152 files changed, 10918 insertions, 1837 deletions

diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index 11224eddcdc2..146fd6147e84 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -34,21 +34,13 @@
 #include <errno.h>
 #include <arpa/inet.h>
 #include <linux/connector.h>
+#include <linux/hyperv.h>
 #include <linux/netlink.h>
 #include <ifaddrs.h>
 #include <netdb.h>
 #include <syslog.h>
-
-/*
- * KYS: TODO. Need to register these in the kernel.
- *
- * The following definitions are shared with the in-kernel component; do not
- * change any of this without making the corresponding changes in
- * the KVP kernel component.
- */
-#define CN_KVP_IDX              0x9     /* MSFT KVP functionality */
-#define CN_KVP_VAL              0x1 /* This supports queries from the kernel */
-#define CN_KVP_USER_VAL         0x2 /* This supports queries from the user  */
+#include <sys/stat.h>
+#include <fcntl.h>
 
 /*
  * KVP protocol: The user mode component first registers with the
@@ -60,25 +52,8 @@
  * We use this infrastructure for also supporting queries from user mode
  * application for state that may be maintained in the KVP kernel component.
  *
- * XXXKYS: Have a shared header file between the user and kernel (TODO)
  */
 
-enum kvp_op {
-        KVP_REGISTER = 0, /* Register the user mode component*/
-        KVP_KERNEL_GET, /*Kernel is requesting the value for the specified key*/
-        KVP_KERNEL_SET, /*Kernel is providing the value for the specified key*/
-        KVP_USER_GET, /*User is requesting the value for the specified key*/
-        KVP_USER_SET /*User is providing the value for the specified key*/
-};
-
-#define HV_KVP_EXCHANGE_MAX_KEY_SIZE    512
-#define HV_KVP_EXCHANGE_MAX_VALUE_SIZE  2048
-
-struct hv_ku_msg {
-        __u32   kvp_index;
-        __u8  kvp_key[HV_KVP_EXCHANGE_MAX_KEY_SIZE]; /* Key name */
-        __u8  kvp_value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE]; /* Key  value */
-};
 
 enum key_index {
         FullyQualifiedDomainName = 0,
@@ -93,10 +68,6 @@ enum key_index {
         ProcessorArchitecture
 };
 
-/*
- * End of shared definitions.
- */
-
 static char kvp_send_buffer[4096];
 static char kvp_recv_buffer[4096];
 static struct sockaddr_nl addr;
@@ -109,6 +80,345 @@ static char *os_build;
 static char *lic_version;
 static struct utsname uts_buf;
 
+
+#define MAX_FILE_NAME 100
+#define ENTRIES_PER_BLOCK 50
+
+struct kvp_record {
+        __u8 key[HV_KVP_EXCHANGE_MAX_KEY_SIZE];
+        __u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE];
+};
+
+struct kvp_file_state {
+        int fd;
+        int num_blocks;
+        struct kvp_record *records;
+        int num_records;
+        __u8 fname[MAX_FILE_NAME];
+};
+
+static struct kvp_file_state kvp_file_info[KVP_POOL_COUNT];
+
+static void kvp_acquire_lock(int pool)
+{
+        struct flock fl = {F_WRLCK, SEEK_SET, 0, 0, 0};
+        fl.l_pid = getpid();
+
+        if (fcntl(kvp_file_info[pool].fd, F_SETLKW, &fl) == -1) {
+                syslog(LOG_ERR, "Failed to acquire the lock pool: %d", pool);
+                exit(-1);
+        }
+}
+
+static void kvp_release_lock(int pool)
+{
+        struct flock fl = {F_UNLCK, SEEK_SET, 0, 0, 0};
+        fl.l_pid = getpid();
+
+        if (fcntl(kvp_file_info[pool].fd, F_SETLK, &fl) == -1) {
+                perror("fcntl");
+                syslog(LOG_ERR, "Failed to release the lock pool: %d", pool);
+                exit(-1);
+        }
+}
+
+static void kvp_update_file(int pool)
+{
+        FILE *filep;
+        size_t bytes_written;
+
+        /*
+         * We are going to write our in-memory registry out to
+         * disk; acquire the lock first.
+         */
+        kvp_acquire_lock(pool);
+
+        filep = fopen(kvp_file_info[pool].fname, "w");
+        if (!filep) {
+                kvp_release_lock(pool);
+                syslog(LOG_ERR, "Failed to open file, pool: %d", pool);
+                exit(-1);
+        }
+
+        bytes_written = fwrite(kvp_file_info[pool].records,
+                                sizeof(struct kvp_record),
+                                kvp_file_info[pool].num_records, filep);
+
+        fflush(filep);
+        kvp_release_lock(pool);
+}
+
+static void kvp_update_mem_state(int pool)
+{
+        FILE *filep;
+        size_t records_read = 0;
+        struct kvp_record *record = kvp_file_info[pool].records;
+        struct kvp_record *readp;
+        int num_blocks = kvp_file_info[pool].num_blocks;
+        int alloc_unit = sizeof(struct kvp_record) * ENTRIES_PER_BLOCK;
+
+        kvp_acquire_lock(pool);
+
+        filep = fopen(kvp_file_info[pool].fname, "r");
+        if (!filep) {
+                kvp_release_lock(pool);
+                syslog(LOG_ERR, "Failed to open file, pool: %d", pool);
+                exit(-1);
+        }
+        while (!feof(filep)) {
+                readp = &record[records_read];
+                records_read += fread(readp, sizeof(struct kvp_record),
+                                        ENTRIES_PER_BLOCK * num_blocks,
+                                        filep);
+
+                if (!feof(filep)) {
+                        /*
+                         * We have more data to read.
+                         */
+                        num_blocks++;
+                        record = realloc(record, alloc_unit * num_blocks);
+
+                        if (record == NULL) {
+                                syslog(LOG_ERR, "malloc failed");
+                                exit(-1);
+                        }
+                        continue;
+                }
+                break;
+        }
+
+        kvp_file_info[pool].num_blocks = num_blocks;
+        kvp_file_info[pool].records = record;
+        kvp_file_info[pool].num_records = records_read;
+
+        kvp_release_lock(pool);
+}
+static int kvp_file_init(void)
+{
+        int ret, fd;
+        FILE *filep;
+        size_t records_read;
+        __u8 *fname;
+        struct kvp_record *record;
+        struct kvp_record *readp;
+        int num_blocks;
+        int i;
+        int alloc_unit = sizeof(struct kvp_record) * ENTRIES_PER_BLOCK;
+
+        if (access("/var/opt/hyperv", F_OK)) {
+                if (mkdir("/var/opt/hyperv", S_IRUSR | S_IWUSR | S_IROTH)) {
+                        syslog(LOG_ERR, " Failed to create /var/opt/hyperv");
+                        exit(-1);
+                }
+        }
+
+        for (i = 0; i < KVP_POOL_COUNT; i++) {
+                fname = kvp_file_info[i].fname;
+                records_read = 0;
+                num_blocks = 1;
+                sprintf(fname, "/var/opt/hyperv/.kvp_pool_%d", i);
+                fd = open(fname, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR | S_IROTH);
+
+                if (fd == -1)
+                        return 1;
+
+
+                filep = fopen(fname, "r");
+                if (!filep)
+                        return 1;
+
+                record = malloc(alloc_unit * num_blocks);
+                if (record == NULL) {
+                        fclose(filep);
+                        return 1;
+                }
+                while (!feof(filep)) {
+                        readp = &record[records_read];
+                        records_read += fread(readp, sizeof(struct kvp_record),
+                                        ENTRIES_PER_BLOCK,
+                                        filep);
+
+                        if (!feof(filep)) {
+                                /*
+                                 * We have more data to read.
+                                 */
+                                num_blocks++;
+                                record = realloc(record, alloc_unit *
+                                                num_blocks);
+                                if (record == NULL) {
+                                        fclose(filep);
+                                        return 1;
+                                }
+                                continue;
+                        }
+                        break;
+                }
+                kvp_file_info[i].fd = fd;
+                kvp_file_info[i].num_blocks = num_blocks;
+                kvp_file_info[i].records = record;
+                kvp_file_info[i].num_records = records_read;
+                fclose(filep);
+
+        }
+
+        return 0;
+}
+
+static int kvp_key_delete(int pool, __u8 *key, int key_size)
+{
+        int i;
+        int j, k;
+        int num_records;
+        struct kvp_record *record;
+
+        /*
+         * First update the in-memory state.
+         */
+        kvp_update_mem_state(pool);
+
+        num_records = kvp_file_info[pool].num_records;
+        record = kvp_file_info[pool].records;
+
+        for (i = 0; i < num_records; i++) {
+                if (memcmp(key, record[i].key, key_size))
+                        continue;
+                /*
+                 * Found a match; just move the remaining
+                 * entries up.
+                 */
+                if (i == num_records) {
+                        kvp_file_info[pool].num_records--;
+                        kvp_update_file(pool);
+                        return 0;
+                }
+
+                j = i;
+                k = j + 1;
+                for (; k < num_records; k++) {
+                        strcpy(record[j].key, record[k].key);
+                        strcpy(record[j].value, record[k].value);
+                        j++;
+                }
+
+                kvp_file_info[pool].num_records--;
+                kvp_update_file(pool);
+                return 0;
+        }
+        return 1;
+}
+
+static int kvp_key_add_or_modify(int pool, __u8 *key, int key_size, __u8 *value,
+                        int value_size)
+{
+        int i;
+        int j, k;
+        int num_records;
+        struct kvp_record *record;
+        int num_blocks;
+
+        if ((key_size > HV_KVP_EXCHANGE_MAX_KEY_SIZE) ||
+                (value_size > HV_KVP_EXCHANGE_MAX_VALUE_SIZE))
+                return 1;
+
+        /*
+         * First update the in-memory state.
+         */
+        kvp_update_mem_state(pool);
+
+        num_records = kvp_file_info[pool].num_records;
+        record = kvp_file_info[pool].records;
+        num_blocks = kvp_file_info[pool].num_blocks;
+
+        for (i = 0; i < num_records; i++) {
+                if (memcmp(key, record[i].key, key_size))
+                        continue;
+                /*
+                 * Found a match; just update the value -
+                 * this is the modify case.
+                 */
+                memcpy(record[i].value, value, value_size);
+                kvp_update_file(pool);
+                return 0;
+        }
+
+        /*
+         * Need to add a new entry;
+         */
+        if (num_records == (ENTRIES_PER_BLOCK * num_blocks)) {
+                /* Need to allocate a larger array for reg entries. */
+                record = realloc(record, sizeof(struct kvp_record) *
+                         ENTRIES_PER_BLOCK * (num_blocks + 1));
+
+                if (record == NULL)
+                        return 1;
+                kvp_file_info[pool].num_blocks++;
+
+        }
+        memcpy(record[i].value, value, value_size);
+        memcpy(record[i].key, key, key_size);
+        kvp_file_info[pool].records = record;
+        kvp_file_info[pool].num_records++;
+        kvp_update_file(pool);
+        return 0;
+}
+
+static int kvp_get_value(int pool, __u8 *key, int key_size, __u8 *value,
+                        int value_size)
+{
+        int i;
+        int num_records;
+        struct kvp_record *record;
+
+        if ((key_size > HV_KVP_EXCHANGE_MAX_KEY_SIZE) ||
+                (value_size > HV_KVP_EXCHANGE_MAX_VALUE_SIZE))
+                return 1;
+
+        /*
+         * First update the in-memory state.
+         */
+        kvp_update_mem_state(pool);
+
+        num_records = kvp_file_info[pool].num_records;
+        record = kvp_file_info[pool].records;
+
+        for (i = 0; i < num_records; i++) {
+                if (memcmp(key, record[i].key, key_size))
+                        continue;
+                /*
+                 * Found a match; just copy the value out.
+                 */
+                memcpy(value, record[i].value, value_size);
+                return 0;
+        }
+
+        return 1;
+}
+
+static void kvp_pool_enumerate(int pool, int index, __u8 *key, int key_size,
+                                __u8 *value, int value_size)
+{
+        struct kvp_record *record;
+
+        /*
+         * First update our in-memory database.
+         */
+        kvp_update_mem_state(pool);
+        record = kvp_file_info[pool].records;
+
+        if (index >= kvp_file_info[pool].num_records) {
+                /*
+                 * This is an invalid index; terminate enumeration;
+                 * - a NULL value will do the trick.
+                 */
+                strcpy(value, "");
+                return;
+        }
+
+        memcpy(key, record[index].key, key_size);
+        memcpy(value, record[index].value, value_size);
+}
+
+
 void kvp_get_os_info(void)
 {
         FILE    *file;
@@ -332,7 +642,7 @@ int main(void)
         struct pollfd pfd;
         struct nlmsghdr *incoming_msg;
         struct cn_msg   *incoming_cn_msg;
-        struct hv_ku_msg *hv_msg;
+        struct hv_kvp_msg *hv_msg;
         char    *p;
         char    *key_value;
         char    *key_name;
@@ -345,6 +655,11 @@ int main(void)
          */
         kvp_get_os_info();
 
+        if (kvp_file_init()) {
+                syslog(LOG_ERR, "Failed to initialize the pools");
+                exit(-1);
+        }
+
         fd = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR);
         if (fd < 0) {
                 syslog(LOG_ERR, "netlink socket creation failed; error:%d", fd);
@@ -370,9 +685,11 @@ int main(void)
         message = (struct cn_msg *)kvp_send_buffer;
         message->id.idx = CN_KVP_IDX;
         message->id.val = CN_KVP_VAL;
-        message->seq = KVP_REGISTER;
+
+        hv_msg = (struct hv_kvp_msg *)message->data;
+        hv_msg->kvp_hdr.operation = KVP_OP_REGISTER;
         message->ack = 0;
-        message->len = 0;
+        message->len = sizeof(struct hv_kvp_msg);
 
         len = netlink_send(fd, message);
         if (len < 0) {
@@ -398,14 +715,15 @@ int main(void)
 
                 incoming_msg = (struct nlmsghdr *)kvp_recv_buffer;
                 incoming_cn_msg = (struct cn_msg *)NLMSG_DATA(incoming_msg);
+                hv_msg = (struct hv_kvp_msg *)incoming_cn_msg->data;
 
-                switch (incoming_cn_msg->seq) {
-                case KVP_REGISTER:
+                switch (hv_msg->kvp_hdr.operation) {
+                case KVP_OP_REGISTER:
                         /*
                          * Driver is registering with us; stash away the version
                          * information.
                          */
-                        p = (char *)incoming_cn_msg->data;
+                        p = (char *)hv_msg->body.kvp_register.version;
                         lic_version = malloc(strlen(p) + 1);
                         if (lic_version) {
                                 strcpy(lic_version, p);
@@ -416,17 +734,65 @@ int main(void)
                         }
                         continue;
 
-                case KVP_KERNEL_GET:
+                /*
+                 * The current protocol with the kernel component uses a
+                 * NULL key name to pass an error condition.
+                 * For the SET, GET and DELETE operations,
+                 * use the existing protocol to pass back error.
+                 */
+
+                case KVP_OP_SET:
+                        if (kvp_key_add_or_modify(hv_msg->kvp_hdr.pool,
+                                        hv_msg->body.kvp_set.data.key,
+                                        hv_msg->body.kvp_set.data.key_size,
+                                        hv_msg->body.kvp_set.data.value,
+                                        hv_msg->body.kvp_set.data.value_size))
+                                strcpy(hv_msg->body.kvp_set.data.key, "");
+                        break;
+
+                case KVP_OP_GET:
+                        if (kvp_get_value(hv_msg->kvp_hdr.pool,
+                                        hv_msg->body.kvp_set.data.key,
+                                        hv_msg->body.kvp_set.data.key_size,
+                                        hv_msg->body.kvp_set.data.value,
+                                        hv_msg->body.kvp_set.data.value_size))
+                                strcpy(hv_msg->body.kvp_set.data.key, "");
+                        break;
+
+                case KVP_OP_DELETE:
+                        if (kvp_key_delete(hv_msg->kvp_hdr.pool,
+                                        hv_msg->body.kvp_delete.key,
+                                        hv_msg->body.kvp_delete.key_size))
+                                strcpy(hv_msg->body.kvp_delete.key, "");
                         break;
+
                 default:
-                        continue;
+                        break;
+                }
+
+                if (hv_msg->kvp_hdr.operation != KVP_OP_ENUMERATE)
+                        goto kvp_done;
+
+                /*
+                 * If the pool is KVP_POOL_AUTO, dynamically generate
+                 * both the key and the value; if not read from the
+                 * appropriate pool.
+                 */
+                if (hv_msg->kvp_hdr.pool != KVP_POOL_AUTO) {
+                        kvp_pool_enumerate(hv_msg->kvp_hdr.pool,
+                                        hv_msg->body.kvp_enum_data.index,
+                                        hv_msg->body.kvp_enum_data.data.key,
+                                        HV_KVP_EXCHANGE_MAX_KEY_SIZE,
+                                        hv_msg->body.kvp_enum_data.data.value,
+                                        HV_KVP_EXCHANGE_MAX_VALUE_SIZE);
+                        goto kvp_done;
                 }
 
-                hv_msg = (struct hv_ku_msg *)incoming_cn_msg->data;
-                key_name = (char *)hv_msg->kvp_key;
-                key_value = (char *)hv_msg->kvp_value;
+                hv_msg = (struct hv_kvp_msg *)incoming_cn_msg->data;
+                key_name = (char *)hv_msg->body.kvp_enum_data.data.key;
+                key_value = (char *)hv_msg->body.kvp_enum_data.data.value;
 
-                switch (hv_msg->kvp_index) {
+                switch (hv_msg->body.kvp_enum_data.index) {
                 case FullyQualifiedDomainName:
                         kvp_get_domain_name(key_value,
                                         HV_KVP_EXCHANGE_MAX_VALUE_SIZE);
@@ -483,12 +849,12 @@ int main(void)
                  * already in the receive buffer. Update the cn_msg header to
                  * reflect the key value that has been added to the message
                  */
+kvp_done:
 
                 incoming_cn_msg->id.idx = CN_KVP_IDX;
                 incoming_cn_msg->id.val = CN_KVP_VAL;
-                incoming_cn_msg->seq = KVP_USER_SET;
                 incoming_cn_msg->ack = 0;
-                incoming_cn_msg->len = sizeof(struct hv_ku_msg);
+                incoming_cn_msg->len = sizeof(struct hv_kvp_msg);
 
                 len = netlink_send(fd, incoming_cn_msg);
                 if (len < 0) {
diff --git a/tools/include/tools/be_byteshift.h b/tools/include/tools/be_byteshift.h
new file mode 100644
index 000000000000..f4912e2668ba
--- /dev/null
+++ b/tools/include/tools/be_byteshift.h
@@ -0,0 +1,70 @@
+#ifndef _TOOLS_BE_BYTESHIFT_H
+#define _TOOLS_BE_BYTESHIFT_H
+
+#include <linux/types.h>
+
+static inline __u16 __get_unaligned_be16(const __u8 *p)
+{
+        return p[0] << 8 | p[1];
+}
+
+static inline __u32 __get_unaligned_be32(const __u8 *p)
+{
+        return p[0] << 24 | p[1] << 16 | p[2] << 8 | p[3];
+}
+
+static inline __u64 __get_unaligned_be64(const __u8 *p)
+{
+        return (__u64)__get_unaligned_be32(p) << 32 |
+               __get_unaligned_be32(p + 4);
+}
+
+static inline void __put_unaligned_be16(__u16 val, __u8 *p)
+{
+        *p++ = val >> 8;
+        *p++ = val;
+}
+
+static inline void __put_unaligned_be32(__u32 val, __u8 *p)
+{
+        __put_unaligned_be16(val >> 16, p);
+        __put_unaligned_be16(val, p + 2);
+}
+
+static inline void __put_unaligned_be64(__u64 val, __u8 *p)
+{
+        __put_unaligned_be32(val >> 32, p);
+        __put_unaligned_be32(val, p + 4);
+}
+
+static inline __u16 get_unaligned_be16(const void *p)
+{
+        return __get_unaligned_be16((const __u8 *)p);
+}
+
+static inline __u32 get_unaligned_be32(const void *p)
+{
+        return __get_unaligned_be32((const __u8 *)p);
+}
+
+static inline __u64 get_unaligned_be64(const void *p)
+{
+        return __get_unaligned_be64((const __u8 *)p);
+}
+
+static inline void put_unaligned_be16(__u16 val, void *p)
+{
+        __put_unaligned_be16(val, p);
+}
+
+static inline void put_unaligned_be32(__u32 val, void *p)
+{
+        __put_unaligned_be32(val, p);
+}
+
+static inline void put_unaligned_be64(__u64 val, void *p)
+{
+        __put_unaligned_be64(val, p);
+}
+
+#endif /* _TOOLS_BE_BYTESHIFT_H */
diff --git a/tools/include/tools/le_byteshift.h b/tools/include/tools/le_byteshift.h
new file mode 100644
index 000000000000..c99d45a68bda
--- /dev/null
+++ b/tools/include/tools/le_byteshift.h
@@ -0,0 +1,70 @@
+#ifndef _TOOLS_LE_BYTESHIFT_H
+#define _TOOLS_LE_BYTESHIFT_H
+
+#include <linux/types.h>
+
+static inline __u16 __get_unaligned_le16(const __u8 *p)
+{
+        return p[0] | p[1] << 8;
+}
+
+static inline __u32 __get_unaligned_le32(const __u8 *p)
+{
+        return p[0] | p[1] << 8 | p[2] << 16 | p[3] << 24;
+}
+
+static inline __u64 __get_unaligned_le64(const __u8 *p)
+{
+        return (__u64)__get_unaligned_le32(p + 4) << 32 |
+               __get_unaligned_le32(p);
+}
+
+static inline void __put_unaligned_le16(__u16 val, __u8 *p)
+{
+        *p++ = val;
+        *p++ = val >> 8;
+}
+
+static inline void __put_unaligned_le32(__u32 val, __u8 *p)
+{
+        __put_unaligned_le16(val >> 16, p + 2);
+        __put_unaligned_le16(val, p);
+}
+
+static inline void __put_unaligned_le64(__u64 val, __u8 *p)
+{
+        __put_unaligned_le32(val >> 32, p + 4);
+        __put_unaligned_le32(val, p);
+}
+
+static inline __u16 get_unaligned_le16(const void *p)
+{
+        return __get_unaligned_le16((const __u8 *)p);
+}
+
+static inline __u32 get_unaligned_le32(const void *p)
+{
+        return __get_unaligned_le32((const __u8 *)p);
+}
+
+static inline __u64 get_unaligned_le64(const void *p)
+{
+        return __get_unaligned_le64((const __u8 *)p);
+}
+
+static inline void put_unaligned_le16(__u16 val, void *p)
+{
+        __put_unaligned_le16(val, p);
+}
+
+static inline void put_unaligned_le32(__u32 val, void *p)
+{
+        __put_unaligned_le32(val, p);
+}
+
+static inline void put_unaligned_le64(__u64 val, void *p)
+{
+        __put_unaligned_le64(val, p);
+}
+
+#endif /* _TOOLS_LE_BYTESHIFT_H */
diff --git a/tools/lguest/.gitignore b/tools/lguest/.gitignore
new file mode 100644
index 000000000000..115587fd5f65
--- /dev/null
+++ b/tools/lguest/.gitignore
@@ -0,0 +1 @@
+lguest
diff --git a/tools/lguest/Makefile b/tools/lguest/Makefile
new file mode 100644
index 000000000000..0ac34206f7a7
--- /dev/null
+++ b/tools/lguest/Makefile
@@ -0,0 +1,8 @@
+# This creates the demonstration utility "lguest" which runs a Linux guest.
+# Missing headers?  Add "-I../../../include -I../../../arch/x86/include"
+CFLAGS:=-m32 -Wall -Wmissing-declarations -Wmissing-prototypes -O3 -U_FORTIFY_SOURCE
+
+all: lguest
+
+clean:
+        rm -f lguest
diff --git a/tools/lguest/extract b/tools/lguest/extract
new file mode 100644
index 000000000000..7730bb6e4b94
--- /dev/null
+++ b/tools/lguest/extract
@@ -0,0 +1,58 @@
+#! /bin/sh
+
+set -e
+
+PREFIX=$1
+shift
+
+trap 'rm -r $TMPDIR' 0
+TMPDIR=`mktemp -d`
+
+exec 3>/dev/null
+for f; do
+    while IFS="
+" read -r LINE; do
+        case "$LINE" in
+            *$PREFIX:[0-9]*:\**)
+                NUM=`echo "$LINE" | sed "s/.*$PREFIX:\([0-9]*\).*/\1/"`
+                if [ -f $TMPDIR/$NUM ]; then
+                    echo "$TMPDIR/$NUM already exits prior to $f"
+                    exit 1
+                fi
+                exec 3>>$TMPDIR/$NUM
+                echo $f | sed 's,\.\./,,g' > $TMPDIR/.$NUM
+                /bin/echo "$LINE" | sed -e "s/$PREFIX:[0-9]*//" -e "s/:\*/*/" >&3
+                ;;
+            *$PREFIX:[0-9]*)
+                NUM=`echo "$LINE" | sed "s/.*$PREFIX:\([0-9]*\).*/\1/"`
+                if [ -f $TMPDIR/$NUM ]; then
+                    echo "$TMPDIR/$NUM already exits prior to $f"
+                    exit 1
+                fi
+                exec 3>>$TMPDIR/$NUM
+                echo $f | sed 's,\.\./,,g' > $TMPDIR/.$NUM
+                /bin/echo "$LINE" | sed "s/$PREFIX:[0-9]*//" >&3
+                ;;
+            *:\**)
+                /bin/echo "$LINE" | sed -e "s/:\*/*/" -e "s,/\*\*/,," >&3
+                echo >&3
+                exec 3>/dev/null
+                ;;
+            *)
+                /bin/echo "$LINE" >&3
+                ;;
+        esac
+    done < $f
+    echo >&3
+    exec 3>/dev/null
+done
+
+LASTFILE=""
+for f in $TMPDIR/*; do
+    if [ "$LASTFILE" != $(cat $TMPDIR/.$(basename $f) ) ]; then
+        LASTFILE=$(cat $TMPDIR/.$(basename $f) )
+        echo "[ $LASTFILE ]"
+    fi
+    cat $f
+done
+
diff --git a/tools/lguest/lguest.c b/tools/lguest/lguest.c
new file mode 100644
index 000000000000..f759f4f097c7
--- /dev/null
+++ b/tools/lguest/lguest.c
@@ -0,0 +1,2065 @@
+/*P:100
+ * This is the Launcher code, a simple program which lays out the "physical"
+ * memory for the new Guest by mapping the kernel image and the virtual
+ * devices, then opens /dev/lguest to tell the kernel about the Guest and
+ * control it.
+:*/
+#define _LARGEFILE64_SOURCE
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <err.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <elf.h>
+#include <sys/mman.h>
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <sys/eventfd.h>
+#include <fcntl.h>
+#include <stdbool.h>
+#include <errno.h>
+#include <ctype.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/time.h>
+#include <time.h>
+#include <netinet/in.h>
+#include <net/if.h>
+#include <linux/sockios.h>
+#include <linux/if_tun.h>
+#include <sys/uio.h>
+#include <termios.h>
+#include <getopt.h>
+#include <assert.h>
+#include <sched.h>
+#include <limits.h>
+#include <stddef.h>
+#include <signal.h>
+#include <pwd.h>
+#include <grp.h>
+
+#include <linux/virtio_config.h>
+#include <linux/virtio_net.h>
+#include <linux/virtio_blk.h>
+#include <linux/virtio_console.h>
+#include <linux/virtio_rng.h>
+#include <linux/virtio_ring.h>
+#include <asm/bootparam.h>
+#include "../../include/linux/lguest_launcher.h"
+/*L:110
+ * We can ignore the 43 include files we need for this program, but I do want
+ * to draw attention to the use of kernel-style types.
+ *
+ * As Linus said, "C is a Spartan language, and so should your naming be."  I
+ * like these abbreviations, so we define them here.  Note that u64 is always
+ * unsigned long long, which works on all Linux systems: this means that we can
+ * use %llu in printf for any u64.
+ */
+typedef unsigned long long u64;
+typedef uint32_t u32;
+typedef uint16_t u16;
+typedef uint8_t u8;
+/*:*/
+
+#define BRIDGE_PFX "bridge:"
+#ifndef SIOCBRADDIF
+#define SIOCBRADDIF     0x89a2          /* add interface to bridge      */
+#endif
+/* We can have up to 256 pages for devices. */
+#define DEVICE_PAGES 256
+/* This will occupy 3 pages: it must be a power of 2. */
+#define VIRTQUEUE_NUM 256
+
+/*L:120
+ * verbose is both a global flag and a macro.  The C preprocessor allows
+ * this, and although I wouldn't recommend it, it works quite nicely here.
+ */
+static bool verbose;
+#define verbose(args...) \
+        do { if (verbose) printf(args); } while(0)
+/*:*/
+
+/* The pointer to the start of guest memory. */
+static void *guest_base;
+/* The maximum guest physical address allowed, and maximum possible. */
+static unsigned long guest_limit, guest_max;
+/* The /dev/lguest file descriptor. */
+static int lguest_fd;
+
+/* a per-cpu variable indicating whose vcpu is currently running */
+static unsigned int __thread cpu_id;
+
+/* This is our list of devices. */
+struct device_list {
+        /* Counter to assign interrupt numbers. */
+        unsigned int next_irq;
+
+        /* Counter to print out convenient device numbers. */
+        unsigned int device_num;
+
+        /* The descriptor page for the devices. */
+        u8 *descpage;
+
+        /* A single linked list of devices. */
+        struct device *dev;
+        /* And a pointer to the last device for easy append. */
+        struct device *lastdev;
+};
+
+/* The list of Guest devices, based on command line arguments. */
+static struct device_list devices;
+
+/* The device structure describes a single device. */
+struct device {
+        /* The linked-list pointer. */
+        struct device *next;
+
+        /* The device's descriptor, as mapped into the Guest. */
+        struct lguest_device_desc *desc;
+
+        /* We can't trust desc values once Guest has booted: we use these. */
+        unsigned int feature_len;
+        unsigned int num_vq;
+
+        /* The name of this device, for --verbose. */
+        const char *name;
+
+        /* Any queues attached to this device */
+        struct virtqueue *vq;
+
+        /* Is it operational */
+        bool running;
+
+        /* Device-specific data. */
+        void *priv;
+};
+
+/* The virtqueue structure describes a queue attached to a device. */
+struct virtqueue {
+        struct virtqueue *next;
+
+        /* Which device owns me. */
+        struct device *dev;
+
+        /* The configuration for this queue. */
+        struct lguest_vqconfig config;
+
+        /* The actual ring of buffers. */
+        struct vring vring;
+
+        /* Last available index we saw. */
+        u16 last_avail_idx;
+
+        /* How many are used since we sent last irq? */
+        unsigned int pending_used;
+
+        /* Eventfd where Guest notifications arrive. */
+        int eventfd;
+
+        /* Function for the thread which is servicing this virtqueue. */
+        void (*service)(struct virtqueue *vq);
+        pid_t thread;
+};
+
+/* Remember the arguments to the program so we can "reboot" */
+static char **main_args;
+
+/* The original tty settings to restore on exit. */
+static struct termios orig_term;
+
+/*
+ * We have to be careful with barriers: our devices are all run in separate
+ * threads and so we need to make sure that changes visible to the Guest happen
+ * in precise order.
+ */
+#define wmb() __asm__ __volatile__("" : : : "memory")
+#define mb() __asm__ __volatile__("" : : : "memory")
+
+/*
+ * Convert an iovec element to the given type.
+ *
+ * This is a fairly ugly trick: we need to know the size of the type and
+ * alignment requirement to check the pointer is kosher.  It's also nice to
+ * have the name of the type in case we report failure.
+ *
+ * Typing those three things all the time is cumbersome and error prone, so we
+ * have a macro which sets them all up and passes to the real function.
+ */
+#define convert(iov, type) \
+        ((type *)_convert((iov), sizeof(type), __alignof__(type), #type))
+
+static void *_convert(struct iovec *iov, size_t size, size_t align,
+                      const char *name)
+{
+        if (iov->iov_len != size)
+                errx(1, "Bad iovec size %zu for %s", iov->iov_len, name);
+        if ((unsigned long)iov->iov_base % align != 0)
+                errx(1, "Bad alignment %p for %s", iov->iov_base, name);
+        return iov->iov_base;
+}
+
+/* Wrapper for the last available index.  Makes it easier to change. */
+#define lg_last_avail(vq)       ((vq)->last_avail_idx)
+
+/*
+ * The virtio configuration space is defined to be little-endian.  x86 is
+ * little-endian too, but it's nice to be explicit so we have these helpers.
+ */
+#define cpu_to_le16(v16) (v16)
+#define cpu_to_le32(v32) (v32)
+#define cpu_to_le64(v64) (v64)
+#define le16_to_cpu(v16) (v16)
+#define le32_to_cpu(v32) (v32)
+#define le64_to_cpu(v64) (v64)
+
+/* Is this iovec empty? */
+static bool iov_empty(const struct iovec iov[], unsigned int num_iov)
+{
+        unsigned int i;
+
+        for (i = 0; i < num_iov; i++)
+                if (iov[i].iov_len)
+                        return false;
+        return true;
+}
+
+/* Take len bytes from the front of this iovec. */
+static void iov_consume(struct iovec iov[], unsigned num_iov, unsigned len)
+{
+        unsigned int i;
+
+        for (i = 0; i < num_iov; i++) {
+                unsigned int used;
+
+                used = iov[i].iov_len < len ? iov[i].iov_len : len;
+                iov[i].iov_base += used;
+                iov[i].iov_len -= used;
+                len -= used;
+        }
+        assert(len == 0);
+}
+
+/* The device virtqueue descriptors are followed by feature bitmasks. */
+static u8 *get_feature_bits(struct device *dev)
+{
+        return (u8 *)(dev->desc + 1)
+                + dev->num_vq * sizeof(struct lguest_vqconfig);
+}
+
+/*L:100
+ * The Launcher code itself takes us out into userspace, that scary place where
+ * pointers run wild and free!  Unfortunately, like most userspace programs,
+ * it's quite boring (which is why everyone likes to hack on the kernel!).
+ * Perhaps if you make up an Lguest Drinking Game at this point, it will get
+ * you through this section.  Or, maybe not.
+ *
+ * The Launcher sets up a big chunk of memory to be the Guest's "physical"
+ * memory and stores it in "guest_base".  In other words, Guest physical ==
+ * Launcher virtual with an offset.
+ *
+ * This can be tough to get your head around, but usually it just means that we
+ * use these trivial conversion functions when the Guest gives us its
+ * "physical" addresses:
+ */
+static void *from_guest_phys(unsigned long addr)
+{
+        return guest_base + addr;
+}
+
+static unsigned long to_guest_phys(const void *addr)
+{
+        return (addr - guest_base);
+}
+
+/*L:130
+ * Loading the Kernel.
+ *
+ * We start with couple of simple helper routines.  open_or_die() avoids
+ * error-checking code cluttering the callers:
+ */
+static int open_or_die(const char *name, int flags)
+{
+        int fd = open(name, flags);
+        if (fd < 0)
+                err(1, "Failed to open %s", name);
+        return fd;
+}
+
+/* map_zeroed_pages() takes a number of pages. */
+static void *map_zeroed_pages(unsigned int num)
+{
+        int fd = open_or_die("/dev/zero", O_RDONLY);
+        void *addr;
+
+        /*
+         * We use a private mapping (ie. if we write to the page, it will be
+         * copied). We allocate an extra two pages PROT_NONE to act as guard
+         * pages against read/write attempts that exceed allocated space.
+         */
+        addr = mmap(NULL, getpagesize() * (num+2),
+                    PROT_NONE, MAP_PRIVATE, fd, 0);
+
+        if (addr == MAP_FAILED)
+                err(1, "Mmapping %u pages of /dev/zero", num);
+
+        if (mprotect(addr + getpagesize(), getpagesize() * num,
+                     PROT_READ|PROT_WRITE) == -1)
+                err(1, "mprotect rw %u pages failed", num);
+
+        /*
+         * One neat mmap feature is that you can close the fd, and it
+         * stays mapped.
+         */
+        close(fd);
+
+        /* Return address after PROT_NONE page */
+        return addr + getpagesize();
+}
+
+/* Get some more pages for a device. */
+static void *get_pages(unsigned int num)
+{
+        void *addr = from_guest_phys(guest_limit);
+
+        guest_limit += num * getpagesize();
+        if (guest_limit > guest_max)
+                errx(1, "Not enough memory for devices");
+        return addr;
+}
+
+/*
+ * This routine is used to load the kernel or initrd.  It tries mmap, but if
+ * that fails (Plan 9's kernel file isn't nicely aligned on page boundaries),
+ * it falls back to reading the memory in.
+ */
+static void map_at(int fd, void *addr, unsigned long offset, unsigned long len)
+{
+        ssize_t r;
+
+        /*
+         * We map writable even though for some segments are marked read-only.
+         * The kernel really wants to be writable: it patches its own
+         * instructions.
+         *
+         * MAP_PRIVATE means that the page won't be copied until a write is
+         * done to it.  This allows us to share untouched memory between
+         * Guests.
+         */
+        if (mmap(addr, len, PROT_READ|PROT_WRITE,
+                 MAP_FIXED|MAP_PRIVATE, fd, offset) != MAP_FAILED)
+                return;
+
+        /* pread does a seek and a read in one shot: saves a few lines. */
+        r = pread(fd, addr, len, offset);
+        if (r != len)
+                err(1, "Reading offset %lu len %lu gave %zi", offset, len, r);
+}
+
+/*
+ * This routine takes an open vmlinux image, which is in ELF, and maps it into
+ * the Guest memory.  ELF = Embedded Linking Format, which is the format used
+ * by all modern binaries on Linux including the kernel.
+ *
+ * The ELF headers give *two* addresses: a physical address, and a virtual
+ * address.  We use the physical address; the Guest will map itself to the
+ * virtual address.
+ *
+ * We return the starting address.
+ */
+static unsigned long map_elf(int elf_fd, const Elf32_Ehdr *ehdr)
+{
+        Elf32_Phdr phdr[ehdr->e_phnum];
+        unsigned int i;
+
+        /*
+         * Sanity checks on the main ELF header: an x86 executable with a
+         * reasonable number of correctly-sized program headers.
+         */
+        if (ehdr->e_type != ET_EXEC
+            || ehdr->e_machine != EM_386
+            || ehdr->e_phentsize != sizeof(Elf32_Phdr)
+            || ehdr->e_phnum < 1 || ehdr->e_phnum > 65536U/sizeof(Elf32_Phdr))
+                errx(1, "Malformed elf header");
+
+        /*
+         * An ELF executable contains an ELF header and a number of "program"
+         * headers which indicate which parts ("segments") of the program to
+         * load where.
+         */
+
+        /* We read in all the program headers at once: */
+        if (lseek(elf_fd, ehdr->e_phoff, SEEK_SET) < 0)
+                err(1, "Seeking to program headers");
+        if (read(elf_fd, phdr, sizeof(phdr)) != sizeof(phdr))
+                err(1, "Reading program headers");
+
+        /*
+         * Try all the headers: there are usually only three.  A read-only one,
+         * a read-write one, and a "note" section which we don't load.
+         */
+        for (i = 0; i < ehdr->e_phnum; i++) {
+                /* If this isn't a loadable segment, we ignore it */
+                if (phdr[i].p_type != PT_LOAD)
+                        continue;
+
+                verbose("Section %i: size %i addr %p\n",
+                        i, phdr[i].p_memsz, (void *)phdr[i].p_paddr);
+
+                /* We map this section of the file at its physical address. */
+                map_at(elf_fd, from_guest_phys(phdr[i].p_paddr),
+                       phdr[i].p_offset, phdr[i].p_filesz);
+        }
+
+        /* The entry point is given in the ELF header. */
+        return ehdr->e_entry;
+}
+
+/*L:150
+ * A bzImage, unlike an ELF file, is not meant to be loaded.  You're supposed
+ * to jump into it and it will unpack itself.  We used to have to perform some
+ * hairy magic because the unpacking code scared me.
+ *
+ * Fortunately, Jeremy Fitzhardinge convinced me it wasn't that hard and wrote
+ * a small patch to jump over the tricky bits in the Guest, so now we just read
+ * the funky header so we know where in the file to load, and away we go!
+ */
+static unsigned long load_bzimage(int fd)
+{
+        struct boot_params boot;
+        int r;
+        /* Modern bzImages get loaded at 1M. */
+        void *p = from_guest_phys(0x100000);
+
+        /*
+         * Go back to the start of the file and read the header.  It should be
+         * a Linux boot header (see Documentation/x86/boot.txt)
+         */
+        lseek(fd, 0, SEEK_SET);
+        read(fd, &boot, sizeof(boot));
+
+        /* Inside the setup_hdr, we expect the magic "HdrS" */
+        if (memcmp(&boot.hdr.header, "HdrS", 4) != 0)
+                errx(1, "This doesn't look like a bzImage to me");
+
+        /* Skip over the extra sectors of the header. */
+        lseek(fd, (boot.hdr.setup_sects+1) * 512, SEEK_SET);
+
+        /* Now read everything into memory. in nice big chunks. */
+        while ((r = read(fd, p, 65536)) > 0)
+                p += r;
+
+        /* Finally, code32_start tells us where to enter the kernel. */
+        return boot.hdr.code32_start;
+}
+
+/*L:140
+ * Loading the kernel is easy when it's a "vmlinux", but most kernels
+ * come wrapped up in the self-decompressing "bzImage" format.  With a little
+ * work, we can load those, too.
+ */
+static unsigned long load_kernel(int fd)
+{
+        Elf32_Ehdr hdr;
+
+        /* Read in the first few bytes. */
+        if (read(fd, &hdr, sizeof(hdr)) != sizeof(hdr))
+                err(1, "Reading kernel");
+
+        /* If it's an ELF file, it starts with "\177ELF" */
+        if (memcmp(hdr.e_ident, ELFMAG, SELFMAG) == 0)
+                return map_elf(fd, &hdr);
+
+        /* Otherwise we assume it's a bzImage, and try to load it. */
+        return load_bzimage(fd);
+}
+
+/*
+ * This is a trivial little helper to align pages.  Andi Kleen hated it because
+ * it calls getpagesize() twice: "it's dumb code."
+ *
+ * Kernel guys get really het up about optimization, even when it's not
+ * necessary.  I leave this code as a reaction against that.
+ */
+static inline unsigned long page_align(unsigned long addr)
+{
+        /* Add upwards and truncate downwards. */
+        return ((addr + getpagesize()-1) & ~(getpagesize()-1));
+}
+
+/*L:180
+ * An "initial ram disk" is a disk image loaded into memory along with the
+ * kernel which the kernel can use to boot from without needing any drivers.
+ * Most distributions now use this as standard: the initrd contains the code to
+ * load the appropriate driver modules for the current machine.
+ *
+ * Importantly, James Morris works for RedHat, and Fedora uses initrds for its
+ * kernels.  He sent me this (and tells me when I break it).
+ */
+static unsigned long load_initrd(const char *name, unsigned long mem)
+{
+        int ifd;
+        struct stat st;
+        unsigned long len;
+
+        ifd = open_or_die(name, O_RDONLY);
+        /* fstat() is needed to get the file size. */
+        if (fstat(ifd, &st) < 0)
+                err(1, "fstat() on initrd '%s'", name);
+
+        /*
+         * We map the initrd at the top of memory, but mmap wants it to be
+         * page-aligned, so we round the size up for that.
+         */
+        len = page_align(st.st_size);
+        map_at(ifd, from_guest_phys(mem - len), 0, st.st_size);
+        /*
+         * Once a file is mapped, you can close the file descriptor.  It's a
+         * little odd, but quite useful.
+         */
+        close(ifd);
+        verbose("mapped initrd %s size=%lu @ %p\n", name, len, (void*)mem-len);
+
+        /* We return the initrd size. */
+        return len;
+}
+/*:*/
+
+/*
+ * Simple routine to roll all the commandline arguments together with spaces
+ * between them.
+ */
+static void concat(char *dst, char *args[])
+{
+        unsigned int i, len = 0;
+
+        for (i = 0; args[i]; i++) {
+                if (i) {
+                        strcat(dst+len, " ");
+                        len++;
+                }
+                strcpy(dst+len, args[i]);
+                len += strlen(args[i]);
+        }
+        /* In case it's empty. */
+        dst[len] = '\0';
+}
+
+/*L:185
+ * This is where we actually tell the kernel to initialize the Guest.  We
+ * saw the arguments it expects when we looked at initialize() in lguest_user.c:
+ * the base of Guest "physical" memory, the top physical page to allow and the
+ * entry point for the Guest.
+ */
+static void tell_kernel(unsigned long start)
+{
+        unsigned long args[] = { LHREQ_INITIALIZE,
+                                 (unsigned long)guest_base,
+                                 guest_limit / getpagesize(), start };
+        verbose("Guest: %p - %p (%#lx)\n",
+                guest_base, guest_base + guest_limit, guest_limit);
+        lguest_fd = open_or_die("/dev/lguest", O_RDWR);
+        if (write(lguest_fd, args, sizeof(args)) < 0)
+                err(1, "Writing to /dev/lguest");
+}
+/*:*/
+
+/*L:200
+ * Device Handling.
+ *
+ * When the Guest gives us a buffer, it sends an array of addresses and sizes.
+ * We need to make sure it's not trying to reach into the Launcher itself, so
+ * we have a convenient routine which checks it and exits with an error message
+ * if something funny is going on:
+ */
+static void *_check_pointer(unsigned long addr, unsigned int size,
+                            unsigned int line)
+{
+        /*
+         * Check if the requested address and size exceeds the allocated memory,
+         * or addr + size wraps around.
+         */
+        if ((addr + size) > guest_limit || (addr + size) < addr)
+                errx(1, "%s:%i: Invalid address %#lx", __FILE__, line, addr);
+        /*
+         * We return a pointer for the caller's convenience, now we know it's
+         * safe to use.
+         */
+        return from_guest_phys(addr);
+}
+/* A macro which transparently hands the line number to the real function. */
+#define check_pointer(addr,size) _check_pointer(addr, size, __LINE__)
+
+/*
+ * Each buffer in the virtqueues is actually a chain of descriptors.  This
+ * function returns the next descriptor in the chain, or vq->vring.num if we're
+ * at the end.
+ */
+static unsigned next_desc(struct vring_desc *desc,
+                          unsigned int i, unsigned int max)
+{
+        unsigned int next;
+
+        /* If this descriptor says it doesn't chain, we're done. */
+        if (!(desc[i].flags & VRING_DESC_F_NEXT))
+                return max;
+
+        /* Check they're not leading us off end of descriptors. */
+        next = desc[i].next;
+        /* Make sure compiler knows to grab that: we don't want it changing! */
+        wmb();
+
+        if (next >= max)
+                errx(1, "Desc next is %u", next);
+
+        return next;
+}
+
+/*
+ * This actually sends the interrupt for this virtqueue, if we've used a
+ * buffer.
+ */
+static void trigger_irq(struct virtqueue *vq)
+{
+        unsigned long buf[] = { LHREQ_IRQ, vq->config.irq };
+
+        /* Don't inform them if nothing used. */
+        if (!vq->pending_used)
+                return;
+        vq->pending_used = 0;
+
+        /* If they don't want an interrupt, don't send one... */
+        if (vq->vring.avail->flags & VRING_AVAIL_F_NO_INTERRUPT) {
+                return;
+        }
+
+        /* Send the Guest an interrupt tell them we used something up. */
+        if (write(lguest_fd, buf, sizeof(buf)) != 0)
+                err(1, "Triggering irq %i", vq->config.irq);
+}
+
+/*
+ * This looks in the virtqueue for the first available buffer, and converts
+ * it to an iovec for convenient access.  Since descriptors consist of some
+ * number of output then some number of input descriptors, it's actually two
+ * iovecs, but we pack them into one and note how many of each there were.
+ *
+ * This function waits if necessary, and returns the descriptor number found.
+ */
+static unsigned wait_for_vq_desc(struct virtqueue *vq,
+                                 struct iovec iov[],
+                                 unsigned int *out_num, unsigned int *in_num)
+{
+        unsigned int i, head, max;
+        struct vring_desc *desc;
+        u16 last_avail = lg_last_avail(vq);
+
+        /* There's nothing available? */
+        while (last_avail == vq->vring.avail->idx) {
+                u64 event;
+
+                /*
+                 * Since we're about to sleep, now is a good time to tell the
+                 * Guest about what we've used up to now.
+                 */
+                trigger_irq(vq);
+
+                /* OK, now we need to know about added descriptors. */
+                vq->vring.used->flags &= ~VRING_USED_F_NO_NOTIFY;
+
+                /*
+                 * They could have slipped one in as we were doing that: make
+                 * sure it's written, then check again.
+                 */
+                mb();
+                if (last_avail != vq->vring.avail->idx) {
+                        vq->vring.used->flags |= VRING_USED_F_NO_NOTIFY;
+                        break;
+                }
+
+                /* Nothing new?  Wait for eventfd to tell us they refilled. */
+                if (read(vq->eventfd, &event, sizeof(event)) != sizeof(event))
+                        errx(1, "Event read failed?");
+
+                /* We don't need to be notified again. */
+                vq->vring.used->flags |= VRING_USED_F_NO_NOTIFY;
+        }
+
+        /* Check it isn't doing very strange things with descriptor numbers. */
+        if ((u16)(vq->vring.avail->idx - last_avail) > vq->vring.num)
+                errx(1, "Guest moved used index from %u to %u",
+                     last_avail, vq->vring.avail->idx);
+
+        /*
+         * Grab the next descriptor number they're advertising, and increment
+         * the index we've seen.
+         */
+        head = vq->vring.avail->ring[last_avail % vq->vring.num];
+        lg_last_avail(vq)++;
+
+        /* If their number is silly, that's a fatal mistake. */
+        if (head >= vq->vring.num)
+                errx(1, "Guest says index %u is available", head);
+
+        /* When we start there are none of either input nor output. */
+        *out_num = *in_num = 0;
+
+        max = vq->vring.num;
+        desc = vq->vring.desc;
+        i = head;
+
+        /*
+         * If this is an indirect entry, then this buffer contains a descriptor
+         * table which we handle as if it's any normal descriptor chain.
+         */
+        if (desc[i].flags & VRING_DESC_F_INDIRECT) {
+                if (desc[i].len % sizeof(struct vring_desc))
+                        errx(1, "Invalid size for indirect buffer table");
+
+                max = desc[i].len / sizeof(struct vring_desc);
+                desc = check_pointer(desc[i].addr, desc[i].len);
+                i = 0;
+        }
+
+        do {
+                /* Grab the first descriptor, and check it's OK. */
+                iov[*out_num + *in_num].iov_len = desc[i].len;
+                iov[*out_num + *in_num].iov_base
+                        = check_pointer(desc[i].addr, desc[i].len);
+                /* If this is an input descriptor, increment that count. */
+                if (desc[i].flags & VRING_DESC_F_WRITE)
+                        (*in_num)++;
+                else {
+                        /*
+                         * If it's an output descriptor, they're all supposed
+                         * to come before any input descriptors.
+                         */
+                        if (*in_num)
+                                errx(1, "Descriptor has out after in");
+                        (*out_num)++;
+                }
+
+                /* If we've got too many, that implies a descriptor loop. */
+                if (*out_num + *in_num > max)
+                        errx(1, "Looped descriptor");
+        } while ((i = next_desc(desc, i, max)) != max);
+
+        return head;
+}
+
+/*
+ * After we've used one of their buffers, we tell the Guest about it.  Sometime
+ * later we'll want to send them an interrupt using trigger_irq(); note that
+ * wait_for_vq_desc() does that for us if it has to wait.
+ */
+static void add_used(struct virtqueue *vq, unsigned int head, int len)
+{
+        struct vring_used_elem *used;
+
+        /*
+         * The virtqueue contains a ring of used buffers.  Get a pointer to the
+         * next entry in that used ring.
+         */
+        used = &vq->vring.used->ring[vq->vring.used->idx % vq->vring.num];
+        used->id = head;
+        used->len = len;
+        /* Make sure buffer is written before we update index. */
+        wmb();
+        vq->vring.used->idx++;
+        vq->pending_used++;
+}
+
+/* And here's the combo meal deal.  Supersize me! */
+static void add_used_and_trigger(struct virtqueue *vq, unsigned head, int len)
+{
+        add_used(vq, head, len);
+        trigger_irq(vq);
+}
+
+/*
+ * The Console
+ *
+ * We associate some data with the console for our exit hack.
+ */
+struct console_abort {
+        /* How many times have they hit ^C? */
+        int count;
+        /* When did they start? */
+        struct timeval start;
+};
+
+/* This is the routine which handles console input (ie. stdin). */
+static void console_input(struct virtqueue *vq)
+{
+        int len;
+        unsigned int head, in_num, out_num;
+        struct console_abort *abort = vq->dev->priv;
+        struct iovec iov[vq->vring.num];
+
+        /* Make sure there's a descriptor available. */
+        head = wait_for_vq_desc(vq, iov, &out_num, &in_num);
+        if (out_num)
+                errx(1, "Output buffers in console in queue?");
+
+        /* Read into it.  This is where we usually wait. */
+        len = readv(STDIN_FILENO, iov, in_num);
+        if (len <= 0) {
+                /* Ran out of input? */
+                warnx("Failed to get console input, ignoring console.");
+                /*
+                 * For simplicity, dying threads kill the whole Launcher.  So
+                 * just nap here.
+                 */
+                for (;;)
+                        pause();
+        }
+
+        /* Tell the Guest we used a buffer. */
+        add_used_and_trigger(vq, head, len);
+
+        /*
+         * Three ^C within one second?  Exit.
+         *
+         * This is such a hack, but works surprisingly well.  Each ^C has to
+         * be in a buffer by itself, so they can't be too fast.  But we check
+         * that we get three within about a second, so they can't be too
+         * slow.
+         */
+        if (len != 1 || ((char *)iov[0].iov_base)[0] != 3) {
+                abort->count = 0;
+                return;
+        }
+
+        abort->count++;
+        if (abort->count == 1)
+                gettimeofday(&abort->start, NULL);
+        else if (abort->count == 3) {
+                struct timeval now;
+                gettimeofday(&now, NULL);
+                /* Kill all Launcher processes with SIGINT, like normal ^C */
+                if (now.tv_sec <= abort->start.tv_sec+1)
+                        kill(0, SIGINT);
+                abort->count = 0;
+        }
+}
+
+/* This is the routine which handles console output (ie. stdout). */
+static void console_output(struct virtqueue *vq)
+{
+        unsigned int head, out, in;
+        struct iovec iov[vq->vring.num];
+
+        /* We usually wait in here, for the Guest to give us something. */
+        head = wait_for_vq_desc(vq, iov, &out, &in);
+        if (in)
+                errx(1, "Input buffers in console output queue?");
+
+        /* writev can return a partial write, so we loop here. */
+        while (!iov_empty(iov, out)) {
+                int len = writev(STDOUT_FILENO, iov, out);
+                if (len <= 0) {
+                        warn("Write to stdout gave %i (%d)", len, errno);
+                        break;
+                }
+                iov_consume(iov, out, len);
+        }
+
+        /*
+         * We're finished with that buffer: if we're going to sleep,
+         * wait_for_vq_desc() will prod the Guest with an interrupt.
+         */
+        add_used(vq, head, 0);
+}
+
+/*
+ * The Network
+ *
+ * Handling output for network is also simple: we get all the output buffers
+ * and write them to /dev/net/tun.
+ */
+struct net_info {
+        int tunfd;
+};
+
+static void net_output(struct virtqueue *vq)
+{
+        struct net_info *net_info = vq->dev->priv;
+        unsigned int head, out, in;
+        struct iovec iov[vq->vring.num];
+
+        /* We usually wait in here for the Guest to give us a packet. */
+        head = wait_for_vq_desc(vq, iov, &out, &in);
+        if (in)
+                errx(1, "Input buffers in net output queue?");
+        /*
+         * Send the whole thing through to /dev/net/tun.  It expects the exact
+         * same format: what a coincidence!
+         */
+        if (writev(net_info->tunfd, iov, out) < 0)
+                warnx("Write to tun failed (%d)?", errno);
+
+        /*
+         * Done with that one; wait_for_vq_desc() will send the interrupt if
+         * all packets are processed.
+         */
+        add_used(vq, head, 0);
+}
+
+/*
+ * Handling network input is a bit trickier, because I've tried to optimize it.
+ *
+ * First we have a helper routine which tells is if from this file descriptor
+ * (ie. the /dev/net/tun device) will block:
+ */
+static bool will_block(int fd)
+{
+        fd_set fdset;
+        struct timeval zero = { 0, 0 };
+        FD_ZERO(&fdset);
+        FD_SET(fd, &fdset);
+        return select(fd+1, &fdset, NULL, NULL, &zero) != 1;
+}
+
+/*
+ * This handles packets coming in from the tun device to our Guest.  Like all
+ * service routines, it gets called again as soon as it returns, so you don't
+ * see a while(1) loop here.
+ */
+static void net_input(struct virtqueue *vq)
+{
+        int len;
+        unsigned int head, out, in;
+        struct iovec iov[vq->vring.num];
+        struct net_info *net_info = vq->dev->priv;
+
+        /*
+         * Get a descriptor to write an incoming packet into.  This will also
+         * send an interrupt if they're out of descriptors.
+         */
+        head = wait_for_vq_desc(vq, iov, &out, &in);
+        if (out)
+                errx(1, "Output buffers in net input queue?");
+
+        /*
+         * If it looks like we'll block reading from the tun device, send them
+         * an interrupt.
+         */
+        if (vq->pending_used && will_block(net_info->tunfd))
+                trigger_irq(vq);
+
+        /*
+         * Read in the packet.  This is where we normally wait (when there's no
+         * incoming network traffic).
+         */
+        len = readv(net_info->tunfd, iov, in);
+        if (len <= 0)
+                warn("Failed to read from tun (%d).", errno);
+
+        /*
+         * Mark that packet buffer as used, but don't interrupt here.  We want
+         * to wait until we've done as much work as we can.
+         */
+        add_used(vq, head, len);
+}
+/*:*/
+
+/* This is the helper to create threads: run the service routine in a loop. */
+static int do_thread(void *_vq)
+{
+        struct virtqueue *vq = _vq;
+
+        for (;;)
+                vq->service(vq);
+        return 0;
+}
+
+/*
+ * When a child dies, we kill our entire process group with SIGTERM.  This
+ * also has the side effect that the shell restores the console for us!
+ */
+static void kill_launcher(int signal)
+{
+        kill(0, SIGTERM);
+}
+
+static void reset_device(struct device *dev)
+{
+        struct virtqueue *vq;
+
+        verbose("Resetting device %s\n", dev->name);
+
+        /* Clear any features they've acked. */
+        memset(get_feature_bits(dev) + dev->feature_len, 0, dev->feature_len);
+
+        /* We're going to be explicitly killing threads, so ignore them. */
+        signal(SIGCHLD, SIG_IGN);
+
+        /* Zero out the virtqueues, get rid of their threads */
+        for (vq = dev->vq; vq; vq = vq->next) {
+                if (vq->thread != (pid_t)-1) {
+                        kill(vq->thread, SIGTERM);
+                        waitpid(vq->thread, NULL, 0);
+                        vq->thread = (pid_t)-1;
+                }
+                memset(vq->vring.desc, 0,
+                       vring_size(vq->config.num, LGUEST_VRING_ALIGN));
+                lg_last_avail(vq) = 0;
+        }
+        dev->running = false;
+
+        /* Now we care if threads die. */
+        signal(SIGCHLD, (void *)kill_launcher);
+}
+
+/*L:216
+ * This actually creates the thread which services the virtqueue for a device.
+ */
+static void create_thread(struct virtqueue *vq)
+{
+        /*
+         * Create stack for thread.  Since the stack grows upwards, we point
+         * the stack pointer to the end of this region.
+         */
+        char *stack = malloc(32768);
+        unsigned long args[] = { LHREQ_EVENTFD,
+                                 vq->config.pfn*getpagesize(), 0 };
+
+        /* Create a zero-initialized eventfd. */
+        vq->eventfd = eventfd(0, 0);
+        if (vq->eventfd < 0)
+                err(1, "Creating eventfd");
+        args[2] = vq->eventfd;
+
+        /*
+         * Attach an eventfd to this virtqueue: it will go off when the Guest
+         * does an LHCALL_NOTIFY for this vq.
+         */
+        if (write(lguest_fd, &args, sizeof(args)) != 0)
+                err(1, "Attaching eventfd");
+
+        /*
+         * CLONE_VM: because it has to access the Guest memory, and SIGCHLD so
+         * we get a signal if it dies.
+         */
+        vq->thread = clone(do_thread, stack + 32768, CLONE_VM | SIGCHLD, vq);
+        if (vq->thread == (pid_t)-1)
+                err(1, "Creating clone");
+
+        /* We close our local copy now the child has it. */
+        close(vq->eventfd);
+}
+
+static void start_device(struct device *dev)
+{
+        unsigned int i;
+        struct virtqueue *vq;
+
+        verbose("Device %s OK: offered", dev->name);
+        for (i = 0; i < dev->feature_len; i++)
+                verbose(" %02x", get_feature_bits(dev)[i]);
+        verbose(", accepted");
+        for (i = 0; i < dev->feature_len; i++)
+                verbose(" %02x", get_feature_bits(dev)
+                        [dev->feature_len+i]);
+
+        for (vq = dev->vq; vq; vq = vq->next) {
+                if (vq->service)
+                        create_thread(vq);
+        }
+        dev->running = true;
+}
+
+static void cleanup_devices(void)
+{
+        struct device *dev;
+
+        for (dev = devices.dev; dev; dev = dev->next)
+                reset_device(dev);
+
+        /* If we saved off the original terminal settings, restore them now. */
+        if (orig_term.c_lflag & (ISIG|ICANON|ECHO))
+                tcsetattr(STDIN_FILENO, TCSANOW, &orig_term);
+}
+
+/* When the Guest tells us they updated the status field, we handle it. */
+static void update_device_status(struct device *dev)
+{
+        /* A zero status is a reset, otherwise it's a set of flags. */
+        if (dev->desc->status == 0)
+                reset_device(dev);
+        else if (dev->desc->status & VIRTIO_CONFIG_S_FAILED) {
+                warnx("Device %s configuration FAILED", dev->name);
+                if (dev->running)
+                        reset_device(dev);
+        } else {
+                if (dev->running)
+                        err(1, "Device %s features finalized twice", dev->name);
+                start_device(dev);
+        }
+}
+
+/*L:215
+ * This is the generic routine we call when the Guest uses LHCALL_NOTIFY.  In
+ * particular, it's used to notify us of device status changes during boot.
+ */
+static void handle_output(unsigned long addr)
+{
+        struct device *i;
+
+        /* Check each device. */
+        for (i = devices.dev; i; i = i->next) {
+                struct virtqueue *vq;
+
+                /*
+                 * Notifications to device descriptors mean they updated the
+                 * device status.
+                 */
+                if (from_guest_phys(addr) == i->desc) {
+                        update_device_status(i);
+                        return;
+                }
+
+                /* Devices should not be used before features are finalized. */
+                for (vq = i->vq; vq; vq = vq->next) {
+                        if (addr != vq->config.pfn*getpagesize())
+                                continue;
+                        errx(1, "Notification on %s before setup!", i->name);
+                }
+        }
+
+        /*
+         * Early console write is done using notify on a nul-terminated string
+         * in Guest memory.  It's also great for hacking debugging messages
+         * into a Guest.
+         */
+        if (addr >= guest_limit)
+                errx(1, "Bad NOTIFY %#lx", addr);
+
+        write(STDOUT_FILENO, from_guest_phys(addr),
+              strnlen(from_guest_phys(addr), guest_limit - addr));
+}
+
+/*L:190
+ * Device Setup
+ *
+ * All devices need a descriptor so the Guest knows it exists, and a "struct
+ * device" so the Launcher can keep track of it.  We have common helper
+ * routines to allocate and manage them.
+ */
+
+/*
+ * The layout of the device page is a "struct lguest_device_desc" followed by a
+ * number of virtqueue descriptors, then two sets of feature bits, then an
+ * array of configuration bytes.  This routine returns the configuration
+ * pointer.
+ */
+static u8 *device_config(const struct device *dev)
+{
+        return (void *)(dev->desc + 1)
+                + dev->num_vq * sizeof(struct lguest_vqconfig)
+                + dev->feature_len * 2;
+}
+
+/*
+ * This routine allocates a new "struct lguest_device_desc" from descriptor
+ * table page just above the Guest's normal memory.  It returns a pointer to
+ * that descriptor.
+ */
+static struct lguest_device_desc *new_dev_desc(u16 type)
+{
+        struct lguest_device_desc d = { .type = type };
+        void *p;
+
+        /* Figure out where the next device config is, based on the last one. */
+        if (devices.lastdev)
+                p = device_config(devices.lastdev)
+                        + devices.lastdev->desc->config_len;
+        else
+                p = devices.descpage;
+
+        /* We only have one page for all the descriptors. */
+        if (p + sizeof(d) > (void *)devices.descpage + getpagesize())
+                errx(1, "Too many devices");
+
+        /* p might not be aligned, so we memcpy in. */
+        return memcpy(p, &d, sizeof(d));
+}
+
+/*
+ * Each device descriptor is followed by the description of its virtqueues.  We
+ * specify how many descriptors the virtqueue is to have.
+ */
+static void add_virtqueue(struct device *dev, unsigned int num_descs,
+                          void (*service)(struct virtqueue *))
+{
+        unsigned int pages;
+        struct virtqueue **i, *vq = malloc(sizeof(*vq));
+        void *p;
+
+        /* First we need some memory for this virtqueue. */
+        pages = (vring_size(num_descs, LGUEST_VRING_ALIGN) + getpagesize() - 1)
+                / getpagesize();
+        p = get_pages(pages);
+
+        /* Initialize the virtqueue */
+        vq->next = NULL;
+        vq->last_avail_idx = 0;
+        vq->dev = dev;
+
+        /*
+         * This is the routine the service thread will run, and its Process ID
+         * once it's running.
+         */
+        vq->service = service;
+        vq->thread = (pid_t)-1;
+
+        /* Initialize the configuration. */
+        vq->config.num = num_descs;
+        vq->config.irq = devices.next_irq++;
+        vq->config.pfn = to_guest_phys(p) / getpagesize();
+
+        /* Initialize the vring. */
+        vring_init(&vq->vring, num_descs, p, LGUEST_VRING_ALIGN);
+
+        /*
+         * Append virtqueue to this device's descriptor.  We use
+         * device_config() to get the end of the device's current virtqueues;
+         * we check that we haven't added any config or feature information
+         * yet, otherwise we'd be overwriting them.
+         */
+        assert(dev->desc->config_len == 0 && dev->desc->feature_len == 0);
+        memcpy(device_config(dev), &vq->config, sizeof(vq->config));
+        dev->num_vq++;
+        dev->desc->num_vq++;
+
+        verbose("Virtqueue page %#lx\n", to_guest_phys(p));
+
+        /*
+         * Add to tail of list, so dev->vq is first vq, dev->vq->next is
+         * second.
+         */
+        for (i = &dev->vq; *i; i = &(*i)->next);
+        *i = vq;
+}
+
+/*
+ * The first half of the feature bitmask is for us to advertise features.  The
+ * second half is for the Guest to accept features.
+ */
+static void add_feature(struct device *dev, unsigned bit)
+{
+        u8 *features = get_feature_bits(dev);
+
+        /* We can't extend the feature bits once we've added config bytes */
+        if (dev->desc->feature_len <= bit / CHAR_BIT) {
+                assert(dev->desc->config_len == 0);
+                dev->feature_len = dev->desc->feature_len = (bit/CHAR_BIT) + 1;
+        }
+
+        features[bit / CHAR_BIT] |= (1 << (bit % CHAR_BIT));
+}
+
+/*
+ * This routine sets the configuration fields for an existing device's
+ * descriptor.  It only works for the last device, but that's OK because that's
+ * how we use it.
+ */
+static void set_config(struct device *dev, unsigned len, const void *conf)
+{
+        /* Check we haven't overflowed our single page. */
+        if (device_config(dev) + len > devices.descpage + getpagesize())
+                errx(1, "Too many devices");
+
+        /* Copy in the config information, and store the length. */
+        memcpy(device_config(dev), conf, len);
+        dev->desc->config_len = len;
+
+        /* Size must fit in config_len field (8 bits)! */
+        assert(dev->desc->config_len == len);
+}
+
+/*
+ * This routine does all the creation and setup of a new device, including
+ * calling new_dev_desc() to allocate the descriptor and device memory.  We
+ * don't actually start the service threads until later.
+ *
+ * See what I mean about userspace being boring?
+ */
+static struct device *new_device(const char *name, u16 type)
+{
+        struct device *dev = malloc(sizeof(*dev));
+
+        /* Now we populate the fields one at a time. */
+        dev->desc = new_dev_desc(type);
+        dev->name = name;
+        dev->vq = NULL;
+        dev->feature_len = 0;
+        dev->num_vq = 0;
+        dev->running = false;
+
+        /*
+         * Append to device list.  Prepending to a single-linked list is
+         * easier, but the user expects the devices to be arranged on the bus
+         * in command-line order.  The first network device on the command line
+         * is eth0, the first block device /dev/vda, etc.
+         */
+        if (devices.lastdev)
+                devices.lastdev->next = dev;
+        else
+                devices.dev = dev;
+        devices.lastdev = dev;
+
+        return dev;
+}
+
+/*
+ * Our first setup routine is the console.  It's a fairly simple device, but
+ * UNIX tty handling makes it uglier than it could be.
+ */
+static void setup_console(void)
+{
+        struct device *dev;
+
+        /* If we can save the initial standard input settings... */
+        if (tcgetattr(STDIN_FILENO, &orig_term) == 0) {
+                struct termios term = orig_term;
+                /*
+                 * Then we turn off echo, line buffering and ^C etc: We want a
+                 * raw input stream to the Guest.
+                 */
+                term.c_lflag &= ~(ISIG|ICANON|ECHO);
+                tcsetattr(STDIN_FILENO, TCSANOW, &term);
+        }
+
+        dev = new_device("console", VIRTIO_ID_CONSOLE);
+
+        /* We store the console state in dev->priv, and initialize it. */
+        dev->priv = malloc(sizeof(struct console_abort));
+        ((struct console_abort *)dev->priv)->count = 0;
+
+        /*
+         * The console needs two virtqueues: the input then the output.  When
+         * they put something the input queue, we make sure we're listening to
+         * stdin.  When they put something in the output queue, we write it to
+         * stdout.
+         */
+        add_virtqueue(dev, VIRTQUEUE_NUM, console_input);
+        add_virtqueue(dev, VIRTQUEUE_NUM, console_output);
+
+        verbose("device %u: console\n", ++devices.device_num);
+}
+/*:*/
+
+/*M:010
+ * Inter-guest networking is an interesting area.  Simplest is to have a
+ * --sharenet=<name> option which opens or creates a named pipe.  This can be
+ * used to send packets to another guest in a 1:1 manner.
+ *
+ * More sophisticated is to use one of the tools developed for project like UML
+ * to do networking.
+ *
+ * Faster is to do virtio bonding in kernel.  Doing this 1:1 would be
+ * completely generic ("here's my vring, attach to your vring") and would work
+ * for any traffic.  Of course, namespace and permissions issues need to be
+ * dealt with.  A more sophisticated "multi-channel" virtio_net.c could hide
+ * multiple inter-guest channels behind one interface, although it would
+ * require some manner of hotplugging new virtio channels.
+ *
+ * Finally, we could use a virtio network switch in the kernel, ie. vhost.
+:*/
+
+static u32 str2ip(const char *ipaddr)
+{
+        unsigned int b[4];
+
+        if (sscanf(ipaddr, "%u.%u.%u.%u", &b[0], &b[1], &b[2], &b[3]) != 4)
+                errx(1, "Failed to parse IP address '%s'", ipaddr);
+        return (b[0] << 24) | (b[1] << 16) | (b[2] << 8) | b[3];
+}
+
+static void str2mac(const char *macaddr, unsigned char mac[6])
+{
+        unsigned int m[6];
+        if (sscanf(macaddr, "%02x:%02x:%02x:%02x:%02x:%02x",
+                   &m[0], &m[1], &m[2], &m[3], &m[4], &m[5]) != 6)
+                errx(1, "Failed to parse mac address '%s'", macaddr);
+        mac[0] = m[0];
+        mac[1] = m[1];
+        mac[2] = m[2];
+        mac[3] = m[3];
+        mac[4] = m[4];
+        mac[5] = m[5];
+}
+
+/*
+ * This code is "adapted" from libbridge: it attaches the Host end of the
+ * network device to the bridge device specified by the command line.
+ *
+ * This is yet another James Morris contribution (I'm an IP-level guy, so I
+ * dislike bridging), and I just try not to break it.
+ */
+static void add_to_bridge(int fd, const char *if_name, const char *br_name)
+{
+        int ifidx;
+        struct ifreq ifr;
+
+        if (!*br_name)
+                errx(1, "must specify bridge name");
+
+        ifidx = if_nametoindex(if_name);
+        if (!ifidx)
+                errx(1, "interface %s does not exist!", if_name);
+
+        strncpy(ifr.ifr_name, br_name, IFNAMSIZ);
+        ifr.ifr_name[IFNAMSIZ-1] = '\0';
+        ifr.ifr_ifindex = ifidx;
+        if (ioctl(fd, SIOCBRADDIF, &ifr) < 0)
+                err(1, "can't add %s to bridge %s", if_name, br_name);
+}
+
+/*
+ * This sets up the Host end of the network device with an IP address, brings
+ * it up so packets will flow, the copies the MAC address into the hwaddr
+ * pointer.
+ */
+static void configure_device(int fd, const char *tapif, u32 ipaddr)
+{
+        struct ifreq ifr;
+        struct sockaddr_in sin;
+
+        memset(&ifr, 0, sizeof(ifr));
+        strcpy(ifr.ifr_name, tapif);
+
+        /* Don't read these incantations.  Just cut & paste them like I did! */
+        sin.sin_family = AF_INET;
+        sin.sin_addr.s_addr = htonl(ipaddr);
+        memcpy(&ifr.ifr_addr, &sin, sizeof(sin));
+        if (ioctl(fd, SIOCSIFADDR, &ifr) != 0)
+                err(1, "Setting %s interface address", tapif);
+        ifr.ifr_flags = IFF_UP;
+        if (ioctl(fd, SIOCSIFFLAGS, &ifr) != 0)
+                err(1, "Bringing interface %s up", tapif);
+}
+
+static int get_tun_device(char tapif[IFNAMSIZ])
+{
+        struct ifreq ifr;
+        int netfd;
+
+        /* Start with this zeroed.  Messy but sure. */
+        memset(&ifr, 0, sizeof(ifr));
+
+        /*
+         * We open the /dev/net/tun device and tell it we want a tap device.  A
+         * tap device is like a tun device, only somehow different.  To tell
+         * the truth, I completely blundered my way through this code, but it
+         * works now!
+         */
+        netfd = open_or_die("/dev/net/tun", O_RDWR);
+        ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_VNET_HDR;
+        strcpy(ifr.ifr_name, "tap%d");
+        if (ioctl(netfd, TUNSETIFF, &ifr) != 0)
+                err(1, "configuring /dev/net/tun");
+
+        if (ioctl(netfd, TUNSETOFFLOAD,
+                  TUN_F_CSUM|TUN_F_TSO4|TUN_F_TSO6|TUN_F_TSO_ECN) != 0)
+                err(1, "Could not set features for tun device");
+
+        /*
+         * We don't need checksums calculated for packets coming in this
+         * device: trust us!
+         */
+        ioctl(netfd, TUNSETNOCSUM, 1);
+
+        memcpy(tapif, ifr.ifr_name, IFNAMSIZ);
+        return netfd;
+}
+
+/*L:195
+ * Our network is a Host<->Guest network.  This can either use bridging or
+ * routing, but the principle is the same: it uses the "tun" device to inject
+ * packets into the Host as if they came in from a normal network card.  We
+ * just shunt packets between the Guest and the tun device.
+ */
+static void setup_tun_net(char *arg)
+{
+        struct device *dev;
+        struct net_info *net_info = malloc(sizeof(*net_info));
+        int ipfd;
+        u32 ip = INADDR_ANY;
+        bool bridging = false;
+        char tapif[IFNAMSIZ], *p;
+        struct virtio_net_config conf;
+
+        net_info->tunfd = get_tun_device(tapif);
+
+        /* First we create a new network device. */
+        dev = new_device("net", VIRTIO_ID_NET);
+        dev->priv = net_info;
+
+        /* Network devices need a recv and a send queue, just like console. */
+        add_virtqueue(dev, VIRTQUEUE_NUM, net_input);
+        add_virtqueue(dev, VIRTQUEUE_NUM, net_output);
+
+        /*
+         * We need a socket to perform the magic network ioctls to bring up the
+         * tap interface, connect to the bridge etc.  Any socket will do!
+         */
+        ipfd = socket(PF_INET, SOCK_DGRAM, IPPROTO_IP);
+        if (ipfd < 0)
+                err(1, "opening IP socket");
+
+        /* If the command line was --tunnet=bridge:<name> do bridging. */
+        if (!strncmp(BRIDGE_PFX, arg, strlen(BRIDGE_PFX))) {
+                arg += strlen(BRIDGE_PFX);
+                bridging = true;
+        }
+
+        /* A mac address may follow the bridge name or IP address */
+        p = strchr(arg, ':');
+        if (p) {
+                str2mac(p+1, conf.mac);
+                add_feature(dev, VIRTIO_NET_F_MAC);
+                *p = '\0';
+        }
+
+        /* arg is now either an IP address or a bridge name */
+        if (bridging)
+                add_to_bridge(ipfd, tapif, arg);
+        else
+                ip = str2ip(arg);
+
+        /* Set up the tun device. */
+        configure_device(ipfd, tapif, ip);
+
+        /* Expect Guest to handle everything except UFO */
+        add_feature(dev, VIRTIO_NET_F_CSUM);
+        add_feature(dev, VIRTIO_NET_F_GUEST_CSUM);
+        add_feature(dev, VIRTIO_NET_F_GUEST_TSO4);
+        add_feature(dev, VIRTIO_NET_F_GUEST_TSO6);
+        add_feature(dev, VIRTIO_NET_F_GUEST_ECN);
+        add_feature(dev, VIRTIO_NET_F_HOST_TSO4);
+        add_feature(dev, VIRTIO_NET_F_HOST_TSO6);
+        add_feature(dev, VIRTIO_NET_F_HOST_ECN);
+        /* We handle indirect ring entries */
+        add_feature(dev, VIRTIO_RING_F_INDIRECT_DESC);
+        set_config(dev, sizeof(conf), &conf);
+
+        /* We don't need the socket any more; setup is done. */
+        close(ipfd);
+
+        devices.device_num++;
+
+        if (bridging)
+                verbose("device %u: tun %s attached to bridge: %s\n",
+                        devices.device_num, tapif, arg);
+        else
+                verbose("device %u: tun %s: %s\n",
+                        devices.device_num, tapif, arg);
+}
+/*:*/
+
+/* This hangs off device->priv. */
+struct vblk_info {
+        /* The size of the file. */
+        off64_t len;
+
+        /* The file descriptor for the file. */
+        int fd;
+
+};
+
+/*L:210
+ * The Disk
+ *
+ * The disk only has one virtqueue, so it only has one thread.  It is really
+ * simple: the Guest asks for a block number and we read or write that position
+ * in the file.
+ *
+ * Before we serviced each virtqueue in a separate thread, that was unacceptably
+ * slow: the Guest waits until the read is finished before running anything
+ * else, even if it could have been doing useful work.
+ *
+ * We could have used async I/O, except it's reputed to suck so hard that
+ * characters actually go missing from your code when you try to use it.
+ */
+static void blk_request(struct virtqueue *vq)
+{
+        struct vblk_info *vblk = vq->dev->priv;
+        unsigned int head, out_num, in_num, wlen;
+        int ret;
+        u8 *in;
+        struct virtio_blk_outhdr *out;
+        struct iovec iov[vq->vring.num];
+        off64_t off;
+
+        /*
+         * Get the next request, where we normally wait.  It triggers the
+         * interrupt to acknowledge previously serviced requests (if any).
+         */
+        head = wait_for_vq_desc(vq, iov, &out_num, &in_num);
+
+        /*
+         * Every block request should contain at least one output buffer
+         * (detailing the location on disk and the type of request) and one
+         * input buffer (to hold the result).
+         */
+        if (out_num == 0 || in_num == 0)
+                errx(1, "Bad virtblk cmd %u out=%u in=%u",
+                     head, out_num, in_num);
+
+        out = convert(&iov[0], struct virtio_blk_outhdr);
+        in = convert(&iov[out_num+in_num-1], u8);
+        /*
+         * For historical reasons, block operations are expressed in 512 byte
+         * "sectors".
+         */
+        off = out->sector * 512;
+
+        /*
+         * In general the virtio block driver is allowed to try SCSI commands.
+         * It'd be nice if we supported eject, for example, but we don't.
+         */
+        if (out->type & VIRTIO_BLK_T_SCSI_CMD) {
+                fprintf(stderr, "Scsi commands unsupported\n");
+                *in = VIRTIO_BLK_S_UNSUPP;
+                wlen = sizeof(*in);
+        } else if (out->type & VIRTIO_BLK_T_OUT) {
+                /*
+                 * Write
+                 *
+                 * Move to the right location in the block file.  This can fail
+                 * if they try to write past end.
+                 */
+                if (lseek64(vblk->fd, off, SEEK_SET) != off)
+                        err(1, "Bad seek to sector %llu", out->sector);
+
+                ret = writev(vblk->fd, iov+1, out_num-1);
+                verbose("WRITE to sector %llu: %i\n", out->sector, ret);
+
+                /*
+                 * Grr... Now we know how long the descriptor they sent was, we
+                 * make sure they didn't try to write over the end of the block
+                 * file (possibly extending it).
+                 */
+                if (ret > 0 && off + ret > vblk->len) {
+                        /* Trim it back to the correct length */
+                        ftruncate64(vblk->fd, vblk->len);
+                        /* Die, bad Guest, die. */
+                        errx(1, "Write past end %llu+%u", off, ret);
+                }
+
+                wlen = sizeof(*in);
+                *in = (ret >= 0 ? VIRTIO_BLK_S_OK : VIRTIO_BLK_S_IOERR);
+        } else if (out->type & VIRTIO_BLK_T_FLUSH) {
+                /* Flush */
+                ret = fdatasync(vblk->fd);
+                verbose("FLUSH fdatasync: %i\n", ret);
+                wlen = sizeof(*in);
+                *in = (ret >= 0 ? VIRTIO_BLK_S_OK : VIRTIO_BLK_S_IOERR);
+        } else {
+                /*
+                 * Read
+                 *
+                 * Move to the right location in the block file.  This can fail
+                 * if they try to read past end.
+                 */
+                if (lseek64(vblk->fd, off, SEEK_SET) != off)
+                        err(1, "Bad seek to sector %llu", out->sector);
+
+                ret = readv(vblk->fd, iov+1, in_num-1);
+                verbose("READ from sector %llu: %i\n", out->sector, ret);
+                if (ret >= 0) {
+                        wlen = sizeof(*in) + ret;
+                        *in = VIRTIO_BLK_S_OK;
+                } else {
+                        wlen = sizeof(*in);
+                        *in = VIRTIO_BLK_S_IOERR;
+                }
+        }
+
+        /* Finished that request. */
+        add_used(vq, head, wlen);
+}
+
+/*L:198 This actually sets up a virtual block device. */
+static void setup_block_file(const char *filename)
+{
+        struct device *dev;
+        struct vblk_info *vblk;
+        struct virtio_blk_config conf;
+
+        /* Creat the device. */
+        dev = new_device("block", VIRTIO_ID_BLOCK);
+
+        /* The device has one virtqueue, where the Guest places requests. */
+        add_virtqueue(dev, VIRTQUEUE_NUM, blk_request);
+
+        /* Allocate the room for our own bookkeeping */
+        vblk = dev->priv = malloc(sizeof(*vblk));
+
+        /* First we open the file and store the length. */
+        vblk->fd = open_or_die(filename, O_RDWR|O_LARGEFILE);
+        vblk->len = lseek64(vblk->fd, 0, SEEK_END);
+
+        /* We support FLUSH. */
+        add_feature(dev, VIRTIO_BLK_F_FLUSH);
+
+        /* Tell Guest how many sectors this device has. */
+        conf.capacity = cpu_to_le64(vblk->len / 512);
+
+        /*
+         * Tell Guest not to put in too many descriptors at once: two are used
+         * for the in and out elements.
+         */
+        add_feature(dev, VIRTIO_BLK_F_SEG_MAX);
+        conf.seg_max = cpu_to_le32(VIRTQUEUE_NUM - 2);
+
+        /* Don't try to put whole struct: we have 8 bit limit. */
+        set_config(dev, offsetof(struct virtio_blk_config, geometry), &conf);
+
+        verbose("device %u: virtblock %llu sectors\n",
+                ++devices.device_num, le64_to_cpu(conf.capacity));
+}
+
+/*L:211
+ * Our random number generator device reads from /dev/random into the Guest's
+ * input buffers.  The usual case is that the Guest doesn't want random numbers
+ * and so has no buffers although /dev/random is still readable, whereas
+ * console is the reverse.
+ *
+ * The same logic applies, however.
+ */
+struct rng_info {
+        int rfd;
+};
+
+static void rng_input(struct virtqueue *vq)
+{
+        int len;
+        unsigned int head, in_num, out_num, totlen = 0;
+        struct rng_info *rng_info = vq->dev->priv;
+        struct iovec iov[vq->vring.num];
+
+        /* First we need a buffer from the Guests's virtqueue. */
+        head = wait_for_vq_desc(vq, iov, &out_num, &in_num);
+        if (out_num)
+                errx(1, "Output buffers in rng?");
+
+        /*
+         * Just like the console write, we loop to cover the whole iovec.
+         * In this case, short reads actually happen quite a bit.
+         */
+        while (!iov_empty(iov, in_num)) {
+                len = readv(rng_info->rfd, iov, in_num);
+                if (len <= 0)
+                        err(1, "Read from /dev/random gave %i", len);
+                iov_consume(iov, in_num, len);
+                totlen += len;
+        }
+
+        /* Tell the Guest about the new input. */
+        add_used(vq, head, totlen);
+}
+
+/*L:199
+ * This creates a "hardware" random number device for the Guest.
+ */
+static void setup_rng(void)
+{
+        struct device *dev;
+        struct rng_info *rng_info = malloc(sizeof(*rng_info));
+
+        /* Our device's privat info simply contains the /dev/random fd. */
+        rng_info->rfd = open_or_die("/dev/random", O_RDONLY);
+
+        /* Create the new device. */
+        dev = new_device("rng", VIRTIO_ID_RNG);
+        dev->priv = rng_info;
+
+        /* The device has one virtqueue, where the Guest places inbufs. */
+        add_virtqueue(dev, VIRTQUEUE_NUM, rng_input);
+
+        verbose("device %u: rng\n", devices.device_num++);
+}
+/* That's the end of device setup. */
+
+/*L:230 Reboot is pretty easy: clean up and exec() the Launcher afresh. */
+static void __attribute__((noreturn)) restart_guest(void)
+{
+        unsigned int i;
+
+        /*
+         * Since we don't track all open fds, we simply close everything beyond
+         * stderr.
+         */
+        for (i = 3; i < FD_SETSIZE; i++)
+                close(i);
+
+        /* Reset all the devices (kills all threads). */
+        cleanup_devices();
+
+        execv(main_args[0], main_args);
+        err(1, "Could not exec %s", main_args[0]);
+}
+
+/*L:220
+ * Finally we reach the core of the Launcher which runs the Guest, serves
+ * its input and output, and finally, lays it to rest.
+ */
+static void __attribute__((noreturn)) run_guest(void)
+{
+        for (;;) {
+                unsigned long notify_addr;
+                int readval;
+
+                /* We read from the /dev/lguest device to run the Guest. */
+                readval = pread(lguest_fd, &notify_addr,
+                                sizeof(notify_addr), cpu_id);
+
+                /* One unsigned long means the Guest did HCALL_NOTIFY */
+                if (readval == sizeof(notify_addr)) {
+                        verbose("Notify on address %#lx\n", notify_addr);
+                        handle_output(notify_addr);
+                /* ENOENT means the Guest died.  Reading tells us why. */
+                } else if (errno == ENOENT) {
+                        char reason[1024] = { 0 };
+                        pread(lguest_fd, reason, sizeof(reason)-1, cpu_id);
+                        errx(1, "%s", reason);
+                /* ERESTART means that we need to reboot the guest */
+                } else if (errno == ERESTART) {
+                        restart_guest();
+                /* Anything else means a bug or incompatible change. */
+                } else
+                        err(1, "Running guest failed");
+        }
+}
+/*L:240
+ * This is the end of the Launcher.  The good news: we are over halfway
+ * through!  The bad news: the most fiendish part of the code still lies ahead
+ * of us.
+ *
+ * Are you ready?  Take a deep breath and join me in the core of the Host, in
+ * "make Host".
+:*/
+
+static struct option opts[] = {
+        { "verbose", 0, NULL, 'v' },
+        { "tunnet", 1, NULL, 't' },
+        { "block", 1, NULL, 'b' },
+        { "rng", 0, NULL, 'r' },
+        { "initrd", 1, NULL, 'i' },
+        { "username", 1, NULL, 'u' },
+        { "chroot", 1, NULL, 'c' },
+        { NULL },
+};
+static void usage(void)
+{
+        errx(1, "Usage: lguest [--verbose] "
+             "[--tunnet=(<ipaddr>:<macaddr>|bridge:<bridgename>:<macaddr>)\n"
+             "|--block=<filename>|--initrd=<filename>]...\n"
+             "<mem-in-mb> vmlinux [args...]");
+}
+
+/*L:105 The main routine is where the real work begins: */
+int main(int argc, char *argv[])
+{
+        /* Memory, code startpoint and size of the (optional) initrd. */
+        unsigned long mem = 0, start, initrd_size = 0;
+        /* Two temporaries. */
+        int i, c;
+        /* The boot information for the Guest. */
+        struct boot_params *boot;
+        /* If they specify an initrd file to load. */
+        const char *initrd_name = NULL;
+
+        /* Password structure for initgroups/setres[gu]id */
+        struct passwd *user_details = NULL;
+
+        /* Directory to chroot to */
+        char *chroot_path = NULL;
+
+        /* Save the args: we "reboot" by execing ourselves again. */
+        main_args = argv;
+
+        /*
+         * First we initialize the device list.  We keep a pointer to the last
+         * device, and the next interrupt number to use for devices (1:
+         * remember that 0 is used by the timer).
+         */
+        devices.lastdev = NULL;
+        devices.next_irq = 1;
+
+        /* We're CPU 0.  In fact, that's the only CPU possible right now. */
+        cpu_id = 0;
+
+        /*
+         * We need to know how much memory so we can set up the device
+         * descriptor and memory pages for the devices as we parse the command
+         * line.  So we quickly look through the arguments to find the amount
+         * of memory now.
+         */
+        for (i = 1; i < argc; i++) {
+                if (argv[i][0] != '-') {
+                        mem = atoi(argv[i]) * 1024 * 1024;
+                        /*
+                         * We start by mapping anonymous pages over all of
+                         * guest-physical memory range.  This fills it with 0,
+                         * and ensures that the Guest won't be killed when it
+                         * tries to access it.
+                         */
+                        guest_base = map_zeroed_pages(mem / getpagesize()
+                                                      + DEVICE_PAGES);
+                        guest_limit = mem;
+                        guest_max = mem + DEVICE_PAGES*getpagesize();
+                        devices.descpage = get_pages(1);
+                        break;
+                }
+        }
+
+        /* The options are fairly straight-forward */
+        while ((c = getopt_long(argc, argv, "v", opts, NULL)) != EOF) {
+                switch (c) {
+                case 'v':
+                        verbose = true;
+                        break;
+                case 't':
+                        setup_tun_net(optarg);
+                        break;
+                case 'b':
+                        setup_block_file(optarg);
+                        break;
+                case 'r':
+                        setup_rng();
+                        break;
+                case 'i':
+                        initrd_name = optarg;
+                        break;
+                case 'u':
+                        user_details = getpwnam(optarg);
+                        if (!user_details)
+                                err(1, "getpwnam failed, incorrect username?");
+                        break;
+                case 'c':
+                        chroot_path = optarg;
+                        break;
+                default:
+                        warnx("Unknown argument %s", argv[optind]);
+                        usage();
+                }
+        }
+        /*
+         * After the other arguments we expect memory and kernel image name,
+         * followed by command line arguments for the kernel.
+         */
+        if (optind + 2 > argc)
+                usage();
+
+        verbose("Guest base is at %p\n", guest_base);
+
+        /* We always have a console device */
+        setup_console();
+
+        /* Now we load the kernel */
+        start = load_kernel(open_or_die(argv[optind+1], O_RDONLY));
+
+        /* Boot information is stashed at physical address 0 */
+        boot = from_guest_phys(0);
+
+        /* Map the initrd image if requested (at top of physical memory) */
+        if (initrd_name) {
+                initrd_size = load_initrd(initrd_name, mem);
+                /*
+                 * These are the location in the Linux boot header where the
+                 * start and size of the initrd are expected to be found.
+                 */
+                boot->hdr.ramdisk_image = mem - initrd_size;
+                boot->hdr.ramdisk_size = initrd_size;
+                /* The bootloader type 0xFF means "unknown"; that's OK. */
+                boot->hdr.type_of_loader = 0xFF;
+        }
+
+        /*
+         * The Linux boot header contains an "E820" memory map: ours is a
+         * simple, single region.
+         */
+        boot->e820_entries = 1;
+        boot->e820_map[0] = ((struct e820entry) { 0, mem, E820_RAM });
+        /*
+         * The boot header contains a command line pointer: we put the command
+         * line after the boot header.
+         */
+        boot->hdr.cmd_line_ptr = to_guest_phys(boot + 1);
+        /* We use a simple helper to copy the arguments separated by spaces. */
+        concat((char *)(boot + 1), argv+optind+2);
+
+        /* Set kernel alignment to 16M (CONFIG_PHYSICAL_ALIGN) */
+        boot->hdr.kernel_alignment = 0x1000000;
+
+        /* Boot protocol version: 2.07 supports the fields for lguest. */
+        boot->hdr.version = 0x207;
+
+        /* The hardware_subarch value of "1" tells the Guest it's an lguest. */
+        boot->hdr.hardware_subarch = 1;
+
+        /* Tell the entry path not to try to reload segment registers. */
+        boot->hdr.loadflags |= KEEP_SEGMENTS;
+
+        /* We tell the kernel to initialize the Guest. */
+        tell_kernel(start);
+
+        /* Ensure that we terminate if a device-servicing child dies. */
+        signal(SIGCHLD, kill_launcher);
+
+        /* If we exit via err(), this kills all the threads, restores tty. */
+        atexit(cleanup_devices);
+
+        /* If requested, chroot to a directory */
+        if (chroot_path) {
+                if (chroot(chroot_path) != 0)
+                        err(1, "chroot(\"%s\") failed", chroot_path);
+
+                if (chdir("/") != 0)
+                        err(1, "chdir(\"/\") failed");
+
+                verbose("chroot done\n");
+        }
+
+        /* If requested, drop privileges */
+        if (user_details) {
+                uid_t u;
+                gid_t g;
+
+                u = user_details->pw_uid;
+                g = user_details->pw_gid;
+
+                if (initgroups(user_details->pw_name, g) != 0)
+                        err(1, "initgroups failed");
+
+                if (setresgid(g, g, g) != 0)
+                        err(1, "setresgid failed");
+
+                if (setresuid(u, u, u) != 0)
+                        err(1, "setresuid failed");
+
+                verbose("Dropping privileges completed\n");
+        }
+
+        /* Finally, run the Guest.  This doesn't return. */
+        run_guest();
+}
+/*:*/
+
+/*M:999
+ * Mastery is done: you now know everything I do.
+ *
+ * But surely you have seen code, features and bugs in your wanderings which
+ * you now yearn to attack?  That is the real game, and I look forward to you
+ * patching and forking lguest into the Your-Name-Here-visor.
+ *
+ * Farewell, and good coding!
+ * Rusty Russell.
+ */
diff --git a/tools/lguest/lguest.txt b/tools/lguest/lguest.txt
new file mode 100644
index 000000000000..bff0c554485d
--- /dev/null
+++ b/tools/lguest/lguest.txt
@@ -0,0 +1,129 @@
+      __
+ (___()'`;  Rusty's Remarkably Unreliable Guide to Lguest
+ /,    /`      - or, A Young Coder's Illustrated Hypervisor
+ \\"--\\    http://lguest.ozlabs.org
+
+Lguest is designed to be a minimal 32-bit x86 hypervisor for the Linux kernel,
+for Linux developers and users to experiment with virtualization with the
+minimum of complexity.  Nonetheless, it should have sufficient features to
+make it useful for specific tasks, and, of course, you are encouraged to fork
+and enhance it (see drivers/lguest/README).
+
+Features:
+
+- Kernel module which runs in a normal kernel.
+- Simple I/O model for communication.
+- Simple program to create new guests.
+- Logo contains cute puppies: http://lguest.ozlabs.org
+
+Developer features:
+
+- Fun to hack on.
+- No ABI: being tied to a specific kernel anyway, you can change anything.
+- Many opportunities for improvement or feature implementation.
+
+Running Lguest:
+
+- The easiest way to run lguest is to use same kernel as guest and host.
+  You can configure them differently, but usually it's easiest not to.
+
+  You will need to configure your kernel with the following options:
+
+  "General setup":
+     "Prompt for development and/or incomplete code/drivers" = Y
+        (CONFIG_EXPERIMENTAL=y)
+
+  "Processor type and features":
+     "Paravirtualized guest support" = Y
+        "Lguest guest support" = Y
+     "High Memory Support" = off/4GB
+     "Alignment value to which kernel should be aligned" = 0x100000
+        (CONFIG_PARAVIRT=y, CONFIG_LGUEST_GUEST=y, CONFIG_HIGHMEM64G=n and
+         CONFIG_PHYSICAL_ALIGN=0x100000)
+
+  "Device Drivers":
+     "Block devices"
+        "Virtio block driver (EXPERIMENTAL)" = M/Y
+     "Network device support"
+        "Universal TUN/TAP device driver support" = M/Y
+        "Virtio network driver (EXPERIMENTAL)" = M/Y
+           (CONFIG_VIRTIO_BLK=m, CONFIG_VIRTIO_NET=m and CONFIG_TUN=m)
+
+  "Virtualization"
+     "Linux hypervisor example code" = M/Y
+        (CONFIG_LGUEST=m)
+
+- A tool called "lguest" is available in this directory: type "make"
+  to build it.  If you didn't build your kernel in-tree, use "make
+  O=<builddir>".
+
+- Create or find a root disk image.  There are several useful ones
+  around, such as the xm-test tiny root image at
+          http://xm-test.xensource.com/ramdisks/initrd-1.1-i386.img
+
+  For more serious work, I usually use a distribution ISO image and
+  install it under qemu, then make multiple copies:
+
+          dd if=/dev/zero of=rootfile bs=1M count=2048
+          qemu -cdrom image.iso -hda rootfile -net user -net nic -boot d
+
+  Make sure that you install a getty on /dev/hvc0 if you want to log in on the
+  console!
+
+- "modprobe lg" if you built it as a module.
+
+- Run an lguest as root:
+
+      Documentation/virtual/lguest/lguest 64 vmlinux --tunnet=192.168.19.1 \
+        --block=rootfile root=/dev/vda
+
+   Explanation:
+    64: the amount of memory to use, in MB.
+
+    vmlinux: the kernel image found in the top of your build directory.  You
+       can also use a standard bzImage.
+
+    --tunnet=192.168.19.1: configures a "tap" device for networking with this
+       IP address.
+
+    --block=rootfile: a file or block device which becomes /dev/vda
+       inside the guest.
+
+    root=/dev/vda: this (and anything else on the command line) are
+       kernel boot parameters.
+
+- Configuring networking.  I usually have the host masquerade, using
+  "iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE" and "echo 1 >
+  /proc/sys/net/ipv4/ip_forward".  In this example, I would configure
+  eth0 inside the guest at 192.168.19.2.
+
+  Another method is to bridge the tap device to an external interface
+  using --tunnet=bridge:<bridgename>, and perhaps run dhcp on the guest
+  to obtain an IP address.  The bridge needs to be configured first:
+  this option simply adds the tap interface to it.
+
+  A simple example on my system:
+
+    ifconfig eth0 0.0.0.0
+    brctl addbr lg0
+    ifconfig lg0 up
+    brctl addif lg0 eth0
+    dhclient lg0
+
+  Then use --tunnet=bridge:lg0 when launching the guest.
+
+  See:
+  
+    http://www.linuxfoundation.org/collaborate/workgroups/networking/bridge
+    
+  for general information on how to get bridging to work.
+
+- Random number generation. Using the --rng option will provide a
+  /dev/hwrng in the guest that will read from the host's /dev/random.
+  Use this option in conjunction with rng-tools (see ../hw_random.txt)
+  to provide entropy to the guest kernel's /dev/random.
+
+There is a helpful mailing list at http://ozlabs.org/mailman/listinfo/lguest
+
+Good luck!
+Rusty Russell rusty@rustcorp.com.au.
diff --git a/tools/nfsd/inject_fault.sh b/tools/nfsd/inject_fault.sh
new file mode 100755
index 000000000000..06a399ac8b2f
--- /dev/null
+++ b/tools/nfsd/inject_fault.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+#
+# Copyright (c) 2011 Bryan Schumaker <bjschuma@netapp.com>
+#
+# Script for easier NFSD fault injection
+
+# Check that debugfs has been mounted
+DEBUGFS=`cat /proc/mounts | grep debugfs`
+if [ "$DEBUGFS" == "" ]; then
+        echo "debugfs does not appear to be mounted!"
+        echo "Please mount debugfs and try again"
+        exit 1
+fi
+
+# Check that the fault injection directory exists
+DEBUGDIR=`echo $DEBUGFS | awk '{print $2}'`/nfsd
+if [ ! -d "$DEBUGDIR" ]; then
+        echo "$DEBUGDIR does not exist"
+        echo "Check that your .config selects CONFIG_NFSD_FAULT_INJECTION"
+        exit 1
+fi
+
+function help()
+{
+        echo "Usage $0 injection_type [count]"
+        echo ""
+        echo "Injection types are:"
+        ls $DEBUGDIR
+        exit 1
+}
+
+if [ $# == 0 ]; then
+        help
+elif [ ! -f $DEBUGDIR/$1 ]; then
+        help
+elif [ $# != 2 ]; then
+        COUNT=0
+else
+        COUNT=$2
+fi
+
+BEFORE=`mktemp`
+AFTER=`mktemp`
+dmesg > $BEFORE
+echo $COUNT > $DEBUGDIR/$1
+dmesg > $AFTER
+# Capture lines that only exist in the $AFTER file
+diff $BEFORE $AFTER | grep ">"
+rm -f $BEFORE $AFTER
diff --git a/tools/perf/Documentation/Makefile b/tools/perf/Documentation/Makefile
index 4626a398836a..ca600e09c8d4 100644
--- a/tools/perf/Documentation/Makefile
+++ b/tools/perf/Documentation/Makefile
@@ -1,3 +1,10 @@
+OUTPUT := ./
+ifeq ("$(origin O)", "command line")
+  ifneq ($(O),)
+        OUTPUT := $(O)/
+  endif
+endif
+
 MAN1_TXT= \
         $(filter-out $(addsuffix .txt, $(ARTICLES) $(SP_ARTICLES)), \
                 $(wildcard perf-*.txt)) \
@@ -6,10 +13,11 @@ MAN5_TXT=
 MAN7_TXT=
 
 MAN_TXT = $(MAN1_TXT) $(MAN5_TXT) $(MAN7_TXT)
-MAN_XML=$(patsubst %.txt,%.xml,$(MAN_TXT))
-MAN_HTML=$(patsubst %.txt,%.html,$(MAN_TXT))
+_MAN_XML=$(patsubst %.txt,%.xml,$(MAN_TXT))
+_MAN_HTML=$(patsubst %.txt,%.html,$(MAN_TXT))
 
-DOC_HTML=$(MAN_HTML)
+MAN_XML=$(addprefix $(OUTPUT),$(_MAN_XML))
+MAN_HTML=$(addprefix $(OUTPUT),$(_MAN_HTML))
 
 ARTICLES =
 # with their own formatting rules.
@@ -18,11 +26,17 @@ API_DOCS = $(patsubst %.txt,%,$(filter-out technical/api-index-skel.txt technica
 SP_ARTICLES += $(API_DOCS)
 SP_ARTICLES += technical/api-index
 
-DOC_HTML += $(patsubst %,%.html,$(ARTICLES) $(SP_ARTICLES))
+_DOC_HTML = $(_MAN_HTML)
+_DOC_HTML+=$(patsubst %,%.html,$(ARTICLES) $(SP_ARTICLES))
+DOC_HTML=$(addprefix $(OUTPUT),$(_DOC_HTML))
 
-DOC_MAN1=$(patsubst %.txt,%.1,$(MAN1_TXT))
-DOC_MAN5=$(patsubst %.txt,%.5,$(MAN5_TXT))
-DOC_MAN7=$(patsubst %.txt,%.7,$(MAN7_TXT))
+_DOC_MAN1=$(patsubst %.txt,%.1,$(MAN1_TXT))
+_DOC_MAN5=$(patsubst %.txt,%.5,$(MAN5_TXT))
+_DOC_MAN7=$(patsubst %.txt,%.7,$(MAN7_TXT))
+
+DOC_MAN1=$(addprefix $(OUTPUT),$(_DOC_MAN1))
+DOC_MAN5=$(addprefix $(OUTPUT),$(_DOC_MAN5))
+DOC_MAN7=$(addprefix $(OUTPUT),$(_DOC_MAN7))
 
 # Make the path relative to DESTDIR, not prefix
 ifndef DESTDIR
@@ -150,9 +164,9 @@ man1: $(DOC_MAN1)
 man5: $(DOC_MAN5)
 man7: $(DOC_MAN7)
 
-info: perf.info perfman.info
+info: $(OUTPUT)perf.info $(OUTPUT)perfman.info
 
-pdf: user-manual.pdf
+pdf: $(OUTPUT)user-manual.pdf
 
 install: install-man
 
@@ -166,7 +180,7 @@ install-man: man
 
 install-info: info
         $(INSTALL) -d -m 755 $(DESTDIR)$(infodir)
-        $(INSTALL) -m 644 perf.info perfman.info $(DESTDIR)$(infodir)
+        $(INSTALL) -m 644 $(OUTPUT)perf.info $(OUTPUT)perfman.info $(DESTDIR)$(infodir)
         if test -r $(DESTDIR)$(infodir)/dir; then \
           $(INSTALL_INFO) --info-dir=$(DESTDIR)$(infodir) perf.info ;\
           $(INSTALL_INFO) --info-dir=$(DESTDIR)$(infodir) perfman.info ;\
@@ -176,7 +190,7 @@ install-info: info
 
 install-pdf: pdf
         $(INSTALL) -d -m 755 $(DESTDIR)$(pdfdir)
-        $(INSTALL) -m 644 user-manual.pdf $(DESTDIR)$(pdfdir)
+        $(INSTALL) -m 644 $(OUTPUT)user-manual.pdf $(DESTDIR)$(pdfdir)
 
 #install-html: html
 #       '$(SHELL_PATH_SQ)' ./install-webdoc.sh $(DESTDIR)$(htmldir)
@@ -189,14 +203,14 @@ install-pdf: pdf
 #
 # Determine "include::" file references in asciidoc files.
 #
-doc.dep : $(wildcard *.txt) build-docdep.perl
+$(OUTPUT)doc.dep : $(wildcard *.txt) build-docdep.perl
         $(QUIET_GEN)$(RM) $@+ $@ && \
         $(PERL_PATH) ./build-docdep.perl >$@+ $(QUIET_STDERR) && \
         mv $@+ $@
 
--include doc.dep
+-include $(OUPTUT)doc.dep
 
-cmds_txt = cmds-ancillaryinterrogators.txt \
+_cmds_txt = cmds-ancillaryinterrogators.txt \
         cmds-ancillarymanipulators.txt \
         cmds-mainporcelain.txt \
         cmds-plumbinginterrogators.txt \
@@ -205,32 +219,36 @@ cmds_txt = cmds-ancillaryinterrogators.txt \
         cmds-synchelpers.txt \
         cmds-purehelpers.txt \
         cmds-foreignscminterface.txt
+cmds_txt=$(addprefix $(OUTPUT),$(_cmds_txt))
 
-$(cmds_txt): cmd-list.made
+$(cmds_txt): $(OUTPUT)cmd-list.made
 
-cmd-list.made: cmd-list.perl ../command-list.txt $(MAN1_TXT)
+$(OUTPUT)cmd-list.made: cmd-list.perl ../command-list.txt $(MAN1_TXT)
         $(QUIET_GEN)$(RM) $@ && \
         $(PERL_PATH) ./cmd-list.perl ../command-list.txt $(QUIET_STDERR) && \
         date >$@
 
 clean:
-        $(RM) *.xml *.xml+ *.html *.html+ *.1 *.5 *.7
-        $(RM) *.texi *.texi+ *.texi++ perf.info perfman.info
-        $(RM) howto-index.txt howto/*.html doc.dep
-        $(RM) technical/api-*.html technical/api-index.txt
-        $(RM) $(cmds_txt) *.made
-
-$(MAN_HTML): %.html : %.txt
+        $(RM) $(MAN_XML) $(addsuffix +,$(MAN_XML))
+        $(RM) $(MAN_HTML) $(addsuffix +,$(MAN_HTML))
+        $(RM) $(DOC_HTML) $(DOC_MAN1) $(DOC_MAN5) $(DOC_MAN7)
+        $(RM) $(OUTPUT)*.texi $(OUTPUT)*.texi+ $(OUTPUT)*.texi++
+        $(RM) $(OUTPUT)perf.info $(OUTPUT)perfman.info
+        $(RM) $(OUTPUT)howto-index.txt $(OUTPUT)howto/*.html $(OUTPUT)doc.dep
+        $(RM) $(OUTPUT)technical/api-*.html $(OUTPUT)technical/api-index.txt
+        $(RM) $(cmds_txt) $(OUTPUT)*.made
+
+$(MAN_HTML): $(OUTPUT)%.html : %.txt
         $(QUIET_ASCIIDOC)$(RM) $@+ $@ && \
         $(ASCIIDOC) -b xhtml11 -d manpage -f asciidoc.conf \
                 $(ASCIIDOC_EXTRA) -aperf_version=$(PERF_VERSION) -o $@+ $< && \
         mv $@+ $@
 
-%.1 %.5 %.7 : %.xml
+$(OUTPUT)%.1 $(OUTPUT)%.5 $(OUTPUT)%.7 : $(OUTPUT)%.xml
         $(QUIET_XMLTO)$(RM) $@ && \
-        xmlto -m $(MANPAGE_XSL) $(XMLTO_EXTRA) man $<
+        xmlto -o $(OUTPUT) -m $(MANPAGE_XSL) $(XMLTO_EXTRA) man $<
 
-%.xml : %.txt
+$(OUTPUT)%.xml : %.txt
         $(QUIET_ASCIIDOC)$(RM) $@+ $@ && \
         $(ASCIIDOC) -b docbook -d manpage -f asciidoc.conf \
                 $(ASCIIDOC_EXTRA) -aperf_version=$(PERF_VERSION) -o $@+ $< && \
@@ -239,25 +257,25 @@ $(MAN_HTML): %.html : %.txt
 XSLT = docbook.xsl
 XSLTOPTS = --xinclude --stringparam html.stylesheet docbook-xsl.css
 
-user-manual.html: user-manual.xml
+$(OUTPUT)user-manual.html: $(OUTPUT)user-manual.xml
         $(QUIET_XSLTPROC)xsltproc $(XSLTOPTS) -o $@ $(XSLT) $<
 
-perf.info: user-manual.texi
-        $(QUIET_MAKEINFO)$(MAKEINFO) --no-split -o $@ user-manual.texi
+$(OUTPUT)perf.info: $(OUTPUT)user-manual.texi
+        $(QUIET_MAKEINFO)$(MAKEINFO) --no-split -o $@ $(OUTPUT)user-manual.texi
 
-user-manual.texi: user-manual.xml
+$(OUTPUT)user-manual.texi: $(OUTPUT)user-manual.xml
         $(QUIET_DB2TEXI)$(RM) $@+ $@ && \
-        $(DOCBOOK2X_TEXI) user-manual.xml --encoding=UTF-8 --to-stdout >$@++ && \
+        $(DOCBOOK2X_TEXI) $(OUTPUT)user-manual.xml --encoding=UTF-8 --to-stdout >$@++ && \
         $(PERL_PATH) fix-texi.perl <$@++ >$@+ && \
         rm $@++ && \
         mv $@+ $@
 
-user-manual.pdf: user-manual.xml
+$(OUTPUT)user-manual.pdf: $(OUTPUT)user-manual.xml
         $(QUIET_DBLATEX)$(RM) $@+ $@ && \
         $(DBLATEX) -o $@+ -p /etc/asciidoc/dblatex/asciidoc-dblatex.xsl -s /etc/asciidoc/dblatex/asciidoc-dblatex.sty $< && \
         mv $@+ $@
 
-perfman.texi: $(MAN_XML) cat-texi.perl
+$(OUTPUT)perfman.texi: $(MAN_XML) cat-texi.perl
         $(QUIET_DB2TEXI)$(RM) $@+ $@ && \
         ($(foreach xml,$(MAN_XML),$(DOCBOOK2X_TEXI) --encoding=UTF-8 \
                 --to-stdout $(xml) &&) true) > $@++ && \
@@ -265,7 +283,7 @@ perfman.texi: $(MAN_XML) cat-texi.perl
         rm $@++ && \
         mv $@+ $@
 
-perfman.info: perfman.texi
+$(OUTPUT)perfman.info: $(OUTPUT)perfman.texi
         $(QUIET_MAKEINFO)$(MAKEINFO) --no-split --no-validate $*.texi
 
 $(patsubst %.txt,%.texi,$(MAN_TXT)): %.texi : %.xml
diff --git a/tools/perf/Documentation/perf-list.txt b/tools/perf/Documentation/perf-list.txt
index 7a527f7e9da9..ddc22525228d 100644
--- a/tools/perf/Documentation/perf-list.txt
+++ b/tools/perf/Documentation/perf-list.txt
@@ -21,6 +21,8 @@ EVENT MODIFIERS
 Events can optionally have a modifer by appending a colon and one or
 more modifiers.  Modifiers allow the user to restrict when events are
 counted with 'u' for user-space, 'k' for kernel, 'h' for hypervisor.
+Additional modifiers are 'G' for guest counting (in KVM guests) and 'H'
+for host counting (not in KVM guests).
 
 The 'p' modifier can be used for specifying how precise the instruction
 address should be. The 'p' modifier is currently only implemented for
diff --git a/tools/perf/Documentation/perf-lock.txt b/tools/perf/Documentation/perf-lock.txt
index d6b2a4f2108b..c7f5f55634ac 100644
--- a/tools/perf/Documentation/perf-lock.txt
+++ b/tools/perf/Documentation/perf-lock.txt
@@ -8,7 +8,7 @@ perf-lock - Analyze lock events
 SYNOPSIS
 --------
 [verse]
-'perf lock' {record|report|trace}
+'perf lock' {record|report|script|info}
 
 DESCRIPTION
 -----------
@@ -20,10 +20,13 @@ and statistics with this 'perf lock' command.
   produces the file "perf.data" which contains tracing
   results of lock events.
 
-  'perf lock trace' shows raw lock events.
-
   'perf lock report' reports statistical data.
 
+  'perf lock script' shows raw lock events.
+
+  'perf lock info' shows metadata like threads or addresses
+  of lock instances.
+
 COMMON OPTIONS
 --------------
 
@@ -47,6 +50,17 @@ REPORT OPTIONS
         Sorting key. Possible values: acquired (default), contended,
         wait_total, wait_max, wait_min.
 
+INFO OPTIONS
+------------
+
+-t::
+--threads::
+        dump thread list in perf.data
+
+-m::
+--map::
+        dump map of lock instances (address:name table)
+
 SEE ALSO
 --------
 linkperf:perf[1]
diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt
index 2937f7e14bb7..a1386b2fff00 100644
--- a/tools/perf/Documentation/perf-record.txt
+++ b/tools/perf/Documentation/perf-record.txt
@@ -52,11 +52,15 @@ OPTIONS
 
 -p::
 --pid=::
-        Record events on existing process ID.
+        Record events on existing process ID (comma separated list).
 
 -t::
 --tid=::
-        Record events on existing thread ID.
+        Record events on existing thread ID (comma separated list).
+
+-u::
+--uid=::
+        Record events in threads owned by uid. Name or number.
 
 -r::
 --realtime=::
@@ -148,6 +152,36 @@ an empty cgroup (monitor all the time) using, e.g., -G foo,,bar. Cgroups must ha
 corresponding events, i.e., they always refer to events defined earlier on the command
 line.
 
+-b::
+--branch-any::
+Enable taken branch stack sampling. Any type of taken branch may be sampled.
+This is a shortcut for --branch-filter any. See --branch-filter for more infos.
+
+-j::
+--branch-filter::
+Enable taken branch stack sampling. Each sample captures a series of consecutive
+taken branches. The number of branches captured with each sample depends on the
+underlying hardware, the type of branches of interest, and the executed code.
+It is possible to select the types of branches captured by enabling filters. The
+following filters are defined:
+
+        - any:  any type of branches
+        - any_call: any function call or system call
+        - any_ret: any function return or system call return
+        - any_ind: any indirect branch
+        - u:  only when the branch target is at the user level
+        - k: only when the branch target is in the kernel
+        - hv: only when the target is at the hypervisor level
+
++
+The option requires at least one branch type among any, any_call, any_ret, ind_call.
+The privilege levels may be ommitted, in which case, the privilege levels of the associated
+event are applied to the branch filter. Both kernel (k) and hypervisor (hv) privilege
+levels are subject to permissions.  When sampling on multiple events, branch stack sampling
+is enabled for all the sampling events. The sampled branch type is the same for all events.
+The various filters must be specified as a comma separated list: --branch-filter any_ret,u,k
+Note that this feature may not be available on all processors.
+
 SEE ALSO
 --------
 linkperf:perf-stat[1], linkperf:perf-list[1]
diff --git a/tools/perf/Documentation/perf-report.txt b/tools/perf/Documentation/perf-report.txt
index 9b430e98712e..2d89f02719b5 100644
--- a/tools/perf/Documentation/perf-report.txt
+++ b/tools/perf/Documentation/perf-report.txt
@@ -48,6 +48,9 @@ OPTIONS
         Only consider these symbols. CSV that understands
         file://filename entries.
 
+--symbol-filter=::
+        Only show symbols that match (partially) with this filter.
+
 -U::
 --hide-unresolved::
         Only display entries resolved to a symbol.
@@ -110,6 +113,8 @@ OPTIONS
         requires a tty, if one is not present, as when piping to other
         commands, the stdio interface is used.
 
+--gtk:: Use the GTK2 interface.
+
 -k::
 --vmlinux=<file>::
         vmlinux pathname
@@ -153,6 +158,16 @@ OPTIONS
         information which may be very large and thus may clutter the display.
         It currently includes: cpu and numa topology of the host system.
 
+-b::
+--branch-stack::
+        Use the addresses of sampled taken branches instead of the instruction
+        address to build the histograms. To generate meaningful output, the
+        perf.data file must have been obtained using perf record -b or
+        perf record --branch-filter xxx where xxx is a branch filter option.
+        perf report is able to auto-detect whether a perf.data file contains
+        branch stacks and it will automatically switch to the branch view mode,
+        unless --no-branch-stack is used.
+
 SEE ALSO
 --------
 linkperf:perf-stat[1], linkperf:perf-annotate[1]
diff --git a/tools/perf/Documentation/perf-script.txt b/tools/perf/Documentation/perf-script.txt
index 2f6cef43da25..e9cbfcddfa3f 100644
--- a/tools/perf/Documentation/perf-script.txt
+++ b/tools/perf/Documentation/perf-script.txt
@@ -115,7 +115,7 @@ OPTIONS
 -f::
 --fields::
         Comma separated list of fields to print. Options are:
-        comm, tid, pid, time, cpu, event, trace, ip, sym, dso, addr.
+        comm, tid, pid, time, cpu, event, trace, ip, sym, dso, addr, symoff.
         Field list can be prepended with the type, trace, sw or hw,
         to indicate to which event type the field list applies.
         e.g., -f sw:comm,tid,time,ip,sym  and -f trace:time,cpu,trace
@@ -200,6 +200,9 @@ OPTIONS
         It currently includes: cpu and numa topology of the host system.
         It can only be used with the perf script report mode.
 
+--show-kernel-path::
+        Try to resolve the path of [kernel.kallsyms]
+
 SEE ALSO
 --------
 linkperf:perf-record[1], linkperf:perf-script-perl[1],
diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt
index 8966b9ab2014..2fa173b51970 100644
--- a/tools/perf/Documentation/perf-stat.txt
+++ b/tools/perf/Documentation/perf-stat.txt
@@ -35,11 +35,11 @@ OPTIONS
         child tasks do not inherit counters
 -p::
 --pid=<pid>::
-        stat events on existing process id
+        stat events on existing process id (comma separated list)
 
 -t::
 --tid=<tid>::
-        stat events on existing thread id
+        stat events on existing thread id (comma separated list)
 
 
 -a::
diff --git a/tools/perf/Documentation/perf-top.txt b/tools/perf/Documentation/perf-top.txt
index b1a5bbbfebef..4a5680cb242e 100644
--- a/tools/perf/Documentation/perf-top.txt
+++ b/tools/perf/Documentation/perf-top.txt
@@ -72,11 +72,15 @@ Default is to monitor all CPUS.
 
 -p <pid>::
 --pid=<pid>::
-        Profile events on existing Process ID.
+        Profile events on existing Process ID (comma separated list).
 
 -t <tid>::
 --tid=<tid>::
-        Profile events on existing thread ID.
+        Profile events on existing thread ID (comma separated list).
+
+-u::
+--uid=::
+        Record events in threads owned by uid. Name or number.
 
 -r <priority>::
 --realtime=<priority>::
diff --git a/tools/perf/MANIFEST b/tools/perf/MANIFEST
index c12659d8cb26..5476bc0a1eac 100644
--- a/tools/perf/MANIFEST
+++ b/tools/perf/MANIFEST
@@ -1,4 +1,5 @@
 tools/perf
+include/linux/const.h
 include/linux/perf_event.h
 include/linux/rbtree.h
 include/linux/list.h
@@ -8,6 +9,7 @@ lib/rbtree.c
 include/linux/swab.h
 arch/*/include/asm/unistd*.h
 arch/*/lib/memcpy*.S
+arch/*/lib/memset*.S
 include/linux/poison.h
 include/linux/magic.h
 include/linux/hw_breakpoint.h
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index ac86d67b636e..820371f10d1b 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -15,6 +15,16 @@ endif
 
 # Define V to have a more verbose compile.
 #
+# Define O to save output files in a separate directory.
+#
+# Define ARCH as name of target architecture if you want cross-builds.
+#
+# Define CROSS_COMPILE as prefix name of compiler if you want cross-builds.
+#
+# Define NO_LIBPERL to disable perl script extension.
+#
+# Define NO_LIBPYTHON to disable python script extension.
+#
 # Define PYTHON to point to the python binary if the default
 # `python' is not correct; for example: PYTHON=python2
 #
@@ -32,6 +42,10 @@ endif
 # Define NO_DWARF if you do not want debug-info analysis feature at all.
 #
 # Define WERROR=0 to disable treating any warnings as errors.
+#
+# Define NO_NEWT if you do not want TUI support.
+#
+# Define NO_DEMANGLE if you do not want C++ symbol demangling.
 
 $(OUTPUT)PERF-VERSION-FILE: .FORCE-PERF-VERSION-FILE
         @$(SHELL_PATH) util/PERF-VERSION-GEN $(OUTPUT)
@@ -61,7 +75,7 @@ ifeq ($(ARCH),x86_64)
         ifeq (${IS_X86_64}, 1)
                 RAW_ARCH := x86_64
                 ARCH_CFLAGS := -DARCH_X86_64
-                ARCH_INCLUDE = ../../arch/x86/lib/memcpy_64.S
+                ARCH_INCLUDE = ../../arch/x86/lib/memcpy_64.S ../../arch/x86/lib/memset_64.S
         endif
 endif
 
@@ -104,7 +118,7 @@ endif
 
 CFLAGS = -fno-omit-frame-pointer -ggdb3 -Wall -Wextra -std=gnu99 $(CFLAGS_WERROR) $(CFLAGS_OPTIMIZE) -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS)
 EXTLIBS = -lpthread -lrt -lelf -lm
-ALL_CFLAGS = $(CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
+ALL_CFLAGS = $(CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE
 ALL_LDFLAGS = $(LDFLAGS)
 STRIP ?= strip
 
@@ -168,10 +182,7 @@ endif
 
 ### --- END CONFIGURATION SECTION ---
 
-# Those must not be GNU-specific; they are shared with perl/ which may
-# be built by a different compiler. (Note that this is an artifact now
-# but it still might be nice to keep that distinction.)
-BASIC_CFLAGS = -Iutil/include -Iarch/$(ARCH)/include
+BASIC_CFLAGS = -Iutil/include -Iarch/$(ARCH)/include -I$(OUTPUT)/util -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE
 BASIC_LDFLAGS =
 
 # Guard against environment variables
@@ -186,7 +197,10 @@ SCRIPT_SH += perf-archive.sh
 grep-libs = $(filter -l%,$(1))
 strip-libs = $(filter-out -l%,$(1))
 
-$(OUTPUT)python/perf.so: $(PYRF_OBJS)
+PYTHON_EXT_SRCS := $(shell grep -v ^\# util/python-ext-sources)
+PYTHON_EXT_DEPS := util/python-ext-sources util/setup.py
+
+$(OUTPUT)python/perf.so: $(PYRF_OBJS) $(PYTHON_EXT_SRCS) $(PYTHON_EXT_DEPS)
         $(QUIET_GEN)CFLAGS='$(BASIC_CFLAGS)' $(PYTHON_WORD) util/setup.py \
           --quiet build_ext; \
         mkdir -p $(OUTPUT)python && \
@@ -220,6 +234,25 @@ endif
 
 export PERL_PATH
 
+FLEX = $(CROSS_COMPILE)flex
+BISON= $(CROSS_COMPILE)bison
+
+event-parser:
+        $(QUIET_BISON)$(BISON) -v util/parse-events.y -d -o $(OUTPUT)util/parse-events-bison.c
+        $(QUIET_FLEX)$(FLEX) --header-file=$(OUTPUT)util/parse-events-flex.h -t util/parse-events.l > $(OUTPUT)util/parse-events-flex.c
+
+$(OUTPUT)util/parse-events-flex.c: event-parser
+$(OUTPUT)util/parse-events-bison.c: event-parser
+
+pmu-parser:
+        $(QUIET_BISON)$(BISON) -v util/pmu.y -d -o $(OUTPUT)util/pmu-bison.c
+        $(QUIET_FLEX)$(FLEX) --header-file=$(OUTPUT)util/pmu-flex.h -t util/pmu.l > $(OUTPUT)util/pmu-flex.c
+
+$(OUTPUT)util/pmu-flex.c: pmu-parser
+$(OUTPUT)util/pmu-bison.c: pmu-parser
+
+$(OUTPUT)util/parse-events.o: event-parser pmu-parser
+
 LIB_FILE=$(OUTPUT)libperf.a
 
 LIB_H += ../../include/linux/perf_event.h
@@ -235,7 +268,7 @@ LIB_H += util/include/linux/const.h
 LIB_H += util/include/linux/ctype.h
 LIB_H += util/include/linux/kernel.h
 LIB_H += util/include/linux/list.h
-LIB_H += util/include/linux/module.h
+LIB_H += util/include/linux/export.h
 LIB_H += util/include/linux/poison.h
 LIB_H += util/include/linux/prefetch.h
 LIB_H += util/include/linux/rbtree.h
@@ -252,6 +285,8 @@ LIB_H += util/include/asm/uaccess.h
 LIB_H += util/include/dwarf-regs.h
 LIB_H += util/include/asm/dwarf2.h
 LIB_H += util/include/asm/cpufeature.h
+LIB_H += util/include/asm/unistd_32.h
+LIB_H += util/include/asm/unistd_64.h
 LIB_H += perf.h
 LIB_H += util/annotate.h
 LIB_H += util/cache.h
@@ -259,6 +294,8 @@ LIB_H += util/callchain.h
 LIB_H += util/build-id.h
 LIB_H += util/debug.h
 LIB_H += util/debugfs.h
+LIB_H += util/sysfs.h
+LIB_H += util/pmu.h
 LIB_H += util/event.h
 LIB_H += util/evsel.h
 LIB_H += util/evlist.h
@@ -305,6 +342,8 @@ LIB_OBJS += $(OUTPUT)util/build-id.o
 LIB_OBJS += $(OUTPUT)util/config.o
 LIB_OBJS += $(OUTPUT)util/ctype.o
 LIB_OBJS += $(OUTPUT)util/debugfs.o
+LIB_OBJS += $(OUTPUT)util/sysfs.o
+LIB_OBJS += $(OUTPUT)util/pmu.o
 LIB_OBJS += $(OUTPUT)util/environment.o
 LIB_OBJS += $(OUTPUT)util/event.o
 LIB_OBJS += $(OUTPUT)util/evlist.o
@@ -341,6 +380,10 @@ LIB_OBJS += $(OUTPUT)util/session.o
 LIB_OBJS += $(OUTPUT)util/thread.o
 LIB_OBJS += $(OUTPUT)util/thread_map.o
 LIB_OBJS += $(OUTPUT)util/trace-event-parse.o
+LIB_OBJS += $(OUTPUT)util/parse-events-flex.o
+LIB_OBJS += $(OUTPUT)util/parse-events-bison.o
+LIB_OBJS += $(OUTPUT)util/pmu-flex.o
+LIB_OBJS += $(OUTPUT)util/pmu-bison.o
 LIB_OBJS += $(OUTPUT)util/trace-event-read.o
 LIB_OBJS += $(OUTPUT)util/trace-event-info.o
 LIB_OBJS += $(OUTPUT)util/trace-event-scripting.o
@@ -362,8 +405,10 @@ BUILTIN_OBJS += $(OUTPUT)bench/sched-messaging.o
 BUILTIN_OBJS += $(OUTPUT)bench/sched-pipe.o
 ifeq ($(RAW_ARCH),x86_64)
 BUILTIN_OBJS += $(OUTPUT)bench/mem-memcpy-x86-64-asm.o
+BUILTIN_OBJS += $(OUTPUT)bench/mem-memset-x86-64-asm.o
 endif
 BUILTIN_OBJS += $(OUTPUT)bench/mem-memcpy.o
+BUILTIN_OBJS += $(OUTPUT)bench/mem-memset.o
 
 BUILTIN_OBJS += $(OUTPUT)builtin-diff.o
 BUILTIN_OBJS += $(OUTPUT)builtin-evlist.o
@@ -481,6 +526,20 @@ else
         endif
 endif
 
+ifdef NO_GTK2
+        BASIC_CFLAGS += -DNO_GTK2
+else
+        FLAGS_GTK2=$(ALL_CFLAGS) $(ALL_LDFLAGS) $(EXTLIBS) $(shell pkg-config --libs --cflags gtk+-2.0)
+        ifneq ($(call try-cc,$(SOURCE_GTK2),$(FLAGS_GTK2)),y)
+                msg := $(warning GTK2 not found, disables GTK2 support. Please install gtk2-devel or libgtk2.0-dev);
+                BASIC_CFLAGS += -DNO_GTK2_SUPPORT
+        else
+                BASIC_CFLAGS += $(shell pkg-config --cflags gtk+-2.0)
+                EXTLIBS += $(shell pkg-config --libs gtk+-2.0)
+                LIB_OBJS += $(OUTPUT)util/gtk/browser.o
+        endif
+endif
+
 ifdef NO_LIBPERL
         BASIC_CFLAGS += -DNO_LIBPERL
 else
@@ -627,6 +686,8 @@ ifndef V
         QUIET_LINK     = @echo '   ' LINK $@;
         QUIET_MKDIR    = @echo '   ' MKDIR $@;
         QUIET_GEN      = @echo '   ' GEN $@;
+        QUIET_FLEX     = @echo '   ' FLEX $@;
+        QUIET_BISON    = @echo '   ' BISON $@;
 endif
 endif
 
@@ -707,12 +768,28 @@ $(OUTPUT)perf.o perf.spec \
         $(SCRIPTS) \
         : $(OUTPUT)PERF-VERSION-FILE
 
+.SUFFIXES:
+.SUFFIXES: .o .c .S .s
+
+# These two need to be here so that when O= is not used they take precedence
+# over the general rule for .o
+
+$(OUTPUT)util/%-flex.o: $(OUTPUT)util/%-flex.c $(OUTPUT)PERF-CFLAGS
+        $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) -Iutil/ -Wno-redundant-decls -Wno-switch-default -Wno-unused-function $<
+
+$(OUTPUT)util/%-bison.o: $(OUTPUT)util/%-bison.c $(OUTPUT)PERF-CFLAGS
+        $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) -DYYENABLE_NLS=0 -DYYLTYPE_IS_TRIVIAL=0 -Iutil/ -Wno-redundant-decls -Wno-switch-default -Wno-unused-function $<
+
 $(OUTPUT)%.o: %.c $(OUTPUT)PERF-CFLAGS
         $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $<
+$(OUTPUT)%.i: %.c $(OUTPUT)PERF-CFLAGS
+        $(QUIET_CC)$(CC) -o $@ -E $(ALL_CFLAGS) $<
 $(OUTPUT)%.s: %.c $(OUTPUT)PERF-CFLAGS
-        $(QUIET_CC)$(CC) -S $(ALL_CFLAGS) $<
+        $(QUIET_CC)$(CC) -o $@ -S $(ALL_CFLAGS) $<
 $(OUTPUT)%.o: %.S
         $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $<
+$(OUTPUT)%.s: %.S
+        $(QUIET_CC)$(CC) -o $@ -E $(ALL_CFLAGS) $<
 
 $(OUTPUT)util/exec_cmd.o: util/exec_cmd.c $(OUTPUT)PERF-CFLAGS
         $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) \
@@ -775,6 +852,8 @@ help:
         @echo '  html           - make html documentation'
         @echo '  info           - make GNU info documentation (access with info <foo>)'
         @echo '  pdf            - make pdf documentation'
+        @echo '  event-parser   - make event parser code'
+        @echo '  pmu-parser     - make pmu format parser code'
         @echo '  TAGS           - use etags to make tag information for source browsing'
         @echo '  tags           - use ctags to make tag information for source browsing'
         @echo '  cscope - use cscope to make interactive browsing database'
@@ -795,7 +874,6 @@ help:
         @echo '  quick-install-html     - install the html documentation quickly'
         @echo ''
         @echo 'Perf maintainer targets:'
-        @echo '  distclean              - alias to clean'
         @echo '  clean                  - clean all binary objects and build output'
 
 doc:
@@ -912,6 +990,7 @@ clean:
         $(RM) *.spec *.pyc *.pyo */*.pyc */*.pyo $(OUTPUT)common-cmds.h TAGS tags cscope*
         $(MAKE) -C Documentation/ clean
         $(RM) $(OUTPUT)PERF-VERSION-FILE $(OUTPUT)PERF-CFLAGS
+        $(RM) $(OUTPUT)util/*-{bison,flex}*
         $(python-clean)
 
 .PHONY: all install clean strip
diff --git a/tools/perf/arch/powerpc/util/header.c b/tools/perf/arch/powerpc/util/header.c
index eba80c292945..2f7073d107fd 100644
--- a/tools/perf/arch/powerpc/util/header.c
+++ b/tools/perf/arch/powerpc/util/header.c
@@ -25,7 +25,7 @@ get_cpuid(char *buffer, size_t sz)
 
         pvr = mfspr(SPRN_PVR);
 
-        nb = snprintf(buffer, sz, "%lu,%lu$", PVR_VER(pvr), PVR_REV(pvr));
+        nb = scnprintf(buffer, sz, "%lu,%lu$", PVR_VER(pvr), PVR_REV(pvr));
 
         /* look for end marker to ensure the entire data fit */
         if (strchr(buffer, '$')) {
diff --git a/tools/perf/arch/x86/util/header.c b/tools/perf/arch/x86/util/header.c
index f94006068d2b..146d12a1cec0 100644
--- a/tools/perf/arch/x86/util/header.c
+++ b/tools/perf/arch/x86/util/header.c
@@ -48,7 +48,7 @@ get_cpuid(char *buffer, size_t sz)
                 if (family >= 0x6)
                         model += ((a >> 16) & 0xf) << 4;
         }
-        nb = snprintf(buffer, sz, "%s,%u,%u,%u$", vendor, family, model, step);
+        nb = scnprintf(buffer, sz, "%s,%u,%u,%u$", vendor, family, model, step);
 
         /* look for end marker to ensure the entire data fit */
         if (strchr(buffer, '$')) {
diff --git a/tools/perf/bench/bench.h b/tools/perf/bench/bench.h
index f7781c6267c0..a09bece6dad2 100644
--- a/tools/perf/bench/bench.h
+++ b/tools/perf/bench/bench.h
@@ -4,6 +4,7 @@
 extern int bench_sched_messaging(int argc, const char **argv, const char *prefix);
 extern int bench_sched_pipe(int argc, const char **argv, const char *prefix);
 extern int bench_mem_memcpy(int argc, const char **argv, const char *prefix __used);
+extern int bench_mem_memset(int argc, const char **argv, const char *prefix);
 
 #define BENCH_FORMAT_DEFAULT_STR        "default"
 #define BENCH_FORMAT_DEFAULT            0
diff --git a/tools/perf/bench/mem-memcpy-x86-64-asm-def.h b/tools/perf/bench/mem-memcpy-x86-64-asm-def.h
index d588b87696fc..d66ab799b35f 100644
--- a/tools/perf/bench/mem-memcpy-x86-64-asm-def.h
+++ b/tools/perf/bench/mem-memcpy-x86-64-asm-def.h
@@ -2,3 +2,11 @@
 MEMCPY_FN(__memcpy,
         "x86-64-unrolled",
         "unrolled memcpy() in arch/x86/lib/memcpy_64.S")
+
+MEMCPY_FN(memcpy_c,
+        "x86-64-movsq",
+        "movsq-based memcpy() in arch/x86/lib/memcpy_64.S")
+
+MEMCPY_FN(memcpy_c_e,
+        "x86-64-movsb",
+        "movsb-based memcpy() in arch/x86/lib/memcpy_64.S")
diff --git a/tools/perf/bench/mem-memcpy-x86-64-asm.S b/tools/perf/bench/mem-memcpy-x86-64-asm.S
index a57b66e853c2..fcd9cf00600a 100644
--- a/tools/perf/bench/mem-memcpy-x86-64-asm.S
+++ b/tools/perf/bench/mem-memcpy-x86-64-asm.S
@@ -1,2 +1,12 @@
-
+#define memcpy MEMCPY /* don't hide glibc's memcpy() */
+#define altinstr_replacement text
+#define globl p2align 4; .globl
+#define Lmemcpy_c globl memcpy_c; memcpy_c
+#define Lmemcpy_c_e globl memcpy_c_e; memcpy_c_e
 #include "../../../arch/x86/lib/memcpy_64.S"
+/*
+ * We need to provide note.GNU-stack section, saying that we want
+ * NOT executable stack. Otherwise the final linking will assume that
+ * the ELF stack should not be restricted at all and set it RWX.
+ */
+.section .note.GNU-stack,"",@progbits
diff --git a/tools/perf/bench/mem-memcpy.c b/tools/perf/bench/mem-memcpy.c
index db82021f4b91..71557225bf92 100644
--- a/tools/perf/bench/mem-memcpy.c
+++ b/tools/perf/bench/mem-memcpy.c
@@ -5,7 +5,6 @@
  *
  * Written by Hitoshi Mitake <mitake@dcl.info.waseda.ac.jp>
  */
-#include <ctype.h>
 
 #include "../perf.h"
 #include "../util/util.h"
@@ -24,6 +23,7 @@
 
 static const char       *length_str     = "1MB";
 static const char       *routine        = "default";
+static int              iterations      = 1;
 static bool             use_clock;
 static int              clock_fd;
 static bool             only_prefault;
@@ -35,6 +35,8 @@ static const struct option options[] = {
                     "available unit: B, MB, GB (upper and lower)"),
         OPT_STRING('r', "routine", &routine, "default",
                     "Specify routine to copy"),
+        OPT_INTEGER('i', "iterations", &iterations,
+                    "repeat memcpy() invocation this number of times"),
         OPT_BOOLEAN('c', "clock", &use_clock,
                     "Use CPU clock for measuring"),
         OPT_BOOLEAN('o', "only-prefault", &only_prefault,
@@ -121,6 +123,7 @@ static u64 do_memcpy_clock(memcpy_t fn, size_t len, bool prefault)
 {
         u64 clock_start = 0ULL, clock_end = 0ULL;
         void *src = NULL, *dst = NULL;
+        int i;
 
         alloc_mem(&src, &dst, len);
 
@@ -128,7 +131,8 @@ static u64 do_memcpy_clock(memcpy_t fn, size_t len, bool prefault)
                 fn(dst, src, len);
 
         clock_start = get_clock();
-        fn(dst, src, len);
+        for (i = 0; i < iterations; ++i)
+                fn(dst, src, len);
         clock_end = get_clock();
 
         free(src);
@@ -140,6 +144,7 @@ static double do_memcpy_gettimeofday(memcpy_t fn, size_t len, bool prefault)
 {
         struct timeval tv_start, tv_end, tv_diff;
         void *src = NULL, *dst = NULL;
+        int i;
 
         alloc_mem(&src, &dst, len);
 
@@ -147,7 +152,8 @@ static double do_memcpy_gettimeofday(memcpy_t fn, size_t len, bool prefault)
                 fn(dst, src, len);
 
         BUG_ON(gettimeofday(&tv_start, NULL));
-        fn(dst, src, len);
+        for (i = 0; i < iterations; ++i)
+                fn(dst, src, len);
         BUG_ON(gettimeofday(&tv_end, NULL));
 
         timersub(&tv_end, &tv_start, &tv_diff);
diff --git a/tools/perf/bench/mem-memset-arch.h b/tools/perf/bench/mem-memset-arch.h
new file mode 100644
index 000000000000..a040fa77665b
--- /dev/null
+++ b/tools/perf/bench/mem-memset-arch.h
@@ -0,0 +1,12 @@
+
+#ifdef ARCH_X86_64
+
+#define MEMSET_FN(fn, name, desc)               \
+        extern void *fn(void *, int, size_t);
+
+#include "mem-memset-x86-64-asm-def.h"
+
+#undef MEMSET_FN
+
+#endif
+
diff --git a/tools/perf/bench/mem-memset-x86-64-asm-def.h b/tools/perf/bench/mem-memset-x86-64-asm-def.h
new file mode 100644
index 000000000000..a71dff97c1f5
--- /dev/null
+++ b/tools/perf/bench/mem-memset-x86-64-asm-def.h
@@ -0,0 +1,12 @@
+
+MEMSET_FN(__memset,
+        "x86-64-unrolled",
+        "unrolled memset() in arch/x86/lib/memset_64.S")
+
+MEMSET_FN(memset_c,
+        "x86-64-stosq",
+        "movsq-based memset() in arch/x86/lib/memset_64.S")
+
+MEMSET_FN(memset_c_e,
+        "x86-64-stosb",
+        "movsb-based memset() in arch/x86/lib/memset_64.S")
diff --git a/tools/perf/bench/mem-memset-x86-64-asm.S b/tools/perf/bench/mem-memset-x86-64-asm.S
new file mode 100644
index 000000000000..9e5af89ed13a
--- /dev/null
+++ b/tools/perf/bench/mem-memset-x86-64-asm.S
@@ -0,0 +1,13 @@
+#define memset MEMSET /* don't hide glibc's memset() */
+#define altinstr_replacement text
+#define globl p2align 4; .globl
+#define Lmemset_c globl memset_c; memset_c
+#define Lmemset_c_e globl memset_c_e; memset_c_e
+#include "../../../arch/x86/lib/memset_64.S"
+
+/*
+ * We need to provide note.GNU-stack section, saying that we want
+ * NOT executable stack. Otherwise the final linking will assume that
+ * the ELF stack should not be restricted at all and set it RWX.
+ */
+.section .note.GNU-stack,"",@progbits
diff --git a/tools/perf/bench/mem-memset.c b/tools/perf/bench/mem-memset.c
new file mode 100644
index 000000000000..e9079185bd72
--- /dev/null
+++ b/tools/perf/bench/mem-memset.c
@@ -0,0 +1,297 @@
+/*
+ * mem-memset.c
+ *
+ * memset: Simple memory set in various ways
+ *
+ * Trivial clone of mem-memcpy.c.
+ */
+
+#include "../perf.h"
+#include "../util/util.h"
+#include "../util/parse-options.h"
+#include "../util/header.h"
+#include "bench.h"
+#include "mem-memset-arch.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/time.h>
+#include <errno.h>
+
+#define K 1024
+
+static const char       *length_str     = "1MB";
+static const char       *routine        = "default";
+static int              iterations      = 1;
+static bool             use_clock;
+static int              clock_fd;
+static bool             only_prefault;
+static bool             no_prefault;
+
+static const struct option options[] = {
+        OPT_STRING('l', "length", &length_str, "1MB",
+                    "Specify length of memory to copy. "
+                    "available unit: B, MB, GB (upper and lower)"),
+        OPT_STRING('r', "routine", &routine, "default",
+                    "Specify routine to copy"),
+        OPT_INTEGER('i', "iterations", &iterations,
+                    "repeat memset() invocation this number of times"),
+        OPT_BOOLEAN('c', "clock", &use_clock,
+                    "Use CPU clock for measuring"),
+        OPT_BOOLEAN('o', "only-prefault", &only_prefault,
+                    "Show only the result with page faults before memset()"),
+        OPT_BOOLEAN('n', "no-prefault", &no_prefault,
+                    "Show only the result without page faults before memset()"),
+        OPT_END()
+};
+
+typedef void *(*memset_t)(void *, int, size_t);
+
+struct routine {
+        const char *name;
+        const char *desc;
+        memset_t fn;
+};
+
+static const struct routine routines[] = {
+        { "default",
+          "Default memset() provided by glibc",
+          memset },
+#ifdef ARCH_X86_64
+
+#define MEMSET_FN(fn, name, desc) { name, desc, fn },
+#include "mem-memset-x86-64-asm-def.h"
+#undef MEMSET_FN
+
+#endif
+
+        { NULL,
+          NULL,
+          NULL   }
+};
+
+static const char * const bench_mem_memset_usage[] = {
+        "perf bench mem memset <options>",
+        NULL
+};
+
+static struct perf_event_attr clock_attr = {
+        .type           = PERF_TYPE_HARDWARE,
+        .config         = PERF_COUNT_HW_CPU_CYCLES
+};
+
+static void init_clock(void)
+{
+        clock_fd = sys_perf_event_open(&clock_attr, getpid(), -1, -1, 0);
+
+        if (clock_fd < 0 && errno == ENOSYS)
+                die("No CONFIG_PERF_EVENTS=y kernel support configured?\n");
+        else
+                BUG_ON(clock_fd < 0);
+}
+
+static u64 get_clock(void)
+{
+        int ret;
+        u64 clk;
+
+        ret = read(clock_fd, &clk, sizeof(u64));
+        BUG_ON(ret != sizeof(u64));
+
+        return clk;
+}
+
+static double timeval2double(struct timeval *ts)
+{
+        return (double)ts->tv_sec +
+                (double)ts->tv_usec / (double)1000000;
+}
+
+static void alloc_mem(void **dst, size_t length)
+{
+        *dst = zalloc(length);
+        if (!dst)
+                die("memory allocation failed - maybe length is too large?\n");
+}
+
+static u64 do_memset_clock(memset_t fn, size_t len, bool prefault)
+{
+        u64 clock_start = 0ULL, clock_end = 0ULL;
+        void *dst = NULL;
+        int i;
+
+        alloc_mem(&dst, len);
+
+        if (prefault)
+                fn(dst, -1, len);
+
+        clock_start = get_clock();
+        for (i = 0; i < iterations; ++i)
+                fn(dst, i, len);
+        clock_end = get_clock();
+
+        free(dst);
+        return clock_end - clock_start;
+}
+
+static double do_memset_gettimeofday(memset_t fn, size_t len, bool prefault)
+{
+        struct timeval tv_start, tv_end, tv_diff;
+        void *dst = NULL;
+        int i;
+
+        alloc_mem(&dst, len);
+
+        if (prefault)
+                fn(dst, -1, len);
+
+        BUG_ON(gettimeofday(&tv_start, NULL));
+        for (i = 0; i < iterations; ++i)
+                fn(dst, i, len);
+        BUG_ON(gettimeofday(&tv_end, NULL));
+
+        timersub(&tv_end, &tv_start, &tv_diff);
+
+        free(dst);
+        return (double)((double)len / timeval2double(&tv_diff));
+}
+
+#define pf (no_prefault ? 0 : 1)
+
+#define print_bps(x) do {                                       \
+                if (x < K)                                      \
+                        printf(" %14lf B/Sec", x);              \
+                else if (x < K * K)                             \
+                        printf(" %14lfd KB/Sec", x / K);        \
+                else if (x < K * K * K)                         \
+                        printf(" %14lf MB/Sec", x / K / K);     \
+                else                                            \
+                        printf(" %14lf GB/Sec", x / K / K / K); \
+        } while (0)
+
+int bench_mem_memset(int argc, const char **argv,
+                     const char *prefix __used)
+{
+        int i;
+        size_t len;
+        double result_bps[2];
+        u64 result_clock[2];
+
+        argc = parse_options(argc, argv, options,
+                             bench_mem_memset_usage, 0);
+
+        if (use_clock)
+                init_clock();
+
+        len = (size_t)perf_atoll((char *)length_str);
+
+        result_clock[0] = result_clock[1] = 0ULL;
+        result_bps[0] = result_bps[1] = 0.0;
+
+        if ((s64)len <= 0) {
+                fprintf(stderr, "Invalid length:%s\n", length_str);
+                return 1;
+        }
+
+        /* same to without specifying either of prefault and no-prefault */
+        if (only_prefault && no_prefault)
+                only_prefault = no_prefault = false;
+
+        for (i = 0; routines[i].name; i++) {
+                if (!strcmp(routines[i].name, routine))
+                        break;
+        }
+        if (!routines[i].name) {
+                printf("Unknown routine:%s\n", routine);
+                printf("Available routines...\n");
+                for (i = 0; routines[i].name; i++) {
+                        printf("\t%s ... %s\n",
+                               routines[i].name, routines[i].desc);
+                }
+                return 1;
+        }
+
+        if (bench_format == BENCH_FORMAT_DEFAULT)
+                printf("# Copying %s Bytes ...\n\n", length_str);
+
+        if (!only_prefault && !no_prefault) {
+                /* show both of results */
+                if (use_clock) {
+                        result_clock[0] =
+                                do_memset_clock(routines[i].fn, len, false);
+                        result_clock[1] =
+                                do_memset_clock(routines[i].fn, len, true);
+                } else {
+                        result_bps[0] =
+                                do_memset_gettimeofday(routines[i].fn,
+                                                len, false);
+                        result_bps[1] =
+                                do_memset_gettimeofday(routines[i].fn,
+                                                len, true);
+                }
+        } else {
+                if (use_clock) {
+                        result_clock[pf] =
+                                do_memset_clock(routines[i].fn,
+                                                len, only_prefault);
+                } else {
+                        result_bps[pf] =
+                                do_memset_gettimeofday(routines[i].fn,
+                                                len, only_prefault);
+                }
+        }
+
+        switch (bench_format) {
+        case BENCH_FORMAT_DEFAULT:
+                if (!only_prefault && !no_prefault) {
+                        if (use_clock) {
+                                printf(" %14lf Clock/Byte\n",
+                                        (double)result_clock[0]
+                                        / (double)len);
+                                printf(" %14lf Clock/Byte (with prefault)\n ",
+                                        (double)result_clock[1]
+                                        / (double)len);
+                        } else {
+                                print_bps(result_bps[0]);
+                                printf("\n");
+                                print_bps(result_bps[1]);
+                                printf(" (with prefault)\n");
+                        }
+                } else {
+                        if (use_clock) {
+                                printf(" %14lf Clock/Byte",
+                                        (double)result_clock[pf]
+                                        / (double)len);
+                        } else
+                                print_bps(result_bps[pf]);
+
+                        printf("%s\n", only_prefault ? " (with prefault)" : "");
+                }
+                break;
+        case BENCH_FORMAT_SIMPLE:
+                if (!only_prefault && !no_prefault) {
+                        if (use_clock) {
+                                printf("%lf %lf\n",
+                                        (double)result_clock[0] / (double)len,
+                                        (double)result_clock[1] / (double)len);
+                        } else {
+                                printf("%lf %lf\n",
+                                        result_bps[0], result_bps[1]);
+                        }
+                } else {
+                        if (use_clock) {
+                                printf("%lf\n", (double)result_clock[pf]
+                                        / (double)len);
+                        } else
+                                printf("%lf\n", result_bps[pf]);
+                }
+                break;
+        default:
+                /* reaching this means there's some disaster: */
+                die("unknown format: %d\n", bench_format);
+                break;
+        }
+
+        return 0;
+}
diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
index 214ba7f9f577..806e0a286634 100644
--- a/tools/perf/builtin-annotate.c
+++ b/tools/perf/builtin-annotate.c
@@ -235,7 +235,7 @@ out_delete:
 }
 
 static const char * const annotate_usage[] = {
-        "perf annotate [<options>] <command>",
+        "perf annotate [<options>]",
         NULL
 };
 
@@ -313,10 +313,5 @@ int cmd_annotate(int argc, const char **argv, const char *prefix __used)
                 annotate.sym_hist_filter = argv[0];
         }
 
-        if (field_sep && *field_sep == '.') {
-                pr_err("'.' is the only non valid --field-separator argument\n");
-                return -1;
-        }
-
         return __cmd_annotate(&annotate);
 }
diff --git a/tools/perf/builtin-bench.c b/tools/perf/builtin-bench.c
index fcb96269852a..b0e74ab2d7a2 100644
--- a/tools/perf/builtin-bench.c
+++ b/tools/perf/builtin-bench.c
@@ -52,6 +52,9 @@ static struct bench_suite mem_suites[] = {
         { "memcpy",
           "Simple memory copy in various ways",
           bench_mem_memcpy },
+        { "memset",
+          "Simple memory set in various ways",
+          bench_mem_memset },
         suite_all,
         { NULL,
           NULL,
diff --git a/tools/perf/builtin-diff.c b/tools/perf/builtin-diff.c
index 4f19513d7dda..d29d350fb2b7 100644
--- a/tools/perf/builtin-diff.c
+++ b/tools/perf/builtin-diff.c
@@ -24,6 +24,11 @@ static char	  diff__default_sort_order[] = "dso,symbol";
 static bool  force;
 static bool show_displacement;
 
+struct perf_diff {
+        struct perf_tool tool;
+        struct perf_session *session;
+};
+
 static int hists__add_entry(struct hists *self,
                             struct addr_location *al, u64 period)
 {
@@ -32,12 +37,14 @@ static int hists__add_entry(struct hists *self,
         return -ENOMEM;
 }
 
-static int diff__process_sample_event(struct perf_tool *tool __used,
+static int diff__process_sample_event(struct perf_tool *tool,
                                       union perf_event *event,
                                       struct perf_sample *sample,
                                       struct perf_evsel *evsel __used,
                                       struct machine *machine)
 {
+        struct perf_diff *_diff = container_of(tool, struct perf_diff, tool);
+        struct perf_session *session = _diff->session;
         struct addr_location al;
 
         if (perf_event__preprocess_sample(event, machine, &al, sample, NULL) < 0) {
@@ -49,24 +56,26 @@ static int diff__process_sample_event(struct perf_tool *tool __used,
         if (al.filtered || al.sym == NULL)
                 return 0;
 
-        if (hists__add_entry(&evsel->hists, &al, sample->period)) {
+        if (hists__add_entry(&session->hists, &al, sample->period)) {
                 pr_warning("problem incrementing symbol period, skipping event\n");
                 return -1;
         }
 
-        evsel->hists.stats.total_period += sample->period;
+        session->hists.stats.total_period += sample->period;
         return 0;
 }
 
-static struct perf_tool perf_diff = {
-        .sample = diff__process_sample_event,
-        .mmap   = perf_event__process_mmap,
-        .comm   = perf_event__process_comm,
-        .exit   = perf_event__process_task,
-        .fork   = perf_event__process_task,
-        .lost   = perf_event__process_lost,
-        .ordered_samples = true,
-        .ordering_requires_timestamps = true,
+static struct perf_diff diff = {
+        .tool = {
+                .sample = diff__process_sample_event,
+                .mmap   = perf_event__process_mmap,
+                .comm   = perf_event__process_comm,
+                .exit   = perf_event__process_task,
+                .fork   = perf_event__process_task,
+                .lost   = perf_event__process_lost,
+                .ordered_samples = true,
+                .ordering_requires_timestamps = true,
+        },
 };
 
 static void perf_session__insert_hist_entry_by_name(struct rb_root *root,
@@ -107,12 +116,6 @@ static void hists__resort_entries(struct hists *self)
         self->entries = tmp;
 }
 
-static void hists__set_positions(struct hists *self)
-{
-        hists__output_resort(self);
-        hists__resort_entries(self);
-}
-
 static struct hist_entry *hists__find_entry(struct hists *self,
                                             struct hist_entry *he)
 {
@@ -146,30 +149,37 @@ static void hists__match(struct hists *older, struct hists *newer)
 static int __cmd_diff(void)
 {
         int ret, i;
+#define older (session[0])
+#define newer (session[1])
         struct perf_session *session[2];
 
-        session[0] = perf_session__new(input_old, O_RDONLY, force, false, &perf_diff);
-        session[1] = perf_session__new(input_new, O_RDONLY, force, false, &perf_diff);
+        older = perf_session__new(input_old, O_RDONLY, force, false,
+                                  &diff.tool);
+        newer = perf_session__new(input_new, O_RDONLY, force, false,
+                                  &diff.tool);
         if (session[0] == NULL || session[1] == NULL)
                 return -ENOMEM;
 
         for (i = 0; i < 2; ++i) {
-                ret = perf_session__process_events(session[i], &perf_diff);
+                diff.session = session[i];
+                ret = perf_session__process_events(session[i], &diff.tool);
                 if (ret)
                         goto out_delete;
+                hists__output_resort(&session[i]->hists);
         }
 
-        hists__output_resort(&session[1]->hists);
         if (show_displacement)
-                hists__set_positions(&session[0]->hists);
+                hists__resort_entries(&older->hists);
 
-        hists__match(&session[0]->hists, &session[1]->hists);
-        hists__fprintf(&session[1]->hists, &session[0]->hists,
+        hists__match(&older->hists, &newer->hists);
+        hists__fprintf(&newer->hists, &older->hists,
                        show_displacement, true, 0, 0, stdout);
 out_delete:
         for (i = 0; i < 2; ++i)
                 perf_session__delete(session[i]);
         return ret;
+#undef older
+#undef newer
 }
 
 static const char * const diff_usage[] = {
diff --git a/tools/perf/builtin-kmem.c b/tools/perf/builtin-kmem.c
index fe1ad8f21961..39104c0beea3 100644
--- a/tools/perf/builtin-kmem.c
+++ b/tools/perf/builtin-kmem.c
@@ -108,7 +108,9 @@ static void setup_cpunode_map(void)
                                 continue;
                         cpunode_map[cpu] = mem;
                 }
+                closedir(dir2);
         }
+        closedir(dir1);
 }
 
 static void insert_alloc_stat(unsigned long call_site, unsigned long ptr,
@@ -645,6 +647,7 @@ static int setup_sorting(struct list_head *sort_list, const char *arg)
                         break;
                 if (sort_dimension__add(tok, sort_list) < 0) {
                         error("Unknown --sort key: '%s'", tok);
+                        free(str);
                         return -1;
                 }
         }
diff --git a/tools/perf/builtin-kvm.c b/tools/perf/builtin-kvm.c
index 032324a76b87..9fc6e0fa3dce 100644
--- a/tools/perf/builtin-kvm.c
+++ b/tools/perf/builtin-kvm.c
@@ -22,9 +22,6 @@
 static const char               *file_name;
 static char                     name_buffer[256];
 
-bool                            perf_host = 1;
-bool                            perf_guest;
-
 static const char * const kvm_usage[] = {
         "perf kvm [<options>] {top|record|report|diff|buildid-list}",
         NULL
@@ -107,7 +104,8 @@ static int __cmd_buildid_list(int argc, const char **argv)
 
 int cmd_kvm(int argc, const char **argv, const char *prefix __used)
 {
-        perf_host = perf_guest = 0;
+        perf_host  = 0;
+        perf_guest = 1;
 
         argc = parse_options(argc, argv, kvm_options, kvm_usage,
                         PARSE_OPT_STOP_AT_NON_OPTION);
diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c
index 2296c391d0f5..12c814838993 100644
--- a/tools/perf/builtin-lock.c
+++ b/tools/perf/builtin-lock.c
@@ -922,12 +922,12 @@ static const struct option info_options[] = {
         OPT_BOOLEAN('t', "threads", &info_threads,
                     "dump thread list in perf.data"),
         OPT_BOOLEAN('m', "map", &info_map,
-                    "map of lock instances (name:address table)"),
+                    "map of lock instances (address:name table)"),
         OPT_END()
 };
 
 static const char * const lock_usage[] = {
-        "perf lock [<options>] {record|trace|report}",
+        "perf lock [<options>] {record|report|script|info}",
         NULL
 };
 
diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c
index 59d43abfbfec..4935c09dd5b5 100644
--- a/tools/perf/builtin-probe.c
+++ b/tools/perf/builtin-probe.c
@@ -20,7 +20,6 @@
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  *
  */
-#define _GNU_SOURCE
 #include <sys/utsname.h>
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -31,7 +30,6 @@
 #include <stdlib.h>
 #include <string.h>
 
-#undef _GNU_SOURCE
 #include "perf.h"
 #include "builtin.h"
 #include "util/util.h"
@@ -60,7 +58,7 @@ static struct {
         struct perf_probe_event events[MAX_PROBES];
         struct strlist *dellist;
         struct line_range line_range;
-        const char *target_module;
+        const char *target;
         int max_probe_points;
         struct strfilter *filter;
 } params;
@@ -248,7 +246,7 @@ static const struct option options[] = {
                    "file", "vmlinux pathname"),
         OPT_STRING('s', "source", &symbol_conf.source_prefix,
                    "directory", "path to kernel source"),
-        OPT_STRING('m', "module", &params.target_module,
+        OPT_STRING('m', "module", &params.target,
                    "modname|path",
                    "target module name (for online) or path (for offline)"),
 #endif
@@ -335,7 +333,7 @@ int cmd_probe(int argc, const char **argv, const char *prefix __used)
                 if (!params.filter)
                         params.filter = strfilter__new(DEFAULT_FUNC_FILTER,
                                                        NULL);
-                ret = show_available_funcs(params.target_module,
+                ret = show_available_funcs(params.target,
                                            params.filter);
                 strfilter__delete(params.filter);
                 if (ret < 0)
@@ -356,7 +354,7 @@ int cmd_probe(int argc, const char **argv, const char *prefix __used)
                         usage_with_options(probe_usage, options);
                 }
 
-                ret = show_line_range(&params.line_range, params.target_module);
+                ret = show_line_range(&params.line_range, params.target);
                 if (ret < 0)
                         pr_err("  Error: Failed to show lines. (%d)\n", ret);
                 return ret;
@@ -373,7 +371,7 @@ int cmd_probe(int argc, const char **argv, const char *prefix __used)
 
                 ret = show_available_vars(params.events, params.nevents,
                                           params.max_probe_points,
-                                          params.target_module,
+                                          params.target,
                                           params.filter,
                                           params.show_ext_vars);
                 strfilter__delete(params.filter);
@@ -395,7 +393,7 @@ int cmd_probe(int argc, const char **argv, const char *prefix __used)
         if (params.nevents) {
                 ret = add_perf_probe_events(params.events, params.nevents,
                                             params.max_probe_points,
-                                            params.target_module,
+                                            params.target,
                                             params.force_add);
                 if (ret < 0) {
                         pr_err("  Error: Failed to add events. (%d)\n", ret);
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 0abfb18b911f..be4e1eee782e 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -44,6 +44,7 @@ struct perf_record {
         struct perf_evlist      *evlist;
         struct perf_session     *session;
         const char              *progname;
+        const char              *uid_str;
         int                     output;
         unsigned int            page_size;
         int                     realtime_prio;
@@ -204,8 +205,11 @@ static void perf_record__open(struct perf_record *rec)
 
                 if (opts->group && pos != first)
                         group_fd = first->fd;
+fallback_missing_features:
+                if (opts->exclude_guest_missing)
+                        attr->exclude_guest = attr->exclude_host = 0;
 retry_sample_id:
-                attr->sample_id_all = opts->sample_id_all_avail ? 1 : 0;
+                attr->sample_id_all = opts->sample_id_all_missing ? 0 : 1;
 try_again:
                 if (perf_evsel__open(pos, evlist->cpus, evlist->threads,
                                      opts->group, group_fd) < 0) {
@@ -217,15 +221,23 @@ try_again:
                         } else if (err ==  ENODEV && opts->cpu_list) {
                                 die("No such device - did you specify"
                                         " an out-of-range profile CPU?\n");
-                        } else if (err == EINVAL && opts->sample_id_all_avail) {
-                                /*
-                                 * Old kernel, no attr->sample_id_type_all field
-                                 */
-                                opts->sample_id_all_avail = false;
-                                if (!opts->sample_time && !opts->raw_samples && !time_needed)
-                                        attr->sample_type &= ~PERF_SAMPLE_TIME;
-
-                                goto retry_sample_id;
+                        } else if (err == EINVAL) {
+                                if (!opts->exclude_guest_missing &&
+                                    (attr->exclude_guest || attr->exclude_host)) {
+                                        pr_debug("Old kernel, cannot exclude "
+                                                 "guest or host samples.\n");
+                                        opts->exclude_guest_missing = true;
+                                        goto fallback_missing_features;
+                                } else if (!opts->sample_id_all_missing) {
+                                        /*
+                                         * Old kernel, no attr->sample_id_type_all field
+                                         */
+                                        opts->sample_id_all_missing = true;
+                                        if (!opts->sample_time && !opts->raw_samples && !time_needed)
+                                                attr->sample_type &= ~PERF_SAMPLE_TIME;
+
+                                        goto retry_sample_id;
+                                }
                         }
 
                         /*
@@ -385,7 +397,7 @@ static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
 {
         struct stat st;
         int flags;
-        int err, output;
+        int err, output, feat;
         unsigned long waking = 0;
         const bool forks = argc > 0;
         struct machine *machine;
@@ -452,8 +464,17 @@ static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
 
         rec->session = session;
 
-        if (!rec->no_buildid)
-                perf_header__set_feat(&session->header, HEADER_BUILD_ID);
+        for (feat = HEADER_FIRST_FEATURE; feat < HEADER_LAST_FEATURE; feat++)
+                perf_header__set_feat(&session->header, feat);
+
+        if (rec->no_buildid)
+                perf_header__clear_feat(&session->header, HEADER_BUILD_ID);
+
+        if (!have_tracepoints(&evsel_list->entries))
+                perf_header__clear_feat(&session->header, HEADER_TRACE_INFO);
+
+        if (!rec->opts.branch_stack)
+                perf_header__clear_feat(&session->header, HEADER_BRANCH_STACK);
 
         if (!rec->file_new) {
                 err = perf_session__read_header(session, output);
@@ -461,22 +482,6 @@ static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
                         goto out_delete_session;
         }
 
-        if (have_tracepoints(&evsel_list->entries))
-                perf_header__set_feat(&session->header, HEADER_TRACE_INFO);
-
-        perf_header__set_feat(&session->header, HEADER_HOSTNAME);
-        perf_header__set_feat(&session->header, HEADER_OSRELEASE);
-        perf_header__set_feat(&session->header, HEADER_ARCH);
-        perf_header__set_feat(&session->header, HEADER_CPUDESC);
-        perf_header__set_feat(&session->header, HEADER_NRCPUS);
-        perf_header__set_feat(&session->header, HEADER_EVENT_DESC);
-        perf_header__set_feat(&session->header, HEADER_CMDLINE);
-        perf_header__set_feat(&session->header, HEADER_VERSION);
-        perf_header__set_feat(&session->header, HEADER_CPU_TOPOLOGY);
-        perf_header__set_feat(&session->header, HEADER_TOTAL_MEM);
-        perf_header__set_feat(&session->header, HEADER_NUMA_TOPOLOGY);
-        perf_header__set_feat(&session->header, HEADER_CPUID);
-
         if (forks) {
                 err = perf_evlist__prepare_workload(evsel_list, opts, argv);
                 if (err < 0) {
@@ -503,9 +508,9 @@ static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
                         return err;
         }
 
-        if (!!rec->no_buildid
+        if (!rec->no_buildid
             && !perf_header__has_feat(&session->header, HEADER_BUILD_ID)) {
-                pr_err("Couldn't generating buildids. "
+                pr_err("Couldn't generate buildids. "
                        "Use --no-buildid to profile anyway.\n");
                 return -1;
         }
@@ -636,6 +641,90 @@ out_delete_session:
         return err;
 }
 
+#define BRANCH_OPT(n, m) \
+        { .name = n, .mode = (m) }
+
+#define BRANCH_END { .name = NULL }
+
+struct branch_mode {
+        const char *name;
+        int mode;
+};
+
+static const struct branch_mode branch_modes[] = {
+        BRANCH_OPT("u", PERF_SAMPLE_BRANCH_USER),
+        BRANCH_OPT("k", PERF_SAMPLE_BRANCH_KERNEL),
+        BRANCH_OPT("hv", PERF_SAMPLE_BRANCH_HV),
+        BRANCH_OPT("any", PERF_SAMPLE_BRANCH_ANY),
+        BRANCH_OPT("any_call", PERF_SAMPLE_BRANCH_ANY_CALL),
+        BRANCH_OPT("any_ret", PERF_SAMPLE_BRANCH_ANY_RETURN),
+        BRANCH_OPT("ind_call", PERF_SAMPLE_BRANCH_IND_CALL),
+        BRANCH_END
+};
+
+static int
+parse_branch_stack(const struct option *opt, const char *str, int unset)
+{
+#define ONLY_PLM \
+        (PERF_SAMPLE_BRANCH_USER        |\
+         PERF_SAMPLE_BRANCH_KERNEL      |\
+         PERF_SAMPLE_BRANCH_HV)
+
+        uint64_t *mode = (uint64_t *)opt->value;
+        const struct branch_mode *br;
+        char *s, *os = NULL, *p;
+        int ret = -1;
+
+        if (unset)
+                return 0;
+
+        /*
+         * cannot set it twice, -b + --branch-filter for instance
+         */
+        if (*mode)
+                return -1;
+
+        /* str may be NULL in case no arg is passed to -b */
+        if (str) {
+                /* because str is read-only */
+                s = os = strdup(str);
+                if (!s)
+                        return -1;
+
+                for (;;) {
+                        p = strchr(s, ',');
+                        if (p)
+                                *p = '\0';
+
+                        for (br = branch_modes; br->name; br++) {
+                                if (!strcasecmp(s, br->name))
+                                        break;
+                        }
+                        if (!br->name) {
+                                ui__warning("unknown branch filter %s,"
+                                            " check man page\n", s);
+                                goto error;
+                        }
+
+                        *mode |= br->mode;
+
+                        if (!p)
+                                break;
+
+                        s = p + 1;
+                }
+        }
+        ret = 0;
+
+        /* default to any branch */
+        if ((*mode & ~ONLY_PLM) == 0) {
+                *mode = PERF_SAMPLE_BRANCH_ANY;
+        }
+error:
+        free(os);
+        return ret;
+}
+
 static const char * const record_usage[] = {
         "perf record [<options>] [<command>]",
         "perf record [<options>] -- <command> [<options>]",
@@ -654,13 +743,10 @@ static const char * const record_usage[] = {
  */
 static struct perf_record record = {
         .opts = {
-                .target_pid          = -1,
-                .target_tid          = -1,
                 .mmap_pages          = UINT_MAX,
                 .user_freq           = UINT_MAX,
                 .user_interval       = ULLONG_MAX,
                 .freq                = 1000,
-                .sample_id_all_avail = true,
         },
         .write_mode = WRITE_FORCE,
         .file_new   = true,
@@ -679,9 +765,9 @@ const struct option record_options[] = {
                      parse_events_option),
         OPT_CALLBACK(0, "filter", &record.evlist, "filter",
                      "event filter", parse_filter),
-        OPT_INTEGER('p', "pid", &record.opts.target_pid,
+        OPT_STRING('p', "pid", &record.opts.target_pid, "pid",
                     "record events on existing process id"),
-        OPT_INTEGER('t', "tid", &record.opts.target_tid,
+        OPT_STRING('t', "tid", &record.opts.target_tid, "tid",
                     "record events on existing thread id"),
         OPT_INTEGER('r', "realtime", &record.realtime_prio,
                     "collect data with this RT SCHED_FIFO priority"),
@@ -727,6 +813,15 @@ const struct option record_options[] = {
         OPT_CALLBACK('G', "cgroup", &record.evlist, "name",
                      "monitor event in cgroup name only",
                      parse_cgroups),
+        OPT_STRING('u', "uid", &record.uid_str, "user", "user to profile"),
+
+        OPT_CALLBACK_NOOPT('b', "branch-any", &record.opts.branch_stack,
+                     "branch any", "sample any taken branches",
+                     parse_branch_stack),
+
+        OPT_CALLBACK('j', "branch-filter", &record.opts.branch_stack,
+                     "branch filter mask", "branch stack filter modes",
+                     parse_branch_stack),
         OPT_END()
 };
 
@@ -747,8 +842,8 @@ int cmd_record(int argc, const char **argv, const char *prefix __used)
 
         argc = parse_options(argc, argv, record_options, record_usage,
                             PARSE_OPT_STOP_AT_NON_OPTION);
-        if (!argc && rec->opts.target_pid == -1 && rec->opts.target_tid == -1 &&
-                !rec->opts.system_wide && !rec->opts.cpu_list)
+        if (!argc && !rec->opts.target_pid && !rec->opts.target_tid &&
+                !rec->opts.system_wide && !rec->opts.cpu_list && !rec->uid_str)
                 usage_with_options(record_usage, record_options);
 
         if (rec->force && rec->append_file) {
@@ -788,11 +883,17 @@ int cmd_record(int argc, const char **argv, const char *prefix __used)
                 goto out_symbol_exit;
         }
 
-        if (rec->opts.target_pid != -1)
+        rec->opts.uid = parse_target_uid(rec->uid_str, rec->opts.target_tid,
+                                         rec->opts.target_pid);
+        if (rec->uid_str != NULL && rec->opts.uid == UINT_MAX - 1)
+                goto out_free_fd;
+
+        if (rec->opts.target_pid)
                 rec->opts.target_tid = rec->opts.target_pid;
 
         if (perf_evlist__create_maps(evsel_list, rec->opts.target_pid,
-                                     rec->opts.target_tid, rec->opts.cpu_list) < 0)
+                                     rec->opts.target_tid, rec->opts.uid,
+                                     rec->opts.cpu_list) < 0)
                 usage_with_options(record_usage, record_options);
 
         list_for_each_entry(pos, &evsel_list->entries, node) {
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 25d34d483e49..2e317438980b 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -40,7 +40,7 @@ struct perf_report {
         struct perf_tool        tool;
         struct perf_session     *session;
         char const              *input_name;
-        bool                    force, use_tui, use_stdio;
+        bool                    force, use_tui, use_gtk, use_stdio;
         bool                    hide_unresolved;
         bool                    dont_use_callchains;
         bool                    show_full_info;
@@ -50,9 +50,86 @@ struct perf_report {
         const char              *pretty_printing_style;
         symbol_filter_t         annotate_init;
         const char              *cpu_list;
+        const char              *symbol_filter_str;
         DECLARE_BITMAP(cpu_bitmap, MAX_NR_CPUS);
 };
 
+static int perf_report__add_branch_hist_entry(struct perf_tool *tool,
+                                        struct addr_location *al,
+                                        struct perf_sample *sample,
+                                        struct perf_evsel *evsel,
+                                      struct machine *machine)
+{
+        struct perf_report *rep = container_of(tool, struct perf_report, tool);
+        struct symbol *parent = NULL;
+        int err = 0;
+        unsigned i;
+        struct hist_entry *he;
+        struct branch_info *bi, *bx;
+
+        if ((sort__has_parent || symbol_conf.use_callchain)
+            && sample->callchain) {
+                err = machine__resolve_callchain(machine, evsel, al->thread,
+                                                 sample->callchain, &parent);
+                if (err)
+                        return err;
+        }
+
+        bi = machine__resolve_bstack(machine, al->thread,
+                                     sample->branch_stack);
+        if (!bi)
+                return -ENOMEM;
+
+        for (i = 0; i < sample->branch_stack->nr; i++) {
+                if (rep->hide_unresolved && !(bi[i].from.sym && bi[i].to.sym))
+                        continue;
+                /*
+                 * The report shows the percentage of total branches captured
+                 * and not events sampled. Thus we use a pseudo period of 1.
+                 */
+                he = __hists__add_branch_entry(&evsel->hists, al, parent,
+                                &bi[i], 1);
+                if (he) {
+                        struct annotation *notes;
+                        err = -ENOMEM;
+                        bx = he->branch_info;
+                        if (bx->from.sym && use_browser > 0) {
+                                notes = symbol__annotation(bx->from.sym);
+                                if (!notes->src
+                                    && symbol__alloc_hist(bx->from.sym) < 0)
+                                        goto out;
+
+                                err = symbol__inc_addr_samples(bx->from.sym,
+                                                               bx->from.map,
+                                                               evsel->idx,
+                                                               bx->from.al_addr);
+                                if (err)
+                                        goto out;
+                        }
+
+                        if (bx->to.sym && use_browser > 0) {
+                                notes = symbol__annotation(bx->to.sym);
+                                if (!notes->src
+                                    && symbol__alloc_hist(bx->to.sym) < 0)
+                                        goto out;
+
+                                err = symbol__inc_addr_samples(bx->to.sym,
+                                                               bx->to.map,
+                                                               evsel->idx,
+                                                               bx->to.al_addr);
+                                if (err)
+                                        goto out;
+                        }
+                        evsel->hists.stats.total_period += 1;
+                        hists__inc_nr_events(&evsel->hists, PERF_RECORD_SAMPLE);
+                        err = 0;
+                } else
+                        return -ENOMEM;
+        }
+out:
+        return err;
+}
+
 static int perf_evsel__add_hist_entry(struct perf_evsel *evsel,
                                       struct addr_location *al,
                                       struct perf_sample *sample,
@@ -126,14 +203,21 @@ static int process_sample_event(struct perf_tool *tool,
         if (rep->cpu_list && !test_bit(sample->cpu, rep->cpu_bitmap))
                 return 0;
 
-        if (al.map != NULL)
-                al.map->dso->hit = 1;
+        if (sort__branch_mode == 1) {
+                if (perf_report__add_branch_hist_entry(tool, &al, sample,
+                                                       evsel, machine)) {
+                        pr_debug("problem adding lbr entry, skipping event\n");
+                        return -1;
+                }
+        } else {
+                if (al.map != NULL)
+                        al.map->dso->hit = 1;
 
-        if (perf_evsel__add_hist_entry(evsel, &al, sample, machine)) {
-                pr_debug("problem incrementing symbol period, skipping event\n");
-                return -1;
+                if (perf_evsel__add_hist_entry(evsel, &al, sample, machine)) {
+                        pr_debug("problem incrementing symbol period, skipping event\n");
+                        return -1;
+                }
         }
-
         return 0;
 }
 
@@ -188,6 +272,15 @@ static int perf_report__setup_sample_type(struct perf_report *rep)
                         }
         }
 
+        if (sort__branch_mode == 1) {
+                if (!(self->sample_type & PERF_SAMPLE_BRANCH_STACK)) {
+                        fprintf(stderr, "selected -b but no branch data."
+                                        " Did you call perf record without"
+                                        " -b?\n");
+                        return -1;
+                }
+        }
+
         return 0;
 }
 
@@ -246,7 +339,7 @@ static int __cmd_report(struct perf_report *rep)
 {
         int ret = -EINVAL;
         u64 nr_samples;
-        struct perf_session *session;
+        struct perf_session *session = rep->session;
         struct perf_evsel *pos;
         struct map *kernel_map;
         struct kmap *kernel_kmap;
@@ -254,13 +347,6 @@ static int __cmd_report(struct perf_report *rep)
 
         signal(SIGINT, sig_handler);
 
-        session = perf_session__new(rep->input_name, O_RDONLY,
-                                    rep->force, false, &rep->tool);
-        if (session == NULL)
-                return -ENOMEM;
-
-        rep->session = session;
-
         if (rep->cpu_list) {
                 ret = perf_session__cpu_bitmap(session, rep->cpu_list,
                                                rep->cpu_bitmap);
@@ -315,6 +401,9 @@ static int __cmd_report(struct perf_report *rep)
         list_for_each_entry(pos, &session->evlist->entries, node) {
                 struct hists *hists = &pos->hists;
 
+                if (pos->idx == 0)
+                        hists->symbol_filter_str = rep->symbol_filter_str;
+
                 hists__collapse_resort(hists);
                 hists__output_resort(hists);
                 nr_samples += hists->stats.nr_events[PERF_RECORD_SAMPLE];
@@ -326,8 +415,13 @@ static int __cmd_report(struct perf_report *rep)
         }
 
         if (use_browser > 0) {
-                perf_evlist__tui_browse_hists(session->evlist, help,
-                                              NULL, NULL, 0);
+                if (use_browser == 1) {
+                        perf_evlist__tui_browse_hists(session->evlist, help,
+                                                      NULL, NULL, 0);
+                } else if (use_browser == 2) {
+                        perf_evlist__gtk_browse_hists(session->evlist, help,
+                                                      NULL, NULL, 0);
+                }
         } else
                 perf_evlist__tty_browse_hists(session->evlist, rep, help);
 
@@ -427,9 +521,19 @@ setup:
         return 0;
 }
 
+static int
+parse_branch_mode(const struct option *opt __used, const char *str __used, int unset)
+{
+        sort__branch_mode = !unset;
+        return 0;
+}
+
 int cmd_report(int argc, const char **argv, const char *prefix __used)
 {
+        struct perf_session *session;
         struct stat st;
+        bool has_br_stack = false;
+        int ret = -1;
         char callchain_default_opt[] = "fractal,0.5,callee";
         const char * const report_usage[] = {
                 "perf report [<options>]",
@@ -474,10 +578,12 @@ int cmd_report(int argc, const char **argv, const char *prefix __used)
         OPT_STRING(0, "pretty", &report.pretty_printing_style, "key",
                    "pretty printing style key: normal raw"),
         OPT_BOOLEAN(0, "tui", &report.use_tui, "Use the TUI interface"),
+        OPT_BOOLEAN(0, "gtk", &report.use_gtk, "Use the GTK2 interface"),
         OPT_BOOLEAN(0, "stdio", &report.use_stdio,
                     "Use the stdio interface"),
         OPT_STRING('s', "sort", &sort_order, "key[,key2...]",
-                   "sort by key(s): pid, comm, dso, symbol, parent"),
+                   "sort by key(s): pid, comm, dso, symbol, parent, dso_to,"
+                   " dso_from, symbol_to, symbol_from, mispredict"),
         OPT_BOOLEAN(0, "showcpuutilization", &symbol_conf.show_cpu_utilization,
                     "Show sample percentage for different cpu modes"),
         OPT_STRING('p', "parent", &parent_pattern, "regex",
@@ -495,6 +601,8 @@ int cmd_report(int argc, const char **argv, const char *prefix __used)
                    "only consider symbols in these comms"),
         OPT_STRING('S', "symbols", &symbol_conf.sym_list_str, "symbol[,symbol...]",
                    "only consider these symbols"),
+        OPT_STRING(0, "symbol-filter", &report.symbol_filter_str, "filter",
+                   "only show symbols that (partially) match with this filter"),
         OPT_STRING('w', "column-widths", &symbol_conf.col_width_list_str,
                    "width[,width...]",
                    "don't try to adjust column width, use these fixed values"),
@@ -517,6 +625,8 @@ int cmd_report(int argc, const char **argv, const char *prefix __used)
                    "Specify disassembler style (e.g. -M intel for intel syntax)"),
         OPT_BOOLEAN(0, "show-total-period", &symbol_conf.show_total_period,
                     "Show a column with the sum of periods"),
+        OPT_CALLBACK_NOOPT('b', "branch-stack", &sort__branch_mode, "",
+                    "use branch records for histogram filling", parse_branch_mode),
         OPT_END()
         };
 
@@ -526,6 +636,8 @@ int cmd_report(int argc, const char **argv, const char *prefix __used)
                 use_browser = 0;
         else if (report.use_tui)
                 use_browser = 1;
+        else if (report.use_gtk)
+                use_browser = 2;
 
         if (report.inverted_callchain)
                 callchain_param.order = ORDER_CALLER;
@@ -536,11 +648,39 @@ int cmd_report(int argc, const char **argv, const char *prefix __used)
                 else
                         report.input_name = "perf.data";
         }
+        session = perf_session__new(report.input_name, O_RDONLY,
+                                    report.force, false, &report.tool);
+        if (session == NULL)
+                return -ENOMEM;
 
-        if (strcmp(report.input_name, "-") != 0)
-                setup_browser(true);
-        else
+        report.session = session;
+
+        has_br_stack = perf_header__has_feat(&session->header,
+                                             HEADER_BRANCH_STACK);
+
+        if (sort__branch_mode == -1 && has_br_stack)
+                sort__branch_mode = 1;
+
+        /* sort__branch_mode could be 0 if --no-branch-stack */
+        if (sort__branch_mode == 1) {
+                /*
+                 * if no sort_order is provided, then specify
+                 * branch-mode specific order
+                 */
+                if (sort_order == default_sort_order)
+                        sort_order = "comm,dso_from,symbol_from,"
+                                     "dso_to,symbol_to";
+
+        }
+
+        if (strcmp(report.input_name, "-") != 0) {
+                if (report.use_gtk)
+                        perf_gtk_setup_browser(argc, argv, true);
+                else
+                        setup_browser(true);
+        } else {
                 use_browser = 0;
+        }
 
         /*
          * Only in the newt browser we are doing integrated annotation,
@@ -568,13 +708,13 @@ int cmd_report(int argc, const char **argv, const char *prefix __used)
         }
 
         if (symbol__init() < 0)
-                return -1;
+                goto error;
 
         setup_sorting(report_usage, options);
 
         if (parent_pattern != default_parent_pattern) {
                 if (sort_dimension__add("parent") < 0)
-                        return -1;
+                        goto error;
 
                 /*
                  * Only show the parent fields if we explicitly
@@ -586,15 +726,31 @@ int cmd_report(int argc, const char **argv, const char *prefix __used)
         } else
                 symbol_conf.exclude_other = false;
 
-        /*
-         * Any (unrecognized) arguments left?
-         */
-        if (argc)
-                usage_with_options(report_usage, options);
+        if (argc) {
+                /*
+                 * Special case: if there's an argument left then assume that
+                 * it's a symbol filter:
+                 */
+                if (argc > 1)
+                        usage_with_options(report_usage, options);
+
+                report.symbol_filter_str = argv[0];
+        }
 
-        sort_entry__setup_elide(&sort_dso, symbol_conf.dso_list, "dso", stdout);
         sort_entry__setup_elide(&sort_comm, symbol_conf.comm_list, "comm", stdout);
-        sort_entry__setup_elide(&sort_sym, symbol_conf.sym_list, "symbol", stdout);
 
-        return __cmd_report(&report);
+        if (sort__branch_mode == 1) {
+                sort_entry__setup_elide(&sort_dso_from, symbol_conf.dso_from_list, "dso_from", stdout);
+                sort_entry__setup_elide(&sort_dso_to, symbol_conf.dso_to_list, "dso_to", stdout);
+                sort_entry__setup_elide(&sort_sym_from, symbol_conf.sym_from_list, "sym_from", stdout);
+                sort_entry__setup_elide(&sort_sym_to, symbol_conf.sym_to_list, "sym_to", stdout);
+        } else {
+                sort_entry__setup_elide(&sort_dso, symbol_conf.dso_list, "dso", stdout);
+                sort_entry__setup_elide(&sort_sym, symbol_conf.sym_list, "symbol", stdout);
+        }
+
+        ret = __cmd_report(&report);
+error:
+        perf_session__delete(session);
+        return ret;
 }
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index fb8b5f83b4a0..1cad3af4bf4c 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -17,6 +17,7 @@
 #include "util/debug.h"
 
 #include <sys/prctl.h>
+#include <sys/resource.h>
 
 #include <semaphore.h>
 #include <pthread.h>
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index fd1909afcfd6..d4ce733b9eba 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -40,6 +40,7 @@ enum perf_output_field {
         PERF_OUTPUT_SYM             = 1U << 8,
         PERF_OUTPUT_DSO             = 1U << 9,
         PERF_OUTPUT_ADDR            = 1U << 10,
+        PERF_OUTPUT_SYMOFFSET       = 1U << 11,
 };
 
 struct output_option {
@@ -57,6 +58,7 @@ struct output_option {
         {.str = "sym",   .field = PERF_OUTPUT_SYM},
         {.str = "dso",   .field = PERF_OUTPUT_DSO},
         {.str = "addr",  .field = PERF_OUTPUT_ADDR},
+        {.str = "symoff", .field = PERF_OUTPUT_SYMOFFSET},
 };
 
 /* default set to maintain compatibility with current format */
@@ -193,6 +195,11 @@ static int perf_evsel__check_attr(struct perf_evsel *evsel,
                        "to symbols.\n");
                 return -EINVAL;
         }
+        if (PRINT_FIELD(SYMOFFSET) && !PRINT_FIELD(SYM)) {
+                pr_err("Display of offsets requested but symbol is not"
+                       "selected.\n");
+                return -EINVAL;
+        }
         if (PRINT_FIELD(DSO) && !PRINT_FIELD(IP) && !PRINT_FIELD(ADDR)) {
                 pr_err("Display of DSO requested but neither sample IP nor "
                            "sample address\nis selected. Hence, no addresses to convert "
@@ -300,10 +307,17 @@ static void print_sample_start(struct perf_sample *sample,
                 } else
                         evname = __event_name(attr->type, attr->config);
 
-                printf("%s: ", evname ? evname : "(unknown)");
+                printf("%s: ", evname ? evname : "[unknown]");
         }
 }
 
+static bool is_bts_event(struct perf_event_attr *attr)
+{
+        return ((attr->type == PERF_TYPE_HARDWARE) &&
+                (attr->config & PERF_COUNT_HW_BRANCH_INSTRUCTIONS) &&
+                (attr->sample_period == 1));
+}
+
 static bool sample_addr_correlates_sym(struct perf_event_attr *attr)
 {
         if ((attr->type == PERF_TYPE_SOFTWARE) &&
@@ -312,6 +326,9 @@ static bool sample_addr_correlates_sym(struct perf_event_attr *attr)
              (attr->config == PERF_COUNT_SW_PAGE_FAULTS_MAJ)))
                 return true;
 
+        if (is_bts_event(attr))
+                return true;
+
         return false;
 }
 
@@ -323,7 +340,6 @@ static void print_sample_addr(union perf_event *event,
 {
         struct addr_location al;
         u8 cpumode = event->header.misc & PERF_RECORD_MISC_CPUMODE_MASK;
-        const char *symname, *dsoname;
 
         printf("%16" PRIx64, sample->addr);
 
@@ -343,22 +359,46 @@ static void print_sample_addr(union perf_event *event,
                 al.sym = map__find_symbol(al.map, al.addr, NULL);
 
         if (PRINT_FIELD(SYM)) {
-                if (al.sym && al.sym->name)
-                        symname = al.sym->name;
+                printf(" ");
+                if (PRINT_FIELD(SYMOFFSET))
+                        symbol__fprintf_symname_offs(al.sym, &al, stdout);
                 else
-                        symname = "";
-
-                printf(" %16s", symname);
+                        symbol__fprintf_symname(al.sym, stdout);
         }
 
         if (PRINT_FIELD(DSO)) {
-                if (al.map && al.map->dso && al.map->dso->name)
-                        dsoname = al.map->dso->name;
-                else
-                        dsoname = "";
+                printf(" (");
+                map__fprintf_dsoname(al.map, stdout);
+                printf(")");
+        }
+}
 
-                printf(" (%s)", dsoname);
+static void print_sample_bts(union perf_event *event,
+                             struct perf_sample *sample,
+                             struct perf_evsel *evsel,
+                             struct machine *machine,
+                             struct thread *thread)
+{
+        struct perf_event_attr *attr = &evsel->attr;
+
+        /* print branch_from information */
+        if (PRINT_FIELD(IP)) {
+                if (!symbol_conf.use_callchain)
+                        printf(" ");
+                else
+                        printf("\n");
+                perf_event__print_ip(event, sample, machine, evsel,
+                                     PRINT_FIELD(SYM), PRINT_FIELD(DSO),
+                                     PRINT_FIELD(SYMOFFSET));
         }
+
+        printf(" => ");
+
+        /* print branch_to information */
+        if (PRINT_FIELD(ADDR))
+                print_sample_addr(event, sample, machine, thread, attr);
+
+        printf("\n");
 }
 
 static void process_event(union perf_event *event __unused,
@@ -374,6 +414,11 @@ static void process_event(union perf_event *event __unused,
 
         print_sample_start(sample, thread, attr);
 
+        if (is_bts_event(attr)) {
+                print_sample_bts(event, sample, evsel, machine, thread);
+                return;
+        }
+
         if (PRINT_FIELD(TRACE))
                 print_trace_event(sample->cpu, sample->raw_data,
                                   sample->raw_size);
@@ -387,7 +432,8 @@ static void process_event(union perf_event *event __unused,
                 else
                         printf("\n");
                 perf_event__print_ip(event, sample, machine, evsel,
-                                     PRINT_FIELD(SYM), PRINT_FIELD(DSO));
+                                     PRINT_FIELD(SYM), PRINT_FIELD(DSO),
+                                     PRINT_FIELD(SYMOFFSET));
         }
 
         printf("\n");
@@ -1018,13 +1064,17 @@ static char *get_script_path(const char *script_root, const char *suffix)
                         __script_root = get_script_root(&script_dirent, suffix);
                         if (__script_root && !strcmp(script_root, __script_root)) {
                                 free(__script_root);
+                                closedir(lang_dir);
+                                closedir(scripts_dir);
                                 snprintf(script_path, MAXPATHLEN, "%s/%s",
                                          lang_path, script_dirent.d_name);
                                 return strdup(script_path);
                         }
                         free(__script_root);
                 }
+                closedir(lang_dir);
         }
+        closedir(scripts_dir);
 
         return NULL;
 }
@@ -1093,7 +1143,10 @@ static const struct option options[] = {
         OPT_STRING(0, "symfs", &symbol_conf.symfs, "directory",
                     "Look for files with symbols relative to this directory"),
         OPT_CALLBACK('f', "fields", NULL, "str",
-                     "comma separated output fields prepend with 'type:'. Valid types: hw,sw,trace,raw. Fields: comm,tid,pid,time,cpu,event,trace,ip,sym,dso,addr",
+                     "comma separated output fields prepend with 'type:'. "
+                     "Valid types: hw,sw,trace,raw. "
+                     "Fields: comm,tid,pid,time,cpu,event,trace,ip,sym,dso,"
+                     "addr,symoff",
                      parse_output_fields),
         OPT_BOOLEAN('a', "all-cpus", &system_wide,
                      "system-wide collection from all CPUs"),
@@ -1102,6 +1155,9 @@ static const struct option options[] = {
                    "only display events for these comms"),
         OPT_BOOLEAN('I', "show-info", &show_full_info,
                     "display extended information from perf.data file"),
+        OPT_BOOLEAN('\0', "show-kernel-path", &symbol_conf.show_kernel_path,
+                    "Show the path of [kernel.kallsyms]"),
+
         OPT_END()
 };
 
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index f5d2a63eba66..c941bb640f49 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -182,8 +182,8 @@ static int			run_count			=  1;
 static bool                     no_inherit                      = false;
 static bool                     scale                           =  true;
 static bool                     no_aggr                         = false;
-static pid_t                    target_pid                      = -1;
-static pid_t                    target_tid                      = -1;
+static const char               *target_pid;
+static const char               *target_tid;
 static pid_t                    child_pid                       = -1;
 static bool                     null_run                        =  false;
 static int                      detailed_run                    =  0;
@@ -296,7 +296,7 @@ static int create_perf_stat_counter(struct perf_evsel *evsel,
         if (system_wide)
                 return perf_evsel__open_per_cpu(evsel, evsel_list->cpus,
                                                 group, group_fd);
-        if (target_pid == -1 && target_tid == -1) {
+        if (!target_pid && !target_tid && (!group || evsel == first)) {
                 attr->disabled = 1;
                 attr->enable_on_exec = 1;
         }
@@ -446,7 +446,7 @@ static int run_perf_stat(int argc __used, const char **argv)
                         exit(-1);
                 }
 
-                if (target_tid == -1 && target_pid == -1 && !system_wide)
+                if (!target_tid && !target_pid && !system_wide)
                         evsel_list->threads->map[0] = child_pid;
 
                 /*
@@ -576,6 +576,8 @@ static void nsec_printout(int cpu, struct perf_evsel *evsel, double avg)
         if (perf_evsel__match(evsel, SOFTWARE, SW_TASK_CLOCK))
                 fprintf(output, " # %8.3f CPUs utilized          ",
                         avg / avg_stats(&walltime_nsecs_stats));
+        else
+                fprintf(output, "                                   ");
 }
 
 /* used for get_ratio_color() */
@@ -844,12 +846,18 @@ static void abs_printout(int cpu, struct perf_evsel *evsel, double avg)
 
                 fprintf(output, " # %8.3f GHz                    ", ratio);
         } else if (runtime_nsecs_stats[cpu].n != 0) {
+                char unit = 'M';
+
                 total = avg_stats(&runtime_nsecs_stats[cpu]);
 
                 if (total)
                         ratio = 1000.0 * avg / total;
+                if (ratio < 0.001) {
+                        ratio *= 1000;
+                        unit = 'K';
+                }
 
-                fprintf(output, " # %8.3f M/sec                  ", ratio);
+                fprintf(output, " # %8.3f %c/sec                  ", ratio, unit);
         } else {
                 fprintf(output, "                                   ");
         }
@@ -960,14 +968,14 @@ static void print_stat(int argc, const char **argv)
         if (!csv_output) {
                 fprintf(output, "\n");
                 fprintf(output, " Performance counter stats for ");
-                if(target_pid == -1 && target_tid == -1) {
+                if (!target_pid && !target_tid) {
                         fprintf(output, "\'%s", argv[0]);
                         for (i = 1; i < argc; i++)
                                 fprintf(output, " %s", argv[i]);
-                } else if (target_pid != -1)
-                        fprintf(output, "process id \'%d", target_pid);
+                } else if (target_pid)
+                        fprintf(output, "process id \'%s", target_pid);
                 else
-                        fprintf(output, "thread id \'%d", target_tid);
+                        fprintf(output, "thread id \'%s", target_tid);
 
                 fprintf(output, "\'");
                 if (run_count > 1)
@@ -1041,10 +1049,10 @@ static const struct option options[] = {
                      "event filter", parse_filter),
         OPT_BOOLEAN('i', "no-inherit", &no_inherit,
                     "child tasks do not inherit counters"),
-        OPT_INTEGER('p', "pid", &target_pid,
-                    "stat events on existing process id"),
-        OPT_INTEGER('t', "tid", &target_tid,
-                    "stat events on existing thread id"),
+        OPT_STRING('p', "pid", &target_pid, "pid",
+                   "stat events on existing process id"),
+        OPT_STRING('t', "tid", &target_tid, "tid",
+                   "stat events on existing thread id"),
         OPT_BOOLEAN('a', "all-cpus", &system_wide,
                     "system-wide collection from all CPUs"),
         OPT_BOOLEAN('g', "group", &group,
@@ -1182,7 +1190,7 @@ int cmd_stat(int argc, const char **argv, const char *prefix __used)
         } else if (big_num_opt == 0) /* User passed --no-big-num */
                 big_num = false;
 
-        if (!argc && target_pid == -1 && target_tid == -1)
+        if (!argc && !target_pid && !target_tid)
                 usage_with_options(stat_usage, options);
         if (run_count <= 0)
                 usage_with_options(stat_usage, options);
@@ -1198,10 +1206,11 @@ int cmd_stat(int argc, const char **argv, const char *prefix __used)
         if (add_default_attributes())
                 goto out;
 
-        if (target_pid != -1)
+        if (target_pid)
                 target_tid = target_pid;
 
-        evsel_list->threads = thread_map__new(target_pid, target_tid);
+        evsel_list->threads = thread_map__new_str(target_pid,
+                                                  target_tid, UINT_MAX);
         if (evsel_list->threads == NULL) {
                 pr_err("Problems finding threads of monitor\n");
                 usage_with_options(stat_usage, options);
diff --git a/tools/perf/builtin-test.c b/tools/perf/builtin-test.c
index 2b9a7f497a20..1c5b9801ac61 100644
--- a/tools/perf/builtin-test.c
+++ b/tools/perf/builtin-test.c
@@ -13,8 +13,11 @@
 #include "util/parse-events.h"
 #include "util/symbol.h"
 #include "util/thread_map.h"
+#include "util/pmu.h"
 #include "../../include/linux/hw_breakpoint.h"
 
+#include <sys/mman.h>
+
 static int vmlinux_matches_kallsyms_filter(struct map *map __used, struct symbol *sym)
 {
         bool *visited = symbol__priv(sym);
@@ -276,7 +279,7 @@ static int test__open_syscall_event(void)
                 return -1;
         }
 
-        threads = thread_map__new(-1, getpid());
+        threads = thread_map__new(-1, getpid(), UINT_MAX);
         if (threads == NULL) {
                 pr_debug("thread_map__new\n");
                 return -1;
@@ -342,7 +345,7 @@ static int test__open_syscall_event_on_all_cpus(void)
                 return -1;
         }
 
-        threads = thread_map__new(-1, getpid());
+        threads = thread_map__new(-1, getpid(), UINT_MAX);
         if (threads == NULL) {
                 pr_debug("thread_map__new\n");
                 return -1;
@@ -490,7 +493,7 @@ static int test__basic_mmap(void)
                 expected_nr_events[i] = random() % 257;
         }
 
-        threads = thread_map__new(-1, getpid());
+        threads = thread_map__new(-1, getpid(), UINT_MAX);
         if (threads == NULL) {
                 pr_debug("thread_map__new\n");
                 return -1;
@@ -648,7 +651,7 @@ static int test__checkevent_raw(struct perf_evlist *evlist)
 
         TEST_ASSERT_VAL("wrong number of entries", 1 == evlist->nr_entries);
         TEST_ASSERT_VAL("wrong type", PERF_TYPE_RAW == evsel->attr.type);
-        TEST_ASSERT_VAL("wrong config", 1 == evsel->attr.config);
+        TEST_ASSERT_VAL("wrong config", 0x1a == evsel->attr.config);
         return 0;
 }
 
@@ -675,6 +678,24 @@ static int test__checkevent_symbolic_name(struct perf_evlist *evlist)
         return 0;
 }
 
+static int test__checkevent_symbolic_name_config(struct perf_evlist *evlist)
+{
+        struct perf_evsel *evsel = list_entry(evlist->entries.next,
+                                              struct perf_evsel, node);
+
+        TEST_ASSERT_VAL("wrong number of entries", 1 == evlist->nr_entries);
+        TEST_ASSERT_VAL("wrong type", PERF_TYPE_HARDWARE == evsel->attr.type);
+        TEST_ASSERT_VAL("wrong config",
+                        PERF_COUNT_HW_CPU_CYCLES == evsel->attr.config);
+        TEST_ASSERT_VAL("wrong period",
+                        100000 == evsel->attr.sample_period);
+        TEST_ASSERT_VAL("wrong config1",
+                        0 == evsel->attr.config1);
+        TEST_ASSERT_VAL("wrong config2",
+                        1 == evsel->attr.config2);
+        return 0;
+}
+
 static int test__checkevent_symbolic_alias(struct perf_evlist *evlist)
 {
         struct perf_evsel *evsel = list_entry(evlist->entries.next,
@@ -856,6 +877,115 @@ static int test__checkevent_genhw_modifier(struct perf_evlist *evlist)
         return test__checkevent_genhw(evlist);
 }
 
+static int test__checkevent_breakpoint_modifier(struct perf_evlist *evlist)
+{
+        struct perf_evsel *evsel = list_entry(evlist->entries.next,
+                                              struct perf_evsel, node);
+
+        TEST_ASSERT_VAL("wrong exclude_user", !evsel->attr.exclude_user);
+        TEST_ASSERT_VAL("wrong exclude_kernel", evsel->attr.exclude_kernel);
+        TEST_ASSERT_VAL("wrong exclude_hv", evsel->attr.exclude_hv);
+        TEST_ASSERT_VAL("wrong precise_ip", !evsel->attr.precise_ip);
+
+        return test__checkevent_breakpoint(evlist);
+}
+
+static int test__checkevent_breakpoint_x_modifier(struct perf_evlist *evlist)
+{
+        struct perf_evsel *evsel = list_entry(evlist->entries.next,
+                                              struct perf_evsel, node);
+
+        TEST_ASSERT_VAL("wrong exclude_user", evsel->attr.exclude_user);
+        TEST_ASSERT_VAL("wrong exclude_kernel", !evsel->attr.exclude_kernel);
+        TEST_ASSERT_VAL("wrong exclude_hv", evsel->attr.exclude_hv);
+        TEST_ASSERT_VAL("wrong precise_ip", !evsel->attr.precise_ip);
+
+        return test__checkevent_breakpoint_x(evlist);
+}
+
+static int test__checkevent_breakpoint_r_modifier(struct perf_evlist *evlist)
+{
+        struct perf_evsel *evsel = list_entry(evlist->entries.next,
+                                              struct perf_evsel, node);
+
+        TEST_ASSERT_VAL("wrong exclude_user", evsel->attr.exclude_user);
+        TEST_ASSERT_VAL("wrong exclude_kernel", evsel->attr.exclude_kernel);
+        TEST_ASSERT_VAL("wrong exclude_hv", !evsel->attr.exclude_hv);
+        TEST_ASSERT_VAL("wrong precise_ip", evsel->attr.precise_ip);
+
+        return test__checkevent_breakpoint_r(evlist);
+}
+
+static int test__checkevent_breakpoint_w_modifier(struct perf_evlist *evlist)
+{
+        struct perf_evsel *evsel = list_entry(evlist->entries.next,
+                                              struct perf_evsel, node);
+
+        TEST_ASSERT_VAL("wrong exclude_user", !evsel->attr.exclude_user);
+        TEST_ASSERT_VAL("wrong exclude_kernel", evsel->attr.exclude_kernel);
+        TEST_ASSERT_VAL("wrong exclude_hv", evsel->attr.exclude_hv);
+        TEST_ASSERT_VAL("wrong precise_ip", evsel->attr.precise_ip);
+
+        return test__checkevent_breakpoint_w(evlist);
+}
+
+static int test__checkevent_pmu(struct perf_evlist *evlist)
+{
+
+        struct perf_evsel *evsel = list_entry(evlist->entries.next,
+                                              struct perf_evsel, node);
+
+        TEST_ASSERT_VAL("wrong number of entries", 1 == evlist->nr_entries);
+        TEST_ASSERT_VAL("wrong type", PERF_TYPE_RAW == evsel->attr.type);
+        TEST_ASSERT_VAL("wrong config",    10 == evsel->attr.config);
+        TEST_ASSERT_VAL("wrong config1",    1 == evsel->attr.config1);
+        TEST_ASSERT_VAL("wrong config2",    3 == evsel->attr.config2);
+        TEST_ASSERT_VAL("wrong period",  1000 == evsel->attr.sample_period);
+
+        return 0;
+}
+
+static int test__checkevent_list(struct perf_evlist *evlist)
+{
+        struct perf_evsel *evsel;
+
+        TEST_ASSERT_VAL("wrong number of entries", 3 == evlist->nr_entries);
+
+        /* r1 */
+        evsel = list_entry(evlist->entries.next, struct perf_evsel, node);
+        TEST_ASSERT_VAL("wrong type", PERF_TYPE_RAW == evsel->attr.type);
+        TEST_ASSERT_VAL("wrong config", 1 == evsel->attr.config);
+        TEST_ASSERT_VAL("wrong config1", 0 == evsel->attr.config1);
+        TEST_ASSERT_VAL("wrong config2", 0 == evsel->attr.config2);
+        TEST_ASSERT_VAL("wrong exclude_user", !evsel->attr.exclude_user);
+        TEST_ASSERT_VAL("wrong exclude_kernel", !evsel->attr.exclude_kernel);
+        TEST_ASSERT_VAL("wrong exclude_hv", !evsel->attr.exclude_hv);
+        TEST_ASSERT_VAL("wrong precise_ip", !evsel->attr.precise_ip);
+
+        /* syscalls:sys_enter_open:k */
+        evsel = list_entry(evsel->node.next, struct perf_evsel, node);
+        TEST_ASSERT_VAL("wrong type", PERF_TYPE_TRACEPOINT == evsel->attr.type);
+        TEST_ASSERT_VAL("wrong sample_type",
+                (PERF_SAMPLE_RAW | PERF_SAMPLE_TIME | PERF_SAMPLE_CPU) ==
+                evsel->attr.sample_type);
+        TEST_ASSERT_VAL("wrong sample_period", 1 == evsel->attr.sample_period);
+        TEST_ASSERT_VAL("wrong exclude_user", evsel->attr.exclude_user);
+        TEST_ASSERT_VAL("wrong exclude_kernel", !evsel->attr.exclude_kernel);
+        TEST_ASSERT_VAL("wrong exclude_hv", evsel->attr.exclude_hv);
+        TEST_ASSERT_VAL("wrong precise_ip", !evsel->attr.precise_ip);
+
+        /* 1:1:hp */
+        evsel = list_entry(evsel->node.next, struct perf_evsel, node);
+        TEST_ASSERT_VAL("wrong type", 1 == evsel->attr.type);
+        TEST_ASSERT_VAL("wrong config", 1 == evsel->attr.config);
+        TEST_ASSERT_VAL("wrong exclude_user", evsel->attr.exclude_user);
+        TEST_ASSERT_VAL("wrong exclude_kernel", evsel->attr.exclude_kernel);
+        TEST_ASSERT_VAL("wrong exclude_hv", !evsel->attr.exclude_hv);
+        TEST_ASSERT_VAL("wrong precise_ip", evsel->attr.precise_ip);
+
+        return 0;
+}
+
 static struct test__event_st {
         const char *name;
         __u32 type;
@@ -870,7 +1000,7 @@ static struct test__event_st {
                 .check = test__checkevent_tracepoint_multi,
         },
         {
-                .name  = "r1",
+                .name  = "r1a",
                 .check = test__checkevent_raw,
         },
         {
@@ -882,6 +1012,10 @@ static struct test__event_st {
                 .check = test__checkevent_symbolic_name,
         },
         {
+                .name  = "cycles/period=100000,config2/",
+                .check = test__checkevent_symbolic_name_config,
+        },
+        {
                 .name  = "faults",
                 .check = test__checkevent_symbolic_alias,
         },
@@ -914,7 +1048,7 @@ static struct test__event_st {
                 .check = test__checkevent_tracepoint_multi_modifier,
         },
         {
-                .name  = "r1:kp",
+                .name  = "r1a:kp",
                 .check = test__checkevent_raw_modifier,
         },
         {
@@ -933,6 +1067,30 @@ static struct test__event_st {
                 .name  = "L1-dcache-load-miss:kp",
                 .check = test__checkevent_genhw_modifier,
         },
+        {
+                .name  = "mem:0:u",
+                .check = test__checkevent_breakpoint_modifier,
+        },
+        {
+                .name  = "mem:0:x:k",
+                .check = test__checkevent_breakpoint_x_modifier,
+        },
+        {
+                .name  = "mem:0:r:hp",
+                .check = test__checkevent_breakpoint_r_modifier,
+        },
+        {
+                .name  = "mem:0:w:up",
+                .check = test__checkevent_breakpoint_w_modifier,
+        },
+        {
+                .name  = "cpu/config=10,config1,config2=3,period=1000/u",
+                .check = test__checkevent_pmu,
+        },
+        {
+                .name  = "r1,syscalls:sys_enter_open:k,1:1:hp",
+                .check = test__checkevent_list,
+        },
 };
 
 #define TEST__EVENTS_CNT (sizeof(test__events) / sizeof(struct test__event_st))
@@ -958,10 +1116,9 @@ static int test__parse_events(void)
                 }
 
                 ret = e->check(evlist);
+                perf_evlist__delete(evlist);
                 if (ret)
                         break;
-
-                perf_evlist__delete(evlist);
         }
 
         return ret;
@@ -1008,12 +1165,9 @@ realloc:
 static int test__PERF_RECORD(void)
 {
         struct perf_record_opts opts = {
-                .target_pid = -1,
-                .target_tid = -1,
                 .no_delay   = true,
                 .freq       = 10,
                 .mmap_pages = 256,
-                .sample_id_all_avail = true,
         };
         cpu_set_t *cpu_mask = NULL;
         size_t cpu_mask_size = 0;
@@ -1054,7 +1208,7 @@ static int test__PERF_RECORD(void)
          * we're monitoring, the one forked there.
          */
         err = perf_evlist__create_maps(evlist, opts.target_pid,
-                                       opts.target_tid, opts.cpu_list);
+                                       opts.target_tid, UINT_MAX, opts.cpu_list);
         if (err < 0) {
                 pr_debug("Not enough memory to create thread/cpu maps\n");
                 goto out_delete_evlist;
@@ -1296,6 +1450,178 @@ out:
         return (err < 0 || errs > 0) ? -1 : 0;
 }
 
+
+#if defined(__x86_64__) || defined(__i386__)
+
+#define barrier() asm volatile("" ::: "memory")
+
+static u64 rdpmc(unsigned int counter)
+{
+        unsigned int low, high;
+
+        asm volatile("rdpmc" : "=a" (low), "=d" (high) : "c" (counter));
+
+        return low | ((u64)high) << 32;
+}
+
+static u64 rdtsc(void)
+{
+        unsigned int low, high;
+
+        asm volatile("rdtsc" : "=a" (low), "=d" (high));
+
+        return low | ((u64)high) << 32;
+}
+
+static u64 mmap_read_self(void *addr)
+{
+        struct perf_event_mmap_page *pc = addr;
+        u32 seq, idx, time_mult = 0, time_shift = 0;
+        u64 count, cyc = 0, time_offset = 0, enabled, running, delta;
+
+        do {
+                seq = pc->lock;
+                barrier();
+
+                enabled = pc->time_enabled;
+                running = pc->time_running;
+
+                if (enabled != running) {
+                        cyc = rdtsc();
+                        time_mult = pc->time_mult;
+                        time_shift = pc->time_shift;
+                        time_offset = pc->time_offset;
+                }
+
+                idx = pc->index;
+                count = pc->offset;
+                if (idx)
+                        count += rdpmc(idx - 1);
+
+                barrier();
+        } while (pc->lock != seq);
+
+        if (enabled != running) {
+                u64 quot, rem;
+
+                quot = (cyc >> time_shift);
+                rem = cyc & ((1 << time_shift) - 1);
+                delta = time_offset + quot * time_mult +
+                        ((rem * time_mult) >> time_shift);
+
+                enabled += delta;
+                if (idx)
+                        running += delta;
+
+                quot = count / running;
+                rem = count % running;
+                count = quot * enabled + (rem * enabled) / running;
+        }
+
+        return count;
+}
+
+/*
+ * If the RDPMC instruction faults then signal this back to the test parent task:
+ */
+static void segfault_handler(int sig __used, siginfo_t *info __used, void *uc __used)
+{
+        exit(-1);
+}
+
+static int __test__rdpmc(void)
+{
+        long page_size = sysconf(_SC_PAGE_SIZE);
+        volatile int tmp = 0;
+        u64 i, loops = 1000;
+        int n;
+        int fd;
+        void *addr;
+        struct perf_event_attr attr = {
+                .type = PERF_TYPE_HARDWARE,
+                .config = PERF_COUNT_HW_INSTRUCTIONS,
+                .exclude_kernel = 1,
+        };
+        u64 delta_sum = 0;
+        struct sigaction sa;
+
+        sigfillset(&sa.sa_mask);
+        sa.sa_sigaction = segfault_handler;
+        sigaction(SIGSEGV, &sa, NULL);
+
+        fprintf(stderr, "\n\n");
+
+        fd = sys_perf_event_open(&attr, 0, -1, -1, 0);
+        if (fd < 0) {
+                die("Error: sys_perf_event_open() syscall returned "
+                    "with %d (%s)\n", fd, strerror(errno));
+        }
+
+        addr = mmap(NULL, page_size, PROT_READ, MAP_SHARED, fd, 0);
+        if (addr == (void *)(-1)) {
+                die("Error: mmap() syscall returned "
+                    "with (%s)\n", strerror(errno));
+        }
+
+        for (n = 0; n < 6; n++) {
+                u64 stamp, now, delta;
+
+                stamp = mmap_read_self(addr);
+
+                for (i = 0; i < loops; i++)
+                        tmp++;
+
+                now = mmap_read_self(addr);
+                loops *= 10;
+
+                delta = now - stamp;
+                fprintf(stderr, "%14d: %14Lu\n", n, (long long)delta);
+
+                delta_sum += delta;
+        }
+
+        munmap(addr, page_size);
+        close(fd);
+
+        fprintf(stderr, "   ");
+
+        if (!delta_sum)
+                return -1;
+
+        return 0;
+}
+
+static int test__rdpmc(void)
+{
+        int status = 0;
+        int wret = 0;
+        int ret;
+        int pid;
+
+        pid = fork();
+        if (pid < 0)
+                return -1;
+
+        if (!pid) {
+                ret = __test__rdpmc();
+
+                exit(ret);
+        }
+
+        wret = waitpid(pid, &status, 0);
+        if (wret < 0 || status)
+                return -1;
+
+        return 0;
+}
+
+#endif
+
+static int test__perf_pmu(void)
+{
+        return perf_pmu__test();
+}
+
 static struct test {
         const char *desc;
         int (*func)(void);
@@ -1320,11 +1646,21 @@ static struct test {
                 .desc = "parse events tests",
                 .func = test__parse_events,
         },
+#if defined(__x86_64__) || defined(__i386__)
+        {
+                .desc = "x86 rdpmc test",
+                .func = test__rdpmc,
+        },
+#endif
         {
                 .desc = "Validate PERF_RECORD_* events & perf_sample fields",
                 .func = test__PERF_RECORD,
         },
         {
+                .desc = "Test perf pmu format parsing",
+                .func = test__perf_pmu,
+        },
+        {
                 .func = NULL,
         },
 };
@@ -1396,7 +1732,7 @@ int cmd_test(int argc, const char **argv, const char *prefix __used)
         NULL,
         };
         const struct option test_options[] = {
-        OPT_INTEGER('v', "verbose", &verbose,
+        OPT_INCR('v', "verbose", &verbose,
                     "be more verbose (show symbol address, etc)"),
         OPT_END()
         };
@@ -1412,7 +1748,5 @@ int cmd_test(int argc, const char **argv, const char *prefix __used)
         if (symbol__init() < 0)
                 return -1;
 
-        setup_pager();
-
         return __cmd_test(argc, argv);
 }
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 4f81eeb99875..e3c63aef8efc 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -64,7 +64,6 @@
 #include <linux/unistd.h>
 #include <linux/types.h>
 
-
 void get_term_dimensions(struct winsize *ws)
 {
         char *s = getenv("LINES");
@@ -89,8 +88,6 @@ void get_term_dimensions(struct winsize *ws)
 
 static void perf_top__update_print_entries(struct perf_top *top)
 {
-        top->print_entries = top->winsize.ws_row;
-
         if (top->print_entries > 9)
                 top->print_entries -= 9;
 }
@@ -100,6 +97,13 @@ static void perf_top__sig_winch(int sig __used, siginfo_t *info __used, void *ar
         struct perf_top *top = arg;
 
         get_term_dimensions(&top->winsize);
+        if (!top->print_entries
+            || (top->print_entries+4) > top->winsize.ws_row) {
+                top->print_entries = top->winsize.ws_row;
+        } else {
+                top->print_entries += 4;
+                top->winsize.ws_row = top->print_entries;
+        }
         perf_top__update_print_entries(top);
 }
 
@@ -235,7 +239,6 @@ static struct hist_entry *perf_evsel__add_hist_entry(struct perf_evsel *evsel,
         if (he == NULL)
                 return NULL;
 
-        evsel->hists.stats.total_period += sample->period;
         hists__inc_nr_events(&evsel->hists, PERF_RECORD_SAMPLE);
         return he;
 }
@@ -454,8 +457,10 @@ static void perf_top__handle_keypress(struct perf_top *top, int c)
                                 };
                                 perf_top__sig_winch(SIGWINCH, NULL, top);
                                 sigaction(SIGWINCH, &act, NULL);
-                        } else
+                        } else {
+                                perf_top__sig_winch(SIGWINCH, NULL, top);
                                 signal(SIGWINCH, SIG_DFL);
+                        }
                         break;
                 case 'E':
                         if (top->evlist->nr_entries > 1) {
@@ -538,10 +543,20 @@ static void perf_top__sort_new_samples(void *arg)
 
 static void *display_thread_tui(void *arg)
 {
+        struct perf_evsel *pos;
         struct perf_top *top = arg;
         const char *help = "For a higher level overview, try: perf top --sort comm,dso";
 
         perf_top__sort_new_samples(top);
+
+        /*
+         * Initialize the uid_filter_str, in the future the TUI will allow
+         * Zooming in/out UIDs. For now juse use whatever the user passed
+         * via --uid.
+         */
+        list_for_each_entry(pos, &top->evlist->entries, node)
+                pos->hists.uid_filter_str = top->uid_str;
+
         perf_evlist__tui_browse_hists(top->evlist, help,
                                       perf_top__sort_new_samples,
                                       top, top->delay_secs);
@@ -662,6 +677,12 @@ static void perf_event__process_sample(struct perf_tool *tool,
                 return;
         }
 
+        if (!machine) {
+                pr_err("%u unprocessable samples recorded.",
+                       top->session->hists.stats.nr_unprocessable_samples++);
+                return;
+        }
+
         if (event->header.misc & PERF_RECORD_MISC_EXACT_IP)
                 top->exact_samples++;
 
@@ -851,8 +872,11 @@ static void perf_top__start_counters(struct perf_top *top)
                 attr->mmap = 1;
                 attr->comm = 1;
                 attr->inherit = top->inherit;
+fallback_missing_features:
+                if (top->exclude_guest_missing)
+                        attr->exclude_guest = attr->exclude_host = 0;
 retry_sample_id:
-                attr->sample_id_all = top->sample_id_all_avail ? 1 : 0;
+                attr->sample_id_all = top->sample_id_all_missing ? 0 : 1;
 try_again:
                 if (perf_evsel__open(counter, top->evlist->cpus,
                                      top->evlist->threads, top->group,
@@ -862,12 +886,20 @@ try_again:
                         if (err == EPERM || err == EACCES) {
                                 ui__error_paranoid();
                                 goto out_err;
-                        } else if (err == EINVAL && top->sample_id_all_avail) {
-                                /*
-                                 * Old kernel, no attr->sample_id_type_all field
-                                 */
-                                top->sample_id_all_avail = false;
-                                goto retry_sample_id;
+                        } else if (err == EINVAL) {
+                                if (!top->exclude_guest_missing &&
+                                    (attr->exclude_guest || attr->exclude_host)) {
+                                        pr_debug("Old kernel, cannot exclude "
+                                                 "guest or host samples.\n");
+                                        top->exclude_guest_missing = true;
+                                        goto fallback_missing_features;
+                                } else if (!top->sample_id_all_missing) {
+                                        /*
+                                         * Old kernel, no attr->sample_id_type_all field
+                                         */
+                                        top->sample_id_all_missing = true;
+                                        goto retry_sample_id;
+                                }
                         }
                         /*
                          * If it's cycles then fall back to hrtimer
@@ -889,6 +921,10 @@ try_again:
                                 ui__warning("The %s event is not supported.\n",
                                             event_name(counter));
                                 goto out_err;
+                        } else if (err == EMFILE) {
+                                ui__warning("Too many events are opened.\n"
+                                            "Try again after reducing the number of events\n");
+                                goto out_err;
                         }
 
                         ui__warning("The sys_perf_event_open() syscall "
@@ -946,7 +982,7 @@ static int __cmd_top(struct perf_top *top)
         if (ret)
                 goto out_delete;
 
-        if (top->target_tid != -1)
+        if (top->target_tid || top->uid != UINT_MAX)
                 perf_event__synthesize_thread_map(&top->tool, top->evlist->threads,
                                                   perf_event__process,
                                                   &top->session->host_machine);
@@ -1084,10 +1120,8 @@ int cmd_top(int argc, const char **argv, const char *prefix __used)
         struct perf_top top = {
                 .count_filter        = 5,
                 .delay_secs          = 2,
-                .target_pid          = -1,
-                .target_tid          = -1,
+                .uid                 = UINT_MAX,
                 .freq                = 1000, /* 1 KHz */
-                .sample_id_all_avail = true,
                 .mmap_pages          = 128,
                 .sym_pcnt_filter     = 5,
         };
@@ -1098,9 +1132,9 @@ int cmd_top(int argc, const char **argv, const char *prefix __used)
                      parse_events_option),
         OPT_INTEGER('c', "count", &top.default_interval,
                     "event period to sample"),
-        OPT_INTEGER('p', "pid", &top.target_pid,
+        OPT_STRING('p', "pid", &top.target_pid, "pid",
                     "profile events on existing process id"),
-        OPT_INTEGER('t', "tid", &top.target_tid,
+        OPT_STRING('t', "tid", &top.target_tid, "tid",
                     "profile events on existing thread id"),
         OPT_BOOLEAN('a', "all-cpus", &top.system_wide,
                             "system-wide collection from all CPUs"),
@@ -1159,6 +1193,7 @@ int cmd_top(int argc, const char **argv, const char *prefix __used)
                     "Display raw encoding of assembly instructions (default)"),
         OPT_STRING('M', "disassembler-style", &disassembler_style, "disassembler style",
                    "Specify disassembler style (e.g. -M intel for intel syntax)"),
+        OPT_STRING('u', "uid", &top.uid_str, "user", "user to profile"),
         OPT_END()
         };
 
@@ -1184,18 +1219,22 @@ int cmd_top(int argc, const char **argv, const char *prefix __used)
 
         setup_browser(false);
 
+        top.uid = parse_target_uid(top.uid_str, top.target_tid, top.target_pid);
+        if (top.uid_str != NULL && top.uid == UINT_MAX - 1)
+                goto out_delete_evlist;
+
         /* CPU and PID are mutually exclusive */
-        if (top.target_tid > 0 && top.cpu_list) {
+        if (top.target_tid && top.cpu_list) {
                 printf("WARNING: PID switch overriding CPU\n");
                 sleep(1);
                 top.cpu_list = NULL;
         }
 
-        if (top.target_pid != -1)
+        if (top.target_pid)
                 top.target_tid = top.target_pid;
 
         if (perf_evlist__create_maps(top.evlist, top.target_pid,
-                                     top.target_tid, top.cpu_list) < 0)
+                                     top.target_tid, top.uid, top.cpu_list) < 0)
                 usage_with_options(top_usage, options);
 
         if (!top.evlist->nr_entries &&
@@ -1259,6 +1298,7 @@ int cmd_top(int argc, const char **argv, const char *prefix __used)
 
         status = __cmd_top(&top);
 
+out_delete_evlist:
         perf_evlist__delete(top.evlist);
 
         return status;
diff --git a/tools/perf/config/feature-tests.mak b/tools/perf/config/feature-tests.mak
index 6170fd2531b5..d9084e03ce56 100644
--- a/tools/perf/config/feature-tests.mak
+++ b/tools/perf/config/feature-tests.mak
@@ -65,6 +65,21 @@ int main(void)
 endef
 endif
 
+ifndef NO_GTK2
+define SOURCE_GTK2
+#pragma GCC diagnostic ignored \"-Wstrict-prototypes\"
+#include <gtk/gtk.h>
+#pragma GCC diagnostic error \"-Wstrict-prototypes\"
+
+int main(int argc, char *argv[])
+{
+        gtk_init(&argc, &argv);
+
+        return 0;
+}
+endef
+endif
+
 ifndef NO_LIBPERL
 define SOURCE_PERL_EMBED
 #include <EXTERN.h>
diff --git a/tools/perf/perf.h b/tools/perf/perf.h
index 64f8bee31ced..89e3355ab173 100644
--- a/tools/perf/perf.h
+++ b/tools/perf/perf.h
@@ -10,6 +10,9 @@ void get_term_dimensions(struct winsize *ws);
 #define rmb()           asm volatile("lock; addl $0,0(%%esp)" ::: "memory")
 #define cpu_relax()     asm volatile("rep; nop" ::: "memory");
 #define CPUINFO_PROC    "model name"
+#ifndef __NR_perf_event_open
+# define __NR_perf_event_open 336
+#endif
 #endif
 
 #if defined(__x86_64__)
@@ -17,6 +20,9 @@ void get_term_dimensions(struct winsize *ws);
 #define rmb()           asm volatile("lfence" ::: "memory")
 #define cpu_relax()     asm volatile("rep; nop" ::: "memory");
 #define CPUINFO_PROC    "model name"
+#ifndef __NR_perf_event_open
+# define __NR_perf_event_open 298
+#endif
 #endif
 
 #ifdef __powerpc__
@@ -167,7 +173,6 @@ sys_perf_event_open(struct perf_event_attr *attr,
                       pid_t pid, int cpu, int group_fd,
                       unsigned long flags)
 {
-        attr->size = sizeof(*attr);
         return syscall(__NR_perf_event_open, attr, pid, cpu,
                        group_fd, flags);
 }
@@ -180,14 +185,32 @@ struct ip_callchain {
         u64 ips[0];
 };
 
+struct branch_flags {
+        u64 mispred:1;
+        u64 predicted:1;
+        u64 reserved:62;
+};
+
+struct branch_entry {
+        u64                             from;
+        u64                             to;
+        struct branch_flags flags;
+};
+
+struct branch_stack {
+        u64                             nr;
+        struct branch_entry     entries[0];
+};
+
 extern bool perf_host, perf_guest;
 extern const char perf_version_string[];
 
 void pthread__unblock_sigwinch(void);
 
 struct perf_record_opts {
-        pid_t        target_pid;
-        pid_t        target_tid;
+        const char   *target_pid;
+        const char   *target_tid;
+        uid_t        uid;
         bool         call_graph;
         bool         group;
         bool         inherit_stat;
@@ -198,12 +221,14 @@ struct perf_record_opts {
         bool         raw_samples;
         bool         sample_address;
         bool         sample_time;
-        bool         sample_id_all_avail;
+        bool         sample_id_all_missing;
+        bool         exclude_guest_missing;
         bool         system_wide;
         bool         period;
         unsigned int freq;
         unsigned int mmap_pages;
         unsigned int user_freq;
+        int          branch_stack;
         u64          default_interval;
         u64          user_interval;
         const char   *cpu_list;
diff --git a/tools/perf/python/twatch.py b/tools/perf/python/twatch.py
index df638c438a9f..b11cca584238 100755
--- a/tools/perf/python/twatch.py
+++ b/tools/perf/python/twatch.py
@@ -19,7 +19,7 @@ def main():
         cpus = perf.cpu_map()
         threads = perf.thread_map()
         evsel = perf.evsel(task = 1, comm = 1, mmap = 0,
-                           wakeup_events = 1, sample_period = 1,
+                           wakeup_events = 1, watermark = 1,
                            sample_id_all = 1,
                            sample_type = perf.SAMPLE_PERIOD | perf.SAMPLE_TID | perf.SAMPLE_CPU | perf.SAMPLE_TID)
         evsel.open(cpus = cpus, threads = threads);
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 011ed2676604..199f69ec656f 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -28,8 +28,8 @@ int symbol__annotate_init(struct map *map __used, struct symbol *sym)
 int symbol__alloc_hist(struct symbol *sym)
 {
         struct annotation *notes = symbol__annotation(sym);
-        size_t sizeof_sym_hist = (sizeof(struct sym_hist) +
-                                  (sym->end - sym->start) * sizeof(u64));
+        const size_t size = sym->end - sym->start + 1;
+        size_t sizeof_sym_hist = (sizeof(struct sym_hist) + size * sizeof(u64));
 
         notes->src = zalloc(sizeof(*notes->src) + symbol_conf.nr_events * sizeof_sym_hist);
         if (notes->src == NULL)
@@ -64,7 +64,7 @@ int symbol__inc_addr_samples(struct symbol *sym, struct map *map,
 
         pr_debug3("%s: addr=%#" PRIx64 "\n", __func__, map->unmap_ip(map, addr));
 
-        if (addr >= sym->end)
+        if (addr > sym->end)
                 return 0;
 
         offset = addr - sym->start;
@@ -315,7 +315,7 @@ fallback:
                        "Please use:\n\n"
                        "  perf buildid-cache -av vmlinux\n\n"
                        "or:\n\n"
-                       "  --vmlinux vmlinux",
+                       "  --vmlinux vmlinux\n",
                        sym->name, build_id_msg ?: "");
                 goto out_free_filename;
         }
@@ -408,7 +408,7 @@ static int symbol__get_source_line(struct symbol *sym, struct map *map,
         if (!notes->src->lines)
                 return -1;
 
-        start = map->unmap_ip(map, sym->start);
+        start = map__rip_2objdump(map, sym->start);
 
         for (i = 0; i < len; i++) {
                 char *path = NULL;
diff --git a/tools/perf/util/bitmap.c b/tools/perf/util/bitmap.c
index 5e230acae1e9..0a1adc1111fd 100644
--- a/tools/perf/util/bitmap.c
+++ b/tools/perf/util/bitmap.c
@@ -19,3 +19,13 @@ int __bitmap_weight(const unsigned long *bitmap, int bits)
 
         return w;
 }
+
+void __bitmap_or(unsigned long *dst, const unsigned long *bitmap1,
+                 const unsigned long *bitmap2, int bits)
+{
+        int k;
+        int nr = BITS_TO_LONGS(bits);
+
+        for (k = 0; k < nr; k++)
+                dst[k] = bitmap1[k] | bitmap2[k];
+}
diff --git a/tools/perf/util/cache.h b/tools/perf/util/cache.h
index fc5e5a09d5b9..8dd224df3e54 100644
--- a/tools/perf/util/cache.h
+++ b/tools/perf/util/cache.h
@@ -45,6 +45,18 @@ void setup_browser(bool fallback_to_pager);
 void exit_browser(bool wait_for_ok);
 #endif
 
+#ifdef NO_GTK2_SUPPORT
+static inline void perf_gtk_setup_browser(int argc __used, const char *argv[] __used, bool fallback_to_pager)
+{
+        if (fallback_to_pager)
+                setup_pager();
+}
+static inline void perf_gtk_exit_browser(bool wait_for_ok __used) {}
+#else
+void perf_gtk_setup_browser(int argc, const char *argv[], bool fallback_to_pager);
+void perf_gtk_exit_browser(bool wait_for_ok);
+#endif
+
 char *alias_lookup(const char *alias);
 int split_cmdline(char *cmdline, const char ***argv);
 
diff --git a/tools/perf/util/color.c b/tools/perf/util/color.c
index 521c38a79190..11e46da17bbb 100644
--- a/tools/perf/util/color.c
+++ b/tools/perf/util/color.c
@@ -1,3 +1,4 @@
+#include <linux/kernel.h>
 #include "cache.h"
 #include "color.h"
 
@@ -182,12 +183,12 @@ static int __color_vsnprintf(char *bf, size_t size, const char *color,
         }
 
         if (perf_use_color_default && *color)
-                r += snprintf(bf, size, "%s", color);
-        r += vsnprintf(bf + r, size - r, fmt, args);
+                r += scnprintf(bf, size, "%s", color);
+        r += vscnprintf(bf + r, size - r, fmt, args);
         if (perf_use_color_default && *color)
-                r += snprintf(bf + r, size - r, "%s", PERF_COLOR_RESET);
+                r += scnprintf(bf + r, size - r, "%s", PERF_COLOR_RESET);
         if (trail)
-                r += snprintf(bf + r, size - r, "%s", trail);
+                r += scnprintf(bf + r, size - r, "%s", trail);
         return r;
 }
 
diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
index 6893eec693ab..adc72f09914d 100644
--- a/tools/perf/util/cpumap.c
+++ b/tools/perf/util/cpumap.c
@@ -166,6 +166,17 @@ out:
         return cpus;
 }
 
+size_t cpu_map__fprintf(struct cpu_map *map, FILE *fp)
+{
+        int i;
+        size_t printed = fprintf(fp, "%d cpu%s: ",
+                                 map->nr, map->nr > 1 ? "s" : "");
+        for (i = 0; i < map->nr; ++i)
+                printed += fprintf(fp, "%s%d", i ? ", " : "", map->map[i]);
+
+        return printed + fprintf(fp, "\n");
+}
+
 struct cpu_map *cpu_map__dummy_new(void)
 {
         struct cpu_map *cpus = malloc(sizeof(*cpus) + sizeof(int));
diff --git a/tools/perf/util/cpumap.h b/tools/perf/util/cpumap.h
index 072c0a374794..c41518573c6a 100644
--- a/tools/perf/util/cpumap.h
+++ b/tools/perf/util/cpumap.h
@@ -1,6 +1,8 @@
 #ifndef __PERF_CPUMAP_H
 #define __PERF_CPUMAP_H
 
+#include <stdio.h>
+
 struct cpu_map {
         int nr;
         int map[];
@@ -10,4 +12,6 @@ struct cpu_map *cpu_map__new(const char *cpu_list);
 struct cpu_map *cpu_map__dummy_new(void);
 void cpu_map__delete(struct cpu_map *map);
 
+size_t cpu_map__fprintf(struct cpu_map *map, FILE *fp);
+
 #endif /* __PERF_CPUMAP_H */
diff --git a/tools/perf/util/ctype.c b/tools/perf/util/ctype.c
index 35073621e5de..aada3ac5e891 100644
--- a/tools/perf/util/ctype.c
+++ b/tools/perf/util/ctype.c
@@ -3,7 +3,7 @@
  *
  * No surprises, and works with signed and unsigned chars.
  */
-#include "cache.h"
+#include "util.h"
 
 enum {
         S = GIT_SPACE,
diff --git a/tools/perf/util/debugfs.c b/tools/perf/util/debugfs.c
index ffc35e748e89..dd8b19319c03 100644
--- a/tools/perf/util/debugfs.c
+++ b/tools/perf/util/debugfs.c
@@ -15,32 +15,6 @@ static const char *debugfs_known_mountpoints[] = {
         0,
 };
 
-/* use this to force a umount */
-void debugfs_force_cleanup(void)
-{
-        debugfs_find_mountpoint();
-        debugfs_premounted = 0;
-        debugfs_umount();
-}
-
-/* construct a full path to a debugfs element */
-int debugfs_make_path(const char *element, char *buffer, int size)
-{
-        int len;
-
-        if (strlen(debugfs_mountpoint) == 0) {
-                buffer[0] = '\0';
-                return -1;
-        }
-
-        len = strlen(debugfs_mountpoint) + strlen(element) + 1;
-        if (len >= size)
-                return len+1;
-
-        snprintf(buffer, size-1, "%s/%s", debugfs_mountpoint, element);
-        return 0;
-}
-
 static int debugfs_found;
 
 /* find the path to the mounted debugfs */
@@ -97,17 +71,6 @@ int debugfs_valid_mountpoint(const char *debugfs)
         return 0;
 }
 
-
-int debugfs_valid_entry(const char *path)
-{
-        struct stat st;
-
-        if (stat(path, &st))
-                return -errno;
-
-        return 0;
-}
-
 static void debugfs_set_tracing_events_path(const char *mountpoint)
 {
         snprintf(tracing_events_path, sizeof(tracing_events_path), "%s/%s",
@@ -149,107 +112,3 @@ void debugfs_set_path(const char *mountpoint)
         snprintf(debugfs_mountpoint, sizeof(debugfs_mountpoint), "%s", mountpoint);
         debugfs_set_tracing_events_path(mountpoint);
 }
-
-/* umount the debugfs */
-
-int debugfs_umount(void)
-{
-        char umountcmd[128];
-        int ret;
-
-        /* if it was already mounted, leave it */
-        if (debugfs_premounted)
-                return 0;
-
-        /* make sure it's a valid mount point */
-        ret = debugfs_valid_mountpoint(debugfs_mountpoint);
-        if (ret)
-                return ret;
-
-        snprintf(umountcmd, sizeof(umountcmd),
-                 "/bin/umount %s", debugfs_mountpoint);
-        return system(umountcmd);
-}
-
-int debugfs_write(const char *entry, const char *value)
-{
-        char path[PATH_MAX + 1];
-        int ret, count;
-        int fd;
-
-        /* construct the path */
-        snprintf(path, sizeof(path), "%s/%s", debugfs_mountpoint, entry);
-
-        /* verify that it exists */
-        ret = debugfs_valid_entry(path);
-        if (ret)
-                return ret;
-
-        /* get how many chars we're going to write */
-        count = strlen(value);
-
-        /* open the debugfs entry */
-        fd = open(path, O_RDWR);
-        if (fd < 0)
-                return -errno;
-
-        while (count > 0) {
-                /* write it */
-                ret = write(fd, value, count);
-                if (ret <= 0) {
-                        if (ret == EAGAIN)
-                                continue;
-                        close(fd);
-                        return -errno;
-                }
-                count -= ret;
-        }
-
-        /* close it */
-        close(fd);
-
-        /* return success */
-        return 0;
-}
-
-/*
- * read a debugfs entry
- * returns the number of chars read or a negative errno
- */
-int debugfs_read(const char *entry, char *buffer, size_t size)
-{
-        char path[PATH_MAX + 1];
-        int ret;
-        int fd;
-
-        /* construct the path */
-        snprintf(path, sizeof(path), "%s/%s", debugfs_mountpoint, entry);
-
-        /* verify that it exists */
-        ret = debugfs_valid_entry(path);
-        if (ret)
-                return ret;
-
-        /* open the debugfs entry */
-        fd = open(path, O_RDONLY);
-        if (fd < 0)
-                return -errno;
-
-        do {
-                /* read it */
-                ret = read(fd, buffer, size);
-                if (ret == 0) {
-                        close(fd);
-                        return EOF;
-                }
-        } while (ret < 0 && errno == EAGAIN);
-
-        /* close it */
-        close(fd);
-
-        /* make *sure* there's a null character at the end */
-        buffer[ret] = '\0';
-
-        /* return the number of chars read */
-        return ret;
-}
diff --git a/tools/perf/util/debugfs.h b/tools/perf/util/debugfs.h
index 4a878f735eb0..68f3e87ec57f 100644
--- a/tools/perf/util/debugfs.h
+++ b/tools/perf/util/debugfs.h
@@ -3,14 +3,8 @@
 
 const char *debugfs_find_mountpoint(void);
 int debugfs_valid_mountpoint(const char *debugfs);
-int debugfs_valid_entry(const char *path);
 char *debugfs_mount(const char *mountpoint);
-int debugfs_umount(void);
 void debugfs_set_path(const char *mountpoint);
-int debugfs_write(const char *entry, const char *value);
-int debugfs_read(const char *entry, char *buffer, size_t size);
-void debugfs_force_cleanup(void);
-int debugfs_make_path(const char *element, char *buffer, int size);
 
 extern char debugfs_mountpoint[];
 extern char tracing_events_path[];
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 73ddaf06b8e7..2a6f33cd888c 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -74,6 +74,7 @@ static pid_t perf_event__get_comm_tgid(pid_t pid, char *comm, size_t len)
                         if (size >= len)
                                 size = len - 1;
                         memcpy(comm, name, size);
+                        comm[size] = '\0';
 
                 } else if (memcmp(bf, "Tgid:", 5) == 0) {
                         char *tgids = bf + 5;
@@ -554,7 +555,7 @@ static int perf_event__process_kernel_mmap(struct perf_tool *tool __used,
 
         is_kernel_mmap = memcmp(event->mmap.filename,
                                 kmmap_prefix,
-                                strlen(kmmap_prefix)) == 0;
+                                strlen(kmmap_prefix) - 1) == 0;
         if (event->mmap.filename[0] == '/' ||
             (!is_kernel_mmap && event->mmap.filename[0] == '[')) {
 
diff --git a/tools/perf/util/event.h b/tools/perf/util/event.h
index cbdeaad9c5e5..1b197280c621 100644
--- a/tools/perf/util/event.h
+++ b/tools/perf/util/event.h
@@ -81,6 +81,7 @@ struct perf_sample {
         u32 raw_size;
         void *raw_data;
         struct ip_callchain *callchain;
+        struct branch_stack *branch_stack;
 };
 
 #define BUILD_ID_SIZE 20
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index fa1837088ca8..1986d8051bd1 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -51,13 +51,15 @@ struct perf_evlist *perf_evlist__new(struct cpu_map *cpus,
 void perf_evlist__config_attrs(struct perf_evlist *evlist,
                                struct perf_record_opts *opts)
 {
-        struct perf_evsel *evsel;
+        struct perf_evsel *evsel, *first;
 
         if (evlist->cpus->map[0] < 0)
                 opts->no_inherit = true;
 
+        first = list_entry(evlist->entries.next, struct perf_evsel, node);
+
         list_for_each_entry(evsel, &evlist->entries, node) {
-                perf_evsel__config(evsel, opts);
+                perf_evsel__config(evsel, opts, first);
 
                 if (evlist->nr_entries > 1)
                         evsel->attr.sample_type |= PERF_SAMPLE_ID;
@@ -97,9 +99,9 @@ void perf_evlist__add(struct perf_evlist *evlist, struct perf_evsel *entry)
         ++evlist->nr_entries;
 }
 
-static void perf_evlist__splice_list_tail(struct perf_evlist *evlist,
-                                          struct list_head *list,
-                                          int nr_entries)
+void perf_evlist__splice_list_tail(struct perf_evlist *evlist,
+                                   struct list_head *list,
+                                   int nr_entries)
 {
         list_splice_tail(list, &evlist->entries);
         evlist->nr_entries += nr_entries;
@@ -111,8 +113,11 @@ int perf_evlist__add_default(struct perf_evlist *evlist)
                 .type = PERF_TYPE_HARDWARE,
                 .config = PERF_COUNT_HW_CPU_CYCLES,
         };
-        struct perf_evsel *evsel = perf_evsel__new(&attr, 0);
+        struct perf_evsel *evsel;
 
+        event_attr_init(&attr);
+
+        evsel = perf_evsel__new(&attr, 0);
         if (evsel == NULL)
                 goto error;
 
@@ -346,6 +351,10 @@ struct perf_evsel *perf_evlist__id2evsel(struct perf_evlist *evlist, u64 id)
         hlist_for_each_entry(sid, pos, head, node)
                 if (sid->id == id)
                         return sid->evsel;
+
+        if (!perf_evlist__sample_id_all(evlist))
+                return list_entry(evlist->entries.next, struct perf_evsel, node);
+
         return NULL;
 }
 
@@ -590,15 +599,15 @@ int perf_evlist__mmap(struct perf_evlist *evlist, unsigned int pages,
         return perf_evlist__mmap_per_cpu(evlist, prot, mask);
 }
 
-int perf_evlist__create_maps(struct perf_evlist *evlist, pid_t target_pid,
-                             pid_t target_tid, const char *cpu_list)
+int perf_evlist__create_maps(struct perf_evlist *evlist, const char *target_pid,
+                             const char *target_tid, uid_t uid, const char *cpu_list)
 {
-        evlist->threads = thread_map__new(target_pid, target_tid);
+        evlist->threads = thread_map__new_str(target_pid, target_tid, uid);
 
         if (evlist->threads == NULL)
                 return -1;
 
-        if (cpu_list == NULL && target_tid != -1)
+        if (uid != UINT_MAX || (cpu_list == NULL && target_tid))
                 evlist->cpus = cpu_map__dummy_new();
         else
                 evlist->cpus = cpu_map__new(cpu_list);
@@ -758,6 +767,7 @@ out_err:
         list_for_each_entry_reverse(evsel, &evlist->entries, node)
                 perf_evsel__close(evsel, ncpus, nthreads);
 
+        errno = -err;
         return err;
 }
 
@@ -817,7 +827,7 @@ int perf_evlist__prepare_workload(struct perf_evlist *evlist,
                 exit(-1);
         }
 
-        if (!opts->system_wide && opts->target_tid == -1 && opts->target_pid == -1)
+        if (!opts->system_wide && !opts->target_tid && !opts->target_pid)
                 evlist->threads->map[0] = evlist->workload.pid;
 
         close(child_ready_pipe[1]);
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index 8922aeed0467..21f1c9e57f13 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -106,8 +106,8 @@ static inline void perf_evlist__set_maps(struct perf_evlist *evlist,
         evlist->threads = threads;
 }
 
-int perf_evlist__create_maps(struct perf_evlist *evlist, pid_t target_pid,
-                             pid_t target_tid, const char *cpu_list);
+int perf_evlist__create_maps(struct perf_evlist *evlist, const char *target_pid,
+                             const char *tid, uid_t uid, const char *cpu_list);
 void perf_evlist__delete_maps(struct perf_evlist *evlist);
 int perf_evlist__set_filters(struct perf_evlist *evlist);
 
@@ -117,4 +117,9 @@ u16 perf_evlist__id_hdr_size(const struct perf_evlist *evlist);
 
 bool perf_evlist__valid_sample_type(const struct perf_evlist *evlist);
 bool perf_evlist__valid_sample_id_all(const struct perf_evlist *evlist);
+
+void perf_evlist__splice_list_tail(struct perf_evlist *evlist,
+                                   struct list_head *list,
+                                   int nr_entries);
+
 #endif /* __PERF_EVLIST_H */
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 667f3b78bb2c..8c13dbcb84b9 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -34,7 +34,7 @@ int __perf_evsel__sample_size(u64 sample_type)
         return size;
 }
 
-static void hists__init(struct hists *hists)
+void hists__init(struct hists *hists)
 {
         memset(hists, 0, sizeof(*hists));
         hists->entries_in_array[0] = hists->entries_in_array[1] = RB_ROOT;
@@ -63,12 +63,13 @@ struct perf_evsel *perf_evsel__new(struct perf_event_attr *attr, int idx)
         return evsel;
 }
 
-void perf_evsel__config(struct perf_evsel *evsel, struct perf_record_opts *opts)
+void perf_evsel__config(struct perf_evsel *evsel, struct perf_record_opts *opts,
+                        struct perf_evsel *first)
 {
         struct perf_event_attr *attr = &evsel->attr;
         int track = !evsel->idx; /* only the first counter needs these */
 
-        attr->sample_id_all = opts->sample_id_all_avail ? 1 : 0;
+        attr->sample_id_all = opts->sample_id_all_missing ? 0 : 1;
         attr->inherit       = !opts->no_inherit;
         attr->read_format   = PERF_FORMAT_TOTAL_TIME_ENABLED |
                               PERF_FORMAT_TOTAL_TIME_RUNNING |
@@ -111,7 +112,7 @@ void perf_evsel__config(struct perf_evsel *evsel, struct perf_record_opts *opts)
         if (opts->period)
                 attr->sample_type       |= PERF_SAMPLE_PERIOD;
 
-        if (opts->sample_id_all_avail &&
+        if (!opts->sample_id_all_missing &&
             (opts->sample_time || opts->system_wide ||
              !opts->no_inherit || opts->cpu_list))
                 attr->sample_type       |= PERF_SAMPLE_TIME;
@@ -126,11 +127,16 @@ void perf_evsel__config(struct perf_evsel *evsel, struct perf_record_opts *opts)
                 attr->watermark = 0;
                 attr->wakeup_events = 1;
         }
+        if (opts->branch_stack) {
+                attr->sample_type       |= PERF_SAMPLE_BRANCH_STACK;
+                attr->branch_sample_type = opts->branch_stack;
+        }
 
         attr->mmap = track;
         attr->comm = track;
 
-        if (opts->target_pid == -1 && opts->target_tid == -1 && !opts->system_wide) {
+        if (!opts->target_pid && !opts->target_tid && !opts->system_wide &&
+            (!opts->group || evsel == first)) {
                 attr->disabled = 1;
                 attr->enable_on_exec = 1;
         }
@@ -463,6 +469,7 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
         memset(data, 0, sizeof(*data));
         data->cpu = data->pid = data->tid = -1;
         data->stream_id = data->id = data->time = -1ULL;
+        data->period = 1;
 
         if (event->header.type != PERF_RECORD_SAMPLE) {
                 if (!sample_id_all)
@@ -535,7 +542,7 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
         }
 
         if (type & PERF_SAMPLE_READ) {
-                fprintf(stderr, "PERF_SAMPLE_READ is unsuported for now\n");
+                fprintf(stderr, "PERF_SAMPLE_READ is unsupported for now\n");
                 return -1;
         }
 
@@ -573,8 +580,20 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
                         return -EFAULT;
 
                 data->raw_data = (void *) pdata;
+
+                array = (void *)array + data->raw_size + sizeof(u32);
         }
 
+        if (type & PERF_SAMPLE_BRANCH_STACK) {
+                u64 sz;
+
+                data->branch_stack = (struct branch_stack *)array;
+                array++; /* nr */
+
+                sz = data->branch_stack->nr * sizeof(struct branch_entry);
+                sz /= sizeof(u64);
+                array += sz;
+        }
         return 0;
 }
 
diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
index 326b8e4d5035..3d6b3e4cb66b 100644
--- a/tools/perf/util/evsel.h
+++ b/tools/perf/util/evsel.h
@@ -80,7 +80,8 @@ void perf_evsel__exit(struct perf_evsel *evsel);
 void perf_evsel__delete(struct perf_evsel *evsel);
 
 void perf_evsel__config(struct perf_evsel *evsel,
-                        struct perf_record_opts *opts);
+                        struct perf_record_opts *opts,
+                        struct perf_evsel *first);
 
 int perf_evsel__alloc_fd(struct perf_evsel *evsel, int ncpus, int nthreads);
 int perf_evsel__alloc_id(struct perf_evsel *evsel, int ncpus, int nthreads);
@@ -169,4 +170,6 @@ static inline int perf_evsel__sample_size(struct perf_evsel *evsel)
         return __perf_evsel__sample_size(evsel->attr.sample_type);
 }
 
+void hists__init(struct hists *hists);
+
 #endif /* __PERF_EVSEL_H */
diff --git a/tools/perf/util/gtk/browser.c b/tools/perf/util/gtk/browser.c
new file mode 100644
index 000000000000..258352a2356c
--- /dev/null
+++ b/tools/perf/util/gtk/browser.c
@@ -0,0 +1,189 @@
+#include "../evlist.h"
+#include "../cache.h"
+#include "../evsel.h"
+#include "../sort.h"
+#include "../hist.h"
+#include "gtk.h"
+
+#include <signal.h>
+
+#define MAX_COLUMNS                     32
+
+void perf_gtk_setup_browser(int argc, const char *argv[],
+                            bool fallback_to_pager __used)
+{
+        gtk_init(&argc, (char ***)&argv);
+}
+
+void perf_gtk_exit_browser(bool wait_for_ok __used)
+{
+        gtk_main_quit();
+}
+
+static void perf_gtk_signal(int sig)
+{
+        psignal(sig, "perf");
+        gtk_main_quit();
+}
+
+static void perf_gtk_resize_window(GtkWidget *window)
+{
+        GdkRectangle rect;
+        GdkScreen *screen;
+        int monitor;
+        int height;
+        int width;
+
+        screen = gtk_widget_get_screen(window);
+
+        monitor = gdk_screen_get_monitor_at_window(screen, window->window);
+
+        gdk_screen_get_monitor_geometry(screen, monitor, &rect);
+
+        width   = rect.width * 3 / 4;
+        height  = rect.height * 3 / 4;
+
+        gtk_window_resize(GTK_WINDOW(window), width, height);
+}
+
+static void perf_gtk_show_hists(GtkWidget *window, struct hists *hists)
+{
+        GType col_types[MAX_COLUMNS];
+        GtkCellRenderer *renderer;
+        struct sort_entry *se;
+        GtkListStore *store;
+        struct rb_node *nd;
+        u64 total_period;
+        GtkWidget *view;
+        int col_idx;
+        int nr_cols;
+
+        nr_cols = 0;
+
+        /* The percentage column */
+        col_types[nr_cols++] = G_TYPE_STRING;
+
+        list_for_each_entry(se, &hist_entry__sort_list, list) {
+                if (se->elide)
+                        continue;
+
+                col_types[nr_cols++] = G_TYPE_STRING;
+        }
+
+        store = gtk_list_store_newv(nr_cols, col_types);
+
+        view = gtk_tree_view_new();
+
+        renderer = gtk_cell_renderer_text_new();
+
+        col_idx = 0;
+
+        /* The percentage column */
+        gtk_tree_view_insert_column_with_attributes(GTK_TREE_VIEW(view),
+                                                    -1, "Overhead (%)",
+                                                    renderer, "text",
+                                                    col_idx++, NULL);
+
+        list_for_each_entry(se, &hist_entry__sort_list, list) {
+                if (se->elide)
+                        continue;
+
+                gtk_tree_view_insert_column_with_attributes(GTK_TREE_VIEW(view),
+                                                            -1, se->se_header,
+                                                            renderer, "text",
+                                                            col_idx++, NULL);
+        }
+
+        gtk_tree_view_set_model(GTK_TREE_VIEW(view), GTK_TREE_MODEL(store));
+
+        g_object_unref(GTK_TREE_MODEL(store));
+
+        total_period = hists->stats.total_period;
+
+        for (nd = rb_first(&hists->entries); nd; nd = rb_next(nd)) {
+                struct hist_entry *h = rb_entry(nd, struct hist_entry, rb_node);
+                GtkTreeIter iter;
+                double percent;
+                char s[512];
+
+                if (h->filtered)
+                        continue;
+
+                gtk_list_store_append(store, &iter);
+
+                col_idx = 0;
+
+                percent = (h->period * 100.0) / total_period;
+
+                snprintf(s, ARRAY_SIZE(s), "%.2f", percent);
+
+                gtk_list_store_set(store, &iter, col_idx++, s, -1);
+
+                list_for_each_entry(se, &hist_entry__sort_list, list) {
+                        if (se->elide)
+                                continue;
+
+                        se->se_snprintf(h, s, ARRAY_SIZE(s),
+                                        hists__col_len(hists, se->se_width_idx));
+
+                        gtk_list_store_set(store, &iter, col_idx++, s, -1);
+                }
+        }
+
+        gtk_container_add(GTK_CONTAINER(window), view);
+}
+
+int perf_evlist__gtk_browse_hists(struct perf_evlist *evlist,
+                                  const char *help __used,
+                                  void (*timer) (void *arg)__used,
+                                  void *arg __used, int delay_secs __used)
+{
+        struct perf_evsel *pos;
+        GtkWidget *notebook;
+        GtkWidget *window;
+
+        signal(SIGSEGV, perf_gtk_signal);
+        signal(SIGFPE,  perf_gtk_signal);
+        signal(SIGINT,  perf_gtk_signal);
+        signal(SIGQUIT, perf_gtk_signal);
+        signal(SIGTERM, perf_gtk_signal);
+
+        window = gtk_window_new(GTK_WINDOW_TOPLEVEL);
+
+        gtk_window_set_title(GTK_WINDOW(window), "perf report");
+
+        g_signal_connect(window, "delete_event", gtk_main_quit, NULL);
+
+        notebook = gtk_notebook_new();
+
+        list_for_each_entry(pos, &evlist->entries, node) {
+                struct hists *hists = &pos->hists;
+                const char *evname = event_name(pos);
+                GtkWidget *scrolled_window;
+                GtkWidget *tab_label;
+
+                scrolled_window = gtk_scrolled_window_new(NULL, NULL);
+
+                gtk_scrolled_window_set_policy(GTK_SCROLLED_WINDOW(scrolled_window),
+                                                        GTK_POLICY_AUTOMATIC,
+                                                        GTK_POLICY_AUTOMATIC);
+
+                perf_gtk_show_hists(scrolled_window, hists);
+
+                tab_label = gtk_label_new(evname);
+
+                gtk_notebook_append_page(GTK_NOTEBOOK(notebook), scrolled_window, tab_label);
+        }
+
+        gtk_container_add(GTK_CONTAINER(window), notebook);
+
+        gtk_widget_show_all(window);
+
+        perf_gtk_resize_window(window);
+
+        gtk_window_set_position(GTK_WINDOW(window), GTK_WIN_POS_CENTER);
+
+        gtk_main();
+
+        return 0;
+}
diff --git a/tools/perf/util/gtk/gtk.h b/tools/perf/util/gtk/gtk.h
new file mode 100644
index 000000000000..75177ee04032
--- /dev/null
+++ b/tools/perf/util/gtk/gtk.h
@@ -0,0 +1,8 @@
+#ifndef _PERF_GTK_H_
+#define _PERF_GTK_H_ 1
+
+#pragma GCC diagnostic ignored "-Wstrict-prototypes"
+#include <gtk/gtk.h>
+#pragma GCC diagnostic error "-Wstrict-prototypes"
+
+#endif /* _PERF_GTK_H_ */
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 3e7e0b09c12c..4c7c2d73251f 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -63,9 +63,20 @@ char *perf_header__find_event(u64 id)
         return NULL;
 }
 
-static const char *__perf_magic = "PERFFILE";
+/*
+ * magic2 = "PERFILE2"
+ * must be a numerical value to let the endianness
+ * determine the memory layout. That way we are able
+ * to detect endianness when reading the perf.data file
+ * back.
+ *
+ * we check for legacy (PERFFILE) format.
+ */
+static const char *__perf_magic1 = "PERFFILE";
+static const u64 __perf_magic2    = 0x32454c4946524550ULL;
+static const u64 __perf_magic2_sw = 0x50455246494c4532ULL;
 
-#define PERF_MAGIC      (*(u64 *)__perf_magic)
+#define PERF_MAGIC      __perf_magic2
 
 struct perf_file_attr {
         struct perf_event_attr  attr;
@@ -280,7 +291,7 @@ int build_id_cache__add_s(const char *sbuild_id, const char *debugdir,
         if (realname == NULL || filename == NULL || linkname == NULL)
                 goto out_free;
 
-        len = snprintf(filename, size, "%s%s%s",
+        len = scnprintf(filename, size, "%s%s%s",
                        debugdir, is_kallsyms ? "/" : "", realname);
         if (mkdir_p(filename, 0755))
                 goto out_free;
@@ -295,7 +306,7 @@ int build_id_cache__add_s(const char *sbuild_id, const char *debugdir,
                         goto out_free;
         }
 
-        len = snprintf(linkname, size, "%s/.build-id/%.2s",
+        len = scnprintf(linkname, size, "%s/.build-id/%.2s",
                        debugdir, sbuild_id);
 
         if (access(linkname, X_OK) && mkdir_p(linkname, 0755))
@@ -1012,6 +1023,12 @@ write_it:
         return do_write_string(fd, buffer);
 }
 
+static int write_branch_stack(int fd __used, struct perf_header *h __used,
+                       struct perf_evlist *evlist __used)
+{
+        return 0;
+}
+
 static void print_hostname(struct perf_header *ph, int fd, FILE *fp)
 {
         char *str = do_read_string(fd, ph);
@@ -1133,8 +1150,9 @@ static void print_event_desc(struct perf_header *ph, int fd, FILE *fp)
         uint64_t id;
         void *buf = NULL;
         char *str;
-        u32 nre, sz, nr, i, j, msz;
-        int ret;
+        u32 nre, sz, nr, i, j;
+        ssize_t ret;
+        size_t msz;
 
         /* number of events */
         ret = read(fd, &nre, sizeof(nre));
@@ -1151,15 +1169,9 @@ static void print_event_desc(struct perf_header *ph, int fd, FILE *fp)
         if (ph->needs_swap)
                 sz = bswap_32(sz);
 
-        /*
-         * ensure it is at least to our ABI rev
-         */
-        if (sz < (u32)sizeof(attr))
-                goto error;
-
         memset(&attr, 0, sizeof(attr));
 
-        /* read entire region to sync up to next field */
+        /* buffer to hold on file attr struct */
         buf = malloc(sz);
         if (!buf)
                 goto error;
@@ -1170,6 +1182,10 @@ static void print_event_desc(struct perf_header *ph, int fd, FILE *fp)
 
         for (i = 0 ; i < nre; i++) {
 
+                /*
+                 * must read entire on-file attr struct to
+                 * sync up with layout.
+                 */
                 ret = read(fd, buf, sz);
                 if (ret != (ssize_t)sz)
                         goto error;
@@ -1305,25 +1321,204 @@ static void print_cpuid(struct perf_header *ph, int fd, FILE *fp)
         free(str);
 }
 
+static void print_branch_stack(struct perf_header *ph __used, int fd __used,
+                               FILE *fp)
+{
+        fprintf(fp, "# contains samples with branch stack\n");
+}
+
+static int __event_process_build_id(struct build_id_event *bev,
+                                    char *filename,
+                                    struct perf_session *session)
+{
+        int err = -1;
+        struct list_head *head;
+        struct machine *machine;
+        u16 misc;
+        struct dso *dso;
+        enum dso_kernel_type dso_type;
+
+        machine = perf_session__findnew_machine(session, bev->pid);
+        if (!machine)
+                goto out;
+
+        misc = bev->header.misc & PERF_RECORD_MISC_CPUMODE_MASK;
+
+        switch (misc) {
+        case PERF_RECORD_MISC_KERNEL:
+                dso_type = DSO_TYPE_KERNEL;
+                head = &machine->kernel_dsos;
+                break;
+        case PERF_RECORD_MISC_GUEST_KERNEL:
+                dso_type = DSO_TYPE_GUEST_KERNEL;
+                head = &machine->kernel_dsos;
+                break;
+        case PERF_RECORD_MISC_USER:
+        case PERF_RECORD_MISC_GUEST_USER:
+                dso_type = DSO_TYPE_USER;
+                head = &machine->user_dsos;
+                break;
+        default:
+                goto out;
+        }
+
+        dso = __dsos__findnew(head, filename);
+        if (dso != NULL) {
+                char sbuild_id[BUILD_ID_SIZE * 2 + 1];
+
+                dso__set_build_id(dso, &bev->build_id);
+
+                if (filename[0] == '[')
+                        dso->kernel = dso_type;
+
+                build_id__sprintf(dso->build_id, sizeof(dso->build_id),
+                                  sbuild_id);
+                pr_debug("build id event received for %s: %s\n",
+                         dso->long_name, sbuild_id);
+        }
+
+        err = 0;
+out:
+        return err;
+}
+
+static int perf_header__read_build_ids_abi_quirk(struct perf_header *header,
+                                                 int input, u64 offset, u64 size)
+{
+        struct perf_session *session = container_of(header, struct perf_session, header);
+        struct {
+                struct perf_event_header   header;
+                u8                         build_id[ALIGN(BUILD_ID_SIZE, sizeof(u64))];
+                char                       filename[0];
+        } old_bev;
+        struct build_id_event bev;
+        char filename[PATH_MAX];
+        u64 limit = offset + size;
+
+        while (offset < limit) {
+                ssize_t len;
+
+                if (read(input, &old_bev, sizeof(old_bev)) != sizeof(old_bev))
+                        return -1;
+
+                if (header->needs_swap)
+                        perf_event_header__bswap(&old_bev.header);
+
+                len = old_bev.header.size - sizeof(old_bev);
+                if (read(input, filename, len) != len)
+                        return -1;
+
+                bev.header = old_bev.header;
+
+                /*
+                 * As the pid is the missing value, we need to fill
+                 * it properly. The header.misc value give us nice hint.
+                 */
+                bev.pid = HOST_KERNEL_ID;
+                if (bev.header.misc == PERF_RECORD_MISC_GUEST_USER ||
+                    bev.header.misc == PERF_RECORD_MISC_GUEST_KERNEL)
+                        bev.pid = DEFAULT_GUEST_KERNEL_ID;
+
+                memcpy(bev.build_id, old_bev.build_id, sizeof(bev.build_id));
+                __event_process_build_id(&bev, filename, session);
+
+                offset += bev.header.size;
+        }
+
+        return 0;
+}
+
+static int perf_header__read_build_ids(struct perf_header *header,
+                                       int input, u64 offset, u64 size)
+{
+        struct perf_session *session = container_of(header, struct perf_session, header);
+        struct build_id_event bev;
+        char filename[PATH_MAX];
+        u64 limit = offset + size, orig_offset = offset;
+        int err = -1;
+
+        while (offset < limit) {
+                ssize_t len;
+
+                if (read(input, &bev, sizeof(bev)) != sizeof(bev))
+                        goto out;
+
+                if (header->needs_swap)
+                        perf_event_header__bswap(&bev.header);
+
+                len = bev.header.size - sizeof(bev);
+                if (read(input, filename, len) != len)
+                        goto out;
+                /*
+                 * The a1645ce1 changeset:
+                 *
+                 * "perf: 'perf kvm' tool for monitoring guest performance from host"
+                 *
+                 * Added a field to struct build_id_event that broke the file
+                 * format.
+                 *
+                 * Since the kernel build-id is the first entry, process the
+                 * table using the old format if the well known
+                 * '[kernel.kallsyms]' string for the kernel build-id has the
+                 * first 4 characters chopped off (where the pid_t sits).
+                 */
+                if (memcmp(filename, "nel.kallsyms]", 13) == 0) {
+                        if (lseek(input, orig_offset, SEEK_SET) == (off_t)-1)
+                                return -1;
+                        return perf_header__read_build_ids_abi_quirk(header, input, offset, size);
+                }
+
+                __event_process_build_id(&bev, filename, session);
+
+                offset += bev.header.size;
+        }
+        err = 0;
+out:
+        return err;
+}
+
+static int process_trace_info(struct perf_file_section *section __unused,
+                              struct perf_header *ph __unused,
+                              int feat __unused, int fd)
+{
+        trace_report(fd, false);
+        return 0;
+}
+
+static int process_build_id(struct perf_file_section *section,
+                            struct perf_header *ph,
+                            int feat __unused, int fd)
+{
+        if (perf_header__read_build_ids(ph, fd, section->offset, section->size))
+                pr_debug("Failed to read buildids, continuing...\n");
+        return 0;
+}
+
 struct feature_ops {
         int (*write)(int fd, struct perf_header *h, struct perf_evlist *evlist);
         void (*print)(struct perf_header *h, int fd, FILE *fp);
+        int (*process)(struct perf_file_section *section,
+                       struct perf_header *h, int feat, int fd);
         const char *name;
         bool full_only;
 };
 
 #define FEAT_OPA(n, func) \
         [n] = { .name = #n, .write = write_##func, .print = print_##func }
+#define FEAT_OPP(n, func) \
+        [n] = { .name = #n, .write = write_##func, .print = print_##func, \
+                .process = process_##func }
 #define FEAT_OPF(n, func) \
-        [n] = { .name = #n, .write = write_##func, .print = print_##func, .full_only = true }
+        [n] = { .name = #n, .write = write_##func, .print = print_##func, \
+                .full_only = true }
 
 /* feature_ops not implemented: */
 #define print_trace_info                NULL
 #define print_build_id                  NULL
 
 static const struct feature_ops feat_ops[HEADER_LAST_FEATURE] = {
-        FEAT_OPA(HEADER_TRACE_INFO,     trace_info),
-        FEAT_OPA(HEADER_BUILD_ID,       build_id),
+        FEAT_OPP(HEADER_TRACE_INFO,     trace_info),
+        FEAT_OPP(HEADER_BUILD_ID,       build_id),
         FEAT_OPA(HEADER_HOSTNAME,       hostname),
         FEAT_OPA(HEADER_OSRELEASE,      osrelease),
         FEAT_OPA(HEADER_VERSION,        version),
@@ -1336,6 +1531,7 @@ static const struct feature_ops feat_ops[HEADER_LAST_FEATURE] = {
         FEAT_OPA(HEADER_CMDLINE,        cmdline),
         FEAT_OPF(HEADER_CPU_TOPOLOGY,   cpu_topology),
         FEAT_OPF(HEADER_NUMA_TOPOLOGY,  numa_topology),
+        FEAT_OPA(HEADER_BRANCH_STACK,   branch_stack),
 };
 
 struct header_print_data {
@@ -1620,24 +1816,128 @@ out_free:
         return err;
 }
 
+static const int attr_file_abi_sizes[] = {
+        [0] = PERF_ATTR_SIZE_VER0,
+        [1] = PERF_ATTR_SIZE_VER1,
+        0,
+};
+
+/*
+ * In the legacy file format, the magic number is not used to encode endianness.
+ * hdr_sz was used to encode endianness. But given that hdr_sz can vary based
+ * on ABI revisions, we need to try all combinations for all endianness to
+ * detect the endianness.
+ */
+static int try_all_file_abis(uint64_t hdr_sz, struct perf_header *ph)
+{
+        uint64_t ref_size, attr_size;
+        int i;
+
+        for (i = 0 ; attr_file_abi_sizes[i]; i++) {
+                ref_size = attr_file_abi_sizes[i]
+                         + sizeof(struct perf_file_section);
+                if (hdr_sz != ref_size) {
+                        attr_size = bswap_64(hdr_sz);
+                        if (attr_size != ref_size)
+                                continue;
+
+                        ph->needs_swap = true;
+                }
+                pr_debug("ABI%d perf.data file detected, need_swap=%d\n",
+                         i,
+                         ph->needs_swap);
+                return 0;
+        }
+        /* could not determine endianness */
+        return -1;
+}
+
+#define PERF_PIPE_HDR_VER0      16
+
+static const size_t attr_pipe_abi_sizes[] = {
+        [0] = PERF_PIPE_HDR_VER0,
+        0,
+};
+
+/*
+ * In the legacy pipe format, there is an implicit assumption that endiannesss
+ * between host recording the samples, and host parsing the samples is the
+ * same. This is not always the case given that the pipe output may always be
+ * redirected into a file and analyzed on a different machine with possibly a
+ * different endianness and perf_event ABI revsions in the perf tool itself.
+ */
+static int try_all_pipe_abis(uint64_t hdr_sz, struct perf_header *ph)
+{
+        u64 attr_size;
+        int i;
+
+        for (i = 0 ; attr_pipe_abi_sizes[i]; i++) {
+                if (hdr_sz != attr_pipe_abi_sizes[i]) {
+                        attr_size = bswap_64(hdr_sz);
+                        if (attr_size != hdr_sz)
+                                continue;
+
+                        ph->needs_swap = true;
+                }
+                pr_debug("Pipe ABI%d perf.data file detected\n", i);
+                return 0;
+        }
+        return -1;
+}
+
+static int check_magic_endian(u64 magic, uint64_t hdr_sz,
+                              bool is_pipe, struct perf_header *ph)
+{
+        int ret;
+
+        /* check for legacy format */
+        ret = memcmp(&magic, __perf_magic1, sizeof(magic));
+        if (ret == 0) {
+                pr_debug("legacy perf.data format\n");
+                if (is_pipe)
+                        return try_all_pipe_abis(hdr_sz, ph);
+
+                return try_all_file_abis(hdr_sz, ph);
+        }
+        /*
+         * the new magic number serves two purposes:
+         * - unique number to identify actual perf.data files
+         * - encode endianness of file
+         */
+
+        /* check magic number with one endianness */
+        if (magic == __perf_magic2)
+                return 0;
+
+        /* check magic number with opposite endianness */
+        if (magic != __perf_magic2_sw)
+                return -1;
+
+        ph->needs_swap = true;
+
+        return 0;
+}
+
 int perf_file_header__read(struct perf_file_header *header,
                            struct perf_header *ph, int fd)
 {
+        int ret;
+
         lseek(fd, 0, SEEK_SET);
 
-        if (readn(fd, header, sizeof(*header)) <= 0 ||
-            memcmp(&header->magic, __perf_magic, sizeof(header->magic)))
+        ret = readn(fd, header, sizeof(*header));
+        if (ret <= 0)
                 return -1;
 
-        if (header->attr_size != sizeof(struct perf_file_attr)) {
-                u64 attr_size = bswap_64(header->attr_size);
-
-                if (attr_size != sizeof(struct perf_file_attr))
-                        return -1;
+        if (check_magic_endian(header->magic,
+                               header->attr_size, false, ph) < 0) {
+                pr_debug("magic/endian check failed\n");
+                return -1;
+        }
 
+        if (ph->needs_swap) {
                 mem_bswap_64(header, offsetof(struct perf_file_header,
-                                            adds_features));
-                ph->needs_swap = true;
+                             adds_features));
         }
 
         if (header->size != sizeof(*header)) {
@@ -1689,156 +1989,6 @@ int perf_file_header__read(struct perf_file_header *header,
         return 0;
 }
 
-static int __event_process_build_id(struct build_id_event *bev,
-                                    char *filename,
-                                    struct perf_session *session)
-{
-        int err = -1;
-        struct list_head *head;
-        struct machine *machine;
-        u16 misc;
-        struct dso *dso;
-        enum dso_kernel_type dso_type;
-
-        machine = perf_session__findnew_machine(session, bev->pid);
-        if (!machine)
-                goto out;
-
-        misc = bev->header.misc & PERF_RECORD_MISC_CPUMODE_MASK;
-
-        switch (misc) {
-        case PERF_RECORD_MISC_KERNEL:
-                dso_type = DSO_TYPE_KERNEL;
-                head = &machine->kernel_dsos;
-                break;
-        case PERF_RECORD_MISC_GUEST_KERNEL:
-                dso_type = DSO_TYPE_GUEST_KERNEL;
-                head = &machine->kernel_dsos;
-                break;
-        case PERF_RECORD_MISC_USER:
-        case PERF_RECORD_MISC_GUEST_USER:
-                dso_type = DSO_TYPE_USER;
-                head = &machine->user_dsos;
-                break;
-        default:
-                goto out;
-        }
-
-        dso = __dsos__findnew(head, filename);
-        if (dso != NULL) {
-                char sbuild_id[BUILD_ID_SIZE * 2 + 1];
-
-                dso__set_build_id(dso, &bev->build_id);
-
-                if (filename[0] == '[')
-                        dso->kernel = dso_type;
-
-                build_id__sprintf(dso->build_id, sizeof(dso->build_id),
-                                  sbuild_id);
-                pr_debug("build id event received for %s: %s\n",
-                         dso->long_name, sbuild_id);
-        }
-
-        err = 0;
-out:
-        return err;
-}
-
-static int perf_header__read_build_ids_abi_quirk(struct perf_header *header,
-                                                 int input, u64 offset, u64 size)
-{
-        struct perf_session *session = container_of(header, struct perf_session, header);
-        struct {
-                struct perf_event_header   header;
-                u8                         build_id[ALIGN(BUILD_ID_SIZE, sizeof(u64))];
-                char                       filename[0];
-        } old_bev;
-        struct build_id_event bev;
-        char filename[PATH_MAX];
-        u64 limit = offset + size;
-
-        while (offset < limit) {
-                ssize_t len;
-
-                if (read(input, &old_bev, sizeof(old_bev)) != sizeof(old_bev))
-                        return -1;
-
-                if (header->needs_swap)
-                        perf_event_header__bswap(&old_bev.header);
-
-                len = old_bev.header.size - sizeof(old_bev);
-                if (read(input, filename, len) != len)
-                        return -1;
-
-                bev.header = old_bev.header;
-
-                /*
-                 * As the pid is the missing value, we need to fill
-                 * it properly. The header.misc value give us nice hint.
-                 */
-                bev.pid = HOST_KERNEL_ID;
-                if (bev.header.misc == PERF_RECORD_MISC_GUEST_USER ||
-                    bev.header.misc == PERF_RECORD_MISC_GUEST_KERNEL)
-                        bev.pid = DEFAULT_GUEST_KERNEL_ID;
-
-                memcpy(bev.build_id, old_bev.build_id, sizeof(bev.build_id));
-                __event_process_build_id(&bev, filename, session);
-
-                offset += bev.header.size;
-        }
-
-        return 0;
-}
-
-static int perf_header__read_build_ids(struct perf_header *header,
-                                       int input, u64 offset, u64 size)
-{
-        struct perf_session *session = container_of(header, struct perf_session, header);
-        struct build_id_event bev;
-        char filename[PATH_MAX];
-        u64 limit = offset + size, orig_offset = offset;
-        int err = -1;
-
-        while (offset < limit) {
-                ssize_t len;
-
-                if (read(input, &bev, sizeof(bev)) != sizeof(bev))
-                        goto out;
-
-                if (header->needs_swap)
-                        perf_event_header__bswap(&bev.header);
-
-                len = bev.header.size - sizeof(bev);
-                if (read(input, filename, len) != len)
-                        goto out;
-                /*
-                 * The a1645ce1 changeset:
-                 *
-                 * "perf: 'perf kvm' tool for monitoring guest performance from host"
-                 *
-                 * Added a field to struct build_id_event that broke the file
-                 * format.
-                 *
-                 * Since the kernel build-id is the first entry, process the
-                 * table using the old format if the well known
-                 * '[kernel.kallsyms]' string for the kernel build-id has the
-                 * first 4 characters chopped off (where the pid_t sits).
-                 */
-                if (memcmp(filename, "nel.kallsyms]", 13) == 0) {
-                        if (lseek(input, orig_offset, SEEK_SET) == (off_t)-1)
-                                return -1;
-                        return perf_header__read_build_ids_abi_quirk(header, input, offset, size);
-                }
-
-                __event_process_build_id(&bev, filename, session);
-
-                offset += bev.header.size;
-        }
-        err = 0;
-out:
-        return err;
-}
-
 static int perf_file_section__process(struct perf_file_section *section,
                                       struct perf_header *ph,
                                       int feat, int fd, void *data __used)
@@ -1854,40 +2004,32 @@ static int perf_file_section__process(struct perf_file_section *section,
                 return 0;
         }
 
-        switch (feat) {
-        case HEADER_TRACE_INFO:
-                trace_report(fd, false);
-                break;
-        case HEADER_BUILD_ID:
-                if (perf_header__read_build_ids(ph, fd, section->offset, section->size))
-                        pr_debug("Failed to read buildids, continuing...\n");
-                break;
-        default:
-                break;
-        }
+        if (!feat_ops[feat].process)
+                return 0;
 
-        return 0;
+        return feat_ops[feat].process(section, ph, feat, fd);
 }
 
 static int perf_file_header__read_pipe(struct perf_pipe_file_header *header,
                                        struct perf_header *ph, int fd,
                                        bool repipe)
 {
-        if (readn(fd, header, sizeof(*header)) <= 0 ||
-            memcmp(&header->magic, __perf_magic, sizeof(header->magic)))
-                return -1;
+        int ret;
 
-        if (repipe && do_write(STDOUT_FILENO, header, sizeof(*header)) < 0)
+        ret = readn(fd, header, sizeof(*header));
+        if (ret <= 0)
                 return -1;
 
-        if (header->size != sizeof(*header)) {
-                u64 size = bswap_64(header->size);
+        if (check_magic_endian(header->magic, header->size, true, ph) < 0) {
+                pr_debug("endian/magic failed\n");
+                return -1;
+        }
 
-                if (size != sizeof(*header))
-                        return -1;
+        if (ph->needs_swap)
+                header->size = bswap_64(header->size);
 
-                ph->needs_swap = true;
-        }
+        if (repipe && do_write(STDOUT_FILENO, header, sizeof(*header)) < 0)
+                return -1;
 
         return 0;
 }
@@ -1908,6 +2050,52 @@ static int perf_header__read_pipe(struct perf_session *session, int fd)
         return 0;
 }
 
+static int read_attr(int fd, struct perf_header *ph,
+                     struct perf_file_attr *f_attr)
+{
+        struct perf_event_attr *attr = &f_attr->attr;
+        size_t sz, left;
+        size_t our_sz = sizeof(f_attr->attr);
+        int ret;
+
+        memset(f_attr, 0, sizeof(*f_attr));
+
+        /* read minimal guaranteed structure */
+        ret = readn(fd, attr, PERF_ATTR_SIZE_VER0);
+        if (ret <= 0) {
+                pr_debug("cannot read %d bytes of header attr\n",
+                         PERF_ATTR_SIZE_VER0);
+                return -1;
+        }
+
+        /* on file perf_event_attr size */
+        sz = attr->size;
+
+        if (ph->needs_swap)
+                sz = bswap_32(sz);
+
+        if (sz == 0) {
+                /* assume ABI0 */
+                sz =  PERF_ATTR_SIZE_VER0;
+        } else if (sz > our_sz) {
+                pr_debug("file uses a more recent and unsupported ABI"
+                         " (%zu bytes extra)\n", sz - our_sz);
+                return -1;
+        }
+        /* what we have not yet read and that we know about */
+        left = sz - PERF_ATTR_SIZE_VER0;
+        if (left) {
+                void *ptr = attr;
+                ptr += PERF_ATTR_SIZE_VER0;
+
+                ret = readn(fd, ptr, left);
+        }
+        /* read perf_file_section, ids are read in caller */
+        ret = readn(fd, &f_attr->ids, sizeof(f_attr->ids));
+
+        return ret <= 0 ? -1 : 0;
+}
+
 int perf_session__read_header(struct perf_session *session, int fd)
 {
         struct perf_header *header = &session->header;
@@ -1923,19 +2111,17 @@ int perf_session__read_header(struct perf_session *session, int fd)
         if (session->fd_pipe)
                 return perf_header__read_pipe(session, fd);
 
-        if (perf_file_header__read(&f_header, header, fd) < 0) {
-                pr_debug("incompatible file format\n");
+        if (perf_file_header__read(&f_header, header, fd) < 0)
                 return -EINVAL;
-        }
 
-        nr_attrs = f_header.attrs.size / sizeof(f_attr);
+        nr_attrs = f_header.attrs.size / f_header.attr_size;
         lseek(fd, f_header.attrs.offset, SEEK_SET);
 
         for (i = 0; i < nr_attrs; i++) {
                 struct perf_evsel *evsel;
                 off_t tmp;
 
-                if (readn(fd, &f_attr, sizeof(f_attr)) <= 0)
+                if (read_attr(fd, header, &f_attr) < 0)
                         goto out_errno;
 
                 if (header->needs_swap)
@@ -2105,7 +2291,7 @@ int perf_event__synthesize_event_type(struct perf_tool *tool,
         strncpy(ev.event_type.event_type.name, name, MAX_EVENT_NAME - 1);
 
         ev.event_type.header.type = PERF_RECORD_HEADER_EVENT_TYPE;
-        size = strlen(name);
+        size = strlen(ev.event_type.event_type.name);
         size = ALIGN(size, sizeof(u64));
         ev.event_type.header.size = sizeof(ev.event_type) -
                 (sizeof(ev.event_type.event_type.name) - size);
diff --git a/tools/perf/util/header.h b/tools/perf/util/header.h
index ac4ec956024e..21a6be09c129 100644
--- a/tools/perf/util/header.h
+++ b/tools/perf/util/header.h
@@ -11,6 +11,7 @@
 
 enum {
         HEADER_RESERVED         = 0,    /* always cleared */
+        HEADER_FIRST_FEATURE    = 1,
         HEADER_TRACE_INFO       = 1,
         HEADER_BUILD_ID,
 
@@ -26,7 +27,7 @@ enum {
         HEADER_EVENT_DESC,
         HEADER_CPU_TOPOLOGY,
         HEADER_NUMA_TOPOLOGY,
-
+        HEADER_BRANCH_STACK,
         HEADER_LAST_FEATURE,
         HEADER_FEAT_BITS        = 256,
 };
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index abef2703cd24..2ec4b60aff6c 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -10,11 +10,14 @@ static bool hists__filter_entry_by_dso(struct hists *hists,
                                        struct hist_entry *he);
 static bool hists__filter_entry_by_thread(struct hists *hists,
                                           struct hist_entry *he);
+static bool hists__filter_entry_by_symbol(struct hists *hists,
+                                          struct hist_entry *he);
 
 enum hist_filter {
         HIST_FILTER__DSO,
         HIST_FILTER__THREAD,
         HIST_FILTER__PARENT,
+        HIST_FILTER__SYMBOL,
 };
 
 struct callchain_param  callchain_param = {
@@ -50,21 +53,25 @@ static void hists__reset_col_len(struct hists *hists)
                 hists__set_col_len(hists, col, 0);
 }
 
+static void hists__set_unres_dso_col_len(struct hists *hists, int dso)
+{
+        const unsigned int unresolved_col_width = BITS_PER_LONG / 4;
+
+        if (hists__col_len(hists, dso) < unresolved_col_width &&
+            !symbol_conf.col_width_list_str && !symbol_conf.field_sep &&
+            !symbol_conf.dso_list)
+                hists__set_col_len(hists, dso, unresolved_col_width);
+}
+
 static void hists__calc_col_len(struct hists *hists, struct hist_entry *h)
 {
+        const unsigned int unresolved_col_width = BITS_PER_LONG / 4;
         u16 len;
 
         if (h->ms.sym)
-                hists__new_col_len(hists, HISTC_SYMBOL, h->ms.sym->namelen);
-        else {
-                const unsigned int unresolved_col_width = BITS_PER_LONG / 4;
-
-                if (hists__col_len(hists, HISTC_DSO) < unresolved_col_width &&
-                    !symbol_conf.col_width_list_str && !symbol_conf.field_sep &&
-                    !symbol_conf.dso_list)
-                        hists__set_col_len(hists, HISTC_DSO,
-                                           unresolved_col_width);
-        }
+                hists__new_col_len(hists, HISTC_SYMBOL, h->ms.sym->namelen + 4);
+        else
+                hists__set_unres_dso_col_len(hists, HISTC_DSO);
 
         len = thread__comm_len(h->thread);
         if (hists__new_col_len(hists, HISTC_COMM, len))
@@ -74,23 +81,54 @@ static void hists__calc_col_len(struct hists *hists, struct hist_entry *h)
                 len = dso__name_len(h->ms.map->dso);
                 hists__new_col_len(hists, HISTC_DSO, len);
         }
+
+        if (h->branch_info) {
+                int symlen;
+                /*
+                 * +4 accounts for '[x] ' priv level info
+                 * +2 account of 0x prefix on raw addresses
+                 */
+                if (h->branch_info->from.sym) {
+                        symlen = (int)h->branch_info->from.sym->namelen + 4;
+                        hists__new_col_len(hists, HISTC_SYMBOL_FROM, symlen);
+
+                        symlen = dso__name_len(h->branch_info->from.map->dso);
+                        hists__new_col_len(hists, HISTC_DSO_FROM, symlen);
+                } else {
+                        symlen = unresolved_col_width + 4 + 2;
+                        hists__new_col_len(hists, HISTC_SYMBOL_FROM, symlen);
+                        hists__set_unres_dso_col_len(hists, HISTC_DSO_FROM);
+                }
+
+                if (h->branch_info->to.sym) {
+                        symlen = (int)h->branch_info->to.sym->namelen + 4;
+                        hists__new_col_len(hists, HISTC_SYMBOL_TO, symlen);
+
+                        symlen = dso__name_len(h->branch_info->to.map->dso);
+                        hists__new_col_len(hists, HISTC_DSO_TO, symlen);
+                } else {
+                        symlen = unresolved_col_width + 4 + 2;
+                        hists__new_col_len(hists, HISTC_SYMBOL_TO, symlen);
+                        hists__set_unres_dso_col_len(hists, HISTC_DSO_TO);
+                }
+        }
 }
 
-static void hist_entry__add_cpumode_period(struct hist_entry *self,
+static void hist_entry__add_cpumode_period(struct hist_entry *he,
                                            unsigned int cpumode, u64 period)
 {
         switch (cpumode) {
         case PERF_RECORD_MISC_KERNEL:
-                self->period_sys += period;
+                he->period_sys += period;
                 break;
         case PERF_RECORD_MISC_USER:
-                self->period_us += period;
+                he->period_us += period;
                 break;
         case PERF_RECORD_MISC_GUEST_KERNEL:
-                self->period_guest_sys += period;
+                he->period_guest_sys += period;
                 break;
         case PERF_RECORD_MISC_GUEST_USER:
-                self->period_guest_us += period;
+                he->period_guest_us += period;
                 break;
         default:
                 break;
@@ -165,18 +203,18 @@ void hists__decay_entries_threaded(struct hists *hists,
 static struct hist_entry *hist_entry__new(struct hist_entry *template)
 {
         size_t callchain_size = symbol_conf.use_callchain ? sizeof(struct callchain_root) : 0;
-        struct hist_entry *self = malloc(sizeof(*self) + callchain_size);
+        struct hist_entry *he = malloc(sizeof(*he) + callchain_size);
 
-        if (self != NULL) {
-                *self = *template;
-                self->nr_events = 1;
-                if (self->ms.map)
-                        self->ms.map->referenced = true;
+        if (he != NULL) {
+                *he = *template;
+                he->nr_events = 1;
+                if (he->ms.map)
+                        he->ms.map->referenced = true;
                 if (symbol_conf.use_callchain)
-                        callchain_init(self->callchain);
+                        callchain_init(he->callchain);
         }
 
-        return self;
+        return he;
 }
 
 static void hists__inc_nr_entries(struct hists *hists, struct hist_entry *h)
@@ -195,26 +233,14 @@ static u8 symbol__parent_filter(const struct symbol *parent)
         return 0;
 }
 
-struct hist_entry *__hists__add_entry(struct hists *hists,
+static struct hist_entry *add_hist_entry(struct hists *hists,
+                                      struct hist_entry *entry,
                                       struct addr_location *al,
-                                      struct symbol *sym_parent, u64 period)
+                                      u64 period)
 {
         struct rb_node **p;
         struct rb_node *parent = NULL;
         struct hist_entry *he;
-        struct hist_entry entry = {
-                .thread = al->thread,
-                .ms = {
-                        .map    = al->map,
-                        .sym    = al->sym,
-                },
-                .cpu    = al->cpu,
-                .ip     = al->addr,
-                .level  = al->level,
-                .period = period,
-                .parent = sym_parent,
-                .filtered = symbol__parent_filter(sym_parent),
-        };
         int cmp;
 
         pthread_mutex_lock(&hists->lock);
@@ -225,7 +251,7 @@ struct hist_entry *__hists__add_entry(struct hists *hists,
                 parent = *p;
                 he = rb_entry(parent, struct hist_entry, rb_node_in);
 
-                cmp = hist_entry__cmp(&entry, he);
+                cmp = hist_entry__cmp(entry, he);
 
                 if (!cmp) {
                         he->period += period;
@@ -239,7 +265,7 @@ struct hist_entry *__hists__add_entry(struct hists *hists,
                         p = &(*p)->rb_right;
         }
 
-        he = hist_entry__new(&entry);
+        he = hist_entry__new(entry);
         if (!he)
                 goto out_unlock;
 
@@ -252,6 +278,51 @@ out_unlock:
         return he;
 }
 
+struct hist_entry *__hists__add_branch_entry(struct hists *self,
+                                             struct addr_location *al,
+                                             struct symbol *sym_parent,
+                                             struct branch_info *bi,
+                                             u64 period)
+{
+        struct hist_entry entry = {
+                .thread = al->thread,
+                .ms = {
+                        .map    = bi->to.map,
+                        .sym    = bi->to.sym,
+                },
+                .cpu    = al->cpu,
+                .ip     = bi->to.addr,
+                .level  = al->level,
+                .period = period,
+                .parent = sym_parent,
+                .filtered = symbol__parent_filter(sym_parent),
+                .branch_info = bi,
+        };
+
+        return add_hist_entry(self, &entry, al, period);
+}
+
+struct hist_entry *__hists__add_entry(struct hists *self,
+                                      struct addr_location *al,
+                                      struct symbol *sym_parent, u64 period)
+{
+        struct hist_entry entry = {
+                .thread = al->thread,
+                .ms = {
+                        .map    = al->map,
+                        .sym    = al->sym,
+                },
+                .cpu    = al->cpu,
+                .ip     = al->addr,
+                .level  = al->level,
+                .period = period,
+                .parent = sym_parent,
+                .filtered = symbol__parent_filter(sym_parent),
+        };
+
+        return add_hist_entry(self, &entry, al, period);
+}
+
 int64_t
 hist_entry__cmp(struct hist_entry *left, struct hist_entry *right)
 {
@@ -352,6 +423,7 @@ static void hists__apply_filters(struct hists *hists, struct hist_entry *he)
 {
         hists__filter_entry_by_dso(hists, he);
         hists__filter_entry_by_thread(hists, he);
+        hists__filter_entry_by_symbol(hists, he);
 }
 
 static void __hists__collapse_resort(struct hists *hists, bool threaded)
@@ -535,7 +607,7 @@ static void init_rem_hits(void)
         rem_hits.ms.sym = rem_sq_bracket;
 }
 
-static size_t __callchain__fprintf_graph(FILE *fp, struct callchain_node *self,
+static size_t __callchain__fprintf_graph(FILE *fp, struct rb_root *root,
                                          u64 total_samples, int depth,
                                          int depth_mask, int left_margin)
 {
@@ -543,21 +615,16 @@ static size_t __callchain__fprintf_graph(FILE *fp, struct callchain_node *self,
         struct callchain_node *child;
         struct callchain_list *chain;
         int new_depth_mask = depth_mask;
-        u64 new_total;
         u64 remaining;
         size_t ret = 0;
         int i;
         uint entries_printed = 0;
 
-        if (callchain_param.mode == CHAIN_GRAPH_REL)
-                new_total = self->children_hit;
-        else
-                new_total = total_samples;
-
-        remaining = new_total;
+        remaining = total_samples;
 
-        node = rb_first(&self->rb_root);
+        node = rb_first(root);
         while (node) {
+                u64 new_total;
                 u64 cumul;
 
                 child = rb_entry(node, struct callchain_node, rb_node);
@@ -585,11 +652,17 @@ static size_t __callchain__fprintf_graph(FILE *fp, struct callchain_node *self,
                 list_for_each_entry(chain, &child->val, list) {
                         ret += ipchain__fprintf_graph(fp, chain, depth,
                                                       new_depth_mask, i++,
-                                                      new_total,
+                                                      total_samples,
                                                       cumul,
                                                       left_margin);
                 }
-                ret += __callchain__fprintf_graph(fp, child, new_total,
+
+                if (callchain_param.mode == CHAIN_GRAPH_REL)
+                        new_total = child->children_hit;
+                else
+                        new_total = total_samples;
+
+                ret += __callchain__fprintf_graph(fp, &child->rb_root, new_total,
                                                   depth + 1,
                                                   new_depth_mask | (1 << depth),
                                                   left_margin);
@@ -599,61 +672,75 @@ static size_t __callchain__fprintf_graph(FILE *fp, struct callchain_node *self,
         }
 
         if (callchain_param.mode == CHAIN_GRAPH_REL &&
-                remaining && remaining != new_total) {
+                remaining && remaining != total_samples) {
 
                 if (!rem_sq_bracket)
                         return ret;
 
                 new_depth_mask &= ~(1 << (depth - 1));
-
                 ret += ipchain__fprintf_graph(fp, &rem_hits, depth,
-                                              new_depth_mask, 0, new_total,
+                                              new_depth_mask, 0, total_samples,
                                               remaining, left_margin);
         }
 
         return ret;
 }
 
-static size_t callchain__fprintf_graph(FILE *fp, struct callchain_node *self,
+static size_t callchain__fprintf_graph(FILE *fp, struct rb_root *root,
                                        u64 total_samples, int left_margin)
 {
+        struct callchain_node *cnode;
         struct callchain_list *chain;
+        u32 entries_printed = 0;
         bool printed = false;
+        struct rb_node *node;
         int i = 0;
-        int ret = 0;
-        u32 entries_printed = 0;
-
-        list_for_each_entry(chain, &self->val, list) {
-                if (!i++ && sort__first_dimension == SORT_SYM)
-                        continue;
-
-                if (!printed) {
-                        ret += callchain__fprintf_left_margin(fp, left_margin);
-                        ret += fprintf(fp, "|\n");
-                        ret += callchain__fprintf_left_margin(fp, left_margin);
-                        ret += fprintf(fp, "---");
-
-                        left_margin += 3;
-                        printed = true;
-                } else
-                        ret += callchain__fprintf_left_margin(fp, left_margin);
+        int ret;
 
-                if (chain->ms.sym)
-                        ret += fprintf(fp, " %s\n", chain->ms.sym->name);
-                else
-                        ret += fprintf(fp, " %p\n", (void *)(long)chain->ip);
+        /*
+         * If have one single callchain root, don't bother printing
+         * its percentage (100 % in fractal mode and the same percentage
+         * than the hist in graph mode). This also avoid one level of column.
+         */
+        node = rb_first(root);
+        if (node && !rb_next(node)) {
+                cnode = rb_entry(node, struct callchain_node, rb_node);
+                list_for_each_entry(chain, &cnode->val, list) {
+                        /*
+                         * If we sort by symbol, the first entry is the same than
+                         * the symbol. No need to print it otherwise it appears as
+                         * displayed twice.
+                         */
+                        if (!i++ && sort__first_dimension == SORT_SYM)
+                                continue;
+                        if (!printed) {
+                                ret += callchain__fprintf_left_margin(fp, left_margin);
+                                ret += fprintf(fp, "|\n");
+                                ret += callchain__fprintf_left_margin(fp, left_margin);
+                                ret += fprintf(fp, "---");
+                                left_margin += 3;
+                                printed = true;
+                        } else
+                                ret += callchain__fprintf_left_margin(fp, left_margin);
+
+                        if (chain->ms.sym)
+                                ret += fprintf(fp, " %s\n", chain->ms.sym->name);
+                        else
+                                ret += fprintf(fp, " %p\n", (void *)(long)chain->ip);
 
-                if (++entries_printed == callchain_param.print_limit)
-                        break;
+                        if (++entries_printed == callchain_param.print_limit)
+                                break;
+                }
+                root = &cnode->rb_root;
         }
 
-        ret += __callchain__fprintf_graph(fp, self, total_samples, 1, 1, left_margin);
-
-        return ret;
+        return __callchain__fprintf_graph(fp, root, total_samples,
+                                          1, 1, left_margin);
 }
 
-static size_t callchain__fprintf_flat(FILE *fp, struct callchain_node *self,
-                                      u64 total_samples)
+static size_t __callchain__fprintf_flat(FILE *fp,
+                                        struct callchain_node *self,
+                                        u64 total_samples)
 {
         struct callchain_list *chain;
         size_t ret = 0;
@@ -661,7 +748,7 @@ static size_t callchain__fprintf_flat(FILE *fp, struct callchain_node *self,
         if (!self)
                 return 0;
 
-        ret += callchain__fprintf_flat(fp, self->parent, total_samples);
+        ret += __callchain__fprintf_flat(fp, self->parent, total_samples);
 
 
         list_for_each_entry(chain, &self->val, list) {
@@ -677,43 +764,58 @@ static size_t callchain__fprintf_flat(FILE *fp, struct callchain_node *self,
         return ret;
 }
 
-static size_t hist_entry_callchain__fprintf(FILE *fp, struct hist_entry *self,
-                                            u64 total_samples, int left_margin)
+static size_t callchain__fprintf_flat(FILE *fp, struct rb_root *self,
+                                      u64 total_samples)
 {
-        struct rb_node *rb_node;
-        struct callchain_node *chain;
         size_t ret = 0;
         u32 entries_printed = 0;
+        struct rb_node *rb_node;
+        struct callchain_node *chain;
 
-        rb_node = rb_first(&self->sorted_chain);
+        rb_node = rb_first(self);
         while (rb_node) {
                 double percent;
 
                 chain = rb_entry(rb_node, struct callchain_node, rb_node);
                 percent = chain->hit * 100.0 / total_samples;
-                switch (callchain_param.mode) {
-                case CHAIN_FLAT:
-                        ret += percent_color_fprintf(fp, "           %6.2f%%\n",
-                                                     percent);
-                        ret += callchain__fprintf_flat(fp, chain, total_samples);
-                        break;
-                case CHAIN_GRAPH_ABS: /* Falldown */
-                case CHAIN_GRAPH_REL:
-                        ret += callchain__fprintf_graph(fp, chain, total_samples,
-                                                        left_margin);
-                case CHAIN_NONE:
-                default:
-                        break;
-                }
+
+                ret = percent_color_fprintf(fp, "           %6.2f%%\n", percent);
+                ret += __callchain__fprintf_flat(fp, chain, total_samples);
                 ret += fprintf(fp, "\n");
                 if (++entries_printed == callchain_param.print_limit)
                         break;
+
                 rb_node = rb_next(rb_node);
         }
 
         return ret;
 }
 
+static size_t hist_entry_callchain__fprintf(struct hist_entry *he,
+                                            u64 total_samples, int left_margin,
+                                            FILE *fp)
+{
+        switch (callchain_param.mode) {
+        case CHAIN_GRAPH_REL:
+                return callchain__fprintf_graph(fp, &he->sorted_chain, he->period,
+                                                left_margin);
+                break;
+        case CHAIN_GRAPH_ABS:
+                return callchain__fprintf_graph(fp, &he->sorted_chain, total_samples,
+                                                left_margin);
+                break;
+        case CHAIN_FLAT:
+                return callchain__fprintf_flat(fp, &he->sorted_chain, total_samples);
+                break;
+        case CHAIN_NONE:
+                break;
+        default:
+                pr_err("Bad callchain mode\n");
+        }
+
+        return 0;
+}
+
 void hists__output_recalc_col_len(struct hists *hists, int max_rows)
 {
         struct rb_node *next = rb_first(&hists->entries);
@@ -730,35 +832,35 @@ void hists__output_recalc_col_len(struct hists *hists, int max_rows)
         }
 }
 
-static int hist_entry__pcnt_snprintf(struct hist_entry *self, char *s,
+static int hist_entry__pcnt_snprintf(struct hist_entry *he, char *s,
                                      size_t size, struct hists *pair_hists,
                                      bool show_displacement, long displacement,
-                                     bool color, u64 session_total)
+                                     bool color, u64 total_period)
 {
         u64 period, total, period_sys, period_us, period_guest_sys, period_guest_us;
         u64 nr_events;
         const char *sep = symbol_conf.field_sep;
         int ret;
 
-        if (symbol_conf.exclude_other && !self->parent)
+        if (symbol_conf.exclude_other && !he->parent)
                 return 0;
 
         if (pair_hists) {
-                period = self->pair ? self->pair->period : 0;
-                nr_events = self->pair ? self->pair->nr_events : 0;
+                period = he->pair ? he->pair->period : 0;
+                nr_events = he->pair ? he->pair->nr_events : 0;
                 total = pair_hists->stats.total_period;
-                period_sys = self->pair ? self->pair->period_sys : 0;
-                period_us = self->pair ? self->pair->period_us : 0;
-                period_guest_sys = self->pair ? self->pair->period_guest_sys : 0;
-                period_guest_us = self->pair ? self->pair->period_guest_us : 0;
+                period_sys = he->pair ? he->pair->period_sys : 0;
+                period_us = he->pair ? he->pair->period_us : 0;
+                period_guest_sys = he->pair ? he->pair->period_guest_sys : 0;
+                period_guest_us = he->pair ? he->pair->period_guest_us : 0;
         } else {
-                period = self->period;
-                nr_events = self->nr_events;
-                total = session_total;
-                period_sys = self->period_sys;
-                period_us = self->period_us;
-                period_guest_sys = self->period_guest_sys;
-                period_guest_us = self->period_guest_us;
+                period = he->period;
+                nr_events = he->nr_events;
+                total = total_period;
+                period_sys = he->period_sys;
+                period_us = he->period_us;
+                period_guest_sys = he->period_guest_sys;
+                period_guest_us = he->period_guest_us;
         }
 
         if (total) {
@@ -767,7 +869,7 @@ static int hist_entry__pcnt_snprintf(struct hist_entry *self, char *s,
                                                      sep ? "%.2f" : "   %6.2f%%",
                                                      (period * 100.0) / total);
                 else
-                        ret = snprintf(s, size, sep ? "%.2f" : "   %6.2f%%",
+                        ret = scnprintf(s, size, sep ? "%.2f" : "   %6.2f%%",
                                        (period * 100.0) / total);
                 if (symbol_conf.show_cpu_utilization) {
                         ret += percent_color_snprintf(s + ret, size - ret,
@@ -790,20 +892,20 @@ static int hist_entry__pcnt_snprintf(struct hist_entry *self, char *s,
                         }
                 }
         } else
-                ret = snprintf(s, size, sep ? "%" PRIu64 : "%12" PRIu64 " ", period);
+                ret = scnprintf(s, size, sep ? "%" PRIu64 : "%12" PRIu64 " ", period);
 
         if (symbol_conf.show_nr_samples) {
                 if (sep)
-                        ret += snprintf(s + ret, size - ret, "%c%" PRIu64, *sep, nr_events);
+                        ret += scnprintf(s + ret, size - ret, "%c%" PRIu64, *sep, nr_events);
                 else
-                        ret += snprintf(s + ret, size - ret, "%11" PRIu64, nr_events);
+                        ret += scnprintf(s + ret, size - ret, "%11" PRIu64, nr_events);
         }
 
         if (symbol_conf.show_total_period) {
                 if (sep)
-                        ret += snprintf(s + ret, size - ret, "%c%" PRIu64, *sep, period);
+                        ret += scnprintf(s + ret, size - ret, "%c%" PRIu64, *sep, period);
                 else
-                        ret += snprintf(s + ret, size - ret, " %12" PRIu64, period);
+                        ret += scnprintf(s + ret, size - ret, " %12" PRIu64, period);
         }
 
         if (pair_hists) {
@@ -812,31 +914,31 @@ static int hist_entry__pcnt_snprintf(struct hist_entry *self, char *s,
 
                 if (total > 0)
                         old_percent = (period * 100.0) / total;
-                if (session_total > 0)
-                        new_percent = (self->period * 100.0) / session_total;
+                if (total_period > 0)
+                        new_percent = (he->period * 100.0) / total_period;
 
                 diff = new_percent - old_percent;
 
                 if (fabs(diff) >= 0.01)
-                        snprintf(bf, sizeof(bf), "%+4.2F%%", diff);
+                        scnprintf(bf, sizeof(bf), "%+4.2F%%", diff);
                 else
-                        snprintf(bf, sizeof(bf), " ");
+                        scnprintf(bf, sizeof(bf), " ");
 
                 if (sep)
-                        ret += snprintf(s + ret, size - ret, "%c%s", *sep, bf);
+                        ret += scnprintf(s + ret, size - ret, "%c%s", *sep, bf);
                 else
-                        ret += snprintf(s + ret, size - ret, "%11.11s", bf);
+                        ret += scnprintf(s + ret, size - ret, "%11.11s", bf);
 
                 if (show_displacement) {
                         if (displacement)
-                                snprintf(bf, sizeof(bf), "%+4ld", displacement);
+                                scnprintf(bf, sizeof(bf), "%+4ld", displacement);
                         else
-                                snprintf(bf, sizeof(bf), " ");
+                                scnprintf(bf, sizeof(bf), " ");
 
                         if (sep)
-                                ret += snprintf(s + ret, size - ret, "%c%s", *sep, bf);
+                                ret += scnprintf(s + ret, size - ret, "%c%s", *sep, bf);
                         else
-                                ret += snprintf(s + ret, size - ret, "%6.6s", bf);
+                                ret += scnprintf(s + ret, size - ret, "%6.6s", bf);
                 }
         }
 
@@ -854,7 +956,7 @@ int hist_entry__snprintf(struct hist_entry *he, char *s, size_t size,
                 if (se->elide)
                         continue;
 
-                ret += snprintf(s + ret, size - ret, "%s", sep ?: "  ");
+                ret += scnprintf(s + ret, size - ret, "%s", sep ?: "  ");
                 ret += se->se_snprintf(he, s + ret, size - ret,
                                        hists__col_len(hists, se->se_width_idx));
         }
@@ -862,9 +964,10 @@ int hist_entry__snprintf(struct hist_entry *he, char *s, size_t size,
         return ret;
 }
 
-int hist_entry__fprintf(struct hist_entry *he, size_t size, struct hists *hists,
-                        struct hists *pair_hists, bool show_displacement,
-                        long displacement, FILE *fp, u64 session_total)
+static int hist_entry__fprintf(struct hist_entry *he, size_t size,
+                               struct hists *hists, struct hists *pair_hists,
+                               bool show_displacement, long displacement,
+                               u64 total_period, FILE *fp)
 {
         char bf[512];
         int ret;
@@ -874,14 +977,14 @@ int hist_entry__fprintf(struct hist_entry *he, size_t size, struct hists *hists,
 
         ret = hist_entry__pcnt_snprintf(he, bf, size, pair_hists,
                                         show_displacement, displacement,
-                                        true, session_total);
+                                        true, total_period);
         hist_entry__snprintf(he, bf + ret, size - ret, hists);
         return fprintf(fp, "%s\n", bf);
 }
 
-static size_t hist_entry__fprintf_callchain(struct hist_entry *self,
-                                            struct hists *hists, FILE *fp,
-                                            u64 session_total)
+static size_t hist_entry__fprintf_callchain(struct hist_entry *he,
+                                            struct hists *hists,
+                                            u64 total_period, FILE *fp)
 {
         int left_margin = 0;
 
@@ -889,11 +992,10 @@ static size_t hist_entry__fprintf_callchain(struct hist_entry *self,
                 struct sort_entry *se = list_first_entry(&hist_entry__sort_list,
                                                          typeof(*se), list);
                 left_margin = hists__col_len(hists, se->se_width_idx);
-                left_margin -= thread__comm_len(self->thread);
+                left_margin -= thread__comm_len(he->thread);
         }
 
-        return hist_entry_callchain__fprintf(fp, self, session_total,
-                                             left_margin);
+        return hist_entry_callchain__fprintf(he, total_period, left_margin, fp);
 }
 
 size_t hists__fprintf(struct hists *hists, struct hists *pair,
@@ -903,6 +1005,7 @@ size_t hists__fprintf(struct hists *hists, struct hists *pair,
         struct sort_entry *se;
         struct rb_node *nd;
         size_t ret = 0;
+        u64 total_period;
         unsigned long position = 1;
         long displacement = 0;
         unsigned int width;
@@ -917,20 +1020,6 @@ size_t hists__fprintf(struct hists *hists, struct hists *pair,
 
         fprintf(fp, "# %s", pair ? "Baseline" : "Overhead");
 
-        if (symbol_conf.show_nr_samples) {
-                if (sep)
-                        fprintf(fp, "%cSamples", *sep);
-                else
-                        fputs("  Samples  ", fp);
-        }
-
-        if (symbol_conf.show_total_period) {
-                if (sep)
-                        ret += fprintf(fp, "%cPeriod", *sep);
-                else
-                        ret += fprintf(fp, "   Period    ");
-        }
-
         if (symbol_conf.show_cpu_utilization) {
                 if (sep) {
                         ret += fprintf(fp, "%csys", *sep);
@@ -940,8 +1029,8 @@ size_t hists__fprintf(struct hists *hists, struct hists *pair,
                                 ret += fprintf(fp, "%cguest us", *sep);
                         }
                 } else {
-                        ret += fprintf(fp, "  sys  ");
-                        ret += fprintf(fp, "  us  ");
+                        ret += fprintf(fp, "     sys  ");
+                        ret += fprintf(fp, "      us  ");
                         if (perf_guest) {
                                 ret += fprintf(fp, "  guest sys  ");
                                 ret += fprintf(fp, "  guest us  ");
@@ -949,6 +1038,20 @@ size_t hists__fprintf(struct hists *hists, struct hists *pair,
                 }
         }
 
+        if (symbol_conf.show_nr_samples) {
+                if (sep)
+                        fprintf(fp, "%cSamples", *sep);
+                else
+                        fputs("  Samples  ", fp);
+        }
+
+        if (symbol_conf.show_total_period) {
+                if (sep)
+                        ret += fprintf(fp, "%cPeriod", *sep);
+                else
+                        ret += fprintf(fp, "   Period    ");
+        }
+
         if (pair) {
                 if (sep)
                         ret += fprintf(fp, "%cDelta", *sep);
@@ -993,6 +1096,8 @@ size_t hists__fprintf(struct hists *hists, struct hists *pair,
                 goto print_entries;
 
         fprintf(fp, "# ........");
+        if (symbol_conf.show_cpu_utilization)
+                fprintf(fp, "   .......   .......");
         if (symbol_conf.show_nr_samples)
                 fprintf(fp, " ..........");
         if (symbol_conf.show_total_period)
@@ -1025,6 +1130,8 @@ size_t hists__fprintf(struct hists *hists, struct hists *pair,
                 goto out;
 
 print_entries:
+        total_period = hists->stats.total_period;
+
         for (nd = rb_first(&hists->entries); nd; nd = rb_next(nd)) {
                 struct hist_entry *h = rb_entry(nd, struct hist_entry, rb_node);
 
@@ -1040,11 +1147,10 @@ print_entries:
                         ++position;
                 }
                 ret += hist_entry__fprintf(h, max_cols, hists, pair, show_displacement,
-                                           displacement, fp, hists->stats.total_period);
+                                           displacement, total_period, fp);
 
                 if (symbol_conf.use_callchain)
-                        ret += hist_entry__fprintf_callchain(h, hists, fp,
-                                                             hists->stats.total_period);
+                        ret += hist_entry__fprintf_callchain(h, hists, total_period, fp);
                 if (max_rows && ++nr_rows >= max_rows)
                         goto out;
 
@@ -1174,6 +1280,37 @@ void hists__filter_by_thread(struct hists *hists)
         }
 }
 
+static bool hists__filter_entry_by_symbol(struct hists *hists,
+                                          struct hist_entry *he)
+{
+        if (hists->symbol_filter_str != NULL &&
+            (!he->ms.sym || strstr(he->ms.sym->name,
+                                   hists->symbol_filter_str) == NULL)) {
+                he->filtered |= (1 << HIST_FILTER__SYMBOL);
+                return true;
+        }
+
+        return false;
+}
+
+void hists__filter_by_symbol(struct hists *hists)
+{
+        struct rb_node *nd;
+
+        hists->nr_entries = hists->stats.total_period = 0;
+        hists->stats.nr_events[PERF_RECORD_SAMPLE] = 0;
+        hists__reset_col_len(hists);
+
+        for (nd = rb_first(&hists->entries); nd; nd = rb_next(nd)) {
+                struct hist_entry *h = rb_entry(nd, struct hist_entry, rb_node);
+
+                if (hists__filter_entry_by_symbol(hists, h))
+                        continue;
+
+                hists__remove_entry_filter(hists, h, HIST_FILTER__SYMBOL);
+        }
+}
+
 int hist_entry__inc_addr_samples(struct hist_entry *he, int evidx, u64 ip)
 {
         return symbol__inc_addr_samples(he->ms.sym, he->ms.map, evidx, ip);
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index ff6f9d56ea41..2cae9df40e04 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -32,6 +32,7 @@ struct events_stats {
         u32 nr_unknown_events;
         u32 nr_invalid_chains;
         u32 nr_unknown_id;
+        u32 nr_unprocessable_samples;
 };
 
 enum hist_column {
@@ -41,6 +42,11 @@ enum hist_column {
         HISTC_COMM,
         HISTC_PARENT,
         HISTC_CPU,
+        HISTC_MISPREDICT,
+        HISTC_SYMBOL_FROM,
+        HISTC_SYMBOL_TO,
+        HISTC_DSO_FROM,
+        HISTC_DSO_TO,
         HISTC_NR_COLS, /* Last entry */
 };
 
@@ -55,6 +61,8 @@ struct hists {
         u64                     nr_entries;
         const struct thread     *thread_filter;
         const struct dso        *dso_filter;
+        const char              *uid_filter_str;
+        const char              *symbol_filter_str;
         pthread_mutex_t         lock;
         struct events_stats     stats;
         u64                     event_stream;
@@ -66,15 +74,18 @@ struct hists {
 struct hist_entry *__hists__add_entry(struct hists *self,
                                       struct addr_location *al,
                                       struct symbol *parent, u64 period);
-extern int64_t hist_entry__cmp(struct hist_entry *, struct hist_entry *);
-extern int64_t hist_entry__collapse(struct hist_entry *, struct hist_entry *);
-int hist_entry__fprintf(struct hist_entry *he, size_t size, struct hists *hists,
-                        struct hists *pair_hists, bool show_displacement,
-                        long displacement, FILE *fp, u64 session_total);
+int64_t hist_entry__cmp(struct hist_entry *left, struct hist_entry *right);
+int64_t hist_entry__collapse(struct hist_entry *left, struct hist_entry *right);
 int hist_entry__snprintf(struct hist_entry *self, char *bf, size_t size,
                          struct hists *hists);
 void hist_entry__free(struct hist_entry *);
 
+struct hist_entry *__hists__add_branch_entry(struct hists *self,
+                                             struct addr_location *al,
+                                             struct symbol *sym_parent,
+                                             struct branch_info *bi,
+                                             u64 period);
+
 void hists__output_resort(struct hists *self);
 void hists__output_resort_threaded(struct hists *hists);
 void hists__collapse_resort(struct hists *self);
@@ -97,6 +108,7 @@ int hist_entry__annotate(struct hist_entry *self, size_t privsize);
 
 void hists__filter_by_dso(struct hists *hists);
 void hists__filter_by_thread(struct hists *hists);
+void hists__filter_by_symbol(struct hists *hists);
 
 u16 hists__col_len(struct hists *self, enum hist_column col);
 void hists__set_col_len(struct hists *self, enum hist_column col, u16 len);
@@ -135,6 +147,23 @@ int perf_evlist__tui_browse_hists(struct perf_evlist *evlist, const char *help,
                                   int refresh);
 #endif
 
+#ifdef NO_GTK2_SUPPORT
+static inline
+int perf_evlist__gtk_browse_hists(struct perf_evlist *evlist __used,
+                                  const char *help __used,
+                                  void(*timer)(void *arg) __used,
+                                  void *arg __used,
+                                  int refresh __used)
+{
+        return 0;
+}
+
+#else
+int perf_evlist__gtk_browse_hists(struct perf_evlist *evlist, const char *help,
+                                  void(*timer)(void *arg), void *arg,
+                                  int refresh);
+#endif
+
 unsigned int hists__sort_list_width(struct hists *self);
 
 #endif  /* __PERF_HIST_H */
diff --git a/tools/perf/util/include/asm/dwarf2.h b/tools/perf/util/include/asm/dwarf2.h
index bb4198e7837a..afe38199e922 100644
--- a/tools/perf/util/include/asm/dwarf2.h
+++ b/tools/perf/util/include/asm/dwarf2.h
@@ -2,10 +2,12 @@
 #ifndef PERF_DWARF2_H
 #define PERF_DWARF2_H
 
-/* dwarf2.h ... dummy header file for including arch/x86/lib/memcpy_64.S */
+/* dwarf2.h ... dummy header file for including arch/x86/lib/mem{cpy,set}_64.S */
 
 #define CFI_STARTPROC
 #define CFI_ENDPROC
+#define CFI_REMEMBER_STATE
+#define CFI_RESTORE_STATE
 
 #endif  /* PERF_DWARF2_H */
 
diff --git a/tools/perf/util/include/asm/unistd_32.h b/tools/perf/util/include/asm/unistd_32.h
new file mode 100644
index 000000000000..8b137891791f
--- /dev/null
+++ b/tools/perf/util/include/asm/unistd_32.h
@@ -0,0 +1 @@
+
diff --git a/tools/perf/util/include/asm/unistd_64.h b/tools/perf/util/include/asm/unistd_64.h
new file mode 100644
index 000000000000..8b137891791f
--- /dev/null
+++ b/tools/perf/util/include/asm/unistd_64.h
@@ -0,0 +1 @@
+
diff --git a/tools/perf/util/include/linux/bitmap.h b/tools/perf/util/include/linux/bitmap.h
index eda4416efa0a..bb162e40c76c 100644
--- a/tools/perf/util/include/linux/bitmap.h
+++ b/tools/perf/util/include/linux/bitmap.h
@@ -5,6 +5,8 @@
 #include <linux/bitops.h>
 
 int __bitmap_weight(const unsigned long *bitmap, int bits);
+void __bitmap_or(unsigned long *dst, const unsigned long *bitmap1,
+                 const unsigned long *bitmap2, int bits);
 
 #define BITMAP_LAST_WORD_MASK(nbits)                                    \
 (                                                                       \
@@ -32,4 +34,13 @@ static inline int bitmap_weight(const unsigned long *src, int nbits)
         return __bitmap_weight(src, nbits);
 }
 
+static inline void bitmap_or(unsigned long *dst, const unsigned long *src1,
+                             const unsigned long *src2, int nbits)
+{
+        if (small_const_nbits(nbits))
+                *dst = *src1 | *src2;
+        else
+                __bitmap_or(dst, src1, src2, nbits);
+}
+
 #endif /* _PERF_BITOPS_H */
diff --git a/tools/perf/util/include/linux/bitops.h b/tools/perf/util/include/linux/bitops.h
index 62cdee78db7b..f1584833bd22 100644
--- a/tools/perf/util/include/linux/bitops.h
+++ b/tools/perf/util/include/linux/bitops.h
@@ -15,7 +15,7 @@
              (bit) = find_next_bit((addr), (size), (bit) + 1))
 
 /* same as for_each_set_bit() but use bit as value to start with */
-#define for_each_set_bit_cont(bit, addr, size) \
+#define for_each_set_bit_from(bit, addr, size) \
         for ((bit) = find_next_bit((addr), (size), (bit));      \
              (bit) < (size);                                    \
              (bit) = find_next_bit((addr), (size), (bit) + 1))
diff --git a/tools/perf/util/include/linux/module.h b/tools/perf/util/include/linux/export.h
index b43e2dc21e04..b43e2dc21e04 100644
--- a/tools/perf/util/include/linux/module.h
+++ b/tools/perf/util/include/linux/export.h
diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
index 316aa0ab7122..dea6d1c1a954 100644
--- a/tools/perf/util/map.c
+++ b/tools/perf/util/map.c
@@ -212,6 +212,21 @@ size_t map__fprintf(struct map *self, FILE *fp)
                        self->start, self->end, self->pgoff, self->dso->name);
 }
 
+size_t map__fprintf_dsoname(struct map *map, FILE *fp)
+{
+        const char *dsoname;
+
+        if (map && map->dso && (map->dso->name || map->dso->long_name)) {
+                if (symbol_conf.show_kernel_path && map->dso->long_name)
+                        dsoname = map->dso->long_name;
+                else if (map->dso->name)
+                        dsoname = map->dso->name;
+        } else
+                dsoname = "[unknown]";
+
+        return fprintf(fp, "%s", dsoname);
+}
+
 /*
  * objdump wants/reports absolute IPs for ET_EXEC, and RIPs for ET_DYN.
  * map->dso->adjust_symbols==1 for ET_EXEC-like cases.
diff --git a/tools/perf/util/map.h b/tools/perf/util/map.h
index 2b8017f8a930..b100c20b7f94 100644
--- a/tools/perf/util/map.h
+++ b/tools/perf/util/map.h
@@ -118,6 +118,7 @@ void map__delete(struct map *self);
 struct map *map__clone(struct map *self);
 int map__overlap(struct map *l, struct map *r);
 size_t map__fprintf(struct map *self, FILE *fp);
+size_t map__fprintf_dsoname(struct map *map, FILE *fp);
 
 int map__load(struct map *self, symbol_filter_t filter);
 struct symbol *map__find_symbol(struct map *self,
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 531c283fc0c5..5b3a0ef4e232 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -11,6 +11,10 @@
 #include "cache.h"
 #include "header.h"
 #include "debugfs.h"
+#include "parse-events-flex.h"
+#include "pmu.h"
+
+#define MAX_NAME_LEN 100
 
 struct event_symbol {
         u8              type;
@@ -19,11 +23,8 @@ struct event_symbol {
         const char      *alias;
 };
 
-enum event_result {
-        EVT_FAILED,
-        EVT_HANDLED,
-        EVT_HANDLED_ALL
-};
+int parse_events_parse(struct list_head *list, struct list_head *list_tmp,
+                       int *idx);
 
 #define CHW(x) .type = PERF_TYPE_HARDWARE, .config = PERF_COUNT_HW_##x
 #define CSW(x) .type = PERF_TYPE_SOFTWARE, .config = PERF_COUNT_SW_##x
@@ -165,7 +166,7 @@ struct tracepoint_path *tracepoint_id_to_path(u64 config)
         struct tracepoint_path *path = NULL;
         DIR *sys_dir, *evt_dir;
         struct dirent *sys_next, *evt_next, sys_dirent, evt_dirent;
-        char id_buf[4];
+        char id_buf[24];
         int fd;
         u64 id;
         char evt_path[MAXPATHLEN];
@@ -354,7 +355,24 @@ const char *__event_name(int type, u64 config)
         return "unknown";
 }
 
-static int parse_aliases(const char **str, const char *names[][MAX_ALIASES], int size)
+static int add_event(struct list_head *list, int *idx,
+                     struct perf_event_attr *attr, char *name)
+{
+        struct perf_evsel *evsel;
+
+        event_attr_init(attr);
+
+        evsel = perf_evsel__new(attr, (*idx)++);
+        if (!evsel)
+                return -ENOMEM;
+
+        list_add_tail(&evsel->node, list);
+
+        evsel->name = strdup(name);
+        return 0;
+}
+
+static int parse_aliases(char *str, const char *names[][MAX_ALIASES], int size)
 {
         int i, j;
         int n, longest = -1;
@@ -362,58 +380,57 @@ static int parse_aliases(const char **str, const char *names[][MAX_ALIASES], int
         for (i = 0; i < size; i++) {
                 for (j = 0; j < MAX_ALIASES && names[i][j]; j++) {
                         n = strlen(names[i][j]);
-                        if (n > longest && !strncasecmp(*str, names[i][j], n))
+                        if (n > longest && !strncasecmp(str, names[i][j], n))
                                 longest = n;
                 }
-                if (longest > 0) {
-                        *str += longest;
+                if (longest > 0)
                         return i;
-                }
         }
 
         return -1;
 }
 
-static enum event_result
-parse_generic_hw_event(const char **str, struct perf_event_attr *attr)
+int parse_events_add_cache(struct list_head *list, int *idx,
+                           char *type, char *op_result1, char *op_result2)
 {
-        const char *s = *str;
+        struct perf_event_attr attr;
+        char name[MAX_NAME_LEN];
         int cache_type = -1, cache_op = -1, cache_result = -1;
+        char *op_result[2] = { op_result1, op_result2 };
+        int i, n;
 
-        cache_type = parse_aliases(&s, hw_cache, PERF_COUNT_HW_CACHE_MAX);
         /*
          * No fallback - if we cannot get a clear cache type
          * then bail out:
          */
+        cache_type = parse_aliases(type, hw_cache,
+                                   PERF_COUNT_HW_CACHE_MAX);
         if (cache_type == -1)
-                return EVT_FAILED;
+                return -EINVAL;
+
+        n = snprintf(name, MAX_NAME_LEN, "%s", type);
+
+        for (i = 0; (i < 2) && (op_result[i]); i++) {
+                char *str = op_result[i];
 
-        while ((cache_op == -1 || cache_result == -1) && *s == '-') {
-                ++s;
+                snprintf(name + n, MAX_NAME_LEN - n, "-%s\n", str);
 
                 if (cache_op == -1) {
-                        cache_op = parse_aliases(&s, hw_cache_op,
-                                                PERF_COUNT_HW_CACHE_OP_MAX);
+                        cache_op = parse_aliases(str, hw_cache_op,
+                                                 PERF_COUNT_HW_CACHE_OP_MAX);
                         if (cache_op >= 0) {
                                 if (!is_cache_op_valid(cache_type, cache_op))
-                                        return EVT_FAILED;
+                                        return -EINVAL;
                                 continue;
                         }
                 }
 
                 if (cache_result == -1) {
-                        cache_result = parse_aliases(&s, hw_cache_result,
+                        cache_result = parse_aliases(str, hw_cache_result,
                                                 PERF_COUNT_HW_CACHE_RESULT_MAX);
                         if (cache_result >= 0)
                                 continue;
                 }
-
-                /*
-                 * Can't parse this as a cache op or result, so back up
-                 * to the '-'.
-                 */
-                --s;
-                break;
         }
 
         /*
@@ -428,20 +445,17 @@ parse_generic_hw_event(const char **str, struct perf_event_attr *attr)
         if (cache_result == -1)
                 cache_result = PERF_COUNT_HW_CACHE_RESULT_ACCESS;
 
-        attr->config = cache_type | (cache_op << 8) | (cache_result << 16);
-        attr->type = PERF_TYPE_HW_CACHE;
-
-        *str = s;
-        return EVT_HANDLED;
+        memset(&attr, 0, sizeof(attr));
+        attr.config = cache_type | (cache_op << 8) | (cache_result << 16);
+        attr.type = PERF_TYPE_HW_CACHE;
+        return add_event(list, idx, &attr, name);
 }
 
-static enum event_result
-parse_single_tracepoint_event(char *sys_name,
-                              const char *evt_name,
-                              unsigned int evt_length,
-                              struct perf_event_attr *attr,
-                              const char **strp)
+static int add_tracepoint(struct list_head *list, int *idx,
+                          char *sys_name, char *evt_name)
 {
+        struct perf_event_attr attr;
+        char name[MAX_NAME_LEN];
         char evt_path[MAXPATHLEN];
         char id_buf[4];
         u64 id;
@@ -452,130 +466,80 @@ parse_single_tracepoint_event(char *sys_name,
 
         fd = open(evt_path, O_RDONLY);
         if (fd < 0)
-                return EVT_FAILED;
+                return -1;
 
         if (read(fd, id_buf, sizeof(id_buf)) < 0) {
                 close(fd);
-                return EVT_FAILED;
+                return -1;
         }
 
         close(fd);
         id = atoll(id_buf);
-        attr->config = id;
-        attr->type = PERF_TYPE_TRACEPOINT;
-        *strp += strlen(sys_name) + evt_length + 1; /* + 1 for the ':' */
-
-        attr->sample_type |= PERF_SAMPLE_RAW;
-        attr->sample_type |= PERF_SAMPLE_TIME;
-        attr->sample_type |= PERF_SAMPLE_CPU;
 
-        attr->sample_period = 1;
+        memset(&attr, 0, sizeof(attr));
+        attr.config = id;
+        attr.type = PERF_TYPE_TRACEPOINT;
+        attr.sample_type |= PERF_SAMPLE_RAW;
+        attr.sample_type |= PERF_SAMPLE_TIME;
+        attr.sample_type |= PERF_SAMPLE_CPU;
+        attr.sample_period = 1;
 
-
-        return EVT_HANDLED;
+        snprintf(name, MAX_NAME_LEN, "%s:%s", sys_name, evt_name);
+        return add_event(list, idx, &attr, name);
 }
 
-/* sys + ':' + event + ':' + flags*/
-#define MAX_EVOPT_LEN   (MAX_EVENT_LENGTH * 2 + 2 + 128)
-static enum event_result
-parse_multiple_tracepoint_event(struct perf_evlist *evlist, char *sys_name,
-                                const char *evt_exp, char *flags)
+static int add_tracepoint_multi(struct list_head *list, int *idx,
+                                char *sys_name, char *evt_name)
 {
         char evt_path[MAXPATHLEN];
         struct dirent *evt_ent;
         DIR *evt_dir;
+        int ret = 0;
 
         snprintf(evt_path, MAXPATHLEN, "%s/%s", tracing_events_path, sys_name);
         evt_dir = opendir(evt_path);
-
         if (!evt_dir) {
                 perror("Can't open event dir");
-                return EVT_FAILED;
+                return -1;
         }
 
-        while ((evt_ent = readdir(evt_dir))) {
-                char event_opt[MAX_EVOPT_LEN + 1];
-                int len;
-
+        while (!ret && (evt_ent = readdir(evt_dir))) {
                 if (!strcmp(evt_ent->d_name, ".")
                     || !strcmp(evt_ent->d_name, "..")
                     || !strcmp(evt_ent->d_name, "enable")
                     || !strcmp(evt_ent->d_name, "filter"))
                         continue;
 
-                if (!strglobmatch(evt_ent->d_name, evt_exp))
+                if (!strglobmatch(evt_ent->d_name, evt_name))
                         continue;
 
-                len = snprintf(event_opt, MAX_EVOPT_LEN, "%s:%s%s%s", sys_name,
-                               evt_ent->d_name, flags ? ":" : "",
-                               flags ?: "");
-                if (len < 0)
-                        return EVT_FAILED;
-
-                if (parse_events(evlist, event_opt, 0))
-                        return EVT_FAILED;
+                ret = add_tracepoint(list, idx, sys_name, evt_ent->d_name);
         }
 
-        return EVT_HANDLED_ALL;
+        return ret;
 }
 
-static enum event_result
-parse_tracepoint_event(struct perf_evlist *evlist, const char **strp,
-                       struct perf_event_attr *attr)
+int parse_events_add_tracepoint(struct list_head *list, int *idx,
+                                char *sys, char *event)
 {
-        const char *evt_name;
-        char *flags = NULL, *comma_loc;
-        char sys_name[MAX_EVENT_LENGTH];
-        unsigned int sys_length, evt_length;
-
-        if (debugfs_valid_mountpoint(tracing_events_path))
-                return 0;
-
-        evt_name = strchr(*strp, ':');
-        if (!evt_name)
-                return EVT_FAILED;
-
-        sys_length = evt_name - *strp;
-        if (sys_length >= MAX_EVENT_LENGTH)
-                return 0;
+        int ret;
 
-        strncpy(sys_name, *strp, sys_length);
-        sys_name[sys_length] = '\0';
-        evt_name = evt_name + 1;
+        ret = debugfs_valid_mountpoint(tracing_events_path);
+        if (ret)
+                return ret;
 
-        comma_loc = strchr(evt_name, ',');
-        if (comma_loc) {
-                /* take the event name up to the comma */
-                evt_name = strndup(evt_name, comma_loc - evt_name);
-        }
-        flags = strchr(evt_name, ':');
-        if (flags) {
-                /* split it out: */
-                evt_name = strndup(evt_name, flags - evt_name);
-                flags++;
-        }
-
-        evt_length = strlen(evt_name);
-        if (evt_length >= MAX_EVENT_LENGTH)
-                return EVT_FAILED;
-        if (strpbrk(evt_name, "*?")) {
-                *strp += strlen(sys_name) + evt_length + 1; /* 1 == the ':' */
-                return parse_multiple_tracepoint_event(evlist, sys_name,
-                                                       evt_name, flags);
-        } else {
-                return parse_single_tracepoint_event(sys_name, evt_name,
-                                                     evt_length, attr, strp);
-        }
+        return strpbrk(event, "*?") ?
+               add_tracepoint_multi(list, idx, sys, event) :
+               add_tracepoint(list, idx, sys, event);
 }
 
-static enum event_result
-parse_breakpoint_type(const char *type, const char **strp,
-                      struct perf_event_attr *attr)
+static int
+parse_breakpoint_type(const char *type, struct perf_event_attr *attr)
 {
         int i;
 
         for (i = 0; i < 3; i++) {
-                if (!type[i])
+                if (!type || !type[i])
                         break;
 
                 switch (type[i]) {
@@ -589,164 +553,146 @@ parse_breakpoint_type(const char *type, const char **strp,
                         attr->bp_type |= HW_BREAKPOINT_X;
                         break;
                 default:
-                        return EVT_FAILED;
+                        return -EINVAL;
                 }
         }
+
         if (!attr->bp_type) /* Default */
                 attr->bp_type = HW_BREAKPOINT_R | HW_BREAKPOINT_W;
 
-        *strp = type + i;
-
-        return EVT_HANDLED;
+        return 0;
 }
 
-static enum event_result
-parse_breakpoint_event(const char **strp, struct perf_event_attr *attr)
+int parse_events_add_breakpoint(struct list_head *list, int *idx,
+                                void *ptr, char *type)
 {
-        const char *target;
-        const char *type;
-        char *endaddr;
-        u64 addr;
-        enum event_result err;
-
-        target = strchr(*strp, ':');
-        if (!target)
-                return EVT_FAILED;
-
-        if (strncmp(*strp, "mem", target - *strp) != 0)
-                return EVT_FAILED;
-
-        target++;
-
-        addr = strtoull(target, &endaddr, 0);
-        if (target == endaddr)
-                return EVT_FAILED;
-
-        attr->bp_addr = addr;
-        *strp = endaddr;
+        struct perf_event_attr attr;
+        char name[MAX_NAME_LEN];
 
-        type = strchr(target, ':');
+        memset(&attr, 0, sizeof(attr));
+        attr.bp_addr = (unsigned long) ptr;
 
-        /* If no type is defined, just rw as default */
-        if (!type) {
-                attr->bp_type = HW_BREAKPOINT_R | HW_BREAKPOINT_W;
-        } else {
-                err = parse_breakpoint_type(++type, strp, attr);
-                if (err == EVT_FAILED)
-                        return EVT_FAILED;
-        }
+        if (parse_breakpoint_type(type, &attr))
+                return -EINVAL;
 
         /*
          * We should find a nice way to override the access length
          * Provide some defaults for now
          */
-        if (attr->bp_type == HW_BREAKPOINT_X)
-                attr->bp_len = sizeof(long);
+        if (attr.bp_type == HW_BREAKPOINT_X)
+                attr.bp_len = sizeof(long);
         else
-                attr->bp_len = HW_BREAKPOINT_LEN_4;
+                attr.bp_len = HW_BREAKPOINT_LEN_4;
 
-        attr->type = PERF_TYPE_BREAKPOINT;
+        attr.type = PERF_TYPE_BREAKPOINT;
 
-        return EVT_HANDLED;
+        snprintf(name, MAX_NAME_LEN, "mem:%p:%s", ptr, type ? type : "rw");
+        return add_event(list, idx, &attr, name);
 }
 
-static int check_events(const char *str, unsigned int i)
+static int config_term(struct perf_event_attr *attr,
+                       struct parse_events__term *term)
 {
-        int n;
+        switch (term->type) {
+        case PARSE_EVENTS__TERM_TYPE_CONFIG:
+                attr->config = term->val.num;
+                break;
+        case PARSE_EVENTS__TERM_TYPE_CONFIG1:
+                attr->config1 = term->val.num;
+                break;
+        case PARSE_EVENTS__TERM_TYPE_CONFIG2:
+                attr->config2 = term->val.num;
+                break;
+        case PARSE_EVENTS__TERM_TYPE_SAMPLE_PERIOD:
+                attr->sample_period = term->val.num;
+                break;
+        case PARSE_EVENTS__TERM_TYPE_BRANCH_SAMPLE_TYPE:
+                /*
+                 * TODO uncomment when the field is available
+                 * attr->branch_sample_type = term->val.num;
+                 */
+                break;
+        default:
+                return -EINVAL;
+        }
+        return 0;
+}
 
-        n = strlen(event_symbols[i].symbol);
-        if (!strncasecmp(str, event_symbols[i].symbol, n))
-                return n;
+static int config_attr(struct perf_event_attr *attr,
+                       struct list_head *head, int fail)
+{
+        struct parse_events__term *term;
 
-        n = strlen(event_symbols[i].alias);
-        if (n) {
-                if (!strncasecmp(str, event_symbols[i].alias, n))
-                        return n;
-        }
+        list_for_each_entry(term, head, list)
+                if (config_term(attr, term) && fail)
+                        return -EINVAL;
 
         return 0;
 }
 
-static enum event_result
-parse_symbolic_event(const char **strp, struct perf_event_attr *attr)
+int parse_events_add_numeric(struct list_head *list, int *idx,
+                             unsigned long type, unsigned long config,
+                             struct list_head *head_config)
 {
-        const char *str = *strp;
-        unsigned int i;
-        int n;
-
-        for (i = 0; i < ARRAY_SIZE(event_symbols); i++) {
-                n = check_events(str, i);
-                if (n > 0) {
-                        attr->type = event_symbols[i].type;
-                        attr->config = event_symbols[i].config;
-                        *strp = str + n;
-                        return EVT_HANDLED;
-                }
-        }
-        return EVT_FAILED;
+        struct perf_event_attr attr;
+
+        memset(&attr, 0, sizeof(attr));
+        attr.type = type;
+        attr.config = config;
+
+        if (head_config &&
+            config_attr(&attr, head_config, 1))
+                return -EINVAL;
+
+        return add_event(list, idx, &attr,
+                         (char *) __event_name(type, config));
 }
 
-static enum event_result
-parse_raw_event(const char **strp, struct perf_event_attr *attr)
+int parse_events_add_pmu(struct list_head *list, int *idx,
+                         char *name, struct list_head *head_config)
 {
-        const char *str = *strp;
-        u64 config;
-        int n;
-
-        if (*str != 'r')
-                return EVT_FAILED;
-        n = hex2u64(str + 1, &config);
-        if (n > 0) {
-                const char *end = str + n + 1;
-                if (*end != '\0' && *end != ',' && *end != ':')
-                        return EVT_FAILED;
-
-                *strp = end;
-                attr->type = PERF_TYPE_RAW;
-                attr->config = config;
-                return EVT_HANDLED;
-        }
-        return EVT_FAILED;
+        struct perf_event_attr attr;
+        struct perf_pmu *pmu;
+
+        pmu = perf_pmu__find(name);
+        if (!pmu)
+                return -EINVAL;
+
+        memset(&attr, 0, sizeof(attr));
+
+        /*
+         * Configure hardcoded terms first, no need to check
+         * return value when called with fail == 0 ;)
+         */
+        config_attr(&attr, head_config, 0);
+
+        if (perf_pmu__config(pmu, &attr, head_config))
+                return -EINVAL;
+
+        return add_event(list, idx, &attr, (char *) "pmu");
 }
 
-static enum event_result
-parse_numeric_event(const char **strp, struct perf_event_attr *attr)
+void parse_events_update_lists(struct list_head *list_event,
+                               struct list_head *list_all)
 {
-        const char *str = *strp;
-        char *endp;
-        unsigned long type;
-        u64 config;
-
-        type = strtoul(str, &endp, 0);
-        if (endp > str && type < PERF_TYPE_MAX && *endp == ':') {
-                str = endp + 1;
-                config = strtoul(str, &endp, 0);
-                if (endp > str) {
-                        attr->type = type;
-                        attr->config = config;
-                        *strp = endp;
-                        return EVT_HANDLED;
-                }
-        }
-        return EVT_FAILED;
+        /*
+         * Called for single event definition. Update the
+         * 'all event' list, and reinit the 'signle event'
+         * list, for next event definition.
+         */
+        list_splice_tail(list_event, list_all);
+        INIT_LIST_HEAD(list_event);
 }
 
-static int
-parse_event_modifier(const char **strp, struct perf_event_attr *attr)
+int parse_events_modifier(struct list_head *list, char *str)
 {
-        const char *str = *strp;
-        int exclude = 0;
-        int eu = 0, ek = 0, eh = 0, precise = 0;
+        struct perf_evsel *evsel;
+        int exclude = 0, exclude_GH = 0;
+        int eu = 0, ek = 0, eh = 0, eH = 0, eG = 0, precise = 0;
 
-        if (!*str)
+        if (str == NULL)
                 return 0;
 
-        if (*str == ',')
-                return 0;
-
-        if (*str++ != ':')
-                return -1;
-
         while (*str) {
                 if (*str == 'u') {
                         if (!exclude)
@@ -760,6 +706,14 @@ parse_event_modifier(const char **strp, struct perf_event_attr *attr)
                         if (!exclude)
                                 exclude = eu = ek = eh = 1;
                         eh = 0;
+                } else if (*str == 'G') {
+                        if (!exclude_GH)
+                                exclude_GH = eG = eH = 1;
+                        eG = 0;
+                } else if (*str == 'H') {
+                        if (!exclude_GH)
+                                exclude_GH = eG = eH = 1;
+                        eH = 0;
                 } else if (*str == 'p') {
                         precise++;
                 } else
@@ -767,108 +721,62 @@ parse_event_modifier(const char **strp, struct perf_event_attr *attr)
 
                 ++str;
         }
-        if (str < *strp + 2)
-                return -1;
 
-        *strp = str;
+        /*
+         * precise ip:
+         *
+         *  0 - SAMPLE_IP can have arbitrary skid
+         *  1 - SAMPLE_IP must have constant skid
+         *  2 - SAMPLE_IP requested to have 0 skid
+         *  3 - SAMPLE_IP must have 0 skid
+         *
+         *  See also PERF_RECORD_MISC_EXACT_IP
+         */
+        if (precise > 3)
+                return -EINVAL;
 
-        attr->exclude_user   = eu;
-        attr->exclude_kernel = ek;
-        attr->exclude_hv     = eh;
-        attr->precise_ip     = precise;
+        list_for_each_entry(evsel, list, node) {
+                evsel->attr.exclude_user   = eu;
+                evsel->attr.exclude_kernel = ek;
+                evsel->attr.exclude_hv     = eh;
+                evsel->attr.precise_ip     = precise;
+                evsel->attr.exclude_host   = eH;
+                evsel->attr.exclude_guest  = eG;
+        }
 
         return 0;
 }
 
-/*
- * Each event can have multiple symbolic names.
- * Symbolic names are (almost) exactly matched.
- */
-static enum event_result
-parse_event_symbols(struct perf_evlist *evlist, const char **str,
-                    struct perf_event_attr *attr)
+int parse_events(struct perf_evlist *evlist, const char *str, int unset __used)
 {
-        enum event_result ret;
-
-        ret = parse_tracepoint_event(evlist, str, attr);
-        if (ret != EVT_FAILED)
-                goto modifier;
-
-        ret = parse_raw_event(str, attr);
-        if (ret != EVT_FAILED)
-                goto modifier;
+        LIST_HEAD(list);
+        LIST_HEAD(list_tmp);
+        YY_BUFFER_STATE buffer;
+        int ret, idx = evlist->nr_entries;
 
-        ret = parse_numeric_event(str, attr);
-        if (ret != EVT_FAILED)
-                goto modifier;
+        buffer = parse_events__scan_string(str);
 
-        ret = parse_symbolic_event(str, attr);
-        if (ret != EVT_FAILED)
-                goto modifier;
+        ret = parse_events_parse(&list, &list_tmp, &idx);
 
-        ret = parse_generic_hw_event(str, attr);
-        if (ret != EVT_FAILED)
-                goto modifier;
+        parse_events__flush_buffer(buffer);
+        parse_events__delete_buffer(buffer);
 
-        ret = parse_breakpoint_event(str, attr);
-        if (ret != EVT_FAILED)
-                goto modifier;
-
-        fprintf(stderr, "invalid or unsupported event: '%s'\n", *str);
-        fprintf(stderr, "Run 'perf list' for a list of valid events\n");
-        return EVT_FAILED;
-
-modifier:
-        if (parse_event_modifier(str, attr) < 0) {
-                fprintf(stderr, "invalid event modifier: '%s'\n", *str);
-                fprintf(stderr, "Run 'perf list' for a list of valid events and modifiers\n");
-
-                return EVT_FAILED;
+        if (!ret) {
+                int entries = idx - evlist->nr_entries;
+                perf_evlist__splice_list_tail(evlist, &list, entries);
+                return 0;
         }
 
+        /*
+         * There are 2 users - builtin-record and builtin-test objects.
+         * Both call perf_evlist__delete in case of error, so we dont
+         * need to bother.
+         */
+        fprintf(stderr, "invalid or unsupported event: '%s'\n", str);
+        fprintf(stderr, "Run 'perf list' for a list of valid events\n");
         return ret;
 }
 
-int parse_events(struct perf_evlist *evlist , const char *str, int unset __used)
-{
-        struct perf_event_attr attr;
-        enum event_result ret;
-        const char *ostr;
-
-        for (;;) {
-                ostr = str;
-                memset(&attr, 0, sizeof(attr));
-                ret = parse_event_symbols(evlist, &str, &attr);
-                if (ret == EVT_FAILED)
-                        return -1;
-
-                if (!(*str == 0 || *str == ',' || isspace(*str)))
-                        return -1;
-
-                if (ret != EVT_HANDLED_ALL) {
-                        struct perf_evsel *evsel;
-                        evsel = perf_evsel__new(&attr, evlist->nr_entries);
-                        if (evsel == NULL)
-                                return -1;
-                        perf_evlist__add(evlist, evsel);
-
-                        evsel->name = calloc(str - ostr + 1, 1);
-                        if (!evsel->name)
-                                return -1;
-                        strncpy(evsel->name, ostr, str - ostr);
-                }
-
-                if (*str == 0)
-                        break;
-                if (*str == ',')
-                        ++str;
-                while (isspace(*str))
-                        ++str;
-        }
-
-        return 0;
-}
-
 int parse_events_option(const struct option *opt, const char *str,
                         int unset __used)
 {
@@ -1041,8 +949,6 @@ int print_hwcache_events(const char *event_glob)
         return printed;
 }
 
-#define MAX_NAME_LEN 100
-
 /*
  * Print the help text for the event symbols:
  */
@@ -1091,8 +997,12 @@ void print_events(const char *event_glob)
 
         printf("\n");
         printf("  %-50s [%s]\n",
-                "rNNN (see 'perf list --help' on how to encode it)",
+               "rNNN",
                event_type_descriptors[PERF_TYPE_RAW]);
+        printf("  %-50s [%s]\n",
+               "cpu/t1=v1[,t2=v2,t3 ...]/modifier",
+               event_type_descriptors[PERF_TYPE_RAW]);
+        printf("   (see 'perf list --help' on how to encode it)\n");
         printf("\n");
 
         printf("  %-50s [%s]\n",
@@ -1102,3 +1012,51 @@ void print_events(const char *event_glob)
 
         print_tracepoint_events(NULL, NULL);
 }
+
+int parse_events__is_hardcoded_term(struct parse_events__term *term)
+{
+        return term->type <= PARSE_EVENTS__TERM_TYPE_HARDCODED_MAX;
+}
+
+int parse_events__new_term(struct parse_events__term **_term, int type,
+                           char *config, char *str, long num)
+{
+        struct parse_events__term *term;
+
+        term = zalloc(sizeof(*term));
+        if (!term)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&term->list);
+        term->type = type;
+        term->config = config;
+
+        switch (type) {
+        case PARSE_EVENTS__TERM_TYPE_CONFIG:
+        case PARSE_EVENTS__TERM_TYPE_CONFIG1:
+        case PARSE_EVENTS__TERM_TYPE_CONFIG2:
+        case PARSE_EVENTS__TERM_TYPE_SAMPLE_PERIOD:
+        case PARSE_EVENTS__TERM_TYPE_BRANCH_SAMPLE_TYPE:
+        case PARSE_EVENTS__TERM_TYPE_NUM:
+                term->val.num = num;
+                break;
+        case PARSE_EVENTS__TERM_TYPE_STR:
+                term->val.str = str;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        *_term = term;
+        return 0;
+}
+
+void parse_events__free_terms(struct list_head *terms)
+{
+        struct parse_events__term *term, *h;
+
+        list_for_each_entry_safe(term, h, terms, list)
+                free(term);
+
+        free(terms);
+}
diff --git a/tools/perf/util/parse-events.h b/tools/perf/util/parse-events.h
index 7e0cbe75d5f1..ca069f893381 100644
--- a/tools/perf/util/parse-events.h
+++ b/tools/perf/util/parse-events.h
@@ -33,6 +33,55 @@ extern int parse_filter(const struct option *opt, const char *str, int unset);
 
 #define EVENTS_HELP_MAX (128*1024)
 
+enum {
+        PARSE_EVENTS__TERM_TYPE_CONFIG,
+        PARSE_EVENTS__TERM_TYPE_CONFIG1,
+        PARSE_EVENTS__TERM_TYPE_CONFIG2,
+        PARSE_EVENTS__TERM_TYPE_SAMPLE_PERIOD,
+        PARSE_EVENTS__TERM_TYPE_BRANCH_SAMPLE_TYPE,
+        PARSE_EVENTS__TERM_TYPE_NUM,
+        PARSE_EVENTS__TERM_TYPE_STR,
+
+        PARSE_EVENTS__TERM_TYPE_HARDCODED_MAX =
+                PARSE_EVENTS__TERM_TYPE_BRANCH_SAMPLE_TYPE,
+};
+
+struct parse_events__term {
+        char *config;
+        union {
+                char *str;
+                long  num;
+        } val;
+        int type;
+
+        struct list_head list;
+};
+
+int parse_events__is_hardcoded_term(struct parse_events__term *term);
+int parse_events__new_term(struct parse_events__term **term, int type,
+                           char *config, char *str, long num);
+void parse_events__free_terms(struct list_head *terms);
+int parse_events_modifier(struct list_head *list __used, char *str __used);
+int parse_events_add_tracepoint(struct list_head *list, int *idx,
+                                char *sys, char *event);
+int parse_events_add_raw(struct perf_evlist *evlist, unsigned long config,
+                         unsigned long config1, unsigned long config2,
+                         char *mod);
+int parse_events_add_numeric(struct list_head *list, int *idx,
+                             unsigned long type, unsigned long config,
+                             struct list_head *head_config);
+int parse_events_add_cache(struct list_head *list, int *idx,
+                           char *type, char *op_result1, char *op_result2);
+int parse_events_add_breakpoint(struct list_head *list, int *idx,
+                                void *ptr, char *type);
+int parse_events_add_pmu(struct list_head *list, int *idx,
+                         char *pmu , struct list_head *head_config);
+void parse_events_update_lists(struct list_head *list_event,
+                               struct list_head *list_all);
+void parse_events_error(struct list_head *list_all,
+                        struct list_head *list_event,
+                        int *idx, char const *msg);
+
 void print_events(const char *event_glob);
 void print_events_type(u8 type);
 void print_tracepoint_events(const char *subsys_glob, const char *event_glob);
diff --git a/tools/perf/util/parse-events.l b/tools/perf/util/parse-events.l
new file mode 100644
index 000000000000..05d766e3ecb5
--- /dev/null
+++ b/tools/perf/util/parse-events.l
@@ -0,0 +1,127 @@
+
+%option prefix="parse_events_"
+
+%{
+#include <errno.h>
+#include "../perf.h"
+#include "parse-events-bison.h"
+#include "parse-events.h"
+
+static int __value(char *str, int base, int token)
+{
+        long num;
+
+        errno = 0;
+        num = strtoul(str, NULL, base);
+        if (errno)
+                return PE_ERROR;
+
+        parse_events_lval.num = num;
+        return token;
+}
+
+static int value(int base)
+{
+        return __value(parse_events_text, base, PE_VALUE);
+}
+
+static int raw(void)
+{
+        return __value(parse_events_text + 1, 16, PE_RAW);
+}
+
+static int str(int token)
+{
+        parse_events_lval.str = strdup(parse_events_text);
+        return token;
+}
+
+static int sym(int type, int config)
+{
+        parse_events_lval.num = (type << 16) + config;
+        return PE_VALUE_SYM;
+}
+
+static int term(int type)
+{
+        parse_events_lval.num = type;
+        return PE_TERM;
+}
+
+%}
+
+num_dec         [0-9]+
+num_hex         0x[a-fA-F0-9]+
+num_raw_hex     [a-fA-F0-9]+
+name            [a-zA-Z_*?][a-zA-Z0-9_*?]*
+modifier_event  [ukhp]{1,5}
+modifier_bp     [rwx]
+
+%%
+cpu-cycles|cycles                               { return sym(PERF_TYPE_HARDWARE, PERF_COUNT_HW_CPU_CYCLES); }
+stalled-cycles-frontend|idle-cycles-frontend    { return sym(PERF_TYPE_HARDWARE, PERF_COUNT_HW_STALLED_CYCLES_FRONTEND); }
+stalled-cycles-backend|idle-cycles-backend      { return sym(PERF_TYPE_HARDWARE, PERF_COUNT_HW_STALLED_CYCLES_BACKEND); }
+instructions                                    { return sym(PERF_TYPE_HARDWARE, PERF_COUNT_HW_INSTRUCTIONS); }
+cache-references                                { return sym(PERF_TYPE_HARDWARE, PERF_COUNT_HW_CACHE_REFERENCES); }
+cache-misses                                    { return sym(PERF_TYPE_HARDWARE, PERF_COUNT_HW_CACHE_MISSES); }
+branch-instructions|branches                    { return sym(PERF_TYPE_HARDWARE, PERF_COUNT_HW_BRANCH_INSTRUCTIONS); }
+branch-misses                                   { return sym(PERF_TYPE_HARDWARE, PERF_COUNT_HW_BRANCH_MISSES); }
+bus-cycles                                      { return sym(PERF_TYPE_HARDWARE, PERF_COUNT_HW_BUS_CYCLES); }
+ref-cycles                                      { return sym(PERF_TYPE_HARDWARE, PERF_COUNT_HW_REF_CPU_CYCLES); }
+cpu-clock                                       { return sym(PERF_TYPE_SOFTWARE, PERF_COUNT_SW_CPU_CLOCK); }
+task-clock                                      { return sym(PERF_TYPE_SOFTWARE, PERF_COUNT_SW_TASK_CLOCK); }
+page-faults|faults                              { return sym(PERF_TYPE_SOFTWARE, PERF_COUNT_SW_PAGE_FAULTS); }
+minor-faults                                    { return sym(PERF_TYPE_SOFTWARE, PERF_COUNT_SW_PAGE_FAULTS_MIN); }
+major-faults                                    { return sym(PERF_TYPE_SOFTWARE, PERF_COUNT_SW_PAGE_FAULTS_MAJ); }
+context-switches|cs                             { return sym(PERF_TYPE_SOFTWARE, PERF_COUNT_SW_CONTEXT_SWITCHES); }
+cpu-migrations|migrations                       { return sym(PERF_TYPE_SOFTWARE, PERF_COUNT_SW_CPU_MIGRATIONS); }
+alignment-faults                                { return sym(PERF_TYPE_SOFTWARE, PERF_COUNT_SW_ALIGNMENT_FAULTS); }
+emulation-faults                                { return sym(PERF_TYPE_SOFTWARE, PERF_COUNT_SW_EMULATION_FAULTS); }
+
+L1-dcache|l1-d|l1d|L1-data              |
+L1-icache|l1-i|l1i|L1-instruction       |
+LLC|L2                                  |
+dTLB|d-tlb|Data-TLB                     |
+iTLB|i-tlb|Instruction-TLB              |
+branch|branches|bpu|btb|bpc             |
+node                                    { return str(PE_NAME_CACHE_TYPE); }
+
+load|loads|read                         |
+store|stores|write                      |
+prefetch|prefetches                     |
+speculative-read|speculative-load       |
+refs|Reference|ops|access               |
+misses|miss                             { return str(PE_NAME_CACHE_OP_RESULT); }
+
+        /*
+         * These are event config hardcoded term names to be specified
+         * within xxx/.../ syntax. So far we dont clash with other names,
+         * so we can put them here directly. In case the we have a conflict
+         * in future, this needs to go into '//' condition block.
+         */
+config                  { return term(PARSE_EVENTS__TERM_TYPE_CONFIG); }
+config1                 { return term(PARSE_EVENTS__TERM_TYPE_CONFIG1); }
+config2                 { return term(PARSE_EVENTS__TERM_TYPE_CONFIG2); }
+period                  { return term(PARSE_EVENTS__TERM_TYPE_SAMPLE_PERIOD); }
+branch_type             { return term(PARSE_EVENTS__TERM_TYPE_BRANCH_SAMPLE_TYPE); }
+
+mem:                    { return PE_PREFIX_MEM; }
+r{num_raw_hex}          { return raw(); }
+{num_dec}               { return value(10); }
+{num_hex}               { return value(16); }
+
+{modifier_event}        { return str(PE_MODIFIER_EVENT); }
+{modifier_bp}           { return str(PE_MODIFIER_BP); }
+{name}                  { return str(PE_NAME); }
+"/"                     { return '/'; }
+-                       { return '-'; }
+,                       { return ','; }
+:                       { return ':'; }
+=                       { return '='; }
+
+%%
+
+int parse_events_wrap(void)
+{
+        return 1;
+}
diff --git a/tools/perf/util/parse-events.y b/tools/perf/util/parse-events.y
new file mode 100644
index 000000000000..d9637da7333c
--- /dev/null
+++ b/tools/perf/util/parse-events.y
@@ -0,0 +1,229 @@
+
+%name-prefix "parse_events_"
+%parse-param {struct list_head *list_all}
+%parse-param {struct list_head *list_event}
+%parse-param {int *idx}
+
+%{
+
+#define YYDEBUG 1
+
+#include <linux/compiler.h>
+#include <linux/list.h>
+#include "types.h"
+#include "util.h"
+#include "parse-events.h"
+
+extern int parse_events_lex (void);
+
+#define ABORT_ON(val) \
+do { \
+        if (val) \
+                YYABORT; \
+} while (0)
+
+%}
+
+%token PE_VALUE PE_VALUE_SYM PE_RAW PE_TERM
+%token PE_NAME
+%token PE_MODIFIER_EVENT PE_MODIFIER_BP
+%token PE_NAME_CACHE_TYPE PE_NAME_CACHE_OP_RESULT
+%token PE_PREFIX_MEM PE_PREFIX_RAW
+%token PE_ERROR
+%type <num> PE_VALUE
+%type <num> PE_VALUE_SYM
+%type <num> PE_RAW
+%type <num> PE_TERM
+%type <str> PE_NAME
+%type <str> PE_NAME_CACHE_TYPE
+%type <str> PE_NAME_CACHE_OP_RESULT
+%type <str> PE_MODIFIER_EVENT
+%type <str> PE_MODIFIER_BP
+%type <head> event_config
+%type <term> event_term
+
+%union
+{
+        char *str;
+        unsigned long num;
+        struct list_head *head;
+        struct parse_events__term *term;
+}
+%%
+
+events:
+events ',' event | event
+
+event:
+event_def PE_MODIFIER_EVENT
+{
+        /*
+         * Apply modifier on all events added by single event definition
+         * (there could be more events added for multiple tracepoint
+         * definitions via '*?'.
+         */
+        ABORT_ON(parse_events_modifier(list_event, $2));
+        parse_events_update_lists(list_event, list_all);
+}
+|
+event_def
+{
+        parse_events_update_lists(list_event, list_all);
+}
+
+event_def: event_pmu |
+           event_legacy_symbol |
+           event_legacy_cache sep_dc |
+           event_legacy_mem |
+           event_legacy_tracepoint sep_dc |
+           event_legacy_numeric sep_dc |
+           event_legacy_raw sep_dc
+
+event_pmu:
+PE_NAME '/' event_config '/'
+{
+        ABORT_ON(parse_events_add_pmu(list_event, idx, $1, $3));
+        parse_events__free_terms($3);
+}
+
+event_legacy_symbol:
+PE_VALUE_SYM '/' event_config '/'
+{
+        int type = $1 >> 16;
+        int config = $1 & 255;
+
+        ABORT_ON(parse_events_add_numeric(list_event, idx, type, config, $3));
+        parse_events__free_terms($3);
+}
+|
+PE_VALUE_SYM sep_slash_dc
+{
+        int type = $1 >> 16;
+        int config = $1 & 255;
+
+        ABORT_ON(parse_events_add_numeric(list_event, idx, type, config, NULL));
+}
+
+event_legacy_cache:
+PE_NAME_CACHE_TYPE '-' PE_NAME_CACHE_OP_RESULT '-' PE_NAME_CACHE_OP_RESULT
+{
+        ABORT_ON(parse_events_add_cache(list_event, idx, $1, $3, $5));
+}
+|
+PE_NAME_CACHE_TYPE '-' PE_NAME_CACHE_OP_RESULT
+{
+        ABORT_ON(parse_events_add_cache(list_event, idx, $1, $3, NULL));
+}
+|
+PE_NAME_CACHE_TYPE
+{
+        ABORT_ON(parse_events_add_cache(list_event, idx, $1, NULL, NULL));
+}
+
+event_legacy_mem:
+PE_PREFIX_MEM PE_VALUE ':' PE_MODIFIER_BP sep_dc
+{
+        ABORT_ON(parse_events_add_breakpoint(list_event, idx, (void *) $2, $4));
+}
+|
+PE_PREFIX_MEM PE_VALUE sep_dc
+{
+        ABORT_ON(parse_events_add_breakpoint(list_event, idx, (void *) $2, NULL));
+}
+
+event_legacy_tracepoint:
+PE_NAME ':' PE_NAME
+{
+        ABORT_ON(parse_events_add_tracepoint(list_event, idx, $1, $3));
+}
+
+event_legacy_numeric:
+PE_VALUE ':' PE_VALUE
+{
+        ABORT_ON(parse_events_add_numeric(list_event, idx, $1, $3, NULL));
+}
+
+event_legacy_raw:
+PE_RAW
+{
+        ABORT_ON(parse_events_add_numeric(list_event, idx, PERF_TYPE_RAW, $1, NULL));
+}
+
+event_config:
+event_config ',' event_term
+{
+        struct list_head *head = $1;
+        struct parse_events__term *term = $3;
+
+        ABORT_ON(!head);
+        list_add_tail(&term->list, head);
+        $$ = $1;
+}
+|
+event_term
+{
+        struct list_head *head = malloc(sizeof(*head));
+        struct parse_events__term *term = $1;
+
+        ABORT_ON(!head);
+        INIT_LIST_HEAD(head);
+        list_add_tail(&term->list, head);
+        $$ = head;
+}
+
+event_term:
+PE_NAME '=' PE_NAME
+{
+        struct parse_events__term *term;
+
+        ABORT_ON(parse_events__new_term(&term, PARSE_EVENTS__TERM_TYPE_STR,
+                 $1, $3, 0));
+        $$ = term;
+}
+|
+PE_NAME '=' PE_VALUE
+{
+        struct parse_events__term *term;
+
+        ABORT_ON(parse_events__new_term(&term, PARSE_EVENTS__TERM_TYPE_NUM,
+                 $1, NULL, $3));
+        $$ = term;
+}
+|
+PE_NAME
+{
+        struct parse_events__term *term;
+
+        ABORT_ON(parse_events__new_term(&term, PARSE_EVENTS__TERM_TYPE_NUM,
+                 $1, NULL, 1));
+        $$ = term;
+}
+|
+PE_TERM '=' PE_VALUE
+{
+        struct parse_events__term *term;
+
+        ABORT_ON(parse_events__new_term(&term, $1, NULL, NULL, $3));
+        $$ = term;
+}
+|
+PE_TERM
+{
+        struct parse_events__term *term;
+
+        ABORT_ON(parse_events__new_term(&term, $1, NULL, NULL, 1));
+        $$ = term;
+}
+
+sep_dc: ':' |
+
+sep_slash_dc: '/' | ':' |
+
+%%
+
+void parse_events_error(struct list_head *list_all __used,
+                        struct list_head *list_event __used,
+                        int *idx __used,
+                        char const *msg __used)
+{
+}
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
new file mode 100644
index 000000000000..cb08a118e811
--- /dev/null
+++ b/tools/perf/util/pmu.c
@@ -0,0 +1,469 @@
+
+#include <linux/list.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <dirent.h>
+#include "sysfs.h"
+#include "util.h"
+#include "pmu.h"
+#include "parse-events.h"
+
+int perf_pmu_parse(struct list_head *list, char *name);
+extern FILE *perf_pmu_in;
+
+static LIST_HEAD(pmus);
+
+/*
+ * Parse & process all the sysfs attributes located under
+ * the directory specified in 'dir' parameter.
+ */
+static int pmu_format_parse(char *dir, struct list_head *head)
+{
+        struct dirent *evt_ent;
+        DIR *format_dir;
+        int ret = 0;
+
+        format_dir = opendir(dir);
+        if (!format_dir)
+                return -EINVAL;
+
+        while (!ret && (evt_ent = readdir(format_dir))) {
+                char path[PATH_MAX];
+                char *name = evt_ent->d_name;
+                FILE *file;
+
+                if (!strcmp(name, ".") || !strcmp(name, ".."))
+                        continue;
+
+                snprintf(path, PATH_MAX, "%s/%s", dir, name);
+
+                ret = -EINVAL;
+                file = fopen(path, "r");
+                if (!file)
+                        break;
+
+                perf_pmu_in = file;
+                ret = perf_pmu_parse(head, name);
+                fclose(file);
+        }
+
+        closedir(format_dir);
+        return ret;
+}
+
+/*
+ * Reading/parsing the default pmu format definition, which should be
+ * located at:
+ * /sys/bus/event_source/devices/<dev>/format as sysfs group attributes.
+ */
+static int pmu_format(char *name, struct list_head *format)
+{
+        struct stat st;
+        char path[PATH_MAX];
+        const char *sysfs;
+
+        sysfs = sysfs_find_mountpoint();
+        if (!sysfs)
+                return -1;
+
+        snprintf(path, PATH_MAX,
+                 "%s/bus/event_source/devices/%s/format", sysfs, name);
+
+        if (stat(path, &st) < 0)
+                return -1;
+
+        if (pmu_format_parse(path, format))
+                return -1;
+
+        return 0;
+}
+
+/*
+ * Reading/parsing the default pmu type value, which should be
+ * located at:
+ * /sys/bus/event_source/devices/<dev>/type as sysfs attribute.
+ */
+static int pmu_type(char *name, __u32 *type)
+{
+        struct stat st;
+        char path[PATH_MAX];
+        const char *sysfs;
+        FILE *file;
+        int ret = 0;
+
+        sysfs = sysfs_find_mountpoint();
+        if (!sysfs)
+                return -1;
+
+        snprintf(path, PATH_MAX,
+                 "%s/bus/event_source/devices/%s/type", sysfs, name);
+
+        if (stat(path, &st) < 0)
+                return -1;
+
+        file = fopen(path, "r");
+        if (!file)
+                return -EINVAL;
+
+        if (1 != fscanf(file, "%u", type))
+                ret = -1;
+
+        fclose(file);
+        return ret;
+}
+
+static struct perf_pmu *pmu_lookup(char *name)
+{
+        struct perf_pmu *pmu;
+        LIST_HEAD(format);
+        __u32 type;
+
+        /*
+         * The pmu data we store & need consists of the pmu
+         * type value and format definitions. Load both right
+         * now.
+         */
+        if (pmu_format(name, &format))
+                return NULL;
+
+        if (pmu_type(name, &type))
+                return NULL;
+
+        pmu = zalloc(sizeof(*pmu));
+        if (!pmu)
+                return NULL;
+
+        INIT_LIST_HEAD(&pmu->format);
+        list_splice(&format, &pmu->format);
+        pmu->name = strdup(name);
+        pmu->type = type;
+        return pmu;
+}
+
+static struct perf_pmu *pmu_find(char *name)
+{
+        struct perf_pmu *pmu;
+
+        list_for_each_entry(pmu, &pmus, list)
+                if (!strcmp(pmu->name, name))
+                        return pmu;
+
+        return NULL;
+}
+
+struct perf_pmu *perf_pmu__find(char *name)
+{
+        struct perf_pmu *pmu;
+
+        /*
+         * Once PMU is loaded it stays in the list,
+         * so we keep us from multiple reading/parsing
+         * the pmu format definitions.
+         */
+        pmu = pmu_find(name);
+        if (pmu)
+                return pmu;
+
+        return pmu_lookup(name);
+}
+
+static struct perf_pmu__format*
+pmu_find_format(struct list_head *formats, char *name)
+{
+        struct perf_pmu__format *format;
+
+        list_for_each_entry(format, formats, list)
+                if (!strcmp(format->name, name))
+                        return format;
+
+        return NULL;
+}
+
+/*
+ * Returns value based on the format definition (format parameter)
+ * and unformated value (value parameter).
+ *
+ * TODO maybe optimize a little ;)
+ */
+static __u64 pmu_format_value(unsigned long *format, __u64 value)
+{
+        unsigned long fbit, vbit;
+        __u64 v = 0;
+
+        for (fbit = 0, vbit = 0; fbit < PERF_PMU_FORMAT_BITS; fbit++) {
+
+                if (!test_bit(fbit, format))
+                        continue;
+
+                if (!(value & (1llu << vbit++)))
+                        continue;
+
+                v |= (1llu << fbit);
+        }
+
+        return v;
+}
+
+/*
+ * Setup one of config[12] attr members based on the
+ * user input data - temr parameter.
+ */
+static int pmu_config_term(struct list_head *formats,
+                           struct perf_event_attr *attr,
+                           struct parse_events__term *term)
+{
+        struct perf_pmu__format *format;
+        __u64 *vp;
+
+        /*
+         * Support only for hardcoded and numnerial terms.
+         * Hardcoded terms should be already in, so nothing
+         * to be done for them.
+         */
+        if (parse_events__is_hardcoded_term(term))
+                return 0;
+
+        if (term->type != PARSE_EVENTS__TERM_TYPE_NUM)
+                return -EINVAL;
+
+        format = pmu_find_format(formats, term->config);
+        if (!format)
+                return -EINVAL;
+
+        switch (format->value) {
+        case PERF_PMU_FORMAT_VALUE_CONFIG:
+                vp = &attr->config;
+                break;
+        case PERF_PMU_FORMAT_VALUE_CONFIG1:
+                vp = &attr->config1;
+                break;
+        case PERF_PMU_FORMAT_VALUE_CONFIG2:
+                vp = &attr->config2;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        *vp |= pmu_format_value(format->bits, term->val.num);
+        return 0;
+}
+
+static int pmu_config(struct list_head *formats, struct perf_event_attr *attr,
+                      struct list_head *head_terms)
+{
+        struct parse_events__term *term, *h;
+
+        list_for_each_entry_safe(term, h, head_terms, list)
+                if (pmu_config_term(formats, attr, term))
+                        return -EINVAL;
+
+        return 0;
+}
+
+/*
+ * Configures event's 'attr' parameter based on the:
+ * 1) users input - specified in terms parameter
+ * 2) pmu format definitions - specified by pmu parameter
+ */
+int perf_pmu__config(struct perf_pmu *pmu, struct perf_event_attr *attr,
+                     struct list_head *head_terms)
+{
+        attr->type = pmu->type;
+        return pmu_config(&pmu->format, attr, head_terms);
+}
+
+int perf_pmu__new_format(struct list_head *list, char *name,
+                         int config, unsigned long *bits)
+{
+        struct perf_pmu__format *format;
+
+        format = zalloc(sizeof(*format));
+        if (!format)
+                return -ENOMEM;
+
+        format->name = strdup(name);
+        format->value = config;
+        memcpy(format->bits, bits, sizeof(format->bits));
+
+        list_add_tail(&format->list, list);
+        return 0;
+}
+
+void perf_pmu__set_format(unsigned long *bits, long from, long to)
+{
+        long b;
+
+        if (!to)
+                to = from;
+
+        memset(bits, 0, BITS_TO_LONGS(PERF_PMU_FORMAT_BITS));
+        for (b = from; b <= to; b++)
+                set_bit(b, bits);
+}
+
+/* Simulated format definitions. */
+static struct test_format {
+        const char *name;
+        const char *value;
+} test_formats[] = {
+        { "krava01", "config:0-1,62-63\n", },
+        { "krava02", "config:10-17\n", },
+        { "krava03", "config:5\n", },
+        { "krava11", "config1:0,2,4,6,8,20-28\n", },
+        { "krava12", "config1:63\n", },
+        { "krava13", "config1:45-47\n", },
+        { "krava21", "config2:0-3,10-13,20-23,30-33,40-43,50-53,60-63\n", },
+        { "krava22", "config2:8,18,48,58\n", },
+        { "krava23", "config2:28-29,38\n", },
+};
+
+#define TEST_FORMATS_CNT (sizeof(test_formats) / sizeof(struct test_format))
+
+/* Simulated users input. */
+static struct parse_events__term test_terms[] = {
+        {
+                .config  = (char *) "krava01",
+                .val.num = 15,
+                .type    = PARSE_EVENTS__TERM_TYPE_NUM,
+        },
+        {
+                .config  = (char *) "krava02",
+                .val.num = 170,
+                .type    = PARSE_EVENTS__TERM_TYPE_NUM,
+        },
+        {
+                .config  = (char *) "krava03",
+                .val.num = 1,
+                .type    = PARSE_EVENTS__TERM_TYPE_NUM,
+        },
+        {
+                .config  = (char *) "krava11",
+                .val.num = 27,
+                .type    = PARSE_EVENTS__TERM_TYPE_NUM,
+        },
+        {
+                .config  = (char *) "krava12",
+                .val.num = 1,
+                .type    = PARSE_EVENTS__TERM_TYPE_NUM,
+        },
+        {
+                .config  = (char *) "krava13",
+                .val.num = 2,
+                .type    = PARSE_EVENTS__TERM_TYPE_NUM,
+        },
+        {
+                .config  = (char *) "krava21",
+                .val.num = 119,
+                .type    = PARSE_EVENTS__TERM_TYPE_NUM,
+        },
+        {
+                .config  = (char *) "krava22",
+                .val.num = 11,
+                .type    = PARSE_EVENTS__TERM_TYPE_NUM,
+        },
+        {
+                .config  = (char *) "krava23",
+                .val.num = 2,
+                .type    = PARSE_EVENTS__TERM_TYPE_NUM,
+        },
+};
+#define TERMS_CNT (sizeof(test_terms) / sizeof(struct parse_events__term))
+
+/*
+ * Prepare format directory data, exported by kernel
+ * at /sys/bus/event_source/devices/<dev>/format.
+ */
+static char *test_format_dir_get(void)
+{
+        static char dir[PATH_MAX];
+        unsigned int i;
+
+        snprintf(dir, PATH_MAX, "/tmp/perf-pmu-test-format-XXXXXX");
+        if (!mkdtemp(dir))
+                return NULL;
+
+        for (i = 0; i < TEST_FORMATS_CNT; i++) {
+                static char name[PATH_MAX];
+                struct test_format *format = &test_formats[i];
+                FILE *file;
+
+                snprintf(name, PATH_MAX, "%s/%s", dir, format->name);
+
+                file = fopen(name, "w");
+                if (!file)
+                        return NULL;
+
+                if (1 != fwrite(format->value, strlen(format->value), 1, file))
+                        break;
+
+                fclose(file);
+        }
+
+        return dir;
+}
+
+/* Cleanup format directory. */
+static int test_format_dir_put(char *dir)
+{
+        char buf[PATH_MAX];
+        snprintf(buf, PATH_MAX, "rm -f %s/*\n", dir);
+        if (system(buf))
+                return -1;
+
+        snprintf(buf, PATH_MAX, "rmdir %s\n", dir);
+        return system(buf);
+}
+
+static struct list_head *test_terms_list(void)
+{
+        static LIST_HEAD(terms);
+        unsigned int i;
+
+        for (i = 0; i < TERMS_CNT; i++)
+                list_add_tail(&test_terms[i].list, &terms);
+
+        return &terms;
+}
+
+#undef TERMS_CNT
+
+int perf_pmu__test(void)
+{
+        char *format = test_format_dir_get();
+        LIST_HEAD(formats);
+        struct list_head *terms = test_terms_list();
+        int ret;
+
+        if (!format)
+                return -EINVAL;
+
+        do {
+                struct perf_event_attr attr;
+
+                memset(&attr, 0, sizeof(attr));
+
+                ret = pmu_format_parse(format, &formats);
+                if (ret)
+                        break;
+
+                ret = pmu_config(&formats, &attr, terms);
+                if (ret)
+                        break;
+
+                ret = -EINVAL;
+
+                if (attr.config  != 0xc00000000002a823)
+                        break;
+                if (attr.config1 != 0x8000400000000145)
+                        break;
+                if (attr.config2 != 0x0400000020041d07)
+                        break;
+
+                ret = 0;
+        } while (0);
+
+        test_format_dir_put(format);
+        return ret;
+}
diff --git a/tools/perf/util/pmu.h b/tools/perf/util/pmu.h
new file mode 100644
index 000000000000..68c0db965e1f
--- /dev/null
+++ b/tools/perf/util/pmu.h
@@ -0,0 +1,41 @@
+#ifndef __PMU_H
+#define __PMU_H
+
+#include <linux/bitops.h>
+#include "../../../include/linux/perf_event.h"
+
+enum {
+        PERF_PMU_FORMAT_VALUE_CONFIG,
+        PERF_PMU_FORMAT_VALUE_CONFIG1,
+        PERF_PMU_FORMAT_VALUE_CONFIG2,
+};
+
+#define PERF_PMU_FORMAT_BITS 64
+
+struct perf_pmu__format {
+        char *name;
+        int value;
+        DECLARE_BITMAP(bits, PERF_PMU_FORMAT_BITS);
+        struct list_head list;
+};
+
+struct perf_pmu {
+        char *name;
+        __u32 type;
+        struct list_head format;
+        struct list_head list;
+};
+
+struct perf_pmu *perf_pmu__find(char *name);
+int perf_pmu__config(struct perf_pmu *pmu, struct perf_event_attr *attr,
+                     struct list_head *head_terms);
+
+int perf_pmu_wrap(void);
+void perf_pmu_error(struct list_head *list, char *name, char const *msg);
+
+int perf_pmu__new_format(struct list_head *list, char *name,
+                         int config, unsigned long *bits);
+void perf_pmu__set_format(unsigned long *bits, long from, long to);
+
+int perf_pmu__test(void);
+#endif /* __PMU_H */
diff --git a/tools/perf/util/pmu.l b/tools/perf/util/pmu.l
new file mode 100644
index 000000000000..a15d9fbd7c0e
--- /dev/null
+++ b/tools/perf/util/pmu.l
@@ -0,0 +1,43 @@
+%option prefix="perf_pmu_"
+
+%{
+#include <stdlib.h>
+#include <linux/bitops.h>
+#include "pmu.h"
+#include "pmu-bison.h"
+
+static int value(int base)
+{
+        long num;
+
+        errno = 0;
+        num = strtoul(perf_pmu_text, NULL, base);
+        if (errno)
+                return PP_ERROR;
+
+        perf_pmu_lval.num = num;
+        return PP_VALUE;
+}
+
+%}
+
+num_dec         [0-9]+
+
+%%
+
+{num_dec}       { return value(10); }
+config          { return PP_CONFIG; }
+config1         { return PP_CONFIG1; }
+config2         { return PP_CONFIG2; }
+-               { return '-'; }
+:               { return ':'; }
+,               { return ','; }
+.               { ; }
+\n              { ; }
+
+%%
+
+int perf_pmu_wrap(void)
+{
+        return 1;
+}
diff --git a/tools/perf/util/pmu.y b/tools/perf/util/pmu.y
new file mode 100644
index 000000000000..20ea77e93169
--- /dev/null
+++ b/tools/perf/util/pmu.y
@@ -0,0 +1,93 @@
+
+%name-prefix "perf_pmu_"
+%parse-param {struct list_head *format}
+%parse-param {char *name}
+
+%{
+
+#include <linux/compiler.h>
+#include <linux/list.h>
+#include <linux/bitmap.h>
+#include <string.h>
+#include "pmu.h"
+
+extern int perf_pmu_lex (void);
+
+#define ABORT_ON(val) \
+do { \
+        if (val) \
+                YYABORT; \
+} while (0)
+
+%}
+
+%token PP_CONFIG PP_CONFIG1 PP_CONFIG2
+%token PP_VALUE PP_ERROR
+%type <num> PP_VALUE
+%type <bits> bit_term
+%type <bits> bits
+
+%union
+{
+        unsigned long num;
+        DECLARE_BITMAP(bits, PERF_PMU_FORMAT_BITS);
+}
+
+%%
+
+format:
+format format_term
+|
+format_term
+
+format_term:
+PP_CONFIG ':' bits
+{
+        ABORT_ON(perf_pmu__new_format(format, name,
+                                      PERF_PMU_FORMAT_VALUE_CONFIG,
+                                      $3));
+}
+|
+PP_CONFIG1 ':' bits
+{
+        ABORT_ON(perf_pmu__new_format(format, name,
+                                      PERF_PMU_FORMAT_VALUE_CONFIG1,
+                                      $3));
+}
+|
+PP_CONFIG2 ':' bits
+{
+        ABORT_ON(perf_pmu__new_format(format, name,
+                                      PERF_PMU_FORMAT_VALUE_CONFIG2,
+                                      $3));
+}
+
+bits:
+bits ',' bit_term
+{
+        bitmap_or($$, $1, $3, 64);
+}
+|
+bit_term
+{
+        memcpy($$, $1, sizeof($1));
+}
+
+bit_term:
+PP_VALUE '-' PP_VALUE
+{
+        perf_pmu__set_format($$, $1, $3);
+}
+|
+PP_VALUE
+{
+        perf_pmu__set_format($$, $1, 0);
+}
+
+%%
+
+void perf_pmu_error(struct list_head *list __used,
+                    char *name __used,
+                    char const *msg __used)
+{
+}
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index eb25900e2211..8a8ee64e72d1 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -19,7 +19,6 @@
  *
  */
 
-#define _GNU_SOURCE
 #include <sys/utsname.h>
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -33,10 +32,8 @@
 #include <limits.h>
 #include <elf.h>
 
-#undef _GNU_SOURCE
 #include "util.h"
 #include "event.h"
-#include "string.h"
 #include "strlist.h"
 #include "debug.h"
 #include "cache.h"
@@ -275,10 +272,10 @@ static int add_module_to_probe_trace_events(struct probe_trace_event *tevs,
 /* Try to find perf_probe_event with debuginfo */
 static int try_to_find_probe_trace_events(struct perf_probe_event *pev,
                                           struct probe_trace_event **tevs,
-                                          int max_tevs, const char *module)
+                                          int max_tevs, const char *target)
 {
         bool need_dwarf = perf_probe_event_need_dwarf(pev);
-        struct debuginfo *dinfo = open_debuginfo(module);
+        struct debuginfo *dinfo = open_debuginfo(target);
         int ntevs, ret = 0;
 
         if (!dinfo) {
@@ -297,9 +294,9 @@ static int try_to_find_probe_trace_events(struct perf_probe_event *pev,
 
         if (ntevs > 0) {        /* Succeeded to find trace events */
                 pr_debug("find %d probe_trace_events.\n", ntevs);
-                if (module)
+                if (target)
                         ret = add_module_to_probe_trace_events(*tevs, ntevs,
-                                                               module);
+                                                               target);
                 return ret < 0 ? ret : ntevs;
         }
 
@@ -1731,7 +1728,7 @@ static int __add_probe_trace_events(struct perf_probe_event *pev,
         }
 
         ret = 0;
-        printf("Add new event%s\n", (ntevs > 1) ? "s:" : ":");
+        printf("Added new event%s\n", (ntevs > 1) ? "s:" : ":");
         for (i = 0; i < ntevs; i++) {
                 tev = &tevs[i];
                 if (pev->event)
@@ -1786,7 +1783,7 @@ static int __add_probe_trace_events(struct perf_probe_event *pev,
 
         if (ret >= 0) {
                 /* Show how to use the event. */
-                printf("\nYou can now use it on all perf tools, such as:\n\n");
+                printf("\nYou can now use it in all perf tools, such as:\n\n");
                 printf("\tperf record -e %s:%s -aR sleep 1\n\n", tev->group,
                          tev->event);
         }
@@ -1798,14 +1795,14 @@ static int __add_probe_trace_events(struct perf_probe_event *pev,
 
 static int convert_to_probe_trace_events(struct perf_probe_event *pev,
                                           struct probe_trace_event **tevs,
-                                          int max_tevs, const char *module)
+                                          int max_tevs, const char *target)
 {
         struct symbol *sym;
         int ret = 0, i;
         struct probe_trace_event *tev;
 
         /* Convert perf_probe_event with debuginfo */
-        ret = try_to_find_probe_trace_events(pev, tevs, max_tevs, module);
+        ret = try_to_find_probe_trace_events(pev, tevs, max_tevs, target);
         if (ret != 0)
                 return ret;     /* Found in debuginfo or got an error */
 
@@ -1821,8 +1818,8 @@ static int convert_to_probe_trace_events(struct perf_probe_event *pev,
                 goto error;
         }
 
-        if (module) {
-                tev->point.module = strdup(module);
+        if (target) {
+                tev->point.module = strdup(target);
                 if (tev->point.module == NULL) {
                         ret = -ENOMEM;
                         goto error;
@@ -1869,6 +1866,12 @@ static int convert_to_probe_trace_events(struct perf_probe_event *pev,
                            tev->point.symbol);
                 ret = -ENOENT;
                 goto error;
+        } else if (tev->point.offset > sym->end - sym->start) {
+                pr_warning("Offset specified is greater than size of %s\n",
+                           tev->point.symbol);
+                ret = -ENOENT;
+                goto error;
+
         }
 
         return 1;
@@ -1886,7 +1889,7 @@ struct __event_package {
 };
 
 int add_perf_probe_events(struct perf_probe_event *pevs, int npevs,
-                          int max_tevs, const char *module, bool force_add)
+                          int max_tevs, const char *target, bool force_add)
 {
         int i, j, ret;
         struct __event_package *pkgs;
@@ -1909,7 +1912,7 @@ int add_perf_probe_events(struct perf_probe_event *pevs, int npevs,
                 ret  = convert_to_probe_trace_events(pkgs[i].pev,
                                                      &pkgs[i].tevs,
                                                      max_tevs,
-                                                     module);
+                                                     target);
                 if (ret < 0)
                         goto end;
                 pkgs[i].ntevs = ret;
@@ -1961,7 +1964,7 @@ static int __del_trace_probe_event(int fd, struct str_node *ent)
                 goto error;
         }
 
-        printf("Remove event: %s\n", ent->s);
+        printf("Removed event: %s\n", ent->s);
         return 0;
 error:
         pr_warning("Failed to delete event: %s\n", strerror(-ret));
@@ -2065,7 +2068,7 @@ static int filter_available_functions(struct map *map __unused,
         return 1;
 }
 
-int show_available_funcs(const char *module, struct strfilter *_filter)
+int show_available_funcs(const char *target, struct strfilter *_filter)
 {
         struct map *map;
         int ret;
@@ -2076,9 +2079,9 @@ int show_available_funcs(const char *module, struct strfilter *_filter)
         if (ret < 0)
                 return ret;
 
-        map = kernel_get_module_map(module);
+        map = kernel_get_module_map(target);
         if (!map) {
-                pr_err("Failed to find %s map.\n", (module) ? : "kernel");
+                pr_err("Failed to find %s map.\n", (target) ? : "kernel");
                 return -EINVAL;
         }
         available_func_filter = _filter;
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index 5d732621a462..d448984ed789 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -30,7 +30,6 @@
 #include <stdlib.h>
 #include <string.h>
 #include <stdarg.h>
-#include <ctype.h>
 #include <dwarf-regs.h>
 
 #include <linux/bitops.h>
@@ -672,7 +671,7 @@ static int find_variable(Dwarf_Die *sc_die, struct probe_finder *pf)
 static int convert_to_trace_point(Dwarf_Die *sp_die, Dwarf_Addr paddr,
                                   bool retprobe, struct probe_trace_point *tp)
 {
-        Dwarf_Addr eaddr;
+        Dwarf_Addr eaddr, highaddr;
         const char *name;
 
         /* Copy the name of probe point */
@@ -683,6 +682,16 @@ static int convert_to_trace_point(Dwarf_Die *sp_die, Dwarf_Addr paddr,
                                    dwarf_diename(sp_die));
                         return -ENOENT;
                 }
+                if (dwarf_highpc(sp_die, &highaddr) != 0) {
+                        pr_warning("Failed to get end address of %s\n",
+                                   dwarf_diename(sp_die));
+                        return -ENOENT;
+                }
+                if (paddr > highaddr) {
+                        pr_warning("Offset specified is greater than size of %s\n",
+                                   dwarf_diename(sp_die));
+                        return -EINVAL;
+                }
                 tp->symbol = strdup(name);
                 if (tp->symbol == NULL)
                         return -ENOMEM;
@@ -963,10 +972,12 @@ static int probe_point_search_cb(Dwarf_Die *sp_die, void *data)
         struct dwarf_callback_param *param = data;
         struct probe_finder *pf = param->data;
         struct perf_probe_point *pp = &pf->pev->point;
+        Dwarf_Attribute attr;
 
         /* Check tag and diename */
         if (dwarf_tag(sp_die) != DW_TAG_subprogram ||
-            !die_compare_name(sp_die, pp->function))
+            !die_compare_name(sp_die, pp->function) ||
+            dwarf_attr(sp_die, DW_AT_declaration, &attr))
                 return DWARF_CB_OK;
 
         /* Check declared file */
diff --git a/tools/perf/util/python-ext-sources b/tools/perf/util/python-ext-sources
new file mode 100644
index 000000000000..2884e67ee625
--- /dev/null
+++ b/tools/perf/util/python-ext-sources
@@ -0,0 +1,19 @@
+#
+# List of files needed by perf python extention
+#
+# Each source file must be placed on its own line so that it can be
+# processed by Makefile and util/setup.py accordingly.
+#
+
+util/python.c
+util/ctype.c
+util/evlist.c
+util/evsel.c
+util/cpumap.c
+util/thread_map.c
+util/util.c
+util/xyarray.c
+util/cgroup.c
+util/debugfs.c
+util/strlist.c
+../../lib/rbtree.c
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index 9dd47a4f2596..e03b58a48424 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -425,14 +425,14 @@ struct pyrf_thread_map {
 static int pyrf_thread_map__init(struct pyrf_thread_map *pthreads,
                                  PyObject *args, PyObject *kwargs)
 {
-        static char *kwlist[] = { "pid", "tid", NULL };
-        int pid = -1, tid = -1;
+        static char *kwlist[] = { "pid", "tid", "uid", NULL };
+        int pid = -1, tid = -1, uid = UINT_MAX;
 
-        if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|ii",
-                                         kwlist, &pid, &tid))
+        if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|iii",
+                                         kwlist, &pid, &tid, &uid))
                 return -1;
 
-        pthreads->threads = thread_map__new(pid, tid);
+        pthreads->threads = thread_map__new(pid, tid, uid);
         if (pthreads->threads == NULL)
                 return -1;
         return 0;
diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
index 0b2a48783172..c2623c6f9b51 100644
--- a/tools/perf/util/scripting-engines/trace-event-python.c
+++ b/tools/perf/util/scripting-engines/trace-event-python.c
@@ -24,7 +24,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <ctype.h>
 #include <errno.h>
 
 #include "../../perf.h"
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index b5ca2558c7bb..9412e3b05f68 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -24,7 +24,7 @@ static int perf_session__open(struct perf_session *self, bool force)
                 self->fd = STDIN_FILENO;
 
                 if (perf_session__read_header(self, self->fd) < 0)
-                        pr_err("incompatible file format");
+                        pr_err("incompatible file format (rerun with -v to learn more)");
 
                 return 0;
         }
@@ -56,7 +56,7 @@ static int perf_session__open(struct perf_session *self, bool force)
         }
 
         if (perf_session__read_header(self, self->fd) < 0) {
-                pr_err("incompatible file format");
+                pr_err("incompatible file format (rerun with -v to learn more)");
                 goto out_close;
         }
 
@@ -140,6 +140,7 @@ struct perf_session *perf_session__new(const char *filename, int mode,
         INIT_LIST_HEAD(&self->ordered_samples.sample_cache);
         INIT_LIST_HEAD(&self->ordered_samples.to_free);
         machine__init(&self->host_machine, "", HOST_KERNEL_ID);
+        hists__init(&self->hists);
 
         if (mode == O_RDONLY) {
                 if (perf_session__open(self, force) < 0)
@@ -229,6 +230,64 @@ static bool symbol__match_parent_regex(struct symbol *sym)
         return 0;
 }
 
+static const u8 cpumodes[] = {
+        PERF_RECORD_MISC_USER,
+        PERF_RECORD_MISC_KERNEL,
+        PERF_RECORD_MISC_GUEST_USER,
+        PERF_RECORD_MISC_GUEST_KERNEL
+};
+#define NCPUMODES (sizeof(cpumodes)/sizeof(u8))
+
+static void ip__resolve_ams(struct machine *self, struct thread *thread,
+                            struct addr_map_symbol *ams,
+                            u64 ip)
+{
+        struct addr_location al;
+        size_t i;
+        u8 m;
+
+        memset(&al, 0, sizeof(al));
+
+        for (i = 0; i < NCPUMODES; i++) {
+                m = cpumodes[i];
+                /*
+                 * We cannot use the header.misc hint to determine whether a
+                 * branch stack address is user, kernel, guest, hypervisor.
+                 * Branches may straddle the kernel/user/hypervisor boundaries.
+                 * Thus, we have to try consecutively until we find a match
+                 * or else, the symbol is unknown
+                 */
+                thread__find_addr_location(thread, self, m, MAP__FUNCTION,
+                                ip, &al, NULL);
+                if (al.sym)
+                        goto found;
+        }
+found:
+        ams->addr = ip;
+        ams->al_addr = al.addr;
+        ams->sym = al.sym;
+        ams->map = al.map;
+}
+
+struct branch_info *machine__resolve_bstack(struct machine *self,
+                                            struct thread *thr,
+                                            struct branch_stack *bs)
+{
+        struct branch_info *bi;
+        unsigned int i;
+
+        bi = calloc(bs->nr, sizeof(struct branch_info));
+        if (!bi)
+                return NULL;
+
+        for (i = 0; i < bs->nr; i++) {
+                ip__resolve_ams(self, thr, &bi[i].to, bs->entries[i].to);
+                ip__resolve_ams(self, thr, &bi[i].from, bs->entries[i].from);
+                bi[i].flags = bs->entries[i].flags;
+        }
+        return bi;
+}
+
 int machine__resolve_callchain(struct machine *self, struct perf_evsel *evsel,
                                struct thread *thread,
                                struct ip_callchain *chain,
@@ -697,6 +756,18 @@ static void callchain__printf(struct perf_sample *sample)
                        i, sample->callchain->ips[i]);
 }
 
+static void branch_stack__printf(struct perf_sample *sample)
+{
+        uint64_t i;
+
+        printf("... branch stack: nr:%" PRIu64 "\n", sample->branch_stack->nr);
+
+        for (i = 0; i < sample->branch_stack->nr; i++)
+                printf("..... %2"PRIu64": %016" PRIx64 " -> %016" PRIx64 "\n",
+                        i, sample->branch_stack->entries[i].from,
+                        sample->branch_stack->entries[i].to);
+}
+
 static void perf_session__print_tstamp(struct perf_session *session,
                                        union perf_event *event,
                                        struct perf_sample *sample)
@@ -744,6 +815,9 @@ static void dump_sample(struct perf_session *session, union perf_event *event,
 
         if (session->sample_type & PERF_SAMPLE_CALLCHAIN)
                 callchain__printf(sample);
+
+        if (session->sample_type & PERF_SAMPLE_BRANCH_STACK)
+                branch_stack__printf(sample);
 }
 
 static struct machine *
@@ -796,6 +870,10 @@ static int perf_session_deliver_event(struct perf_session *session,
                         ++session->hists.stats.nr_unknown_id;
                         return -1;
                 }
+                if (machine == NULL) {
+                        ++session->hists.stats.nr_unprocessable_samples;
+                        return -1;
+                }
                 return tool->sample(tool, event, sample, evsel, machine);
         case PERF_RECORD_MMAP:
                 return tool->mmap(tool, event, sample, machine);
@@ -964,6 +1042,12 @@ static void perf_session__warn_about_errors(const struct perf_session *session,
                             session->hists.stats.nr_invalid_chains,
                             session->hists.stats.nr_events[PERF_RECORD_SAMPLE]);
         }
+
+        if (session->hists.stats.nr_unprocessable_samples != 0) {
+                ui__warning("%u unprocessable samples recorded.\n"
+                            "Do you have a KVM guest running and not using 'perf kvm'?\n",
+                            session->hists.stats.nr_unprocessable_samples);
+        }
 }
 
 #define session_done()  (*(volatile int *)(&session_done))
@@ -1293,10 +1377,9 @@ struct perf_evsel *perf_session__find_first_evtype(struct perf_session *session,
 
 void perf_event__print_ip(union perf_event *event, struct perf_sample *sample,
                           struct machine *machine, struct perf_evsel *evsel,
-                          int print_sym, int print_dso)
+                          int print_sym, int print_dso, int print_symoffset)
 {
         struct addr_location al;
-        const char *symname, *dsoname;
         struct callchain_cursor *cursor = &evsel->hists.callchain_cursor;
         struct callchain_cursor_node *node;
 
@@ -1324,20 +1407,13 @@ void perf_event__print_ip(union perf_event *event, struct perf_sample *sample,
 
                         printf("\t%16" PRIx64, node->ip);
                         if (print_sym) {
-                                if (node->sym && node->sym->name)
-                                        symname = node->sym->name;
-                                else
-                                        symname = "";
-
-                                printf(" %s", symname);
+                                printf(" ");
+                                symbol__fprintf_symname(node->sym, stdout);
                         }
                         if (print_dso) {
-                                if (node->map && node->map->dso && node->map->dso->name)
-                                        dsoname = node->map->dso->name;
-                                else
-                                        dsoname = "";
-
-                                printf(" (%s)", dsoname);
+                                printf(" (");
+                                map__fprintf_dsoname(al.map, stdout);
+                                printf(")");
                         }
                         printf("\n");
 
@@ -1347,21 +1423,18 @@ void perf_event__print_ip(union perf_event *event, struct perf_sample *sample,
         } else {
                 printf("%16" PRIx64, sample->ip);
                 if (print_sym) {
-                        if (al.sym && al.sym->name)
-                                symname = al.sym->name;
+                        printf(" ");
+                        if (print_symoffset)
+                                symbol__fprintf_symname_offs(al.sym, &al,
+                                                             stdout);
                         else
-                                symname = "";
-
-                        printf(" %s", symname);
+                                symbol__fprintf_symname(al.sym, stdout);
                 }
 
                 if (print_dso) {
-                        if (al.map && al.map->dso && al.map->dso->name)
-                                dsoname = al.map->dso->name;
-                        else
-                                dsoname = "";
-
-                        printf(" (%s)", dsoname);
+                        printf(" (");
+                        map__fprintf_dsoname(al.map, stdout);
+                        printf(")");
                 }
         }
 }
diff --git a/tools/perf/util/session.h b/tools/perf/util/session.h
index 37bc38381fb6..7a5434c00565 100644
--- a/tools/perf/util/session.h
+++ b/tools/perf/util/session.h
@@ -73,6 +73,10 @@ int perf_session__resolve_callchain(struct perf_session *self, struct perf_evsel
                                     struct ip_callchain *chain,
                                     struct symbol **parent);
 
+struct branch_info *machine__resolve_bstack(struct machine *self,
+                                            struct thread *thread,
+                                            struct branch_stack *bs);
+
 bool perf_session__has_traces(struct perf_session *self, const char *msg);
 
 void mem_bswap_64(void *src, int byte_size);
@@ -147,7 +151,7 @@ struct perf_evsel *perf_session__find_first_evtype(struct perf_session *session,
 
 void perf_event__print_ip(union perf_event *event, struct perf_sample *sample,
                           struct machine *machine, struct perf_evsel *evsel,
-                          int print_sym, int print_dso);
+                          int print_sym, int print_dso, int print_symoffset);
 
 int perf_session__cpu_bitmap(struct perf_session *session,
                              const char *cpu_list, unsigned long *cpu_bitmap);
diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py
index 36d4c5619575..d0f9f29cf181 100644
--- a/tools/perf/util/setup.py
+++ b/tools/perf/util/setup.py
@@ -24,11 +24,11 @@ cflags += getenv('CFLAGS', '').split()
 build_lib = getenv('PYTHON_EXTBUILD_LIB')
 build_tmp = getenv('PYTHON_EXTBUILD_TMP')
 
+ext_sources = [f.strip() for f in file('util/python-ext-sources')
+                                if len(f.strip()) > 0 and f[0] != '#']
+
 perf = Extension('perf',
-                  sources = ['util/python.c', 'util/ctype.c', 'util/evlist.c',
-                             'util/evsel.c', 'util/cpumap.c', 'util/thread_map.c',
-                             'util/util.c', 'util/xyarray.c', 'util/cgroup.c',
-                             'util/debugfs.c'],
+                  sources = ext_sources,
                   include_dirs = ['util/include'],
                   extra_compile_args = cflags,
                  )
diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
index 16da30d8d765..a27237430c5f 100644
--- a/tools/perf/util/sort.c
+++ b/tools/perf/util/sort.c
@@ -8,6 +8,7 @@ const char	default_sort_order[] = "comm,dso,symbol";
 const char      *sort_order = default_sort_order;
 int             sort__need_collapse = 0;
 int             sort__has_parent = 0;
+int             sort__branch_mode = -1; /* -1 = means not set */
 
 enum sort_type  sort__first_dimension;
 
@@ -33,6 +34,9 @@ static int repsep_snprintf(char *bf, size_t size, const char *fmt, ...)
                 }
         }
         va_end(ap);
+
+        if (n >= (int)size)
+                return size - 1;
         return n;
 }
 
@@ -94,6 +98,26 @@ static int hist_entry__comm_snprintf(struct hist_entry *self, char *bf,
         return repsep_snprintf(bf, size, "%*s", width, self->thread->comm);
 }
 
+static int64_t _sort__dso_cmp(struct map *map_l, struct map *map_r)
+{
+        struct dso *dso_l = map_l ? map_l->dso : NULL;
+        struct dso *dso_r = map_r ? map_r->dso : NULL;
+        const char *dso_name_l, *dso_name_r;
+
+        if (!dso_l || !dso_r)
+                return cmp_null(dso_l, dso_r);
+
+        if (verbose) {
+                dso_name_l = dso_l->long_name;
+                dso_name_r = dso_r->long_name;
+        } else {
+                dso_name_l = dso_l->short_name;
+                dso_name_r = dso_r->short_name;
+        }
+
+        return strcmp(dso_name_l, dso_name_r);
+}
+
 struct sort_entry sort_comm = {
         .se_header      = "Command",
         .se_cmp         = sort__comm_cmp,
@@ -107,36 +131,74 @@ struct sort_entry sort_comm = {
 static int64_t
 sort__dso_cmp(struct hist_entry *left, struct hist_entry *right)
 {
-        struct dso *dso_l = left->ms.map ? left->ms.map->dso : NULL;
-        struct dso *dso_r = right->ms.map ? right->ms.map->dso : NULL;
-        const char *dso_name_l, *dso_name_r;
+        return _sort__dso_cmp(left->ms.map, right->ms.map);
+}
 
-        if (!dso_l || !dso_r)
-                return cmp_null(dso_l, dso_r);
 
-        if (verbose) {
-                dso_name_l = dso_l->long_name;
-                dso_name_r = dso_r->long_name;
-        } else {
-                dso_name_l = dso_l->short_name;
-                dso_name_r = dso_r->short_name;
+static int64_t _sort__sym_cmp(struct symbol *sym_l, struct symbol *sym_r,
+                              u64 ip_l, u64 ip_r)
+{
+        if (!sym_l || !sym_r)
+                return cmp_null(sym_l, sym_r);
+
+        if (sym_l == sym_r)
+                return 0;
+
+        if (sym_l)
+                ip_l = sym_l->start;
+        if (sym_r)
+                ip_r = sym_r->start;
+
+        return (int64_t)(ip_r - ip_l);
+}
+
+static int _hist_entry__dso_snprintf(struct map *map, char *bf,
+                                     size_t size, unsigned int width)
+{
+        if (map && map->dso) {
+                const char *dso_name = !verbose ? map->dso->short_name :
+                        map->dso->long_name;
+                return repsep_snprintf(bf, size, "%-*s", width, dso_name);
         }
 
-        return strcmp(dso_name_l, dso_name_r);
+        return repsep_snprintf(bf, size, "%-*s", width, "[unknown]");
 }
 
 static int hist_entry__dso_snprintf(struct hist_entry *self, char *bf,
                                     size_t size, unsigned int width)
 {
-        if (self->ms.map && self->ms.map->dso) {
-                const char *dso_name = !verbose ? self->ms.map->dso->short_name :
-                                                  self->ms.map->dso->long_name;
-                return repsep_snprintf(bf, size, "%-*s", width, dso_name);
+        return _hist_entry__dso_snprintf(self->ms.map, bf, size, width);
+}
+
+static int _hist_entry__sym_snprintf(struct map *map, struct symbol *sym,
+                                     u64 ip, char level, char *bf, size_t size,
+                                     unsigned int width __used)
+{
+        size_t ret = 0;
+
+        if (verbose) {
+                char o = map ? dso__symtab_origin(map->dso) : '!';
+                ret += repsep_snprintf(bf, size, "%-#*llx %c ",
+                                       BITS_PER_LONG / 4, ip, o);
         }
 
-        return repsep_snprintf(bf, size, "%-*s", width, "[unknown]");
+        ret += repsep_snprintf(bf + ret, size - ret, "[%c] ", level);
+        if (sym)
+                ret += repsep_snprintf(bf + ret, size - ret, "%-*s",
+                                       width - ret,
+                                       sym->name);
+        else {
+                size_t len = BITS_PER_LONG / 4;
+                ret += repsep_snprintf(bf + ret, size - ret, "%-#.*llx",
+                                       len, ip);
+                ret += repsep_snprintf(bf + ret, size - ret, "%-*s",
+                                       width - ret, "");
+        }
+
+        return ret;
 }
 
+
 struct sort_entry sort_dso = {
         .se_header      = "Shared Object",
         .se_cmp         = sort__dso_cmp,
@@ -144,8 +206,14 @@ struct sort_entry sort_dso = {
         .se_width_idx   = HISTC_DSO,
 };
 
-/* --sort symbol */
+static int hist_entry__sym_snprintf(struct hist_entry *self, char *bf,
+                                    size_t size, unsigned int width __used)
+{
+        return _hist_entry__sym_snprintf(self->ms.map, self->ms.sym, self->ip,
+                                         self->level, bf, size, width);
+}
 
+/* --sort symbol */
 static int64_t
 sort__sym_cmp(struct hist_entry *left, struct hist_entry *right)
 {
@@ -163,31 +231,7 @@ sort__sym_cmp(struct hist_entry *left, struct hist_entry *right)
         ip_l = left->ms.sym->start;
         ip_r = right->ms.sym->start;
 
-        return (int64_t)(ip_r - ip_l);
-}
-
-static int hist_entry__sym_snprintf(struct hist_entry *self, char *bf,
-                                    size_t size, unsigned int width __used)
-{
-        size_t ret = 0;
-
-        if (verbose) {
-                char o = self->ms.map ? dso__symtab_origin(self->ms.map->dso) : '!';
-                ret += repsep_snprintf(bf, size, "%-#*llx %c ",
-                                       BITS_PER_LONG / 4, self->ip, o);
-        }
-
-        if (!sort_dso.elide)
-                ret += repsep_snprintf(bf + ret, size - ret, "[%c] ", self->level);
-
-        if (self->ms.sym)
-                ret += repsep_snprintf(bf + ret, size - ret, "%s",
-                                       self->ms.sym->name);
-        else
-                ret += repsep_snprintf(bf + ret, size - ret, "%-#*llx",
-                                       BITS_PER_LONG / 4, self->ip);
-
-        return ret;
+        return _sort__sym_cmp(left->ms.sym, right->ms.sym, ip_l, ip_r);
 }
 
 struct sort_entry sort_sym = {
@@ -246,19 +290,155 @@ struct sort_entry sort_cpu = {
         .se_width_idx   = HISTC_CPU,
 };
 
+static int64_t
+sort__dso_from_cmp(struct hist_entry *left, struct hist_entry *right)
+{
+        return _sort__dso_cmp(left->branch_info->from.map,
+                              right->branch_info->from.map);
+}
+
+static int hist_entry__dso_from_snprintf(struct hist_entry *self, char *bf,
+                                    size_t size, unsigned int width)
+{
+        return _hist_entry__dso_snprintf(self->branch_info->from.map,
+                                         bf, size, width);
+}
+
+struct sort_entry sort_dso_from = {
+        .se_header      = "Source Shared Object",
+        .se_cmp         = sort__dso_from_cmp,
+        .se_snprintf    = hist_entry__dso_from_snprintf,
+        .se_width_idx   = HISTC_DSO_FROM,
+};
+
+static int64_t
+sort__dso_to_cmp(struct hist_entry *left, struct hist_entry *right)
+{
+        return _sort__dso_cmp(left->branch_info->to.map,
+                              right->branch_info->to.map);
+}
+
+static int hist_entry__dso_to_snprintf(struct hist_entry *self, char *bf,
+                                       size_t size, unsigned int width)
+{
+        return _hist_entry__dso_snprintf(self->branch_info->to.map,
+                                         bf, size, width);
+}
+
+static int64_t
+sort__sym_from_cmp(struct hist_entry *left, struct hist_entry *right)
+{
+        struct addr_map_symbol *from_l = &left->branch_info->from;
+        struct addr_map_symbol *from_r = &right->branch_info->from;
+
+        if (!from_l->sym && !from_r->sym)
+                return right->level - left->level;
+
+        return _sort__sym_cmp(from_l->sym, from_r->sym, from_l->addr,
+                             from_r->addr);
+}
+
+static int64_t
+sort__sym_to_cmp(struct hist_entry *left, struct hist_entry *right)
+{
+        struct addr_map_symbol *to_l = &left->branch_info->to;
+        struct addr_map_symbol *to_r = &right->branch_info->to;
+
+        if (!to_l->sym && !to_r->sym)
+                return right->level - left->level;
+
+        return _sort__sym_cmp(to_l->sym, to_r->sym, to_l->addr, to_r->addr);
+}
+
+static int hist_entry__sym_from_snprintf(struct hist_entry *self, char *bf,
+                                    size_t size, unsigned int width __used)
+{
+        struct addr_map_symbol *from = &self->branch_info->from;
+        return _hist_entry__sym_snprintf(from->map, from->sym, from->addr,
+                                         self->level, bf, size, width);
+
+}
+
+static int hist_entry__sym_to_snprintf(struct hist_entry *self, char *bf,
+                                    size_t size, unsigned int width __used)
+{
+        struct addr_map_symbol *to = &self->branch_info->to;
+        return _hist_entry__sym_snprintf(to->map, to->sym, to->addr,
+                                         self->level, bf, size, width);
+
+}
+
+struct sort_entry sort_dso_to = {
+        .se_header      = "Target Shared Object",
+        .se_cmp         = sort__dso_to_cmp,
+        .se_snprintf    = hist_entry__dso_to_snprintf,
+        .se_width_idx   = HISTC_DSO_TO,
+};
+
+struct sort_entry sort_sym_from = {
+        .se_header      = "Source Symbol",
+        .se_cmp         = sort__sym_from_cmp,
+        .se_snprintf    = hist_entry__sym_from_snprintf,
+        .se_width_idx   = HISTC_SYMBOL_FROM,
+};
+
+struct sort_entry sort_sym_to = {
+        .se_header      = "Target Symbol",
+        .se_cmp         = sort__sym_to_cmp,
+        .se_snprintf    = hist_entry__sym_to_snprintf,
+        .se_width_idx   = HISTC_SYMBOL_TO,
+};
+
+static int64_t
+sort__mispredict_cmp(struct hist_entry *left, struct hist_entry *right)
+{
+        const unsigned char mp = left->branch_info->flags.mispred !=
+                                        right->branch_info->flags.mispred;
+        const unsigned char p = left->branch_info->flags.predicted !=
+                                        right->branch_info->flags.predicted;
+
+        return mp || p;
+}
+
+static int hist_entry__mispredict_snprintf(struct hist_entry *self, char *bf,
+                                    size_t size, unsigned int width){
+        static const char *out = "N/A";
+
+        if (self->branch_info->flags.predicted)
+                out = "N";
+        else if (self->branch_info->flags.mispred)
+                out = "Y";
+
+        return repsep_snprintf(bf, size, "%-*s", width, out);
+}
+
+struct sort_entry sort_mispredict = {
+        .se_header      = "Branch Mispredicted",
+        .se_cmp         = sort__mispredict_cmp,
+        .se_snprintf    = hist_entry__mispredict_snprintf,
+        .se_width_idx   = HISTC_MISPREDICT,
+};
+
 struct sort_dimension {
         const char              *name;
         struct sort_entry       *entry;
         int                     taken;
 };
 
+#define DIM(d, n, func) [d] = { .name = n, .entry = &(func) }
+
 static struct sort_dimension sort_dimensions[] = {
-        { .name = "pid",        .entry = &sort_thread,  },
-        { .name = "comm",       .entry = &sort_comm,    },
-        { .name = "dso",        .entry = &sort_dso,     },
-        { .name = "symbol",     .entry = &sort_sym,     },
-        { .name = "parent",     .entry = &sort_parent,  },
-        { .name = "cpu",        .entry = &sort_cpu,     },
+        DIM(SORT_PID, "pid", sort_thread),
+        DIM(SORT_COMM, "comm", sort_comm),
+        DIM(SORT_DSO, "dso", sort_dso),
+        DIM(SORT_DSO_FROM, "dso_from", sort_dso_from),
+        DIM(SORT_DSO_TO, "dso_to", sort_dso_to),
+        DIM(SORT_SYM, "symbol", sort_sym),
+        DIM(SORT_SYM_TO, "symbol_from", sort_sym_from),
+        DIM(SORT_SYM_FROM, "symbol_to", sort_sym_to),
+        DIM(SORT_PARENT, "parent", sort_parent),
+        DIM(SORT_CPU, "cpu", sort_cpu),
+        DIM(SORT_MISPREDICT, "mispredict", sort_mispredict),
 };
 
 int sort_dimension__add(const char *tok)
@@ -270,7 +450,6 @@ int sort_dimension__add(const char *tok)
 
                 if (strncasecmp(tok, sd->name, strlen(tok)))
                         continue;
-
                 if (sd->entry == &sort_parent) {
                         int ret = regcomp(&parent_regex, parent_pattern, REG_EXTENDED);
                         if (ret) {
@@ -302,6 +481,16 @@ int sort_dimension__add(const char *tok)
                                 sort__first_dimension = SORT_PARENT;
                         else if (!strcmp(sd->name, "cpu"))
                                 sort__first_dimension = SORT_CPU;
+                        else if (!strcmp(sd->name, "symbol_from"))
+                                sort__first_dimension = SORT_SYM_FROM;
+                        else if (!strcmp(sd->name, "symbol_to"))
+                                sort__first_dimension = SORT_SYM_TO;
+                        else if (!strcmp(sd->name, "dso_from"))
+                                sort__first_dimension = SORT_DSO_FROM;
+                        else if (!strcmp(sd->name, "dso_to"))
+                                sort__first_dimension = SORT_DSO_TO;
+                        else if (!strcmp(sd->name, "mispredict"))
+                                sort__first_dimension = SORT_MISPREDICT;
                 }
 
                 list_add_tail(&sd->entry->list, &hist_entry__sort_list);
@@ -309,7 +498,6 @@ int sort_dimension__add(const char *tok)
 
                 return 0;
         }
-
         return -ESRCH;
 }
 
diff --git a/tools/perf/util/sort.h b/tools/perf/util/sort.h
index 3f67ae395752..472aa5a63a58 100644
--- a/tools/perf/util/sort.h
+++ b/tools/perf/util/sort.h
@@ -31,11 +31,16 @@ extern const char *parent_pattern;
 extern const char default_sort_order[];
 extern int sort__need_collapse;
 extern int sort__has_parent;
+extern int sort__branch_mode;
 extern char *field_sep;
 extern struct sort_entry sort_comm;
 extern struct sort_entry sort_dso;
 extern struct sort_entry sort_sym;
 extern struct sort_entry sort_parent;
+extern struct sort_entry sort_dso_from;
+extern struct sort_entry sort_dso_to;
+extern struct sort_entry sort_sym_from;
+extern struct sort_entry sort_sym_to;
 extern enum sort_type sort__first_dimension;
 
 /**
@@ -72,6 +77,7 @@ struct hist_entry {
                 struct hist_entry *pair;
                 struct rb_root    sorted_chain;
         };
+        struct branch_info      *branch_info;
         struct callchain_root   callchain[0];
 };
 
@@ -82,6 +88,11 @@ enum sort_type {
         SORT_SYM,
         SORT_PARENT,
         SORT_CPU,
+        SORT_DSO_FROM,
+        SORT_DSO_TO,
+        SORT_SYM_FROM,
+        SORT_SYM_TO,
+        SORT_MISPREDICT,
 };
 
 /*
diff --git a/tools/perf/util/strbuf.c b/tools/perf/util/strbuf.c
index 92e068517c1a..2eeb51baf077 100644
--- a/tools/perf/util/strbuf.c
+++ b/tools/perf/util/strbuf.c
@@ -1,4 +1,5 @@
 #include "cache.h"
+#include <linux/kernel.h>
 
 int prefixcmp(const char *str, const char *prefix)
 {
@@ -89,14 +90,14 @@ void strbuf_addf(struct strbuf *sb, const char *fmt, ...)
         if (!strbuf_avail(sb))
                 strbuf_grow(sb, 64);
         va_start(ap, fmt);
-        len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap);
+        len = vscnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap);
         va_end(ap);
         if (len < 0)
-                die("your vsnprintf is broken");
+                die("your vscnprintf is broken");
         if (len > strbuf_avail(sb)) {
                 strbuf_grow(sb, len);
                 va_start(ap, fmt);
-                len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap);
+                len = vscnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap);
                 va_end(ap);
                 if (len > strbuf_avail(sb)) {
                         die("this should not happen, your snprintf is broken");
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 215d50f2042e..c0a028c3ebaf 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1,8 +1,5 @@
-#define _GNU_SOURCE
-#include <ctype.h>
 #include <dirent.h>
 #include <errno.h>
-#include <libgen.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
@@ -13,6 +10,7 @@
 #include <unistd.h>
 #include <inttypes.h>
 #include "build-id.h"
+#include "util.h"
 #include "debug.h"
 #include "symbol.h"
 #include "strlist.h"
@@ -52,6 +50,8 @@ struct symbol_conf symbol_conf = {
 
 int dso__name_len(const struct dso *dso)
 {
+        if (!dso)
+                return strlen("[unknown]");
         if (verbose)
                 return dso->long_name_len;
 
@@ -264,6 +264,28 @@ static size_t symbol__fprintf(struct symbol *sym, FILE *fp)
                        sym->name);
 }
 
+size_t symbol__fprintf_symname_offs(const struct symbol *sym,
+                                    const struct addr_location *al, FILE *fp)
+{
+        unsigned long offset;
+        size_t length;
+
+        if (sym && sym->name) {
+                length = fprintf(fp, "%s", sym->name);
+                if (al) {
+                        offset = al->addr - sym->start;
+                        length += fprintf(fp, "+0x%lx", offset);
+                }
+                return length;
+        } else
+                return fprintf(fp, "[unknown]");
+}
+
+size_t symbol__fprintf_symname(const struct symbol *sym, FILE *fp)
+{
+        return symbol__fprintf_symname_offs(sym, NULL, fp);
+}
+
 void dso__set_long_name(struct dso *dso, char *name)
 {
         if (name == NULL)
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 123c2e14353e..ac49ef208a5f 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -5,6 +5,7 @@
 #include <stdbool.h>
 #include <stdint.h>
 #include "map.h"
+#include "../perf.h"
 #include <linux/list.h>
 #include <linux/rbtree.h>
 #include <stdio.h>
@@ -70,6 +71,7 @@ struct symbol_conf {
         unsigned short  priv_size;
         unsigned short  nr_events;
         bool            try_vmlinux_path,
+                        show_kernel_path,
                         use_modules,
                         sort_by_name,
                         show_nr_samples,
@@ -95,7 +97,11 @@ struct symbol_conf {
                         *col_width_list_str;
        struct strlist   *dso_list,
                         *comm_list,
-                        *sym_list;
+                        *sym_list,
+                        *dso_from_list,
+                        *dso_to_list,
+                        *sym_from_list,
+                        *sym_to_list;
         const char      *symfs;
 };
 
@@ -119,6 +125,19 @@ struct map_symbol {
         bool          has_children;
 };
 
+struct addr_map_symbol {
+        struct map    *map;
+        struct symbol *sym;
+        u64           addr;
+        u64           al_addr;
+};
+
+struct branch_info {
+        struct addr_map_symbol from;
+        struct addr_map_symbol to;
+        struct branch_flags flags;
+};
+
 struct addr_location {
         struct thread *thread;
         struct map    *map;
@@ -241,6 +260,9 @@ void machines__destroy_guest_kernel_maps(struct rb_root *machines);
 
 int symbol__init(void);
 void symbol__exit(void);
+size_t symbol__fprintf_symname_offs(const struct symbol *sym,
+                                    const struct addr_location *al, FILE *fp);
+size_t symbol__fprintf_symname(const struct symbol *sym, FILE *fp);
 bool symbol_type__is_a(char symbol_type, enum map_type map_type);
 
 size_t machine__fprintf_vmlinux_path(struct machine *machine, FILE *fp);
diff --git a/tools/perf/util/sysfs.c b/tools/perf/util/sysfs.c
new file mode 100644
index 000000000000..48c6902e749f
--- /dev/null
+++ b/tools/perf/util/sysfs.c
@@ -0,0 +1,60 @@
+
+#include "util.h"
+#include "sysfs.h"
+
+static const char * const sysfs_known_mountpoints[] = {
+        "/sys",
+        0,
+};
+
+static int sysfs_found;
+char sysfs_mountpoint[PATH_MAX];
+
+static int sysfs_valid_mountpoint(const char *sysfs)
+{
+        struct statfs st_fs;
+
+        if (statfs(sysfs, &st_fs) < 0)
+                return -ENOENT;
+        else if (st_fs.f_type != (long) SYSFS_MAGIC)
+                return -ENOENT;
+
+        return 0;
+}
+
+const char *sysfs_find_mountpoint(void)
+{
+        const char * const *ptr;
+        char type[100];
+        FILE *fp;
+
+        if (sysfs_found)
+                return (const char *) sysfs_mountpoint;
+
+        ptr = sysfs_known_mountpoints;
+        while (*ptr) {
+                if (sysfs_valid_mountpoint(*ptr) == 0) {
+                        sysfs_found = 1;
+                        strcpy(sysfs_mountpoint, *ptr);
+                        return sysfs_mountpoint;
+                }
+                ptr++;
+        }
+
+        /* give up and parse /proc/mounts */
+        fp = fopen("/proc/mounts", "r");
+        if (fp == NULL)
+                return NULL;
+
+        while (!sysfs_found &&
+               fscanf(fp, "%*s %" STR(PATH_MAX) "s %99s %*s %*d %*d\n",
+                      sysfs_mountpoint, type) == 2) {
+
+                if (strcmp(type, "sysfs") == 0)
+                        sysfs_found = 1;
+        }
+
+        fclose(fp);
+
+        return sysfs_found ? sysfs_mountpoint : NULL;
+}
diff --git a/tools/perf/util/sysfs.h b/tools/perf/util/sysfs.h
new file mode 100644
index 000000000000..a813b7203938
--- /dev/null
+++ b/tools/perf/util/sysfs.h
@@ -0,0 +1,6 @@
+#ifndef __SYSFS_H__
+#define __SYSFS_H__
+
+const char *sysfs_find_mountpoint(void);
+
+#endif /* __DEBUGFS_H__ */
diff --git a/tools/perf/util/thread_map.c b/tools/perf/util/thread_map.c
index a5df131b77c3..84d9bd782004 100644
--- a/tools/perf/util/thread_map.c
+++ b/tools/perf/util/thread_map.c
@@ -1,6 +1,13 @@
 #include <dirent.h>
+#include <limits.h>
+#include <stdbool.h>
 #include <stdlib.h>
 #include <stdio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include "strlist.h"
+#include <string.h>
 #include "thread_map.h"
 
 /* Skip "." and ".." directories */
@@ -23,7 +30,7 @@ struct thread_map *thread_map__new_by_pid(pid_t pid)
         sprintf(name, "/proc/%d/task", pid);
         items = scandir(name, &namelist, filter, NULL);
         if (items <= 0)
-                return NULL;
+                return NULL;
 
         threads = malloc(sizeof(*threads) + sizeof(pid_t) * items);
         if (threads != NULL) {
@@ -51,14 +58,240 @@ struct thread_map *thread_map__new_by_tid(pid_t tid)
         return threads;
 }
 
-struct thread_map *thread_map__new(pid_t pid, pid_t tid)
+struct thread_map *thread_map__new_by_uid(uid_t uid)
+{
+        DIR *proc;
+        int max_threads = 32, items, i;
+        char path[256];
+        struct dirent dirent, *next, **namelist = NULL;
+        struct thread_map *threads = malloc(sizeof(*threads) +
+                                            max_threads * sizeof(pid_t));
+        if (threads == NULL)
+                goto out;
+
+        proc = opendir("/proc");
+        if (proc == NULL)
+                goto out_free_threads;
+
+        threads->nr = 0;
+
+        while (!readdir_r(proc, &dirent, &next) && next) {
+                char *end;
+                bool grow = false;
+                struct stat st;
+                pid_t pid = strtol(dirent.d_name, &end, 10);
+
+                if (*end) /* only interested in proper numerical dirents */
+                        continue;
+
+                snprintf(path, sizeof(path), "/proc/%s", dirent.d_name);
+
+                if (stat(path, &st) != 0)
+                        continue;
+
+                if (st.st_uid != uid)
+                        continue;
+
+                snprintf(path, sizeof(path), "/proc/%d/task", pid);
+                items = scandir(path, &namelist, filter, NULL);
+                if (items <= 0)
+                        goto out_free_closedir;
+
+                while (threads->nr + items >= max_threads) {
+                        max_threads *= 2;
+                        grow = true;
+                }
+
+                if (grow) {
+                        struct thread_map *tmp;
+
+                        tmp = realloc(threads, (sizeof(*threads) +
+                                                max_threads * sizeof(pid_t)));
+                        if (tmp == NULL)
+                                goto out_free_namelist;
+
+                        threads = tmp;
+                }
+
+                for (i = 0; i < items; i++)
+                        threads->map[threads->nr + i] = atoi(namelist[i]->d_name);
+
+                for (i = 0; i < items; i++)
+                        free(namelist[i]);
+                free(namelist);
+
+                threads->nr += items;
+        }
+
+out_closedir:
+        closedir(proc);
+out:
+        return threads;
+
+out_free_threads:
+        free(threads);
+        return NULL;
+
+out_free_namelist:
+        for (i = 0; i < items; i++)
+                free(namelist[i]);
+        free(namelist);
+
+out_free_closedir:
+        free(threads);
+        threads = NULL;
+        goto out_closedir;
+}
+
+struct thread_map *thread_map__new(pid_t pid, pid_t tid, uid_t uid)
 {
         if (pid != -1)
                 return thread_map__new_by_pid(pid);
+
+        if (tid == -1 && uid != UINT_MAX)
+                return thread_map__new_by_uid(uid);
+
         return thread_map__new_by_tid(tid);
 }
 
+static struct thread_map *thread_map__new_by_pid_str(const char *pid_str)
+{
+        struct thread_map *threads = NULL, *nt;
+        char name[256];
+        int items, total_tasks = 0;
+        struct dirent **namelist = NULL;
+        int i, j = 0;
+        pid_t pid, prev_pid = INT_MAX;
+        char *end_ptr;
+        struct str_node *pos;
+        struct strlist *slist = strlist__new(false, pid_str);
+
+        if (!slist)
+                return NULL;
+
+        strlist__for_each(pos, slist) {
+                pid = strtol(pos->s, &end_ptr, 10);
+
+                if (pid == INT_MIN || pid == INT_MAX ||
+                    (*end_ptr != '\0' && *end_ptr != ','))
+                        goto out_free_threads;
+
+                if (pid == prev_pid)
+                        continue;
+
+                sprintf(name, "/proc/%d/task", pid);
+                items = scandir(name, &namelist, filter, NULL);
+                if (items <= 0)
+                        goto out_free_threads;
+
+                total_tasks += items;
+                nt = realloc(threads, (sizeof(*threads) +
+                                       sizeof(pid_t) * total_tasks));
+                if (nt == NULL)
+                        goto out_free_threads;
+
+                threads = nt;
+
+                if (threads) {
+                        for (i = 0; i < items; i++)
+                                threads->map[j++] = atoi(namelist[i]->d_name);
+                        threads->nr = total_tasks;
+                }
+
+                for (i = 0; i < items; i++)
+                        free(namelist[i]);
+                free(namelist);
+
+                if (!threads)
+                        break;
+        }
+
+out:
+        strlist__delete(slist);
+        return threads;
+
+out_free_threads:
+        free(threads);
+        threads = NULL;
+        goto out;
+}
+
+static struct thread_map *thread_map__new_by_tid_str(const char *tid_str)
+{
+        struct thread_map *threads = NULL, *nt;
+        int ntasks = 0;
+        pid_t tid, prev_tid = INT_MAX;
+        char *end_ptr;
+        struct str_node *pos;
+        struct strlist *slist;
+
+        /* perf-stat expects threads to be generated even if tid not given */
+        if (!tid_str) {
+                threads = malloc(sizeof(*threads) + sizeof(pid_t));
+                if (threads != NULL) {
+                        threads->map[0] = -1;
+                        threads->nr     = 1;
+                }
+                return threads;
+        }
+
+        slist = strlist__new(false, tid_str);
+        if (!slist)
+                return NULL;
+
+        strlist__for_each(pos, slist) {
+                tid = strtol(pos->s, &end_ptr, 10);
+
+                if (tid == INT_MIN || tid == INT_MAX ||
+                    (*end_ptr != '\0' && *end_ptr != ','))
+                        goto out_free_threads;
+
+                if (tid == prev_tid)
+                        continue;
+
+                ntasks++;
+                nt = realloc(threads, sizeof(*threads) + sizeof(pid_t) * ntasks);
+
+                if (nt == NULL)
+                        goto out_free_threads;
+
+                threads = nt;
+                threads->map[ntasks - 1] = tid;
+                threads->nr              = ntasks;
+        }
+out:
+        return threads;
+
+out_free_threads:
+        free(threads);
+        threads = NULL;
+        goto out;
+}
+
+struct thread_map *thread_map__new_str(const char *pid, const char *tid,
+                                       uid_t uid)
+{
+        if (pid)
+                return thread_map__new_by_pid_str(pid);
+
+        if (!tid && uid != UINT_MAX)
+                return thread_map__new_by_uid(uid);
+
+        return thread_map__new_by_tid_str(tid);
+}
+
 void thread_map__delete(struct thread_map *threads)
 {
         free(threads);
 }
+
+size_t thread_map__fprintf(struct thread_map *threads, FILE *fp)
+{
+        int i;
+        size_t printed = fprintf(fp, "%d thread%s: ",
+                                 threads->nr, threads->nr > 1 ? "s" : "");
+        for (i = 0; i < threads->nr; ++i)
+                printed += fprintf(fp, "%s%d", i ? ", " : "", threads->map[i]);
+
+        return printed + fprintf(fp, "\n");
+}
diff --git a/tools/perf/util/thread_map.h b/tools/perf/util/thread_map.h
index 3cb907311409..7da80f14418b 100644
--- a/tools/perf/util/thread_map.h
+++ b/tools/perf/util/thread_map.h
@@ -2,6 +2,7 @@
 #define __PERF_THREAD_MAP_H
 
 #include <sys/types.h>
+#include <stdio.h>
 
 struct thread_map {
         int nr;
@@ -10,6 +11,14 @@ struct thread_map {
 
 struct thread_map *thread_map__new_by_pid(pid_t pid);
 struct thread_map *thread_map__new_by_tid(pid_t tid);
-struct thread_map *thread_map__new(pid_t pid, pid_t tid);
+struct thread_map *thread_map__new_by_uid(uid_t uid);
+struct thread_map *thread_map__new(pid_t pid, pid_t tid, uid_t uid);
+
+struct thread_map *thread_map__new_str(const char *pid,
+                const char *tid, uid_t uid);
+
 void thread_map__delete(struct thread_map *threads);
+
+size_t thread_map__fprintf(struct thread_map *threads, FILE *fp);
+
 #endif  /* __PERF_THREAD_MAP_H */
diff --git a/tools/perf/util/top.c b/tools/perf/util/top.c
index 500471dffa4f..09fe579ccafb 100644
--- a/tools/perf/util/top.c
+++ b/tools/perf/util/top.c
@@ -69,12 +69,15 @@ size_t perf_top__header_snprintf(struct perf_top *top, char *bf, size_t size)
 
         ret += SNPRINTF(bf + ret, size - ret, "], ");
 
-        if (top->target_pid != -1)
-                ret += SNPRINTF(bf + ret, size - ret, " (target_pid: %d",
+        if (top->target_pid)
+                ret += SNPRINTF(bf + ret, size - ret, " (target_pid: %s",
                                 top->target_pid);
-        else if (top->target_tid != -1)
-                ret += SNPRINTF(bf + ret, size - ret, " (target_tid: %d",
+        else if (top->target_tid)
+                ret += SNPRINTF(bf + ret, size - ret, " (target_tid: %s",
                                 top->target_tid);
+        else if (top->uid_str != NULL)
+                ret += SNPRINTF(bf + ret, size - ret, " (uid: %s",
+                                top->uid_str);
         else
                 ret += SNPRINTF(bf + ret, size - ret, " (all");
 
@@ -82,7 +85,7 @@ size_t perf_top__header_snprintf(struct perf_top *top, char *bf, size_t size)
                 ret += SNPRINTF(bf + ret, size - ret, ", CPU%s: %s)",
                                 top->evlist->cpus->nr > 1 ? "s" : "", top->cpu_list);
         else {
-                if (top->target_tid != -1)
+                if (top->target_tid)
                         ret += SNPRINTF(bf + ret, size - ret, ")");
                 else
                         ret += SNPRINTF(bf + ret, size - ret, ", %d CPU%s)",
diff --git a/tools/perf/util/top.h b/tools/perf/util/top.h
index a248f3c2c60d..ce61cb2d1acf 100644
--- a/tools/perf/util/top.h
+++ b/tools/perf/util/top.h
@@ -23,7 +23,8 @@ struct perf_top {
         u64                guest_us_samples, guest_kernel_samples;
         int                print_entries, count_filter, delay_secs;
         int                freq;
-        pid_t              target_pid, target_tid;
+        const char         *target_pid, *target_tid;
+        uid_t              uid;
         bool               hide_kernel_symbols, hide_user_symbols, zero;
         bool               system_wide;
         bool               use_tui, use_stdio;
@@ -33,7 +34,8 @@ struct perf_top {
         bool               vmlinux_warned;
         bool               inherit;
         bool               group;
-        bool               sample_id_all_avail;
+        bool               sample_id_all_missing;
+        bool               exclude_guest_missing;
         bool               dump_symtab;
         const char         *cpu_list;
         struct hist_entry  *sym_filter_entry;
@@ -45,6 +47,7 @@ struct perf_top {
         int                realtime_prio;
         int                sym_pcnt_filter;
         const char         *sym_filter;
+        const char         *uid_str;
 };
 
 size_t perf_top__header_snprintf(struct perf_top *top, char *bf, size_t size);
diff --git a/tools/perf/util/trace-event-info.c b/tools/perf/util/trace-event-info.c
index ac6830d8292b..fc22cf5c605f 100644
--- a/tools/perf/util/trace-event-info.c
+++ b/tools/perf/util/trace-event-info.c
@@ -18,7 +18,6 @@
  *
  * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  */
-#include <ctype.h>
 #include "util.h"
 #include <dirent.h>
 #include <mntent.h>
diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
index 6c164dc9ee95..dfd1bd8371a4 100644
--- a/tools/perf/util/trace-event-parse.c
+++ b/tools/perf/util/trace-event-parse.c
@@ -21,14 +21,12 @@
  *  The parts for function graph printing was taken and modified from the
  *  Linux Kernel that were written by Frederic Weisbecker.
  */
-#define _GNU_SOURCE
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <ctype.h>
 #include <errno.h>
 
-#undef _GNU_SOURCE
 #include "../perf.h"
 #include "util.h"
 #include "trace-event.h"
@@ -724,7 +722,7 @@ static char *event_read_name(void)
 static int event_read_id(void)
 {
         char *token;
-        int id;
+        int id = -1;
 
         if (read_expected_item(EVENT_ITEM, "ID") < 0)
                 return -1;
@@ -733,15 +731,13 @@ static int event_read_id(void)
                 return -1;
 
         if (read_expect_type(EVENT_ITEM, &token) < 0)
-                goto fail;
+                goto free;
 
         id = strtoul(token, NULL, 0);
-        free_token(token);
-        return id;
 
- fail:
+ free:
         free_token(token);
-        return -1;
+        return id;
 }
 
 static int field_is_string(struct format_field *field)
@@ -1425,6 +1421,11 @@ static long long arg_num_eval(struct print_arg *arg)
                                 die("unknown op '%s'", arg->op.op);
                         }
                         break;
+                case '+':
+                        left = arg_num_eval(arg->op.left);
+                        right = arg_num_eval(arg->op.right);
+                        val = left + right;
+                        break;
                 default:
                         die("unknown op '%s'", arg->op.op);
                 }
@@ -1485,6 +1486,13 @@ process_fields(struct event *event, struct print_flag_sym **list, char **tok)
 
                 free_token(token);
                 type = process_arg(event, arg, &token);
+
+                if (type == EVENT_OP)
+                        type = process_op(event, arg, &token);
+
+                if (type == EVENT_ERROR)
+                        goto out_free;
+
                 if (test_type_token(type, token, EVENT_DELIM, ","))
                         goto out_free;
 
diff --git a/tools/perf/util/trace-event-read.c b/tools/perf/util/trace-event-read.c
index f55cc3a765a1..b9592e0de8d7 100644
--- a/tools/perf/util/trace-event-read.c
+++ b/tools/perf/util/trace-event-read.c
@@ -33,7 +33,6 @@
 #include <pthread.h>
 #include <fcntl.h>
 #include <unistd.h>
-#include <ctype.h>
 #include <errno.h>
 
 #include "../perf.h"
diff --git a/tools/perf/util/trace-event-scripting.c b/tools/perf/util/trace-event-scripting.c
index a3fdf55f317b..18ae6c1831d3 100644
--- a/tools/perf/util/trace-event-scripting.c
+++ b/tools/perf/util/trace-event-scripting.c
@@ -22,7 +22,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <ctype.h>
 #include <errno.h>
 
 #include "../perf.h"
diff --git a/tools/perf/util/ui/browser.h b/tools/perf/util/ui/browser.h
index 84d761b730c1..6ee82f60feaf 100644
--- a/tools/perf/util/ui/browser.h
+++ b/tools/perf/util/ui/browser.h
@@ -49,6 +49,8 @@ int ui_browser__warning(struct ui_browser *browser, int timeout,
                         const char *format, ...);
 int ui_browser__help_window(struct ui_browser *browser, const char *text);
 bool ui_browser__dialog_yesno(struct ui_browser *browser, const char *text);
+int ui_browser__input_window(const char *title, const char *text, char *input,
+                             const char *exit_msg, int delay_sec);
 
 void ui_browser__argv_seek(struct ui_browser *browser, off_t offset, int whence);
 unsigned int ui_browser__argv_refresh(struct ui_browser *browser);
diff --git a/tools/perf/util/ui/browsers/annotate.c b/tools/perf/util/ui/browsers/annotate.c
index 295a9c93f945..57a4c6ef3fd2 100644
--- a/tools/perf/util/ui/browsers/annotate.c
+++ b/tools/perf/util/ui/browsers/annotate.c
@@ -69,14 +69,17 @@ static void annotate_browser__write(struct ui_browser *self, void *entry, int ro
         if (!self->navkeypressed)
                 width += 1;
 
+        if (!ab->hide_src_code && ol->offset != -1)
+                if (!current_entry || (self->use_navkeypressed &&
+                                       !self->navkeypressed))
+                        ui_browser__set_color(self, HE_COLORSET_CODE);
+
         if (!*ol->line)
                 slsmg_write_nstring(" ", width - 18);
         else
                 slsmg_write_nstring(ol->line, width - 18);
 
-        if (!current_entry)
-                ui_browser__set_color(self, HE_COLORSET_CODE);
-        else
+        if (current_entry)
                 ab->selection = ol;
 }
 
@@ -230,9 +233,9 @@ static int annotate_browser__run(struct annotate_browser *self, int evidx,
         struct rb_node *nd = NULL;
         struct map_symbol *ms = self->b.priv;
         struct symbol *sym = ms->sym;
-        const char *help = "<-, ESC: exit, TAB/shift+TAB: cycle hottest lines, "
-                           "H: Hottest, -> Line action, S -> Toggle source "
-                           "code view";
+        const char *help = "<-/ESC: Exit, TAB/shift+TAB: Cycle hot lines, "
+                           "H: Go to hottest line, ->/ENTER: Line action, "
+                           "S: Toggle source code view";
         int key;
 
         if (ui_browser__show(&self->b, sym->name, help) < 0)
@@ -284,9 +287,11 @@ static int annotate_browser__run(struct annotate_browser *self, int evidx,
                                 nd = self->curr_hot;
                         break;
                 case 'H':
+                case 'h':
                         nd = self->curr_hot;
                         break;
                 case 'S':
+                case 's':
                         if (annotate_browser__toggle_source(self))
                                 ui_helpline__puts(help);
                         continue;
@@ -338,6 +343,7 @@ static int annotate_browser__run(struct annotate_browser *self, int evidx,
                                 pthread_mutex_unlock(&notes->lock);
                                 symbol__tui_annotate(target, ms->map, evidx,
                                                      timer, arg, delay_secs);
+                                ui_browser__show_title(&self->b, sym->name);
                         }
                         continue;
                 case K_LEFT:
diff --git a/tools/perf/util/ui/browsers/hists.c b/tools/perf/util/ui/browsers/hists.c
index 1212a386a033..d7a1c4afe28b 100644
--- a/tools/perf/util/ui/browsers/hists.c
+++ b/tools/perf/util/ui/browsers/hists.c
@@ -1,6 +1,4 @@
-#define _GNU_SOURCE
 #include <stdio.h>
-#undef _GNU_SOURCE
 #include "../libslang.h"
 #include <stdlib.h>
 #include <string.h>
@@ -807,8 +805,11 @@ static struct hist_browser *hist_browser__new(struct hists *hists)
                 self->hists = hists;
                 self->b.refresh = hist_browser__refresh;
                 self->b.seek = ui_browser__hists_seek;
-                self->b.use_navkeypressed = true,
-                self->has_symbols = sort_sym.list.next != NULL;
+                self->b.use_navkeypressed = true;
+                if (sort__branch_mode == 1)
+                        self->has_symbols = sort_sym_from.list.next != NULL;
+                else
+                        self->has_symbols = sort_sym.list.next != NULL;
         }
 
         return self;
@@ -839,19 +840,32 @@ static int hists__browser_title(struct hists *self, char *bf, size_t size,
         unsigned long nr_events = self->stats.nr_events[PERF_RECORD_SAMPLE];
 
         nr_events = convert_unit(nr_events, &unit);
-        printed = snprintf(bf, size, "Events: %lu%c %s", nr_events, unit, ev_name);
+        printed = scnprintf(bf, size, "Events: %lu%c %s", nr_events, unit, ev_name);
 
-        if (thread)
+        if (self->uid_filter_str)
                 printed += snprintf(bf + printed, size - printed,
+                                    ", UID: %s", self->uid_filter_str);
+        if (thread)
+                printed += scnprintf(bf + printed, size - printed,
                                     ", Thread: %s(%d)",
                                     (thread->comm_set ? thread->comm : ""),
                                     thread->pid);
         if (dso)
-                printed += snprintf(bf + printed, size - printed,
+                printed += scnprintf(bf + printed, size - printed,
                                     ", DSO: %s", dso->short_name);
         return printed;
 }
 
+static inline void free_popup_options(char **options, int n)
+{
+        int i;
+
+        for (i = 0; i < n; ++i) {
+                free(options[i]);
+                options[i] = NULL;
+        }
+}
+
 static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                                     const char *helpline, const char *ev_name,
                                     bool left_exits,
@@ -860,8 +874,12 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
 {
         struct hists *self = &evsel->hists;
         struct hist_browser *browser = hist_browser__new(self);
+        struct branch_info *bi;
         struct pstack *fstack;
+        char *options[16];
+        int nr_options = 0;
         int key = -1;
+        char buf[64];
 
         if (browser == NULL)
                 return -1;
@@ -872,13 +890,16 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
 
         ui_helpline__push(helpline);
 
+        memset(options, 0, sizeof(options));
+
         while (1) {
                 const struct thread *thread = NULL;
                 const struct dso *dso = NULL;
-                char *options[16];
-                int nr_options = 0, choice = 0, i,
+                int choice = 0,
                     annotate = -2, zoom_dso = -2, zoom_thread = -2,
-                    browse_map = -2;
+                    annotate_f = -2, annotate_t = -2, browse_map = -2;
+
+                nr_options = 0;
 
                 key = hist_browser__run(browser, ev_name, timer, arg, delay_secs);
 
@@ -886,7 +907,6 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                         thread = hist_browser__selected_thread(browser);
                         dso = browser->selection->map ? browser->selection->map->dso : NULL;
                 }
-
                 switch (key) {
                 case K_TAB:
                 case K_UNTAB:
@@ -901,7 +921,7 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                         if (!browser->has_symbols) {
                                 ui_browser__warning(&browser->b, delay_secs * 2,
                         "Annotation is only available for symbolic views, "
-                        "include \"sym\" in --sort to use it.");
+                        "include \"sym*\" in --sort to use it.");
                                 continue;
                         }
 
@@ -914,6 +934,16 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                         goto zoom_dso;
                 case 't':
                         goto zoom_thread;
+                case 's':
+                        if (ui_browser__input_window("Symbol to show",
+                                        "Please enter the name of symbol you want to see",
+                                        buf, "ENTER: OK, ESC: Cancel",
+                                        delay_secs * 2) == K_ENTER) {
+                                self->symbol_filter_str = *buf ? buf : NULL;
+                                hists__filter_by_symbol(self);
+                                hist_browser__reset(browser);
+                        }
+                        continue;
                 case K_F1:
                 case 'h':
                 case '?':
@@ -931,7 +961,8 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                                         "C             Collapse all callchains\n"
                                         "E             Expand all callchains\n"
                                         "d             Zoom into current DSO\n"
-                                        "t             Zoom into current Thread");
+                                        "t             Zoom into current Thread\n"
+                                        "s             Filter symbol by name");
                         continue;
                 case K_ENTER:
                 case K_RIGHT:
@@ -971,12 +1002,34 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                 if (!browser->has_symbols)
                         goto add_exit_option;
 
-                if (browser->selection != NULL &&
-                    browser->selection->sym != NULL &&
-                    !browser->selection->map->dso->annotate_warned &&
-                    asprintf(&options[nr_options], "Annotate %s",
-                             browser->selection->sym->name) > 0)
-                        annotate = nr_options++;
+                if (sort__branch_mode == 1) {
+                        bi = browser->he_selection->branch_info;
+                        if (browser->selection != NULL &&
+                            bi &&
+                            bi->from.sym != NULL &&
+                            !bi->from.map->dso->annotate_warned &&
+                                asprintf(&options[nr_options], "Annotate %s",
+                                         bi->from.sym->name) > 0)
+                                annotate_f = nr_options++;
+
+                        if (browser->selection != NULL &&
+                            bi &&
+                            bi->to.sym != NULL &&
+                            !bi->to.map->dso->annotate_warned &&
+                            (bi->to.sym != bi->from.sym ||
+                             bi->to.map->dso != bi->from.map->dso) &&
+                                asprintf(&options[nr_options], "Annotate %s",
+                                         bi->to.sym->name) > 0)
+                                annotate_t = nr_options++;
+                } else {
+
+                        if (browser->selection != NULL &&
+                            browser->selection->sym != NULL &&
+                            !browser->selection->map->dso->annotate_warned &&
+                                asprintf(&options[nr_options], "Annotate %s",
+                                         browser->selection->sym->name) > 0)
+                                annotate = nr_options++;
+                }
 
                 if (thread != NULL &&
                     asprintf(&options[nr_options], "Zoom %s %s(%d) thread",
@@ -997,25 +1050,39 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                         browse_map = nr_options++;
 add_exit_option:
                 options[nr_options++] = (char *)"Exit";
-
+retry_popup_menu:
                 choice = ui__popup_menu(nr_options, options);
 
-                for (i = 0; i < nr_options - 1; ++i)
-                        free(options[i]);
-
                 if (choice == nr_options - 1)
                         break;
 
-                if (choice == -1)
+                if (choice == -1) {
+                        free_popup_options(options, nr_options - 1);
                         continue;
+                }
 
-                if (choice == annotate) {
+                if (choice == annotate || choice == annotate_t || choice == annotate_f) {
                         struct hist_entry *he;
                         int err;
 do_annotate:
                         he = hist_browser__selected_entry(browser);
                         if (he == NULL)
                                 continue;
+
+                        /*
+                         * we stash the branch_info symbol + map into the
+                         * the ms so we don't have to rewrite all the annotation
+                         * code to use branch_info.
+                         * in branch mode, the ms struct is not used
+                         */
+                        if (choice == annotate_f) {
+                                he->ms.sym = he->branch_info->from.sym;
+                                he->ms.map = he->branch_info->from.map;
+                        }  else if (choice == annotate_t) {
+                                he->ms.sym = he->branch_info->to.sym;
+                                he->ms.map = he->branch_info->to.map;
+                        }
+
                         /*
                          * Don't let this be freed, say, by hists__decay_entry.
                          */
@@ -1023,9 +1090,18 @@ do_annotate:
                         err = hist_entry__tui_annotate(he, evsel->idx,
                                                        timer, arg, delay_secs);
                         he->used = false;
+                        /*
+                         * offer option to annotate the other branch source or target
+                         * (if they exists) when returning from annotate
+                         */
+                        if ((err == 'q' || err == CTRL('c'))
+                            && annotate_t != -2 && annotate_f != -2)
+                                goto retry_popup_menu;
+
                         ui_browser__update_nr_entries(&browser->b, browser->hists->nr_entries);
                         if (err)
                                 ui_browser__handle_resize(&browser->b);
+
                 } else if (choice == browse_map)
                         map__browse(browser->selection->map);
                 else if (choice == zoom_dso) {
@@ -1071,6 +1147,7 @@ out_free_stack:
         pstack__delete(fstack);
 out:
         hist_browser__delete(browser);
+        free_popup_options(options, nr_options - 1);
         return key;
 }
 
@@ -1097,7 +1174,7 @@ static void perf_evsel_menu__write(struct ui_browser *browser,
                                                        HE_COLORSET_NORMAL);
 
         nr_events = convert_unit(nr_events, &unit);
-        printed = snprintf(bf, sizeof(bf), "%lu%c%s%s", nr_events,
+        printed = scnprintf(bf, sizeof(bf), "%lu%c%s%s", nr_events,
                            unit, unit == ' ' ? "" : " ", ev_name);
         slsmg_printf("%s", bf);
 
@@ -1107,8 +1184,8 @@ static void perf_evsel_menu__write(struct ui_browser *browser,
                 if (!current_entry)
                         ui_browser__set_color(browser, HE_COLORSET_TOP);
                 nr_events = convert_unit(nr_events, &unit);
-                snprintf(bf, sizeof(bf), ": %ld%c%schunks LOST!", nr_events,
-                         unit, unit == ' ' ? "" : " ");
+                printed += scnprintf(bf, sizeof(bf), ": %ld%c%schunks LOST!",
+                                     nr_events, unit, unit == ' ' ? "" : " ");
                 warn = bf;
         }
 
diff --git a/tools/perf/util/ui/browsers/map.c b/tools/perf/util/ui/browsers/map.c
index 6905bcc8be2d..eca6575abfd0 100644
--- a/tools/perf/util/ui/browsers/map.c
+++ b/tools/perf/util/ui/browsers/map.c
@@ -3,9 +3,9 @@
 #include <newt.h>
 #include <inttypes.h>
 #include <sys/ttydefaults.h>
-#include <ctype.h>
 #include <string.h>
 #include <linux/bitops.h>
+#include "../../util.h"
 #include "../../debug.h"
 #include "../../symbol.h"
 #include "../browser.h"
diff --git a/tools/perf/util/ui/helpline.c b/tools/perf/util/ui/helpline.c
index 6ef3c5691762..2f950c2641c8 100644
--- a/tools/perf/util/ui/helpline.c
+++ b/tools/perf/util/ui/helpline.c
@@ -1,4 +1,3 @@
-#define _GNU_SOURCE
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -65,7 +64,7 @@ int ui_helpline__show_help(const char *format, va_list ap)
         static int backlog;
 
         pthread_mutex_lock(&ui__lock);
-        ret = vsnprintf(ui_helpline__last_msg + backlog,
+        ret = vscnprintf(ui_helpline__last_msg + backlog,
                         sizeof(ui_helpline__last_msg) - backlog, format, ap);
         backlog += ret;
 
diff --git a/tools/perf/util/ui/keysyms.h b/tools/perf/util/ui/keysyms.h
index 3458b1985761..809eca5707fa 100644
--- a/tools/perf/util/ui/keysyms.h
+++ b/tools/perf/util/ui/keysyms.h
@@ -16,6 +16,8 @@
 #define K_TAB   '\t'
 #define K_UNTAB SL_KEY_UNTAB
 #define K_UP    SL_KEY_UP
+#define K_BKSPC 0x7f
+#define K_DEL   SL_KEY_DELETE
 
 /* Not really keys */
 #define K_TIMER  -1
diff --git a/tools/perf/util/ui/util.c b/tools/perf/util/ui/util.c
index 45daa7c41dad..ad4374a16bb0 100644
--- a/tools/perf/util/ui/util.c
+++ b/tools/perf/util/ui/util.c
@@ -69,6 +69,88 @@ int ui__popup_menu(int argc, char * const argv[])
         return popup_menu__run(&menu);
 }
 
+int ui_browser__input_window(const char *title, const char *text, char *input,
+                             const char *exit_msg, int delay_secs)
+{
+        int x, y, len, key;
+        int max_len = 60, nr_lines = 0;
+        static char buf[50];
+        const char *t;
+
+        t = text;
+        while (1) {
+                const char *sep = strchr(t, '\n');
+
+                if (sep == NULL)
+                        sep = strchr(t, '\0');
+                len = sep - t;
+                if (max_len < len)
+                        max_len = len;
+                ++nr_lines;
+                if (*sep == '\0')
+                        break;
+                t = sep + 1;
+        }
+
+        max_len += 2;
+        nr_lines += 8;
+        y = SLtt_Screen_Rows / 2 - nr_lines / 2;
+        x = SLtt_Screen_Cols / 2 - max_len / 2;
+
+        SLsmg_set_color(0);
+        SLsmg_draw_box(y, x++, nr_lines, max_len);
+        if (title) {
+                SLsmg_gotorc(y, x + 1);
+                SLsmg_write_string((char *)title);
+        }
+        SLsmg_gotorc(++y, x);
+        nr_lines -= 7;
+        max_len -= 2;
+        SLsmg_write_wrapped_string((unsigned char *)text, y, x,
+                                   nr_lines, max_len, 1);
+        y += nr_lines;
+        len = 5;
+        while (len--) {
+                SLsmg_gotorc(y + len - 1, x);
+                SLsmg_write_nstring((char *)" ", max_len);
+        }
+        SLsmg_draw_box(y++, x + 1, 3, max_len - 2);
+
+        SLsmg_gotorc(y + 3, x);
+        SLsmg_write_nstring((char *)exit_msg, max_len);
+        SLsmg_refresh();
+
+        x += 2;
+        len = 0;
+        key = ui__getch(delay_secs);
+        while (key != K_TIMER && key != K_ENTER && key != K_ESC) {
+                if (key == K_BKSPC) {
+                        if (len == 0)
+                                goto next_key;
+                        SLsmg_gotorc(y, x + --len);
+                        SLsmg_write_char(' ');
+                } else {
+                        buf[len] = key;
+                        SLsmg_gotorc(y, x + len++);
+                        SLsmg_write_char(key);
+                }
+                SLsmg_refresh();
+
+                /* XXX more graceful overflow handling needed */
+                if (len == sizeof(buf) - 1) {
+                        ui_helpline__push("maximum size of symbol name reached!");
+                        key = K_ENTER;
+                        break;
+                }
+next_key:
+                key = ui__getch(delay_secs);
+        }
+
+        buf[len] = '\0';
+        strncpy(input, buf, len+1);
+        return key;
+}
+
 int ui__question_window(const char *title, const char *text,
                         const char *exit_msg, int delay_secs)
 {
diff --git a/tools/perf/util/usage.c b/tools/perf/util/usage.c
index d76d1c0ff98f..52bb07c6442a 100644
--- a/tools/perf/util/usage.c
+++ b/tools/perf/util/usage.c
@@ -7,6 +7,7 @@
  * Copyright (C) Linus Torvalds, 2005
  */
 #include "util.h"
+#include "debug.h"
 
 static void report(const char *prefix, const char *err, va_list params)
 {
@@ -81,3 +82,41 @@ void warning(const char *warn, ...)
         warn_routine(warn, params);
         va_end(params);
 }
+
+uid_t parse_target_uid(const char *str, const char *tid, const char *pid)
+{
+        struct passwd pwd, *result;
+        char buf[1024];
+
+        if (str == NULL)
+                return UINT_MAX;
+
+        /* UID and PID are mutually exclusive */
+        if (tid || pid) {
+                ui__warning("PID/TID switch overriding UID\n");
+                sleep(1);
+                return UINT_MAX;
+        }
+
+        getpwnam_r(str, &pwd, buf, sizeof(buf), &result);
+
+        if (result == NULL) {
+                char *endptr;
+                int uid = strtol(str, &endptr, 10);
+
+                if (*endptr != '\0') {
+                        ui__error("Invalid user %s\n", str);
+                        return UINT_MAX - 1;
+                }
+
+                getpwuid_r(uid, &pwd, buf, sizeof(buf), &result);
+
+                if (result == NULL) {
+                        ui__error("Problems obtaining information for user %s\n",
+                                  str);
+                        return UINT_MAX - 1;
+                }
+        }
+
+        return result->pw_uid;
+}
diff --git a/tools/perf/util/util.c b/tools/perf/util/util.c
index 5b3ea49aa63e..8109a907841e 100644
--- a/tools/perf/util/util.c
+++ b/tools/perf/util/util.c
@@ -1,6 +1,23 @@
+#include "../perf.h"
 #include "util.h"
 #include <sys/mman.h>
 
+/*
+ * XXX We need to find a better place for these things...
+ */
+bool perf_host  = true;
+bool perf_guest = false;
+
+void event_attr_init(struct perf_event_attr *attr)
+{
+        if (!perf_host)
+                attr->exclude_host  = 1;
+        if (!perf_guest)
+                attr->exclude_guest = 1;
+        /* to capture ABI version */
+        attr->size = sizeof(*attr);
+}
+
 int mkdir_p(char *path, mode_t mode)
 {
         struct stat st;
diff --git a/tools/perf/util/util.h b/tools/perf/util/util.h
index 37be34dff798..0f99f394d8e0 100644
--- a/tools/perf/util/util.h
+++ b/tools/perf/util/util.h
@@ -40,7 +40,6 @@
 #define decimal_length(x)       ((int)(sizeof(x) * 2.56 + 0.5) + 1)
 
 #define _ALL_SOURCE 1
-#define _GNU_SOURCE 1
 #define _BSD_SOURCE 1
 #define HAS_BOOL
 
@@ -200,6 +199,8 @@ static inline int has_extension(const char *filename, const char *ext)
 #undef isalpha
 #undef isprint
 #undef isalnum
+#undef islower
+#undef isupper
 #undef tolower
 #undef toupper
 
@@ -220,6 +221,8 @@ extern unsigned char sane_ctype[256];
 #define isalpha(x) sane_istest(x,GIT_ALPHA)
 #define isalnum(x) sane_istest(x,GIT_ALPHA | GIT_DIGIT)
 #define isprint(x) sane_istest(x,GIT_PRINT)
+#define islower(x) (sane_istest(x,GIT_ALPHA) && sane_istest(x,0x20))
+#define isupper(x) (sane_istest(x,GIT_ALPHA) && !sane_istest(x,0x20))
 #define tolower(x) sane_case((unsigned char)(x), 0x20)
 #define toupper(x) sane_case((unsigned char)(x), 0)
 
@@ -242,6 +245,12 @@ int strtailcmp(const char *s1, const char *s2);
 unsigned long convert_unit(unsigned long value, char *unit);
 int readn(int fd, void *buf, size_t size);
 
+struct perf_event_attr;
+
+void event_attr_init(struct perf_event_attr *attr);
+
+uid_t parse_target_uid(const char *str, const char *tid, const char *pid);
+
 #define _STR(x) #x
 #define STR(x) _STR(x)
 
diff --git a/tools/power/cpupower/Makefile b/tools/power/cpupower/Makefile
index e8a03aceceb1..a93e06cfcc2a 100644
--- a/tools/power/cpupower/Makefile
+++ b/tools/power/cpupower/Makefile
@@ -19,6 +19,16 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 #
+OUTPUT=./
+ifeq ("$(origin O)", "command line")
+        OUTPUT := $(O)/
+endif
+
+ifneq ($(OUTPUT),)
+# check that the output directory actually exists
+OUTDIR := $(shell cd $(OUTPUT) && /bin/pwd)
+$(if $(OUTDIR),, $(error output directory "$(OUTPUT)" does not exist))
+endif
 
 # --- CONFIGURATION BEGIN ---
 
@@ -87,6 +97,7 @@ AR = $(CROSS)ar
 STRIP = $(CROSS)strip
 RANLIB = $(CROSS)ranlib
 HOSTCC = gcc
+MKDIR = mkdir
 
 
 # Now we set up the build system
@@ -95,7 +106,7 @@ HOSTCC = gcc
 # set up PWD so that older versions of make will work with our build.
 PWD = $(shell pwd)
 
-GMO_FILES = ${shell for HLANG in ${LANGUAGES}; do echo po/$$HLANG.gmo; done;}
+GMO_FILES = ${shell for HLANG in ${LANGUAGES}; do echo $(OUTPUT)po/$$HLANG.gmo; done;}
 
 export CROSS CC AR STRIP RANLIB CFLAGS LDFLAGS LIB_OBJS
 
@@ -122,15 +133,18 @@ UTIL_OBJS =  utils/helpers/amd.o utils/helpers/topology.o utils/helpers/msr.o \
         utils/cpupower.o utils/cpufreq-info.o utils/cpufreq-set.o \
         utils/cpupower-set.o utils/cpupower-info.o utils/cpuidle-info.o
 
+UTIL_SRC := $(UTIL_OBJS:.o=.c)
+
+UTIL_OBJS := $(addprefix $(OUTPUT),$(UTIL_OBJS))
+
 UTIL_HEADERS = utils/helpers/helpers.h utils/idle_monitor/cpupower-monitor.h \
         utils/helpers/bitmask.h \
         utils/idle_monitor/idle_monitors.h utils/idle_monitor/idle_monitors.def
 
-UTIL_SRC := $(UTIL_OBJS:.o=.c)
-
 LIB_HEADERS =   lib/cpufreq.h lib/sysfs.h
 LIB_SRC =       lib/cpufreq.c lib/sysfs.c
 LIB_OBJS =      lib/cpufreq.o lib/sysfs.o
+LIB_OBJS :=     $(addprefix $(OUTPUT),$(LIB_OBJS))
 
 CFLAGS +=       -pipe
 
@@ -168,83 +182,90 @@ endif
 
 # the actual make rules
 
-all: libcpupower cpupower $(COMPILE_NLS) $(COMPILE_BENCH)
+all: libcpupower $(OUTPUT)cpupower $(COMPILE_NLS) $(COMPILE_BENCH)
 
-lib/%.o: $(LIB_SRC) $(LIB_HEADERS)
+$(OUTPUT)lib/%.o: $(LIB_SRC) $(LIB_HEADERS)
         $(ECHO) "  CC      " $@
         $(QUIET) $(CC) $(CFLAGS) -fPIC -o $@ -c lib/$*.c
 
-libcpupower.so.$(LIB_MAJ): $(LIB_OBJS)
+$(OUTPUT)libcpupower.so.$(LIB_MAJ): $(LIB_OBJS)
         $(ECHO) "  LD      " $@
         $(QUIET) $(CC) -shared $(CFLAGS) $(LDFLAGS) -o $@ \
                 -Wl,-soname,libcpupower.so.$(LIB_MIN) $(LIB_OBJS)
-        @ln -sf $@ libcpupower.so
-        @ln -sf $@ libcpupower.so.$(LIB_MIN)
+        @ln -sf $(@F) $(OUTPUT)libcpupower.so
+        @ln -sf $(@F) $(OUTPUT)libcpupower.so.$(LIB_MIN)
 
-libcpupower: libcpupower.so.$(LIB_MAJ)
+libcpupower: $(OUTPUT)libcpupower.so.$(LIB_MAJ)
 
 # Let all .o files depend on its .c file and all headers
 # Might be worth to put this into utils/Makefile at some point of time
 $(UTIL_OBJS): $(UTIL_HEADERS)
 
-.c.o:
+$(OUTPUT)%.o: %.c
         $(ECHO) "  CC      " $@
         $(QUIET) $(CC) $(CFLAGS) -I./lib -I ./utils -o $@ -c $*.c
 
-cpupower: $(UTIL_OBJS) libcpupower.so.$(LIB_MAJ)
+$(OUTPUT)cpupower: $(UTIL_OBJS) $(OUTPUT)libcpupower.so.$(LIB_MAJ)
         $(ECHO) "  CC      " $@
-        $(QUIET) $(CC) $(CFLAGS) $(LDFLAGS) -lcpupower -lrt -lpci -L. -o $@ $(UTIL_OBJS)
+        $(QUIET) $(CC) $(CFLAGS) $(LDFLAGS) $(UTIL_OBJS) -lcpupower -lrt -lpci -L$(OUTPUT) -o $@
         $(QUIET) $(STRIPCMD) $@
 
-po/$(PACKAGE).pot: $(UTIL_SRC)
+$(OUTPUT)po/$(PACKAGE).pot: $(UTIL_SRC)
         $(ECHO) "  GETTEXT " $@
         $(QUIET) xgettext --default-domain=$(PACKAGE) --add-comments \
-                --keyword=_ --keyword=N_ $(UTIL_SRC) && \
-        test -f $(PACKAGE).po && \
-        mv -f $(PACKAGE).po po/$(PACKAGE).pot
+                --keyword=_ --keyword=N_ $(UTIL_SRC) -p $(@D) -o $(@F)
 
-po/%.gmo: po/%.po
+$(OUTPUT)po/%.gmo: po/%.po
         $(ECHO) "  MSGFMT  " $@
         $(QUIET) msgfmt -o $@ po/$*.po
 
 create-gmo: ${GMO_FILES}
 
-update-po: po/$(PACKAGE).pot
+update-po: $(OUTPUT)po/$(PACKAGE).pot
         $(ECHO) "  MSGMRG  " $@
         $(QUIET) @for HLANG in $(LANGUAGES); do \
                 echo -n "Updating $$HLANG "; \
-                if msgmerge po/$$HLANG.po po/$(PACKAGE).pot -o \
-                   po/$$HLANG.new.po; then \
-                        mv -f po/$$HLANG.new.po po/$$HLANG.po; \
+                if msgmerge po/$$HLANG.po $< -o \
+                   $(OUTPUT)po/$$HLANG.new.po; then \
+                        mv -f $(OUTPUT)po/$$HLANG.new.po $(OUTPUT)po/$$HLANG.po; \
                 else \
                         echo "msgmerge for $$HLANG failed!"; \
-                        rm -f po/$$HLANG.new.po; \
+                        rm -f $(OUTPUT)po/$$HLANG.new.po; \
                 fi; \
         done;
 
-compile-bench: libcpupower.so.$(LIB_MAJ)
-        @V=$(V) confdir=$(confdir) $(MAKE) -C bench
+compile-bench: $(OUTPUT)libcpupower.so.$(LIB_MAJ)
+        @V=$(V) confdir=$(confdir) $(MAKE) -C bench O=$(OUTPUT)
+
+# we compile into subdirectories. if the target directory is not the
+# source directory, they might not exists. So we depend the various
+# files onto their directories.
+DIRECTORY_DEPS = $(LIB_OBJS) $(UTIL_OBJS) $(GMO_FILES)
+$(DIRECTORY_DEPS): | $(sort $(dir $(DIRECTORY_DEPS)))
+
+# In the second step, we make a rule to actually create these directories
+$(sort $(dir $(DIRECTORY_DEPS))):
+        $(ECHO) "  MKDIR      " $@
+        $(QUIET) $(MKDIR) -p $@ 2>/dev/null
 
 clean:
-        -find . \( -not -type d \) -and \( -name '*~' -o -name '*.[oas]' \) -type f -print \
+        -find $(OUTPUT) \( -not -type d \) -and \( -name '*~' -o -name '*.[oas]' \) -type f -print \
          | xargs rm -f
-        -rm -f $(UTIL_BINS)
-        -rm -f $(IDLE_OBJS)
-        -rm -f cpupower
-        -rm -f libcpupower.so*
-        -rm -rf po/*.gmo po/*.pot
-        $(MAKE) -C bench clean
+        -rm -f $(OUTPUT)cpupower
+        -rm -f $(OUTPUT)libcpupower.so*
+        -rm -rf $(OUTPUT)po/*.{gmo,pot}
+        $(MAKE) -C bench O=$(OUTPUT) clean
 
 
 install-lib:
         $(INSTALL) -d $(DESTDIR)${libdir}
-        $(CP) libcpupower.so* $(DESTDIR)${libdir}/
+        $(CP) $(OUTPUT)libcpupower.so* $(DESTDIR)${libdir}/
         $(INSTALL) -d $(DESTDIR)${includedir}
         $(INSTALL_DATA) lib/cpufreq.h $(DESTDIR)${includedir}/cpufreq.h
 
 install-tools:
         $(INSTALL) -d $(DESTDIR)${bindir}
-        $(INSTALL_PROGRAM) cpupower $(DESTDIR)${bindir}
+        $(INSTALL_PROGRAM) $(OUTPUT)cpupower $(DESTDIR)${bindir}
 
 install-man:
         $(INSTALL_DATA) -D man/cpupower.1 $(DESTDIR)${mandir}/man1/cpupower.1
@@ -257,13 +278,13 @@ install-man:
 install-gmo:
         $(INSTALL) -d $(DESTDIR)${localedir}
         for HLANG in $(LANGUAGES); do \
-                echo '$(INSTALL_DATA) -D po/$$HLANG.gmo $(DESTDIR)${localedir}/$$HLANG/LC_MESSAGES/cpupower.mo'; \
-                $(INSTALL_DATA) -D po/$$HLANG.gmo $(DESTDIR)${localedir}/$$HLANG/LC_MESSAGES/cpupower.mo; \
+                echo '$(INSTALL_DATA) -D $(OUTPUT)po/$$HLANG.gmo $(DESTDIR)${localedir}/$$HLANG/LC_MESSAGES/cpupower.mo'; \
+                $(INSTALL_DATA) -D $(OUTPUT)po/$$HLANG.gmo $(DESTDIR)${localedir}/$$HLANG/LC_MESSAGES/cpupower.mo; \
         done;
 
 install-bench:
         @#DESTDIR must be set from outside to survive
-        @sbindir=$(sbindir) bindir=$(bindir) docdir=$(docdir) confdir=$(confdir) $(MAKE) -C bench install
+        @sbindir=$(sbindir) bindir=$(bindir) docdir=$(docdir) confdir=$(confdir) $(MAKE) -C bench O=$(OUTPUT) install
 
 install: all install-lib install-tools install-man $(INSTALL_NLS) $(INSTALL_BENCH)
 
diff --git a/tools/power/cpupower/bench/Makefile b/tools/power/cpupower/bench/Makefile
index 2b67606fc3e3..7ec7021a29cd 100644
--- a/tools/power/cpupower/bench/Makefile
+++ b/tools/power/cpupower/bench/Makefile
@@ -1,29 +1,36 @@
-LIBS = -L../ -lm -lcpupower
+OUTPUT := ./
+ifeq ("$(origin O)", "command line")
+ifneq ($(O),)
+        OUTPUT := $(O)/
+endif
+endif
 
-OBJS = main.o parse.o system.o benchmark.o
+LIBS = -L../ -L$(OUTPUT) -lm -lcpupower
+
+OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o
 CFLAGS += -D_GNU_SOURCE -I../lib -DDEFAULT_CONFIG_FILE=\"$(confdir)/cpufreq-bench.conf\"
 
-%.o : %.c
+$(OUTPUT)%.o : %.c
         $(ECHO) "  CC      " $@
         $(QUIET) $(CC) -c $(CFLAGS) $< -o $@
 
-cpufreq-bench: $(OBJS)
+$(OUTPUT)cpufreq-bench: $(OBJS)
         $(ECHO) "  CC      " $@
         $(QUIET) $(CC) -o $@ $(CFLAGS) $(OBJS) $(LIBS)
 
-all: cpufreq-bench
+all: $(OUTPUT)cpufreq-bench
 
 install:
         mkdir -p $(DESTDIR)/$(sbindir)
         mkdir -p $(DESTDIR)/$(bindir)
         mkdir -p $(DESTDIR)/$(docdir)
         mkdir -p $(DESTDIR)/$(confdir)
-        install -m 755 cpufreq-bench $(DESTDIR)/$(sbindir)/cpufreq-bench
+        install -m 755 $(OUTPUT)cpufreq-bench $(DESTDIR)/$(sbindir)/cpufreq-bench
         install -m 755 cpufreq-bench_plot.sh $(DESTDIR)/$(bindir)/cpufreq-bench_plot.sh
         install -m 644 README-BENCH $(DESTDIR)/$(docdir)/README-BENCH
         install -m 755 cpufreq-bench_script.sh $(DESTDIR)/$(docdir)/cpufreq-bench_script.sh
         install -m 644 example.cfg $(DESTDIR)/$(confdir)/cpufreq-bench.conf
 
 clean:
-        rm -f *.o
-        rm -f cpufreq-bench
+        rm -f $(OUTPUT)*.o
+        rm -f $(OUTPUT)cpufreq-bench
diff --git a/tools/power/cpupower/debug/i386/Makefile b/tools/power/cpupower/debug/i386/Makefile
index d08cc1ead9bc..3ba158f0e287 100644
--- a/tools/power/cpupower/debug/i386/Makefile
+++ b/tools/power/cpupower/debug/i386/Makefile
@@ -1,20 +1,38 @@
+OUTPUT=./
+ifeq ("$(origin O)", "command line")
+        OUTPUT := $(O)/
+endif
+
+DESTDIR =
+bindir  = /usr/bin
+
+INSTALL = /usr/bin/install
+
+
 default: all
 
-centrino-decode: centrino-decode.c
-        $(CC) $(CFLAGS) -o centrino-decode centrino-decode.c
+$(OUTPUT)centrino-decode: centrino-decode.c
+        $(CC) $(CFLAGS) -o $@ centrino-decode.c
 
-dump_psb: dump_psb.c
-        $(CC) $(CFLAGS) -o dump_psb dump_psb.c
+$(OUTPUT)dump_psb: dump_psb.c
+        $(CC) $(CFLAGS) -o $@ dump_psb.c
 
-intel_gsic: intel_gsic.c
-        $(CC) $(CFLAGS) -o intel_gsic -llrmi intel_gsic.c
+$(OUTPUT)intel_gsic: intel_gsic.c
+        $(CC) $(CFLAGS) -o $@ -llrmi intel_gsic.c
 
-powernow-k8-decode: powernow-k8-decode.c
-        $(CC) $(CFLAGS) -o powernow-k8-decode powernow-k8-decode.c
+$(OUTPUT)powernow-k8-decode: powernow-k8-decode.c
+        $(CC) $(CFLAGS) -o $@ powernow-k8-decode.c
 
-all: centrino-decode dump_psb intel_gsic powernow-k8-decode
+all: $(OUTPUT)centrino-decode $(OUTPUT)dump_psb $(OUTPUT)intel_gsic $(OUTPUT)powernow-k8-decode
 
 clean:
-        rm -rf centrino-decode dump_psb intel_gsic powernow-k8-decode
+        rm -rf $(OUTPUT){centrino-decode,dump_psb,intel_gsic,powernow-k8-decode}
+
+install:
+        $(INSTALL) -d $(DESTDIR)${bindir}
+        $(INSTALL) $(OUTPUT)centrino-decode $(DESTDIR)${bindir}
+        $(INSTALL) $(OUTPUT)powernow-k8-decode $(DESTDIR)${bindir}
+        $(INSTALL) $(OUTPUT)dump_psb $(DESTDIR)${bindir}
+        $(INSTALL) $(OUTPUT)intel_gsic $(DESTDIR)${bindir}
 
-.PHONY: all default clean
+.PHONY: all default clean install
diff --git a/tools/power/cpupower/debug/x86_64/Makefile b/tools/power/cpupower/debug/x86_64/Makefile
index 3326217dd311..1c5214526716 100644
--- a/tools/power/cpupower/debug/x86_64/Makefile
+++ b/tools/power/cpupower/debug/x86_64/Makefile
@@ -1,14 +1,30 @@
+OUTPUT=./
+ifeq ("$(origin O)", "command line")
+        OUTPUT := $(O)/
+endif
+
+DESTDIR =
+bindir  = /usr/bin
+
+INSTALL = /usr/bin/install
+
+
 default: all
 
-centrino-decode: ../i386/centrino-decode.c
+$(OUTPUT)centrino-decode: ../i386/centrino-decode.c
         $(CC) $(CFLAGS) -o $@ $<
 
-powernow-k8-decode: ../i386/powernow-k8-decode.c
+$(OUTPUT)powernow-k8-decode: ../i386/powernow-k8-decode.c
         $(CC) $(CFLAGS) -o $@ $<
 
-all: centrino-decode powernow-k8-decode
+all: $(OUTPUT)centrino-decode $(OUTPUT)powernow-k8-decode
 
 clean:
-        rm -rf centrino-decode powernow-k8-decode
+        rm -rf $(OUTPUT)centrino-decode $(OUTPUT)powernow-k8-decode
+
+install:
+        $(INSTALL) -d $(DESTDIR)${bindir}
+        $(INSTALL) $(OUTPUT)centrino-decode $(DESTDIR)${bindir}
+        $(INSTALL) $(OUTPUT)powernow-k8-decode $(DESTDIR)${bindir}
 
-.PHONY: all default clean
+.PHONY: all default clean install
diff --git a/tools/power/cpupower/man/cpupower-frequency-info.1 b/tools/power/cpupower/man/cpupower-frequency-info.1
index bb60a8d1e45a..4a1918ea8f9c 100644
--- a/tools/power/cpupower/man/cpupower-frequency-info.1
+++ b/tools/power/cpupower/man/cpupower-frequency-info.1
@@ -1,4 +1,4 @@
-.TH "cpupower-frequency-info" "1" "0.1" "Mattia Dongili" ""
+.TH "CPUPOWER\-FREQUENCY\-INFO" "1" "0.1" "" "cpupower Manual"
 .SH "NAME"
 .LP 
 cpupower frequency\-info \- Utility to retrieve cpufreq kernel information
@@ -50,8 +50,6 @@ Prints out information like provided by the /proc/cpufreq interface in 2.4. and
 \fB\-m\fR \fB\-\-human\fR
 human\-readable output for the \-f, \-w, \-s and \-y parameters.
 .TP  
-\fB\-h\fR \fB\-\-help\fR
-Prints out the help screen.
 .SH "REMARKS"
 .LP 
 By default only values of core zero are displayed. How to display settings of
diff --git a/tools/power/cpupower/man/cpupower-frequency-set.1 b/tools/power/cpupower/man/cpupower-frequency-set.1
index 685f469093ad..3eacc8d03d1a 100644
--- a/tools/power/cpupower/man/cpupower-frequency-set.1
+++ b/tools/power/cpupower/man/cpupower-frequency-set.1
@@ -1,4 +1,4 @@
-.TH "cpupower-freqency-set" "1" "0.1" "Mattia Dongili" ""
+.TH "CPUPOWER\-FREQUENCY\-SET" "1" "0.1" "" "cpupower Manual"
 .SH "NAME"
 .LP 
 cpupower frequency\-set \- A small tool which allows to modify cpufreq settings.
@@ -26,8 +26,6 @@ specific frequency to be set. Requires userspace governor to be available and lo
 \fB\-r\fR \fB\-\-related\fR
 modify all hardware-related CPUs at the same time
 .TP 
-\fB\-h\fR \fB\-\-help\fR
-Prints out the help screen.
 .SH "REMARKS"
 .LP 
 By default values are applied on all cores. How to modify single core
diff --git a/tools/power/cpupower/man/cpupower-idle-info.1 b/tools/power/cpupower/man/cpupower-idle-info.1
new file mode 100644
index 000000000000..4178effd9e99
--- /dev/null
+++ b/tools/power/cpupower/man/cpupower-idle-info.1
@@ -0,0 +1,90 @@
+.TH "CPUPOWER-IDLE-INFO" "1" "0.1" "" "cpupower Manual"
+.SH "NAME"
+.LP
+cpupower idle\-info \- Utility to retrieve cpu idle kernel information
+.SH "SYNTAX"
+.LP
+cpupower [ \-c cpulist ] idle\-info [\fIoptions\fP]
+.SH "DESCRIPTION"
+.LP
+A tool which prints out per cpu idle information helpful to developers and interested users.
+.SH "OPTIONS"
+.LP
+.TP
+\fB\-f\fR \fB\-\-silent\fR
+Only print a summary of all available C-states in the system.
+.TP
+\fB\-e\fR \fB\-\-proc\fR
+deprecated.
+Prints out idle information in old /proc/acpi/processor/*/power format. This
+interface has been removed from the kernel for quite some time, do not let
+further code depend on this option, best do not use it.
+
+.SH IDLE\-INFO DESCRIPTIONS
+CPU sleep state statistics and descriptions are retrieved from sysfs files,
+exported by the cpuidle kernel subsystem. The kernel only updates these
+statistics when it enters or leaves an idle state, therefore on a very idle or
+a very busy system, these statistics may not be accurate. They still provide a
+good overview about the usage and availability of processor sleep states on
+the platform.
+
+Be aware that the sleep states as exported by the hardware or BIOS and used by
+the Linux kernel may not exactly reflect the capabilities of the
+processor. This often is the case on the X86 architecture when the acpi_idle
+driver is used. It is also possible that the hardware overrules the kernel
+requests, due to internal activity monitors or other reasons.
+On recent X86 platforms it is often possible to read out hardware registers
+which monitor the duration of sleep states the processor resided in. The
+cpupower monitor tool (cpupower\-monitor(1)) can be used to show real sleep
+state residencies. Please refer to the architecture specific description
+section below.
+
+.SH IDLE\-INFO ARCHITECTURE SPECIFIC DESCRIPTIONS
+.SS "X86"
+POLL idle state
+
+If cpuidle is active, X86 platforms have one special idle state.
+The POLL idle state is not a real idle state, it does not save any
+power. Instead, a busy\-loop is executed doing nothing for a short period of
+time. This state is used if the kernel knows that work has to be processed
+very soon and entering any real hardware idle state may result in a slight
+performance penalty.
+
+There exist two different cpuidle drivers on the X86 architecture platform:
+
+"acpi_idle" cpuidle driver
+
+The acpi_idle cpuidle driver retrieves available sleep states (C\-states) from
+the ACPI BIOS tables (from the _CST ACPI function on recent platforms or from
+the FADT BIOS table on older ones).
+The C1 state is not retrieved from ACPI tables. If the C1 state is entered,
+the kernel will call the hlt instruction (or mwait on Intel).
+
+"intel_idle" cpuidle driver
+
+In kernel 2.6.36 the intel_idle driver was introduced.
+It only serves recent Intel CPUs (Nehalem, Westmere, Sandybridge, Atoms or
+newer). On older Intel CPUs the acpi_idle driver is still used (if the BIOS
+provides C\-state ACPI tables).
+The intel_idle driver knows the sleep state capabilities of the processor and
+ignores ACPI BIOS exported processor sleep states tables.
+
+.SH "REMARKS"
+.LP
+By default only values of core zero are displayed. How to display settings of
+other cores is described in the cpupower(1) manpage in the \-\-cpu option
+section.
+.SH REFERENCES
+http://www.acpi.info/spec.htm
+.SH "FILES"
+.nf
+\fI/sys/devices/system/cpu/cpu*/cpuidle/state*\fP
+\fI/sys/devices/system/cpu/cpuidle/*\fP
+.fi
+.SH "AUTHORS"
+.nf
+Thomas Renninger <trenn@suse.de>
+.fi
+.SH "SEE ALSO"
+.LP
+cpupower(1), cpupower\-monitor(1), cpupower\-info(1), cpupower\-set(1)
diff --git a/tools/power/cpupower/man/cpupower-monitor.1 b/tools/power/cpupower/man/cpupower-monitor.1
index d5cfa265c3d3..1141c2073719 100644
--- a/tools/power/cpupower/man/cpupower-monitor.1
+++ b/tools/power/cpupower/man/cpupower-monitor.1
@@ -107,7 +107,7 @@ Deepest package sleep states may in reality show up as machine/platform wide
 sleep states and can only be entered if all cores are idle. Look up Intel
 manuals (some are provided in the References section) for further details.
 
-.SS "Ontario" "Liano"
+.SS "Fam_12h" "Fam_14h"
 AMD laptop and desktop processor (family 12h and 14h) sleep state counters.
 The registers are accessed via PCI and therefore can still be read out while
 cores have been offlined.
diff --git a/tools/power/cpupower/utils/cpuidle-info.c b/tools/power/cpupower/utils/cpuidle-info.c
index b028267c1376..8145af5f93a6 100644
--- a/tools/power/cpupower/utils/cpuidle-info.c
+++ b/tools/power/cpupower/utils/cpuidle-info.c
@@ -35,17 +35,9 @@ static void cpuidle_cpu_output(unsigned int cpu, int verbose)
                 printf(_("CPU %u: Can't read idle state info\n"), cpu);
                 return;
         }
-        tmp = sysfs_get_idlestate_name(cpu, idlestates - 1);
-        if (!tmp) {
-                printf(_("Could not determine max idle state %u\n"),
-                       idlestates - 1);
-                return;
-        }
-
         printf(_("Number of idle states: %d\n"), idlestates);
-
         printf(_("Available idle states:"));
-        for (idlestate = 1; idlestate < idlestates; idlestate++) {
+        for (idlestate = 0; idlestate < idlestates; idlestate++) {
                 tmp = sysfs_get_idlestate_name(cpu, idlestate);
                 if (!tmp)
                         continue;
@@ -57,7 +49,7 @@ static void cpuidle_cpu_output(unsigned int cpu, int verbose)
         if (!verbose)
                 return;
 
-        for (idlestate = 1; idlestate < idlestates; idlestate++) {
+        for (idlestate = 0; idlestate < idlestates; idlestate++) {
                 tmp = sysfs_get_idlestate_name(cpu, idlestate);
                 if (!tmp)
                         continue;
diff --git a/tools/power/cpupower/utils/helpers/amd.c b/tools/power/cpupower/utils/helpers/amd.c
index 87d5605bdda8..6437ef39aeea 100644
--- a/tools/power/cpupower/utils/helpers/amd.c
+++ b/tools/power/cpupower/utils/helpers/amd.c
@@ -112,14 +112,12 @@ int decode_pstates(unsigned int cpu, unsigned int cpu_family,
 int amd_pci_get_num_boost_states(int *active, int *states)
 {
         struct pci_access *pci_acc;
-        int vendor_id = 0x1022;
-        int boost_dev_ids[4] = {0x1204, 0x1604, 0x1704, 0};
         struct pci_dev *device;
         uint8_t val = 0;
 
         *active = *states = 0;
 
-        device = pci_acc_init(&pci_acc, vendor_id, boost_dev_ids);
+        device = pci_slot_func_init(&pci_acc, 0x18, 4);
 
         if (device == NULL)
                 return -ENODEV;
diff --git a/tools/power/cpupower/utils/helpers/helpers.h b/tools/power/cpupower/utils/helpers/helpers.h
index 2747e738efb0..2eb584cf2f55 100644
--- a/tools/power/cpupower/utils/helpers/helpers.h
+++ b/tools/power/cpupower/utils/helpers/helpers.h
@@ -66,8 +66,8 @@ enum cpupower_cpu_vendor {X86_VENDOR_UNKNOWN = 0, X86_VENDOR_INTEL,
 #define CPUPOWER_CAP_AMD_CBP            0x00000004
 #define CPUPOWER_CAP_PERF_BIAS          0x00000008
 #define CPUPOWER_CAP_HAS_TURBO_RATIO    0x00000010
-#define CPUPOWER_CAP_IS_SNB             0x00000011
-#define CPUPOWER_CAP_INTEL_IDA          0x00000012
+#define CPUPOWER_CAP_IS_SNB             0x00000020
+#define CPUPOWER_CAP_INTEL_IDA          0x00000040
 
 #define MAX_HW_PSTATES 10
 
@@ -132,8 +132,11 @@ extern unsigned long long msr_intel_get_turbo_ratio(unsigned int cpu);
 
 /* PCI stuff ****************************/
 extern int amd_pci_get_num_boost_states(int *active, int *states);
-extern struct pci_dev *pci_acc_init(struct pci_access **pacc, int vendor_id,
-                                    int *dev_ids);
+extern struct pci_dev *pci_acc_init(struct pci_access **pacc, int domain,
+                                    int bus, int slot, int func, int vendor,
+                                    int dev);
+extern struct pci_dev *pci_slot_func_init(struct pci_access **pacc,
+                                              int slot, int func);
 
 /* PCI stuff ****************************/
 
diff --git a/tools/power/cpupower/utils/helpers/pci.c b/tools/power/cpupower/utils/helpers/pci.c
index cd2eb6fe41c4..9690798e6446 100644
--- a/tools/power/cpupower/utils/helpers/pci.c
+++ b/tools/power/cpupower/utils/helpers/pci.c
@@ -10,19 +10,24 @@
  * **pacc : if a valid pci_dev is returned
  *         *pacc must be passed to pci_acc_cleanup to free it
  *
- * vendor_id : the pci vendor id matching the pci device to access
- * dev_ids :   device ids matching the pci device to access
+ * domain: domain
+ * bus:    bus
+ * slot:   slot
+ * func:   func
+ * vendor: vendor
+ * device: device
+ * Pass -1 for one of the six above to match any
  *
  * Returns :
  * struct pci_dev which can be used with pci_{read,write}_* functions
  *                to access the PCI config space of matching pci devices
  */
-struct pci_dev *pci_acc_init(struct pci_access **pacc, int vendor_id,
-                                    int *dev_ids)
+struct pci_dev *pci_acc_init(struct pci_access **pacc, int domain, int bus,
+                             int slot, int func, int vendor, int dev)
 {
-        struct pci_filter filter_nb_link = { -1, -1, -1, -1, vendor_id, 0};
+        struct pci_filter filter_nb_link = { domain, bus, slot, func,
+                                             vendor, dev };
         struct pci_dev *device;
-        unsigned int i;
 
         *pacc = pci_alloc();
         if (*pacc == NULL)
@@ -31,14 +36,20 @@ struct pci_dev *pci_acc_init(struct pci_access **pacc, int vendor_id,
         pci_init(*pacc);
         pci_scan_bus(*pacc);
 
-        for (i = 0; dev_ids[i] != 0; i++) {
-                filter_nb_link.device = dev_ids[i];
-                for (device = (*pacc)->devices; device; device = device->next) {
-                        if (pci_filter_match(&filter_nb_link, device))
-                                return device;
-                }
+        for (device = (*pacc)->devices; device; device = device->next) {
+                if (pci_filter_match(&filter_nb_link, device))
+                        return device;
         }
         pci_cleanup(*pacc);
         return NULL;
 }
+
+/* Typically one wants to get a specific slot(device)/func of the root domain
+   and bus */
+struct pci_dev *pci_slot_func_init(struct pci_access **pacc, int slot,
+                                       int func)
+{
+        return pci_acc_init(pacc, 0, 0, slot, func, -1, -1);
+}
+
 #endif /* defined(__i386__) || defined(__x86_64__) */
diff --git a/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c b/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c
index 202e555988be..2116df9ad832 100644
--- a/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c
+++ b/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c
@@ -20,8 +20,6 @@
 #include "idle_monitor/cpupower-monitor.h"
 #include "helpers/helpers.h"
 
-/******** PCI parts could go into own file and get shared ***************/
-
 #define PCI_NON_PC0_OFFSET      0xb0
 #define PCI_PC1_OFFSET          0xb4
 #define PCI_PC6_OFFSET          0xb8
@@ -82,10 +80,7 @@ static cstate_t amd_fam14h_cstates[AMD_FAM14H_STATE_NUM] = {
 };
 
 static struct pci_access *pci_acc;
-static int pci_vendor_id = 0x1022;
-static int pci_dev_ids[2] = {0x1716, 0};
 static struct pci_dev *amd_fam14h_pci_dev;
-
 static int nbp1_entered;
 
 struct timespec start_time;
@@ -286,13 +281,13 @@ struct cpuidle_monitor *amd_fam14h_register(void)
         if (cpupower_cpu_info.vendor != X86_VENDOR_AMD)
                 return NULL;
 
-        if (cpupower_cpu_info.family == 0x14) {
-                if (cpu_count <= 0 || cpu_count > 2) {
-                        fprintf(stderr, "AMD fam14h: Invalid cpu count: %d\n",
-                                cpu_count);
-                        return NULL;
-                }
-        } else
+        if (cpupower_cpu_info.family == 0x14)
+                strncpy(amd_fam14h_monitor.name, "Fam_14h",
+                        MONITOR_NAME_LEN - 1);
+        else if (cpupower_cpu_info.family == 0x12)
+                strncpy(amd_fam14h_monitor.name, "Fam_12h",
+                        MONITOR_NAME_LEN - 1);
+        else
                 return NULL;
 
         /* We do not alloc for nbp1 machine wide counter */
@@ -303,7 +298,9 @@ struct cpuidle_monitor *amd_fam14h_register(void)
                                               sizeof(unsigned long long));
         }
 
-        amd_fam14h_pci_dev = pci_acc_init(&pci_acc, pci_vendor_id, pci_dev_ids);
+        /* We need PCI device: Slot 18, Func 6, compare with BKDG
+           for fam 12h/14h */
+        amd_fam14h_pci_dev = pci_slot_func_init(&pci_acc, 0x18, 6);
         if (amd_fam14h_pci_dev == NULL || pci_acc == NULL)
                 return NULL;
 
@@ -325,7 +322,7 @@ static void amd_fam14h_unregister(void)
 }
 
 struct cpuidle_monitor amd_fam14h_monitor = {
-        .name                   = "Ontario",
+        .name                   = "",
         .hw_states              = amd_fam14h_cstates,
         .hw_states_num          = AMD_FAM14H_STATE_NUM,
         .start                  = amd_fam14h_start,
diff --git a/tools/power/x86/turbostat/turbostat.8 b/tools/power/x86/turbostat/turbostat.8
index 555c69a5592a..adf175f61496 100644
--- a/tools/power/x86/turbostat/turbostat.8
+++ b/tools/power/x86/turbostat/turbostat.8
@@ -4,11 +4,13 @@ turbostat \- Report processor frequency and idle statistics
 .SH SYNOPSIS
 .ft B
 .B turbostat
+.RB [ "\-s" ]
 .RB [ "\-v" ]
 .RB [ "\-M MSR#" ]
 .RB command
 .br
 .B turbostat
+.RB [ "\-s" ]
 .RB [ "\-v" ]
 .RB [ "\-M MSR#" ]
 .RB [ "\-i interval_sec" ]
@@ -25,6 +27,8 @@ supports an "invariant" TSC, plus the APERF and MPERF MSRs.
 on processors that additionally support C-state residency counters.
 
 .SS Options
+The \fB-s\fP option prints only a 1-line summary for each sample interval.
+.PP
 The \fB-v\fP option increases verbosity.
 .PP
 The \fB-M MSR#\fP option dumps the specified MSR,
@@ -39,13 +43,14 @@ displays the statistics gathered since it was forked.
 .SH FIELD DESCRIPTIONS
 .nf
 \fBpk\fP processor package number.
-\fBcr\fP processor core number.
+\fBcor\fP processor core number.
 \fBCPU\fP Linux CPU (logical processor) number.
+Note that multiple CPUs per core indicate support for Intel(R) Hyper-Threading Technology.
 \fB%c0\fP percent of the interval that the CPU retired instructions.
 \fBGHz\fP average clock rate while the CPU was in c0 state.
 \fBTSC\fP average GHz that the TSC ran during the entire interval.
-\fB%c1, %c3, %c6\fP show the percentage residency in hardware core idle states.
-\fB%pc3, %pc6\fP percentage residency in hardware package idle states.
+\fB%c1, %c3, %c6, %c7\fP show the percentage residency in hardware core idle states.
+\fB%pc2, %pc3, %pc6, %pc7\fP percentage residency in hardware package idle states.
 .fi
 .PP
 .SH EXAMPLE
@@ -53,25 +58,37 @@ Without any parameters, turbostat prints out counters ever 5 seconds.
 (override interval with "-i sec" option, or specify a command
 for turbostat to fork).
 
-The first row of statistics reflect the average for the entire system.
+The first row of statistics is a summary for the entire system.
+Note that the summary is a weighted average.
 Subsequent rows show per-CPU statistics.
 
 .nf
 [root@x980]# ./turbostat
-cr   CPU   %c0   GHz  TSC   %c1    %c3    %c6   %pc3   %pc6
-          0.04 1.62 3.38   0.11   0.00  99.85   0.00  95.07
-  0   0   0.04 1.62 3.38   0.06   0.00  99.90   0.00  95.07
-  0   6   0.02 1.62 3.38   0.08   0.00  99.90   0.00  95.07
-  1   2   0.10 1.62 3.38   0.29   0.00  99.61   0.00  95.07
-  1   8   0.11 1.62 3.38   0.28   0.00  99.61   0.00  95.07
-  2   4   0.01 1.62 3.38   0.01   0.00  99.98   0.00  95.07
-  2  10   0.01 1.61 3.38   0.02   0.00  99.98   0.00  95.07
-  8   1   0.07 1.62 3.38   0.15   0.00  99.78   0.00  95.07
-  8   7   0.03 1.62 3.38   0.19   0.00  99.78   0.00  95.07
-  9   3   0.01 1.62 3.38   0.02   0.00  99.98   0.00  95.07
-  9   9   0.01 1.62 3.38   0.02   0.00  99.98   0.00  95.07
- 10   5   0.01 1.62 3.38   0.13   0.00  99.86   0.00  95.07
- 10  11   0.08 1.62 3.38   0.05   0.00  99.86   0.00  95.07
+cor CPU    %c0  GHz  TSC    %c1    %c3    %c6   %pc3   %pc6
+          0.60 1.63 3.38   2.91   0.00  96.49   0.00  76.64
+  0   0   0.59 1.62 3.38   4.51   0.00  94.90   0.00  76.64
+  0   6   1.13 1.64 3.38   3.97   0.00  94.90   0.00  76.64
+  1   2   0.08 1.62 3.38   0.07   0.00  99.85   0.00  76.64
+  1   8   0.03 1.62 3.38   0.12   0.00  99.85   0.00  76.64
+  2   4   0.01 1.62 3.38   0.06   0.00  99.93   0.00  76.64
+  2  10   0.04 1.62 3.38   0.02   0.00  99.93   0.00  76.64
+  8   1   2.85 1.62 3.38  11.71   0.00  85.44   0.00  76.64
+  8   7   1.98 1.62 3.38  12.58   0.00  85.44   0.00  76.64
+  9   3   0.36 1.62 3.38   0.71   0.00  98.93   0.00  76.64
+  9   9   0.09 1.62 3.38   0.98   0.00  98.93   0.00  76.64
+ 10   5   0.03 1.62 3.38   0.09   0.00  99.87   0.00  76.64
+ 10  11   0.07 1.62 3.38   0.06   0.00  99.87   0.00  76.64
+.fi
+.SH SUMMARY EXAMPLE
+The "-s" option prints the column headers just once,
+and then the one line system summary for each sample interval.
+
+.nf
+[root@x980]# ./turbostat -s
+   %c0  GHz  TSC    %c1    %c3    %c6   %pc3   %pc6
+  0.61 1.89 3.38   5.95   0.00  93.44   0.00  66.33
+  0.52 1.62 3.38   6.83   0.00  92.65   0.00  61.11
+  0.62 1.92 3.38   5.47   0.00  93.91   0.00  67.31
 .fi
 .SH VERBOSE EXAMPLE
 The "-v" option adds verbosity to the output:
@@ -101,33 +118,33 @@ until ^C while the other CPUs are mostly idle:
 
 .nf
 [root@x980 lenb]# ./turbostat cat /dev/zero > /dev/null
-
-^Ccr   CPU   %c0   GHz  TSC   %c1    %c3    %c6   %pc3   %pc6
-           8.49 3.63 3.38  16.23   0.66  74.63   0.00   0.00
-   0   0   1.22 3.62 3.38  32.18   0.00  66.60   0.00   0.00
-   0   6   0.40 3.61 3.38  33.00   0.00  66.60   0.00   0.00
-   1   2   0.11 3.14 3.38   0.19   3.95  95.75   0.00   0.00
-   1   8   0.05 2.88 3.38   0.25   3.95  95.75   0.00   0.00
-   2   4   0.00 3.13 3.38   0.02   0.00  99.98   0.00   0.00
-   2  10   0.00 3.09 3.38   0.02   0.00  99.98   0.00   0.00
-   8   1   0.04 3.50 3.38  14.43   0.00  85.54   0.00   0.00
-   8   7   0.03 2.98 3.38  14.43   0.00  85.54   0.00   0.00
-   9   3   0.00 3.16 3.38 100.00   0.00   0.00   0.00   0.00
-   9   9  99.93 3.63 3.38   0.06   0.00   0.00   0.00   0.00
-  10   5   0.01 2.82 3.38   0.08   0.00  99.91   0.00   0.00
-  10  11   0.02 3.36 3.38   0.06   0.00  99.91   0.00   0.00
-6.950866 sec
+^C
+cor CPU    %c0  GHz  TSC    %c1    %c3    %c6   %pc3   %pc6
+          8.63 3.64 3.38  14.46   0.49  76.42   0.00   0.00
+  0   0   0.34 3.36 3.38  99.66   0.00   0.00   0.00   0.00
+  0   6  99.96 3.64 3.38   0.04   0.00   0.00   0.00   0.00
+  1   2   0.14 3.50 3.38   1.75   2.04  96.07   0.00   0.00
+  1   8   0.38 3.57 3.38   1.51   2.04  96.07   0.00   0.00
+  2   4   0.01 2.65 3.38   0.06   0.00  99.93   0.00   0.00
+  2  10   0.03 2.12 3.38   0.04   0.00  99.93   0.00   0.00
+  8   1   0.91 3.59 3.38  35.27   0.92  62.90   0.00   0.00
+  8   7   1.61 3.63 3.38  34.57   0.92  62.90   0.00   0.00
+  9   3   0.04 3.38 3.38   0.20   0.00  99.76   0.00   0.00
+  9   9   0.04 3.29 3.38   0.20   0.00  99.76   0.00   0.00
+ 10   5   0.03 3.08 3.38   0.12   0.00  99.85   0.00   0.00
+ 10  11   0.05 3.07 3.38   0.10   0.00  99.85   0.00   0.00
+4.907015 sec
 
 .fi
-Above the cycle soaker drives cpu9 up 3.6 Ghz turbo limit
+Above the cycle soaker drives cpu6 up 3.6 Ghz turbo limit
 while the other processors are generally in various states of idle.
 
-Note that cpu3 is an HT sibling sharing core9
-with cpu9, and thus it is unable to get to an idle state
-deeper than c1 while cpu9 is busy.
+Note that cpu0 is an HT sibling sharing core0
+with cpu6, and thus it is unable to get to an idle state
+deeper than c1 while cpu6 is busy.
 
-Note that turbostat reports average GHz of 3.61, while
-the arithmetic average of the GHz column above is 3.24.
+Note that turbostat reports average GHz of 3.64, while
+the arithmetic average of the GHz column above is lower.
 This is a weighted average, where the weight is %c0.  ie. it is the total number of
 un-halted cycles elapsed per time divided by the number of CPUs.
 .SH NOTES
@@ -167,6 +184,6 @@ http://www.intel.com/products/processor/manuals/
 .SH "SEE ALSO"
 msr(4), vmstat(8)
 .PP
-.SH AUTHORS
+.SH AUTHOR
 .nf
 Written by Len Brown <len.brown@intel.com>
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index 3c6f7808efae..ab2f682fd44c 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -2,7 +2,7 @@
  * turbostat -- show CPU frequency and C-state residency
  * on modern Intel turbo-capable processors.
  *
- * Copyright (c) 2010, Intel Corporation.
+ * Copyright (c) 2012 Intel Corporation.
  * Len Brown <len.brown@intel.com>
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -19,6 +19,7 @@
  * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
+#define _GNU_SOURCE
 #include <stdio.h>
 #include <unistd.h>
 #include <sys/types.h>
@@ -32,6 +33,7 @@
 #include <dirent.h>
 #include <string.h>
 #include <ctype.h>
+#include <sched.h>
 
 #define MSR_TSC 0x10
 #define MSR_NEHALEM_PLATFORM_INFO       0xCE
@@ -49,6 +51,7 @@
 char *proc_stat = "/proc/stat";
 unsigned int interval_sec = 5;  /* set with -i interval_sec */
 unsigned int verbose;           /* set with -v */
+unsigned int summary_only;      /* set with -s */
 unsigned int skip_c0;
 unsigned int skip_c1;
 unsigned int do_nhm_cstates;
@@ -68,9 +71,10 @@ unsigned int show_cpu;
 int aperf_mperf_unstable;
 int backwards_count;
 char *progname;
-int need_reinitialize;
 
 int num_cpus;
+cpu_set_t *cpu_mask;
+size_t cpu_mask_size;
 
 struct counters {
         unsigned long long tsc;         /* per thread */
@@ -99,44 +103,76 @@ struct timeval tv_even;
 struct timeval tv_odd;
 struct timeval tv_delta;
 
-unsigned long long get_msr(int cpu, off_t offset)
+/*
+ * cpu_mask_init(ncpus)
+ *
+ * allocate and clear cpu_mask
+ * set cpu_mask_size
+ */
+void cpu_mask_init(int ncpus)
+{
+        cpu_mask = CPU_ALLOC(ncpus);
+        if (cpu_mask == NULL) {
+                perror("CPU_ALLOC");
+                exit(3);
+        }
+        cpu_mask_size = CPU_ALLOC_SIZE(ncpus);
+        CPU_ZERO_S(cpu_mask_size, cpu_mask);
+}
+
+void cpu_mask_uninit()
+{
+        CPU_FREE(cpu_mask);
+        cpu_mask = NULL;
+        cpu_mask_size = 0;
+}
+
+int cpu_migrate(int cpu)
+{
+        CPU_ZERO_S(cpu_mask_size, cpu_mask);
+        CPU_SET_S(cpu, cpu_mask_size, cpu_mask);
+        if (sched_setaffinity(0, cpu_mask_size, cpu_mask) == -1)
+                return -1;
+        else
+                return 0;
+}
+
+int get_msr(int cpu, off_t offset, unsigned long long *msr)
 {
         ssize_t retval;
-        unsigned long long msr;
         char pathname[32];
         int fd;
 
         sprintf(pathname, "/dev/cpu/%d/msr", cpu);
         fd = open(pathname, O_RDONLY);
-        if (fd < 0) {
-                perror(pathname);
-                need_reinitialize = 1;
-                return 0;
-        }
-
-        retval = pread(fd, &msr, sizeof msr, offset);
-        if (retval != sizeof msr) {
-                fprintf(stderr, "cpu%d pread(..., 0x%zx) = %jd\n",
-                        cpu, offset, retval);
-                exit(-2);
-        }
+        if (fd < 0)
+                return -1;
 
+        retval = pread(fd, msr, sizeof *msr, offset);
         close(fd);
-        return msr;
+
+        if (retval != sizeof *msr)
+                return -1;
+
+        return 0;
 }
 
 void print_header(void)
 {
         if (show_pkg)
                 fprintf(stderr, "pk");
+        if (show_pkg)
+                fprintf(stderr, " ");
         if (show_core)
-                fprintf(stderr, " cr");
+                fprintf(stderr, "cor");
         if (show_cpu)
                 fprintf(stderr, " CPU");
+        if (show_pkg || show_core || show_cpu)
+                fprintf(stderr, " ");
         if (do_nhm_cstates)
-                fprintf(stderr, "    %%c0 ");
+                fprintf(stderr, "   %%c0");
         if (has_aperf)
-                fprintf(stderr, " GHz");
+                fprintf(stderr, "  GHz");
         fprintf(stderr, "  TSC");
         if (do_nhm_cstates)
                 fprintf(stderr, "    %%c1");
@@ -147,13 +183,13 @@ void print_header(void)
         if (do_snb_cstates)
                 fprintf(stderr, "    %%c7");
         if (do_snb_cstates)
-                fprintf(stderr, "  %%pc2");
+                fprintf(stderr, "   %%pc2");
         if (do_nhm_cstates)
-                fprintf(stderr, "  %%pc3");
+                fprintf(stderr, "   %%pc3");
         if (do_nhm_cstates)
-                fprintf(stderr, "  %%pc6");
+                fprintf(stderr, "   %%pc6");
         if (do_snb_cstates)
-                fprintf(stderr, "  %%pc7");
+                fprintf(stderr, "   %%pc7");
         if (extra_msr_offset)
                 fprintf(stderr, "        MSR 0x%x ", extra_msr_offset);
 
@@ -187,6 +223,15 @@ void dump_list(struct counters *cnt)
                 dump_cnt(cnt);
 }
 
+/*
+ * column formatting convention & formats
+ * package: "pk" 2 columns %2d
+ * core: "cor" 3 columns %3d
+ * CPU: "CPU" 3 columns %3d
+ * GHz: "GHz" 3 columns %3.2
+ * TSC: "TSC" 3 columns %3.2
+ * percentage " %pc3" %6.2
+ */
 void print_cnt(struct counters *p)
 {
         double interval_float;
@@ -196,39 +241,45 @@ void print_cnt(struct counters *p)
         /* topology columns, print blanks on 1st (average) line */
         if (p == cnt_average) {
                 if (show_pkg)
+                        fprintf(stderr, "  ");
+                if (show_pkg && show_core)
                         fprintf(stderr, " ");
                 if (show_core)
-                        fprintf(stderr, "    ");
+                        fprintf(stderr, "   ");
                 if (show_cpu)
-                        fprintf(stderr, "    ");
+                        fprintf(stderr, " " "   ");
         } else {
                 if (show_pkg)
-                        fprintf(stderr, "%d", p->pkg);
+                        fprintf(stderr, "%2d", p->pkg);
+                if (show_pkg && show_core)
+                        fprintf(stderr, " ");
                 if (show_core)
-                        fprintf(stderr, "%4d", p->core);
+                        fprintf(stderr, "%3d", p->core);
                 if (show_cpu)
-                        fprintf(stderr, "%4d", p->cpu);
+                        fprintf(stderr, " %3d", p->cpu);
         }
 
         /* %c0 */
         if (do_nhm_cstates) {
+                if (show_pkg || show_core || show_cpu)
+                        fprintf(stderr, " ");
                 if (!skip_c0)
-                        fprintf(stderr, "%7.2f", 100.0 * p->mperf/p->tsc);
+                        fprintf(stderr, "%6.2f", 100.0 * p->mperf/p->tsc);
                 else
-                        fprintf(stderr, "   ****");
+                        fprintf(stderr, "  ****");
         }
 
         /* GHz */
         if (has_aperf) {
                 if (!aperf_mperf_unstable) {
-                        fprintf(stderr, "%5.2f",
+                        fprintf(stderr, " %3.2f",
                                 1.0 * p->tsc / units * p->aperf /
                                 p->mperf / interval_float);
                 } else {
                         if (p->aperf > p->tsc || p->mperf > p->tsc) {
-                                fprintf(stderr, " ****");
+                                fprintf(stderr, " ***");
                         } else {
-                                fprintf(stderr, "%4.1f*",
+                                fprintf(stderr, "%3.1f*",
                                         1.0 * p->tsc /
                                         units * p->aperf /
                                         p->mperf / interval_float);
@@ -241,7 +292,7 @@ void print_cnt(struct counters *p)
 
         if (do_nhm_cstates) {
                 if (!skip_c1)
-                        fprintf(stderr, "%7.2f", 100.0 * p->c1/p->tsc);
+                        fprintf(stderr, " %6.2f", 100.0 * p->c1/p->tsc);
                 else
                         fprintf(stderr, "  ****");
         }
@@ -252,13 +303,13 @@ void print_cnt(struct counters *p)
         if (do_snb_cstates)
                 fprintf(stderr, " %6.2f", 100.0 * p->c7/p->tsc);
         if (do_snb_cstates)
-                fprintf(stderr, " %5.2f", 100.0 * p->pc2/p->tsc);
+                fprintf(stderr, " %6.2f", 100.0 * p->pc2/p->tsc);
         if (do_nhm_cstates)
-                fprintf(stderr, " %5.2f", 100.0 * p->pc3/p->tsc);
+                fprintf(stderr, " %6.2f", 100.0 * p->pc3/p->tsc);
         if (do_nhm_cstates)
-                fprintf(stderr, " %5.2f", 100.0 * p->pc6/p->tsc);
+                fprintf(stderr, " %6.2f", 100.0 * p->pc6/p->tsc);
         if (do_snb_cstates)
-                fprintf(stderr, " %5.2f", 100.0 * p->pc7/p->tsc);
+                fprintf(stderr, " %6.2f", 100.0 * p->pc7/p->tsc);
         if (extra_msr_offset)
                 fprintf(stderr, "  0x%016llx", p->extra_msr);
         putc('\n', stderr);
@@ -267,12 +318,20 @@ void print_cnt(struct counters *p)
 void print_counters(struct counters *counters)
 {
         struct counters *cnt;
+        static int printed;
+
 
-        print_header();
+        if (!printed || !summary_only)
+                print_header();
 
         if (num_cpus > 1)
                 print_cnt(cnt_average);
 
+        printed = 1;
+
+        if (summary_only)
+                return;
+
         for (cnt = counters; cnt != NULL; cnt = cnt->next)
                 print_cnt(cnt);
 
@@ -440,31 +499,51 @@ void compute_average(struct counters *delta, struct counters *avg)
         free(sum);
 }
 
-void get_counters(struct counters *cnt)
+int get_counters(struct counters *cnt)
 {
         for ( ; cnt; cnt = cnt->next) {
-                cnt->tsc = get_msr(cnt->cpu, MSR_TSC);
-                if (do_nhm_cstates)
-                        cnt->c3 = get_msr(cnt->cpu, MSR_CORE_C3_RESIDENCY);
-                if (do_nhm_cstates)
-                        cnt->c6 = get_msr(cnt->cpu, MSR_CORE_C6_RESIDENCY);
-                if (do_snb_cstates)
-                        cnt->c7 = get_msr(cnt->cpu, MSR_CORE_C7_RESIDENCY);
-                if (has_aperf)
-                        cnt->aperf = get_msr(cnt->cpu, MSR_APERF);
-                if (has_aperf)
-                        cnt->mperf = get_msr(cnt->cpu, MSR_MPERF);
-                if (do_snb_cstates)
-                        cnt->pc2 = get_msr(cnt->cpu, MSR_PKG_C2_RESIDENCY);
-                if (do_nhm_cstates)
-                        cnt->pc3 = get_msr(cnt->cpu, MSR_PKG_C3_RESIDENCY);
-                if (do_nhm_cstates)
-                        cnt->pc6 = get_msr(cnt->cpu, MSR_PKG_C6_RESIDENCY);
+
+                if (cpu_migrate(cnt->cpu))
+                        return -1;
+
+                if (get_msr(cnt->cpu, MSR_TSC, &cnt->tsc))
+                        return -1;
+
+                if (has_aperf) {
+                        if (get_msr(cnt->cpu, MSR_APERF, &cnt->aperf))
+                                return -1;
+                        if (get_msr(cnt->cpu, MSR_MPERF, &cnt->mperf))
+                                return -1;
+                }
+
+                if (do_nhm_cstates) {
+                        if (get_msr(cnt->cpu, MSR_CORE_C3_RESIDENCY, &cnt->c3))
+                                return -1;
+                        if (get_msr(cnt->cpu, MSR_CORE_C6_RESIDENCY, &cnt->c6))
+                                return -1;
+                }
+
                 if (do_snb_cstates)
-                        cnt->pc7 = get_msr(cnt->cpu, MSR_PKG_C7_RESIDENCY);
+                        if (get_msr(cnt->cpu, MSR_CORE_C7_RESIDENCY, &cnt->c7))
+                                return -1;
+
+                if (do_nhm_cstates) {
+                        if (get_msr(cnt->cpu, MSR_PKG_C3_RESIDENCY, &cnt->pc3))
+                                return -1;
+                        if (get_msr(cnt->cpu, MSR_PKG_C6_RESIDENCY, &cnt->pc6))
+                                return -1;
+                }
+                if (do_snb_cstates) {
+                        if (get_msr(cnt->cpu, MSR_PKG_C2_RESIDENCY, &cnt->pc2))
+                                return -1;
+                        if (get_msr(cnt->cpu, MSR_PKG_C7_RESIDENCY, &cnt->pc7))
+                                return -1;
+                }
                 if (extra_msr_offset)
-                        cnt->extra_msr = get_msr(cnt->cpu, extra_msr_offset);
+                        if (get_msr(cnt->cpu, extra_msr_offset, &cnt->extra_msr))
+                                return -1;
         }
+        return 0;
 }
 
 void print_nehalem_info(void)
@@ -475,7 +554,7 @@ void print_nehalem_info(void)
         if (!do_nehalem_platform_info)
                 return;
 
-        msr = get_msr(0, MSR_NEHALEM_PLATFORM_INFO);
+        get_msr(0, MSR_NEHALEM_PLATFORM_INFO, &msr);
 
         ratio = (msr >> 40) & 0xFF;
         fprintf(stderr, "%d * %.0f = %.0f MHz max efficiency\n",
@@ -491,7 +570,7 @@ void print_nehalem_info(void)
         if (!do_nehalem_turbo_ratio_limit)
                 return;
 
-        msr = get_msr(0, MSR_NEHALEM_TURBO_RATIO_LIMIT);
+        get_msr(0, MSR_NEHALEM_TURBO_RATIO_LIMIT, &msr);
 
         ratio = (msr >> 24) & 0xFF;
         if (ratio)
@@ -557,7 +636,8 @@ void insert_counters(struct counters **list,
                 return;
         }
 
-        show_cpu = 1;   /* there is more than one CPU */
+        if (!summary_only)
+                show_cpu = 1;   /* there is more than one CPU */
 
         /*
          * insert on front of list.
@@ -575,13 +655,15 @@ void insert_counters(struct counters **list,
 
         while (prev->next && (prev->next->pkg < new->pkg)) {
                 prev = prev->next;
-                show_pkg = 1;   /* there is more than 1 package */
+                if (!summary_only)
+                        show_pkg = 1;   /* there is more than 1 package */
         }
 
         while (prev->next && (prev->next->pkg == new->pkg)
                 && (prev->next->core < new->core)) {
                 prev = prev->next;
-                show_core = 1;  /* there is more than 1 core */
+                if (!summary_only)
+                        show_core = 1;  /* there is more than 1 core */
         }
 
         while (prev->next && (prev->next->pkg == new->pkg)
@@ -681,7 +763,7 @@ int get_core_id(int cpu)
 }
 
 /*
- * run func(index, cpu) on every cpu in /proc/stat
+ * run func(pkg, core, cpu) on every cpu in /proc/stat
  */
 
 int for_all_cpus(void (func)(int, int, int))
@@ -717,18 +799,18 @@ int for_all_cpus(void (func)(int, int, int))
 
 void re_initialize(void)
 {
-        printf("turbostat: topology changed, re-initializing.\n");
         free_all_counters();
         num_cpus = for_all_cpus(alloc_new_counters);
-        need_reinitialize = 0;
-        printf("num_cpus is now %d\n", num_cpus);
+        cpu_mask_uninit();
+        cpu_mask_init(num_cpus);
+        printf("turbostat: re-initialized with num_cpus %d\n", num_cpus);
 }
 
 void dummy(int pkg, int core, int cpu) { return; }
 /*
  * check to see if a cpu came on-line
  */
-void verify_num_cpus(void)
+int verify_num_cpus(void)
 {
         int new_num_cpus;
 
@@ -738,8 +820,9 @@ void verify_num_cpus(void)
                 if (verbose)
                         printf("num_cpus was %d, is now  %d\n",
                                 num_cpus, new_num_cpus);
-                need_reinitialize = 1;
+                return -1;
         }
+        return 0;
 }
 
 void turbostat_loop()
@@ -749,25 +832,25 @@ restart:
         gettimeofday(&tv_even, (struct timezone *)NULL);
 
         while (1) {
-                verify_num_cpus();
-                if (need_reinitialize) {
+                if (verify_num_cpus()) {
                         re_initialize();
                         goto restart;
                 }
                 sleep(interval_sec);
-                get_counters(cnt_odd);
+                if (get_counters(cnt_odd)) {
+                        re_initialize();
+                        goto restart;
+                }
                 gettimeofday(&tv_odd, (struct timezone *)NULL);
-
                 compute_delta(cnt_odd, cnt_even, cnt_delta);
                 timersub(&tv_odd, &tv_even, &tv_delta);
                 compute_average(cnt_delta, cnt_average);
                 print_counters(cnt_delta);
-                if (need_reinitialize) {
+                sleep(interval_sec);
+                if (get_counters(cnt_even)) {
                         re_initialize();
                         goto restart;
                 }
-                sleep(interval_sec);
-                get_counters(cnt_even);
                 gettimeofday(&tv_even, (struct timezone *)NULL);
                 compute_delta(cnt_even, cnt_odd, cnt_delta);
                 timersub(&tv_even, &tv_odd, &tv_delta);
@@ -811,6 +894,8 @@ int has_nehalem_turbo_ratio_limit(unsigned int family, unsigned int model)
         case 0x2C:      /* Westmere EP - Gulftown */
         case 0x2A:      /* SNB */
         case 0x2D:      /* SNB Xeon */
+        case 0x3A:      /* IVB */
+        case 0x3D:      /* IVB Xeon */
                 return 1;
         case 0x2E:      /* Nehalem-EX Xeon - Beckton */
         case 0x2F:      /* Westmere-EX Xeon - Eagleton */
@@ -951,6 +1036,7 @@ void turbostat_init()
         check_super_user();
 
         num_cpus = for_all_cpus(alloc_new_counters);
+        cpu_mask_init(num_cpus);
 
         if (verbose)
                 print_nehalem_info();
@@ -1003,8 +1089,11 @@ void cmdline(int argc, char **argv)
 
         progname = argv[0];
 
-        while ((opt = getopt(argc, argv, "+vi:M:")) != -1) {
+        while ((opt = getopt(argc, argv, "+svi:M:")) != -1) {
                 switch (opt) {
+                case 's':
+                        summary_only++;
+                        break;
                 case 'v':
                         verbose++;
                         break;
diff --git a/tools/testing/ktest/compare-ktest-sample.pl b/tools/testing/ktest/compare-ktest-sample.pl
index 9a571e71683c..a373a5bfff68 100755
--- a/tools/testing/ktest/compare-ktest-sample.pl
+++ b/tools/testing/ktest/compare-ktest-sample.pl
@@ -2,7 +2,9 @@
 
 open (IN,"ktest.pl");
 while (<IN>) {
+    # hashes are now used
     if (/\$opt\{"?([A-Z].*?)(\[.*\])?"?\}/ ||
+        /^\s*"?([A-Z].*?)"?\s*=>\s*/ ||
         /set_test_option\("(.*?)"/) {
         $opt{$1} = 1;
     }
@@ -11,7 +13,7 @@ close IN;
 
 open (IN, "sample.conf");
 while (<IN>) {
-    if (/^\s*#?\s*(\S+)\s*=/) {
+    if (/^\s*#?\s*([A-Z]\S*)\s*=/) {
         $samp{$1} = 1;
     }
 }
diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
index 8b4c2535b266..95d6a6f7c33a 100755
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -18,40 +18,51 @@ $| = 1;
 my %opt;
 my %repeat_tests;
 my %repeats;
-my %default;
 
 #default opts
-$default{"NUM_TESTS"}           = 1;
-$default{"REBOOT_TYPE"}         = "grub";
-$default{"TEST_TYPE"}           = "test";
-$default{"BUILD_TYPE"}          = "randconfig";
-$default{"MAKE_CMD"}            = "make";
-$default{"TIMEOUT"}             = 120;
-$default{"TMP_DIR"}             = "/tmp/ktest/\${MACHINE}";
-$default{"SLEEP_TIME"}          = 60;   # sleep time between tests
-$default{"BUILD_NOCLEAN"}       = 0;
-$default{"REBOOT_ON_ERROR"}     = 0;
-$default{"POWEROFF_ON_ERROR"}   = 0;
-$default{"REBOOT_ON_SUCCESS"}   = 1;
-$default{"POWEROFF_ON_SUCCESS"} = 0;
-$default{"BUILD_OPTIONS"}       = "";
-$default{"BISECT_SLEEP_TIME"}   = 60;   # sleep time between bisects
-$default{"PATCHCHECK_SLEEP_TIME"} = 60; # sleep time between patch checks
-$default{"CLEAR_LOG"}           = 0;
-$default{"BISECT_MANUAL"}       = 0;
-$default{"BISECT_SKIP"}         = 1;
-$default{"SUCCESS_LINE"}        = "login:";
-$default{"DETECT_TRIPLE_FAULT"} = 1;
-$default{"NO_INSTALL"}          = 0;
-$default{"BOOTED_TIMEOUT"}      = 1;
-$default{"DIE_ON_FAILURE"}      = 1;
-$default{"SSH_EXEC"}            = "ssh \$SSH_USER\@\$MACHINE \$SSH_COMMAND";
-$default{"SCP_TO_TARGET"}       = "scp \$SRC_FILE \$SSH_USER\@\$MACHINE:\$DST_FILE";
-$default{"REBOOT"}              = "ssh \$SSH_USER\@\$MACHINE reboot";
-$default{"STOP_AFTER_SUCCESS"}  = 10;
-$default{"STOP_AFTER_FAILURE"}  = 60;
-$default{"STOP_TEST_AFTER"}     = 600;
-$default{"LOCALVERSION"}        = "-test";
+my %default = (
+    "NUM_TESTS"                 => 1,
+    "TEST_TYPE"                 => "build",
+    "BUILD_TYPE"                => "randconfig",
+    "MAKE_CMD"                  => "make",
+    "TIMEOUT"                   => 120,
+    "TMP_DIR"                   => "/tmp/ktest/\${MACHINE}",
+    "SLEEP_TIME"                => 60,  # sleep time between tests
+    "BUILD_NOCLEAN"             => 0,
+    "REBOOT_ON_ERROR"           => 0,
+    "POWEROFF_ON_ERROR"         => 0,
+    "REBOOT_ON_SUCCESS"         => 1,
+    "POWEROFF_ON_SUCCESS"       => 0,
+    "BUILD_OPTIONS"             => "",
+    "BISECT_SLEEP_TIME"         => 60,   # sleep time between bisects
+    "PATCHCHECK_SLEEP_TIME"     => 60, # sleep time between patch checks
+    "CLEAR_LOG"                 => 0,
+    "BISECT_MANUAL"             => 0,
+    "BISECT_SKIP"               => 1,
+    "SUCCESS_LINE"              => "login:",
+    "DETECT_TRIPLE_FAULT"       => 1,
+    "NO_INSTALL"                => 0,
+    "BOOTED_TIMEOUT"            => 1,
+    "DIE_ON_FAILURE"            => 1,
+    "SSH_EXEC"                  => "ssh \$SSH_USER\@\$MACHINE \$SSH_COMMAND",
+    "SCP_TO_TARGET"             => "scp \$SRC_FILE \$SSH_USER\@\$MACHINE:\$DST_FILE",
+    "SCP_TO_TARGET_INSTALL"     => "\${SCP_TO_TARGET}",
+    "REBOOT"                    => "ssh \$SSH_USER\@\$MACHINE reboot",
+    "STOP_AFTER_SUCCESS"        => 10,
+    "STOP_AFTER_FAILURE"        => 60,
+    "STOP_TEST_AFTER"           => 600,
+
+# required, and we will ask users if they don't have them but we keep the default
+# value something that is common.
+    "REBOOT_TYPE"               => "grub",
+    "LOCALVERSION"              => "-test",
+    "SSH_USER"                  => "root",
+    "BUILD_TARGET"              => "arch/x86/boot/bzImage",
+    "TARGET_IMAGE"              => "/boot/vmlinuz-test",
+
+    "LOG_FILE"                  => undef,
+    "IGNORE_UNUSED"             => 0,
+);
 
 my $ktest_config;
 my $version;
@@ -73,12 +84,16 @@ my $reboot_script;
 my $power_cycle;
 my $reboot;
 my $reboot_on_error;
+my $switch_to_good;
+my $switch_to_test;
 my $poweroff_on_error;
+my $reboot_on_success;
 my $die_on_failure;
 my $powercycle_after_reboot;
 my $poweroff_after_halt;
 my $ssh_exec;
 my $scp_to_target;
+my $scp_to_target_install;
 my $power_off;
 my $grub_menu;
 my $grub_number;
@@ -92,17 +107,24 @@ my $start_minconfig;
 my $start_minconfig_defined;
 my $output_minconfig;
 my $ignore_config;
+my $ignore_errors;
 my $addconfig;
 my $in_bisect = 0;
-my $bisect_bad = "";
+my $bisect_bad_commit = "";
 my $reverse_bisect;
 my $bisect_manual;
 my $bisect_skip;
 my $config_bisect_good;
+my $bisect_ret_good;
+my $bisect_ret_bad;
+my $bisect_ret_skip;
+my $bisect_ret_abort;
+my $bisect_ret_default;
 my $in_patchcheck = 0;
 my $run_test;
 my $redirect;
 my $buildlog;
+my $testlog;
 my $dmesg;
 my $monitor_fp;
 my $monitor_pid;
@@ -112,6 +134,7 @@ my $bisect_sleep_time;
 my $patchcheck_sleep_time;
 my $ignore_warnings;
 my $store_failures;
+my $store_successes;
 my $test_name;
 my $timeout;
 my $booted_timeout;
@@ -124,10 +147,34 @@ my $stop_after_failure;
 my $stop_test_after;
 my $build_target;
 my $target_image;
+my $checkout;
 my $localversion;
 my $iteration = 0;
 my $successes = 0;
 
+my $bisect_good;
+my $bisect_bad;
+my $bisect_type;
+my $bisect_start;
+my $bisect_replay;
+my $bisect_files;
+my $bisect_reverse;
+my $bisect_check;
+
+my $config_bisect;
+my $config_bisect_type;
+
+my $patchcheck_type;
+my $patchcheck_start;
+my $patchcheck_end;
+
+# set when a test is something other that just building or install
+# which would require more options.
+my $buildonly = 1;
+
+# set when creating a new config
+my $newconfig = 0;
+
 my %entered_configs;
 my %config_help;
 my %variable;
@@ -136,11 +183,101 @@ my %force_config;
 # do not force reboots on config problems
 my $no_reboot = 1;
 
+my %option_map = (
+    "MACHINE"                   => \$machine,
+    "SSH_USER"                  => \$ssh_user,
+    "TMP_DIR"                   => \$tmpdir,
+    "OUTPUT_DIR"                => \$outputdir,
+    "BUILD_DIR"                 => \$builddir,
+    "TEST_TYPE"                 => \$test_type,
+    "BUILD_TYPE"                => \$build_type,
+    "BUILD_OPTIONS"             => \$build_options,
+    "PRE_BUILD"                 => \$pre_build,
+    "POST_BUILD"                => \$post_build,
+    "PRE_BUILD_DIE"             => \$pre_build_die,
+    "POST_BUILD_DIE"            => \$post_build_die,
+    "POWER_CYCLE"               => \$power_cycle,
+    "REBOOT"                    => \$reboot,
+    "BUILD_NOCLEAN"             => \$noclean,
+    "MIN_CONFIG"                => \$minconfig,
+    "OUTPUT_MIN_CONFIG"         => \$output_minconfig,
+    "START_MIN_CONFIG"          => \$start_minconfig,
+    "IGNORE_CONFIG"             => \$ignore_config,
+    "TEST"                      => \$run_test,
+    "ADD_CONFIG"                => \$addconfig,
+    "REBOOT_TYPE"               => \$reboot_type,
+    "GRUB_MENU"                 => \$grub_menu,
+    "POST_INSTALL"              => \$post_install,
+    "NO_INSTALL"                => \$no_install,
+    "REBOOT_SCRIPT"             => \$reboot_script,
+    "REBOOT_ON_ERROR"           => \$reboot_on_error,
+    "SWITCH_TO_GOOD"            => \$switch_to_good,
+    "SWITCH_TO_TEST"            => \$switch_to_test,
+    "POWEROFF_ON_ERROR"         => \$poweroff_on_error,
+    "REBOOT_ON_SUCCESS"         => \$reboot_on_success,
+    "DIE_ON_FAILURE"            => \$die_on_failure,
+    "POWER_OFF"                 => \$power_off,
+    "POWERCYCLE_AFTER_REBOOT"   => \$powercycle_after_reboot,
+    "POWEROFF_AFTER_HALT"       => \$poweroff_after_halt,
+    "SLEEP_TIME"                => \$sleep_time,
+    "BISECT_SLEEP_TIME"         => \$bisect_sleep_time,
+    "PATCHCHECK_SLEEP_TIME"     => \$patchcheck_sleep_time,
+    "IGNORE_WARNINGS"           => \$ignore_warnings,
+    "IGNORE_ERRORS"             => \$ignore_errors,
+    "BISECT_MANUAL"             => \$bisect_manual,
+    "BISECT_SKIP"               => \$bisect_skip,
+    "CONFIG_BISECT_GOOD"        => \$config_bisect_good,
+    "BISECT_RET_GOOD"           => \$bisect_ret_good,
+    "BISECT_RET_BAD"            => \$bisect_ret_bad,
+    "BISECT_RET_SKIP"           => \$bisect_ret_skip,
+    "BISECT_RET_ABORT"          => \$bisect_ret_abort,
+    "BISECT_RET_DEFAULT"        => \$bisect_ret_default,
+    "STORE_FAILURES"            => \$store_failures,
+    "STORE_SUCCESSES"           => \$store_successes,
+    "TEST_NAME"                 => \$test_name,
+    "TIMEOUT"                   => \$timeout,
+    "BOOTED_TIMEOUT"            => \$booted_timeout,
+    "CONSOLE"                   => \$console,
+    "DETECT_TRIPLE_FAULT"       => \$detect_triplefault,
+    "SUCCESS_LINE"              => \$success_line,
+    "REBOOT_SUCCESS_LINE"       => \$reboot_success_line,
+    "STOP_AFTER_SUCCESS"        => \$stop_after_success,
+    "STOP_AFTER_FAILURE"        => \$stop_after_failure,
+    "STOP_TEST_AFTER"           => \$stop_test_after,
+    "BUILD_TARGET"              => \$build_target,
+    "SSH_EXEC"                  => \$ssh_exec,
+    "SCP_TO_TARGET"             => \$scp_to_target,
+    "SCP_TO_TARGET_INSTALL"     => \$scp_to_target_install,
+    "CHECKOUT"                  => \$checkout,
+    "TARGET_IMAGE"              => \$target_image,
+    "LOCALVERSION"              => \$localversion,
+
+    "BISECT_GOOD"               => \$bisect_good,
+    "BISECT_BAD"                => \$bisect_bad,
+    "BISECT_TYPE"               => \$bisect_type,
+    "BISECT_START"              => \$bisect_start,
+    "BISECT_REPLAY"             => \$bisect_replay,
+    "BISECT_FILES"              => \$bisect_files,
+    "BISECT_REVERSE"            => \$bisect_reverse,
+    "BISECT_CHECK"              => \$bisect_check,
+
+    "CONFIG_BISECT"             => \$config_bisect,
+    "CONFIG_BISECT_TYPE"        => \$config_bisect_type,
+
+    "PATCHCHECK_TYPE"           => \$patchcheck_type,
+    "PATCHCHECK_START"          => \$patchcheck_start,
+    "PATCHCHECK_END"            => \$patchcheck_end,
+);
+
+# Options may be used by other options, record them.
+my %used_options;
+
 # default variables that can be used
 chomp ($variable{"PWD"} = `pwd`);
 
 $config_help{"MACHINE"} = << "EOF"
  The machine hostname that you will test.
+ For build only tests, it is still needed to differentiate log files.
 EOF
     ;
 $config_help{"SSH_USER"} = << "EOF"
@@ -150,11 +287,15 @@ EOF
     ;
 $config_help{"BUILD_DIR"} = << "EOF"
  The directory that contains the Linux source code (full path).
+ You can use \${PWD} that will be the path where ktest.pl is run, or use
+ \${THIS_DIR} which is assigned \${PWD} but may be changed later.
 EOF
     ;
 $config_help{"OUTPUT_DIR"} = << "EOF"
  The directory that the objects will be built (full path).
  (can not be same as BUILD_DIR)
+ You can use \${PWD} that will be the path where ktest.pl is run, or use
+ \${THIS_DIR} which is assigned \${PWD} but may be changed later.
 EOF
     ;
 $config_help{"BUILD_TARGET"} = << "EOF"
@@ -162,6 +303,11 @@ $config_help{"BUILD_TARGET"} = << "EOF"
  (relative to OUTPUT_DIR)
 EOF
     ;
+$config_help{"BUILD_OPTIONS"} = << "EOF"
+ Options to add to \"make\" when building.
+ i.e.  -j20
+EOF
+    ;
 $config_help{"TARGET_IMAGE"} = << "EOF"
  The place to put your image on the test machine.
 EOF
@@ -227,20 +373,36 @@ $config_help{"REBOOT_SCRIPT"} = << "EOF"
 EOF
     ;
 
-sub read_yn {
-    my ($prompt) = @_;
+sub read_prompt {
+    my ($cancel, $prompt) = @_;
 
     my $ans;
 
     for (;;) {
-        print "$prompt [Y/n] ";
+        if ($cancel) {
+            print "$prompt [y/n/C] ";
+        } else {
+            print "$prompt [Y/n] ";
+        }
         $ans = <STDIN>;
         chomp $ans;
         if ($ans =~ /^\s*$/) {
-            $ans = "y";
+            if ($cancel) {
+                $ans = "c";
+            } else {
+                $ans = "y";
+            }
         }
         last if ($ans =~ /^y$/i || $ans =~ /^n$/i);
-        print "Please answer either 'y' or 'n'.\n";
+        if ($cancel) {
+            last if ($ans =~ /^c$/i);
+            print "Please answer either 'y', 'n' or 'c'.\n";
+        } else {
+            print "Please answer either 'y' or 'n'.\n";
+        }
+    }
+    if ($ans =~ /^c/i) {
+        exit;
     }
     if ($ans !~ /^y$/i) {
         return 0;
@@ -248,6 +410,18 @@ sub read_yn {
     return 1;
 }
 
+sub read_yn {
+    my ($prompt) = @_;
+
+    return read_prompt 0, $prompt;
+}
+
+sub read_ync {
+    my ($prompt) = @_;
+
+    return read_prompt 1, $prompt;
+}
+
 sub get_ktest_config {
     my ($config) = @_;
     my $ans;
@@ -261,7 +435,7 @@ sub get_ktest_config {
 
     for (;;) {
         print "$config = ";
-        if (defined($default{$config})) {
+        if (defined($default{$config}) && length($default{$config})) {
             print "\[$default{$config}\] ";
         }
         $ans = <STDIN>;
@@ -274,22 +448,37 @@ sub get_ktest_config {
                 next;
             }
         }
-        $entered_configs{$config} = process_variables($ans);
+        $entered_configs{$config} = ${ans};
         last;
     }
 }
 
 sub get_ktest_configs {
     get_ktest_config("MACHINE");
-    get_ktest_config("SSH_USER");
     get_ktest_config("BUILD_DIR");
     get_ktest_config("OUTPUT_DIR");
-    get_ktest_config("BUILD_TARGET");
-    get_ktest_config("TARGET_IMAGE");
-    get_ktest_config("POWER_CYCLE");
-    get_ktest_config("CONSOLE");
+
+    if ($newconfig) {
+        get_ktest_config("BUILD_OPTIONS");
+    }
+
+    # options required for other than just building a kernel
+    if (!$buildonly) {
+        get_ktest_config("POWER_CYCLE");
+        get_ktest_config("CONSOLE");
+    }
+
+    # options required for install and more
+    if ($buildonly != 1) {
+        get_ktest_config("SSH_USER");
+        get_ktest_config("BUILD_TARGET");
+        get_ktest_config("TARGET_IMAGE");
+    }
+
     get_ktest_config("LOCALVERSION");
 
+    return if ($buildonly);
+
     my $rtype = $opt{"REBOOT_TYPE"};
 
     if (!defined($rtype)) {
@@ -303,8 +492,6 @@ sub get_ktest_configs {
 
     if ($rtype eq "grub") {
         get_ktest_config("GRUB_MENU");
-    } else {
-        get_ktest_config("REBOOT_SCRIPT");
     }
 }
 
@@ -334,6 +521,10 @@ sub process_variables {
         } else {
             # put back the origin piece.
             $retval = "$retval\$\{$var\}";
+            # This could be an option that is used later, save
+            # it so we don't warn if this option is not one of
+            # ktests options.
+            $used_options{$var} = 1;
         }
         $value = $end;
     }
@@ -348,6 +539,19 @@ sub process_variables {
 sub set_value {
     my ($lvalue, $rvalue, $override, $overrides, $name) = @_;
 
+    my $prvalue = process_variables($rvalue);
+
+    if ($buildonly && $lvalue =~ /^TEST_TYPE(\[.*\])?$/ && $prvalue ne "build") {
+        # Note if a test is something other than build, then we
+        # will need other manditory options.
+        if ($prvalue ne "install") {
+            $buildonly = 0;
+        } else {
+            # install still limits some manditory options.
+            $buildonly = 2;
+        }
+    }
+
     if (defined($opt{$lvalue})) {
         if (!$override || defined(${$overrides}{$lvalue})) {
             my $extra = "";
@@ -356,13 +560,12 @@ sub set_value {
             }
             die "$name: $.: Option $lvalue defined more than once!\n$extra";
         }
-        ${$overrides}{$lvalue} = $rvalue;
+        ${$overrides}{$lvalue} = $prvalue;
     }
     if ($rvalue =~ /^\s*$/) {
         delete $opt{$lvalue};
     } else {
-        $rvalue = process_variables($rvalue);
-        $opt{$lvalue} = $rvalue;
+        $opt{$lvalue} = $prvalue;
     }
 }
 
@@ -712,6 +915,15 @@ sub __read_config {
     return $test_case;
 }
 
+sub get_test_case {
+        print "What test case would you like to run?\n";
+        print " (build, install or boot)\n";
+        print " Other tests are available but require editing the config file\n";
+        my $ans = <STDIN>;
+        chomp $ans;
+        $default{"TEST_TYPE"} = $ans;
+}
+
 sub read_config {
     my ($config) = @_;
 
@@ -726,10 +938,7 @@ sub read_config {
     # was a test specified?
     if (!$test_case) {
         print "No test case specified.\n";
-        print "What test case would you like to run?\n";
-        my $ans = <STDIN>;
-        chomp $ans;
-        $default{"TEST_TYPE"} = $ans;
+        get_test_case;
     }
 
     # set any defaults
@@ -739,6 +948,37 @@ sub read_config {
             $opt{$default} = $default{$default};
         }
     }
+
+    if ($opt{"IGNORE_UNUSED"} == 1) {
+        return;
+    }
+
+    my %not_used;
+
+    # check if there are any stragglers (typos?)
+    foreach my $option (keys %opt) {
+        my $op = $option;
+        # remove per test labels.
+        $op =~ s/\[.*\]//;
+        if (!exists($option_map{$op}) &&
+            !exists($default{$op}) &&
+            !exists($used_options{$op})) {
+            $not_used{$op} = 1;
+        }
+    }
+
+    if (%not_used) {
+        my $s = "s are";
+        $s = " is" if (keys %not_used == 1);
+        print "The following option$s not used; could be a typo:\n";
+        foreach my $option (keys %not_used) {
+            print "$option\n";
+        }
+        print "Set IGRNORE_UNUSED = 1 to have ktest ignore unused variables\n";
+        if (!read_yn "Do you want to continue?") {
+            exit -1;
+        }
+    }
 }
 
 sub __eval_option {
@@ -873,6 +1113,16 @@ sub reboot {
     }
 }
 
+sub reboot_to_good {
+    my ($time) = @_;
+
+    if (defined($switch_to_good)) {
+        run_command $switch_to_good;
+    }
+
+    reboot $time;
+}
+
 sub do_not_reboot {
     my $i = $iteration;
 
@@ -889,7 +1139,7 @@ sub dodie {
     if ($reboot_on_error && !do_not_reboot) {
 
         doprint "REBOOTING\n";
-        reboot;
+        reboot_to_good;
 
     } elsif ($poweroff_on_error && defined($power_off)) {
         doprint "POWERING OFF\n";
@@ -975,6 +1225,43 @@ sub wait_for_monitor {
     print "** Monitor flushed **\n";
 }
 
+sub save_logs {
+        my ($result, $basedir) = @_;
+        my @t = localtime;
+        my $date = sprintf "%04d%02d%02d%02d%02d%02d",
+                1900+$t[5],$t[4],$t[3],$t[2],$t[1],$t[0];
+
+        my $type = $build_type;
+        if ($type =~ /useconfig/) {
+            $type = "useconfig";
+        }
+
+        my $dir = "$machine-$test_type-$type-$result-$date";
+
+        $dir = "$basedir/$dir";
+
+        if (!-d $dir) {
+            mkpath($dir) or
+                die "can't create $dir";
+        }
+
+        my %files = (
+                "config" => $output_config,
+                "buildlog" => $buildlog,
+                "dmesg" => $dmesg,
+                "testlog" => $testlog,
+        );
+
+        while (my ($name, $source) = each(%files)) {
+                if (-f "$source") {
+                        cp "$source", "$dir/$name" or
+                                die "failed to copy $source";
+                }
+        }
+
+        doprint "*** Saved info to $dir ***\n";
+}
+
 sub fail {
 
         if ($die_on_failure) {
@@ -988,7 +1275,7 @@ sub fail {
         # no need to reboot for just building.
         if (!do_not_reboot) {
             doprint "REBOOTING\n";
-            reboot $sleep_time;
+            reboot_to_good $sleep_time;
         }
 
         my $name = "";
@@ -1003,38 +1290,9 @@ sub fail {
         doprint "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%\n";
         doprint "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%\n";
 
-        return 1 if (!defined($store_failures));
-
-        my @t = localtime;
-        my $date = sprintf "%04d%02d%02d%02d%02d%02d",
-                1900+$t[5],$t[4],$t[3],$t[2],$t[1],$t[0];
-
-        my $type = $build_type;
-        if ($type =~ /useconfig/) {
-            $type = "useconfig";
-        }
-
-        my $dir = "$machine-$test_type-$type-fail-$date";
-        my $faildir = "$store_failures/$dir";
-
-        if (!-d $faildir) {
-            mkpath($faildir) or
-                die "can't create $faildir";
-        }
-        if (-f "$output_config") {
-            cp "$output_config", "$faildir/config" or
-                die "failed to copy .config";
-        }
-        if (-f $buildlog) {
-            cp $buildlog, "$faildir/buildlog" or
-                die "failed to move $buildlog";
-        }
-        if (-f $dmesg) {
-            cp $dmesg, "$faildir/dmesg" or
-                die "failed to move $dmesg";
-        }
-
-        doprint "*** Saved info to $faildir ***\n";
+        if (defined($store_failures)) {
+            save_logs "fail", $store_failures;
+        }
 
         return 1;
 }
@@ -1095,8 +1353,7 @@ sub run_ssh {
 }
 
 sub run_scp {
-    my ($src, $dst) = @_;
-    my $cp_scp = $scp_to_target;
+    my ($src, $dst, $cp_scp) = @_;
 
     $cp_scp =~ s/\$SRC_FILE/$src/g;
     $cp_scp =~ s/\$DST_FILE/$dst/g;
@@ -1104,6 +1361,22 @@ sub run_scp {
     return run_command "$cp_scp";
 }
 
+sub run_scp_install {
+    my ($src, $dst) = @_;
+
+    my $cp_scp = $scp_to_target_install;
+
+    return run_scp($src, $dst, $cp_scp);
+}
+
+sub run_scp_mod {
+    my ($src, $dst) = @_;
+
+    my $cp_scp = $scp_to_target;
+
+    return run_scp($src, $dst, $cp_scp);
+}
+
 sub get_grub_index {
 
     if ($reboot_type ne "grub") {
@@ -1170,13 +1443,16 @@ sub wait_for_input
 }
 
 sub reboot_to {
+    if (defined($switch_to_test)) {
+        run_command $switch_to_test;
+    }
+
     if ($reboot_type eq "grub") {
         run_ssh "'(echo \"savedefault --default=$grub_number --once\" | grub --batch)'";
-        reboot;
-        return;
+    } elsif (defined $reboot_script) {
+        run_command "$reboot_script";
     }
-
-    run_command "$reboot_script";
+    reboot;
 }
 
 sub get_sha1 {
@@ -1203,6 +1479,7 @@ sub get_sha1 {
 sub monitor {
     my $booted = 0;
     my $bug = 0;
+    my $bug_ignored = 0;
     my $skip_call_trace = 0;
     my $loops;
 
@@ -1275,8 +1552,12 @@ sub monitor {
 
         if ($full_line =~ /call trace:/i) {
             if (!$bug && !$skip_call_trace) {
-                $bug = 1;
-                $failure_start = time;
+                if ($ignore_errors) {
+                    $bug_ignored = 1;
+                } else {
+                    $bug = 1;
+                    $failure_start = time;
+                }
             }
         }
 
@@ -1338,15 +1619,26 @@ sub monitor {
         fail "failed - never got a boot prompt." and return 0;
     }
 
+    if ($bug_ignored) {
+        doprint "WARNING: Call Trace detected but ignored due to IGNORE_ERRORS=1\n";
+    }
+
     return 1;
 }
 
+sub eval_kernel_version {
+    my ($option) = @_;
+
+    $option =~ s/\$KERNEL_VERSION/$version/g;
+
+    return $option;
+}
+
 sub do_post_install {
 
     return if (!defined($post_install));
 
-    my $cp_post_install = $post_install;
-    $cp_post_install =~ s/\$KERNEL_VERSION/$version/g;
+    my $cp_post_install = eval_kernel_version $post_install;
     run_command "$cp_post_install" or
         dodie "Failed to run post install";
 }
@@ -1355,7 +1647,9 @@ sub install {
 
     return if ($no_install);
 
-    run_scp "$outputdir/$build_target", "$target_image" or
+    my $cp_target = eval_kernel_version $target_image;
+
+    run_scp_install "$outputdir/$build_target", "$cp_target" or
         dodie "failed to copy image";
 
     my $install_mods = 0;
@@ -1377,7 +1671,7 @@ sub install {
         return;
     }
 
-    run_command "$make INSTALL_MOD_PATH=$tmpdir modules_install" or
+    run_command "$make INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=$tmpdir modules_install" or
         dodie "Failed to install modules";
 
     my $modlib = "/lib/modules/$version";
@@ -1390,7 +1684,7 @@ sub install {
     run_command "cd $tmpdir && tar -cjf $modtar lib/modules/$version" or
         dodie "making tarball";
 
-    run_scp "$tmpdir/$modtar", "/tmp" or
+    run_scp_mod "$tmpdir/$modtar", "/tmp" or
         dodie "failed to copy modules";
 
     unlink "$tmpdir/$modtar";
@@ -1640,9 +1934,13 @@ sub success {
     doprint     "*******************************************\n";
     doprint     "*******************************************\n";
 
+    if (defined($store_successes)) {
+        save_logs "success", $store_successes;
+    }
+
     if ($i != $opt{"NUM_TESTS"} && !do_not_reboot) {
         doprint "Reboot and wait $sleep_time seconds\n";
-        reboot $sleep_time;
+        reboot_to_good $sleep_time;
     }
 }
 
@@ -1669,7 +1967,10 @@ sub child_run_test {
     $poweroff_on_error = 0;
     $die_on_failure = 1;
 
+    $redirect = "$testlog";
     run_command $run_test or $failed = 1;
+    undef $redirect;
+
     exit $failed;
 }
 
@@ -1744,6 +2045,43 @@ sub do_run_test {
     waitpid $child_pid, 0;
     $child_exit = $?;
 
+    if (!$bug && $in_bisect) {
+        if (defined($bisect_ret_good)) {
+            if ($child_exit == $bisect_ret_good) {
+                return 1;
+            }
+        }
+        if (defined($bisect_ret_skip)) {
+            if ($child_exit == $bisect_ret_skip) {
+                return -1;
+            }
+        }
+        if (defined($bisect_ret_abort)) {
+            if ($child_exit == $bisect_ret_abort) {
+                fail "test abort" and return -2;
+            }
+        }
+        if (defined($bisect_ret_bad)) {
+            if ($child_exit == $bisect_ret_skip) {
+                return 0;
+            }
+        }
+        if (defined($bisect_ret_default)) {
+            if ($bisect_ret_default eq "good") {
+                return 1;
+            } elsif ($bisect_ret_default eq "bad") {
+                return 0;
+            } elsif ($bisect_ret_default eq "skip") {
+                return -1;
+            } elsif ($bisect_ret_default eq "abort") {
+                return -2;
+            } else {
+                fail "unknown default action: $bisect_ret_default"
+                    and return -2;
+            }
+        }
+    }
+
     if ($bug || $child_exit) {
         return 0 if $in_bisect;
         fail "test failed" and return 0;
@@ -1770,7 +2108,7 @@ sub run_git_bisect {
     if ($output =~ m/^(Bisecting: .*\(roughly \d+ steps?\))\s+\[([[:xdigit:]]+)\]/) {
         doprint "$1 [$2]\n";
     } elsif ($output =~ m/^([[:xdigit:]]+) is the first bad commit/) {
-        $bisect_bad = $1;
+        $bisect_bad_commit = $1;
         doprint "Found bad commit... $1\n";
         return 0;
     } else {
@@ -1783,7 +2121,7 @@ sub run_git_bisect {
 
 sub bisect_reboot {
     doprint "Reboot and sleep $bisect_sleep_time seconds\n";
-    reboot $bisect_sleep_time;
+    reboot_to_good $bisect_sleep_time;
 }
 
 # returns 1 on success, 0 on failure, -1 on skip
@@ -1868,21 +2206,28 @@ sub run_bisect {
     }
 }
 
+sub update_bisect_replay {
+    my $tmp_log = "$tmpdir/ktest_bisect_log";
+    run_command "git bisect log > $tmp_log" or
+        die "can't create bisect log";
+    return $tmp_log;
+}
+
 sub bisect {
     my ($i) = @_;
 
     my $result;
 
-    die "BISECT_GOOD[$i] not defined\n" if (!defined($opt{"BISECT_GOOD[$i]"}));
-    die "BISECT_BAD[$i] not defined\n"  if (!defined($opt{"BISECT_BAD[$i]"}));
-    die "BISECT_TYPE[$i] not defined\n" if (!defined($opt{"BISECT_TYPE[$i]"}));
+    die "BISECT_GOOD[$i] not defined\n" if (!defined($bisect_good));
+    die "BISECT_BAD[$i] not defined\n"  if (!defined($bisect_bad));
+    die "BISECT_TYPE[$i] not defined\n" if (!defined($bisect_type));
 
-    my $good = $opt{"BISECT_GOOD[$i]"};
-    my $bad = $opt{"BISECT_BAD[$i]"};
-    my $type = $opt{"BISECT_TYPE[$i]"};
-    my $start = $opt{"BISECT_START[$i]"};
-    my $replay = $opt{"BISECT_REPLAY[$i]"};
-    my $start_files = $opt{"BISECT_FILES[$i]"};
+    my $good = $bisect_good;
+    my $bad = $bisect_bad;
+    my $type = $bisect_type;
+    my $start = $bisect_start;
+    my $replay = $bisect_replay;
+    my $start_files = $bisect_files;
 
     if (defined($start_files)) {
         $start_files = " -- " . $start_files;
@@ -1894,8 +2239,7 @@ sub bisect {
     $good = get_sha1($good);
     $bad = get_sha1($bad);
 
-    if (defined($opt{"BISECT_REVERSE[$i]"}) &&
-        $opt{"BISECT_REVERSE[$i]"} == 1) {
+    if (defined($bisect_reverse) && $bisect_reverse == 1) {
         doprint "Performing a reverse bisect (bad is good, good is bad!)\n";
         $reverse_bisect = 1;
     } else {
@@ -1907,8 +2251,31 @@ sub bisect {
         $type = "boot";
     }
 
-    my $check = $opt{"BISECT_CHECK[$i]"};
-    if (defined($check) && $check ne "0") {
+    # Check if a bisect was running
+    my $bisect_start_file = "$builddir/.git/BISECT_START";
+
+    my $check = $bisect_check;
+    my $do_check = defined($check) && $check ne "0";
+
+    if ( -f $bisect_start_file ) {
+        print "Bisect in progress found\n";
+        if ($do_check) {
+            print " If you say yes, then no checks of good or bad will be done\n";
+        }
+        if (defined($replay)) {
+            print "** BISECT_REPLAY is defined in config file **";
+            print " Ignore config option and perform new git bisect log?\n";
+            if (read_ync " (yes, no, or cancel) ") {
+                $replay = update_bisect_replay;
+                $do_check = 0;
+            }
+        } elsif (read_yn "read git log and continue?") {
+            $replay = update_bisect_replay;
+            $do_check = 0;
+        }
+    }
+
+    if ($do_check) {
 
         # get current HEAD
         my $head = get_sha1("HEAD");
@@ -1973,7 +2340,7 @@ sub bisect {
     run_command "git bisect reset" or
         dodie "could not reset git bisect";
 
-    doprint "Bad commit was [$bisect_bad]\n";
+    doprint "Bad commit was [$bisect_bad_commit]\n";
 
     success $i;
 }
@@ -2129,7 +2496,7 @@ sub run_config_bisect {
     }
 
     doprint "***** RUN TEST ***\n";
-    my $type = $opt{"CONFIG_BISECT_TYPE[$iteration]"};
+    my $type = $config_bisect_type;
     my $ret;
     my %current_config;
 
@@ -2233,7 +2600,7 @@ sub run_config_bisect {
 sub config_bisect {
     my ($i) = @_;
 
-    my $start_config = $opt{"CONFIG_BISECT[$i]"};
+    my $start_config = $config_bisect;
 
     my $tmpconfig = "$tmpdir/use_config";
 
@@ -2262,7 +2629,7 @@ sub config_bisect {
     # read directly what we want to check
     my %config_check;
     open (IN, $output_config)
-        or dodie "faied to open $output_config";
+        or dodie "failed to open $output_config";
 
     while (<IN>) {
         if (/^((CONFIG\S*)=.*)/) {
@@ -2346,29 +2713,29 @@ sub config_bisect {
 
 sub patchcheck_reboot {
     doprint "Reboot and sleep $patchcheck_sleep_time seconds\n";
-    reboot $patchcheck_sleep_time;
+    reboot_to_good $patchcheck_sleep_time;
 }
 
 sub patchcheck {
     my ($i) = @_;
 
     die "PATCHCHECK_START[$i] not defined\n"
-        if (!defined($opt{"PATCHCHECK_START[$i]"}));
+        if (!defined($patchcheck_start));
     die "PATCHCHECK_TYPE[$i] not defined\n"
-        if (!defined($opt{"PATCHCHECK_TYPE[$i]"}));
+        if (!defined($patchcheck_type));
 
-    my $start = $opt{"PATCHCHECK_START[$i]"};
+    my $start = $patchcheck_start;
 
     my $end = "HEAD";
-    if (defined($opt{"PATCHCHECK_END[$i]"})) {
-        $end = $opt{"PATCHCHECK_END[$i]"};
+    if (defined($patchcheck_end)) {
+        $end = $patchcheck_end;
     }
 
     # Get the true sha1's since we can use things like HEAD~3
     $start = get_sha1($start);
     $end = get_sha1($end);
 
-    my $type = $opt{"PATCHCHECK_TYPE[$i]"};
+    my $type = $patchcheck_type;
 
     # Can't have a test without having a test to run
     if ($type eq "test" && !defined($run_test)) {
@@ -2905,9 +3272,11 @@ sub make_min_config {
         $in_bisect = 1;
 
         my $failed = 0;
-        build "oldconfig";
-        start_monitor_and_boot or $failed = 1;
-        end_monitor;
+        build "oldconfig" or $failed = 1;
+        if (!$failed) {
+                start_monitor_and_boot or $failed = 1;
+                end_monitor;
+        }
 
         $in_bisect = 0;
 
@@ -2963,7 +3332,7 @@ sub make_min_config {
         }
 
         doprint "Reboot and wait $sleep_time seconds\n";
-        reboot $sleep_time;
+        reboot_to_good $sleep_time;
     }
 
     success $i;
@@ -2985,13 +3354,27 @@ if ($#ARGV == 0) {
 }
 
 if (! -f $ktest_config) {
+    $newconfig = 1;
+    get_test_case;
     open(OUT, ">$ktest_config") or die "Can not create $ktest_config";
     print OUT << "EOF"
 # Generated by ktest.pl
 #
+
+# PWD is a ktest.pl variable that will result in the process working
+# directory that ktest.pl is executed in.
+
+# THIS_DIR is automatically assigned the PWD of the path that generated
+# the config file. It is best to use this variable when assigning other
+# directory paths within this directory. This allows you to easily
+# move the test cases to other locations or to other machines.
+#
+THIS_DIR := $variable{"PWD"}
+
 # Define each test with TEST_START
 # The config options below it will override the defaults
 TEST_START
+TEST_TYPE = $default{"TEST_TYPE"}
 
 DEFAULTS
 EOF
@@ -3011,7 +3394,7 @@ if ($#new_configs >= 0) {
     open(OUT, ">>$ktest_config") or die "Can not append to $ktest_config";
     foreach my $config (@new_configs) {
         print OUT "$config = $entered_configs{$config}\n";
-        $opt{$config} = $entered_configs{$config};
+        $opt{$config} = process_variables($entered_configs{$config});
     }
 }
 
@@ -3091,61 +3474,10 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
 
     my $makecmd = set_test_option("MAKE_CMD", $i);
 
-    $machine = set_test_option("MACHINE", $i);
-    $ssh_user = set_test_option("SSH_USER", $i);
-    $tmpdir = set_test_option("TMP_DIR", $i);
-    $outputdir = set_test_option("OUTPUT_DIR", $i);
-    $builddir = set_test_option("BUILD_DIR", $i);
-    $test_type = set_test_option("TEST_TYPE", $i);
-    $build_type = set_test_option("BUILD_TYPE", $i);
-    $build_options = set_test_option("BUILD_OPTIONS", $i);
-    $pre_build = set_test_option("PRE_BUILD", $i);
-    $post_build = set_test_option("POST_BUILD", $i);
-    $pre_build_die = set_test_option("PRE_BUILD_DIE", $i);
-    $post_build_die = set_test_option("POST_BUILD_DIE", $i);
-    $power_cycle = set_test_option("POWER_CYCLE", $i);
-    $reboot = set_test_option("REBOOT", $i);
-    $noclean = set_test_option("BUILD_NOCLEAN", $i);
-    $minconfig = set_test_option("MIN_CONFIG", $i);
-    $output_minconfig = set_test_option("OUTPUT_MIN_CONFIG", $i);
-    $start_minconfig = set_test_option("START_MIN_CONFIG", $i);
-    $ignore_config = set_test_option("IGNORE_CONFIG", $i);
-    $run_test = set_test_option("TEST", $i);
-    $addconfig = set_test_option("ADD_CONFIG", $i);
-    $reboot_type = set_test_option("REBOOT_TYPE", $i);
-    $grub_menu = set_test_option("GRUB_MENU", $i);
-    $post_install = set_test_option("POST_INSTALL", $i);
-    $no_install = set_test_option("NO_INSTALL", $i);
-    $reboot_script = set_test_option("REBOOT_SCRIPT", $i);
-    $reboot_on_error = set_test_option("REBOOT_ON_ERROR", $i);
-    $poweroff_on_error = set_test_option("POWEROFF_ON_ERROR", $i);
-    $die_on_failure = set_test_option("DIE_ON_FAILURE", $i);
-    $power_off = set_test_option("POWER_OFF", $i);
-    $powercycle_after_reboot = set_test_option("POWERCYCLE_AFTER_REBOOT", $i);
-    $poweroff_after_halt = set_test_option("POWEROFF_AFTER_HALT", $i);
-    $sleep_time = set_test_option("SLEEP_TIME", $i);
-    $bisect_sleep_time = set_test_option("BISECT_SLEEP_TIME", $i);
-    $patchcheck_sleep_time = set_test_option("PATCHCHECK_SLEEP_TIME", $i);
-    $ignore_warnings = set_test_option("IGNORE_WARNINGS", $i);
-    $bisect_manual = set_test_option("BISECT_MANUAL", $i);
-    $bisect_skip = set_test_option("BISECT_SKIP", $i);
-    $config_bisect_good = set_test_option("CONFIG_BISECT_GOOD", $i);
-    $store_failures = set_test_option("STORE_FAILURES", $i);
-    $test_name = set_test_option("TEST_NAME", $i);
-    $timeout = set_test_option("TIMEOUT", $i);
-    $booted_timeout = set_test_option("BOOTED_TIMEOUT", $i);
-    $console = set_test_option("CONSOLE", $i);
-    $detect_triplefault = set_test_option("DETECT_TRIPLE_FAULT", $i);
-    $success_line = set_test_option("SUCCESS_LINE", $i);
-    $reboot_success_line = set_test_option("REBOOT_SUCCESS_LINE", $i);
-    $stop_after_success = set_test_option("STOP_AFTER_SUCCESS", $i);
-    $stop_after_failure = set_test_option("STOP_AFTER_FAILURE", $i);
-    $stop_test_after = set_test_option("STOP_TEST_AFTER", $i);
-    $build_target = set_test_option("BUILD_TARGET", $i);
-    $ssh_exec = set_test_option("SSH_EXEC", $i);
-    $scp_to_target = set_test_option("SCP_TO_TARGET", $i);
-    $target_image = set_test_option("TARGET_IMAGE", $i);
-    $localversion = set_test_option("LOCALVERSION", $i);
+    # Load all the options into their mapped variable names
+    foreach my $opt (keys %option_map) {
+        ${$option_map{$opt}} = set_test_option($opt, $i);
+    }
 
     $start_minconfig_defined = 1;
 
@@ -3166,26 +3498,26 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
     $ENV{"SSH_USER"} = $ssh_user;
     $ENV{"MACHINE"} = $machine;
 
-    $target = "$ssh_user\@$machine";
-
     $buildlog = "$tmpdir/buildlog-$machine";
+    $testlog = "$tmpdir/testlog-$machine";
     $dmesg = "$tmpdir/dmesg-$machine";
     $make = "$makecmd O=$outputdir";
     $output_config = "$outputdir/.config";
 
-    if ($reboot_type eq "grub") {
-        dodie "GRUB_MENU not defined" if (!defined($grub_menu));
-    } elsif (!defined($reboot_script)) {
-        dodie "REBOOT_SCRIPT not defined"
+    if (!$buildonly) {
+        $target = "$ssh_user\@$machine";
+        if ($reboot_type eq "grub") {
+            dodie "GRUB_MENU not defined" if (!defined($grub_menu));
+        }
     }
 
     my $run_type = $build_type;
     if ($test_type eq "patchcheck") {
-        $run_type = $opt{"PATCHCHECK_TYPE[$i]"};
+        $run_type = $patchcheck_type;
     } elsif ($test_type eq "bisect") {
-        $run_type = $opt{"BISECT_TYPE[$i]"};
+        $run_type = $bisect_type;
     } elsif ($test_type eq "config_bisect") {
-        $run_type = $opt{"CONFIG_BISECT_TYPE[$i]"};
+        $run_type = $config_bisect_type;
     }
 
     if ($test_type eq "make_min_config") {
@@ -3205,6 +3537,7 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
 
     unlink $dmesg;
     unlink $buildlog;
+    unlink $testlog;
 
     if (defined($addconfig)) {
         my $min = $minconfig;
@@ -3216,14 +3549,15 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
         $minconfig = "$tmpdir/add_config";
     }
 
-    my $checkout = $opt{"CHECKOUT[$i]"};
     if (defined($checkout)) {
         run_command "git checkout $checkout" or
             die "failed to checkout $checkout";
     }
 
-    $no_reboot = 0;
-
+    # A test may opt to not reboot the box
+    if ($reboot_on_success) {
+        $no_reboot = 0;
+    }
 
     if ($test_type eq "bisect") {
         bisect $i;
@@ -3267,9 +3601,13 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
 if ($opt{"POWEROFF_ON_SUCCESS"}) {
     halt;
 } elsif ($opt{"REBOOT_ON_SUCCESS"} && !do_not_reboot) {
-    reboot;
+    reboot_to_good;
+} elsif (defined($switch_to_good)) {
+    # still need to get to the good kernel
+    run_command $switch_to_good;
 }
 
+
 doprint "\n    $successes of $opt{NUM_TESTS} tests were successful\n\n";
 
 exit 0;
diff --git a/tools/testing/ktest/sample.conf b/tools/testing/ktest/sample.conf
index 553c06b7d6f2..b682456afda8 100644
--- a/tools/testing/ktest/sample.conf
+++ b/tools/testing/ktest/sample.conf
@@ -346,7 +346,10 @@
 #GRUB_MENU = Test Kernel
 
 # A script to reboot the target into the test kernel
-# (Only mandatory if REBOOT_TYPE = script)
+# This and SWITCH_TO_TEST are about the same, except
+# SWITCH_TO_TEST is run even for REBOOT_TYPE = grub.
+# This may be left undefined.
+# (default undefined)
 #REBOOT_SCRIPT =
 
 #### Optional Config Options (all have defaults) ####
@@ -468,6 +471,27 @@
 # The test will not modify that file.
 #REBOOT_TYPE = grub
 
+# If you are using a machine that doesn't boot with grub, and
+# perhaps gets its kernel from a remote server (tftp), then
+# you can use this option to update the target image with the
+# test image.
+#
+# You could also do the same with POST_INSTALL, but the difference
+# between that option and this option is that POST_INSTALL runs
+# after the install, where this one runs just before a reboot.
+# (default undefined)
+#SWITCH_TO_TEST = cp ${OUTPUT_DIR}/${BUILD_TARGET} ${TARGET_IMAGE}
+
+# If you are using a machine that doesn't boot with grub, and
+# perhaps gets its kernel from a remote server (tftp), then
+# you can use this option to update the target image with the
+# the known good image to reboot safely back into.
+#
+# This option holds a command that will execute before needing
+# to reboot to a good known image.
+# (default undefined)
+#SWITCH_TO_GOOD = ssh ${SSH_USER}/${MACHINE} cp good_image ${TARGET_IMAGE}
+
 # The min config that is needed to build for the machine
 # A nice way to create this is with the following:
 #
@@ -589,6 +613,12 @@
 # (default undefined)
 #STORE_FAILURES = /home/test/failures
 
+# Directory to store success directories on success. If this is not
+# set, the .config, dmesg and bootlog will not be saved if a
+# test succeeds.
+# (default undefined)
+#STORE_SUCCESSES = /home/test/successes
+
 # Build without doing a make mrproper, or removing .config
 # (default 0)
 #BUILD_NOCLEAN = 0
@@ -680,10 +710,18 @@
 # The variables SSH_USER, MACHINE and SSH_COMMAND are defined
 #SSH_EXEC = ssh $SSH_USER@$MACHINE $SSH_COMMAND";
 
-# The way to copy a file to the target
+# The way to copy a file to the target (install and modules)
 # (default scp $SRC_FILE $SSH_USER@$MACHINE:$DST_FILE)
-# The variables SSH_USER, MACHINE, SRC_FILE and DST_FILE are defined.
-#SCP_TO_TARGET = scp $SRC_FILE $SSH_USER@$MACHINE:$DST_FILE
+# The variables SSH_USER, MACHINE are defined by the config
+# SRC_FILE and DST_FILE are ktest internal variables and
+# should only have '$' and not the '${}' notation.
+# (default scp $SRC_FILE ${SSH_USER}@${MACHINE}:$DST_FILE)
+#SCP_TO_TARGET = echo skip scp for $SRC_FILE $DST_FILE
+
+# If install needs to be different than modules, then this
+# option will override the SCP_TO_TARGET for installation.
+# (default ${SCP_TO_TARGET} )
+#SCP_TO_TARGET_INSTALL = scp $SRC_FILE tftp@tftpserver:$DST_FILE
 
 # The nice way to reboot the target
 # (default ssh $SSH_USER@$MACHINE reboot)
@@ -700,6 +738,25 @@
 # (default 1)
 #DETECT_TRIPLE_FAULT = 0
 
+# All options in the config file should be either used by ktest
+# or could be used within a value of another option. If an option
+# in the config file is not used, ktest will warn about it and ask
+# if you want to continue.
+#
+# If you don't care if there are non-used options, enable this
+# option. Be careful though, a non-used option is usually a sign
+# of an option name being typed incorrectly.
+# (default 0)
+#IGNORE_UNUSED = 1
+
+# When testing a kernel that happens to have WARNINGs, and call
+# traces, ktest.pl will detect these and fail a boot or test run
+# due to warnings. By setting this option, ktest will ignore
+# call traces, and will not fail a test if the kernel produces
+# an oops. Use this option with care.
+# (default 0)
+#IGNORE_ERRORS = 1
+
 #### Per test run options ####
 # The following options are only allowed in TEST_START sections.
 # They are ignored in the DEFAULTS sections.
@@ -862,6 +919,42 @@
 #   BISECT_BAD with BISECT_CHECK = good or
 #   BISECT_CHECK = bad, respectively.
 #
+# BISECT_RET_GOOD = 0 (optional, default undefined)
+#
+#   In case the specificed test returns something other than just
+#   0 for good, and non-zero for bad, you can override 0 being
+#   good by defining BISECT_RET_GOOD.
+#
+# BISECT_RET_BAD = 1 (optional, default undefined)
+#
+#   In case the specificed test returns something other than just
+#   0 for good, and non-zero for bad, you can override non-zero being
+#   bad by defining BISECT_RET_BAD.
+#
+# BISECT_RET_ABORT = 255 (optional, default undefined)
+#
+#   If you need to abort the bisect if the test discovers something
+#   that was wrong, you can define BISECT_RET_ABORT to be the error
+#   code returned by the test in order to abort the bisect.
+#
+# BISECT_RET_SKIP = 2 (optional, default undefined)
+#
+#   If the test detects that the current commit is neither good
+#   nor bad, but something else happened (another bug detected)
+#   you can specify BISECT_RET_SKIP to an error code that the
+#   test returns when it should skip the current commit.
+#
+# BISECT_RET_DEFAULT = good (optional, default undefined)
+#
+#   You can override the default of what to do when the above
+#   options are not hit. This may be one of, "good", "bad",
+#   "abort" or "skip" (without the quotes).
+#
+#   Note, if you do not define any of the previous BISECT_RET_*
+#   and define BISECT_RET_DEFAULT, all bisects results will do
+#   what the BISECT_RET_DEFAULT has.
+#
+#
 # Example:
 #   TEST_START
 #   TEST_TYPE = bisect
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
new file mode 100644
index 000000000000..28bc57ee757c
--- /dev/null
+++ b/tools/testing/selftests/Makefile
@@ -0,0 +1,16 @@
+TARGETS = breakpoints vm
+
+all:
+        for TARGET in $(TARGETS); do \
+                make -C $$TARGET; \
+        done;
+
+run_tests: all
+        for TARGET in $(TARGETS); do \
+                make -C $$TARGET run_tests; \
+        done;
+
+clean:
+        for TARGET in $(TARGETS); do \
+                make -C $$TARGET clean; \
+        done;
diff --git a/tools/testing/selftests/breakpoints/Makefile b/tools/testing/selftests/breakpoints/Makefile
new file mode 100644
index 000000000000..931278035f5c
--- /dev/null
+++ b/tools/testing/selftests/breakpoints/Makefile
@@ -0,0 +1,23 @@
+# Taken from perf makefile
+uname_M := $(shell uname -m 2>/dev/null || echo not)
+ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/i386/)
+ifeq ($(ARCH),i386)
+        ARCH := x86
+endif
+ifeq ($(ARCH),x86_64)
+        ARCH := x86
+endif
+
+
+all:
+ifeq ($(ARCH),x86)
+        gcc breakpoint_test.c -o breakpoint_test
+else
+        echo "Not an x86 target, can't build breakpoints selftests"
+endif
+
+run_tests:
+        ./breakpoint_test
+
+clean:
+        rm -fr breakpoint_test
diff --git a/tools/testing/selftests/breakpoints/breakpoint_test.c b/tools/testing/selftests/breakpoints/breakpoint_test.c
new file mode 100644
index 000000000000..a0743f3b2b57
--- /dev/null
+++ b/tools/testing/selftests/breakpoints/breakpoint_test.c
@@ -0,0 +1,394 @@
+/*
+ * Copyright (C) 2011 Red Hat, Inc., Frederic Weisbecker <fweisbec@redhat.com>
+ *
+ * Licensed under the terms of the GNU GPL License version 2
+ *
+ * Selftests for breakpoints (and more generally the do_debug() path) in x86.
+ */
+
+
+#include <sys/ptrace.h>
+#include <unistd.h>
+#include <stddef.h>
+#include <sys/user.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+
+
+/* Breakpoint access modes */
+enum {
+        BP_X = 1,
+        BP_RW = 2,
+        BP_W = 4,
+};
+
+static pid_t child_pid;
+
+/*
+ * Ensures the child and parent are always "talking" about
+ * the same test sequence. (ie: that we haven't forgotten
+ * to call check_trapped() somewhere).
+ */
+static int nr_tests;
+
+static void set_breakpoint_addr(void *addr, int n)
+{
+        int ret;
+
+        ret = ptrace(PTRACE_POKEUSER, child_pid,
+                     offsetof(struct user, u_debugreg[n]), addr);
+        if (ret) {
+                perror("Can't set breakpoint addr\n");
+                exit(-1);
+        }
+}
+
+static void toggle_breakpoint(int n, int type, int len,
+                              int local, int global, int set)
+{
+        int ret;
+
+        int xtype, xlen;
+        unsigned long vdr7, dr7;
+
+        switch (type) {
+        case BP_X:
+                xtype = 0;
+                break;
+        case BP_W:
+                xtype = 1;
+                break;
+        case BP_RW:
+                xtype = 3;
+                break;
+        }
+
+        switch (len) {
+        case 1:
+                xlen = 0;
+                break;
+        case 2:
+                xlen = 4;
+                break;
+        case 4:
+                xlen = 0xc;
+                break;
+        case 8:
+                xlen = 8;
+                break;
+        }
+
+        dr7 = ptrace(PTRACE_PEEKUSER, child_pid,
+                     offsetof(struct user, u_debugreg[7]), 0);
+
+        vdr7 = (xlen | xtype) << 16;
+        vdr7 <<= 4 * n;
+
+        if (local) {
+                vdr7 |= 1 << (2 * n);
+                vdr7 |= 1 << 8;
+        }
+        if (global) {
+                vdr7 |= 2 << (2 * n);
+                vdr7 |= 1 << 9;
+        }
+
+        if (set)
+                dr7 |= vdr7;
+        else
+                dr7 &= ~vdr7;
+
+        ret = ptrace(PTRACE_POKEUSER, child_pid,
+                     offsetof(struct user, u_debugreg[7]), dr7);
+        if (ret) {
+                perror("Can't set dr7");
+                exit(-1);
+        }
+}
+
+/* Dummy variables to test read/write accesses */
+static unsigned long long dummy_var[4];
+
+/* Dummy functions to test execution accesses */
+static void dummy_func(void) { }
+static void dummy_func1(void) { }
+static void dummy_func2(void) { }
+static void dummy_func3(void) { }
+
+static void (*dummy_funcs[])(void) = {
+        dummy_func,
+        dummy_func1,
+        dummy_func2,
+        dummy_func3,
+};
+
+static int trapped;
+
+static void check_trapped(void)
+{
+        /*
+         * If we haven't trapped, wake up the parent
+         * so that it notices the failure.
+         */
+        if (!trapped)
+                kill(getpid(), SIGUSR1);
+        trapped = 0;
+
+        nr_tests++;
+}
+
+static void write_var(int len)
+{
+        char *pcval; short *psval; int *pival; long long *plval;
+        int i;
+
+        for (i = 0; i < 4; i++) {
+                switch (len) {
+                case 1:
+                        pcval = (char *)&dummy_var[i];
+                        *pcval = 0xff;
+                        break;
+                case 2:
+                        psval = (short *)&dummy_var[i];
+                        *psval = 0xffff;
+                        break;
+                case 4:
+                        pival = (int *)&dummy_var[i];
+                        *pival = 0xffffffff;
+                        break;
+                case 8:
+                        plval = (long long *)&dummy_var[i];
+                        *plval = 0xffffffffffffffffLL;
+                        break;
+                }
+                check_trapped();
+        }
+}
+
+static void read_var(int len)
+{
+        char cval; short sval; int ival; long long lval;
+        int i;
+
+        for (i = 0; i < 4; i++) {
+                switch (len) {
+                case 1:
+                        cval = *(char *)&dummy_var[i];
+                        break;
+                case 2:
+                        sval = *(short *)&dummy_var[i];
+                        break;
+                case 4:
+                        ival = *(int *)&dummy_var[i];
+                        break;
+                case 8:
+                        lval = *(long long *)&dummy_var[i];
+                        break;
+                }
+                check_trapped();
+        }
+}
+
+/*
+ * Do the r/w/x accesses to trigger the breakpoints. And run
+ * the usual traps.
+ */
+static void trigger_tests(void)
+{
+        int len, local, global, i;
+        char val;
+        int ret;
+
+        ret = ptrace(PTRACE_TRACEME, 0, NULL, 0);
+        if (ret) {
+                perror("Can't be traced?\n");
+                return;
+        }
+
+        /* Wake up father so that it sets up the first test */
+        kill(getpid(), SIGUSR1);
+
+        /* Test instruction breakpoints */
+        for (local = 0; local < 2; local++) {
+                for (global = 0; global < 2; global++) {
+                        if (!local && !global)
+                                continue;
+
+                        for (i = 0; i < 4; i++) {
+                                dummy_funcs[i]();
+                                check_trapped();
+                        }
+                }
+        }
+
+        /* Test write watchpoints */
+        for (len = 1; len <= sizeof(long); len <<= 1) {
+                for (local = 0; local < 2; local++) {
+                        for (global = 0; global < 2; global++) {
+                                if (!local && !global)
+                                        continue;
+                                write_var(len);
+                        }
+                }
+        }
+
+        /* Test read/write watchpoints (on read accesses) */
+        for (len = 1; len <= sizeof(long); len <<= 1) {
+                for (local = 0; local < 2; local++) {
+                        for (global = 0; global < 2; global++) {
+                                if (!local && !global)
+                                        continue;
+                                read_var(len);
+                        }
+                }
+        }
+
+        /* Icebp trap */
+        asm(".byte 0xf1\n");
+        check_trapped();
+
+        /* Int 3 trap */
+        asm("int $3\n");
+        check_trapped();
+
+        kill(getpid(), SIGUSR1);
+}
+
+static void check_success(const char *msg)
+{
+        const char *msg2;
+        int child_nr_tests;
+        int status;
+
+        /* Wait for the child to SIGTRAP */
+        wait(&status);
+
+        msg2 = "Failed";
+
+        if (WSTOPSIG(status) == SIGTRAP) {
+                child_nr_tests = ptrace(PTRACE_PEEKDATA, child_pid,
+                                        &nr_tests, 0);
+                if (child_nr_tests == nr_tests)
+                        msg2 = "Ok";
+                if (ptrace(PTRACE_POKEDATA, child_pid, &trapped, 1)) {
+                        perror("Can't poke\n");
+                        exit(-1);
+                }
+        }
+
+        nr_tests++;
+
+        printf("%s [%s]\n", msg, msg2);
+}
+
+static void launch_instruction_breakpoints(char *buf, int local, int global)
+{
+        int i;
+
+        for (i = 0; i < 4; i++) {
+                set_breakpoint_addr(dummy_funcs[i], i);
+                toggle_breakpoint(i, BP_X, 1, local, global, 1);
+                ptrace(PTRACE_CONT, child_pid, NULL, 0);
+                sprintf(buf, "Test breakpoint %d with local: %d global: %d",
+                        i, local, global);
+                check_success(buf);
+                toggle_breakpoint(i, BP_X, 1, local, global, 0);
+        }
+}
+
+static void launch_watchpoints(char *buf, int mode, int len,
+                               int local, int global)
+{
+        const char *mode_str;
+        int i;
+
+        if (mode == BP_W)
+                mode_str = "write";
+        else
+                mode_str = "read";
+
+        for (i = 0; i < 4; i++) {
+                set_breakpoint_addr(&dummy_var[i], i);
+                toggle_breakpoint(i, mode, len, local, global, 1);
+                ptrace(PTRACE_CONT, child_pid, NULL, 0);
+                sprintf(buf, "Test %s watchpoint %d with len: %d local: "
+                        "%d global: %d", mode_str, i, len, local, global);
+                check_success(buf);
+                toggle_breakpoint(i, mode, len, local, global, 0);
+        }
+}
+
+/* Set the breakpoints and check the child successfully trigger them */
+static void launch_tests(void)
+{
+        char buf[1024];
+        int len, local, global, i;
+
+        /* Instruction breakpoints */
+        for (local = 0; local < 2; local++) {
+                for (global = 0; global < 2; global++) {
+                        if (!local && !global)
+                                continue;
+                        launch_instruction_breakpoints(buf, local, global);
+                }
+        }
+
+        /* Write watchpoint */
+        for (len = 1; len <= sizeof(long); len <<= 1) {
+                for (local = 0; local < 2; local++) {
+                        for (global = 0; global < 2; global++) {
+                                if (!local && !global)
+                                        continue;
+                                launch_watchpoints(buf, BP_W, len,
+                                                   local, global);
+                        }
+                }
+        }
+
+        /* Read-Write watchpoint */
+        for (len = 1; len <= sizeof(long); len <<= 1) {
+                for (local = 0; local < 2; local++) {
+                        for (global = 0; global < 2; global++) {
+                                if (!local && !global)
+                                        continue;
+                                launch_watchpoints(buf, BP_RW, len,
+                                                   local, global);
+                        }
+                }
+        }
+
+        /* Icebp traps */
+        ptrace(PTRACE_CONT, child_pid, NULL, 0);
+        check_success("Test icebp");
+
+        /* Int 3 traps */
+        ptrace(PTRACE_CONT, child_pid, NULL, 0);
+        check_success("Test int 3 trap");
+
+        ptrace(PTRACE_CONT, child_pid, NULL, 0);
+}
+
+int main(int argc, char **argv)
+{
+        pid_t pid;
+        int ret;
+
+        pid = fork();
+        if (!pid) {
+                trigger_tests();
+                return 0;
+        }
+
+        child_pid = pid;
+
+        wait(NULL);
+
+        launch_tests();
+
+        wait(NULL);
+
+        return 0;
+}
diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
new file mode 100644
index 000000000000..b336b24aa6c0
--- /dev/null
+++ b/tools/testing/selftests/vm/Makefile
@@ -0,0 +1,14 @@
+# Makefile for vm selftests
+
+CC = $(CROSS_COMPILE)gcc
+CFLAGS = -Wall -Wextra
+
+all: hugepage-mmap hugepage-shm  map_hugetlb
+%: %.c
+        $(CC) $(CFLAGS) -o $@ $^
+
+run_tests: all
+        /bin/sh ./run_vmtests
+
+clean:
+        $(RM) hugepage-mmap hugepage-shm  map_hugetlb
diff --git a/tools/testing/selftests/vm/hugepage-mmap.c b/tools/testing/selftests/vm/hugepage-mmap.c
new file mode 100644
index 000000000000..a10f310d2362
--- /dev/null
+++ b/tools/testing/selftests/vm/hugepage-mmap.c
@@ -0,0 +1,92 @@
+/*
+ * hugepage-mmap:
+ *
+ * Example of using huge page memory in a user application using the mmap
+ * system call.  Before running this application, make sure that the
+ * administrator has mounted the hugetlbfs filesystem (on some directory
+ * like /mnt) using the command mount -t hugetlbfs nodev /mnt. In this
+ * example, the app is requesting memory of size 256MB that is backed by
+ * huge pages.
+ *
+ * For the ia64 architecture, the Linux kernel reserves Region number 4 for
+ * huge pages.  That means that if one requires a fixed address, a huge page
+ * aligned address starting with 0x800000... will be required.  If a fixed
+ * address is not required, the kernel will select an address in the proper
+ * range.
+ * Other architectures, such as ppc64, i386 or x86_64 are not so constrained.
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <sys/mman.h>
+#include <fcntl.h>
+
+#define FILE_NAME "huge/hugepagefile"
+#define LENGTH (256UL*1024*1024)
+#define PROTECTION (PROT_READ | PROT_WRITE)
+
+/* Only ia64 requires this */
+#ifdef __ia64__
+#define ADDR (void *)(0x8000000000000000UL)
+#define FLAGS (MAP_SHARED | MAP_FIXED)
+#else
+#define ADDR (void *)(0x0UL)
+#define FLAGS (MAP_SHARED)
+#endif
+
+static void check_bytes(char *addr)
+{
+        printf("First hex is %x\n", *((unsigned int *)addr));
+}
+
+static void write_bytes(char *addr)
+{
+        unsigned long i;
+
+        for (i = 0; i < LENGTH; i++)
+                *(addr + i) = (char)i;
+}
+
+static int read_bytes(char *addr)
+{
+        unsigned long i;
+
+        check_bytes(addr);
+        for (i = 0; i < LENGTH; i++)
+                if (*(addr + i) != (char)i) {
+                        printf("Mismatch at %lu\n", i);
+                        return 1;
+                }
+        return 0;
+}
+
+int main(void)
+{
+        void *addr;
+        int fd, ret;
+
+        fd = open(FILE_NAME, O_CREAT | O_RDWR, 0755);
+        if (fd < 0) {
+                perror("Open failed");
+                exit(1);
+        }
+
+        addr = mmap(ADDR, LENGTH, PROTECTION, FLAGS, fd, 0);
+        if (addr == MAP_FAILED) {
+                perror("mmap");
+                unlink(FILE_NAME);
+                exit(1);
+        }
+
+        printf("Returned address is %p\n", addr);
+        check_bytes(addr);
+        write_bytes(addr);
+        ret = read_bytes(addr);
+
+        munmap(addr, LENGTH);
+        close(fd);
+        unlink(FILE_NAME);
+
+        return ret;
+}
diff --git a/tools/testing/selftests/vm/hugepage-shm.c b/tools/testing/selftests/vm/hugepage-shm.c
new file mode 100644
index 000000000000..0d0ef4fc0c04
--- /dev/null
+++ b/tools/testing/selftests/vm/hugepage-shm.c
@@ -0,0 +1,100 @@
+/*
+ * hugepage-shm:
+ *
+ * Example of using huge page memory in a user application using Sys V shared
+ * memory system calls.  In this example the app is requesting 256MB of
+ * memory that is backed by huge pages.  The application uses the flag
+ * SHM_HUGETLB in the shmget system call to inform the kernel that it is
+ * requesting huge pages.
+ *
+ * For the ia64 architecture, the Linux kernel reserves Region number 4 for
+ * huge pages.  That means that if one requires a fixed address, a huge page
+ * aligned address starting with 0x800000... will be required.  If a fixed
+ * address is not required, the kernel will select an address in the proper
+ * range.
+ * Other architectures, such as ppc64, i386 or x86_64 are not so constrained.
+ *
+ * Note: The default shared memory limit is quite low on many kernels,
+ * you may need to increase it via:
+ *
+ * echo 268435456 > /proc/sys/kernel/shmmax
+ *
+ * This will increase the maximum size per shared memory segment to 256MB.
+ * The other limit that you will hit eventually is shmall which is the
+ * total amount of shared memory in pages. To set it to 16GB on a system
+ * with a 4kB pagesize do:
+ *
+ * echo 4194304 > /proc/sys/kernel/shmall
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/ipc.h>
+#include <sys/shm.h>
+#include <sys/mman.h>
+
+#ifndef SHM_HUGETLB
+#define SHM_HUGETLB 04000
+#endif
+
+#define LENGTH (256UL*1024*1024)
+
+#define dprintf(x)  printf(x)
+
+/* Only ia64 requires this */
+#ifdef __ia64__
+#define ADDR (void *)(0x8000000000000000UL)
+#define SHMAT_FLAGS (SHM_RND)
+#else
+#define ADDR (void *)(0x0UL)
+#define SHMAT_FLAGS (0)
+#endif
+
+int main(void)
+{
+        int shmid;
+        unsigned long i;
+        char *shmaddr;
+
+        shmid = shmget(2, LENGTH, SHM_HUGETLB | IPC_CREAT | SHM_R | SHM_W);
+        if (shmid < 0) {
+                perror("shmget");
+                exit(1);
+        }
+        printf("shmid: 0x%x\n", shmid);
+
+        shmaddr = shmat(shmid, ADDR, SHMAT_FLAGS);
+        if (shmaddr == (char *)-1) {
+                perror("Shared memory attach failure");
+                shmctl(shmid, IPC_RMID, NULL);
+                exit(2);
+        }
+        printf("shmaddr: %p\n", shmaddr);
+
+        dprintf("Starting the writes:\n");
+        for (i = 0; i < LENGTH; i++) {
+                shmaddr[i] = (char)(i);
+                if (!(i % (1024 * 1024)))
+                        dprintf(".");
+        }
+        dprintf("\n");
+
+        dprintf("Starting the Check...");
+        for (i = 0; i < LENGTH; i++)
+                if (shmaddr[i] != (char)i) {
+                        printf("\nIndex %lu mismatched\n", i);
+                        exit(3);
+                }
+        dprintf("Done.\n");
+
+        if (shmdt((const void *)shmaddr) != 0) {
+                perror("Detach failure");
+                shmctl(shmid, IPC_RMID, NULL);
+                exit(4);
+        }
+
+        shmctl(shmid, IPC_RMID, NULL);
+
+        return 0;
+}
diff --git a/tools/testing/selftests/vm/map_hugetlb.c b/tools/testing/selftests/vm/map_hugetlb.c
new file mode 100644
index 000000000000..ac56639dd4a9
--- /dev/null
+++ b/tools/testing/selftests/vm/map_hugetlb.c
@@ -0,0 +1,79 @@
+/*
+ * Example of using hugepage memory in a user application using the mmap
+ * system call with MAP_HUGETLB flag.  Before running this program make
+ * sure the administrator has allocated enough default sized huge pages
+ * to cover the 256 MB allocation.
+ *
+ * For ia64 architecture, Linux kernel reserves Region number 4 for hugepages.
+ * That means the addresses starting with 0x800000... will need to be
+ * specified.  Specifying a fixed address is not required on ppc64, i386
+ * or x86_64.
+ */
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <sys/mman.h>
+#include <fcntl.h>
+
+#define LENGTH (256UL*1024*1024)
+#define PROTECTION (PROT_READ | PROT_WRITE)
+
+#ifndef MAP_HUGETLB
+#define MAP_HUGETLB 0x40000 /* arch specific */
+#endif
+
+/* Only ia64 requires this */
+#ifdef __ia64__
+#define ADDR (void *)(0x8000000000000000UL)
+#define FLAGS (MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB | MAP_FIXED)
+#else
+#define ADDR (void *)(0x0UL)
+#define FLAGS (MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB)
+#endif
+
+static void check_bytes(char *addr)
+{
+        printf("First hex is %x\n", *((unsigned int *)addr));
+}
+
+static void write_bytes(char *addr)
+{
+        unsigned long i;
+
+        for (i = 0; i < LENGTH; i++)
+                *(addr + i) = (char)i;
+}
+
+static int read_bytes(char *addr)
+{
+        unsigned long i;
+
+        check_bytes(addr);
+        for (i = 0; i < LENGTH; i++)
+                if (*(addr + i) != (char)i) {
+                        printf("Mismatch at %lu\n", i);
+                        return 1;
+                }
+        return 0;
+}
+
+int main(void)
+{
+        void *addr;
+        int ret;
+
+        addr = mmap(ADDR, LENGTH, PROTECTION, FLAGS, 0, 0);
+        if (addr == MAP_FAILED) {
+                perror("mmap");
+                exit(1);
+        }
+
+        printf("Returned address is %p\n", addr);
+        check_bytes(addr);
+        write_bytes(addr);
+        ret = read_bytes(addr);
+
+        munmap(addr, LENGTH);
+
+        return ret;
+}
diff --git a/tools/testing/selftests/vm/run_vmtests b/tools/testing/selftests/vm/run_vmtests
new file mode 100644
index 000000000000..8b40bd5e5cc2
--- /dev/null
+++ b/tools/testing/selftests/vm/run_vmtests
@@ -0,0 +1,77 @@
+#!/bin/bash
+#please run as root
+
+#we need 256M, below is the size in kB
+needmem=262144
+mnt=./huge
+
+#get pagesize and freepages from /proc/meminfo
+while read name size unit; do
+        if [ "$name" = "HugePages_Free:" ]; then
+                freepgs=$size
+        fi
+        if [ "$name" = "Hugepagesize:" ]; then
+                pgsize=$size
+        fi
+done < /proc/meminfo
+
+#set proper nr_hugepages
+if [ -n "$freepgs" ] && [ -n "$pgsize" ]; then
+        nr_hugepgs=`cat /proc/sys/vm/nr_hugepages`
+        needpgs=`expr $needmem / $pgsize`
+        if [ $freepgs -lt $needpgs ]; then
+                lackpgs=$(( $needpgs - $freepgs ))
+                echo $(( $lackpgs + $nr_hugepgs )) > /proc/sys/vm/nr_hugepages
+                if [ $? -ne 0 ]; then
+                        echo "Please run this test as root"
+                        exit 1
+                fi
+        fi
+else
+        echo "no hugetlbfs support in kernel?"
+        exit 1
+fi
+
+mkdir $mnt
+mount -t hugetlbfs none $mnt
+
+echo "--------------------"
+echo "runing hugepage-mmap"
+echo "--------------------"
+./hugepage-mmap
+if [ $? -ne 0 ]; then
+        echo "[FAIL]"
+else
+        echo "[PASS]"
+fi
+
+shmmax=`cat /proc/sys/kernel/shmmax`
+shmall=`cat /proc/sys/kernel/shmall`
+echo 268435456 > /proc/sys/kernel/shmmax
+echo 4194304 > /proc/sys/kernel/shmall
+echo "--------------------"
+echo "runing hugepage-shm"
+echo "--------------------"
+./hugepage-shm
+if [ $? -ne 0 ]; then
+        echo "[FAIL]"
+else
+        echo "[PASS]"
+fi
+echo $shmmax > /proc/sys/kernel/shmmax
+echo $shmall > /proc/sys/kernel/shmall
+
+echo "--------------------"
+echo "runing map_hugetlb"
+echo "--------------------"
+./map_hugetlb
+if [ $? -ne 0 ]; then
+        echo "[FAIL]"
+else
+        echo "[PASS]"
+fi
+
+#cleanup
+umount $mnt
+rm -rf $mnt
+echo $nr_hugepgs > /proc/sys/vm/nr_hugepages
diff --git a/tools/usb/Makefile b/tools/usb/Makefile
index 8b704af14349..396d6c44e9d7 100644
--- a/tools/usb/Makefile
+++ b/tools/usb/Makefile
@@ -3,7 +3,7 @@
 CC = $(CROSS_COMPILE)gcc
 PTHREAD_LIBS = -lpthread
 WARNINGS = -Wall -Wextra
-CFLAGS = $(WARNINGS) -g $(PTHREAD_LIBS)
+CFLAGS = $(WARNINGS) -g $(PTHREAD_LIBS) -I../include
 
 all: testusb ffs-test
 %: %.c
diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c
index b9c798631699..4b107b5e623f 100644
--- a/tools/usb/ffs-test.c
+++ b/tools/usb/ffs-test.c
@@ -2,7 +2,7 @@
  * ffs-test.c.c -- user mode filesystem api for usb composite function
  *
  * Copyright (C) 2010 Samsung Electronics
- *                    Author: Michal Nazarewicz <m.nazarewicz@samsung.com>
+ *                    Author: Michal Nazarewicz <mina86@mina86.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -36,6 +36,7 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
+#include <tools/le_byteshift.h>
 
 #include "../../include/linux/usb/functionfs.h"
 
@@ -47,34 +48,6 @@
 #define le32_to_cpu(x)  le32toh(x)
 #define le16_to_cpu(x)  le16toh(x)
 
-static inline __u16 get_unaligned_le16(const void *_ptr)
-{
-        const __u8 *ptr = _ptr;
-        return ptr[0] | (ptr[1] << 8);
-}
-
-static inline __u32 get_unaligned_le32(const void *_ptr)
-{
-        const __u8 *ptr = _ptr;
-        return ptr[0] | (ptr[1] << 8) | (ptr[2] << 16) | (ptr[3] << 24);
-}
-
-static inline void put_unaligned_le16(__u16 val, void *_ptr)
-{
-        __u8 *ptr = _ptr;
-        *ptr++ = val;
-        *ptr++ = val >> 8;
-}
-
-static inline void put_unaligned_le32(__u32 val, void *_ptr)
-{
-        __u8 *ptr = _ptr;
-        *ptr++ = val;
-        *ptr++ = val >>  8;
-        *ptr++ = val >> 16;
-        *ptr++ = val >> 24;
-}
-
 
 /******************** Messages and Errors ***********************************/
 
diff --git a/tools/usb/testusb.c b/tools/usb/testusb.c
index f08e89463842..6e0f56701e44 100644
--- a/tools/usb/testusb.c
+++ b/tools/usb/testusb.c
@@ -3,7 +3,7 @@
 /*
  * Copyright (c) 2002 by David Brownell
  * Copyright (c) 2010 by Samsung Electronics
- * Author: Michal Nazarewicz <m.nazarewicz@samsung.com>
+ * Author: Michal Nazarewicz <mina86@mina86.com>
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
diff --git a/tools/virtio/linux/hrtimer.h b/tools/virtio/linux/hrtimer.h
new file mode 100644
index 000000000000..e69de29bb2d1
--- /dev/null
+++ b/tools/virtio/linux/hrtimer.h
diff --git a/tools/virtio/linux/module.h b/tools/virtio/linux/module.h
new file mode 100644
index 000000000000..e69de29bb2d1
--- /dev/null
+++ b/tools/virtio/linux/module.h
diff --git a/tools/virtio/linux/virtio.h b/tools/virtio/linux/virtio.h
index 669bcdd45805..7579f19e61e0 100644
--- a/tools/virtio/linux/virtio.h
+++ b/tools/virtio/linux/virtio.h
@@ -181,26 +181,20 @@ struct virtqueue {
 #define smp_mb()        mb()
 # define smp_rmb()      barrier()
 # define smp_wmb()      barrier()
+/* Weak barriers should be used. If not - it's a bug */
+# define rmb()  abort()
+# define wmb()  abort()
 #else
 #error Please fill in barrier macros
 #endif
 
 /* Interfaces exported by virtio_ring. */
-int virtqueue_add_buf_gfp(struct virtqueue *vq,
-                          struct scatterlist sg[],
-                          unsigned int out_num,
-                          unsigned int in_num,
-                          void *data,
-                          gfp_t gfp);
-
-static inline int virtqueue_add_buf(struct virtqueue *vq,
-                                    struct scatterlist sg[],
-                                    unsigned int out_num,
-                                    unsigned int in_num,
-                                    void *data)
-{
-        return virtqueue_add_buf_gfp(vq, sg, out_num, in_num, data, GFP_ATOMIC);
-}
+int virtqueue_add_buf(struct virtqueue *vq,
+                      struct scatterlist sg[],
+                      unsigned int out_num,
+                      unsigned int in_num,
+                      void *data,
+                      gfp_t gfp);
 
 void virtqueue_kick(struct virtqueue *vq);
 
@@ -214,6 +208,7 @@ void *virtqueue_detach_unused_buf(struct virtqueue *vq);
 struct virtqueue *vring_new_virtqueue(unsigned int num,
                                       unsigned int vring_align,
                                       struct virtio_device *vdev,
+                                      bool weak_barriers,
                                       void *pages,
                                       void (*notify)(struct virtqueue *vq),
                                       void (*callback)(struct virtqueue *vq),
diff --git a/tools/virtio/virtio_test.c b/tools/virtio/virtio_test.c
index 74d3331bdaf9..6bf95f995364 100644
--- a/tools/virtio/virtio_test.c
+++ b/tools/virtio/virtio_test.c
@@ -92,7 +92,8 @@ static void vq_info_add(struct vdev_info *dev, int num)
         assert(r >= 0);
         memset(info->ring, 0, vring_size(num, 4096));
         vring_init(&info->vring, num, info->ring, 4096);
-        info->vq = vring_new_virtqueue(info->vring.num, 4096, &dev->vdev, info->ring,
+        info->vq = vring_new_virtqueue(info->vring.num, 4096, &dev->vdev,
+                                       true, info->ring,
                                        vq_notify, vq_callback, "test");
         assert(info->vq);
         info->vq->priv = info;
@@ -160,7 +161,8 @@ static void run_test(struct vdev_info *dev, struct vq_info *vq, int bufs)
                         if (started < bufs) {
                                 sg_init_one(&sl, dev->buf, dev->buf_size);
                                 r = virtqueue_add_buf(vq->vq, &sl, 1, 0,
-                                                      dev->buf + started);
+                                                      dev->buf + started,
+                                                      GFP_ATOMIC);
                                 if (likely(r >= 0)) {
                                         ++started;
                                         virtqueue_kick(vq->vq);
diff --git a/tools/vm/Makefile b/tools/vm/Makefile
new file mode 100644
index 000000000000..8e30e5c40f8a
--- /dev/null
+++ b/tools/vm/Makefile
@@ -0,0 +1,11 @@
+# Makefile for vm tools
+
+CC = $(CROSS_COMPILE)gcc
+CFLAGS = -Wall -Wextra
+
+all: page-types slabinfo
+%: %.c
+        $(CC) $(CFLAGS) -o $@ $^
+
+clean:
+        $(RM) page-types slabinfo
diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
new file mode 100644
index 000000000000..7dab7b25b5c6
--- /dev/null
+++ b/tools/vm/page-types.c
@@ -0,0 +1,1102 @@
+/*
+ * page-types: Tool for querying page flags
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; version 2.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should find a copy of v2 of the GNU General Public License somewhere on
+ * your Linux system; if not, write to the Free Software Foundation, Inc., 59
+ * Temple Place, Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * Copyright (C) 2009 Intel corporation
+ *
+ * Authors: Wu Fengguang <fengguang.wu@intel.com>
+ */
+
+#define _LARGEFILE64_SOURCE
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <stdint.h>
+#include <stdarg.h>
+#include <string.h>
+#include <getopt.h>
+#include <limits.h>
+#include <assert.h>
+#include <sys/types.h>
+#include <sys/errno.h>
+#include <sys/fcntl.h>
+#include <sys/mount.h>
+#include <sys/statfs.h>
+#include "../../include/linux/magic.h"
+
+
+#ifndef MAX_PATH
+# define MAX_PATH 256
+#endif
+
+#ifndef STR
+# define _STR(x) #x
+# define STR(x) _STR(x)
+#endif
+
+/*
+ * pagemap kernel ABI bits
+ */
+
+#define PM_ENTRY_BYTES      sizeof(uint64_t)
+#define PM_STATUS_BITS      3
+#define PM_STATUS_OFFSET    (64 - PM_STATUS_BITS)
+#define PM_STATUS_MASK      (((1LL << PM_STATUS_BITS) - 1) << PM_STATUS_OFFSET)
+#define PM_STATUS(nr)       (((nr) << PM_STATUS_OFFSET) & PM_STATUS_MASK)
+#define PM_PSHIFT_BITS      6
+#define PM_PSHIFT_OFFSET    (PM_STATUS_OFFSET - PM_PSHIFT_BITS)
+#define PM_PSHIFT_MASK      (((1LL << PM_PSHIFT_BITS) - 1) << PM_PSHIFT_OFFSET)
+#define PM_PSHIFT(x)        (((u64) (x) << PM_PSHIFT_OFFSET) & PM_PSHIFT_MASK)
+#define PM_PFRAME_MASK      ((1LL << PM_PSHIFT_OFFSET) - 1)
+#define PM_PFRAME(x)        ((x) & PM_PFRAME_MASK)
+
+#define PM_PRESENT          PM_STATUS(4LL)
+#define PM_SWAP             PM_STATUS(2LL)
+
+
+/*
+ * kernel page flags
+ */
+
+#define KPF_BYTES               8
+#define PROC_KPAGEFLAGS         "/proc/kpageflags"
+
+/* copied from kpageflags_read() */
+#define KPF_LOCKED              0
+#define KPF_ERROR               1
+#define KPF_REFERENCED          2
+#define KPF_UPTODATE            3
+#define KPF_DIRTY               4
+#define KPF_LRU                 5
+#define KPF_ACTIVE              6
+#define KPF_SLAB                7
+#define KPF_WRITEBACK           8
+#define KPF_RECLAIM             9
+#define KPF_BUDDY               10
+
+/* [11-20] new additions in 2.6.31 */
+#define KPF_MMAP                11
+#define KPF_ANON                12
+#define KPF_SWAPCACHE           13
+#define KPF_SWAPBACKED          14
+#define KPF_COMPOUND_HEAD       15
+#define KPF_COMPOUND_TAIL       16
+#define KPF_HUGE                17
+#define KPF_UNEVICTABLE         18
+#define KPF_HWPOISON            19
+#define KPF_NOPAGE              20
+#define KPF_KSM                 21
+#define KPF_THP                 22
+
+/* [32-] kernel hacking assistances */
+#define KPF_RESERVED            32
+#define KPF_MLOCKED             33
+#define KPF_MAPPEDTODISK        34
+#define KPF_PRIVATE             35
+#define KPF_PRIVATE_2           36
+#define KPF_OWNER_PRIVATE       37
+#define KPF_ARCH                38
+#define KPF_UNCACHED            39
+
+/* [48-] take some arbitrary free slots for expanding overloaded flags
+ * not part of kernel API
+ */
+#define KPF_READAHEAD           48
+#define KPF_SLOB_FREE           49
+#define KPF_SLUB_FROZEN         50
+#define KPF_SLUB_DEBUG          51
+
+#define KPF_ALL_BITS            ((uint64_t)~0ULL)
+#define KPF_HACKERS_BITS        (0xffffULL << 32)
+#define KPF_OVERLOADED_BITS     (0xffffULL << 48)
+#define BIT(name)               (1ULL << KPF_##name)
+#define BITS_COMPOUND           (BIT(COMPOUND_HEAD) | BIT(COMPOUND_TAIL))
+
+static const char * const page_flag_names[] = {
+        [KPF_LOCKED]            = "L:locked",
+        [KPF_ERROR]             = "E:error",
+        [KPF_REFERENCED]        = "R:referenced",
+        [KPF_UPTODATE]          = "U:uptodate",
+        [KPF_DIRTY]             = "D:dirty",
+        [KPF_LRU]               = "l:lru",
+        [KPF_ACTIVE]            = "A:active",
+        [KPF_SLAB]              = "S:slab",
+        [KPF_WRITEBACK]         = "W:writeback",
+        [KPF_RECLAIM]           = "I:reclaim",
+        [KPF_BUDDY]             = "B:buddy",
+
+        [KPF_MMAP]              = "M:mmap",
+        [KPF_ANON]              = "a:anonymous",
+        [KPF_SWAPCACHE]         = "s:swapcache",
+        [KPF_SWAPBACKED]        = "b:swapbacked",
+        [KPF_COMPOUND_HEAD]     = "H:compound_head",
+        [KPF_COMPOUND_TAIL]     = "T:compound_tail",
+        [KPF_HUGE]              = "G:huge",
+        [KPF_UNEVICTABLE]       = "u:unevictable",
+        [KPF_HWPOISON]          = "X:hwpoison",
+        [KPF_NOPAGE]            = "n:nopage",
+        [KPF_KSM]               = "x:ksm",
+        [KPF_THP]               = "t:thp",
+
+        [KPF_RESERVED]          = "r:reserved",
+        [KPF_MLOCKED]           = "m:mlocked",
+        [KPF_MAPPEDTODISK]      = "d:mappedtodisk",
+        [KPF_PRIVATE]           = "P:private",
+        [KPF_PRIVATE_2]         = "p:private_2",
+        [KPF_OWNER_PRIVATE]     = "O:owner_private",
+        [KPF_ARCH]              = "h:arch",
+        [KPF_UNCACHED]          = "c:uncached",
+
+        [KPF_READAHEAD]         = "I:readahead",
+        [KPF_SLOB_FREE]         = "P:slob_free",
+        [KPF_SLUB_FROZEN]       = "A:slub_frozen",
+        [KPF_SLUB_DEBUG]        = "E:slub_debug",
+};
+
+
+static const char * const debugfs_known_mountpoints[] = {
+        "/sys/kernel/debug",
+        "/debug",
+        0,
+};
+
+/*
+ * data structures
+ */
+
+static int              opt_raw;        /* for kernel developers */
+static int              opt_list;       /* list pages (in ranges) */
+static int              opt_no_summary; /* don't show summary */
+static pid_t            opt_pid;        /* process to walk */
+
+#define MAX_ADDR_RANGES 1024
+static int              nr_addr_ranges;
+static unsigned long    opt_offset[MAX_ADDR_RANGES];
+static unsigned long    opt_size[MAX_ADDR_RANGES];
+
+#define MAX_VMAS        10240
+static int              nr_vmas;
+static unsigned long    pg_start[MAX_VMAS];
+static unsigned long    pg_end[MAX_VMAS];
+
+#define MAX_BIT_FILTERS 64
+static int              nr_bit_filters;
+static uint64_t         opt_mask[MAX_BIT_FILTERS];
+static uint64_t         opt_bits[MAX_BIT_FILTERS];
+
+static int              page_size;
+
+static int              pagemap_fd;
+static int              kpageflags_fd;
+
+static int              opt_hwpoison;
+static int              opt_unpoison;
+
+static char             hwpoison_debug_fs[MAX_PATH+1];
+static int              hwpoison_inject_fd;
+static int              hwpoison_forget_fd;
+
+#define HASH_SHIFT      13
+#define HASH_SIZE       (1 << HASH_SHIFT)
+#define HASH_MASK       (HASH_SIZE - 1)
+#define HASH_KEY(flags) (flags & HASH_MASK)
+
+static unsigned long    total_pages;
+static unsigned long    nr_pages[HASH_SIZE];
+static uint64_t         page_flags[HASH_SIZE];
+
+
+/*
+ * helper functions
+ */
+
+#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+
+#define min_t(type, x, y) ({                    \
+        type __min1 = (x);                      \
+        type __min2 = (y);                      \
+        __min1 < __min2 ? __min1 : __min2; })
+
+#define max_t(type, x, y) ({                    \
+        type __max1 = (x);                      \
+        type __max2 = (y);                      \
+        __max1 > __max2 ? __max1 : __max2; })
+
+static unsigned long pages2mb(unsigned long pages)
+{
+        return (pages * page_size) >> 20;
+}
+
+static void fatal(const char *x, ...)
+{
+        va_list ap;
+
+        va_start(ap, x);
+        vfprintf(stderr, x, ap);
+        va_end(ap);
+        exit(EXIT_FAILURE);
+}
+
+static int checked_open(const char *pathname, int flags)
+{
+        int fd = open(pathname, flags);
+
+        if (fd < 0) {
+                perror(pathname);
+                exit(EXIT_FAILURE);
+        }
+
+        return fd;
+}
+
+/*
+ * pagemap/kpageflags routines
+ */
+
+static unsigned long do_u64_read(int fd, char *name,
+                                 uint64_t *buf,
+                                 unsigned long index,
+                                 unsigned long count)
+{
+        long bytes;
+
+        if (index > ULONG_MAX / 8)
+                fatal("index overflow: %lu\n", index);
+
+        if (lseek(fd, index * 8, SEEK_SET) < 0) {
+                perror(name);
+                exit(EXIT_FAILURE);
+        }
+
+        bytes = read(fd, buf, count * 8);
+        if (bytes < 0) {
+                perror(name);
+                exit(EXIT_FAILURE);
+        }
+        if (bytes % 8)
+                fatal("partial read: %lu bytes\n", bytes);
+
+        return bytes / 8;
+}
+
+static unsigned long kpageflags_read(uint64_t *buf,
+                                     unsigned long index,
+                                     unsigned long pages)
+{
+        return do_u64_read(kpageflags_fd, PROC_KPAGEFLAGS, buf, index, pages);
+}
+
+static unsigned long pagemap_read(uint64_t *buf,
+                                  unsigned long index,
+                                  unsigned long pages)
+{
+        return do_u64_read(pagemap_fd, "/proc/pid/pagemap", buf, index, pages);
+}
+
+static unsigned long pagemap_pfn(uint64_t val)
+{
+        unsigned long pfn;
+
+        if (val & PM_PRESENT)
+                pfn = PM_PFRAME(val);
+        else
+                pfn = 0;
+
+        return pfn;
+}
+
+
+/*
+ * page flag names
+ */
+
+static char *page_flag_name(uint64_t flags)
+{
+        static char buf[65];
+        int present;
+        int i, j;
+
+        for (i = 0, j = 0; i < ARRAY_SIZE(page_flag_names); i++) {
+                present = (flags >> i) & 1;
+                if (!page_flag_names[i]) {
+                        if (present)
+                                fatal("unknown flag bit %d\n", i);
+                        continue;
+                }
+                buf[j++] = present ? page_flag_names[i][0] : '_';
+        }
+
+        return buf;
+}
+
+static char *page_flag_longname(uint64_t flags)
+{
+        static char buf[1024];
+        int i, n;
+
+        for (i = 0, n = 0; i < ARRAY_SIZE(page_flag_names); i++) {
+                if (!page_flag_names[i])
+                        continue;
+                if ((flags >> i) & 1)
+                        n += snprintf(buf + n, sizeof(buf) - n, "%s,",
+                                        page_flag_names[i] + 2);
+        }
+        if (n)
+                n--;
+        buf[n] = '\0';
+
+        return buf;
+}
+
+
+/*
+ * page list and summary
+ */
+
+static void show_page_range(unsigned long voffset,
+                            unsigned long offset, uint64_t flags)
+{
+        static uint64_t      flags0;
+        static unsigned long voff;
+        static unsigned long index;
+        static unsigned long count;
+
+        if (flags == flags0 && offset == index + count &&
+            (!opt_pid || voffset == voff + count)) {
+                count++;
+                return;
+        }
+
+        if (count) {
+                if (opt_pid)
+                        printf("%lx\t", voff);
+                printf("%lx\t%lx\t%s\n",
+                                index, count, page_flag_name(flags0));
+        }
+
+        flags0 = flags;
+        index  = offset;
+        voff   = voffset;
+        count  = 1;
+}
+
+static void show_page(unsigned long voffset,
+                      unsigned long offset, uint64_t flags)
+{
+        if (opt_pid)
+                printf("%lx\t", voffset);
+        printf("%lx\t%s\n", offset, page_flag_name(flags));
+}
+
+static void show_summary(void)
+{
+        int i;
+
+        printf("             flags\tpage-count       MB"
+                "  symbolic-flags\t\t\tlong-symbolic-flags\n");
+
+        for (i = 0; i < ARRAY_SIZE(nr_pages); i++) {
+                if (nr_pages[i])
+                        printf("0x%016llx\t%10lu %8lu  %s\t%s\n",
+                                (unsigned long long)page_flags[i],
+                                nr_pages[i],
+                                pages2mb(nr_pages[i]),
+                                page_flag_name(page_flags[i]),
+                                page_flag_longname(page_flags[i]));
+        }
+
+        printf("             total\t%10lu %8lu\n",
+                        total_pages, pages2mb(total_pages));
+}
+
+
+/*
+ * page flag filters
+ */
+
+static int bit_mask_ok(uint64_t flags)
+{
+        int i;
+
+        for (i = 0; i < nr_bit_filters; i++) {
+                if (opt_bits[i] == KPF_ALL_BITS) {
+                        if ((flags & opt_mask[i]) == 0)
+                                return 0;
+                } else {
+                        if ((flags & opt_mask[i]) != opt_bits[i])
+                                return 0;
+                }
+        }
+
+        return 1;
+}
+
+static uint64_t expand_overloaded_flags(uint64_t flags)
+{
+        /* SLOB/SLUB overload several page flags */
+        if (flags & BIT(SLAB)) {
+                if (flags & BIT(PRIVATE))
+                        flags ^= BIT(PRIVATE) | BIT(SLOB_FREE);
+                if (flags & BIT(ACTIVE))
+                        flags ^= BIT(ACTIVE) | BIT(SLUB_FROZEN);
+                if (flags & BIT(ERROR))
+                        flags ^= BIT(ERROR) | BIT(SLUB_DEBUG);
+        }
+
+        /* PG_reclaim is overloaded as PG_readahead in the read path */
+        if ((flags & (BIT(RECLAIM) | BIT(WRITEBACK))) == BIT(RECLAIM))
+                flags ^= BIT(RECLAIM) | BIT(READAHEAD);
+
+        return flags;
+}
+
+static uint64_t well_known_flags(uint64_t flags)
+{
+        /* hide flags intended only for kernel hacker */
+        flags &= ~KPF_HACKERS_BITS;
+
+        /* hide non-hugeTLB compound pages */
+        if ((flags & BITS_COMPOUND) && !(flags & BIT(HUGE)))
+                flags &= ~BITS_COMPOUND;
+
+        return flags;
+}
+
+static uint64_t kpageflags_flags(uint64_t flags)
+{
+        flags = expand_overloaded_flags(flags);
+
+        if (!opt_raw)
+                flags = well_known_flags(flags);
+
+        return flags;
+}
+
+/* verify that a mountpoint is actually a debugfs instance */
+static int debugfs_valid_mountpoint(const char *debugfs)
+{
+        struct statfs st_fs;
+
+        if (statfs(debugfs, &st_fs) < 0)
+                return -ENOENT;
+        else if (st_fs.f_type != (long) DEBUGFS_MAGIC)
+                return -ENOENT;
+
+        return 0;
+}
+
+/* find the path to the mounted debugfs */
+static const char *debugfs_find_mountpoint(void)
+{
+        const char **ptr;
+        char type[100];
+        FILE *fp;
+
+        ptr = debugfs_known_mountpoints;
+        while (*ptr) {
+                if (debugfs_valid_mountpoint(*ptr) == 0) {
+                        strcpy(hwpoison_debug_fs, *ptr);
+                        return hwpoison_debug_fs;
+                }
+                ptr++;
+        }
+
+        /* give up and parse /proc/mounts */
+        fp = fopen("/proc/mounts", "r");
+        if (fp == NULL)
+                perror("Can't open /proc/mounts for read");
+
+        while (fscanf(fp, "%*s %"
+                      STR(MAX_PATH)
+                      "s %99s %*s %*d %*d\n",
+                      hwpoison_debug_fs, type) == 2) {
+                if (strcmp(type, "debugfs") == 0)
+                        break;
+        }
+        fclose(fp);
+
+        if (strcmp(type, "debugfs") != 0)
+                return NULL;
+
+        return hwpoison_debug_fs;
+}
+
+/* mount the debugfs somewhere if it's not mounted */
+
+static void debugfs_mount(void)
+{
+        const char **ptr;
+
+        /* see if it's already mounted */
+        if (debugfs_find_mountpoint())
+                return;
+
+        ptr = debugfs_known_mountpoints;
+        while (*ptr) {
+                if (mount(NULL, *ptr, "debugfs", 0, NULL) == 0) {
+                        /* save the mountpoint */
+                        strcpy(hwpoison_debug_fs, *ptr);
+                        break;
+                }
+                ptr++;
+        }
+
+        if (*ptr == NULL) {
+                perror("mount debugfs");
+                exit(EXIT_FAILURE);
+        }
+}
+
+/*
+ * page actions
+ */
+
+static void prepare_hwpoison_fd(void)
+{
+        char buf[MAX_PATH + 1];
+
+        debugfs_mount();
+
+        if (opt_hwpoison && !hwpoison_inject_fd) {
+                snprintf(buf, MAX_PATH, "%s/hwpoison/corrupt-pfn",
+                        hwpoison_debug_fs);
+                hwpoison_inject_fd = checked_open(buf, O_WRONLY);
+        }
+
+        if (opt_unpoison && !hwpoison_forget_fd) {
+                snprintf(buf, MAX_PATH, "%s/hwpoison/unpoison-pfn",
+                        hwpoison_debug_fs);
+                hwpoison_forget_fd = checked_open(buf, O_WRONLY);
+        }
+}
+
+static int hwpoison_page(unsigned long offset)
+{
+        char buf[100];
+        int len;
+
+        len = sprintf(buf, "0x%lx\n", offset);
+        len = write(hwpoison_inject_fd, buf, len);
+        if (len < 0) {
+                perror("hwpoison inject");
+                return len;
+        }
+        return 0;
+}
+
+static int unpoison_page(unsigned long offset)
+{
+        char buf[100];
+        int len;
+
+        len = sprintf(buf, "0x%lx\n", offset);
+        len = write(hwpoison_forget_fd, buf, len);
+        if (len < 0) {
+                perror("hwpoison forget");
+                return len;
+        }
+        return 0;
+}
+
+/*
+ * page frame walker
+ */
+
+static int hash_slot(uint64_t flags)
+{
+        int k = HASH_KEY(flags);
+        int i;
+
+        /* Explicitly reserve slot 0 for flags 0: the following logic
+         * cannot distinguish an unoccupied slot from slot (flags==0).
+         */
+        if (flags == 0)
+                return 0;
+
+        /* search through the remaining (HASH_SIZE-1) slots */
+        for (i = 1; i < ARRAY_SIZE(page_flags); i++, k++) {
+                if (!k || k >= ARRAY_SIZE(page_flags))
+                        k = 1;
+                if (page_flags[k] == 0) {
+                        page_flags[k] = flags;
+                        return k;
+                }
+                if (page_flags[k] == flags)
+                        return k;
+        }
+
+        fatal("hash table full: bump up HASH_SHIFT?\n");
+        exit(EXIT_FAILURE);
+}
+
+static void add_page(unsigned long voffset,
+                     unsigned long offset, uint64_t flags)
+{
+        flags = kpageflags_flags(flags);
+
+        if (!bit_mask_ok(flags))
+                return;
+
+        if (opt_hwpoison)
+                hwpoison_page(offset);
+        if (opt_unpoison)
+                unpoison_page(offset);
+
+        if (opt_list == 1)
+                show_page_range(voffset, offset, flags);
+        else if (opt_list == 2)
+                show_page(voffset, offset, flags);
+
+        nr_pages[hash_slot(flags)]++;
+        total_pages++;
+}
+
+#define KPAGEFLAGS_BATCH        (64 << 10)      /* 64k pages */
+static void walk_pfn(unsigned long voffset,
+                     unsigned long index,
+                     unsigned long count)
+{
+        uint64_t buf[KPAGEFLAGS_BATCH];
+        unsigned long batch;
+        long pages;
+        unsigned long i;
+
+        while (count) {
+                batch = min_t(unsigned long, count, KPAGEFLAGS_BATCH);
+                pages = kpageflags_read(buf, index, batch);
+                if (pages == 0)
+                        break;
+
+                for (i = 0; i < pages; i++)
+                        add_page(voffset + i, index + i, buf[i]);
+
+                index += pages;
+                count -= pages;
+        }
+}
+
+#define PAGEMAP_BATCH   (64 << 10)
+static void walk_vma(unsigned long index, unsigned long count)
+{
+        uint64_t buf[PAGEMAP_BATCH];
+        unsigned long batch;
+        unsigned long pages;
+        unsigned long pfn;
+        unsigned long i;
+
+        while (count) {
+                batch = min_t(unsigned long, count, PAGEMAP_BATCH);
+                pages = pagemap_read(buf, index, batch);
+                if (pages == 0)
+                        break;
+
+                for (i = 0; i < pages; i++) {
+                        pfn = pagemap_pfn(buf[i]);
+                        if (pfn)
+                                walk_pfn(index + i, pfn, 1);
+                }
+
+                index += pages;
+                count -= pages;
+        }
+}
+
+static void walk_task(unsigned long index, unsigned long count)
+{
+        const unsigned long end = index + count;
+        unsigned long start;
+        int i = 0;
+
+        while (index < end) {
+
+                while (pg_end[i] <= index)
+                        if (++i >= nr_vmas)
+                                return;
+                if (pg_start[i] >= end)
+                        return;
+
+                start = max_t(unsigned long, pg_start[i], index);
+                index = min_t(unsigned long, pg_end[i], end);
+
+                assert(start < index);
+                walk_vma(start, index - start);
+        }
+}
+
+static void add_addr_range(unsigned long offset, unsigned long size)
+{
+        if (nr_addr_ranges >= MAX_ADDR_RANGES)
+                fatal("too many addr ranges\n");
+
+        opt_offset[nr_addr_ranges] = offset;
+        opt_size[nr_addr_ranges] = min_t(unsigned long, size, ULONG_MAX-offset);
+        nr_addr_ranges++;
+}
+
+static void walk_addr_ranges(void)
+{
+        int i;
+
+        kpageflags_fd = checked_open(PROC_KPAGEFLAGS, O_RDONLY);
+
+        if (!nr_addr_ranges)
+                add_addr_range(0, ULONG_MAX);
+
+        for (i = 0; i < nr_addr_ranges; i++)
+                if (!opt_pid)
+                        walk_pfn(0, opt_offset[i], opt_size[i]);
+                else
+                        walk_task(opt_offset[i], opt_size[i]);
+
+        close(kpageflags_fd);
+}
+
+
+/*
+ * user interface
+ */
+
+static const char *page_flag_type(uint64_t flag)
+{
+        if (flag & KPF_HACKERS_BITS)
+                return "(r)";
+        if (flag & KPF_OVERLOADED_BITS)
+                return "(o)";
+        return "   ";
+}
+
+static void usage(void)
+{
+        int i, j;
+
+        printf(
+"page-types [options]\n"
+"            -r|--raw                   Raw mode, for kernel developers\n"
+"            -d|--describe flags        Describe flags\n"
+"            -a|--addr    addr-spec     Walk a range of pages\n"
+"            -b|--bits    bits-spec     Walk pages with specified bits\n"
+"            -p|--pid     pid           Walk process address space\n"
+#if 0 /* planned features */
+"            -f|--file    filename      Walk file address space\n"
+#endif
+"            -l|--list                  Show page details in ranges\n"
+"            -L|--list-each             Show page details one by one\n"
+"            -N|--no-summary            Don't show summary info\n"
+"            -X|--hwpoison              hwpoison pages\n"
+"            -x|--unpoison              unpoison pages\n"
+"            -h|--help                  Show this usage message\n"
+"flags:\n"
+"            0x10                       bitfield format, e.g.\n"
+"            anon                       bit-name, e.g.\n"
+"            0x10,anon                  comma-separated list, e.g.\n"
+"addr-spec:\n"
+"            N                          one page at offset N (unit: pages)\n"
+"            N+M                        pages range from N to N+M-1\n"
+"            N,M                        pages range from N to M-1\n"
+"            N,                         pages range from N to end\n"
+"            ,M                         pages range from 0 to M-1\n"
+"bits-spec:\n"
+"            bit1,bit2                  (flags & (bit1|bit2)) != 0\n"
+"            bit1,bit2=bit1             (flags & (bit1|bit2)) == bit1\n"
+"            bit1,~bit2                 (flags & (bit1|bit2)) == bit1\n"
+"            =bit1,bit2                 flags == (bit1|bit2)\n"
+"bit-names:\n"
+        );
+
+        for (i = 0, j = 0; i < ARRAY_SIZE(page_flag_names); i++) {
+                if (!page_flag_names[i])
+                        continue;
+                printf("%16s%s", page_flag_names[i] + 2,
+                                 page_flag_type(1ULL << i));
+                if (++j > 3) {
+                        j = 0;
+                        putchar('\n');
+                }
+        }
+        printf("\n                                   "
+                "(r) raw mode bits  (o) overloaded bits\n");
+}
+
+static unsigned long long parse_number(const char *str)
+{
+        unsigned long long n;
+
+        n = strtoll(str, NULL, 0);
+
+        if (n == 0 && str[0] != '0')
+                fatal("invalid name or number: %s\n", str);
+
+        return n;
+}
+
+static void parse_pid(const char *str)
+{
+        FILE *file;
+        char buf[5000];
+
+        opt_pid = parse_number(str);
+
+        sprintf(buf, "/proc/%d/pagemap", opt_pid);
+        pagemap_fd = checked_open(buf, O_RDONLY);
+
+        sprintf(buf, "/proc/%d/maps", opt_pid);
+        file = fopen(buf, "r");
+        if (!file) {
+                perror(buf);
+                exit(EXIT_FAILURE);
+        }
+
+        while (fgets(buf, sizeof(buf), file) != NULL) {
+                unsigned long vm_start;
+                unsigned long vm_end;
+                unsigned long long pgoff;
+                int major, minor;
+                char r, w, x, s;
+                unsigned long ino;
+                int n;
+
+                n = sscanf(buf, "%lx-%lx %c%c%c%c %llx %x:%x %lu",
+                           &vm_start,
+                           &vm_end,
+                           &r, &w, &x, &s,
+                           &pgoff,
+                           &major, &minor,
+                           &ino);
+                if (n < 10) {
+                        fprintf(stderr, "unexpected line: %s\n", buf);
+                        continue;
+                }
+                pg_start[nr_vmas] = vm_start / page_size;
+                pg_end[nr_vmas] = vm_end / page_size;
+                if (++nr_vmas >= MAX_VMAS) {
+                        fprintf(stderr, "too many VMAs\n");
+                        break;
+                }
+        }
+        fclose(file);
+}
+
+static void parse_file(const char *name)
+{
+}
+
+static void parse_addr_range(const char *optarg)
+{
+        unsigned long offset;
+        unsigned long size;
+        char *p;
+
+        p = strchr(optarg, ',');
+        if (!p)
+                p = strchr(optarg, '+');
+
+        if (p == optarg) {
+                offset = 0;
+                size   = parse_number(p + 1);
+        } else if (p) {
+                offset = parse_number(optarg);
+                if (p[1] == '\0')
+                        size = ULONG_MAX;
+                else {
+                        size = parse_number(p + 1);
+                        if (*p == ',') {
+                                if (size < offset)
+                                        fatal("invalid range: %lu,%lu\n",
+                                                        offset, size);
+                                size -= offset;
+                        }
+                }
+        } else {
+                offset = parse_number(optarg);
+                size   = 1;
+        }
+
+        add_addr_range(offset, size);
+}
+
+static void add_bits_filter(uint64_t mask, uint64_t bits)
+{
+        if (nr_bit_filters >= MAX_BIT_FILTERS)
+                fatal("too much bit filters\n");
+
+        opt_mask[nr_bit_filters] = mask;
+        opt_bits[nr_bit_filters] = bits;
+        nr_bit_filters++;
+}
+
+static uint64_t parse_flag_name(const char *str, int len)
+{
+        int i;
+
+        if (!*str || !len)
+                return 0;
+
+        if (len <= 8 && !strncmp(str, "compound", len))
+                return BITS_COMPOUND;
+
+        for (i = 0; i < ARRAY_SIZE(page_flag_names); i++) {
+                if (!page_flag_names[i])
+                        continue;
+                if (!strncmp(str, page_flag_names[i] + 2, len))
+                        return 1ULL << i;
+        }
+
+        return parse_number(str);
+}
+
+static uint64_t parse_flag_names(const char *str, int all)
+{
+        const char *p    = str;
+        uint64_t   flags = 0;
+
+        while (1) {
+                if (*p == ',' || *p == '=' || *p == '\0') {
+                        if ((*str != '~') || (*str == '~' && all && *++str))
+                                flags |= parse_flag_name(str, p - str);
+                        if (*p != ',')
+                                break;
+                        str = p + 1;
+                }
+                p++;
+        }
+
+        return flags;
+}
+
+static void parse_bits_mask(const char *optarg)
+{
+        uint64_t mask;
+        uint64_t bits;
+        const char *p;
+
+        p = strchr(optarg, '=');
+        if (p == optarg) {
+                mask = KPF_ALL_BITS;
+                bits = parse_flag_names(p + 1, 0);
+        } else if (p) {
+                mask = parse_flag_names(optarg, 0);
+                bits = parse_flag_names(p + 1, 0);
+        } else if (strchr(optarg, '~')) {
+                mask = parse_flag_names(optarg, 1);
+                bits = parse_flag_names(optarg, 0);
+        } else {
+                mask = parse_flag_names(optarg, 0);
+                bits = KPF_ALL_BITS;
+        }
+
+        add_bits_filter(mask, bits);
+}
+
+static void describe_flags(const char *optarg)
+{
+        uint64_t flags = parse_flag_names(optarg, 0);
+
+        printf("0x%016llx\t%s\t%s\n",
+                (unsigned long long)flags,
+                page_flag_name(flags),
+                page_flag_longname(flags));
+}
+
+static const struct option opts[] = {
+        { "raw"       , 0, NULL, 'r' },
+        { "pid"       , 1, NULL, 'p' },
+        { "file"      , 1, NULL, 'f' },
+        { "addr"      , 1, NULL, 'a' },
+        { "bits"      , 1, NULL, 'b' },
+        { "describe"  , 1, NULL, 'd' },
+        { "list"      , 0, NULL, 'l' },
+        { "list-each" , 0, NULL, 'L' },
+        { "no-summary", 0, NULL, 'N' },
+        { "hwpoison"  , 0, NULL, 'X' },
+        { "unpoison"  , 0, NULL, 'x' },
+        { "help"      , 0, NULL, 'h' },
+        { NULL        , 0, NULL, 0 }
+};
+
+int main(int argc, char *argv[])
+{
+        int c;
+
+        page_size = getpagesize();
+
+        while ((c = getopt_long(argc, argv,
+                                "rp:f:a:b:d:lLNXxh", opts, NULL)) != -1) {
+                switch (c) {
+                case 'r':
+                        opt_raw = 1;
+                        break;
+                case 'p':
+                        parse_pid(optarg);
+                        break;
+                case 'f':
+                        parse_file(optarg);
+                        break;
+                case 'a':
+                        parse_addr_range(optarg);
+                        break;
+                case 'b':
+                        parse_bits_mask(optarg);
+                        break;
+                case 'd':
+                        describe_flags(optarg);
+                        exit(0);
+                case 'l':
+                        opt_list = 1;
+                        break;
+                case 'L':
+                        opt_list = 2;
+                        break;
+                case 'N':
+                        opt_no_summary = 1;
+                        break;
+                case 'X':
+                        opt_hwpoison = 1;
+                        prepare_hwpoison_fd();
+                        break;
+                case 'x':
+                        opt_unpoison = 1;
+                        prepare_hwpoison_fd();
+                        break;
+                case 'h':
+                        usage();
+                        exit(0);
+                default:
+                        usage();
+                        exit(1);
+                }
+        }
+
+        if (opt_list && opt_pid)
+                printf("voffset\t");
+        if (opt_list == 1)
+                printf("offset\tlen\tflags\n");
+        if (opt_list == 2)
+                printf("offset\tflags\n");
+
+        walk_addr_ranges();
+
+        if (opt_list == 1)
+                show_page_range(0, 0, 0);  /* drain the buffer */
+
+        if (opt_no_summary)
+                return 0;
+
+        if (opt_list)
+                printf("\n\n");
+
+        show_summary();
+
+        return 0;
+}
diff --git a/tools/slub/slabinfo.c b/tools/vm/slabinfo.c
index 164cbcf61106..164cbcf61106 100644
--- a/tools/slub/slabinfo.c
+++ b/tools/vm/slabinfo.c