h>
 
-/*
- * ffs: find first bit set. This is defined the same way as the libc and
- * compiler builtin ffs routines, therefore differs in spirit from the above
- * ffz (man ffs): it operates on "int" values only and the result value is the
- * bit number + 1.  ffs(0) is defined to return zero.
- */
-#define ffs(x)  __builtin_ffs(x)
+#include <asm-generic/bitops/builtin-ffs.h>
 
 /*
  * hweightN: returns the hamming weight (i.e. the number
diff --git a/arch/ia64/include/asm/dmi.h b/arch/ia64/include/asm/dmi.h
index 1ed4c8fedb83..185d3d18d0ec 100644
--- a/arch/ia64/include/asm/dmi.h
+++ b/arch/ia64/include/asm/dmi.h
@@ -7,6 +7,6 @@
 /* Use normal IO mappings for DMI */
 #define dmi_ioremap ioremap
 #define dmi_iounmap(x,l) iounmap(x)
-#define dmi_alloc(l) kmalloc(l, GFP_ATOMIC)
+#define dmi_alloc(l) kzalloc(l, GFP_ATOMIC)
 
 #endif
diff --git a/arch/ia64/include/asm/spinlock.h b/arch/ia64/include/asm/spinlock.h
index 54ff557d474e..45698cd15b7b 100644
--- a/arch/ia64/include/asm/spinlock.h
+++ b/arch/ia64/include/asm/spinlock.h
@@ -102,6 +102,11 @@ static inline int __ticket_spin_is_contended(arch_spinlock_t *lock)
         return ((tmp - (tmp >> TICKET_SHIFT)) & TICKET_MASK) > 1;
 }
 
+static __always_inline int arch_spin_value_unlocked(arch_spinlock_t lock)
+{
+        return !(((lock.lock >> TICKET_SHIFT) ^ lock.lock) & TICKET_MASK);
+}
+
 static inline int arch_spin_is_locked(arch_spinlock_t *lock)
 {
         return __ticket_spin_is_locked(lock);
diff --git a/arch/ia64/include/asm/tlb.h b/arch/ia64/include/asm/tlb.h
index ef3a9de01954..bc5efc7c3f3f 100644
--- a/arch/ia64/include/asm/tlb.h
+++ b/arch/ia64/include/asm/tlb.h
@@ -22,7 +22,7 @@
  * unmapping a portion of the virtual address space, these hooks are called according to
  * the following template:
  *
- *      tlb <- tlb_gather_mmu(mm, full_mm_flush);       // start unmap for address space MM
+ *      tlb <- tlb_gather_mmu(mm, start, end);          // start unmap for address space MM
  *      {
  *        for each vma that needs a shootdown do {
  *          tlb_start_vma(tlb, vma);
@@ -58,6 +58,7 @@ struct mmu_gather {
         unsigned int            max;
         unsigned char           fullmm;         /* non-zero means full mm flush */
         unsigned char           need_flush;     /* really unmapped some PTEs? */
+        unsigned long           start, end;
         unsigned long           start_addr;
         unsigned long           end_addr;
         struct page             **pages;
@@ -155,13 +156,15 @@ static inline void __tlb_alloc_page(struct mmu_gather *tlb)
 
 
 static inline void
-tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned int full_mm_flush)
+tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
 {
         tlb->mm = mm;
         tlb->max = ARRAY_SIZE(tlb->local);
         tlb->pages = tlb->local;
         tlb->nr = 0;
-        tlb->fullmm = full_mm_flush;
+        tlb->fullmm = !(start | (end+1));
+        tlb->start = start;
+        tlb->end = end;
         tlb->start_addr = ~0UL;
 }
 
diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
index 5b2dc0d10c8f..bdfd8789b376 100644
--- a/arch/ia64/kvm/kvm-ia64.c
+++ b/arch/ia64/kvm/kvm-ia64.c
@@ -1560,6 +1560,10 @@ int kvm_arch_create_memslot(struct kvm_memory_slot *slot, unsigned long npages)
         return 0;
 }
 
+void kvm_arch_memslots_updated(struct kvm *kvm)
+{
+}
+
 int kvm_arch_prepare_memory_region(struct kvm *kvm,
                 struct kvm_memory_slot *memslot,
                 struct kvm_userspace_memory_region *mem,
diff --git a/arch/m68k/amiga/platform.c b/arch/m68k/amiga/platform.c
index 6083088c0cca..dacd9f911f71 100644
--- a/arch/m68k/amiga/platform.c
+++ b/arch/m68k/amiga/platform.c
@@ -56,7 +56,7 @@ static int __init amiga_init_bus(void)
         n = AMIGAHW_PRESENT(ZORRO3) ? 4 : 2;
         pdev = platform_device_register_simple("amiga-zorro", -1,
                                                zorro_resources, n);
-        return PTR_RET(pdev);
+        return PTR_ERR_OR_ZERO(pdev);
 }
 
 subsys_initcall(amiga_init_bus);
diff --git a/arch/m68k/emu/natfeat.c b/arch/m68k/emu/natfeat.c
index 2291a7d69d49..121a6660ad4e 100644
--- a/arch/m68k/emu/natfeat.c
+++ b/arch/m68k/emu/natfeat.c
@@ -18,9 +18,11 @@
 #include <asm/machdep.h>
 #include <asm/natfeat.h>
 
+extern long nf_get_id_phys(unsigned long feature_name);
+
 asm("\n"
-"       .global nf_get_id,nf_call\n"
-"nf_get_id:\n"
+"       .global nf_get_id_phys,nf_call\n"
+"nf_get_id_phys:\n"
 "       .short  0x7300\n"
 "       rts\n"
 "nf_call:\n"
@@ -29,12 +31,25 @@ asm("\n"
 "1:     moveq.l #0,%d0\n"
 "       rts\n"
 "       .section __ex_table,\"a\"\n"
-"       .long   nf_get_id,1b\n"
+"       .long   nf_get_id_phys,1b\n"
 "       .long   nf_call,1b\n"
 "       .previous");
-EXPORT_SYMBOL_GPL(nf_get_id);
 EXPORT_SYMBOL_GPL(nf_call);
 
+long nf_get_id(const char *feature_name)
+{
+        /* feature_name may be in vmalloc()ed memory, so make a copy */
+        char name_copy[32];
+        size_t n;
+
+        n = strlcpy(name_copy, feature_name, sizeof(name_copy));
+        if (n >= sizeof(name_copy))
+                return 0;
+
+        return nf_get_id_phys(virt_to_phys(name_copy));
+}
+EXPORT_SYMBOL_GPL(nf_get_id);
+
 void nfprint(const char *fmt, ...)
 {
         static char buf[256];
@@ -43,7 +58,7 @@ void nfprint(const char *fmt, ...)
 
         va_start(ap, fmt);
         n = vsnprintf(buf, 256, fmt, ap);
-        nf_call(nf_get_id("NF_STDERR"), buf);
+        nf_call(nf_get_id("NF_STDERR"), virt_to_phys(buf));
         va_end(ap);
 }
 
@@ -68,7 +83,7 @@ void nf_init(void)
         id = nf_get_id("NF_NAME");
         if (!id)
                 return;
-        nf_call(id, buf, 256);
+        nf_call(id, virt_to_phys(buf), 256);
         buf[255] = 0;
 
         pr_info("NatFeats found (%s, %lu.%lu)\n", buf, version >> 16,
diff --git a/arch/m68k/emu/nfblock.c b/arch/m68k/emu/nfblock.c
index e3011338ab40..0721858fbd1e 100644
--- a/arch/m68k/emu/nfblock.c
+++ b/arch/m68k/emu/nfblock.c
@@ -41,8 +41,8 @@ static inline s32 nfhd_read_write(u32 major, u32 minor, u32 rwflag, u32 recno,
 static inline s32 nfhd_get_capacity(u32 major, u32 minor, u32 *blocks,
                                     u32 *blocksize)
 {
-        return nf_call(nfhd_id + NFHD_GET_CAPACITY, major, minor, blocks,
-                       blocksize);
+        return nf_call(nfhd_id + NFHD_GET_CAPACITY, major, minor,
+                       virt_to_phys(blocks), virt_to_phys(blocksize));
 }
 
 static LIST_HEAD(nfhd_list);
diff --git a/arch/m68k/emu/nfcon.c b/arch/m68k/emu/nfcon.c
index 6685bf45c2c3..57e8c8fb5eba 100644
--- a/arch/m68k/emu/nfcon.c
+++ b/arch/m68k/emu/nfcon.c
@@ -15,6 +15,7 @@
 #include <linux/slab.h>
 #include <linux/err.h>
 #include <linux/uaccess.h>
+#include <linux/io.h>
 
 #include <asm/natfeat.h>
 
@@ -25,17 +26,18 @@ static struct tty_driver *nfcon_tty_driver;
 static void nfputs(const char *str, unsigned int count)
 {
         char buf[68];
+        unsigned long phys = virt_to_phys(buf);
 
         buf[64] = 0;
         while (count > 64) {
                 memcpy(buf, str, 64);
-                nf_call(stderr_id, buf);
+                nf_call(stderr_id, phys);
                 str += 64;
                 count -= 64;
         }
         memcpy(buf, str, count);
         buf[count] = 0;
-        nf_call(stderr_id, buf);
+        nf_call(stderr_id, phys);
 }
 
 static void nfcon_write(struct console *con, const char *str,
@@ -79,7 +81,7 @@ static int nfcon_tty_put_char(struct tty_struct *tty, unsigned char ch)
 {
         char temp[2] = { ch, 0 };
 
-        nf_call(stderr_id, temp);
+        nf_call(stderr_id, virt_to_phys(temp));
         return 1;
 }
 
diff --git a/arch/m68k/emu/nfeth.c b/arch/m68k/emu/nfeth.c
index 695cd737a42e..a0985fd088d1 100644
--- a/arch/m68k/emu/nfeth.c
+++ b/arch/m68k/emu/nfeth.c
@@ -195,7 +195,8 @@ static struct net_device * __init nfeth_probe(int unit)
         char mac[ETH_ALEN], host_ip[32], local_ip[32];
         int err;
 
-        if (!nf_call(nfEtherID + XIF_GET_MAC, unit, mac, ETH_ALEN))
+        if (!nf_call(nfEtherID + XIF_GET_MAC, unit, virt_to_phys(mac),
+                     ETH_ALEN))
                 return NULL;
 
         dev = alloc_etherdev(sizeof(struct nfeth_private));
@@ -217,9 +218,9 @@ static struct net_device * __init nfeth_probe(int unit)
         }
 
         nf_call(nfEtherID + XIF_GET_IPHOST, unit,
-                host_ip, sizeof(host_ip));
+                virt_to_phys(host_ip), sizeof(host_ip));
         nf_call(nfEtherID + XIF_GET_IPATARI, unit,
-                local_ip, sizeof(local_ip));
+                virt_to_phys(local_ip), sizeof(local_ip));
 
         netdev_info(dev, KBUILD_MODNAME " addr:%s (%s) HWaddr:%pM\n", host_ip,
                     local_ip, mac);
diff --git a/arch/m68k/include/asm/div64.h b/arch/m68k/include/asm/div64.h
index 444ea8a09e9f..ef881cfbbca9 100644
--- a/arch/m68k/include/asm/div64.h
+++ b/arch/m68k/include/asm/div64.h
@@ -15,16 +15,17 @@
                 unsigned long long n64;                         \
         } __n;                                                  \
         unsigned long __rem, __upper;                           \
+        unsigned long __base = (base);                          \
                                                                 \
         __n.n64 = (n);                                          \
         if ((__upper = __n.n32[0])) {                           \
                 asm ("divul.l %2,%1:%0"                         \
-                        : "=d" (__n.n32[0]), "=d" (__upper)     \
-                        : "d" (base), "0" (__n.n32[0]));        \
+                     : "=d" (__n.n32[0]), "=d" (__upper)        \
+                     : "d" (__base), "0" (__n.n32[0]));         \
         }                                                       \
         asm ("divu.l %2,%1:%0"                                  \
-                : "=d" (__n.n32[1]), "=d" (__rem)               \
-                : "d" (base), "1" (__upper), "0" (__n.n32[1])); \
+             : "=d" (__n.n32[1]), "=d" (__rem)                  \
+             : "d" (__base), "1" (__upper), "0" (__n.n32[1]));  \
         (n) = __n.n64;                                          \
         __rem;                                                  \
 })
diff --git a/arch/m68k/include/asm/irqflags.h b/arch/m68k/include/asm/irqflags.h
index 7ef4115b8c4a..a823cd73dc09 100644
--- a/arch/m68k/include/asm/irqflags.h
+++ b/arch/m68k/include/asm/irqflags.h
@@ -3,7 +3,7 @@
 
 #include <linux/types.h>
 #ifdef CONFIG_MMU
-#include <linux/hardirq.h>
+#include <linux/preempt_mask.h>
 #endif
 #include <linux/preempt.h>
 #include <asm/thread_info.h>
@@ -67,6 +67,10 @@ static inline void arch_local_irq_restore(unsigned long flags)
 
 static inline bool arch_irqs_disabled_flags(unsigned long flags)
 {
+        if (MACH_IS_ATARI) {
+                /* Ignore HSYNC = ipl 2 on Atari */
+                return (flags & ~(ALLOWINT | 0x200)) != 0;
+        }
         return (flags & ~ALLOWINT) != 0;
 }
 
diff --git a/arch/m68k/kernel/time.c b/arch/m68k/kernel/time.c
index bea6bcf8f9b8..7eb9792009f8 100644
--- a/arch/m68k/kernel/time.c
+++ b/arch/m68k/kernel/time.c
@@ -90,7 +90,7 @@ static int __init rtc_init(void)
                 return -ENODEV;
 
         pdev = platform_device_register_simple("rtc-generic", -1, NULL, 0);
-        return PTR_RET(pdev);
+        return PTR_ERR_OR_ZERO(pdev);
 }
 
 module_init(rtc_init);
diff --git a/arch/m68k/platform/coldfire/pci.c b/arch/m68k/platform/coldfire/pci.c
index b33f97a13e6d..df9679238b6d 100644
--- a/arch/m68k/platform/coldfire/pci.c
+++ b/arch/m68k/platform/coldfire/pci.c
@@ -319,7 +319,6 @@ static int __init mcf_pci_init(void)
         pci_fixup_irqs(pci_common_swizzle, mcf_pci_map_irq);
         pci_bus_size_bridges(rootbus);
         pci_bus_assign_resources(rootbus);
-        pci_enable_bridges(rootbus);
         return 0;
 }
 
diff --git a/arch/m68k/q40/config.c b/arch/m68k/q40/config.c
index 658542b914fc..078bb744b5fe 100644
--- a/arch/m68k/q40/config.c
+++ b/arch/m68k/q40/config.c
@@ -338,6 +338,6 @@ static __init int q40_add_kbd_device(void)
                 return -ENODEV;
 
         pdev = platform_device_register_simple("q40kbd", -1, NULL, 0);
-        return PTR_RET(pdev);
+        return PTR_ERR_OR_ZERO(pdev);
 }
 arch_initcall(q40_add_kbd_device);
diff --git a/arch/microblaze/Kconfig b/arch/microblaze/Kconfig
index d22a4ecffff4..3f6659cbc969 100644
--- a/arch/microblaze/Kconfig
+++ b/arch/microblaze/Kconfig
@@ -28,7 +28,8 @@ config MICROBLAZE
         select GENERIC_CLOCKEVENTS
         select GENERIC_IDLE_POLL_SETUP
         select MODULES_USE_ELF_RELA
-        select CLONE_BACKWARDS
+        select CLONE_BACKWARDS3
+        select CLKSRC_OF
 
 config SWAP
         def_bool n
diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
index 0a603d3ecf24..40350a3c24e9 100644
--- a/arch/microblaze/Makefile
+++ b/arch/microblaze/Makefile
@@ -72,7 +72,7 @@ all: linux.bin
 archclean:
         $(Q)$(MAKE) $(clean)=$(boot)
 
-linux.bin linux.bin.gz: vmlinux
+linux.bin linux.bin.gz linux.bin.ub: vmlinux
         $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
 
 simpleImage.%: vmlinux
@@ -81,6 +81,7 @@ simpleImage.%: vmlinux
 define archhelp
   echo '* linux.bin    - Create raw binary'
   echo '  linux.bin.gz - Create compressed raw binary'
+  echo '  linux.bin.ub - Create U-Boot wrapped raw binary'
   echo '  simpleImage.<dt> - ELF image with $(arch)/boot/dts/<dt>.dts linked in'
   echo '                   - stripped elf with fdt blob'
   echo '  simpleImage.<dt>.unstrip - full ELF image with fdt blob'
diff --git a/arch/microblaze/boot/Makefile b/arch/microblaze/boot/Makefile
index 80fe54fb7ca3..8e211cc28dac 100644
--- a/arch/microblaze/boot/Makefile
+++ b/arch/microblaze/boot/Makefile
@@ -2,12 +2,15 @@
 # arch/microblaze/boot/Makefile
 #
 
-targets := linux.bin linux.bin.gz simpleImage.%
+targets := linux.bin linux.bin.gz linux.bin.ub simpleImage.%
 
 OBJCOPYFLAGS := -R .note -R .comment -R .note.gnu.build-id -O binary
 
 $(obj)/linux.bin: vmlinux FORCE
         $(call if_changed,objcopy)
+        @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+$(obj)/linux.bin.ub: $(obj)/linux.bin FORCE
         $(call if_changed,uimage)
         @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
 
@@ -22,8 +25,6 @@ quiet_cmd_strip = STRIP   $@
         cmd_strip = $(STRIP) -K microblaze_start -K _end -K __log_buf \
                                 -K _fdt_start vmlinux -o $@
 
-UIMAGE_IN = $@
-UIMAGE_OUT = $@.ub
 UIMAGE_LOADADDR = $(CONFIG_KERNEL_BASE_ADDR)
 
 $(obj)/simpleImage.%: vmlinux FORCE
diff --git a/arch/microblaze/include/asm/prom.h b/arch/microblaze/include/asm/prom.h
index 20c5e8e5121b..9977816c5ad3 100644
--- a/arch/microblaze/include/asm/prom.h
+++ b/arch/microblaze/include/asm/prom.h
@@ -50,9 +50,6 @@ void of_parse_dma_window(struct device_node *dn, const void *dma_window_prop,
 
 extern void kdump_move_device_tree(void);
 
-/* CPU OF node matching */
-struct device_node *of_get_cpu_node(int cpu, unsigned int *thread);
-
 #endif /* __ASSEMBLY__ */
 #endif /* __KERNEL__ */
 
diff --git a/arch/microblaze/include/asm/selfmod.h b/arch/microblaze/include/asm/selfmod.h
deleted file mode 100644
index c42aff2e6cd0..000000000000
--- a/arch/microblaze/include/asm/selfmod.h
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright (C) 2007-2008 Michal Simek <monstr@monstr.eu>
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License. See the file "COPYING" in the main directory of this archive
- * for more details.
- */
-
-#ifndef _ASM_MICROBLAZE_SELFMOD_H
-#define _ASM_MICROBLAZE_SELFMOD_H
-
-/*
- * BARRIER_BASE_ADDR is constant address for selfmod function.
- * do not change this value - selfmod function is in
- * arch/microblaze/kernel/selfmod.c: selfmod_function()
- *
- * last 16 bits is used for storing register offset
- */
-
-#define BARRIER_BASE_ADDR       0x1234ff00
-
-void selfmod_function(const int *arr_fce, const unsigned int base);
-
-#endif /* _ASM_MICROBLAZE_SELFMOD_H */
diff --git a/arch/microblaze/kernel/Makefile b/arch/microblaze/kernel/Makefile
index 928c950fc14c..5b0e512c78e5 100644
--- a/arch/microblaze/kernel/Makefile
+++ b/arch/microblaze/kernel/Makefile
@@ -7,7 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
 CFLAGS_REMOVE_timer.o = -pg
 CFLAGS_REMOVE_intc.o = -pg
 CFLAGS_REMOVE_early_printk.o = -pg
-CFLAGS_REMOVE_selfmod.o = -pg
 CFLAGS_REMOVE_heartbeat.o = -pg
 CFLAGS_REMOVE_ftrace.o = -pg
 CFLAGS_REMOVE_process.o = -pg
@@ -23,7 +22,6 @@ obj-y += dma.o exceptions.o \
 obj-y += cpu/
 
 obj-$(CONFIG_EARLY_PRINTK)      += early_printk.o
-obj-$(CONFIG_SELFMOD)           += selfmod.o
 obj-$(CONFIG_HEART_BEAT)        += heartbeat.o
 obj-$(CONFIG_MODULES)           += microblaze_ksyms.o module.o
 obj-$(CONFIG_MMU)               += misc.o
diff --git a/arch/microblaze/kernel/cpu/cpuinfo.c b/arch/microblaze/kernel/cpu/cpuinfo.c
index 410398f6db55..c9203b1007aa 100644
--- a/arch/microblaze/kernel/cpu/cpuinfo.c
+++ b/arch/microblaze/kernel/cpu/cpuinfo.c
@@ -39,6 +39,8 @@ const struct cpu_ver_key cpu_ver_lookup[] = {
         {"8.30.a", 0x17},
         {"8.40.a", 0x18},
         {"8.40.b", 0x19},
+        {"9.0", 0x1b},
+        {"9.1", 0x1d},
         {NULL, 0},
 };
 
diff --git a/arch/microblaze/kernel/intc.c b/arch/microblaze/kernel/intc.c
index d85fa3a2b0f8..581451ad4687 100644
--- a/arch/microblaze/kernel/intc.c
+++ b/arch/microblaze/kernel/intc.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2007-2009 Michal Simek <monstr@monstr.eu>
+ * Copyright (C) 2007-2013 Michal Simek <monstr@monstr.eu>
+ * Copyright (C) 2012-2013 Xilinx, Inc.
  * Copyright (C) 2007-2009 PetaLogix
  * Copyright (C) 2006 Atmark Techno, Inc.
  *
@@ -8,23 +9,15 @@
  * for more details.
  */
 
-#include <linux/init.h>
 #include <linux/irqdomain.h>
 #include <linux/irq.h>
-#include <asm/page.h>
+#include <linux/of_address.h>
 #include <linux/io.h>
 #include <linux/bug.h>
 
-#include <asm/prom.h>
-#include <asm/irq.h>
+#include "../../drivers/irqchip/irqchip.h"
 
-#ifdef CONFIG_SELFMOD_INTC
-#include <asm/selfmod.h>
-#define INTC_BASE       BARRIER_BASE_ADDR
-#else
-static unsigned int intc_baseaddr;
-#define INTC_BASE       intc_baseaddr
-#endif
+static void __iomem *intc_baseaddr;
 
 /* No one else should require these constants, so define them locally here. */
 #define ISR 0x00                        /* Interrupt Status Register */
@@ -50,21 +43,21 @@ static void intc_enable_or_unmask(struct irq_data *d)
          * acks the irq before calling the interrupt handler
          */
         if (irqd_is_level_type(d))
-                out_be32(INTC_BASE + IAR, mask);
+                out_be32(intc_baseaddr + IAR, mask);
 
-        out_be32(INTC_BASE + SIE, mask);
+        out_be32(intc_baseaddr + SIE, mask);
 }
 
 static void intc_disable_or_mask(struct irq_data *d)
 {
         pr_debug("disable: %ld\n", d->hwirq);
-        out_be32(INTC_BASE + CIE, 1 << d->hwirq);
+        out_be32(intc_baseaddr + CIE, 1 << d->hwirq);
 }
 
 static void intc_ack(struct irq_data *d)
 {
         pr_debug("ack: %ld\n", d->hwirq);
-        out_be32(INTC_BASE + IAR, 1 << d->hwirq);
+        out_be32(intc_baseaddr + IAR, 1 << d->hwirq);
 }
 
 static void intc_mask_ack(struct irq_data *d)
@@ -72,8 +65,8 @@ static void intc_mask_ack(struct irq_data *d)
         unsigned long mask = 1 << d->hwirq;
 
         pr_debug("disable_and_ack: %ld\n", d->hwirq);
-        out_be32(INTC_BASE + CIE, mask);
-        out_be32(INTC_BASE + IAR, mask);
+        out_be32(intc_baseaddr + CIE, mask);
+        out_be32(intc_baseaddr + IAR, mask);
 }
 
 static struct irq_chip intc_dev = {
@@ -90,7 +83,7 @@ unsigned int get_irq(void)
 {
         unsigned int hwirq, irq = -1;
 
-        hwirq = in_be32(INTC_BASE + IVR);
+        hwirq = in_be32(intc_baseaddr + IVR);
         if (hwirq != -1U)
                 irq = irq_find_mapping(root_domain, hwirq);
 
@@ -120,40 +113,32 @@ static const struct irq_domain_ops xintc_irq_domain_ops = {
         .map = xintc_map,
 };
 
-void __init init_IRQ(void)
+static int __init xilinx_intc_of_init(struct device_node *intc,
+                                             struct device_node *parent)
 {
         u32 nr_irq, intr_mask;
-        struct device_node *intc = NULL;
-#ifdef CONFIG_SELFMOD_INTC
-        unsigned int intc_baseaddr = 0;
-        static int arr_func[] = {
-                                (int)&get_irq,
-                                (int)&intc_enable_or_unmask,
-                                (int)&intc_disable_or_mask,
-                                (int)&intc_mask_ack,
-                                (int)&intc_ack,
-                                (int)&intc_end,
-                                0
-                        };
-#endif
-        intc = of_find_compatible_node(NULL, NULL, "xlnx,xps-intc-1.00.a");
-        BUG_ON(!intc);
-
-        intc_baseaddr = be32_to_cpup(of_get_property(intc, "reg", NULL));
-        intc_baseaddr = (unsigned long) ioremap(intc_baseaddr, PAGE_SIZE);
-        nr_irq = be32_to_cpup(of_get_property(intc,
-                                                "xlnx,num-intr-inputs", NULL));
-
-        intr_mask =
-                be32_to_cpup(of_get_property(intc, "xlnx,kind-of-intr", NULL));
+        int ret;
+
+        intc_baseaddr = of_iomap(intc, 0);
+        BUG_ON(!intc_baseaddr);
+
+        ret = of_property_read_u32(intc, "xlnx,num-intr-inputs", &nr_irq);
+        if (ret < 0) {
+                pr_err("%s: unable to read xlnx,num-intr-inputs\n", __func__);
+                return -EINVAL;
+        }
+
+        ret = of_property_read_u32(intc, "xlnx,kind-of-intr", &intr_mask);
+        if (ret < 0) {
+                pr_err("%s: unable to read xlnx,kind-of-intr\n", __func__);
+                return -EINVAL;
+        }
+
         if (intr_mask > (u32)((1ULL << nr_irq) - 1))
                 pr_info(" ERROR: Mismatch in kind-of-intr param\n");
 
-#ifdef CONFIG_SELFMOD_INTC
-        selfmod_function((int *) arr_func, intc_baseaddr);
-#endif
-        pr_info("%s #0 at 0x%08x, num_irq=%d, edge=0x%x\n",
-                intc->name, intc_baseaddr, nr_irq, intr_mask);
+        pr_info("%s: num_irq=%d, edge=0x%x\n",
+                intc->full_name, nr_irq, intr_mask);
 
         /*
          * Disable all external interrupts until they are
@@ -174,4 +159,8 @@ void __init init_IRQ(void)
                                                         (void *)intr_mask);
 
         irq_set_default_host(root_domain);
+
+        return 0;
 }
+
+IRQCHIP_DECLARE(xilinx_intc, "xlnx,xps-intc-1.00.a", xilinx_intc_of_init);
diff --git a/arch/microblaze/kernel/irq.c b/arch/microblaze/kernel/irq.c
index ace700afbfdf..11e24de91aa4 100644
--- a/arch/microblaze/kernel/irq.c
+++ b/arch/microblaze/kernel/irq.c
@@ -17,10 +17,8 @@
 #include <linux/seq_file.h>
 #include <linux/kernel_stat.h>
 #include <linux/irq.h>
+#include <linux/irqchip.h>
 #include <linux/of_irq.h>
-#include <linux/export.h>
-
-#include <asm/prom.h>
 
 static u32 concurrent_irq;
 
@@ -47,3 +45,9 @@ next_irq:
         set_irq_regs(old_regs);
         trace_hardirqs_on();
 }
+
+void __init init_IRQ(void)
+{
+        /* process the entire interrupt tree in one go */
+        irqchip_init();
+}
diff --git a/arch/microblaze/kernel/reset.c b/arch/microblaze/kernel/reset.c
index 2e5079ab53d2..fbe58c6554a8 100644
--- a/arch/microblaze/kernel/reset.c
+++ b/arch/microblaze/kernel/reset.c
@@ -67,7 +67,11 @@ static void gpio_system_reset(void)
                 pr_notice("Reset GPIO unavailable - halting!\n");
 }
 #else
-#define gpio_system_reset() do {} while (0)
+static void gpio_system_reset(void)
+{
+        pr_notice("No reset GPIO present - halting!\n");
+}
+
 void of_platform_reset_gpio_probe(void)
 {
         return;
diff --git a/arch/microblaze/kernel/selfmod.c b/arch/microblaze/kernel/selfmod.c
deleted file mode 100644
index 89508bdc9f3c..000000000000
--- a/arch/microblaze/kernel/selfmod.c
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Copyright (C) 2007-2009 Michal Simek <monstr@monstr.eu>
- * Copyright (C) 2009 PetaLogix
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License. See the file "COPYING" in the main directory of this archive
- * for more details.
- */
-
-#include <linux/interrupt.h>
-#include <asm/selfmod.h>
-
-#undef DEBUG
-
-#if __GNUC__ > 3
-#error GCC 4 unsupported SELFMOD. Please disable SELFMOD from menuconfig.
-#endif
-
-#define OPCODE_IMM              0xB0000000
-#define OPCODE_LWI              0xE8000000
-#define OPCODE_LWI_MASK         0xEC000000
-#define OPCODE_RTSD             0xB60F0008 /* return from func: rtsd r15, 8 */
-#define OPCODE_ADDIK            0x30000000
-#define OPCODE_ADDIK_MASK       0xFC000000
-
-#define IMM_BASE        (OPCODE_IMM | (BARRIER_BASE_ADDR >> 16))
-#define LWI_BASE        (OPCODE_LWI | (BARRIER_BASE_ADDR & 0x0000ff00))
-#define LWI_BASE_MASK   (OPCODE_LWI_MASK | (BARRIER_BASE_ADDR & 0x0000ff00))
-#define ADDIK_BASE      (OPCODE_ADDIK | (BARRIER_BASE_ADDR & 0x0000ff00))
-#define ADDIK_BASE_MASK (OPCODE_ADDIK_MASK | (BARRIER_BASE_ADDR & 0x0000ff00))
-
-#define MODIFY_INSTR {                                          \
-        pr_debug("%s: curr instr, (%d):0x%x, next(%d):0x%x\n",          \
-                __func__, i, addr[i], i + 1, addr[i + 1]);              \
-        addr[i] = OPCODE_IMM + (base >> 16);                            \
-        /* keep instruction opcode and add only last 16bits */          \
-        addr[i + 1] = (addr[i + 1] & 0xffff00ff) + (base & 0xffff);     \
-        __invalidate_icache(addr[i]);                                   \
-        __invalidate_icache(addr[i + 1]);                               \
-        pr_debug("%s: hack instr, (%d):0x%x, next(%d):0x%x\n",          \
-                __func__, i, addr[i], i + 1, addr[i + 1]); }
-
-/* NOTE
- * self-modified part of code for improvement of interrupt controller
- * save instruction in interrupt rutine
- */
-void selfmod_function(const int *arr_fce, const unsigned int base)
-{
-        unsigned int flags, i, j, *addr = NULL;
-
-        local_irq_save(flags);
-        __disable_icache();
-
-        /* zero terminated array */
-        for (j = 0; arr_fce[j] != 0; j++) {
-                /* get start address of function */
-                addr = (unsigned int *) arr_fce[j];
-                pr_debug("%s: func(%d) at 0x%x\n",
-                                        __func__, j, (unsigned int) addr);
-                for (i = 0; ; i++) {
-                        pr_debug("%s: instruction code at %d: 0x%x\n",
-                                                __func__, i, addr[i]);
-                        if (addr[i] == IMM_BASE) {
-                                /* detecting of lwi (0xE8) or swi (0xF8) instr
-                                 * I can detect both opcode with one mask */
-                                if ((addr[i + 1] & LWI_BASE_MASK) == LWI_BASE) {
-                                        MODIFY_INSTR;
-                                } else /* detection addik for ack */
-                                if ((addr[i + 1] & ADDIK_BASE_MASK) ==
-                                                                ADDIK_BASE) {
-                                        MODIFY_INSTR;
-                                }
-                        } else if (addr[i] == OPCODE_RTSD) {
-                                /* return from function means end of function */
-                                pr_debug("%s: end of array %d\n", __func__, i);
-                                break;
-                        }
-                }
-        }
-        local_irq_restore(flags);
-} /* end of self-modified code */
diff --git a/arch/microblaze/kernel/setup.c b/arch/microblaze/kernel/setup.c
index 0263da7b83dd..0775e036c526 100644
--- a/arch/microblaze/kernel/setup.c
+++ b/arch/microblaze/kernel/setup.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/init.h>
+#include <linux/clocksource.h>
 #include <linux/string.h>
 #include <linux/seq_file.h>
 #include <linux/cpu.h>
@@ -68,10 +69,6 @@ void __init setup_arch(char **cmdline_p)
 
         xilinx_pci_init();
 
-#if defined(CONFIG_SELFMOD_INTC) || defined(CONFIG_SELFMOD_TIMER)
-        pr_notice("Self modified code enable\n");
-#endif
-
 #ifdef CONFIG_VT
 #if defined(CONFIG_XILINX_CONSOLE)
         conswitchp = &xil_con;
@@ -196,6 +193,11 @@ void __init machine_early_init(const char *cmdline, unsigned int ram,
         per_cpu(CURRENT_SAVE, 0) = (unsigned long)current;
 }
 
+void __init time_init(void)
+{
+        clocksource_of_init();
+}
+
 #ifdef CONFIG_DEBUG_FS
 struct dentry *of_debugfs_root;
 
diff --git a/arch/microblaze/kernel/timer.c b/arch/microblaze/kernel/timer.c
index aec5020a6e31..e4b3f33ef34c 100644
--- a/arch/microblaze/kernel/timer.c
+++ b/arch/microblaze/kernel/timer.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2007-2009 Michal Simek <monstr@monstr.eu>
+ * Copyright (C) 2007-2013 Michal Simek <monstr@monstr.eu>
+ * Copyright (C) 2012-2013 Xilinx, Inc.
  * Copyright (C) 2007-2009 PetaLogix
  * Copyright (C) 2006 Atmark Techno, Inc.
  *
@@ -8,34 +9,16 @@
  * for more details.
  */
 
-#include <linux/init.h>
-#include <linux/kernel.h>
-#include <linux/param.h>
 #include <linux/interrupt.h>
-#include <linux/profile.h>
-#include <linux/irq.h>
 #include <linux/delay.h>
 #include <linux/sched.h>
-#include <linux/spinlock.h>
-#include <linux/err.h>
 #include <linux/clk.h>
-#include <linux/clocksource.h>
 #include <linux/clockchips.h>
-#include <linux/io.h>
-#include <linux/bug.h>
+#include <linux/of_address.h>
 #include <asm/cpuinfo.h>
-#include <asm/setup.h>
-#include <asm/prom.h>
-#include <asm/irq.h>
 #include <linux/cnt32_to_63.h>
 
-#ifdef CONFIG_SELFMOD_TIMER
-#include <asm/selfmod.h>
-#define TIMER_BASE      BARRIER_BASE_ADDR
-#else
-static unsigned int timer_baseaddr;
-#define TIMER_BASE      timer_baseaddr
-#endif
+static void __iomem *timer_baseaddr;
 
 static unsigned int freq_div_hz;
 static unsigned int timer_clock_freq;
@@ -59,19 +42,21 @@ static unsigned int timer_clock_freq;
 #define TCSR_PWMA       (1<<9)
 #define TCSR_ENALL      (1<<10)
 
-static inline void microblaze_timer0_stop(void)
+static inline void xilinx_timer0_stop(void)
 {
-        out_be32(TIMER_BASE + TCSR0, in_be32(TIMER_BASE + TCSR0) & ~TCSR_ENT);
+        out_be32(timer_baseaddr + TCSR0,
+                 in_be32(timer_baseaddr + TCSR0) & ~TCSR_ENT);
 }
 
-static inline void microblaze_timer0_start_periodic(unsigned long load_val)
+static inline void xilinx_timer0_start_periodic(unsigned long load_val)
 {
         if (!load_val)
                 load_val = 1;
-        out_be32(TIMER_BASE + TLR0, load_val); /* loading value to timer reg */
+        /* loading value to timer reg */
+        out_be32(timer_baseaddr + TLR0, load_val);
 
         /* load the initial value */
-        out_be32(TIMER_BASE + TCSR0, TCSR_LOAD);
+        out_be32(timer_baseaddr + TCSR0, TCSR_LOAD);
 
         /* see timer data sheet for detail
          * !ENALL - don't enable 'em all
@@ -86,38 +71,39 @@ static inline void microblaze_timer0_start_periodic(unsigned long load_val)
          * UDT - set the timer as down counter
          * !MDT0 - generate mode
          */
-        out_be32(TIMER_BASE + TCSR0,
+        out_be32(timer_baseaddr + TCSR0,
                         TCSR_TINT|TCSR_ENIT|TCSR_ENT|TCSR_ARHT|TCSR_UDT);
 }
 
-static inline void microblaze_timer0_start_oneshot(unsigned long load_val)
+static inline void xilinx_timer0_start_oneshot(unsigned long load_val)
 {
         if (!load_val)
                 load_val = 1;
-        out_be32(TIMER_BASE + TLR0, load_val); /* loading value to timer reg */
+        /* loading value to timer reg */
+        out_be32(timer_baseaddr + TLR0, load_val);
 
         /* load the initial value */
-        out_be32(TIMER_BASE + TCSR0, TCSR_LOAD);
+        out_be32(timer_baseaddr + TCSR0, TCSR_LOAD);
 
-        out_be32(TIMER_BASE + TCSR0,
+        out_be32(timer_baseaddr + TCSR0,
                         TCSR_TINT|TCSR_ENIT|TCSR_ENT|TCSR_ARHT|TCSR_UDT);
 }
 
-static int microblaze_timer_set_next_event(unsigned long delta,
+static int xilinx_timer_set_next_event(unsigned long delta,
                                         struct clock_event_device *dev)
 {
         pr_debug("%s: next event, delta %x\n", __func__, (u32)delta);
-        microblaze_timer0_start_oneshot(delta);
+        xilinx_timer0_start_oneshot(delta);
         return 0;
 }
 
-static void microblaze_timer_set_mode(enum clock_event_mode mode,
+static void xilinx_timer_set_mode(enum clock_event_mode mode,
                                 struct clock_event_device *evt)
 {
         switch (mode) {
         case CLOCK_EVT_MODE_PERIODIC:
                 pr_info("%s: periodic\n", __func__);
-                microblaze_timer0_start_periodic(freq_div_hz);
+                xilinx_timer0_start_periodic(freq_div_hz);
                 break;
         case CLOCK_EVT_MODE_ONESHOT:
                 pr_info("%s: oneshot\n", __func__);
@@ -127,7 +113,7 @@ static void microblaze_timer_set_mode(enum clock_event_mode mode,
                 break;
         case CLOCK_EVT_MODE_SHUTDOWN:
                 pr_info("%s: shutdown\n", __func__);
-                microblaze_timer0_stop();
+                xilinx_timer0_stop();
                 break;
         case CLOCK_EVT_MODE_RESUME:
                 pr_info("%s: resume\n", __func__);
@@ -135,23 +121,23 @@ static void microblaze_timer_set_mode(enum clock_event_mode mode,
         }
 }
 
-static struct clock_event_device clockevent_microblaze_timer = {
-        .name           = "microblaze_clockevent",
+static struct clock_event_device clockevent_xilinx_timer = {
+        .name           = "xilinx_clockevent",
         .features       = CLOCK_EVT_FEAT_ONESHOT | CLOCK_EVT_FEAT_PERIODIC,
         .shift          = 8,
         .rating         = 300,
-        .set_next_event = microblaze_timer_set_next_event,
-        .set_mode       = microblaze_timer_set_mode,
+        .set_next_event = xilinx_timer_set_next_event,
+        .set_mode       = xilinx_timer_set_mode,
 };
 
 static inline void timer_ack(void)
 {
-        out_be32(TIMER_BASE + TCSR0, in_be32(TIMER_BASE + TCSR0));
+        out_be32(timer_baseaddr + TCSR0, in_be32(timer_baseaddr + TCSR0));
 }
 
 static irqreturn_t timer_interrupt(int irq, void *dev_id)
 {
-        struct clock_event_device *evt = &clockevent_microblaze_timer;
+        struct clock_event_device *evt = &clockevent_xilinx_timer;
 #ifdef CONFIG_HEART_BEAT
         heartbeat();
 #endif
@@ -164,73 +150,74 @@ static struct irqaction timer_irqaction = {
         .handler = timer_interrupt,
         .flags = IRQF_DISABLED | IRQF_TIMER,
         .name = "timer",
-        .dev_id = &clockevent_microblaze_timer,
+        .dev_id = &clockevent_xilinx_timer,
 };
 
-static __init void microblaze_clockevent_init(void)
+static __init void xilinx_clockevent_init(void)
 {
-        clockevent_microblaze_timer.mult =
+        clockevent_xilinx_timer.mult =
                 div_sc(timer_clock_freq, NSEC_PER_SEC,
-                                clockevent_microblaze_timer.shift);
-        clockevent_microblaze_timer.max_delta_ns =
-                clockevent_delta2ns((u32)~0, &clockevent_microblaze_timer);
-        clockevent_microblaze_timer.min_delta_ns =
-                clockevent_delta2ns(1, &clockevent_microblaze_timer);
-        clockevent_microblaze_timer.cpumask = cpumask_of(0);
-        clockevents_register_device(&clockevent_microblaze_timer);
+                                clockevent_xilinx_timer.shift);
+        clockevent_xilinx_timer.max_delta_ns =
+                clockevent_delta2ns((u32)~0, &clockevent_xilinx_timer);
+        clockevent_xilinx_timer.min_delta_ns =
+                clockevent_delta2ns(1, &clockevent_xilinx_timer);
+        clockevent_xilinx_timer.cpumask = cpumask_of(0);
+        clockevents_register_device(&clockevent_xilinx_timer);
 }
 
-static cycle_t microblaze_read(struct clocksource *cs)
+static cycle_t xilinx_read(struct clocksource *cs)
 {
         /* reading actual value of timer 1 */
-        return (cycle_t) (in_be32(TIMER_BASE + TCR1));
+        return (cycle_t) (in_be32(timer_baseaddr + TCR1));
 }
 
-static struct timecounter microblaze_tc = {
+static struct timecounter xilinx_tc = {
         .cc = NULL,
 };
 
-static cycle_t microblaze_cc_read(const struct cyclecounter *cc)
+static cycle_t xilinx_cc_read(const struct cyclecounter *cc)
 {
-        return microblaze_read(NULL);
+        return xilinx_read(NULL);
 }
 
-static struct cyclecounter microblaze_cc = {
-        .read = microblaze_cc_read,
+static struct cyclecounter xilinx_cc = {
+        .read = xilinx_cc_read,
         .mask = CLOCKSOURCE_MASK(32),
         .shift = 8,
 };
 
-static int __init init_microblaze_timecounter(void)
+static int __init init_xilinx_timecounter(void)
 {
-        microblaze_cc.mult = div_sc(timer_clock_freq, NSEC_PER_SEC,
-                                microblaze_cc.shift);
+        xilinx_cc.mult = div_sc(timer_clock_freq, NSEC_PER_SEC,
+                                xilinx_cc.shift);
 
-        timecounter_init(&microblaze_tc, &microblaze_cc, sched_clock());
+        timecounter_init(&xilinx_tc, &xilinx_cc, sched_clock());
 
         return 0;
 }
 
 static struct clocksource clocksource_microblaze = {
-        .name           = "microblaze_clocksource",
+        .name           = "xilinx_clocksource",
         .rating         = 300,
-        .read           = microblaze_read,
+        .read           = xilinx_read,
         .mask           = CLOCKSOURCE_MASK(32),
         .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 
-static int __init microblaze_clocksource_init(void)
+static int __init xilinx_clocksource_init(void)
 {
         if (clocksource_register_hz(&clocksource_microblaze, timer_clock_freq))
                 panic("failed to register clocksource");
 
         /* stop timer1 */
-        out_be32(TIMER_BASE + TCSR1, in_be32(TIMER_BASE + TCSR1) & ~TCSR_ENT);
+        out_be32(timer_baseaddr + TCSR1,
+                 in_be32(timer_baseaddr + TCSR1) & ~TCSR_ENT);
         /* start timer1 - up counting without interrupt */
-        out_be32(TIMER_BASE + TCSR1, TCSR_TINT|TCSR_ENT|TCSR_ARHT);
+        out_be32(timer_baseaddr + TCSR1, TCSR_TINT|TCSR_ENT|TCSR_ARHT);
 
         /* register timecounter - for ftrace support */
-        init_microblaze_timecounter();
+        init_xilinx_timecounter();
         return 0;
 }
 
@@ -240,55 +227,31 @@ static int __init microblaze_clocksource_init(void)
  */
 static int timer_initialized;
 
-void __init time_init(void)
+static void __init xilinx_timer_init(struct device_node *timer)
 {
         u32 irq;
         u32 timer_num = 1;
-        struct device_node *timer = NULL;
-        const void *prop;
-#ifdef CONFIG_SELFMOD_TIMER
-        unsigned int timer_baseaddr = 0;
-        int arr_func[] = {
-                                (int)&microblaze_read,
-                                (int)&timer_interrupt,
-                                (int)&microblaze_clocksource_init,
-                                (int)&microblaze_timer_set_mode,
-                                (int)&microblaze_timer_set_next_event,
-                                0
-                        };
-#endif
-        prop = of_get_property(of_chosen, "system-timer", NULL);
-        if (prop)
-                timer = of_find_node_by_phandle(be32_to_cpup(prop));
-        else
-                pr_info("No chosen timer found, using default\n");
-
-        if (!timer)
-                timer = of_find_compatible_node(NULL, NULL,
-                                                "xlnx,xps-timer-1.00.a");
-        BUG_ON(!timer);
-
-        timer_baseaddr = be32_to_cpup(of_get_property(timer, "reg", NULL));
-        timer_baseaddr = (unsigned long) ioremap(timer_baseaddr, PAGE_SIZE);
+        int ret;
+
+        timer_baseaddr = of_iomap(timer, 0);
+        if (!timer_baseaddr) {
+                pr_err("ERROR: invalid timer base address\n");
+                BUG();
+        }
+
         irq = irq_of_parse_and_map(timer, 0);
-        timer_num = be32_to_cpup(of_get_property(timer,
-                                                "xlnx,one-timer-only", NULL));
+
+        of_property_read_u32(timer, "xlnx,one-timer-only", &timer_num);
         if (timer_num) {
-                pr_emerg("Please   enable two timers in HW\n");
+                pr_emerg("Please enable two timers in HW\n");
                 BUG();
         }
 
-#ifdef CONFIG_SELFMOD_TIMER
-        selfmod_function((int *) arr_func, timer_baseaddr);
-#endif
-        pr_info("%s #0 at 0x%08x, irq=%d\n",
-                timer->name, timer_baseaddr, irq);
+        pr_info("%s: irq=%d\n", timer->full_name, irq);
 
         /* If there is clock-frequency property than use it */
-        prop = of_get_property(timer, "clock-frequency", NULL);
-        if (prop)
-                timer_clock_freq = be32_to_cpup(prop);
-        else
+        ret = of_property_read_u32(timer, "clock-frequency", &timer_clock_freq);
+        if (ret < 0)
                 timer_clock_freq = cpuinfo.cpu_clock_freq;
 
         freq_div_hz = timer_clock_freq / HZ;
@@ -297,8 +260,8 @@ void __init time_init(void)
 #ifdef CONFIG_HEART_BEAT
         setup_heartbeat();
 #endif
-        microblaze_clocksource_init();
-        microblaze_clockevent_init();
+        xilinx_clocksource_init();
+        xilinx_clockevent_init();
         timer_initialized = 1;
 }
 
@@ -312,3 +275,6 @@ unsigned long long notrace sched_clock(void)
         }
         return 0;
 }
+
+CLOCKSOURCE_OF_DECLARE(xilinx_timer, "xlnx,xps-timer-1.00.a",
+                       xilinx_timer_init);
diff --git a/arch/microblaze/pci/pci-common.c b/arch/microblaze/pci/pci-common.c
index bdb8ea100e73..1b93bf0892a0 100644
--- a/arch/microblaze/pci/pci-common.c
+++ b/arch/microblaze/pci/pci-common.c
@@ -657,67 +657,42 @@ void pci_resource_to_user(const struct pci_dev *dev, int bar,
 void pci_process_bridge_OF_ranges(struct pci_controller *hose,
                                   struct device_node *dev, int primary)
 {
-        const u32 *ranges;
-        int rlen;
-        int pna = of_n_addr_cells(dev);
-        int np = pna + 5;
         int memno = 0, isa_hole = -1;
-        u32 pci_space;
-        unsigned long long pci_addr, cpu_addr, pci_next, cpu_next, size;
         unsigned long long isa_mb = 0;
         struct resource *res;
+        struct of_pci_range range;
+        struct of_pci_range_parser parser;
 
         pr_info("PCI host bridge %s %s ranges:\n",
                dev->full_name, primary ? "(primary)" : "");
 
-        /* Get ranges property */
-        ranges = of_get_property(dev, "ranges", &rlen);
-        if (ranges == NULL)
+        /* Check for ranges property */
+        if (of_pci_range_parser_init(&parser, dev))
                 return;
 
-        /* Parse it */
         pr_debug("Parsing ranges property...\n");
-        while ((rlen -= np * 4) >= 0) {
+        for_each_of_pci_range(&parser, &range) {
                 /* Read next ranges element */
-                pci_space = ranges[0];
-                pci_addr = of_read_number(ranges + 1, 2);
-                cpu_addr = of_translate_address(dev, ranges + 3);
-                size = of_read_number(ranges + pna + 3, 2);
-
                 pr_debug("pci_space: 0x%08x pci_addr:0x%016llx ",
-                                pci_space, pci_addr);
+                                range.pci_space, range.pci_addr);
                 pr_debug("cpu_addr:0x%016llx size:0x%016llx\n",
-                                        cpu_addr, size);
-
-                ranges += np;
+                                        range.cpu_addr, range.size);
 
                 /* If we failed translation or got a zero-sized region
                  * (some FW try to feed us with non sensical zero sized regions
                  * such as power3 which look like some kind of attempt
                  * at exposing the VGA memory hole)
                  */
-                if (cpu_addr == OF_BAD_ADDR || size == 0)
+                if (range.cpu_addr == OF_BAD_ADDR || range.size == 0)
                         continue;
 
-                /* Now consume following elements while they are contiguous */
-                for (; rlen >= np * sizeof(u32);
-                     ranges += np, rlen -= np * 4) {
-                        if (ranges[0] != pci_space)
-                                break;
-                        pci_next = of_read_number(ranges + 1, 2);
-                        cpu_next = of_translate_address(dev, ranges + 3);
-                        if (pci_next != pci_addr + size ||
-                            cpu_next != cpu_addr + size)
-                                break;
-                        size += of_read_number(ranges + pna + 3, 2);
-                }
-
                 /* Act based on address space type */
                 res = NULL;
-                switch ((pci_space >> 24) & 0x3) {
-                case 1:         /* PCI IO space */
+                switch (range.flags & IORESOURCE_TYPE_BITS) {
+                case IORESOURCE_IO:
                         pr_info("  IO 0x%016llx..0x%016llx -> 0x%016llx\n",
-                               cpu_addr, cpu_addr + size - 1, pci_addr);
+                                range.cpu_addr, range.cpu_addr + range.size - 1,
+                                range.pci_addr);
 
                         /* We support only one IO range */
                         if (hose->pci_io_size) {
@@ -725,11 +700,12 @@ void pci_process_bridge_OF_ranges(struct pci_controller *hose,
                                 continue;
                         }
                         /* On 32 bits, limit I/O space to 16MB */
-                        if (size > 0x01000000)
-                                size = 0x01000000;
+                        if (range.size > 0x01000000)
+                                range.size = 0x01000000;
 
                         /* 32 bits needs to map IOs here */
-                        hose->io_base_virt = ioremap(cpu_addr, size);
+                        hose->io_base_virt = ioremap(range.cpu_addr,
+                                                range.size);
 
                         /* Expect trouble if pci_addr is not 0 */
                         if (primary)
@@ -738,19 +714,20 @@ void pci_process_bridge_OF_ranges(struct pci_controller *hose,
                         /* pci_io_size and io_base_phys always represent IO
                          * space starting at 0 so we factor in pci_addr
                          */
-                        hose->pci_io_size = pci_addr + size;
-                        hose->io_base_phys = cpu_addr - pci_addr;
+                        hose->pci_io_size = range.pci_addr + range.size;
+                        hose->io_base_phys = range.cpu_addr - range.pci_addr;
 
                         /* Build resource */
                         res = &hose->io_resource;
-                        res->flags = IORESOURCE_IO;
-                        res->start = pci_addr;
+                        range.cpu_addr = range.pci_addr;
+
                         break;
-                case 2:         /* PCI Memory space */
-                case 3:         /* PCI 64 bits Memory space */
+                case IORESOURCE_MEM:
                         pr_info(" MEM 0x%016llx..0x%016llx -> 0x%016llx %s\n",
-                               cpu_addr, cpu_addr + size - 1, pci_addr,
-                               (pci_space & 0x40000000) ? "Prefetch" : "");
+                                range.cpu_addr, range.cpu_addr + range.size - 1,
+                                range.pci_addr,
+                                (range.pci_space & 0x40000000) ?
+                                "Prefetch" : "");
 
                         /* We support only 3 memory ranges */
                         if (memno >= 3) {
@@ -758,13 +735,13 @@ void pci_process_bridge_OF_ranges(struct pci_controller *hose,
                                 continue;
                         }
                         /* Handles ISA memory hole space here */
-                        if (pci_addr == 0) {
-                                isa_mb = cpu_addr;
+                        if (range.pci_addr == 0) {
+                                isa_mb = range.cpu_addr;
                                 isa_hole = memno;
                                 if (primary || isa_mem_base == 0)
-                                        isa_mem_base = cpu_addr;
-                                hose->isa_mem_phys = cpu_addr;
-                                hose->isa_mem_size = size;
+                                        isa_mem_base = range.cpu_addr;
+                                hose->isa_mem_phys = range.cpu_addr;
+                                hose->isa_mem_size = range.size;
                         }
 
                         /* We get the PCI/Mem offset from the first range or
@@ -772,30 +749,23 @@ void pci_process_bridge_OF_ranges(struct pci_controller *hose,
                          * hole. If they don't match, bugger.
                          */
                         if (memno == 0 ||
-                            (isa_hole >= 0 && pci_addr != 0 &&
+                            (isa_hole >= 0 && range.pci_addr != 0 &&
                              hose->pci_mem_offset == isa_mb))
-                                hose->pci_mem_offset = cpu_addr - pci_addr;
-                        else if (pci_addr != 0 &&
-                                 hose->pci_mem_offset != cpu_addr - pci_addr) {
+                                hose->pci_mem_offset = range.cpu_addr -
+                                                        range.pci_addr;
+                        else if (range.pci_addr != 0 &&
+                                 hose->pci_mem_offset != range.cpu_addr -
+                                                        range.pci_addr) {
                                 pr_info(" \\--> Skipped (offset mismatch) !\n");
                                 continue;
                         }
 
                         /* Build resource */
                         res = &hose->mem_resources[memno++];
-                        res->flags = IORESOURCE_MEM;
-                        if (pci_space & 0x40000000)
-                                res->flags |= IORESOURCE_PREFETCH;
-                        res->start = cpu_addr;
                         break;
                 }
-                if (res != NULL) {
-                        res->name = dev->full_name;
-                        res->end = res->start + size - 1;
-                        res->parent = NULL;
-                        res->sibling = NULL;
-                        res->child = NULL;
-                }
+                if (res != NULL)
+                        of_pci_range_to_resource(&range, dev, res);
         }
 
         /* If there's an ISA hole and the pci_mem_offset is -not- matching
diff --git a/arch/microblaze/platform/Kconfig.platform b/arch/microblaze/platform/Kconfig.platform
index b1747211b8b1..db1aa5c22cea 100644
--- a/arch/microblaze/platform/Kconfig.platform
+++ b/arch/microblaze/platform/Kconfig.platform
@@ -18,28 +18,6 @@ config PLATFORM_GENERIC
 
 endchoice
 
-config SELFMOD
-        bool "Use self modified code for intc/timer"
-        depends on NO_MMU
-        default n
-        help
-          This choice enables self-modified code for interrupt controller
-          and timer.
-
-config SELFMOD_INTC
-        bool "Use self modified code for intc"
-        depends on SELFMOD
-        default y
-        help
-          This choice enables self-modified code for interrupt controller.
-
-config SELFMOD_TIMER
-        bool "Use self modified code for timer"
-        depends on SELFMOD
-        default y
-        help
-          This choice enables self-modified code for timer.
-
 config OPT_LIB_FUNCTION
         bool "Optimalized lib function"
         default y
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index e12764c2a9d0..dccd7cec442d 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -2305,9 +2305,9 @@ config KEXEC
 
           It is an ongoing process to be certain the hardware in a machine
           is properly shutdown, so do not be surprised if this code does not
-          initially work for you.  It may help to enable device hotplugging
-          support.  As of this writing the exact hardware interface is
-          strongly in flux, so no good recommendation can be made.
+          initially work for you.  As of this writing the exact hardware
+          interface is strongly in flux, so no good recommendation can be
+          made.
 
 config CRASH_DUMP
           bool "Kernel crash dumps"
diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h
index 1dc086087a72..fa44f3ec5302 100644
--- a/arch/mips/include/asm/cpu-features.h
+++ b/arch/mips/include/asm/cpu-features.h
@@ -17,6 +17,8 @@
 #define current_cpu_type()      current_cpu_data.cputype
 #endif
 
+#define boot_cpu_type()         cpu_data[0].cputype
+
 /*
  * SMP assumption: Options of CPU 0 are a superset of all processors.
  * This is true for all known MIPS systems.
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index 159abc8842d2..126da74d4c55 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -66,6 +66,8 @@ static void __init bmips_smp_setup(void)
         int i, cpu = 1, boot_cpu = 0;
 
 #if defined(CONFIG_CPU_BMIPS4350) || defined(CONFIG_CPU_BMIPS4380)
+        int cpu_hw_intr;
+
         /* arbitration priority */
         clear_c0_brcm_cmt_ctrl(0x30);
 
@@ -80,8 +82,12 @@ static void __init bmips_smp_setup(void)
          * MIPS interrupt 2 (HW INT 0) is the CPU0 L1 controller output
          * MIPS interrupt 3 (HW INT 1) is the CPU1 L1 controller output
          */
-        change_c0_brcm_cmt_intr(0xf8018000,
-                                        (0x02 << 27) | (0x03 << 15));
+        if (boot_cpu == 0)
+                cpu_hw_intr = 0x02;
+        else
+                cpu_hw_intr = 0x1d;
+
+        change_c0_brcm_cmt_intr(0xf8018000, (cpu_hw_intr << 27) | (0x03 << 15));
 
         /* single core, 2 threads (2 pipelines) */
         max_cpus = 2;
diff --git a/arch/mips/kernel/vpe.c b/arch/mips/kernel/vpe.c
index 1765bab000a0..faf84c5f2629 100644
--- a/arch/mips/kernel/vpe.c
+++ b/arch/mips/kernel/vpe.c
@@ -1335,8 +1335,9 @@ static ssize_t store_kill(struct device *dev, struct device_attribute *attr,
 
         return len;
 }
+static DEVICE_ATTR(kill, S_IWUSR, NULL, store_kill);
 
-static ssize_t show_ntcs(struct device *cd, struct device_attribute *attr,
+static ssize_t ntcs_show(struct device *cd, struct device_attribute *attr,
                          char *buf)
 {
         struct vpe *vpe = get_vpe(tclimit);
@@ -1344,7 +1345,7 @@ static ssize_t show_ntcs(struct device *cd, struct device_attribute *attr,
         return sprintf(buf, "%d\n", vpe->ntcs);
 }
 
-static ssize_t store_ntcs(struct device *dev, struct device_attribute *attr,
+static ssize_t ntcs_store(struct device *dev, struct device_attribute *attr,
                           const char *buf, size_t len)
 {
         struct vpe *vpe = get_vpe(tclimit);
@@ -1365,12 +1366,14 @@ static ssize_t store_ntcs(struct device *dev, struct device_attribute *attr,
 out_einval:
         return -EINVAL;
 }
+static DEVICE_ATTR_RW(ntcs);
 
-static struct device_attribute vpe_class_attributes[] = {
-        __ATTR(kill, S_IWUSR, NULL, store_kill),
-        __ATTR(ntcs, S_IRUGO | S_IWUSR, show_ntcs, store_ntcs),
-        {}
+static struct attribute vpe_attrs[] = {
+        &dev_attr_kill.attr,
+        &dev_attr_ntcs.attr,
+        NULL,
 };
+ATTRIBUTE_GROUPS(vpe);
 
 static void vpe_device_release(struct device *cd)
 {
@@ -1381,7 +1384,7 @@ struct class vpe_class = {
         .name = "vpe",
         .owner = THIS_MODULE,
         .dev_release = vpe_device_release,
-        .dev_attrs = vpe_class_attributes,
+        .dev_groups = vpe_groups,
 };
 
 struct device vpe_device;
diff --git a/arch/mips/kvm/kvm_locore.S b/arch/mips/kvm/kvm_locore.S
index dca2aa665993..bbace092ad0a 100644
--- a/arch/mips/kvm/kvm_locore.S
+++ b/arch/mips/kvm/kvm_locore.S
@@ -1,13 +1,13 @@
 /*
-* This file is subject to the terms and conditions of the GNU General Public
-* License.  See the file "COPYING" in the main directory of this archive
-* for more details.
-*
-* Main entry point for the guest, exception handling.
-*
-* Copyright (C) 2012  MIPS Technologies, Inc.  All rights reserved.
-* Authors: Sanjay Lal <sanjayl@kymasys.com>
-*/
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Main entry point for the guest, exception handling.
+ *
+ * Copyright (C) 2012  MIPS Technologies, Inc.  All rights reserved.
+ * Authors: Sanjay Lal <sanjayl@kymasys.com>
+ */
 
 #include <asm/asm.h>
 #include <asm/asmmacro.h>
@@ -55,195 +55,193 @@
  * a0: run
  * a1: vcpu
  */
+        .set    noreorder
+        .set    noat
 
 FEXPORT(__kvm_mips_vcpu_run)
-    .set    push
-    .set    noreorder
-    .set    noat
-
-    /* k0/k1 not being used in host kernel context */
-        addiu           k1,sp, -PT_SIZE
-    LONG_S          $0, PT_R0(k1)
-    LONG_S      $1, PT_R1(k1)
-    LONG_S      $2, PT_R2(k1)
-    LONG_S      $3, PT_R3(k1)
-
-    LONG_S      $4, PT_R4(k1)
-    LONG_S      $5, PT_R5(k1)
-    LONG_S      $6, PT_R6(k1)
-    LONG_S      $7, PT_R7(k1)
-
-    LONG_S      $8,  PT_R8(k1)
-    LONG_S      $9,  PT_R9(k1)
-    LONG_S      $10, PT_R10(k1)
-    LONG_S      $11, PT_R11(k1)
-    LONG_S      $12, PT_R12(k1)
-    LONG_S      $13, PT_R13(k1)
-    LONG_S      $14, PT_R14(k1)
-    LONG_S      $15, PT_R15(k1)
-    LONG_S      $16, PT_R16(k1)
-    LONG_S      $17, PT_R17(k1)
-
-    LONG_S      $18, PT_R18(k1)
-    LONG_S      $19, PT_R19(k1)
-    LONG_S      $20, PT_R20(k1)
-    LONG_S      $21, PT_R21(k1)
-    LONG_S      $22, PT_R22(k1)
-    LONG_S      $23, PT_R23(k1)
-    LONG_S      $24, PT_R24(k1)
-    LONG_S      $25, PT_R25(k1)
+        /* k0/k1 not being used in host kernel context */
+        INT_ADDIU k1, sp, -PT_SIZE
+        LONG_S  $0, PT_R0(k1)
+        LONG_S  $1, PT_R1(k1)
+        LONG_S  $2, PT_R2(k1)
+        LONG_S  $3, PT_R3(k1)
+
+        LONG_S  $4, PT_R4(k1)
+        LONG_S  $5, PT_R5(k1)
+        LONG_S  $6, PT_R6(k1)
+        LONG_S  $7, PT_R7(k1)
+
+        LONG_S  $8,  PT_R8(k1)
+        LONG_S  $9,  PT_R9(k1)
+        LONG_S  $10, PT_R10(k1)
+        LONG_S  $11, PT_R11(k1)
+        LONG_S  $12, PT_R12(k1)
+        LONG_S  $13, PT_R13(k1)
+        LONG_S  $14, PT_R14(k1)
+        LONG_S  $15, PT_R15(k1)
+        LONG_S  $16, PT_R16(k1)
+        LONG_S  $17, PT_R17(k1)
+
+        LONG_S  $18, PT_R18(k1)
+        LONG_S  $19, PT_R19(k1)
+        LONG_S  $20, PT_R20(k1)
+        LONG_S  $21, PT_R21(k1)
+        LONG_S  $22, PT_R22(k1)
+        LONG_S  $23, PT_R23(k1)
+        LONG_S  $24, PT_R24(k1)
+        LONG_S  $25, PT_R25(k1)
 
         /* XXXKYMA k0/k1 not saved, not being used if we got here through an ioctl() */
 
-    LONG_S      $28, PT_R28(k1)
-    LONG_S      $29, PT_R29(k1)
-    LONG_S      $30, PT_R30(k1)
-    LONG_S      $31, PT_R31(k1)
+        LONG_S  $28, PT_R28(k1)
+        LONG_S  $29, PT_R29(k1)
+        LONG_S  $30, PT_R30(k1)
+        LONG_S  $31, PT_R31(k1)
 
-    /* Save hi/lo */
-        mflo            v0
-        LONG_S          v0, PT_LO(k1)
-        mfhi            v1
-        LONG_S          v1, PT_HI(k1)
+        /* Save hi/lo */
+        mflo    v0
+        LONG_S  v0, PT_LO(k1)
+        mfhi    v1
+        LONG_S  v1, PT_HI(k1)
 
         /* Save host status */
-        mfc0            v0, CP0_STATUS
-        LONG_S          v0, PT_STATUS(k1)
+        mfc0    v0, CP0_STATUS
+        LONG_S  v0, PT_STATUS(k1)
 
         /* Save host ASID, shove it into the BVADDR location */
-        mfc0            v1,CP0_ENTRYHI
-        andi            v1, 0xff
-        LONG_S          v1, PT_HOST_ASID(k1)
+        mfc0    v1, CP0_ENTRYHI
+        andi    v1, 0xff
+        LONG_S  v1, PT_HOST_ASID(k1)
 
-    /* Save DDATA_LO, will be used to store pointer to vcpu */
-    mfc0        v1, CP0_DDATA_LO
-    LONG_S      v1, PT_HOST_USERLOCAL(k1)
+        /* Save DDATA_LO, will be used to store pointer to vcpu */
+        mfc0    v1, CP0_DDATA_LO
+        LONG_S  v1, PT_HOST_USERLOCAL(k1)
 
-    /* DDATA_LO has pointer to vcpu */
-    mtc0        a1,CP0_DDATA_LO
+        /* DDATA_LO has pointer to vcpu */
+        mtc0    a1, CP0_DDATA_LO
 
-    /* Offset into vcpu->arch */
-        addiu           k1, a1, VCPU_HOST_ARCH
+        /* Offset into vcpu->arch */
+        INT_ADDIU k1, a1, VCPU_HOST_ARCH
 
-    /* Save the host stack to VCPU, used for exception processing when we exit from the Guest */
-    LONG_S      sp, VCPU_HOST_STACK(k1)
+        /*
+         * Save the host stack to VCPU, used for exception processing
+         * when we exit from the Guest
+         */
+        LONG_S  sp, VCPU_HOST_STACK(k1)
 
-    /* Save the kernel gp as well */
-    LONG_S      gp, VCPU_HOST_GP(k1)
+        /* Save the kernel gp as well */
+        LONG_S  gp, VCPU_HOST_GP(k1)
 
         /* Setup status register for running the guest in UM, interrupts are disabled */
-        li                      k0,(ST0_EXL | KSU_USER| ST0_BEV)
-        mtc0            k0,CP0_STATUS
-    ehb
-
-    /* load up the new EBASE */
-    LONG_L      k0, VCPU_GUEST_EBASE(k1)
-    mtc0        k0,CP0_EBASE
-
-    /* Now that the new EBASE has been loaded, unset BEV, set interrupt mask as it was
-     * but make sure that timer interrupts are enabled
-     */
-    li          k0,(ST0_EXL | KSU_USER | ST0_IE)
-    andi        v0, v0, ST0_IM
-    or          k0, k0, v0
-    mtc0        k0,CP0_STATUS
-    ehb
+        li      k0, (ST0_EXL | KSU_USER | ST0_BEV)
+        mtc0    k0, CP0_STATUS
+        ehb
+
+        /* load up the new EBASE */
+        LONG_L  k0, VCPU_GUEST_EBASE(k1)
+        mtc0    k0, CP0_EBASE
+
+        /*
+         * Now that the new EBASE has been loaded, unset BEV, set
+         * interrupt mask as it was but make sure that timer interrupts
+         * are enabled
+         */
+        li      k0, (ST0_EXL | KSU_USER | ST0_IE)
+        andi    v0, v0, ST0_IM
+        or      k0, k0, v0
+        mtc0    k0, CP0_STATUS
+        ehb
 
 
         /* Set Guest EPC */
-        LONG_L          t0, VCPU_PC(k1)
-        mtc0            t0, CP0_EPC
+        LONG_L  t0, VCPU_PC(k1)
+        mtc0    t0, CP0_EPC
 
 FEXPORT(__kvm_mips_load_asid)
-    /* Set the ASID for the Guest Kernel */
-    sll         t0, t0, 1                       /* with kseg0 @ 0x40000000, kernel */
-                                                /* addresses shift to 0x80000000 */
-    bltz        t0, 1f                          /* If kernel */
-        addiu       t1, k1, VCPU_GUEST_KERNEL_ASID  /* (BD)  */
-    addiu       t1, k1, VCPU_GUEST_USER_ASID    /* else user */
+        /* Set the ASID for the Guest Kernel */
+        INT_SLL t0, t0, 1       /* with kseg0 @ 0x40000000, kernel */
+                                /* addresses shift to 0x80000000 */
+        bltz    t0, 1f          /* If kernel */
+         INT_ADDIU t1, k1, VCPU_GUEST_KERNEL_ASID  /* (BD)  */
+        INT_ADDIU t1, k1, VCPU_GUEST_USER_ASID    /* else user */
 1:
-    /* t1: contains the base of the ASID array, need to get the cpu id  */
-    LONG_L      t2, TI_CPU($28)             /* smp_processor_id */
-    sll         t2, t2, 2                   /* x4 */
-    addu        t3, t1, t2
-    LONG_L      k0, (t3)
-    andi        k0, k0, 0xff
-        mtc0            k0,CP0_ENTRYHI
-    ehb
-
-    /* Disable RDHWR access */
-    mtc0    zero,  CP0_HWRENA
-
-    /* Now load up the Guest Context from VCPU */
-    LONG_L      $1, VCPU_R1(k1)
-    LONG_L      $2, VCPU_R2(k1)
-    LONG_L      $3, VCPU_R3(k1)
-
-    LONG_L      $4, VCPU_R4(k1)
-    LONG_L      $5, VCPU_R5(k1)
-    LONG_L      $6, VCPU_R6(k1)
-    LONG_L      $7, VCPU_R7(k1)
-
-    LONG_L      $8,  VCPU_R8(k1)
-    LONG_L      $9,  VCPU_R9(k1)
-    LONG_L      $10, VCPU_R10(k1)
-    LONG_L      $11, VCPU_R11(k1)
-    LONG_L      $12, VCPU_R12(k1)
-    LONG_L      $13, VCPU_R13(k1)
-    LONG_L      $14, VCPU_R14(k1)
-    LONG_L      $15, VCPU_R15(k1)
-    LONG_L      $16, VCPU_R16(k1)
-    LONG_L      $17, VCPU_R17(k1)
-    LONG_L      $18, VCPU_R18(k1)
-    LONG_L      $19, VCPU_R19(k1)
-    LONG_L      $20, VCPU_R20(k1)
-    LONG_L      $21, VCPU_R21(k1)
-    LONG_L      $22, VCPU_R22(k1)
-    LONG_L      $23, VCPU_R23(k1)
-    LONG_L      $24, VCPU_R24(k1)
-    LONG_L      $25, VCPU_R25(k1)
-
-    /* k0/k1 loaded up later */
-
-    LONG_L      $28, VCPU_R28(k1)
-    LONG_L      $29, VCPU_R29(k1)
-    LONG_L      $30, VCPU_R30(k1)
-    LONG_L      $31, VCPU_R31(k1)
-
-    /* Restore hi/lo */
-        LONG_L          k0, VCPU_LO(k1)
-        mtlo            k0
-
-        LONG_L          k0, VCPU_HI(k1)
-        mthi            k0
+             /* t1: contains the base of the ASID array, need to get the cpu id  */
+        LONG_L  t2, TI_CPU($28)             /* smp_processor_id */
+        INT_SLL t2, t2, 2                   /* x4 */
+        REG_ADDU t3, t1, t2
+        LONG_L  k0, (t3)
+        andi    k0, k0, 0xff
+        mtc0    k0, CP0_ENTRYHI
+        ehb
+
+        /* Disable RDHWR access */
+        mtc0    zero, CP0_HWRENA
+
+        /* Now load up the Guest Context from VCPU */
+        LONG_L  $1, VCPU_R1(k1)
+        LONG_L  $2, VCPU_R2(k1)
+        LONG_L  $3, VCPU_R3(k1)
+
+        LONG_L  $4, VCPU_R4(k1)
+        LONG_L  $5, VCPU_R5(k1)
+        LONG_L  $6, VCPU_R6(k1)
+        LONG_L  $7, VCPU_R7(k1)
+
+        LONG_L  $8, VCPU_R8(k1)
+        LONG_L  $9, VCPU_R9(k1)
+        LONG_L  $10, VCPU_R10(k1)
+        LONG_L  $11, VCPU_R11(k1)
+        LONG_L  $12, VCPU_R12(k1)
+        LONG_L  $13, VCPU_R13(k1)
+        LONG_L  $14, VCPU_R14(k1)
+        LONG_L  $15, VCPU_R15(k1)
+        LONG_L  $16, VCPU_R16(k1)
+        LONG_L  $17, VCPU_R17(k1)
+        LONG_L  $18, VCPU_R18(k1)
+        LONG_L  $19, VCPU_R19(k1)
+        LONG_L  $20, VCPU_R20(k1)
+        LONG_L  $21, VCPU_R21(k1)
+        LONG_L  $22, VCPU_R22(k1)
+        LONG_L  $23, VCPU_R23(k1)
+        LONG_L  $24, VCPU_R24(k1)
+        LONG_L  $25, VCPU_R25(k1)
+
+        /* k0/k1 loaded up later */
+
+        LONG_L  $28, VCPU_R28(k1)
+        LONG_L  $29, VCPU_R29(k1)
+        LONG_L  $30, VCPU_R30(k1)
+        LONG_L  $31, VCPU_R31(k1)
+
+        /* Restore hi/lo */
+        LONG_L  k0, VCPU_LO(k1)
+        mtlo    k0
+
+        LONG_L  k0, VCPU_HI(k1)
+        mthi    k0
 
 FEXPORT(__kvm_mips_load_k0k1)
         /* Restore the guest's k0/k1 registers */
-    LONG_L      k0, VCPU_R26(k1)
-    LONG_L      k1, VCPU_R27(k1)
+        LONG_L  k0, VCPU_R26(k1)
+        LONG_L  k1, VCPU_R27(k1)
 
-    /* Jump to guest */
+        /* Jump to guest */
         eret
-        .set    pop
 
 VECTOR(MIPSX(exception), unknown)
 /*
  * Find out what mode we came from and jump to the proper handler.
  */
-    .set    push
-        .set    noat
-    .set    noreorder
-    mtc0    k0, CP0_ERROREPC    #01: Save guest k0
-    ehb                         #02:
-
-    mfc0    k0, CP0_EBASE       #02: Get EBASE
-    srl     k0, k0, 10          #03: Get rid of CPUNum
-    sll     k0, k0, 10          #04
-    LONG_S  k1, 0x3000(k0)      #05: Save k1 @ offset 0x3000
-    addiu   k0, k0, 0x2000      #06: Exception handler is installed @ offset 0x2000
-        j       k0                                      #07: jump to the function
-        nop                                             #08: branch delay slot
-        .set    push
+        mtc0    k0, CP0_ERROREPC        #01: Save guest k0
+        ehb                             #02:
+
+        mfc0    k0, CP0_EBASE           #02: Get EBASE
+        INT_SRL k0, k0, 10              #03: Get rid of CPUNum
+        INT_SLL k0, k0, 10              #04
+        LONG_S  k1, 0x3000(k0)          #05: Save k1 @ offset 0x3000
+        INT_ADDIU k0, k0, 0x2000                #06: Exception handler is installed @ offset 0x2000
+        j       k0                      #07: jump to the function
+         nop                            #08: branch delay slot
 VECTOR_END(MIPSX(exceptionEnd))
 .end MIPSX(exception)
 
@@ -253,329 +251,327 @@ VECTOR_END(MIPSX(exceptionEnd))
  *
  */
 NESTED (MIPSX(GuestException), CALLFRAME_SIZ, ra)
-    .set    push
-    .set    noat
-    .set    noreorder
-
-    /* Get the VCPU pointer from DDTATA_LO */
-    mfc0        k1, CP0_DDATA_LO
-        addiu           k1, k1, VCPU_HOST_ARCH
-
-    /* Start saving Guest context to VCPU */
-    LONG_S  $0, VCPU_R0(k1)
-    LONG_S  $1, VCPU_R1(k1)
-    LONG_S  $2, VCPU_R2(k1)
-    LONG_S  $3, VCPU_R3(k1)
-    LONG_S  $4, VCPU_R4(k1)
-    LONG_S  $5, VCPU_R5(k1)
-    LONG_S  $6, VCPU_R6(k1)
-    LONG_S  $7, VCPU_R7(k1)
-    LONG_S  $8, VCPU_R8(k1)
-    LONG_S  $9, VCPU_R9(k1)
-    LONG_S  $10, VCPU_R10(k1)
-    LONG_S  $11, VCPU_R11(k1)
-    LONG_S  $12, VCPU_R12(k1)
-    LONG_S  $13, VCPU_R13(k1)
-    LONG_S  $14, VCPU_R14(k1)
-    LONG_S  $15, VCPU_R15(k1)
-    LONG_S  $16, VCPU_R16(k1)
-    LONG_S  $17,VCPU_R17(k1)
-    LONG_S  $18, VCPU_R18(k1)
-    LONG_S  $19, VCPU_R19(k1)
-    LONG_S  $20, VCPU_R20(k1)
-    LONG_S  $21, VCPU_R21(k1)
-    LONG_S  $22, VCPU_R22(k1)
-    LONG_S  $23, VCPU_R23(k1)
-    LONG_S  $24, VCPU_R24(k1)
-    LONG_S  $25, VCPU_R25(k1)
-
-    /* Guest k0/k1 saved later */
-
-    LONG_S  $28, VCPU_R28(k1)
-    LONG_S  $29, VCPU_R29(k1)
-    LONG_S  $30, VCPU_R30(k1)
-    LONG_S  $31, VCPU_R31(k1)
-
-    /* We need to save hi/lo and restore them on
-     * the way out
-     */
-    mfhi    t0
-    LONG_S  t0, VCPU_HI(k1)
-
-    mflo    t0
-    LONG_S  t0, VCPU_LO(k1)
-
-    /* Finally save guest k0/k1 to VCPU */
-    mfc0    t0, CP0_ERROREPC
-    LONG_S  t0, VCPU_R26(k1)
-
-    /* Get GUEST k1 and save it in VCPU */
-    la      t1, ~0x2ff
-    mfc0    t0, CP0_EBASE
-    and     t0, t0, t1
-    LONG_L  t0, 0x3000(t0)
-    LONG_S  t0, VCPU_R27(k1)
-
-    /* Now that context has been saved, we can use other registers */
-
-    /* Restore vcpu */
-    mfc0        a1, CP0_DDATA_LO
-    move        s1, a1
-
-   /* Restore run (vcpu->run) */
-    LONG_L      a0, VCPU_RUN(a1)
-    /* Save pointer to run in s0, will be saved by the compiler */
-    move        s0, a0
-
-
-    /* Save Host level EPC, BadVaddr and Cause to VCPU, useful to process the exception */
-    mfc0    k0,CP0_EPC
-    LONG_S  k0, VCPU_PC(k1)
-
-    mfc0    k0, CP0_BADVADDR
-    LONG_S  k0, VCPU_HOST_CP0_BADVADDR(k1)
-
-    mfc0    k0, CP0_CAUSE
-    LONG_S  k0, VCPU_HOST_CP0_CAUSE(k1)
-
-    mfc0    k0, CP0_ENTRYHI
-    LONG_S  k0, VCPU_HOST_ENTRYHI(k1)
-
-    /* Now restore the host state just enough to run the handlers */
-
-    /* Swtich EBASE to the one used by Linux */
-    /* load up the host EBASE */
-    mfc0        v0, CP0_STATUS
-
-    .set at
-        or          k0, v0, ST0_BEV
-    .set noat
-
-    mtc0        k0, CP0_STATUS
-    ehb
-
-    LONG_L      k0, VCPU_HOST_EBASE(k1)
-    mtc0        k0,CP0_EBASE
-
-
-    /* Now that the new EBASE has been loaded, unset BEV and KSU_USER */
-    .set at
-        and         v0, v0, ~(ST0_EXL | KSU_USER | ST0_IE)
-    or          v0, v0, ST0_CU0
-    .set noat
-    mtc0        v0, CP0_STATUS
-    ehb
-
-    /* Load up host GP */
-    LONG_L  gp, VCPU_HOST_GP(k1)
-
-    /* Need a stack before we can jump to "C" */
-    LONG_L  sp, VCPU_HOST_STACK(k1)
-
-    /* Saved host state */
-    addiu   sp,sp, -PT_SIZE
+        /* Get the VCPU pointer from DDTATA_LO */
+        mfc0    k1, CP0_DDATA_LO
+        INT_ADDIU k1, k1, VCPU_HOST_ARCH
+
+        /* Start saving Guest context to VCPU */
+        LONG_S  $0, VCPU_R0(k1)
+        LONG_S  $1, VCPU_R1(k1)
+        LONG_S  $2, VCPU_R2(k1)
+        LONG_S  $3, VCPU_R3(k1)
+        LONG_S  $4, VCPU_R4(k1)
+        LONG_S  $5, VCPU_R5(k1)
+        LONG_S  $6, VCPU_R6(k1)
+        LONG_S  $7, VCPU_R7(k1)
+        LONG_S  $8, VCPU_R8(k1)
+        LONG_S  $9, VCPU_R9(k1)
+        LONG_S  $10, VCPU_R10(k1)
+        LONG_S  $11, VCPU_R11(k1)
+        LONG_S  $12, VCPU_R12(k1)
+        LONG_S  $13, VCPU_R13(k1)
+        LONG_S  $14, VCPU_R14(k1)
+        LONG_S  $15, VCPU_R15(k1)
+        LONG_S  $16, VCPU_R16(k1)
+        LONG_S  $17, VCPU_R17(k1)
+        LONG_S  $18, VCPU_R18(k1)
+        LONG_S  $19, VCPU_R19(k1)
+        LONG_S  $20, VCPU_R20(k1)
+        LONG_S  $21, VCPU_R21(k1)
+        LONG_S  $22, VCPU_R22(k1)
+        LONG_S  $23, VCPU_R23(k1)
+        LONG_S  $24, VCPU_R24(k1)
+        LONG_S  $25, VCPU_R25(k1)
+
+        /* Guest k0/k1 saved later */
+
+        LONG_S  $28, VCPU_R28(k1)
+        LONG_S  $29, VCPU_R29(k1)
+        LONG_S  $30, VCPU_R30(k1)
+        LONG_S  $31, VCPU_R31(k1)
+
+        /* We need to save hi/lo and restore them on
+         * the way out
+         */
+        mfhi    t0
+        LONG_S  t0, VCPU_HI(k1)
+
+        mflo    t0
+        LONG_S  t0, VCPU_LO(k1)
+
+        /* Finally save guest k0/k1 to VCPU */
+        mfc0    t0, CP0_ERROREPC
+        LONG_S  t0, VCPU_R26(k1)
+
+        /* Get GUEST k1 and save it in VCPU */
+        PTR_LI  t1, ~0x2ff
+        mfc0    t0, CP0_EBASE
+        and     t0, t0, t1
+        LONG_L  t0, 0x3000(t0)
+        LONG_S  t0, VCPU_R27(k1)
+
+        /* Now that context has been saved, we can use other registers */
+
+        /* Restore vcpu */
+        mfc0    a1, CP0_DDATA_LO
+        move    s1, a1
+
+        /* Restore run (vcpu->run) */
+        LONG_L  a0, VCPU_RUN(a1)
+        /* Save pointer to run in s0, will be saved by the compiler */
+        move    s0, a0
+
+        /* Save Host level EPC, BadVaddr and Cause to VCPU, useful to
+         * process the exception */
+        mfc0    k0,CP0_EPC
+        LONG_S  k0, VCPU_PC(k1)
+
+        mfc0    k0, CP0_BADVADDR
+        LONG_S  k0, VCPU_HOST_CP0_BADVADDR(k1)
+
+        mfc0    k0, CP0_CAUSE
+        LONG_S  k0, VCPU_HOST_CP0_CAUSE(k1)
+
+        mfc0    k0, CP0_ENTRYHI
+        LONG_S  k0, VCPU_HOST_ENTRYHI(k1)
+
+        /* Now restore the host state just enough to run the handlers */
+
+        /* Swtich EBASE to the one used by Linux */
+        /* load up the host EBASE */
+        mfc0    v0, CP0_STATUS
+
+        .set    at
+        or      k0, v0, ST0_BEV
+        .set    noat
+
+        mtc0    k0, CP0_STATUS
+        ehb
+
+        LONG_L  k0, VCPU_HOST_EBASE(k1)
+        mtc0    k0,CP0_EBASE
+
 
-    /* XXXKYMA do we need to load the host ASID, maybe not because the
-     * kernel entries are marked GLOBAL, need to verify
-     */
+        /* Now that the new EBASE has been loaded, unset BEV and KSU_USER */
+        .set    at
+        and     v0, v0, ~(ST0_EXL | KSU_USER | ST0_IE)
+        or      v0, v0, ST0_CU0
+        .set    noat
+        mtc0    v0, CP0_STATUS
+        ehb
+
+        /* Load up host GP */
+        LONG_L  gp, VCPU_HOST_GP(k1)
+
+        /* Need a stack before we can jump to "C" */
+        LONG_L  sp, VCPU_HOST_STACK(k1)
+
+        /* Saved host state */
+        INT_ADDIU sp, sp, -PT_SIZE
 
-    /* Restore host DDATA_LO */
-    LONG_L      k0, PT_HOST_USERLOCAL(sp)
-    mtc0        k0, CP0_DDATA_LO
+        /* XXXKYMA do we need to load the host ASID, maybe not because the
+         * kernel entries are marked GLOBAL, need to verify
+         */
 
-    /* Restore RDHWR access */
-    la      k0, 0x2000000F
-    mtc0    k0,  CP0_HWRENA
+        /* Restore host DDATA_LO */
+        LONG_L  k0, PT_HOST_USERLOCAL(sp)
+        mtc0    k0, CP0_DDATA_LO
 
-    /* Jump to handler */
+        /* Restore RDHWR access */
+        PTR_LI  k0, 0x2000000F
+        mtc0    k0, CP0_HWRENA
+
+        /* Jump to handler */
 FEXPORT(__kvm_mips_jump_to_handler)
-    /* XXXKYMA: not sure if this is safe, how large is the stack?? */
-    /* Now jump to the kvm_mips_handle_exit() to see if we can deal with this in the kernel */
-    la          t9,kvm_mips_handle_exit
-    jalr.hb     t9
-    addiu       sp,sp, -CALLFRAME_SIZ           /* BD Slot */
-
-    /* Return from handler Make sure interrupts are disabled */
-    di
-    ehb
-
-    /* XXXKYMA: k0/k1 could have been blown away if we processed an exception
-     * while we were handling the exception from the guest, reload k1
-     */
-    move        k1, s1
-        addiu           k1, k1, VCPU_HOST_ARCH
-
-    /* Check return value, should tell us if we are returning to the host (handle I/O etc)
-     * or resuming the guest
-     */
-    andi        t0, v0, RESUME_HOST
-    bnez        t0, __kvm_mips_return_to_host
-    nop
+        /* XXXKYMA: not sure if this is safe, how large is the stack??
+         * Now jump to the kvm_mips_handle_exit() to see if we can deal
+         * with this in the kernel */
+        PTR_LA  t9, kvm_mips_handle_exit
+        jalr.hb t9
+         INT_ADDIU sp, sp, -CALLFRAME_SIZ           /* BD Slot */
+
+        /* Return from handler Make sure interrupts are disabled */
+        di
+        ehb
+
+        /* XXXKYMA: k0/k1 could have been blown away if we processed
+         * an exception while we were handling the exception from the
+         * guest, reload k1
+         */
+
+        move    k1, s1
+        INT_ADDIU k1, k1, VCPU_HOST_ARCH
+
+        /* Check return value, should tell us if we are returning to the
+         * host (handle I/O etc)or resuming the guest
+         */
+        andi    t0, v0, RESUME_HOST
+        bnez    t0, __kvm_mips_return_to_host
+         nop
 
 __kvm_mips_return_to_guest:
-    /* Put the saved pointer to vcpu (s1) back into the DDATA_LO Register */
-    mtc0        s1, CP0_DDATA_LO
-
-    /* Load up the Guest EBASE to minimize the window where BEV is set */
-    LONG_L      t0, VCPU_GUEST_EBASE(k1)
-
-    /* Switch EBASE back to the one used by KVM */
-    mfc0        v1, CP0_STATUS
-    .set at
-        or          k0, v1, ST0_BEV
-    .set noat
-    mtc0        k0, CP0_STATUS
-    ehb
-    mtc0        t0,CP0_EBASE
-
-    /* Setup status register for running guest in UM */
-    .set at
-    or     v1, v1, (ST0_EXL | KSU_USER | ST0_IE)
-    and     v1, v1, ~ST0_CU0
-    .set noat
-    mtc0    v1, CP0_STATUS
-    ehb
+        /* Put the saved pointer to vcpu (s1) back into the DDATA_LO Register */
+        mtc0    s1, CP0_DDATA_LO
 
+        /* Load up the Guest EBASE to minimize the window where BEV is set */
+        LONG_L  t0, VCPU_GUEST_EBASE(k1)
+
+        /* Switch EBASE back to the one used by KVM */
+        mfc0    v1, CP0_STATUS
+        .set    at
+        or      k0, v1, ST0_BEV
+        .set    noat
+        mtc0    k0, CP0_STATUS
+        ehb
+        mtc0    t0, CP0_EBASE
+
+        /* Setup status register for running guest in UM */
+        .set    at
+        or      v1, v1, (ST0_EXL | KSU_USER | ST0_IE)
+        and     v1, v1, ~ST0_CU0
+        .set    noat
+        mtc0    v1, CP0_STATUS
+        ehb
 
         /* Set Guest EPC */
-        LONG_L          t0, VCPU_PC(k1)
-        mtc0            t0, CP0_EPC
-
-    /* Set the ASID for the Guest Kernel */
-    sll         t0, t0, 1                       /* with kseg0 @ 0x40000000, kernel */
-                                                /* addresses shift to 0x80000000 */
-    bltz        t0, 1f                          /* If kernel */
-        addiu       t1, k1, VCPU_GUEST_KERNEL_ASID  /* (BD)  */
-    addiu       t1, k1, VCPU_GUEST_USER_ASID    /* else user */
+        LONG_L  t0, VCPU_PC(k1)
+        mtc0    t0, CP0_EPC
+
+        /* Set the ASID for the Guest Kernel */
+        INT_SLL t0, t0, 1       /* with kseg0 @ 0x40000000, kernel */
+                                /* addresses shift to 0x80000000 */
+        bltz    t0, 1f          /* If kernel */
+         INT_ADDIU t1, k1, VCPU_GUEST_KERNEL_ASID  /* (BD)  */
+        INT_ADDIU t1, k1, VCPU_GUEST_USER_ASID    /* else user */
 1:
-    /* t1: contains the base of the ASID array, need to get the cpu id  */
-    LONG_L      t2, TI_CPU($28)             /* smp_processor_id */
-    sll         t2, t2, 2                   /* x4 */
-    addu        t3, t1, t2
-    LONG_L      k0, (t3)
-    andi        k0, k0, 0xff
-        mtc0            k0,CP0_ENTRYHI
-    ehb
-
-    /* Disable RDHWR access */
-    mtc0    zero,  CP0_HWRENA
-
-    /* load the guest context from VCPU and return */
-    LONG_L  $0, VCPU_R0(k1)
-    LONG_L  $1, VCPU_R1(k1)
-    LONG_L  $2, VCPU_R2(k1)
-    LONG_L  $3, VCPU_R3(k1)
-    LONG_L  $4, VCPU_R4(k1)
-    LONG_L  $5, VCPU_R5(k1)
-    LONG_L  $6, VCPU_R6(k1)
-    LONG_L  $7, VCPU_R7(k1)
-    LONG_L  $8, VCPU_R8(k1)
-    LONG_L  $9, VCPU_R9(k1)
-    LONG_L  $10, VCPU_R10(k1)
-    LONG_L  $11, VCPU_R11(k1)
-    LONG_L  $12, VCPU_R12(k1)
-    LONG_L  $13, VCPU_R13(k1)
-    LONG_L  $14, VCPU_R14(k1)
-    LONG_L  $15, VCPU_R15(k1)
-    LONG_L  $16, VCPU_R16(k1)
-    LONG_L  $17, VCPU_R17(k1)
-    LONG_L  $18, VCPU_R18(k1)
-    LONG_L  $19, VCPU_R19(k1)
-    LONG_L  $20, VCPU_R20(k1)
-    LONG_L  $21, VCPU_R21(k1)
-    LONG_L  $22, VCPU_R22(k1)
-    LONG_L  $23, VCPU_R23(k1)
-    LONG_L  $24, VCPU_R24(k1)
-    LONG_L  $25, VCPU_R25(k1)
-
-    /* $/k1 loaded later */
-    LONG_L  $28, VCPU_R28(k1)
-    LONG_L  $29, VCPU_R29(k1)
-    LONG_L  $30, VCPU_R30(k1)
-    LONG_L  $31, VCPU_R31(k1)
+        /* t1: contains the base of the ASID array, need to get the cpu id  */
+        LONG_L  t2, TI_CPU($28)         /* smp_processor_id */
+        INT_SLL t2, t2, 2               /* x4 */
+        REG_ADDU t3, t1, t2
+        LONG_L  k0, (t3)
+        andi    k0, k0, 0xff
+        mtc0    k0,CP0_ENTRYHI
+        ehb
+
+        /* Disable RDHWR access */
+        mtc0    zero,  CP0_HWRENA
+
+        /* load the guest context from VCPU and return */
+        LONG_L  $0, VCPU_R0(k1)
+        LONG_L  $1, VCPU_R1(k1)
+        LONG_L  $2, VCPU_R2(k1)
+        LONG_L  $3, VCPU_R3(k1)
+        LONG_L  $4, VCPU_R4(k1)
+        LONG_L  $5, VCPU_R5(k1)
+        LONG_L  $6, VCPU_R6(k1)
+        LONG_L  $7, VCPU_R7(k1)
+        LONG_L  $8, VCPU_R8(k1)
+        LONG_L  $9, VCPU_R9(k1)
+        LONG_L  $10, VCPU_R10(k1)
+        LONG_L  $11, VCPU_R11(k1)
+        LONG_L  $12, VCPU_R12(k1)
+        LONG_L  $13, VCPU_R13(k1)
+        LONG_L  $14, VCPU_R14(k1)
+        LONG_L  $15, VCPU_R15(k1)
+        LONG_L  $16, VCPU_R16(k1)
+        LONG_L  $17, VCPU_R17(k1)
+        LONG_L  $18, VCPU_R18(k1)
+        LONG_L  $19, VCPU_R19(k1)
+        LONG_L  $20, VCPU_R20(k1)
+        LONG_L  $21, VCPU_R21(k1)
+        LONG_L  $22, VCPU_R22(k1)
+        LONG_L  $23, VCPU_R23(k1)
+        LONG_L  $24, VCPU_R24(k1)
+        LONG_L  $25, VCPU_R25(k1)
+
+        /* $/k1 loaded later */
+        LONG_L  $28, VCPU_R28(k1)
+        LONG_L  $29, VCPU_R29(k1)
+        LONG_L  $30, VCPU_R30(k1)
+        LONG_L  $31, VCPU_R31(k1)
 
 FEXPORT(__kvm_mips_skip_guest_restore)
-    LONG_L  k0, VCPU_HI(k1)
-    mthi    k0
+        LONG_L  k0, VCPU_HI(k1)
+        mthi    k0
 
-    LONG_L  k0, VCPU_LO(k1)
-    mtlo    k0
+        LONG_L  k0, VCPU_LO(k1)
+        mtlo    k0
 
-    LONG_L  k0, VCPU_R26(k1)
-    LONG_L  k1, VCPU_R27(k1)
+        LONG_L  k0, VCPU_R26(k1)
+        LONG_L  k1, VCPU_R27(k1)
 
-    eret
+        eret
 
 __kvm_mips_return_to_host:
-    /* EBASE is already pointing to Linux */
-    LONG_L  k1, VCPU_HOST_STACK(k1)
-        addiu   k1,k1, -PT_SIZE
-
-    /* Restore host DDATA_LO */
-    LONG_L      k0, PT_HOST_USERLOCAL(k1)
-    mtc0        k0, CP0_DDATA_LO
-
-    /* Restore host ASID */
-    LONG_L      k0, PT_HOST_ASID(sp)
-    andi        k0, 0xff
-    mtc0        k0,CP0_ENTRYHI
-    ehb
-
-    /* Load context saved on the host stack */
-    LONG_L  $0, PT_R0(k1)
-    LONG_L  $1, PT_R1(k1)
-
-    /* r2/v0 is the return code, shift it down by 2 (arithmetic) to recover the err code  */
-    sra     k0, v0, 2
-    move    $2, k0
-
-    LONG_L  $3, PT_R3(k1)
-    LONG_L  $4, PT_R4(k1)
-    LONG_L  $5, PT_R5(k1)
-    LONG_L  $6, PT_R6(k1)
-    LONG_L  $7, PT_R7(k1)
-    LONG_L  $8, PT_R8(k1)
-    LONG_L  $9, PT_R9(k1)
-    LONG_L  $10, PT_R10(k1)
-    LONG_L  $11, PT_R11(k1)
-    LONG_L  $12, PT_R12(k1)
-    LONG_L  $13, PT_R13(k1)
-    LONG_L  $14, PT_R14(k1)
-    LONG_L  $15, PT_R15(k1)
-    LONG_L  $16, PT_R16(k1)
-    LONG_L  $17, PT_R17(k1)
-    LONG_L  $18, PT_R18(k1)
-    LONG_L  $19, PT_R19(k1)
-    LONG_L  $20, PT_R20(k1)
-    LONG_L  $21, PT_R21(k1)
-    LONG_L  $22, PT_R22(k1)
-    LONG_L  $23, PT_R23(k1)
-    LONG_L  $24, PT_R24(k1)
-    LONG_L  $25, PT_R25(k1)
-
-    /* Host k0/k1 were not saved */
-
-    LONG_L  $28, PT_R28(k1)
-    LONG_L  $29, PT_R29(k1)
-    LONG_L  $30, PT_R30(k1)
-
-    LONG_L  k0, PT_HI(k1)
-    mthi    k0
-
-    LONG_L  k0, PT_LO(k1)
-    mtlo    k0
-
-    /* Restore RDHWR access */
-    la      k0, 0x2000000F
-    mtc0    k0,  CP0_HWRENA
-
-
-    /* Restore RA, which is the address we will return to */
-    LONG_L  ra, PT_R31(k1)
-    j       ra
-    nop
-
-    .set    pop
+        /* EBASE is already pointing to Linux */
+        LONG_L  k1, VCPU_HOST_STACK(k1)
+        INT_ADDIU k1,k1, -PT_SIZE
+
+        /* Restore host DDATA_LO */
+        LONG_L  k0, PT_HOST_USERLOCAL(k1)
+        mtc0    k0, CP0_DDATA_LO
+
+        /* Restore host ASID */
+        LONG_L  k0, PT_HOST_ASID(sp)
+        andi    k0, 0xff
+        mtc0    k0,CP0_ENTRYHI
+        ehb
+
+        /* Load context saved on the host stack */
+        LONG_L  $0, PT_R0(k1)
+        LONG_L  $1, PT_R1(k1)
+
+        /* r2/v0 is the return code, shift it down by 2 (arithmetic)
+         * to recover the err code  */
+        INT_SRA k0, v0, 2
+        move    $2, k0
+
+        LONG_L  $3, PT_R3(k1)
+        LONG_L  $4, PT_R4(k1)
+        LONG_L  $5, PT_R5(k1)
+        LONG_L  $6, PT_R6(k1)
+        LONG_L  $7, PT_R7(k1)
+        LONG_L  $8, PT_R8(k1)
+        LONG_L  $9, PT_R9(k1)
+        LONG_L  $10, PT_R10(k1)
+        LONG_L  $11, PT_R11(k1)
+        LONG_L  $12, PT_R12(k1)
+        LONG_L  $13, PT_R13(k1)
+        LONG_L  $14, PT_R14(k1)
+        LONG_L  $15, PT_R15(k1)
+        LONG_L  $16, PT_R16(k1)
+        LONG_L  $17, PT_R17(k1)
+        LONG_L  $18, PT_R18(k1)
+        LONG_L  $19, PT_R19(k1)
+        LONG_L  $20, PT_R20(k1)
+        LONG_L  $21, PT_R21(k1)
+        LONG_L  $22, PT_R22(k1)
+        LONG_L  $23, PT_R23(k1)
+        LONG_L  $24, PT_R24(k1)
+        LONG_L  $25, PT_R25(k1)
+
+        /* Host k0/k1 were not saved */
+
+        LONG_L  $28, PT_R28(k1)
+        LONG_L  $29, PT_R29(k1)
+        LONG_L  $30, PT_R30(k1)
+
+        LONG_L  k0, PT_HI(k1)
+        mthi    k0
+
+        LONG_L  k0, PT_LO(k1)
+        mtlo    k0
+
+        /* Restore RDHWR access */
+        PTR_LI  k0, 0x2000000F
+        mtc0    k0,  CP0_HWRENA
+
+
+        /* Restore RA, which is the address we will return to */
+        LONG_L  ra, PT_R31(k1)
+        j       ra
+         nop
+
 VECTOR_END(MIPSX(GuestExceptionEnd))
 .end MIPSX(GuestException)
 
@@ -627,24 +623,23 @@ MIPSX(exceptions):
 
 #define HW_SYNCI_Step       $1
 LEAF(MIPSX(SyncICache))
-    .set    push
+        .set    push
         .set    mips32r2
-    beq     a1, zero, 20f
-    nop
-    addu    a1, a0, a1
-    rdhwr   v0, HW_SYNCI_Step
-    beq     v0, zero, 20f
-    nop
-
+        beq     a1, zero, 20f
+         nop
+        REG_ADDU a1, a0, a1
+        rdhwr   v0, HW_SYNCI_Step
+        beq     v0, zero, 20f
+         nop
 10:
-    synci   0(a0)
-    addu    a0, a0, v0
-    sltu    v1, a0, a1
-    bne     v1, zero, 10b
-    nop
-    sync
+        synci   0(a0)
+        REG_ADDU a0, a0, v0
+        sltu    v1, a0, a1
+        bne     v1, zero, 10b
+         nop
+        sync
 20:
-    jr.hb   ra
-    nop
-    .set pop
+        jr.hb   ra
+         nop
+        .set    pop
 END(MIPSX(SyncICache))
diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c
index dd203e59e6fd..a7b044536de4 100644
--- a/arch/mips/kvm/kvm_mips.c
+++ b/arch/mips/kvm/kvm_mips.c
@@ -208,6 +208,10 @@ int kvm_arch_create_memslot(struct kvm_memory_slot *slot, unsigned long npages)
         return 0;
 }
 
+void kvm_arch_memslots_updated(struct kvm *kvm)
+{
+}
+
 int kvm_arch_prepare_memory_region(struct kvm *kvm,
                                 struct kvm_memory_slot *memslot,
                                 struct kvm_userspace_memory_region *mem,
diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
index e773659ccf9f..46048d24328c 100644
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -803,6 +803,32 @@ static int isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
                                 dec_insn.next_pc_inc;
                 return 1;
                 break;
+#ifdef CONFIG_CPU_CAVIUM_OCTEON
+        case lwc2_op: /* This is bbit0 on Octeon */
+                if ((regs->regs[insn.i_format.rs] & (1ull<<insn.i_format.rt)) == 0)
+                        *contpc = regs->cp0_epc + 4 + (insn.i_format.simmediate << 2);
+                else
+                        *contpc = regs->cp0_epc + 8;
+                return 1;
+        case ldc2_op: /* This is bbit032 on Octeon */
+                if ((regs->regs[insn.i_format.rs] & (1ull<<(insn.i_format.rt + 32))) == 0)
+                        *contpc = regs->cp0_epc + 4 + (insn.i_format.simmediate << 2);
+                else
+                        *contpc = regs->cp0_epc + 8;
+                return 1;
+        case swc2_op: /* This is bbit1 on Octeon */
+                if (regs->regs[insn.i_format.rs] & (1ull<<insn.i_format.rt))
+                        *contpc = regs->cp0_epc + 4 + (insn.i_format.simmediate << 2);
+                else
+                        *contpc = regs->cp0_epc + 8;
+                return 1;
+        case sdc2_op: /* This is bbit132 on Octeon */
+                if (regs->regs[insn.i_format.rs] & (1ull<<(insn.i_format.rt + 32)))
+                        *contpc = regs->cp0_epc + 4 + (insn.i_format.simmediate << 2);
+                else
+                        *contpc = regs->cp0_epc + 8;
+                return 1;
+#endif
         case cop0_op:
         case cop1_op:
         case cop2_op:
diff --git a/arch/mips/oprofile/common.c b/arch/mips/oprofile/common.c
index af763e838fdd..5e5424753b56 100644
--- a/arch/mips/oprofile/common.c
+++ b/arch/mips/oprofile/common.c
@@ -33,7 +33,7 @@ static int op_mips_setup(void)
         return 0;
 }
 
-static int op_mips_create_files(struct super_block *sb, struct dentry *root)
+static int op_mips_create_files(struct dentry *root)
 {
         int i;
 
@@ -42,16 +42,16 @@ static int op_mips_create_files(struct super_block *sb, struct dentry *root)
                 char buf[4];
 
                 snprintf(buf, sizeof buf, "%d", i);
-                dir = oprofilefs_mkdir(sb, root, buf);
-
-                oprofilefs_create_ulong(sb, dir, "enabled", &ctr[i].enabled);
-                oprofilefs_create_ulong(sb, dir, "event", &ctr[i].event);
-                oprofilefs_create_ulong(sb, dir, "count", &ctr[i].count);
-                oprofilefs_create_ulong(sb, dir, "kernel", &ctr[i].kernel);
-                oprofilefs_create_ulong(sb, dir, "user", &ctr[i].user);
-                oprofilefs_create_ulong(sb, dir, "exl", &ctr[i].exl);
+                dir = oprofilefs_mkdir(root, buf);
+
+                oprofilefs_create_ulong(dir, "enabled", &ctr[i].enabled);
+                oprofilefs_create_ulong(dir, "event", &ctr[i].event);
+                oprofilefs_create_ulong(dir, "count", &ctr[i].count);
+                oprofilefs_create_ulong(dir, "kernel", &ctr[i].kernel);
+                oprofilefs_create_ulong(dir, "user", &ctr[i].user);
+                oprofilefs_create_ulong(dir, "exl", &ctr[i].exl);
                 /* Dummy.  */
-                oprofilefs_create_ulong(sb, dir, "unit_mask", &ctr[i].unit_mask);
+                oprofilefs_create_ulong(dir, "unit_mask", &ctr[i].unit_mask);
         }
 
         return 0;
diff --git a/arch/mips/oprofile/op_model_mipsxx.c b/arch/mips/oprofile/op_model_mipsxx.c
index e4b1140cdae0..3a2b6e9f25cf 100644
--- a/arch/mips/oprofile/op_model_mipsxx.c
+++ b/arch/mips/oprofile/op_model_mipsxx.c
@@ -166,7 +166,7 @@ static void mipsxx_reg_setup(struct op_counter_config *ctr)
                         reg.control[i] |= M_PERFCTL_USER;
                 if (ctr[i].exl)
                         reg.control[i] |= M_PERFCTL_EXL;
-                if (current_cpu_type() == CPU_XLR)
+                if (boot_cpu_type() == CPU_XLR)
                         reg.control[i] |= M_PERFCTL_COUNT_ALL_THREADS;
                 reg.counter[i] = 0x80000000 - ctr[i].count;
         }
diff --git a/arch/mips/pci/pci.c b/arch/mips/pci/pci.c
index 594e60d6a43b..33e7aa52d9c4 100644
--- a/arch/mips/pci/pci.c
+++ b/arch/mips/pci/pci.c
@@ -113,7 +113,6 @@ static void pcibios_scanbus(struct pci_controller *hose)
                 if (!pci_has_flag(PCI_PROBE_ONLY)) {
                         pci_bus_size_bridges(bus);
                         pci_bus_assign_resources(bus);
-                        pci_enable_bridges(bus);
                 }
         }
 }
diff --git a/arch/mips/pnx833x/common/platform.c b/arch/mips/pnx833x/common/platform.c
index d22dc0d6f289..2b7e837dc2e2 100644
--- a/arch/mips/pnx833x/common/platform.c
+++ b/arch/mips/pnx833x/common/platform.c
@@ -206,11 +206,13 @@ static struct resource pnx833x_ethernet_resources[] = {
                 .end   = PNX8335_IP3902_PORTS_END,
                 .flags = IORESOURCE_MEM,
         },
+#ifdef CONFIG_SOC_PNX8335
         [1] = {
                 .start = PNX8335_PIC_ETHERNET_INT,
                 .end   = PNX8335_PIC_ETHERNET_INT,
                 .flags = IORESOURCE_IRQ,
         },
+#endif
 };
 
 static struct platform_device pnx833x_ethernet_device = {
diff --git a/arch/mips/sni/a20r.c b/arch/mips/sni/a20r.c
index dd0ab982d77e..f9407e170476 100644
--- a/arch/mips/sni/a20r.c
+++ b/arch/mips/sni/a20r.c
@@ -122,7 +122,6 @@ static struct resource sc26xx_rsrc[] = {
 
 static struct sccnxp_pdata sccnxp_data = {
         .reg_shift      = 2,
-        .frequency      = 3686400,
         .mctrl_cfg[0]   = MCTRL_SIG(DTR_OP, LINE_OP7) |
                           MCTRL_SIG(RTS_OP, LINE_OP3) |
                           MCTRL_SIG(DSR_IP, LINE_IP5) |
diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig
index 99dbab1c59ac..d60bf98fa5cf 100644
--- a/arch/openrisc/Kconfig
+++ b/arch/openrisc/Kconfig
@@ -55,6 +55,7 @@ config GENERIC_CSUM
 
 source "init/Kconfig"
 
+source "kernel/Kconfig.freezer"
 
 menu "Processor type and features"
 
diff --git a/arch/openrisc/include/asm/prom.h b/arch/openrisc/include/asm/prom.h
index bbb34e5343a2..eb59bfe23e85 100644
--- a/arch/openrisc/include/asm/prom.h
+++ b/arch/openrisc/include/asm/prom.h
@@ -44,9 +44,6 @@ void of_parse_dma_window(struct device_node *dn, const void *dma_window_prop,
 
 extern void kdump_move_device_tree(void);
 
-/* CPU OF node matching */
-struct device_node *of_get_cpu_node(int cpu, unsigned int *thread);
-
 /* Get the MAC address */
 extern const void *of_get_mac_address(struct device_node *np);
 
diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
index 07349b002687..1cba8f29bb49 100644
--- a/arch/parisc/kernel/signal.c
+++ b/arch/parisc/kernel/signal.c
@@ -78,7 +78,7 @@ restore_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs)
         err |= __copy_from_user(regs->iaoq, sc->sc_iaoq, sizeof(regs->iaoq));
         err |= __copy_from_user(regs->iasq, sc->sc_iasq, sizeof(regs->iasq));
         err |= __get_user(regs->sar, &sc->sc_sar);
-        DBG(2,"restore_sigcontext: iaoq is 0x%#lx / 0x%#lx\n", 
+        DBG(2,"restore_sigcontext: iaoq is %#lx / %#lx\n",
                         regs->iaoq[0],regs->iaoq[1]);
         DBG(2,"restore_sigcontext: r28 is %ld\n", regs->gr[28]);
         return err;
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 3bf72cd2c8fc..a4e3a93bf2d4 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -312,6 +312,26 @@ config MATH_EMULATION
           such as fsqrt on cores that do have an FPU but do not implement
           them (such as Freescale BookE).
 
+choice
+        prompt "Math emulation options"
+        default MATH_EMULATION_FULL
+        depends on MATH_EMULATION
+
+config  MATH_EMULATION_FULL
+        bool "Emulate all the floating point instructions"
+        ---help---
+          Select this option will enable the kernel to support to emulate
+          all the floating point instructions. If your SoC doesn't have
+          a FPU, you should select this.
+
+config MATH_EMULATION_HW_UNIMPLEMENTED
+        bool "Just emulate the FPU unimplemented instructions"
+        ---help---
+          Select this if you know there does have a hardware FPU on your
+          SoC, but some floating point instructions are not implemented by that.
+
+endchoice
+
 config PPC_TRANSACTIONAL_MEM
        bool "Transactional Memory support for POWERPC"
        depends on PPC_BOOK3S_64
@@ -369,9 +389,9 @@ config KEXEC
 
           It is an ongoing process to be certain the hardware in a machine
           is properly shutdown, so do not be surprised if this code does not
-          initially work for you.  It may help to enable device hotplugging
-          support.  As of this writing the exact hardware interface is
-          strongly in flux, so no good recommendation can be made.
+          initially work for you.  As of this writing the exact hardware
+          interface is strongly in flux, so no good recommendation can be
+          made.
 
 config CRASH_DUMP
         bool "Build a kdump crash kernel"
@@ -566,7 +586,7 @@ config SCHED_SMT
 config PPC_DENORMALISATION
         bool "PowerPC denormalisation exception handling"
         depends on PPC_BOOK3S_64
-        default "n"
+        default "y" if PPC_POWERNV
         ---help---
           Add support for handling denormalisation of single precision
           values.  Useful for bare metal only.  If unsure say Y here.
@@ -979,6 +999,7 @@ config RELOCATABLE
           must live at a different physical address than the primary
           kernel.
 
+# This value must have zeroes in the bottom 60 bits otherwise lots will break
 config PAGE_OFFSET
         hex
         default "0xc000000000000000"
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 967fd23ace78..51cfb78d4061 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -88,13 +88,30 @@ CFLAGS-$(CONFIG_PPC64)	+= $(call cc-option,-mcmodel=medium,-mminimal-toc)
 CFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mno-pointers-to-nested-functions)
 CFLAGS-$(CONFIG_PPC32)  := -ffixed-r2 -mmultiple
 
+ifeq ($(CONFIG_PPC_BOOK3S_64),y)
 CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power7,-mtune=power4)
+else
+CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=powerpc64
+endif
+
 CFLAGS-$(CONFIG_CELL_CPU) += $(call cc-option,-mcpu=cell)
 CFLAGS-$(CONFIG_POWER4_CPU) += $(call cc-option,-mcpu=power4)
 CFLAGS-$(CONFIG_POWER5_CPU) += $(call cc-option,-mcpu=power5)
 CFLAGS-$(CONFIG_POWER6_CPU) += $(call cc-option,-mcpu=power6)
 CFLAGS-$(CONFIG_POWER7_CPU) += $(call cc-option,-mcpu=power7)
 
+E5500_CPU := $(call cc-option,-mcpu=e500mc64,-mcpu=powerpc64)
+CFLAGS-$(CONFIG_E5500_CPU) += $(E5500_CPU)
+CFLAGS-$(CONFIG_E6500_CPU) += $(call cc-option,-mcpu=e6500,$(E5500_CPU))
+
+ifeq ($(CONFIG_PPC32),y)
+ifeq ($(CONFIG_PPC_E500MC),y)
+CFLAGS-y += $(call cc-option,-mcpu=e500mc,-mcpu=powerpc)
+else
+CFLAGS-$(CONFIG_E500) += $(call cc-option,-mcpu=8540 -msoft-float,-mcpu=powerpc)
+endif
+endif
+
 CFLAGS-$(CONFIG_TUNE_CELL) += $(call cc-option,-mtune=cell)
 
 KBUILD_CPPFLAGS += -Iarch/$(ARCH)
@@ -139,7 +156,6 @@ endif
 
 cpu-as-$(CONFIG_4xx)            += -Wa,-m405
 cpu-as-$(CONFIG_ALTIVEC)        += -Wa,-maltivec
-cpu-as-$(CONFIG_E500)           += -Wa,-me500
 cpu-as-$(CONFIG_E200)           += -Wa,-me200
 
 KBUILD_AFLAGS += $(cpu-as-y)
diff --git a/arch/powerpc/boot/.gitignore b/arch/powerpc/boot/.gitignore
index c32ae5ce9fff..554734ff302e 100644
--- a/arch/powerpc/boot/.gitignore
+++ b/arch/powerpc/boot/.gitignore
@@ -22,6 +22,7 @@ zImage.initrd
 zImage.bin.*
 zImage.chrp
 zImage.coff
+zImage.epapr
 zImage.holly
 zImage.*lds
 zImage.miboot
diff --git a/arch/powerpc/boot/dts/ac14xx.dts b/arch/powerpc/boot/dts/ac14xx.dts
index a27a4609bb42..a543c4088cba 100644
--- a/arch/powerpc/boot/dts/ac14xx.dts
+++ b/arch/powerpc/boot/dts/ac14xx.dts
@@ -10,7 +10,7 @@
  */
 
 
-/include/ "mpc5121.dtsi"
+#include <mpc5121.dtsi>
 
 / {
         model = "ac14xx";
diff --git a/arch/powerpc/boot/dts/b4420qds.dts b/arch/powerpc/boot/dts/b4420qds.dts
index 923156d03b30..508dbdf33c81 100644
--- a/arch/powerpc/boot/dts/b4420qds.dts
+++ b/arch/powerpc/boot/dts/b4420qds.dts
@@ -33,7 +33,7 @@
  */
 
 /include/ "fsl/b4420si-pre.dtsi"
-/include/ "b4qds.dts"
+/include/ "b4qds.dtsi"
 
 / {
         model = "fsl,B4420QDS";
diff --git a/arch/powerpc/boot/dts/b4860qds.dts b/arch/powerpc/boot/dts/b4860qds.dts
index 78907f38bb77..6bb3707ffe3d 100644
--- a/arch/powerpc/boot/dts/b4860qds.dts
+++ b/arch/powerpc/boot/dts/b4860qds.dts
@@ -33,7 +33,7 @@
  */
 
 /include/ "fsl/b4860si-pre.dtsi"
-/include/ "b4qds.dts"
+/include/ "b4qds.dtsi"
 
 / {
         model = "fsl,B4860QDS";
diff --git a/arch/powerpc/boot/dts/b4qds.dts b/arch/powerpc/boot/dts/b4qds.dtsi
index e6d2f8f90544..e6d2f8f90544 100644
--- a/arch/powerpc/boot/dts/b4qds.dts
+++ b/arch/powerpc/boot/dts/b4qds.dtsi
diff --git a/arch/powerpc/boot/dts/c293pcie.dts b/arch/powerpc/boot/dts/c293pcie.dts
new file mode 100644
index 000000000000..1238bda8901f
--- /dev/null
+++ b/arch/powerpc/boot/dts/c293pcie.dts
@@ -0,0 +1,223 @@
+/*
+ * C293 PCIE Device Tree Source
+ *
+ * Copyright 2013 Freescale Semiconductor Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Freescale Semiconductor nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/include/ "fsl/c293si-pre.dtsi"
+
+/ {
+        model = "fsl,C293PCIE";
+        compatible = "fsl,C293PCIE";
+
+        memory {
+                device_type = "memory";
+        };
+
+        ifc: ifc@fffe1e000 {
+                reg = <0xf 0xffe1e000 0 0x2000>;
+                ranges = <0x0 0x0 0xf 0xec000000 0x04000000
+                          0x2 0x0 0xf 0xffdf0000 0x00010000>;
+
+        };
+
+        soc: soc@fffe00000 {
+                ranges = <0x0 0xf 0xffe00000 0x100000>;
+        };
+
+        pci0: pcie@fffe0a000 {
+                reg = <0xf 0xffe0a000 0 0x1000>;
+                ranges = <0x2000000 0x0 0x80000000 0xc 0x00000000 0x0 0x20000000
+                          0x1000000 0x0 0x00000000 0xf 0xffc00000 0x0 0x10000>;
+                pcie@0 {
+                        ranges = <0x2000000 0x0 0x80000000
+                                  0x2000000 0x0 0x80000000
+                                  0x0 0x20000000
+
+                                  0x1000000 0x0 0x0
+                                  0x1000000 0x0 0x0
+                                  0x0 0x100000>;
+                };
+        };
+};
+
+&ifc {
+        nor@0,0 {
+                #address-cells = <1>;
+                #size-cells = <1>;
+                compatible = "cfi-flash";
+                reg = <0x0 0x0 0x4000000>;
+                bank-width = <2>;
+                device-width = <1>;
+
+                partition@0 {
+                        /* 1MB for DTB Image */
+                        reg = <0x0 0x00100000>;
+                        label = "NOR DTB Image";
+                };
+
+                partition@100000 {
+                        /* 8 MB for Linux Kernel Image */
+                        reg = <0x00100000 0x00800000>;
+                        label = "NOR Linux Kernel Image";
+                };
+
+                partition@900000 {
+                        /* 53MB for rootfs */
+                        reg = <0x00900000 0x03500000>;
+                        label = "NOR Rootfs Image";
+                };
+
+                partition@3e00000 {
+                        /* 1MB for blob encrypted key */
+                        reg = <0x03e00000 0x00100000>;
+                        label = "NOR blob encrypted key";
+                };
+
+                partition@3f00000 {
+                        /* 512KB for u-boot Bootloader Image and evn */
+                        reg = <0x03f00000 0x00100000>;
+                        label = "NOR U-Boot Image";
+                        read-only;
+                };
+        };
+
+        nand@1,0 {
+                #address-cells = <1>;
+                #size-cells = <1>;
+                compatible = "fsl,ifc-nand";
+                reg = <0x1 0x0 0x10000>;
+
+                partition@0 {
+                        /* This location must not be altered  */
+                        /* 1MB for u-boot Bootloader Image */
+                        reg = <0x0 0x00100000>;
+                        label = "NAND U-Boot Image";
+                        read-only;
+                };
+
+                partition@100000 {
+                        /* 1MB for DTB Image */
+                        reg = <0x00100000 0x00100000>;
+                        label = "NAND DTB Image";
+                };
+
+                partition@200000 {
+                        /* 16MB for Linux Kernel Image */
+                        reg = <0x00200000 0x01000000>;
+                        label = "NAND Linux Kernel Image";
+                };
+
+                partition@1200000 {
+                        /* 4078MB for Root file System Image */
+                        reg = <0x00600000 0xfee00000>;
+                        label = "NAND RFS Image";
+                };
+        };
+
+        cpld@2,0 {
+                compatible = "fsl,c293pcie-cpld";
+                reg = <0x2 0x0 0x20>;
+        };
+};
+
+&soc {
+        i2c@3000 {
+                eeprom@50 {
+                        compatible = "st,24c1024";
+                        reg = <0x50>;
+                };
+
+                adt7461@4c {
+                        compatible = "adi,adt7461";
+                        reg = <0x4c>;
+                };
+        };
+
+        spi@7000 {
+                flash@0 {
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        compatible = "spansion,s25sl12801";
+                        reg = <0>;
+                        spi-max-frequency = <50000000>;
+
+                        partition@0 {
+                                /* 1MB for u-boot Bootloader Image */
+                                /* 1MB for Environment */
+                                reg = <0x0 0x00100000>;
+                                label = "SPI Flash U-Boot Image";
+                                read-only;
+                        };
+
+                        partition@100000 {
+                                /* 512KB for DTB Image */
+                                reg = <0x00100000 0x00080000>;
+                                label = "SPI Flash DTB Image";
+                        };
+
+                        partition@180000 {
+                                /* 4MB for Linux Kernel Image */
+                                reg = <0x00180000 0x00400000>;
+                                label = "SPI Flash Linux Kernel Image";
+                        };
+
+                        partition@580000 {
+                                /* 10.5MB for RFS Image */
+                                reg = <0x00580000 0x00a80000>;
+                                label = "SPI Flash RFS Image";
+                        };
+                };
+        };
+
+        mdio@24000 {
+                phy0: ethernet-phy@0 {
+                        interrupts = <2 1 0 0>;
+                        reg = <0x0>;
+                };
+
+                phy1: ethernet-phy@1 {
+                        interrupts = <2 1 0 0>;
+                        reg = <0x2>;
+                };
+        };
+
+        enet0: ethernet@b0000 {
+                phy-handle = <&phy0>;
+                phy-connection-type = "rgmii-id";
+        };
+
+        enet1: ethernet@b1000 {
+                phy-handle = <&phy1>;
+                phy-connection-type = "rgmii-id";
+        };
+};
+/include/ "fsl/c293si-post.dtsi"
diff --git a/arch/powerpc/boot/dts/fsl/b4si-post.dtsi b/arch/powerpc/boot/dts/fsl/b4si-post.dtsi
index 73991547c69b..4c617bf8cdb2 100644
--- a/arch/powerpc/boot/dts/fsl/b4si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/b4si-post.dtsi
@@ -204,7 +204,7 @@
                 };
         };
 
-/include/ "qoriq-mpic.dtsi"
+/include/ "qoriq-mpic4.3.dtsi"
 
         guts: global-utilities@e0000 {
                 compatible = "fsl,b4-device-config";
diff --git a/arch/powerpc/boot/dts/fsl/c293si-post.dtsi b/arch/powerpc/boot/dts/fsl/c293si-post.dtsi
new file mode 100644
index 000000000000..bd208320bff5
--- /dev/null
+++ b/arch/powerpc/boot/dts/fsl/c293si-post.dtsi
@@ -0,0 +1,193 @@
+/*
+ * C293 Silicon/SoC Device Tree Source (post include)
+ *
+ * Copyright 2012 Freescale Semiconductor Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Freescale Semiconductor nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+&ifc {
+        #address-cells = <2>;
+        #size-cells = <1>;
+        compatible = "fsl,ifc", "simple-bus";
+        interrupts = <19 2 0 0>;
+};
+
+/* controller at 0xa000 */
+&pci0 {
+        compatible = "fsl,qoriq-pcie-v2.2", "fsl,qoriq-pcie";
+        device_type = "pci";
+        #size-cells = <2>;
+        #address-cells = <3>;
+        bus-range = <0 255>;
+        clock-frequency = <33333333>;
+        interrupts = <16 2 0 0>;
+
+        pcie@0 {
+                reg = <0 0 0 0 0>;
+                #interrupt-cells = <1>;
+                #size-cells = <2>;
+                #address-cells = <3>;
+                device_type = "pci";
+                interrupts = <16 2 0 0>;
+                interrupt-map-mask = <0xf800 0 0 7>;
+                interrupt-map = <
+                        /* IDSEL 0x0 */
+                        0000 0x0 0x0 0x1 &mpic 0x0 0x1 0x0 0x0
+                        0000 0x0 0x0 0x2 &mpic 0x1 0x1 0x0 0x0
+                        0000 0x0 0x0 0x3 &mpic 0x2 0x1 0x0 0x0
+                        0000 0x0 0x0 0x4 &mpic 0x3 0x1 0x0 0x0
+                        >;
+        };
+};
+
+&soc {
+        #address-cells = <1>;
+        #size-cells = <1>;
+        device_type = "soc";
+        compatible = "simple-bus";
+        bus-frequency = <0>;            // Filled out by uboot.
+
+        ecm-law@0 {
+                compatible = "fsl,ecm-law";
+                reg = <0x0 0x1000>;
+                fsl,num-laws = <12>;
+        };
+
+        ecm@1000 {
+                compatible = "fsl,c293-ecm", "fsl,ecm";
+                reg = <0x1000 0x1000>;
+                interrupts = <16 2 0 0>;
+        };
+
+        memory-controller@2000 {
+                compatible = "fsl,c293-memory-controller";
+                reg = <0x2000 0x1000>;
+                interrupts = <16 2 0 0>;
+        };
+
+/include/ "pq3-i2c-0.dtsi"
+/include/ "pq3-i2c-1.dtsi"
+/include/ "pq3-duart-0.dtsi"
+/include/ "pq3-espi-0.dtsi"
+        spi0: spi@7000 {
+                fsl,espi-num-chipselects = <1>;
+        };
+
+/include/ "pq3-gpio-0.dtsi"
+        L2: l2-cache-controller@20000 {
+                compatible = "fsl,c293-l2-cache-controller";
+                reg = <0x20000 0x1000>;
+                cache-line-size = <32>; // 32 bytes
+                cache-size = <0x80000>; // L2,512K
+                interrupts = <16 2 0 0>;
+        };
+
+/include/ "pq3-dma-0.dtsi"
+/include/ "pq3-esdhc-0.dtsi"
+        sdhc@2e000 {
+                compatible = "fsl,c293-esdhc", "fsl,esdhc";
+                sdhci,auto-cmd12;
+        };
+
+        crypto@80000 {
+/include/ "qoriq-sec6.0-0.dtsi"
+        };
+
+        crypto@80000 {
+                reg = <0x80000 0x20000>;
+                ranges = <0x0 0x80000 0x20000>;
+
+                jr@1000{
+                        interrupts = <45 2 0 0>;
+                };
+                jr@2000{
+                        interrupts = <57 2 0 0>;
+                };
+        };
+
+        crypto@a0000 {
+/include/ "qoriq-sec6.0-0.dtsi"
+        };
+
+        crypto@a0000 {
+                reg = <0xa0000 0x20000>;
+                ranges = <0x0 0xa0000 0x20000>;
+
+                jr@1000{
+                        interrupts = <49 2 0 0>;
+                };
+                jr@2000{
+                        interrupts = <50 2 0 0>;
+                };
+        };
+
+        crypto@c0000 {
+/include/ "qoriq-sec6.0-0.dtsi"
+        };
+
+        crypto@c0000 {
+                reg = <0xc0000 0x20000>;
+                ranges = <0x0 0xc0000 0x20000>;
+
+                jr@1000{
+                        interrupts = <55 2 0 0>;
+                };
+                jr@2000{
+                        interrupts = <56 2 0 0>;
+                };
+        };
+
+/include/ "pq3-mpic.dtsi"
+/include/ "pq3-mpic-timer-B.dtsi"
+
+/include/ "pq3-etsec2-0.dtsi"
+        enet0: ethernet@b0000 {
+                queue-group@b0000 {
+                        reg = <0x10000 0x1000>;
+                        fsl,rx-bit-map = <0xff>;
+                        fsl,tx-bit-map = <0xff>;
+                };
+        };
+
+/include/ "pq3-etsec2-1.dtsi"
+        enet1: ethernet@b1000 {
+                queue-group@b1000 {
+                        reg = <0x11000 0x1000>;
+                        fsl,rx-bit-map = <0xff>;
+                        fsl,tx-bit-map = <0xff>;
+                };
+        };
+
+        global-utilities@e0000 {
+                compatible = "fsl,c293-guts";
+                reg = <0xe0000 0x1000>;
+                fsl,has-rstcr;
+        };
+};
diff --git a/arch/powerpc/boot/dts/fsl/c293si-pre.dtsi b/arch/powerpc/boot/dts/fsl/c293si-pre.dtsi
new file mode 100644
index 000000000000..065049d76245
--- /dev/null
+++ b/arch/powerpc/boot/dts/fsl/c293si-pre.dtsi
@@ -0,0 +1,63 @@
+/*
+ * C293 Silicon/SoC Device Tree Source (pre include)
+ *
+ * Copyright 2012 Freescale Semiconductor Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Freescale Semiconductor nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/dts-v1/;
+
+/include/ "e500v2_power_isa.dtsi"
+
+/ {
+        compatible = "fsl,C293";
+        #address-cells = <2>;
+        #size-cells = <2>;
+        interrupt-parent = <&mpic>;
+
+        aliases {
+                serial0 = &serial0;
+                serial1 = &serial1;
+                ethernet0 = &enet0;
+                ethernet1 = &enet1;
+                pci0 = &pci0;
+        };
+
+        cpus {
+                #address-cells = <1>;
+                #size-cells = <0>;
+
+                PowerPC,e500v2@0 {
+                        device_type = "cpu";
+                        reg = <0x0>;
+                        next-level-cache = <&L2>;
+                };
+        };
+};
diff --git a/arch/powerpc/boot/dts/fsl/qoriq-mpic4.3.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-mpic4.3.dtsi
new file mode 100644
index 000000000000..64f713c24825
--- /dev/null
+++ b/arch/powerpc/boot/dts/fsl/qoriq-mpic4.3.dtsi
@@ -0,0 +1,149 @@
+/*
+ * QorIQ MPIC device tree stub [ controller @ offset 0x40000 ]
+ *
+ * Copyright 2013 Freescale Semiconductor Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Freescale Semiconductor nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+mpic: pic@40000 {
+        interrupt-controller;
+        #address-cells = <0>;
+        #interrupt-cells = <4>;
+        reg = <0x40000 0x40000>;
+        compatible = "fsl,mpic";
+        device_type = "open-pic";
+        clock-frequency = <0x0>;
+};
+
+timer@41100 {
+        compatible = "fsl,mpic-global-timer";
+        reg = <0x41100 0x100 0x41300 4>;
+        interrupts = <0 0 3 0
+                      1 0 3 0
+                      2 0 3 0
+                      3 0 3 0>;
+};
+
+msi0: msi@41600 {
+        compatible = "fsl,mpic-msi-v4.3";
+        reg = <0x41600 0x200 0x44148 4>;
+        interrupts = <
+                0xe0 0 0 0
+                0xe1 0 0 0
+                0xe2 0 0 0
+                0xe3 0 0 0
+                0xe4 0 0 0
+                0xe5 0 0 0
+                0xe6 0 0 0
+                0xe7 0 0 0
+                0x100 0 0 0
+                0x101 0 0 0
+                0x102 0 0 0
+                0x103 0 0 0
+                0x104 0 0 0
+                0x105 0 0 0
+                0x106 0 0 0
+                0x107 0 0 0>;
+};
+
+msi1: msi@41800 {
+        compatible = "fsl,mpic-msi-v4.3";
+        reg = <0x41800 0x200 0x45148 4>;
+        interrupts = <
+                0xe8 0 0 0
+                0xe9 0 0 0
+                0xea 0 0 0
+                0xeb 0 0 0
+                0xec 0 0 0
+                0xed 0 0 0
+                0xee 0 0 0
+                0xef 0 0 0
+                0x108 0 0 0
+                0x109 0 0 0
+                0x10a 0 0 0
+                0x10b 0 0 0
+                0x10c 0 0 0
+                0x10d 0 0 0
+                0x10e 0 0 0
+                0x10f 0 0 0>;
+};
+
+msi2: msi@41a00 {
+        compatible = "fsl,mpic-msi-v4.3";
+        reg = <0x41a00 0x200 0x46148 4>;
+        interrupts = <
+                0xf0 0 0 0
+                0xf1 0 0 0
+                0xf2 0 0 0
+                0xf3 0 0 0
+                0xf4 0 0 0
+                0xf5 0 0 0
+                0xf6 0 0 0
+                0xf7 0 0 0
+                0x110 0 0 0
+                0x111 0 0 0
+                0x112 0 0 0
+                0x113 0 0 0
+                0x114 0 0 0
+                0x115 0 0 0
+                0x116 0 0 0
+                0x117 0 0 0>;
+};
+
+msi3: msi@41c00 {
+        compatible = "fsl,mpic-msi-v4.3";
+        reg = <0x41c00 0x200 0x47148 4>;
+        interrupts = <
+                0xf8 0 0 0
+                0xf9 0 0 0
+                0xfa 0 0 0
+                0xfb 0 0 0
+                0xfc 0 0 0
+                0xfd 0 0 0
+                0xfe 0 0 0
+                0xff 0 0 0
+                0x118 0 0 0
+                0x119 0 0 0
+                0x11a 0 0 0
+                0x11b 0 0 0
+                0x11c 0 0 0
+                0x11d 0 0 0
+                0x11e 0 0 0
+                0x11f 0 0 0>;
+};
+
+timer@42100 {
+        compatible = "fsl,mpic-global-timer";
+        reg = <0x42100 0x100 0x42300 4>;
+        interrupts = <4 0 3 0
+                      5 0 3 0
+                      6 0 3 0
+                      7 0 3 0>;
+};
diff --git a/arch/powerpc/boot/dts/fsl/qoriq-sec6.0-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-sec6.0-0.dtsi
new file mode 100644
index 000000000000..f75b4f820c3c
--- /dev/null
+++ b/arch/powerpc/boot/dts/fsl/qoriq-sec6.0-0.dtsi
@@ -0,0 +1,56 @@
+/*
+ * QorIQ Sec/Crypto 6.0 device tree stub
+ *
+ * Copyright 2013 Freescale Semiconductor Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Freescale Semiconductor nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+        compatible = "fsl,sec-v6.0";
+        fsl,sec-era = <6>;
+        #address-cells = <1>;
+        #size-cells = <1>;
+
+        jr@1000 {
+                compatible = "fsl,sec-v6.0-job-ring",
+                             "fsl,sec-v5.2-job-ring",
+                             "fsl,sec-v5.0-job-ring",
+                             "fsl,sec-v4.4-job-ring",
+                             "fsl,sec-v4.0-job-ring";
+                reg        = <0x1000 0x1000>;
+        };
+
+        jr@2000 {
+                compatible = "fsl,sec-v6.0-job-ring",
+                             "fsl,sec-v5.2-job-ring",
+                             "fsl,sec-v5.0-job-ring",
+                             "fsl,sec-v4.4-job-ring",
+                             "fsl,sec-v4.0-job-ring";
+                reg        = <0x2000 0x1000>;
+        };
diff --git a/arch/powerpc/boot/dts/fsl/t4240si-post.dtsi b/arch/powerpc/boot/dts/fsl/t4240si-post.dtsi
index bd611a9cad32..510afa362de1 100644
--- a/arch/powerpc/boot/dts/fsl/t4240si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/t4240si-post.dtsi
@@ -358,7 +358,7 @@
                         16 2 1 30>;
         };
 
-/include/ "qoriq-mpic.dtsi"
+/include/ "qoriq-mpic4.3.dtsi"
 
         guts: global-utilities@e0000 {
                 compatible = "fsl,t4240-device-config", "fsl,qoriq-device-config-2.0";
diff --git a/arch/powerpc/boot/dts/include/dt-bindings b/arch/powerpc/boot/dts/include/dt-bindings
new file mode 120000
index 000000000000..08c00e4972fa
--- /dev/null
+++ b/arch/powerpc/boot/dts/include/dt-bindings
@@ -0,0 +1 @@
+../../../../../include/dt-bindings
\ No newline at end of file
diff --git a/arch/powerpc/boot/dts/mpc5121ads.dts b/arch/powerpc/boot/dts/mpc5121ads.dts
index 7d3cb79185cb..c228a0a232a6 100644
--- a/arch/powerpc/boot/dts/mpc5121ads.dts
+++ b/arch/powerpc/boot/dts/mpc5121ads.dts
@@ -9,7 +9,7 @@
  * option) any later version.
  */
 
-/include/ "mpc5121.dtsi"
+#include <mpc5121.dtsi>
 
 / {
         model = "mpc5121ads";
diff --git a/arch/powerpc/boot/dts/p1020rdb-pd.dts b/arch/powerpc/boot/dts/p1020rdb-pd.dts
new file mode 100644
index 000000000000..987017ea36b6
--- /dev/null
+++ b/arch/powerpc/boot/dts/p1020rdb-pd.dts
@@ -0,0 +1,280 @@
+/*
+ * P1020 RDB-PD Device Tree Source (32-bit address map)
+ *
+ * Copyright 2013 Freescale Semiconductor Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Freescale Semiconductor nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/include/ "fsl/p1020si-pre.dtsi"
+/ {
+        model = "fsl,P1020RDB-PD";
+        compatible = "fsl,P1020RDB-PD";
+
+        memory {
+                device_type = "memory";
+        };
+
+        lbc: localbus@ffe05000 {
+                reg = <0x0 0xffe05000 0x0 0x1000>;
+
+                /* NOR, NAND flash, L2 switch and CPLD */
+                ranges = <0x0 0x0 0x0 0xec000000 0x04000000
+                          0x1 0x0 0x0 0xff800000 0x00040000
+                          0x2 0x0 0x0 0xffa00000 0x00020000
+                          0x3 0x0 0x0 0xffb00000 0x00020000>;
+
+                nor@0,0 {
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        compatible = "cfi-flash";
+                        reg = <0x0 0x0 0x4000000>;
+                        bank-width = <2>;
+                        device-width = <1>;
+
+                        partition@0 {
+                                /* 128KB for DTB Image */
+                                reg = <0x0 0x00020000>;
+                                label = "NOR DTB Image";
+                        };
+
+                        partition@20000 {
+                                /* 3.875 MB for Linux Kernel Image */
+                                reg = <0x00020000 0x003e0000>;
+                                label = "NOR Linux Kernel Image";
+                        };
+
+                        partition@400000 {
+                                /* 58MB for Root file System */
+                                reg = <0x00400000 0x03a00000>;
+                                label = "NOR Root File System";
+                        };
+
+                        partition@3e00000 {
+                                /* This location must not be altered  */
+                                /* 1M for Vitesse 7385 Switch firmware */
+                                reg = <0x3e00000 0x00100000>;
+                                label = "NOR Vitesse-7385 Firmware";
+                                read-only;
+                        };
+
+                        partition@3f00000 {
+                                /* This location must not be altered  */
+                                /* 512KB for u-boot Bootloader Image */
+                                /* 512KB for u-boot Environment Variables */
+                                reg = <0x03f00000 0x00100000>;
+                                label = "NOR U-Boot Image";
+                                read-only;
+                        };
+                };
+
+                nand@1,0 {
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        compatible = "fsl,p1020-fcm-nand",
+                                     "fsl,elbc-fcm-nand";
+                        reg = <0x1 0x0 0x40000>;
+
+                        partition@0 {
+                                /* This location must not be altered  */
+                                /* 1MB for u-boot Bootloader Image */
+                                reg = <0x0 0x00100000>;
+                                label = "NAND U-Boot Image";
+                                read-only;
+                        };
+
+                        partition@100000 {
+                                /* 1MB for DTB Image */
+                                reg = <0x00100000 0x00100000>;
+                                label = "NAND DTB Image";
+                        };
+
+                        partition@200000 {
+                                /* 4MB for Linux Kernel Image */
+                                reg = <0x00200000 0x00400000>;
+                                label = "NAND Linux Kernel Image";
+                        };
+
+                        partition@600000 {
+                                /* 122MB for File System Image */
+                                reg = <0x00600000 0x07a00000>;
+                                label = "NAND File System Image";
+                        };
+                };
+
+                cpld@2,0 {
+                        compatible = "fsl,p1020rdb-pd-cpld";
+                        reg = <0x2 0x0 0x20000>;
+                };
+
+                L2switch@3,0 {
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        compatible = "vitesse-7385";
+                        reg = <0x3 0x0 0x20000>;
+                };
+        };
+
+        soc: soc@ffe00000 {
+                ranges = <0x0 0x0 0xffe00000 0x100000>;
+
+                i2c@3000 {
+                        rtc@68 {
+                                compatible = "dallas,ds1339";
+                                reg = <0x68>;
+                        };
+                };
+
+                spi@7000 {
+                        flash@0 {
+                                #address-cells = <1>;
+                                #size-cells = <1>;
+                                compatible = "spansion,s25sl12801";
+                                reg = <0>;
+                                /* input clock */
+                                spi-max-frequency = <40000000>;
+
+                                partition@0 {
+                                        /* 512KB for u-boot Bootloader Image */
+                                        reg = <0x0 0x00080000>;
+                                        label = "SPI U-Boot Image";
+                                        read-only;
+                                };
+
+                                partition@80000 {
+                                        /* 512KB for DTB Image*/
+                                        reg = <0x00080000 0x00080000>;
+                                        label = "SPI DTB Image";
+                                };
+
+                                partition@100000 {
+                                        /* 4MB for Linux Kernel Image */
+                                        reg = <0x00100000 0x00400000>;
+                                        label = "SPI Linux Kernel Image";
+                                };
+
+                                partition@500000 {
+                                        /* 11MB for FS System Image */
+                                        reg = <0x00500000 0x00b00000>;
+                                        label = "SPI File System Image";
+                                };
+                        };
+
+                        slic@0 {
+                                compatible = "zarlink,le88266";
+                                reg = <1>;
+                                spi-max-frequency = <8000000>;
+                        };
+
+                        slic@1 {
+                                compatible = "zarlink,le88266";
+                                reg = <2>;
+                                spi-max-frequency = <8000000>;
+                        };
+                };
+
+                mdio@24000 {
+                        phy0: ethernet-phy@0 {
+                                interrupts = <3 1 0 0>;
+                                reg = <0x0>;
+                        };
+
+                        phy1: ethernet-phy@1 {
+                                interrupts = <2 1 0 0>;
+                                reg = <0x1>;
+                        };
+                };
+
+                mdio@25000 {
+                        tbi1: tbi-phy@11 {
+                                reg = <0x11>;
+                                device_type = "tbi-phy";
+                        };
+                };
+
+                mdio@26000 {
+                        tbi2: tbi-phy@11 {
+                                reg = <0x11>;
+                                device_type = "tbi-phy";
+                        };
+                };
+
+                enet0: ethernet@b0000 {
+                        fixed-link = <1 1 1000 0 0>;
+                        phy-connection-type = "rgmii-id";
+                };
+
+                enet1: ethernet@b1000 {
+                        phy-handle = <&phy0>;
+                        tbi-handle = <&tbi1>;
+                        phy-connection-type = "sgmii";
+                };
+
+                enet2: ethernet@b2000 {
+                        phy-handle = <&phy1>;
+                        phy-connection-type = "rgmii-id";
+                };
+
+                usb@22000 {
+                        phy_type = "ulpi";
+                };
+        };
+
+        pci0: pcie@ffe09000 {
+                reg = <0x0 0xffe09000 0x0 0x1000>;
+                ranges = <0x2000000 0x0 0xa0000000 0x0 0xa0000000 0x0 0x20000000
+                          0x1000000 0x0 0x00000000 0x0 0xffc10000 0x0 0x10000>;
+                pcie@0 {
+                        ranges = <0x2000000 0x0 0xa0000000
+                                  0x2000000 0x0 0xa0000000
+                                  0x0 0x20000000
+
+                                  0x1000000 0x0 0x0
+                                  0x1000000 0x0 0x0
+                                  0x0 0x100000>;
+                };
+        };
+
+        pci1: pcie@ffe0a000 {
+                reg = <0x0 0xffe0a000 0x0 0x1000>;
+                ranges = <0x2000000 0x0 0x80000000 0x0 0x80000000 0x0 0x20000000
+                          0x1000000 0x0 0x00000000 0x0 0xffc00000 0x0 0x10000>;
+                pcie@0 {
+                        ranges = <0x2000000 0x0 0x80000000
+                                  0x2000000 0x0 0x80000000
+                                  0x0 0x20000000
+
+                                  0x1000000 0x0 0x0
+                                  0x1000000 0x0 0x0
+                                  0x0 0x100000>;
+                };
+        };
+};
+
+/include/ "fsl/p1020si-post.dtsi"
diff --git a/arch/powerpc/boot/dts/p1023rdb.dts b/arch/powerpc/boot/dts/p1023rdb.dts
new file mode 100644
index 000000000000..0a06a88ddbd5
--- /dev/null
+++ b/arch/powerpc/boot/dts/p1023rdb.dts
@@ -0,0 +1,234 @@
+/*
+ * P1023 RDB Device Tree Source
+ *
+ *    Copyright 2013 Freescale Semiconductor Inc.
+ *
+ * Author: Chunhe Lan <Chunhe.Lan@freescale.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Freescale Semiconductor nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/include/ "fsl/p1023si-pre.dtsi"
+
+/ {
+        model = "fsl,P1023";
+        compatible = "fsl,P1023RDB";
+        #address-cells = <2>;
+        #size-cells = <2>;
+        interrupt-parent = <&mpic>;
+
+        memory {
+                device_type = "memory";
+        };
+
+        soc: soc@ff600000 {
+                ranges = <0x0 0x0 0xff600000 0x200000>;
+
+                i2c@3000 {
+                        eeprom@53 {
+                                compatible = "at24,24c04";
+                                reg = <0x53>;
+                        };
+
+                        rtc@6f {
+                                compatible = "microchip,mcp7941x";
+                                reg = <0x6f>;
+                        };
+                };
+
+                usb@22000 {
+                        dr_mode = "host";
+                        phy_type = "ulpi";
+                };
+        };
+
+        lbc: localbus@ff605000 {
+                reg = <0 0xff605000 0 0x1000>;
+
+                /* NOR, NAND Flashes */
+                ranges = <0x0 0x0 0x0 0xec000000 0x04000000
+                          0x1 0x0 0x0 0xffa00000 0x08000000>;
+
+                nor@0,0 {
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        compatible = "cfi-flash";
+                        reg = <0x0 0x0 0x04000000>;
+                        bank-width = <2>;
+                        device-width = <1>;
+
+                        partition@0 {
+                                /* 48MB for Root File System */
+                                reg = <0x00000000 0x03000000>;
+                                label = "NOR Root File System";
+                        };
+
+                        partition@3000000 {
+                                /* 1MB for DTB Image */
+                                reg = <0x03000000 0x00100000>;
+                                label = "NOR DTB Image";
+                        };
+
+                        partition@3100000 {
+                                /* 14MB for Linux Kernel Image */
+                                reg = <0x03100000 0x00e00000>;
+                                label = "NOR Linux Kernel Image";
+                        };
+
+                        partition@3f00000 {
+                                /* This location must not be altered  */
+                                /* 512KB for u-boot Bootloader Image */
+                                /* 512KB for u-boot Environment Variables */
+                                reg = <0x03f00000 0x00100000>;
+                                label = "NOR U-Boot Image";
+                                read-only;
+                        };
+                };
+
+                nand@1,0 {
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        compatible = "fsl,elbc-fcm-nand";
+                        reg = <0x1 0x0 0x40000>;
+
+                        partition@0 {
+                                /* This location must not be altered  */
+                                /* 1MB for u-boot Bootloader Image */
+                                reg = <0x0 0x00100000>;
+                                label = "NAND U-Boot Image";
+                                read-only;
+                        };
+
+                        partition@100000 {
+                                /* 1MB for DTB Image */
+                                reg = <0x00100000 0x00100000>;
+                                label = "NAND DTB Image";
+                        };
+
+                        partition@200000 {
+                                /* 14MB for Linux Kernel Image */
+                                reg = <0x00200000 0x00e00000>;
+                                label = "NAND Linux Kernel Image";
+                        };
+
+                        partition@1000000 {
+                                /* 96MB for Root File System Image */
+                                reg = <0x01000000 0x06000000>;
+                                label = "NAND Root File System";
+                        };
+
+                        partition@7000000 {
+                                /* 16MB for User Writable Area */
+                                reg = <0x07000000 0x01000000>;
+                                label = "NAND Writable User area";
+                        };
+                };
+        };
+
+        pci0: pcie@ff60a000 {
+                reg = <0 0xff60a000 0 0x1000>;
+                ranges = <0x2000000 0x0 0xc0000000 0 0xc0000000 0x0 0x20000000
+                          0x1000000 0x0 0x00000000 0 0xffc20000 0x0 0x10000>;
+                pcie@0 {
+                        /* IRQ[0:3] are pulled up on board, set to active-low */
+                        interrupt-map-mask = <0xf800 0 0 7>;
+                        interrupt-map = <
+                                /* IDSEL 0x0 */
+                                0000 0 0 1 &mpic 0 1 0 0
+                                0000 0 0 2 &mpic 1 1 0 0
+                                0000 0 0 3 &mpic 2 1 0 0
+                                0000 0 0 4 &mpic 3 1 0 0
+                                >;
+                        ranges = <0x2000000 0x0 0xc0000000
+                                  0x2000000 0x0 0xc0000000
+                                  0x0 0x20000000
+
+                                  0x1000000 0x0 0x0
+                                  0x1000000 0x0 0x0
+                                  0x0 0x100000>;
+                };
+        };
+
+        board_pci1: pci1: pcie@ff609000 {
+                reg = <0 0xff609000 0 0x1000>;
+                ranges = <0x2000000 0x0 0xa0000000 0 0xa0000000 0x0 0x20000000
+                          0x1000000 0x0 0x00000000 0 0xffc10000 0x0 0x10000>;
+                pcie@0 {
+                        /*
+                         * IRQ[4:6] only for PCIe, set to active-high,
+                         * IRQ[7] is pulled up on board, set to active-low
+                         */
+                        interrupt-map-mask = <0xf800 0 0 7>;
+                        interrupt-map = <
+                                /* IDSEL 0x0 */
+                                0000 0 0 1 &mpic 4 2 0 0
+                                0000 0 0 2 &mpic 5 2 0 0
+                                0000 0 0 3 &mpic 6 2 0 0
+                                0000 0 0 4 &mpic 7 1 0 0
+                                >;
+                        ranges = <0x2000000 0x0 0xa0000000
+                                  0x2000000 0x0 0xa0000000
+                                  0x0 0x20000000
+
+                                  0x1000000 0x0 0x0
+                                  0x1000000 0x0 0x0
+                                  0x0 0x100000>;
+                };
+        };
+
+        pci2: pcie@ff60b000 {
+                reg = <0 0xff60b000 0 0x1000>;
+                ranges = <0x2000000 0x0 0x80000000 0 0x80000000 0x0 0x20000000
+                          0x1000000 0x0 0x00000000 0 0xffc00000 0x0 0x10000>;
+                pcie@0 {
+                        /*
+                         * IRQ[8:10] are pulled up on board, set to active-low
+                         * IRQ[11] only for PCIe, set to active-high,
+                         */
+                        interrupt-map-mask = <0xf800 0 0 7>;
+                        interrupt-map = <
+                                /* IDSEL 0x0 */
+                                0000 0 0 1 &mpic 8 1 0 0
+                                0000 0 0 2 &mpic 9 1 0 0
+                                0000 0 0 3 &mpic 10 1 0 0
+                                0000 0 0 4 &mpic 11 2 0 0
+                                >;
+                        ranges = <0x2000000 0x0 0x80000000
+                                  0x2000000 0x0 0x80000000
+                                  0x0 0x20000000
+
+                                  0x1000000 0x0 0x0
+                                  0x1000000 0x0 0x0
+                                  0x0 0x100000>;
+                };
+        };
+
+};
+
+/include/ "fsl/p1023si-post.dtsi"
diff --git a/arch/powerpc/boot/dts/pdm360ng.dts b/arch/powerpc/boot/dts/pdm360ng.dts
index 74337403faee..871c16d1ad5e 100644
--- a/arch/powerpc/boot/dts/pdm360ng.dts
+++ b/arch/powerpc/boot/dts/pdm360ng.dts
@@ -13,7 +13,7 @@
  * option) any later version.
  */
 
-/include/ "mpc5121.dtsi"
+#include <mpc5121.dtsi>
 
 / {
         model = "pdm360ng";
diff --git a/arch/powerpc/boot/ppc_asm.h b/arch/powerpc/boot/ppc_asm.h
index 1c2c2817f9b7..eb0e98be69e0 100644
--- a/arch/powerpc/boot/ppc_asm.h
+++ b/arch/powerpc/boot/ppc_asm.h
@@ -59,4 +59,7 @@
 #define r30     30
 #define r31     31
 
+#define SPRN_TBRL       268
+#define SPRN_TBRU       269
+
 #endif /* _PPC64_PPC_ASM_H */
diff --git a/arch/powerpc/boot/util.S b/arch/powerpc/boot/util.S
index 427ddfc11991..5143228e3e5f 100644
--- a/arch/powerpc/boot/util.S
+++ b/arch/powerpc/boot/util.S
@@ -71,18 +71,18 @@ udelay:
         add     r4,r4,r5
         addi    r4,r4,-1
         divw    r4,r4,r5        /* BUS ticks */
-1:      mftbu   r5
-        mftb    r6
-        mftbu   r7
+1:      mfspr   r5, SPRN_TBRU
+        mfspr   r6, SPRN_TBRL
+        mfspr   r7, SPRN_TBRU
         cmpw    0,r5,r7
         bne     1b              /* Get [synced] base time */
         addc    r9,r6,r4        /* Compute end time */
         addze   r8,r5
-2:      mftbu   r5
+2:      mfspr   r5, SPRN_TBRU
         cmpw    0,r5,r8
         blt     2b
         bgt     3f
-        mftb    r6
+        mfspr   r6, SPRN_TBRL
         cmpw    0,r6,r9
         blt     2b
 3:      blr
diff --git a/arch/powerpc/configs/85xx/p1023rds_defconfig b/arch/powerpc/configs/85xx/p1023_defconfig
index b80bcc69d1f7..b06d37da44f4 100644
--- a/arch/powerpc/configs/85xx/p1023rds_defconfig
+++ b/arch/powerpc/configs/85xx/p1023_defconfig
@@ -1,14 +1,13 @@
 CONFIG_PPC_85xx=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=2
-CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_AUDIT=y
-CONFIG_IRQ_DOMAIN_DEBUG=y
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
+CONFIG_RCU_FANOUT=32
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
@@ -22,6 +21,8 @@ CONFIG_MODVERSIONS=y
 # CONFIG_BLK_DEV_BSG is not set
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_MAC_PARTITION=y
+CONFIG_PHYSICAL_START=0x00000000
+CONFIG_P1023_RDB=y
 CONFIG_P1023_RDS=y
 CONFIG_QUICC_ENGINE=y
 CONFIG_QE_GPIO=y
@@ -63,10 +64,21 @@ CONFIG_IPV6=y
 CONFIG_IP_SCTP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_MTD=y
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_CHAR=y
+CONFIG_MTD_BLOCK=y
+CONFIG_MTD_CFI=y
+CONFIG_MTD_CFI_AMDSTD=y
+CONFIG_MTD_PHYSMAP_OF=y
+CONFIG_MTD_NAND=y
+CONFIG_MTD_NAND_FSL_ELBC=y
 CONFIG_PROC_DEVICETREE=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=131072
+CONFIG_EEPROM_AT24=y
 CONFIG_EEPROM_LEGACY=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_CHR_DEV_ST=y
@@ -82,6 +94,8 @@ CONFIG_DUMMY=y
 CONFIG_FS_ENET=y
 CONFIG_FSL_PQ_MDIO=y
 CONFIG_E1000E=y
+CONFIG_PHYLIB=y
+CONFIG_AT803X_PHY=y
 CONFIG_MARVELL_PHY=y
 CONFIG_DAVICOM_PHY=y
 CONFIG_CICADA_PHY=y
@@ -96,12 +110,15 @@ CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=2
 CONFIG_SERIAL_8250_RUNTIME_UARTS=2
+CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
 CONFIG_SERIAL_8250_DETECT_IRQ=y
 CONFIG_SERIAL_8250_RSA=y
-CONFIG_SERIAL_QE=m
+CONFIG_HW_RANDOM=y
 CONFIG_NVRAM=y
 CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_CPM=m
 CONFIG_I2C_MPC=y
 CONFIG_GPIO_MPC8XXX=y
@@ -121,6 +138,7 @@ CONFIG_USB_STORAGE=y
 CONFIG_EDAC=y
 CONFIG_EDAC_MM_EDAC=y
 CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_DS1307=y
 CONFIG_RTC_DRV_CMOS=y
 CONFIG_DMADEVICES=y
 CONFIG_FSL_DMA=y
@@ -161,6 +179,7 @@ CONFIG_DEBUG_FS=y
 CONFIG_DETECT_HUNG_TASK=y
 # CONFIG_DEBUG_BUGVERBOSE is not set
 CONFIG_DEBUG_INFO=y
+CONFIG_STRICT_DEVMEM=y
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_SHA256=y
 CONFIG_CRYPTO_SHA512=y
diff --git a/arch/powerpc/configs/corenet32_smp_defconfig b/arch/powerpc/configs/corenet32_smp_defconfig
index 60027c2a7034..3dfab4c40c76 100644
--- a/arch/powerpc/configs/corenet32_smp_defconfig
+++ b/arch/powerpc/configs/corenet32_smp_defconfig
@@ -70,6 +70,7 @@ CONFIG_IPV6=y
 CONFIG_IP_SCTP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_MTD=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
diff --git a/arch/powerpc/configs/corenet64_smp_defconfig b/arch/powerpc/configs/corenet64_smp_defconfig
index 6c8b020806ff..fa94fb3bb44d 100644
--- a/arch/powerpc/configs/corenet64_smp_defconfig
+++ b/arch/powerpc/configs/corenet64_smp_defconfig
@@ -27,6 +27,8 @@ CONFIG_P5040_DS=y
 CONFIG_T4240_QDS=y
 # CONFIG_PPC_OF_BOOT_TRAMPOLINE is not set
 CONFIG_BINFMT_MISC=m
+CONFIG_MATH_EMULATION=y
+CONFIG_MATH_EMULATION_HW_UNIMPLEMENTED=y
 CONFIG_FSL_IFC=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_MSI=y
@@ -59,6 +61,7 @@ CONFIG_IPV6=y
 CONFIG_IP_SCTP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_MTD=y
 CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_OF_PARTS=y
diff --git a/arch/powerpc/configs/mpc83xx_defconfig b/arch/powerpc/configs/mpc83xx_defconfig
index 09116c6a6719..23fec79964cf 100644
--- a/arch/powerpc/configs/mpc83xx_defconfig
+++ b/arch/powerpc/configs/mpc83xx_defconfig
@@ -42,6 +42,7 @@ CONFIG_INET_ESP=y
 # CONFIG_IPV6 is not set
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
 CONFIG_MTD_CHAR=y
diff --git a/arch/powerpc/configs/mpc85xx_defconfig b/arch/powerpc/configs/mpc85xx_defconfig
index 5a58882e351e..dc098d988211 100644
--- a/arch/powerpc/configs/mpc85xx_defconfig
+++ b/arch/powerpc/configs/mpc85xx_defconfig
@@ -27,6 +27,7 @@ CONFIG_MPC85xx_MDS=y
 CONFIG_MPC8536_DS=y
 CONFIG_MPC85xx_DS=y
 CONFIG_MPC85xx_RDB=y
+CONFIG_C293_PCIE=y
 CONFIG_P1010_RDB=y
 CONFIG_P1022_DS=y
 CONFIG_P1022_RDK=y
@@ -78,6 +79,7 @@ CONFIG_IPV6=y
 CONFIG_IP_SCTP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_MTD=y
 CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_OF_PARTS=y
diff --git a/arch/powerpc/configs/mpc85xx_smp_defconfig b/arch/powerpc/configs/mpc85xx_smp_defconfig
index 152fa05b15e4..5bca60161bb3 100644
--- a/arch/powerpc/configs/mpc85xx_smp_defconfig
+++ b/arch/powerpc/configs/mpc85xx_smp_defconfig
@@ -30,6 +30,7 @@ CONFIG_MPC85xx_MDS=y
 CONFIG_MPC8536_DS=y
 CONFIG_MPC85xx_DS=y
 CONFIG_MPC85xx_RDB=y
+CONFIG_C293_PCIE=y
 CONFIG_P1010_RDB=y
 CONFIG_P1022_DS=y
 CONFIG_P1022_RDK=y
@@ -81,6 +82,7 @@ CONFIG_IPV6=y
 CONFIG_IP_SCTP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_MTD=y
 CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_OF_PARTS=y
diff --git a/arch/powerpc/include/asm/Kbuild b/arch/powerpc/include/asm/Kbuild
index 650757c300db..704e6f10ae80 100644
--- a/arch/powerpc/include/asm/Kbuild
+++ b/arch/powerpc/include/asm/Kbuild
@@ -2,3 +2,4 @@
 generic-y += clkdev.h
 generic-y += rwsem.h
 generic-y += trace_clock.h
+generic-y += vtime.h
\ No newline at end of file
diff --git a/arch/powerpc/include/asm/asm-compat.h b/arch/powerpc/include/asm/asm-compat.h
index 6e82f5f9a6fd..4b237aa35660 100644
--- a/arch/powerpc/include/asm/asm-compat.h
+++ b/arch/powerpc/include/asm/asm-compat.h
@@ -32,6 +32,15 @@
 #define PPC_MTOCRF(FXM, RS) MTOCRF((FXM), RS)
 #define PPC_LR_STKOFF   16
 #define PPC_MIN_STKFRM  112
+
+#ifdef __BIG_ENDIAN__
+#define LDX_BE  stringify_in_c(ldx)
+#define STDX_BE stringify_in_c(stdx)
+#else
+#define LDX_BE  stringify_in_c(ldbrx)
+#define STDX_BE stringify_in_c(stdbrx)
+#endif
+
 #else /* 32-bit */
 
 /* operations for longs and pointers */
diff --git a/arch/powerpc/include/asm/btext.h b/arch/powerpc/include/asm/btext.h
index 906f46e31006..89fc382648bc 100644
--- a/arch/powerpc/include/asm/btext.h
+++ b/arch/powerpc/include/asm/btext.h
@@ -13,6 +13,7 @@ extern void btext_update_display(unsigned long phys, int width, int height,
 extern void btext_setup_display(int width, int height, int depth, int pitch,
                                 unsigned long address);
 extern void btext_prepare_BAT(void);
+extern void btext_map(void);
 extern void btext_unmap(void);
 
 extern void btext_drawchar(char c);
diff --git a/arch/powerpc/include/asm/cacheflush.h b/arch/powerpc/include/asm/cacheflush.h
index b843e35122e8..5b9312220e84 100644
--- a/arch/powerpc/include/asm/cacheflush.h
+++ b/arch/powerpc/include/asm/cacheflush.h
@@ -32,13 +32,7 @@ extern void flush_dcache_page(struct page *page);
 
 extern void __flush_disable_L1(void);
 
-extern void __flush_icache_range(unsigned long, unsigned long);
-static inline void flush_icache_range(unsigned long start, unsigned long stop)
-{
-        if (!cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
-                __flush_icache_range(start, stop);
-}
-
+extern void flush_icache_range(unsigned long, unsigned long);
 extern void flush_icache_user_range(struct vm_area_struct *vma,
                                     struct page *page, unsigned long addr,
                                     int len);
diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index 6f3887d884d2..0d4939ba48e7 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -371,14 +371,19 @@ extern const char *powerpc_base_platform;
 #define CPU_FTRS_E500MC (CPU_FTR_USE_TB | CPU_FTR_NODSISRALIGN | \
             CPU_FTR_L2CSR | CPU_FTR_LWSYNC | CPU_FTR_NOEXECUTE | \
             CPU_FTR_DBELL | CPU_FTR_DEBUG_LVL_EXC | CPU_FTR_EMB_HV)
+/*
+ * e5500/e6500 erratum A-006958 is a timebase bug that can use the
+ * same workaround as CPU_FTR_CELL_TB_BUG.
+ */
 #define CPU_FTRS_E5500  (CPU_FTR_USE_TB | CPU_FTR_NODSISRALIGN | \
             CPU_FTR_L2CSR | CPU_FTR_LWSYNC | CPU_FTR_NOEXECUTE | \
             CPU_FTR_DBELL | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
-            CPU_FTR_DEBUG_LVL_EXC | CPU_FTR_EMB_HV)
+            CPU_FTR_DEBUG_LVL_EXC | CPU_FTR_EMB_HV | CPU_FTR_CELL_TB_BUG)
 #define CPU_FTRS_E6500  (CPU_FTR_USE_TB | CPU_FTR_NODSISRALIGN | \
             CPU_FTR_L2CSR | CPU_FTR_LWSYNC | CPU_FTR_NOEXECUTE | \
             CPU_FTR_DBELL | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
-            CPU_FTR_DEBUG_LVL_EXC | CPU_FTR_EMB_HV | CPU_FTR_ALTIVEC_COMP)
+            CPU_FTR_DEBUG_LVL_EXC | CPU_FTR_EMB_HV | CPU_FTR_ALTIVEC_COMP | \
+            CPU_FTR_CELL_TB_BUG)
 #define CPU_FTRS_GENERIC_32     (CPU_FTR_COMMON | CPU_FTR_NODSISRALIGN)
 
 /* 64-bit CPUs */
diff --git a/arch/powerpc/include/asm/emulated_ops.h b/arch/powerpc/include/asm/emulated_ops.h
index 63f2a22e9954..5a8b82aa7241 100644
--- a/arch/powerpc/include/asm/emulated_ops.h
+++ b/arch/powerpc/include/asm/emulated_ops.h
@@ -46,8 +46,6 @@ extern struct ppc_emulated {
         struct ppc_emulated_entry unaligned;
 #ifdef CONFIG_MATH_EMULATION
         struct ppc_emulated_entry math;
-#elif defined(CONFIG_8XX_MINIMAL_FPEMU)
-        struct ppc_emulated_entry 8xx;
 #endif
 #ifdef CONFIG_VSX
         struct ppc_emulated_entry vsx;
diff --git a/arch/powerpc/include/asm/epapr_hcalls.h b/arch/powerpc/include/asm/epapr_hcalls.h
index d3d634274d2c..86b0ac79990c 100644
--- a/arch/powerpc/include/asm/epapr_hcalls.h
+++ b/arch/powerpc/include/asm/epapr_hcalls.h
@@ -105,6 +105,12 @@
 extern bool epapr_paravirt_enabled;
 extern u32 epapr_hypercall_start[];
 
+#ifdef CONFIG_EPAPR_PARAVIRT
+int __init epapr_paravirt_early_init(void);
+#else
+static inline int epapr_paravirt_early_init(void) { return 0; }
+#endif
+
 /*
  * We use "uintptr_t" to define a register because it's guaranteed to be a
  * 32-bit integer on a 32-bit platform, and a 64-bit integer on a 64-bit
diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
index 07ca627e52c0..cca12f084842 100644
--- a/arch/powerpc/include/asm/exception-64s.h
+++ b/arch/powerpc/include/asm/exception-64s.h
@@ -48,17 +48,18 @@
 #define EX_LR           72
 #define EX_CFAR         80
 #define EX_PPR          88      /* SMT thread status register (priority) */
+#define EX_CTR          96
 
 #ifdef CONFIG_RELOCATABLE
 #define __EXCEPTION_RELON_PROLOG_PSERIES_1(label, h)                    \
         ld      r12,PACAKBASE(r13);     /* get high part of &label */   \
         mfspr   r11,SPRN_##h##SRR0;     /* save SRR0 */                 \
         LOAD_HANDLER(r12,label);                                        \
-        mtlr    r12;                                                    \
+        mtctr   r12;                                                    \
         mfspr   r12,SPRN_##h##SRR1;     /* and SRR1 */                  \
         li      r10,MSR_RI;                                             \
         mtmsrd  r10,1;                  /* Set RI (EE=0) */             \
-        blr;
+        bctr;
 #else
 /* If not relocatable, we can jump directly -- and save messing with LR */
 #define __EXCEPTION_RELON_PROLOG_PSERIES_1(label, h)                    \
@@ -97,18 +98,18 @@
 
 #if defined(CONFIG_RELOCATABLE)
 /*
- * If we support interrupts with relocation on AND we're a relocatable
- * kernel, we need to use LR to get to the 2nd level handler.  So, save/restore
- * it when required.
+ * If we support interrupts with relocation on AND we're a relocatable kernel,
+ * we need to use CTR to get to the 2nd level handler.  So, save/restore it
+ * when required.
  */
-#define SAVE_LR(reg, area)      mflr    reg ;   std     reg,area+EX_LR(r13)
-#define GET_LR(reg, area)                       ld      reg,area+EX_LR(r13)
-#define RESTORE_LR(reg, area)   ld      reg,area+EX_LR(r13) ; mtlr reg
+#define SAVE_CTR(reg, area)     mfctr   reg ;   std     reg,area+EX_CTR(r13)
+#define GET_CTR(reg, area)                      ld      reg,area+EX_CTR(r13)
+#define RESTORE_CTR(reg, area)  ld      reg,area+EX_CTR(r13) ; mtctr reg
 #else
-/* ...else LR is unused and in register. */
-#define SAVE_LR(reg, area)
-#define GET_LR(reg, area)       mflr    reg
-#define RESTORE_LR(reg, area)
+/* ...else CTR is unused and in register. */
+#define SAVE_CTR(reg, area)
+#define GET_CTR(reg, area)      mfctr   reg
+#define RESTORE_CTR(reg, area)
 #endif
 
 /*
@@ -164,7 +165,7 @@ END_FTR_SECTION_NESTED(ftr,ftr,943)
 #define __EXCEPTION_PROLOG_1(area, extra, vec)                          \
         OPT_SAVE_REG_TO_PACA(area+EX_PPR, r9, CPU_FTR_HAS_PPR);         \
         OPT_SAVE_REG_TO_PACA(area+EX_CFAR, r10, CPU_FTR_CFAR);          \
-        SAVE_LR(r10, area);                                             \
+        SAVE_CTR(r10, area);                                            \
         mfcr    r9;                                                     \
         extra(vec);                                                     \
         std     r11,area+EX_R11(r13);                                   \
@@ -270,7 +271,7 @@ do_kvm_##n:								\
         sth     r1,PACA_TRAP_SAVE(r13);                                    \
         std     r3,area+EX_R3(r13);                                        \
         addi    r3,r13,area;            /* r3 -> where regs are saved*/    \
-        RESTORE_LR(r1, area);                                              \
+        RESTORE_CTR(r1, area);                                             \
         b       bad_stack;                                                 \
 3:      std     r9,_CCR(r1);            /* save CR in stackframe        */ \
         std     r11,_NIP(r1);           /* save SRR0 in stackframe      */ \
@@ -298,10 +299,10 @@ do_kvm_##n:								\
         ld      r10,area+EX_CFAR(r13);                                     \
         std     r10,ORIG_GPR3(r1);                                         \
         END_FTR_SECTION_NESTED(CPU_FTR_CFAR, CPU_FTR_CFAR, 66);            \
-        GET_LR(r9,area);                /* Get LR, later save to stack  */ \
+        mflr    r9;                     /* Get LR, later save to stack  */ \
         ld      r2,PACATOC(r13);        /* get kernel TOC into r2       */ \
         std     r9,_LINK(r1);                                              \
-        mfctr   r10;                    /* save CTR in stackframe       */ \
+        GET_CTR(r10, area);                                                \
         std     r10,_CTR(r1);                                              \
         lbz     r10,PACASOFTIRQEN(r13);                            \
         mfspr   r11,SPRN_XER;           /* save XER in stackframe       */ \
@@ -479,7 +480,7 @@ label##_relon_hv:							\
  */
 
 /* Exception addition: Hard disable interrupts */
-#define DISABLE_INTS    SOFT_DISABLE_INTS(r10,r11)
+#define DISABLE_INTS    RECONCILE_IRQ_STATE(r10,r11)
 
 #define ADD_NVGPRS                              \
         bl      .save_nvgprs
diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h
index dd15e5e37d6d..5a64757dc0d1 100644
--- a/arch/powerpc/include/asm/io.h
+++ b/arch/powerpc/include/asm/io.h
@@ -69,8 +69,18 @@ extern unsigned long pci_dram_offset;
 
 extern resource_size_t isa_mem_base;
 
-#if defined(CONFIG_PPC32) && defined(CONFIG_PPC_INDIRECT_IO)
-#error CONFIG_PPC_INDIRECT_IO is not yet supported on 32 bits
+/* Boolean set by platform if PIO accesses are suppored while _IO_BASE
+ * is not set or addresses cannot be translated to MMIO. This is typically
+ * set when the platform supports "special" PIO accesses via a non memory
+ * mapped mechanism, and allows things like the early udbg UART code to
+ * function.
+ */
+extern bool isa_io_special;
+
+#ifdef CONFIG_PPC32
+#if defined(CONFIG_PPC_INDIRECT_PIO) || defined(CONFIG_PPC_INDIRECT_MMIO)
+#error CONFIG_PPC_INDIRECT_{PIO,MMIO} are not yet supported on 32 bits
+#endif
 #endif
 
 /*
@@ -222,9 +232,9 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src,
  * for PowerPC is as close as possible to the x86 version of these, and thus
  * provides fairly heavy weight barriers for the non-raw versions
  *
- * In addition, they support a hook mechanism when CONFIG_PPC_INDIRECT_IO
- * allowing the platform to provide its own implementation of some or all
- * of the accessors.
+ * In addition, they support a hook mechanism when CONFIG_PPC_INDIRECT_MMIO
+ * or CONFIG_PPC_INDIRECT_PIO are set allowing the platform to provide its
+ * own implementation of some or all of the accessors.
  */
 
 /*
@@ -240,8 +250,8 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src,
 
 /* Indirect IO address tokens:
  *
- * When CONFIG_PPC_INDIRECT_IO is set, the platform can provide hooks
- * on all IOs. (Note that this is all 64 bits only for now)
+ * When CONFIG_PPC_INDIRECT_MMIO is set, the platform can provide hooks
+ * on all MMIOs. (Note that this is all 64 bits only for now)
  *
  * To help platforms who may need to differenciate MMIO addresses in
  * their hooks, a bitfield is reserved for use by the platform near the
@@ -263,11 +273,14 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src,
  *
  * The direct IO mapping operations will then mask off those bits
  * before doing the actual access, though that only happen when
- * CONFIG_PPC_INDIRECT_IO is set, thus be careful when you use that
+ * CONFIG_PPC_INDIRECT_MMIO is set, thus be careful when you use that
  * mechanism
+ *
+ * For PIO, there is a separate CONFIG_PPC_INDIRECT_PIO which makes
+ * all PIO functions call through a hook.
  */
 
-#ifdef CONFIG_PPC_INDIRECT_IO
+#ifdef CONFIG_PPC_INDIRECT_MMIO
 #define PCI_IO_IND_TOKEN_MASK   0x0fff000000000000ul
 #define PCI_IO_IND_TOKEN_SHIFT  48
 #define PCI_FIX_ADDR(addr)                                              \
@@ -672,7 +685,7 @@ extern void __iomem * __ioremap_at(phys_addr_t pa, void *ea,
 extern void __iounmap_at(void *ea, unsigned long size);
 
 /*
- * When CONFIG_PPC_INDIRECT_IO is set, we use the generic iomap implementation
+ * When CONFIG_PPC_INDIRECT_PIO is set, we use the generic iomap implementation
  * which needs some additional definitions here. They basically allow PIO
  * space overall to be 1GB. This will work as long as we never try to use
  * iomap to map MMIO below 1GB which should be fine on ppc64
diff --git a/arch/powerpc/include/asm/irqflags.h b/arch/powerpc/include/asm/irqflags.h
index 6f9b6e23dc5a..f51a5580bfd0 100644
--- a/arch/powerpc/include/asm/irqflags.h
+++ b/arch/powerpc/include/asm/irqflags.h
@@ -40,9 +40,10 @@
 #define TRACE_DISABLE_INTS      TRACE_WITH_FRAME_BUFFER(.trace_hardirqs_off)
 
 /*
- * This is used by assembly code to soft-disable interrupts
+ * This is used by assembly code to soft-disable interrupts first and
+ * reconcile irq state.
  */
-#define SOFT_DISABLE_INTS(__rA, __rB)           \
+#define RECONCILE_IRQ_STATE(__rA, __rB)         \
         lbz     __rA,PACASOFTIRQEN(r13);        \
         lbz     __rB,PACAIRQHAPPENED(r13);      \
         cmpwi   cr0,__rA,0;                     \
@@ -58,7 +59,7 @@
 #define TRACE_ENABLE_INTS
 #define TRACE_DISABLE_INTS
 
-#define SOFT_DISABLE_INTS(__rA, __rB)           \
+#define RECONCILE_IRQ_STATE(__rA, __rB)         \
         lbz     __rA,PACAIRQHAPPENED(r13);      \
         li      __rB,0;                         \
         ori     __rA,__rA,PACA_IRQ_HARD_DIS;    \
diff --git a/arch/powerpc/include/asm/kvm_book3s.h b/arch/powerpc/include/asm/kvm_book3s.h
index 08891d07aeb6..fa19e2f1a874 100644
--- a/arch/powerpc/include/asm/kvm_book3s.h
+++ b/arch/powerpc/include/asm/kvm_book3s.h
@@ -334,6 +334,27 @@ static inline u32 kvmppc_get_last_inst(struct kvm_vcpu *vcpu)
         return r;
 }
 
+/*
+ * Like kvmppc_get_last_inst(), but for fetching a sc instruction.
+ * Because the sc instruction sets SRR0 to point to the following
+ * instruction, we have to fetch from pc - 4.
+ */
+static inline u32 kvmppc_get_last_sc(struct kvm_vcpu *vcpu)
+{
+        ulong pc = kvmppc_get_pc(vcpu) - 4;
+        struct kvmppc_book3s_shadow_vcpu *svcpu = svcpu_get(vcpu);
+        u32 r;
+
+        /* Load the instruction manually if it failed to do so in the
+         * exit path */
+        if (svcpu->last_inst == KVM_INST_FETCH_FAILED)
+                kvmppc_ld(vcpu, &pc, sizeof(u32), &svcpu->last_inst, false);
+
+        r = svcpu->last_inst;
+        svcpu_put(svcpu);
+        return r;
+}
+
 static inline ulong kvmppc_get_fault_dar(struct kvm_vcpu *vcpu)
 {
         struct kvmppc_book3s_shadow_vcpu *svcpu = svcpu_get(vcpu);
@@ -446,6 +467,23 @@ static inline u32 kvmppc_get_last_inst(struct kvm_vcpu *vcpu)
         return vcpu->arch.last_inst;
 }
 
+/*
+ * Like kvmppc_get_last_inst(), but for fetching a sc instruction.
+ * Because the sc instruction sets SRR0 to point to the following
+ * instruction, we have to fetch from pc - 4.
+ */
+static inline u32 kvmppc_get_last_sc(struct kvm_vcpu *vcpu)
+{
+        ulong pc = kvmppc_get_pc(vcpu) - 4;
+
+        /* Load the instruction manually if it failed to do so in the
+         * exit path */
+        if (vcpu->arch.last_inst == KVM_INST_FETCH_FAILED)
+                kvmppc_ld(vcpu, &pc, sizeof(u32), &vcpu->arch.last_inst, false);
+
+        return vcpu->arch.last_inst;
+}
+
 static inline ulong kvmppc_get_fault_dar(struct kvm_vcpu *vcpu)
 {
         return vcpu->arch.fault_dar;
diff --git a/arch/powerpc/include/asm/kvm_book3s_64.h b/arch/powerpc/include/asm/kvm_book3s_64.h
index a1ecb14e4442..86d638a3b359 100644
--- a/arch/powerpc/include/asm/kvm_book3s_64.h
+++ b/arch/powerpc/include/asm/kvm_book3s_64.h
@@ -37,7 +37,7 @@ static inline void svcpu_put(struct kvmppc_book3s_shadow_vcpu *svcpu)
 
 #ifdef CONFIG_KVM_BOOK3S_64_HV
 #define KVM_DEFAULT_HPT_ORDER   24      /* 16MB HPT by default */
-extern int kvm_hpt_order;               /* order of preallocated HPTs */
+extern unsigned long kvm_rma_pages;
 #endif
 
 #define VRMA_VSID       0x1ffffffUL     /* 1TB VSID reserved for VRMA */
@@ -100,7 +100,7 @@ static inline unsigned long compute_tlbie_rb(unsigned long v, unsigned long r,
                         /* (masks depend on page size) */
                         rb |= 0x1000;           /* page encoding in LP field */
                         rb |= (va_low & 0x7f) << 16; /* 7b of VA in AVA/LP field */
-                        rb |= (va_low & 0xfe);  /* AVAL field (P7 doesn't seem to care) */
+                        rb |= ((va_low << 4) & 0xf0);   /* AVAL field (P7 doesn't seem to care) */
                 }
         } else {
                 /* 4kB page */
diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h
index af326cde7cb6..33283532e9d8 100644
--- a/arch/powerpc/include/asm/kvm_host.h
+++ b/arch/powerpc/include/asm/kvm_host.h
@@ -183,13 +183,9 @@ struct kvmppc_spapr_tce_table {
         struct page *pages[0];
 };
 
-struct kvmppc_linear_info {
-        void            *base_virt;
-        unsigned long    base_pfn;
-        unsigned long    npages;
-        struct list_head list;
-        atomic_t         use_count;
-        int              type;
+struct kvm_rma_info {
+        atomic_t use_count;
+        unsigned long base_pfn;
 };
 
 /* XICS components, defined in book3s_xics.c */
@@ -246,7 +242,7 @@ struct kvm_arch {
         int tlbie_lock;
         unsigned long lpcr;
         unsigned long rmor;
-        struct kvmppc_linear_info *rma;
+        struct kvm_rma_info *rma;
         unsigned long vrma_slb_v;
         int rma_setup_done;
         int using_mmu_notifiers;
@@ -259,7 +255,7 @@ struct kvm_arch {
         spinlock_t slot_phys_lock;
         cpumask_t need_tlb_flush;
         struct kvmppc_vcore *vcores[KVM_MAX_VCORES];
-        struct kvmppc_linear_info *hpt_li;
+        int hpt_cma_alloc;
 #endif /* CONFIG_KVM_BOOK3S_64_HV */
 #ifdef CONFIG_PPC_BOOK3S_64
         struct list_head spapr_tce_tables;
diff --git a/arch/powerpc/include/asm/kvm_ppc.h b/arch/powerpc/include/asm/kvm_ppc.h
index a5287fe03d77..b15554a26c20 100644
--- a/arch/powerpc/include/asm/kvm_ppc.h
+++ b/arch/powerpc/include/asm/kvm_ppc.h
@@ -137,10 +137,10 @@ extern long kvmppc_h_put_tce(struct kvm_vcpu *vcpu, unsigned long liobn,
                              unsigned long ioba, unsigned long tce);
 extern long kvm_vm_ioctl_allocate_rma(struct kvm *kvm,
                                 struct kvm_allocate_rma *rma);
-extern struct kvmppc_linear_info *kvm_alloc_rma(void);
-extern void kvm_release_rma(struct kvmppc_linear_info *ri);
-extern struct kvmppc_linear_info *kvm_alloc_hpt(void);
-extern void kvm_release_hpt(struct kvmppc_linear_info *li);
+extern struct kvm_rma_info *kvm_alloc_rma(void);
+extern void kvm_release_rma(struct kvm_rma_info *ri);
+extern struct page *kvm_alloc_hpt(unsigned long nr_pages);
+extern void kvm_release_hpt(struct page *page, unsigned long nr_pages);
 extern int kvmppc_core_init_vm(struct kvm *kvm);
 extern void kvmppc_core_destroy_vm(struct kvm *kvm);
 extern void kvmppc_core_free_memslot(struct kvm_memory_slot *free,
@@ -261,6 +261,7 @@ void kvmppc_set_pid(struct kvm_vcpu *vcpu, u32 pid);
 struct openpic;
 
 #ifdef CONFIG_KVM_BOOK3S_64_HV
+extern void kvm_cma_reserve(void) __init;
 static inline void kvmppc_set_xics_phys(int cpu, unsigned long addr)
 {
         paca[cpu].kvm_hstate.xics_phys = addr;
@@ -281,13 +282,12 @@ static inline void kvmppc_set_host_ipi(int cpu, u8 host_ipi)
 }
 
 extern void kvmppc_fast_vcpu_kick(struct kvm_vcpu *vcpu);
-extern void kvm_linear_init(void);
 
 #else
-static inline void kvmppc_set_xics_phys(int cpu, unsigned long addr)
+static inline void __init kvm_cma_reserve(void)
 {}
 
-static inline void kvm_linear_init(void)
+static inline void kvmppc_set_xics_phys(int cpu, unsigned long addr)
 {}
 
 static inline u32 kvmppc_get_xics_latch(void)
@@ -394,10 +394,15 @@ static inline void kvmppc_mmu_flush_icache(pfn_t pfn)
         }
 }
 
-/* Please call after prepare_to_enter. This function puts the lazy ee state
-   back to normal mode, without actually enabling interrupts. */
-static inline void kvmppc_lazy_ee_enable(void)
+/*
+ * Please call after prepare_to_enter. This function puts the lazy ee and irq
+ * disabled tracking state back to normal mode, without actually enabling
+ * interrupts.
+ */
+static inline void kvmppc_fix_ee_before_entry(void)
 {
+        trace_hardirqs_on();
+
 #ifdef CONFIG_PPC64
         /* Only need to enable IRQs by hard enabling them after this */
         local_paca->irq_happened = 0;
diff --git a/arch/powerpc/include/asm/lppaca.h b/arch/powerpc/include/asm/lppaca.h
index 9b12f88d4adb..4470d1e34d23 100644
--- a/arch/powerpc/include/asm/lppaca.h
+++ b/arch/powerpc/include/asm/lppaca.h
@@ -48,15 +48,13 @@
 struct lppaca {
         /* cacheline 1 contains read-only data */
 
-        u32     desc;                   /* Eye catcher 0xD397D781 */
-        u16     size;                   /* Size of this struct */
-        u16     reserved1;
-        u16     reserved2:14;
-        u8      shared_proc:1;          /* Shared processor indicator */
-        u8      secondary_thread:1;     /* Secondary thread indicator */
+        __be32  desc;                   /* Eye catcher 0xD397D781 */
+        __be16  size;                   /* Size of this struct */
+        u8      reserved1[3];
+        u8      __old_status;           /* Old status, including shared proc */
         u8      reserved3[14];
-        volatile u32 dyn_hw_node_id;    /* Dynamic hardware node id */
-        volatile u32 dyn_hw_proc_id;    /* Dynamic hardware proc id */
+        volatile __be32 dyn_hw_node_id; /* Dynamic hardware node id */
+        volatile __be32 dyn_hw_proc_id; /* Dynamic hardware proc id */
         u8      reserved4[56];
         volatile u8 vphn_assoc_counts[8]; /* Virtual processor home node */
                                           /* associativity change counters */
@@ -73,9 +71,9 @@ struct lppaca {
         u8      fpregs_in_use;
         u8      pmcregs_in_use;
         u8      reserved8[28];
-        u64     wait_state_cycles;      /* Wait cycles for this proc */
+        __be64  wait_state_cycles;      /* Wait cycles for this proc */
         u8      reserved9[28];
-        u16     slb_count;              /* # of SLBs to maintain */
+        __be16  slb_count;              /* # of SLBs to maintain */
         u8      idle;                   /* Indicate OS is idle */
         u8      vmxregs_in_use;
 
@@ -89,17 +87,17 @@ struct lppaca {
          * NOTE: This value will ALWAYS be zero for dedicated processors and
          * will NEVER be zero for shared processors (ie, initialized to a 1).
          */
-        volatile u32 yield_count;
-        volatile u32 dispersion_count;  /* dispatch changed physical cpu */
-        volatile u64 cmo_faults;        /* CMO page fault count */
-        volatile u64 cmo_fault_time;    /* CMO page fault time */
+        volatile __be32 yield_count;
+        volatile __be32 dispersion_count; /* dispatch changed physical cpu */
+        volatile __be64 cmo_faults;     /* CMO page fault count */
+        volatile __be64 cmo_fault_time; /* CMO page fault time */
         u8      reserved10[104];
 
         /* cacheline 4-5 */
 
-        u32     page_ins;               /* CMO Hint - # page ins by OS */
+        __be32  page_ins;               /* CMO Hint - # page ins by OS */
         u8      reserved11[148];
-        volatile u64 dtl_idx;           /* Dispatch Trace Log head index */
+        volatile __be64 dtl_idx;                /* Dispatch Trace Log head index */
         u8      reserved12[96];
 } __attribute__((__aligned__(0x400)));
 
@@ -108,17 +106,29 @@ extern struct lppaca lppaca[];
 #define lppaca_of(cpu)  (*paca[cpu].lppaca_ptr)
 
 /*
+ * Old kernels used a reserved bit in the VPA to determine if it was running
+ * in shared processor mode. New kernels look for a non zero yield count
+ * but KVM still needs to set the bit to keep the old stuff happy.
+ */
+#define LPPACA_OLD_SHARED_PROC          2
+
+static inline bool lppaca_shared_proc(struct lppaca *l)
+{
+        return l->yield_count != 0;
+}
+
+/*
  * SLB shadow buffer structure as defined in the PAPR.  The save_area
  * contains adjacent ESID and VSID pairs for each shadowed SLB.  The
  * ESID is stored in the lower 64bits, then the VSID.
  */
 struct slb_shadow {
-        u32     persistent;             /* Number of persistent SLBs */
-        u32     buffer_length;          /* Total shadow buffer length */
-        u64     reserved;
+        __be32  persistent;             /* Number of persistent SLBs */
+        __be32  buffer_length;          /* Total shadow buffer length */
+        __be64  reserved;
         struct  {
-                u64     esid;
-                u64     vsid;
+                __be64     esid;
+                __be64  vsid;
         } save_area[SLB_NUM_BOLTED];
 } ____cacheline_aligned;
 
@@ -130,14 +140,14 @@ extern struct slb_shadow slb_shadow[];
 struct dtl_entry {
         u8      dispatch_reason;
         u8      preempt_reason;
-        u16     processor_id;
-        u32     enqueue_to_dispatch_time;
-        u32     ready_to_enqueue_time;
-        u32     waiting_to_ready_time;
-        u64     timebase;
-        u64     fault_addr;
-        u64     srr0;
-        u64     srr1;
+        __be16  processor_id;
+        __be32  enqueue_to_dispatch_time;
+        __be32  ready_to_enqueue_time;
+        __be32  waiting_to_ready_time;
+        __be64  timebase;
+        __be64  fault_addr;
+        __be64  srr0;
+        __be64  srr1;
 };
 
 #define DISPATCH_LOG_BYTES      4096    /* bytes per cpu */
diff --git a/arch/powerpc/include/asm/mpc5121.h b/arch/powerpc/include/asm/mpc5121.h
index 8ae133eaf9fa..887d3d6133e3 100644
--- a/arch/powerpc/include/asm/mpc5121.h
+++ b/arch/powerpc/include/asm/mpc5121.h
@@ -32,25 +32,11 @@ struct mpc512x_ccm {
         u32     scfr2;  /* System Clock Frequency Register 2 */
         u32     scfr2s; /* System Clock Frequency Shadow Register 2 */
         u32     bcr;    /* Bread Crumb Register */
-        u32     p0ccr;  /* PSC0 Clock Control Register */
-        u32     p1ccr;  /* PSC1 CCR */
-        u32     p2ccr;  /* PSC2 CCR */
-        u32     p3ccr;  /* PSC3 CCR */
-        u32     p4ccr;  /* PSC4 CCR */
-        u32     p5ccr;  /* PSC5 CCR */
-        u32     p6ccr;  /* PSC6 CCR */
-        u32     p7ccr;  /* PSC7 CCR */
-        u32     p8ccr;  /* PSC8 CCR */
-        u32     p9ccr;  /* PSC9 CCR */
-        u32     p10ccr; /* PSC10 CCR */
-        u32     p11ccr; /* PSC11 CCR */
+        u32     psc_ccr[12];    /* PSC Clock Control Registers */
         u32     spccr;  /* SPDIF Clock Control Register */
         u32     cccr;   /* CFM Clock Control Register */
         u32     dccr;   /* DIU Clock Control Register */
-        u32     m1ccr;  /* MSCAN1 CCR */
-        u32     m2ccr;  /* MSCAN2 CCR */
-        u32     m3ccr;  /* MSCAN3 CCR */
-        u32     m4ccr;  /* MSCAN4 CCR */
+        u32     mscan_ccr[4];   /* MSCAN Clock Control Registers */
         u8      res[0x98]; /* Reserved */
 };
 
diff --git a/arch/powerpc/include/asm/mpc85xx.h b/arch/powerpc/include/asm/mpc85xx.h
new file mode 100644
index 000000000000..736d4acc05a8
--- /dev/null
+++ b/arch/powerpc/include/asm/mpc85xx.h
@@ -0,0 +1,92 @@
+/*
+ * MPC85xx cpu type detection
+ *
+ * Copyright 2011-2012 Freescale Semiconductor, Inc.
+ *
+ * This is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __ASM_PPC_MPC85XX_H
+#define __ASM_PPC_MPC85XX_H
+
+#define SVR_REV(svr)    ((svr) & 0xFF)          /* SOC design resision */
+#define SVR_MAJ(svr)    (((svr) >>  4) & 0xF)   /* Major revision field*/
+#define SVR_MIN(svr)    (((svr) >>  0) & 0xF)   /* Minor revision field*/
+
+/* Some parts define SVR[0:23] as the SOC version */
+#define SVR_SOC_VER(svr) (((svr) >> 8) & 0xFFF7FF)      /* SOC Version fields */
+
+#define SVR_8533        0x803400
+#define SVR_8535        0x803701
+#define SVR_8536        0x803700
+#define SVR_8540        0x803000
+#define SVR_8541        0x807200
+#define SVR_8543        0x803200
+#define SVR_8544        0x803401
+#define SVR_8545        0x803102
+#define SVR_8547        0x803101
+#define SVR_8548        0x803100
+#define SVR_8555        0x807100
+#define SVR_8560        0x807000
+#define SVR_8567        0x807501
+#define SVR_8568        0x807500
+#define SVR_8569        0x808000
+#define SVR_8572        0x80E000
+#define SVR_P1010       0x80F100
+#define SVR_P1011       0x80E500
+#define SVR_P1012       0x80E501
+#define SVR_P1013       0x80E700
+#define SVR_P1014       0x80F101
+#define SVR_P1017       0x80F700
+#define SVR_P1020       0x80E400
+#define SVR_P1021       0x80E401
+#define SVR_P1022       0x80E600
+#define SVR_P1023       0x80F600
+#define SVR_P1024       0x80E402
+#define SVR_P1025       0x80E403
+#define SVR_P2010       0x80E300
+#define SVR_P2020       0x80E200
+#define SVR_P2040       0x821000
+#define SVR_P2041       0x821001
+#define SVR_P3041       0x821103
+#define SVR_P4040       0x820100
+#define SVR_P4080       0x820000
+#define SVR_P5010       0x822100
+#define SVR_P5020       0x822000
+#define SVR_P5021       0X820500
+#define SVR_P5040       0x820400
+#define SVR_T4240       0x824000
+#define SVR_T4120       0x824001
+#define SVR_T4160       0x824100
+#define SVR_C291        0x850000
+#define SVR_C292        0x850020
+#define SVR_C293        0x850030
+#define SVR_B4860       0X868000
+#define SVR_G4860       0x868001
+#define SVR_G4060       0x868003
+#define SVR_B4440       0x868100
+#define SVR_G4440       0x868101
+#define SVR_B4420       0x868102
+#define SVR_B4220       0x868103
+#define SVR_T1040       0x852000
+#define SVR_T1041       0x852001
+#define SVR_T1042       0x852002
+#define SVR_T1020       0x852100
+#define SVR_T1021       0x852101
+#define SVR_T1022       0x852102
+
+#define SVR_8610        0x80A000
+#define SVR_8641        0x809000
+#define SVR_8641D       0x809001
+
+#define SVR_9130        0x860001
+#define SVR_9131        0x860000
+#define SVR_9132        0x861000
+#define SVR_9232        0x861400
+
+#define SVR_Unknown     0xFFFFFF
+
+#endif
diff --git a/arch/powerpc/include/asm/mpic.h b/arch/powerpc/include/asm/mpic.h
index 4a1ac9fbf186..754f93d208fa 100644
--- a/arch/powerpc/include/asm/mpic.h
+++ b/arch/powerpc/include/asm/mpic.h
@@ -396,7 +396,14 @@ extern struct bus_type mpic_subsys;
 #define MPIC_REGSET_TSI108              MPIC_REGSET(1)  /* Tsi108/109 PIC */
 
 /* Get the version of primary MPIC */
+#ifdef CONFIG_MPIC
 extern u32 fsl_mpic_primary_get_version(void);
+#else
+static inline u32 fsl_mpic_primary_get_version(void)
+{
+        return 0;
+}
+#endif
 
 /* Allocate the controller structure and setup the linux irq descs
  * for the range if interrupts passed in. No HW initialization is
diff --git a/arch/powerpc/include/asm/opal.h b/arch/powerpc/include/asm/opal.h
index 029fe85722aa..c5cd72833d6e 100644
--- a/arch/powerpc/include/asm/opal.h
+++ b/arch/powerpc/include/asm/opal.h
@@ -124,6 +124,11 @@ extern int opal_enter_rtas(struct rtas_args *args,
 #define OPAL_PCI_POLL                           62
 #define OPAL_PCI_MSI_EOI                        63
 #define OPAL_PCI_GET_PHB_DIAG_DATA2             64
+#define OPAL_XSCOM_READ                         65
+#define OPAL_XSCOM_WRITE                        66
+#define OPAL_LPC_READ                           67
+#define OPAL_LPC_WRITE                          68
+#define OPAL_RETURN_CPU                         69
 
 #ifndef __ASSEMBLY__
 
@@ -337,6 +342,17 @@ enum OpalEpowStatus {
         OPAL_EPOW_OVER_INTERNAL_TEMP = 3
 };
 
+/*
+ * Address cycle types for LPC accesses. These also correspond
+ * to the content of the first cell of the "reg" property for
+ * device nodes on the LPC bus
+ */
+enum OpalLPCAddressType {
+        OPAL_LPC_MEM    = 0,
+        OPAL_LPC_IO     = 1,
+        OPAL_LPC_FW     = 2,
+};
+
 struct opal_machine_check_event {
         enum OpalMCE_Version    version:8;      /* 0x00 */
         uint8_t                 in_use;         /* 0x01 */
@@ -631,6 +647,15 @@ int64_t opal_set_system_attention_led(uint8_t led_action);
 int64_t opal_pci_next_error(uint64_t phb_id, uint64_t *first_frozen_pe,
                             uint16_t *pci_error_type, uint16_t *severity);
 int64_t opal_pci_poll(uint64_t phb_id);
+int64_t opal_return_cpu(void);
+
+int64_t opal_xscom_read(uint32_t gcid, uint32_t pcb_addr, uint64_t *val);
+int64_t opal_xscom_write(uint32_t gcid, uint32_t pcb_addr, uint64_t val);
+
+int64_t opal_lpc_write(uint32_t chip_id, enum OpalLPCAddressType addr_type,
+                       uint32_t addr, uint32_t data, uint32_t sz);
+int64_t opal_lpc_read(uint32_t chip_id, enum OpalLPCAddressType addr_type,
+                      uint32_t addr, uint32_t *data, uint32_t sz);
 
 /* Internal functions */
 extern int early_init_dt_scan_opal(unsigned long node, const char *uname, int depth, void *data);
@@ -664,6 +689,8 @@ extern int opal_machine_check(struct pt_regs *regs);
 
 extern void opal_shutdown(void);
 
+extern void opal_lpc_init(void);
+
 #endif /* __ASSEMBLY__ */
 
 #endif /* __OPAL_H */
diff --git a/arch/powerpc/include/asm/paca.h b/arch/powerpc/include/asm/paca.h
index 77c91e74b612..a5954cebbc55 100644
--- a/arch/powerpc/include/asm/paca.h
+++ b/arch/powerpc/include/asm/paca.h
@@ -68,8 +68,13 @@ struct paca_struct {
          * instruction.  They must travel together and be properly
          * aligned.
          */
+#ifdef __BIG_ENDIAN__
         u16 lock_token;                 /* Constant 0x8000, used in locks */
         u16 paca_index;                 /* Logical processor number */
+#else
+        u16 paca_index;                 /* Logical processor number */
+        u16 lock_token;                 /* Constant 0x8000, used in locks */
+#endif
 
         u64 kernel_toc;                 /* Kernel TOC address */
         u64 kernelbase;                 /* Base address of kernel */
@@ -93,9 +98,9 @@ struct paca_struct {
          * Now, starting in cacheline 2, the exception save areas
          */
         /* used for most interrupts/exceptions */
-        u64 exgen[12] __attribute__((aligned(0x80)));
-        u64 exmc[12];           /* used for machine checks */
-        u64 exslb[12];          /* used for SLB/segment table misses
+        u64 exgen[13] __attribute__((aligned(0x80)));
+        u64 exmc[13];           /* used for machine checks */
+        u64 exslb[13];          /* used for SLB/segment table misses
                                  * on the linear mapping */
         /* SLB related definitions */
         u16 vmalloc_sllp;
diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
index 988c812aab5b..b9f426212d3a 100644
--- a/arch/powerpc/include/asm/page.h
+++ b/arch/powerpc/include/asm/page.h
@@ -211,9 +211,19 @@ extern long long virt_phys_offset;
 #define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) + VIRT_PHYS_OFFSET))
 #define __pa(x) ((unsigned long)(x) - VIRT_PHYS_OFFSET)
 #else
+#ifdef CONFIG_PPC64
+/*
+ * gcc miscompiles (unsigned long)(&static_var) - PAGE_OFFSET
+ * with -mcmodel=medium, so we use & and | instead of - and + on 64-bit.
+ */
+#define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) | PAGE_OFFSET))
+#define __pa(x) ((unsigned long)(x) & 0x0fffffffffffffffUL)
+
+#else /* 32-bit, non book E */
 #define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) + PAGE_OFFSET - MEMORY_START))
 #define __pa(x) ((unsigned long)(x) - PAGE_OFFSET + MEMORY_START)
 #endif
+#endif
 
 /*
  * Unfortunately the PLT is in the BSS in the PPC32 ELF ABI,
diff --git a/arch/powerpc/include/asm/pci-bridge.h b/arch/powerpc/include/asm/pci-bridge.h
index 32d0d2018faf..4ca90a39d6d0 100644
--- a/arch/powerpc/include/asm/pci-bridge.h
+++ b/arch/powerpc/include/asm/pci-bridge.h
@@ -159,7 +159,7 @@ struct pci_dn {
 
         int     pci_ext_config_space;   /* for pci devices */
 
-        int     force_32bit_msi:1;
+        bool    force_32bit_msi;
 
         struct  pci_dev *pcidev;        /* back-pointer to the pci device */
 #ifdef CONFIG_EEH
diff --git a/arch/powerpc/include/asm/perf_event_fsl_emb.h b/arch/powerpc/include/asm/perf_event_fsl_emb.h
index 718a9fa94e68..a58165450f6f 100644
--- a/arch/powerpc/include/asm/perf_event_fsl_emb.h
+++ b/arch/powerpc/include/asm/perf_event_fsl_emb.h
@@ -13,7 +13,7 @@
 #include <linux/types.h>
 #include <asm/hw_irq.h>
 
-#define MAX_HWEVENTS 4
+#define MAX_HWEVENTS 6
 
 /* event flags */
 #define FSL_EMB_EVENT_VALID      1
diff --git a/arch/powerpc/include/asm/perf_event_server.h b/arch/powerpc/include/asm/perf_event_server.h
index 8b2492644754..3fd2f1b6f906 100644
--- a/arch/powerpc/include/asm/perf_event_server.h
+++ b/arch/powerpc/include/asm/perf_event_server.h
@@ -138,11 +138,11 @@ extern ssize_t power_events_sysfs_show(struct device *dev,
 #define EVENT_PTR(_id, _suffix)         &EVENT_VAR(_id, _suffix).attr.attr
 
 #define EVENT_ATTR(_name, _id, _suffix)                                 \
-        PMU_EVENT_ATTR(_name, EVENT_VAR(_id, _suffix), PME_PM_##_id,    \
+        PMU_EVENT_ATTR(_name, EVENT_VAR(_id, _suffix), PME_##_id,       \
                         power_events_sysfs_show)
 
 #define GENERIC_EVENT_ATTR(_name, _id)  EVENT_ATTR(_name, _id, _g)
 #define GENERIC_EVENT_PTR(_id)          EVENT_PTR(_id, _g)
 
-#define POWER_EVENT_ATTR(_name, _id)    EVENT_ATTR(PM_##_name, _id, _p)
+#define POWER_EVENT_ATTR(_name, _id)    EVENT_ATTR(_name, _id, _p)
 #define POWER_EVENT_PTR(_id)            EVENT_PTR(_id, _p)
diff --git a/arch/powerpc/platforms/pseries/plpar_wrappers.h b/arch/powerpc/include/asm/plpar_wrappers.h
index f35787b6a5e0..a63b045e707c 100644
--- a/arch/powerpc/platforms/pseries/plpar_wrappers.h
+++ b/arch/powerpc/include/asm/plpar_wrappers.h
@@ -1,5 +1,5 @@
-#ifndef _PSERIES_PLPAR_WRAPPERS_H
-#define _PSERIES_PLPAR_WRAPPERS_H
+#ifndef _ASM_POWERPC_PLPAR_WRAPPERS_H
+#define _ASM_POWERPC_PLPAR_WRAPPERS_H
 
 #include <linux/string.h>
 #include <linux/irqflags.h>
@@ -256,30 +256,6 @@ static inline long plpar_tce_stuff(unsigned long liobn, unsigned long ioba,
         return plpar_hcall_norets(H_STUFF_TCE, liobn, ioba, tceval, count);
 }
 
-static inline long plpar_get_term_char(unsigned long termno,
-                unsigned long *len_ret, char *buf_ret)
-{
-        long rc;
-        unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
-        unsigned long *lbuf = (unsigned long *)buf_ret; /* TODO: alignment? */
-
-        rc = plpar_hcall(H_GET_TERM_CHAR, retbuf, termno);
-
-        *len_ret = retbuf[0];
-        lbuf[0] = retbuf[1];
-        lbuf[1] = retbuf[2];
-
-        return rc;
-}
-
-static inline long plpar_put_term_char(unsigned long termno, unsigned long len,
-                const char *buffer)
-{
-        unsigned long *lbuf = (unsigned long *)buffer;  /* TODO: alignment? */
-        return plpar_hcall_norets(H_PUT_TERM_CHAR, termno, len, lbuf[0],
-                        lbuf[1]);
-}
-
 /* Set various resource mode parameters */
 static inline long plpar_set_mode(unsigned long mflags, unsigned long resource,
                 unsigned long value1, unsigned long value2)
@@ -321,4 +297,4 @@ static inline long plapr_set_watchpoint0(unsigned long dawr0, unsigned long dawr
         return plpar_set_mode(0, 2, dawr0, dawrx0);
 }
 
-#endif /* _PSERIES_PLPAR_WRAPPERS_H */
+#endif /* _ASM_POWERPC_PLPAR_WRAPPERS_H */
diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
index eccfc161e58e..d7fe9f5b46d4 100644
--- a/arch/powerpc/include/asm/ppc-opcode.h
+++ b/arch/powerpc/include/asm/ppc-opcode.h
@@ -81,6 +81,53 @@
 #define __REGA0_R30     30
 #define __REGA0_R31     31
 
+/* opcode and xopcode for instructions */
+#define OP_TRAP 3
+#define OP_TRAP_64 2
+
+#define OP_31_XOP_TRAP      4
+#define OP_31_XOP_LWZX      23
+#define OP_31_XOP_DCBST     54
+#define OP_31_XOP_LWZUX     55
+#define OP_31_XOP_TRAP_64   68
+#define OP_31_XOP_DCBF      86
+#define OP_31_XOP_LBZX      87
+#define OP_31_XOP_STWX      151
+#define OP_31_XOP_STBX      215
+#define OP_31_XOP_LBZUX     119
+#define OP_31_XOP_STBUX     247
+#define OP_31_XOP_LHZX      279
+#define OP_31_XOP_LHZUX     311
+#define OP_31_XOP_MFSPR     339
+#define OP_31_XOP_LHAX      343
+#define OP_31_XOP_LHAUX     375
+#define OP_31_XOP_STHX      407
+#define OP_31_XOP_STHUX     439
+#define OP_31_XOP_MTSPR     467
+#define OP_31_XOP_DCBI      470
+#define OP_31_XOP_LWBRX     534
+#define OP_31_XOP_TLBSYNC   566
+#define OP_31_XOP_STWBRX    662
+#define OP_31_XOP_LHBRX     790
+#define OP_31_XOP_STHBRX    918
+
+#define OP_LWZ  32
+#define OP_LD   58
+#define OP_LWZU 33
+#define OP_LBZ  34
+#define OP_LBZU 35
+#define OP_STW  36
+#define OP_STWU 37
+#define OP_STD  62
+#define OP_STB  38
+#define OP_STBU 39
+#define OP_LHZ  40
+#define OP_LHZU 41
+#define OP_LHA  42
+#define OP_LHAU 43
+#define OP_STH  44
+#define OP_STHU 45
+
 /* sorted alphabetically */
 #define PPC_INST_BHRBE                  0x7c00025c
 #define PPC_INST_CLRBHRB                0x7c00035c
diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h
index 2f1b6c5f8174..599545738af3 100644
--- a/arch/powerpc/include/asm/ppc_asm.h
+++ b/arch/powerpc/include/asm/ppc_asm.h
@@ -54,7 +54,8 @@ BEGIN_FW_FTR_SECTION;							\
         /* from user - see if there are any DTL entries to process */   \
         ld      r10,PACALPPACAPTR(r13); /* get ptr to VPA */            \
         ld      r11,PACA_DTL_RIDX(r13); /* get log read index */        \
-        ld      r10,LPPACA_DTLIDX(r10); /* get log write index */       \
+        addi    r10,r10,LPPACA_DTLIDX;                                  \
+        LDX_BE  r10,0,r10;              /* get log write index */       \
         cmpd    cr1,r11,r10;                                            \
         beq+    cr1,33f;                                                \
         bl      .accumulate_stolen_time;                                \
@@ -219,19 +220,6 @@ END_FW_FTR_SECTION_IFSET(FW_FEATURE_SPLPAR)
 #define REST_8VSRS(n,b,base)    REST_4VSRS(n,b,base); REST_4VSRS(n+4,b,base)
 #define REST_16VSRS(n,b,base)   REST_8VSRS(n,b,base); REST_8VSRS(n+8,b,base)
 #define REST_32VSRS(n,b,base)   REST_16VSRS(n,b,base); REST_16VSRS(n+16,b,base)
-/* Save the upper 32 VSRs (32-63) in the thread VSX region (0-31) */
-#define SAVE_VSRU(n,b,base)     li b,THREAD_VR0+(16*(n));  STXVD2X(n+32,R##base,R##b)
-#define SAVE_2VSRSU(n,b,base)   SAVE_VSRU(n,b,base); SAVE_VSRU(n+1,b,base)
-#define SAVE_4VSRSU(n,b,base)   SAVE_2VSRSU(n,b,base); SAVE_2VSRSU(n+2,b,base)
-#define SAVE_8VSRSU(n,b,base)   SAVE_4VSRSU(n,b,base); SAVE_4VSRSU(n+4,b,base)
-#define SAVE_16VSRSU(n,b,base)  SAVE_8VSRSU(n,b,base); SAVE_8VSRSU(n+8,b,base)
-#define SAVE_32VSRSU(n,b,base)  SAVE_16VSRSU(n,b,base); SAVE_16VSRSU(n+16,b,base)
-#define REST_VSRU(n,b,base)     li b,THREAD_VR0+(16*(n)); LXVD2X(n+32,R##base,R##b)
-#define REST_2VSRSU(n,b,base)   REST_VSRU(n,b,base); REST_VSRU(n+1,b,base)
-#define REST_4VSRSU(n,b,base)   REST_2VSRSU(n,b,base); REST_2VSRSU(n+2,b,base)
-#define REST_8VSRSU(n,b,base)   REST_4VSRSU(n,b,base); REST_4VSRSU(n+4,b,base)
-#define REST_16VSRSU(n,b,base)  REST_8VSRSU(n,b,base); REST_8VSRSU(n+8,b,base)
-#define REST_32VSRSU(n,b,base)  REST_16VSRSU(n,b,base); REST_16VSRSU(n+16,b,base)
 
 /*
  * b = base register for addressing, o = base offset from register of 1st EVR
@@ -443,15 +431,15 @@ END_FTR_SECTION_IFSET(CPU_FTR_601)
 #define ISYNC_601
 #endif
 
-#ifdef CONFIG_PPC_CELL
+#if defined(CONFIG_PPC_CELL) || defined(CONFIG_PPC_FSL_BOOK3E)
 #define MFTB(dest)                      \
-90:     mftb  dest;                     \
+90:     mfspr dest, SPRN_TBRL;          \
 BEGIN_FTR_SECTION_NESTED(96);           \
         cmpwi dest,0;                   \
         beq-  90b;                      \
 END_FTR_SECTION_NESTED(CPU_FTR_CELL_TB_BUG, CPU_FTR_CELL_TB_BUG, 96)
 #else
-#define MFTB(dest)                      mftb dest
+#define MFTB(dest)                      mfspr dest, SPRN_TBRL
 #endif
 
 #ifndef CONFIG_SMP
diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
index 47a35b08b963..e378cccfca55 100644
--- a/arch/powerpc/include/asm/processor.h
+++ b/arch/powerpc/include/asm/processor.h
@@ -247,6 +247,10 @@ struct thread_struct {
         unsigned long   tm_orig_msr;    /* Thread's MSR on ctx switch */
         struct pt_regs  ckpt_regs;      /* Checkpointed registers */
 
+        unsigned long   tm_tar;
+        unsigned long   tm_ppr;
+        unsigned long   tm_dscr;
+
         /*
          * Transactional FP and VSX 0-31 register set.
          * NOTE: the sense of these is the opposite of the integer ckpt_regs!
diff --git a/arch/powerpc/include/asm/prom.h b/arch/powerpc/include/asm/prom.h
index bc2da154f68b..7d0c7f3a7171 100644
--- a/arch/powerpc/include/asm/prom.h
+++ b/arch/powerpc/include/asm/prom.h
@@ -38,14 +38,12 @@ extern unsigned long pci_address_to_pio(phys_addr_t address);
 /* Parse the ibm,dma-window property of an OF node into the busno, phys and
  * size parameters.
  */
-void of_parse_dma_window(struct device_node *dn, const void *dma_window_prop,
-                unsigned long *busno, unsigned long *phys, unsigned long *size);
+void of_parse_dma_window(struct device_node *dn, const __be32 *dma_window,
+                         unsigned long *busno, unsigned long *phys,
+                         unsigned long *size);
 
 extern void kdump_move_device_tree(void);
 
-/* CPU OF node matching */
-struct device_node *of_get_cpu_node(int cpu, unsigned int *thread);
-
 /* cache lookup */
 struct device_node *of_find_next_cache_node(struct device_node *np);
 
@@ -58,6 +56,8 @@ static inline int of_node_to_nid(struct device_node *device) { return 0; }
 
 extern void of_instantiate_rtc(void);
 
+extern int of_get_ibm_chip_id(struct device_node *np);
+
 /* The of_drconf_cell struct defines the layout of the LMB array
  * specified in the device tree property
  * ibm,dynamic-reconfiguration-memory/ibm,dynamic-memory
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index a6840e4e24f7..10d1ef016bf1 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -115,10 +115,10 @@
 #define MSR_64BIT       MSR_SF
 
 /* Server variant */
-#define MSR_            MSR_ME | MSR_RI | MSR_IR | MSR_DR | MSR_ISF |MSR_HV
-#define MSR_KERNEL      MSR_ | MSR_64BIT
-#define MSR_USER32      MSR_ | MSR_PR | MSR_EE
-#define MSR_USER64      MSR_USER32 | MSR_64BIT
+#define MSR_            (MSR_ME | MSR_RI | MSR_IR | MSR_DR | MSR_ISF |MSR_HV)
+#define MSR_KERNEL      (MSR_ | MSR_64BIT)
+#define MSR_USER32      (MSR_ | MSR_PR | MSR_EE)
+#define MSR_USER64      (MSR_USER32 | MSR_64BIT)
 #elif defined(CONFIG_PPC_BOOK3S_32) || defined(CONFIG_8xx)
 /* Default MSR for kernel mode. */
 #define MSR_KERNEL      (MSR_ME|MSR_RI|MSR_IR|MSR_DR)
@@ -254,19 +254,28 @@
 #define SPRN_HRMOR      0x139   /* Real mode offset register */
 #define SPRN_HSRR0      0x13A   /* Hypervisor Save/Restore 0 */
 #define SPRN_HSRR1      0x13B   /* Hypervisor Save/Restore 1 */
+/* HFSCR and FSCR bit numbers are the same */
+#define FSCR_TAR_LG     8       /* Enable Target Address Register */
+#define FSCR_EBB_LG     7       /* Enable Event Based Branching */
+#define FSCR_TM_LG      5       /* Enable Transactional Memory */
+#define FSCR_BHRB_LG    4       /* Enable Branch History Rolling Buffer*/
+#define FSCR_PM_LG      3       /* Enable prob/priv access to PMU SPRs */
+#define FSCR_DSCR_LG    2       /* Enable Data Stream Control Register */
+#define FSCR_VECVSX_LG  1       /* Enable VMX/VSX  */
+#define FSCR_FP_LG      0       /* Enable Floating Point */
 #define SPRN_FSCR       0x099   /* Facility Status & Control Register */
-#define   FSCR_TAR      (1 << (63-55)) /* Enable Target Address Register */
-#define   FSCR_EBB      (1 << (63-56)) /* Enable Event Based Branching */
-#define   FSCR_DSCR     (1 << (63-61)) /* Enable Data Stream Control Register */
+#define   FSCR_TAR      __MASK(FSCR_TAR_LG)
+#define   FSCR_EBB      __MASK(FSCR_EBB_LG)
+#define   FSCR_DSCR     __MASK(FSCR_DSCR_LG)
 #define SPRN_HFSCR      0xbe    /* HV=1 Facility Status & Control Register */
-#define   HFSCR_TAR     (1 << (63-55)) /* Enable Target Address Register */
-#define   HFSCR_EBB     (1 << (63-56)) /* Enable Event Based Branching */
-#define   HFSCR_TM      (1 << (63-58)) /* Enable Transactional Memory */
-#define   HFSCR_PM      (1 << (63-60)) /* Enable prob/priv access to PMU SPRs */
-#define   HFSCR_BHRB    (1 << (63-59)) /* Enable Branch History Rolling Buffer*/
-#define   HFSCR_DSCR    (1 << (63-61)) /* Enable Data Stream Control Register */
-#define   HFSCR_VECVSX  (1 << (63-62)) /* Enable VMX/VSX  */
-#define   HFSCR_FP      (1 << (63-63)) /* Enable Floating Point */
+#define   HFSCR_TAR     __MASK(FSCR_TAR_LG)
+#define   HFSCR_EBB     __MASK(FSCR_EBB_LG)
+#define   HFSCR_TM      __MASK(FSCR_TM_LG)
+#define   HFSCR_PM      __MASK(FSCR_PM_LG)
+#define   HFSCR_BHRB    __MASK(FSCR_BHRB_LG)
+#define   HFSCR_DSCR    __MASK(FSCR_DSCR_LG)
+#define   HFSCR_VECVSX  __MASK(FSCR_VECVSX_LG)
+#define   HFSCR_FP      __MASK(FSCR_FP_LG)
 #define SPRN_TAR        0x32f   /* Target Address Register */
 #define SPRN_LPCR       0x13E   /* LPAR Control Register */
 #define   LPCR_VPM0     (1ul << (63-0))
@@ -1117,10 +1126,10 @@
                                      : "memory")
 
 #ifdef __powerpc64__
-#ifdef CONFIG_PPC_CELL
+#if defined(CONFIG_PPC_CELL) || defined(CONFIG_PPC_FSL_BOOK3E)
 #define mftb()          ({unsigned long rval;                           \
                         asm volatile(                                   \
-                                "90:    mftb %0;\n"                     \
+                                "90:    mfspr %0, %2;\n"                \
                                 "97:    cmpwi %0,0;\n"                  \
                                 "       beq- 90b;\n"                    \
                                 "99:\n"                                 \
@@ -1134,18 +1143,23 @@
                                 "       .llong 0\n"                     \
                                 "       .llong 0\n"                     \
                                 ".previous"                             \
-                        : "=r" (rval) : "i" (CPU_FTR_CELL_TB_BUG)); rval;})
+                        : "=r" (rval) \
+                        : "i" (CPU_FTR_CELL_TB_BUG), "i" (SPRN_TBRL)); \
+                        rval;})
 #else
 #define mftb()          ({unsigned long rval;   \
-                        asm volatile("mftb %0" : "=r" (rval)); rval;})
+                        asm volatile("mfspr %0, %1" : \
+                                     "=r" (rval) : "i" (SPRN_TBRL)); rval;})
 #endif /* !CONFIG_PPC_CELL */
 
 #else /* __powerpc64__ */
 
 #define mftbl()         ({unsigned long rval;   \
-                        asm volatile("mftbl %0" : "=r" (rval)); rval;})
+                        asm volatile("mfspr %0, %1" : "=r" (rval) : \
+                                "i" (SPRN_TBRL)); rval;})
 #define mftbu()         ({unsigned long rval;   \
-                        asm volatile("mftbu %0" : "=r" (rval)); rval;})
+                        asm volatile("mfspr %0, %1" : "=r" (rval) : \
+                                "i" (SPRN_TBRU)); rval;})
 #endif /* !__powerpc64__ */
 
 #define mttbl(v)        asm volatile("mttbl %0":: "r"(v))
diff --git a/arch/powerpc/include/asm/reg_booke.h b/arch/powerpc/include/asm/reg_booke.h
index b417de3cc2c4..ed8f836da094 100644
--- a/arch/powerpc/include/asm/reg_booke.h
+++ b/arch/powerpc/include/asm/reg_booke.h
@@ -29,10 +29,10 @@
 #if defined(CONFIG_PPC_BOOK3E_64)
 #define MSR_64BIT       MSR_CM
 
-#define MSR_            MSR_ME | MSR_CE
-#define MSR_KERNEL      MSR_ | MSR_64BIT
-#define MSR_USER32      MSR_ | MSR_PR | MSR_EE
-#define MSR_USER64      MSR_USER32 | MSR_64BIT
+#define MSR_            (MSR_ME | MSR_CE)
+#define MSR_KERNEL      (MSR_ | MSR_64BIT)
+#define MSR_USER32      (MSR_ | MSR_PR | MSR_EE)
+#define MSR_USER64      (MSR_USER32 | MSR_64BIT)
 #elif defined (CONFIG_40x)
 #define MSR_KERNEL      (MSR_ME|MSR_RI|MSR_IR|MSR_DR|MSR_CE)
 #define MSR_USER        (MSR_KERNEL|MSR_PR|MSR_EE)
diff --git a/arch/powerpc/include/asm/reg_fsl_emb.h b/arch/powerpc/include/asm/reg_fsl_emb.h
index 77bb71cfd991..0e3ddf5177f6 100644
--- a/arch/powerpc/include/asm/reg_fsl_emb.h
+++ b/arch/powerpc/include/asm/reg_fsl_emb.h
@@ -17,12 +17,16 @@
 /* Freescale Book E Performance Monitor APU Registers */
 #define PMRN_PMC0       0x010   /* Performance Monitor Counter 0 */
 #define PMRN_PMC1       0x011   /* Performance Monitor Counter 1 */
-#define PMRN_PMC2       0x012   /* Performance Monitor Counter 1 */
-#define PMRN_PMC3       0x013   /* Performance Monitor Counter 1 */
+#define PMRN_PMC2       0x012   /* Performance Monitor Counter 2 */
+#define PMRN_PMC3       0x013   /* Performance Monitor Counter 3 */
+#define PMRN_PMC4       0x014   /* Performance Monitor Counter 4 */
+#define PMRN_PMC5       0x015   /* Performance Monitor Counter 5 */
 #define PMRN_PMLCA0     0x090   /* PM Local Control A0 */
 #define PMRN_PMLCA1     0x091   /* PM Local Control A1 */
 #define PMRN_PMLCA2     0x092   /* PM Local Control A2 */
 #define PMRN_PMLCA3     0x093   /* PM Local Control A3 */
+#define PMRN_PMLCA4     0x094   /* PM Local Control A4 */
+#define PMRN_PMLCA5     0x095   /* PM Local Control A5 */
 
 #define PMLCA_FC        0x80000000      /* Freeze Counter */
 #define PMLCA_FCS       0x40000000      /* Freeze in Supervisor */
@@ -30,14 +34,18 @@
 #define PMLCA_FCM1      0x10000000      /* Freeze when PMM==1 */
 #define PMLCA_FCM0      0x08000000      /* Freeze when PMM==0 */
 #define PMLCA_CE        0x04000000      /* Condition Enable */
+#define PMLCA_FGCS1     0x00000002      /* Freeze in guest state */
+#define PMLCA_FGCS0     0x00000001      /* Freeze in hypervisor state */
 
-#define PMLCA_EVENT_MASK 0x00ff0000     /* Event field */
+#define PMLCA_EVENT_MASK 0x01ff0000     /* Event field */
 #define PMLCA_EVENT_SHIFT       16
 
 #define PMRN_PMLCB0     0x110   /* PM Local Control B0 */
 #define PMRN_PMLCB1     0x111   /* PM Local Control B1 */
 #define PMRN_PMLCB2     0x112   /* PM Local Control B2 */
 #define PMRN_PMLCB3     0x113   /* PM Local Control B3 */
+#define PMRN_PMLCB4     0x114   /* PM Local Control B4 */
+#define PMRN_PMLCB5     0x115   /* PM Local Control B5 */
 
 #define PMLCB_THRESHMUL_MASK    0x0700  /* Threshold Multiple Field */
 #define PMLCB_THRESHMUL_SHIFT   8
@@ -55,16 +63,22 @@
 
 #define PMRN_UPMC0      0x000   /* User Performance Monitor Counter 0 */
 #define PMRN_UPMC1      0x001   /* User Performance Monitor Counter 1 */
-#define PMRN_UPMC2      0x002   /* User Performance Monitor Counter 1 */
-#define PMRN_UPMC3      0x003   /* User Performance Monitor Counter 1 */
+#define PMRN_UPMC2      0x002   /* User Performance Monitor Counter 2 */
+#define PMRN_UPMC3      0x003   /* User Performance Monitor Counter 3 */
+#define PMRN_UPMC4      0x004   /* User Performance Monitor Counter 4 */
+#define PMRN_UPMC5      0x005   /* User Performance Monitor Counter 5 */
 #define PMRN_UPMLCA0    0x080   /* User PM Local Control A0 */
 #define PMRN_UPMLCA1    0x081   /* User PM Local Control A1 */
 #define PMRN_UPMLCA2    0x082   /* User PM Local Control A2 */
 #define PMRN_UPMLCA3    0x083   /* User PM Local Control A3 */
+#define PMRN_UPMLCA4    0x084   /* User PM Local Control A4 */
+#define PMRN_UPMLCA5    0x085   /* User PM Local Control A5 */
 #define PMRN_UPMLCB0    0x100   /* User PM Local Control B0 */
 #define PMRN_UPMLCB1    0x101   /* User PM Local Control B1 */
 #define PMRN_UPMLCB2    0x102   /* User PM Local Control B2 */
 #define PMRN_UPMLCB3    0x103   /* User PM Local Control B3 */
+#define PMRN_UPMLCB4    0x104   /* User PM Local Control B4 */
+#define PMRN_UPMLCB5    0x105   /* User PM Local Control B5 */
 #define PMRN_UPMGC0     0x180   /* User PM Global Control 0 */
 
 
diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h
index c7a8bfc9f6f5..9bd52c65e66f 100644
--- a/arch/powerpc/include/asm/rtas.h
+++ b/arch/powerpc/include/asm/rtas.h
@@ -44,12 +44,12 @@
  *
  */
 
-typedef u32 rtas_arg_t;
+typedef __be32 rtas_arg_t;
 
 struct rtas_args {
-        u32 token;
-        u32 nargs;
-        u32 nret; 
+        __be32 token;
+        __be32 nargs;
+        __be32 nret; 
         rtas_arg_t args[16];
         rtas_arg_t *rets;     /* Pointer to return values in args[]. */
 };  
diff --git a/arch/powerpc/include/asm/smp.h b/arch/powerpc/include/asm/smp.h
index 48cfc858abd6..98da78e0c2c0 100644
--- a/arch/powerpc/include/asm/smp.h
+++ b/arch/powerpc/include/asm/smp.h
@@ -112,6 +112,7 @@ static inline struct cpumask *cpu_core_mask(int cpu)
 }
 
 extern int cpu_to_core_id(int cpu);
+extern int cpu_to_chip_id(int cpu);
 
 /* Since OpenPIC has only 4 IPIs, we use slightly different message numbers.
  *
@@ -186,6 +187,8 @@ extern int smt_enabled_at_boot;
 extern int smp_mpic_probe(void);
 extern void smp_mpic_setup_cpu(int cpu);
 extern int smp_generic_kick_cpu(int nr);
+extern int smp_generic_cpu_bootable(unsigned int nr);
+
 
 extern void smp_generic_give_timebase(void);
 extern void smp_generic_take_timebase(void);
diff --git a/arch/powerpc/include/asm/spinlock.h b/arch/powerpc/include/asm/spinlock.h
index 5b23f910ee57..5f54a744dcc5 100644
--- a/arch/powerpc/include/asm/spinlock.h
+++ b/arch/powerpc/include/asm/spinlock.h
@@ -32,8 +32,12 @@
 
 #ifdef CONFIG_PPC64
 /* use 0x800000yy when locked, where yy == CPU number */
+#ifdef __BIG_ENDIAN__
 #define LOCK_TOKEN      (*(u32 *)(&get_paca()->lock_token))
 #else
+#define LOCK_TOKEN      (*(u32 *)(&get_paca()->paca_index))
+#endif
+#else
 #define LOCK_TOKEN      1
 #endif
 
@@ -96,7 +100,7 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock)
 
 #if defined(CONFIG_PPC_SPLPAR)
 /* We only yield to the hypervisor if we are in shared processor mode */
-#define SHARED_PROCESSOR (local_paca->lppaca_ptr->shared_proc)
+#define SHARED_PROCESSOR (lppaca_shared_proc(local_paca->lppaca_ptr))
 extern void __spin_yield(arch_spinlock_t *lock);
 extern void __rw_yield(arch_rwlock_t *lock);
 #else /* SPLPAR */
diff --git a/arch/powerpc/include/asm/switch_to.h b/arch/powerpc/include/asm/switch_to.h
index 49a13e0ef234..2be5618cdec6 100644
--- a/arch/powerpc/include/asm/switch_to.h
+++ b/arch/powerpc/include/asm/switch_to.h
@@ -15,12 +15,18 @@ extern struct task_struct *__switch_to(struct task_struct *,
 struct thread_struct;
 extern struct task_struct *_switch(struct thread_struct *prev,
                                    struct thread_struct *next);
+#ifdef CONFIG_PPC_BOOK3S_64
+static inline void save_tar(struct thread_struct *prev)
+{
+        if (cpu_has_feature(CPU_FTR_ARCH_207S))
+                prev->tar = mfspr(SPRN_TAR);
+}
+#else
+static inline void save_tar(struct thread_struct *prev) {}
+#endif
 
-extern void giveup_fpu(struct task_struct *);
 extern void load_up_fpu(void);
-extern void disable_kernel_fp(void);
 extern void enable_kernel_fp(void);
-extern void flush_fp_to_thread(struct task_struct *);
 extern void enable_kernel_altivec(void);
 extern void load_up_altivec(struct task_struct *);
 extern int emulate_altivec(struct pt_regs *);
@@ -38,6 +44,14 @@ static inline void discard_lazy_cpu_state(void)
 }
 #endif
 
+#ifdef CONFIG_PPC_FPU
+extern void flush_fp_to_thread(struct task_struct *);
+extern void giveup_fpu(struct task_struct *);
+#else
+static inline void flush_fp_to_thread(struct task_struct *t) { }
+static inline void giveup_fpu(struct task_struct *t) { }
+#endif
+
 #ifdef CONFIG_ALTIVEC
 extern void flush_altivec_to_thread(struct task_struct *);
 extern void giveup_altivec(struct task_struct *);
diff --git a/arch/powerpc/include/asm/timex.h b/arch/powerpc/include/asm/timex.h
index c55e14f7ef44..18908caa1f3b 100644
--- a/arch/powerpc/include/asm/timex.h
+++ b/arch/powerpc/include/asm/timex.h
@@ -29,7 +29,7 @@ static inline cycles_t get_cycles(void)
         ret = 0;
 
         __asm__ __volatile__(
-                "97:    mftb %0\n"
+                "97:    mfspr %0, %2\n"
                 "99:\n"
                 ".section __ftr_fixup,\"a\"\n"
                 ".align 2\n"
@@ -41,7 +41,7 @@ static inline cycles_t get_cycles(void)
                 "       .long 0\n"
                 "       .long 0\n"
                 ".previous"
-                : "=r" (ret) : "i" (CPU_FTR_601));
+                : "=r" (ret) : "i" (CPU_FTR_601), "i" (SPRN_TBRL));
         return ret;
 #endif
 }
diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
index 161ab662843b..89e3ef2496ac 100644
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -96,6 +96,7 @@ static inline int prrn_is_enabled(void)
 #ifdef CONFIG_PPC64
 #include <asm/smp.h>
 
+#define topology_physical_package_id(cpu)       (cpu_to_chip_id(cpu))
 #define topology_thread_cpumask(cpu)    (per_cpu(cpu_sibling_map, cpu))
 #define topology_core_cpumask(cpu)      (per_cpu(cpu_core_map, cpu))
 #define topology_core_id(cpu)           (cpu_to_core_id(cpu))
diff --git a/arch/powerpc/include/asm/udbg.h b/arch/powerpc/include/asm/udbg.h
index dc590919f8eb..b51fba10e733 100644
--- a/arch/powerpc/include/asm/udbg.h
+++ b/arch/powerpc/include/asm/udbg.h
@@ -27,10 +27,11 @@ extern void udbg_printf(const char *fmt, ...)
         __attribute__ ((format (printf, 1, 2)));
 extern void udbg_progress(char *s, unsigned short hex);
 
-extern void udbg_init_uart(void __iomem *comport, unsigned int speed,
-                           unsigned int clock);
-extern unsigned int udbg_probe_uart_speed(void __iomem *comport,
-                                          unsigned int clock);
+extern void udbg_uart_init_mmio(void __iomem *addr, unsigned int stride);
+extern void udbg_uart_init_pio(unsigned long port, unsigned int stride);
+
+extern void udbg_uart_setup(unsigned int speed, unsigned int clock);
+extern unsigned int udbg_probe_uart_speed(unsigned int clock);
 
 struct device_node;
 extern void udbg_scc_init(int force_scc);
diff --git a/arch/powerpc/include/uapi/asm/elf.h b/arch/powerpc/include/uapi/asm/elf.h
index 05b8d560cfba..7e39c9146a71 100644
--- a/arch/powerpc/include/uapi/asm/elf.h
+++ b/arch/powerpc/include/uapi/asm/elf.h
@@ -107,26 +107,25 @@ typedef elf_gregset_t32 compat_elf_gregset_t;
 # define ELF_NVRREG     34      /* includes vscr & vrsave in split vectors */
 # define ELF_NVSRHALFREG 32     /* Half the vsx registers */
 # define ELF_GREG_TYPE  elf_greg_t64
+# define ELF_ARCH       EM_PPC64
+# define ELF_CLASS      ELFCLASS64
+typedef elf_greg_t64 elf_greg_t;
+typedef elf_gregset_t64 elf_gregset_t;
 #else
 # define ELF_NEVRREG    34      /* includes acc (as 2) */
 # define ELF_NVRREG     33      /* includes vscr */
 # define ELF_GREG_TYPE  elf_greg_t32
 # define ELF_ARCH       EM_PPC
 # define ELF_CLASS      ELFCLASS32
-# define ELF_DATA       ELFDATA2MSB
+typedef elf_greg_t32 elf_greg_t;
+typedef elf_gregset_t32 elf_gregset_t;
 #endif /* __powerpc64__ */
 
-#ifndef ELF_ARCH
-# define ELF_ARCH       EM_PPC64
-# define ELF_CLASS      ELFCLASS64
-# define ELF_DATA       ELFDATA2MSB
-  typedef elf_greg_t64 elf_greg_t;
-  typedef elf_gregset_t64 elf_gregset_t;
+#ifdef __BIG_ENDIAN__
+#define ELF_DATA        ELFDATA2MSB
 #else
-  /* Assumption: ELF_ARCH == EM_PPC and ELF_CLASS == ELFCLASS32 */
-  typedef elf_greg_t32 elf_greg_t;
-  typedef elf_gregset_t32 elf_gregset_t;
-#endif /* ELF_ARCH */
+#define ELF_DATA        ELFDATA2LSB
+#endif
 
 /* Floating point registers */
 typedef double elf_fpreg_t;
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index a8619bfe879e..445cb6e39d5b 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -55,7 +55,6 @@ obj-$(CONFIG_PPC_RTAS)		+= rtas.o rtas-rtc.o $(rtaspci-y-y)
 obj-$(CONFIG_PPC_RTAS_DAEMON)   += rtasd.o
 obj-$(CONFIG_RTAS_FLASH)        += rtas_flash.o
 obj-$(CONFIG_RTAS_PROC)         += rtas-proc.o
-obj-$(CONFIG_LPARCFG)           += lparcfg.o
 obj-$(CONFIG_IBMVIO)            += vio.o
 obj-$(CONFIG_IBMEBUS)           += ibmebus.o
 obj-$(CONFIG_EEH)              += eeh.o eeh_pe.o eeh_dev.o eeh_cache.o \
@@ -117,9 +116,7 @@ obj-$(CONFIG_DYNAMIC_FTRACE)	+= ftrace.o
 obj-$(CONFIG_FUNCTION_GRAPH_TRACER)     += ftrace.o
 obj-$(CONFIG_FTRACE_SYSCALLS)   += ftrace.o
 
-obj-$(CONFIG_8XX_MINIMAL_FPEMU) += softemu8xx.o
-
-ifneq ($(CONFIG_PPC_INDIRECT_IO),y)
+ifneq ($(CONFIG_PPC_INDIRECT_PIO),y)
 obj-y                           += iomap.o
 endif
 
diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
index ee5b690a0bed..a27ccd5dc6b9 100644
--- a/arch/powerpc/kernel/align.c
+++ b/arch/powerpc/kernel/align.c
@@ -651,6 +651,10 @@ static int emulate_vsx(unsigned char __user *addr, unsigned int reg,
         int sw = 0;
         int i, j;
 
+        /* userland only */
+        if (unlikely(!user_mode(regs)))
+                return 0;
+
         flush_vsx_to_thread(current);
 
         if (reg < 32)
@@ -764,6 +768,16 @@ int fix_alignment(struct pt_regs *regs)
         nb = aligninfo[instr].len;
         flags = aligninfo[instr].flags;
 
+        /* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */
+        if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) {
+                nb = 8;
+                flags = LD+SW;
+        } else if (IS_XFORM(instruction) &&
+                   ((instruction >> 1) & 0x3ff) == 660) {
+                nb = 8;
+                flags = ST+SW;
+        }
+
         /* Byteswap little endian loads and stores */
         swiz = 0;
         if (regs->msr & MSR_LE) {
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index c7e8afc2ead0..d8958be5f31a 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -138,6 +138,9 @@ int main(void)
         DEFINE(THREAD_TM_TFHAR, offsetof(struct thread_struct, tm_tfhar));
         DEFINE(THREAD_TM_TEXASR, offsetof(struct thread_struct, tm_texasr));
         DEFINE(THREAD_TM_TFIAR, offsetof(struct thread_struct, tm_tfiar));
+        DEFINE(THREAD_TM_TAR, offsetof(struct thread_struct, tm_tar));
+        DEFINE(THREAD_TM_PPR, offsetof(struct thread_struct, tm_ppr));
+        DEFINE(THREAD_TM_DSCR, offsetof(struct thread_struct, tm_dscr));
         DEFINE(PT_CKPT_REGS, offsetof(struct thread_struct, ckpt_regs));
         DEFINE(THREAD_TRANSACT_VR0, offsetof(struct thread_struct,
                                          transact_vr[0]));
@@ -451,6 +454,7 @@ int main(void)
         DEFINE(VCPU_SPRG2, offsetof(struct kvm_vcpu, arch.shregs.sprg2));
         DEFINE(VCPU_SPRG3, offsetof(struct kvm_vcpu, arch.shregs.sprg3));
 #endif
+        DEFINE(VCPU_SHARED_SPRG3, offsetof(struct kvm_vcpu_arch_shared, sprg3));
         DEFINE(VCPU_SHARED_SPRG4, offsetof(struct kvm_vcpu_arch_shared, sprg4));
         DEFINE(VCPU_SHARED_SPRG5, offsetof(struct kvm_vcpu_arch_shared, sprg5));
         DEFINE(VCPU_SHARED_SPRG6, offsetof(struct kvm_vcpu_arch_shared, sprg6));
diff --git a/arch/powerpc/kernel/btext.c b/arch/powerpc/kernel/btext.c
index ac8f52732fde..41c011cb6070 100644
--- a/arch/powerpc/kernel/btext.c
+++ b/arch/powerpc/kernel/btext.c
@@ -25,11 +25,6 @@
 static void scrollscreen(void);
 #endif
 
-static void draw_byte(unsigned char c, long locX, long locY);
-static void draw_byte_32(unsigned char *bits, unsigned int *base, int rb);
-static void draw_byte_16(unsigned char *bits, unsigned int *base, int rb);
-static void draw_byte_8(unsigned char *bits, unsigned int *base, int rb);
-
 #define __force_data __attribute__((__section__(".data")))
 
 static int g_loc_X __force_data;
@@ -52,6 +47,26 @@ static unsigned char vga_font[cmapsz];
 int boot_text_mapped __force_data = 0;
 int force_printk_to_btext = 0;
 
+extern void rmci_on(void);
+extern void rmci_off(void);
+
+static inline void rmci_maybe_on(void)
+{
+#if defined(CONFIG_PPC_EARLY_DEBUG_BOOTX) && defined(CONFIG_PPC64)
+        if (!(mfmsr() & MSR_DR))
+                rmci_on();
+#endif
+}
+
+static inline void rmci_maybe_off(void)
+{
+#if defined(CONFIG_PPC_EARLY_DEBUG_BOOTX) && defined(CONFIG_PPC64)
+        if (!(mfmsr() & MSR_DR))
+                rmci_off();
+#endif
+}
+
+
 #ifdef CONFIG_PPC32
 /* Calc BAT values for mapping the display and store them
  * in disp_BAT.  Those values are then used from head.S to map
@@ -134,7 +149,7 @@ void __init btext_unmap(void)
  *    changes.
  */
 
-static void map_boot_text(void)
+void btext_map(void)
 {
         unsigned long base, offset, size;
         unsigned char *vbase;
@@ -209,7 +224,7 @@ int btext_initialize(struct device_node *np)
         dispDeviceRect[2] = width;
         dispDeviceRect[3] = height;
 
-        map_boot_text();
+        btext_map();
 
         return 0;
 }
@@ -283,7 +298,7 @@ void btext_update_display(unsigned long phys, int width, int height,
                 iounmap(logicalDisplayBase);
                 boot_text_mapped = 0;
         }
-        map_boot_text();
+        btext_map();
         g_loc_X = 0;
         g_loc_Y = 0;
         g_max_loc_X = width / 8;
@@ -298,6 +313,7 @@ void btext_clearscreen(void)
                                         (dispDeviceDepth >> 3)) >> 2;
         int i,j;
 
+        rmci_maybe_on();
         for (i=0; i<(dispDeviceRect[3] - dispDeviceRect[1]); i++)
         {
                 unsigned int *ptr = base;
@@ -305,6 +321,7 @@ void btext_clearscreen(void)
                         *(ptr++) = 0;
                 base += (dispDeviceRowBytes >> 2);
         }
+        rmci_maybe_off();
 }
 
 void btext_flushscreen(void)
@@ -355,6 +372,8 @@ static void scrollscreen(void)
                                    (dispDeviceDepth >> 3)) >> 2;
         int i,j;
 
+        rmci_maybe_on();
+
         for (i=0; i<(dispDeviceRect[3] - dispDeviceRect[1] - 16); i++)
         {
                 unsigned int *src_ptr = src;
@@ -371,9 +390,116 @@ static void scrollscreen(void)
                         *(dst_ptr++) = 0;
                 dst += (dispDeviceRowBytes >> 2);
         }
+
+        rmci_maybe_off();
 }
 #endif /* ndef NO_SCROLL */
 
+static unsigned int expand_bits_8[16] = {
+        0x00000000,
+        0x000000ff,
+        0x0000ff00,
+        0x0000ffff,
+        0x00ff0000,
+        0x00ff00ff,
+        0x00ffff00,
+        0x00ffffff,
+        0xff000000,
+        0xff0000ff,
+        0xff00ff00,
+        0xff00ffff,
+        0xffff0000,
+        0xffff00ff,
+        0xffffff00,
+        0xffffffff
+};
+
+static unsigned int expand_bits_16[4] = {
+        0x00000000,
+        0x0000ffff,
+        0xffff0000,
+        0xffffffff
+};
+
+
+static void draw_byte_32(unsigned char *font, unsigned int *base, int rb)
+{
+        int l, bits;
+        int fg = 0xFFFFFFFFUL;
+        int bg = 0x00000000UL;
+
+        for (l = 0; l < 16; ++l)
+        {
+                bits = *font++;
+                base[0] = (-(bits >> 7) & fg) ^ bg;
+                base[1] = (-((bits >> 6) & 1) & fg) ^ bg;
+                base[2] = (-((bits >> 5) & 1) & fg) ^ bg;
+                base[3] = (-((bits >> 4) & 1) & fg) ^ bg;
+                base[4] = (-((bits >> 3) & 1) & fg) ^ bg;
+                base[5] = (-((bits >> 2) & 1) & fg) ^ bg;
+                base[6] = (-((bits >> 1) & 1) & fg) ^ bg;
+                base[7] = (-(bits & 1) & fg) ^ bg;
+                base = (unsigned int *) ((char *)base + rb);
+        }
+}
+
+static inline void draw_byte_16(unsigned char *font, unsigned int *base, int rb)
+{
+        int l, bits;
+        int fg = 0xFFFFFFFFUL;
+        int bg = 0x00000000UL;
+        unsigned int *eb = (int *)expand_bits_16;
+
+        for (l = 0; l < 16; ++l)
+        {
+                bits = *font++;
+                base[0] = (eb[bits >> 6] & fg) ^ bg;
+                base[1] = (eb[(bits >> 4) & 3] & fg) ^ bg;
+                base[2] = (eb[(bits >> 2) & 3] & fg) ^ bg;
+                base[3] = (eb[bits & 3] & fg) ^ bg;
+                base = (unsigned int *) ((char *)base + rb);
+        }
+}
+
+static inline void draw_byte_8(unsigned char *font, unsigned int *base, int rb)
+{
+        int l, bits;
+        int fg = 0x0F0F0F0FUL;
+        int bg = 0x00000000UL;
+        unsigned int *eb = (int *)expand_bits_8;
+
+        for (l = 0; l < 16; ++l)
+        {
+                bits = *font++;
+                base[0] = (eb[bits >> 4] & fg) ^ bg;
+                base[1] = (eb[bits & 0xf] & fg) ^ bg;
+                base = (unsigned int *) ((char *)base + rb);
+        }
+}
+
+static noinline void draw_byte(unsigned char c, long locX, long locY)
+{
+        unsigned char *base     = calc_base(locX << 3, locY << 4);
+        unsigned char *font     = &vga_font[((unsigned int)c) * 16];
+        int rb                  = dispDeviceRowBytes;
+
+        rmci_maybe_on();
+        switch(dispDeviceDepth) {
+        case 24:
+        case 32:
+                draw_byte_32(font, (unsigned int *)base, rb);
+                break;
+        case 15:
+        case 16:
+                draw_byte_16(font, (unsigned int *)base, rb);
+                break;
+        case 8:
+                draw_byte_8(font, (unsigned int *)base, rb);
+                break;
+        }
+        rmci_maybe_off();
+}
+
 void btext_drawchar(char c)
 {
         int cline = 0;
@@ -465,107 +591,12 @@ void btext_drawhex(unsigned long v)
         btext_drawchar(' ');
 }
 
-static void draw_byte(unsigned char c, long locX, long locY)
-{
-        unsigned char *base     = calc_base(locX << 3, locY << 4);
-        unsigned char *font     = &vga_font[((unsigned int)c) * 16];
-        int rb                  = dispDeviceRowBytes;
-
-        switch(dispDeviceDepth) {
-        case 24:
-        case 32:
-                draw_byte_32(font, (unsigned int *)base, rb);
-                break;
-        case 15:
-        case 16:
-                draw_byte_16(font, (unsigned int *)base, rb);
-                break;
-        case 8:
-                draw_byte_8(font, (unsigned int *)base, rb);
-                break;
-        }
-}
-
-static unsigned int expand_bits_8[16] = {
-        0x00000000,
-        0x000000ff,
-        0x0000ff00,
-        0x0000ffff,
-        0x00ff0000,
-        0x00ff00ff,
-        0x00ffff00,
-        0x00ffffff,
-        0xff000000,
-        0xff0000ff,
-        0xff00ff00,
-        0xff00ffff,
-        0xffff0000,
-        0xffff00ff,
-        0xffffff00,
-        0xffffffff
-};
-
-static unsigned int expand_bits_16[4] = {
-        0x00000000,
-        0x0000ffff,
-        0xffff0000,
-        0xffffffff
-};
-
-
-static void draw_byte_32(unsigned char *font, unsigned int *base, int rb)
-{
-        int l, bits;
-        int fg = 0xFFFFFFFFUL;
-        int bg = 0x00000000UL;
-
-        for (l = 0; l < 16; ++l)
-        {
-                bits = *font++;
-                base[0] = (-(bits >> 7) & fg) ^ bg;
-                base[1] = (-((bits >> 6) & 1) & fg) ^ bg;
-                base[2] = (-((bits >> 5) & 1) & fg) ^ bg;
-                base[3] = (-((bits >> 4) & 1) & fg) ^ bg;
-                base[4] = (-((bits >> 3) & 1) & fg) ^ bg;
-                base[5] = (-((bits >> 2) & 1) & fg) ^ bg;
-                base[6] = (-((bits >> 1) & 1) & fg) ^ bg;
-                base[7] = (-(bits & 1) & fg) ^ bg;
-                base = (unsigned int *) ((char *)base + rb);
-        }
-}
-
-static void draw_byte_16(unsigned char *font, unsigned int *base, int rb)
-{
-        int l, bits;
-        int fg = 0xFFFFFFFFUL;
-        int bg = 0x00000000UL;
-        unsigned int *eb = (int *)expand_bits_16;
-
-        for (l = 0; l < 16; ++l)
-        {
-                bits = *font++;
-                base[0] = (eb[bits >> 6] & fg) ^ bg;
-                base[1] = (eb[(bits >> 4) & 3] & fg) ^ bg;
-                base[2] = (eb[(bits >> 2) & 3] & fg) ^ bg;
-                base[3] = (eb[bits & 3] & fg) ^ bg;
-                base = (unsigned int *) ((char *)base + rb);
-        }
-}
-
-static void draw_byte_8(unsigned char *font, unsigned int *base, int rb)
+void __init udbg_init_btext(void)
 {
-        int l, bits;
-        int fg = 0x0F0F0F0FUL;
-        int bg = 0x00000000UL;
-        unsigned int *eb = (int *)expand_bits_8;
-
-        for (l = 0; l < 16; ++l)
-        {
-                bits = *font++;
-                base[0] = (eb[bits >> 4] & fg) ^ bg;
-                base[1] = (eb[bits & 0xf] & fg) ^ bg;
-                base = (unsigned int *) ((char *)base + rb);
-        }
+        /* If btext is enabled, we might have a BAT setup for early display,
+         * thus we do enable some very basic udbg output
+         */
+        udbg_putc = btext_drawchar;
 }
 
 static unsigned char vga_font[cmapsz] = {
@@ -913,10 +944,3 @@ static unsigned char vga_font[cmapsz] = {
 0x00, 0x00, 0x00, 0x00,
 };
 
-void __init udbg_init_btext(void)
-{
-        /* If btext is enabled, we might have a BAT setup for early display,
-         * thus we do enable some very basic udbg output
-         */
-        udbg_putc = btext_drawchar;
-}
diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
index 9262cf2bec4b..654932727873 100644
--- a/arch/powerpc/kernel/cacheinfo.c
+++ b/arch/powerpc/kernel/cacheinfo.c
@@ -196,7 +196,7 @@ static void cache_cpu_set(struct cache *cache, int cpu)
 static int cache_size(const struct cache *cache, unsigned int *ret)
 {
         const char *propname;
-        const u32 *cache_size;
+        const __be32 *cache_size;
 
         propname = cache_type_info[cache->type].size_prop;
 
@@ -204,7 +204,7 @@ static int cache_size(const struct cache *cache, unsigned int *ret)
         if (!cache_size)
                 return -ENODEV;
 
-        *ret = *cache_size;
+        *ret = of_read_number(cache_size, 1);
         return 0;
 }
 
@@ -222,7 +222,7 @@ static int cache_size_kb(const struct cache *cache, unsigned int *ret)
 /* not cache_line_size() because that's a macro in include/linux/cache.h */
 static int cache_get_line_size(const struct cache *cache, unsigned int *ret)
 {
-        const u32 *line_size;
+        const __be32 *line_size;
         int i, lim;
 
         lim = ARRAY_SIZE(cache_type_info[cache->type].line_size_props);
@@ -239,14 +239,14 @@ static int cache_get_line_size(const struct cache *cache, unsigned int *ret)
         if (!line_size)
                 return -ENODEV;
 
-        *ret = *line_size;
+        *ret = of_read_number(line_size, 1);
         return 0;
 }
 
 static int cache_nr_sets(const struct cache *cache, unsigned int *ret)
 {
         const char *propname;
-        const u32 *nr_sets;
+        const __be32 *nr_sets;
 
         propname = cache_type_info[cache->type].nr_sets_prop;
 
@@ -254,7 +254,7 @@ static int cache_nr_sets(const struct cache *cache, unsigned int *ret)
         if (!nr_sets)
                 return -ENODEV;
 
-        *ret = *nr_sets;
+        *ret = of_read_number(nr_sets, 1);
         return 0;
 }
 
diff --git a/arch/powerpc/kernel/cpu_setup_fsl_booke.S b/arch/powerpc/kernel/cpu_setup_fsl_booke.S
index 0b9af015bedc..bfb18c7290b7 100644
--- a/arch/powerpc/kernel/cpu_setup_fsl_booke.S
+++ b/arch/powerpc/kernel/cpu_setup_fsl_booke.S
@@ -75,7 +75,7 @@ _GLOBAL(__setup_cpu_e500v2)
         bl      __e500_icache_setup
         bl      __e500_dcache_setup
         bl      __setup_e500_ivors
-#ifdef CONFIG_FSL_RIO
+#if defined(CONFIG_FSL_RIO) || defined(CONFIG_FSL_PCI)
         /* Ensure that RFXE is set */
         mfspr   r3,SPRN_HID1
         oris    r3,r3,HID1_RFXE@h
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index 22973a74df73..597d954e5860 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -2105,7 +2105,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
                         MMU_FTR_USE_TLBILX,
                 .icache_bsize           = 64,
                 .dcache_bsize           = 64,
-                .num_pmcs               = 4,
+                .num_pmcs               = 6,
                 .oprofile_cpu_type      = "ppc/e6500",
                 .oprofile_type          = PPC_OPROFILE_FSL_EMB,
                 .cpu_setup              = __setup_cpu_e6500,
diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
index ea9414c8088d..55593ee2d5aa 100644
--- a/arch/powerpc/kernel/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -1061,7 +1061,7 @@ static const struct file_operations proc_eeh_operations = {
 
 static int __init eeh_init_proc(void)
 {
-        if (machine_is(pseries))
+        if (machine_is(pseries) || machine_is(powernv))
                 proc_create("powerpc/eeh", 0, NULL, &proc_eeh_operations);
         return 0;
 }
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index ab15b8d057ad..c04cdf70d487 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -102,7 +102,8 @@ BEGIN_FW_FTR_SECTION
         /* if from user, see if there are any DTL entries to process */
         ld      r10,PACALPPACAPTR(r13)  /* get ptr to VPA */
         ld      r11,PACA_DTL_RIDX(r13)  /* get log read index */
-        ld      r10,LPPACA_DTLIDX(r10)  /* get log write index */
+        addi    r10,r10,LPPACA_DTLIDX
+        LDX_BE  r10,0,r10               /* get log write index */
         cmpd    cr1,r11,r10
         beq+    cr1,33f
         bl      .accumulate_stolen_time
@@ -449,15 +450,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_DSCR)
 
 #ifdef CONFIG_PPC_BOOK3S_64
 BEGIN_FTR_SECTION
-        /*
-         * Back up the TAR across context switches.  Note that the TAR is not
-         * available for use in the kernel.  (To provide this, the TAR should
-         * be backed up/restored on exception entry/exit instead, and be in
-         * pt_regs.  FIXME, this should be in pt_regs anyway (for debug).)
-         */
-        mfspr   r0,SPRN_TAR
-        std     r0,THREAD_TAR(r3)
-
         /* Event based branch registers */
         mfspr   r0, SPRN_BESCR
         std     r0, THREAD_BESCR(r3)
@@ -531,9 +523,11 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_1T_SEGMENT)
          */
         ld      r9,PACA_SLBSHADOWPTR(r13)
         li      r12,0
-        std     r12,SLBSHADOW_STACKESID(r9) /* Clear ESID */
-        std     r7,SLBSHADOW_STACKVSID(r9)  /* Save VSID */
-        std     r0,SLBSHADOW_STACKESID(r9)  /* Save ESID */
+        std     r12,SLBSHADOW_STACKESID(r9)     /* Clear ESID */
+        li      r12,SLBSHADOW_STACKVSID
+        STDX_BE r7,r12,r9                       /* Save VSID */
+        li      r12,SLBSHADOW_STACKESID
+        STDX_BE r0,r12,r9                       /* Save ESID */
 
         /* No need to check for MMU_FTR_NO_SLBIE_B here, since when
          * we have 1TB segments, the only CPUs known to have the errata
@@ -586,7 +580,13 @@ BEGIN_FTR_SECTION
         cmpwi   r6,0
         bne     1f
         ld      r0,0(r7)
-1:      cmpd    r0,r25
+1:
+BEGIN_FTR_SECTION_NESTED(70)
+        mfspr   r8, SPRN_FSCR
+        rldimi  r8, r6, FSCR_DSCR_LG, (63 - FSCR_DSCR_LG)
+        mtspr   SPRN_FSCR, r8
+END_FTR_SECTION_NESTED(CPU_FTR_ARCH_207S, CPU_FTR_ARCH_207S, 70)
+        cmpd    r0,r25
         beq     2f
         mtspr   SPRN_DSCR,r0
 2:
@@ -721,9 +721,9 @@ resume_kernel:
 
         /*
          * Here we are preempting the current task. We want to make
-         * sure we are soft-disabled first
+         * sure we are soft-disabled first and reconcile irq state.
          */
-        SOFT_DISABLE_INTS(r3,r4)
+        RECONCILE_IRQ_STATE(r3,r4)
 1:      bl      .preempt_schedule_irq
 
         /* Re-test flags and eventually loop */
diff --git a/arch/powerpc/kernel/epapr_paravirt.c b/arch/powerpc/kernel/epapr_paravirt.c
index d44a571e45a7..6300c13bbde4 100644
--- a/arch/powerpc/kernel/epapr_paravirt.c
+++ b/arch/powerpc/kernel/epapr_paravirt.c
@@ -30,22 +30,20 @@ extern u32 epapr_ev_idle_start[];
 
 bool epapr_paravirt_enabled;
 
-static int __init epapr_paravirt_init(void)
+static int __init early_init_dt_scan_epapr(unsigned long node,
+                                           const char *uname,
+                                           int depth, void *data)
 {
-        struct device_node *hyper_node;
         const u32 *insts;
-        int len, i;
+        unsigned long len;
+        int i;
 
-        hyper_node = of_find_node_by_path("/hypervisor");
-        if (!hyper_node)
-                return -ENODEV;
-
-        insts = of_get_property(hyper_node, "hcall-instructions", &len);
+        insts = of_get_flat_dt_prop(node, "hcall-instructions", &len);
         if (!insts)
-                return -ENODEV;
+                return 0;
 
         if (len % 4 || len > (4 * 4))
-                return -ENODEV;
+                return -1;
 
         for (i = 0; i < (len / 4); i++) {
                 patch_instruction(epapr_hypercall_start + i, insts[i]);
@@ -55,13 +53,19 @@ static int __init epapr_paravirt_init(void)
         }
 
 #if !defined(CONFIG_64BIT) || defined(CONFIG_PPC_BOOK3E_64)
-        if (of_get_property(hyper_node, "has-idle", NULL))
+        if (of_get_flat_dt_prop(node, "has-idle", NULL))
                 ppc_md.power_save = epapr_ev_idle;
 #endif
 
         epapr_paravirt_enabled = true;
 
+        return 1;
+}
+
+int __init epapr_paravirt_early_init(void)
+{
+        of_scan_flat_dt(early_init_dt_scan_epapr, NULL);
+
         return 0;
 }
 
-early_initcall(epapr_paravirt_init);
diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
index 645170a07ada..2d067049db27 100644
--- a/arch/powerpc/kernel/exceptions-64e.S
+++ b/arch/powerpc/kernel/exceptions-64e.S
@@ -198,9 +198,9 @@ exc_##n##_common:							    \
 /* This second version is meant for exceptions that don't immediately
  * hard-enable. We set a bit in paca->irq_happened to ensure that
  * a subsequent call to arch_local_irq_restore() will properly
- * hard-enable and avoid the fast-path
+ * hard-enable and avoid the fast-path, and then reconcile irq state.
  */
-#define INTS_DISABLE    SOFT_DISABLE_INTS(r3,r4)
+#define INTS_DISABLE    RECONCILE_IRQ_STATE(r3,r4)
 
 /* This is called by exceptions that used INTS_KEEP (that did not touch
  * irq indicators in the PACA). This will restore MSR:EE to it's previous
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 4e00d223b2e3..3a9ed6ac224b 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -293,27 +293,31 @@ system_call_pSeries:
          * out of line to handle them
          */
         . = 0xe00
-hv_exception_trampoline:
+hv_data_storage_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       h_data_storage_hv
 
         . = 0xe20
+hv_instr_storage_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       h_instr_storage_hv
 
         . = 0xe40
+emulation_assist_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       emulation_assist_hv
 
         . = 0xe60
+hv_exception_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       hmi_exception_hv
 
         . = 0xe80
+hv_doorbell_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       h_doorbell_hv
@@ -323,32 +327,32 @@ hv_exception_trampoline:
          * prolog code of the PerformanceMonitor one. A little
          * trickery is thus necessary
          */
-performance_monitor_pSeries_1:
         . = 0xf00
+performance_monitor_pseries_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       performance_monitor_pSeries
 
-altivec_unavailable_pSeries_1:
         . = 0xf20
+altivec_unavailable_pseries_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       altivec_unavailable_pSeries
 
-vsx_unavailable_pSeries_1:
         . = 0xf40
+vsx_unavailable_pseries_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       vsx_unavailable_pSeries
 
-facility_unavailable_trampoline:
         . = 0xf60
+facility_unavailable_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       facility_unavailable_pSeries
 
-hv_facility_unavailable_trampoline:
         . = 0xf80
+hv_facility_unavailable_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       facility_unavailable_hv
@@ -367,11 +371,7 @@ denorm_exception_hv:
         HMT_MEDIUM_PPR_DISCARD
         mtspr   SPRN_SPRG_HSCRATCH0,r13
         EXCEPTION_PROLOG_0(PACA_EXGEN)
-        std     r11,PACA_EXGEN+EX_R11(r13)
-        std     r12,PACA_EXGEN+EX_R12(r13)
-        mfspr   r9,SPRN_SPRG_HSCRATCH0
-        std     r9,PACA_EXGEN+EX_R13(r13)
-        mfcr    r9
+        EXCEPTION_PROLOG_1(PACA_EXGEN, NOTEST, 0x1500)
 
 #ifdef CONFIG_PPC_DENORMALISATION
         mfspr   r10,SPRN_HSRR1
@@ -381,6 +381,7 @@ denorm_exception_hv:
         bne+    denorm_assist
 #endif
 
+        KVMTEST(0x1500)
         EXCEPTION_PROLOG_PSERIES_1(denorm_common, EXC_HV)
         KVM_HANDLER_SKIP(PACA_EXGEN, EXC_STD, 0x1500)
 
@@ -501,6 +502,10 @@ denorm_done:
         mtcrf   0x80,r9
         ld      r9,PACA_EXGEN+EX_R9(r13)
         RESTORE_PPR_PACA(PACA_EXGEN, r10)
+BEGIN_FTR_SECTION
+        ld      r10,PACA_EXGEN+EX_CFAR(r13)
+        mtspr   SPRN_CFAR,r10
+END_FTR_SECTION_IFSET(CPU_FTR_CFAR)
         ld      r10,PACA_EXGEN+EX_R10(r13)
         ld      r11,PACA_EXGEN+EX_R11(r13)
         ld      r12,PACA_EXGEN+EX_R12(r13)
@@ -808,6 +813,7 @@ system_call_relon_pSeries:
         b       .       /* Can't happen, see v2.07 Book III-S section 6.5 */
 
         . = 0x4e40
+emulation_assist_relon_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       emulation_assist_relon_hv
@@ -816,39 +822,40 @@ system_call_relon_pSeries:
         b       .       /* Can't happen, see v2.07 Book III-S section 6.5 */
 
         . = 0x4e80
+h_doorbell_relon_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       h_doorbell_relon_hv
 
-performance_monitor_relon_pSeries_1:
         . = 0x4f00
+performance_monitor_relon_pseries_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       performance_monitor_relon_pSeries
 
-altivec_unavailable_relon_pSeries_1:
         . = 0x4f20
+altivec_unavailable_relon_pseries_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       altivec_unavailable_relon_pSeries
 
-vsx_unavailable_relon_pSeries_1:
         . = 0x4f40
+vsx_unavailable_relon_pseries_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       vsx_unavailable_relon_pSeries
 
-facility_unavailable_relon_trampoline:
         . = 0x4f60
+facility_unavailable_relon_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
         b       facility_unavailable_relon_pSeries
 
-hv_facility_unavailable_relon_trampoline:
         . = 0x4f80
+hv_facility_unavailable_relon_trampoline:
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
-        b       facility_unavailable_relon_hv
+        b       hv_facility_unavailable_relon_hv
 
         STD_RELON_EXCEPTION_PSERIES(0x5300, 0x1300, instruction_breakpoint)
 #ifdef CONFIG_PPC_DENORMALISATION
@@ -1175,6 +1182,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_VSX)
         b       .ret_from_except
 
         STD_EXCEPTION_COMMON(0xf60, facility_unavailable, .facility_unavailable_exception)
+        STD_EXCEPTION_COMMON(0xf80, hv_facility_unavailable, .facility_unavailable_exception)
 
         .align  7
         .globl  __end_handlers
@@ -1188,7 +1196,7 @@ __end_handlers:
         STD_RELON_EXCEPTION_PSERIES_OOL(0xf20, altivec_unavailable)
         STD_RELON_EXCEPTION_PSERIES_OOL(0xf40, vsx_unavailable)
         STD_RELON_EXCEPTION_PSERIES_OOL(0xf60, facility_unavailable)
-        STD_RELON_EXCEPTION_HV_OOL(0xf80, facility_unavailable)
+        STD_RELON_EXCEPTION_HV_OOL(0xf80, hv_facility_unavailable)
 
 #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_PPC_POWERNV)
 /*
diff --git a/arch/powerpc/kernel/head_40x.S b/arch/powerpc/kernel/head_40x.S
index 8a9b6f59822d..67ee0d6c1070 100644
--- a/arch/powerpc/kernel/head_40x.S
+++ b/arch/powerpc/kernel/head_40x.S
@@ -822,14 +822,6 @@ finish_tlb_load:
         rfi                     /* Should sync shadow TLBs */
         b       .               /* prevent prefetch past rfi */
 
-/* extern void giveup_fpu(struct task_struct *prev)
- *
- * The PowerPC 4xx family of processors do not have an FPU, so this just
- * returns.
- */
-_ENTRY(giveup_fpu)
-        blr
-
 /* This is where the main kernel code starts.
  */
 start_here:
diff --git a/arch/powerpc/kernel/head_44x.S b/arch/powerpc/kernel/head_44x.S
index 97e2671cde7f..c334f53453f7 100644
--- a/arch/powerpc/kernel/head_44x.S
+++ b/arch/powerpc/kernel/head_44x.S
@@ -784,16 +784,6 @@ _GLOBAL(__fixup_440A_mcheck)
         sync
         blr
 
-/*
- * extern void giveup_fpu(struct task_struct *prev)
- *
- * The 44x core does not have an FPU.
- */
-#ifndef CONFIG_PPC_FPU
-_GLOBAL(giveup_fpu)
-        blr
-#endif
-
 _GLOBAL(set_context)
 
 #ifdef CONFIG_BDI_SWITCH
diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index b61363d557b5..3d11d8038dee 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -703,6 +703,7 @@ _GLOBAL(relative_toc)
         mtlr    r0
         blr
 
+.balign 8
 p_toc:  .llong  __toc_start + 0x8000 - 0b
 
 /*
diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
index b2a5860accfb..1b92a97b1b04 100644
--- a/arch/powerpc/kernel/head_8xx.S
+++ b/arch/powerpc/kernel/head_8xx.S
@@ -691,10 +691,6 @@ modified_instr:
         b       151b
 #endif
 
-        .globl  giveup_fpu
-giveup_fpu:
-        blr
-
 /*
  * This is where the main kernel code starts.
  */
diff --git a/arch/powerpc/kernel/head_fsl_booke.S b/arch/powerpc/kernel/head_fsl_booke.S
index d10a7cacccd2..289afaffbbb5 100644
--- a/arch/powerpc/kernel/head_fsl_booke.S
+++ b/arch/powerpc/kernel/head_fsl_booke.S
@@ -948,16 +948,6 @@ _GLOBAL(giveup_spe)
 #endif /* CONFIG_SPE */
 
 /*
- * extern void giveup_fpu(struct task_struct *prev)
- *
- * Not all FSL Book-E cores have an FPU
- */
-#ifndef CONFIG_PPC_FPU
-_GLOBAL(giveup_fpu)
-        blr
-#endif
-
-/*
  * extern void abort(void)
  *
  * At present, this routine just applies a system reset.
diff --git a/arch/powerpc/kernel/io-workarounds.c b/arch/powerpc/kernel/io-workarounds.c
index fa0b54b2a362..24b968f8e4d8 100644
--- a/arch/powerpc/kernel/io-workarounds.c
+++ b/arch/powerpc/kernel/io-workarounds.c
@@ -53,6 +53,7 @@ static struct iowa_bus *iowa_pci_find(unsigned long vaddr, unsigned long paddr)
         return NULL;
 }
 
+#ifdef CONFIG_PPC_INDIRECT_MMIO
 struct iowa_bus *iowa_mem_find_bus(const PCI_IO_ADDR addr)
 {
         unsigned hugepage_shift;
@@ -90,13 +91,25 @@ struct iowa_bus *iowa_mem_find_bus(const PCI_IO_ADDR addr)
 
         return bus;
 }
+#else /* CONFIG_PPC_INDIRECT_MMIO */
+struct iowa_bus *iowa_mem_find_bus(const PCI_IO_ADDR addr)
+{
+        return NULL;
+}
+#endif /* !CONFIG_PPC_INDIRECT_MMIO */
 
+#ifdef CONFIG_PPC_INDIRECT_PIO
 struct iowa_bus *iowa_pio_find_bus(unsigned long port)
 {
         unsigned long vaddr = (unsigned long)pci_io_base + port;
         return iowa_pci_find(vaddr, 0);
 }
-
+#else
+struct iowa_bus *iowa_pio_find_bus(unsigned long port)
+{
+        return NULL;
+}
+#endif
 
 #define DEF_PCI_AC_RET(name, ret, at, al, space, aa)            \
 static ret iowa_##name at                                       \
@@ -137,6 +150,7 @@ static const struct ppc_pci_io iowa_pci_io = {
 
 };
 
+#ifdef CONFIG_PPC_INDIRECT_MMIO
 static void __iomem *iowa_ioremap(phys_addr_t addr, unsigned long size,
                                   unsigned long flags, void *caller)
 {
@@ -151,6 +165,9 @@ static void __iomem *iowa_ioremap(phys_addr_t addr, unsigned long size,
         }
         return res;
 }
+#else /* CONFIG_PPC_INDIRECT_MMIO */
+#define iowa_ioremap NULL
+#endif /* !CONFIG_PPC_INDIRECT_MMIO */
 
 /* Enable IO workaround */
 static void io_workaround_init(void)
diff --git a/arch/powerpc/kernel/io.c b/arch/powerpc/kernel/io.c
index 886381f32c3d..2a2b4aeab80f 100644
--- a/arch/powerpc/kernel/io.c
+++ b/arch/powerpc/kernel/io.c
@@ -25,6 +25,9 @@
 #include <asm/firmware.h>
 #include <asm/bug.h>
 
+/* See definition in io.h */
+bool isa_io_special;
+
 void _insb(const volatile u8 __iomem *port, void *buf, long count)
 {
         u8 *tbuf = buf;
diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
index b20ff173a671..0adab06ce5c0 100644
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -105,7 +105,7 @@ static int __init fail_iommu_debugfs(void)
         struct dentry *dir = fault_create_debugfs_attr("fail_iommu",
                                                        NULL, &fail_iommu);
 
-        return PTR_RET(dir);
+        return PTR_ERR_OR_ZERO(dir);
 }
 late_initcall(fail_iommu_debugfs);
 
diff --git a/arch/powerpc/kernel/legacy_serial.c b/arch/powerpc/kernel/legacy_serial.c
index 0733b05eb856..22e88dd2f34a 100644
--- a/arch/powerpc/kernel/legacy_serial.c
+++ b/arch/powerpc/kernel/legacy_serial.c
@@ -99,7 +99,7 @@ static int __init add_legacy_port(struct device_node *np, int want_index,
                 legacy_serial_count = index + 1;
 
         /* Check if there is a port who already claimed our slot */
-        if (legacy_serial_infos[index].np != 0) {
+        if (legacy_serial_infos[index].np != NULL) {
                 /* if we still have some room, move it, else override */
                 if (legacy_serial_count < MAX_LEGACY_SERIAL_PORTS) {
                         printk(KERN_DEBUG "Moved legacy port %d -> %d\n",
@@ -152,7 +152,7 @@ static int __init add_legacy_soc_port(struct device_node *np,
                                       struct device_node *soc_dev)
 {
         u64 addr;
-        const u32 *addrp;
+        const __be32 *addrp;
         upf_t flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | UPF_SHARE_IRQ
                 | UPF_FIXED_PORT;
         struct device_node *tsi = of_get_parent(np);
@@ -221,14 +221,19 @@ static int __init add_legacy_isa_port(struct device_node *np,
         /* Translate ISA address. If it fails, we still register the port
          * with no translated address so that it can be picked up as an IO
          * port later by the serial driver
+         *
+         * Note: Don't even try on P8 lpc, we know it's not directly mapped
          */
-        taddr = of_translate_address(np, reg);
-        if (taddr == OF_BAD_ADDR)
+        if (!of_device_is_compatible(isa_brg, "ibm,power8-lpc")) {
+                taddr = of_translate_address(np, reg);
+                if (taddr == OF_BAD_ADDR)
+                        taddr = 0;
+        } else
                 taddr = 0;
 
         /* Add port, irq will be dealt with later */
-        return add_legacy_port(np, index, UPIO_PORT, be32_to_cpu(reg[1]), taddr,
-                               NO_IRQ, UPF_BOOT_AUTOCONF, 0);
+        return add_legacy_port(np, index, UPIO_PORT, be32_to_cpu(reg[1]),
+                               taddr, NO_IRQ, UPF_BOOT_AUTOCONF, 0);
 
 }
 
@@ -237,7 +242,7 @@ static int __init add_legacy_pci_port(struct device_node *np,
                                       struct device_node *pci_dev)
 {
         u64 addr, base;
-        const u32 *addrp;
+        const __be32 *addrp;
         unsigned int flags;
         int iotype, index = -1, lindex = 0;
 
@@ -270,7 +275,7 @@ static int __init add_legacy_pci_port(struct device_node *np,
         if (iotype == UPIO_MEM)
                 base = addr;
         else
-                base = addrp[2];
+                base = of_read_number(&addrp[2], 1);
 
         /* Try to guess an index... If we have subdevices of the pci dev,
          * we get to their "reg" property
@@ -307,19 +312,31 @@ static int __init add_legacy_pci_port(struct device_node *np,
 
 static void __init setup_legacy_serial_console(int console)
 {
-        struct legacy_serial_info *info =
-                &legacy_serial_infos[console];
+        struct legacy_serial_info *info = &legacy_serial_infos[console];
+        struct plat_serial8250_port *port = &legacy_serial_ports[console];
         void __iomem *addr;
 
-        if (info->taddr == 0)
-                return;
-        addr = ioremap(info->taddr, 0x1000);
-        if (addr == NULL)
-                return;
+        /* Check if a translated MMIO address has been found */
+        if (info->taddr) {
+                addr = ioremap(info->taddr, 0x1000);
+                if (addr == NULL)
+                        return;
+                udbg_uart_init_mmio(addr, 1);
+        } else {
+                /* Check if it's PIO and we support untranslated PIO */
+                if (port->iotype == UPIO_PORT && isa_io_special)
+                        udbg_uart_init_pio(port->iobase, 1);
+                else
+                        return;
+        }
+
+        /* Try to query the current speed */
         if (info->speed == 0)
-                info->speed = udbg_probe_uart_speed(addr, info->clock);
+                info->speed = udbg_probe_uart_speed(info->clock);
+
+        /* Set it up */
         DBG("default console speed = %d\n", info->speed);
-        udbg_init_uart(addr, info->speed, info->clock);
+        udbg_uart_setup(info->speed, info->clock);
 }
 
 /*
@@ -367,10 +384,13 @@ void __init find_legacy_serial_ports(void)
         /* Next, fill our array with ISA ports */
         for_each_node_by_type(np, "serial") {
                 struct device_node *isa = of_get_parent(np);
-                if (isa && !strcmp(isa->name, "isa")) {
-                        index = add_legacy_isa_port(np, isa);
-                        if (index >= 0 && np == stdout)
-                                legacy_serial_console = index;
+                if (isa && (!strcmp(isa->name, "isa") ||
+                            !strcmp(isa->name, "lpc"))) {
+                        if (of_device_is_available(np)) {
+                                index = add_legacy_isa_port(np, isa);
+                                if (index >= 0 && np == stdout)
+                                        legacy_serial_console = index;
+                        }
                 }
                 of_node_put(isa);
         }
diff --git a/arch/powerpc/kernel/misc_32.S b/arch/powerpc/kernel/misc_32.S
index e469f30e6eeb..777d999f563b 100644
--- a/arch/powerpc/kernel/misc_32.S
+++ b/arch/powerpc/kernel/misc_32.S
@@ -327,8 +327,9 @@ END_FTR_SECTION_IFSET(CPU_FTR_UNIFIED_ID_CACHE)
  *
  * flush_icache_range(unsigned long start, unsigned long stop)
  */
-_KPROBE(__flush_icache_range)
+_KPROBE(flush_icache_range)
 BEGIN_FTR_SECTION
+        isync
         blr                             /* for 601, do nothing */
 END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE)
         li      r5,L1_CACHE_BYTES-1
diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
index 6820e45f557b..971d7e78aff2 100644
--- a/arch/powerpc/kernel/misc_64.S
+++ b/arch/powerpc/kernel/misc_64.S
@@ -67,8 +67,10 @@ PPC64_CACHES:
  *   flush all bytes from start through stop-1 inclusive
  */
 
-_KPROBE(__flush_icache_range)
-
+_KPROBE(flush_icache_range)
+BEGIN_FTR_SECTION
+        blr
+END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE)
 /*
  * Flush the data cache to memory 
  * 
@@ -247,6 +249,37 @@ _GLOBAL(__bswapdi2)
         blr
 
 #if defined(CONFIG_PPC_PMAC) || defined(CONFIG_PPC_MAPLE)
+
+_GLOBAL(rmci_on)
+        sync
+        isync
+        li      r3,0x100
+        rldicl  r3,r3,32,0
+        mfspr   r5,SPRN_HID4
+        or      r5,r5,r3
+        sync
+        mtspr   SPRN_HID4,r5
+        isync
+        slbia
+        isync
+        sync
+        blr
+
+_GLOBAL(rmci_off)
+        sync
+        isync
+        li      r3,0x100
+        rldicl  r3,r3,32,0
+        mfspr   r5,SPRN_HID4
+        andc    r5,r5,r3
+        sync
+        mtspr   SPRN_HID4,r5
+        isync
+        slbia
+        isync
+        sync
+        blr
+
 /*
  * Do an IO access in real mode
  */
@@ -416,19 +449,6 @@ _GLOBAL(scom970_write)
         blr
 #endif /* CONFIG_CPU_FREQ_PMAC64 || CONFIG_CPU_FREQ_MAPLE */
 
-
-/*
- * disable_kernel_fp()
- * Disable the FPU.
- */
-_GLOBAL(disable_kernel_fp)
-        mfmsr   r3
-        rldicl  r0,r3,(63-MSR_FP_LG),1
-        rldicl  r3,r0,(MSR_FP_LG+1),0
-        mtmsrd  r3                      /* disable use of fpu now */
-        isync
-        blr
-
 /* kexec_wait(phys_cpu)
  *
  * wait for the flag to change, indicating this kernel is going away but
diff --git a/arch/powerpc/kernel/paca.c b/arch/powerpc/kernel/paca.c
index f8f24685f10a..3fc16e3beb9f 100644
--- a/arch/powerpc/kernel/paca.c
+++ b/arch/powerpc/kernel/paca.c
@@ -34,10 +34,10 @@ extern unsigned long __toc_start;
  */
 struct lppaca lppaca[] = {
         [0 ... (NR_LPPACAS-1)] = {
-                .desc = 0xd397d781,     /* "LpPa" */
-                .size = sizeof(struct lppaca),
+                .desc = cpu_to_be32(0xd397d781),        /* "LpPa" */
+                .size = cpu_to_be16(sizeof(struct lppaca)),
                 .fpregs_in_use = 1,
-                .slb_count = 64,
+                .slb_count = cpu_to_be16(64),
                 .vmxregs_in_use = 0,
                 .page_ins = 0,
         },
@@ -101,8 +101,8 @@ static inline void free_lppacas(void) { }
  */
 struct slb_shadow slb_shadow[] __cacheline_aligned = {
         [0 ... (NR_CPUS-1)] = {
-                .persistent = SLB_NUM_BOLTED,
-                .buffer_length = sizeof(struct slb_shadow),
+                .persistent = cpu_to_be32(SLB_NUM_BOLTED),
+                .buffer_length = cpu_to_be32(sizeof(struct slb_shadow)),
         },
 };
 
diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
index 7d22a675fe1a..905a24bb7acc 100644
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -306,7 +306,7 @@ static struct resource *__pci_mmap_make_offset(struct pci_dev *dev,
         unsigned long io_offset = 0;
         int i, res_bit;
 
-        if (hose == 0)
+        if (hose == NULL)
                 return NULL;            /* should never happen */
 
         /* If memory, add on the PCI bridge address offset */
@@ -667,7 +667,7 @@ void pci_resource_to_user(const struct pci_dev *dev, int bar,
 void pci_process_bridge_OF_ranges(struct pci_controller *hose,
                                   struct device_node *dev, int primary)
 {
-        const u32 *ranges;
+        const __be32 *ranges;
         int rlen;
         int pna = of_n_addr_cells(dev);
         int np = pna + 5;
@@ -687,7 +687,7 @@ void pci_process_bridge_OF_ranges(struct pci_controller *hose,
         /* Parse it */
         while ((rlen -= np * 4) >= 0) {
                 /* Read next ranges element */
-                pci_space = ranges[0];
+                pci_space = of_read_number(ranges, 1);
                 pci_addr = of_read_number(ranges + 1, 2);
                 cpu_addr = of_translate_address(dev, ranges + 3);
                 size = of_read_number(ranges + pna + 3, 2);
@@ -704,7 +704,7 @@ void pci_process_bridge_OF_ranges(struct pci_controller *hose,
                 /* Now consume following elements while they are contiguous */
                 for (; rlen >= np * sizeof(u32);
                      ranges += np, rlen -= np * 4) {
-                        if (ranges[0] != pci_space)
+                        if (of_read_number(ranges, 1) != pci_space)
                                 break;
                         pci_next = of_read_number(ranges + 1, 2);
                         cpu_next = of_translate_address(dev, ranges + 3);
@@ -1055,8 +1055,7 @@ void pcibios_fixup_bus(struct pci_bus *bus)
          * bases. This is -not- called when generating the PCI tree from
          * the OF device-tree.
          */
-        if (bus->self != NULL)
-                pci_read_bridge_bases(bus);
+        pci_read_bridge_bases(bus);
 
         /* Now fixup the bus bus */
         pcibios_setup_bus_self(bus);
@@ -1578,7 +1577,7 @@ fake_pci_bus(struct pci_controller *hose, int busnr)
 {
         static struct pci_bus bus;
 
-        if (hose == 0) {
+        if (hose == NULL) {
                 printk(KERN_ERR "Can't find hose for PCI bus %d!\n", busnr);
         }
         bus.number = busnr;
@@ -1674,12 +1673,8 @@ void pcibios_scan_phb(struct pci_controller *hose)
         /* Configure PCI Express settings */
         if (bus && !pci_has_flag(PCI_PROBE_ONLY)) {
                 struct pci_bus *child;
-                list_for_each_entry(child, &bus->children, node) {
-                        struct pci_dev *self = child->self;
-                        if (!self)
-                                continue;
-                        pcie_bus_configure_settings(child, self->pcie_mpss);
-                }
+                list_for_each_entry(child, &bus->children, node)
+                        pcie_bus_configure_settings(child);
         }
 }
 
diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
index 2e8629654ca8..a9e311f7a9dd 100644
--- a/arch/powerpc/kernel/pci_64.c
+++ b/arch/powerpc/kernel/pci_64.c
@@ -109,7 +109,7 @@ int pcibios_unmap_io_space(struct pci_bus *bus)
         hose = pci_bus_to_host(bus);
 
         /* Check if we have IOs allocated */
-        if (hose->io_base_alloc == 0)
+        if (hose->io_base_alloc == NULL)
                 return 0;
 
         pr_debug("IO unmapping for PHB %s\n", hose->dn->full_name);
@@ -272,7 +272,7 @@ static void quirk_radeon_32bit_msi(struct pci_dev *dev)
         struct pci_dn *pdn = pci_get_pdn(dev);
 
         if (pdn)
-                pdn->force_32bit_msi = 1;
+                pdn->force_32bit_msi = true;
 }
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x68f2, quirk_radeon_32bit_msi);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0xaa68, quirk_radeon_32bit_msi);
diff --git a/arch/powerpc/kernel/pci_dn.c b/arch/powerpc/kernel/pci_dn.c
index df038442548a..1f61fab59d9b 100644
--- a/arch/powerpc/kernel/pci_dn.c
+++ b/arch/powerpc/kernel/pci_dn.c
@@ -47,9 +47,8 @@ struct pci_dn *pci_get_pdn(struct pci_dev *pdev)
 void *update_dn_pci_info(struct device_node *dn, void *data)
 {
         struct pci_controller *phb = data;
-        const int *type =
-                of_get_property(dn, "ibm,pci-config-space-type", NULL);
-        const u32 *regs;
+        const __be32 *type = of_get_property(dn, "ibm,pci-config-space-type", NULL);
+        const __be32 *regs;
         struct pci_dn *pdn;
 
         pdn = zalloc_maybe_bootmem(sizeof(*pdn), GFP_KERNEL);
@@ -63,12 +62,14 @@ void *update_dn_pci_info(struct device_node *dn, void *data)
 #endif
         regs = of_get_property(dn, "reg", NULL);
         if (regs) {
+                u32 addr = of_read_number(regs, 1);
+
                 /* First register entry is addr (00BBSS00)  */
-                pdn->busno = (regs[0] >> 16) & 0xff;
-                pdn->devfn = (regs[0] >> 8) & 0xff;
+                pdn->busno = (addr >> 16) & 0xff;
+                pdn->devfn = (addr >> 8) & 0xff;
         }
 
-        pdn->pci_ext_config_space = (type && *type == 1);
+        pdn->pci_ext_config_space = (type && of_read_number(type, 1) == 1);
         return NULL;
 }
 
@@ -98,12 +99,13 @@ void *traverse_pci_devices(struct device_node *start, traverse_func pre,
 
         /* We started with a phb, iterate all childs */
         for (dn = start->child; dn; dn = nextdn) {
-                const u32 *classp;
-                u32 class;
+                const __be32 *classp;
+                u32 class = 0;
 
                 nextdn = NULL;
                 classp = of_get_property(dn, "class-code", NULL);
-                class = classp ? *classp : 0;
+                if (classp)
+                        class = of_read_number(classp, 1);
 
                 if (pre && ((ret = pre(dn, data)) != NULL))
                         return ret;
diff --git a/arch/powerpc/kernel/pci_of_scan.c b/arch/powerpc/kernel/pci_of_scan.c
index 15d9105323bf..4368ec6fdc8c 100644
--- a/arch/powerpc/kernel/pci_of_scan.c
+++ b/arch/powerpc/kernel/pci_of_scan.c
@@ -24,12 +24,12 @@
  */
 static u32 get_int_prop(struct device_node *np, const char *name, u32 def)
 {
-        const u32 *prop;
+        const __be32 *prop;
         int len;
 
         prop = of_get_property(np, name, &len);
         if (prop && len >= 4)
-                return *prop;
+                return of_read_number(prop, 1);
         return def;
 }
 
@@ -77,7 +77,7 @@ static void of_pci_parse_addrs(struct device_node *node, struct pci_dev *dev)
         unsigned int flags;
         struct pci_bus_region region;
         struct resource *res;
-        const u32 *addrs;
+        const __be32 *addrs;
         u32 i;
         int proplen;
 
@@ -86,14 +86,14 @@ static void of_pci_parse_addrs(struct device_node *node, struct pci_dev *dev)
                 return;
         pr_debug("    parse addresses (%d bytes) @ %p\n", proplen, addrs);
         for (; proplen >= 20; proplen -= 20, addrs += 5) {
-                flags = pci_parse_of_flags(addrs[0], 0);
+                flags = pci_parse_of_flags(of_read_number(addrs, 1), 0);
                 if (!flags)
                         continue;
                 base = of_read_number(&addrs[1], 2);
                 size = of_read_number(&addrs[3], 2);
                 if (!size)
                         continue;
-                i = addrs[0] & 0xff;
+                i = of_read_number(addrs, 1) & 0xff;
                 pr_debug("  base: %llx, size: %llx, i: %x\n",
                          (unsigned long long)base,
                          (unsigned long long)size, i);
@@ -207,7 +207,7 @@ void of_scan_pci_bridge(struct pci_dev *dev)
 {
         struct device_node *node = dev->dev.of_node;
         struct pci_bus *bus;
-        const u32 *busrange, *ranges;
+        const __be32 *busrange, *ranges;
         int len, i, mode;
         struct pci_bus_region region;
         struct resource *res;
@@ -230,9 +230,11 @@ void of_scan_pci_bridge(struct pci_dev *dev)
                 return;
         }
 
-        bus = pci_find_bus(pci_domain_nr(dev->bus), busrange[0]);
+        bus = pci_find_bus(pci_domain_nr(dev->bus),
+                           of_read_number(busrange, 1));
         if (!bus) {
-                bus = pci_add_new_bus(dev->bus, dev, busrange[0]);
+                bus = pci_add_new_bus(dev->bus, dev,
+                                      of_read_number(busrange, 1));
                 if (!bus) {
                         printk(KERN_ERR "Failed to create pci bus for %s\n",
                                node->full_name);
@@ -241,7 +243,8 @@ void of_scan_pci_bridge(struct pci_dev *dev)
         }
 
         bus->primary = dev->bus->number;
-        pci_bus_insert_busn_res(bus, busrange[0], busrange[1]);
+        pci_bus_insert_busn_res(bus, of_read_number(busrange, 1),
+                                of_read_number(busrange+1, 1));
         bus->bridge_ctl = 0;
 
         /* parse ranges property */
@@ -254,7 +257,7 @@ void of_scan_pci_bridge(struct pci_dev *dev)
         }
         i = 1;
         for (; len >= 32; len -= 32, ranges += 8) {
-                flags = pci_parse_of_flags(ranges[0], 1);
+                flags = pci_parse_of_flags(of_read_number(ranges, 1), 1);
                 size = of_read_number(&ranges[6], 2);
                 if (flags == 0 || size == 0)
                         continue;
diff --git a/arch/powerpc/kernel/ppc_ksyms.c b/arch/powerpc/kernel/ppc_ksyms.c
index c29666586998..21646dbe1bb3 100644
--- a/arch/powerpc/kernel/ppc_ksyms.c
+++ b/arch/powerpc/kernel/ppc_ksyms.c
@@ -96,7 +96,9 @@ EXPORT_SYMBOL(pci_dram_offset);
 
 EXPORT_SYMBOL(start_thread);
 
+#ifdef CONFIG_PPC_FPU
 EXPORT_SYMBOL(giveup_fpu);
+#endif
 #ifdef CONFIG_ALTIVEC
 EXPORT_SYMBOL(giveup_altivec);
 #endif /* CONFIG_ALTIVEC */
@@ -111,7 +113,6 @@ EXPORT_SYMBOL(giveup_spe);
 #ifndef CONFIG_PPC64
 EXPORT_SYMBOL(flush_instruction_cache);
 #endif
-EXPORT_SYMBOL(__flush_icache_range);
 EXPORT_SYMBOL(flush_dcache_range);
 
 #ifdef CONFIG_SMP
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index c517dbe705fd..6f428da53e20 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -74,6 +74,7 @@ struct task_struct *last_task_used_vsx = NULL;
 struct task_struct *last_task_used_spe = NULL;
 #endif
 
+#ifdef CONFIG_PPC_FPU
 /*
  * Make sure the floating-point register state in the
  * the thread_struct is up to date for task tsk.
@@ -107,6 +108,7 @@ void flush_fp_to_thread(struct task_struct *tsk)
         }
 }
 EXPORT_SYMBOL_GPL(flush_fp_to_thread);
+#endif
 
 void enable_kernel_fp(void)
 {
@@ -600,6 +602,16 @@ struct task_struct *__switch_to(struct task_struct *prev,
         struct ppc64_tlb_batch *batch;
 #endif
 
+        /* Back up the TAR across context switches.
+         * Note that the TAR is not available for use in the kernel.  (To
+         * provide this, the TAR should be backed up/restored on exception
+         * entry/exit instead, and be in pt_regs.  FIXME, this should be in
+         * pt_regs anyway (for debug).)
+         * Save the TAR here before we do treclaim/trecheckpoint as these
+         * will change the TAR.
+         */
+        save_tar(&prev->thread);
+
         __switch_to_tm(prev);
 
 #ifdef CONFIG_SMP
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index eb23ac92abb9..6bfcab97c981 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -215,16 +215,16 @@ static void __init check_cpu_pa_features(unsigned long node)
 #ifdef CONFIG_PPC_STD_MMU_64
 static void __init check_cpu_slb_size(unsigned long node)
 {
-        u32 *slb_size_ptr;
+        __be32 *slb_size_ptr;
 
         slb_size_ptr = of_get_flat_dt_prop(node, "slb-size", NULL);
         if (slb_size_ptr != NULL) {
-                mmu_slb_size = *slb_size_ptr;
+                mmu_slb_size = be32_to_cpup(slb_size_ptr);
                 return;
         }
         slb_size_ptr = of_get_flat_dt_prop(node, "ibm,slb-size", NULL);
         if (slb_size_ptr != NULL) {
-                mmu_slb_size = *slb_size_ptr;
+                mmu_slb_size = be32_to_cpup(slb_size_ptr);
         }
 }
 #else
@@ -279,11 +279,11 @@ static void __init check_cpu_feature_properties(unsigned long node)
 {
         unsigned long i;
         struct feature_property *fp = feature_properties;
-        const u32 *prop;
+        const __be32 *prop;
 
         for (i = 0; i < ARRAY_SIZE(feature_properties); ++i, ++fp) {
                 prop = of_get_flat_dt_prop(node, fp->name, NULL);
-                if (prop && *prop >= fp->min_value) {
+                if (prop && be32_to_cpup(prop) >= fp->min_value) {
                         cur_cpu_spec->cpu_features |= fp->cpu_feature;
                         cur_cpu_spec->cpu_user_features |= fp->cpu_user_ftr;
                 }
@@ -295,8 +295,8 @@ static int __init early_init_dt_scan_cpus(unsigned long node,
                                           void *data)
 {
         char *type = of_get_flat_dt_prop(node, "device_type", NULL);
-        const u32 *prop;
-        const u32 *intserv;
+        const __be32 *prop;
+        const __be32 *intserv;
         int i, nthreads;
         unsigned long len;
         int found = -1;
@@ -324,8 +324,9 @@ static int __init early_init_dt_scan_cpus(unsigned long node,
                  * version 2 of the kexec param format adds the phys cpuid of
                  * booted proc.
                  */
-                if (initial_boot_params->version >= 2) {
-                        if (intserv[i] == initial_boot_params->boot_cpuid_phys) {
+                if (be32_to_cpu(initial_boot_params->version) >= 2) {
+                        if (be32_to_cpu(intserv[i]) ==
+                            be32_to_cpu(initial_boot_params->boot_cpuid_phys)) {
                                 found = boot_cpu_count;
                                 found_thread = i;
                         }
@@ -347,9 +348,10 @@ static int __init early_init_dt_scan_cpus(unsigned long node,
 
         if (found >= 0) {
                 DBG("boot cpu: logical %d physical %d\n", found,
-                        intserv[found_thread]);
+                        be32_to_cpu(intserv[found_thread]));
                 boot_cpuid = found;
-                set_hard_smp_processor_id(found, intserv[found_thread]);
+                set_hard_smp_processor_id(found,
+                        be32_to_cpu(intserv[found_thread]));
 
                 /*
                  * PAPR defines "logical" PVR values for cpus that
@@ -366,8 +368,8 @@ static int __init early_init_dt_scan_cpus(unsigned long node,
                  * it uses 0x0f000001.
                  */
                 prop = of_get_flat_dt_prop(node, "cpu-version", NULL);
-                if (prop && (*prop & 0xff000000) == 0x0f000000)
-                        identify_cpu(0, *prop);
+                if (prop && (be32_to_cpup(prop) & 0xff000000) == 0x0f000000)
+                        identify_cpu(0, be32_to_cpup(prop));
 
                 identical_pvr_fixup(node);
         }
@@ -389,7 +391,7 @@ static int __init early_init_dt_scan_cpus(unsigned long node,
 int __init early_init_dt_scan_chosen_ppc(unsigned long node, const char *uname,
                                          int depth, void *data)
 {
-        unsigned long *lprop;
+        unsigned long *lprop; /* All these set by kernel, so no need to convert endian */
 
         /* Use common scan routine to determine if this is the chosen node */
         if (early_init_dt_scan_chosen(node, uname, depth, data) == 0)
@@ -454,7 +456,7 @@ static int __init early_init_dt_scan_drconf_memory(unsigned long node)
         if (dm == NULL || l < sizeof(__be32))
                 return 0;
 
-        n = *dm++;      /* number of entries */
+        n = of_read_number(dm++, 1);    /* number of entries */
         if (l < (n * (dt_root_addr_cells + 4) + 1) * sizeof(__be32))
                 return 0;
 
@@ -466,7 +468,7 @@ static int __init early_init_dt_scan_drconf_memory(unsigned long node)
 
         for (; n != 0; --n) {
                 base = dt_mem_next_cell(dt_root_addr_cells, &dm);
-                flags = dm[3];
+                flags = of_read_number(&dm[3], 1);
                 /* skip DRC index, pad, assoc. list index, flags */
                 dm += 4;
                 /* skip this block if the reserved bit is set in flags (0x80)
@@ -591,16 +593,16 @@ static void __init early_reserve_mem_dt(void)
 static void __init early_reserve_mem(void)
 {
         u64 base, size;
-        u64 *reserve_map;
+        __be64 *reserve_map;
         unsigned long self_base;
         unsigned long self_size;
 
-        reserve_map = (u64 *)(((unsigned long)initial_boot_params) +
-                                        initial_boot_params->off_mem_rsvmap);
+        reserve_map = (__be64 *)(((unsigned long)initial_boot_params) +
+                        be32_to_cpu(initial_boot_params->off_mem_rsvmap));
 
         /* before we do anything, lets reserve the dt blob */
         self_base = __pa((unsigned long)initial_boot_params);
-        self_size = initial_boot_params->totalsize;
+        self_size = be32_to_cpu(initial_boot_params->totalsize);
         memblock_reserve(self_base, self_size);
 
         /* Look for the new "reserved-regions" property in the DT */
@@ -620,15 +622,15 @@ static void __init early_reserve_mem(void)
          * Handle the case where we might be booting from an old kexec
          * image that setup the mem_rsvmap as pairs of 32-bit values
          */
-        if (*reserve_map > 0xffffffffull) {
+        if (be64_to_cpup(reserve_map) > 0xffffffffull) {
                 u32 base_32, size_32;
-                u32 *reserve_map_32 = (u32 *)reserve_map;
+                __be32 *reserve_map_32 = (__be32 *)reserve_map;
 
                 DBG("Found old 32-bit reserve map\n");
 
                 while (1) {
-                        base_32 = *(reserve_map_32++);
-                        size_32 = *(reserve_map_32++);
+                        base_32 = be32_to_cpup(reserve_map_32++);
+                        size_32 = be32_to_cpup(reserve_map_32++);
                         if (size_32 == 0)
                                 break;
                         /* skip if the reservation is for the blob */
@@ -644,8 +646,8 @@ static void __init early_reserve_mem(void)
 
         /* Handle the reserve map in the fdt blob if it exists */
         while (1) {
-                base = *(reserve_map++);
-                size = *(reserve_map++);
+                base = be64_to_cpup(reserve_map++);
+                size = be64_to_cpup(reserve_map++);
                 if (size == 0)
                         break;
                 DBG("reserving: %llx -> %llx\n", base, size);
@@ -795,6 +797,32 @@ struct device_node *of_find_next_cache_node(struct device_node *np)
         return NULL;
 }
 
+/**
+ * of_get_ibm_chip_id - Returns the IBM "chip-id" of a device
+ * @np: device node of the device
+ *
+ * This looks for a property "ibm,chip-id" in the node or any
+ * of its parents and returns its content, or -1 if it cannot
+ * be found.
+ */
+int of_get_ibm_chip_id(struct device_node *np)
+{
+        of_node_get(np);
+        while(np) {
+                struct device_node *old = np;
+                const __be32 *prop;
+
+                prop = of_get_property(np, "ibm,chip-id", NULL);
+                if (prop) {
+                        of_node_put(np);
+                        return be32_to_cpup(prop);
+                }
+                np = of_get_parent(np);
+                of_node_put(old);
+        }
+        return -1;
+}
+
 #ifdef CONFIG_PPC_PSERIES
 /*
  * Fix up the uninitialized fields in a new device node:
@@ -865,49 +893,10 @@ static int __init prom_reconfig_setup(void)
 __initcall(prom_reconfig_setup);
 #endif
 
-/* Find the device node for a given logical cpu number, also returns the cpu
- * local thread number (index in ibm,interrupt-server#s) if relevant and
- * asked for (non NULL)
- */
-struct device_node *of_get_cpu_node(int cpu, unsigned int *thread)
+bool arch_match_cpu_phys_id(int cpu, u64 phys_id)
 {
-        int hardid;
-        struct device_node *np;
-
-        hardid = get_hard_smp_processor_id(cpu);
-
-        for_each_node_by_type(np, "cpu") {
-                const u32 *intserv;
-                unsigned int plen, t;
-
-                /* Check for ibm,ppc-interrupt-server#s. If it doesn't exist
-                 * fallback to "reg" property and assume no threads
-                 */
-                intserv = of_get_property(np, "ibm,ppc-interrupt-server#s",
-                                &plen);
-                if (intserv == NULL) {
-                        const u32 *reg = of_get_property(np, "reg", NULL);
-                        if (reg == NULL)
-                                continue;
-                        if (*reg == hardid) {
-                                if (thread)
-                                        *thread = 0;
-                                return np;
-                        }
-                } else {
-                        plen /= sizeof(u32);
-                        for (t = 0; t < plen; t++) {
-                                if (hardid == intserv[t]) {
-                                        if (thread)
-                                                *thread = t;
-                                        return np;
-                                }
-                        }
-                }
-        }
-        return NULL;
+        return (int)phys_id == get_hard_smp_processor_id(cpu);
 }
-EXPORT_SYMBOL(of_get_cpu_node);
 
 #if defined(CONFIG_DEBUG_FS) && defined(DEBUG)
 static struct debugfs_blob_wrapper flat_dt_blob;
@@ -917,7 +906,7 @@ static int __init export_flat_device_tree(void)
         struct dentry *d;
 
         flat_dt_blob.data = initial_boot_params;
-        flat_dt_blob.size = initial_boot_params->totalsize;
+        flat_dt_blob.size = be32_to_cpu(initial_boot_params->totalsize);
 
         d = debugfs_create_blob("flat-device-tree", S_IFREG | S_IRUSR,
                                 powerpc_debugfs_root, &flat_dt_blob);
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index 607902424e73..7b6391b68fb8 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -107,10 +107,10 @@ int of_workarounds;
 typedef u32 prom_arg_t;
 
 struct prom_args {
-        u32 service;
-        u32 nargs;
-        u32 nret;
-        prom_arg_t args[10];
+        __be32 service;
+        __be32 nargs;
+        __be32 nret;
+        __be32 args[10];
 };
 
 struct prom_t {
@@ -123,11 +123,11 @@ struct prom_t {
 };
 
 struct mem_map_entry {
-        u64     base;
-        u64     size;
+        __be64  base;
+        __be64  size;
 };
 
-typedef u32 cell_t;
+typedef __be32 cell_t;
 
 extern void __start(unsigned long r3, unsigned long r4, unsigned long r5,
                     unsigned long r6, unsigned long r7, unsigned long r8,
@@ -219,13 +219,13 @@ static int __init call_prom(const char *service, int nargs, int nret, ...)
         struct prom_args args;
         va_list list;
 
-        args.service = ADDR(service);
-        args.nargs = nargs;
-        args.nret = nret;
+        args.service = cpu_to_be32(ADDR(service));
+        args.nargs = cpu_to_be32(nargs);
+        args.nret = cpu_to_be32(nret);
 
         va_start(list, nret);
         for (i = 0; i < nargs; i++)
-                args.args[i] = va_arg(list, prom_arg_t);
+                args.args[i] = cpu_to_be32(va_arg(list, prom_arg_t));
         va_end(list);
 
         for (i = 0; i < nret; i++)
@@ -234,7 +234,7 @@ static int __init call_prom(const char *service, int nargs, int nret, ...)
         if (enter_prom(&args, prom_entry) < 0)
                 return PROM_ERROR;
 
-        return (nret > 0) ? args.args[nargs] : 0;
+        return (nret > 0) ? be32_to_cpu(args.args[nargs]) : 0;
 }
 
 static int __init call_prom_ret(const char *service, int nargs, int nret,
@@ -244,13 +244,13 @@ static int __init call_prom_ret(const char *service, int nargs, int nret,
         struct prom_args args;
         va_list list;
 
-        args.service = ADDR(service);
-        args.nargs = nargs;
-        args.nret = nret;
+        args.service = cpu_to_be32(ADDR(service));
+        args.nargs = cpu_to_be32(nargs);
+        args.nret = cpu_to_be32(nret);
 
         va_start(list, rets);
         for (i = 0; i < nargs; i++)
-                args.args[i] = va_arg(list, prom_arg_t);
+                args.args[i] = cpu_to_be32(va_arg(list, prom_arg_t));
         va_end(list);
 
         for (i = 0; i < nret; i++)
@@ -261,9 +261,9 @@ static int __init call_prom_ret(const char *service, int nargs, int nret,
 
         if (rets != NULL)
                 for (i = 1; i < nret; ++i)
-                        rets[i-1] = args.args[nargs+i];
+                        rets[i-1] = be32_to_cpu(args.args[nargs+i]);
 
-        return (nret > 0) ? args.args[nargs] : 0;
+        return (nret > 0) ? be32_to_cpu(args.args[nargs]) : 0;
 }
 
 
@@ -527,7 +527,7 @@ static int __init prom_setprop(phandle node, const char *nodename,
 #define islower(c)      ('a' <= (c) && (c) <= 'z')
 #define toupper(c)      (islower(c) ? ((c) - 'a' + 'A') : (c))
 
-unsigned long prom_strtoul(const char *cp, const char **endp)
+static unsigned long prom_strtoul(const char *cp, const char **endp)
 {
         unsigned long result = 0, base = 10, value;
 
@@ -552,7 +552,7 @@ unsigned long prom_strtoul(const char *cp, const char **endp)
         return result;
 }
 
-unsigned long prom_memparse(const char *ptr, const char **retptr)
+static unsigned long prom_memparse(const char *ptr, const char **retptr)
 {
         unsigned long ret = prom_strtoul(ptr, retptr);
         int shift = 0;
@@ -724,7 +724,8 @@ unsigned char ibm_architecture_vec[] = {
 
 };
 
-/* Old method - ELF header with PT_NOTE sections */
+/* Old method - ELF header with PT_NOTE sections only works on BE */
+#ifdef __BIG_ENDIAN__
 static struct fake_elf {
         Elf32_Ehdr      elfhdr;
         Elf32_Phdr      phdr[2];
@@ -810,6 +811,7 @@ static struct fake_elf {
                 }
         }
 };
+#endif /* __BIG_ENDIAN__ */
 
 static int __init prom_count_smt_threads(void)
 {
@@ -852,9 +854,9 @@ static int __init prom_count_smt_threads(void)
 
 static void __init prom_send_capabilities(void)
 {
-        ihandle elfloader, root;
+        ihandle root;
         prom_arg_t ret;
-        u32 *cores;
+        __be32 *cores;
 
         root = call_prom("open", 1, 1, ADDR("/"));
         if (root != 0) {
@@ -864,15 +866,15 @@ static void __init prom_send_capabilities(void)
                  * (we assume this is the same for all cores) and use it to
                  * divide NR_CPUS.
                  */
-                cores = (u32 *)&ibm_architecture_vec[IBM_ARCH_VEC_NRCORES_OFFSET];
-                if (*cores != NR_CPUS) {
+                cores = (__be32 *)&ibm_architecture_vec[IBM_ARCH_VEC_NRCORES_OFFSET];
+                if (be32_to_cpup(cores) != NR_CPUS) {
                         prom_printf("WARNING ! "
                                     "ibm_architecture_vec structure inconsistent: %lu!\n",
-                                    *cores);
+                                    be32_to_cpup(cores));
                 } else {
-                        *cores = DIV_ROUND_UP(NR_CPUS, prom_count_smt_threads());
+                        *cores = cpu_to_be32(DIV_ROUND_UP(NR_CPUS, prom_count_smt_threads()));
                         prom_printf("Max number of cores passed to firmware: %lu (NR_CPUS = %lu)\n",
-                                    *cores, NR_CPUS);
+                                    be32_to_cpup(cores), NR_CPUS);
                 }
 
                 /* try calling the ibm,client-architecture-support method */
@@ -893,17 +895,24 @@ static void __init prom_send_capabilities(void)
                 prom_printf(" not implemented\n");
         }
 
-        /* no ibm,client-architecture-support call, try the old way */
-        elfloader = call_prom("open", 1, 1, ADDR("/packages/elf-loader"));
-        if (elfloader == 0) {
-                prom_printf("couldn't open /packages/elf-loader\n");
-                return;
+#ifdef __BIG_ENDIAN__
+        {
+                ihandle elfloader;
+
+                /* no ibm,client-architecture-support call, try the old way */
+                elfloader = call_prom("open", 1, 1,
+                                      ADDR("/packages/elf-loader"));
+                if (elfloader == 0) {
+                        prom_printf("couldn't open /packages/elf-loader\n");
+                        return;
+                }
+                call_prom("call-method", 3, 1, ADDR("process-elf-header"),
+                          elfloader, ADDR(&fake_elf));
+                call_prom("close", 1, 0, elfloader);
         }
-        call_prom("call-method", 3, 1, ADDR("process-elf-header"),
-                        elfloader, ADDR(&fake_elf));
-        call_prom("close", 1, 0, elfloader);
+#endif /* __BIG_ENDIAN__ */
 }
-#endif
+#endif /* #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_PPC_POWERNV) */
 
 /*
  * Memory allocation strategy... our layout is normally:
@@ -1050,11 +1059,11 @@ static unsigned long __init prom_next_cell(int s, cell_t **cellp)
                 p++;
                 s--;
         }
-        r = *p++;
+        r = be32_to_cpu(*p++);
 #ifdef CONFIG_PPC64
         if (s > 1) {
                 r <<= 32;
-                r |= *(p++);
+                r |= be32_to_cpu(*(p++));
         }
 #endif
         *cellp = p;
@@ -1087,8 +1096,8 @@ static void __init reserve_mem(u64 base, u64 size)
 
         if (cnt >= (MEM_RESERVE_MAP_SIZE - 1))
                 prom_panic("Memory reserve map exhausted !\n");
-        mem_reserve_map[cnt].base = base;
-        mem_reserve_map[cnt].size = size;
+        mem_reserve_map[cnt].base = cpu_to_be64(base);
+        mem_reserve_map[cnt].size = cpu_to_be64(size);
         mem_reserve_cnt = cnt + 1;
 }
 
@@ -1102,6 +1111,7 @@ static void __init prom_init_mem(void)
         char *path, type[64];
         unsigned int plen;
         cell_t *p, *endp;
+        __be32 val;
         u32 rac, rsc;
 
         /*
@@ -1109,12 +1119,14 @@ static void __init prom_init_mem(void)
          * 1) top of RMO (first node)
          * 2) top of memory
          */
-        rac = 2;
-        prom_getprop(prom.root, "#address-cells", &rac, sizeof(rac));
-        rsc = 1;
-        prom_getprop(prom.root, "#size-cells", &rsc, sizeof(rsc));
-        prom_debug("root_addr_cells: %x\n", (unsigned long) rac);
-        prom_debug("root_size_cells: %x\n", (unsigned long) rsc);
+        val = cpu_to_be32(2);
+        prom_getprop(prom.root, "#address-cells", &val, sizeof(val));
+        rac = be32_to_cpu(val);
+        val = cpu_to_be32(1);
+        prom_getprop(prom.root, "#size-cells", &val, sizeof(rsc));
+        rsc = be32_to_cpu(val);
+        prom_debug("root_addr_cells: %x\n", rac);
+        prom_debug("root_size_cells: %x\n", rsc);
 
         prom_debug("scanning memory:\n");
         path = prom_scratch;
@@ -1222,25 +1234,23 @@ static void __init prom_init_mem(void)
 
 static void __init prom_close_stdin(void)
 {
-        ihandle val;
+        __be32 val;
+        ihandle stdin;
 
-        if (prom_getprop(prom.chosen, "stdin", &val, sizeof(val)) > 0)
-                call_prom("close", 1, 0, val);
+        if (prom_getprop(prom.chosen, "stdin", &val, sizeof(val)) > 0) {
+                stdin = be32_to_cpu(val);
+                call_prom("close", 1, 0, stdin);
+        }
 }
 
 #ifdef CONFIG_PPC_POWERNV
 
-static u64 __initdata prom_opal_size;
-static u64 __initdata prom_opal_align;
-static int __initdata prom_rtas_start_cpu;
-static u64 __initdata prom_rtas_data;
-static u64 __initdata prom_rtas_entry;
-
 #ifdef CONFIG_PPC_EARLY_DEBUG_OPAL
 static u64 __initdata prom_opal_base;
 static u64 __initdata prom_opal_entry;
 #endif
 
+#ifdef __BIG_ENDIAN__
 /* XXX Don't change this structure without updating opal-takeover.S */
 static struct opal_secondary_data {
         s64                             ack;    /*  0 */
@@ -1248,6 +1258,12 @@ static struct opal_secondary_data {
         struct opal_takeover_args       args;   /* 16 */
 } opal_secondary_data;
 
+static u64 __initdata prom_opal_align;
+static u64 __initdata prom_opal_size;
+static int __initdata prom_rtas_start_cpu;
+static u64 __initdata prom_rtas_data;
+static u64 __initdata prom_rtas_entry;
+
 extern char opal_secondary_entry;
 
 static void __init prom_query_opal(void)
@@ -1265,6 +1281,7 @@ static void __init prom_query_opal(void)
         }
 
         prom_printf("Querying for OPAL presence... ");
+
         rc = opal_query_takeover(&prom_opal_size,
                                  &prom_opal_align);
         prom_debug("(rc = %ld) ", rc);
@@ -1425,6 +1442,7 @@ static void __init prom_opal_takeover(void)
         for (;;)
                 opal_do_takeover(args);
 }
+#endif /* __BIG_ENDIAN__ */
 
 /*
  * Allocate room for and instantiate OPAL
@@ -1435,6 +1453,7 @@ static void __init prom_instantiate_opal(void)
         ihandle opal_inst;
         u64 base, entry;
         u64 size = 0, align = 0x10000;
+        __be64 val64;
         u32 rets[2];
 
         prom_debug("prom_instantiate_opal: start...\n");
@@ -1444,11 +1463,14 @@ static void __init prom_instantiate_opal(void)
         if (!PHANDLE_VALID(opal_node))
                 return;
 
-        prom_getprop(opal_node, "opal-runtime-size", &size, sizeof(size));
+        val64 = 0;
+        prom_getprop(opal_node, "opal-runtime-size", &val64, sizeof(val64));
+        size = be64_to_cpu(val64);
         if (size == 0)
                 return;
-        prom_getprop(opal_node, "opal-runtime-alignment", &align,
-                     sizeof(align));
+        val64 = 0;
+        prom_getprop(opal_node, "opal-runtime-alignment", &val64,sizeof(val64));
+        align = be64_to_cpu(val64);
 
         base = alloc_down(size, align, 0);
         if (base == 0) {
@@ -1505,6 +1527,7 @@ static void __init prom_instantiate_rtas(void)
         phandle rtas_node;
         ihandle rtas_inst;
         u32 base, entry = 0;
+        __be32 val;
         u32 size = 0;
 
         prom_debug("prom_instantiate_rtas: start...\n");
@@ -1514,7 +1537,9 @@ static void __init prom_instantiate_rtas(void)
         if (!PHANDLE_VALID(rtas_node))
                 return;
 
-        prom_getprop(rtas_node, "rtas-size", &size, sizeof(size));
+        val = 0;
+        prom_getprop(rtas_node, "rtas-size", &val, sizeof(size));
+        size = be32_to_cpu(val);
         if (size == 0)
                 return;
 
@@ -1541,12 +1566,14 @@ static void __init prom_instantiate_rtas(void)
 
         reserve_mem(base, size);
 
+        val = cpu_to_be32(base);
         prom_setprop(rtas_node, "/rtas", "linux,rtas-base",
-                     &base, sizeof(base));
+                     &val, sizeof(val));
+        val = cpu_to_be32(entry);
         prom_setprop(rtas_node, "/rtas", "linux,rtas-entry",
-                     &entry, sizeof(entry));
+                     &val, sizeof(val));
 
-#ifdef CONFIG_PPC_POWERNV
+#if defined(CONFIG_PPC_POWERNV) && defined(__BIG_ENDIAN__)
         /* PowerVN takeover hack */
         prom_rtas_data = base;
         prom_rtas_entry = entry;
@@ -1620,6 +1647,7 @@ static void __init prom_instantiate_sml(void)
 /*
  * Allocate room for and initialize TCE tables
  */
+#ifdef __BIG_ENDIAN__
 static void __init prom_initialize_tce_table(void)
 {
         phandle node;
@@ -1748,7 +1776,8 @@ static void __init prom_initialize_tce_table(void)
         /* Flag the first invalid entry */
         prom_debug("ending prom_initialize_tce_table\n");
 }
-#endif
+#endif /* __BIG_ENDIAN__ */
+#endif /* CONFIG_PPC64 */
 
 /*
  * With CHRP SMP we need to use the OF to start the other processors.
@@ -1777,7 +1806,6 @@ static void __init prom_initialize_tce_table(void)
 static void __init prom_hold_cpus(void)
 {
         unsigned long i;
-        unsigned int reg;
         phandle node;
         char type[64];
         unsigned long *spinloop
@@ -1803,6 +1831,9 @@ static void __init prom_hold_cpus(void)
 
         /* look for cpus */
         for (node = 0; prom_next_node(&node); ) {
+                unsigned int cpu_no;
+                __be32 reg;
+
                 type[0] = 0;
                 prom_getprop(node, "device_type", type, sizeof(type));
                 if (strcmp(type, "cpu") != 0)
@@ -1813,10 +1844,11 @@ static void __init prom_hold_cpus(void)
                         if (strcmp(type, "okay") != 0)
                                 continue;
 
-                reg = -1;
+                reg = cpu_to_be32(-1); /* make sparse happy */
                 prom_getprop(node, "reg", &reg, sizeof(reg));
+                cpu_no = be32_to_cpu(reg);
 
-                prom_debug("cpu hw idx   = %lu\n", reg);
+                prom_debug("cpu hw idx   = %lu\n", cpu_no);
 
                 /* Init the acknowledge var which will be reset by
                  * the secondary cpu when it awakens from its OF
@@ -1824,24 +1856,24 @@ static void __init prom_hold_cpus(void)
                  */
                 *acknowledge = (unsigned long)-1;
 
-                if (reg != prom.cpu) {
+                if (cpu_no != prom.cpu) {
                         /* Primary Thread of non-boot cpu or any thread */
-                        prom_printf("starting cpu hw idx %lu... ", reg);
+                        prom_printf("starting cpu hw idx %lu... ", cpu_no);
                         call_prom("start-cpu", 3, 0, node,
-                                  secondary_hold, reg);
+                                  secondary_hold, cpu_no);
 
                         for (i = 0; (i < 100000000) && 
                              (*acknowledge == ((unsigned long)-1)); i++ )
                                 mb();
 
-                        if (*acknowledge == reg)
+                        if (*acknowledge == cpu_no)
                                 prom_printf("done\n");
                         else
                                 prom_printf("failed: %x\n", *acknowledge);
                 }
 #ifdef CONFIG_SMP
                 else
-                        prom_printf("boot cpu hw idx %lu\n", reg);
+                        prom_printf("boot cpu hw idx %lu\n", cpu_no);
 #endif /* CONFIG_SMP */
         }
 
@@ -1895,6 +1927,7 @@ static void __init prom_find_mmu(void)
         prom.memory = call_prom("open", 1, 1, ADDR("/memory"));
         prom_getprop(prom.chosen, "mmu", &prom.mmumap,
                      sizeof(prom.mmumap));
+        prom.mmumap = be32_to_cpu(prom.mmumap);
         if (!IHANDLE_VALID(prom.memory) || !IHANDLE_VALID(prom.mmumap))
                 of_workarounds &= ~OF_WA_CLAIM;         /* hmmm */
 }
@@ -1906,17 +1939,19 @@ static void __init prom_init_stdout(void)
 {
         char *path = of_stdout_device;
         char type[16];
-        u32 val;
+        phandle stdout_node;
+        __be32 val;
 
         if (prom_getprop(prom.chosen, "stdout", &val, sizeof(val)) <= 0)
                 prom_panic("cannot find stdout");
 
-        prom.stdout = val;
+        prom.stdout = be32_to_cpu(val);
 
         /* Get the full OF pathname of the stdout device */
         memset(path, 0, 256);
         call_prom("instance-to-path", 3, 1, prom.stdout, path, 255);
-        val = call_prom("instance-to-package", 1, 1, prom.stdout);
+        stdout_node = call_prom("instance-to-package", 1, 1, prom.stdout);
+        val = cpu_to_be32(stdout_node);
         prom_setprop(prom.chosen, "/chosen", "linux,stdout-package",
                      &val, sizeof(val));
         prom_printf("OF stdout device is: %s\n", of_stdout_device);
@@ -1925,9 +1960,9 @@ static void __init prom_init_stdout(void)
 
         /* If it's a display, note it */
         memset(type, 0, sizeof(type));
-        prom_getprop(val, "device_type", type, sizeof(type));
+        prom_getprop(stdout_node, "device_type", type, sizeof(type));
         if (strcmp(type, "display") == 0)
-                prom_setprop(val, path, "linux,boot-display", NULL, 0);
+                prom_setprop(stdout_node, path, "linux,boot-display", NULL, 0);
 }
 
 static int __init prom_find_machine_type(void)
@@ -2082,6 +2117,22 @@ static void __init prom_check_displays(void)
                                            clut[2]) != 0)
                                 break;
 #endif /* CONFIG_LOGO_LINUX_CLUT224 */
+
+#ifdef CONFIG_PPC_EARLY_DEBUG_BOOTX
+                if (prom_getprop(node, "linux,boot-display", NULL, 0) !=
+                    PROM_ERROR) {
+                        u32 width, height, pitch, addr;
+
+                        prom_printf("Setting btext !\n");
+                        prom_getprop(node, "width", &width, 4);
+                        prom_getprop(node, "height", &height, 4);
+                        prom_getprop(node, "linebytes", &pitch, 4);
+                        prom_getprop(node, "address", &addr, 4);
+                        prom_printf("W=%d H=%d LB=%d addr=0x%x\n",
+                                    width, height, pitch, addr);
+                        btext_setup_display(width, height, 8, pitch, addr);
+                }
+#endif /* CONFIG_PPC_EARLY_DEBUG_BOOTX */
         }
 }
 
@@ -2117,8 +2168,10 @@ static void __init *make_room(unsigned long *mem_start, unsigned long *mem_end,
         return ret;
 }
 
-#define dt_push_token(token, mem_start, mem_end) \
-        do { *((u32 *)make_room(mem_start, mem_end, 4, 4)) = token; } while(0)
+#define dt_push_token(token, mem_start, mem_end) do {                   \
+                void *room = make_room(mem_start, mem_end, 4, 4);       \
+                *(__be32 *)room = cpu_to_be32(token);                   \
+        } while(0)
 
 static unsigned long __init dt_find_string(char *str)
 {
@@ -2291,7 +2344,7 @@ static void __init scan_dt_build_struct(phandle node, unsigned long *mem_start,
                         dt_push_token(4, mem_start, mem_end);
                         dt_push_token(soff, mem_start, mem_end);
                         valp = make_room(mem_start, mem_end, 4, 4);
-                        *(u32 *)valp = node;
+                        *(__be32 *)valp = cpu_to_be32(node);
                 }
         }
 
@@ -2364,16 +2417,16 @@ static void __init flatten_device_tree(void)
         dt_struct_end = PAGE_ALIGN(mem_start);
 
         /* Finish header */
-        hdr->boot_cpuid_phys = prom.cpu;
-        hdr->magic = OF_DT_HEADER;
-        hdr->totalsize = dt_struct_end - dt_header_start;
-        hdr->off_dt_struct = dt_struct_start - dt_header_start;
-        hdr->off_dt_strings = dt_string_start - dt_header_start;
-        hdr->dt_strings_size = dt_string_end - dt_string_start;
-        hdr->off_mem_rsvmap = ((unsigned long)rsvmap) - dt_header_start;
-        hdr->version = OF_DT_VERSION;
+        hdr->boot_cpuid_phys = cpu_to_be32(prom.cpu);
+        hdr->magic = cpu_to_be32(OF_DT_HEADER);
+        hdr->totalsize = cpu_to_be32(dt_struct_end - dt_header_start);
+        hdr->off_dt_struct = cpu_to_be32(dt_struct_start - dt_header_start);
+        hdr->off_dt_strings = cpu_to_be32(dt_string_start - dt_header_start);
+        hdr->dt_strings_size = cpu_to_be32(dt_string_end - dt_string_start);
+        hdr->off_mem_rsvmap = cpu_to_be32(((unsigned long)rsvmap) - dt_header_start);
+        hdr->version = cpu_to_be32(OF_DT_VERSION);
         /* Version 16 is not backward compatible */
-        hdr->last_comp_version = 0x10;
+        hdr->last_comp_version = cpu_to_be32(0x10);
 
         /* Copy the reserve map in */
         memcpy(rsvmap, mem_reserve_map, sizeof(mem_reserve_map));
@@ -2384,8 +2437,8 @@ static void __init flatten_device_tree(void)
                 prom_printf("reserved memory map:\n");
                 for (i = 0; i < mem_reserve_cnt; i++)
                         prom_printf("  %x - %x\n",
-                                    mem_reserve_map[i].base,
-                                    mem_reserve_map[i].size);
+                                    be64_to_cpu(mem_reserve_map[i].base),
+                                    be64_to_cpu(mem_reserve_map[i].size));
         }
 #endif
         /* Bump mem_reserve_cnt to cause further reservations to fail
@@ -2397,7 +2450,6 @@ static void __init flatten_device_tree(void)
                     dt_string_start, dt_string_end);
         prom_printf("Device tree struct  0x%x -> 0x%x\n",
                     dt_struct_start, dt_struct_end);
-
 }
 
 #ifdef CONFIG_PPC_MAPLE
@@ -2730,18 +2782,19 @@ static void __init fixup_device_tree(void)
 
 static void __init prom_find_boot_cpu(void)
 {
-        u32 getprop_rval;
+        __be32 rval;
         ihandle prom_cpu;
         phandle cpu_pkg;
 
-        prom.cpu = 0;
-        if (prom_getprop(prom.chosen, "cpu", &prom_cpu, sizeof(prom_cpu)) <= 0)
+        rval = 0;
+        if (prom_getprop(prom.chosen, "cpu", &rval, sizeof(rval)) <= 0)
                 return;
+        prom_cpu = be32_to_cpu(rval);
 
         cpu_pkg = call_prom("instance-to-package", 1, 1, prom_cpu);
 
-        prom_getprop(cpu_pkg, "reg", &getprop_rval, sizeof(getprop_rval));
-        prom.cpu = getprop_rval;
+        prom_getprop(cpu_pkg, "reg", &rval, sizeof(rval));
+        prom.cpu = be32_to_cpu(rval);
 
         prom_debug("Booting CPU hw index = %lu\n", prom.cpu);
 }
@@ -2750,15 +2803,15 @@ static void __init prom_check_initrd(unsigned long r3, unsigned long r4)
 {
 #ifdef CONFIG_BLK_DEV_INITRD
         if (r3 && r4 && r4 != 0xdeadbeef) {
-                unsigned long val;
+                __be64 val;
 
                 prom_initrd_start = is_kernel_addr(r3) ? __pa(r3) : r3;
                 prom_initrd_end = prom_initrd_start + r4;
 
-                val = prom_initrd_start;
+                val = cpu_to_be64(prom_initrd_start);
                 prom_setprop(prom.chosen, "/chosen", "linux,initrd-start",
                              &val, sizeof(val));
-                val = prom_initrd_end;
+                val = cpu_to_be64(prom_initrd_end);
                 prom_setprop(prom.chosen, "/chosen", "linux,initrd-end",
                              &val, sizeof(val));
 
@@ -2915,7 +2968,7 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
          */
         prom_check_displays();
 
-#ifdef CONFIG_PPC64
+#if defined(CONFIG_PPC64) && defined(__BIG_ENDIAN__)
         /*
          * Initialize IOMMU (TCE tables) on pSeries. Do that before anything else
          * that uses the allocator, we need to make sure we get the top of memory
@@ -2934,6 +2987,7 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
                 prom_instantiate_rtas();
 
 #ifdef CONFIG_PPC_POWERNV
+#ifdef __BIG_ENDIAN__
         /* Detect HAL and try instanciating it & doing takeover */
         if (of_platform == PLATFORM_PSERIES_LPAR) {
                 prom_query_opal();
@@ -2941,9 +2995,11 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
                         prom_opal_hold_cpus();
                         prom_opal_takeover();
                 }
-        } else if (of_platform == PLATFORM_OPAL)
+        } else
+#endif /* __BIG_ENDIAN__ */
+        if (of_platform == PLATFORM_OPAL)
                 prom_instantiate_opal();
-#endif
+#endif /* CONFIG_PPC_POWERNV */
 
 #ifdef CONFIG_PPC64
         /* instantiate sml */
@@ -2962,10 +3018,11 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
         /*
          * Fill in some infos for use by the kernel later on
          */
-        if (prom_memory_limit)
+        if (prom_memory_limit) {
+                __be64 val = cpu_to_be64(prom_memory_limit);
                 prom_setprop(prom.chosen, "/chosen", "linux,memory-limit",
-                             &prom_memory_limit,
-                             sizeof(prom_memory_limit));
+                             &val, sizeof(val));
+        }
 #ifdef CONFIG_PPC64
         if (prom_iommu_off)
                 prom_setprop(prom.chosen, "/chosen", "linux,iommu-off",
diff --git a/arch/powerpc/kernel/prom_init_check.sh b/arch/powerpc/kernel/prom_init_check.sh
index 3765da6be4f2..b0c263da219a 100644
--- a/arch/powerpc/kernel/prom_init_check.sh
+++ b/arch/powerpc/kernel/prom_init_check.sh
@@ -22,7 +22,8 @@ __secondary_hold_acknowledge __secondary_hold_spinloop __start
 strcmp strcpy strlcpy strlen strncmp strstr logo_linux_clut224
 reloc_got2 kernstart_addr memstart_addr linux_banner _stext
 opal_query_takeover opal_do_takeover opal_enter_rtas opal_secondary_entry
-boot_command_line __prom_init_toc_start __prom_init_toc_end"
+boot_command_line __prom_init_toc_start __prom_init_toc_end
+btext_setup_display"
 
 NM="$1"
 OBJ="$2"
diff --git a/arch/powerpc/kernel/prom_parse.c b/arch/powerpc/kernel/prom_parse.c
index 4e1331b8eb33..6295e646f78c 100644
--- a/arch/powerpc/kernel/prom_parse.c
+++ b/arch/powerpc/kernel/prom_parse.c
@@ -7,28 +7,27 @@
 #include <linux/of_address.h>
 #include <asm/prom.h>
 
-void of_parse_dma_window(struct device_node *dn, const void *dma_window_prop,
-                unsigned long *busno, unsigned long *phys, unsigned long *size)
+void of_parse_dma_window(struct device_node *dn, const __be32 *dma_window,
+                         unsigned long *busno, unsigned long *phys,
+                         unsigned long *size)
 {
-        const u32 *dma_window;
         u32 cells;
-        const unsigned char *prop;
-
-        dma_window = dma_window_prop;
+        const __be32 *prop;
 
         /* busno is always one cell */
-        *busno = *(dma_window++);
+        *busno = of_read_number(dma_window, 1);
+        dma_window++;
 
         prop = of_get_property(dn, "ibm,#dma-address-cells", NULL);
         if (!prop)
                 prop = of_get_property(dn, "#address-cells", NULL);
 
-        cells = prop ? *(u32 *)prop : of_n_addr_cells(dn);
+        cells = prop ? of_read_number(prop, 1) : of_n_addr_cells(dn);
         *phys = of_read_number(dma_window, cells);
 
         dma_window += cells;
 
         prop = of_get_property(dn, "ibm,#dma-size-cells", NULL);
-        cells = prop ? *(u32 *)prop : of_n_size_cells(dn);
+        cells = prop ? of_read_number(prop, 1) : of_n_size_cells(dn);
         *size = of_read_number(dma_window, cells);
 }
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index 80b5ef403f68..4cf674d7d5ae 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -91,7 +91,7 @@ static void unlock_rtas(unsigned long flags)
  * are designed only for very early low-level debugging, which
  * is why the token is hard-coded to 10.
  */
-static void call_rtas_display_status(char c)
+static void call_rtas_display_status(unsigned char c)
 {
         struct rtas_args *args = &rtas.args;
         unsigned long s;
@@ -100,11 +100,11 @@ static void call_rtas_display_status(char c)
                 return;
         s = lock_rtas();
 
-        args->token = 10;
-        args->nargs = 1;
-        args->nret  = 1;
-        args->rets  = (rtas_arg_t *)&(args->args[1]);
-        args->args[0] = (unsigned char)c;
+        args->token = cpu_to_be32(10);
+        args->nargs = cpu_to_be32(1);
+        args->nret  = cpu_to_be32(1);
+        args->rets  = &(args->args[1]);
+        args->args[0] = cpu_to_be32(c);
 
         enter_rtas(__pa(args));
 
@@ -204,7 +204,7 @@ void rtas_progress(char *s, unsigned short hex)
 {
         struct device_node *root;
         int width;
-        const int *p;
+        const __be32 *p;
         char *os;
         static int display_character, set_indicator;
         static int display_width, display_lines, form_feed;
@@ -221,13 +221,13 @@ void rtas_progress(char *s, unsigned short hex)
                 if ((root = of_find_node_by_path("/rtas"))) {
                         if ((p = of_get_property(root,
                                         "ibm,display-line-length", NULL)))
-                                display_width = *p;
+                                display_width = be32_to_cpu(*p);
                         if ((p = of_get_property(root,
                                         "ibm,form-feed", NULL)))
-                                form_feed = *p;
+                                form_feed = be32_to_cpu(*p);
                         if ((p = of_get_property(root,
                                         "ibm,display-number-of-lines", NULL)))
-                                display_lines = *p;
+                                display_lines = be32_to_cpu(*p);
                         row_width = of_get_property(root,
                                         "ibm,display-truncation-length", NULL);
                         of_node_put(root);
@@ -322,11 +322,11 @@ EXPORT_SYMBOL(rtas_progress);		/* needed by rtas_flash module */
 
 int rtas_token(const char *service)
 {
-        const int *tokp;
+        const __be32 *tokp;
         if (rtas.dev == NULL)
                 return RTAS_UNKNOWN_SERVICE;
         tokp = of_get_property(rtas.dev, service, NULL);
-        return tokp ? *tokp : RTAS_UNKNOWN_SERVICE;
+        return tokp ? be32_to_cpu(*tokp) : RTAS_UNKNOWN_SERVICE;
 }
 EXPORT_SYMBOL(rtas_token);
 
@@ -380,11 +380,11 @@ static char *__fetch_rtas_last_error(char *altbuf)
 
         bufsz = rtas_get_error_log_max();
 
-        err_args.token = rtas_last_error_token;
-        err_args.nargs = 2;
-        err_args.nret = 1;
-        err_args.args[0] = (rtas_arg_t)__pa(rtas_err_buf);
-        err_args.args[1] = bufsz;
+        err_args.token = cpu_to_be32(rtas_last_error_token);
+        err_args.nargs = cpu_to_be32(2);
+        err_args.nret = cpu_to_be32(1);
+        err_args.args[0] = cpu_to_be32(__pa(rtas_err_buf));
+        err_args.args[1] = cpu_to_be32(bufsz);
         err_args.args[2] = 0;
 
         save_args = rtas.args;
@@ -433,13 +433,13 @@ int rtas_call(int token, int nargs, int nret, int *outputs, ...)
         s = lock_rtas();
         rtas_args = &rtas.args;
 
-        rtas_args->token = token;
-        rtas_args->nargs = nargs;
-        rtas_args->nret  = nret;
-        rtas_args->rets  = (rtas_arg_t *)&(rtas_args->args[nargs]);
+        rtas_args->token = cpu_to_be32(token);
+        rtas_args->nargs = cpu_to_be32(nargs);
+        rtas_args->nret  = cpu_to_be32(nret);
+        rtas_args->rets  = &(rtas_args->args[nargs]);
         va_start(list, outputs);
         for (i = 0; i < nargs; ++i)
-                rtas_args->args[i] = va_arg(list, rtas_arg_t);
+                rtas_args->args[i] = cpu_to_be32(va_arg(list, __u32));
         va_end(list);
 
         for (i = 0; i < nret; ++i)
@@ -449,13 +449,13 @@ int rtas_call(int token, int nargs, int nret, int *outputs, ...)
 
         /* A -1 return code indicates that the last command couldn't
            be completed due to a hardware error. */
-        if (rtas_args->rets[0] == -1)
+        if (be32_to_cpu(rtas_args->rets[0]) == -1)
                 buff_copy = __fetch_rtas_last_error(NULL);
 
         if (nret > 1 && outputs != NULL)
                 for (i = 0; i < nret-1; ++i)
-                        outputs[i] = rtas_args->rets[i+1];
-        ret = (nret > 0)? rtas_args->rets[0]: 0;
+                        outputs[i] = be32_to_cpu(rtas_args->rets[i+1]);
+        ret = (nret > 0)? be32_to_cpu(rtas_args->rets[0]): 0;
 
         unlock_rtas(s);
 
@@ -588,8 +588,8 @@ bool rtas_indicator_present(int token, int *maxindex)
 {
         int proplen, count, i;
         const struct indicator_elem {
-                u32 token;
-                u32 maxindex;
+                __be32 token;
+                __be32 maxindex;
         } *indicators;
 
         indicators = of_get_property(rtas.dev, "rtas-indicators", &proplen);
@@ -599,10 +599,10 @@ bool rtas_indicator_present(int token, int *maxindex)
         count = proplen / sizeof(struct indicator_elem);
 
         for (i = 0; i < count; i++) {
-                if (indicators[i].token != token)
+                if (__be32_to_cpu(indicators[i].token) != token)
                         continue;
                 if (maxindex)
-                        *maxindex = indicators[i].maxindex;
+                        *maxindex = __be32_to_cpu(indicators[i].maxindex);
                 return true;
         }
 
@@ -1097,19 +1097,19 @@ void __init rtas_initialize(void)
          */
         rtas.dev = of_find_node_by_name(NULL, "rtas");
         if (rtas.dev) {
-                const u32 *basep, *entryp, *sizep;
+                const __be32 *basep, *entryp, *sizep;
 
                 basep = of_get_property(rtas.dev, "linux,rtas-base", NULL);
                 sizep = of_get_property(rtas.dev, "rtas-size", NULL);
                 if (basep != NULL && sizep != NULL) {
-                        rtas.base = *basep;
-                        rtas.size = *sizep;
+                        rtas.base = __be32_to_cpu(*basep);
+                        rtas.size = __be32_to_cpu(*sizep);
                         entryp = of_get_property(rtas.dev,
                                         "linux,rtas-entry", NULL);
                         if (entryp == NULL) /* Ugh */
                                 rtas.entry = rtas.base;
                         else
-                                rtas.entry = *entryp;
+                                rtas.entry = __be32_to_cpu(*entryp);
                 } else
                         rtas.dev = NULL;
         }
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index 63d051f5b7a5..3d261c071fc8 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -436,7 +436,8 @@ void __init smp_setup_cpu_maps(void)
         DBG("smp_setup_cpu_maps()\n");
 
         while ((dn = of_find_node_by_type(dn, "cpu")) && cpu < nr_cpu_ids) {
-                const int *intserv;
+                const __be32 *intserv;
+                __be32 cpu_be;
                 int j, len;
 
                 DBG("  * %s...\n", dn->full_name);
@@ -450,15 +451,17 @@ void __init smp_setup_cpu_maps(void)
                 } else {
                         DBG("    no ibm,ppc-interrupt-server#s -> 1 thread\n");
                         intserv = of_get_property(dn, "reg", NULL);
-                        if (!intserv)
-                                intserv = &cpu; /* assume logical == phys */
+                        if (!intserv) {
+                                cpu_be = cpu_to_be32(cpu);
+                                intserv = &cpu_be;      /* assume logical == phys */
+                        }
                 }
 
                 for (j = 0; j < nthreads && cpu < nr_cpu_ids; j++) {
                         DBG("    thread %d -> cpu %d (hard id %d)\n",
-                            j, cpu, intserv[j]);
+                            j, cpu, be32_to_cpu(intserv[j]));
                         set_cpu_present(cpu, true);
-                        set_hard_smp_processor_id(cpu, intserv[j]);
+                        set_hard_smp_processor_id(cpu, be32_to_cpu(intserv[j]));
                         set_cpu_possible(cpu, true);
                         cpu++;
                 }
diff --git a/arch/powerpc/kernel/setup_32.c b/arch/powerpc/kernel/setup_32.c
index a8f54ecb091f..a4bbcae72578 100644
--- a/arch/powerpc/kernel/setup_32.c
+++ b/arch/powerpc/kernel/setup_32.c
@@ -38,6 +38,7 @@
 #include <asm/serial.h>
 #include <asm/udbg.h>
 #include <asm/mmu_context.h>
+#include <asm/epapr_hcalls.h>
 
 #include "setup.h"
 
@@ -128,6 +129,8 @@ notrace void __init machine_init(u64 dt_ptr)
         /* Do some early initialization based on the flat device tree */
         early_init_devtree(__va(dt_ptr));
 
+        epapr_paravirt_early_init();
+
         early_init_mmu();
 
         probe_machine();
@@ -326,5 +329,4 @@ void __init setup_arch(char **cmdline_p)
 
         /* Initialize the MMU context management stuff */
         mmu_context_init();
-
 }
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 389fb8077cc9..278ca93e1f28 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -10,7 +10,7 @@
  *      2 of the License, or (at your option) any later version.
  */
 
-#undef DEBUG
+#define DEBUG
 
 #include <linux/export.h>
 #include <linux/string.h>
@@ -66,6 +66,7 @@
 #include <asm/code-patching.h>
 #include <asm/kvm_ppc.h>
 #include <asm/hugetlb.h>
+#include <asm/epapr_hcalls.h>
 
 #include "setup.h"
 
@@ -215,6 +216,8 @@ void __init early_setup(unsigned long dt_ptr)
          */
         early_init_devtree(__va(dt_ptr));
 
+        epapr_paravirt_early_init();
+
         /* Now we know the logical id of our boot cpu, setup the paca. */
         setup_paca(&paca[boot_cpuid]);
         fixup_boot_paca();
@@ -229,6 +232,8 @@ void __init early_setup(unsigned long dt_ptr)
         /* Initialize the hash table or TLB handling */
         early_init_mmu();
 
+        kvm_cma_reserve();
+
         /*
          * Reserve any gigantic pages requested on the command line.
          * memblock needs to have been initialized by the time this is
@@ -237,6 +242,18 @@ void __init early_setup(unsigned long dt_ptr)
         reserve_hugetlb_gpages();
 
         DBG(" <- early_setup()\n");
+
+#ifdef CONFIG_PPC_EARLY_DEBUG_BOOTX
+        /*
+         * This needs to be done *last* (after the above DBG() even)
+         *
+         * Right after we return from this function, we turn on the MMU
+         * which means the real-mode access trick that btext does will
+         * no longer work, it needs to switch to using a real MMU
+         * mapping. This call will ensure that it does
+         */
+        btext_map();
+#endif /* CONFIG_PPC_EARLY_DEBUG_BOOTX */
 }
 
 #ifdef CONFIG_SMP
@@ -305,14 +322,14 @@ static void __init initialize_cache_info(void)
                  * d-cache and i-cache sizes... -Peter
                  */
                 if (num_cpus == 1) {
-                        const u32 *sizep, *lsizep;
+                        const __be32 *sizep, *lsizep;
                         u32 size, lsize;
 
                         size = 0;
                         lsize = cur_cpu_spec->dcache_bsize;
                         sizep = of_get_property(np, "d-cache-size", NULL);
                         if (sizep != NULL)
-                                size = *sizep;
+                                size = be32_to_cpu(*sizep);
                         lsizep = of_get_property(np, "d-cache-block-size",
                                                  NULL);
                         /* fallback if block size missing */
@@ -321,8 +338,8 @@ static void __init initialize_cache_info(void)
                                                          "d-cache-line-size",
                                                          NULL);
                         if (lsizep != NULL)
-                                lsize = *lsizep;
-                        if (sizep == 0 || lsizep == 0)
+                                lsize = be32_to_cpu(*lsizep);
+                        if (sizep == NULL || lsizep == NULL)
                                 DBG("Argh, can't find dcache properties ! "
                                     "sizep: %p, lsizep: %p\n", sizep, lsizep);
 
@@ -335,7 +352,7 @@ static void __init initialize_cache_info(void)
                         lsize = cur_cpu_spec->icache_bsize;
                         sizep = of_get_property(np, "i-cache-size", NULL);
                         if (sizep != NULL)
-                                size = *sizep;
+                                size = be32_to_cpu(*sizep);
                         lsizep = of_get_property(np, "i-cache-block-size",
                                                  NULL);
                         if (lsizep == NULL)
@@ -343,8 +360,8 @@ static void __init initialize_cache_info(void)
                                                          "i-cache-line-size",
                                                          NULL);
                         if (lsizep != NULL)
-                                lsize = *lsizep;
-                        if (sizep == 0 || lsizep == 0)
+                                lsize = be32_to_cpu(*lsizep);
+                        if (sizep == NULL || lsizep == NULL)
                                 DBG("Argh, can't find icache properties ! "
                                     "sizep: %p, lsizep: %p\n", sizep, lsizep);
 
@@ -609,8 +626,6 @@ void __init setup_arch(char **cmdline_p)
         /* Initialize the MMU context management stuff */
         mmu_context_init();
 
-        kvm_linear_init();
-
         /* Interrupt code needs to be 64K-aligned */
         if ((unsigned long)_stext & 0xffff)
                 panic("Kernelbase not 64K-aligned (0x%lx)!\n",
@@ -701,8 +716,7 @@ void __init setup_per_cpu_areas(void)
 #endif
 
 
-#ifdef CONFIG_PPC_INDIRECT_IO
+#if defined(CONFIG_PPC_INDIRECT_PIO) || defined(CONFIG_PPC_INDIRECT_MMIO)
 struct ppc_pci_io ppc_pci_io;
 EXPORT_SYMBOL(ppc_pci_io);
-#endif /* CONFIG_PPC_INDIRECT_IO */
-
+#endif
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 0f83122e6676..bebdf1a1a540 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -436,7 +436,10 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
          * use altivec. Since VSCR only contains 32 bits saved in the least
          * significant bits of a vector, we "cheat" and stuff VRSAVE in the
          * most significant bits of that same vector. --BenH
+         * Note that the current VRSAVE value is in the SPR at this point.
          */
+        if (cpu_has_feature(CPU_FTR_ALTIVEC))
+                current->thread.vrsave = mfspr(SPRN_VRSAVE);
         if (__put_user(current->thread.vrsave, (u32 __user *)&frame->mc_vregs[32]))
                 return 1;
 #endif /* CONFIG_ALTIVEC */
@@ -557,6 +560,8 @@ static int save_tm_user_regs(struct pt_regs *regs,
          * significant bits of a vector, we "cheat" and stuff VRSAVE in the
          * most significant bits of that same vector. --BenH
          */
+        if (cpu_has_feature(CPU_FTR_ALTIVEC))
+                current->thread.vrsave = mfspr(SPRN_VRSAVE);
         if (__put_user(current->thread.vrsave,
                        (u32 __user *)&frame->mc_vregs[32]))
                 return 1;
@@ -696,6 +701,8 @@ static long restore_user_regs(struct pt_regs *regs,
         /* Always get VRSAVE back */
         if (__get_user(current->thread.vrsave, (u32 __user *)&sr->mc_vregs[32]))
                 return 1;
+        if (cpu_has_feature(CPU_FTR_ALTIVEC))
+                mtspr(SPRN_VRSAVE, current->thread.vrsave);
 #endif /* CONFIG_ALTIVEC */
         if (copy_fpr_from_user(current, &sr->mc_fregs))
                 return 1;
@@ -809,6 +816,8 @@ static long restore_tm_user_regs(struct pt_regs *regs,
             __get_user(current->thread.transact_vrsave,
                        (u32 __user *)&tm_sr->mc_vregs[32]))
                 return 1;
+        if (cpu_has_feature(CPU_FTR_ALTIVEC))
+                mtspr(SPRN_VRSAVE, current->thread.vrsave);
 #endif /* CONFIG_ALTIVEC */
 
         regs->msr &= ~(MSR_FP | MSR_FE0 | MSR_FE1);
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 887e99d85bc2..f93ec2835a13 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -96,8 +96,6 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
         unsigned long msr = regs->msr;
         long err = 0;
 
-        flush_fp_to_thread(current);
-
 #ifdef CONFIG_ALTIVEC
         err |= __put_user(v_regs, &sc->v_regs);
 
@@ -114,6 +112,8 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
         /* We always copy to/from vrsave, it's 0 if we don't have or don't
          * use altivec.
          */
+        if (cpu_has_feature(CPU_FTR_ALTIVEC))
+                current->thread.vrsave = mfspr(SPRN_VRSAVE);
         err |= __put_user(current->thread.vrsave, (u32 __user *)&v_regs[33]);
 #else /* CONFIG_ALTIVEC */
         err |= __put_user(0, &sc->v_regs);
@@ -217,6 +217,8 @@ static long setup_tm_sigcontexts(struct sigcontext __user *sc,
         /* We always copy to/from vrsave, it's 0 if we don't have or don't
          * use altivec.
          */
+        if (cpu_has_feature(CPU_FTR_ALTIVEC))
+                current->thread.vrsave = mfspr(SPRN_VRSAVE);
         err |= __put_user(current->thread.vrsave, (u32 __user *)&v_regs[33]);
         if (msr & MSR_VEC)
                 err |= __put_user(current->thread.transact_vrsave,
@@ -346,16 +348,18 @@ static long restore_sigcontext(struct pt_regs *regs, sigset_t *set, int sig,
         if (v_regs && !access_ok(VERIFY_READ, v_regs, 34 * sizeof(vector128)))
                 return -EFAULT;
         /* Copy 33 vec registers (vr0..31 and vscr) from the stack */
-        if (v_regs != 0 && (msr & MSR_VEC) != 0)
+        if (v_regs != NULL && (msr & MSR_VEC) != 0)
                 err |= __copy_from_user(current->thread.vr, v_regs,
                                         33 * sizeof(vector128));
         else if (current->thread.used_vr)
                 memset(current->thread.vr, 0, 33 * sizeof(vector128));
         /* Always get VRSAVE back */
-        if (v_regs != 0)
+        if (v_regs != NULL)
                 err |= __get_user(current->thread.vrsave, (u32 __user *)&v_regs[33]);
         else
                 current->thread.vrsave = 0;
+        if (cpu_has_feature(CPU_FTR_ALTIVEC))
+                mtspr(SPRN_VRSAVE, current->thread.vrsave);
 #endif /* CONFIG_ALTIVEC */
         /* restore floating point */
         err |= copy_fpr_from_user(current, &sc->fp_regs);
@@ -463,7 +467,7 @@ static long restore_tm_sigcontexts(struct pt_regs *regs,
                                     tm_v_regs, 34 * sizeof(vector128)))
                 return -EFAULT;
         /* Copy 33 vec registers (vr0..31 and vscr) from the stack */
-        if (v_regs != 0 && tm_v_regs != 0 && (msr & MSR_VEC) != 0) {
+        if (v_regs != NULL && tm_v_regs != NULL && (msr & MSR_VEC) != 0) {
                 err |= __copy_from_user(current->thread.vr, v_regs,
                                         33 * sizeof(vector128));
                 err |= __copy_from_user(current->thread.transact_vr, tm_v_regs,
@@ -474,7 +478,7 @@ static long restore_tm_sigcontexts(struct pt_regs *regs,
                 memset(current->thread.transact_vr, 0, 33 * sizeof(vector128));
         }
         /* Always get VRSAVE back */
-        if (v_regs != 0 && tm_v_regs != 0) {
+        if (v_regs != NULL && tm_v_regs != NULL) {
                 err |= __get_user(current->thread.vrsave,
                                   (u32 __user *)&v_regs[33]);
                 err |= __get_user(current->thread.transact_vrsave,
@@ -484,6 +488,8 @@ static long restore_tm_sigcontexts(struct pt_regs *regs,
                 current->thread.vrsave = 0;
                 current->thread.transact_vrsave = 0;
         }
+        if (cpu_has_feature(CPU_FTR_ALTIVEC))
+                mtspr(SPRN_VRSAVE, current->thread.vrsave);
 #endif /* CONFIG_ALTIVEC */
         /* restore floating point */
         err |= copy_fpr_from_user(current, &sc->fp_regs);
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 38b0ba65a735..442d8e23f8f4 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -81,6 +81,28 @@ int smt_enabled_at_boot = 1;
 
 static void (*crash_ipi_function_ptr)(struct pt_regs *) = NULL;
 
+/*
+ * Returns 1 if the specified cpu should be brought up during boot.
+ * Used to inhibit booting threads if they've been disabled or
+ * limited on the command line
+ */
+int smp_generic_cpu_bootable(unsigned int nr)
+{
+        /* Special case - we inhibit secondary thread startup
+         * during boot if the user requests it.
+         */
+        if (system_state == SYSTEM_BOOTING && cpu_has_feature(CPU_FTR_SMT)) {
+                if (!smt_enabled_at_boot && cpu_thread_in_core(nr) != 0)
+                        return 0;
+                if (smt_enabled_at_boot
+                    && cpu_thread_in_core(nr) >= smt_enabled_at_boot)
+                        return 0;
+        }
+
+        return 1;
+}
+
+
 #ifdef CONFIG_PPC64
 int smp_generic_kick_cpu(int nr)
 {
@@ -172,7 +194,7 @@ int smp_request_message_ipi(int virq, int msg)
 #endif
         err = request_irq(virq, smp_ipi_action[msg],
                           IRQF_PERCPU | IRQF_NO_THREAD | IRQF_NO_SUSPEND,
-                          smp_ipi_name[msg], 0);
+                          smp_ipi_name[msg], NULL);
         WARN(err < 0, "unable to request_irq %d for %s (rc %d)\n",
                 virq, smp_ipi_name[msg], err);
 
@@ -210,6 +232,12 @@ void smp_muxed_ipi_message_pass(int cpu, int msg)
         smp_ops->cause_ipi(cpu, info->data);
 }
 
+#ifdef __BIG_ENDIAN__
+#define IPI_MESSAGE(A) (1 << (24 - 8 * (A)))
+#else
+#define IPI_MESSAGE(A) (1 << (8 * (A)))
+#endif
+
 irqreturn_t smp_ipi_demux(void)
 {
         struct cpu_messages *info = &__get_cpu_var(ipi_message);
@@ -219,19 +247,14 @@ irqreturn_t smp_ipi_demux(void)
 
         do {
                 all = xchg(&info->messages, 0);
-
-#ifdef __BIG_ENDIAN
-                if (all & (1 << (24 - 8 * PPC_MSG_CALL_FUNCTION)))
+                if (all & IPI_MESSAGE(PPC_MSG_CALL_FUNCTION))
                         generic_smp_call_function_interrupt();
-                if (all & (1 << (24 - 8 * PPC_MSG_RESCHEDULE)))
+                if (all & IPI_MESSAGE(PPC_MSG_RESCHEDULE))
                         scheduler_ipi();
-                if (all & (1 << (24 - 8 * PPC_MSG_CALL_FUNC_SINGLE)))
+                if (all & IPI_MESSAGE(PPC_MSG_CALL_FUNC_SINGLE))
                         generic_smp_call_function_single_interrupt();
-                if (all & (1 << (24 - 8 * PPC_MSG_DEBUGGER_BREAK)))
+                if (all & IPI_MESSAGE(PPC_MSG_DEBUGGER_BREAK))
                         debug_ipi_action(0, NULL);
-#else
-#error Unsupported ENDIAN
-#endif
         } while (info->messages);
 
         return IRQ_HANDLED;
@@ -574,6 +597,21 @@ out:
         return id;
 }
 
+/* Return the value of the chip-id property corresponding
+ * to the given logical cpu.
+ */
+int cpu_to_chip_id(int cpu)
+{
+        struct device_node *np;
+
+        np = of_get_cpu_node(cpu, NULL);
+        if (!np)
+                return -1;
+
+        of_node_put(np);
+        return of_get_ibm_chip_id(np);
+}
+
 /* Helper routines for cpu to core mapping */
 int cpu_core_index_of_thread(int cpu)
 {
@@ -587,6 +625,33 @@ int cpu_first_thread_of_core(int core)
 }
 EXPORT_SYMBOL_GPL(cpu_first_thread_of_core);
 
+static void traverse_siblings_chip_id(int cpu, bool add, int chipid)
+{
+        const struct cpumask *mask;
+        struct device_node *np;
+        int i, plen;
+        const __be32 *prop;
+
+        mask = add ? cpu_online_mask : cpu_present_mask;
+        for_each_cpu(i, mask) {
+                np = of_get_cpu_node(i, NULL);
+                if (!np)
+                        continue;
+                prop = of_get_property(np, "ibm,chip-id", &plen);
+                if (prop && plen == sizeof(int) &&
+                    of_read_number(prop, 1) == chipid) {
+                        if (add) {
+                                cpumask_set_cpu(cpu, cpu_core_mask(i));
+                                cpumask_set_cpu(i, cpu_core_mask(cpu));
+                        } else {
+                                cpumask_clear_cpu(cpu, cpu_core_mask(i));
+                                cpumask_clear_cpu(i, cpu_core_mask(cpu));
+                        }
+                }
+                of_node_put(np);
+        }
+}
+
 /* Must be called when no change can occur to cpu_present_mask,
  * i.e. during cpu online or offline.
  */
@@ -609,11 +674,51 @@ static struct device_node *cpu_to_l2cache(int cpu)
         return cache;
 }
 
+static void traverse_core_siblings(int cpu, bool add)
+{
+        struct device_node *l2_cache, *np;
+        const struct cpumask *mask;
+        int i, chip, plen;
+        const __be32 *prop;
+
+        /* First see if we have ibm,chip-id properties in cpu nodes */
+        np = of_get_cpu_node(cpu, NULL);
+        if (np) {
+                chip = -1;
+                prop = of_get_property(np, "ibm,chip-id", &plen);
+                if (prop && plen == sizeof(int))
+                        chip = of_read_number(prop, 1);
+                of_node_put(np);
+                if (chip >= 0) {
+                        traverse_siblings_chip_id(cpu, add, chip);
+                        return;
+                }
+        }
+
+        l2_cache = cpu_to_l2cache(cpu);
+        mask = add ? cpu_online_mask : cpu_present_mask;
+        for_each_cpu(i, mask) {
+                np = cpu_to_l2cache(i);
+                if (!np)
+                        continue;
+                if (np == l2_cache) {
+                        if (add) {
+                                cpumask_set_cpu(cpu, cpu_core_mask(i));
+                                cpumask_set_cpu(i, cpu_core_mask(cpu));
+                        } else {
+                                cpumask_clear_cpu(cpu, cpu_core_mask(i));
+                                cpumask_clear_cpu(i, cpu_core_mask(cpu));
+                        }
+                }
+                of_node_put(np);
+        }
+        of_node_put(l2_cache);
+}
+
 /* Activate a secondary processor. */
 void start_secondary(void *unused)
 {
         unsigned int cpu = smp_processor_id();
-        struct device_node *l2_cache;
         int i, base;
 
         atomic_inc(&init_mm.mm_count);
@@ -652,18 +757,7 @@ void start_secondary(void *unused)
                 cpumask_set_cpu(cpu, cpu_core_mask(base + i));
                 cpumask_set_cpu(base + i, cpu_core_mask(cpu));
         }
-        l2_cache = cpu_to_l2cache(cpu);
-        for_each_online_cpu(i) {
-                struct device_node *np = cpu_to_l2cache(i);
-                if (!np)
-                        continue;
-                if (np == l2_cache) {
-                        cpumask_set_cpu(cpu, cpu_core_mask(i));
-                        cpumask_set_cpu(i, cpu_core_mask(cpu));
-                }
-                of_node_put(np);
-        }
-        of_node_put(l2_cache);
+        traverse_core_siblings(cpu, true);
 
         smp_wmb();
         notify_cpu_starting(cpu);
@@ -719,7 +813,6 @@ int arch_sd_sibling_asym_packing(void)
 #ifdef CONFIG_HOTPLUG_CPU
 int __cpu_disable(void)
 {
-        struct device_node *l2_cache;
         int cpu = smp_processor_id();
         int base, i;
         int err;
@@ -739,20 +832,7 @@ int __cpu_disable(void)
                 cpumask_clear_cpu(cpu, cpu_core_mask(base + i));
                 cpumask_clear_cpu(base + i, cpu_core_mask(cpu));
         }
-
-        l2_cache = cpu_to_l2cache(cpu);
-        for_each_present_cpu(i) {
-                struct device_node *np = cpu_to_l2cache(i);
-                if (!np)
-                        continue;
-                if (np == l2_cache) {
-                        cpumask_clear_cpu(cpu, cpu_core_mask(i));
-                        cpumask_clear_cpu(i, cpu_core_mask(cpu));
-                }
-                of_node_put(np);
-        }
-        of_node_put(l2_cache);
-
+        traverse_core_siblings(cpu, false);
 
         return 0;
 }
diff --git a/arch/powerpc/kernel/softemu8xx.c b/arch/powerpc/kernel/softemu8xx.c
deleted file mode 100644
index 29b2f81dd709..000000000000
--- a/arch/powerpc/kernel/softemu8xx.c
+++ /dev/null
@@ -1,199 +0,0 @@
-/*
- * Software emulation of some PPC instructions for the 8xx core.
- *
- * Copyright (C) 1998 Dan Malek (dmalek@jlc.net)
- *
- * Software floating emuation for the MPC8xx processor.  I did this mostly
- * because it was easier than trying to get the libraries compiled for
- * software floating point.  The goal is still to get the libraries done,
- * but I lost patience and needed some hacks to at least get init and
- * shells running.  The first problem is the setjmp/longjmp that save
- * and restore the floating point registers.
- *
- * For this emulation, our working registers are found on the register
- * save area.
- */
-
-#include <linux/errno.h>
-#include <linux/sched.h>
-#include <linux/kernel.h>
-#include <linux/mm.h>
-#include <linux/stddef.h>
-#include <linux/unistd.h>
-#include <linux/ptrace.h>
-#include <linux/user.h>
-#include <linux/interrupt.h>
-
-#include <asm/pgtable.h>
-#include <asm/uaccess.h>
-#include <asm/io.h>
-
-/* Eventually we may need a look-up table, but this works for now.
-*/
-#define LFS     48
-#define LFD     50
-#define LFDU    51
-#define STFD    54
-#define STFDU   55
-#define FMR     63
-
-void print_8xx_pte(struct mm_struct *mm, unsigned long addr)
-{
-        pgd_t *pgd;
-        pmd_t *pmd;
-        pte_t *pte;
-
-        printk(" pte @ 0x%8lx: ", addr);
-        pgd = pgd_offset(mm, addr & PAGE_MASK);
-        if (pgd) {
-                pmd = pmd_offset(pud_offset(pgd, addr & PAGE_MASK),
-                                 addr & PAGE_MASK);
-                if (pmd && pmd_present(*pmd)) {
-                        pte = pte_offset_kernel(pmd, addr & PAGE_MASK);
-                        if (pte) {
-                                printk(" (0x%08lx)->(0x%08lx)->0x%08lx\n",
-                                        (long)pgd, (long)pte, (long)pte_val(*pte));
-#define pp ((long)pte_val(*pte))
-                                printk(" RPN: %05lx PP: %lx SPS: %lx SH: %lx "
-                                       "CI: %lx v: %lx\n",
-                                       pp>>12,    /* rpn */
-                                       (pp>>10)&3, /* pp */
-                                       (pp>>3)&1, /* small */
-                                       (pp>>2)&1, /* shared */
-                                       (pp>>1)&1, /* cache inhibit */
-                                       pp&1       /* valid */
-                                       );
-#undef pp
-                        }
-                        else {
-                                printk("no pte\n");
-                        }
-                }
-                else {
-                        printk("no pmd\n");
-                }
-        }
-        else {
-                printk("no pgd\n");
-        }
-}
-
-int get_8xx_pte(struct mm_struct *mm, unsigned long addr)
-{
-        pgd_t *pgd;
-        pmd_t *pmd;
-        pte_t *pte;
-        int retval = 0;
-
-        pgd = pgd_offset(mm, addr & PAGE_MASK);
-        if (pgd) {
-                pmd = pmd_offset(pud_offset(pgd, addr & PAGE_MASK),
-                                 addr & PAGE_MASK);
-                if (pmd && pmd_present(*pmd)) {
-                        pte = pte_offset_kernel(pmd, addr & PAGE_MASK);
-                        if (pte) {
-                                retval = (int)pte_val(*pte);
-                        }
-                }
-        }
-        return retval;
-}
-
-/*
- * We return 0 on success, 1 on unimplemented instruction, and EFAULT
- * if a load/store faulted.
- */
-int Soft_emulate_8xx(struct pt_regs *regs)
-{
-        u32 inst, instword;
-        u32 flreg, idxreg, disp;
-        int retval;
-        s16 sdisp;
-        u32 *ea, *ip;
-
-        retval = 0;
-
-        instword = *((u32 *)regs->nip);
-        inst = instword >> 26;
-
-        flreg = (instword >> 21) & 0x1f;
-        idxreg = (instword >> 16) & 0x1f;
-        disp = instword & 0xffff;
-
-        ea = (u32 *)(regs->gpr[idxreg] + disp);
-        ip = (u32 *)&current->thread.TS_FPR(flreg);
-
-        switch ( inst )
-        {
-        case LFD:
-                /* this is a 16 bit quantity that is sign extended
-                 * so use a signed short here -- Cort
-                 */
-                sdisp = (instword & 0xffff);
-                ea = (u32 *)(regs->gpr[idxreg] + sdisp);
-                if (copy_from_user(ip, ea, sizeof(double)))
-                        retval = -EFAULT;
-                break;
-
-        case LFDU:
-                if (copy_from_user(ip, ea, sizeof(double)))
-                        retval = -EFAULT;
-                else
-                        regs->gpr[idxreg] = (u32)ea;
-                break;
-        case LFS:
-                sdisp = (instword & 0xffff);
-                ea = (u32 *)(regs->gpr[idxreg] + sdisp);
-                if (copy_from_user(ip, ea, sizeof(float)))
-                        retval = -EFAULT;
-                break;
-        case STFD:
-                /* this is a 16 bit quantity that is sign extended
-                 * so use a signed short here -- Cort
-                 */
-                sdisp = (instword & 0xffff);
-                ea = (u32 *)(regs->gpr[idxreg] + sdisp);
-                if (copy_to_user(ea, ip, sizeof(double)))
-                        retval = -EFAULT;
-                break;
-
-        case STFDU:
-                if (copy_to_user(ea, ip, sizeof(double)))
-                        retval = -EFAULT;
-                else
-                        regs->gpr[idxreg] = (u32)ea;
-                break;
-        case FMR:
-                /* assume this is a fp move -- Cort */
-                memcpy(ip, &current->thread.TS_FPR((instword>>11)&0x1f),
-                       sizeof(double));
-                break;
-        default:
-                retval = 1;
-                printk("Bad emulation %s/%d\n"
-                       " NIP: %08lx instruction: %08x opcode: %x "
-                       "A: %x B: %x C: %x code: %x rc: %x\n",
-                       current->comm,current->pid,
-                       regs->nip,
-                       instword,inst,
-                       (instword>>16)&0x1f,
-                       (instword>>11)&0x1f,
-                       (instword>>6)&0x1f,
-                       (instword>>1)&0x3ff,
-                       instword&1);
-                {
-                        int pa;
-                        print_8xx_pte(current->mm,regs->nip);
-                        pa = get_8xx_pte(current->mm,regs->nip) & PAGE_MASK;
-                        pa |= (regs->nip & ~PAGE_MASK);
-                        pa = (unsigned long)__va(pa);
-                        printk("Kernel VA for NIP %x ", pa);
-                        print_8xx_pte(current->mm,pa);
-                }
-        }
-
-        if (retval == 0)
-                regs->nip += 4;
-
-        return retval;
-}
diff --git a/arch/powerpc/kernel/swsusp_asm64.S b/arch/powerpc/kernel/swsusp_asm64.S
index 86ac1d90d02b..22045984835f 100644
--- a/arch/powerpc/kernel/swsusp_asm64.S
+++ b/arch/powerpc/kernel/swsusp_asm64.S
@@ -46,10 +46,19 @@
 #define SL_r29          0xe8
 #define SL_r30          0xf0
 #define SL_r31          0xf8
-#define SL_SIZE         SL_r31+8
+#define SL_SPRG1        0x100
+#define SL_TCR          0x108
+#define SL_SIZE         SL_TCR+8
 
 /* these macros rely on the save area being
  * pointed to by r11 */
+
+#define SAVE_SPR(register)              \
+        mfspr   r0, SPRN_##register     ;\
+        std     r0, SL_##register(r11)
+#define RESTORE_SPR(register)           \
+        ld      r0, SL_##register(r11)  ;\
+        mtspr   SPRN_##register, r0
 #define SAVE_SPECIAL(special)           \
         mf##special     r0              ;\
         std     r0, SL_##special(r11)
@@ -103,8 +112,15 @@ _GLOBAL(swsusp_arch_suspend)
         SAVE_REGISTER(r30)
         SAVE_REGISTER(r31)
         SAVE_SPECIAL(MSR)
-        SAVE_SPECIAL(SDR1)
         SAVE_SPECIAL(XER)
+#ifdef CONFIG_PPC_BOOK3S_64
+        SAVE_SPECIAL(SDR1)
+#else
+        SAVE_SPR(TCR)
+
+        /* Save SPRG1, SPRG1 be used save paca */
+        SAVE_SPR(SPRG1)
+#endif
 
         /* we push the stack up 128 bytes but don't store the
          * stack pointer on the stack like a real stackframe */
@@ -151,6 +167,7 @@ copy_page_loop:
         bne+    copyloop
 nothing_to_copy:
 
+#ifdef CONFIG_PPC_BOOK3S_64
         /* flush caches */
         lis     r3, 0x10
         mtctr   r3
@@ -167,6 +184,7 @@ nothing_to_copy:
         sync
 
         tlbia
+#endif
 
         ld      r11,swsusp_save_area_ptr@toc(r2)
 
@@ -208,16 +226,39 @@ nothing_to_copy:
         RESTORE_REGISTER(r29)
         RESTORE_REGISTER(r30)
         RESTORE_REGISTER(r31)
+
+#ifdef CONFIG_PPC_BOOK3S_64
         /* can't use RESTORE_SPECIAL(MSR) */
         ld      r0, SL_MSR(r11)
         mtmsrd  r0, 0
         RESTORE_SPECIAL(SDR1)
+#else
+        /* Restore SPRG1, be used to save paca */
+        ld      r0, SL_SPRG1(r11)
+        mtsprg  1, r0
+
+        RESTORE_SPECIAL(MSR)
+
+        /* Restore TCR and clear any pending bits in TSR. */
+        RESTORE_SPR(TCR)
+        lis     r0, (TSR_ENW | TSR_WIS | TSR_DIS | TSR_FIS)@h
+        mtspr   SPRN_TSR, r0
+
+        /* Kick decrementer */
+        li      r0, 1
+        mtdec   r0
+
+        /* Invalidate all tlbs */
+        bl      _tlbil_all
+#endif
         RESTORE_SPECIAL(XER)
 
         sync
 
         addi    r1,r1,-128
+#ifdef CONFIG_PPC_BOOK3S_64
         bl      slb_flush_and_rebolt
+#endif
         bl      do_after_copyback
         addi    r1,r1,128
 
diff --git a/arch/powerpc/kernel/swsusp_booke.S b/arch/powerpc/kernel/swsusp_booke.S
index 11a39307dd71..0f204053e5b5 100644
--- a/arch/powerpc/kernel/swsusp_booke.S
+++ b/arch/powerpc/kernel/swsusp_booke.S
@@ -141,6 +141,14 @@ _GLOBAL(swsusp_arch_resume)
         lis     r11,swsusp_save_area@h
         ori     r11,r11,swsusp_save_area@l
 
+        /*
+         * Mappings from virtual addresses to physical addresses may be
+         * different than they were prior to restoring hibernation state. 
+         * Invalidate the TLB so that the boot CPU is using the new
+         * mappings.
+         */
+        bl      _tlbil_all
+
         lwz     r4,SL_SPRG0(r11)
         mtsprg  0,r4
         lwz     r4,SL_SPRG1(r11)
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 65ab9e909377..192b051df97e 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -210,18 +210,18 @@ static u64 scan_dispatch_log(u64 stop_tb)
         if (!dtl)
                 return 0;
 
-        if (i == vpa->dtl_idx)
+        if (i == be64_to_cpu(vpa->dtl_idx))
                 return 0;
-        while (i < vpa->dtl_idx) {
+        while (i < be64_to_cpu(vpa->dtl_idx)) {
                 if (dtl_consumer)
                         dtl_consumer(dtl, i);
-                dtb = dtl->timebase;
-                tb_delta = dtl->enqueue_to_dispatch_time +
-                        dtl->ready_to_enqueue_time;
+                dtb = be64_to_cpu(dtl->timebase);
+                tb_delta = be32_to_cpu(dtl->enqueue_to_dispatch_time) +
+                        be32_to_cpu(dtl->ready_to_enqueue_time);
                 barrier();
-                if (i + N_DISPATCH_LOG < vpa->dtl_idx) {
+                if (i + N_DISPATCH_LOG < be64_to_cpu(vpa->dtl_idx)) {
                         /* buffer has overflowed */
-                        i = vpa->dtl_idx - N_DISPATCH_LOG;
+                        i = be64_to_cpu(vpa->dtl_idx) - N_DISPATCH_LOG;
                         dtl = local_paca->dispatch_log + (i % N_DISPATCH_LOG);
                         continue;
                 }
@@ -269,7 +269,7 @@ static inline u64 calculate_stolen_time(u64 stop_tb)
 {
         u64 stolen = 0;
 
-        if (get_paca()->dtl_ridx != get_paca()->lppaca_ptr->dtl_idx) {
+        if (get_paca()->dtl_ridx != be64_to_cpu(get_lppaca()->dtl_idx)) {
                 stolen = scan_dispatch_log(stop_tb);
                 get_paca()->system_time -= stolen;
         }
@@ -612,7 +612,7 @@ unsigned long long sched_clock(void)
 static int __init get_freq(char *name, int cells, unsigned long *val)
 {
         struct device_node *cpu;
-        const unsigned int *fp;
+        const __be32 *fp;
         int found = 0;
 
         /* The cpu node should have timebase and clock frequency properties */
@@ -1049,7 +1049,7 @@ static int __init rtc_init(void)
 
         pdev = platform_device_register_simple("rtc-generic", -1, NULL, 0);
 
-        return PTR_RET(pdev);
+        return PTR_ERR_OR_ZERO(pdev);
 }
 
 module_init(rtc_init);
diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S
index 51be8fb24803..7b60b9851469 100644
--- a/arch/powerpc/kernel/tm.S
+++ b/arch/powerpc/kernel/tm.S
@@ -155,10 +155,10 @@ _GLOBAL(tm_reclaim)
         mfvscr  vr0
         li      r6, THREAD_TRANSACT_VSCR
         stvx    vr0, r3, r6
+dont_backup_vec:
         mfspr   r0, SPRN_VRSAVE
         std     r0, THREAD_TRANSACT_VRSAVE(r3)
 
-dont_backup_vec:
         andi.   r0, r4, MSR_FP
         beq     dont_backup_fp
 
@@ -233,6 +233,16 @@ dont_backup_fp:
         std     r5, _CCR(r7)
         std     r6, _XER(r7)
 
+
+        /* ******************** TAR, PPR, DSCR ********** */
+        mfspr   r3, SPRN_TAR
+        mfspr   r4, SPRN_PPR
+        mfspr   r5, SPRN_DSCR
+
+        std     r3, THREAD_TM_TAR(r12)
+        std     r4, THREAD_TM_PPR(r12)
+        std     r5, THREAD_TM_DSCR(r12)
+
         /* MSR and flags:  We don't change CRs, and we don't need to alter
          * MSR.
          */
@@ -331,11 +341,11 @@ _GLOBAL(tm_recheckpoint)
         lvx     vr0, r3, r5
         mtvscr  vr0
         REST_32VRS(0, r5, r3)                   /* r5 scratch, r3 THREAD ptr */
+dont_restore_vec:
         ld      r5, THREAD_VRSAVE(r3)
         mtspr   SPRN_VRSAVE, r5
 #endif
 
-dont_restore_vec:
         andi.   r0, r4, MSR_FP
         beq     dont_restore_fp
 
@@ -347,6 +357,16 @@ dont_restore_fp:
         mtmsr   r6                              /* FP/Vec off again! */
 
 restore_gprs:
+
+        /* ******************** TAR, PPR, DSCR ********** */
+        ld      r4, THREAD_TM_TAR(r3)
+        ld      r5, THREAD_TM_PPR(r3)
+        ld      r6, THREAD_TM_DSCR(r3)
+
+        mtspr   SPRN_TAR,       r4
+        mtspr   SPRN_PPR,       r5
+        mtspr   SPRN_DSCR,      r6
+
         /* ******************** CR,LR,CCR,MSR ********** */
         ld      r3, _CTR(r7)
         ld      r4, _LINK(r7)
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index bf33c22e38a4..f783c932faeb 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -44,9 +44,7 @@
 #include <asm/machdep.h>
 #include <asm/rtas.h>
 #include <asm/pmc.h>
-#ifdef CONFIG_PPC32
 #include <asm/reg.h>
-#endif
 #ifdef CONFIG_PMAC_BACKLIGHT
 #include <asm/backlight.h>
 #endif
@@ -62,6 +60,7 @@
 #include <asm/switch_to.h>
 #include <asm/tm.h>
 #include <asm/debug.h>
+#include <sysdev/fsl_pci.h>
 
 #if defined(CONFIG_DEBUGGER) || defined(CONFIG_KEXEC)
 int (*__debugger)(struct pt_regs *regs) __read_mostly;
@@ -567,6 +566,8 @@ int machine_check_e500(struct pt_regs *regs)
         if (reason & MCSR_BUS_RBERR) {
                 if (fsl_rio_mcheck_exception(regs))
                         return 1;
+                if (fsl_pci_mcheck_exception(regs))
+                        return 1;
         }
 
         printk("Machine check in kernel mode.\n");
@@ -964,7 +965,7 @@ static int emulate_instruction(struct pt_regs *regs)
         u32 instword;
         u32 rd;
 
-        if (!user_mode(regs) || (regs->msr & MSR_LE))
+        if (!user_mode(regs))
                 return -EINVAL;
         CHECK_FULL_REGS(regs);
 
@@ -1052,11 +1053,41 @@ int is_valid_bugaddr(unsigned long addr)
         return is_kernel_addr(addr);
 }
 
+#ifdef CONFIG_MATH_EMULATION
+static int emulate_math(struct pt_regs *regs)
+{
+        int ret;
+        extern int do_mathemu(struct pt_regs *regs);
+
+        ret = do_mathemu(regs);
+        if (ret >= 0)
+                PPC_WARN_EMULATED(math, regs);
+
+        switch (ret) {
+        case 0:
+                emulate_single_step(regs);
+                return 0;
+        case 1: {
+                        int code = 0;
+                        code = __parse_fpscr(current->thread.fpscr.val);
+                        _exception(SIGFPE, regs, code, regs->nip);
+                        return 0;
+                }
+        case -EFAULT:
+                _exception(SIGSEGV, regs, SEGV_MAPERR, regs->nip);
+                return 0;
+        }
+
+        return -1;
+}
+#else
+static inline int emulate_math(struct pt_regs *regs) { return -1; }
+#endif
+
 void __kprobes program_check_exception(struct pt_regs *regs)
 {
         enum ctx_state prev_state = exception_enter();
         unsigned int reason = get_reason(regs);
-        extern int do_mathemu(struct pt_regs *regs);
 
         /* We can now get here via a FP Unavailable exception if the core
          * has no FPU, in that case the reason flags will be 0 */
@@ -1118,11 +1149,20 @@ void __kprobes program_check_exception(struct pt_regs *regs)
         }
 #endif
 
+        /*
+         * If we took the program check in the kernel skip down to sending a
+         * SIGILL. The subsequent cases all relate to emulating instructions
+         * which we should only do for userspace. We also do not want to enable
+         * interrupts for kernel faults because that might lead to further
+         * faults, and loose the context of the original exception.
+         */
+        if (!user_mode(regs))
+                goto sigill;
+
         /* We restore the interrupt state now */
         if (!arch_irq_disabled_regs(regs))
                 local_irq_enable();
 
-#ifdef CONFIG_MATH_EMULATION
         /* (reason & REASON_ILLEGAL) would be the obvious thing here,
          * but there seems to be a hardware bug on the 405GP (RevD)
          * that means ESR is sometimes set incorrectly - either to
@@ -1131,31 +1171,8 @@ void __kprobes program_check_exception(struct pt_regs *regs)
          * instruction or only on FP instructions, whether there is a
          * pattern to occurrences etc. -dgibson 31/Mar/2003
          */
-
-        /*
-         * If we support a HW FPU, we need to ensure the FP state
-         * if flushed into the thread_struct before attempting
-         * emulation
-         */
-#ifdef CONFIG_PPC_FPU
-        flush_fp_to_thread(current);
-#endif
-        switch (do_mathemu(regs)) {
-        case 0:
-                emulate_single_step(regs);
+        if (!emulate_math(regs))
                 goto bail;
-        case 1: {
-                        int code = 0;
-                        code = __parse_fpscr(current->thread.fpscr.val);
-                        _exception(SIGFPE, regs, code, regs->nip);
-                        goto bail;
-                }
-        case -EFAULT:
-                _exception(SIGSEGV, regs, SEGV_MAPERR, regs->nip);
-                goto bail;
-        }
-        /* fall through on any other errors */
-#endif /* CONFIG_MATH_EMULATION */
 
         /* Try to emulate it if we should. */
         if (reason & (REASON_ILLEGAL | REASON_PRIVILEGED)) {
@@ -1170,6 +1187,7 @@ void __kprobes program_check_exception(struct pt_regs *regs)
                 }
         }
 
+sigill:
         if (reason & REASON_PRIVILEGED)
                 _exception(SIGILL, regs, ILL_PRVOPC, regs->nip);
         else
@@ -1296,43 +1314,51 @@ void vsx_unavailable_exception(struct pt_regs *regs)
         die("Unrecoverable VSX Unavailable Exception", regs, SIGABRT);
 }
 
+#ifdef CONFIG_PPC64
 void facility_unavailable_exception(struct pt_regs *regs)
 {
         static char *facility_strings[] = {
-                "FPU",
-                "VMX/VSX",
-                "DSCR",
-                "PMU SPRs",
-                "BHRB",
-                "TM",
-                "AT",
-                "EBB",
-                "TAR",
+                [FSCR_FP_LG] = "FPU",
+                [FSCR_VECVSX_LG] = "VMX/VSX",
+                [FSCR_DSCR_LG] = "DSCR",
+                [FSCR_PM_LG] = "PMU SPRs",
+                [FSCR_BHRB_LG] = "BHRB",
+                [FSCR_TM_LG] = "TM",
+                [FSCR_EBB_LG] = "EBB",
+                [FSCR_TAR_LG] = "TAR",
         };
-        char *facility, *prefix;
+        char *facility = "unknown";
         u64 value;
+        u8 status;
+        bool hv;
 
-        if (regs->trap == 0xf60) {
-                value = mfspr(SPRN_FSCR);
-                prefix = "";
-        } else {
+        hv = (regs->trap == 0xf80);
+        if (hv)
                 value = mfspr(SPRN_HFSCR);
-                prefix = "Hypervisor ";
+        else
+                value = mfspr(SPRN_FSCR);
+
+        status = value >> 56;
+        if (status == FSCR_DSCR_LG) {
+                /* User is acessing the DSCR.  Set the inherit bit and allow
+                 * the user to set it directly in future by setting via the
+                 * FSCR DSCR bit.  We always leave HFSCR DSCR set.
+                 */
+                current->thread.dscr_inherit = 1;
+                mtspr(SPRN_FSCR, value | FSCR_DSCR);
+                return;
         }
 
-        value = value >> 56;
+        if ((status < ARRAY_SIZE(facility_strings)) &&
+            facility_strings[status])
+                facility = facility_strings[status];
 
         /* We restore the interrupt state now */
         if (!arch_irq_disabled_regs(regs))
                 local_irq_enable();
 
-        if (value < ARRAY_SIZE(facility_strings))
-                facility = facility_strings[value];
-        else
-                facility = "unknown";
-
         pr_err("%sFacility '%s' unavailable, exception at 0x%lx, MSR=%lx\n",
-                prefix, facility, regs->nip, regs->msr);
+               hv ? "Hypervisor " : "", facility, regs->nip, regs->msr);
 
         if (user_mode(regs)) {
                 _exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
@@ -1341,6 +1367,7 @@ void facility_unavailable_exception(struct pt_regs *regs)
 
         die("Unexpected facility unavailable exception", regs, SIGABRT);
 }
+#endif
 
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
 
@@ -1434,11 +1461,6 @@ void performance_monitor_exception(struct pt_regs *regs)
 #ifdef CONFIG_8xx
 void SoftwareEmulation(struct pt_regs *regs)
 {
-        extern int do_mathemu(struct pt_regs *);
-#if defined(CONFIG_MATH_EMULATION)
-        int errcode;
-#endif
-
         CHECK_FULL_REGS(regs);
 
         if (!user_mode(regs)) {
@@ -1446,31 +1468,10 @@ void SoftwareEmulation(struct pt_regs *regs)
                 die("Kernel Mode Software FPU Emulation", regs, SIGFPE);
         }
 
-#ifdef CONFIG_MATH_EMULATION
-        errcode = do_mathemu(regs);
-        if (errcode >= 0)
-                PPC_WARN_EMULATED(math, regs);
-
-        switch (errcode) {
-        case 0:
-                emulate_single_step(regs);
-                return;
-        case 1: {
-                        int code = 0;
-                        code = __parse_fpscr(current->thread.fpscr.val);
-                        _exception(SIGFPE, regs, code, regs->nip);
-                        return;
-                }
-        case -EFAULT:
-                _exception(SIGSEGV, regs, SEGV_MAPERR, regs->nip);
-                return;
-        default:
-                _exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
+        if (!emulate_math(regs))
                 return;
-        }
-#else
+
         _exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
-#endif
 }
 #endif /* CONFIG_8xx */
 
diff --git a/arch/powerpc/kernel/udbg_16550.c b/arch/powerpc/kernel/udbg_16550.c
index 6837f839ab78..75702e207b29 100644
--- a/arch/powerpc/kernel/udbg_16550.c
+++ b/arch/powerpc/kernel/udbg_16550.c
@@ -18,23 +18,19 @@ extern void real_writeb(u8 data, volatile u8 __iomem *addr);
 extern u8 real_205_readb(volatile u8 __iomem  *addr);
 extern void real_205_writeb(u8 data, volatile u8 __iomem *addr);
 
-struct NS16550 {
-        /* this struct must be packed */
-        unsigned char rbr;  /* 0 */
-        unsigned char ier;  /* 1 */
-        unsigned char fcr;  /* 2 */
-        unsigned char lcr;  /* 3 */
-        unsigned char mcr;  /* 4 */
-        unsigned char lsr;  /* 5 */
-        unsigned char msr;  /* 6 */
-        unsigned char scr;  /* 7 */
-};
-
-#define thr rbr
-#define iir fcr
-#define dll rbr
-#define dlm ier
-#define dlab lcr
+#define UART_RBR        0
+#define UART_IER        1
+#define UART_FCR        2
+#define UART_LCR        3
+#define UART_MCR        4
+#define UART_LSR        5
+#define UART_MSR        6
+#define UART_SCR        7
+#define UART_THR        UART_RBR
+#define UART_IIR        UART_FCR
+#define UART_DLL        UART_RBR
+#define UART_DLM        UART_IER
+#define UART_DLAB       UART_LCR
 
 #define LSR_DR   0x01  /* Data ready */
 #define LSR_OE   0x02  /* Overrun */
@@ -47,52 +43,62 @@ struct NS16550 {
 
 #define LCR_DLAB 0x80
 
-static struct NS16550 __iomem *udbg_comport;
+static u8 (*udbg_uart_in)(unsigned int reg);
+static void (*udbg_uart_out)(unsigned int reg, u8 data);
 
-static void udbg_550_flush(void)
+static void udbg_uart_flush(void)
 {
-        if (udbg_comport) {
-                while ((in_8(&udbg_comport->lsr) & LSR_THRE) == 0)
-                        /* wait for idle */;
-        }
+        if (!udbg_uart_in)
+                return;
+
+        /* wait for idle */
+        while ((udbg_uart_in(UART_LSR) & LSR_THRE) == 0)
+                cpu_relax();
 }
 
-static void udbg_550_putc(char c)
+static void udbg_uart_putc(char c)
 {
-        if (udbg_comport) {
-                if (c == '\n')
-                        udbg_550_putc('\r');
-                udbg_550_flush();
-                out_8(&udbg_comport->thr, c);
-        }
+        if (!udbg_uart_out)
+                return;
+
+        if (c == '\n')
+                udbg_uart_putc('\r');
+        udbg_uart_flush();
+        udbg_uart_out(UART_THR, c);
 }
 
-static int udbg_550_getc_poll(void)
+static int udbg_uart_getc_poll(void)
 {
-        if (udbg_comport) {
-                if ((in_8(&udbg_comport->lsr) & LSR_DR) != 0)
-                        return in_8(&udbg_comport->rbr);
-                else
-                        return -1;
-        }
+        if (!udbg_uart_in || !(udbg_uart_in(UART_LSR) & LSR_DR))
+                return udbg_uart_in(UART_RBR);
         return -1;
 }
 
-static int udbg_550_getc(void)
+static int udbg_uart_getc(void)
 {
-        if (udbg_comport) {
-                while ((in_8(&udbg_comport->lsr) & LSR_DR) == 0)
-                        /* wait for char */;
-                return in_8(&udbg_comport->rbr);
-        }
-        return -1;
+        if (!udbg_uart_in)
+                return -1;
+        /* wait for char */
+        while (!(udbg_uart_in(UART_LSR) & LSR_DR))
+                cpu_relax();
+        return udbg_uart_in(UART_RBR);
+}
+
+static void udbg_use_uart(void)
+{
+        udbg_putc = udbg_uart_putc;
+        udbg_flush = udbg_uart_flush;
+        udbg_getc = udbg_uart_getc;
+        udbg_getc_poll = udbg_uart_getc_poll;
 }
 
-void udbg_init_uart(void __iomem *comport, unsigned int speed,
-                    unsigned int clock)
+void udbg_uart_setup(unsigned int speed, unsigned int clock)
 {
         unsigned int dll, base_bauds;
 
+        if (!udbg_uart_out)
+                return;
+
         if (clock == 0)
                 clock = 1843200;
         if (speed == 0)
@@ -101,51 +107,43 @@ void udbg_init_uart(void __iomem *comport, unsigned int speed,
         base_bauds = clock / 16;
         dll = base_bauds / speed;
 
-        if (comport) {
-                udbg_comport = (struct NS16550 __iomem *)comport;
-                out_8(&udbg_comport->lcr, 0x00);
-                out_8(&udbg_comport->ier, 0xff);
-                out_8(&udbg_comport->ier, 0x00);
-                out_8(&udbg_comport->lcr, LCR_DLAB);
-                out_8(&udbg_comport->dll, dll & 0xff);
-                out_8(&udbg_comport->dlm, dll >> 8);
-                /* 8 data, 1 stop, no parity */
-                out_8(&udbg_comport->lcr, 0x03);
-                /* RTS/DTR */
-                out_8(&udbg_comport->mcr, 0x03);
-                /* Clear & enable FIFOs */
-                out_8(&udbg_comport->fcr ,0x07);
-                udbg_putc = udbg_550_putc;
-                udbg_flush = udbg_550_flush;
-                udbg_getc = udbg_550_getc;
-                udbg_getc_poll = udbg_550_getc_poll;
-        }
+        udbg_uart_out(UART_LCR, 0x00);
+        udbg_uart_out(UART_IER, 0xff);
+        udbg_uart_out(UART_IER, 0x00);
+        udbg_uart_out(UART_LCR, LCR_DLAB);
+        udbg_uart_out(UART_DLL, dll & 0xff);
+        udbg_uart_out(UART_DLM, dll >> 8);
+        /* 8 data, 1 stop, no parity */
+        udbg_uart_out(UART_LCR, 0x3);
+        /* RTS/DTR */
+        udbg_uart_out(UART_MCR, 0x3);
+        /* Clear & enable FIFOs */
+        udbg_uart_out(UART_FCR, 0x7);
 }
 
-unsigned int udbg_probe_uart_speed(void __iomem *comport, unsigned int clock)
+unsigned int udbg_probe_uart_speed(unsigned int clock)
 {
         unsigned int dll, dlm, divisor, prescaler, speed;
         u8 old_lcr;
-        struct NS16550 __iomem *port = comport;
 
-        old_lcr = in_8(&port->lcr);
+        old_lcr = udbg_uart_in(UART_LCR);
 
         /* select divisor latch registers.  */
-        out_8(&port->lcr, LCR_DLAB);
+        udbg_uart_out(UART_LCR, old_lcr | LCR_DLAB);
 
         /* now, read the divisor */
-        dll = in_8(&port->dll);
-        dlm = in_8(&port->dlm);
+        dll = udbg_uart_in(UART_DLL);
+        dlm = udbg_uart_in(UART_DLM);
         divisor = dlm << 8 | dll;
 
         /* check prescaling */
-        if (in_8(&port->mcr) & 0x80)
+        if (udbg_uart_in(UART_MCR) & 0x80)
                 prescaler = 4;
         else
                 prescaler = 1;
 
         /* restore the LCR */
-        out_8(&port->lcr, old_lcr);
+        udbg_uart_out(UART_LCR, old_lcr);
 
         /* calculate speed */
         speed = (clock / prescaler) / (divisor * 16);
@@ -157,195 +155,155 @@ unsigned int udbg_probe_uart_speed(void __iomem *comport, unsigned int clock)
         return speed;
 }
 
-#ifdef CONFIG_PPC_MAPLE
-void udbg_maple_real_flush(void)
+static union {
+        unsigned char __iomem *mmio_base;
+        unsigned long pio_base;
+} udbg_uart;
+
+static unsigned int udbg_uart_stride = 1;
+
+static u8 udbg_uart_in_pio(unsigned int reg)
 {
-        if (udbg_comport) {
-                while ((real_readb(&udbg_comport->lsr) & LSR_THRE) == 0)
-                        /* wait for idle */;
-        }
+        return inb(udbg_uart.pio_base + (reg * udbg_uart_stride));
 }
 
-void udbg_maple_real_putc(char c)
+static void udbg_uart_out_pio(unsigned int reg, u8 data)
 {
-        if (udbg_comport) {
-                if (c == '\n')
-                        udbg_maple_real_putc('\r');
-                udbg_maple_real_flush();
-                real_writeb(c, &udbg_comport->thr); eieio();
-        }
+        outb(data, udbg_uart.pio_base + (reg * udbg_uart_stride));
 }
 
-void __init udbg_init_maple_realmode(void)
+void udbg_uart_init_pio(unsigned long port, unsigned int stride)
 {
-        udbg_comport = (struct NS16550 __iomem *)0xf40003f8;
-
-        udbg_putc = udbg_maple_real_putc;
-        udbg_flush = udbg_maple_real_flush;
-        udbg_getc = NULL;
-        udbg_getc_poll = NULL;
+        if (!port)
+                return;
+        udbg_uart.pio_base = port;
+        udbg_uart_stride = stride;
+        udbg_uart_in = udbg_uart_in_pio;
+        udbg_uart_out = udbg_uart_out_pio;
+        udbg_use_uart();
 }
-#endif /* CONFIG_PPC_MAPLE */
 
-#ifdef CONFIG_PPC_PASEMI
-void udbg_pas_real_flush(void)
+static u8 udbg_uart_in_mmio(unsigned int reg)
 {
-        if (udbg_comport) {
-                while ((real_205_readb(&udbg_comport->lsr) & LSR_THRE) == 0)
-                        /* wait for idle */;
-        }
+        return in_8(udbg_uart.mmio_base + (reg * udbg_uart_stride));
 }
 
-void udbg_pas_real_putc(char c)
+static void udbg_uart_out_mmio(unsigned int reg, u8 data)
 {
-        if (udbg_comport) {
-                if (c == '\n')
-                        udbg_pas_real_putc('\r');
-                udbg_pas_real_flush();
-                real_205_writeb(c, &udbg_comport->thr); eieio();
-        }
+        out_8(udbg_uart.mmio_base + (reg * udbg_uart_stride), data);
 }
 
-void udbg_init_pas_realmode(void)
-{
-        udbg_comport = (struct NS16550 __iomem *)0xfcff03f8UL;
 
-        udbg_putc = udbg_pas_real_putc;
-        udbg_flush = udbg_pas_real_flush;
-        udbg_getc = NULL;
-        udbg_getc_poll = NULL;
+void udbg_uart_init_mmio(void __iomem *addr, unsigned int stride)
+{
+        if (!addr)
+                return;
+        udbg_uart.mmio_base = addr;
+        udbg_uart_stride = stride;
+        udbg_uart_in = udbg_uart_in_mmio;
+        udbg_uart_out = udbg_uart_out_mmio;
+        udbg_use_uart();
 }
-#endif /* CONFIG_PPC_MAPLE */
 
-#ifdef CONFIG_PPC_EARLY_DEBUG_44x
-#include <platforms/44x/44x.h>
+#ifdef CONFIG_PPC_MAPLE
+
+#define UDBG_UART_MAPLE_ADDR    ((void __iomem *)0xf40003f8)
 
-static void udbg_44x_as1_flush(void)
+static u8 udbg_uart_in_maple(unsigned int reg)
 {
-        if (udbg_comport) {
-                while ((as1_readb(&udbg_comport->lsr) & LSR_THRE) == 0)
-                        /* wait for idle */;
-        }
+        return real_readb(UDBG_UART_MAPLE_ADDR + reg);
 }
 
-static void udbg_44x_as1_putc(char c)
+static void udbg_uart_out_maple(unsigned int reg, u8 val)
 {
-        if (udbg_comport) {
-                if (c == '\n')
-                        udbg_44x_as1_putc('\r');
-                udbg_44x_as1_flush();
-                as1_writeb(c, &udbg_comport->thr); eieio();
-        }
+        real_writeb(val, UDBG_UART_MAPLE_ADDR + reg);
 }
 
-static int udbg_44x_as1_getc(void)
+void __init udbg_init_maple_realmode(void)
 {
-        if (udbg_comport) {
-                while ((as1_readb(&udbg_comport->lsr) & LSR_DR) == 0)
-                        ; /* wait for char */
-                return as1_readb(&udbg_comport->rbr);
-        }
-        return -1;
+        udbg_uart_in = udbg_uart_in_maple;
+        udbg_uart_out = udbg_uart_out_maple;
+        udbg_use_uart();
 }
 
-void __init udbg_init_44x_as1(void)
-{
-        udbg_comport =
-                (struct NS16550 __iomem *)PPC44x_EARLY_DEBUG_VIRTADDR;
+#endif /* CONFIG_PPC_MAPLE */
 
-        udbg_putc = udbg_44x_as1_putc;
-        udbg_flush = udbg_44x_as1_flush;
-        udbg_getc = udbg_44x_as1_getc;
-}
-#endif /* CONFIG_PPC_EARLY_DEBUG_44x */
+#ifdef CONFIG_PPC_PASEMI
 
-#ifdef CONFIG_PPC_EARLY_DEBUG_40x
-static void udbg_40x_real_flush(void)
+#define UDBG_UART_PAS_ADDR      ((void __iomem *)0xfcff03f8UL)
+
+static u8 udbg_uart_in_pas(unsigned int reg)
 {
-        if (udbg_comport) {
-                while ((real_readb(&udbg_comport->lsr) & LSR_THRE) == 0)
-                        /* wait for idle */;
-        }
+        return real_205_readb(UDBG_UART_PAS_ADDR + reg);
 }
 
-static void udbg_40x_real_putc(char c)
+static void udbg_uart_out_pas(unsigned int reg, u8 val)
 {
-        if (udbg_comport) {
-                if (c == '\n')
-                        udbg_40x_real_putc('\r');
-                udbg_40x_real_flush();
-                real_writeb(c, &udbg_comport->thr); eieio();
-        }
+        real_205_writeb(val, UDBG_UART_PAS_ADDR + reg);
 }
 
-static int udbg_40x_real_getc(void)
+void __init udbg_init_pas_realmode(void)
 {
-        if (udbg_comport) {
-                while ((real_readb(&udbg_comport->lsr) & LSR_DR) == 0)
-                        ; /* wait for char */
-                return real_readb(&udbg_comport->rbr);
-        }
-        return -1;
+        udbg_uart_in = udbg_uart_in_pas;
+        udbg_uart_out = udbg_uart_out_pas;
+        udbg_use_uart();
 }
 
-void __init udbg_init_40x_realmode(void)
-{
-        udbg_comport = (struct NS16550 __iomem *)
-                CONFIG_PPC_EARLY_DEBUG_40x_PHYSADDR;
+#endif /* CONFIG_PPC_PASEMI */
+
+#ifdef CONFIG_PPC_EARLY_DEBUG_44x
 
-        udbg_putc = udbg_40x_real_putc;
-        udbg_flush = udbg_40x_real_flush;
-        udbg_getc = udbg_40x_real_getc;
-        udbg_getc_poll = NULL;
+#include <platforms/44x/44x.h>
+
+static u8 udbg_uart_in_44x_as1(unsigned int reg)
+{
+        return as1_readb((void __iomem *)PPC44x_EARLY_DEBUG_VIRTADDR + reg);
 }
-#endif /* CONFIG_PPC_EARLY_DEBUG_40x */
 
-#ifdef CONFIG_PPC_EARLY_DEBUG_WSP
-static void udbg_wsp_flush(void)
+static void udbg_uart_out_44x_as1(unsigned int reg, u8 val)
 {
-        if (udbg_comport) {
-                while ((readb(&udbg_comport->lsr) & LSR_THRE) == 0)
-                        /* wait for idle */;
-        }
+        as1_writeb(val, (void __iomem *)PPC44x_EARLY_DEBUG_VIRTADDR + reg);
 }
 
-static void udbg_wsp_putc(char c)
+void __init udbg_init_44x_as1(void)
 {
-        if (udbg_comport) {
-                if (c == '\n')
-                        udbg_wsp_putc('\r');
-                udbg_wsp_flush();
-                writeb(c, &udbg_comport->thr); eieio();
-        }
+        udbg_uart_in = udbg_uart_in_44x_as1;
+        udbg_uart_out = udbg_uart_out_44x_as1;
+        udbg_use_uart();
 }
 
-static int udbg_wsp_getc(void)
+#endif /* CONFIG_PPC_EARLY_DEBUG_44x */
+
+#ifdef CONFIG_PPC_EARLY_DEBUG_40x
+
+static u8 udbg_uart_in_40x(unsigned int reg)
 {
-        if (udbg_comport) {
-                while ((readb(&udbg_comport->lsr) & LSR_DR) == 0)
-                        ; /* wait for char */
-                return readb(&udbg_comport->rbr);
-        }
-        return -1;
+        return real_readb((void __iomem *)CONFIG_PPC_EARLY_DEBUG_40x_PHYSADDR
+                          + reg);
 }
 
-static int udbg_wsp_getc_poll(void)
+static void udbg_uart_out_40x(unsigned int reg, u8 val)
 {
-        if (udbg_comport)
-                if (readb(&udbg_comport->lsr) & LSR_DR)
-                        return readb(&udbg_comport->rbr);
-        return -1;
+        real_writeb(val, (void __iomem *)CONFIG_PPC_EARLY_DEBUG_40x_PHYSADDR
+                    + reg);
 }
 
-void __init udbg_init_wsp(void)
+void __init udbg_init_40x_realmode(void)
 {
-        udbg_comport = (struct NS16550 __iomem *)WSP_UART_VIRT;
+        udbg_uart_in = udbg_uart_in_40x;
+        udbg_uart_out = udbg_uart_out_40x;
+        udbg_use_uart();
+}
 
-        udbg_init_uart(udbg_comport, 57600, 50000000);
+#endif /* CONFIG_PPC_EARLY_DEBUG_40x */
+
+
+#ifdef CONFIG_PPC_EARLY_DEBUG_WSP
 
-        udbg_putc = udbg_wsp_putc;
-        udbg_flush = udbg_wsp_flush;
-        udbg_getc = udbg_wsp_getc;
-        udbg_getc_poll = udbg_wsp_getc_poll;
+void __init udbg_init_wsp(void)
+{
+        udbg_uart_init_mmio((void *)WSP_UART_VIRT, 1);
+        udbg_uart_setup(57600, 50000000);
 }
+
 #endif /* CONFIG_PPC_EARLY_DEBUG_WSP */
diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S
index 27e2f623210b..6b1f2a6d5517 100644
--- a/arch/powerpc/kernel/vdso32/gettimeofday.S
+++ b/arch/powerpc/kernel/vdso32/gettimeofday.S
@@ -232,9 +232,9 @@ __do_get_tspec:
         lwz     r6,(CFG_TB_ORIG_STAMP+4)(r9)
 
         /* Get a stable TB value */
-2:      mftbu   r3
-        mftbl   r4
-        mftbu   r0
+2:      mfspr   r3, SPRN_TBRU
+        mfspr   r4, SPRN_TBRL
+        mfspr   r0, SPRN_TBRU
         cmplw   cr0,r3,r0
         bne-    2b
 
diff --git a/arch/powerpc/kernel/vio.c b/arch/powerpc/kernel/vio.c
index 536016d792ba..78a350670de3 100644
--- a/arch/powerpc/kernel/vio.c
+++ b/arch/powerpc/kernel/vio.c
@@ -1153,7 +1153,7 @@ EXPORT_SYMBOL(vio_h_cop_sync);
 
 static struct iommu_table *vio_build_iommu_table(struct vio_dev *dev)
 {
-        const unsigned char *dma_window;
+        const __be32 *dma_window;
         struct iommu_table *tbl;
         unsigned long offset, size;
 
@@ -1312,8 +1312,7 @@ struct vio_dev *vio_register_device_node(struct device_node *of_node)
 {
         struct vio_dev *viodev;
         struct device_node *parent_node;
-        const unsigned int *unit_address;
-        const unsigned int *pfo_resid = NULL;
+        const __be32 *prop;
         enum vio_dev_family family;
         const char *of_node_name = of_node->name ? of_node->name : "<unknown>";
 
@@ -1360,6 +1359,8 @@ struct vio_dev *vio_register_device_node(struct device_node *of_node)
         /* we need the 'device_type' property, in order to match with drivers */
         viodev->family = family;
         if (viodev->family == VDEVICE) {
+                unsigned int unit_address;
+
                 if (of_node->type != NULL)
                         viodev->type = of_node->type;
                 else {
@@ -1368,24 +1369,24 @@ struct vio_dev *vio_register_device_node(struct device_node *of_node)
                         goto out;
                 }
 
-                unit_address = of_get_property(of_node, "reg", NULL);
-                if (unit_address == NULL) {
+                prop = of_get_property(of_node, "reg", NULL);
+                if (prop == NULL) {
                         pr_warn("%s: node %s missing 'reg'\n",
                                         __func__, of_node_name);
                         goto out;
                 }
-                dev_set_name(&viodev->dev, "%x", *unit_address);
+                unit_address = of_read_number(prop, 1);
+                dev_set_name(&viodev->dev, "%x", unit_address);
                 viodev->irq = irq_of_parse_and_map(of_node, 0);
-                viodev->unit_address = *unit_address;
+                viodev->unit_address = unit_address;
         } else {
                 /* PFO devices need their resource_id for submitting COP_OPs
                  * This is an optional field for devices, but is required when
                  * performing synchronous ops */
-                pfo_resid = of_get_property(of_node, "ibm,resource-id", NULL);
-                if (pfo_resid != NULL)
-                        viodev->resource_id = *pfo_resid;
+                prop = of_get_property(of_node, "ibm,resource-id", NULL);
+                if (prop != NULL)
+                        viodev->resource_id = of_read_number(prop, 1);
 
-                unit_address = NULL;
                 dev_set_name(&viodev->dev, "%s", of_node_name);
                 viodev->type = of_node_name;
                 viodev->irq = 0;
@@ -1622,7 +1623,6 @@ static struct vio_dev *vio_find_name(const char *name)
  */
 struct vio_dev *vio_find_node(struct device_node *vnode)
 {
-        const uint32_t *unit_address;
         char kobj_name[20];
         struct device_node *vnode_parent;
         const char *dev_type;
@@ -1638,10 +1638,13 @@ struct vio_dev *vio_find_node(struct device_node *vnode)
 
         /* construct the kobject name from the device node */
         if (!strcmp(dev_type, "vdevice")) {
-                unit_address = of_get_property(vnode, "reg", NULL);
-                if (!unit_address)
+                const __be32 *prop;
+                
+                prop = of_get_property(vnode, "reg", NULL);
+                if (!prop)
                         return NULL;
-                snprintf(kobj_name, sizeof(kobj_name), "%x", *unit_address);
+                snprintf(kobj_name, sizeof(kobj_name), "%x",
+                         (uint32_t)of_read_number(prop, 1));
         } else if (!strcmp(dev_type, "ibm,platform-facilities"))
                 snprintf(kobj_name, sizeof(kobj_name), "%s", vnode->name);
         else
diff --git a/arch/powerpc/kvm/Kconfig b/arch/powerpc/kvm/Kconfig
index eb643f862579..ffaef2cb101a 100644
--- a/arch/powerpc/kvm/Kconfig
+++ b/arch/powerpc/kvm/Kconfig
@@ -72,6 +72,7 @@ config KVM_BOOK3S_64_HV
         bool "KVM support for POWER7 and PPC970 using hypervisor mode in host"
         depends on KVM_BOOK3S_64
         select MMU_NOTIFIER
+        select CMA
         ---help---
           Support running unmodified book3s_64 guest kernels in
           virtual machines on POWER7 and PPC970 processors that have
diff --git a/arch/powerpc/kvm/Makefile b/arch/powerpc/kvm/Makefile
index 008cd856c5b5..6646c952c5e3 100644
--- a/arch/powerpc/kvm/Makefile
+++ b/arch/powerpc/kvm/Makefile
@@ -81,6 +81,7 @@ kvm-book3s_64-builtin-objs-$(CONFIG_KVM_BOOK3S_64_HV) := \
         book3s_64_vio_hv.o \
         book3s_hv_ras.o \
         book3s_hv_builtin.o \
+        book3s_hv_cma.o \
         $(kvm-book3s_64-builtin-xics-objs-y)
 
 kvm-book3s_64-objs-$(CONFIG_KVM_XICS) += \
diff --git a/arch/powerpc/kvm/book3s_64_mmu.c b/arch/powerpc/kvm/book3s_64_mmu.c
index 739bfbadb85e..7e345e00661a 100644
--- a/arch/powerpc/kvm/book3s_64_mmu.c
+++ b/arch/powerpc/kvm/book3s_64_mmu.c
@@ -182,10 +182,13 @@ static int kvmppc_mmu_book3s_64_xlate(struct kvm_vcpu *vcpu, gva_t eaddr,
         hva_t ptegp;
         u64 pteg[16];
         u64 avpn = 0;
+        u64 v, r;
+        u64 v_val, v_mask;
+        u64 eaddr_mask;
         int i;
-        u8 key = 0;
+        u8 pp, key = 0;
         bool found = false;
-        int second = 0;
+        bool second = false;
         ulong mp_ea = vcpu->arch.magic_page_ea;
 
         /* Magic page override */
@@ -208,8 +211,16 @@ static int kvmppc_mmu_book3s_64_xlate(struct kvm_vcpu *vcpu, gva_t eaddr,
                 goto no_seg_found;
 
         avpn = kvmppc_mmu_book3s_64_get_avpn(slbe, eaddr);
+        v_val = avpn & HPTE_V_AVPN;
+
         if (slbe->tb)
-                avpn |= SLB_VSID_B_1T;
+                v_val |= SLB_VSID_B_1T;
+        if (slbe->large)
+                v_val |= HPTE_V_LARGE;
+        v_val |= HPTE_V_VALID;
+
+        v_mask = SLB_VSID_B | HPTE_V_AVPN | HPTE_V_LARGE | HPTE_V_VALID |
+                HPTE_V_SECONDARY;
 
 do_second:
         ptegp = kvmppc_mmu_book3s_64_get_pteg(vcpu_book3s, slbe, eaddr, second);
@@ -227,91 +238,74 @@ do_second:
                 key = 4;
 
         for (i=0; i<16; i+=2) {
-                u64 v = pteg[i];
-                u64 r = pteg[i+1];
-
-                /* Valid check */
-                if (!(v & HPTE_V_VALID))
-                        continue;
-                /* Hash check */
-                if ((v & HPTE_V_SECONDARY) != second)
-                        continue;
-
-                /* AVPN compare */
-                if (HPTE_V_COMPARE(avpn, v)) {
-                        u8 pp = (r & HPTE_R_PP) | key;
-                        int eaddr_mask = 0xFFF;
-
-                        gpte->eaddr = eaddr;
-                        gpte->vpage = kvmppc_mmu_book3s_64_ea_to_vp(vcpu,
-                                                                    eaddr,
-                                                                    data);
-                        if (slbe->large)
-                                eaddr_mask = 0xFFFFFF;
-                        gpte->raddr = (r & HPTE_R_RPN) | (eaddr & eaddr_mask);
-                        gpte->may_execute = ((r & HPTE_R_N) ? false : true);
-                        gpte->may_read = false;
-                        gpte->may_write = false;
-
-                        switch (pp) {
-                        case 0:
-                        case 1:
-                        case 2:
-                        case 6:
-                                gpte->may_write = true;
-                                /* fall through */
-                        case 3:
-                        case 5:
-                        case 7:
-                                gpte->may_read = true;
-                                break;
-                        }
-
-                        dprintk("KVM MMU: Translated 0x%lx [0x%llx] -> 0x%llx "
-                                "-> 0x%lx\n",
-                                eaddr, avpn, gpte->vpage, gpte->raddr);
+                /* Check all relevant fields of 1st dword */
+                if ((pteg[i] & v_mask) == v_val) {
                         found = true;
                         break;
                 }
         }
 
-        /* Update PTE R and C bits, so the guest's swapper knows we used the
-         * page */
-        if (found) {
-                u32 oldr = pteg[i+1];
+        if (!found) {
+                if (second)
+                        goto no_page_found;
+                v_val |= HPTE_V_SECONDARY;
+                second = true;
+                goto do_second;
+        }
 
-                if (gpte->may_read) {
-                        /* Set the accessed flag */
-                        pteg[i+1] |= HPTE_R_R;
-                }
-                if (gpte->may_write) {
-                        /* Set the dirty flag */
-                        pteg[i+1] |= HPTE_R_C;
-                } else {
-                        dprintk("KVM: Mapping read-only page!\n");
-                }
+        v = pteg[i];
+        r = pteg[i+1];
+        pp = (r & HPTE_R_PP) | key;
+        eaddr_mask = 0xFFF;
+
+        gpte->eaddr = eaddr;
+        gpte->vpage = kvmppc_mmu_book3s_64_ea_to_vp(vcpu, eaddr, data);
+        if (slbe->large)
+                eaddr_mask = 0xFFFFFF;
+        gpte->raddr = (r & HPTE_R_RPN & ~eaddr_mask) | (eaddr & eaddr_mask);
+        gpte->may_execute = ((r & HPTE_R_N) ? false : true);
+        gpte->may_read = false;
+        gpte->may_write = false;
+
+        switch (pp) {
+        case 0:
+        case 1:
+        case 2:
+        case 6:
+                gpte->may_write = true;
+                /* fall through */
+        case 3:
+        case 5:
+        case 7:
+                gpte->may_read = true;
+                break;
+        }
 
-                /* Write back into the PTEG */
-                if (pteg[i+1] != oldr)
-                        copy_to_user((void __user *)ptegp, pteg, sizeof(pteg));
+        dprintk("KVM MMU: Translated 0x%lx [0x%llx] -> 0x%llx "
+                "-> 0x%lx\n",
+                eaddr, avpn, gpte->vpage, gpte->raddr);
 
-                if (!gpte->may_read)
-                        return -EPERM;
-                return 0;
-        } else {
-                dprintk("KVM MMU: No PTE found (ea=0x%lx sdr1=0x%llx "
-                        "ptegp=0x%lx)\n",
-                        eaddr, to_book3s(vcpu)->sdr1, ptegp);
-                for (i = 0; i < 16; i += 2)
-                        dprintk("   %02d: 0x%llx - 0x%llx (0x%llx)\n",
-                                i, pteg[i], pteg[i+1], avpn);
-
-                if (!second) {
-                        second = HPTE_V_SECONDARY;
-                        goto do_second;
-                }
+        /* Update PTE R and C bits, so the guest's swapper knows we used the
+         * page */
+        if (gpte->may_read) {
+                /* Set the accessed flag */
+                r |= HPTE_R_R;
+        }
+        if (data && gpte->may_write) {
+                /* Set the dirty flag -- XXX even if not writing */
+                r |= HPTE_R_C;
+        }
+
+        /* Write back into the PTEG */
+        if (pteg[i+1] != r) {
+                pteg[i+1] = r;
+                copy_to_user((void __user *)ptegp, pteg, sizeof(pteg));
         }
 
+        if (!gpte->may_read)
+                return -EPERM;
+        return 0;
+
 no_page_found:
         return -ENOENT;
 
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index 710d31317d81..043eec8461e7 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -37,6 +37,8 @@
 #include <asm/ppc-opcode.h>
 #include <asm/cputable.h>
 
+#include "book3s_hv_cma.h"
+
 /* POWER7 has 10-bit LPIDs, PPC970 has 6-bit LPIDs */
 #define MAX_LPID_970    63
 
@@ -52,8 +54,8 @@ long kvmppc_alloc_hpt(struct kvm *kvm, u32 *htab_orderp)
 {
         unsigned long hpt;
         struct revmap_entry *rev;
-        struct kvmppc_linear_info *li;
-        long order = kvm_hpt_order;
+        struct page *page = NULL;
+        long order = KVM_DEFAULT_HPT_ORDER;
 
         if (htab_orderp) {
                 order = *htab_orderp;
@@ -61,26 +63,23 @@ long kvmppc_alloc_hpt(struct kvm *kvm, u32 *htab_orderp)
                         order = PPC_MIN_HPT_ORDER;
         }
 
+        kvm->arch.hpt_cma_alloc = 0;
         /*
-         * If the user wants a different size from default,
          * try first to allocate it from the kernel page allocator.
+         * We keep the CMA reserved for failed allocation.
          */
-        hpt = 0;
-        if (order != kvm_hpt_order) {
-                hpt = __get_free_pages(GFP_KERNEL|__GFP_ZERO|__GFP_REPEAT|
-                                       __GFP_NOWARN, order - PAGE_SHIFT);
-                if (!hpt)
-                        --order;
-        }
+        hpt = __get_free_pages(GFP_KERNEL | __GFP_ZERO | __GFP_REPEAT |
+                               __GFP_NOWARN, order - PAGE_SHIFT);
 
         /* Next try to allocate from the preallocated pool */
         if (!hpt) {
-                li = kvm_alloc_hpt();
-                if (li) {
-                        hpt = (ulong)li->base_virt;
-                        kvm->arch.hpt_li = li;
-                        order = kvm_hpt_order;
-                }
+                VM_BUG_ON(order < KVM_CMA_CHUNK_ORDER);
+                page = kvm_alloc_hpt(1 << (order - PAGE_SHIFT));
+                if (page) {
+                        hpt = (unsigned long)pfn_to_kaddr(page_to_pfn(page));
+                        kvm->arch.hpt_cma_alloc = 1;
+                } else
+                        --order;
         }
 
         /* Lastly try successively smaller sizes from the page allocator */
@@ -118,8 +117,8 @@ long kvmppc_alloc_hpt(struct kvm *kvm, u32 *htab_orderp)
         return 0;
 
  out_freehpt:
-        if (kvm->arch.hpt_li)
-                kvm_release_hpt(kvm->arch.hpt_li);
+        if (kvm->arch.hpt_cma_alloc)
+                kvm_release_hpt(page, 1 << (order - PAGE_SHIFT));
         else
                 free_pages(hpt, order - PAGE_SHIFT);
         return -ENOMEM;
@@ -165,8 +164,9 @@ void kvmppc_free_hpt(struct kvm *kvm)
 {
         kvmppc_free_lpid(kvm->arch.lpid);
         vfree(kvm->arch.revmap);
-        if (kvm->arch.hpt_li)
-                kvm_release_hpt(kvm->arch.hpt_li);
+        if (kvm->arch.hpt_cma_alloc)
+                kvm_release_hpt(virt_to_page(kvm->arch.hpt_virt),
+                                1 << (kvm->arch.hpt_order - PAGE_SHIFT));
         else
                 free_pages(kvm->arch.hpt_virt,
                            kvm->arch.hpt_order - PAGE_SHIFT);
@@ -1579,7 +1579,7 @@ int kvm_vm_ioctl_get_htab_fd(struct kvm *kvm, struct kvm_get_htab_fd *ghf)
         ctx->first_pass = 1;
 
         rwflag = (ghf->flags & KVM_GET_HTAB_WRITE) ? O_WRONLY : O_RDONLY;
-        ret = anon_inode_getfd("kvm-htab", &kvm_htab_fops, ctx, rwflag);
+        ret = anon_inode_getfd("kvm-htab", &kvm_htab_fops, ctx, rwflag | O_CLOEXEC);
         if (ret < 0) {
                 kvm_put_kvm(kvm);
                 return ret;
diff --git a/arch/powerpc/kvm/book3s_64_slb.S b/arch/powerpc/kvm/book3s_64_slb.S
index 4f0caecc0f9d..4f12e8f0c718 100644
--- a/arch/powerpc/kvm/book3s_64_slb.S
+++ b/arch/powerpc/kvm/book3s_64_slb.S
@@ -17,6 +17,10 @@
  * Authors: Alexander Graf <agraf@suse.de>
  */
 
+#ifdef __LITTLE_ENDIAN__
+#error Need to fix SLB shadow accesses in little endian mode
+#endif
+
 #define SHADOW_SLB_ESID(num)    (SLBSHADOW_SAVEAREA + (num * 0x10))
 #define SHADOW_SLB_VSID(num)    (SLBSHADOW_SAVEAREA + (num * 0x10) + 0x8)
 #define UNBOLT_SLB_ENTRY(num) \
diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
index b2d3f3b2de72..54cf9bc94dad 100644
--- a/arch/powerpc/kvm/book3s_64_vio.c
+++ b/arch/powerpc/kvm/book3s_64_vio.c
@@ -136,7 +136,7 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,
         mutex_unlock(&kvm->lock);
 
         return anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops,
-                                stt, O_RDWR);
+                                stt, O_RDWR | O_CLOEXEC);
 
 fail:
         if (stt) {
diff --git a/arch/powerpc/kvm/book3s_emulate.c b/arch/powerpc/kvm/book3s_emulate.c
index 1f6344c4408d..360ce68c9809 100644
--- a/arch/powerpc/kvm/book3s_emulate.c
+++ b/arch/powerpc/kvm/book3s_emulate.c
@@ -458,6 +458,7 @@ int kvmppc_core_emulate_mtspr(struct kvm_vcpu *vcpu, int sprn, ulong spr_val)
         case SPRN_PMC4_GEKKO:
         case SPRN_WPAR_GEKKO:
         case SPRN_MSSSR0:
+        case SPRN_DABR:
                 break;
 unprivileged:
         default:
@@ -555,6 +556,7 @@ int kvmppc_core_emulate_mfspr(struct kvm_vcpu *vcpu, int sprn, ulong *spr_val)
         case SPRN_PMC4_GEKKO:
         case SPRN_WPAR_GEKKO:
         case SPRN_MSSSR0:
+        case SPRN_DABR:
                 *spr_val = 0;
                 break;
         default:
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 2efa9dde741a..62a2b5ab08ed 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -217,7 +217,7 @@ struct kvm_vcpu *kvmppc_find_vcpu(struct kvm *kvm, int id)
 
 static void init_vpa(struct kvm_vcpu *vcpu, struct lppaca *vpa)
 {
-        vpa->shared_proc = 1;
+        vpa->__old_status |= LPPACA_OLD_SHARED_PROC;
         vpa->yield_count = 1;
 }
 
@@ -680,13 +680,12 @@ static int kvmppc_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu,
 }
 
 int kvm_arch_vcpu_ioctl_get_sregs(struct kvm_vcpu *vcpu,
-                                  struct kvm_sregs *sregs)
+                                  struct kvm_sregs *sregs)
 {
         int i;
 
-        sregs->pvr = vcpu->arch.pvr;
-
         memset(sregs, 0, sizeof(struct kvm_sregs));
+        sregs->pvr = vcpu->arch.pvr;
         for (i = 0; i < vcpu->arch.slb_max; i++) {
                 sregs->u.s.ppc64.slb[i].slbe = vcpu->arch.slb[i].orige;
                 sregs->u.s.ppc64.slb[i].slbv = vcpu->arch.slb[i].origv;
@@ -696,7 +695,7 @@ int kvm_arch_vcpu_ioctl_get_sregs(struct kvm_vcpu *vcpu,
 }
 
 int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
-                                  struct kvm_sregs *sregs)
+                                  struct kvm_sregs *sregs)
 {
         int i, j;
 
@@ -1511,10 +1510,10 @@ static inline int lpcr_rmls(unsigned long rma_size)
 
 static int kvm_rma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
-        struct kvmppc_linear_info *ri = vma->vm_file->private_data;
         struct page *page;
+        struct kvm_rma_info *ri = vma->vm_file->private_data;
 
-        if (vmf->pgoff >= ri->npages)
+        if (vmf->pgoff >= kvm_rma_pages)
                 return VM_FAULT_SIGBUS;
 
         page = pfn_to_page(ri->base_pfn + vmf->pgoff);
@@ -1536,7 +1535,7 @@ static int kvm_rma_mmap(struct file *file, struct vm_area_struct *vma)
 
 static int kvm_rma_release(struct inode *inode, struct file *filp)
 {
-        struct kvmppc_linear_info *ri = filp->private_data;
+        struct kvm_rma_info *ri = filp->private_data;
 
         kvm_release_rma(ri);
         return 0;
@@ -1549,18 +1548,27 @@ static const struct file_operations kvm_rma_fops = {
 
 long kvm_vm_ioctl_allocate_rma(struct kvm *kvm, struct kvm_allocate_rma *ret)
 {
-        struct kvmppc_linear_info *ri;
         long fd;
+        struct kvm_rma_info *ri;
+        /*
+         * Only do this on PPC970 in HV mode
+         */
+        if (!cpu_has_feature(CPU_FTR_HVMODE) ||
+            !cpu_has_feature(CPU_FTR_ARCH_201))
+                return -EINVAL;
+
+        if (!kvm_rma_pages)
+                return -EINVAL;
 
         ri = kvm_alloc_rma();
         if (!ri)
                 return -ENOMEM;
 
-        fd = anon_inode_getfd("kvm-rma", &kvm_rma_fops, ri, O_RDWR);
+        fd = anon_inode_getfd("kvm-rma", &kvm_rma_fops, ri, O_RDWR | O_CLOEXEC);
         if (fd < 0)
                 kvm_release_rma(ri);
 
-        ret->rma_size = ri->npages << PAGE_SHIFT;
+        ret->rma_size = kvm_rma_pages << PAGE_SHIFT;
         return fd;
 }
 
@@ -1725,7 +1733,7 @@ static int kvmppc_hv_setup_htab_rma(struct kvm_vcpu *vcpu)
 {
         int err = 0;
         struct kvm *kvm = vcpu->kvm;
-        struct kvmppc_linear_info *ri = NULL;
+        struct kvm_rma_info *ri = NULL;
         unsigned long hva;
         struct kvm_memory_slot *memslot;
         struct vm_area_struct *vma;
@@ -1803,13 +1811,13 @@ static int kvmppc_hv_setup_htab_rma(struct kvm_vcpu *vcpu)
 
         } else {
                 /* Set up to use an RMO region */
-                rma_size = ri->npages;
+                rma_size = kvm_rma_pages;
                 if (rma_size > memslot->npages)
                         rma_size = memslot->npages;
                 rma_size <<= PAGE_SHIFT;
                 rmls = lpcr_rmls(rma_size);
                 err = -EINVAL;
-                if (rmls < 0) {
+                if ((long)rmls < 0) {
                         pr_err("KVM: Can't use RMA of 0x%lx bytes\n", rma_size);
                         goto out_srcu;
                 }
@@ -1831,14 +1839,14 @@ static int kvmppc_hv_setup_htab_rma(struct kvm_vcpu *vcpu)
                         /* POWER7 */
                         lpcr &= ~(LPCR_VPM0 | LPCR_VRMA_L);
                         lpcr |= rmls << LPCR_RMLS_SH;
-                        kvm->arch.rmor = kvm->arch.rma->base_pfn << PAGE_SHIFT;
+                        kvm->arch.rmor = ri->base_pfn << PAGE_SHIFT;
                 }
                 kvm->arch.lpcr = lpcr;
                 pr_info("KVM: Using RMO at %lx size %lx (LPCR = %lx)\n",
                         ri->base_pfn << PAGE_SHIFT, rma_size, lpcr);
 
                 /* Initialize phys addrs of pages in RMO */
-                npages = ri->npages;
+                npages = kvm_rma_pages;
                 porder = __ilog2(npages);
                 physp = memslot->arch.slot_phys;
                 if (physp) {
@@ -1874,7 +1882,7 @@ int kvmppc_core_init_vm(struct kvm *kvm)
         /* Allocate the guest's logical partition ID */
 
         lpid = kvmppc_alloc_lpid();
-        if (lpid < 0)
+        if ((long)lpid < 0)
                 return -ENOMEM;
         kvm->arch.lpid = lpid;
 
diff --git a/arch/powerpc/kvm/book3s_hv_builtin.c b/arch/powerpc/kvm/book3s_hv_builtin.c
index ec0a9e5de100..8cd0daebb82d 100644
--- a/arch/powerpc/kvm/book3s_hv_builtin.c
+++ b/arch/powerpc/kvm/book3s_hv_builtin.c
@@ -13,33 +13,34 @@
 #include <linux/spinlock.h>
 #include <linux/bootmem.h>
 #include <linux/init.h>
+#include <linux/memblock.h>
+#include <linux/sizes.h>
 
 #include <asm/cputable.h>
 #include <asm/kvm_ppc.h>
 #include <asm/kvm_book3s.h>
 
-#define KVM_LINEAR_RMA          0
-#define KVM_LINEAR_HPT          1
-
-static void __init kvm_linear_init_one(ulong size, int count, int type);
-static struct kvmppc_linear_info *kvm_alloc_linear(int type);
-static void kvm_release_linear(struct kvmppc_linear_info *ri);
-
-int kvm_hpt_order = KVM_DEFAULT_HPT_ORDER;
-EXPORT_SYMBOL_GPL(kvm_hpt_order);
-
-/*************** RMA *************/
-
+#include "book3s_hv_cma.h"
+/*
+ * Hash page table alignment on newer cpus(CPU_FTR_ARCH_206)
+ * should be power of 2.
+ */
+#define HPT_ALIGN_PAGES         ((1 << 18) >> PAGE_SHIFT) /* 256k */
+/*
+ * By default we reserve 5% of memory for hash pagetable allocation.
+ */
+static unsigned long kvm_cma_resv_ratio = 5;
 /*
- * This maintains a list of RMAs (real mode areas) for KVM guests to use.
+ * We allocate RMAs (real mode areas) for KVM guests from the KVM CMA area.
  * Each RMA has to be physically contiguous and of a size that the
  * hardware supports.  PPC970 and POWER7 support 64MB, 128MB and 256MB,
  * and other larger sizes.  Since we are unlikely to be allocate that
  * much physically contiguous memory after the system is up and running,
- * we preallocate a set of RMAs in early boot for KVM to use.
+ * we preallocate a set of RMAs in early boot using CMA.
+ * should be power of 2.
  */
-static unsigned long kvm_rma_size = 64 << 20;   /* 64MB */
-static unsigned long kvm_rma_count;
+unsigned long kvm_rma_pages = (1 << 27) >> PAGE_SHIFT;  /* 128MB */
+EXPORT_SYMBOL_GPL(kvm_rma_pages);
 
 /* Work out RMLS (real mode limit selector) field value for a given RMA size.
    Assumes POWER7 or PPC970. */
@@ -69,165 +70,114 @@ static inline int lpcr_rmls(unsigned long rma_size)
 
 static int __init early_parse_rma_size(char *p)
 {
-        if (!p)
-                return 1;
+        unsigned long kvm_rma_size;
 
+        pr_debug("%s(%s)\n", __func__, p);
+        if (!p)
+                return -EINVAL;
         kvm_rma_size = memparse(p, &p);
-
+        /*
+         * Check that the requested size is one supported in hardware
+         */
+        if (lpcr_rmls(kvm_rma_size) < 0) {
+                pr_err("RMA size of 0x%lx not supported\n", kvm_rma_size);
+                return -EINVAL;
+        }
+        kvm_rma_pages = kvm_rma_size >> PAGE_SHIFT;
         return 0;
 }
 early_param("kvm_rma_size", early_parse_rma_size);
 
-static int __init early_parse_rma_count(char *p)
+struct kvm_rma_info *kvm_alloc_rma()
 {
-        if (!p)
-                return 1;
-
-        kvm_rma_count = simple_strtoul(p, NULL, 0);
-
-        return 0;
-}
-early_param("kvm_rma_count", early_parse_rma_count);
-
-struct kvmppc_linear_info *kvm_alloc_rma(void)
-{
-        return kvm_alloc_linear(KVM_LINEAR_RMA);
+        struct page *page;
+        struct kvm_rma_info *ri;
+
+        ri = kmalloc(sizeof(struct kvm_rma_info), GFP_KERNEL);
+        if (!ri)
+                return NULL;
+        page = kvm_alloc_cma(kvm_rma_pages, kvm_rma_pages);
+        if (!page)
+                goto err_out;
+        atomic_set(&ri->use_count, 1);
+        ri->base_pfn = page_to_pfn(page);
+        return ri;
+err_out:
+        kfree(ri);
+        return NULL;
 }
 EXPORT_SYMBOL_GPL(kvm_alloc_rma);
 
-void kvm_release_rma(struct kvmppc_linear_info *ri)
+void kvm_release_rma(struct kvm_rma_info *ri)
 {
-        kvm_release_linear(ri);
+        if (atomic_dec_and_test(&ri->use_count)) {
+                kvm_release_cma(pfn_to_page(ri->base_pfn), kvm_rma_pages);
+                kfree(ri);
+        }
 }
 EXPORT_SYMBOL_GPL(kvm_release_rma);
 
-/*************** HPT *************/
-
-/*
- * This maintains a list of big linear HPT tables that contain the GVA->HPA
- * memory mappings. If we don't reserve those early on, we might not be able
- * to get a big (usually 16MB) linear memory region from the kernel anymore.
- */
-
-static unsigned long kvm_hpt_count;
-
-static int __init early_parse_hpt_count(char *p)
+static int __init early_parse_kvm_cma_resv(char *p)
 {
+        pr_debug("%s(%s)\n", __func__, p);
         if (!p)
-                return 1;
-
-        kvm_hpt_count = simple_strtoul(p, NULL, 0);
-
-        return 0;
+                return -EINVAL;
+        return kstrtoul(p, 0, &kvm_cma_resv_ratio);
 }
-early_param("kvm_hpt_count", early_parse_hpt_count);
+early_param("kvm_cma_resv_ratio", early_parse_kvm_cma_resv);
 
-struct kvmppc_linear_info *kvm_alloc_hpt(void)
+struct page *kvm_alloc_hpt(unsigned long nr_pages)
 {
-        return kvm_alloc_linear(KVM_LINEAR_HPT);
+        unsigned long align_pages = HPT_ALIGN_PAGES;
+
+        /* Old CPUs require HPT aligned on a multiple of its size */
+        if (!cpu_has_feature(CPU_FTR_ARCH_206))
+                align_pages = nr_pages;
+        return kvm_alloc_cma(nr_pages, align_pages);
 }
 EXPORT_SYMBOL_GPL(kvm_alloc_hpt);
 
-void kvm_release_hpt(struct kvmppc_linear_info *li)
+void kvm_release_hpt(struct page *page, unsigned long nr_pages)
 {
-        kvm_release_linear(li);
+        kvm_release_cma(page, nr_pages);
 }
 EXPORT_SYMBOL_GPL(kvm_release_hpt);
 
-/*************** generic *************/
-
-static LIST_HEAD(free_linears);
-static DEFINE_SPINLOCK(linear_lock);
-
-static void __init kvm_linear_init_one(ulong size, int count, int type)
-{
-        unsigned long i;
-        unsigned long j, npages;
-        void *linear;
-        struct page *pg;
-        const char *typestr;
-        struct kvmppc_linear_info *linear_info;
-
-        if (!count)
-                return;
-
-        typestr = (type == KVM_LINEAR_RMA) ? "RMA" : "HPT";
-
-        npages = size >> PAGE_SHIFT;
-        linear_info = alloc_bootmem(count * sizeof(struct kvmppc_linear_info));
-        for (i = 0; i < count; ++i) {
-                linear = alloc_bootmem_align(size, size);
-                pr_debug("Allocated KVM %s at %p (%ld MB)\n", typestr, linear,
-                         size >> 20);
-                linear_info[i].base_virt = linear;
-                linear_info[i].base_pfn = __pa(linear) >> PAGE_SHIFT;
-                linear_info[i].npages = npages;
-                linear_info[i].type = type;
-                list_add_tail(&linear_info[i].list, &free_linears);
-                atomic_set(&linear_info[i].use_count, 0);
-
-                pg = pfn_to_page(linear_info[i].base_pfn);
-                for (j = 0; j < npages; ++j) {
-                        atomic_inc(&pg->_count);
-                        ++pg;
-                }
-        }
-}
-
-static struct kvmppc_linear_info *kvm_alloc_linear(int type)
-{
-        struct kvmppc_linear_info *ri, *ret;
-
-        ret = NULL;
-        spin_lock(&linear_lock);
-        list_for_each_entry(ri, &free_linears, list) {
-                if (ri->type != type)
-                        continue;
-
-                list_del(&ri->list);
-                atomic_inc(&ri->use_count);
-                memset(ri->base_virt, 0, ri->npages << PAGE_SHIFT);
-                ret = ri;
-                break;
-        }
-        spin_unlock(&linear_lock);
-        return ret;
-}
-
-static void kvm_release_linear(struct kvmppc_linear_info *ri)
-{
-        if (atomic_dec_and_test(&ri->use_count)) {
-                spin_lock(&linear_lock);
-                list_add_tail(&ri->list, &free_linears);
-                spin_unlock(&linear_lock);
-
-        }
-}
-
-/*
- * Called at boot time while the bootmem allocator is active,
- * to allocate contiguous physical memory for the hash page
- * tables for guests.
+/**
+ * kvm_cma_reserve() - reserve area for kvm hash pagetable
+ *
+ * This function reserves memory from early allocator. It should be
+ * called by arch specific code once the early allocator (memblock or bootmem)
+ * has been activated and all other subsystems have already allocated/reserved
+ * memory.
  */
-void __init kvm_linear_init(void)
+void __init kvm_cma_reserve(void)
 {
-        /* HPT */
-        kvm_linear_init_one(1 << kvm_hpt_order, kvm_hpt_count, KVM_LINEAR_HPT);
-
-        /* RMA */
-        /* Only do this on PPC970 in HV mode */
-        if (!cpu_has_feature(CPU_FTR_HVMODE) ||
-            !cpu_has_feature(CPU_FTR_ARCH_201))
-                return;
-
-        if (!kvm_rma_size || !kvm_rma_count)
-                return;
-
-        /* Check that the requested size is one supported in hardware */
-        if (lpcr_rmls(kvm_rma_size) < 0) {
-                pr_err("RMA size of 0x%lx not supported\n", kvm_rma_size);
-                return;
+        unsigned long align_size;
+        struct memblock_region *reg;
+        phys_addr_t selected_size = 0;
+        /*
+         * We cannot use memblock_phys_mem_size() here, because
+         * memblock_analyze() has not been called yet.
+         */
+        for_each_memblock(memory, reg)
+                selected_size += memblock_region_memory_end_pfn(reg) -
+                                 memblock_region_memory_base_pfn(reg);
+
+        selected_size = (selected_size * kvm_cma_resv_ratio / 100) << PAGE_SHIFT;
+        if (selected_size) {
+                pr_debug("%s: reserving %ld MiB for global area\n", __func__,
+                         (unsigned long)selected_size / SZ_1M);
+                /*
+                 * Old CPUs require HPT aligned on a multiple of its size. So for them
+                 * make the alignment as max size we could request.
+                 */
+                if (!cpu_has_feature(CPU_FTR_ARCH_206))
+                        align_size = __rounddown_pow_of_two(selected_size);
+                else
+                        align_size = HPT_ALIGN_PAGES << PAGE_SHIFT;
+
+                align_size = max(kvm_rma_pages << PAGE_SHIFT, align_size);
+                kvm_cma_declare_contiguous(selected_size, align_size);
         }
-
-        kvm_linear_init_one(kvm_rma_size, kvm_rma_count, KVM_LINEAR_RMA);
 }
diff --git a/arch/powerpc/kvm/book3s_hv_cma.c b/arch/powerpc/kvm/book3s_hv_cma.c
new file mode 100644
index 000000000000..d9d3d8553d51
--- /dev/null
+++ b/arch/powerpc/kvm/book3s_hv_cma.c
@@ -0,0 +1,240 @@
+/*
+ * Contiguous Memory Allocator for ppc KVM hash pagetable  based on CMA
+ * for DMA mapping framework
+ *
+ * Copyright IBM Corporation, 2013
+ * Author Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License or (at your optional) any later version of the license.
+ *
+ */
+#define pr_fmt(fmt) "kvm_cma: " fmt
+
+#ifdef CONFIG_CMA_DEBUG
+#ifndef DEBUG
+#  define DEBUG
+#endif
+#endif
+
+#include <linux/memblock.h>
+#include <linux/mutex.h>
+#include <linux/sizes.h>
+#include <linux/slab.h>
+
+#include "book3s_hv_cma.h"
+
+struct kvm_cma {
+        unsigned long   base_pfn;
+        unsigned long   count;
+        unsigned long   *bitmap;
+};
+
+static DEFINE_MUTEX(kvm_cma_mutex);
+static struct kvm_cma kvm_cma_area;
+
+/**
+ * kvm_cma_declare_contiguous() - reserve area for contiguous memory handling
+ *                                for kvm hash pagetable
+ * @size:  Size of the reserved memory.
+ * @alignment:  Alignment for the contiguous memory area
+ *
+ * This function reserves memory for kvm cma area. It should be
+ * called by arch code when early allocator (memblock or bootmem)
+ * is still activate.
+ */
+long __init kvm_cma_declare_contiguous(phys_addr_t size, phys_addr_t alignment)
+{
+        long base_pfn;
+        phys_addr_t addr;
+        struct kvm_cma *cma = &kvm_cma_area;
+
+        pr_debug("%s(size %lx)\n", __func__, (unsigned long)size);
+
+        if (!size)
+                return -EINVAL;
+        /*
+         * Sanitise input arguments.
+         * We should be pageblock aligned for CMA.
+         */
+        alignment = max(alignment, (phys_addr_t)(PAGE_SIZE << pageblock_order));
+        size = ALIGN(size, alignment);
+        /*
+         * Reserve memory
+         * Use __memblock_alloc_base() since
+         * memblock_alloc_base() panic()s.
+         */
+        addr = __memblock_alloc_base(size, alignment, 0);
+        if (!addr) {
+                base_pfn = -ENOMEM;
+                goto err;
+        } else
+                base_pfn = PFN_DOWN(addr);
+
+        /*
+         * Each reserved area must be initialised later, when more kernel
+         * subsystems (like slab allocator) are available.
+         */
+        cma->base_pfn = base_pfn;
+        cma->count    = size >> PAGE_SHIFT;
+        pr_info("CMA: reserved %ld MiB\n", (unsigned long)size / SZ_1M);
+        return 0;
+err:
+        pr_err("CMA: failed to reserve %ld MiB\n", (unsigned long)size / SZ_1M);
+        return base_pfn;
+}
+
+/**
+ * kvm_alloc_cma() - allocate pages from contiguous area
+ * @nr_pages: Requested number of pages.
+ * @align_pages: Requested alignment in number of pages
+ *
+ * This function allocates memory buffer for hash pagetable.
+ */
+struct page *kvm_alloc_cma(unsigned long nr_pages, unsigned long align_pages)
+{
+        int ret;
+        struct page *page = NULL;
+        struct kvm_cma *cma = &kvm_cma_area;
+        unsigned long chunk_count, nr_chunk;
+        unsigned long mask, pfn, pageno, start = 0;
+
+
+        if (!cma || !cma->count)
+                return NULL;
+
+        pr_debug("%s(cma %p, count %lu, align pages %lu)\n", __func__,
+                 (void *)cma, nr_pages, align_pages);
+
+        if (!nr_pages)
+                return NULL;
+        /*
+         * align mask with chunk size. The bit tracks pages in chunk size
+         */
+        VM_BUG_ON(!is_power_of_2(align_pages));
+        mask = (align_pages >> (KVM_CMA_CHUNK_ORDER - PAGE_SHIFT)) - 1;
+        BUILD_BUG_ON(PAGE_SHIFT > KVM_CMA_CHUNK_ORDER);
+
+        chunk_count = cma->count >>  (KVM_CMA_CHUNK_ORDER - PAGE_SHIFT);
+        nr_chunk = nr_pages >> (KVM_CMA_CHUNK_ORDER - PAGE_SHIFT);
+
+        mutex_lock(&kvm_cma_mutex);
+        for (;;) {
+                pageno = bitmap_find_next_zero_area(cma->bitmap, chunk_count,
+                                                    start, nr_chunk, mask);
+                if (pageno >= chunk_count)
+                        break;
+
+                pfn = cma->base_pfn + (pageno << (KVM_CMA_CHUNK_ORDER - PAGE_SHIFT));
+                ret = alloc_contig_range(pfn, pfn + nr_pages, MIGRATE_CMA);
+                if (ret == 0) {
+                        bitmap_set(cma->bitmap, pageno, nr_chunk);
+                        page = pfn_to_page(pfn);
+                        memset(pfn_to_kaddr(pfn), 0, nr_pages << PAGE_SHIFT);
+                        break;
+                } else if (ret != -EBUSY) {
+                        break;
+                }
+                pr_debug("%s(): memory range at %p is busy, retrying\n",
+                         __func__, pfn_to_page(pfn));
+                /* try again with a bit different memory target */
+                start = pageno + mask + 1;
+        }
+        mutex_unlock(&kvm_cma_mutex);
+        pr_debug("%s(): returned %p\n", __func__, page);
+        return page;
+}
+
+/**
+ * kvm_release_cma() - release allocated pages for hash pagetable
+ * @pages: Allocated pages.
+ * @nr_pages: Number of allocated pages.
+ *
+ * This function releases memory allocated by kvm_alloc_cma().
+ * It returns false when provided pages do not belong to contiguous area and
+ * true otherwise.
+ */
+bool kvm_release_cma(struct page *pages, unsigned long nr_pages)
+{
+        unsigned long pfn;
+        unsigned long nr_chunk;
+        struct kvm_cma *cma = &kvm_cma_area;
+
+        if (!cma || !pages)
+                return false;
+
+        pr_debug("%s(page %p count %lu)\n", __func__, (void *)pages, nr_pages);
+
+        pfn = page_to_pfn(pages);
+
+        if (pfn < cma->base_pfn || pfn >= cma->base_pfn + cma->count)
+                return false;
+
+        VM_BUG_ON(pfn + nr_pages > cma->base_pfn + cma->count);
+        nr_chunk = nr_pages >>  (KVM_CMA_CHUNK_ORDER - PAGE_SHIFT);
+
+        mutex_lock(&kvm_cma_mutex);
+        bitmap_clear(cma->bitmap,
+                     (pfn - cma->base_pfn) >> (KVM_CMA_CHUNK_ORDER - PAGE_SHIFT),
+                     nr_chunk);
+        free_contig_range(pfn, nr_pages);
+        mutex_unlock(&kvm_cma_mutex);
+
+        return true;
+}
+
+static int __init kvm_cma_activate_area(unsigned long base_pfn,
+                                        unsigned long count)
+{
+        unsigned long pfn = base_pfn;
+        unsigned i = count >> pageblock_order;
+        struct zone *zone;
+
+        WARN_ON_ONCE(!pfn_valid(pfn));
+        zone = page_zone(pfn_to_page(pfn));
+        do {
+                unsigned j;
+                base_pfn = pfn;
+                for (j = pageblock_nr_pages; j; --j, pfn++) {
+                        WARN_ON_ONCE(!pfn_valid(pfn));
+                        /*
+                         * alloc_contig_range requires the pfn range
+                         * specified to be in the same zone. Make this
+                         * simple by forcing the entire CMA resv range
+                         * to be in the same zone.
+                         */
+                        if (page_zone(pfn_to_page(pfn)) != zone)
+                                return -EINVAL;
+                }
+                init_cma_reserved_pageblock(pfn_to_page(base_pfn));
+        } while (--i);
+        return 0;
+}
+
+static int __init kvm_cma_init_reserved_areas(void)
+{
+        int bitmap_size, ret;
+        unsigned long chunk_count;
+        struct kvm_cma *cma = &kvm_cma_area;
+
+        pr_debug("%s()\n", __func__);
+        if (!cma->count)
+                return 0;
+        chunk_count = cma->count >> (KVM_CMA_CHUNK_ORDER - PAGE_SHIFT);
+        bitmap_size = BITS_TO_LONGS(chunk_count) * sizeof(long);
+        cma->bitmap = kzalloc(bitmap_size, GFP_KERNEL);
+        if (!cma->bitmap)
+                return -ENOMEM;
+
+        ret = kvm_cma_activate_area(cma->base_pfn, cma->count);
+        if (ret)
+                goto error;
+        return 0;
+
+error:
+        kfree(cma->bitmap);
+        return ret;
+}
+core_initcall(kvm_cma_init_reserved_areas);
diff --git a/arch/powerpc/kvm/book3s_hv_cma.h b/arch/powerpc/kvm/book3s_hv_cma.h
new file mode 100644
index 000000000000..655144f75fa5
--- /dev/null
+++ b/arch/powerpc/kvm/book3s_hv_cma.h
@@ -0,0 +1,27 @@
+/*
+ * Contiguous Memory Allocator for ppc KVM hash pagetable  based on CMA
+ * for DMA mapping framework
+ *
+ * Copyright IBM Corporation, 2013
+ * Author Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License or (at your optional) any later version of the license.
+ *
+ */
+
+#ifndef __POWERPC_KVM_CMA_ALLOC_H__
+#define __POWERPC_KVM_CMA_ALLOC_H__
+/*
+ * Both RMA and Hash page allocation will be multiple of 256K.
+ */
+#define KVM_CMA_CHUNK_ORDER     18
+
+extern struct page *kvm_alloc_cma(unsigned long nr_pages,
+                                  unsigned long align_pages);
+extern bool kvm_release_cma(struct page *pages, unsigned long nr_pages);
+extern long kvm_cma_declare_contiguous(phys_addr_t size,
+                                       phys_addr_t alignment) __init;
+#endif
diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
index fc25689a9f35..9c515440ad1a 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
@@ -363,7 +363,11 @@ long kvmppc_h_enter(struct kvm_vcpu *vcpu, unsigned long flags,
                                  vcpu->arch.pgdir, true, &vcpu->arch.gpr[4]);
 }
 
+#ifdef __BIG_ENDIAN__
 #define LOCK_TOKEN      (*(u32 *)(&get_paca()->lock_token))
+#else
+#define LOCK_TOKEN      (*(u32 *)(&get_paca()->paca_index))
+#endif
 
 static inline int try_lock_tlbie(unsigned int *lock)
 {
@@ -383,6 +387,80 @@ static inline int try_lock_tlbie(unsigned int *lock)
         return old == 0;
 }
 
+/*
+ * tlbie/tlbiel is a bit different on the PPC970 compared to later
+ * processors such as POWER7; the large page bit is in the instruction
+ * not RB, and the top 16 bits and the bottom 12 bits of the VA
+ * in RB must be 0.
+ */
+static void do_tlbies_970(struct kvm *kvm, unsigned long *rbvalues,
+                          long npages, int global, bool need_sync)
+{
+        long i;
+
+        if (global) {
+                while (!try_lock_tlbie(&kvm->arch.tlbie_lock))
+                        cpu_relax();
+                if (need_sync)
+                        asm volatile("ptesync" : : : "memory");
+                for (i = 0; i < npages; ++i) {
+                        unsigned long rb = rbvalues[i];
+
+                        if (rb & 1)             /* large page */
+                                asm volatile("tlbie %0,1" : :
+                                             "r" (rb & 0x0000fffffffff000ul));
+                        else
+                                asm volatile("tlbie %0,0" : :
+                                             "r" (rb & 0x0000fffffffff000ul));
+                }
+                asm volatile("eieio; tlbsync; ptesync" : : : "memory");
+                kvm->arch.tlbie_lock = 0;
+        } else {
+                if (need_sync)
+                        asm volatile("ptesync" : : : "memory");
+                for (i = 0; i < npages; ++i) {
+                        unsigned long rb = rbvalues[i];
+
+                        if (rb & 1)             /* large page */
+                                asm volatile("tlbiel %0,1" : :
+                                             "r" (rb & 0x0000fffffffff000ul));
+                        else
+                                asm volatile("tlbiel %0,0" : :
+                                             "r" (rb & 0x0000fffffffff000ul));
+                }
+                asm volatile("ptesync" : : : "memory");
+        }
+}
+
+static void do_tlbies(struct kvm *kvm, unsigned long *rbvalues,
+                      long npages, int global, bool need_sync)
+{
+        long i;
+
+        if (cpu_has_feature(CPU_FTR_ARCH_201)) {
+                /* PPC970 tlbie instruction is a bit different */
+                do_tlbies_970(kvm, rbvalues, npages, global, need_sync);
+                return;
+        }
+        if (global) {
+                while (!try_lock_tlbie(&kvm->arch.tlbie_lock))
+                        cpu_relax();
+                if (need_sync)
+                        asm volatile("ptesync" : : : "memory");
+                for (i = 0; i < npages; ++i)
+                        asm volatile(PPC_TLBIE(%1,%0) : :
+                                     "r" (rbvalues[i]), "r" (kvm->arch.lpid));
+                asm volatile("eieio; tlbsync; ptesync" : : : "memory");
+                kvm->arch.tlbie_lock = 0;
+        } else {
+                if (need_sync)
+                        asm volatile("ptesync" : : : "memory");
+                for (i = 0; i < npages; ++i)
+                        asm volatile("tlbiel %0" : : "r" (rbvalues[i]));
+                asm volatile("ptesync" : : : "memory");
+        }
+}
+
 long kvmppc_do_h_remove(struct kvm *kvm, unsigned long flags,
                         unsigned long pte_index, unsigned long avpn,
                         unsigned long *hpret)
@@ -408,19 +486,7 @@ long kvmppc_do_h_remove(struct kvm *kvm, unsigned long flags,
         if (v & HPTE_V_VALID) {
                 hpte[0] &= ~HPTE_V_VALID;
                 rb = compute_tlbie_rb(v, hpte[1], pte_index);
-                if (global_invalidates(kvm, flags)) {
-                        while (!try_lock_tlbie(&kvm->arch.tlbie_lock))
-                                cpu_relax();
-                        asm volatile("ptesync" : : : "memory");
-                        asm volatile(PPC_TLBIE(%1,%0)"; eieio; tlbsync"
-                                     : : "r" (rb), "r" (kvm->arch.lpid));
-                        asm volatile("ptesync" : : : "memory");
-                        kvm->arch.tlbie_lock = 0;
-                } else {
-                        asm volatile("ptesync" : : : "memory");
-                        asm volatile("tlbiel %0" : : "r" (rb));
-                        asm volatile("ptesync" : : : "memory");
-                }
+                do_tlbies(kvm, &rb, 1, global_invalidates(kvm, flags), true);
                 /* Read PTE low word after tlbie to get final R/C values */
                 remove_revmap_chain(kvm, pte_index, rev, v, hpte[1]);
         }
@@ -448,12 +514,11 @@ long kvmppc_h_bulk_remove(struct kvm_vcpu *vcpu)
         unsigned long *hp, *hptes[4], tlbrb[4];
         long int i, j, k, n, found, indexes[4];
         unsigned long flags, req, pte_index, rcbits;
-        long int local = 0;
+        int global;
         long int ret = H_SUCCESS;
         struct revmap_entry *rev, *revs[4];
 
-        if (atomic_read(&kvm->online_vcpus) == 1)
-                local = 1;
+        global = global_invalidates(kvm, 0);
         for (i = 0; i < 4 && ret == H_SUCCESS; ) {
                 n = 0;
                 for (; i < 4; ++i) {
@@ -529,22 +594,7 @@ long kvmppc_h_bulk_remove(struct kvm_vcpu *vcpu)
                         break;
 
                 /* Now that we've collected a batch, do the tlbies */
-                if (!local) {
-                        while(!try_lock_tlbie(&kvm->arch.tlbie_lock))
-                                cpu_relax();
-                        asm volatile("ptesync" : : : "memory");
-                        for (k = 0; k < n; ++k)
-                                asm volatile(PPC_TLBIE(%1,%0) : :
-                                             "r" (tlbrb[k]),
-                                             "r" (kvm->arch.lpid));
-                        asm volatile("eieio; tlbsync; ptesync" : : : "memory");
-                        kvm->arch.tlbie_lock = 0;
-                } else {
-                        asm volatile("ptesync" : : : "memory");
-                        for (k = 0; k < n; ++k)
-                                asm volatile("tlbiel %0" : : "r" (tlbrb[k]));
-                        asm volatile("ptesync" : : : "memory");
-                }
+                do_tlbies(kvm, tlbrb, n, global, true);
 
                 /* Read PTE low words after tlbie to get final R/C values */
                 for (k = 0; k < n; ++k) {
@@ -603,19 +653,7 @@ long kvmppc_h_protect(struct kvm_vcpu *vcpu, unsigned long flags,
         if (v & HPTE_V_VALID) {
                 rb = compute_tlbie_rb(v, r, pte_index);
                 hpte[0] = v & ~HPTE_V_VALID;
-                if (global_invalidates(kvm, flags)) {
-                        while(!try_lock_tlbie(&kvm->arch.tlbie_lock))
-                                cpu_relax();
-                        asm volatile("ptesync" : : : "memory");
-                        asm volatile(PPC_TLBIE(%1,%0)"; eieio; tlbsync"
-                                     : : "r" (rb), "r" (kvm->arch.lpid));
-                        asm volatile("ptesync" : : : "memory");
-                        kvm->arch.tlbie_lock = 0;
-                } else {
-                        asm volatile("ptesync" : : : "memory");
-                        asm volatile("tlbiel %0" : : "r" (rb));
-                        asm volatile("ptesync" : : : "memory");
-                }
+                do_tlbies(kvm, &rb, 1, global_invalidates(kvm, flags), true);
                 /*
                  * If the host has this page as readonly but the guest
                  * wants to make it read/write, reduce the permissions.
@@ -686,13 +724,7 @@ void kvmppc_invalidate_hpte(struct kvm *kvm, unsigned long *hptep,
 
         hptep[0] &= ~HPTE_V_VALID;
         rb = compute_tlbie_rb(hptep[0], hptep[1], pte_index);
-        while (!try_lock_tlbie(&kvm->arch.tlbie_lock))
-                cpu_relax();
-        asm volatile("ptesync" : : : "memory");
-        asm volatile(PPC_TLBIE(%1,%0)"; eieio; tlbsync"
-                     : : "r" (rb), "r" (kvm->arch.lpid));
-        asm volatile("ptesync" : : : "memory");
-        kvm->arch.tlbie_lock = 0;
+        do_tlbies(kvm, &rb, 1, 1, true);
 }
 EXPORT_SYMBOL_GPL(kvmppc_invalidate_hpte);
 
@@ -706,12 +738,7 @@ void kvmppc_clear_ref_hpte(struct kvm *kvm, unsigned long *hptep,
         rbyte = (hptep[1] & ~HPTE_R_R) >> 8;
         /* modify only the second-last byte, which contains the ref bit */
         *((char *)hptep + 14) = rbyte;
-        while (!try_lock_tlbie(&kvm->arch.tlbie_lock))
-                cpu_relax();
-        asm volatile(PPC_TLBIE(%1,%0)"; eieio; tlbsync"
-                     : : "r" (rb), "r" (kvm->arch.lpid));
-        asm volatile("ptesync" : : : "memory");
-        kvm->arch.tlbie_lock = 0;
+        do_tlbies(kvm, &rb, 1, 1, false);
 }
 EXPORT_SYMBOL_GPL(kvmppc_clear_ref_hpte);
 
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index b02f91e4c70d..294b7af28cdd 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -29,6 +29,10 @@
 #include <asm/kvm_book3s_asm.h>
 #include <asm/mmu-hash64.h>
 
+#ifdef __LITTLE_ENDIAN__
+#error Need to fix lppaca and SLB shadow accesses in little endian mode
+#endif
+
 /*****************************************************************************
  *                                                                           *
  *        Real Mode handlers that need to be in the linear mapping           *
@@ -389,7 +393,11 @@ toc_tlbie_lock:
         .tc     native_tlbie_lock[TC],native_tlbie_lock
         .previous
         ld      r3,toc_tlbie_lock@toc(2)
+#ifdef __BIG_ENDIAN__
         lwz     r8,PACA_LOCK_TOKEN(r13)
+#else
+        lwz     r8,PACAPACAINDEX(r13)
+#endif
 24:     lwarx   r0,0,r3
         cmpwi   r0,0
         bne     24b
@@ -964,7 +972,11 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_201)
 32:     ld      r4,VCPU_KVM(r9)         /* pointer to struct kvm */
 
         /* Take the guest's tlbie_lock */
+#ifdef __BIG_ENDIAN__
         lwz     r8,PACA_LOCK_TOKEN(r13)
+#else
+        lwz     r8,PACAPACAINDEX(r13)
+#endif
         addi    r3,r4,KVM_TLBIE_LOCK
 24:     lwarx   r0,0,r3
         cmpwi   r0,0
@@ -1381,7 +1393,7 @@ hcall_try_real_mode:
         cmpldi  r3,hcall_real_table_end - hcall_real_table
         bge     guest_exit_cont
         LOAD_REG_ADDR(r4, hcall_real_table)
-        lwzx    r3,r3,r4
+        lwax    r3,r3,r4
         cmpwi   r3,0
         beq     guest_exit_cont
         add     r3,r3,r4
diff --git a/arch/powerpc/kvm/book3s_interrupts.S b/arch/powerpc/kvm/book3s_interrupts.S
index 48cbbf862958..17cfae5497a3 100644
--- a/arch/powerpc/kvm/book3s_interrupts.S
+++ b/arch/powerpc/kvm/book3s_interrupts.S
@@ -92,6 +92,11 @@ kvm_start_lightweight:
         PPC_LL  r3, VCPU_HFLAGS(r4)
         rldicl  r3, r3, 0, 63           /* r3 &= 1 */
         stb     r3, HSTATE_RESTORE_HID5(r13)
+
+        /* Load up guest SPRG3 value, since it's user readable */
+        ld      r3, VCPU_SHARED(r4)
+        ld      r3, VCPU_SHARED_SPRG3(r3)
+        mtspr   SPRN_SPRG3, r3
 #endif /* CONFIG_PPC_BOOK3S_64 */
 
         PPC_LL  r4, VCPU_SHADOW_MSR(r4) /* get shadow_msr */
@@ -123,6 +128,15 @@ kvmppc_handler_highmem:
         /* R7 = vcpu */
         PPC_LL  r7, GPR4(r1)
 
+#ifdef CONFIG_PPC_BOOK3S_64
+        /*
+         * Reload kernel SPRG3 value.
+         * No need to save guest value as usermode can't modify SPRG3.
+         */
+        ld      r3, PACA_SPRG3(r13)
+        mtspr   SPRN_SPRG3, r3
+#endif /* CONFIG_PPC_BOOK3S_64 */
+
         PPC_STL r14, VCPU_GPR(R14)(r7)
         PPC_STL r15, VCPU_GPR(R15)(r7)
         PPC_STL r16, VCPU_GPR(R16)(r7)
diff --git a/arch/powerpc/kvm/book3s_pr.c b/arch/powerpc/kvm/book3s_pr.c
index 19498a567a81..27db1e665959 100644
--- a/arch/powerpc/kvm/book3s_pr.c
+++ b/arch/powerpc/kvm/book3s_pr.c
@@ -468,7 +468,8 @@ void kvmppc_giveup_ext(struct kvm_vcpu *vcpu, ulong msr)
                  * both the traditional FP registers and the added VSX
                  * registers into thread.fpr[].
                  */
-                giveup_fpu(current);
+                if (current->thread.regs->msr & MSR_FP)
+                        giveup_fpu(current);
                 for (i = 0; i < ARRAY_SIZE(vcpu->arch.fpr); i++)
                         vcpu_fpr[i] = thread_fpr[get_fpr_index(i)];
 
@@ -483,7 +484,8 @@ void kvmppc_giveup_ext(struct kvm_vcpu *vcpu, ulong msr)
 
 #ifdef CONFIG_ALTIVEC
         if (msr & MSR_VEC) {
-                giveup_altivec(current);
+                if (current->thread.regs->msr & MSR_VEC)
+                        giveup_altivec(current);
                 memcpy(vcpu->arch.vr, t->vr, sizeof(vcpu->arch.vr));
                 vcpu->arch.vscr = t->vscr;
         }
@@ -575,8 +577,6 @@ static int kvmppc_handle_ext(struct kvm_vcpu *vcpu, unsigned int exit_nr,
         printk(KERN_INFO "Loading up ext 0x%lx\n", msr);
 #endif
 
-        current->thread.regs->msr |= msr;
-
         if (msr & MSR_FP) {
                 for (i = 0; i < ARRAY_SIZE(vcpu->arch.fpr); i++)
                         thread_fpr[get_fpr_index(i)] = vcpu_fpr[i];
@@ -598,12 +598,32 @@ static int kvmppc_handle_ext(struct kvm_vcpu *vcpu, unsigned int exit_nr,
 #endif
         }
 
+        current->thread.regs->msr |= msr;
         vcpu->arch.guest_owned_ext |= msr;
         kvmppc_recalc_shadow_msr(vcpu);
 
         return RESUME_GUEST;
 }
 
+/*
+ * Kernel code using FP or VMX could have flushed guest state to
+ * the thread_struct; if so, get it back now.
+ */
+static void kvmppc_handle_lost_ext(struct kvm_vcpu *vcpu)
+{
+        unsigned long lost_ext;
+
+        lost_ext = vcpu->arch.guest_owned_ext & ~current->thread.regs->msr;
+        if (!lost_ext)
+                return;
+
+        if (lost_ext & MSR_FP)
+                kvmppc_load_up_fpu();
+        if (lost_ext & MSR_VEC)
+                kvmppc_load_up_altivec();
+        current->thread.regs->msr |= lost_ext;
+}
+
 int kvmppc_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu,
                        unsigned int exit_nr)
 {
@@ -772,7 +792,7 @@ program_interrupt:
         }
         case BOOK3S_INTERRUPT_SYSCALL:
                 if (vcpu->arch.papr_enabled &&
-                    (kvmppc_get_last_inst(vcpu) == 0x44000022) &&
+                    (kvmppc_get_last_sc(vcpu) == 0x44000022) &&
                     !(vcpu->arch.shared->msr & MSR_PR)) {
                         /* SC 1 papr hypercalls */
                         ulong cmd = kvmppc_get_gpr(vcpu, 3);
@@ -890,8 +910,9 @@ program_interrupt:
                         local_irq_enable();
                         r = s;
                 } else {
-                        kvmppc_lazy_ee_enable();
+                        kvmppc_fix_ee_before_entry();
                 }
+                kvmppc_handle_lost_ext(vcpu);
         }
 
         trace_kvm_book3s_reenter(r, vcpu);
@@ -1047,11 +1068,12 @@ struct kvm_vcpu *kvmppc_core_vcpu_create(struct kvm *kvm, unsigned int id)
         if (err)
                 goto free_shadow_vcpu;
 
+        err = -ENOMEM;
         p = __get_free_page(GFP_KERNEL|__GFP_ZERO);
-        /* the real shared page fills the last 4k of our page */
-        vcpu->arch.shared = (void*)(p + PAGE_SIZE - 4096);
         if (!p)
                 goto uninit_vcpu;
+        /* the real shared page fills the last 4k of our page */
+        vcpu->arch.shared = (void *)(p + PAGE_SIZE - 4096);
 
 #ifdef CONFIG_PPC_BOOK3S_64
         /* default to book3s_64 (970fx) */
@@ -1161,7 +1183,7 @@ int kvmppc_vcpu_run(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
         if (vcpu->arch.shared->msr & MSR_FP)
                 kvmppc_handle_ext(vcpu, BOOK3S_INTERRUPT_FP_UNAVAIL, MSR_FP);
 
-        kvmppc_lazy_ee_enable();
+        kvmppc_fix_ee_before_entry();
 
         ret = __kvmppc_vcpu_run(kvm_run, vcpu);
 
diff --git a/arch/powerpc/kvm/book3s_xics.c b/arch/powerpc/kvm/book3s_xics.c
index 94c1dd46b83d..a3a5cb8ee7ea 100644
--- a/arch/powerpc/kvm/book3s_xics.c
+++ b/arch/powerpc/kvm/book3s_xics.c
@@ -19,6 +19,7 @@
 #include <asm/hvcall.h>
 #include <asm/xics.h>
 #include <asm/debug.h>
+#include <asm/time.h>
 
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c
index dcc94f016007..17722d82f1d1 100644
--- a/arch/powerpc/kvm/booke.c
+++ b/arch/powerpc/kvm/booke.c
@@ -674,8 +674,6 @@ int kvmppc_vcpu_run(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
                 goto out;
         }
 
-        kvm_guest_enter();
-
 #ifdef CONFIG_PPC_FPU
         /* Save userspace FPU state in stack */
         enable_kernel_fp();
@@ -698,7 +696,7 @@ int kvmppc_vcpu_run(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
         kvmppc_load_guest_fp(vcpu);
 #endif
 
-        kvmppc_lazy_ee_enable();
+        kvmppc_fix_ee_before_entry();
 
         ret = __kvmppc_vcpu_run(kvm_run, vcpu);
 
@@ -1168,7 +1166,7 @@ int kvmppc_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu,
                         local_irq_enable();
                         r = (s << 2) | RESUME_HOST | (r & RESUME_FLAG_NV);
                 } else {
-                        kvmppc_lazy_ee_enable();
+                        kvmppc_fix_ee_before_entry();
                 }
         }
 
diff --git a/arch/powerpc/kvm/emulate.c b/arch/powerpc/kvm/emulate.c
index 2c52ada30775..751cd45f65a0 100644
--- a/arch/powerpc/kvm/emulate.c
+++ b/arch/powerpc/kvm/emulate.c
@@ -30,53 +30,10 @@
 #include <asm/byteorder.h>
 #include <asm/kvm_ppc.h>
 #include <asm/disassemble.h>
+#include <asm/ppc-opcode.h>
 #include "timing.h"
 #include "trace.h"
 
-#define OP_TRAP 3
-#define OP_TRAP_64 2
-
-#define OP_31_XOP_TRAP      4
-#define OP_31_XOP_LWZX      23
-#define OP_31_XOP_DCBST     54
-#define OP_31_XOP_TRAP_64   68
-#define OP_31_XOP_DCBF      86
-#define OP_31_XOP_LBZX      87
-#define OP_31_XOP_STWX      151
-#define OP_31_XOP_STBX      215
-#define OP_31_XOP_LBZUX     119
-#define OP_31_XOP_STBUX     247
-#define OP_31_XOP_LHZX      279
-#define OP_31_XOP_LHZUX     311
-#define OP_31_XOP_MFSPR     339
-#define OP_31_XOP_LHAX      343
-#define OP_31_XOP_STHX      407
-#define OP_31_XOP_STHUX     439
-#define OP_31_XOP_MTSPR     467
-#define OP_31_XOP_DCBI      470
-#define OP_31_XOP_LWBRX     534
-#define OP_31_XOP_TLBSYNC   566
-#define OP_31_XOP_STWBRX    662
-#define OP_31_XOP_LHBRX     790
-#define OP_31_XOP_STHBRX    918
-
-#define OP_LWZ  32
-#define OP_LD   58
-#define OP_LWZU 33
-#define OP_LBZ  34
-#define OP_LBZU 35
-#define OP_STW  36
-#define OP_STWU 37
-#define OP_STD  62
-#define OP_STB  38
-#define OP_STBU 39
-#define OP_LHZ  40
-#define OP_LHZU 41
-#define OP_LHA  42
-#define OP_LHAU 43
-#define OP_STH  44
-#define OP_STHU 45
-
 void kvmppc_emulate_dec(struct kvm_vcpu *vcpu)
 {
         unsigned long dec_nsec;
diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
index 6316ee336e88..07c0106fab76 100644
--- a/arch/powerpc/kvm/powerpc.c
+++ b/arch/powerpc/kvm/powerpc.c
@@ -117,8 +117,6 @@ int kvmppc_prepare_to_enter(struct kvm_vcpu *vcpu)
                         kvm_guest_exit();
                         continue;
                 }
-
-                trace_hardirqs_on();
 #endif
 
                 kvm_guest_enter();
@@ -420,6 +418,10 @@ int kvm_arch_create_memslot(struct kvm_memory_slot *slot, unsigned long npages)
         return kvmppc_core_create_memslot(slot, npages);
 }
 
+void kvm_arch_memslots_updated(struct kvm *kvm)
+{
+}
+
 int kvm_arch_prepare_memory_region(struct kvm *kvm,
                                    struct kvm_memory_slot *memslot,
                                    struct kvm_userspace_memory_region *mem,
@@ -823,39 +825,39 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu,
 #endif
 #ifdef CONFIG_KVM_MPIC
         case KVM_CAP_IRQ_MPIC: {
-                struct file *filp;
+                struct fd f;
                 struct kvm_device *dev;
 
                 r = -EBADF;
-                filp = fget(cap->args[0]);
-                if (!filp)
+                f = fdget(cap->args[0]);
+                if (!f.file)
                         break;
 
                 r = -EPERM;
-                dev = kvm_device_from_filp(filp);
+                dev = kvm_device_from_filp(f.file);
                 if (dev)
                         r = kvmppc_mpic_connect_vcpu(dev, vcpu, cap->args[1]);
 
-                fput(filp);
+                fdput(f);
                 break;
         }
 #endif
 #ifdef CONFIG_KVM_XICS
         case KVM_CAP_IRQ_XICS: {
-                struct file *filp;
+                struct fd f;
                 struct kvm_device *dev;
 
                 r = -EBADF;
-                filp = fget(cap->args[0]);
-                if (!filp)
+                f = fdget(cap->args[0]);
+                if (!f.file)
                         break;
 
                 r = -EPERM;
-                dev = kvm_device_from_filp(filp);
+                dev = kvm_device_from_filp(f.file);
                 if (dev)
                         r = kvmppc_xics_connect_vcpu(dev, vcpu, cap->args[1]);
 
-                fput(filp);
+                fdput(f);
                 break;
         }
 #endif /* CONFIG_KVM_XICS */
diff --git a/arch/powerpc/lib/locks.c b/arch/powerpc/lib/locks.c
index bb7cfecf2788..0c9c8d7d0734 100644
--- a/arch/powerpc/lib/locks.c
+++ b/arch/powerpc/lib/locks.c
@@ -32,7 +32,7 @@ void __spin_yield(arch_spinlock_t *lock)
                 return;
         holder_cpu = lock_value & 0xffff;
         BUG_ON(holder_cpu >= NR_CPUS);
-        yield_count = lppaca_of(holder_cpu).yield_count;
+        yield_count = be32_to_cpu(lppaca_of(holder_cpu).yield_count);
         if ((yield_count & 1) == 0)
                 return;         /* virtual cpu is currently running */
         rmb();
@@ -57,7 +57,7 @@ void __rw_yield(arch_rwlock_t *rw)
                 return;         /* no write lock at present */
         holder_cpu = lock_value & 0xffff;
         BUG_ON(holder_cpu >= NR_CPUS);
-        yield_count = lppaca_of(holder_cpu).yield_count;
+        yield_count = be32_to_cpu(lppaca_of(holder_cpu).yield_count);
         if ((yield_count & 1) == 0)
                 return;         /* virtual cpu is currently running */
         rmb();
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index 99c7fc16dc0d..a7ee978fb860 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -100,8 +100,10 @@ static unsigned long __kprobes dform_ea(unsigned int instr, struct pt_regs *regs
         ea = (signed short) instr;              /* sign-extend */
         if (ra) {
                 ea += regs->gpr[ra];
-                if (instr & 0x04000000)         /* update forms */
-                        regs->gpr[ra] = ea;
+                if (instr & 0x04000000) {               /* update forms */
+                        if ((instr>>26) != 47)          /* stmw is not an update form */
+                                regs->gpr[ra] = ea;
+                }
         }
 
         return truncate_if_32bit(regs->msr, ea);
@@ -279,7 +281,7 @@ static int __kprobes write_mem_unaligned(unsigned long val, unsigned long ea,
                 err = write_mem_aligned(val >> (nb - c) * 8, ea, c);
                 if (err)
                         return err;
-                ++ea;
+                ea += c;
         }
         return 0;
 }
diff --git a/arch/powerpc/math-emu/Makefile b/arch/powerpc/math-emu/Makefile
index 8d035d2d42a6..1b46ab4f6417 100644
--- a/arch/powerpc/math-emu/Makefile
+++ b/arch/powerpc/math-emu/Makefile
@@ -1,15 +1,15 @@
-
-obj-$(CONFIG_MATH_EMULATION)    += fabs.o fadd.o fadds.o fcmpo.o fcmpu.o \
-                                        fctiw.o fctiwz.o fdiv.o fdivs.o \
-                                        fmadd.o fmadds.o fmsub.o fmsubs.o \
-                                        fmul.o fmuls.o fnabs.o fneg.o \
-                                        fnmadd.o fnmadds.o fnmsub.o fnmsubs.o \
-                                        fres.o fre.o frsp.o fsel.o lfs.o \
-                                        frsqrte.o frsqrtes.o \
-                                        fsqrt.o fsqrts.o fsub.o fsubs.o \
-                                        mcrfs.o mffs.o mtfsb0.o mtfsb1.o \
-                                        mtfsf.o mtfsfi.o stfiwx.o stfs.o \
-                                        math.o fmr.o lfd.o stfd.o
+math-emu-common-objs = math.o fre.o fsqrt.o fsqrts.o frsqrtes.o mtfsf.o mtfsfi.o
+obj-$(CONFIG_MATH_EMULATION_HW_UNIMPLEMENTED) += $(math-emu-common-objs)
+obj-$(CONFIG_MATH_EMULATION_FULL) += $(math-emu-common-objs) fabs.o fadd.o \
+                                        fadds.o fcmpo.o fcmpu.o fctiw.o \
+                                        fctiwz.o fdiv.o fdivs.o  fmadd.o \
+                                        fmadds.o fmsub.o fmsubs.o fmul.o \
+                                        fmuls.o fnabs.o fneg.o fnmadd.o \
+                                        fnmadds.o fnmsub.o fnmsubs.o fres.o \
+                                        frsp.o fsel.o lfs.o frsqrte.o fsub.o \
+                                        fsubs.o  mcrfs.o mffs.o mtfsb0.o \
+                                        mtfsb1.o stfiwx.o stfs.o math.o \
+                                        fmr.o lfd.o stfd.o
 
 obj-$(CONFIG_SPE)               += math_efp.o
 
diff --git a/arch/powerpc/math-emu/math.c b/arch/powerpc/math-emu/math.c
index 0328e66e0799..ab151f040502 100644
--- a/arch/powerpc/math-emu/math.c
+++ b/arch/powerpc/math-emu/math.c
@@ -7,12 +7,27 @@
 
 #include <asm/uaccess.h>
 #include <asm/reg.h>
+#include <asm/switch_to.h>
 
 #include <asm/sfp-machine.h>
 #include <math-emu/double.h>
 
 #define FLOATFUNC(x)    extern int x(void *, void *, void *, void *)
 
+/* The instructions list which may be not implemented by a hardware FPU */
+FLOATFUNC(fre);
+FLOATFUNC(frsqrtes);
+FLOATFUNC(fsqrt);
+FLOATFUNC(fsqrts);
+FLOATFUNC(mtfsf);
+FLOATFUNC(mtfsfi);
+
+#ifdef CONFIG_MATH_EMULATION_HW_UNIMPLEMENTED
+#undef FLOATFUNC(x)
+#define FLOATFUNC(x)    static inline int x(void *op1, void *op2, void *op3, \
+                                                 void *op4) { }
+#endif
+
 FLOATFUNC(fadd);
 FLOATFUNC(fadds);
 FLOATFUNC(fdiv);
@@ -42,8 +57,6 @@ FLOATFUNC(mcrfs);
 FLOATFUNC(mffs);
 FLOATFUNC(mtfsb0);
 FLOATFUNC(mtfsb1);
-FLOATFUNC(mtfsf);
-FLOATFUNC(mtfsfi);
 
 FLOATFUNC(lfd);
 FLOATFUNC(lfs);
@@ -58,13 +71,9 @@ FLOATFUNC(fnabs);
 FLOATFUNC(fneg);
 
 /* Optional */
-FLOATFUNC(fre);
 FLOATFUNC(fres);
 FLOATFUNC(frsqrte);
-FLOATFUNC(frsqrtes);
 FLOATFUNC(fsel);
-FLOATFUNC(fsqrt);
-FLOATFUNC(fsqrts);
 
 
 #define OP31            0x1f            /*   31 */
@@ -154,7 +163,6 @@ FLOATFUNC(fsqrts);
 #define XEU     15
 #define XFLB    10
 
-#ifdef CONFIG_MATH_EMULATION
 static int
 record_exception(struct pt_regs *regs, int eflag)
 {
@@ -212,7 +220,6 @@ record_exception(struct pt_regs *regs, int eflag)
 
         return (fpscr & FPSCR_FEX) ? 1 : 0;
 }
-#endif /* CONFIG_MATH_EMULATION */
 
 int
 do_mathemu(struct pt_regs *regs)
@@ -222,56 +229,13 @@ do_mathemu(struct pt_regs *regs)
         signed short sdisp;
         u32 insn = 0;
         int idx = 0;
-#ifdef CONFIG_MATH_EMULATION
         int (*func)(void *, void *, void *, void *);
         int type = 0;
         int eflag, trap;
-#endif
 
         if (get_user(insn, (u32 *)pc))
                 return -EFAULT;
 
-#ifndef CONFIG_MATH_EMULATION
-        switch (insn >> 26) {
-        case LFD:
-                idx = (insn >> 16) & 0x1f;
-                sdisp = (insn & 0xffff);
-                op0 = (void *)&current->thread.TS_FPR((insn >> 21) & 0x1f);
-                op1 = (void *)((idx ? regs->gpr[idx] : 0) + sdisp);
-                lfd(op0, op1, op2, op3);
-                break;
-        case LFDU:
-                idx = (insn >> 16) & 0x1f;
-                sdisp = (insn & 0xffff);
-                op0 = (void *)&current->thread.TS_FPR((insn >> 21) & 0x1f);
-                op1 = (void *)((idx ? regs->gpr[idx] : 0) + sdisp);
-                lfd(op0, op1, op2, op3);
-                regs->gpr[idx] = (unsigned long)op1;
-                break;
-        case STFD:
-                idx = (insn >> 16) & 0x1f;
-                sdisp = (insn & 0xffff);
-                op0 = (void *)&current->thread.TS_FPR((insn >> 21) & 0x1f);
-                op1 = (void *)((idx ? regs->gpr[idx] : 0) + sdisp);
-                stfd(op0, op1, op2, op3);
-                break;
-        case STFDU:
-                idx = (insn >> 16) & 0x1f;
-                sdisp = (insn & 0xffff);
-                op0 = (void *)&current->thread.TS_FPR((insn >> 21) & 0x1f);
-                op1 = (void *)((idx ? regs->gpr[idx] : 0) + sdisp);
-                stfd(op0, op1, op2, op3);
-                regs->gpr[idx] = (unsigned long)op1;
-                break;
-        case OP63:
-                op0 = (void *)&current->thread.TS_FPR((insn >> 21) & 0x1f);
-                op1 = (void *)&current->thread.TS_FPR((insn >> 11) & 0x1f);
-                fmr(op0, op1, op2, op3);
-                break;
-        default:
-                goto illegal;
-        }
-#else /* CONFIG_MATH_EMULATION */
         switch (insn >> 26) {
         case LFS:       func = lfs;     type = D;       break;
         case LFSU:      func = lfs;     type = DU;      break;
@@ -416,21 +380,16 @@ do_mathemu(struct pt_regs *regs)
         case XE:
                 idx = (insn >> 16) & 0x1f;
                 op0 = (void *)&current->thread.TS_FPR((insn >> 21) & 0x1f);
-                if (!idx) {
-                        if (((insn >> 1) & 0x3ff) == STFIWX)
-                                op1 = (void *)(regs->gpr[(insn >> 11) & 0x1f]);
-                        else
-                                goto illegal;
-                } else {
-                        op1 = (void *)(regs->gpr[idx] + regs->gpr[(insn >> 11) & 0x1f]);
-                }
-
+                op1 = (void *)((idx ? regs->gpr[idx] : 0)
+                                + regs->gpr[(insn >> 11) & 0x1f]);
                 break;
 
         case XEU:
                 idx = (insn >> 16) & 0x1f;
+                if (!idx)
+                        goto illegal;
                 op0 = (void *)&current->thread.TS_FPR((insn >> 21) & 0x1f);
-                op1 = (void *)((idx ? regs->gpr[idx] : 0)
+                op1 = (void *)(regs->gpr[idx]
                                 + regs->gpr[(insn >> 11) & 0x1f]);
                 break;
 
@@ -465,6 +424,13 @@ do_mathemu(struct pt_regs *regs)
                 goto illegal;
         }
 
+        /*
+         * If we support a HW FPU, we need to ensure the FP state
+         * is flushed into the thread_struct before attempting
+         * emulation
+         */
+        flush_fp_to_thread(current);
+
         eflag = func(op0, op1, op2, op3);
 
         if (insn & 1) {
@@ -485,7 +451,6 @@ do_mathemu(struct pt_regs *regs)
         default:
                 break;
         }
-#endif /* CONFIG_MATH_EMULATION */
 
         regs->nip += 4;
         return 0;
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 8726779e1409..76d8e7cc7805 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -443,8 +443,12 @@ good_area:
                                       regs, address);
 #ifdef CONFIG_PPC_SMLPAR
                         if (firmware_has_feature(FW_FEATURE_CMO)) {
+                                u32 page_ins;
+
                                 preempt_disable();
-                                get_lppaca()->page_ins += (1 << PAGE_FACTOR);
+                                page_ins = be32_to_cpu(get_lppaca()->page_ins);
+                                page_ins += 1 << PAGE_FACTOR;
+                                get_lppaca()->page_ins = cpu_to_be32(page_ins);
                                 preempt_enable();
                         }
 #endif /* CONFIG_PPC_SMLPAR */
diff --git a/arch/powerpc/mm/gup.c b/arch/powerpc/mm/gup.c
index 49822d90ea96..6936547018b8 100644
--- a/arch/powerpc/mm/gup.c
+++ b/arch/powerpc/mm/gup.c
@@ -117,8 +117,8 @@ static int gup_pud_range(pgd_t pgd, unsigned long addr, unsigned long end,
         return 1;
 }
 
-int get_user_pages_fast(unsigned long start, int nr_pages, int write,
-                        struct page **pages)
+int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
+                          struct page **pages)
 {
         struct mm_struct *mm = current->mm;
         unsigned long addr, len, end;
@@ -135,7 +135,7 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
 
         if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
                                         start, len)))
-                goto slow_irqon;
+                return 0;
 
         pr_devel("  aligned: %lx .. %lx\n", start, end);
 
@@ -166,30 +166,35 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
                          (void *)pgd_val(pgd));
                 next = pgd_addr_end(addr, end);
                 if (pgd_none(pgd))
-                        goto slow;
+                        break;
                 if (pgd_huge(pgd)) {
                         if (!gup_hugepte((pte_t *)pgdp, PGDIR_SIZE, addr, next,
                                          write, pages, &nr))
-                                goto slow;
+                                break;
                 } else if (is_hugepd(pgdp)) {
                         if (!gup_hugepd((hugepd_t *)pgdp, PGDIR_SHIFT,
                                         addr, next, write, pages, &nr))
-                                goto slow;
+                                break;
                 } else if (!gup_pud_range(pgd, addr, next, write, pages, &nr))
-                        goto slow;
+                        break;
         } while (pgdp++, addr = next, addr != end);
 
         local_irq_enable();
 
-        VM_BUG_ON(nr != (end - start) >> PAGE_SHIFT);
         return nr;
+}
 
-        {
-                int ret;
+int get_user_pages_fast(unsigned long start, int nr_pages, int write,
+                        struct page **pages)
+{
+        struct mm_struct *mm = current->mm;
+        int nr, ret;
+
+        start &= PAGE_MASK;
+        nr = __get_user_pages_fast(start, nr_pages, write, pages);
+        ret = nr;
 
-slow:
-                local_irq_enable();
-slow_irqon:
+        if (nr < nr_pages) {
                 pr_devel("  slow path ! nr = %d\n", nr);
 
                 /* Try to get the remaining pages with get_user_pages */
@@ -198,7 +203,7 @@ slow_irqon:
 
                 down_read(&mm->mmap_sem);
                 ret = get_user_pages(current, mm, start,
-                        (end - start) >> PAGE_SHIFT, write, 0, pages, NULL);
+                                     nr_pages - nr, write, 0, pages, NULL);
                 up_read(&mm->mmap_sem);
 
                 /* Have to be a bit careful with return values */
@@ -208,9 +213,9 @@ slow_irqon:
                         else
                                 ret += nr;
                 }
-
-                return ret;
         }
+
+        return ret;
 }
 
 #endif /* __HAVE_ARCH_PTE_SPECIAL */
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index 6ecc38bd5b24..bde8b5589755 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -907,7 +907,7 @@ static int subpage_protection(struct mm_struct *mm, unsigned long ea)
 
         if (ea >= spt->maxaddr)
                 return 0;
-        if (ea < 0x100000000) {
+        if (ea < 0x100000000UL) {
                 /* addresses below 4GB use spt->low_prot */
                 sbpm = spt->low_prot;
         } else {
diff --git a/arch/powerpc/mm/init_32.c b/arch/powerpc/mm/init_32.c
index 01e2db97a210..d47d3dab4870 100644
--- a/arch/powerpc/mm/init_32.c
+++ b/arch/powerpc/mm/init_32.c
@@ -52,7 +52,7 @@
 #if defined(CONFIG_KERNEL_START_BOOL) || defined(CONFIG_LOWMEM_SIZE_BOOL)
 /* The amount of lowmem must be within 0xF0000000 - KERNELBASE. */
 #if (CONFIG_LOWMEM_SIZE > (0xF0000000 - PAGE_OFFSET))
-#error "You must adjust CONFIG_LOWMEM_SIZE or CONFIG_START_KERNEL"
+#error "You must adjust CONFIG_LOWMEM_SIZE or CONFIG_KERNEL_START"
 #endif
 #endif
 #define MAX_LOW_MEM     CONFIG_LOWMEM_SIZE
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index 7f4bea162026..1cf9c5b67f24 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -514,7 +514,7 @@ static int add_system_ram_resources(void)
                         res->name = "System RAM";
                         res->start = base;
                         res->end = base + size - 1;
-                        res->flags = IORESOURCE_MEM;
+                        res->flags = IORESOURCE_MEM | IORESOURCE_BUSY;
                         WARN_ON(request_resource(&iomem_resource, res) < 0);
                 }
         }
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 5850798826cd..c916127f10c3 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -58,7 +58,7 @@ static int form1_affinity;
 
 #define MAX_DISTANCE_REF_POINTS 4
 static int distance_ref_points_depth;
-static const unsigned int *distance_ref_points;
+static const __be32 *distance_ref_points;
 static int distance_lookup_table[MAX_NUMNODES][MAX_DISTANCE_REF_POINTS];
 
 /*
@@ -179,7 +179,7 @@ static void unmap_cpu_from_node(unsigned long cpu)
 #endif /* CONFIG_HOTPLUG_CPU || CONFIG_PPC_SPLPAR */
 
 /* must hold reference to node during call */
-static const int *of_get_associativity(struct device_node *dev)
+static const __be32 *of_get_associativity(struct device_node *dev)
 {
         return of_get_property(dev, "ibm,associativity", NULL);
 }
@@ -189,9 +189,9 @@ static const int *of_get_associativity(struct device_node *dev)
  * it exists (the property exists only in kexec/kdump kernels,
  * added by kexec-tools)
  */
-static const u32 *of_get_usable_memory(struct device_node *memory)
+static const __be32 *of_get_usable_memory(struct device_node *memory)
 {
-        const u32 *prop;
+        const __be32 *prop;
         u32 len;
         prop = of_get_property(memory, "linux,drconf-usable-memory", &len);
         if (!prop || len < sizeof(unsigned int))
@@ -219,7 +219,7 @@ int __node_distance(int a, int b)
 }
 
 static void initialize_distance_lookup_table(int nid,
-                const unsigned int *associativity)
+                const __be32 *associativity)
 {
         int i;
 
@@ -227,29 +227,32 @@ static void initialize_distance_lookup_table(int nid,
                 return;
 
         for (i = 0; i < distance_ref_points_depth; i++) {
-                distance_lookup_table[nid][i] =
-                        associativity[distance_ref_points[i]];
+                const __be32 *entry;
+
+                entry = &associativity[be32_to_cpu(distance_ref_points[i])];
+                distance_lookup_table[nid][i] = of_read_number(entry, 1);
         }
 }
 
 /* Returns nid in the range [0..MAX_NUMNODES-1], or -1 if no useful numa
  * info is found.
  */
-static int associativity_to_nid(const unsigned int *associativity)
+static int associativity_to_nid(const __be32 *associativity)
 {
         int nid = -1;
 
         if (min_common_depth == -1)
                 goto out;
 
-        if (associativity[0] >= min_common_depth)
-                nid = associativity[min_common_depth];
+        if (of_read_number(associativity, 1) >= min_common_depth)
+                nid = of_read_number(&associativity[min_common_depth], 1);
 
         /* POWER4 LPAR uses 0xffff as invalid node */
         if (nid == 0xffff || nid >= MAX_NUMNODES)
                 nid = -1;
 
-        if (nid > 0 && associativity[0] >= distance_ref_points_depth)
+        if (nid > 0 &&
+            of_read_number(associativity, 1) >= distance_ref_points_depth)
                 initialize_distance_lookup_table(nid, associativity);
 
 out:
@@ -262,7 +265,7 @@ out:
 static int of_node_to_nid_single(struct device_node *device)
 {
         int nid = -1;
-        const unsigned int *tmp;
+        const __be32 *tmp;
 
         tmp = of_get_associativity(device);
         if (tmp)
@@ -334,7 +337,7 @@ static int __init find_min_common_depth(void)
         }
 
         if (form1_affinity) {
-                depth = distance_ref_points[0];
+                depth = of_read_number(distance_ref_points, 1);
         } else {
                 if (distance_ref_points_depth < 2) {
                         printk(KERN_WARNING "NUMA: "
@@ -342,7 +345,7 @@ static int __init find_min_common_depth(void)
                         goto err;
                 }
 
-                depth = distance_ref_points[1];
+                depth = of_read_number(&distance_ref_points[1], 1);
         }
 
         /*
@@ -376,12 +379,12 @@ static void __init get_n_mem_cells(int *n_addr_cells, int *n_size_cells)
         of_node_put(memory);
 }
 
-static unsigned long read_n_cells(int n, const unsigned int **buf)
+static unsigned long read_n_cells(int n, const __be32 **buf)
 {
         unsigned long result = 0;
 
         while (n--) {
-                result = (result << 32) | **buf;
+                result = (result << 32) | of_read_number(*buf, 1);
                 (*buf)++;
         }
         return result;
@@ -391,17 +394,17 @@ static unsigned long read_n_cells(int n, const unsigned int **buf)
  * Read the next memblock list entry from the ibm,dynamic-memory property
  * and return the information in the provided of_drconf_cell structure.
  */
-static void read_drconf_cell(struct of_drconf_cell *drmem, const u32 **cellp)
+static void read_drconf_cell(struct of_drconf_cell *drmem, const __be32 **cellp)
 {
-        const u32 *cp;
+        const __be32 *cp;
 
         drmem->base_addr = read_n_cells(n_mem_addr_cells, cellp);
 
         cp = *cellp;
-        drmem->drc_index = cp[0];
-        drmem->reserved = cp[1];
-        drmem->aa_index = cp[2];
-        drmem->flags = cp[3];
+        drmem->drc_index = of_read_number(cp, 1);
+        drmem->reserved = of_read_number(&cp[1], 1);
+        drmem->aa_index = of_read_number(&cp[2], 1);
+        drmem->flags = of_read_number(&cp[3], 1);
 
         *cellp = cp + 4;
 }
@@ -413,16 +416,16 @@ static void read_drconf_cell(struct of_drconf_cell *drmem, const u32 **cellp)
  * list entries followed by N memblock list entries.  Each memblock list entry
  * contains information as laid out in the of_drconf_cell struct above.
  */
-static int of_get_drconf_memory(struct device_node *memory, const u32 **dm)
+static int of_get_drconf_memory(struct device_node *memory, const __be32 **dm)
 {
-        const u32 *prop;
+        const __be32 *prop;
         u32 len, entries;
 
         prop = of_get_property(memory, "ibm,dynamic-memory", &len);
         if (!prop || len < sizeof(unsigned int))
                 return 0;
 
-        entries = *prop++;
+        entries = of_read_number(prop++, 1);
 
         /* Now that we know the number of entries, revalidate the size
          * of the property read in to ensure we have everything
@@ -440,7 +443,7 @@ static int of_get_drconf_memory(struct device_node *memory, const u32 **dm)
  */
 static u64 of_get_lmb_size(struct device_node *memory)
 {
-        const u32 *prop;
+        const __be32 *prop;
         u32 len;
 
         prop = of_get_property(memory, "ibm,lmb-size", &len);
@@ -453,7 +456,7 @@ static u64 of_get_lmb_size(struct device_node *memory)
 struct assoc_arrays {
         u32     n_arrays;
         u32     array_sz;
-        const u32 *arrays;
+        const __be32 *arrays;
 };
 
 /*
@@ -469,15 +472,15 @@ struct assoc_arrays {
 static int of_get_assoc_arrays(struct device_node *memory,
                                struct assoc_arrays *aa)
 {
-        const u32 *prop;
+        const __be32 *prop;
         u32 len;
 
         prop = of_get_property(memory, "ibm,associativity-lookup-arrays", &len);
         if (!prop || len < 2 * sizeof(unsigned int))
                 return -1;
 
-        aa->n_arrays = *prop++;
-        aa->array_sz = *prop++;
+        aa->n_arrays = of_read_number(prop++, 1);
+        aa->array_sz = of_read_number(prop++, 1);
 
         /* Now that we know the number of arrays and size of each array,
          * revalidate the size of the property read in.
@@ -504,7 +507,7 @@ static int of_drconf_to_nid_single(struct of_drconf_cell *drmem,
             !(drmem->flags & DRCONF_MEM_AI_INVALID) &&
             drmem->aa_index < aa->n_arrays) {
                 index = drmem->aa_index * aa->array_sz + min_common_depth - 1;
-                nid = aa->arrays[index];
+                nid = of_read_number(&aa->arrays[index], 1);
 
                 if (nid == 0xffff || nid >= MAX_NUMNODES)
                         nid = default_nid;
@@ -595,7 +598,7 @@ static unsigned long __init numa_enforce_memory_limit(unsigned long start,
  * Reads the counter for a given entry in
  * linux,drconf-usable-memory property
  */
-static inline int __init read_usm_ranges(const u32 **usm)
+static inline int __init read_usm_ranges(const __be32 **usm)
 {
         /*
          * For each lmb in ibm,dynamic-memory a corresponding
@@ -612,7 +615,7 @@ static inline int __init read_usm_ranges(const u32 **usm)
  */
 static void __init parse_drconf_memory(struct device_node *memory)
 {
-        const u32 *uninitialized_var(dm), *usm;
+        const __be32 *uninitialized_var(dm), *usm;
         unsigned int n, rc, ranges, is_kexec_kdump = 0;
         unsigned long lmb_size, base, size, sz;
         int nid;
@@ -721,7 +724,7 @@ static int __init parse_numa_properties(void)
                 unsigned long size;
                 int nid;
                 int ranges;
-                const unsigned int *memcell_buf;
+                const __be32 *memcell_buf;
                 unsigned int len;
 
                 memcell_buf = of_get_property(memory,
@@ -1106,7 +1109,7 @@ early_param("numa", early_numa);
 static int hot_add_drconf_scn_to_nid(struct device_node *memory,
                                      unsigned long scn_addr)
 {
-        const u32 *dm;
+        const __be32 *dm;
         unsigned int drconf_cell_cnt, rc;
         unsigned long lmb_size;
         struct assoc_arrays aa;
@@ -1159,7 +1162,7 @@ int hot_add_node_scn_to_nid(unsigned long scn_addr)
         for_each_node_by_type(memory, "memory") {
                 unsigned long start, size;
                 int ranges;
-                const unsigned int *memcell_buf;
+                const __be32 *memcell_buf;
                 unsigned int len;
 
                 memcell_buf = of_get_property(memory, "reg", &len);
@@ -1232,7 +1235,7 @@ static u64 hot_add_drconf_memory_max(void)
         struct device_node *memory = NULL;
         unsigned int drconf_cell_cnt = 0;
         u64 lmb_size = 0;
-        const u32 *dm = 0;
+        const __be32 *dm = 0;
 
         memory = of_find_node_by_path("/ibm,dynamic-reconfiguration-memory");
         if (memory) {
@@ -1337,40 +1340,41 @@ static int update_cpu_associativity_changes_mask(void)
  * Convert the associativity domain numbers returned from the hypervisor
  * to the sequence they would appear in the ibm,associativity property.
  */
-static int vphn_unpack_associativity(const long *packed, unsigned int *unpacked)
+static int vphn_unpack_associativity(const long *packed, __be32 *unpacked)
 {
         int i, nr_assoc_doms = 0;
-        const u16 *field = (const u16*) packed;
+        const __be16 *field = (const __be16 *) packed;
 
 #define VPHN_FIELD_UNUSED       (0xffff)
 #define VPHN_FIELD_MSB          (0x8000)
 #define VPHN_FIELD_MASK         (~VPHN_FIELD_MSB)
 
         for (i = 1; i < VPHN_ASSOC_BUFSIZE; i++) {
-                if (*field == VPHN_FIELD_UNUSED) {
+                if (be16_to_cpup(field) == VPHN_FIELD_UNUSED) {
                         /* All significant fields processed, and remaining
                          * fields contain the reserved value of all 1's.
                          * Just store them.
                          */
-                        unpacked[i] = *((u32*)field);
+                        unpacked[i] = *((__be32 *)field);
                         field += 2;
-                } else if (*field & VPHN_FIELD_MSB) {
+                } else if (be16_to_cpup(field) & VPHN_FIELD_MSB) {
                         /* Data is in the lower 15 bits of this field */
-                        unpacked[i] = *field & VPHN_FIELD_MASK;
+                        unpacked[i] = cpu_to_be32(
+                                be16_to_cpup(field) & VPHN_FIELD_MASK);
                         field++;
                         nr_assoc_doms++;
                 } else {
                         /* Data is in the lower 15 bits of this field
                          * concatenated with the next 16 bit field
                          */
-                        unpacked[i] = *((u32*)field);
+                        unpacked[i] = *((__be32 *)field);
                         field += 2;
                         nr_assoc_doms++;
                 }
         }
 
         /* The first cell contains the length of the property */
-        unpacked[0] = nr_assoc_doms;
+        unpacked[0] = cpu_to_be32(nr_assoc_doms);
 
         return nr_assoc_doms;
 }
@@ -1379,7 +1383,7 @@ static int vphn_unpack_associativity(const long *packed, unsigned int *unpacked)
  * Retrieve the new associativity information for a virtual processor's
  * home node.
  */
-static long hcall_vphn(unsigned long cpu, unsigned int *associativity)
+static long hcall_vphn(unsigned long cpu, __be32 *associativity)
 {
         long rc;
         long retbuf[PLPAR_HCALL9_BUFSIZE] = {0};
@@ -1393,7 +1397,7 @@ static long hcall_vphn(unsigned long cpu, unsigned int *associativity)
 }
 
 static long vphn_get_associativity(unsigned long cpu,
-                                        unsigned int *associativity)
+                                        __be32 *associativity)
 {
         long rc;
 
@@ -1450,7 +1454,7 @@ int arch_update_cpu_topology(void)
 {
         unsigned int cpu, sibling, changed = 0;
         struct topology_update_data *updates, *ud;
-        unsigned int associativity[VPHN_ASSOC_BUFSIZE] = {0};
+        __be32 associativity[VPHN_ASSOC_BUFSIZE] = {0};
         cpumask_t updated_cpus;
         struct device *dev;
         int weight, new_nid, i = 0;
@@ -1609,7 +1613,7 @@ int start_topology_update(void)
 #endif
                 }
         } else if (firmware_has_feature(FW_FEATURE_VPHN) &&
-                   get_lppaca()->shared_proc) {
+                   lppaca_shared_proc(get_lppaca())) {
                 if (!vphn_enabled) {
                         prrn_enabled = 0;
                         vphn_enabled = 1;
diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c
index a538c80db2df..9d1d33cd2be5 100644
--- a/arch/powerpc/mm/slb.c
+++ b/arch/powerpc/mm/slb.c
@@ -66,8 +66,10 @@ static inline void slb_shadow_update(unsigned long ea, int ssize,
          * we only update the current CPU's SLB shadow buffer.
          */
         get_slb_shadow()->save_area[entry].esid = 0;
-        get_slb_shadow()->save_area[entry].vsid = mk_vsid_data(ea, ssize, flags);
-        get_slb_shadow()->save_area[entry].esid = mk_esid_data(ea, ssize, entry);
+        get_slb_shadow()->save_area[entry].vsid =
+                                cpu_to_be64(mk_vsid_data(ea, ssize, flags));
+        get_slb_shadow()->save_area[entry].esid =
+                                cpu_to_be64(mk_esid_data(ea, ssize, entry));
 }
 
 static inline void slb_shadow_clear(unsigned long entry)
@@ -112,7 +114,8 @@ static void __slb_flush_and_rebolt(void)
         } else {
                 /* Update stack entry; others don't change */
                 slb_shadow_update(get_paca()->kstack, mmu_kernel_ssize, lflags, 2);
-                ksp_vsid_data = get_slb_shadow()->save_area[2].vsid;
+                ksp_vsid_data =
+                        be64_to_cpu(get_slb_shadow()->save_area[2].vsid);
         }
 
         /* We need to do this all in asm, so we're sure we don't touch
diff --git a/arch/powerpc/mm/subpage-prot.c b/arch/powerpc/mm/subpage-prot.c
index aa74acb0fdfc..a770df2dae70 100644
--- a/arch/powerpc/mm/subpage-prot.c
+++ b/arch/powerpc/mm/subpage-prot.c
@@ -105,7 +105,7 @@ static void subpage_prot_clear(unsigned long addr, unsigned long len)
                 limit = spt->maxaddr;
         for (; addr < limit; addr = next) {
                 next = pmd_addr_end(addr, limit);
-                if (addr < 0x100000000) {
+                if (addr < 0x100000000UL) {
                         spm = spt->low_prot;
                 } else {
                         spm = spt->protptrs[addr >> SBP_L3_SHIFT];
@@ -219,7 +219,7 @@ long sys_subpage_prot(unsigned long addr, unsigned long len, u32 __user *map)
         for (limit = addr + len; addr < limit; addr = next) {
                 next = pmd_addr_end(addr, limit);
                 err = -ENOMEM;
-                if (addr < 0x100000000) {
+                if (addr < 0x100000000UL) {
                         spm = spt->low_prot;
                 } else {
                         spm = spt->protptrs[addr >> SBP_L3_SHIFT];
diff --git a/arch/powerpc/oprofile/common.c b/arch/powerpc/oprofile/common.c
index 4f51025f5b00..c77348c5d463 100644
--- a/arch/powerpc/oprofile/common.c
+++ b/arch/powerpc/oprofile/common.c
@@ -119,7 +119,7 @@ static void op_powerpc_stop(void)
                 model->global_stop();
 }
 
-static int op_powerpc_create_files(struct super_block *sb, struct dentry *root)
+static int op_powerpc_create_files(struct dentry *root)
 {
         int i;
 
@@ -128,9 +128,9 @@ static int op_powerpc_create_files(struct super_block *sb, struct dentry *root)
          * There is one mmcr0, mmcr1 and mmcra for setting the events for
          * all of the counters.
          */
-        oprofilefs_create_ulong(sb, root, "mmcr0", &sys.mmcr0);
-        oprofilefs_create_ulong(sb, root, "mmcr1", &sys.mmcr1);
-        oprofilefs_create_ulong(sb, root, "mmcra", &sys.mmcra);
+        oprofilefs_create_ulong(root, "mmcr0", &sys.mmcr0);
+        oprofilefs_create_ulong(root, "mmcr1", &sys.mmcr1);
+        oprofilefs_create_ulong(root, "mmcra", &sys.mmcra);
 #ifdef CONFIG_OPROFILE_CELL
         /* create a file the user tool can check to see what level of profiling
          * support exits with this kernel. Initialize bit mask to indicate
@@ -142,7 +142,7 @@ static int op_powerpc_create_files(struct super_block *sb, struct dentry *root)
          * If the file does not exist, then the kernel only supports SPU
          * cycle profiling, PPU event and cycle profiling.
          */
-        oprofilefs_create_ulong(sb, root, "cell_support", &sys.cell_support);
+        oprofilefs_create_ulong(root, "cell_support", &sys.cell_support);
         sys.cell_support = 0x1; /* Note, the user OProfile tool must check
                                  * that this bit is set before attempting to
                                  * user SPU event profiling.  Older kernels
@@ -160,11 +160,11 @@ static int op_powerpc_create_files(struct super_block *sb, struct dentry *root)
                 char buf[4];
 
                 snprintf(buf, sizeof buf, "%d", i);
-                dir = oprofilefs_mkdir(sb, root, buf);
+                dir = oprofilefs_mkdir(root, buf);
 
-                oprofilefs_create_ulong(sb, dir, "enabled", &ctr[i].enabled);
-                oprofilefs_create_ulong(sb, dir, "event", &ctr[i].event);
-                oprofilefs_create_ulong(sb, dir, "count", &ctr[i].count);
+                oprofilefs_create_ulong(dir, "enabled", &ctr[i].enabled);
+                oprofilefs_create_ulong(dir, "event", &ctr[i].event);
+                oprofilefs_create_ulong(dir, "count", &ctr[i].count);
 
                 /*
                  * Classic PowerPC doesn't support per-counter
@@ -173,14 +173,14 @@ static int op_powerpc_create_files(struct super_block *sb, struct dentry *root)
                  * Book-E style performance monitors, we do
                  * support them.
                  */
-                oprofilefs_create_ulong(sb, dir, "kernel", &ctr[i].kernel);
-                oprofilefs_create_ulong(sb, dir, "user", &ctr[i].user);
+                oprofilefs_create_ulong(dir, "kernel", &ctr[i].kernel);
+                oprofilefs_create_ulong(dir, "user", &ctr[i].user);
 
-                oprofilefs_create_ulong(sb, dir, "unit_mask", &ctr[i].unit_mask);
+                oprofilefs_create_ulong(dir, "unit_mask", &ctr[i].unit_mask);
         }
 
-        oprofilefs_create_ulong(sb, root, "enable_kernel", &sys.enable_kernel);
-        oprofilefs_create_ulong(sb, root, "enable_user", &sys.enable_user);
+        oprofilefs_create_ulong(root, "enable_kernel", &sys.enable_kernel);
+        oprofilefs_create_ulong(root, "enable_user", &sys.enable_user);
 
         /* Default to tracing both kernel and user */
         sys.enable_kernel = 1;
diff --git a/arch/powerpc/oprofile/op_model_fsl_emb.c b/arch/powerpc/oprofile/op_model_fsl_emb.c
index ccc1daa33aed..2a82d3ed464d 100644
--- a/arch/powerpc/oprofile/op_model_fsl_emb.c
+++ b/arch/powerpc/oprofile/op_model_fsl_emb.c
@@ -46,6 +46,12 @@ static inline u32 get_pmlca(int ctr)
                 case 3:
                         pmlca = mfpmr(PMRN_PMLCA3);
                         break;
+                case 4:
+                        pmlca = mfpmr(PMRN_PMLCA4);
+                        break;
+                case 5:
+                        pmlca = mfpmr(PMRN_PMLCA5);
+                        break;
                 default:
                         panic("Bad ctr number\n");
         }
@@ -68,6 +74,12 @@ static inline void set_pmlca(int ctr, u32 pmlca)
                 case 3:
                         mtpmr(PMRN_PMLCA3, pmlca);
                         break;
+                case 4:
+                        mtpmr(PMRN_PMLCA4, pmlca);
+                        break;
+                case 5:
+                        mtpmr(PMRN_PMLCA5, pmlca);
+                        break;
                 default:
                         panic("Bad ctr number\n");
         }
@@ -84,6 +96,10 @@ static inline unsigned int ctr_read(unsigned int i)
                         return mfpmr(PMRN_PMC2);
                 case 3:
                         return mfpmr(PMRN_PMC3);
+                case 4:
+                        return mfpmr(PMRN_PMC4);
+                case 5:
+                        return mfpmr(PMRN_PMC5);
                 default:
                         return 0;
         }
@@ -104,6 +120,12 @@ static inline void ctr_write(unsigned int i, unsigned int val)
                 case 3:
                         mtpmr(PMRN_PMC3, val);
                         break;
+                case 4:
+                        mtpmr(PMRN_PMC4, val);
+                        break;
+                case 5:
+                        mtpmr(PMRN_PMC5, val);
+                        break;
                 default:
                         break;
         }
@@ -133,6 +155,14 @@ static void init_pmc_stop(int ctr)
                         mtpmr(PMRN_PMLCA3, pmlca);
                         mtpmr(PMRN_PMLCB3, pmlcb);
                         break;
+                case 4:
+                        mtpmr(PMRN_PMLCA4, pmlca);
+                        mtpmr(PMRN_PMLCB4, pmlcb);
+                        break;
+                case 5:
+                        mtpmr(PMRN_PMLCA5, pmlca);
+                        mtpmr(PMRN_PMLCB5, pmlcb);
+                        break;
                 default:
                         panic("Bad ctr number!\n");
         }
diff --git a/arch/powerpc/perf/Makefile b/arch/powerpc/perf/Makefile
index 510fae10513d..60d71eea919c 100644
--- a/arch/powerpc/perf/Makefile
+++ b/arch/powerpc/perf/Makefile
@@ -9,7 +9,7 @@ obj64-$(CONFIG_PPC_PERF_CTRS)	+= power4-pmu.o ppc970-pmu.o power5-pmu.o \
 obj32-$(CONFIG_PPC_PERF_CTRS)   += mpc7450-pmu.o
 
 obj-$(CONFIG_FSL_EMB_PERF_EVENT) += core-fsl-emb.o
-obj-$(CONFIG_FSL_EMB_PERF_EVENT_E500) += e500-pmu.o
+obj-$(CONFIG_FSL_EMB_PERF_EVENT_E500) += e500-pmu.o e6500-pmu.o
 
 obj-$(CONFIG_PPC64)             += $(obj64-y)
 obj-$(CONFIG_PPC32)             += $(obj32-y)
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index eeae308cf982..29b89e863d7c 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -24,7 +24,7 @@
 #define BHRB_MAX_ENTRIES        32
 #define BHRB_TARGET             0x0000000000000002
 #define BHRB_PREDICTION         0x0000000000000001
-#define BHRB_EA                 0xFFFFFFFFFFFFFFFC
+#define BHRB_EA                 0xFFFFFFFFFFFFFFFCUL
 
 struct cpu_hw_events {
         int n_events;
diff --git a/arch/powerpc/perf/core-fsl-emb.c b/arch/powerpc/perf/core-fsl-emb.c
index 106c53354675..d35ae52c69dc 100644
--- a/arch/powerpc/perf/core-fsl-emb.c
+++ b/arch/powerpc/perf/core-fsl-emb.c
@@ -70,6 +70,12 @@ static unsigned long read_pmc(int idx)
         case 3:
                 val = mfpmr(PMRN_PMC3);
                 break;
+        case 4:
+                val = mfpmr(PMRN_PMC4);
+                break;
+        case 5:
+                val = mfpmr(PMRN_PMC5);
+                break;
         default:
                 printk(KERN_ERR "oops trying to read PMC%d\n", idx);
                 val = 0;
@@ -95,6 +101,12 @@ static void write_pmc(int idx, unsigned long val)
         case 3:
                 mtpmr(PMRN_PMC3, val);
                 break;
+        case 4:
+                mtpmr(PMRN_PMC4, val);
+                break;
+        case 5:
+                mtpmr(PMRN_PMC5, val);
+                break;
         default:
                 printk(KERN_ERR "oops trying to write PMC%d\n", idx);
         }
@@ -120,6 +132,12 @@ static void write_pmlca(int idx, unsigned long val)
         case 3:
                 mtpmr(PMRN_PMLCA3, val);
                 break;
+        case 4:
+                mtpmr(PMRN_PMLCA4, val);
+                break;
+        case 5:
+                mtpmr(PMRN_PMLCA5, val);
+                break;
         default:
                 printk(KERN_ERR "oops trying to write PMLCA%d\n", idx);
         }
@@ -145,6 +163,12 @@ static void write_pmlcb(int idx, unsigned long val)
         case 3:
                 mtpmr(PMRN_PMLCB3, val);
                 break;
+        case 4:
+                mtpmr(PMRN_PMLCB4, val);
+                break;
+        case 5:
+                mtpmr(PMRN_PMLCB5, val);
+                break;
         default:
                 printk(KERN_ERR "oops trying to write PMLCB%d\n", idx);
         }
@@ -462,6 +486,12 @@ static int fsl_emb_pmu_event_init(struct perf_event *event)
         int num_restricted;
         int i;
 
+        if (ppmu->n_counter > MAX_HWEVENTS) {
+                WARN(1, "No. of perf counters (%d) is higher than max array size(%d)\n",
+                        ppmu->n_counter, MAX_HWEVENTS);
+                ppmu->n_counter = MAX_HWEVENTS;
+        }
+
         switch (event->attr.type) {
         case PERF_TYPE_HARDWARE:
                 ev = event->attr.config;
diff --git a/arch/powerpc/perf/e6500-pmu.c b/arch/powerpc/perf/e6500-pmu.c
new file mode 100644
index 000000000000..3d877aa777b5
--- /dev/null
+++ b/arch/powerpc/perf/e6500-pmu.c
@@ -0,0 +1,121 @@
+/*
+ * Performance counter support for e6500 family processors.
+ *
+ * Author: Priyanka Jain, Priyanka.Jain@freescale.com
+ * Based on e500-pmu.c
+ * Copyright 2013 Freescale Semiconductor, Inc.
+ * Copyright 2008-2009 Paul Mackerras, IBM Corporation.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/string.h>
+#include <linux/perf_event.h>
+#include <asm/reg.h>
+#include <asm/cputable.h>
+
+/*
+ * Map of generic hardware event types to hardware events
+ * Zero if unsupported
+ */
+static int e6500_generic_events[] = {
+        [PERF_COUNT_HW_CPU_CYCLES] = 1,
+        [PERF_COUNT_HW_INSTRUCTIONS] = 2,
+        [PERF_COUNT_HW_CACHE_MISSES] = 221,
+        [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = 12,
+        [PERF_COUNT_HW_BRANCH_MISSES] = 15,
+};
+
+#define C(x)    PERF_COUNT_HW_CACHE_##x
+
+/*
+ * Table of generalized cache-related events.
+ * 0 means not supported, -1 means nonsensical, other values
+ * are event codes.
+ */
+static int e6500_cache_events[C(MAX)][C(OP_MAX)][C(RESULT_MAX)] = {
+        [C(L1D)] = {
+                                /*RESULT_ACCESS         RESULT_MISS */
+                [C(OP_READ)] = {        27,             222     },
+                [C(OP_WRITE)] = {       28,             223     },
+                [C(OP_PREFETCH)] = {    29,             0       },
+        },
+        [C(L1I)] = {
+                                /*RESULT_ACCESS         RESULT_MISS */
+                [C(OP_READ)] = {        2,              254     },
+                [C(OP_WRITE)] = {       -1,             -1      },
+                [C(OP_PREFETCH)] = {    37,             0       },
+        },
+        /*
+         * Assuming LL means L2, it's not a good match for this model.
+         * It does not have separate read/write events (but it does have
+         * separate instruction/data events).
+         */
+        [C(LL)] = {
+                                /*RESULT_ACCESS         RESULT_MISS */
+                [C(OP_READ)] = {        0,              0       },
+                [C(OP_WRITE)] = {       0,              0       },
+                [C(OP_PREFETCH)] = {    0,              0       },
+        },
+        /*
+         * There are data/instruction MMU misses, but that's a miss on
+         * the chip's internal level-one TLB which is probably not
+         * what the user wants.  Instead, unified level-two TLB misses
+         * are reported here.
+         */
+        [C(DTLB)] = {
+                                /*RESULT_ACCESS         RESULT_MISS */
+                [C(OP_READ)] = {        26,             66      },
+                [C(OP_WRITE)] = {       -1,             -1      },
+                [C(OP_PREFETCH)] = {    -1,             -1      },
+        },
+        [C(BPU)] = {
+                                /*RESULT_ACCESS         RESULT_MISS */
+                [C(OP_READ)] = {        12,             15      },
+                [C(OP_WRITE)] = {       -1,             -1      },
+                [C(OP_PREFETCH)] = {    -1,             -1      },
+        },
+        [C(NODE)] = {
+                                /* RESULT_ACCESS        RESULT_MISS */
+                [C(OP_READ)] = {        -1,             -1      },
+                [C(OP_WRITE)] = {       -1,             -1      },
+                [C(OP_PREFETCH)] = {    -1,             -1      },
+        },
+};
+
+static int num_events = 512;
+
+/* Upper half of event id is PMLCb, for threshold events */
+static u64 e6500_xlate_event(u64 event_id)
+{
+        u32 event_low = (u32)event_id;
+        if (event_low >= num_events ||
+                (event_id & (FSL_EMB_EVENT_THRESHMUL | FSL_EMB_EVENT_THRESH)))
+                return 0;
+
+        return FSL_EMB_EVENT_VALID;
+}
+
+static struct fsl_emb_pmu e6500_pmu = {
+        .name                   = "e6500 family",
+        .n_counter              = 6,
+        .n_restricted           = 0,
+        .xlate_event            = e6500_xlate_event,
+        .n_generic              = ARRAY_SIZE(e6500_generic_events),
+        .generic_events         = e6500_generic_events,
+        .cache_events           = &e6500_cache_events,
+};
+
+static int init_e6500_pmu(void)
+{
+        if (!cur_cpu_spec->oprofile_cpu_type ||
+                strcmp(cur_cpu_spec->oprofile_cpu_type, "ppc/e6500"))
+                return -ENODEV;
+
+        return register_fsl_emb_pmu(&e6500_pmu);
+}
+
+early_initcall(init_e6500_pmu);
diff --git a/arch/powerpc/perf/power7-events-list.h b/arch/powerpc/perf/power7-events-list.h
new file mode 100644
index 000000000000..687790a2c0b8
--- /dev/null
+++ b/arch/powerpc/perf/power7-events-list.h
@@ -0,0 +1,548 @@
+/*
+ * Performance counter support for POWER7 processors.
+ *
+ * Copyright 2013 Runzhen Wang, IBM Corporation.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+EVENT(PM_IC_DEMAND_L2_BR_ALL,                 0x04898)
+EVENT(PM_GCT_UTIL_7_TO_10_SLOTS,              0x020a0)
+EVENT(PM_PMC2_SAVED,                          0x10022)
+EVENT(PM_CMPLU_STALL_DFU,                     0x2003c)
+EVENT(PM_VSU0_16FLOP,                         0x0a0a4)
+EVENT(PM_MRK_LSU_DERAT_MISS,                  0x3d05a)
+EVENT(PM_MRK_ST_CMPL,                         0x10034)
+EVENT(PM_NEST_PAIR3_ADD,                      0x40881)
+EVENT(PM_L2_ST_DISP,                          0x46180)
+EVENT(PM_L2_CASTOUT_MOD,                      0x16180)
+EVENT(PM_ISEG,                                0x020a4)
+EVENT(PM_MRK_INST_TIMEO,                      0x40034)
+EVENT(PM_L2_RCST_DISP_FAIL_ADDR,              0x36282)
+EVENT(PM_LSU1_DC_PREF_STREAM_CONFIRM,         0x0d0b6)
+EVENT(PM_IERAT_WR_64K,                        0x040be)
+EVENT(PM_MRK_DTLB_MISS_16M,                   0x4d05e)
+EVENT(PM_IERAT_MISS,                          0x100f6)
+EVENT(PM_MRK_PTEG_FROM_LMEM,                  0x4d052)
+EVENT(PM_FLOP,                                0x100f4)
+EVENT(PM_THRD_PRIO_4_5_CYC,                   0x040b4)
+EVENT(PM_BR_PRED_TA,                          0x040aa)
+EVENT(PM_CMPLU_STALL_FXU,                     0x20014)
+EVENT(PM_EXT_INT,                             0x200f8)
+EVENT(PM_VSU_FSQRT_FDIV,                      0x0a888)
+EVENT(PM_MRK_LD_MISS_EXPOSED_CYC,             0x1003e)
+EVENT(PM_LSU1_LDF,                            0x0c086)
+EVENT(PM_IC_WRITE_ALL,                        0x0488c)
+EVENT(PM_LSU0_SRQ_STFWD,                      0x0c0a0)
+EVENT(PM_PTEG_FROM_RL2L3_MOD,                 0x1c052)
+EVENT(PM_MRK_DATA_FROM_L31_SHR,               0x1d04e)
+EVENT(PM_DATA_FROM_L21_MOD,                   0x3c046)
+EVENT(PM_VSU1_SCAL_DOUBLE_ISSUED,             0x0b08a)
+EVENT(PM_VSU0_8FLOP,                          0x0a0a0)
+EVENT(PM_POWER_EVENT1,                        0x1006e)
+EVENT(PM_DISP_CLB_HELD_BAL,                   0x02092)
+EVENT(PM_VSU1_2FLOP,                          0x0a09a)
+EVENT(PM_LWSYNC_HELD,                         0x0209a)
+EVENT(PM_PTEG_FROM_DL2L3_SHR,                 0x3c054)
+EVENT(PM_INST_FROM_L21_MOD,                   0x34046)
+EVENT(PM_IERAT_XLATE_WR_16MPLUS,              0x040bc)
+EVENT(PM_IC_REQ_ALL,                          0x04888)
+EVENT(PM_DSLB_MISS,                           0x0d090)
+EVENT(PM_L3_MISS,                             0x1f082)
+EVENT(PM_LSU0_L1_PREF,                        0x0d0b8)
+EVENT(PM_VSU_SCALAR_SINGLE_ISSUED,            0x0b884)
+EVENT(PM_LSU1_DC_PREF_STREAM_CONFIRM_STRIDE,  0x0d0be)
+EVENT(PM_L2_INST,                             0x36080)
+EVENT(PM_VSU0_FRSP,                           0x0a0b4)
+EVENT(PM_FLUSH_DISP,                          0x02082)
+EVENT(PM_PTEG_FROM_L2MISS,                    0x4c058)
+EVENT(PM_VSU1_DQ_ISSUED,                      0x0b09a)
+EVENT(PM_CMPLU_STALL_LSU,                     0x20012)
+EVENT(PM_MRK_DATA_FROM_DMEM,                  0x1d04a)
+EVENT(PM_LSU_FLUSH_ULD,                       0x0c8b0)
+EVENT(PM_PTEG_FROM_LMEM,                      0x4c052)
+EVENT(PM_MRK_DERAT_MISS_16M,                  0x3d05c)
+EVENT(PM_THRD_ALL_RUN_CYC,                    0x2000c)
+EVENT(PM_MEM0_PREFETCH_DISP,                  0x20083)
+EVENT(PM_MRK_STALL_CMPLU_CYC_COUNT,           0x3003f)
+EVENT(PM_DATA_FROM_DL2L3_MOD,                 0x3c04c)
+EVENT(PM_VSU_FRSP,                            0x0a8b4)
+EVENT(PM_MRK_DATA_FROM_L21_MOD,               0x3d046)
+EVENT(PM_PMC1_OVERFLOW,                       0x20010)
+EVENT(PM_VSU0_SINGLE,                         0x0a0a8)
+EVENT(PM_MRK_PTEG_FROM_L3MISS,                0x2d058)
+EVENT(PM_MRK_PTEG_FROM_L31_SHR,               0x2d056)
+EVENT(PM_VSU0_VECTOR_SP_ISSUED,               0x0b090)
+EVENT(PM_VSU1_FEST,                           0x0a0ba)
+EVENT(PM_MRK_INST_DISP,                       0x20030)
+EVENT(PM_VSU0_COMPLEX_ISSUED,                 0x0b096)
+EVENT(PM_LSU1_FLUSH_UST,                      0x0c0b6)
+EVENT(PM_INST_CMPL,                           0x00002)
+EVENT(PM_FXU_IDLE,                            0x1000e)
+EVENT(PM_LSU0_FLUSH_ULD,                      0x0c0b0)
+EVENT(PM_MRK_DATA_FROM_DL2L3_MOD,             0x3d04c)
+EVENT(PM_LSU_LMQ_SRQ_EMPTY_ALL_CYC,           0x3001c)
+EVENT(PM_LSU1_REJECT_LMQ_FULL,                0x0c0a6)
+EVENT(PM_INST_PTEG_FROM_L21_MOD,              0x3e056)
+EVENT(PM_INST_FROM_RL2L3_MOD,                 0x14042)
+EVENT(PM_SHL_CREATED,                         0x05082)
+EVENT(PM_L2_ST_HIT,                           0x46182)
+EVENT(PM_DATA_FROM_DMEM,                      0x1c04a)
+EVENT(PM_L3_LD_MISS,                          0x2f082)
+EVENT(PM_FXU1_BUSY_FXU0_IDLE,                 0x4000e)
+EVENT(PM_DISP_CLB_HELD_RES,                   0x02094)
+EVENT(PM_L2_SN_SX_I_DONE,                     0x36382)
+EVENT(PM_GRP_CMPL,                            0x30004)
+EVENT(PM_STCX_CMPL,                           0x0c098)
+EVENT(PM_VSU0_2FLOP,                          0x0a098)
+EVENT(PM_L3_PREF_MISS,                        0x3f082)
+EVENT(PM_LSU_SRQ_SYNC_CYC,                    0x0d096)
+EVENT(PM_LSU_REJECT_ERAT_MISS,                0x20064)
+EVENT(PM_L1_ICACHE_MISS,                      0x200fc)
+EVENT(PM_LSU1_FLUSH_SRQ,                      0x0c0be)
+EVENT(PM_LD_REF_L1_LSU0,                      0x0c080)
+EVENT(PM_VSU0_FEST,                           0x0a0b8)
+EVENT(PM_VSU_VECTOR_SINGLE_ISSUED,            0x0b890)
+EVENT(PM_FREQ_UP,                             0x4000c)
+EVENT(PM_DATA_FROM_LMEM,                      0x3c04a)
+EVENT(PM_LSU1_LDX,                            0x0c08a)
+EVENT(PM_PMC3_OVERFLOW,                       0x40010)
+EVENT(PM_MRK_BR_MPRED,                        0x30036)
+EVENT(PM_SHL_MATCH,                           0x05086)
+EVENT(PM_MRK_BR_TAKEN,                        0x10036)
+EVENT(PM_CMPLU_STALL_BRU,                     0x4004e)
+EVENT(PM_ISLB_MISS,                           0x0d092)
+EVENT(PM_CYC,                                 0x0001e)
+EVENT(PM_DISP_HELD_THERMAL,                   0x30006)
+EVENT(PM_INST_PTEG_FROM_RL2L3_SHR,            0x2e054)
+EVENT(PM_LSU1_SRQ_STFWD,                      0x0c0a2)
+EVENT(PM_GCT_NOSLOT_BR_MPRED,                 0x4001a)
+EVENT(PM_1PLUS_PPC_CMPL,                      0x100f2)
+EVENT(PM_PTEG_FROM_DMEM,                      0x2c052)
+EVENT(PM_VSU_2FLOP,                           0x0a898)
+EVENT(PM_GCT_FULL_CYC,                        0x04086)
+EVENT(PM_MRK_DATA_FROM_L3_CYC,                0x40020)
+EVENT(PM_LSU_SRQ_S0_ALLOC,                    0x0d09d)
+EVENT(PM_MRK_DERAT_MISS_4K,                   0x1d05c)
+EVENT(PM_BR_MPRED_TA,                         0x040ae)
+EVENT(PM_INST_PTEG_FROM_L2MISS,               0x4e058)
+EVENT(PM_DPU_HELD_POWER,                      0x20006)
+EVENT(PM_RUN_INST_CMPL,                       0x400fa)
+EVENT(PM_MRK_VSU_FIN,                         0x30032)
+EVENT(PM_LSU_SRQ_S0_VALID,                    0x0d09c)
+EVENT(PM_GCT_EMPTY_CYC,                       0x20008)
+EVENT(PM_IOPS_DISP,                           0x30014)
+EVENT(PM_RUN_SPURR,                           0x10008)
+EVENT(PM_PTEG_FROM_L21_MOD,                   0x3c056)
+EVENT(PM_VSU0_1FLOP,                          0x0a080)
+EVENT(PM_SNOOP_TLBIE,                         0x0d0b2)
+EVENT(PM_DATA_FROM_L3MISS,                    0x2c048)
+EVENT(PM_VSU_SINGLE,                          0x0a8a8)
+EVENT(PM_DTLB_MISS_16G,                       0x1c05e)
+EVENT(PM_CMPLU_STALL_VECTOR,                  0x2001c)
+EVENT(PM_FLUSH,                               0x400f8)
+EVENT(PM_L2_LD_HIT,                           0x36182)
+EVENT(PM_NEST_PAIR2_AND,                      0x30883)
+EVENT(PM_VSU1_1FLOP,                          0x0a082)
+EVENT(PM_IC_PREF_REQ,                         0x0408a)
+EVENT(PM_L3_LD_HIT,                           0x2f080)
+EVENT(PM_GCT_NOSLOT_IC_MISS,                  0x2001a)
+EVENT(PM_DISP_HELD,                           0x10006)
+EVENT(PM_L2_LD,                               0x16080)
+EVENT(PM_LSU_FLUSH_SRQ,                       0x0c8bc)
+EVENT(PM_BC_PLUS_8_CONV,                      0x040b8)
+EVENT(PM_MRK_DATA_FROM_L31_MOD_CYC,           0x40026)
+EVENT(PM_CMPLU_STALL_VECTOR_LONG,             0x4004a)
+EVENT(PM_L2_RCST_BUSY_RC_FULL,                0x26282)
+EVENT(PM_TB_BIT_TRANS,                        0x300f8)
+EVENT(PM_THERMAL_MAX,                         0x40006)
+EVENT(PM_LSU1_FLUSH_ULD,                      0x0c0b2)
+EVENT(PM_LSU1_REJECT_LHS,                     0x0c0ae)
+EVENT(PM_LSU_LRQ_S0_ALLOC,                    0x0d09f)
+EVENT(PM_L3_CO_L31,                           0x4f080)
+EVENT(PM_POWER_EVENT4,                        0x4006e)
+EVENT(PM_DATA_FROM_L31_SHR,                   0x1c04e)
+EVENT(PM_BR_UNCOND,                           0x0409e)
+EVENT(PM_LSU1_DC_PREF_STREAM_ALLOC,           0x0d0aa)
+EVENT(PM_PMC4_REWIND,                         0x10020)
+EVENT(PM_L2_RCLD_DISP,                        0x16280)
+EVENT(PM_THRD_PRIO_2_3_CYC,                   0x040b2)
+EVENT(PM_MRK_PTEG_FROM_L2MISS,                0x4d058)
+EVENT(PM_IC_DEMAND_L2_BHT_REDIRECT,           0x04098)
+EVENT(PM_LSU_DERAT_MISS,                      0x200f6)
+EVENT(PM_IC_PREF_CANCEL_L2,                   0x04094)
+EVENT(PM_MRK_FIN_STALL_CYC_COUNT,             0x1003d)
+EVENT(PM_BR_PRED_CCACHE,                      0x040a0)
+EVENT(PM_GCT_UTIL_1_TO_2_SLOTS,               0x0209c)
+EVENT(PM_MRK_ST_CMPL_INT,                     0x30034)
+EVENT(PM_LSU_TWO_TABLEWALK_CYC,               0x0d0a6)
+EVENT(PM_MRK_DATA_FROM_L3MISS,                0x2d048)
+EVENT(PM_GCT_NOSLOT_CYC,                      0x100f8)
+EVENT(PM_LSU_SET_MPRED,                       0x0c0a8)
+EVENT(PM_FLUSH_DISP_TLBIE,                    0x0208a)
+EVENT(PM_VSU1_FCONV,                          0x0a0b2)
+EVENT(PM_DERAT_MISS_16G,                      0x4c05c)
+EVENT(PM_INST_FROM_LMEM,                      0x3404a)
+EVENT(PM_IC_DEMAND_L2_BR_REDIRECT,            0x0409a)
+EVENT(PM_CMPLU_STALL_SCALAR_LONG,             0x20018)
+EVENT(PM_INST_PTEG_FROM_L2,                   0x1e050)
+EVENT(PM_PTEG_FROM_L2,                        0x1c050)
+EVENT(PM_MRK_DATA_FROM_L21_SHR_CYC,           0x20024)
+EVENT(PM_MRK_DTLB_MISS_4K,                    0x2d05a)
+EVENT(PM_VSU0_FPSCR,                          0x0b09c)
+EVENT(PM_VSU1_VECT_DOUBLE_ISSUED,             0x0b082)
+EVENT(PM_MRK_PTEG_FROM_RL2L3_MOD,             0x1d052)
+EVENT(PM_MEM0_RQ_DISP,                        0x10083)
+EVENT(PM_L2_LD_MISS,                          0x26080)
+EVENT(PM_VMX_RESULT_SAT_1,                    0x0b0a0)
+EVENT(PM_L1_PREF,                             0x0d8b8)
+EVENT(PM_MRK_DATA_FROM_LMEM_CYC,              0x2002c)
+EVENT(PM_GRP_IC_MISS_NONSPEC,                 0x1000c)
+EVENT(PM_PB_NODE_PUMP,                        0x10081)
+EVENT(PM_SHL_MERGED,                          0x05084)
+EVENT(PM_NEST_PAIR1_ADD,                      0x20881)
+EVENT(PM_DATA_FROM_L3,                        0x1c048)
+EVENT(PM_LSU_FLUSH,                           0x0208e)
+EVENT(PM_LSU_SRQ_SYNC_COUNT,                  0x0d097)
+EVENT(PM_PMC2_OVERFLOW,                       0x30010)
+EVENT(PM_LSU_LDF,                             0x0c884)
+EVENT(PM_POWER_EVENT3,                        0x3006e)
+EVENT(PM_DISP_WT,                             0x30008)
+EVENT(PM_CMPLU_STALL_REJECT,                  0x40016)
+EVENT(PM_IC_BANK_CONFLICT,                    0x04082)
+EVENT(PM_BR_MPRED_CR_TA,                      0x048ae)
+EVENT(PM_L2_INST_MISS,                        0x36082)
+EVENT(PM_CMPLU_STALL_ERAT_MISS,               0x40018)
+EVENT(PM_NEST_PAIR2_ADD,                      0x30881)
+EVENT(PM_MRK_LSU_FLUSH,                       0x0d08c)
+EVENT(PM_L2_LDST,                             0x16880)
+EVENT(PM_INST_FROM_L31_SHR,                   0x1404e)
+EVENT(PM_VSU0_FIN,                            0x0a0bc)
+EVENT(PM_LARX_LSU,                            0x0c894)
+EVENT(PM_INST_FROM_RMEM,                      0x34042)
+EVENT(PM_DISP_CLB_HELD_TLBIE,                 0x02096)
+EVENT(PM_MRK_DATA_FROM_DMEM_CYC,              0x2002e)
+EVENT(PM_BR_PRED_CR,                          0x040a8)
+EVENT(PM_LSU_REJECT,                          0x10064)
+EVENT(PM_GCT_UTIL_3_TO_6_SLOTS,               0x0209e)
+EVENT(PM_CMPLU_STALL_END_GCT_NOSLOT,          0x10028)
+EVENT(PM_LSU0_REJECT_LMQ_FULL,                0x0c0a4)
+EVENT(PM_VSU_FEST,                            0x0a8b8)
+EVENT(PM_NEST_PAIR0_AND,                      0x10883)
+EVENT(PM_PTEG_FROM_L3,                        0x2c050)
+EVENT(PM_POWER_EVENT2,                        0x2006e)
+EVENT(PM_IC_PREF_CANCEL_PAGE,                 0x04090)
+EVENT(PM_VSU0_FSQRT_FDIV,                     0x0a088)
+EVENT(PM_MRK_GRP_CMPL,                        0x40030)
+EVENT(PM_VSU0_SCAL_DOUBLE_ISSUED,             0x0b088)
+EVENT(PM_GRP_DISP,                            0x3000a)
+EVENT(PM_LSU0_LDX,                            0x0c088)
+EVENT(PM_DATA_FROM_L2,                        0x1c040)
+EVENT(PM_MRK_DATA_FROM_RL2L3_MOD,             0x1d042)
+EVENT(PM_LD_REF_L1,                           0x0c880)
+EVENT(PM_VSU0_VECT_DOUBLE_ISSUED,             0x0b080)
+EVENT(PM_VSU1_2FLOP_DOUBLE,                   0x0a08e)
+EVENT(PM_THRD_PRIO_6_7_CYC,                   0x040b6)
+EVENT(PM_BC_PLUS_8_RSLV_TAKEN,                0x040ba)
+EVENT(PM_BR_MPRED_CR,                         0x040ac)
+EVENT(PM_L3_CO_MEM,                           0x4f082)
+EVENT(PM_LD_MISS_L1,                          0x400f0)
+EVENT(PM_DATA_FROM_RL2L3_MOD,                 0x1c042)
+EVENT(PM_LSU_SRQ_FULL_CYC,                    0x1001a)
+EVENT(PM_TABLEWALK_CYC,                       0x10026)
+EVENT(PM_MRK_PTEG_FROM_RMEM,                  0x3d052)
+EVENT(PM_LSU_SRQ_STFWD,                       0x0c8a0)
+EVENT(PM_INST_PTEG_FROM_RMEM,                 0x3e052)
+EVENT(PM_FXU0_FIN,                            0x10004)
+EVENT(PM_LSU1_L1_SW_PREF,                     0x0c09e)
+EVENT(PM_PTEG_FROM_L31_MOD,                   0x1c054)
+EVENT(PM_PMC5_OVERFLOW,                       0x10024)
+EVENT(PM_LD_REF_L1_LSU1,                      0x0c082)
+EVENT(PM_INST_PTEG_FROM_L21_SHR,              0x4e056)
+EVENT(PM_CMPLU_STALL_THRD,                    0x1001c)
+EVENT(PM_DATA_FROM_RMEM,                      0x3c042)
+EVENT(PM_VSU0_SCAL_SINGLE_ISSUED,             0x0b084)
+EVENT(PM_BR_MPRED_LSTACK,                     0x040a6)
+EVENT(PM_MRK_DATA_FROM_RL2L3_MOD_CYC,         0x40028)
+EVENT(PM_LSU0_FLUSH_UST,                      0x0c0b4)
+EVENT(PM_LSU_NCST,                            0x0c090)
+EVENT(PM_BR_TAKEN,                            0x20004)
+EVENT(PM_INST_PTEG_FROM_LMEM,                 0x4e052)
+EVENT(PM_GCT_NOSLOT_BR_MPRED_IC_MISS,         0x4001c)
+EVENT(PM_DTLB_MISS_4K,                        0x2c05a)
+EVENT(PM_PMC4_SAVED,                          0x30022)
+EVENT(PM_VSU1_PERMUTE_ISSUED,                 0x0b092)
+EVENT(PM_SLB_MISS,                            0x0d890)
+EVENT(PM_LSU1_FLUSH_LRQ,                      0x0c0ba)
+EVENT(PM_DTLB_MISS,                           0x300fc)
+EVENT(PM_VSU1_FRSP,                           0x0a0b6)
+EVENT(PM_VSU_VECTOR_DOUBLE_ISSUED,            0x0b880)
+EVENT(PM_L2_CASTOUT_SHR,                      0x16182)
+EVENT(PM_DATA_FROM_DL2L3_SHR,                 0x3c044)
+EVENT(PM_VSU1_STF,                            0x0b08e)
+EVENT(PM_ST_FIN,                              0x200f0)
+EVENT(PM_PTEG_FROM_L21_SHR,                   0x4c056)
+EVENT(PM_L2_LOC_GUESS_WRONG,                  0x26480)
+EVENT(PM_MRK_STCX_FAIL,                       0x0d08e)
+EVENT(PM_LSU0_REJECT_LHS,                     0x0c0ac)
+EVENT(PM_IC_PREF_CANCEL_HIT,                  0x04092)
+EVENT(PM_L3_PREF_BUSY,                        0x4f080)
+EVENT(PM_MRK_BRU_FIN,                         0x2003a)
+EVENT(PM_LSU1_NCLD,                           0x0c08e)
+EVENT(PM_INST_PTEG_FROM_L31_MOD,              0x1e054)
+EVENT(PM_LSU_NCLD,                            0x0c88c)
+EVENT(PM_LSU_LDX,                             0x0c888)
+EVENT(PM_L2_LOC_GUESS_CORRECT,                0x16480)
+EVENT(PM_THRESH_TIMEO,                        0x10038)
+EVENT(PM_L3_PREF_ST,                          0x0d0ae)
+EVENT(PM_DISP_CLB_HELD_SYNC,                  0x02098)
+EVENT(PM_VSU_SIMPLE_ISSUED,                   0x0b894)
+EVENT(PM_VSU1_SINGLE,                         0x0a0aa)
+EVENT(PM_DATA_TABLEWALK_CYC,                  0x3001a)
+EVENT(PM_L2_RC_ST_DONE,                       0x36380)
+EVENT(PM_MRK_PTEG_FROM_L21_MOD,               0x3d056)
+EVENT(PM_LARX_LSU1,                           0x0c096)
+EVENT(PM_MRK_DATA_FROM_RMEM,                  0x3d042)
+EVENT(PM_DISP_CLB_HELD,                       0x02090)
+EVENT(PM_DERAT_MISS_4K,                       0x1c05c)
+EVENT(PM_L2_RCLD_DISP_FAIL_ADDR,              0x16282)
+EVENT(PM_SEG_EXCEPTION,                       0x028a4)
+EVENT(PM_FLUSH_DISP_SB,                       0x0208c)
+EVENT(PM_L2_DC_INV,                           0x26182)
+EVENT(PM_PTEG_FROM_DL2L3_MOD,                 0x4c054)
+EVENT(PM_DSEG,                                0x020a6)
+EVENT(PM_BR_PRED_LSTACK,                      0x040a2)
+EVENT(PM_VSU0_STF,                            0x0b08c)
+EVENT(PM_LSU_FX_FIN,                          0x10066)
+EVENT(PM_DERAT_MISS_16M,                      0x3c05c)
+EVENT(PM_MRK_PTEG_FROM_DL2L3_MOD,             0x4d054)
+EVENT(PM_GCT_UTIL_11_PLUS_SLOTS,              0x020a2)
+EVENT(PM_INST_FROM_L3,                        0x14048)
+EVENT(PM_MRK_IFU_FIN,                         0x3003a)
+EVENT(PM_ITLB_MISS,                           0x400fc)
+EVENT(PM_VSU_STF,                             0x0b88c)
+EVENT(PM_LSU_FLUSH_UST,                       0x0c8b4)
+EVENT(PM_L2_LDST_MISS,                        0x26880)
+EVENT(PM_FXU1_FIN,                            0x40004)
+EVENT(PM_SHL_DEALLOCATED,                     0x05080)
+EVENT(PM_L2_SN_M_WR_DONE,                     0x46382)
+EVENT(PM_LSU_REJECT_SET_MPRED,                0x0c8a8)
+EVENT(PM_L3_PREF_LD,                          0x0d0ac)
+EVENT(PM_L2_SN_M_RD_DONE,                     0x46380)
+EVENT(PM_MRK_DERAT_MISS_16G,                  0x4d05c)
+EVENT(PM_VSU_FCONV,                           0x0a8b0)
+EVENT(PM_ANY_THRD_RUN_CYC,                    0x100fa)
+EVENT(PM_LSU_LMQ_FULL_CYC,                    0x0d0a4)
+EVENT(PM_MRK_LSU_REJECT_LHS,                  0x0d082)
+EVENT(PM_MRK_LD_MISS_L1_CYC,                  0x4003e)
+EVENT(PM_MRK_DATA_FROM_L2_CYC,                0x20020)
+EVENT(PM_INST_IMC_MATCH_DISP,                 0x30016)
+EVENT(PM_MRK_DATA_FROM_RMEM_CYC,              0x4002c)
+EVENT(PM_VSU0_SIMPLE_ISSUED,                  0x0b094)
+EVENT(PM_CMPLU_STALL_DIV,                     0x40014)
+EVENT(PM_MRK_PTEG_FROM_RL2L3_SHR,             0x2d054)
+EVENT(PM_VSU_FMA_DOUBLE,                      0x0a890)
+EVENT(PM_VSU_4FLOP,                           0x0a89c)
+EVENT(PM_VSU1_FIN,                            0x0a0be)
+EVENT(PM_NEST_PAIR1_AND,                      0x20883)
+EVENT(PM_INST_PTEG_FROM_RL2L3_MOD,            0x1e052)
+EVENT(PM_RUN_CYC,                             0x200f4)
+EVENT(PM_PTEG_FROM_RMEM,                      0x3c052)
+EVENT(PM_LSU_LRQ_S0_VALID,                    0x0d09e)
+EVENT(PM_LSU0_LDF,                            0x0c084)
+EVENT(PM_FLUSH_COMPLETION,                    0x30012)
+EVENT(PM_ST_MISS_L1,                          0x300f0)
+EVENT(PM_L2_NODE_PUMP,                        0x36480)
+EVENT(PM_INST_FROM_DL2L3_SHR,                 0x34044)
+EVENT(PM_MRK_STALL_CMPLU_CYC,                 0x3003e)
+EVENT(PM_VSU1_DENORM,                         0x0a0ae)
+EVENT(PM_MRK_DATA_FROM_L31_SHR_CYC,           0x20026)
+EVENT(PM_NEST_PAIR0_ADD,                      0x10881)
+EVENT(PM_INST_FROM_L3MISS,                    0x24048)
+EVENT(PM_EE_OFF_EXT_INT,                      0x02080)
+EVENT(PM_INST_PTEG_FROM_DMEM,                 0x2e052)
+EVENT(PM_INST_FROM_DL2L3_MOD,                 0x3404c)
+EVENT(PM_PMC6_OVERFLOW,                       0x30024)
+EVENT(PM_VSU_2FLOP_DOUBLE,                    0x0a88c)
+EVENT(PM_TLB_MISS,                            0x20066)
+EVENT(PM_FXU_BUSY,                            0x2000e)
+EVENT(PM_L2_RCLD_DISP_FAIL_OTHER,             0x26280)
+EVENT(PM_LSU_REJECT_LMQ_FULL,                 0x0c8a4)
+EVENT(PM_IC_RELOAD_SHR,                       0x04096)
+EVENT(PM_GRP_MRK,                             0x10031)
+EVENT(PM_MRK_ST_NEST,                         0x20034)
+EVENT(PM_VSU1_FSQRT_FDIV,                     0x0a08a)
+EVENT(PM_LSU0_FLUSH_LRQ,                      0x0c0b8)
+EVENT(PM_LARX_LSU0,                           0x0c094)
+EVENT(PM_IBUF_FULL_CYC,                       0x04084)
+EVENT(PM_MRK_DATA_FROM_DL2L3_SHR_CYC,         0x2002a)
+EVENT(PM_LSU_DC_PREF_STREAM_ALLOC,            0x0d8a8)
+EVENT(PM_GRP_MRK_CYC,                         0x10030)
+EVENT(PM_MRK_DATA_FROM_RL2L3_SHR_CYC,         0x20028)
+EVENT(PM_L2_GLOB_GUESS_CORRECT,               0x16482)
+EVENT(PM_LSU_REJECT_LHS,                      0x0c8ac)
+EVENT(PM_MRK_DATA_FROM_LMEM,                  0x3d04a)
+EVENT(PM_INST_PTEG_FROM_L3,                   0x2e050)
+EVENT(PM_FREQ_DOWN,                           0x3000c)
+EVENT(PM_PB_RETRY_NODE_PUMP,                  0x30081)
+EVENT(PM_INST_FROM_RL2L3_SHR,                 0x1404c)
+EVENT(PM_MRK_INST_ISSUED,                     0x10032)
+EVENT(PM_PTEG_FROM_L3MISS,                    0x2c058)
+EVENT(PM_RUN_PURR,                            0x400f4)
+EVENT(PM_MRK_GRP_IC_MISS,                     0x40038)
+EVENT(PM_MRK_DATA_FROM_L3,                    0x1d048)
+EVENT(PM_CMPLU_STALL_DCACHE_MISS,             0x20016)
+EVENT(PM_PTEG_FROM_RL2L3_SHR,                 0x2c054)
+EVENT(PM_LSU_FLUSH_LRQ,                       0x0c8b8)
+EVENT(PM_MRK_DERAT_MISS_64K,                  0x2d05c)
+EVENT(PM_INST_PTEG_FROM_DL2L3_MOD,            0x4e054)
+EVENT(PM_L2_ST_MISS,                          0x26082)
+EVENT(PM_MRK_PTEG_FROM_L21_SHR,               0x4d056)
+EVENT(PM_LWSYNC,                              0x0d094)
+EVENT(PM_LSU0_DC_PREF_STREAM_CONFIRM_STRIDE,  0x0d0bc)
+EVENT(PM_MRK_LSU_FLUSH_LRQ,                   0x0d088)
+EVENT(PM_INST_IMC_MATCH_CMPL,                 0x100f0)
+EVENT(PM_NEST_PAIR3_AND,                      0x40883)
+EVENT(PM_PB_RETRY_SYS_PUMP,                   0x40081)
+EVENT(PM_MRK_INST_FIN,                        0x30030)
+EVENT(PM_MRK_PTEG_FROM_DL2L3_SHR,             0x3d054)
+EVENT(PM_INST_FROM_L31_MOD,                   0x14044)
+EVENT(PM_MRK_DTLB_MISS_64K,                   0x3d05e)
+EVENT(PM_LSU_FIN,                             0x30066)
+EVENT(PM_MRK_LSU_REJECT,                      0x40064)
+EVENT(PM_L2_CO_FAIL_BUSY,                     0x16382)
+EVENT(PM_MEM0_WQ_DISP,                        0x40083)
+EVENT(PM_DATA_FROM_L31_MOD,                   0x1c044)
+EVENT(PM_THERMAL_WARN,                        0x10016)
+EVENT(PM_VSU0_4FLOP,                          0x0a09c)
+EVENT(PM_BR_MPRED_CCACHE,                     0x040a4)
+EVENT(PM_CMPLU_STALL_IFU,                     0x4004c)
+EVENT(PM_L1_DEMAND_WRITE,                     0x0408c)
+EVENT(PM_FLUSH_BR_MPRED,                      0x02084)
+EVENT(PM_MRK_DTLB_MISS_16G,                   0x1d05e)
+EVENT(PM_MRK_PTEG_FROM_DMEM,                  0x2d052)
+EVENT(PM_L2_RCST_DISP,                        0x36280)
+EVENT(PM_CMPLU_STALL,                         0x4000a)
+EVENT(PM_LSU_PARTIAL_CDF,                     0x0c0aa)
+EVENT(PM_DISP_CLB_HELD_SB,                    0x020a8)
+EVENT(PM_VSU0_FMA_DOUBLE,                     0x0a090)
+EVENT(PM_FXU0_BUSY_FXU1_IDLE,                 0x3000e)
+EVENT(PM_IC_DEMAND_CYC,                       0x10018)
+EVENT(PM_MRK_DATA_FROM_L21_SHR,               0x3d04e)
+EVENT(PM_MRK_LSU_FLUSH_UST,                   0x0d086)
+EVENT(PM_INST_PTEG_FROM_L3MISS,               0x2e058)
+EVENT(PM_VSU_DENORM,                          0x0a8ac)
+EVENT(PM_MRK_LSU_PARTIAL_CDF,                 0x0d080)
+EVENT(PM_INST_FROM_L21_SHR,                   0x3404e)
+EVENT(PM_IC_PREF_WRITE,                       0x0408e)
+EVENT(PM_BR_PRED,                             0x0409c)
+EVENT(PM_INST_FROM_DMEM,                      0x1404a)
+EVENT(PM_IC_PREF_CANCEL_ALL,                  0x04890)
+EVENT(PM_LSU_DC_PREF_STREAM_CONFIRM,          0x0d8b4)
+EVENT(PM_MRK_LSU_FLUSH_SRQ,                   0x0d08a)
+EVENT(PM_MRK_FIN_STALL_CYC,                   0x1003c)
+EVENT(PM_L2_RCST_DISP_FAIL_OTHER,             0x46280)
+EVENT(PM_VSU1_DD_ISSUED,                      0x0b098)
+EVENT(PM_PTEG_FROM_L31_SHR,                   0x2c056)
+EVENT(PM_DATA_FROM_L21_SHR,                   0x3c04e)
+EVENT(PM_LSU0_NCLD,                           0x0c08c)
+EVENT(PM_VSU1_4FLOP,                          0x0a09e)
+EVENT(PM_VSU1_8FLOP,                          0x0a0a2)
+EVENT(PM_VSU_8FLOP,                           0x0a8a0)
+EVENT(PM_LSU_LMQ_SRQ_EMPTY_CYC,               0x2003e)
+EVENT(PM_DTLB_MISS_64K,                       0x3c05e)
+EVENT(PM_THRD_CONC_RUN_INST,                  0x300f4)
+EVENT(PM_MRK_PTEG_FROM_L2,                    0x1d050)
+EVENT(PM_PB_SYS_PUMP,                         0x20081)
+EVENT(PM_VSU_FIN,                             0x0a8bc)
+EVENT(PM_MRK_DATA_FROM_L31_MOD,               0x1d044)
+EVENT(PM_THRD_PRIO_0_1_CYC,                   0x040b0)
+EVENT(PM_DERAT_MISS_64K,                      0x2c05c)
+EVENT(PM_PMC2_REWIND,                         0x30020)
+EVENT(PM_INST_FROM_L2,                        0x14040)
+EVENT(PM_GRP_BR_MPRED_NONSPEC,                0x1000a)
+EVENT(PM_INST_DISP,                           0x200f2)
+EVENT(PM_MEM0_RD_CANCEL_TOTAL,                0x30083)
+EVENT(PM_LSU0_DC_PREF_STREAM_CONFIRM,         0x0d0b4)
+EVENT(PM_L1_DCACHE_RELOAD_VALID,              0x300f6)
+EVENT(PM_VSU_SCALAR_DOUBLE_ISSUED,            0x0b888)
+EVENT(PM_L3_PREF_HIT,                         0x3f080)
+EVENT(PM_MRK_PTEG_FROM_L31_MOD,               0x1d054)
+EVENT(PM_CMPLU_STALL_STORE,                   0x2004a)
+EVENT(PM_MRK_FXU_FIN,                         0x20038)
+EVENT(PM_PMC4_OVERFLOW,                       0x10010)
+EVENT(PM_MRK_PTEG_FROM_L3,                    0x2d050)
+EVENT(PM_LSU0_LMQ_LHR_MERGE,                  0x0d098)
+EVENT(PM_BTAC_HIT,                            0x0508a)
+EVENT(PM_L3_RD_BUSY,                          0x4f082)
+EVENT(PM_LSU0_L1_SW_PREF,                     0x0c09c)
+EVENT(PM_INST_FROM_L2MISS,                    0x44048)
+EVENT(PM_LSU0_DC_PREF_STREAM_ALLOC,           0x0d0a8)
+EVENT(PM_L2_ST,                               0x16082)
+EVENT(PM_VSU0_DENORM,                         0x0a0ac)
+EVENT(PM_MRK_DATA_FROM_DL2L3_SHR,             0x3d044)
+EVENT(PM_BR_PRED_CR_TA,                       0x048aa)
+EVENT(PM_VSU0_FCONV,                          0x0a0b0)
+EVENT(PM_MRK_LSU_FLUSH_ULD,                   0x0d084)
+EVENT(PM_BTAC_MISS,                           0x05088)
+EVENT(PM_MRK_LD_MISS_EXPOSED_CYC_COUNT,       0x1003f)
+EVENT(PM_MRK_DATA_FROM_L2,                    0x1d040)
+EVENT(PM_LSU_DCACHE_RELOAD_VALID,             0x0d0a2)
+EVENT(PM_VSU_FMA,                             0x0a884)
+EVENT(PM_LSU0_FLUSH_SRQ,                      0x0c0bc)
+EVENT(PM_LSU1_L1_PREF,                        0x0d0ba)
+EVENT(PM_IOPS_CMPL,                           0x10014)
+EVENT(PM_L2_SYS_PUMP,                         0x36482)
+EVENT(PM_L2_RCLD_BUSY_RC_FULL,                0x46282)
+EVENT(PM_LSU_LMQ_S0_ALLOC,                    0x0d0a1)
+EVENT(PM_FLUSH_DISP_SYNC,                     0x02088)
+EVENT(PM_MRK_DATA_FROM_DL2L3_MOD_CYC,         0x4002a)
+EVENT(PM_L2_IC_INV,                           0x26180)
+EVENT(PM_MRK_DATA_FROM_L21_MOD_CYC,           0x40024)
+EVENT(PM_L3_PREF_LDST,                        0x0d8ac)
+EVENT(PM_LSU_SRQ_EMPTY_CYC,                   0x40008)
+EVENT(PM_LSU_LMQ_S0_VALID,                    0x0d0a0)
+EVENT(PM_FLUSH_PARTIAL,                       0x02086)
+EVENT(PM_VSU1_FMA_DOUBLE,                     0x0a092)
+EVENT(PM_1PLUS_PPC_DISP,                      0x400f2)
+EVENT(PM_DATA_FROM_L2MISS,                    0x200fe)
+EVENT(PM_SUSPENDED,                           0x00000)
+EVENT(PM_VSU0_FMA,                            0x0a084)
+EVENT(PM_CMPLU_STALL_SCALAR,                  0x40012)
+EVENT(PM_STCX_FAIL,                           0x0c09a)
+EVENT(PM_VSU0_FSQRT_FDIV_DOUBLE,              0x0a094)
+EVENT(PM_DC_PREF_DST,                         0x0d0b0)
+EVENT(PM_VSU1_SCAL_SINGLE_ISSUED,             0x0b086)
+EVENT(PM_L3_HIT,                              0x1f080)
+EVENT(PM_L2_GLOB_GUESS_WRONG,                 0x26482)
+EVENT(PM_MRK_DFU_FIN,                         0x20032)
+EVENT(PM_INST_FROM_L1,                        0x04080)
+EVENT(PM_BRU_FIN,                             0x10068)
+EVENT(PM_IC_DEMAND_REQ,                       0x04088)
+EVENT(PM_VSU1_FSQRT_FDIV_DOUBLE,              0x0a096)
+EVENT(PM_VSU1_FMA,                            0x0a086)
+EVENT(PM_MRK_LD_MISS_L1,                      0x20036)
+EVENT(PM_VSU0_2FLOP_DOUBLE,                   0x0a08c)
+EVENT(PM_LSU_DC_PREF_STRIDED_STREAM_CONFIRM,  0x0d8bc)
+EVENT(PM_INST_PTEG_FROM_L31_SHR,              0x2e056)
+EVENT(PM_MRK_LSU_REJECT_ERAT_MISS,            0x30064)
+EVENT(PM_MRK_DATA_FROM_L2MISS,                0x4d048)
+EVENT(PM_DATA_FROM_RL2L3_SHR,                 0x1c04c)
+EVENT(PM_INST_FROM_PREF,                      0x14046)
+EVENT(PM_VSU1_SQ,                             0x0b09e)
+EVENT(PM_L2_LD_DISP,                          0x36180)
+EVENT(PM_L2_DISP_ALL,                         0x46080)
+EVENT(PM_THRD_GRP_CMPL_BOTH_CYC,              0x10012)
+EVENT(PM_VSU_FSQRT_FDIV_DOUBLE,               0x0a894)
+EVENT(PM_BR_MPRED,                            0x400f6)
+EVENT(PM_INST_PTEG_FROM_DL2L3_SHR,            0x3e054)
+EVENT(PM_VSU_1FLOP,                           0x0a880)
+EVENT(PM_HV_CYC,                              0x2000a)
+EVENT(PM_MRK_LSU_FIN,                         0x40032)
+EVENT(PM_MRK_DATA_FROM_RL2L3_SHR,             0x1d04c)
+EVENT(PM_DTLB_MISS_16M,                       0x4c05e)
+EVENT(PM_LSU1_LMQ_LHR_MERGE,                  0x0d09a)
+EVENT(PM_IFU_FIN,                             0x40066)
diff --git a/arch/powerpc/perf/power7-pmu.c b/arch/powerpc/perf/power7-pmu.c
index d1821b8bbc4c..56c67bca2f75 100644
--- a/arch/powerpc/perf/power7-pmu.c
+++ b/arch/powerpc/perf/power7-pmu.c
@@ -53,37 +53,13 @@
 /*
  * Power7 event codes.
  */
-#define PME_PM_CYC                      0x1e
-#define PME_PM_GCT_NOSLOT_CYC           0x100f8
-#define PME_PM_CMPLU_STALL              0x4000a
-#define PME_PM_INST_CMPL                0x2
-#define PME_PM_LD_REF_L1                0xc880
-#define PME_PM_LD_MISS_L1               0x400f0
-#define PME_PM_BRU_FIN                  0x10068
-#define PME_PM_BR_MPRED                 0x400f6
-
-#define PME_PM_CMPLU_STALL_FXU                  0x20014
-#define PME_PM_CMPLU_STALL_DIV                  0x40014
-#define PME_PM_CMPLU_STALL_SCALAR               0x40012
-#define PME_PM_CMPLU_STALL_SCALAR_LONG          0x20018
-#define PME_PM_CMPLU_STALL_VECTOR               0x2001c
-#define PME_PM_CMPLU_STALL_VECTOR_LONG          0x4004a
-#define PME_PM_CMPLU_STALL_LSU                  0x20012
-#define PME_PM_CMPLU_STALL_REJECT               0x40016
-#define PME_PM_CMPLU_STALL_ERAT_MISS            0x40018
-#define PME_PM_CMPLU_STALL_DCACHE_MISS          0x20016
-#define PME_PM_CMPLU_STALL_STORE                0x2004a
-#define PME_PM_CMPLU_STALL_THRD                 0x1001c
-#define PME_PM_CMPLU_STALL_IFU                  0x4004c
-#define PME_PM_CMPLU_STALL_BRU                  0x4004e
-#define PME_PM_GCT_NOSLOT_IC_MISS               0x2001a
-#define PME_PM_GCT_NOSLOT_BR_MPRED              0x4001a
-#define PME_PM_GCT_NOSLOT_BR_MPRED_IC_MISS      0x4001c
-#define PME_PM_GRP_CMPL                         0x30004
-#define PME_PM_1PLUS_PPC_CMPL                   0x100f2
-#define PME_PM_CMPLU_STALL_DFU                  0x2003c
-#define PME_PM_RUN_CYC                          0x200f4
-#define PME_PM_RUN_INST_CMPL                    0x400fa
+#define EVENT(_name, _code) \
+        PME_##_name = _code,
+
+enum {
+#include "power7-events-list.h"
+};
+#undef EVENT
 
 /*
  * Layout of constraint bits:
@@ -398,96 +374,36 @@ static int power7_cache_events[C(MAX)][C(OP_MAX)][C(RESULT_MAX)] = {
 };
 
 
-GENERIC_EVENT_ATTR(cpu-cycles,                  CYC);
-GENERIC_EVENT_ATTR(stalled-cycles-frontend,     GCT_NOSLOT_CYC);
-GENERIC_EVENT_ATTR(stalled-cycles-backend,      CMPLU_STALL);
-GENERIC_EVENT_ATTR(instructions,                INST_CMPL);
-GENERIC_EVENT_ATTR(cache-references,            LD_REF_L1);
-GENERIC_EVENT_ATTR(cache-misses,                LD_MISS_L1);
-GENERIC_EVENT_ATTR(branch-instructions,         BRU_FIN);
-GENERIC_EVENT_ATTR(branch-misses,               BR_MPRED);
-
-POWER_EVENT_ATTR(CYC,                           CYC);
-POWER_EVENT_ATTR(GCT_NOSLOT_CYC,                GCT_NOSLOT_CYC);
-POWER_EVENT_ATTR(CMPLU_STALL,                   CMPLU_STALL);
-POWER_EVENT_ATTR(INST_CMPL,                     INST_CMPL);
-POWER_EVENT_ATTR(LD_REF_L1,                     LD_REF_L1);
-POWER_EVENT_ATTR(LD_MISS_L1,                    LD_MISS_L1);
-POWER_EVENT_ATTR(BRU_FIN,                       BRU_FIN)
-POWER_EVENT_ATTR(BR_MPRED,                      BR_MPRED);
-
-POWER_EVENT_ATTR(CMPLU_STALL_FXU,               CMPLU_STALL_FXU);
-POWER_EVENT_ATTR(CMPLU_STALL_DIV,               CMPLU_STALL_DIV);
-POWER_EVENT_ATTR(CMPLU_STALL_SCALAR,            CMPLU_STALL_SCALAR);
-POWER_EVENT_ATTR(CMPLU_STALL_SCALAR_LONG,       CMPLU_STALL_SCALAR_LONG);
-POWER_EVENT_ATTR(CMPLU_STALL_VECTOR,            CMPLU_STALL_VECTOR);
-POWER_EVENT_ATTR(CMPLU_STALL_VECTOR_LONG,       CMPLU_STALL_VECTOR_LONG);
-POWER_EVENT_ATTR(CMPLU_STALL_LSU,               CMPLU_STALL_LSU);
-POWER_EVENT_ATTR(CMPLU_STALL_REJECT,            CMPLU_STALL_REJECT);
-
-POWER_EVENT_ATTR(CMPLU_STALL_ERAT_MISS,         CMPLU_STALL_ERAT_MISS);
-POWER_EVENT_ATTR(CMPLU_STALL_DCACHE_MISS,       CMPLU_STALL_DCACHE_MISS);
-POWER_EVENT_ATTR(CMPLU_STALL_STORE,             CMPLU_STALL_STORE);
-POWER_EVENT_ATTR(CMPLU_STALL_THRD,              CMPLU_STALL_THRD);
-POWER_EVENT_ATTR(CMPLU_STALL_IFU,               CMPLU_STALL_IFU);
-POWER_EVENT_ATTR(CMPLU_STALL_BRU,               CMPLU_STALL_BRU);
-POWER_EVENT_ATTR(GCT_NOSLOT_IC_MISS,            GCT_NOSLOT_IC_MISS);
-
-POWER_EVENT_ATTR(GCT_NOSLOT_BR_MPRED,           GCT_NOSLOT_BR_MPRED);
-POWER_EVENT_ATTR(GCT_NOSLOT_BR_MPRED_IC_MISS,   GCT_NOSLOT_BR_MPRED_IC_MISS);
-POWER_EVENT_ATTR(GRP_CMPL,                      GRP_CMPL);
-POWER_EVENT_ATTR(1PLUS_PPC_CMPL,                1PLUS_PPC_CMPL);
-POWER_EVENT_ATTR(CMPLU_STALL_DFU,               CMPLU_STALL_DFU);
-POWER_EVENT_ATTR(RUN_CYC,                       RUN_CYC);
-POWER_EVENT_ATTR(RUN_INST_CMPL,                 RUN_INST_CMPL);
+GENERIC_EVENT_ATTR(cpu-cycles,                  PM_CYC);
+GENERIC_EVENT_ATTR(stalled-cycles-frontend,     PM_GCT_NOSLOT_CYC);
+GENERIC_EVENT_ATTR(stalled-cycles-backend,      PM_CMPLU_STALL);
+GENERIC_EVENT_ATTR(instructions,                PM_INST_CMPL);
+GENERIC_EVENT_ATTR(cache-references,            PM_LD_REF_L1);
+GENERIC_EVENT_ATTR(cache-misses,                PM_LD_MISS_L1);
+GENERIC_EVENT_ATTR(branch-instructions,         PM_BRU_FIN);
+GENERIC_EVENT_ATTR(branch-misses,               PM_BR_MPRED);
+
+#define EVENT(_name, _code)     POWER_EVENT_ATTR(_name, _name);
+#include "power7-events-list.h"
+#undef EVENT
+
+#define EVENT(_name, _code)     POWER_EVENT_PTR(_name),
 
 static struct attribute *power7_events_attr[] = {
-        GENERIC_EVENT_PTR(CYC),
-        GENERIC_EVENT_PTR(GCT_NOSLOT_CYC),
-        GENERIC_EVENT_PTR(CMPLU_STALL),
-        GENERIC_EVENT_PTR(INST_CMPL),
-        GENERIC_EVENT_PTR(LD_REF_L1),
-        GENERIC_EVENT_PTR(LD_MISS_L1),
-        GENERIC_EVENT_PTR(BRU_FIN),
-        GENERIC_EVENT_PTR(BR_MPRED),
-
-        POWER_EVENT_PTR(CYC),
-        POWER_EVENT_PTR(GCT_NOSLOT_CYC),
-        POWER_EVENT_PTR(CMPLU_STALL),
-        POWER_EVENT_PTR(INST_CMPL),
-        POWER_EVENT_PTR(LD_REF_L1),
-        POWER_EVENT_PTR(LD_MISS_L1),
-        POWER_EVENT_PTR(BRU_FIN),
-        POWER_EVENT_PTR(BR_MPRED),
-
-        POWER_EVENT_PTR(CMPLU_STALL_FXU),
-        POWER_EVENT_PTR(CMPLU_STALL_DIV),
-        POWER_EVENT_PTR(CMPLU_STALL_SCALAR),
-        POWER_EVENT_PTR(CMPLU_STALL_SCALAR_LONG),
-        POWER_EVENT_PTR(CMPLU_STALL_VECTOR),
-        POWER_EVENT_PTR(CMPLU_STALL_VECTOR_LONG),
-        POWER_EVENT_PTR(CMPLU_STALL_LSU),
-        POWER_EVENT_PTR(CMPLU_STALL_REJECT),
-
-        POWER_EVENT_PTR(CMPLU_STALL_ERAT_MISS),
-        POWER_EVENT_PTR(CMPLU_STALL_DCACHE_MISS),
-        POWER_EVENT_PTR(CMPLU_STALL_STORE),
-        POWER_EVENT_PTR(CMPLU_STALL_THRD),
-        POWER_EVENT_PTR(CMPLU_STALL_IFU),
-        POWER_EVENT_PTR(CMPLU_STALL_BRU),
-        POWER_EVENT_PTR(GCT_NOSLOT_IC_MISS),
-        POWER_EVENT_PTR(GCT_NOSLOT_BR_MPRED),
-
-        POWER_EVENT_PTR(GCT_NOSLOT_BR_MPRED_IC_MISS),
-        POWER_EVENT_PTR(GRP_CMPL),
-        POWER_EVENT_PTR(1PLUS_PPC_CMPL),
-        POWER_EVENT_PTR(CMPLU_STALL_DFU),
-        POWER_EVENT_PTR(RUN_CYC),
-        POWER_EVENT_PTR(RUN_INST_CMPL),
+        GENERIC_EVENT_PTR(PM_CYC),
+        GENERIC_EVENT_PTR(PM_GCT_NOSLOT_CYC),
+        GENERIC_EVENT_PTR(PM_CMPLU_STALL),
+        GENERIC_EVENT_PTR(PM_INST_CMPL),
+        GENERIC_EVENT_PTR(PM_LD_REF_L1),
+        GENERIC_EVENT_PTR(PM_LD_MISS_L1),
+        GENERIC_EVENT_PTR(PM_BRU_FIN),
+        GENERIC_EVENT_PTR(PM_BR_MPRED),
+
+        #include "power7-events-list.h"
+        #undef EVENT
         NULL
 };
 
-
 static struct attribute_group power7_pmu_events_group = {
         .name = "events",
         .attrs = power7_events_attr,
diff --git a/arch/powerpc/platforms/44x/warp.c b/arch/powerpc/platforms/44x/warp.c
index 4cfa49901c02..534574a97ec9 100644
--- a/arch/powerpc/platforms/44x/warp.c
+++ b/arch/powerpc/platforms/44x/warp.c
@@ -16,7 +16,6 @@
 #include <linux/interrupt.h>
 #include <linux/delay.h>
 #include <linux/of_gpio.h>
-#include <linux/of_i2c.h>
 #include <linux/slab.h>
 #include <linux/export.h>
 
diff --git a/arch/powerpc/platforms/52xx/mpc52xx_pic.c b/arch/powerpc/platforms/52xx/mpc52xx_pic.c
index b89ef65392dc..b69221ba07fd 100644
--- a/arch/powerpc/platforms/52xx/mpc52xx_pic.c
+++ b/arch/powerpc/platforms/52xx/mpc52xx_pic.c
@@ -373,8 +373,9 @@ static int mpc52xx_irqhost_map(struct irq_domain *h, unsigned int virq,
         case MPC52xx_IRQ_L1_PERP: irqchip = &mpc52xx_periph_irqchip; break;
         case MPC52xx_IRQ_L1_SDMA: irqchip = &mpc52xx_sdma_irqchip; break;
         case MPC52xx_IRQ_L1_CRIT:
+        default:
                 pr_warn("%s: Critical IRQ #%d is unsupported! Nopping it.\n",
-                        __func__, l2irq);
+                        __func__, l1irq);
                 irq_set_chip(virq, &no_irq_chip);
                 return 0;
         }
diff --git a/arch/powerpc/platforms/85xx/Kconfig b/arch/powerpc/platforms/85xx/Kconfig
index efdd37c775ad..de2eb9320993 100644
--- a/arch/powerpc/platforms/85xx/Kconfig
+++ b/arch/powerpc/platforms/85xx/Kconfig
@@ -32,6 +32,12 @@ config BSC9131_RDB
           StarCore SC3850 DSP
           Manufacturer : Freescale Semiconductor, Inc
 
+config C293_PCIE
+          bool "Freescale C293PCIE"
+          select DEFAULT_UIMAGE
+          help
+          This option enables support for the C293PCIE board
+
 config MPC8540_ADS
         bool "Freescale MPC8540 ADS"
         select DEFAULT_UIMAGE
@@ -112,10 +118,10 @@ config P1022_RDK
           reference board.
 
 config P1023_RDS
-        bool "Freescale P1023 RDS"
+        bool "Freescale P1023 RDS/RDB"
         select DEFAULT_UIMAGE
         help
-          This option enables support for the P1023 RDS board
+          This option enables support for the P1023 RDS and RDB boards
 
 config SOCRATES
         bool "Socrates"
diff --git a/arch/powerpc/platforms/85xx/Makefile b/arch/powerpc/platforms/85xx/Makefile
index 2eab37ea4a9d..53c9f75a6907 100644
--- a/arch/powerpc/platforms/85xx/Makefile
+++ b/arch/powerpc/platforms/85xx/Makefile
@@ -6,6 +6,7 @@ obj-$(CONFIG_SMP) += smp.o
 obj-y += common.o
 
 obj-$(CONFIG_BSC9131_RDB) += bsc913x_rdb.o
+obj-$(CONFIG_C293_PCIE)   += c293pcie.o
 obj-$(CONFIG_MPC8540_ADS) += mpc85xx_ads.o
 obj-$(CONFIG_MPC8560_ADS) += mpc85xx_ads.o
 obj-$(CONFIG_MPC85xx_CDS) += mpc85xx_cds.o
diff --git a/arch/powerpc/platforms/85xx/c293pcie.c b/arch/powerpc/platforms/85xx/c293pcie.c
new file mode 100644
index 000000000000..6208e49142bf
--- /dev/null
+++ b/arch/powerpc/platforms/85xx/c293pcie.c
@@ -0,0 +1,75 @@
+/*
+ * C293PCIE Board Setup
+ *
+ * Copyright 2013 Freescale Semiconductor Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/stddef.h>
+#include <linux/kernel.h>
+#include <linux/of_platform.h>
+
+#include <asm/machdep.h>
+#include <asm/udbg.h>
+#include <asm/mpic.h>
+
+#include <sysdev/fsl_soc.h>
+#include <sysdev/fsl_pci.h>
+
+#include "mpc85xx.h"
+
+void __init c293_pcie_pic_init(void)
+{
+        struct mpic *mpic = mpic_alloc(NULL, 0, MPIC_BIG_ENDIAN |
+          MPIC_SINGLE_DEST_CPU, 0, 256, " OpenPIC  ");
+
+        BUG_ON(mpic == NULL);
+
+        mpic_init(mpic);
+}
+
+
+/*
+ * Setup the architecture
+ */
+static void __init c293_pcie_setup_arch(void)
+{
+        if (ppc_md.progress)
+                ppc_md.progress("c293_pcie_setup_arch()", 0);
+
+        fsl_pci_assign_primary();
+
+        printk(KERN_INFO "C293 PCIE board from Freescale Semiconductor\n");
+}
+
+machine_arch_initcall(c293_pcie, mpc85xx_common_publish_devices);
+
+/*
+ * Called very early, device-tree isn't unflattened
+ */
+static int __init c293_pcie_probe(void)
+{
+        unsigned long root = of_get_flat_dt_root();
+
+        if (of_flat_dt_is_compatible(root, "fsl,C293PCIE"))
+                return 1;
+        return 0;
+}
+
+define_machine(c293_pcie) {
+        .name                   = "C293 PCIE",
+        .probe                  = c293_pcie_probe,
+        .setup_arch             = c293_pcie_setup_arch,
+        .init_IRQ               = c293_pcie_pic_init,
+#ifdef CONFIG_PCI
+        .pcibios_fixup_bus      = fsl_pcibios_fixup_bus,
+#endif
+        .get_irq                = mpic_get_irq,
+        .restart                = fsl_rstcr_restart,
+        .calibrate_decr         = generic_calibrate_decr,
+        .progress               = udbg_progress,
+};
diff --git a/arch/powerpc/platforms/85xx/corenet_ds.c b/arch/powerpc/platforms/85xx/corenet_ds.c
index c59c617eee93..aa3690bae415 100644
--- a/arch/powerpc/platforms/85xx/corenet_ds.c
+++ b/arch/powerpc/platforms/85xx/corenet_ds.c
@@ -53,12 +53,6 @@ void __init corenet_ds_setup_arch(void)
 {
         mpc85xx_smp_init();
 
-#if defined(CONFIG_PCI) && defined(CONFIG_PPC64)
-        pci_devs_phb_init();
-#endif
-
-        fsl_pci_assign_primary();
-
         swiotlb_detect_4g();
 
         pr_info("%s board from Freescale Semiconductor\n", ppc_md.name);
diff --git a/arch/powerpc/platforms/85xx/mpc85xx_rdb.c b/arch/powerpc/platforms/85xx/mpc85xx_rdb.c
index ede8771d6f02..53b6fb0a3d56 100644
--- a/arch/powerpc/platforms/85xx/mpc85xx_rdb.c
+++ b/arch/powerpc/platforms/85xx/mpc85xx_rdb.c
@@ -160,6 +160,7 @@ machine_arch_initcall(p2020_rdb_pc, mpc85xx_common_publish_devices);
 machine_arch_initcall(p1020_mbg_pc, mpc85xx_common_publish_devices);
 machine_arch_initcall(p1020_rdb, mpc85xx_common_publish_devices);
 machine_arch_initcall(p1020_rdb_pc, mpc85xx_common_publish_devices);
+machine_arch_initcall(p1020_rdb_pd, mpc85xx_common_publish_devices);
 machine_arch_initcall(p1020_utm_pc, mpc85xx_common_publish_devices);
 machine_arch_initcall(p1021_rdb_pc, mpc85xx_common_publish_devices);
 machine_arch_initcall(p1025_rdb, mpc85xx_common_publish_devices);
@@ -193,6 +194,13 @@ static int __init p1020_rdb_pc_probe(void)
         return of_flat_dt_is_compatible(root, "fsl,P1020RDB-PC");
 }
 
+static int __init p1020_rdb_pd_probe(void)
+{
+        unsigned long root = of_get_flat_dt_root();
+
+        return of_flat_dt_is_compatible(root, "fsl,P1020RDB-PD");
+}
+
 static int __init p1021_rdb_pc_probe(void)
 {
         unsigned long root = of_get_flat_dt_root();
@@ -351,6 +359,20 @@ define_machine(p1020_rdb_pc) {
         .progress               = udbg_progress,
 };
 
+define_machine(p1020_rdb_pd) {
+        .name                   = "P1020RDB-PD",
+        .probe                  = p1020_rdb_pd_probe,
+        .setup_arch             = mpc85xx_rdb_setup_arch,
+        .init_IRQ               = mpc85xx_rdb_pic_init,
+#ifdef CONFIG_PCI
+        .pcibios_fixup_bus      = fsl_pcibios_fixup_bus,
+#endif
+        .get_irq                = mpic_get_irq,
+        .restart                = fsl_rstcr_restart,
+        .calibrate_decr         = generic_calibrate_decr,
+        .progress               = udbg_progress,
+};
+
 define_machine(p1024_rdb) {
         .name                   = "P1024 RDB",
         .probe                  = p1024_rdb_probe,
diff --git a/arch/powerpc/platforms/85xx/p1023_rds.c b/arch/powerpc/platforms/85xx/p1023_rds.c
index 9cc60a738834..2ae9d490c3d9 100644
--- a/arch/powerpc/platforms/85xx/p1023_rds.c
+++ b/arch/powerpc/platforms/85xx/p1023_rds.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2010-2011 Freescale Semiconductor, Inc.
+ * Copyright 2010-2011, 2013 Freescale Semiconductor, Inc.
  *
  * Author: Roy Zang <tie-fei.zang@freescale.com>
  *
@@ -86,6 +86,7 @@ static void __init mpc85xx_rds_setup_arch(void)
 }
 
 machine_arch_initcall(p1023_rds, mpc85xx_common_publish_devices);
+machine_arch_initcall(p1023_rdb, mpc85xx_common_publish_devices);
 
 static void __init mpc85xx_rds_pic_init(void)
 {
@@ -106,6 +107,14 @@ static int __init p1023_rds_probe(void)
 
 }
 
+static int __init p1023_rdb_probe(void)
+{
+        unsigned long root = of_get_flat_dt_root();
+
+        return of_flat_dt_is_compatible(root, "fsl,P1023RDB");
+
+}
+
 define_machine(p1023_rds) {
         .name                   = "P1023 RDS",
         .probe                  = p1023_rds_probe,
@@ -120,3 +129,16 @@ define_machine(p1023_rds) {
 #endif
 };
 
+define_machine(p1023_rdb) {
+        .name                   = "P1023 RDB",
+        .probe                  = p1023_rdb_probe,
+        .setup_arch             = mpc85xx_rds_setup_arch,
+        .init_IRQ               = mpc85xx_rds_pic_init,
+        .get_irq                = mpic_get_irq,
+        .restart                = fsl_rstcr_restart,
+        .calibrate_decr         = generic_calibrate_decr,
+        .progress               = udbg_progress,
+#ifdef CONFIG_PCI
+        .pcibios_fixup_bus      = fsl_pcibios_fixup_bus,
+#endif
+};
diff --git a/arch/powerpc/platforms/85xx/smp.c b/arch/powerpc/platforms/85xx/smp.c
index 5ced4f5bb2b2..281b7f01df63 100644
--- a/arch/powerpc/platforms/85xx/smp.c
+++ b/arch/powerpc/platforms/85xx/smp.c
@@ -69,7 +69,32 @@ static void mpc85xx_give_timebase(void)
         tb_req = 0;
 
         mpc85xx_timebase_freeze(1);
+#ifdef CONFIG_PPC64
+        /*
+         * e5500/e6500 have a workaround for erratum A-006958 in place
+         * that will reread the timebase until TBL is non-zero.
+         * That would be a bad thing when the timebase is frozen.
+         *
+         * Thus, we read it manually, and instead of checking that
+         * TBL is non-zero, we ensure that TB does not change.  We don't
+         * do that for the main mftb implementation, because it requires
+         * a scratch register
+         */
+        {
+                u64 prev;
+
+                asm volatile("mfspr %0, %1" : "=r" (timebase) :
+                             "i" (SPRN_TBRL));
+
+                do {
+                        prev = timebase;
+                        asm volatile("mfspr %0, %1" : "=r" (timebase) :
+                                     "i" (SPRN_TBRL));
+                } while (prev != timebase);
+        }
+#else
         timebase = get_tb();
+#endif
         mb();
         tb_valid = 1;
 
@@ -255,6 +280,7 @@ out:
 
 struct smp_ops_t smp_85xx_ops = {
         .kick_cpu = smp_85xx_kick_cpu,
+        .cpu_bootable = smp_generic_cpu_bootable,
 #ifdef CONFIG_HOTPLUG_CPU
         .cpu_disable    = generic_cpu_disable,
         .cpu_die        = generic_cpu_die,
diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
index d703775bda30..bf9c6d4cd26c 100644
--- a/arch/powerpc/platforms/Kconfig
+++ b/arch/powerpc/platforms/Kconfig
@@ -202,17 +202,12 @@ config PPC_P7_NAP
         bool
         default n
 
-config PPC_INDIRECT_IO
-        bool
-        select GENERIC_IOMAP
-
 config PPC_INDIRECT_PIO
         bool
-        select PPC_INDIRECT_IO
+        select GENERIC_IOMAP
 
 config PPC_INDIRECT_MMIO
         bool
-        select PPC_INDIRECT_IO
 
 config PPC_IO_WORKAROUNDS
         bool
diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype
index 47d9a03dd415..6704e2e20e6b 100644
--- a/arch/powerpc/platforms/Kconfig.cputype
+++ b/arch/powerpc/platforms/Kconfig.cputype
@@ -96,18 +96,31 @@ config GENERIC_CPU
 
 config CELL_CPU
         bool "Cell Broadband Engine"
+        depends on PPC_BOOK3S_64
 
 config POWER4_CPU
         bool "POWER4"
+        depends on PPC_BOOK3S_64
 
 config POWER5_CPU
         bool "POWER5"
+        depends on PPC_BOOK3S_64
 
 config POWER6_CPU
         bool "POWER6"
+        depends on PPC_BOOK3S_64
 
 config POWER7_CPU
         bool "POWER7"
+        depends on PPC_BOOK3S_64
+
+config E5500_CPU
+        bool "Freescale e5500"
+        depends on E500
+
+config E6500_CPU
+        bool "Freescale e6500"
+        depends on E500
 
 endchoice
 
diff --git a/arch/powerpc/platforms/cell/iommu.c b/arch/powerpc/platforms/cell/iommu.c
index 946306b1bb4e..b53560660b72 100644
--- a/arch/powerpc/platforms/cell/iommu.c
+++ b/arch/powerpc/platforms/cell/iommu.c
@@ -697,7 +697,7 @@ static int __init cell_iommu_get_window(struct device_node *np,
                                          unsigned long *base,
                                          unsigned long *size)
 {
-        const void *dma_window;
+        const __be32 *dma_window;
         unsigned long index;
 
         /* Use ibm,dma-window if available, else, hard code ! */
diff --git a/arch/powerpc/platforms/cell/smp.c b/arch/powerpc/platforms/cell/smp.c
index f75f6fcac729..90745eaa45fe 100644
--- a/arch/powerpc/platforms/cell/smp.c
+++ b/arch/powerpc/platforms/cell/smp.c
@@ -136,25 +136,12 @@ static int smp_cell_kick_cpu(int nr)
         return 0;
 }
 
-static int smp_cell_cpu_bootable(unsigned int nr)
-{
-        /* Special case - we inhibit secondary thread startup
-         * during boot if the user requests it.  Odd-numbered
-         * cpus are assumed to be secondary threads.
-         */
-        if (system_state == SYSTEM_BOOTING &&
-            cpu_has_feature(CPU_FTR_SMT) &&
-            !smt_enabled_at_boot && cpu_thread_in_core(nr) != 0)
-                return 0;
-
-        return 1;
-}
 static struct smp_ops_t bpa_iic_smp_ops = {
         .message_pass   = iic_message_pass,
         .probe          = smp_iic_probe,
         .kick_cpu       = smp_cell_kick_cpu,
         .setup_cpu      = smp_cell_setup_cpu,
-        .cpu_bootable   = smp_cell_cpu_bootable,
+        .cpu_bootable   = smp_generic_cpu_bootable,
 };
 
 /* This is called very early */
diff --git a/arch/powerpc/platforms/powernv/Kconfig b/arch/powerpc/platforms/powernv/Kconfig
index c24684c818ab..6fae5eb99ea6 100644
--- a/arch/powerpc/platforms/powernv/Kconfig
+++ b/arch/powerpc/platforms/powernv/Kconfig
@@ -7,6 +7,8 @@ config PPC_POWERNV
         select PPC_P7_NAP
         select PPC_PCI_CHOICE if EMBEDDED
         select EPAPR_BOOT
+        select PPC_INDIRECT_PIO
+        select PPC_UDBG_16550
         default y
 
 config POWERNV_MSI
diff --git a/arch/powerpc/platforms/powernv/Makefile b/arch/powerpc/platforms/powernv/Makefile
index 7fe595152478..300c437d713c 100644
--- a/arch/powerpc/platforms/powernv/Makefile
+++ b/arch/powerpc/platforms/powernv/Makefile
@@ -1,5 +1,5 @@
 obj-y                   += setup.o opal-takeover.o opal-wrappers.o opal.o
-obj-y                   += opal-rtc.o opal-nvram.o
+obj-y                   += opal-rtc.o opal-nvram.o opal-lpc.o
 
 obj-$(CONFIG_SMP)       += smp.o
 obj-$(CONFIG_PCI)       += pci.o pci-p5ioc2.o pci-ioda.o
diff --git a/arch/powerpc/platforms/powernv/eeh-ioda.c b/arch/powerpc/platforms/powernv/eeh-ioda.c
index 0cd1c4a71755..cf42e74514fa 100644
--- a/arch/powerpc/platforms/powernv/eeh-ioda.c
+++ b/arch/powerpc/platforms/powernv/eeh-ioda.c
@@ -36,13 +36,6 @@
 #include "powernv.h"
 #include "pci.h"
 
-/* Debugging option */
-#ifdef IODA_EEH_DBG_ON
-#define IODA_EEH_DBG(args...)   pr_info(args)
-#else
-#define IODA_EEH_DBG(args...)
-#endif
-
 static char *hub_diag = NULL;
 static int ioda_eeh_nb_init = 0;
 
@@ -823,17 +816,17 @@ static int ioda_eeh_next_error(struct eeh_pe **pe)
 
                 /* If OPAL API returns error, we needn't proceed */
                 if (rc != OPAL_SUCCESS) {
-                        IODA_EEH_DBG("%s: Invalid return value on "
-                                     "PHB#%x (0x%lx) from opal_pci_next_error",
-                                     __func__, hose->global_number, rc);
+                        pr_devel("%s: Invalid return value on "
+                                 "PHB#%x (0x%lx) from opal_pci_next_error",
+                                 __func__, hose->global_number, rc);
                         continue;
                 }
 
                 /* If the PHB doesn't have error, stop processing */
                 if (err_type == OPAL_EEH_NO_ERROR ||
                     severity == OPAL_EEH_SEV_NO_ERROR) {
-                        IODA_EEH_DBG("%s: No error found on PHB#%x\n",
-                                     __func__, hose->global_number);
+                        pr_devel("%s: No error found on PHB#%x\n",
+                                 __func__, hose->global_number);
                         continue;
                 }
 
@@ -842,8 +835,9 @@ static int ioda_eeh_next_error(struct eeh_pe **pe)
                  * highest priority reported upon multiple errors on the
                  * specific PHB.
                  */
-                IODA_EEH_DBG("%s: Error (%d, %d, %d) on PHB#%x\n",
-                        err_type, severity, pe_no, hose->global_number);
+                pr_devel("%s: Error (%d, %d, %llu) on PHB#%x\n",
+                         __func__, err_type, severity,
+                         frozen_pe_no, hose->global_number);
                 switch (err_type) {
                 case OPAL_EEH_IOC_ERROR:
                         if (severity == OPAL_EEH_SEV_IOC_DEAD) {
diff --git a/arch/powerpc/platforms/powernv/opal-lpc.c b/arch/powerpc/platforms/powernv/opal-lpc.c
new file mode 100644
index 000000000000..a7614bb14e17
--- /dev/null
+++ b/arch/powerpc/platforms/powernv/opal-lpc.c
@@ -0,0 +1,203 @@
+/*
+ * PowerNV LPC bus handling.
+ *
+ * Copyright 2013 IBM Corp.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/kernel.h>
+#include <linux/of.h>
+#include <linux/bug.h>
+
+#include <asm/machdep.h>
+#include <asm/firmware.h>
+#include <asm/xics.h>
+#include <asm/opal.h>
+
+static int opal_lpc_chip_id = -1;
+
+static u8 opal_lpc_inb(unsigned long port)
+{
+        int64_t rc;
+        uint32_t data;
+
+        if (opal_lpc_chip_id < 0 || port > 0xffff)
+                return 0xff;
+        rc = opal_lpc_read(opal_lpc_chip_id, OPAL_LPC_IO, port, &data, 1);
+        return rc ? 0xff : data;
+}
+
+static __le16 __opal_lpc_inw(unsigned long port)
+{
+        int64_t rc;
+        uint32_t data;
+
+        if (opal_lpc_chip_id < 0 || port > 0xfffe)
+                return 0xffff;
+        if (port & 1)
+                return (__le16)opal_lpc_inb(port) << 8 | opal_lpc_inb(port + 1);
+        rc = opal_lpc_read(opal_lpc_chip_id, OPAL_LPC_IO, port, &data, 2);
+        return rc ? 0xffff : data;
+}
+static u16 opal_lpc_inw(unsigned long port)
+{
+        return le16_to_cpu(__opal_lpc_inw(port));
+}
+
+static __le32 __opal_lpc_inl(unsigned long port)
+{
+        int64_t rc;
+        uint32_t data;
+
+        if (opal_lpc_chip_id < 0 || port > 0xfffc)
+                return 0xffffffff;
+        if (port & 3)
+                return (__le32)opal_lpc_inb(port    ) << 24 |
+                       (__le32)opal_lpc_inb(port + 1) << 16 |
+                       (__le32)opal_lpc_inb(port + 2) <<  8 |
+                               opal_lpc_inb(port + 3);
+        rc = opal_lpc_read(opal_lpc_chip_id, OPAL_LPC_IO, port, &data, 4);
+        return rc ? 0xffffffff : data;
+}
+
+static u32 opal_lpc_inl(unsigned long port)
+{
+        return le32_to_cpu(__opal_lpc_inl(port));
+}
+
+static void opal_lpc_outb(u8 val, unsigned long port)
+{
+        if (opal_lpc_chip_id < 0 || port > 0xffff)
+                return;
+        opal_lpc_write(opal_lpc_chip_id, OPAL_LPC_IO, port, val, 1);
+}
+
+static void __opal_lpc_outw(__le16 val, unsigned long port)
+{
+        if (opal_lpc_chip_id < 0 || port > 0xfffe)
+                return;
+        if (port & 1) {
+                opal_lpc_outb(val >> 8, port);
+                opal_lpc_outb(val     , port + 1);
+                return;
+        }
+        opal_lpc_write(opal_lpc_chip_id, OPAL_LPC_IO, port, val, 2);
+}
+
+static void opal_lpc_outw(u16 val, unsigned long port)
+{
+        __opal_lpc_outw(cpu_to_le16(val), port);
+}
+
+static void __opal_lpc_outl(__le32 val, unsigned long port)
+{
+        if (opal_lpc_chip_id < 0 || port > 0xfffc)
+                return;
+        if (port & 3) {
+                opal_lpc_outb(val >> 24, port);
+                opal_lpc_outb(val >> 16, port + 1);
+                opal_lpc_outb(val >>  8, port + 2);
+                opal_lpc_outb(val      , port + 3);
+                return;
+        }
+        opal_lpc_write(opal_lpc_chip_id, OPAL_LPC_IO, port, val, 4);
+}
+
+static void opal_lpc_outl(u32 val, unsigned long port)
+{
+        __opal_lpc_outl(cpu_to_le32(val), port);
+}
+
+static void opal_lpc_insb(unsigned long p, void *b, unsigned long c)
+{
+        u8 *ptr = b;
+
+        while(c--)
+                *(ptr++) = opal_lpc_inb(p);
+}
+
+static void opal_lpc_insw(unsigned long p, void *b, unsigned long c)
+{
+        __le16 *ptr = b;
+
+        while(c--)
+                *(ptr++) = __opal_lpc_inw(p);
+}
+
+static void opal_lpc_insl(unsigned long p, void *b, unsigned long c)
+{
+        __le32 *ptr = b;
+
+        while(c--)
+                *(ptr++) = __opal_lpc_inl(p);
+}
+
+static void opal_lpc_outsb(unsigned long p, const void *b, unsigned long c)
+{
+        const u8 *ptr = b;
+
+        while(c--)
+                opal_lpc_outb(*(ptr++), p);
+}
+
+static void opal_lpc_outsw(unsigned long p, const void *b, unsigned long c)
+{
+        const __le16 *ptr = b;
+
+        while(c--)
+                __opal_lpc_outw(*(ptr++), p);
+}
+
+static void opal_lpc_outsl(unsigned long p, const void *b, unsigned long c)
+{
+        const __le32 *ptr = b;
+
+        while(c--)
+                __opal_lpc_outl(*(ptr++), p);
+}
+
+static const struct ppc_pci_io opal_lpc_io = {
+        .inb    = opal_lpc_inb,
+        .inw    = opal_lpc_inw,
+        .inl    = opal_lpc_inl,
+        .outb   = opal_lpc_outb,
+        .outw   = opal_lpc_outw,
+        .outl   = opal_lpc_outl,
+        .insb   = opal_lpc_insb,
+        .insw   = opal_lpc_insw,
+        .insl   = opal_lpc_insl,
+        .outsb  = opal_lpc_outsb,
+        .outsw  = opal_lpc_outsw,
+        .outsl  = opal_lpc_outsl,
+};
+
+void opal_lpc_init(void)
+{
+        struct device_node *np;
+
+        /*
+         * Look for a Power8 LPC bus tagged as "primary",
+         * we currently support only one though the OPAL APIs
+         * support any number.
+         */
+        for_each_compatible_node(np, NULL, "ibm,power8-lpc") {
+                if (!of_device_is_available(np))
+                        continue;
+                if (!of_get_property(np, "primary", NULL))
+                        continue;
+                opal_lpc_chip_id = of_get_ibm_chip_id(np);
+                break;
+        }
+        if (opal_lpc_chip_id < 0)
+                return;
+
+        /* Setup special IO ops */
+        ppc_pci_io = opal_lpc_io;
+        isa_io_special = true;
+
+        pr_info("OPAL: Power8 LPC bus found, chip ID %d\n", opal_lpc_chip_id);
+}
diff --git a/arch/powerpc/platforms/powernv/opal-wrappers.S b/arch/powerpc/platforms/powernv/opal-wrappers.S
index e88863ffb135..8f3844535fbb 100644
--- a/arch/powerpc/platforms/powernv/opal-wrappers.S
+++ b/arch/powerpc/platforms/powernv/opal-wrappers.S
@@ -111,3 +111,8 @@ OPAL_CALL(opal_pci_next_error,			OPAL_PCI_NEXT_ERROR);
 OPAL_CALL(opal_pci_poll,                        OPAL_PCI_POLL);
 OPAL_CALL(opal_pci_msi_eoi,                     OPAL_PCI_MSI_EOI);
 OPAL_CALL(opal_pci_get_phb_diag_data2,          OPAL_PCI_GET_PHB_DIAG_DATA2);
+OPAL_CALL(opal_xscom_read,                      OPAL_XSCOM_READ);
+OPAL_CALL(opal_xscom_write,                     OPAL_XSCOM_WRITE);
+OPAL_CALL(opal_lpc_read,                        OPAL_LPC_READ);
+OPAL_CALL(opal_lpc_write,                       OPAL_LPC_WRITE);
+OPAL_CALL(opal_return_cpu,                      OPAL_RETURN_CPU);
diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
index 106301fd2fa5..2911abe550f1 100644
--- a/arch/powerpc/platforms/powernv/opal.c
+++ b/arch/powerpc/platforms/powernv/opal.c
@@ -380,18 +380,20 @@ static int __init opal_init(void)
                 pr_warn("opal: Node not found\n");
                 return -ENODEV;
         }
+
+        /* Register OPAL consoles if any ports */
         if (firmware_has_feature(FW_FEATURE_OPALv2))
                 consoles = of_find_node_by_path("/ibm,opal/consoles");
         else
                 consoles = of_node_get(opal_node);
-
-        /* Register serial ports */
-        for_each_child_of_node(consoles, np) {
-                if (strcmp(np->name, "serial"))
-                        continue;
-                of_platform_device_create(np, NULL, NULL);
+        if (consoles) {
+                for_each_child_of_node(consoles, np) {
+                        if (strcmp(np->name, "serial"))
+                                continue;
+                        of_platform_device_create(np, NULL, NULL);
+                }
+                of_node_put(consoles);
         }
-        of_node_put(consoles);
 
         /* Find all OPAL interrupts and request them */
         irqs = of_get_property(opal_node, "opal-interrupts", &irqlen);
@@ -422,7 +424,7 @@ void opal_shutdown(void)
 
         for (i = 0; i < opal_irq_count; i++) {
                 if (opal_irqs[i])
-                        free_irq(opal_irqs[i], 0);
+                        free_irq(opal_irqs[i], NULL);
                 opal_irqs[i] = 0;
         }
 }
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index d8140b125e62..74a5a5773b1f 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -1104,16 +1104,16 @@ void __init pnv_pci_init_ioda_phb(struct device_node *np,
                                   u64 hub_id, int ioda_type)
 {
         struct pci_controller *hose;
-        static int primary = 1;
         struct pnv_phb *phb;
         unsigned long size, m32map_off, iomap_off, pemap_off;
         const u64 *prop64;
         const u32 *prop32;
+        int len;
         u64 phb_id;
         void *aux;
         long rc;
 
-        pr_info(" Initializing IODA%d OPAL PHB %s\n", ioda_type, np->full_name);
+        pr_info("Initializing IODA%d OPAL PHB %s\n", ioda_type, np->full_name);
 
         prop64 = of_get_property(np, "ibm,opal-phbid", NULL);
         if (!prop64) {
@@ -1124,20 +1124,31 @@ void __init pnv_pci_init_ioda_phb(struct device_node *np,
         pr_debug("  PHB-ID  : 0x%016llx\n", phb_id);
 
         phb = alloc_bootmem(sizeof(struct pnv_phb));
-        if (phb) {
-                memset(phb, 0, sizeof(struct pnv_phb));
-                phb->hose = hose = pcibios_alloc_controller(np);
+        if (!phb) {
+                pr_err("  Out of memory !\n");
+                return;
         }
-        if (!phb || !phb->hose) {
-                pr_err("PCI: Failed to allocate PCI controller for %s\n",
+
+        /* Allocate PCI controller */
+        memset(phb, 0, sizeof(struct pnv_phb));
+        phb->hose = hose = pcibios_alloc_controller(np);
+        if (!phb->hose) {
+                pr_err("  Can't allocate PCI controller for %s\n",
                        np->full_name);
+                free_bootmem((unsigned long)phb, sizeof(struct pnv_phb));
                 return;
         }
 
         spin_lock_init(&phb->lock);
-        /* XXX Use device-tree */
-        hose->first_busno = 0;
-        hose->last_busno = 0xff;
+        prop32 = of_get_property(np, "bus-range", &len);
+        if (prop32 && len == 8) {
+                hose->first_busno = prop32[0];
+                hose->last_busno = prop32[1];
+        } else {
+                pr_warn("  Broken <bus-range> on %s\n", np->full_name);
+                hose->first_busno = 0;
+                hose->last_busno = 0xff;
+        }
         hose->private_data = phb;
         phb->hub_id = hub_id;
         phb->opal_id = phb_id;
@@ -1152,8 +1163,7 @@ void __init pnv_pci_init_ioda_phb(struct device_node *np,
                 phb->model = PNV_PHB_MODEL_UNKNOWN;
 
         /* Parse 32-bit and IO ranges (if any) */
-        pci_process_bridge_OF_ranges(phb->hose, np, primary);
-        primary = 0;
+        pci_process_bridge_OF_ranges(hose, np, !hose->global_number);
 
         /* Get registers */
         phb->regs = of_iomap(np, 0);
@@ -1177,22 +1187,23 @@ void __init pnv_pci_init_ioda_phb(struct device_node *np,
         phb->ioda.io_segsize = phb->ioda.io_size / phb->ioda.total_pe;
         phb->ioda.io_pci_base = 0; /* XXX calculate this ? */
 
-        /* Allocate aux data & arrays
-         *
-         * XXX TODO: Don't allocate io segmap on PHB3
-         */
+        /* Allocate aux data & arrays. We don't have IO ports on PHB3 */
         size = _ALIGN_UP(phb->ioda.total_pe / 8, sizeof(unsigned long));
         m32map_off = size;
         size += phb->ioda.total_pe * sizeof(phb->ioda.m32_segmap[0]);
         iomap_off = size;
-        size += phb->ioda.total_pe * sizeof(phb->ioda.io_segmap[0]);
+        if (phb->type == PNV_PHB_IODA1) {
+                iomap_off = size;
+                size += phb->ioda.total_pe * sizeof(phb->ioda.io_segmap[0]);
+        }
         pemap_off = size;
         size += phb->ioda.total_pe * sizeof(struct pnv_ioda_pe);
         aux = alloc_bootmem(size);
         memset(aux, 0, size);
         phb->ioda.pe_alloc = aux;
         phb->ioda.m32_segmap = aux + m32map_off;
-        phb->ioda.io_segmap = aux + iomap_off;
+        if (phb->type == PNV_PHB_IODA1)
+                phb->ioda.io_segmap = aux + iomap_off;
         phb->ioda.pe_array = aux + pemap_off;
         set_bit(0, phb->ioda.pe_alloc);
 
diff --git a/arch/powerpc/platforms/powernv/powernv.h b/arch/powerpc/platforms/powernv/powernv.h
index a1c6f83fc391..de6819be1f95 100644
--- a/arch/powerpc/platforms/powernv/powernv.h
+++ b/arch/powerpc/platforms/powernv/powernv.h
@@ -15,4 +15,6 @@ static inline void pnv_pci_init(void) { }
 static inline void pnv_pci_shutdown(void) { }
 #endif
 
+extern void pnv_lpc_init(void);
+
 #endif /* _POWERNV_H */
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index 84438af96c05..e239dcfa224c 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -31,6 +31,7 @@
 #include <asm/xics.h>
 #include <asm/rtas.h>
 #include <asm/opal.h>
+#include <asm/kexec.h>
 
 #include "powernv.h"
 
@@ -54,6 +55,12 @@ static void __init pnv_setup_arch(void)
 
 static void __init pnv_init_early(void)
 {
+        /*
+         * Initialize the LPC bus now so that legacy serial
+         * ports can be found on it
+         */
+        opal_lpc_init();
+
 #ifdef CONFIG_HVC_OPAL
         if (firmware_has_feature(FW_FEATURE_OPAL))
                 hvc_opal_init_early();
@@ -147,6 +154,16 @@ static void pnv_shutdown(void)
 static void pnv_kexec_cpu_down(int crash_shutdown, int secondary)
 {
         xics_kexec_teardown_cpu(secondary);
+
+        /* Return secondary CPUs to firmware on OPAL v3 */
+        if (firmware_has_feature(FW_FEATURE_OPALv3) && secondary) {
+                mb();
+                get_paca()->kexec_state = KEXEC_STATE_REAL_MODE;
+                mb();
+
+                /* Return the CPU to OPAL */
+                opal_return_cpu();
+        }
 }
 #endif /* CONFIG_KEXEC */
 
diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
index 89e3857af4e0..908672bdcea6 100644
--- a/arch/powerpc/platforms/powernv/smp.c
+++ b/arch/powerpc/platforms/powernv/smp.c
@@ -46,22 +46,6 @@ static void pnv_smp_setup_cpu(int cpu)
                 xics_setup_cpu();
 }
 
-static int pnv_smp_cpu_bootable(unsigned int nr)
-{
-        /* Special case - we inhibit secondary thread startup
-         * during boot if the user requests it.
-         */
-        if (system_state == SYSTEM_BOOTING && cpu_has_feature(CPU_FTR_SMT)) {
-                if (!smt_enabled_at_boot && cpu_thread_in_core(nr) != 0)
-                        return 0;
-                if (smt_enabled_at_boot
-                    && cpu_thread_in_core(nr) >= smt_enabled_at_boot)
-                        return 0;
-        }
-
-        return 1;
-}
-
 int pnv_smp_kick_cpu(int nr)
 {
         unsigned int pcpu = get_hard_smp_processor_id(nr);
@@ -195,7 +179,7 @@ static struct smp_ops_t pnv_smp_ops = {
         .probe          = xics_smp_probe,
         .kick_cpu       = pnv_smp_kick_cpu,
         .setup_cpu      = pnv_smp_setup_cpu,
-        .cpu_bootable   = pnv_smp_cpu_bootable,
+        .cpu_bootable   = smp_generic_cpu_bootable,
 #ifdef CONFIG_HOTPLUG_CPU
         .cpu_disable    = pnv_smp_cpu_disable,
         .cpu_die        = generic_cpu_die,
diff --git a/arch/powerpc/platforms/ps3/time.c b/arch/powerpc/platforms/ps3/time.c
index cba1e6be68e5..ce73ce865613 100644
--- a/arch/powerpc/platforms/ps3/time.c
+++ b/arch/powerpc/platforms/ps3/time.c
@@ -90,7 +90,7 @@ static int __init ps3_rtc_init(void)
 
         pdev = platform_device_register_simple("rtc-ps3", -1, NULL, 0);
 
-        return PTR_RET(pdev);
+        return PTR_ERR_OR_ZERO(pdev);
 }
 
 module_init(ps3_rtc_init);
diff --git a/arch/powerpc/platforms/pseries/Makefile b/arch/powerpc/platforms/pseries/Makefile
index 8ae010381316..6c61ec5ee914 100644
--- a/arch/powerpc/platforms/pseries/Makefile
+++ b/arch/powerpc/platforms/pseries/Makefile
@@ -22,6 +22,7 @@ obj-$(CONFIG_CMM)		+= cmm.o
 obj-$(CONFIG_DTL)               += dtl.o
 obj-$(CONFIG_IO_EVENT_IRQ)      += io_event_irq.o
 obj-$(CONFIG_PSERIES_IDLE)      += processor_idle.o
+obj-$(CONFIG_LPARCFG)           += lparcfg.o
 
 ifeq ($(CONFIG_PPC_PSERIES),y)
 obj-$(CONFIG_SUSPEND)           += suspend.o
diff --git a/arch/powerpc/platforms/pseries/cmm.c b/arch/powerpc/platforms/pseries/cmm.c
index c638535753df..1e561bef459b 100644
--- a/arch/powerpc/platforms/pseries/cmm.c
+++ b/arch/powerpc/platforms/pseries/cmm.c
@@ -40,8 +40,7 @@
 #include <asm/pgalloc.h>
 #include <asm/uaccess.h>
 #include <linux/memory.h>
-
-#include "plpar_wrappers.h"
+#include <asm/plpar_wrappers.h>
 
 #define CMM_DRIVER_VERSION      "1.0.0"
 #define CMM_DEFAULT_DELAY       1
diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
index a1a7b9a67ffd..7cfdaae1721a 100644
--- a/arch/powerpc/platforms/pseries/dlpar.c
+++ b/arch/powerpc/platforms/pseries/dlpar.c
@@ -63,26 +63,32 @@ static struct property *dlpar_parse_cc_property(struct cc_workarea *ccwa)
         return prop;
 }
 
-static struct device_node *dlpar_parse_cc_node(struct cc_workarea *ccwa)
+static struct device_node *dlpar_parse_cc_node(struct cc_workarea *ccwa,
+                                               const char *path)
 {
         struct device_node *dn;
         char *name;
 
+        /* If parent node path is "/" advance path to NULL terminator to
+         * prevent double leading slashs in full_name.
+         */
+        if (!path[1])
+                path++;
+
         dn = kzalloc(sizeof(*dn), GFP_KERNEL);
         if (!dn)
                 return NULL;
 
-        /* The configure connector reported name does not contain a
-         * preceding '/', so we allocate a buffer large enough to
-         * prepend this to the full_name.
-         */
         name = (char *)ccwa + ccwa->name_offset;
-        dn->full_name = kasprintf(GFP_KERNEL, "/%s", name);
+        dn->full_name = kasprintf(GFP_KERNEL, "%s/%s", path, name);
         if (!dn->full_name) {
                 kfree(dn);
                 return NULL;
         }
 
+        of_node_set_flag(dn, OF_DYNAMIC);
+        kref_init(&dn->kref);
+
         return dn;
 }
 
@@ -120,7 +126,8 @@ void dlpar_free_cc_nodes(struct device_node *dn)
 #define CALL_AGAIN      -2
 #define ERR_CFG_USE     -9003
 
-struct device_node *dlpar_configure_connector(u32 drc_index)
+struct device_node *dlpar_configure_connector(u32 drc_index,
+                                              struct device_node *parent)
 {
         struct device_node *dn;
         struct device_node *first_dn = NULL;
@@ -129,6 +136,7 @@ struct device_node *dlpar_configure_connector(u32 drc_index)
         struct property *last_property = NULL;
         struct cc_workarea *ccwa;
         char *data_buf;
+        const char *parent_path = parent->full_name;
         int cc_token;
         int rc = -1;
 
@@ -162,7 +170,7 @@ struct device_node *dlpar_configure_connector(u32 drc_index)
                         break;
 
                 case NEXT_SIBLING:
-                        dn = dlpar_parse_cc_node(ccwa);
+                        dn = dlpar_parse_cc_node(ccwa, parent_path);
                         if (!dn)
                                 goto cc_error;
 
@@ -172,13 +180,17 @@ struct device_node *dlpar_configure_connector(u32 drc_index)
                         break;
 
                 case NEXT_CHILD:
-                        dn = dlpar_parse_cc_node(ccwa);
+                        if (first_dn)
+                                parent_path = last_dn->full_name;
+
+                        dn = dlpar_parse_cc_node(ccwa, parent_path);
                         if (!dn)
                                 goto cc_error;
 
-                        if (!first_dn)
+                        if (!first_dn) {
+                                dn->parent = parent;
                                 first_dn = dn;
-                        else {
+                        } else {
                                 dn->parent = last_dn;
                                 if (last_dn)
                                         last_dn->child = dn;
@@ -202,6 +214,7 @@ struct device_node *dlpar_configure_connector(u32 drc_index)
 
                 case PREV_PARENT:
                         last_dn = last_dn->parent;
+                        parent_path = last_dn->parent->full_name;
                         break;
 
                 case CALL_AGAIN:
@@ -256,8 +269,6 @@ int dlpar_attach_node(struct device_node *dn)
 {
         int rc;
 
-        of_node_set_flag(dn, OF_DYNAMIC);
-        kref_init(&dn->kref);
         dn->parent = derive_parent(dn->full_name);
         if (!dn->parent)
                 return -ENOMEM;
@@ -275,8 +286,15 @@ int dlpar_attach_node(struct device_node *dn)
 
 int dlpar_detach_node(struct device_node *dn)
 {
+        struct device_node *child;
         int rc;
 
+        child = of_get_next_child(dn, NULL);
+        while (child) {
+                dlpar_detach_node(child);
+                child = of_get_next_child(dn, child);
+        }
+
         rc = of_detach_node(dn);
         if (rc)
                 return rc;
@@ -382,9 +400,8 @@ out:
 
 static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
 {
-        struct device_node *dn;
+        struct device_node *dn, *parent;
         unsigned long drc_index;
-        char *cpu_name;
         int rc;
 
         cpu_hotplug_driver_lock();
@@ -394,25 +411,19 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
                 goto out;
         }
 
-        dn = dlpar_configure_connector(drc_index);
-        if (!dn) {
-                rc = -EINVAL;
+        parent = of_find_node_by_path("/cpus");
+        if (!parent) {
+                rc = -ENODEV;
                 goto out;
         }
 
-        /* configure-connector reports cpus as living in the base
-         * directory of the device tree.  CPUs actually live in the
-         * cpus directory so we need to fixup the full_name.
-         */
-        cpu_name = kasprintf(GFP_KERNEL, "/cpus%s", dn->full_name);
-        if (!cpu_name) {
-                dlpar_free_cc_nodes(dn);
-                rc = -ENOMEM;
+        dn = dlpar_configure_connector(drc_index, parent);
+        if (!dn) {
+                rc = -EINVAL;
                 goto out;
         }
 
-        kfree(dn->full_name);
-        dn->full_name = cpu_name;
+        of_node_put(parent);
 
         rc = dlpar_acquire_drc(drc_index);
         if (rc) {
diff --git a/arch/powerpc/platforms/pseries/dtl.c b/arch/powerpc/platforms/pseries/dtl.c
index 0cc0ac07a55d..5db66f1fbc26 100644
--- a/arch/powerpc/platforms/pseries/dtl.c
+++ b/arch/powerpc/platforms/pseries/dtl.c
@@ -29,8 +29,7 @@
 #include <asm/firmware.h>
 #include <asm/lppaca.h>
 #include <asm/debug.h>
-
-#include "plpar_wrappers.h"
+#include <asm/plpar_wrappers.h>
 
 struct dtl {
         struct dtl_entry        *buf;
@@ -87,7 +86,7 @@ static void consume_dtle(struct dtl_entry *dtle, u64 index)
         barrier();
 
         /* check for hypervisor ring buffer overflow, ignore this entry if so */
-        if (index + N_DISPATCH_LOG < vpa->dtl_idx)
+        if (index + N_DISPATCH_LOG < be64_to_cpu(vpa->dtl_idx))
                 return;
 
         ++wp;
diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
index 217ca5c75b20..82789e79e539 100644
--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
@@ -30,7 +30,8 @@
 #include <asm/machdep.h>
 #include <asm/vdso_datapage.h>
 #include <asm/xics.h>
-#include "plpar_wrappers.h"
+#include <asm/plpar_wrappers.h>
+
 #include "offline_states.h"
 
 /* This version can't take the spinlock, because it never returns */
@@ -123,7 +124,7 @@ static void pseries_mach_cpu_die(void)
                 cede_latency_hint = 2;
 
                 get_lppaca()->idle = 1;
-                if (!get_lppaca()->shared_proc)
+                if (!lppaca_shared_proc(get_lppaca()))
                         get_lppaca()->donate_dedicated_cpu = 1;
 
                 while (get_preferred_offline_state(cpu) == CPU_STATE_INACTIVE) {
@@ -137,7 +138,7 @@ static void pseries_mach_cpu_die(void)
 
                 local_irq_disable();
 
-                if (!get_lppaca()->shared_proc)
+                if (!lppaca_shared_proc(get_lppaca()))
                         get_lppaca()->donate_dedicated_cpu = 0;
                 get_lppaca()->idle = 0;
 
diff --git a/arch/powerpc/platforms/pseries/hvconsole.c b/arch/powerpc/platforms/pseries/hvconsole.c
index b344f94b0400..849b29b3e9ae 100644
--- a/arch/powerpc/platforms/pseries/hvconsole.c
+++ b/arch/powerpc/platforms/pseries/hvconsole.c
@@ -28,7 +28,7 @@
 #include <linux/errno.h>
 #include <asm/hvcall.h>
 #include <asm/hvconsole.h>
-#include "plpar_wrappers.h"
+#include <asm/plpar_wrappers.h>
 
 /**
  * hvc_get_chars - retrieve characters from firmware for denoted vterm adatper
@@ -40,10 +40,16 @@
  */
 int hvc_get_chars(uint32_t vtermno, char *buf, int count)
 {
-        unsigned long got;
+        long ret;
+        unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
+        unsigned long *lbuf = (unsigned long *)buf;
+
+        ret = plpar_hcall(H_GET_TERM_CHAR, retbuf, vtermno);
+        lbuf[0] = be64_to_cpu(retbuf[1]);
+        lbuf[1] = be64_to_cpu(retbuf[2]);
 
-        if (plpar_get_term_char(vtermno, &got, buf) == H_SUCCESS)
-                return got;
+        if (ret == H_SUCCESS)
+                return retbuf[0];
 
         return 0;
 }
@@ -69,8 +75,9 @@ int hvc_put_chars(uint32_t vtermno, const char *buf, int count)
         if (count > MAX_VIO_PUT_CHARS)
                 count = MAX_VIO_PUT_CHARS;
 
-        ret = plpar_hcall_norets(H_PUT_TERM_CHAR, vtermno, count, lbuf[0],
-                                 lbuf[1]);
+        ret = plpar_hcall_norets(H_PUT_TERM_CHAR, vtermno, count,
+                                 cpu_to_be64(lbuf[0]),
+                                 cpu_to_be64(lbuf[1]));
         if (ret == H_SUCCESS)
                 return count;
         if (ret == H_BUSY)
diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
index 23fc1dcf4434..0307901e4132 100644
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -48,8 +48,7 @@
 #include <asm/ppc-pci.h>
 #include <asm/udbg.h>
 #include <asm/mmzone.h>
-
-#include "plpar_wrappers.h"
+#include <asm/plpar_wrappers.h>
 
 
 static void tce_invalidate_pSeries_sw(struct iommu_table *tbl,
@@ -530,7 +529,7 @@ static void iommu_table_setparms(struct pci_controller *phb,
 static void iommu_table_setparms_lpar(struct pci_controller *phb,
                                       struct device_node *dn,
                                       struct iommu_table *tbl,
-                                      const void *dma_window)
+                                      const __be32 *dma_window)
 {
         unsigned long offset, size;
 
@@ -630,7 +629,7 @@ static void pci_dma_bus_setup_pSeriesLP(struct pci_bus *bus)
         struct iommu_table *tbl;
         struct device_node *dn, *pdn;
         struct pci_dn *ppci;
-        const void *dma_window = NULL;
+        const __be32 *dma_window = NULL;
 
         dn = pci_bus_to_OF_node(bus);
 
@@ -1152,7 +1151,7 @@ static void pci_dma_dev_setup_pSeriesLP(struct pci_dev *dev)
 {
         struct device_node *pdn, *dn;
         struct iommu_table *tbl;
-        const void *dma_window = NULL;
+        const __be32 *dma_window = NULL;
         struct pci_dn *pci;
 
         pr_debug("pci_dma_dev_setup_pSeriesLP: %s\n", pci_name(dev));
@@ -1201,7 +1200,7 @@ static int dma_set_mask_pSeriesLP(struct device *dev, u64 dma_mask)
         bool ddw_enabled = false;
         struct device_node *pdn, *dn;
         struct pci_dev *pdev;
-        const void *dma_window = NULL;
+        const __be32 *dma_window = NULL;
         u64 dma_offset;
 
         if (!dev->dma_mask)
diff --git a/arch/powerpc/platforms/pseries/kexec.c b/arch/powerpc/platforms/pseries/kexec.c
index 7d94bdc63d50..13fa95b3aa8b 100644
--- a/arch/powerpc/platforms/pseries/kexec.c
+++ b/arch/powerpc/platforms/pseries/kexec.c
@@ -17,9 +17,9 @@
 #include <asm/mpic.h>
 #include <asm/xics.h>
 #include <asm/smp.h>
+#include <asm/plpar_wrappers.h>
 
 #include "pseries.h"
-#include "plpar_wrappers.h"
 
 static void pseries_kexec_cpu_down(int crash_shutdown, int secondary)
 {
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 8bad880bd177..356bc75ca74f 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -41,8 +41,8 @@
 #include <asm/smp.h>
 #include <asm/trace.h>
 #include <asm/firmware.h>
+#include <asm/plpar_wrappers.h>
 
-#include "plpar_wrappers.h"
 #include "pseries.h"
 
 /* Flag bits for H_BULK_REMOVE */
@@ -68,6 +68,12 @@ void vpa_init(int cpu)
         struct paca_struct *pp;
         struct dtl_entry *dtl;
 
+        /*
+         * The spec says it "may be problematic" if CPU x registers the VPA of
+         * CPU y. We should never do that, but wail if we ever do.
+         */
+        WARN_ON(cpu != smp_processor_id());
+
         if (cpu_has_feature(CPU_FTR_ALTIVEC))
                 lppaca_of(cpu).vmxregs_in_use = 1;
 
@@ -106,7 +112,7 @@ void vpa_init(int cpu)
                 lppaca_of(cpu).dtl_idx = 0;
 
                 /* hypervisor reads buffer length from this field */
-                dtl->enqueue_to_dispatch_time = DISPATCH_LOG_BYTES;
+                dtl->enqueue_to_dispatch_time = cpu_to_be32(DISPATCH_LOG_BYTES);
                 ret = register_dtl(hwcpu, __pa(dtl));
                 if (ret)
                         pr_err("WARNING: DTL registration of cpu %d (hw %d) "
@@ -724,7 +730,7 @@ int h_get_mpp(struct hvcall_mpp_data *mpp_data)
 
         mpp_data->mem_weight = (retbuf[3] >> 7 * 8) & 0xff;
         mpp_data->unallocated_mem_weight = (retbuf[3] >> 6 * 8) & 0xff;
-        mpp_data->unallocated_entitlement = retbuf[3] & 0xffffffffffff;
+        mpp_data->unallocated_entitlement = retbuf[3] & 0xffffffffffffUL;
 
         mpp_data->pool_size = retbuf[4];
         mpp_data->loan_request = retbuf[5];
diff --git a/arch/powerpc/kernel/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c
index d92f3871e9cf..e738007eae64 100644
--- a/arch/powerpc/kernel/lparcfg.c
+++ b/arch/powerpc/platforms/pseries/lparcfg.c
@@ -35,7 +35,13 @@
 #include <asm/vdso_datapage.h>
 #include <asm/vio.h>
 #include <asm/mmu.h>
+#include <asm/machdep.h>
 
+
+/*
+ * This isn't a module but we expose that to userspace
+ * via /proc so leave the definitions here
+ */
 #define MODULE_VERS "1.9"
 #define MODULE_NAME "lparcfg"
 
@@ -165,7 +171,7 @@ static void parse_ppp_data(struct seq_file *m)
                    ppp_data.active_system_procs);
 
         /* pool related entries are appropriate for shared configs */
-        if (lppaca_of(0).shared_proc) {
+        if (lppaca_shared_proc(get_lppaca())) {
                 unsigned long pool_idle_time, pool_procs;
 
                 seq_printf(m, "pool=%d\n", ppp_data.pool_num);
@@ -387,8 +393,8 @@ static void pseries_cmo_data(struct seq_file *m)
                 return;
 
         for_each_possible_cpu(cpu) {
-                cmo_faults += lppaca_of(cpu).cmo_faults;
-                cmo_fault_time += lppaca_of(cpu).cmo_fault_time;
+                cmo_faults += be64_to_cpu(lppaca_of(cpu).cmo_faults);
+                cmo_fault_time += be64_to_cpu(lppaca_of(cpu).cmo_fault_time);
         }
 
         seq_printf(m, "cmo_faults=%lu\n", cmo_faults);
@@ -406,8 +412,9 @@ static void splpar_dispatch_data(struct seq_file *m)
         unsigned long dispatch_dispersions = 0;
 
         for_each_possible_cpu(cpu) {
-                dispatches += lppaca_of(cpu).yield_count;
-                dispatch_dispersions += lppaca_of(cpu).dispersion_count;
+                dispatches += be32_to_cpu(lppaca_of(cpu).yield_count);
+                dispatch_dispersions +=
+                        be32_to_cpu(lppaca_of(cpu).dispersion_count);
         }
 
         seq_printf(m, "dispatches=%lu\n", dispatches);
@@ -418,7 +425,8 @@ static void parse_em_data(struct seq_file *m)
 {
         unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
 
-        if (plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS)
+        if (firmware_has_feature(FW_FEATURE_LPAR) &&
+            plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS)
                 seq_printf(m, "power_mode_data=%016lx\n", retbuf[0]);
 }
 
@@ -473,7 +481,8 @@ static int pseries_lparcfg_data(struct seq_file *m, void *v)
         seq_printf(m, "partition_potential_processors=%d\n",
                    partition_potential_processors);
 
-        seq_printf(m, "shared_processor_mode=%d\n", lppaca_of(0).shared_proc);
+        seq_printf(m, "shared_processor_mode=%d\n",
+                   lppaca_shared_proc(get_lppaca()));
 
         seq_printf(m, "slb_size=%d\n", mmu_slb_size);
 
@@ -677,7 +686,6 @@ static int lparcfg_open(struct inode *inode, struct file *file)
 }
 
 static const struct file_operations lparcfg_fops = {
-        .owner          = THIS_MODULE,
         .read           = seq_read,
         .write          = lparcfg_write,
         .open           = lparcfg_open,
@@ -699,14 +707,4 @@ static int __init lparcfg_init(void)
         }
         return 0;
 }
-
-static void __exit lparcfg_cleanup(void)
-{
-        remove_proc_subtree("powerpc/lparcfg", NULL);
-}
-
-module_init(lparcfg_init);
-module_exit(lparcfg_cleanup);
-MODULE_DESCRIPTION("Interface for LPAR configuration data");
-MODULE_AUTHOR("Dave Engebretsen");
-MODULE_LICENSE("GPL");
+machine_device_initcall(pseries, lparcfg_init);
diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
index 3d01eee9ffb1..cde4e0a095ae 100644
--- a/arch/powerpc/platforms/pseries/mobility.c
+++ b/arch/powerpc/platforms/pseries/mobility.c
@@ -28,7 +28,7 @@ struct update_props_workarea {
         u32 state;
         u64 reserved;
         u32 nprops;
-};
+} __packed;
 
 #define NODE_ACTION_MASK        0xff000000
 #define NODE_COUNT_MASK         0x00ffffff
@@ -62,6 +62,7 @@ static int delete_dt_node(u32 phandle)
                 return -ENOENT;
 
         dlpar_detach_node(dn);
+        of_node_put(dn);
         return 0;
 }
 
@@ -119,7 +120,7 @@ static int update_dt_property(struct device_node *dn, struct property **prop,
 
         if (!more) {
                 of_update_property(dn, new_prop);
-                new_prop = NULL;
+                *prop = NULL;
         }
 
         return 0;
@@ -130,7 +131,7 @@ static int update_dt_node(u32 phandle, s32 scope)
         struct update_props_workarea *upwa;
         struct device_node *dn;
         struct property *prop = NULL;
-        int i, rc;
+        int i, rc, rtas_rc;
         char *prop_data;
         char *rtas_buf;
         int update_properties_token;
@@ -154,25 +155,26 @@ static int update_dt_node(u32 phandle, s32 scope)
         upwa->phandle = phandle;
 
         do {
-                rc = mobility_rtas_call(update_properties_token, rtas_buf,
+                rtas_rc = mobility_rtas_call(update_properties_token, rtas_buf,
                                         scope);
-                if (rc < 0)
+                if (rtas_rc < 0)
                         break;
 
                 prop_data = rtas_buf + sizeof(*upwa);
 
-                /* The first element of the buffer is the path of the node
-                 * being updated in the form of a 8 byte string length
-                 * followed by the string. Skip past this to get to the
-                 * properties being updated.
+                /* On the first call to ibm,update-properties for a node the
+                 * the first property value descriptor contains an empty
+                 * property name, the property value length encoded as u32,
+                 * and the property value is the node path being updated.
                  */
-                vd = *prop_data++;
-                prop_data += vd;
+                if (*prop_data == 0) {
+                        prop_data++;
+                        vd = *(u32 *)prop_data;
+                        prop_data += vd + sizeof(vd);
+                        upwa->nprops--;
+                }
 
-                /* The path we skipped over is counted as one of the elements
-                 * returned so start counting at one.
-                 */
-                for (i = 1; i < upwa->nprops; i++) {
+                for (i = 0; i < upwa->nprops; i++) {
                         char *prop_name;
 
                         prop_name = prop_data;
@@ -202,7 +204,7 @@ static int update_dt_node(u32 phandle, s32 scope)
                                 prop_data += vd;
                         }
                 }
-        } while (rc == 1);
+        } while (rtas_rc == 1);
 
         of_node_put(dn);
         kfree(rtas_buf);
@@ -215,17 +217,14 @@ static int add_dt_node(u32 parent_phandle, u32 drc_index)
         struct device_node *parent_dn;
         int rc;
 
-        dn = dlpar_configure_connector(drc_index);
-        if (!dn)
+        parent_dn = of_find_node_by_phandle(parent_phandle);
+        if (!parent_dn)
                 return -ENOENT;
 
-        parent_dn = of_find_node_by_phandle(parent_phandle);
-        if (!parent_dn) {
-                dlpar_free_cc_nodes(dn);
+        dn = dlpar_configure_connector(drc_index, parent_dn);
+        if (!dn)
                 return -ENOENT;
-        }
 
-        dn->parent = parent_dn;
         rc = dlpar_attach_node(dn);
         if (rc)
                 dlpar_free_cc_nodes(dn);
diff --git a/arch/powerpc/platforms/pseries/nvram.c b/arch/powerpc/platforms/pseries/nvram.c
index 9f8671a44551..d276cd3edd8f 100644
--- a/arch/powerpc/platforms/pseries/nvram.c
+++ b/arch/powerpc/platforms/pseries/nvram.c
@@ -539,65 +539,6 @@ static int zip_oops(size_t text_len)
 }
 
 #ifdef CONFIG_PSTORE
-/* Derived from logfs_uncompress */
-int nvram_decompress(void *in, void *out, size_t inlen, size_t outlen)
-{
-        int err, ret;
-
-        ret = -EIO;
-        err = zlib_inflateInit(&stream);
-        if (err != Z_OK)
-                goto error;
-
-        stream.next_in = in;
-        stream.avail_in = inlen;
-        stream.total_in = 0;
-        stream.next_out = out;
-        stream.avail_out = outlen;
-        stream.total_out = 0;
-
-        err = zlib_inflate(&stream, Z_FINISH);
-        if (err != Z_STREAM_END)
-                goto error;
-
-        err = zlib_inflateEnd(&stream);
-        if (err != Z_OK)
-                goto error;
-
-        ret = stream.total_out;
-error:
-        return ret;
-}
-
-static int unzip_oops(char *oops_buf, char *big_buf)
-{
-        struct oops_log_info *oops_hdr = (struct oops_log_info *)oops_buf;
-        u64 timestamp = oops_hdr->timestamp;
-        char *big_oops_data = NULL;
-        char *oops_data_buf = NULL;
-        size_t big_oops_data_sz;
-        int unzipped_len;
-
-        big_oops_data = big_buf + sizeof(struct oops_log_info);
-        big_oops_data_sz = big_oops_buf_sz - sizeof(struct oops_log_info);
-        oops_data_buf = oops_buf + sizeof(struct oops_log_info);
-
-        unzipped_len = nvram_decompress(oops_data_buf, big_oops_data,
-                                        oops_hdr->report_length,
-                                        big_oops_data_sz);
-
-        if (unzipped_len < 0) {
-                pr_err("nvram: decompression failed; returned %d\n",
-                                                                unzipped_len);
-                return -1;
-        }
-        oops_hdr = (struct oops_log_info *)big_buf;
-        oops_hdr->version = OOPS_HDR_VERSION;
-        oops_hdr->report_length = (u16) unzipped_len;
-        oops_hdr->timestamp = timestamp;
-        return 0;
-}
-
 static int nvram_pstore_open(struct pstore_info *psi)
 {
         /* Reset the iterator to start reading partitions again */
@@ -613,7 +554,7 @@ static int nvram_pstore_open(struct pstore_info *psi)
  * @part:               pstore writes data to registered buffer in parts,
  *                      part number will indicate the same.
  * @count:              Indicates oops count
- * @hsize:              Size of header added by pstore
+ * @compressed:         Flag to indicate the log is compressed
  * @size:               number of bytes written to the registered buffer
  * @psi:                registered pstore_info structure
  *
@@ -624,7 +565,7 @@ static int nvram_pstore_open(struct pstore_info *psi)
 static int nvram_pstore_write(enum pstore_type_id type,
                                 enum kmsg_dump_reason reason,
                                 u64 *id, unsigned int part, int count,
-                                size_t hsize, size_t size,
+                                bool compressed, size_t size,
                                 struct pstore_info *psi)
 {
         int rc;
@@ -640,30 +581,11 @@ static int nvram_pstore_write(enum pstore_type_id type,
         oops_hdr->report_length = (u16) size;
         oops_hdr->timestamp = get_seconds();
 
-        if (big_oops_buf) {
-                rc = zip_oops(size);
-                /*
-                 * If compression fails copy recent log messages from
-                 * big_oops_buf to oops_data.
-                 */
-                if (rc != 0) {
-                        size_t diff = size - oops_data_sz + hsize;
-
-                        if (size > oops_data_sz) {
-                                memcpy(oops_data, big_oops_buf, hsize);
-                                memcpy(oops_data + hsize, big_oops_buf + diff,
-                                        oops_data_sz - hsize);
-
-                                oops_hdr->report_length = (u16) oops_data_sz;
-                        } else
-                                memcpy(oops_data, big_oops_buf, size);
-                } else
-                        err_type = ERR_TYPE_KERNEL_PANIC_GZ;
-        }
+        if (compressed)
+                err_type = ERR_TYPE_KERNEL_PANIC_GZ;
 
         rc = nvram_write_os_partition(&oops_log_partition, oops_buf,
-                (int) (sizeof(*oops_hdr) + oops_hdr->report_length), err_type,
-                count);
+                (int) (sizeof(*oops_hdr) + size), err_type, count);
 
         if (rc != 0)
                 return rc;
@@ -679,16 +601,15 @@ static int nvram_pstore_write(enum pstore_type_id type,
  */
 static ssize_t nvram_pstore_read(u64 *id, enum pstore_type_id *type,
                                 int *count, struct timespec *time, char **buf,
-                                struct pstore_info *psi)
+                                bool *compressed, struct pstore_info *psi)
 {
         struct oops_log_info *oops_hdr;
         unsigned int err_type, id_no, size = 0;
         struct nvram_os_partition *part = NULL;
-        char *buff = NULL, *big_buff = NULL;
-        int rc, sig = 0;
+        char *buff = NULL;
+        int sig = 0;
         loff_t p;
 
-read_partition:
         read_type++;
 
         switch (nvram_type_ids[read_type]) {
@@ -749,30 +670,32 @@ read_partition:
                 *id = id_no;
 
         if (nvram_type_ids[read_type] == PSTORE_TYPE_DMESG) {
-                oops_hdr = (struct oops_log_info *)buff;
-                *buf = buff + sizeof(*oops_hdr);
-
-                if (err_type == ERR_TYPE_KERNEL_PANIC_GZ) {
-                        big_buff = kmalloc(big_oops_buf_sz, GFP_KERNEL);
-                        if (!big_buff)
-                                return -ENOMEM;
-
-                        rc = unzip_oops(buff, big_buff);
+                size_t length, hdr_size;
 
-                        if (rc != 0) {
-                                kfree(buff);
-                                kfree(big_buff);
-                                goto read_partition;
-                        }
-
-                        oops_hdr = (struct oops_log_info *)big_buff;
-                        *buf = big_buff + sizeof(*oops_hdr);
-                        kfree(buff);
+                oops_hdr = (struct oops_log_info *)buff;
+                if (oops_hdr->version < OOPS_HDR_VERSION) {
+                        /* Old format oops header had 2-byte record size */
+                        hdr_size = sizeof(u16);
+                        length = oops_hdr->version;
+                        time->tv_sec = 0;
+                        time->tv_nsec = 0;
+                } else {
+                        hdr_size = sizeof(*oops_hdr);
+                        length = oops_hdr->report_length;
+                        time->tv_sec = oops_hdr->timestamp;
+                        time->tv_nsec = 0;
                 }
+                *buf = kmalloc(length, GFP_KERNEL);
+                if (*buf == NULL)
+                        return -ENOMEM;
+                memcpy(*buf, buff + hdr_size, length);
+                kfree(buff);
 
-                time->tv_sec = oops_hdr->timestamp;
-                time->tv_nsec = 0;
-                return oops_hdr->report_length;
+                if (err_type == ERR_TYPE_KERNEL_PANIC_GZ)
+                        *compressed = true;
+                else
+                        *compressed = false;
+                return length;
         }
 
         *buf = buff;
@@ -791,13 +714,8 @@ static int nvram_pstore_init(void)
 {
         int rc = 0;
 
-        if (big_oops_buf) {
-                nvram_pstore_info.buf = big_oops_buf;
-                nvram_pstore_info.bufsize = big_oops_buf_sz;
-        } else {
-                nvram_pstore_info.buf = oops_data;
-                nvram_pstore_info.bufsize = oops_data_sz;
-        }
+        nvram_pstore_info.buf = oops_data;
+        nvram_pstore_info.bufsize = oops_data_sz;
 
         rc = pstore_register(&nvram_pstore_info);
         if (rc != 0)
@@ -836,6 +754,11 @@ static void __init nvram_init_oops_partition(int rtas_partition_exists)
         oops_data = oops_buf + sizeof(struct oops_log_info);
         oops_data_sz = oops_log_partition.size - sizeof(struct oops_log_info);
 
+        rc = nvram_pstore_init();
+
+        if (!rc)
+                return;
+
         /*
          * Figure compression (preceded by elimination of each line's <n>
          * severity prefix) will reduce the oops/panic report to at most
@@ -844,8 +767,8 @@ static void __init nvram_init_oops_partition(int rtas_partition_exists)
         big_oops_buf_sz = (oops_data_sz * 100) / 45;
         big_oops_buf = kmalloc(big_oops_buf_sz, GFP_KERNEL);
         if (big_oops_buf) {
-                stream.workspace = kmalloc(zlib_deflate_workspacesize(
-                                WINDOW_BITS, MEM_LEVEL), GFP_KERNEL);
+                stream.workspace =  kmalloc(zlib_deflate_workspacesize(
+                                        WINDOW_BITS, MEM_LEVEL), GFP_KERNEL);
                 if (!stream.workspace) {
                         pr_err("nvram: No memory for compression workspace; "
                                 "skipping compression of %s partition data\n",
@@ -859,11 +782,6 @@ static void __init nvram_init_oops_partition(int rtas_partition_exists)
                 stream.workspace = NULL;
         }
 
-        rc = nvram_pstore_init();
-
-        if (!rc)
-                return;
-
         rc = kmsg_dump_register(&nvram_kmsg_dumper);
         if (rc != 0) {
                 pr_err("nvram: kmsg_dump_register() failed; returned %d\n", rc);
diff --git a/arch/powerpc/platforms/pseries/processor_idle.c b/arch/powerpc/platforms/pseries/processor_idle.c
index 4644efa06941..a166e38bd683 100644
--- a/arch/powerpc/platforms/pseries/processor_idle.c
+++ b/arch/powerpc/platforms/pseries/processor_idle.c
@@ -18,9 +18,7 @@
 #include <asm/machdep.h>
 #include <asm/firmware.h>
 #include <asm/runlatch.h>
-
-#include "plpar_wrappers.h"
-#include "pseries.h"
+#include <asm/plpar_wrappers.h>
 
 struct cpuidle_driver pseries_idle_driver = {
         .name             = "pseries_idle",
@@ -45,7 +43,11 @@ static inline void idle_loop_prolog(unsigned long *in_purr)
 
 static inline void idle_loop_epilog(unsigned long in_purr)
 {
-        get_lppaca()->wait_state_cycles += mfspr(SPRN_PURR) - in_purr;
+        u64 wait_cycles;
+
+        wait_cycles = be64_to_cpu(get_lppaca()->wait_state_cycles);
+        wait_cycles += mfspr(SPRN_PURR) - in_purr;
+        get_lppaca()->wait_state_cycles = cpu_to_be64(wait_cycles);
         get_lppaca()->idle = 0;
 }
 
@@ -308,7 +310,7 @@ static int pseries_idle_probe(void)
                 return -EPERM;
         }
 
-        if (get_lppaca()->shared_proc)
+        if (lppaca_shared_proc(get_lppaca()))
                 cpuidle_state_table = shared_states;
         else
                 cpuidle_state_table = dedicated_states;
diff --git a/arch/powerpc/platforms/pseries/pseries.h b/arch/powerpc/platforms/pseries/pseries.h
index c2a3a258001c..99219530ea4a 100644
--- a/arch/powerpc/platforms/pseries/pseries.h
+++ b/arch/powerpc/platforms/pseries/pseries.h
@@ -56,13 +56,10 @@ extern void hvc_vio_init_early(void);
 /* Dynamic logical Partitioning/Mobility */
 extern void dlpar_free_cc_nodes(struct device_node *);
 extern void dlpar_free_cc_property(struct property *);
-extern struct device_node *dlpar_configure_connector(u32);
+extern struct device_node *dlpar_configure_connector(u32, struct device_node *);
 extern int dlpar_attach_node(struct device_node *);
 extern int dlpar_detach_node(struct device_node *);
 
-/* Snooze Delay, pseries_idle */
-DECLARE_PER_CPU(long, smt_snooze_delay);
-
 /* PCI root bridge prepare function override for pseries */
 struct pci_host_bridge;
 int pseries_root_bridge_prepare(struct pci_host_bridge *bridge);
diff --git a/arch/powerpc/platforms/pseries/pseries_energy.c b/arch/powerpc/platforms/pseries/pseries_energy.c
index a91e6dadda2c..92767791f93b 100644
--- a/arch/powerpc/platforms/pseries/pseries_energy.c
+++ b/arch/powerpc/platforms/pseries/pseries_energy.c
@@ -108,8 +108,8 @@ err:
  * energy consumption.
  */
 
-#define FLAGS_MODE1     0x004E200000080E01
-#define FLAGS_MODE2     0x004E200000080401
+#define FLAGS_MODE1     0x004E200000080E01UL
+#define FLAGS_MODE2     0x004E200000080401UL
 #define FLAGS_ACTIVATE  0x100
 
 static ssize_t get_best_energy_list(char *page, int activate)
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index c11c8238797c..d64feb3ea0be 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -66,8 +66,8 @@
 #include <asm/firmware.h>
 #include <asm/eeh.h>
 #include <asm/reg.h>
+#include <asm/plpar_wrappers.h>
 
-#include "plpar_wrappers.h"
 #include "pseries.h"
 
 int CMO_PrPSP = -1;
@@ -183,7 +183,7 @@ static void __init pseries_mpic_init_IRQ(void)
         np = of_find_node_by_path("/");
         naddr = of_n_addr_cells(np);
         opprop = of_get_property(np, "platform-open-pic", &opplen);
-        if (opprop != 0) {
+        if (opprop != NULL) {
                 openpic_addr = of_read_number(opprop, naddr);
                 printk(KERN_DEBUG "OpenPIC addr: %lx\n", openpic_addr);
         }
@@ -323,7 +323,7 @@ static int alloc_dispatch_logs(void)
         get_paca()->lppaca_ptr->dtl_idx = 0;
 
         /* hypervisor reads buffer length from this field */
-        dtl->enqueue_to_dispatch_time = DISPATCH_LOG_BYTES;
+        dtl->enqueue_to_dispatch_time = cpu_to_be32(DISPATCH_LOG_BYTES);
         ret = register_dtl(hard_smp_processor_id(), __pa(dtl));
         if (ret)
                 pr_err("WARNING: DTL registration of cpu %d (hw %d) failed "
diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c
index 306643cc9dbc..1c1771a40250 100644
--- a/arch/powerpc/platforms/pseries/smp.c
+++ b/arch/powerpc/platforms/pseries/smp.c
@@ -43,8 +43,8 @@
 #include <asm/cputhreads.h>
 #include <asm/xics.h>
 #include <asm/dbell.h>
+#include <asm/plpar_wrappers.h>
 
-#include "plpar_wrappers.h"
 #include "pseries.h"
 #include "offline_states.h"
 
@@ -187,22 +187,6 @@ static int smp_pSeries_kick_cpu(int nr)
         return 0;
 }
 
-static int smp_pSeries_cpu_bootable(unsigned int nr)
-{
-        /* Special case - we inhibit secondary thread startup
-         * during boot if the user requests it.
-         */
-        if (system_state == SYSTEM_BOOTING && cpu_has_feature(CPU_FTR_SMT)) {
-                if (!smt_enabled_at_boot && cpu_thread_in_core(nr) != 0)
-                        return 0;
-                if (smt_enabled_at_boot
-                    && cpu_thread_in_core(nr) >= smt_enabled_at_boot)
-                        return 0;
-        }
-
-        return 1;
-}
-
 /* Only used on systems that support multiple IPI mechanisms */
 static void pSeries_cause_ipi_mux(int cpu, unsigned long data)
 {
@@ -237,7 +221,7 @@ static struct smp_ops_t pSeries_xics_smp_ops = {
         .probe          = pSeries_smp_probe,
         .kick_cpu       = smp_pSeries_kick_cpu,
         .setup_cpu      = smp_xics_setup_cpu,
-        .cpu_bootable   = smp_pSeries_cpu_bootable,
+        .cpu_bootable   = smp_generic_cpu_bootable,
 };
 
 /* This is called very early */
diff --git a/arch/powerpc/platforms/wsp/wsp.h b/arch/powerpc/platforms/wsp/wsp.h
index 62ef21afb89a..a563a8aaf812 100644
--- a/arch/powerpc/platforms/wsp/wsp.h
+++ b/arch/powerpc/platforms/wsp/wsp.h
@@ -17,7 +17,6 @@ extern void scom_init_wsp(void);
 extern void a2_setup_smp(void);
 extern int a2_scom_startup_cpu(unsigned int lcpu, int thr_idx,
                                struct device_node *np);
-extern int smp_a2_cpu_bootable(unsigned int nr);
 extern int smp_a2_kick_cpu(int nr);
 
 extern void opb_pic_init(void);
diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c
index ab02db3d02d8..77efbaec7b9c 100644
--- a/arch/powerpc/sysdev/fsl_msi.c
+++ b/arch/powerpc/sysdev/fsl_msi.c
@@ -28,6 +28,18 @@
 #include "fsl_msi.h"
 #include "fsl_pci.h"
 
+#define MSIIR_OFFSET_MASK       0xfffff
+#define MSIIR_IBS_SHIFT         0
+#define MSIIR_SRS_SHIFT         5
+#define MSIIR1_IBS_SHIFT        4
+#define MSIIR1_SRS_SHIFT        0
+#define MSI_SRS_MASK            0xf
+#define MSI_IBS_MASK            0x1f
+
+#define msi_hwirq(msi, msir_index, intr_index) \
+                ((msir_index) << (msi)->srs_shift | \
+                 ((intr_index) << (msi)->ibs_shift))
+
 static LIST_HEAD(msi_head);
 
 struct fsl_msi_feature {
@@ -80,18 +92,19 @@ static const struct irq_domain_ops fsl_msi_host_ops = {
 
 static int fsl_msi_init_allocator(struct fsl_msi *msi_data)
 {
-        int rc;
+        int rc, hwirq;
 
-        rc = msi_bitmap_alloc(&msi_data->bitmap, NR_MSI_IRQS,
+        rc = msi_bitmap_alloc(&msi_data->bitmap, NR_MSI_IRQS_MAX,
                               msi_data->irqhost->of_node);
         if (rc)
                 return rc;
 
-        rc = msi_bitmap_reserve_dt_hwirqs(&msi_data->bitmap);
-        if (rc < 0) {
-                msi_bitmap_free(&msi_data->bitmap);
-                return rc;
-        }
+        /*
+         * Reserve all the hwirqs
+         * The available hwirqs will be released in fsl_msi_setup_hwirq()
+         */
+        for (hwirq = 0; hwirq < NR_MSI_IRQS_MAX; hwirq++)
+                msi_bitmap_reserve_hwirq(&msi_data->bitmap, hwirq);
 
         return 0;
 }
@@ -144,8 +157,9 @@ static void fsl_compose_msi_msg(struct pci_dev *pdev, int hwirq,
 
         msg->data = hwirq;
 
-        pr_debug("%s: allocated srs: %d, ibs: %d\n",
-                __func__, hwirq / IRQS_PER_MSI_REG, hwirq % IRQS_PER_MSI_REG);
+        pr_debug("%s: allocated srs: %d, ibs: %d\n", __func__,
+                 (hwirq >> msi_data->srs_shift) & MSI_SRS_MASK,
+                 (hwirq >> msi_data->ibs_shift) & MSI_IBS_MASK);
 }
 
 static int fsl_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
@@ -255,7 +269,7 @@ static void fsl_msi_cascade(unsigned int irq, struct irq_desc *desc)
 
         msir_index = cascade_data->index;
 
-        if (msir_index >= NR_MSI_REG)
+        if (msir_index >= NR_MSI_REG_MAX)
                 cascade_irq = NO_IRQ;
 
         irqd_set_chained_irq_inprogress(idata);
@@ -285,8 +299,8 @@ static void fsl_msi_cascade(unsigned int irq, struct irq_desc *desc)
                 intr_index = ffs(msir_value) - 1;
 
                 cascade_irq = irq_linear_revmap(msi_data->irqhost,
-                                msir_index * IRQS_PER_MSI_REG +
-                                        intr_index + have_shift);
+                                msi_hwirq(msi_data, msir_index,
+                                          intr_index + have_shift));
                 if (cascade_irq != NO_IRQ)
                         generic_handle_irq(cascade_irq);
                 have_shift += intr_index + 1;
@@ -316,7 +330,7 @@ static int fsl_of_msi_remove(struct platform_device *ofdev)
 
         if (msi->list.prev != NULL)
                 list_del(&msi->list);
-        for (i = 0; i < NR_MSI_REG; i++) {
+        for (i = 0; i < NR_MSI_REG_MAX; i++) {
                 virq = msi->msi_virqs[i];
                 if (virq != NO_IRQ) {
                         cascade_data = irq_get_handler_data(virq);
@@ -339,7 +353,7 @@ static int fsl_msi_setup_hwirq(struct fsl_msi *msi, struct platform_device *dev,
                                int offset, int irq_index)
 {
         struct fsl_msi_cascade_data *cascade_data = NULL;
-        int virt_msir;
+        int virt_msir, i;
 
         virt_msir = irq_of_parse_and_map(dev->dev.of_node, irq_index);
         if (virt_msir == NO_IRQ) {
@@ -360,6 +374,11 @@ static int fsl_msi_setup_hwirq(struct fsl_msi *msi, struct platform_device *dev,
         irq_set_handler_data(virt_msir, cascade_data);
         irq_set_chained_handler(virt_msir, fsl_msi_cascade);
 
+        /* Release the hwirqs corresponding to this MSI register */
+        for (i = 0; i < IRQS_PER_MSI_REG; i++)
+                msi_bitmap_free_hwirqs(&msi->bitmap,
+                                       msi_hwirq(msi, offset, i), 1);
+
         return 0;
 }
 
@@ -368,14 +387,12 @@ static int fsl_of_msi_probe(struct platform_device *dev)
 {
         const struct of_device_id *match;
         struct fsl_msi *msi;
-        struct resource res;
+        struct resource res, msiir;
         int err, i, j, irq_index, count;
-        int rc;
         const u32 *p;
         const struct fsl_msi_feature *features;
         int len;
         u32 offset;
-        static const u32 all_avail[] = { 0, NR_MSI_IRQS };
 
         match = of_match_device(fsl_of_msi_ids, &dev->dev);
         if (!match)
@@ -392,7 +409,7 @@ static int fsl_of_msi_probe(struct platform_device *dev)
         platform_set_drvdata(dev, msi);
 
         msi->irqhost = irq_domain_add_linear(dev->dev.of_node,
-                                      NR_MSI_IRQS, &fsl_msi_host_ops, msi);
+                                      NR_MSI_IRQS_MAX, &fsl_msi_host_ops, msi);
 
         if (msi->irqhost == NULL) {
                 dev_err(&dev->dev, "No memory for MSI irqhost\n");
@@ -421,6 +438,16 @@ static int fsl_of_msi_probe(struct platform_device *dev)
                 }
                 msi->msiir_offset =
                         features->msiir_offset + (res.start & 0xfffff);
+
+                /*
+                 * First read the MSIIR/MSIIR1 offset from dts
+                 * On failure use the hardcode MSIIR offset
+                 */
+                if (of_address_to_resource(dev->dev.of_node, 1, &msiir))
+                        msi->msiir_offset = features->msiir_offset +
+                                            (res.start & MSIIR_OFFSET_MASK);
+                else
+                        msi->msiir_offset = msiir.start & MSIIR_OFFSET_MASK;
         }
 
         msi->feature = features->fsl_pic_ip;
@@ -431,42 +458,66 @@ static int fsl_of_msi_probe(struct platform_device *dev)
          */
         msi->phandle = dev->dev.of_node->phandle;
 
-        rc = fsl_msi_init_allocator(msi);
-        if (rc) {
+        err = fsl_msi_init_allocator(msi);
+        if (err) {
                 dev_err(&dev->dev, "Error allocating MSI bitmap\n");
                 goto error_out;
         }
 
         p = of_get_property(dev->dev.of_node, "msi-available-ranges", &len);
-        if (p && len % (2 * sizeof(u32)) != 0) {
-                dev_err(&dev->dev, "%s: Malformed msi-available-ranges property\n",
-                        __func__);
-                err = -EINVAL;
-                goto error_out;
-        }
 
-        if (!p) {
-                p = all_avail;
-                len = sizeof(all_avail);
-        }
+        if (of_device_is_compatible(dev->dev.of_node, "fsl,mpic-msi-v4.3")) {
+                msi->srs_shift = MSIIR1_SRS_SHIFT;
+                msi->ibs_shift = MSIIR1_IBS_SHIFT;
+                if (p)
+                        dev_warn(&dev->dev, "%s: dose not support msi-available-ranges property\n",
+                                __func__);
+
+                for (irq_index = 0; irq_index < NR_MSI_REG_MSIIR1;
+                     irq_index++) {
+                        err = fsl_msi_setup_hwirq(msi, dev,
+                                                  irq_index, irq_index);
+                        if (err)
+                                goto error_out;
+                }
+        } else {
+                static const u32 all_avail[] =
+                        { 0, NR_MSI_REG_MSIIR * IRQS_PER_MSI_REG };
 
-        for (irq_index = 0, i = 0; i < len / (2 * sizeof(u32)); i++) {
-                if (p[i * 2] % IRQS_PER_MSI_REG ||
-                    p[i * 2 + 1] % IRQS_PER_MSI_REG) {
-                        printk(KERN_WARNING "%s: %s: msi available range of %u at %u is not IRQ-aligned\n",
-                               __func__, dev->dev.of_node->full_name,
-                               p[i * 2 + 1], p[i * 2]);
+                msi->srs_shift = MSIIR_SRS_SHIFT;
+                msi->ibs_shift = MSIIR_IBS_SHIFT;
+
+                if (p && len % (2 * sizeof(u32)) != 0) {
+                        dev_err(&dev->dev, "%s: Malformed msi-available-ranges property\n",
+                                __func__);
                         err = -EINVAL;
                         goto error_out;
                 }
 
-                offset = p[i * 2] / IRQS_PER_MSI_REG;
-                count = p[i * 2 + 1] / IRQS_PER_MSI_REG;
+                if (!p) {
+                        p = all_avail;
+                        len = sizeof(all_avail);
+                }
 
-                for (j = 0; j < count; j++, irq_index++) {
-                        err = fsl_msi_setup_hwirq(msi, dev, offset + j, irq_index);
-                        if (err)
+                for (irq_index = 0, i = 0; i < len / (2 * sizeof(u32)); i++) {
+                        if (p[i * 2] % IRQS_PER_MSI_REG ||
+                            p[i * 2 + 1] % IRQS_PER_MSI_REG) {
+                                pr_warn("%s: %s: msi available range of %u at %u is not IRQ-aligned\n",
+                                       __func__, dev->dev.of_node->full_name,
+                                       p[i * 2 + 1], p[i * 2]);
+                                err = -EINVAL;
                                 goto error_out;
+                        }
+
+                        offset = p[i * 2] / IRQS_PER_MSI_REG;
+                        count = p[i * 2 + 1] / IRQS_PER_MSI_REG;
+
+                        for (j = 0; j < count; j++, irq_index++) {
+                                err = fsl_msi_setup_hwirq(msi, dev, offset + j,
+                                                          irq_index);
+                                if (err)
+                                        goto error_out;
+                        }
                 }
         }
 
@@ -509,6 +560,10 @@ static const struct of_device_id fsl_of_msi_ids[] = {
                 .data = &mpic_msi_feature,
         },
         {
+                .compatible = "fsl,mpic-msi-v4.3",
+                .data = &mpic_msi_feature,
+        },
+        {
                 .compatible = "fsl,ipic-msi",
                 .data = &ipic_msi_feature,
         },
diff --git a/arch/powerpc/sysdev/fsl_msi.h b/arch/powerpc/sysdev/fsl_msi.h
index 8225f8653f78..df9aa9fe0933 100644
--- a/arch/powerpc/sysdev/fsl_msi.h
+++ b/arch/powerpc/sysdev/fsl_msi.h
@@ -16,9 +16,11 @@
 #include <linux/of.h>
 #include <asm/msi_bitmap.h>
 
-#define NR_MSI_REG              8
+#define NR_MSI_REG_MSIIR        8  /* MSIIR can index 8 MSI registers */
+#define NR_MSI_REG_MSIIR1       16 /* MSIIR1 can index 16 MSI registers */
+#define NR_MSI_REG_MAX          NR_MSI_REG_MSIIR1
 #define IRQS_PER_MSI_REG        32
-#define NR_MSI_IRQS     (NR_MSI_REG * IRQS_PER_MSI_REG)
+#define NR_MSI_IRQS_MAX (NR_MSI_REG_MAX * IRQS_PER_MSI_REG)
 
 #define FSL_PIC_IP_MASK   0x0000000F
 #define FSL_PIC_IP_MPIC   0x00000001
@@ -31,9 +33,11 @@ struct fsl_msi {
         unsigned long cascade_irq;
 
         u32 msiir_offset; /* Offset of MSIIR, relative to start of CCSR */
+        u32 ibs_shift; /* Shift of interrupt bit select */
+        u32 srs_shift; /* Shift of the shared interrupt register select */
         void __iomem *msi_regs;
         u32 feature;
-        int msi_virqs[NR_MSI_REG];
+        int msi_virqs[NR_MSI_REG_MAX];
 
         struct msi_bitmap bitmap;
 
diff --git a/arch/powerpc/sysdev/fsl_pci.c b/arch/powerpc/sysdev/fsl_pci.c
index 46ac1ddea683..ccfb50ddfe38 100644
--- a/arch/powerpc/sysdev/fsl_pci.c
+++ b/arch/powerpc/sysdev/fsl_pci.c
@@ -26,11 +26,15 @@
 #include <linux/memblock.h>
 #include <linux/log2.h>
 #include <linux/slab.h>
+#include <linux/uaccess.h>
 
 #include <asm/io.h>
 #include <asm/prom.h>
 #include <asm/pci-bridge.h>
+#include <asm/ppc-pci.h>
 #include <asm/machdep.h>
+#include <asm/disassemble.h>
+#include <asm/ppc-opcode.h>
 #include <sysdev/fsl_soc.h>
 #include <sysdev/fsl_pci.h>
 
@@ -64,7 +68,7 @@ static int fsl_pcie_check_link(struct pci_controller *hose)
         if (hose->indirect_type & PPC_INDIRECT_TYPE_FSL_CFG_REG_LINK) {
                 if (hose->ops->read == fsl_indirect_read_config) {
                         struct pci_bus bus;
-                        bus.number = 0;
+                        bus.number = hose->first_busno;
                         bus.sysdata = hose;
                         bus.ops = hose->ops;
                         indirect_read_config(&bus, 0, PCIE_LTSSM, 4, &val);
@@ -297,10 +301,10 @@ static void setup_pci_atmu(struct pci_controller *hose)
         if (early_find_capability(hose, 0, 0, PCI_CAP_ID_EXP)) {
                 /* Size window to exact size if power-of-two or one size up */
                 if ((1ull << mem_log) != mem) {
+                        mem_log++;
                         if ((1ull << mem_log) > mem)
                                 pr_info("%s: Setting PCI inbound window "
                                         "greater than memory size\n", name);
-                        mem_log++;
                 }
 
                 piwar |= ((mem_log - 1) & PIWAR_SZ_MASK);
@@ -373,7 +377,9 @@ static void setup_pci_atmu(struct pci_controller *hose)
         }
 
         if (hose->dma_window_size < mem) {
-#ifndef CONFIG_SWIOTLB
+#ifdef CONFIG_SWIOTLB
+                ppc_swiotlb_enable = 1;
+#else
                 pr_err("%s: ERROR: Memory size exceeds PCI ATMU ability to "
                         "map - enable CONFIG_SWIOTLB to avoid dma errors.\n",
                          name);
@@ -868,6 +874,160 @@ u64 fsl_pci_immrbar_base(struct pci_controller *hose)
         return 0;
 }
 
+#ifdef CONFIG_E500
+static int mcheck_handle_load(struct pt_regs *regs, u32 inst)
+{
+        unsigned int rd, ra, rb, d;
+
+        rd = get_rt(inst);
+        ra = get_ra(inst);
+        rb = get_rb(inst);
+        d = get_d(inst);
+
+        switch (get_op(inst)) {
+        case 31:
+                switch (get_xop(inst)) {
+                case OP_31_XOP_LWZX:
+                case OP_31_XOP_LWBRX:
+                        regs->gpr[rd] = 0xffffffff;
+                        break;
+
+                case OP_31_XOP_LWZUX:
+                        regs->gpr[rd] = 0xffffffff;
+                        regs->gpr[ra] += regs->gpr[rb];
+                        break;
+
+                case OP_31_XOP_LBZX:
+                        regs->gpr[rd] = 0xff;
+                        break;
+
+                case OP_31_XOP_LBZUX:
+                        regs->gpr[rd] = 0xff;
+                        regs->gpr[ra] += regs->gpr[rb];
+                        break;
+
+                case OP_31_XOP_LHZX:
+                case OP_31_XOP_LHBRX:
+                        regs->gpr[rd] = 0xffff;
+                        break;
+
+                case OP_31_XOP_LHZUX:
+                        regs->gpr[rd] = 0xffff;
+                        regs->gpr[ra] += regs->gpr[rb];
+                        break;
+
+                case OP_31_XOP_LHAX:
+                        regs->gpr[rd] = ~0UL;
+                        break;
+
+                case OP_31_XOP_LHAUX:
+                        regs->gpr[rd] = ~0UL;
+                        regs->gpr[ra] += regs->gpr[rb];
+                        break;
+
+                default:
+                        return 0;
+                }
+                break;
+
+        case OP_LWZ:
+                regs->gpr[rd] = 0xffffffff;
+                break;
+
+        case OP_LWZU:
+                regs->gpr[rd] = 0xffffffff;
+                regs->gpr[ra] += (s16)d;
+                break;
+
+        case OP_LBZ:
+                regs->gpr[rd] = 0xff;
+                break;
+
+        case OP_LBZU:
+                regs->gpr[rd] = 0xff;
+                regs->gpr[ra] += (s16)d;
+                break;
+
+        case OP_LHZ:
+                regs->gpr[rd] = 0xffff;
+                break;
+
+        case OP_LHZU:
+                regs->gpr[rd] = 0xffff;
+                regs->gpr[ra] += (s16)d;
+                break;
+
+        case OP_LHA:
+                regs->gpr[rd] = ~0UL;
+                break;
+
+        case OP_LHAU:
+                regs->gpr[rd] = ~0UL;
+                regs->gpr[ra] += (s16)d;
+                break;
+
+        default:
+                return 0;
+        }
+
+        return 1;
+}
+
+static int is_in_pci_mem_space(phys_addr_t addr)
+{
+        struct pci_controller *hose;
+        struct resource *res;
+        int i;
+
+        list_for_each_entry(hose, &hose_list, list_node) {
+                if (!(hose->indirect_type & PPC_INDIRECT_TYPE_EXT_REG))
+                        continue;
+
+                for (i = 0; i < 3; i++) {
+                        res = &hose->mem_resources[i];
+                        if ((res->flags & IORESOURCE_MEM) &&
+                                addr >= res->start && addr <= res->end)
+                                return 1;
+                }
+        }
+        return 0;
+}
+
+int fsl_pci_mcheck_exception(struct pt_regs *regs)
+{
+        u32 inst;
+        int ret;
+        phys_addr_t addr = 0;
+
+        /* Let KVM/QEMU deal with the exception */
+        if (regs->msr & MSR_GS)
+                return 0;
+
+#ifdef CONFIG_PHYS_64BIT
+        addr = mfspr(SPRN_MCARU);
+        addr <<= 32;
+#endif
+        addr += mfspr(SPRN_MCAR);
+
+        if (is_in_pci_mem_space(addr)) {
+                if (user_mode(regs)) {
+                        pagefault_disable();
+                        ret = get_user(regs->nip, &inst);
+                        pagefault_enable();
+                } else {
+                        ret = probe_kernel_address(regs->nip, inst);
+                }
+
+                if (mcheck_handle_load(regs, inst)) {
+                        regs->nip += 4;
+                        return 1;
+                }
+        }
+
+        return 0;
+}
+#endif
+
 #if defined(CONFIG_FSL_SOC_BOOKE) || defined(CONFIG_PPC_86xx)
 static const struct of_device_id pci_ids[] = {
         { .compatible = "fsl,mpc8540-pci", },
@@ -928,28 +1088,10 @@ static int fsl_pci_probe(struct platform_device *pdev)
 {
         int ret;
         struct device_node *node;
-#ifdef CONFIG_SWIOTLB
-        struct pci_controller *hose;
-#endif
 
         node = pdev->dev.of_node;
         ret = fsl_add_bridge(pdev, fsl_pci_primary == node);
 
-#ifdef CONFIG_SWIOTLB
-        if (ret == 0) {
-                hose = pci_find_hose_for_OF_device(pdev->dev.of_node);
-
-                /*
-                 * if we couldn't map all of DRAM via the dma windows
-                 * we need SWIOTLB to handle buffers located outside of
-                 * dma capable memory region
-                 */
-                if (memblock_end_of_DRAM() - 1 > hose->dma_window_base_cur +
-                                hose->dma_window_size)
-                        ppc_swiotlb_enable = 1;
-        }
-#endif
-
         mpc85xx_pci_err_probe(pdev);
 
         return 0;
diff --git a/arch/powerpc/sysdev/fsl_pci.h b/arch/powerpc/sysdev/fsl_pci.h
index 72b5625330e2..defc422a375f 100644
--- a/arch/powerpc/sysdev/fsl_pci.h
+++ b/arch/powerpc/sysdev/fsl_pci.h
@@ -126,5 +126,11 @@ static inline int mpc85xx_pci_err_probe(struct platform_device *op)
 }
 #endif
 
+#ifdef CONFIG_FSL_PCI
+extern int fsl_pci_mcheck_exception(struct pt_regs *);
+#else
+static inline int fsl_pci_mcheck_exception(struct pt_regs *regs) {return 0; }
+#endif
+
 #endif /* __POWERPC_FSL_PCI_H */
 #endif /* __KERNEL__ */
diff --git a/arch/powerpc/sysdev/rtc_cmos_setup.c b/arch/powerpc/sysdev/rtc_cmos_setup.c
index af79e1ea74b6..af0f9beddca9 100644
--- a/arch/powerpc/sysdev/rtc_cmos_setup.c
+++ b/arch/powerpc/sysdev/rtc_cmos_setup.c
@@ -62,7 +62,7 @@ static int  __init add_rtc(void)
         pd = platform_device_register_simple("rtc_cmos", -1,
                                              &res[0], num_res);
 
-        return PTR_RET(pd);
+        return PTR_ERR_OR_ZERO(pd);
 }
 fs_initcall(add_rtc);
 
diff --git a/arch/powerpc/sysdev/xics/icp-native.c b/arch/powerpc/sysdev/xics/icp-native.c
index 7cd728b3b5e4..9dee47071af8 100644
--- a/arch/powerpc/sysdev/xics/icp-native.c
+++ b/arch/powerpc/sysdev/xics/icp-native.c
@@ -216,7 +216,7 @@ static int __init icp_native_init_one_node(struct device_node *np,
                                            unsigned int *indx)
 {
         unsigned int ilen;
-        const u32 *ireg;
+        const __be32 *ireg;
         int i;
         int reg_tuple_size;
         int num_servers = 0;
diff --git a/arch/powerpc/sysdev/xics/xics-common.c b/arch/powerpc/sysdev/xics/xics-common.c
index 9049d9f44485..fe0cca477164 100644
--- a/arch/powerpc/sysdev/xics/xics-common.c
+++ b/arch/powerpc/sysdev/xics/xics-common.c
@@ -49,7 +49,7 @@ void xics_update_irq_servers(void)
         int i, j;
         struct device_node *np;
         u32 ilen;
-        const u32 *ireg;
+        const __be32 *ireg;
         u32 hcpuid;
 
         /* Find the server numbers for the boot cpu. */
@@ -75,8 +75,8 @@ void xics_update_irq_servers(void)
          * default distribution server
          */
         for (j = 0; j < i; j += 2) {
-                if (ireg[j] == hcpuid) {
-                        xics_default_distrib_server = ireg[j+1];
+                if (be32_to_cpu(ireg[j]) == hcpuid) {
+                        xics_default_distrib_server = be32_to_cpu(ireg[j+1]);
                         break;
                 }
         }
@@ -383,7 +383,7 @@ void __init xics_register_ics(struct ics *ics)
 static void __init xics_get_server_size(void)
 {
         struct device_node *np;
-        const u32 *isize;
+        const __be32 *isize;
 
         /* We fetch the interrupt server size from the first ICS node
          * we find if any
@@ -394,7 +394,7 @@ static void __init xics_get_server_size(void)
         isize = of_get_property(np, "ibm,interrupt-server#-size", NULL);
         if (!isize)
                 return;
-        xics_interrupt_server_size = *isize;
+        xics_interrupt_server_size = be32_to_cpu(*isize);
         of_node_put(np);
 }
 
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index 96bf5bd30fbc..af9d3469fb99 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -972,27 +972,27 @@ static void bootcmds(void)
 static int cpu_cmd(void)
 {
 #ifdef CONFIG_SMP
-        unsigned long cpu;
+        unsigned long cpu, first_cpu, last_cpu;
         int timeout;
-        int count;
 
         if (!scanhex(&cpu)) {
                 /* print cpus waiting or in xmon */
                 printf("cpus stopped:");
-                count = 0;
+                last_cpu = first_cpu = NR_CPUS;
                 for_each_possible_cpu(cpu) {
                         if (cpumask_test_cpu(cpu, &cpus_in_xmon)) {
-                                if (count == 0)
-                                        printf(" %x", cpu);
-                                ++count;
-                        } else {
-                                if (count > 1)
-                                        printf("-%x", cpu - 1);
-                                count = 0;
+                                if (cpu == last_cpu + 1) {
+                                        last_cpu = cpu;
+                                } else {
+                                        if (last_cpu != first_cpu)
+                                                printf("-%lx", last_cpu);
+                                        last_cpu = first_cpu = cpu;
+                                        printf(" %lx", cpu);
+                                }
                         }
                 }
-                if (count > 1)
-                        printf("-%x", NR_CPUS - 1);
+                if (last_cpu != first_cpu)
+                        printf("-%lx", last_cpu);
                 printf("\n");
                 return 0;
         }
@@ -1256,11 +1256,18 @@ const char *getvecname(unsigned long vec)
         case 0x700:     ret = "(Program Check)"; break;
         case 0x800:     ret = "(FPU Unavailable)"; break;
         case 0x900:     ret = "(Decrementer)"; break;
+        case 0x980:     ret = "(Hypervisor Decrementer)"; break;
+        case 0xa00:     ret = "(Doorbell)"; break;
         case 0xc00:     ret = "(System Call)"; break;
         case 0xd00:     ret = "(Single Step)"; break;
+        case 0xe40:     ret = "(Emulation Assist)"; break;
+        case 0xe60:     ret = "(HMI)"; break;
+        case 0xe80:     ret = "(Hypervisor Doorbell)"; break;
         case 0xf00:     ret = "(Performance Monitor)"; break;
         case 0xf20:     ret = "(Altivec Unavailable)"; break;
         case 0x1300:    ret = "(Instruction Breakpoint)"; break;
+        case 0x1500:    ret = "(Denormalisation)"; break;
+        case 0x1700:    ret = "(Altivec Assist)"; break;
         default: ret = "";
         }
         return ret;
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 22f75b504f7f..8b7892bf6d8b 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -116,8 +116,10 @@ config S390
         select HAVE_FUNCTION_GRAPH_TRACER
         select HAVE_FUNCTION_TRACER
         select HAVE_FUNCTION_TRACE_MCOUNT_TEST
+        select HAVE_GENERIC_HARDIRQS
         select HAVE_KERNEL_BZIP2
         select HAVE_KERNEL_GZIP
+        select HAVE_KERNEL_LZ4
         select HAVE_KERNEL_LZMA
         select HAVE_KERNEL_LZO
         select HAVE_KERNEL_XZ
@@ -227,11 +229,12 @@ config MARCH_Z196
           not work on older machines.
 
 config MARCH_ZEC12
-        bool "IBM zEC12"
+        bool "IBM zBC12 and zEC12"
         select HAVE_MARCH_ZEC12_FEATURES if 64BIT
         help
-          Select this to enable optimizations for IBM zEC12 (2827 series). The
-          kernel will be slightly faster but will not work on older machines.
+          Select this to enable optimizations for IBM zBC12 and zEC12 (2828 and
+          2827 series). The kernel will be slightly faster but will not work on
+          older machines.
 
 endchoice
 
@@ -443,6 +446,16 @@ config PCI_NR_FUNCTIONS
           This allows you to specify the maximum number of PCI functions which
           this kernel will support.
 
+config PCI_NR_MSI
+        int "Maximum number of MSI interrupts (64-32768)"
+        range 64 32768
+        default "256"
+        help
+          This defines the number of virtual interrupts the kernel will
+          provide for MSI interrupts. If you configure your system to have
+          too few drivers will fail to allocate MSI interrupts for all
+          PCI devices.
+
 source "drivers/pci/Kconfig"
 source "drivers/pci/pcie/Kconfig"
 source "drivers/pci/hotplug/Kconfig"
@@ -709,6 +722,7 @@ config S390_GUEST
         def_bool y
         prompt "s390 support for virtio devices"
         depends on 64BIT
+        select TTY
         select VIRTUALIZATION
         select VIRTIO
         select VIRTIO_CONSOLE
diff --git a/arch/s390/boot/compressed/Makefile b/arch/s390/boot/compressed/Makefile
index 3ad8f61c9985..866ecbe670e4 100644
--- a/arch/s390/boot/compressed/Makefile
+++ b/arch/s390/boot/compressed/Makefile
@@ -6,9 +6,9 @@
 
 BITS := $(if $(CONFIG_64BIT),64,31)
 
-targets := vmlinux.lds vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 \
-           vmlinux.bin.xz vmlinux.bin.lzma vmlinux.bin.lzo misc.o piggy.o \
-           sizes.h head$(BITS).o
+targets := vmlinux.lds vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2
+targets += vmlinux.bin.xz vmlinux.bin.lzma vmlinux.bin.lzo vmlinux.bin.lz4
+targets += misc.o piggy.o sizes.h head$(BITS).o
 
 KBUILD_CFLAGS := -m$(BITS) -D__KERNEL__ $(LINUX_INCLUDE) -O2
 KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
@@ -48,6 +48,7 @@ vmlinux.bin.all-y := $(obj)/vmlinux.bin
 
 suffix-$(CONFIG_KERNEL_GZIP)  := gz
 suffix-$(CONFIG_KERNEL_BZIP2) := bz2
+suffix-$(CONFIG_KERNEL_LZ4)  := lz4
 suffix-$(CONFIG_KERNEL_LZMA)  := lzma
 suffix-$(CONFIG_KERNEL_LZO)  := lzo
 suffix-$(CONFIG_KERNEL_XZ)  := xz
@@ -56,6 +57,8 @@ $(obj)/vmlinux.bin.gz: $(vmlinux.bin.all-y)
         $(call if_changed,gzip)
 $(obj)/vmlinux.bin.bz2: $(vmlinux.bin.all-y)
         $(call if_changed,bzip2)
+$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y)
+        $(call if_changed,lz4)
 $(obj)/vmlinux.bin.lzma: $(vmlinux.bin.all-y)
         $(call if_changed,lzma)
 $(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y)
diff --git a/arch/s390/boot/compressed/misc.c b/arch/s390/boot/compressed/misc.c
index c4c6a1cf221b..57cbaff1f397 100644
--- a/arch/s390/boot/compressed/misc.c
+++ b/arch/s390/boot/compressed/misc.c
@@ -47,6 +47,10 @@ static unsigned long free_mem_end_ptr;
 #include "../../../../lib/decompress_bunzip2.c"
 #endif
 
+#ifdef CONFIG_KERNEL_LZ4
+#include "../../../../lib/decompress_unlz4.c"
+#endif
+
 #ifdef CONFIG_KERNEL_LZMA
 #include "../../../../lib/decompress_unlzma.c"
 #endif
diff --git a/arch/s390/hypfs/hypfs.h b/arch/s390/hypfs/hypfs.h
index f41e0ef7fdf9..79f2ac55253f 100644
--- a/arch/s390/hypfs/hypfs.h
+++ b/arch/s390/hypfs/hypfs.h
@@ -18,26 +18,23 @@
 #define UPDATE_FILE_MODE 0220
 #define DIR_MODE         0550
 
-extern struct dentry *hypfs_mkdir(struct super_block *sb, struct dentry *parent,
-                                  const char *name);
+extern struct dentry *hypfs_mkdir(struct dentry *parent, const char *name);
 
-extern struct dentry *hypfs_create_u64(struct super_block *sb,
-                                       struct dentry *dir, const char *name,
+extern struct dentry *hypfs_create_u64(struct dentry *dir, const char *name,
                                        __u64 value);
 
-extern struct dentry *hypfs_create_str(struct super_block *sb,
-                                       struct dentry *dir, const char *name,
+extern struct dentry *hypfs_create_str(struct dentry *dir, const char *name,
                                        char *string);
 
 /* LPAR Hypervisor */
 extern int hypfs_diag_init(void);
 extern void hypfs_diag_exit(void);
-extern int hypfs_diag_create_files(struct super_block *sb, struct dentry *root);
+extern int hypfs_diag_create_files(struct dentry *root);
 
 /* VM Hypervisor */
 extern int hypfs_vm_init(void);
 extern void hypfs_vm_exit(void);
-extern int hypfs_vm_create_files(struct super_block *sb, struct dentry *root);
+extern int hypfs_vm_create_files(struct dentry *root);
 
 /* debugfs interface */
 struct hypfs_dbfs_file;
diff --git a/arch/s390/hypfs/hypfs_dbfs.c b/arch/s390/hypfs/hypfs_dbfs.c
index bb5dd496614f..17ab8b7b53cc 100644
--- a/arch/s390/hypfs/hypfs_dbfs.c
+++ b/arch/s390/hypfs/hypfs_dbfs.c
@@ -105,7 +105,7 @@ void hypfs_dbfs_remove_file(struct hypfs_dbfs_file *df)
 int hypfs_dbfs_init(void)
 {
         dbfs_dir = debugfs_create_dir("s390_hypfs", NULL);
-        return PTR_RET(dbfs_dir);
+        return PTR_ERR_OR_ZERO(dbfs_dir);
 }
 
 void hypfs_dbfs_exit(void)
diff --git a/arch/s390/hypfs/hypfs_diag.c b/arch/s390/hypfs/hypfs_diag.c
index 138893e5f736..5eeffeefae06 100644
--- a/arch/s390/hypfs/hypfs_diag.c
+++ b/arch/s390/hypfs/hypfs_diag.c
@@ -623,8 +623,7 @@ void hypfs_diag_exit(void)
  * *******************************************
  */
 
-static int hypfs_create_cpu_files(struct super_block *sb,
-                                  struct dentry *cpus_dir, void *cpu_info)
+static int hypfs_create_cpu_files(struct dentry *cpus_dir, void *cpu_info)
 {
         struct dentry *cpu_dir;
         char buffer[TMP_SIZE];
@@ -632,30 +631,29 @@ static int hypfs_create_cpu_files(struct super_block *sb,
 
         snprintf(buffer, TMP_SIZE, "%d", cpu_info__cpu_addr(diag204_info_type,
                                                             cpu_info));
-        cpu_dir = hypfs_mkdir(sb, cpus_dir, buffer);
-        rc = hypfs_create_u64(sb, cpu_dir, "mgmtime",
+        cpu_dir = hypfs_mkdir(cpus_dir, buffer);
+        rc = hypfs_create_u64(cpu_dir, "mgmtime",
                               cpu_info__acc_time(diag204_info_type, cpu_info) -
                               cpu_info__lp_time(diag204_info_type, cpu_info));
         if (IS_ERR(rc))
                 return PTR_ERR(rc);
-        rc = hypfs_create_u64(sb, cpu_dir, "cputime",
+        rc = hypfs_create_u64(cpu_dir, "cputime",
                               cpu_info__lp_time(diag204_info_type, cpu_info));
         if (IS_ERR(rc))
                 return PTR_ERR(rc);
         if (diag204_info_type == INFO_EXT) {
-                rc = hypfs_create_u64(sb, cpu_dir, "onlinetime",
+                rc = hypfs_create_u64(cpu_dir, "onlinetime",
                                       cpu_info__online_time(diag204_info_type,
                                                             cpu_info));
                 if (IS_ERR(rc))
                         return PTR_ERR(rc);
         }
         diag224_idx2name(cpu_info__ctidx(diag204_info_type, cpu_info), buffer);
-        rc = hypfs_create_str(sb, cpu_dir, "type", buffer);
+        rc = hypfs_create_str(cpu_dir, "type", buffer);
         return PTR_RET(rc);
 }
 
-static void *hypfs_create_lpar_files(struct super_block *sb,
-                                     struct dentry *systems_dir, void *part_hdr)
+static void *hypfs_create_lpar_files(struct dentry *systems_dir, void *part_hdr)
 {
         struct dentry *cpus_dir;
         struct dentry *lpar_dir;
@@ -665,16 +663,16 @@ static void *hypfs_create_lpar_files(struct super_block *sb,
 
         part_hdr__part_name(diag204_info_type, part_hdr, lpar_name);
         lpar_name[LPAR_NAME_LEN] = 0;
-        lpar_dir = hypfs_mkdir(sb, systems_dir, lpar_name);
+        lpar_dir = hypfs_mkdir(systems_dir, lpar_name);
         if (IS_ERR(lpar_dir))
                 return lpar_dir;
-        cpus_dir = hypfs_mkdir(sb, lpar_dir, "cpus");
+        cpus_dir = hypfs_mkdir(lpar_dir, "cpus");
         if (IS_ERR(cpus_dir))
                 return cpus_dir;
         cpu_info = part_hdr + part_hdr__size(diag204_info_type);
         for (i = 0; i < part_hdr__rcpus(diag204_info_type, part_hdr); i++) {
                 int rc;
-                rc = hypfs_create_cpu_files(sb, cpus_dir, cpu_info);
+                rc = hypfs_create_cpu_files(cpus_dir, cpu_info);
                 if (rc)
                         return ERR_PTR(rc);
                 cpu_info += cpu_info__size(diag204_info_type);
@@ -682,8 +680,7 @@ static void *hypfs_create_lpar_files(struct super_block *sb,
         return cpu_info;
 }
 
-static int hypfs_create_phys_cpu_files(struct super_block *sb,
-                                       struct dentry *cpus_dir, void *cpu_info)
+static int hypfs_create_phys_cpu_files(struct dentry *cpus_dir, void *cpu_info)
 {
         struct dentry *cpu_dir;
         char buffer[TMP_SIZE];
@@ -691,32 +688,31 @@ static int hypfs_create_phys_cpu_files(struct super_block *sb,
 
         snprintf(buffer, TMP_SIZE, "%i", phys_cpu__cpu_addr(diag204_info_type,
                                                             cpu_info));
-        cpu_dir = hypfs_mkdir(sb, cpus_dir, buffer);
+        cpu_dir = hypfs_mkdir(cpus_dir, buffer);
         if (IS_ERR(cpu_dir))
                 return PTR_ERR(cpu_dir);
-        rc = hypfs_create_u64(sb, cpu_dir, "mgmtime",
+        rc = hypfs_create_u64(cpu_dir, "mgmtime",
                               phys_cpu__mgm_time(diag204_info_type, cpu_info));
         if (IS_ERR(rc))
                 return PTR_ERR(rc);
         diag224_idx2name(phys_cpu__ctidx(diag204_info_type, cpu_info), buffer);
-        rc = hypfs_create_str(sb, cpu_dir, "type", buffer);
+        rc = hypfs_create_str(cpu_dir, "type", buffer);
         return PTR_RET(rc);
 }
 
-static void *hypfs_create_phys_files(struct super_block *sb,
-                                     struct dentry *parent_dir, void *phys_hdr)
+static void *hypfs_create_phys_files(struct dentry *parent_dir, void *phys_hdr)
 {
         int i;
         void *cpu_info;
         struct dentry *cpus_dir;
 
-        cpus_dir = hypfs_mkdir(sb, parent_dir, "cpus");
+        cpus_dir = hypfs_mkdir(parent_dir, "cpus");
         if (IS_ERR(cpus_dir))
                 return cpus_dir;
         cpu_info = phys_hdr + phys_hdr__size(diag204_info_type);
         for (i = 0; i < phys_hdr__cpus(diag204_info_type, phys_hdr); i++) {
                 int rc;
-                rc = hypfs_create_phys_cpu_files(sb, cpus_dir, cpu_info);
+                rc = hypfs_create_phys_cpu_files(cpus_dir, cpu_info);
                 if (rc)
                         return ERR_PTR(rc);
                 cpu_info += phys_cpu__size(diag204_info_type);
@@ -724,7 +720,7 @@ static void *hypfs_create_phys_files(struct super_block *sb,
         return cpu_info;
 }
 
-int hypfs_diag_create_files(struct super_block *sb, struct dentry *root)
+int hypfs_diag_create_files(struct dentry *root)
 {
         struct dentry *systems_dir, *hyp_dir;
         void *time_hdr, *part_hdr;
@@ -735,7 +731,7 @@ int hypfs_diag_create_files(struct super_block *sb, struct dentry *root)
         if (IS_ERR(buffer))
                 return PTR_ERR(buffer);
 
-        systems_dir = hypfs_mkdir(sb, root, "systems");
+        systems_dir = hypfs_mkdir(root, "systems");
         if (IS_ERR(systems_dir)) {
                 rc = PTR_ERR(systems_dir);
                 goto err_out;
@@ -743,25 +739,25 @@ int hypfs_diag_create_files(struct super_block *sb, struct dentry *root)
         time_hdr = (struct x_info_blk_hdr *)buffer;
         part_hdr = time_hdr + info_blk_hdr__size(diag204_info_type);
         for (i = 0; i < info_blk_hdr__npar(diag204_info_type, time_hdr); i++) {
-                part_hdr = hypfs_create_lpar_files(sb, systems_dir, part_hdr);
+                part_hdr = hypfs_create_lpar_files(systems_dir, part_hdr);
                 if (IS_ERR(part_hdr)) {
                         rc = PTR_ERR(part_hdr);
                         goto err_out;
                 }
         }
         if (info_blk_hdr__flags(diag204_info_type, time_hdr) & LPAR_PHYS_FLG) {
-                ptr = hypfs_create_phys_files(sb, root, part_hdr);
+                ptr = hypfs_create_phys_files(root, part_hdr);
                 if (IS_ERR(ptr)) {
                         rc = PTR_ERR(ptr);
                         goto err_out;
                 }
         }
-        hyp_dir = hypfs_mkdir(sb, root, "hyp");
+        hyp_dir = hypfs_mkdir(root, "hyp");
         if (IS_ERR(hyp_dir)) {
                 rc = PTR_ERR(hyp_dir);
                 goto err_out;
         }
-        ptr = hypfs_create_str(sb, hyp_dir, "type", "LPAR Hypervisor");
+        ptr = hypfs_create_str(hyp_dir, "type", "LPAR Hypervisor");
         if (IS_ERR(ptr)) {
                 rc = PTR_ERR(ptr);
                 goto err_out;
diff --git a/arch/s390/hypfs/hypfs_vm.c b/arch/s390/hypfs/hypfs_vm.c
index f364dcf77e8e..24908ce149f1 100644
--- a/arch/s390/hypfs/hypfs_vm.c
+++ b/arch/s390/hypfs/hypfs_vm.c
@@ -107,16 +107,15 @@ static void diag2fc_free(const void *data)
         vfree(data);
 }
 
-#define ATTRIBUTE(sb, dir, name, member) \
+#define ATTRIBUTE(dir, name, member) \
 do { \
         void *rc; \
-        rc = hypfs_create_u64(sb, dir, name, member); \
+        rc = hypfs_create_u64(dir, name, member); \
         if (IS_ERR(rc)) \
                 return PTR_ERR(rc); \
 } while(0)
 
-static int hpyfs_vm_create_guest(struct super_block *sb,
-                                 struct dentry *systems_dir,
+static int hpyfs_vm_create_guest(struct dentry *systems_dir,
                                  struct diag2fc_data *data)
 {
         char guest_name[NAME_LEN + 1] = {};
@@ -130,46 +129,46 @@ static int hpyfs_vm_create_guest(struct super_block *sb,
         memcpy(guest_name, data->guest_name, NAME_LEN);
         EBCASC(guest_name, NAME_LEN);
         strim(guest_name);
-        guest_dir = hypfs_mkdir(sb, systems_dir, guest_name);
+        guest_dir = hypfs_mkdir(systems_dir, guest_name);
         if (IS_ERR(guest_dir))
                 return PTR_ERR(guest_dir);
-        ATTRIBUTE(sb, guest_dir, "onlinetime_us", data->el_time);
+        ATTRIBUTE(guest_dir, "onlinetime_us", data->el_time);
 
         /* logical cpu information */
-        cpus_dir = hypfs_mkdir(sb, guest_dir, "cpus");
+        cpus_dir = hypfs_mkdir(guest_dir, "cpus");
         if (IS_ERR(cpus_dir))
                 return PTR_ERR(cpus_dir);
-        ATTRIBUTE(sb, cpus_dir, "cputime_us", data->used_cpu);
-        ATTRIBUTE(sb, cpus_dir, "capped", capped_value);
-        ATTRIBUTE(sb, cpus_dir, "dedicated", dedicated_flag);
-        ATTRIBUTE(sb, cpus_dir, "count", data->vcpus);
-        ATTRIBUTE(sb, cpus_dir, "weight_min", data->cpu_min);
-        ATTRIBUTE(sb, cpus_dir, "weight_max", data->cpu_max);
-        ATTRIBUTE(sb, cpus_dir, "weight_cur", data->cpu_shares);
+        ATTRIBUTE(cpus_dir, "cputime_us", data->used_cpu);
+        ATTRIBUTE(cpus_dir, "capped", capped_value);
+        ATTRIBUTE(cpus_dir, "dedicated", dedicated_flag);
+        ATTRIBUTE(cpus_dir, "count", data->vcpus);
+        ATTRIBUTE(cpus_dir, "weight_min", data->cpu_min);
+        ATTRIBUTE(cpus_dir, "weight_max", data->cpu_max);
+        ATTRIBUTE(cpus_dir, "weight_cur", data->cpu_shares);
 
         /* memory information */
-        mem_dir = hypfs_mkdir(sb, guest_dir, "mem");
+        mem_dir = hypfs_mkdir(guest_dir, "mem");
         if (IS_ERR(mem_dir))
                 return PTR_ERR(mem_dir);
-        ATTRIBUTE(sb, mem_dir, "min_KiB", data->mem_min_kb);
-        ATTRIBUTE(sb, mem_dir, "max_KiB", data->mem_max_kb);
-        ATTRIBUTE(sb, mem_dir, "used_KiB", data->mem_used_kb);
-        ATTRIBUTE(sb, mem_dir, "share_KiB", data->mem_share_kb);
+        ATTRIBUTE(mem_dir, "min_KiB", data->mem_min_kb);
+        ATTRIBUTE(mem_dir, "max_KiB", data->mem_max_kb);
+        ATTRIBUTE(mem_dir, "used_KiB", data->mem_used_kb);
+        ATTRIBUTE(mem_dir, "share_KiB", data->mem_share_kb);
 
         /* samples */
-        samples_dir = hypfs_mkdir(sb, guest_dir, "samples");
+        samples_dir = hypfs_mkdir(guest_dir, "samples");
         if (IS_ERR(samples_dir))
                 return PTR_ERR(samples_dir);
-        ATTRIBUTE(sb, samples_dir, "cpu_using", data->cpu_use_samp);
-        ATTRIBUTE(sb, samples_dir, "cpu_delay", data->cpu_delay_samp);
-        ATTRIBUTE(sb, samples_dir, "mem_delay", data->page_wait_samp);
-        ATTRIBUTE(sb, samples_dir, "idle", data->idle_samp);
-        ATTRIBUTE(sb, samples_dir, "other", data->other_samp);
-        ATTRIBUTE(sb, samples_dir, "total", data->total_samp);
+        ATTRIBUTE(samples_dir, "cpu_using", data->cpu_use_samp);
+        ATTRIBUTE(samples_dir, "cpu_delay", data->cpu_delay_samp);
+        ATTRIBUTE(samples_dir, "mem_delay", data->page_wait_samp);
+        ATTRIBUTE(samples_dir, "idle", data->idle_samp);
+        ATTRIBUTE(samples_dir, "other", data->other_samp);
+        ATTRIBUTE(samples_dir, "total", data->total_samp);
         return 0;
 }
 
-int hypfs_vm_create_files(struct super_block *sb, struct dentry *root)
+int hypfs_vm_create_files(struct dentry *root)
 {
         struct dentry *dir, *file;
         struct diag2fc_data *data;
@@ -181,38 +180,38 @@ int hypfs_vm_create_files(struct super_block *sb, struct dentry *root)
                 return PTR_ERR(data);
 
         /* Hpervisor Info */
-        dir = hypfs_mkdir(sb, root, "hyp");
+        dir = hypfs_mkdir(root, "hyp");
         if (IS_ERR(dir)) {
                 rc = PTR_ERR(dir);
                 goto failed;
         }
-        file = hypfs_create_str(sb, dir, "type", "z/VM Hypervisor");
+        file = hypfs_create_str(dir, "type", "z/VM Hypervisor");
         if (IS_ERR(file)) {
                 rc = PTR_ERR(file);
                 goto failed;
         }
 
         /* physical cpus */
-        dir = hypfs_mkdir(sb, root, "cpus");
+        dir = hypfs_mkdir(root, "cpus");
         if (IS_ERR(dir)) {
                 rc = PTR_ERR(dir);
                 goto failed;
         }
-        file = hypfs_create_u64(sb, dir, "count", data->lcpus);
+        file = hypfs_create_u64(dir, "count", data->lcpus);
         if (IS_ERR(file)) {
                 rc = PTR_ERR(file);
                 goto failed;
         }
 
         /* guests */
-        dir = hypfs_mkdir(sb, root, "systems");
+        dir = hypfs_mkdir(root, "systems");
         if (IS_ERR(dir)) {
                 rc = PTR_ERR(dir);
                 goto failed;
         }
 
         for (i = 0; i < count; i++) {
-                rc = hpyfs_vm_create_guest(sb, dir, &(data[i]));
+                rc = hpyfs_vm_create_guest(dir, &(data[i]));
                 if (rc)
                         goto failed;
         }
diff --git a/arch/s390/hypfs/inode.c b/arch/s390/hypfs/inode.c
index 7a539f4f5e30..ddfe09b45134 100644
--- a/arch/s390/hypfs/inode.c
+++ b/arch/s390/hypfs/inode.c
@@ -28,8 +28,7 @@
 #define HYPFS_MAGIC 0x687970    /* ASCII 'hyp' */
 #define TMP_SIZE 64             /* size of temporary buffers */
 
-static struct dentry *hypfs_create_update_file(struct super_block *sb,
-                                               struct dentry *dir);
+static struct dentry *hypfs_create_update_file(struct dentry *dir);
 
 struct hypfs_sb_info {
         kuid_t uid;                     /* uid used for files and dirs */
@@ -193,9 +192,9 @@ static ssize_t hypfs_aio_write(struct kiocb *iocb, const struct iovec *iov,
         }
         hypfs_delete_tree(sb->s_root);
         if (MACHINE_IS_VM)
-                rc = hypfs_vm_create_files(sb, sb->s_root);
+                rc = hypfs_vm_create_files(sb->s_root);
         else
-                rc = hypfs_diag_create_files(sb, sb->s_root);
+                rc = hypfs_diag_create_files(sb->s_root);
         if (rc) {
                 pr_err("Updating the hypfs tree failed\n");
                 hypfs_delete_tree(sb->s_root);
@@ -302,12 +301,12 @@ static int hypfs_fill_super(struct super_block *sb, void *data, int silent)
         if (!root_dentry)
                 return -ENOMEM;
         if (MACHINE_IS_VM)
-                rc = hypfs_vm_create_files(sb, root_dentry);
+                rc = hypfs_vm_create_files(root_dentry);
         else
-                rc = hypfs_diag_create_files(sb, root_dentry);
+                rc = hypfs_diag_create_files(root_dentry);
         if (rc)
                 return rc;
-        sbi->update_file = hypfs_create_update_file(sb, root_dentry);
+        sbi->update_file = hypfs_create_update_file(root_dentry);
         if (IS_ERR(sbi->update_file))
                 return PTR_ERR(sbi->update_file);
         hypfs_update_update(sb);
@@ -334,8 +333,7 @@ static void hypfs_kill_super(struct super_block *sb)
         kill_litter_super(sb);
 }
 
-static struct dentry *hypfs_create_file(struct super_block *sb,
-                                        struct dentry *parent, const char *name,
+static struct dentry *hypfs_create_file(struct dentry *parent, const char *name,
                                         char *data, umode_t mode)
 {
         struct dentry *dentry;
@@ -347,7 +345,7 @@ static struct dentry *hypfs_create_file(struct super_block *sb,
                 dentry = ERR_PTR(-ENOMEM);
                 goto fail;
         }
-        inode = hypfs_make_inode(sb, mode);
+        inode = hypfs_make_inode(parent->d_sb, mode);
         if (!inode) {
                 dput(dentry);
                 dentry = ERR_PTR(-ENOMEM);
@@ -373,24 +371,22 @@ fail:
         return dentry;
 }
 
-struct dentry *hypfs_mkdir(struct super_block *sb, struct dentry *parent,
-                           const char *name)
+struct dentry *hypfs_mkdir(struct dentry *parent, const char *name)
 {
         struct dentry *dentry;
 
-        dentry = hypfs_create_file(sb, parent, name, NULL, S_IFDIR | DIR_MODE);
+        dentry = hypfs_create_file(parent, name, NULL, S_IFDIR | DIR_MODE);
         if (IS_ERR(dentry))
                 return dentry;
         hypfs_add_dentry(dentry);
         return dentry;
 }
 
-static struct dentry *hypfs_create_update_file(struct super_block *sb,
-                                               struct dentry *dir)
+static struct dentry *hypfs_create_update_file(struct dentry *dir)
 {
         struct dentry *dentry;
 
-        dentry = hypfs_create_file(sb, dir, "update", NULL,
+        dentry = hypfs_create_file(dir, "update", NULL,
                                    S_IFREG | UPDATE_FILE_MODE);
         /*
          * We do not put the update file on the 'delete' list with
@@ -400,7 +396,7 @@ static struct dentry *hypfs_create_update_file(struct super_block *sb,
         return dentry;
 }
 
-struct dentry *hypfs_create_u64(struct super_block *sb, struct dentry *dir,
+struct dentry *hypfs_create_u64(struct dentry *dir,
                                 const char *name, __u64 value)
 {
         char *buffer;
@@ -412,7 +408,7 @@ struct dentry *hypfs_create_u64(struct super_block *sb, struct dentry *dir,
         if (!buffer)
                 return ERR_PTR(-ENOMEM);
         dentry =
-            hypfs_create_file(sb, dir, name, buffer, S_IFREG | REG_FILE_MODE);
+            hypfs_create_file(dir, name, buffer, S_IFREG | REG_FILE_MODE);
         if (IS_ERR(dentry)) {
                 kfree(buffer);
                 return ERR_PTR(-ENOMEM);
@@ -421,7 +417,7 @@ struct dentry *hypfs_create_u64(struct super_block *sb, struct dentry *dir,
         return dentry;
 }
 
-struct dentry *hypfs_create_str(struct super_block *sb, struct dentry *dir,
+struct dentry *hypfs_create_str(struct dentry *dir,
                                 const char *name, char *string)
 {
         char *buffer;
@@ -432,7 +428,7 @@ struct dentry *hypfs_create_str(struct super_block *sb, struct dentry *dir,
                 return ERR_PTR(-ENOMEM);
         sprintf(buffer, "%s\n", string);
         dentry =
-            hypfs_create_file(sb, dir, name, buffer, S_IFREG | REG_FILE_MODE);
+            hypfs_create_file(dir, name, buffer, S_IFREG | REG_FILE_MODE);
         if (IS_ERR(dentry)) {
                 kfree(buffer);
                 return ERR_PTR(-ENOMEM);
diff --git a/arch/s390/include/asm/airq.h b/arch/s390/include/asm/airq.h
index 4066cee0c2d2..4bbb5957ed1b 100644
--- a/arch/s390/include/asm/airq.h
+++ b/arch/s390/include/asm/airq.h
@@ -9,6 +9,8 @@
 #ifndef _ASM_S390_AIRQ_H
 #define _ASM_S390_AIRQ_H
 
+#include <linux/bit_spinlock.h>
+
 struct airq_struct {
         struct hlist_node list;         /* Handler queueing. */
         void (*handler)(struct airq_struct *);  /* Thin-interrupt handler */
@@ -23,4 +25,69 @@ struct airq_struct {
 int register_adapter_interrupt(struct airq_struct *airq);
 void unregister_adapter_interrupt(struct airq_struct *airq);
 
+/* Adapter interrupt bit vector */
+struct airq_iv {
+        unsigned long *vector;  /* Adapter interrupt bit vector */
+        unsigned long *avail;   /* Allocation bit mask for the bit vector */
+        unsigned long *bitlock; /* Lock bit mask for the bit vector */
+        unsigned long *ptr;     /* Pointer associated with each bit */
+        unsigned int *data;     /* 32 bit value associated with each bit */
+        unsigned long bits;     /* Number of bits in the vector */
+        unsigned long end;      /* Number of highest allocated bit + 1 */
+        spinlock_t lock;        /* Lock to protect alloc & free */
+};
+
+#define AIRQ_IV_ALLOC   1       /* Use an allocation bit mask */
+#define AIRQ_IV_BITLOCK 2       /* Allocate the lock bit mask */
+#define AIRQ_IV_PTR     4       /* Allocate the ptr array */
+#define AIRQ_IV_DATA    8       /* Allocate the data array */
+
+struct airq_iv *airq_iv_create(unsigned long bits, unsigned long flags);
+void airq_iv_release(struct airq_iv *iv);
+unsigned long airq_iv_alloc_bit(struct airq_iv *iv);
+void airq_iv_free_bit(struct airq_iv *iv, unsigned long bit);
+unsigned long airq_iv_scan(struct airq_iv *iv, unsigned long start,
+                           unsigned long end);
+
+static inline unsigned long airq_iv_end(struct airq_iv *iv)
+{
+        return iv->end;
+}
+
+static inline void airq_iv_lock(struct airq_iv *iv, unsigned long bit)
+{
+        const unsigned long be_to_le = BITS_PER_LONG - 1;
+        bit_spin_lock(bit ^ be_to_le, iv->bitlock);
+}
+
+static inline void airq_iv_unlock(struct airq_iv *iv, unsigned long bit)
+{
+        const unsigned long be_to_le = BITS_PER_LONG - 1;
+        bit_spin_unlock(bit ^ be_to_le, iv->bitlock);
+}
+
+static inline void airq_iv_set_data(struct airq_iv *iv, unsigned long bit,
+                                    unsigned int data)
+{
+        iv->data[bit] = data;
+}
+
+static inline unsigned int airq_iv_get_data(struct airq_iv *iv,
+                                            unsigned long bit)
+{
+        return iv->data[bit];
+}
+
+static inline void airq_iv_set_ptr(struct airq_iv *iv, unsigned long bit,
+                                   unsigned long ptr)
+{
+        iv->ptr[bit] = ptr;
+}
+
+static inline unsigned long airq_iv_get_ptr(struct airq_iv *iv,
+                                            unsigned long bit)
+{
+        return iv->ptr[bit];
+}
+
 #endif /* _ASM_S390_AIRQ_H */
diff --git a/arch/s390/include/asm/bitops.h b/arch/s390/include/asm/bitops.h
index 4d8604e311f3..10135a38673c 100644
--- a/arch/s390/include/asm/bitops.h
+++ b/arch/s390/include/asm/bitops.h
@@ -216,7 +216,7 @@ static inline void __set_bit(unsigned long nr, volatile unsigned long *ptr)
         addr = (unsigned long) ptr + ((nr ^ (BITS_PER_LONG - 8)) >> 3);
         asm volatile(
                 "       oc      %O0(1,%R0),%1"
-                : "=Q" (*(char *) addr) : "Q" (_oi_bitmap[nr & 7]) : "cc" );
+                : "+Q" (*(char *) addr) : "Q" (_oi_bitmap[nr & 7]) : "cc");
 }
 
 static inline void 
@@ -244,7 +244,7 @@ __clear_bit(unsigned long nr, volatile unsigned long *ptr)
         addr = (unsigned long) ptr + ((nr ^ (BITS_PER_LONG - 8)) >> 3);
         asm volatile(
                 "       nc      %O0(1,%R0),%1"
-                : "=Q" (*(char *) addr) : "Q" (_ni_bitmap[nr & 7]) : "cc" );
+                : "+Q" (*(char *) addr) : "Q" (_ni_bitmap[nr & 7]) : "cc");
 }
 
 static inline void 
@@ -271,7 +271,7 @@ static inline void __change_bit(unsigned long nr, volatile unsigned long *ptr)
         addr = (unsigned long) ptr + ((nr ^ (BITS_PER_LONG - 8)) >> 3);
         asm volatile(
                 "       xc      %O0(1,%R0),%1"
-                : "=Q" (*(char *) addr) : "Q" (_oi_bitmap[nr & 7]) : "cc" );
+                : "+Q" (*(char *) addr) : "Q" (_oi_bitmap[nr & 7]) : "cc");
 }
 
 static inline void 
@@ -301,7 +301,7 @@ test_and_set_bit_simple(unsigned long nr, volatile unsigned long *ptr)
         ch = *(unsigned char *) addr;
         asm volatile(
                 "       oc      %O0(1,%R0),%1"
-                : "=Q" (*(char *) addr) : "Q" (_oi_bitmap[nr & 7])
+                : "+Q" (*(char *) addr) : "Q" (_oi_bitmap[nr & 7])
                 : "cc", "memory");
         return (ch >> (nr & 7)) & 1;
 }
@@ -320,7 +320,7 @@ test_and_clear_bit_simple(unsigned long nr, volatile unsigned long *ptr)
         ch = *(unsigned char *) addr;
         asm volatile(
                 "       nc      %O0(1,%R0),%1"
-                : "=Q" (*(char *) addr) : "Q" (_ni_bitmap[nr & 7])
+                : "+Q" (*(char *) addr) : "Q" (_ni_bitmap[nr & 7])
                 : "cc", "memory");
         return (ch >> (nr & 7)) & 1;
 }
@@ -339,7 +339,7 @@ test_and_change_bit_simple(unsigned long nr, volatile unsigned long *ptr)
         ch = *(unsigned char *) addr;
         asm volatile(
                 "       xc      %O0(1,%R0),%1"
-                : "=Q" (*(char *) addr) : "Q" (_oi_bitmap[nr & 7])
+                : "+Q" (*(char *) addr) : "Q" (_oi_bitmap[nr & 7])
                 : "cc", "memory");
         return (ch >> (nr & 7)) & 1;
 }
@@ -693,7 +693,7 @@ static inline int find_next_bit_left(const unsigned long *addr,
         size -= offset;
         p = addr + offset / BITS_PER_LONG;
         if (bit) {
-                set = __flo_word(0, *p & (~0UL << bit));
+                set = __flo_word(0, *p & (~0UL >> bit));
                 if (set >= size)
                         return size + offset;
                 if (set < BITS_PER_LONG)
diff --git a/arch/s390/include/asm/cio.h b/arch/s390/include/asm/cio.h
index ffb898961c8d..d42625053c37 100644
--- a/arch/s390/include/asm/cio.h
+++ b/arch/s390/include/asm/cio.h
@@ -296,6 +296,7 @@ static inline int ccw_dev_id_is_equal(struct ccw_dev_id *dev_id1,
         return 0;
 }
 
+void channel_subsystem_reinit(void);
 extern void css_schedule_reprobe(void);
 
 extern void reipl_ccw_dev(struct ccw_dev_id *id);
diff --git a/arch/s390/include/asm/cputime.h b/arch/s390/include/asm/cputime.h
index d2ff41370c0c..f65bd3634519 100644
--- a/arch/s390/include/asm/cputime.h
+++ b/arch/s390/include/asm/cputime.h
@@ -13,9 +13,6 @@
 #include <asm/div64.h>
 
 
-#define __ARCH_HAS_VTIME_ACCOUNT
-#define __ARCH_HAS_VTIME_TASK_SWITCH
-
 /* We want to use full resolution of the CPU timer: 2**-12 micro-seconds. */
 
 typedef unsigned long long __nocast cputime_t;
diff --git a/arch/s390/include/asm/hardirq.h b/arch/s390/include/asm/hardirq.h
index 0c82ba86e997..a908d2941c5d 100644
--- a/arch/s390/include/asm/hardirq.h
+++ b/arch/s390/include/asm/hardirq.h
@@ -20,4 +20,9 @@
 
 #define HARDIRQ_BITS    8
 
+static inline void ack_bad_irq(unsigned int irq)
+{
+        printk(KERN_CRIT "unexpected IRQ trap at vector %02x\n", irq);
+}
+
 #endif /* __ASM_HARDIRQ_H */
diff --git a/arch/s390/include/asm/hugetlb.h b/arch/s390/include/asm/hugetlb.h
index bd90359d6d22..11eae5f55b70 100644
--- a/arch/s390/include/asm/hugetlb.h
+++ b/arch/s390/include/asm/hugetlb.h
@@ -17,6 +17,9 @@
 
 void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
                      pte_t *ptep, pte_t pte);
+pte_t huge_ptep_get(pte_t *ptep);
+pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
+                              unsigned long addr, pte_t *ptep);
 
 /*
  * If the arch doesn't supply something else, assume that hugepage
@@ -38,147 +41,75 @@ static inline int prepare_hugepage_range(struct file *file,
 int arch_prepare_hugepage(struct page *page);
 void arch_release_hugepage(struct page *page);
 
-static inline pte_t huge_pte_wrprotect(pte_t pte)
+static inline void huge_pte_clear(struct mm_struct *mm, unsigned long addr,
+                                  pte_t *ptep)
 {
-        pte_val(pte) |= _PAGE_RO;
-        return pte;
+        pte_val(*ptep) = _SEGMENT_ENTRY_EMPTY;
 }
 
-static inline int huge_pte_none(pte_t pte)
+static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
+                                         unsigned long address, pte_t *ptep)
 {
-        return (pte_val(pte) & _SEGMENT_ENTRY_INV) &&
-                !(pte_val(pte) & _SEGMENT_ENTRY_RO);
+        huge_ptep_get_and_clear(vma->vm_mm, address, ptep);
 }
 
-static inline pte_t huge_ptep_get(pte_t *ptep)
+static inline int huge_ptep_set_access_flags(struct vm_area_struct *vma,
+                                             unsigned long addr, pte_t *ptep,
+                                             pte_t pte, int dirty)
 {
-        pte_t pte = *ptep;
-        unsigned long mask;
-
-        if (!MACHINE_HAS_HPAGE) {
-                ptep = (pte_t *) (pte_val(pte) & _SEGMENT_ENTRY_ORIGIN);
-                if (ptep) {
-                        mask = pte_val(pte) &
-                                (_SEGMENT_ENTRY_INV | _SEGMENT_ENTRY_RO);
-                        pte = pte_mkhuge(*ptep);
-                        pte_val(pte) |= mask;
-                }
+        int changed = !pte_same(huge_ptep_get(ptep), pte);
+        if (changed) {
+                huge_ptep_get_and_clear(vma->vm_mm, addr, ptep);
+                set_huge_pte_at(vma->vm_mm, addr, ptep, pte);
         }
-        return pte;
+        return changed;
 }
 
-static inline void __pmd_csp(pmd_t *pmdp)
+static inline void huge_ptep_set_wrprotect(struct mm_struct *mm,
+                                           unsigned long addr, pte_t *ptep)
 {
-        register unsigned long reg2 asm("2") = pmd_val(*pmdp);
-        register unsigned long reg3 asm("3") = pmd_val(*pmdp) |
-                                               _SEGMENT_ENTRY_INV;
-        register unsigned long reg4 asm("4") = ((unsigned long) pmdp) + 5;
-
-        asm volatile(
-                "       csp %1,%3"
-                : "=m" (*pmdp)
-                : "d" (reg2), "d" (reg3), "d" (reg4), "m" (*pmdp) : "cc");
+        pte_t pte = huge_ptep_get_and_clear(mm, addr, ptep);
+        set_huge_pte_at(mm, addr, ptep, pte_wrprotect(pte));
 }
 
-static inline void huge_ptep_invalidate(struct mm_struct *mm,
-                                        unsigned long address, pte_t *ptep)
-{
-        pmd_t *pmdp = (pmd_t *) ptep;
-
-        if (MACHINE_HAS_IDTE)
-                __pmd_idte(address, pmdp);
-        else
-                __pmd_csp(pmdp);
-        pmd_val(*pmdp) = _SEGMENT_ENTRY_INV | _SEGMENT_ENTRY;
-}
-
-static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
-                                            unsigned long addr, pte_t *ptep)
-{
-        pte_t pte = huge_ptep_get(ptep);
-
-        huge_ptep_invalidate(mm, addr, ptep);
-        return pte;
-}
-
-#define huge_ptep_set_access_flags(__vma, __addr, __ptep, __entry, __dirty) \
-({                                                                          \
-        int __changed = !pte_same(huge_ptep_get(__ptep), __entry);          \
-        if (__changed) {                                                    \
-                huge_ptep_invalidate((__vma)->vm_mm, __addr, __ptep);       \
-                set_huge_pte_at((__vma)->vm_mm, __addr, __ptep, __entry);   \
-        }                                                                   \
-        __changed;                                                          \
-})
-
-#define huge_ptep_set_wrprotect(__mm, __addr, __ptep)                   \
-({                                                                      \
-        pte_t __pte = huge_ptep_get(__ptep);                            \
-        if (huge_pte_write(__pte)) {                                    \
-                huge_ptep_invalidate(__mm, __addr, __ptep);             \
-                set_huge_pte_at(__mm, __addr, __ptep,                   \
-                                huge_pte_wrprotect(__pte));             \
-        }                                                               \
-})
-
-static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
-                                         unsigned long address, pte_t *ptep)
+static inline pte_t mk_huge_pte(struct page *page, pgprot_t pgprot)
 {
-        huge_ptep_invalidate(vma->vm_mm, address, ptep);
+        return mk_pte(page, pgprot);
 }
 
-static inline pte_t mk_huge_pte(struct page *page, pgprot_t pgprot)
+static inline int huge_pte_none(pte_t pte)
 {
-        pte_t pte;
-        pmd_t pmd;
-
-        pmd = mk_pmd_phys(page_to_phys(page), pgprot);
-        pte_val(pte) = pmd_val(pmd);
-        return pte;
+        return pte_none(pte);
 }
 
 static inline int huge_pte_write(pte_t pte)
 {
-        pmd_t pmd;
-
-        pmd_val(pmd) = pte_val(pte);
-        return pmd_write(pmd);
+        return pte_write(pte);
 }
 
 static inline int huge_pte_dirty(pte_t pte)
 {
-        /* No dirty bit in the segment table entry. */
-        return 0;
+        return pte_dirty(pte);
 }
 
 static inline pte_t huge_pte_mkwrite(pte_t pte)
 {
-        pmd_t pmd;
-
-        pmd_val(pmd) = pte_val(pte);
-        pte_val(pte) = pmd_val(pmd_mkwrite(pmd));
-        return pte;
+        return pte_mkwrite(pte);
 }
 
 static inline pte_t huge_pte_mkdirty(pte_t pte)
 {
-        /* No dirty bit in the segment table entry. */
-        return pte;
+        return pte_mkdirty(pte);
 }
 
-static inline pte_t huge_pte_modify(pte_t pte, pgprot_t newprot)
+static inline pte_t huge_pte_wrprotect(pte_t pte)
 {
-        pmd_t pmd;
-
-        pmd_val(pmd) = pte_val(pte);
-        pte_val(pte) = pmd_val(pmd_modify(pmd, newprot));
-        return pte;
+        return pte_wrprotect(pte);
 }
 
-static inline void huge_pte_clear(struct mm_struct *mm, unsigned long addr,
-                                  pte_t *ptep)
+static inline pte_t huge_pte_modify(pte_t pte, pgprot_t newprot)
 {
-        pmd_clear((pmd_t *) ptep);
+        return pte_modify(pte, newprot);
 }
 
 #endif /* _ASM_S390_HUGETLB_H */
diff --git a/arch/s390/include/asm/hw_irq.h b/arch/s390/include/asm/hw_irq.h
index 7e3d2586c1ff..ee96a8b697f9 100644
--- a/arch/s390/include/asm/hw_irq.h
+++ b/arch/s390/include/asm/hw_irq.h
@@ -4,19 +4,8 @@
 #include <linux/msi.h>
 #include <linux/pci.h>
 
-static inline struct msi_desc *irq_get_msi_desc(unsigned int irq)
-{
-        return __irq_get_msi_desc(irq);
-}
-
-/* Must be called with msi map lock held */
-static inline int irq_set_msi_desc(unsigned int irq, struct msi_desc *msi)
-{
-        if (!msi)
-                return -EINVAL;
-
-        msi->irq = irq;
-        return 0;
-}
+void __init init_airq_interrupts(void);
+void __init init_cio_interrupts(void);
+void __init init_ext_interrupts(void);
 
 #endif
diff --git a/arch/s390/include/asm/irq.h b/arch/s390/include/asm/irq.h
index 87c17bfb2968..1eaa3625803c 100644
--- a/arch/s390/include/asm/irq.h
+++ b/arch/s390/include/asm/irq.h
@@ -1,17 +1,28 @@
 #ifndef _ASM_IRQ_H
 #define _ASM_IRQ_H
 
+#define EXT_INTERRUPT   1
+#define IO_INTERRUPT    2
+#define THIN_INTERRUPT  3
+
+#define NR_IRQS_BASE    4
+
+#ifdef CONFIG_PCI_NR_MSI
+# define NR_IRQS        (NR_IRQS_BASE + CONFIG_PCI_NR_MSI)
+#else
+# define NR_IRQS        NR_IRQS_BASE
+#endif
+
+/* This number is used when no interrupt has been assigned */
+#define NO_IRQ          0
+
+#ifndef __ASSEMBLY__
+
 #include <linux/hardirq.h>
 #include <linux/percpu.h>
 #include <linux/cache.h>
 #include <linux/types.h>
 
-enum interruption_main_class {
-        EXTERNAL_INTERRUPT,
-        IO_INTERRUPT,
-        NR_IRQS
-};
-
 enum interruption_class {
         IRQEXT_CLK,
         IRQEXT_EXC,
@@ -72,14 +83,8 @@ void service_subclass_irq_unregister(void);
 void measurement_alert_subclass_register(void);
 void measurement_alert_subclass_unregister(void);
 
-#ifdef CONFIG_LOCKDEP
-#  define disable_irq_nosync_lockdep(irq)       disable_irq_nosync(irq)
-#  define disable_irq_nosync_lockdep_irqsave(irq, flags) \
-                                                disable_irq_nosync(irq)
-#  define disable_irq_lockdep(irq)              disable_irq(irq)
-#  define enable_irq_lockdep(irq)               enable_irq(irq)
-#  define enable_irq_lockdep_irqrestore(irq, flags) \
-                                                enable_irq(irq)
-#endif
+#define irq_canonicalize(irq)  (irq)
+
+#endif /* __ASSEMBLY__ */
 
 #endif /* _ASM_IRQ_H */
diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index 3238d4004e84..e87ecaa2c569 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -274,6 +274,14 @@ struct kvm_arch{
         int css_support;
 };
 
+#define KVM_HVA_ERR_BAD         (-1UL)
+#define KVM_HVA_ERR_RO_BAD      (-2UL)
+
+static inline bool kvm_is_error_hva(unsigned long addr)
+{
+        return IS_ERR_VALUE(addr);
+}
+
 extern int sie64a(struct kvm_s390_sie_block *, u64 *);
 extern char sie_exit;
 #endif
diff --git a/arch/s390/include/asm/mmu.h b/arch/s390/include/asm/mmu.h
index 6340178748bf..ff132ac64ddd 100644
--- a/arch/s390/include/asm/mmu.h
+++ b/arch/s390/include/asm/mmu.h
@@ -12,8 +12,6 @@ typedef struct {
         unsigned long asce_bits;
         unsigned long asce_limit;
         unsigned long vdso_base;
-        /* Cloned contexts will be created with extended page tables. */
-        unsigned int alloc_pgste:1;
         /* The mmu context has extended page tables. */
         unsigned int has_pgste:1;
 } mm_context_t;
diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
index 084e7755ed9b..9f973d8de90e 100644
--- a/arch/s390/include/asm/mmu_context.h
+++ b/arch/s390/include/asm/mmu_context.h
@@ -21,24 +21,7 @@ static inline int init_new_context(struct task_struct *tsk,
 #ifdef CONFIG_64BIT
         mm->context.asce_bits |= _ASCE_TYPE_REGION3;
 #endif
-        if (current->mm && current->mm->context.alloc_pgste) {
-                /*
-                 * alloc_pgste indicates, that any NEW context will be created
-                 * with extended page tables. The old context is unchanged. The
-                 * page table allocation and the page table operations will
-                 * look at has_pgste to distinguish normal and extended page
-                 * tables. The only way to create extended page tables is to
-                 * set alloc_pgste and then create a new context (e.g. dup_mm).
-                 * The page table allocation is called after init_new_context
-                 * and if has_pgste is set, it will create extended page
-                 * tables.
-                 */
-                mm->context.has_pgste = 1;
-                mm->context.alloc_pgste = 1;
-        } else {
-                mm->context.has_pgste = 0;
-                mm->context.alloc_pgste = 0;
-        }
+        mm->context.has_pgste = 0;
         mm->context.asce_limit = STACK_TOP_MAX;
         crst_table_init((unsigned long *) mm->pgd, pgd_entry_type(mm));
         return 0;
@@ -77,8 +60,7 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
         WARN_ON(atomic_read(&prev->context.attach_count) < 0);
         atomic_inc(&next->context.attach_count);
         /* Check for TLBs not flushed yet */
-        if (next->context.flush_mm)
-                __tlb_flush_mm(next);
+        __tlb_flush_mm_lazy(next);
 }
 
 #define enter_lazy_tlb(mm,tsk)  do { } while (0)
diff --git a/arch/s390/include/asm/page.h b/arch/s390/include/asm/page.h
index 5d64fb7619cc..1e51f2915b2e 100644
--- a/arch/s390/include/asm/page.h
+++ b/arch/s390/include/asm/page.h
@@ -32,16 +32,6 @@
 
 void storage_key_init_range(unsigned long start, unsigned long end);
 
-static inline unsigned long pfmf(unsigned long function, unsigned long address)
-{
-        asm volatile(
-                "       .insn   rre,0xb9af0000,%[function],%[address]"
-                : [address] "+a" (address)
-                : [function] "d" (function)
-                : "memory");
-        return address;
-}
-
 static inline void clear_page(void *page)
 {
         register unsigned long reg1 asm ("1") = 0;
@@ -150,15 +140,6 @@ static inline int page_reset_referenced(unsigned long addr)
 #define _PAGE_FP_BIT            0x08    /* HW fetch protection bit      */
 #define _PAGE_ACC_BITS          0xf0    /* HW access control bits       */
 
-/*
- * Test and clear referenced bit in storage key.
- */
-#define __HAVE_ARCH_PAGE_TEST_AND_CLEAR_YOUNG
-static inline int page_test_and_clear_young(unsigned long pfn)
-{
-        return page_reset_referenced(pfn << PAGE_SHIFT);
-}
-
 struct page;
 void arch_free_page(struct page *page, int order);
 void arch_alloc_page(struct page *page, int order);
diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
index 6e577ba0e5da..c290f13d1c47 100644
--- a/arch/s390/include/asm/pci.h
+++ b/arch/s390/include/asm/pci.h
@@ -6,6 +6,7 @@
 /* must be set before including pci_clp.h */
 #define PCI_BAR_COUNT   6
 
+#include <linux/pci.h>
 #include <asm-generic/pci.h>
 #include <asm-generic/pci-dma-compat.h>
 #include <asm/pci_clp.h>
@@ -53,14 +54,9 @@ struct zpci_fmb {
         atomic64_t unmapped_pages;
 } __packed __aligned(16);
 
-struct msi_map {
-        unsigned long irq;
-        struct msi_desc *msi;
-        struct hlist_node msi_chain;
-};
-
-#define ZPCI_NR_MSI_VECS        64
-#define ZPCI_MSI_MASK           (ZPCI_NR_MSI_VECS - 1)
+#define ZPCI_MSI_VEC_BITS       11
+#define ZPCI_MSI_VEC_MAX        (1 << ZPCI_MSI_VEC_BITS)
+#define ZPCI_MSI_VEC_MASK       (ZPCI_MSI_VEC_MAX - 1)
 
 enum zpci_state {
         ZPCI_FN_STATE_RESERVED,
@@ -91,8 +87,7 @@ struct zpci_dev {
 
         /* IRQ stuff */
         u64             msi_addr;       /* MSI address */
-        struct zdev_irq_map *irq_map;
-        struct msi_map *msi_map[ZPCI_NR_MSI_VECS];
+        struct airq_iv *aibv;           /* adapter interrupt bit vector */
         unsigned int    aisb;           /* number of the summary bit */
 
         /* DMA stuff */
@@ -122,11 +117,6 @@ struct zpci_dev {
         struct dentry   *debugfs_perf;
 };
 
-struct pci_hp_callback_ops {
-        int (*create_slot)      (struct zpci_dev *zdev);
-        void (*remove_slot)     (struct zpci_dev *zdev);
-};
-
 static inline bool zdev_enabled(struct zpci_dev *zdev)
 {
         return (zdev->fh & (1UL << 31)) ? true : false;
@@ -146,32 +136,38 @@ int zpci_register_ioat(struct zpci_dev *, u8, u64, u64, u64);
 int zpci_unregister_ioat(struct zpci_dev *, u8);
 
 /* CLP */
-int clp_find_pci_devices(void);
+int clp_scan_pci_devices(void);
+int clp_rescan_pci_devices(void);
+int clp_rescan_pci_devices_simple(void);
 int clp_add_pci_device(u32, u32, int);
 int clp_enable_fh(struct zpci_dev *, u8);
 int clp_disable_fh(struct zpci_dev *);
 
-/* MSI */
-struct msi_desc *__irq_get_msi_desc(unsigned int);
-int zpci_msi_set_mask_bits(struct msi_desc *, u32, u32);
-int zpci_setup_msi_irq(struct zpci_dev *, struct msi_desc *, unsigned int, int);
-void zpci_teardown_msi_irq(struct zpci_dev *, struct msi_desc *);
-int zpci_msihash_init(void);
-void zpci_msihash_exit(void);
-
 #ifdef CONFIG_PCI
 /* Error handling and recovery */
 void zpci_event_error(void *);
 void zpci_event_availability(void *);
+void zpci_rescan(void);
 #else /* CONFIG_PCI */
 static inline void zpci_event_error(void *e) {}
 static inline void zpci_event_availability(void *e) {}
+static inline void zpci_rescan(void) {}
 #endif /* CONFIG_PCI */
 
+#ifdef CONFIG_HOTPLUG_PCI_S390
+int zpci_init_slot(struct zpci_dev *);
+void zpci_exit_slot(struct zpci_dev *);
+#else /* CONFIG_HOTPLUG_PCI_S390 */
+static inline int zpci_init_slot(struct zpci_dev *zdev)
+{
+        return 0;
+}
+static inline void zpci_exit_slot(struct zpci_dev *zdev) {}
+#endif /* CONFIG_HOTPLUG_PCI_S390 */
+
 /* Helpers */
 struct zpci_dev *get_zdev(struct pci_dev *);
 struct zpci_dev *get_zdev_by_fid(u32);
-bool zpci_fid_present(u32);
 
 /* sysfs */
 int zpci_sysfs_add_device(struct device *);
@@ -181,14 +177,6 @@ void zpci_sysfs_remove_device(struct device *);
 int zpci_dma_init(void);
 void zpci_dma_exit(void);
 
-/* Hotplug */
-extern struct mutex zpci_list_lock;
-extern struct list_head zpci_list;
-extern unsigned int s390_pci_probe;
-
-void zpci_register_hp_ops(struct pci_hp_callback_ops *);
-void zpci_deregister_hp_ops(void);
-
 /* FMB */
 int zpci_fmb_enable_device(struct zpci_dev *);
 int zpci_fmb_disable_device(struct zpci_dev *);
diff --git a/arch/s390/include/asm/pci_insn.h b/arch/s390/include/asm/pci_insn.h
index e6a2bdd4d705..df6eac9f0cb4 100644
--- a/arch/s390/include/asm/pci_insn.h
+++ b/arch/s390/include/asm/pci_insn.h
@@ -79,11 +79,11 @@ struct zpci_fib {
 } __packed;
 
 
-int s390pci_mod_fc(u64 req, struct zpci_fib *fib);
-int s390pci_refresh_trans(u64 fn, u64 addr, u64 range);
-int s390pci_load(u64 *data, u64 req, u64 offset);
-int s390pci_store(u64 data, u64 req, u64 offset);
-int s390pci_store_block(const u64 *data, u64 req, u64 offset);
-void set_irq_ctrl(u16 ctl, char *unused, u8 isc);
+int zpci_mod_fc(u64 req, struct zpci_fib *fib);
+int zpci_refresh_trans(u64 fn, u64 addr, u64 range);
+int zpci_load(u64 *data, u64 req, u64 offset);
+int zpci_store(u64 data, u64 req, u64 offset);
+int zpci_store_block(const u64 *data, u64 req, u64 offset);
+void zpci_set_irq_ctrl(u16 ctl, char *unused, u8 isc);
 
 #endif
diff --git a/arch/s390/include/asm/pci_io.h b/arch/s390/include/asm/pci_io.h
index 83a9caa6ae53..d194d544d694 100644
--- a/arch/s390/include/asm/pci_io.h
+++ b/arch/s390/include/asm/pci_io.h
@@ -36,7 +36,7 @@ static inline RETTYPE zpci_read_##RETTYPE(const volatile void __iomem *addr)	\
         u64 data;                                                               \
         int rc;                                                                 \
                                                                                 \
-        rc = s390pci_load(&data, req, ZPCI_OFFSET(addr));                       \
+        rc = zpci_load(&data, req, ZPCI_OFFSET(addr));                          \
         if (rc)                                                                 \
                 data = -1ULL;                                                   \
         return (RETTYPE) data;                                                  \
@@ -50,7 +50,7 @@ static inline void zpci_write_##VALTYPE(VALTYPE val,				\
         u64 req = ZPCI_CREATE_REQ(entry->fh, entry->bar, LENGTH);               \
         u64 data = (VALTYPE) val;                                               \
                                                                                 \
-        s390pci_store(data, req, ZPCI_OFFSET(addr));                            \
+        zpci_store(data, req, ZPCI_OFFSET(addr));                               \
 }
 
 zpci_read(8, u64)
@@ -83,7 +83,7 @@ static inline int zpci_write_single(u64 req, const u64 *data, u64 offset, u8 len
                 val = 0;                /* let FW report error */
                 break;
         }
-        return s390pci_store(val, req, offset);
+        return zpci_store(val, req, offset);
 }
 
 static inline int zpci_read_single(u64 req, u64 *dst, u64 offset, u8 len)
@@ -91,7 +91,7 @@ static inline int zpci_read_single(u64 req, u64 *dst, u64 offset, u8 len)
         u64 data;
         int cc;
 
-        cc = s390pci_load(&data, req, offset);
+        cc = zpci_load(&data, req, offset);
         if (cc)
                 goto out;
 
@@ -115,7 +115,7 @@ out:
 
 static inline int zpci_write_block(u64 req, const u64 *data, u64 offset)
 {
-        return s390pci_store_block(data, req, offset);
+        return zpci_store_block(data, req, offset);
 }
 
 static inline u8 zpci_get_max_write_size(u64 src, u64 dst, int len, int max)
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 75fb726de91f..9b60a36c348d 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -217,63 +217,57 @@ extern unsigned long MODULES_END;
 
 /* Hardware bits in the page table entry */
 #define _PAGE_CO        0x100           /* HW Change-bit override */
-#define _PAGE_RO        0x200           /* HW read-only bit  */
+#define _PAGE_PROTECT   0x200           /* HW read-only bit  */
 #define _PAGE_INVALID   0x400           /* HW invalid bit    */
+#define _PAGE_LARGE     0x800           /* Bit to mark a large pte */
 
 /* Software bits in the page table entry */
-#define _PAGE_SWT       0x001           /* SW pte type bit t */
-#define _PAGE_SWX       0x002           /* SW pte type bit x */
-#define _PAGE_SWC       0x004           /* SW pte changed bit */
-#define _PAGE_SWR       0x008           /* SW pte referenced bit */
-#define _PAGE_SWW       0x010           /* SW pte write bit */
-#define _PAGE_SPECIAL   0x020           /* SW associated with special page */
+#define _PAGE_PRESENT   0x001           /* SW pte present bit */
+#define _PAGE_TYPE      0x002           /* SW pte type bit */
+#define _PAGE_YOUNG     0x004           /* SW pte young bit */
+#define _PAGE_DIRTY     0x008           /* SW pte dirty bit */
+#define _PAGE_READ      0x010           /* SW pte read bit */
+#define _PAGE_WRITE     0x020           /* SW pte write bit */
+#define _PAGE_SPECIAL   0x040           /* SW associated with special page */
 #define __HAVE_ARCH_PTE_SPECIAL
 
 /* Set of bits not changed in pte_modify */
 #define _PAGE_CHG_MASK          (PAGE_MASK | _PAGE_SPECIAL | _PAGE_CO | \
-                                 _PAGE_SWC | _PAGE_SWR)
-
-/* Six different types of pages. */
-#define _PAGE_TYPE_EMPTY        0x400
-#define _PAGE_TYPE_NONE         0x401
-#define _PAGE_TYPE_SWAP         0x403
-#define _PAGE_TYPE_FILE         0x601   /* bit 0x002 is used for offset !! */
-#define _PAGE_TYPE_RO           0x200
-#define _PAGE_TYPE_RW           0x000
-
-/*
- * Only four types for huge pages, using the invalid bit and protection bit
- * of a segment table entry.
- */
-#define _HPAGE_TYPE_EMPTY       0x020   /* _SEGMENT_ENTRY_INV */
-#define _HPAGE_TYPE_NONE        0x220
-#define _HPAGE_TYPE_RO          0x200   /* _SEGMENT_ENTRY_RO  */
-#define _HPAGE_TYPE_RW          0x000
+                                 _PAGE_DIRTY | _PAGE_YOUNG)
 
 /*
- * PTE type bits are rather complicated. handle_pte_fault uses pte_present,
- * pte_none and pte_file to find out the pte type WITHOUT holding the page
- * table lock. ptep_clear_flush on the other hand uses ptep_clear_flush to
- * invalidate a given pte. ipte sets the hw invalid bit and clears all tlbs
- * for the page. The page table entry is set to _PAGE_TYPE_EMPTY afterwards.
- * This change is done while holding the lock, but the intermediate step
- * of a previously valid pte with the hw invalid bit set can be observed by
- * handle_pte_fault. That makes it necessary that all valid pte types with
- * the hw invalid bit set must be distinguishable from the four pte types
- * empty, none, swap and file.
+ * handle_pte_fault uses pte_present, pte_none and pte_file to find out the
+ * pte type WITHOUT holding the page table lock. The _PAGE_PRESENT bit
+ * is used to distinguish present from not-present ptes. It is changed only
+ * with the page table lock held.
+ *
+ * The following table gives the different possible bit combinations for
+ * the pte hardware and software bits in the last 12 bits of a pte:
  *
- *                      irxt  ipte  irxt
- * _PAGE_TYPE_EMPTY     1000   ->   1000
- * _PAGE_TYPE_NONE      1001   ->   1001
- * _PAGE_TYPE_SWAP      1011   ->   1011
- * _PAGE_TYPE_FILE      11?1   ->   11?1
- * _PAGE_TYPE_RO        0100   ->   1100
- * _PAGE_TYPE_RW        0000   ->   1000
+ *                              842100000000
+ *                              000084210000
+ *                              000000008421
+ *                              .IR...wrdytp
+ * empty                        .10...000000
+ * swap                         .10...xxxx10
+ * file                         .11...xxxxx0
+ * prot-none, clean, old        .11...000001
+ * prot-none, clean, young      .11...000101
+ * prot-none, dirty, old        .10...001001
+ * prot-none, dirty, young      .10...001101
+ * read-only, clean, old        .11...010001
+ * read-only, clean, young      .01...010101
+ * read-only, dirty, old        .11...011001
+ * read-only, dirty, young      .01...011101
+ * read-write, clean, old       .11...110001
+ * read-write, clean, young     .01...110101
+ * read-write, dirty, old       .10...111001
+ * read-write, dirty, young     .00...111101
  *
- * pte_none is true for bits combinations 1000, 1010, 1100, 1110
- * pte_present is true for bits combinations 0000, 0010, 0100, 0110, 1001
- * pte_file is true for bits combinations 1101, 1111
- * swap pte is 1011 and 0001, 0011, 0101, 0111 are invalid.
+ * pte_present is true for the bit pattern .xx...xxxxx1, (pte & 0x001) == 0x001
+ * pte_none    is true for the bit pattern .10...xxxx00, (pte & 0x603) == 0x400
+ * pte_file    is true for the bit pattern .11...xxxxx0, (pte & 0x601) == 0x600
+ * pte_swap    is true for the bit pattern .10...xxxx10, (pte & 0x603) == 0x402
  */
 
 #ifndef CONFIG_64BIT
@@ -286,14 +280,25 @@ extern unsigned long MODULES_END;
 #define _ASCE_TABLE_LENGTH      0x7f    /* 128 x 64 entries = 8k            */
 
 /* Bits in the segment table entry */
+#define _SEGMENT_ENTRY_BITS     0x7fffffffUL    /* Valid segment table bits */
 #define _SEGMENT_ENTRY_ORIGIN   0x7fffffc0UL    /* page table origin        */
-#define _SEGMENT_ENTRY_RO       0x200   /* page protection bit              */
-#define _SEGMENT_ENTRY_INV      0x20    /* invalid segment table entry      */
+#define _SEGMENT_ENTRY_PROTECT  0x200   /* page protection bit              */
+#define _SEGMENT_ENTRY_INVALID  0x20    /* invalid segment table entry      */
 #define _SEGMENT_ENTRY_COMMON   0x10    /* common segment bit               */
 #define _SEGMENT_ENTRY_PTL      0x0f    /* page table length                */
+#define _SEGMENT_ENTRY_NONE     _SEGMENT_ENTRY_PROTECT
 
 #define _SEGMENT_ENTRY          (_SEGMENT_ENTRY_PTL)
-#define _SEGMENT_ENTRY_EMPTY    (_SEGMENT_ENTRY_INV)
+#define _SEGMENT_ENTRY_EMPTY    (_SEGMENT_ENTRY_INVALID)
+
+/*
+ * Segment table entry encoding (I = invalid, R = read-only bit):
+ *              ..R...I.....
+ * prot-none    ..1...1.....
+ * read-only    ..1...0.....
+ * read-write   ..0...0.....
+ * empty        ..0...1.....
+ */
 
 /* Page status table bits for virtualization */
 #define PGSTE_ACC_BITS  0xf0000000UL
@@ -303,9 +308,7 @@ extern unsigned long MODULES_END;
 #define PGSTE_HC_BIT    0x00200000UL
 #define PGSTE_GR_BIT    0x00040000UL
 #define PGSTE_GC_BIT    0x00020000UL
-#define PGSTE_UR_BIT    0x00008000UL
-#define PGSTE_UC_BIT    0x00004000UL    /* user dirty (migration) */
-#define PGSTE_IN_BIT    0x00002000UL    /* IPTE notify bit */
+#define PGSTE_IN_BIT    0x00008000UL    /* IPTE notify bit */
 
 #else /* CONFIG_64BIT */
 
@@ -324,8 +327,8 @@ extern unsigned long MODULES_END;
 
 /* Bits in the region table entry */
 #define _REGION_ENTRY_ORIGIN    ~0xfffUL/* region/segment table origin      */
-#define _REGION_ENTRY_RO        0x200   /* region protection bit            */
-#define _REGION_ENTRY_INV       0x20    /* invalid region table entry       */
+#define _REGION_ENTRY_PROTECT   0x200   /* region protection bit            */
+#define _REGION_ENTRY_INVALID   0x20    /* invalid region table entry       */
 #define _REGION_ENTRY_TYPE_MASK 0x0c    /* region/segment table type mask   */
 #define _REGION_ENTRY_TYPE_R1   0x0c    /* region first table type          */
 #define _REGION_ENTRY_TYPE_R2   0x08    /* region second table type         */
@@ -333,29 +336,47 @@ extern unsigned long MODULES_END;
 #define _REGION_ENTRY_LENGTH    0x03    /* region third length              */
 
 #define _REGION1_ENTRY          (_REGION_ENTRY_TYPE_R1 | _REGION_ENTRY_LENGTH)
-#define _REGION1_ENTRY_EMPTY    (_REGION_ENTRY_TYPE_R1 | _REGION_ENTRY_INV)
+#define _REGION1_ENTRY_EMPTY    (_REGION_ENTRY_TYPE_R1 | _REGION_ENTRY_INVALID)
 #define _REGION2_ENTRY          (_REGION_ENTRY_TYPE_R2 | _REGION_ENTRY_LENGTH)
-#define _REGION2_ENTRY_EMPTY    (_REGION_ENTRY_TYPE_R2 | _REGION_ENTRY_INV)
+#define _REGION2_ENTRY_EMPTY    (_REGION_ENTRY_TYPE_R2 | _REGION_ENTRY_INVALID)
 #define _REGION3_ENTRY          (_REGION_ENTRY_TYPE_R3 | _REGION_ENTRY_LENGTH)
-#define _REGION3_ENTRY_EMPTY    (_REGION_ENTRY_TYPE_R3 | _REGION_ENTRY_INV)
+#define _REGION3_ENTRY_EMPTY    (_REGION_ENTRY_TYPE_R3 | _REGION_ENTRY_INVALID)
 
 #define _REGION3_ENTRY_LARGE    0x400   /* RTTE-format control, large page  */
 #define _REGION3_ENTRY_RO       0x200   /* page protection bit              */
 #define _REGION3_ENTRY_CO       0x100   /* change-recording override        */
 
 /* Bits in the segment table entry */
+#define _SEGMENT_ENTRY_BITS     0xfffffffffffffe33UL
+#define _SEGMENT_ENTRY_BITS_LARGE 0xfffffffffff1ff33UL
 #define _SEGMENT_ENTRY_ORIGIN_LARGE ~0xfffffUL /* large page address        */
 #define _SEGMENT_ENTRY_ORIGIN   ~0x7ffUL/* segment table origin             */
-#define _SEGMENT_ENTRY_RO       0x200   /* page protection bit              */
-#define _SEGMENT_ENTRY_INV      0x20    /* invalid segment table entry      */
+#define _SEGMENT_ENTRY_PROTECT  0x200   /* page protection bit              */
+#define _SEGMENT_ENTRY_INVALID  0x20    /* invalid segment table entry      */
 
 #define _SEGMENT_ENTRY          (0)
-#define _SEGMENT_ENTRY_EMPTY    (_SEGMENT_ENTRY_INV)
+#define _SEGMENT_ENTRY_EMPTY    (_SEGMENT_ENTRY_INVALID)
 
 #define _SEGMENT_ENTRY_LARGE    0x400   /* STE-format control, large page   */
 #define _SEGMENT_ENTRY_CO       0x100   /* change-recording override   */
+#define _SEGMENT_ENTRY_SPLIT    0x001   /* THP splitting bit */
+#define _SEGMENT_ENTRY_YOUNG    0x002   /* SW segment young bit */
+#define _SEGMENT_ENTRY_NONE     _SEGMENT_ENTRY_YOUNG
+
+/*
+ * Segment table entry encoding (R = read-only, I = invalid, y = young bit):
+ *                      ..R...I...y.
+ * prot-none, old       ..0...1...1.
+ * prot-none, young     ..1...1...1.
+ * read-only, old       ..1...1...0.
+ * read-only, young     ..1...0...1.
+ * read-write, old      ..0...1...0.
+ * read-write, young    ..0...0...1.
+ * The segment table origin is used to distinguish empty (origin==0) from
+ * read-write, old segment table entries (origin!=0)
+ */
+
 #define _SEGMENT_ENTRY_SPLIT_BIT 0      /* THP splitting bit number */
-#define _SEGMENT_ENTRY_SPLIT    (1UL << _SEGMENT_ENTRY_SPLIT_BIT)
 
 /* Set of bits not changed in pmd_modify */
 #define _SEGMENT_CHG_MASK       (_SEGMENT_ENTRY_ORIGIN | _SEGMENT_ENTRY_LARGE \
@@ -369,9 +390,7 @@ extern unsigned long MODULES_END;
 #define PGSTE_HC_BIT    0x0020000000000000UL
 #define PGSTE_GR_BIT    0x0004000000000000UL
 #define PGSTE_GC_BIT    0x0002000000000000UL
-#define PGSTE_UR_BIT    0x0000800000000000UL
-#define PGSTE_UC_BIT    0x0000400000000000UL    /* user dirty (migration) */
-#define PGSTE_IN_BIT    0x0000200000000000UL    /* IPTE notify bit */
+#define PGSTE_IN_BIT    0x0000800000000000UL    /* IPTE notify bit */
 
 #endif /* CONFIG_64BIT */
 
@@ -386,14 +405,18 @@ extern unsigned long MODULES_END;
 /*
  * Page protection definitions.
  */
-#define PAGE_NONE       __pgprot(_PAGE_TYPE_NONE)
-#define PAGE_RO         __pgprot(_PAGE_TYPE_RO)
-#define PAGE_RW         __pgprot(_PAGE_TYPE_RO | _PAGE_SWW)
-#define PAGE_RWC        __pgprot(_PAGE_TYPE_RW | _PAGE_SWW | _PAGE_SWC)
-
-#define PAGE_KERNEL     PAGE_RWC
-#define PAGE_SHARED     PAGE_KERNEL
-#define PAGE_COPY       PAGE_RO
+#define PAGE_NONE       __pgprot(_PAGE_PRESENT | _PAGE_INVALID)
+#define PAGE_READ       __pgprot(_PAGE_PRESENT | _PAGE_READ | \
+                                 _PAGE_INVALID | _PAGE_PROTECT)
+#define PAGE_WRITE      __pgprot(_PAGE_PRESENT | _PAGE_READ | _PAGE_WRITE | \
+                                 _PAGE_INVALID | _PAGE_PROTECT)
+
+#define PAGE_SHARED     __pgprot(_PAGE_PRESENT | _PAGE_READ | _PAGE_WRITE | \
+                                 _PAGE_YOUNG | _PAGE_DIRTY)
+#define PAGE_KERNEL     __pgprot(_PAGE_PRESENT | _PAGE_READ | _PAGE_WRITE | \
+                                 _PAGE_YOUNG | _PAGE_DIRTY)
+#define PAGE_KERNEL_RO  __pgprot(_PAGE_PRESENT | _PAGE_READ | _PAGE_YOUNG | \
+                                 _PAGE_PROTECT)
 
 /*
  * On s390 the page table entry has an invalid bit and a read-only bit.
@@ -402,35 +425,31 @@ extern unsigned long MODULES_END;
  */
          /*xwr*/
 #define __P000  PAGE_NONE
-#define __P001  PAGE_RO
-#define __P010  PAGE_RO
-#define __P011  PAGE_RO
-#define __P100  PAGE_RO
-#define __P101  PAGE_RO
-#define __P110  PAGE_RO
-#define __P111  PAGE_RO
+#define __P001  PAGE_READ
+#define __P010  PAGE_READ
+#define __P011  PAGE_READ
+#define __P100  PAGE_READ
+#define __P101  PAGE_READ
+#define __P110  PAGE_READ
+#define __P111  PAGE_READ
 
 #define __S000  PAGE_NONE
-#define __S001  PAGE_RO
-#define __S010  PAGE_RW
-#define __S011  PAGE_RW
-#define __S100  PAGE_RO
-#define __S101  PAGE_RO
-#define __S110  PAGE_RW
-#define __S111  PAGE_RW
+#define __S001  PAGE_READ
+#define __S010  PAGE_WRITE
+#define __S011  PAGE_WRITE
+#define __S100  PAGE_READ
+#define __S101  PAGE_READ
+#define __S110  PAGE_WRITE
+#define __S111  PAGE_WRITE
 
 /*
  * Segment entry (large page) protection definitions.
  */
-#define SEGMENT_NONE    __pgprot(_HPAGE_TYPE_NONE)
-#define SEGMENT_RO      __pgprot(_HPAGE_TYPE_RO)
-#define SEGMENT_RW      __pgprot(_HPAGE_TYPE_RW)
-
-static inline int mm_exclusive(struct mm_struct *mm)
-{
-        return likely(mm == current->active_mm &&
-                      atomic_read(&mm->context.attach_count) <= 1);
-}
+#define SEGMENT_NONE    __pgprot(_SEGMENT_ENTRY_INVALID | \
+                                 _SEGMENT_ENTRY_NONE)
+#define SEGMENT_READ    __pgprot(_SEGMENT_ENTRY_INVALID | \
+                                 _SEGMENT_ENTRY_PROTECT)
+#define SEGMENT_WRITE   __pgprot(_SEGMENT_ENTRY_INVALID)
 
 static inline int mm_has_pgste(struct mm_struct *mm)
 {
@@ -467,7 +486,7 @@ static inline int pgd_none(pgd_t pgd)
 {
         if ((pgd_val(pgd) & _REGION_ENTRY_TYPE_MASK) < _REGION_ENTRY_TYPE_R2)
                 return 0;
-        return (pgd_val(pgd) & _REGION_ENTRY_INV) != 0UL;
+        return (pgd_val(pgd) & _REGION_ENTRY_INVALID) != 0UL;
 }
 
 static inline int pgd_bad(pgd_t pgd)
@@ -478,7 +497,7 @@ static inline int pgd_bad(pgd_t pgd)
          * invalid for either table entry.
          */
         unsigned long mask =
-                ~_SEGMENT_ENTRY_ORIGIN & ~_REGION_ENTRY_INV &
+                ~_SEGMENT_ENTRY_ORIGIN & ~_REGION_ENTRY_INVALID &
                 ~_REGION_ENTRY_TYPE_MASK & ~_REGION_ENTRY_LENGTH;
         return (pgd_val(pgd) & mask) != 0;
 }
@@ -494,7 +513,7 @@ static inline int pud_none(pud_t pud)
 {
         if ((pud_val(pud) & _REGION_ENTRY_TYPE_MASK) < _REGION_ENTRY_TYPE_R3)
                 return 0;
-        return (pud_val(pud) & _REGION_ENTRY_INV) != 0UL;
+        return (pud_val(pud) & _REGION_ENTRY_INVALID) != 0UL;
 }
 
 static inline int pud_large(pud_t pud)
@@ -512,7 +531,7 @@ static inline int pud_bad(pud_t pud)
          * invalid for either table entry.
          */
         unsigned long mask =
-                ~_SEGMENT_ENTRY_ORIGIN & ~_REGION_ENTRY_INV &
+                ~_SEGMENT_ENTRY_ORIGIN & ~_REGION_ENTRY_INVALID &
                 ~_REGION_ENTRY_TYPE_MASK & ~_REGION_ENTRY_LENGTH;
         return (pud_val(pud) & mask) != 0;
 }
@@ -521,30 +540,36 @@ static inline int pud_bad(pud_t pud)
 
 static inline int pmd_present(pmd_t pmd)
 {
-        unsigned long mask = _SEGMENT_ENTRY_INV | _SEGMENT_ENTRY_RO;
-        return (pmd_val(pmd) & mask) == _HPAGE_TYPE_NONE ||
-               !(pmd_val(pmd) & _SEGMENT_ENTRY_INV);
+        return pmd_val(pmd) != _SEGMENT_ENTRY_INVALID;
 }
 
 static inline int pmd_none(pmd_t pmd)
 {
-        return (pmd_val(pmd) & _SEGMENT_ENTRY_INV) &&
-               !(pmd_val(pmd) & _SEGMENT_ENTRY_RO);
+        return pmd_val(pmd) == _SEGMENT_ENTRY_INVALID;
 }
 
 static inline int pmd_large(pmd_t pmd)
 {
 #ifdef CONFIG_64BIT
-        return !!(pmd_val(pmd) & _SEGMENT_ENTRY_LARGE);
+        return (pmd_val(pmd) & _SEGMENT_ENTRY_LARGE) != 0;
 #else
         return 0;
 #endif
 }
 
+static inline int pmd_prot_none(pmd_t pmd)
+{
+        return (pmd_val(pmd) & _SEGMENT_ENTRY_INVALID) &&
+                (pmd_val(pmd) & _SEGMENT_ENTRY_NONE);
+}
+
 static inline int pmd_bad(pmd_t pmd)
 {
-        unsigned long mask = ~_SEGMENT_ENTRY_ORIGIN & ~_SEGMENT_ENTRY_INV;
-        return (pmd_val(pmd) & mask) != _SEGMENT_ENTRY;
+#ifdef CONFIG_64BIT
+        if (pmd_large(pmd))
+                return (pmd_val(pmd) & ~_SEGMENT_ENTRY_BITS_LARGE) != 0;
+#endif
+        return (pmd_val(pmd) & ~_SEGMENT_ENTRY_BITS) != 0;
 }
 
 #define __HAVE_ARCH_PMDP_SPLITTING_FLUSH
@@ -563,31 +588,40 @@ extern int pmdp_clear_flush_young(struct vm_area_struct *vma,
 #define __HAVE_ARCH_PMD_WRITE
 static inline int pmd_write(pmd_t pmd)
 {
-        return (pmd_val(pmd) & _SEGMENT_ENTRY_RO) == 0;
+        if (pmd_prot_none(pmd))
+                return 0;
+        return (pmd_val(pmd) & _SEGMENT_ENTRY_PROTECT) == 0;
 }
 
 static inline int pmd_young(pmd_t pmd)
 {
-        return 0;
+        int young = 0;
+#ifdef CONFIG_64BIT
+        if (pmd_prot_none(pmd))
+                young = (pmd_val(pmd) & _SEGMENT_ENTRY_PROTECT) != 0;
+        else
+                young = (pmd_val(pmd) & _SEGMENT_ENTRY_YOUNG) != 0;
+#endif
+        return young;
 }
 
-static inline int pte_none(pte_t pte)
+static inline int pte_present(pte_t pte)
 {
-        return (pte_val(pte) & _PAGE_INVALID) && !(pte_val(pte) & _PAGE_SWT);
+        /* Bit pattern: (pte & 0x001) == 0x001 */
+        return (pte_val(pte) & _PAGE_PRESENT) != 0;
 }
 
-static inline int pte_present(pte_t pte)
+static inline int pte_none(pte_t pte)
 {
-        unsigned long mask = _PAGE_RO | _PAGE_INVALID | _PAGE_SWT | _PAGE_SWX;
-        return (pte_val(pte) & mask) == _PAGE_TYPE_NONE ||
-                (!(pte_val(pte) & _PAGE_INVALID) &&
-                 !(pte_val(pte) & _PAGE_SWT));
+        /* Bit pattern: pte == 0x400 */
+        return pte_val(pte) == _PAGE_INVALID;
 }
 
 static inline int pte_file(pte_t pte)
 {
-        unsigned long mask = _PAGE_RO | _PAGE_INVALID | _PAGE_SWT;
-        return (pte_val(pte) & mask) == _PAGE_TYPE_FILE;
+        /* Bit pattern: (pte & 0x601) == 0x600 */
+        return (pte_val(pte) & (_PAGE_INVALID | _PAGE_PROTECT | _PAGE_PRESENT))
+                == (_PAGE_INVALID | _PAGE_PROTECT);
 }
 
 static inline int pte_special(pte_t pte)
@@ -634,6 +668,15 @@ static inline void pgste_set_unlock(pte_t *ptep, pgste_t pgste)
 #endif
 }
 
+static inline pgste_t pgste_get(pte_t *ptep)
+{
+        unsigned long pgste = 0;
+#ifdef CONFIG_PGSTE
+        pgste = *(unsigned long *)(ptep + PTRS_PER_PTE);
+#endif
+        return __pgste(pgste);
+}
+
 static inline void pgste_set(pte_t *ptep, pgste_t pgste)
 {
 #ifdef CONFIG_PGSTE
@@ -644,33 +687,28 @@ static inline void pgste_set(pte_t *ptep, pgste_t pgste)
 static inline pgste_t pgste_update_all(pte_t *ptep, pgste_t pgste)
 {
 #ifdef CONFIG_PGSTE
-        unsigned long address, bits;
-        unsigned char skey;
+        unsigned long address, bits, skey;
 
         if (pte_val(*ptep) & _PAGE_INVALID)
                 return pgste;
         address = pte_val(*ptep) & PAGE_MASK;
-        skey = page_get_storage_key(address);
+        skey = (unsigned long) page_get_storage_key(address);
         bits = skey & (_PAGE_CHANGED | _PAGE_REFERENCED);
-        /* Clear page changed & referenced bit in the storage key */
-        if (bits & _PAGE_CHANGED)
+        if (!(pgste_val(pgste) & PGSTE_HC_BIT) && (bits & _PAGE_CHANGED)) {
+                /* Transfer dirty + referenced bit to host bits in pgste */
+                pgste_val(pgste) |= bits << 52;
                 page_set_storage_key(address, skey ^ bits, 0);
-        else if (bits)
+        } else if (!(pgste_val(pgste) & PGSTE_HR_BIT) &&
+                   (bits & _PAGE_REFERENCED)) {
+                /* Transfer referenced bit to host bit in pgste */
+                pgste_val(pgste) |= PGSTE_HR_BIT;
                 page_reset_referenced(address);
+        }
         /* Transfer page changed & referenced bit to guest bits in pgste */
         pgste_val(pgste) |= bits << 48;         /* GR bit & GC bit */
-        /* Get host changed & referenced bits from pgste */
-        bits |= (pgste_val(pgste) & (PGSTE_HR_BIT | PGSTE_HC_BIT)) >> 52;
-        /* Transfer page changed & referenced bit to kvm user bits */
-        pgste_val(pgste) |= bits << 45;         /* PGSTE_UR_BIT & PGSTE_UC_BIT */
-        /* Clear relevant host bits in pgste. */
-        pgste_val(pgste) &= ~(PGSTE_HR_BIT | PGSTE_HC_BIT);
-        pgste_val(pgste) &= ~(PGSTE_ACC_BITS | PGSTE_FP_BIT);
         /* Copy page access key and fetch protection bit to pgste */
-        pgste_val(pgste) |=
-                (unsigned long) (skey & (_PAGE_ACC_BITS | _PAGE_FP_BIT)) << 56;
-        /* Transfer referenced bit to pte */
-        pte_val(*ptep) |= (bits & _PAGE_REFERENCED) << 1;
+        pgste_val(pgste) &= ~(PGSTE_ACC_BITS | PGSTE_FP_BIT);
+        pgste_val(pgste) |= (skey & (_PAGE_ACC_BITS | _PAGE_FP_BIT)) << 56;
 #endif
         return pgste;
 
@@ -679,24 +717,11 @@ static inline pgste_t pgste_update_all(pte_t *ptep, pgste_t pgste)
 static inline pgste_t pgste_update_young(pte_t *ptep, pgste_t pgste)
 {
 #ifdef CONFIG_PGSTE
-        int young;
-
         if (pte_val(*ptep) & _PAGE_INVALID)
                 return pgste;
         /* Get referenced bit from storage key */
-        young = page_reset_referenced(pte_val(*ptep) & PAGE_MASK);
-        if (young)
-                pgste_val(pgste) |= PGSTE_GR_BIT;
-        /* Get host referenced bit from pgste */
-        if (pgste_val(pgste) & PGSTE_HR_BIT) {
-                pgste_val(pgste) &= ~PGSTE_HR_BIT;
-                young = 1;
-        }
-        /* Transfer referenced bit to kvm user bits and pte */
-        if (young) {
-                pgste_val(pgste) |= PGSTE_UR_BIT;
-                pte_val(*ptep) |= _PAGE_SWR;
-        }
+        if (page_reset_referenced(pte_val(*ptep) & PAGE_MASK))
+                pgste_val(pgste) |= PGSTE_HR_BIT | PGSTE_GR_BIT;
 #endif
         return pgste;
 }
@@ -723,13 +748,13 @@ static inline void pgste_set_key(pte_t *ptep, pgste_t pgste, pte_t entry)
 
 static inline void pgste_set_pte(pte_t *ptep, pte_t entry)
 {
-        if (!MACHINE_HAS_ESOP && (pte_val(entry) & _PAGE_SWW)) {
+        if (!MACHINE_HAS_ESOP && (pte_val(entry) & _PAGE_WRITE)) {
                 /*
                  * Without enhanced suppression-on-protection force
                  * the dirty bit on for all writable ptes.
                  */
-                pte_val(entry) |= _PAGE_SWC;
-                pte_val(entry) &= ~_PAGE_RO;
+                pte_val(entry) |= _PAGE_DIRTY;
+                pte_val(entry) &= ~_PAGE_PROTECT;
         }
         *ptep = entry;
 }
@@ -841,21 +866,17 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
  */
 static inline int pte_write(pte_t pte)
 {
-        return (pte_val(pte) & _PAGE_SWW) != 0;
+        return (pte_val(pte) & _PAGE_WRITE) != 0;
 }
 
 static inline int pte_dirty(pte_t pte)
 {
-        return (pte_val(pte) & _PAGE_SWC) != 0;
+        return (pte_val(pte) & _PAGE_DIRTY) != 0;
 }
 
 static inline int pte_young(pte_t pte)
 {
-#ifdef CONFIG_PGSTE
-        if (pte_val(pte) & _PAGE_SWR)
-                return 1;
-#endif
-        return 0;
+        return (pte_val(pte) & _PAGE_YOUNG) != 0;
 }
 
 /*
@@ -880,12 +901,12 @@ static inline void pud_clear(pud_t *pud)
 
 static inline void pmd_clear(pmd_t *pmdp)
 {
-        pmd_val(*pmdp) = _SEGMENT_ENTRY_EMPTY;
+        pmd_val(*pmdp) = _SEGMENT_ENTRY_INVALID;
 }
 
 static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 {
-        pte_val(*ptep) = _PAGE_TYPE_EMPTY;
+        pte_val(*ptep) = _PAGE_INVALID;
 }
 
 /*
@@ -896,55 +917,63 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 {
         pte_val(pte) &= _PAGE_CHG_MASK;
         pte_val(pte) |= pgprot_val(newprot);
-        if ((pte_val(pte) & _PAGE_SWC) && (pte_val(pte) & _PAGE_SWW))
-                pte_val(pte) &= ~_PAGE_RO;
+        /*
+         * newprot for PAGE_NONE, PAGE_READ and PAGE_WRITE has the
+         * invalid bit set, clear it again for readable, young pages
+         */
+        if ((pte_val(pte) & _PAGE_YOUNG) && (pte_val(pte) & _PAGE_READ))
+                pte_val(pte) &= ~_PAGE_INVALID;
+        /*
+         * newprot for PAGE_READ and PAGE_WRITE has the page protection
+         * bit set, clear it again for writable, dirty pages
+         */
+        if ((pte_val(pte) & _PAGE_DIRTY) && (pte_val(pte) & _PAGE_WRITE))
+                pte_val(pte) &= ~_PAGE_PROTECT;
         return pte;
 }
 
 static inline pte_t pte_wrprotect(pte_t pte)
 {
-        pte_val(pte) &= ~_PAGE_SWW;
-        /* Do not clobber _PAGE_TYPE_NONE pages!  */
-        if (!(pte_val(pte) & _PAGE_INVALID))
-                pte_val(pte) |= _PAGE_RO;
+        pte_val(pte) &= ~_PAGE_WRITE;
+        pte_val(pte) |= _PAGE_PROTECT;
         return pte;
 }
 
 static inline pte_t pte_mkwrite(pte_t pte)
 {
-        pte_val(pte) |= _PAGE_SWW;
-        if (pte_val(pte) & _PAGE_SWC)
-                pte_val(pte) &= ~_PAGE_RO;
+        pte_val(pte) |= _PAGE_WRITE;
+        if (pte_val(pte) & _PAGE_DIRTY)
+                pte_val(pte) &= ~_PAGE_PROTECT;
         return pte;
 }
 
 static inline pte_t pte_mkclean(pte_t pte)
 {
-        pte_val(pte) &= ~_PAGE_SWC;
-        /* Do not clobber _PAGE_TYPE_NONE pages!  */
-        if (!(pte_val(pte) & _PAGE_INVALID))
-                pte_val(pte) |= _PAGE_RO;
+        pte_val(pte) &= ~_PAGE_DIRTY;
+        pte_val(pte) |= _PAGE_PROTECT;
         return pte;
 }
 
 static inline pte_t pte_mkdirty(pte_t pte)
 {
-        pte_val(pte) |= _PAGE_SWC;
-        if (pte_val(pte) & _PAGE_SWW)
-                pte_val(pte) &= ~_PAGE_RO;
+        pte_val(pte) |= _PAGE_DIRTY;
+        if (pte_val(pte) & _PAGE_WRITE)
+                pte_val(pte) &= ~_PAGE_PROTECT;
         return pte;
 }
 
 static inline pte_t pte_mkold(pte_t pte)
 {
-#ifdef CONFIG_PGSTE
-        pte_val(pte) &= ~_PAGE_SWR;
-#endif
+        pte_val(pte) &= ~_PAGE_YOUNG;
+        pte_val(pte) |= _PAGE_INVALID;
         return pte;
 }
 
 static inline pte_t pte_mkyoung(pte_t pte)
 {
+        pte_val(pte) |= _PAGE_YOUNG;
+        if (pte_val(pte) & _PAGE_READ)
+                pte_val(pte) &= ~_PAGE_INVALID;
         return pte;
 }
 
@@ -957,7 +986,7 @@ static inline pte_t pte_mkspecial(pte_t pte)
 #ifdef CONFIG_HUGETLB_PAGE
 static inline pte_t pte_mkhuge(pte_t pte)
 {
-        pte_val(pte) |= (_SEGMENT_ENTRY_LARGE | _SEGMENT_ENTRY_CO);
+        pte_val(pte) |= _PAGE_LARGE;
         return pte;
 }
 #endif
@@ -974,8 +1003,8 @@ static inline int ptep_test_and_clear_user_dirty(struct mm_struct *mm,
         if (mm_has_pgste(mm)) {
                 pgste = pgste_get_lock(ptep);
                 pgste = pgste_update_all(ptep, pgste);
-                dirty = !!(pgste_val(pgste) & PGSTE_UC_BIT);
-                pgste_val(pgste) &= ~PGSTE_UC_BIT;
+                dirty = !!(pgste_val(pgste) & PGSTE_HC_BIT);
+                pgste_val(pgste) &= ~PGSTE_HC_BIT;
                 pgste_set_unlock(ptep, pgste);
                 return dirty;
         }
@@ -994,59 +1023,75 @@ static inline int ptep_test_and_clear_user_young(struct mm_struct *mm,
         if (mm_has_pgste(mm)) {
                 pgste = pgste_get_lock(ptep);
                 pgste = pgste_update_young(ptep, pgste);
-                young = !!(pgste_val(pgste) & PGSTE_UR_BIT);
-                pgste_val(pgste) &= ~PGSTE_UR_BIT;
+                young = !!(pgste_val(pgste) & PGSTE_HR_BIT);
+                pgste_val(pgste) &= ~PGSTE_HR_BIT;
                 pgste_set_unlock(ptep, pgste);
         }
         return young;
 }
 
+static inline void __ptep_ipte(unsigned long address, pte_t *ptep)
+{
+        if (!(pte_val(*ptep) & _PAGE_INVALID)) {
+#ifndef CONFIG_64BIT
+                /* pto must point to the start of the segment table */
+                pte_t *pto = (pte_t *) (((unsigned long) ptep) & 0x7ffffc00);
+#else
+                /* ipte in zarch mode can do the math */
+                pte_t *pto = ptep;
+#endif
+                asm volatile(
+                        "       ipte    %2,%3"
+                        : "=m" (*ptep) : "m" (*ptep),
+                          "a" (pto), "a" (address));
+        }
+}
+
+static inline void ptep_flush_lazy(struct mm_struct *mm,
+                                   unsigned long address, pte_t *ptep)
+{
+        int active = (mm == current->active_mm) ? 1 : 0;
+
+        if (atomic_read(&mm->context.attach_count) > active)
+                __ptep_ipte(address, ptep);
+        else
+                mm->context.flush_mm = 1;
+}
+
 #define __HAVE_ARCH_PTEP_TEST_AND_CLEAR_YOUNG
 static inline int ptep_test_and_clear_young(struct vm_area_struct *vma,
                                             unsigned long addr, pte_t *ptep)
 {
         pgste_t pgste;
         pte_t pte;
+        int young;
 
         if (mm_has_pgste(vma->vm_mm)) {
                 pgste = pgste_get_lock(ptep);
-                pgste = pgste_update_young(ptep, pgste);
-                pte = *ptep;
-                *ptep = pte_mkold(pte);
-                pgste_set_unlock(ptep, pgste);
-                return pte_young(pte);
+                pgste = pgste_ipte_notify(vma->vm_mm, addr, ptep, pgste);
         }
-        return 0;
+
+        pte = *ptep;
+        __ptep_ipte(addr, ptep);
+        young = pte_young(pte);
+        pte = pte_mkold(pte);
+
+        if (mm_has_pgste(vma->vm_mm)) {
+                pgste_set_pte(ptep, pte);
+                pgste_set_unlock(ptep, pgste);
+        } else
+                *ptep = pte;
+
+        return young;
 }
 
 #define __HAVE_ARCH_PTEP_CLEAR_YOUNG_FLUSH
 static inline int ptep_clear_flush_young(struct vm_area_struct *vma,
                                          unsigned long address, pte_t *ptep)
 {
-        /* No need to flush TLB
-         * On s390 reference bits are in storage key and never in TLB
-         * With virtualization we handle the reference bit, without we
-         * we can simply return */
         return ptep_test_and_clear_young(vma, address, ptep);
 }
 
-static inline void __ptep_ipte(unsigned long address, pte_t *ptep)
-{
-        if (!(pte_val(*ptep) & _PAGE_INVALID)) {
-#ifndef CONFIG_64BIT
-                /* pto must point to the start of the segment table */
-                pte_t *pto = (pte_t *) (((unsigned long) ptep) & 0x7ffffc00);
-#else
-                /* ipte in zarch mode can do the math */
-                pte_t *pto = ptep;
-#endif
-                asm volatile(
-                        "       ipte    %2,%3"
-                        : "=m" (*ptep) : "m" (*ptep),
-                          "a" (pto), "a" (address));
-        }
-}
-
 /*
  * This is hard to understand. ptep_get_and_clear and ptep_clear_flush
  * both clear the TLB for the unmapped pte. The reason is that
@@ -1067,16 +1112,14 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm,
         pgste_t pgste;
         pte_t pte;
 
-        mm->context.flush_mm = 1;
         if (mm_has_pgste(mm)) {
                 pgste = pgste_get_lock(ptep);
                 pgste = pgste_ipte_notify(mm, address, ptep, pgste);
         }
 
         pte = *ptep;
-        if (!mm_exclusive(mm))
-                __ptep_ipte(address, ptep);
-        pte_val(*ptep) = _PAGE_TYPE_EMPTY;
+        ptep_flush_lazy(mm, address, ptep);
+        pte_val(*ptep) = _PAGE_INVALID;
 
         if (mm_has_pgste(mm)) {
                 pgste = pgste_update_all(&pte, pgste);
@@ -1093,15 +1136,14 @@ static inline pte_t ptep_modify_prot_start(struct mm_struct *mm,
         pgste_t pgste;
         pte_t pte;
 
-        mm->context.flush_mm = 1;
         if (mm_has_pgste(mm)) {
                 pgste = pgste_get_lock(ptep);
                 pgste_ipte_notify(mm, address, ptep, pgste);
         }
 
         pte = *ptep;
-        if (!mm_exclusive(mm))
-                __ptep_ipte(address, ptep);
+        ptep_flush_lazy(mm, address, ptep);
+        pte_val(*ptep) |= _PAGE_INVALID;
 
         if (mm_has_pgste(mm)) {
                 pgste = pgste_update_all(&pte, pgste);
@@ -1117,7 +1159,7 @@ static inline void ptep_modify_prot_commit(struct mm_struct *mm,
         pgste_t pgste;
 
         if (mm_has_pgste(mm)) {
-                pgste = *(pgste_t *)(ptep + PTRS_PER_PTE);
+                pgste = pgste_get(ptep);
                 pgste_set_key(ptep, pgste, pte);
                 pgste_set_pte(ptep, pte);
                 pgste_set_unlock(ptep, pgste);
@@ -1139,7 +1181,7 @@ static inline pte_t ptep_clear_flush(struct vm_area_struct *vma,
 
         pte = *ptep;
         __ptep_ipte(address, ptep);
-        pte_val(*ptep) = _PAGE_TYPE_EMPTY;
+        pte_val(*ptep) = _PAGE_INVALID;
 
         if (mm_has_pgste(vma->vm_mm)) {
                 pgste = pgste_update_all(&pte, pgste);
@@ -1163,18 +1205,17 @@ static inline pte_t ptep_get_and_clear_full(struct mm_struct *mm,
         pgste_t pgste;
         pte_t pte;
 
-        if (mm_has_pgste(mm)) {
+        if (!full && mm_has_pgste(mm)) {
                 pgste = pgste_get_lock(ptep);
-                if (!full)
-                        pgste = pgste_ipte_notify(mm, address, ptep, pgste);
+                pgste = pgste_ipte_notify(mm, address, ptep, pgste);
         }
 
         pte = *ptep;
         if (!full)
-                __ptep_ipte(address, ptep);
-        pte_val(*ptep) = _PAGE_TYPE_EMPTY;
+                ptep_flush_lazy(mm, address, ptep);
+        pte_val(*ptep) = _PAGE_INVALID;
 
-        if (mm_has_pgste(mm)) {
+        if (!full && mm_has_pgste(mm)) {
                 pgste = pgste_update_all(&pte, pgste);
                 pgste_set_unlock(ptep, pgste);
         }
@@ -1189,14 +1230,12 @@ static inline pte_t ptep_set_wrprotect(struct mm_struct *mm,
         pte_t pte = *ptep;
 
         if (pte_write(pte)) {
-                mm->context.flush_mm = 1;
                 if (mm_has_pgste(mm)) {
                         pgste = pgste_get_lock(ptep);
                         pgste = pgste_ipte_notify(mm, address, ptep, pgste);
                 }
 
-                if (!mm_exclusive(mm))
-                        __ptep_ipte(address, ptep);
+                ptep_flush_lazy(mm, address, ptep);
                 pte = pte_wrprotect(pte);
 
                 if (mm_has_pgste(mm)) {
@@ -1240,7 +1279,7 @@ static inline pte_t mk_pte_phys(unsigned long physpage, pgprot_t pgprot)
 {
         pte_t __pte;
         pte_val(__pte) = physpage + pgprot_val(pgprot);
-        return __pte;
+        return pte_mkyoung(__pte);
 }
 
 static inline pte_t mk_pte(struct page *page, pgprot_t pgprot)
@@ -1248,10 +1287,8 @@ static inline pte_t mk_pte(struct page *page, pgprot_t pgprot)
         unsigned long physpage = page_to_phys(page);
         pte_t __pte = mk_pte_phys(physpage, pgprot);
 
-        if ((pte_val(__pte) & _PAGE_SWW) && PageDirty(page)) {
-                pte_val(__pte) |= _PAGE_SWC;
-                pte_val(__pte) &= ~_PAGE_RO;
-        }
+        if (pte_write(__pte) && PageDirty(page))
+                __pte = pte_mkdirty(__pte);
         return __pte;
 }
 
@@ -1313,7 +1350,7 @@ static inline void __pmd_idte(unsigned long address, pmd_t *pmdp)
         unsigned long sto = (unsigned long) pmdp -
                             pmd_index(address) * sizeof(pmd_t);
 
-        if (!(pmd_val(*pmdp) & _SEGMENT_ENTRY_INV)) {
+        if (!(pmd_val(*pmdp) & _SEGMENT_ENTRY_INVALID)) {
                 asm volatile(
                         "       .insn   rrf,0xb98e0000,%2,%3,0,0"
                         : "=m" (*pmdp)
@@ -1324,24 +1361,68 @@ static inline void __pmd_idte(unsigned long address, pmd_t *pmdp)
         }
 }
 
+static inline void __pmd_csp(pmd_t *pmdp)
+{
+        register unsigned long reg2 asm("2") = pmd_val(*pmdp);
+        register unsigned long reg3 asm("3") = pmd_val(*pmdp) |
+                                               _SEGMENT_ENTRY_INVALID;
+        register unsigned long reg4 asm("4") = ((unsigned long) pmdp) + 5;
+
+        asm volatile(
+                "       csp %1,%3"
+                : "=m" (*pmdp)
+                : "d" (reg2), "d" (reg3), "d" (reg4), "m" (*pmdp) : "cc");
+}
+
 #if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_HUGETLB_PAGE)
 static inline unsigned long massage_pgprot_pmd(pgprot_t pgprot)
 {
         /*
-         * pgprot is PAGE_NONE, PAGE_RO, or PAGE_RW (see __Pxxx / __Sxxx)
+         * pgprot is PAGE_NONE, PAGE_READ, or PAGE_WRITE (see __Pxxx / __Sxxx)
          * Convert to segment table entry format.
          */
         if (pgprot_val(pgprot) == pgprot_val(PAGE_NONE))
                 return pgprot_val(SEGMENT_NONE);
-        if (pgprot_val(pgprot) == pgprot_val(PAGE_RO))
-                return pgprot_val(SEGMENT_RO);
-        return pgprot_val(SEGMENT_RW);
+        if (pgprot_val(pgprot) == pgprot_val(PAGE_READ))
+                return pgprot_val(SEGMENT_READ);
+        return pgprot_val(SEGMENT_WRITE);
+}
+
+static inline pmd_t pmd_mkyoung(pmd_t pmd)
+{
+#ifdef CONFIG_64BIT
+        if (pmd_prot_none(pmd)) {
+                pmd_val(pmd) |= _SEGMENT_ENTRY_PROTECT;
+        } else {
+                pmd_val(pmd) |= _SEGMENT_ENTRY_YOUNG;
+                pmd_val(pmd) &= ~_SEGMENT_ENTRY_INVALID;
+        }
+#endif
+        return pmd;
+}
+
+static inline pmd_t pmd_mkold(pmd_t pmd)
+{
+#ifdef CONFIG_64BIT
+        if (pmd_prot_none(pmd)) {
+                pmd_val(pmd) &= ~_SEGMENT_ENTRY_PROTECT;
+        } else {
+                pmd_val(pmd) &= ~_SEGMENT_ENTRY_YOUNG;
+                pmd_val(pmd) |= _SEGMENT_ENTRY_INVALID;
+        }
+#endif
+        return pmd;
 }
 
 static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
 {
+        int young;
+
+        young = pmd_young(pmd);
         pmd_val(pmd) &= _SEGMENT_CHG_MASK;
         pmd_val(pmd) |= massage_pgprot_pmd(newprot);
+        if (young)
+                pmd = pmd_mkyoung(pmd);
         return pmd;
 }
 
@@ -1349,18 +1430,29 @@ static inline pmd_t mk_pmd_phys(unsigned long physpage, pgprot_t pgprot)
 {
         pmd_t __pmd;
         pmd_val(__pmd) = physpage + massage_pgprot_pmd(pgprot);
-        return __pmd;
+        return pmd_mkyoung(__pmd);
 }
 
 static inline pmd_t pmd_mkwrite(pmd_t pmd)
 {
-        /* Do not clobber _HPAGE_TYPE_NONE pages! */
-        if (!(pmd_val(pmd) & _SEGMENT_ENTRY_INV))
-                pmd_val(pmd) &= ~_SEGMENT_ENTRY_RO;
+        /* Do not clobber PROT_NONE segments! */
+        if (!pmd_prot_none(pmd))
+                pmd_val(pmd) &= ~_SEGMENT_ENTRY_PROTECT;
         return pmd;
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLB_PAGE */
 
+static inline void pmdp_flush_lazy(struct mm_struct *mm,
+                                   unsigned long address, pmd_t *pmdp)
+{
+        int active = (mm == current->active_mm) ? 1 : 0;
+
+        if ((atomic_read(&mm->context.attach_count) & 0xffff) > active)
+                __pmd_idte(address, pmdp);
+        else
+                mm->context.flush_mm = 1;
+}
+
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
 
 #define __HAVE_ARCH_PGTABLE_DEPOSIT
@@ -1378,7 +1470,7 @@ static inline int pmd_trans_splitting(pmd_t pmd)
 static inline void set_pmd_at(struct mm_struct *mm, unsigned long addr,
                               pmd_t *pmdp, pmd_t entry)
 {
-        if (!(pmd_val(entry) & _SEGMENT_ENTRY_INV) && MACHINE_HAS_EDAT1)
+        if (!(pmd_val(entry) & _SEGMENT_ENTRY_INVALID) && MACHINE_HAS_EDAT1)
                 pmd_val(entry) |= _SEGMENT_ENTRY_CO;
         *pmdp = entry;
 }
@@ -1391,7 +1483,9 @@ static inline pmd_t pmd_mkhuge(pmd_t pmd)
 
 static inline pmd_t pmd_wrprotect(pmd_t pmd)
 {
-        pmd_val(pmd) |= _SEGMENT_ENTRY_RO;
+        /* Do not clobber PROT_NONE segments! */
+        if (!pmd_prot_none(pmd))
+                pmd_val(pmd) |= _SEGMENT_ENTRY_PROTECT;
         return pmd;
 }
 
@@ -1401,50 +1495,16 @@ static inline pmd_t pmd_mkdirty(pmd_t pmd)
         return pmd;
 }
 
-static inline pmd_t pmd_mkold(pmd_t pmd)
-{
-        /* No referenced bit in the segment table entry. */
-        return pmd;
-}
-
-static inline pmd_t pmd_mkyoung(pmd_t pmd)
-{
-        /* No referenced bit in the segment table entry. */
-        return pmd;
-}
-
 #define __HAVE_ARCH_PMDP_TEST_AND_CLEAR_YOUNG
 static inline int pmdp_test_and_clear_young(struct vm_area_struct *vma,
                                             unsigned long address, pmd_t *pmdp)
 {
-        unsigned long pmd_addr = pmd_val(*pmdp) & HPAGE_MASK;
-        long tmp, rc;
-        int counter;
+        pmd_t pmd;
 
-        rc = 0;
-        if (MACHINE_HAS_RRBM) {
-                counter = PTRS_PER_PTE >> 6;
-                asm volatile(
-                        "0:     .insn   rre,0xb9ae0000,%0,%3\n" /* rrbm */
-                        "       ogr     %1,%0\n"
-                        "       la      %3,0(%4,%3)\n"
-                        "       brct    %2,0b\n"
-                        : "=&d" (tmp), "+&d" (rc), "+d" (counter),
-                          "+a" (pmd_addr)
-                        : "a" (64 * 4096UL) : "cc");
-                rc = !!rc;
-        } else {
-                counter = PTRS_PER_PTE;
-                asm volatile(
-                        "0:     rrbe    0,%2\n"
-                        "       la      %2,0(%3,%2)\n"
-                        "       brc     12,1f\n"
-                        "       lhi     %0,1\n"
-                        "1:     brct    %1,0b\n"
-                        : "+d" (rc), "+d" (counter), "+a" (pmd_addr)
-                        : "a" (4096UL) : "cc");
-        }
-        return rc;
+        pmd = *pmdp;
+        __pmd_idte(address, pmdp);
+        *pmdp = pmd_mkold(pmd);
+        return pmd_young(pmd);
 }
 
 #define __HAVE_ARCH_PMDP_GET_AND_CLEAR
@@ -1510,10 +1570,8 @@ static inline unsigned long pmd_pfn(pmd_t pmd)
  * exception will occur instead of a page translation exception. The
  * specifiation exception has the bad habit not to store necessary
  * information in the lowcore.
- * Bit 21 and bit 22 are the page invalid bit and the page protection
- * bit. We set both to indicate a swapped page.
- * Bit 30 and 31 are used to distinguish the different page types. For
- * a swapped page these bits need to be zero.
+ * Bits 21, 22, 30 and 31 are used to indicate the page type.
+ * A swap pte is indicated by bit pattern (pte & 0x603) == 0x402
  * This leaves the bits 1-19 and bits 24-29 to store type and offset.
  * We use the 5 bits from 25-29 for the type and the 20 bits from 1-19
  * plus 24 for the offset.
@@ -1527,10 +1585,8 @@ static inline unsigned long pmd_pfn(pmd_t pmd)
  * exception will occur instead of a page translation exception. The
  * specifiation exception has the bad habit not to store necessary
  * information in the lowcore.
- * Bit 53 and bit 54 are the page invalid bit and the page protection
- * bit. We set both to indicate a swapped page.
- * Bit 62 and 63 are used to distinguish the different page types. For
- * a swapped page these bits need to be zero.
+ * Bits 53, 54, 62 and 63 are used to indicate the page type.
+ * A swap pte is indicated by bit pattern (pte & 0x603) == 0x402
  * This leaves the bits 0-51 and bits 56-61 to store type and offset.
  * We use the 5 bits from 57-61 for the type and the 53 bits from 0-51
  * plus 56 for the offset.
@@ -1547,7 +1603,7 @@ static inline pte_t mk_swap_pte(unsigned long type, unsigned long offset)
 {
         pte_t pte;
         offset &= __SWP_OFFSET_MASK;
-        pte_val(pte) = _PAGE_TYPE_SWAP | ((type & 0x1f) << 2) |
+        pte_val(pte) = _PAGE_INVALID | _PAGE_TYPE | ((type & 0x1f) << 2) |
                 ((offset & 1UL) << 7) | ((offset & ~1UL) << 11);
         return pte;
 }
@@ -1570,7 +1626,7 @@ static inline pte_t mk_swap_pte(unsigned long type, unsigned long offset)
 
 #define pgoff_to_pte(__off) \
         ((pte_t) { ((((__off) & 0x7f) << 1) + (((__off) >> 7) << 12)) \
-                   | _PAGE_TYPE_FILE })
+                   | _PAGE_INVALID | _PAGE_PROTECT })
 
 #endif /* !__ASSEMBLY__ */
 
diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
index b0e6435b2f02..0eb37505cab1 100644
--- a/arch/s390/include/asm/processor.h
+++ b/arch/s390/include/asm/processor.h
@@ -43,6 +43,7 @@ extern void execve_tail(void);
 #ifndef CONFIG_64BIT
 
 #define TASK_SIZE               (1UL << 31)
+#define TASK_MAX_SIZE           (1UL << 31)
 #define TASK_UNMAPPED_BASE      (1UL << 30)
 
 #else /* CONFIG_64BIT */
@@ -51,6 +52,7 @@ extern void execve_tail(void);
 #define TASK_UNMAPPED_BASE      (test_thread_flag(TIF_31BIT) ? \
                                         (1UL << 30) : (1UL << 41))
 #define TASK_SIZE               TASK_SIZE_OF(current)
+#define TASK_MAX_SIZE           (1UL << 53)
 
 #endif /* CONFIG_64BIT */
 
diff --git a/arch/s390/include/asm/serial.h b/arch/s390/include/asm/serial.h
new file mode 100644
index 000000000000..5b3e48ef534b
--- /dev/null
+++ b/arch/s390/include/asm/serial.h
@@ -0,0 +1,6 @@
+#ifndef _ASM_S390_SERIAL_H
+#define _ASM_S390_SERIAL_H
+
+#define BASE_BAUD 0
+
+#endif /* _ASM_S390_SERIAL_H */
diff --git a/arch/s390/include/asm/switch_to.h b/arch/s390/include/asm/switch_to.h
index 80b6f11263c4..6dbd559763c9 100644
--- a/arch/s390/include/asm/switch_to.h
+++ b/arch/s390/include/asm/switch_to.h
@@ -8,6 +8,7 @@
 #define __ASM_SWITCH_TO_H
 
 #include <linux/thread_info.h>
+#include <asm/ptrace.h>
 
 extern struct task_struct *__switch_to(void *, void *);
 extern void update_cr_regs(struct task_struct *task);
@@ -68,12 +69,16 @@ static inline void restore_fp_regs(s390_fp_regs *fpregs)
 
 static inline void save_access_regs(unsigned int *acrs)
 {
-        asm volatile("stam 0,15,%0" : "=Q" (*acrs));
+        typedef struct { int _[NUM_ACRS]; } acrstype;
+
+        asm volatile("stam 0,15,%0" : "=Q" (*(acrstype *)acrs));
 }
 
 static inline void restore_access_regs(unsigned int *acrs)
 {
-        asm volatile("lam 0,15,%0" : : "Q" (*acrs));
+        typedef struct { int _[NUM_ACRS]; } acrstype;
+
+        asm volatile("lam 0,15,%0" : : "Q" (*(acrstype *)acrs));
 }
 
 #define switch_to(prev,next,last) do {                                  \
diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
index b75d7d686684..2cb846c4b37f 100644
--- a/arch/s390/include/asm/tlb.h
+++ b/arch/s390/include/asm/tlb.h
@@ -32,6 +32,7 @@ struct mmu_gather {
         struct mm_struct *mm;
         struct mmu_table_batch *batch;
         unsigned int fullmm;
+        unsigned long start, end;
 };
 
 struct mmu_table_batch {
@@ -48,10 +49,13 @@ extern void tlb_remove_table(struct mmu_gather *tlb, void *table);
 
 static inline void tlb_gather_mmu(struct mmu_gather *tlb,
                                   struct mm_struct *mm,
-                                  unsigned int full_mm_flush)
+                                  unsigned long start,
+                                  unsigned long end)
 {
         tlb->mm = mm;
-        tlb->fullmm = full_mm_flush;
+        tlb->start = start;
+        tlb->end = end;
+        tlb->fullmm = !(start | (end+1));
         tlb->batch = NULL;
         if (tlb->fullmm)
                 __tlb_flush_mm(mm);
@@ -59,13 +63,14 @@ static inline void tlb_gather_mmu(struct mmu_gather *tlb,
 
 static inline void tlb_flush_mmu(struct mmu_gather *tlb)
 {
+        __tlb_flush_mm_lazy(tlb->mm);
         tlb_table_flush(tlb);
 }
 
 static inline void tlb_finish_mmu(struct mmu_gather *tlb,
                                   unsigned long start, unsigned long end)
 {
-        tlb_table_flush(tlb);
+        tlb_flush_mmu(tlb);
 }
 
 /*
diff --git a/arch/s390/include/asm/tlbflush.h b/arch/s390/include/asm/tlbflush.h
index 6b32af30878c..f9fef0425fee 100644
--- a/arch/s390/include/asm/tlbflush.h
+++ b/arch/s390/include/asm/tlbflush.h
@@ -86,7 +86,7 @@ static inline void __tlb_flush_mm(struct mm_struct * mm)
                 __tlb_flush_full(mm);
 }
 
-static inline void __tlb_flush_mm_cond(struct mm_struct * mm)
+static inline void __tlb_flush_mm_lazy(struct mm_struct * mm)
 {
         if (mm->context.flush_mm) {
                 __tlb_flush_mm(mm);
@@ -118,13 +118,13 @@ static inline void __tlb_flush_mm_cond(struct mm_struct * mm)
 
 static inline void flush_tlb_mm(struct mm_struct *mm)
 {
-        __tlb_flush_mm_cond(mm);
+        __tlb_flush_mm_lazy(mm);
 }
 
 static inline void flush_tlb_range(struct vm_area_struct *vma,
                                    unsigned long start, unsigned long end)
 {
-        __tlb_flush_mm_cond(vma->vm_mm);
+        __tlb_flush_mm_lazy(vma->vm_mm);
 }
 
 static inline void flush_tlb_kernel_range(unsigned long start,
diff --git a/arch/s390/include/asm/vtime.h b/arch/s390/include/asm/vtime.h
new file mode 100644
index 000000000000..af9896c53eb3
--- /dev/null
+++ b/arch/s390/include/asm/vtime.h
@@ -0,0 +1,7 @@
+#ifndef _S390_VTIME_H
+#define _S390_VTIME_H
+
+#define __ARCH_HAS_VTIME_ACCOUNT
+#define __ARCH_HAS_VTIME_TASK_SWITCH
+
+#endif /* _S390_VTIME_H */
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index be7a408be7a1..cc30d1fb000c 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -18,6 +18,7 @@
 #include <asm/unistd.h>
 #include <asm/page.h>
 #include <asm/sigp.h>
+#include <asm/irq.h>
 
 __PT_R0      =  __PT_GPRS
 __PT_R1      =  __PT_GPRS + 4
@@ -435,6 +436,11 @@ io_skip:
 io_loop:
         l       %r1,BASED(.Ldo_IRQ)
         lr      %r2,%r11                # pass pointer to pt_regs
+        lhi     %r3,IO_INTERRUPT
+        tm      __PT_INT_CODE+8(%r11),0x80      # adapter interrupt ?
+        jz      io_call
+        lhi     %r3,THIN_INTERRUPT
+io_call:
         basr    %r14,%r1                # call do_IRQ
         tm      __LC_MACHINE_FLAGS+2,0x10       # MACHINE_FLAG_LPAR
         jz      io_return
@@ -584,9 +590,10 @@ ext_skip:
         mvc     __PT_INT_CODE(4,%r11),__LC_EXT_CPU_ADDR
         mvc     __PT_INT_PARM(4,%r11),__LC_EXT_PARAMS
         TRACE_IRQS_OFF
+        l       %r1,BASED(.Ldo_IRQ)
         lr      %r2,%r11                # pass pointer to pt_regs
-        l       %r1,BASED(.Ldo_extint)
-        basr    %r14,%r1                # call do_extint
+        lhi     %r3,EXT_INTERRUPT
+        basr    %r14,%r1                # call do_IRQ
         j       io_return
 
 /*
@@ -879,13 +886,13 @@ cleanup_idle:
         stm     %r9,%r10,__LC_SYSTEM_TIMER
         mvc     __LC_LAST_UPDATE_TIMER(8),__TIMER_IDLE_EXIT(%r2)
         # prepare return psw
-        n       %r8,BASED(cleanup_idle_wait)    # clear wait state bit
+        n       %r8,BASED(cleanup_idle_wait)    # clear irq & wait state bits
         l       %r9,24(%r11)                    # return from psw_idle
         br      %r14
 cleanup_idle_insn:
         .long   psw_idle_lpsw + 0x80000000
 cleanup_idle_wait:
-        .long   0xfffdffff
+        .long   0xfcfdffff
 
 /*
  * Integer constants
@@ -902,7 +909,6 @@ cleanup_idle_wait:
 .Ldo_machine_check:     .long   s390_do_machine_check
 .Lhandle_mcck:          .long   s390_handle_mcck
 .Ldo_IRQ:               .long   do_IRQ
-.Ldo_extint:            .long   do_extint
 .Ldo_signal:            .long   do_signal
 .Ldo_notify_resume:     .long   do_notify_resume
 .Ldo_per_trap:          .long   do_per_trap
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index 1c039d0c24c7..2b2188b97c6a 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -19,6 +19,7 @@
 #include <asm/unistd.h>
 #include <asm/page.h>
 #include <asm/sigp.h>
+#include <asm/irq.h>
 
 __PT_R0      =  __PT_GPRS
 __PT_R1      =  __PT_GPRS + 8
@@ -468,6 +469,11 @@ io_skip:
         xc      __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
 io_loop:
         lgr     %r2,%r11                # pass pointer to pt_regs
+        lghi    %r3,IO_INTERRUPT
+        tm      __PT_INT_CODE+8(%r11),0x80      # adapter interrupt ?
+        jz      io_call
+        lghi    %r3,THIN_INTERRUPT
+io_call:
         brasl   %r14,do_IRQ
         tm      __LC_MACHINE_FLAGS+6,0x10       # MACHINE_FLAG_LPAR
         jz      io_return
@@ -623,7 +629,8 @@ ext_skip:
         TRACE_IRQS_OFF
         xc      __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
         lgr     %r2,%r11                # pass pointer to pt_regs
-        brasl   %r14,do_extint
+        lghi    %r3,EXT_INTERRUPT
+        brasl   %r14,do_IRQ
         j       io_return
 
 /*
@@ -922,7 +929,7 @@ cleanup_idle:
         stg     %r9,__LC_SYSTEM_TIMER
         mvc     __LC_LAST_UPDATE_TIMER(8),__TIMER_IDLE_EXIT(%r2)
         # prepare return psw
-        nihh    %r8,0xfffd              # clear wait state bit
+        nihh    %r8,0xfcfd              # clear irq & wait state bits
         lg      %r9,48(%r11)            # return from psw_idle
         br      %r14
 cleanup_idle_insn:
diff --git a/arch/s390/kernel/irq.c b/arch/s390/kernel/irq.c
index 54b0995514e8..b34ba0ea96a9 100644
--- a/arch/s390/kernel/irq.c
+++ b/arch/s390/kernel/irq.c
@@ -22,6 +22,7 @@
 #include <asm/cputime.h>
 #include <asm/lowcore.h>
 #include <asm/irq.h>
+#include <asm/hw_irq.h>
 #include "entry.h"
 
 DEFINE_PER_CPU_SHARED_ALIGNED(struct irq_stat, irq_stat);
@@ -42,9 +43,10 @@ struct irq_class {
  * Since the external and I/O interrupt fields are already sums we would end
  * up with having a sum which accounts each interrupt twice.
  */
-static const struct irq_class irqclass_main_desc[NR_IRQS] = {
-        [EXTERNAL_INTERRUPT] = {.name = "EXT"},
-        [IO_INTERRUPT]       = {.name = "I/O"}
+static const struct irq_class irqclass_main_desc[NR_IRQS_BASE] = {
+        [EXT_INTERRUPT]  = {.name = "EXT"},
+        [IO_INTERRUPT]   = {.name = "I/O"},
+        [THIN_INTERRUPT] = {.name = "AIO"},
 };
 
 /*
@@ -86,6 +88,28 @@ static const struct irq_class irqclass_sub_desc[NR_ARCH_IRQS] = {
         [CPU_RST]    = {.name = "RST", .desc = "[CPU] CPU Restart"},
 };
 
+void __init init_IRQ(void)
+{
+        irq_reserve_irqs(0, THIN_INTERRUPT);
+        init_cio_interrupts();
+        init_airq_interrupts();
+        init_ext_interrupts();
+}
+
+void do_IRQ(struct pt_regs *regs, int irq)
+{
+        struct pt_regs *old_regs;
+
+        old_regs = set_irq_regs(regs);
+        irq_enter();
+        if (S390_lowcore.int_clock >= S390_lowcore.clock_comparator)
+                /* Serve timer interrupts first. */
+                clock_comparator_work();
+        generic_handle_irq(irq);
+        irq_exit();
+        set_irq_regs(old_regs);
+}
+
 /*
  * show_interrupts is needed by /proc/interrupts.
  */
@@ -100,27 +124,36 @@ int show_interrupts(struct seq_file *p, void *v)
                 for_each_online_cpu(cpu)
                         seq_printf(p, "CPU%d       ", cpu);
                 seq_putc(p, '\n');
+                goto out;
         }
         if (irq < NR_IRQS) {
+                if (irq >= NR_IRQS_BASE)
+                        goto out;
                 seq_printf(p, "%s: ", irqclass_main_desc[irq].name);
                 for_each_online_cpu(cpu)
-                        seq_printf(p, "%10u ", kstat_cpu(cpu).irqs[irq]);
+                        seq_printf(p, "%10u ", kstat_irqs_cpu(irq, cpu));
                 seq_putc(p, '\n');
-                goto skip_arch_irqs;
+                goto out;
         }
         for (irq = 0; irq < NR_ARCH_IRQS; irq++) {
                 seq_printf(p, "%s: ", irqclass_sub_desc[irq].name);
                 for_each_online_cpu(cpu)
-                        seq_printf(p, "%10u ", per_cpu(irq_stat, cpu).irqs[irq]);
+                        seq_printf(p, "%10u ",
+                                   per_cpu(irq_stat, cpu).irqs[irq]);
                 if (irqclass_sub_desc[irq].desc)
                         seq_printf(p, "  %s", irqclass_sub_desc[irq].desc);
                 seq_putc(p, '\n');
         }
-skip_arch_irqs:
+out:
         put_online_cpus();
         return 0;
 }
 
+int arch_show_interrupts(struct seq_file *p, int prec)
+{
+        return 0;
+}
+
 /*
  * Switch to the asynchronous interrupt stack for softirq execution.
  */
@@ -159,14 +192,6 @@ asmlinkage void do_softirq(void)
         local_irq_restore(flags);
 }
 
-#ifdef CONFIG_PROC_FS
-void init_irq_proc(void)
-{
-        if (proc_mkdir("irq", NULL))
-                create_prof_cpu_mask();
-}
-#endif
-
 /*
  * ext_int_hash[index] is the list head for all external interrupts that hash
  * to this index.
@@ -183,14 +208,6 @@ struct ext_int_info {
 /* ext_int_hash_lock protects the handler lists for external interrupts */
 DEFINE_SPINLOCK(ext_int_hash_lock);
 
-static void __init init_external_interrupts(void)
-{
-        int idx;
-
-        for (idx = 0; idx < ARRAY_SIZE(ext_int_hash); idx++)
-                INIT_LIST_HEAD(&ext_int_hash[idx]);
-}
-
 static inline int ext_hash(u16 code)
 {
         return (code + (code >> 9)) & 0xff;
@@ -234,20 +251,13 @@ int unregister_external_interrupt(u16 code, ext_int_handler_t handler)
 }
 EXPORT_SYMBOL(unregister_external_interrupt);
 
-void __irq_entry do_extint(struct pt_regs *regs)
+static irqreturn_t do_ext_interrupt(int irq, void *dummy)
 {
+        struct pt_regs *regs = get_irq_regs();
         struct ext_code ext_code;
-        struct pt_regs *old_regs;
         struct ext_int_info *p;
         int index;
 
-        old_regs = set_irq_regs(regs);
-        irq_enter();
-        if (S390_lowcore.int_clock >= S390_lowcore.clock_comparator) {
-                /* Serve timer interrupts first. */
-                clock_comparator_work();
-        }
-        kstat_incr_irqs_this_cpu(EXTERNAL_INTERRUPT, NULL);
         ext_code = *(struct ext_code *) &regs->int_code;
         if (ext_code.code != 0x1004)
                 __get_cpu_var(s390_idle).nohz_delay = 1;
@@ -259,13 +269,25 @@ void __irq_entry do_extint(struct pt_regs *regs)
                         p->handler(ext_code, regs->int_parm,
                                    regs->int_parm_long);
         rcu_read_unlock();
-        irq_exit();
-        set_irq_regs(old_regs);
+
+        return IRQ_HANDLED;
 }
 
-void __init init_IRQ(void)
+static struct irqaction external_interrupt = {
+        .name    = "EXT",
+        .handler = do_ext_interrupt,
+};
+
+void __init init_ext_interrupts(void)
 {
-        init_external_interrupts();
+        int idx;
+
+        for (idx = 0; idx < ARRAY_SIZE(ext_int_hash); idx++)
+                INIT_LIST_HEAD(&ext_int_hash[idx]);
+
+        irq_set_chip_and_handler(EXT_INTERRUPT,
+                                 &dummy_irq_chip, handle_percpu_irq);
+        setup_irq(EXT_INTERRUPT, &external_interrupt);
 }
 
 static DEFINE_SPINLOCK(sc_irq_lock);
@@ -313,69 +335,3 @@ void measurement_alert_subclass_unregister(void)
         spin_unlock(&ma_subclass_lock);
 }
 EXPORT_SYMBOL(measurement_alert_subclass_unregister);
-
-#ifdef CONFIG_SMP
-void synchronize_irq(unsigned int irq)
-{
-        /*
-         * Not needed, the handler is protected by a lock and IRQs that occur
-         * after the handler is deleted are just NOPs.
-         */
-}
-EXPORT_SYMBOL_GPL(synchronize_irq);
-#endif
-
-#ifndef CONFIG_PCI
-
-/* Only PCI devices have dynamically-defined IRQ handlers */
-
-int request_irq(unsigned int irq, irq_handler_t handler,
-                unsigned long irqflags, const char *devname, void *dev_id)
-{
-        return -EINVAL;
-}
-EXPORT_SYMBOL_GPL(request_irq);
-
-void free_irq(unsigned int irq, void *dev_id)
-{
-        WARN_ON(1);
-}
-EXPORT_SYMBOL_GPL(free_irq);
-
-void enable_irq(unsigned int irq)
-{
-        WARN_ON(1);
-}
-EXPORT_SYMBOL_GPL(enable_irq);
-
-void disable_irq(unsigned int irq)
-{
-        WARN_ON(1);
-}
-EXPORT_SYMBOL_GPL(disable_irq);
-
-#endif /* !CONFIG_PCI */
-
-void disable_irq_nosync(unsigned int irq)
-{
-        disable_irq(irq);
-}
-EXPORT_SYMBOL_GPL(disable_irq_nosync);
-
-unsigned long probe_irq_on(void)
-{
-        return 0;
-}
-EXPORT_SYMBOL_GPL(probe_irq_on);
-
-int probe_irq_off(unsigned long val)
-{
-        return 0;
-}
-EXPORT_SYMBOL_GPL(probe_irq_off);
-
-unsigned int probe_irq_mask(unsigned long val)
-{
-        return val;
-}
-EXPORT_SYMBOL_GPL(probe_irq_mask);
diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c
index 3388b2b2a07d..adbbe7f1cb0d 100644
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -105,14 +105,31 @@ static int __kprobes get_fixup_type(kprobe_opcode_t *insn)
                 fixup |= FIXUP_RETURN_REGISTER;
                 break;
         case 0xeb:
-                if ((insn[2] & 0xff) == 0x44 || /* bxhg  */
-                    (insn[2] & 0xff) == 0x45)   /* bxleg */
+                switch (insn[2] & 0xff) {
+                case 0x44: /* bxhg  */
+                case 0x45: /* bxleg */
                         fixup = FIXUP_BRANCH_NOT_TAKEN;
+                        break;
+                }
                 break;
         case 0xe3:      /* bctg */
                 if ((insn[2] & 0xff) == 0x46)
                         fixup = FIXUP_BRANCH_NOT_TAKEN;
                 break;
+        case 0xec:
+                switch (insn[2] & 0xff) {
+                case 0xe5: /* clgrb */
+                case 0xe6: /* cgrb  */
+                case 0xf6: /* crb   */
+                case 0xf7: /* clrb  */
+                case 0xfc: /* cgib  */
+                case 0xfd: /* cglib */
+                case 0xfe: /* cib   */
+                case 0xff: /* clib  */
+                        fixup = FIXUP_BRANCH_NOT_TAKEN;
+                        break;
+                }
+                break;
         }
         return fixup;
 }
diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
index 504175ebf8b0..c4c033819879 100644
--- a/arch/s390/kernel/nmi.c
+++ b/arch/s390/kernel/nmi.c
@@ -214,10 +214,7 @@ static int notrace s390_revalidate_registers(struct mci *mci)
                         : "0", "cc");
 #endif
         /* Revalidate clock comparator register */
-        if (S390_lowcore.clock_comparator == -1)
-                set_clock_comparator(S390_lowcore.mcck_clock);
-        else
-                set_clock_comparator(S390_lowcore.clock_comparator);
+        set_clock_comparator(S390_lowcore.clock_comparator);
         /* Check if old PSW is valid */
         if (!mci->wp)
                 /*
diff --git a/arch/s390/kernel/perf_event.c b/arch/s390/kernel/perf_event.c
index a6fc037671b1..500aa1029bcb 100644
--- a/arch/s390/kernel/perf_event.c
+++ b/arch/s390/kernel/perf_event.c
@@ -52,12 +52,13 @@ static struct kvm_s390_sie_block *sie_block(struct pt_regs *regs)
 
 static bool is_in_guest(struct pt_regs *regs)
 {
-        unsigned long ip = instruction_pointer(regs);
-
         if (user_mode(regs))
                 return false;
-
-        return ip == (unsigned long) &sie_exit;
+#if defined(CONFIG_KVM) || defined(CONFIG_KVM_MODULE)
+        return instruction_pointer(regs) == (unsigned long) &sie_exit;
+#else
+        return false;
+#endif
 }
 
 static unsigned long guest_is_user_mode(struct pt_regs *regs)
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 2bc3eddae34a..c5dbb335716d 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -71,6 +71,7 @@ void arch_cpu_idle(void)
         }
         /* Halt the cpu and keep track of cpu time accounting. */
         vtime_stop_cpu();
+        local_irq_enable();
 }
 
 void arch_cpu_idle_exit(void)
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index e9fadb04e3c6..9556905bd3ce 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -60,11 +60,11 @@ void update_cr_regs(struct task_struct *task)
 
                 __ctl_store(cr, 0, 2);
                 cr_new[1] = cr[1];
-                /* Set or clear transaction execution TXC/PIFO bits 8 and 9. */
+                /* Set or clear transaction execution TXC bit 8. */
                 if (task->thread.per_flags & PER_FLAG_NO_TE)
-                        cr_new[0] = cr[0] & ~(3UL << 54);
+                        cr_new[0] = cr[0] & ~(1UL << 55);
                 else
-                        cr_new[0] = cr[0] | (3UL << 54);
+                        cr_new[0] = cr[0] | (1UL << 55);
                 /* Set or clear transaction execution TDC bits 62 and 63. */
                 cr_new[2] = cr[2] & ~3UL;
                 if (task->thread.per_flags & PER_FLAG_TE_ABORT_RAND) {
@@ -1299,7 +1299,7 @@ int regs_query_register_offset(const char *name)
 
         if (!name || *name != 'r')
                 return -EINVAL;
-        if (strict_strtoul(name + 1, 10, &offset))
+        if (kstrtoul(name + 1, 10, &offset))
                 return -EINVAL;
         if (offset >= NUM_GPRS)
                 return -EINVAL;
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 497451ec5e26..aeed8a61fa0d 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -994,6 +994,7 @@ static void __init setup_hwcaps(void)
                 strcpy(elf_platform, "z196");
                 break;
         case 0x2827:
+        case 0x2828:
                 strcpy(elf_platform, "zEC12");
                 break;
         }
diff --git a/arch/s390/kernel/suspend.c b/arch/s390/kernel/suspend.c
index c479d2f9605b..737bff38e3ee 100644
--- a/arch/s390/kernel/suspend.c
+++ b/arch/s390/kernel/suspend.c
@@ -10,6 +10,9 @@
 #include <linux/suspend.h>
 #include <linux/mm.h>
 #include <asm/ctl_reg.h>
+#include <asm/ipl.h>
+#include <asm/cio.h>
+#include <asm/pci.h>
 
 /*
  * References to section boundaries
@@ -211,3 +214,11 @@ void restore_processor_state(void)
         __ctl_set_bit(0,28);
         local_mcck_enable();
 }
+
+/* Called at the end of swsusp_arch_resume */
+void s390_early_resume(void)
+{
+        lgr_info_log();
+        channel_subsystem_reinit();
+        zpci_rescan();
+}
diff --git a/arch/s390/kernel/swsusp_asm64.S b/arch/s390/kernel/swsusp_asm64.S
index c487be4cfc81..6b09fdffbd2f 100644
--- a/arch/s390/kernel/swsusp_asm64.S
+++ b/arch/s390/kernel/swsusp_asm64.S
@@ -281,11 +281,8 @@ restore_registers:
         lghi    %r2,0
         brasl   %r14,arch_set_page_states
 
-        /* Log potential guest relocation */
-        brasl   %r14,lgr_info_log
-
-        /* Reinitialize the channel subsystem */
-        brasl   %r14,channel_subsystem_reinit
+        /* Call arch specific early resume code */
+        brasl   %r14,s390_early_resume
 
         /* Return 0 */
         lmg     %r6,%r15,STACK_FRAME_OVERHEAD + __SF_GPRS(%r15)
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index 876546b9cfa1..064c3082ab33 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -92,7 +92,6 @@ void clock_comparator_work(void)
         struct clock_event_device *cd;
 
         S390_lowcore.clock_comparator = -1ULL;
-        set_clock_comparator(S390_lowcore.clock_comparator);
         cd = &__get_cpu_var(comparators);
         cd->event_handler(cd);
 }
diff --git a/arch/s390/kernel/vdso.c b/arch/s390/kernel/vdso.c
index d7776281cb60..05d75c413137 100644
--- a/arch/s390/kernel/vdso.c
+++ b/arch/s390/kernel/vdso.c
@@ -63,7 +63,7 @@ static int __init vdso_setup(char *s)
         else if (strncmp(s, "off", 4) == 0)
                 vdso_enabled = 0;
         else {
-                rc = strict_strtoul(s, 0, &val);
+                rc = kstrtoul(s, 0, &val);
                 vdso_enabled = rc ? 0 : !!val;
         }
         return !rc;
@@ -113,11 +113,11 @@ int vdso_alloc_per_cpu(struct _lowcore *lowcore)
 
         clear_table((unsigned long *) segment_table, _SEGMENT_ENTRY_EMPTY,
                     PAGE_SIZE << SEGMENT_ORDER);
-        clear_table((unsigned long *) page_table, _PAGE_TYPE_EMPTY,
+        clear_table((unsigned long *) page_table, _PAGE_INVALID,
                     256*sizeof(unsigned long));
 
         *(unsigned long *) segment_table = _SEGMENT_ENTRY + page_table;
-        *(unsigned long *) page_table = _PAGE_RO + page_frame;
+        *(unsigned long *) page_table = _PAGE_PROTECT + page_frame;
 
         psal = (u32 *) (page_table + 256*sizeof(unsigned long));
         aste = psal + 32;
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index 9b9c1b78ec67..abcfab55f99b 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -19,6 +19,7 @@
 #include <asm/irq_regs.h>
 #include <asm/cputime.h>
 #include <asm/vtimer.h>
+#include <asm/vtime.h>
 #include <asm/irq.h>
 #include "entry.h"
 
diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c
index 3074475c8ae0..3a74d8af0d69 100644
--- a/arch/s390/kvm/diag.c
+++ b/arch/s390/kvm/diag.c
@@ -119,12 +119,21 @@ static int __diag_virtio_hypercall(struct kvm_vcpu *vcpu)
          * The layout is as follows:
          * - gpr 2 contains the subchannel id (passed as addr)
          * - gpr 3 contains the virtqueue index (passed as datamatch)
+         * - gpr 4 contains the index on the bus (optionally)
          */
-        ret = kvm_io_bus_write(vcpu->kvm, KVM_VIRTIO_CCW_NOTIFY_BUS,
-                                vcpu->run->s.regs.gprs[2],
-                                8, &vcpu->run->s.regs.gprs[3]);
+        ret = kvm_io_bus_write_cookie(vcpu->kvm, KVM_VIRTIO_CCW_NOTIFY_BUS,
+                                      vcpu->run->s.regs.gprs[2],
+                                      8, &vcpu->run->s.regs.gprs[3],
+                                      vcpu->run->s.regs.gprs[4]);
         srcu_read_unlock(&vcpu->kvm->srcu, idx);
-        /* kvm_io_bus_write returns -EOPNOTSUPP if it found no match. */
+
+        /*
+         * Return cookie in gpr 2, but don't overwrite the register if the
+         * diagnose will be handled by userspace.
+         */
+        if (ret != -EOPNOTSUPP)
+                vcpu->run->s.regs.gprs[2] = ret;
+        /* kvm_io_bus_write_cookie returns -EOPNOTSUPP if it found no match. */
         return ret < 0 ? ret : 0;
 }
 
diff --git a/arch/s390/kvm/gaccess.h b/arch/s390/kvm/gaccess.h
index 302e0e52b009..99d789e8a018 100644
--- a/arch/s390/kvm/gaccess.h
+++ b/arch/s390/kvm/gaccess.h
@@ -42,9 +42,11 @@ static inline void __user *__gptr_to_uptr(struct kvm_vcpu *vcpu,
 ({                                                              \
         __typeof__(gptr) __uptr = __gptr_to_uptr(vcpu, gptr, 1);\
         int __mask = sizeof(__typeof__(*(gptr))) - 1;           \
-        int __ret = PTR_RET((void __force *)__uptr);            \
+        int __ret;                                              \
                                                                 \
-        if (!__ret) {                                           \
+        if (IS_ERR((void __force *)__uptr)) {                   \
+                __ret = PTR_ERR((void __force *)__uptr);        \
+        } else {                                                \
                 BUG_ON((unsigned long)__uptr & __mask);         \
                 __ret = get_user(x, __uptr);                    \
         }                                                       \
@@ -55,9 +57,11 @@ static inline void __user *__gptr_to_uptr(struct kvm_vcpu *vcpu,
 ({                                                              \
         __typeof__(gptr) __uptr = __gptr_to_uptr(vcpu, gptr, 1);\
         int __mask = sizeof(__typeof__(*(gptr))) - 1;           \
-        int __ret = PTR_RET((void __force *)__uptr);            \
+        int __ret;                                              \
                                                                 \
-        if (!__ret) {                                           \
+        if (IS_ERR((void __force *)__uptr)) {                   \
+                __ret = PTR_ERR((void __force *)__uptr);        \
+        } else {                                                \
                 BUG_ON((unsigned long)__uptr & __mask);         \
                 __ret = put_user(x, __uptr);                    \
         }                                                       \
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index ba694d2ba51e..776dafe918db 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -28,6 +28,7 @@
 #include <asm/pgtable.h>
 #include <asm/nmi.h>
 #include <asm/switch_to.h>
+#include <asm/facility.h>
 #include <asm/sclp.h>
 #include "kvm-s390.h"
 #include "gaccess.h"
@@ -84,9 +85,15 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
         { NULL }
 };
 
-static unsigned long long *facilities;
+unsigned long *vfacilities;
 static struct gmap_notifier gmap_notifier;
 
+/* test availability of vfacility */
+static inline int test_vfacility(unsigned long nr)
+{
+        return __test_facility(nr, (void *) vfacilities);
+}
+
 /* Section: not file related */
 int kvm_arch_hardware_enable(void *garbage)
 {
@@ -387,7 +394,7 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
         vcpu->arch.sie_block->ecb   = 6;
         vcpu->arch.sie_block->ecb2  = 8;
         vcpu->arch.sie_block->eca   = 0xC1002001U;
-        vcpu->arch.sie_block->fac   = (int) (long) facilities;
+        vcpu->arch.sie_block->fac   = (int) (long) vfacilities;
         hrtimer_init(&vcpu->arch.ckc_timer, CLOCK_REALTIME, HRTIMER_MODE_ABS);
         tasklet_init(&vcpu->arch.tasklet, kvm_s390_tasklet,
                      (unsigned long) vcpu);
@@ -702,14 +709,25 @@ static int __vcpu_run(struct kvm_vcpu *vcpu)
                 return rc;
 
         vcpu->arch.sie_block->icptcode = 0;
-        preempt_disable();
-        kvm_guest_enter();
-        preempt_enable();
         VCPU_EVENT(vcpu, 6, "entering sie flags %x",
                    atomic_read(&vcpu->arch.sie_block->cpuflags));
         trace_kvm_s390_sie_enter(vcpu,
                                  atomic_read(&vcpu->arch.sie_block->cpuflags));
+
+        /*
+         * As PF_VCPU will be used in fault handler, between guest_enter
+         * and guest_exit should be no uaccess.
+         */
+        preempt_disable();
+        kvm_guest_enter();
+        preempt_enable();
         rc = sie64a(vcpu->arch.sie_block, vcpu->run->s.regs.gprs);
+        kvm_guest_exit();
+
+        VCPU_EVENT(vcpu, 6, "exit sie icptcode %d",
+                   vcpu->arch.sie_block->icptcode);
+        trace_kvm_s390_sie_exit(vcpu, vcpu->arch.sie_block->icptcode);
+
         if (rc > 0)
                 rc = 0;
         if (rc < 0) {
@@ -721,10 +739,6 @@ static int __vcpu_run(struct kvm_vcpu *vcpu)
                         rc = kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
                 }
         }
-        VCPU_EVENT(vcpu, 6, "exit sie icptcode %d",
-                   vcpu->arch.sie_block->icptcode);
-        trace_kvm_s390_sie_exit(vcpu, vcpu->arch.sie_block->icptcode);
-        kvm_guest_exit();
 
         memcpy(&vcpu->run->s.regs.gprs[14], &vcpu->arch.sie_block->gg14, 16);
         return rc;
@@ -1056,6 +1070,10 @@ int kvm_arch_create_memslot(struct kvm_memory_slot *slot, unsigned long npages)
         return 0;
 }
 
+void kvm_arch_memslots_updated(struct kvm *kvm)
+{
+}
+
 /* Section: memory related */
 int kvm_arch_prepare_memory_region(struct kvm *kvm,
                                    struct kvm_memory_slot *memslot,
@@ -1122,20 +1140,20 @@ static int __init kvm_s390_init(void)
          * to hold the maximum amount of facilities. On the other hand, we
          * only set facilities that are known to work in KVM.
          */
-        facilities = (unsigned long long *) get_zeroed_page(GFP_KERNEL|GFP_DMA);
-        if (!facilities) {
+        vfacilities = (unsigned long *) get_zeroed_page(GFP_KERNEL|GFP_DMA);
+        if (!vfacilities) {
                 kvm_exit();
                 return -ENOMEM;
         }
-        memcpy(facilities, S390_lowcore.stfle_fac_list, 16);
-        facilities[0] &= 0xff82fff3f47c0000ULL;
-        facilities[1] &= 0x001c000000000000ULL;
+        memcpy(vfacilities, S390_lowcore.stfle_fac_list, 16);
+        vfacilities[0] &= 0xff82fff3f47c0000UL;
+        vfacilities[1] &= 0x001c000000000000UL;
         return 0;
 }
 
 static void __exit kvm_s390_exit(void)
 {
-        free_page((unsigned long) facilities);
+        free_page((unsigned long) vfacilities);
         kvm_exit();
 }
 
diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h
index 028ca9fd2158..dc99f1ca4267 100644
--- a/arch/s390/kvm/kvm-s390.h
+++ b/arch/s390/kvm/kvm-s390.h
@@ -24,6 +24,9 @@
 
 typedef int (*intercept_handler_t)(struct kvm_vcpu *vcpu);
 
+/* declare vfacilities extern */
+extern unsigned long *vfacilities;
+
 /* negativ values are error codes, positive values for internal conditions */
 #define SIE_INTERCEPT_RERUNVCPU         (1<<0)
 #define SIE_INTERCEPT_UCONTROL          (1<<1)
@@ -112,6 +115,13 @@ static inline u64 kvm_s390_get_base_disp_rs(struct kvm_vcpu *vcpu)
         return (base2 ? vcpu->run->s.regs.gprs[base2] : 0) + disp2;
 }
 
+/* Set the condition code in the guest program status word */
+static inline void kvm_s390_set_psw_cc(struct kvm_vcpu *vcpu, unsigned long cc)
+{
+        vcpu->arch.sie_block->gpsw.mask &= ~(3UL << 44);
+        vcpu->arch.sie_block->gpsw.mask |= cc << 44;
+}
+
 int kvm_s390_handle_wait(struct kvm_vcpu *vcpu);
 enum hrtimer_restart kvm_s390_idle_wakeup(struct hrtimer *timer);
 void kvm_s390_tasklet(unsigned long parm);
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index 0da3e6eb6be6..59200ee275e5 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -16,6 +16,7 @@
 #include <linux/errno.h>
 #include <linux/compat.h>
 #include <asm/asm-offsets.h>
+#include <asm/facility.h>
 #include <asm/current.h>
 #include <asm/debug.h>
 #include <asm/ebcdic.h>
@@ -163,8 +164,7 @@ static int handle_tpi(struct kvm_vcpu *vcpu)
         kfree(inti);
 no_interrupt:
         /* Set condition code and we're done. */
-        vcpu->arch.sie_block->gpsw.mask &= ~(3ul << 44);
-        vcpu->arch.sie_block->gpsw.mask |= (cc & 3ul) << 44;
+        kvm_s390_set_psw_cc(vcpu, cc);
         return 0;
 }
 
@@ -219,15 +219,13 @@ static int handle_io_inst(struct kvm_vcpu *vcpu)
                  * Set condition code 3 to stop the guest from issueing channel
                  * I/O instructions.
                  */
-                vcpu->arch.sie_block->gpsw.mask &= ~(3ul << 44);
-                vcpu->arch.sie_block->gpsw.mask |= (3 & 3ul) << 44;
+                kvm_s390_set_psw_cc(vcpu, 3);
                 return 0;
         }
 }
 
 static int handle_stfl(struct kvm_vcpu *vcpu)
 {
-        unsigned int facility_list;
         int rc;
 
         vcpu->stat.instruction_stfl++;
@@ -235,15 +233,13 @@ static int handle_stfl(struct kvm_vcpu *vcpu)
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
-        /* only pass the facility bits, which we can handle */
-        facility_list = S390_lowcore.stfl_fac_list & 0xff82fff3;
-
         rc = copy_to_guest(vcpu, offsetof(struct _lowcore, stfl_fac_list),
-                           &facility_list, sizeof(facility_list));
+                           vfacilities, 4);
         if (rc)
                 return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
-        VCPU_EVENT(vcpu, 5, "store facility list value %x", facility_list);
-        trace_kvm_s390_handle_stfl(vcpu, facility_list);
+        VCPU_EVENT(vcpu, 5, "store facility list value %x",
+                   *(unsigned int *) vfacilities);
+        trace_kvm_s390_handle_stfl(vcpu, *(unsigned int *) vfacilities);
         return 0;
 }
 
@@ -386,7 +382,7 @@ static int handle_stsi(struct kvm_vcpu *vcpu)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
         if (fc > 3) {
-                vcpu->arch.sie_block->gpsw.mask |= 3ul << 44;     /* cc 3 */
+                kvm_s390_set_psw_cc(vcpu, 3);
                 return 0;
         }
 
@@ -396,7 +392,7 @@ static int handle_stsi(struct kvm_vcpu *vcpu)
 
         if (fc == 0) {
                 vcpu->run->s.regs.gprs[0] = 3 << 28;
-                vcpu->arch.sie_block->gpsw.mask &= ~(3ul << 44);  /* cc 0 */
+                kvm_s390_set_psw_cc(vcpu, 0);
                 return 0;
         }
 
@@ -430,12 +426,11 @@ static int handle_stsi(struct kvm_vcpu *vcpu)
         }
         trace_kvm_s390_handle_stsi(vcpu, fc, sel1, sel2, operand2);
         free_page(mem);
-        vcpu->arch.sie_block->gpsw.mask &= ~(3ul << 44);
+        kvm_s390_set_psw_cc(vcpu, 0);
         vcpu->run->s.regs.gprs[0] = 0;
         return 0;
 out_no_data:
-        /* condition code 3 */
-        vcpu->arch.sie_block->gpsw.mask |= 3ul << 44;
+        kvm_s390_set_psw_cc(vcpu, 3);
 out_exception:
         free_page(mem);
         return rc;
@@ -493,12 +488,12 @@ static int handle_epsw(struct kvm_vcpu *vcpu)
         kvm_s390_get_regs_rre(vcpu, &reg1, &reg2);
 
         /* This basically extracts the mask half of the psw. */
-        vcpu->run->s.regs.gprs[reg1] &= 0xffffffff00000000;
+        vcpu->run->s.regs.gprs[reg1] &= 0xffffffff00000000UL;
         vcpu->run->s.regs.gprs[reg1] |= vcpu->arch.sie_block->gpsw.mask >> 32;
         if (reg2) {
-                vcpu->run->s.regs.gprs[reg2] &= 0xffffffff00000000;
+                vcpu->run->s.regs.gprs[reg2] &= 0xffffffff00000000UL;
                 vcpu->run->s.regs.gprs[reg2] |=
-                        vcpu->arch.sie_block->gpsw.mask & 0x00000000ffffffff;
+                        vcpu->arch.sie_block->gpsw.mask & 0x00000000ffffffffUL;
         }
         return 0;
 }
@@ -532,8 +527,7 @@ static int handle_pfmf(struct kvm_vcpu *vcpu)
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 
         /* Only provide non-quiescing support if the host supports it */
-        if (vcpu->run->s.regs.gprs[reg1] & PFMF_NQ &&
-            S390_lowcore.stfl_fac_list & 0x00020000)
+        if (vcpu->run->s.regs.gprs[reg1] & PFMF_NQ && !test_facility(14))
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 
         /* No support for conditional-SSKE */
diff --git a/arch/s390/lib/delay.c b/arch/s390/lib/delay.c
index c61b9fad43cc..57c87d7d7ede 100644
--- a/arch/s390/lib/delay.c
+++ b/arch/s390/lib/delay.c
@@ -44,7 +44,6 @@ static void __udelay_disabled(unsigned long long usecs)
         do {
                 set_clock_comparator(end);
                 vtime_stop_cpu();
-                local_irq_disable();
         } while (get_tod_clock() < end);
         lockdep_on();
         __ctl_load(cr0, 0, 0);
@@ -64,7 +63,6 @@ static void __udelay_enabled(unsigned long long usecs)
                         set_clock_comparator(end);
                 }
                 vtime_stop_cpu();
-                local_irq_disable();
                 if (clock_saved)
                         local_tick_enable(clock_saved);
         } while (get_tod_clock() < end);
diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
index 50ea137a2d3c..1694d738b175 100644
--- a/arch/s390/lib/uaccess_pt.c
+++ b/arch/s390/lib/uaccess_pt.c
@@ -86,28 +86,28 @@ static unsigned long follow_table(struct mm_struct *mm,
         switch (mm->context.asce_bits & _ASCE_TYPE_MASK) {
         case _ASCE_TYPE_REGION1:
                 table = table + ((address >> 53) & 0x7ff);
-                if (unlikely(*table & _REGION_ENTRY_INV))
+                if (unlikely(*table & _REGION_ENTRY_INVALID))
                         return -0x39UL;
                 table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                 /* fallthrough */
         case _ASCE_TYPE_REGION2:
                 table = table + ((address >> 42) & 0x7ff);
-                if (unlikely(*table & _REGION_ENTRY_INV))
+                if (unlikely(*table & _REGION_ENTRY_INVALID))
                         return -0x3aUL;
                 table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                 /* fallthrough */
         case _ASCE_TYPE_REGION3:
                 table = table + ((address >> 31) & 0x7ff);
-                if (unlikely(*table & _REGION_ENTRY_INV))
+                if (unlikely(*table & _REGION_ENTRY_INVALID))
                         return -0x3bUL;
                 table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                 /* fallthrough */
         case _ASCE_TYPE_SEGMENT:
                 table = table + ((address >> 20) & 0x7ff);
-                if (unlikely(*table & _SEGMENT_ENTRY_INV))
+                if (unlikely(*table & _SEGMENT_ENTRY_INVALID))
                         return -0x10UL;
                 if (unlikely(*table & _SEGMENT_ENTRY_LARGE)) {
-                        if (write && (*table & _SEGMENT_ENTRY_RO))
+                        if (write && (*table & _SEGMENT_ENTRY_PROTECT))
                                 return -0x04UL;
                         return (*table & _SEGMENT_ENTRY_ORIGIN_LARGE) +
                                 (address & ~_SEGMENT_ENTRY_ORIGIN_LARGE);
@@ -117,7 +117,7 @@ static unsigned long follow_table(struct mm_struct *mm,
         table = table + ((address >> 12) & 0xff);
         if (unlikely(*table & _PAGE_INVALID))
                 return -0x11UL;
-        if (write && (*table & _PAGE_RO))
+        if (write && (*table & _PAGE_PROTECT))
                 return -0x04UL;
         return (*table & PAGE_MASK) + (address & ~PAGE_MASK);
 }
@@ -130,13 +130,13 @@ static unsigned long follow_table(struct mm_struct *mm,
         unsigned long *table = (unsigned long *)__pa(mm->pgd);
 
         table = table + ((address >> 20) & 0x7ff);
-        if (unlikely(*table & _SEGMENT_ENTRY_INV))
+        if (unlikely(*table & _SEGMENT_ENTRY_INVALID))
                 return -0x10UL;
         table = (unsigned long *)(*table & _SEGMENT_ENTRY_ORIGIN);
         table = table + ((address >> 12) & 0xff);
         if (unlikely(*table & _PAGE_INVALID))
                 return -0x11UL;
-        if (write && (*table & _PAGE_RO))
+        if (write && (*table & _PAGE_PROTECT))
                 return -0x04UL;
         return (*table & PAGE_MASK) + (address & ~PAGE_MASK);
 }
diff --git a/arch/s390/mm/dump_pagetables.c b/arch/s390/mm/dump_pagetables.c
index 3ad65b04ac15..46d517c3c763 100644
--- a/arch/s390/mm/dump_pagetables.c
+++ b/arch/s390/mm/dump_pagetables.c
@@ -53,7 +53,7 @@ static void print_prot(struct seq_file *m, unsigned int pr, int level)
                 seq_printf(m, "I\n");
                 return;
         }
-        seq_printf(m, "%s", pr & _PAGE_RO ? "RO " : "RW ");
+        seq_printf(m, "%s", pr & _PAGE_PROTECT ? "RO " : "RW ");
         seq_printf(m, "%s", pr & _PAGE_CO ? "CO " : "   ");
         seq_putc(m, '\n');
 }
@@ -105,12 +105,12 @@ static void note_page(struct seq_file *m, struct pg_state *st,
 }
 
 /*
- * The actual page table walker functions. In order to keep the implementation
- * of print_prot() short, we only check and pass _PAGE_INVALID and _PAGE_RO
- * flags to note_page() if a region, segment or page table entry is invalid or
- * read-only.
- * After all it's just a hint that the current level being walked contains an
- * invalid or read-only entry.
+ * The actual page table walker functions. In order to keep the
+ * implementation of print_prot() short, we only check and pass
+ * _PAGE_INVALID and _PAGE_PROTECT flags to note_page() if a region,
+ * segment or page table entry is invalid or read-only.
+ * After all it's just a hint that the current level being walked
+ * contains an invalid or read-only entry.
  */
 static void walk_pte_level(struct seq_file *m, struct pg_state *st,
                            pmd_t *pmd, unsigned long addr)
@@ -122,14 +122,14 @@ static void walk_pte_level(struct seq_file *m, struct pg_state *st,
         for (i = 0; i < PTRS_PER_PTE && addr < max_addr; i++) {
                 st->current_address = addr;
                 pte = pte_offset_kernel(pmd, addr);
-                prot = pte_val(*pte) & (_PAGE_RO | _PAGE_INVALID);
+                prot = pte_val(*pte) & (_PAGE_PROTECT | _PAGE_INVALID);
                 note_page(m, st, prot, 4);
                 addr += PAGE_SIZE;
         }
 }
 
 #ifdef CONFIG_64BIT
-#define _PMD_PROT_MASK (_SEGMENT_ENTRY_RO | _SEGMENT_ENTRY_CO)
+#define _PMD_PROT_MASK (_SEGMENT_ENTRY_PROTECT | _SEGMENT_ENTRY_CO)
 #else
 #define _PMD_PROT_MASK 0
 #endif
diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c
index 1f5315d1215c..5d758db27bdc 100644
--- a/arch/s390/mm/gup.c
+++ b/arch/s390/mm/gup.c
@@ -24,7 +24,7 @@ static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
         pte_t *ptep, pte;
         struct page *page;
 
-        mask = (write ? _PAGE_RO : 0) | _PAGE_INVALID | _PAGE_SPECIAL;
+        mask = (write ? _PAGE_PROTECT : 0) | _PAGE_INVALID | _PAGE_SPECIAL;
 
         ptep = ((pte_t *) pmd_deref(pmd)) + pte_index(addr);
         do {
@@ -55,8 +55,8 @@ static inline int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
         struct page *head, *page, *tail;
         int refs;
 
-        result = write ? 0 : _SEGMENT_ENTRY_RO;
-        mask = result | _SEGMENT_ENTRY_INV;
+        result = write ? 0 : _SEGMENT_ENTRY_PROTECT;
+        mask = result | _SEGMENT_ENTRY_INVALID;
         if ((pmd_val(pmd) & mask) != result)
                 return 0;
         VM_BUG_ON(!pfn_valid(pmd_val(pmd) >> PAGE_SHIFT));
diff --git a/arch/s390/mm/hugetlbpage.c b/arch/s390/mm/hugetlbpage.c
index 121089d57802..248445f92604 100644
--- a/arch/s390/mm/hugetlbpage.c
+++ b/arch/s390/mm/hugetlbpage.c
@@ -8,21 +8,127 @@
 #include <linux/mm.h>
 #include <linux/hugetlb.h>
 
+static inline pmd_t __pte_to_pmd(pte_t pte)
+{
+        int none, young, prot;
+        pmd_t pmd;
+
+        /*
+         * Convert encoding               pte bits        pmd bits
+         *                              .IR...wrdytp    ..R...I...y.
+         * empty                        .10...000000 -> ..0...1...0.
+         * prot-none, clean, old        .11...000001 -> ..0...1...1.
+         * prot-none, clean, young      .11...000101 -> ..1...1...1.
+         * prot-none, dirty, old        .10...001001 -> ..0...1...1.
+         * prot-none, dirty, young      .10...001101 -> ..1...1...1.
+         * read-only, clean, old        .11...010001 -> ..1...1...0.
+         * read-only, clean, young      .01...010101 -> ..1...0...1.
+         * read-only, dirty, old        .11...011001 -> ..1...1...0.
+         * read-only, dirty, young      .01...011101 -> ..1...0...1.
+         * read-write, clean, old       .11...110001 -> ..0...1...0.
+         * read-write, clean, young     .01...110101 -> ..0...0...1.
+         * read-write, dirty, old       .10...111001 -> ..0...1...0.
+         * read-write, dirty, young     .00...111101 -> ..0...0...1.
+         * Huge ptes are dirty by definition, a clean pte is made dirty
+         * by the conversion.
+         */
+        if (pte_present(pte)) {
+                pmd_val(pmd) = pte_val(pte) & PAGE_MASK;
+                if (pte_val(pte) & _PAGE_INVALID)
+                        pmd_val(pmd) |= _SEGMENT_ENTRY_INVALID;
+                none = (pte_val(pte) & _PAGE_PRESENT) &&
+                        !(pte_val(pte) & _PAGE_READ) &&
+                        !(pte_val(pte) & _PAGE_WRITE);
+                prot = (pte_val(pte) & _PAGE_PROTECT) &&
+                        !(pte_val(pte) & _PAGE_WRITE);
+                young = pte_val(pte) & _PAGE_YOUNG;
+                if (none || young)
+                        pmd_val(pmd) |= _SEGMENT_ENTRY_YOUNG;
+                if (prot || (none && young))
+                        pmd_val(pmd) |= _SEGMENT_ENTRY_PROTECT;
+        } else
+                pmd_val(pmd) = _SEGMENT_ENTRY_INVALID;
+        return pmd;
+}
+
+static inline pte_t __pmd_to_pte(pmd_t pmd)
+{
+        pte_t pte;
+
+        /*
+         * Convert encoding       pmd bits        pte bits
+         *                      ..R...I...y.    .IR...wrdytp
+         * empty                ..0...1...0. -> .10...000000
+         * prot-none, old       ..0...1...1. -> .10...001001
+         * prot-none, young     ..1...1...1. -> .10...001101
+         * read-only, old       ..1...1...0. -> .11...011001
+         * read-only, young     ..1...0...1. -> .01...011101
+         * read-write, old      ..0...1...0. -> .10...111001
+         * read-write, young    ..0...0...1. -> .00...111101
+         * Huge ptes are dirty by definition
+         */
+        if (pmd_present(pmd)) {
+                pte_val(pte) = _PAGE_PRESENT | _PAGE_LARGE | _PAGE_DIRTY |
+                        (pmd_val(pmd) & PAGE_MASK);
+                if (pmd_val(pmd) & _SEGMENT_ENTRY_INVALID)
+                        pte_val(pte) |= _PAGE_INVALID;
+                if (pmd_prot_none(pmd)) {
+                        if (pmd_val(pmd) & _SEGMENT_ENTRY_PROTECT)
+                                pte_val(pte) |= _PAGE_YOUNG;
+                } else {
+                        pte_val(pte) |= _PAGE_READ;
+                        if (pmd_val(pmd) & _SEGMENT_ENTRY_PROTECT)
+                                pte_val(pte) |= _PAGE_PROTECT;
+                        else
+                                pte_val(pte) |= _PAGE_WRITE;
+                        if (pmd_val(pmd) & _SEGMENT_ENTRY_YOUNG)
+                                pte_val(pte) |= _PAGE_YOUNG;
+                }
+        } else
+                pte_val(pte) = _PAGE_INVALID;
+        return pte;
+}
 
 void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
-                                   pte_t *pteptr, pte_t pteval)
+                     pte_t *ptep, pte_t pte)
 {
-        pmd_t *pmdp = (pmd_t *) pteptr;
-        unsigned long mask;
+        pmd_t pmd;
 
+        pmd = __pte_to_pmd(pte);
         if (!MACHINE_HAS_HPAGE) {
-                pteptr = (pte_t *) pte_page(pteval)[1].index;
-                mask = pte_val(pteval) &
-                                (_SEGMENT_ENTRY_INV | _SEGMENT_ENTRY_RO);
-                pte_val(pteval) = (_SEGMENT_ENTRY + __pa(pteptr)) | mask;
+                pmd_val(pmd) &= ~_SEGMENT_ENTRY_ORIGIN;
+                pmd_val(pmd) |= pte_page(pte)[1].index;
+        } else
+                pmd_val(pmd) |= _SEGMENT_ENTRY_LARGE | _SEGMENT_ENTRY_CO;
+        *(pmd_t *) ptep = pmd;
+}
+
+pte_t huge_ptep_get(pte_t *ptep)
+{
+        unsigned long origin;
+        pmd_t pmd;
+
+        pmd = *(pmd_t *) ptep;
+        if (!MACHINE_HAS_HPAGE && pmd_present(pmd)) {
+                origin = pmd_val(pmd) & _SEGMENT_ENTRY_ORIGIN;
+                pmd_val(pmd) &= ~_SEGMENT_ENTRY_ORIGIN;
+                pmd_val(pmd) |= *(unsigned long *) origin;
         }
+        return __pmd_to_pte(pmd);
+}
 
-        pmd_val(*pmdp) = pte_val(pteval);
+pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
+                              unsigned long addr, pte_t *ptep)
+{
+        pmd_t *pmdp = (pmd_t *) ptep;
+        pte_t pte = huge_ptep_get(ptep);
+
+        if (MACHINE_HAS_IDTE)
+                __pmd_idte(addr, pmdp);
+        else
+                __pmd_csp(pmdp);
+        pmd_val(*pmdp) = _SEGMENT_ENTRY_EMPTY;
+        return pte;
 }
 
 int arch_prepare_hugepage(struct page *page)
@@ -58,7 +164,7 @@ void arch_release_hugepage(struct page *page)
         ptep = (pte_t *) page[1].index;
         if (!ptep)
                 return;
-        clear_table((unsigned long *) ptep, _PAGE_TYPE_EMPTY,
+        clear_table((unsigned long *) ptep, _PAGE_INVALID,
                     PTRS_PER_PTE * sizeof(pte_t));
         page_table_free(&init_mm, (unsigned long *) ptep);
         page[1].index = 0;
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index ce36ea80e4f9..ad446b0c55b6 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -69,6 +69,7 @@ static void __init setup_zero_pages(void)
                 order = 2;
                 break;
         case 0x2827:    /* zEC12 */
+        case 0x2828:    /* zEC12 */
         default:
                 order = 5;
                 break;
diff --git a/arch/s390/mm/pageattr.c b/arch/s390/mm/pageattr.c
index 80adfbf75065..990397420e6b 100644
--- a/arch/s390/mm/pageattr.c
+++ b/arch/s390/mm/pageattr.c
@@ -118,7 +118,7 @@ void kernel_map_pages(struct page *page, int numpages, int enable)
                 pte = pte_offset_kernel(pmd, address);
                 if (!enable) {
                         __ptep_ipte(address, pte);
-                        pte_val(*pte) = _PAGE_TYPE_EMPTY;
+                        pte_val(*pte) = _PAGE_INVALID;
                         continue;
                 }
                 pte_val(*pte) = __pa(address);
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index a8154a1a2c94..bf7c0dc64a76 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -161,7 +161,7 @@ static int gmap_unlink_segment(struct gmap *gmap, unsigned long *table)
         struct gmap_rmap *rmap;
         struct page *page;
 
-        if (*table & _SEGMENT_ENTRY_INV)
+        if (*table & _SEGMENT_ENTRY_INVALID)
                 return 0;
         page = pfn_to_page(*table >> PAGE_SHIFT);
         mp = (struct gmap_pgtable *) page->index;
@@ -172,7 +172,7 @@ static int gmap_unlink_segment(struct gmap *gmap, unsigned long *table)
                 kfree(rmap);
                 break;
         }
-        *table = _SEGMENT_ENTRY_INV | _SEGMENT_ENTRY_RO | mp->vmaddr;
+        *table = mp->vmaddr | _SEGMENT_ENTRY_INVALID | _SEGMENT_ENTRY_PROTECT;
         return 1;
 }
 
@@ -258,7 +258,7 @@ static int gmap_alloc_table(struct gmap *gmap,
                 return -ENOMEM;
         new = (unsigned long *) page_to_phys(page);
         crst_table_init(new, init);
-        if (*table & _REGION_ENTRY_INV) {
+        if (*table & _REGION_ENTRY_INVALID) {
                 list_add(&page->lru, &gmap->crst_list);
                 *table = (unsigned long) new | _REGION_ENTRY_LENGTH |
                         (*table & _REGION_ENTRY_TYPE_MASK);
@@ -292,22 +292,22 @@ int gmap_unmap_segment(struct gmap *gmap, unsigned long to, unsigned long len)
         for (off = 0; off < len; off += PMD_SIZE) {
                 /* Walk the guest addr space page table */
                 table = gmap->table + (((to + off) >> 53) & 0x7ff);
-                if (*table & _REGION_ENTRY_INV)
+                if (*table & _REGION_ENTRY_INVALID)
                         goto out;
                 table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                 table = table + (((to + off) >> 42) & 0x7ff);
-                if (*table & _REGION_ENTRY_INV)
+                if (*table & _REGION_ENTRY_INVALID)
                         goto out;
                 table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                 table = table + (((to + off) >> 31) & 0x7ff);
-                if (*table & _REGION_ENTRY_INV)
+                if (*table & _REGION_ENTRY_INVALID)
                         goto out;
                 table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                 table = table + (((to + off) >> 20) & 0x7ff);
 
                 /* Clear segment table entry in guest address space. */
                 flush |= gmap_unlink_segment(gmap, table);
-                *table = _SEGMENT_ENTRY_INV;
+                *table = _SEGMENT_ENTRY_INVALID;
         }
 out:
         spin_unlock(&gmap->mm->page_table_lock);
@@ -335,7 +335,7 @@ int gmap_map_segment(struct gmap *gmap, unsigned long from,
 
         if ((from | to | len) & (PMD_SIZE - 1))
                 return -EINVAL;
-        if (len == 0 || from + len > PGDIR_SIZE ||
+        if (len == 0 || from + len > TASK_MAX_SIZE ||
             from + len < from || to + len < to)
                 return -EINVAL;
 
@@ -345,17 +345,17 @@ int gmap_map_segment(struct gmap *gmap, unsigned long from,
         for (off = 0; off < len; off += PMD_SIZE) {
                 /* Walk the gmap address space page table */
                 table = gmap->table + (((to + off) >> 53) & 0x7ff);
-                if ((*table & _REGION_ENTRY_INV) &&
+                if ((*table & _REGION_ENTRY_INVALID) &&
                     gmap_alloc_table(gmap, table, _REGION2_ENTRY_EMPTY))
                         goto out_unmap;
                 table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                 table = table + (((to + off) >> 42) & 0x7ff);
-                if ((*table & _REGION_ENTRY_INV) &&
+                if ((*table & _REGION_ENTRY_INVALID) &&
                     gmap_alloc_table(gmap, table, _REGION3_ENTRY_EMPTY))
                         goto out_unmap;
                 table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                 table = table + (((to + off) >> 31) & 0x7ff);
-                if ((*table & _REGION_ENTRY_INV) &&
+                if ((*table & _REGION_ENTRY_INVALID) &&
                     gmap_alloc_table(gmap, table, _SEGMENT_ENTRY_EMPTY))
                         goto out_unmap;
                 table = (unsigned long *) (*table & _REGION_ENTRY_ORIGIN);
@@ -363,7 +363,8 @@ int gmap_map_segment(struct gmap *gmap, unsigned long from,
 
                 /* Store 'from' address in an invalid segment table entry. */
                 flush |= gmap_unlink_segment(gmap, table);
-                *table = _SEGMENT_ENTRY_INV | _SEGMENT_ENTRY_RO | (from + off);
+                *table =  (from + off) | (_SEGMENT_ENTRY_INVALID |
+                                          _SEGMENT_ENTRY_PROTECT);
         }
         spin_unlock(&gmap->mm->page_table_lock);
         up_read(&gmap->mm->mmap_sem);
@@ -384,15 +385,15 @@ static unsigned long *gmap_table_walk(unsigned long address, struct gmap *gmap)
         unsigned long *table;
 
         table = gmap->table + ((address >> 53) & 0x7ff);
-        if (unlikely(*table & _REGION_ENTRY_INV))
+        if (unlikely(*table & _REGION_ENTRY_INVALID))
                 return ERR_PTR(-EFAULT);
         table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
         table = table + ((address >> 42) & 0x7ff);
-        if (unlikely(*table & _REGION_ENTRY_INV))
+        if (unlikely(*table & _REGION_ENTRY_INVALID))
                 return ERR_PTR(-EFAULT);
         table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
         table = table + ((address >> 31) & 0x7ff);
-        if (unlikely(*table & _REGION_ENTRY_INV))
+        if (unlikely(*table & _REGION_ENTRY_INVALID))
                 return ERR_PTR(-EFAULT);
         table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
         table = table + ((address >> 20) & 0x7ff);
@@ -422,11 +423,11 @@ unsigned long __gmap_translate(unsigned long address, struct gmap *gmap)
                 return PTR_ERR(segment_ptr);
         /* Convert the gmap address to an mm address. */
         segment = *segment_ptr;
-        if (!(segment & _SEGMENT_ENTRY_INV)) {
+        if (!(segment & _SEGMENT_ENTRY_INVALID)) {
                 page = pfn_to_page(segment >> PAGE_SHIFT);
                 mp = (struct gmap_pgtable *) page->index;
                 return mp->vmaddr | (address & ~PMD_MASK);
-        } else if (segment & _SEGMENT_ENTRY_RO) {
+        } else if (segment & _SEGMENT_ENTRY_PROTECT) {
                 vmaddr = segment & _SEGMENT_ENTRY_ORIGIN;
                 return vmaddr | (address & ~PMD_MASK);
         }
@@ -517,8 +518,8 @@ static void gmap_disconnect_pgtable(struct mm_struct *mm, unsigned long *table)
         page = pfn_to_page(__pa(table) >> PAGE_SHIFT);
         mp = (struct gmap_pgtable *) page->index;
         list_for_each_entry_safe(rmap, next, &mp->mapper, list) {
-                *rmap->entry =
-                        _SEGMENT_ENTRY_INV | _SEGMENT_ENTRY_RO | mp->vmaddr;
+                *rmap->entry = mp->vmaddr | (_SEGMENT_ENTRY_INVALID |
+                                             _SEGMENT_ENTRY_PROTECT);
                 list_del(&rmap->list);
                 kfree(rmap);
                 flush = 1;
@@ -545,13 +546,13 @@ unsigned long __gmap_fault(unsigned long address, struct gmap *gmap)
         /* Convert the gmap address to an mm address. */
         while (1) {
                 segment = *segment_ptr;
-                if (!(segment & _SEGMENT_ENTRY_INV)) {
+                if (!(segment & _SEGMENT_ENTRY_INVALID)) {
                         /* Page table is present */
                         page = pfn_to_page(segment >> PAGE_SHIFT);
                         mp = (struct gmap_pgtable *) page->index;
                         return mp->vmaddr | (address & ~PMD_MASK);
                 }
-                if (!(segment & _SEGMENT_ENTRY_RO))
+                if (!(segment & _SEGMENT_ENTRY_PROTECT))
                         /* Nothing mapped in the gmap address space. */
                         break;
                 rc = gmap_connect_pgtable(address, segment, segment_ptr, gmap);
@@ -586,25 +587,25 @@ void gmap_discard(unsigned long from, unsigned long to, struct gmap *gmap)
         while (address < to) {
                 /* Walk the gmap address space page table */
                 table = gmap->table + ((address >> 53) & 0x7ff);
-                if (unlikely(*table & _REGION_ENTRY_INV)) {
+                if (unlikely(*table & _REGION_ENTRY_INVALID)) {
                         address = (address + PMD_SIZE) & PMD_MASK;
                         continue;
                 }
                 table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                 table = table + ((address >> 42) & 0x7ff);
-                if (unlikely(*table & _REGION_ENTRY_INV)) {
+                if (unlikely(*table & _REGION_ENTRY_INVALID)) {
                         address = (address + PMD_SIZE) & PMD_MASK;
                         continue;
                 }
                 table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                 table = table + ((address >> 31) & 0x7ff);
-                if (unlikely(*table & _REGION_ENTRY_INV)) {
+                if (unlikely(*table & _REGION_ENTRY_INVALID)) {
                         address = (address + PMD_SIZE) & PMD_MASK;
                         continue;
                 }
                 table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                 table = table + ((address >> 20) & 0x7ff);
-                if (unlikely(*table & _SEGMENT_ENTRY_INV)) {
+                if (unlikely(*table & _SEGMENT_ENTRY_INVALID)) {
                         address = (address + PMD_SIZE) & PMD_MASK;
                         continue;
                 }
@@ -687,7 +688,7 @@ int gmap_ipte_notify(struct gmap *gmap, unsigned long start, unsigned long len)
                         continue;
                 /* Set notification bit in the pgste of the pte */
                 entry = *ptep;
-                if ((pte_val(entry) & (_PAGE_INVALID | _PAGE_RO)) == 0) {
+                if ((pte_val(entry) & (_PAGE_INVALID | _PAGE_PROTECT)) == 0) {
                         pgste = pgste_get_lock(ptep);
                         pgste_val(pgste) |= PGSTE_IN_BIT;
                         pgste_set_unlock(ptep, pgste);
@@ -731,6 +732,11 @@ void gmap_do_ipte_notify(struct mm_struct *mm, unsigned long addr, pte_t *pte)
         spin_unlock(&gmap_notifier_lock);
 }
 
+static inline int page_table_with_pgste(struct page *page)
+{
+        return atomic_read(&page->_mapcount) == 0;
+}
+
 static inline unsigned long *page_table_alloc_pgste(struct mm_struct *mm,
                                                     unsigned long vmaddr)
 {
@@ -750,10 +756,11 @@ static inline unsigned long *page_table_alloc_pgste(struct mm_struct *mm,
         mp->vmaddr = vmaddr & PMD_MASK;
         INIT_LIST_HEAD(&mp->mapper);
         page->index = (unsigned long) mp;
-        atomic_set(&page->_mapcount, 3);
+        atomic_set(&page->_mapcount, 0);
         table = (unsigned long *) page_to_phys(page);
-        clear_table(table, _PAGE_TYPE_EMPTY, PAGE_SIZE/2);
-        clear_table(table + PTRS_PER_PTE, 0, PAGE_SIZE/2);
+        clear_table(table, _PAGE_INVALID, PAGE_SIZE/2);
+        clear_table(table + PTRS_PER_PTE, PGSTE_HR_BIT | PGSTE_HC_BIT,
+                    PAGE_SIZE/2);
         return table;
 }
 
@@ -791,26 +798,21 @@ int set_guest_storage_key(struct mm_struct *mm, unsigned long addr,
         pgste_val(new) |= (key & (_PAGE_CHANGED | _PAGE_REFERENCED)) << 48;
         pgste_val(new) |= (key & (_PAGE_ACC_BITS | _PAGE_FP_BIT)) << 56;
         if (!(pte_val(*ptep) & _PAGE_INVALID)) {
-                unsigned long address, bits;
-                unsigned char skey;
+                unsigned long address, bits, skey;
 
                 address = pte_val(*ptep) & PAGE_MASK;
-                skey = page_get_storage_key(address);
+                skey = (unsigned long) page_get_storage_key(address);
                 bits = skey & (_PAGE_CHANGED | _PAGE_REFERENCED);
+                skey = key & (_PAGE_ACC_BITS | _PAGE_FP_BIT);
                 /* Set storage key ACC and FP */
-                page_set_storage_key(address,
-                                (key & (_PAGE_ACC_BITS | _PAGE_FP_BIT)),
-                                !nq);
-
+                page_set_storage_key(address, skey, !nq);
                 /* Merge host changed & referenced into pgste  */
                 pgste_val(new) |= bits << 52;
-                /* Transfer skey changed & referenced bit to kvm user bits */
-                pgste_val(new) |= bits << 45;   /* PGSTE_UR_BIT & PGSTE_UC_BIT */
         }
         /* changing the guest storage key is considered a change of the page */
         if ((pgste_val(new) ^ pgste_val(old)) &
             (PGSTE_ACC_BITS | PGSTE_FP_BIT | PGSTE_GR_BIT | PGSTE_GC_BIT))
-                pgste_val(new) |= PGSTE_UC_BIT;
+                pgste_val(new) |= PGSTE_HC_BIT;
 
         pgste_set_unlock(ptep, new);
         pte_unmap_unlock(*ptep, ptl);
@@ -821,6 +823,11 @@ EXPORT_SYMBOL(set_guest_storage_key);
 
 #else /* CONFIG_PGSTE */
 
+static inline int page_table_with_pgste(struct page *page)
+{
+        return 0;
+}
+
 static inline unsigned long *page_table_alloc_pgste(struct mm_struct *mm,
                                                     unsigned long vmaddr)
 {
@@ -878,7 +885,7 @@ unsigned long *page_table_alloc(struct mm_struct *mm, unsigned long vmaddr)
                 pgtable_page_ctor(page);
                 atomic_set(&page->_mapcount, 1);
                 table = (unsigned long *) page_to_phys(page);
-                clear_table(table, _PAGE_TYPE_EMPTY, PAGE_SIZE);
+                clear_table(table, _PAGE_INVALID, PAGE_SIZE);
                 spin_lock_bh(&mm->context.list_lock);
                 list_add(&page->lru, &mm->context.pgtable_list);
         } else {
@@ -897,12 +904,12 @@ void page_table_free(struct mm_struct *mm, unsigned long *table)
         struct page *page;
         unsigned int bit, mask;
 
-        if (mm_has_pgste(mm)) {
+        page = pfn_to_page(__pa(table) >> PAGE_SHIFT);
+        if (page_table_with_pgste(page)) {
                 gmap_disconnect_pgtable(mm, table);
                 return page_table_free_pgste(table);
         }
         /* Free 1K/2K page table fragment of a 4K page */
-        page = pfn_to_page(__pa(table) >> PAGE_SHIFT);
         bit = 1 << ((__pa(table) & ~PAGE_MASK)/(PTRS_PER_PTE*sizeof(pte_t)));
         spin_lock_bh(&mm->context.list_lock);
         if ((atomic_read(&page->_mapcount) & FRAG_MASK) != FRAG_MASK)
@@ -940,14 +947,14 @@ void page_table_free_rcu(struct mmu_gather *tlb, unsigned long *table)
         unsigned int bit, mask;
 
         mm = tlb->mm;
-        if (mm_has_pgste(mm)) {
+        page = pfn_to_page(__pa(table) >> PAGE_SHIFT);
+        if (page_table_with_pgste(page)) {
                 gmap_disconnect_pgtable(mm, table);
                 table = (unsigned long *) (__pa(table) | FRAG_MASK);
                 tlb_remove_table(tlb, table);
                 return;
         }
         bit = 1 << ((__pa(table) & ~PAGE_MASK) / (PTRS_PER_PTE*sizeof(pte_t)));
-        page = pfn_to_page(__pa(table) >> PAGE_SHIFT);
         spin_lock_bh(&mm->context.list_lock);
         if ((atomic_read(&page->_mapcount) & FRAG_MASK) != FRAG_MASK)
                 list_del(&page->lru);
@@ -1007,7 +1014,6 @@ void tlb_table_flush(struct mmu_gather *tlb)
         struct mmu_table_batch **batch = &tlb->batch;
 
         if (*batch) {
-                __tlb_flush_mm(tlb->mm);
                 call_rcu_sched(&(*batch)->rcu, tlb_remove_table_rcu);
                 *batch = NULL;
         }
@@ -1017,11 +1023,12 @@ void tlb_remove_table(struct mmu_gather *tlb, void *table)
 {
         struct mmu_table_batch **batch = &tlb->batch;
 
+        tlb->mm->context.flush_mm = 1;
         if (*batch == NULL) {
                 *batch = (struct mmu_table_batch *)
                         __get_free_page(GFP_NOWAIT | __GFP_NOWARN);
                 if (*batch == NULL) {
-                        __tlb_flush_mm(tlb->mm);
+                        __tlb_flush_mm_lazy(tlb->mm);
                         tlb_remove_table_one(table);
                         return;
                 }
@@ -1029,40 +1036,124 @@ void tlb_remove_table(struct mmu_gather *tlb, void *table)
         }
         (*batch)->tables[(*batch)->nr++] = table;
         if ((*batch)->nr == MAX_TABLE_BATCH)
-                tlb_table_flush(tlb);
+                tlb_flush_mmu(tlb);
 }
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
-void thp_split_vma(struct vm_area_struct *vma)
+static inline void thp_split_vma(struct vm_area_struct *vma)
 {
         unsigned long addr;
-        struct page *page;
 
-        for (addr = vma->vm_start; addr < vma->vm_end; addr += PAGE_SIZE) {
-                page = follow_page(vma, addr, FOLL_SPLIT);
-        }
+        for (addr = vma->vm_start; addr < vma->vm_end; addr += PAGE_SIZE)
+                follow_page(vma, addr, FOLL_SPLIT);
 }
 
-void thp_split_mm(struct mm_struct *mm)
+static inline void thp_split_mm(struct mm_struct *mm)
 {
-        struct vm_area_struct *vma = mm->mmap;
+        struct vm_area_struct *vma;
 
-        while (vma != NULL) {
+        for (vma = mm->mmap; vma != NULL; vma = vma->vm_next) {
                 thp_split_vma(vma);
                 vma->vm_flags &= ~VM_HUGEPAGE;
                 vma->vm_flags |= VM_NOHUGEPAGE;
-                vma = vma->vm_next;
         }
+        mm->def_flags |= VM_NOHUGEPAGE;
+}
+#else
+static inline void thp_split_mm(struct mm_struct *mm)
+{
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
+static unsigned long page_table_realloc_pmd(struct mmu_gather *tlb,
+                                struct mm_struct *mm, pud_t *pud,
+                                unsigned long addr, unsigned long end)
+{
+        unsigned long next, *table, *new;
+        struct page *page;
+        pmd_t *pmd;
+
+        pmd = pmd_offset(pud, addr);
+        do {
+                next = pmd_addr_end(addr, end);
+again:
+                if (pmd_none_or_clear_bad(pmd))
+                        continue;
+                table = (unsigned long *) pmd_deref(*pmd);
+                page = pfn_to_page(__pa(table) >> PAGE_SHIFT);
+                if (page_table_with_pgste(page))
+                        continue;
+                /* Allocate new page table with pgstes */
+                new = page_table_alloc_pgste(mm, addr);
+                if (!new) {
+                        mm->context.has_pgste = 0;
+                        continue;
+                }
+                spin_lock(&mm->page_table_lock);
+                if (likely((unsigned long *) pmd_deref(*pmd) == table)) {
+                        /* Nuke pmd entry pointing to the "short" page table */
+                        pmdp_flush_lazy(mm, addr, pmd);
+                        pmd_clear(pmd);
+                        /* Copy ptes from old table to new table */
+                        memcpy(new, table, PAGE_SIZE/2);
+                        clear_table(table, _PAGE_INVALID, PAGE_SIZE/2);
+                        /* Establish new table */
+                        pmd_populate(mm, pmd, (pte_t *) new);
+                        /* Free old table with rcu, there might be a walker! */
+                        page_table_free_rcu(tlb, table);
+                        new = NULL;
+                }
+                spin_unlock(&mm->page_table_lock);
+                if (new) {
+                        page_table_free_pgste(new);
+                        goto again;
+                }
+        } while (pmd++, addr = next, addr != end);
+
+        return addr;
+}
+
+static unsigned long page_table_realloc_pud(struct mmu_gather *tlb,
+                                   struct mm_struct *mm, pgd_t *pgd,
+                                   unsigned long addr, unsigned long end)
+{
+        unsigned long next;
+        pud_t *pud;
+
+        pud = pud_offset(pgd, addr);
+        do {
+                next = pud_addr_end(addr, end);
+                if (pud_none_or_clear_bad(pud))
+                        continue;
+                next = page_table_realloc_pmd(tlb, mm, pud, addr, next);
+        } while (pud++, addr = next, addr != end);
+
+        return addr;
+}
+
+static void page_table_realloc(struct mmu_gather *tlb, struct mm_struct *mm,
+                               unsigned long addr, unsigned long end)
+{
+        unsigned long next;
+        pgd_t *pgd;
+
+        pgd = pgd_offset(mm, addr);
+        do {
+                next = pgd_addr_end(addr, end);
+                if (pgd_none_or_clear_bad(pgd))
+                        continue;
+                next = page_table_realloc_pud(tlb, mm, pgd, addr, next);
+        } while (pgd++, addr = next, addr != end);
+}
+
 /*
  * switch on pgstes for its userspace process (for kvm)
  */
 int s390_enable_sie(void)
 {
         struct task_struct *tsk = current;
-        struct mm_struct *mm, *old_mm;
+        struct mm_struct *mm = tsk->mm;
+        struct mmu_gather tlb;
 
         /* Do we have switched amode? If no, we cannot do sie */
         if (s390_user_mode == HOME_SPACE_MODE)
@@ -1072,57 +1163,16 @@ int s390_enable_sie(void)
         if (mm_has_pgste(tsk->mm))
                 return 0;
 
-        /* lets check if we are allowed to replace the mm */
-        task_lock(tsk);
-        if (!tsk->mm || atomic_read(&tsk->mm->mm_users) > 1 ||
-#ifdef CONFIG_AIO
-            !hlist_empty(&tsk->mm->ioctx_list) ||
-#endif
-            tsk->mm != tsk->active_mm) {
-                task_unlock(tsk);
-                return -EINVAL;
-        }
-        task_unlock(tsk);
-
-        /* we copy the mm and let dup_mm create the page tables with_pgstes */
-        tsk->mm->context.alloc_pgste = 1;
-        /* make sure that both mms have a correct rss state */
-        sync_mm_rss(tsk->mm);
-        mm = dup_mm(tsk);
-        tsk->mm->context.alloc_pgste = 0;
-        if (!mm)
-                return -ENOMEM;
-
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+        down_write(&mm->mmap_sem);
         /* split thp mappings and disable thp for future mappings */
         thp_split_mm(mm);
-        mm->def_flags |= VM_NOHUGEPAGE;
-#endif
-
-        /* Now lets check again if something happened */
-        task_lock(tsk);
-        if (!tsk->mm || atomic_read(&tsk->mm->mm_users) > 1 ||
-#ifdef CONFIG_AIO
-            !hlist_empty(&tsk->mm->ioctx_list) ||
-#endif
-            tsk->mm != tsk->active_mm) {
-                mmput(mm);
-                task_unlock(tsk);
-                return -EINVAL;
-        }
-
-        /* ok, we are alone. No ptrace, no threads, etc. */
-        old_mm = tsk->mm;
-        tsk->mm = tsk->active_mm = mm;
-        preempt_disable();
-        update_mm(mm, tsk);
-        atomic_inc(&mm->context.attach_count);
-        atomic_dec(&old_mm->context.attach_count);
-        cpumask_set_cpu(smp_processor_id(), mm_cpumask(mm));
-        preempt_enable();
-        task_unlock(tsk);
-        mmput(old_mm);
-        return 0;
+        /* Reallocate the page tables with pgstes */
+        mm->context.has_pgste = 1;
+        tlb_gather_mmu(&tlb, mm, 0, TASK_SIZE);
+        page_table_realloc(&tlb, mm, 0, TASK_SIZE);
+        tlb_finish_mmu(&tlb, 0, TASK_SIZE);
+        up_write(&mm->mmap_sem);
+        return mm->context.has_pgste ? 0 : -ENOMEM;
 }
 EXPORT_SYMBOL_GPL(s390_enable_sie);
 
@@ -1198,9 +1248,9 @@ pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp)
                 list_del(lh);
         }
         ptep = (pte_t *) pgtable;
-        pte_val(*ptep) = _PAGE_TYPE_EMPTY;
+        pte_val(*ptep) = _PAGE_INVALID;
         ptep++;
-        pte_val(*ptep) = _PAGE_TYPE_EMPTY;
+        pte_val(*ptep) = _PAGE_INVALID;
         return pgtable;
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c
index 8b268fcc4612..bcfb70b60be6 100644
--- a/arch/s390/mm/vmem.c
+++ b/arch/s390/mm/vmem.c
@@ -69,7 +69,7 @@ static pte_t __ref *vmem_pte_alloc(unsigned long address)
                 pte = alloc_bootmem(PTRS_PER_PTE * sizeof(pte_t));
         if (!pte)
                 return NULL;
-        clear_table((unsigned long *) pte, _PAGE_TYPE_EMPTY,
+        clear_table((unsigned long *) pte, _PAGE_INVALID,
                     PTRS_PER_PTE * sizeof(pte_t));
         return pte;
 }
@@ -101,7 +101,7 @@ static int vmem_add_mem(unsigned long start, unsigned long size, int ro)
                     !(address & ~PUD_MASK) && (address + PUD_SIZE <= end)) {
                         pud_val(*pu_dir) = __pa(address) |
                                 _REGION_ENTRY_TYPE_R3 | _REGION3_ENTRY_LARGE |
-                                (ro ? _REGION_ENTRY_RO : 0);
+                                (ro ? _REGION_ENTRY_PROTECT : 0);
                         address += PUD_SIZE;
                         continue;
                 }
@@ -118,7 +118,8 @@ static int vmem_add_mem(unsigned long start, unsigned long size, int ro)
                     !(address & ~PMD_MASK) && (address + PMD_SIZE <= end)) {
                         pmd_val(*pm_dir) = __pa(address) |
                                 _SEGMENT_ENTRY | _SEGMENT_ENTRY_LARGE |
-                                (ro ? _SEGMENT_ENTRY_RO : 0);
+                                _SEGMENT_ENTRY_YOUNG |
+                                (ro ? _SEGMENT_ENTRY_PROTECT : 0);
                         address += PMD_SIZE;
                         continue;
                 }
@@ -131,7 +132,8 @@ static int vmem_add_mem(unsigned long start, unsigned long size, int ro)
                 }
 
                 pt_dir = pte_offset_kernel(pm_dir, address);
-                pte_val(*pt_dir) = __pa(address) | (ro ? _PAGE_RO : 0);
+                pte_val(*pt_dir) = __pa(address) |
+                        pgprot_val(ro ? PAGE_KERNEL_RO : PAGE_KERNEL);
                 address += PAGE_SIZE;
         }
         ret = 0;
@@ -154,7 +156,7 @@ static void vmem_remove_range(unsigned long start, unsigned long size)
         pte_t *pt_dir;
         pte_t  pte;
 
-        pte_val(pte) = _PAGE_TYPE_EMPTY;
+        pte_val(pte) = _PAGE_INVALID;
         while (address < end) {
                 pg_dir = pgd_offset_k(address);
                 if (pgd_none(*pg_dir)) {
@@ -255,7 +257,8 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node)
                         new_page =__pa(vmem_alloc_pages(0));
                         if (!new_page)
                                 goto out;
-                        pte_val(*pt_dir) = __pa(new_page);
+                        pte_val(*pt_dir) =
+                                __pa(new_page) | pgprot_val(PAGE_KERNEL);
                 }
                 address += PAGE_SIZE;
         }
diff --git a/arch/s390/oprofile/init.c b/arch/s390/oprofile/init.c
index ffeb17ce7f31..04e1b6a85362 100644
--- a/arch/s390/oprofile/init.c
+++ b/arch/s390/oprofile/init.c
@@ -346,16 +346,15 @@ static const struct file_operations timer_enabled_fops = {
 };
 
 
-static int oprofile_create_hwsampling_files(struct super_block *sb,
-                                            struct dentry *root)
+static int oprofile_create_hwsampling_files(struct dentry *root)
 {
         struct dentry *dir;
 
-        dir = oprofilefs_mkdir(sb, root, "timer");
+        dir = oprofilefs_mkdir(root, "timer");
         if (!dir)
                 return -EINVAL;
 
-        oprofilefs_create_file(sb, dir, "enabled", &timer_enabled_fops);
+        oprofilefs_create_file(dir, "enabled", &timer_enabled_fops);
 
         if (!hwsampler_available)
                 return 0;
@@ -376,17 +375,17 @@ static int oprofile_create_hwsampling_files(struct super_block *sb,
                  * and can only be set to 0.
                  */
 
-                dir = oprofilefs_mkdir(sb, root, "0");
+                dir = oprofilefs_mkdir(root, "0");
                 if (!dir)
                         return -EINVAL;
 
-                oprofilefs_create_file(sb, dir, "enabled", &hwsampler_fops);
-                oprofilefs_create_file(sb, dir, "event", &zero_fops);
-                oprofilefs_create_file(sb, dir, "count", &hw_interval_fops);
-                oprofilefs_create_file(sb, dir, "unit_mask", &zero_fops);
-                oprofilefs_create_file(sb, dir, "kernel", &kernel_fops);
-                oprofilefs_create_file(sb, dir, "user", &user_fops);
-                oprofilefs_create_ulong(sb, dir, "hw_sdbt_blocks",
+                oprofilefs_create_file(dir, "enabled", &hwsampler_fops);
+                oprofilefs_create_file(dir, "event", &zero_fops);
+                oprofilefs_create_file(dir, "count", &hw_interval_fops);
+                oprofilefs_create_file(dir, "unit_mask", &zero_fops);
+                oprofilefs_create_file(dir, "kernel", &kernel_fops);
+                oprofilefs_create_file(dir, "user", &user_fops);
+                oprofilefs_create_ulong(dir, "hw_sdbt_blocks",
                                         &oprofile_sdbt_blocks);
 
         } else {
@@ -396,19 +395,19 @@ static int oprofile_create_hwsampling_files(struct super_block *sb,
                  * space tools.  The /dev/oprofile/hwsampling fs is
                  * provided in that case.
                  */
-                dir = oprofilefs_mkdir(sb, root, "hwsampling");
+                dir = oprofilefs_mkdir(root, "hwsampling");
                 if (!dir)
                         return -EINVAL;
 
-                oprofilefs_create_file(sb, dir, "hwsampler",
+                oprofilefs_create_file(dir, "hwsampler",
                                        &hwsampler_fops);
-                oprofilefs_create_file(sb, dir, "hw_interval",
+                oprofilefs_create_file(dir, "hw_interval",
                                        &hw_interval_fops);
-                oprofilefs_create_ro_ulong(sb, dir, "hw_min_interval",
+                oprofilefs_create_ro_ulong(dir, "hw_min_interval",
                                            &oprofile_min_interval);
-                oprofilefs_create_ro_ulong(sb, dir, "hw_max_interval",
+                oprofilefs_create_ro_ulong(dir, "hw_max_interval",
                                            &oprofile_max_interval);
-                oprofilefs_create_ulong(sb, dir, "hw_sdbt_blocks",
+                oprofilefs_create_ulong(dir, "hw_sdbt_blocks",
                                         &oprofile_sdbt_blocks);
         }
         return 0;
@@ -440,7 +439,7 @@ static int oprofile_hwsampler_init(struct oprofile_operations *ops)
                 switch (id.machine) {
                 case 0x2097: case 0x2098: ops->cpu_type = "s390/z10"; break;
                 case 0x2817: case 0x2818: ops->cpu_type = "s390/z196"; break;
-                case 0x2827:              ops->cpu_type = "s390/zEC12"; break;
+                case 0x2827: case 0x2828: ops->cpu_type = "s390/zEC12"; break;
                 default: return -ENODEV;
                 }
         }
diff --git a/arch/s390/pci/Makefile b/arch/s390/pci/Makefile
index 086a2e37935d..a9e1dc4ae442 100644
--- a/arch/s390/pci/Makefile
+++ b/arch/s390/pci/Makefile
@@ -2,5 +2,5 @@
 # Makefile for the s390 PCI subsystem.
 #
 
-obj-$(CONFIG_PCI)       += pci.o pci_dma.o pci_clp.o pci_msi.o pci_sysfs.o \
+obj-$(CONFIG_PCI)       += pci.o pci_dma.o pci_clp.o pci_sysfs.o \
                            pci_event.o pci_debug.o pci_insn.o
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index e2956ad39a4f..f17a8343e360 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -42,45 +42,26 @@
 #define SIC_IRQ_MODE_SINGLE             1
 
 #define ZPCI_NR_DMA_SPACES              1
-#define ZPCI_MSI_VEC_BITS               6
 #define ZPCI_NR_DEVICES                 CONFIG_PCI_NR_FUNCTIONS
 
 /* list of all detected zpci devices */
-LIST_HEAD(zpci_list);
-EXPORT_SYMBOL_GPL(zpci_list);
-DEFINE_MUTEX(zpci_list_lock);
-EXPORT_SYMBOL_GPL(zpci_list_lock);
+static LIST_HEAD(zpci_list);
+static DEFINE_SPINLOCK(zpci_list_lock);
 
-static struct pci_hp_callback_ops *hotplug_ops;
+static void zpci_enable_irq(struct irq_data *data);
+static void zpci_disable_irq(struct irq_data *data);
 
-static DECLARE_BITMAP(zpci_domain, ZPCI_NR_DEVICES);
-static DEFINE_SPINLOCK(zpci_domain_lock);
-
-struct callback {
-        irq_handler_t   handler;
-        void            *data;
+static struct irq_chip zpci_irq_chip = {
+        .name = "zPCI",
+        .irq_unmask = zpci_enable_irq,
+        .irq_mask = zpci_disable_irq,
 };
 
-struct zdev_irq_map {
-        unsigned long   aibv;           /* AI bit vector */
-        int             msi_vecs;       /* consecutive MSI-vectors used */
-        int             __unused;
-        struct callback cb[ZPCI_NR_MSI_VECS]; /* callback handler array */
-        spinlock_t      lock;           /* protect callbacks against de-reg */
-};
-
-struct intr_bucket {
-        /* amap of adapters, one bit per dev, corresponds to one irq nr */
-        unsigned long   *alloc;
-        /* AI summary bit, global page for all devices */
-        unsigned long   *aisb;
-        /* pointer to aibv and callback data in zdev */
-        struct zdev_irq_map *imap[ZPCI_NR_DEVICES];
-        /* protects the whole bucket struct */
-        spinlock_t      lock;
-};
+static DECLARE_BITMAP(zpci_domain, ZPCI_NR_DEVICES);
+static DEFINE_SPINLOCK(zpci_domain_lock);
 
-static struct intr_bucket *bucket;
+static struct airq_iv *zpci_aisb_iv;
+static struct airq_iv *zpci_aibv[ZPCI_NR_DEVICES];
 
 /* Adapter interrupt definitions */
 static void zpci_irq_handler(struct airq_struct *airq);
@@ -96,27 +77,8 @@ static DECLARE_BITMAP(zpci_iomap, ZPCI_IOMAP_MAX_ENTRIES);
 struct zpci_iomap_entry *zpci_iomap_start;
 EXPORT_SYMBOL_GPL(zpci_iomap_start);
 
-/* highest irq summary bit */
-static int __read_mostly aisb_max;
-
-static struct kmem_cache *zdev_irq_cache;
 static struct kmem_cache *zdev_fmb_cache;
 
-static inline int irq_to_msi_nr(unsigned int irq)
-{
-        return irq & ZPCI_MSI_MASK;
-}
-
-static inline int irq_to_dev_nr(unsigned int irq)
-{
-        return irq >> ZPCI_MSI_VEC_BITS;
-}
-
-static inline struct zdev_irq_map *get_imap(unsigned int irq)
-{
-        return bucket->imap[irq_to_dev_nr(irq)];
-}
-
 struct zpci_dev *get_zdev(struct pci_dev *pdev)
 {
         return (struct zpci_dev *) pdev->sysdata;
@@ -126,22 +88,17 @@ struct zpci_dev *get_zdev_by_fid(u32 fid)
 {
         struct zpci_dev *tmp, *zdev = NULL;
 
-        mutex_lock(&zpci_list_lock);
+        spin_lock(&zpci_list_lock);
         list_for_each_entry(tmp, &zpci_list, entry) {
                 if (tmp->fid == fid) {
                         zdev = tmp;
                         break;
                 }
         }
-        mutex_unlock(&zpci_list_lock);
+        spin_unlock(&zpci_list_lock);
         return zdev;
 }
 
-bool zpci_fid_present(u32 fid)
-{
-        return (get_zdev_by_fid(fid) != NULL) ? true : false;
-}
-
 static struct zpci_dev *get_zdev_by_bus(struct pci_bus *bus)
 {
         return (bus && bus->sysdata) ? (struct zpci_dev *) bus->sysdata : NULL;
@@ -160,8 +117,7 @@ int pci_proc_domain(struct pci_bus *bus)
 EXPORT_SYMBOL_GPL(pci_proc_domain);
 
 /* Modify PCI: Register adapter interruptions */
-static int zpci_register_airq(struct zpci_dev *zdev, unsigned int aisb,
-                              u64 aibv)
+static int zpci_set_airq(struct zpci_dev *zdev)
 {
         u64 req = ZPCI_CREATE_REQ(zdev->fh, 0, ZPCI_MOD_FC_REG_INT);
         struct zpci_fib *fib;
@@ -172,14 +128,14 @@ static int zpci_register_airq(struct zpci_dev *zdev, unsigned int aisb,
                 return -ENOMEM;
 
         fib->isc = PCI_ISC;
-        fib->noi = zdev->irq_map->msi_vecs;
         fib->sum = 1;           /* enable summary notifications */
-        fib->aibv = aibv;
-        fib->aibvo = 0;         /* every function has its own page */
-        fib->aisb = (u64) bucket->aisb + aisb / 8;
-        fib->aisbo = aisb & ZPCI_MSI_MASK;
+        fib->noi = airq_iv_end(zdev->aibv);
+        fib->aibv = (unsigned long) zdev->aibv->vector;
+        fib->aibvo = 0;         /* each zdev has its own interrupt vector */
+        fib->aisb = (unsigned long) zpci_aisb_iv->vector + (zdev->aisb/64)*8;
+        fib->aisbo = zdev->aisb & 63;
 
-        rc = s390pci_mod_fc(req, fib);
+        rc = zpci_mod_fc(req, fib);
         pr_debug("%s mpcifc returned noi: %d\n", __func__, fib->noi);
 
         free_page((unsigned long) fib);
@@ -209,7 +165,7 @@ static int mod_pci(struct zpci_dev *zdev, int fn, u8 dmaas, struct mod_pci_args
         fib->iota = args->iota;
         fib->fmb_addr = args->fmb_addr;
 
-        rc = s390pci_mod_fc(req, fib);
+        rc = zpci_mod_fc(req, fib);
         free_page((unsigned long) fib);
         return rc;
 }
@@ -234,7 +190,7 @@ int zpci_unregister_ioat(struct zpci_dev *zdev, u8 dmaas)
 }
 
 /* Modify PCI: Unregister adapter interruptions */
-static int zpci_unregister_airq(struct zpci_dev *zdev)
+static int zpci_clear_airq(struct zpci_dev *zdev)
 {
         struct mod_pci_args args = { 0, 0, 0, 0 };
 
@@ -283,7 +239,7 @@ static int zpci_cfg_load(struct zpci_dev *zdev, int offset, u32 *val, u8 len)
         u64 data;
         int rc;
 
-        rc = s390pci_load(&data, req, offset);
+        rc = zpci_load(&data, req, offset);
         if (!rc) {
                 data = data << ((8 - len) * 8);
                 data = le64_to_cpu(data);
@@ -301,25 +257,46 @@ static int zpci_cfg_store(struct zpci_dev *zdev, int offset, u32 val, u8 len)
 
         data = cpu_to_le64(data);
         data = data >> ((8 - len) * 8);
-        rc = s390pci_store(data, req, offset);
+        rc = zpci_store(data, req, offset);
         return rc;
 }
 
-void enable_irq(unsigned int irq)
+static int zpci_msi_set_mask_bits(struct msi_desc *msi, u32 mask, u32 flag)
+{
+        int offset, pos;
+        u32 mask_bits;
+
+        if (msi->msi_attrib.is_msix) {
+                offset = msi->msi_attrib.entry_nr * PCI_MSIX_ENTRY_SIZE +
+                        PCI_MSIX_ENTRY_VECTOR_CTRL;
+                msi->masked = readl(msi->mask_base + offset);
+                writel(flag, msi->mask_base + offset);
+        } else if (msi->msi_attrib.maskbit) {
+                pos = (long) msi->mask_base;
+                pci_read_config_dword(msi->dev, pos, &mask_bits);
+                mask_bits &= ~(mask);
+                mask_bits |= flag & mask;
+                pci_write_config_dword(msi->dev, pos, mask_bits);
+        } else
+                return 0;
+
+        msi->msi_attrib.maskbit = !!flag;
+        return 1;
+}
+
+static void zpci_enable_irq(struct irq_data *data)
 {
-        struct msi_desc *msi = irq_get_msi_desc(irq);
+        struct msi_desc *msi = irq_get_msi_desc(data->irq);
 
         zpci_msi_set_mask_bits(msi, 1, 0);
 }
-EXPORT_SYMBOL_GPL(enable_irq);
 
-void disable_irq(unsigned int irq)
+static void zpci_disable_irq(struct irq_data *data)
 {
-        struct msi_desc *msi = irq_get_msi_desc(irq);
+        struct msi_desc *msi = irq_get_msi_desc(data->irq);
 
         zpci_msi_set_mask_bits(msi, 1, 1);
 }
-EXPORT_SYMBOL_GPL(disable_irq);
 
 void pcibios_fixup_bus(struct pci_bus *bus)
 {
@@ -404,152 +381,147 @@ static struct pci_ops pci_root_ops = {
         .write = pci_write,
 };
 
-/* store the last handled bit to implement fair scheduling of devices */
-static DEFINE_PER_CPU(unsigned long, next_sbit);
-
 static void zpci_irq_handler(struct airq_struct *airq)
 {
-        unsigned long sbit, mbit, last = 0, start = __get_cpu_var(next_sbit);
-        int rescan = 0, max = aisb_max;
-        struct zdev_irq_map *imap;
+        unsigned long si, ai;
+        struct airq_iv *aibv;
+        int irqs_on = 0;
 
         inc_irq_stat(IRQIO_PCI);
-        sbit = start;
-
-scan:
-        /* find summary_bit */
-        for_each_set_bit_left_cont(sbit, bucket->aisb, max) {
-                clear_bit(63 - (sbit & 63), bucket->aisb + (sbit >> 6));
-                last = sbit;
+        for (si = 0;;) {
+                /* Scan adapter summary indicator bit vector */
+                si = airq_iv_scan(zpci_aisb_iv, si, airq_iv_end(zpci_aisb_iv));
+                if (si == -1UL) {
+                        if (irqs_on++)
+                                /* End of second scan with interrupts on. */
+                                break;
+                        /* First scan complete, reenable interrupts. */
+                        zpci_set_irq_ctrl(SIC_IRQ_MODE_SINGLE, NULL, PCI_ISC);
+                        si = 0;
+                        continue;
+                }
 
-                /* find vector bit */
-                imap = bucket->imap[sbit];
-                for_each_set_bit_left(mbit, &imap->aibv, imap->msi_vecs) {
+                /* Scan the adapter interrupt vector for this device. */
+                aibv = zpci_aibv[si];
+                for (ai = 0;;) {
+                        ai = airq_iv_scan(aibv, ai, airq_iv_end(aibv));
+                        if (ai == -1UL)
+                                break;
                         inc_irq_stat(IRQIO_MSI);
-                        clear_bit(63 - mbit, &imap->aibv);
-
-                        spin_lock(&imap->lock);
-                        if (imap->cb[mbit].handler)
-                                imap->cb[mbit].handler(mbit,
-                                        imap->cb[mbit].data);
-                        spin_unlock(&imap->lock);
+                        airq_iv_lock(aibv, ai);
+                        generic_handle_irq(airq_iv_get_data(aibv, ai));
+                        airq_iv_unlock(aibv, ai);
                 }
         }
-
-        if (rescan)
-                goto out;
-
-        /* scan the skipped bits */
-        if (start > 0) {
-                sbit = 0;
-                max = start;
-                start = 0;
-                goto scan;
-        }
-
-        /* enable interrupts again */
-        set_irq_ctrl(SIC_IRQ_MODE_SINGLE, NULL, PCI_ISC);
-
-        /* check again to not lose initiative */
-        rmb();
-        max = aisb_max;
-        sbit = find_first_bit_left(bucket->aisb, max);
-        if (sbit != max) {
-                rescan++;
-                goto scan;
-        }
-out:
-        /* store next device bit to scan */
-        __get_cpu_var(next_sbit) = (++last >= aisb_max) ? 0 : last;
 }
 
-/* msi_vecs - number of requested interrupts, 0 place function to error state */
-static int zpci_setup_msi(struct pci_dev *pdev, int msi_vecs)
+int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
 {
         struct zpci_dev *zdev = get_zdev(pdev);
-        unsigned int aisb, msi_nr;
+        unsigned int hwirq, irq, msi_vecs;
+        unsigned long aisb;
         struct msi_desc *msi;
+        struct msi_msg msg;
         int rc;
 
-        /* store the number of used MSI vectors */
-        zdev->irq_map->msi_vecs = min(msi_vecs, ZPCI_NR_MSI_VECS);
-
-        spin_lock(&bucket->lock);
-        aisb = find_first_zero_bit(bucket->alloc, PAGE_SIZE);
-        /* alloc map exhausted? */
-        if (aisb == PAGE_SIZE) {
-                spin_unlock(&bucket->lock);
-                return -EIO;
-        }
-        set_bit(aisb, bucket->alloc);
-        spin_unlock(&bucket->lock);
+        pr_debug("%s: requesting %d MSI-X interrupts...", __func__, nvec);
+        if (type != PCI_CAP_ID_MSIX && type != PCI_CAP_ID_MSI)
+                return -EINVAL;
+        msi_vecs = min(nvec, ZPCI_MSI_VEC_MAX);
+        msi_vecs = min_t(unsigned int, msi_vecs, CONFIG_PCI_NR_MSI);
 
+        /* Allocate adapter summary indicator bit */
+        rc = -EIO;
+        aisb = airq_iv_alloc_bit(zpci_aisb_iv);
+        if (aisb == -1UL)
+                goto out;
         zdev->aisb = aisb;
-        if (aisb + 1 > aisb_max)
-                aisb_max = aisb + 1;
 
-        /* wire up IRQ shortcut pointer */
-        bucket->imap[zdev->aisb] = zdev->irq_map;
-        pr_debug("%s: imap[%u] linked to %p\n", __func__, zdev->aisb, zdev->irq_map);
+        /* Create adapter interrupt vector */
+        rc = -ENOMEM;
+        zdev->aibv = airq_iv_create(msi_vecs, AIRQ_IV_DATA | AIRQ_IV_BITLOCK);
+        if (!zdev->aibv)
+                goto out_si;
 
-        /* TODO: irq number 0 wont be found if we return less than requested MSIs.
-         * ignore it for now and fix in common code.
-         */
-        msi_nr = aisb << ZPCI_MSI_VEC_BITS;
+        /* Wire up shortcut pointer */
+        zpci_aibv[aisb] = zdev->aibv;
 
+        /* Request MSI interrupts */
+        hwirq = 0;
         list_for_each_entry(msi, &pdev->msi_list, list) {
-                rc = zpci_setup_msi_irq(zdev, msi, msi_nr,
-                                          aisb << ZPCI_MSI_VEC_BITS);
+                rc = -EIO;
+                irq = irq_alloc_desc(0);        /* Alloc irq on node 0 */
+                if (irq == NO_IRQ)
+                        goto out_msi;
+                rc = irq_set_msi_desc(irq, msi);
                 if (rc)
-                        return rc;
-                msi_nr++;
+                        goto out_msi;
+                irq_set_chip_and_handler(irq, &zpci_irq_chip,
+                                         handle_simple_irq);
+                msg.data = hwirq;
+                msg.address_lo = zdev->msi_addr & 0xffffffff;
+                msg.address_hi = zdev->msi_addr >> 32;
+                write_msi_msg(irq, &msg);
+                airq_iv_set_data(zdev->aibv, hwirq, irq);
+                hwirq++;
         }
 
-        rc = zpci_register_airq(zdev, aisb, (u64) &zdev->irq_map->aibv);
-        if (rc) {
-                clear_bit(aisb, bucket->alloc);
-                dev_err(&pdev->dev, "register MSI failed with: %d\n", rc);
-                return rc;
+        /* Enable adapter interrupts */
+        rc = zpci_set_airq(zdev);
+        if (rc)
+                goto out_msi;
+
+        return (msi_vecs == nvec) ? 0 : msi_vecs;
+
+out_msi:
+        list_for_each_entry(msi, &pdev->msi_list, list) {
+                if (hwirq-- == 0)
+                        break;
+                irq_set_msi_desc(msi->irq, NULL);
+                irq_free_desc(msi->irq);
+                msi->msg.address_lo = 0;
+                msi->msg.address_hi = 0;
+                msi->msg.data = 0;
+                msi->irq = 0;
         }
-        return (zdev->irq_map->msi_vecs == msi_vecs) ?
-                0 : zdev->irq_map->msi_vecs;
+        zpci_aibv[aisb] = NULL;
+        airq_iv_release(zdev->aibv);
+out_si:
+        airq_iv_free_bit(zpci_aisb_iv, aisb);
+out:
+        dev_err(&pdev->dev, "register MSI failed with: %d\n", rc);
+        return rc;
 }
 
-static void zpci_teardown_msi(struct pci_dev *pdev)
+void arch_teardown_msi_irqs(struct pci_dev *pdev)
 {
         struct zpci_dev *zdev = get_zdev(pdev);
         struct msi_desc *msi;
-        int aisb, rc;
+        int rc;
 
-        rc = zpci_unregister_airq(zdev);
+        pr_info("%s: on pdev: %p\n", __func__, pdev);
+
+        /* Disable adapter interrupts */
+        rc = zpci_clear_airq(zdev);
         if (rc) {
                 dev_err(&pdev->dev, "deregister MSI failed with: %d\n", rc);
                 return;
         }
 
-        msi = list_first_entry(&pdev->msi_list, struct msi_desc, list);
-        aisb = irq_to_dev_nr(msi->irq);
-
-        list_for_each_entry(msi, &pdev->msi_list, list)
-                zpci_teardown_msi_irq(zdev, msi);
-
-        clear_bit(aisb, bucket->alloc);
-        if (aisb + 1 == aisb_max)
-                aisb_max--;
-}
-
-int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
-{
-        pr_debug("%s: requesting %d MSI-X interrupts...", __func__, nvec);
-        if (type != PCI_CAP_ID_MSIX && type != PCI_CAP_ID_MSI)
-                return -EINVAL;
-        return zpci_setup_msi(pdev, nvec);
-}
+        /* Release MSI interrupts */
+        list_for_each_entry(msi, &pdev->msi_list, list) {
+                zpci_msi_set_mask_bits(msi, 1, 1);
+                irq_set_msi_desc(msi->irq, NULL);
+                irq_free_desc(msi->irq);
+                msi->msg.address_lo = 0;
+                msi->msg.address_hi = 0;
+                msi->msg.data = 0;
+                msi->irq = 0;
+        }
 
-void arch_teardown_msi_irqs(struct pci_dev *pdev)
-{
-        pr_info("%s: on pdev: %p\n", __func__, pdev);
-        zpci_teardown_msi(pdev);
+        zpci_aibv[zdev->aisb] = NULL;
+        airq_iv_release(zdev->aibv);
+        airq_iv_free_bit(zpci_aisb_iv, zdev->aisb);
 }
 
 static void zpci_map_resources(struct zpci_dev *zdev)
@@ -564,8 +536,6 @@ static void zpci_map_resources(struct zpci_dev *zdev)
                         continue;
                 pdev->resource[i].start = (resource_size_t) pci_iomap(pdev, i, 0);
                 pdev->resource[i].end = pdev->resource[i].start + len - 1;
-                pr_debug("BAR%i: -> start: %Lx  end: %Lx\n",
-                        i, pdev->resource[i].start, pdev->resource[i].end);
         }
 }
 
@@ -589,162 +559,47 @@ struct zpci_dev *zpci_alloc_device(void)
 
         /* Alloc memory for our private pci device data */
         zdev = kzalloc(sizeof(*zdev), GFP_KERNEL);
-        if (!zdev)
-                return ERR_PTR(-ENOMEM);
-
-        /* Alloc aibv & callback space */
-        zdev->irq_map = kmem_cache_zalloc(zdev_irq_cache, GFP_KERNEL);
-        if (!zdev->irq_map)
-                goto error;
-        WARN_ON((u64) zdev->irq_map & 0xff);
-        return zdev;
-
-error:
-        kfree(zdev);
-        return ERR_PTR(-ENOMEM);
+        return zdev ? : ERR_PTR(-ENOMEM);
 }
 
 void zpci_free_device(struct zpci_dev *zdev)
 {
-        kmem_cache_free(zdev_irq_cache, zdev->irq_map);
         kfree(zdev);
 }
 
-/*
- * Too late for any s390 specific setup, since interrupts must be set up
- * already which requires DMA setup too and the pci scan will access the
- * config space, which only works if the function handle is enabled.
- */
-int pcibios_enable_device(struct pci_dev *pdev, int mask)
-{
-        struct resource *res;
-        u16 cmd;
-        int i;
-
-        pci_read_config_word(pdev, PCI_COMMAND, &cmd);
-
-        for (i = 0; i < PCI_BAR_COUNT; i++) {
-                res = &pdev->resource[i];
-
-                if (res->flags & IORESOURCE_IO)
-                        return -EINVAL;
-
-                if (res->flags & IORESOURCE_MEM)
-                        cmd |= PCI_COMMAND_MEMORY;
-        }
-        pci_write_config_word(pdev, PCI_COMMAND, cmd);
-        return 0;
-}
-
 int pcibios_add_platform_entries(struct pci_dev *pdev)
 {
         return zpci_sysfs_add_device(&pdev->dev);
 }
 
-int zpci_request_irq(unsigned int irq, irq_handler_t handler, void *data)
-{
-        int msi_nr = irq_to_msi_nr(irq);
-        struct zdev_irq_map *imap;
-        struct msi_desc *msi;
-
-        msi = irq_get_msi_desc(irq);
-        if (!msi)
-                return -EIO;
-
-        imap = get_imap(irq);
-        spin_lock_init(&imap->lock);
-
-        pr_debug("%s: register handler for IRQ:MSI %d:%d\n", __func__, irq >> 6, msi_nr);
-        imap->cb[msi_nr].handler = handler;
-        imap->cb[msi_nr].data = data;
-
-        /*
-         * The generic MSI code returns with the interrupt disabled on the
-         * card, using the MSI mask bits. Firmware doesn't appear to unmask
-         * at that level, so we do it here by hand.
-         */
-        zpci_msi_set_mask_bits(msi, 1, 0);
-        return 0;
-}
-
-void zpci_free_irq(unsigned int irq)
-{
-        struct zdev_irq_map *imap = get_imap(irq);
-        int msi_nr = irq_to_msi_nr(irq);
-        unsigned long flags;
-
-        pr_debug("%s: for irq: %d\n", __func__, irq);
-
-        spin_lock_irqsave(&imap->lock, flags);
-        imap->cb[msi_nr].handler = NULL;
-        imap->cb[msi_nr].data = NULL;
-        spin_unlock_irqrestore(&imap->lock, flags);
-}
-
-int request_irq(unsigned int irq, irq_handler_t handler,
-                unsigned long irqflags, const char *devname, void *dev_id)
-{
-        pr_debug("%s: irq: %d  handler: %p  flags: %lx  dev: %s\n",
-                __func__, irq, handler, irqflags, devname);
-
-        return zpci_request_irq(irq, handler, dev_id);
-}
-EXPORT_SYMBOL_GPL(request_irq);
-
-void free_irq(unsigned int irq, void *dev_id)
-{
-        zpci_free_irq(irq);
-}
-EXPORT_SYMBOL_GPL(free_irq);
-
 static int __init zpci_irq_init(void)
 {
-        int cpu, rc;
-
-        bucket = kzalloc(sizeof(*bucket), GFP_KERNEL);
-        if (!bucket)
-                return -ENOMEM;
-
-        bucket->aisb = (unsigned long *) get_zeroed_page(GFP_KERNEL);
-        if (!bucket->aisb) {
-                rc = -ENOMEM;
-                goto out_aisb;
-        }
-
-        bucket->alloc = (unsigned long *) get_zeroed_page(GFP_KERNEL);
-        if (!bucket->alloc) {
-                rc = -ENOMEM;
-                goto out_alloc;
-        }
+        int rc;
 
         rc = register_adapter_interrupt(&zpci_airq);
         if (rc)
-                goto out_ai;
+                goto out;
         /* Set summary to 1 to be called every time for the ISC. */
         *zpci_airq.lsi_ptr = 1;
 
-        for_each_online_cpu(cpu)
-                per_cpu(next_sbit, cpu) = 0;
+        rc = -ENOMEM;
+        zpci_aisb_iv = airq_iv_create(ZPCI_NR_DEVICES, AIRQ_IV_ALLOC);
+        if (!zpci_aisb_iv)
+                goto out_airq;
 
-        spin_lock_init(&bucket->lock);
-        set_irq_ctrl(SIC_IRQ_MODE_SINGLE, NULL, PCI_ISC);
+        zpci_set_irq_ctrl(SIC_IRQ_MODE_SINGLE, NULL, PCI_ISC);
         return 0;
 
-out_ai:
-        free_page((unsigned long) bucket->alloc);
-out_alloc:
-        free_page((unsigned long) bucket->aisb);
-out_aisb:
-        kfree(bucket);
+out_airq:
+        unregister_adapter_interrupt(&zpci_airq);
+out:
         return rc;
 }
 
 static void zpci_irq_exit(void)
 {
-        free_page((unsigned long) bucket->alloc);
-        free_page((unsigned long) bucket->aisb);
+        airq_iv_release(zpci_aisb_iv);
         unregister_adapter_interrupt(&zpci_airq);
-        kfree(bucket);
 }
 
 static struct resource *zpci_alloc_bus_resource(unsigned long start, unsigned long size,
@@ -801,16 +656,49 @@ static void zpci_free_iomap(struct zpci_dev *zdev, int entry)
 int pcibios_add_device(struct pci_dev *pdev)
 {
         struct zpci_dev *zdev = get_zdev(pdev);
+        struct resource *res;
+        int i;
+
+        zdev->pdev = pdev;
+        zpci_map_resources(zdev);
+
+        for (i = 0; i < PCI_BAR_COUNT; i++) {
+                res = &pdev->resource[i];
+                if (res->parent || !res->flags)
+                        continue;
+                pci_claim_resource(pdev, i);
+        }
+
+        return 0;
+}
+
+int pcibios_enable_device(struct pci_dev *pdev, int mask)
+{
+        struct zpci_dev *zdev = get_zdev(pdev);
+        struct resource *res;
+        u16 cmd;
+        int i;
 
         zdev->pdev = pdev;
         zpci_debug_init_device(zdev);
         zpci_fmb_enable_device(zdev);
         zpci_map_resources(zdev);
 
+        pci_read_config_word(pdev, PCI_COMMAND, &cmd);
+        for (i = 0; i < PCI_BAR_COUNT; i++) {
+                res = &pdev->resource[i];
+
+                if (res->flags & IORESOURCE_IO)
+                        return -EINVAL;
+
+                if (res->flags & IORESOURCE_MEM)
+                        cmd |= PCI_COMMAND_MEMORY;
+        }
+        pci_write_config_word(pdev, PCI_COMMAND, cmd);
         return 0;
 }
 
-void pcibios_release_device(struct pci_dev *pdev)
+void pcibios_disable_device(struct pci_dev *pdev)
 {
         struct zpci_dev *zdev = get_zdev(pdev);
 
@@ -898,6 +786,8 @@ int zpci_enable_device(struct zpci_dev *zdev)
         rc = zpci_dma_init_device(zdev);
         if (rc)
                 goto out_dma;
+
+        zdev->state = ZPCI_FN_STATE_ONLINE;
         return 0;
 
 out_dma:
@@ -926,18 +816,16 @@ int zpci_create_device(struct zpci_dev *zdev)
                 rc = zpci_enable_device(zdev);
                 if (rc)
                         goto out_free;
-
-                zdev->state = ZPCI_FN_STATE_ONLINE;
         }
         rc = zpci_scan_bus(zdev);
         if (rc)
                 goto out_disable;
 
-        mutex_lock(&zpci_list_lock);
+        spin_lock(&zpci_list_lock);
         list_add_tail(&zdev->entry, &zpci_list);
-        if (hotplug_ops)
-                hotplug_ops->create_slot(zdev);
-        mutex_unlock(&zpci_list_lock);
+        spin_unlock(&zpci_list_lock);
+
+        zpci_init_slot(zdev);
 
         return 0;
 
@@ -967,15 +855,10 @@ static inline int barsize(u8 size)
 
 static int zpci_mem_init(void)
 {
-        zdev_irq_cache = kmem_cache_create("PCI_IRQ_cache", sizeof(struct zdev_irq_map),
-                                L1_CACHE_BYTES, SLAB_HWCACHE_ALIGN, NULL);
-        if (!zdev_irq_cache)
-                goto error_zdev;
-
         zdev_fmb_cache = kmem_cache_create("PCI_FMB_cache", sizeof(struct zpci_fmb),
                                 16, 0, NULL);
         if (!zdev_fmb_cache)
-                goto error_fmb;
+                goto error_zdev;
 
         /* TODO: use realloc */
         zpci_iomap_start = kzalloc(ZPCI_IOMAP_MAX_ENTRIES * sizeof(*zpci_iomap_start),
@@ -986,8 +869,6 @@ static int zpci_mem_init(void)
 
 error_iomap:
         kmem_cache_destroy(zdev_fmb_cache);
-error_fmb:
-        kmem_cache_destroy(zdev_irq_cache);
 error_zdev:
         return -ENOMEM;
 }
@@ -995,28 +876,10 @@ error_zdev:
 static void zpci_mem_exit(void)
 {
         kfree(zpci_iomap_start);
-        kmem_cache_destroy(zdev_irq_cache);
         kmem_cache_destroy(zdev_fmb_cache);
 }
 
-void zpci_register_hp_ops(struct pci_hp_callback_ops *ops)
-{
-        mutex_lock(&zpci_list_lock);
-        hotplug_ops = ops;
-        mutex_unlock(&zpci_list_lock);
-}
-EXPORT_SYMBOL_GPL(zpci_register_hp_ops);
-
-void zpci_deregister_hp_ops(void)
-{
-        mutex_lock(&zpci_list_lock);
-        hotplug_ops = NULL;
-        mutex_unlock(&zpci_list_lock);
-}
-EXPORT_SYMBOL_GPL(zpci_deregister_hp_ops);
-
-unsigned int s390_pci_probe;
-EXPORT_SYMBOL_GPL(s390_pci_probe);
+static unsigned int s390_pci_probe;
 
 char * __init pcibios_setup(char *str)
 {
@@ -1044,16 +907,12 @@ static int __init pci_base_init(void)
 
         rc = zpci_debug_init();
         if (rc)
-                return rc;
+                goto out;
 
         rc = zpci_mem_init();
         if (rc)
                 goto out_mem;
 
-        rc = zpci_msihash_init();
-        if (rc)
-                goto out_hash;
-
         rc = zpci_irq_init();
         if (rc)
                 goto out_irq;
@@ -1062,7 +921,7 @@ static int __init pci_base_init(void)
         if (rc)
                 goto out_dma;
 
-        rc = clp_find_pci_devices();
+        rc = clp_scan_pci_devices();
         if (rc)
                 goto out_find;
 
@@ -1073,11 +932,15 @@ out_find:
 out_dma:
         zpci_irq_exit();
 out_irq:
-        zpci_msihash_exit();
-out_hash:
         zpci_mem_exit();
 out_mem:
         zpci_debug_exit();
+out:
         return rc;
 }
-subsys_initcall(pci_base_init);
+subsys_initcall_sync(pci_base_init);
+
+void zpci_rescan(void)
+{
+        clp_rescan_pci_devices_simple();
+}
diff --git a/arch/s390/pci/pci_clp.c b/arch/s390/pci/pci_clp.c
index 2e9539625d93..475563c3d1e4 100644
--- a/arch/s390/pci/pci_clp.c
+++ b/arch/s390/pci/pci_clp.c
@@ -36,9 +36,9 @@ static inline u8 clp_instr(void *data)
         return cc;
 }
 
-static void *clp_alloc_block(void)
+static void *clp_alloc_block(gfp_t gfp_mask)
 {
-        return (void *) __get_free_pages(GFP_KERNEL, get_order(CLP_BLK_SIZE));
+        return (void *) __get_free_pages(gfp_mask, get_order(CLP_BLK_SIZE));
 }
 
 static void clp_free_block(void *ptr)
@@ -70,7 +70,7 @@ static int clp_query_pci_fngrp(struct zpci_dev *zdev, u8 pfgid)
         struct clp_req_rsp_query_pci_grp *rrb;
         int rc;
 
-        rrb = clp_alloc_block();
+        rrb = clp_alloc_block(GFP_KERNEL);
         if (!rrb)
                 return -ENOMEM;
 
@@ -113,7 +113,7 @@ static int clp_query_pci_fn(struct zpci_dev *zdev, u32 fh)
         struct clp_req_rsp_query_pci *rrb;
         int rc;
 
-        rrb = clp_alloc_block();
+        rrb = clp_alloc_block(GFP_KERNEL);
         if (!rrb)
                 return -ENOMEM;
 
@@ -179,9 +179,9 @@ error:
 static int clp_set_pci_fn(u32 *fh, u8 nr_dma_as, u8 command)
 {
         struct clp_req_rsp_set_pci *rrb;
-        int rc, retries = 1000;
+        int rc, retries = 100;
 
-        rrb = clp_alloc_block();
+        rrb = clp_alloc_block(GFP_KERNEL);
         if (!rrb)
                 return -ENOMEM;
 
@@ -199,7 +199,7 @@ static int clp_set_pci_fn(u32 *fh, u8 nr_dma_as, u8 command)
                         retries--;
                         if (retries < 0)
                                 break;
-                        msleep(1);
+                        msleep(20);
                 }
         } while (rrb->response.hdr.rsp == CLP_RC_SETPCIFN_BUSY);
 
@@ -245,49 +245,12 @@ int clp_disable_fh(struct zpci_dev *zdev)
         return rc;
 }
 
-static void clp_check_pcifn_entry(struct clp_fh_list_entry *entry)
+static int clp_list_pci(struct clp_req_rsp_list_pci *rrb,
+                        void (*cb)(struct clp_fh_list_entry *entry))
 {
-        int present, rc;
-
-        if (!entry->vendor_id)
-                return;
-
-        /* TODO: be a little bit more scalable */
-        present = zpci_fid_present(entry->fid);
-
-        if (present)
-                pr_debug("%s: device %x already present\n", __func__, entry->fid);
-
-        /* skip already used functions */
-        if (present && entry->config_state)
-                return;
-
-        /* aev 306: function moved to stand-by state */
-        if (present && !entry->config_state) {
-                /*
-                 * The handle is already disabled, that means no iota/irq freeing via
-                 * the firmware interfaces anymore. Need to free resources manually
-                 * (DMA memory, debug, sysfs)...
-                 */
-                zpci_stop_device(get_zdev_by_fid(entry->fid));
-                return;
-        }
-
-        rc = clp_add_pci_device(entry->fid, entry->fh, entry->config_state);
-        if (rc)
-                pr_err("Failed to add fid: 0x%x\n", entry->fid);
-}
-
-int clp_find_pci_devices(void)
-{
-        struct clp_req_rsp_list_pci *rrb;
         u64 resume_token = 0;
         int entries, i, rc;
 
-        rrb = clp_alloc_block();
-        if (!rrb)
-                return -ENOMEM;
-
         do {
                 memset(rrb, 0, sizeof(*rrb));
                 rrb->request.hdr.len = sizeof(rrb->request);
@@ -316,12 +279,101 @@ int clp_find_pci_devices(void)
                 resume_token = rrb->response.resume_token;
 
                 for (i = 0; i < entries; i++)
-                        clp_check_pcifn_entry(&rrb->response.fh_list[i]);
+                        cb(&rrb->response.fh_list[i]);
         } while (resume_token);
 
         pr_debug("Maximum number of supported PCI functions: %u\n",
                 rrb->response.max_fn);
 out:
+        return rc;
+}
+
+static void __clp_add(struct clp_fh_list_entry *entry)
+{
+        if (!entry->vendor_id)
+                return;
+
+        clp_add_pci_device(entry->fid, entry->fh, entry->config_state);
+}
+
+static void __clp_rescan(struct clp_fh_list_entry *entry)
+{
+        struct zpci_dev *zdev;
+
+        if (!entry->vendor_id)
+                return;
+
+        zdev = get_zdev_by_fid(entry->fid);
+        if (!zdev) {
+                clp_add_pci_device(entry->fid, entry->fh, entry->config_state);
+                return;
+        }
+
+        if (!entry->config_state) {
+                /*
+                 * The handle is already disabled, that means no iota/irq freeing via
+                 * the firmware interfaces anymore. Need to free resources manually
+                 * (DMA memory, debug, sysfs)...
+                 */
+                zpci_stop_device(zdev);
+        }
+}
+
+static void __clp_update(struct clp_fh_list_entry *entry)
+{
+        struct zpci_dev *zdev;
+
+        if (!entry->vendor_id)
+                return;
+
+        zdev = get_zdev_by_fid(entry->fid);
+        if (!zdev)
+                return;
+
+        zdev->fh = entry->fh;
+}
+
+int clp_scan_pci_devices(void)
+{
+        struct clp_req_rsp_list_pci *rrb;
+        int rc;
+
+        rrb = clp_alloc_block(GFP_KERNEL);
+        if (!rrb)
+                return -ENOMEM;
+
+        rc = clp_list_pci(rrb, __clp_add);
+
+        clp_free_block(rrb);
+        return rc;
+}
+
+int clp_rescan_pci_devices(void)
+{
+        struct clp_req_rsp_list_pci *rrb;
+        int rc;
+
+        rrb = clp_alloc_block(GFP_KERNEL);
+        if (!rrb)
+                return -ENOMEM;
+
+        rc = clp_list_pci(rrb, __clp_rescan);
+
+        clp_free_block(rrb);
+        return rc;
+}
+
+int clp_rescan_pci_devices_simple(void)
+{
+        struct clp_req_rsp_list_pci *rrb;
+        int rc;
+
+        rrb = clp_alloc_block(GFP_NOWAIT);
+        if (!rrb)
+                return -ENOMEM;
+
+        rc = clp_list_pci(rrb, __clp_update);
+
         clp_free_block(rrb);
         return rc;
 }
diff --git a/arch/s390/pci/pci_dma.c b/arch/s390/pci/pci_dma.c
index a2343c1f6e04..7e5573acb063 100644
--- a/arch/s390/pci/pci_dma.c
+++ b/arch/s390/pci/pci_dma.c
@@ -10,6 +10,7 @@
 #include <linux/export.h>
 #include <linux/iommu-helper.h>
 #include <linux/dma-mapping.h>
+#include <linux/vmalloc.h>
 #include <linux/pci.h>
 #include <asm/pci_dma.h>
 
@@ -170,8 +171,8 @@ static int dma_update_trans(struct zpci_dev *zdev, unsigned long pa,
                  */
                 goto no_refresh;
 
-        rc = s390pci_refresh_trans((u64) zdev->fh << 32, start_dma_addr,
-                                   nr_pages * PAGE_SIZE);
+        rc = zpci_refresh_trans((u64) zdev->fh << 32, start_dma_addr,
+                                nr_pages * PAGE_SIZE);
 
 no_refresh:
         spin_unlock_irqrestore(&zdev->dma_table_lock, irq_flags);
@@ -407,7 +408,6 @@ static void s390_dma_unmap_sg(struct device *dev, struct scatterlist *sg,
 
 int zpci_dma_init_device(struct zpci_dev *zdev)
 {
-        unsigned int bitmap_order;
         int rc;
 
         spin_lock_init(&zdev->iommu_bitmap_lock);
@@ -421,12 +421,7 @@ int zpci_dma_init_device(struct zpci_dev *zdev)
 
         zdev->iommu_size = (unsigned long) high_memory - PAGE_OFFSET;
         zdev->iommu_pages = zdev->iommu_size >> PAGE_SHIFT;
-        bitmap_order = get_order(zdev->iommu_pages / 8);
-        pr_info("iommu_size: 0x%lx  iommu_pages: 0x%lx  bitmap_order: %i\n",
-                 zdev->iommu_size, zdev->iommu_pages, bitmap_order);
-
-        zdev->iommu_bitmap = (void *) __get_free_pages(GFP_KERNEL | __GFP_ZERO,
-                                                       bitmap_order);
+        zdev->iommu_bitmap = vzalloc(zdev->iommu_pages / 8);
         if (!zdev->iommu_bitmap) {
                 rc = -ENOMEM;
                 goto out_reg;
@@ -451,8 +446,7 @@ void zpci_dma_exit_device(struct zpci_dev *zdev)
 {
         zpci_unregister_ioat(zdev, 0);
         dma_cleanup_tables(zdev);
-        free_pages((unsigned long) zdev->iommu_bitmap,
-                   get_order(zdev->iommu_pages / 8));
+        vfree(zdev->iommu_bitmap);
         zdev->iommu_bitmap = NULL;
         zdev->next_bit = 0;
 }
diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c
index ec62e3a0dc09..0aecaf954845 100644
--- a/arch/s390/pci/pci_event.c
+++ b/arch/s390/pci/pci_event.c
@@ -69,7 +69,7 @@ static void zpci_event_log_avail(struct zpci_ccdf_avail *ccdf)
                 clp_add_pci_device(ccdf->fid, ccdf->fh, 0);
                 break;
         case 0x0306:
-                clp_find_pci_devices();
+                clp_rescan_pci_devices();
                 break;
         default:
                 break;
diff --git a/arch/s390/pci/pci_insn.c b/arch/s390/pci/pci_insn.c
index 22eeb9d7ffeb..85267c058af8 100644
--- a/arch/s390/pci/pci_insn.c
+++ b/arch/s390/pci/pci_insn.c
@@ -27,7 +27,7 @@ static inline u8 __mpcifc(u64 req, struct zpci_fib *fib, u8 *status)
         return cc;
 }
 
-int s390pci_mod_fc(u64 req, struct zpci_fib *fib)
+int zpci_mod_fc(u64 req, struct zpci_fib *fib)
 {
         u8 cc, status;
 
@@ -61,7 +61,7 @@ static inline u8 __rpcit(u64 fn, u64 addr, u64 range, u8 *status)
         return cc;
 }
 
-int s390pci_refresh_trans(u64 fn, u64 addr, u64 range)
+int zpci_refresh_trans(u64 fn, u64 addr, u64 range)
 {
         u8 cc, status;
 
@@ -78,7 +78,7 @@ int s390pci_refresh_trans(u64 fn, u64 addr, u64 range)
 }
 
 /* Set Interruption Controls */
-void set_irq_ctrl(u16 ctl, char *unused, u8 isc)
+void zpci_set_irq_ctrl(u16 ctl, char *unused, u8 isc)
 {
         asm volatile (
                 "       .insn   rsy,0xeb00000000d1,%[ctl],%[isc],%[u]\n"
@@ -109,7 +109,7 @@ static inline int __pcilg(u64 *data, u64 req, u64 offset, u8 *status)
         return cc;
 }
 
-int s390pci_load(u64 *data, u64 req, u64 offset)
+int zpci_load(u64 *data, u64 req, u64 offset)
 {
         u8 status;
         int cc;
@@ -125,7 +125,7 @@ int s390pci_load(u64 *data, u64 req, u64 offset)
                             __func__, cc, status, req, offset);
         return (cc > 0) ? -EIO : cc;
 }
-EXPORT_SYMBOL_GPL(s390pci_load);
+EXPORT_SYMBOL_GPL(zpci_load);
 
 /* PCI Store */
 static inline int __pcistg(u64 data, u64 req, u64 offset, u8 *status)
@@ -147,7 +147,7 @@ static inline int __pcistg(u64 data, u64 req, u64 offset, u8 *status)
         return cc;
 }
 
-int s390pci_store(u64 data, u64 req, u64 offset)
+int zpci_store(u64 data, u64 req, u64 offset)
 {
         u8 status;
         int cc;
@@ -163,7 +163,7 @@ int s390pci_store(u64 data, u64 req, u64 offset)
                         __func__, cc, status, req, offset);
         return (cc > 0) ? -EIO : cc;
 }
-EXPORT_SYMBOL_GPL(s390pci_store);
+EXPORT_SYMBOL_GPL(zpci_store);
 
 /* PCI Store Block */
 static inline int __pcistb(const u64 *data, u64 req, u64 offset, u8 *status)
@@ -183,7 +183,7 @@ static inline int __pcistb(const u64 *data, u64 req, u64 offset, u8 *status)
         return cc;
 }
 
-int s390pci_store_block(const u64 *data, u64 req, u64 offset)
+int zpci_store_block(const u64 *data, u64 req, u64 offset)
 {
         u8 status;
         int cc;
@@ -199,4 +199,4 @@ int s390pci_store_block(const u64 *data, u64 req, u64 offset)
                             __func__, cc, status, req, offset);
         return (cc > 0) ? -EIO : cc;
 }
-EXPORT_SYMBOL_GPL(s390pci_store_block);
+EXPORT_SYMBOL_GPL(zpci_store_block);
diff --git a/arch/s390/pci/pci_msi.c b/arch/s390/pci/pci_msi.c
deleted file mode 100644
index b097aed05a9b..000000000000
--- a/arch/s390/pci/pci_msi.c
+++ /dev/null
@@ -1,142 +0,0 @@
-/*
- * Copyright IBM Corp. 2012
- *
- * Author(s):
- *   Jan Glauber <jang@linux.vnet.ibm.com>
- */
-
-#define COMPONENT "zPCI"
-#define pr_fmt(fmt) COMPONENT ": " fmt
-
-#include <linux/kernel.h>
-#include <linux/err.h>
-#include <linux/rculist.h>
-#include <linux/hash.h>
-#include <linux/pci.h>
-#include <linux/msi.h>
-#include <asm/hw_irq.h>
-
-/* mapping of irq numbers to msi_desc */
-static struct hlist_head *msi_hash;
-static const unsigned int msi_hash_bits = 8;
-#define MSI_HASH_BUCKETS (1U << msi_hash_bits)
-#define msi_hashfn(nr)  hash_long(nr, msi_hash_bits)
-
-static DEFINE_SPINLOCK(msi_map_lock);
-
-struct msi_desc *__irq_get_msi_desc(unsigned int irq)
-{
-        struct msi_map *map;
-
-        hlist_for_each_entry_rcu(map,
-                        &msi_hash[msi_hashfn(irq)], msi_chain)
-                if (map->irq == irq)
-                        return map->msi;
-        return NULL;
-}
-
-int zpci_msi_set_mask_bits(struct msi_desc *msi, u32 mask, u32 flag)
-{
-        if (msi->msi_attrib.is_msix) {
-                int offset = msi->msi_attrib.entry_nr * PCI_MSIX_ENTRY_SIZE +
-                        PCI_MSIX_ENTRY_VECTOR_CTRL;
-                msi->masked = readl(msi->mask_base + offset);
-                writel(flag, msi->mask_base + offset);
-        } else {
-                if (msi->msi_attrib.maskbit) {
-                        int pos;
-                        u32 mask_bits;
-
-                        pos = (long) msi->mask_base;
-                        pci_read_config_dword(msi->dev, pos, &mask_bits);
-                        mask_bits &= ~(mask);
-                        mask_bits |= flag & mask;
-                        pci_write_config_dword(msi->dev, pos, mask_bits);
-                } else {
-                        return 0;
-                }
-        }
-
-        msi->msi_attrib.maskbit = !!flag;
-        return 1;
-}
-
-int zpci_setup_msi_irq(struct zpci_dev *zdev, struct msi_desc *msi,
-                        unsigned int nr, int offset)
-{
-        struct msi_map *map;
-        struct msi_msg msg;
-        int rc;
-
-        map = kmalloc(sizeof(*map), GFP_KERNEL);
-        if (map == NULL)
-                return -ENOMEM;
-
-        map->irq = nr;
-        map->msi = msi;
-        zdev->msi_map[nr & ZPCI_MSI_MASK] = map;
-        INIT_HLIST_NODE(&map->msi_chain);
-
-        pr_debug("%s hashing irq: %u  to bucket nr: %llu\n",
-                __func__, nr, msi_hashfn(nr));
-        hlist_add_head_rcu(&map->msi_chain, &msi_hash[msi_hashfn(nr)]);
-
-        spin_lock(&msi_map_lock);
-        rc = irq_set_msi_desc(nr, msi);
-        if (rc) {
-                spin_unlock(&msi_map_lock);
-                hlist_del_rcu(&map->msi_chain);
-                kfree(map);
-                zdev->msi_map[nr & ZPCI_MSI_MASK] = NULL;
-                return rc;
-        }
-        spin_unlock(&msi_map_lock);
-
-        msg.data = nr - offset;
-        msg.address_lo = zdev->msi_addr & 0xffffffff;
-        msg.address_hi = zdev->msi_addr >> 32;
-        write_msi_msg(nr, &msg);
-        return 0;
-}
-
-void zpci_teardown_msi_irq(struct zpci_dev *zdev, struct msi_desc *msi)
-{
-        int irq = msi->irq & ZPCI_MSI_MASK;
-        struct msi_map *map;
-
-        msi->msg.address_lo = 0;
-        msi->msg.address_hi = 0;
-        msi->msg.data = 0;
-        msi->irq = 0;
-        zpci_msi_set_mask_bits(msi, 1, 1);
-
-        spin_lock(&msi_map_lock);
-        map = zdev->msi_map[irq];
-        hlist_del_rcu(&map->msi_chain);
-        kfree(map);
-        zdev->msi_map[irq] = NULL;
-        spin_unlock(&msi_map_lock);
-}
-
-/*
- * The msi hash table has 256 entries which is good for 4..20
- * devices (a typical device allocates 10 + CPUs MSI's). Maybe make
- * the hash table size adjustable later.
- */
-int __init zpci_msihash_init(void)
-{
-        unsigned int i;
-
-        msi_hash = kmalloc(MSI_HASH_BUCKETS * sizeof(*msi_hash), GFP_KERNEL);
-        if (!msi_hash)
-                return -ENOMEM;
-
-        for (i = 0; i < MSI_HASH_BUCKETS; i++)
-                INIT_HLIST_HEAD(&msi_hash[i]);
-        return 0;
-}
-
-void __init zpci_msihash_exit(void)
-{
-        kfree(msi_hash);
-}
diff --git a/arch/s390/pci/pci_sysfs.c b/arch/s390/pci/pci_sysfs.c
index e99a2557f186..cf8a12ff733b 100644
--- a/arch/s390/pci/pci_sysfs.c
+++ b/arch/s390/pci/pci_sysfs.c
@@ -48,11 +48,38 @@ static ssize_t show_pfgid(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR(pfgid, S_IRUGO, show_pfgid, NULL);
 
+static void recover_callback(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct zpci_dev *zdev = get_zdev(pdev);
+        int ret;
+
+        pci_stop_and_remove_bus_device(pdev);
+        ret = zpci_disable_device(zdev);
+        if (ret)
+                return;
+
+        ret = zpci_enable_device(zdev);
+        if (ret)
+                return;
+
+        pci_rescan_bus(zdev->bus);
+}
+
+static ssize_t store_recover(struct device *dev, struct device_attribute *attr,
+                             const char *buf, size_t count)
+{
+        int rc = device_schedule_callback(dev, recover_callback);
+        return rc ? rc : count;
+}
+static DEVICE_ATTR(recover, S_IWUSR, NULL, store_recover);
+
 static struct device_attribute *zpci_dev_attrs[] = {
         &dev_attr_function_id,
         &dev_attr_function_handle,
         &dev_attr_pchid,
         &dev_attr_pfgid,
+        &dev_attr_recover,
         NULL,
 };
 
diff --git a/arch/score/Kconfig b/arch/score/Kconfig
index c8def8bc9020..5fc237581caf 100644
--- a/arch/score/Kconfig
+++ b/arch/score/Kconfig
@@ -87,6 +87,8 @@ config STACKTRACE_SUPPORT
 
 source "init/Kconfig"
 
+source "kernel/Kconfig.freezer"
+
 config MMU
         def_bool y
 
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index 1020dd85431a..1018ed3a3ca5 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -643,9 +643,9 @@ config KEXEC
 
           It is an ongoing process to be certain the hardware in a machine
           is properly shutdown, so do not be surprised if this code does not
-          initially work for you.  It may help to enable device hotplugging
-          support.  As of this writing the exact hardware interface is
-          strongly in flux, so no good recommendation can be made.
+          initially work for you.  As of this writing the exact hardware
+          interface is strongly in flux, so no good recommendation can be
+          made.
 
 config CRASH_DUMP
         bool "kernel crash dumps (EXPERIMENTAL)"
diff --git a/arch/sh/boards/board-espt.c b/arch/sh/boards/board-espt.c
index 4d94dff9015c..7291e2f11a47 100644
--- a/arch/sh/boards/board-espt.c
+++ b/arch/sh/boards/board-espt.c
@@ -80,7 +80,6 @@ static struct resource sh_eth_resources[] = {
 static struct sh_eth_plat_data sh7763_eth_pdata = {
         .phy = 0,
         .edmac_endian = EDMAC_LITTLE_ENDIAN,
-        .register_type = SH_ETH_REG_GIGABIT,
         .phy_interface = PHY_INTERFACE_MODE_MII,
 };
 
diff --git a/arch/sh/boards/board-sh7757lcr.c b/arch/sh/boards/board-sh7757lcr.c
index 4f114d1cd019..25c5a932f9fe 100644
--- a/arch/sh/boards/board-sh7757lcr.c
+++ b/arch/sh/boards/board-sh7757lcr.c
@@ -77,7 +77,6 @@ static struct resource sh_eth0_resources[] = {
 static struct sh_eth_plat_data sh7757_eth0_pdata = {
         .phy = 1,
         .edmac_endian = EDMAC_LITTLE_ENDIAN,
-        .register_type = SH_ETH_REG_FAST_SH4,
         .set_mdio_gate = sh7757_eth_set_mdio_gate,
 };
 
@@ -106,7 +105,6 @@ static struct resource sh_eth1_resources[] = {
 static struct sh_eth_plat_data sh7757_eth1_pdata = {
         .phy = 1,
         .edmac_endian = EDMAC_LITTLE_ENDIAN,
-        .register_type = SH_ETH_REG_FAST_SH4,
         .set_mdio_gate = sh7757_eth_set_mdio_gate,
 };
 
@@ -151,7 +149,6 @@ static struct resource sh_eth_giga0_resources[] = {
 static struct sh_eth_plat_data sh7757_eth_giga0_pdata = {
         .phy = 18,
         .edmac_endian = EDMAC_LITTLE_ENDIAN,
-        .register_type = SH_ETH_REG_GIGABIT,
         .set_mdio_gate = sh7757_eth_giga_set_mdio_gate,
         .phy_interface = PHY_INTERFACE_MODE_RGMII_ID,
 };
@@ -186,7 +183,6 @@ static struct resource sh_eth_giga1_resources[] = {
 static struct sh_eth_plat_data sh7757_eth_giga1_pdata = {
         .phy = 19,
         .edmac_endian = EDMAC_LITTLE_ENDIAN,
-        .register_type = SH_ETH_REG_GIGABIT,
         .set_mdio_gate = sh7757_eth_giga_set_mdio_gate,
         .phy_interface = PHY_INTERFACE_MODE_RGMII_ID,
 };
diff --git a/arch/sh/boards/mach-ecovec24/setup.c b/arch/sh/boards/mach-ecovec24/setup.c
index 61fade0ffa96..a4f630f04ea3 100644
--- a/arch/sh/boards/mach-ecovec24/setup.c
+++ b/arch/sh/boards/mach-ecovec24/setup.c
@@ -159,7 +159,6 @@ static struct resource sh_eth_resources[] = {
 static struct sh_eth_plat_data sh_eth_plat = {
         .phy = 0x1f, /* SMSC LAN8700 */
         .edmac_endian = EDMAC_LITTLE_ENDIAN,
-        .register_type = SH_ETH_REG_FAST_SH4,
         .phy_interface = PHY_INTERFACE_MODE_MII,
         .ether_link_active_low = 1
 };
diff --git a/arch/sh/boards/mach-se/7724/setup.c b/arch/sh/boards/mach-se/7724/setup.c
index b70180ef3e29..21e4230659a5 100644
--- a/arch/sh/boards/mach-se/7724/setup.c
+++ b/arch/sh/boards/mach-se/7724/setup.c
@@ -365,7 +365,7 @@ static struct platform_device keysc_device = {
 static struct resource sh_eth_resources[] = {
         [0] = {
                 .start = SH_ETH_ADDR,
-                .end   = SH_ETH_ADDR + 0x1FC,
+                .end   = SH_ETH_ADDR + 0x1FC - 1,
                 .flags = IORESOURCE_MEM,
         },
         [1] = {
@@ -377,6 +377,7 @@ static struct resource sh_eth_resources[] = {
 static struct sh_eth_plat_data sh_eth_plat = {
         .phy = 0x1f, /* SMSC LAN8187 */
         .edmac_endian = EDMAC_LITTLE_ENDIAN,
+        .phy_interface = PHY_INTERFACE_MODE_MII,
 };
 
 static struct platform_device sh_eth_device = {
diff --git a/arch/sh/boards/mach-sh7763rdp/setup.c b/arch/sh/boards/mach-sh7763rdp/setup.c
index 50ba481fa240..2c8fb04685d4 100644
--- a/arch/sh/boards/mach-sh7763rdp/setup.c
+++ b/arch/sh/boards/mach-sh7763rdp/setup.c
@@ -88,7 +88,6 @@ static struct resource sh_eth_resources[] = {
 static struct sh_eth_plat_data sh7763_eth_pdata = {
         .phy = 1,
         .edmac_endian = EDMAC_LITTLE_ENDIAN,
-        .register_type = SH_ETH_REG_GIGABIT,
         .phy_interface = PHY_INTERFACE_MODE_MII,
 };
 
diff --git a/arch/sh/drivers/pci/pci.c b/arch/sh/drivers/pci/pci.c
index 102f5d58b037..60ed3e1c4b75 100644
--- a/arch/sh/drivers/pci/pci.c
+++ b/arch/sh/drivers/pci/pci.c
@@ -69,7 +69,6 @@ static void pcibios_scanbus(struct pci_channel *hose)
 
                 pci_bus_size_bridges(bus);
                 pci_bus_assign_resources(bus);
-                pci_enable_bridges(bus);
         } else {
                 pci_free_resource_list(&resources);
         }
diff --git a/arch/sh/include/asm/tlb.h b/arch/sh/include/asm/tlb.h
index e61d43d9f689..362192ed12fe 100644
--- a/arch/sh/include/asm/tlb.h
+++ b/arch/sh/include/asm/tlb.h
@@ -36,10 +36,12 @@ static inline void init_tlb_gather(struct mmu_gather *tlb)
 }
 
 static inline void
-tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned int full_mm_flush)
+tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
 {
         tlb->mm = mm;
-        tlb->fullmm = full_mm_flush;
+        tlb->start = start;
+        tlb->end = end;
+        tlb->fullmm = !(start | (end+1));
 
         init_tlb_gather(tlb);
 }
diff --git a/arch/sh/kernel/cpu/sh2/setup-sh7619.c b/arch/sh/kernel/cpu/sh2/setup-sh7619.c
index bb11e1925178..4df4d4ffe39b 100644
--- a/arch/sh/kernel/cpu/sh2/setup-sh7619.c
+++ b/arch/sh/kernel/cpu/sh2/setup-sh7619.c
@@ -12,6 +12,7 @@
 #include <linux/init.h>
 #include <linux/serial.h>
 #include <linux/serial_sci.h>
+#include <linux/sh_eth.h>
 #include <linux/sh_timer.h>
 #include <linux/io.h>
 
@@ -110,10 +111,16 @@ static struct platform_device scif2_device = {
         },
 };
 
+static struct sh_eth_plat_data eth_platform_data = {
+        .phy            = 1,
+        .edmac_endian   = EDMAC_LITTLE_ENDIAN,
+        .phy_interface  = PHY_INTERFACE_MODE_MII,
+};
+
 static struct resource eth_resources[] = {
         [0] = {
                 .start = 0xfb000000,
-                .end =   0xfb0001c8,
+                .end = 0xfb0001c7,
                 .flags = IORESOURCE_MEM,
         },
         [1] = {
@@ -127,7 +134,7 @@ static struct platform_device eth_device = {
         .name = "sh7619-ether",
         .id = -1,
         .dev = {
-                .platform_data = (void *)1,
+                .platform_data = &eth_platform_data,
         },
         .num_resources = ARRAY_SIZE(eth_resources),
         .resource = eth_resources,
diff --git a/arch/sh/kernel/cpu/shmobile/cpuidle.c b/arch/sh/kernel/cpu/shmobile/cpuidle.c
index d30622592116..e3abfd4277e2 100644
--- a/arch/sh/kernel/cpu/shmobile/cpuidle.c
+++ b/arch/sh/kernel/cpu/shmobile/cpuidle.c
@@ -91,13 +91,11 @@ static struct cpuidle_driver cpuidle_driver = {
 
 int __init sh_mobile_setup_cpuidle(void)
 {
-        int ret;
-
         if (sh_mobile_sleep_supported & SUSP_SH_SF)
                 cpuidle_driver.states[1].disabled = false;
 
         if (sh_mobile_sleep_supported & SUSP_SH_STANDBY)
                 cpuidle_driver.states[2].disabled = false;
 
-        return cpuidle_register(&cpuidle_driver);
+        return cpuidle_register(&cpuidle_driver, NULL);
 }
diff --git a/arch/sparc/include/asm/switch_to_64.h b/arch/sparc/include/asm/switch_to_64.h
index c7de3323819c..8d284801f232 100644
--- a/arch/sparc/include/asm/switch_to_64.h
+++ b/arch/sparc/include/asm/switch_to_64.h
@@ -48,8 +48,8 @@ do {	save_and_clear_fpu();						\
         "wrpr   %%g0, 14, %%pil\n\t"                                    \
         "brz,pt %%o7, switch_to_pc\n\t"                                 \
         " mov   %%g7, %0\n\t"                                           \
-        "sethi  %%hi(ret_from_syscall), %%g1\n\t"                       \
-        "jmpl   %%g1 + %%lo(ret_from_syscall), %%g0\n\t"                \
+        "sethi  %%hi(ret_from_fork), %%g1\n\t"                          \
+        "jmpl   %%g1 + %%lo(ret_from_fork), %%g0\n\t"                   \
         " nop\n\t"                                                      \
         ".globl switch_to_pc\n\t"                                       \
         "switch_to_pc:\n\t"                                             \
diff --git a/arch/sparc/kernel/cpumap.c b/arch/sparc/kernel/cpumap.c
index e4de74c2c9b0..cb5d272d658a 100644
--- a/arch/sparc/kernel/cpumap.c
+++ b/arch/sparc/kernel/cpumap.c
@@ -327,6 +327,7 @@ static int iterate_cpu(struct cpuinfo_tree *t, unsigned int root_index)
         case SUN4V_CHIP_NIAGARA3:
         case SUN4V_CHIP_NIAGARA4:
         case SUN4V_CHIP_NIAGARA5:
+        case SUN4V_CHIP_SPARC64X:
                 rover_inc_table = niagara_iterate_method;
                 break;
         default:
diff --git a/arch/sparc/kernel/entry.S b/arch/sparc/kernel/entry.S
index e2a030045089..33c02b15f478 100644
--- a/arch/sparc/kernel/entry.S
+++ b/arch/sparc/kernel/entry.S
@@ -839,7 +839,7 @@ sys_sigreturn:
          nop
 
         call    syscall_trace
-         nop
+         mov    1, %o1
 
 1:
         /* We don't want to muck with user registers like a
diff --git a/arch/sparc/kernel/kgdb_64.c b/arch/sparc/kernel/kgdb_64.c
index c8759550799f..53c0a82e6030 100644
--- a/arch/sparc/kernel/kgdb_64.c
+++ b/arch/sparc/kernel/kgdb_64.c
@@ -42,7 +42,7 @@ void sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *p)
 {
         struct thread_info *t = task_thread_info(p);
         extern unsigned int switch_to_pc;
-        extern unsigned int ret_from_syscall;
+        extern unsigned int ret_from_fork;
         struct reg_window *win;
         unsigned long pc, cwp;
         int i;
@@ -66,7 +66,7 @@ void sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *p)
                 gdb_regs[i] = 0;
 
         if (t->new_child)
-                pc = (unsigned long) &ret_from_syscall;
+                pc = (unsigned long) &ret_from_fork;
         else
                 pc = (unsigned long) &switch_to_pc;
 
diff --git a/arch/sparc/kernel/ktlb.S b/arch/sparc/kernel/ktlb.S
index 0746e5e32b37..fde5a419cf27 100644
--- a/arch/sparc/kernel/ktlb.S
+++ b/arch/sparc/kernel/ktlb.S
@@ -25,11 +25,10 @@ kvmap_itlb:
          */
 kvmap_itlb_4v:
 
-kvmap_itlb_nonlinear:
         /* Catch kernel NULL pointer calls.  */
         sethi           %hi(PAGE_SIZE), %g5
         cmp             %g4, %g5
-        bleu,pn         %xcc, kvmap_dtlb_longpath
+        blu,pn          %xcc, kvmap_itlb_longpath
          nop
 
         KERN_TSB_LOOKUP_TL1(%g4, %g6, %g5, %g1, %g2, %g3, kvmap_itlb_load)
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index 7ff45e4ba681..773c1f2983ce 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -14,6 +14,7 @@
 #include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/errno.h>
+#include <linux/export.h>
 #include <linux/ptrace.h>
 #include <linux/user.h>
 #include <linux/smp.h>
@@ -116,6 +117,7 @@ void flush_ptrace_access(struct vm_area_struct *vma, struct page *page,
 
         preempt_enable();
 }
+EXPORT_SYMBOL_GPL(flush_ptrace_access);
 
 static int get_from_target(struct task_struct *target, unsigned long uaddr,
                            void *kbuf, int len)
@@ -1087,7 +1089,7 @@ asmlinkage void syscall_trace_leave(struct pt_regs *regs)
         audit_syscall_exit(regs);
 
         if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
-                trace_sys_exit(regs, regs->u_regs[UREG_G1]);
+                trace_sys_exit(regs, regs->u_regs[UREG_I0]);
 
         if (test_thread_flag(TIF_SYSCALL_TRACE))
                 tracehook_report_syscall_exit(regs, 0);
diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
index 13785547e435..3fdb455e3318 100644
--- a/arch/sparc/kernel/setup_64.c
+++ b/arch/sparc/kernel/setup_64.c
@@ -499,12 +499,14 @@ static void __init init_sparc64_elf_hwcap(void)
                     sun4v_chip_type == SUN4V_CHIP_NIAGARA2 ||
                     sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
                     sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
-                    sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
+                    sun4v_chip_type == SUN4V_CHIP_SPARC64X)
                         cap |= HWCAP_SPARC_BLKINIT;
                 if (sun4v_chip_type == SUN4V_CHIP_NIAGARA2 ||
                     sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
                     sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
-                    sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
+                    sun4v_chip_type == SUN4V_CHIP_SPARC64X)
                         cap |= HWCAP_SPARC_N2;
         }
 
@@ -530,13 +532,15 @@ static void __init init_sparc64_elf_hwcap(void)
                         if (sun4v_chip_type == SUN4V_CHIP_NIAGARA2 ||
                             sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
                             sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
-                            sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
+                            sun4v_chip_type == SUN4V_CHIP_SPARC64X)
                                 cap |= (AV_SPARC_VIS | AV_SPARC_VIS2 |
                                         AV_SPARC_ASI_BLK_INIT |
                                         AV_SPARC_POPC);
                         if (sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
                             sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
-                            sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
+                            sun4v_chip_type == SUN4V_CHIP_SPARC64X)
                                 cap |= (AV_SPARC_VIS3 | AV_SPARC_HPC |
                                         AV_SPARC_FMAF);
                 }
diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
index 22a1098961f5..d950197a17e1 100644
--- a/arch/sparc/kernel/syscalls.S
+++ b/arch/sparc/kernel/syscalls.S
@@ -98,8 +98,8 @@ sys_clone:
         ba,pt   %xcc, sparc_do_fork
          add    %sp, PTREGS_OFF, %o2
 
-        .globl  ret_from_syscall
-ret_from_syscall:
+        .globl  ret_from_fork
+ret_from_fork:
         /* Clear current_thread_info()->new_child. */
         stb     %g0, [%g6 + TI_NEW_CHILD]
         call    schedule_tail
@@ -152,7 +152,7 @@ linux_syscall_trace32:
         srl     %i4, 0, %o4
         srl     %i1, 0, %o1
         srl     %i2, 0, %o2
-        ba,pt   %xcc, 2f
+        ba,pt   %xcc, 5f
          srl    %i3, 0, %o3
 
 linux_syscall_trace:
@@ -182,13 +182,13 @@ linux_sparc_syscall32:
         srl     %i1, 0, %o1                             ! IEU0  Group
         ldx     [%g6 + TI_FLAGS], %l0           ! Load
 
-        srl     %i5, 0, %o5                             ! IEU1
+        srl     %i3, 0, %o3                             ! IEU0
         srl     %i2, 0, %o2                             ! IEU0  Group
         andcc   %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %g0
         bne,pn  %icc, linux_syscall_trace32             ! CTI
          mov    %i0, %l5                                ! IEU1
-        call    %l7                                     ! CTI   Group brk forced
-         srl    %i3, 0, %o3                             ! IEU0
+5:      call    %l7                                     ! CTI   Group brk forced
+         srl    %i5, 0, %o5                             ! IEU1
         ba,a,pt %xcc, 3f
 
         /* Linux native system calls enter here... */
diff --git a/arch/sparc/kernel/trampoline_64.S b/arch/sparc/kernel/trampoline_64.S
index e0b1e13a0736..ad4bde3bb61e 100644
--- a/arch/sparc/kernel/trampoline_64.S
+++ b/arch/sparc/kernel/trampoline_64.S
@@ -129,7 +129,6 @@ startup_continue:
         clr             %l5
         sethi           %hi(num_kernel_image_mappings), %l6
         lduw            [%l6 + %lo(num_kernel_image_mappings)], %l6
-        add             %l6, 1, %l6
 
         mov             15, %l7
         BRANCH_IF_ANY_CHEETAH(g1,g5,2f)
@@ -222,7 +221,6 @@ niagara_lock_tlb:
         clr             %l5
         sethi           %hi(num_kernel_image_mappings), %l6
         lduw            [%l6 + %lo(num_kernel_image_mappings)], %l6
-        add             %l6, 1, %l6
 
 1:
         mov             HV_FAST_MMU_MAP_PERM_ADDR, %o5
diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
index 0c4e35e522fa..323335b9cd2b 100644
--- a/arch/sparc/lib/ksyms.c
+++ b/arch/sparc/lib/ksyms.c
@@ -98,15 +98,6 @@ EXPORT_SYMBOL(___copy_from_user);
 EXPORT_SYMBOL(___copy_in_user);
 EXPORT_SYMBOL(__clear_user);
 
-/* RW semaphores */
-EXPORT_SYMBOL(__down_read);
-EXPORT_SYMBOL(__down_read_trylock);
-EXPORT_SYMBOL(__down_write);
-EXPORT_SYMBOL(__down_write_trylock);
-EXPORT_SYMBOL(__up_read);
-EXPORT_SYMBOL(__up_write);
-EXPORT_SYMBOL(__downgrade_write);
-
 /* Atomic counter implementation. */
 EXPORT_SYMBOL(atomic_add);
 EXPORT_SYMBOL(atomic_add_ret);
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index 24565a7ffe6d..6e1ed55f6cfc 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
@@ -26,6 +26,7 @@ config TILE
         select HAVE_SYSCALL_TRACEPOINTS
         select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
         select HAVE_DEBUG_STACKOVERFLOW
+        select ARCH_WANT_FRAME_POINTERS
 
 # FIXME: investigate whether we need/want these options.
 #       select HAVE_IOREMAP_PROT
@@ -64,6 +65,9 @@ config HUGETLB_SUPER_PAGES
         depends on HUGETLB_PAGE && TILEGX
         def_bool y
 
+config GENERIC_TIME_VSYSCALL
+        def_bool y
+
 # FIXME: tilegx can implement a more efficient rwsem.
 config RWSEM_GENERIC_SPINLOCK
         def_bool y
@@ -112,10 +116,19 @@ config SMP
 config HVC_TILE
         depends on TTY
         select HVC_DRIVER
+        select HVC_IRQ if TILEGX
         def_bool y
 
 config TILEGX
-        bool "Building with TILE-Gx (64-bit) compiler and toolchain"
+        bool "Building for TILE-Gx (64-bit) processor"
+        select HAVE_FUNCTION_TRACER
+        select HAVE_FUNCTION_TRACE_MCOUNT_TEST
+        select HAVE_FUNCTION_GRAPH_TRACER
+        select HAVE_DYNAMIC_FTRACE
+        select HAVE_FTRACE_MCOUNT_RECORD
+        select HAVE_KPROBES
+        select HAVE_KRETPROBES
+        select HAVE_ARCH_KGDB
 
 config TILEPRO
         def_bool !TILEGX
@@ -194,7 +207,7 @@ config SYSVIPC_COMPAT
         def_bool y
         depends on COMPAT && SYSVIPC
 
-# We do not currently support disabling HIGHMEM on tile64 and tilepro.
+# We do not currently support disabling HIGHMEM on tilepro.
 config HIGHMEM
         bool # "Support for more than 512 MB of RAM"
         default !TILEGX
@@ -300,6 +313,8 @@ config PAGE_OFFSET
 
 source "mm/Kconfig"
 
+source "kernel/Kconfig.preempt"
+
 config CMDLINE_BOOL
         bool "Built-in kernel command line"
         default n
@@ -396,8 +411,20 @@ config NO_IOMEM
 config NO_IOPORT
         def_bool !PCI
 
+config TILE_PCI_IO
+        bool "PCI I/O space support"
+        default n
+        depends on PCI
+        depends on TILEGX
+        ---help---
+          Enable PCI I/O space support on TILEGx. Since the PCI I/O space
+          is used by few modern PCIe endpoint devices, its support is disabled
+          by default to save the TRIO PIO Region resource for other purposes.
+
 source "drivers/pci/Kconfig"
 
+source "drivers/pci/pcie/Kconfig"
+
 config TILE_USB
         tristate "Tilera USB host adapter support"
         default y
diff --git a/arch/tile/Kconfig.debug b/arch/tile/Kconfig.debug
index 9165ea979e85..19734d3ab1e8 100644
--- a/arch/tile/Kconfig.debug
+++ b/arch/tile/Kconfig.debug
@@ -14,14 +14,12 @@ config EARLY_PRINTK
           with klogd/syslogd. You should normally N here,
           unless you want to debug such a crash.
 
-config DEBUG_EXTRA_FLAGS
-        string "Additional compiler arguments when building with '-g'"
-        depends on DEBUG_INFO
-        default ""
+config TILE_HVGLUE_TRACE
+        bool "Provide wrapper functions for hypervisor ABI calls"
+        default n
         help
-          Debug info can be large, and flags like
-          `-femit-struct-debug-baseonly' can reduce the kernel file
-          size and build time noticeably.  Such flags are often
-          helpful if the main use of debug info is line number info.
+          Provide wrapper functions for the hypervisor ABI calls
+          defined in arch/tile/kernel/hvglue.S.  This allows tracing
+          mechanisms, etc., to have visibility into those calls.
 
 endmenu
diff --git a/arch/tile/Makefile b/arch/tile/Makefile
index 3d15364c6071..4dc380a519d4 100644
--- a/arch/tile/Makefile
+++ b/arch/tile/Makefile
@@ -30,10 +30,6 @@ endif
 # In kernel modules, this causes load failures due to unsupported relocations.
 KBUILD_CFLAGS   += -fno-asynchronous-unwind-tables
 
-ifneq ($(CONFIG_DEBUG_EXTRA_FLAGS),"")
-KBUILD_CFLAGS   += $(CONFIG_DEBUG_EXTRA_FLAGS)
-endif
-
 LIBGCC_PATH     := \
   $(shell $(CC) $(KBUILD_CFLAGS) $(KCFLAGS) -print-libgcc-file-name)
 
diff --git a/arch/tile/configs/tilegx_defconfig b/arch/tile/configs/tilegx_defconfig
index 47684815e5c8..730e40d9cf62 100644
--- a/arch/tile/configs/tilegx_defconfig
+++ b/arch/tile/configs/tilegx_defconfig
@@ -1,16 +1,15 @@
 CONFIG_TILEGX=y
-CONFIG_EXPERIMENTAL=y
-# CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
+CONFIG_FHANDLE=y
+CONFIG_AUDIT=y
+CONFIG_NO_HZ=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
-CONFIG_FHANDLE=y
 CONFIG_TASKSTATS=y
 CONFIG_TASK_DELAY_ACCT=y
 CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
-CONFIG_AUDIT=y
 CONFIG_LOG_BUF_SHIFT=19
 CONFIG_CGROUPS=y
 CONFIG_CGROUP_DEBUG=y
@@ -18,18 +17,18 @@ CONFIG_CGROUP_DEVICE=y
 CONFIG_CPUSETS=y
 CONFIG_CGROUP_CPUACCT=y
 CONFIG_RESOURCE_COUNTERS=y
-CONFIG_CGROUP_MEMCG=y
-CONFIG_CGROUP_MEMCG_SWAP=y
 CONFIG_CGROUP_SCHED=y
 CONFIG_RT_GROUP_SCHED=y
 CONFIG_BLK_CGROUP=y
 CONFIG_NAMESPACES=y
 CONFIG_RELAY=y
 CONFIG_BLK_DEV_INITRD=y
+CONFIG_RD_XZ=y
 CONFIG_SYSCTL_SYSCALL=y
 CONFIG_EMBEDDED=y
 # CONFIG_COMPAT_BRK is not set
 CONFIG_PROFILING=y
+CONFIG_KPROBES=y
 CONFIG_MODULES=y
 CONFIG_MODULE_FORCE_LOAD=y
 CONFIG_MODULE_UNLOAD=y
@@ -45,12 +44,12 @@ CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_SGI_PARTITION=y
 CONFIG_SUN_PARTITION=y
 CONFIG_KARMA_PARTITION=y
-CONFIG_EFI_PARTITION=y
 CONFIG_CFQ_GROUP_IOSCHED=y
 CONFIG_NR_CPUS=100
-CONFIG_NO_HZ=y
-CONFIG_HIGH_RES_TIMERS=y
 CONFIG_HZ_100=y
+# CONFIG_COMPACTION is not set
+CONFIG_PREEMPT_VOLUNTARY=y
+CONFIG_TILE_PCI_IO=y
 CONFIG_PCI_DEBUG=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_BINFMT_MISC=y
@@ -108,150 +107,9 @@ CONFIG_IPV6_MULTIPLE_TABLES=y
 CONFIG_IPV6_MROUTE=y
 CONFIG_IPV6_PIMSM_V2=y
 CONFIG_NETLABEL=y
-CONFIG_NETFILTER=y
-CONFIG_NF_CONNTRACK=m
-CONFIG_NF_CONNTRACK_SECMARK=y
-CONFIG_NF_CONNTRACK_ZONES=y
-CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CT_PROTO_DCCP=m
-CONFIG_NF_CT_PROTO_UDPLITE=m
-CONFIG_NF_CONNTRACK_AMANDA=m
-CONFIG_NF_CONNTRACK_FTP=m
-CONFIG_NF_CONNTRACK_H323=m
-CONFIG_NF_CONNTRACK_IRC=m
-CONFIG_NF_CONNTRACK_NETBIOS_NS=m
-CONFIG_NF_CONNTRACK_PPTP=m
-CONFIG_NF_CONNTRACK_SANE=m
-CONFIG_NF_CONNTRACK_SIP=m
-CONFIG_NF_CONNTRACK_TFTP=m
-CONFIG_NETFILTER_TPROXY=m
-CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
-CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
-CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
-CONFIG_NETFILTER_XT_TARGET_CT=m
-CONFIG_NETFILTER_XT_TARGET_DSCP=m
-CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
-CONFIG_NETFILTER_XT_TARGET_MARK=m
-CONFIG_NETFILTER_XT_TARGET_NFLOG=m
-CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
-CONFIG_NETFILTER_XT_TARGET_TEE=m
-CONFIG_NETFILTER_XT_TARGET_TPROXY=m
-CONFIG_NETFILTER_XT_TARGET_TRACE=m
-CONFIG_NETFILTER_XT_TARGET_SECMARK=m
-CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
-CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
-CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
-CONFIG_NETFILTER_XT_MATCH_COMMENT=m
-CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
-CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
-CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
-CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
-CONFIG_NETFILTER_XT_MATCH_DCCP=m
-CONFIG_NETFILTER_XT_MATCH_DSCP=m
-CONFIG_NETFILTER_XT_MATCH_ESP=m
-CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
-CONFIG_NETFILTER_XT_MATCH_HELPER=m
-CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
-CONFIG_NETFILTER_XT_MATCH_IPVS=m
-CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
-CONFIG_NETFILTER_XT_MATCH_MAC=m
-CONFIG_NETFILTER_XT_MATCH_MARK=m
-CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
-CONFIG_NETFILTER_XT_MATCH_OSF=m
-CONFIG_NETFILTER_XT_MATCH_OWNER=m
-CONFIG_NETFILTER_XT_MATCH_POLICY=m
-CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
-CONFIG_NETFILTER_XT_MATCH_QUOTA=m
-CONFIG_NETFILTER_XT_MATCH_RATEEST=m
-CONFIG_NETFILTER_XT_MATCH_REALM=m
-CONFIG_NETFILTER_XT_MATCH_RECENT=m
-CONFIG_NETFILTER_XT_MATCH_SOCKET=m
-CONFIG_NETFILTER_XT_MATCH_STATE=m
-CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
-CONFIG_NETFILTER_XT_MATCH_STRING=m
-CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
-CONFIG_NETFILTER_XT_MATCH_TIME=m
-CONFIG_NETFILTER_XT_MATCH_U32=m
-CONFIG_IP_VS=m
-CONFIG_IP_VS_IPV6=y
-CONFIG_IP_VS_PROTO_TCP=y
-CONFIG_IP_VS_PROTO_UDP=y
-CONFIG_IP_VS_PROTO_ESP=y
-CONFIG_IP_VS_PROTO_AH=y
-CONFIG_IP_VS_PROTO_SCTP=y
-CONFIG_IP_VS_RR=m
-CONFIG_IP_VS_WRR=m
-CONFIG_IP_VS_LC=m
-CONFIG_IP_VS_WLC=m
-CONFIG_IP_VS_LBLC=m
-CONFIG_IP_VS_LBLCR=m
-CONFIG_IP_VS_SED=m
-CONFIG_IP_VS_NQ=m
-CONFIG_NF_CONNTRACK_IPV4=m
-# CONFIG_NF_CONNTRACK_PROC_COMPAT is not set
-CONFIG_IP_NF_QUEUE=m
-CONFIG_IP_NF_IPTABLES=y
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_FILTER=y
-CONFIG_IP_NF_TARGET_REJECT=y
-CONFIG_IP_NF_TARGET_LOG=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_SECURITY=m
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_IP6_NF_QUEUE=m
-CONFIG_IP6_NF_IPTABLES=m
-CONFIG_IP6_NF_MATCH_AH=m
-CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_HL=m
-CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_TARGET_HL=m
-CONFIG_IP6_NF_TARGET_LOG=m
-CONFIG_IP6_NF_FILTER=m
-CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_MANGLE=m
-CONFIG_IP6_NF_RAW=m
-CONFIG_IP6_NF_SECURITY=m
-CONFIG_BRIDGE_NF_EBTABLES=m
-CONFIG_BRIDGE_EBT_BROUTE=m
-CONFIG_BRIDGE_EBT_T_FILTER=m
-CONFIG_BRIDGE_EBT_T_NAT=m
-CONFIG_BRIDGE_EBT_802_3=m
-CONFIG_BRIDGE_EBT_AMONG=m
-CONFIG_BRIDGE_EBT_ARP=m
-CONFIG_BRIDGE_EBT_IP=m
-CONFIG_BRIDGE_EBT_IP6=m
-CONFIG_BRIDGE_EBT_LIMIT=m
-CONFIG_BRIDGE_EBT_MARK=m
-CONFIG_BRIDGE_EBT_PKTTYPE=m
-CONFIG_BRIDGE_EBT_STP=m
-CONFIG_BRIDGE_EBT_VLAN=m
-CONFIG_BRIDGE_EBT_ARPREPLY=m
-CONFIG_BRIDGE_EBT_DNAT=m
-CONFIG_BRIDGE_EBT_MARK_T=m
-CONFIG_BRIDGE_EBT_REDIRECT=m
-CONFIG_BRIDGE_EBT_SNAT=m
-CONFIG_BRIDGE_EBT_LOG=m
-CONFIG_BRIDGE_EBT_ULOG=m
-CONFIG_BRIDGE_EBT_NFLOG=m
 CONFIG_RDS=m
 CONFIG_RDS_TCP=m
 CONFIG_BRIDGE=m
-CONFIG_NET_DSA=y
 CONFIG_VLAN_8021Q=m
 CONFIG_VLAN_8021Q_GVRP=y
 CONFIG_PHONET=m
@@ -292,13 +150,13 @@ CONFIG_NET_ACT_POLICE=m
 CONFIG_NET_ACT_GACT=m
 CONFIG_GACT_PROB=y
 CONFIG_NET_ACT_MIRRED=m
-CONFIG_NET_ACT_IPT=m
 CONFIG_NET_ACT_NAT=m
 CONFIG_NET_ACT_PEDIT=m
 CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_CLS_IND=y
 CONFIG_DCB=y
+CONFIG_DNS_RESOLVER=y
 # CONFIG_WIRELESS is not set
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
@@ -317,10 +175,12 @@ CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_CONSTANTS=y
 CONFIG_SCSI_LOGGING=y
 CONFIG_SCSI_SAS_ATA=y
+CONFIG_ISCSI_TCP=m
 CONFIG_SCSI_MVSAS=y
 # CONFIG_SCSI_MVSAS_DEBUG is not set
 CONFIG_SCSI_MVSAS_TASKLET=y
 CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
 CONFIG_SATA_SIL24=y
 # CONFIG_ATA_SFF is not set
 CONFIG_MD=y
@@ -343,6 +203,12 @@ CONFIG_DM_MULTIPATH_QL=m
 CONFIG_DM_MULTIPATH_ST=m
 CONFIG_DM_DELAY=m
 CONFIG_DM_UEVENT=y
+CONFIG_TARGET_CORE=m
+CONFIG_TCM_IBLOCK=m
+CONFIG_TCM_FILEIO=m
+CONFIG_TCM_PSCSI=m
+CONFIG_LOOPBACK_TARGET=m
+CONFIG_ISCSI_TARGET=m
 CONFIG_FUSION=y
 CONFIG_FUSION_SAS=y
 CONFIG_NETDEVICES=y
@@ -359,42 +225,8 @@ CONFIG_VETH=m
 CONFIG_NET_DSA_MV88E6060=y
 CONFIG_NET_DSA_MV88E6131=y
 CONFIG_NET_DSA_MV88E6123_61_65=y
-# CONFIG_NET_VENDOR_3COM is not set
-# CONFIG_NET_VENDOR_ADAPTEC is not set
-# CONFIG_NET_VENDOR_ALTEON is not set
-# CONFIG_NET_VENDOR_AMD is not set
-# CONFIG_NET_VENDOR_ATHEROS is not set
-# CONFIG_NET_VENDOR_BROADCOM is not set
-# CONFIG_NET_VENDOR_BROCADE is not set
-# CONFIG_NET_VENDOR_CHELSIO is not set
-# CONFIG_NET_VENDOR_CISCO is not set
-# CONFIG_NET_VENDOR_DEC is not set
-# CONFIG_NET_VENDOR_DLINK is not set
-# CONFIG_NET_VENDOR_EMULEX is not set
-# CONFIG_NET_VENDOR_EXAR is not set
-# CONFIG_NET_VENDOR_HP is not set
-# CONFIG_NET_VENDOR_INTEL is not set
-# CONFIG_NET_VENDOR_MARVELL is not set
-# CONFIG_NET_VENDOR_MELLANOX is not set
-# CONFIG_NET_VENDOR_MICREL is not set
-# CONFIG_NET_VENDOR_MYRI is not set
-# CONFIG_NET_VENDOR_NATSEMI is not set
-# CONFIG_NET_VENDOR_NVIDIA is not set
-# CONFIG_NET_VENDOR_OKI is not set
-# CONFIG_NET_PACKET_ENGINE is not set
-# CONFIG_NET_VENDOR_QLOGIC is not set
-# CONFIG_NET_VENDOR_REALTEK is not set
-# CONFIG_NET_VENDOR_RDC is not set
-# CONFIG_NET_VENDOR_SEEQ is not set
-# CONFIG_NET_VENDOR_SILAN is not set
-# CONFIG_NET_VENDOR_SIS is not set
-# CONFIG_NET_VENDOR_SMSC is not set
-# CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SUN is not set
-# CONFIG_NET_VENDOR_TEHUTI is not set
-# CONFIG_NET_VENDOR_TI is not set
-# CONFIG_TILE_NET is not set
-# CONFIG_NET_VENDOR_VIA is not set
+CONFIG_SKY2=y
+CONFIG_PTP_1588_CLOCK_TILEGX=y
 # CONFIG_WLAN is not set
 # CONFIG_INPUT_MOUSEDEV is not set
 # CONFIG_INPUT_KEYBOARD is not set
@@ -402,6 +234,7 @@ CONFIG_NET_DSA_MV88E6123_61_65=y
 # CONFIG_SERIO is not set
 # CONFIG_VT is not set
 # CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_TILEGX=y
 CONFIG_HW_RANDOM=y
 CONFIG_HW_RANDOM_TIMERIOMEM=m
 CONFIG_I2C=y
@@ -410,13 +243,16 @@ CONFIG_I2C_CHARDEV=y
 CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_NOWAYOUT=y
 # CONFIG_VGA_ARB is not set
-# CONFIG_HID_SUPPORT is not set
+CONFIG_DRM=m
+CONFIG_DRM_TDFX=m
+CONFIG_DRM_R128=m
+CONFIG_DRM_MGA=m
+CONFIG_DRM_VIA=m
+CONFIG_DRM_SAVAGE=m
 CONFIG_USB=y
-# CONFIG_USB_DEVICE_CLASS is not set
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_STORAGE=y
-CONFIG_USB_LIBUSUAL=y
 CONFIG_EDAC=y
 CONFIG_EDAC_MM_EDAC=y
 CONFIG_RTC_CLASS=y
@@ -464,9 +300,8 @@ CONFIG_ECRYPT_FS=m
 CONFIG_CRAMFS=m
 CONFIG_SQUASHFS=m
 CONFIG_NFS_FS=m
-CONFIG_NFS_V3=y
 CONFIG_NFS_V3_ACL=y
-CONFIG_NFS_V4=y
+CONFIG_NFS_V4=m
 CONFIG_NFS_V4_1=y
 CONFIG_NFS_FSCACHE=y
 CONFIG_NFSD=m
@@ -519,25 +354,28 @@ CONFIG_NLS_ISO8859_15=m
 CONFIG_NLS_KOI8_R=m
 CONFIG_NLS_KOI8_U=m
 CONFIG_NLS_UTF8=m
+CONFIG_DLM=m
 CONFIG_DLM_DEBUG=y
+CONFIG_DYNAMIC_DEBUG=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_INFO_REDUCED=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
-CONFIG_MAGIC_SYSRQ=y
 CONFIG_STRIP_ASM_SYMS=y
 CONFIG_DEBUG_FS=y
 CONFIG_HEADERS_CHECK=y
+# CONFIG_FRAME_POINTER is not set
+CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
+CONFIG_DEBUG_VM=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_LOCKUP_DETECTOR=y
 CONFIG_SCHEDSTATS=y
 CONFIG_TIMER_STATS=y
-CONFIG_DEBUG_INFO=y
-CONFIG_DEBUG_INFO_REDUCED=y
-CONFIG_DEBUG_VM=y
-CONFIG_DEBUG_MEMORY_INIT=y
 CONFIG_DEBUG_LIST=y
 CONFIG_DEBUG_CREDENTIALS=y
-CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
-CONFIG_DYNAMIC_DEBUG=y
+CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_ASYNC_RAID6_TEST=m
-CONFIG_DEBUG_STACKOVERFLOW=y
+CONFIG_KGDB=y
 CONFIG_KEYS_DEBUG_PROC_KEYS=y
 CONFIG_SECURITY=y
 CONFIG_SECURITYFS=y
@@ -546,7 +384,6 @@ CONFIG_SECURITY_NETWORK_XFRM=y
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_DISABLE=y
-CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_PCRYPT=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
@@ -559,14 +396,12 @@ CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_HMAC=y
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
-CONFIG_CRYPTO_CRC32C=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD128=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA1=y
-CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
diff --git a/arch/tile/configs/tilepro_defconfig b/arch/tile/configs/tilepro_defconfig
index dd2b8f0c631f..80fc32ed0491 100644
--- a/arch/tile/configs/tilepro_defconfig
+++ b/arch/tile/configs/tilepro_defconfig
@@ -1,15 +1,14 @@
-CONFIG_EXPERIMENTAL=y
-# CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
+CONFIG_AUDIT=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
-CONFIG_FHANDLE=y
 CONFIG_TASKSTATS=y
 CONFIG_TASK_DELAY_ACCT=y
 CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
-CONFIG_AUDIT=y
 CONFIG_LOG_BUF_SHIFT=19
 CONFIG_CGROUPS=y
 CONFIG_CGROUP_DEBUG=y
@@ -17,14 +16,13 @@ CONFIG_CGROUP_DEVICE=y
 CONFIG_CPUSETS=y
 CONFIG_CGROUP_CPUACCT=y
 CONFIG_RESOURCE_COUNTERS=y
-CONFIG_CGROUP_MEMCG=y
-CONFIG_CGROUP_MEMCG_SWAP=y
 CONFIG_CGROUP_SCHED=y
 CONFIG_RT_GROUP_SCHED=y
 CONFIG_BLK_CGROUP=y
 CONFIG_NAMESPACES=y
 CONFIG_RELAY=y
 CONFIG_BLK_DEV_INITRD=y
+CONFIG_RD_XZ=y
 CONFIG_SYSCTL_SYSCALL=y
 CONFIG_EMBEDDED=y
 # CONFIG_COMPAT_BRK is not set
@@ -44,11 +42,10 @@ CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_SGI_PARTITION=y
 CONFIG_SUN_PARTITION=y
 CONFIG_KARMA_PARTITION=y
-CONFIG_EFI_PARTITION=y
 CONFIG_CFQ_GROUP_IOSCHED=y
-CONFIG_NO_HZ=y
-CONFIG_HIGH_RES_TIMERS=y
 CONFIG_HZ_100=y
+# CONFIG_COMPACTION is not set
+CONFIG_PREEMPT_VOLUNTARY=y
 CONFIG_PCI_DEBUG=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_BINFMT_MISC=y
@@ -122,16 +119,15 @@ CONFIG_NF_CONNTRACK_PPTP=m
 CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
-CONFIG_NETFILTER_TPROXY=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
 CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
 CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
-CONFIG_NETFILTER_XT_TARGET_CT=m
 CONFIG_NETFILTER_XT_TARGET_DSCP=m
 CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
 CONFIG_NETFILTER_XT_TARGET_MARK=m
 CONFIG_NETFILTER_XT_TARGET_NFLOG=m
 CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
 CONFIG_NETFILTER_XT_TARGET_TEE=m
 CONFIG_NETFILTER_XT_TARGET_TPROXY=m
 CONFIG_NETFILTER_XT_TARGET_TRACE=m
@@ -189,14 +185,12 @@ CONFIG_IP_VS_SED=m
 CONFIG_IP_VS_NQ=m
 CONFIG_NF_CONNTRACK_IPV4=m
 # CONFIG_NF_CONNTRACK_PROC_COMPAT is not set
-CONFIG_IP_NF_QUEUE=m
 CONFIG_IP_NF_IPTABLES=y
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=y
 CONFIG_IP_NF_TARGET_REJECT=y
-CONFIG_IP_NF_TARGET_LOG=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_IP_NF_MANGLE=m
 CONFIG_IP_NF_TARGET_ECN=m
@@ -207,8 +201,6 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_IP6_NF_QUEUE=m
-CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
 CONFIG_IP6_NF_MATCH_FRAG=m
@@ -218,7 +210,6 @@ CONFIG_IP6_NF_MATCH_IPV6HEADER=m
 CONFIG_IP6_NF_MATCH_MH=m
 CONFIG_IP6_NF_MATCH_RT=m
 CONFIG_IP6_NF_TARGET_HL=m
-CONFIG_IP6_NF_TARGET_LOG=m
 CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
 CONFIG_IP6_NF_MANGLE=m
@@ -249,7 +240,6 @@ CONFIG_BRIDGE_EBT_NFLOG=m
 CONFIG_RDS=m
 CONFIG_RDS_TCP=m
 CONFIG_BRIDGE=m
-CONFIG_NET_DSA=y
 CONFIG_VLAN_8021Q=m
 CONFIG_VLAN_8021Q_GVRP=y
 CONFIG_PHONET=m
@@ -297,6 +287,7 @@ CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_CLS_IND=y
 CONFIG_DCB=y
+CONFIG_DNS_RESOLVER=y
 # CONFIG_WIRELESS is not set
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
@@ -354,40 +345,7 @@ CONFIG_NET_DSA_MV88E6060=y
 CONFIG_NET_DSA_MV88E6131=y
 CONFIG_NET_DSA_MV88E6123_61_65=y
 # CONFIG_NET_VENDOR_3COM is not set
-# CONFIG_NET_VENDOR_ADAPTEC is not set
-# CONFIG_NET_VENDOR_ALTEON is not set
-# CONFIG_NET_VENDOR_AMD is not set
-# CONFIG_NET_VENDOR_ATHEROS is not set
-# CONFIG_NET_VENDOR_BROADCOM is not set
-# CONFIG_NET_VENDOR_BROCADE is not set
-# CONFIG_NET_VENDOR_CHELSIO is not set
-# CONFIG_NET_VENDOR_CISCO is not set
-# CONFIG_NET_VENDOR_DEC is not set
-# CONFIG_NET_VENDOR_DLINK is not set
-# CONFIG_NET_VENDOR_EMULEX is not set
-# CONFIG_NET_VENDOR_EXAR is not set
-# CONFIG_NET_VENDOR_HP is not set
-# CONFIG_NET_VENDOR_INTEL is not set
-# CONFIG_NET_VENDOR_MARVELL is not set
-# CONFIG_NET_VENDOR_MELLANOX is not set
-# CONFIG_NET_VENDOR_MICREL is not set
-# CONFIG_NET_VENDOR_MYRI is not set
-# CONFIG_NET_VENDOR_NATSEMI is not set
-# CONFIG_NET_VENDOR_NVIDIA is not set
-# CONFIG_NET_VENDOR_OKI is not set
-# CONFIG_NET_PACKET_ENGINE is not set
-# CONFIG_NET_VENDOR_QLOGIC is not set
-# CONFIG_NET_VENDOR_REALTEK is not set
-# CONFIG_NET_VENDOR_RDC is not set
-# CONFIG_NET_VENDOR_SEEQ is not set
-# CONFIG_NET_VENDOR_SILAN is not set
-# CONFIG_NET_VENDOR_SIS is not set
-# CONFIG_NET_VENDOR_SMSC is not set
-# CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SUN is not set
-# CONFIG_NET_VENDOR_TEHUTI is not set
-# CONFIG_NET_VENDOR_TI is not set
-# CONFIG_NET_VENDOR_VIA is not set
+CONFIG_E1000E=y
 # CONFIG_WLAN is not set
 # CONFIG_INPUT_MOUSEDEV is not set
 # CONFIG_INPUT_KEYBOARD is not set
@@ -403,7 +361,6 @@ CONFIG_I2C_CHARDEV=y
 CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_NOWAYOUT=y
 # CONFIG_VGA_ARB is not set
-# CONFIG_HID_SUPPORT is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_EDAC=y
 CONFIG_EDAC_MM_EDAC=y
@@ -448,13 +405,13 @@ CONFIG_PROC_KCORE=y
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
 CONFIG_HUGETLBFS=y
+CONFIG_CONFIGFS_FS=m
 CONFIG_ECRYPT_FS=m
 CONFIG_CRAMFS=m
 CONFIG_SQUASHFS=m
 CONFIG_NFS_FS=m
-CONFIG_NFS_V3=y
 CONFIG_NFS_V3_ACL=y
-CONFIG_NFS_V4=y
+CONFIG_NFS_V4=m
 CONFIG_NFS_V4_1=y
 CONFIG_NFS_FSCACHE=y
 CONFIG_NFSD=m
@@ -508,26 +465,29 @@ CONFIG_NLS_ISO8859_15=m
 CONFIG_NLS_KOI8_R=m
 CONFIG_NLS_KOI8_U=m
 CONFIG_NLS_UTF8=m
+CONFIG_DLM=m
 CONFIG_DLM_DEBUG=y
+CONFIG_DYNAMIC_DEBUG=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_INFO_REDUCED=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 CONFIG_FRAME_WARN=2048
-CONFIG_MAGIC_SYSRQ=y
 CONFIG_STRIP_ASM_SYMS=y
 CONFIG_DEBUG_FS=y
 CONFIG_HEADERS_CHECK=y
+# CONFIG_FRAME_POINTER is not set
+CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_VM=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_LOCKUP_DETECTOR=y
 CONFIG_SCHEDSTATS=y
 CONFIG_TIMER_STATS=y
-CONFIG_DEBUG_INFO=y
-CONFIG_DEBUG_INFO_REDUCED=y
-CONFIG_DEBUG_VM=y
-CONFIG_DEBUG_MEMORY_INIT=y
 CONFIG_DEBUG_LIST=y
 CONFIG_DEBUG_CREDENTIALS=y
-CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
-CONFIG_DYNAMIC_DEBUG=y
+CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_ASYNC_RAID6_TEST=m
-CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_KEYS_DEBUG_PROC_KEYS=y
 CONFIG_SECURITY=y
 CONFIG_SECURITYFS=y
@@ -536,7 +496,6 @@ CONFIG_SECURITY_NETWORK_XFRM=y
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_DISABLE=y
-CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_PCRYPT=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
@@ -549,14 +508,12 @@ CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_HMAC=y
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
-CONFIG_CRYPTO_CRC32C=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD128=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA1=y
-CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
diff --git a/arch/tile/gxio/Kconfig b/arch/tile/gxio/Kconfig
index d221f8d6de8b..d4e10d58071b 100644
--- a/arch/tile/gxio/Kconfig
+++ b/arch/tile/gxio/Kconfig
@@ -26,3 +26,8 @@ config TILE_GXIO_TRIO
 config TILE_GXIO_USB_HOST
         bool
         select TILE_GXIO
+
+# Support direct access to the TILE-Gx UART hardware from kernel space.
+config TILE_GXIO_UART
+        bool
+        select TILE_GXIO
diff --git a/arch/tile/gxio/Makefile b/arch/tile/gxio/Makefile
index 8684bcaa74ea..26ae2c727467 100644
--- a/arch/tile/gxio/Makefile
+++ b/arch/tile/gxio/Makefile
@@ -6,4 +6,5 @@ obj-$(CONFIG_TILE_GXIO) += iorpc_globals.o kiorpc.o
 obj-$(CONFIG_TILE_GXIO_DMA) += dma_queue.o
 obj-$(CONFIG_TILE_GXIO_MPIPE) += mpipe.o iorpc_mpipe.o iorpc_mpipe_info.o
 obj-$(CONFIG_TILE_GXIO_TRIO) += trio.o iorpc_trio.o
+obj-$(CONFIG_TILE_GXIO_UART) += uart.o iorpc_uart.o
 obj-$(CONFIG_TILE_GXIO_USB_HOST) += usb_host.o iorpc_usb_host.o
diff --git a/arch/tile/gxio/iorpc_mpipe.c b/arch/tile/gxio/iorpc_mpipe.c
index 31b87bf8c027..4f8f3d619c4a 100644
--- a/arch/tile/gxio/iorpc_mpipe.c
+++ b/arch/tile/gxio/iorpc_mpipe.c
@@ -387,6 +387,27 @@ int gxio_mpipe_link_close_aux(gxio_mpipe_context_t * context, int mac)
 
 EXPORT_SYMBOL(gxio_mpipe_link_close_aux);
 
+struct link_set_attr_aux_param {
+        int mac;
+        uint32_t attr;
+        int64_t val;
+};
+
+int gxio_mpipe_link_set_attr_aux(gxio_mpipe_context_t * context, int mac,
+                                 uint32_t attr, int64_t val)
+{
+        struct link_set_attr_aux_param temp;
+        struct link_set_attr_aux_param *params = &temp;
+
+        params->mac = mac;
+        params->attr = attr;
+        params->val = val;
+
+        return hv_dev_pwrite(context->fd, 0, (HV_VirtAddr) params,
+                             sizeof(*params), GXIO_MPIPE_OP_LINK_SET_ATTR_AUX);
+}
+
+EXPORT_SYMBOL(gxio_mpipe_link_set_attr_aux);
 
 struct get_timestamp_aux_param {
         uint64_t sec;
@@ -454,6 +475,51 @@ int gxio_mpipe_adjust_timestamp_aux(gxio_mpipe_context_t * context,
 
 EXPORT_SYMBOL(gxio_mpipe_adjust_timestamp_aux);
 
+struct adjust_timestamp_freq_param {
+        int32_t ppb;
+};
+
+int gxio_mpipe_adjust_timestamp_freq(gxio_mpipe_context_t * context,
+                                     int32_t ppb)
+{
+        struct adjust_timestamp_freq_param temp;
+        struct adjust_timestamp_freq_param *params = &temp;
+
+        params->ppb = ppb;
+
+        return hv_dev_pwrite(context->fd, 0, (HV_VirtAddr) params,
+                             sizeof(*params),
+                             GXIO_MPIPE_OP_ADJUST_TIMESTAMP_FREQ);
+}
+
+EXPORT_SYMBOL(gxio_mpipe_adjust_timestamp_freq);
+
+struct config_edma_ring_blks_param {
+        unsigned int ering;
+        unsigned int max_blks;
+        unsigned int min_snf_blks;
+        unsigned int db;
+};
+
+int gxio_mpipe_config_edma_ring_blks(gxio_mpipe_context_t * context,
+                                     unsigned int ering, unsigned int max_blks,
+                                     unsigned int min_snf_blks, unsigned int db)
+{
+        struct config_edma_ring_blks_param temp;
+        struct config_edma_ring_blks_param *params = &temp;
+
+        params->ering = ering;
+        params->max_blks = max_blks;
+        params->min_snf_blks = min_snf_blks;
+        params->db = db;
+
+        return hv_dev_pwrite(context->fd, 0, (HV_VirtAddr) params,
+                             sizeof(*params),
+                             GXIO_MPIPE_OP_CONFIG_EDMA_RING_BLKS);
+}
+
+EXPORT_SYMBOL(gxio_mpipe_config_edma_ring_blks);
+
 struct arm_pollfd_param {
         union iorpc_pollfd pollfd;
 };
diff --git a/arch/tile/gxio/iorpc_mpipe_info.c b/arch/tile/gxio/iorpc_mpipe_info.c
index d0254aa60cba..64883aabeb9c 100644
--- a/arch/tile/gxio/iorpc_mpipe_info.c
+++ b/arch/tile/gxio/iorpc_mpipe_info.c
@@ -16,6 +16,24 @@
 #include "gxio/iorpc_mpipe_info.h"
 
 
+struct instance_aux_param {
+        _gxio_mpipe_link_name_t name;
+};
+
+int gxio_mpipe_info_instance_aux(gxio_mpipe_info_context_t * context,
+                                 _gxio_mpipe_link_name_t name)
+{
+        struct instance_aux_param temp;
+        struct instance_aux_param *params = &temp;
+
+        params->name = name;
+
+        return hv_dev_pwrite(context->fd, 0, (HV_VirtAddr) params,
+                             sizeof(*params), GXIO_MPIPE_INFO_OP_INSTANCE_AUX);
+}
+
+EXPORT_SYMBOL(gxio_mpipe_info_instance_aux);
+
 struct enumerate_aux_param {
         _gxio_mpipe_link_name_t name;
         _gxio_mpipe_link_mac_t mac;
diff --git a/arch/tile/gxio/iorpc_trio.c b/arch/tile/gxio/iorpc_trio.c
index cef4b2209cda..da6e18e049c3 100644
--- a/arch/tile/gxio/iorpc_trio.c
+++ b/arch/tile/gxio/iorpc_trio.c
@@ -61,6 +61,29 @@ int gxio_trio_alloc_memory_maps(gxio_trio_context_t * context,
 
 EXPORT_SYMBOL(gxio_trio_alloc_memory_maps);
 
+struct alloc_scatter_queues_param {
+        unsigned int count;
+        unsigned int first;
+        unsigned int flags;
+};
+
+int gxio_trio_alloc_scatter_queues(gxio_trio_context_t * context,
+                                   unsigned int count, unsigned int first,
+                                   unsigned int flags)
+{
+        struct alloc_scatter_queues_param temp;
+        struct alloc_scatter_queues_param *params = &temp;
+
+        params->count = count;
+        params->first = first;
+        params->flags = flags;
+
+        return hv_dev_pwrite(context->fd, 0, (HV_VirtAddr) params,
+                             sizeof(*params),
+                             GXIO_TRIO_OP_ALLOC_SCATTER_QUEUES);
+}
+
+EXPORT_SYMBOL(gxio_trio_alloc_scatter_queues);
 
 struct alloc_pio_regions_param {
         unsigned int count;
diff --git a/arch/tile/gxio/iorpc_uart.c b/arch/tile/gxio/iorpc_uart.c
new file mode 100644
index 000000000000..b9a6d6193d73
--- /dev/null
+++ b/arch/tile/gxio/iorpc_uart.c
@@ -0,0 +1,77 @@
+/*
+ * Copyright 2013 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+/* This file is machine-generated; DO NOT EDIT! */
+#include "gxio/iorpc_uart.h"
+
+struct cfg_interrupt_param {
+        union iorpc_interrupt interrupt;
+};
+
+int gxio_uart_cfg_interrupt(gxio_uart_context_t *context, int inter_x,
+                            int inter_y, int inter_ipi, int inter_event)
+{
+        struct cfg_interrupt_param temp;
+        struct cfg_interrupt_param *params = &temp;
+
+        params->interrupt.kernel.x = inter_x;
+        params->interrupt.kernel.y = inter_y;
+        params->interrupt.kernel.ipi = inter_ipi;
+        params->interrupt.kernel.event = inter_event;
+
+        return hv_dev_pwrite(context->fd, 0, (HV_VirtAddr) params,
+                             sizeof(*params), GXIO_UART_OP_CFG_INTERRUPT);
+}
+
+EXPORT_SYMBOL(gxio_uart_cfg_interrupt);
+
+struct get_mmio_base_param {
+        HV_PTE base;
+};
+
+int gxio_uart_get_mmio_base(gxio_uart_context_t *context, HV_PTE *base)
+{
+        int __result;
+        struct get_mmio_base_param temp;
+        struct get_mmio_base_param *params = &temp;
+
+        __result =
+            hv_dev_pread(context->fd, 0, (HV_VirtAddr) params, sizeof(*params),
+                         GXIO_UART_OP_GET_MMIO_BASE);
+        *base = params->base;
+
+        return __result;
+}
+
+EXPORT_SYMBOL(gxio_uart_get_mmio_base);
+
+struct check_mmio_offset_param {
+        unsigned long offset;
+        unsigned long size;
+};
+
+int gxio_uart_check_mmio_offset(gxio_uart_context_t *context,
+                                unsigned long offset, unsigned long size)
+{
+        struct check_mmio_offset_param temp;
+        struct check_mmio_offset_param *params = &temp;
+
+        params->offset = offset;
+        params->size = size;
+
+        return hv_dev_pwrite(context->fd, 0, (HV_VirtAddr) params,
+                             sizeof(*params), GXIO_UART_OP_CHECK_MMIO_OFFSET);
+}
+
+EXPORT_SYMBOL(gxio_uart_check_mmio_offset);
diff --git a/arch/tile/gxio/mpipe.c b/arch/tile/gxio/mpipe.c
index e71c63390acc..5301a9ffbae1 100644
--- a/arch/tile/gxio/mpipe.c
+++ b/arch/tile/gxio/mpipe.c
@@ -36,8 +36,14 @@ int gxio_mpipe_init(gxio_mpipe_context_t *context, unsigned int mpipe_index)
         int fd;
         int i;
 
+        if (mpipe_index >= GXIO_MPIPE_INSTANCE_MAX)
+                return -EINVAL;
+
         snprintf(file, sizeof(file), "mpipe/%d/iorpc", mpipe_index);
         fd = hv_dev_open((HV_VirtAddr) file, 0);
+
+        context->fd = fd;
+
         if (fd < 0) {
                 if (fd >= GXIO_ERR_MIN && fd <= GXIO_ERR_MAX)
                         return fd;
@@ -45,8 +51,6 @@ int gxio_mpipe_init(gxio_mpipe_context_t *context, unsigned int mpipe_index)
                         return -ENODEV;
         }
 
-        context->fd = fd;
-
         /* Map in the MMIO space. */
         context->mmio_cfg_base = (void __force *)
                 iorpc_ioremap(fd, HV_MPIPE_CONFIG_MMIO_OFFSET,
@@ -64,12 +68,15 @@ int gxio_mpipe_init(gxio_mpipe_context_t *context, unsigned int mpipe_index)
         for (i = 0; i < 8; i++)
                 context->__stacks.stacks[i] = 255;
 
+        context->instance = mpipe_index;
+
         return 0;
 
       fast_failed:
         iounmap((void __force __iomem *)(context->mmio_cfg_base));
       cfg_failed:
         hv_dev_close(context->fd);
+        context->fd = -1;
         return -ENODEV;
 }
 
@@ -383,7 +390,7 @@ EXPORT_SYMBOL_GPL(gxio_mpipe_iqueue_init);
 
 int gxio_mpipe_equeue_init(gxio_mpipe_equeue_t *equeue,
                            gxio_mpipe_context_t *context,
-                           unsigned int edma_ring_id,
+                           unsigned int ering,
                            unsigned int channel,
                            void *mem, unsigned int mem_size,
                            unsigned int mem_flags)
@@ -394,7 +401,7 @@ int gxio_mpipe_equeue_init(gxio_mpipe_equeue_t *equeue,
         /* Offset used to read number of completed commands. */
         MPIPE_EDMA_POST_REGION_ADDR_t offset;
 
-        int result = gxio_mpipe_init_edma_ring(context, edma_ring_id, channel,
+        int result = gxio_mpipe_init_edma_ring(context, ering, channel,
                                                mem, mem_size, mem_flags);
         if (result < 0)
                 return result;
@@ -405,7 +412,7 @@ int gxio_mpipe_equeue_init(gxio_mpipe_equeue_t *equeue,
         offset.region =
                 MPIPE_MMIO_ADDR__REGION_VAL_EDMA -
                 MPIPE_MMIO_ADDR__REGION_VAL_IDMA;
-        offset.ring = edma_ring_id;
+        offset.ring = ering;
 
         __gxio_dma_queue_init(&equeue->dma_queue,
                               context->mmio_fast_base + offset.word,
@@ -413,6 +420,9 @@ int gxio_mpipe_equeue_init(gxio_mpipe_equeue_t *equeue,
         equeue->edescs = mem;
         equeue->mask_num_entries = num_entries - 1;
         equeue->log2_num_entries = __builtin_ctz(num_entries);
+        equeue->context = context;
+        equeue->ering = ering;
+        equeue->channel = channel;
 
         return 0;
 }
@@ -493,6 +503,20 @@ static gxio_mpipe_context_t *_gxio_get_link_context(void)
         return contextp;
 }
 
+int gxio_mpipe_link_instance(const char *link_name)
+{
+        _gxio_mpipe_link_name_t name;
+        gxio_mpipe_context_t *context = _gxio_get_link_context();
+
+        if (!context)
+                return GXIO_ERR_NO_DEVICE;
+
+        strncpy(name.name, link_name, sizeof(name.name));
+        name.name[GXIO_MPIPE_LINK_NAME_LEN - 1] = '\0';
+
+        return gxio_mpipe_info_instance_aux(context, name);
+}
+
 int gxio_mpipe_link_enumerate_mac(int idx, char *link_name, uint8_t *link_mac)
 {
         int rv;
@@ -543,3 +567,12 @@ int gxio_mpipe_link_close(gxio_mpipe_link_t *link)
 }
 
 EXPORT_SYMBOL_GPL(gxio_mpipe_link_close);
+
+int gxio_mpipe_link_set_attr(gxio_mpipe_link_t *link, uint32_t attr,
+                             int64_t val)
+{
+        return gxio_mpipe_link_set_attr_aux(link->context, link->mac, attr,
+                                            val);
+}
+
+EXPORT_SYMBOL_GPL(gxio_mpipe_link_set_attr);
diff --git a/arch/tile/gxio/uart.c b/arch/tile/gxio/uart.c
new file mode 100644
index 000000000000..ba585175ef88
--- /dev/null
+++ b/arch/tile/gxio/uart.c
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2013 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+/*
+ * Implementation of UART gxio calls.
+ */
+
+#include <linux/io.h>
+#include <linux/errno.h>
+#include <linux/module.h>
+
+#include <gxio/uart.h>
+#include <gxio/iorpc_globals.h>
+#include <gxio/iorpc_uart.h>
+#include <gxio/kiorpc.h>
+
+int gxio_uart_init(gxio_uart_context_t *context, int uart_index)
+{
+        char file[32];
+        int fd;
+
+        snprintf(file, sizeof(file), "uart/%d/iorpc", uart_index);
+        fd = hv_dev_open((HV_VirtAddr) file, 0);
+        if (fd < 0) {
+                if (fd >= GXIO_ERR_MIN && fd <= GXIO_ERR_MAX)
+                        return fd;
+                else
+                        return -ENODEV;
+        }
+
+        context->fd = fd;
+
+        /* Map in the MMIO space. */
+        context->mmio_base = (void __force *)
+                iorpc_ioremap(fd, HV_UART_MMIO_OFFSET, HV_UART_MMIO_SIZE);
+
+        if (context->mmio_base == NULL) {
+                hv_dev_close(context->fd);
+                context->fd = -1;
+                return -ENODEV;
+        }
+
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(gxio_uart_init);
+
+int gxio_uart_destroy(gxio_uart_context_t *context)
+{
+        iounmap((void __force __iomem *)(context->mmio_base));
+        hv_dev_close(context->fd);
+
+        context->mmio_base = NULL;
+        context->fd = -1;
+
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(gxio_uart_destroy);
+
+/* UART register write wrapper. */
+void gxio_uart_write(gxio_uart_context_t *context, uint64_t offset,
+                     uint64_t word)
+{
+        __gxio_mmio_write(context->mmio_base + offset, word);
+}
+
+EXPORT_SYMBOL_GPL(gxio_uart_write);
+
+/* UART register read wrapper. */
+uint64_t gxio_uart_read(gxio_uart_context_t *context, uint64_t offset)
+{
+        return __gxio_mmio_read(context->mmio_base + offset);
+}
+
+EXPORT_SYMBOL_GPL(gxio_uart_read);
diff --git a/arch/tile/include/arch/trio.h b/arch/tile/include/arch/trio.h
index d3000a871a21..c0ddedcae085 100644
--- a/arch/tile/include/arch/trio.h
+++ b/arch/tile/include/arch/trio.h
@@ -23,6 +23,45 @@
 #ifndef __ASSEMBLER__
 
 /*
+ * Map SQ Doorbell Format.
+ * This describes the format of the write-only doorbell register that exists
+ * in the last 8-bytes of the MAP_SQ_BASE/LIM range.  This register is only
+ * writable from PCIe space.  Writes to this register will not be written to
+ * Tile memory space and thus no IO VA translation is required if the last
+ * page of the BASE/LIM range is not otherwise written.
+ */
+
+__extension__
+typedef union
+{
+  struct
+  {
+#ifndef __BIG_ENDIAN__
+    /*
+     * When written with a 1, the associated MAP_SQ region's doorbell
+     * interrupt will be triggered once all previous writes are visible to
+     * Tile software.
+     */
+    uint_reg_t doorbell   : 1;
+    /*
+     * When written with a 1, the descriptor at the head of the associated
+     * MAP_SQ's FIFO will be dequeued.
+     */
+    uint_reg_t pop        : 1;
+    /* Reserved. */
+    uint_reg_t __reserved : 62;
+#else   /* __BIG_ENDIAN__ */
+    uint_reg_t __reserved : 62;
+    uint_reg_t pop        : 1;
+    uint_reg_t doorbell   : 1;
+#endif
+  };
+
+  uint_reg_t word;
+} TRIO_MAP_SQ_DOORBELL_FMT_t;
+
+
+/*
  * Tile PIO Region Configuration - CFG Address Format.
  * This register describes the address format for PIO accesses when the
  * associated region is setup with TYPE=CFG.
diff --git a/arch/tile/include/arch/uart.h b/arch/tile/include/arch/uart.h
new file mode 100644
index 000000000000..07966970adad
--- /dev/null
+++ b/arch/tile/include/arch/uart.h
@@ -0,0 +1,300 @@
+/*
+ * Copyright 2013 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+/* Machine-generated file; do not edit. */
+
+#ifndef __ARCH_UART_H__
+#define __ARCH_UART_H__
+
+#include <arch/abi.h>
+#include <arch/uart_def.h>
+
+#ifndef __ASSEMBLER__
+
+/* Divisor. */
+
+__extension__
+typedef union
+{
+  struct
+  {
+#ifndef __BIG_ENDIAN__
+    /*
+     * Baud Rate Divisor.  Desired_baud_rate = REF_CLK frequency / (baud *
+     * 16).
+     *                       Note: REF_CLK is always 125 MHz, the default
+     * divisor = 68, baud rate = 125M/(68*16) = 115200 baud.
+     */
+    uint_reg_t divisor    : 12;
+    /* Reserved. */
+    uint_reg_t __reserved : 52;
+#else   /* __BIG_ENDIAN__ */
+    uint_reg_t __reserved : 52;
+    uint_reg_t divisor    : 12;
+#endif
+  };
+
+  uint_reg_t word;
+} UART_DIVISOR_t;
+
+/* FIFO Count. */
+
+__extension__
+typedef union
+{
+  struct
+  {
+#ifndef __BIG_ENDIAN__
+    /*
+     * n: n active entries in the receive FIFO (max is 2**8). Each entry has
+     * 8 bits.
+     * 0: no active entry in the receive FIFO (that is empty).
+     */
+    uint_reg_t rfifo_count  : 9;
+    /* Reserved. */
+    uint_reg_t __reserved_0 : 7;
+    /*
+     * n: n active entries in the transmit FIFO (max is 2**8). Each entry has
+     * 8 bits.
+     * 0: no active entry in the transmit FIFO (that is empty).
+     */
+    uint_reg_t tfifo_count  : 9;
+    /* Reserved. */
+    uint_reg_t __reserved_1 : 7;
+    /*
+     * n: n active entries in the write FIFO (max is 2**2). Each entry has 8
+     * bits.
+     * 0: no active entry in the write FIFO (that is empty).
+     */
+    uint_reg_t wfifo_count  : 3;
+    /* Reserved. */
+    uint_reg_t __reserved_2 : 29;
+#else   /* __BIG_ENDIAN__ */
+    uint_reg_t __reserved_2 : 29;
+    uint_reg_t wfifo_count  : 3;
+    uint_reg_t __reserved_1 : 7;
+    uint_reg_t tfifo_count  : 9;
+    uint_reg_t __reserved_0 : 7;
+    uint_reg_t rfifo_count  : 9;
+#endif
+  };
+
+  uint_reg_t word;
+} UART_FIFO_COUNT_t;
+
+/* FLAG. */
+
+__extension__
+typedef union
+{
+  struct
+  {
+#ifndef __BIG_ENDIAN__
+    /* Reserved. */
+    uint_reg_t __reserved_0 : 1;
+    /* 1: receive FIFO is empty */
+    uint_reg_t rfifo_empty  : 1;
+    /* 1: write FIFO is empty. */
+    uint_reg_t wfifo_empty  : 1;
+    /* 1: transmit FIFO is empty. */
+    uint_reg_t tfifo_empty  : 1;
+    /* 1: receive FIFO is full. */
+    uint_reg_t rfifo_full   : 1;
+    /* 1: write FIFO is full. */
+    uint_reg_t wfifo_full   : 1;
+    /* 1: transmit FIFO is full. */
+    uint_reg_t tfifo_full   : 1;
+    /* Reserved. */
+    uint_reg_t __reserved_1 : 57;
+#else   /* __BIG_ENDIAN__ */
+    uint_reg_t __reserved_1 : 57;
+    uint_reg_t tfifo_full   : 1;
+    uint_reg_t wfifo_full   : 1;
+    uint_reg_t rfifo_full   : 1;
+    uint_reg_t tfifo_empty  : 1;
+    uint_reg_t wfifo_empty  : 1;
+    uint_reg_t rfifo_empty  : 1;
+    uint_reg_t __reserved_0 : 1;
+#endif
+  };
+
+  uint_reg_t word;
+} UART_FLAG_t;
+
+/*
+ * Interrupt Vector Mask.
+ * Each bit in this register corresponds to a specific interrupt. When set,
+ * the associated interrupt will not be dispatched.
+ */
+
+__extension__
+typedef union
+{
+  struct
+  {
+#ifndef __BIG_ENDIAN__
+    /* Read data FIFO read and no data available */
+    uint_reg_t rdat_err       : 1;
+    /* Write FIFO was written but it was full */
+    uint_reg_t wdat_err       : 1;
+    /* Stop bit not found when current data was received */
+    uint_reg_t frame_err      : 1;
+    /* Parity error was detected when current data was received */
+    uint_reg_t parity_err     : 1;
+    /* Data was received but the receive FIFO was full */
+    uint_reg_t rfifo_overflow : 1;
+    /*
+     * An almost full event is reached when data is to be written to the
+     * receive FIFO, and the receive FIFO has more than or equal to
+     * BUFFER_THRESHOLD.RFIFO_AFULL bytes.
+     */
+    uint_reg_t rfifo_afull    : 1;
+    /* Reserved. */
+    uint_reg_t __reserved_0   : 1;
+    /* An entry in the transmit FIFO was popped */
+    uint_reg_t tfifo_re       : 1;
+    /* An entry has been pushed into the receive FIFO */
+    uint_reg_t rfifo_we       : 1;
+    /* An entry of the write FIFO has been popped */
+    uint_reg_t wfifo_re       : 1;
+    /* Rshim read receive FIFO in protocol mode */
+    uint_reg_t rfifo_err      : 1;
+    /*
+     * An almost empty event is reached when data is to be read from the
+     * transmit FIFO, and the transmit FIFO has less than or equal to
+     * BUFFER_THRESHOLD.TFIFO_AEMPTY bytes.
+     */
+    uint_reg_t tfifo_aempty   : 1;
+    /* Reserved. */
+    uint_reg_t __reserved_1   : 52;
+#else   /* __BIG_ENDIAN__ */
+    uint_reg_t __reserved_1   : 52;
+    uint_reg_t tfifo_aempty   : 1;
+    uint_reg_t rfifo_err      : 1;
+    uint_reg_t wfifo_re       : 1;
+    uint_reg_t rfifo_we       : 1;
+    uint_reg_t tfifo_re       : 1;
+    uint_reg_t __reserved_0   : 1;
+    uint_reg_t rfifo_afull    : 1;
+    uint_reg_t rfifo_overflow : 1;
+    uint_reg_t parity_err     : 1;
+    uint_reg_t frame_err      : 1;
+    uint_reg_t wdat_err       : 1;
+    uint_reg_t rdat_err       : 1;
+#endif
+  };
+
+  uint_reg_t word;
+} UART_INTERRUPT_MASK_t;
+
+/*
+ * Interrupt vector, write-one-to-clear.
+ * Each bit in this register corresponds to a specific interrupt. Hardware
+ * sets the bit when the associated condition has occurred. Writing a 1
+ * clears the status bit.
+ */
+
+__extension__
+typedef union
+{
+  struct
+  {
+#ifndef __BIG_ENDIAN__
+    /* Read data FIFO read and no data available */
+    uint_reg_t rdat_err       : 1;
+    /* Write FIFO was written but it was full */
+    uint_reg_t wdat_err       : 1;
+    /* Stop bit not found when current data was received */
+    uint_reg_t frame_err      : 1;
+    /* Parity error was detected when current data was received */
+    uint_reg_t parity_err     : 1;
+    /* Data was received but the receive FIFO was full */
+    uint_reg_t rfifo_overflow : 1;
+    /*
+     * Data was received and the receive FIFO is now almost full (more than
+     * BUFFER_THRESHOLD.RFIFO_AFULL bytes in it)
+     */
+    uint_reg_t rfifo_afull    : 1;
+    /* Reserved. */
+    uint_reg_t __reserved_0   : 1;
+    /* An entry in the transmit FIFO was popped */
+    uint_reg_t tfifo_re       : 1;
+    /* An entry has been pushed into the receive FIFO */
+    uint_reg_t rfifo_we       : 1;
+    /* An entry of the write FIFO has been popped */
+    uint_reg_t wfifo_re       : 1;
+    /* Rshim read receive FIFO in protocol mode */
+    uint_reg_t rfifo_err      : 1;
+    /*
+     * Data was read from the transmit FIFO and now it is almost empty (less
+     * than or equal to BUFFER_THRESHOLD.TFIFO_AEMPTY bytes in it).
+     */
+    uint_reg_t tfifo_aempty   : 1;
+    /* Reserved. */
+    uint_reg_t __reserved_1   : 52;
+#else   /* __BIG_ENDIAN__ */
+    uint_reg_t __reserved_1   : 52;
+    uint_reg_t tfifo_aempty   : 1;
+    uint_reg_t rfifo_err      : 1;
+    uint_reg_t wfifo_re       : 1;
+    uint_reg_t rfifo_we       : 1;
+    uint_reg_t tfifo_re       : 1;
+    uint_reg_t __reserved_0   : 1;
+    uint_reg_t rfifo_afull    : 1;
+    uint_reg_t rfifo_overflow : 1;
+    uint_reg_t parity_err     : 1;
+    uint_reg_t frame_err      : 1;
+    uint_reg_t wdat_err       : 1;
+    uint_reg_t rdat_err       : 1;
+#endif
+  };
+
+  uint_reg_t word;
+} UART_INTERRUPT_STATUS_t;
+
+/* Type. */
+
+__extension__
+typedef union
+{
+  struct
+  {
+#ifndef __BIG_ENDIAN__
+    /* Number of stop bits, rx and tx */
+    uint_reg_t sbits        : 1;
+    /* Reserved. */
+    uint_reg_t __reserved_0 : 1;
+    /* Data word size, rx and tx */
+    uint_reg_t dbits        : 1;
+    /* Reserved. */
+    uint_reg_t __reserved_1 : 1;
+    /* Parity selection, rx and tx */
+    uint_reg_t ptype        : 3;
+    /* Reserved. */
+    uint_reg_t __reserved_2 : 57;
+#else   /* __BIG_ENDIAN__ */
+    uint_reg_t __reserved_2 : 57;
+    uint_reg_t ptype        : 3;
+    uint_reg_t __reserved_1 : 1;
+    uint_reg_t dbits        : 1;
+    uint_reg_t __reserved_0 : 1;
+    uint_reg_t sbits        : 1;
+#endif
+  };
+
+  uint_reg_t word;
+} UART_TYPE_t;
+#endif /* !defined(__ASSEMBLER__) */
+
+#endif /* !defined(__ARCH_UART_H__) */
diff --git a/arch/tile/include/arch/uart_def.h b/arch/tile/include/arch/uart_def.h
new file mode 100644
index 000000000000..42bcaf535379
--- /dev/null
+++ b/arch/tile/include/arch/uart_def.h
@@ -0,0 +1,120 @@
+/*
+ * Copyright 2013 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+/* Machine-generated file; do not edit. */
+
+#ifndef __ARCH_UART_DEF_H__
+#define __ARCH_UART_DEF_H__
+#define UART_DIVISOR 0x0158
+#define UART_FIFO_COUNT 0x0110
+#define UART_FLAG 0x0108
+#define UART_INTERRUPT_MASK 0x0208
+#define UART_INTERRUPT_MASK__RDAT_ERR_SHIFT 0
+#define UART_INTERRUPT_MASK__RDAT_ERR_WIDTH 1
+#define UART_INTERRUPT_MASK__RDAT_ERR_RESET_VAL 1
+#define UART_INTERRUPT_MASK__RDAT_ERR_RMASK 0x1
+#define UART_INTERRUPT_MASK__RDAT_ERR_MASK  0x1
+#define UART_INTERRUPT_MASK__RDAT_ERR_FIELD 0,0
+#define UART_INTERRUPT_MASK__WDAT_ERR_SHIFT 1
+#define UART_INTERRUPT_MASK__WDAT_ERR_WIDTH 1
+#define UART_INTERRUPT_MASK__WDAT_ERR_RESET_VAL 1
+#define UART_INTERRUPT_MASK__WDAT_ERR_RMASK 0x1
+#define UART_INTERRUPT_MASK__WDAT_ERR_MASK  0x2
+#define UART_INTERRUPT_MASK__WDAT_ERR_FIELD 1,1
+#define UART_INTERRUPT_MASK__FRAME_ERR_SHIFT 2
+#define UART_INTERRUPT_MASK__FRAME_ERR_WIDTH 1
+#define UART_INTERRUPT_MASK__FRAME_ERR_RESET_VAL 1
+#define UART_INTERRUPT_MASK__FRAME_ERR_RMASK 0x1
+#define UART_INTERRUPT_MASK__FRAME_ERR_MASK  0x4
+#define UART_INTERRUPT_MASK__FRAME_ERR_FIELD 2,2
+#define UART_INTERRUPT_MASK__PARITY_ERR_SHIFT 3
+#define UART_INTERRUPT_MASK__PARITY_ERR_WIDTH 1
+#define UART_INTERRUPT_MASK__PARITY_ERR_RESET_VAL 1
+#define UART_INTERRUPT_MASK__PARITY_ERR_RMASK 0x1
+#define UART_INTERRUPT_MASK__PARITY_ERR_MASK  0x8
+#define UART_INTERRUPT_MASK__PARITY_ERR_FIELD 3,3
+#define UART_INTERRUPT_MASK__RFIFO_OVERFLOW_SHIFT 4
+#define UART_INTERRUPT_MASK__RFIFO_OVERFLOW_WIDTH 1
+#define UART_INTERRUPT_MASK__RFIFO_OVERFLOW_RESET_VAL 1
+#define UART_INTERRUPT_MASK__RFIFO_OVERFLOW_RMASK 0x1
+#define UART_INTERRUPT_MASK__RFIFO_OVERFLOW_MASK  0x10
+#define UART_INTERRUPT_MASK__RFIFO_OVERFLOW_FIELD 4,4
+#define UART_INTERRUPT_MASK__RFIFO_AFULL_SHIFT 5
+#define UART_INTERRUPT_MASK__RFIFO_AFULL_WIDTH 1
+#define UART_INTERRUPT_MASK__RFIFO_AFULL_RESET_VAL 1
+#define UART_INTERRUPT_MASK__RFIFO_AFULL_RMASK 0x1
+#define UART_INTERRUPT_MASK__RFIFO_AFULL_MASK  0x20
+#define UART_INTERRUPT_MASK__RFIFO_AFULL_FIELD 5,5
+#define UART_INTERRUPT_MASK__TFIFO_RE_SHIFT 7
+#define UART_INTERRUPT_MASK__TFIFO_RE_WIDTH 1
+#define UART_INTERRUPT_MASK__TFIFO_RE_RESET_VAL 1
+#define UART_INTERRUPT_MASK__TFIFO_RE_RMASK 0x1
+#define UART_INTERRUPT_MASK__TFIFO_RE_MASK  0x80
+#define UART_INTERRUPT_MASK__TFIFO_RE_FIELD 7,7
+#define UART_INTERRUPT_MASK__RFIFO_WE_SHIFT 8
+#define UART_INTERRUPT_MASK__RFIFO_WE_WIDTH 1
+#define UART_INTERRUPT_MASK__RFIFO_WE_RESET_VAL 1
+#define UART_INTERRUPT_MASK__RFIFO_WE_RMASK 0x1
+#define UART_INTERRUPT_MASK__RFIFO_WE_MASK  0x100
+#define UART_INTERRUPT_MASK__RFIFO_WE_FIELD 8,8
+#define UART_INTERRUPT_MASK__WFIFO_RE_SHIFT 9
+#define UART_INTERRUPT_MASK__WFIFO_RE_WIDTH 1
+#define UART_INTERRUPT_MASK__WFIFO_RE_RESET_VAL 1
+#define UART_INTERRUPT_MASK__WFIFO_RE_RMASK 0x1
+#define UART_INTERRUPT_MASK__WFIFO_RE_MASK  0x200
+#define UART_INTERRUPT_MASK__WFIFO_RE_FIELD 9,9
+#define UART_INTERRUPT_MASK__RFIFO_ERR_SHIFT 10
+#define UART_INTERRUPT_MASK__RFIFO_ERR_WIDTH 1
+#define UART_INTERRUPT_MASK__RFIFO_ERR_RESET_VAL 1
+#define UART_INTERRUPT_MASK__RFIFO_ERR_RMASK 0x1
+#define UART_INTERRUPT_MASK__RFIFO_ERR_MASK  0x400
+#define UART_INTERRUPT_MASK__RFIFO_ERR_FIELD 10,10
+#define UART_INTERRUPT_MASK__TFIFO_AEMPTY_SHIFT 11
+#define UART_INTERRUPT_MASK__TFIFO_AEMPTY_WIDTH 1
+#define UART_INTERRUPT_MASK__TFIFO_AEMPTY_RESET_VAL 1
+#define UART_INTERRUPT_MASK__TFIFO_AEMPTY_RMASK 0x1
+#define UART_INTERRUPT_MASK__TFIFO_AEMPTY_MASK  0x800
+#define UART_INTERRUPT_MASK__TFIFO_AEMPTY_FIELD 11,11
+#define UART_INTERRUPT_STATUS 0x0200
+#define UART_RECEIVE_DATA 0x0148
+#define UART_TRANSMIT_DATA 0x0140
+#define UART_TYPE 0x0160
+#define UART_TYPE__SBITS_SHIFT 0
+#define UART_TYPE__SBITS_WIDTH 1
+#define UART_TYPE__SBITS_RESET_VAL 1
+#define UART_TYPE__SBITS_RMASK 0x1
+#define UART_TYPE__SBITS_MASK  0x1
+#define UART_TYPE__SBITS_FIELD 0,0
+#define UART_TYPE__SBITS_VAL_ONE_SBITS 0x0
+#define UART_TYPE__SBITS_VAL_TWO_SBITS 0x1
+#define UART_TYPE__DBITS_SHIFT 2
+#define UART_TYPE__DBITS_WIDTH 1
+#define UART_TYPE__DBITS_RESET_VAL 0
+#define UART_TYPE__DBITS_RMASK 0x1
+#define UART_TYPE__DBITS_MASK  0x4
+#define UART_TYPE__DBITS_FIELD 2,2
+#define UART_TYPE__DBITS_VAL_EIGHT_DBITS 0x0
+#define UART_TYPE__DBITS_VAL_SEVEN_DBITS 0x1
+#define UART_TYPE__PTYPE_SHIFT 4
+#define UART_TYPE__PTYPE_WIDTH 3
+#define UART_TYPE__PTYPE_RESET_VAL 3
+#define UART_TYPE__PTYPE_RMASK 0x7
+#define UART_TYPE__PTYPE_MASK  0x70
+#define UART_TYPE__PTYPE_FIELD 4,6
+#define UART_TYPE__PTYPE_VAL_NONE 0x0
+#define UART_TYPE__PTYPE_VAL_MARK 0x1
+#define UART_TYPE__PTYPE_VAL_SPACE 0x2
+#define UART_TYPE__PTYPE_VAL_EVEN 0x3
+#define UART_TYPE__PTYPE_VAL_ODD 0x4
+#endif /* !defined(__ARCH_UART_DEF_H__) */
diff --git a/arch/tile/include/asm/Kbuild b/arch/tile/include/asm/Kbuild
index b17b9b8e53cd..664d6ad23f80 100644
--- a/arch/tile/include/asm/Kbuild
+++ b/arch/tile/include/asm/Kbuild
@@ -11,12 +11,13 @@ generic-y += errno.h
 generic-y += exec.h
 generic-y += fb.h
 generic-y += fcntl.h
+generic-y += hw_irq.h
 generic-y += ioctl.h
 generic-y += ioctls.h
 generic-y += ipcbuf.h
 generic-y += irq_regs.h
-generic-y += kdebug.h
 generic-y += local.h
+generic-y += local64.h
 generic-y += msgbuf.h
 generic-y += mutex.h
 generic-y += param.h
diff --git a/arch/tile/include/asm/atomic.h b/arch/tile/include/asm/atomic.h
index e71387ab20ca..d385eaadece7 100644
--- a/arch/tile/include/asm/atomic.h
+++ b/arch/tile/include/asm/atomic.h
@@ -114,6 +114,32 @@ static inline int atomic_read(const atomic_t *v)
 #define atomic_inc_and_test(v)          (atomic_inc_return(v) == 0)
 
 /**
+ * atomic_xchg - atomically exchange contents of memory with a new value
+ * @v: pointer of type atomic_t
+ * @i: integer value to store in memory
+ *
+ * Atomically sets @v to @i and returns old @v
+ */
+static inline int atomic_xchg(atomic_t *v, int n)
+{
+        return xchg(&v->counter, n);
+}
+
+/**
+ * atomic_cmpxchg - atomically exchange contents of memory if it matches
+ * @v: pointer of type atomic_t
+ * @o: old value that memory should have
+ * @n: new value to write to memory if it matches
+ *
+ * Atomically checks if @v holds @o and replaces it with @n if so.
+ * Returns the old value at @v.
+ */
+static inline int atomic_cmpxchg(atomic_t *v, int o, int n)
+{
+        return cmpxchg(&v->counter, o, n);
+}
+
+/**
  * atomic_add_negative - add and test if negative
  * @v: pointer of type atomic_t
  * @i: integer value to add
@@ -133,6 +159,32 @@ static inline int atomic_read(const atomic_t *v)
 
 #ifndef __ASSEMBLY__
 
+/**
+ * atomic64_xchg - atomically exchange contents of memory with a new value
+ * @v: pointer of type atomic64_t
+ * @i: integer value to store in memory
+ *
+ * Atomically sets @v to @i and returns old @v
+ */
+static inline u64 atomic64_xchg(atomic64_t *v, u64 n)
+{
+        return xchg64(&v->counter, n);
+}
+
+/**
+ * atomic64_cmpxchg - atomically exchange contents of memory if it matches
+ * @v: pointer of type atomic64_t
+ * @o: old value that memory should have
+ * @n: new value to write to memory if it matches
+ *
+ * Atomically checks if @v holds @o and replaces it with @n if so.
+ * Returns the old value at @v.
+ */
+static inline u64 atomic64_cmpxchg(atomic64_t *v, u64 o, u64 n)
+{
+        return cmpxchg64(&v->counter, o, n);
+}
+
 static inline long long atomic64_dec_if_positive(atomic64_t *v)
 {
         long long c, old, dec;
diff --git a/arch/tile/include/asm/atomic_32.h b/arch/tile/include/asm/atomic_32.h
index e7fb5cfb9597..0d0395b1b152 100644
--- a/arch/tile/include/asm/atomic_32.h
+++ b/arch/tile/include/asm/atomic_32.h
@@ -22,40 +22,6 @@
 
 #ifndef __ASSEMBLY__
 
-/* Tile-specific routines to support <linux/atomic.h>. */
-int _atomic_xchg(atomic_t *v, int n);
-int _atomic_xchg_add(atomic_t *v, int i);
-int _atomic_xchg_add_unless(atomic_t *v, int a, int u);
-int _atomic_cmpxchg(atomic_t *v, int o, int n);
-
-/**
- * atomic_xchg - atomically exchange contents of memory with a new value
- * @v: pointer of type atomic_t
- * @i: integer value to store in memory
- *
- * Atomically sets @v to @i and returns old @v
- */
-static inline int atomic_xchg(atomic_t *v, int n)
-{
-        smp_mb();  /* barrier for proper semantics */
-        return _atomic_xchg(v, n);
-}
-
-/**
- * atomic_cmpxchg - atomically exchange contents of memory if it matches
- * @v: pointer of type atomic_t
- * @o: old value that memory should have
- * @n: new value to write to memory if it matches
- *
- * Atomically checks if @v holds @o and replaces it with @n if so.
- * Returns the old value at @v.
- */
-static inline int atomic_cmpxchg(atomic_t *v, int o, int n)
-{
-        smp_mb();  /* barrier for proper semantics */
-        return _atomic_cmpxchg(v, o, n);
-}
-
 /**
  * atomic_add - add integer to atomic variable
  * @i: integer value to add
@@ -65,7 +31,7 @@ static inline int atomic_cmpxchg(atomic_t *v, int o, int n)
  */
 static inline void atomic_add(int i, atomic_t *v)
 {
-        _atomic_xchg_add(v, i);
+        _atomic_xchg_add(&v->counter, i);
 }
 
 /**
@@ -78,7 +44,7 @@ static inline void atomic_add(int i, atomic_t *v)
 static inline int atomic_add_return(int i, atomic_t *v)
 {
         smp_mb();  /* barrier for proper semantics */
-        return _atomic_xchg_add(v, i) + i;
+        return _atomic_xchg_add(&v->counter, i) + i;
 }
 
 /**
@@ -93,7 +59,7 @@ static inline int atomic_add_return(int i, atomic_t *v)
 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
 {
         smp_mb();  /* barrier for proper semantics */
-        return _atomic_xchg_add_unless(v, a, u);
+        return _atomic_xchg_add_unless(&v->counter, a, u);
 }
 
 /**
@@ -108,7 +74,7 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
  */
 static inline void atomic_set(atomic_t *v, int n)
 {
-        _atomic_xchg(v, n);
+        _atomic_xchg(&v->counter, n);
 }
 
 /* A 64bit atomic type */
@@ -119,11 +85,6 @@ typedef struct {
 
 #define ATOMIC64_INIT(val) { (val) }
 
-u64 _atomic64_xchg(atomic64_t *v, u64 n);
-u64 _atomic64_xchg_add(atomic64_t *v, u64 i);
-u64 _atomic64_xchg_add_unless(atomic64_t *v, u64 a, u64 u);
-u64 _atomic64_cmpxchg(atomic64_t *v, u64 o, u64 n);
-
 /**
  * atomic64_read - read atomic variable
  * @v: pointer of type atomic64_t
@@ -137,35 +98,7 @@ static inline u64 atomic64_read(const atomic64_t *v)
          * Casting away const is safe since the atomic support routines
          * do not write to memory if the value has not been modified.
          */
-        return _atomic64_xchg_add((atomic64_t *)v, 0);
-}
-
-/**
- * atomic64_xchg - atomically exchange contents of memory with a new value
- * @v: pointer of type atomic64_t
- * @i: integer value to store in memory
- *
- * Atomically sets @v to @i and returns old @v
- */
-static inline u64 atomic64_xchg(atomic64_t *v, u64 n)
-{
-        smp_mb();  /* barrier for proper semantics */
-        return _atomic64_xchg(v, n);
-}
-
-/**
- * atomic64_cmpxchg - atomically exchange contents of memory if it matches
- * @v: pointer of type atomic64_t
- * @o: old value that memory should have
- * @n: new value to write to memory if it matches
- *
- * Atomically checks if @v holds @o and replaces it with @n if so.
- * Returns the old value at @v.
- */
-static inline u64 atomic64_cmpxchg(atomic64_t *v, u64 o, u64 n)
-{
-        smp_mb();  /* barrier for proper semantics */
-        return _atomic64_cmpxchg(v, o, n);
+        return _atomic64_xchg_add((u64 *)&v->counter, 0);
 }
 
 /**
@@ -177,7 +110,7 @@ static inline u64 atomic64_cmpxchg(atomic64_t *v, u64 o, u64 n)
  */
 static inline void atomic64_add(u64 i, atomic64_t *v)
 {
-        _atomic64_xchg_add(v, i);
+        _atomic64_xchg_add(&v->counter, i);
 }
 
 /**
@@ -190,7 +123,7 @@ static inline void atomic64_add(u64 i, atomic64_t *v)
 static inline u64 atomic64_add_return(u64 i, atomic64_t *v)
 {
         smp_mb();  /* barrier for proper semantics */
-        return _atomic64_xchg_add(v, i) + i;
+        return _atomic64_xchg_add(&v->counter, i) + i;
 }
 
 /**
@@ -205,7 +138,7 @@ static inline u64 atomic64_add_return(u64 i, atomic64_t *v)
 static inline u64 atomic64_add_unless(atomic64_t *v, u64 a, u64 u)
 {
         smp_mb();  /* barrier for proper semantics */
-        return _atomic64_xchg_add_unless(v, a, u) != u;
+        return _atomic64_xchg_add_unless(&v->counter, a, u) != u;
 }
 
 /**
@@ -220,7 +153,7 @@ static inline u64 atomic64_add_unless(atomic64_t *v, u64 a, u64 u)
  */
 static inline void atomic64_set(atomic64_t *v, u64 n)
 {
-        _atomic64_xchg(v, n);
+        _atomic64_xchg(&v->counter, n);
 }
 
 #define atomic64_add_negative(a, v)     (atomic64_add_return((a), (v)) < 0)
@@ -252,21 +185,6 @@ static inline void atomic64_set(atomic64_t *v, u64 n)
  * Internal definitions only beyond this point.
  */
 
-#define ATOMIC_LOCKS_FOUND_VIA_TABLE() \
-  (!CHIP_HAS_CBOX_HOME_MAP() && defined(CONFIG_SMP))
-
-#if ATOMIC_LOCKS_FOUND_VIA_TABLE()
-
-/* Number of entries in atomic_lock_ptr[]. */
-#define ATOMIC_HASH_L1_SHIFT 6
-#define ATOMIC_HASH_L1_SIZE (1 << ATOMIC_HASH_L1_SHIFT)
-
-/* Number of locks in each struct pointed to by atomic_lock_ptr[]. */
-#define ATOMIC_HASH_L2_SHIFT (CHIP_L2_LOG_LINE_SIZE() - 2)
-#define ATOMIC_HASH_L2_SIZE (1 << ATOMIC_HASH_L2_SHIFT)
-
-#else /* ATOMIC_LOCKS_FOUND_VIA_TABLE() */
-
 /*
  * Number of atomic locks in atomic_locks[]. Must be a power of two.
  * There is no reason for more than PAGE_SIZE / 8 entries, since that
@@ -281,8 +199,6 @@ static inline void atomic64_set(atomic64_t *v, u64 n)
 extern int atomic_locks[];
 #endif
 
-#endif /* ATOMIC_LOCKS_FOUND_VIA_TABLE() */
-
 /*
  * All the code that may fault while holding an atomic lock must
  * place the pointer to the lock in ATOMIC_LOCK_REG so the fault code
diff --git a/arch/tile/include/asm/atomic_64.h b/arch/tile/include/asm/atomic_64.h
index f4500c688ffa..ad220eed05fc 100644
--- a/arch/tile/include/asm/atomic_64.h
+++ b/arch/tile/include/asm/atomic_64.h
@@ -32,25 +32,6 @@
  * on any routine which updates memory and returns a value.
  */
 
-static inline int atomic_cmpxchg(atomic_t *v, int o, int n)
-{
-        int val;
-        __insn_mtspr(SPR_CMPEXCH_VALUE, o);
-        smp_mb();  /* barrier for proper semantics */
-        val = __insn_cmpexch4((void *)&v->counter, n);
-        smp_mb();  /* barrier for proper semantics */
-        return val;
-}
-
-static inline int atomic_xchg(atomic_t *v, int n)
-{
-        int val;
-        smp_mb();  /* barrier for proper semantics */
-        val = __insn_exch4((void *)&v->counter, n);
-        smp_mb();  /* barrier for proper semantics */
-        return val;
-}
-
 static inline void atomic_add(int i, atomic_t *v)
 {
         __insn_fetchadd4((void *)&v->counter, i);
@@ -72,7 +53,7 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
                 if (oldval == u)
                         break;
                 guess = oldval;
-                oldval = atomic_cmpxchg(v, guess, guess + a);
+                oldval = cmpxchg(&v->counter, guess, guess + a);
         } while (guess != oldval);
         return oldval;
 }
@@ -84,25 +65,6 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
 #define atomic64_read(v)                ((v)->counter)
 #define atomic64_set(v, i) ((v)->counter = (i))
 
-static inline long atomic64_cmpxchg(atomic64_t *v, long o, long n)
-{
-        long val;
-        smp_mb();  /* barrier for proper semantics */
-        __insn_mtspr(SPR_CMPEXCH_VALUE, o);
-        val = __insn_cmpexch((void *)&v->counter, n);
-        smp_mb();  /* barrier for proper semantics */
-        return val;
-}
-
-static inline long atomic64_xchg(atomic64_t *v, long n)
-{
-        long val;
-        smp_mb();  /* barrier for proper semantics */
-        val = __insn_exch((void *)&v->counter, n);
-        smp_mb();  /* barrier for proper semantics */
-        return val;
-}
-
 static inline void atomic64_add(long i, atomic64_t *v)
 {
         __insn_fetchadd((void *)&v->counter, i);
@@ -124,7 +86,7 @@ static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
                 if (oldval == u)
                         break;
                 guess = oldval;
-                oldval = atomic64_cmpxchg(v, guess, guess + a);
+                oldval = cmpxchg(&v->counter, guess, guess + a);
         } while (guess != oldval);
         return oldval != u;
 }
diff --git a/arch/tile/include/asm/barrier.h b/arch/tile/include/asm/barrier.h
index 990a217a0b72..a9a73da5865d 100644
--- a/arch/tile/include/asm/barrier.h
+++ b/arch/tile/include/asm/barrier.h
@@ -77,7 +77,6 @@
 
 #define __sync()        __insn_mf()
 
-#if !CHIP_HAS_MF_WAITS_FOR_VICTIMS()
 #include <hv/syscall_public.h>
 /*
  * Issue an uncacheable load to each memory controller, then
@@ -96,7 +95,6 @@ static inline void __mb_incoherent(void)
                        "r20", "r21", "r22", "r23", "r24",
                        "r25", "r26", "r27", "r28", "r29");
 }
-#endif
 
 /* Fence to guarantee visibility of stores to incoherent memory. */
 static inline void
@@ -104,7 +102,6 @@ mb_incoherent(void)
 {
         __insn_mf();
 
-#if !CHIP_HAS_MF_WAITS_FOR_VICTIMS()
         {
 #if CHIP_HAS_TILE_WRITE_PENDING()
                 const unsigned long WRITE_TIMEOUT_CYCLES = 400;
@@ -116,7 +113,6 @@ mb_incoherent(void)
 #endif /* CHIP_HAS_TILE_WRITE_PENDING() */
                 (void) __mb_incoherent();
         }
-#endif /* CHIP_HAS_MF_WAITS_FOR_VICTIMS() */
 }
 
 #define fast_wmb()      __sync()
diff --git a/arch/tile/include/asm/bitops.h b/arch/tile/include/asm/bitops.h
index bd186c4eaa50..d5a206865036 100644
--- a/arch/tile/include/asm/bitops.h
+++ b/arch/tile/include/asm/bitops.h
@@ -29,17 +29,6 @@
 #endif
 
 /**
- * __ffs - find first set bit in word
- * @word: The word to search
- *
- * Undefined if no set bit exists, so code should check against 0 first.
- */
-static inline unsigned long __ffs(unsigned long word)
-{
-        return __builtin_ctzl(word);
-}
-
-/**
  * ffz - find first zero bit in word
  * @word: The word to search
  *
@@ -50,33 +39,6 @@ static inline unsigned long ffz(unsigned long word)
         return __builtin_ctzl(~word);
 }
 
-/**
- * __fls - find last set bit in word
- * @word: The word to search
- *
- * Undefined if no set bit exists, so code should check against 0 first.
- */
-static inline unsigned long __fls(unsigned long word)
-{
-        return (sizeof(word) * 8) - 1 - __builtin_clzl(word);
-}
-
-/**
- * ffs - find first set bit in word
- * @x: the word to search
- *
- * This is defined the same way as the libc and compiler builtin ffs
- * routines, therefore differs in spirit from the other bitops.
- *
- * ffs(value) returns 0 if value is 0 or the position of the first
- * set bit if value is nonzero. The first (least significant) bit
- * is at position 1.
- */
-static inline int ffs(int x)
-{
-        return __builtin_ffs(x);
-}
-
 static inline int fls64(__u64 w)
 {
         return (sizeof(__u64) * 8) - __builtin_clzll(w);
@@ -118,6 +80,9 @@ static inline unsigned long __arch_hweight64(__u64 w)
         return __builtin_popcountll(w);
 }
 
+#include <asm-generic/bitops/builtin-__ffs.h>
+#include <asm-generic/bitops/builtin-__fls.h>
+#include <asm-generic/bitops/builtin-ffs.h>
 #include <asm-generic/bitops/const_hweight.h>
 #include <asm-generic/bitops/lock.h>
 #include <asm-generic/bitops/find.h>
diff --git a/arch/tile/include/asm/bitops_32.h b/arch/tile/include/asm/bitops_32.h
index ddc4c1efde43..386865ad2f55 100644
--- a/arch/tile/include/asm/bitops_32.h
+++ b/arch/tile/include/asm/bitops_32.h
@@ -16,7 +16,7 @@
 #define _ASM_TILE_BITOPS_32_H
 
 #include <linux/compiler.h>
-#include <linux/atomic.h>
+#include <asm/barrier.h>
 
 /* Tile-specific routines to support <asm/bitops.h>. */
 unsigned long _atomic_or(volatile unsigned long *p, unsigned long mask);
diff --git a/arch/tile/include/asm/bitops_64.h b/arch/tile/include/asm/bitops_64.h
index 60b87ee54fb8..ad34cd056085 100644
--- a/arch/tile/include/asm/bitops_64.h
+++ b/arch/tile/include/asm/bitops_64.h
@@ -16,7 +16,7 @@
 #define _ASM_TILE_BITOPS_64_H
 
 #include <linux/compiler.h>
-#include <linux/atomic.h>
+#include <asm/cmpxchg.h>
 
 /* See <asm/bitops.h> for API comments. */
 
@@ -44,8 +44,7 @@ static inline void change_bit(unsigned nr, volatile unsigned long *addr)
         oldval = *addr;
         do {
                 guess = oldval;
-                oldval = atomic64_cmpxchg((atomic64_t *)addr,
-                                          guess, guess ^ mask);
+                oldval = cmpxchg(addr, guess, guess ^ mask);
         } while (guess != oldval);
 }
 
@@ -90,8 +89,7 @@ static inline int test_and_change_bit(unsigned nr,
         oldval = *addr;
         do {
                 guess = oldval;
-                oldval = atomic64_cmpxchg((atomic64_t *)addr,
-                                          guess, guess ^ mask);
+                oldval = cmpxchg(addr, guess, guess ^ mask);
         } while (guess != oldval);
         return (oldval & mask) != 0;
 }
diff --git a/arch/tile/include/asm/cache.h b/arch/tile/include/asm/cache.h
index a9a529964e07..6160761d5f61 100644
--- a/arch/tile/include/asm/cache.h
+++ b/arch/tile/include/asm/cache.h
@@ -49,9 +49,16 @@
 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
 
 /*
- * Attribute for data that is kept read/write coherent until the end of
- * initialization, then bumped to read/only incoherent for performance.
+ * Originally we used small TLB pages for kernel data and grouped some
+ * things together as "write once", enforcing the property at the end
+ * of initialization by making those pages read-only and non-coherent.
+ * This allowed better cache utilization since cache inclusion did not
+ * need to be maintained.  However, to do this requires an extra TLB
+ * entry, which on balance is more of a performance hit than the
+ * non-coherence is a performance gain, so we now just make "read
+ * mostly" and "write once" be synonyms.  We keep the attribute
+ * separate in case we change our minds at a future date.
  */
-#define __write_once __attribute__((__section__(".w1data")))
+#define __write_once __read_mostly
 
 #endif /* _ASM_TILE_CACHE_H */
diff --git a/arch/tile/include/asm/cacheflush.h b/arch/tile/include/asm/cacheflush.h
index 0fc63c488edf..92ee4c8a4f76 100644
--- a/arch/tile/include/asm/cacheflush.h
+++ b/arch/tile/include/asm/cacheflush.h
@@ -75,23 +75,6 @@ static inline void copy_to_user_page(struct vm_area_struct *vma,
 #define copy_from_user_page(vma, page, vaddr, dst, src, len) \
         memcpy((dst), (src), (len))
 
-/*
- * Invalidate a VA range; pads to L2 cacheline boundaries.
- *
- * Note that on TILE64, __inv_buffer() actually flushes modified
- * cache lines in addition to invalidating them, i.e., it's the
- * same as __finv_buffer().
- */
-static inline void __inv_buffer(void *buffer, size_t size)
-{
-        char *next = (char *)((long)buffer & -L2_CACHE_BYTES);
-        char *finish = (char *)L2_CACHE_ALIGN((long)buffer + size);
-        while (next < finish) {
-                __insn_inv(next);
-                next += CHIP_INV_STRIDE();
-        }
-}
-
 /* Flush a VA range; pads to L2 cacheline boundaries. */
 static inline void __flush_buffer(void *buffer, size_t size)
 {
@@ -115,13 +98,6 @@ static inline void __finv_buffer(void *buffer, size_t size)
 }
 
 
-/* Invalidate a VA range and wait for it to be complete. */
-static inline void inv_buffer(void *buffer, size_t size)
-{
-        __inv_buffer(buffer, size);
-        mb();
-}
-
 /*
  * Flush a locally-homecached VA range and wait for the evicted
  * cachelines to hit memory.
@@ -142,6 +118,26 @@ static inline void finv_buffer_local(void *buffer, size_t size)
         mb_incoherent();
 }
 
+#ifdef __tilepro__
+/* Invalidate a VA range; pads to L2 cacheline boundaries. */
+static inline void __inv_buffer(void *buffer, size_t size)
+{
+        char *next = (char *)((long)buffer & -L2_CACHE_BYTES);
+        char *finish = (char *)L2_CACHE_ALIGN((long)buffer + size);
+        while (next < finish) {
+                __insn_inv(next);
+                next += CHIP_INV_STRIDE();
+        }
+}
+
+/* Invalidate a VA range and wait for it to be complete. */
+static inline void inv_buffer(void *buffer, size_t size)
+{
+        __inv_buffer(buffer, size);
+        mb();
+}
+#endif
+
 /*
  * Flush and invalidate a VA range that is homed remotely, waiting
  * until the memory controller holds the flushed values.  If "hfh" is
diff --git a/arch/tile/include/asm/cmpxchg.h b/arch/tile/include/asm/cmpxchg.h
index 276f067e3640..4001d5eab4bb 100644
--- a/arch/tile/include/asm/cmpxchg.h
+++ b/arch/tile/include/asm/cmpxchg.h
@@ -20,53 +20,108 @@
 
 #ifndef __ASSEMBLY__
 
-/* Nonexistent functions intended to cause link errors. */
-extern unsigned long __xchg_called_with_bad_pointer(void);
-extern unsigned long __cmpxchg_called_with_bad_pointer(void);
+#include <asm/barrier.h>
 
-#define xchg(ptr, x)                                                    \
+/* Nonexistent functions intended to cause compile errors. */
+extern void __xchg_called_with_bad_pointer(void)
+        __compiletime_error("Bad argument size for xchg");
+extern void __cmpxchg_called_with_bad_pointer(void)
+        __compiletime_error("Bad argument size for cmpxchg");
+
+#ifndef __tilegx__
+
+/* Note the _atomic_xxx() routines include a final mb(). */
+int _atomic_xchg(int *ptr, int n);
+int _atomic_xchg_add(int *v, int i);
+int _atomic_xchg_add_unless(int *v, int a, int u);
+int _atomic_cmpxchg(int *ptr, int o, int n);
+u64 _atomic64_xchg(u64 *v, u64 n);
+u64 _atomic64_xchg_add(u64 *v, u64 i);
+u64 _atomic64_xchg_add_unless(u64 *v, u64 a, u64 u);
+u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n);
+
+#define xchg(ptr, n)                                                    \
+        ({                                                              \
+                if (sizeof(*(ptr)) != 4)                                \
+                        __xchg_called_with_bad_pointer();               \
+                smp_mb();                                               \
+                (typeof(*(ptr)))_atomic_xchg((int *)(ptr), (int)(n));   \
+        })
+
+#define cmpxchg(ptr, o, n)                                              \
+        ({                                                              \
+                if (sizeof(*(ptr)) != 4)                                \
+                        __cmpxchg_called_with_bad_pointer();            \
+                smp_mb();                                               \
+                (typeof(*(ptr)))_atomic_cmpxchg((int *)ptr, (int)o, (int)n); \
+        })
+
+#define xchg64(ptr, n)                                                  \
+        ({                                                              \
+                if (sizeof(*(ptr)) != 8)                                \
+                        __xchg_called_with_bad_pointer();               \
+                smp_mb();                                               \
+                (typeof(*(ptr)))_atomic64_xchg((u64 *)(ptr), (u64)(n)); \
+        })
+
+#define cmpxchg64(ptr, o, n)                                            \
+        ({                                                              \
+                if (sizeof(*(ptr)) != 8)                                \
+                        __cmpxchg_called_with_bad_pointer();            \
+                smp_mb();                                               \
+                (typeof(*(ptr)))_atomic64_cmpxchg((u64 *)ptr, (u64)o, (u64)n); \
+        })
+
+#else
+
+#define xchg(ptr, n)                                                    \
         ({                                                              \
                 typeof(*(ptr)) __x;                                     \
+                smp_mb();                                               \
                 switch (sizeof(*(ptr))) {                               \
                 case 4:                                                 \
-                        __x = (typeof(__x))(typeof(__x-__x))atomic_xchg( \
-                                (atomic_t *)(ptr),                      \
-                                (u32)(typeof((x)-(x)))(x));             \
+                        __x = (typeof(__x))(unsigned long)              \
+                                __insn_exch4((ptr), (u32)(unsigned long)(n)); \
                         break;                                          \
                 case 8:                                                 \
-                        __x = (typeof(__x))(typeof(__x-__x))atomic64_xchg( \
-                                (atomic64_t *)(ptr),                    \
-                                (u64)(typeof((x)-(x)))(x));             \
+                        __x = (typeof(__x))                     \
+                                __insn_exch((ptr), (unsigned long)(n)); \
                         break;                                          \
                 default:                                                \
                         __xchg_called_with_bad_pointer();               \
+                        break;                                          \
                 }                                                       \
+                smp_mb();                                               \
                 __x;                                                    \
         })
 
 #define cmpxchg(ptr, o, n)                                              \
         ({                                                              \
                 typeof(*(ptr)) __x;                                     \
+                __insn_mtspr(SPR_CMPEXCH_VALUE, (unsigned long)(o));    \
+                smp_mb();                                               \
                 switch (sizeof(*(ptr))) {                               \
                 case 4:                                                 \
-                        __x = (typeof(__x))(typeof(__x-__x))atomic_cmpxchg( \
-                                (atomic_t *)(ptr),                      \
-                                (u32)(typeof((o)-(o)))(o),              \
-                                (u32)(typeof((n)-(n)))(n));             \
+                        __x = (typeof(__x))(unsigned long)              \
+                                __insn_cmpexch4((ptr), (u32)(unsigned long)(n)); \
                         break;                                          \
                 case 8:                                                 \
-                        __x = (typeof(__x))(typeof(__x-__x))atomic64_cmpxchg( \
-                                (atomic64_t *)(ptr),                    \
-                                (u64)(typeof((o)-(o)))(o),              \
-                                (u64)(typeof((n)-(n)))(n));             \
+                        __x = (typeof(__x))__insn_cmpexch((ptr), (u64)(n)); \
                         break;                                          \
                 default:                                                \
                         __cmpxchg_called_with_bad_pointer();            \
+                        break;                                          \
                 }                                                       \
+                smp_mb();                                               \
                 __x;                                                    \
         })
 
-#define tas(ptr) (xchg((ptr), 1))
+#define xchg64 xchg
+#define cmpxchg64 cmpxchg
+
+#endif
+
+#define tas(ptr) xchg((ptr), 1)
 
 #endif /* __ASSEMBLY__ */
 
diff --git a/arch/tile/include/asm/device.h b/arch/tile/include/asm/device.h
index 5182705bd056..6ab8bf146d4c 100644
--- a/arch/tile/include/asm/device.h
+++ b/arch/tile/include/asm/device.h
@@ -23,7 +23,10 @@ struct dev_archdata {
         /* Offset of the DMA address from the PA. */
         dma_addr_t              dma_offset;
 
-        /* Highest DMA address that can be generated by this device. */
+        /*
+         * Highest DMA address that can be generated by devices that
+         * have limited DMA capability, i.e. non 64-bit capable.
+         */
         dma_addr_t              max_direct_dma_addr;
 };
 
diff --git a/arch/tile/include/asm/dma-mapping.h b/arch/tile/include/asm/dma-mapping.h
index f2ff191376b4..1eae359d8315 100644
--- a/arch/tile/include/asm/dma-mapping.h
+++ b/arch/tile/include/asm/dma-mapping.h
@@ -20,9 +20,14 @@
 #include <linux/cache.h>
 #include <linux/io.h>
 
+#ifdef __tilegx__
+#define ARCH_HAS_DMA_GET_REQUIRED_MASK
+#endif
+
 extern struct dma_map_ops *tile_dma_map_ops;
 extern struct dma_map_ops *gx_pci_dma_map_ops;
 extern struct dma_map_ops *gx_legacy_pci_dma_map_ops;
+extern struct dma_map_ops *gx_hybrid_pci_dma_map_ops;
 
 static inline struct dma_map_ops *get_dma_ops(struct device *dev)
 {
@@ -44,12 +49,12 @@ static inline void set_dma_offset(struct device *dev, dma_addr_t off)
 
 static inline dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr)
 {
-        return paddr + get_dma_offset(dev);
+        return paddr;
 }
 
 static inline phys_addr_t dma_to_phys(struct device *dev, dma_addr_t daddr)
 {
-        return daddr - get_dma_offset(dev);
+        return daddr;
 }
 
 static inline void dma_mark_clean(void *addr, size_t size) {}
@@ -87,11 +92,19 @@ dma_set_mask(struct device *dev, u64 mask)
 {
         struct dma_map_ops *dma_ops = get_dma_ops(dev);
 
-        /* Handle legacy PCI devices with limited memory addressability. */
-        if ((dma_ops == gx_pci_dma_map_ops) && (mask <= DMA_BIT_MASK(32))) {
-                set_dma_ops(dev, gx_legacy_pci_dma_map_ops);
-                set_dma_offset(dev, 0);
-                if (mask > dev->archdata.max_direct_dma_addr)
+        /*
+         * For PCI devices with 64-bit DMA addressing capability, promote
+         * the dma_ops to hybrid, with the consistent memory DMA space limited
+         * to 32-bit. For 32-bit capable devices, limit the streaming DMA
+         * address range to max_direct_dma_addr.
+         */
+        if (dma_ops == gx_pci_dma_map_ops ||
+            dma_ops == gx_hybrid_pci_dma_map_ops ||
+            dma_ops == gx_legacy_pci_dma_map_ops) {
+                if (mask == DMA_BIT_MASK(64) &&
+                    dma_ops == gx_legacy_pci_dma_map_ops)
+                        set_dma_ops(dev, gx_hybrid_pci_dma_map_ops);
+                else if (mask > dev->archdata.max_direct_dma_addr)
                         mask = dev->archdata.max_direct_dma_addr;
         }
 
diff --git a/arch/tile/include/asm/elf.h b/arch/tile/include/asm/elf.h
index ff8a93408823..41d9878a9686 100644
--- a/arch/tile/include/asm/elf.h
+++ b/arch/tile/include/asm/elf.h
@@ -30,7 +30,6 @@ typedef unsigned long elf_greg_t;
 #define ELF_NGREG (sizeof(struct pt_regs) / sizeof(elf_greg_t))
 typedef elf_greg_t elf_gregset_t[ELF_NGREG];
 
-#define EM_TILE64  187
 #define EM_TILEPRO 188
 #define EM_TILEGX  191
 
@@ -132,6 +131,15 @@ extern int dump_task_regs(struct task_struct *, elf_gregset_t *);
 struct linux_binprm;
 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
                                        int executable_stack);
+#define ARCH_DLINFO \
+do { \
+        NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE); \
+} while (0)
+
+struct mm_struct;
+extern unsigned long arch_randomize_brk(struct mm_struct *mm);
+#define arch_randomize_brk arch_randomize_brk
+
 #ifdef CONFIG_COMPAT
 
 #define COMPAT_ELF_PLATFORM "tilegx-m32"
diff --git a/arch/tile/include/asm/fixmap.h b/arch/tile/include/asm/fixmap.h
index e16dbf929cb5..c6b9c1b38fd1 100644
--- a/arch/tile/include/asm/fixmap.h
+++ b/arch/tile/include/asm/fixmap.h
@@ -78,14 +78,6 @@ enum fixed_addresses {
 #endif
 };
 
-extern void __set_fixmap(enum fixed_addresses idx,
-                         unsigned long phys, pgprot_t flags);
-
-#define set_fixmap(idx, phys) \
-                __set_fixmap(idx, phys, PAGE_KERNEL)
-#define clear_fixmap(idx) \
-                __set_fixmap(idx, 0, __pgprot(0))
-
 #define __FIXADDR_SIZE  (__end_of_permanent_fixed_addresses << PAGE_SHIFT)
 #define __FIXADDR_BOOT_SIZE     (__end_of_fixed_addresses << PAGE_SHIFT)
 #define FIXADDR_START           (FIXADDR_TOP + PAGE_SIZE - __FIXADDR_SIZE)
diff --git a/arch/tile/include/asm/ftrace.h b/arch/tile/include/asm/ftrace.h
index 461459b06d98..13a9bb81a8ab 100644
--- a/arch/tile/include/asm/ftrace.h
+++ b/arch/tile/include/asm/ftrace.h
@@ -15,6 +15,26 @@
 #ifndef _ASM_TILE_FTRACE_H
 #define _ASM_TILE_FTRACE_H
 
-/* empty */
+#ifdef CONFIG_FUNCTION_TRACER
+
+#define MCOUNT_ADDR ((unsigned long)(__mcount))
+#define MCOUNT_INSN_SIZE 8              /* sizeof mcount call */
+
+#ifndef __ASSEMBLY__
+extern void __mcount(void);
+
+#ifdef CONFIG_DYNAMIC_FTRACE
+static inline unsigned long ftrace_call_adjust(unsigned long addr)
+{
+        return addr;
+}
+
+struct dyn_arch_ftrace {
+};
+#endif /*  CONFIG_DYNAMIC_FTRACE */
+
+#endif /* __ASSEMBLY__ */
+
+#endif /* CONFIG_FUNCTION_TRACER */
 
 #endif /* _ASM_TILE_FTRACE_H */
diff --git a/arch/tile/include/asm/futex.h b/arch/tile/include/asm/futex.h
index 5909ac3d7218..1a6ef1b69cb1 100644
--- a/arch/tile/include/asm/futex.h
+++ b/arch/tile/include/asm/futex.h
@@ -43,6 +43,7 @@
             ".pushsection .fixup,\"ax\"\n"                      \
             "0: { movei %0, %5; j 9f }\n"                       \
             ".section __ex_table,\"a\"\n"                       \
+            ".align 8\n"                                        \
             ".quad 1b, 0b\n"                                    \
             ".popsection\n"                                     \
             "9:"                                                \
diff --git a/arch/tile/include/asm/homecache.h b/arch/tile/include/asm/homecache.h
index 7b7771328642..7ddd1b8d6910 100644
--- a/arch/tile/include/asm/homecache.h
+++ b/arch/tile/include/asm/homecache.h
@@ -33,8 +33,7 @@ struct zone;
 
 /*
  * Is this page immutable (unwritable) and thus able to be cached more
- * widely than would otherwise be possible?  On tile64 this means we
- * mark the PTE to cache locally; on tilepro it means we have "nc" set.
+ * widely than would otherwise be possible?  This means we have "nc" set.
  */
 #define PAGE_HOME_IMMUTABLE -2
 
@@ -44,16 +43,8 @@ struct zone;
  */
 #define PAGE_HOME_INCOHERENT -3
 
-#if CHIP_HAS_CBOX_HOME_MAP()
 /* Home for the page is distributed via hash-for-home. */
 #define PAGE_HOME_HASH -4
-#endif
-
-/* Homing is unknown or unspecified.  Not valid for page_home(). */
-#define PAGE_HOME_UNKNOWN -5
-
-/* Home on the current cpu.  Not valid for page_home(). */
-#define PAGE_HOME_HERE -6
 
 /* Support wrapper to use instead of explicit hv_flush_remote(). */
 extern void flush_remote(unsigned long cache_pfn, unsigned long cache_length,
diff --git a/arch/tile/include/asm/io.h b/arch/tile/include/asm/io.h
index 31672918064c..9fe434969fab 100644
--- a/arch/tile/include/asm/io.h
+++ b/arch/tile/include/asm/io.h
@@ -19,7 +19,8 @@
 #include <linux/bug.h>
 #include <asm/page.h>
 
-#define IO_SPACE_LIMIT 0xfffffffful
+/* Maximum PCI I/O space address supported. */
+#define IO_SPACE_LIMIT 0xffffffff
 
 /*
  * Convert a physical pointer to a virtual kernel pointer for /dev/mem
@@ -254,7 +255,7 @@ static inline void writeq(u64 val, unsigned long addr)
 
 static inline void memset_io(volatile void *dst, int val, size_t len)
 {
-        int x;
+        size_t x;
         BUG_ON((unsigned long)dst & 0x3);
         val = (val & 0xff) * 0x01010101;
         for (x = 0; x < len; x += 4)
@@ -264,7 +265,7 @@ static inline void memset_io(volatile void *dst, int val, size_t len)
 static inline void memcpy_fromio(void *dst, const volatile void __iomem *src,
                                  size_t len)
 {
-        int x;
+        size_t x;
         BUG_ON((unsigned long)src & 0x3);
         for (x = 0; x < len; x += 4)
                 *(u32 *)(dst + x) = readl(src + x);
@@ -273,7 +274,7 @@ static inline void memcpy_fromio(void *dst, const volatile void __iomem *src,
 static inline void memcpy_toio(volatile void __iomem *dst, const void *src,
                                 size_t len)
 {
-        int x;
+        size_t x;
         BUG_ON((unsigned long)dst & 0x3);
         for (x = 0; x < len; x += 4)
                 writel(*(u32 *)(src + x), dst + x);
@@ -281,8 +282,108 @@ static inline void memcpy_toio(volatile void __iomem *dst, const void *src,
 
 #endif
 
+#if CHIP_HAS_MMIO() && defined(CONFIG_TILE_PCI_IO)
+
+static inline u8 inb(unsigned long addr)
+{
+        return readb((volatile void __iomem *) addr);
+}
+
+static inline u16 inw(unsigned long addr)
+{
+        return readw((volatile void __iomem *) addr);
+}
+
+static inline u32 inl(unsigned long addr)
+{
+        return readl((volatile void __iomem *) addr);
+}
+
+static inline void outb(u8 b, unsigned long addr)
+{
+        writeb(b, (volatile void __iomem *) addr);
+}
+
+static inline void outw(u16 b, unsigned long addr)
+{
+        writew(b, (volatile void __iomem *) addr);
+}
+
+static inline void outl(u32 b, unsigned long addr)
+{
+        writel(b, (volatile void __iomem *) addr);
+}
+
+static inline void insb(unsigned long addr, void *buffer, int count)
+{
+        if (count) {
+                u8 *buf = buffer;
+                do {
+                        u8 x = inb(addr);
+                        *buf++ = x;
+                } while (--count);
+        }
+}
+
+static inline void insw(unsigned long addr, void *buffer, int count)
+{
+        if (count) {
+                u16 *buf = buffer;
+                do {
+                        u16 x = inw(addr);
+                        *buf++ = x;
+                } while (--count);
+        }
+}
+
+static inline void insl(unsigned long addr, void *buffer, int count)
+{
+        if (count) {
+                u32 *buf = buffer;
+                do {
+                        u32 x = inl(addr);
+                        *buf++ = x;
+                } while (--count);
+        }
+}
+
+static inline void outsb(unsigned long addr, const void *buffer, int count)
+{
+        if (count) {
+                const u8 *buf = buffer;
+                do {
+                        outb(*buf++, addr);
+                } while (--count);
+        }
+}
+
+static inline void outsw(unsigned long addr, const void *buffer, int count)
+{
+        if (count) {
+                const u16 *buf = buffer;
+                do {
+                        outw(*buf++, addr);
+                } while (--count);
+        }
+}
+
+static inline void outsl(unsigned long addr, const void *buffer, int count)
+{
+        if (count) {
+                const u32 *buf = buffer;
+                do {
+                        outl(*buf++, addr);
+                } while (--count);
+        }
+}
+
+extern void __iomem *ioport_map(unsigned long port, unsigned int len);
+extern void ioport_unmap(void __iomem *addr);
+
+#else
+
 /*
- * The Tile architecture does not support IOPORT, even with PCI.
+ * The TilePro architecture does not support IOPORT, even with PCI.
  * Unfortunately we can't yet simply not declare these methods,
  * since some generic code that compiles into the kernel, but
  * we never run, uses them unconditionally.
@@ -290,7 +391,12 @@ static inline void memcpy_toio(volatile void __iomem *dst, const void *src,
 
 static inline long ioport_panic(void)
 {
+#ifdef __tilegx__
+        panic("PCI IO space support is disabled. Configure the kernel with"
+              " CONFIG_TILE_PCI_IO to enable it");
+#else
         panic("inb/outb and friends do not exist on tile");
+#endif
         return 0;
 }
 
@@ -335,13 +441,6 @@ static inline void outl(u32 b, unsigned long addr)
         ioport_panic();
 }
 
-#define inb_p(addr)     inb(addr)
-#define inw_p(addr)     inw(addr)
-#define inl_p(addr)     inl(addr)
-#define outb_p(x, addr) outb((x), (addr))
-#define outw_p(x, addr) outw((x), (addr))
-#define outl_p(x, addr) outl((x), (addr))
-
 static inline void insb(unsigned long addr, void *buffer, int count)
 {
         ioport_panic();
@@ -372,6 +471,15 @@ static inline void outsl(unsigned long addr, const void *buffer, int count)
         ioport_panic();
 }
 
+#endif /* CHIP_HAS_MMIO() && defined(CONFIG_TILE_PCI_IO) */
+
+#define inb_p(addr)     inb(addr)
+#define inw_p(addr)     inw(addr)
+#define inl_p(addr)     inl(addr)
+#define outb_p(x, addr) outb((x), (addr))
+#define outw_p(x, addr) outw((x), (addr))
+#define outl_p(x, addr) outl((x), (addr))
+
 #define ioread16be(addr)        be16_to_cpu(ioread16(addr))
 #define ioread32be(addr)        be32_to_cpu(ioread32(addr))
 #define iowrite16be(v, addr)    iowrite16(be16_to_cpu(v), (addr))
diff --git a/arch/tile/include/asm/irqflags.h b/arch/tile/include/asm/irqflags.h
index c96f9bbb760d..71af5747874d 100644
--- a/arch/tile/include/asm/irqflags.h
+++ b/arch/tile/include/asm/irqflags.h
@@ -124,6 +124,12 @@
 DECLARE_PER_CPU(unsigned long long, interrupts_enabled_mask);
 #define INITIAL_INTERRUPTS_ENABLED (1ULL << INT_MEM_ERROR)
 
+#ifdef CONFIG_DEBUG_PREEMPT
+/* Due to inclusion issues, we can't rely on <linux/smp.h> here. */
+extern unsigned int debug_smp_processor_id(void);
+# define smp_processor_id() debug_smp_processor_id()
+#endif
+
 /* Disable interrupts. */
 #define arch_local_irq_disable() \
         interrupt_mask_set_mask(LINUX_MASKABLE_INTERRUPTS)
@@ -132,9 +138,18 @@ DECLARE_PER_CPU(unsigned long long, interrupts_enabled_mask);
 #define arch_local_irq_disable_all() \
         interrupt_mask_set_mask(-1ULL)
 
+/*
+ * Read the set of maskable interrupts.
+ * We avoid the preemption warning here via __this_cpu_ptr since even
+ * if irqs are already enabled, it's harmless to read the wrong cpu's
+ * enabled mask.
+ */
+#define arch_local_irqs_enabled() \
+        (*__this_cpu_ptr(&interrupts_enabled_mask))
+
 /* Re-enable all maskable interrupts. */
 #define arch_local_irq_enable() \
-        interrupt_mask_reset_mask(__get_cpu_var(interrupts_enabled_mask))
+        interrupt_mask_reset_mask(arch_local_irqs_enabled())
 
 /* Disable or enable interrupts based on flag argument. */
 #define arch_local_irq_restore(disabled) do { \
@@ -161,7 +176,7 @@ DECLARE_PER_CPU(unsigned long long, interrupts_enabled_mask);
 
 /* Prevent the given interrupt from being enabled next time we enable irqs. */
 #define arch_local_irq_mask(interrupt) \
-        (__get_cpu_var(interrupts_enabled_mask) &= ~(1ULL << (interrupt)))
+        this_cpu_and(interrupts_enabled_mask, ~(1ULL << (interrupt)))
 
 /* Prevent the given interrupt from being enabled immediately. */
 #define arch_local_irq_mask_now(interrupt) do { \
@@ -171,7 +186,7 @@ DECLARE_PER_CPU(unsigned long long, interrupts_enabled_mask);
 
 /* Allow the given interrupt to be enabled next time we enable irqs. */
 #define arch_local_irq_unmask(interrupt) \
-        (__get_cpu_var(interrupts_enabled_mask) |= (1ULL << (interrupt)))
+        this_cpu_or(interrupts_enabled_mask, (1ULL << (interrupt)))
 
 /* Allow the given interrupt to be enabled immediately, if !irqs_disabled. */
 #define arch_local_irq_unmask_now(interrupt) do { \
diff --git a/arch/tile/include/asm/hw_irq.h b/arch/tile/include/asm/kdebug.h
index 4fac5fbf333e..5bbbfa904c2d 100644
--- a/arch/tile/include/asm/hw_irq.h
+++ b/arch/tile/include/asm/kdebug.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2010 Tilera Corporation. All Rights Reserved.
+ * Copyright 2012 Tilera Corporation. All Rights Reserved.
  *
  *   This program is free software; you can redistribute it and/or
  *   modify it under the terms of the GNU General Public License
@@ -12,7 +12,17 @@
  *   more details.
  */
 
-#ifndef _ASM_TILE_HW_IRQ_H
-#define _ASM_TILE_HW_IRQ_H
+#ifndef _ASM_TILE_KDEBUG_H
+#define _ASM_TILE_KDEBUG_H
 
-#endif /* _ASM_TILE_HW_IRQ_H */
+#include <linux/notifier.h>
+
+enum die_val {
+        DIE_OOPS = 1,
+        DIE_BREAK,
+        DIE_SSTEPBP,
+        DIE_PAGE_FAULT,
+        DIE_COMPILED_BPT
+};
+
+#endif /* _ASM_TILE_KDEBUG_H */
diff --git a/arch/tile/include/asm/kgdb.h b/arch/tile/include/asm/kgdb.h
new file mode 100644
index 000000000000..280c181cf0db
--- /dev/null
+++ b/arch/tile/include/asm/kgdb.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright 2013 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ *
+ * TILE-Gx KGDB support.
+ */
+
+#ifndef __TILE_KGDB_H__
+#define __TILE_KGDB_H__
+
+#include <linux/kdebug.h>
+#include <arch/opcode.h>
+
+#define GDB_SIZEOF_REG          sizeof(unsigned long)
+
+/*
+ * TILE-Gx gdb is expecting the following register layout:
+ * 56 GPRs(R0 - R52, TP, SP, LR), 8 special GPRs(networks and ZERO),
+ * plus the PC and the faultnum.
+ *
+ * Even though kernel not use the 8 special GPRs, they need to be present
+ * in the registers sent for correct processing in the host-side gdb.
+ *
+ */
+#define DBG_MAX_REG_NUM         (56+8+2)
+#define NUMREGBYTES             (DBG_MAX_REG_NUM * GDB_SIZEOF_REG)
+
+/*
+ * BUFMAX defines the maximum number of characters in inbound/outbound
+ * buffers at least NUMREGBYTES*2 are needed for register packets,
+ * Longer buffer is needed to list all threads.
+ */
+#define BUFMAX                  2048
+
+#define BREAK_INSTR_SIZE        TILEGX_BUNDLE_SIZE_IN_BYTES
+
+/*
+ * Require cache flush for set/clear a software breakpoint or write memory.
+ */
+#define CACHE_FLUSH_IS_SAFE     1
+
+/*
+ * The compiled-in breakpoint instruction can be used to "break" into
+ * the debugger via magic system request key (sysrq-G).
+ */
+static tile_bundle_bits compiled_bpt = TILEGX_BPT_BUNDLE | DIE_COMPILED_BPT;
+
+enum tilegx_regnum {
+        TILEGX_PC_REGNUM = TREG_LAST_GPR + 9,
+        TILEGX_FAULTNUM_REGNUM,
+};
+
+/*
+ * Generate a breakpoint exception to "break" into the debugger.
+ */
+static inline void arch_kgdb_breakpoint(void)
+{
+        asm volatile (".quad %0\n\t"
+                      ::""(compiled_bpt));
+}
+
+#endif /* __TILE_KGDB_H__ */
diff --git a/arch/tile/include/asm/kprobes.h b/arch/tile/include/asm/kprobes.h
new file mode 100644
index 000000000000..d8f9a83943b1
--- /dev/null
+++ b/arch/tile/include/asm/kprobes.h
@@ -0,0 +1,79 @@
+/*
+ * arch/tile/include/asm/kprobes.h
+ *
+ * Copyright 2012 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+#ifndef _ASM_TILE_KPROBES_H
+#define _ASM_TILE_KPROBES_H
+
+#include <linux/types.h>
+#include <linux/ptrace.h>
+#include <linux/percpu.h>
+
+#include <arch/opcode.h>
+
+#define __ARCH_WANT_KPROBES_INSN_SLOT
+#define MAX_INSN_SIZE                   2
+
+#define kretprobe_blacklist_size 0
+
+typedef tile_bundle_bits kprobe_opcode_t;
+
+#define flush_insn_slot(p)                                              \
+        flush_icache_range((unsigned long)p->addr,                      \
+                           (unsigned long)p->addr +                     \
+                           (MAX_INSN_SIZE * sizeof(kprobe_opcode_t)))
+
+struct kprobe;
+
+/* Architecture specific copy of original instruction. */
+struct arch_specific_insn {
+        kprobe_opcode_t *insn;
+};
+
+struct prev_kprobe {
+        struct kprobe *kp;
+        unsigned long status;
+        unsigned long saved_pc;
+};
+
+#define MAX_JPROBES_STACK_SIZE 128
+#define MAX_JPROBES_STACK_ADDR \
+        (((unsigned long)current_thread_info()) + THREAD_SIZE - 32 \
+                - sizeof(struct pt_regs))
+
+#define MIN_JPROBES_STACK_SIZE(ADDR)                                    \
+        ((((ADDR) + MAX_JPROBES_STACK_SIZE) > MAX_JPROBES_STACK_ADDR)   \
+                ? MAX_JPROBES_STACK_ADDR - (ADDR)                       \
+                : MAX_JPROBES_STACK_SIZE)
+
+/* per-cpu kprobe control block. */
+struct kprobe_ctlblk {
+        unsigned long kprobe_status;
+        unsigned long kprobe_saved_pc;
+        unsigned long jprobe_saved_sp;
+        struct prev_kprobe prev_kprobe;
+        struct pt_regs jprobe_saved_regs;
+        char jprobes_stack[MAX_JPROBES_STACK_SIZE];
+};
+
+extern tile_bundle_bits breakpoint2_insn;
+extern tile_bundle_bits breakpoint_insn;
+
+void arch_remove_kprobe(struct kprobe *);
+
+extern int kprobe_exceptions_notify(struct notifier_block *self,
+                             unsigned long val, void *data);
+
+#endif /* _ASM_TILE_KPROBES_H */
diff --git a/arch/tile/include/asm/mmu.h b/arch/tile/include/asm/mmu.h
index e2c789096795..0cab1182bde1 100644
--- a/arch/tile/include/asm/mmu.h
+++ b/arch/tile/include/asm/mmu.h
@@ -22,6 +22,7 @@ struct mm_context {
          * semaphore but atomically, but it is conservatively set.
          */
         unsigned long priority_cached;
+        unsigned long vdso_base;
 };
 
 typedef struct mm_context mm_context_t;
diff --git a/arch/tile/include/asm/mmu_context.h b/arch/tile/include/asm/mmu_context.h
index 37f0b741dee7..4734215e2ad4 100644
--- a/arch/tile/include/asm/mmu_context.h
+++ b/arch/tile/include/asm/mmu_context.h
@@ -45,7 +45,7 @@ static inline void __install_page_table(pgd_t *pgdir, int asid, pgprot_t prot)
 
 static inline void install_page_table(pgd_t *pgdir, int asid)
 {
-        pte_t *ptep = virt_to_pte(NULL, (unsigned long)pgdir);
+        pte_t *ptep = virt_to_kpte((unsigned long)pgdir);
         __install_page_table(pgdir, asid, *ptep);
 }
 
diff --git a/arch/tile/include/asm/mmzone.h b/arch/tile/include/asm/mmzone.h
index 9d3dbce8f953..804f1098b6cd 100644
--- a/arch/tile/include/asm/mmzone.h
+++ b/arch/tile/include/asm/mmzone.h
@@ -42,7 +42,7 @@ static inline int pfn_to_nid(unsigned long pfn)
 
 #define kern_addr_valid(kaddr)  virt_addr_valid((void *)kaddr)
 
-static inline int pfn_valid(int pfn)
+static inline int pfn_valid(unsigned long pfn)
 {
         int nid = pfn_to_nid(pfn);
 
diff --git a/arch/tile/include/asm/page.h b/arch/tile/include/asm/page.h
index dd033a4fd627..6346888f7bdc 100644
--- a/arch/tile/include/asm/page.h
+++ b/arch/tile/include/asm/page.h
@@ -39,6 +39,12 @@
 #define HPAGE_MASK      (~(HPAGE_SIZE - 1))
 
 /*
+ * We do define AT_SYSINFO_EHDR to support vDSO,
+ * but don't use the gate mechanism.
+ */
+#define __HAVE_ARCH_GATE_AREA           1
+
+/*
  * If the Kconfig doesn't specify, set a maximum zone order that
  * is enough so that we can create huge pages from small pages given
  * the respective sizes of the two page types.  See <linux/mmzone.h>.
@@ -142,8 +148,12 @@ static inline __attribute_const__ int get_order(unsigned long size)
 #define HAVE_ARCH_HUGETLB_UNMAPPED_AREA
 #endif
 
+/* Allow overriding how much VA or PA the kernel will use. */
+#define MAX_PA_WIDTH CHIP_PA_WIDTH()
+#define MAX_VA_WIDTH CHIP_VA_WIDTH()
+
 /* Each memory controller has PAs distinct in their high bits. */
-#define NR_PA_HIGHBIT_SHIFT (CHIP_PA_WIDTH() - CHIP_LOG_NUM_MSHIMS())
+#define NR_PA_HIGHBIT_SHIFT (MAX_PA_WIDTH - CHIP_LOG_NUM_MSHIMS())
 #define NR_PA_HIGHBIT_VALUES (1 << CHIP_LOG_NUM_MSHIMS())
 #define __pa_to_highbits(pa) ((phys_addr_t)(pa) >> NR_PA_HIGHBIT_SHIFT)
 #define __pfn_to_highbits(pfn) ((pfn) >> (NR_PA_HIGHBIT_SHIFT - PAGE_SHIFT))
@@ -154,7 +164,7 @@ static inline __attribute_const__ int get_order(unsigned long size)
  * We reserve the lower half of memory for user-space programs, and the
  * upper half for system code.  We re-map all of physical memory in the
  * upper half, which takes a quarter of our VA space.  Then we have
- * the vmalloc regions.  The supervisor code lives at 0xfffffff700000000,
+ * the vmalloc regions.  The supervisor code lives at the highest address,
  * with the hypervisor above that.
  *
  * Loadable kernel modules are placed immediately after the static
@@ -166,26 +176,19 @@ static inline __attribute_const__ int get_order(unsigned long size)
  * Similarly, for now we don't play any struct page mapping games.
  */
 
-#if CHIP_PA_WIDTH() + 2 > CHIP_VA_WIDTH()
+#if MAX_PA_WIDTH + 2 > MAX_VA_WIDTH
 # error Too much PA to map with the VA available!
 #endif
-#define HALF_VA_SPACE           (_AC(1, UL) << (CHIP_VA_WIDTH() - 1))
 
-#define MEM_LOW_END             (HALF_VA_SPACE - 1)         /* low half */
-#define MEM_HIGH_START          (-HALF_VA_SPACE)            /* high half */
-#define PAGE_OFFSET             MEM_HIGH_START
-#define FIXADDR_BASE            _AC(0xfffffff400000000, UL) /* 4 GB */
-#define FIXADDR_TOP             _AC(0xfffffff500000000, UL) /* 4 GB */
+#define PAGE_OFFSET             (-(_AC(1, UL) << (MAX_VA_WIDTH - 1)))
+#define KERNEL_HIGH_VADDR       _AC(0xfffffff800000000, UL)  /* high 32GB */
+#define FIXADDR_BASE            (KERNEL_HIGH_VADDR - 0x400000000) /* 4 GB */
+#define FIXADDR_TOP             (KERNEL_HIGH_VADDR - 0x300000000) /* 4 GB */
 #define _VMALLOC_START          FIXADDR_TOP
-#define HUGE_VMAP_BASE          _AC(0xfffffff600000000, UL) /* 4 GB */
-#define MEM_SV_START            _AC(0xfffffff700000000, UL) /* 256 MB */
-#define MEM_SV_INTRPT           MEM_SV_START
-#define MEM_MODULE_START        _AC(0xfffffff710000000, UL) /* 256 MB */
+#define HUGE_VMAP_BASE          (KERNEL_HIGH_VADDR - 0x200000000) /* 4 GB */
+#define MEM_SV_START            (KERNEL_HIGH_VADDR - 0x100000000) /* 256 MB */
+#define MEM_MODULE_START        (MEM_SV_START + (256*1024*1024)) /* 256 MB */
 #define MEM_MODULE_END          (MEM_MODULE_START + (256*1024*1024))
-#define MEM_HV_START            _AC(0xfffffff800000000, UL) /* 32 GB */
-
-/* Highest DTLB address we will use */
-#define KERNEL_HIGH_VADDR       MEM_SV_START
 
 #else /* !__tilegx__ */
 
@@ -207,25 +210,18 @@ static inline __attribute_const__ int get_order(unsigned long size)
  * values, and after that, we show "typical" values, since the actual
  * addresses depend on kernel #defines.
  *
- * MEM_HV_INTRPT                   0xfe000000
- * MEM_SV_INTRPT (kernel code)     0xfd000000
+ * MEM_HV_START                    0xfe000000
+ * MEM_SV_START  (kernel code)     0xfd000000
  * MEM_USER_INTRPT (user vector)   0xfc000000
- * FIX_KMAP_xxx                    0xf8000000 (via NR_CPUS * KM_TYPE_NR)
- * PKMAP_BASE                      0xf7000000 (via LAST_PKMAP)
- * HUGE_VMAP                       0xf3000000 (via CONFIG_NR_HUGE_VMAPS)
- * VMALLOC_START                   0xf0000000 (via __VMALLOC_RESERVE)
+ * FIX_KMAP_xxx                    0xfa000000 (via NR_CPUS * KM_TYPE_NR)
+ * PKMAP_BASE                      0xf9000000 (via LAST_PKMAP)
+ * VMALLOC_START                   0xf7000000 (via VMALLOC_RESERVE)
  * mapped LOWMEM                   0xc0000000
  */
 
 #define MEM_USER_INTRPT         _AC(0xfc000000, UL)
-#if CONFIG_KERNEL_PL == 1
-#define MEM_SV_INTRPT           _AC(0xfd000000, UL)
-#define MEM_HV_INTRPT           _AC(0xfe000000, UL)
-#else
-#define MEM_GUEST_INTRPT        _AC(0xfd000000, UL)
-#define MEM_SV_INTRPT           _AC(0xfe000000, UL)
-#define MEM_HV_INTRPT           _AC(0xff000000, UL)
-#endif
+#define MEM_SV_START            _AC(0xfd000000, UL)
+#define MEM_HV_START            _AC(0xfe000000, UL)
 
 #define INTRPT_SIZE             0x4000
 
@@ -246,7 +242,7 @@ static inline __attribute_const__ int get_order(unsigned long size)
 
 #endif /* __tilegx__ */
 
-#ifndef __ASSEMBLY__
+#if !defined(__ASSEMBLY__) && !defined(VDSO_BUILD)
 
 #ifdef CONFIG_HIGHMEM
 
@@ -332,6 +328,7 @@ static inline int pfn_valid(unsigned long pfn)
 
 struct mm_struct;
 extern pte_t *virt_to_pte(struct mm_struct *mm, unsigned long addr);
+extern pte_t *virt_to_kpte(unsigned long kaddr);
 
 #endif /* !__ASSEMBLY__ */
 
diff --git a/arch/tile/include/asm/pci.h b/arch/tile/include/asm/pci.h
index 54a924208d3c..dfedd7ac7298 100644
--- a/arch/tile/include/asm/pci.h
+++ b/arch/tile/include/asm/pci.h
@@ -17,7 +17,6 @@
 
 #include <linux/dma-mapping.h>
 #include <linux/pci.h>
-#include <linux/numa.h>
 #include <asm-generic/pci_iomap.h>
 
 #ifndef __tilegx__
@@ -29,7 +28,6 @@ struct pci_controller {
         int index;              /* PCI domain number */
         struct pci_bus *root_bus;
 
-        int first_busno;
         int last_busno;
 
         int hv_cfg_fd[2];       /* config{0,1} fds for this PCIe controller */
@@ -124,6 +122,11 @@ static inline void pci_iounmap(struct pci_dev *dev, void __iomem *addr) {}
  * the CPA plus TILE_PCI_MEM_MAP_BASE_OFFSET. To support 32-bit
  * devices, we create a separate map region that handles the low
  * 4GB.
+ *
+ * This design lets us avoid the "PCI hole" problem where the host bridge
+ * won't pass DMA traffic with target addresses that happen to fall within the
+ * BAR space. This enables us to use all the physical memory for DMA, instead
+ * of wasting the same amount of physical memory as the BAR window size.
  */
 #define TILE_PCI_MEM_MAP_BASE_OFFSET    (1ULL << CHIP_PA_WIDTH())
 
@@ -145,6 +148,10 @@ struct pci_controller {
 
         int pio_mem_index;      /* PIO region index for memory access */
 
+#ifdef CONFIG_TILE_PCI_IO
+        int pio_io_index;       /* PIO region index for I/O space access */
+#endif
+
         /*
          * Mem-Map regions for all the memory controllers so that Linux can
          * map all of its physical memory space to the PCI bus.
@@ -154,6 +161,10 @@ struct pci_controller {
         int index;              /* PCI domain number */
         struct pci_bus *root_bus;
 
+        /* PCI I/O space resource for this controller. */
+        struct resource io_space;
+        char io_space_name[32];
+
         /* PCI memory space resource for this controller. */
         struct resource mem_space;
         char mem_space_name[32];
@@ -166,13 +177,11 @@ struct pci_controller {
 
         /* Table that maps the INTx numbers to Linux irq numbers. */
         int irq_intx_table[4];
-
-        /* Address ranges that are routed to this controller/bridge. */
-        struct resource mem_resources[3];
 };
 
 extern struct pci_controller pci_controllers[TILEGX_NUM_TRIO * TILEGX_TRIO_PCIES];
 extern gxio_trio_context_t trio_contexts[TILEGX_NUM_TRIO];
+extern int num_trio_shims;
 
 extern void pci_iounmap(struct pci_dev *dev, void __iomem *);
 
@@ -211,7 +220,8 @@ static inline int pcibios_assign_all_busses(void)
 }
 
 #define PCIBIOS_MIN_MEM         0
-#define PCIBIOS_MIN_IO          0
+/* Minimum PCI I/O address, starting at the page boundary. */
+#define PCIBIOS_MIN_IO          PAGE_SIZE
 
 /* Use any cpu for PCI. */
 #define cpumask_of_pcibus(bus) cpu_online_mask
diff --git a/arch/tile/include/asm/pgtable_32.h b/arch/tile/include/asm/pgtable_32.h
index 4ce4a7a99c24..63142ab3b3dd 100644
--- a/arch/tile/include/asm/pgtable_32.h
+++ b/arch/tile/include/asm/pgtable_32.h
@@ -84,10 +84,12 @@ extern unsigned long VMALLOC_RESERVE /* = CONFIG_VMALLOC_RESERVE */;
 /* We have no pmd or pud since we are strictly a two-level page table */
 #include <asm-generic/pgtable-nopmd.h>
 
+static inline int pud_huge_page(pud_t pud)      { return 0; }
+
 /* We don't define any pgds for these addresses. */
 static inline int pgd_addr_invalid(unsigned long addr)
 {
-        return addr >= MEM_HV_INTRPT;
+        return addr >= MEM_HV_START;
 }
 
 /*
diff --git a/arch/tile/include/asm/pgtable_64.h b/arch/tile/include/asm/pgtable_64.h
index 2492fa5478e7..3421177f7370 100644
--- a/arch/tile/include/asm/pgtable_64.h
+++ b/arch/tile/include/asm/pgtable_64.h
@@ -63,6 +63,15 @@
 /* We have no pud since we are a three-level page table. */
 #include <asm-generic/pgtable-nopud.h>
 
+/*
+ * pmds are the same as pgds and ptes, so converting is a no-op.
+ */
+#define pmd_pte(pmd) (pmd)
+#define pmdp_ptep(pmdp) (pmdp)
+#define pte_pmd(pte) (pte)
+
+#define pud_pte(pud) ((pud).pgd)
+
 static inline int pud_none(pud_t pud)
 {
         return pud_val(pud) == 0;
@@ -73,6 +82,11 @@ static inline int pud_present(pud_t pud)
         return pud_val(pud) & _PAGE_PRESENT;
 }
 
+static inline int pud_huge_page(pud_t pud)
+{
+        return pud_val(pud) & _PAGE_HUGE_PAGE;
+}
+
 #define pmd_ERROR(e) \
         pr_err("%s:%d: bad pmd 0x%016llx.\n", __FILE__, __LINE__, pmd_val(e))
 
@@ -89,6 +103,9 @@ static inline int pud_bad(pud_t pud)
 /* Return the page-table frame number (ptfn) that a pud_t points at. */
 #define pud_ptfn(pud) hv_pte_get_ptfn((pud).pgd)
 
+/* Return the page frame number (pfn) that a pud_t points at. */
+#define pud_pfn(pud) pte_pfn(pud_pte(pud))
+
 /*
  * A given kernel pud_t maps to a kernel pmd_t table at a specific
  * virtual address.  Since kernel pmd_t tables can be aligned at
@@ -123,8 +140,7 @@ static inline unsigned long pgd_addr_normalize(unsigned long addr)
 /* We don't define any pgds for these addresses. */
 static inline int pgd_addr_invalid(unsigned long addr)
 {
-        return addr >= MEM_HV_START ||
-                (addr > MEM_LOW_END && addr < MEM_HIGH_START);
+        return addr >= KERNEL_HIGH_VADDR || addr != pgd_addr_normalize(addr);
 }
 
 /*
@@ -152,13 +168,6 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm,
         return hv_pte(__insn_exch(&ptep->val, 0UL));
 }
 
-/*
- * pmds are the same as pgds and ptes, so converting is a no-op.
- */
-#define pmd_pte(pmd) (pmd)
-#define pmdp_ptep(pmdp) (pmdp)
-#define pte_pmd(pte) (pte)
-
 #endif /* __ASSEMBLY__ */
 
 #endif /* _ASM_TILE_PGTABLE_64_H */
diff --git a/arch/tile/include/asm/processor.h b/arch/tile/include/asm/processor.h
index b3f104953da2..42323636c459 100644
--- a/arch/tile/include/asm/processor.h
+++ b/arch/tile/include/asm/processor.h
@@ -15,6 +15,8 @@
 #ifndef _ASM_TILE_PROCESSOR_H
 #define _ASM_TILE_PROCESSOR_H
 
+#include <arch/chip.h>
+
 #ifndef __ASSEMBLY__
 
 /*
@@ -25,7 +27,6 @@
 #include <asm/ptrace.h>
 #include <asm/percpu.h>
 
-#include <arch/chip.h>
 #include <arch/spr_def.h>
 
 struct task_struct;
@@ -110,18 +111,16 @@ struct thread_struct {
         unsigned long long interrupt_mask;
         /* User interrupt-control 0 state */
         unsigned long intctrl_0;
-#if CHIP_HAS_PROC_STATUS_SPR()
+        /* Is this task currently doing a backtrace? */
+        bool in_backtrace;
         /* Any other miscellaneous processor state bits */
         unsigned long proc_status;
-#endif
 #if !CHIP_HAS_FIXED_INTVEC_BASE()
         /* Interrupt base for PL0 interrupts */
         unsigned long interrupt_vector_base;
 #endif
-#if CHIP_HAS_TILE_RTF_HWM()
         /* Tile cache retry fifo high-water mark */
         unsigned long tile_rtf_hwm;
-#endif
 #if CHIP_HAS_DSTREAM_PF()
         /* Data stream prefetch control */
         unsigned long dstream_pf;
@@ -134,21 +133,16 @@ struct thread_struct {
         /* Async DMA TLB fault information */
         struct async_tlb dma_async_tlb;
 #endif
-#if CHIP_HAS_SN_PROC()
-        /* Was static network processor when we were switched out? */
-        int sn_proc_running;
-        /* Async SNI TLB fault information */
-        struct async_tlb sn_async_tlb;
-#endif
 };
 
 #endif /* !__ASSEMBLY__ */
 
 /*
  * Start with "sp" this many bytes below the top of the kernel stack.
- * This preserves the invariant that a called function may write to *sp.
+ * This allows us to be cache-aware when handling the initial save
+ * of the pt_regs value to the stack.
  */
-#define STACK_TOP_DELTA 8
+#define STACK_TOP_DELTA 64
 
 /*
  * When entering the kernel via a fault, start with the top of the
@@ -164,7 +158,7 @@ struct thread_struct {
 #ifndef __ASSEMBLY__
 
 #ifdef __tilegx__
-#define TASK_SIZE_MAX           (MEM_LOW_END + 1)
+#define TASK_SIZE_MAX           (_AC(1, UL) << (MAX_VA_WIDTH - 1))
 #else
 #define TASK_SIZE_MAX           PAGE_OFFSET
 #endif
@@ -178,10 +172,10 @@ struct thread_struct {
 #define TASK_SIZE               TASK_SIZE_MAX
 #endif
 
-/* We provide a minimal "vdso" a la x86; just the sigreturn code for now. */
-#define VDSO_BASE               (TASK_SIZE - PAGE_SIZE)
+#define VDSO_BASE       ((unsigned long)current->active_mm->context.vdso_base)
+#define VDSO_SYM(x)     (VDSO_BASE + (unsigned long)(x))
 
-#define STACK_TOP               VDSO_BASE
+#define STACK_TOP               TASK_SIZE
 
 /* STACK_TOP_MAX is used temporarily in execve and should not check COMPAT. */
 #define STACK_TOP_MAX           TASK_SIZE_MAX
@@ -232,21 +226,28 @@ extern int do_work_pending(struct pt_regs *regs, u32 flags);
 unsigned long get_wchan(struct task_struct *p);
 
 /* Return initial ksp value for given task. */
-#define task_ksp0(task) ((unsigned long)(task)->stack + THREAD_SIZE)
+#define task_ksp0(task) \
+        ((unsigned long)(task)->stack + THREAD_SIZE - STACK_TOP_DELTA)
 
 /* Return some info about the user process TASK. */
-#define KSTK_TOP(task)  (task_ksp0(task) - STACK_TOP_DELTA)
 #define task_pt_regs(task) \
-  ((struct pt_regs *)(task_ksp0(task) - KSTK_PTREGS_GAP) - 1)
+        ((struct pt_regs *)(task_ksp0(task) - KSTK_PTREGS_GAP) - 1)
 #define current_pt_regs()                                   \
-  ((struct pt_regs *)((stack_pointer | (THREAD_SIZE - 1)) - \
-                      (KSTK_PTREGS_GAP - 1)) - 1)
+        ((struct pt_regs *)((stack_pointer | (THREAD_SIZE - 1)) - \
+                            STACK_TOP_DELTA - (KSTK_PTREGS_GAP - 1)) - 1)
 #define task_sp(task)   (task_pt_regs(task)->sp)
 #define task_pc(task)   (task_pt_regs(task)->pc)
 /* Aliases for pc and sp (used in fs/proc/array.c) */
 #define KSTK_EIP(task)  task_pc(task)
 #define KSTK_ESP(task)  task_sp(task)
 
+/* Fine-grained unaligned JIT support */
+#define GET_UNALIGN_CTL(tsk, adr)       get_unalign_ctl((tsk), (adr))
+#define SET_UNALIGN_CTL(tsk, val)       set_unalign_ctl((tsk), (val))
+
+extern int get_unalign_ctl(struct task_struct *tsk, unsigned long adr);
+extern int set_unalign_ctl(struct task_struct *tsk, unsigned int val);
+
 /* Standard format for printing registers and other word-size data. */
 #ifdef __tilegx__
 # define REGFMT "0x%016lx"
@@ -275,7 +276,6 @@ extern char chip_model[64];
 /* Data on which physical memory controller corresponds to which NUMA node. */
 extern int node_controller[];
 
-#if CHIP_HAS_CBOX_HOME_MAP()
 /* Does the heap allocator return hash-for-home pages by default? */
 extern int hash_default;
 
@@ -285,11 +285,6 @@ extern int kstack_hash;
 /* Does MAP_ANONYMOUS return hash-for-home pages by default? */
 #define uheap_hash hash_default
 
-#else
-#define hash_default 0
-#define kstack_hash 0
-#define uheap_hash 0
-#endif
 
 /* Are we using huge pages in the TLB for kernel data? */
 extern int kdata_huge;
@@ -337,7 +332,6 @@ extern int kdata_huge;
 
 /*
  * Provide symbolic constants for PLs.
- * Note that assembly code assumes that USER_PL is zero.
  */
 #define USER_PL 0
 #if CONFIG_KERNEL_PL == 2
@@ -346,20 +340,38 @@ extern int kdata_huge;
 #define KERNEL_PL CONFIG_KERNEL_PL
 
 /* SYSTEM_SAVE_K_0 holds the current cpu number ORed with ksp0. */
-#define CPU_LOG_MASK_VALUE 12
-#define CPU_MASK_VALUE ((1 << CPU_LOG_MASK_VALUE) - 1)
-#if CONFIG_NR_CPUS > CPU_MASK_VALUE
-# error Too many cpus!
+#ifdef __tilegx__
+#define CPU_SHIFT 48
+#if CHIP_VA_WIDTH() > CPU_SHIFT
+# error Too many VA bits!
 #endif
+#define MAX_CPU_ID ((1 << (64 - CPU_SHIFT)) - 1)
+#define raw_smp_processor_id() \
+        ((int)(__insn_mfspr(SPR_SYSTEM_SAVE_K_0) >> CPU_SHIFT))
+#define get_current_ksp0() \
+        ((unsigned long)(((long)__insn_mfspr(SPR_SYSTEM_SAVE_K_0) << \
+                          (64 - CPU_SHIFT)) >> (64 - CPU_SHIFT)))
+#define next_current_ksp0(task) ({ \
+        unsigned long __ksp0 = task_ksp0(task) & ((1UL << CPU_SHIFT) - 1); \
+        unsigned long __cpu = (long)raw_smp_processor_id() << CPU_SHIFT; \
+        __ksp0 | __cpu; \
+})
+#else
+#define LOG2_NR_CPU_IDS 6
+#define MAX_CPU_ID ((1 << LOG2_NR_CPU_IDS) - 1)
 #define raw_smp_processor_id() \
-        ((int)__insn_mfspr(SPR_SYSTEM_SAVE_K_0) & CPU_MASK_VALUE)
+        ((int)__insn_mfspr(SPR_SYSTEM_SAVE_K_0) & MAX_CPU_ID)
 #define get_current_ksp0() \
-        (__insn_mfspr(SPR_SYSTEM_SAVE_K_0) & ~CPU_MASK_VALUE)
+        (__insn_mfspr(SPR_SYSTEM_SAVE_K_0) & ~MAX_CPU_ID)
 #define next_current_ksp0(task) ({ \
         unsigned long __ksp0 = task_ksp0(task); \
         int __cpu = raw_smp_processor_id(); \
-        BUG_ON(__ksp0 & CPU_MASK_VALUE); \
+        BUG_ON(__ksp0 & MAX_CPU_ID); \
         __ksp0 | __cpu; \
 })
+#endif
+#if CONFIG_NR_CPUS > (MAX_CPU_ID + 1)
+# error Too many cpus!
+#endif
 
 #endif /* _ASM_TILE_PROCESSOR_H */
diff --git a/arch/tile/include/asm/ptrace.h b/arch/tile/include/asm/ptrace.h
index fd412260aff7..b9620c077abc 100644
--- a/arch/tile/include/asm/ptrace.h
+++ b/arch/tile/include/asm/ptrace.h
@@ -33,12 +33,13 @@ typedef unsigned long pt_reg_t;
 
 #ifndef __ASSEMBLY__
 
+#define regs_return_value(regs) ((regs)->regs[0])
 #define instruction_pointer(regs) ((regs)->pc)
 #define profile_pc(regs) instruction_pointer(regs)
 #define user_stack_pointer(regs) ((regs)->sp)
 
 /* Does the process account for user or for system time? */
-#define user_mode(regs) (EX1_PL((regs)->ex1) == USER_PL)
+#define user_mode(regs) (EX1_PL((regs)->ex1) < KERNEL_PL)
 
 /* Fill in a struct pt_regs with the current kernel registers. */
 struct pt_regs *get_pt_regs(struct pt_regs *);
@@ -79,8 +80,7 @@ extern void single_step_execve(void);
 
 struct task_struct;
 
-extern void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs,
-                         int error_code);
+extern void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs);
 
 #ifdef __tilegx__
 /* We need this since sigval_t has a user pointer in it, for GETSIGINFO etc. */
diff --git a/arch/tile/include/asm/sections.h b/arch/tile/include/asm/sections.h
index 7d8a935a9238..5d5d3b739a6b 100644
--- a/arch/tile/include/asm/sections.h
+++ b/arch/tile/include/asm/sections.h
@@ -25,10 +25,16 @@ extern char _sinitdata[], _einitdata[];
 /* Write-once data is writable only till the end of initialization. */
 extern char __w1data_begin[], __w1data_end[];
 
+extern char vdso_start[], vdso_end[];
+#ifdef CONFIG_COMPAT
+extern char vdso32_start[], vdso32_end[];
+#endif
 
 /* Not exactly sections, but PC comparison points in the code. */
 extern char __rt_sigreturn[], __rt_sigreturn_end[];
-#ifndef __tilegx__
+#ifdef __tilegx__
+extern char __start_unalign_asm_code[], __end_unalign_asm_code[];
+#else
 extern char sys_cmpxchg[], __sys_cmpxchg_end[];
 extern char __sys_cmpxchg_grab_lock[];
 extern char __start_atomic_asm_code[], __end_atomic_asm_code[];
diff --git a/arch/tile/include/asm/setup.h b/arch/tile/include/asm/setup.h
index d048888c5d9a..e98909033e5b 100644
--- a/arch/tile/include/asm/setup.h
+++ b/arch/tile/include/asm/setup.h
@@ -24,9 +24,8 @@
  */
 #define MAXMEM_PFN      PFN_DOWN(MAXMEM)
 
+int tile_console_write(const char *buf, int count);
 void early_panic(const char *fmt, ...);
-void warn_early_printk(void);
-void __init disable_early_printk(void);
 
 /* Init-time routine to do tile-specific per-cpu setup. */
 void setup_cpu(int boot);
diff --git a/arch/tile/include/asm/smp.h b/arch/tile/include/asm/smp.h
index 1aa759aeb5b3..9a326b64f7ae 100644
--- a/arch/tile/include/asm/smp.h
+++ b/arch/tile/include/asm/smp.h
@@ -101,10 +101,8 @@ void print_disabled_cpus(void);
 extern struct cpumask cpu_lotar_map;
 #define cpu_is_valid_lotar(cpu) cpumask_test_cpu((cpu), &cpu_lotar_map)
 
-#if CHIP_HAS_CBOX_HOME_MAP()
 /* Which processors are used for hash-for-home mapping */
 extern struct cpumask hash_for_home_map;
-#endif
 
 /* Which cpus can have their cache flushed by hv_flush_remote(). */
 extern struct cpumask cpu_cacheable_map;
diff --git a/arch/tile/include/asm/spinlock_64.h b/arch/tile/include/asm/spinlock_64.h
index 5f8b6a095fd8..9a12b9c7e5d3 100644
--- a/arch/tile/include/asm/spinlock_64.h
+++ b/arch/tile/include/asm/spinlock_64.h
@@ -27,7 +27,7 @@
  * Return the "current" portion of a ticket lock value,
  * i.e. the number that currently owns the lock.
  */
-static inline int arch_spin_current(u32 val)
+static inline u32 arch_spin_current(u32 val)
 {
         return val >> __ARCH_SPIN_CURRENT_SHIFT;
 }
@@ -36,7 +36,7 @@ static inline int arch_spin_current(u32 val)
  * Return the "next" portion of a ticket lock value,
  * i.e. the number that the next task to try to acquire the lock will get.
  */
-static inline int arch_spin_next(u32 val)
+static inline u32 arch_spin_next(u32 val)
 {
         return val & __ARCH_SPIN_NEXT_MASK;
 }
diff --git a/arch/tile/include/asm/string.h b/arch/tile/include/asm/string.h
index 7535cf1a30e4..92b271bd9ebd 100644
--- a/arch/tile/include/asm/string.h
+++ b/arch/tile/include/asm/string.h
@@ -21,8 +21,10 @@
 #define __HAVE_ARCH_MEMMOVE
 #define __HAVE_ARCH_STRCHR
 #define __HAVE_ARCH_STRLEN
+#define __HAVE_ARCH_STRNLEN
 
 extern __kernel_size_t strlen(const char *);
+extern __kernel_size_t strnlen(const char *, __kernel_size_t);
 extern char *strchr(const char *s, int c);
 extern void *memchr(const void *s, int c, size_t n);
 extern void *memset(void *, int, __kernel_size_t);
diff --git a/arch/tile/include/asm/thread_info.h b/arch/tile/include/asm/thread_info.h
index d1733dee98a2..b8aa6df3e102 100644
--- a/arch/tile/include/asm/thread_info.h
+++ b/arch/tile/include/asm/thread_info.h
@@ -39,6 +39,11 @@ struct thread_info {
         struct restart_block    restart_block;
         struct single_step_state *step_state;   /* single step state
                                                    (if non-zero) */
+        int                     align_ctl;      /* controls unaligned access */
+#ifdef __tilegx__
+        unsigned long           unalign_jit_tmp[4]; /* temp r0..r3 storage */
+        void __user             *unalign_jit_base; /* unalign fixup JIT base */
+#endif
 };
 
 /*
@@ -56,6 +61,7 @@ struct thread_info {
                 .fn = do_no_restart_syscall,    \
         },                                      \
         .step_state     = NULL,                 \
+        .align_ctl      = 0,                    \
 }
 
 #define init_thread_info        (init_thread_union.thread_info)
diff --git a/arch/tile/include/asm/topology.h b/arch/tile/include/asm/topology.h
index d5e86c9f74fd..d15c0d8d550f 100644
--- a/arch/tile/include/asm/topology.h
+++ b/arch/tile/include/asm/topology.h
@@ -89,9 +89,6 @@ static inline const struct cpumask *cpumask_of_node(int node)
 #define topology_core_id(cpu)                   (cpu)
 #define topology_core_cpumask(cpu)              ((void)(cpu), cpu_online_mask)
 #define topology_thread_cpumask(cpu)            cpumask_of(cpu)
-
-/* indicates that pointers to the topology struct cpumask maps are valid */
-#define arch_provides_topology_pointers         yes
 #endif
 
 #endif /* _ASM_TILE_TOPOLOGY_H */
diff --git a/arch/tile/include/asm/traps.h b/arch/tile/include/asm/traps.h
index e28c3df4176a..4b99a1c3aab2 100644
--- a/arch/tile/include/asm/traps.h
+++ b/arch/tile/include/asm/traps.h
@@ -15,12 +15,13 @@
 #ifndef _ASM_TILE_TRAPS_H
 #define _ASM_TILE_TRAPS_H
 
+#ifndef __ASSEMBLY__
 #include <arch/chip.h>
 
 /* mm/fault.c */
 void do_page_fault(struct pt_regs *, int fault_num,
                    unsigned long address, unsigned long write);
-#if CHIP_HAS_TILE_DMA() || CHIP_HAS_SN_PROC()
+#if CHIP_HAS_TILE_DMA()
 void do_async_page_fault(struct pt_regs *);
 #endif
 
@@ -69,6 +70,16 @@ void gx_singlestep_handle(struct pt_regs *, int fault_num);
 
 /* kernel/intvec_64.S */
 void fill_ra_stack(void);
+
+/* Handle unalign data fixup. */
+extern void do_unaligned(struct pt_regs *regs, int vecnum);
+#endif
+
+#endif /* __ASSEMBLY__ */
+
+#ifdef __tilegx__
+/* 128 byte JIT per unalign fixup. */
+#define UNALIGN_JIT_SHIFT    7
 #endif
 
 #endif /* _ASM_TILE_TRAPS_H */
diff --git a/arch/tile/include/asm/uaccess.h b/arch/tile/include/asm/uaccess.h
index e4d44bd7df27..b6cde3209b96 100644
--- a/arch/tile/include/asm/uaccess.h
+++ b/arch/tile/include/asm/uaccess.h
@@ -127,8 +127,10 @@ extern int fixup_exception(struct pt_regs *regs);
 
 #ifdef __LP64__
 #define _ASM_PTR        ".quad"
+#define _ASM_ALIGN      ".align 8"
 #else
 #define _ASM_PTR        ".long"
+#define _ASM_ALIGN      ".align 4"
 #endif
 
 #define __get_user_asm(OP, x, ptr, ret)                                 \
@@ -137,6 +139,7 @@ extern int fixup_exception(struct pt_regs *regs);
                      "0: { movei %1, 0; movei %0, %3 }\n"               \
                      "j 9f\n"                                           \
                      ".section __ex_table,\"a\"\n"                      \
+                     _ASM_ALIGN "\n"                                    \
                      _ASM_PTR " 1b, 0b\n"                               \
                      ".popsection\n"                                    \
                      "9:"                                               \
@@ -168,6 +171,7 @@ extern int fixup_exception(struct pt_regs *regs);
                              "0: { movei %1, 0; movei %2, 0 }\n"        \
                              "{ movei %0, %4; j 9f }\n"                 \
                              ".section __ex_table,\"a\"\n"              \
+                             ".align 4\n"                               \
                              ".word 1b, 0b\n"                           \
                              ".word 2b, 0b\n"                           \
                              ".popsection\n"                            \
@@ -224,6 +228,7 @@ extern int __get_user_bad(void)
                      ".pushsection .fixup,\"ax\"\n"                     \
                      "0: { movei %0, %3; j 9f }\n"                      \
                      ".section __ex_table,\"a\"\n"                      \
+                     _ASM_ALIGN "\n"                                    \
                      _ASM_PTR " 1b, 0b\n"                               \
                      ".popsection\n"                                    \
                      "9:"                                               \
@@ -248,6 +253,7 @@ extern int __get_user_bad(void)
                              ".pushsection .fixup,\"ax\"\n"             \
                              "0: { movei %0, %4; j 9f }\n"              \
                              ".section __ex_table,\"a\"\n"              \
+                             ".align 4\n"                               \
                              ".word 1b, 0b\n"                           \
                              ".word 2b, 0b\n"                           \
                              ".popsection\n"                            \
@@ -567,37 +573,6 @@ static inline unsigned long __must_check flush_user(
 }
 
 /**
- * inv_user: - Invalidate a block of memory in user space from cache.
- * @mem:   Destination address, in user space.
- * @len:   Number of bytes to invalidate.
- *
- * Returns number of bytes that could not be invalidated.
- * On success, this will be zero.
- *
- * Note that on Tile64, the "inv" operation is in fact a
- * "flush and invalidate", so cache write-backs will occur prior
- * to the cache being marked invalid.
- */
-extern unsigned long inv_user_asm(void __user *mem, unsigned long len);
-static inline unsigned long __must_check __inv_user(
-        void __user *mem, unsigned long len)
-{
-        int retval;
-
-        might_fault();
-        retval = inv_user_asm(mem, len);
-        mb_incoherent();
-        return retval;
-}
-static inline unsigned long __must_check inv_user(
-        void __user *mem, unsigned long len)
-{
-        if (access_ok(VERIFY_WRITE, mem, len))
-                return __inv_user(mem, len);
-        return len;
-}
-
-/**
  * finv_user: - Flush-inval a block of memory in user space from cache.
  * @mem:   Destination address, in user space.
  * @len:   Number of bytes to invalidate.
diff --git a/arch/tile/include/asm/unaligned.h b/arch/tile/include/asm/unaligned.h
index 37dfbe598872..5a58a0d11449 100644
--- a/arch/tile/include/asm/unaligned.h
+++ b/arch/tile/include/asm/unaligned.h
@@ -15,11 +15,15 @@
 #ifndef _ASM_TILE_UNALIGNED_H
 #define _ASM_TILE_UNALIGNED_H
 
-#include <linux/unaligned/le_struct.h>
-#include <linux/unaligned/be_byteshift.h>
-#include <linux/unaligned/generic.h>
-#define get_unaligned   __get_unaligned_le
-#define put_unaligned   __put_unaligned_le
+/*
+ * We could implement faster get_unaligned_[be/le]64 using the ldna
+ * instruction on tilegx; however, we need to either copy all of the
+ * other generic functions to here (which is pretty ugly) or else
+ * modify both the generic code and other arch code to allow arch
+ * specific unaligned data access functions.  Given these functions
+ * are not often called, we'll stick with the generic version.
+ */
+#include <asm-generic/unaligned.h>
 
 /*
  * Is the kernel doing fixups of unaligned accesses?  If <0, no kernel
diff --git a/arch/tile/include/asm/vdso.h b/arch/tile/include/asm/vdso.h
new file mode 100644
index 000000000000..9f6a78d665fa
--- /dev/null
+++ b/arch/tile/include/asm/vdso.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2012 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+#ifndef __TILE_VDSO_H__
+#define __TILE_VDSO_H__
+
+#include <linux/types.h>
+
+/*
+ * Note about the vdso_data structure:
+ *
+ * NEVER USE THEM IN USERSPACE CODE DIRECTLY. The layout of the
+ * structure is supposed to be known only to the function in the vdso
+ * itself and may change without notice.
+ */
+
+struct vdso_data {
+        __u64 tz_update_count;  /* Timezone atomicity ctr             */
+        __u64 tb_update_count;  /* Timebase atomicity ctr             */
+        __u64 xtime_tod_stamp;  /* TOD clock for xtime                */
+        __u64 xtime_clock_sec;  /* Kernel time second                 */
+        __u64 xtime_clock_nsec; /* Kernel time nanosecond             */
+        __u64 wtom_clock_sec;   /* Wall to monotonic clock second     */
+        __u64 wtom_clock_nsec;  /* Wall to monotonic clock nanosecond */
+        __u32 mult;             /* Cycle to nanosecond multiplier     */
+        __u32 shift;            /* Cycle to nanosecond divisor (power of two) */
+        __u32 tz_minuteswest;   /* Minutes west of Greenwich          */
+        __u32 tz_dsttime;       /* Type of dst correction             */
+};
+
+extern struct vdso_data *vdso_data;
+
+/* __vdso_rt_sigreturn is defined with the addresses in the vdso page. */
+extern void __vdso_rt_sigreturn(void);
+
+extern int setup_vdso_pages(void);
+
+#endif /* __TILE_VDSO_H__ */
diff --git a/arch/tile/include/gxio/iorpc_mpipe.h b/arch/tile/include/gxio/iorpc_mpipe.h
index 9d50fce1b1a7..fdd07f88cfd7 100644
--- a/arch/tile/include/gxio/iorpc_mpipe.h
+++ b/arch/tile/include/gxio/iorpc_mpipe.h
@@ -44,10 +44,13 @@
 #define GXIO_MPIPE_OP_REGISTER_CLIENT_MEMORY IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x1210)
 #define GXIO_MPIPE_OP_LINK_OPEN_AUX    IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1211)
 #define GXIO_MPIPE_OP_LINK_CLOSE_AUX   IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1212)
+#define GXIO_MPIPE_OP_LINK_SET_ATTR_AUX IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1213)
 
-#define GXIO_MPIPE_OP_GET_TIMESTAMP_AUX IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x121e)
-#define GXIO_MPIPE_OP_SET_TIMESTAMP_AUX IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x121f)
-#define GXIO_MPIPE_OP_ADJUST_TIMESTAMP_AUX IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x1220)
+#define GXIO_MPIPE_OP_GET_TIMESTAMP_AUX IORPC_OPCODE(IORPC_FORMAT_NONE, 0x121e)
+#define GXIO_MPIPE_OP_SET_TIMESTAMP_AUX IORPC_OPCODE(IORPC_FORMAT_NONE, 0x121f)
+#define GXIO_MPIPE_OP_ADJUST_TIMESTAMP_AUX IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1220)
+#define GXIO_MPIPE_OP_CONFIG_EDMA_RING_BLKS IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1221)
+#define GXIO_MPIPE_OP_ADJUST_TIMESTAMP_FREQ IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1222)
 #define GXIO_MPIPE_OP_ARM_POLLFD       IORPC_OPCODE(IORPC_FORMAT_KERNEL_POLLFD, 0x9000)
 #define GXIO_MPIPE_OP_CLOSE_POLLFD     IORPC_OPCODE(IORPC_FORMAT_KERNEL_POLLFD, 0x9001)
 #define GXIO_MPIPE_OP_GET_MMIO_BASE    IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x8000)
@@ -114,6 +117,8 @@ int gxio_mpipe_link_open_aux(gxio_mpipe_context_t * context,
 
 int gxio_mpipe_link_close_aux(gxio_mpipe_context_t * context, int mac);
 
+int gxio_mpipe_link_set_attr_aux(gxio_mpipe_context_t * context, int mac,
+                                 uint32_t attr, int64_t val);
 
 int gxio_mpipe_get_timestamp_aux(gxio_mpipe_context_t * context, uint64_t * sec,
                                  uint64_t * nsec, uint64_t * cycles);
@@ -124,6 +129,9 @@ int gxio_mpipe_set_timestamp_aux(gxio_mpipe_context_t * context, uint64_t sec,
 int gxio_mpipe_adjust_timestamp_aux(gxio_mpipe_context_t * context,
                                     int64_t nsec);
 
+int gxio_mpipe_adjust_timestamp_freq(gxio_mpipe_context_t * context,
+                                     int32_t ppb);
+
 int gxio_mpipe_arm_pollfd(gxio_mpipe_context_t * context, int pollfd_cookie);
 
 int gxio_mpipe_close_pollfd(gxio_mpipe_context_t * context, int pollfd_cookie);
diff --git a/arch/tile/include/gxio/iorpc_mpipe_info.h b/arch/tile/include/gxio/iorpc_mpipe_info.h
index 0bcf3f71ce8b..476c5e5ca22c 100644
--- a/arch/tile/include/gxio/iorpc_mpipe_info.h
+++ b/arch/tile/include/gxio/iorpc_mpipe_info.h
@@ -27,11 +27,15 @@
 #include <asm/pgtable.h>
 
 
+#define GXIO_MPIPE_INFO_OP_INSTANCE_AUX IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1250)
 #define GXIO_MPIPE_INFO_OP_ENUMERATE_AUX IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1251)
 #define GXIO_MPIPE_INFO_OP_GET_MMIO_BASE IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x8000)
 #define GXIO_MPIPE_INFO_OP_CHECK_MMIO_OFFSET IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x8001)
 
 
+int gxio_mpipe_info_instance_aux(gxio_mpipe_info_context_t * context,
+                                 _gxio_mpipe_link_name_t name);
+
 int gxio_mpipe_info_enumerate_aux(gxio_mpipe_info_context_t * context,
                                   unsigned int idx,
                                   _gxio_mpipe_link_name_t * name,
diff --git a/arch/tile/include/gxio/iorpc_trio.h b/arch/tile/include/gxio/iorpc_trio.h
index 58105c31228b..d95b96fd6c93 100644
--- a/arch/tile/include/gxio/iorpc_trio.h
+++ b/arch/tile/include/gxio/iorpc_trio.h
@@ -30,6 +30,7 @@
 
 #define GXIO_TRIO_OP_ALLOC_MEMORY_MAPS IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1404)
 
+#define GXIO_TRIO_OP_ALLOC_SCATTER_QUEUES IORPC_OPCODE(IORPC_FORMAT_NONE, 0x140e)
 #define GXIO_TRIO_OP_ALLOC_PIO_REGIONS IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1412)
 
 #define GXIO_TRIO_OP_INIT_PIO_REGION_AUX IORPC_OPCODE(IORPC_FORMAT_NONE, 0x1414)
@@ -54,6 +55,10 @@ int gxio_trio_alloc_memory_maps(gxio_trio_context_t * context,
                                 unsigned int flags);
 
 
+int gxio_trio_alloc_scatter_queues(gxio_trio_context_t * context,
+                                   unsigned int count, unsigned int first,
+                                   unsigned int flags);
+
 int gxio_trio_alloc_pio_regions(gxio_trio_context_t * context,
                                 unsigned int count, unsigned int first,
                                 unsigned int flags);
diff --git a/arch/tile/include/gxio/iorpc_uart.h b/arch/tile/include/gxio/iorpc_uart.h
new file mode 100644
index 000000000000..55429d48ea56
--- /dev/null
+++ b/arch/tile/include/gxio/iorpc_uart.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2013 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+/* This file is machine-generated; DO NOT EDIT! */
+#ifndef __GXIO_UART_LINUX_RPC_H__
+#define __GXIO_UART_LINUX_RPC_H__
+
+#include <hv/iorpc.h>
+
+#include <hv/drv_uart_intf.h>
+#include <gxio/uart.h>
+#include <gxio/kiorpc.h>
+#include <linux/string.h>
+#include <linux/module.h>
+#include <asm/pgtable.h>
+
+#define GXIO_UART_OP_CFG_INTERRUPT     IORPC_OPCODE(IORPC_FORMAT_KERNEL_INTERRUPT, 0x1900)
+#define GXIO_UART_OP_GET_MMIO_BASE     IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x8000)
+#define GXIO_UART_OP_CHECK_MMIO_OFFSET IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x8001)
+
+int gxio_uart_cfg_interrupt(gxio_uart_context_t *context, int inter_x,
+                            int inter_y, int inter_ipi, int inter_event);
+
+int gxio_uart_get_mmio_base(gxio_uart_context_t *context, HV_PTE *base);
+
+int gxio_uart_check_mmio_offset(gxio_uart_context_t *context,
+                                unsigned long offset, unsigned long size);
+
+#endif /* !__GXIO_UART_LINUX_RPC_H__ */
diff --git a/arch/tile/include/gxio/mpipe.h b/arch/tile/include/gxio/mpipe.h
index b74f470ed11e..e37cf4f0cffd 100644
--- a/arch/tile/include/gxio/mpipe.h
+++ b/arch/tile/include/gxio/mpipe.h
@@ -220,6 +220,13 @@ typedef MPIPE_PDESC_t gxio_mpipe_idesc_t;
  */
 typedef MPIPE_EDMA_DESC_t gxio_mpipe_edesc_t;
 
+/*
+ * Max # of mpipe instances. 2 currently.
+ */
+#define GXIO_MPIPE_INSTANCE_MAX  HV_MPIPE_INSTANCE_MAX
+
+#define NR_MPIPE_MAX   GXIO_MPIPE_INSTANCE_MAX
+
 /* Get the "va" field from an "idesc".
  *
  * This is the address at which the ingress hardware copied the first
@@ -311,6 +318,9 @@ typedef struct {
         /* File descriptor for calling up to Linux (and thus the HV). */
         int fd;
 
+        /* Corresponding mpipe instance #. */
+        int instance;
+
         /* The VA at which configuration registers are mapped. */
         char *mmio_cfg_base;
 
@@ -810,7 +820,7 @@ extern int gxio_mpipe_alloc_edma_rings(gxio_mpipe_context_t *context,
 /* Initialize an eDMA ring, using the given memory and size.
  *
  * @param context An initialized mPIPE context.
- * @param ring The eDMA ring index.
+ * @param ering The eDMA ring index.
  * @param channel The channel to use.  This must be one of the channels
  * associated with the context's set of open links.
  * @param mem A physically contiguous region of memory to be filled
@@ -823,10 +833,37 @@ extern int gxio_mpipe_alloc_edma_rings(gxio_mpipe_context_t *context,
  * ::GXIO_ERR_INVAL_MEMORY_SIZE on failure.
  */
 extern int gxio_mpipe_init_edma_ring(gxio_mpipe_context_t *context,
-                                     unsigned int ring, unsigned int channel,
+                                     unsigned int ering, unsigned int channel,
                                      void *mem, size_t mem_size,
                                      unsigned int mem_flags);
 
+/* Set the "max_blks", "min_snf_blks", and "db" fields of
+ * ::MPIPE_EDMA_RG_INIT_DAT_THRESH_t for a given edma ring.
+ *
+ * The global pool of dynamic blocks will be automatically adjusted.
+ *
+ * This function should not be called after any egress has been done
+ * on the edma ring.
+ *
+ * Most applications should just use gxio_mpipe_equeue_set_snf_size().
+ *
+ * @param context An initialized mPIPE context.
+ * @param ering The eDMA ring index.
+ * @param max_blks The number of blocks to dedicate to the ring
+ * (normally min_snf_blks + 1).  Must be greater than min_snf_blocks.
+ * @param min_snf_blks The number of blocks which must be stored
+ * prior to starting to send the packet (normally 12).
+ * @param db Whether to allow use of dynamic blocks by the ring
+ * (normally 1).
+ *
+ * @return 0 on success, negative on error.
+ */
+extern int gxio_mpipe_config_edma_ring_blks(gxio_mpipe_context_t *context,
+                                            unsigned int ering,
+                                            unsigned int max_blks,
+                                            unsigned int min_snf_blks,
+                                            unsigned int db);
+
 /*****************************************************************
  *                      Classifier Program                        *
  ******************************************************************/
@@ -1288,15 +1325,39 @@ typedef struct {
         /* The log2() of the number of entries. */
         unsigned long log2_num_entries;
 
+        /* The context. */
+        gxio_mpipe_context_t *context;
+
+        /* The ering. */
+        unsigned int ering;
+
+        /* The channel. */
+        unsigned int channel;
+
 } gxio_mpipe_equeue_t;
 
 /* Initialize an "equeue".
  *
- * Takes the equeue plus the same args as gxio_mpipe_init_edma_ring().
+ * This function uses gxio_mpipe_init_edma_ring() to initialize the
+ * underlying edma_ring using the provided arguments.
+ *
+ * @param equeue An egress queue to be initialized.
+ * @param context An initialized mPIPE context.
+ * @param ering The eDMA ring index.
+ * @param channel The channel to use.  This must be one of the channels
+ * associated with the context's set of open links.
+ * @param mem A physically contiguous region of memory to be filled
+ * with a ring of ::gxio_mpipe_edesc_t structures.
+ * @param mem_size Number of bytes in the ring.  Must be 512, 2048,
+ * 8192 or 65536, times 16 (i.e. sizeof(gxio_mpipe_edesc_t)).
+ * @param mem_flags ::gxio_mpipe_mem_flags_e memory flags.
+ *
+ * @return 0 on success, ::GXIO_MPIPE_ERR_BAD_EDMA_RING or
+ * ::GXIO_ERR_INVAL_MEMORY_SIZE on failure.
  */
 extern int gxio_mpipe_equeue_init(gxio_mpipe_equeue_t *equeue,
                                   gxio_mpipe_context_t *context,
-                                  unsigned int edma_ring_id,
+                                  unsigned int ering,
                                   unsigned int channel,
                                   void *mem, unsigned int mem_size,
                                   unsigned int mem_flags);
@@ -1494,6 +1555,37 @@ static inline int gxio_mpipe_equeue_is_complete(gxio_mpipe_equeue_t *equeue,
                                             completion_slot, update);
 }
 
+/* Set the snf (store and forward) size for an equeue.
+ *
+ * The snf size for an equeue defaults to 1536, and encodes the size
+ * of the largest packet for which egress is guaranteed to avoid
+ * transmission underruns and/or corrupt checksums under heavy load.
+ *
+ * The snf size affects a global resource pool which cannot support,
+ * for example, all 24 equeues each requesting an snf size of 8K.
+ *
+ * To ensure that jumbo packets can be egressed properly, the snf size
+ * should be set to the size of the largest possible packet, which
+ * will usually be limited by the size of the app's largest buffer.
+ *
+ * This is a convenience wrapper around
+ * gxio_mpipe_config_edma_ring_blks().
+ *
+ * This function should not be called after any egress has been done
+ * on the equeue.
+ *
+ * @param equeue An egress queue initialized via gxio_mpipe_equeue_init().
+ * @param size The snf size, in bytes.
+ * @return Zero on success, negative error otherwise.
+ */
+static inline int gxio_mpipe_equeue_set_snf_size(gxio_mpipe_equeue_t *equeue,
+                                                 size_t size)
+{
+        int blks = (size + 127) / 128;
+        return gxio_mpipe_config_edma_ring_blks(equeue->context, equeue->ering,
+                                                blks + 1, blks, 1);
+}
+
 /*****************************************************************
  *                        Link Management                         *
  ******************************************************************/
@@ -1634,6 +1726,24 @@ typedef struct {
         uint8_t mac;
 } gxio_mpipe_link_t;
 
+/* Translate a link name to the instance number of the mPIPE shim which is
+ *  connected to that link.  This call does not verify whether the link is
+ *  currently available, and does not reserve any link resources;
+ *  gxio_mpipe_link_open() must be called to perform those functions.
+ *
+ *  Typically applications will call this function to translate a link name
+ *  to an mPIPE instance number; call gxio_mpipe_init(), passing it that
+ *  instance number, to initialize the mPIPE shim; and then call
+ *  gxio_mpipe_link_open(), passing it the same link name plus the mPIPE
+ *  context, to configure the link.
+ *
+ * @param link_name Name of the link; see @ref gxio_mpipe_link_names.
+ * @return The mPIPE instance number which is associated with the named
+ *  link, or a negative error code (::GXIO_ERR_NO_DEVICE) if the link does
+ *  not exist.
+ */
+extern int gxio_mpipe_link_instance(const char *link_name);
+
 /* Retrieve one of this system's legal link names, and its MAC address.
  *
  * @param index Link name index.  If a system supports N legal link names,
@@ -1697,6 +1807,17 @@ static inline int gxio_mpipe_link_channel(gxio_mpipe_link_t *link)
         return link->channel;
 }
 
+/* Set a link attribute.
+ *
+ * @param link A properly initialized link state object.
+ * @param attr An attribute from the set of @ref gxio_mpipe_link_attrs.
+ * @param val New value of the attribute.
+ * @return 0 if the attribute was successfully set, or a negative error
+ *  code.
+ */
+extern int gxio_mpipe_link_set_attr(gxio_mpipe_link_t *link, uint32_t attr,
+                                    int64_t val);
+
 ///////////////////////////////////////////////////////////////////
 //                             Timestamp                         //
 ///////////////////////////////////////////////////////////////////
@@ -1733,4 +1854,18 @@ extern int gxio_mpipe_set_timestamp(gxio_mpipe_context_t *context,
 extern int gxio_mpipe_adjust_timestamp(gxio_mpipe_context_t *context,
                                        int64_t delta);
 
+/** Adjust the mPIPE timestamp clock frequency.
+ *
+ * @param context An initialized mPIPE context.
+ * @param ppb A 32-bit signed PPB (Parts Per Billion) value to adjust.
+ * The absolute value of ppb must be less than or equal to 1000000000.
+ * Values less than about 30000 will generally cause a GXIO_ERR_INVAL
+ * return due to the granularity of the hardware that converts reference
+ * clock cycles into seconds and nanoseconds.
+ * @return If the call was successful, zero; otherwise, a negative error
+ *  code.
+ */
+extern int gxio_mpipe_adjust_timestamp_freq(gxio_mpipe_context_t* context,
+                                            int32_t ppb);
+
 #endif /* !_GXIO_MPIPE_H_ */
diff --git a/arch/tile/include/gxio/uart.h b/arch/tile/include/gxio/uart.h
new file mode 100644
index 000000000000..438ee7e46c7b
--- /dev/null
+++ b/arch/tile/include/gxio/uart.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright 2013 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+#ifndef _GXIO_UART_H_
+#define _GXIO_UART_H_
+
+#include "common.h"
+
+#include <hv/drv_uart_intf.h>
+#include <hv/iorpc.h>
+
+/*
+ *
+ * An API for manipulating UART interface.
+ */
+
+/*
+ *
+ * The Rshim allows access to the processor's UART interface.
+ */
+
+/* A context object used to manage UART resources. */
+typedef struct {
+
+        /* File descriptor for calling up to the hypervisor. */
+        int fd;
+
+        /* The VA at which our MMIO registers are mapped. */
+        char *mmio_base;
+
+} gxio_uart_context_t;
+
+/* Request UART interrupts.
+ *
+ *  Request that interrupts be delivered to a tile when the UART's
+ *  Receive FIFO is written, or the Write FIFO is read.
+ *
+ * @param context Pointer to a properly initialized gxio_uart_context_t.
+ * @param bind_cpu_x X coordinate of CPU to which interrupt will be delivered.
+ * @param bind_cpu_y Y coordinate of CPU to which interrupt will be delivered.
+ * @param bind_interrupt IPI interrupt number.
+ * @param bind_event Sub-interrupt event bit number; a negative value can
+ *  disable the interrupt.
+ * @return Zero if all of the requested UART events were successfully
+ *  configured to interrupt.
+ */
+extern int gxio_uart_cfg_interrupt(gxio_uart_context_t *context,
+                                   int bind_cpu_x,
+                                   int bind_cpu_y,
+                                   int bind_interrupt, int bind_event);
+
+/* Initialize a UART context.
+ *
+ *  A properly initialized context must be obtained before any of the other
+ *  gxio_uart routines may be used.
+ *
+ * @param context Pointer to a gxio_uart_context_t, which will be initialized
+ *  by this routine, if it succeeds.
+ * @param uart_index Index of the UART to use.
+ * @return Zero if the context was successfully initialized, else a
+ *  GXIO_ERR_xxx error code.
+ */
+extern int gxio_uart_init(gxio_uart_context_t *context, int uart_index);
+
+/* Destroy a UART context.
+ *
+ *  Once destroyed, a context may not be used with any gxio_uart routines
+ *  other than gxio_uart_init().  After this routine returns, no further
+ *  interrupts requested on this context will be delivered.  The state and
+ *  configuration of the pins which had been attached to this context are
+ *  unchanged by this operation.
+ *
+ * @param context Pointer to a gxio_uart_context_t.
+ * @return Zero if the context was successfully destroyed, else a
+ *  GXIO_ERR_xxx error code.
+ */
+extern int gxio_uart_destroy(gxio_uart_context_t *context);
+
+/* Write UART register.
+ * @param context Pointer to a gxio_uart_context_t.
+ * @param offset UART register offset.
+ * @param word Data will be wrote to UART reigister.
+ */
+extern void gxio_uart_write(gxio_uart_context_t *context, uint64_t offset,
+                            uint64_t word);
+
+/* Read UART register.
+ * @param context Pointer to a gxio_uart_context_t.
+ * @param offset UART register offset.
+ * @return Data read from UART register.
+ */
+extern uint64_t gxio_uart_read(gxio_uart_context_t *context, uint64_t offset);
+
+#endif /* _GXIO_UART_H_ */
diff --git a/arch/tile/include/hv/drv_mpipe_intf.h b/arch/tile/include/hv/drv_mpipe_intf.h
index 6cdae3bf046e..c97e416dd963 100644
--- a/arch/tile/include/hv/drv_mpipe_intf.h
+++ b/arch/tile/include/hv/drv_mpipe_intf.h
@@ -23,6 +23,9 @@
 #include <arch/mpipe_constants.h>
 
 
+/** Number of mPIPE instances supported */
+#define HV_MPIPE_INSTANCE_MAX   (2)
+
 /** Number of buffer stacks (32). */
 #define HV_MPIPE_NUM_BUFFER_STACKS \
   (MPIPE_MMIO_INIT_DAT_GX36_1__BUFFER_STACK_MASK_WIDTH)
diff --git a/arch/tile/include/hv/drv_trio_intf.h b/arch/tile/include/hv/drv_trio_intf.h
index ef9f3f52ee27..237e04dee66c 100644
--- a/arch/tile/include/hv/drv_trio_intf.h
+++ b/arch/tile/include/hv/drv_trio_intf.h
@@ -64,8 +64,9 @@ struct pcie_port_property
    *  will not consider it an error if the link comes up as a x8 link. */
   uint8_t allow_x8: 1;
 
-  /** Reserved. */
-  uint8_t reserved: 1;
+  /** If true, this link is connected to a device which may or may not
+   *  be present. */
+  uint8_t removable: 1;
 
 };
 
@@ -167,6 +168,9 @@ pcie_stream_intr_config_sel_t;
 struct pcie_trio_ports_property
 {
   struct pcie_port_property ports[TILEGX_TRIO_PCIES];
+
+  /** Set if this TRIO belongs to a Gx72 device. */
+  uint8_t is_gx72;
 };
 
 /* Flags indicating traffic class. */
diff --git a/arch/tile/include/hv/drv_uart_intf.h b/arch/tile/include/hv/drv_uart_intf.h
new file mode 100644
index 000000000000..f5379e2404fd
--- /dev/null
+++ b/arch/tile/include/hv/drv_uart_intf.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2013 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+/**
+ * Interface definitions for the UART driver.
+ */
+
+#ifndef _SYS_HV_DRV_UART_INTF_H
+#define _SYS_HV_DRV_UART_INTF_H
+
+#include <arch/uart.h>
+
+/** Number of UART ports supported. */
+#define TILEGX_UART_NR        2
+
+/** The mmap file offset (PA) of the UART MMIO region. */
+#define HV_UART_MMIO_OFFSET   0
+
+/** The maximum size of the UARTs MMIO region (64K Bytes). */
+#define HV_UART_MMIO_SIZE     (1UL << 16)
+
+#endif /* _SYS_HV_DRV_UART_INTF_H */
diff --git a/arch/tile/include/hv/hypervisor.h b/arch/tile/include/hv/hypervisor.h
index 837dca5328c2..dfcdeb61ba34 100644
--- a/arch/tile/include/hv/hypervisor.h
+++ b/arch/tile/include/hv/hypervisor.h
@@ -318,8 +318,11 @@
 /** hv_set_pte_super_shift */
 #define HV_DISPATCH_SET_PTE_SUPER_SHIFT           57
 
+/** hv_console_set_ipi */
+#define HV_DISPATCH_CONSOLE_SET_IPI               63
+
 /** One more than the largest dispatch value */
-#define _HV_DISPATCH_END                          58
+#define _HV_DISPATCH_END                          64
 
 
 #ifndef __ASSEMBLER__
@@ -541,14 +544,24 @@ typedef enum {
   HV_CONFSTR_CPUMOD_REV      = 18,
 
   /** Human-readable CPU module description. */
-  HV_CONFSTR_CPUMOD_DESC     = 19
+  HV_CONFSTR_CPUMOD_DESC     = 19,
+
+  /** Per-tile hypervisor statistics.  When this identifier is specified,
+   *  the hv_confstr call takes two extra arguments.  The first is the
+   *  HV_XY_TO_LOTAR of the target tile's coordinates.  The second is
+   *  a flag word.  The only current flag is the lowest bit, which means
+   *  "zero out the stats instead of retrieving them"; in this case the
+   *  buffer and buffer length are ignored. */
+  HV_CONFSTR_HV_STATS        = 20
 
 } HV_ConfstrQuery;
 
 /** Query a configuration string from the hypervisor.
  *
  * @param query Identifier for the specific string to be retrieved
- *        (HV_CONFSTR_xxx).
+ *        (HV_CONFSTR_xxx).  Some strings may require or permit extra
+ *        arguments to be appended which select specific objects to be
+ *        described; see the string descriptions above.
  * @param buf Buffer in which to place the string.
  * @param len Length of the buffer.
  * @return If query is valid, then the length of the corresponding string,
@@ -556,21 +569,16 @@ typedef enum {
  *        was truncated.  If query is invalid, HV_EINVAL.  If the specified
  *        buffer is not writable by the client, HV_EFAULT.
  */
-int hv_confstr(HV_ConfstrQuery query, HV_VirtAddr buf, int len);
+int hv_confstr(HV_ConfstrQuery query, HV_VirtAddr buf, int len, ...);
 
 /** Tile coordinate */
 typedef struct
 {
-#ifndef __BIG_ENDIAN__
   /** X coordinate, relative to supervisor's top-left coordinate */
   int x;
 
   /** Y coordinate, relative to supervisor's top-left coordinate */
   int y;
-#else
-  int y;
-  int x;
-#endif
 } HV_Coord;
 
 
@@ -585,6 +593,30 @@ typedef struct
  */
 int hv_get_ipi_pte(HV_Coord tile, int pl, HV_PTE* pte);
 
+/** Configure the console interrupt.
+ *
+ * When the console client interrupt is enabled, the hypervisor will
+ * deliver the specified IPI to the client in the following situations:
+ *
+ * - The console has at least one character available for input.
+ *
+ * - The console can accept new characters for output, and the last call
+ *   to hv_console_write() did not write all of the characters requested
+ *   by the client.
+ *
+ * Note that in some system configurations, console interrupt will not
+ * be available; clients should be prepared for this routine to fail and
+ * to fall back to periodic console polling in that case.
+ *
+ * @param ipi Index of the IPI register which will receive the interrupt.
+ * @param event IPI event number for console interrupt. If less than 0,
+ *        disable the console IPI interrupt.
+ * @param coord Tile to be targeted for console interrupt.
+ * @return 0 on success, otherwise, HV_EINVAL if illegal parameter,
+ *         HV_ENOTSUP if console interrupt are not available.
+ */
+int hv_console_set_ipi(int ipi, int event, HV_Coord coord);
+
 #else /* !CHIP_HAS_IPI() */
 
 /** A set of interrupts. */
@@ -1092,13 +1124,8 @@ HV_VirtAddrRange hv_inquire_virtual(int idx);
 /** A range of ASID values. */
 typedef struct
 {
-#ifndef __BIG_ENDIAN__
   HV_ASID start;        /**< First ASID in the range. */
   unsigned int size;    /**< Number of ASIDs. Zero for an invalid range. */
-#else
-  unsigned int size;    /**< Number of ASIDs. Zero for an invalid range. */
-  HV_ASID start;        /**< First ASID in the range. */
-#endif
 } HV_ASIDRange;
 
 /** Returns information about a range of ASIDs.
@@ -1422,7 +1449,6 @@ typedef enum
 /** Message recipient. */
 typedef struct
 {
-#ifndef __BIG_ENDIAN__
   /** X coordinate, relative to supervisor's top-left coordinate */
   unsigned int x:11;
 
@@ -1431,11 +1457,6 @@ typedef struct
 
   /** Status of this recipient */
   HV_Recip_State state:10;
-#else //__BIG_ENDIAN__
-  HV_Recip_State state:10;
-  unsigned int y:11;
-  unsigned int x:11;
-#endif
 } HV_Recipient;
 
 /** Send a message to a set of recipients.
diff --git a/arch/tile/include/uapi/arch/Kbuild b/arch/tile/include/uapi/arch/Kbuild
index 4ebc34f4768d..97dfbecec6b6 100644
--- a/arch/tile/include/uapi/arch/Kbuild
+++ b/arch/tile/include/uapi/arch/Kbuild
@@ -1,7 +1,6 @@
 # UAPI Header export list
 header-y += abi.h
 header-y += chip.h
-header-y += chip_tile64.h
 header-y += chip_tilegx.h
 header-y += chip_tilepro.h
 header-y += icache.h
diff --git a/arch/tile/include/uapi/arch/chip.h b/arch/tile/include/uapi/arch/chip.h
index 926d3db0e91e..4c91f90b9369 100644
--- a/arch/tile/include/uapi/arch/chip.h
+++ b/arch/tile/include/uapi/arch/chip.h
@@ -12,9 +12,7 @@
  *   more details.
  */
 
-#if __tile_chip__ == 0
-#include <arch/chip_tile64.h>
-#elif __tile_chip__ == 1
+#if __tile_chip__ == 1
 #include <arch/chip_tilepro.h>
 #elif defined(__tilegx__)
 #include <arch/chip_tilegx.h>
diff --git a/arch/tile/include/uapi/arch/chip_tile64.h b/arch/tile/include/uapi/arch/chip_tile64.h
deleted file mode 100644
index 261aaba092d4..000000000000
--- a/arch/tile/include/uapi/arch/chip_tile64.h
+++ /dev/null
@@ -1,258 +0,0 @@
-/*
- * Copyright 2010 Tilera Corporation. All Rights Reserved.
- *
- *   This program is free software; you can redistribute it and/or
- *   modify it under the terms of the GNU General Public License
- *   as published by the Free Software Foundation, version 2.
- *
- *   This program is distributed in the hope that it will be useful, but
- *   WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
- *   NON INFRINGEMENT.  See the GNU General Public License for
- *   more details.
- */
-
-/*
- * @file
- * Global header file.
- * This header file specifies defines for TILE64.
- */
-
-#ifndef __ARCH_CHIP_H__
-#define __ARCH_CHIP_H__
-
-/** Specify chip version.
- * When possible, prefer the CHIP_xxx symbols below for future-proofing.
- * This is intended for cross-compiling; native compilation should
- * use the predefined __tile_chip__ symbol.
- */
-#define TILE_CHIP 0
-
-/** Specify chip revision.
- * This provides for the case of a respin of a particular chip type;
- * the normal value for this symbol is "0".
- * This is intended for cross-compiling; native compilation should
- * use the predefined __tile_chip_rev__ symbol.
- */
-#define TILE_CHIP_REV 0
-
-/** The name of this architecture. */
-#define CHIP_ARCH_NAME "tile64"
-
-/** The ELF e_machine type for binaries for this chip. */
-#define CHIP_ELF_TYPE() EM_TILE64
-
-/** The alternate ELF e_machine type for binaries for this chip. */
-#define CHIP_COMPAT_ELF_TYPE() 0x2506
-
-/** What is the native word size of the machine? */
-#define CHIP_WORD_SIZE() 32
-
-/** How many bits of a virtual address are used. Extra bits must be
- * the sign extension of the low bits.
- */
-#define CHIP_VA_WIDTH() 32
-
-/** How many bits are in a physical address? */
-#define CHIP_PA_WIDTH() 36
-
-/** Size of the L2 cache, in bytes. */
-#define CHIP_L2_CACHE_SIZE() 65536
-
-/** Log size of an L2 cache line in bytes. */
-#define CHIP_L2_LOG_LINE_SIZE() 6
-
-/** Size of an L2 cache line, in bytes. */
-#define CHIP_L2_LINE_SIZE() (1 << CHIP_L2_LOG_LINE_SIZE())
-
-/** Associativity of the L2 cache. */
-#define CHIP_L2_ASSOC() 2
-
-/** Size of the L1 data cache, in bytes. */
-#define CHIP_L1D_CACHE_SIZE() 8192
-
-/** Log size of an L1 data cache line in bytes. */
-#define CHIP_L1D_LOG_LINE_SIZE() 4
-
-/** Size of an L1 data cache line, in bytes. */
-#define CHIP_L1D_LINE_SIZE() (1 << CHIP_L1D_LOG_LINE_SIZE())
-
-/** Associativity of the L1 data cache. */
-#define CHIP_L1D_ASSOC() 2
-
-/** Size of the L1 instruction cache, in bytes. */
-#define CHIP_L1I_CACHE_SIZE() 8192
-
-/** Log size of an L1 instruction cache line in bytes. */
-#define CHIP_L1I_LOG_LINE_SIZE() 6
-
-/** Size of an L1 instruction cache line, in bytes. */
-#define CHIP_L1I_LINE_SIZE() (1 << CHIP_L1I_LOG_LINE_SIZE())
-
-/** Associativity of the L1 instruction cache. */
-#define CHIP_L1I_ASSOC() 1
-
-/** Stride with which flush instructions must be issued. */
-#define CHIP_FLUSH_STRIDE() CHIP_L2_LINE_SIZE()
-
-/** Stride with which inv instructions must be issued. */
-#define CHIP_INV_STRIDE() CHIP_L1D_LINE_SIZE()
-
-/** Stride with which finv instructions must be issued. */
-#define CHIP_FINV_STRIDE() CHIP_L1D_LINE_SIZE()
-
-/** Can the local cache coherently cache data that is homed elsewhere? */
-#define CHIP_HAS_COHERENT_LOCAL_CACHE() 0
-
-/** How many simultaneous outstanding victims can the L2 cache have? */
-#define CHIP_MAX_OUTSTANDING_VICTIMS() 2
-
-/** Does the TLB support the NC and NOALLOC bits? */
-#define CHIP_HAS_NC_AND_NOALLOC_BITS() 0
-
-/** Does the chip support hash-for-home caching? */
-#define CHIP_HAS_CBOX_HOME_MAP() 0
-
-/** Number of entries in the chip's home map tables. */
-/* #define CHIP_CBOX_HOME_MAP_SIZE() -- does not apply to chip 0 */
-
-/** Do uncacheable requests miss in the cache regardless of whether
- * there is matching data? */
-#define CHIP_HAS_ENFORCED_UNCACHEABLE_REQUESTS() 0
-
-/** Does the mf instruction wait for victims? */
-#define CHIP_HAS_MF_WAITS_FOR_VICTIMS() 1
-
-/** Does the chip have an "inv" instruction that doesn't also flush? */
-#define CHIP_HAS_INV() 0
-
-/** Does the chip have a "wh64" instruction? */
-#define CHIP_HAS_WH64() 0
-
-/** Does this chip have a 'dword_align' instruction? */
-#define CHIP_HAS_DWORD_ALIGN() 0
-
-/** Number of performance counters. */
-#define CHIP_PERFORMANCE_COUNTERS() 2
-
-/** Does this chip have auxiliary performance counters? */
-#define CHIP_HAS_AUX_PERF_COUNTERS() 0
-
-/** Is the CBOX_MSR1 SPR supported? */
-#define CHIP_HAS_CBOX_MSR1() 0
-
-/** Is the TILE_RTF_HWM SPR supported? */
-#define CHIP_HAS_TILE_RTF_HWM() 0
-
-/** Is the TILE_WRITE_PENDING SPR supported? */
-#define CHIP_HAS_TILE_WRITE_PENDING() 0
-
-/** Is the PROC_STATUS SPR supported? */
-#define CHIP_HAS_PROC_STATUS_SPR() 0
-
-/** Is the DSTREAM_PF SPR supported? */
-#define CHIP_HAS_DSTREAM_PF() 0
-
-/** Log of the number of mshims we have. */
-#define CHIP_LOG_NUM_MSHIMS() 2
-
-/** Are the bases of the interrupt vector areas fixed? */
-#define CHIP_HAS_FIXED_INTVEC_BASE() 1
-
-/** Are the interrupt masks split up into 2 SPRs? */
-#define CHIP_HAS_SPLIT_INTR_MASK() 1
-
-/** Is the cycle count split up into 2 SPRs? */
-#define CHIP_HAS_SPLIT_CYCLE() 1
-
-/** Does the chip have a static network? */
-#define CHIP_HAS_SN() 1
-
-/** Does the chip have a static network processor? */
-#define CHIP_HAS_SN_PROC() 1
-
-/** Size of the L1 static network processor instruction cache, in bytes. */
-#define CHIP_L1SNI_CACHE_SIZE() 2048
-
-/** Does the chip have DMA support in each tile? */
-#define CHIP_HAS_TILE_DMA() 1
-
-/** Does the chip have the second revision of the directly accessible
- *  dynamic networks?  This encapsulates a number of characteristics,
- *  including the absence of the catch-all, the absence of inline message
- *  tags, the absence of support for network context-switching, and so on.
- */
-#define CHIP_HAS_REV1_XDN() 0
-
-/** Does the chip have cmpexch and similar (fetchadd, exch, etc.)? */
-#define CHIP_HAS_CMPEXCH() 0
-
-/** Does the chip have memory-mapped I/O support? */
-#define CHIP_HAS_MMIO() 0
-
-/** Does the chip have post-completion interrupts? */
-#define CHIP_HAS_POST_COMPLETION_INTERRUPTS() 0
-
-/** Does the chip have native single step support? */
-#define CHIP_HAS_SINGLE_STEP() 0
-
-#ifndef __OPEN_SOURCE__  /* features only relevant to hypervisor-level code */
-
-/** How many entries are present in the instruction TLB? */
-#define CHIP_ITLB_ENTRIES() 8
-
-/** How many entries are present in the data TLB? */
-#define CHIP_DTLB_ENTRIES() 16
-
-/** How many MAF entries does the XAUI shim have? */
-#define CHIP_XAUI_MAF_ENTRIES() 16
-
-/** Does the memory shim have a source-id table? */
-#define CHIP_HAS_MSHIM_SRCID_TABLE() 1
-
-/** Does the L1 instruction cache clear on reset? */
-#define CHIP_HAS_L1I_CLEAR_ON_RESET() 0
-
-/** Does the chip come out of reset with valid coordinates on all tiles?
- * Note that if defined, this also implies that the upper left is 1,1.
- */
-#define CHIP_HAS_VALID_TILE_COORD_RESET() 0
-
-/** Does the chip have unified packet formats? */
-#define CHIP_HAS_UNIFIED_PACKET_FORMATS() 0
-
-/** Does the chip support write reordering? */
-#define CHIP_HAS_WRITE_REORDERING() 0
-
-/** Does the chip support Y-X routing as well as X-Y? */
-#define CHIP_HAS_Y_X_ROUTING() 0
-
-/** Is INTCTRL_3 managed with the correct MPL? */
-#define CHIP_HAS_INTCTRL_3_STATUS_FIX() 0
-
-/** Is it possible to configure the chip to be big-endian? */
-#define CHIP_HAS_BIG_ENDIAN_CONFIG() 0
-
-/** Is the CACHE_RED_WAY_OVERRIDDEN SPR supported? */
-#define CHIP_HAS_CACHE_RED_WAY_OVERRIDDEN() 0
-
-/** Is the DIAG_TRACE_WAY SPR supported? */
-#define CHIP_HAS_DIAG_TRACE_WAY() 0
-
-/** Is the MEM_STRIPE_CONFIG SPR supported? */
-#define CHIP_HAS_MEM_STRIPE_CONFIG() 0
-
-/** Are the TLB_PERF SPRs supported? */
-#define CHIP_HAS_TLB_PERF() 0
-
-/** Is the VDN_SNOOP_SHIM_CTL SPR supported? */
-#define CHIP_HAS_VDN_SNOOP_SHIM_CTL() 0
-
-/** Does the chip support rev1 DMA packets? */
-#define CHIP_HAS_REV1_DMA_PACKETS() 0
-
-/** Does the chip have an IPI shim? */
-#define CHIP_HAS_IPI() 0
-
-#endif /* !__OPEN_SOURCE__ */
-#endif /* __ARCH_CHIP_H__ */
diff --git a/arch/tile/include/uapi/arch/opcode_tilegx.h b/arch/tile/include/uapi/arch/opcode_tilegx.h
index c14d02c81600..d76ff2db745e 100644
--- a/arch/tile/include/uapi/arch/opcode_tilegx.h
+++ b/arch/tile/include/uapi/arch/opcode_tilegx.h
@@ -61,6 +61,7 @@ typedef tilegx_bundle_bits tile_bundle_bits;
 #define TILE_BUNDLE_ALIGNMENT_IN_BYTES TILEGX_BUNDLE_ALIGNMENT_IN_BYTES
 #define TILE_LOG2_BUNDLE_ALIGNMENT_IN_BYTES \
   TILEGX_LOG2_BUNDLE_ALIGNMENT_IN_BYTES
+#define TILE_BPT_BUNDLE TILEGX_BPT_BUNDLE
 
 /* 64-bit pattern for a { bpt ; nop } bundle. */
 #define TILEGX_BPT_BUNDLE 0x286a44ae51485000ULL
diff --git a/arch/tile/include/uapi/arch/opcode_tilepro.h b/arch/tile/include/uapi/arch/opcode_tilepro.h
index 71b763b8ce83..4451cff1a861 100644
--- a/arch/tile/include/uapi/arch/opcode_tilepro.h
+++ b/arch/tile/include/uapi/arch/opcode_tilepro.h
@@ -71,6 +71,7 @@ typedef tilepro_bundle_bits tile_bundle_bits;
 #define TILE_BUNDLE_ALIGNMENT_IN_BYTES TILEPRO_BUNDLE_ALIGNMENT_IN_BYTES
 #define TILE_LOG2_BUNDLE_ALIGNMENT_IN_BYTES \
   TILEPRO_LOG2_BUNDLE_ALIGNMENT_IN_BYTES
+#define TILE_BPT_BUNDLE TILEPRO_BPT_BUNDLE
 
 /* 64-bit pattern for a { bpt ; nop } bundle. */
 #define TILEPRO_BPT_BUNDLE 0x400b3cae70166000ULL
diff --git a/arch/tile/include/uapi/arch/spr_def_32.h b/arch/tile/include/uapi/arch/spr_def_32.h
index c689446e6284..78daa3146d25 100644
--- a/arch/tile/include/uapi/arch/spr_def_32.h
+++ b/arch/tile/include/uapi/arch/spr_def_32.h
@@ -200,8 +200,6 @@
 #define SPR_SIM_CONTROL 0x4e0c
 #define SPR_SNCTL 0x0805
 #define SPR_SNCTL__FRZFABRIC_MASK  0x1
-#define SPR_SNCTL__FRZPROC_MASK  0x2
-#define SPR_SNPC 0x080b
 #define SPR_SNSTATIC 0x080c
 #define SPR_SYSTEM_SAVE_0_0 0x4b00
 #define SPR_SYSTEM_SAVE_0_1 0x4b01
diff --git a/arch/tile/include/uapi/asm/auxvec.h b/arch/tile/include/uapi/asm/auxvec.h
index 1d393edb0641..c93e92709f14 100644
--- a/arch/tile/include/uapi/asm/auxvec.h
+++ b/arch/tile/include/uapi/asm/auxvec.h
@@ -15,6 +15,7 @@
 #ifndef _ASM_TILE_AUXVEC_H
 #define _ASM_TILE_AUXVEC_H
 
-/* No extensions to auxvec */
+/* The vDSO location. */
+#define AT_SYSINFO_EHDR         33
 
 #endif /* _ASM_TILE_AUXVEC_H */
diff --git a/arch/tile/include/uapi/asm/cachectl.h b/arch/tile/include/uapi/asm/cachectl.h
index af4c9f9154d1..572ddcad2090 100644
--- a/arch/tile/include/uapi/asm/cachectl.h
+++ b/arch/tile/include/uapi/asm/cachectl.h
@@ -29,8 +29,8 @@
  * to honor the arguments at some point.)
  *
  * Flush and invalidation of memory can normally be performed with the
- * __insn_flush(), __insn_inv(), and __insn_finv() instructions from
- * userspace.  The DCACHE option to the system call allows userspace
+ * __insn_flush() and __insn_finv() instructions from userspace.
+ * The DCACHE option to the system call allows userspace
  * to flush the entire L1+L2 data cache from the core.  In this case,
  * the address and length arguments are not used.  The DCACHE flush is
  * restricted to the current core, not all cores in the address space.
diff --git a/arch/tile/kernel/Makefile b/arch/tile/kernel/Makefile
index 5334be8e2538..27a2bf39dae8 100644
--- a/arch/tile/kernel/Makefile
+++ b/arch/tile/kernel/Makefile
@@ -3,11 +3,17 @@
 #
 
 extra-y := vmlinux.lds head_$(BITS).o
-obj-y := backtrace.o entry.o irq.o messaging.o \
+obj-y := backtrace.o entry.o hvglue.o irq.o messaging.o \
         pci-dma.o proc.o process.o ptrace.o reboot.o \
-        setup.o signal.o single_step.o stack.o sys.o sysfs.o time.o traps.o \
+        setup.o signal.o single_step.o stack.o sys.o \
+        sysfs.o time.o traps.o unaligned.o vdso.o \
         intvec_$(BITS).o regs_$(BITS).o tile-desc_$(BITS).o
 
+ifdef CONFIG_FUNCTION_TRACER
+CFLAGS_REMOVE_ftrace.o = -pg
+CFLAGS_REMOVE_early_printk.o = -pg
+endif
+
 obj-$(CONFIG_HARDWALL)          += hardwall.o
 obj-$(CONFIG_COMPAT)            += compat.o compat_signal.o
 obj-$(CONFIG_SMP)               += smpboot.o smp.o tlb.o
@@ -20,3 +26,9 @@ else
 obj-$(CONFIG_PCI)               += pci.o
 endif
 obj-$(CONFIG_TILE_USB)          += usb.o
+obj-$(CONFIG_TILE_HVGLUE_TRACE) += hvglue_trace.o
+obj-$(CONFIG_FUNCTION_TRACER)   += ftrace.o mcount_64.o
+obj-$(CONFIG_KPROBES)           += kprobes.o
+obj-$(CONFIG_KGDB)              += kgdb.o
+
+obj-y                           += vdso/
diff --git a/arch/tile/kernel/asm-offsets.c b/arch/tile/kernel/asm-offsets.c
index 01ddf19cc36d..375e7c321eef 100644
--- a/arch/tile/kernel/asm-offsets.c
+++ b/arch/tile/kernel/asm-offsets.c
@@ -14,13 +14,6 @@
  * Generates definitions from c-type structures used by assembly sources.
  */
 
-#include <linux/kbuild.h>
-#include <linux/thread_info.h>
-#include <linux/sched.h>
-#include <linux/hardirq.h>
-#include <linux/ptrace.h>
-#include <hv/hypervisor.h>
-
 /* Check for compatible compiler early in the build. */
 #ifdef CONFIG_TILEGX
 # ifndef __tilegx__
@@ -31,46 +24,61 @@
 # endif
 #else
 # ifdef __tilegx__
-#  error Can not build TILEPro/TILE64 configurations with tilegx compiler
+#  error Can not build TILEPro configurations with tilegx compiler
 # endif
 #endif
 
+#include <linux/kbuild.h>
+#include <linux/thread_info.h>
+#include <linux/sched.h>
+#include <linux/hardirq.h>
+#include <linux/ptrace.h>
+#include <hv/hypervisor.h>
+
 void foo(void)
 {
-        DEFINE(SINGLESTEP_STATE_BUFFER_OFFSET, \
+        DEFINE(SINGLESTEP_STATE_BUFFER_OFFSET,
                offsetof(struct single_step_state, buffer));
-        DEFINE(SINGLESTEP_STATE_FLAGS_OFFSET, \
+        DEFINE(SINGLESTEP_STATE_FLAGS_OFFSET,
                offsetof(struct single_step_state, flags));
-        DEFINE(SINGLESTEP_STATE_ORIG_PC_OFFSET, \
+        DEFINE(SINGLESTEP_STATE_ORIG_PC_OFFSET,
                offsetof(struct single_step_state, orig_pc));
-        DEFINE(SINGLESTEP_STATE_NEXT_PC_OFFSET, \
+        DEFINE(SINGLESTEP_STATE_NEXT_PC_OFFSET,
                offsetof(struct single_step_state, next_pc));
-        DEFINE(SINGLESTEP_STATE_BRANCH_NEXT_PC_OFFSET, \
+        DEFINE(SINGLESTEP_STATE_BRANCH_NEXT_PC_OFFSET,
                offsetof(struct single_step_state, branch_next_pc));
-        DEFINE(SINGLESTEP_STATE_UPDATE_VALUE_OFFSET, \
+        DEFINE(SINGLESTEP_STATE_UPDATE_VALUE_OFFSET,
                offsetof(struct single_step_state, update_value));
 
-        DEFINE(THREAD_INFO_TASK_OFFSET, \
+        DEFINE(THREAD_INFO_TASK_OFFSET,
                offsetof(struct thread_info, task));
-        DEFINE(THREAD_INFO_FLAGS_OFFSET, \
+        DEFINE(THREAD_INFO_FLAGS_OFFSET,
                offsetof(struct thread_info, flags));
-        DEFINE(THREAD_INFO_STATUS_OFFSET, \
+        DEFINE(THREAD_INFO_STATUS_OFFSET,
                offsetof(struct thread_info, status));
-        DEFINE(THREAD_INFO_HOMECACHE_CPU_OFFSET, \
+        DEFINE(THREAD_INFO_HOMECACHE_CPU_OFFSET,
                offsetof(struct thread_info, homecache_cpu));
-        DEFINE(THREAD_INFO_STEP_STATE_OFFSET, \
+        DEFINE(THREAD_INFO_PREEMPT_COUNT_OFFSET,
+               offsetof(struct thread_info, preempt_count));
+        DEFINE(THREAD_INFO_STEP_STATE_OFFSET,
                offsetof(struct thread_info, step_state));
+#ifdef __tilegx__
+        DEFINE(THREAD_INFO_UNALIGN_JIT_BASE_OFFSET,
+               offsetof(struct thread_info, unalign_jit_base));
+        DEFINE(THREAD_INFO_UNALIGN_JIT_TMP_OFFSET,
+               offsetof(struct thread_info, unalign_jit_tmp));
+#endif
 
         DEFINE(TASK_STRUCT_THREAD_KSP_OFFSET,
                offsetof(struct task_struct, thread.ksp));
         DEFINE(TASK_STRUCT_THREAD_PC_OFFSET,
                offsetof(struct task_struct, thread.pc));
 
-        DEFINE(HV_TOPOLOGY_WIDTH_OFFSET, \
+        DEFINE(HV_TOPOLOGY_WIDTH_OFFSET,
                offsetof(HV_Topology, width));
-        DEFINE(HV_TOPOLOGY_HEIGHT_OFFSET, \
+        DEFINE(HV_TOPOLOGY_HEIGHT_OFFSET,
                offsetof(HV_Topology, height));
 
-        DEFINE(IRQ_CPUSTAT_SYSCALL_COUNT_OFFSET, \
+        DEFINE(IRQ_CPUSTAT_SYSCALL_COUNT_OFFSET,
                offsetof(irq_cpustat_t, irq_syscall_count));
 }
diff --git a/arch/tile/kernel/compat_signal.c b/arch/tile/kernel/compat_signal.c
index d0a052e725be..85e00b2f39bf 100644
--- a/arch/tile/kernel/compat_signal.c
+++ b/arch/tile/kernel/compat_signal.c
@@ -32,6 +32,7 @@
 #include <asm/ucontext.h>
 #include <asm/sigframe.h>
 #include <asm/syscalls.h>
+#include <asm/vdso.h>
 #include <arch/interrupts.h>
 
 struct compat_ucontext {
@@ -227,7 +228,7 @@ int compat_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
         if (err)
                 goto give_sigsegv;
 
-        restorer = VDSO_BASE;
+        restorer = VDSO_SYM(&__vdso_rt_sigreturn);
         if (ka->sa.sa_flags & SA_RESTORER)
                 restorer = ptr_to_compat_reg(ka->sa.sa_restorer);
 
diff --git a/arch/tile/kernel/early_printk.c b/arch/tile/kernel/early_printk.c
index 34d72a151bf3..b608e00e7f6d 100644
--- a/arch/tile/kernel/early_printk.c
+++ b/arch/tile/kernel/early_printk.c
@@ -23,19 +23,24 @@
 
 static void early_hv_write(struct console *con, const char *s, unsigned n)
 {
-        hv_console_write((HV_VirtAddr) s, n);
+        tile_console_write(s, n);
+
+        /*
+         * Convert NL to NLCR (close enough to CRNL) during early boot.
+         * We assume newlines are at the ends of strings, which turns out
+         * to be good enough for early boot console output.
+         */
+        if (n && s[n-1] == '\n')
+                tile_console_write("\r", 1);
 }
 
 static struct console early_hv_console = {
         .name =         "earlyhv",
         .write =        early_hv_write,
-        .flags =        CON_PRINTBUFFER,
+        .flags =        CON_PRINTBUFFER | CON_BOOT,
         .index =        -1,
 };
 
-/* Direct interface for emergencies */
-static int early_console_complete;
-
 void early_panic(const char *fmt, ...)
 {
         va_list ap;
@@ -43,51 +48,21 @@ void early_panic(const char *fmt, ...)
         va_start(ap, fmt);
         early_printk("Kernel panic - not syncing: ");
         early_vprintk(fmt, ap);
-        early_console->write(early_console, "\n", 1);
+        early_printk("\n");
         va_end(ap);
         dump_stack();
         hv_halt();
 }
 
-static int __initdata keep_early;
-
 static int __init setup_early_printk(char *str)
 {
         if (early_console)
                 return 1;
 
-        if (str != NULL && strncmp(str, "keep", 4) == 0)
-                keep_early = 1;
-
         early_console = &early_hv_console;
         register_console(early_console);
 
         return 0;
 }
 
-void __init disable_early_printk(void)
-{
-        early_console_complete = 1;
-        if (!early_console)
-                return;
-        if (!keep_early) {
-                early_printk("disabling early console\n");
-                unregister_console(early_console);
-                early_console = NULL;
-        } else {
-                early_printk("keeping early console\n");
-        }
-}
-
-void warn_early_printk(void)
-{
-        if (early_console_complete || early_console)
-                return;
-        early_printk("\
-Machine shutting down before console output is fully initialized.\n\
-You may wish to reboot and add the option 'earlyprintk' to your\n\
-boot command line to see any diagnostic early console output.\n\
-");
-}
-
 early_param("earlyprintk", setup_early_printk);
diff --git a/arch/tile/kernel/entry.S b/arch/tile/kernel/entry.S
index f116cb0bce20..3d9175992a20 100644
--- a/arch/tile/kernel/entry.S
+++ b/arch/tile/kernel/entry.S
@@ -27,22 +27,6 @@ STD_ENTRY(current_text_addr)
         { move r0, lr; jrp lr }
         STD_ENDPROC(current_text_addr)
 
-/*
- * We don't run this function directly, but instead copy it to a page
- * we map into every user process.  See vdso_setup().
- *
- * Note that libc has a copy of this function that it uses to compare
- * against the PC when a stack backtrace ends, so if this code is
- * changed, the libc implementation(s) should also be updated.
- */
-        .pushsection .data
-ENTRY(__rt_sigreturn)
-        moveli TREG_SYSCALL_NR_NAME,__NR_rt_sigreturn
-        swint1
-        ENDPROC(__rt_sigreturn)
-        ENTRY(__rt_sigreturn_end)
-        .popsection
-
 STD_ENTRY(dump_stack)
         { move r2, lr; lnk r1 }
         { move r4, r52; addli r1, r1, dump_stack - . }
diff --git a/arch/tile/kernel/ftrace.c b/arch/tile/kernel/ftrace.c
new file mode 100644
index 000000000000..f1c452092eeb
--- /dev/null
+++ b/arch/tile/kernel/ftrace.c
@@ -0,0 +1,246 @@
+/*
+ * Copyright 2012 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ *
+ * TILE-Gx specific ftrace support
+ */
+
+#include <linux/ftrace.h>
+#include <linux/uaccess.h>
+
+#include <asm/cacheflush.h>
+#include <asm/ftrace.h>
+#include <asm/sections.h>
+
+#include <arch/opcode.h>
+
+#ifdef CONFIG_DYNAMIC_FTRACE
+
+static inline tilegx_bundle_bits NOP(void)
+{
+        return create_UnaryOpcodeExtension_X0(FNOP_UNARY_OPCODE_X0) |
+                create_RRROpcodeExtension_X0(UNARY_RRR_0_OPCODE_X0) |
+                create_Opcode_X0(RRR_0_OPCODE_X0) |
+                create_UnaryOpcodeExtension_X1(NOP_UNARY_OPCODE_X1) |
+                create_RRROpcodeExtension_X1(UNARY_RRR_0_OPCODE_X1) |
+                create_Opcode_X1(RRR_0_OPCODE_X1);
+}
+
+static int machine_stopped __read_mostly;
+
+int ftrace_arch_code_modify_prepare(void)
+{
+        machine_stopped = 1;
+        return 0;
+}
+
+int ftrace_arch_code_modify_post_process(void)
+{
+        flush_icache_range(0, CHIP_L1I_CACHE_SIZE());
+        machine_stopped = 0;
+        return 0;
+}
+
+/*
+ * Put { move r10, lr; jal ftrace_caller } in a bundle, this lets dynamic
+ * tracer just add one cycle overhead to every kernel function when disabled.
+ */
+static unsigned long ftrace_gen_branch(unsigned long pc, unsigned long addr,
+                                       bool link)
+{
+        tilegx_bundle_bits opcode_x0, opcode_x1;
+        long pcrel_by_instr = (addr - pc) >> TILEGX_LOG2_BUNDLE_SIZE_IN_BYTES;
+
+        if (link) {
+                /* opcode: jal addr */
+                opcode_x1 =
+                        create_Opcode_X1(JUMP_OPCODE_X1) |
+                        create_JumpOpcodeExtension_X1(JAL_JUMP_OPCODE_X1) |
+                        create_JumpOff_X1(pcrel_by_instr);
+        } else {
+                /* opcode: j addr */
+                opcode_x1 =
+                        create_Opcode_X1(JUMP_OPCODE_X1) |
+                        create_JumpOpcodeExtension_X1(J_JUMP_OPCODE_X1) |
+                        create_JumpOff_X1(pcrel_by_instr);
+        }
+
+        if (addr == FTRACE_ADDR) {
+                /* opcode: or r10, lr, zero */
+                opcode_x0 =
+                        create_Dest_X0(10) |
+                        create_SrcA_X0(TREG_LR) |
+                        create_SrcB_X0(TREG_ZERO) |
+                        create_RRROpcodeExtension_X0(OR_RRR_0_OPCODE_X0) |
+                        create_Opcode_X0(RRR_0_OPCODE_X0);
+        } else {
+                /* opcode: fnop */
+                opcode_x0 =
+                        create_UnaryOpcodeExtension_X0(FNOP_UNARY_OPCODE_X0) |
+                        create_RRROpcodeExtension_X0(UNARY_RRR_0_OPCODE_X0) |
+                        create_Opcode_X0(RRR_0_OPCODE_X0);
+        }
+
+        return opcode_x1 | opcode_x0;
+}
+
+static unsigned long ftrace_nop_replace(struct dyn_ftrace *rec)
+{
+        return NOP();
+}
+
+static unsigned long ftrace_call_replace(unsigned long pc, unsigned long addr)
+{
+        return ftrace_gen_branch(pc, addr, true);
+}
+
+static int ftrace_modify_code(unsigned long pc, unsigned long old,
+                              unsigned long new)
+{
+        unsigned long pc_wr;
+
+        /* Check if the address is in kernel text space and module space. */
+        if (!kernel_text_address(pc))
+                return -EINVAL;
+
+        /* Operate on writable kernel text mapping. */
+        pc_wr = pc - MEM_SV_START + PAGE_OFFSET;
+
+        if (probe_kernel_write((void *)pc_wr, &new, MCOUNT_INSN_SIZE))
+                return -EPERM;
+
+        smp_wmb();
+
+        if (!machine_stopped && num_online_cpus() > 1)
+                flush_icache_range(pc, pc + MCOUNT_INSN_SIZE);
+
+        return 0;
+}
+
+int ftrace_update_ftrace_func(ftrace_func_t func)
+{
+        unsigned long pc, old;
+        unsigned long new;
+        int ret;
+
+        pc = (unsigned long)&ftrace_call;
+        memcpy(&old, &ftrace_call, MCOUNT_INSN_SIZE);
+        new = ftrace_call_replace(pc, (unsigned long)func);
+
+        ret = ftrace_modify_code(pc, old, new);
+
+        return ret;
+}
+
+int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
+{
+        unsigned long new, old;
+        unsigned long ip = rec->ip;
+
+        old = ftrace_nop_replace(rec);
+        new = ftrace_call_replace(ip, addr);
+
+        return ftrace_modify_code(rec->ip, old, new);
+}
+
+int ftrace_make_nop(struct module *mod,
+                    struct dyn_ftrace *rec, unsigned long addr)
+{
+        unsigned long ip = rec->ip;
+        unsigned long old;
+        unsigned long new;
+        int ret;
+
+        old = ftrace_call_replace(ip, addr);
+        new = ftrace_nop_replace(rec);
+        ret = ftrace_modify_code(ip, old, new);
+
+        return ret;
+}
+
+int __init ftrace_dyn_arch_init(void *data)
+{
+        *(unsigned long *)data = 0;
+
+        return 0;
+}
+#endif /* CONFIG_DYNAMIC_FTRACE */
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+                           unsigned long frame_pointer)
+{
+        unsigned long return_hooker = (unsigned long) &return_to_handler;
+        struct ftrace_graph_ent trace;
+        unsigned long old;
+        int err;
+
+        if (unlikely(atomic_read(&current->tracing_graph_pause)))
+                return;
+
+        old = *parent;
+        *parent = return_hooker;
+
+        err = ftrace_push_return_trace(old, self_addr, &trace.depth,
+                                       frame_pointer);
+        if (err == -EBUSY) {
+                *parent = old;
+                return;
+        }
+
+        trace.func = self_addr;
+
+        /* Only trace if the calling function expects to */
+        if (!ftrace_graph_entry(&trace)) {
+                current->curr_ret_stack--;
+                *parent = old;
+        }
+}
+
+#ifdef CONFIG_DYNAMIC_FTRACE
+extern unsigned long ftrace_graph_call;
+
+static int __ftrace_modify_caller(unsigned long *callsite,
+                                  void (*func) (void), bool enable)
+{
+        unsigned long caller_fn = (unsigned long) func;
+        unsigned long pc = (unsigned long) callsite;
+        unsigned long branch = ftrace_gen_branch(pc, caller_fn, false);
+        unsigned long nop = NOP();
+        unsigned long old = enable ? nop : branch;
+        unsigned long new = enable ? branch : nop;
+
+        return ftrace_modify_code(pc, old, new);
+}
+
+static int ftrace_modify_graph_caller(bool enable)
+{
+        int ret;
+
+        ret = __ftrace_modify_caller(&ftrace_graph_call,
+                                     ftrace_graph_caller,
+                                     enable);
+
+        return ret;
+}
+
+int ftrace_enable_ftrace_graph_caller(void)
+{
+        return ftrace_modify_graph_caller(true);
+}
+
+int ftrace_disable_ftrace_graph_caller(void)
+{
+        return ftrace_modify_graph_caller(false);
+}
+#endif /* CONFIG_DYNAMIC_FTRACE */
+#endif /* CONFIG_FUNCTION_GRAPH_TRACER */
diff --git a/arch/tile/kernel/hardwall.c b/arch/tile/kernel/hardwall.c
index 38ac189d9575..df27a1fd94a3 100644
--- a/arch/tile/kernel/hardwall.c
+++ b/arch/tile/kernel/hardwall.c
@@ -272,9 +272,9 @@ static void hardwall_setup_func(void *info)
         struct hardwall_info *r = info;
         struct hardwall_type *hwt = r->type;
 
-        int cpu = smp_processor_id();
-        int x = cpu % smp_width;
-        int y = cpu / smp_width;
+        int cpu = smp_processor_id();  /* on_each_cpu disables preemption */
+        int x = cpu_x(cpu);
+        int y = cpu_y(cpu);
         int bits = 0;
         if (x == r->ulhc_x)
                 bits |= W_PROTECT;
@@ -317,6 +317,7 @@ static void hardwall_protect_rectangle(struct hardwall_info *r)
         on_each_cpu_mask(&rect_cpus, hardwall_setup_func, r, 1);
 }
 
+/* Entered from INT_xDN_FIREWALL interrupt vector with irqs disabled. */
 void __kprobes do_hardwall_trap(struct pt_regs* regs, int fault_num)
 {
         struct hardwall_info *rect;
@@ -325,7 +326,6 @@ void __kprobes do_hardwall_trap(struct pt_regs* regs, int fault_num)
         struct siginfo info;
         int cpu = smp_processor_id();
         int found_processes;
-        unsigned long flags;
         struct pt_regs *old_regs = set_irq_regs(regs);
 
         irq_enter();
@@ -346,7 +346,7 @@ void __kprobes do_hardwall_trap(struct pt_regs* regs, int fault_num)
         BUG_ON(hwt->disabled);
 
         /* This tile trapped a network access; find the rectangle. */
-        spin_lock_irqsave(&hwt->lock, flags);
+        spin_lock(&hwt->lock);
         list_for_each_entry(rect, &hwt->list, list) {
                 if (cpumask_test_cpu(cpu, &rect->cpumask))
                         break;
@@ -401,7 +401,7 @@ void __kprobes do_hardwall_trap(struct pt_regs* regs, int fault_num)
                 pr_notice("hardwall: no associated processes!\n");
 
  done:
-        spin_unlock_irqrestore(&hwt->lock, flags);
+        spin_unlock(&hwt->lock);
 
         /*
          * We have to disable firewall interrupts now, or else when we
@@ -540,6 +540,14 @@ static struct hardwall_info *hardwall_create(struct hardwall_type *hwt,
                 }
         }
 
+        /*
+         * Eliminate cpus that are not part of this Linux client.
+         * Note that this allows for configurations that we might not want to
+         * support, such as one client on every even cpu, another client on
+         * every odd cpu.
+         */
+        cpumask_and(&info->cpumask, &info->cpumask, cpu_online_mask);
+
         /* Confirm it doesn't overlap and add it to the list. */
         spin_lock_irqsave(&hwt->lock, flags);
         list_for_each_entry(iter, &hwt->list, list) {
@@ -612,7 +620,7 @@ static int hardwall_activate(struct hardwall_info *info)
 
 /*
  * Deactivate a task's hardwall.  Must hold lock for hardwall_type.
- * This method may be called from free_task(), so we don't want to
+ * This method may be called from exit_thread(), so we don't want to
  * rely on too many fields of struct task_struct still being valid.
  * We assume the cpus_allowed, pid, and comm fields are still valid.
  */
@@ -653,7 +661,7 @@ static int hardwall_deactivate(struct hardwall_type *hwt,
                 return -EINVAL;
 
         printk(KERN_DEBUG "Pid %d (%s) deactivated for %s hardwall: cpu %d\n",
-               task->pid, task->comm, hwt->name, smp_processor_id());
+               task->pid, task->comm, hwt->name, raw_smp_processor_id());
         return 0;
 }
 
@@ -795,8 +803,8 @@ static void reset_xdn_network_state(struct hardwall_type *hwt)
         /* Reset UDN coordinates to their standard value */
         {
                 unsigned int cpu = smp_processor_id();
-                unsigned int x = cpu % smp_width;
-                unsigned int y = cpu / smp_width;
+                unsigned int x = cpu_x(cpu);
+                unsigned int y = cpu_y(cpu);
                 __insn_mtspr(SPR_UDN_TILE_COORD, (x << 18) | (y << 7));
         }
 
diff --git a/arch/tile/kernel/head_32.S b/arch/tile/kernel/head_32.S
index ac115307e5e4..8d5b40ff2922 100644
--- a/arch/tile/kernel/head_32.S
+++ b/arch/tile/kernel/head_32.S
@@ -39,12 +39,12 @@ ENTRY(_start)
         }
         {
           moveli r0, _HV_VERSION_OLD_HV_INIT
-          jal hv_init
+          jal _hv_init
         }
         /* Get a reasonable default ASID in r0 */
         {
           move r0, zero
-          jal hv_inquire_asid
+          jal _hv_inquire_asid
         }
         /* Install the default page table */
         {
@@ -64,7 +64,7 @@ ENTRY(_start)
           auli r0, r0, ha16(swapper_pg_dir - PAGE_OFFSET)
         }
         {
-          inv r6
+          finv r6
           move r1, zero   /* high 32 bits of CPA is zero */
         }
         {
@@ -73,12 +73,12 @@ ENTRY(_start)
         }
         {
           auli lr, lr, ha16(1f)
-          j hv_install_context
+          j _hv_install_context
         }
 1:
 
         /* Get our processor number and save it away in SAVE_K_0. */
-        jal hv_inquire_topology
+        jal _hv_inquire_topology
         mulll_uu r4, r1, r2        /* r1 == y, r2 == width */
         add r4, r4, r0             /* r0 == x, so r4 == cpu == y*width + x */
 
@@ -86,7 +86,7 @@ ENTRY(_start)
         /*
          * Load up our per-cpu offset.  When the first (master) tile
          * boots, this value is still zero, so we will load boot_pc
-         * with start_kernel, and boot_sp with init_stack + THREAD_SIZE.
+         * with start_kernel, and boot_sp at the top of init_stack.
          * The master tile initializes the per-cpu offset array, so that
          * when subsequent (secondary) tiles boot, they will instead load
          * from their per-cpu versions of boot_sp and boot_pc.
@@ -126,7 +126,6 @@ ENTRY(_start)
         lw sp, r1
         or r4, sp, r4
         mtspr SPR_SYSTEM_SAVE_K_0, r4  /* save ksp0 + cpu */
-        addi sp, sp, -STACK_TOP_DELTA
         {
           move lr, zero   /* stop backtraces in the called function */
           jr r0
@@ -163,8 +162,8 @@ ENTRY(swapper_pg_dir)
         .set addr, addr + PGDIR_SIZE
         .endr
 
-        /* The true text VAs are mapped as VA = PA + MEM_SV_INTRPT */
-        PTE MEM_SV_INTRPT, 0, (1 << (HV_PTE_INDEX_READABLE - 32)) | \
+        /* The true text VAs are mapped as VA = PA + MEM_SV_START */
+        PTE MEM_SV_START, 0, (1 << (HV_PTE_INDEX_READABLE - 32)) | \
                               (1 << (HV_PTE_INDEX_EXECUTABLE - 32))
         .org swapper_pg_dir + PGDIR_SIZE
         END(swapper_pg_dir)
diff --git a/arch/tile/kernel/head_64.S b/arch/tile/kernel/head_64.S
index 6093964fa5c7..bd0e12f283f3 100644
--- a/arch/tile/kernel/head_64.S
+++ b/arch/tile/kernel/head_64.S
@@ -25,6 +25,15 @@
 #include <arch/chip.h>
 #include <arch/spr_def.h>
 
+/* Extract two 32-bit bit values that were read into one register. */
+#ifdef __BIG_ENDIAN__
+#define GET_FIRST_INT(rd, rs) shrsi rd, rs, 32
+#define GET_SECOND_INT(rd, rs) addxi rd, rs, 0
+#else
+#define GET_FIRST_INT(rd, rs) addxi rd, rs, 0
+#define GET_SECOND_INT(rd, rs) shrsi rd, rs, 32
+#endif
+
 /*
  * This module contains the entry code for kernel images. It performs the
  * minimal setup needed to call the generic C routines.
@@ -46,11 +55,11 @@ ENTRY(_start)
           movei r2, TILE_CHIP_REV
           movei r3, KERNEL_PL
         }
-        jal hv_init
+        jal _hv_init
         /* Get a reasonable default ASID in r0 */
         {
           move r0, zero
-          jal hv_inquire_asid
+          jal _hv_inquire_asid
         }
 
         /*
@@ -61,7 +70,7 @@ ENTRY(_start)
          * other CPUs should see a properly-constructed page table.
          */
         {
-          v4int_l r2, zero, r0    /* ASID for hv_install_context */
+          GET_FIRST_INT(r2, r0)    /* ASID for hv_install_context */
           moveli r4, hw1_last(swapper_pgprot - PAGE_OFFSET)
         }
         {
@@ -77,7 +86,7 @@ ENTRY(_start)
         {
           /* After initializing swapper_pgprot, HV_PTE_GLOBAL is set. */
           bfextu r7, r1, HV_PTE_INDEX_GLOBAL, HV_PTE_INDEX_GLOBAL
-          inv r4
+          finv r4
         }
         bnez r7, .Lno_write
         {
@@ -121,29 +130,24 @@ ENTRY(_start)
         }
         {
           moveli r3, CTX_PAGE_FLAG
-          j hv_install_context
+          j _hv_install_context
         }
 1:
 
         /* Install the interrupt base. */
-        moveli r0, hw2_last(MEM_SV_START)
-        shl16insli r0, r0, hw1(MEM_SV_START)
-        shl16insli r0, r0, hw0(MEM_SV_START)
+        moveli r0, hw2_last(intrpt_start)
+        shl16insli r0, r0, hw1(intrpt_start)
+        shl16insli r0, r0, hw0(intrpt_start)
         mtspr SPR_INTERRUPT_VECTOR_BASE_K, r0
 
-        /*
-         * Get our processor number and save it away in SAVE_K_0.
-         * Extract stuff from the topology structure: r4 = y, r6 = x,
-         * r5 = width.  FIXME: consider whether we want to just make these
-         * 64-bit values (and if so fix smp_topology write below, too).
-         */
-        jal hv_inquire_topology
+        /* Get our processor number and save it away in SAVE_K_0. */
+        jal _hv_inquire_topology
         {
-          v4int_l r5, zero, r1    /* r5 = width */
-          shrui r4, r0, 32        /* r4 = y */
+          GET_FIRST_INT(r5, r1)   /* r5 = width */
+          GET_SECOND_INT(r4, r0)  /* r4 = y */
         }
         {
-          v4int_l r6, zero, r0    /* r6 = x */
+          GET_FIRST_INT(r6, r0)   /* r6 = x */
           mul_lu_lu r4, r4, r5
         }
         {
@@ -154,7 +158,7 @@ ENTRY(_start)
         /*
          * Load up our per-cpu offset.  When the first (master) tile
          * boots, this value is still zero, so we will load boot_pc
-         * with start_kernel, and boot_sp with init_stack + THREAD_SIZE.
+         * with start_kernel, and boot_sp with at the top of init_stack.
          * The master tile initializes the per-cpu offset array, so that
          * when subsequent (secondary) tiles boot, they will instead load
          * from their per-cpu versions of boot_sp and boot_pc.
@@ -198,9 +202,9 @@ ENTRY(_start)
         }
         ld r0, r0
         ld sp, r1
-        or r4, sp, r4
+        shli r4, r4, CPU_SHIFT
+        bfins r4, sp, 0, CPU_SHIFT-1
         mtspr SPR_SYSTEM_SAVE_K_0, r4  /* save ksp0 + cpu */
-        addi sp, sp, -STACK_TOP_DELTA
         {
           move lr, zero   /* stop backtraces in the called function */
           jr r0
diff --git a/arch/tile/kernel/hvglue.S b/arch/tile/kernel/hvglue.S
new file mode 100644
index 000000000000..2ab456622391
--- /dev/null
+++ b/arch/tile/kernel/hvglue.S
@@ -0,0 +1,74 @@
+/* Hypervisor call vector addresses; see <hv/hypervisor.h> */
+.macro gensym sym, val, size
+.org \val
+.global _\sym
+.type _\sym,function
+_\sym:
+.size _\sym,\size
+#ifndef CONFIG_TILE_HVGLUE_TRACE
+.globl \sym
+.set \sym,_\sym
+#endif
+.endm
+
+.section .hvglue,"x",@nobits
+.align 8
+gensym hv_init, 0x20, 32
+gensym hv_install_context, 0x40, 32
+gensym hv_sysconf, 0x60, 32
+gensym hv_get_rtc, 0x80, 32
+gensym hv_set_rtc, 0xa0, 32
+gensym hv_flush_asid, 0xc0, 32
+gensym hv_flush_page, 0xe0, 32
+gensym hv_flush_pages, 0x100, 32
+gensym hv_restart, 0x120, 32
+gensym hv_halt, 0x140, 32
+gensym hv_power_off, 0x160, 32
+gensym hv_inquire_physical, 0x180, 32
+gensym hv_inquire_memory_controller, 0x1a0, 32
+gensym hv_inquire_virtual, 0x1c0, 32
+gensym hv_inquire_asid, 0x1e0, 32
+gensym hv_nanosleep, 0x200, 32
+gensym hv_console_read_if_ready, 0x220, 32
+gensym hv_console_write, 0x240, 32
+gensym hv_downcall_dispatch, 0x260, 32
+gensym hv_inquire_topology, 0x280, 32
+gensym hv_fs_findfile, 0x2a0, 32
+gensym hv_fs_fstat, 0x2c0, 32
+gensym hv_fs_pread, 0x2e0, 32
+gensym hv_physaddr_read64, 0x300, 32
+gensym hv_physaddr_write64, 0x320, 32
+gensym hv_get_command_line, 0x340, 32
+gensym hv_set_caching, 0x360, 32
+gensym hv_bzero_page, 0x380, 32
+gensym hv_register_message_state, 0x3a0, 32
+gensym hv_send_message, 0x3c0, 32
+gensym hv_receive_message, 0x3e0, 32
+gensym hv_inquire_context, 0x400, 32
+gensym hv_start_all_tiles, 0x420, 32
+gensym hv_dev_open, 0x440, 32
+gensym hv_dev_close, 0x460, 32
+gensym hv_dev_pread, 0x480, 32
+gensym hv_dev_pwrite, 0x4a0, 32
+gensym hv_dev_poll, 0x4c0, 32
+gensym hv_dev_poll_cancel, 0x4e0, 32
+gensym hv_dev_preada, 0x500, 32
+gensym hv_dev_pwritea, 0x520, 32
+gensym hv_flush_remote, 0x540, 32
+gensym hv_console_putc, 0x560, 32
+gensym hv_inquire_tiles, 0x580, 32
+gensym hv_confstr, 0x5a0, 32
+gensym hv_reexec, 0x5c0, 32
+gensym hv_set_command_line, 0x5e0, 32
+gensym hv_clear_intr, 0x600, 32
+gensym hv_enable_intr, 0x620, 32
+gensym hv_disable_intr, 0x640, 32
+gensym hv_raise_intr, 0x660, 32
+gensym hv_trigger_ipi, 0x680, 32
+gensym hv_store_mapping, 0x6a0, 32
+gensym hv_inquire_realpa, 0x6c0, 32
+gensym hv_flush_all, 0x6e0, 32
+gensym hv_get_ipi_pte, 0x700, 32
+gensym hv_set_pte_super_shift, 0x720, 32
+gensym hv_console_set_ipi, 0x7e0, 32
+gensym hv_glue_internals, 0x800, 30720
diff --git a/arch/tile/kernel/hvglue.lds b/arch/tile/kernel/hvglue.lds
deleted file mode 100644
index d44c5a67a1ed..000000000000
--- a/arch/tile/kernel/hvglue.lds
+++ /dev/null
@@ -1,59 +0,0 @@
-/* Hypervisor call vector addresses; see <hv/hypervisor.h> */
-hv_init = TEXT_OFFSET + 0x10020;
-hv_install_context = TEXT_OFFSET + 0x10040;
-hv_sysconf = TEXT_OFFSET + 0x10060;
-hv_get_rtc = TEXT_OFFSET + 0x10080;
-hv_set_rtc = TEXT_OFFSET + 0x100a0;
-hv_flush_asid = TEXT_OFFSET + 0x100c0;
-hv_flush_page = TEXT_OFFSET + 0x100e0;
-hv_flush_pages = TEXT_OFFSET + 0x10100;
-hv_restart = TEXT_OFFSET + 0x10120;
-hv_halt = TEXT_OFFSET + 0x10140;
-hv_power_off = TEXT_OFFSET + 0x10160;
-hv_inquire_physical = TEXT_OFFSET + 0x10180;
-hv_inquire_memory_controller = TEXT_OFFSET + 0x101a0;
-hv_inquire_virtual = TEXT_OFFSET + 0x101c0;
-hv_inquire_asid = TEXT_OFFSET + 0x101e0;
-hv_nanosleep = TEXT_OFFSET + 0x10200;
-hv_console_read_if_ready = TEXT_OFFSET + 0x10220;
-hv_console_write = TEXT_OFFSET + 0x10240;
-hv_downcall_dispatch = TEXT_OFFSET + 0x10260;
-hv_inquire_topology = TEXT_OFFSET + 0x10280;
-hv_fs_findfile = TEXT_OFFSET + 0x102a0;
-hv_fs_fstat = TEXT_OFFSET + 0x102c0;
-hv_fs_pread = TEXT_OFFSET + 0x102e0;
-hv_physaddr_read64 = TEXT_OFFSET + 0x10300;
-hv_physaddr_write64 = TEXT_OFFSET + 0x10320;
-hv_get_command_line = TEXT_OFFSET + 0x10340;
-hv_set_caching = TEXT_OFFSET + 0x10360;
-hv_bzero_page = TEXT_OFFSET + 0x10380;
-hv_register_message_state = TEXT_OFFSET + 0x103a0;
-hv_send_message = TEXT_OFFSET + 0x103c0;
-hv_receive_message = TEXT_OFFSET + 0x103e0;
-hv_inquire_context = TEXT_OFFSET + 0x10400;
-hv_start_all_tiles = TEXT_OFFSET + 0x10420;
-hv_dev_open = TEXT_OFFSET + 0x10440;
-hv_dev_close = TEXT_OFFSET + 0x10460;
-hv_dev_pread = TEXT_OFFSET + 0x10480;
-hv_dev_pwrite = TEXT_OFFSET + 0x104a0;
-hv_dev_poll = TEXT_OFFSET + 0x104c0;
-hv_dev_poll_cancel = TEXT_OFFSET + 0x104e0;
-hv_dev_preada = TEXT_OFFSET + 0x10500;
-hv_dev_pwritea = TEXT_OFFSET + 0x10520;
-hv_flush_remote = TEXT_OFFSET + 0x10540;
-hv_console_putc = TEXT_OFFSET + 0x10560;
-hv_inquire_tiles = TEXT_OFFSET + 0x10580;
-hv_confstr = TEXT_OFFSET + 0x105a0;
-hv_reexec = TEXT_OFFSET + 0x105c0;
-hv_set_command_line = TEXT_OFFSET + 0x105e0;
-hv_clear_intr = TEXT_OFFSET + 0x10600;
-hv_enable_intr = TEXT_OFFSET + 0x10620;
-hv_disable_intr = TEXT_OFFSET + 0x10640;
-hv_raise_intr = TEXT_OFFSET + 0x10660;
-hv_trigger_ipi = TEXT_OFFSET + 0x10680;
-hv_store_mapping = TEXT_OFFSET + 0x106a0;
-hv_inquire_realpa = TEXT_OFFSET + 0x106c0;
-hv_flush_all = TEXT_OFFSET + 0x106e0;
-hv_get_ipi_pte = TEXT_OFFSET + 0x10700;
-hv_set_pte_super_shift = TEXT_OFFSET + 0x10720;
-hv_glue_internals = TEXT_OFFSET + 0x10740;
diff --git a/arch/tile/kernel/hvglue_trace.c b/arch/tile/kernel/hvglue_trace.c
new file mode 100644
index 000000000000..85c74ad29312
--- /dev/null
+++ b/arch/tile/kernel/hvglue_trace.c
@@ -0,0 +1,266 @@
+/*
+ * Copyright 2013 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+/*
+ * Pull in the hypervisor header so we declare all the ABI functions
+ * with the underscore versions, then undef the names so that we can
+ * provide our own wrapper versions.
+ */
+#define hv_init _hv_init
+#define hv_install_context _hv_install_context
+#define hv_sysconf _hv_sysconf
+#define hv_get_rtc _hv_get_rtc
+#define hv_set_rtc _hv_set_rtc
+#define hv_flush_asid _hv_flush_asid
+#define hv_flush_page _hv_flush_page
+#define hv_flush_pages _hv_flush_pages
+#define hv_restart _hv_restart
+#define hv_halt _hv_halt
+#define hv_power_off _hv_power_off
+#define hv_inquire_physical _hv_inquire_physical
+#define hv_inquire_memory_controller _hv_inquire_memory_controller
+#define hv_inquire_virtual _hv_inquire_virtual
+#define hv_inquire_asid _hv_inquire_asid
+#define hv_nanosleep _hv_nanosleep
+#define hv_console_read_if_ready _hv_console_read_if_ready
+#define hv_console_write _hv_console_write
+#define hv_downcall_dispatch _hv_downcall_dispatch
+#define hv_inquire_topology _hv_inquire_topology
+#define hv_fs_findfile _hv_fs_findfile
+#define hv_fs_fstat _hv_fs_fstat
+#define hv_fs_pread _hv_fs_pread
+#define hv_physaddr_read64 _hv_physaddr_read64
+#define hv_physaddr_write64 _hv_physaddr_write64
+#define hv_get_command_line _hv_get_command_line
+#define hv_set_caching _hv_set_caching
+#define hv_bzero_page _hv_bzero_page
+#define hv_register_message_state _hv_register_message_state
+#define hv_send_message _hv_send_message
+#define hv_receive_message _hv_receive_message
+#define hv_inquire_context _hv_inquire_context
+#define hv_start_all_tiles _hv_start_all_tiles
+#define hv_dev_open _hv_dev_open
+#define hv_dev_close _hv_dev_close
+#define hv_dev_pread _hv_dev_pread
+#define hv_dev_pwrite _hv_dev_pwrite
+#define hv_dev_poll _hv_dev_poll
+#define hv_dev_poll_cancel _hv_dev_poll_cancel
+#define hv_dev_preada _hv_dev_preada
+#define hv_dev_pwritea _hv_dev_pwritea
+#define hv_flush_remote _hv_flush_remote
+#define hv_console_putc _hv_console_putc
+#define hv_inquire_tiles _hv_inquire_tiles
+#define hv_confstr _hv_confstr
+#define hv_reexec _hv_reexec
+#define hv_set_command_line _hv_set_command_line
+#define hv_clear_intr _hv_clear_intr
+#define hv_enable_intr _hv_enable_intr
+#define hv_disable_intr _hv_disable_intr
+#define hv_raise_intr _hv_raise_intr
+#define hv_trigger_ipi _hv_trigger_ipi
+#define hv_store_mapping _hv_store_mapping
+#define hv_inquire_realpa _hv_inquire_realpa
+#define hv_flush_all _hv_flush_all
+#define hv_get_ipi_pte _hv_get_ipi_pte
+#define hv_set_pte_super_shift _hv_set_pte_super_shift
+#define hv_console_set_ipi _hv_console_set_ipi
+#include <hv/hypervisor.h>
+#undef hv_init
+#undef hv_install_context
+#undef hv_sysconf
+#undef hv_get_rtc
+#undef hv_set_rtc
+#undef hv_flush_asid
+#undef hv_flush_page
+#undef hv_flush_pages
+#undef hv_restart
+#undef hv_halt
+#undef hv_power_off
+#undef hv_inquire_physical
+#undef hv_inquire_memory_controller
+#undef hv_inquire_virtual
+#undef hv_inquire_asid
+#undef hv_nanosleep
+#undef hv_console_read_if_ready
+#undef hv_console_write
+#undef hv_downcall_dispatch
+#undef hv_inquire_topology
+#undef hv_fs_findfile
+#undef hv_fs_fstat
+#undef hv_fs_pread
+#undef hv_physaddr_read64
+#undef hv_physaddr_write64
+#undef hv_get_command_line
+#undef hv_set_caching
+#undef hv_bzero_page
+#undef hv_register_message_state
+#undef hv_send_message
+#undef hv_receive_message
+#undef hv_inquire_context
+#undef hv_start_all_tiles
+#undef hv_dev_open
+#undef hv_dev_close
+#undef hv_dev_pread
+#undef hv_dev_pwrite
+#undef hv_dev_poll
+#undef hv_dev_poll_cancel
+#undef hv_dev_preada
+#undef hv_dev_pwritea
+#undef hv_flush_remote
+#undef hv_console_putc
+#undef hv_inquire_tiles
+#undef hv_confstr
+#undef hv_reexec
+#undef hv_set_command_line
+#undef hv_clear_intr
+#undef hv_enable_intr
+#undef hv_disable_intr
+#undef hv_raise_intr
+#undef hv_trigger_ipi
+#undef hv_store_mapping
+#undef hv_inquire_realpa
+#undef hv_flush_all
+#undef hv_get_ipi_pte
+#undef hv_set_pte_super_shift
+#undef hv_console_set_ipi
+
+/*
+ * Provide macros based on <linux/syscalls.h> to provide a wrapper
+ * function that invokes the same function with an underscore prefix.
+ * We can't use the existing __SC_xxx macros because we need to
+ * support up to nine arguments rather than up to six, and also this
+ * way the file stands alone from possible changes in the
+ * implementation of <linux/syscalls.h>.
+ */
+#define HV_WRAP0(type, name)                                    \
+        type name(void);                                        \
+        type name(void)                                         \
+        {                                                       \
+                return _##name();                               \
+        }
+#define __HV_DECL1(t1, a1)      t1 a1
+#define __HV_DECL2(t2, a2, ...) t2 a2, __HV_DECL1(__VA_ARGS__)
+#define __HV_DECL3(t3, a3, ...) t3 a3, __HV_DECL2(__VA_ARGS__)
+#define __HV_DECL4(t4, a4, ...) t4 a4, __HV_DECL3(__VA_ARGS__)
+#define __HV_DECL5(t5, a5, ...) t5 a5, __HV_DECL4(__VA_ARGS__)
+#define __HV_DECL6(t6, a6, ...) t6 a6, __HV_DECL5(__VA_ARGS__)
+#define __HV_DECL7(t7, a7, ...) t7 a7, __HV_DECL6(__VA_ARGS__)
+#define __HV_DECL8(t8, a8, ...) t8 a8, __HV_DECL7(__VA_ARGS__)
+#define __HV_DECL9(t9, a9, ...) t9 a9, __HV_DECL8(__VA_ARGS__)
+#define __HV_PASS1(t1, a1)      a1
+#define __HV_PASS2(t2, a2, ...) a2, __HV_PASS1(__VA_ARGS__)
+#define __HV_PASS3(t3, a3, ...) a3, __HV_PASS2(__VA_ARGS__)
+#define __HV_PASS4(t4, a4, ...) a4, __HV_PASS3(__VA_ARGS__)
+#define __HV_PASS5(t5, a5, ...) a5, __HV_PASS4(__VA_ARGS__)
+#define __HV_PASS6(t6, a6, ...) a6, __HV_PASS5(__VA_ARGS__)
+#define __HV_PASS7(t7, a7, ...) a7, __HV_PASS6(__VA_ARGS__)
+#define __HV_PASS8(t8, a8, ...) a8, __HV_PASS7(__VA_ARGS__)
+#define __HV_PASS9(t9, a9, ...) a9, __HV_PASS8(__VA_ARGS__)
+#define HV_WRAPx(x, type, name, ...)                            \
+        type name(__HV_DECL##x(__VA_ARGS__));                   \
+        type name(__HV_DECL##x(__VA_ARGS__))                    \
+        {                                                       \
+                return _##name(__HV_PASS##x(__VA_ARGS__));      \
+        }
+#define HV_WRAP1(type, name, ...) HV_WRAPx(1, type, name, __VA_ARGS__)
+#define HV_WRAP2(type, name, ...) HV_WRAPx(2, type, name, __VA_ARGS__)
+#define HV_WRAP3(type, name, ...) HV_WRAPx(3, type, name, __VA_ARGS__)
+#define HV_WRAP4(type, name, ...) HV_WRAPx(4, type, name, __VA_ARGS__)
+#define HV_WRAP5(type, name, ...) HV_WRAPx(5, type, name, __VA_ARGS__)
+#define HV_WRAP6(type, name, ...) HV_WRAPx(6, type, name, __VA_ARGS__)
+#define HV_WRAP7(type, name, ...) HV_WRAPx(7, type, name, __VA_ARGS__)
+#define HV_WRAP8(type, name, ...) HV_WRAPx(8, type, name, __VA_ARGS__)
+#define HV_WRAP9(type, name, ...) HV_WRAPx(9, type, name, __VA_ARGS__)
+
+/* List all the hypervisor API functions. */
+HV_WRAP4(void, hv_init, HV_VersionNumber, interface_version_number,
+         int, chip_num, int, chip_rev_num, int, client_pl)
+HV_WRAP1(long, hv_sysconf, HV_SysconfQuery, query)
+HV_WRAP3(int, hv_confstr, HV_ConfstrQuery, query, HV_VirtAddr, buf, int, len)
+#if CHIP_HAS_IPI()
+HV_WRAP3(int, hv_get_ipi_pte, HV_Coord, tile, int, pl, HV_PTE*, pte)
+HV_WRAP3(int, hv_console_set_ipi, int, ipi, int, event, HV_Coord, coord);
+#else
+HV_WRAP1(void, hv_enable_intr, HV_IntrMask, enab_mask)
+HV_WRAP1(void, hv_disable_intr, HV_IntrMask, disab_mask)
+HV_WRAP1(void, hv_clear_intr, HV_IntrMask, clear_mask)
+HV_WRAP1(void, hv_raise_intr, HV_IntrMask, raise_mask)
+HV_WRAP2(HV_Errno, hv_trigger_ipi, HV_Coord, tile, int, interrupt)
+#endif /* !CHIP_HAS_IPI() */
+HV_WRAP3(int, hv_store_mapping, HV_VirtAddr, va, unsigned int, len,
+         HV_PhysAddr, pa)
+HV_WRAP2(HV_PhysAddr, hv_inquire_realpa, HV_PhysAddr, cpa, unsigned int, len)
+HV_WRAP0(HV_RTCTime, hv_get_rtc)
+HV_WRAP1(void, hv_set_rtc, HV_RTCTime, time)
+HV_WRAP4(int, hv_install_context, HV_PhysAddr, page_table, HV_PTE, access,
+         HV_ASID, asid, __hv32, flags)
+HV_WRAP2(int, hv_set_pte_super_shift, int, level, int, log2_count)
+HV_WRAP0(HV_Context, hv_inquire_context)
+HV_WRAP1(int, hv_flush_asid, HV_ASID, asid)
+HV_WRAP2(int, hv_flush_page, HV_VirtAddr, address, HV_PageSize, page_size)
+HV_WRAP3(int, hv_flush_pages, HV_VirtAddr, start, HV_PageSize, page_size,
+         unsigned long, size)
+HV_WRAP1(int, hv_flush_all, int, preserve_global)
+HV_WRAP2(void, hv_restart, HV_VirtAddr, cmd, HV_VirtAddr, args)
+HV_WRAP0(void, hv_halt)
+HV_WRAP0(void, hv_power_off)
+HV_WRAP1(int, hv_reexec, HV_PhysAddr, entry)
+HV_WRAP0(HV_Topology, hv_inquire_topology)
+HV_WRAP3(HV_Errno, hv_inquire_tiles, HV_InqTileSet, set, HV_VirtAddr, cpumask,
+         int, length)
+HV_WRAP1(HV_PhysAddrRange, hv_inquire_physical, int, idx)
+HV_WRAP2(HV_MemoryControllerInfo, hv_inquire_memory_controller, HV_Coord, coord,
+         int, controller)
+HV_WRAP1(HV_VirtAddrRange, hv_inquire_virtual, int, idx)
+HV_WRAP1(HV_ASIDRange, hv_inquire_asid, int, idx)
+HV_WRAP1(void, hv_nanosleep, int, nanosecs)
+HV_WRAP0(int, hv_console_read_if_ready)
+HV_WRAP1(void, hv_console_putc, int, byte)
+HV_WRAP2(int, hv_console_write, HV_VirtAddr, bytes, int, len)
+HV_WRAP0(void, hv_downcall_dispatch)
+HV_WRAP1(int, hv_fs_findfile, HV_VirtAddr, filename)
+HV_WRAP1(HV_FS_StatInfo, hv_fs_fstat, int, inode)
+HV_WRAP4(int, hv_fs_pread, int, inode, HV_VirtAddr, buf,
+         int, length, int, offset)
+HV_WRAP2(unsigned long long, hv_physaddr_read64, HV_PhysAddr, addr,
+         HV_PTE, access)
+HV_WRAP3(void, hv_physaddr_write64, HV_PhysAddr, addr, HV_PTE, access,
+         unsigned long long, val)
+HV_WRAP2(int, hv_get_command_line, HV_VirtAddr, buf, int, length)
+HV_WRAP2(HV_Errno, hv_set_command_line, HV_VirtAddr, buf, int, length)
+HV_WRAP1(void, hv_set_caching, unsigned long, bitmask)
+HV_WRAP2(void, hv_bzero_page, HV_VirtAddr, va, unsigned int, size)
+HV_WRAP1(HV_Errno, hv_register_message_state, HV_MsgState*, msgstate)
+HV_WRAP4(int, hv_send_message, HV_Recipient *, recips, int, nrecip,
+         HV_VirtAddr, buf, int, buflen)
+HV_WRAP3(HV_RcvMsgInfo, hv_receive_message, HV_MsgState, msgstate,
+         HV_VirtAddr, buf, int, buflen)
+HV_WRAP0(void, hv_start_all_tiles)
+HV_WRAP2(int, hv_dev_open, HV_VirtAddr, name, __hv32, flags)
+HV_WRAP1(int, hv_dev_close, int, devhdl)
+HV_WRAP5(int, hv_dev_pread, int, devhdl, __hv32, flags, HV_VirtAddr, va,
+         __hv32, len, __hv64, offset)
+HV_WRAP5(int, hv_dev_pwrite, int, devhdl, __hv32, flags, HV_VirtAddr, va,
+         __hv32, len, __hv64, offset)
+HV_WRAP3(int, hv_dev_poll, int, devhdl, __hv32, events, HV_IntArg, intarg)
+HV_WRAP1(int, hv_dev_poll_cancel, int, devhdl)
+HV_WRAP6(int, hv_dev_preada, int, devhdl, __hv32, flags, __hv32, sgl_len,
+         HV_SGL *, sglp, __hv64, offset, HV_IntArg, intarg)
+HV_WRAP6(int, hv_dev_pwritea, int, devhdl, __hv32, flags, __hv32, sgl_len,
+         HV_SGL *, sglp, __hv64, offset, HV_IntArg, intarg)
+HV_WRAP9(int, hv_flush_remote, HV_PhysAddr, cache_pa,
+         unsigned long, cache_control, unsigned long*, cache_cpumask,
+         HV_VirtAddr, tlb_va, unsigned long, tlb_length,
+         unsigned long, tlb_pgsize, unsigned long*, tlb_cpumask,
+         HV_Remote_ASID*, asids, int, asidcount)
diff --git a/arch/tile/kernel/intvec_32.S b/arch/tile/kernel/intvec_32.S
index cb52d66343ed..088d5c141e68 100644
--- a/arch/tile/kernel/intvec_32.S
+++ b/arch/tile/kernel/intvec_32.S
@@ -28,20 +28,10 @@
 #include <arch/interrupts.h>
 #include <arch/spr_def.h>
 
-#ifdef CONFIG_PREEMPT
-# error "No support for kernel preemption currently"
-#endif
-
 #define PTREGS_PTR(reg, ptreg) addli reg, sp, C_ABI_SAVE_AREA_SIZE + (ptreg)
 
 #define PTREGS_OFFSET_SYSCALL PTREGS_OFFSET_REG(TREG_SYSCALL_NR)
 
-#if !CHIP_HAS_WH64()
-        /* By making this an empty macro, we can use wh64 in the code. */
-        .macro  wh64 reg
-        .endm
-#endif
-
         .macro  push_reg reg, ptr=sp, delta=-4
         {
          sw     \ptr, \reg
@@ -189,7 +179,7 @@ intvec_\vecname:
          * point sp at the top aligned address on the actual stack page.
          */
         mfspr   r0, SPR_SYSTEM_SAVE_K_0
-        mm      r0, r0, zero, LOG2_THREAD_SIZE, 31
+        mm      r0, r0, zero, LOG2_NR_CPU_IDS, 31
 
 0:
         /*
@@ -207,6 +197,9 @@ intvec_\vecname:
          *    cache line 1: r14...r29
          *    cache line 0: 2 x frame, r0..r13
          */
+#if STACK_TOP_DELTA != 64
+#error STACK_TOP_DELTA must be 64 for assumptions here and in task_pt_regs()
+#endif
         andi    r0, r0, -64
 
         /*
@@ -326,18 +319,14 @@ intvec_\vecname:
          movei  r3, -1   /* not used, but set for consistency */
         }
         .else
-#if CHIP_HAS_AUX_PERF_COUNTERS()
         .ifc \c_routine, op_handle_aux_perf_interrupt
         {
          mfspr  r2, AUX_PERF_COUNT_STS
          movei  r3, -1   /* not used, but set for consistency */
         }
         .else
-#endif
         movei   r3, 0
-#if CHIP_HAS_AUX_PERF_COUNTERS()
         .endif
-#endif
         .endif
         .endif
         .endif
@@ -354,7 +343,7 @@ intvec_\vecname:
 #ifdef __COLLECT_LINKER_FEEDBACK__
         .pushsection .text.intvec_feedback,"ax"
         .org    (\vecnum << 5)
-        FEEDBACK_ENTER_EXPLICIT(intvec_\vecname, .intrpt1, 1 << 8)
+        FEEDBACK_ENTER_EXPLICIT(intvec_\vecname, .intrpt, 1 << 8)
         jrp     lr
         .popsection
 #endif
@@ -468,7 +457,7 @@ intvec_\vecname:
         }
         {
          auli   r21, r21, ha16(__per_cpu_offset)
-         mm     r20, r20, zero, 0, LOG2_THREAD_SIZE-1
+         mm     r20, r20, zero, 0, LOG2_NR_CPU_IDS-1
         }
         s2a     r20, r20, r21
         lw      tp, r20
@@ -562,7 +551,6 @@ intvec_\vecname:
         .endif
         mtspr   INTERRUPT_CRITICAL_SECTION, zero
 
-#if CHIP_HAS_WH64()
         /*
          * Prepare the first 256 stack bytes to be rapidly accessible
          * without having to fetch the background data.  We don't really
@@ -583,7 +571,6 @@ intvec_\vecname:
          addi   r52, r52, -64
         }
         wh64    r52
-#endif
 
 #ifdef CONFIG_TRACE_IRQFLAGS
         .ifnc \function,handle_nmi
@@ -762,7 +749,7 @@ intvec_\vecname:
         .macro  dc_dispatch vecnum, vecname
         .org    (\vecnum << 8)
 intvec_\vecname:
-        j       hv_downcall_dispatch
+        j       _hv_downcall_dispatch
         ENDPROC(intvec_\vecname)
         .endm
 
@@ -812,17 +799,34 @@ STD_ENTRY(interrupt_return)
         }
         lw      r29, r29
         andi    r29, r29, SPR_EX_CONTEXT_1_1__PL_MASK  /* mask off ICS */
+        bzt     r29, .Lresume_userspace
+
+#ifdef CONFIG_PREEMPT
+        /* Returning to kernel space. Check if we need preemption. */
+        GET_THREAD_INFO(r29)
+        addli   r28, r29, THREAD_INFO_FLAGS_OFFSET
         {
-         bzt    r29, .Lresume_userspace
-         PTREGS_PTR(r29, PTREGS_OFFSET_PC)
+         lw     r28, r28
+         addli  r29, r29, THREAD_INFO_PREEMPT_COUNT_OFFSET
         }
+        {
+         andi   r28, r28, _TIF_NEED_RESCHED
+         lw     r29, r29
+        }
+        bzt     r28, 1f
+        bnz     r29, 1f
+        jal     preempt_schedule_irq
+        FEEDBACK_REENTER(interrupt_return)
+1:
+#endif
 
         /* If we're resuming to _cpu_idle_nap, bump PC forward by 8. */
         {
-         lw     r28, r29
+         PTREGS_PTR(r29, PTREGS_OFFSET_PC)
          moveli r27, lo16(_cpu_idle_nap)
         }
         {
+         lw     r28, r29
          auli   r27, r27, ha16(_cpu_idle_nap)
         }
         {
@@ -1420,7 +1424,6 @@ handle_ill:
         {
          lw     r0, r0          /* indirect thru thread_info to get task_info*/
          addi   r1, sp, C_ABI_SAVE_AREA_SIZE  /* put ptregs pointer into r1 */
-         move   r2, zero        /* load error code into r2 */
         }
 
         jal     send_sigtrap    /* issue a SIGTRAP */
@@ -1518,12 +1521,10 @@ STD_ENTRY(_sys_clone)
         __HEAD
         .align 64
         /* Align much later jump on the start of a cache line. */
-#if !ATOMIC_LOCKS_FOUND_VIA_TABLE()
         nop
 #if PAGE_SIZE >= 0x10000
         nop
 #endif
-#endif
 ENTRY(sys_cmpxchg)
 
         /*
@@ -1557,45 +1558,6 @@ ENTRY(sys_cmpxchg)
 # error Code here assumes PAGE_OFFSET can be loaded with just hi16()
 #endif
 
-#if ATOMIC_LOCKS_FOUND_VIA_TABLE()
-        {
-         /* Check for unaligned input. */
-         bnz    sp, .Lcmpxchg_badaddr
-         mm     r25, r0, zero, 3, PAGE_SHIFT-1
-        }
-        {
-         crc32_32 r25, zero, r25
-         moveli r21, lo16(atomic_lock_ptr)
-        }
-        {
-         auli   r21, r21, ha16(atomic_lock_ptr)
-         auli   r23, zero, hi16(PAGE_OFFSET)  /* hugepage-aligned */
-        }
-        {
-         shri   r20, r25, 32 - ATOMIC_HASH_L1_SHIFT
-         slt_u  r23, r0, r23
-         lw     r26, r0  /* see comment in the "#else" for the "lw r26". */
-        }
-        {
-         s2a    r21, r20, r21
-         bbns   r23, .Lcmpxchg_badaddr
-        }
-        {
-         lw     r21, r21
-         seqi   r23, TREG_SYSCALL_NR_NAME, __NR_FAST_cmpxchg64
-         andi   r25, r25, ATOMIC_HASH_L2_SIZE - 1
-        }
-        {
-         /* Branch away at this point if we're doing a 64-bit cmpxchg. */
-         bbs    r23, .Lcmpxchg64
-         andi   r23, r0, 7       /* Precompute alignment for cmpxchg64. */
-        }
-        {
-         s2a    ATOMIC_LOCK_REG_NAME, r25, r21
-         j      .Lcmpxchg32_tns   /* see comment in the #else for the jump. */
-        }
-
-#else /* ATOMIC_LOCKS_FOUND_VIA_TABLE() */
         {
          /* Check for unaligned input. */
          bnz    sp, .Lcmpxchg_badaddr
@@ -1609,7 +1571,7 @@ ENTRY(sys_cmpxchg)
           * Because of C pointer arithmetic, we want to compute this:
           *
           * ((char*)atomic_locks +
-          *  (((r0 >> 3) & (1 << (ATOMIC_HASH_SIZE - 1))) << 2))
+          *  (((r0 >> 3) & ((1 << ATOMIC_HASH_SHIFT) - 1)) << 2))
           *
           * Instead of two shifts we just ">> 1", and use 'mm'
           * to ignore the low and high bits we don't want.
@@ -1620,12 +1582,9 @@ ENTRY(sys_cmpxchg)
 
          /*
           * Ensure that the TLB is loaded before we take out the lock.
-          * On tilepro, this will start fetching the value all the way
-          * into our L1 as well (and if it gets modified before we
-          * grab the lock, it will be invalidated from our cache
-          * before we reload it).  On tile64, we'll start fetching it
-          * into our L1 if we're the home, and if we're not, we'll
-          * still at least start fetching it into the home's L2.
+          * This will start fetching the value all the way into our L1
+          * as well (and if it gets modified before we grab the lock,
+          * it will be invalidated from our cache before we reload it).
           */
          lw     r26, r0
         }
@@ -1668,8 +1627,6 @@ ENTRY(sys_cmpxchg)
          j      .Lcmpxchg32_tns
         }
 
-#endif /* ATOMIC_LOCKS_FOUND_VIA_TABLE() */
-
 /* Symbol for do_page_fault_ics() to use to compare against the PC. */
 .global __sys_cmpxchg_grab_lock
 __sys_cmpxchg_grab_lock:
@@ -1807,9 +1764,6 @@ __sys_cmpxchg_grab_lock:
         .align 64
 .Lcmpxchg64:
         {
-#if ATOMIC_LOCKS_FOUND_VIA_TABLE()
-         s2a    ATOMIC_LOCK_REG_NAME, r25, r21
-#endif
          bzt     r23, .Lcmpxchg64_tns
         }
         j       .Lcmpxchg_badaddr
@@ -1875,8 +1829,8 @@ int_unalign:
         push_extra_callee_saves r0
         j       do_trap
 
-/* Include .intrpt1 array of interrupt vectors */
-        .section ".intrpt1", "ax"
+/* Include .intrpt array of interrupt vectors */
+        .section ".intrpt", "ax"
 
 #define op_handle_perf_interrupt bad_intr
 #define op_handle_aux_perf_interrupt bad_intr
@@ -1944,10 +1898,8 @@ int_unalign:
                      do_page_fault
         int_hand     INT_SN_CPL, SN_CPL, bad_intr
         int_hand     INT_DOUBLE_FAULT, DOUBLE_FAULT, do_trap
-#if CHIP_HAS_AUX_PERF_COUNTERS()
         int_hand     INT_AUX_PERF_COUNT, AUX_PERF_COUNT, \
                      op_handle_aux_perf_interrupt, handle_nmi
-#endif
 
         /* Synthetic interrupt delivered only by the simulator */
         int_hand     INT_BREAKPOINT, BREAKPOINT, do_breakpoint
diff --git a/arch/tile/kernel/intvec_64.S b/arch/tile/kernel/intvec_64.S
index 85d483957027..ec755d3f3734 100644
--- a/arch/tile/kernel/intvec_64.S
+++ b/arch/tile/kernel/intvec_64.S
@@ -17,25 +17,33 @@
 #include <linux/linkage.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
+#include <linux/init.h>
 #include <asm/ptrace.h>
 #include <asm/thread_info.h>
 #include <asm/irqflags.h>
 #include <asm/asm-offsets.h>
 #include <asm/types.h>
+#include <asm/traps.h>
 #include <asm/signal.h>
 #include <hv/hypervisor.h>
 #include <arch/abi.h>
 #include <arch/interrupts.h>
 #include <arch/spr_def.h>
 
-#ifdef CONFIG_PREEMPT
-# error "No support for kernel preemption currently"
-#endif
-
 #define PTREGS_PTR(reg, ptreg) addli reg, sp, C_ABI_SAVE_AREA_SIZE + (ptreg)
 
 #define PTREGS_OFFSET_SYSCALL PTREGS_OFFSET_REG(TREG_SYSCALL_NR)
 
+#if CONFIG_KERNEL_PL == 1 || CONFIG_KERNEL_PL == 2
+/*
+ * Set "result" non-zero if ex1 holds the PL of the kernel
+ * (with or without ICS being set).  Note this works only
+ * because we never find the PL at level 3.
+ */
+# define IS_KERNEL_EX1(result, ex1) andi result, ex1, CONFIG_KERNEL_PL
+#else
+# error Recode IS_KERNEL_EX1 for CONFIG_KERNEL_PL
+#endif
 
         .macro  push_reg reg, ptr=sp, delta=-8
         {
@@ -98,6 +106,185 @@
         }
         .endm
 
+        /*
+         * Unalign data exception fast handling: In order to handle
+         * unaligned data access, a fast JIT version is generated and stored
+         * in a specific area in user space. We first need to do a quick poke
+         * to see if the JIT is available. We use certain bits in the fault
+         * PC (3 to 9 is used for 16KB page size) as index to address the JIT
+         * code area. The first 64bit word is the fault PC, and the 2nd one is
+         * the fault bundle itself. If these 2 words both match, then we
+         * directly "iret" to JIT code. If not, a slow path is invoked to
+         * generate new JIT code. Note: the current JIT code WILL be
+         * overwritten if it existed. So, ideally we can handle 128 unalign
+         * fixups via JIT. For lookup efficiency and to effectively support
+         * tight loops with multiple unaligned reference, a simple
+         * direct-mapped cache is used.
+         *
+         * SPR_EX_CONTEXT_K_0 is modified to return to JIT code.
+         * SPR_EX_CONTEXT_K_1 has ICS set.
+         * SPR_EX_CONTEXT_0_0 is setup to user program's next PC.
+         * SPR_EX_CONTEXT_0_1 = 0.
+         */
+        .macro int_hand_unalign_fast  vecnum, vecname
+        .org  (\vecnum << 8)
+intvec_\vecname:
+        /* Put r3 in SPR_SYSTEM_SAVE_K_1.  */
+        mtspr   SPR_SYSTEM_SAVE_K_1, r3
+
+        mfspr   r3, SPR_EX_CONTEXT_K_1
+        /*
+         * Examine if exception comes from user without ICS set.
+         * If not, just go directly to the slow path.
+         */
+        bnez    r3, hand_unalign_slow_nonuser
+
+        mfspr   r3, SPR_SYSTEM_SAVE_K_0
+
+        /* Get &thread_info->unalign_jit_tmp[0] in r3. */
+        bfexts  r3, r3, 0, CPU_SHIFT-1
+        mm      r3, zero, LOG2_THREAD_SIZE, 63
+        addli   r3, r3, THREAD_INFO_UNALIGN_JIT_TMP_OFFSET
+
+        /*
+         * Save r0, r1, r2 into thread_info array r3 points to
+         * from low to high memory in order.
+         */
+        st_add  r3, r0, 8
+        st_add  r3, r1, 8
+        {
+         st_add r3, r2, 8
+         andi   r2, sp, 7
+        }
+
+        /* Save stored r3 value so we can revert it on a page fault. */
+        mfspr   r1, SPR_SYSTEM_SAVE_K_1
+        st      r3, r1
+
+        {
+         /* Generate a SIGBUS if sp is not 8-byte aligned. */
+         bnez   r2, hand_unalign_slow_badsp
+        }
+
+        /*
+         * Get the thread_info in r0; load r1 with pc. Set the low bit of sp
+         * as an indicator to the page fault code in case we fault.
+         */
+        {
+         ori    sp, sp, 1
+         mfspr  r1, SPR_EX_CONTEXT_K_0
+        }
+
+        /* Add the jit_info offset in thread_info; extract r1 [3:9] into r2. */
+        {
+         addli  r0, r3, THREAD_INFO_UNALIGN_JIT_BASE_OFFSET - \
+          (THREAD_INFO_UNALIGN_JIT_TMP_OFFSET + (3 * 8))
+         bfextu r2, r1, 3, (2 + PAGE_SHIFT - UNALIGN_JIT_SHIFT)
+        }
+
+        /* Load the jit_info; multiply r2 by 128. */
+        {
+         ld     r0, r0
+         shli   r2, r2, UNALIGN_JIT_SHIFT
+        }
+
+        /*
+         * If r0 is NULL, the JIT page is not mapped, so go to slow path;
+         * add offset r2 to r0 at the same time.
+         */
+        {
+         beqz   r0, hand_unalign_slow
+         add    r2, r0, r2
+        }
+
+        /*
+         * We are loading from userspace (both the JIT info PC and
+         * instruction word, and the instruction word we executed)
+         * and since either could fault while holding the interrupt
+         * critical section, we must tag this region and check it in
+         * do_page_fault() to handle it properly.
+         */
+ENTRY(__start_unalign_asm_code)
+
+        /* Load first word of JIT in r0 and increment r2 by 8. */
+        ld_add  r0, r2, 8
+
+        /*
+         * Compare the PC with the 1st word in JIT; load the fault bundle
+         * into r1.
+         */
+        {
+         cmpeq  r0, r0, r1
+         ld     r1, r1
+        }
+
+        /* Go to slow path if PC doesn't match. */
+        beqz    r0, hand_unalign_slow
+
+        /*
+         * Load the 2nd word of JIT, which is supposed to be the fault
+         * bundle for a cache hit. Increment r2; after this bundle r2 will
+         * point to the potential start of the JIT code we want to run.
+         */
+        ld_add  r0, r2, 8
+
+        /* No further accesses to userspace are done after this point. */
+ENTRY(__end_unalign_asm_code)
+
+        /* Compare the real bundle with what is saved in the JIT area. */
+        {
+         cmpeq  r0, r1, r0
+         mtspr  SPR_EX_CONTEXT_0_1, zero
+        }
+
+        /* Go to slow path if the fault bundle does not match. */
+        beqz    r0, hand_unalign_slow
+
+        /*
+         * A cache hit is found.
+         * r2 points to start of JIT code (3rd word).
+         * r0 is the fault pc.
+         * r1 is the fault bundle.
+         * Reset the low bit of sp.
+         */
+        {
+         mfspr  r0, SPR_EX_CONTEXT_K_0
+         andi   sp, sp, ~1
+        }
+
+        /* Write r2 into EX_CONTEXT_K_0 and increment PC. */
+        {
+         mtspr  SPR_EX_CONTEXT_K_0, r2
+         addi   r0, r0, 8
+        }
+
+        /*
+         * Set ICS on kernel EX_CONTEXT_K_1 in order to "iret" to
+         * user with ICS set. This way, if the JIT fixup causes another
+         * unalign exception (which shouldn't be possible) the user
+         * process will be terminated with SIGBUS. Also, our fixup will
+         * run without interleaving with external interrupts.
+         * Each fixup is at most 14 bundles, so it won't hold ICS for long.
+         */
+        {
+         movei  r1, PL_ICS_EX1(USER_PL, 1)
+         mtspr  SPR_EX_CONTEXT_0_0, r0
+        }
+
+        {
+         mtspr  SPR_EX_CONTEXT_K_1, r1
+         addi   r3, r3, -(3 * 8)
+        }
+
+        /* Restore r0..r3. */
+        ld_add  r0, r3, 8
+        ld_add  r1, r3, 8
+        ld_add  r2, r3, 8
+        ld      r3, r3
+
+        iret
+        ENDPROC(intvec_\vecname)
+        .endm
 
 #ifdef __COLLECT_LINKER_FEEDBACK__
         .pushsection .text.intvec_feedback,"ax"
@@ -118,15 +305,21 @@ intvec_feedback:
          * The "processing" argument specifies the code for processing
          * the interrupt. Defaults to "handle_interrupt".
          */
-        .macro  int_hand vecnum, vecname, c_routine, processing=handle_interrupt
-        .org    (\vecnum << 8)
+        .macro __int_hand vecnum, vecname, c_routine,processing=handle_interrupt
 intvec_\vecname:
         /* Temporarily save a register so we have somewhere to work. */
 
         mtspr   SPR_SYSTEM_SAVE_K_1, r0
         mfspr   r0, SPR_EX_CONTEXT_K_1
 
-        andi    r0, r0, SPR_EX_CONTEXT_1_1__PL_MASK  /* mask off ICS */
+        /*
+         * The unalign data fastpath code sets the low bit in sp to
+         * force us to reset it here on fault.
+         */
+        {
+         blbs   sp, 2f
+         IS_KERNEL_EX1(r0, r0)
+        }
 
         .ifc    \vecnum, INT_DOUBLE_FAULT
         /*
@@ -176,15 +369,15 @@ intvec_\vecname:
         }
         .endif
 
-
+2:
         /*
-         * SYSTEM_SAVE_K_0 holds the cpu number in the low bits, and
-         * the current stack top in the higher bits.  So we recover
-         * our stack top by just masking off the low bits, then
+         * SYSTEM_SAVE_K_0 holds the cpu number in the high bits, and
+         * the current stack top in the lower bits.  So we recover
+         * our starting stack value by sign-extending the low bits, then
          * point sp at the top aligned address on the actual stack page.
          */
         mfspr   r0, SPR_SYSTEM_SAVE_K_0
-        mm      r0, zero, LOG2_THREAD_SIZE, 63
+        bfexts  r0, r0, 0, CPU_SHIFT-1
 
 0:
         /*
@@ -206,6 +399,9 @@ intvec_\vecname:
          *    cache line 1: r6...r13
          *    cache line 0: 2 x frame, r0..r5
          */
+#if STACK_TOP_DELTA != 64
+#error STACK_TOP_DELTA must be 64 for assumptions here and in task_pt_regs()
+#endif
         andi    r0, r0, -64
 
         /*
@@ -305,7 +501,7 @@ intvec_\vecname:
         mfspr   r3, SPR_SYSTEM_SAVE_K_2   /* info about page fault */
         .else
         .ifc \vecnum, INT_ILL_TRANS
-        mfspr   r2, ILL_TRANS_REASON
+        mfspr   r2, ILL_VA_PC
         .else
         .ifc \vecnum, INT_DOUBLE_FAULT
         mfspr   r2, SPR_SYSTEM_SAVE_K_2   /* double fault info from HV */
@@ -315,12 +511,10 @@ intvec_\vecname:
         .else
         .ifc \c_routine, op_handle_perf_interrupt
         mfspr   r2, PERF_COUNT_STS
-#if CHIP_HAS_AUX_PERF_COUNTERS()
         .else
         .ifc \c_routine, op_handle_aux_perf_interrupt
         mfspr   r2, AUX_PERF_COUNT_STS
         .endif
-#endif
         .endif
         .endif
         .endif
@@ -339,7 +533,7 @@ intvec_\vecname:
 #ifdef __COLLECT_LINKER_FEEDBACK__
         .pushsection .text.intvec_feedback,"ax"
         .org    (\vecnum << 5)
-        FEEDBACK_ENTER_EXPLICIT(intvec_\vecname, .intrpt1, 1 << 8)
+        FEEDBACK_ENTER_EXPLICIT(intvec_\vecname, .intrpt, 1 << 8)
         jrp     lr
         .popsection
 #endif
@@ -455,11 +649,12 @@ intvec_\vecname:
         /*
          * If we will be returning to the kernel, we will need to
          * reset the interrupt masks to the state they had before.
-         * Set DISABLE_IRQ in flags iff we came from PL1 with irqs disabled.
+         * Set DISABLE_IRQ in flags iff we came from kernel pl with
+         * irqs disabled.
          */
         mfspr   r32, SPR_EX_CONTEXT_K_1
         {
-         andi   r32, r32, SPR_EX_CONTEXT_1_1__PL_MASK  /* mask off ICS */
+         IS_KERNEL_EX1(r22, r22)
          PTREGS_PTR(r21, PTREGS_OFFSET_FLAGS)
         }
         beqzt   r32, 1f       /* zero if from user space */
@@ -503,7 +698,7 @@ intvec_\vecname:
         }
         {
          shl16insli r21, r21, hw1(__per_cpu_offset)
-         bfextu r20, r20, 0, LOG2_THREAD_SIZE-1
+         bfextu r20, r20, CPU_SHIFT, 63
         }
         shl16insli r21, r21, hw0(__per_cpu_offset)
         shl3add r20, r20, r21
@@ -585,7 +780,7 @@ intvec_\vecname:
         .macro  dc_dispatch vecnum, vecname
         .org    (\vecnum << 8)
 intvec_\vecname:
-        j       hv_downcall_dispatch
+        j       _hv_downcall_dispatch
         ENDPROC(intvec_\vecname)
         .endm
 
@@ -626,14 +821,36 @@ STD_ENTRY(interrupt_return)
          PTREGS_PTR(r29, PTREGS_OFFSET_EX1)
         }
         ld      r29, r29
-        andi    r29, r29, SPR_EX_CONTEXT_1_1__PL_MASK  /* mask off ICS */
+        IS_KERNEL_EX1(r29, r29)
         {
          beqzt  r29, .Lresume_userspace
-         PTREGS_PTR(r29, PTREGS_OFFSET_PC)
+         move   r29, sp
+        }
+
+#ifdef CONFIG_PREEMPT
+        /* Returning to kernel space. Check if we need preemption. */
+        EXTRACT_THREAD_INFO(r29)
+        addli   r28, r29, THREAD_INFO_FLAGS_OFFSET
+        {
+         ld     r28, r28
+         addli  r29, r29, THREAD_INFO_PREEMPT_COUNT_OFFSET
+        }
+        {
+         andi   r28, r28, _TIF_NEED_RESCHED
+         ld4s   r29, r29
         }
+        beqzt   r28, 1f
+        bnez    r29, 1f
+        jal     preempt_schedule_irq
+        FEEDBACK_REENTER(interrupt_return)
+1:
+#endif
 
         /* If we're resuming to _cpu_idle_nap, bump PC forward by 8. */
-        moveli  r27, hw2_last(_cpu_idle_nap)
+        {
+         moveli r27, hw2_last(_cpu_idle_nap)
+         PTREGS_PTR(r29, PTREGS_OFFSET_PC)
+        }
         {
          ld     r28, r29
          shl16insli r27, r27, hw1(_cpu_idle_nap)
@@ -728,7 +945,7 @@ STD_ENTRY(interrupt_return)
          PTREGS_PTR(r32, PTREGS_OFFSET_FLAGS)
         }
         {
-         andi   r0, r0, SPR_EX_CONTEXT_1_1__PL_MASK
+         IS_KERNEL_EX1(r0, r0)
          ld     r32, r32
         }
         bnez    r0, 1f
@@ -799,7 +1016,7 @@ STD_ENTRY(interrupt_return)
         pop_reg r21, sp, PTREGS_OFFSET_REG(31) - PTREGS_OFFSET_PC
         {
          mtspr  SPR_EX_CONTEXT_K_1, lr
-         andi   lr, lr, SPR_EX_CONTEXT_1_1__PL_MASK  /* mask off ICS */
+         IS_KERNEL_EX1(lr, lr)
         }
         {
          mtspr  SPR_EX_CONTEXT_K_0, r21
@@ -1223,10 +1440,31 @@ STD_ENTRY(_sys_clone)
         j       sys_clone
         STD_ENDPROC(_sys_clone)
 
-/* The single-step support may need to read all the registers. */
+        /*
+         * Recover r3, r2, r1 and r0 here saved by unalign fast vector.
+         * The vector area limit is 32 bundles, so we handle the reload here.
+         * r0, r1, r2 are in thread_info from low to high memory in order.
+         * r3 points to location the original r3 was saved.
+         * We put this code in the __HEAD section so it can be reached
+         * via a conditional branch from the fast path.
+         */
+        __HEAD
+hand_unalign_slow:
+        andi    sp, sp, ~1
+hand_unalign_slow_badsp:
+        addi    r3, r3, -(3 * 8)
+        ld_add  r0, r3, 8
+        ld_add  r1, r3, 8
+        ld      r2, r3
+hand_unalign_slow_nonuser:
+        mfspr   r3, SPR_SYSTEM_SAVE_K_1
+        __int_hand     INT_UNALIGN_DATA, UNALIGN_DATA_SLOW, int_unalign
+
+/* The unaligned data support needs to read all the registers. */
 int_unalign:
         push_extra_callee_saves r0
-        j       do_trap
+        j       do_unaligned
+ENDPROC(hand_unalign_slow)
 
 /* Fill the return address stack with nonzero entries. */
 STD_ENTRY(fill_ra_stack)
@@ -1240,8 +1478,15 @@ STD_ENTRY(fill_ra_stack)
 4:      jrp     r0
         STD_ENDPROC(fill_ra_stack)
 
-/* Include .intrpt1 array of interrupt vectors */
-        .section ".intrpt1", "ax"
+        .macro int_hand  vecnum, vecname, c_routine, processing=handle_interrupt
+        .org   (\vecnum << 8)
+                __int_hand   \vecnum, \vecname, \c_routine, \processing
+        .endm
+
+/* Include .intrpt array of interrupt vectors */
+        .section ".intrpt", "ax"
+        .global intrpt_start
+intrpt_start:
 
 #define op_handle_perf_interrupt bad_intr
 #define op_handle_aux_perf_interrupt bad_intr
@@ -1272,7 +1517,7 @@ STD_ENTRY(fill_ra_stack)
         int_hand     INT_SWINT_1, SWINT_1, SYSCALL, handle_syscall
         int_hand     INT_SWINT_0, SWINT_0, do_trap
         int_hand     INT_ILL_TRANS, ILL_TRANS, do_trap
-        int_hand     INT_UNALIGN_DATA, UNALIGN_DATA, int_unalign
+        int_hand_unalign_fast INT_UNALIGN_DATA, UNALIGN_DATA
         int_hand     INT_DTLB_MISS, DTLB_MISS, do_page_fault
         int_hand     INT_DTLB_ACCESS, DTLB_ACCESS, do_page_fault
         int_hand     INT_IDN_FIREWALL, IDN_FIREWALL, do_hardwall_trap
diff --git a/arch/tile/kernel/irq.c b/arch/tile/kernel/irq.c
index 3ccf2cd7182e..0586fdb9352d 100644
--- a/arch/tile/kernel/irq.c
+++ b/arch/tile/kernel/irq.c
@@ -55,7 +55,8 @@ static DEFINE_PER_CPU(int, irq_depth);
 
 /* State for allocating IRQs on Gx. */
 #if CHIP_HAS_IPI()
-static unsigned long available_irqs = ~(1UL << IRQ_RESCHEDULE);
+static unsigned long available_irqs = ((1UL << NR_IRQS) - 1) &
+                                      (~(1UL << IRQ_RESCHEDULE));
 static DEFINE_SPINLOCK(available_irqs_lock);
 #endif
 
@@ -73,7 +74,8 @@ static DEFINE_SPINLOCK(available_irqs_lock);
 
 /*
  * The interrupt handling path, implemented in terms of HV interrupt
- * emulation on TILE64 and TILEPro, and IPI hardware on TILE-Gx.
+ * emulation on TILEPro, and IPI hardware on TILE-Gx.
+ * Entered with interrupts disabled.
  */
 void tile_dev_intr(struct pt_regs *regs, int intnum)
 {
@@ -233,7 +235,7 @@ void tile_irq_activate(unsigned int irq, int tile_irq_type)
 {
         /*
          * We use handle_level_irq() by default because the pending
-         * interrupt vector (whether modeled by the HV on TILE64 and
+         * interrupt vector (whether modeled by the HV on
          * TILEPro or implemented in hardware on TILE-Gx) has
          * level-style semantics for each bit.  An interrupt fires
          * whenever a bit is high, not just at edges.
diff --git a/arch/tile/kernel/kgdb.c b/arch/tile/kernel/kgdb.c
new file mode 100644
index 000000000000..4cd88381a83e
--- /dev/null
+++ b/arch/tile/kernel/kgdb.c
@@ -0,0 +1,499 @@
+/*
+ * Copyright 2013 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ *
+ * TILE-Gx KGDB support.
+ */
+
+#include <linux/ptrace.h>
+#include <linux/kgdb.h>
+#include <linux/kdebug.h>
+#include <linux/uaccess.h>
+#include <linux/module.h>
+#include <asm/cacheflush.h>
+
+static tile_bundle_bits singlestep_insn = TILEGX_BPT_BUNDLE | DIE_SSTEPBP;
+static unsigned long stepped_addr;
+static tile_bundle_bits stepped_instr;
+
+struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
+        { "r0", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[0])},
+        { "r1", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[1])},
+        { "r2", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[2])},
+        { "r3", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[3])},
+        { "r4", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[4])},
+        { "r5", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[5])},
+        { "r6", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[6])},
+        { "r7", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[7])},
+        { "r8", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[8])},
+        { "r9", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[9])},
+        { "r10", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[10])},
+        { "r11", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[11])},
+        { "r12", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[12])},
+        { "r13", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[13])},
+        { "r14", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[14])},
+        { "r15", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[15])},
+        { "r16", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[16])},
+        { "r17", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[17])},
+        { "r18", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[18])},
+        { "r19", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[19])},
+        { "r20", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[20])},
+        { "r21", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[21])},
+        { "r22", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[22])},
+        { "r23", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[23])},
+        { "r24", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[24])},
+        { "r25", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[25])},
+        { "r26", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[26])},
+        { "r27", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[27])},
+        { "r28", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[28])},
+        { "r29", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[29])},
+        { "r30", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[30])},
+        { "r31", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[31])},
+        { "r32", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[32])},
+        { "r33", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[33])},
+        { "r34", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[34])},
+        { "r35", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[35])},
+        { "r36", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[36])},
+        { "r37", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[37])},
+        { "r38", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[38])},
+        { "r39", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[39])},
+        { "r40", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[40])},
+        { "r41", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[41])},
+        { "r42", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[42])},
+        { "r43", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[43])},
+        { "r44", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[44])},
+        { "r45", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[45])},
+        { "r46", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[46])},
+        { "r47", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[47])},
+        { "r48", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[48])},
+        { "r49", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[49])},
+        { "r50", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[50])},
+        { "r51", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[51])},
+        { "r52", GDB_SIZEOF_REG, offsetof(struct pt_regs, regs[52])},
+        { "tp", GDB_SIZEOF_REG, offsetof(struct pt_regs, tp)},
+        { "sp", GDB_SIZEOF_REG, offsetof(struct pt_regs, sp)},
+        { "lr", GDB_SIZEOF_REG, offsetof(struct pt_regs, lr)},
+        { "sn", GDB_SIZEOF_REG, -1},
+        { "idn0", GDB_SIZEOF_REG, -1},
+        { "idn1", GDB_SIZEOF_REG, -1},
+        { "udn0", GDB_SIZEOF_REG, -1},
+        { "udn1", GDB_SIZEOF_REG, -1},
+        { "udn2", GDB_SIZEOF_REG, -1},
+        { "udn3", GDB_SIZEOF_REG, -1},
+        { "zero", GDB_SIZEOF_REG, -1},
+        { "pc", GDB_SIZEOF_REG, offsetof(struct pt_regs, pc)},
+        { "faultnum", GDB_SIZEOF_REG, offsetof(struct pt_regs, faultnum)},
+};
+
+char *dbg_get_reg(int regno, void *mem, struct pt_regs *regs)
+{
+        if (regno >= DBG_MAX_REG_NUM || regno < 0)
+                return NULL;
+
+        if (dbg_reg_def[regno].offset != -1)
+                memcpy(mem, (void *)regs + dbg_reg_def[regno].offset,
+                       dbg_reg_def[regno].size);
+        else
+                memset(mem, 0, dbg_reg_def[regno].size);
+        return dbg_reg_def[regno].name;
+}
+
+int dbg_set_reg(int regno, void *mem, struct pt_regs *regs)
+{
+        if (regno >= DBG_MAX_REG_NUM || regno < 0)
+                return -EINVAL;
+
+        if (dbg_reg_def[regno].offset != -1)
+                memcpy((void *)regs + dbg_reg_def[regno].offset, mem,
+                       dbg_reg_def[regno].size);
+        return 0;
+}
+
+/*
+ * Similar to pt_regs_to_gdb_regs() except that process is sleeping and so
+ * we may not be able to get all the info.
+ */
+void
+sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
+{
+        int reg;
+        struct pt_regs *thread_regs;
+        unsigned long *ptr = gdb_regs;
+
+        if (task == NULL)
+                return;
+
+        /* Initialize to zero. */
+        memset(gdb_regs, 0, NUMREGBYTES);
+
+        thread_regs = task_pt_regs(task);
+        for (reg = 0; reg <= TREG_LAST_GPR; reg++)
+                *(ptr++) = thread_regs->regs[reg];
+
+        gdb_regs[TILEGX_PC_REGNUM] = thread_regs->pc;
+        gdb_regs[TILEGX_FAULTNUM_REGNUM] = thread_regs->faultnum;
+}
+
+void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long pc)
+{
+        regs->pc = pc;
+}
+
+static void kgdb_call_nmi_hook(void *ignored)
+{
+        kgdb_nmicallback(raw_smp_processor_id(), NULL);
+}
+
+void kgdb_roundup_cpus(unsigned long flags)
+{
+        local_irq_enable();
+        smp_call_function(kgdb_call_nmi_hook, NULL, 0);
+        local_irq_disable();
+}
+
+/*
+ * Convert a kernel address to the writable kernel text mapping.
+ */
+static unsigned long writable_address(unsigned long addr)
+{
+        unsigned long ret = 0;
+
+        if (core_kernel_text(addr))
+                ret = addr - MEM_SV_START + PAGE_OFFSET;
+        else if (is_module_text_address(addr))
+                ret = addr;
+        else
+                pr_err("Unknown virtual address 0x%lx\n", addr);
+
+        return ret;
+}
+
+/*
+ * Calculate the new address for after a step.
+ */
+static unsigned long get_step_address(struct pt_regs *regs)
+{
+        int src_reg;
+        int jump_off;
+        int br_off;
+        unsigned long addr;
+        unsigned int opcode;
+        tile_bundle_bits bundle;
+
+        /* Move to the next instruction by default. */
+        addr = regs->pc + TILEGX_BUNDLE_SIZE_IN_BYTES;
+        bundle = *(unsigned long *)instruction_pointer(regs);
+
+        /* 0: X mode, Otherwise: Y mode. */
+        if (bundle & TILEGX_BUNDLE_MODE_MASK) {
+                if (get_Opcode_Y1(bundle) == RRR_1_OPCODE_Y1 &&
+                    get_RRROpcodeExtension_Y1(bundle) ==
+                    UNARY_RRR_1_OPCODE_Y1) {
+                        opcode = get_UnaryOpcodeExtension_Y1(bundle);
+
+                        switch (opcode) {
+                        case JALR_UNARY_OPCODE_Y1:
+                        case JALRP_UNARY_OPCODE_Y1:
+                        case JR_UNARY_OPCODE_Y1:
+                        case JRP_UNARY_OPCODE_Y1:
+                                src_reg = get_SrcA_Y1(bundle);
+                                dbg_get_reg(src_reg, &addr, regs);
+                                break;
+                        }
+                }
+        } else if (get_Opcode_X1(bundle) == RRR_0_OPCODE_X1) {
+                if (get_RRROpcodeExtension_X1(bundle) ==
+                    UNARY_RRR_0_OPCODE_X1) {
+                        opcode = get_UnaryOpcodeExtension_X1(bundle);
+
+                        switch (opcode) {
+                        case JALR_UNARY_OPCODE_X1:
+                        case JALRP_UNARY_OPCODE_X1:
+                        case JR_UNARY_OPCODE_X1:
+                        case JRP_UNARY_OPCODE_X1:
+                                src_reg = get_SrcA_X1(bundle);
+                                dbg_get_reg(src_reg, &addr, regs);
+                                break;
+                        }
+                }
+        } else if (get_Opcode_X1(bundle) == JUMP_OPCODE_X1) {
+                opcode = get_JumpOpcodeExtension_X1(bundle);
+
+                switch (opcode) {
+                case JAL_JUMP_OPCODE_X1:
+                case J_JUMP_OPCODE_X1:
+                        jump_off = sign_extend(get_JumpOff_X1(bundle), 27);
+                        addr = regs->pc +
+                                (jump_off << TILEGX_LOG2_BUNDLE_SIZE_IN_BYTES);
+                        break;
+                }
+        } else if (get_Opcode_X1(bundle) == BRANCH_OPCODE_X1) {
+                br_off = 0;
+                opcode = get_BrType_X1(bundle);
+
+                switch (opcode) {
+                case BEQZT_BRANCH_OPCODE_X1:
+                case BEQZ_BRANCH_OPCODE_X1:
+                        if (get_SrcA_X1(bundle) == 0)
+                                br_off = get_BrOff_X1(bundle);
+                        break;
+                case BGEZT_BRANCH_OPCODE_X1:
+                case BGEZ_BRANCH_OPCODE_X1:
+                        if (get_SrcA_X1(bundle) >= 0)
+                                br_off = get_BrOff_X1(bundle);
+                        break;
+                case BGTZT_BRANCH_OPCODE_X1:
+                case BGTZ_BRANCH_OPCODE_X1:
+                        if (get_SrcA_X1(bundle) > 0)
+                                br_off = get_BrOff_X1(bundle);
+                        break;
+                case BLBCT_BRANCH_OPCODE_X1:
+                case BLBC_BRANCH_OPCODE_X1:
+                        if (!(get_SrcA_X1(bundle) & 1))
+                                br_off = get_BrOff_X1(bundle);
+                        break;
+                case BLBST_BRANCH_OPCODE_X1:
+                case BLBS_BRANCH_OPCODE_X1:
+                        if (get_SrcA_X1(bundle) & 1)
+                                br_off = get_BrOff_X1(bundle);
+                        break;
+                case BLEZT_BRANCH_OPCODE_X1:
+                case BLEZ_BRANCH_OPCODE_X1:
+                        if (get_SrcA_X1(bundle) <= 0)
+                                br_off = get_BrOff_X1(bundle);
+                        break;
+                case BLTZT_BRANCH_OPCODE_X1:
+                case BLTZ_BRANCH_OPCODE_X1:
+                        if (get_SrcA_X1(bundle) < 0)
+                                br_off = get_BrOff_X1(bundle);
+                        break;
+                case BNEZT_BRANCH_OPCODE_X1:
+                case BNEZ_BRANCH_OPCODE_X1:
+                        if (get_SrcA_X1(bundle) != 0)
+                                br_off = get_BrOff_X1(bundle);
+                        break;
+                }
+
+                if (br_off != 0) {
+                        br_off = sign_extend(br_off, 17);
+                        addr = regs->pc +
+                                (br_off << TILEGX_LOG2_BUNDLE_SIZE_IN_BYTES);
+                }
+        }
+
+        return addr;
+}
+
+/*
+ * Replace the next instruction after the current instruction with a
+ * breakpoint instruction.
+ */
+static void do_single_step(struct pt_regs *regs)
+{
+        unsigned long addr_wr;
+
+        /* Determine where the target instruction will send us to. */
+        stepped_addr = get_step_address(regs);
+        probe_kernel_read((char *)&stepped_instr, (char *)stepped_addr,
+                          BREAK_INSTR_SIZE);
+
+        addr_wr = writable_address(stepped_addr);
+        probe_kernel_write((char *)addr_wr, (char *)&singlestep_insn,
+                           BREAK_INSTR_SIZE);
+        smp_wmb();
+        flush_icache_range(stepped_addr, stepped_addr + BREAK_INSTR_SIZE);
+}
+
+static void undo_single_step(struct pt_regs *regs)
+{
+        unsigned long addr_wr;
+
+        if (stepped_instr == 0)
+                return;
+
+        addr_wr = writable_address(stepped_addr);
+        probe_kernel_write((char *)addr_wr, (char *)&stepped_instr,
+                           BREAK_INSTR_SIZE);
+        stepped_instr = 0;
+        smp_wmb();
+        flush_icache_range(stepped_addr, stepped_addr + BREAK_INSTR_SIZE);
+}
+
+/*
+ * Calls linux_debug_hook before the kernel dies. If KGDB is enabled,
+ * then try to fall into the debugger.
+ */
+static int
+kgdb_notify(struct notifier_block *self, unsigned long cmd, void *ptr)
+{
+        int ret;
+        unsigned long flags;
+        struct die_args *args = (struct die_args *)ptr;
+        struct pt_regs *regs = args->regs;
+
+#ifdef CONFIG_KPROBES
+        /*
+         * Return immediately if the kprobes fault notifier has set
+         * DIE_PAGE_FAULT.
+         */
+        if (cmd == DIE_PAGE_FAULT)
+                return NOTIFY_DONE;
+#endif /* CONFIG_KPROBES */
+
+        switch (cmd) {
+        case DIE_BREAK:
+        case DIE_COMPILED_BPT:
+                break;
+        case DIE_SSTEPBP:
+                local_irq_save(flags);
+                kgdb_handle_exception(0, SIGTRAP, 0, regs);
+                local_irq_restore(flags);
+                return NOTIFY_STOP;
+        default:
+                /* Userspace events, ignore. */
+                if (user_mode(regs))
+                        return NOTIFY_DONE;
+        }
+
+        local_irq_save(flags);
+        ret = kgdb_handle_exception(args->trapnr, args->signr, args->err, regs);
+        local_irq_restore(flags);
+        if (ret)
+                return NOTIFY_DONE;
+
+        return NOTIFY_STOP;
+}
+
+static struct notifier_block kgdb_notifier = {
+        .notifier_call = kgdb_notify,
+};
+
+/*
+ * kgdb_arch_handle_exception - Handle architecture specific GDB packets.
+ * @vector: The error vector of the exception that happened.
+ * @signo: The signal number of the exception that happened.
+ * @err_code: The error code of the exception that happened.
+ * @remcom_in_buffer: The buffer of the packet we have read.
+ * @remcom_out_buffer: The buffer of %BUFMAX bytes to write a packet into.
+ * @regs: The &struct pt_regs of the current process.
+ *
+ * This function MUST handle the 'c' and 's' command packets,
+ * as well packets to set / remove a hardware breakpoint, if used.
+ * If there are additional packets which the hardware needs to handle,
+ * they are handled here. The code should return -1 if it wants to
+ * process more packets, and a %0 or %1 if it wants to exit from the
+ * kgdb callback.
+ */
+int kgdb_arch_handle_exception(int vector, int signo, int err_code,
+                               char *remcom_in_buffer, char *remcom_out_buffer,
+                               struct pt_regs *regs)
+{
+        char *ptr;
+        unsigned long address;
+
+        /* Undo any stepping we may have done. */
+        undo_single_step(regs);
+
+        switch (remcom_in_buffer[0]) {
+        case 'c':
+        case 's':
+        case 'D':
+        case 'k':
+                /*
+                 * Try to read optional parameter, pc unchanged if no parm.
+                 * If this was a compiled-in breakpoint, we need to move
+                 * to the next instruction or we will just breakpoint
+                 * over and over again.
+                 */
+                ptr = &remcom_in_buffer[1];
+                if (kgdb_hex2long(&ptr, &address))
+                        regs->pc = address;
+                else if (*(unsigned long *)regs->pc == compiled_bpt)
+                        regs->pc += BREAK_INSTR_SIZE;
+
+                if (remcom_in_buffer[0] == 's') {
+                        do_single_step(regs);
+                        kgdb_single_step = 1;
+                        atomic_set(&kgdb_cpu_doing_single_step,
+                                   raw_smp_processor_id());
+                } else
+                        atomic_set(&kgdb_cpu_doing_single_step, -1);
+
+                return 0;
+        }
+
+        return -1; /* this means that we do not want to exit from the handler */
+}
+
+struct kgdb_arch arch_kgdb_ops;
+
+/*
+ * kgdb_arch_init - Perform any architecture specific initalization.
+ *
+ * This function will handle the initalization of any architecture
+ * specific callbacks.
+ */
+int kgdb_arch_init(void)
+{
+        tile_bundle_bits bundle = TILEGX_BPT_BUNDLE;
+
+        memcpy(arch_kgdb_ops.gdb_bpt_instr, &bundle, BREAK_INSTR_SIZE);
+        return register_die_notifier(&kgdb_notifier);
+}
+
+/*
+ * kgdb_arch_exit - Perform any architecture specific uninitalization.
+ *
+ * This function will handle the uninitalization of any architecture
+ * specific callbacks, for dynamic registration and unregistration.
+ */
+void kgdb_arch_exit(void)
+{
+        unregister_die_notifier(&kgdb_notifier);
+}
+
+int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
+{
+        int err;
+        unsigned long addr_wr = writable_address(bpt->bpt_addr);
+
+        if (addr_wr == 0)
+                return -1;
+
+        err = probe_kernel_read(bpt->saved_instr, (char *)bpt->bpt_addr,
+                                BREAK_INSTR_SIZE);
+        if (err)
+                return err;
+
+        err = probe_kernel_write((char *)addr_wr, arch_kgdb_ops.gdb_bpt_instr,
+                                 BREAK_INSTR_SIZE);
+        smp_wmb();
+        flush_icache_range((unsigned long)bpt->bpt_addr,
+                           (unsigned long)bpt->bpt_addr + BREAK_INSTR_SIZE);
+        return err;
+}
+
+int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
+{
+        int err;
+        unsigned long addr_wr = writable_address(bpt->bpt_addr);
+
+        if (addr_wr == 0)
+                return -1;
+
+        err = probe_kernel_write((char *)addr_wr, (char *)bpt->saved_instr,
+                                 BREAK_INSTR_SIZE);
+        smp_wmb();
+        flush_icache_range((unsigned long)bpt->bpt_addr,
+                           (unsigned long)bpt->bpt_addr + BREAK_INSTR_SIZE);
+        return err;
+}
diff --git a/arch/tile/kernel/kprobes.c b/arch/tile/kernel/kprobes.c
new file mode 100644
index 000000000000..27cdcacbe81d
--- /dev/null
+++ b/arch/tile/kernel/kprobes.c
@@ -0,0 +1,528 @@
+/*
+ * arch/tile/kernel/kprobes.c
+ * Kprobes on TILE-Gx
+ *
+ * Some portions copied from the MIPS version.
+ *
+ * Copyright (C) IBM Corporation, 2002, 2004
+ * Copyright 2006 Sony Corp.
+ * Copyright 2010 Cavium Networks
+ *
+ * Copyright 2012 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+#include <linux/kprobes.h>
+#include <linux/kdebug.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <asm/cacheflush.h>
+
+#include <arch/opcode.h>
+
+DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
+DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
+
+tile_bundle_bits breakpoint_insn = TILEGX_BPT_BUNDLE;
+tile_bundle_bits breakpoint2_insn = TILEGX_BPT_BUNDLE | DIE_SSTEPBP;
+
+/*
+ * Check whether instruction is branch or jump, or if executing it
+ * has different results depending on where it is executed (e.g. lnk).
+ */
+static int __kprobes insn_has_control(kprobe_opcode_t insn)
+{
+        if (get_Mode(insn) != 0) {   /* Y-format bundle */
+                if (get_Opcode_Y1(insn) != RRR_1_OPCODE_Y1 ||
+                    get_RRROpcodeExtension_Y1(insn) != UNARY_RRR_1_OPCODE_Y1)
+                        return 0;
+
+                switch (get_UnaryOpcodeExtension_Y1(insn)) {
+                case JALRP_UNARY_OPCODE_Y1:
+                case JALR_UNARY_OPCODE_Y1:
+                case JRP_UNARY_OPCODE_Y1:
+                case JR_UNARY_OPCODE_Y1:
+                case LNK_UNARY_OPCODE_Y1:
+                        return 1;
+                default:
+                        return 0;
+                }
+        }
+
+        switch (get_Opcode_X1(insn)) {
+        case BRANCH_OPCODE_X1:  /* branch instructions */
+        case JUMP_OPCODE_X1:    /* jump instructions: j and jal */
+                return 1;
+
+        case RRR_0_OPCODE_X1:   /* other jump instructions */
+                if (get_RRROpcodeExtension_X1(insn) != UNARY_RRR_0_OPCODE_X1)
+                        return 0;
+                switch (get_UnaryOpcodeExtension_X1(insn)) {
+                case JALRP_UNARY_OPCODE_X1:
+                case JALR_UNARY_OPCODE_X1:
+                case JRP_UNARY_OPCODE_X1:
+                case JR_UNARY_OPCODE_X1:
+                case LNK_UNARY_OPCODE_X1:
+                        return 1;
+                default:
+                        return 0;
+                }
+        default:
+                return 0;
+        }
+}
+
+int __kprobes arch_prepare_kprobe(struct kprobe *p)
+{
+        unsigned long addr = (unsigned long)p->addr;
+
+        if (addr & (sizeof(kprobe_opcode_t) - 1))
+                return -EINVAL;
+
+        if (insn_has_control(*p->addr)) {
+                pr_notice("Kprobes for control instructions are not "
+                          "supported\n");
+                return -EINVAL;
+        }
+
+        /* insn: must be on special executable page on tile. */
+        p->ainsn.insn = get_insn_slot();
+        if (!p->ainsn.insn)
+                return -ENOMEM;
+
+        /*
+         * In the kprobe->ainsn.insn[] array we store the original
+         * instruction at index zero and a break trap instruction at
+         * index one.
+         */
+        memcpy(&p->ainsn.insn[0], p->addr, sizeof(kprobe_opcode_t));
+        p->ainsn.insn[1] = breakpoint2_insn;
+        p->opcode = *p->addr;
+
+        return 0;
+}
+
+void __kprobes arch_arm_kprobe(struct kprobe *p)
+{
+        unsigned long addr_wr;
+
+        /* Operate on writable kernel text mapping. */
+        addr_wr = (unsigned long)p->addr - MEM_SV_START + PAGE_OFFSET;
+
+        if (probe_kernel_write((void *)addr_wr, &breakpoint_insn,
+                sizeof(breakpoint_insn)))
+                pr_err("%s: failed to enable kprobe\n", __func__);
+
+        smp_wmb();
+        flush_insn_slot(p);
+}
+
+void __kprobes arch_disarm_kprobe(struct kprobe *kp)
+{
+        unsigned long addr_wr;
+
+        /* Operate on writable kernel text mapping. */
+        addr_wr = (unsigned long)kp->addr - MEM_SV_START + PAGE_OFFSET;
+
+        if (probe_kernel_write((void *)addr_wr, &kp->opcode,
+                sizeof(kp->opcode)))
+                pr_err("%s: failed to enable kprobe\n", __func__);
+
+        smp_wmb();
+        flush_insn_slot(kp);
+}
+
+void __kprobes arch_remove_kprobe(struct kprobe *p)
+{
+        if (p->ainsn.insn) {
+                free_insn_slot(p->ainsn.insn, 0);
+                p->ainsn.insn = NULL;
+        }
+}
+
+static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb)
+{
+        kcb->prev_kprobe.kp = kprobe_running();
+        kcb->prev_kprobe.status = kcb->kprobe_status;
+        kcb->prev_kprobe.saved_pc = kcb->kprobe_saved_pc;
+}
+
+static void __kprobes restore_previous_kprobe(struct kprobe_ctlblk *kcb)
+{
+        __this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
+        kcb->kprobe_status = kcb->prev_kprobe.status;
+        kcb->kprobe_saved_pc = kcb->prev_kprobe.saved_pc;
+}
+
+static void __kprobes set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
+                        struct kprobe_ctlblk *kcb)
+{
+        __this_cpu_write(current_kprobe, p);
+        kcb->kprobe_saved_pc = regs->pc;
+}
+
+static void __kprobes prepare_singlestep(struct kprobe *p, struct pt_regs *regs)
+{
+        /* Single step inline if the instruction is a break. */
+        if (p->opcode == breakpoint_insn ||
+            p->opcode == breakpoint2_insn)
+                regs->pc = (unsigned long)p->addr;
+        else
+                regs->pc = (unsigned long)&p->ainsn.insn[0];
+}
+
+static int __kprobes kprobe_handler(struct pt_regs *regs)
+{
+        struct kprobe *p;
+        int ret = 0;
+        kprobe_opcode_t *addr;
+        struct kprobe_ctlblk *kcb;
+
+        addr = (kprobe_opcode_t *)regs->pc;
+
+        /*
+         * We don't want to be preempted for the entire
+         * duration of kprobe processing.
+         */
+        preempt_disable();
+        kcb = get_kprobe_ctlblk();
+
+        /* Check we're not actually recursing. */
+        if (kprobe_running()) {
+                p = get_kprobe(addr);
+                if (p) {
+                        if (kcb->kprobe_status == KPROBE_HIT_SS &&
+                            p->ainsn.insn[0] == breakpoint_insn) {
+                                goto no_kprobe;
+                        }
+                        /*
+                         * We have reentered the kprobe_handler(), since
+                         * another probe was hit while within the handler.
+                         * We here save the original kprobes variables and
+                         * just single step on the instruction of the new probe
+                         * without calling any user handlers.
+                         */
+                        save_previous_kprobe(kcb);
+                        set_current_kprobe(p, regs, kcb);
+                        kprobes_inc_nmissed_count(p);
+                        prepare_singlestep(p, regs);
+                        kcb->kprobe_status = KPROBE_REENTER;
+                        return 1;
+                } else {
+                        if (*addr != breakpoint_insn) {
+                                /*
+                                 * The breakpoint instruction was removed by
+                                 * another cpu right after we hit, no further
+                                 * handling of this interrupt is appropriate.
+                                 */
+                                ret = 1;
+                                goto no_kprobe;
+                        }
+                        p = __this_cpu_read(current_kprobe);
+                        if (p->break_handler && p->break_handler(p, regs))
+                                goto ss_probe;
+                }
+                goto no_kprobe;
+        }
+
+        p = get_kprobe(addr);
+        if (!p) {
+                if (*addr != breakpoint_insn) {
+                        /*
+                         * The breakpoint instruction was removed right
+                         * after we hit it.  Another cpu has removed
+                         * either a probepoint or a debugger breakpoint
+                         * at this address.  In either case, no further
+                         * handling of this interrupt is appropriate.
+                         */
+                        ret = 1;
+                }
+                /* Not one of ours: let kernel handle it. */
+                goto no_kprobe;
+        }
+
+        set_current_kprobe(p, regs, kcb);
+        kcb->kprobe_status = KPROBE_HIT_ACTIVE;
+
+        if (p->pre_handler && p->pre_handler(p, regs)) {
+                /* Handler has already set things up, so skip ss setup. */
+                return 1;
+        }
+
+ss_probe:
+        prepare_singlestep(p, regs);
+        kcb->kprobe_status = KPROBE_HIT_SS;
+        return 1;
+
+no_kprobe:
+        preempt_enable_no_resched();
+        return ret;
+}
+
+/*
+ * Called after single-stepping.  p->addr is the address of the
+ * instruction that has been replaced by the breakpoint. To avoid the
+ * SMP problems that can occur when we temporarily put back the
+ * original opcode to single-step, we single-stepped a copy of the
+ * instruction.  The address of this copy is p->ainsn.insn.
+ *
+ * This function prepares to return from the post-single-step
+ * breakpoint trap.
+ */
+static void __kprobes resume_execution(struct kprobe *p,
+                                       struct pt_regs *regs,
+                                       struct kprobe_ctlblk *kcb)
+{
+        unsigned long orig_pc = kcb->kprobe_saved_pc;
+        regs->pc = orig_pc + 8;
+}
+
+static inline int post_kprobe_handler(struct pt_regs *regs)
+{
+        struct kprobe *cur = kprobe_running();
+        struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
+
+        if (!cur)
+                return 0;
+
+        if ((kcb->kprobe_status != KPROBE_REENTER) && cur->post_handler) {
+                kcb->kprobe_status = KPROBE_HIT_SSDONE;
+                cur->post_handler(cur, regs, 0);
+        }
+
+        resume_execution(cur, regs, kcb);
+
+        /* Restore back the original saved kprobes variables and continue. */
+        if (kcb->kprobe_status == KPROBE_REENTER) {
+                restore_previous_kprobe(kcb);
+                goto out;
+        }
+        reset_current_kprobe();
+out:
+        preempt_enable_no_resched();
+
+        return 1;
+}
+
+static inline int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
+{
+        struct kprobe *cur = kprobe_running();
+        struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
+
+        if (cur->fault_handler && cur->fault_handler(cur, regs, trapnr))
+                return 1;
+
+        if (kcb->kprobe_status & KPROBE_HIT_SS) {
+                /*
+                 * We are here because the instruction being single
+                 * stepped caused a page fault. We reset the current
+                 * kprobe and the ip points back to the probe address
+                 * and allow the page fault handler to continue as a
+                 * normal page fault.
+                 */
+                resume_execution(cur, regs, kcb);
+                reset_current_kprobe();
+                preempt_enable_no_resched();
+        }
+        return 0;
+}
+
+/*
+ * Wrapper routine for handling exceptions.
+ */
+int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
+                                       unsigned long val, void *data)
+{
+        struct die_args *args = (struct die_args *)data;
+        int ret = NOTIFY_DONE;
+
+        switch (val) {
+        case DIE_BREAK:
+                if (kprobe_handler(args->regs))
+                        ret = NOTIFY_STOP;
+                break;
+        case DIE_SSTEPBP:
+                if (post_kprobe_handler(args->regs))
+                        ret = NOTIFY_STOP;
+                break;
+        case DIE_PAGE_FAULT:
+                /* kprobe_running() needs smp_processor_id(). */
+                preempt_disable();
+
+                if (kprobe_running()
+                    && kprobe_fault_handler(args->regs, args->trapnr))
+                        ret = NOTIFY_STOP;
+                preempt_enable();
+                break;
+        default:
+                break;
+        }
+        return ret;
+}
+
+int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
+{
+        struct jprobe *jp = container_of(p, struct jprobe, kp);
+        struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
+
+        kcb->jprobe_saved_regs = *regs;
+        kcb->jprobe_saved_sp = regs->sp;
+
+        memcpy(kcb->jprobes_stack, (void *)kcb->jprobe_saved_sp,
+               MIN_JPROBES_STACK_SIZE(kcb->jprobe_saved_sp));
+
+        regs->pc = (unsigned long)(jp->entry);
+
+        return 1;
+}
+
+/* Defined in the inline asm below. */
+void jprobe_return_end(void);
+
+void __kprobes jprobe_return(void)
+{
+        asm volatile(
+                "bpt\n\t"
+                ".globl jprobe_return_end\n"
+                "jprobe_return_end:\n");
+}
+
+int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
+{
+        struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
+
+        if (regs->pc >= (unsigned long)jprobe_return &&
+            regs->pc <= (unsigned long)jprobe_return_end) {
+                *regs = kcb->jprobe_saved_regs;
+                memcpy((void *)kcb->jprobe_saved_sp, kcb->jprobes_stack,
+                       MIN_JPROBES_STACK_SIZE(kcb->jprobe_saved_sp));
+                preempt_enable_no_resched();
+
+                return 1;
+        }
+        return 0;
+}
+
+/*
+ * Function return probe trampoline:
+ * - init_kprobes() establishes a probepoint here
+ * - When the probed function returns, this probe causes the
+ *   handlers to fire
+ */
+static void __used kretprobe_trampoline_holder(void)
+{
+        asm volatile(
+                "nop\n\t"
+                ".global kretprobe_trampoline\n"
+                "kretprobe_trampoline:\n\t"
+                "nop\n\t"
+                : : : "memory");
+}
+
+void kretprobe_trampoline(void);
+
+void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
+                                      struct pt_regs *regs)
+{
+        ri->ret_addr = (kprobe_opcode_t *) regs->lr;
+
+        /* Replace the return addr with trampoline addr */
+        regs->lr = (unsigned long)kretprobe_trampoline;
+}
+
+/*
+ * Called when the probe at kretprobe trampoline is hit.
+ */
+static int __kprobes trampoline_probe_handler(struct kprobe *p,
+                                                struct pt_regs *regs)
+{
+        struct kretprobe_instance *ri = NULL;
+        struct hlist_head *head, empty_rp;
+        struct hlist_node *tmp;
+        unsigned long flags, orig_ret_address = 0;
+        unsigned long trampoline_address = (unsigned long)kretprobe_trampoline;
+
+        INIT_HLIST_HEAD(&empty_rp);
+        kretprobe_hash_lock(current, &head, &flags);
+
+        /*
+         * It is possible to have multiple instances associated with a given
+         * task either because multiple functions in the call path have
+         * a return probe installed on them, and/or more than one return
+         * return probe was registered for a target function.
+         *
+         * We can handle this because:
+         *     - instances are always inserted at the head of the list
+         *     - when multiple return probes are registered for the same
+         *       function, the first instance's ret_addr will point to the
+         *       real return address, and all the rest will point to
+         *       kretprobe_trampoline
+         */
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
+                if (ri->task != current)
+                        /* another task is sharing our hash bucket */
+                        continue;
+
+                if (ri->rp && ri->rp->handler)
+                        ri->rp->handler(ri, regs);
+
+                orig_ret_address = (unsigned long)ri->ret_addr;
+                recycle_rp_inst(ri, &empty_rp);
+
+                if (orig_ret_address != trampoline_address) {
+                        /*
+                         * This is the real return address. Any other
+                         * instances associated with this task are for
+                         * other calls deeper on the call stack
+                         */
+                        break;
+                }
+        }
+
+        kretprobe_assert(ri, orig_ret_address, trampoline_address);
+        instruction_pointer(regs) = orig_ret_address;
+
+        reset_current_kprobe();
+        kretprobe_hash_unlock(current, &flags);
+        preempt_enable_no_resched();
+
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
+                hlist_del(&ri->hlist);
+                kfree(ri);
+        }
+        /*
+         * By returning a non-zero value, we are telling
+         * kprobe_handler() that we don't want the post_handler
+         * to run (and have re-enabled preemption)
+         */
+        return 1;
+}
+
+int __kprobes arch_trampoline_kprobe(struct kprobe *p)
+{
+        if (p->addr == (kprobe_opcode_t *)kretprobe_trampoline)
+                return 1;
+
+        return 0;
+}
+
+static struct kprobe trampoline_p = {
+        .addr = (kprobe_opcode_t *)kretprobe_trampoline,
+        .pre_handler = trampoline_probe_handler
+};
+
+int __init arch_init_kprobes(void)
+{
+        register_kprobe(&trampoline_p);
+        return 0;
+}
diff --git a/arch/tile/kernel/mcount_64.S b/arch/tile/kernel/mcount_64.S
new file mode 100644
index 000000000000..70d7bb0c4d8f
--- /dev/null
+++ b/arch/tile/kernel/mcount_64.S
@@ -0,0 +1,224 @@
+/*
+ * Copyright 2012 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ *
+ * TILE-Gx specific __mcount support
+ */
+
+#include <linux/linkage.h>
+#include <asm/ftrace.h>
+
+#define REGSIZE 8
+
+        .text
+        .global __mcount
+
+        .macro  MCOUNT_SAVE_REGS
+        addli   sp, sp, -REGSIZE
+        {
+         st     sp, lr
+         addli  r29, sp, - (12 * REGSIZE)
+        }
+        {
+         addli  sp, sp, - (13 * REGSIZE)
+         st     r29, sp
+        }
+        addli   r29, r29, REGSIZE
+        { st    r29, r0; addli  r29, r29, REGSIZE }
+        { st    r29, r1; addli  r29, r29, REGSIZE }
+        { st    r29, r2; addli  r29, r29, REGSIZE }
+        { st    r29, r3; addli  r29, r29, REGSIZE }
+        { st    r29, r4; addli  r29, r29, REGSIZE }
+        { st    r29, r5; addli  r29, r29, REGSIZE }
+        { st    r29, r6; addli  r29, r29, REGSIZE }
+        { st    r29, r7; addli  r29, r29, REGSIZE }
+        { st    r29, r8; addli  r29, r29, REGSIZE }
+        { st    r29, r9; addli  r29, r29, REGSIZE }
+        { st    r29, r10; addli r29, r29, REGSIZE }
+        .endm
+
+        .macro  MCOUNT_RESTORE_REGS
+        addli   r29, sp, (2 * REGSIZE)
+        { ld    r0, r29; addli  r29, r29, REGSIZE }
+        { ld    r1, r29; addli  r29, r29, REGSIZE }
+        { ld    r2, r29; addli  r29, r29, REGSIZE }
+        { ld    r3, r29; addli  r29, r29, REGSIZE }
+        { ld    r4, r29; addli  r29, r29, REGSIZE }
+        { ld    r5, r29; addli  r29, r29, REGSIZE }
+        { ld    r6, r29; addli  r29, r29, REGSIZE }
+        { ld    r7, r29; addli  r29, r29, REGSIZE }
+        { ld    r8, r29; addli  r29, r29, REGSIZE }
+        { ld    r9, r29; addli  r29, r29, REGSIZE }
+        { ld    r10, r29; addli lr, sp, (13 * REGSIZE) }
+        { ld    lr, lr;  addli  sp, sp, (14 * REGSIZE) }
+        .endm
+
+        .macro  RETURN_BACK
+        { move  r12, lr; move   lr, r10 }
+        jrp     r12
+        .endm
+
+#ifdef CONFIG_DYNAMIC_FTRACE
+
+        .align  64
+STD_ENTRY(__mcount)
+__mcount:
+        j       ftrace_stub
+STD_ENDPROC(__mcount)
+
+        .align  64
+STD_ENTRY(ftrace_caller)
+        moveli  r11, hw2_last(function_trace_stop)
+        { shl16insli    r11, r11, hw1(function_trace_stop); move r12, lr }
+        { shl16insli    r11, r11, hw0(function_trace_stop); move lr, r10 }
+        ld      r11, r11
+        beqz    r11, 1f
+        jrp     r12
+
+1:
+        { move  r10, lr; move   lr, r12 }
+        MCOUNT_SAVE_REGS
+
+        /* arg1: self return address */
+        /* arg2: parent's return address */
+        { move  r0, lr; move    r1, r10 }
+
+        .global ftrace_call
+ftrace_call:
+        /*
+         * a placeholder for the call to a real tracing function, i.e.
+         * ftrace_trace_function()
+         */
+        nop
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        .global ftrace_graph_call
+ftrace_graph_call:
+        /*
+         * a placeholder for the call to a real tracing function, i.e.
+         * ftrace_graph_caller()
+         */
+        nop
+#endif
+        MCOUNT_RESTORE_REGS
+        .global ftrace_stub
+ftrace_stub:
+        RETURN_BACK
+STD_ENDPROC(ftrace_caller)
+
+#else /* ! CONFIG_DYNAMIC_FTRACE */
+
+        .align  64
+STD_ENTRY(__mcount)
+        moveli  r11, hw2_last(function_trace_stop)
+        { shl16insli    r11, r11, hw1(function_trace_stop); move r12, lr }
+        { shl16insli    r11, r11, hw0(function_trace_stop); move lr, r10 }
+        ld      r11, r11
+        beqz    r11, 1f
+        jrp     r12
+
+1:
+        { move  r10, lr; move   lr, r12 }
+        {
+         moveli r11, hw2_last(ftrace_trace_function)
+         moveli r13, hw2_last(ftrace_stub)
+        }
+        {
+         shl16insli     r11, r11, hw1(ftrace_trace_function)
+         shl16insli     r13, r13, hw1(ftrace_stub)
+        }
+        {
+         shl16insli     r11, r11, hw0(ftrace_trace_function)
+         shl16insli     r13, r13, hw0(ftrace_stub)
+        }
+
+        ld      r11, r11
+        sub     r14, r13, r11
+        bnez    r14, static_trace
+
+#ifdef  CONFIG_FUNCTION_GRAPH_TRACER
+        moveli  r15, hw2_last(ftrace_graph_return)
+        shl16insli      r15, r15, hw1(ftrace_graph_return)
+        shl16insli      r15, r15, hw0(ftrace_graph_return)
+        ld      r15, r15
+        sub     r15, r15, r13
+        bnez    r15, ftrace_graph_caller
+
+        {
+         moveli r16, hw2_last(ftrace_graph_entry)
+         moveli r17, hw2_last(ftrace_graph_entry_stub)
+        }
+        {
+         shl16insli     r16, r16, hw1(ftrace_graph_entry)
+         shl16insli     r17, r17, hw1(ftrace_graph_entry_stub)
+        }
+        {
+         shl16insli     r16, r16, hw0(ftrace_graph_entry)
+         shl16insli     r17, r17, hw0(ftrace_graph_entry_stub)
+        }
+        ld      r16, r16
+        sub     r17, r16, r17
+        bnez    r17, ftrace_graph_caller
+
+#endif
+        RETURN_BACK
+
+static_trace:
+        MCOUNT_SAVE_REGS
+
+        /* arg1: self return address */
+        /* arg2: parent's return address */
+        { move  r0, lr; move    r1, r10 }
+
+        /* call ftrace_trace_function() */
+        jalr    r11
+
+        MCOUNT_RESTORE_REGS
+
+        .global ftrace_stub
+ftrace_stub:
+        RETURN_BACK
+STD_ENDPROC(__mcount)
+
+#endif  /* ! CONFIG_DYNAMIC_FTRACE */
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+
+STD_ENTRY(ftrace_graph_caller)
+ftrace_graph_caller:
+#ifndef CONFIG_DYNAMIC_FTRACE
+        MCOUNT_SAVE_REGS
+#endif
+
+        /* arg1: Get the location of the parent's return address */
+        addi    r0, sp, 12 * REGSIZE
+        /* arg2: Get self return address */
+        move    r1, lr
+
+        jal prepare_ftrace_return
+
+        MCOUNT_RESTORE_REGS
+        RETURN_BACK
+STD_ENDPROC(ftrace_graph_caller)
+
+        .global return_to_handler
+return_to_handler:
+        MCOUNT_SAVE_REGS
+
+        jal     ftrace_return_to_handler
+        /* restore the real parent address */
+        move    r11, r0
+
+        MCOUNT_RESTORE_REGS
+        jr      r11
+
+#endif /* CONFIG_FUNCTION_GRAPH_TRACER */
diff --git a/arch/tile/kernel/pci-dma.c b/arch/tile/kernel/pci-dma.c
index b9fe80ec1089..09b58703ac26 100644
--- a/arch/tile/kernel/pci-dma.c
+++ b/arch/tile/kernel/pci-dma.c
@@ -36,8 +36,9 @@ static void *tile_dma_alloc_coherent(struct device *dev, size_t size,
                                      dma_addr_t *dma_handle, gfp_t gfp,
                                      struct dma_attrs *attrs)
 {
-        u64 dma_mask = dev->coherent_dma_mask ?: DMA_BIT_MASK(32);
-        int node = dev_to_node(dev);
+        u64 dma_mask = (dev && dev->coherent_dma_mask) ?
+                dev->coherent_dma_mask : DMA_BIT_MASK(32);
+        int node = dev ? dev_to_node(dev) : 0;
         int order = get_order(size);
         struct page *pg;
         dma_addr_t addr;
@@ -256,7 +257,7 @@ static void tile_dma_unmap_page(struct device *dev, dma_addr_t dma_address,
         BUG_ON(!valid_dma_direction(direction));
 
         __dma_complete_page(pfn_to_page(PFN_DOWN(dma_address)),
-                            dma_address & PAGE_OFFSET, size, direction);
+                            dma_address & (PAGE_SIZE - 1), size, direction);
 }
 
 static void tile_dma_sync_single_for_cpu(struct device *dev,
@@ -357,7 +358,7 @@ static void *tile_pci_dma_alloc_coherent(struct device *dev, size_t size,
 
         addr = page_to_phys(pg);
 
-        *dma_handle = phys_to_dma(dev, addr);
+        *dma_handle = addr + get_dma_offset(dev);
 
         return page_address(pg);
 }
@@ -387,7 +388,7 @@ static int tile_pci_dma_map_sg(struct device *dev, struct scatterlist *sglist,
                 sg->dma_address = sg_phys(sg);
                 __dma_prep_pa_range(sg->dma_address, sg->length, direction);
 
-                sg->dma_address = phys_to_dma(dev, sg->dma_address);
+                sg->dma_address = sg->dma_address + get_dma_offset(dev);
 #ifdef CONFIG_NEED_SG_DMA_LENGTH
                 sg->dma_length = sg->length;
 #endif
@@ -422,7 +423,7 @@ static dma_addr_t tile_pci_dma_map_page(struct device *dev, struct page *page,
         BUG_ON(offset + size > PAGE_SIZE);
         __dma_prep_page(page, offset, size, direction);
 
-        return phys_to_dma(dev, page_to_pa(page) + offset);
+        return page_to_pa(page) + offset + get_dma_offset(dev);
 }
 
 static void tile_pci_dma_unmap_page(struct device *dev, dma_addr_t dma_address,
@@ -432,10 +433,10 @@ static void tile_pci_dma_unmap_page(struct device *dev, dma_addr_t dma_address,
 {
         BUG_ON(!valid_dma_direction(direction));
 
-        dma_address = dma_to_phys(dev, dma_address);
+        dma_address -= get_dma_offset(dev);
 
         __dma_complete_page(pfn_to_page(PFN_DOWN(dma_address)),
-                            dma_address & PAGE_OFFSET, size, direction);
+                            dma_address & (PAGE_SIZE - 1), size, direction);
 }
 
 static void tile_pci_dma_sync_single_for_cpu(struct device *dev,
@@ -445,7 +446,7 @@ static void tile_pci_dma_sync_single_for_cpu(struct device *dev,
 {
         BUG_ON(!valid_dma_direction(direction));
 
-        dma_handle = dma_to_phys(dev, dma_handle);
+        dma_handle -= get_dma_offset(dev);
 
         __dma_complete_pa_range(dma_handle, size, direction);
 }
@@ -456,7 +457,7 @@ static void tile_pci_dma_sync_single_for_device(struct device *dev,
                                                 enum dma_data_direction
                                                 direction)
 {
-        dma_handle = dma_to_phys(dev, dma_handle);
+        dma_handle -= get_dma_offset(dev);
 
         __dma_prep_pa_range(dma_handle, size, direction);
 }
@@ -558,22 +559,47 @@ static struct dma_map_ops pci_swiotlb_dma_ops = {
         .mapping_error = swiotlb_dma_mapping_error,
 };
 
+static struct dma_map_ops pci_hybrid_dma_ops = {
+        .alloc = tile_swiotlb_alloc_coherent,
+        .free = tile_swiotlb_free_coherent,
+        .map_page = tile_pci_dma_map_page,
+        .unmap_page = tile_pci_dma_unmap_page,
+        .map_sg = tile_pci_dma_map_sg,
+        .unmap_sg = tile_pci_dma_unmap_sg,
+        .sync_single_for_cpu = tile_pci_dma_sync_single_for_cpu,
+        .sync_single_for_device = tile_pci_dma_sync_single_for_device,
+        .sync_sg_for_cpu = tile_pci_dma_sync_sg_for_cpu,
+        .sync_sg_for_device = tile_pci_dma_sync_sg_for_device,
+        .mapping_error = tile_pci_dma_mapping_error,
+        .dma_supported = tile_pci_dma_supported
+};
+
 struct dma_map_ops *gx_legacy_pci_dma_map_ops = &pci_swiotlb_dma_ops;
+struct dma_map_ops *gx_hybrid_pci_dma_map_ops = &pci_hybrid_dma_ops;
 #else
 struct dma_map_ops *gx_legacy_pci_dma_map_ops;
+struct dma_map_ops *gx_hybrid_pci_dma_map_ops;
 #endif
 EXPORT_SYMBOL(gx_legacy_pci_dma_map_ops);
+EXPORT_SYMBOL(gx_hybrid_pci_dma_map_ops);
 
 #ifdef CONFIG_ARCH_HAS_DMA_SET_COHERENT_MASK
 int dma_set_coherent_mask(struct device *dev, u64 mask)
 {
         struct dma_map_ops *dma_ops = get_dma_ops(dev);
 
-        /* Handle legacy PCI devices with limited memory addressability. */
-        if (((dma_ops == gx_pci_dma_map_ops) ||
-            (dma_ops == gx_legacy_pci_dma_map_ops)) &&
-            (mask <= DMA_BIT_MASK(32))) {
-                if (mask > dev->archdata.max_direct_dma_addr)
+        /*
+         * For PCI devices with 64-bit DMA addressing capability, promote
+         * the dma_ops to full capability for both streams and consistent
+         * memory access. For 32-bit capable devices, limit the consistent 
+         * memory DMA range to max_direct_dma_addr.
+         */
+        if (dma_ops == gx_pci_dma_map_ops ||
+            dma_ops == gx_hybrid_pci_dma_map_ops ||
+            dma_ops == gx_legacy_pci_dma_map_ops) {
+                if (mask == DMA_BIT_MASK(64))
+                        set_dma_ops(dev, gx_pci_dma_map_ops);
+                else if (mask > dev->archdata.max_direct_dma_addr)
                         mask = dev->archdata.max_direct_dma_addr;
         }
 
@@ -584,3 +610,21 @@ int dma_set_coherent_mask(struct device *dev, u64 mask)
 }
 EXPORT_SYMBOL(dma_set_coherent_mask);
 #endif
+
+#ifdef ARCH_HAS_DMA_GET_REQUIRED_MASK
+/*
+ * The generic dma_get_required_mask() uses the highest physical address
+ * (max_pfn) to provide the hint to the PCI drivers regarding 32-bit or
+ * 64-bit DMA configuration. Since TILEGx has I/O TLB/MMU, allowing the
+ * DMAs to use the full 64-bit PCI address space and not limited by
+ * the physical memory space, we always let the PCI devices use
+ * 64-bit DMA if they have that capability, by returning the 64-bit
+ * DMA mask here. The device driver has the option to use 32-bit DMA if
+ * the device is not capable of 64-bit DMA.
+ */
+u64 dma_get_required_mask(struct device *dev)
+{
+        return DMA_BIT_MASK(64);
+}
+EXPORT_SYMBOL_GPL(dma_get_required_mask);
+#endif
diff --git a/arch/tile/kernel/pci.c b/arch/tile/kernel/pci.c
index 67237d34c2e2..b7180e6e900d 100644
--- a/arch/tile/kernel/pci.c
+++ b/arch/tile/kernel/pci.c
@@ -20,7 +20,6 @@
 #include <linux/capability.h>
 #include <linux/sched.h>
 #include <linux/errno.h>
-#include <linux/bootmem.h>
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/uaccess.h>
@@ -52,6 +51,8 @@
  *
  */
 
+static int pci_probe = 1;
+
 /*
  * This flag tells if the platform is TILEmpower that needs
  * special configuration for the PLX switch chip.
@@ -144,6 +145,11 @@ int __init tile_pci_init(void)
 {
         int i;
 
+        if (!pci_probe) {
+                pr_info("PCI: disabled by boot argument\n");
+                return 0;
+        }
+
         pr_info("PCI: Searching for controllers...\n");
 
         /* Re-init number of PCIe controllers to support hot-plug feature. */
@@ -192,7 +198,6 @@ int __init tile_pci_init(void)
                         controller->hv_cfg_fd[0] = hv_cfg_fd0;
                         controller->hv_cfg_fd[1] = hv_cfg_fd1;
                         controller->hv_mem_fd = hv_mem_fd;
-                        controller->first_busno = 0;
                         controller->last_busno = 0xff;
                         controller->ops = &tile_cfg_ops;
 
@@ -283,7 +288,7 @@ int __init pcibios_init(void)
          * known to require at least 20ms here, but we use a more
          * conservative value.
          */
-        mdelay(250);
+        msleep(250);
 
         /* Scan all of the recorded PCI controllers.  */
         for (i = 0; i < TILE_NUM_PCIE; i++) {
@@ -304,18 +309,10 @@ int __init pcibios_init(void)
 
                         pr_info("PCI: initializing controller #%d\n", i);
 
-                        /*
-                         * This comes from the generic Linux PCI driver.
-                         *
-                         * It reads the PCI tree for this bus into the Linux
-                         * data structures.
-                         *
-                         * This is inlined in linux/pci.h and calls into
-                         * pci_scan_bus_parented() in probe.c.
-                         */
                         pci_add_resource(&resources, &ioport_resource);
                         pci_add_resource(&resources, &iomem_resource);
-                        bus = pci_scan_root_bus(NULL, 0, controller->ops, controller, &resources);
+                        bus = pci_scan_root_bus(NULL, 0, controller->ops,
+                                                controller, &resources);
                         controller->root_bus = bus;
                         controller->last_busno = bus->busn_res.end;
                 }
@@ -388,6 +385,16 @@ void pcibios_set_master(struct pci_dev *dev)
         /* No special bus mastering setup handling. */
 }
 
+/* Process any "pci=" kernel boot arguments. */
+char *__init pcibios_setup(char *str)
+{
+        if (!strcmp(str, "off")) {
+                pci_probe = 0;
+                return NULL;
+        }
+        return str;
+}
+
 /*
  * Enable memory and/or address decoding, as appropriate, for the
  * device described by the 'dev' struct.
diff --git a/arch/tile/kernel/pci_gx.c b/arch/tile/kernel/pci_gx.c
index 11425633b2d7..a97a6452b812 100644
--- a/arch/tile/kernel/pci_gx.c
+++ b/arch/tile/kernel/pci_gx.c
@@ -69,19 +69,32 @@ static int pcie_rc[TILEGX_NUM_TRIO][TILEGX_TRIO_PCIES];
  * a HW PCIe link-training bug. The exact delay is specified with
  * a kernel boot argument in the form of "pcie_rc_delay=T,P,S",
  * where T is the TRIO instance number, P is the port number and S is
- * the delay in seconds. If the delay is not provided, the value
- * will be DEFAULT_RC_DELAY.
+ * the delay in seconds. If the argument is specified, but the delay is
+ * not provided, the value will be DEFAULT_RC_DELAY.
  */
 static int rc_delay[TILEGX_NUM_TRIO][TILEGX_TRIO_PCIES];
 
 /* Default number of seconds that the PCIe RC port probe can be delayed. */
 #define DEFAULT_RC_DELAY        10
 
-/* Max number of seconds that the PCIe RC port probe can be delayed. */
-#define MAX_RC_DELAY            20
+/* The PCI I/O space size in each PCI domain. */
+#define IO_SPACE_SIZE           0x10000
+
+/* Provide shorter versions of some very long constant names. */
+#define AUTO_CONFIG_RC  \
+        TRIO_PCIE_INTFC_PORT_CONFIG__STRAP_STATE_VAL_AUTO_CONFIG_RC
+#define AUTO_CONFIG_RC_G1       \
+        TRIO_PCIE_INTFC_PORT_CONFIG__STRAP_STATE_VAL_AUTO_CONFIG_RC_G1
+#define AUTO_CONFIG_EP  \
+        TRIO_PCIE_INTFC_PORT_CONFIG__STRAP_STATE_VAL_AUTO_CONFIG_ENDPOINT
+#define AUTO_CONFIG_EP_G1       \
+        TRIO_PCIE_INTFC_PORT_CONFIG__STRAP_STATE_VAL_AUTO_CONFIG_ENDPOINT_G1
 
 /* Array of the PCIe ports configuration info obtained from the BIB. */
-struct pcie_port_property pcie_ports[TILEGX_NUM_TRIO][TILEGX_TRIO_PCIES];
+struct pcie_trio_ports_property pcie_ports[TILEGX_NUM_TRIO];
+
+/* Number of configured TRIO instances. */
+int num_trio_shims;
 
 /* All drivers share the TRIO contexts defined here. */
 gxio_trio_context_t trio_contexts[TILEGX_NUM_TRIO];
@@ -89,24 +102,21 @@ gxio_trio_context_t trio_contexts[TILEGX_NUM_TRIO];
 /* Pointer to an array of PCIe RC controllers. */
 struct pci_controller pci_controllers[TILEGX_NUM_TRIO * TILEGX_TRIO_PCIES];
 int num_rc_controllers;
-static int num_ep_controllers;
 
 static struct pci_ops tile_cfg_ops;
 
 /* Mask of CPUs that should receive PCIe interrupts. */
 static struct cpumask intr_cpus_map;
 
-/*
- * We don't need to worry about the alignment of resources.
- */
+/* We don't need to worry about the alignment of resources. */
 resource_size_t pcibios_align_resource(void *data, const struct resource *res,
-                                resource_size_t size, resource_size_t align)
+                                       resource_size_t size,
+                                       resource_size_t align)
 {
         return res->start;
 }
 EXPORT_SYMBOL(pcibios_align_resource);
 
-
 /*
  * Pick a CPU to receive and handle the PCIe interrupts, based on the IRQ #.
  * For now, we simply send interrupts to non-dataplane CPUs.
@@ -134,24 +144,19 @@ static int tile_irq_cpu(int irq)
         return cpu;
 }
 
-/*
- * Open a file descriptor to the TRIO shim.
- */
+/* Open a file descriptor to the TRIO shim. */
 static int tile_pcie_open(int trio_index)
 {
         gxio_trio_context_t *context = &trio_contexts[trio_index];
         int ret;
+        int mac;
 
-        /*
-         * This opens a file descriptor to the TRIO shim.
-         */
+        /* This opens a file descriptor to the TRIO shim. */
         ret = gxio_trio_init(context, trio_index);
         if (ret < 0)
-                return ret;
+                goto gxio_trio_init_failure;
 
-        /*
-         * Allocate an ASID for the kernel.
-         */
+        /* Allocate an ASID for the kernel. */
         ret = gxio_trio_alloc_asids(context, 1, 0, 0);
         if (ret < 0) {
                 pr_err("PCI: ASID alloc failure on TRIO %d, give up\n",
@@ -189,31 +194,97 @@ static int tile_pcie_open(int trio_index)
         }
 #endif
 
+        /* Get the properties of the PCIe ports on this TRIO instance. */
+        ret = gxio_trio_get_port_property(context, &pcie_ports[trio_index]);
+        if (ret < 0) {
+                pr_err("PCI: PCIE_GET_PORT_PROPERTY failure, error %d,"
+                       " on TRIO %d\n", ret, trio_index);
+                goto get_port_property_failure;
+        }
+
+        context->mmio_base_mac =
+                iorpc_ioremap(context->fd, 0, HV_TRIO_CONFIG_IOREMAP_SIZE);
+        if (context->mmio_base_mac == NULL) {
+                pr_err("PCI: TRIO config space mapping failure, error %d,"
+                       " on TRIO %d\n", ret, trio_index);
+                ret = -ENOMEM;
+
+                goto trio_mmio_mapping_failure;
+        }
+
+        /* Check the port strap state which will override the BIB setting. */
+        for (mac = 0; mac < TILEGX_TRIO_PCIES; mac++) {
+                TRIO_PCIE_INTFC_PORT_CONFIG_t port_config;
+                unsigned int reg_offset;
+
+                /* Ignore ports that are not specified in the BIB. */
+                if (!pcie_ports[trio_index].ports[mac].allow_rc &&
+                    !pcie_ports[trio_index].ports[mac].allow_ep)
+                        continue;
+
+                reg_offset =
+                        (TRIO_PCIE_INTFC_PORT_CONFIG <<
+                                TRIO_CFG_REGION_ADDR__REG_SHIFT) |
+                        (TRIO_CFG_REGION_ADDR__INTFC_VAL_MAC_INTERFACE <<
+                                TRIO_CFG_REGION_ADDR__INTFC_SHIFT) |
+                        (mac << TRIO_CFG_REGION_ADDR__MAC_SEL_SHIFT);
+
+                port_config.word =
+                        __gxio_mmio_read(context->mmio_base_mac + reg_offset);
+
+                if (port_config.strap_state != AUTO_CONFIG_RC &&
+                    port_config.strap_state != AUTO_CONFIG_RC_G1) {
+                        /*
+                         * If this is really intended to be an EP port, record
+                         * it so that the endpoint driver will know about it.
+                         */
+                        if (port_config.strap_state == AUTO_CONFIG_EP ||
+                            port_config.strap_state == AUTO_CONFIG_EP_G1)
+                                pcie_ports[trio_index].ports[mac].allow_ep = 1;
+                }
+        }
+
         return ret;
 
+trio_mmio_mapping_failure:
+get_port_property_failure:
 asid_alloc_failure:
 #ifdef USE_SHARED_PCIE_CONFIG_REGION
 pio_alloc_failure:
 #endif
         hv_dev_close(context->fd);
+gxio_trio_init_failure:
+        context->fd = -1;
 
         return ret;
 }
 
-static void
-tilegx_legacy_irq_ack(struct irq_data *d)
+static int __init tile_trio_init(void)
+{
+        int i;
+
+        /* We loop over all the TRIO shims. */
+        for (i = 0; i < TILEGX_NUM_TRIO; i++) {
+                if (tile_pcie_open(i) < 0)
+                        continue;
+                num_trio_shims++;
+        }
+
+        return 0;
+}
+postcore_initcall(tile_trio_init);
+
+static void tilegx_legacy_irq_ack(struct irq_data *d)
 {
         __insn_mtspr(SPR_IPI_EVENT_RESET_K, 1UL << d->irq);
 }
 
-static void
-tilegx_legacy_irq_mask(struct irq_data *d)
+static void tilegx_legacy_irq_mask(struct irq_data *d)
 {
         __insn_mtspr(SPR_IPI_MASK_SET_K, 1UL << d->irq);
 }
 
-static void
-tilegx_legacy_irq_unmask(struct irq_data *d)
+static void tilegx_legacy_irq_unmask(struct irq_data *d)
 {
         __insn_mtspr(SPR_IPI_MASK_RESET_K, 1UL << d->irq);
 }
@@ -234,8 +305,7 @@ static struct irq_chip tilegx_legacy_irq_chip = {
  * to Linux which just calls handle_level_irq() after clearing the
  * MAC INTx Assert status bit associated with this interrupt.
  */
-static void
-trio_handle_level_irq(unsigned int irq, struct irq_desc *desc)
+static void trio_handle_level_irq(unsigned int irq, struct irq_desc *desc)
 {
         struct pci_controller *controller = irq_desc_get_handler_data(desc);
         gxio_trio_context_t *trio_context = controller->trio;
@@ -301,9 +371,7 @@ static int tile_init_irqs(struct pci_controller *controller)
                         goto free_irqs;
                 }
 
-                /*
-                 * Register the IRQ handler with the kernel.
-                 */
+                /* Register the IRQ handler with the kernel. */
                 irq_set_chip_and_handler(irq, &tilegx_legacy_irq_chip,
                                         trio_handle_level_irq);
                 irq_set_chip_data(irq, (void *)(uint64_t)i);
@@ -320,14 +388,39 @@ free_irqs:
 }
 
 /*
+ * Return 1 if the port is strapped to operate in RC mode.
+ */
+static int
+strapped_for_rc(gxio_trio_context_t *trio_context, int mac)
+{
+        TRIO_PCIE_INTFC_PORT_CONFIG_t port_config;
+        unsigned int reg_offset;
+
+        /* Check the port configuration. */
+        reg_offset =
+                (TRIO_PCIE_INTFC_PORT_CONFIG <<
+                        TRIO_CFG_REGION_ADDR__REG_SHIFT) |
+                (TRIO_CFG_REGION_ADDR__INTFC_VAL_MAC_INTERFACE <<
+                        TRIO_CFG_REGION_ADDR__INTFC_SHIFT) |
+                (mac << TRIO_CFG_REGION_ADDR__MAC_SEL_SHIFT);
+        port_config.word =
+                __gxio_mmio_read(trio_context->mmio_base_mac + reg_offset);
+
+        if (port_config.strap_state == AUTO_CONFIG_RC ||
+            port_config.strap_state == AUTO_CONFIG_RC_G1)
+                return 1;
+        else
+                return 0;
+}
+
+/*
  * Find valid controllers and fill in pci_controller structs for each
  * of them.
  *
- * Returns the number of controllers discovered.
+ * Return the number of controllers discovered.
  */
 int __init tile_pci_init(void)
 {
-        int num_trio_shims = 0;
         int ctl_index = 0;
         int i, j;
 
@@ -338,64 +431,62 @@ int __init tile_pci_init(void)
 
         pr_info("PCI: Searching for controllers...\n");
 
-        /*
-         * We loop over all the TRIO shims.
-         */
-        for (i = 0; i < TILEGX_NUM_TRIO; i++) {
-                int ret;
-
-                ret = tile_pcie_open(i);
-                if (ret < 0)
-                        continue;
-
-                num_trio_shims++;
-        }
-
         if (num_trio_shims == 0 || sim_is_simulator())
                 return 0;
 
         /*
-         * Now determine which PCIe ports are configured to operate in RC mode.
-         * We look at the Board Information Block first and then see if there
-         * are any overriding configuration by the HW strapping pin.
+         * Now determine which PCIe ports are configured to operate in RC
+         * mode. There is a differece in the port configuration capability
+         * between the Gx36 and Gx72 devices.
+         *
+         * The Gx36 has configuration capability for each of the 3 PCIe
+         * interfaces (disable, auto endpoint, auto RC, etc.).
+         * On the Gx72, you can only select one of the 3 PCIe interfaces per
+         * TRIO to train automatically. Further, the allowable training modes
+         * are reduced to four options (auto endpoint, auto RC, stream x1,
+         * stream x4).
+         *
+         * For Gx36 ports, it must be allowed to be in RC mode by the
+         * Board Information Block, and the hardware strapping pins must be
+         * set to RC mode.
+         *
+         * For Gx72 ports, the port will operate in RC mode if either of the
+         * following is true:
+         * 1. It is allowed to be in RC mode by the Board Information Block,
+         *    and the BIB doesn't allow the EP mode.
+         * 2. It is allowed to be in either the RC or the EP mode by the BIB,
+         *    and the hardware strapping pin is set to RC mode.
          */
         for (i = 0; i < TILEGX_NUM_TRIO; i++) {
                 gxio_trio_context_t *context = &trio_contexts[i];
-                int ret;
 
                 if (context->fd < 0)
                         continue;
 
-                ret = hv_dev_pread(context->fd, 0,
-                        (HV_VirtAddr)&pcie_ports[i][0],
-                        sizeof(struct pcie_port_property) * TILEGX_TRIO_PCIES,
-                        GXIO_TRIO_OP_GET_PORT_PROPERTY);
-                if (ret < 0) {
-                        pr_err("PCI: PCIE_GET_PORT_PROPERTY failure, error %d,"
-                                " on TRIO %d\n", ret, i);
-                        continue;
-                }
-
                 for (j = 0; j < TILEGX_TRIO_PCIES; j++) {
-                        if (pcie_ports[i][j].allow_rc) {
+                        int is_rc = 0;
+
+                        if (pcie_ports[i].is_gx72 &&
+                            pcie_ports[i].ports[j].allow_rc) {
+                                if (!pcie_ports[i].ports[j].allow_ep ||
+                                    strapped_for_rc(context, j))
+                                        is_rc = 1;
+                        } else if (pcie_ports[i].ports[j].allow_rc &&
+                                   strapped_for_rc(context, j)) {
+                                is_rc = 1;
+                        }
+                        if (is_rc) {
                                 pcie_rc[i][j] = 1;
                                 num_rc_controllers++;
                         }
-                        else if (pcie_ports[i][j].allow_ep) {
-                                num_ep_controllers++;
-                        }
                 }
         }
 
-        /*
-         * Return if no PCIe ports are configured to operate in RC mode.
-         */
+        /* Return if no PCIe ports are configured to operate in RC mode. */
         if (num_rc_controllers == 0)
                 return 0;
 
-        /*
-         * Set the TRIO pointer and MAC index for each PCIe RC port.
-         */
+        /* Set the TRIO pointer and MAC index for each PCIe RC port. */
         for (i = 0; i < TILEGX_NUM_TRIO; i++) {
                 for (j = 0; j < TILEGX_TRIO_PCIES; j++) {
                         if (pcie_rc[i][j]) {
@@ -411,26 +502,32 @@ int __init tile_pci_init(void)
         }
 
 out:
-        /*
-         * Configure each PCIe RC port.
-         */
+        /* Configure each PCIe RC port. */
         for (i = 0; i < num_rc_controllers; i++) {
-                /*
-                 * Configure the PCIe MAC to run in RC mode.
-                 */
 
+                /* Configure the PCIe MAC to run in RC mode. */
                 struct pci_controller *controller = &pci_controllers[i];
 
                 controller->index = i;
                 controller->ops = &tile_cfg_ops;
 
+                controller->io_space.start = PCIBIOS_MIN_IO +
+                        (i * IO_SPACE_SIZE);
+                controller->io_space.end = controller->io_space.start +
+                        IO_SPACE_SIZE - 1;
+                BUG_ON(controller->io_space.end > IO_SPACE_LIMIT);
+                controller->io_space.flags = IORESOURCE_IO;
+                snprintf(controller->io_space_name,
+                         sizeof(controller->io_space_name),
+                         "PCI I/O domain %d", i);
+                controller->io_space.name = controller->io_space_name;
+
                 /*
                  * The PCI memory resource is located above the PA space.
                  * For every host bridge, the BAR window or the MMIO aperture
                  * is in range [3GB, 4GB - 1] of a 4GB space beyond the
                  * PA space.
                  */
-
                 controller->mem_offset = TILE_PCI_MEM_START +
                         (i * TILE_PCI_BAR_WINDOW_TOP);
                 controller->mem_space.start = controller->mem_offset +
@@ -458,7 +555,6 @@ static int tile_map_irq(const struct pci_dev *dev, u8 device, u8 pin)
         return controller->irq_intx_table[pin - 1];
 }
 
-
 static void fixup_read_and_payload_sizes(struct pci_controller *controller)
 {
         gxio_trio_context_t *trio_context = controller->trio;
@@ -472,9 +568,7 @@ static void fixup_read_and_payload_sizes(struct pci_controller *controller)
 
         mac = controller->mac;
 
-        /*
-         * Set our max read request size to be 4KB.
-         */
+        /* Set our max read request size to be 4KB. */
         reg_offset =
                 (TRIO_PCIE_RC_DEVICE_CONTROL <<
                         TRIO_CFG_REGION_ADDR__REG_SHIFT) |
@@ -483,10 +577,10 @@ static void fixup_read_and_payload_sizes(struct pci_controller *controller)
                 (mac << TRIO_CFG_REGION_ADDR__MAC_SEL_SHIFT);
 
         dev_control.word = __gxio_mmio_read32(trio_context->mmio_base_mac +
-                                                reg_offset);
+                                              reg_offset);
         dev_control.max_read_req_sz = 5;
         __gxio_mmio_write32(trio_context->mmio_base_mac + reg_offset,
-                                                dev_control.word);
+                            dev_control.word);
 
         /*
          * Set the max payload size supported by this Gx PCIe MAC.
@@ -502,19 +596,14 @@ static void fixup_read_and_payload_sizes(struct pci_controller *controller)
                 (mac << TRIO_CFG_REGION_ADDR__MAC_SEL_SHIFT);
 
         rc_dev_cap.word = __gxio_mmio_read32(trio_context->mmio_base_mac +
-                                                reg_offset);
+                                             reg_offset);
         rc_dev_cap.mps_sup = 1;
         __gxio_mmio_write32(trio_context->mmio_base_mac + reg_offset,
-                                                rc_dev_cap.word);
+                            rc_dev_cap.word);
 
         /* Configure PCI Express MPS setting. */
-        list_for_each_entry(child, &root_bus->children, node) {
-                struct pci_dev *self = child->self;
-                if (!self)
-                        continue;
-
-                pcie_bus_configure_settings(child, self->pcie_mpss);
-        }
+        list_for_each_entry(child, &root_bus->children, node)
+                pcie_bus_configure_settings(child);
 
         /*
          * Set the mac_config register in trio based on the MPS/MRS of the link.
@@ -533,7 +622,7 @@ static void fixup_read_and_payload_sizes(struct pci_controller *controller)
                                     dev_control.max_payload_size,
                                     dev_control.max_read_req_sz,
                                     mac);
-        if (err < 0) {
+        if (err < 0) {
                 pr_err("PCI: PCIE_CONFIGURE_MAC_MPS_MRS failure, "
                         "MAC %d on TRIO %d\n",
                         mac, controller->trio_index);
@@ -570,21 +659,14 @@ static int setup_pcie_rc_delay(char *str)
                 if (!isdigit(*str))
                         return -EINVAL;
                 delay = simple_strtoul(str, (char **)&str, 10);
-                if (delay > MAX_RC_DELAY)
-                        return -EINVAL;
         }
 
         rc_delay[trio_index][mac] = delay ? : DEFAULT_RC_DELAY;
-        pr_info("Delaying PCIe RC link training for %u sec"
-                " on MAC %lu on TRIO %lu\n", rc_delay[trio_index][mac],
-                mac, trio_index);
         return 0;
 }
 early_param("pcie_rc_delay", setup_pcie_rc_delay);
 
-/*
- * PCI initialization entry point, called by subsys_initcall.
- */
+/* PCI initialization entry point, called by subsys_initcall. */
 int __init pcibios_init(void)
 {
         resource_size_t offset;
@@ -594,35 +676,10 @@ int __init pcibios_init(void)
 
         tile_pci_init();
 
-        if (num_rc_controllers == 0 && num_ep_controllers == 0)
+        if (num_rc_controllers == 0)
                 return 0;
 
         /*
-         * We loop over all the TRIO shims and set up the MMIO mappings.
-         */
-        for (i = 0; i < TILEGX_NUM_TRIO; i++) {
-                gxio_trio_context_t *context = &trio_contexts[i];
-
-                if (context->fd < 0)
-                        continue;
-
-                /*
-                 * Map in the MMIO space for the MAC.
-                 */
-                offset = 0;
-                context->mmio_base_mac =
-                        iorpc_ioremap(context->fd, offset,
-                                      HV_TRIO_CONFIG_IOREMAP_SIZE);
-                if (context->mmio_base_mac == NULL) {
-                        pr_err("PCI: MAC map failure on TRIO %d\n", i);
-
-                        hv_dev_close(context->fd);
-                        context->fd = -1;
-                        continue;
-                }
-        }
-
-        /*
          * Delay a bit in case devices aren't ready.  Some devices are
          * known to require at least 20ms here, but we use a more
          * conservative value.
@@ -633,7 +690,6 @@ int __init pcibios_init(void)
         for (next_busno = 0, i = 0; i < num_rc_controllers; i++) {
                 struct pci_controller *controller = &pci_controllers[i];
                 gxio_trio_context_t *trio_context = controller->trio;
-                TRIO_PCIE_INTFC_PORT_CONFIG_t port_config;
                 TRIO_PCIE_INTFC_PORT_STATUS_t port_status;
                 TRIO_PCIE_INTFC_TX_FIFO_CTL_t tx_fifo_ctl;
                 struct pci_bus *bus;
@@ -650,75 +706,64 @@ int __init pcibios_init(void)
                 mac = controller->mac;
 
                 /*
-                 * Check the port strap state which will override the BIB
-                 * setting.
+                 * Check for PCIe link-up status to decide if we need
+                 * to force the link to come up.
                  */
-
                 reg_offset =
-                        (TRIO_PCIE_INTFC_PORT_CONFIG <<
+                        (TRIO_PCIE_INTFC_PORT_STATUS <<
                                 TRIO_CFG_REGION_ADDR__REG_SHIFT) |
                         (TRIO_CFG_REGION_ADDR__INTFC_VAL_MAC_INTERFACE <<
-                                TRIO_CFG_REGION_ADDR__INTFC_SHIFT ) |
+                                TRIO_CFG_REGION_ADDR__INTFC_SHIFT) |
                         (mac << TRIO_CFG_REGION_ADDR__MAC_SEL_SHIFT);
 
-                port_config.word =
+                port_status.word =
                         __gxio_mmio_read(trio_context->mmio_base_mac +
                                          reg_offset);
-
-                if ((port_config.strap_state !=
-                        TRIO_PCIE_INTFC_PORT_CONFIG__STRAP_STATE_VAL_AUTO_CONFIG_RC) &&
-                        (port_config.strap_state !=
-                        TRIO_PCIE_INTFC_PORT_CONFIG__STRAP_STATE_VAL_AUTO_CONFIG_RC_G1)) {
-                        /*
-                         * If this is really intended to be an EP port,
-                         * record it so that the endpoint driver will know about it.
-                         */
-                        if (port_config.strap_state ==
-                        TRIO_PCIE_INTFC_PORT_CONFIG__STRAP_STATE_VAL_AUTO_CONFIG_ENDPOINT ||
-                        port_config.strap_state ==
-                        TRIO_PCIE_INTFC_PORT_CONFIG__STRAP_STATE_VAL_AUTO_CONFIG_ENDPOINT_G1)
-                                pcie_ports[trio_index][mac].allow_ep = 1;
-
-                        continue;
+                if (!port_status.dl_up) {
+                        if (rc_delay[trio_index][mac]) {
+                                pr_info("Delaying PCIe RC TRIO init %d sec"
+                                        " on MAC %d on TRIO %d\n",
+                                        rc_delay[trio_index][mac], mac,
+                                        trio_index);
+                                msleep(rc_delay[trio_index][mac] * 1000);
+                        }
+                        ret = gxio_trio_force_rc_link_up(trio_context, mac);
+                        if (ret < 0)
+                                pr_err("PCI: PCIE_FORCE_LINK_UP failure, "
+                                        "MAC %d on TRIO %d\n", mac, trio_index);
                 }
 
-                /*
-                 * Delay the RC link training if needed.
-                 */
-                if (rc_delay[trio_index][mac])
-                        msleep(rc_delay[trio_index][mac] * 1000);
-
-                ret = gxio_trio_force_rc_link_up(trio_context, mac);
-                if (ret < 0)
-                        pr_err("PCI: PCIE_FORCE_LINK_UP failure, "
-                                "MAC %d on TRIO %d\n", mac, trio_index);
-
                 pr_info("PCI: Found PCI controller #%d on TRIO %d MAC %d\n", i,
                         trio_index, controller->mac);
 
-                /*
-                 * Wait a bit here because some EP devices take longer
-                 * to come up.
-                 */
-                msleep(1000);
-
-                /*
-                 * Check for PCIe link-up status.
-                 */
-
-                reg_offset =
-                        (TRIO_PCIE_INTFC_PORT_STATUS <<
-                                TRIO_CFG_REGION_ADDR__REG_SHIFT) |
-                        (TRIO_CFG_REGION_ADDR__INTFC_VAL_MAC_INTERFACE <<
-                                TRIO_CFG_REGION_ADDR__INTFC_SHIFT ) |
-                        (mac << TRIO_CFG_REGION_ADDR__MAC_SEL_SHIFT);
+                /* Delay the bus probe if needed. */
+                if (rc_delay[trio_index][mac]) {
+                        pr_info("Delaying PCIe RC bus enumerating %d sec"
+                                " on MAC %d on TRIO %d\n",
+                                rc_delay[trio_index][mac], mac,
+                                trio_index);
+                        msleep(rc_delay[trio_index][mac] * 1000);
+                } else {
+                        /*
+                         * Wait a bit here because some EP devices
+                         * take longer to come up.
+                         */
+                        msleep(1000);
+                }
 
+                /* Check for PCIe link-up status again. */
                 port_status.word =
                         __gxio_mmio_read(trio_context->mmio_base_mac +
                                          reg_offset);
                 if (!port_status.dl_up) {
-                        pr_err("PCI: link is down, MAC %d on TRIO %d\n",
-                                mac, trio_index);
+                        if (pcie_ports[trio_index].ports[mac].removable) {
+                                pr_info("PCI: link is down, MAC %d on TRIO %d\n",
+                                        mac, trio_index);
+                                pr_info("This is expected if no PCIe card"
+                                        " is connected to this link\n");
+                        } else
+                                pr_err("PCI: link is down, MAC %d on TRIO %d\n",
+                                        mac, trio_index);
                         continue;
                 }
 
@@ -744,7 +789,6 @@ int __init pcibios_init(void)
                  * Change the device ID so that Linux bus crawl doesn't confuse
                  * the internal bridge with any Tilera endpoints.
                  */
-
                 reg_offset =
                         (TRIO_PCIE_RC_DEVICE_ID_VEN_ID <<
                                 TRIO_CFG_REGION_ADDR__REG_SHIFT) |
@@ -757,10 +801,7 @@ int __init pcibios_init(void)
                                     TRIO_PCIE_RC_DEVICE_ID_VEN_ID__DEV_ID_SHIFT) |
                                     TILERA_VENDOR_ID);
 
-                /*
-                 * Set the internal P2P bridge class code.
-                 */
-
+                /* Set the internal P2P bridge class code. */
                 reg_offset =
                         (TRIO_PCIE_RC_REVISION_ID <<
                                 TRIO_CFG_REGION_ADDR__REG_SHIFT) |
@@ -771,26 +812,22 @@ int __init pcibios_init(void)
                 class_code_revision =
                         __gxio_mmio_read32(trio_context->mmio_base_mac +
                                            reg_offset);
-                class_code_revision = (class_code_revision & 0xff ) |
-                                        (PCI_CLASS_BRIDGE_PCI << 16);
+                class_code_revision = (class_code_revision & 0xff) |
+                        (PCI_CLASS_BRIDGE_PCI << 16);
 
                 __gxio_mmio_write32(trio_context->mmio_base_mac +
                                     reg_offset, class_code_revision);
 
 #ifdef USE_SHARED_PCIE_CONFIG_REGION
 
-                /*
-                 * Map in the MMIO space for the PIO region.
-                 */
+                /* Map in the MMIO space for the PIO region. */
                 offset = HV_TRIO_PIO_OFFSET(trio_context->pio_cfg_index) |
                         (((unsigned long long)mac) <<
                         TRIO_TILE_PIO_REGION_SETUP_CFG_ADDR__MAC_SHIFT);
 
 #else
 
-                /*
-                 * Alloc a PIO region for PCI config access per MAC.
-                 */
+                /* Alloc a PIO region for PCI config access per MAC. */
                 ret = gxio_trio_alloc_pio_regions(trio_context, 1, 0, 0);
                 if (ret < 0) {
                         pr_err("PCI: PCI CFG PIO alloc failure for mac %d "
@@ -801,9 +838,7 @@ int __init pcibios_init(void)
 
                 trio_context->pio_cfg_index[mac] = ret;
 
-                /*
-                 * For PIO CFG, the bus_address_hi parameter is 0.
-                 */
+                /* For PIO CFG, the bus_address_hi parameter is 0. */
                 ret = gxio_trio_init_pio_region_aux(trio_context,
                         trio_context->pio_cfg_index[mac],
                         mac, 0, HV_TRIO_PIO_FLAG_CONFIG_SPACE);
@@ -820,9 +855,15 @@ int __init pcibios_init(void)
 
 #endif
 
+                /*
+                 * To save VMALLOC space, we take advantage of the fact that
+                 * bit 29 in the PIO CFG address format is reserved 0. With
+                 * TRIO_TILE_PIO_REGION_SETUP_CFG_ADDR__MAC_SHIFT being 30,
+                 * this cuts VMALLOC space usage from 1GB to 512MB per mac.
+                 */
                 trio_context->mmio_base_pio_cfg[mac] =
-                        iorpc_ioremap(trio_context->fd, offset,
-                        (1 << TRIO_TILE_PIO_REGION_SETUP_CFG_ADDR__MAC_SHIFT));
+                        iorpc_ioremap(trio_context->fd, offset, (1UL <<
+                        (TRIO_TILE_PIO_REGION_SETUP_CFG_ADDR__MAC_SHIFT - 1)));
                 if (trio_context->mmio_base_pio_cfg[mac] == NULL) {
                         pr_err("PCI: PIO map failure for mac %d on TRIO %d\n",
                                 mac, trio_index);
@@ -830,9 +871,7 @@ int __init pcibios_init(void)
                         continue;
                 }
 
-                /*
-                 * Initialize the PCIe interrupts.
-                 */
+                /* Initialize the PCIe interrupts. */
                 if (tile_init_irqs(controller)) {
                         pr_err("PCI: IRQs init failure for mac %d on TRIO %d\n",
                                 mac, trio_index);
@@ -843,17 +882,16 @@ int __init pcibios_init(void)
                 /*
                  * The PCI memory resource is located above the PA space.
                  * The memory range for the PCI root bus should not overlap
-                 * with the physical RAM
+                 * with the physical RAM.
                  */
                 pci_add_resource_offset(&resources, &controller->mem_space,
                                         controller->mem_offset);
-
+                pci_add_resource(&resources, &controller->io_space);
                 controller->first_busno = next_busno;
                 bus = pci_scan_root_bus(NULL, next_busno, controller->ops,
                                         controller, &resources);
                 controller->root_bus = bus;
                 next_busno = bus->busn_res.end + 1;
-
         }
 
         /* Do machine dependent PCI interrupt routing */
@@ -865,7 +903,6 @@ int __init pcibios_init(void)
          * It allocates all of the resources (I/O memory, etc)
          * associated with the devices read in above.
          */
-
         pci_assign_unassigned_resources();
 
         /* Record the I/O resources in the PCI controller structure. */
@@ -873,9 +910,6 @@ int __init pcibios_init(void)
                 struct pci_controller *controller = &pci_controllers[i];
                 gxio_trio_context_t *trio_context = controller->trio;
                 struct pci_bus *root_bus = pci_controllers[i].root_bus;
-                struct pci_bus *next_bus;
-                uint32_t bus_address_hi;
-                struct pci_dev *dev;
                 int ret;
                 int j;
 
@@ -889,43 +923,12 @@ int __init pcibios_init(void)
                 /* Configure the max_payload_size values for this domain. */
                 fixup_read_and_payload_sizes(controller);
 
-                list_for_each_entry(dev, &root_bus->devices, bus_list) {
-                        /* Find the PCI host controller, ie. the 1st bridge. */
-                        if ((dev->class >> 8) == PCI_CLASS_BRIDGE_PCI &&
-                                (PCI_SLOT(dev->devfn) == 0)) {
-                                next_bus = dev->subordinate;
-                                pci_controllers[i].mem_resources[0] =
-                                        *next_bus->resource[0];
-                                pci_controllers[i].mem_resources[1] =
-                                         *next_bus->resource[1];
-                                pci_controllers[i].mem_resources[2] =
-                                         *next_bus->resource[2];
-
-                                break;
-                        }
-                }
-
-                if (pci_controllers[i].mem_resources[1].flags & IORESOURCE_MEM)
-                        bus_address_hi =
-                                pci_controllers[i].mem_resources[1].start >> 32;
-                else if (pci_controllers[i].mem_resources[2].flags & IORESOURCE_PREFETCH)
-                        bus_address_hi =
-                                pci_controllers[i].mem_resources[2].start >> 32;
-                else {
-                        /* This is unlikely. */
-                        pr_err("PCI: no memory resources on TRIO %d mac %d\n",
-                                controller->trio_index, controller->mac);
-                        continue;
-                }
-
-                /*
-                 * Alloc a PIO region for PCI memory access for each RC port.
-                 */
+                /* Alloc a PIO region for PCI memory access for each RC port. */
                 ret = gxio_trio_alloc_pio_regions(trio_context, 1, 0, 0);
                 if (ret < 0) {
                         pr_err("PCI: MEM PIO alloc failure on TRIO %d mac %d, "
-                                "give up\n", controller->trio_index,
-                                controller->mac);
+                               "give up\n", controller->trio_index,
+                               controller->mac);
 
                         continue;
                 }
@@ -943,12 +946,45 @@ int __init pcibios_init(void)
                                                     0);
                 if (ret < 0) {
                         pr_err("PCI: MEM PIO init failure on TRIO %d mac %d, "
-                                "give up\n", controller->trio_index,
-                                controller->mac);
+                               "give up\n", controller->trio_index,
+                               controller->mac);
+
+                        continue;
+                }
+
+#ifdef CONFIG_TILE_PCI_IO
+                /*
+                 * Alloc a PIO region for PCI I/O space access for each RC port.
+                 */
+                ret = gxio_trio_alloc_pio_regions(trio_context, 1, 0, 0);
+                if (ret < 0) {
+                        pr_err("PCI: I/O PIO alloc failure on TRIO %d mac %d, "
+                               "give up\n", controller->trio_index,
+                               controller->mac);
 
                         continue;
                 }
 
+                controller->pio_io_index = ret;
+
+                /*
+                 * For PIO IO, the bus_address_hi parameter is hard-coded 0
+                 * because PCI I/O address space is 32-bit.
+                 */
+                ret = gxio_trio_init_pio_region_aux(trio_context,
+                                                    controller->pio_io_index,
+                                                    controller->mac,
+                                                    0,
+                                                    HV_TRIO_PIO_FLAG_IO_SPACE);
+                if (ret < 0) {
+                        pr_err("PCI: I/O PIO init failure on TRIO %d mac %d, "
+                               "give up\n", controller->trio_index,
+                               controller->mac);
+
+                        continue;
+                }
+#endif
+
                 /*
                  * Configure a Mem-Map region for each memory controller so
                  * that Linux can map all of its PA space to the PCI bus.
@@ -963,9 +999,9 @@ int __init pcibios_init(void)
                                                           0);
                         if (ret < 0) {
                                 pr_err("PCI: Mem-Map alloc failure on TRIO %d "
-                                        "mac %d for MC %d, give up\n",
-                                        controller->trio_index,
-                                        controller->mac, j);
+                                       "mac %d for MC %d, give up\n",
+                                       controller->trio_index,
+                                       controller->mac, j);
 
                                 goto alloc_mem_map_failed;
                         }
@@ -996,9 +1032,9 @@ int __init pcibios_init(void)
                                 GXIO_TRIO_ORDER_MODE_UNORDERED);
                         if (ret < 0) {
                                 pr_err("PCI: Mem-Map init failure on TRIO %d "
-                                        "mac %d for MC %d, give up\n",
-                                        controller->trio_index,
-                                        controller->mac, j);
+                                       "mac %d for MC %d, give up\n",
+                                       controller->trio_index,
+                                       controller->mac, j);
 
                                 goto alloc_mem_map_failed;
                         }
@@ -1007,23 +1043,19 @@ int __init pcibios_init(void)
 alloc_mem_map_failed:
                         break;
                 }
-
         }
 
         return 0;
 }
 subsys_initcall(pcibios_init);
 
-/* Note: to be deleted after Linux 3.6 merge. */
+/* No bus fixups needed. */
 void pcibios_fixup_bus(struct pci_bus *bus)
 {
 }
 
-/*
- * This can be called from the generic PCI layer, but doesn't need to
- * do anything.
- */
-char *pcibios_setup(char *str)
+/* Process any "pci=" kernel boot arguments. */
+char *__init pcibios_setup(char *str)
 {
         if (!strcmp(str, "off")) {
                 pci_probe = 0;
@@ -1034,8 +1066,7 @@ char *pcibios_setup(char *str)
 
 /*
  * Enable memory address decoding, as appropriate, for the
- * device described by the 'dev' struct. The I/O decoding
- * is disabled, though the TILE-Gx supports I/O addressing.
+ * device described by the 'dev' struct.
  *
  * This is called from the generic PCI layer, and can be called
  * for bridges or endpoints.
@@ -1045,13 +1076,24 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
         return pci_enable_resources(dev, mask);
 }
 
-/* Called for each device after PCI setup is done. */
+/*
+ * Called for each device after PCI setup is done.
+ * We initialize the PCI device capabilities conservatively, assuming that
+ * all devices can only address the 32-bit DMA space. The exception here is
+ * that the device dma_offset is set to the value that matches the 64-bit
+ * capable devices. This is OK because dma_offset is not used by legacy
+ * dma_ops, nor by the hybrid dma_ops's streaming DMAs, which are 64-bit ops.
+ * This implementation matches the kernel design of setting PCI devices'
+ * coherent_dma_mask to 0xffffffffull by default, allowing the device drivers
+ * to skip calling pci_set_consistent_dma_mask(DMA_BIT_MASK(32)).
+ */
 static void pcibios_fixup_final(struct pci_dev *pdev)
 {
-        set_dma_ops(&pdev->dev, gx_pci_dma_map_ops);
+        set_dma_ops(&pdev->dev, gx_legacy_pci_dma_map_ops);
         set_dma_offset(&pdev->dev, TILE_PCI_MEM_MAP_BASE_OFFSET);
         pdev->dev.archdata.max_direct_dma_addr =
                 TILE_PCI_MAX_DIRECT_DMA_ADDRESS;
+        pdev->dev.coherent_dma_mask = TILE_PCI_MAX_DIRECT_DMA_ADDRESS;
 }
 DECLARE_PCI_FIXUP_FINAL(PCI_ANY_ID, PCI_ANY_ID, pcibios_fixup_final);
 
@@ -1065,19 +1107,15 @@ void __iomem *ioremap(resource_size_t phys_addr, unsigned long size)
         resource_size_t start;
         resource_size_t end;
         int trio_fd;
-        int i, j;
+        int i;
 
         start = phys_addr;
         end = phys_addr + size - 1;
 
         /*
-         * In the following, each PCI controller's mem_resources[1]
-         * represents its (non-prefetchable) PCI memory resource and
-         * mem_resources[2] refers to its prefetchable PCI memory resource.
-         * By searching phys_addr in each controller's mem_resources[], we can
+         * By searching phys_addr in each controller's mem_space, we can
          * determine the controller that should accept the PCI memory access.
          */
-
         for (i = 0; i < num_rc_controllers; i++) {
                 /*
                  * Skip controllers that are not properly initialized or
@@ -1086,25 +1124,18 @@ void __iomem *ioremap(resource_size_t phys_addr, unsigned long size)
                 if (pci_controllers[i].root_bus == NULL)
                         continue;
 
-                for (j = 1; j < 3; j++) {
-                        bar_start =
-                                pci_controllers[i].mem_resources[j].start;
-                        bar_end =
-                                pci_controllers[i].mem_resources[j].end;
+                bar_start = pci_controllers[i].mem_space.start;
+                bar_end = pci_controllers[i].mem_space.end;
 
-                        if ((start >= bar_start) && (end <= bar_end)) {
-
-                                controller = &pci_controllers[i];
-
-                                goto got_it;
-                        }
+                if ((start >= bar_start) && (end <= bar_end)) {
+                        controller = &pci_controllers[i];
+                        break;
                 }
         }
 
         if (controller == NULL)
                 return NULL;
 
-got_it:
         trio_fd = controller->trio->fd;
 
         /* Convert the resource start to the bus address offset. */
@@ -1112,14 +1143,71 @@ got_it:
 
         offset = HV_TRIO_PIO_OFFSET(controller->pio_mem_index) + start;
 
-        /*
-         * We need to keep the PCI bus address's in-page offset in the VA.
-         */
+        /* We need to keep the PCI bus address's in-page offset in the VA. */
         return iorpc_ioremap(trio_fd, offset, size) +
-                (phys_addr & (PAGE_SIZE - 1));
+                (start & (PAGE_SIZE - 1));
 }
 EXPORT_SYMBOL(ioremap);
 
+#ifdef CONFIG_TILE_PCI_IO
+/* Map a PCI I/O address into VA space. */
+void __iomem *ioport_map(unsigned long port, unsigned int size)
+{
+        struct pci_controller *controller = NULL;
+        resource_size_t bar_start;
+        resource_size_t bar_end;
+        resource_size_t offset;
+        resource_size_t start;
+        resource_size_t end;
+        int trio_fd;
+        int i;
+
+        start = port;
+        end = port + size - 1;
+
+        /*
+         * By searching the port in each controller's io_space, we can
+         * determine the controller that should accept the PCI I/O access.
+         */
+        for (i = 0; i < num_rc_controllers; i++) {
+                /*
+                 * Skip controllers that are not properly initialized or
+                 * have down links.
+                 */
+                if (pci_controllers[i].root_bus == NULL)
+                        continue;
+
+                bar_start = pci_controllers[i].io_space.start;
+                bar_end = pci_controllers[i].io_space.end;
+
+                if ((start >= bar_start) && (end <= bar_end)) {
+                        controller = &pci_controllers[i];
+                        break;
+                }
+        }
+
+        if (controller == NULL)
+                return NULL;
+
+        trio_fd = controller->trio->fd;
+
+        /* Convert the resource start to the bus address offset. */
+        port -= controller->io_space.start;
+
+        offset = HV_TRIO_PIO_OFFSET(controller->pio_io_index) + port;
+
+        /* We need to keep the PCI bus address's in-page offset in the VA. */
+        return iorpc_ioremap(trio_fd, offset, size) + (port & (PAGE_SIZE - 1));
+}
+EXPORT_SYMBOL(ioport_map);
+
+void ioport_unmap(void __iomem *addr)
+{
+        iounmap(addr);
+}
+EXPORT_SYMBOL(ioport_unmap);
+#endif
+
 void pci_iounmap(struct pci_dev *dev, void __iomem *addr)
 {
         iounmap(addr);
@@ -1141,7 +1229,6 @@ EXPORT_SYMBOL(pci_iounmap);
  * offset is in bytes, from the start of config space for the
  * specified bus & device.
  */
-
 static int tile_cfg_read(struct pci_bus *bus, unsigned int devfn, int offset,
                          int size, u32 *val)
 {
@@ -1191,7 +1278,6 @@ static int tile_cfg_read(struct pci_bus *bus, unsigned int devfn, int offset,
          * Accesses to the directly attached device have to be
          * sent as type-0 configs.
          */
-
         if (busnum == (controller->first_busno + 1)) {
                 /*
                  * There is only one device off of our built-in P2P bridge.
@@ -1213,9 +1299,8 @@ static int tile_cfg_read(struct pci_bus *bus, unsigned int devfn, int offset,
          * Note that we don't set the mac field in cfg_addr because the
          * mapping is per port.
          */
-
         mmio_addr = trio_context->mmio_base_pio_cfg[controller->mac] +
-                        cfg_addr.word;
+                cfg_addr.word;
 
 valid_device:
 
@@ -1319,7 +1404,6 @@ static int tile_cfg_write(struct pci_bus *bus, unsigned int devfn, int offset,
          * Accesses to the directly attached device have to be
          * sent as type-0 configs.
          */
-
         if (busnum == (controller->first_busno + 1)) {
                 /*
                  * There is only one device off of our built-in P2P bridge.
@@ -1341,7 +1425,6 @@ static int tile_cfg_write(struct pci_bus *bus, unsigned int devfn, int offset,
          * Note that we don't set the mac field in cfg_addr because the
          * mapping is per port.
          */
-
         mmio_addr = trio_context->mmio_base_pio_cfg[controller->mac] +
                         cfg_addr.word;
 
@@ -1379,11 +1462,8 @@ static struct pci_ops tile_cfg_ops = {
 };
 
 
-/*
- * MSI support starts here.
- */
-static unsigned int
-tilegx_msi_startup(struct irq_data *d)
+/* MSI support starts here. */
+static unsigned int tilegx_msi_startup(struct irq_data *d)
 {
         if (d->msi_desc)
                 unmask_msi_irq(d);
@@ -1391,21 +1471,18 @@ tilegx_msi_startup(struct irq_data *d)
         return 0;
 }
 
-static void
-tilegx_msi_ack(struct irq_data *d)
+static void tilegx_msi_ack(struct irq_data *d)
 {
         __insn_mtspr(SPR_IPI_EVENT_RESET_K, 1UL << d->irq);
 }
 
-static void
-tilegx_msi_mask(struct irq_data *d)
+static void tilegx_msi_mask(struct irq_data *d)
 {
         mask_msi_irq(d);
         __insn_mtspr(SPR_IPI_MASK_SET_K, 1UL << d->irq);
 }
 
-static void
-tilegx_msi_unmask(struct irq_data *d)
+static void tilegx_msi_unmask(struct irq_data *d)
 {
         __insn_mtspr(SPR_IPI_MASK_RESET_K, 1UL << d->irq);
         unmask_msi_irq(d);
@@ -1462,32 +1539,55 @@ int arch_setup_msi_irq(struct pci_dev *pdev, struct msi_desc *desc)
         trio_context = controller->trio;
 
         /*
-         * Allocate the Mem-Map that will accept the MSI write and
-         * trigger the TILE-side interrupts.
+         * Allocate a scatter-queue that will accept the MSI write and
+         * trigger the TILE-side interrupts. We use the scatter-queue regions
+         * before the mem map regions, because the latter are needed by more
+         * applications.
          */
-        mem_map = gxio_trio_alloc_memory_maps(trio_context, 1, 0, 0);
-        if (mem_map < 0) {
-                dev_printk(KERN_INFO, &pdev->dev,
-                        "%s Mem-Map alloc failure. "
-                        "Failed to initialize MSI interrupts. "
-                        "Falling back to legacy interrupts.\n",
-                        desc->msi_attrib.is_msix ? "MSI-X" : "MSI");
+        mem_map = gxio_trio_alloc_scatter_queues(trio_context, 1, 0, 0);
+        if (mem_map >= 0) {
+                TRIO_MAP_SQ_DOORBELL_FMT_t doorbell_template = {{
+                        .pop = 0,
+                        .doorbell = 1,
+                }};
+
+                mem_map += TRIO_NUM_MAP_MEM_REGIONS;
+                mem_map_base = MEM_MAP_INTR_REGIONS_BASE +
+                        mem_map * MEM_MAP_INTR_REGION_SIZE;
+                mem_map_limit = mem_map_base + MEM_MAP_INTR_REGION_SIZE - 1;
+
+                msi_addr = mem_map_base + MEM_MAP_INTR_REGION_SIZE - 8;
+                msg.data = (unsigned int)doorbell_template.word;
+        } else {
+                /* SQ regions are out, allocate from map mem regions. */
+                mem_map = gxio_trio_alloc_memory_maps(trio_context, 1, 0, 0);
+                if (mem_map < 0) {
+                        dev_printk(KERN_INFO, &pdev->dev,
+                                "%s Mem-Map alloc failure. "
+                                "Failed to initialize MSI interrupts. "
+                                "Falling back to legacy interrupts.\n",
+                                desc->msi_attrib.is_msix ? "MSI-X" : "MSI");
+                        ret = -ENOMEM;
+                        goto msi_mem_map_alloc_failure;
+                }
 
-                ret = -ENOMEM;
-                goto msi_mem_map_alloc_failure;
+                mem_map_base = MEM_MAP_INTR_REGIONS_BASE +
+                        mem_map * MEM_MAP_INTR_REGION_SIZE;
+                mem_map_limit = mem_map_base + MEM_MAP_INTR_REGION_SIZE - 1;
+
+                msi_addr = mem_map_base + TRIO_MAP_MEM_REG_INT3 -
+                        TRIO_MAP_MEM_REG_INT0;
+
+                msg.data = mem_map;
         }
 
         /* We try to distribute different IRQs to different tiles. */
         cpu = tile_irq_cpu(irq);
 
         /*
-         * Now call up to the HV to configure the Mem-Map interrupt and
+         * Now call up to the HV to configure the MSI interrupt and
          * set up the IPI binding.
          */
-        mem_map_base = MEM_MAP_INTR_REGIONS_BASE +
-                mem_map * MEM_MAP_INTR_REGION_SIZE;
-        mem_map_limit = mem_map_base + MEM_MAP_INTR_REGION_SIZE - 1;
-
         ret = gxio_trio_config_msi_intr(trio_context, cpu_x(cpu), cpu_y(cpu),
                                         KERNEL_PL, irq, controller->mac,
                                         mem_map, mem_map_base, mem_map_limit,
@@ -1500,13 +1600,9 @@ int arch_setup_msi_irq(struct pci_dev *pdev, struct msi_desc *desc)
 
         irq_set_msi_desc(irq, desc);
 
-        msi_addr = mem_map_base + TRIO_MAP_MEM_REG_INT3 - TRIO_MAP_MEM_REG_INT0;
-
         msg.address_hi = msi_addr >> 32;
         msg.address_lo = msi_addr & 0xffffffff;
 
-        msg.data = mem_map;
-
         write_msi_msg(irq, &msg);
         irq_set_chip_and_handler(irq, &tilegx_msi_chip, handle_level_irq);
         irq_set_handler_data(irq, controller);
diff --git a/arch/tile/kernel/proc.c b/arch/tile/kernel/proc.c
index dafc447b5125..681100c59fda 100644
--- a/arch/tile/kernel/proc.c
+++ b/arch/tile/kernel/proc.c
@@ -113,7 +113,6 @@ arch_initcall(proc_tile_init);
  * Support /proc/sys/tile directory
  */
 
-#ifndef __tilegx__  /* FIXME: GX: no support for unaligned access yet */
 static ctl_table unaligned_subtable[] = {
         {
                 .procname       = "enabled",
@@ -160,4 +159,3 @@ static int __init proc_sys_tile_init(void)
 }
 
 arch_initcall(proc_sys_tile_init);
-#endif
diff --git a/arch/tile/kernel/process.c b/arch/tile/kernel/process.c
index 8ac304484f98..16ed58948757 100644
--- a/arch/tile/kernel/process.c
+++ b/arch/tile/kernel/process.c
@@ -33,6 +33,7 @@
 #include <asm/syscalls.h>
 #include <asm/traps.h>
 #include <asm/setup.h>
+#include <asm/uaccess.h>
 #ifdef CONFIG_HARDWALL
 #include <asm/hardwall.h>
 #endif
@@ -74,19 +75,6 @@ void arch_release_thread_info(struct thread_info *info)
 {
         struct single_step_state *step_state = info->step_state;
 
-#ifdef CONFIG_HARDWALL
-        /*
-         * We free a thread_info from the context of the task that has
-         * been scheduled next, so the original task is already dead.
-         * Calling deactivate here just frees up the data structures.
-         * If the task we're freeing held the last reference to a
-         * hardwall fd, it would have been released prior to this point
-         * anyway via exit_files(), and the hardwall_task.info pointers
-         * would be NULL by now.
-         */
-        hardwall_deactivate_all(info->task);
-#endif
-
         if (step_state) {
 
                 /*
@@ -160,6 +148,14 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
          */
         task_thread_info(p)->step_state = NULL;
 
+#ifdef __tilegx__
+        /*
+         * Do not clone unalign jit fixup from the parent; each thread
+         * must allocate its own on demand.
+         */
+        task_thread_info(p)->unalign_jit_base = NULL;
+#endif
+
         /*
          * Copy the registers onto the kernel stack so the
          * return-from-interrupt code will reload it into registers.
@@ -191,16 +187,8 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
         memset(&p->thread.dma_async_tlb, 0, sizeof(struct async_tlb));
 #endif
 
-#if CHIP_HAS_SN_PROC()
-        /* Likewise, the new thread is not running static processor code. */
-        p->thread.sn_proc_running = 0;
-        memset(&p->thread.sn_async_tlb, 0, sizeof(struct async_tlb));
-#endif
-
-#if CHIP_HAS_PROC_STATUS_SPR()
         /* New thread has its miscellaneous processor state bits clear. */
         p->thread.proc_status = 0;
-#endif
 
 #ifdef CONFIG_HARDWALL
         /* New thread does not own any networks. */
@@ -218,19 +206,32 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
         return 0;
 }
 
+int set_unalign_ctl(struct task_struct *tsk, unsigned int val)
+{
+        task_thread_info(tsk)->align_ctl = val;
+        return 0;
+}
+
+int get_unalign_ctl(struct task_struct *tsk, unsigned long adr)
+{
+        return put_user(task_thread_info(tsk)->align_ctl,
+                        (unsigned int __user *)adr);
+}
+
+static struct task_struct corrupt_current = { .comm = "<corrupt>" };
+
 /*
  * Return "current" if it looks plausible, or else a pointer to a dummy.
  * This can be helpful if we are just trying to emit a clean panic.
  */
 struct task_struct *validate_current(void)
 {
-        static struct task_struct corrupt = { .comm = "<corrupt>" };
         struct task_struct *tsk = current;
         if (unlikely((unsigned long)tsk < PAGE_OFFSET ||
                      (high_memory && (void *)tsk > high_memory) ||
                      ((unsigned long)tsk & (__alignof__(*tsk) - 1)) != 0)) {
                 pr_err("Corrupt 'current' %p (sp %#lx)\n", tsk, stack_pointer);
-                tsk = &corrupt;
+                tsk = &corrupt_current;
         }
         return tsk;
 }
@@ -369,15 +370,11 @@ static void save_arch_state(struct thread_struct *t)
         t->system_save[2] = __insn_mfspr(SPR_SYSTEM_SAVE_0_2);
         t->system_save[3] = __insn_mfspr(SPR_SYSTEM_SAVE_0_3);
         t->intctrl_0 = __insn_mfspr(SPR_INTCTRL_0_STATUS);
-#if CHIP_HAS_PROC_STATUS_SPR()
         t->proc_status = __insn_mfspr(SPR_PROC_STATUS);
-#endif
 #if !CHIP_HAS_FIXED_INTVEC_BASE()
         t->interrupt_vector_base = __insn_mfspr(SPR_INTERRUPT_VECTOR_BASE_0);
 #endif
-#if CHIP_HAS_TILE_RTF_HWM()
         t->tile_rtf_hwm = __insn_mfspr(SPR_TILE_RTF_HWM);
-#endif
 #if CHIP_HAS_DSTREAM_PF()
         t->dstream_pf = __insn_mfspr(SPR_DSTREAM_PF);
 #endif
@@ -398,15 +395,11 @@ static void restore_arch_state(const struct thread_struct *t)
         __insn_mtspr(SPR_SYSTEM_SAVE_0_2, t->system_save[2]);
         __insn_mtspr(SPR_SYSTEM_SAVE_0_3, t->system_save[3]);
         __insn_mtspr(SPR_INTCTRL_0_STATUS, t->intctrl_0);
-#if CHIP_HAS_PROC_STATUS_SPR()
         __insn_mtspr(SPR_PROC_STATUS, t->proc_status);
-#endif
 #if !CHIP_HAS_FIXED_INTVEC_BASE()
         __insn_mtspr(SPR_INTERRUPT_VECTOR_BASE_0, t->interrupt_vector_base);
 #endif
-#if CHIP_HAS_TILE_RTF_HWM()
         __insn_mtspr(SPR_TILE_RTF_HWM, t->tile_rtf_hwm);
-#endif
 #if CHIP_HAS_DSTREAM_PF()
         __insn_mtspr(SPR_DSTREAM_PF, t->dstream_pf);
 #endif
@@ -415,26 +408,11 @@ static void restore_arch_state(const struct thread_struct *t)
 
 void _prepare_arch_switch(struct task_struct *next)
 {
-#if CHIP_HAS_SN_PROC()
-        int snctl;
-#endif
 #if CHIP_HAS_TILE_DMA()
         struct tile_dma_state *dma = &current->thread.tile_dma_state;
         if (dma->enabled)
                 save_tile_dma_state(dma);
 #endif
-#if CHIP_HAS_SN_PROC()
-        /*
-         * Suspend the static network processor if it was running.
-         * We do not suspend the fabric itself, just like we don't
-         * try to suspend the UDN.
-         */
-        snctl = __insn_mfspr(SPR_SNCTL);
-        current->thread.sn_proc_running =
-                (snctl & SPR_SNCTL__FRZPROC_MASK) == 0;
-        if (current->thread.sn_proc_running)
-                __insn_mtspr(SPR_SNCTL, snctl | SPR_SNCTL__FRZPROC_MASK);
-#endif
 }
 
 
@@ -462,17 +440,6 @@ struct task_struct *__sched _switch_to(struct task_struct *prev,
         /* Restore other arch state. */
         restore_arch_state(&next->thread);
 
-#if CHIP_HAS_SN_PROC()
-        /*
-         * Restart static network processor in the new process
-         * if it was running before.
-         */
-        if (next->thread.sn_proc_running) {
-                int snctl = __insn_mfspr(SPR_SNCTL);
-                __insn_mtspr(SPR_SNCTL, snctl & ~SPR_SNCTL__FRZPROC_MASK);
-        }
-#endif
-
 #ifdef CONFIG_HARDWALL
         /* Enable or disable access to the network registers appropriately. */
         hardwall_switch_tasks(prev, next);
@@ -514,7 +481,7 @@ int do_work_pending(struct pt_regs *regs, u32 thread_info_flags)
                 schedule();
                 return 1;
         }
-#if CHIP_HAS_TILE_DMA() || CHIP_HAS_SN_PROC()
+#if CHIP_HAS_TILE_DMA()
         if (thread_info_flags & _TIF_ASYNC_TLB) {
                 do_async_page_fault(regs);
                 return 1;
@@ -564,7 +531,15 @@ void flush_thread(void)
  */
 void exit_thread(void)
 {
-        /* Nothing */
+#ifdef CONFIG_HARDWALL
+        /*
+         * Remove the task from the list of tasks that are associated
+         * with any live hardwalls.  (If the task that is exiting held
+         * the last reference to a hardwall fd, it would already have
+         * been released and deactivated at this point.)
+         */
+        hardwall_deactivate_all(current);
+#endif
 }
 
 void show_regs(struct pt_regs *regs)
@@ -573,23 +548,24 @@ void show_regs(struct pt_regs *regs)
         int i;
 
         pr_err("\n");
-        show_regs_print_info(KERN_ERR);
+        if (tsk != &corrupt_current)
+                show_regs_print_info(KERN_ERR);
 #ifdef __tilegx__
-        for (i = 0; i < 51; i += 3)
+        for (i = 0; i < 17; i++)
                 pr_err(" r%-2d: "REGFMT" r%-2d: "REGFMT" r%-2d: "REGFMT"\n",
-                       i, regs->regs[i], i+1, regs->regs[i+1],
-                       i+2, regs->regs[i+2]);
-        pr_err(" r51: "REGFMT" r52: "REGFMT" tp : "REGFMT"\n",
-               regs->regs[51], regs->regs[52], regs->tp);
+                       i, regs->regs[i], i+18, regs->regs[i+18],
+                       i+36, regs->regs[i+36]);
+        pr_err(" r17: "REGFMT" r35: "REGFMT" tp : "REGFMT"\n",
+               regs->regs[17], regs->regs[35], regs->tp);
         pr_err(" sp : "REGFMT" lr : "REGFMT"\n", regs->sp, regs->lr);
 #else
-        for (i = 0; i < 52; i += 4)
+        for (i = 0; i < 13; i++)
                 pr_err(" r%-2d: "REGFMT" r%-2d: "REGFMT
                        " r%-2d: "REGFMT" r%-2d: "REGFMT"\n",
-                       i, regs->regs[i], i+1, regs->regs[i+1],
-                       i+2, regs->regs[i+2], i+3, regs->regs[i+3]);
-        pr_err(" r52: "REGFMT" tp : "REGFMT" sp : "REGFMT" lr : "REGFMT"\n",
-               regs->regs[52], regs->tp, regs->sp, regs->lr);
+                       i, regs->regs[i], i+14, regs->regs[i+14],
+                       i+27, regs->regs[i+27], i+40, regs->regs[i+40]);
+        pr_err(" r13: "REGFMT" tp : "REGFMT" sp : "REGFMT" lr : "REGFMT"\n",
+               regs->regs[13], regs->tp, regs->sp, regs->lr);
 #endif
         pr_err(" pc : "REGFMT" ex1: %ld     faultnum: %ld\n",
                regs->pc, regs->ex1, regs->faultnum);
diff --git a/arch/tile/kernel/ptrace.c b/arch/tile/kernel/ptrace.c
index 0f83ed4602b2..de98c6ddf136 100644
--- a/arch/tile/kernel/ptrace.c
+++ b/arch/tile/kernel/ptrace.c
@@ -265,6 +265,21 @@ int do_syscall_trace_enter(struct pt_regs *regs)
 
 void do_syscall_trace_exit(struct pt_regs *regs)
 {
+        long errno;
+
+        /*
+         * The standard tile calling convention returns the value (or negative
+         * errno) in r0, and zero (or positive errno) in r1.
+         * It saves a couple of cycles on the hot path to do this work in
+         * registers only as we return, rather than updating the in-memory
+         * struct ptregs.
+         */
+        errno = (long) regs->regs[0];
+        if (errno < 0 && errno > -4096)
+                regs->regs[1] = -errno;
+        else
+                regs->regs[1] = 0;
+
         if (test_thread_flag(TIF_SYSCALL_TRACE))
                 tracehook_report_syscall_exit(regs, 0);
 
@@ -272,7 +287,7 @@ void do_syscall_trace_exit(struct pt_regs *regs)
                 trace_sys_exit(regs, regs->regs[0]);
 }
 
-void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, int error_code)
+void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs)
 {
         struct siginfo info;
 
@@ -288,5 +303,5 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, int error_code)
 /* Handle synthetic interrupt delivered only by the simulator. */
 void __kprobes do_breakpoint(struct pt_regs* regs, int fault_num)
 {
-        send_sigtrap(current, regs, fault_num);
+        send_sigtrap(current, regs);
 }
diff --git a/arch/tile/kernel/reboot.c b/arch/tile/kernel/reboot.c
index d1b5c913ae72..6c5d2c070a12 100644
--- a/arch/tile/kernel/reboot.c
+++ b/arch/tile/kernel/reboot.c
@@ -27,7 +27,6 @@
 
 void machine_halt(void)
 {
-        warn_early_printk();
         arch_local_irq_disable_all();
         smp_send_stop();
         hv_halt();
@@ -35,7 +34,6 @@ void machine_halt(void)
 
 void machine_power_off(void)
 {
-        warn_early_printk();
         arch_local_irq_disable_all();
         smp_send_stop();
         hv_power_off();
diff --git a/arch/tile/kernel/regs_32.S b/arch/tile/kernel/regs_32.S
index c12280c2d904..542cae17a93a 100644
--- a/arch/tile/kernel/regs_32.S
+++ b/arch/tile/kernel/regs_32.S
@@ -20,7 +20,7 @@
 #include <asm/switch_to.h>
 
 /*
- * See <asm/system.h>; called with prev and next task_struct pointers.
+ * See <asm/switch_to.h>; called with prev and next task_struct pointers.
  * "prev" is returned in r0 for _switch_to and also for ret_from_fork.
  *
  * We want to save pc/sp in "prev", and get the new pc/sp from "next".
@@ -39,7 +39,7 @@
  */
 
 #if CALLEE_SAVED_REGS_COUNT != 24
-# error Mismatch between <asm/system.h> and kernel/entry.S
+# error Mismatch between <asm/switch_to.h> and kernel/entry.S
 #endif
 #define FRAME_SIZE ((2 + CALLEE_SAVED_REGS_COUNT) * 4)
 
diff --git a/arch/tile/kernel/regs_64.S b/arch/tile/kernel/regs_64.S
index 0829fd01fa30..bbffcc6f340f 100644
--- a/arch/tile/kernel/regs_64.S
+++ b/arch/tile/kernel/regs_64.S
@@ -20,7 +20,7 @@
 #include <asm/switch_to.h>
 
 /*
- * See <asm/system.h>; called with prev and next task_struct pointers.
+ * See <asm/switch_to.h>; called with prev and next task_struct pointers.
  * "prev" is returned in r0 for _switch_to and also for ret_from_fork.
  *
  * We want to save pc/sp in "prev", and get the new pc/sp from "next".
@@ -39,7 +39,7 @@
  */
 
 #if CALLEE_SAVED_REGS_COUNT != 24
-# error Mismatch between <asm/system.h> and kernel/entry.S
+# error Mismatch between <asm/switch_to.h> and kernel/entry.S
 #endif
 #define FRAME_SIZE ((2 + CALLEE_SAVED_REGS_COUNT) * 8)
 
diff --git a/arch/tile/kernel/relocate_kernel_32.S b/arch/tile/kernel/relocate_kernel_32.S
index 010b418515f8..e44fbcf8cbd5 100644
--- a/arch/tile/kernel/relocate_kernel_32.S
+++ b/arch/tile/kernel/relocate_kernel_32.S
@@ -20,15 +20,6 @@
 #include <asm/page.h>
 #include <hv/hypervisor.h>
 
-#define ___hvb  MEM_SV_INTRPT + HV_GLUE_START_CPA
-
-#define ___hv_dispatch(f) (___hvb + (HV_DISPATCH_ENTRY_SIZE * f))
-
-#define ___hv_console_putc ___hv_dispatch(HV_DISPATCH_CONSOLE_PUTC)
-#define ___hv_halt         ___hv_dispatch(HV_DISPATCH_HALT)
-#define ___hv_reexec       ___hv_dispatch(HV_DISPATCH_REEXEC)
-#define ___hv_flush_remote ___hv_dispatch(HV_DISPATCH_FLUSH_REMOTE)
-
 #undef RELOCATE_NEW_KERNEL_VERBOSE
 
 STD_ENTRY(relocate_new_kernel)
@@ -43,8 +34,8 @@ STD_ENTRY(relocate_new_kernel)
         addi    sp, sp, -8
         /* we now have a stack (whether we need one or not) */
 
-        moveli  r40, lo16(___hv_console_putc)
-        auli    r40, r40, ha16(___hv_console_putc)
+        moveli  r40, lo16(hv_console_putc)
+        auli    r40, r40, ha16(hv_console_putc)
 
 #ifdef RELOCATE_NEW_KERNEL_VERBOSE
         moveli  r0, 'r'
@@ -86,7 +77,6 @@ STD_ENTRY(relocate_new_kernel)
         move    r30, sp
         addi    sp, sp, -8
 
-#if CHIP_HAS_CBOX_HOME_MAP()
         /*
          * On TILEPro, we need to flush all tiles' caches, since we may
          * have been doing hash-for-home caching there.  Note that we
@@ -114,15 +104,14 @@ STD_ENTRY(relocate_new_kernel)
         }
         {
          move   r8, zero         /* asids */
-         moveli r20, lo16(___hv_flush_remote)
+         moveli r20, lo16(hv_flush_remote)
         }
         {
          move   r9, zero         /* asidcount */
-         auli   r20, r20, ha16(___hv_flush_remote)
+         auli   r20, r20, ha16(hv_flush_remote)
         }
 
         jalr    r20
-#endif
 
         /* r33 is destination pointer, default to zero */
 
@@ -175,8 +164,8 @@ STD_ENTRY(relocate_new_kernel)
         move    r0, r32
         moveli  r1, 0           /* arg to hv_reexec is 64 bits */
 
-        moveli  r41, lo16(___hv_reexec)
-        auli    r41, r41, ha16(___hv_reexec)
+        moveli  r41, lo16(hv_reexec)
+        auli    r41, r41, ha16(hv_reexec)
 
         jalr    r41
 
@@ -267,8 +256,8 @@ STD_ENTRY(relocate_new_kernel)
         moveli  r0, '\n'
         jalr    r40
 .Lhalt:
-        moveli  r41, lo16(___hv_halt)
-        auli    r41, r41, ha16(___hv_halt)
+        moveli  r41, lo16(hv_halt)
+        auli    r41, r41, ha16(hv_halt)
 
         jalr    r41
         STD_ENDPROC(relocate_new_kernel)
diff --git a/arch/tile/kernel/relocate_kernel_64.S b/arch/tile/kernel/relocate_kernel_64.S
index 1c09a4f5a4ea..d9d8cf6176e8 100644
--- a/arch/tile/kernel/relocate_kernel_64.S
+++ b/arch/tile/kernel/relocate_kernel_64.S
@@ -34,11 +34,11 @@ STD_ENTRY(relocate_new_kernel)
         addi    sp, sp, -8
         /* we now have a stack (whether we need one or not) */
 
+#ifdef RELOCATE_NEW_KERNEL_VERBOSE
         moveli  r40, hw2_last(hv_console_putc)
         shl16insli r40, r40, hw1(hv_console_putc)
         shl16insli r40, r40, hw0(hv_console_putc)
 
-#ifdef RELOCATE_NEW_KERNEL_VERBOSE
         moveli  r0, 'r'
         jalr    r40
 
@@ -78,7 +78,6 @@ STD_ENTRY(relocate_new_kernel)
         move    r30, sp
         addi    sp, sp, -16
 
-#if CHIP_HAS_CBOX_HOME_MAP()
         /*
          * On TILE-GX, we need to flush all tiles' caches, since we may
          * have been doing hash-for-home caching there.  Note that we
@@ -116,7 +115,6 @@ STD_ENTRY(relocate_new_kernel)
         shl16insli      r20, r20, hw0(hv_flush_remote)
 
         jalr    r20
-#endif
 
         /* r33 is destination pointer, default to zero */
 
@@ -176,10 +174,12 @@ STD_ENTRY(relocate_new_kernel)
 
         /* we should not get here */
 
+#ifdef RELOCATE_NEW_KERNEL_VERBOSE
         moveli  r0, '?'
         jalr    r40
         moveli  r0, '\n'
         jalr    r40
+#endif
 
         j       .Lhalt
 
@@ -237,7 +237,9 @@ STD_ENTRY(relocate_new_kernel)
         j       .Lloop
 
 
-.Lerr:  moveli  r0, 'e'
+.Lerr:
+#ifdef RELOCATE_NEW_KERNEL_VERBOSE
+        moveli  r0, 'e'
         jalr    r40
         moveli  r0, 'r'
         jalr    r40
@@ -245,6 +247,7 @@ STD_ENTRY(relocate_new_kernel)
         jalr    r40
         moveli  r0, '\n'
         jalr    r40
+#endif
 .Lhalt:
         moveli r41, hw2_last(hv_halt)
         shl16insli r41, r41, hw1(hv_halt)
diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
index eceb8344280f..4c34caea9dd3 100644
--- a/arch/tile/kernel/setup.c
+++ b/arch/tile/kernel/setup.c
@@ -154,6 +154,65 @@ static int __init setup_maxnodemem(char *str)
 }
 early_param("maxnodemem", setup_maxnodemem);
 
+struct memmap_entry {
+        u64 addr;       /* start of memory segment */
+        u64 size;       /* size of memory segment */
+};
+static struct memmap_entry memmap_map[64];
+static int memmap_nr;
+
+static void add_memmap_region(u64 addr, u64 size)
+{
+        if (memmap_nr >= ARRAY_SIZE(memmap_map)) {
+                pr_err("Ooops! Too many entries in the memory map!\n");
+                return;
+        }
+        memmap_map[memmap_nr].addr = addr;
+        memmap_map[memmap_nr].size = size;
+        memmap_nr++;
+}
+
+static int __init setup_memmap(char *p)
+{
+        char *oldp;
+        u64 start_at, mem_size;
+
+        if (!p)
+                return -EINVAL;
+
+        if (!strncmp(p, "exactmap", 8)) {
+                pr_err("\"memmap=exactmap\" not valid on tile\n");
+                return 0;
+        }
+
+        oldp = p;
+        mem_size = memparse(p, &p);
+        if (p == oldp)
+                return -EINVAL;
+
+        if (*p == '@') {
+                pr_err("\"memmap=nn@ss\" (force RAM) invalid on tile\n");
+        } else if (*p == '#') {
+                pr_err("\"memmap=nn#ss\" (force ACPI data) invalid on tile\n");
+        } else if (*p == '$') {
+                start_at = memparse(p+1, &p);
+                add_memmap_region(start_at, mem_size);
+        } else {
+                if (mem_size == 0)
+                        return -EINVAL;
+                maxmem_pfn = (mem_size >> HPAGE_SHIFT) <<
+                        (HPAGE_SHIFT - PAGE_SHIFT);
+        }
+        return *p == '\0' ? 0 : -EINVAL;
+}
+early_param("memmap", setup_memmap);
+
+static int __init setup_mem(char *str)
+{
+        return setup_maxmem(str);
+}
+early_param("mem", setup_mem);  /* compatibility with x86 */
+
 static int __init setup_isolnodes(char *str)
 {
         char buf[MAX_NUMNODES * 5];
@@ -209,7 +268,7 @@ early_param("vmalloc", parse_vmalloc);
 /*
  * Determine for each controller where its lowmem is mapped and how much of
  * it is mapped there.  On controller zero, the first few megabytes are
- * already mapped in as code at MEM_SV_INTRPT, so in principle we could
+ * already mapped in as code at MEM_SV_START, so in principle we could
  * start our data mappings higher up, but for now we don't bother, to avoid
  * additional confusion.
  *
@@ -614,11 +673,12 @@ static void __init setup_bootmem_allocator_node(int i)
         /*
          * Throw away any memory aliased by the PCI region.
          */
-        if (pci_reserve_start_pfn < end && pci_reserve_end_pfn > start)
-                reserve_bootmem(PFN_PHYS(pci_reserve_start_pfn),
-                                PFN_PHYS(pci_reserve_end_pfn -
-                                         pci_reserve_start_pfn),
+        if (pci_reserve_start_pfn < end && pci_reserve_end_pfn > start) {
+                start = max(pci_reserve_start_pfn, start);
+                end = min(pci_reserve_end_pfn, end);
+                reserve_bootmem(PFN_PHYS(start), PFN_PHYS(end - start),
                                 BOOTMEM_EXCLUSIVE);
+        }
 #endif
 }
 
@@ -628,6 +688,31 @@ static void __init setup_bootmem_allocator(void)
         for (i = 0; i < MAX_NUMNODES; ++i)
                 setup_bootmem_allocator_node(i);
 
+        /* Reserve any memory excluded by "memmap" arguments. */
+        for (i = 0; i < memmap_nr; ++i) {
+                struct memmap_entry *m = &memmap_map[i];
+                reserve_bootmem(m->addr, m->size, 0);
+        }
+
+#ifdef CONFIG_BLK_DEV_INITRD
+        if (initrd_start) {
+                /* Make sure the initrd memory region is not modified. */
+                if (reserve_bootmem(initrd_start, initrd_end - initrd_start,
+                                    BOOTMEM_EXCLUSIVE)) {
+                        pr_crit("The initrd memory region has been polluted. Disabling it.\n");
+                        initrd_start = 0;
+                        initrd_end = 0;
+                } else {
+                        /*
+                         * Translate initrd_start & initrd_end from PA to VA for
+                         * future access.
+                         */
+                        initrd_start += PAGE_OFFSET;
+                        initrd_end += PAGE_OFFSET;
+                }
+        }
+#endif
+
 #ifdef CONFIG_KEXEC
         if (crashk_res.start != crashk_res.end)
                 reserve_bootmem(crashk_res.start, resource_size(&crashk_res), 0);
@@ -961,9 +1046,6 @@ void setup_cpu(int boot)
         arch_local_irq_unmask(INT_DMATLB_MISS);
         arch_local_irq_unmask(INT_DMATLB_ACCESS);
 #endif
-#if CHIP_HAS_SN_PROC()
-        arch_local_irq_unmask(INT_SNITLB_MISS);
-#endif
 #ifdef __tilegx__
         arch_local_irq_unmask(INT_SINGLE_STEP_K);
 #endif
@@ -978,10 +1060,6 @@ void setup_cpu(int boot)
         /* Static network is not restricted. */
         __insn_mtspr(SPR_MPL_SN_ACCESS_SET_0, 1);
 #endif
-#if CHIP_HAS_SN_PROC()
-        __insn_mtspr(SPR_MPL_SN_NOTIFY_SET_0, 1);
-        __insn_mtspr(SPR_MPL_SN_CPL_SET_0, 1);
-#endif
 
         /*
          * Set the MPL for interrupt control 0 & 1 to the corresponding
@@ -1029,6 +1107,10 @@ static void __init load_hv_initrd(void)
         int fd, rc;
         void *initrd;
 
+        /* If initrd has already been set, skip initramfs file in hvfs. */
+        if (initrd_start)
+                return;
+
         fd = hv_fs_findfile((HV_VirtAddr) initramfs_file);
         if (fd == HV_ENOENT) {
                 if (set_initramfs_file) {
@@ -1067,6 +1149,25 @@ void __init free_initrd_mem(unsigned long begin, unsigned long end)
         free_bootmem(__pa(begin), end - begin);
 }
 
+static int __init setup_initrd(char *str)
+{
+        char *endp;
+        unsigned long initrd_size;
+
+        initrd_size = str ? simple_strtoul(str, &endp, 0) : 0;
+        if (initrd_size == 0 || *endp != '@')
+                return -EINVAL;
+
+        initrd_start = simple_strtoul(endp+1, &endp, 0);
+        if (initrd_start == 0)
+                return -EINVAL;
+
+        initrd_end = initrd_start + initrd_size;
+
+        return 0;
+}
+early_param("initrd", setup_initrd);
+
 #else
 static inline void load_hv_initrd(void) {}
 #endif /* CONFIG_BLK_DEV_INITRD */
@@ -1134,7 +1235,7 @@ static void __init validate_va(void)
 #ifndef __tilegx__   /* FIXME: GX: probably some validation relevant here */
         /*
          * Similarly, make sure we're only using allowed VAs.
-         * We assume we can contiguously use MEM_USER_INTRPT .. MEM_HV_INTRPT,
+         * We assume we can contiguously use MEM_USER_INTRPT .. MEM_HV_START,
          * and 0 .. KERNEL_HIGH_VADDR.
          * In addition, make sure we CAN'T use the end of memory, since
          * we use the last chunk of each pgd for the pgd_list.
@@ -1149,7 +1250,7 @@ static void __init validate_va(void)
                 if (range.size == 0)
                         break;
                 if (range.start <= MEM_USER_INTRPT &&
-                    range.start + range.size >= MEM_HV_INTRPT)
+                    range.start + range.size >= MEM_HV_START)
                         user_kernel_ok = 1;
                 if (range.start == 0)
                         max_va = range.size;
@@ -1183,7 +1284,6 @@ static void __init validate_va(void)
 struct cpumask __write_once cpu_lotar_map;
 EXPORT_SYMBOL(cpu_lotar_map);
 
-#if CHIP_HAS_CBOX_HOME_MAP()
 /*
  * hash_for_home_map lists all the tiles that hash-for-home data
  * will be cached on.  Note that this may includes tiles that are not
@@ -1193,7 +1293,6 @@ EXPORT_SYMBOL(cpu_lotar_map);
  */
 struct cpumask hash_for_home_map;
 EXPORT_SYMBOL(hash_for_home_map);
-#endif
 
 /*
  * cpu_cacheable_map lists all the cpus whose caches the hypervisor can
@@ -1286,7 +1385,6 @@ static void __init setup_cpu_maps(void)
                 cpu_lotar_map = *cpu_possible_mask;
         }
 
-#if CHIP_HAS_CBOX_HOME_MAP()
         /* Retrieve set of CPUs used for hash-for-home caching */
         rc = hv_inquire_tiles(HV_INQ_TILES_HFH_CACHE,
                               (HV_VirtAddr) hash_for_home_map.bits,
@@ -1294,9 +1392,6 @@ static void __init setup_cpu_maps(void)
         if (rc < 0)
                 early_panic("hv_inquire_tiles(HFH_CACHE) failed: rc %d\n", rc);
         cpumask_or(&cpu_cacheable_map, cpu_possible_mask, &hash_for_home_map);
-#else
-        cpu_cacheable_map = *cpu_possible_mask;
-#endif
 }
 
 
@@ -1492,7 +1587,7 @@ void __init setup_per_cpu_areas(void)
 
                         /* Update the vmalloc mapping and page home. */
                         unsigned long addr = (unsigned long)ptr + i;
-                        pte_t *ptep = virt_to_pte(NULL, addr);
+                        pte_t *ptep = virt_to_kpte(addr);
                         pte_t pte = *ptep;
                         BUG_ON(pfn != pte_pfn(pte));
                         pte = hv_pte_set_mode(pte, HV_PTE_MODE_CACHE_TILE_L3);
@@ -1501,12 +1596,12 @@ void __init setup_per_cpu_areas(void)
 
                         /* Update the lowmem mapping for consistency. */
                         lowmem_va = (unsigned long)pfn_to_kaddr(pfn);
-                        ptep = virt_to_pte(NULL, lowmem_va);
+                        ptep = virt_to_kpte(lowmem_va);
                         if (pte_huge(*ptep)) {
                                 printk(KERN_DEBUG "early shatter of huge page"
                                        " at %#lx\n", lowmem_va);
                                 shatter_pmd((pmd_t *)ptep);
-                                ptep = virt_to_pte(NULL, lowmem_va);
+                                ptep = virt_to_kpte(lowmem_va);
                                 BUG_ON(pte_huge(*ptep));
                         }
                         BUG_ON(pfn != pte_pfn(*ptep));
@@ -1548,6 +1643,8 @@ insert_non_bus_resource(void)
 {
         struct resource *res =
                 kzalloc(sizeof(struct resource), GFP_ATOMIC);
+        if (!res)
+                return NULL;
         res->name = "Non-Bus Physical Address Space";
         res->start = (1ULL << 32);
         res->end = -1LL;
@@ -1561,11 +1658,13 @@ insert_non_bus_resource(void)
 #endif
 
 static struct resource* __init
-insert_ram_resource(u64 start_pfn, u64 end_pfn)
+insert_ram_resource(u64 start_pfn, u64 end_pfn, bool reserved)
 {
         struct resource *res =
                 kzalloc(sizeof(struct resource), GFP_ATOMIC);
-        res->name = "System RAM";
+        if (!res)
+                return NULL;
+        res->name = reserved ? "Reserved" : "System RAM";
         res->start = start_pfn << PAGE_SHIFT;
         res->end = (end_pfn << PAGE_SHIFT) - 1;
         res->flags = IORESOURCE_BUSY | IORESOURCE_MEM;
@@ -1585,7 +1684,7 @@ insert_ram_resource(u64 start_pfn, u64 end_pfn)
 static int __init request_standard_resources(void)
 {
         int i;
-        enum { CODE_DELTA = MEM_SV_INTRPT - PAGE_OFFSET };
+        enum { CODE_DELTA = MEM_SV_START - PAGE_OFFSET };
 
 #if defined(CONFIG_PCI) && !defined(__tilegx__)
         insert_non_bus_resource();
@@ -1600,11 +1699,11 @@ static int __init request_standard_resources(void)
                     end_pfn > pci_reserve_start_pfn) {
                         if (end_pfn > pci_reserve_end_pfn)
                                 insert_ram_resource(pci_reserve_end_pfn,
-                                                     end_pfn);
+                                                    end_pfn, 0);
                         end_pfn = pci_reserve_start_pfn;
                 }
 #endif
-                insert_ram_resource(start_pfn, end_pfn);
+                insert_ram_resource(start_pfn, end_pfn, 0);
         }
 
         code_resource.start = __pa(_text - CODE_DELTA);
@@ -1615,6 +1714,13 @@ static int __init request_standard_resources(void)
         insert_resource(&iomem_resource, &code_resource);
         insert_resource(&iomem_resource, &data_resource);
 
+        /* Mark any "memmap" regions busy for the resource manager. */
+        for (i = 0; i < memmap_nr; ++i) {
+                struct memmap_entry *m = &memmap_map[i];
+                insert_ram_resource(PFN_DOWN(m->addr),
+                                    PFN_UP(m->addr + m->size - 1), 1);
+        }
+
 #ifdef CONFIG_KEXEC
         insert_resource(&iomem_resource, &crashk_res);
 #endif
diff --git a/arch/tile/kernel/signal.c b/arch/tile/kernel/signal.c
index 9531845bf661..2d1dbf38a9ab 100644
--- a/arch/tile/kernel/signal.c
+++ b/arch/tile/kernel/signal.c
@@ -33,6 +33,7 @@
 #include <asm/ucontext.h>
 #include <asm/sigframe.h>
 #include <asm/syscalls.h>
+#include <asm/vdso.h>
 #include <arch/interrupts.h>
 
 #define DEBUG_SIG 0
@@ -190,7 +191,7 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
         if (err)
                 goto give_sigsegv;
 
-        restorer = VDSO_BASE;
+        restorer = VDSO_SYM(&__vdso_rt_sigreturn);
         if (ka->sa.sa_flags & SA_RESTORER)
                 restorer = (unsigned long) ka->sa.sa_restorer;
 
diff --git a/arch/tile/kernel/single_step.c b/arch/tile/kernel/single_step.c
index 27742e87e255..de07fa7d1315 100644
--- a/arch/tile/kernel/single_step.c
+++ b/arch/tile/kernel/single_step.c
@@ -12,41 +12,30 @@
  *   more details.
  *
  * A code-rewriter that enables instruction single-stepping.
- * Derived from iLib's single-stepping code.
  */
 
-#ifndef __tilegx__   /* Hardware support for single step unavailable. */
-
-/* These functions are only used on the TILE platform */
+#include <linux/smp.h>
+#include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/thread_info.h>
 #include <linux/uaccess.h>
 #include <linux/mman.h>
 #include <linux/types.h>
 #include <linux/err.h>
+#include <linux/prctl.h>
 #include <asm/cacheflush.h>
+#include <asm/traps.h>
+#include <asm/uaccess.h>
 #include <asm/unaligned.h>
 #include <arch/abi.h>
+#include <arch/spr_def.h>
 #include <arch/opcode.h>
 
-#define signExtend17(val) sign_extend((val), 17)
-#define TILE_X1_MASK (0xffffffffULL << 31)
-
-int unaligned_printk;
 
-static int __init setup_unaligned_printk(char *str)
-{
-        long val;
-        if (strict_strtol(str, 0, &val) != 0)
-                return 0;
-        unaligned_printk = val;
-        pr_info("Printk for each unaligned data accesses is %s\n",
-                unaligned_printk ? "enabled" : "disabled");
-        return 1;
-}
-__setup("unaligned_printk=", setup_unaligned_printk);
+#ifndef __tilegx__   /* Hardware support for single step unavailable. */
 
-unsigned int unaligned_fixup_count;
+#define signExtend17(val) sign_extend((val), 17)
+#define TILE_X1_MASK (0xffffffffULL << 31)
 
 enum mem_op {
         MEMOP_NONE,
@@ -56,12 +45,13 @@ enum mem_op {
         MEMOP_STORE_POSTINCR
 };
 
-static inline tile_bundle_bits set_BrOff_X1(tile_bundle_bits n, s32 offset)
+static inline tilepro_bundle_bits set_BrOff_X1(tilepro_bundle_bits n,
+        s32 offset)
 {
-        tile_bundle_bits result;
+        tilepro_bundle_bits result;
 
         /* mask out the old offset */
-        tile_bundle_bits mask = create_BrOff_X1(-1);
+        tilepro_bundle_bits mask = create_BrOff_X1(-1);
         result = n & (~mask);
 
         /* or in the new offset */
@@ -70,10 +60,11 @@ static inline tile_bundle_bits set_BrOff_X1(tile_bundle_bits n, s32 offset)
         return result;
 }
 
-static inline tile_bundle_bits move_X1(tile_bundle_bits n, int dest, int src)
+static inline tilepro_bundle_bits move_X1(tilepro_bundle_bits n, int dest,
+        int src)
 {
-        tile_bundle_bits result;
-        tile_bundle_bits op;
+        tilepro_bundle_bits result;
+        tilepro_bundle_bits op;
 
         result = n & (~TILE_X1_MASK);
 
@@ -87,13 +78,13 @@ static inline tile_bundle_bits move_X1(tile_bundle_bits n, int dest, int src)
         return result;
 }
 
-static inline tile_bundle_bits nop_X1(tile_bundle_bits n)
+static inline tilepro_bundle_bits nop_X1(tilepro_bundle_bits n)
 {
         return move_X1(n, TREG_ZERO, TREG_ZERO);
 }
 
-static inline tile_bundle_bits addi_X1(
-        tile_bundle_bits n, int dest, int src, int imm)
+static inline tilepro_bundle_bits addi_X1(
+        tilepro_bundle_bits n, int dest, int src, int imm)
 {
         n &= ~TILE_X1_MASK;
 
@@ -107,15 +98,26 @@ static inline tile_bundle_bits addi_X1(
         return n;
 }
 
-static tile_bundle_bits rewrite_load_store_unaligned(
+static tilepro_bundle_bits rewrite_load_store_unaligned(
         struct single_step_state *state,
-        tile_bundle_bits bundle,
+        tilepro_bundle_bits bundle,
         struct pt_regs *regs,
         enum mem_op mem_op,
         int size, int sign_ext)
 {
         unsigned char __user *addr;
         int val_reg, addr_reg, err, val;
+        int align_ctl;
+
+        align_ctl = unaligned_fixup;
+        switch (task_thread_info(current)->align_ctl) {
+        case PR_UNALIGN_NOPRINT:
+                align_ctl = 1;
+                break;
+        case PR_UNALIGN_SIGBUS:
+                align_ctl = 0;
+                break;
+        }
 
         /* Get address and value registers */
         if (bundle & TILEPRO_BUNDLE_Y_ENCODING_MASK) {
@@ -160,7 +162,7 @@ static tile_bundle_bits rewrite_load_store_unaligned(
          * tilepro hardware would be doing, if it could provide us with the
          * actual bad address in an SPR, which it doesn't.
          */
-        if (unaligned_fixup == 0) {
+        if (align_ctl == 0) {
                 siginfo_t info = {
                         .si_signo = SIGBUS,
                         .si_code = BUS_ADRALN,
@@ -209,14 +211,14 @@ static tile_bundle_bits rewrite_load_store_unaligned(
 
         if (err) {
                 siginfo_t info = {
-                        .si_signo = SIGSEGV,
-                        .si_code = SEGV_MAPERR,
+                        .si_signo = SIGBUS,
+                        .si_code = BUS_ADRALN,
                         .si_addr = addr
                 };
-                trace_unhandled_signal("segfault", regs,
-                                       (unsigned long)addr, SIGSEGV);
+                trace_unhandled_signal("bad address for unaligned fixup", regs,
+                                       (unsigned long)addr, SIGBUS);
                 force_sig_info(info.si_signo, &info, current);
-                return (tile_bundle_bits) 0;
+                return (tilepro_bundle_bits) 0;
         }
 
         if (unaligned_printk || unaligned_fixup_count == 0) {
@@ -285,7 +287,7 @@ void single_step_execve(void)
         ti->step_state = NULL;
 }
 
-/**
+/*
  * single_step_once() - entry point when single stepping has been triggered.
  * @regs: The machine register state
  *
@@ -304,20 +306,31 @@ void single_step_execve(void)
  */
 void single_step_once(struct pt_regs *regs)
 {
-        extern tile_bundle_bits __single_step_ill_insn;
-        extern tile_bundle_bits __single_step_j_insn;
-        extern tile_bundle_bits __single_step_addli_insn;
-        extern tile_bundle_bits __single_step_auli_insn;
+        extern tilepro_bundle_bits __single_step_ill_insn;
+        extern tilepro_bundle_bits __single_step_j_insn;
+        extern tilepro_bundle_bits __single_step_addli_insn;
+        extern tilepro_bundle_bits __single_step_auli_insn;
         struct thread_info *info = (void *)current_thread_info();
         struct single_step_state *state = info->step_state;
         int is_single_step = test_ti_thread_flag(info, TIF_SINGLESTEP);
-        tile_bundle_bits __user *buffer, *pc;
-        tile_bundle_bits bundle;
+        tilepro_bundle_bits __user *buffer, *pc;
+        tilepro_bundle_bits bundle;
         int temp_reg;
         int target_reg = TREG_LR;
         int err;
         enum mem_op mem_op = MEMOP_NONE;
         int size = 0, sign_ext = 0;  /* happy compiler */
+        int align_ctl;
+
+        align_ctl = unaligned_fixup;
+        switch (task_thread_info(current)->align_ctl) {
+        case PR_UNALIGN_NOPRINT:
+                align_ctl = 1;
+                break;
+        case PR_UNALIGN_SIGBUS:
+                align_ctl = 0;
+                break;
+        }
 
         asm(
 "    .pushsection .rodata.single_step\n"
@@ -390,7 +403,7 @@ void single_step_once(struct pt_regs *regs)
         if (regs->faultnum == INT_SWINT_1)
                 regs->pc -= 8;
 
-        pc = (tile_bundle_bits __user *)(regs->pc);
+        pc = (tilepro_bundle_bits __user *)(regs->pc);
         if (get_user(bundle, pc) != 0) {
                 pr_err("Couldn't read instruction at %p trying to step\n", pc);
                 return;
@@ -533,7 +546,6 @@ void single_step_once(struct pt_regs *regs)
                         }
                         break;
 
-#if CHIP_HAS_WH64()
                 /* postincrement operations */
                 case IMM_0_OPCODE_X1:
                         switch (get_ImmOpcodeExtension_X1(bundle)) {
@@ -568,7 +580,6 @@ void single_step_once(struct pt_regs *regs)
                                 break;
                         }
                         break;
-#endif /* CHIP_HAS_WH64() */
                 }
 
                 if (state->update) {
@@ -627,9 +638,9 @@ void single_step_once(struct pt_regs *regs)
 
         /*
          * Check if we need to rewrite an unaligned load/store.
-         * Returning zero is a special value meaning we need to SIGSEGV.
+         * Returning zero is a special value meaning we generated a signal.
          */
-        if (mem_op != MEMOP_NONE && unaligned_fixup >= 0) {
+        if (mem_op != MEMOP_NONE && align_ctl >= 0) {
                 bundle = rewrite_load_store_unaligned(state, bundle, regs,
                                                       mem_op, size, sign_ext);
                 if (bundle == 0)
@@ -668,9 +679,9 @@ void single_step_once(struct pt_regs *regs)
                 }
 
                 /* End with a jump back to the next instruction */
-                delta = ((regs->pc + TILE_BUNDLE_SIZE_IN_BYTES) -
+                delta = ((regs->pc + TILEPRO_BUNDLE_SIZE_IN_BYTES) -
                         (unsigned long)buffer) >>
-                        TILE_LOG2_BUNDLE_ALIGNMENT_IN_BYTES;
+                        TILEPRO_LOG2_BUNDLE_ALIGNMENT_IN_BYTES;
                 bundle = __single_step_j_insn;
                 bundle |= create_JOffLong_X1(delta);
                 err |= __put_user(bundle, buffer++);
@@ -698,9 +709,6 @@ void single_step_once(struct pt_regs *regs)
 }
 
 #else
-#include <linux/smp.h>
-#include <linux/ptrace.h>
-#include <arch/spr_def.h>
 
 static DEFINE_PER_CPU(unsigned long, ss_saved_pc);
 
@@ -743,10 +751,10 @@ void gx_singlestep_handle(struct pt_regs *regs, int fault_num)
         } else if ((*ss_pc != regs->pc) ||
                    (!(control & SPR_SINGLE_STEP_CONTROL_1__CANCELED_MASK))) {
 
-                ptrace_notify(SIGTRAP);
                 control |= SPR_SINGLE_STEP_CONTROL_1__CANCELED_MASK;
                 control |= SPR_SINGLE_STEP_CONTROL_1__INHIBIT_MASK;
                 __insn_mtspr(SPR_SINGLE_STEP_CONTROL_K, control);
+                send_sigtrap(current, regs);
         }
 }
 
diff --git a/arch/tile/kernel/smp.c b/arch/tile/kernel/smp.c
index cbc73a8b8fe1..01e8ab29f43a 100644
--- a/arch/tile/kernel/smp.c
+++ b/arch/tile/kernel/smp.c
@@ -20,8 +20,13 @@
 #include <linux/irq.h>
 #include <linux/module.h>
 #include <asm/cacheflush.h>
+#include <asm/homecache.h>
 
-HV_Topology smp_topology __write_once;
+/*
+ * We write to width and height with a single store in head_NN.S,
+ * so make the variable aligned to "long".
+ */
+HV_Topology smp_topology __write_once __aligned(sizeof(long));
 EXPORT_SYMBOL(smp_topology);
 
 #if CHIP_HAS_IPI()
@@ -100,8 +105,8 @@ static void smp_start_cpu_interrupt(void)
 /* Handler to stop the current cpu. */
 static void smp_stop_cpu_interrupt(void)
 {
-        set_cpu_online(smp_processor_id(), 0);
         arch_local_irq_disable_all();
+        set_cpu_online(smp_processor_id(), 0);
         for (;;)
                 asm("nap; nop");
 }
@@ -167,9 +172,16 @@ static void ipi_flush_icache_range(void *info)
 void flush_icache_range(unsigned long start, unsigned long end)
 {
         struct ipi_flush flush = { start, end };
-        preempt_disable();
-        on_each_cpu(ipi_flush_icache_range, &flush, 1);
-        preempt_enable();
+
+        /* If invoked with irqs disabled, we can not issue IPIs. */
+        if (irqs_disabled())
+                flush_remote(0, HV_FLUSH_EVICT_L1I, NULL, 0, 0, 0,
+                        NULL, NULL, 0);
+        else {
+                preempt_disable();
+                on_each_cpu(ipi_flush_icache_range, &flush, 1);
+                preempt_enable();
+        }
 }
 
 
diff --git a/arch/tile/kernel/smpboot.c b/arch/tile/kernel/smpboot.c
index a535655b7089..732e9d138661 100644
--- a/arch/tile/kernel/smpboot.c
+++ b/arch/tile/kernel/smpboot.c
@@ -142,13 +142,15 @@ static struct cpumask cpu_started;
  */
 static void start_secondary(void)
 {
-        int cpuid = smp_processor_id();
+        int cpuid;
+
+        preempt_disable();
+
+        cpuid = smp_processor_id();
 
         /* Set our thread pointer appropriately. */
         set_my_cpu_offset(__per_cpu_offset[cpuid]);
 
-        preempt_disable();
-
         /*
          * In large machines even this will slow us down, since we
          * will be contending for for the printk spinlock.
diff --git a/arch/tile/kernel/stack.c b/arch/tile/kernel/stack.c
index af8dfc9665f6..362284af3afd 100644
--- a/arch/tile/kernel/stack.c
+++ b/arch/tile/kernel/stack.c
@@ -29,6 +29,7 @@
 #include <asm/switch_to.h>
 #include <asm/sigframe.h>
 #include <asm/stack.h>
+#include <asm/vdso.h>
 #include <arch/abi.h>
 #include <arch/interrupts.h>
 
@@ -102,9 +103,8 @@ static struct pt_regs *valid_fault_handler(struct KBacktraceIterator* kbt)
             p->sp >= sp) {
                 if (kbt->verbose)
                         pr_err("  <%s while in kernel mode>\n", fault);
-        } else if (EX1_PL(p->ex1) == USER_PL &&
-            p->pc < PAGE_OFFSET &&
-            p->sp < PAGE_OFFSET) {
+        } else if (user_mode(p) &&
+                   p->sp < PAGE_OFFSET && p->sp != 0) {
                 if (kbt->verbose)
                         pr_err("  <%s while in user mode>\n", fault);
         } else if (kbt->verbose) {
@@ -120,7 +120,7 @@ static struct pt_regs *valid_fault_handler(struct KBacktraceIterator* kbt)
 /* Is the pc pointing to a sigreturn trampoline? */
 static int is_sigreturn(unsigned long pc)
 {
-        return (pc == VDSO_BASE);
+        return current->mm && (pc == VDSO_SYM(&__vdso_rt_sigreturn));
 }
 
 /* Return a pt_regs pointer for a valid signal handler frame */
@@ -129,7 +129,7 @@ static struct pt_regs *valid_sigframe(struct KBacktraceIterator* kbt,
 {
         BacktraceIterator *b = &kbt->it;
 
-        if (b->pc == VDSO_BASE && b->sp < PAGE_OFFSET &&
+        if (is_sigreturn(b->pc) && b->sp < PAGE_OFFSET &&
             b->sp % sizeof(long) == 0) {
                 int retval;
                 pagefault_disable();
@@ -195,21 +195,21 @@ static int KBacktraceIterator_next_item_inclusive(
  */
 static void validate_stack(struct pt_regs *regs)
 {
-        int cpu = smp_processor_id();
+        int cpu = raw_smp_processor_id();
         unsigned long ksp0 = get_current_ksp0();
-        unsigned long ksp0_base = ksp0 - THREAD_SIZE;
+        unsigned long ksp0_base = ksp0 & -THREAD_SIZE;
         unsigned long sp = stack_pointer;
 
         if (EX1_PL(regs->ex1) == KERNEL_PL && regs->sp >= ksp0) {
-                pr_err("WARNING: cpu %d: kernel stack page %#lx underrun!\n"
+                pr_err("WARNING: cpu %d: kernel stack %#lx..%#lx underrun!\n"
                        "  sp %#lx (%#lx in caller), caller pc %#lx, lr %#lx\n",
-                       cpu, ksp0_base, sp, regs->sp, regs->pc, regs->lr);
+                       cpu, ksp0_base, ksp0, sp, regs->sp, regs->pc, regs->lr);
         }
 
         else if (sp < ksp0_base + sizeof(struct thread_info)) {
-                pr_err("WARNING: cpu %d: kernel stack page %#lx overrun!\n"
+                pr_err("WARNING: cpu %d: kernel stack %#lx..%#lx overrun!\n"
                        "  sp %#lx (%#lx in caller), caller pc %#lx, lr %#lx\n",
-                       cpu, ksp0_base, sp, regs->sp, regs->pc, regs->lr);
+                       cpu, ksp0_base, ksp0, sp, regs->sp, regs->pc, regs->lr);
         }
 }
 
@@ -352,6 +352,26 @@ static void describe_addr(struct KBacktraceIterator *kbt,
 }
 
 /*
+ * Avoid possible crash recursion during backtrace.  If it happens, it
+ * makes it easy to lose the actual root cause of the failure, so we
+ * put a simple guard on all the backtrace loops.
+ */
+static bool start_backtrace(void)
+{
+        if (current->thread.in_backtrace) {
+                pr_err("Backtrace requested while in backtrace!\n");
+                return false;
+        }
+        current->thread.in_backtrace = true;
+        return true;
+}
+
+static void end_backtrace(void)
+{
+        current->thread.in_backtrace = false;
+}
+
+/*
  * This method wraps the backtracer's more generic support.
  * It is only invoked from the architecture-specific code; show_stack()
  * and dump_stack() (in entry.S) are architecture-independent entry points.
@@ -361,6 +381,8 @@ void tile_show_stack(struct KBacktraceIterator *kbt, int headers)
         int i;
         int have_mmap_sem = 0;
 
+        if (!start_backtrace())
+                return;
         if (headers) {
                 /*
                  * Add a blank line since if we are called from panic(),
@@ -371,7 +393,7 @@ void tile_show_stack(struct KBacktraceIterator *kbt, int headers)
                 pr_err("Starting stack dump of tid %d, pid %d (%s)"
                        " on cpu %d at cycle %lld\n",
                        kbt->task->pid, kbt->task->tgid, kbt->task->comm,
-                       smp_processor_id(), get_cycles());
+                       raw_smp_processor_id(), get_cycles());
         }
         kbt->verbose = 1;
         i = 0;
@@ -402,6 +424,7 @@ void tile_show_stack(struct KBacktraceIterator *kbt, int headers)
                 pr_err("Stack dump complete\n");
         if (have_mmap_sem)
                 up_read(&kbt->task->mm->mmap_sem);
+        end_backtrace();
 }
 EXPORT_SYMBOL(tile_show_stack);
 
@@ -463,6 +486,8 @@ void save_stack_trace_tsk(struct task_struct *task, struct stack_trace *trace)
         int skip = trace->skip;
         int i = 0;
 
+        if (!start_backtrace())
+                goto done;
         if (task == NULL || task == current)
                 KBacktraceIterator_init_current(&kbt);
         else
@@ -476,6 +501,8 @@ void save_stack_trace_tsk(struct task_struct *task, struct stack_trace *trace)
                         break;
                 trace->entries[i++] = kbt.it.pc;
         }
+        end_backtrace();
+done:
         trace->nr_entries = i;
 }
 EXPORT_SYMBOL(save_stack_trace_tsk);
diff --git a/arch/tile/kernel/sys.c b/arch/tile/kernel/sys.c
index b881a7be24bd..38debe706061 100644
--- a/arch/tile/kernel/sys.c
+++ b/arch/tile/kernel/sys.c
@@ -38,8 +38,10 @@
 SYSCALL_DEFINE3(cacheflush, unsigned long, addr, unsigned long, len,
                 unsigned long, flags)
 {
+        /* DCACHE is not particularly effective if not bound to one cpu. */
         if (flags & DCACHE)
-                homecache_evict(cpumask_of(smp_processor_id()));
+                homecache_evict(cpumask_of(raw_smp_processor_id()));
+
         if (flags & ICACHE)
                 flush_remote(0, HV_FLUSH_EVICT_L1I, mm_cpumask(current->mm),
                              0, 0, 0, NULL, NULL, 0);
diff --git a/arch/tile/kernel/sysfs.c b/arch/tile/kernel/sysfs.c
index e25b0a89c18f..a3ed12f8f83b 100644
--- a/arch/tile/kernel/sysfs.c
+++ b/arch/tile/kernel/sysfs.c
@@ -157,6 +157,67 @@ hvconfig_bin_read(struct file *filp, struct kobject *kobj,
         return count;
 }
 
+static ssize_t hv_stats_show(struct device *dev,
+                             struct device_attribute *attr,
+                             char *page)
+{
+        int cpu = dev->id;
+        long lotar = HV_XY_TO_LOTAR(cpu_x(cpu), cpu_y(cpu));
+
+        ssize_t n = hv_confstr(HV_CONFSTR_HV_STATS,
+                               (unsigned long)page, PAGE_SIZE - 1,
+                               lotar, 0);
+        n = n < 0 ? 0 : min(n, (ssize_t)PAGE_SIZE - 1);
+        page[n] = '\0';
+        return n;
+}
+
+static ssize_t hv_stats_store(struct device *dev,
+                              struct device_attribute *attr,
+                              const char *page,
+                              size_t count)
+{
+        int cpu = dev->id;
+        long lotar = HV_XY_TO_LOTAR(cpu_x(cpu), cpu_y(cpu));
+
+        ssize_t n = hv_confstr(HV_CONFSTR_HV_STATS, 0, 0, lotar, 1);
+        return n < 0 ? n : count;
+}
+
+static DEVICE_ATTR(hv_stats, 0644, hv_stats_show, hv_stats_store);
+
+static int hv_stats_device_add(struct device *dev, struct subsys_interface *sif)
+{
+        int err, cpu = dev->id;
+
+        if (!cpu_online(cpu))
+                return 0;
+
+        err = sysfs_create_file(&dev->kobj, &dev_attr_hv_stats.attr);
+
+        return err;
+}
+
+static int hv_stats_device_remove(struct device *dev,
+                                  struct subsys_interface *sif)
+{
+        int cpu = dev->id;
+
+        if (!cpu_online(cpu))
+                return 0;
+
+        sysfs_remove_file(&dev->kobj, &dev_attr_hv_stats.attr);
+        return 0;
+}
+
+
+static struct subsys_interface hv_stats_interface = {
+        .name                   = "hv_stats",
+        .subsys                 = &cpu_subsys,
+        .add_dev                = hv_stats_device_add,
+        .remove_dev             = hv_stats_device_remove,
+};
+
 static int __init create_sysfs_entries(void)
 {
         int err = 0;
@@ -188,6 +249,21 @@ static int __init create_sysfs_entries(void)
                 err = sysfs_create_bin_file(hypervisor_kobj, &hvconfig_bin);
         }
 
+        if (!err) {
+                /*
+                 * Don't bother adding the hv_stats files on each CPU if
+                 * our hypervisor doesn't supply statistics.
+                 */
+                int cpu = raw_smp_processor_id();
+                long lotar = HV_XY_TO_LOTAR(cpu_x(cpu), cpu_y(cpu));
+                char dummy;
+                ssize_t n = hv_confstr(HV_CONFSTR_HV_STATS,
+                                       (unsigned long) &dummy, 1,
+                                       lotar, 0);
+                if (n >= 0)
+                        err = subsys_interface_register(&hv_stats_interface);
+        }
+
         return err;
 }
 subsys_initcall(create_sysfs_entries);
diff --git a/arch/tile/kernel/time.c b/arch/tile/kernel/time.c
index 7c353d8c2da9..5d10642db63e 100644
--- a/arch/tile/kernel/time.c
+++ b/arch/tile/kernel/time.c
@@ -23,8 +23,10 @@
 #include <linux/smp.h>
 #include <linux/delay.h>
 #include <linux/module.h>
+#include <linux/timekeeper_internal.h>
 #include <asm/irq_regs.h>
 #include <asm/traps.h>
+#include <asm/vdso.h>
 #include <hv/hypervisor.h>
 #include <arch/interrupts.h>
 #include <arch/spr_def.h>
@@ -110,7 +112,6 @@ void __init time_init(void)
         setup_tile_timer();
 }
 
-
 /*
  * Define the tile timer clock event device.  The timer is driven by
  * the TILE_TIMER_CONTROL register, which consists of a 31-bit down
@@ -237,3 +238,37 @@ cycles_t ns2cycles(unsigned long nsecs)
         struct clock_event_device *dev = &__raw_get_cpu_var(tile_timer);
         return ((u64)nsecs * dev->mult) >> dev->shift;
 }
+
+void update_vsyscall_tz(void)
+{
+        /* Userspace gettimeofday will spin while this value is odd. */
+        ++vdso_data->tz_update_count;
+        smp_wmb();
+        vdso_data->tz_minuteswest = sys_tz.tz_minuteswest;
+        vdso_data->tz_dsttime = sys_tz.tz_dsttime;
+        smp_wmb();
+        ++vdso_data->tz_update_count;
+}
+
+void update_vsyscall(struct timekeeper *tk)
+{
+        struct timespec wall_time = tk_xtime(tk);
+        struct timespec *wtm = &tk->wall_to_monotonic;
+        struct clocksource *clock = tk->clock;
+
+        if (clock != &cycle_counter_cs)
+                return;
+
+        /* Userspace gettimeofday will spin while this value is odd. */
+        ++vdso_data->tb_update_count;
+        smp_wmb();
+        vdso_data->xtime_tod_stamp = clock->cycle_last;
+        vdso_data->xtime_clock_sec = wall_time.tv_sec;
+        vdso_data->xtime_clock_nsec = wall_time.tv_nsec;
+        vdso_data->wtom_clock_sec = wtm->tv_sec;
+        vdso_data->wtom_clock_nsec = wtm->tv_nsec;
+        vdso_data->mult = clock->mult;
+        vdso_data->shift = clock->shift;
+        smp_wmb();
+        ++vdso_data->tb_update_count;
+}
diff --git a/arch/tile/kernel/tlb.c b/arch/tile/kernel/tlb.c
index 3fd54d5bbd4c..f23b53515671 100644
--- a/arch/tile/kernel/tlb.c
+++ b/arch/tile/kernel/tlb.c
@@ -91,8 +91,14 @@ void flush_tlb_all(void)
         }
 }
 
+/*
+ * Callers need to flush the L1I themselves if necessary, e.g. for
+ * kernel module unload.  Otherwise we assume callers are not using
+ * executable pgprot_t's.  Using EVICT_L1I means that dataplane cpus
+ * will get an unnecessary interrupt otherwise.
+ */
 void flush_tlb_kernel_range(unsigned long start, unsigned long end)
 {
-        flush_remote(0, HV_FLUSH_EVICT_L1I, cpu_online_mask,
+        flush_remote(0, 0, NULL,
                      start, end - start, PAGE_SIZE, cpu_online_mask, NULL, 0);
 }
diff --git a/arch/tile/kernel/traps.c b/arch/tile/kernel/traps.c
index 5b19a23c8908..6b603d556ca6 100644
--- a/arch/tile/kernel/traps.c
+++ b/arch/tile/kernel/traps.c
@@ -15,6 +15,7 @@
 #include <linux/sched.h>
 #include <linux/kernel.h>
 #include <linux/kprobes.h>
+#include <linux/kdebug.h>
 #include <linux/module.h>
 #include <linux/reboot.h>
 #include <linux/uaccess.h>
@@ -29,7 +30,7 @@
 
 void __init trap_init(void)
 {
-        /* Nothing needed here since we link code at .intrpt1 */
+        /* Nothing needed here since we link code at .intrpt */
 }
 
 int unaligned_fixup = 1;
@@ -100,13 +101,7 @@ static int retry_gpv(unsigned int gpv_reason)
 
 #endif /* CHIP_HAS_TILE_DMA() */
 
-#ifdef __tilegx__
-#define bundle_bits tilegx_bundle_bits
-#else
-#define bundle_bits tile_bundle_bits
-#endif
-
-extern bundle_bits bpt_code;
+extern tile_bundle_bits bpt_code;
 
 asm(".pushsection .rodata.bpt_code,\"a\";"
     ".align 8;"
@@ -114,7 +109,7 @@ asm(".pushsection .rodata.bpt_code,\"a\";"
     ".size bpt_code,.-bpt_code;"
     ".popsection");
 
-static int special_ill(bundle_bits bundle, int *sigp, int *codep)
+static int special_ill(tile_bundle_bits bundle, int *sigp, int *codep)
 {
         int sig, code, maxcode;
 
@@ -214,24 +209,73 @@ static const char *const int_name[] = {
 #endif
 };
 
+static int do_bpt(struct pt_regs *regs)
+{
+        unsigned long bundle, bcode, bpt;
+
+        bundle = *(unsigned long *)instruction_pointer(regs);
+
+        /*
+         * bpt shoule be { bpt; nop }, which is 0x286a44ae51485000ULL.
+         * we encode the unused least significant bits for other purpose.
+         */
+        bpt = bundle & ~((1ULL << 12) - 1);
+        if (bpt != TILE_BPT_BUNDLE)
+                return 0;
+
+        bcode = bundle & ((1ULL << 12) - 1);
+        /*
+         * notify the kprobe handlers, if instruction is likely to
+         * pertain to them.
+         */
+        switch (bcode) {
+        /* breakpoint_insn */
+        case 0:
+                notify_die(DIE_BREAK, "debug", regs, bundle,
+                        INT_ILL, SIGTRAP);
+                break;
+        /* compiled_bpt */
+        case DIE_COMPILED_BPT:
+                notify_die(DIE_COMPILED_BPT, "debug", regs, bundle,
+                        INT_ILL, SIGTRAP);
+                break;
+        /* breakpoint2_insn */
+        case DIE_SSTEPBP:
+                notify_die(DIE_SSTEPBP, "single_step", regs, bundle,
+                        INT_ILL, SIGTRAP);
+                break;
+        default:
+                return 0;
+        }
+
+        return 1;
+}
+
 void __kprobes do_trap(struct pt_regs *regs, int fault_num,
                        unsigned long reason)
 {
         siginfo_t info = { 0 };
         int signo, code;
         unsigned long address = 0;
-        bundle_bits instr;
+        tile_bundle_bits instr;
+        int is_kernel = !user_mode(regs);
+
+        /* Handle breakpoints, etc. */
+        if (is_kernel && fault_num == INT_ILL && do_bpt(regs))
+                return;
 
-        /* Re-enable interrupts. */
-        local_irq_enable();
+        /* Re-enable interrupts, if they were previously enabled. */
+        if (!(regs->flags & PT_FLAGS_DISABLE_IRQ))
+                local_irq_enable();
 
         /*
          * If it hits in kernel mode and we can't fix it up, just exit the
          * current process and hope for the best.
          */
-        if (!user_mode(regs)) {
+        if (is_kernel) {
                 const char *name;
-                if (fixup_exception(regs))  /* only UNALIGN_DATA in practice */
+                char buf[100];
+                if (fixup_exception(regs))  /* ILL_TRANS or UNALIGN_DATA */
                         return;
                 if (fault_num >= 0 &&
                     fault_num < sizeof(int_name)/sizeof(int_name[0]) &&
@@ -239,10 +283,16 @@ void __kprobes do_trap(struct pt_regs *regs, int fault_num,
                         name = int_name[fault_num];
                 else
                         name = "Unknown interrupt";
-                pr_alert("Kernel took bad trap %d (%s) at PC %#lx\n",
-                         fault_num, name, regs->pc);
                 if (fault_num == INT_GPV)
-                        pr_alert("GPV_REASON is %#lx\n", reason);
+                        snprintf(buf, sizeof(buf), "; GPV_REASON %#lx", reason);
+#ifdef __tilegx__
+                else if (fault_num == INT_ILL_TRANS)
+                        snprintf(buf, sizeof(buf), "; address %#lx", reason);
+#endif
+                else
+                        buf[0] = '\0';
+                pr_alert("Kernel took bad trap %d (%s) at PC %#lx%s\n",
+                         fault_num, name, regs->pc, buf);
                 show_regs(regs);
                 do_exit(SIGKILL);  /* FIXME: implement i386 die() */
                 return;
@@ -324,11 +374,8 @@ void __kprobes do_trap(struct pt_regs *regs, int fault_num,
                 fill_ra_stack();
 
                 signo = SIGSEGV;
+                address = reason;
                 code = SEGV_MAPERR;
-                if (reason & SPR_ILL_TRANS_REASON__I_STREAM_VA_RMASK)
-                        address = regs->pc;
-                else
-                        address = 0;  /* FIXME: GX: single-step for address */
                 break;
         }
 #endif
diff --git a/arch/tile/kernel/unaligned.c b/arch/tile/kernel/unaligned.c
new file mode 100644
index 000000000000..b425fb6a480d
--- /dev/null
+++ b/arch/tile/kernel/unaligned.c
@@ -0,0 +1,1609 @@
+/*
+ * Copyright 2013 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ *
+ * A code-rewriter that handles unaligned exception.
+ */
+
+#include <linux/smp.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/thread_info.h>
+#include <linux/uaccess.h>
+#include <linux/mman.h>
+#include <linux/types.h>
+#include <linux/err.h>
+#include <linux/module.h>
+#include <linux/compat.h>
+#include <linux/prctl.h>
+#include <asm/cacheflush.h>
+#include <asm/traps.h>
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+#include <arch/abi.h>
+#include <arch/spr_def.h>
+#include <arch/opcode.h>
+
+
+/*
+ * This file handles unaligned exception for tile-Gx. The tilepro's unaligned
+ * exception is supported out of single_step.c
+ */
+
+int unaligned_printk;
+
+static int __init setup_unaligned_printk(char *str)
+{
+        long val;
+        if (kstrtol(str, 0, &val) != 0)
+                return 0;
+        unaligned_printk = val;
+        pr_info("Printk for each unaligned data accesses is %s\n",
+                unaligned_printk ? "enabled" : "disabled");
+        return 1;
+}
+__setup("unaligned_printk=", setup_unaligned_printk);
+
+unsigned int unaligned_fixup_count;
+
+#ifdef __tilegx__
+
+/*
+ * Unalign data jit fixup code fragement. Reserved space is 128 bytes.
+ * The 1st 64-bit word saves fault PC address, 2nd word is the fault
+ * instruction bundle followed by 14 JIT bundles.
+ */
+
+struct unaligned_jit_fragment {
+        unsigned long       pc;
+        tilegx_bundle_bits  bundle;
+        tilegx_bundle_bits  insn[14];
+};
+
+/*
+ * Check if a nop or fnop at bundle's pipeline X0.
+ */
+
+static bool is_bundle_x0_nop(tilegx_bundle_bits bundle)
+{
+        return (((get_UnaryOpcodeExtension_X0(bundle) ==
+                  NOP_UNARY_OPCODE_X0) &&
+                 (get_RRROpcodeExtension_X0(bundle) ==
+                  UNARY_RRR_0_OPCODE_X0) &&
+                 (get_Opcode_X0(bundle) ==
+                  RRR_0_OPCODE_X0)) ||
+                ((get_UnaryOpcodeExtension_X0(bundle) ==
+                  FNOP_UNARY_OPCODE_X0) &&
+                 (get_RRROpcodeExtension_X0(bundle) ==
+                  UNARY_RRR_0_OPCODE_X0) &&
+                 (get_Opcode_X0(bundle) ==
+                  RRR_0_OPCODE_X0)));
+}
+
+/*
+ * Check if nop or fnop at bundle's pipeline X1.
+ */
+
+static bool is_bundle_x1_nop(tilegx_bundle_bits bundle)
+{
+        return (((get_UnaryOpcodeExtension_X1(bundle) ==
+                  NOP_UNARY_OPCODE_X1) &&
+                 (get_RRROpcodeExtension_X1(bundle) ==
+                  UNARY_RRR_0_OPCODE_X1) &&
+                 (get_Opcode_X1(bundle) ==
+                  RRR_0_OPCODE_X1)) ||
+                ((get_UnaryOpcodeExtension_X1(bundle) ==
+                  FNOP_UNARY_OPCODE_X1) &&
+                 (get_RRROpcodeExtension_X1(bundle) ==
+                  UNARY_RRR_0_OPCODE_X1) &&
+                 (get_Opcode_X1(bundle) ==
+                  RRR_0_OPCODE_X1)));
+}
+
+/*
+ * Check if nop or fnop at bundle's Y0 pipeline.
+ */
+
+static bool is_bundle_y0_nop(tilegx_bundle_bits bundle)
+{
+        return (((get_UnaryOpcodeExtension_Y0(bundle) ==
+                  NOP_UNARY_OPCODE_Y0) &&
+                 (get_RRROpcodeExtension_Y0(bundle) ==
+                  UNARY_RRR_1_OPCODE_Y0) &&
+                 (get_Opcode_Y0(bundle) ==
+                  RRR_1_OPCODE_Y0)) ||
+                ((get_UnaryOpcodeExtension_Y0(bundle) ==
+                  FNOP_UNARY_OPCODE_Y0) &&
+                 (get_RRROpcodeExtension_Y0(bundle) ==
+                  UNARY_RRR_1_OPCODE_Y0) &&
+                 (get_Opcode_Y0(bundle) ==
+                  RRR_1_OPCODE_Y0)));
+}
+
+/*
+ * Check if nop or fnop at bundle's pipeline Y1.
+ */
+
+static bool is_bundle_y1_nop(tilegx_bundle_bits bundle)
+{
+        return (((get_UnaryOpcodeExtension_Y1(bundle) ==
+                  NOP_UNARY_OPCODE_Y1) &&
+                 (get_RRROpcodeExtension_Y1(bundle) ==
+                  UNARY_RRR_1_OPCODE_Y1) &&
+                 (get_Opcode_Y1(bundle) ==
+                  RRR_1_OPCODE_Y1)) ||
+                ((get_UnaryOpcodeExtension_Y1(bundle) ==
+                  FNOP_UNARY_OPCODE_Y1) &&
+                 (get_RRROpcodeExtension_Y1(bundle) ==
+                  UNARY_RRR_1_OPCODE_Y1) &&
+                 (get_Opcode_Y1(bundle) ==
+                  RRR_1_OPCODE_Y1)));
+}
+
+/*
+ * Test if a bundle's y0 and y1 pipelines are both nop or fnop.
+ */
+
+static bool is_y0_y1_nop(tilegx_bundle_bits bundle)
+{
+        return is_bundle_y0_nop(bundle) && is_bundle_y1_nop(bundle);
+}
+
+/*
+ * Test if a bundle's x0 and x1 pipelines are both nop or fnop.
+ */
+
+static bool is_x0_x1_nop(tilegx_bundle_bits bundle)
+{
+        return is_bundle_x0_nop(bundle) && is_bundle_x1_nop(bundle);
+}
+
+/*
+ * Find the destination, source registers of fault unalign access instruction
+ * at X1 or Y2. Also, allocate up to 3 scratch registers clob1, clob2 and
+ * clob3, which are guaranteed different from any register used in the fault
+ * bundle. r_alias is used to return if the other instructions other than the
+ * unalign load/store shares same register with ra, rb and rd.
+ */
+
+static void find_regs(tilegx_bundle_bits bundle, uint64_t *rd, uint64_t *ra,
+                      uint64_t *rb, uint64_t *clob1, uint64_t *clob2,
+                      uint64_t *clob3, bool *r_alias)
+{
+        int i;
+        uint64_t reg;
+        uint64_t reg_map = 0, alias_reg_map = 0, map;
+        bool alias;
+
+        *ra = -1;
+        *rb = -1;
+
+        if (rd)
+                *rd = -1;
+
+        *clob1 = -1;
+        *clob2 = -1;
+        *clob3 = -1;
+        alias = false;
+
+        /*
+         * Parse fault bundle, find potential used registers and mark
+         * corresponding bits in reg_map and alias_map. These 2 bit maps
+         * are used to find the scratch registers and determine if there
+         * is register alais.
+         */
+        if (bundle & TILEGX_BUNDLE_MODE_MASK) {  /* Y Mode Bundle. */
+
+                reg = get_SrcA_Y2(bundle);
+                reg_map |= 1ULL << reg;
+                *ra = reg;
+                reg = get_SrcBDest_Y2(bundle);
+                reg_map |= 1ULL << reg;
+
+                if (rd) {
+                        /* Load. */
+                        *rd = reg;
+                        alias_reg_map = (1ULL << *rd) | (1ULL << *ra);
+                } else {
+                        /* Store. */
+                        *rb = reg;
+                        alias_reg_map = (1ULL << *ra) | (1ULL << *rb);
+                }
+
+                if (!is_bundle_y1_nop(bundle)) {
+                        reg = get_SrcA_Y1(bundle);
+                        reg_map |= (1ULL << reg);
+                        map = (1ULL << reg);
+
+                        reg = get_SrcB_Y1(bundle);
+                        reg_map |= (1ULL << reg);
+                        map |= (1ULL << reg);
+
+                        reg = get_Dest_Y1(bundle);
+                        reg_map |= (1ULL << reg);
+                        map |= (1ULL << reg);
+
+                        if (map & alias_reg_map)
+                                alias = true;
+                }
+
+                if (!is_bundle_y0_nop(bundle)) {
+                        reg = get_SrcA_Y0(bundle);
+                        reg_map |= (1ULL << reg);
+                        map = (1ULL << reg);
+
+                        reg = get_SrcB_Y0(bundle);
+                        reg_map |= (1ULL << reg);
+                        map |= (1ULL << reg);
+
+                        reg = get_Dest_Y0(bundle);
+                        reg_map |= (1ULL << reg);
+                        map |= (1ULL << reg);
+
+                        if (map & alias_reg_map)
+                                alias = true;
+                }
+        } else  { /* X Mode Bundle. */
+
+                reg = get_SrcA_X1(bundle);
+                reg_map |= (1ULL << reg);
+                *ra = reg;
+                if (rd) {
+                        /* Load. */
+                        reg = get_Dest_X1(bundle);
+                        reg_map |= (1ULL << reg);
+                        *rd = reg;
+                        alias_reg_map = (1ULL << *rd) | (1ULL << *ra);
+                } else {
+                        /* Store. */
+                        reg = get_SrcB_X1(bundle);
+                        reg_map |= (1ULL << reg);
+                        *rb = reg;
+                        alias_reg_map = (1ULL << *ra) | (1ULL << *rb);
+                }
+
+                if (!is_bundle_x0_nop(bundle)) {
+                        reg = get_SrcA_X0(bundle);
+                        reg_map |= (1ULL << reg);
+                        map = (1ULL << reg);
+
+                        reg = get_SrcB_X0(bundle);
+                        reg_map |= (1ULL << reg);
+                        map |= (1ULL << reg);
+
+                        reg = get_Dest_X0(bundle);
+                        reg_map |= (1ULL << reg);
+                        map |= (1ULL << reg);
+
+                        if (map & alias_reg_map)
+                                alias = true;
+                }
+        }
+
+        /*
+         * "alias" indicates if the unalign access registers have collision
+         * with others in the same bundle. We jsut simply test all register
+         * operands case (RRR), ignored the case with immidate. If a bundle
+         * has no register alias, we may do fixup in a simple or fast manner.
+         * So if an immidata field happens to hit with a register, we may end
+         * up fall back to the generic handling.
+         */
+
+        *r_alias = alias;
+
+        /* Flip bits on reg_map. */
+        reg_map ^= -1ULL;
+
+        /* Scan reg_map lower 54(TREG_SP) bits to find 3 set bits. */
+        for (i = 0; i < TREG_SP; i++) {
+                if (reg_map & (0x1ULL << i)) {
+                        if (*clob1 == -1) {
+                                *clob1 = i;
+                        } else if (*clob2 == -1) {
+                                *clob2 = i;
+                        } else if (*clob3 == -1) {
+                                *clob3 = i;
+                                return;
+                        }
+                }
+        }
+}
+
+/*
+ * Sanity check for register ra, rb, rd, clob1/2/3. Return true if any of them
+ * is unexpected.
+ */
+
+static bool check_regs(uint64_t rd, uint64_t ra, uint64_t rb,
+                       uint64_t clob1, uint64_t clob2,  uint64_t clob3)
+{
+        bool unexpected = false;
+        if ((ra >= 56) && (ra != TREG_ZERO))
+                unexpected = true;
+
+        if ((clob1 >= 56) || (clob2 >= 56) || (clob3 >= 56))
+                unexpected = true;
+
+        if (rd != -1) {
+                if ((rd >= 56) && (rd != TREG_ZERO))
+                        unexpected = true;
+        } else {
+                if ((rb >= 56) && (rb != TREG_ZERO))
+                        unexpected = true;
+        }
+        return unexpected;
+}
+
+
+#define  GX_INSN_X0_MASK   ((1ULL << 31) - 1)
+#define  GX_INSN_X1_MASK   (((1ULL << 31) - 1) << 31)
+#define  GX_INSN_Y0_MASK   ((0xFULL << 27) | (0xFFFFFULL))
+#define  GX_INSN_Y1_MASK   (GX_INSN_Y0_MASK << 31)
+#define  GX_INSN_Y2_MASK   ((0x7FULL << 51) | (0x7FULL << 20))
+
+#ifdef __LITTLE_ENDIAN
+#define  GX_INSN_BSWAP(_bundle_)    (_bundle_)
+#else
+#define  GX_INSN_BSWAP(_bundle_)    swab64(_bundle_)
+#endif /* __LITTLE_ENDIAN */
+
+/*
+ * __JIT_CODE(.) creates template bundles in .rodata.unalign_data section.
+ * The corresponding static function jix_x#_###(.) generates partial or
+ * whole bundle based on the template and given arguments.
+ */
+
+#define __JIT_CODE(_X_)                                         \
+        asm (".pushsection .rodata.unalign_data, \"a\"\n"       \
+             _X_"\n"                                            \
+             ".popsection\n")
+
+__JIT_CODE("__unalign_jit_x1_mtspr:   {mtspr 0,  r0}");
+static tilegx_bundle_bits jit_x1_mtspr(int spr, int reg)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x1_mtspr;
+        return (GX_INSN_BSWAP(__unalign_jit_x1_mtspr) & GX_INSN_X1_MASK) |
+                create_MT_Imm14_X1(spr) | create_SrcA_X1(reg);
+}
+
+__JIT_CODE("__unalign_jit_x1_mfspr:   {mfspr r0, 0}");
+static tilegx_bundle_bits  jit_x1_mfspr(int reg, int spr)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x1_mfspr;
+        return (GX_INSN_BSWAP(__unalign_jit_x1_mfspr) & GX_INSN_X1_MASK) |
+                create_MF_Imm14_X1(spr) | create_Dest_X1(reg);
+}
+
+__JIT_CODE("__unalign_jit_x0_addi:   {addi  r0, r0, 0; iret}");
+static tilegx_bundle_bits  jit_x0_addi(int rd, int ra, int imm8)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x0_addi;
+        return (GX_INSN_BSWAP(__unalign_jit_x0_addi) & GX_INSN_X0_MASK) |
+                create_Dest_X0(rd) | create_SrcA_X0(ra) |
+                create_Imm8_X0(imm8);
+}
+
+__JIT_CODE("__unalign_jit_x1_ldna:   {ldna  r0, r0}");
+static tilegx_bundle_bits  jit_x1_ldna(int rd, int ra)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x1_ldna;
+        return (GX_INSN_BSWAP(__unalign_jit_x1_ldna) &  GX_INSN_X1_MASK) |
+                create_Dest_X1(rd) | create_SrcA_X1(ra);
+}
+
+__JIT_CODE("__unalign_jit_x0_dblalign:   {dblalign r0, r0 ,r0}");
+static tilegx_bundle_bits  jit_x0_dblalign(int rd, int ra, int rb)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x0_dblalign;
+        return (GX_INSN_BSWAP(__unalign_jit_x0_dblalign) & GX_INSN_X0_MASK) |
+                create_Dest_X0(rd) | create_SrcA_X0(ra) |
+                create_SrcB_X0(rb);
+}
+
+__JIT_CODE("__unalign_jit_x1_iret:   {iret}");
+static tilegx_bundle_bits  jit_x1_iret(void)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x1_iret;
+        return GX_INSN_BSWAP(__unalign_jit_x1_iret) & GX_INSN_X1_MASK;
+}
+
+__JIT_CODE("__unalign_jit_x01_fnop:   {fnop;fnop}");
+static tilegx_bundle_bits  jit_x0_fnop(void)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x01_fnop;
+        return GX_INSN_BSWAP(__unalign_jit_x01_fnop) & GX_INSN_X0_MASK;
+}
+
+static tilegx_bundle_bits  jit_x1_fnop(void)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x01_fnop;
+        return GX_INSN_BSWAP(__unalign_jit_x01_fnop) & GX_INSN_X1_MASK;
+}
+
+__JIT_CODE("__unalign_jit_y2_dummy:   {fnop; fnop; ld zero, sp}");
+static tilegx_bundle_bits  jit_y2_dummy(void)
+{
+        extern  tilegx_bundle_bits __unalign_jit_y2_dummy;
+        return GX_INSN_BSWAP(__unalign_jit_y2_dummy) & GX_INSN_Y2_MASK;
+}
+
+static tilegx_bundle_bits  jit_y1_fnop(void)
+{
+        extern  tilegx_bundle_bits __unalign_jit_y2_dummy;
+        return GX_INSN_BSWAP(__unalign_jit_y2_dummy) & GX_INSN_Y1_MASK;
+}
+
+__JIT_CODE("__unalign_jit_x1_st1_add:  {st1_add r1, r0, 0}");
+static tilegx_bundle_bits  jit_x1_st1_add(int ra, int rb, int imm8)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x1_st1_add;
+        return (GX_INSN_BSWAP(__unalign_jit_x1_st1_add) &
+                (~create_SrcA_X1(-1)) &
+                GX_INSN_X1_MASK) | create_SrcA_X1(ra) |
+                create_SrcB_X1(rb) | create_Dest_Imm8_X1(imm8);
+}
+
+__JIT_CODE("__unalign_jit_x1_st:  {crc32_8 r1, r0, r0; st  r0, r0}");
+static tilegx_bundle_bits  jit_x1_st(int ra, int rb)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x1_st;
+        return (GX_INSN_BSWAP(__unalign_jit_x1_st) & GX_INSN_X1_MASK) |
+                create_SrcA_X1(ra) | create_SrcB_X1(rb);
+}
+
+__JIT_CODE("__unalign_jit_x1_st_add:  {st_add  r1, r0, 0}");
+static tilegx_bundle_bits  jit_x1_st_add(int ra, int rb, int imm8)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x1_st_add;
+        return (GX_INSN_BSWAP(__unalign_jit_x1_st_add) &
+                (~create_SrcA_X1(-1)) &
+                GX_INSN_X1_MASK) | create_SrcA_X1(ra) |
+                create_SrcB_X1(rb) | create_Dest_Imm8_X1(imm8);
+}
+
+__JIT_CODE("__unalign_jit_x1_ld:  {crc32_8 r1, r0, r0; ld  r0, r0}");
+static tilegx_bundle_bits  jit_x1_ld(int rd, int ra)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x1_ld;
+        return (GX_INSN_BSWAP(__unalign_jit_x1_ld) & GX_INSN_X1_MASK) |
+                create_Dest_X1(rd) | create_SrcA_X1(ra);
+}
+
+__JIT_CODE("__unalign_jit_x1_ld_add:  {ld_add  r1, r0, 0}");
+static tilegx_bundle_bits  jit_x1_ld_add(int rd, int ra, int imm8)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x1_ld_add;
+        return (GX_INSN_BSWAP(__unalign_jit_x1_ld_add) &
+                (~create_Dest_X1(-1)) &
+                GX_INSN_X1_MASK) | create_Dest_X1(rd) |
+                create_SrcA_X1(ra) | create_Imm8_X1(imm8);
+}
+
+__JIT_CODE("__unalign_jit_x0_bfexts:  {bfexts r0, r0, 0, 0}");
+static tilegx_bundle_bits  jit_x0_bfexts(int rd, int ra, int bfs, int bfe)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x0_bfexts;
+        return (GX_INSN_BSWAP(__unalign_jit_x0_bfexts) &
+                GX_INSN_X0_MASK) |
+                create_Dest_X0(rd) | create_SrcA_X0(ra) |
+                create_BFStart_X0(bfs) | create_BFEnd_X0(bfe);
+}
+
+__JIT_CODE("__unalign_jit_x0_bfextu:  {bfextu r0, r0, 0, 0}");
+static tilegx_bundle_bits  jit_x0_bfextu(int rd, int ra, int bfs, int bfe)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x0_bfextu;
+        return (GX_INSN_BSWAP(__unalign_jit_x0_bfextu) &
+                GX_INSN_X0_MASK) |
+                create_Dest_X0(rd) | create_SrcA_X0(ra) |
+                create_BFStart_X0(bfs) | create_BFEnd_X0(bfe);
+}
+
+__JIT_CODE("__unalign_jit_x1_addi:  {bfextu r1, r1, 0, 0; addi r0, r0, 0}");
+static tilegx_bundle_bits  jit_x1_addi(int rd, int ra, int imm8)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x1_addi;
+        return (GX_INSN_BSWAP(__unalign_jit_x1_addi) & GX_INSN_X1_MASK) |
+                create_Dest_X1(rd) | create_SrcA_X1(ra) |
+                create_Imm8_X1(imm8);
+}
+
+__JIT_CODE("__unalign_jit_x0_shrui:  {shrui r0, r0, 0; iret}");
+static tilegx_bundle_bits  jit_x0_shrui(int rd, int ra, int imm6)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x0_shrui;
+        return (GX_INSN_BSWAP(__unalign_jit_x0_shrui) &
+                GX_INSN_X0_MASK) |
+                create_Dest_X0(rd) | create_SrcA_X0(ra) |
+                create_ShAmt_X0(imm6);
+}
+
+__JIT_CODE("__unalign_jit_x0_rotli:  {rotli r0, r0, 0; iret}");
+static tilegx_bundle_bits  jit_x0_rotli(int rd, int ra, int imm6)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x0_rotli;
+        return (GX_INSN_BSWAP(__unalign_jit_x0_rotli) &
+                GX_INSN_X0_MASK) |
+                create_Dest_X0(rd) | create_SrcA_X0(ra) |
+                create_ShAmt_X0(imm6);
+}
+
+__JIT_CODE("__unalign_jit_x1_bnezt:  {bnezt r0, __unalign_jit_x1_bnezt}");
+static tilegx_bundle_bits  jit_x1_bnezt(int ra, int broff)
+{
+        extern  tilegx_bundle_bits __unalign_jit_x1_bnezt;
+        return (GX_INSN_BSWAP(__unalign_jit_x1_bnezt) &
+                GX_INSN_X1_MASK) |
+                create_SrcA_X1(ra) | create_BrOff_X1(broff);
+}
+
+#undef __JIT_CODE
+
+/*
+ * This function generates unalign fixup JIT.
+ *
+ * We fist find unalign load/store instruction's destination, source
+ * reguisters: ra, rb and rd. and 3 scratch registers by calling
+ * find_regs(...). 3 scratch clobbers should not alias with any register
+ * used in the fault bundle. Then analyze the fault bundle to determine
+ * if it's a load or store, operand width, branch or address increment etc.
+ * At last generated JIT is copied into JIT code area in user space.
+ */
+
+static
+void jit_bundle_gen(struct pt_regs *regs, tilegx_bundle_bits bundle,
+                    int align_ctl)
+{
+        struct thread_info *info = current_thread_info();
+        struct unaligned_jit_fragment frag;
+        struct unaligned_jit_fragment *jit_code_area;
+        tilegx_bundle_bits bundle_2 = 0;
+        /* If bundle_2_enable = false, bundle_2 is fnop/nop operation. */
+        bool     bundle_2_enable = true;
+        uint64_t ra, rb, rd = -1, clob1, clob2, clob3;
+        /*
+         * Indicate if the unalign access
+         * instruction's registers hit with
+         * others in the same bundle.
+         */
+        bool     alias = false;
+        bool     load_n_store = true;
+        bool     load_store_signed = false;
+        unsigned int  load_store_size = 8;
+        bool     y1_br = false;  /* True, for a branch in same bundle at Y1.*/
+        int      y1_br_reg = 0;
+        /* True for link operation. i.e. jalr or lnk at Y1 */
+        bool     y1_lr = false;
+        int      y1_lr_reg = 0;
+        bool     x1_add = false;/* True, for load/store ADD instruction at X1*/
+        int      x1_add_imm8 = 0;
+        bool     unexpected = false;
+        int      n = 0, k;
+
+        jit_code_area =
+                (struct unaligned_jit_fragment *)(info->unalign_jit_base);
+
+        memset((void *)&frag, 0, sizeof(frag));
+
+        /* 0: X mode, Otherwise: Y mode. */
+        if (bundle & TILEGX_BUNDLE_MODE_MASK) {
+                unsigned int mod, opcode;
+
+                if (get_Opcode_Y1(bundle) == RRR_1_OPCODE_Y1 &&
+                    get_RRROpcodeExtension_Y1(bundle) ==
+                    UNARY_RRR_1_OPCODE_Y1) {
+
+                        opcode = get_UnaryOpcodeExtension_Y1(bundle);
+
+                        /*
+                         * Test "jalr", "jalrp", "jr", "jrp" instruction at Y1
+                         * pipeline.
+                         */
+                        switch (opcode) {
+                        case JALR_UNARY_OPCODE_Y1:
+                        case JALRP_UNARY_OPCODE_Y1:
+                                y1_lr = true;
+                                y1_lr_reg = 55; /* Link register. */
+                                /* FALLTHROUGH */
+                        case JR_UNARY_OPCODE_Y1:
+                        case JRP_UNARY_OPCODE_Y1:
+                                y1_br = true;
+                                y1_br_reg = get_SrcA_Y1(bundle);
+                                break;
+                        case LNK_UNARY_OPCODE_Y1:
+                                /* "lnk" at Y1 pipeline. */
+                                y1_lr = true;
+                                y1_lr_reg = get_Dest_Y1(bundle);
+                                break;
+                        }
+                }
+
+                opcode = get_Opcode_Y2(bundle);
+                mod = get_Mode(bundle);
+
+                /*
+                 *  bundle_2 is bundle after making Y2 as a dummy operation
+                 *  - ld zero, sp
+                 */
+                bundle_2 = (bundle & (~GX_INSN_Y2_MASK)) | jit_y2_dummy();
+
+                /* Make Y1 as fnop if Y1 is a branch or lnk operation. */
+                if (y1_br || y1_lr) {
+                        bundle_2 &= ~(GX_INSN_Y1_MASK);
+                        bundle_2 |= jit_y1_fnop();
+                }
+
+                if (is_y0_y1_nop(bundle_2))
+                        bundle_2_enable = false;
+
+                if (mod == MODE_OPCODE_YC2) {
+                        /* Store. */
+                        load_n_store = false;
+                        load_store_size = 1 << opcode;
+                        load_store_signed = false;
+                        find_regs(bundle, 0, &ra, &rb, &clob1, &clob2,
+                                  &clob3, &alias);
+                        if (load_store_size > 8)
+                                unexpected = true;
+                } else {
+                        /* Load. */
+                        load_n_store = true;
+                        if (mod == MODE_OPCODE_YB2) {
+                                switch (opcode) {
+                                case LD_OPCODE_Y2:
+                                        load_store_signed = false;
+                                        load_store_size = 8;
+                                        break;
+                                case LD4S_OPCODE_Y2:
+                                        load_store_signed = true;
+                                        load_store_size = 4;
+                                        break;
+                                case LD4U_OPCODE_Y2:
+                                        load_store_signed = false;
+                                        load_store_size = 4;
+                                        break;
+                                default:
+                                        unexpected = true;
+                                }
+                        } else if (mod == MODE_OPCODE_YA2) {
+                                if (opcode == LD2S_OPCODE_Y2) {
+                                        load_store_signed = true;
+                                        load_store_size = 2;
+                                } else if (opcode == LD2U_OPCODE_Y2) {
+                                        load_store_signed = false;
+                                        load_store_size = 2;
+                                } else
+                                        unexpected = true;
+                        } else
+                                unexpected = true;
+                        find_regs(bundle, &rd, &ra, &rb, &clob1, &clob2,
+                                  &clob3, &alias);
+                }
+        } else {
+                unsigned int opcode;
+
+                /* bundle_2 is bundle after making X1 as "fnop". */
+                bundle_2 = (bundle & (~GX_INSN_X1_MASK)) | jit_x1_fnop();
+
+                if (is_x0_x1_nop(bundle_2))
+                        bundle_2_enable = false;
+
+                if (get_Opcode_X1(bundle) == RRR_0_OPCODE_X1) {
+                        opcode = get_UnaryOpcodeExtension_X1(bundle);
+
+                        if (get_RRROpcodeExtension_X1(bundle) ==
+                            UNARY_RRR_0_OPCODE_X1) {
+                                load_n_store = true;
+                                find_regs(bundle, &rd, &ra, &rb, &clob1,
+                                          &clob2, &clob3, &alias);
+
+                                switch (opcode) {
+                                case LD_UNARY_OPCODE_X1:
+                                        load_store_signed = false;
+                                        load_store_size = 8;
+                                        break;
+                                case LD4S_UNARY_OPCODE_X1:
+                                        load_store_signed = true;
+                                        /* FALLTHROUGH */
+                                case LD4U_UNARY_OPCODE_X1:
+                                        load_store_size = 4;
+                                        break;
+
+                                case LD2S_UNARY_OPCODE_X1:
+                                        load_store_signed = true;
+                                        /* FALLTHROUGH */
+                                case LD2U_UNARY_OPCODE_X1:
+                                        load_store_size = 2;
+                                        break;
+                                default:
+                                        unexpected = true;
+                                }
+                        } else {
+                                load_n_store = false;
+                                load_store_signed = false;
+                                find_regs(bundle, 0, &ra, &rb,
+                                          &clob1, &clob2, &clob3,
+                                          &alias);
+
+                                opcode = get_RRROpcodeExtension_X1(bundle);
+                                switch (opcode) {
+                                case ST_RRR_0_OPCODE_X1:
+                                        load_store_size = 8;
+                                        break;
+                                case ST4_RRR_0_OPCODE_X1:
+                                        load_store_size = 4;
+                                        break;
+                                case ST2_RRR_0_OPCODE_X1:
+                                        load_store_size = 2;
+                                        break;
+                                default:
+                                        unexpected = true;
+                                }
+                        }
+                } else if (get_Opcode_X1(bundle) == IMM8_OPCODE_X1) {
+                        load_n_store = true;
+                        opcode = get_Imm8OpcodeExtension_X1(bundle);
+                        switch (opcode) {
+                        case LD_ADD_IMM8_OPCODE_X1:
+                                load_store_size = 8;
+                                break;
+
+                        case LD4S_ADD_IMM8_OPCODE_X1:
+                                load_store_signed = true;
+                                /* FALLTHROUGH */
+                        case LD4U_ADD_IMM8_OPCODE_X1:
+                                load_store_size = 4;
+                                break;
+
+                        case LD2S_ADD_IMM8_OPCODE_X1:
+                                load_store_signed = true;
+                                /* FALLTHROUGH */
+                        case LD2U_ADD_IMM8_OPCODE_X1:
+                                load_store_size = 2;
+                                break;
+
+                        case ST_ADD_IMM8_OPCODE_X1:
+                                load_n_store = false;
+                                load_store_size = 8;
+                                break;
+                        case ST4_ADD_IMM8_OPCODE_X1:
+                                load_n_store = false;
+                                load_store_size = 4;
+                                break;
+                        case ST2_ADD_IMM8_OPCODE_X1:
+                                load_n_store = false;
+                                load_store_size = 2;
+                                break;
+                        default:
+                                unexpected = true;
+                        }
+
+                        if (!unexpected) {
+                                x1_add = true;
+                                if (load_n_store)
+                                        x1_add_imm8 = get_Imm8_X1(bundle);
+                                else
+                                        x1_add_imm8 = get_Dest_Imm8_X1(bundle);
+                        }
+
+                        find_regs(bundle, load_n_store ? (&rd) : NULL,
+                                  &ra, &rb, &clob1, &clob2, &clob3, &alias);
+                } else
+                        unexpected = true;
+        }
+
+        /*
+         * Some sanity check for register numbers extracted from fault bundle.
+         */
+        if (check_regs(rd, ra, rb, clob1, clob2, clob3) == true)
+                unexpected = true;
+
+        /* Give warning if register ra has an aligned address. */
+        if (!unexpected)
+                WARN_ON(!((load_store_size - 1) & (regs->regs[ra])));
+
+
+        /*
+         * Fault came from kernel space, here we only need take care of
+         * unaligned "get_user/put_user" macros defined in "uaccess.h".
+         * Basically, we will handle bundle like this:
+         * {ld/2u/4s rd, ra; movei rx, 0} or {st/2/4 ra, rb; movei rx, 0}
+         * (Refer to file "arch/tile/include/asm/uaccess.h" for details).
+         * For either load or store, byte-wise operation is performed by calling
+         * get_user() or put_user(). If the macro returns non-zero value,
+         * set the value to rx, otherwise set zero to rx. Finally make pc point
+         * to next bundle and return.
+         */
+
+        if (EX1_PL(regs->ex1) != USER_PL) {
+
+                unsigned long rx = 0;
+                unsigned long x = 0, ret = 0;
+
+                if (y1_br || y1_lr || x1_add ||
+                    (load_store_signed !=
+                     (load_n_store && load_store_size == 4))) {
+                        /* No branch, link, wrong sign-ext or load/store add. */
+                        unexpected = true;
+                } else if (!unexpected) {
+                        if (bundle & TILEGX_BUNDLE_MODE_MASK) {
+                                /*
+                                 * Fault bundle is Y mode.
+                                 * Check if the Y1 and Y0 is the form of
+                                 * { movei rx, 0; nop/fnop }, if yes,
+                                 * find the rx.
+                                 */
+
+                                if ((get_Opcode_Y1(bundle) == ADDI_OPCODE_Y1)
+                                    && (get_SrcA_Y1(bundle) == TREG_ZERO) &&
+                                    (get_Imm8_Y1(bundle) == 0) &&
+                                    is_bundle_y0_nop(bundle)) {
+                                        rx = get_Dest_Y1(bundle);
+                                } else if ((get_Opcode_Y0(bundle) ==
+                                            ADDI_OPCODE_Y0) &&
+                                           (get_SrcA_Y0(bundle) == TREG_ZERO) &&
+                                           (get_Imm8_Y0(bundle) == 0) &&
+                                           is_bundle_y1_nop(bundle)) {
+                                        rx = get_Dest_Y0(bundle);
+                                } else {
+                                        unexpected = true;
+                                }
+                        } else {
+                                /*
+                                 * Fault bundle is X mode.
+                                 * Check if the X0 is 'movei rx, 0',
+                                 * if yes, find the rx.
+                                 */
+
+                                if ((get_Opcode_X0(bundle) == IMM8_OPCODE_X0)
+                                    && (get_Imm8OpcodeExtension_X0(bundle) ==
+                                        ADDI_IMM8_OPCODE_X0) &&
+                                    (get_SrcA_X0(bundle) == TREG_ZERO) &&
+                                    (get_Imm8_X0(bundle) == 0)) {
+                                        rx = get_Dest_X0(bundle);
+                                } else {
+                                        unexpected = true;
+                                }
+                        }
+
+                        /* rx should be less than 56. */
+                        if (!unexpected && (rx >= 56))
+                                unexpected = true;
+                }
+
+                if (!search_exception_tables(regs->pc)) {
+                        /* No fixup in the exception tables for the pc. */
+                        unexpected = true;
+                }
+
+                if (unexpected) {
+                        /* Unexpected unalign kernel fault. */
+                        struct task_struct *tsk = validate_current();
+
+                        bust_spinlocks(1);
+
+                        show_regs(regs);
+
+                        if (unlikely(tsk->pid < 2)) {
+                                panic("Kernel unalign fault running %s!",
+                                      tsk->pid ? "init" : "the idle task");
+                        }
+#ifdef SUPPORT_DIE
+                        die("Oops", regs);
+#endif
+                        bust_spinlocks(1);
+
+                        do_group_exit(SIGKILL);
+
+                } else {
+                        unsigned long i, b = 0;
+                        unsigned char *ptr =
+                                (unsigned char *)regs->regs[ra];
+                        if (load_n_store) {
+                                /* handle get_user(x, ptr) */
+                                for (i = 0; i < load_store_size; i++) {
+                                        ret = get_user(b, ptr++);
+                                        if (!ret) {
+                                                /* Success! update x. */
+#ifdef __LITTLE_ENDIAN
+                                                x |= (b << (8 * i));
+#else
+                                                x <<= 8;
+                                                x |= b;
+#endif /* __LITTLE_ENDIAN */
+                                        } else {
+                                                x = 0;
+                                                break;
+                                        }
+                                }
+
+                                /* Sign-extend 4-byte loads. */
+                                if (load_store_size == 4)
+                                        x = (long)(int)x;
+
+                                /* Set register rd. */
+                                regs->regs[rd] = x;
+
+                                /* Set register rx. */
+                                regs->regs[rx] = ret;
+
+                                /* Bump pc. */
+                                regs->pc += 8;
+
+                        } else {
+                                /* Handle put_user(x, ptr) */
+                                x = regs->regs[rb];
+#ifdef __LITTLE_ENDIAN
+                                b = x;
+#else
+                                /*
+                                 * Swap x in order to store x from low
+                                 * to high memory same as the
+                                 * little-endian case.
+                                 */
+                                switch (load_store_size) {
+                                case 8:
+                                        b = swab64(x);
+                                        break;
+                                case 4:
+                                        b = swab32(x);
+                                        break;
+                                case 2:
+                                        b = swab16(x);
+                                        break;
+                                }
+#endif /* __LITTLE_ENDIAN */
+                                for (i = 0; i < load_store_size; i++) {
+                                        ret = put_user(b, ptr++);
+                                        if (ret)
+                                                break;
+                                        /* Success! shift 1 byte. */
+                                        b >>= 8;
+                                }
+                                /* Set register rx. */
+                                regs->regs[rx] = ret;
+
+                                /* Bump pc. */
+                                regs->pc += 8;
+                        }
+                }
+
+                unaligned_fixup_count++;
+
+                if (unaligned_printk) {
+                        pr_info("%s/%d. Unalign fixup for kernel access "
+                                "to userspace %lx.",
+                                current->comm, current->pid, regs->regs[ra]);
+                }
+
+                /* Done! Return to the exception handler. */
+                return;
+        }
+
+        if ((align_ctl == 0) || unexpected) {
+                siginfo_t info = {
+                        .si_signo = SIGBUS,
+                        .si_code = BUS_ADRALN,
+                        .si_addr = (unsigned char __user *)0
+                };
+                if (unaligned_printk)
+                        pr_info("Unalign bundle: unexp @%llx, %llx",
+                                (unsigned long long)regs->pc,
+                                (unsigned long long)bundle);
+
+                if (ra < 56) {
+                        unsigned long uaa = (unsigned long)regs->regs[ra];
+                        /* Set bus Address. */
+                        info.si_addr = (unsigned char __user *)uaa;
+                }
+
+                unaligned_fixup_count++;
+
+                trace_unhandled_signal("unaligned fixup trap", regs,
+                                       (unsigned long)info.si_addr, SIGBUS);
+                force_sig_info(info.si_signo, &info, current);
+                return;
+        }
+
+#ifdef __LITTLE_ENDIAN
+#define UA_FIXUP_ADDR_DELTA          1
+#define UA_FIXUP_BFEXT_START(_B_)    0
+#define UA_FIXUP_BFEXT_END(_B_)     (8 * (_B_) - 1)
+#else /* __BIG_ENDIAN */
+#define UA_FIXUP_ADDR_DELTA          -1
+#define UA_FIXUP_BFEXT_START(_B_)   (64 - 8 * (_B_))
+#define UA_FIXUP_BFEXT_END(_B_)      63
+#endif /* __LITTLE_ENDIAN */
+
+
+
+        if ((ra != rb) && (rd != TREG_SP) && !alias &&
+            !y1_br && !y1_lr && !x1_add) {
+                /*
+                 * Simple case: ra != rb and no register alias found,
+                 * and no branch or link. This will be the majority.
+                 * We can do a little better for simplae case than the
+                 * generic scheme below.
+                 */
+                if (!load_n_store) {
+                        /*
+                         * Simple store: ra != rb, no need for scratch register.
+                         * Just store and rotate to right bytewise.
+                         */
+#ifdef __BIG_ENDIAN
+                        frag.insn[n++] =
+                                jit_x0_addi(ra, ra, load_store_size - 1) |
+                                jit_x1_fnop();
+#endif /* __BIG_ENDIAN */
+                        for (k = 0; k < load_store_size; k++) {
+                                /* Store a byte. */
+                                frag.insn[n++] =
+                                        jit_x0_rotli(rb, rb, 56) |
+                                        jit_x1_st1_add(ra, rb,
+                                                       UA_FIXUP_ADDR_DELTA);
+                        }
+#ifdef __BIG_ENDIAN
+                        frag.insn[n] = jit_x1_addi(ra, ra, 1);
+#else
+                        frag.insn[n] = jit_x1_addi(ra, ra,
+                                                   -1 * load_store_size);
+#endif /* __LITTLE_ENDIAN */
+
+                        if (load_store_size == 8) {
+                                frag.insn[n] |= jit_x0_fnop();
+                        } else if (load_store_size == 4) {
+                                frag.insn[n] |= jit_x0_rotli(rb, rb, 32);
+                        } else { /* = 2 */
+                                frag.insn[n] |= jit_x0_rotli(rb, rb, 16);
+                        }
+                        n++;
+                        if (bundle_2_enable)
+                                frag.insn[n++] = bundle_2;
+                        frag.insn[n++] = jit_x0_fnop() | jit_x1_iret();
+                } else {
+                        if (rd == ra) {
+                                /* Use two clobber registers: clob1/2. */
+                                frag.insn[n++] =
+                                        jit_x0_addi(TREG_SP, TREG_SP, -16) |
+                                        jit_x1_fnop();
+                                frag.insn[n++] =
+                                        jit_x0_addi(clob1, ra, 7) |
+                                        jit_x1_st_add(TREG_SP, clob1, -8);
+                                frag.insn[n++] =
+                                        jit_x0_addi(clob2, ra, 0) |
+                                        jit_x1_st(TREG_SP, clob2);
+                                frag.insn[n++] =
+                                        jit_x0_fnop() |
+                                        jit_x1_ldna(rd, ra);
+                                frag.insn[n++] =
+                                        jit_x0_fnop() |
+                                        jit_x1_ldna(clob1, clob1);
+                                /*
+                                 * Note: we must make sure that rd must not
+                                 * be sp. Recover clob1/2 from stack.
+                                 */
+                                frag.insn[n++] =
+                                        jit_x0_dblalign(rd, clob1, clob2) |
+                                        jit_x1_ld_add(clob2, TREG_SP, 8);
+                                frag.insn[n++] =
+                                        jit_x0_fnop() |
+                                        jit_x1_ld_add(clob1, TREG_SP, 16);
+                        } else {
+                                /* Use one clobber register: clob1 only. */
+                                frag.insn[n++] =
+                                        jit_x0_addi(TREG_SP, TREG_SP, -16) |
+                                        jit_x1_fnop();
+                                frag.insn[n++] =
+                                        jit_x0_addi(clob1, ra, 7) |
+                                        jit_x1_st(TREG_SP, clob1);
+                                frag.insn[n++] =
+                                        jit_x0_fnop() |
+                                        jit_x1_ldna(rd, ra);
+                                frag.insn[n++] =
+                                        jit_x0_fnop() |
+                                        jit_x1_ldna(clob1, clob1);
+                                /*
+                                 * Note: we must make sure that rd must not
+                                 * be sp. Recover clob1 from stack.
+                                 */
+                                frag.insn[n++] =
+                                        jit_x0_dblalign(rd, clob1, ra) |
+                                        jit_x1_ld_add(clob1, TREG_SP, 16);
+                        }
+
+                        if (bundle_2_enable)
+                                frag.insn[n++] = bundle_2;
+                        /*
+                         * For non 8-byte load, extract corresponding bytes and
+                         * signed extension.
+                         */
+                        if (load_store_size == 4) {
+                                if (load_store_signed)
+                                        frag.insn[n++] =
+                                                jit_x0_bfexts(
+                                                        rd, rd,
+                                                        UA_FIXUP_BFEXT_START(4),
+                                                        UA_FIXUP_BFEXT_END(4)) |
+                                                jit_x1_fnop();
+                                else
+                                        frag.insn[n++] =
+                                                jit_x0_bfextu(
+                                                        rd, rd,
+                                                        UA_FIXUP_BFEXT_START(4),
+                                                        UA_FIXUP_BFEXT_END(4)) |
+                                                jit_x1_fnop();
+                        } else if (load_store_size == 2) {
+                                if (load_store_signed)
+                                        frag.insn[n++] =
+                                                jit_x0_bfexts(
+                                                        rd, rd,
+                                                        UA_FIXUP_BFEXT_START(2),
+                                                        UA_FIXUP_BFEXT_END(2)) |
+                                                jit_x1_fnop();
+                                else
+                                        frag.insn[n++] =
+                                                jit_x0_bfextu(
+                                                        rd, rd,
+                                                        UA_FIXUP_BFEXT_START(2),
+                                                        UA_FIXUP_BFEXT_END(2)) |
+                                                jit_x1_fnop();
+                        }
+
+                        frag.insn[n++] =
+                                jit_x0_fnop()  |
+                                jit_x1_iret();
+                }
+        } else if (!load_n_store) {
+
+                /*
+                 * Generic memory store cases: use 3 clobber registers.
+                 *
+                 * Alloc space for saveing clob2,1,3 on user's stack.
+                 * register clob3 points to where clob2 saved, followed by
+                 * clob1 and 3 from high to low memory.
+                 */
+                frag.insn[n++] =
+                        jit_x0_addi(TREG_SP, TREG_SP, -32)    |
+                        jit_x1_fnop();
+                frag.insn[n++] =
+                        jit_x0_addi(clob3, TREG_SP, 16)  |
+                        jit_x1_st_add(TREG_SP, clob3, 8);
+#ifdef __LITTLE_ENDIAN
+                frag.insn[n++] =
+                        jit_x0_addi(clob1, ra, 0)   |
+                        jit_x1_st_add(TREG_SP, clob1, 8);
+#else
+                frag.insn[n++] =
+                        jit_x0_addi(clob1, ra, load_store_size - 1)   |
+                        jit_x1_st_add(TREG_SP, clob1, 8);
+#endif
+                if (load_store_size == 8) {
+                        /*
+                         * We save one byte a time, not for fast, but compact
+                         * code. After each store, data source register shift
+                         * right one byte. unchanged after 8 stores.
+                         */
+                        frag.insn[n++] =
+                                jit_x0_addi(clob2, TREG_ZERO, 7)     |
+                                jit_x1_st_add(TREG_SP, clob2, 16);
+                        frag.insn[n++] =
+                                jit_x0_rotli(rb, rb, 56)      |
+                                jit_x1_st1_add(clob1, rb, UA_FIXUP_ADDR_DELTA);
+                        frag.insn[n++] =
+                                jit_x0_addi(clob2, clob2, -1) |
+                                jit_x1_bnezt(clob2, -1);
+                        frag.insn[n++] =
+                                jit_x0_fnop()                 |
+                                jit_x1_addi(clob2, y1_br_reg, 0);
+                } else if (load_store_size == 4) {
+                        frag.insn[n++] =
+                                jit_x0_addi(clob2, TREG_ZERO, 3)     |
+                                jit_x1_st_add(TREG_SP, clob2, 16);
+                        frag.insn[n++] =
+                                jit_x0_rotli(rb, rb, 56)      |
+                                jit_x1_st1_add(clob1, rb, UA_FIXUP_ADDR_DELTA);
+                        frag.insn[n++] =
+                                jit_x0_addi(clob2, clob2, -1) |
+                                jit_x1_bnezt(clob2, -1);
+                        /*
+                         * same as 8-byte case, but need shift another 4
+                         * byte to recover rb for 4-byte store.
+                         */
+                        frag.insn[n++] = jit_x0_rotli(rb, rb, 32)      |
+                                jit_x1_addi(clob2, y1_br_reg, 0);
+                } else { /* =2 */
+                        frag.insn[n++] =
+                                jit_x0_addi(clob2, rb, 0)     |
+                                jit_x1_st_add(TREG_SP, clob2, 16);
+                        for (k = 0; k < 2; k++) {
+                                frag.insn[n++] =
+                                        jit_x0_shrui(rb, rb, 8)  |
+                                        jit_x1_st1_add(clob1, rb,
+                                                       UA_FIXUP_ADDR_DELTA);
+                        }
+                        frag.insn[n++] =
+                                jit_x0_addi(rb, clob2, 0)       |
+                                jit_x1_addi(clob2, y1_br_reg, 0);
+                }
+
+                if (bundle_2_enable)
+                        frag.insn[n++] = bundle_2;
+
+                if (y1_lr) {
+                        frag.insn[n++] =
+                                jit_x0_fnop()                    |
+                                jit_x1_mfspr(y1_lr_reg,
+                                             SPR_EX_CONTEXT_0_0);
+                }
+                if (y1_br) {
+                        frag.insn[n++] =
+                                jit_x0_fnop()                    |
+                                jit_x1_mtspr(SPR_EX_CONTEXT_0_0,
+                                             clob2);
+                }
+                if (x1_add) {
+                        frag.insn[n++] =
+                                jit_x0_addi(ra, ra, x1_add_imm8) |
+                                jit_x1_ld_add(clob2, clob3, -8);
+                } else {
+                        frag.insn[n++] =
+                                jit_x0_fnop()                    |
+                                jit_x1_ld_add(clob2, clob3, -8);
+                }
+                frag.insn[n++] =
+                        jit_x0_fnop()   |
+                        jit_x1_ld_add(clob1, clob3, -8);
+                frag.insn[n++] = jit_x0_fnop()   | jit_x1_ld(clob3, clob3);
+                frag.insn[n++] = jit_x0_fnop()   | jit_x1_iret();
+
+        } else {
+                /*
+                 * Generic memory load cases.
+                 *
+                 * Alloc space for saveing clob1,2,3 on user's stack.
+                 * register clob3 points to where clob1 saved, followed
+                 * by clob2 and 3 from high to low memory.
+                 */
+
+                frag.insn[n++] =
+                        jit_x0_addi(TREG_SP, TREG_SP, -32) |
+                        jit_x1_fnop();
+                frag.insn[n++] =
+                        jit_x0_addi(clob3, TREG_SP, 16) |
+                        jit_x1_st_add(TREG_SP, clob3, 8);
+                frag.insn[n++] =
+                        jit_x0_addi(clob2, ra, 0) |
+                        jit_x1_st_add(TREG_SP, clob2, 8);
+
+                if (y1_br) {
+                        frag.insn[n++] =
+                                jit_x0_addi(clob1, y1_br_reg, 0) |
+                                jit_x1_st_add(TREG_SP, clob1, 16);
+                } else {
+                        frag.insn[n++] =
+                                jit_x0_fnop() |
+                                jit_x1_st_add(TREG_SP, clob1, 16);
+                }
+
+                if (bundle_2_enable)
+                        frag.insn[n++] = bundle_2;
+
+                if (y1_lr) {
+                        frag.insn[n++] =
+                                jit_x0_fnop()  |
+                                jit_x1_mfspr(y1_lr_reg,
+                                             SPR_EX_CONTEXT_0_0);
+                }
+
+                if (y1_br) {
+                        frag.insn[n++] =
+                                jit_x0_fnop() |
+                                jit_x1_mtspr(SPR_EX_CONTEXT_0_0,
+                                             clob1);
+                }
+
+                frag.insn[n++] =
+                        jit_x0_addi(clob1, clob2, 7)      |
+                        jit_x1_ldna(rd, clob2);
+                frag.insn[n++] =
+                        jit_x0_fnop()                     |
+                        jit_x1_ldna(clob1, clob1);
+                frag.insn[n++] =
+                        jit_x0_dblalign(rd, clob1, clob2) |
+                        jit_x1_ld_add(clob1, clob3, -8);
+                if (x1_add) {
+                        frag.insn[n++] =
+                                jit_x0_addi(ra, ra, x1_add_imm8) |
+                                jit_x1_ld_add(clob2, clob3, -8);
+                } else {
+                        frag.insn[n++] =
+                                jit_x0_fnop()  |
+                                jit_x1_ld_add(clob2, clob3, -8);
+                }
+
+                frag.insn[n++] =
+                        jit_x0_fnop() |
+                        jit_x1_ld(clob3, clob3);
+
+                if (load_store_size == 4) {
+                        if (load_store_signed)
+                                frag.insn[n++] =
+                                        jit_x0_bfexts(
+                                                rd, rd,
+                                                UA_FIXUP_BFEXT_START(4),
+                                                UA_FIXUP_BFEXT_END(4)) |
+                                        jit_x1_fnop();
+                        else
+                                frag.insn[n++] =
+                                        jit_x0_bfextu(
+                                                rd, rd,
+                                                UA_FIXUP_BFEXT_START(4),
+                                                UA_FIXUP_BFEXT_END(4)) |
+                                        jit_x1_fnop();
+                } else if (load_store_size == 2) {
+                        if (load_store_signed)
+                                frag.insn[n++] =
+                                        jit_x0_bfexts(
+                                                rd, rd,
+                                                UA_FIXUP_BFEXT_START(2),
+                                                UA_FIXUP_BFEXT_END(2)) |
+                                        jit_x1_fnop();
+                        else
+                                frag.insn[n++] =
+                                        jit_x0_bfextu(
+                                                rd, rd,
+                                                UA_FIXUP_BFEXT_START(2),
+                                                UA_FIXUP_BFEXT_END(2)) |
+                                        jit_x1_fnop();
+                }
+
+                frag.insn[n++] = jit_x0_fnop() | jit_x1_iret();
+        }
+
+        /* Max JIT bundle count is 14. */
+        WARN_ON(n > 14);
+
+        if (!unexpected) {
+                int status = 0;
+                int idx = (regs->pc >> 3) &
+                        ((1ULL << (PAGE_SHIFT - UNALIGN_JIT_SHIFT)) - 1);
+
+                frag.pc = regs->pc;
+                frag.bundle = bundle;
+
+                if (unaligned_printk) {
+                        pr_info("%s/%d, Unalign fixup: pc=%lx "
+                                "bundle=%lx %d %d %d %d %d %d %d %d.",
+                                current->comm, current->pid,
+                                (unsigned long)frag.pc,
+                                (unsigned long)frag.bundle,
+                                (int)alias, (int)rd, (int)ra,
+                                (int)rb, (int)bundle_2_enable,
+                                (int)y1_lr, (int)y1_br, (int)x1_add);
+
+                        for (k = 0; k < n; k += 2)
+                                pr_info("[%d] %016llx %016llx", k,
+                                        (unsigned long long)frag.insn[k],
+                                        (unsigned long long)frag.insn[k+1]);
+                }
+
+                /* Swap bundle byte order for big endian sys. */
+#ifdef __BIG_ENDIAN
+                frag.bundle = GX_INSN_BSWAP(frag.bundle);
+                for (k = 0; k < n; k++)
+                        frag.insn[k] = GX_INSN_BSWAP(frag.insn[k]);
+#endif /* __BIG_ENDIAN */
+
+                status = copy_to_user((void __user *)&jit_code_area[idx],
+                                      &frag, sizeof(frag));
+                if (status) {
+                        /* Fail to copy JIT into user land. send SIGSEGV. */
+                        siginfo_t info = {
+                                .si_signo = SIGSEGV,
+                                .si_code = SEGV_MAPERR,
+                                .si_addr = (void __user *)&jit_code_area[idx]
+                        };
+
+                        pr_warn("Unalign fixup: pid=%d %s jit_code_area=%llx",
+                                current->pid, current->comm,
+                                (unsigned long long)&jit_code_area[idx]);
+
+                        trace_unhandled_signal("segfault in unalign fixup",
+                                               regs,
+                                               (unsigned long)info.si_addr,
+                                               SIGSEGV);
+                        force_sig_info(info.si_signo, &info, current);
+                        return;
+                }
+
+
+                /* Do a cheaper increment, not accurate. */
+                unaligned_fixup_count++;
+                __flush_icache_range((unsigned long)&jit_code_area[idx],
+                                     (unsigned long)&jit_code_area[idx] +
+                                     sizeof(frag));
+
+                /* Setup SPR_EX_CONTEXT_0_0/1 for returning to user program.*/
+                __insn_mtspr(SPR_EX_CONTEXT_0_0, regs->pc + 8);
+                __insn_mtspr(SPR_EX_CONTEXT_0_1, PL_ICS_EX1(USER_PL, 0));
+
+                /* Modify pc at the start of new JIT. */
+                regs->pc = (unsigned long)&jit_code_area[idx].insn[0];
+                /* Set ICS in SPR_EX_CONTEXT_K_1. */
+                regs->ex1 = PL_ICS_EX1(USER_PL, 1);
+        }
+}
+
+
+/*
+ * C function to generate unalign data JIT. Called from unalign data
+ * interrupt handler.
+ *
+ * First check if unalign fix is disabled or exception did not not come from
+ * user space or sp register points to unalign address, if true, generate a
+ * SIGBUS. Then map a page into user space as JIT area if it is not mapped
+ * yet. Genenerate JIT code by calling jit_bundle_gen(). After that return
+ * back to exception handler.
+ *
+ * The exception handler will "iret" to new generated JIT code after
+ * restoring caller saved registers. In theory, the JIT code will perform
+ * another "iret" to resume user's program.
+ */
+
+void do_unaligned(struct pt_regs *regs, int vecnum)
+{
+        tilegx_bundle_bits __user  *pc;
+        tilegx_bundle_bits bundle;
+        struct thread_info *info = current_thread_info();
+        int align_ctl;
+
+        /* Checks the per-process unaligned JIT flags */
+        align_ctl = unaligned_fixup;
+        switch (task_thread_info(current)->align_ctl) {
+        case PR_UNALIGN_NOPRINT:
+                align_ctl = 1;
+                break;
+        case PR_UNALIGN_SIGBUS:
+                align_ctl = 0;
+                break;
+        }
+
+        /* Enable iterrupt in order to access user land. */
+        local_irq_enable();
+
+        /*
+         * The fault came from kernel space. Two choices:
+         * (a) unaligned_fixup < 1, we will first call get/put_user fixup
+         *     to return -EFAULT. If no fixup, simply panic the kernel.
+         * (b) unaligned_fixup >=1, we will try to fix the unaligned access
+         *     if it was triggered by get_user/put_user() macros. Panic the
+         *     kernel if it is not fixable.
+         */
+
+        if (EX1_PL(regs->ex1) != USER_PL) {
+
+                if (align_ctl < 1) {
+                        unaligned_fixup_count++;
+                        /* If exception came from kernel, try fix it up. */
+                        if (fixup_exception(regs)) {
+                                if (unaligned_printk)
+                                        pr_info("Unalign fixup: %d %llx @%llx",
+                                                (int)unaligned_fixup,
+                                                (unsigned long long)regs->ex1,
+                                                (unsigned long long)regs->pc);
+                                return;
+                        }
+                        /* Not fixable. Go panic. */
+                        panic("Unalign exception in Kernel. pc=%lx",
+                              regs->pc);
+                        return;
+                } else {
+                        /*
+                         * Try to fix the exception. If we can't, panic the
+                         * kernel.
+                         */
+                        bundle = GX_INSN_BSWAP(
+                                *((tilegx_bundle_bits *)(regs->pc)));
+                        jit_bundle_gen(regs, bundle, align_ctl);
+                        return;
+                }
+        }
+
+        /*
+         * Fault came from user with ICS or stack is not aligned.
+         * If so, we will trigger SIGBUS.
+         */
+        if ((regs->sp & 0x7) || (regs->ex1) || (align_ctl < 0)) {
+                siginfo_t info = {
+                        .si_signo = SIGBUS,
+                        .si_code = BUS_ADRALN,
+                        .si_addr = (unsigned char __user *)0
+                };
+
+                if (unaligned_printk)
+                        pr_info("Unalign fixup: %d %llx @%llx",
+                                (int)unaligned_fixup,
+                                (unsigned long long)regs->ex1,
+                                (unsigned long long)regs->pc);
+
+                unaligned_fixup_count++;
+
+                trace_unhandled_signal("unaligned fixup trap", regs, 0, SIGBUS);
+                force_sig_info(info.si_signo, &info, current);
+                return;
+        }
+
+
+        /* Read the bundle casued the exception! */
+        pc = (tilegx_bundle_bits __user *)(regs->pc);
+        if (get_user(bundle, pc) != 0) {
+                /* Probably never be here since pc is valid user address.*/
+                siginfo_t info = {
+                        .si_signo = SIGSEGV,
+                        .si_code = SEGV_MAPERR,
+                        .si_addr = (void __user *)pc
+                };
+                pr_err("Couldn't read instruction at %p trying to step\n", pc);
+                trace_unhandled_signal("segfault in unalign fixup", regs,
+                                       (unsigned long)info.si_addr, SIGSEGV);
+                force_sig_info(info.si_signo, &info, current);
+                return;
+        }
+
+        if (!info->unalign_jit_base) {
+                void __user *user_page;
+
+                /*
+                 * Allocate a page in userland.
+                 * For 64-bit processes we try to place the mapping far
+                 * from anything else that might be going on (specifically
+                 * 64 GB below the top of the user address space).  If it
+                 * happens not to be possible to put it there, it's OK;
+                 * the kernel will choose another location and we'll
+                 * remember it for later.
+                 */
+                if (is_compat_task())
+                        user_page = NULL;
+                else
+                        user_page = (void __user *)(TASK_SIZE - (1UL << 36)) +
+                                (current->pid << PAGE_SHIFT);
+
+                user_page = (void __user *) vm_mmap(NULL,
+                                                    (unsigned long)user_page,
+                                                    PAGE_SIZE,
+                                                    PROT_EXEC | PROT_READ |
+                                                    PROT_WRITE,
+#ifdef CONFIG_HOMECACHE
+                                                    MAP_CACHE_HOME_TASK |
+#endif
+                                                    MAP_PRIVATE |
+                                                    MAP_ANONYMOUS,
+                                                    0);
+
+                if (IS_ERR((void __force *)user_page)) {
+                        pr_err("Out of kernel pages trying do_mmap.\n");
+                        return;
+                }
+
+                /* Save the address in the thread_info struct */
+                info->unalign_jit_base = user_page;
+                if (unaligned_printk)
+                        pr_info("Unalign bundle: %d:%d, allocate page @%llx",
+                                raw_smp_processor_id(), current->pid,
+                                (unsigned long long)user_page);
+        }
+
+        /* Generate unalign JIT */
+        jit_bundle_gen(regs, GX_INSN_BSWAP(bundle), align_ctl);
+}
+
+#endif /* __tilegx__ */
diff --git a/arch/tile/kernel/vdso.c b/arch/tile/kernel/vdso.c
new file mode 100644
index 000000000000..1533af24106e
--- /dev/null
+++ b/arch/tile/kernel/vdso.c
@@ -0,0 +1,212 @@
+/*
+ * Copyright 2012 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+#include <linux/binfmts.h>
+#include <linux/compat.h>
+#include <linux/elf.h>
+#include <linux/mm.h>
+#include <linux/pagemap.h>
+
+#include <asm/vdso.h>
+#include <asm/mman.h>
+#include <asm/sections.h>
+
+#include <arch/sim.h>
+
+/* The alignment of the vDSO. */
+#define VDSO_ALIGNMENT  PAGE_SIZE
+
+
+static unsigned int vdso_pages;
+static struct page **vdso_pagelist;
+
+#ifdef CONFIG_COMPAT
+static unsigned int vdso32_pages;
+static struct page **vdso32_pagelist;
+#endif
+static int vdso_ready;
+
+/*
+ * The vdso data page.
+ */
+static union {
+        struct vdso_data        data;
+        u8                      page[PAGE_SIZE];
+} vdso_data_store __page_aligned_data;
+
+struct vdso_data *vdso_data = &vdso_data_store.data;
+
+static unsigned int __read_mostly vdso_enabled = 1;
+
+static struct page **vdso_setup(void *vdso_kbase, unsigned int pages)
+{
+        int i;
+        struct page **pagelist;
+
+        pagelist = kzalloc(sizeof(struct page *) * (pages + 1), GFP_KERNEL);
+        BUG_ON(pagelist == NULL);
+        for (i = 0; i < pages - 1; i++) {
+                struct page *pg = virt_to_page(vdso_kbase + i*PAGE_SIZE);
+                ClearPageReserved(pg);
+                pagelist[i] = pg;
+        }
+        pagelist[pages - 1] = virt_to_page(vdso_data);
+        pagelist[pages] = NULL;
+
+        return pagelist;
+}
+
+static int __init vdso_init(void)
+{
+        int data_pages = sizeof(vdso_data_store) >> PAGE_SHIFT;
+
+        /*
+         * We can disable vDSO support generally, but we need to retain
+         * one page to support the two-bundle (16-byte) rt_sigreturn path.
+         */
+        if (!vdso_enabled) {
+                size_t offset = (unsigned long)&__vdso_rt_sigreturn;
+                static struct page *sigret_page;
+                sigret_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
+                BUG_ON(sigret_page == NULL);
+                vdso_pagelist = &sigret_page;
+                vdso_pages = 1;
+                BUG_ON(offset >= PAGE_SIZE);
+                memcpy(page_address(sigret_page) + offset,
+                       vdso_start + offset, 16);
+#ifdef CONFIG_COMPAT
+                vdso32_pages = vdso_pages;
+                vdso32_pagelist = vdso_pagelist;
+#endif
+                vdso_ready = 1;
+                return 0;
+        }
+
+        vdso_pages = (vdso_end - vdso_start) >> PAGE_SHIFT;
+        vdso_pages += data_pages;
+        vdso_pagelist = vdso_setup(vdso_start, vdso_pages);
+
+#ifdef CONFIG_COMPAT
+        vdso32_pages = (vdso32_end - vdso32_start) >> PAGE_SHIFT;
+        vdso32_pages += data_pages;
+        vdso32_pagelist = vdso_setup(vdso32_start, vdso32_pages);
+#endif
+
+        smp_wmb();
+        vdso_ready = 1;
+
+        return 0;
+}
+arch_initcall(vdso_init);
+
+const char *arch_vma_name(struct vm_area_struct *vma)
+{
+        if (vma->vm_mm && vma->vm_start == VDSO_BASE)
+                return "[vdso]";
+#ifndef __tilegx__
+        if (vma->vm_start == MEM_USER_INTRPT)
+                return "[intrpt]";
+#endif
+        return NULL;
+}
+
+struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
+{
+        return NULL;
+}
+
+int in_gate_area(struct mm_struct *mm, unsigned long address)
+{
+        return 0;
+}
+
+int in_gate_area_no_mm(unsigned long address)
+{
+        return 0;
+}
+
+int setup_vdso_pages(void)
+{
+        struct page **pagelist;
+        unsigned long pages;
+        struct mm_struct *mm = current->mm;
+        unsigned long vdso_base = 0;
+        int retval = 0;
+
+        if (!vdso_ready)
+                return 0;
+
+        mm->context.vdso_base = 0;
+
+        pagelist = vdso_pagelist;
+        pages = vdso_pages;
+#ifdef CONFIG_COMPAT
+        if (is_compat_task()) {
+                pagelist = vdso32_pagelist;
+                pages = vdso32_pages;
+        }
+#endif
+
+        /*
+         * vDSO has a problem and was disabled, just don't "enable" it for the
+         * process.
+         */
+        if (pages == 0)
+                return 0;
+
+        vdso_base = get_unmapped_area(NULL, vdso_base,
+                                      (pages << PAGE_SHIFT) +
+                                      ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
+                                      0, 0);
+        if (IS_ERR_VALUE(vdso_base)) {
+                retval = vdso_base;
+                return retval;
+        }
+
+        /* Add required alignment. */
+        vdso_base = ALIGN(vdso_base, VDSO_ALIGNMENT);
+
+        /*
+         * Put vDSO base into mm struct. We need to do this before calling
+         * install_special_mapping or the perf counter mmap tracking code
+         * will fail to recognise it as a vDSO (since arch_vma_name fails).
+         */
+        mm->context.vdso_base = vdso_base;
+
+        /*
+         * our vma flags don't have VM_WRITE so by default, the process isn't
+         * allowed to write those pages.
+         * gdb can break that with ptrace interface, and thus trigger COW on
+         * those pages but it's then your responsibility to never do that on
+         * the "data" page of the vDSO or you'll stop getting kernel updates
+         * and your nice userland gettimeofday will be totally dead.
+         * It's fine to use that for setting breakpoints in the vDSO code
+         * pages though
+         */
+        retval = install_special_mapping(mm, vdso_base,
+                                         pages << PAGE_SHIFT,
+                                         VM_READ|VM_EXEC |
+                                         VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC,
+                                         pagelist);
+        if (retval)
+                mm->context.vdso_base = 0;
+
+        return retval;
+}
+
+static __init int vdso_func(char *s)
+{
+        return kstrtouint(s, 0, &vdso_enabled);
+}
+__setup("vdso=", vdso_func);
diff --git a/arch/tile/kernel/vdso/Makefile b/arch/tile/kernel/vdso/Makefile
new file mode 100644
index 000000000000..e2b7a2f4ee41
--- /dev/null
+++ b/arch/tile/kernel/vdso/Makefile
@@ -0,0 +1,118 @@
+# Symbols present in the vdso
+vdso-syms = rt_sigreturn gettimeofday
+
+# Files to link into the vdso
+obj-vdso = $(patsubst %, v%.o, $(vdso-syms))
+
+# Build rules
+targets := $(obj-vdso) vdso.so vdso.so.dbg vdso.lds
+obj-vdso := $(addprefix $(obj)/, $(obj-vdso))
+
+# vdso32 is only for tilegx -m32 compat task.
+VDSO32-$(CONFIG_COMPAT) := y
+
+obj-y += vdso.o
+obj-$(VDSO32-y) += vdso32.o
+extra-y += vdso.lds
+CPPFLAGS_vdso.lds += -P -C -U$(ARCH)
+
+# vDSO code runs in userspace and -pg doesn't help with profiling anyway.
+CFLAGS_REMOVE_vdso.o = -pg
+CFLAGS_REMOVE_vdso32.o = -pg
+CFLAGS_REMOVE_vrt_sigreturn.o = -pg
+CFLAGS_REMOVE_vrt_sigreturn32.o = -pg
+CFLAGS_REMOVE_vgettimeofday.o = -pg
+CFLAGS_REMOVE_vgettimeofday32.o = -pg
+
+ifdef CONFIG_FEEDBACK_COLLECT
+# vDSO code runs in userspace, not collecting feedback data.
+CFLAGS_REMOVE_vdso.o = -ffeedback-generate
+CFLAGS_REMOVE_vdso32.o = -ffeedback-generate
+CFLAGS_REMOVE_vrt_sigreturn.o = -ffeedback-generate
+CFLAGS_REMOVE_vrt_sigreturn32.o = -ffeedback-generate
+CFLAGS_REMOVE_vgettimeofday.o = -ffeedback-generate
+CFLAGS_REMOVE_vgettimeofday32.o = -ffeedback-generate
+endif
+
+# Disable gcov profiling for VDSO code
+GCOV_PROFILE := n
+
+# Force dependency
+$(obj)/vdso.o: $(obj)/vdso.so
+
+# link rule for the .so file, .lds has to be first
+SYSCFLAGS_vdso.so.dbg = $(c_flags)
+$(obj)/vdso.so.dbg: $(src)/vdso.lds $(obj-vdso)
+        $(call if_changed,vdsold)
+
+
+# We also create a special relocatable object that should mirror the symbol
+# table and layout of the linked DSO.  With ld -R we can then refer to
+# these symbols in the kernel code rather than hand-coded addresses.
+extra-y += vdso-syms.o
+$(obj)/built-in.o: $(obj)/vdso-syms.o
+$(obj)/built-in.o: ld_flags += -R $(obj)/vdso-syms.o
+
+SYSCFLAGS_vdso.so.dbg = -shared -s -Wl,-soname=linux-vdso.so.1 \
+                            $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
+SYSCFLAGS_vdso_syms.o = -r
+$(obj)/vdso-syms.o: $(src)/vdso.lds $(obj)/vrt_sigreturn.o FORCE
+        $(call if_changed,vdsold)
+
+
+# strip rule for the .so file
+$(obj)/%.so: OBJCOPYFLAGS := -S
+$(obj)/%.so: $(obj)/%.so.dbg FORCE
+        $(call if_changed,objcopy)
+
+# actual build commands
+# The DSO images are built using a special linker script
+# Add -lgcc so tilepro gets static muldi3 and lshrdi3 definitions.
+# Make sure only to export the intended __vdso_xxx symbol offsets.
+quiet_cmd_vdsold = VDSOLD  $@
+      cmd_vdsold = $(CC) $(KCFLAGS) -nostdlib $(SYSCFLAGS_$(@F)) \
+                           -Wl,-T,$(filter-out FORCE,$^) -o $@.tmp -lgcc && \
+                   $(CROSS_COMPILE)objcopy \
+                           $(patsubst %, -G __vdso_%, $(vdso-syms)) $@.tmp $@
+
+# install commands for the unstripped file
+quiet_cmd_vdso_install = INSTALL $@
+      cmd_vdso_install = cp $(obj)/$@.dbg $(MODLIB)/vdso/$@
+
+vdso.so: $(obj)/vdso.so.dbg
+        @mkdir -p $(MODLIB)/vdso
+        $(call cmd,vdso_install)
+
+vdso32.so: $(obj)/vdso32.so.dbg
+        $(call cmd,vdso_install)
+
+vdso_install: vdso.so
+vdso32_install: vdso32.so
+
+
+KBUILD_AFLAGS_32 := $(filter-out -m64,$(KBUILD_AFLAGS))
+KBUILD_AFLAGS_32 += -m32 -s
+KBUILD_CFLAGS_32 := $(filter-out -m64,$(KBUILD_CFLAGS))
+KBUILD_CFLAGS_32 += -m32 -fPIC -shared
+
+obj-vdso32 = $(patsubst %, v%32.o, $(vdso-syms))
+obj-vdso32 := $(addprefix $(obj)/, $(obj-vdso32))
+
+targets += $(obj-vdso32) vdso32.so vdso32.so.dbg
+
+$(obj-vdso32:%=%): KBUILD_AFLAGS = $(KBUILD_AFLAGS_32)
+$(obj-vdso32:%=%): KBUILD_CFLAGS = $(KBUILD_CFLAGS_32)
+
+$(obj)/vgettimeofday32.o: $(obj)/vgettimeofday.c
+        $(call if_changed,cc_o_c)
+
+$(obj)/vrt_sigreturn32.o: $(obj)/vrt_sigreturn.S
+        $(call if_changed,as_o_S)
+
+# Force dependency
+$(obj)/vdso32.o: $(obj)/vdso32.so
+
+SYSCFLAGS_vdso32.so.dbg = -m32 -shared -s -Wl,-soname=linux-vdso32.so.1 \
+                            $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
+$(obj)/vdso32.so.dbg: $(src)/vdso.lds $(obj-vdso32)
+        $(call if_changed,vdsold)
diff --git a/arch/tile/kernel/vdso/vdso.S b/arch/tile/kernel/vdso/vdso.S
new file mode 100644
index 000000000000..3467adb41630
--- /dev/null
+++ b/arch/tile/kernel/vdso/vdso.S
@@ -0,0 +1,28 @@
+/*
+ * Copyright 2012 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+#include <linux/init.h>
+#include <linux/linkage.h>
+#include <asm/page.h>
+
+        __PAGE_ALIGNED_DATA
+
+        .global vdso_start, vdso_end
+        .align PAGE_SIZE
+vdso_start:
+        .incbin "arch/tile/kernel/vdso/vdso.so"
+        .align PAGE_SIZE
+vdso_end:
+
+        .previous
diff --git a/arch/tile/kernel/vdso/vdso.lds.S b/arch/tile/kernel/vdso/vdso.lds.S
new file mode 100644
index 000000000000..041cd6c39c83
--- /dev/null
+++ b/arch/tile/kernel/vdso/vdso.lds.S
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2012 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+#define VDSO_VERSION_STRING     LINUX_2.6
+
+
+OUTPUT_ARCH(tile)
+
+/* The ELF entry point can be used to set the AT_SYSINFO value. */
+ENTRY(__vdso_rt_sigreturn);
+
+
+SECTIONS
+{
+        . = SIZEOF_HEADERS;
+
+        .hash           : { *(.hash) }                  :text
+        .gnu.hash       : { *(.gnu.hash) }
+        .dynsym         : { *(.dynsym) }
+        .dynstr         : { *(.dynstr) }
+        .gnu.version    : { *(.gnu.version) }
+        .gnu.version_d  : { *(.gnu.version_d) }
+        .gnu.version_r  : { *(.gnu.version_r) }
+
+        .note           : { *(.note.*) }                :text   :note
+        .dynamic        : { *(.dynamic) }               :text   :dynamic
+
+        .eh_frame_hdr   : { *(.eh_frame_hdr) }          :text   :eh_frame_hdr
+        .eh_frame       : { KEEP (*(.eh_frame)) }       :text
+
+        .rodata  : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
+
+        /*
+         * This linker script is used both with -r and with -shared.
+         * For the layouts to match, we need to skip more than enough
+         * space for the dynamic symbol table et al. If this amount
+         * is insufficient, ld -shared will barf. Just increase it here.
+         */
+        . = 0x1000;
+        .text           : { *(.text .text.*) }          :text
+
+        .data           : {
+                *(.got.plt) *(.got)
+                *(.data .data.* .gnu.linkonce.d.*)
+                *(.dynbss)
+                *(.bss .bss.* .gnu.linkonce.b.*)
+        }
+}
+
+
+/*
+ * We must supply the ELF program headers explicitly to get just one
+ * PT_LOAD segment, and set the flags explicitly to make segments read-only.
+ */
+PHDRS
+{
+        text            PT_LOAD         FLAGS(5) FILEHDR PHDRS; /* PF_R|PF_X */
+        dynamic         PT_DYNAMIC      FLAGS(4);               /* PF_R */
+        note            PT_NOTE         FLAGS(4);               /* PF_R */
+        eh_frame_hdr    PT_GNU_EH_FRAME;
+}
+
+
+/*
+ * This controls what userland symbols we export from the vDSO.
+ */
+VERSION
+{
+        VDSO_VERSION_STRING {
+        global:
+                __vdso_rt_sigreturn;
+                __vdso_gettimeofday;
+                gettimeofday;
+        local:*;
+        };
+}
diff --git a/arch/tile/kernel/vdso/vdso32.S b/arch/tile/kernel/vdso/vdso32.S
new file mode 100644
index 000000000000..1d1ac3257e11
--- /dev/null
+++ b/arch/tile/kernel/vdso/vdso32.S
@@ -0,0 +1,28 @@
+/*
+ * Copyright 2013 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+#include <linux/init.h>
+#include <linux/linkage.h>
+#include <asm/page.h>
+
+        __PAGE_ALIGNED_DATA
+
+        .global vdso32_start, vdso32_end
+        .align PAGE_SIZE
+vdso32_start:
+        .incbin "arch/tile/kernel/vdso/vdso32.so"
+        .align PAGE_SIZE
+vdso32_end:
+
+        .previous
diff --git a/arch/tile/kernel/vdso/vgettimeofday.c b/arch/tile/kernel/vdso/vgettimeofday.c
new file mode 100644
index 000000000000..51ec8e46f5f9
--- /dev/null
+++ b/arch/tile/kernel/vdso/vgettimeofday.c
@@ -0,0 +1,107 @@
+/*
+ * Copyright 2012 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+#define VDSO_BUILD  /* avoid some shift warnings for -m32 in <asm/page.h> */
+#include <linux/time.h>
+#include <asm/timex.h>
+#include <asm/vdso.h>
+
+#if CHIP_HAS_SPLIT_CYCLE()
+static inline cycles_t get_cycles_inline(void)
+{
+        unsigned int high = __insn_mfspr(SPR_CYCLE_HIGH);
+        unsigned int low = __insn_mfspr(SPR_CYCLE_LOW);
+        unsigned int high2 = __insn_mfspr(SPR_CYCLE_HIGH);
+
+        while (unlikely(high != high2)) {
+                low = __insn_mfspr(SPR_CYCLE_LOW);
+                high = high2;
+                high2 = __insn_mfspr(SPR_CYCLE_HIGH);
+        }
+
+        return (((cycles_t)high) << 32) | low;
+}
+#define get_cycles get_cycles_inline
+#endif
+
+/*
+ * Find out the vDSO data page address in the process address space.
+ */
+inline unsigned long get_datapage(void)
+{
+        unsigned long ret;
+
+        /* vdso data page located in the 2nd vDSO page. */
+        asm volatile ("lnk %0" : "=r"(ret));
+        ret &= ~(PAGE_SIZE - 1);
+        ret += PAGE_SIZE;
+
+        return ret;
+}
+
+int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
+{
+        cycles_t cycles;
+        unsigned long count, sec, ns;
+        volatile struct vdso_data *vdso_data;
+
+        vdso_data = (struct vdso_data *)get_datapage();
+        /* The use of the timezone is obsolete, normally tz is NULL. */
+        if (unlikely(tz != NULL)) {
+                while (1) {
+                        /* Spin until the update finish. */
+                        count = vdso_data->tz_update_count;
+                        if (count & 1)
+                                continue;
+
+                        tz->tz_minuteswest = vdso_data->tz_minuteswest;
+                        tz->tz_dsttime = vdso_data->tz_dsttime;
+
+                        /* Check whether updated, read again if so. */
+                        if (count == vdso_data->tz_update_count)
+                                break;
+                }
+        }
+
+        if (unlikely(tv == NULL))
+                return 0;
+
+        while (1) {
+                /* Spin until the update finish. */
+                count = vdso_data->tb_update_count;
+                if (count & 1)
+                        continue;
+
+                cycles = (get_cycles() - vdso_data->xtime_tod_stamp);
+                ns = (cycles * vdso_data->mult) >> vdso_data->shift;
+                sec = vdso_data->xtime_clock_sec;
+                ns += vdso_data->xtime_clock_nsec;
+                if (ns >= NSEC_PER_SEC) {
+                        ns -= NSEC_PER_SEC;
+                        sec += 1;
+                }
+
+                /* Check whether updated, read again if so. */
+                if (count == vdso_data->tb_update_count)
+                        break;
+        }
+
+        tv->tv_sec = sec;
+        tv->tv_usec = ns / 1000;
+
+        return 0;
+}
+
+int gettimeofday(struct timeval *tv, struct timezone *tz)
+        __attribute__((weak, alias("__vdso_gettimeofday")));
diff --git a/arch/tile/kernel/vdso/vrt_sigreturn.S b/arch/tile/kernel/vdso/vrt_sigreturn.S
new file mode 100644
index 000000000000..6326caf4a039
--- /dev/null
+++ b/arch/tile/kernel/vdso/vrt_sigreturn.S
@@ -0,0 +1,30 @@
+/*
+ * Copyright 2012 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+#include <linux/linkage.h>
+#include <arch/abi.h>
+#include <asm/unistd.h>
+
+/*
+ * Note that libc has a copy of this function that it uses to compare
+ * against the PC when a stack backtrace ends, so if this code is
+ * changed, the libc implementation(s) should also be updated.
+ */
+ENTRY(__vdso_rt_sigreturn)
+        moveli TREG_SYSCALL_NR_NAME, __NR_rt_sigreturn
+        swint1
+        /* We don't use ENDPROC to avoid tagging this symbol as FUNC,
+         * which confuses the perf tool.
+         */
+        END(__vdso_rt_sigreturn)
diff --git a/arch/tile/kernel/vmlinux.lds.S b/arch/tile/kernel/vmlinux.lds.S
index a13ed902afbb..f1819423ffc9 100644
--- a/arch/tile/kernel/vmlinux.lds.S
+++ b/arch/tile/kernel/vmlinux.lds.S
@@ -5,7 +5,7 @@
 #include <hv/hypervisor.h>
 
 /* Text loads starting from the supervisor interrupt vector address. */
-#define TEXT_OFFSET MEM_SV_INTRPT
+#define TEXT_OFFSET MEM_SV_START
 
 OUTPUT_ARCH(tile)
 ENTRY(_start)
@@ -13,7 +13,7 @@ jiffies = jiffies_64;
 
 PHDRS
 {
-  intrpt1 PT_LOAD ;
+  intrpt PT_LOAD ;
   text PT_LOAD ;
   data PT_LOAD ;
 }
@@ -24,14 +24,17 @@ SECTIONS
   #define LOAD_OFFSET TEXT_OFFSET
 
   /* Interrupt vectors */
-  .intrpt1 (LOAD_OFFSET) : AT ( 0 )   /* put at the start of physical memory */
+  .intrpt (LOAD_OFFSET) : AT ( 0 )   /* put at the start of physical memory */
   {
     _text = .;
-    *(.intrpt1)
-  } :intrpt1 =0
+    *(.intrpt)
+  } :intrpt =0
 
   /* Hypervisor call vectors */
-  #include "hvglue.lds"
+  . = ALIGN(0x10000);
+  .hvglue : AT (ADDR(.hvglue) - LOAD_OFFSET) {
+    *(.hvglue)
+  } :NONE
 
   /* Now the real code */
   . = ALIGN(0x20000);
@@ -40,7 +43,11 @@ SECTIONS
     HEAD_TEXT
     SCHED_TEXT
     LOCK_TEXT
+    KPROBES_TEXT
+    IRQENTRY_TEXT
     __fix_text_end = .;   /* tile-cpack won't rearrange before this */
+    ALIGN_FUNCTION();
+    *(.hottext*)
     TEXT_TEXT
     *(.text.*)
     *(.coldtext*)
@@ -67,20 +74,8 @@ SECTIONS
   __init_end = .;
 
   _sdata = .;                   /* Start of data section */
-
   RO_DATA_SECTION(PAGE_SIZE)
-
-  /* initially writeable, then read-only */
-  . = ALIGN(PAGE_SIZE);
-  __w1data_begin = .;
-  .w1data : AT(ADDR(.w1data) - LOAD_OFFSET) {
-    VMLINUX_SYMBOL(__w1data_begin) = .;
-    *(.w1data)
-    VMLINUX_SYMBOL(__w1data_end) = .;
-  }
-
   RW_DATA_SECTION(L2_CACHE_BYTES, PAGE_SIZE, THREAD_SIZE)
-
   _edata = .;
 
   EXCEPTION_TABLE(L2_CACHE_BYTES)
diff --git a/arch/tile/lib/Makefile b/arch/tile/lib/Makefile
index 985f59858234..c4211cbb2021 100644
--- a/arch/tile/lib/Makefile
+++ b/arch/tile/lib/Makefile
@@ -4,15 +4,15 @@
 
 lib-y = cacheflush.o checksum.o cpumask.o delay.o uaccess.o \
         memmove.o memcpy_$(BITS).o memchr_$(BITS).o memset_$(BITS).o \
-        strchr_$(BITS).o strlen_$(BITS).o
-
-ifeq ($(CONFIG_TILEGX),y)
-CFLAGS_REMOVE_memcpy_user_64.o = -fno-omit-frame-pointer
-lib-y += memcpy_user_64.o
-else
-lib-y += atomic_32.o atomic_asm_32.o memcpy_tile64.o
-endif
+        strchr_$(BITS).o strlen_$(BITS).o strnlen_$(BITS).o
 
+lib-$(CONFIG_TILEGX) += memcpy_user_64.o
+lib-$(CONFIG_TILEPRO) += atomic_32.o atomic_asm_32.o
 lib-$(CONFIG_SMP) += spinlock_$(BITS).o usercopy_$(BITS).o
 
 obj-$(CONFIG_MODULES) += exports.o
+
+# The finv_buffer_remote() and copy_{to,from}_user() routines can't
+# have -pg added, since they both rely on being leaf functions.
+CFLAGS_REMOVE_cacheflush.o = -pg
+CFLAGS_REMOVE_memcpy_user_64.o = -pg
diff --git a/arch/tile/lib/atomic_32.c b/arch/tile/lib/atomic_32.c
index f5cada70c3c8..759efa337be8 100644
--- a/arch/tile/lib/atomic_32.c
+++ b/arch/tile/lib/atomic_32.c
@@ -20,50 +20,12 @@
 #include <linux/atomic.h>
 #include <arch/chip.h>
 
-/* See <asm/atomic_32.h> */
-#if ATOMIC_LOCKS_FOUND_VIA_TABLE()
-
-/*
- * A block of memory containing locks for atomic ops. Each instance of this
- * struct will be homed on a different CPU.
- */
-struct atomic_locks_on_cpu {
-        int lock[ATOMIC_HASH_L2_SIZE];
-} __attribute__((aligned(ATOMIC_HASH_L2_SIZE * 4)));
-
-static DEFINE_PER_CPU(struct atomic_locks_on_cpu, atomic_lock_pool);
-
-/* The locks we'll use until __init_atomic_per_cpu is called. */
-static struct atomic_locks_on_cpu __initdata initial_atomic_locks;
-
-/* Hash into this vector to get a pointer to lock for the given atomic. */
-struct atomic_locks_on_cpu *atomic_lock_ptr[ATOMIC_HASH_L1_SIZE]
-        __write_once = {
-        [0 ... ATOMIC_HASH_L1_SIZE-1] (&initial_atomic_locks)
-};
-
-#else /* ATOMIC_LOCKS_FOUND_VIA_TABLE() */
-
 /* This page is remapped on startup to be hash-for-home. */
 int atomic_locks[PAGE_SIZE / sizeof(int)] __page_aligned_bss;
 
-#endif /* ATOMIC_LOCKS_FOUND_VIA_TABLE() */
-
 int *__atomic_hashed_lock(volatile void *v)
 {
         /* NOTE: this code must match "sys_cmpxchg" in kernel/intvec_32.S */
-#if ATOMIC_LOCKS_FOUND_VIA_TABLE()
-        unsigned long i =
-                (unsigned long) v & ((PAGE_SIZE-1) & -sizeof(long long));
-        unsigned long n = __insn_crc32_32(0, i);
-
-        /* Grab high bits for L1 index. */
-        unsigned long l1_index = n >> ((sizeof(n) * 8) - ATOMIC_HASH_L1_SHIFT);
-        /* Grab low bits for L2 index. */
-        unsigned long l2_index = n & (ATOMIC_HASH_L2_SIZE - 1);
-
-        return &atomic_lock_ptr[l1_index]->lock[l2_index];
-#else
         /*
          * Use bits [3, 3 + ATOMIC_HASH_SHIFT) as the lock index.
          * Using mm works here because atomic_locks is page aligned.
@@ -72,26 +34,13 @@ int *__atomic_hashed_lock(volatile void *v)
                                       (unsigned long)atomic_locks,
                                       2, (ATOMIC_HASH_SHIFT + 2) - 1);
         return (int *)ptr;
-#endif
 }
 
 #ifdef CONFIG_SMP
 /* Return whether the passed pointer is a valid atomic lock pointer. */
 static int is_atomic_lock(int *p)
 {
-#if ATOMIC_LOCKS_FOUND_VIA_TABLE()
-        int i;
-        for (i = 0; i < ATOMIC_HASH_L1_SIZE; ++i) {
-
-                if (p >= &atomic_lock_ptr[i]->lock[0] &&
-                    p < &atomic_lock_ptr[i]->lock[ATOMIC_HASH_L2_SIZE]) {
-                        return 1;
-                }
-        }
-        return 0;
-#else
         return p >= &atomic_locks[0] && p < &atomic_locks[ATOMIC_HASH_SIZE];
-#endif
 }
 
 void __atomic_fault_unlock(int *irqlock_word)
@@ -110,33 +59,32 @@ static inline int *__atomic_setup(volatile void *v)
         return __atomic_hashed_lock(v);
 }
 
-int _atomic_xchg(atomic_t *v, int n)
+int _atomic_xchg(int *v, int n)
 {
-        return __atomic_xchg(&v->counter, __atomic_setup(v), n).val;
+        return __atomic_xchg(v, __atomic_setup(v), n).val;
 }
 EXPORT_SYMBOL(_atomic_xchg);
 
-int _atomic_xchg_add(atomic_t *v, int i)
+int _atomic_xchg_add(int *v, int i)
 {
-        return __atomic_xchg_add(&v->counter, __atomic_setup(v), i).val;
+        return __atomic_xchg_add(v, __atomic_setup(v), i).val;
 }
 EXPORT_SYMBOL(_atomic_xchg_add);
 
-int _atomic_xchg_add_unless(atomic_t *v, int a, int u)
+int _atomic_xchg_add_unless(int *v, int a, int u)
 {
         /*
          * Note: argument order is switched here since it is easier
          * to use the first argument consistently as the "old value"
          * in the assembly, as is done for _atomic_cmpxchg().
          */
-        return __atomic_xchg_add_unless(&v->counter, __atomic_setup(v), u, a)
-                .val;
+        return __atomic_xchg_add_unless(v, __atomic_setup(v), u, a).val;
 }
 EXPORT_SYMBOL(_atomic_xchg_add_unless);
 
-int _atomic_cmpxchg(atomic_t *v, int o, int n)
+int _atomic_cmpxchg(int *v, int o, int n)
 {
-        return __atomic_cmpxchg(&v->counter, __atomic_setup(v), o, n).val;
+        return __atomic_cmpxchg(v, __atomic_setup(v), o, n).val;
 }
 EXPORT_SYMBOL(_atomic_cmpxchg);
 
@@ -159,33 +107,32 @@ unsigned long _atomic_xor(volatile unsigned long *p, unsigned long mask)
 EXPORT_SYMBOL(_atomic_xor);
 
 
-u64 _atomic64_xchg(atomic64_t *v, u64 n)
+u64 _atomic64_xchg(u64 *v, u64 n)
 {
-        return __atomic64_xchg(&v->counter, __atomic_setup(v), n);
+        return __atomic64_xchg(v, __atomic_setup(v), n);
 }
 EXPORT_SYMBOL(_atomic64_xchg);
 
-u64 _atomic64_xchg_add(atomic64_t *v, u64 i)
+u64 _atomic64_xchg_add(u64 *v, u64 i)
 {
-        return __atomic64_xchg_add(&v->counter, __atomic_setup(v), i);
+        return __atomic64_xchg_add(v, __atomic_setup(v), i);
 }
 EXPORT_SYMBOL(_atomic64_xchg_add);
 
-u64 _atomic64_xchg_add_unless(atomic64_t *v, u64 a, u64 u)
+u64 _atomic64_xchg_add_unless(u64 *v, u64 a, u64 u)
 {
         /*
          * Note: argument order is switched here since it is easier
          * to use the first argument consistently as the "old value"
          * in the assembly, as is done for _atomic_cmpxchg().
          */
-        return __atomic64_xchg_add_unless(&v->counter, __atomic_setup(v),
-                                          u, a);
+        return __atomic64_xchg_add_unless(v, __atomic_setup(v), u, a);
 }
 EXPORT_SYMBOL(_atomic64_xchg_add_unless);
 
-u64 _atomic64_cmpxchg(atomic64_t *v, u64 o, u64 n)
+u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n)
 {
-        return __atomic64_cmpxchg(&v->counter, __atomic_setup(v), o, n);
+        return __atomic64_cmpxchg(v, __atomic_setup(v), o, n);
 }
 EXPORT_SYMBOL(_atomic64_cmpxchg);
 
@@ -208,54 +155,8 @@ struct __get_user __atomic_bad_address(int __user *addr)
 }
 
 
-#if CHIP_HAS_CBOX_HOME_MAP()
-static int __init noatomichash(char *str)
-{
-        pr_warning("noatomichash is deprecated.\n");
-        return 1;
-}
-__setup("noatomichash", noatomichash);
-#endif
-
 void __init __init_atomic_per_cpu(void)
 {
-#if ATOMIC_LOCKS_FOUND_VIA_TABLE()
-
-        unsigned int i;
-        int actual_cpu;
-
-        /*
-         * Before this is called from setup, we just have one lock for
-         * all atomic objects/operations.  Here we replace the
-         * elements of atomic_lock_ptr so that they point at per_cpu
-         * integers.  This seemingly over-complex approach stems from
-         * the fact that DEFINE_PER_CPU defines an entry for each cpu
-         * in the grid, not each cpu from 0..ATOMIC_HASH_SIZE-1.  But
-         * for efficient hashing of atomics to their locks we want a
-         * compile time constant power of 2 for the size of this
-         * table, so we use ATOMIC_HASH_SIZE.
-         *
-         * Here we populate atomic_lock_ptr from the per cpu
-         * atomic_lock_pool, interspersing by actual cpu so that
-         * subsequent elements are homed on consecutive cpus.
-         */
-
-        actual_cpu = cpumask_first(cpu_possible_mask);
-
-        for (i = 0; i < ATOMIC_HASH_L1_SIZE; ++i) {
-                /*
-                 * Preincrement to slightly bias against using cpu 0,
-                 * which has plenty of stuff homed on it already.
-                 */
-                actual_cpu = cpumask_next(actual_cpu, cpu_possible_mask);
-                if (actual_cpu >= nr_cpu_ids)
-                        actual_cpu = cpumask_first(cpu_possible_mask);
-
-                atomic_lock_ptr[i] = &per_cpu(atomic_lock_pool, actual_cpu);
-        }
-
-#else /* ATOMIC_LOCKS_FOUND_VIA_TABLE() */
-
         /* Validate power-of-two and "bigger than cpus" assumption */
         BUILD_BUG_ON(ATOMIC_HASH_SIZE & (ATOMIC_HASH_SIZE-1));
         BUG_ON(ATOMIC_HASH_SIZE < nr_cpu_ids);
@@ -279,6 +180,4 @@ void __init __init_atomic_per_cpu(void)
          * That should not produce more indices than ATOMIC_HASH_SIZE.
          */
         BUILD_BUG_ON((PAGE_SIZE >> 3) > ATOMIC_HASH_SIZE);
-
-#endif /* ATOMIC_LOCKS_FOUND_VIA_TABLE() */
 }
diff --git a/arch/tile/lib/atomic_asm_32.S b/arch/tile/lib/atomic_asm_32.S
index 30638042691d..6bda3132cd61 100644
--- a/arch/tile/lib/atomic_asm_32.S
+++ b/arch/tile/lib/atomic_asm_32.S
@@ -164,6 +164,7 @@ STD_ENTRY_SECTION(__atomic\name, .text.atomic)
         STD_ENDPROC(__atomic\name)
         .ifc \bitwidth,32
         .pushsection __ex_table,"a"
+        .align  4
         .word   1b, __atomic\name
         .word   2b, __atomic\name
         .word   __atomic\name, __atomic_bad_address
diff --git a/arch/tile/lib/cacheflush.c b/arch/tile/lib/cacheflush.c
index 8f8ad814b139..9c0ec22009a5 100644
--- a/arch/tile/lib/cacheflush.c
+++ b/arch/tile/lib/cacheflush.c
@@ -36,7 +36,8 @@ static inline void force_load(char *p)
  * core (if "!hfh") or homed via hash-for-home (if "hfh"), waiting
  * until the memory controller holds the flushed values.
  */
-void finv_buffer_remote(void *buffer, size_t size, int hfh)
+void __attribute__((optimize("omit-frame-pointer")))
+finv_buffer_remote(void *buffer, size_t size, int hfh)
 {
         char *p, *base;
         size_t step_size, load_count;
@@ -147,18 +148,21 @@ void finv_buffer_remote(void *buffer, size_t size, int hfh)
                 force_load(p);
 
         /*
-         * Repeat, but with inv's instead of loads, to get rid of the
+         * Repeat, but with finv's instead of loads, to get rid of the
          * data we just loaded into our own cache and the old home L3.
-         * No need to unroll since inv's don't target a register.
+         * No need to unroll since finv's don't target a register.
+         * The finv's are guaranteed not to actually flush the data in
+         * the buffer back to their home, since we just read it, so the
+         * lines are clean in cache; we will only invalidate those lines.
          */
         p = (char *)buffer + size - 1;
-        __insn_inv(p);
+        __insn_finv(p);
         p -= step_size;
         p = (char *)((unsigned long)p | (step_size - 1));
         for (; p >= base; p -= step_size)
-                __insn_inv(p);
+                __insn_finv(p);
 
-        /* Wait for the load+inv's (and thus finvs) to have completed. */
+        /* Wait for these finv's (and thus the first finvs) to be done. */
         __insn_mf();
 
 #ifdef __tilegx__
diff --git a/arch/tile/lib/exports.c b/arch/tile/lib/exports.c
index a93b02a25222..82733c87d67e 100644
--- a/arch/tile/lib/exports.c
+++ b/arch/tile/lib/exports.c
@@ -22,7 +22,6 @@ EXPORT_SYMBOL(strnlen_user_asm);
 EXPORT_SYMBOL(strncpy_from_user_asm);
 EXPORT_SYMBOL(clear_user_asm);
 EXPORT_SYMBOL(flush_user_asm);
-EXPORT_SYMBOL(inv_user_asm);
 EXPORT_SYMBOL(finv_user_asm);
 
 /* arch/tile/kernel/entry.S */
@@ -34,6 +33,12 @@ EXPORT_SYMBOL(dump_stack);
 /* arch/tile/kernel/head.S */
 EXPORT_SYMBOL(empty_zero_page);
 
+#ifdef CONFIG_FUNCTION_TRACER
+/* arch/tile/kernel/mcount_64.S */
+#include <asm/ftrace.h>
+EXPORT_SYMBOL(__mcount);
+#endif /* CONFIG_FUNCTION_TRACER */
+
 /* arch/tile/lib/, various memcpy files */
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(__copy_to_user_inatomic);
diff --git a/arch/tile/lib/memchr_64.c b/arch/tile/lib/memchr_64.c
index 6f867dbf7c56..f8196b3a950e 100644
--- a/arch/tile/lib/memchr_64.c
+++ b/arch/tile/lib/memchr_64.c
@@ -36,7 +36,7 @@ void *memchr(const void *s, int c, size_t n)
         p = (const uint64_t *)(s_int & -8);
 
         /* Create eight copies of the byte for which we are looking. */
-        goal = 0x0101010101010101ULL * (uint8_t) c;
+        goal = copy_byte(c);
 
         /* Read the first word, but munge it so that bytes before the array
          * will not match goal.
diff --git a/arch/tile/lib/memcpy_32.S b/arch/tile/lib/memcpy_32.S
index 2a419a6122db..a2771ae5da53 100644
--- a/arch/tile/lib/memcpy_32.S
+++ b/arch/tile/lib/memcpy_32.S
@@ -22,14 +22,6 @@
 
 #include <linux/linkage.h>
 
-/* On TILE64, we wrap these functions via arch/tile/lib/memcpy_tile64.c */
-#if !CHIP_HAS_COHERENT_LOCAL_CACHE()
-#define memcpy __memcpy_asm
-#define __copy_to_user_inatomic __copy_to_user_inatomic_asm
-#define __copy_from_user_inatomic __copy_from_user_inatomic_asm
-#define __copy_from_user_zeroing __copy_from_user_zeroing_asm
-#endif
-
 #define IS_MEMCPY         0
 #define IS_COPY_FROM_USER  1
 #define IS_COPY_FROM_USER_ZEROING  2
@@ -44,6 +36,7 @@
  */
 #define EX \
         .pushsection __ex_table, "a"; \
+        .align 4; \
         .word 9f, memcpy_common_fixup; \
         .popsection; \
         9
@@ -158,12 +151,9 @@ EX:	{ sw r0, r3; addi r0, r0, 4; addi r2, r2, -4 }
 
         { addi r3, r1, 60; andi r9, r9, -64 }
 
-#if CHIP_HAS_WH64()
         /* No need to prefetch dst, we'll just do the wh64
          * right before we copy a line.
          */
-#endif
-
 EX:     { lw r5, r3; addi r3, r3, 64; movei r4, 1 }
         /* Intentionally stall for a few cycles to leave L2 cache alone. */
         { bnzt zero, .; move r27, lr }
@@ -171,21 +161,6 @@ EX:	{ lw r6, r3; addi r3, r3, 64 }
         /* Intentionally stall for a few cycles to leave L2 cache alone. */
         { bnzt zero, . }
 EX:     { lw r7, r3; addi r3, r3, 64 }
-#if !CHIP_HAS_WH64()
-        /* Prefetch the dest */
-        /* Intentionally stall for a few cycles to leave L2 cache alone. */
-        { bnzt zero, . }
-        /* Use a real load to cause a TLB miss if necessary.  We aren't using
-         * r28, so this should be fine.
-         */
-EX:     { lw r28, r9; addi r9, r9, 64 }
-        /* Intentionally stall for a few cycles to leave L2 cache alone. */
-        { bnzt zero, . }
-        { prefetch r9; addi r9, r9, 64 }
-        /* Intentionally stall for a few cycles to leave L2 cache alone. */
-        { bnzt zero, . }
-        { prefetch r9; addi r9, r9, 64 }
-#endif
         /* Intentionally stall for a few cycles to leave L2 cache alone. */
         { bz zero, .Lbig_loop2 }
 
@@ -286,13 +261,8 @@ EX:	{ lw r7, r3; addi r3, r3, 64 }
         /* Fill second L1D line. */
 EX:     { lw r17, r17; addi r1, r1, 48; mvz r3, r13, r1 } /* r17 = WORD_4 */
 
-#if CHIP_HAS_WH64()
         /* Prepare destination line for writing. */
 EX:     { wh64 r9; addi r9, r9, 64 }
-#else
-        /* Prefetch dest line */
-        { prefetch r9; addi r9, r9, 64 }
-#endif
         /* Load seven words that are L1D hits to cover wh64 L2 usage. */
 
         /* Load the three remaining words from the last L1D line, which
@@ -330,16 +300,7 @@ EX:	{ lw r18, r1; addi r1, r1, 4 }                  /* r18 = WORD_8 */
 EX:     { sw r0, r16; addi r0, r0, 4; add r16, r0, r2 } /* store(WORD_0) */
 EX:     { sw r0, r13; addi r0, r0, 4; andi r16, r16, -64 } /* store(WORD_1) */
 EX:     { sw r0, r14; addi r0, r0, 4; slt_u r16, r9, r16 } /* store(WORD_2) */
-#if CHIP_HAS_WH64()
 EX:     { sw r0, r15; addi r0, r0, 4; addi r13, sp, -64 } /* store(WORD_3) */
-#else
-        /* Back up the r9 to a cache line we are already storing to
-         * if it gets past the end of the dest vector.  Strictly speaking,
-         * we don't need to back up to the start of a cache line, but it's free
-         * and tidy, so why not?
-         */
-EX:     { sw r0, r15; addi r0, r0, 4; andi r13, r0, -64 } /* store(WORD_3) */
-#endif
         /* Store second L1D line. */
 EX:     { sw r0, r17; addi r0, r0, 4; mvz r9, r16, r13 }/* store(WORD_4) */
 EX:     { sw r0, r19; addi r0, r0, 4 }                  /* store(WORD_5) */
@@ -403,7 +364,6 @@ EX:	{ sb r0, r3;   addi r0, r0, 1; addi r2, r2, -1 }
 
 .Ldest_is_word_aligned:
 
-#if CHIP_HAS_DWORD_ALIGN()
 EX:     { andi r8, r0, 63; lwadd_na r6, r1, 4}
         { slti_u r9, r2, 64; bz r8, .Ldest_is_L2_line_aligned }
 
@@ -511,26 +471,6 @@ EX:	{ swadd r0, r13, 4; addi r2, r2, -32 }
         /* Move r1 back to the point where it corresponds to r0. */
         { addi r1, r1, -4 }
 
-#else /* !CHIP_HAS_DWORD_ALIGN() */
-
-        /* Compute right/left shift counts and load initial source words. */
-        { andi r5, r1, -4; andi r3, r1, 3 }
-EX:     { lw r6, r5; addi r5, r5, 4; shli r3, r3, 3 }
-EX:     { lw r7, r5; addi r5, r5, 4; sub r4, zero, r3 }
-
-        /* Load and store one word at a time, using shifts and ORs
-         * to correct for the misaligned src.
-         */
-.Lcopy_unaligned_src_loop:
-        { shr r6, r6, r3; shl r8, r7, r4 }
-EX:     { lw r7, r5; or r8, r8, r6; move r6, r7 }
-EX:     { sw r0, r8; addi r0, r0, 4; addi r2, r2, -4 }
-        { addi r5, r5, 4; slti_u r8, r2, 8 }
-        { bzt r8, .Lcopy_unaligned_src_loop; addi r1, r1, 4 }
-
-        { bz r2, .Lcopy_unaligned_done }
-#endif /* !CHIP_HAS_DWORD_ALIGN() */
-
         /* Fall through */
 
 /*
@@ -614,5 +554,6 @@ memcpy_fixup_loop:
         .size memcpy_common_fixup, . - memcpy_common_fixup
 
         .section __ex_table,"a"
+        .align 4
         .word .Lcfu, .Lcopy_from_user_fixup_zero_remainder
         .word .Lctu, .Lcopy_to_user_fixup_done
diff --git a/arch/tile/lib/memcpy_64.c b/arch/tile/lib/memcpy_64.c
index c79b8e7c6828..4815354b8cd2 100644
--- a/arch/tile/lib/memcpy_64.c
+++ b/arch/tile/lib/memcpy_64.c
@@ -18,14 +18,17 @@
 /* EXPORT_SYMBOL() is in arch/tile/lib/exports.c since this should be asm. */
 
 /* Must be 8 bytes in size. */
-#define word_t uint64_t
+#define op_t uint64_t
 
-#if CHIP_L2_LINE_SIZE() != 64 && CHIP_L2_LINE_SIZE() != 128
-#error "Assumes 64 or 128 byte line size"
+/* Threshold value for when to enter the unrolled loops. */
+#define OP_T_THRES      16
+
+#if CHIP_L2_LINE_SIZE() != 64
+#error "Assumes 64 byte line size"
 #endif
 
 /* How many cache lines ahead should we prefetch? */
-#define PREFETCH_LINES_AHEAD 3
+#define PREFETCH_LINES_AHEAD 4
 
 /*
  * Provide "base versions" of load and store for the normal code path.
@@ -51,15 +54,16 @@ void *memcpy(void *__restrict dstv, const void *__restrict srcv, size_t n)
  * macros to return a count of uncopied bytes due to mm fault.
  */
 #define RETVAL 0
-int USERCOPY_FUNC(void *__restrict dstv, const void *__restrict srcv, size_t n)
+int __attribute__((optimize("omit-frame-pointer")))
+USERCOPY_FUNC(void *__restrict dstv, const void *__restrict srcv, size_t n)
 #endif
 {
         char *__restrict dst1 = (char *)dstv;
         const char *__restrict src1 = (const char *)srcv;
         const char *__restrict src1_end;
         const char *__restrict prefetch;
-        word_t *__restrict dst8;    /* 8-byte pointer to destination memory. */
-        word_t final; /* Final bytes to write to trailing word, if any */
+        op_t *__restrict dst8;    /* 8-byte pointer to destination memory. */
+        op_t final; /* Final bytes to write to trailing word, if any */
         long i;
 
         if (n < 16) {
@@ -79,104 +83,228 @@ int USERCOPY_FUNC(void *__restrict dstv, const void *__restrict srcv, size_t n)
         for (i = 0; i < PREFETCH_LINES_AHEAD; i++) {
                 __insn_prefetch(prefetch);
                 prefetch += CHIP_L2_LINE_SIZE();
-                prefetch = (prefetch > src1_end) ? prefetch : src1;
+                prefetch = (prefetch < src1_end) ? prefetch : src1;
         }
 
         /* Copy bytes until dst is word-aligned. */
-        for (; (uintptr_t)dst1 & (sizeof(word_t) - 1); n--)
+        for (; (uintptr_t)dst1 & (sizeof(op_t) - 1); n--)
                 ST1(dst1++, LD1(src1++));
 
         /* 8-byte pointer to destination memory. */
-        dst8 = (word_t *)dst1;
-
-        if (__builtin_expect((uintptr_t)src1 & (sizeof(word_t) - 1), 0)) {
-                /*
-                 * Misaligned copy.  Copy 8 bytes at a time, but don't
-                 * bother with other fanciness.
-                 *
-                 * TODO: Consider prefetching and using wh64 as well.
-                 */
-
-                /* Create an aligned src8. */
-                const word_t *__restrict src8 =
-                        (const word_t *)((uintptr_t)src1 & -sizeof(word_t));
-                word_t b;
-
-                word_t a = LD8(src8++);
-                for (; n >= sizeof(word_t); n -= sizeof(word_t)) {
-                        b = LD8(src8++);
-                        a = __insn_dblalign(a, b, src1);
-                        ST8(dst8++, a);
-                        a = b;
+        dst8 = (op_t *)dst1;
+
+        if (__builtin_expect((uintptr_t)src1 & (sizeof(op_t) - 1), 0)) {
+                /* Unaligned copy. */
+
+                op_t  tmp0 = 0, tmp1 = 0, tmp2, tmp3;
+                const op_t *src8 = (const op_t *) ((uintptr_t)src1 &
+                                                   -sizeof(op_t));
+                const void *srci = (void *)src1;
+                int m;
+
+                m = (CHIP_L2_LINE_SIZE() << 2) -
+                        (((uintptr_t)dst8) & ((CHIP_L2_LINE_SIZE() << 2) - 1));
+                m = (n < m) ? n : m;
+                m /= sizeof(op_t);
+
+                /* Copy until 'dst' is cache-line-aligned. */
+                n -= (sizeof(op_t) * m);
+
+                switch (m % 4) {
+                case 0:
+                        if (__builtin_expect(!m, 0))
+                                goto _M0;
+                        tmp1 = LD8(src8++);
+                        tmp2 = LD8(src8++);
+                        goto _8B3;
+                case 2:
+                        m += 2;
+                        tmp3 = LD8(src8++);
+                        tmp0 = LD8(src8++);
+                        goto _8B1;
+                case 3:
+                        m += 1;
+                        tmp2 = LD8(src8++);
+                        tmp3 = LD8(src8++);
+                        goto _8B2;
+                case 1:
+                        m--;
+                        tmp0 = LD8(src8++);
+                        tmp1 = LD8(src8++);
+                        if (__builtin_expect(!m, 0))
+                                goto _8B0;
+                }
+
+                do {
+                        tmp2 = LD8(src8++);
+                        tmp0 =  __insn_dblalign(tmp0, tmp1, srci);
+                        ST8(dst8++, tmp0);
+_8B3:
+                        tmp3 = LD8(src8++);
+                        tmp1 = __insn_dblalign(tmp1, tmp2, srci);
+                        ST8(dst8++, tmp1);
+_8B2:
+                        tmp0 = LD8(src8++);
+                        tmp2 = __insn_dblalign(tmp2, tmp3, srci);
+                        ST8(dst8++, tmp2);
+_8B1:
+                        tmp1 = LD8(src8++);
+                        tmp3 = __insn_dblalign(tmp3, tmp0, srci);
+                        ST8(dst8++, tmp3);
+                        m -= 4;
+                } while (m);
+
+_8B0:
+                tmp0 = __insn_dblalign(tmp0, tmp1, srci);
+                ST8(dst8++, tmp0);
+                src8--;
+
+_M0:
+                if (__builtin_expect(n >= CHIP_L2_LINE_SIZE(), 0)) {
+                        op_t tmp4, tmp5, tmp6, tmp7, tmp8;
+
+                        prefetch = ((const char *)src8) +
+                                CHIP_L2_LINE_SIZE() * PREFETCH_LINES_AHEAD;
+
+                        for (tmp0 = LD8(src8++); n >= CHIP_L2_LINE_SIZE();
+                             n -= CHIP_L2_LINE_SIZE()) {
+                                /* Prefetch and advance to next line to
+                                   prefetch, but don't go past the end.  */
+                                __insn_prefetch(prefetch);
+
+                                /* Make sure prefetch got scheduled
+                                   earlier.  */
+                                __asm__ ("" : : : "memory");
+
+                                prefetch += CHIP_L2_LINE_SIZE();
+                                prefetch = (prefetch < src1_end) ? prefetch :
+                                        (const char *) src8;
+
+                                tmp1 = LD8(src8++);
+                                tmp2 = LD8(src8++);
+                                tmp3 = LD8(src8++);
+                                tmp4 = LD8(src8++);
+                                tmp5 = LD8(src8++);
+                                tmp6 = LD8(src8++);
+                                tmp7 = LD8(src8++);
+                                tmp8 = LD8(src8++);
+
+                                tmp0 = __insn_dblalign(tmp0, tmp1, srci);
+                                tmp1 = __insn_dblalign(tmp1, tmp2, srci);
+                                tmp2 = __insn_dblalign(tmp2, tmp3, srci);
+                                tmp3 = __insn_dblalign(tmp3, tmp4, srci);
+                                tmp4 = __insn_dblalign(tmp4, tmp5, srci);
+                                tmp5 = __insn_dblalign(tmp5, tmp6, srci);
+                                tmp6 = __insn_dblalign(tmp6, tmp7, srci);
+                                tmp7 = __insn_dblalign(tmp7, tmp8, srci);
+
+                                __insn_wh64(dst8);
+
+                                ST8(dst8++, tmp0);
+                                ST8(dst8++, tmp1);
+                                ST8(dst8++, tmp2);
+                                ST8(dst8++, tmp3);
+                                ST8(dst8++, tmp4);
+                                ST8(dst8++, tmp5);
+                                ST8(dst8++, tmp6);
+                                ST8(dst8++, tmp7);
+
+                                tmp0 = tmp8;
+                        }
+                        src8--;
+                }
+
+                /* Copy the rest 8-byte chunks. */
+                if (n >= sizeof(op_t)) {
+                        tmp0 = LD8(src8++);
+                        for (; n >= sizeof(op_t); n -= sizeof(op_t)) {
+                                tmp1 = LD8(src8++);
+                                tmp0 = __insn_dblalign(tmp0, tmp1, srci);
+                                ST8(dst8++, tmp0);
+                                tmp0 = tmp1;
+                        }
+                        src8--;
                 }
 
                 if (n == 0)
                         return RETVAL;
 
-                b = ((const char *)src8 <= src1_end) ? *src8 : 0;
+                tmp0 = LD8(src8++);
+                tmp1 = ((const char *)src8 <= src1_end)
+                        ? LD8((op_t *)src8) : 0;
+                final = __insn_dblalign(tmp0, tmp1, srci);
 
-                /*
-                 * Final source bytes to write to trailing partial
-                 * word, if any.
-                 */
-                final = __insn_dblalign(a, b, src1);
         } else {
                 /* Aligned copy. */
 
-                const word_t* __restrict src8 = (const word_t *)src1;
+                const op_t *__restrict src8 = (const op_t *)src1;
 
                 /* src8 and dst8 are both word-aligned. */
                 if (n >= CHIP_L2_LINE_SIZE()) {
                         /* Copy until 'dst' is cache-line-aligned. */
                         for (; (uintptr_t)dst8 & (CHIP_L2_LINE_SIZE() - 1);
-                             n -= sizeof(word_t))
+                             n -= sizeof(op_t))
                                 ST8(dst8++, LD8(src8++));
 
                         for (; n >= CHIP_L2_LINE_SIZE(); ) {
-                                __insn_wh64(dst8);
+                                op_t tmp0, tmp1, tmp2, tmp3;
+                                op_t tmp4, tmp5, tmp6, tmp7;
 
                                 /*
                                  * Prefetch and advance to next line
-                                 * to prefetch, but don't go past the end
+                                 * to prefetch, but don't go past the
+                                 * end.
                                  */
                                 __insn_prefetch(prefetch);
+
+                                /* Make sure prefetch got scheduled
+                                   earlier.  */
+                                __asm__ ("" : : : "memory");
+
                                 prefetch += CHIP_L2_LINE_SIZE();
-                                prefetch = (prefetch > src1_end) ? prefetch :
+                                prefetch = (prefetch < src1_end) ? prefetch :
                                         (const char *)src8;
 
                                 /*
-                                 * Copy an entire cache line.  Manually
-                                 * unrolled to avoid idiosyncracies of
-                                 * compiler unrolling.
+                                 * Do all the loads before wh64.  This
+                                 * is necessary if [src8, src8+7] and
+                                 * [dst8, dst8+7] share the same cache
+                                 * line and dst8 <= src8, as can be
+                                 * the case when called from memmove,
+                                 * or with code tested on x86 whose
+                                 * memcpy always works with forward
+                                 * copies.
                                  */
-#define COPY_WORD(offset) ({ ST8(dst8+offset, LD8(src8+offset)); n -= 8; })
-                                COPY_WORD(0);
-                                COPY_WORD(1);
-                                COPY_WORD(2);
-                                COPY_WORD(3);
-                                COPY_WORD(4);
-                                COPY_WORD(5);
-                                COPY_WORD(6);
-                                COPY_WORD(7);
-#if CHIP_L2_LINE_SIZE() == 128
-                                COPY_WORD(8);
-                                COPY_WORD(9);
-                                COPY_WORD(10);
-                                COPY_WORD(11);
-                                COPY_WORD(12);
-                                COPY_WORD(13);
-                                COPY_WORD(14);
-                                COPY_WORD(15);
-#elif CHIP_L2_LINE_SIZE() != 64
-# error Fix code that assumes particular L2 cache line sizes
-#endif
+                                tmp0 = LD8(src8++);
+                                tmp1 = LD8(src8++);
+                                tmp2 = LD8(src8++);
+                                tmp3 = LD8(src8++);
+                                tmp4 = LD8(src8++);
+                                tmp5 = LD8(src8++);
+                                tmp6 = LD8(src8++);
+                                tmp7 = LD8(src8++);
+
+                                /* wh64 and wait for tmp7 load completion. */
+                                __asm__ ("move %0, %0; wh64 %1\n"
+                                         : : "r"(tmp7), "r"(dst8));
 
-                                dst8 += CHIP_L2_LINE_SIZE() / sizeof(word_t);
-                                src8 += CHIP_L2_LINE_SIZE() / sizeof(word_t);
+                                ST8(dst8++, tmp0);
+                                ST8(dst8++, tmp1);
+                                ST8(dst8++, tmp2);
+                                ST8(dst8++, tmp3);
+                                ST8(dst8++, tmp4);
+                                ST8(dst8++, tmp5);
+                                ST8(dst8++, tmp6);
+                                ST8(dst8++, tmp7);
+
+                                n -= CHIP_L2_LINE_SIZE();
                         }
+#if CHIP_L2_LINE_SIZE() != 64
+# error "Fix code that assumes particular L2 cache line size."
+#endif
                 }
 
-                for (; n >= sizeof(word_t); n -= sizeof(word_t))
+                for (; n >= sizeof(op_t); n -= sizeof(op_t))
                         ST8(dst8++, LD8(src8++));
 
                 if (__builtin_expect(n == 0, 1))
diff --git a/arch/tile/lib/memcpy_tile64.c b/arch/tile/lib/memcpy_tile64.c
deleted file mode 100644
index 3bc4b4e40d93..000000000000
--- a/arch/tile/lib/memcpy_tile64.c
+++ /dev/null
@@ -1,276 +0,0 @@
-/*
- * Copyright 2010 Tilera Corporation. All Rights Reserved.
- *
- *   This program is free software; you can redistribute it and/or
- *   modify it under the terms of the GNU General Public License
- *   as published by the Free Software Foundation, version 2.
- *
- *   This program is distributed in the hope that it will be useful, but
- *   WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
- *   NON INFRINGEMENT.  See the GNU General Public License for
- *   more details.
- */
-
-#include <linux/string.h>
-#include <linux/smp.h>
-#include <linux/module.h>
-#include <linux/uaccess.h>
-#include <asm/fixmap.h>
-#include <asm/kmap_types.h>
-#include <asm/tlbflush.h>
-#include <hv/hypervisor.h>
-#include <arch/chip.h>
-
-
-#if !CHIP_HAS_COHERENT_LOCAL_CACHE()
-
-/* Defined in memcpy.S */
-extern unsigned long __memcpy_asm(void *to, const void *from, unsigned long n);
-extern unsigned long __copy_to_user_inatomic_asm(
-        void __user *to, const void *from, unsigned long n);
-extern unsigned long __copy_from_user_inatomic_asm(
-        void *to, const void __user *from, unsigned long n);
-extern unsigned long __copy_from_user_zeroing_asm(
-        void *to, const void __user *from, unsigned long n);
-
-typedef unsigned long (*memcpy_t)(void *, const void *, unsigned long);
-
-/* Size above which to consider TLB games for performance */
-#define LARGE_COPY_CUTOFF 2048
-
-/* Communicate to the simulator what we are trying to do. */
-#define sim_allow_multiple_caching(b) \
-  __insn_mtspr(SPR_SIM_CONTROL, \
-   SIM_CONTROL_ALLOW_MULTIPLE_CACHING | ((b) << _SIM_CONTROL_OPERATOR_BITS))
-
-/*
- * Copy memory by briefly enabling incoherent cacheline-at-a-time mode.
- *
- * We set up our own source and destination PTEs that we fully control.
- * This is the only way to guarantee that we don't race with another
- * thread that is modifying the PTE; we can't afford to try the
- * copy_{to,from}_user() technique of catching the interrupt, since
- * we must run with interrupts disabled to avoid the risk of some
- * other code seeing the incoherent data in our cache.  (Recall that
- * our cache is indexed by PA, so even if the other code doesn't use
- * our kmap_atomic virtual addresses, they'll still hit in cache using
- * the normal VAs that aren't supposed to hit in cache.)
- */
-static void memcpy_multicache(void *dest, const void *source,
-                              pte_t dst_pte, pte_t src_pte, int len)
-{
-        int idx;
-        unsigned long flags, newsrc, newdst;
-        pmd_t *pmdp;
-        pte_t *ptep;
-        int type0, type1;
-        int cpu = get_cpu();
-
-        /*
-         * Disable interrupts so that we don't recurse into memcpy()
-         * in an interrupt handler, nor accidentally reference
-         * the PA of the source from an interrupt routine.  Also
-         * notify the simulator that we're playing games so we don't
-         * generate spurious coherency warnings.
-         */
-        local_irq_save(flags);
-        sim_allow_multiple_caching(1);
-
-        /* Set up the new dest mapping */
-        type0 = kmap_atomic_idx_push();
-        idx = FIX_KMAP_BEGIN + (KM_TYPE_NR * cpu) + type0;
-        newdst = __fix_to_virt(idx) + ((unsigned long)dest & (PAGE_SIZE-1));
-        pmdp = pmd_offset(pud_offset(pgd_offset_k(newdst), newdst), newdst);
-        ptep = pte_offset_kernel(pmdp, newdst);
-        if (pte_val(*ptep) != pte_val(dst_pte)) {
-                set_pte(ptep, dst_pte);
-                local_flush_tlb_page(NULL, newdst, PAGE_SIZE);
-        }
-
-        /* Set up the new source mapping */
-        type1 = kmap_atomic_idx_push();
-        idx += (type0 - type1);
-        src_pte = hv_pte_set_nc(src_pte);
-        src_pte = hv_pte_clear_writable(src_pte);  /* be paranoid */
-        newsrc = __fix_to_virt(idx) + ((unsigned long)source & (PAGE_SIZE-1));
-        pmdp = pmd_offset(pud_offset(pgd_offset_k(newsrc), newsrc), newsrc);
-        ptep = pte_offset_kernel(pmdp, newsrc);
-        __set_pte(ptep, src_pte);   /* set_pte() would be confused by this */
-        local_flush_tlb_page(NULL, newsrc, PAGE_SIZE);
-
-        /* Actually move the data. */
-        __memcpy_asm((void *)newdst, (const void *)newsrc, len);
-
-        /*
-         * Remap the source as locally-cached and not OLOC'ed so that
-         * we can inval without also invaling the remote cpu's cache.
-         * This also avoids known errata with inv'ing cacheable oloc data.
-         */
-        src_pte = hv_pte_set_mode(src_pte, HV_PTE_MODE_CACHE_NO_L3);
-        src_pte = hv_pte_set_writable(src_pte); /* need write access for inv */
-        __set_pte(ptep, src_pte);   /* set_pte() would be confused by this */
-        local_flush_tlb_page(NULL, newsrc, PAGE_SIZE);
-
-        /*
-         * Do the actual invalidation, covering the full L2 cache line
-         * at the end since __memcpy_asm() is somewhat aggressive.
-         */
-        __inv_buffer((void *)newsrc, len);
-
-        /*
-         * We're done: notify the simulator that all is back to normal,
-         * and re-enable interrupts and pre-emption.
-         */
-        kmap_atomic_idx_pop();
-        kmap_atomic_idx_pop();
-        sim_allow_multiple_caching(0);
-        local_irq_restore(flags);
-        put_cpu();
-}
-
-/*
- * Identify large copies from remotely-cached memory, and copy them
- * via memcpy_multicache() if they look good, otherwise fall back
- * to the particular kind of copying passed as the memcpy_t function.
- */
-static unsigned long fast_copy(void *dest, const void *source, int len,
-                               memcpy_t func)
-{
-        /*
-         * Check if it's big enough to bother with.  We may end up doing a
-         * small copy via TLB manipulation if we're near a page boundary,
-         * but presumably we'll make it up when we hit the second page.
-         */
-        while (len >= LARGE_COPY_CUTOFF) {
-                int copy_size, bytes_left_on_page;
-                pte_t *src_ptep, *dst_ptep;
-                pte_t src_pte, dst_pte;
-                struct page *src_page, *dst_page;
-
-                /* Is the source page oloc'ed to a remote cpu? */
-retry_source:
-                src_ptep = virt_to_pte(current->mm, (unsigned long)source);
-                if (src_ptep == NULL)
-                        break;
-                src_pte = *src_ptep;
-                if (!hv_pte_get_present(src_pte) ||
-                    !hv_pte_get_readable(src_pte) ||
-                    hv_pte_get_mode(src_pte) != HV_PTE_MODE_CACHE_TILE_L3)
-                        break;
-                if (get_remote_cache_cpu(src_pte) == smp_processor_id())
-                        break;
-                src_page = pfn_to_page(pte_pfn(src_pte));
-                get_page(src_page);
-                if (pte_val(src_pte) != pte_val(*src_ptep)) {
-                        put_page(src_page);
-                        goto retry_source;
-                }
-                if (pte_huge(src_pte)) {
-                        /* Adjust the PTE to correspond to a small page */
-                        int pfn = pte_pfn(src_pte);
-                        pfn += (((unsigned long)source & (HPAGE_SIZE-1))
-                                >> PAGE_SHIFT);
-                        src_pte = pfn_pte(pfn, src_pte);
-                        src_pte = pte_mksmall(src_pte);
-                }
-
-                /* Is the destination page writable? */
-retry_dest:
-                dst_ptep = virt_to_pte(current->mm, (unsigned long)dest);
-                if (dst_ptep == NULL) {
-                        put_page(src_page);
-                        break;
-                }
-                dst_pte = *dst_ptep;
-                if (!hv_pte_get_present(dst_pte) ||
-                    !hv_pte_get_writable(dst_pte)) {
-                        put_page(src_page);
-                        break;
-                }
-                dst_page = pfn_to_page(pte_pfn(dst_pte));
-                if (dst_page == src_page) {
-                        /*
-                         * Source and dest are on the same page; this
-                         * potentially exposes us to incoherence if any
-                         * part of src and dest overlap on a cache line.
-                         * Just give up rather than trying to be precise.
-                         */
-                        put_page(src_page);
-                        break;
-                }
-                get_page(dst_page);
-                if (pte_val(dst_pte) != pte_val(*dst_ptep)) {
-                        put_page(dst_page);
-                        goto retry_dest;
-                }
-                if (pte_huge(dst_pte)) {
-                        /* Adjust the PTE to correspond to a small page */
-                        int pfn = pte_pfn(dst_pte);
-                        pfn += (((unsigned long)dest & (HPAGE_SIZE-1))
-                                >> PAGE_SHIFT);
-                        dst_pte = pfn_pte(pfn, dst_pte);
-                        dst_pte = pte_mksmall(dst_pte);
-                }
-
-                /* All looks good: create a cachable PTE and copy from it */
-                copy_size = len;
-                bytes_left_on_page =
-                        PAGE_SIZE - (((int)source) & (PAGE_SIZE-1));
-                if (copy_size > bytes_left_on_page)
-                        copy_size = bytes_left_on_page;
-                bytes_left_on_page =
-                        PAGE_SIZE - (((int)dest) & (PAGE_SIZE-1));
-                if (copy_size > bytes_left_on_page)
-                        copy_size = bytes_left_on_page;
-                memcpy_multicache(dest, source, dst_pte, src_pte, copy_size);
-
-                /* Release the pages */
-                put_page(dst_page);
-                put_page(src_page);
-
-                /* Continue on the next page */
-                dest += copy_size;
-                source += copy_size;
-                len -= copy_size;
-        }
-
-        return func(dest, source, len);
-}
-
-void *memcpy(void *to, const void *from, __kernel_size_t n)
-{
-        if (n < LARGE_COPY_CUTOFF)
-                return (void *)__memcpy_asm(to, from, n);
-        else
-                return (void *)fast_copy(to, from, n, __memcpy_asm);
-}
-
-unsigned long __copy_to_user_inatomic(void __user *to, const void *from,
-                                      unsigned long n)
-{
-        if (n < LARGE_COPY_CUTOFF)
-                return __copy_to_user_inatomic_asm(to, from, n);
-        else
-                return fast_copy(to, from, n, __copy_to_user_inatomic_asm);
-}
-
-unsigned long __copy_from_user_inatomic(void *to, const void __user *from,
-                                        unsigned long n)
-{
-        if (n < LARGE_COPY_CUTOFF)
-                return __copy_from_user_inatomic_asm(to, from, n);
-        else
-                return fast_copy(to, from, n, __copy_from_user_inatomic_asm);
-}
-
-unsigned long __copy_from_user_zeroing(void *to, const void __user *from,
-                                       unsigned long n)
-{
-        if (n < LARGE_COPY_CUTOFF)
-                return __copy_from_user_zeroing_asm(to, from, n);
-        else
-                return fast_copy(to, from, n, __copy_from_user_zeroing_asm);
-}
-
-#endif /* !CHIP_HAS_COHERENT_LOCAL_CACHE() */
diff --git a/arch/tile/lib/memcpy_user_64.c b/arch/tile/lib/memcpy_user_64.c
index 37440caa7370..88c7016492c4 100644
--- a/arch/tile/lib/memcpy_user_64.c
+++ b/arch/tile/lib/memcpy_user_64.c
@@ -31,6 +31,7 @@
                     ".pushsection .coldtext.memcpy,\"ax\";"     \
                     "2: { move r0, %2; jrp lr };"               \
                     ".section __ex_table,\"a\";"                \
+                    ".align 8;"                                 \
                     ".quad 1b, 2b;"                             \
                     ".popsection"                               \
                     : "=m" (*(p)) : "r" (v), "r" (n));          \
@@ -43,6 +44,7 @@
                     ".pushsection .coldtext.memcpy,\"ax\";"     \
                     "2: { move r0, %2; jrp lr };"               \
                     ".section __ex_table,\"a\";"                \
+                    ".align 8;"                                 \
                     ".quad 1b, 2b;"                             \
                     ".popsection"                               \
                     : "=r" (__v) : "m" (*(p)), "r" (n));        \
diff --git a/arch/tile/lib/memset_32.c b/arch/tile/lib/memset_32.c
index 57dbb3a5bff8..2042bfe6595f 100644
--- a/arch/tile/lib/memset_32.c
+++ b/arch/tile/lib/memset_32.c
@@ -12,13 +12,10 @@
  *   more details.
  */
 
-#include <arch/chip.h>
-
 #include <linux/types.h>
 #include <linux/string.h>
 #include <linux/module.h>
-
-#undef memset
+#include <arch/chip.h>
 
 void *memset(void *s, int c, size_t n)
 {
@@ -26,11 +23,7 @@ void *memset(void *s, int c, size_t n)
         int n32;
         uint32_t v16, v32;
         uint8_t *out8 = s;
-#if !CHIP_HAS_WH64()
-        int ahead32;
-#else
         int to_align32;
-#endif
 
         /* Experimentation shows that a trivial tight loop is a win up until
          * around a size of 20, where writing a word at a time starts to win.
@@ -61,21 +54,6 @@ void *memset(void *s, int c, size_t n)
                 return s;
         }
 
-#if !CHIP_HAS_WH64()
-        /* Use a spare issue slot to start prefetching the first cache
-         * line early. This instruction is free as the store can be buried
-         * in otherwise idle issue slots doing ALU ops.
-         */
-        __insn_prefetch(out8);
-
-        /* We prefetch the end so that a short memset that spans two cache
-         * lines gets some prefetching benefit. Again we believe this is free
-         * to issue.
-         */
-        __insn_prefetch(&out8[n - 1]);
-#endif /* !CHIP_HAS_WH64() */
-
-
         /* Align 'out8'. We know n >= 3 so this won't write past the end. */
         while (((uintptr_t) out8 & 3) != 0) {
                 *out8++ = c;
@@ -96,90 +74,6 @@ void *memset(void *s, int c, size_t n)
         /* This must be at least 8 or the following loop doesn't work. */
 #define CACHE_LINE_SIZE_IN_WORDS (CHIP_L2_LINE_SIZE() / 4)
 
-#if !CHIP_HAS_WH64()
-
-        ahead32 = CACHE_LINE_SIZE_IN_WORDS;
-
-        /* We already prefetched the first and last cache lines, so
-         * we only need to do more prefetching if we are storing
-         * to more than two cache lines.
-         */
-        if (n32 > CACHE_LINE_SIZE_IN_WORDS * 2) {
-                int i;
-
-                /* Prefetch the next several cache lines.
-                 * This is the setup code for the software-pipelined
-                 * loop below.
-                 */
-#define MAX_PREFETCH 5
-                ahead32 = n32 & -CACHE_LINE_SIZE_IN_WORDS;
-                if (ahead32 > MAX_PREFETCH * CACHE_LINE_SIZE_IN_WORDS)
-                        ahead32 = MAX_PREFETCH * CACHE_LINE_SIZE_IN_WORDS;
-
-                for (i = CACHE_LINE_SIZE_IN_WORDS;
-                     i < ahead32; i += CACHE_LINE_SIZE_IN_WORDS)
-                        __insn_prefetch(&out32[i]);
-        }
-
-        if (n32 > ahead32) {
-                while (1) {
-                        int j;
-
-                        /* Prefetch by reading one word several cache lines
-                         * ahead.  Since loads are non-blocking this will
-                         * cause the full cache line to be read while we are
-                         * finishing earlier cache lines.  Using a store
-                         * here causes microarchitectural performance
-                         * problems where a victimizing store miss goes to
-                         * the head of the retry FIFO and locks the pipe for
-                         * a few cycles.  So a few subsequent stores in this
-                         * loop go into the retry FIFO, and then later
-                         * stores see other stores to the same cache line
-                         * are already in the retry FIFO and themselves go
-                         * into the retry FIFO, filling it up and grinding
-                         * to a halt waiting for the original miss to be
-                         * satisfied.
-                         */
-                        __insn_prefetch(&out32[ahead32]);
-
-#if CACHE_LINE_SIZE_IN_WORDS % 4 != 0
-#error "Unhandled CACHE_LINE_SIZE_IN_WORDS"
-#endif
-
-                        n32 -= CACHE_LINE_SIZE_IN_WORDS;
-
-                        /* Save icache space by only partially unrolling
-                         * this loop.
-                         */
-                        for (j = CACHE_LINE_SIZE_IN_WORDS / 4; j > 0; j--) {
-                                *out32++ = v32;
-                                *out32++ = v32;
-                                *out32++ = v32;
-                                *out32++ = v32;
-                        }
-
-                        /* To save compiled code size, reuse this loop even
-                         * when we run out of prefetching to do by dropping
-                         * ahead32 down.
-                         */
-                        if (n32 <= ahead32) {
-                                /* Not even a full cache line left,
-                                 * so stop now.
-                                 */
-                                if (n32 < CACHE_LINE_SIZE_IN_WORDS)
-                                        break;
-
-                                /* Choose a small enough value that we don't
-                                 * prefetch past the end.  There's no sense
-                                 * in touching cache lines we don't have to.
-                                 */
-                                ahead32 = CACHE_LINE_SIZE_IN_WORDS - 1;
-                        }
-                }
-        }
-
-#else /* CHIP_HAS_WH64() */
-
         /* Determine how many words we need to emit before the 'out32'
          * pointer becomes aligned modulo the cache line size.
          */
@@ -236,8 +130,6 @@ void *memset(void *s, int c, size_t n)
                 n32 &= CACHE_LINE_SIZE_IN_WORDS - 1;
         }
 
-#endif /* CHIP_HAS_WH64() */
-
         /* Now handle any leftover values. */
         if (n32 != 0) {
                 do {
diff --git a/arch/tile/lib/memset_64.c b/arch/tile/lib/memset_64.c
index 3873085711d5..03ef69cd73de 100644
--- a/arch/tile/lib/memset_64.c
+++ b/arch/tile/lib/memset_64.c
@@ -12,13 +12,11 @@
  *   more details.
  */
 
-#include <arch/chip.h>
-
 #include <linux/types.h>
 #include <linux/string.h>
 #include <linux/module.h>
-
-#undef memset
+#include <arch/chip.h>
+#include "string-endian.h"
 
 void *memset(void *s, int c, size_t n)
 {
@@ -70,8 +68,7 @@ void *memset(void *s, int c, size_t n)
         n64 = n >> 3;
 
         /* Tile input byte out to 64 bits. */
-        /* KLUDGE */
-        v64 = 0x0101010101010101ULL * (uint8_t)c;
+        v64 = copy_byte(c);
 
         /* This must be at least 8 or the following loop doesn't work. */
 #define CACHE_LINE_SIZE_IN_DOUBLEWORDS (CHIP_L2_LINE_SIZE() / 8)
diff --git a/arch/tile/lib/strchr_32.c b/arch/tile/lib/strchr_32.c
index c94e6f7ae7b5..841fe6963019 100644
--- a/arch/tile/lib/strchr_32.c
+++ b/arch/tile/lib/strchr_32.c
@@ -16,8 +16,6 @@
 #include <linux/string.h>
 #include <linux/module.h>
 
-#undef strchr
-
 char *strchr(const char *s, int c)
 {
         int z, g;
diff --git a/arch/tile/lib/strchr_64.c b/arch/tile/lib/strchr_64.c
index f39f9dc422b0..fe6e31c06f8d 100644
--- a/arch/tile/lib/strchr_64.c
+++ b/arch/tile/lib/strchr_64.c
@@ -26,7 +26,7 @@ char *strchr(const char *s, int c)
         const uint64_t *p = (const uint64_t *)(s_int & -8);
 
         /* Create eight copies of the byte for which we are looking. */
-        const uint64_t goal = 0x0101010101010101ULL * (uint8_t) c;
+        const uint64_t goal = copy_byte(c);
 
         /* Read the first aligned word, but force bytes before the string to
          * match neither zero nor goal (we make sure the high bit of each
diff --git a/arch/tile/lib/string-endian.h b/arch/tile/lib/string-endian.h
index c0eed7ce69c3..2e49cbfe9371 100644
--- a/arch/tile/lib/string-endian.h
+++ b/arch/tile/lib/string-endian.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Tilera Corporation. All Rights Reserved.
+ * Copyright 2013 Tilera Corporation. All Rights Reserved.
  *
  *   This program is free software; you can redistribute it and/or
  *   modify it under the terms of the GNU General Public License
@@ -31,3 +31,14 @@
 #define CFZ(x) __insn_clz(x)
 #define REVCZ(x) __insn_ctz(x)
 #endif
+
+/*
+ * Create eight copies of the byte in a uint64_t.  Byte Shuffle uses
+ * the bytes of srcB as the index into the dest vector to select a
+ * byte.  With all indices of zero, the first byte is copied into all
+ * the other bytes.
+ */
+static inline uint64_t copy_byte(uint8_t byte)
+{
+        return __insn_shufflebytes(byte, 0, 0);
+}
diff --git a/arch/tile/lib/strlen_32.c b/arch/tile/lib/strlen_32.c
index 4974292a5534..f26f88e11e4a 100644
--- a/arch/tile/lib/strlen_32.c
+++ b/arch/tile/lib/strlen_32.c
@@ -16,8 +16,6 @@
 #include <linux/string.h>
 #include <linux/module.h>
 
-#undef strlen
-
 size_t strlen(const char *s)
 {
         /* Get an aligned pointer. */
diff --git a/arch/tile/lib/strnlen_32.c b/arch/tile/lib/strnlen_32.c
new file mode 100644
index 000000000000..1434141d9e01
--- /dev/null
+++ b/arch/tile/lib/strnlen_32.c
@@ -0,0 +1,47 @@
+/*
+ * Copyright 2013 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+#include <linux/types.h>
+#include <linux/string.h>
+#include <linux/module.h>
+
+size_t strnlen(const char *s, size_t count)
+{
+        /* Get an aligned pointer. */
+        const uintptr_t s_int = (uintptr_t) s;
+        const uint32_t *p = (const uint32_t *)(s_int & -4);
+        size_t bytes_read = sizeof(*p) - (s_int & (sizeof(*p) - 1));
+        size_t len;
+        uint32_t v, bits;
+
+        /* Avoid page fault risk by not reading any bytes when count is 0. */
+        if (count == 0)
+                return 0;
+
+        /* Read first word, but force bytes before the string to be nonzero. */
+        v = *p | ((1 << ((s_int << 3) & 31)) - 1);
+
+        while ((bits = __insn_seqb(v, 0)) == 0) {
+                if (bytes_read >= count) {
+                        /* Read COUNT bytes and didn't find the terminator. */
+                        return count;
+                }
+                v = *++p;
+                bytes_read += sizeof(v);
+        }
+
+        len = ((const char *) p) + (__insn_ctz(bits) >> 3) - s;
+        return (len < count ? len : count);
+}
+EXPORT_SYMBOL(strnlen);
diff --git a/arch/tile/lib/strnlen_64.c b/arch/tile/lib/strnlen_64.c
new file mode 100644
index 000000000000..2e8de6a5136f
--- /dev/null
+++ b/arch/tile/lib/strnlen_64.c
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2013 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+#include <linux/types.h>
+#include <linux/string.h>
+#include <linux/module.h>
+#include "string-endian.h"
+
+size_t strnlen(const char *s, size_t count)
+{
+        /* Get an aligned pointer. */
+        const uintptr_t s_int = (uintptr_t) s;
+        const uint64_t *p = (const uint64_t *)(s_int & -8);
+        size_t bytes_read = sizeof(*p) - (s_int & (sizeof(*p) - 1));
+        size_t len;
+        uint64_t v, bits;
+
+        /* Avoid page fault risk by not reading any bytes when count is 0. */
+        if (count == 0)
+                return 0;
+
+        /* Read and MASK the first word. */
+        v = *p | MASK(s_int);
+
+        while ((bits = __insn_v1cmpeqi(v, 0)) == 0) {
+                if (bytes_read >= count) {
+                        /* Read COUNT bytes and didn't find the terminator. */
+                        return count;
+                }
+                v = *++p;
+                bytes_read += sizeof(v);
+        }
+
+        len = ((const char *) p) + (CFZ(bits) >> 3) - s;
+        return (len < count ? len : count);
+}
+EXPORT_SYMBOL(strnlen);
diff --git a/arch/tile/lib/usercopy_32.S b/arch/tile/lib/usercopy_32.S
index b62d002af009..1bc162224638 100644
--- a/arch/tile/lib/usercopy_32.S
+++ b/arch/tile/lib/usercopy_32.S
@@ -36,6 +36,7 @@ strnlen_user_fault:
         { move r0, zero; jrp lr }
         ENDPROC(strnlen_user_fault)
         .section __ex_table,"a"
+        .align 4
         .word 1b, strnlen_user_fault
         .popsection
 
@@ -47,18 +48,20 @@ strnlen_user_fault:
  */
 STD_ENTRY(strncpy_from_user_asm)
         { bz r2, 2f; move r3, r0 }
-1:      { lb_u r4, r1; addi r1, r1, 1; addi r2, r2, -1 }
+1:      { lb_u r4, r1; addi r1, r1, 1; addi r2, r2, -1 }
         { sb r0, r4; addi r0, r0, 1 }
-        bz r2, 2f
-        bnzt r4, 1b
-        addi r0, r0, -1   /* don't count the trailing NUL */
-2:      { sub r0, r0, r3; jrp lr }
+        bz r4, 2f
+        bnzt r2, 1b
+        { sub r0, r0, r3; jrp lr }
+2:      addi r0, r0, -1   /* don't count the trailing NUL */
+        { sub r0, r0, r3; jrp lr }
         STD_ENDPROC(strncpy_from_user_asm)
         .pushsection .fixup,"ax"
 strncpy_from_user_fault:
         { movei r0, -EFAULT; jrp lr }
         ENDPROC(strncpy_from_user_fault)
         .section __ex_table,"a"
+        .align 4
         .word 1b, strncpy_from_user_fault
         .popsection
 
@@ -77,6 +80,7 @@ STD_ENTRY(clear_user_asm)
         bnzt r1, 1b
 2:      { move r0, r1; jrp lr }
         .pushsection __ex_table,"a"
+        .align 4
         .word 1b, 2b
         .popsection
 
@@ -86,6 +90,7 @@ STD_ENTRY(clear_user_asm)
 2:      { move r0, r1; jrp lr }
         STD_ENDPROC(clear_user_asm)
         .pushsection __ex_table,"a"
+        .align 4
         .word 1b, 2b
         .popsection
 
@@ -105,25 +110,7 @@ STD_ENTRY(flush_user_asm)
 2:      { move r0, r1; jrp lr }
         STD_ENDPROC(flush_user_asm)
         .pushsection __ex_table,"a"
-        .word 1b, 2b
-        .popsection
-
-/*
- * inv_user_asm takes the user target address in r0 and the
- * number of bytes to invalidate in r1.
- * It returns the number of not inv'able bytes (hopefully zero) in r0.
- */
-STD_ENTRY(inv_user_asm)
-        bz r1, 2f
-        { movei r2, L2_CACHE_BYTES; add r1, r0, r1 }
-        { sub r2, zero, r2; addi r1, r1, L2_CACHE_BYTES-1 }
-        { and r0, r0, r2; and r1, r1, r2 }
-        { sub r1, r1, r0 }
-1:      { inv r0; addi r1, r1, -CHIP_INV_STRIDE() }
-        { addi r0, r0, CHIP_INV_STRIDE(); bnzt r1, 1b }
-2:      { move r0, r1; jrp lr }
-        STD_ENDPROC(inv_user_asm)
-        .pushsection __ex_table,"a"
+        .align 4
         .word 1b, 2b
         .popsection
 
@@ -143,5 +130,6 @@ STD_ENTRY(finv_user_asm)
 2:      { move r0, r1; jrp lr }
         STD_ENDPROC(finv_user_asm)
         .pushsection __ex_table,"a"
+        .align 4
         .word 1b, 2b
         .popsection
diff --git a/arch/tile/lib/usercopy_64.S b/arch/tile/lib/usercopy_64.S
index adb2dbbc70cd..b3b31a3306f8 100644
--- a/arch/tile/lib/usercopy_64.S
+++ b/arch/tile/lib/usercopy_64.S
@@ -36,6 +36,7 @@ strnlen_user_fault:
         { move r0, zero; jrp lr }
         ENDPROC(strnlen_user_fault)
         .section __ex_table,"a"
+        .align 8
         .quad 1b, strnlen_user_fault
         .popsection
 
@@ -47,18 +48,20 @@ strnlen_user_fault:
  */
 STD_ENTRY(strncpy_from_user_asm)
         { beqz r2, 2f; move r3, r0 }
-1:      { ld1u r4, r1; addi r1, r1, 1; addi r2, r2, -1 }
+1:      { ld1u r4, r1; addi r1, r1, 1; addi r2, r2, -1 }
         { st1 r0, r4; addi r0, r0, 1 }
-        beqz r2, 2f
-        bnezt r4, 1b
-        addi r0, r0, -1   /* don't count the trailing NUL */
-2:      { sub r0, r0, r3; jrp lr }
+        beqz r4, 2f
+        bnezt r2, 1b
+        { sub r0, r0, r3; jrp lr }
+2:      addi r0, r0, -1   /* don't count the trailing NUL */
+        { sub r0, r0, r3; jrp lr }
         STD_ENDPROC(strncpy_from_user_asm)
         .pushsection .fixup,"ax"
 strncpy_from_user_fault:
         { movei r0, -EFAULT; jrp lr }
         ENDPROC(strncpy_from_user_fault)
         .section __ex_table,"a"
+        .align 8
         .quad 1b, strncpy_from_user_fault
         .popsection
 
@@ -77,6 +80,7 @@ STD_ENTRY(clear_user_asm)
         bnezt r1, 1b
 2:      { move r0, r1; jrp lr }
         .pushsection __ex_table,"a"
+        .align 8
         .quad 1b, 2b
         .popsection
 
@@ -86,6 +90,7 @@ STD_ENTRY(clear_user_asm)
 2:      { move r0, r1; jrp lr }
         STD_ENDPROC(clear_user_asm)
         .pushsection __ex_table,"a"
+        .align 8
         .quad 1b, 2b
         .popsection
 
@@ -105,25 +110,7 @@ STD_ENTRY(flush_user_asm)
 2:      { move r0, r1; jrp lr }
         STD_ENDPROC(flush_user_asm)
         .pushsection __ex_table,"a"
-        .quad 1b, 2b
-        .popsection
-
-/*
- * inv_user_asm takes the user target address in r0 and the
- * number of bytes to invalidate in r1.
- * It returns the number of not inv'able bytes (hopefully zero) in r0.
- */
-STD_ENTRY(inv_user_asm)
-        beqz r1, 2f
-        { movei r2, L2_CACHE_BYTES; add r1, r0, r1 }
-        { sub r2, zero, r2; addi r1, r1, L2_CACHE_BYTES-1 }
-        { and r0, r0, r2; and r1, r1, r2 }
-        { sub r1, r1, r0 }
-1:      { inv r0; addi r1, r1, -CHIP_INV_STRIDE() }
-        { addi r0, r0, CHIP_INV_STRIDE(); bnezt r1, 1b }
-2:      { move r0, r1; jrp lr }
-        STD_ENDPROC(inv_user_asm)
-        .pushsection __ex_table,"a"
+        .align 8
         .quad 1b, 2b
         .popsection
 
@@ -143,5 +130,6 @@ STD_ENTRY(finv_user_asm)
 2:      { move r0, r1; jrp lr }
         STD_ENDPROC(finv_user_asm)
         .pushsection __ex_table,"a"
+        .align 8
         .quad 1b, 2b
         .popsection
diff --git a/arch/tile/mm/elf.c b/arch/tile/mm/elf.c
index 743c951c61b0..23f044e8a7ab 100644
--- a/arch/tile/mm/elf.c
+++ b/arch/tile/mm/elf.c
@@ -21,7 +21,8 @@
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
 #include <asm/sections.h>
-#include <arch/sim_def.h>
+#include <asm/vdso.h>
+#include <arch/sim.h>
 
 /* Notify a running simulator, if any, that an exec just occurred. */
 static void sim_notify_exec(const char *binary_name)
@@ -38,21 +39,55 @@ static void sim_notify_exec(const char *binary_name)
 
 static int notify_exec(struct mm_struct *mm)
 {
-        int retval = 0;  /* failure */
-
-        if (mm->exe_file) {
-                char *buf = (char *) __get_free_page(GFP_KERNEL);
-                if (buf) {
-                        char *path = d_path(&mm->exe_file->f_path,
-                                            buf, PAGE_SIZE);
-                        if (!IS_ERR(path)) {
-                                sim_notify_exec(path);
-                                retval = 1;
-                        }
-                        free_page((unsigned long)buf);
+        char *buf, *path;
+        struct vm_area_struct *vma;
+
+        if (!sim_is_simulator())
+                return 1;
+
+        if (mm->exe_file == NULL)
+                return 0;
+
+        for (vma = current->mm->mmap; ; vma = vma->vm_next) {
+                if (vma == NULL)
+                        return 0;
+                if (vma->vm_file == mm->exe_file)
+                        break;
+        }
+
+        buf = (char *) __get_free_page(GFP_KERNEL);
+        if (buf == NULL)
+                return 0;
+
+        path = d_path(&mm->exe_file->f_path, buf, PAGE_SIZE);
+        if (IS_ERR(path)) {
+                free_page((unsigned long)buf);
+                return 0;
+        }
+
+        /*
+         * Notify simulator of an ET_DYN object so we know the load address.
+         * The somewhat cryptic overuse of SIM_CONTROL_DLOPEN allows us
+         * to be backward-compatible with older simulator releases.
+         */
+        if (vma->vm_start == (ELF_ET_DYN_BASE & PAGE_MASK)) {
+                char buf[64];
+                int i;
+
+                snprintf(buf, sizeof(buf), "0x%lx:@", vma->vm_start);
+                for (i = 0; ; ++i) {
+                        char c = buf[i];
+                        __insn_mtspr(SPR_SIM_CONTROL,
+                                     (SIM_CONTROL_DLOPEN
+                                      | (c << _SIM_CONTROL_OPERATOR_BITS)));
+                        if (c == '\0')
+                                break;
                 }
         }
-        return retval;
+
+        sim_notify_exec(path);
+        free_page((unsigned long)buf);
+        return 1;
 }
 
 /* Notify a running simulator, if any, that we loaded an interpreter. */
@@ -68,37 +103,10 @@ static void sim_notify_interp(unsigned long load_addr)
 }
 
 
-/* Kernel address of page used to map read-only kernel data into userspace. */
-static void *vdso_page;
-
-/* One-entry array used for install_special_mapping. */
-static struct page *vdso_pages[1];
-
-static int __init vdso_setup(void)
-{
-        vdso_page = (void *)get_zeroed_page(GFP_ATOMIC);
-        memcpy(vdso_page, __rt_sigreturn, __rt_sigreturn_end - __rt_sigreturn);
-        vdso_pages[0] = virt_to_page(vdso_page);
-        return 0;
-}
-device_initcall(vdso_setup);
-
-const char *arch_vma_name(struct vm_area_struct *vma)
-{
-        if (vma->vm_private_data == vdso_pages)
-                return "[vdso]";
-#ifndef __tilegx__
-        if (vma->vm_start == MEM_USER_INTRPT)
-                return "[intrpt]";
-#endif
-        return NULL;
-}
-
 int arch_setup_additional_pages(struct linux_binprm *bprm,
                                 int executable_stack)
 {
         struct mm_struct *mm = current->mm;
-        unsigned long vdso_base;
         int retval = 0;
 
         down_write(&mm->mmap_sem);
@@ -111,14 +119,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm,
         if (!notify_exec(mm))
                 sim_notify_exec(bprm->filename);
 
-        /*
-         * MAYWRITE to allow gdb to COW and set breakpoints
-         */
-        vdso_base = VDSO_BASE;
-        retval = install_special_mapping(mm, vdso_base, PAGE_SIZE,
-                                         VM_READ|VM_EXEC|
-                                         VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC,
-                                         vdso_pages);
+        retval = setup_vdso_pages();
 
 #ifndef __tilegx__
         /*
diff --git a/arch/tile/mm/fault.c b/arch/tile/mm/fault.c
index f7f99f90cbe0..111d5a9b76f1 100644
--- a/arch/tile/mm/fault.c
+++ b/arch/tile/mm/fault.c
@@ -34,6 +34,7 @@
 #include <linux/hugetlb.h>
 #include <linux/syscalls.h>
 #include <linux/uaccess.h>
+#include <linux/kdebug.h>
 
 #include <asm/pgalloc.h>
 #include <asm/sections.h>
@@ -122,10 +123,9 @@ static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address)
         pmd_k = pmd_offset(pud_k, address);
         if (!pmd_present(*pmd_k))
                 return NULL;
-        if (!pmd_present(*pmd)) {
+        if (!pmd_present(*pmd))
                 set_pmd(pmd, *pmd_k);
-                arch_flush_lazy_mmu_mode();
-        } else
+        else
                 BUG_ON(pmd_ptfn(*pmd) != pmd_ptfn(*pmd_k));
         return pmd_k;
 }
@@ -283,7 +283,7 @@ static int handle_page_fault(struct pt_regs *regs,
         flags = (FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
                  (write ? FAULT_FLAG_WRITE : 0));
 
-        is_kernel_mode = (EX1_PL(regs->ex1) != USER_PL);
+        is_kernel_mode = !user_mode(regs);
 
         tsk = validate_current();
 
@@ -466,28 +466,15 @@ good_area:
                 }
         }
 
-#if CHIP_HAS_TILE_DMA() || CHIP_HAS_SN_PROC()
-        /*
-         * If this was an asynchronous fault,
-         * restart the appropriate engine.
-         */
-        switch (fault_num) {
 #if CHIP_HAS_TILE_DMA()
+        /* If this was a DMA TLB fault, restart the DMA engine. */
+        switch (fault_num) {
         case INT_DMATLB_MISS:
         case INT_DMATLB_MISS_DWNCL:
         case INT_DMATLB_ACCESS:
         case INT_DMATLB_ACCESS_DWNCL:
                 __insn_mtspr(SPR_DMA_CTR, SPR_DMA_CTR__REQUEST_MASK);
                 break;
-#endif
-#if CHIP_HAS_SN_PROC()
-        case INT_SNITLB_MISS:
-        case INT_SNITLB_MISS_DWNCL:
-                __insn_mtspr(SPR_SNCTL,
-                             __insn_mfspr(SPR_SNCTL) &
-                             ~SPR_SNCTL__FRZPROC_MASK);
-                break;
-#endif
         }
 #endif
 
@@ -722,8 +709,60 @@ void do_page_fault(struct pt_regs *regs, int fault_num,
 {
         int is_page_fault;
 
+#ifdef CONFIG_KPROBES
+        /*
+         * This is to notify the fault handler of the kprobes.  The
+         * exception code is redundant as it is also carried in REGS,
+         * but we pass it anyhow.
+         */
+        if (notify_die(DIE_PAGE_FAULT, "page fault", regs, -1,
+                       regs->faultnum, SIGSEGV) == NOTIFY_STOP)
+                return;
+#endif
+
+#ifdef __tilegx__
+        /*
+         * We don't need early do_page_fault_ics() support, since unlike
+         * Pro we don't need to worry about unlocking the atomic locks.
+         * There is only one current case in GX where we touch any memory
+         * under ICS other than our own kernel stack, and we handle that
+         * here.  (If we crash due to trying to touch our own stack,
+         * we're in too much trouble for C code to help out anyway.)
+         */
+        if (write & ~1) {
+                unsigned long pc = write & ~1;
+                if (pc >= (unsigned long) __start_unalign_asm_code &&
+                    pc < (unsigned long) __end_unalign_asm_code) {
+                        struct thread_info *ti = current_thread_info();
+                        /*
+                         * Our EX_CONTEXT is still what it was from the
+                         * initial unalign exception, but now we've faulted
+                         * on the JIT page.  We would like to complete the
+                         * page fault however is appropriate, and then retry
+                         * the instruction that caused the unalign exception.
+                         * Our state has been "corrupted" by setting the low
+                         * bit in "sp", and stashing r0..r3 in the
+                         * thread_info area, so we revert all of that, then
+                         * continue as if this were a normal page fault.
+                         */
+                        regs->sp &= ~1UL;
+                        regs->regs[0] = ti->unalign_jit_tmp[0];
+                        regs->regs[1] = ti->unalign_jit_tmp[1];
+                        regs->regs[2] = ti->unalign_jit_tmp[2];
+                        regs->regs[3] = ti->unalign_jit_tmp[3];
+                        write &= 1;
+                } else {
+                        pr_alert("%s/%d: ICS set at page fault at %#lx: %#lx\n",
+                                 current->comm, current->pid, pc, address);
+                        show_regs(regs);
+                        do_group_exit(SIGKILL);
+                        return;
+                }
+        }
+#else
         /* This case should have been handled by do_page_fault_ics(). */
         BUG_ON(write & ~1);
+#endif
 
 #if CHIP_HAS_TILE_DMA()
         /*
@@ -752,10 +791,6 @@ void do_page_fault(struct pt_regs *regs, int fault_num,
         case INT_DMATLB_MISS:
         case INT_DMATLB_MISS_DWNCL:
 #endif
-#if CHIP_HAS_SN_PROC()
-        case INT_SNITLB_MISS:
-        case INT_SNITLB_MISS_DWNCL:
-#endif
                 is_page_fault = 1;
                 break;
 
@@ -771,8 +806,8 @@ void do_page_fault(struct pt_regs *regs, int fault_num,
                 panic("Bad fault number %d in do_page_fault", fault_num);
         }
 
-#if CHIP_HAS_TILE_DMA() || CHIP_HAS_SN_PROC()
-        if (EX1_PL(regs->ex1) != USER_PL) {
+#if CHIP_HAS_TILE_DMA()
+        if (!user_mode(regs)) {
                 struct async_tlb *async;
                 switch (fault_num) {
 #if CHIP_HAS_TILE_DMA()
@@ -783,12 +818,6 @@ void do_page_fault(struct pt_regs *regs, int fault_num,
                         async = &current->thread.dma_async_tlb;
                         break;
 #endif
-#if CHIP_HAS_SN_PROC()
-                case INT_SNITLB_MISS:
-                case INT_SNITLB_MISS_DWNCL:
-                        async = &current->thread.sn_async_tlb;
-                        break;
-#endif
                 default:
                         async = NULL;
                 }
@@ -821,14 +850,22 @@ void do_page_fault(struct pt_regs *regs, int fault_num,
 }
 
 
-#if CHIP_HAS_TILE_DMA() || CHIP_HAS_SN_PROC()
+#if CHIP_HAS_TILE_DMA()
 /*
- * Check an async_tlb structure to see if a deferred fault is waiting,
- * and if so pass it to the page-fault code.
+ * This routine effectively re-issues asynchronous page faults
+ * when we are returning to user space.
  */
-static void handle_async_page_fault(struct pt_regs *regs,
-                                    struct async_tlb *async)
+void do_async_page_fault(struct pt_regs *regs)
 {
+        struct async_tlb *async = &current->thread.dma_async_tlb;
+
+        /*
+         * Clear thread flag early.  If we re-interrupt while processing
+         * code here, we will reset it and recall this routine before
+         * returning to user space.
+         */
+        clear_thread_flag(TIF_ASYNC_TLB);
+
         if (async->fault_num) {
                 /*
                  * Clear async->fault_num before calling the page-fault
@@ -842,35 +879,15 @@ static void handle_async_page_fault(struct pt_regs *regs,
                                   async->address, async->is_write);
         }
 }
-
-/*
- * This routine effectively re-issues asynchronous page faults
- * when we are returning to user space.
- */
-void do_async_page_fault(struct pt_regs *regs)
-{
-        /*
-         * Clear thread flag early.  If we re-interrupt while processing
-         * code here, we will reset it and recall this routine before
-         * returning to user space.
-         */
-        clear_thread_flag(TIF_ASYNC_TLB);
-
-#if CHIP_HAS_TILE_DMA()
-        handle_async_page_fault(regs, &current->thread.dma_async_tlb);
-#endif
-#if CHIP_HAS_SN_PROC()
-        handle_async_page_fault(regs, &current->thread.sn_async_tlb);
-#endif
-}
-#endif /* CHIP_HAS_TILE_DMA() || CHIP_HAS_SN_PROC() */
+#endif /* CHIP_HAS_TILE_DMA() */
 
 
 void vmalloc_sync_all(void)
 {
 #ifdef __tilegx__
         /* Currently all L1 kernel pmd's are static and shared. */
-        BUG_ON(pgd_index(VMALLOC_END) != pgd_index(VMALLOC_START));
+        BUILD_BUG_ON(pgd_index(VMALLOC_END - PAGE_SIZE) !=
+                     pgd_index(VMALLOC_START));
 #else
         /*
          * Note that races in the updates of insync and start aren't
diff --git a/arch/tile/mm/highmem.c b/arch/tile/mm/highmem.c
index 347d123b14be..0dc218294770 100644
--- a/arch/tile/mm/highmem.c
+++ b/arch/tile/mm/highmem.c
@@ -114,7 +114,6 @@ static void kmap_atomic_register(struct page *page, int type,
 
         list_add(&amp->list, &amp_list);
         set_pte(ptep, pteval);
-        arch_flush_lazy_mmu_mode();
 
         spin_unlock(&amp_lock);
         homecache_kpte_unlock(flags);
@@ -259,7 +258,6 @@ void __kunmap_atomic(void *kvaddr)
                 BUG_ON(vaddr >= (unsigned long)high_memory);
         }
 
-        arch_flush_lazy_mmu_mode();
         pagefault_enable();
 }
 EXPORT_SYMBOL(__kunmap_atomic);
diff --git a/arch/tile/mm/homecache.c b/arch/tile/mm/homecache.c
index 1ae911939a18..004ba568d93f 100644
--- a/arch/tile/mm/homecache.c
+++ b/arch/tile/mm/homecache.c
@@ -43,12 +43,9 @@
 #include "migrate.h"
 
 
-#if CHIP_HAS_COHERENT_LOCAL_CACHE()
-
 /*
  * The noallocl2 option suppresses all use of the L2 cache to cache
- * locally from a remote home.  There's no point in using it if we
- * don't have coherent local caching, though.
+ * locally from a remote home.
  */
 static int __write_once noallocl2;
 static int __init set_noallocl2(char *str)
@@ -58,12 +55,6 @@ static int __init set_noallocl2(char *str)
 }
 early_param("noallocl2", set_noallocl2);
 
-#else
-
-#define noallocl2 0
-
-#endif
-
 
 /*
  * Update the irq_stat for cpus that we are going to interrupt
@@ -172,7 +163,8 @@ void flush_remote(unsigned long cache_pfn, unsigned long cache_control,
 
 static void homecache_finv_page_va(void* va, int home)
 {
-        if (home == smp_processor_id()) {
+        int cpu = get_cpu();
+        if (home == cpu) {
                 finv_buffer_local(va, PAGE_SIZE);
         } else if (home == PAGE_HOME_HASH) {
                 finv_buffer_remote(va, PAGE_SIZE, 1);
@@ -180,6 +172,7 @@ static void homecache_finv_page_va(void* va, int home)
                 BUG_ON(home < 0 || home >= NR_CPUS);
                 finv_buffer_remote(va, PAGE_SIZE, 0);
         }
+        put_cpu();
 }
 
 void homecache_finv_map_page(struct page *page, int home)
@@ -198,7 +191,7 @@ void homecache_finv_map_page(struct page *page, int home)
 #else
         va = __fix_to_virt(FIX_HOMECACHE_BEGIN + smp_processor_id());
 #endif
-        ptep = virt_to_pte(NULL, (unsigned long)va);
+        ptep = virt_to_kpte(va);
         pte = pfn_pte(page_to_pfn(page), PAGE_KERNEL);
         __set_pte(ptep, pte_set_home(pte, home));
         homecache_finv_page_va((void *)va, home);
@@ -263,10 +256,8 @@ static int pte_to_home(pte_t pte)
                 return PAGE_HOME_INCOHERENT;
         case HV_PTE_MODE_UNCACHED:
                 return PAGE_HOME_UNCACHED;
-#if CHIP_HAS_CBOX_HOME_MAP()
         case HV_PTE_MODE_CACHE_HASH_L3:
                 return PAGE_HOME_HASH;
-#endif
         }
         panic("Bad PTE %#llx\n", pte.val);
 }
@@ -323,20 +314,16 @@ pte_t pte_set_home(pte_t pte, int home)
                                                       HV_PTE_MODE_CACHE_NO_L3);
                         }
                 } else
-#if CHIP_HAS_CBOX_HOME_MAP()
                 if (hash_default)
                         pte = hv_pte_set_mode(pte, HV_PTE_MODE_CACHE_HASH_L3);
                 else
-#endif
                         pte = hv_pte_set_mode(pte, HV_PTE_MODE_CACHE_NO_L3);
                 pte = hv_pte_set_nc(pte);
                 break;
 
-#if CHIP_HAS_CBOX_HOME_MAP()
         case PAGE_HOME_HASH:
                 pte = hv_pte_set_mode(pte, HV_PTE_MODE_CACHE_HASH_L3);
                 break;
-#endif
 
         default:
                 BUG_ON(home < 0 || home >= NR_CPUS ||
@@ -346,7 +333,6 @@ pte_t pte_set_home(pte_t pte, int home)
                 break;
         }
 
-#if CHIP_HAS_NC_AND_NOALLOC_BITS()
         if (noallocl2)
                 pte = hv_pte_set_no_alloc_l2(pte);
 
@@ -355,7 +341,6 @@ pte_t pte_set_home(pte_t pte, int home)
             hv_pte_get_mode(pte) == HV_PTE_MODE_CACHE_NO_L3) {
                 pte = hv_pte_set_mode(pte, HV_PTE_MODE_UNCACHED);
         }
-#endif
 
         /* Checking this case here gives a better panic than from the hv. */
         BUG_ON(hv_pte_get_mode(pte) == 0);
@@ -371,19 +356,13 @@ EXPORT_SYMBOL(pte_set_home);
  * so they're not suitable for anything but infrequent use.
  */
 
-#if CHIP_HAS_CBOX_HOME_MAP()
-static inline int initial_page_home(void) { return PAGE_HOME_HASH; }
-#else
-static inline int initial_page_home(void) { return 0; }
-#endif
-
 int page_home(struct page *page)
 {
         if (PageHighMem(page)) {
-                return initial_page_home();
+                return PAGE_HOME_HASH;
         } else {
                 unsigned long kva = (unsigned long)page_address(page);
-                return pte_to_home(*virt_to_pte(NULL, kva));
+                return pte_to_home(*virt_to_kpte(kva));
         }
 }
 EXPORT_SYMBOL(page_home);
@@ -402,7 +381,7 @@ void homecache_change_page_home(struct page *page, int order, int home)
                      NULL, 0);
 
         for (i = 0; i < pages; ++i, kva += PAGE_SIZE) {
-                pte_t *ptep = virt_to_pte(NULL, kva);
+                pte_t *ptep = virt_to_kpte(kva);
                 pte_t pteval = *ptep;
                 BUG_ON(!pte_present(pteval) || pte_huge(pteval));
                 __set_pte(ptep, pte_set_home(pteval, home));
@@ -436,7 +415,7 @@ struct page *homecache_alloc_pages_node(int nid, gfp_t gfp_mask,
 void __homecache_free_pages(struct page *page, unsigned int order)
 {
         if (put_page_testzero(page)) {
-                homecache_change_page_home(page, order, initial_page_home());
+                homecache_change_page_home(page, order, PAGE_HOME_HASH);
                 if (order == 0) {
                         free_hot_cold_page(page, 0);
                 } else {
diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c
index 650ccff8378c..e514899e1100 100644
--- a/arch/tile/mm/hugetlbpage.c
+++ b/arch/tile/mm/hugetlbpage.c
@@ -49,38 +49,6 @@ int huge_shift[HUGE_SHIFT_ENTRIES] = {
 #endif
 };
 
-/*
- * This routine is a hybrid of pte_alloc_map() and pte_alloc_kernel().
- * It assumes that L2 PTEs are never in HIGHMEM (we don't support that).
- * It locks the user pagetable, and bumps up the mm->nr_ptes field,
- * but otherwise allocate the page table using the kernel versions.
- */
-static pte_t *pte_alloc_hugetlb(struct mm_struct *mm, pmd_t *pmd,
-                                unsigned long address)
-{
-        pte_t *new;
-
-        if (pmd_none(*pmd)) {
-                new = pte_alloc_one_kernel(mm, address);
-                if (!new)
-                        return NULL;
-
-                smp_wmb(); /* See comment in __pte_alloc */
-
-                spin_lock(&mm->page_table_lock);
-                if (likely(pmd_none(*pmd))) {  /* Has another populated it ? */
-                        mm->nr_ptes++;
-                        pmd_populate_kernel(mm, pmd, new);
-                        new = NULL;
-                } else
-                        VM_BUG_ON(pmd_trans_splitting(*pmd));
-                spin_unlock(&mm->page_table_lock);
-                if (new)
-                        pte_free_kernel(mm, new);
-        }
-
-        return pte_offset_kernel(pmd, address);
-}
 #endif
 
 pte_t *huge_pte_alloc(struct mm_struct *mm,
@@ -109,7 +77,7 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
                 else {
                         if (sz != PAGE_SIZE << huge_shift[HUGE_SHIFT_PAGE])
                                 panic("Unexpected page size %#lx\n", sz);
-                        return pte_alloc_hugetlb(mm, pmd, addr);
+                        return pte_alloc_map(mm, NULL, pmd, addr);
                 }
         }
 #else
@@ -144,14 +112,14 @@ pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
 
         /* Get the top-level page table entry. */
         pgd = (pgd_t *)get_pte((pte_t *)mm->pgd, pgd_index(addr), 0);
-        if (!pgd_present(*pgd))
-                return NULL;
 
         /* We don't have four levels. */
         pud = pud_offset(pgd, addr);
 #ifndef __PAGETABLE_PUD_FOLDED
 # error support fourth page table level
 #endif
+        if (!pud_present(*pud))
+                return NULL;
 
         /* Check for an L0 huge PTE, if we have three levels. */
 #ifndef __PAGETABLE_PMD_FOLDED
diff --git a/arch/tile/mm/init.c b/arch/tile/mm/init.c
index e182958c707d..4e316deb92fd 100644
--- a/arch/tile/mm/init.c
+++ b/arch/tile/mm/init.c
@@ -106,10 +106,8 @@ pte_t *get_prealloc_pte(unsigned long pfn)
  */
 static int initial_heap_home(void)
 {
-#if CHIP_HAS_CBOX_HOME_MAP()
         if (hash_default)
                 return PAGE_HOME_HASH;
-#endif
         return smp_processor_id();
 }
 
@@ -190,14 +188,11 @@ static void __init page_table_range_init(unsigned long start,
 }
 
 
-#if CHIP_HAS_CBOX_HOME_MAP()
-
 static int __initdata ktext_hash = 1;  /* .text pages */
 static int __initdata kdata_hash = 1;  /* .data and .bss pages */
 int __write_once hash_default = 1;     /* kernel allocator pages */
 EXPORT_SYMBOL(hash_default);
 int __write_once kstack_hash = 1;      /* if no homecaching, use h4h */
-#endif /* CHIP_HAS_CBOX_HOME_MAP */
 
 /*
  * CPUs to use to for striping the pages of kernel data.  If hash-for-home
@@ -215,14 +210,12 @@ int __write_once kdata_huge;       /* if no homecaching, small pages */
 static pgprot_t __init construct_pgprot(pgprot_t prot, int home)
 {
         prot = pte_set_home(prot, home);
-#if CHIP_HAS_CBOX_HOME_MAP()
         if (home == PAGE_HOME_IMMUTABLE) {
                 if (ktext_hash)
                         prot = hv_pte_set_mode(prot, HV_PTE_MODE_CACHE_HASH_L3);
                 else
                         prot = hv_pte_set_mode(prot, HV_PTE_MODE_CACHE_NO_L3);
         }
-#endif
         return prot;
 }
 
@@ -234,22 +227,17 @@ static pgprot_t __init init_pgprot(ulong address)
 {
         int cpu;
         unsigned long page;
-        enum { CODE_DELTA = MEM_SV_INTRPT - PAGE_OFFSET };
+        enum { CODE_DELTA = MEM_SV_START - PAGE_OFFSET };
 
-#if CHIP_HAS_CBOX_HOME_MAP()
         /* For kdata=huge, everything is just hash-for-home. */
         if (kdata_huge)
                 return construct_pgprot(PAGE_KERNEL, PAGE_HOME_HASH);
-#endif
 
         /* We map the aliased pages of permanent text inaccessible. */
         if (address < (ulong) _sinittext - CODE_DELTA)
                 return PAGE_NONE;
 
-        /*
-         * We map read-only data non-coherent for performance.  We could
-         * use neighborhood caching on TILE64, but it's not clear it's a win.
-         */
+        /* We map read-only data non-coherent for performance. */
         if ((address >= (ulong) __start_rodata &&
              address < (ulong) __end_rodata) ||
             address == (ulong) empty_zero_page) {
@@ -257,12 +245,10 @@ static pgprot_t __init init_pgprot(ulong address)
         }
 
 #ifndef __tilegx__
-#if !ATOMIC_LOCKS_FOUND_VIA_TABLE()
         /* Force the atomic_locks[] array page to be hash-for-home. */
         if (address == (ulong) atomic_locks)
                 return construct_pgprot(PAGE_KERNEL, PAGE_HOME_HASH);
 #endif
-#endif
 
         /*
          * Everything else that isn't data or bss is heap, so mark it
@@ -280,19 +266,9 @@ static pgprot_t __init init_pgprot(ulong address)
         if (address >= (ulong) _end || address < (ulong) _einitdata)
                 return construct_pgprot(PAGE_KERNEL, initial_heap_home());
 
-#if CHIP_HAS_CBOX_HOME_MAP()
         /* Use hash-for-home if requested for data/bss. */
         if (kdata_hash)
                 return construct_pgprot(PAGE_KERNEL, PAGE_HOME_HASH);
-#endif
-
-        /*
-         * Make the w1data homed like heap to start with, to avoid
-         * making it part of the page-striped data area when we're just
-         * going to convert it to read-only soon anyway.
-         */
-        if (address >= (ulong)__w1data_begin && address < (ulong)__w1data_end)
-                return construct_pgprot(PAGE_KERNEL, initial_heap_home());
 
         /*
          * Otherwise we just hand out consecutive cpus.  To avoid
@@ -301,7 +277,7 @@ static pgprot_t __init init_pgprot(ulong address)
          * the requested address, while walking cpu home around kdata_mask.
          * This is typically no more than a dozen or so iterations.
          */
-        page = (((ulong)__w1data_end) + PAGE_SIZE - 1) & PAGE_MASK;
+        page = (((ulong)__end_rodata) + PAGE_SIZE - 1) & PAGE_MASK;
         BUG_ON(address < page || address >= (ulong)_end);
         cpu = cpumask_first(&kdata_mask);
         for (; page < address; page += PAGE_SIZE) {
@@ -311,11 +287,9 @@ static pgprot_t __init init_pgprot(ulong address)
                 if (page == (ulong)empty_zero_page)
                         continue;
 #ifndef __tilegx__
-#if !ATOMIC_LOCKS_FOUND_VIA_TABLE()
                 if (page == (ulong)atomic_locks)
                         continue;
 #endif
-#endif
                 cpu = cpumask_next(cpu, &kdata_mask);
                 if (cpu == NR_CPUS)
                         cpu = cpumask_first(&kdata_mask);
@@ -358,7 +332,7 @@ static int __init setup_ktext(char *str)
 
         ktext_arg_seen = 1;
 
-        /* Default setting on Tile64: use a huge page */
+        /* Default setting: use a huge page */
         if (strcmp(str, "huge") == 0)
                 pr_info("ktext: using one huge locally cached page\n");
 
@@ -404,10 +378,8 @@ static inline pgprot_t ktext_set_nocache(pgprot_t prot)
 {
         if (!ktext_nocache)
                 prot = hv_pte_set_nc(prot);
-#if CHIP_HAS_NC_AND_NOALLOC_BITS()
         else
                 prot = hv_pte_set_no_alloc_l2(prot);
-#endif
         return prot;
 }
 
@@ -440,7 +412,6 @@ static void __init kernel_physical_mapping_init(pgd_t *pgd_base)
         struct cpumask kstripe_mask;
         int rc, i;
 
-#if CHIP_HAS_CBOX_HOME_MAP()
         if (ktext_arg_seen && ktext_hash) {
                 pr_warning("warning: \"ktext\" boot argument ignored"
                            " if \"kcache_hash\" sets up text hash-for-home\n");
@@ -457,7 +428,6 @@ static void __init kernel_physical_mapping_init(pgd_t *pgd_base)
                           " kcache_hash=all or =allbutstack\n");
                 kdata_huge = 0;
         }
-#endif
 
         /*
          * Set up a mask for cpus to use for kernel striping.
@@ -538,7 +508,7 @@ static void __init kernel_physical_mapping_init(pgd_t *pgd_base)
                 }
         }
 
-        address = MEM_SV_INTRPT;
+        address = MEM_SV_START;
         pmd = get_pmd(pgtables, address);
         pfn = 0;  /* code starts at PA 0 */
         if (ktext_small) {
@@ -585,13 +555,11 @@ static void __init kernel_physical_mapping_init(pgd_t *pgd_base)
         } else {
                 pte_t pteval = pfn_pte(0, PAGE_KERNEL_EXEC);
                 pteval = pte_mkhuge(pteval);
-#if CHIP_HAS_CBOX_HOME_MAP()
                 if (ktext_hash) {
                         pteval = hv_pte_set_mode(pteval,
                                                  HV_PTE_MODE_CACHE_HASH_L3);
                         pteval = ktext_set_nocache(pteval);
                 } else
-#endif /* CHIP_HAS_CBOX_HOME_MAP() */
                 if (cpumask_weight(&ktext_mask) == 1) {
                         pteval = set_remote_cache_cpu(pteval,
                                               cpumask_first(&ktext_mask));
@@ -777,10 +745,7 @@ void __init paging_init(void)
 
         kernel_physical_mapping_init(pgd_base);
 
-        /*
-         * Fixed mappings, only the page table structure has to be
-         * created - mappings will be set by set_fixmap():
-         */
+        /* Fixed mappings, only the page table structure has to be created. */
         page_table_range_init(fix_to_virt(__end_of_fixed_addresses - 1),
                               FIXADDR_TOP, pgd_base);
 
@@ -941,26 +906,6 @@ void __init pgtable_cache_init(void)
                 panic("pgtable_cache_init(): Cannot create pgd cache");
 }
 
-#if !CHIP_HAS_COHERENT_LOCAL_CACHE()
-/*
- * The __w1data area holds data that is only written during initialization,
- * and is read-only and thus freely cacheable thereafter.  Fix the page
- * table entries that cover that region accordingly.
- */
-static void mark_w1data_ro(void)
-{
-        /* Loop over page table entries */
-        unsigned long addr = (unsigned long)__w1data_begin;
-        BUG_ON((addr & (PAGE_SIZE-1)) != 0);
-        for (; addr <= (unsigned long)__w1data_end - 1; addr += PAGE_SIZE) {
-                unsigned long pfn = kaddr_to_pfn((void *)addr);
-                pte_t *ptep = virt_to_pte(NULL, addr);
-                BUG_ON(pte_huge(*ptep));   /* not relevant for kdata_huge */
-                set_pte_at(&init_mm, addr, ptep, pfn_pte(pfn, PAGE_KERNEL_RO));
-        }
-}
-#endif
-
 #ifdef CONFIG_DEBUG_PAGEALLOC
 static long __write_once initfree;
 #else
@@ -1000,7 +945,7 @@ static void free_init_pages(char *what, unsigned long begin, unsigned long end)
                  */
                 int pfn = kaddr_to_pfn((void *)addr);
                 struct page *page = pfn_to_page(pfn);
-                pte_t *ptep = virt_to_pte(NULL, addr);
+                pte_t *ptep = virt_to_kpte(addr);
                 if (!initfree) {
                         /*
                          * If debugging page accesses then do not free
@@ -1024,15 +969,11 @@ static void free_init_pages(char *what, unsigned long begin, unsigned long end)
 
 void free_initmem(void)
 {
-        const unsigned long text_delta = MEM_SV_INTRPT - PAGE_OFFSET;
+        const unsigned long text_delta = MEM_SV_START - PAGE_OFFSET;
 
         /*
-         * Evict the dirty initdata on the boot cpu, evict the w1data
-         * wherever it's homed, and evict all the init code everywhere.
-         * We are guaranteed that no one will touch the init pages any
-         * more, and although other cpus may be touching the w1data,
-         * we only actually change the caching on tile64, which won't
-         * be keeping local copies in the other tiles' caches anyway.
+         * Evict the cache on all cores to avoid incoherence.
+         * We are guaranteed that no one will touch the init pages any more.
          */
         homecache_evict(&cpu_cacheable_map);
 
@@ -1043,26 +984,11 @@ void free_initmem(void)
 
         /*
          * Free the pages mapped from 0xc0000000 that correspond to code
-         * pages from MEM_SV_INTRPT that we won't use again after init.
+         * pages from MEM_SV_START that we won't use again after init.
          */
         free_init_pages("unused kernel text",
                         (unsigned long)_sinittext - text_delta,
                         (unsigned long)_einittext - text_delta);
-
-#if !CHIP_HAS_COHERENT_LOCAL_CACHE()
-        /*
-         * Upgrade the .w1data section to globally cached.
-         * We don't do this on tilepro, since the cache architecture
-         * pretty much makes it irrelevant, and in any case we end
-         * up having racing issues with other tiles that may touch
-         * the data after we flush the cache but before we update
-         * the PTEs and flush the TLBs, causing sharer shootdowns
-         * later.  Even though this is to clean data, it seems like
-         * an unnecessary complication.
-         */
-        mark_w1data_ro();
-#endif
-
         /* Do a global TLB flush so everyone sees the changes. */
         flush_tlb_all();
 }
diff --git a/arch/tile/mm/migrate_32.S b/arch/tile/mm/migrate_32.S
index 5305814bf187..772085491bf9 100644
--- a/arch/tile/mm/migrate_32.S
+++ b/arch/tile/mm/migrate_32.S
@@ -136,7 +136,7 @@ STD_ENTRY(flush_and_install_context)
          move r8, zero  /* asids */
          move r9, zero  /* asidcount */
         }
-        jal hv_flush_remote
+        jal _hv_flush_remote
         bnz r0, .Ldone
 
         /* Now install the new page table. */
@@ -152,7 +152,7 @@ STD_ENTRY(flush_and_install_context)
          move r4, r_asid
          moveli r5, HV_CTX_DIRECTIO | CTX_PAGE_FLAG
         }
-        jal hv_install_context
+        jal _hv_install_context
         bnz r0, .Ldone
 
         /* Finally, flush the TLB. */
diff --git a/arch/tile/mm/migrate_64.S b/arch/tile/mm/migrate_64.S
index 1d15b10833d1..a49eee38f872 100644
--- a/arch/tile/mm/migrate_64.S
+++ b/arch/tile/mm/migrate_64.S
@@ -123,7 +123,7 @@ STD_ENTRY(flush_and_install_context)
         }
         {
          move r8, zero  /* asidcount */
-         jal hv_flush_remote
+         jal _hv_flush_remote
         }
         bnez r0, 1f
 
@@ -136,7 +136,7 @@ STD_ENTRY(flush_and_install_context)
          move r2, r_asid
          moveli r3, HV_CTX_DIRECTIO | CTX_PAGE_FLAG
         }
-        jal hv_install_context
+        jal _hv_install_context
         bnez r0, 1f
 
         /* Finally, flush the TLB. */
diff --git a/arch/tile/mm/mmap.c b/arch/tile/mm/mmap.c
index d67d91ebf63e..851a94e6ae58 100644
--- a/arch/tile/mm/mmap.c
+++ b/arch/tile/mm/mmap.c
@@ -58,16 +58,36 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
 #else
         int is_32bit = 0;
 #endif
+        unsigned long random_factor = 0UL;
+
+        /*
+         *  8 bits of randomness in 32bit mmaps, 24 address space bits
+         * 12 bits of randomness in 64bit mmaps, 28 address space bits
+         */
+        if (current->flags & PF_RANDOMIZE) {
+                if (is_32bit)
+                        random_factor = get_random_int() % (1<<8);
+                else
+                        random_factor = get_random_int() % (1<<12);
+
+                random_factor <<= PAGE_SHIFT;
+        }
 
         /*
          * Use standard layout if the expected stack growth is unlimited
          * or we are running native 64 bits.
          */
-        if (!is_32bit || rlimit(RLIMIT_STACK) == RLIM_INFINITY) {
-                mm->mmap_base = TASK_UNMAPPED_BASE;
+        if (rlimit(RLIMIT_STACK) == RLIM_INFINITY) {
+                mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
                 mm->get_unmapped_area = arch_get_unmapped_area;
         } else {
                 mm->mmap_base = mmap_base(mm);
                 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
         }
 }
+
+unsigned long arch_randomize_brk(struct mm_struct *mm)
+{
+        unsigned long range_end = mm->brk + 0x02000000;
+        return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
+}
diff --git a/arch/tile/mm/pgtable.c b/arch/tile/mm/pgtable.c
index dfd63ce87327..2deaddf3e01f 100644
--- a/arch/tile/mm/pgtable.c
+++ b/arch/tile/mm/pgtable.c
@@ -83,55 +83,6 @@ void show_mem(unsigned int filter)
         }
 }
 
-/*
- * Associate a virtual page frame with a given physical page frame
- * and protection flags for that frame.
- */
-static void set_pte_pfn(unsigned long vaddr, unsigned long pfn, pgprot_t flags)
-{
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
-
-        pgd = swapper_pg_dir + pgd_index(vaddr);
-        if (pgd_none(*pgd)) {
-                BUG();
-                return;
-        }
-        pud = pud_offset(pgd, vaddr);
-        if (pud_none(*pud)) {
-                BUG();
-                return;
-        }
-        pmd = pmd_offset(pud, vaddr);
-        if (pmd_none(*pmd)) {
-                BUG();
-                return;
-        }
-        pte = pte_offset_kernel(pmd, vaddr);
-        /* <pfn,flags> stored as-is, to permit clearing entries */
-        set_pte(pte, pfn_pte(pfn, flags));
-
-        /*
-         * It's enough to flush this one mapping.
-         * This appears conservative since it is only called
-         * from __set_fixmap.
-         */
-        local_flush_tlb_page(NULL, vaddr, PAGE_SIZE);
-}
-
-void __set_fixmap(enum fixed_addresses idx, unsigned long phys, pgprot_t flags)
-{
-        unsigned long address = __fix_to_virt(idx);
-
-        if (idx >= __end_of_fixed_addresses) {
-                BUG();
-                return;
-        }
-        set_pte_pfn(address, phys >> PAGE_SHIFT, flags);
-}
-
 /**
  * shatter_huge_page() - ensure a given address is mapped by a small page.
  *
@@ -374,6 +325,17 @@ void ptep_set_wrprotect(struct mm_struct *mm,
 
 #endif
 
+/*
+ * Return a pointer to the PTE that corresponds to the given
+ * address in the given page table.  A NULL page table just uses
+ * the standard kernel page table; the preferred API in this case
+ * is virt_to_kpte().
+ *
+ * The returned pointer can point to a huge page in other levels
+ * of the page table than the bottom, if the huge page is present
+ * in the page table.  For bottom-level PTEs, the returned pointer
+ * can point to a PTE that is either present or not.
+ */
 pte_t *virt_to_pte(struct mm_struct* mm, unsigned long addr)
 {
         pgd_t *pgd;
@@ -387,13 +349,23 @@ pte_t *virt_to_pte(struct mm_struct* mm, unsigned long addr)
         pud = pud_offset(pgd, addr);
         if (!pud_present(*pud))
                 return NULL;
+        if (pud_huge_page(*pud))
+                return (pte_t *)pud;
         pmd = pmd_offset(pud, addr);
-        if (pmd_huge_page(*pmd))
-                return (pte_t *)pmd;
         if (!pmd_present(*pmd))
                 return NULL;
+        if (pmd_huge_page(*pmd))
+                return (pte_t *)pmd;
         return pte_offset_kernel(pmd, addr);
 }
+EXPORT_SYMBOL(virt_to_pte);
+
+pte_t *virt_to_kpte(unsigned long kaddr)
+{
+        BUG_ON(kaddr < PAGE_OFFSET);
+        return virt_to_pte(NULL, kaddr);
+}
+EXPORT_SYMBOL(virt_to_kpte);
 
 pgprot_t set_remote_cache_cpu(pgprot_t prot, int cpu)
 {
@@ -568,7 +540,7 @@ void __iomem *ioremap_prot(resource_size_t phys_addr, unsigned long size,
         addr = area->addr;
         if (ioremap_page_range((unsigned long)addr, (unsigned long)addr + size,
                                phys_addr, pgprot)) {
-                remove_vm_area((void *)(PAGE_MASK & (unsigned long) addr));
+                free_vm_area(area);
                 return NULL;
         }
         return (__force void __iomem *) (offset + (char *)addr);
diff --git a/arch/um/include/asm/tlb.h b/arch/um/include/asm/tlb.h
index 4febacd1a8a1..29b0301c18aa 100644
--- a/arch/um/include/asm/tlb.h
+++ b/arch/um/include/asm/tlb.h
@@ -45,10 +45,12 @@ static inline void init_tlb_gather(struct mmu_gather *tlb)
 }
 
 static inline void
-tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned int full_mm_flush)
+tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
 {
         tlb->mm = mm;
-        tlb->fullmm = full_mm_flush;
+        tlb->start = start;
+        tlb->end = end;
+        tlb->fullmm = !(start | (end+1));
 
         init_tlb_gather(tlb);
 }
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index b32ebf92b0ce..5c0ed72c02a2 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -16,6 +16,7 @@ config X86_64
         def_bool y
         depends on 64BIT
         select X86_DEV_DMA_OPS
+        select ARCH_USE_CMPXCHG_LOCKREF
 
 ### Arch settings
 config X86
@@ -81,7 +82,6 @@ config X86
         select HAVE_USER_RETURN_NOTIFIER
         select ARCH_BINFMT_ELF_RANDOMIZE_PIE
         select HAVE_ARCH_JUMP_LABEL
-        select HAVE_TEXT_POKE_SMP
         select HAVE_GENERIC_HARDIRQS
         select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
         select SPARSE_IRQ
@@ -632,6 +632,7 @@ config PARAVIRT_DEBUG
 config PARAVIRT_SPINLOCKS
         bool "Paravirtualization layer for spinlocks"
         depends on PARAVIRT && SMP
+        select UNINLINE_SPIN_UNLOCK
         ---help---
           Paravirtualized spinlocks allow a pvops backend to replace the
           spinlock implementation with something virtualization-friendly
@@ -656,6 +657,15 @@ config KVM_GUEST
           underlying device model, the host provides the guest with
           timing infrastructure such as time of day, and system time
 
+config KVM_DEBUG_FS
+        bool "Enable debug information for KVM Guests in debugfs"
+        depends on KVM_GUEST && DEBUG_FS
+        default n
+        ---help---
+          This option enables collection of various statistics for KVM guest.
+          Statistics are displayed in debugfs filesystem. Enabling this option
+          may incur significant overhead.
+
 source "arch/x86/lguest/Kconfig"
 
 config PARAVIRT_TIME_ACCOUNTING
@@ -1344,8 +1354,12 @@ config ARCH_SELECT_MEMORY_MODEL
         depends on ARCH_SPARSEMEM_ENABLE
 
 config ARCH_MEMORY_PROBE
-        def_bool y
+        bool "Enable sysfs memory/probe interface"
         depends on X86_64 && MEMORY_HOTPLUG
+        help
+          This option enables a sysfs memory/probe interface for testing.
+          See Documentation/memory-hotplug.txt for more information.
+          If you are unsure how to answer this question, answer N.
 
 config ARCH_PROC_KCORE_TEXT
         def_bool y
@@ -1627,9 +1641,9 @@ config KEXEC
 
           It is an ongoing process to be certain the hardware in a machine
           is properly shutdown, so do not be surprised if this code does not
-          initially work for you.  It may help to enable device hotplugging
-          support.  As of this writing the exact hardware interface is
-          strongly in flux, so no good recommendation can be made.
+          initially work for you.  As of this writing the exact hardware
+          interface is strongly in flux, so no good recommendation can be
+          made.
 
 config CRASH_DUMP
         bool "kernel crash dumps"
@@ -1716,9 +1730,10 @@ config X86_NEED_RELOCS
         depends on X86_32 && RELOCATABLE
 
 config PHYSICAL_ALIGN
-        hex "Alignment value to which kernel should be aligned" if X86_32
+        hex "Alignment value to which kernel should be aligned"
         default "0x1000000"
-        range 0x2000 0x1000000
+        range 0x2000 0x1000000 if X86_32
+        range 0x200000 0x1000000 if X86_64
         ---help---
           This value puts the alignment restrictions on physical address
           where kernel is loaded and run from. Kernel is compiled for an
@@ -1736,6 +1751,9 @@ config PHYSICAL_ALIGN
           end result is that kernel runs from a physical address meeting
           above alignment restrictions.
 
+          On 32-bit this value must be a multiple of 0x2000. On 64-bit
+          this value must be a multiple of 0x200000.
+
           Don't change this unless you know what you are doing.
 
 config HOTPLUG_CPU
@@ -2270,6 +2288,32 @@ config RAPIDIO
 
 source "drivers/rapidio/Kconfig"
 
+config X86_SYSFB
+        bool "Mark VGA/VBE/EFI FB as generic system framebuffer"
+        help
+          Firmwares often provide initial graphics framebuffers so the BIOS,
+          bootloader or kernel can show basic video-output during boot for
+          user-guidance and debugging. Historically, x86 used the VESA BIOS
+          Extensions and EFI-framebuffers for this, which are mostly limited
+          to x86.
+          This option, if enabled, marks VGA/VBE/EFI framebuffers as generic
+          framebuffers so the new generic system-framebuffer drivers can be
+          used on x86. If the framebuffer is not compatible with the generic
+          modes, it is adverticed as fallback platform framebuffer so legacy
+          drivers like efifb, vesafb and uvesafb can pick it up.
+          If this option is not selected, all system framebuffers are always
+          marked as fallback platform framebuffers as usual.
+
+          Note: Legacy fbdev drivers, including vesafb, efifb, uvesafb, will
+          not be able to pick up generic system framebuffers if this option
+          is selected. You are highly encouraged to enable simplefb as
+          replacement if you select this option. simplefb can correctly deal
+          with generic system framebuffers. But you should still keep vesafb
+          and others enabled as fallback if a system framebuffer is
+          incompatible with simplefb.
+
+          If unsure, say Y.
+
 endmenu
 
 
@@ -2332,10 +2376,6 @@ config HAVE_ATOMIC_IOMAP
         def_bool y
         depends on X86_32
 
-config HAVE_TEXT_POKE_SMP
-        bool
-        select STOP_MACHINE if SMP
-
 config X86_DEV_DMA_OPS
         bool
         depends on X86_64 || STA2X11
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 07639c656fcd..41250fb33985 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -16,6 +16,10 @@ endif
 # e.g.: obj-y += foo_$(BITS).o
 export BITS
 
+ifdef CONFIG_X86_NEED_RELOCS
+        LDFLAGS_vmlinux := --emit-relocs
+endif
+
 ifeq ($(CONFIG_X86_32),y)
         BITS := 32
         UTS_MACHINE := i386
@@ -25,10 +29,6 @@ ifeq ($(CONFIG_X86_32),y)
         KBUILD_AFLAGS += $(biarch)
         KBUILD_CFLAGS += $(biarch)
 
-        ifdef CONFIG_RELOCATABLE
-                LDFLAGS_vmlinux := --emit-relocs
-        endif
-
         KBUILD_CFLAGS += -msoft-float -mregparm=3 -freg-struct-return
 
         # Never want PIC in a 32-bit kernel, prevent breakage with GCC built
diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
index 5b7531966b84..ef72baeff484 100644
--- a/arch/x86/boot/boot.h
+++ b/arch/x86/boot/boot.h
@@ -355,6 +355,7 @@ int strncmp(const char *cs, const char *ct, size_t count);
 size_t strnlen(const char *s, size_t maxlen);
 unsigned int atou(const char *s);
 unsigned long long simple_strtoull(const char *cp, char **endp, unsigned int base);
+size_t strlen(const char *s);
 
 /* tty.c */
 void puts(const char *);
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index d606463aa6d6..b7388a425f09 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -225,7 +225,7 @@ static void low_free(unsigned long size, unsigned long addr)
         unsigned long nr_pages;
 
         nr_pages = round_up(size, EFI_PAGE_SIZE) / EFI_PAGE_SIZE;
-        efi_call_phys2(sys_table->boottime->free_pages, addr, size);
+        efi_call_phys2(sys_table->boottime->free_pages, addr, nr_pages);
 }
 
 static void find_bits(unsigned long mask, u8 *pos, u8 *size)
diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
index 1e3184f6072f..5d6f6891b188 100644
--- a/arch/x86/boot/compressed/head_32.S
+++ b/arch/x86/boot/compressed/head_32.S
@@ -181,8 +181,9 @@ relocated:
 /*
  * Do the decompression, and jump to the new kernel..
  */
-        leal    z_extract_offset_negative(%ebx), %ebp
                                 /* push arguments for decompress_kernel: */
+        pushl   $z_output_len   /* decompressed length */
+        leal    z_extract_offset_negative(%ebx), %ebp
         pushl   %ebp            /* output address */
         pushl   $z_input_len    /* input_len */
         leal    input_data(%ebx), %eax
@@ -191,33 +192,7 @@ relocated:
         pushl   %eax            /* heap area */
         pushl   %esi            /* real mode pointer */
         call    decompress_kernel
-        addl    $20, %esp
-
-#if CONFIG_RELOCATABLE
-/*
- * Find the address of the relocations.
- */
-        leal    z_output_len(%ebp), %edi
-
-/*
- * Calculate the delta between where vmlinux was compiled to run
- * and where it was actually loaded.
- */
-        movl    %ebp, %ebx
-        subl    $LOAD_PHYSICAL_ADDR, %ebx
-        jz      2f      /* Nothing to be done if loaded at compiled addr. */
-/*
- * Process relocations.
- */
-
-1:      subl    $4, %edi
-        movl    (%edi), %ecx
-        testl   %ecx, %ecx
-        jz      2f
-        addl    %ebx, -__PAGE_OFFSET(%ebx, %ecx)
-        jmp     1b
-2:
-#endif
+        addl    $24, %esp
 
 /*
  * Jump to the decompressed kernel.
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
index 06e71c2c16bf..c337422b575d 100644
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -338,6 +338,7 @@ relocated:
         leaq    input_data(%rip), %rdx  /* input_data */
         movl    $z_input_len, %ecx      /* input_len */
         movq    %rbp, %r8               /* output target address */
+        movq    $z_output_len, %r9      /* decompressed length */
         call    decompress_kernel
         popq    %rsi
 
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 0319c88290a5..434f077d2c4d 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -271,6 +271,79 @@ static void error(char *x)
                 asm("hlt");
 }
 
+#if CONFIG_X86_NEED_RELOCS
+static void handle_relocations(void *output, unsigned long output_len)
+{
+        int *reloc;
+        unsigned long delta, map, ptr;
+        unsigned long min_addr = (unsigned long)output;
+        unsigned long max_addr = min_addr + output_len;
+
+        /*
+         * Calculate the delta between where vmlinux was linked to load
+         * and where it was actually loaded.
+         */
+        delta = min_addr - LOAD_PHYSICAL_ADDR;
+        if (!delta) {
+                debug_putstr("No relocation needed... ");
+                return;
+        }
+        debug_putstr("Performing relocations... ");
+
+        /*
+         * The kernel contains a table of relocation addresses. Those
+         * addresses have the final load address of the kernel in virtual
+         * memory. We are currently working in the self map. So we need to
+         * create an adjustment for kernel memory addresses to the self map.
+         * This will involve subtracting out the base address of the kernel.
+         */
+        map = delta - __START_KERNEL_map;
+
+        /*
+         * Process relocations: 32 bit relocations first then 64 bit after.
+         * Two sets of binary relocations are added to the end of the kernel
+         * before compression. Each relocation table entry is the kernel
+         * address of the location which needs to be updated stored as a
+         * 32-bit value which is sign extended to 64 bits.
+         *
+         * Format is:
+         *
+         * kernel bits...
+         * 0 - zero terminator for 64 bit relocations
+         * 64 bit relocation repeated
+         * 0 - zero terminator for 32 bit relocations
+         * 32 bit relocation repeated
+         *
+         * So we work backwards from the end of the decompressed image.
+         */
+        for (reloc = output + output_len - sizeof(*reloc); *reloc; reloc--) {
+                int extended = *reloc;
+                extended += map;
+
+                ptr = (unsigned long)extended;
+                if (ptr < min_addr || ptr > max_addr)
+                        error("32-bit relocation outside of kernel!\n");
+
+                *(uint32_t *)ptr += delta;
+        }
+#ifdef CONFIG_X86_64
+        for (reloc--; *reloc; reloc--) {
+                long extended = *reloc;
+                extended += map;
+
+                ptr = (unsigned long)extended;
+                if (ptr < min_addr || ptr > max_addr)
+                        error("64-bit relocation outside of kernel!\n");
+
+                *(uint64_t *)ptr += delta;
+        }
+#endif
+}
+#else
+static inline void handle_relocations(void *output, unsigned long output_len)
+{ }
+#endif
+
 static void parse_elf(void *output)
 {
 #ifdef CONFIG_X86_64
@@ -325,7 +398,8 @@ static void parse_elf(void *output)
 asmlinkage void decompress_kernel(void *rmode, memptr heap,
                                   unsigned char *input_data,
                                   unsigned long input_len,
-                                  unsigned char *output)
+                                  unsigned char *output,
+                                  unsigned long output_len)
 {
         real_mode = rmode;
 
@@ -365,6 +439,7 @@ asmlinkage void decompress_kernel(void *rmode, memptr heap,
         debug_putstr("\nDecompressing Linux... ");
         decompress(input_data, input_len, NULL, NULL, output, NULL, error);
         parse_elf(output);
+        handle_relocations(output, output_len);
         debug_putstr("done.\nBooting the kernel.\n");
         return;
 }
diff --git a/arch/x86/boot/printf.c b/arch/x86/boot/printf.c
index cdac91ca55d3..565083c16e5c 100644
--- a/arch/x86/boot/printf.c
+++ b/arch/x86/boot/printf.c
@@ -55,7 +55,7 @@ static char *number(char *str, long num, int base, int size, int precision,
         locase = (type & SMALL);
         if (type & LEFT)
                 type &= ~ZEROPAD;
-        if (base < 2 || base > 36)
+        if (base < 2 || base > 16)
                 return NULL;
         c = (type & ZEROPAD) ? '0' : ' ';
         sign = 0;
diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
index bccfca68430e..665a730307f2 100644
--- a/arch/x86/ia32/ia32_signal.c
+++ b/arch/x86/ia32/ia32_signal.c
@@ -457,7 +457,7 @@ int ia32_setup_rt_frame(int sig, struct ksignal *ksig,
                 else
                         put_user_ex(0, &frame->uc.uc_flags);
                 put_user_ex(0, &frame->uc.uc_link);
-                err |= __compat_save_altstack(&frame->uc.uc_stack, regs->sp);
+                compat_save_altstack_ex(&frame->uc.uc_stack, regs->sp);
 
                 if (ksig->ka.sa.sa_flags & SA_RESTORER)
                         restorer = ksig->ka.sa.sa_restorer;
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index 474dc1b59f72..4299eb05023c 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -452,7 +452,7 @@ ia32_badsys:
 
         CFI_ENDPROC
         
-        .macro PTREGSCALL label, func, arg
+        .macro PTREGSCALL label, func
         ALIGN
 GLOBAL(\label)
         leaq \func(%rip),%rax
diff --git a/arch/x86/include/asm/acpi.h b/arch/x86/include/asm/acpi.h
index 2dfac58f3b11..b1977bad5435 100644
--- a/arch/x86/include/asm/acpi.h
+++ b/arch/x86/include/asm/acpi.h
@@ -86,6 +86,7 @@ extern int acpi_pci_disabled;
 extern int acpi_skip_timer_override;
 extern int acpi_use_timer_override;
 extern int acpi_fix_pin2_polarity;
+extern int acpi_disable_cmcff;
 
 extern u8 acpi_sci_flags;
 extern int acpi_sci_override_gsi;
@@ -168,6 +169,7 @@ static inline void arch_acpi_set_pdc_bits(u32 *buf)
 
 #define acpi_lapic 0
 #define acpi_ioapic 0
+#define acpi_disable_cmcff 0
 static inline void acpi_noirq_set(void) { }
 static inline void acpi_disable_pci(void) { }
 static inline void disable_acpi(void) { }
diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
index 58ed6d96a6ac..0a3f9c9f98d5 100644
--- a/arch/x86/include/asm/alternative.h
+++ b/arch/x86/include/asm/alternative.h
@@ -5,6 +5,7 @@
 #include <linux/stddef.h>
 #include <linux/stringify.h>
 #include <asm/asm.h>
+#include <asm/ptrace.h>
 
 /*
  * Alternative inline assembly for SMP.
@@ -220,20 +221,11 @@ extern void *text_poke_early(void *addr, const void *opcode, size_t len);
  * no thread can be preempted in the instructions being modified (no iret to an
  * invalid instruction possible) or if the instructions are changed from a
  * consistent state to another consistent state atomically.
- * More care must be taken when modifying code in the SMP case because of
- * Intel's errata. text_poke_smp() takes care that errata, but still
- * doesn't support NMI/MCE handler code modifying.
  * On the local CPU you need to be protected again NMI or MCE handlers seeing an
  * inconsistent instruction while you patch.
  */
-struct text_poke_param {
-        void *addr;
-        const void *opcode;
-        size_t len;
-};
-
 extern void *text_poke(void *addr, const void *opcode, size_t len);
-extern void *text_poke_smp(void *addr, const void *opcode, size_t len);
-extern void text_poke_smp_batch(struct text_poke_param *params, int n);
+extern int poke_int3_handler(struct pt_regs *regs);
+extern void *text_poke_bp(void *addr, const void *opcode, size_t len, void *handler);
 
 #endif /* _ASM_X86_ALTERNATIVE_H */
diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
index f8119b582c3c..1d2091a226bc 100644
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -715,4 +715,6 @@ static inline void exiting_ack_irq(void)
         ack_APIC_irq();
 }
 
+extern void ioapic_zap_locks(void);
+
 #endif /* _ASM_X86_APIC_H */
diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h
index 1c2d247f65ce..4582e8e1cd1a 100644
--- a/arch/x86/include/asm/asm.h
+++ b/arch/x86/include/asm/asm.h
@@ -3,21 +3,25 @@
 
 #ifdef __ASSEMBLY__
 # define __ASM_FORM(x)  x
+# define __ASM_FORM_RAW(x)     x
 # define __ASM_FORM_COMMA(x) x,
 #else
 # define __ASM_FORM(x)  " " #x " "
+# define __ASM_FORM_RAW(x)     #x
 # define __ASM_FORM_COMMA(x) " " #x ","
 #endif
 
 #ifdef CONFIG_X86_32
 # define __ASM_SEL(a,b) __ASM_FORM(a)
+# define __ASM_SEL_RAW(a,b) __ASM_FORM_RAW(a)
 #else
 # define __ASM_SEL(a,b) __ASM_FORM(b)
+# define __ASM_SEL_RAW(a,b) __ASM_FORM_RAW(b)
 #endif
 
 #define __ASM_SIZE(inst, ...)   __ASM_SEL(inst##l##__VA_ARGS__, \
                                           inst##q##__VA_ARGS__)
-#define __ASM_REG(reg)          __ASM_SEL(e##reg, r##reg)
+#define __ASM_REG(reg)         __ASM_SEL_RAW(e##reg, r##reg)
 
 #define _ASM_PTR        __ASM_SEL(.long, .quad)
 #define _ASM_ALIGN      __ASM_SEL(.balign 4, .balign 8)
diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
index 6dfd0195bb55..41639ce8fd63 100644
--- a/arch/x86/include/asm/bitops.h
+++ b/arch/x86/include/asm/bitops.h
@@ -15,6 +15,14 @@
 #include <linux/compiler.h>
 #include <asm/alternative.h>
 
+#if BITS_PER_LONG == 32
+# define _BITOPS_LONG_SHIFT 5
+#elif BITS_PER_LONG == 64
+# define _BITOPS_LONG_SHIFT 6
+#else
+# error "Unexpected BITS_PER_LONG"
+#endif
+
 #define BIT_64(n)                       (U64_C(1) << (n))
 
 /*
@@ -59,7 +67,7 @@
  * restricted to acting on a single-word quantity.
  */
 static __always_inline void
-set_bit(unsigned int nr, volatile unsigned long *addr)
+set_bit(long nr, volatile unsigned long *addr)
 {
         if (IS_IMMEDIATE(nr)) {
                 asm volatile(LOCK_PREFIX "orb %1,%0"
@@ -81,7 +89,7 @@ set_bit(unsigned int nr, volatile unsigned long *addr)
  * If it's called on the same region of memory simultaneously, the effect
  * may be that only one operation succeeds.
  */
-static inline void __set_bit(int nr, volatile unsigned long *addr)
+static inline void __set_bit(long nr, volatile unsigned long *addr)
 {
         asm volatile("bts %1,%0" : ADDR : "Ir" (nr) : "memory");
 }
@@ -97,7 +105,7 @@ static inline void __set_bit(int nr, volatile unsigned long *addr)
  * in order to ensure changes are visible on other processors.
  */
 static __always_inline void
-clear_bit(int nr, volatile unsigned long *addr)
+clear_bit(long nr, volatile unsigned long *addr)
 {
         if (IS_IMMEDIATE(nr)) {
                 asm volatile(LOCK_PREFIX "andb %1,%0"
@@ -118,13 +126,13 @@ clear_bit(int nr, volatile unsigned long *addr)
  * clear_bit() is atomic and implies release semantics before the memory
  * operation. It can be used for an unlock.
  */
-static inline void clear_bit_unlock(unsigned nr, volatile unsigned long *addr)
+static inline void clear_bit_unlock(long nr, volatile unsigned long *addr)
 {
         barrier();
         clear_bit(nr, addr);
 }
 
-static inline void __clear_bit(int nr, volatile unsigned long *addr)
+static inline void __clear_bit(long nr, volatile unsigned long *addr)
 {
         asm volatile("btr %1,%0" : ADDR : "Ir" (nr));
 }
@@ -141,7 +149,7 @@ static inline void __clear_bit(int nr, volatile unsigned long *addr)
  * No memory barrier is required here, because x86 cannot reorder stores past
  * older loads. Same principle as spin_unlock.
  */
-static inline void __clear_bit_unlock(unsigned nr, volatile unsigned long *addr)
+static inline void __clear_bit_unlock(long nr, volatile unsigned long *addr)
 {
         barrier();
         __clear_bit(nr, addr);
@@ -159,7 +167,7 @@ static inline void __clear_bit_unlock(unsigned nr, volatile unsigned long *addr)
  * If it's called on the same region of memory simultaneously, the effect
  * may be that only one operation succeeds.
  */
-static inline void __change_bit(int nr, volatile unsigned long *addr)
+static inline void __change_bit(long nr, volatile unsigned long *addr)
 {
         asm volatile("btc %1,%0" : ADDR : "Ir" (nr));
 }
@@ -173,7 +181,7 @@ static inline void __change_bit(int nr, volatile unsigned long *addr)
  * Note that @nr may be almost arbitrarily large; this function is not
  * restricted to acting on a single-word quantity.
  */
-static inline void change_bit(int nr, volatile unsigned long *addr)
+static inline void change_bit(long nr, volatile unsigned long *addr)
 {
         if (IS_IMMEDIATE(nr)) {
                 asm volatile(LOCK_PREFIX "xorb %1,%0"
@@ -194,7 +202,7 @@ static inline void change_bit(int nr, volatile unsigned long *addr)
  * This operation is atomic and cannot be reordered.
  * It also implies a memory barrier.
  */
-static inline int test_and_set_bit(int nr, volatile unsigned long *addr)
+static inline int test_and_set_bit(long nr, volatile unsigned long *addr)
 {
         int oldbit;
 
@@ -212,7 +220,7 @@ static inline int test_and_set_bit(int nr, volatile unsigned long *addr)
  * This is the same as test_and_set_bit on x86.
  */
 static __always_inline int
-test_and_set_bit_lock(int nr, volatile unsigned long *addr)
+test_and_set_bit_lock(long nr, volatile unsigned long *addr)
 {
         return test_and_set_bit(nr, addr);
 }
@@ -226,7 +234,7 @@ test_and_set_bit_lock(int nr, volatile unsigned long *addr)
  * If two examples of this operation race, one can appear to succeed
  * but actually fail.  You must protect multiple accesses with a lock.
  */
-static inline int __test_and_set_bit(int nr, volatile unsigned long *addr)
+static inline int __test_and_set_bit(long nr, volatile unsigned long *addr)
 {
         int oldbit;
 
@@ -245,7 +253,7 @@ static inline int __test_and_set_bit(int nr, volatile unsigned long *addr)
  * This operation is atomic and cannot be reordered.
  * It also implies a memory barrier.
  */
-static inline int test_and_clear_bit(int nr, volatile unsigned long *addr)
+static inline int test_and_clear_bit(long nr, volatile unsigned long *addr)
 {
         int oldbit;
 
@@ -272,7 +280,7 @@ static inline int test_and_clear_bit(int nr, volatile unsigned long *addr)
  * accessed from a hypervisor on the same CPU if running in a VM: don't change
  * this without also updating arch/x86/kernel/kvm.c
  */
-static inline int __test_and_clear_bit(int nr, volatile unsigned long *addr)
+static inline int __test_and_clear_bit(long nr, volatile unsigned long *addr)
 {
         int oldbit;
 
@@ -284,7 +292,7 @@ static inline int __test_and_clear_bit(int nr, volatile unsigned long *addr)
 }
 
 /* WARNING: non atomic and it can be reordered! */
-static inline int __test_and_change_bit(int nr, volatile unsigned long *addr)
+static inline int __test_and_change_bit(long nr, volatile unsigned long *addr)
 {
         int oldbit;
 
@@ -304,7 +312,7 @@ static inline int __test_and_change_bit(int nr, volatile unsigned long *addr)
  * This operation is atomic and cannot be reordered.
  * It also implies a memory barrier.
  */
-static inline int test_and_change_bit(int nr, volatile unsigned long *addr)
+static inline int test_and_change_bit(long nr, volatile unsigned long *addr)
 {
         int oldbit;
 
@@ -315,13 +323,13 @@ static inline int test_and_change_bit(int nr, volatile unsigned long *addr)
         return oldbit;
 }
 
-static __always_inline int constant_test_bit(unsigned int nr, const volatile unsigned long *addr)
+static __always_inline int constant_test_bit(long nr, const volatile unsigned long *addr)
 {
-        return ((1UL << (nr % BITS_PER_LONG)) &
-                (addr[nr / BITS_PER_LONG])) != 0;
+        return ((1UL << (nr & (BITS_PER_LONG-1))) &
+                (addr[nr >> _BITOPS_LONG_SHIFT])) != 0;
 }
 
-static inline int variable_test_bit(int nr, volatile const unsigned long *addr)
+static inline int variable_test_bit(long nr, volatile const unsigned long *addr)
 {
         int oldbit;
 
diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h
index 653668d140f9..4a8cb8d7cbd5 100644
--- a/arch/x86/include/asm/bootparam_utils.h
+++ b/arch/x86/include/asm/bootparam_utils.h
@@ -35,9 +35,9 @@ static void sanitize_boot_params(struct boot_params *boot_params)
          */
         if (boot_params->sentinel) {
                 /* fields in boot_params are left uninitialized, clear them */
-                memset(&boot_params->olpc_ofw_header, 0,
+                memset(&boot_params->ext_ramdisk_image, 0,
                        (char *)&boot_params->efi_info -
-                        (char *)&boot_params->olpc_ofw_header);
+                        (char *)&boot_params->ext_ramdisk_image);
                 memset(&boot_params->kbd_status, 0,
                        (char *)&boot_params->hdr -
                        (char *)&boot_params->kbd_status);
diff --git a/arch/x86/include/asm/checksum_32.h b/arch/x86/include/asm/checksum_32.h
index 46fc474fd819..f50de6951738 100644
--- a/arch/x86/include/asm/checksum_32.h
+++ b/arch/x86/include/asm/checksum_32.h
@@ -49,9 +49,15 @@ static inline __wsum csum_partial_copy_from_user(const void __user *src,
                                                  int len, __wsum sum,
                                                  int *err_ptr)
 {
+        __wsum ret;
+
         might_sleep();
-        return csum_partial_copy_generic((__force void *)src, dst,
-                                         len, sum, err_ptr, NULL);
+        stac();
+        ret = csum_partial_copy_generic((__force void *)src, dst,
+                                        len, sum, err_ptr, NULL);
+        clac();
+
+        return ret;
 }
 
 /*
@@ -176,10 +182,16 @@ static inline __wsum csum_and_copy_to_user(const void *src,
                                            int len, __wsum sum,
                                            int *err_ptr)
 {
+        __wsum ret;
+
         might_sleep();
-        if (access_ok(VERIFY_WRITE, dst, len))
-                return csum_partial_copy_generic(src, (__force void *)dst,
-                                                 len, sum, NULL, err_ptr);
+        if (access_ok(VERIFY_WRITE, dst, len)) {
+                stac();
+                ret = csum_partial_copy_generic(src, (__force void *)dst,
+                                                len, sum, NULL, err_ptr);
+                clac();
+                return ret;
+        }
 
         if (len)
                 *err_ptr = -EFAULT;
diff --git a/arch/x86/include/asm/checksum_64.h b/arch/x86/include/asm/checksum_64.h
index 9bfdc41629ec..e6fd8a026c7b 100644
--- a/arch/x86/include/asm/checksum_64.h
+++ b/arch/x86/include/asm/checksum_64.h
@@ -133,7 +133,7 @@ extern __wsum csum_partial(const void *buff, int len, __wsum sum);
 
 
 /* Do not call this directly. Use the wrappers below */
-extern __wsum csum_partial_copy_generic(const void *src, const void *dst,
+extern __visible __wsum csum_partial_copy_generic(const void *src, const void *dst,
                                         int len, __wsum sum,
                                         int *src_err_ptr, int *dst_err_ptr);
 
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 47538a61c91b..d3f5c63078d8 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -366,9 +366,10 @@ extern bool __static_cpu_has_safe(u16 bit);
  */
 static __always_inline __pure bool __static_cpu_has(u16 bit)
 {
-#if __GNUC__ > 4 || __GNUC_MINOR__ >= 5
+#ifdef CC_HAVE_ASM_GOTO
 
 #ifdef CONFIG_X86_DEBUG_STATIC_CPU_HAS
+
                 /*
                  * Catch too early usage of this before alternatives
                  * have run.
@@ -384,6 +385,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
                          ".previous\n"
                          /* skipping size check since replacement size = 0 */
                          : : "i" (X86_FEATURE_ALWAYS) : : t_warn);
+
 #endif
 
                 asm goto("1: jmp %l[t_no]\n"
@@ -406,7 +408,9 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
                 warn_pre_alternatives();
                 return false;
 #endif
-#else /* GCC_VERSION >= 40500 */
+
+#else /* CC_HAVE_ASM_GOTO */
+
                 u8 flag;
                 /* Open-coded due to __stringify() in ALTERNATIVE() */
                 asm volatile("1: movb $0,%0\n"
@@ -427,7 +431,8 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
                              ".previous\n"
                              : "=qm" (flag) : "i" (bit));
                 return flag;
-#endif
+
+#endif /* CC_HAVE_ASM_GOTO */
 }
 
 #define static_cpu_has(bit)                                     \
@@ -441,7 +446,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
 
 static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
 {
-#if __GNUC__ > 4 || __GNUC_MINOR__ >= 5
+#ifdef CC_HAVE_ASM_GOTO
 /*
  * We need to spell the jumps to the compiler because, depending on the offset,
  * the replacement jump can be bigger than the original jump, and this we cannot
@@ -475,7 +480,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
                 return false;
         t_dynamic:
                 return __static_cpu_has_safe(bit);
-#else /* GCC_VERSION >= 40500 */
+#else
                 u8 flag;
                 /* Open-coded due to __stringify() in ALTERNATIVE() */
                 asm volatile("1: movb $2,%0\n"
@@ -511,7 +516,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
                              : "=qm" (flag)
                              : "i" (bit), "i" (X86_FEATURE_ALWAYS));
                 return (flag == 2 ? __static_cpu_has_safe(bit) : flag);
-#endif
+#endif /* CC_HAVE_ASM_GOTO */
 }
 
 #define static_cpu_has_safe(bit)                                \
diff --git a/arch/x86/include/asm/e820.h b/arch/x86/include/asm/e820.h
index cccd07fa5e3a..779c2efe2e97 100644
--- a/arch/x86/include/asm/e820.h
+++ b/arch/x86/include/asm/e820.h
@@ -29,7 +29,7 @@ extern void e820_setup_gap(void);
 extern int e820_search_gap(unsigned long *gapstart, unsigned long *gapsize,
                         unsigned long start_addr, unsigned long long end_addr);
 struct setup_data;
-extern void parse_e820_ext(struct setup_data *data);
+extern void parse_e820_ext(u64 phys_addr, u32 data_len);
 
 #if defined(CONFIG_X86_64) || \
         (defined(CONFIG_X86_32) && defined(CONFIG_HIBERNATION))
diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
index e4ac559c4a24..92b3bae08b74 100644
--- a/arch/x86/include/asm/hw_irq.h
+++ b/arch/x86/include/asm/hw_irq.h
@@ -26,56 +26,56 @@
 #include <asm/sections.h>
 
 /* Interrupt handlers registered during init_IRQ */
-extern void apic_timer_interrupt(void);
-extern void x86_platform_ipi(void);
-extern void kvm_posted_intr_ipi(void);
-extern void error_interrupt(void);
-extern void irq_work_interrupt(void);
-
-extern void spurious_interrupt(void);
-extern void thermal_interrupt(void);
-extern void reschedule_interrupt(void);
-
-extern void invalidate_interrupt(void);
-extern void invalidate_interrupt0(void);
-extern void invalidate_interrupt1(void);
-extern void invalidate_interrupt2(void);
-extern void invalidate_interrupt3(void);
-extern void invalidate_interrupt4(void);
-extern void invalidate_interrupt5(void);
-extern void invalidate_interrupt6(void);
-extern void invalidate_interrupt7(void);
-extern void invalidate_interrupt8(void);
-extern void invalidate_interrupt9(void);
-extern void invalidate_interrupt10(void);
-extern void invalidate_interrupt11(void);
-extern void invalidate_interrupt12(void);
-extern void invalidate_interrupt13(void);
-extern void invalidate_interrupt14(void);
-extern void invalidate_interrupt15(void);
-extern void invalidate_interrupt16(void);
-extern void invalidate_interrupt17(void);
-extern void invalidate_interrupt18(void);
-extern void invalidate_interrupt19(void);
-extern void invalidate_interrupt20(void);
-extern void invalidate_interrupt21(void);
-extern void invalidate_interrupt22(void);
-extern void invalidate_interrupt23(void);
-extern void invalidate_interrupt24(void);
-extern void invalidate_interrupt25(void);
-extern void invalidate_interrupt26(void);
-extern void invalidate_interrupt27(void);
-extern void invalidate_interrupt28(void);
-extern void invalidate_interrupt29(void);
-extern void invalidate_interrupt30(void);
-extern void invalidate_interrupt31(void);
-
-extern void irq_move_cleanup_interrupt(void);
-extern void reboot_interrupt(void);
-extern void threshold_interrupt(void);
-
-extern void call_function_interrupt(void);
-extern void call_function_single_interrupt(void);
+extern asmlinkage void apic_timer_interrupt(void);
+extern asmlinkage void x86_platform_ipi(void);
+extern asmlinkage void kvm_posted_intr_ipi(void);
+extern asmlinkage void error_interrupt(void);
+extern asmlinkage void irq_work_interrupt(void);
+
+extern asmlinkage void spurious_interrupt(void);
+extern asmlinkage void thermal_interrupt(void);
+extern asmlinkage void reschedule_interrupt(void);
+
+extern asmlinkage void invalidate_interrupt(void);
+extern asmlinkage void invalidate_interrupt0(void);
+extern asmlinkage void invalidate_interrupt1(void);
+extern asmlinkage void invalidate_interrupt2(void);
+extern asmlinkage void invalidate_interrupt3(void);
+extern asmlinkage void invalidate_interrupt4(void);
+extern asmlinkage void invalidate_interrupt5(void);
+extern asmlinkage void invalidate_interrupt6(void);
+extern asmlinkage void invalidate_interrupt7(void);
+extern asmlinkage void invalidate_interrupt8(void);
+extern asmlinkage void invalidate_interrupt9(void);
+extern asmlinkage void invalidate_interrupt10(void);
+extern asmlinkage void invalidate_interrupt11(void);
+extern asmlinkage void invalidate_interrupt12(void);
+extern asmlinkage void invalidate_interrupt13(void);
+extern asmlinkage void invalidate_interrupt14(void);
+extern asmlinkage void invalidate_interrupt15(void);
+extern asmlinkage void invalidate_interrupt16(void);
+extern asmlinkage void invalidate_interrupt17(void);
+extern asmlinkage void invalidate_interrupt18(void);
+extern asmlinkage void invalidate_interrupt19(void);
+extern asmlinkage void invalidate_interrupt20(void);
+extern asmlinkage void invalidate_interrupt21(void);
+extern asmlinkage void invalidate_interrupt22(void);
+extern asmlinkage void invalidate_interrupt23(void);
+extern asmlinkage void invalidate_interrupt24(void);
+extern asmlinkage void invalidate_interrupt25(void);
+extern asmlinkage void invalidate_interrupt26(void);
+extern asmlinkage void invalidate_interrupt27(void);
+extern asmlinkage void invalidate_interrupt28(void);
+extern asmlinkage void invalidate_interrupt29(void);
+extern asmlinkage void invalidate_interrupt30(void);
+extern asmlinkage void invalidate_interrupt31(void);
+
+extern asmlinkage void irq_move_cleanup_interrupt(void);
+extern asmlinkage void reboot_interrupt(void);
+extern asmlinkage void threshold_interrupt(void);
+
+extern asmlinkage void call_function_interrupt(void);
+extern asmlinkage void call_function_single_interrupt(void);
 
 #ifdef CONFIG_TRACING
 /* Interrupt handlers registered during init_IRQ */
@@ -172,22 +172,18 @@ extern atomic_t irq_mis_count;
 extern void eisa_set_level_irq(unsigned int irq);
 
 /* SMP */
-extern void smp_apic_timer_interrupt(struct pt_regs *);
-extern void smp_spurious_interrupt(struct pt_regs *);
-extern void smp_x86_platform_ipi(struct pt_regs *);
-extern void smp_error_interrupt(struct pt_regs *);
+extern __visible void smp_apic_timer_interrupt(struct pt_regs *);
+extern __visible void smp_spurious_interrupt(struct pt_regs *);
+extern __visible void smp_x86_platform_ipi(struct pt_regs *);
+extern __visible void smp_error_interrupt(struct pt_regs *);
 #ifdef CONFIG_X86_IO_APIC
 extern asmlinkage void smp_irq_move_cleanup_interrupt(void);
 #endif
 #ifdef CONFIG_SMP
-extern void smp_reschedule_interrupt(struct pt_regs *);
-extern void smp_call_function_interrupt(struct pt_regs *);
-extern void smp_call_function_single_interrupt(struct pt_regs *);
-#ifdef CONFIG_X86_32
-extern void smp_invalidate_interrupt(struct pt_regs *);
-#else
-extern asmlinkage void smp_invalidate_interrupt(struct pt_regs *);
-#endif
+extern __visible void smp_reschedule_interrupt(struct pt_regs *);
+extern __visible void smp_call_function_interrupt(struct pt_regs *);
+extern __visible void smp_call_function_single_interrupt(struct pt_regs *);
+extern __visible void smp_invalidate_interrupt(struct pt_regs *);
 #endif
 
 extern void (*__initconst interrupt[NR_VECTORS-FIRST_EXTERNAL_VECTOR])(void);
diff --git a/arch/x86/include/asm/hypervisor.h b/arch/x86/include/asm/hypervisor.h
index 2d4b5e6107cd..e42f758a0fbd 100644
--- a/arch/x86/include/asm/hypervisor.h
+++ b/arch/x86/include/asm/hypervisor.h
@@ -33,7 +33,7 @@ struct hypervisor_x86 {
         const char      *name;
 
         /* Detection routine */
-        bool            (*detect)(void);
+        uint32_t        (*detect)(void);
 
         /* Adjust CPU feature bits (run once per CPU) */
         void            (*set_cpu_features)(struct cpuinfo_x86 *);
diff --git a/arch/x86/include/asm/irq.h b/arch/x86/include/asm/irq.h
index 57873beb3292..0ea10f27d613 100644
--- a/arch/x86/include/asm/irq.h
+++ b/arch/x86/include/asm/irq.h
@@ -33,7 +33,7 @@ extern void (*x86_platform_ipi_callback)(void);
 extern void native_init_IRQ(void);
 extern bool handle_irq(unsigned irq, struct pt_regs *regs);
 
-extern unsigned int do_IRQ(struct pt_regs *regs);
+extern __visible unsigned int do_IRQ(struct pt_regs *regs);
 
 /* Interrupt vector management */
 extern DECLARE_BITMAP(used_vectors, NR_VECTORS);
diff --git a/arch/x86/include/asm/kprobes.h b/arch/x86/include/asm/kprobes.h
index 5a6d2873f80e..9454c167629f 100644
--- a/arch/x86/include/asm/kprobes.h
+++ b/arch/x86/include/asm/kprobes.h
@@ -49,10 +49,10 @@ typedef u8 kprobe_opcode_t;
 #define flush_insn_slot(p)      do { } while (0)
 
 /* optinsn template addresses */
-extern kprobe_opcode_t optprobe_template_entry;
-extern kprobe_opcode_t optprobe_template_val;
-extern kprobe_opcode_t optprobe_template_call;
-extern kprobe_opcode_t optprobe_template_end;
+extern __visible kprobe_opcode_t optprobe_template_entry;
+extern __visible kprobe_opcode_t optprobe_template_val;
+extern __visible kprobe_opcode_t optprobe_template_call;
+extern __visible kprobe_opcode_t optprobe_template_end;
 #define MAX_OPTIMIZED_LENGTH (MAX_INSN_SIZE + RELATIVE_ADDR_SIZE)
 #define MAX_OPTINSN_SIZE                                \
         (((unsigned long)&optprobe_template_end -       \
@@ -62,7 +62,7 @@ extern kprobe_opcode_t optprobe_template_end;
 extern const int kretprobe_blacklist_size;
 
 void arch_remove_kprobe(struct kprobe *p);
-void kretprobe_trampoline(void);
+asmlinkage void kretprobe_trampoline(void);
 
 /* Architecture specific copy of original instruction*/
 struct arch_specific_insn {
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index f87f7fcefa0a..c76ff74a98f2 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -286,6 +286,7 @@ struct kvm_mmu {
         u64 *pae_root;
         u64 *lm_root;
         u64 rsvd_bits_mask[2][4];
+        u64 bad_mt_xwr;
 
         /*
          * Bitmap: bit set = last pte in walk
@@ -323,6 +324,7 @@ struct kvm_pmu {
         u64 global_ovf_ctrl;
         u64 counter_bitmask[2];
         u64 global_ctrl_mask;
+        u64 reserved_bits;
         u8 version;
         struct kvm_pmc gp_counters[INTEL_PMC_MAX_GENERIC];
         struct kvm_pmc fixed_counters[INTEL_PMC_MAX_FIXED];
@@ -511,6 +513,14 @@ struct kvm_vcpu_arch {
          * instruction.
          */
         bool write_fault_to_shadow_pgtable;
+
+        /* set at EPT violation at this point */
+        unsigned long exit_qualification;
+
+        /* pv related host specific info */
+        struct {
+                bool pv_unhalted;
+        } pv;
 };
 
 struct kvm_lpage_info {
@@ -802,8 +812,8 @@ extern u32  kvm_min_guest_tsc_khz;
 extern u32  kvm_max_guest_tsc_khz;
 
 enum emulation_result {
-        EMULATE_DONE,       /* no further processing */
-        EMULATE_DO_MMIO,      /* kvm_run filled with mmio request */
+        EMULATE_DONE,         /* no further processing */
+        EMULATE_USER_EXIT,    /* kvm_run ready for userspace exit */
         EMULATE_FAIL,         /* can't emulate this instruction */
 };
 
diff --git a/arch/x86/include/asm/kvm_para.h b/arch/x86/include/asm/kvm_para.h
index 695399f2d5eb..1df115909758 100644
--- a/arch/x86/include/asm/kvm_para.h
+++ b/arch/x86/include/asm/kvm_para.h
@@ -85,26 +85,20 @@ static inline long kvm_hypercall4(unsigned int nr, unsigned long p1,
         return ret;
 }
 
-static inline bool kvm_para_available(void)
+static inline uint32_t kvm_cpuid_base(void)
 {
-        unsigned int eax, ebx, ecx, edx;
-        char signature[13];
-
         if (boot_cpu_data.cpuid_level < 0)
-                return false;   /* So we don't blow up on old processors */
+                return 0;       /* So we don't blow up on old processors */
 
-        if (cpu_has_hypervisor) {
-                cpuid(KVM_CPUID_SIGNATURE, &eax, &ebx, &ecx, &edx);
-                memcpy(signature + 0, &ebx, 4);
-                memcpy(signature + 4, &ecx, 4);
-                memcpy(signature + 8, &edx, 4);
-                signature[12] = 0;
+        if (cpu_has_hypervisor)
+                return hypervisor_cpuid_base("KVMKVMKVM\0\0\0", 0);
 
-                if (strcmp(signature, "KVMKVMKVM") == 0)
-                        return true;
-        }
+        return 0;
+}
 
-        return false;
+static inline bool kvm_para_available(void)
+{
+        return kvm_cpuid_base() != 0;
 }
 
 static inline unsigned int kvm_arch_para_features(void)
@@ -118,10 +112,20 @@ void kvm_async_pf_task_wait(u32 token);
 void kvm_async_pf_task_wake(u32 token);
 u32 kvm_read_and_reset_pf_reason(void);
 extern void kvm_disable_steal_time(void);
-#else
-#define kvm_guest_init() do { } while (0)
+
+#ifdef CONFIG_PARAVIRT_SPINLOCKS
+void __init kvm_spinlock_init(void);
+#else /* !CONFIG_PARAVIRT_SPINLOCKS */
+static inline void kvm_spinlock_init(void)
+{
+}
+#endif /* CONFIG_PARAVIRT_SPINLOCKS */
+
+#else /* CONFIG_KVM_GUEST */
+#define kvm_guest_init() do {} while (0)
 #define kvm_async_pf_task_wait(T) do {} while(0)
 #define kvm_async_pf_task_wake(T) do {} while(0)
+
 static inline u32 kvm_read_and_reset_pf_reason(void)
 {
         return 0;
diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
index 29e3093bbd21..cbe6b9e404ce 100644
--- a/arch/x86/include/asm/mce.h
+++ b/arch/x86/include/asm/mce.h
@@ -32,11 +32,20 @@
 #define MCI_STATUS_PCC   (1ULL<<57)  /* processor context corrupt */
 #define MCI_STATUS_S     (1ULL<<56)  /* Signaled machine check */
 #define MCI_STATUS_AR    (1ULL<<55)  /* Action required */
-#define MCACOD            0xffff     /* MCA Error Code */
+
+/*
+ * Note that the full MCACOD field of IA32_MCi_STATUS MSR is
+ * bits 15:0.  But bit 12 is the 'F' bit, defined for corrected
+ * errors to indicate that errors are being filtered by hardware.
+ * We should mask out bit 12 when looking for specific signatures
+ * of uncorrected errors - so the F bit is deliberately skipped
+ * in this #define.
+ */
+#define MCACOD            0xefff     /* MCA Error Code */
 
 /* Architecturally defined codes from SDM Vol. 3B Chapter 15 */
 #define MCACOD_SCRUB    0x00C0  /* 0xC0-0xCF Memory Scrubbing */
-#define MCACOD_SCRUBMSK 0xfff0
+#define MCACOD_SCRUBMSK 0xeff0  /* Skip bit 12 ('F' bit) */
 #define MCACOD_L3WB     0x017A  /* L3 Explicit Writeback */
 #define MCACOD_DATA     0x0134  /* Data Load */
 #define MCACOD_INSTR    0x0150  /* Instruction Fetch */
@@ -188,6 +197,9 @@ extern void register_mce_write_callback(ssize_t (*)(struct file *filp,
                                     const char __user *ubuf,
                                     size_t usize, loff_t *off));
 
+/* Disable CMCI/polling for MCA bank claimed by firmware */
+extern void mce_disable_bank(int bank);
+
 /*
  * Exception handler
  */
diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h
index 50e5c58ced23..4c019179a57d 100644
--- a/arch/x86/include/asm/microcode_amd.h
+++ b/arch/x86/include/asm/microcode_amd.h
@@ -59,7 +59,7 @@ static inline u16 find_equiv_id(struct equiv_cpu_entry *equiv_cpu_table,
 
 extern int __apply_microcode_amd(struct microcode_amd *mc_amd);
 extern int apply_microcode_amd(int cpu);
-extern enum ucode_state load_microcode_amd(int cpu, const u8 *data, size_t size);
+extern enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size);
 
 #ifdef CONFIG_MICROCODE_AMD_EARLY
 #ifdef CONFIG_X86_32
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index cdbf36776106..be12c534fd59 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -45,22 +45,28 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
                 /* Re-load page tables */
                 load_cr3(next->pgd);
 
-                /* stop flush ipis for the previous mm */
+                /* Stop flush ipis for the previous mm */
                 cpumask_clear_cpu(cpu, mm_cpumask(prev));
 
-                /*
-                 * load the LDT, if the LDT is different:
-                 */
+                /* Load the LDT, if the LDT is different: */
                 if (unlikely(prev->context.ldt != next->context.ldt))
                         load_LDT_nolock(&next->context);
         }
 #ifdef CONFIG_SMP
-        else {
+          else {
                 this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
                 BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next);
 
-                if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next))) {
-                        /* We were in lazy tlb mode and leave_mm disabled
+                if (!cpumask_test_cpu(cpu, mm_cpumask(next))) {
+                        /*
+                         * On established mms, the mm_cpumask is only changed
+                         * from irq context, from ptep_clear_flush() while in
+                         * lazy tlb mode, and here. Irqs are blocked during
+                         * schedule, protecting us from simultaneous changes.
+                         */
+                        cpumask_set_cpu(cpu, mm_cpumask(next));
+                        /*
+                         * We were in lazy tlb mode and leave_mm disabled
                          * tlb flush IPI delivery. We must reload CR3
                          * to make sure to use no freed page tables.
                          */
diff --git a/arch/x86/include/asm/mutex_64.h b/arch/x86/include/asm/mutex_64.h
index 2c543fff241b..e7e6751648ed 100644
--- a/arch/x86/include/asm/mutex_64.h
+++ b/arch/x86/include/asm/mutex_64.h
@@ -16,6 +16,20 @@
  *
  * Atomically decrements @v and calls <fail_fn> if the result is negative.
  */
+#ifdef CC_HAVE_ASM_GOTO
+static inline void __mutex_fastpath_lock(atomic_t *v,
+                                         void (*fail_fn)(atomic_t *))
+{
+        asm volatile goto(LOCK_PREFIX "   decl %0\n"
+                          "   jns %l[exit]\n"
+                          : : "m" (v->counter)
+                          : "memory", "cc"
+                          : exit);
+        fail_fn(v);
+exit:
+        return;
+}
+#else
 #define __mutex_fastpath_lock(v, fail_fn)                       \
 do {                                                            \
         unsigned long dummy;                                    \
@@ -32,6 +46,7 @@ do {								\
                      : "rax", "rsi", "rdx", "rcx",              \
                        "r8", "r9", "r10", "r11", "memory");     \
 } while (0)
+#endif
 
 /**
  *  __mutex_fastpath_lock_retval - try to take the lock by moving the count
@@ -56,6 +71,20 @@ static inline int __mutex_fastpath_lock_retval(atomic_t *count)
  *
  * Atomically increments @v and calls <fail_fn> if the result is nonpositive.
  */
+#ifdef CC_HAVE_ASM_GOTO
+static inline void __mutex_fastpath_unlock(atomic_t *v,
+                                           void (*fail_fn)(atomic_t *))
+{
+        asm volatile goto(LOCK_PREFIX "   incl %0\n"
+                          "   jg %l[exit]\n"
+                          : : "m" (v->counter)
+                          : "memory", "cc"
+                          : exit);
+        fail_fn(v);
+exit:
+        return;
+}
+#else
 #define __mutex_fastpath_unlock(v, fail_fn)                     \
 do {                                                            \
         unsigned long dummy;                                    \
@@ -72,6 +101,7 @@ do {								\
                      : "rax", "rsi", "rdx", "rcx",              \
                        "r8", "r9", "r10", "r11", "memory");     \
 } while (0)
+#endif
 
 #define __mutex_slowpath_needs_to_unlock()      1
 
diff --git a/arch/x86/include/asm/page_32_types.h b/arch/x86/include/asm/page_32_types.h
index ef17af013475..f48b17df4224 100644
--- a/arch/x86/include/asm/page_32_types.h
+++ b/arch/x86/include/asm/page_32_types.h
@@ -15,6 +15,8 @@
  */
 #define __PAGE_OFFSET           _AC(CONFIG_PAGE_OFFSET, UL)
 
+#define __START_KERNEL_map      __PAGE_OFFSET
+
 #define THREAD_SIZE_ORDER       1
 #define THREAD_SIZE             (PAGE_SIZE << THREAD_SIZE_ORDER)
 
diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
index 6c896fbe21db..43dcd804ebd5 100644
--- a/arch/x86/include/asm/page_64_types.h
+++ b/arch/x86/include/asm/page_64_types.h
@@ -32,11 +32,6 @@
  */
 #define __PAGE_OFFSET           _AC(0xffff880000000000, UL)
 
-#define __PHYSICAL_START        ((CONFIG_PHYSICAL_START +               \
-                                  (CONFIG_PHYSICAL_ALIGN - 1)) &        \
-                                 ~(CONFIG_PHYSICAL_ALIGN - 1))
-
-#define __START_KERNEL          (__START_KERNEL_map + __PHYSICAL_START)
 #define __START_KERNEL_map      _AC(0xffffffff80000000, UL)
 
 /* See Documentation/x86/x86_64/mm.txt for a description of the memory map. */
diff --git a/arch/x86/include/asm/page_types.h b/arch/x86/include/asm/page_types.h
index 54c97879195e..f97fbe3abb67 100644
--- a/arch/x86/include/asm/page_types.h
+++ b/arch/x86/include/asm/page_types.h
@@ -33,6 +33,11 @@
         (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0 ) | \
          VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
 
+#define __PHYSICAL_START        ALIGN(CONFIG_PHYSICAL_START, \
+                                      CONFIG_PHYSICAL_ALIGN)
+
+#define __START_KERNEL          (__START_KERNEL_map + __PHYSICAL_START)
+
 #ifdef CONFIG_X86_64
 #include <asm/page_64_types.h>
 #else
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index cfdc9ee4c900..401f350ef71b 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -712,36 +712,16 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
 
 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
 
-static inline int arch_spin_is_locked(struct arch_spinlock *lock)
+static __always_inline void __ticket_lock_spinning(struct arch_spinlock *lock,
+                                                        __ticket_t ticket)
 {
-        return PVOP_CALL1(int, pv_lock_ops.spin_is_locked, lock);
+        PVOP_VCALLEE2(pv_lock_ops.lock_spinning, lock, ticket);
 }
 
-static inline int arch_spin_is_contended(struct arch_spinlock *lock)
+static __always_inline void __ticket_unlock_kick(struct arch_spinlock *lock,
+                                                        __ticket_t ticket)
 {
-        return PVOP_CALL1(int, pv_lock_ops.spin_is_contended, lock);
-}
-#define arch_spin_is_contended  arch_spin_is_contended
-
-static __always_inline void arch_spin_lock(struct arch_spinlock *lock)
-{
-        PVOP_VCALL1(pv_lock_ops.spin_lock, lock);
-}
-
-static __always_inline void arch_spin_lock_flags(struct arch_spinlock *lock,
-                                                  unsigned long flags)
-{
-        PVOP_VCALL2(pv_lock_ops.spin_lock_flags, lock, flags);
-}
-
-static __always_inline int arch_spin_trylock(struct arch_spinlock *lock)
-{
-        return PVOP_CALL1(int, pv_lock_ops.spin_trylock, lock);
-}
-
-static __always_inline void arch_spin_unlock(struct arch_spinlock *lock)
-{
-        PVOP_VCALL1(pv_lock_ops.spin_unlock, lock);
+        PVOP_VCALL2(pv_lock_ops.unlock_kick, lock, ticket);
 }
 
 #endif
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
index 0db1fcac668c..aab8f671b523 100644
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -327,13 +327,15 @@ struct pv_mmu_ops {
 };
 
 struct arch_spinlock;
+#ifdef CONFIG_SMP
+#include <asm/spinlock_types.h>
+#else
+typedef u16 __ticket_t;
+#endif
+
 struct pv_lock_ops {
-        int (*spin_is_locked)(struct arch_spinlock *lock);
-        int (*spin_is_contended)(struct arch_spinlock *lock);
-        void (*spin_lock)(struct arch_spinlock *lock);
-        void (*spin_lock_flags)(struct arch_spinlock *lock, unsigned long flags);
-        int (*spin_trylock)(struct arch_spinlock *lock);
-        void (*spin_unlock)(struct arch_spinlock *lock);
+        struct paravirt_callee_save lock_spinning;
+        void (*unlock_kick)(struct arch_spinlock *lock, __ticket_t ticket);
 };
 
 /* This contains all the paravirt structures: we get a convenient
@@ -387,7 +389,8 @@ extern struct pv_lock_ops pv_lock_ops;
 
 /* Simple instruction patching code. */
 #define DEF_NATIVE(ops, name, code)                                     \
-        extern const char start_##ops##_##name[], end_##ops##_##name[]; \
+        extern const char start_##ops##_##name[] __visible,             \
+                          end_##ops##_##name[] __visible;               \
         asm("start_" #ops "_" #name ": " code "; end_" #ops "_" #name ":")
 
 unsigned paravirt_patch_nop(void);
diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h
index f2b489cf1602..3bf2dd0cf61f 100644
--- a/arch/x86/include/asm/pgtable-2level.h
+++ b/arch/x86/include/asm/pgtable-2level.h
@@ -55,9 +55,53 @@ static inline pmd_t native_pmdp_get_and_clear(pmd_t *xp)
 #define native_pmdp_get_and_clear(xp) native_local_pmdp_get_and_clear(xp)
 #endif
 
+#ifdef CONFIG_MEM_SOFT_DIRTY
+
+/*
+ * Bits _PAGE_BIT_PRESENT, _PAGE_BIT_FILE, _PAGE_BIT_SOFT_DIRTY and
+ * _PAGE_BIT_PROTNONE are taken, split up the 28 bits of offset
+ * into this range.
+ */
+#define PTE_FILE_MAX_BITS       28
+#define PTE_FILE_SHIFT1         (_PAGE_BIT_PRESENT + 1)
+#define PTE_FILE_SHIFT2         (_PAGE_BIT_FILE + 1)
+#define PTE_FILE_SHIFT3         (_PAGE_BIT_PROTNONE + 1)
+#define PTE_FILE_SHIFT4         (_PAGE_BIT_SOFT_DIRTY + 1)
+#define PTE_FILE_BITS1          (PTE_FILE_SHIFT2 - PTE_FILE_SHIFT1 - 1)
+#define PTE_FILE_BITS2          (PTE_FILE_SHIFT3 - PTE_FILE_SHIFT2 - 1)
+#define PTE_FILE_BITS3          (PTE_FILE_SHIFT4 - PTE_FILE_SHIFT3 - 1)
+
+#define pte_to_pgoff(pte)                                               \
+        ((((pte).pte_low >> (PTE_FILE_SHIFT1))                          \
+          & ((1U << PTE_FILE_BITS1) - 1)))                              \
+        + ((((pte).pte_low >> (PTE_FILE_SHIFT2))                        \
+            & ((1U << PTE_FILE_BITS2) - 1))                             \
+           << (PTE_FILE_BITS1))                                         \
+        + ((((pte).pte_low >> (PTE_FILE_SHIFT3))                        \
+            & ((1U << PTE_FILE_BITS3) - 1))                             \
+           << (PTE_FILE_BITS1 + PTE_FILE_BITS2))                        \
+        + ((((pte).pte_low >> (PTE_FILE_SHIFT4)))                       \
+            << (PTE_FILE_BITS1 + PTE_FILE_BITS2 + PTE_FILE_BITS3))
+
+#define pgoff_to_pte(off)                                               \
+        ((pte_t) { .pte_low =                                           \
+         ((((off)) & ((1U << PTE_FILE_BITS1) - 1)) << PTE_FILE_SHIFT1)  \
+         + ((((off) >> PTE_FILE_BITS1)                                  \
+             & ((1U << PTE_FILE_BITS2) - 1))                            \
+            << PTE_FILE_SHIFT2)                                         \
+         + ((((off) >> (PTE_FILE_BITS1 + PTE_FILE_BITS2))               \
+             & ((1U << PTE_FILE_BITS3) - 1))                            \
+            << PTE_FILE_SHIFT3)                                         \
+         + ((((off) >>                                                  \
+              (PTE_FILE_BITS1 + PTE_FILE_BITS2 + PTE_FILE_BITS3)))      \
+            << PTE_FILE_SHIFT4)                                         \
+         + _PAGE_FILE })
+
+#else /* CONFIG_MEM_SOFT_DIRTY */
+
 /*
  * Bits _PAGE_BIT_PRESENT, _PAGE_BIT_FILE and _PAGE_BIT_PROTNONE are taken,
- * split up the 29 bits of offset into this range:
+ * split up the 29 bits of offset into this range.
  */
 #define PTE_FILE_MAX_BITS       29
 #define PTE_FILE_SHIFT1         (_PAGE_BIT_PRESENT + 1)
@@ -88,6 +132,8 @@ static inline pmd_t native_pmdp_get_and_clear(pmd_t *xp)
             << PTE_FILE_SHIFT3)                                         \
          + _PAGE_FILE })
 
+#endif /* CONFIG_MEM_SOFT_DIRTY */
+
 /* Encode and de-code a swap entry */
 #if _PAGE_BIT_FILE < _PAGE_BIT_PROTNONE
 #define SWP_TYPE_BITS (_PAGE_BIT_FILE - _PAGE_BIT_PRESENT - 1)
diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
index 4cc9f2b7cdc3..81bb91b49a88 100644
--- a/arch/x86/include/asm/pgtable-3level.h
+++ b/arch/x86/include/asm/pgtable-3level.h
@@ -179,6 +179,9 @@ static inline pmd_t native_pmdp_get_and_clear(pmd_t *pmdp)
 /*
  * Bits 0, 6 and 7 are taken in the low part of the pte,
  * put the 32 bits of offset into the high part.
+ *
+ * For soft-dirty tracking 11 bit is taken from
+ * the low part of pte as well.
  */
 #define pte_to_pgoff(pte) ((pte).pte_high)
 #define pgoff_to_pte(off)                                               \
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 7dc305a46058..8d16befdec88 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -22,7 +22,8 @@
  * ZERO_PAGE is a global shared page that is always zero: used
  * for zero-mapped memory areas etc..
  */
-extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]
+        __visible;
 #define ZERO_PAGE(vaddr) (virt_to_page(empty_zero_page))
 
 extern spinlock_t pgd_lock;
@@ -314,6 +315,36 @@ static inline pmd_t pmd_mksoft_dirty(pmd_t pmd)
         return pmd_set_flags(pmd, _PAGE_SOFT_DIRTY);
 }
 
+static inline pte_t pte_swp_mksoft_dirty(pte_t pte)
+{
+        return pte_set_flags(pte, _PAGE_SWP_SOFT_DIRTY);
+}
+
+static inline int pte_swp_soft_dirty(pte_t pte)
+{
+        return pte_flags(pte) & _PAGE_SWP_SOFT_DIRTY;
+}
+
+static inline pte_t pte_swp_clear_soft_dirty(pte_t pte)
+{
+        return pte_clear_flags(pte, _PAGE_SWP_SOFT_DIRTY);
+}
+
+static inline pte_t pte_file_clear_soft_dirty(pte_t pte)
+{
+        return pte_clear_flags(pte, _PAGE_SOFT_DIRTY);
+}
+
+static inline pte_t pte_file_mksoft_dirty(pte_t pte)
+{
+        return pte_set_flags(pte, _PAGE_SOFT_DIRTY);
+}
+
+static inline int pte_file_soft_dirty(pte_t pte)
+{
+        return pte_flags(pte) & _PAGE_SOFT_DIRTY;
+}
+
 /*
  * Mask out unsupported bits in a present pgprot.  Non-present pgprots
  * can use those bits for other purposes, so leave them be.
diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
index c98ac63aae48..f4843e031131 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -61,12 +61,27 @@
  * they do not conflict with each other.
  */
 
+#define _PAGE_BIT_SOFT_DIRTY    _PAGE_BIT_HIDDEN
+
 #ifdef CONFIG_MEM_SOFT_DIRTY
-#define _PAGE_SOFT_DIRTY        (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
+#define _PAGE_SOFT_DIRTY        (_AT(pteval_t, 1) << _PAGE_BIT_SOFT_DIRTY)
 #else
 #define _PAGE_SOFT_DIRTY        (_AT(pteval_t, 0))
 #endif
 
+/*
+ * Tracking soft dirty bit when a page goes to a swap is tricky.
+ * We need a bit which can be stored in pte _and_ not conflict
+ * with swap entry format. On x86 bits 6 and 7 are *not* involved
+ * into swap entry computation, but bit 6 is used for nonlinear
+ * file mapping, so we borrow bit 7 for soft dirty tracking.
+ */
+#ifdef CONFIG_MEM_SOFT_DIRTY
+#define _PAGE_SWP_SOFT_DIRTY    _PAGE_PSE
+#else
+#define _PAGE_SWP_SOFT_DIRTY    (_AT(pteval_t, 0))
+#endif
+
 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
 #define _PAGE_NX        (_AT(pteval_t, 1) << _PAGE_BIT_NX)
 #else
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 24cf5aefb704..987c75ecc334 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -412,7 +412,7 @@ union irq_stack_union {
         };
 };
 
-DECLARE_PER_CPU_FIRST(union irq_stack_union, irq_stack_union);
+DECLARE_PER_CPU_FIRST(union irq_stack_union, irq_stack_union) __visible;
 DECLARE_INIT_PER_CPU(irq_stack_union);
 
 DECLARE_PER_CPU(char *, irq_stack_ptr);
@@ -942,33 +942,19 @@ extern int set_tsc_mode(unsigned int val);
 
 extern u16 amd_get_nb_id(int cpu);
 
-struct aperfmperf {
-        u64 aperf, mperf;
-};
-
-static inline void get_aperfmperf(struct aperfmperf *am)
+static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves)
 {
-        WARN_ON_ONCE(!boot_cpu_has(X86_FEATURE_APERFMPERF));
-
-        rdmsrl(MSR_IA32_APERF, am->aperf);
-        rdmsrl(MSR_IA32_MPERF, am->mperf);
-}
+        uint32_t base, eax, signature[3];
 
-#define APERFMPERF_SHIFT 10
+        for (base = 0x40000000; base < 0x40010000; base += 0x100) {
+                cpuid(base, &eax, &signature[0], &signature[1], &signature[2]);
 
-static inline
-unsigned long calc_aperfmperf_ratio(struct aperfmperf *old,
-                                    struct aperfmperf *new)
-{
-        u64 aperf = new->aperf - old->aperf;
-        u64 mperf = new->mperf - old->mperf;
-        unsigned long ratio = aperf;
-
-        mperf >>= APERFMPERF_SHIFT;
-        if (mperf)
-                ratio = div64_u64(aperf, mperf);
+                if (!memcmp(sig, signature, 12) &&
+                    (leaves == 0 || ((eax - base) >= leaves)))
+                        return base;
+        }
 
-        return ratio;
+        return 0;
 }
 
 extern unsigned long arch_align_stack(unsigned long sp);
diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h
index 109a9dd5d454..be8269b00e2a 100644
--- a/arch/x86/include/asm/pvclock.h
+++ b/arch/x86/include/asm/pvclock.h
@@ -93,7 +93,6 @@ unsigned __pvclock_read_cycles(const struct pvclock_vcpu_time_info *src,
 
 struct pvclock_vsyscall_time_info {
         struct pvclock_vcpu_time_info pvti;
-        u32 migrate_count;
 } __attribute__((__aligned__(SMP_CACHE_BYTES)));
 
 #define PVTI_SIZE sizeof(struct pvclock_vsyscall_time_info)
diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h
index b7bf3505e1ec..347555492dad 100644
--- a/arch/x86/include/asm/setup.h
+++ b/arch/x86/include/asm/setup.h
@@ -6,6 +6,8 @@
 
 #define COMMAND_LINE_SIZE 2048
 
+#include <linux/linkage.h>
+
 #ifdef __i386__
 
 #include <linux/pfn.h>
@@ -108,11 +110,11 @@ void *extend_brk(size_t size, size_t align);
 extern void probe_roms(void);
 #ifdef __i386__
 
-void __init i386_start_kernel(void);
+asmlinkage void __init i386_start_kernel(void);
 
 #else
-void __init x86_64_start_kernel(char *real_mode);
-void __init x86_64_start_reservations(char *real_mode_data);
+asmlinkage void __init x86_64_start_kernel(char *real_mode);
+asmlinkage void __init x86_64_start_reservations(char *real_mode_data);
 
 #endif /* __i386__ */
 #endif /* _SETUP */
diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h
index 2f4d924fe6c9..645cad2c95ff 100644
--- a/arch/x86/include/asm/special_insns.h
+++ b/arch/x86/include/asm/special_insns.h
@@ -101,7 +101,7 @@ static inline void native_wbinvd(void)
         asm volatile("wbinvd": : :"memory");
 }
 
-extern void native_load_gs_index(unsigned);
+extern asmlinkage void native_load_gs_index(unsigned);
 
 #ifdef CONFIG_PARAVIRT
 #include <asm/paravirt.h>
diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
index 33692eaabab5..bf156ded74b5 100644
--- a/arch/x86/include/asm/spinlock.h
+++ b/arch/x86/include/asm/spinlock.h
@@ -1,11 +1,14 @@
 #ifndef _ASM_X86_SPINLOCK_H
 #define _ASM_X86_SPINLOCK_H
 
+#include <linux/jump_label.h>
 #include <linux/atomic.h>
 #include <asm/page.h>
 #include <asm/processor.h>
 #include <linux/compiler.h>
 #include <asm/paravirt.h>
+#include <asm/bitops.h>
+
 /*
  * Your basic SMP spinlocks, allowing only a single CPU anywhere
  *
@@ -34,6 +37,36 @@
 # define UNLOCK_LOCK_PREFIX
 #endif
 
+/* How long a lock should spin before we consider blocking */
+#define SPIN_THRESHOLD  (1 << 15)
+
+extern struct static_key paravirt_ticketlocks_enabled;
+static __always_inline bool static_key_false(struct static_key *key);
+
+#ifdef CONFIG_PARAVIRT_SPINLOCKS
+
+static inline void __ticket_enter_slowpath(arch_spinlock_t *lock)
+{
+        set_bit(0, (volatile unsigned long *)&lock->tickets.tail);
+}
+
+#else  /* !CONFIG_PARAVIRT_SPINLOCKS */
+static __always_inline void __ticket_lock_spinning(arch_spinlock_t *lock,
+                                                        __ticket_t ticket)
+{
+}
+static inline void __ticket_unlock_kick(arch_spinlock_t *lock,
+                                                        __ticket_t ticket)
+{
+}
+
+#endif /* CONFIG_PARAVIRT_SPINLOCKS */
+
+static __always_inline int arch_spin_value_unlocked(arch_spinlock_t lock)
+{
+        return lock.tickets.head == lock.tickets.tail;
+}
+
 /*
  * Ticket locks are conceptually two parts, one indicating the current head of
  * the queue, and the other indicating the current tail. The lock is acquired
@@ -47,81 +80,101 @@
  * in the high part, because a wide xadd increment of the low part would carry
  * up and contaminate the high part.
  */
-static __always_inline void __ticket_spin_lock(arch_spinlock_t *lock)
+static __always_inline void arch_spin_lock(arch_spinlock_t *lock)
 {
-        register struct __raw_tickets inc = { .tail = 1 };
+        register struct __raw_tickets inc = { .tail = TICKET_LOCK_INC };
 
         inc = xadd(&lock->tickets, inc);
+        if (likely(inc.head == inc.tail))
+                goto out;
 
+        inc.tail &= ~TICKET_SLOWPATH_FLAG;
         for (;;) {
-                if (inc.head == inc.tail)
-                        break;
-                cpu_relax();
-                inc.head = ACCESS_ONCE(lock->tickets.head);
+                unsigned count = SPIN_THRESHOLD;
+
+                do {
+                        if (ACCESS_ONCE(lock->tickets.head) == inc.tail)
+                                goto out;
+                        cpu_relax();
+                } while (--count);
+                __ticket_lock_spinning(lock, inc.tail);
         }
-        barrier();              /* make sure nothing creeps before the lock is taken */
+out:    barrier();      /* make sure nothing creeps before the lock is taken */
 }
 
-static __always_inline int __ticket_spin_trylock(arch_spinlock_t *lock)
+static __always_inline int arch_spin_trylock(arch_spinlock_t *lock)
 {
         arch_spinlock_t old, new;
 
         old.tickets = ACCESS_ONCE(lock->tickets);
-        if (old.tickets.head != old.tickets.tail)
+        if (old.tickets.head != (old.tickets.tail & ~TICKET_SLOWPATH_FLAG))
                 return 0;
 
-        new.head_tail = old.head_tail + (1 << TICKET_SHIFT);
+        new.head_tail = old.head_tail + (TICKET_LOCK_INC << TICKET_SHIFT);
 
         /* cmpxchg is a full barrier, so nothing can move before it */
         return cmpxchg(&lock->head_tail, old.head_tail, new.head_tail) == old.head_tail;
 }
 
-static __always_inline void __ticket_spin_unlock(arch_spinlock_t *lock)
+static inline void __ticket_unlock_slowpath(arch_spinlock_t *lock,
+                                            arch_spinlock_t old)
 {
-        __add(&lock->tickets.head, 1, UNLOCK_LOCK_PREFIX);
+        arch_spinlock_t new;
+
+        BUILD_BUG_ON(((__ticket_t)NR_CPUS) != NR_CPUS);
+
+        /* Perform the unlock on the "before" copy */
+        old.tickets.head += TICKET_LOCK_INC;
+
+        /* Clear the slowpath flag */
+        new.head_tail = old.head_tail & ~(TICKET_SLOWPATH_FLAG << TICKET_SHIFT);
+
+        /*
+         * If the lock is uncontended, clear the flag - use cmpxchg in
+         * case it changes behind our back though.
+         */
+        if (new.tickets.head != new.tickets.tail ||
+            cmpxchg(&lock->head_tail, old.head_tail,
+                                        new.head_tail) != old.head_tail) {
+                /*
+                 * Lock still has someone queued for it, so wake up an
+                 * appropriate waiter.
+                 */
+                __ticket_unlock_kick(lock, old.tickets.head);
+        }
 }
 
-static inline int __ticket_spin_is_locked(arch_spinlock_t *lock)
+static __always_inline void arch_spin_unlock(arch_spinlock_t *lock)
 {
-        struct __raw_tickets tmp = ACCESS_ONCE(lock->tickets);
+        if (TICKET_SLOWPATH_FLAG &&
+            static_key_false(&paravirt_ticketlocks_enabled)) {
+                arch_spinlock_t prev;
 
-        return tmp.tail != tmp.head;
-}
+                prev = *lock;
+                add_smp(&lock->tickets.head, TICKET_LOCK_INC);
 
-static inline int __ticket_spin_is_contended(arch_spinlock_t *lock)
-{
-        struct __raw_tickets tmp = ACCESS_ONCE(lock->tickets);
+                /* add_smp() is a full mb() */
 
-        return (__ticket_t)(tmp.tail - tmp.head) > 1;
+                if (unlikely(lock->tickets.tail & TICKET_SLOWPATH_FLAG))
+                        __ticket_unlock_slowpath(lock, prev);
+        } else
+                __add(&lock->tickets.head, TICKET_LOCK_INC, UNLOCK_LOCK_PREFIX);
 }
 
-#ifndef CONFIG_PARAVIRT_SPINLOCKS
-
 static inline int arch_spin_is_locked(arch_spinlock_t *lock)
 {
-        return __ticket_spin_is_locked(lock);
-}
-
-static inline int arch_spin_is_contended(arch_spinlock_t *lock)
-{
-        return __ticket_spin_is_contended(lock);
-}
-#define arch_spin_is_contended  arch_spin_is_contended
+        struct __raw_tickets tmp = ACCESS_ONCE(lock->tickets);
 
-static __always_inline void arch_spin_lock(arch_spinlock_t *lock)
-{
-        __ticket_spin_lock(lock);
+        return tmp.tail != tmp.head;
 }
 
-static __always_inline int arch_spin_trylock(arch_spinlock_t *lock)
+static inline int arch_spin_is_contended(arch_spinlock_t *lock)
 {
-        return __ticket_spin_trylock(lock);
-}
+        struct __raw_tickets tmp = ACCESS_ONCE(lock->tickets);
 
-static __always_inline void arch_spin_unlock(arch_spinlock_t *lock)
-{
-        __ticket_spin_unlock(lock);
+        return (__ticket_t)(tmp.tail - tmp.head) > TICKET_LOCK_INC;
 }
+#define arch_spin_is_contended  arch_spin_is_contended
 
 static __always_inline void arch_spin_lock_flags(arch_spinlock_t *lock,
                                                   unsigned long flags)
@@ -129,8 +182,6 @@ static __always_inline void arch_spin_lock_flags(arch_spinlock_t *lock,
         arch_spin_lock(lock);
 }
 
-#endif  /* CONFIG_PARAVIRT_SPINLOCKS */
-
 static inline void arch_spin_unlock_wait(arch_spinlock_t *lock)
 {
         while (arch_spin_is_locked(lock))
@@ -233,8 +284,4 @@ static inline void arch_write_unlock(arch_rwlock_t *rw)
 #define arch_read_relax(lock)   cpu_relax()
 #define arch_write_relax(lock)  cpu_relax()
 
-/* The {read|write|spin}_lock() on x86 are full memory barriers. */
-static inline void smp_mb__after_lock(void) { }
-#define ARCH_HAS_SMP_MB_AFTER_LOCK
-
 #endif /* _ASM_X86_SPINLOCK_H */
diff --git a/arch/x86/include/asm/spinlock_types.h b/arch/x86/include/asm/spinlock_types.h
index ad0ad07fc006..4f1bea19945b 100644
--- a/arch/x86/include/asm/spinlock_types.h
+++ b/arch/x86/include/asm/spinlock_types.h
@@ -1,13 +1,17 @@
 #ifndef _ASM_X86_SPINLOCK_TYPES_H
 #define _ASM_X86_SPINLOCK_TYPES_H
 
-#ifndef __LINUX_SPINLOCK_TYPES_H
-# error "please don't include this file directly"
-#endif
-
 #include <linux/types.h>
 
-#if (CONFIG_NR_CPUS < 256)
+#ifdef CONFIG_PARAVIRT_SPINLOCKS
+#define __TICKET_LOCK_INC       2
+#define TICKET_SLOWPATH_FLAG    ((__ticket_t)1)
+#else
+#define __TICKET_LOCK_INC       1
+#define TICKET_SLOWPATH_FLAG    ((__ticket_t)0)
+#endif
+
+#if (CONFIG_NR_CPUS < (256 / __TICKET_LOCK_INC))
 typedef u8  __ticket_t;
 typedef u16 __ticketpair_t;
 #else
@@ -15,6 +19,8 @@ typedef u16 __ticket_t;
 typedef u32 __ticketpair_t;
 #endif
 
+#define TICKET_LOCK_INC ((__ticket_t)__TICKET_LOCK_INC)
+
 #define TICKET_SHIFT    (sizeof(__ticket_t) * 8)
 
 typedef struct arch_spinlock {
diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
index 4ec45b3abba1..d7f3b3b78ac3 100644
--- a/arch/x86/include/asm/switch_to.h
+++ b/arch/x86/include/asm/switch_to.h
@@ -2,8 +2,8 @@
 #define _ASM_X86_SWITCH_TO_H
 
 struct task_struct; /* one of the stranger aspects of C forward declarations */
-struct task_struct *__switch_to(struct task_struct *prev,
-                                struct task_struct *next);
+__visible struct task_struct *__switch_to(struct task_struct *prev,
+                                           struct task_struct *next);
 struct tss_struct;
 void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
                       struct tss_struct *tss);
diff --git a/arch/x86/include/asm/sync_bitops.h b/arch/x86/include/asm/sync_bitops.h
index 9d09b4073b60..05af3b31d522 100644
--- a/arch/x86/include/asm/sync_bitops.h
+++ b/arch/x86/include/asm/sync_bitops.h
@@ -26,9 +26,9 @@
  * Note that @nr may be almost arbitrarily large; this function is not
  * restricted to acting on a single-word quantity.
  */
-static inline void sync_set_bit(int nr, volatile unsigned long *addr)
+static inline void sync_set_bit(long nr, volatile unsigned long *addr)
 {
-        asm volatile("lock; btsl %1,%0"
+        asm volatile("lock; bts %1,%0"
                      : "+m" (ADDR)
                      : "Ir" (nr)
                      : "memory");
@@ -44,9 +44,9 @@ static inline void sync_set_bit(int nr, volatile unsigned long *addr)
  * you should call smp_mb__before_clear_bit() and/or smp_mb__after_clear_bit()
  * in order to ensure changes are visible on other processors.
  */
-static inline void sync_clear_bit(int nr, volatile unsigned long *addr)
+static inline void sync_clear_bit(long nr, volatile unsigned long *addr)
 {
-        asm volatile("lock; btrl %1,%0"
+        asm volatile("lock; btr %1,%0"
                      : "+m" (ADDR)
                      : "Ir" (nr)
                      : "memory");
@@ -61,9 +61,9 @@ static inline void sync_clear_bit(int nr, volatile unsigned long *addr)
  * Note that @nr may be almost arbitrarily large; this function is not
  * restricted to acting on a single-word quantity.
  */
-static inline void sync_change_bit(int nr, volatile unsigned long *addr)
+static inline void sync_change_bit(long nr, volatile unsigned long *addr)
 {
-        asm volatile("lock; btcl %1,%0"
+        asm volatile("lock; btc %1,%0"
                      : "+m" (ADDR)
                      : "Ir" (nr)
                      : "memory");
@@ -77,11 +77,11 @@ static inline void sync_change_bit(int nr, volatile unsigned long *addr)
  * This operation is atomic and cannot be reordered.
  * It also implies a memory barrier.
  */
-static inline int sync_test_and_set_bit(int nr, volatile unsigned long *addr)
+static inline int sync_test_and_set_bit(long nr, volatile unsigned long *addr)
 {
         int oldbit;
 
-        asm volatile("lock; btsl %2,%1\n\tsbbl %0,%0"
+        asm volatile("lock; bts %2,%1\n\tsbbl %0,%0"
                      : "=r" (oldbit), "+m" (ADDR)
                      : "Ir" (nr) : "memory");
         return oldbit;
@@ -95,11 +95,11 @@ static inline int sync_test_and_set_bit(int nr, volatile unsigned long *addr)
  * This operation is atomic and cannot be reordered.
  * It also implies a memory barrier.
  */
-static inline int sync_test_and_clear_bit(int nr, volatile unsigned long *addr)
+static inline int sync_test_and_clear_bit(long nr, volatile unsigned long *addr)
 {
         int oldbit;
 
-        asm volatile("lock; btrl %2,%1\n\tsbbl %0,%0"
+        asm volatile("lock; btr %2,%1\n\tsbbl %0,%0"
                      : "=r" (oldbit), "+m" (ADDR)
                      : "Ir" (nr) : "memory");
         return oldbit;
@@ -113,11 +113,11 @@ static inline int sync_test_and_clear_bit(int nr, volatile unsigned long *addr)
  * This operation is atomic and cannot be reordered.
  * It also implies a memory barrier.
  */
-static inline int sync_test_and_change_bit(int nr, volatile unsigned long *addr)
+static inline int sync_test_and_change_bit(long nr, volatile unsigned long *addr)
 {
         int oldbit;
 
-        asm volatile("lock; btcl %2,%1\n\tsbbl %0,%0"
+        asm volatile("lock; btc %2,%1\n\tsbbl %0,%0"
                      : "=r" (oldbit), "+m" (ADDR)
                      : "Ir" (nr) : "memory");
         return oldbit;
diff --git a/arch/x86/include/asm/syscall.h b/arch/x86/include/asm/syscall.h
index 2e188d68397c..aea284b41312 100644
--- a/arch/x86/include/asm/syscall.h
+++ b/arch/x86/include/asm/syscall.h
@@ -20,7 +20,8 @@
 #include <asm/thread_info.h>    /* for TS_COMPAT */
 #include <asm/unistd.h>
 
-extern const unsigned long sys_call_table[];
+typedef void (*sys_call_ptr_t)(void);
+extern const sys_call_ptr_t sys_call_table[];
 
 /*
  * Only the low 32 bits of orig_ax are meaningful, so we return int.
diff --git a/arch/x86/include/asm/syscalls.h b/arch/x86/include/asm/syscalls.h
index 2917a6452c49..592a6a672e07 100644
--- a/arch/x86/include/asm/syscalls.h
+++ b/arch/x86/include/asm/syscalls.h
@@ -24,7 +24,7 @@ asmlinkage long sys_iopl(unsigned int);
 asmlinkage int sys_modify_ldt(int, void __user *, unsigned long);
 
 /* kernel/signal.c */
-long sys_rt_sigreturn(void);
+asmlinkage long sys_rt_sigreturn(void);
 
 /* kernel/tls.c */
 asmlinkage long sys_set_thread_area(struct user_desc __user *);
@@ -34,7 +34,7 @@ asmlinkage long sys_get_thread_area(struct user_desc __user *);
 #ifdef CONFIG_X86_32
 
 /* kernel/signal.c */
-unsigned long sys_sigreturn(void);
+asmlinkage unsigned long sys_sigreturn(void);
 
 /* kernel/vm86_32.c */
 asmlinkage long sys_vm86old(struct vm86_struct __user *);
@@ -44,7 +44,7 @@ asmlinkage long sys_vm86(unsigned long, unsigned long);
 
 /* X86_64 only */
 /* kernel/process_64.c */
-long sys_arch_prctl(int, unsigned long);
+asmlinkage long sys_arch_prctl(int, unsigned long);
 
 /* kernel/sys_x86_64.c */
 asmlinkage long sys_mmap(unsigned long, unsigned long, unsigned long,
diff --git a/arch/x86/include/asm/sysfb.h b/arch/x86/include/asm/sysfb.h
new file mode 100644
index 000000000000..2aeb3e25579c
--- /dev/null
+++ b/arch/x86/include/asm/sysfb.h
@@ -0,0 +1,98 @@
+#ifndef _ARCH_X86_KERNEL_SYSFB_H
+#define _ARCH_X86_KERNEL_SYSFB_H
+
+/*
+ * Generic System Framebuffers on x86
+ * Copyright (c) 2012-2013 David Herrmann <dh.herrmann@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+
+#include <linux/kernel.h>
+#include <linux/platform_data/simplefb.h>
+#include <linux/screen_info.h>
+
+enum {
+        M_I17,          /* 17-Inch iMac */
+        M_I20,          /* 20-Inch iMac */
+        M_I20_SR,       /* 20-Inch iMac (Santa Rosa) */
+        M_I24,          /* 24-Inch iMac */
+        M_I24_8_1,      /* 24-Inch iMac, 8,1th gen */
+        M_I24_10_1,     /* 24-Inch iMac, 10,1th gen */
+        M_I27_11_1,     /* 27-Inch iMac, 11,1th gen */
+        M_MINI,         /* Mac Mini */
+        M_MINI_3_1,     /* Mac Mini, 3,1th gen */
+        M_MINI_4_1,     /* Mac Mini, 4,1th gen */
+        M_MB,           /* MacBook */
+        M_MB_2,         /* MacBook, 2nd rev. */
+        M_MB_3,         /* MacBook, 3rd rev. */
+        M_MB_5_1,       /* MacBook, 5th rev. */
+        M_MB_6_1,       /* MacBook, 6th rev. */
+        M_MB_7_1,       /* MacBook, 7th rev. */
+        M_MB_SR,        /* MacBook, 2nd gen, (Santa Rosa) */
+        M_MBA,          /* MacBook Air */
+        M_MBA_3,        /* Macbook Air, 3rd rev */
+        M_MBP,          /* MacBook Pro */
+        M_MBP_2,        /* MacBook Pro 2nd gen */
+        M_MBP_2_2,      /* MacBook Pro 2,2nd gen */
+        M_MBP_SR,       /* MacBook Pro (Santa Rosa) */
+        M_MBP_4,        /* MacBook Pro, 4th gen */
+        M_MBP_5_1,      /* MacBook Pro, 5,1th gen */
+        M_MBP_5_2,      /* MacBook Pro, 5,2th gen */
+        M_MBP_5_3,      /* MacBook Pro, 5,3rd gen */
+        M_MBP_6_1,      /* MacBook Pro, 6,1th gen */
+        M_MBP_6_2,      /* MacBook Pro, 6,2th gen */
+        M_MBP_7_1,      /* MacBook Pro, 7,1th gen */
+        M_MBP_8_2,      /* MacBook Pro, 8,2nd gen */
+        M_UNKNOWN       /* placeholder */
+};
+
+struct efifb_dmi_info {
+        char *optname;
+        unsigned long base;
+        int stride;
+        int width;
+        int height;
+        int flags;
+};
+
+#ifdef CONFIG_EFI
+
+extern struct efifb_dmi_info efifb_dmi_list[];
+void sysfb_apply_efi_quirks(void);
+
+#else /* CONFIG_EFI */
+
+static inline void sysfb_apply_efi_quirks(void)
+{
+}
+
+#endif /* CONFIG_EFI */
+
+#ifdef CONFIG_X86_SYSFB
+
+bool parse_mode(const struct screen_info *si,
+                struct simplefb_platform_data *mode);
+int create_simplefb(const struct screen_info *si,
+                    const struct simplefb_platform_data *mode);
+
+#else /* CONFIG_X86_SYSFB */
+
+static inline bool parse_mode(const struct screen_info *si,
+                              struct simplefb_platform_data *mode)
+{
+        return false;
+}
+
+static inline int create_simplefb(const struct screen_info *si,
+                                  const struct simplefb_platform_data *mode)
+{
+        return -EINVAL;
+}
+
+#endif /* CONFIG_X86_SYSFB */
+
+#endif /* _ARCH_X86_KERNEL_SYSFB_H */
diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h
index 095b21507b6a..d35f24e231cd 100644
--- a/arch/x86/include/asm/topology.h
+++ b/arch/x86/include/asm/topology.h
@@ -124,9 +124,6 @@ extern const struct cpumask *cpu_coregroup_mask(int cpu);
 #define topology_core_id(cpu)                   (cpu_data(cpu).cpu_core_id)
 #define topology_core_cpumask(cpu)              (per_cpu(cpu_core_map, cpu))
 #define topology_thread_cpumask(cpu)            (per_cpu(cpu_sibling_map, cpu))
-
-/* indicates that pointers to the topology cpumask_t maps are valid */
-#define arch_provides_topology_pointers         yes
 #endif
 
 static inline void arch_fix_phys_package_id(int num, u32 slot)
diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
index 88eae2aec619..7036cb60cd87 100644
--- a/arch/x86/include/asm/traps.h
+++ b/arch/x86/include/asm/traps.h
@@ -6,11 +6,7 @@
 #include <asm/debugreg.h>
 #include <asm/siginfo.h>                        /* TRAP_TRACE, ... */
 
-#ifdef CONFIG_X86_32
-#define dotraplinkage
-#else
-#define dotraplinkage asmlinkage
-#endif
+#define dotraplinkage __visible
 
 asmlinkage void divide_error(void);
 asmlinkage void debug(void);
diff --git a/arch/x86/include/asm/tsc.h b/arch/x86/include/asm/tsc.h
index c91e8b9d588b..235be70d5bb4 100644
--- a/arch/x86/include/asm/tsc.h
+++ b/arch/x86/include/asm/tsc.h
@@ -49,6 +49,7 @@ extern void tsc_init(void);
 extern void mark_tsc_unstable(char *reason);
 extern int unsynchronized_tsc(void);
 extern int check_tsc_unstable(void);
+extern int check_tsc_disabled(void);
 extern unsigned long native_calibrate_tsc(void);
 
 extern int tsc_clocksource_reliable;
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 5ee26875baea..5838fa911aa0 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -153,16 +153,19 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
  * Careful: we have to cast the result to the type of the pointer
  * for sign reasons.
  *
- * The use of %edx as the register specifier is a bit of a
+ * The use of _ASM_DX as the register specifier is a bit of a
  * simplification, as gcc only cares about it as the starting point
  * and not size: for a 64-bit value it will use %ecx:%edx on 32 bits
  * (%ecx being the next register in gcc's x86 register sequence), and
  * %rdx on 64 bits.
+ *
+ * Clang/LLVM cares about the size of the register, but still wants
+ * the base register for something that ends up being a pair.
  */
 #define get_user(x, ptr)                                                \
 ({                                                                      \
         int __ret_gu;                                                   \
-        register __inttype(*(ptr)) __val_gu asm("%edx");                \
+        register __inttype(*(ptr)) __val_gu asm("%"_ASM_DX);            \
         __chk_user_ptr(ptr);                                            \
         might_fault();                                                  \
         asm volatile("call __get_user_%P3"                              \
diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h
index f3e01a2cbaa1..966502d4682e 100644
--- a/arch/x86/include/asm/vmx.h
+++ b/arch/x86/include/asm/vmx.h
@@ -387,6 +387,7 @@ enum vmcs_field {
 #define VMX_EPT_EXTENT_INDIVIDUAL_ADDR          0
 #define VMX_EPT_EXTENT_CONTEXT                  1
 #define VMX_EPT_EXTENT_GLOBAL                   2
+#define VMX_EPT_EXTENT_SHIFT                    24
 
 #define VMX_EPT_EXECUTE_ONLY_BIT                (1ull)
 #define VMX_EPT_PAGE_WALK_4_BIT                 (1ull << 6)
@@ -394,6 +395,7 @@ enum vmcs_field {
 #define VMX_EPTP_WB_BIT                         (1ull << 14)
 #define VMX_EPT_2MB_PAGE_BIT                    (1ull << 16)
 #define VMX_EPT_1GB_PAGE_BIT                    (1ull << 17)
+#define VMX_EPT_INVEPT_BIT                      (1ull << 20)
 #define VMX_EPT_AD_BIT                              (1ull << 21)
 #define VMX_EPT_EXTENT_CONTEXT_BIT              (1ull << 25)
 #define VMX_EPT_EXTENT_GLOBAL_BIT               (1ull << 26)
diff --git a/arch/x86/include/asm/vvar.h b/arch/x86/include/asm/vvar.h
index de656ac2af41..d76ac40da206 100644
--- a/arch/x86/include/asm/vvar.h
+++ b/arch/x86/include/asm/vvar.h
@@ -35,7 +35,7 @@
 
 #define DEFINE_VVAR(type, name)                                         \
         type name                                                       \
-        __attribute__((section(".vvar_" #name), aligned(16)))
+        __attribute__((section(".vvar_" #name), aligned(16))) __visible
 
 #define VVAR(name) (*vvaraddr_ ## name)
 
diff --git a/arch/x86/include/asm/xen/events.h b/arch/x86/include/asm/xen/events.h
index ca842f2769ef..608a79d5a466 100644
--- a/arch/x86/include/asm/xen/events.h
+++ b/arch/x86/include/asm/xen/events.h
@@ -7,6 +7,7 @@ enum ipi_vector {
         XEN_CALL_FUNCTION_SINGLE_VECTOR,
         XEN_SPIN_UNLOCK_VECTOR,
         XEN_IRQ_WORK_VECTOR,
+        XEN_NMI_VECTOR,
 
         XEN_NR_IPIS,
 };
diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h
index 125f344f06a9..d866959e5685 100644
--- a/arch/x86/include/asm/xen/hypervisor.h
+++ b/arch/x86/include/asm/xen/hypervisor.h
@@ -40,21 +40,7 @@ extern struct start_info *xen_start_info;
 
 static inline uint32_t xen_cpuid_base(void)
 {
-        uint32_t base, eax, ebx, ecx, edx;
-        char signature[13];
-
-        for (base = 0x40000000; base < 0x40010000; base += 0x100) {
-                cpuid(base, &eax, &ebx, &ecx, &edx);
-                *(uint32_t *)(signature + 0) = ebx;
-                *(uint32_t *)(signature + 4) = ecx;
-                *(uint32_t *)(signature + 8) = edx;
-                signature[12] = 0;
-
-                if (!strcmp("XenVMMXenVMM", signature) && ((eax - base) >= 2))
-                        return base;
-        }
-
-        return 0;
+        return hypervisor_cpuid_base("XenVMMXenVMM", 2);
 }
 
 #ifdef CONFIG_XEN
diff --git a/arch/x86/include/uapi/asm/kvm_para.h b/arch/x86/include/uapi/asm/kvm_para.h
index 06fdbd987e97..94dc8ca434e0 100644
--- a/arch/x86/include/uapi/asm/kvm_para.h
+++ b/arch/x86/include/uapi/asm/kvm_para.h
@@ -23,6 +23,7 @@
 #define KVM_FEATURE_ASYNC_PF            4
 #define KVM_FEATURE_STEAL_TIME          5
 #define KVM_FEATURE_PV_EOI              6
+#define KVM_FEATURE_PV_UNHALT           7
 
 /* The last 8 bits are used to indicate how to interpret the flags field
  * in pvclock structure. If no bits are set, all flags are ignored.
diff --git a/arch/x86/include/uapi/asm/vmx.h b/arch/x86/include/uapi/asm/vmx.h
index d651082c7cf7..0e79420376eb 100644
--- a/arch/x86/include/uapi/asm/vmx.h
+++ b/arch/x86/include/uapi/asm/vmx.h
@@ -65,6 +65,7 @@
 #define EXIT_REASON_EOI_INDUCED         45
 #define EXIT_REASON_EPT_VIOLATION       48
 #define EXIT_REASON_EPT_MISCONFIG       49
+#define EXIT_REASON_INVEPT              50
 #define EXIT_REASON_PREEMPTION_TIMER    52
 #define EXIT_REASON_WBINVD              54
 #define EXIT_REASON_XSETBV              55
@@ -106,12 +107,13 @@
         { EXIT_REASON_APIC_ACCESS,           "APIC_ACCESS" }, \
         { EXIT_REASON_EPT_VIOLATION,         "EPT_VIOLATION" }, \
         { EXIT_REASON_EPT_MISCONFIG,         "EPT_MISCONFIG" }, \
+        { EXIT_REASON_INVEPT,                "INVEPT" }, \
+        { EXIT_REASON_PREEMPTION_TIMER,      "PREEMPTION_TIMER" }, \
         { EXIT_REASON_WBINVD,                "WBINVD" }, \
         { EXIT_REASON_APIC_WRITE,            "APIC_WRITE" }, \
         { EXIT_REASON_EOI_INDUCED,           "EOI_INDUCED" }, \
         { EXIT_REASON_INVALID_STATE,         "INVALID_STATE" }, \
         { EXIT_REASON_INVD,                  "INVD" }, \
-        { EXIT_REASON_INVPCID,               "INVPCID" }, \
-        { EXIT_REASON_PREEMPTION_TIMER,      "PREEMPTION_TIMER" }
+        { EXIT_REASON_INVPCID,               "INVPCID" }
 
 #endif /* _UAPIVMX_H */
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index 88d99ea77723..a5408b965c9d 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -103,6 +103,9 @@ obj-$(CONFIG_X86_CHECK_BIOS_CORRUPTION) += check.o
 obj-$(CONFIG_SWIOTLB)                   += pci-swiotlb.o
 obj-$(CONFIG_OF)                        += devicetree.o
 obj-$(CONFIG_UPROBES)                   += uprobes.o
+obj-y                                   += sysfb.o
+obj-$(CONFIG_X86_SYSFB)                 += sysfb_simplefb.o
+obj-$(CONFIG_EFI)                       += sysfb_efi.o
 
 obj-$(CONFIG_PERF_EVENTS)               += perf_regs.o
 obj-$(CONFIG_TRACING)                   += tracepoint.o
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 2627a81253ee..40c76604199f 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -67,6 +67,7 @@ EXPORT_SYMBOL(acpi_pci_disabled);
 int acpi_lapic;
 int acpi_ioapic;
 int acpi_strict;
+int acpi_disable_cmcff;
 
 u8 acpi_sci_flags __initdata;
 int acpi_sci_override_gsi __initdata;
@@ -141,16 +142,8 @@ static u32 irq_to_gsi(int irq)
 }
 
 /*
- * Temporarily use the virtual area starting from FIX_IO_APIC_BASE_END,
- * to map the target physical address. The problem is that set_fixmap()
- * provides a single page, and it is possible that the page is not
- * sufficient.
- * By using this area, we can map up to MAX_IO_APICS pages temporarily,
- * i.e. until the next __va_range() call.
- *
- * Important Safety Note:  The fixed I/O APIC page numbers are *subtracted*
- * from the fixed base.  That's why we start at FIX_IO_APIC_BASE_END and
- * count idx down while incrementing the phys address.
+ * This is just a simple wrapper around early_ioremap(),
+ * with sanity checks for phys == 0 and size == 0.
  */
 char *__init __acpi_map_table(unsigned long phys, unsigned long size)
 {
@@ -160,6 +153,7 @@ char *__init __acpi_map_table(unsigned long phys, unsigned long size)
 
         return early_ioremap(phys, size);
 }
+
 void __init __acpi_unmap_table(char *map, unsigned long size)
 {
         if (!map || !size)
@@ -199,7 +193,7 @@ static void acpi_register_lapic(int id, u8 enabled)
 {
         unsigned int ver = 0;
 
-        if (id >= (MAX_LOCAL_APIC-1)) {
+        if (id >= MAX_LOCAL_APIC) {
                 printk(KERN_INFO PREFIX "skipped apicid that is too big\n");
                 return;
         }
@@ -1120,6 +1114,7 @@ int mp_register_gsi(struct device *dev, u32 gsi, int trigger, int polarity)
         int ioapic;
         int ioapic_pin;
         struct io_apic_irq_attr irq_attr;
+        int ret;
 
         if (acpi_irq_model != ACPI_IRQ_MODEL_IOAPIC)
                 return gsi;
@@ -1149,7 +1144,9 @@ int mp_register_gsi(struct device *dev, u32 gsi, int trigger, int polarity)
         set_io_apic_irq_attr(&irq_attr, ioapic, ioapic_pin,
                              trigger == ACPI_EDGE_SENSITIVE ? 0 : 1,
                              polarity == ACPI_ACTIVE_HIGH ? 0 : 1);
-        io_apic_set_pci_routing(dev, gsi_to_irq(gsi), &irq_attr);
+        ret = io_apic_set_pci_routing(dev, gsi_to_irq(gsi), &irq_attr);
+        if (ret < 0)
+                gsi = INT_MIN;
 
         return gsi;
 }
@@ -1626,6 +1623,10 @@ static int __init parse_acpi(char *arg)
         /* "acpi=copy_dsdt" copys DSDT */
         else if (strcmp(arg, "copy_dsdt") == 0) {
                 acpi_gbl_copy_dsdt_locally = 1;
+        }
+        /* "acpi=nocmcff" disables FF mode for corrected errors */
+        else if (strcmp(arg, "nocmcff") == 0) {
+                acpi_disable_cmcff = 1;
         } else {
                 /* Core will printk when we return error. */
                 return -EINVAL;
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index c15cf9a25e27..15e8563e5c24 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -11,6 +11,7 @@
 #include <linux/memory.h>
 #include <linux/stop_machine.h>
 #include <linux/slab.h>
+#include <linux/kdebug.h>
 #include <asm/alternative.h>
 #include <asm/sections.h>
 #include <asm/pgtable.h>
@@ -596,97 +597,93 @@ void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
         return addr;
 }
 
-/*
- * Cross-modifying kernel text with stop_machine().
- * This code originally comes from immediate value.
- */
-static atomic_t stop_machine_first;
-static int wrote_text;
+static void do_sync_core(void *info)
+{
+        sync_core();
+}
 
-struct text_poke_params {
-        struct text_poke_param *params;
-        int nparams;
-};
+static bool bp_patching_in_progress;
+static void *bp_int3_handler, *bp_int3_addr;
 
-static int __kprobes stop_machine_text_poke(void *data)
+int poke_int3_handler(struct pt_regs *regs)
 {
-        struct text_poke_params *tpp = data;
-        struct text_poke_param *p;
-        int i;
+        /* bp_patching_in_progress */
+        smp_rmb();
 
-        if (atomic_xchg(&stop_machine_first, 0)) {
-                for (i = 0; i < tpp->nparams; i++) {
-                        p = &tpp->params[i];
-                        text_poke(p->addr, p->opcode, p->len);
-                }
-                smp_wmb();      /* Make sure other cpus see that this has run */
-                wrote_text = 1;
-        } else {
-                while (!wrote_text)
-                        cpu_relax();
-                smp_mb();       /* Load wrote_text before following execution */
-        }
+        if (likely(!bp_patching_in_progress))
+                return 0;
 
-        for (i = 0; i < tpp->nparams; i++) {
-                p = &tpp->params[i];
-                flush_icache_range((unsigned long)p->addr,
-                                   (unsigned long)p->addr + p->len);
-        }
-        /*
-         * Intel Archiecture Software Developer's Manual section 7.1.3 specifies
-         * that a core serializing instruction such as "cpuid" should be
-         * executed on _each_ core before the new instruction is made visible.
-         */
-        sync_core();
-        return 0;
-}
+        if (user_mode_vm(regs) || regs->ip != (unsigned long)bp_int3_addr)
+                return 0;
+
+        /* set up the specified breakpoint handler */
+        regs->ip = (unsigned long) bp_int3_handler;
+
+        return 1;
 
-/**
- * text_poke_smp - Update instructions on a live kernel on SMP
- * @addr: address to modify
- * @opcode: source of the copy
- * @len: length to copy
- *
- * Modify multi-byte instruction by using stop_machine() on SMP. This allows
- * user to poke/set multi-byte text on SMP. Only non-NMI/MCE code modifying
- * should be allowed, since stop_machine() does _not_ protect code against
- * NMI and MCE.
- *
- * Note: Must be called under get_online_cpus() and text_mutex.
- */
-void *__kprobes text_poke_smp(void *addr, const void *opcode, size_t len)
-{
-        struct text_poke_params tpp;
-        struct text_poke_param p;
-
-        p.addr = addr;
-        p.opcode = opcode;
-        p.len = len;
-        tpp.params = &p;
-        tpp.nparams = 1;
-        atomic_set(&stop_machine_first, 1);
-        wrote_text = 0;
-        /* Use __stop_machine() because the caller already got online_cpus. */
-        __stop_machine(stop_machine_text_poke, (void *)&tpp, cpu_online_mask);
-        return addr;
 }
 
 /**
- * text_poke_smp_batch - Update instructions on a live kernel on SMP
- * @params: an array of text_poke parameters
- * @n: the number of elements in params.
+ * text_poke_bp() -- update instructions on live kernel on SMP
+ * @addr:       address to patch
+ * @opcode:     opcode of new instruction
+ * @len:        length to copy
+ * @handler:    address to jump to when the temporary breakpoint is hit
  *
- * Modify multi-byte instruction by using stop_machine() on SMP. Since the
- * stop_machine() is heavy task, it is better to aggregate text_poke requests
- * and do it once if possible.
+ * Modify multi-byte instruction by using int3 breakpoint on SMP.
+ * We completely avoid stop_machine() here, and achieve the
+ * synchronization using int3 breakpoint.
  *
- * Note: Must be called under get_online_cpus() and text_mutex.
+ * The way it is done:
+ *      - add a int3 trap to the address that will be patched
+ *      - sync cores
+ *      - update all but the first byte of the patched range
+ *      - sync cores
+ *      - replace the first byte (int3) by the first byte of
+ *        replacing opcode
+ *      - sync cores
+ *
+ * Note: must be called under text_mutex.
  */
-void __kprobes text_poke_smp_batch(struct text_poke_param *params, int n)
+void *text_poke_bp(void *addr, const void *opcode, size_t len, void *handler)
 {
-        struct text_poke_params tpp = {.params = params, .nparams = n};
+        unsigned char int3 = 0xcc;
+
+        bp_int3_handler = handler;
+        bp_int3_addr = (u8 *)addr + sizeof(int3);
+        bp_patching_in_progress = true;
+        /*
+         * Corresponding read barrier in int3 notifier for
+         * making sure the in_progress flags is correctly ordered wrt.
+         * patching
+         */
+        smp_wmb();
+
+        text_poke(addr, &int3, sizeof(int3));
 
-        atomic_set(&stop_machine_first, 1);
-        wrote_text = 0;
-        __stop_machine(stop_machine_text_poke, (void *)&tpp, cpu_online_mask);
+        on_each_cpu(do_sync_core, NULL, 1);
+
+        if (len - sizeof(int3) > 0) {
+                /* patch all but the first byte */
+                text_poke((char *)addr + sizeof(int3),
+                          (const char *) opcode + sizeof(int3),
+                          len - sizeof(int3));
+                /*
+                 * According to Intel, this core syncing is very likely
+                 * not necessary and we'd be safe even without it. But
+                 * better safe than sorry (plus there's not only Intel).
+                 */
+                on_each_cpu(do_sync_core, NULL, 1);
+        }
+
+        /* patch the first byte */
+        text_poke(addr, opcode, sizeof(int3));
+
+        on_each_cpu(do_sync_core, NULL, 1);
+
+        bp_patching_in_progress = false;
+        smp_wmb();
+
+        return addr;
 }
+
diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
index 3048ded1b598..59554dca96ec 100644
--- a/arch/x86/kernel/amd_nb.c
+++ b/arch/x86/kernel/amd_nb.c
@@ -20,6 +20,7 @@ const struct pci_device_id amd_nb_misc_ids[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_10H_NB_MISC) },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
+        { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
         {}
 };
@@ -27,6 +28,7 @@ EXPORT_SYMBOL(amd_nb_misc_ids);
 
 static const struct pci_device_id amd_nb_link_ids[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
+        { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F4) },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
         {}
 };
@@ -81,13 +83,20 @@ int amd_cache_northbridges(void)
                         next_northbridge(misc, amd_nb_misc_ids);
                 node_to_amd_nb(i)->link = link =
                         next_northbridge(link, amd_nb_link_ids);
-        }
+        }
 
+        /* GART present only on Fam15h upto model 0fh */
         if (boot_cpu_data.x86 == 0xf || boot_cpu_data.x86 == 0x10 ||
-            boot_cpu_data.x86 == 0x15)
+            (boot_cpu_data.x86 == 0x15 && boot_cpu_data.x86_model < 0x10))
                 amd_northbridges.flags |= AMD_NB_GART;
 
         /*
+         * Check for L3 cache presence.
+         */
+        if (!cpuid_edx(0x80000006))
+                return 0;
+
+        /*
          * Some CPU families support L3 Cache Index Disable. There are some
          * limitations because of E382 and E388 on family 0x10.
          */
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index eca89c53a7f5..a7eb82d9b012 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -913,7 +913,7 @@ static void local_apic_timer_interrupt(void)
  * [ if a single-CPU system runs an SMP kernel then we call the local
  *   interrupt as well. Thus we cannot inline the local irq ... ]
  */
-void __irq_entry smp_apic_timer_interrupt(struct pt_regs *regs)
+__visible void __irq_entry smp_apic_timer_interrupt(struct pt_regs *regs)
 {
         struct pt_regs *old_regs = set_irq_regs(regs);
 
@@ -932,7 +932,7 @@ void __irq_entry smp_apic_timer_interrupt(struct pt_regs *regs)
         set_irq_regs(old_regs);
 }
 
-void __irq_entry smp_trace_apic_timer_interrupt(struct pt_regs *regs)
+__visible void __irq_entry smp_trace_apic_timer_interrupt(struct pt_regs *regs)
 {
         struct pt_regs *old_regs = set_irq_regs(regs);
 
@@ -1946,14 +1946,14 @@ static inline void __smp_spurious_interrupt(void)
                 "should never happen.\n", smp_processor_id());
 }
 
-void smp_spurious_interrupt(struct pt_regs *regs)
+__visible void smp_spurious_interrupt(struct pt_regs *regs)
 {
         entering_irq();
         __smp_spurious_interrupt();
         exiting_irq();
 }
 
-void smp_trace_spurious_interrupt(struct pt_regs *regs)
+__visible void smp_trace_spurious_interrupt(struct pt_regs *regs)
 {
         entering_irq();
         trace_spurious_apic_entry(SPURIOUS_APIC_VECTOR);
@@ -2002,14 +2002,14 @@ static inline void __smp_error_interrupt(struct pt_regs *regs)
 
 }
 
-void smp_error_interrupt(struct pt_regs *regs)
+__visible void smp_error_interrupt(struct pt_regs *regs)
 {
         entering_irq();
         __smp_error_interrupt(regs);
         exiting_irq();
 }
 
-void smp_trace_error_interrupt(struct pt_regs *regs)
+__visible void smp_trace_error_interrupt(struct pt_regs *regs)
 {
         entering_irq();
         trace_error_apic_entry(ERROR_APIC_VECTOR);
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 9ed796ccc32c..e63a5bd2a78f 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1534,6 +1534,11 @@ void intel_ir_io_apic_print_entries(unsigned int apic,
         }
 }
 
+void ioapic_zap_locks(void)
+{
+        raw_spin_lock_init(&ioapic_lock);
+}
+
 __apicdebuginit(void) print_IO_APIC(int ioapic_idx)
 {
         union IO_APIC_reg_00 reg_00;
@@ -3375,12 +3380,15 @@ int io_apic_setup_irq_pin_once(unsigned int irq, int node,
 {
         unsigned int ioapic_idx = attr->ioapic, pin = attr->ioapic_pin;
         int ret;
+        struct IO_APIC_route_entry orig_entry;
 
         /* Avoid redundant programming */
         if (test_bit(pin, ioapics[ioapic_idx].pin_programmed)) {
-                pr_debug("Pin %d-%d already programmed\n",
-                         mpc_ioapic_id(ioapic_idx), pin);
-                return 0;
+                pr_debug("Pin %d-%d already programmed\n", mpc_ioapic_id(ioapic_idx), pin);
+                orig_entry = ioapic_read_entry(attr->ioapic, pin);
+                if (attr->trigger == orig_entry.trigger && attr->polarity == orig_entry.polarity)
+                        return 0;
+                return -EBUSY;
         }
         ret = io_apic_setup_irq_pin(irq, node, attr);
         if (!ret)
diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
index 53a4e2744846..3ab03430211d 100644
--- a/arch/x86/kernel/apm_32.c
+++ b/arch/x86/kernel/apm_32.c
@@ -392,7 +392,7 @@ static struct cpuidle_device apm_cpuidle_device;
 /*
  * Local variables
  */
-static struct {
+__visible struct {
         unsigned long   offset;
         unsigned short  segment;
 } apm_bios_entry;
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index f654ecefea5b..903a264af981 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -66,8 +66,8 @@ static inline int wrmsrl_amd_safe(unsigned msr, unsigned long long val)
  *      performance at the same time..
  */
 
-extern void vide(void);
-__asm__(".align 4\nvide: ret");
+extern __visible void vide(void);
+__asm__(".globl vide\n\t.align 4\nvide: ret");
 
 static void init_amd_k5(struct cpuinfo_x86 *c)
 {
@@ -512,7 +512,7 @@ static void early_init_amd(struct cpuinfo_x86 *c)
 
 static const int amd_erratum_383[];
 static const int amd_erratum_400[];
-static bool cpu_has_amd_erratum(const int *erratum);
+static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum);
 
 static void init_amd(struct cpuinfo_x86 *c)
 {
@@ -729,11 +729,11 @@ static void init_amd(struct cpuinfo_x86 *c)
                 value &= ~(1ULL << 24);
                 wrmsrl_safe(MSR_AMD64_BU_CFG2, value);
 
-                if (cpu_has_amd_erratum(amd_erratum_383))
+                if (cpu_has_amd_erratum(c, amd_erratum_383))
                         set_cpu_bug(c, X86_BUG_AMD_TLB_MMATCH);
         }
 
-        if (cpu_has_amd_erratum(amd_erratum_400))
+        if (cpu_has_amd_erratum(c, amd_erratum_400))
                 set_cpu_bug(c, X86_BUG_AMD_APIC_C1E);
 
         rdmsr_safe(MSR_AMD64_PATCH_LEVEL, &c->microcode, &dummy);
@@ -878,23 +878,13 @@ static const int amd_erratum_400[] =
 static const int amd_erratum_383[] =
         AMD_OSVW_ERRATUM(3, AMD_MODEL_RANGE(0x10, 0, 0, 0xff, 0xf));
 
-static bool cpu_has_amd_erratum(const int *erratum)
+
+static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum)
 {
-        struct cpuinfo_x86 *cpu = __this_cpu_ptr(&cpu_info);
         int osvw_id = *erratum++;
         u32 range;
         u32 ms;
 
-        /*
-         * If called early enough that current_cpu_data hasn't been initialized
-         * yet, fall back to boot_cpu_data.
-         */
-        if (cpu->x86 == 0)
-                cpu = &boot_cpu_data;
-
-        if (cpu->x86_vendor != X86_VENDOR_AMD)
-                return false;
-
         if (osvw_id >= 0 && osvw_id < 65536 &&
             cpu_has(cpu, X86_FEATURE_OSVW)) {
                 u64 osvw_len;
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 25eb2747b063..2793d1f095a2 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1076,7 +1076,7 @@ struct desc_ptr debug_idt_descr = { NR_VECTORS * 16 - 1,
                                     (unsigned long) debug_idt_table };
 
 DEFINE_PER_CPU_FIRST(union irq_stack_union,
-                     irq_stack_union) __aligned(PAGE_SIZE);
+                     irq_stack_union) __aligned(PAGE_SIZE) __visible;
 
 /*
  * The following four percpu variables are hot.  Align current_task to
@@ -1093,7 +1093,7 @@ EXPORT_PER_CPU_SYMBOL(kernel_stack);
 DEFINE_PER_CPU(char *, irq_stack_ptr) =
         init_per_cpu_var(irq_stack_union.irq_stack) + IRQ_STACK_SIZE - 64;
 
-DEFINE_PER_CPU(unsigned int, irq_count) = -1;
+DEFINE_PER_CPU(unsigned int, irq_count) __visible = -1;
 
 DEFINE_PER_CPU(struct task_struct *, fpu_owner_task);
 
diff --git a/arch/x86/kernel/cpu/hypervisor.c b/arch/x86/kernel/cpu/hypervisor.c
index 87279212d318..36ce402a3fa5 100644
--- a/arch/x86/kernel/cpu/hypervisor.c
+++ b/arch/x86/kernel/cpu/hypervisor.c
@@ -25,11 +25,6 @@
 #include <asm/processor.h>
 #include <asm/hypervisor.h>
 
-/*
- * Hypervisor detect order.  This is specified explicitly here because
- * some hypervisors might implement compatibility modes for other
- * hypervisors and therefore need to be detected in specific sequence.
- */
 static const __initconst struct hypervisor_x86 * const hypervisors[] =
 {
 #ifdef CONFIG_XEN_PVHVM
@@ -49,15 +44,19 @@ static inline void __init
 detect_hypervisor_vendor(void)
 {
         const struct hypervisor_x86 *h, * const *p;
+        uint32_t pri, max_pri = 0;
 
         for (p = hypervisors; p < hypervisors + ARRAY_SIZE(hypervisors); p++) {
                 h = *p;
-                if (h->detect()) {
+                pri = h->detect();
+                if (pri != 0 && pri > max_pri) {
+                        max_pri = pri;
                         x86_hyper = h;
-                        printk(KERN_INFO "Hypervisor detected: %s\n", h->name);
-                        break;
                 }
         }
+
+        if (max_pri)
+                printk(KERN_INFO "Hypervisor detected: %s\n", x86_hyper->name);
 }
 
 void init_hypervisor(struct cpuinfo_x86 *c)
diff --git a/arch/x86/kernel/cpu/mcheck/mce-internal.h b/arch/x86/kernel/cpu/mcheck/mce-internal.h
index 5b7d4fa5d3b7..09edd0b65fef 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-internal.h
+++ b/arch/x86/kernel/cpu/mcheck/mce-internal.h
@@ -25,15 +25,18 @@ int mce_severity(struct mce *a, int tolerant, char **msg);
 struct dentry *mce_get_debugfs_dir(void);
 
 extern struct mce_bank *mce_banks;
+extern mce_banks_t mce_banks_ce_disabled;
 
 #ifdef CONFIG_X86_MCE_INTEL
 unsigned long mce_intel_adjust_timer(unsigned long interval);
 void mce_intel_cmci_poll(void);
 void mce_intel_hcpu_update(unsigned long cpu);
+void cmci_disable_bank(int bank);
 #else
 # define mce_intel_adjust_timer mce_adjust_timer_default
 static inline void mce_intel_cmci_poll(void) { }
 static inline void mce_intel_hcpu_update(unsigned long cpu) { }
+static inline void cmci_disable_bank(int bank) { }
 #endif
 
 void mce_timer_kick(unsigned long interval);
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 87a65c939bcd..b3218cdee95f 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -97,6 +97,15 @@ DEFINE_PER_CPU(mce_banks_t, mce_poll_banks) = {
         [0 ... BITS_TO_LONGS(MAX_NR_BANKS)-1] = ~0UL
 };
 
+/*
+ * MCA banks controlled through firmware first for corrected errors.
+ * This is a global list of banks for which we won't enable CMCI and we
+ * won't poll. Firmware controls these banks and is responsible for
+ * reporting corrected errors through GHES. Uncorrected/recoverable
+ * errors are still notified through a machine check.
+ */
+mce_banks_t mce_banks_ce_disabled;
+
 static DEFINE_PER_CPU(struct work_struct, mce_work);
 
 static void (*quirk_no_way_out)(int bank, struct mce *m, struct pt_regs *regs);
@@ -1935,6 +1944,25 @@ static struct miscdevice mce_chrdev_device = {
         &mce_chrdev_ops,
 };
 
+static void __mce_disable_bank(void *arg)
+{
+        int bank = *((int *)arg);
+        __clear_bit(bank, __get_cpu_var(mce_poll_banks));
+        cmci_disable_bank(bank);
+}
+
+void mce_disable_bank(int bank)
+{
+        if (bank >= mca_cfg.banks) {
+                pr_warn(FW_BUG
+                        "Ignoring request to disable invalid MCA bank %d.\n",
+                        bank);
+                return;
+        }
+        set_bit(bank, mce_banks_ce_disabled);
+        on_each_cpu(__mce_disable_bank, &bank, 1);
+}
+
 /*
  * mce=off Disables machine check
  * mce=no_cmci Disables CMCI
diff --git a/arch/x86/kernel/cpu/mcheck/mce_intel.c b/arch/x86/kernel/cpu/mcheck/mce_intel.c
index d56405309dc1..4cfe0458ca66 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_intel.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_intel.c
@@ -203,6 +203,10 @@ static void cmci_discover(int banks)
                 if (test_bit(i, owned))
                         continue;
 
+                /* Skip banks in firmware first mode */
+                if (test_bit(i, mce_banks_ce_disabled))
+                        continue;
+
                 rdmsrl(MSR_IA32_MCx_CTL2(i), val);
 
                 /* Already owned by someone else? */
@@ -271,6 +275,19 @@ void cmci_recheck(void)
         local_irq_restore(flags);
 }
 
+/* Caller must hold the lock on cmci_discover_lock */
+static void __cmci_disable_bank(int bank)
+{
+        u64 val;
+
+        if (!test_bit(bank, __get_cpu_var(mce_banks_owned)))
+                return;
+        rdmsrl(MSR_IA32_MCx_CTL2(bank), val);
+        val &= ~MCI_CTL2_CMCI_EN;
+        wrmsrl(MSR_IA32_MCx_CTL2(bank), val);
+        __clear_bit(bank, __get_cpu_var(mce_banks_owned));
+}
+
 /*
  * Disable CMCI on this CPU for all banks it owns when it goes down.
  * This allows other CPUs to claim the banks on rediscovery.
@@ -280,20 +297,12 @@ void cmci_clear(void)
         unsigned long flags;
         int i;
         int banks;
-        u64 val;
 
         if (!cmci_supported(&banks))
                 return;
         raw_spin_lock_irqsave(&cmci_discover_lock, flags);
-        for (i = 0; i < banks; i++) {
-                if (!test_bit(i, __get_cpu_var(mce_banks_owned)))
-                        continue;
-                /* Disable CMCI */
-                rdmsrl(MSR_IA32_MCx_CTL2(i), val);
-                val &= ~MCI_CTL2_CMCI_EN;
-                wrmsrl(MSR_IA32_MCx_CTL2(i), val);
-                __clear_bit(i, __get_cpu_var(mce_banks_owned));
-        }
+        for (i = 0; i < banks; i++)
+                __cmci_disable_bank(i);
         raw_spin_unlock_irqrestore(&cmci_discover_lock, flags);
 }
 
@@ -327,6 +336,19 @@ void cmci_reenable(void)
                 cmci_discover(banks);
 }
 
+void cmci_disable_bank(int bank)
+{
+        int banks;
+        unsigned long flags;
+
+        if (!cmci_supported(&banks))
+                return;
+
+        raw_spin_lock_irqsave(&cmci_discover_lock, flags);
+        __cmci_disable_bank(bank);
+        raw_spin_unlock_irqrestore(&cmci_discover_lock, flags);
+}
+
 static void intel_init_cmci(void)
 {
         int banks;
diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
index 8f4be53ea04b..71a39f3621ba 100644
--- a/arch/x86/kernel/cpu/mshyperv.c
+++ b/arch/x86/kernel/cpu/mshyperv.c
@@ -27,20 +27,23 @@
 struct ms_hyperv_info ms_hyperv;
 EXPORT_SYMBOL_GPL(ms_hyperv);
 
-static bool __init ms_hyperv_platform(void)
+static uint32_t  __init ms_hyperv_platform(void)
 {
         u32 eax;
         u32 hyp_signature[3];
 
         if (!boot_cpu_has(X86_FEATURE_HYPERVISOR))
-                return false;
+                return 0;
 
         cpuid(HYPERV_CPUID_VENDOR_AND_MAX_FUNCTIONS,
               &eax, &hyp_signature[0], &hyp_signature[1], &hyp_signature[2]);
 
-        return eax >= HYPERV_CPUID_MIN &&
-                eax <= HYPERV_CPUID_MAX &&
-                !memcmp("Microsoft Hv", hyp_signature, 12);
+        if (eax >= HYPERV_CPUID_MIN &&
+            eax <= HYPERV_CPUID_MAX &&
+            !memcmp("Microsoft Hv", hyp_signature, 12))
+                return HYPERV_CPUID_VENDOR_AND_MAX_FUNCTIONS;
+
+        return 0;
 }
 
 static cycle_t read_hv_clock(struct clocksource *arg)
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index a7c7305030cc..8355c84b9729 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1884,6 +1884,7 @@ static struct pmu pmu = {
 void arch_perf_update_userpage(struct perf_event_mmap_page *userpg, u64 now)
 {
         userpg->cap_usr_time = 0;
+        userpg->cap_usr_time_zero = 0;
         userpg->cap_usr_rdpmc = x86_pmu.attr_rdpmc;
         userpg->pmc_width = x86_pmu.cntval_bits;
 
@@ -1897,6 +1898,11 @@ void arch_perf_update_userpage(struct perf_event_mmap_page *userpg, u64 now)
         userpg->time_mult = this_cpu_read(cyc2ns);
         userpg->time_shift = CYC2NS_SCALE_FACTOR;
         userpg->time_offset = this_cpu_read(cyc2ns_offset) - now;
+
+        if (sched_clock_stable && !check_tsc_disabled()) {
+                userpg->cap_usr_time_zero = 1;
+                userpg->time_zero = this_cpu_read(cyc2ns_offset);
+        }
 }
 
 /*
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index 97e557bc4c91..cc16faae0538 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -641,6 +641,8 @@ extern struct event_constraint intel_core2_pebs_event_constraints[];
 
 extern struct event_constraint intel_atom_pebs_event_constraints[];
 
+extern struct event_constraint intel_slm_pebs_event_constraints[];
+
 extern struct event_constraint intel_nehalem_pebs_event_constraints[];
 
 extern struct event_constraint intel_westmere_pebs_event_constraints[];
diff --git a/arch/x86/kernel/cpu/perf_event_amd.c b/arch/x86/kernel/cpu/perf_event_amd.c
index 4cbe03287b08..beeb7cc07044 100644
--- a/arch/x86/kernel/cpu/perf_event_amd.c
+++ b/arch/x86/kernel/cpu/perf_event_amd.c
@@ -347,8 +347,7 @@ static struct amd_nb *amd_alloc_nb(int cpu)
         struct amd_nb *nb;
         int i;
 
-        nb = kmalloc_node(sizeof(struct amd_nb), GFP_KERNEL | __GFP_ZERO,
-                          cpu_to_node(cpu));
+        nb = kzalloc_node(sizeof(struct amd_nb), GFP_KERNEL, cpu_to_node(cpu));
         if (!nb)
                 return NULL;
 
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index fbc9210b45bc..0abf6742a8b0 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -81,7 +81,8 @@ static struct event_constraint intel_nehalem_event_constraints[] __read_mostly =
 
 static struct extra_reg intel_nehalem_extra_regs[] __read_mostly =
 {
-        INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0xffff, RSP_0),
+        /* must define OFFCORE_RSP_X first, see intel_fixup_er() */
+        INTEL_UEVENT_EXTRA_REG(0x01b7, MSR_OFFCORE_RSP_0, 0xffff, RSP_0),
         INTEL_UEVENT_PEBS_LDLAT_EXTRA_REG(0x100b),
         EVENT_EXTRA_END
 };
@@ -143,8 +144,9 @@ static struct event_constraint intel_ivb_event_constraints[] __read_mostly =
 
 static struct extra_reg intel_westmere_extra_regs[] __read_mostly =
 {
-        INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0xffff, RSP_0),
-        INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0xffff, RSP_1),
+        /* must define OFFCORE_RSP_X first, see intel_fixup_er() */
+        INTEL_UEVENT_EXTRA_REG(0x01b7, MSR_OFFCORE_RSP_0, 0xffff, RSP_0),
+        INTEL_UEVENT_EXTRA_REG(0x01bb, MSR_OFFCORE_RSP_1, 0xffff, RSP_1),
         INTEL_UEVENT_PEBS_LDLAT_EXTRA_REG(0x100b),
         EVENT_EXTRA_END
 };
@@ -162,16 +164,27 @@ static struct event_constraint intel_gen_event_constraints[] __read_mostly =
         EVENT_CONSTRAINT_END
 };
 
+static struct event_constraint intel_slm_event_constraints[] __read_mostly =
+{
+        FIXED_EVENT_CONSTRAINT(0x00c0, 0), /* INST_RETIRED.ANY */
+        FIXED_EVENT_CONSTRAINT(0x003c, 1), /* CPU_CLK_UNHALTED.CORE */
+        FIXED_EVENT_CONSTRAINT(0x013c, 2), /* CPU_CLK_UNHALTED.REF */
+        FIXED_EVENT_CONSTRAINT(0x0300, 2), /* pseudo CPU_CLK_UNHALTED.REF */
+        EVENT_CONSTRAINT_END
+};
+
 static struct extra_reg intel_snb_extra_regs[] __read_mostly = {
-        INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3f807f8fffull, RSP_0),
-        INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3f807f8fffull, RSP_1),
+        /* must define OFFCORE_RSP_X first, see intel_fixup_er() */
+        INTEL_UEVENT_EXTRA_REG(0x01b7, MSR_OFFCORE_RSP_0, 0x3f807f8fffull, RSP_0),
+        INTEL_UEVENT_EXTRA_REG(0x01bb, MSR_OFFCORE_RSP_1, 0x3f807f8fffull, RSP_1),
         INTEL_UEVENT_PEBS_LDLAT_EXTRA_REG(0x01cd),
         EVENT_EXTRA_END
 };
 
 static struct extra_reg intel_snbep_extra_regs[] __read_mostly = {
-        INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3fffff8fffull, RSP_0),
-        INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3fffff8fffull, RSP_1),
+        /* must define OFFCORE_RSP_X first, see intel_fixup_er() */
+        INTEL_UEVENT_EXTRA_REG(0x01b7, MSR_OFFCORE_RSP_0, 0x3fffff8fffull, RSP_0),
+        INTEL_UEVENT_EXTRA_REG(0x01bb, MSR_OFFCORE_RSP_1, 0x3fffff8fffull, RSP_1),
         INTEL_UEVENT_PEBS_LDLAT_EXTRA_REG(0x01cd),
         EVENT_EXTRA_END
 };
@@ -882,6 +895,140 @@ static __initconst const u64 atom_hw_cache_event_ids
  },
 };
 
+static struct extra_reg intel_slm_extra_regs[] __read_mostly =
+{
+        /* must define OFFCORE_RSP_X first, see intel_fixup_er() */
+        INTEL_UEVENT_EXTRA_REG(0x01b7, MSR_OFFCORE_RSP_0, 0x768005ffff, RSP_0),
+        INTEL_UEVENT_EXTRA_REG(0x02b7, MSR_OFFCORE_RSP_1, 0x768005ffff, RSP_1),
+        EVENT_EXTRA_END
+};
+
+#define SLM_DMND_READ           SNB_DMND_DATA_RD
+#define SLM_DMND_WRITE          SNB_DMND_RFO
+#define SLM_DMND_PREFETCH       (SNB_PF_DATA_RD|SNB_PF_RFO)
+
+#define SLM_SNP_ANY             (SNB_SNP_NONE|SNB_SNP_MISS|SNB_NO_FWD|SNB_HITM)
+#define SLM_LLC_ACCESS          SNB_RESP_ANY
+#define SLM_LLC_MISS            (SLM_SNP_ANY|SNB_NON_DRAM)
+
+static __initconst const u64 slm_hw_cache_extra_regs
+                                [PERF_COUNT_HW_CACHE_MAX]
+                                [PERF_COUNT_HW_CACHE_OP_MAX]
+                                [PERF_COUNT_HW_CACHE_RESULT_MAX] =
+{
+ [ C(LL  ) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = SLM_DMND_READ|SLM_LLC_ACCESS,
+                [ C(RESULT_MISS)   ] = SLM_DMND_READ|SLM_LLC_MISS,
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = SLM_DMND_WRITE|SLM_LLC_ACCESS,
+                [ C(RESULT_MISS)   ] = SLM_DMND_WRITE|SLM_LLC_MISS,
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = SLM_DMND_PREFETCH|SLM_LLC_ACCESS,
+                [ C(RESULT_MISS)   ] = SLM_DMND_PREFETCH|SLM_LLC_MISS,
+        },
+ },
+};
+
+static __initconst const u64 slm_hw_cache_event_ids
+                                [PERF_COUNT_HW_CACHE_MAX]
+                                [PERF_COUNT_HW_CACHE_OP_MAX]
+                                [PERF_COUNT_HW_CACHE_RESULT_MAX] =
+{
+ [ C(L1D) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0x0104, /* LD_DCU_MISS */
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+ },
+ [ C(L1I ) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0x0380, /* ICACHE.ACCESSES */
+                [ C(RESULT_MISS)   ] = 0x0280, /* ICACGE.MISSES */
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = -1,
+                [ C(RESULT_MISS)   ] = -1,
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+ },
+ [ C(LL  ) ] = {
+        [ C(OP_READ) ] = {
+                /* OFFCORE_RESPONSE.ANY_DATA.LOCAL_CACHE */
+                [ C(RESULT_ACCESS) ] = 0x01b7,
+                /* OFFCORE_RESPONSE.ANY_DATA.ANY_LLC_MISS */
+                [ C(RESULT_MISS)   ] = 0x01b7,
+        },
+        [ C(OP_WRITE) ] = {
+                /* OFFCORE_RESPONSE.ANY_RFO.LOCAL_CACHE */
+                [ C(RESULT_ACCESS) ] = 0x01b7,
+                /* OFFCORE_RESPONSE.ANY_RFO.ANY_LLC_MISS */
+                [ C(RESULT_MISS)   ] = 0x01b7,
+        },
+        [ C(OP_PREFETCH) ] = {
+                /* OFFCORE_RESPONSE.PREFETCH.LOCAL_CACHE */
+                [ C(RESULT_ACCESS) ] = 0x01b7,
+                /* OFFCORE_RESPONSE.PREFETCH.ANY_LLC_MISS */
+                [ C(RESULT_MISS)   ] = 0x01b7,
+        },
+ },
+ [ C(DTLB) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0x0804, /* LD_DTLB_MISS */
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+ },
+ [ C(ITLB) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0x00c0, /* INST_RETIRED.ANY_P */
+                [ C(RESULT_MISS)   ] = 0x0282, /* ITLB.MISSES */
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = -1,
+                [ C(RESULT_MISS)   ] = -1,
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = -1,
+                [ C(RESULT_MISS)   ] = -1,
+        },
+ },
+ [ C(BPU ) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0x00c4, /* BR_INST_RETIRED.ANY */
+                [ C(RESULT_MISS)   ] = 0x00c5, /* BP_INST_RETIRED.MISPRED */
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = -1,
+                [ C(RESULT_MISS)   ] = -1,
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = -1,
+                [ C(RESULT_MISS)   ] = -1,
+        },
+ },
+};
+
 static inline bool intel_pmu_needs_lbr_smpl(struct perf_event *event)
 {
         /* user explicitly requested branch sampling */
@@ -1301,11 +1448,11 @@ static void intel_fixup_er(struct perf_event *event, int idx)
 
         if (idx == EXTRA_REG_RSP_0) {
                 event->hw.config &= ~INTEL_ARCH_EVENT_MASK;
-                event->hw.config |= 0x01b7;
+                event->hw.config |= x86_pmu.extra_regs[EXTRA_REG_RSP_0].event;
                 event->hw.extra_reg.reg = MSR_OFFCORE_RSP_0;
         } else if (idx == EXTRA_REG_RSP_1) {
                 event->hw.config &= ~INTEL_ARCH_EVENT_MASK;
-                event->hw.config |= 0x01bb;
+                event->hw.config |= x86_pmu.extra_regs[EXTRA_REG_RSP_1].event;
                 event->hw.extra_reg.reg = MSR_OFFCORE_RSP_1;
         }
 }
@@ -2176,6 +2323,21 @@ __init int intel_pmu_init(void)
                 pr_cont("Atom events, ");
                 break;
 
+        case 55: /* Atom 22nm "Silvermont" */
+                memcpy(hw_cache_event_ids, slm_hw_cache_event_ids,
+                        sizeof(hw_cache_event_ids));
+                memcpy(hw_cache_extra_regs, slm_hw_cache_extra_regs,
+                       sizeof(hw_cache_extra_regs));
+
+                intel_pmu_lbr_init_atom();
+
+                x86_pmu.event_constraints = intel_slm_event_constraints;
+                x86_pmu.pebs_constraints = intel_slm_pebs_event_constraints;
+                x86_pmu.extra_regs = intel_slm_extra_regs;
+                x86_pmu.er_flags |= ERF_HAS_RSP_1;
+                pr_cont("Silvermont events, ");
+                break;
+
         case 37: /* 32 nm nehalem, "Clarkdale" */
         case 44: /* 32 nm nehalem, "Gulftown" */
         case 47: /* 32 nm Xeon E7 */
@@ -2270,6 +2432,7 @@ __init int intel_pmu_init(void)
         case 70:
         case 71:
         case 63:
+        case 69:
                 x86_pmu.late_ack = true;
                 memcpy(hw_cache_event_ids, snb_hw_cache_event_ids, sizeof(hw_cache_event_ids));
                 memcpy(hw_cache_extra_regs, snb_hw_cache_extra_regs, sizeof(hw_cache_extra_regs));
diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index 3065c57a63c1..63438aad177f 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -224,7 +224,7 @@ static int alloc_pebs_buffer(int cpu)
         if (!x86_pmu.pebs)
                 return 0;
 
-        buffer = kmalloc_node(PEBS_BUFFER_SIZE, GFP_KERNEL | __GFP_ZERO, node);
+        buffer = kzalloc_node(PEBS_BUFFER_SIZE, GFP_KERNEL, node);
         if (unlikely(!buffer))
                 return -ENOMEM;
 
@@ -262,7 +262,7 @@ static int alloc_bts_buffer(int cpu)
         if (!x86_pmu.bts)
                 return 0;
 
-        buffer = kmalloc_node(BTS_BUFFER_SIZE, GFP_KERNEL | __GFP_ZERO, node);
+        buffer = kzalloc_node(BTS_BUFFER_SIZE, GFP_KERNEL, node);
         if (unlikely(!buffer))
                 return -ENOMEM;
 
@@ -295,7 +295,7 @@ static int alloc_ds_buffer(int cpu)
         int node = cpu_to_node(cpu);
         struct debug_store *ds;
 
-        ds = kmalloc_node(sizeof(*ds), GFP_KERNEL | __GFP_ZERO, node);
+        ds = kzalloc_node(sizeof(*ds), GFP_KERNEL, node);
         if (unlikely(!ds))
                 return -ENOMEM;
 
@@ -517,6 +517,32 @@ struct event_constraint intel_atom_pebs_event_constraints[] = {
         EVENT_CONSTRAINT_END
 };
 
+struct event_constraint intel_slm_pebs_event_constraints[] = {
+        INTEL_UEVENT_CONSTRAINT(0x0103, 0x1), /* REHABQ.LD_BLOCK_ST_FORWARD_PS */
+        INTEL_UEVENT_CONSTRAINT(0x0803, 0x1), /* REHABQ.LD_SPLITS_PS */
+        INTEL_UEVENT_CONSTRAINT(0x0204, 0x1), /* MEM_UOPS_RETIRED.L2_HIT_LOADS_PS */
+        INTEL_UEVENT_CONSTRAINT(0x0404, 0x1), /* MEM_UOPS_RETIRED.L2_MISS_LOADS_PS */
+        INTEL_UEVENT_CONSTRAINT(0x0804, 0x1), /* MEM_UOPS_RETIRED.DTLB_MISS_LOADS_PS */
+        INTEL_UEVENT_CONSTRAINT(0x2004, 0x1), /* MEM_UOPS_RETIRED.HITM_PS */
+        INTEL_UEVENT_CONSTRAINT(0x00c0, 0x1), /* INST_RETIRED.ANY_PS */
+        INTEL_UEVENT_CONSTRAINT(0x00c4, 0x1), /* BR_INST_RETIRED.ALL_BRANCHES_PS */
+        INTEL_UEVENT_CONSTRAINT(0x7ec4, 0x1), /* BR_INST_RETIRED.JCC_PS */
+        INTEL_UEVENT_CONSTRAINT(0xbfc4, 0x1), /* BR_INST_RETIRED.FAR_BRANCH_PS */
+        INTEL_UEVENT_CONSTRAINT(0xebc4, 0x1), /* BR_INST_RETIRED.NON_RETURN_IND_PS */
+        INTEL_UEVENT_CONSTRAINT(0xf7c4, 0x1), /* BR_INST_RETIRED.RETURN_PS */
+        INTEL_UEVENT_CONSTRAINT(0xf9c4, 0x1), /* BR_INST_RETIRED.CALL_PS */
+        INTEL_UEVENT_CONSTRAINT(0xfbc4, 0x1), /* BR_INST_RETIRED.IND_CALL_PS */
+        INTEL_UEVENT_CONSTRAINT(0xfdc4, 0x1), /* BR_INST_RETIRED.REL_CALL_PS */
+        INTEL_UEVENT_CONSTRAINT(0xfec4, 0x1), /* BR_INST_RETIRED.TAKEN_JCC_PS */
+        INTEL_UEVENT_CONSTRAINT(0x00c5, 0x1), /* BR_INST_MISP_RETIRED.ALL_BRANCHES_PS */
+        INTEL_UEVENT_CONSTRAINT(0x7ec5, 0x1), /* BR_INST_MISP_RETIRED.JCC_PS */
+        INTEL_UEVENT_CONSTRAINT(0xebc5, 0x1), /* BR_INST_MISP_RETIRED.NON_RETURN_IND_PS */
+        INTEL_UEVENT_CONSTRAINT(0xf7c5, 0x1), /* BR_INST_MISP_RETIRED.RETURN_PS */
+        INTEL_UEVENT_CONSTRAINT(0xfbc5, 0x1), /* BR_INST_MISP_RETIRED.IND_CALL_PS */
+        INTEL_UEVENT_CONSTRAINT(0xfec5, 0x1), /* BR_INST_MISP_RETIRED.TAKEN_JCC_PS */
+        EVENT_CONSTRAINT_END
+};
+
 struct event_constraint intel_nehalem_pebs_event_constraints[] = {
         INTEL_PLD_CONSTRAINT(0x100b, 0xf),      /* MEM_INST_RETIRED.* */
         INTEL_EVENT_CONSTRAINT(0x0f, 0xf),    /* MEM_UNCORE_RETIRED.* */
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index cad791dbde95..fd8011ed4dcd 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -6,6 +6,8 @@ static struct intel_uncore_type **pci_uncores = empty_uncore;
 /* pci bus to socket mapping */
 static int pcibus_to_physid[256] = { [0 ... 255] = -1, };
 
+static struct pci_dev *extra_pci_dev[UNCORE_SOCKET_MAX][UNCORE_EXTRA_PCI_DEV_MAX];
+
 static DEFINE_RAW_SPINLOCK(uncore_box_lock);
 
 /* mask of cpus that collect uncore events */
@@ -45,6 +47,24 @@ DEFINE_UNCORE_FORMAT_ATTR(filter_band0, filter_band0, "config1:0-7");
 DEFINE_UNCORE_FORMAT_ATTR(filter_band1, filter_band1, "config1:8-15");
 DEFINE_UNCORE_FORMAT_ATTR(filter_band2, filter_band2, "config1:16-23");
 DEFINE_UNCORE_FORMAT_ATTR(filter_band3, filter_band3, "config1:24-31");
+DEFINE_UNCORE_FORMAT_ATTR(match_rds, match_rds, "config1:48-51");
+DEFINE_UNCORE_FORMAT_ATTR(match_rnid30, match_rnid30, "config1:32-35");
+DEFINE_UNCORE_FORMAT_ATTR(match_rnid4, match_rnid4, "config1:31");
+DEFINE_UNCORE_FORMAT_ATTR(match_dnid, match_dnid, "config1:13-17");
+DEFINE_UNCORE_FORMAT_ATTR(match_mc, match_mc, "config1:9-12");
+DEFINE_UNCORE_FORMAT_ATTR(match_opc, match_opc, "config1:5-8");
+DEFINE_UNCORE_FORMAT_ATTR(match_vnw, match_vnw, "config1:3-4");
+DEFINE_UNCORE_FORMAT_ATTR(match0, match0, "config1:0-31");
+DEFINE_UNCORE_FORMAT_ATTR(match1, match1, "config1:32-63");
+DEFINE_UNCORE_FORMAT_ATTR(mask_rds, mask_rds, "config2:48-51");
+DEFINE_UNCORE_FORMAT_ATTR(mask_rnid30, mask_rnid30, "config2:32-35");
+DEFINE_UNCORE_FORMAT_ATTR(mask_rnid4, mask_rnid4, "config2:31");
+DEFINE_UNCORE_FORMAT_ATTR(mask_dnid, mask_dnid, "config2:13-17");
+DEFINE_UNCORE_FORMAT_ATTR(mask_mc, mask_mc, "config2:9-12");
+DEFINE_UNCORE_FORMAT_ATTR(mask_opc, mask_opc, "config2:5-8");
+DEFINE_UNCORE_FORMAT_ATTR(mask_vnw, mask_vnw, "config2:3-4");
+DEFINE_UNCORE_FORMAT_ATTR(mask0, mask0, "config2:0-31");
+DEFINE_UNCORE_FORMAT_ATTR(mask1, mask1, "config2:32-63");
 
 static u64 uncore_msr_read_counter(struct intel_uncore_box *box, struct perf_event *event)
 {
@@ -281,7 +301,7 @@ static struct attribute *snbep_uncore_cbox_formats_attr[] = {
 };
 
 static struct attribute *snbep_uncore_pcu_formats_attr[] = {
-        &format_attr_event.attr,
+        &format_attr_event_ext.attr,
         &format_attr_occ_sel.attr,
         &format_attr_edge.attr,
         &format_attr_inv.attr,
@@ -301,6 +321,24 @@ static struct attribute *snbep_uncore_qpi_formats_attr[] = {
         &format_attr_edge.attr,
         &format_attr_inv.attr,
         &format_attr_thresh8.attr,
+        &format_attr_match_rds.attr,
+        &format_attr_match_rnid30.attr,
+        &format_attr_match_rnid4.attr,
+        &format_attr_match_dnid.attr,
+        &format_attr_match_mc.attr,
+        &format_attr_match_opc.attr,
+        &format_attr_match_vnw.attr,
+        &format_attr_match0.attr,
+        &format_attr_match1.attr,
+        &format_attr_mask_rds.attr,
+        &format_attr_mask_rnid30.attr,
+        &format_attr_mask_rnid4.attr,
+        &format_attr_mask_dnid.attr,
+        &format_attr_mask_mc.attr,
+        &format_attr_mask_opc.attr,
+        &format_attr_mask_vnw.attr,
+        &format_attr_mask0.attr,
+        &format_attr_mask1.attr,
         NULL,
 };
 
@@ -314,8 +352,8 @@ static struct uncore_event_desc snbep_uncore_imc_events[] = {
 static struct uncore_event_desc snbep_uncore_qpi_events[] = {
         INTEL_UNCORE_EVENT_DESC(clockticks,       "event=0x14"),
         INTEL_UNCORE_EVENT_DESC(txl_flits_active, "event=0x00,umask=0x06"),
-        INTEL_UNCORE_EVENT_DESC(drs_data,         "event=0x02,umask=0x08"),
-        INTEL_UNCORE_EVENT_DESC(ncb_data,         "event=0x03,umask=0x04"),
+        INTEL_UNCORE_EVENT_DESC(drs_data,         "event=0x102,umask=0x08"),
+        INTEL_UNCORE_EVENT_DESC(ncb_data,         "event=0x103,umask=0x04"),
         { /* end: all zeroes */ },
 };
 
@@ -356,13 +394,16 @@ static struct intel_uncore_ops snbep_uncore_msr_ops = {
         SNBEP_UNCORE_MSR_OPS_COMMON_INIT(),
 };
 
+#define SNBEP_UNCORE_PCI_OPS_COMMON_INIT()                      \
+        .init_box       = snbep_uncore_pci_init_box,            \
+        .disable_box    = snbep_uncore_pci_disable_box,         \
+        .enable_box     = snbep_uncore_pci_enable_box,          \
+        .disable_event  = snbep_uncore_pci_disable_event,       \
+        .read_counter   = snbep_uncore_pci_read_counter
+
 static struct intel_uncore_ops snbep_uncore_pci_ops = {
-        .init_box       = snbep_uncore_pci_init_box,
-        .disable_box    = snbep_uncore_pci_disable_box,
-        .enable_box     = snbep_uncore_pci_enable_box,
-        .disable_event  = snbep_uncore_pci_disable_event,
-        .enable_event   = snbep_uncore_pci_enable_event,
-        .read_counter   = snbep_uncore_pci_read_counter,
+        SNBEP_UNCORE_PCI_OPS_COMMON_INIT(),
+        .enable_event   = snbep_uncore_pci_enable_event,        \
 };
 
 static struct event_constraint snbep_uncore_cbox_constraints[] = {
@@ -726,6 +767,61 @@ static struct intel_uncore_type *snbep_msr_uncores[] = {
         NULL,
 };
 
+enum {
+        SNBEP_PCI_QPI_PORT0_FILTER,
+        SNBEP_PCI_QPI_PORT1_FILTER,
+};
+
+static int snbep_qpi_hw_config(struct intel_uncore_box *box, struct perf_event *event)
+{
+        struct hw_perf_event *hwc = &event->hw;
+        struct hw_perf_event_extra *reg1 = &hwc->extra_reg;
+        struct hw_perf_event_extra *reg2 = &hwc->branch_reg;
+
+        if ((hwc->config & SNBEP_PMON_CTL_EV_SEL_MASK) == 0x38) {
+                reg1->idx = 0;
+                reg1->reg = SNBEP_Q_Py_PCI_PMON_PKT_MATCH0;
+                reg1->config = event->attr.config1;
+                reg2->reg = SNBEP_Q_Py_PCI_PMON_PKT_MASK0;
+                reg2->config = event->attr.config2;
+        }
+        return 0;
+}
+
+static void snbep_qpi_enable_event(struct intel_uncore_box *box, struct perf_event *event)
+{
+        struct pci_dev *pdev = box->pci_dev;
+        struct hw_perf_event *hwc = &event->hw;
+        struct hw_perf_event_extra *reg1 = &hwc->extra_reg;
+        struct hw_perf_event_extra *reg2 = &hwc->branch_reg;
+
+        if (reg1->idx != EXTRA_REG_NONE) {
+                int idx = box->pmu->pmu_idx + SNBEP_PCI_QPI_PORT0_FILTER;
+                struct pci_dev *filter_pdev = extra_pci_dev[box->phys_id][idx];
+                WARN_ON_ONCE(!filter_pdev);
+                if (filter_pdev) {
+                        pci_write_config_dword(filter_pdev, reg1->reg,
+                                                (u32)reg1->config);
+                        pci_write_config_dword(filter_pdev, reg1->reg + 4,
+                                                (u32)(reg1->config >> 32));
+                        pci_write_config_dword(filter_pdev, reg2->reg,
+                                                (u32)reg2->config);
+                        pci_write_config_dword(filter_pdev, reg2->reg + 4,
+                                                (u32)(reg2->config >> 32));
+                }
+        }
+
+        pci_write_config_dword(pdev, hwc->config_base, hwc->config | SNBEP_PMON_CTL_EN);
+}
+
+static struct intel_uncore_ops snbep_uncore_qpi_ops = {
+        SNBEP_UNCORE_PCI_OPS_COMMON_INIT(),
+        .enable_event           = snbep_qpi_enable_event,
+        .hw_config              = snbep_qpi_hw_config,
+        .get_constraint         = uncore_get_constraint,
+        .put_constraint         = uncore_put_constraint,
+};
+
 #define SNBEP_UNCORE_PCI_COMMON_INIT()                          \
         .perf_ctr       = SNBEP_PCI_PMON_CTR0,                  \
         .event_ctl      = SNBEP_PCI_PMON_CTL0,                  \
@@ -755,17 +851,18 @@ static struct intel_uncore_type snbep_uncore_imc = {
 };
 
 static struct intel_uncore_type snbep_uncore_qpi = {
-        .name           = "qpi",
-        .num_counters   = 4,
-        .num_boxes      = 2,
-        .perf_ctr_bits  = 48,
-        .perf_ctr       = SNBEP_PCI_PMON_CTR0,
-        .event_ctl      = SNBEP_PCI_PMON_CTL0,
-        .event_mask     = SNBEP_QPI_PCI_PMON_RAW_EVENT_MASK,
-        .box_ctl        = SNBEP_PCI_PMON_BOX_CTL,
-        .ops            = &snbep_uncore_pci_ops,
-        .event_descs    = snbep_uncore_qpi_events,
-        .format_group   = &snbep_uncore_qpi_format_group,
+        .name                   = "qpi",
+        .num_counters           = 4,
+        .num_boxes              = 2,
+        .perf_ctr_bits          = 48,
+        .perf_ctr               = SNBEP_PCI_PMON_CTR0,
+        .event_ctl              = SNBEP_PCI_PMON_CTL0,
+        .event_mask             = SNBEP_QPI_PCI_PMON_RAW_EVENT_MASK,
+        .box_ctl                = SNBEP_PCI_PMON_BOX_CTL,
+        .num_shared_regs        = 1,
+        .ops                    = &snbep_uncore_qpi_ops,
+        .event_descs            = snbep_uncore_qpi_events,
+        .format_group           = &snbep_uncore_qpi_format_group,
 };
 
 
@@ -807,43 +904,53 @@ static struct intel_uncore_type *snbep_pci_uncores[] = {
 static DEFINE_PCI_DEVICE_TABLE(snbep_uncore_pci_ids) = {
         { /* Home Agent */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_UNC_HA),
-                .driver_data = SNBEP_PCI_UNCORE_HA,
+                .driver_data = UNCORE_PCI_DEV_DATA(SNBEP_PCI_UNCORE_HA, 0),
         },
         { /* MC Channel 0 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_UNC_IMC0),
-                .driver_data = SNBEP_PCI_UNCORE_IMC,
+                .driver_data = UNCORE_PCI_DEV_DATA(SNBEP_PCI_UNCORE_IMC, 0),
         },
         { /* MC Channel 1 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_UNC_IMC1),
-                .driver_data = SNBEP_PCI_UNCORE_IMC,
+                .driver_data = UNCORE_PCI_DEV_DATA(SNBEP_PCI_UNCORE_IMC, 1),
         },
         { /* MC Channel 2 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_UNC_IMC2),
-                .driver_data = SNBEP_PCI_UNCORE_IMC,
+                .driver_data = UNCORE_PCI_DEV_DATA(SNBEP_PCI_UNCORE_IMC, 2),
         },
         { /* MC Channel 3 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_UNC_IMC3),
-                .driver_data = SNBEP_PCI_UNCORE_IMC,
+                .driver_data = UNCORE_PCI_DEV_DATA(SNBEP_PCI_UNCORE_IMC, 3),
         },
         { /* QPI Port 0 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_UNC_QPI0),
-                .driver_data = SNBEP_PCI_UNCORE_QPI,
+                .driver_data = UNCORE_PCI_DEV_DATA(SNBEP_PCI_UNCORE_QPI, 0),
         },
         { /* QPI Port 1 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_UNC_QPI1),
-                .driver_data = SNBEP_PCI_UNCORE_QPI,
+                .driver_data = UNCORE_PCI_DEV_DATA(SNBEP_PCI_UNCORE_QPI, 1),
         },
         { /* R2PCIe */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_UNC_R2PCIE),
-                .driver_data = SNBEP_PCI_UNCORE_R2PCIE,
+                .driver_data = UNCORE_PCI_DEV_DATA(SNBEP_PCI_UNCORE_R2PCIE, 0),
         },
         { /* R3QPI Link 0 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_UNC_R3QPI0),
-                .driver_data = SNBEP_PCI_UNCORE_R3QPI,
+                .driver_data = UNCORE_PCI_DEV_DATA(SNBEP_PCI_UNCORE_R3QPI, 0),
         },
         { /* R3QPI Link 1 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_UNC_R3QPI1),
-                .driver_data = SNBEP_PCI_UNCORE_R3QPI,
+                .driver_data = UNCORE_PCI_DEV_DATA(SNBEP_PCI_UNCORE_R3QPI, 1),
+        },
+        { /* QPI Port 0 filter  */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x3c86),
+                .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
+                                                   SNBEP_PCI_QPI_PORT0_FILTER),
+        },
+        { /* QPI Port 0 filter  */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x3c96),
+                .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
+                                                   SNBEP_PCI_QPI_PORT1_FILTER),
         },
         { /* end: all zeroes */ }
 };
@@ -1256,71 +1363,71 @@ static struct intel_uncore_type *ivt_pci_uncores[] = {
 static DEFINE_PCI_DEVICE_TABLE(ivt_uncore_pci_ids) = {
         { /* Home Agent 0 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe30),
-                .driver_data = IVT_PCI_UNCORE_HA,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_HA, 0),
         },
         { /* Home Agent 1 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe38),
-                .driver_data = IVT_PCI_UNCORE_HA,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_HA, 1),
         },
         { /* MC0 Channel 0 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xeb4),
-                .driver_data = IVT_PCI_UNCORE_IMC,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_IMC, 0),
         },
         { /* MC0 Channel 1 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xeb5),
-                .driver_data = IVT_PCI_UNCORE_IMC,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_IMC, 1),
         },
         { /* MC0 Channel 3 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xeb0),
-                .driver_data = IVT_PCI_UNCORE_IMC,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_IMC, 2),
         },
         { /* MC0 Channel 4 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xeb1),
-                .driver_data = IVT_PCI_UNCORE_IMC,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_IMC, 3),
         },
         { /* MC1 Channel 0 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xef4),
-                .driver_data = IVT_PCI_UNCORE_IMC,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_IMC, 4),
         },
         { /* MC1 Channel 1 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xef5),
-                .driver_data = IVT_PCI_UNCORE_IMC,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_IMC, 5),
         },
         { /* MC1 Channel 3 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xef0),
-                .driver_data = IVT_PCI_UNCORE_IMC,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_IMC, 6),
         },
         { /* MC1 Channel 4 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xef1),
-                .driver_data = IVT_PCI_UNCORE_IMC,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_IMC, 7),
         },
         { /* QPI0 Port 0 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe32),
-                .driver_data = IVT_PCI_UNCORE_QPI,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_QPI, 0),
         },
         { /* QPI0 Port 1 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe33),
-                .driver_data = IVT_PCI_UNCORE_QPI,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_QPI, 1),
         },
         { /* QPI1 Port 2 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe3a),
-                .driver_data = IVT_PCI_UNCORE_QPI,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_QPI, 2),
         },
         { /* R2PCIe */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe34),
-                .driver_data = IVT_PCI_UNCORE_R2PCIE,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_R2PCIE, 0),
         },
         { /* R3QPI0 Link 0 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe36),
-                .driver_data = IVT_PCI_UNCORE_R3QPI,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_R3QPI, 0),
         },
         { /* R3QPI0 Link 1 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe37),
-                .driver_data = IVT_PCI_UNCORE_R3QPI,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_R3QPI, 1),
         },
         { /* R3QPI1 Link 2 */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe3e),
-                .driver_data = IVT_PCI_UNCORE_R3QPI,
+                .driver_data = UNCORE_PCI_DEV_DATA(IVT_PCI_UNCORE_R3QPI, 2),
         },
         { /* end: all zeroes */ }
 };
@@ -2606,7 +2713,7 @@ struct intel_uncore_box *uncore_alloc_box(struct intel_uncore_type *type, int cp
 
         size = sizeof(*box) + type->num_shared_regs * sizeof(struct intel_uncore_extra_reg);
 
-        box = kmalloc_node(size, GFP_KERNEL | __GFP_ZERO, cpu_to_node(cpu));
+        box = kzalloc_node(size, GFP_KERNEL, cpu_to_node(cpu));
         if (!box)
                 return NULL;
 
@@ -3167,16 +3274,24 @@ static bool pcidrv_registered;
 /*
  * add a pci uncore device
  */
-static int uncore_pci_add(struct intel_uncore_type *type, struct pci_dev *pdev)
+static int uncore_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
         struct intel_uncore_pmu *pmu;
         struct intel_uncore_box *box;
-        int i, phys_id;
+        struct intel_uncore_type *type;
+        int phys_id;
 
         phys_id = pcibus_to_physid[pdev->bus->number];
         if (phys_id < 0)
                 return -ENODEV;
 
+        if (UNCORE_PCI_DEV_TYPE(id->driver_data) == UNCORE_EXTRA_PCI_DEV) {
+                extra_pci_dev[phys_id][UNCORE_PCI_DEV_IDX(id->driver_data)] = pdev;
+                pci_set_drvdata(pdev, NULL);
+                return 0;
+        }
+
+        type = pci_uncores[UNCORE_PCI_DEV_TYPE(id->driver_data)];
         box = uncore_alloc_box(type, 0);
         if (!box)
                 return -ENOMEM;
@@ -3185,21 +3300,11 @@ static int uncore_pci_add(struct intel_uncore_type *type, struct pci_dev *pdev)
          * for performance monitoring unit with multiple boxes,
          * each box has a different function id.
          */
-        for (i = 0; i < type->num_boxes; i++) {
-                pmu = &type->pmus[i];
-                if (pmu->func_id == pdev->devfn)
-                        break;
-                if (pmu->func_id < 0) {
-                        pmu->func_id = pdev->devfn;
-                        break;
-                }
-                pmu = NULL;
-        }
-
-        if (!pmu) {
-                kfree(box);
-                return -EINVAL;
-        }
+        pmu = &type->pmus[UNCORE_PCI_DEV_IDX(id->driver_data)];
+        if (pmu->func_id < 0)
+                pmu->func_id = pdev->devfn;
+        else
+                WARN_ON_ONCE(pmu->func_id != pdev->devfn);
 
         box->phys_id = phys_id;
         box->pci_dev = pdev;
@@ -3217,9 +3322,22 @@ static int uncore_pci_add(struct intel_uncore_type *type, struct pci_dev *pdev)
 static void uncore_pci_remove(struct pci_dev *pdev)
 {
         struct intel_uncore_box *box = pci_get_drvdata(pdev);
-        struct intel_uncore_pmu *pmu = box->pmu;
-        int cpu, phys_id = pcibus_to_physid[pdev->bus->number];
+        struct intel_uncore_pmu *pmu;
+        int i, cpu, phys_id = pcibus_to_physid[pdev->bus->number];
 
+        box = pci_get_drvdata(pdev);
+        if (!box) {
+                for (i = 0; i < UNCORE_EXTRA_PCI_DEV_MAX; i++) {
+                        if (extra_pci_dev[phys_id][i] == pdev) {
+                                extra_pci_dev[phys_id][i] = NULL;
+                                break;
+                        }
+                }
+                WARN_ON_ONCE(i >= UNCORE_EXTRA_PCI_DEV_MAX);
+                return;
+        }
+
+        pmu = box->pmu;
         if (WARN_ON_ONCE(phys_id != box->phys_id))
                 return;
 
@@ -3240,12 +3358,6 @@ static void uncore_pci_remove(struct pci_dev *pdev)
         kfree(box);
 }
 
-static int uncore_pci_probe(struct pci_dev *pdev,
-                            const struct pci_device_id *id)
-{
-        return uncore_pci_add(pci_uncores[id->driver_data], pdev);
-}
-
 static int __init uncore_pci_init(void)
 {
         int ret;
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.h b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
index 47b3d00c9d89..a80ab71a883d 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.h
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
@@ -12,6 +12,15 @@
 #define UNCORE_PMC_IDX_FIXED            UNCORE_PMC_IDX_MAX_GENERIC
 #define UNCORE_PMC_IDX_MAX              (UNCORE_PMC_IDX_FIXED + 1)
 
+#define UNCORE_PCI_DEV_DATA(type, idx)  ((type << 8) | idx)
+#define UNCORE_PCI_DEV_TYPE(data)       ((data >> 8) & 0xff)
+#define UNCORE_PCI_DEV_IDX(data)        (data & 0xff)
+#define UNCORE_EXTRA_PCI_DEV            0xff
+#define UNCORE_EXTRA_PCI_DEV_MAX        2
+
+/* support up to 8 sockets */
+#define UNCORE_SOCKET_MAX               8
+
 #define UNCORE_EVENT_CONSTRAINT(c, n) EVENT_CONSTRAINT(c, n, 0xff)
 
 /* SNB event control */
@@ -108,6 +117,7 @@
                                 (SNBEP_PMON_CTL_EV_SEL_MASK | \
                                  SNBEP_PCU_MSR_PMON_CTL_OCC_SEL_MASK | \
                                  SNBEP_PMON_CTL_EDGE_DET | \
+                                 SNBEP_PMON_CTL_EV_SEL_EXT | \
                                  SNBEP_PMON_CTL_INVERT | \
                                  SNBEP_PCU_MSR_PMON_CTL_TRESH_MASK | \
                                  SNBEP_PCU_MSR_PMON_CTL_OCC_INVERT | \
diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c
index 7076878404ec..628a059a9a06 100644
--- a/arch/x86/kernel/cpu/vmware.c
+++ b/arch/x86/kernel/cpu/vmware.c
@@ -93,7 +93,7 @@ static void __init vmware_platform_setup(void)
  * serial key should be enough, as this will always have a VMware
  * specific string when running under VMware hypervisor.
  */
-static bool __init vmware_platform(void)
+static uint32_t __init vmware_platform(void)
 {
         if (cpu_has_hypervisor) {
                 unsigned int eax;
@@ -102,12 +102,12 @@ static bool __init vmware_platform(void)
                 cpuid(CPUID_VMWARE_INFO_LEAF, &eax, &hyper_vendor_id[0],
                       &hyper_vendor_id[1], &hyper_vendor_id[2]);
                 if (!memcmp(hyper_vendor_id, "VMwareVMware", 12))
-                        return true;
+                        return CPUID_VMWARE_INFO_LEAF;
         } else if (dmi_available && dmi_name_in_serial("VMware") &&
                    __vmware_platform())
-                return true;
+                return 1;
 
-        return false;
+        return 0;
 }
 
 /*
diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
index 74467feb4dc5..e0e0841eef45 100644
--- a/arch/x86/kernel/crash.c
+++ b/arch/x86/kernel/crash.c
@@ -128,7 +128,9 @@ void native_machine_crash_shutdown(struct pt_regs *regs)
         cpu_emergency_svm_disable();
 
         lapic_shutdown();
-#if defined(CONFIG_X86_IO_APIC)
+#ifdef CONFIG_X86_IO_APIC
+        /* Prevent crash_kexec() from deadlocking on ioapic_lock. */
+        ioapic_zap_locks();
         disable_IO_APIC();
 #endif
 #ifdef CONFIG_HPET_TIMER
diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
index d32abeabbda5..174da5fc5a7b 100644
--- a/arch/x86/kernel/e820.c
+++ b/arch/x86/kernel/e820.c
@@ -658,15 +658,18 @@ __init void e820_setup_gap(void)
  * boot_params.e820_map, others are passed via SETUP_E820_EXT node of
  * linked list of struct setup_data, which is parsed here.
  */
-void __init parse_e820_ext(struct setup_data *sdata)
+void __init parse_e820_ext(u64 phys_addr, u32 data_len)
 {
         int entries;
         struct e820entry *extmap;
+        struct setup_data *sdata;
 
+        sdata = early_memremap(phys_addr, data_len);
         entries = sdata->len / sizeof(struct e820entry);
         extmap = (struct e820entry *)(sdata->data);
         __append_e820_map(extmap, entries);
         sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
+        early_iounmap(sdata, data_len);
         printk(KERN_INFO "e820: extended physical RAM map:\n");
         e820_print_map("extended");
 }
diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
index 94ab6b90dd3f..63bdb29b2549 100644
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -196,15 +196,23 @@ static void __init ati_bugs_contd(int num, int slot, int func)
 static void __init intel_remapping_check(int num, int slot, int func)
 {
         u8 revision;
+        u16 device;
 
+        device = read_pci_config_16(num, slot, func, PCI_DEVICE_ID);
         revision = read_pci_config_byte(num, slot, func, PCI_REVISION_ID);
 
         /*
-         * Revision 0x13 of this chipset supports irq remapping
-         * but has an erratum that breaks its behavior, flag it as such
+         * Revision 13 of all triggering devices id in this quirk have
+         * a problem draining interrupts when irq remapping is enabled,
+         * and should be flagged as broken.  Additionally revisions 0x12
+         * and 0x22 of device id 0x3405 has this problem.
          */
         if (revision == 0x13)
                 set_irq_remapping_broken();
+        else if ((device == 0x3405) &&
+            ((revision == 0x12) ||
+             (revision == 0x22)))
+                set_irq_remapping_broken();
 
 }
 
@@ -239,6 +247,8 @@ static struct chipset early_qrk[] __initdata = {
           PCI_CLASS_SERIAL_SMBUS, PCI_ANY_ID, 0, ati_bugs_contd },
         { PCI_VENDOR_ID_INTEL, 0x3403, PCI_CLASS_BRIDGE_HOST,
           PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
+        { PCI_VENDOR_ID_INTEL, 0x3405, PCI_CLASS_BRIDGE_HOST,
+          PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
         { PCI_VENDOR_ID_INTEL, 0x3406, PCI_CLASS_BRIDGE_HOST,
           PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
         {}
diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
index 138463a24877..06f87bece92a 100644
--- a/arch/x86/kernel/head32.c
+++ b/arch/x86/kernel/head32.c
@@ -29,7 +29,7 @@ static void __init i386_default_early_setup(void)
         reserve_ebda_region();
 }
 
-void __init i386_start_kernel(void)
+asmlinkage void __init i386_start_kernel(void)
 {
         sanitize_boot_params(&boot_params);
 
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 55b67614ed94..1be8e43b669e 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -137,7 +137,7 @@ static void __init copy_bootdata(char *real_mode_data)
         }
 }
 
-void __init x86_64_start_kernel(char * real_mode_data)
+asmlinkage void __init x86_64_start_kernel(char * real_mode_data)
 {
         int i;
 
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index 5dd87a89f011..81ba27679f18 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -409,6 +409,7 @@ enable_paging:
 /*
  * Check if it is 486
  */
+        movb $4,X86                     # at least 486
         cmpl $-1,X86_CPUID
         je is486
 
@@ -436,7 +437,6 @@ enable_paging:
         movl %edx,X86_CAPABILITY
 
 is486:
-        movb $4,X86
         movl $0x50022,%ecx      # set AM, WP, NE and MP
         movl %cr0,%eax
         andl $0x80000011,%eax   # Save PG,PE,ET
diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
index 202d24f0f7e7..5d576ab34403 100644
--- a/arch/x86/kernel/i387.c
+++ b/arch/x86/kernel/i387.c
@@ -116,7 +116,7 @@ static void mxcsr_feature_mask_init(void)
 
         if (cpu_has_fxsr) {
                 memset(&fx_scratch, 0, sizeof(struct i387_fxsave_struct));
-                asm volatile("fxsave %0" : : "m" (fx_scratch));
+                asm volatile("fxsave %0" : "+m" (fx_scratch));
                 mask = fx_scratch.mxcsr_mask;
                 if (mask == 0)
                         mask = 0x0000ffbf;
diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index 3a8185c042a2..22d0687e7fda 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -177,7 +177,7 @@ u64 arch_irq_stat(void)
  * SMP cross-CPU interrupts have their own specific
  * handlers).
  */
-unsigned int __irq_entry do_IRQ(struct pt_regs *regs)
+__visible unsigned int __irq_entry do_IRQ(struct pt_regs *regs)
 {
         struct pt_regs *old_regs = set_irq_regs(regs);
 
@@ -215,7 +215,7 @@ void __smp_x86_platform_ipi(void)
                 x86_platform_ipi_callback();
 }
 
-void smp_x86_platform_ipi(struct pt_regs *regs)
+__visible void smp_x86_platform_ipi(struct pt_regs *regs)
 {
         struct pt_regs *old_regs = set_irq_regs(regs);
 
@@ -229,7 +229,7 @@ void smp_x86_platform_ipi(struct pt_regs *regs)
 /*
  * Handler for POSTED_INTERRUPT_VECTOR.
  */
-void smp_kvm_posted_intr_ipi(struct pt_regs *regs)
+__visible void smp_kvm_posted_intr_ipi(struct pt_regs *regs)
 {
         struct pt_regs *old_regs = set_irq_regs(regs);
 
@@ -247,7 +247,7 @@ void smp_kvm_posted_intr_ipi(struct pt_regs *regs)
 }
 #endif
 
-void smp_trace_x86_platform_ipi(struct pt_regs *regs)
+__visible void smp_trace_x86_platform_ipi(struct pt_regs *regs)
 {
         struct pt_regs *old_regs = set_irq_regs(regs);
 
diff --git a/arch/x86/kernel/irq_work.c b/arch/x86/kernel/irq_work.c
index 636a55e4a13c..1de84e3ab4e0 100644
--- a/arch/x86/kernel/irq_work.c
+++ b/arch/x86/kernel/irq_work.c
@@ -22,14 +22,14 @@ static inline void __smp_irq_work_interrupt(void)
         irq_work_run();
 }
 
-void smp_irq_work_interrupt(struct pt_regs *regs)
+__visible void smp_irq_work_interrupt(struct pt_regs *regs)
 {
         irq_work_entering_irq();
         __smp_irq_work_interrupt();
         exiting_irq();
 }
 
-void smp_trace_irq_work_interrupt(struct pt_regs *regs)
+__visible void smp_trace_irq_work_interrupt(struct pt_regs *regs)
 {
         irq_work_entering_irq();
         trace_irq_work_entry(IRQ_WORK_VECTOR);
diff --git a/arch/x86/kernel/jump_label.c b/arch/x86/kernel/jump_label.c
index 2889b3d43882..460f5d9ceebb 100644
--- a/arch/x86/kernel/jump_label.c
+++ b/arch/x86/kernel/jump_label.c
@@ -37,7 +37,19 @@ static void __jump_label_transform(struct jump_entry *entry,
         } else
                 memcpy(&code, ideal_nops[NOP_ATOMIC5], JUMP_LABEL_NOP_SIZE);
 
-        (*poker)((void *)entry->code, &code, JUMP_LABEL_NOP_SIZE);
+        /*
+         * Make text_poke_bp() a default fallback poker.
+         *
+         * At the time the change is being done, just ignore whether we
+         * are doing nop -> jump or jump -> nop transition, and assume
+         * always nop being the 'currently valid' instruction
+         *
+         */
+        if (poker)
+                (*poker)((void *)entry->code, &code, JUMP_LABEL_NOP_SIZE);
+        else
+                text_poke_bp((void *)entry->code, &code, JUMP_LABEL_NOP_SIZE,
+                             (void *)entry->code + JUMP_LABEL_NOP_SIZE);
 }
 
 void arch_jump_label_transform(struct jump_entry *entry,
@@ -45,7 +57,7 @@ void arch_jump_label_transform(struct jump_entry *entry,
 {
         get_online_cpus();
         mutex_lock(&text_mutex);
-        __jump_label_transform(entry, type, text_poke_smp);
+        __jump_label_transform(entry, type, NULL);
         mutex_unlock(&text_mutex);
         put_online_cpus();
 }
diff --git a/arch/x86/kernel/kprobes/common.h b/arch/x86/kernel/kprobes/common.h
index 2e9d4b5af036..c6ee63f927ab 100644
--- a/arch/x86/kernel/kprobes/common.h
+++ b/arch/x86/kernel/kprobes/common.h
@@ -82,14 +82,9 @@ extern void synthesize_reljump(void *from, void *to);
 extern void synthesize_relcall(void *from, void *to);
 
 #ifdef  CONFIG_OPTPROBES
-extern int arch_init_optprobes(void);
 extern int setup_detour_execution(struct kprobe *p, struct pt_regs *regs, int reenter);
 extern unsigned long __recover_optprobed_insn(kprobe_opcode_t *buf, unsigned long addr);
 #else   /* !CONFIG_OPTPROBES */
-static inline int arch_init_optprobes(void)
-{
-        return 0;
-}
 static inline int setup_detour_execution(struct kprobe *p, struct pt_regs *regs, int reenter)
 {
         return 0;
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 211bce445522..79a3f9682871 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -661,7 +661,7 @@ static void __used __kprobes kretprobe_trampoline_holder(void)
 /*
  * Called from kretprobe_trampoline
  */
-static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
+__visible __used __kprobes void *trampoline_handler(struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
@@ -1068,7 +1068,7 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
 
 int __init arch_init_kprobes(void)
 {
-        return arch_init_optprobes();
+        return 0;
 }
 
 int __kprobes arch_trampoline_kprobe(struct kprobe *p)
diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
index 76dc6f095724..898160b42e43 100644
--- a/arch/x86/kernel/kprobes/opt.c
+++ b/arch/x86/kernel/kprobes/opt.c
@@ -88,9 +88,7 @@ static void __kprobes synthesize_set_arg1(kprobe_opcode_t *addr, unsigned long v
         *(unsigned long *)addr = val;
 }
 
-static void __used __kprobes kprobes_optinsn_template_holder(void)
-{
-        asm volatile (
+asm (
                         ".global optprobe_template_entry\n"
                         "optprobe_template_entry:\n"
 #ifdef CONFIG_X86_64
@@ -129,7 +127,6 @@ static void __used __kprobes kprobes_optinsn_template_holder(void)
 #endif
                         ".global optprobe_template_end\n"
                         "optprobe_template_end:\n");
-}
 
 #define TMPL_MOVE_IDX \
         ((long)&optprobe_template_val - (long)&optprobe_template_entry)
@@ -371,31 +368,6 @@ int __kprobes arch_prepare_optimized_kprobe(struct optimized_kprobe *op)
         return 0;
 }
 
-#define MAX_OPTIMIZE_PROBES 256
-static struct text_poke_param *jump_poke_params;
-static struct jump_poke_buffer {
-        u8 buf[RELATIVEJUMP_SIZE];
-} *jump_poke_bufs;
-
-static void __kprobes setup_optimize_kprobe(struct text_poke_param *tprm,
-                                            u8 *insn_buf,
-                                            struct optimized_kprobe *op)
-{
-        s32 rel = (s32)((long)op->optinsn.insn -
-                        ((long)op->kp.addr + RELATIVEJUMP_SIZE));
-
-        /* Backup instructions which will be replaced by jump address */
-        memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
-               RELATIVE_ADDR_SIZE);
-
-        insn_buf[0] = RELATIVEJUMP_OPCODE;
-        *(s32 *)(&insn_buf[1]) = rel;
-
-        tprm->addr = op->kp.addr;
-        tprm->opcode = insn_buf;
-        tprm->len = RELATIVEJUMP_SIZE;
-}
-
 /*
  * Replace breakpoints (int3) with relative jumps.
  * Caller must call with locking kprobe_mutex and text_mutex.
@@ -403,37 +375,38 @@ static void __kprobes setup_optimize_kprobe(struct text_poke_param *tprm,
 void __kprobes arch_optimize_kprobes(struct list_head *oplist)
 {
         struct optimized_kprobe *op, *tmp;
-        int c = 0;
+        u8 insn_buf[RELATIVEJUMP_SIZE];
 
         list_for_each_entry_safe(op, tmp, oplist, list) {
+                s32 rel = (s32)((long)op->optinsn.insn -
+                        ((long)op->kp.addr + RELATIVEJUMP_SIZE));
+
                 WARN_ON(kprobe_disabled(&op->kp));
-                /* Setup param */
-                setup_optimize_kprobe(&jump_poke_params[c],
-                                      jump_poke_bufs[c].buf, op);
+
+                /* Backup instructions which will be replaced by jump address */
+                memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
+                       RELATIVE_ADDR_SIZE);
+
+                insn_buf[0] = RELATIVEJUMP_OPCODE;
+                *(s32 *)(&insn_buf[1]) = rel;
+
+                text_poke_bp(op->kp.addr, insn_buf, RELATIVEJUMP_SIZE,
+                             op->optinsn.insn);
+
                 list_del_init(&op->list);
-                if (++c >= MAX_OPTIMIZE_PROBES)
-                        break;
         }
-
-        /*
-         * text_poke_smp doesn't support NMI/MCE code modifying.
-         * However, since kprobes itself also doesn't support NMI/MCE
-         * code probing, it's not a problem.
-         */
-        text_poke_smp_batch(jump_poke_params, c);
 }
 
-static void __kprobes setup_unoptimize_kprobe(struct text_poke_param *tprm,
-                                              u8 *insn_buf,
-                                              struct optimized_kprobe *op)
+/* Replace a relative jump with a breakpoint (int3).  */
+void __kprobes arch_unoptimize_kprobe(struct optimized_kprobe *op)
 {
+        u8 insn_buf[RELATIVEJUMP_SIZE];
+
         /* Set int3 to first byte for kprobes */
         insn_buf[0] = BREAKPOINT_INSTRUCTION;
         memcpy(insn_buf + 1, op->optinsn.copied_insn, RELATIVE_ADDR_SIZE);
-
-        tprm->addr = op->kp.addr;
-        tprm->opcode = insn_buf;
-        tprm->len = RELATIVEJUMP_SIZE;
+        text_poke_bp(op->kp.addr, insn_buf, RELATIVEJUMP_SIZE,
+                     op->optinsn.insn);
 }
 
 /*
@@ -444,34 +417,11 @@ extern void arch_unoptimize_kprobes(struct list_head *oplist,
                                     struct list_head *done_list)
 {
         struct optimized_kprobe *op, *tmp;
-        int c = 0;
 
         list_for_each_entry_safe(op, tmp, oplist, list) {
-                /* Setup param */
-                setup_unoptimize_kprobe(&jump_poke_params[c],
-                                        jump_poke_bufs[c].buf, op);
+                arch_unoptimize_kprobe(op);
                 list_move(&op->list, done_list);
-                if (++c >= MAX_OPTIMIZE_PROBES)
-                        break;
         }
-
-        /*
-         * text_poke_smp doesn't support NMI/MCE code modifying.
-         * However, since kprobes itself also doesn't support NMI/MCE
-         * code probing, it's not a problem.
-         */
-        text_poke_smp_batch(jump_poke_params, c);
-}
-
-/* Replace a relative jump with a breakpoint (int3).  */
-void __kprobes arch_unoptimize_kprobe(struct optimized_kprobe *op)
-{
-        u8 buf[RELATIVEJUMP_SIZE];
-
-        /* Set int3 to first byte for kprobes */
-        buf[0] = BREAKPOINT_INSTRUCTION;
-        memcpy(buf + 1, op->optinsn.copied_insn, RELATIVE_ADDR_SIZE);
-        text_poke_smp(op->kp.addr, buf, RELATIVEJUMP_SIZE);
 }
 
 int  __kprobes
@@ -491,22 +441,3 @@ setup_detour_execution(struct kprobe *p, struct pt_regs *regs, int reenter)
         }
         return 0;
 }
-
-int __kprobes arch_init_optprobes(void)
-{
-        /* Allocate code buffer and parameter array */
-        jump_poke_bufs = kmalloc(sizeof(struct jump_poke_buffer) *
-                                 MAX_OPTIMIZE_PROBES, GFP_KERNEL);
-        if (!jump_poke_bufs)
-                return -ENOMEM;
-
-        jump_poke_params = kmalloc(sizeof(struct text_poke_param) *
-                                   MAX_OPTIMIZE_PROBES, GFP_KERNEL);
-        if (!jump_poke_params) {
-                kfree(jump_poke_bufs);
-                jump_poke_bufs = NULL;
-                return -ENOMEM;
-        }
-
-        return 0;
-}
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index a96d32cc55b8..697b93af02dd 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -34,6 +34,7 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/kprobes.h>
+#include <linux/debugfs.h>
 #include <asm/timer.h>
 #include <asm/cpu.h>
 #include <asm/traps.h>
@@ -419,6 +420,7 @@ static void __init kvm_smp_prepare_boot_cpu(void)
         WARN_ON(kvm_register_clock("primary cpu clock"));
         kvm_guest_cpu_init();
         native_smp_prepare_boot_cpu();
+        kvm_spinlock_init();
 }
 
 static void kvm_guest_cpu_online(void *dummy)
@@ -498,11 +500,9 @@ void __init kvm_guest_init(void)
 #endif
 }
 
-static bool __init kvm_detect(void)
+static uint32_t __init kvm_detect(void)
 {
-        if (!kvm_para_available())
-                return false;
-        return true;
+        return kvm_cpuid_base();
 }
 
 const struct hypervisor_x86 x86_hyper_kvm __refconst = {
@@ -523,3 +523,263 @@ static __init int activate_jump_labels(void)
         return 0;
 }
 arch_initcall(activate_jump_labels);
+
+#ifdef CONFIG_PARAVIRT_SPINLOCKS
+
+/* Kick a cpu by its apicid. Used to wake up a halted vcpu */
+static void kvm_kick_cpu(int cpu)
+{
+        int apicid;
+        unsigned long flags = 0;
+
+        apicid = per_cpu(x86_cpu_to_apicid, cpu);
+        kvm_hypercall2(KVM_HC_KICK_CPU, flags, apicid);
+}
+
+enum kvm_contention_stat {
+        TAKEN_SLOW,
+        TAKEN_SLOW_PICKUP,
+        RELEASED_SLOW,
+        RELEASED_SLOW_KICKED,
+        NR_CONTENTION_STATS
+};
+
+#ifdef CONFIG_KVM_DEBUG_FS
+#define HISTO_BUCKETS   30
+
+static struct kvm_spinlock_stats
+{
+        u32 contention_stats[NR_CONTENTION_STATS];
+        u32 histo_spin_blocked[HISTO_BUCKETS+1];
+        u64 time_blocked;
+} spinlock_stats;
+
+static u8 zero_stats;
+
+static inline void check_zero(void)
+{
+        u8 ret;
+        u8 old;
+
+        old = ACCESS_ONCE(zero_stats);
+        if (unlikely(old)) {
+                ret = cmpxchg(&zero_stats, old, 0);
+                /* This ensures only one fellow resets the stat */
+                if (ret == old)
+                        memset(&spinlock_stats, 0, sizeof(spinlock_stats));
+        }
+}
+
+static inline void add_stats(enum kvm_contention_stat var, u32 val)
+{
+        check_zero();
+        spinlock_stats.contention_stats[var] += val;
+}
+
+
+static inline u64 spin_time_start(void)
+{
+        return sched_clock();
+}
+
+static void __spin_time_accum(u64 delta, u32 *array)
+{
+        unsigned index;
+
+        index = ilog2(delta);
+        check_zero();
+
+        if (index < HISTO_BUCKETS)
+                array[index]++;
+        else
+                array[HISTO_BUCKETS]++;
+}
+
+static inline void spin_time_accum_blocked(u64 start)
+{
+        u32 delta;
+
+        delta = sched_clock() - start;
+        __spin_time_accum(delta, spinlock_stats.histo_spin_blocked);
+        spinlock_stats.time_blocked += delta;
+}
+
+static struct dentry *d_spin_debug;
+static struct dentry *d_kvm_debug;
+
+struct dentry *kvm_init_debugfs(void)
+{
+        d_kvm_debug = debugfs_create_dir("kvm", NULL);
+        if (!d_kvm_debug)
+                printk(KERN_WARNING "Could not create 'kvm' debugfs directory\n");
+
+        return d_kvm_debug;
+}
+
+static int __init kvm_spinlock_debugfs(void)
+{
+        struct dentry *d_kvm;
+
+        d_kvm = kvm_init_debugfs();
+        if (d_kvm == NULL)
+                return -ENOMEM;
+
+        d_spin_debug = debugfs_create_dir("spinlocks", d_kvm);
+
+        debugfs_create_u8("zero_stats", 0644, d_spin_debug, &zero_stats);
+
+        debugfs_create_u32("taken_slow", 0444, d_spin_debug,
+                   &spinlock_stats.contention_stats[TAKEN_SLOW]);
+        debugfs_create_u32("taken_slow_pickup", 0444, d_spin_debug,
+                   &spinlock_stats.contention_stats[TAKEN_SLOW_PICKUP]);
+
+        debugfs_create_u32("released_slow", 0444, d_spin_debug,
+                   &spinlock_stats.contention_stats[RELEASED_SLOW]);
+        debugfs_create_u32("released_slow_kicked", 0444, d_spin_debug,
+                   &spinlock_stats.contention_stats[RELEASED_SLOW_KICKED]);
+
+        debugfs_create_u64("time_blocked", 0444, d_spin_debug,
+                           &spinlock_stats.time_blocked);
+
+        debugfs_create_u32_array("histo_blocked", 0444, d_spin_debug,
+                     spinlock_stats.histo_spin_blocked, HISTO_BUCKETS + 1);
+
+        return 0;
+}
+fs_initcall(kvm_spinlock_debugfs);
+#else  /* !CONFIG_KVM_DEBUG_FS */
+static inline void add_stats(enum kvm_contention_stat var, u32 val)
+{
+}
+
+static inline u64 spin_time_start(void)
+{
+        return 0;
+}
+
+static inline void spin_time_accum_blocked(u64 start)
+{
+}
+#endif  /* CONFIG_KVM_DEBUG_FS */
+
+struct kvm_lock_waiting {
+        struct arch_spinlock *lock;
+        __ticket_t want;
+};
+
+/* cpus 'waiting' on a spinlock to become available */
+static cpumask_t waiting_cpus;
+
+/* Track spinlock on which a cpu is waiting */
+static DEFINE_PER_CPU(struct kvm_lock_waiting, klock_waiting);
+
+static void kvm_lock_spinning(struct arch_spinlock *lock, __ticket_t want)
+{
+        struct kvm_lock_waiting *w;
+        int cpu;
+        u64 start;
+        unsigned long flags;
+
+        if (in_nmi())
+                return;
+
+        w = &__get_cpu_var(klock_waiting);
+        cpu = smp_processor_id();
+        start = spin_time_start();
+
+        /*
+         * Make sure an interrupt handler can't upset things in a
+         * partially setup state.
+         */
+        local_irq_save(flags);
+
+        /*
+         * The ordering protocol on this is that the "lock" pointer
+         * may only be set non-NULL if the "want" ticket is correct.
+         * If we're updating "want", we must first clear "lock".
+         */
+        w->lock = NULL;
+        smp_wmb();
+        w->want = want;
+        smp_wmb();
+        w->lock = lock;
+
+        add_stats(TAKEN_SLOW, 1);
+
+        /*
+         * This uses set_bit, which is atomic but we should not rely on its
+         * reordering gurantees. So barrier is needed after this call.
+         */
+        cpumask_set_cpu(cpu, &waiting_cpus);
+
+        barrier();
+
+        /*
+         * Mark entry to slowpath before doing the pickup test to make
+         * sure we don't deadlock with an unlocker.
+         */
+        __ticket_enter_slowpath(lock);
+
+        /*
+         * check again make sure it didn't become free while
+         * we weren't looking.
+         */
+        if (ACCESS_ONCE(lock->tickets.head) == want) {
+                add_stats(TAKEN_SLOW_PICKUP, 1);
+                goto out;
+        }
+
+        /*
+         * halt until it's our turn and kicked. Note that we do safe halt
+         * for irq enabled case to avoid hang when lock info is overwritten
+         * in irq spinlock slowpath and no spurious interrupt occur to save us.
+         */
+        if (arch_irqs_disabled_flags(flags))
+                halt();
+        else
+                safe_halt();
+
+out:
+        cpumask_clear_cpu(cpu, &waiting_cpus);
+        w->lock = NULL;
+        local_irq_restore(flags);
+        spin_time_accum_blocked(start);
+}
+PV_CALLEE_SAVE_REGS_THUNK(kvm_lock_spinning);
+
+/* Kick vcpu waiting on @lock->head to reach value @ticket */
+static void kvm_unlock_kick(struct arch_spinlock *lock, __ticket_t ticket)
+{
+        int cpu;
+
+        add_stats(RELEASED_SLOW, 1);
+        for_each_cpu(cpu, &waiting_cpus) {
+                const struct kvm_lock_waiting *w = &per_cpu(klock_waiting, cpu);
+                if (ACCESS_ONCE(w->lock) == lock &&
+                    ACCESS_ONCE(w->want) == ticket) {
+                        add_stats(RELEASED_SLOW_KICKED, 1);
+                        kvm_kick_cpu(cpu);
+                        break;
+                }
+        }
+}
+
+/*
+ * Setup pv_lock_ops to exploit KVM_FEATURE_PV_UNHALT if present.
+ */
+void __init kvm_spinlock_init(void)
+{
+        if (!kvm_para_available())
+                return;
+        /* Does host kernel support KVM_FEATURE_PV_UNHALT? */
+        if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT))
+                return;
+
+        printk(KERN_INFO "KVM setup paravirtual spinlock\n");
+
+        static_key_slow_inc(&paravirt_ticketlocks_enabled);
+
+        pv_lock_ops.lock_spinning = PV_CALLEE_SAVE(kvm_lock_spinning);
+        pv_lock_ops.unlock_kick = kvm_unlock_kick;
+}
+#endif  /* CONFIG_PARAVIRT_SPINLOCKS */
diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
index 47ebb1dbfbcb..7123b5df479d 100644
--- a/arch/x86/kernel/microcode_amd.c
+++ b/arch/x86/kernel/microcode_amd.c
@@ -145,10 +145,9 @@ static int collect_cpu_info_amd(int cpu, struct cpu_signature *csig)
         return 0;
 }
 
-static unsigned int verify_patch_size(int cpu, u32 patch_size,
+static unsigned int verify_patch_size(u8 family, u32 patch_size,
                                       unsigned int size)
 {
-        struct cpuinfo_x86 *c = &cpu_data(cpu);
         u32 max_size;
 
 #define F1XH_MPB_MAX_SIZE 2048
@@ -156,7 +155,7 @@ static unsigned int verify_patch_size(int cpu, u32 patch_size,
 #define F15H_MPB_MAX_SIZE 4096
 #define F16H_MPB_MAX_SIZE 3458
 
-        switch (c->x86) {
+        switch (family) {
         case 0x14:
                 max_size = F14H_MPB_MAX_SIZE;
                 break;
@@ -220,12 +219,13 @@ int apply_microcode_amd(int cpu)
                 return 0;
         }
 
-        if (__apply_microcode_amd(mc_amd))
+        if (__apply_microcode_amd(mc_amd)) {
                 pr_err("CPU%d: update failed for patch_level=0x%08x\n",
                         cpu, mc_amd->hdr.patch_id);
-        else
-                pr_info("CPU%d: new patch_level=0x%08x\n", cpu,
-                        mc_amd->hdr.patch_id);
+                return -1;
+        }
+        pr_info("CPU%d: new patch_level=0x%08x\n", cpu,
+                mc_amd->hdr.patch_id);
 
         uci->cpu_sig.rev = mc_amd->hdr.patch_id;
         c->microcode = mc_amd->hdr.patch_id;
@@ -276,9 +276,8 @@ static void cleanup(void)
  * driver cannot continue functioning normally. In such cases, we tear
  * down everything we've used up so far and exit.
  */
-static int verify_and_add_patch(unsigned int cpu, u8 *fw, unsigned int leftover)
+static int verify_and_add_patch(u8 family, u8 *fw, unsigned int leftover)
 {
-        struct cpuinfo_x86 *c = &cpu_data(cpu);
         struct microcode_header_amd *mc_hdr;
         struct ucode_patch *patch;
         unsigned int patch_size, crnt_size, ret;
@@ -298,7 +297,7 @@ static int verify_and_add_patch(unsigned int cpu, u8 *fw, unsigned int leftover)
 
         /* check if patch is for the current family */
         proc_fam = ((proc_fam >> 8) & 0xf) + ((proc_fam >> 20) & 0xff);
-        if (proc_fam != c->x86)
+        if (proc_fam != family)
                 return crnt_size;
 
         if (mc_hdr->nb_dev_id || mc_hdr->sb_dev_id) {
@@ -307,7 +306,7 @@ static int verify_and_add_patch(unsigned int cpu, u8 *fw, unsigned int leftover)
                 return crnt_size;
         }
 
-        ret = verify_patch_size(cpu, patch_size, leftover);
+        ret = verify_patch_size(family, patch_size, leftover);
         if (!ret) {
                 pr_err("Patch-ID 0x%08x: size mismatch.\n", mc_hdr->patch_id);
                 return crnt_size;
@@ -338,7 +337,8 @@ static int verify_and_add_patch(unsigned int cpu, u8 *fw, unsigned int leftover)
         return crnt_size;
 }
 
-static enum ucode_state __load_microcode_amd(int cpu, const u8 *data, size_t size)
+static enum ucode_state __load_microcode_amd(u8 family, const u8 *data,
+                                             size_t size)
 {
         enum ucode_state ret = UCODE_ERROR;
         unsigned int leftover;
@@ -361,7 +361,7 @@ static enum ucode_state __load_microcode_amd(int cpu, const u8 *data, size_t siz
         }
 
         while (leftover) {
-                crnt_size = verify_and_add_patch(cpu, fw, leftover);
+                crnt_size = verify_and_add_patch(family, fw, leftover);
                 if (crnt_size < 0)
                         return ret;
 
@@ -372,22 +372,22 @@ static enum ucode_state __load_microcode_amd(int cpu, const u8 *data, size_t siz
         return UCODE_OK;
 }
 
-enum ucode_state load_microcode_amd(int cpu, const u8 *data, size_t size)
+enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size)
 {
         enum ucode_state ret;
 
         /* free old equiv table */
         free_equiv_cpu_table();
 
-        ret = __load_microcode_amd(cpu, data, size);
+        ret = __load_microcode_amd(family, data, size);
 
         if (ret != UCODE_OK)
                 cleanup();
 
 #if defined(CONFIG_MICROCODE_AMD_EARLY) && defined(CONFIG_X86_32)
         /* save BSP's matching patch for early load */
-        if (cpu_data(cpu).cpu_index == boot_cpu_data.cpu_index) {
-                struct ucode_patch *p = find_patch(cpu);
+        if (cpu_data(smp_processor_id()).cpu_index == boot_cpu_data.cpu_index) {
+                struct ucode_patch *p = find_patch(smp_processor_id());
                 if (p) {
                         memset(amd_bsp_mpb, 0, MPB_MAX_SIZE);
                         memcpy(amd_bsp_mpb, p->data, min_t(u32, ksize(p->data),
@@ -440,7 +440,7 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device,
                 goto fw_release;
         }
 
-        ret = load_microcode_amd(cpu, fw->data, fw->size);
+        ret = load_microcode_amd(c->x86, fw->data, fw->size);
 
  fw_release:
         release_firmware(fw);
diff --git a/arch/x86/kernel/microcode_amd_early.c b/arch/x86/kernel/microcode_amd_early.c
index 1d14ffee5749..6073104ccaa3 100644
--- a/arch/x86/kernel/microcode_amd_early.c
+++ b/arch/x86/kernel/microcode_amd_early.c
@@ -238,25 +238,17 @@ static void __init collect_cpu_sig_on_bsp(void *arg)
         uci->cpu_sig.sig = cpuid_eax(0x00000001);
 }
 #else
-static void collect_cpu_info_amd_early(struct cpuinfo_x86 *c,
-                                                 struct ucode_cpu_info *uci)
+void load_ucode_amd_ap(void)
 {
+        unsigned int cpu = smp_processor_id();
+        struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
         u32 rev, eax;
 
         rdmsr(MSR_AMD64_PATCH_LEVEL, rev, eax);
         eax = cpuid_eax(0x00000001);
 
-        uci->cpu_sig.sig = eax;
         uci->cpu_sig.rev = rev;
-        c->microcode = rev;
-        c->x86 = ((eax >> 8) & 0xf) + ((eax >> 20) & 0xff);
-}
-
-void load_ucode_amd_ap(void)
-{
-        unsigned int cpu = smp_processor_id();
-
-        collect_cpu_info_amd_early(&cpu_data(cpu), ucode_cpu_info + cpu);
+        uci->cpu_sig.sig = eax;
 
         if (cpu && !ucode_loaded) {
                 void *ucode;
@@ -265,8 +257,10 @@ void load_ucode_amd_ap(void)
                         return;
 
                 ucode = (void *)(initrd_start + ucode_offset);
-                if (load_microcode_amd(0, ucode, ucode_size) != UCODE_OK)
+                eax   = ((eax >> 8) & 0xf) + ((eax >> 20) & 0xff);
+                if (load_microcode_amd(eax, ucode, ucode_size) != UCODE_OK)
                         return;
+
                 ucode_loaded = true;
         }
 
@@ -278,6 +272,8 @@ int __init save_microcode_in_initrd_amd(void)
 {
         enum ucode_state ret;
         void *ucode;
+        u32 eax;
+
 #ifdef CONFIG_X86_32
         unsigned int bsp = boot_cpu_data.cpu_index;
         struct ucode_cpu_info *uci = ucode_cpu_info + bsp;
@@ -293,7 +289,10 @@ int __init save_microcode_in_initrd_amd(void)
                 return 0;
 
         ucode = (void *)(initrd_start + ucode_offset);
-        ret = load_microcode_amd(0, ucode, ucode_size);
+        eax   = cpuid_eax(0x00000001);
+        eax   = ((eax >> 8) & 0xf) + ((eax >> 20) & 0xff);
+
+        ret = load_microcode_amd(eax, ucode, ucode_size);
         if (ret != UCODE_OK)
                 return -EINVAL;
 
diff --git a/arch/x86/kernel/paravirt-spinlocks.c b/arch/x86/kernel/paravirt-spinlocks.c
index 676b8c77a976..bbb6c7316341 100644
--- a/arch/x86/kernel/paravirt-spinlocks.c
+++ b/arch/x86/kernel/paravirt-spinlocks.c
@@ -4,25 +4,17 @@
  */
 #include <linux/spinlock.h>
 #include <linux/module.h>
+#include <linux/jump_label.h>
 
 #include <asm/paravirt.h>
 
-static inline void
-default_spin_lock_flags(arch_spinlock_t *lock, unsigned long flags)
-{
-        arch_spin_lock(lock);
-}
-
 struct pv_lock_ops pv_lock_ops = {
 #ifdef CONFIG_SMP
-        .spin_is_locked = __ticket_spin_is_locked,
-        .spin_is_contended = __ticket_spin_is_contended,
-
-        .spin_lock = __ticket_spin_lock,
-        .spin_lock_flags = default_spin_lock_flags,
-        .spin_trylock = __ticket_spin_trylock,
-        .spin_unlock = __ticket_spin_unlock,
+        .lock_spinning = __PV_IS_CALLEE_SAVE(paravirt_nop),
+        .unlock_kick = paravirt_nop,
 #endif
 };
 EXPORT_SYMBOL(pv_lock_ops);
 
+struct static_key paravirt_ticketlocks_enabled = STATIC_KEY_INIT_FALSE;
+EXPORT_SYMBOL(paravirt_ticketlocks_enabled);
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index cd6de64cc480..1b10af835c31 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -62,11 +62,6 @@ void __init default_banner(void)
                pv_info.name);
 }
 
-/* Simple instruction patching code. */
-#define DEF_NATIVE(ops, name, code)                                     \
-        extern const char start_##ops##_##name[], end_##ops##_##name[]; \
-        asm("start_" #ops "_" #name ": " code "; end_" #ops "_" #name ":")
-
 /* Undefined instruction for dealing with missing ops pointers. */
 static const unsigned char ud2a[] = { 0x0f, 0x0b };
 
@@ -324,7 +319,7 @@ struct pv_time_ops pv_time_ops = {
         .steal_clock = native_steal_clock,
 };
 
-struct pv_irq_ops pv_irq_ops = {
+__visible struct pv_irq_ops pv_irq_ops = {
         .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
         .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
         .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
@@ -336,7 +331,7 @@ struct pv_irq_ops pv_irq_ops = {
 #endif
 };
 
-struct pv_cpu_ops pv_cpu_ops = {
+__visible struct pv_cpu_ops pv_cpu_ops = {
         .cpuid = native_cpuid,
         .get_debugreg = native_get_debugreg,
         .set_debugreg = native_set_debugreg,
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 83369e5a1d27..c83516be1052 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -36,7 +36,7 @@
  * section. Since TSS's are completely CPU-local, we want them
  * on exact cacheline boundaries, to eliminate cacheline ping-pong.
  */
-DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
+__visible DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
 
 #ifdef CONFIG_X86_64
 static DEFINE_PER_CPU(unsigned char, is_idle);
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index f8adefca71dc..884f98f69354 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -247,7 +247,7 @@ EXPORT_SYMBOL_GPL(start_thread);
  * the task-switch, and shows up in ret_from_fork in entry.S,
  * for example.
  */
-__notrace_funcgraph struct task_struct *
+__visible __notrace_funcgraph struct task_struct *
 __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
 {
         struct thread_struct *prev = &prev_p->thread,
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 05646bab4ca6..bb1dc51bab05 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -52,7 +52,7 @@
 
 asmlinkage extern void ret_from_fork(void);
 
-DEFINE_PER_CPU(unsigned long, old_rsp);
+asmlinkage DEFINE_PER_CPU(unsigned long, old_rsp);
 
 /* Prints also some state that isn't saved in the pt_regs */
 void __show_regs(struct pt_regs *regs, int all)
@@ -274,7 +274,7 @@ void start_thread_ia32(struct pt_regs *regs, u32 new_ip, u32 new_sp)
  * Kprobes not supported here. Set the probe on schedule instead.
  * Function graph tracer not supported too.
  */
-__notrace_funcgraph struct task_struct *
+__visible __notrace_funcgraph struct task_struct *
 __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
 {
         struct thread_struct *prev = &prev_p->thread;
diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
index 2cb9470ea85b..a16bae3f83b3 100644
--- a/arch/x86/kernel/pvclock.c
+++ b/arch/x86/kernel/pvclock.c
@@ -128,46 +128,7 @@ void pvclock_read_wallclock(struct pvclock_wall_clock *wall_clock,
         set_normalized_timespec(ts, now.tv_sec, now.tv_nsec);
 }
 
-static struct pvclock_vsyscall_time_info *pvclock_vdso_info;
-
-static struct pvclock_vsyscall_time_info *
-pvclock_get_vsyscall_user_time_info(int cpu)
-{
-        if (!pvclock_vdso_info) {
-                BUG();
-                return NULL;
-        }
-
-        return &pvclock_vdso_info[cpu];
-}
-
-struct pvclock_vcpu_time_info *pvclock_get_vsyscall_time_info(int cpu)
-{
-        return &pvclock_get_vsyscall_user_time_info(cpu)->pvti;
-}
-
 #ifdef CONFIG_X86_64
-static int pvclock_task_migrate(struct notifier_block *nb, unsigned long l,
-                                void *v)
-{
-        struct task_migration_notifier *mn = v;
-        struct pvclock_vsyscall_time_info *pvti;
-
-        pvti = pvclock_get_vsyscall_user_time_info(mn->from_cpu);
-
-        /* this is NULL when pvclock vsyscall is not initialized */
-        if (unlikely(pvti == NULL))
-                return NOTIFY_DONE;
-
-        pvti->migrate_count++;
-
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block pvclock_migrate = {
-        .notifier_call = pvclock_task_migrate,
-};
-
 /*
  * Initialize the generic pvclock vsyscall state.  This will allocate
  * a/some page(s) for the per-vcpu pvclock information, set up a
@@ -181,17 +142,12 @@ int __init pvclock_init_vsyscall(struct pvclock_vsyscall_time_info *i,
 
         WARN_ON (size != PVCLOCK_VSYSCALL_NR_PAGES*PAGE_SIZE);
 
-        pvclock_vdso_info = i;
-
         for (idx = 0; idx <= (PVCLOCK_FIXMAP_END-PVCLOCK_FIXMAP_BEGIN); idx++) {
                 __set_fixmap(PVCLOCK_FIXMAP_BEGIN + idx,
                              __pa(i) + (idx*PAGE_SIZE),
                              PAGE_KERNEL_VVAR);
         }
 
-
-        register_task_migration_notifier(&pvclock_migrate);
-
         return 0;
 }
 #endif
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index f8ec57815c05..f0de6294b955 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -206,9 +206,9 @@ EXPORT_SYMBOL(boot_cpu_data);
 
 
 #if !defined(CONFIG_X86_PAE) || defined(CONFIG_X86_64)
-unsigned long mmu_cr4_features;
+__visible unsigned long mmu_cr4_features;
 #else
-unsigned long mmu_cr4_features = X86_CR4_PAE;
+__visible unsigned long mmu_cr4_features = X86_CR4_PAE;
 #endif
 
 /* Boot loader ID and version as integers, for the benefit of proc_dointvec */
@@ -426,25 +426,23 @@ static void __init reserve_initrd(void)
 static void __init parse_setup_data(void)
 {
         struct setup_data *data;
-        u64 pa_data;
+        u64 pa_data, pa_next;
 
         pa_data = boot_params.hdr.setup_data;
         while (pa_data) {
-                u32 data_len, map_len;
+                u32 data_len, map_len, data_type;
 
                 map_len = max(PAGE_SIZE - (pa_data & ~PAGE_MASK),
                               (u64)sizeof(struct setup_data));
                 data = early_memremap(pa_data, map_len);
                 data_len = data->len + sizeof(struct setup_data);
-                if (data_len > map_len) {
-                        early_iounmap(data, map_len);
-                        data = early_memremap(pa_data, data_len);
-                        map_len = data_len;
-                }
+                data_type = data->type;
+                pa_next = data->next;
+                early_iounmap(data, map_len);
 
-                switch (data->type) {
+                switch (data_type) {
                 case SETUP_E820_EXT:
-                        parse_e820_ext(data);
+                        parse_e820_ext(pa_data, data_len);
                         break;
                 case SETUP_DTB:
                         add_dtb(pa_data);
@@ -452,8 +450,7 @@ static void __init parse_setup_data(void)
                 default:
                         break;
                 }
-                pa_data = data->next;
-                early_iounmap(data, map_len);
+                pa_data = pa_next;
         }
 }
 
@@ -1070,7 +1067,7 @@ void __init setup_arch(char **cmdline_p)
 
         cleanup_highmap();
 
-        memblock.current_limit = ISA_END_ADDRESS;
+        memblock_set_current_limit(ISA_END_ADDRESS);
         memblock_x86_fill();
 
         /*
@@ -1103,7 +1100,7 @@ void __init setup_arch(char **cmdline_p)
 
         setup_real_mode();
 
-        memblock.current_limit = get_max_mapped();
+        memblock_set_current_limit(get_max_mapped());
         dma_contiguous_reserve(0);
 
         /*
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index cf913587d4dd..9e5de6813e1f 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -358,7 +358,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
                 else
                         put_user_ex(0, &frame->uc.uc_flags);
                 put_user_ex(0, &frame->uc.uc_link);
-                err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
+                save_altstack_ex(&frame->uc.uc_stack, regs->sp);
 
                 /* Set up to return from userspace.  */
                 restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
@@ -423,7 +423,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
                 else
                         put_user_ex(0, &frame->uc.uc_flags);
                 put_user_ex(0, &frame->uc.uc_link);
-                err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
+                save_altstack_ex(&frame->uc.uc_stack, regs->sp);
 
                 /* Set up to return from userspace.  If provided, use a stub
                    already in userspace.  */
@@ -490,7 +490,7 @@ static int x32_setup_rt_frame(struct ksignal *ksig,
                 else
                         put_user_ex(0, &frame->uc.uc_flags);
                 put_user_ex(0, &frame->uc.uc_link);
-                err |= __compat_save_altstack(&frame->uc.uc_stack, regs->sp);
+                compat_save_altstack_ex(&frame->uc.uc_stack, regs->sp);
                 put_user_ex(0, &frame->uc.uc__pad0);
 
                 if (ksig->ka.sa.sa_flags & SA_RESTORER) {
@@ -533,7 +533,7 @@ static int x32_setup_rt_frame(struct ksignal *ksig,
  * Do a signal return; undo the signal stack.
  */
 #ifdef CONFIG_X86_32
-unsigned long sys_sigreturn(void)
+asmlinkage unsigned long sys_sigreturn(void)
 {
         struct pt_regs *regs = current_pt_regs();
         struct sigframe __user *frame;
@@ -562,7 +562,7 @@ badframe:
 }
 #endif /* CONFIG_X86_32 */
 
-long sys_rt_sigreturn(void)
+asmlinkage long sys_rt_sigreturn(void)
 {
         struct pt_regs *regs = current_pt_regs();
         struct rt_sigframe __user *frame;
@@ -728,7 +728,7 @@ static void do_signal(struct pt_regs *regs)
  * notification of userspace execution resumption
  * - triggered by the TIF_WORK_MASK flags
  */
-void
+__visible void
 do_notify_resume(struct pt_regs *regs, void *unused, __u32 thread_info_flags)
 {
         user_exit();
diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c
index cdaa347dfcad..7c3a5a61f2e4 100644
--- a/arch/x86/kernel/smp.c
+++ b/arch/x86/kernel/smp.c
@@ -256,7 +256,7 @@ static inline void __smp_reschedule_interrupt(void)
         scheduler_ipi();
 }
 
-void smp_reschedule_interrupt(struct pt_regs *regs)
+__visible void smp_reschedule_interrupt(struct pt_regs *regs)
 {
         ack_APIC_irq();
         __smp_reschedule_interrupt();
@@ -271,7 +271,7 @@ static inline void smp_entering_irq(void)
         irq_enter();
 }
 
-void smp_trace_reschedule_interrupt(struct pt_regs *regs)
+__visible void smp_trace_reschedule_interrupt(struct pt_regs *regs)
 {
         /*
          * Need to call irq_enter() before calling the trace point.
@@ -295,14 +295,14 @@ static inline void __smp_call_function_interrupt(void)
         inc_irq_stat(irq_call_count);
 }
 
-void smp_call_function_interrupt(struct pt_regs *regs)
+__visible void smp_call_function_interrupt(struct pt_regs *regs)
 {
         smp_entering_irq();
         __smp_call_function_interrupt();
         exiting_irq();
 }
 
-void smp_trace_call_function_interrupt(struct pt_regs *regs)
+__visible void smp_trace_call_function_interrupt(struct pt_regs *regs)
 {
         smp_entering_irq();
         trace_call_function_entry(CALL_FUNCTION_VECTOR);
@@ -317,14 +317,14 @@ static inline void __smp_call_function_single_interrupt(void)
         inc_irq_stat(irq_call_count);
 }
 
-void smp_call_function_single_interrupt(struct pt_regs *regs)
+__visible void smp_call_function_single_interrupt(struct pt_regs *regs)
 {
         smp_entering_irq();
         __smp_call_function_single_interrupt();
         exiting_irq();
 }
 
-void smp_trace_call_function_single_interrupt(struct pt_regs *regs)
+__visible void smp_trace_call_function_single_interrupt(struct pt_regs *regs)
 {
         smp_entering_irq();
         trace_call_function_single_entry(CALL_FUNCTION_SINGLE_VECTOR);
diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
index dbded5aedb81..30277e27431a 100644
--- a/arch/x86/kernel/sys_x86_64.c
+++ b/arch/x86/kernel/sys_x86_64.c
@@ -101,7 +101,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
                                 *begin = new_begin;
                 }
         } else {
-                *begin = TASK_UNMAPPED_BASE;
+                *begin = current->mm->mmap_legacy_base;
                 *end = TASK_SIZE;
         }
 }
diff --git a/arch/x86/kernel/syscall_32.c b/arch/x86/kernel/syscall_32.c
index 147fcd4941c4..e9bcd57d8a9e 100644
--- a/arch/x86/kernel/syscall_32.c
+++ b/arch/x86/kernel/syscall_32.c
@@ -15,7 +15,7 @@ typedef asmlinkage void (*sys_call_ptr_t)(void);
 
 extern asmlinkage void sys_ni_syscall(void);
 
-const sys_call_ptr_t sys_call_table[__NR_syscall_max+1] = {
+__visible const sys_call_ptr_t sys_call_table[__NR_syscall_max+1] = {
         /*
          * Smells like a compiler bug -- it doesn't work
          * when the & below is removed.
diff --git a/arch/x86/kernel/syscall_64.c b/arch/x86/kernel/syscall_64.c
index 5c7f8c20da74..4ac730b37f0b 100644
--- a/arch/x86/kernel/syscall_64.c
+++ b/arch/x86/kernel/syscall_64.c
@@ -4,6 +4,7 @@
 #include <linux/sys.h>
 #include <linux/cache.h>
 #include <asm/asm-offsets.h>
+#include <asm/syscall.h>
 
 #define __SYSCALL_COMMON(nr, sym, compat) __SYSCALL_64(nr, sym, compat)
 
@@ -19,11 +20,9 @@
 
 #define __SYSCALL_64(nr, sym, compat) [nr] = sym,
 
-typedef void (*sys_call_ptr_t)(void);
-
 extern void sys_ni_syscall(void);
 
-const sys_call_ptr_t sys_call_table[__NR_syscall_max+1] = {
+asmlinkage const sys_call_ptr_t sys_call_table[__NR_syscall_max+1] = {
         /*
          * Smells like a compiler bug -- it doesn't work
          * when the & below is removed.
diff --git a/arch/x86/kernel/sysfb.c b/arch/x86/kernel/sysfb.c
new file mode 100644
index 000000000000..193ec2ce46c7
--- /dev/null
+++ b/arch/x86/kernel/sysfb.c
@@ -0,0 +1,74 @@
+/*
+ * Generic System Framebuffers on x86
+ * Copyright (c) 2012-2013 David Herrmann <dh.herrmann@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+
+/*
+ * Simple-Framebuffer support for x86 systems
+ * Create a platform-device for any available boot framebuffer. The
+ * simple-framebuffer platform device is already available on DT systems, so
+ * this module parses the global "screen_info" object and creates a suitable
+ * platform device compatible with the "simple-framebuffer" DT object. If
+ * the framebuffer is incompatible, we instead create a legacy
+ * "vesa-framebuffer", "efi-framebuffer" or "platform-framebuffer" device and
+ * pass the screen_info as platform_data. This allows legacy drivers
+ * to pick these devices up without messing with simple-framebuffer drivers.
+ * The global "screen_info" is still valid at all times.
+ *
+ * If CONFIG_X86_SYSFB is not selected, we never register "simple-framebuffer"
+ * platform devices, but only use legacy framebuffer devices for
+ * backwards compatibility.
+ *
+ * TODO: We set the dev_id field of all platform-devices to 0. This allows
+ * other x86 OF/DT parsers to create such devices, too. However, they must
+ * start at offset 1 for this to work.
+ */
+
+#include <linux/err.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/platform_data/simplefb.h>
+#include <linux/platform_device.h>
+#include <linux/screen_info.h>
+#include <asm/sysfb.h>
+
+static __init int sysfb_init(void)
+{
+        struct screen_info *si = &screen_info;
+        struct simplefb_platform_data mode;
+        struct platform_device *pd;
+        const char *name;
+        bool compatible;
+        int ret;
+
+        sysfb_apply_efi_quirks();
+
+        /* try to create a simple-framebuffer device */
+        compatible = parse_mode(si, &mode);
+        if (compatible) {
+                ret = create_simplefb(si, &mode);
+                if (!ret)
+                        return 0;
+        }
+
+        /* if the FB is incompatible, create a legacy framebuffer device */
+        if (si->orig_video_isVGA == VIDEO_TYPE_EFI)
+                name = "efi-framebuffer";
+        else if (si->orig_video_isVGA == VIDEO_TYPE_VLFB)
+                name = "vesa-framebuffer";
+        else
+                name = "platform-framebuffer";
+
+        pd = platform_device_register_resndata(NULL, name, 0,
+                                               NULL, 0, si, sizeof(*si));
+        return IS_ERR(pd) ? PTR_ERR(pd) : 0;
+}
+
+/* must execute after PCI subsystem for EFI quirks */
+device_initcall(sysfb_init);
diff --git a/arch/x86/kernel/sysfb_efi.c b/arch/x86/kernel/sysfb_efi.c
new file mode 100644
index 000000000000..b285d4e8c68e
--- /dev/null
+++ b/arch/x86/kernel/sysfb_efi.c
@@ -0,0 +1,214 @@
+/*
+ * Generic System Framebuffers on x86
+ * Copyright (c) 2012-2013 David Herrmann <dh.herrmann@gmail.com>
+ *
+ * EFI Quirks Copyright (c) 2006 Edgar Hucek <gimli@dark-green.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+
+/*
+ * EFI Quirks
+ * Several EFI systems do not correctly advertise their boot framebuffers.
+ * Hence, we use this static table of known broken machines and fix up the
+ * information so framebuffer drivers can load corectly.
+ */
+
+#include <linux/dmi.h>
+#include <linux/err.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/pci.h>
+#include <linux/screen_info.h>
+#include <video/vga.h>
+#include <asm/sysfb.h>
+
+enum {
+        OVERRIDE_NONE = 0x0,
+        OVERRIDE_BASE = 0x1,
+        OVERRIDE_STRIDE = 0x2,
+        OVERRIDE_HEIGHT = 0x4,
+        OVERRIDE_WIDTH = 0x8,
+};
+
+struct efifb_dmi_info efifb_dmi_list[] = {
+        [M_I17] = { "i17", 0x80010000, 1472 * 4, 1440, 900, OVERRIDE_NONE },
+        [M_I20] = { "i20", 0x80010000, 1728 * 4, 1680, 1050, OVERRIDE_NONE }, /* guess */
+        [M_I20_SR] = { "imac7", 0x40010000, 1728 * 4, 1680, 1050, OVERRIDE_NONE },
+        [M_I24] = { "i24", 0x80010000, 2048 * 4, 1920, 1200, OVERRIDE_NONE }, /* guess */
+        [M_I24_8_1] = { "imac8", 0xc0060000, 2048 * 4, 1920, 1200, OVERRIDE_NONE },
+        [M_I24_10_1] = { "imac10", 0xc0010000, 2048 * 4, 1920, 1080, OVERRIDE_NONE },
+        [M_I27_11_1] = { "imac11", 0xc0010000, 2560 * 4, 2560, 1440, OVERRIDE_NONE },
+        [M_MINI]= { "mini", 0x80000000, 2048 * 4, 1024, 768, OVERRIDE_NONE },
+        [M_MINI_3_1] = { "mini31", 0x40010000, 1024 * 4, 1024, 768, OVERRIDE_NONE },
+        [M_MINI_4_1] = { "mini41", 0xc0010000, 2048 * 4, 1920, 1200, OVERRIDE_NONE },
+        [M_MB] = { "macbook", 0x80000000, 2048 * 4, 1280, 800, OVERRIDE_NONE },
+        [M_MB_5_1] = { "macbook51", 0x80010000, 2048 * 4, 1280, 800, OVERRIDE_NONE },
+        [M_MB_6_1] = { "macbook61", 0x80010000, 2048 * 4, 1280, 800, OVERRIDE_NONE },
+        [M_MB_7_1] = { "macbook71", 0x80010000, 2048 * 4, 1280, 800, OVERRIDE_NONE },
+        [M_MBA] = { "mba", 0x80000000, 2048 * 4, 1280, 800, OVERRIDE_NONE },
+        /* 11" Macbook Air 3,1 passes the wrong stride */
+        [M_MBA_3] = { "mba3", 0, 2048 * 4, 0, 0, OVERRIDE_STRIDE },
+        [M_MBP] = { "mbp", 0x80010000, 1472 * 4, 1440, 900, OVERRIDE_NONE },
+        [M_MBP_2] = { "mbp2", 0, 0, 0, 0, OVERRIDE_NONE }, /* placeholder */
+        [M_MBP_2_2] = { "mbp22", 0x80010000, 1472 * 4, 1440, 900, OVERRIDE_NONE },
+        [M_MBP_SR] = { "mbp3", 0x80030000, 2048 * 4, 1440, 900, OVERRIDE_NONE },
+        [M_MBP_4] = { "mbp4", 0xc0060000, 2048 * 4, 1920, 1200, OVERRIDE_NONE },
+        [M_MBP_5_1] = { "mbp51", 0xc0010000, 2048 * 4, 1440, 900, OVERRIDE_NONE },
+        [M_MBP_5_2] = { "mbp52", 0xc0010000, 2048 * 4, 1920, 1200, OVERRIDE_NONE },
+        [M_MBP_5_3] = { "mbp53", 0xd0010000, 2048 * 4, 1440, 900, OVERRIDE_NONE },
+        [M_MBP_6_1] = { "mbp61", 0x90030000, 2048 * 4, 1920, 1200, OVERRIDE_NONE },
+        [M_MBP_6_2] = { "mbp62", 0x90030000, 2048 * 4, 1680, 1050, OVERRIDE_NONE },
+        [M_MBP_7_1] = { "mbp71", 0xc0010000, 2048 * 4, 1280, 800, OVERRIDE_NONE },
+        [M_MBP_8_2] = { "mbp82", 0x90010000, 1472 * 4, 1440, 900, OVERRIDE_NONE },
+        [M_UNKNOWN] = { NULL, 0, 0, 0, 0, OVERRIDE_NONE }
+};
+
+#define choose_value(dmivalue, fwvalue, field, flags) ({        \
+                typeof(fwvalue) _ret_ = fwvalue;                \
+                if ((flags) & (field))                          \
+                        _ret_ = dmivalue;                       \
+                else if ((fwvalue) == 0)                        \
+                        _ret_ = dmivalue;                       \
+                _ret_;                                          \
+        })
+
+static int __init efifb_set_system(const struct dmi_system_id *id)
+{
+        struct efifb_dmi_info *info = id->driver_data;
+
+        if (info->base == 0 && info->height == 0 && info->width == 0 &&
+            info->stride == 0)
+                return 0;
+
+        /* Trust the bootloader over the DMI tables */
+        if (screen_info.lfb_base == 0) {
+#if defined(CONFIG_PCI)
+                struct pci_dev *dev = NULL;
+                int found_bar = 0;
+#endif
+                if (info->base) {
+                        screen_info.lfb_base = choose_value(info->base,
+                                screen_info.lfb_base, OVERRIDE_BASE,
+                                info->flags);
+
+#if defined(CONFIG_PCI)
+                        /* make sure that the address in the table is actually
+                         * on a VGA device's PCI BAR */
+
+                        for_each_pci_dev(dev) {
+                                int i;
+                                if ((dev->class >> 8) != PCI_CLASS_DISPLAY_VGA)
+                                        continue;
+                                for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
+                                        resource_size_t start, end;
+
+                                        start = pci_resource_start(dev, i);
+                                        if (start == 0)
+                                                break;
+                                        end = pci_resource_end(dev, i);
+                                        if (screen_info.lfb_base >= start &&
+                                            screen_info.lfb_base < end) {
+                                                found_bar = 1;
+                                        }
+                                }
+                        }
+                        if (!found_bar)
+                                screen_info.lfb_base = 0;
+#endif
+                }
+        }
+        if (screen_info.lfb_base) {
+                screen_info.lfb_linelength = choose_value(info->stride,
+                        screen_info.lfb_linelength, OVERRIDE_STRIDE,
+                        info->flags);
+                screen_info.lfb_width = choose_value(info->width,
+                        screen_info.lfb_width, OVERRIDE_WIDTH,
+                        info->flags);
+                screen_info.lfb_height = choose_value(info->height,
+                        screen_info.lfb_height, OVERRIDE_HEIGHT,
+                        info->flags);
+                if (screen_info.orig_video_isVGA == 0)
+                        screen_info.orig_video_isVGA = VIDEO_TYPE_EFI;
+        } else {
+                screen_info.lfb_linelength = 0;
+                screen_info.lfb_width = 0;
+                screen_info.lfb_height = 0;
+                screen_info.orig_video_isVGA = 0;
+                return 0;
+        }
+
+        printk(KERN_INFO "efifb: dmi detected %s - framebuffer at 0x%08x "
+                         "(%dx%d, stride %d)\n", id->ident,
+                         screen_info.lfb_base, screen_info.lfb_width,
+                         screen_info.lfb_height, screen_info.lfb_linelength);
+
+        return 1;
+}
+
+#define EFIFB_DMI_SYSTEM_ID(vendor, name, enumid)               \
+        {                                                       \
+                efifb_set_system,                               \
+                name,                                           \
+                {                                               \
+                        DMI_MATCH(DMI_BIOS_VENDOR, vendor),     \
+                        DMI_MATCH(DMI_PRODUCT_NAME, name)       \
+                },                                              \
+                &efifb_dmi_list[enumid]                         \
+        }
+
+static const struct dmi_system_id efifb_dmi_system_table[] __initconst = {
+        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "iMac4,1", M_I17),
+        /* At least one of these two will be right; maybe both? */
+        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "iMac5,1", M_I20),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac5,1", M_I20),
+        /* At least one of these two will be right; maybe both? */
+        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "iMac6,1", M_I24),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac6,1", M_I24),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac7,1", M_I20_SR),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac8,1", M_I24_8_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac10,1", M_I24_10_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac11,1", M_I27_11_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "Macmini1,1", M_MINI),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "Macmini3,1", M_MINI_3_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "Macmini4,1", M_MINI_4_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBook1,1", M_MB),
+        /* At least one of these two will be right; maybe both? */
+        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBook2,1", M_MB),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook2,1", M_MB),
+        /* At least one of these two will be right; maybe both? */
+        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBook3,1", M_MB),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook3,1", M_MB),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook4,1", M_MB),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook5,1", M_MB_5_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook6,1", M_MB_6_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook7,1", M_MB_7_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookAir1,1", M_MBA),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookAir3,1", M_MBA_3),
+        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro1,1", M_MBP),
+        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro2,1", M_MBP_2),
+        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro2,2", M_MBP_2_2),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro2,1", M_MBP_2),
+        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro3,1", M_MBP_SR),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro3,1", M_MBP_SR),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro4,1", M_MBP_4),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro5,1", M_MBP_5_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro5,2", M_MBP_5_2),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro5,3", M_MBP_5_3),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro6,1", M_MBP_6_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro6,2", M_MBP_6_2),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro7,1", M_MBP_7_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro8,2", M_MBP_8_2),
+        {},
+};
+
+__init void sysfb_apply_efi_quirks(void)
+{
+        if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI ||
+            !(screen_info.capabilities & VIDEO_CAPABILITY_SKIP_QUIRKS))
+                dmi_check_system(efifb_dmi_system_table);
+}
diff --git a/arch/x86/kernel/sysfb_simplefb.c b/arch/x86/kernel/sysfb_simplefb.c
new file mode 100644
index 000000000000..22513e96b012
--- /dev/null
+++ b/arch/x86/kernel/sysfb_simplefb.c
@@ -0,0 +1,95 @@
+/*
+ * Generic System Framebuffers on x86
+ * Copyright (c) 2012-2013 David Herrmann <dh.herrmann@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+
+/*
+ * simple-framebuffer probing
+ * Try to convert "screen_info" into a "simple-framebuffer" compatible mode.
+ * If the mode is incompatible, we return "false" and let the caller create
+ * legacy nodes instead.
+ */
+
+#include <linux/err.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/platform_data/simplefb.h>
+#include <linux/platform_device.h>
+#include <linux/screen_info.h>
+#include <asm/sysfb.h>
+
+static const char simplefb_resname[] = "BOOTFB";
+static const struct simplefb_format formats[] = SIMPLEFB_FORMATS;
+
+/* try parsing x86 screen_info into a simple-framebuffer mode struct */
+__init bool parse_mode(const struct screen_info *si,
+                       struct simplefb_platform_data *mode)
+{
+        const struct simplefb_format *f;
+        __u8 type;
+        unsigned int i;
+
+        type = si->orig_video_isVGA;
+        if (type != VIDEO_TYPE_VLFB && type != VIDEO_TYPE_EFI)
+                return false;
+
+        for (i = 0; i < ARRAY_SIZE(formats); ++i) {
+                f = &formats[i];
+                if (si->lfb_depth == f->bits_per_pixel &&
+                    si->red_size == f->red.length &&
+                    si->red_pos == f->red.offset &&
+                    si->green_size == f->green.length &&
+                    si->green_pos == f->green.offset &&
+                    si->blue_size == f->blue.length &&
+                    si->blue_pos == f->blue.offset &&
+                    si->rsvd_size == f->transp.length &&
+                    si->rsvd_pos == f->transp.offset) {
+                        mode->format = f->name;
+                        mode->width = si->lfb_width;
+                        mode->height = si->lfb_height;
+                        mode->stride = si->lfb_linelength;
+                        return true;
+                }
+        }
+
+        return false;
+}
+
+__init int create_simplefb(const struct screen_info *si,
+                           const struct simplefb_platform_data *mode)
+{
+        struct platform_device *pd;
+        struct resource res;
+        unsigned long len;
+
+        /* don't use lfb_size as it may contain the whole VMEM instead of only
+         * the part that is occupied by the framebuffer */
+        len = mode->height * mode->stride;
+        len = PAGE_ALIGN(len);
+        if (len > si->lfb_size << 16) {
+                printk(KERN_WARNING "sysfb: VRAM smaller than advertised\n");
+                return -EINVAL;
+        }
+
+        /* setup IORESOURCE_MEM as framebuffer memory */
+        memset(&res, 0, sizeof(res));
+        res.flags = IORESOURCE_MEM;
+        res.name = simplefb_resname;
+        res.start = si->lfb_base;
+        res.end = si->lfb_base + len - 1;
+        if (res.end <= res.start)
+                return -EINVAL;
+
+        pd = platform_device_register_resndata(NULL, "simple-framebuffer", 0,
+                                               &res, 1, mode, sizeof(*mode));
+        if (IS_ERR(pd))
+                return PTR_ERR(pd);
+
+        return 0;
+}
diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
index addf7b58f4e8..91a4496db434 100644
--- a/arch/x86/kernel/tboot.c
+++ b/arch/x86/kernel/tboot.c
@@ -301,6 +301,15 @@ static int tboot_sleep(u8 sleep_state, u32 pm1a_control, u32 pm1b_control)
         return 0;
 }
 
+static int tboot_extended_sleep(u8 sleep_state, u32 val_a, u32 val_b)
+{
+        if (!tboot_enabled())
+                return 0;
+
+        pr_warning("tboot is not able to suspend on platforms with reduced hardware sleep (ACPIv5)");
+        return -ENODEV;
+}
+
 static atomic_t ap_wfs_count;
 
 static int tboot_wait_for_aps(int num_aps)
@@ -422,6 +431,7 @@ static __init int tboot_late_init(void)
 #endif
 
         acpi_os_set_prepare_sleep(&tboot_sleep);
+        acpi_os_set_prepare_extended_sleep(&tboot_extended_sleep);
         return 0;
 }
 
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 1b23a1c92746..8c8093b146ca 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -58,6 +58,7 @@
 #include <asm/mce.h>
 #include <asm/fixmap.h>
 #include <asm/mach_traps.h>
+#include <asm/alternative.h>
 
 #ifdef CONFIG_X86_64
 #include <asm/x86_init.h>
@@ -327,6 +328,9 @@ dotraplinkage void __kprobes notrace do_int3(struct pt_regs *regs, long error_co
             ftrace_int3_handler(regs))
                 return;
 #endif
+        if (poke_int3_handler(regs))
+                return;
+
         prev_state = exception_enter();
 #ifdef CONFIG_KGDB_LOW_LEVEL_TRAP
         if (kgdb_ll_trap(DIE_INT3, "int3", regs, error_code, X86_TRAP_BP,
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 6ff49247edf8..930e5d48f560 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -89,6 +89,12 @@ int check_tsc_unstable(void)
 }
 EXPORT_SYMBOL_GPL(check_tsc_unstable);
 
+int check_tsc_disabled(void)
+{
+        return tsc_disabled;
+}
+EXPORT_SYMBOL_GPL(check_tsc_disabled);
+
 #ifdef CONFIG_X86_TSC
 int __init notsc_setup(char *str)
 {
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index a20ecb5b6cbf..b110fe6c03d4 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -413,7 +413,8 @@ static int do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
                              (1 << KVM_FEATURE_CLOCKSOURCE2) |
                              (1 << KVM_FEATURE_ASYNC_PF) |
                              (1 << KVM_FEATURE_PV_EOI) |
-                             (1 << KVM_FEATURE_CLOCKSOURCE_STABLE_BIT);
+                             (1 << KVM_FEATURE_CLOCKSOURCE_STABLE_BIT) |
+                             (1 << KVM_FEATURE_PV_UNHALT);
 
                 if (sched_info_on())
                         entry->eax |= (1 << KVM_FEATURE_STEAL_TIME);
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index afc11245827c..5439117d5c4c 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -79,16 +79,6 @@ static inline void apic_set_reg(struct kvm_lapic *apic, int reg_off, u32 val)
         *((u32 *) (apic->regs + reg_off)) = val;
 }
 
-static inline int apic_test_and_set_vector(int vec, void *bitmap)
-{
-        return test_and_set_bit(VEC_POS(vec), (bitmap) + REG_POS(vec));
-}
-
-static inline int apic_test_and_clear_vector(int vec, void *bitmap)
-{
-        return test_and_clear_bit(VEC_POS(vec), (bitmap) + REG_POS(vec));
-}
-
 static inline int apic_test_vector(int vec, void *bitmap)
 {
         return test_bit(VEC_POS(vec), (bitmap) + REG_POS(vec));
@@ -331,10 +321,10 @@ void kvm_apic_update_irr(struct kvm_vcpu *vcpu, u32 *pir)
 }
 EXPORT_SYMBOL_GPL(kvm_apic_update_irr);
 
-static inline int apic_test_and_set_irr(int vec, struct kvm_lapic *apic)
+static inline void apic_set_irr(int vec, struct kvm_lapic *apic)
 {
         apic->irr_pending = true;
-        return apic_test_and_set_vector(vec, apic->regs + APIC_IRR);
+        apic_set_vector(vec, apic->regs + APIC_IRR);
 }
 
 static inline int apic_search_irr(struct kvm_lapic *apic)
@@ -681,32 +671,28 @@ static int __apic_accept_irq(struct kvm_lapic *apic, int delivery_mode,
                 if (unlikely(!apic_enabled(apic)))
                         break;
 
+                result = 1;
+
                 if (dest_map)
                         __set_bit(vcpu->vcpu_id, dest_map);
 
-                if (kvm_x86_ops->deliver_posted_interrupt) {
-                        result = 1;
+                if (kvm_x86_ops->deliver_posted_interrupt)
                         kvm_x86_ops->deliver_posted_interrupt(vcpu, vector);
-                } else {
-                        result = !apic_test_and_set_irr(vector, apic);
-
-                        if (!result) {
-                                if (trig_mode)
-                                        apic_debug("level trig mode repeatedly "
-                                                "for vector %d", vector);
-                                goto out;
-                        }
+                else {
+                        apic_set_irr(vector, apic);
 
                         kvm_make_request(KVM_REQ_EVENT, vcpu);
                         kvm_vcpu_kick(vcpu);
                 }
-out:
                 trace_kvm_apic_accept_irq(vcpu->vcpu_id, delivery_mode,
-                                trig_mode, vector, !result);
+                                          trig_mode, vector, false);
                 break;
 
         case APIC_DM_REMRD:
-                apic_debug("Ignoring delivery mode 3\n");
+                result = 1;
+                vcpu->arch.pv.pv_unhalted = 1;
+                kvm_make_request(KVM_REQ_EVENT, vcpu);
+                kvm_vcpu_kick(vcpu);
                 break;
 
         case APIC_DM_SMI:
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 9e9285ae9b94..6e2d2c8f230b 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -132,8 +132,8 @@ module_param(dbg, bool, 0644);
         (PAGE_MASK & ~((1ULL << (PAGE_SHIFT + (((level) - 1) \
                                             * PT32_LEVEL_BITS))) - 1))
 
-#define PT64_PERM_MASK (PT_PRESENT_MASK | PT_WRITABLE_MASK | PT_USER_MASK \
-                        | PT64_NX_MASK)
+#define PT64_PERM_MASK (PT_PRESENT_MASK | PT_WRITABLE_MASK | shadow_user_mask \
+                        | shadow_x_mask | shadow_nx_mask)
 
 #define ACC_EXEC_MASK    1
 #define ACC_WRITE_MASK   PT_WRITABLE_MASK
@@ -331,11 +331,6 @@ static int is_large_pte(u64 pte)
         return pte & PT_PAGE_SIZE_MASK;
 }
 
-static int is_dirty_gpte(unsigned long pte)
-{
-        return pte & PT_DIRTY_MASK;
-}
-
 static int is_rmap_spte(u64 pte)
 {
         return is_shadow_present_pte(pte);
@@ -2052,12 +2047,18 @@ static void shadow_walk_next(struct kvm_shadow_walk_iterator *iterator)
         return __shadow_walk_next(iterator, *iterator->sptep);
 }
 
-static void link_shadow_page(u64 *sptep, struct kvm_mmu_page *sp)
+static void link_shadow_page(u64 *sptep, struct kvm_mmu_page *sp, bool accessed)
 {
         u64 spte;
 
+        BUILD_BUG_ON(VMX_EPT_READABLE_MASK != PT_PRESENT_MASK ||
+                        VMX_EPT_WRITABLE_MASK != PT_WRITABLE_MASK);
+
         spte = __pa(sp->spt) | PT_PRESENT_MASK | PT_WRITABLE_MASK |
-               shadow_user_mask | shadow_x_mask | shadow_accessed_mask;
+               shadow_user_mask | shadow_x_mask;
+
+        if (accessed)
+                spte |= shadow_accessed_mask;
 
         mmu_spte_set(sptep, spte);
 }
@@ -2574,14 +2575,6 @@ static void nonpaging_new_cr3(struct kvm_vcpu *vcpu)
         mmu_free_roots(vcpu);
 }
 
-static bool is_rsvd_bits_set(struct kvm_mmu *mmu, u64 gpte, int level)
-{
-        int bit7;
-
-        bit7 = (gpte >> 7) & 1;
-        return (gpte & mmu->rsvd_bits_mask[bit7][level-1]) != 0;
-}
-
 static pfn_t pte_prefetch_gfn_to_pfn(struct kvm_vcpu *vcpu, gfn_t gfn,
                                      bool no_dirty_log)
 {
@@ -2594,26 +2587,6 @@ static pfn_t pte_prefetch_gfn_to_pfn(struct kvm_vcpu *vcpu, gfn_t gfn,
         return gfn_to_pfn_memslot_atomic(slot, gfn);
 }
 
-static bool prefetch_invalid_gpte(struct kvm_vcpu *vcpu,
-                                  struct kvm_mmu_page *sp, u64 *spte,
-                                  u64 gpte)
-{
-        if (is_rsvd_bits_set(&vcpu->arch.mmu, gpte, PT_PAGE_TABLE_LEVEL))
-                goto no_present;
-
-        if (!is_present_gpte(gpte))
-                goto no_present;
-
-        if (!(gpte & PT_ACCESSED_MASK))
-                goto no_present;
-
-        return false;
-
-no_present:
-        drop_spte(vcpu->kvm, spte);
-        return true;
-}
-
 static int direct_pte_prefetch_many(struct kvm_vcpu *vcpu,
                                     struct kvm_mmu_page *sp,
                                     u64 *start, u64 *end)
@@ -2710,7 +2683,7 @@ static int __direct_map(struct kvm_vcpu *vcpu, gpa_t v, int write,
                                               iterator.level - 1,
                                               1, ACC_ALL, iterator.sptep);
 
-                        link_shadow_page(iterator.sptep, sp);
+                        link_shadow_page(iterator.sptep, sp, true);
                 }
         }
         return emulate;
@@ -2808,7 +2781,7 @@ exit:
         return ret;
 }
 
-static bool page_fault_can_be_fast(struct kvm_vcpu *vcpu, u32 error_code)
+static bool page_fault_can_be_fast(u32 error_code)
 {
         /*
          * Do not fix the mmio spte with invalid generation number which
@@ -2861,7 +2834,7 @@ static bool fast_page_fault(struct kvm_vcpu *vcpu, gva_t gva, int level,
         bool ret = false;
         u64 spte = 0ull;
 
-        if (!page_fault_can_be_fast(vcpu, error_code))
+        if (!page_fault_can_be_fast(error_code))
                 return false;
 
         walk_shadow_page_lockless_begin(vcpu);
@@ -3209,6 +3182,7 @@ void kvm_mmu_sync_roots(struct kvm_vcpu *vcpu)
         mmu_sync_roots(vcpu);
         spin_unlock(&vcpu->kvm->mmu_lock);
 }
+EXPORT_SYMBOL_GPL(kvm_mmu_sync_roots);
 
 static gpa_t nonpaging_gva_to_gpa(struct kvm_vcpu *vcpu, gva_t vaddr,
                                   u32 access, struct x86_exception *exception)
@@ -3478,6 +3452,7 @@ void kvm_mmu_flush_tlb(struct kvm_vcpu *vcpu)
         ++vcpu->stat.tlb_flush;
         kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
 }
+EXPORT_SYMBOL_GPL(kvm_mmu_flush_tlb);
 
 static void paging_new_cr3(struct kvm_vcpu *vcpu)
 {
@@ -3501,18 +3476,6 @@ static void paging_free(struct kvm_vcpu *vcpu)
         nonpaging_free(vcpu);
 }
 
-static inline void protect_clean_gpte(unsigned *access, unsigned gpte)
-{
-        unsigned mask;
-
-        BUILD_BUG_ON(PT_WRITABLE_MASK != ACC_WRITE_MASK);
-
-        mask = (unsigned)~ACC_WRITE_MASK;
-        /* Allow write access to dirty gptes */
-        mask |= (gpte >> (PT_DIRTY_SHIFT - PT_WRITABLE_SHIFT)) & PT_WRITABLE_MASK;
-        *access &= mask;
-}
-
 static bool sync_mmio_spte(struct kvm *kvm, u64 *sptep, gfn_t gfn,
                            unsigned access, int *nr_present)
 {
@@ -3530,16 +3493,6 @@ static bool sync_mmio_spte(struct kvm *kvm, u64 *sptep, gfn_t gfn,
         return false;
 }
 
-static inline unsigned gpte_access(struct kvm_vcpu *vcpu, u64 gpte)
-{
-        unsigned access;
-
-        access = (gpte & (PT_WRITABLE_MASK | PT_USER_MASK)) | ACC_EXEC_MASK;
-        access &= ~(gpte >> PT64_NX_SHIFT);
-
-        return access;
-}
-
 static inline bool is_last_gpte(struct kvm_mmu *mmu, unsigned level, unsigned gpte)
 {
         unsigned index;
@@ -3549,6 +3502,11 @@ static inline bool is_last_gpte(struct kvm_mmu *mmu, unsigned level, unsigned gp
         return mmu->last_pte_bitmap & (1 << index);
 }
 
+#define PTTYPE_EPT 18 /* arbitrary */
+#define PTTYPE PTTYPE_EPT
+#include "paging_tmpl.h"
+#undef PTTYPE
+
 #define PTTYPE 64
 #include "paging_tmpl.h"
 #undef PTTYPE
@@ -3563,6 +3521,8 @@ static void reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
         int maxphyaddr = cpuid_maxphyaddr(vcpu);
         u64 exb_bit_rsvd = 0;
 
+        context->bad_mt_xwr = 0;
+
         if (!context->nx)
                 exb_bit_rsvd = rsvd_bits(63, 63);
         switch (context->root_level) {
@@ -3618,7 +3578,40 @@ static void reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
         }
 }
 
-static void update_permission_bitmask(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu)
+static void reset_rsvds_bits_mask_ept(struct kvm_vcpu *vcpu,
+                struct kvm_mmu *context, bool execonly)
+{
+        int maxphyaddr = cpuid_maxphyaddr(vcpu);
+        int pte;
+
+        context->rsvd_bits_mask[0][3] =
+                rsvd_bits(maxphyaddr, 51) | rsvd_bits(3, 7);
+        context->rsvd_bits_mask[0][2] =
+                rsvd_bits(maxphyaddr, 51) | rsvd_bits(3, 6);
+        context->rsvd_bits_mask[0][1] =
+                rsvd_bits(maxphyaddr, 51) | rsvd_bits(3, 6);
+        context->rsvd_bits_mask[0][0] = rsvd_bits(maxphyaddr, 51);
+
+        /* large page */
+        context->rsvd_bits_mask[1][3] = context->rsvd_bits_mask[0][3];
+        context->rsvd_bits_mask[1][2] =
+                rsvd_bits(maxphyaddr, 51) | rsvd_bits(12, 29);
+        context->rsvd_bits_mask[1][1] =
+                rsvd_bits(maxphyaddr, 51) | rsvd_bits(12, 20);
+        context->rsvd_bits_mask[1][0] = context->rsvd_bits_mask[0][0];
+
+        for (pte = 0; pte < 64; pte++) {
+                int rwx_bits = pte & 7;
+                int mt = pte >> 3;
+                if (mt == 0x2 || mt == 0x3 || mt == 0x7 ||
+                                rwx_bits == 0x2 || rwx_bits == 0x6 ||
+                                (rwx_bits == 0x4 && !execonly))
+                        context->bad_mt_xwr |= (1ull << pte);
+        }
+}
+
+static void update_permission_bitmask(struct kvm_vcpu *vcpu,
+                struct kvm_mmu *mmu, bool ept)
 {
         unsigned bit, byte, pfec;
         u8 map;
@@ -3636,12 +3629,16 @@ static void update_permission_bitmask(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu
                         w = bit & ACC_WRITE_MASK;
                         u = bit & ACC_USER_MASK;
 
-                        /* Not really needed: !nx will cause pte.nx to fault */
-                        x |= !mmu->nx;
-                        /* Allow supervisor writes if !cr0.wp */
-                        w |= !is_write_protection(vcpu) && !uf;
-                        /* Disallow supervisor fetches of user code if cr4.smep */
-                        x &= !(smep && u && !uf);
+                        if (!ept) {
+                                /* Not really needed: !nx will cause pte.nx to fault */
+                                x |= !mmu->nx;
+                                /* Allow supervisor writes if !cr0.wp */
+                                w |= !is_write_protection(vcpu) && !uf;
+                                /* Disallow supervisor fetches of user code if cr4.smep */
+                                x &= !(smep && u && !uf);
+                        } else
+                                /* Not really needed: no U/S accesses on ept  */
+                                u = 1;
 
                         fault = (ff && !x) || (uf && !u) || (wf && !w);
                         map |= fault << bit;
@@ -3676,7 +3673,7 @@ static int paging64_init_context_common(struct kvm_vcpu *vcpu,
         context->root_level = level;
 
         reset_rsvds_bits_mask(vcpu, context);
-        update_permission_bitmask(vcpu, context);
+        update_permission_bitmask(vcpu, context, false);
         update_last_pte_bitmap(vcpu, context);
 
         ASSERT(is_pae(vcpu));
@@ -3706,7 +3703,7 @@ static int paging32_init_context(struct kvm_vcpu *vcpu,
         context->root_level = PT32_ROOT_LEVEL;
 
         reset_rsvds_bits_mask(vcpu, context);
-        update_permission_bitmask(vcpu, context);
+        update_permission_bitmask(vcpu, context, false);
         update_last_pte_bitmap(vcpu, context);
 
         context->new_cr3 = paging_new_cr3;
@@ -3768,7 +3765,7 @@ static int init_kvm_tdp_mmu(struct kvm_vcpu *vcpu)
                 context->gva_to_gpa = paging32_gva_to_gpa;
         }
 
-        update_permission_bitmask(vcpu, context);
+        update_permission_bitmask(vcpu, context, false);
         update_last_pte_bitmap(vcpu, context);
 
         return 0;
@@ -3800,6 +3797,33 @@ int kvm_init_shadow_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context)
 }
 EXPORT_SYMBOL_GPL(kvm_init_shadow_mmu);
 
+int kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context,
+                bool execonly)
+{
+        ASSERT(vcpu);
+        ASSERT(!VALID_PAGE(vcpu->arch.mmu.root_hpa));
+
+        context->shadow_root_level = kvm_x86_ops->get_tdp_level();
+
+        context->nx = true;
+        context->new_cr3 = paging_new_cr3;
+        context->page_fault = ept_page_fault;
+        context->gva_to_gpa = ept_gva_to_gpa;
+        context->sync_page = ept_sync_page;
+        context->invlpg = ept_invlpg;
+        context->update_pte = ept_update_pte;
+        context->free = paging_free;
+        context->root_level = context->shadow_root_level;
+        context->root_hpa = INVALID_PAGE;
+        context->direct_map = false;
+
+        update_permission_bitmask(vcpu, context, true);
+        reset_rsvds_bits_mask_ept(vcpu, context, execonly);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(kvm_init_shadow_ept_mmu);
+
 static int init_kvm_softmmu(struct kvm_vcpu *vcpu)
 {
         int r = kvm_init_shadow_mmu(vcpu, vcpu->arch.walk_mmu);
@@ -3847,7 +3871,7 @@ static int init_kvm_nested_mmu(struct kvm_vcpu *vcpu)
                 g_context->gva_to_gpa = paging32_gva_to_gpa_nested;
         }
 
-        update_permission_bitmask(vcpu, g_context);
+        update_permission_bitmask(vcpu, g_context, false);
         update_last_pte_bitmap(vcpu, g_context);
 
         return 0;
@@ -3923,8 +3947,8 @@ static bool need_remote_flush(u64 old, u64 new)
                 return true;
         if ((old ^ new) & PT64_BASE_ADDR_MASK)
                 return true;
-        old ^= PT64_NX_MASK;
-        new ^= PT64_NX_MASK;
+        old ^= shadow_nx_mask;
+        new ^= shadow_nx_mask;
         return (old & ~new & PT64_PERM_MASK) != 0;
 }
 
@@ -4182,7 +4206,7 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u32 error_code,
         switch (er) {
         case EMULATE_DONE:
                 return 1;
-        case EMULATE_DO_MMIO:
+        case EMULATE_USER_EXIT:
                 ++vcpu->stat.mmio_exits;
                 /* fall through */
         case EMULATE_FAIL:
@@ -4390,11 +4414,8 @@ void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm)
         /*
          * The very rare case: if the generation-number is round,
          * zap all shadow pages.
-         *
-         * The max value is MMIO_MAX_GEN - 1 since it is not called
-         * when mark memslot invalid.
          */
-        if (unlikely(kvm_current_mmio_generation(kvm) >= (MMIO_MAX_GEN - 1))) {
+        if (unlikely(kvm_current_mmio_generation(kvm) >= MMIO_MAX_GEN)) {
                 printk_ratelimited(KERN_INFO "kvm: zapping shadow pages for mmio generation wraparound\n");
                 kvm_mmu_invalidate_zap_all_pages(kvm);
         }
diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
index 5b59c573aba7..77e044a0f5f7 100644
--- a/arch/x86/kvm/mmu.h
+++ b/arch/x86/kvm/mmu.h
@@ -71,6 +71,8 @@ enum {
 
 int handle_mmio_page_fault_common(struct kvm_vcpu *vcpu, u64 addr, bool direct);
 int kvm_init_shadow_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context);
+int kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context,
+                bool execonly);
 
 static inline unsigned int kvm_mmu_available_pages(struct kvm *kvm)
 {
diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 7769699d48a8..043330159179 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -23,6 +23,13 @@
  * so the code in this file is compiled twice, once per pte size.
  */
 
+/*
+ * This is used to catch non optimized PT_GUEST_(DIRTY|ACCESS)_SHIFT macro
+ * uses for EPT without A/D paging type.
+ */
+extern u64 __pure __using_nonexistent_pte_bit(void)
+               __compiletime_error("wrong use of PT_GUEST_(DIRTY|ACCESS)_SHIFT");
+
 #if PTTYPE == 64
         #define pt_element_t u64
         #define guest_walker guest_walker64
@@ -32,6 +39,10 @@
         #define PT_LVL_OFFSET_MASK(lvl) PT64_LVL_OFFSET_MASK(lvl)
         #define PT_INDEX(addr, level) PT64_INDEX(addr, level)
         #define PT_LEVEL_BITS PT64_LEVEL_BITS
+        #define PT_GUEST_ACCESSED_MASK PT_ACCESSED_MASK
+        #define PT_GUEST_DIRTY_MASK PT_DIRTY_MASK
+        #define PT_GUEST_DIRTY_SHIFT PT_DIRTY_SHIFT
+        #define PT_GUEST_ACCESSED_SHIFT PT_ACCESSED_SHIFT
         #ifdef CONFIG_X86_64
         #define PT_MAX_FULL_LEVELS 4
         #define CMPXCHG cmpxchg
@@ -49,7 +60,26 @@
         #define PT_INDEX(addr, level) PT32_INDEX(addr, level)
         #define PT_LEVEL_BITS PT32_LEVEL_BITS
         #define PT_MAX_FULL_LEVELS 2
+        #define PT_GUEST_ACCESSED_MASK PT_ACCESSED_MASK
+        #define PT_GUEST_DIRTY_MASK PT_DIRTY_MASK
+        #define PT_GUEST_DIRTY_SHIFT PT_DIRTY_SHIFT
+        #define PT_GUEST_ACCESSED_SHIFT PT_ACCESSED_SHIFT
         #define CMPXCHG cmpxchg
+#elif PTTYPE == PTTYPE_EPT
+        #define pt_element_t u64
+        #define guest_walker guest_walkerEPT
+        #define FNAME(name) ept_##name
+        #define PT_BASE_ADDR_MASK PT64_BASE_ADDR_MASK
+        #define PT_LVL_ADDR_MASK(lvl) PT64_LVL_ADDR_MASK(lvl)
+        #define PT_LVL_OFFSET_MASK(lvl) PT64_LVL_OFFSET_MASK(lvl)
+        #define PT_INDEX(addr, level) PT64_INDEX(addr, level)
+        #define PT_LEVEL_BITS PT64_LEVEL_BITS
+        #define PT_GUEST_ACCESSED_MASK 0
+        #define PT_GUEST_DIRTY_MASK 0
+        #define PT_GUEST_DIRTY_SHIFT __using_nonexistent_pte_bit()
+        #define PT_GUEST_ACCESSED_SHIFT __using_nonexistent_pte_bit()
+        #define CMPXCHG cmpxchg64
+        #define PT_MAX_FULL_LEVELS 4
 #else
         #error Invalid PTTYPE value
 #endif
@@ -80,6 +110,40 @@ static gfn_t gpte_to_gfn_lvl(pt_element_t gpte, int lvl)
         return (gpte & PT_LVL_ADDR_MASK(lvl)) >> PAGE_SHIFT;
 }
 
+static inline void FNAME(protect_clean_gpte)(unsigned *access, unsigned gpte)
+{
+        unsigned mask;
+
+        /* dirty bit is not supported, so no need to track it */
+        if (!PT_GUEST_DIRTY_MASK)
+                return;
+
+        BUILD_BUG_ON(PT_WRITABLE_MASK != ACC_WRITE_MASK);
+
+        mask = (unsigned)~ACC_WRITE_MASK;
+        /* Allow write access to dirty gptes */
+        mask |= (gpte >> (PT_GUEST_DIRTY_SHIFT - PT_WRITABLE_SHIFT)) &
+                PT_WRITABLE_MASK;
+        *access &= mask;
+}
+
+static bool FNAME(is_rsvd_bits_set)(struct kvm_mmu *mmu, u64 gpte, int level)
+{
+        int bit7 = (gpte >> 7) & 1, low6 = gpte & 0x3f;
+
+        return (gpte & mmu->rsvd_bits_mask[bit7][level-1]) |
+                ((mmu->bad_mt_xwr & (1ull << low6)) != 0);
+}
+
+static inline int FNAME(is_present_gpte)(unsigned long pte)
+{
+#if PTTYPE != PTTYPE_EPT
+        return is_present_gpte(pte);
+#else
+        return pte & 7;
+#endif
+}
+
 static int FNAME(cmpxchg_gpte)(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
                                pt_element_t __user *ptep_user, unsigned index,
                                pt_element_t orig_pte, pt_element_t new_pte)
@@ -103,6 +167,42 @@ static int FNAME(cmpxchg_gpte)(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
         return (ret != orig_pte);
 }
 
+static bool FNAME(prefetch_invalid_gpte)(struct kvm_vcpu *vcpu,
+                                  struct kvm_mmu_page *sp, u64 *spte,
+                                  u64 gpte)
+{
+        if (FNAME(is_rsvd_bits_set)(&vcpu->arch.mmu, gpte, PT_PAGE_TABLE_LEVEL))
+                goto no_present;
+
+        if (!FNAME(is_present_gpte)(gpte))
+                goto no_present;
+
+        /* if accessed bit is not supported prefetch non accessed gpte */
+        if (PT_GUEST_ACCESSED_MASK && !(gpte & PT_GUEST_ACCESSED_MASK))
+                goto no_present;
+
+        return false;
+
+no_present:
+        drop_spte(vcpu->kvm, spte);
+        return true;
+}
+
+static inline unsigned FNAME(gpte_access)(struct kvm_vcpu *vcpu, u64 gpte)
+{
+        unsigned access;
+#if PTTYPE == PTTYPE_EPT
+        access = ((gpte & VMX_EPT_WRITABLE_MASK) ? ACC_WRITE_MASK : 0) |
+                ((gpte & VMX_EPT_EXECUTABLE_MASK) ? ACC_EXEC_MASK : 0) |
+                ACC_USER_MASK;
+#else
+        access = (gpte & (PT_WRITABLE_MASK | PT_USER_MASK)) | ACC_EXEC_MASK;
+        access &= ~(gpte >> PT64_NX_SHIFT);
+#endif
+
+        return access;
+}
+
 static int FNAME(update_accessed_dirty_bits)(struct kvm_vcpu *vcpu,
                                              struct kvm_mmu *mmu,
                                              struct guest_walker *walker,
@@ -114,18 +214,23 @@ static int FNAME(update_accessed_dirty_bits)(struct kvm_vcpu *vcpu,
         gfn_t table_gfn;
         int ret;
 
+        /* dirty/accessed bits are not supported, so no need to update them */
+        if (!PT_GUEST_DIRTY_MASK)
+                return 0;
+
         for (level = walker->max_level; level >= walker->level; --level) {
                 pte = orig_pte = walker->ptes[level - 1];
                 table_gfn = walker->table_gfn[level - 1];
                 ptep_user = walker->ptep_user[level - 1];
                 index = offset_in_page(ptep_user) / sizeof(pt_element_t);
-                if (!(pte & PT_ACCESSED_MASK)) {
+                if (!(pte & PT_GUEST_ACCESSED_MASK)) {
                         trace_kvm_mmu_set_accessed_bit(table_gfn, index, sizeof(pte));
-                        pte |= PT_ACCESSED_MASK;
+                        pte |= PT_GUEST_ACCESSED_MASK;
                 }
-                if (level == walker->level && write_fault && !is_dirty_gpte(pte)) {
+                if (level == walker->level && write_fault &&
+                                !(pte & PT_GUEST_DIRTY_MASK)) {
                         trace_kvm_mmu_set_dirty_bit(table_gfn, index, sizeof(pte));
-                        pte |= PT_DIRTY_MASK;
+                        pte |= PT_GUEST_DIRTY_MASK;
                 }
                 if (pte == orig_pte)
                         continue;
@@ -170,7 +275,7 @@ retry_walk:
         if (walker->level == PT32E_ROOT_LEVEL) {
                 pte = mmu->get_pdptr(vcpu, (addr >> 30) & 3);
                 trace_kvm_mmu_paging_element(pte, walker->level);
-                if (!is_present_gpte(pte))
+                if (!FNAME(is_present_gpte)(pte))
                         goto error;
                 --walker->level;
         }
@@ -179,7 +284,7 @@ retry_walk:
         ASSERT((!is_long_mode(vcpu) && is_pae(vcpu)) ||
                (mmu->get_cr3(vcpu) & CR3_NONPAE_RESERVED_BITS) == 0);
 
-        accessed_dirty = PT_ACCESSED_MASK;
+        accessed_dirty = PT_GUEST_ACCESSED_MASK;
         pt_access = pte_access = ACC_ALL;
         ++walker->level;
 
@@ -215,17 +320,17 @@ retry_walk:
 
                 trace_kvm_mmu_paging_element(pte, walker->level);
 
-                if (unlikely(!is_present_gpte(pte)))
+                if (unlikely(!FNAME(is_present_gpte)(pte)))
                         goto error;
 
-                if (unlikely(is_rsvd_bits_set(&vcpu->arch.mmu, pte,
-                                              walker->level))) {
+                if (unlikely(FNAME(is_rsvd_bits_set)(mmu, pte,
+                                                     walker->level))) {
                         errcode |= PFERR_RSVD_MASK | PFERR_PRESENT_MASK;
                         goto error;
                 }
 
                 accessed_dirty &= pte;
-                pte_access = pt_access & gpte_access(vcpu, pte);
+                pte_access = pt_access & FNAME(gpte_access)(vcpu, pte);
 
                 walker->ptes[walker->level - 1] = pte;
         } while (!is_last_gpte(mmu, walker->level, pte));
@@ -248,13 +353,15 @@ retry_walk:
         walker->gfn = real_gpa >> PAGE_SHIFT;
 
         if (!write_fault)
-                protect_clean_gpte(&pte_access, pte);
+                FNAME(protect_clean_gpte)(&pte_access, pte);
         else
                 /*
-                 * On a write fault, fold the dirty bit into accessed_dirty by
-                 * shifting it one place right.
+                 * On a write fault, fold the dirty bit into accessed_dirty.
+                 * For modes without A/D bits support accessed_dirty will be
+                 * always clear.
                  */
-                accessed_dirty &= pte >> (PT_DIRTY_SHIFT - PT_ACCESSED_SHIFT);
+                accessed_dirty &= pte >>
+                        (PT_GUEST_DIRTY_SHIFT - PT_GUEST_ACCESSED_SHIFT);
 
         if (unlikely(!accessed_dirty)) {
                 ret = FNAME(update_accessed_dirty_bits)(vcpu, mmu, walker, write_fault);
@@ -279,6 +386,25 @@ error:
         walker->fault.vector = PF_VECTOR;
         walker->fault.error_code_valid = true;
         walker->fault.error_code = errcode;
+
+#if PTTYPE == PTTYPE_EPT
+        /*
+         * Use PFERR_RSVD_MASK in error_code to to tell if EPT
+         * misconfiguration requires to be injected. The detection is
+         * done by is_rsvd_bits_set() above.
+         *
+         * We set up the value of exit_qualification to inject:
+         * [2:0] - Derive from [2:0] of real exit_qualification at EPT violation
+         * [5:3] - Calculated by the page walk of the guest EPT page tables
+         * [7:8] - Derived from [7:8] of real exit_qualification
+         *
+         * The other bits are set to 0.
+         */
+        if (!(errcode & PFERR_RSVD_MASK)) {
+                vcpu->arch.exit_qualification &= 0x187;
+                vcpu->arch.exit_qualification |= ((pt_access & pte) & 0x7) << 3;
+        }
+#endif
         walker->fault.address = addr;
         walker->fault.nested_page_fault = mmu != vcpu->arch.walk_mmu;
 
@@ -293,6 +419,7 @@ static int FNAME(walk_addr)(struct guest_walker *walker,
                                         access);
 }
 
+#if PTTYPE != PTTYPE_EPT
 static int FNAME(walk_addr_nested)(struct guest_walker *walker,
                                    struct kvm_vcpu *vcpu, gva_t addr,
                                    u32 access)
@@ -300,6 +427,7 @@ static int FNAME(walk_addr_nested)(struct guest_walker *walker,
         return FNAME(walk_addr_generic)(walker, vcpu, &vcpu->arch.nested_mmu,
                                         addr, access);
 }
+#endif
 
 static bool
 FNAME(prefetch_gpte)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
@@ -309,14 +437,14 @@ FNAME(prefetch_gpte)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
         gfn_t gfn;
         pfn_t pfn;
 
-        if (prefetch_invalid_gpte(vcpu, sp, spte, gpte))
+        if (FNAME(prefetch_invalid_gpte)(vcpu, sp, spte, gpte))
                 return false;
 
         pgprintk("%s: gpte %llx spte %p\n", __func__, (u64)gpte, spte);
 
         gfn = gpte_to_gfn(gpte);
-        pte_access = sp->role.access & gpte_access(vcpu, gpte);
-        protect_clean_gpte(&pte_access, gpte);
+        pte_access = sp->role.access & FNAME(gpte_access)(vcpu, gpte);
+        FNAME(protect_clean_gpte)(&pte_access, gpte);
         pfn = pte_prefetch_gfn_to_pfn(vcpu, gfn,
                         no_dirty_log && (pte_access & ACC_WRITE_MASK));
         if (is_error_pfn(pfn))
@@ -446,7 +574,7 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
                         goto out_gpte_changed;
 
                 if (sp)
-                        link_shadow_page(it.sptep, sp);
+                        link_shadow_page(it.sptep, sp, PT_GUEST_ACCESSED_MASK);
         }
 
         for (;
@@ -466,7 +594,7 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
 
                 sp = kvm_mmu_get_page(vcpu, direct_gfn, addr, it.level-1,
                                       true, direct_access, it.sptep);
-                link_shadow_page(it.sptep, sp);
+                link_shadow_page(it.sptep, sp, PT_GUEST_ACCESSED_MASK);
         }
 
         clear_sp_write_flooding_count(it.sptep);
@@ -727,6 +855,7 @@ static gpa_t FNAME(gva_to_gpa)(struct kvm_vcpu *vcpu, gva_t vaddr, u32 access,
         return gpa;
 }
 
+#if PTTYPE != PTTYPE_EPT
 static gpa_t FNAME(gva_to_gpa_nested)(struct kvm_vcpu *vcpu, gva_t vaddr,
                                       u32 access,
                                       struct x86_exception *exception)
@@ -745,6 +874,7 @@ static gpa_t FNAME(gva_to_gpa_nested)(struct kvm_vcpu *vcpu, gva_t vaddr,
 
         return gpa;
 }
+#endif
 
 /*
  * Using the cached information from sp->gfns is safe because:
@@ -785,15 +915,15 @@ static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
                                           sizeof(pt_element_t)))
                         return -EINVAL;
 
-                if (prefetch_invalid_gpte(vcpu, sp, &sp->spt[i], gpte)) {
+                if (FNAME(prefetch_invalid_gpte)(vcpu, sp, &sp->spt[i], gpte)) {
                         vcpu->kvm->tlbs_dirty++;
                         continue;
                 }
 
                 gfn = gpte_to_gfn(gpte);
                 pte_access = sp->role.access;
-                pte_access &= gpte_access(vcpu, gpte);
-                protect_clean_gpte(&pte_access, gpte);
+                pte_access &= FNAME(gpte_access)(vcpu, gpte);
+                FNAME(protect_clean_gpte)(&pte_access, gpte);
 
                 if (sync_mmio_spte(vcpu->kvm, &sp->spt[i], gfn, pte_access,
                       &nr_present))
@@ -830,3 +960,7 @@ static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
 #undef gpte_to_gfn
 #undef gpte_to_gfn_lvl
 #undef CMPXCHG
+#undef PT_GUEST_ACCESSED_MASK
+#undef PT_GUEST_DIRTY_MASK
+#undef PT_GUEST_DIRTY_SHIFT
+#undef PT_GUEST_ACCESSED_SHIFT
diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
index c53e797e7369..5c4f63151b4d 100644
--- a/arch/x86/kvm/pmu.c
+++ b/arch/x86/kvm/pmu.c
@@ -160,7 +160,7 @@ static void stop_counter(struct kvm_pmc *pmc)
 
 static void reprogram_counter(struct kvm_pmc *pmc, u32 type,
                 unsigned config, bool exclude_user, bool exclude_kernel,
-                bool intr)
+                bool intr, bool in_tx, bool in_tx_cp)
 {
         struct perf_event *event;
         struct perf_event_attr attr = {
@@ -173,6 +173,10 @@ static void reprogram_counter(struct kvm_pmc *pmc, u32 type,
                 .exclude_kernel = exclude_kernel,
                 .config = config,
         };
+        if (in_tx)
+                attr.config |= HSW_IN_TX;
+        if (in_tx_cp)
+                attr.config |= HSW_IN_TX_CHECKPOINTED;
 
         attr.sample_period = (-pmc->counter) & pmc_bitmask(pmc);
 
@@ -226,7 +230,9 @@ static void reprogram_gp_counter(struct kvm_pmc *pmc, u64 eventsel)
 
         if (!(eventsel & (ARCH_PERFMON_EVENTSEL_EDGE |
                                 ARCH_PERFMON_EVENTSEL_INV |
-                                ARCH_PERFMON_EVENTSEL_CMASK))) {
+                                ARCH_PERFMON_EVENTSEL_CMASK |
+                                HSW_IN_TX |
+                                HSW_IN_TX_CHECKPOINTED))) {
                 config = find_arch_event(&pmc->vcpu->arch.pmu, event_select,
                                 unit_mask);
                 if (config != PERF_COUNT_HW_MAX)
@@ -239,7 +245,9 @@ static void reprogram_gp_counter(struct kvm_pmc *pmc, u64 eventsel)
         reprogram_counter(pmc, type, config,
                         !(eventsel & ARCH_PERFMON_EVENTSEL_USR),
                         !(eventsel & ARCH_PERFMON_EVENTSEL_OS),
-                        eventsel & ARCH_PERFMON_EVENTSEL_INT);
+                        eventsel & ARCH_PERFMON_EVENTSEL_INT,
+                        (eventsel & HSW_IN_TX),
+                        (eventsel & HSW_IN_TX_CHECKPOINTED));
 }
 
 static void reprogram_fixed_counter(struct kvm_pmc *pmc, u8 en_pmi, int idx)
@@ -256,7 +264,7 @@ static void reprogram_fixed_counter(struct kvm_pmc *pmc, u8 en_pmi, int idx)
                         arch_events[fixed_pmc_events[idx]].event_type,
                         !(en & 0x2), /* exclude user */
                         !(en & 0x1), /* exclude kernel */
-                        pmi);
+                        pmi, false, false);
 }
 
 static inline u8 fixed_en_pmi(u64 ctrl, int idx)
@@ -408,7 +416,7 @@ int kvm_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                 } else if ((pmc = get_gp_pmc(pmu, index, MSR_P6_EVNTSEL0))) {
                         if (data == pmc->eventsel)
                                 return 0;
-                        if (!(data & 0xffffffff00200000ull)) {
+                        if (!(data & pmu->reserved_bits)) {
                                 reprogram_gp_counter(pmc, data);
                                 return 0;
                         }
@@ -450,6 +458,7 @@ void kvm_pmu_cpuid_update(struct kvm_vcpu *vcpu)
         pmu->counter_bitmask[KVM_PMC_GP] = 0;
         pmu->counter_bitmask[KVM_PMC_FIXED] = 0;
         pmu->version = 0;
+        pmu->reserved_bits = 0xffffffff00200000ull;
 
         entry = kvm_find_cpuid_entry(vcpu, 0xa, 0);
         if (!entry)
@@ -478,6 +487,12 @@ void kvm_pmu_cpuid_update(struct kvm_vcpu *vcpu)
         pmu->global_ctrl = ((1 << pmu->nr_arch_gp_counters) - 1) |
                 (((1ull << pmu->nr_arch_fixed_counters) - 1) << INTEL_PMC_IDX_FIXED);
         pmu->global_ctrl_mask = ~pmu->global_ctrl;
+
+        entry = kvm_find_cpuid_entry(vcpu, 7, 0);
+        if (entry &&
+            (boot_cpu_has(X86_FEATURE_HLE) || boot_cpu_has(X86_FEATURE_RTM)) &&
+            (entry->ebx & (X86_FEATURE_HLE|X86_FEATURE_RTM)))
+                pmu->reserved_bits ^= HSW_IN_TX|HSW_IN_TX_CHECKPOINTED;
 }
 
 void kvm_pmu_init(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 064d0be67ecc..1f1da43ff2a2 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -373,6 +373,7 @@ struct nested_vmx {
          * we must keep them pinned while L2 runs.
          */
         struct page *apic_access_page;
+        u64 msr_ia32_feature_control;
 };
 
 #define POSTED_INTR_ON  0
@@ -711,10 +712,10 @@ static void nested_release_page_clean(struct page *page)
         kvm_release_page_clean(page);
 }
 
+static unsigned long nested_ept_get_cr3(struct kvm_vcpu *vcpu);
 static u64 construct_eptp(unsigned long root_hpa);
 static void kvm_cpu_vmxon(u64 addr);
 static void kvm_cpu_vmxoff(void);
-static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3);
 static int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr);
 static void vmx_set_segment(struct kvm_vcpu *vcpu,
                             struct kvm_segment *var, int seg);
@@ -1039,12 +1040,16 @@ static inline bool nested_cpu_has2(struct vmcs12 *vmcs12, u32 bit)
                 (vmcs12->secondary_vm_exec_control & bit);
 }
 
-static inline bool nested_cpu_has_virtual_nmis(struct vmcs12 *vmcs12,
-        struct kvm_vcpu *vcpu)
+static inline bool nested_cpu_has_virtual_nmis(struct vmcs12 *vmcs12)
 {
         return vmcs12->pin_based_vm_exec_control & PIN_BASED_VIRTUAL_NMIS;
 }
 
+static inline int nested_cpu_has_ept(struct vmcs12 *vmcs12)
+{
+        return nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_EPT);
+}
+
 static inline bool is_exception(u32 intr_info)
 {
         return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
@@ -2155,6 +2160,7 @@ static u32 nested_vmx_pinbased_ctls_low, nested_vmx_pinbased_ctls_high;
 static u32 nested_vmx_exit_ctls_low, nested_vmx_exit_ctls_high;
 static u32 nested_vmx_entry_ctls_low, nested_vmx_entry_ctls_high;
 static u32 nested_vmx_misc_low, nested_vmx_misc_high;
+static u32 nested_vmx_ept_caps;
 static __init void nested_vmx_setup_ctls_msrs(void)
 {
         /*
@@ -2190,14 +2196,17 @@ static __init void nested_vmx_setup_ctls_msrs(void)
          * If bit 55 of VMX_BASIC is off, bits 0-8 and 10, 11, 13, 14, 16 and
          * 17 must be 1.
          */
+        rdmsr(MSR_IA32_VMX_EXIT_CTLS,
+                nested_vmx_exit_ctls_low, nested_vmx_exit_ctls_high);
         nested_vmx_exit_ctls_low = VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR;
         /* Note that guest use of VM_EXIT_ACK_INTR_ON_EXIT is not supported. */
+        nested_vmx_exit_ctls_high &=
 #ifdef CONFIG_X86_64
-        nested_vmx_exit_ctls_high = VM_EXIT_HOST_ADDR_SPACE_SIZE;
-#else
-        nested_vmx_exit_ctls_high = 0;
+                VM_EXIT_HOST_ADDR_SPACE_SIZE |
 #endif
-        nested_vmx_exit_ctls_high |= VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR;
+                VM_EXIT_LOAD_IA32_PAT | VM_EXIT_SAVE_IA32_PAT;
+        nested_vmx_exit_ctls_high |= (VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR |
+                                      VM_EXIT_LOAD_IA32_EFER);
 
         /* entry controls */
         rdmsr(MSR_IA32_VMX_ENTRY_CTLS,
@@ -2205,8 +2214,12 @@ static __init void nested_vmx_setup_ctls_msrs(void)
         /* If bit 55 of VMX_BASIC is off, bits 0-8 and 12 must be 1. */
         nested_vmx_entry_ctls_low = VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR;
         nested_vmx_entry_ctls_high &=
-                VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_IA32E_MODE;
-        nested_vmx_entry_ctls_high |= VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR;
+#ifdef CONFIG_X86_64
+                VM_ENTRY_IA32E_MODE |
+#endif
+                VM_ENTRY_LOAD_IA32_PAT;
+        nested_vmx_entry_ctls_high |= (VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR |
+                                       VM_ENTRY_LOAD_IA32_EFER);
 
         /* cpu-based controls */
         rdmsr(MSR_IA32_VMX_PROCBASED_CTLS,
@@ -2241,6 +2254,22 @@ static __init void nested_vmx_setup_ctls_msrs(void)
                 SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
                 SECONDARY_EXEC_WBINVD_EXITING;
 
+        if (enable_ept) {
+                /* nested EPT: emulate EPT also to L1 */
+                nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT;
+                nested_vmx_ept_caps = VMX_EPT_PAGE_WALK_4_BIT |
+                         VMX_EPTP_WB_BIT | VMX_EPT_INVEPT_BIT;
+                nested_vmx_ept_caps &= vmx_capability.ept;
+                /*
+                 * Since invept is completely emulated we support both global
+                 * and context invalidation independent of what host cpu
+                 * supports
+                 */
+                nested_vmx_ept_caps |= VMX_EPT_EXTENT_GLOBAL_BIT |
+                        VMX_EPT_EXTENT_CONTEXT_BIT;
+        } else
+                nested_vmx_ept_caps = 0;
+
         /* miscellaneous data */
         rdmsr(MSR_IA32_VMX_MISC, nested_vmx_misc_low, nested_vmx_misc_high);
         nested_vmx_misc_low &= VMX_MISC_PREEMPTION_TIMER_RATE_MASK |
@@ -2282,8 +2311,11 @@ static int vmx_get_vmx_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata)
 
         switch (msr_index) {
         case MSR_IA32_FEATURE_CONTROL:
-                *pdata = 0;
-                break;
+                if (nested_vmx_allowed(vcpu)) {
+                        *pdata = to_vmx(vcpu)->nested.msr_ia32_feature_control;
+                        break;
+                }
+                return 0;
         case MSR_IA32_VMX_BASIC:
                 /*
                  * This MSR reports some information about VMX support. We
@@ -2346,8 +2378,8 @@ static int vmx_get_vmx_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata)
                                         nested_vmx_secondary_ctls_high);
                 break;
         case MSR_IA32_VMX_EPT_VPID_CAP:
-                /* Currently, no nested ept or nested vpid */
-                *pdata = 0;
+                /* Currently, no nested vpid support */
+                *pdata = nested_vmx_ept_caps;
                 break;
         default:
                 return 0;
@@ -2356,14 +2388,24 @@ static int vmx_get_vmx_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata)
         return 1;
 }
 
-static int vmx_set_vmx_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
+static int vmx_set_vmx_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 {
+        u32 msr_index = msr_info->index;
+        u64 data = msr_info->data;
+        bool host_initialized = msr_info->host_initiated;
+
         if (!nested_vmx_allowed(vcpu))
                 return 0;
 
-        if (msr_index == MSR_IA32_FEATURE_CONTROL)
-                /* TODO: the right thing. */
+        if (msr_index == MSR_IA32_FEATURE_CONTROL) {
+                if (!host_initialized &&
+                                to_vmx(vcpu)->nested.msr_ia32_feature_control
+                                & FEATURE_CONTROL_LOCKED)
+                        return 0;
+                to_vmx(vcpu)->nested.msr_ia32_feature_control = data;
                 return 1;
+        }
+
         /*
          * No need to treat VMX capability MSRs specially: If we don't handle
          * them, handle_wrmsr will #GP(0), which is correct (they are readonly)
@@ -2494,7 +2536,7 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                         return 1;
                 /* Otherwise falls through */
         default:
-                if (vmx_set_vmx_msr(vcpu, msr_index, data))
+                if (vmx_set_vmx_msr(vcpu, msr_info))
                         break;
                 msr = find_msr_entry(vmx, msr_index);
                 if (msr) {
@@ -5302,9 +5344,13 @@ static int handle_ept_violation(struct kvm_vcpu *vcpu)
 
         /* It is a write fault? */
         error_code = exit_qualification & (1U << 1);
+        /* It is a fetch fault? */
+        error_code |= (exit_qualification & (1U << 2)) << 2;
         /* ept page table is present? */
         error_code |= (exit_qualification >> 3) & 0x1;
 
+        vcpu->arch.exit_qualification = exit_qualification;
+
         return kvm_mmu_page_fault(vcpu, gpa, error_code, NULL, 0);
 }
 
@@ -5438,7 +5484,8 @@ static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
 
                 err = emulate_instruction(vcpu, EMULTYPE_NO_REEXECUTE);
 
-                if (err == EMULATE_DO_MMIO) {
+                if (err == EMULATE_USER_EXIT) {
+                        ++vcpu->stat.mmio_exits;
                         ret = 0;
                         goto out;
                 }
@@ -5567,8 +5614,47 @@ static void nested_free_all_saved_vmcss(struct vcpu_vmx *vmx)
                 free_loaded_vmcs(&vmx->vmcs01);
 }
 
+/*
+ * The following 3 functions, nested_vmx_succeed()/failValid()/failInvalid(),
+ * set the success or error code of an emulated VMX instruction, as specified
+ * by Vol 2B, VMX Instruction Reference, "Conventions".
+ */
+static void nested_vmx_succeed(struct kvm_vcpu *vcpu)
+{
+        vmx_set_rflags(vcpu, vmx_get_rflags(vcpu)
+                        & ~(X86_EFLAGS_CF | X86_EFLAGS_PF | X86_EFLAGS_AF |
+                            X86_EFLAGS_ZF | X86_EFLAGS_SF | X86_EFLAGS_OF));
+}
+
+static void nested_vmx_failInvalid(struct kvm_vcpu *vcpu)
+{
+        vmx_set_rflags(vcpu, (vmx_get_rflags(vcpu)
+                        & ~(X86_EFLAGS_PF | X86_EFLAGS_AF | X86_EFLAGS_ZF |
+                            X86_EFLAGS_SF | X86_EFLAGS_OF))
+                        | X86_EFLAGS_CF);
+}
+
 static void nested_vmx_failValid(struct kvm_vcpu *vcpu,
-                                 u32 vm_instruction_error);
+                                        u32 vm_instruction_error)
+{
+        if (to_vmx(vcpu)->nested.current_vmptr == -1ull) {
+                /*
+                 * failValid writes the error number to the current VMCS, which
+                 * can't be done there isn't a current VMCS.
+                 */
+                nested_vmx_failInvalid(vcpu);
+                return;
+        }
+        vmx_set_rflags(vcpu, (vmx_get_rflags(vcpu)
+                        & ~(X86_EFLAGS_CF | X86_EFLAGS_PF | X86_EFLAGS_AF |
+                            X86_EFLAGS_SF | X86_EFLAGS_OF))
+                        | X86_EFLAGS_ZF);
+        get_vmcs12(vcpu)->vm_instruction_error = vm_instruction_error;
+        /*
+         * We don't need to force a shadow sync because
+         * VM_INSTRUCTION_ERROR is not shadowed
+         */
+}
 
 /*
  * Emulate the VMXON instruction.
@@ -5583,6 +5669,8 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
         struct kvm_segment cs;
         struct vcpu_vmx *vmx = to_vmx(vcpu);
         struct vmcs *shadow_vmcs;
+        const u64 VMXON_NEEDED_FEATURES = FEATURE_CONTROL_LOCKED
+                | FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
 
         /* The Intel VMX Instruction Reference lists a bunch of bits that
          * are prerequisite to running VMXON, most notably cr4.VMXE must be
@@ -5611,6 +5699,13 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
                 skip_emulated_instruction(vcpu);
                 return 1;
         }
+
+        if ((vmx->nested.msr_ia32_feature_control & VMXON_NEEDED_FEATURES)
+                        != VMXON_NEEDED_FEATURES) {
+                kvm_inject_gp(vcpu, 0);
+                return 1;
+        }
+
         if (enable_shadow_vmcs) {
                 shadow_vmcs = alloc_vmcs();
                 if (!shadow_vmcs)
@@ -5628,6 +5723,7 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
         vmx->nested.vmxon = true;
 
         skip_emulated_instruction(vcpu);
+        nested_vmx_succeed(vcpu);
         return 1;
 }
 
@@ -5712,6 +5808,7 @@ static int handle_vmoff(struct kvm_vcpu *vcpu)
                 return 1;
         free_nested(to_vmx(vcpu));
         skip_emulated_instruction(vcpu);
+        nested_vmx_succeed(vcpu);
         return 1;
 }
 
@@ -5768,48 +5865,6 @@ static int get_vmx_mem_address(struct kvm_vcpu *vcpu,
         return 0;
 }
 
-/*
- * The following 3 functions, nested_vmx_succeed()/failValid()/failInvalid(),
- * set the success or error code of an emulated VMX instruction, as specified
- * by Vol 2B, VMX Instruction Reference, "Conventions".
- */
-static void nested_vmx_succeed(struct kvm_vcpu *vcpu)
-{
-        vmx_set_rflags(vcpu, vmx_get_rflags(vcpu)
-                        & ~(X86_EFLAGS_CF | X86_EFLAGS_PF | X86_EFLAGS_AF |
-                            X86_EFLAGS_ZF | X86_EFLAGS_SF | X86_EFLAGS_OF));
-}
-
-static void nested_vmx_failInvalid(struct kvm_vcpu *vcpu)
-{
-        vmx_set_rflags(vcpu, (vmx_get_rflags(vcpu)
-                        & ~(X86_EFLAGS_PF | X86_EFLAGS_AF | X86_EFLAGS_ZF |
-                            X86_EFLAGS_SF | X86_EFLAGS_OF))
-                        | X86_EFLAGS_CF);
-}
-
-static void nested_vmx_failValid(struct kvm_vcpu *vcpu,
-                                        u32 vm_instruction_error)
-{
-        if (to_vmx(vcpu)->nested.current_vmptr == -1ull) {
-                /*
-                 * failValid writes the error number to the current VMCS, which
-                 * can't be done there isn't a current VMCS.
-                 */
-                nested_vmx_failInvalid(vcpu);
-                return;
-        }
-        vmx_set_rflags(vcpu, (vmx_get_rflags(vcpu)
-                        & ~(X86_EFLAGS_CF | X86_EFLAGS_PF | X86_EFLAGS_AF |
-                            X86_EFLAGS_SF | X86_EFLAGS_OF))
-                        | X86_EFLAGS_ZF);
-        get_vmcs12(vcpu)->vm_instruction_error = vm_instruction_error;
-        /*
-         * We don't need to force a shadow sync because
-         * VM_INSTRUCTION_ERROR is not shadowed
-         */
-}
-
 /* Emulate the VMCLEAR instruction */
 static int handle_vmclear(struct kvm_vcpu *vcpu)
 {
@@ -5972,8 +6027,8 @@ static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx)
         unsigned long field;
         u64 field_value;
         struct vmcs *shadow_vmcs = vmx->nested.current_shadow_vmcs;
-        unsigned long *fields = (unsigned long *)shadow_read_write_fields;
-        int num_fields = max_shadow_read_write_fields;
+        const unsigned long *fields = shadow_read_write_fields;
+        const int num_fields = max_shadow_read_write_fields;
 
         vmcs_load(shadow_vmcs);
 
@@ -6002,12 +6057,11 @@ static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx)
 
 static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx)
 {
-        unsigned long *fields[] = {
-                (unsigned long *)shadow_read_write_fields,
-                (unsigned long *)shadow_read_only_fields
+        const unsigned long *fields[] = {
+                shadow_read_write_fields,
+                shadow_read_only_fields
         };
-        int num_lists =  ARRAY_SIZE(fields);
-        int max_fields[] = {
+        const int max_fields[] = {
                 max_shadow_read_write_fields,
                 max_shadow_read_only_fields
         };
@@ -6018,7 +6072,7 @@ static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx)
 
         vmcs_load(shadow_vmcs);
 
-        for (q = 0; q < num_lists; q++) {
+        for (q = 0; q < ARRAY_SIZE(fields); q++) {
                 for (i = 0; i < max_fields[q]; i++) {
                         field = fields[q][i];
                         vmcs12_read_any(&vmx->vcpu, field, &field_value);
@@ -6248,6 +6302,74 @@ static int handle_vmptrst(struct kvm_vcpu *vcpu)
         return 1;
 }
 
+/* Emulate the INVEPT instruction */
+static int handle_invept(struct kvm_vcpu *vcpu)
+{
+        u32 vmx_instruction_info, types;
+        unsigned long type;
+        gva_t gva;
+        struct x86_exception e;
+        struct {
+                u64 eptp, gpa;
+        } operand;
+        u64 eptp_mask = ((1ull << 51) - 1) & PAGE_MASK;
+
+        if (!(nested_vmx_secondary_ctls_high & SECONDARY_EXEC_ENABLE_EPT) ||
+            !(nested_vmx_ept_caps & VMX_EPT_INVEPT_BIT)) {
+                kvm_queue_exception(vcpu, UD_VECTOR);
+                return 1;
+        }
+
+        if (!nested_vmx_check_permission(vcpu))
+                return 1;
+
+        if (!kvm_read_cr0_bits(vcpu, X86_CR0_PE)) {
+                kvm_queue_exception(vcpu, UD_VECTOR);
+                return 1;
+        }
+
+        vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
+        type = kvm_register_read(vcpu, (vmx_instruction_info >> 28) & 0xf);
+
+        types = (nested_vmx_ept_caps >> VMX_EPT_EXTENT_SHIFT) & 6;
+
+        if (!(types & (1UL << type))) {
+                nested_vmx_failValid(vcpu,
+                                VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
+                return 1;
+        }
+
+        /* According to the Intel VMX instruction reference, the memory
+         * operand is read even if it isn't needed (e.g., for type==global)
+         */
+        if (get_vmx_mem_address(vcpu, vmcs_readl(EXIT_QUALIFICATION),
+                        vmx_instruction_info, &gva))
+                return 1;
+        if (kvm_read_guest_virt(&vcpu->arch.emulate_ctxt, gva, &operand,
+                                sizeof(operand), &e)) {
+                kvm_inject_page_fault(vcpu, &e);
+                return 1;
+        }
+
+        switch (type) {
+        case VMX_EPT_EXTENT_CONTEXT:
+                if ((operand.eptp & eptp_mask) !=
+                                (nested_ept_get_cr3(vcpu) & eptp_mask))
+                        break;
+        case VMX_EPT_EXTENT_GLOBAL:
+                kvm_mmu_sync_roots(vcpu);
+                kvm_mmu_flush_tlb(vcpu);
+                nested_vmx_succeed(vcpu);
+                break;
+        default:
+                BUG_ON(1);
+                break;
+        }
+
+        skip_emulated_instruction(vcpu);
+        return 1;
+}
+
 /*
  * The exit handlers return 1 if the exit was handled fully and guest execution
  * may resume.  Otherwise they set the kvm_run parameter to indicate what needs
@@ -6292,6 +6414,7 @@ static int (*const kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
         [EXIT_REASON_PAUSE_INSTRUCTION]       = handle_pause,
         [EXIT_REASON_MWAIT_INSTRUCTION]       = handle_invalid_op,
         [EXIT_REASON_MONITOR_INSTRUCTION]     = handle_invalid_op,
+        [EXIT_REASON_INVEPT]                  = handle_invept,
 };
 
 static const int kvm_vmx_max_exit_handlers =
@@ -6518,6 +6641,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
         case EXIT_REASON_VMPTRST: case EXIT_REASON_VMREAD:
         case EXIT_REASON_VMRESUME: case EXIT_REASON_VMWRITE:
         case EXIT_REASON_VMOFF: case EXIT_REASON_VMON:
+        case EXIT_REASON_INVEPT:
                 /*
                  * VMX instructions trap unconditionally. This allows L1 to
                  * emulate them for its L2 guest, i.e., allows 3-level nesting!
@@ -6550,7 +6674,20 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
                 return nested_cpu_has2(vmcs12,
                         SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES);
         case EXIT_REASON_EPT_VIOLATION:
+                /*
+                 * L0 always deals with the EPT violation. If nested EPT is
+                 * used, and the nested mmu code discovers that the address is
+                 * missing in the guest EPT table (EPT12), the EPT violation
+                 * will be injected with nested_ept_inject_page_fault()
+                 */
+                return 0;
         case EXIT_REASON_EPT_MISCONFIG:
+                /*
+                 * L2 never uses directly L1's EPT, but rather L0's own EPT
+                 * table (shadow on EPT) or a merged EPT table that L0 built
+                 * (EPT on EPT). So any problems with the structure of the
+                 * table is L0's fault.
+                 */
                 return 0;
         case EXIT_REASON_PREEMPTION_TIMER:
                 return vmcs12->pin_based_vm_exec_control &
@@ -6638,7 +6775,7 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
 
         if (unlikely(!cpu_has_virtual_nmis() && vmx->soft_vnmi_blocked &&
             !(is_guest_mode(vcpu) && nested_cpu_has_virtual_nmis(
-                                        get_vmcs12(vcpu), vcpu)))) {
+                                        get_vmcs12(vcpu))))) {
                 if (vmx_interrupt_allowed(vcpu)) {
                         vmx->soft_vnmi_blocked = 0;
                 } else if (vmx->vnmi_blocked_time > 1000000000LL &&
@@ -7326,6 +7463,48 @@ static void vmx_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
                 entry->ecx |= bit(X86_FEATURE_VMX);
 }
 
+static void nested_ept_inject_page_fault(struct kvm_vcpu *vcpu,
+                struct x86_exception *fault)
+{
+        struct vmcs12 *vmcs12;
+        nested_vmx_vmexit(vcpu);
+        vmcs12 = get_vmcs12(vcpu);
+
+        if (fault->error_code & PFERR_RSVD_MASK)
+                vmcs12->vm_exit_reason = EXIT_REASON_EPT_MISCONFIG;
+        else
+                vmcs12->vm_exit_reason = EXIT_REASON_EPT_VIOLATION;
+        vmcs12->exit_qualification = vcpu->arch.exit_qualification;
+        vmcs12->guest_physical_address = fault->address;
+}
+
+/* Callbacks for nested_ept_init_mmu_context: */
+
+static unsigned long nested_ept_get_cr3(struct kvm_vcpu *vcpu)
+{
+        /* return the page table to be shadowed - in our case, EPT12 */
+        return get_vmcs12(vcpu)->ept_pointer;
+}
+
+static int nested_ept_init_mmu_context(struct kvm_vcpu *vcpu)
+{
+        int r = kvm_init_shadow_ept_mmu(vcpu, &vcpu->arch.mmu,
+                        nested_vmx_ept_caps & VMX_EPT_EXECUTE_ONLY_BIT);
+
+        vcpu->arch.mmu.set_cr3           = vmx_set_cr3;
+        vcpu->arch.mmu.get_cr3           = nested_ept_get_cr3;
+        vcpu->arch.mmu.inject_page_fault = nested_ept_inject_page_fault;
+
+        vcpu->arch.walk_mmu              = &vcpu->arch.nested_mmu;
+
+        return r;
+}
+
+static void nested_ept_uninit_mmu_context(struct kvm_vcpu *vcpu)
+{
+        vcpu->arch.walk_mmu = &vcpu->arch.mmu;
+}
+
 /*
  * prepare_vmcs02 is called when the L1 guest hypervisor runs its nested
  * L2 guest. L1 has a vmcs for L2 (vmcs12), and this function "merges" it
@@ -7388,7 +7567,7 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
                 vmcs12->guest_interruptibility_info);
         vmcs_write32(GUEST_SYSENTER_CS, vmcs12->guest_sysenter_cs);
         kvm_set_dr(vcpu, 7, vmcs12->guest_dr7);
-        vmcs_writel(GUEST_RFLAGS, vmcs12->guest_rflags);
+        vmx_set_rflags(vcpu, vmcs12->guest_rflags);
         vmcs_writel(GUEST_PENDING_DBG_EXCEPTIONS,
                 vmcs12->guest_pending_dbg_exceptions);
         vmcs_writel(GUEST_SYSENTER_ESP, vmcs12->guest_sysenter_esp);
@@ -7508,15 +7687,24 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
         vcpu->arch.cr0_guest_owned_bits &= ~vmcs12->cr0_guest_host_mask;
         vmcs_writel(CR0_GUEST_HOST_MASK, ~vcpu->arch.cr0_guest_owned_bits);
 
-        /* Note: IA32_MODE, LOAD_IA32_EFER are modified by vmx_set_efer below */
-        vmcs_write32(VM_EXIT_CONTROLS,
-                vmcs12->vm_exit_controls | vmcs_config.vmexit_ctrl);
-        vmcs_write32(VM_ENTRY_CONTROLS, vmcs12->vm_entry_controls |
+        /* L2->L1 exit controls are emulated - the hardware exit is to L0 so
+         * we should use its exit controls. Note that VM_EXIT_LOAD_IA32_EFER
+         * bits are further modified by vmx_set_efer() below.
+         */
+        vmcs_write32(VM_EXIT_CONTROLS, vmcs_config.vmexit_ctrl);
+
+        /* vmcs12's VM_ENTRY_LOAD_IA32_EFER and VM_ENTRY_IA32E_MODE are
+         * emulated by vmx_set_efer(), below.
+         */
+        vmcs_write32(VM_ENTRY_CONTROLS,
+                (vmcs12->vm_entry_controls & ~VM_ENTRY_LOAD_IA32_EFER &
+                        ~VM_ENTRY_IA32E_MODE) |
                 (vmcs_config.vmentry_ctrl & ~VM_ENTRY_IA32E_MODE));
 
-        if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_PAT)
+        if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_PAT) {
                 vmcs_write64(GUEST_IA32_PAT, vmcs12->guest_ia32_pat);
-        else if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT)
+                vcpu->arch.pat = vmcs12->guest_ia32_pat;
+        } else if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT)
                 vmcs_write64(GUEST_IA32_PAT, vmx->vcpu.arch.pat);
 
 
@@ -7538,6 +7726,11 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
                 vmx_flush_tlb(vcpu);
         }
 
+        if (nested_cpu_has_ept(vmcs12)) {
+                kvm_mmu_unload(vcpu);
+                nested_ept_init_mmu_context(vcpu);
+        }
+
         if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_EFER)
                 vcpu->arch.efer = vmcs12->guest_ia32_efer;
         else if (vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE)
@@ -7565,6 +7758,16 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
         kvm_set_cr3(vcpu, vmcs12->guest_cr3);
         kvm_mmu_reset_context(vcpu);
 
+        /*
+         * L1 may access the L2's PDPTR, so save them to construct vmcs12
+         */
+        if (enable_ept) {
+                vmcs_write64(GUEST_PDPTR0, vmcs12->guest_pdptr0);
+                vmcs_write64(GUEST_PDPTR1, vmcs12->guest_pdptr1);
+                vmcs_write64(GUEST_PDPTR2, vmcs12->guest_pdptr2);
+                vmcs_write64(GUEST_PDPTR3, vmcs12->guest_pdptr3);
+        }
+
         kvm_register_write(vcpu, VCPU_REGS_RSP, vmcs12->guest_rsp);
         kvm_register_write(vcpu, VCPU_REGS_RIP, vmcs12->guest_rip);
 }
@@ -7887,6 +8090,22 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
         vmcs12->guest_pending_dbg_exceptions =
                 vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS);
 
+        /*
+         * In some cases (usually, nested EPT), L2 is allowed to change its
+         * own CR3 without exiting. If it has changed it, we must keep it.
+         * Of course, if L0 is using shadow page tables, GUEST_CR3 was defined
+         * by L0, not L1 or L2, so we mustn't unconditionally copy it to vmcs12.
+         *
+         * Additionally, restore L2's PDPTR to vmcs12.
+         */
+        if (enable_ept) {
+                vmcs12->guest_cr3 = vmcs_read64(GUEST_CR3);
+                vmcs12->guest_pdptr0 = vmcs_read64(GUEST_PDPTR0);
+                vmcs12->guest_pdptr1 = vmcs_read64(GUEST_PDPTR1);
+                vmcs12->guest_pdptr2 = vmcs_read64(GUEST_PDPTR2);
+                vmcs12->guest_pdptr3 = vmcs_read64(GUEST_PDPTR3);
+        }
+
         vmcs12->vm_entry_controls =
                 (vmcs12->vm_entry_controls & ~VM_ENTRY_IA32E_MODE) |
                 (vmcs_read32(VM_ENTRY_CONTROLS) & VM_ENTRY_IA32E_MODE);
@@ -7948,6 +8167,8 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
 static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
                                    struct vmcs12 *vmcs12)
 {
+        struct kvm_segment seg;
+
         if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_EFER)
                 vcpu->arch.efer = vmcs12->host_ia32_efer;
         else if (vmcs12->vm_exit_controls & VM_EXIT_HOST_ADDR_SPACE_SIZE)
@@ -7982,7 +8203,9 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
         vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);
         kvm_set_cr4(vcpu, vmcs12->host_cr4);
 
-        /* shadow page tables on either EPT or shadow page tables */
+        if (nested_cpu_has_ept(vmcs12))
+                nested_ept_uninit_mmu_context(vcpu);
+
         kvm_set_cr3(vcpu, vmcs12->host_cr3);
         kvm_mmu_reset_context(vcpu);
 
@@ -8001,23 +8224,61 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
         vmcs_writel(GUEST_SYSENTER_EIP, vmcs12->host_ia32_sysenter_eip);
         vmcs_writel(GUEST_IDTR_BASE, vmcs12->host_idtr_base);
         vmcs_writel(GUEST_GDTR_BASE, vmcs12->host_gdtr_base);
-        vmcs_writel(GUEST_TR_BASE, vmcs12->host_tr_base);
-        vmcs_writel(GUEST_GS_BASE, vmcs12->host_gs_base);
-        vmcs_writel(GUEST_FS_BASE, vmcs12->host_fs_base);
-        vmcs_write16(GUEST_ES_SELECTOR, vmcs12->host_es_selector);
-        vmcs_write16(GUEST_CS_SELECTOR, vmcs12->host_cs_selector);
-        vmcs_write16(GUEST_SS_SELECTOR, vmcs12->host_ss_selector);
-        vmcs_write16(GUEST_DS_SELECTOR, vmcs12->host_ds_selector);
-        vmcs_write16(GUEST_FS_SELECTOR, vmcs12->host_fs_selector);
-        vmcs_write16(GUEST_GS_SELECTOR, vmcs12->host_gs_selector);
-        vmcs_write16(GUEST_TR_SELECTOR, vmcs12->host_tr_selector);
-
-        if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_PAT)
+
+        if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_PAT) {
                 vmcs_write64(GUEST_IA32_PAT, vmcs12->host_ia32_pat);
+                vcpu->arch.pat = vmcs12->host_ia32_pat;
+        }
         if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL)
                 vmcs_write64(GUEST_IA32_PERF_GLOBAL_CTRL,
                         vmcs12->host_ia32_perf_global_ctrl);
 
+        /* Set L1 segment info according to Intel SDM
+            27.5.2 Loading Host Segment and Descriptor-Table Registers */
+        seg = (struct kvm_segment) {
+                .base = 0,
+                .limit = 0xFFFFFFFF,
+                .selector = vmcs12->host_cs_selector,
+                .type = 11,
+                .present = 1,
+                .s = 1,
+                .g = 1
+        };
+        if (vmcs12->vm_exit_controls & VM_EXIT_HOST_ADDR_SPACE_SIZE)
+                seg.l = 1;
+        else
+                seg.db = 1;
+        vmx_set_segment(vcpu, &seg, VCPU_SREG_CS);
+        seg = (struct kvm_segment) {
+                .base = 0,
+                .limit = 0xFFFFFFFF,
+                .type = 3,
+                .present = 1,
+                .s = 1,
+                .db = 1,
+                .g = 1
+        };
+        seg.selector = vmcs12->host_ds_selector;
+        vmx_set_segment(vcpu, &seg, VCPU_SREG_DS);
+        seg.selector = vmcs12->host_es_selector;
+        vmx_set_segment(vcpu, &seg, VCPU_SREG_ES);
+        seg.selector = vmcs12->host_ss_selector;
+        vmx_set_segment(vcpu, &seg, VCPU_SREG_SS);
+        seg.selector = vmcs12->host_fs_selector;
+        seg.base = vmcs12->host_fs_base;
+        vmx_set_segment(vcpu, &seg, VCPU_SREG_FS);
+        seg.selector = vmcs12->host_gs_selector;
+        seg.base = vmcs12->host_gs_base;
+        vmx_set_segment(vcpu, &seg, VCPU_SREG_GS);
+        seg = (struct kvm_segment) {
+                .base = vmcs12->host_tr_base,
+                .limit = 0x67,
+                .selector = vmcs12->host_tr_selector,
+                .type = 11,
+                .present = 1
+        };
+        vmx_set_segment(vcpu, &seg, VCPU_SREG_TR);
+
         kvm_set_dr(vcpu, 7, 0x400);
         vmcs_write64(GUEST_IA32_DEBUGCTL, 0);
 }
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index d21bce505315..e5ca72a5cdb6 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -682,17 +682,6 @@ int kvm_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
                  */
         }
 
-        /*
-         * Does the new cr3 value map to physical memory? (Note, we
-         * catch an invalid cr3 even in real-mode, because it would
-         * cause trouble later on when we turn on paging anyway.)
-         *
-         * A real CPU would silently accept an invalid cr3 and would
-         * attempt to use it - with largely undefined (and often hard
-         * to debug) behavior on the guest side.
-         */
-        if (unlikely(!gfn_to_memslot(vcpu->kvm, cr3 >> PAGE_SHIFT)))
-                return 1;
         vcpu->arch.cr3 = cr3;
         __set_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail);
         vcpu->arch.mmu.new_cr3(vcpu);
@@ -850,7 +839,8 @@ static u32 msrs_to_save[] = {
 #ifdef CONFIG_X86_64
         MSR_CSTAR, MSR_KERNEL_GS_BASE, MSR_SYSCALL_MASK, MSR_LSTAR,
 #endif
-        MSR_IA32_TSC, MSR_IA32_CR_PAT, MSR_VM_HSAVE_PA
+        MSR_IA32_TSC, MSR_IA32_CR_PAT, MSR_VM_HSAVE_PA,
+        MSR_IA32_FEATURE_CONTROL
 };
 
 static unsigned num_msrs_to_save;
@@ -1457,6 +1447,29 @@ static void pvclock_update_vm_gtod_copy(struct kvm *kvm)
 #endif
 }
 
+static void kvm_gen_update_masterclock(struct kvm *kvm)
+{
+#ifdef CONFIG_X86_64
+        int i;
+        struct kvm_vcpu *vcpu;
+        struct kvm_arch *ka = &kvm->arch;
+
+        spin_lock(&ka->pvclock_gtod_sync_lock);
+        kvm_make_mclock_inprogress_request(kvm);
+        /* no guest entries from this point */
+        pvclock_update_vm_gtod_copy(kvm);
+
+        kvm_for_each_vcpu(i, vcpu, kvm)
+                set_bit(KVM_REQ_CLOCK_UPDATE, &vcpu->requests);
+
+        /* guest entries allowed */
+        kvm_for_each_vcpu(i, vcpu, kvm)
+                clear_bit(KVM_REQ_MCLOCK_INPROGRESS, &vcpu->requests);
+
+        spin_unlock(&ka->pvclock_gtod_sync_lock);
+#endif
+}
+
 static int kvm_guest_time_update(struct kvm_vcpu *v)
 {
         unsigned long flags, this_tsc_khz;
@@ -3806,6 +3819,7 @@ long kvm_arch_vm_ioctl(struct file *filp,
                 delta = user_ns.clock - now_ns;
                 local_irq_enable();
                 kvm->arch.kvmclock_offset = delta;
+                kvm_gen_update_masterclock(kvm);
                 break;
         }
         case KVM_GET_CLOCK: {
@@ -4955,6 +4969,97 @@ static bool retry_instruction(struct x86_emulate_ctxt *ctxt,
 static int complete_emulated_mmio(struct kvm_vcpu *vcpu);
 static int complete_emulated_pio(struct kvm_vcpu *vcpu);
 
+static int kvm_vcpu_check_hw_bp(unsigned long addr, u32 type, u32 dr7,
+                                unsigned long *db)
+{
+        u32 dr6 = 0;
+        int i;
+        u32 enable, rwlen;
+
+        enable = dr7;
+        rwlen = dr7 >> 16;
+        for (i = 0; i < 4; i++, enable >>= 2, rwlen >>= 4)
+                if ((enable & 3) && (rwlen & 15) == type && db[i] == addr)
+                        dr6 |= (1 << i);
+        return dr6;
+}
+
+static void kvm_vcpu_check_singlestep(struct kvm_vcpu *vcpu, int *r)
+{
+        struct kvm_run *kvm_run = vcpu->run;
+
+        /*
+         * Use the "raw" value to see if TF was passed to the processor.
+         * Note that the new value of the flags has not been saved yet.
+         *
+         * This is correct even for TF set by the guest, because "the
+         * processor will not generate this exception after the instruction
+         * that sets the TF flag".
+         */
+        unsigned long rflags = kvm_x86_ops->get_rflags(vcpu);
+
+        if (unlikely(rflags & X86_EFLAGS_TF)) {
+                if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) {
+                        kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1;
+                        kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip;
+                        kvm_run->debug.arch.exception = DB_VECTOR;
+                        kvm_run->exit_reason = KVM_EXIT_DEBUG;
+                        *r = EMULATE_USER_EXIT;
+                } else {
+                        vcpu->arch.emulate_ctxt.eflags &= ~X86_EFLAGS_TF;
+                        /*
+                         * "Certain debug exceptions may clear bit 0-3.  The
+                         * remaining contents of the DR6 register are never
+                         * cleared by the processor".
+                         */
+                        vcpu->arch.dr6 &= ~15;
+                        vcpu->arch.dr6 |= DR6_BS;
+                        kvm_queue_exception(vcpu, DB_VECTOR);
+                }
+        }
+}
+
+static bool kvm_vcpu_check_breakpoint(struct kvm_vcpu *vcpu, int *r)
+{
+        struct kvm_run *kvm_run = vcpu->run;
+        unsigned long eip = vcpu->arch.emulate_ctxt.eip;
+        u32 dr6 = 0;
+
+        if (unlikely(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP) &&
+            (vcpu->arch.guest_debug_dr7 & DR7_BP_EN_MASK)) {
+                dr6 = kvm_vcpu_check_hw_bp(eip, 0,
+                                           vcpu->arch.guest_debug_dr7,
+                                           vcpu->arch.eff_db);
+
+                if (dr6 != 0) {
+                        kvm_run->debug.arch.dr6 = dr6 | DR6_FIXED_1;
+                        kvm_run->debug.arch.pc = kvm_rip_read(vcpu) +
+                                get_segment_base(vcpu, VCPU_SREG_CS);
+
+                        kvm_run->debug.arch.exception = DB_VECTOR;
+                        kvm_run->exit_reason = KVM_EXIT_DEBUG;
+                        *r = EMULATE_USER_EXIT;
+                        return true;
+                }
+        }
+
+        if (unlikely(vcpu->arch.dr7 & DR7_BP_EN_MASK)) {
+                dr6 = kvm_vcpu_check_hw_bp(eip, 0,
+                                           vcpu->arch.dr7,
+                                           vcpu->arch.db);
+
+                if (dr6 != 0) {
+                        vcpu->arch.dr6 &= ~15;
+                        vcpu->arch.dr6 |= dr6;
+                        kvm_queue_exception(vcpu, DB_VECTOR);
+                        *r = EMULATE_DONE;
+                        return true;
+                }
+        }
+
+        return false;
+}
+
 int x86_emulate_instruction(struct kvm_vcpu *vcpu,
                             unsigned long cr2,
                             int emulation_type,
@@ -4975,6 +5080,16 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu,
 
         if (!(emulation_type & EMULTYPE_NO_DECODE)) {
                 init_emulate_ctxt(vcpu);
+
+                /*
+                 * We will reenter on the same instruction since
+                 * we do not set complete_userspace_io.  This does not
+                 * handle watchpoints yet, those would be handled in
+                 * the emulate_ops.
+                 */
+                if (kvm_vcpu_check_breakpoint(vcpu, &r))
+                        return r;
+
                 ctxt->interruptibility = 0;
                 ctxt->have_exception = false;
                 ctxt->perm_ok = false;
@@ -5031,17 +5146,18 @@ restart:
                 inject_emulated_exception(vcpu);
                 r = EMULATE_DONE;
         } else if (vcpu->arch.pio.count) {
-                if (!vcpu->arch.pio.in)
+                if (!vcpu->arch.pio.in) {
+                        /* FIXME: return into emulator if single-stepping.  */
                         vcpu->arch.pio.count = 0;
-                else {
+                } else {
                         writeback = false;
                         vcpu->arch.complete_userspace_io = complete_emulated_pio;
                 }
-                r = EMULATE_DO_MMIO;
+                r = EMULATE_USER_EXIT;
         } else if (vcpu->mmio_needed) {
                 if (!vcpu->mmio_is_write)
                         writeback = false;
-                r = EMULATE_DO_MMIO;
+                r = EMULATE_USER_EXIT;
                 vcpu->arch.complete_userspace_io = complete_emulated_mmio;
         } else if (r == EMULATION_RESTART)
                 goto restart;
@@ -5050,10 +5166,12 @@ restart:
 
         if (writeback) {
                 toggle_interruptibility(vcpu, ctxt->interruptibility);
-                kvm_set_rflags(vcpu, ctxt->eflags);
                 kvm_make_request(KVM_REQ_EVENT, vcpu);
                 vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
                 kvm_rip_write(vcpu, ctxt->eip);
+                if (r == EMULATE_DONE)
+                        kvm_vcpu_check_singlestep(vcpu, &r);
+                kvm_set_rflags(vcpu, ctxt->eflags);
         } else
                 vcpu->arch.emulate_regs_need_sync_to_vcpu = true;
 
@@ -5347,7 +5465,7 @@ static struct notifier_block pvclock_gtod_notifier = {
 int kvm_arch_init(void *opaque)
 {
         int r;
-        struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
+        struct kvm_x86_ops *ops = opaque;
 
         if (kvm_x86_ops) {
                 printk(KERN_ERR "kvm: already loaded the other module\n");
@@ -5495,6 +5613,23 @@ int kvm_hv_hypercall(struct kvm_vcpu *vcpu)
         return 1;
 }
 
+/*
+ * kvm_pv_kick_cpu_op:  Kick a vcpu.
+ *
+ * @apicid - apicid of vcpu to be kicked.
+ */
+static void kvm_pv_kick_cpu_op(struct kvm *kvm, unsigned long flags, int apicid)
+{
+        struct kvm_lapic_irq lapic_irq;
+
+        lapic_irq.shorthand = 0;
+        lapic_irq.dest_mode = 0;
+        lapic_irq.dest_id = apicid;
+
+        lapic_irq.delivery_mode = APIC_DM_REMRD;
+        kvm_irq_delivery_to_apic(kvm, 0, &lapic_irq, NULL);
+}
+
 int kvm_emulate_hypercall(struct kvm_vcpu *vcpu)
 {
         unsigned long nr, a0, a1, a2, a3, ret;
@@ -5528,6 +5663,10 @@ int kvm_emulate_hypercall(struct kvm_vcpu *vcpu)
         case KVM_HC_VAPIC_POLL_IRQ:
                 ret = 0;
                 break;
+        case KVM_HC_KICK_CPU:
+                kvm_pv_kick_cpu_op(vcpu->kvm, a0, a1);
+                ret = 0;
+                break;
         default:
                 ret = -KVM_ENOSYS;
                 break;
@@ -5689,29 +5828,6 @@ static void process_nmi(struct kvm_vcpu *vcpu)
         kvm_make_request(KVM_REQ_EVENT, vcpu);
 }
 
-static void kvm_gen_update_masterclock(struct kvm *kvm)
-{
-#ifdef CONFIG_X86_64
-        int i;
-        struct kvm_vcpu *vcpu;
-        struct kvm_arch *ka = &kvm->arch;
-
-        spin_lock(&ka->pvclock_gtod_sync_lock);
-        kvm_make_mclock_inprogress_request(kvm);
-        /* no guest entries from this point */
-        pvclock_update_vm_gtod_copy(kvm);
-
-        kvm_for_each_vcpu(i, vcpu, kvm)
-                set_bit(KVM_REQ_CLOCK_UPDATE, &vcpu->requests);
-
-        /* guest entries allowed */
-        kvm_for_each_vcpu(i, vcpu, kvm)
-                clear_bit(KVM_REQ_MCLOCK_INPROGRESS, &vcpu->requests);
-
-        spin_unlock(&ka->pvclock_gtod_sync_lock);
-#endif
-}
-
 static void vcpu_scan_ioapic(struct kvm_vcpu *vcpu)
 {
         u64 eoi_exit_bitmap[4];
@@ -5950,6 +6066,7 @@ static int __vcpu_run(struct kvm_vcpu *vcpu)
                                 kvm_apic_accept_events(vcpu);
                                 switch(vcpu->arch.mp_state) {
                                 case KVM_MP_STATE_HALTED:
+                                        vcpu->arch.pv.pv_unhalted = false;
                                         vcpu->arch.mp_state =
                                                 KVM_MP_STATE_RUNNABLE;
                                 case KVM_MP_STATE_RUNNABLE:
@@ -6061,6 +6178,8 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
 
         if (vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments) {
                 vcpu->mmio_needed = 0;
+
+                /* FIXME: return into emulator if single-stepping.  */
                 if (vcpu->mmio_is_write)
                         return 1;
                 vcpu->mmio_read_completed = 1;
@@ -6249,7 +6368,12 @@ int kvm_arch_vcpu_ioctl_get_mpstate(struct kvm_vcpu *vcpu,
                                     struct kvm_mp_state *mp_state)
 {
         kvm_apic_accept_events(vcpu);
-        mp_state->mp_state = vcpu->arch.mp_state;
+        if (vcpu->arch.mp_state == KVM_MP_STATE_HALTED &&
+                                        vcpu->arch.pv.pv_unhalted)
+                mp_state->mp_state = KVM_MP_STATE_RUNNABLE;
+        else
+                mp_state->mp_state = vcpu->arch.mp_state;
+
         return 0;
 }
 
@@ -6770,6 +6894,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
         BUG_ON(vcpu->kvm == NULL);
         kvm = vcpu->kvm;
 
+        vcpu->arch.pv.pv_unhalted = false;
         vcpu->arch.emulate_ctxt.ops = &emulate_ops;
         if (!irqchip_in_kernel(kvm) || kvm_vcpu_is_bsp(vcpu))
                 vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
@@ -7019,6 +7144,15 @@ out_free:
         return -ENOMEM;
 }
 
+void kvm_arch_memslots_updated(struct kvm *kvm)
+{
+        /*
+         * memslots->generation has been incremented.
+         * mmio generation may have reached its maximum value.
+         */
+        kvm_mmu_invalidate_mmio_sptes(kvm);
+}
+
 int kvm_arch_prepare_memory_region(struct kvm *kvm,
                                 struct kvm_memory_slot *memslot,
                                 struct kvm_userspace_memory_region *mem,
@@ -7079,11 +7213,6 @@ void kvm_arch_commit_memory_region(struct kvm *kvm,
          */
         if ((change != KVM_MR_DELETE) && (mem->flags & KVM_MEM_LOG_DIRTY_PAGES))
                 kvm_mmu_slot_remove_write_access(kvm, mem->slot);
-        /*
-         * If memory slot is created, or moved, we need to clear all
-         * mmio sptes.
-         */
-        kvm_mmu_invalidate_mmio_sptes(kvm);
 }
 
 void kvm_arch_flush_shadow_all(struct kvm *kvm)
@@ -7103,6 +7232,7 @@ int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu)
                 !vcpu->arch.apf.halted)
                 || !list_empty_careful(&vcpu->async_pf.done)
                 || kvm_apic_has_events(vcpu)
+                || vcpu->arch.pv.pv_unhalted
                 || atomic_read(&vcpu->arch.nmi_queued) ||
                 (kvm_arch_interrupt_allowed(vcpu) &&
                  kvm_cpu_has_interrupt(vcpu));
diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
index 25b7ae8d058a..7609e0e421ec 100644
--- a/arch/x86/lib/csum-wrappers_64.c
+++ b/arch/x86/lib/csum-wrappers_64.c
@@ -6,6 +6,7 @@
  */
 #include <asm/checksum.h>
 #include <linux/module.h>
+#include <asm/smap.h>
 
 /**
  * csum_partial_copy_from_user - Copy and checksum from user space.
@@ -52,8 +53,10 @@ csum_partial_copy_from_user(const void __user *src, void *dst,
                         len -= 2;
                 }
         }
+        stac();
         isum = csum_partial_copy_generic((__force const void *)src,
                                 dst, len, isum, errp, NULL);
+        clac();
         if (unlikely(*errp))
                 goto out_err;
 
@@ -82,6 +85,8 @@ __wsum
 csum_partial_copy_to_user(const void *src, void __user *dst,
                           int len, __wsum isum, int *errp)
 {
+        __wsum ret;
+
         might_sleep();
 
         if (unlikely(!access_ok(VERIFY_WRITE, dst, len))) {
@@ -105,8 +110,11 @@ csum_partial_copy_to_user(const void *src, void __user *dst,
         }
 
         *errp = 0;
-        return csum_partial_copy_generic(src, (void __force *)dst,
-                                         len, isum, NULL, errp);
+        stac();
+        ret = csum_partial_copy_generic(src, (void __force *)dst,
+                                        len, isum, NULL, errp);
+        clac();
+        return ret;
 }
 EXPORT_SYMBOL(csum_partial_copy_to_user);
 
diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
index 906fea315791..c905e89e19fe 100644
--- a/arch/x86/lib/usercopy_64.c
+++ b/arch/x86/lib/usercopy_64.c
@@ -68,7 +68,7 @@ EXPORT_SYMBOL(copy_in_user);
  * Since protection fault in copy_from/to_user is not a normal situation,
  * it is not necessary to optimize tail handling.
  */
-unsigned long
+__visible unsigned long
 copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
 {
         char c;
diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
index 5d7e51f3fd28..533a85e3a07e 100644
--- a/arch/x86/lib/x86-opcode-map.txt
+++ b/arch/x86/lib/x86-opcode-map.txt
@@ -1,10 +1,8 @@
 # x86 Opcode Maps
 #
 # This is (mostly) based on following documentations.
-# - Intel(R) 64 and IA-32 Architectures Software Developer's Manual Vol.2
-#   (#325383-040US, October 2011)
-# - Intel(R) Advanced Vector Extensions Programming Reference
-#   (#319433-011,JUNE 2011).
+# - Intel(R) 64 and IA-32 Architectures Software Developer's Manual Vol.2C
+#   (#326018-047US, June 2013)
 #
 #<Opcode maps>
 # Table: table-name
@@ -29,6 +27,7 @@
 #  - (F3): the last prefix is 0xF3
 #  - (F2): the last prefix is 0xF2
 #  - (!F3) : the last prefix is not 0xF3 (including non-last prefix case)
+#  - (66&F2): Both 0x66 and 0xF2 prefixes are specified.
 
 Table: one byte opcode
 Referrer:
@@ -246,8 +245,8 @@ c2: RETN Iw (f64)
 c3: RETN
 c4: LES Gz,Mp (i64) | VEX+2byte (Prefix)
 c5: LDS Gz,Mp (i64) | VEX+1byte (Prefix)
-c6: Grp11 Eb,Ib (1A)
-c7: Grp11 Ev,Iz (1A)
+c6: Grp11A Eb,Ib (1A)
+c7: Grp11B Ev,Iz (1A)
 c8: ENTER Iw,Ib
 c9: LEAVE (d64)
 ca: RETF Iw
@@ -293,8 +292,8 @@ ef: OUT DX,eAX
 # 0xf0 - 0xff
 f0: LOCK (Prefix)
 f1:
-f2: REPNE (Prefix)
-f3: REP/REPE (Prefix)
+f2: REPNE (Prefix) | XACQUIRE (Prefix)
+f3: REP/REPE (Prefix) | XRELEASE (Prefix)
 f4: HLT
 f5: CMC
 f6: Grp3_1 Eb (1A)
@@ -326,7 +325,8 @@ AVXcode: 1
 0a:
 0b: UD2 (1B)
 0c:
-0d: NOP Ev | GrpP
+# AMD's prefetch group. Intel supports prefetchw(/1) only.
+0d: GrpP
 0e: FEMMS
 # 3DNow! uses the last imm byte as opcode extension.
 0f: 3DNow! Pq,Qq,Ib
@@ -729,12 +729,12 @@ dc: VAESENC Vdq,Hdq,Wdq (66),(v1)
 dd: VAESENCLAST Vdq,Hdq,Wdq (66),(v1)
 de: VAESDEC Vdq,Hdq,Wdq (66),(v1)
 df: VAESDECLAST Vdq,Hdq,Wdq (66),(v1)
-f0: MOVBE Gy,My | MOVBE Gw,Mw (66) | CRC32 Gd,Eb (F2)
-f1: MOVBE My,Gy | MOVBE Mw,Gw (66) | CRC32 Gd,Ey (F2)
+f0: MOVBE Gy,My | MOVBE Gw,Mw (66) | CRC32 Gd,Eb (F2) | CRC32 Gd,Eb (66&F2)
+f1: MOVBE My,Gy | MOVBE Mw,Gw (66) | CRC32 Gd,Ey (F2) | CRC32 Gd,Ew (66&F2)
 f2: ANDN Gy,By,Ey (v)
 f3: Grp17 (1A)
 f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v)
-f6: MULX By,Gy,rDX,Ey (F2),(v)
+f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v)
 f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v)
 EndTable
 
@@ -861,8 +861,8 @@ EndTable
 
 GrpTable: Grp7
 0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B)
-1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001)
-2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B)
+1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B)
+2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B)
 3: LIDT Ms
 4: SMSW Mw/Rv
 5:
@@ -880,15 +880,21 @@ EndTable
 GrpTable: Grp9
 1: CMPXCHG8B/16B Mq/Mdq
 6: VMPTRLD Mq | VMCLEAR Mq (66) | VMXON Mq (F3) | RDRAND Rv (11B)
-7: VMPTRST Mq | VMPTRST Mq (F3)
+7: VMPTRST Mq | VMPTRST Mq (F3) | RDSEED Rv (11B)
 EndTable
 
 GrpTable: Grp10
 EndTable
 
-GrpTable: Grp11
-# Note: the operands are given by group opcode
-0: MOV
+# Grp11A and Grp11B are expressed as Grp11 in Intel SDM
+GrpTable: Grp11A
+0: MOV Eb,Ib
+7: XABORT Ib (000),(11B)
+EndTable
+
+GrpTable: Grp11B
+0: MOV Eb,Iz
+7: XBEGIN Jz (000),(11B)
 EndTable
 
 GrpTable: Grp12
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index 2ec29ac78ae6..04664cdb7fda 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -78,8 +78,8 @@ __ref void *alloc_low_pages(unsigned int num)
         return __va(pfn << PAGE_SHIFT);
 }
 
-/* need 4 4k for initial PMD_SIZE, 4k for 0-ISA_END_ADDRESS */
-#define INIT_PGT_BUF_SIZE       (5 * PAGE_SIZE)
+/* need 3 4k for initial PMD_SIZE,  3 4k for 0-ISA_END_ADDRESS */
+#define INIT_PGT_BUF_SIZE       (6 * PAGE_SIZE)
 RESERVE_BRK(early_pgt_alloc, INIT_PGT_BUF_SIZE);
 void  __init early_alloc_pgt_buf(void)
 {
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 0215e2c563ef..799580cabc78 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -487,7 +487,7 @@ __early_ioremap(resource_size_t phys_addr, unsigned long size, pgprot_t prot)
         unsigned long offset;
         resource_size_t last_addr;
         unsigned int nrpages;
-        enum fixed_addresses idx0, idx;
+        enum fixed_addresses idx;
         int i, slot;
 
         WARN_ON(system_state != SYSTEM_BOOTING);
@@ -540,8 +540,7 @@ __early_ioremap(resource_size_t phys_addr, unsigned long size, pgprot_t prot)
         /*
          * Ok, go for it..
          */
-        idx0 = FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*slot;
-        idx = idx0;
+        idx = FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*slot;
         while (nrpages > 0) {
                 early_set_fixmap(idx, phys_addr, prot);
                 phys_addr += PAGE_SIZE;
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index 62c29a5bfe26..25e7e1372bb2 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -112,11 +112,13 @@ static unsigned long mmap_legacy_base(void)
  */
 void arch_pick_mmap_layout(struct mm_struct *mm)
 {
+        mm->mmap_legacy_base = mmap_legacy_base();
+        mm->mmap_base = mmap_base();
+
         if (mmap_is_legacy()) {
-                mm->mmap_base = mmap_legacy_base();
+                mm->mmap_base = mm->mmap_legacy_base;
                 mm->get_unmapped_area = arch_get_unmapped_area;
         } else {
-                mm->mmap_base = mmap_base();
                 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
         }
 }
diff --git a/arch/x86/mm/srat.c b/arch/x86/mm/srat.c
index cdd0da9dd530..266ca912f62e 100644
--- a/arch/x86/mm/srat.c
+++ b/arch/x86/mm/srat.c
@@ -146,6 +146,7 @@ int __init
 acpi_numa_memory_affinity_init(struct acpi_srat_mem_affinity *ma)
 {
         u64 start, end;
+        u32 hotpluggable;
         int node, pxm;
 
         if (srat_disabled())
@@ -154,7 +155,8 @@ acpi_numa_memory_affinity_init(struct acpi_srat_mem_affinity *ma)
                 goto out_err_bad_srat;
         if ((ma->flags & ACPI_SRAT_MEM_ENABLED) == 0)
                 goto out_err;
-        if ((ma->flags & ACPI_SRAT_MEM_HOT_PLUGGABLE) && !save_add_info())
+        hotpluggable = ma->flags & ACPI_SRAT_MEM_HOT_PLUGGABLE;
+        if (hotpluggable && !save_add_info())
                 goto out_err;
 
         start = ma->base_address;
@@ -174,9 +176,10 @@ acpi_numa_memory_affinity_init(struct acpi_srat_mem_affinity *ma)
 
         node_set(node, numa_nodes_parsed);
 
-        printk(KERN_INFO "SRAT: Node %u PXM %u [mem %#010Lx-%#010Lx]\n",
-               node, pxm,
-               (unsigned long long) start, (unsigned long long) end - 1);
+        pr_info("SRAT: Node %u PXM %u [mem %#010Lx-%#010Lx]%s\n",
+                node, pxm,
+                (unsigned long long) start, (unsigned long long) end - 1,
+                hotpluggable ? " hotplug" : "");
 
         return 0;
 out_err_bad_srat:
diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
index 48768df2471a..6890d8498e0b 100644
--- a/arch/x86/oprofile/nmi_int.c
+++ b/arch/x86/oprofile/nmi_int.c
@@ -403,7 +403,7 @@ static void nmi_cpu_down(void *dummy)
                 nmi_cpu_shutdown(dummy);
 }
 
-static int nmi_create_files(struct super_block *sb, struct dentry *root)
+static int nmi_create_files(struct dentry *root)
 {
         unsigned int i;
 
@@ -420,14 +420,14 @@ static int nmi_create_files(struct super_block *sb, struct dentry *root)
                         continue;
 
                 snprintf(buf,  sizeof(buf), "%d", i);
-                dir = oprofilefs_mkdir(sb, root, buf);
-                oprofilefs_create_ulong(sb, dir, "enabled", &counter_config[i].enabled);
-                oprofilefs_create_ulong(sb, dir, "event", &counter_config[i].event);
-                oprofilefs_create_ulong(sb, dir, "count", &counter_config[i].count);
-                oprofilefs_create_ulong(sb, dir, "unit_mask", &counter_config[i].unit_mask);
-                oprofilefs_create_ulong(sb, dir, "kernel", &counter_config[i].kernel);
-                oprofilefs_create_ulong(sb, dir, "user", &counter_config[i].user);
-                oprofilefs_create_ulong(sb, dir, "extra", &counter_config[i].extra);
+                dir = oprofilefs_mkdir(root, buf);
+                oprofilefs_create_ulong(dir, "enabled", &counter_config[i].enabled);
+                oprofilefs_create_ulong(dir, "event", &counter_config[i].event);
+                oprofilefs_create_ulong(dir, "count", &counter_config[i].count);
+                oprofilefs_create_ulong(dir, "unit_mask", &counter_config[i].unit_mask);
+                oprofilefs_create_ulong(dir, "kernel", &counter_config[i].kernel);
+                oprofilefs_create_ulong(dir, "user", &counter_config[i].user);
+                oprofilefs_create_ulong(dir, "extra", &counter_config[i].extra);
         }
 
         return 0;
diff --git a/arch/x86/oprofile/op_model_amd.c b/arch/x86/oprofile/op_model_amd.c
index b2b94438ff05..50d86c0e9ba4 100644
--- a/arch/x86/oprofile/op_model_amd.c
+++ b/arch/x86/oprofile/op_model_amd.c
@@ -454,16 +454,16 @@ static void init_ibs(void)
         printk(KERN_INFO "oprofile: AMD IBS detected (0x%08x)\n", ibs_caps);
 }
 
-static int (*create_arch_files)(struct super_block *sb, struct dentry *root);
+static int (*create_arch_files)(struct dentry *root);
 
-static int setup_ibs_files(struct super_block *sb, struct dentry *root)
+static int setup_ibs_files(struct dentry *root)
 {
         struct dentry *dir;
         int ret = 0;
 
         /* architecture specific files */
         if (create_arch_files)
-                ret = create_arch_files(sb, root);
+                ret = create_arch_files(root);
 
         if (ret)
                 return ret;
@@ -479,26 +479,26 @@ static int setup_ibs_files(struct super_block *sb, struct dentry *root)
         ibs_config.max_cnt_op = 250000;
 
         if (ibs_caps & IBS_CAPS_FETCHSAM) {
-                dir = oprofilefs_mkdir(sb, root, "ibs_fetch");
-                oprofilefs_create_ulong(sb, dir, "enable",
+                dir = oprofilefs_mkdir(root, "ibs_fetch");
+                oprofilefs_create_ulong(dir, "enable",
                                         &ibs_config.fetch_enabled);
-                oprofilefs_create_ulong(sb, dir, "max_count",
+                oprofilefs_create_ulong(dir, "max_count",
                                         &ibs_config.max_cnt_fetch);
-                oprofilefs_create_ulong(sb, dir, "rand_enable",
+                oprofilefs_create_ulong(dir, "rand_enable",
                                         &ibs_config.rand_en);
         }
 
         if (ibs_caps & IBS_CAPS_OPSAM) {
-                dir = oprofilefs_mkdir(sb, root, "ibs_op");
-                oprofilefs_create_ulong(sb, dir, "enable",
+                dir = oprofilefs_mkdir(root, "ibs_op");
+                oprofilefs_create_ulong(dir, "enable",
                                         &ibs_config.op_enabled);
-                oprofilefs_create_ulong(sb, dir, "max_count",
+                oprofilefs_create_ulong(dir, "max_count",
                                         &ibs_config.max_cnt_op);
                 if (ibs_caps & IBS_CAPS_OPCNT)
-                        oprofilefs_create_ulong(sb, dir, "dispatched_ops",
+                        oprofilefs_create_ulong(dir, "dispatched_ops",
                                                 &ibs_config.dispatched_ops);
                 if (ibs_caps & IBS_CAPS_BRNTRGT)
-                        oprofilefs_create_ulong(sb, dir, "branch_target",
+                        oprofilefs_create_ulong(dir, "branch_target",
                                                 &ibs_config.branch_target);
         }
 
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index d641897a1f4e..b30e937689d6 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -568,13 +568,8 @@ struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)
          */
         if (bus) {
                 struct pci_bus *child;
-                list_for_each_entry(child, &bus->children, node) {
-                        struct pci_dev *self = child->self;
-                        if (!self)
-                                continue;
-
-                        pcie_bus_configure_settings(child, self->pcie_mpss);
-                }
+                list_for_each_entry(child, &bus->children, node)
+                        pcie_bus_configure_settings(child);
         }
 
         if (bus && node != -1) {
diff --git a/arch/x86/pci/i386.c b/arch/x86/pci/i386.c
index 94919e307f8e..db6b1ab43255 100644
--- a/arch/x86/pci/i386.c
+++ b/arch/x86/pci/i386.c
@@ -210,6 +210,8 @@ static void pcibios_allocate_bridge_resources(struct pci_dev *dev)
                 r = &dev->resource[idx];
                 if (!r->flags)
                         continue;
+                if (r->parent)  /* Already allocated */
+                        continue;
                 if (!r->start || pci_claim_resource(dev, idx) < 0) {
                         /*
                          * Something is wrong with the region.
@@ -318,6 +320,8 @@ static void pcibios_allocate_dev_rom_resource(struct pci_dev *dev)
         r = &dev->resource[PCI_ROM_RESOURCE];
         if (!r->flags || !r->start)
                 return;
+        if (r->parent) /* Already allocated */
+                return;
 
         if (pci_claim_resource(dev, PCI_ROM_RESOURCE) < 0) {
                 r->end -= r->start;
diff --git a/arch/x86/pci/mmconfig-shared.c b/arch/x86/pci/mmconfig-shared.c
index 082e88129712..5596c7bdd327 100644
--- a/arch/x86/pci/mmconfig-shared.c
+++ b/arch/x86/pci/mmconfig-shared.c
@@ -700,7 +700,7 @@ int pci_mmconfig_insert(struct device *dev, u16 seg, u8 start, u8 end,
         if (!(pci_probe & PCI_PROBE_MMCONF) || pci_mmcfg_arch_init_failed)
                 return -ENODEV;
 
-        if (start > end)
+        if (start > end || !addr)
                 return -EINVAL;
 
         mutex_lock(&pci_mmcfg_lock);
@@ -716,11 +716,6 @@ int pci_mmconfig_insert(struct device *dev, u16 seg, u8 start, u8 end,
                 return -EEXIST;
         }
 
-        if (!addr) {
-                mutex_unlock(&pci_mmcfg_lock);
-                return -EINVAL;
-        }
-
         rc = -EBUSY;
         cfg = pci_mmconfig_alloc(seg, start, end, addr);
         if (cfg == NULL) {
diff --git a/arch/x86/pci/mrst.c b/arch/x86/pci/mrst.c
index 6eb18c42a28a..903fded50786 100644
--- a/arch/x86/pci/mrst.c
+++ b/arch/x86/pci/mrst.c
@@ -23,11 +23,11 @@
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <linux/dmi.h>
+#include <linux/acpi.h>
+#include <linux/io.h>
+#include <linux/smp.h>
 
-#include <asm/acpi.h>
 #include <asm/segment.h>
-#include <asm/io.h>
-#include <asm/smp.h>
 #include <asm/pci_x86.h>
 #include <asm/hw_irq.h>
 #include <asm/io_apic.h>
@@ -43,7 +43,7 @@
 #define PCI_FIXED_BAR_4_SIZE    0x14
 #define PCI_FIXED_BAR_5_SIZE    0x1c
 
-static int pci_soc_mode = 0;
+static int pci_soc_mode;
 
 /**
  * fixed_bar_cap - return the offset of the fixed BAR cap if found
@@ -141,7 +141,8 @@ static int pci_device_update_fixed(struct pci_bus *bus, unsigned int devfn,
  */
 static bool type1_access_ok(unsigned int bus, unsigned int devfn, int reg)
 {
-        /* This is a workaround for A0 LNC bug where PCI status register does
+        /*
+         * This is a workaround for A0 LNC bug where PCI status register does
          * not have new CAP bit set. can not be written by SW either.
          *
          * PCI header type in real LNC indicates a single function device, this
@@ -154,7 +155,7 @@ static bool type1_access_ok(unsigned int bus, unsigned int devfn, int reg)
                                 || devfn == PCI_DEVFN(0, 0)
                                 || devfn == PCI_DEVFN(3, 0)))
                 return 1;
-        return 0; /* langwell on others */
+        return 0; /* Langwell on others */
 }
 
 static int pci_read(struct pci_bus *bus, unsigned int devfn, int where,
@@ -172,7 +173,8 @@ static int pci_write(struct pci_bus *bus, unsigned int devfn, int where,
 {
         int offset;
 
-        /* On MRST, there is no PCI ROM BAR, this will cause a subsequent read
+        /*
+         * On MRST, there is no PCI ROM BAR, this will cause a subsequent read
          * to ROM BAR return 0 then being ignored.
          */
         if (where == PCI_ROM_ADDRESS)
@@ -210,7 +212,8 @@ static int mrst_pci_irq_enable(struct pci_dev *dev)
 
         pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin);
 
-        /* MRST only have IOAPIC, the PCI irq lines are 1:1 mapped to
+        /*
+         * MRST only have IOAPIC, the PCI irq lines are 1:1 mapped to
          * IOAPIC RTE entries, so we just enable RTE for the device.
          */
         irq_attr.ioapic = mp_find_ioapic(dev->irq);
@@ -235,7 +238,7 @@ struct pci_ops pci_mrst_ops = {
  */
 int __init pci_mrst_init(void)
 {
-        printk(KERN_INFO "Intel MID platform detected, using MID PCI ops\n");
+        pr_info("Intel MID platform detected, using MID PCI ops\n");
         pci_mmcfg_late_init();
         pcibios_enable_irq = mrst_pci_irq_enable;
         pci_root_ops = pci_mrst_ops;
@@ -244,17 +247,21 @@ int __init pci_mrst_init(void)
         return 1;
 }
 
-/* Langwell devices are not true pci devices, they are not subject to 10 ms
- * d3 to d0 delay required by pci spec.
+/*
+ * Langwell devices are not true PCI devices; they are not subject to 10 ms
+ * d3 to d0 delay required by PCI spec.
  */
 static void pci_d3delay_fixup(struct pci_dev *dev)
 {
-        /* PCI fixups are effectively decided compile time. If we have a dual
-           SoC/non-SoC kernel we don't want to mangle d3 on non SoC devices */
-        if (!pci_soc_mode)
-            return;
-        /* true pci devices in lincroft should allow type 1 access, the rest
-         * are langwell fake pci devices.
+        /*
+         * PCI fixups are effectively decided compile time. If we have a dual
+         * SoC/non-SoC kernel we don't want to mangle d3 on non-SoC devices.
+         */
+        if (!pci_soc_mode)
+                return;
+        /*
+         * True PCI devices in Lincroft should allow type 1 access, the rest
+         * are Langwell fake PCI devices.
          */
         if (type1_access_ok(dev->bus->number, dev->devfn, PCI_DEVICE_ID))
                 return;
diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
index 1cf5b300305e..424f4c97a44d 100644
--- a/arch/x86/power/cpu.c
+++ b/arch/x86/power/cpu.c
@@ -25,10 +25,10 @@
 #include <asm/cpu.h>
 
 #ifdef CONFIG_X86_32
-unsigned long saved_context_ebx;
-unsigned long saved_context_esp, saved_context_ebp;
-unsigned long saved_context_esi, saved_context_edi;
-unsigned long saved_context_eflags;
+__visible unsigned long saved_context_ebx;
+__visible unsigned long saved_context_esp, saved_context_ebp;
+__visible unsigned long saved_context_esi, saved_context_edi;
+__visible unsigned long saved_context_eflags;
 #endif
 struct saved_context saved_context;
 
diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
index a0fde91c16cf..304fca20d96e 100644
--- a/arch/x86/power/hibernate_64.c
+++ b/arch/x86/power/hibernate_64.c
@@ -20,26 +20,26 @@
 #include <asm/suspend.h>
 
 /* References to section boundaries */
-extern const void __nosave_begin, __nosave_end;
+extern __visible const void __nosave_begin, __nosave_end;
 
 /* Defined in hibernate_asm_64.S */
-extern int restore_image(void);
+extern asmlinkage int restore_image(void);
 
 /*
  * Address to jump to in the last phase of restore in order to get to the image
  * kernel's text (this value is passed in the image header).
  */
-unsigned long restore_jump_address;
+unsigned long restore_jump_address __visible;
 
 /*
  * Value of the cr3 register from before the hibernation (this value is passed
  * in the image header).
  */
-unsigned long restore_cr3;
+unsigned long restore_cr3 __visible;
 
-pgd_t *temp_level4_pgt;
+pgd_t *temp_level4_pgt __visible;
 
-void *relocated_restore_code;
+void *relocated_restore_code __visible;
 
 static void *alloc_pgt_page(void *context)
 {
diff --git a/arch/x86/tools/gen-insn-attr-x86.awk b/arch/x86/tools/gen-insn-attr-x86.awk
index e6773dc8ac41..093a892026f9 100644
--- a/arch/x86/tools/gen-insn-attr-x86.awk
+++ b/arch/x86/tools/gen-insn-attr-x86.awk
@@ -68,7 +68,7 @@ BEGIN {
 
         lprefix1_expr = "\\((66|!F3)\\)"
         lprefix2_expr = "\\(F3\\)"
-        lprefix3_expr = "\\((F2|!F3)\\)"
+        lprefix3_expr = "\\((F2|!F3|66\\&F2)\\)"
         lprefix_expr = "\\((66|F2|F3)\\)"
         max_lprefix = 4
 
@@ -83,6 +83,8 @@ BEGIN {
         prefix_num["Operand-Size"] = "INAT_PFX_OPNDSZ"
         prefix_num["REPNE"] = "INAT_PFX_REPNE"
         prefix_num["REP/REPE"] = "INAT_PFX_REPE"
+        prefix_num["XACQUIRE"] = "INAT_PFX_REPNE"
+        prefix_num["XRELEASE"] = "INAT_PFX_REPE"
         prefix_num["LOCK"] = "INAT_PFX_LOCK"
         prefix_num["SEG=CS"] = "INAT_PFX_CS"
         prefix_num["SEG=DS"] = "INAT_PFX_DS"
diff --git a/arch/x86/vdso/vclock_gettime.c b/arch/x86/vdso/vclock_gettime.c
index c74436e687bf..72074d528400 100644
--- a/arch/x86/vdso/vclock_gettime.c
+++ b/arch/x86/vdso/vclock_gettime.c
@@ -85,15 +85,18 @@ static notrace cycle_t vread_pvclock(int *mode)
         cycle_t ret;
         u64 last;
         u32 version;
-        u32 migrate_count;
         u8 flags;
         unsigned cpu, cpu1;
 
 
         /*
-         * When looping to get a consistent (time-info, tsc) pair, we
-         * also need to deal with the possibility we can switch vcpus,
-         * so make sure we always re-fetch time-info for the current vcpu.
+         * Note: hypervisor must guarantee that:
+         * 1. cpu ID number maps 1:1 to per-CPU pvclock time info.
+         * 2. that per-CPU pvclock time info is updated if the
+         *    underlying CPU changes.
+         * 3. that version is increased whenever underlying CPU
+         *    changes.
+         *
          */
         do {
                 cpu = __getcpu() & VGETCPU_CPU_MASK;
@@ -104,8 +107,6 @@ static notrace cycle_t vread_pvclock(int *mode)
 
                 pvti = get_pvti(cpu);
 
-                migrate_count = pvti->migrate_count;
-
                 version = __pvclock_read_cycles(&pvti->pvti, &ret, &flags);
 
                 /*
@@ -117,8 +118,7 @@ static notrace cycle_t vread_pvclock(int *mode)
                 cpu1 = __getcpu() & VGETCPU_CPU_MASK;
         } while (unlikely(cpu != cpu1 ||
                           (pvti->pvti.version & 1) ||
-                          pvti->pvti.version != version ||
-                          pvti->migrate_count != migrate_count));
+                          pvti->pvti.version != version));
 
         if (unlikely(!(flags & PVCLOCK_TSC_STABLE_BIT)))
                 *mode = VCLOCK_NONE;
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 193097ef3d7d..2fc216dfbd9c 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -427,8 +427,7 @@ static void __init xen_init_cpuid_mask(void)
 
         if (!xen_initial_domain())
                 cpuid_leaf1_edx_mask &=
-                        ~((1 << X86_FEATURE_APIC) |  /* disable local APIC */
-                          (1 << X86_FEATURE_ACPI));  /* disable ACPI */
+                        ~((1 << X86_FEATURE_ACPI));  /* disable ACPI */
 
         cpuid_leaf1_ecx_mask &= ~(1 << (X86_FEATURE_X2APIC % 32));
 
@@ -735,8 +734,7 @@ static int cvt_gate_to_trap(int vector, const gate_desc *val,
                 addr = (unsigned long)xen_int3;
         else if (addr == (unsigned long)stack_segment)
                 addr = (unsigned long)xen_stack_segment;
-        else if (addr == (unsigned long)double_fault ||
-                 addr == (unsigned long)nmi) {
+        else if (addr == (unsigned long)double_fault) {
                 /* Don't need to handle these */
                 return 0;
 #ifdef CONFIG_X86_MCE
@@ -747,7 +745,12 @@ static int cvt_gate_to_trap(int vector, const gate_desc *val,
                  */
                 ;
 #endif
-        } else {
+        } else if (addr == (unsigned long)nmi)
+                /*
+                 * Use the native version as well.
+                 */
+                ;
+        else {
                 /* Some other trap using IST? */
                 if (WARN_ON(val->ist != 0))
                         return 0;
@@ -1710,6 +1713,8 @@ static void __init xen_hvm_guest_init(void)
 
         xen_hvm_init_shared_info();
 
+        xen_panic_handler_init();
+
         if (xen_feature(XENFEAT_hvm_callback_vector))
                 xen_have_vector_callback = 1;
         xen_hvm_smp_init();
@@ -1720,15 +1725,12 @@ static void __init xen_hvm_guest_init(void)
         xen_hvm_init_mmu_ops();
 }
 
-static bool __init xen_hvm_platform(void)
+static uint32_t __init xen_hvm_platform(void)
 {
         if (xen_pv_domain())
-                return false;
-
-        if (!xen_cpuid_base())
-                return false;
+                return 0;
 
-        return true;
+        return xen_cpuid_base();
 }
 
 bool xen_hvm_need_lapic(void)
diff --git a/arch/x86/xen/irq.c b/arch/x86/xen/irq.c
index 01a4dc015ae1..0da7f863056f 100644
--- a/arch/x86/xen/irq.c
+++ b/arch/x86/xen/irq.c
@@ -47,23 +47,18 @@ static void xen_restore_fl(unsigned long flags)
         /* convert from IF type flag */
         flags = !(flags & X86_EFLAGS_IF);
 
-        /* There's a one instruction preempt window here.  We need to
-           make sure we're don't switch CPUs between getting the vcpu
-           pointer and updating the mask. */
+        /* See xen_irq_enable() for why preemption must be disabled. */
         preempt_disable();
         vcpu = this_cpu_read(xen_vcpu);
         vcpu->evtchn_upcall_mask = flags;
-        preempt_enable_no_resched();
-
-        /* Doesn't matter if we get preempted here, because any
-           pending event will get dealt with anyway. */
 
         if (flags == 0) {
-                preempt_check_resched();
                 barrier(); /* unmask then check (avoid races) */
                 if (unlikely(vcpu->evtchn_upcall_pending))
                         xen_force_evtchn_callback();
-        }
+                preempt_enable();
+        } else
+                preempt_enable_no_resched();
 }
 PV_CALLEE_SAVE_REGS_THUNK(xen_restore_fl);
 
@@ -82,10 +77,12 @@ static void xen_irq_enable(void)
 {
         struct vcpu_info *vcpu;
 
-        /* We don't need to worry about being preempted here, since
-           either a) interrupts are disabled, so no preemption, or b)
-           the caller is confused and is trying to re-enable interrupts
-           on an indeterminate processor. */
+        /*
+         * We may be preempted as soon as vcpu->evtchn_upcall_mask is
+         * cleared, so disable preemption to ensure we check for
+         * events on the VCPU we are still running on.
+         */
+        preempt_disable();
 
         vcpu = this_cpu_read(xen_vcpu);
         vcpu->evtchn_upcall_mask = 0;
@@ -96,6 +93,8 @@ static void xen_irq_enable(void)
         barrier(); /* unmask then check (avoid races) */
         if (unlikely(vcpu->evtchn_upcall_pending))
                 xen_force_evtchn_callback();
+
+        preempt_enable();
 }
 PV_CALLEE_SAVE_REGS_THUNK(xen_irq_enable);
 
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index 95fb2aa5927e..0d4ec35895d4 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -161,6 +161,7 @@
 #include <asm/xen/page.h>
 #include <asm/xen/hypercall.h>
 #include <asm/xen/hypervisor.h>
+#include <xen/balloon.h>
 #include <xen/grant_table.h>
 
 #include "multicalls.h"
@@ -967,7 +968,10 @@ int m2p_remove_override(struct page *page,
         if (kmap_op != NULL) {
                 if (!PageHighMem(page)) {
                         struct multicall_space mcs;
-                        struct gnttab_unmap_grant_ref *unmap_op;
+                        struct gnttab_unmap_and_replace *unmap_op;
+                        struct page *scratch_page = get_balloon_scratch_page();
+                        unsigned long scratch_page_address = (unsigned long)
+                                __va(page_to_pfn(scratch_page) << PAGE_SHIFT);
 
                         /*
                          * It might be that we queued all the m2p grant table
@@ -990,21 +994,25 @@ int m2p_remove_override(struct page *page,
                         }
 
                         mcs = xen_mc_entry(
-                                        sizeof(struct gnttab_unmap_grant_ref));
+                                        sizeof(struct gnttab_unmap_and_replace));
                         unmap_op = mcs.args;
                         unmap_op->host_addr = kmap_op->host_addr;
+                        unmap_op->new_addr = scratch_page_address;
                         unmap_op->handle = kmap_op->handle;
-                        unmap_op->dev_bus_addr = 0;
 
                         MULTI_grant_table_op(mcs.mc,
-                                        GNTTABOP_unmap_grant_ref, unmap_op, 1);
+                                        GNTTABOP_unmap_and_replace, unmap_op, 1);
 
                         xen_mc_issue(PARAVIRT_LAZY_MMU);
 
-                        set_pte_at(&init_mm, address, ptep,
-                                        pfn_pte(pfn, PAGE_KERNEL));
-                        __flush_tlb_single(address);
+                        mcs = __xen_mc_entry(0);
+                        MULTI_update_va_mapping(mcs.mc, scratch_page_address,
+                                        pfn_pte(page_to_pfn(get_balloon_scratch_page()),
+                                        PAGE_KERNEL_RO), 0);
+                        xen_mc_issue(PARAVIRT_LAZY_MMU);
+
                         kmap_op->host_addr = 0;
+                        put_balloon_scratch_page();
                 }
         }
 
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index 056d11faef21..09f3059cb00b 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -33,6 +33,9 @@
 /* These are code, but not functions.  Defined in entry.S */
 extern const char xen_hypervisor_callback[];
 extern const char xen_failsafe_callback[];
+#ifdef CONFIG_X86_64
+extern const char nmi[];
+#endif
 extern void xen_sysenter_target(void);
 extern void xen_syscall_target(void);
 extern void xen_syscall32_target(void);
@@ -215,13 +218,19 @@ static void __init xen_set_identity_and_release_chunk(
         unsigned long pfn;
 
         /*
-         * If the PFNs are currently mapped, the VA mapping also needs
-         * to be updated to be 1:1.
+         * If the PFNs are currently mapped, clear the mappings
+         * (except for the ISA region which must be 1:1 mapped) to
+         * release the refcounts (in Xen) on the original frames.
          */
-        for (pfn = start_pfn; pfn <= max_pfn_mapped && pfn < end_pfn; pfn++)
+        for (pfn = start_pfn; pfn <= max_pfn_mapped && pfn < end_pfn; pfn++) {
+                pte_t pte = __pte_ma(0);
+
+                if (pfn < PFN_UP(ISA_END_ADDRESS))
+                        pte = mfn_pte(pfn, PAGE_KERNEL_IO);
+
                 (void)HYPERVISOR_update_va_mapping(
-                        (unsigned long)__va(pfn << PAGE_SHIFT),
-                        mfn_pte(pfn, PAGE_KERNEL_IO), 0);
+                        (unsigned long)__va(pfn << PAGE_SHIFT), pte, 0);
+        }
 
         if (start_pfn < nr_pages)
                 *released += xen_release_chunk(
@@ -313,6 +322,17 @@ static void xen_align_and_add_e820_region(u64 start, u64 size, int type)
         e820_add_region(start, end - start, type);
 }
 
+void xen_ignore_unusable(struct e820entry *list, size_t map_size)
+{
+        struct e820entry *entry;
+        unsigned int i;
+
+        for (i = 0, entry = list; i < map_size; i++, entry++) {
+                if (entry->type == E820_UNUSABLE)
+                        entry->type = E820_RAM;
+        }
+}
+
 /**
  * machine_specific_memory_setup - Hook for machine specific memory setup.
  **/
@@ -353,6 +373,17 @@ char * __init xen_memory_setup(void)
         }
         BUG_ON(rc);
 
+        /*
+         * Xen won't allow a 1:1 mapping to be created to UNUSABLE
+         * regions, so if we're using the machine memory map leave the
+         * region as RAM as it is in the pseudo-physical map.
+         *
+         * UNUSABLE regions in domUs are not handled and will need
+         * a patch in the future.
+         */
+        if (xen_initial_domain())
+                xen_ignore_unusable(map, memmap.nr_entries);
+
         /* Make sure the Xen-supplied memory map is well-ordered. */
         sanitize_e820_map(map, memmap.nr_entries, &memmap.nr_entries);
 
@@ -525,7 +556,13 @@ void xen_enable_syscall(void)
         }
 #endif /* CONFIG_X86_64 */
 }
-
+void __cpuinit xen_enable_nmi(void)
+{
+#ifdef CONFIG_X86_64
+        if (register_callback(CALLBACKTYPE_nmi, nmi))
+                BUG();
+#endif
+}
 void __init xen_arch_setup(void)
 {
         xen_panic_handler_init();
@@ -543,7 +580,7 @@ void __init xen_arch_setup(void)
 
         xen_enable_sysenter();
         xen_enable_syscall();
-
+        xen_enable_nmi();
 #ifdef CONFIG_ACPI
         if (!(xen_start_info->flags & SIF_INITDOMAIN)) {
                 printk(KERN_INFO "ACPI in unprivileged domain disabled\n");
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index ca92754eb846..9235842cd76a 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -279,6 +279,7 @@ static void __init xen_smp_prepare_boot_cpu(void)
 
         xen_filter_cpu_maps();
         xen_setup_vcpu_info_placement();
+        xen_init_spinlocks();
 }
 
 static void __init xen_smp_prepare_cpus(unsigned int max_cpus)
@@ -572,6 +573,12 @@ static inline int xen_map_vector(int vector)
         case IRQ_WORK_VECTOR:
                 xen_vector = XEN_IRQ_WORK_VECTOR;
                 break;
+#ifdef CONFIG_X86_64
+        case NMI_VECTOR:
+        case APIC_DM_NMI: /* Some use that instead of NMI_VECTOR */
+                xen_vector = XEN_NMI_VECTOR;
+                break;
+#endif
         default:
                 xen_vector = -1;
                 printk(KERN_ERR "xen: vector 0x%x is not implemented\n",
@@ -680,7 +687,6 @@ void __init xen_smp_init(void)
 {
         smp_ops = xen_smp_ops;
         xen_fill_possible_map();
-        xen_init_spinlocks();
 }
 
 static void __init xen_hvm_smp_prepare_cpus(unsigned int max_cpus)
@@ -694,8 +700,15 @@ static void __init xen_hvm_smp_prepare_cpus(unsigned int max_cpus)
 static int xen_hvm_cpu_up(unsigned int cpu, struct task_struct *tidle)
 {
         int rc;
-        rc = native_cpu_up(cpu, tidle);
-        WARN_ON (xen_smp_intr_init(cpu));
+        /*
+         * xen_smp_intr_init() needs to run before native_cpu_up()
+         * so that IPI vectors are set up on the booting CPU before
+         * it is marked online in native_cpu_up().
+        */
+        rc = xen_smp_intr_init(cpu);
+        WARN_ON(rc);
+        if (!rc)
+                rc =  native_cpu_up(cpu, tidle);
         return rc;
 }
 
diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
index cf3caee356b3..0438b9324a72 100644
--- a/arch/x86/xen/spinlock.c
+++ b/arch/x86/xen/spinlock.c
@@ -17,45 +17,44 @@
 #include "xen-ops.h"
 #include "debugfs.h"
 
-#ifdef CONFIG_XEN_DEBUG_FS
-static struct xen_spinlock_stats
-{
-        u64 taken;
-        u32 taken_slow;
-        u32 taken_slow_nested;
-        u32 taken_slow_pickup;
-        u32 taken_slow_spurious;
-        u32 taken_slow_irqenable;
+enum xen_contention_stat {
+        TAKEN_SLOW,
+        TAKEN_SLOW_PICKUP,
+        TAKEN_SLOW_SPURIOUS,
+        RELEASED_SLOW,
+        RELEASED_SLOW_KICKED,
+        NR_CONTENTION_STATS
+};
 
-        u64 released;
-        u32 released_slow;
-        u32 released_slow_kicked;
 
+#ifdef CONFIG_XEN_DEBUG_FS
 #define HISTO_BUCKETS   30
-        u32 histo_spin_total[HISTO_BUCKETS+1];
-        u32 histo_spin_spinning[HISTO_BUCKETS+1];
+static struct xen_spinlock_stats
+{
+        u32 contention_stats[NR_CONTENTION_STATS];
         u32 histo_spin_blocked[HISTO_BUCKETS+1];
-
-        u64 time_total;
-        u64 time_spinning;
         u64 time_blocked;
 } spinlock_stats;
 
 static u8 zero_stats;
 
-static unsigned lock_timeout = 1 << 10;
-#define TIMEOUT lock_timeout
-
 static inline void check_zero(void)
 {
-        if (unlikely(zero_stats)) {
-                memset(&spinlock_stats, 0, sizeof(spinlock_stats));
-                zero_stats = 0;
+        u8 ret;
+        u8 old = ACCESS_ONCE(zero_stats);
+        if (unlikely(old)) {
+                ret = cmpxchg(&zero_stats, old, 0);
+                /* This ensures only one fellow resets the stat */
+                if (ret == old)
+                        memset(&spinlock_stats, 0, sizeof(spinlock_stats));
         }
 }
 
-#define ADD_STATS(elem, val)                    \
-        do { check_zero(); spinlock_stats.elem += (val); } while(0)
+static inline void add_stats(enum xen_contention_stat var, u32 val)
+{
+        check_zero();
+        spinlock_stats.contention_stats[var] += val;
+}
 
 static inline u64 spin_time_start(void)
 {
@@ -74,22 +73,6 @@ static void __spin_time_accum(u64 delta, u32 *array)
                 array[HISTO_BUCKETS]++;
 }
 
-static inline void spin_time_accum_spinning(u64 start)
-{
-        u32 delta = xen_clocksource_read() - start;
-
-        __spin_time_accum(delta, spinlock_stats.histo_spin_spinning);
-        spinlock_stats.time_spinning += delta;
-}
-
-static inline void spin_time_accum_total(u64 start)
-{
-        u32 delta = xen_clocksource_read() - start;
-
-        __spin_time_accum(delta, spinlock_stats.histo_spin_total);
-        spinlock_stats.time_total += delta;
-}
-
 static inline void spin_time_accum_blocked(u64 start)
 {
         u32 delta = xen_clocksource_read() - start;
@@ -99,19 +82,15 @@ static inline void spin_time_accum_blocked(u64 start)
 }
 #else  /* !CONFIG_XEN_DEBUG_FS */
 #define TIMEOUT                 (1 << 10)
-#define ADD_STATS(elem, val)    do { (void)(val); } while(0)
+static inline void add_stats(enum xen_contention_stat var, u32 val)
+{
+}
 
 static inline u64 spin_time_start(void)
 {
         return 0;
 }
 
-static inline void spin_time_accum_total(u64 start)
-{
-}
-static inline void spin_time_accum_spinning(u64 start)
-{
-}
 static inline void spin_time_accum_blocked(u64 start)
 {
 }
@@ -134,227 +113,123 @@ typedef u16 xen_spinners_t;
         asm(LOCK_PREFIX " decw %0" : "+m" ((xl)->spinners) : : "memory");
 #endif
 
-struct xen_spinlock {
-        unsigned char lock;             /* 0 -> free; 1 -> locked */
-        xen_spinners_t spinners;        /* count of waiting cpus */
+struct xen_lock_waiting {
+        struct arch_spinlock *lock;
+        __ticket_t want;
 };
 
-static int xen_spin_is_locked(struct arch_spinlock *lock)
-{
-        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
-
-        return xl->lock != 0;
-}
-
-static int xen_spin_is_contended(struct arch_spinlock *lock)
-{
-        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
-
-        /* Not strictly true; this is only the count of contended
-           lock-takers entering the slow path. */
-        return xl->spinners != 0;
-}
-
-static int xen_spin_trylock(struct arch_spinlock *lock)
-{
-        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
-        u8 old = 1;
-
-        asm("xchgb %b0,%1"
-            : "+q" (old), "+m" (xl->lock) : : "memory");
-
-        return old == 0;
-}
-
-static DEFINE_PER_CPU(char *, irq_name);
 static DEFINE_PER_CPU(int, lock_kicker_irq) = -1;
-static DEFINE_PER_CPU(struct xen_spinlock *, lock_spinners);
-
-/*
- * Mark a cpu as interested in a lock.  Returns the CPU's previous
- * lock of interest, in case we got preempted by an interrupt.
- */
-static inline struct xen_spinlock *spinning_lock(struct xen_spinlock *xl)
-{
-        struct xen_spinlock *prev;
-
-        prev = __this_cpu_read(lock_spinners);
-        __this_cpu_write(lock_spinners, xl);
-
-        wmb();                  /* set lock of interest before count */
-
-        inc_spinners(xl);
-
-        return prev;
-}
-
-/*
- * Mark a cpu as no longer interested in a lock.  Restores previous
- * lock of interest (NULL for none).
- */
-static inline void unspinning_lock(struct xen_spinlock *xl, struct xen_spinlock *prev)
-{
-        dec_spinners(xl);
-        wmb();                  /* decrement count before restoring lock */
-        __this_cpu_write(lock_spinners, prev);
-}
+static DEFINE_PER_CPU(char *, irq_name);
+static DEFINE_PER_CPU(struct xen_lock_waiting, lock_waiting);
+static cpumask_t waiting_cpus;
 
-static noinline int xen_spin_lock_slow(struct arch_spinlock *lock, bool irq_enable)
+static void xen_lock_spinning(struct arch_spinlock *lock, __ticket_t want)
 {
-        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
-        struct xen_spinlock *prev;
         int irq = __this_cpu_read(lock_kicker_irq);
-        int ret;
+        struct xen_lock_waiting *w = &__get_cpu_var(lock_waiting);
+        int cpu = smp_processor_id();
         u64 start;
+        unsigned long flags;
 
         /* If kicker interrupts not initialized yet, just spin */
         if (irq == -1)
-                return 0;
+                return;
 
         start = spin_time_start();
 
-        /* announce we're spinning */
-        prev = spinning_lock(xl);
+        /*
+         * Make sure an interrupt handler can't upset things in a
+         * partially setup state.
+         */
+        local_irq_save(flags);
+        /*
+         * We don't really care if we're overwriting some other
+         * (lock,want) pair, as that would mean that we're currently
+         * in an interrupt context, and the outer context had
+         * interrupts enabled.  That has already kicked the VCPU out
+         * of xen_poll_irq(), so it will just return spuriously and
+         * retry with newly setup (lock,want).
+         *
+         * The ordering protocol on this is that the "lock" pointer
+         * may only be set non-NULL if the "want" ticket is correct.
+         * If we're updating "want", we must first clear "lock".
+         */
+        w->lock = NULL;
+        smp_wmb();
+        w->want = want;
+        smp_wmb();
+        w->lock = lock;
 
-        ADD_STATS(taken_slow, 1);
-        ADD_STATS(taken_slow_nested, prev != NULL);
+        /* This uses set_bit, which atomic and therefore a barrier */
+        cpumask_set_cpu(cpu, &waiting_cpus);
+        add_stats(TAKEN_SLOW, 1);
 
-        do {
-                unsigned long flags;
+        /* clear pending */
+        xen_clear_irq_pending(irq);
 
-                /* clear pending */
-                xen_clear_irq_pending(irq);
+        /* Only check lock once pending cleared */
+        barrier();
 
-                /* check again make sure it didn't become free while
-                   we weren't looking  */
-                ret = xen_spin_trylock(lock);
-                if (ret) {
-                        ADD_STATS(taken_slow_pickup, 1);
+        /*
+         * Mark entry to slowpath before doing the pickup test to make
+         * sure we don't deadlock with an unlocker.
+         */
+        __ticket_enter_slowpath(lock);
 
-                        /*
-                         * If we interrupted another spinlock while it
-                         * was blocking, make sure it doesn't block
-                         * without rechecking the lock.
-                         */
-                        if (prev != NULL)
-                                xen_set_irq_pending(irq);
-                        goto out;
-                }
+        /*
+         * check again make sure it didn't become free while
+         * we weren't looking
+         */
+        if (ACCESS_ONCE(lock->tickets.head) == want) {
+                add_stats(TAKEN_SLOW_PICKUP, 1);
+                goto out;
+        }
 
-                flags = arch_local_save_flags();
-                if (irq_enable) {
-                        ADD_STATS(taken_slow_irqenable, 1);
-                        raw_local_irq_enable();
-                }
+        /* Allow interrupts while blocked */
+        local_irq_restore(flags);
 
-                /*
-                 * Block until irq becomes pending.  If we're
-                 * interrupted at this point (after the trylock but
-                 * before entering the block), then the nested lock
-                 * handler guarantees that the irq will be left
-                 * pending if there's any chance the lock became free;
-                 * xen_poll_irq() returns immediately if the irq is
-                 * pending.
-                 */
-                xen_poll_irq(irq);
+        /*
+         * If an interrupt happens here, it will leave the wakeup irq
+         * pending, which will cause xen_poll_irq() to return
+         * immediately.
+         */
 
-                raw_local_irq_restore(flags);
+        /* Block until irq becomes pending (or perhaps a spurious wakeup) */
+        xen_poll_irq(irq);
+        add_stats(TAKEN_SLOW_SPURIOUS, !xen_test_irq_pending(irq));
 
-                ADD_STATS(taken_slow_spurious, !xen_test_irq_pending(irq));
-        } while (!xen_test_irq_pending(irq)); /* check for spurious wakeups */
+        local_irq_save(flags);
 
         kstat_incr_irqs_this_cpu(irq, irq_to_desc(irq));
-
 out:
-        unspinning_lock(xl, prev);
-        spin_time_accum_blocked(start);
-
-        return ret;
-}
-
-static inline void __xen_spin_lock(struct arch_spinlock *lock, bool irq_enable)
-{
-        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
-        unsigned timeout;
-        u8 oldval;
-        u64 start_spin;
-
-        ADD_STATS(taken, 1);
-
-        start_spin = spin_time_start();
-
-        do {
-                u64 start_spin_fast = spin_time_start();
-
-                timeout = TIMEOUT;
-
-                asm("1: xchgb %1,%0\n"
-                    "   testb %1,%1\n"
-                    "   jz 3f\n"
-                    "2: rep;nop\n"
-                    "   cmpb $0,%0\n"
-                    "   je 1b\n"
-                    "   dec %2\n"
-                    "   jnz 2b\n"
-                    "3:\n"
-                    : "+m" (xl->lock), "=q" (oldval), "+r" (timeout)
-                    : "1" (1)
-                    : "memory");
+        cpumask_clear_cpu(cpu, &waiting_cpus);
+        w->lock = NULL;
 
-                spin_time_accum_spinning(start_spin_fast);
+        local_irq_restore(flags);
 
-        } while (unlikely(oldval != 0 &&
-                          (TIMEOUT == ~0 || !xen_spin_lock_slow(lock, irq_enable))));
-
-        spin_time_accum_total(start_spin);
-}
-
-static void xen_spin_lock(struct arch_spinlock *lock)
-{
-        __xen_spin_lock(lock, false);
-}
-
-static void xen_spin_lock_flags(struct arch_spinlock *lock, unsigned long flags)
-{
-        __xen_spin_lock(lock, !raw_irqs_disabled_flags(flags));
+        spin_time_accum_blocked(start);
 }
+PV_CALLEE_SAVE_REGS_THUNK(xen_lock_spinning);
 
-static noinline void xen_spin_unlock_slow(struct xen_spinlock *xl)
+static void xen_unlock_kick(struct arch_spinlock *lock, __ticket_t next)
 {
         int cpu;
 
-        ADD_STATS(released_slow, 1);
+        add_stats(RELEASED_SLOW, 1);
+
+        for_each_cpu(cpu, &waiting_cpus) {
+                const struct xen_lock_waiting *w = &per_cpu(lock_waiting, cpu);
 
-        for_each_online_cpu(cpu) {
-                /* XXX should mix up next cpu selection */
-                if (per_cpu(lock_spinners, cpu) == xl) {
-                        ADD_STATS(released_slow_kicked, 1);
+                /* Make sure we read lock before want */
+                if (ACCESS_ONCE(w->lock) == lock &&
+                    ACCESS_ONCE(w->want) == next) {
+                        add_stats(RELEASED_SLOW_KICKED, 1);
                         xen_send_IPI_one(cpu, XEN_SPIN_UNLOCK_VECTOR);
+                        break;
                 }
         }
 }
 
-static void xen_spin_unlock(struct arch_spinlock *lock)
-{
-        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
-
-        ADD_STATS(released, 1);
-
-        smp_wmb();              /* make sure no writes get moved after unlock */
-        xl->lock = 0;           /* release lock */
-
-        /*
-         * Make sure unlock happens before checking for waiting
-         * spinners.  We need a strong barrier to enforce the
-         * write-read ordering to different memory locations, as the
-         * CPU makes no implied guarantees about their ordering.
-         */
-        mb();
-
-        if (unlikely(xl->spinners))
-                xen_spin_unlock_slow(xl);
-}
-
 static irqreturn_t dummy_handler(int irq, void *dev_id)
 {
         BUG();
@@ -408,6 +283,8 @@ void xen_uninit_lock_cpu(int cpu)
         per_cpu(irq_name, cpu) = NULL;
 }
 
+static bool xen_pvspin __initdata = true;
+
 void __init xen_init_spinlocks(void)
 {
         /*
@@ -417,15 +294,23 @@ void __init xen_init_spinlocks(void)
         if (xen_hvm_domain())
                 return;
 
-        BUILD_BUG_ON(sizeof(struct xen_spinlock) > sizeof(arch_spinlock_t));
+        if (!xen_pvspin) {
+                printk(KERN_DEBUG "xen: PV spinlocks disabled\n");
+                return;
+        }
 
-        pv_lock_ops.spin_is_locked = xen_spin_is_locked;
-        pv_lock_ops.spin_is_contended = xen_spin_is_contended;
-        pv_lock_ops.spin_lock = xen_spin_lock;
-        pv_lock_ops.spin_lock_flags = xen_spin_lock_flags;
-        pv_lock_ops.spin_trylock = xen_spin_trylock;
-        pv_lock_ops.spin_unlock = xen_spin_unlock;
+        static_key_slow_inc(&paravirt_ticketlocks_enabled);
+
+        pv_lock_ops.lock_spinning = PV_CALLEE_SAVE(xen_lock_spinning);
+        pv_lock_ops.unlock_kick = xen_unlock_kick;
+}
+
+static __init int xen_parse_nopvspin(char *arg)
+{
+        xen_pvspin = false;
+        return 0;
 }
+early_param("xen_nopvspin", xen_parse_nopvspin);
 
 #ifdef CONFIG_XEN_DEBUG_FS
 
@@ -442,37 +327,21 @@ static int __init xen_spinlock_debugfs(void)
 
         debugfs_create_u8("zero_stats", 0644, d_spin_debug, &zero_stats);
 
-        debugfs_create_u32("timeout", 0644, d_spin_debug, &lock_timeout);
-
-        debugfs_create_u64("taken", 0444, d_spin_debug, &spinlock_stats.taken);
         debugfs_create_u32("taken_slow", 0444, d_spin_debug,
-                           &spinlock_stats.taken_slow);
-        debugfs_create_u32("taken_slow_nested", 0444, d_spin_debug,
-                           &spinlock_stats.taken_slow_nested);
+                           &spinlock_stats.contention_stats[TAKEN_SLOW]);
         debugfs_create_u32("taken_slow_pickup", 0444, d_spin_debug,
-                           &spinlock_stats.taken_slow_pickup);
+                           &spinlock_stats.contention_stats[TAKEN_SLOW_PICKUP]);
         debugfs_create_u32("taken_slow_spurious", 0444, d_spin_debug,
-                           &spinlock_stats.taken_slow_spurious);
-        debugfs_create_u32("taken_slow_irqenable", 0444, d_spin_debug,
-                           &spinlock_stats.taken_slow_irqenable);
+                           &spinlock_stats.contention_stats[TAKEN_SLOW_SPURIOUS]);
 
-        debugfs_create_u64("released", 0444, d_spin_debug, &spinlock_stats.released);
         debugfs_create_u32("released_slow", 0444, d_spin_debug,
-                           &spinlock_stats.released_slow);
+                           &spinlock_stats.contention_stats[RELEASED_SLOW]);
         debugfs_create_u32("released_slow_kicked", 0444, d_spin_debug,
-                           &spinlock_stats.released_slow_kicked);
+                           &spinlock_stats.contention_stats[RELEASED_SLOW_KICKED]);
 
-        debugfs_create_u64("time_spinning", 0444, d_spin_debug,
-                           &spinlock_stats.time_spinning);
         debugfs_create_u64("time_blocked", 0444, d_spin_debug,
                            &spinlock_stats.time_blocked);
-        debugfs_create_u64("time_total", 0444, d_spin_debug,
-                           &spinlock_stats.time_total);
 
-        debugfs_create_u32_array("histo_total", 0444, d_spin_debug,
-                                spinlock_stats.histo_spin_total, HISTO_BUCKETS + 1);
-        debugfs_create_u32_array("histo_spinning", 0444, d_spin_debug,
-                                spinlock_stats.histo_spin_spinning, HISTO_BUCKETS + 1);
         debugfs_create_u32_array("histo_blocked", 0444, d_spin_debug,
                                 spinlock_stats.histo_spin_blocked, HISTO_BUCKETS + 1);
 
diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
index 86782c5d7e2a..95f8c6142328 100644
--- a/arch/x86/xen/xen-ops.h
+++ b/arch/x86/xen/xen-ops.h
@@ -105,9 +105,9 @@ static inline void __init xen_init_apic(void)
 /* Declare an asm function, along with symbols needed to make it
    inlineable */
 #define DECL_ASM(ret, name, ...)                \
-        ret name(__VA_ARGS__);                  \
-        extern char name##_end[];               \
-        extern char name##_reloc[]              \
+        __visible ret name(__VA_ARGS__);        \
+        extern char name##_end[] __visible;     \
+        extern char name##_reloc[] __visible
 
 DECL_ASM(void, xen_irq_enable_direct, void);
 DECL_ASM(void, xen_irq_disable_direct, void);
@@ -115,11 +115,11 @@ DECL_ASM(unsigned long, xen_save_fl_direct, void);
 DECL_ASM(void, xen_restore_fl_direct, unsigned long);
 
 /* These are not functions, and cannot be called normally */
-void xen_iret(void);
-void xen_sysexit(void);
-void xen_sysret32(void);
-void xen_sysret64(void);
-void xen_adjust_exception_frame(void);
+__visible void xen_iret(void);
+__visible void xen_sysexit(void);
+__visible void xen_sysret32(void);
+__visible void xen_sysret64(void);
+__visible void xen_adjust_exception_frame(void);
 
 extern int xen_panic_handler_init(void);