Merge git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc-merge

131 files changed, 19574 insertions, 3538 deletions

diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 331483ace0d9..28004f002ec9 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -47,7 +47,7 @@ config PPC
 
 config EARLY_PRINTK
         bool
-        default y if PPC64
+        default y
 
 config COMPAT
         bool
@@ -297,6 +297,7 @@ config PPC_PMAC64
         bool
         depends on PPC_PMAC && POWER4
         select U3_DART
+        select MPIC_BROKEN_U3
         select GENERIC_TBSYNC
         default y
 
@@ -325,9 +326,7 @@ config PPC_CELL
         select MMIO_NVRAM
 
 config PPC_OF
-        bool
-        depends on PPC_MULTIPLATFORM    # for now
-        default y
+        def_bool y
 
 config XICS
         depends on PPC_PSERIES
@@ -376,11 +375,28 @@ config CELL_IIC
         bool
         default y
 
+config CRASH_DUMP
+        bool "kernel crash dumps (EXPERIMENTAL)"
+        depends on PPC_MULTIPLATFORM
+        depends on EXPERIMENTAL
+        help
+          Build a kernel suitable for use as a kdump capture kernel.
+          The kernel will be linked at a different address than normal, and
+          so can only be used for Kdump.
+
+          Don't change this unless you know what you are doing.
+
 config IBMVIO
         depends on PPC_PSERIES || PPC_ISERIES
         bool
         default y
 
+config IBMEBUS
+        depends on PPC_PSERIES
+        bool "Support for GX bus based adapters"
+        help
+          Bus device driver for GX bus based adapters.
+
 config PPC_MPC106
         bool
         default n
@@ -472,6 +488,7 @@ source arch/powerpc/platforms/embedded6xx/Kconfig
 source arch/powerpc/platforms/4xx/Kconfig
 source arch/powerpc/platforms/85xx/Kconfig
 source arch/powerpc/platforms/8xx/Kconfig
+source arch/powerpc/platforms/cell/Kconfig
 
 menu "Kernel options"
 
@@ -575,11 +592,12 @@ config ARCH_SELECT_MEMORY_MODEL
         depends on PPC64
 
 config ARCH_FLATMEM_ENABLE
-       def_bool y
-       depends on PPC64 && !NUMA
+        def_bool y
+        depends on (PPC64 && !NUMA) || PPC32
 
 config ARCH_SPARSEMEM_ENABLE
         def_bool y
+        depends on PPC64
 
 config ARCH_SPARSEMEM_DEFAULT
         def_bool y
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index a13eb575f834..5f80e58e5cb3 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -151,7 +151,7 @@ CPPFLAGS_vmlinux.lds	:= -Upowerpc
 # All the instructions talk about "make bzImage".
 bzImage: zImage
 
-BOOT_TARGETS = zImage zImage.initrd znetboot znetboot.initrd vmlinux.sm
+BOOT_TARGETS = zImage zImage.initrd znetboot znetboot.initrd vmlinux.sm uImage
 
 .PHONY: $(BOOT_TARGETS)
 
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index 9770f587af73..22726aefc8ea 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -143,6 +143,36 @@ $(obj)/zImage.initrd: $(obj)/zImage.initrd.vmode $(obj)/addnote
         @cp -f $< $@
         $(call if_changed,addnote)
 
+#-----------------------------------------------------------
+# build u-boot images
+#-----------------------------------------------------------
+quiet_cmd_mygzip = GZIP $@
+cmd_mygzip = gzip -f -9 < $< > $@.$$$$ && mv $@.$$$$ $@
+
+quiet_cmd_objbin = OBJCOPY $@
+      cmd_objbin = $(OBJCOPY) -O binary $< $@
+
+quiet_cmd_uimage = UIMAGE $@
+      cmd_uimage = $(CONFIG_SHELL) $(MKIMAGE) -A ppc -O linux -T kernel \
+               -C gzip -a 00000000 -e 00000000 -n 'Linux-$(KERNELRELEASE)' \
+               -d $< $@
+
+MKIMAGE         := $(srctree)/scripts/mkuboot.sh
+targets         += uImage
+extra-y         += vmlinux.bin vmlinux.gz
+
+$(obj)/vmlinux.bin: vmlinux FORCE
+        $(call if_changed,objbin)
+
+$(obj)/vmlinux.gz: $(obj)/vmlinux.bin FORCE
+        $(call if_changed,mygzip)
+
+$(obj)/uImage: $(obj)/vmlinux.gz
+        $(Q)rm -f $@
+        $(call cmd,uimage)
+        @echo -n '  Image: $@ '
+        @if [ -f $@ ]; then echo 'is ready' ; else echo 'not made'; fi
+
 install: $(CONFIGURE) $(BOOTIMAGE)
         sh -x $(srctree)/$(src)/install.sh "$(KERNELRELEASE)" vmlinux System.map "$(INSTALL_PATH)" "$(BOOTIMAGE)"
 
diff --git a/arch/powerpc/configs/pmac32_defconfig b/arch/powerpc/configs/pmac32_defconfig
new file mode 100644
index 000000000000..398203bd98eb
--- /dev/null
+++ b/arch/powerpc/configs/pmac32_defconfig
@@ -0,0 +1,1729 @@
+#
+# Automatically generated make config: don't edit
+# Linux kernel version: 2.6.15-rc5
+# Tue Dec 13 17:24:05 2005
+#
+# CONFIG_PPC64 is not set
+CONFIG_PPC32=y
+CONFIG_PPC_MERGE=y
+CONFIG_MMU=y
+CONFIG_GENERIC_HARDIRQS=y
+CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_PPC=y
+CONFIG_EARLY_PRINTK=y
+CONFIG_GENERIC_NVRAM=y
+CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+
+#
+# Processor support
+#
+CONFIG_6xx=y
+# CONFIG_PPC_52xx is not set
+# CONFIG_PPC_82xx is not set
+# CONFIG_PPC_83xx is not set
+# CONFIG_40x is not set
+# CONFIG_44x is not set
+# CONFIG_8xx is not set
+# CONFIG_E200 is not set
+# CONFIG_E500 is not set
+CONFIG_PPC_FPU=y
+CONFIG_ALTIVEC=y
+CONFIG_PPC_STD_MMU=y
+CONFIG_PPC_STD_MMU_32=y
+# CONFIG_SMP is not set
+
+#
+# Code maturity level options
+#
+CONFIG_EXPERIMENTAL=y
+CONFIG_CLEAN_COMPILE=y
+CONFIG_BROKEN_ON_SMP=y
+CONFIG_INIT_ENV_ARG_LIMIT=32
+
+#
+# General setup
+#
+CONFIG_LOCALVERSION=""
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SWAP=y
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+# CONFIG_BSD_PROCESS_ACCT is not set
+CONFIG_SYSCTL=y
+# CONFIG_AUDIT is not set
+CONFIG_HOTPLUG=y
+CONFIG_KOBJECT_UEVENT=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_INITRAMFS_SOURCE=""
+# CONFIG_EMBEDDED is not set
+CONFIG_KALLSYMS=y
+# CONFIG_KALLSYMS_ALL is not set
+# CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_PRINTK=y
+CONFIG_BUG=y
+CONFIG_BASE_FULL=y
+CONFIG_FUTEX=y
+CONFIG_EPOLL=y
+CONFIG_SHMEM=y
+CONFIG_CC_ALIGN_FUNCTIONS=0
+CONFIG_CC_ALIGN_LABELS=0
+CONFIG_CC_ALIGN_LOOPS=0
+CONFIG_CC_ALIGN_JUMPS=0
+# CONFIG_TINY_SHMEM is not set
+CONFIG_BASE_SMALL=0
+
+#
+# Loadable module support
+#
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+CONFIG_OBSOLETE_MODPARM=y
+# CONFIG_MODVERSIONS is not set
+# CONFIG_MODULE_SRCVERSION_ALL is not set
+CONFIG_KMOD=y
+
+#
+# Block layer
+#
+CONFIG_LBD=y
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+CONFIG_DEFAULT_AS=y
+# CONFIG_DEFAULT_DEADLINE is not set
+# CONFIG_DEFAULT_CFQ is not set
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="anticipatory"
+
+#
+# Platform support
+#
+CONFIG_PPC_MULTIPLATFORM=y
+# CONFIG_PPC_ISERIES is not set
+# CONFIG_EMBEDDED6xx is not set
+# CONFIG_APUS is not set
+# CONFIG_PPC_CHRP is not set
+CONFIG_PPC_PMAC=y
+CONFIG_PPC_OF=y
+CONFIG_MPIC=y
+# CONFIG_PPC_RTAS is not set
+# CONFIG_MMIO_NVRAM is not set
+# CONFIG_CRASH_DUMP is not set
+CONFIG_PPC_MPC106=y
+# CONFIG_GENERIC_TBSYNC is not set
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_TABLE=y
+# CONFIG_CPU_FREQ_DEBUG is not set
+CONFIG_CPU_FREQ_STAT=y
+# CONFIG_CPU_FREQ_STAT_DETAILS is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+# CONFIG_CPU_FREQ_GOV_ONDEMAND is not set
+# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
+CONFIG_CPU_FREQ_PMAC=y
+CONFIG_PPC601_SYNC_FIX=y
+# CONFIG_TAU is not set
+# CONFIG_WANT_EARLY_SERIAL is not set
+
+#
+# Kernel options
+#
+# CONFIG_HIGHMEM is not set
+# CONFIG_HZ_100 is not set
+CONFIG_HZ_250=y
+# CONFIG_HZ_1000 is not set
+CONFIG_HZ=250
+CONFIG_PREEMPT_NONE=y
+# CONFIG_PREEMPT_VOLUNTARY is not set
+# CONFIG_PREEMPT is not set
+CONFIG_BINFMT_ELF=y
+CONFIG_BINFMT_MISC=m
+# CONFIG_KEXEC is not set
+CONFIG_ARCH_FLATMEM_ENABLE=y
+CONFIG_SELECT_MEMORY_MODEL=y
+CONFIG_FLATMEM_MANUAL=y
+# CONFIG_DISCONTIGMEM_MANUAL is not set
+# CONFIG_SPARSEMEM_MANUAL is not set
+CONFIG_FLATMEM=y
+CONFIG_FLAT_NODE_MEM_MAP=y
+# CONFIG_SPARSEMEM_STATIC is not set
+CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_PROC_DEVICETREE=y
+# CONFIG_CMDLINE_BOOL is not set
+CONFIG_PM=y
+# CONFIG_PM_LEGACY is not set
+CONFIG_PM_DEBUG=y
+CONFIG_SOFTWARE_SUSPEND=y
+CONFIG_PM_STD_PARTITION=""
+CONFIG_SECCOMP=y
+CONFIG_ISA_DMA_API=y
+
+#
+# Bus options
+#
+CONFIG_GENERIC_ISA_DMA=y
+# CONFIG_PPC_I8259 is not set
+CONFIG_PPC_INDIRECT_PCI=y
+CONFIG_PCI=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_LEGACY_PROC=y
+# CONFIG_PCI_DEBUG is not set
+
+#
+# PCCARD (PCMCIA/CardBus) support
+#
+CONFIG_PCCARD=m
+# CONFIG_PCMCIA_DEBUG is not set
+CONFIG_PCMCIA=m
+CONFIG_PCMCIA_LOAD_CIS=y
+CONFIG_PCMCIA_IOCTL=y
+CONFIG_CARDBUS=y
+
+#
+# PC-card bridges
+#
+CONFIG_YENTA=m
+# CONFIG_PD6729 is not set
+# CONFIG_I82092 is not set
+CONFIG_PCCARD_NONSTATIC=m
+
+#
+# PCI Hotplug Support
+#
+# CONFIG_HOTPLUG_PCI is not set
+
+#
+# Advanced setup
+#
+# CONFIG_ADVANCED_OPTIONS is not set
+
+#
+# Default settings for advanced configuration options are used
+#
+CONFIG_HIGHMEM_START=0xfe000000
+CONFIG_LOWMEM_SIZE=0x30000000
+CONFIG_KERNEL_START=0xc0000000
+CONFIG_TASK_SIZE=0x80000000
+CONFIG_BOOT_LOAD=0x00800000
+
+#
+# Networking
+#
+CONFIG_NET=y
+
+#
+# Networking options
+#
+CONFIG_PACKET=y
+# CONFIG_PACKET_MMAP is not set
+CONFIG_UNIX=y
+# CONFIG_NET_KEY is not set
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+# CONFIG_IP_ADVANCED_ROUTER is not set
+CONFIG_IP_FIB_HASH=y
+# CONFIG_IP_PNP is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE is not set
+# CONFIG_IP_MROUTE is not set
+# CONFIG_ARPD is not set
+CONFIG_SYN_COOKIES=y
+# CONFIG_INET_AH is not set
+# CONFIG_INET_ESP is not set
+# CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_TUNNEL is not set
+CONFIG_INET_DIAG=y
+CONFIG_INET_TCP_DIAG=y
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_BIC=y
+
+#
+# IP: Virtual Server Configuration
+#
+# CONFIG_IP_VS is not set
+# CONFIG_IPV6 is not set
+CONFIG_NETFILTER=y
+# CONFIG_NETFILTER_DEBUG is not set
+
+#
+# Core Netfilter Configuration
+#
+# CONFIG_NETFILTER_NETLINK is not set
+
+#
+# IP: Netfilter Configuration
+#
+CONFIG_IP_NF_CONNTRACK=m
+# CONFIG_IP_NF_CT_ACCT is not set
+# CONFIG_IP_NF_CONNTRACK_MARK is not set
+# CONFIG_IP_NF_CONNTRACK_EVENTS is not set
+# CONFIG_IP_NF_CT_PROTO_SCTP is not set
+CONFIG_IP_NF_FTP=m
+CONFIG_IP_NF_IRC=m
+CONFIG_IP_NF_NETBIOS_NS=m
+CONFIG_IP_NF_TFTP=m
+CONFIG_IP_NF_AMANDA=m
+CONFIG_IP_NF_PPTP=m
+# CONFIG_IP_NF_QUEUE is not set
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MATCH_LIMIT=m
+CONFIG_IP_NF_MATCH_IPRANGE=m
+CONFIG_IP_NF_MATCH_MAC=m
+CONFIG_IP_NF_MATCH_PKTTYPE=m
+CONFIG_IP_NF_MATCH_MARK=m
+CONFIG_IP_NF_MATCH_MULTIPORT=m
+CONFIG_IP_NF_MATCH_TOS=m
+CONFIG_IP_NF_MATCH_RECENT=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_DSCP=m
+CONFIG_IP_NF_MATCH_AH_ESP=m
+CONFIG_IP_NF_MATCH_LENGTH=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_MATCH_TCPMSS=m
+CONFIG_IP_NF_MATCH_HELPER=m
+CONFIG_IP_NF_MATCH_STATE=m
+CONFIG_IP_NF_MATCH_CONNTRACK=m
+CONFIG_IP_NF_MATCH_OWNER=m
+# CONFIG_IP_NF_MATCH_ADDRTYPE is not set
+# CONFIG_IP_NF_MATCH_REALM is not set
+# CONFIG_IP_NF_MATCH_SCTP is not set
+CONFIG_IP_NF_MATCH_DCCP=m
+# CONFIG_IP_NF_MATCH_COMMENT is not set
+# CONFIG_IP_NF_MATCH_HASHLIMIT is not set
+CONFIG_IP_NF_MATCH_STRING=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+# CONFIG_IP_NF_TARGET_LOG is not set
+CONFIG_IP_NF_TARGET_ULOG=m
+CONFIG_IP_NF_TARGET_TCPMSS=m
+# CONFIG_IP_NF_TARGET_NFQUEUE is not set
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_NAT_NEEDED=y
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_SAME=m
+CONFIG_IP_NF_NAT_SNMP_BASIC=m
+CONFIG_IP_NF_NAT_IRC=m
+CONFIG_IP_NF_NAT_FTP=m
+CONFIG_IP_NF_NAT_TFTP=m
+CONFIG_IP_NF_NAT_AMANDA=m
+CONFIG_IP_NF_NAT_PPTP=m
+# CONFIG_IP_NF_MANGLE is not set
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_TARGET_NOTRACK=m
+CONFIG_IP_NF_ARPTABLES=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+
+#
+# DCCP Configuration (EXPERIMENTAL)
+#
+CONFIG_IP_DCCP=m
+CONFIG_INET_DCCP_DIAG=m
+
+#
+# DCCP CCIDs Configuration (EXPERIMENTAL)
+#
+CONFIG_IP_DCCP_CCID3=m
+CONFIG_IP_DCCP_TFRC_LIB=m
+
+#
+# DCCP Kernel Hacking
+#
+# CONFIG_IP_DCCP_DEBUG is not set
+# CONFIG_IP_DCCP_UNLOAD_HACK is not set
+
+#
+# SCTP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_SCTP is not set
+# CONFIG_ATM is not set
+# CONFIG_BRIDGE is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_NET_DIVERT is not set
+# CONFIG_ECONET is not set
+# CONFIG_WAN_ROUTER is not set
+
+#
+# QoS and/or fair queueing
+#
+# CONFIG_NET_SCHED is not set
+
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_HAMRADIO is not set
+CONFIG_IRDA=m
+
+#
+# IrDA protocols
+#
+CONFIG_IRLAN=m
+CONFIG_IRNET=m
+CONFIG_IRCOMM=m
+# CONFIG_IRDA_ULTRA is not set
+
+#
+# IrDA options
+#
+CONFIG_IRDA_CACHE_LAST_LSAP=y
+CONFIG_IRDA_FAST_RR=y
+# CONFIG_IRDA_DEBUG is not set
+
+#
+# Infrared-port device drivers
+#
+
+#
+# SIR device drivers
+#
+CONFIG_IRTTY_SIR=m
+
+#
+# Dongle support
+#
+# CONFIG_DONGLE is not set
+
+#
+# Old SIR device drivers
+#
+# CONFIG_IRPORT_SIR is not set
+
+#
+# Old Serial dongle support
+#
+
+#
+# FIR device drivers
+#
+# CONFIG_USB_IRDA is not set
+# CONFIG_SIGMATEL_FIR is not set
+# CONFIG_NSC_FIR is not set
+# CONFIG_WINBOND_FIR is not set
+# CONFIG_TOSHIBA_FIR is not set
+# CONFIG_SMC_IRCC_FIR is not set
+# CONFIG_ALI_FIR is not set
+# CONFIG_VLSI_FIR is not set
+# CONFIG_VIA_FIR is not set
+CONFIG_BT=m
+CONFIG_BT_L2CAP=m
+CONFIG_BT_SCO=m
+CONFIG_BT_RFCOMM=m
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_BNEP=m
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+CONFIG_BT_HIDP=m
+
+#
+# Bluetooth device drivers
+#
+CONFIG_BT_HCIUSB=m
+# CONFIG_BT_HCIUSB_SCO is not set
+# CONFIG_BT_HCIUART is not set
+CONFIG_BT_HCIBCM203X=m
+# CONFIG_BT_HCIBPA10X is not set
+CONFIG_BT_HCIBFUSB=m
+# CONFIG_BT_HCIDTL1 is not set
+# CONFIG_BT_HCIBT3C is not set
+# CONFIG_BT_HCIBLUECARD is not set
+# CONFIG_BT_HCIBTUART is not set
+# CONFIG_BT_HCIVHCI is not set
+CONFIG_IEEE80211=m
+# CONFIG_IEEE80211_DEBUG is not set
+CONFIG_IEEE80211_CRYPT_WEP=m
+CONFIG_IEEE80211_CRYPT_CCMP=m
+CONFIG_IEEE80211_CRYPT_TKIP=m
+
+#
+# Device Drivers
+#
+
+#
+# Generic Driver Options
+#
+# CONFIG_STANDALONE is not set
+CONFIG_PREVENT_FIRMWARE_BUILD=y
+CONFIG_FW_LOADER=m
+# CONFIG_DEBUG_DRIVER is not set
+
+#
+# Connector - unified userspace <-> kernelspace linker
+#
+CONFIG_CONNECTOR=y
+CONFIG_PROC_EVENTS=y
+
+#
+# Memory Technology Devices (MTD)
+#
+# CONFIG_MTD is not set
+
+#
+# Parallel port support
+#
+# CONFIG_PARPORT is not set
+
+#
+# Plug and Play support
+#
+
+#
+# Block devices
+#
+# CONFIG_BLK_DEV_FD is not set
+CONFIG_MAC_FLOPPY=y
+# CONFIG_BLK_CPQ_DA is not set
+# CONFIG_BLK_CPQ_CISS_DA is not set
+# CONFIG_BLK_DEV_DAC960 is not set
+# CONFIG_BLK_DEV_UMEM is not set
+# CONFIG_BLK_DEV_COW_COMMON is not set
+CONFIG_BLK_DEV_LOOP=y
+# CONFIG_BLK_DEV_CRYPTOLOOP is not set
+# CONFIG_BLK_DEV_NBD is not set
+# CONFIG_BLK_DEV_SX8 is not set
+CONFIG_BLK_DEV_UB=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_INITRD=y
+# CONFIG_CDROM_PKTCDVD is not set
+# CONFIG_ATA_OVER_ETH is not set
+
+#
+# ATA/ATAPI/MFM/RLL support
+#
+CONFIG_IDE=y
+CONFIG_BLK_DEV_IDE=y
+
+#
+# Please see Documentation/ide.txt for help/info on IDE drives
+#
+# CONFIG_BLK_DEV_IDE_SATA is not set
+CONFIG_BLK_DEV_IDEDISK=y
+# CONFIG_IDEDISK_MULTI_MODE is not set
+CONFIG_BLK_DEV_IDECS=m
+CONFIG_BLK_DEV_IDECD=y
+# CONFIG_BLK_DEV_IDETAPE is not set
+CONFIG_BLK_DEV_IDEFLOPPY=y
+CONFIG_BLK_DEV_IDESCSI=y
+# CONFIG_IDE_TASK_IOCTL is not set
+
+#
+# IDE chipset support/bugfixes
+#
+# CONFIG_IDE_GENERIC is not set
+CONFIG_BLK_DEV_IDEPCI=y
+CONFIG_IDEPCI_SHARE_IRQ=y
+# CONFIG_BLK_DEV_OFFBOARD is not set
+CONFIG_BLK_DEV_GENERIC=y
+# CONFIG_BLK_DEV_OPTI621 is not set
+CONFIG_BLK_DEV_SL82C105=y
+CONFIG_BLK_DEV_IDEDMA_PCI=y
+# CONFIG_BLK_DEV_IDEDMA_FORCED is not set
+CONFIG_IDEDMA_PCI_AUTO=y
+# CONFIG_IDEDMA_ONLYDISK is not set
+# CONFIG_BLK_DEV_AEC62XX is not set
+# CONFIG_BLK_DEV_ALI15X3 is not set
+# CONFIG_BLK_DEV_AMD74XX is not set
+# CONFIG_BLK_DEV_CMD64X is not set
+# CONFIG_BLK_DEV_TRIFLEX is not set
+# CONFIG_BLK_DEV_CY82C693 is not set
+# CONFIG_BLK_DEV_CS5520 is not set
+# CONFIG_BLK_DEV_CS5530 is not set
+# CONFIG_BLK_DEV_HPT34X is not set
+# CONFIG_BLK_DEV_HPT366 is not set
+# CONFIG_BLK_DEV_SC1200 is not set
+# CONFIG_BLK_DEV_PIIX is not set
+# CONFIG_BLK_DEV_IT821X is not set
+# CONFIG_BLK_DEV_NS87415 is not set
+# CONFIG_BLK_DEV_PDC202XX_OLD is not set
+CONFIG_BLK_DEV_PDC202XX_NEW=y
+# CONFIG_PDC202XX_FORCE is not set
+# CONFIG_BLK_DEV_SVWKS is not set
+# CONFIG_BLK_DEV_SIIMAGE is not set
+# CONFIG_BLK_DEV_SLC90E66 is not set
+# CONFIG_BLK_DEV_TRM290 is not set
+# CONFIG_BLK_DEV_VIA82CXXX is not set
+CONFIG_BLK_DEV_IDE_PMAC=y
+CONFIG_BLK_DEV_IDE_PMAC_ATA100FIRST=y
+CONFIG_BLK_DEV_IDEDMA_PMAC=y
+CONFIG_BLK_DEV_IDE_PMAC_BLINK=y
+# CONFIG_IDE_ARM is not set
+CONFIG_BLK_DEV_IDEDMA=y
+# CONFIG_IDEDMA_IVB is not set
+CONFIG_IDEDMA_AUTO=y
+# CONFIG_BLK_DEV_HD is not set
+
+#
+# SCSI device support
+#
+# CONFIG_RAID_ATTRS is not set
+CONFIG_SCSI=y
+CONFIG_SCSI_PROC_FS=y
+
+#
+# SCSI support type (disk, tape, CD-ROM)
+#
+CONFIG_BLK_DEV_SD=y
+CONFIG_CHR_DEV_ST=y
+# CONFIG_CHR_DEV_OSST is not set
+CONFIG_BLK_DEV_SR=y
+CONFIG_BLK_DEV_SR_VENDOR=y
+CONFIG_CHR_DEV_SG=y
+# CONFIG_CHR_DEV_SCH is not set
+
+#
+# Some SCSI devices (e.g. CD jukebox) support multiple LUNs
+#
+# CONFIG_SCSI_MULTI_LUN is not set
+CONFIG_SCSI_CONSTANTS=y
+# CONFIG_SCSI_LOGGING is not set
+
+#
+# SCSI Transport Attributes
+#
+CONFIG_SCSI_SPI_ATTRS=y
+# CONFIG_SCSI_FC_ATTRS is not set
+# CONFIG_SCSI_ISCSI_ATTRS is not set
+# CONFIG_SCSI_SAS_ATTRS is not set
+
+#
+# SCSI low-level drivers
+#
+# CONFIG_ISCSI_TCP is not set
+# CONFIG_BLK_DEV_3W_XXXX_RAID is not set
+# CONFIG_SCSI_3W_9XXX is not set
+# CONFIG_SCSI_ACARD is not set
+# CONFIG_SCSI_AACRAID is not set
+CONFIG_SCSI_AIC7XXX=m
+CONFIG_AIC7XXX_CMDS_PER_DEVICE=253
+CONFIG_AIC7XXX_RESET_DELAY_MS=15000
+CONFIG_AIC7XXX_DEBUG_ENABLE=y
+CONFIG_AIC7XXX_DEBUG_MASK=0
+CONFIG_AIC7XXX_REG_PRETTY_PRINT=y
+CONFIG_SCSI_AIC7XXX_OLD=m
+# CONFIG_SCSI_AIC79XX is not set
+# CONFIG_SCSI_DPT_I2O is not set
+# CONFIG_MEGARAID_NEWGEN is not set
+# CONFIG_MEGARAID_LEGACY is not set
+# CONFIG_MEGARAID_SAS is not set
+# CONFIG_SCSI_SATA is not set
+# CONFIG_SCSI_BUSLOGIC is not set
+# CONFIG_SCSI_DMX3191D is not set
+# CONFIG_SCSI_EATA is not set
+# CONFIG_SCSI_FUTURE_DOMAIN is not set
+# CONFIG_SCSI_GDTH is not set
+# CONFIG_SCSI_IPS is not set
+# CONFIG_SCSI_INITIO is not set
+# CONFIG_SCSI_INIA100 is not set
+CONFIG_SCSI_SYM53C8XX_2=y
+CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE=0
+CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS=16
+CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
+# CONFIG_SCSI_SYM53C8XX_IOMAPPED is not set
+# CONFIG_SCSI_IPR is not set
+# CONFIG_SCSI_QLOGIC_FC is not set
+# CONFIG_SCSI_QLOGIC_1280 is not set
+CONFIG_SCSI_QLA2XXX=y
+# CONFIG_SCSI_QLA21XX is not set
+# CONFIG_SCSI_QLA22XX is not set
+# CONFIG_SCSI_QLA2300 is not set
+# CONFIG_SCSI_QLA2322 is not set
+# CONFIG_SCSI_QLA6312 is not set
+# CONFIG_SCSI_QLA24XX is not set
+# CONFIG_SCSI_LPFC is not set
+# CONFIG_SCSI_DC395x is not set
+# CONFIG_SCSI_DC390T is not set
+# CONFIG_SCSI_NSP32 is not set
+# CONFIG_SCSI_DEBUG is not set
+CONFIG_SCSI_MESH=y
+CONFIG_SCSI_MESH_SYNC_RATE=5
+CONFIG_SCSI_MESH_RESET_DELAY_MS=1000
+CONFIG_SCSI_MAC53C94=y
+
+#
+# PCMCIA SCSI adapter support
+#
+# CONFIG_PCMCIA_AHA152X is not set
+# CONFIG_PCMCIA_FDOMAIN is not set
+# CONFIG_PCMCIA_NINJA_SCSI is not set
+# CONFIG_PCMCIA_QLOGIC is not set
+# CONFIG_PCMCIA_SYM53C500 is not set
+
+#
+# Multi-device support (RAID and LVM)
+#
+CONFIG_MD=y
+CONFIG_BLK_DEV_MD=m
+CONFIG_MD_LINEAR=m
+CONFIG_MD_RAID0=m
+CONFIG_MD_RAID1=m
+# CONFIG_MD_RAID10 is not set
+CONFIG_MD_RAID5=m
+CONFIG_MD_RAID6=m
+CONFIG_MD_MULTIPATH=m
+CONFIG_MD_FAULTY=m
+CONFIG_BLK_DEV_DM=m
+CONFIG_DM_CRYPT=m
+# CONFIG_DM_SNAPSHOT is not set
+# CONFIG_DM_MIRROR is not set
+# CONFIG_DM_ZERO is not set
+# CONFIG_DM_MULTIPATH is not set
+
+#
+# Fusion MPT device support
+#
+# CONFIG_FUSION is not set
+# CONFIG_FUSION_SPI is not set
+# CONFIG_FUSION_FC is not set
+# CONFIG_FUSION_SAS is not set
+
+#
+# IEEE 1394 (FireWire) support
+#
+CONFIG_IEEE1394=m
+
+#
+# Subsystem Options
+#
+# CONFIG_IEEE1394_VERBOSEDEBUG is not set
+# CONFIG_IEEE1394_OUI_DB is not set
+CONFIG_IEEE1394_EXTRA_CONFIG_ROMS=y
+CONFIG_IEEE1394_CONFIG_ROM_IP1394=y
+# CONFIG_IEEE1394_EXPORT_FULL_API is not set
+
+#
+# Device Drivers
+#
+# CONFIG_IEEE1394_PCILYNX is not set
+CONFIG_IEEE1394_OHCI1394=m
+
+#
+# Protocol Drivers
+#
+CONFIG_IEEE1394_VIDEO1394=m
+CONFIG_IEEE1394_SBP2=m
+# CONFIG_IEEE1394_SBP2_PHYS_DMA is not set
+CONFIG_IEEE1394_ETH1394=m
+CONFIG_IEEE1394_DV1394=m
+CONFIG_IEEE1394_RAWIO=m
+# CONFIG_IEEE1394_CMP is not set
+
+#
+# I2O device support
+#
+# CONFIG_I2O is not set
+
+#
+# Macintosh device drivers
+#
+CONFIG_ADB=y
+CONFIG_ADB_CUDA=y
+CONFIG_ADB_PMU=y
+CONFIG_PMAC_APM_EMU=y
+CONFIG_PMAC_MEDIABAY=y
+CONFIG_PMAC_BACKLIGHT=y
+CONFIG_INPUT_ADBHID=y
+CONFIG_MAC_EMUMOUSEBTN=y
+CONFIG_THERM_WINDTUNNEL=m
+CONFIG_THERM_ADT746X=m
+# CONFIG_WINDFARM is not set
+# CONFIG_ANSLCD is not set
+
+#
+# Network device support
+#
+CONFIG_NETDEVICES=y
+# CONFIG_DUMMY is not set
+# CONFIG_BONDING is not set
+# CONFIG_EQUALIZER is not set
+# CONFIG_TUN is not set
+
+#
+# ARCnet devices
+#
+# CONFIG_ARCNET is not set
+
+#
+# PHY device support
+#
+# CONFIG_PHYLIB is not set
+
+#
+# Ethernet (10 or 100Mbit)
+#
+CONFIG_NET_ETHERNET=y
+CONFIG_MII=y
+CONFIG_MACE=y
+# CONFIG_MACE_AAUI_PORT is not set
+CONFIG_BMAC=y
+# CONFIG_HAPPYMEAL is not set
+CONFIG_SUNGEM=y
+# CONFIG_CASSINI is not set
+# CONFIG_NET_VENDOR_3COM is not set
+
+#
+# Tulip family network device support
+#
+# CONFIG_NET_TULIP is not set
+# CONFIG_HP100 is not set
+CONFIG_NET_PCI=y
+CONFIG_PCNET32=y
+# CONFIG_AMD8111_ETH is not set
+# CONFIG_ADAPTEC_STARFIRE is not set
+# CONFIG_B44 is not set
+# CONFIG_FORCEDETH is not set
+# CONFIG_DGRS is not set
+# CONFIG_EEPRO100 is not set
+# CONFIG_E100 is not set
+# CONFIG_FEALNX is not set
+# CONFIG_NATSEMI is not set
+# CONFIG_NE2K_PCI is not set
+# CONFIG_8139CP is not set
+# CONFIG_8139TOO is not set
+# CONFIG_SIS900 is not set
+# CONFIG_EPIC100 is not set
+# CONFIG_SUNDANCE is not set
+# CONFIG_TLAN is not set
+# CONFIG_VIA_RHINE is not set
+
+#
+# Ethernet (1000 Mbit)
+#
+# CONFIG_ACENIC is not set
+# CONFIG_DL2K is not set
+# CONFIG_E1000 is not set
+# CONFIG_NS83820 is not set
+# CONFIG_HAMACHI is not set
+# CONFIG_YELLOWFIN is not set
+# CONFIG_R8169 is not set
+# CONFIG_SIS190 is not set
+# CONFIG_SKGE is not set
+# CONFIG_SK98LIN is not set
+# CONFIG_VIA_VELOCITY is not set
+# CONFIG_TIGON3 is not set
+# CONFIG_BNX2 is not set
+# CONFIG_MV643XX_ETH is not set
+
+#
+# Ethernet (10000 Mbit)
+#
+# CONFIG_CHELSIO_T1 is not set
+# CONFIG_IXGB is not set
+# CONFIG_S2IO is not set
+
+#
+# Token Ring devices
+#
+# CONFIG_TR is not set
+
+#
+# Wireless LAN (non-hamradio)
+#
+CONFIG_NET_RADIO=y
+
+#
+# Obsolete Wireless cards support (pre-802.11)
+#
+# CONFIG_STRIP is not set
+# CONFIG_PCMCIA_WAVELAN is not set
+# CONFIG_PCMCIA_NETWAVE is not set
+
+#
+# Wireless 802.11 Frequency Hopping cards support
+#
+# CONFIG_PCMCIA_RAYCS is not set
+
+#
+# Wireless 802.11b ISA/PCI cards support
+#
+# CONFIG_IPW2100 is not set
+# CONFIG_IPW2200 is not set
+# CONFIG_AIRO is not set
+CONFIG_HERMES=m
+CONFIG_APPLE_AIRPORT=m
+# CONFIG_PLX_HERMES is not set
+# CONFIG_TMD_HERMES is not set
+# CONFIG_NORTEL_HERMES is not set
+# CONFIG_PCI_HERMES is not set
+# CONFIG_ATMEL is not set
+
+#
+# Wireless 802.11b Pcmcia/Cardbus cards support
+#
+# CONFIG_PCMCIA_HERMES is not set
+# CONFIG_PCMCIA_SPECTRUM is not set
+# CONFIG_AIRO_CS is not set
+# CONFIG_PCMCIA_WL3501 is not set
+
+#
+# Prism GT/Duette 802.11(a/b/g) PCI/Cardbus support
+#
+CONFIG_PRISM54=m
+# CONFIG_HOSTAP is not set
+CONFIG_NET_WIRELESS=y
+
+#
+# PCMCIA network device support
+#
+# CONFIG_NET_PCMCIA is not set
+
+#
+# Wan interfaces
+#
+# CONFIG_WAN is not set
+# CONFIG_FDDI is not set
+# CONFIG_HIPPI is not set
+CONFIG_PPP=y
+CONFIG_PPP_MULTILINK=y
+# CONFIG_PPP_FILTER is not set
+CONFIG_PPP_ASYNC=y
+CONFIG_PPP_SYNC_TTY=m
+CONFIG_PPP_DEFLATE=y
+CONFIG_PPP_BSDCOMP=m
+# CONFIG_PPP_MPPE is not set
+# CONFIG_PPPOE is not set
+# CONFIG_SLIP is not set
+# CONFIG_NET_FC is not set
+# CONFIG_SHAPER is not set
+# CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
+
+#
+# ISDN subsystem
+#
+# CONFIG_ISDN is not set
+
+#
+# Telephony Support
+#
+# CONFIG_PHONE is not set
+
+#
+# Input device support
+#
+CONFIG_INPUT=y
+
+#
+# Userland interfaces
+#
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+# CONFIG_INPUT_JOYDEV is not set
+# CONFIG_INPUT_TSDEV is not set
+CONFIG_INPUT_EVDEV=y
+# CONFIG_INPUT_EVBUG is not set
+
+#
+# Input Device Drivers
+#
+CONFIG_INPUT_KEYBOARD=y
+# CONFIG_KEYBOARD_ATKBD is not set
+# CONFIG_KEYBOARD_SUNKBD is not set
+# CONFIG_KEYBOARD_LKKBD is not set
+# CONFIG_KEYBOARD_XTKBD is not set
+# CONFIG_KEYBOARD_NEWTON is not set
+CONFIG_INPUT_MOUSE=y
+# CONFIG_MOUSE_PS2 is not set
+# CONFIG_MOUSE_SERIAL is not set
+# CONFIG_MOUSE_VSXXXAA is not set
+# CONFIG_INPUT_JOYSTICK is not set
+# CONFIG_INPUT_TOUCHSCREEN is not set
+# CONFIG_INPUT_MISC is not set
+
+#
+# Hardware I/O ports
+#
+CONFIG_SERIO=y
+# CONFIG_SERIO_I8042 is not set
+# CONFIG_SERIO_SERPORT is not set
+# CONFIG_SERIO_PCIPS2 is not set
+# CONFIG_SERIO_RAW is not set
+# CONFIG_GAMEPORT is not set
+
+#
+# Character devices
+#
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_HW_CONSOLE=y
+# CONFIG_SERIAL_NONSTANDARD is not set
+
+#
+# Serial drivers
+#
+CONFIG_SERIAL_8250=m
+# CONFIG_SERIAL_8250_CS is not set
+CONFIG_SERIAL_8250_NR_UARTS=4
+# CONFIG_SERIAL_8250_EXTENDED is not set
+
+#
+# Non-8250 serial port support
+#
+CONFIG_SERIAL_CORE=m
+# CONFIG_SERIAL_PMACZILOG is not set
+# CONFIG_SERIAL_JSM is not set
+CONFIG_UNIX98_PTYS=y
+CONFIG_LEGACY_PTYS=y
+CONFIG_LEGACY_PTY_COUNT=256
+
+#
+# IPMI
+#
+# CONFIG_IPMI_HANDLER is not set
+
+#
+# Watchdog Cards
+#
+# CONFIG_WATCHDOG is not set
+CONFIG_NVRAM=y
+CONFIG_GEN_RTC=y
+# CONFIG_GEN_RTC_X is not set
+# CONFIG_DTLK is not set
+# CONFIG_R3964 is not set
+# CONFIG_APPLICOM is not set
+
+#
+# Ftape, the floppy tape device driver
+#
+CONFIG_AGP=m
+CONFIG_AGP_UNINORTH=m
+CONFIG_DRM=m
+# CONFIG_DRM_TDFX is not set
+CONFIG_DRM_R128=m
+CONFIG_DRM_RADEON=m
+# CONFIG_DRM_MGA is not set
+# CONFIG_DRM_SIS is not set
+# CONFIG_DRM_VIA is not set
+# CONFIG_DRM_SAVAGE is not set
+
+#
+# PCMCIA character devices
+#
+# CONFIG_SYNCLINK_CS is not set
+# CONFIG_CARDMAN_4000 is not set
+# CONFIG_CARDMAN_4040 is not set
+# CONFIG_RAW_DRIVER is not set
+
+#
+# TPM devices
+#
+# CONFIG_TCG_TPM is not set
+# CONFIG_TELCLOCK is not set
+
+#
+# I2C support
+#
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=m
+
+#
+# I2C Algorithms
+#
+CONFIG_I2C_ALGOBIT=y
+# CONFIG_I2C_ALGOPCF is not set
+# CONFIG_I2C_ALGOPCA is not set
+
+#
+# I2C Hardware Bus support
+#
+# CONFIG_I2C_ALI1535 is not set
+# CONFIG_I2C_ALI1563 is not set
+# CONFIG_I2C_ALI15X3 is not set
+# CONFIG_I2C_AMD756 is not set
+# CONFIG_I2C_AMD8111 is not set
+# CONFIG_I2C_I801 is not set
+# CONFIG_I2C_I810 is not set
+# CONFIG_I2C_PIIX4 is not set
+CONFIG_I2C_KEYWEST=m
+# CONFIG_I2C_MPC is not set
+# CONFIG_I2C_NFORCE2 is not set
+# CONFIG_I2C_PARPORT_LIGHT is not set
+# CONFIG_I2C_PROSAVAGE is not set
+# CONFIG_I2C_SAVAGE4 is not set
+# CONFIG_SCx200_ACB is not set
+# CONFIG_I2C_SIS5595 is not set
+# CONFIG_I2C_SIS630 is not set
+# CONFIG_I2C_SIS96X is not set
+# CONFIG_I2C_STUB is not set
+# CONFIG_I2C_VIA is not set
+# CONFIG_I2C_VIAPRO is not set
+# CONFIG_I2C_VOODOO3 is not set
+# CONFIG_I2C_PCA_ISA is not set
+
+#
+# Miscellaneous I2C Chip support
+#
+# CONFIG_SENSORS_DS1337 is not set
+# CONFIG_SENSORS_DS1374 is not set
+# CONFIG_SENSORS_EEPROM is not set
+# CONFIG_SENSORS_PCF8574 is not set
+# CONFIG_SENSORS_PCA9539 is not set
+# CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_SENSORS_RTC8564 is not set
+# CONFIG_SENSORS_M41T00 is not set
+# CONFIG_SENSORS_MAX6875 is not set
+# CONFIG_RTC_X1205_I2C is not set
+# CONFIG_I2C_DEBUG_CORE is not set
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+# CONFIG_I2C_DEBUG_CHIP is not set
+
+#
+# Dallas's 1-wire bus
+#
+# CONFIG_W1 is not set
+
+#
+# Hardware Monitoring support
+#
+# CONFIG_HWMON is not set
+# CONFIG_HWMON_VID is not set
+
+#
+# Misc devices
+#
+
+#
+# Multimedia Capabilities Port drivers
+#
+
+#
+# Multimedia devices
+#
+# CONFIG_VIDEO_DEV is not set
+
+#
+# Digital Video Broadcasting Devices
+#
+# CONFIG_DVB is not set
+
+#
+# Graphics support
+#
+CONFIG_FB=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+CONFIG_FB_MACMODES=y
+CONFIG_FB_MODE_HELPERS=y
+CONFIG_FB_TILEBLITTING=y
+# CONFIG_FB_CIRRUS is not set
+# CONFIG_FB_PM2 is not set
+# CONFIG_FB_CYBER2000 is not set
+CONFIG_FB_OF=y
+CONFIG_FB_CONTROL=y
+CONFIG_FB_PLATINUM=y
+CONFIG_FB_VALKYRIE=y
+CONFIG_FB_CT65550=y
+# CONFIG_FB_ASILIANT is not set
+CONFIG_FB_IMSTT=y
+# CONFIG_FB_VGA16 is not set
+# CONFIG_FB_S1D13XXX is not set
+CONFIG_FB_NVIDIA=y
+CONFIG_FB_NVIDIA_I2C=y
+# CONFIG_FB_RIVA is not set
+CONFIG_FB_MATROX=y
+CONFIG_FB_MATROX_MILLENIUM=y
+CONFIG_FB_MATROX_MYSTIQUE=y
+# CONFIG_FB_MATROX_G is not set
+# CONFIG_FB_MATROX_I2C is not set
+# CONFIG_FB_MATROX_MULTIHEAD is not set
+# CONFIG_FB_RADEON_OLD is not set
+CONFIG_FB_RADEON=y
+CONFIG_FB_RADEON_I2C=y
+# CONFIG_FB_RADEON_DEBUG is not set
+CONFIG_FB_ATY128=y
+CONFIG_FB_ATY=y
+CONFIG_FB_ATY_CT=y
+# CONFIG_FB_ATY_GENERIC_LCD is not set
+# CONFIG_FB_ATY_XL_INIT is not set
+CONFIG_FB_ATY_GX=y
+# CONFIG_FB_SAVAGE is not set
+# CONFIG_FB_SIS is not set
+# CONFIG_FB_NEOMAGIC is not set
+# CONFIG_FB_KYRO is not set
+CONFIG_FB_3DFX=y
+# CONFIG_FB_3DFX_ACCEL is not set
+# CONFIG_FB_VOODOO1 is not set
+# CONFIG_FB_CYBLA is not set
+# CONFIG_FB_TRIDENT is not set
+# CONFIG_FB_VIRTUAL is not set
+
+#
+# Console display driver support
+#
+# CONFIG_VGA_CONSOLE is not set
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
+# CONFIG_FONTS is not set
+CONFIG_FONT_8x8=y
+CONFIG_FONT_8x16=y
+
+#
+# Logo configuration
+#
+CONFIG_LOGO=y
+CONFIG_LOGO_LINUX_MONO=y
+CONFIG_LOGO_LINUX_VGA16=y
+CONFIG_LOGO_LINUX_CLUT224=y
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
+
+#
+# Sound
+#
+CONFIG_SOUND=m
+CONFIG_DMASOUND_PMAC=m
+CONFIG_DMASOUND=m
+
+#
+# Advanced Linux Sound Architecture
+#
+CONFIG_SND=m
+CONFIG_SND_TIMER=m
+CONFIG_SND_PCM=m
+CONFIG_SND_HWDEP=m
+CONFIG_SND_RAWMIDI=m
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_OSSEMUL=y
+CONFIG_SND_MIXER_OSS=m
+CONFIG_SND_PCM_OSS=m
+CONFIG_SND_SEQUENCER_OSS=y
+# CONFIG_SND_VERBOSE_PRINTK is not set
+# CONFIG_SND_DEBUG is not set
+CONFIG_SND_GENERIC_DRIVER=y
+
+#
+# Generic devices
+#
+CONFIG_SND_DUMMY=m
+# CONFIG_SND_VIRMIDI is not set
+# CONFIG_SND_MTPAV is not set
+# CONFIG_SND_SERIAL_U16550 is not set
+# CONFIG_SND_MPU401 is not set
+
+#
+# PCI devices
+#
+# CONFIG_SND_ALI5451 is not set
+# CONFIG_SND_ATIIXP is not set
+# CONFIG_SND_ATIIXP_MODEM is not set
+# CONFIG_SND_AU8810 is not set
+# CONFIG_SND_AU8820 is not set
+# CONFIG_SND_AU8830 is not set
+# CONFIG_SND_AZT3328 is not set
+# CONFIG_SND_BT87X is not set
+# CONFIG_SND_CS46XX is not set
+# CONFIG_SND_CS4281 is not set
+# CONFIG_SND_EMU10K1 is not set
+# CONFIG_SND_EMU10K1X is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
+# CONFIG_SND_TRIDENT is not set
+# CONFIG_SND_YMFPCI is not set
+# CONFIG_SND_AD1889 is not set
+# CONFIG_SND_ALS4000 is not set
+# CONFIG_SND_CMIPCI is not set
+# CONFIG_SND_ENS1370 is not set
+# CONFIG_SND_ENS1371 is not set
+# CONFIG_SND_ES1938 is not set
+# CONFIG_SND_ES1968 is not set
+# CONFIG_SND_MAESTRO3 is not set
+# CONFIG_SND_FM801 is not set
+# CONFIG_SND_ICE1712 is not set
+# CONFIG_SND_ICE1724 is not set
+# CONFIG_SND_INTEL8X0 is not set
+# CONFIG_SND_INTEL8X0M is not set
+# CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_VIA82XX is not set
+# CONFIG_SND_VIA82XX_MODEM is not set
+# CONFIG_SND_VX222 is not set
+# CONFIG_SND_HDA_INTEL is not set
+
+#
+# ALSA PowerMac devices
+#
+CONFIG_SND_POWERMAC=m
+# CONFIG_SND_POWERMAC_AUTO_DRC is not set
+
+#
+# USB devices
+#
+CONFIG_SND_USB_AUDIO=m
+# CONFIG_SND_USB_USX2Y is not set
+
+#
+# PCMCIA devices
+#
+
+#
+# Open Sound System
+#
+# CONFIG_SOUND_PRIME is not set
+
+#
+# USB support
+#
+CONFIG_USB_ARCH_HAS_HCD=y
+CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB=y
+# CONFIG_USB_DEBUG is not set
+
+#
+# Miscellaneous USB options
+#
+CONFIG_USB_DEVICEFS=y
+# CONFIG_USB_BANDWIDTH is not set
+CONFIG_USB_DYNAMIC_MINORS=y
+# CONFIG_USB_SUSPEND is not set
+# CONFIG_USB_OTG is not set
+
+#
+# USB Host Controller Drivers
+#
+# CONFIG_USB_EHCI_HCD is not set
+# CONFIG_USB_ISP116X_HCD is not set
+CONFIG_USB_OHCI_HCD=y
+# CONFIG_USB_OHCI_BIG_ENDIAN is not set
+CONFIG_USB_OHCI_LITTLE_ENDIAN=y
+# CONFIG_USB_UHCI_HCD is not set
+# CONFIG_USB_SL811_HCD is not set
+
+#
+# USB Device Class drivers
+#
+# CONFIG_OBSOLETE_OSS_USB_DRIVER is not set
+CONFIG_USB_ACM=m
+CONFIG_USB_PRINTER=m
+
+#
+# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+#
+
+#
+# may also be needed; see USB_STORAGE Help for more information
+#
+# CONFIG_USB_STORAGE is not set
+
+#
+# USB Input Devices
+#
+CONFIG_USB_HID=y
+CONFIG_USB_HIDINPUT=y
+# CONFIG_HID_FF is not set
+# CONFIG_USB_HIDDEV is not set
+# CONFIG_USB_AIPTEK is not set
+# CONFIG_USB_WACOM is not set
+# CONFIG_USB_ACECAD is not set
+# CONFIG_USB_KBTAB is not set
+# CONFIG_USB_POWERMATE is not set
+# CONFIG_USB_MTOUCH is not set
+# CONFIG_USB_ITMTOUCH is not set
+# CONFIG_USB_EGALAX is not set
+# CONFIG_USB_YEALINK is not set
+# CONFIG_USB_XPAD is not set
+# CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_KEYSPAN_REMOTE is not set
+CONFIG_USB_APPLETOUCH=y
+
+#
+# USB Imaging devices
+#
+# CONFIG_USB_MDC800 is not set
+# CONFIG_USB_MICROTEK is not set
+
+#
+# USB Multimedia devices
+#
+# CONFIG_USB_DABUSB is not set
+
+#
+# Video4Linux support is needed for USB Multimedia device support
+#
+
+#
+# USB Network Adapters
+#
+# CONFIG_USB_CATC is not set
+# CONFIG_USB_KAWETH is not set
+# CONFIG_USB_PEGASUS is not set
+# CONFIG_USB_RTL8150 is not set
+CONFIG_USB_USBNET=m
+CONFIG_USB_NET_AX8817X=m
+CONFIG_USB_NET_CDCETHER=m
+# CONFIG_USB_NET_GL620A is not set
+CONFIG_USB_NET_NET1080=m
+# CONFIG_USB_NET_PLUSB is not set
+# CONFIG_USB_NET_RNDIS_HOST is not set
+# CONFIG_USB_NET_CDC_SUBSET is not set
+CONFIG_USB_NET_ZAURUS=m
+# CONFIG_USB_ZD1201 is not set
+CONFIG_USB_MON=y
+
+#
+# USB port drivers
+#
+
+#
+# USB Serial Converter support
+#
+CONFIG_USB_SERIAL=m
+# CONFIG_USB_SERIAL_GENERIC is not set
+# CONFIG_USB_SERIAL_AIRPRIME is not set
+# CONFIG_USB_SERIAL_ANYDATA is not set
+# CONFIG_USB_SERIAL_BELKIN is not set
+# CONFIG_USB_SERIAL_WHITEHEAT is not set
+# CONFIG_USB_SERIAL_DIGI_ACCELEPORT is not set
+# CONFIG_USB_SERIAL_CP2101 is not set
+# CONFIG_USB_SERIAL_CYPRESS_M8 is not set
+# CONFIG_USB_SERIAL_EMPEG is not set
+# CONFIG_USB_SERIAL_FTDI_SIO is not set
+CONFIG_USB_SERIAL_VISOR=m
+CONFIG_USB_SERIAL_IPAQ=m
+# CONFIG_USB_SERIAL_IR is not set
+# CONFIG_USB_SERIAL_EDGEPORT is not set
+# CONFIG_USB_SERIAL_EDGEPORT_TI is not set
+# CONFIG_USB_SERIAL_GARMIN is not set
+# CONFIG_USB_SERIAL_IPW is not set
+CONFIG_USB_SERIAL_KEYSPAN_PDA=m
+CONFIG_USB_SERIAL_KEYSPAN=m
+CONFIG_USB_SERIAL_KEYSPAN_MPR=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28X=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28XA=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28XB=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19=y
+CONFIG_USB_SERIAL_KEYSPAN_USA18X=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19W=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19QW=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19QI=y
+CONFIG_USB_SERIAL_KEYSPAN_USA49W=y
+CONFIG_USB_SERIAL_KEYSPAN_USA49WLC=y
+# CONFIG_USB_SERIAL_KLSI is not set
+# CONFIG_USB_SERIAL_KOBIL_SCT is not set
+# CONFIG_USB_SERIAL_MCT_U232 is not set
+# CONFIG_USB_SERIAL_PL2303 is not set
+# CONFIG_USB_SERIAL_HP4X is not set
+# CONFIG_USB_SERIAL_SAFE is not set
+# CONFIG_USB_SERIAL_TI is not set
+# CONFIG_USB_SERIAL_CYBERJACK is not set
+# CONFIG_USB_SERIAL_XIRCOM is not set
+# CONFIG_USB_SERIAL_OPTION is not set
+# CONFIG_USB_SERIAL_OMNINET is not set
+CONFIG_USB_EZUSB=y
+
+#
+# USB Miscellaneous drivers
+#
+# CONFIG_USB_EMI62 is not set
+# CONFIG_USB_EMI26 is not set
+# CONFIG_USB_AUERSWALD is not set
+# CONFIG_USB_RIO500 is not set
+# CONFIG_USB_LEGOTOWER is not set
+# CONFIG_USB_LCD is not set
+# CONFIG_USB_LED is not set
+# CONFIG_USB_CYTHERM is not set
+# CONFIG_USB_PHIDGETKIT is not set
+# CONFIG_USB_PHIDGETSERVO is not set
+# CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_LD is not set
+# CONFIG_USB_TEST is not set
+
+#
+# USB DSL modem support
+#
+
+#
+# USB Gadget Support
+#
+# CONFIG_USB_GADGET is not set
+
+#
+# MMC/SD Card support
+#
+# CONFIG_MMC is not set
+
+#
+# InfiniBand support
+#
+# CONFIG_INFINIBAND is not set
+
+#
+# SN Devices
+#
+
+#
+# File systems
+#
+CONFIG_EXT2_FS=y
+# CONFIG_EXT2_FS_XATTR is not set
+# CONFIG_EXT2_FS_XIP is not set
+CONFIG_EXT3_FS=y
+CONFIG_EXT3_FS_XATTR=y
+# CONFIG_EXT3_FS_POSIX_ACL is not set
+# CONFIG_EXT3_FS_SECURITY is not set
+CONFIG_JBD=y
+# CONFIG_JBD_DEBUG is not set
+CONFIG_FS_MBCACHE=y
+# CONFIG_REISERFS_FS is not set
+# CONFIG_JFS_FS is not set
+# CONFIG_FS_POSIX_ACL is not set
+# CONFIG_XFS_FS is not set
+# CONFIG_MINIX_FS is not set
+# CONFIG_ROMFS_FS is not set
+CONFIG_INOTIFY=y
+# CONFIG_QUOTA is not set
+CONFIG_DNOTIFY=y
+# CONFIG_AUTOFS_FS is not set
+# CONFIG_AUTOFS4_FS is not set
+CONFIG_FUSE_FS=m
+
+#
+# CD-ROM/DVD Filesystems
+#
+CONFIG_ISO9660_FS=y
+CONFIG_JOLIET=y
+CONFIG_ZISOFS=y
+CONFIG_ZISOFS_FS=y
+CONFIG_UDF_FS=m
+CONFIG_UDF_NLS=y
+
+#
+# DOS/FAT/NT Filesystems
+#
+CONFIG_FAT_FS=m
+CONFIG_MSDOS_FS=m
+CONFIG_VFAT_FS=m
+CONFIG_FAT_DEFAULT_CODEPAGE=437
+CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
+# CONFIG_NTFS_FS is not set
+
+#
+# Pseudo filesystems
+#
+CONFIG_PROC_FS=y
+CONFIG_PROC_KCORE=y
+CONFIG_SYSFS=y
+CONFIG_TMPFS=y
+# CONFIG_HUGETLB_PAGE is not set
+CONFIG_RAMFS=y
+CONFIG_RELAYFS_FS=m
+
+#
+# Miscellaneous filesystems
+#
+# CONFIG_ADFS_FS is not set
+# CONFIG_AFFS_FS is not set
+CONFIG_HFS_FS=m
+CONFIG_HFSPLUS_FS=m
+# CONFIG_BEFS_FS is not set
+# CONFIG_BFS_FS is not set
+# CONFIG_EFS_FS is not set
+# CONFIG_CRAMFS is not set
+# CONFIG_VXFS_FS is not set
+# CONFIG_HPFS_FS is not set
+# CONFIG_QNX4FS_FS is not set
+# CONFIG_SYSV_FS is not set
+# CONFIG_UFS_FS is not set
+
+#
+# Network File Systems
+#
+CONFIG_NFS_FS=y
+# CONFIG_NFS_V3 is not set
+# CONFIG_NFS_V4 is not set
+# CONFIG_NFS_DIRECTIO is not set
+CONFIG_NFSD=y
+# CONFIG_NFSD_V3 is not set
+# CONFIG_NFSD_TCP is not set
+CONFIG_LOCKD=y
+CONFIG_EXPORTFS=y
+CONFIG_NFS_COMMON=y
+CONFIG_SUNRPC=y
+# CONFIG_RPCSEC_GSS_KRB5 is not set
+# CONFIG_RPCSEC_GSS_SPKM3 is not set
+CONFIG_SMB_FS=m
+# CONFIG_SMB_NLS_DEFAULT is not set
+# CONFIG_CIFS is not set
+# CONFIG_NCP_FS is not set
+# CONFIG_CODA_FS is not set
+# CONFIG_AFS_FS is not set
+# CONFIG_9P_FS is not set
+
+#
+# Partition Types
+#
+CONFIG_PARTITION_ADVANCED=y
+# CONFIG_ACORN_PARTITION is not set
+# CONFIG_OSF_PARTITION is not set
+# CONFIG_AMIGA_PARTITION is not set
+# CONFIG_ATARI_PARTITION is not set
+CONFIG_MAC_PARTITION=y
+CONFIG_MSDOS_PARTITION=y
+# CONFIG_BSD_DISKLABEL is not set
+# CONFIG_MINIX_SUBPARTITION is not set
+# CONFIG_SOLARIS_X86_PARTITION is not set
+# CONFIG_UNIXWARE_DISKLABEL is not set
+# CONFIG_LDM_PARTITION is not set
+# CONFIG_SGI_PARTITION is not set
+# CONFIG_ULTRIX_PARTITION is not set
+# CONFIG_SUN_PARTITION is not set
+# CONFIG_EFI_PARTITION is not set
+
+#
+# Native Language Support
+#
+CONFIG_NLS=y
+CONFIG_NLS_DEFAULT="iso8859-1"
+CONFIG_NLS_CODEPAGE_437=m
+# CONFIG_NLS_CODEPAGE_737 is not set
+# CONFIG_NLS_CODEPAGE_775 is not set
+# CONFIG_NLS_CODEPAGE_850 is not set
+# CONFIG_NLS_CODEPAGE_852 is not set
+# CONFIG_NLS_CODEPAGE_855 is not set
+# CONFIG_NLS_CODEPAGE_857 is not set
+# CONFIG_NLS_CODEPAGE_860 is not set
+# CONFIG_NLS_CODEPAGE_861 is not set
+# CONFIG_NLS_CODEPAGE_862 is not set
+# CONFIG_NLS_CODEPAGE_863 is not set
+# CONFIG_NLS_CODEPAGE_864 is not set
+# CONFIG_NLS_CODEPAGE_865 is not set
+# CONFIG_NLS_CODEPAGE_866 is not set
+# CONFIG_NLS_CODEPAGE_869 is not set
+# CONFIG_NLS_CODEPAGE_936 is not set
+# CONFIG_NLS_CODEPAGE_950 is not set
+# CONFIG_NLS_CODEPAGE_932 is not set
+# CONFIG_NLS_CODEPAGE_949 is not set
+# CONFIG_NLS_CODEPAGE_874 is not set
+# CONFIG_NLS_ISO8859_8 is not set
+# CONFIG_NLS_CODEPAGE_1250 is not set
+# CONFIG_NLS_CODEPAGE_1251 is not set
+# CONFIG_NLS_ASCII is not set
+CONFIG_NLS_ISO8859_1=m
+# CONFIG_NLS_ISO8859_2 is not set
+# CONFIG_NLS_ISO8859_3 is not set
+# CONFIG_NLS_ISO8859_4 is not set
+# CONFIG_NLS_ISO8859_5 is not set
+# CONFIG_NLS_ISO8859_6 is not set
+# CONFIG_NLS_ISO8859_7 is not set
+# CONFIG_NLS_ISO8859_9 is not set
+# CONFIG_NLS_ISO8859_13 is not set
+# CONFIG_NLS_ISO8859_14 is not set
+# CONFIG_NLS_ISO8859_15 is not set
+# CONFIG_NLS_KOI8_R is not set
+# CONFIG_NLS_KOI8_U is not set
+CONFIG_NLS_UTF8=m
+
+#
+# Library routines
+#
+CONFIG_CRC_CCITT=y
+CONFIG_CRC16=y
+CONFIG_CRC32=y
+# CONFIG_LIBCRC32C is not set
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_TEXTSEARCH=y
+CONFIG_TEXTSEARCH_KMP=m
+CONFIG_TEXTSEARCH_BM=m
+CONFIG_TEXTSEARCH_FSM=m
+
+#
+# Instrumentation Support
+#
+CONFIG_PROFILING=y
+CONFIG_OPROFILE=y
+
+#
+# Kernel hacking
+#
+# CONFIG_PRINTK_TIME is not set
+CONFIG_DEBUG_KERNEL=y
+# CONFIG_MAGIC_SYSRQ is not set
+CONFIG_LOG_BUF_SHIFT=14
+CONFIG_DETECT_SOFTLOCKUP=y
+# CONFIG_SCHEDSTATS is not set
+# CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_SPINLOCK is not set
+# CONFIG_DEBUG_SPINLOCK_SLEEP is not set
+# CONFIG_DEBUG_KOBJECT is not set
+# CONFIG_DEBUG_INFO is not set
+# CONFIG_DEBUG_FS is not set
+# CONFIG_DEBUG_VM is not set
+# CONFIG_RCU_TORTURE_TEST is not set
+CONFIG_DEBUGGER=y
+CONFIG_XMON=y
+CONFIG_XMON_DEFAULT=y
+# CONFIG_BDI_SWITCH is not set
+CONFIG_BOOTX_TEXT=y
+
+#
+# Security options
+#
+# CONFIG_KEYS is not set
+# CONFIG_SECURITY is not set
+
+#
+# Cryptographic options
+#
+CONFIG_CRYPTO=y
+# CONFIG_CRYPTO_HMAC is not set
+# CONFIG_CRYPTO_NULL is not set
+# CONFIG_CRYPTO_MD4 is not set
+# CONFIG_CRYPTO_MD5 is not set
+# CONFIG_CRYPTO_SHA1 is not set
+# CONFIG_CRYPTO_SHA256 is not set
+# CONFIG_CRYPTO_SHA512 is not set
+# CONFIG_CRYPTO_WP512 is not set
+# CONFIG_CRYPTO_TGR192 is not set
+# CONFIG_CRYPTO_DES is not set
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+# CONFIG_CRYPTO_SERPENT is not set
+CONFIG_CRYPTO_AES=m
+# CONFIG_CRYPTO_CAST5 is not set
+# CONFIG_CRYPTO_CAST6 is not set
+# CONFIG_CRYPTO_TEA is not set
+CONFIG_CRYPTO_ARC4=m
+# CONFIG_CRYPTO_KHAZAD is not set
+# CONFIG_CRYPTO_ANUBIS is not set
+# CONFIG_CRYPTO_DEFLATE is not set
+CONFIG_CRYPTO_MICHAEL_MIC=m
+# CONFIG_CRYPTO_CRC32C is not set
+# CONFIG_CRYPTO_TEST is not set
+
+#
+# Hardware crypto devices
+#
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index 9ed551b6c172..6e03b595b6c8 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -17,11 +17,11 @@ obj-y				+= vdso32/
 obj-$(CONFIG_PPC64)             += setup_64.o binfmt_elf32.o sys_ppc32.o \
                                    signal_64.o ptrace32.o systbl.o \
                                    paca.o ioctl32.o cpu_setup_power4.o \
-                                   firmware.o sysfs.o udbg.o idle_64.o
+                                   firmware.o sysfs.o idle_64.o
 obj-$(CONFIG_PPC64)             += vdso64/
 obj-$(CONFIG_ALTIVEC)           += vecemu.o vector.o
 obj-$(CONFIG_POWER4)            += idle_power4.o
-obj-$(CONFIG_PPC_OF)            += of_device.o
+obj-$(CONFIG_PPC_OF)            += of_device.o prom_parse.o
 procfs-$(CONFIG_PPC64)          := proc_ppc64.o
 obj-$(CONFIG_PROC_FS)           += $(procfs-y)
 rtaspci-$(CONFIG_PPC64)         := rtas_pci.o
@@ -30,12 +30,10 @@ obj-$(CONFIG_RTAS_FLASH)	+= rtas_flash.o
 obj-$(CONFIG_RTAS_PROC)         += rtas-proc.o
 obj-$(CONFIG_LPARCFG)           += lparcfg.o
 obj-$(CONFIG_IBMVIO)            += vio.o
+obj-$(CONFIG_IBMEBUS)           += ibmebus.o
 obj-$(CONFIG_GENERIC_TBSYNC)    += smp-tbsync.o
-obj-$(CONFIG_PPC_PSERIES)       += udbg_16550.o
-obj-$(CONFIG_PPC_MAPLE)         += udbg_16550.o
-udbgscc-$(CONFIG_PPC64)         := udbg_scc.o
-obj-$(CONFIG_PPC_PMAC)          += $(udbgscc-y)
 obj64-$(CONFIG_PPC_MULTIPLATFORM) += nvram_64.o
+obj-$(CONFIG_CRASH_DUMP)        += crash_dump.o
 
 ifeq ($(CONFIG_PPC_MERGE),y)
 
@@ -48,25 +46,25 @@ extra-$(CONFIG_8xx)		:= head_8xx.o
 extra-y                         += vmlinux.lds
 
 obj-y                           += process.o init_task.o time.o \
-                                   prom.o traps.o setup-common.o
+                                   prom.o traps.o setup-common.o udbg.o
 obj-$(CONFIG_PPC32)             += entry_32.o setup_32.o misc_32.o systbl.o
 obj-$(CONFIG_PPC64)             += misc_64.o dma_64.o iommu.o
-obj-$(CONFIG_PPC_OF)            += prom_init.o
+obj-$(CONFIG_PPC_MULTIPLATFORM) += prom_init.o
 obj-$(CONFIG_MODULES)           += ppc_ksyms.o
 obj-$(CONFIG_BOOTX_TEXT)        += btext.o
 obj-$(CONFIG_6xx)               += idle_6xx.o
 obj-$(CONFIG_SMP)               += smp.o
 obj-$(CONFIG_KPROBES)           += kprobes.o
-
+obj-$(CONFIG_SERIAL_8250)       += legacy_serial.o udbg_16550.o
 module-$(CONFIG_PPC64)          += module_64.o
 obj-$(CONFIG_MODULES)           += $(module-y)
 
 pci64-$(CONFIG_PPC64)           += pci_64.o pci_dn.o pci_iommu.o \
                                    pci_direct_iommu.o iomap.o
 obj-$(CONFIG_PCI)               += $(pci64-y)
-
-kexec64-$(CONFIG_PPC64)         += machine_kexec_64.o
-obj-$(CONFIG_KEXEC)             += $(kexec64-y)
+kexec-$(CONFIG_PPC64)           := machine_kexec_64.o
+kexec-$(CONFIG_PPC32)           := machine_kexec_32.o
+obj-$(CONFIG_KEXEC)             += machine_kexec.o crash.o $(kexec-y)
 
 ifeq ($(CONFIG_PPC_ISERIES),y)
 $(obj)/head_64.o: $(obj)/lparmap.s
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index 91538d2445bf..56399c5c931a 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -92,9 +92,9 @@ int main(void)
 
         DEFINE(TI_FLAGS, offsetof(struct thread_info, flags));
         DEFINE(TI_PREEMPT, offsetof(struct thread_info, preempt_count));
-        DEFINE(TI_SC_NOERR, offsetof(struct thread_info, syscall_noerror));
-#ifdef CONFIG_PPC32
+        DEFINE(TI_SIGFRAME, offsetof(struct thread_info, nvgprs_frame));
         DEFINE(TI_TASK, offsetof(struct thread_info, task));
+#ifdef CONFIG_PPC32
         DEFINE(TI_EXECDOMAIN, offsetof(struct thread_info, exec_domain));
         DEFINE(TI_CPU, offsetof(struct thread_info, cpu));
 #endif /* CONFIG_PPC32 */
@@ -131,11 +131,9 @@ int main(void)
         DEFINE(PACALOWHTLBAREAS, offsetof(struct paca_struct, context.low_htlb_areas));
         DEFINE(PACAHIGHHTLBAREAS, offsetof(struct paca_struct, context.high_htlb_areas));
 #endif /* CONFIG_HUGETLB_PAGE */
-        DEFINE(PACADEFAULTDECR, offsetof(struct paca_struct, default_decr));
         DEFINE(PACA_EXGEN, offsetof(struct paca_struct, exgen));
         DEFINE(PACA_EXMC, offsetof(struct paca_struct, exmc));
         DEFINE(PACA_EXSLB, offsetof(struct paca_struct, exslb));
-        DEFINE(PACA_EXDSI, offsetof(struct paca_struct, exdsi));
         DEFINE(PACAEMERGSP, offsetof(struct paca_struct, emergency_sp));
         DEFINE(PACALPPACA, offsetof(struct paca_struct, lppaca));
         DEFINE(PACAHWCPUID, offsetof(struct paca_struct, hw_cpu_id));
diff --git a/arch/powerpc/kernel/btext.c b/arch/powerpc/kernel/btext.c
index bdfba92b2b38..6223d39177cb 100644
--- a/arch/powerpc/kernel/btext.c
+++ b/arch/powerpc/kernel/btext.c
@@ -31,15 +31,18 @@ static void draw_byte_32(unsigned char *bits, unsigned int *base, int rb);
 static void draw_byte_16(unsigned char *bits, unsigned int *base, int rb);
 static void draw_byte_8(unsigned char *bits, unsigned int *base, int rb);
 
-static int g_loc_X;
-static int g_loc_Y;
-static int g_max_loc_X;
-static int g_max_loc_Y;
+#define __force_data __attribute__((__section__(".data")))
 
-static int dispDeviceRowBytes;
-static int dispDeviceDepth;
-static int dispDeviceRect[4];
-static unsigned char *dispDeviceBase, *logicalDisplayBase;
+static int g_loc_X __force_data;
+static int g_loc_Y __force_data;
+static int g_max_loc_X __force_data;
+static int g_max_loc_Y __force_data;
+
+static int dispDeviceRowBytes __force_data;
+static int dispDeviceDepth  __force_data;
+static int dispDeviceRect[4] __force_data;
+static unsigned char *dispDeviceBase __force_data;
+static unsigned char *logicalDisplayBase __force_data;
 
 unsigned long disp_BAT[2] __initdata = {0, 0};
 
@@ -47,7 +50,7 @@ unsigned long disp_BAT[2] __initdata = {0, 0};
 
 static unsigned char vga_font[cmapsz];
 
-int boot_text_mapped;
+int boot_text_mapped __force_data = 0;
 int force_printk_to_btext = 0;
 
 #ifdef CONFIG_PPC32
@@ -57,7 +60,7 @@ int force_printk_to_btext = 0;
  *
  * The display is mapped to virtual address 0xD0000000, rather
  * than 1:1, because some some CHRP machines put the frame buffer
- * in the region starting at 0xC0000000 (KERNELBASE).
+ * in the region starting at 0xC0000000 (PAGE_OFFSET).
  * This mapping is temporary and will disappear as soon as the
  * setup done by MMU_Init() is applied.
  *
@@ -66,10 +69,9 @@ int force_printk_to_btext = 0;
  * is really badly aligned, but I didn't encounter this case
  * yet.
  */
-void __init
-btext_prepare_BAT(void)
+void __init btext_prepare_BAT(void)
 {
-        unsigned long vaddr = KERNELBASE + 0x10000000;
+        unsigned long vaddr = PAGE_OFFSET + 0x10000000;
         unsigned long addr;
         unsigned long lowbits;
 
@@ -95,12 +97,13 @@ btext_prepare_BAT(void)
 }
 #endif
 
-/* This function will enable the early boot text when doing OF booting. This
- * way, xmon output should work too
+
+/* This function can be used to enable the early boot text when doing
+ * OF booting or within bootx init. It must be followed by a btext_unmap()
+ * call before the logical address becomes unuseable
  */
-void __init
-btext_setup_display(int width, int height, int depth, int pitch,
-                    unsigned long address)
+void __init btext_setup_display(int width, int height, int depth, int pitch,
+                                unsigned long address)
 {
         g_loc_X = 0;
         g_loc_Y = 0;
@@ -116,6 +119,11 @@ btext_setup_display(int width, int height, int depth, int pitch,
         boot_text_mapped = 1;
 }
 
+void __init btext_unmap(void)
+{
+        boot_text_mapped = 0;
+}
+
 /* Here's a small text engine to use during early boot
  * or for debugging purposes
  *
@@ -127,7 +135,7 @@ btext_setup_display(int width, int height, int depth, int pitch,
  *    changes.
  */
 
-void map_boot_text(void)
+static void map_boot_text(void)
 {
         unsigned long base, offset, size;
         unsigned char *vbase;
@@ -175,8 +183,9 @@ int btext_initialize(struct device_node *np)
         if (prop)
                 address = *prop;
 
-        /* FIXME: Add support for PCI reg properties */
-
+        /* FIXME: Add support for PCI reg properties. Right now, only
+         * reliable on macs
+         */
         if (address == 0)
                 return -EINVAL;
 
@@ -184,7 +193,6 @@ int btext_initialize(struct device_node *np)
         g_loc_Y = 0;
         g_max_loc_X = width / 8;
         g_max_loc_Y = height / 16;
-        logicalDisplayBase = (unsigned char *)address;
         dispDeviceBase = (unsigned char *)address;
         dispDeviceRowBytes = pitch;
         dispDeviceDepth = depth;
@@ -197,14 +205,12 @@ int btext_initialize(struct device_node *np)
         return 0;
 }
 
-void __init init_boot_display(void)
+int __init btext_find_display(int allow_nonstdout)
 {
         char *name;
         struct device_node *np = NULL; 
         int rc = -ENODEV;
 
-        printk("trying to initialize btext ...\n");
-
         name = (char *)get_property(of_chosen, "linux,stdout-path", NULL);
         if (name != NULL) {
                 np = of_find_node_by_path(name);
@@ -218,8 +224,8 @@ void __init init_boot_display(void)
         }
         if (np)
                 rc = btext_initialize(np);
-        if (rc == 0)
-                return;
+        if (rc == 0 || !allow_nonstdout)
+                return rc;
 
         for (np = NULL; (np = of_find_node_by_type(np, "display"));) {
                 if (get_property(np, "linux,opened", NULL)) {
@@ -228,8 +234,9 @@ void __init init_boot_display(void)
                         printk("result: %d\n", rc);
                 }
                 if (rc == 0)
-                        return;
+                        break;
         }
+        return rc;
 }
 
 /* Calc the base address of a given point (x,y) */
@@ -277,44 +284,83 @@ EXPORT_SYMBOL(btext_update_display);
 
 void btext_clearscreen(void)
 {
-        unsigned long *base     = (unsigned long *)calc_base(0, 0);
+        unsigned int *base      = (unsigned int *)calc_base(0, 0);
         unsigned long width     = ((dispDeviceRect[2] - dispDeviceRect[0]) *
-                                        (dispDeviceDepth >> 3)) >> 3;
+                                        (dispDeviceDepth >> 3)) >> 2;
         int i,j;
 
         for (i=0; i<(dispDeviceRect[3] - dispDeviceRect[1]); i++)
         {
-                unsigned long *ptr = base;
+                unsigned int *ptr = base;
                 for(j=width; j; --j)
                         *(ptr++) = 0;
-                base += (dispDeviceRowBytes >> 3);
+                base += (dispDeviceRowBytes >> 2);
         }
 }
 
+void btext_flushscreen(void)
+{
+        unsigned int *base      = (unsigned int *)calc_base(0, 0);
+        unsigned long width     = ((dispDeviceRect[2] - dispDeviceRect[0]) *
+                                        (dispDeviceDepth >> 3)) >> 2;
+        int i,j;
+
+        for (i=0; i < (dispDeviceRect[3] - dispDeviceRect[1]); i++)
+        {
+                unsigned int *ptr = base;
+                for(j = width; j > 0; j -= 8) {
+                        __asm__ __volatile__ ("dcbst 0,%0" :: "r" (ptr));
+                        ptr += 8;
+                }
+                base += (dispDeviceRowBytes >> 2);
+        }
+        __asm__ __volatile__ ("sync" ::: "memory");
+}
+
+void btext_flushline(void)
+{
+        unsigned int *base      = (unsigned int *)calc_base(0, g_loc_Y << 4);
+        unsigned long width     = ((dispDeviceRect[2] - dispDeviceRect[0]) *
+                                        (dispDeviceDepth >> 3)) >> 2;
+        int i,j;
+
+        for (i=0; i < 16; i++)
+        {
+                unsigned int *ptr = base;
+                for(j = width; j > 0; j -= 8) {
+                        __asm__ __volatile__ ("dcbst 0,%0" :: "r" (ptr));
+                        ptr += 8;
+                }
+                base += (dispDeviceRowBytes >> 2);
+        }
+        __asm__ __volatile__ ("sync" ::: "memory");
+}
+
+
 #ifndef NO_SCROLL
 static void scrollscreen(void)
 {
-        unsigned long *src      = (unsigned long *)calc_base(0,16);
-        unsigned long *dst      = (unsigned long *)calc_base(0,0);
+        unsigned int *src       = (unsigned int *)calc_base(0,16);
+        unsigned int *dst       = (unsigned int *)calc_base(0,0);
         unsigned long width     = ((dispDeviceRect[2] - dispDeviceRect[0]) *
-                                   (dispDeviceDepth >> 3)) >> 3;
+                                   (dispDeviceDepth >> 3)) >> 2;
         int i,j;
 
         for (i=0; i<(dispDeviceRect[3] - dispDeviceRect[1] - 16); i++)
         {
-                unsigned long *src_ptr = src;
-                unsigned long *dst_ptr = dst;
+                unsigned int *src_ptr = src;
+                unsigned int *dst_ptr = dst;
                 for(j=width; j; --j)
                         *(dst_ptr++) = *(src_ptr++);
-                src += (dispDeviceRowBytes >> 3);
-                dst += (dispDeviceRowBytes >> 3);
+                src += (dispDeviceRowBytes >> 2);
+                dst += (dispDeviceRowBytes >> 2);
         }
         for (i=0; i<16; i++)
         {
-                unsigned long *dst_ptr = dst;
+                unsigned int *dst_ptr = dst;
                 for(j=width; j; --j)
                         *(dst_ptr++) = 0;
-                dst += (dispDeviceRowBytes >> 3);
+                dst += (dispDeviceRowBytes >> 2);
         }
 }
 #endif /* ndef NO_SCROLL */
@@ -377,6 +423,14 @@ void btext_drawstring(const char *c)
                 btext_drawchar(*c++);
 }
 
+void btext_drawtext(const char *c, unsigned int len)
+{
+        if (!boot_text_mapped)
+                return;
+        while (len--)
+                btext_drawchar(*c++);
+}
+
 void btext_drawhex(unsigned long v)
 {
         char *hex_table = "0123456789abcdef";
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index 1d85cedbbb7b..43c74a6b07b1 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -78,10 +78,8 @@ struct cpu_spec	cpu_specs[] = {
                 .dcache_bsize           = 128,
                 .num_pmcs               = 8,
                 .cpu_setup              = __setup_cpu_power3,
-#ifdef CONFIG_OPROFILE
                 .oprofile_cpu_type      = "ppc64/power3",
-                .oprofile_model         = &op_model_rs64,
-#endif
+                .oprofile_type          = RS64,
         },
         {       /* Power3+ */
                 .pvr_mask               = 0xffff0000,
@@ -93,10 +91,8 @@ struct cpu_spec	cpu_specs[] = {
                 .dcache_bsize           = 128,
                 .num_pmcs               = 8,
                 .cpu_setup              = __setup_cpu_power3,
-#ifdef CONFIG_OPROFILE
                 .oprofile_cpu_type      = "ppc64/power3",
-                .oprofile_model         = &op_model_rs64,
-#endif
+                .oprofile_type          = RS64,
         },
         {       /* Northstar */
                 .pvr_mask               = 0xffff0000,
@@ -108,10 +104,8 @@ struct cpu_spec	cpu_specs[] = {
                 .dcache_bsize           = 128,
                 .num_pmcs               = 8,
                 .cpu_setup              = __setup_cpu_power3,
-#ifdef CONFIG_OPROFILE
                 .oprofile_cpu_type      = "ppc64/rs64",
-                .oprofile_model         = &op_model_rs64,
-#endif
+                .oprofile_type          = RS64,
         },
         {       /* Pulsar */
                 .pvr_mask               = 0xffff0000,
@@ -123,10 +117,8 @@ struct cpu_spec	cpu_specs[] = {
                 .dcache_bsize           = 128,
                 .num_pmcs               = 8,
                 .cpu_setup              = __setup_cpu_power3,
-#ifdef CONFIG_OPROFILE
                 .oprofile_cpu_type      = "ppc64/rs64",
-                .oprofile_model         = &op_model_rs64,
-#endif
+                .oprofile_type          = RS64,
         },
         {       /* I-star */
                 .pvr_mask               = 0xffff0000,
@@ -138,10 +130,8 @@ struct cpu_spec	cpu_specs[] = {
                 .dcache_bsize           = 128,
                 .num_pmcs               = 8,
                 .cpu_setup              = __setup_cpu_power3,
-#ifdef CONFIG_OPROFILE
                 .oprofile_cpu_type      = "ppc64/rs64",
-                .oprofile_model         = &op_model_rs64,
-#endif
+                .oprofile_type          = RS64,
         },
         {       /* S-star */
                 .pvr_mask               = 0xffff0000,
@@ -153,10 +143,8 @@ struct cpu_spec	cpu_specs[] = {
                 .dcache_bsize           = 128,
                 .num_pmcs               = 8,
                 .cpu_setup              = __setup_cpu_power3,
-#ifdef CONFIG_OPROFILE
                 .oprofile_cpu_type      = "ppc64/rs64",
-                .oprofile_model         = &op_model_rs64,
-#endif
+                .oprofile_type          = RS64,
         },
         {       /* Power4 */
                 .pvr_mask               = 0xffff0000,
@@ -168,10 +156,8 @@ struct cpu_spec	cpu_specs[] = {
                 .dcache_bsize           = 128,
                 .num_pmcs               = 8,
                 .cpu_setup              = __setup_cpu_power4,
-#ifdef CONFIG_OPROFILE
                 .oprofile_cpu_type      = "ppc64/power4",
-                .oprofile_model         = &op_model_rs64,
-#endif
+                .oprofile_type          = POWER4,
         },
         {       /* Power4+ */
                 .pvr_mask               = 0xffff0000,
@@ -183,10 +169,8 @@ struct cpu_spec	cpu_specs[] = {
                 .dcache_bsize           = 128,
                 .num_pmcs               = 8,
                 .cpu_setup              = __setup_cpu_power4,
-#ifdef CONFIG_OPROFILE
                 .oprofile_cpu_type      = "ppc64/power4",
-                .oprofile_model         = &op_model_power4,
-#endif
+                .oprofile_type          = POWER4,
         },
         {       /* PPC970 */
                 .pvr_mask               = 0xffff0000,
@@ -199,10 +183,8 @@ struct cpu_spec	cpu_specs[] = {
                 .dcache_bsize           = 128,
                 .num_pmcs               = 8,
                 .cpu_setup              = __setup_cpu_ppc970,
-#ifdef CONFIG_OPROFILE
                 .oprofile_cpu_type      = "ppc64/970",
-                .oprofile_model         = &op_model_power4,
-#endif
+                .oprofile_type          = POWER4,
         },
 #endif /* CONFIG_PPC64 */
 #if defined(CONFIG_PPC64) || defined(CONFIG_POWER4)
@@ -221,10 +203,8 @@ struct cpu_spec	cpu_specs[] = {
                 .dcache_bsize           = 128,
                 .num_pmcs               = 8,
                 .cpu_setup              = __setup_cpu_ppc970,
-#ifdef CONFIG_OPROFILE
                 .oprofile_cpu_type      = "ppc64/970",
-                .oprofile_model         = &op_model_power4,
-#endif
+                .oprofile_type          = POWER4,
         },
 #endif /* defined(CONFIG_PPC64) || defined(CONFIG_POWER4) */
 #ifdef CONFIG_PPC64
@@ -238,10 +218,8 @@ struct cpu_spec	cpu_specs[] = {
                 .icache_bsize           = 128,
                 .dcache_bsize           = 128,
                 .cpu_setup              = __setup_cpu_ppc970,
-#ifdef CONFIG_OPROFILE
                 .oprofile_cpu_type      = "ppc64/970",
-                .oprofile_model         = &op_model_power4,
-#endif
+                .oprofile_type          = POWER4,
         },
         {       /* Power5 GR */
                 .pvr_mask               = 0xffff0000,
@@ -253,27 +231,23 @@ struct cpu_spec	cpu_specs[] = {
                 .dcache_bsize           = 128,
                 .num_pmcs               = 6,
                 .cpu_setup              = __setup_cpu_power4,
-#ifdef CONFIG_OPROFILE
                 .oprofile_cpu_type      = "ppc64/power5",
-                .oprofile_model         = &op_model_power4,
-#endif
+                .oprofile_type          = POWER4,
         },
         {       /* Power5 GS */
                 .pvr_mask               = 0xffff0000,
                 .pvr_value              = 0x003b0000,
-                .cpu_name               = "POWER5 (gs)",
+                .cpu_name               = "POWER5+ (gs)",
                 .cpu_features           = CPU_FTRS_POWER5,
                 .cpu_user_features      = COMMON_USER_POWER5_PLUS,
                 .icache_bsize           = 128,
                 .dcache_bsize           = 128,
                 .num_pmcs               = 6,
                 .cpu_setup              = __setup_cpu_power4,
-#ifdef CONFIG_OPROFILE
-                .oprofile_cpu_type      = "ppc64/power5",
-                .oprofile_model         = &op_model_power4,
-#endif
+                .oprofile_cpu_type      = "ppc64/power5+",
+                .oprofile_type          = POWER4,
         },
-        {       /* BE DD1.x */
+        {       /* Cell Broadband Engine */
                 .pvr_mask               = 0xffff0000,
                 .pvr_value              = 0x00700000,
                 .cpu_name               = "Cell Broadband Engine",
@@ -545,7 +519,9 @@ struct cpu_spec	cpu_specs[] = {
                 .icache_bsize           = 32,
                 .dcache_bsize           = 32,
                 .num_pmcs               = 6,
-                .cpu_setup              = __setup_cpu_745x
+                .cpu_setup              = __setup_cpu_745x,
+                .oprofile_cpu_type      = "ppc/7450",
+                .oprofile_type          = G4,
         },
         {       /* 7450 2.1 */
                 .pvr_mask               = 0xffffffff,
@@ -556,7 +532,9 @@ struct cpu_spec	cpu_specs[] = {
                 .icache_bsize           = 32,
                 .dcache_bsize           = 32,
                 .num_pmcs               = 6,
-                .cpu_setup              = __setup_cpu_745x
+                .cpu_setup              = __setup_cpu_745x,
+                .oprofile_cpu_type      = "ppc/7450",
+                .oprofile_type          = G4,
         },
         {       /* 7450 2.3 and newer */
                 .pvr_mask               = 0xffff0000,
@@ -567,7 +545,9 @@ struct cpu_spec	cpu_specs[] = {
                 .icache_bsize           = 32,
                 .dcache_bsize           = 32,
                 .num_pmcs               = 6,
-                .cpu_setup              = __setup_cpu_745x
+                .cpu_setup              = __setup_cpu_745x,
+                .oprofile_cpu_type      = "ppc/7450",
+                .oprofile_type          = G4,
         },
         {       /* 7455 rev 1.x */
                 .pvr_mask               = 0xffffff00,
@@ -578,7 +558,9 @@ struct cpu_spec	cpu_specs[] = {
                 .icache_bsize           = 32,
                 .dcache_bsize           = 32,
                 .num_pmcs               = 6,
-                .cpu_setup              = __setup_cpu_745x
+                .cpu_setup              = __setup_cpu_745x,
+                .oprofile_cpu_type      = "ppc/7450",
+                .oprofile_type          = G4,
         },
         {       /* 7455 rev 2.0 */
                 .pvr_mask               = 0xffffffff,
@@ -589,7 +571,9 @@ struct cpu_spec	cpu_specs[] = {
                 .icache_bsize           = 32,
                 .dcache_bsize           = 32,
                 .num_pmcs               = 6,
-                .cpu_setup              = __setup_cpu_745x
+                .cpu_setup              = __setup_cpu_745x,
+                .oprofile_cpu_type      = "ppc/7450",
+                .oprofile_type          = G4,
         },
         {       /* 7455 others */
                 .pvr_mask               = 0xffff0000,
@@ -600,7 +584,9 @@ struct cpu_spec	cpu_specs[] = {
                 .icache_bsize           = 32,
                 .dcache_bsize           = 32,
                 .num_pmcs               = 6,
-                .cpu_setup              = __setup_cpu_745x
+                .cpu_setup              = __setup_cpu_745x,
+                .oprofile_cpu_type      = "ppc/7450",
+                .oprofile_type          = G4,
         },
         {       /* 7447/7457 Rev 1.0 */
                 .pvr_mask               = 0xffffffff,
@@ -611,7 +597,9 @@ struct cpu_spec	cpu_specs[] = {
                 .icache_bsize           = 32,
                 .dcache_bsize           = 32,
                 .num_pmcs               = 6,
-                .cpu_setup              = __setup_cpu_745x
+                .cpu_setup              = __setup_cpu_745x,
+                .oprofile_cpu_type      = "ppc/7450",
+                .oprofile_type          = G4,
         },
         {       /* 7447/7457 Rev 1.1 */
                 .pvr_mask               = 0xffffffff,
@@ -622,7 +610,9 @@ struct cpu_spec	cpu_specs[] = {
                 .icache_bsize           = 32,
                 .dcache_bsize           = 32,
                 .num_pmcs               = 6,
-                .cpu_setup              = __setup_cpu_745x
+                .cpu_setup              = __setup_cpu_745x,
+                .oprofile_cpu_type      = "ppc/7450",
+                .oprofile_type          = G4,
         },
         {       /* 7447/7457 Rev 1.2 and later */
                 .pvr_mask               = 0xffff0000,
@@ -633,7 +623,9 @@ struct cpu_spec	cpu_specs[] = {
                 .icache_bsize           = 32,
                 .dcache_bsize           = 32,
                 .num_pmcs               = 6,
-                .cpu_setup              = __setup_cpu_745x
+                .cpu_setup              = __setup_cpu_745x,
+                .oprofile_cpu_type      = "ppc/7450",
+                .oprofile_type          = G4,
         },
         {       /* 7447A */
                 .pvr_mask               = 0xffff0000,
@@ -644,7 +636,9 @@ struct cpu_spec	cpu_specs[] = {
                 .icache_bsize           = 32,
                 .dcache_bsize           = 32,
                 .num_pmcs               = 6,
-                .cpu_setup              = __setup_cpu_745x
+                .cpu_setup              = __setup_cpu_745x,
+                .oprofile_cpu_type      = "ppc/7450",
+                .oprofile_type          = G4,
         },
         {       /* 7448 */
                 .pvr_mask               = 0xffff0000,
@@ -655,7 +649,9 @@ struct cpu_spec	cpu_specs[] = {
                 .icache_bsize           = 32,
                 .dcache_bsize           = 32,
                 .num_pmcs               = 6,
-                .cpu_setup              = __setup_cpu_745x
+                .cpu_setup              = __setup_cpu_745x,
+                .oprofile_cpu_type      = "ppc/7450",
+                .oprofile_type          = G4,
         },
         {       /* 82xx (8240, 8245, 8260 are all 603e cores) */
                 .pvr_mask               = 0x7fff0000,
@@ -979,6 +975,8 @@ struct cpu_spec	cpu_specs[] = {
                 .icache_bsize           = 32,
                 .dcache_bsize           = 32,
                 .num_pmcs               = 4,
+                .oprofile_cpu_type      = "ppc/e500",
+                .oprofile_type          = BOOKE,
         },
         {       /* e500v2 */
                 .pvr_mask               = 0xffff0000,
@@ -992,6 +990,8 @@ struct cpu_spec	cpu_specs[] = {
                 .icache_bsize           = 32,
                 .dcache_bsize           = 32,
                 .num_pmcs               = 4,
+                .oprofile_cpu_type      = "ppc/e500",
+                .oprofile_type          = BOOKE,
         },
 #endif
 #if !CLASSIC_PPC
diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
new file mode 100644
index 000000000000..4681155121ef
--- /dev/null
+++ b/arch/powerpc/kernel/crash.c
@@ -0,0 +1,264 @@
+/*
+ * Architecture specific (PPC64) functions for kexec based crash dumps.
+ *
+ * Copyright (C) 2005, IBM Corp.
+ *
+ * Created by: Haren Myneni
+ *
+ * This source code is licensed under the GNU General Public License,
+ * Version 2.  See the file COPYING for more details.
+ *
+ */
+
+#undef DEBUG
+
+#include <linux/kernel.h>
+#include <linux/smp.h>
+#include <linux/reboot.h>
+#include <linux/kexec.h>
+#include <linux/bootmem.h>
+#include <linux/crash_dump.h>
+#include <linux/irq.h>
+#include <linux/delay.h>
+#include <linux/elf.h>
+#include <linux/elfcore.h>
+#include <linux/init.h>
+#include <linux/types.h>
+
+#include <asm/processor.h>
+#include <asm/machdep.h>
+#include <asm/kdump.h>
+#include <asm/lmb.h>
+#include <asm/firmware.h>
+
+#ifdef DEBUG
+#include <asm/udbg.h>
+#define DBG(fmt...) udbg_printf(fmt)
+#else
+#define DBG(fmt...)
+#endif
+
+/* This keeps a track of which one is crashing cpu. */
+int crashing_cpu = -1;
+
+static u32 *append_elf_note(u32 *buf, char *name, unsigned type, void *data,
+                                                               size_t data_len)
+{
+        struct elf_note note;
+
+        note.n_namesz = strlen(name) + 1;
+        note.n_descsz = data_len;
+        note.n_type   = type;
+        memcpy(buf, &note, sizeof(note));
+        buf += (sizeof(note) +3)/4;
+        memcpy(buf, name, note.n_namesz);
+        buf += (note.n_namesz + 3)/4;
+        memcpy(buf, data, note.n_descsz);
+        buf += (note.n_descsz + 3)/4;
+
+        return buf;
+}
+
+static void final_note(u32 *buf)
+{
+        struct elf_note note;
+
+        note.n_namesz = 0;
+        note.n_descsz = 0;
+        note.n_type   = 0;
+        memcpy(buf, &note, sizeof(note));
+}
+
+static void crash_save_this_cpu(struct pt_regs *regs, int cpu)
+{
+        struct elf_prstatus prstatus;
+        u32 *buf;
+
+        if ((cpu < 0) || (cpu >= NR_CPUS))
+                return;
+
+        /* Using ELF notes here is opportunistic.
+         * I need a well defined structure format
+         * for the data I pass, and I need tags
+         * on the data to indicate what information I have
+         * squirrelled away.  ELF notes happen to provide
+         * all of that that no need to invent something new.
+         */
+        buf = &crash_notes[cpu][0];
+        memset(&prstatus, 0, sizeof(prstatus));
+        prstatus.pr_pid = current->pid;
+        elf_core_copy_regs(&prstatus.pr_reg, regs);
+        buf = append_elf_note(buf, "CORE", NT_PRSTATUS, &prstatus,
+                        sizeof(prstatus));
+        final_note(buf);
+}
+
+/* FIXME Merge this with xmon_save_regs ?? */
+static inline void crash_get_current_regs(struct pt_regs *regs)
+{
+        unsigned long tmp1, tmp2;
+
+        __asm__ __volatile__ (
+                "std    0,0(%2)\n"
+                "std    1,8(%2)\n"
+                "std    2,16(%2)\n"
+                "std    3,24(%2)\n"
+                "std    4,32(%2)\n"
+                "std    5,40(%2)\n"
+                "std    6,48(%2)\n"
+                "std    7,56(%2)\n"
+                "std    8,64(%2)\n"
+                "std    9,72(%2)\n"
+                "std    10,80(%2)\n"
+                "std    11,88(%2)\n"
+                "std    12,96(%2)\n"
+                "std    13,104(%2)\n"
+                "std    14,112(%2)\n"
+                "std    15,120(%2)\n"
+                "std    16,128(%2)\n"
+                "std    17,136(%2)\n"
+                "std    18,144(%2)\n"
+                "std    19,152(%2)\n"
+                "std    20,160(%2)\n"
+                "std    21,168(%2)\n"
+                "std    22,176(%2)\n"
+                "std    23,184(%2)\n"
+                "std    24,192(%2)\n"
+                "std    25,200(%2)\n"
+                "std    26,208(%2)\n"
+                "std    27,216(%2)\n"
+                "std    28,224(%2)\n"
+                "std    29,232(%2)\n"
+                "std    30,240(%2)\n"
+                "std    31,248(%2)\n"
+                "mfmsr  %0\n"
+                "std    %0, 264(%2)\n"
+                "mfctr  %0\n"
+                "std    %0, 280(%2)\n"
+                "mflr   %0\n"
+                "std    %0, 288(%2)\n"
+                "bl     1f\n"
+        "1:      mflr   %1\n"
+                "std    %1, 256(%2)\n"
+                "mtlr   %0\n"
+                "mfxer  %0\n"
+                "std    %0, 296(%2)\n"
+                : "=&r" (tmp1), "=&r" (tmp2)
+                : "b" (regs));
+}
+
+/* We may have saved_regs from where the error came from
+ * or it is NULL if via a direct panic().
+ */
+static void crash_save_self(struct pt_regs *saved_regs)
+{
+        struct pt_regs regs;
+        int cpu;
+
+        cpu = smp_processor_id();
+        if (saved_regs)
+                memcpy(&regs, saved_regs, sizeof(regs));
+        else
+                crash_get_current_regs(&regs);
+        crash_save_this_cpu(&regs, cpu);
+}
+
+#ifdef CONFIG_SMP
+static atomic_t waiting_for_crash_ipi;
+
+void crash_ipi_callback(struct pt_regs *regs)
+{
+        int cpu = smp_processor_id();
+
+        if (cpu == crashing_cpu)
+                return;
+
+        if (!cpu_online(cpu))
+                return;
+
+        if (ppc_md.kexec_cpu_down)
+                ppc_md.kexec_cpu_down(1, 1);
+
+        local_irq_disable();
+
+        crash_save_this_cpu(regs, cpu);
+        atomic_dec(&waiting_for_crash_ipi);
+        kexec_smp_wait();
+        /* NOTREACHED */
+}
+
+static void crash_kexec_prepare_cpus(void)
+{
+        unsigned int msecs;
+
+        atomic_set(&waiting_for_crash_ipi, num_online_cpus() - 1);
+
+        crash_send_ipi(crash_ipi_callback);
+        smp_wmb();
+
+        /*
+         * FIXME: Until we will have the way to stop other CPUSs reliabally,
+         * the crash CPU will send an IPI and wait for other CPUs to
+         * respond. If not, proceed the kexec boot even though we failed to
+         * capture other CPU states.
+         */
+        msecs = 1000000;
+        while ((atomic_read(&waiting_for_crash_ipi) > 0) && (--msecs > 0)) {
+                barrier();
+                mdelay(1);
+        }
+
+        /* Would it be better to replace the trap vector here? */
+
+        /*
+         * FIXME: In case if we do not get all CPUs, one possibility: ask the
+         * user to do soft reset such that we get all.
+         * IPI handler is already set by the panic cpu initially. Therefore,
+         * all cpus could invoke this handler from die() and the panic CPU
+         * will call machine_kexec() directly from this handler to do
+         * kexec boot.
+         */
+        if (atomic_read(&waiting_for_crash_ipi))
+                printk(KERN_ALERT "done waiting: %d cpus not responding\n",
+                        atomic_read(&waiting_for_crash_ipi));
+        /* Leave the IPI callback set */
+}
+#else
+static void crash_kexec_prepare_cpus(void)
+{
+        /*
+         * move the secondarys to us so that we can copy
+         * the new kernel 0-0x100 safely
+         *
+         * do this if kexec in setup.c ?
+         */
+        smp_release_cpus();
+}
+
+#endif
+
+void default_machine_crash_shutdown(struct pt_regs *regs)
+{
+        /*
+         * This function is only called after the system
+         * has paniced or is otherwise in a critical state.
+         * The minimum amount of code to allow a kexec'd kernel
+         * to run successfully needs to happen here.
+         *
+         * In practice this means stopping other cpus in
+         * an SMP system.
+         * The kernel is broken so disable interrupts.
+         */
+        local_irq_disable();
+
+        if (ppc_md.kexec_cpu_down)
+                ppc_md.kexec_cpu_down(1, 0);
+
+        /*
+         * Make a note of crashing cpu. Will be used in machine_kexec
+         * such that another IPI will not be sent.
+         */
+        crashing_cpu = smp_processor_id();
+        crash_kexec_prepare_cpus();
+        crash_save_self(regs);
+}
diff --git a/arch/powerpc/kernel/crash_dump.c b/arch/powerpc/kernel/crash_dump.c
new file mode 100644
index 000000000000..87effa3f21a7
--- /dev/null
+++ b/arch/powerpc/kernel/crash_dump.c
@@ -0,0 +1,109 @@
+/*
+ * Routines for doing kexec-based kdump.
+ *
+ * Copyright (C) 2005, IBM Corp.
+ *
+ * Created by: Michael Ellerman
+ *
+ * This source code is licensed under the GNU General Public License,
+ * Version 2.  See the file COPYING for more details.
+ */
+
+#undef DEBUG
+
+#include <linux/crash_dump.h>
+#include <linux/bootmem.h>
+#include <asm/kdump.h>
+#include <asm/lmb.h>
+#include <asm/firmware.h>
+#include <asm/uaccess.h>
+
+#ifdef DEBUG
+#include <asm/udbg.h>
+#define DBG(fmt...) udbg_printf(fmt)
+#else
+#define DBG(fmt...)
+#endif
+
+static void __init create_trampoline(unsigned long addr)
+{
+        /* The maximum range of a single instruction branch, is the current
+         * instruction's address + (32 MB - 4) bytes. For the trampoline we
+         * need to branch to current address + 32 MB. So we insert a nop at
+         * the trampoline address, then the next instruction (+ 4 bytes)
+         * does a branch to (32 MB - 4). The net effect is that when we
+         * branch to "addr" we jump to ("addr" + 32 MB). Although it requires
+         * two instructions it doesn't require any registers.
+         */
+        create_instruction(addr, 0x60000000); /* nop */
+        create_branch(addr + 4, addr + PHYSICAL_START, 0);
+}
+
+void __init kdump_setup(void)
+{
+        unsigned long i;
+
+        DBG(" -> kdump_setup()\n");
+
+        for (i = KDUMP_TRAMPOLINE_START; i < KDUMP_TRAMPOLINE_END; i += 8) {
+                create_trampoline(i);
+        }
+
+        create_trampoline(__pa(system_reset_fwnmi) - PHYSICAL_START);
+        create_trampoline(__pa(machine_check_fwnmi) - PHYSICAL_START);
+
+        DBG(" <- kdump_setup()\n");
+}
+
+static int __init parse_elfcorehdr(char *p)
+{
+        if (p)
+                elfcorehdr_addr = memparse(p, &p);
+
+        return 0;
+}
+__setup("elfcorehdr=", parse_elfcorehdr);
+
+static int __init parse_savemaxmem(char *p)
+{
+        if (p)
+                saved_max_pfn = (memparse(p, &p) >> PAGE_SHIFT) - 1;
+
+        return 0;
+}
+__setup("savemaxmem=", parse_savemaxmem);
+
+/*
+ * copy_oldmem_page - copy one page from "oldmem"
+ * @pfn: page frame number to be copied
+ * @buf: target memory address for the copy; this can be in kernel address
+ *      space or user address space (see @userbuf)
+ * @csize: number of bytes to copy
+ * @offset: offset in bytes into the page (based on pfn) to begin the copy
+ * @userbuf: if set, @buf is in user address space, use copy_to_user(),
+ *      otherwise @buf is in kernel address space, use memcpy().
+ *
+ * Copy a page from "oldmem". For this page, there is no pte mapped
+ * in the current kernel. We stitch up a pte, similar to kmap_atomic.
+ */
+ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
+                        size_t csize, unsigned long offset, int userbuf)
+{
+        void  *vaddr;
+
+        if (!csize)
+                return 0;
+
+        vaddr = __ioremap(pfn << PAGE_SHIFT, PAGE_SIZE, 0);
+
+        if (userbuf) {
+                if (copy_to_user((char __user *)buf, (vaddr + offset), csize)) {
+                        iounmap(vaddr);
+                        return -EFAULT;
+                }
+        } else
+                memcpy(buf, (vaddr + offset), csize);
+
+        iounmap(vaddr);
+        return csize;
+}
diff --git a/arch/powerpc/kernel/dma_64.c b/arch/powerpc/kernel/dma_64.c
index 7c3419656ccc..36aaa7663f02 100644
--- a/arch/powerpc/kernel/dma_64.c
+++ b/arch/powerpc/kernel/dma_64.c
@@ -10,6 +10,7 @@
 /* Include the busses we support */
 #include <linux/pci.h>
 #include <asm/vio.h>
+#include <asm/ibmebus.h>
 #include <asm/scatterlist.h>
 #include <asm/bug.h>
 
@@ -23,6 +24,10 @@ static struct dma_mapping_ops *get_dma_ops(struct device *dev)
         if (dev->bus == &vio_bus_type)
                 return &vio_dma_ops;
 #endif
+#ifdef CONFIG_IBMEBUS
+        if (dev->bus == &ibmebus_bus_type)
+                return &ibmebus_dma_ops;
+#endif
         return NULL;
 }
 
@@ -47,6 +52,10 @@ int dma_set_mask(struct device *dev, u64 dma_mask)
         if (dev->bus == &vio_bus_type)
                 return -EIO;
 #endif /* CONFIG_IBMVIO */
+#ifdef CONFIG_IBMEBUS
+        if (dev->bus == &ibmebus_bus_type)
+                return -EIO;
+#endif
         BUG();
         return 0;
 }
diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S
index 2e99ae41723c..036b71d2adfc 100644
--- a/arch/powerpc/kernel/entry_32.S
+++ b/arch/powerpc/kernel/entry_32.S
@@ -200,8 +200,6 @@ _GLOBAL(DoSyscall)
         bl      do_show_syscall
 #endif /* SHOW_SYSCALLS */
         rlwinm  r10,r1,0,0,(31-THREAD_SHIFT)    /* current_thread_info() */
-        li      r11,0
-        stb     r11,TI_SC_NOERR(r10)
         lwz     r11,TI_FLAGS(r10)
         andi.   r11,r11,_TIF_SYSCALL_T_OR_A
         bne-    syscall_dotrace
@@ -222,25 +220,21 @@ ret_from_syscall:
         bl      do_show_syscall_exit
 #endif
         mr      r6,r3
-        li      r11,-_LAST_ERRNO
-        cmplw   0,r3,r11
         rlwinm  r12,r1,0,0,(31-THREAD_SHIFT)    /* current_thread_info() */
-        blt+    30f
-        lbz     r11,TI_SC_NOERR(r12)
-        cmpwi   r11,0
-        bne     30f
-        neg     r3,r3
-        lwz     r10,_CCR(r1)    /* Set SO bit in CR */
-        oris    r10,r10,0x1000
-        stw     r10,_CCR(r1)
-
         /* disable interrupts so current_thread_info()->flags can't change */
-30:     LOAD_MSR_KERNEL(r10,MSR_KERNEL) /* doesn't include MSR_EE */
+        LOAD_MSR_KERNEL(r10,MSR_KERNEL) /* doesn't include MSR_EE */
         SYNC
         MTMSRD(r10)
         lwz     r9,TI_FLAGS(r12)
-        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SIGPENDING|_TIF_NEED_RESCHED)
+        li      r8,-_LAST_ERRNO
+        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SIGPENDING|_TIF_NEED_RESCHED|_TIF_RESTOREALL)
         bne-    syscall_exit_work
+        cmplw   0,r3,r8
+        blt+    syscall_exit_cont
+        lwz     r11,_CCR(r1)                    /* Load CR */
+        neg     r3,r3
+        oris    r11,r11,0x1000  /* Set SO bit in CR */
+        stw     r11,_CCR(r1)
 syscall_exit_cont:
 #if defined(CONFIG_4xx) || defined(CONFIG_BOOKE)
         /* If the process has its own DBCR0 value, load it up.  The single
@@ -292,46 +286,113 @@ syscall_dotrace:
         b       syscall_dotrace_cont
 
 syscall_exit_work:
-        stw     r6,RESULT(r1)   /* Save result */
+        andi.   r0,r9,_TIF_RESTOREALL
+        bne-    2f
+        cmplw   0,r3,r8
+        blt+    1f
+        andi.   r0,r9,_TIF_NOERROR
+        bne-    1f
+        lwz     r11,_CCR(r1)                    /* Load CR */
+        neg     r3,r3
+        oris    r11,r11,0x1000  /* Set SO bit in CR */
+        stw     r11,_CCR(r1)
+
+1:      stw     r6,RESULT(r1)   /* Save result */
         stw     r3,GPR3(r1)     /* Update return value */
-        andi.   r0,r9,_TIF_SYSCALL_T_OR_A
-        beq     5f
-        ori     r10,r10,MSR_EE
-        SYNC
-        MTMSRD(r10)             /* re-enable interrupts */
+2:      andi.   r0,r9,(_TIF_PERSYSCALL_MASK)
+        beq     4f
+
+        /* Clear per-syscall TIF flags if any are set, but _leave_
+        _TIF_SAVE_NVGPRS set in r9 since we haven't dealt with that
+        yet.  */
+
+        li      r11,_TIF_PERSYSCALL_MASK
+        addi    r12,r12,TI_FLAGS
+3:      lwarx   r8,0,r12
+        andc    r8,r8,r11
+#ifdef CONFIG_IBM405_ERR77
+        dcbt    0,r12
+#endif
+        stwcx.  r8,0,r12
+        bne-    3b
+        subi    r12,r12,TI_FLAGS
+        
+4:      /* Anything which requires enabling interrupts? */
+        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP|_TIF_SAVE_NVGPRS)
+        beq     7f
+
+        /* Save NVGPRS if they're not saved already */
         lwz     r4,_TRAP(r1)
         andi.   r4,r4,1
-        beq     4f
+        beq     5f
         SAVE_NVGPRS(r1)
         li      r4,0xc00
         stw     r4,_TRAP(r1)
-4:
+
+        /* Re-enable interrupts */
+5:      ori     r10,r10,MSR_EE
+        SYNC
+        MTMSRD(r10)
+
+        andi.   r0,r9,_TIF_SAVE_NVGPRS
+        bne     save_user_nvgprs
+
+save_user_nvgprs_cont:
+        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP)
+        beq     7f
+
         addi    r3,r1,STACK_FRAME_OVERHEAD
         bl      do_syscall_trace_leave
         REST_NVGPRS(r1)
-2:
-        lwz     r3,GPR3(r1)
+
+6:      lwz     r3,GPR3(r1)
         LOAD_MSR_KERNEL(r10,MSR_KERNEL) /* doesn't include MSR_EE */
         SYNC
         MTMSRD(r10)             /* disable interrupts again */
         rlwinm  r12,r1,0,0,(31-THREAD_SHIFT)    /* current_thread_info() */
         lwz     r9,TI_FLAGS(r12)
-5:
+7:
         andi.   r0,r9,_TIF_NEED_RESCHED
-        bne     1f
+        bne     8f
         lwz     r5,_MSR(r1)
         andi.   r5,r5,MSR_PR
-        beq     syscall_exit_cont
+        beq     ret_from_except
         andi.   r0,r9,_TIF_SIGPENDING
-        beq     syscall_exit_cont
+        beq     ret_from_except
         b       do_user_signal
-1:
+8:
         ori     r10,r10,MSR_EE
         SYNC
         MTMSRD(r10)             /* re-enable interrupts */
         bl      schedule
-        b       2b
+        b       6b
+
+save_user_nvgprs:
+        lwz     r8,TI_SIGFRAME(r12)
+
+.macro savewords start, end
+  1:    stw \start,4*(\start)(r8)
+        .section __ex_table,"a"
+        .align  2
+        .long   1b,save_user_nvgprs_fault
+        .previous
+        .if \end - \start
+        savewords "(\start+1)",\end
+        .endif
+.endm   
+        savewords 14,31
+        b       save_user_nvgprs_cont
+
+        
+save_user_nvgprs_fault:
+        li      r3,11           /* SIGSEGV */
+        lwz     r4,TI_TASK(r12)
+        bl      force_sigsegv
 
+        rlwinm  r12,r1,0,0,(31-THREAD_SHIFT)    /* current_thread_info() */
+        lwz     r9,TI_FLAGS(r12)
+        b       save_user_nvgprs_cont
+        
 #ifdef SHOW_SYSCALLS
 do_show_syscall:
 #ifdef SHOW_SYSCALLS_TASK
@@ -401,28 +462,10 @@ show_syscalls_task:
 #endif /* SHOW_SYSCALLS */
 
 /*
- * The sigsuspend and rt_sigsuspend system calls can call do_signal
- * and thus put the process into the stopped state where we might
- * want to examine its user state with ptrace.  Therefore we need
- * to save all the nonvolatile registers (r13 - r31) before calling
- * the C code.
+ * The fork/clone functions need to copy the full register set into
+ * the child process. Therefore we need to save all the nonvolatile
+ * registers (r13 - r31) before calling the C code.
  */
-        .globl  ppc_sigsuspend
-ppc_sigsuspend:
-        SAVE_NVGPRS(r1)
-        lwz     r0,_TRAP(r1)
-        rlwinm  r0,r0,0,0,30            /* clear LSB to indicate full */
-        stw     r0,_TRAP(r1)            /* register set saved */
-        b       sys_sigsuspend
-
-        .globl  ppc_rt_sigsuspend
-ppc_rt_sigsuspend:
-        SAVE_NVGPRS(r1)
-        lwz     r0,_TRAP(r1)
-        rlwinm  r0,r0,0,0,30
-        stw     r0,_TRAP(r1)
-        b       sys_rt_sigsuspend
-
         .globl  ppc_fork
 ppc_fork:
         SAVE_NVGPRS(r1)
@@ -447,14 +490,6 @@ ppc_clone:
         stw     r0,_TRAP(r1)            /* register set saved */
         b       sys_clone
 
-        .globl  ppc_swapcontext
-ppc_swapcontext:
-        SAVE_NVGPRS(r1)
-        lwz     r0,_TRAP(r1)
-        rlwinm  r0,r0,0,0,30            /* clear LSB to indicate full */
-        stw     r0,_TRAP(r1)            /* register set saved */
-        b       sys_swapcontext
-
 /*
  * Top-level page fault handling.
  * This is in assembler because if do_page_fault tells us that
@@ -626,16 +661,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_601)
         .long   ret_from_except
 #endif
 
-        .globl  sigreturn_exit
-sigreturn_exit:
-        subi    r1,r3,STACK_FRAME_OVERHEAD
-        rlwinm  r12,r1,0,0,(31-THREAD_SHIFT)    /* current_thread_info() */
-        lwz     r9,TI_FLAGS(r12)
-        andi.   r0,r9,_TIF_SYSCALL_T_OR_A
-        beq+    ret_from_except_full
-        bl      do_syscall_trace_leave
-        /* fall through */
-
         .globl  ret_from_except_full
 ret_from_except_full:
         REST_NVGPRS(r1)
@@ -658,7 +683,7 @@ user_exc_return:		/* r10 contains MSR_KERNEL here */
         /* Check current_thread_info()->flags */
         rlwinm  r9,r1,0,0,(31-THREAD_SHIFT)
         lwz     r9,TI_FLAGS(r9)
-        andi.   r0,r9,(_TIF_SIGPENDING|_TIF_NEED_RESCHED)
+        andi.   r0,r9,(_TIF_SIGPENDING|_TIF_NEED_RESCHED|_TIF_RESTOREALL)
         bne     do_work
 
 restore_user:
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index bce33a38399f..aacebb33e98a 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -113,9 +113,7 @@ system_call_common:
         addi    r9,r1,STACK_FRAME_OVERHEAD
 #endif
         clrrdi  r11,r1,THREAD_SHIFT
-        li      r12,0
         ld      r10,TI_FLAGS(r11)
-        stb     r12,TI_SC_NOERR(r11)
         andi.   r11,r10,_TIF_SYSCALL_T_OR_A
         bne-    syscall_dotrace
 syscall_dotrace_cont:
@@ -144,24 +142,12 @@ system_call:			/* label this so stack traces look sane */
         bctrl                   /* Call handler */
 
 syscall_exit:
+        std     r3,RESULT(r1)
 #ifdef SHOW_SYSCALLS
-        std     r3,GPR3(r1)
         bl      .do_show_syscall_exit
-        ld      r3,GPR3(r1)
+        ld      r3,RESULT(r1)
 #endif
-        std     r3,RESULT(r1)
-        ld      r5,_CCR(r1)
-        li      r10,-_LAST_ERRNO
-        cmpld   r3,r10
         clrrdi  r12,r1,THREAD_SHIFT
-        bge-    syscall_error
-syscall_error_cont:
-
-        /* check for syscall tracing or audit */
-        ld      r9,TI_FLAGS(r12)
-        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP)
-        bne-    syscall_exit_trace
-syscall_exit_trace_cont:
 
         /* disable interrupts so current_thread_info()->flags can't change,
            and so that we don't get interrupted after loading SRR0/1. */
@@ -173,8 +159,13 @@ syscall_exit_trace_cont:
         rotldi  r10,r10,16
         mtmsrd  r10,1
         ld      r9,TI_FLAGS(r12)
-        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SIGPENDING|_TIF_NEED_RESCHED)
+        li      r11,-_LAST_ERRNO
+        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP|_TIF_SIGPENDING|_TIF_NEED_RESCHED|_TIF_RESTOREALL|_TIF_SAVE_NVGPRS|_TIF_NOERROR)
         bne-    syscall_exit_work
+        cmpld   r3,r11
+        ld      r5,_CCR(r1)
+        bge-    syscall_error
+syscall_error_cont:
         ld      r7,_NIP(r1)
         stdcx.  r0,0,r1                 /* to clear the reservation */
         andi.   r6,r8,MSR_PR
@@ -193,21 +184,12 @@ syscall_exit_trace_cont:
         rfid
         b       .       /* prevent speculative execution */
 
-syscall_enosys:
-        li      r3,-ENOSYS
-        std     r3,RESULT(r1)
-        clrrdi  r12,r1,THREAD_SHIFT
-        ld      r5,_CCR(r1)
-
-syscall_error:
-        lbz     r11,TI_SC_NOERR(r12)
-        cmpwi   0,r11,0
-        bne-    syscall_error_cont
-        neg     r3,r3
+syscall_error:  
         oris    r5,r5,0x1000    /* Set SO bit in CR */
+        neg     r3,r3
         std     r5,_CCR(r1)
         b       syscall_error_cont
-        
+        
 /* Traced system call support */
 syscall_dotrace:
         bl      .save_nvgprs
@@ -225,21 +207,69 @@ syscall_dotrace:
         ld      r10,TI_FLAGS(r10)
         b       syscall_dotrace_cont
 
-syscall_exit_trace:
-        std     r3,GPR3(r1)
-        bl      .save_nvgprs
+syscall_enosys:
+        li      r3,-ENOSYS
+        b       syscall_exit
+        
+syscall_exit_work:
+        /* If TIF_RESTOREALL is set, don't scribble on either r3 or ccr.
+         If TIF_NOERROR is set, just save r3 as it is. */
+
+        andi.   r0,r9,_TIF_RESTOREALL
+        bne-    2f
+        cmpld   r3,r11          /* r10 is -LAST_ERRNO */
+        blt+    1f
+        andi.   r0,r9,_TIF_NOERROR
+        bne-    1f
+        ld      r5,_CCR(r1)
+        neg     r3,r3
+        oris    r5,r5,0x1000    /* Set SO bit in CR */
+        std     r5,_CCR(r1)
+1:      std     r3,GPR3(r1)
+2:      andi.   r0,r9,(_TIF_PERSYSCALL_MASK)
+        beq     4f
+
+        /* Clear per-syscall TIF flags if any are set, but _leave_
+        _TIF_SAVE_NVGPRS set in r9 since we haven't dealt with that
+        yet.  */
+
+        li      r11,_TIF_PERSYSCALL_MASK
+        addi    r12,r12,TI_FLAGS
+3:      ldarx   r10,0,r12
+        andc    r10,r10,r11
+        stdcx.  r10,0,r12
+        bne-    3b
+        subi    r12,r12,TI_FLAGS
+        
+4:      bl      .save_nvgprs
+        /* Anything else left to do? */
+        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP|_TIF_SAVE_NVGPRS)
+        beq     .ret_from_except_lite
+
+        /* Re-enable interrupts */
+        mfmsr   r10
+        ori     r10,r10,MSR_EE
+        mtmsrd  r10,1
+
+        andi.   r0,r9,_TIF_SAVE_NVGPRS
+        bne     save_user_nvgprs
+
+        /* If tracing, re-enable interrupts and do it */
+save_user_nvgprs_cont:  
+        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP)
+        beq     5f
+        
         addi    r3,r1,STACK_FRAME_OVERHEAD
         bl      .do_syscall_trace_leave
         REST_NVGPRS(r1)
-        ld      r3,GPR3(r1)
-        ld      r5,_CCR(r1)
         clrrdi  r12,r1,THREAD_SHIFT
-        b       syscall_exit_trace_cont
 
-/* Stuff to do on exit from a system call. */
-syscall_exit_work:
-        std     r3,GPR3(r1)
-        std     r5,_CCR(r1)
+        /* Disable interrupts again and handle other work if any */
+5:      mfmsr   r10
+        rldicl  r10,r10,48,1
+        rotldi  r10,r10,16
+        mtmsrd  r10,1
+
         b       .ret_from_except_lite
 
 /* Save non-volatile GPRs, if not already saved. */
@@ -252,6 +282,52 @@ _GLOBAL(save_nvgprs)
         std     r0,_TRAP(r1)
         blr
 
+
+save_user_nvgprs:
+        ld      r10,TI_SIGFRAME(r12)
+        andi.   r0,r9,_TIF_32BIT
+        beq-    save_user_nvgprs_64
+
+        /* 32-bit save to userspace */
+
+.macro savewords start, end
+  1:    stw \start,4*(\start)(r10)
+        .section __ex_table,"a"
+        .align  3
+        .llong  1b,save_user_nvgprs_fault
+        .previous
+        .if \end - \start
+        savewords "(\start+1)",\end
+        .endif
+.endm   
+        savewords 14,31
+        b       save_user_nvgprs_cont
+
+save_user_nvgprs_64:
+        /* 64-bit save to userspace */
+
+.macro savelongs start, end
+  1:    std \start,8*(\start)(r10)
+        .section __ex_table,"a"
+        .align  3
+        .llong  1b,save_user_nvgprs_fault
+        .previous
+        .if \end - \start
+        savelongs "(\start+1)",\end
+        .endif
+.endm   
+        savelongs 14,31
+        b       save_user_nvgprs_cont
+
+save_user_nvgprs_fault:
+        li      r3,11           /* SIGSEGV */
+        ld      r4,TI_TASK(r12)
+        bl      .force_sigsegv
+
+        clrrdi  r12,r1,THREAD_SHIFT
+        ld      r9,TI_FLAGS(r12)
+        b       save_user_nvgprs_cont
+        
 /*
  * The sigsuspend and rt_sigsuspend system calls can call do_signal
  * and thus put the process into the stopped state where we might
@@ -260,35 +336,6 @@ _GLOBAL(save_nvgprs)
  * the C code.  Similarly, fork, vfork and clone need the full
  * register state on the stack so that it can be copied to the child.
  */
-_GLOBAL(ppc32_sigsuspend)
-        bl      .save_nvgprs
-        bl      .compat_sys_sigsuspend
-        b       70f
-
-_GLOBAL(ppc64_rt_sigsuspend)
-        bl      .save_nvgprs
-        bl      .sys_rt_sigsuspend
-        b       70f
-
-_GLOBAL(ppc32_rt_sigsuspend)
-        bl      .save_nvgprs
-        bl      .compat_sys_rt_sigsuspend
-70:     cmpdi   0,r3,0
-        /* If it returned an error, we need to return via syscall_exit to set
-           the SO bit in cr0 and potentially stop for ptrace. */
-        bne     syscall_exit
-        /* If sigsuspend() returns zero, we are going into a signal handler. We
-           may need to call audit_syscall_exit() to mark the exit from sigsuspend() */
-#ifdef CONFIG_AUDITSYSCALL
-        ld      r3,PACACURRENT(r13)
-        ld      r4,AUDITCONTEXT(r3)
-        cmpdi   0,r4,0
-        beq     .ret_from_except        /* No audit_context: Leave immediately. */
-        li      r4, 2                   /* AUDITSC_FAILURE */
-        li      r5,-4                   /* It's always -EINTR */
-        bl      .audit_syscall_exit
-#endif
-        b       .ret_from_except
 
 _GLOBAL(ppc_fork)
         bl      .save_nvgprs
@@ -305,37 +352,6 @@ _GLOBAL(ppc_clone)
         bl      .sys_clone
         b       syscall_exit
 
-_GLOBAL(ppc32_swapcontext)
-        bl      .save_nvgprs
-        bl      .compat_sys_swapcontext
-        b       80f
-        
-_GLOBAL(ppc64_swapcontext)
-        bl      .save_nvgprs
-        bl      .sys_swapcontext
-        b       80f
-
-_GLOBAL(ppc32_sigreturn)
-        bl      .compat_sys_sigreturn
-        b       80f
-
-_GLOBAL(ppc32_rt_sigreturn)
-        bl      .compat_sys_rt_sigreturn
-        b       80f
-
-_GLOBAL(ppc64_rt_sigreturn)
-        bl      .sys_rt_sigreturn
-
-80:     cmpdi   0,r3,0
-        blt     syscall_exit
-        clrrdi  r4,r1,THREAD_SHIFT
-        ld      r4,TI_FLAGS(r4)
-        andi.   r4,r4,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP)
-        beq+    81f
-        addi    r3,r1,STACK_FRAME_OVERHEAD
-        bl      .do_syscall_trace_leave
-81:     b       .ret_from_except
-
 _GLOBAL(ret_from_fork)
         bl      .schedule_tail
         REST_NVGPRS(r1)
@@ -674,7 +690,7 @@ _GLOBAL(enter_rtas)
 
         /* Setup our real return addr */        
         SET_REG_TO_LABEL(r4,.rtas_return_loc)
-        SET_REG_TO_CONST(r9,KERNELBASE)
+        SET_REG_TO_CONST(r9,PAGE_OFFSET)
         sub     r4,r4,r9
         mtlr    r4
 
@@ -702,7 +718,7 @@ _GLOBAL(enter_rtas)
 _STATIC(rtas_return_loc)
         /* relocation is off at this point */
         mfspr   r4,SPRN_SPRG3           /* Get PACA */
-        SET_REG_TO_CONST(r5, KERNELBASE)
+        SET_REG_TO_CONST(r5, PAGE_OFFSET)
         sub     r4,r4,r5                /* RELOC the PACA base pointer */
 
         mfmsr   r6
diff --git a/arch/powerpc/kernel/head_32.S b/arch/powerpc/kernel/head_32.S
index ccdf94731e30..03b25f9359f8 100644
--- a/arch/powerpc/kernel/head_32.S
+++ b/arch/powerpc/kernel/head_32.S
@@ -120,10 +120,25 @@ __start:
  * because OF may have I/O devices mapped into that area
  * (particularly on CHRP).
  */
+#ifdef CONFIG_PPC_MULTIPLATFORM
         cmpwi   0,r5,0
         beq     1f
         bl      prom_init
         trap
+#endif
+
+/*
+ * Check for BootX signature when supporting PowerMac and branch to
+ * appropriate trampoline if it's present
+ */
+#ifdef CONFIG_PPC_PMAC
+1:      lis     r31,0x426f
+        ori     r31,r31,0x6f58
+        cmpw    0,r3,r31
+        bne     1f
+        bl      bootx_init
+        trap
+#endif /* CONFIG_PPC_PMAC */
 
 1:      mr      r31,r3                  /* save parameters */
         mr      r30,r4
@@ -153,6 +168,9 @@ __after_mmu_off:
         bl      flush_tlbs
 
         bl      initial_bats
+#if !defined(CONFIG_APUS) && defined(CONFIG_BOOTX_TEXT)
+        bl      setup_disp_bat
+#endif
 
 /*
  * Call setup_cpu for CPU 0 and initialize 6xx Idle
@@ -450,16 +468,11 @@ SystemCall:
  * by executing an altivec instruction.
  */
         . = 0xf00
-        b       Trap_0f
+        b       PerformanceMonitor
 
         . = 0xf20
         b       AltiVecUnavailable
 
-Trap_0f:
-        EXCEPTION_PROLOG
-        addi    r3,r1,STACK_FRAME_OVERHEAD
-        EXC_XFER_EE(0xf00, unknown_exception)
-
 /*
  * Handle TLB miss for instruction on 603/603e.
  * Note: we get an alternate set of r0 - r3 to use automatically.
@@ -703,6 +716,11 @@ AltiVecUnavailable:
 #endif /* CONFIG_ALTIVEC */
         EXC_XFER_EE_LITE(0xf20, altivec_unavailable_exception)
 
+PerformanceMonitor:
+        EXCEPTION_PROLOG
+        addi    r3,r1,STACK_FRAME_OVERHEAD
+        EXC_XFER_STD(0xf00, performance_monitor_exception)
+
 #ifdef CONFIG_ALTIVEC
 /* Note that the AltiVec support is closely modeled after the FP
  * support.  Changes to one are likely to be applicable to the
@@ -1306,6 +1324,32 @@ initial_bats:
         blr
 
 
+#if !defined(CONFIG_APUS) && defined(CONFIG_BOOTX_TEXT)
+setup_disp_bat:
+        /*
+         * setup the display bat prepared for us in prom.c
+         */
+        mflr    r8
+        bl      reloc_offset
+        mtlr    r8
+        addis   r8,r3,disp_BAT@ha
+        addi    r8,r8,disp_BAT@l
+        cmpwi   cr0,r8,0
+        beqlr
+        lwz     r11,0(r8)
+        lwz     r8,4(r8)
+        mfspr   r9,SPRN_PVR
+        rlwinm  r9,r9,16,16,31          /* r9 = 1 for 601, 4 for 604 */
+        cmpwi   0,r9,1
+        beq     1f
+        mtspr   SPRN_DBAT3L,r8
+        mtspr   SPRN_DBAT3U,r11
+        blr
+1:      mtspr   SPRN_IBAT3L,r8
+        mtspr   SPRN_IBAT3U,r11
+        blr
+#endif /* !defined(CONFIG_APUS) && defined(CONFIG_BOOTX_TEXT) */
+
 #ifdef CONFIG_8260
 /* Jump into the system reset for the rom.
  * We first disable the MMU, and then jump to the ROM reset address.
diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index 8a8bf79ef044..1c066d125375 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -154,11 +154,15 @@ _GLOBAL(__secondary_hold)
         bne     100b
 
 #ifdef CONFIG_HMT
-        b       .hmt_init
+        LOADADDR(r4, .hmt_init)
+        mtctr   r4
+        bctr
 #else
 #ifdef CONFIG_SMP
+        LOADADDR(r4, .pSeries_secondary_smp_init)
+        mtctr   r4
         mr      r3,r24
-        b       .pSeries_secondary_smp_init
+        bctr
 #else
         BUG_OPCODE
 #endif
@@ -200,6 +204,20 @@ exception_marker:
 #define EX_R3           64
 #define EX_LR           72
 
+/*
+ * We're short on space and time in the exception prolog, so we can't use
+ * the normal LOADADDR macro. Normally we just need the low halfword of the
+ * address, but for Kdump we need the whole low word.
+ */
+#ifdef CONFIG_CRASH_DUMP
+#define LOAD_HANDLER(reg, label)                                        \
+        oris    reg,reg,(label)@h;      /* virt addr of handler ... */  \
+        ori     reg,reg,(label)@l;      /* .. and the rest */
+#else
+#define LOAD_HANDLER(reg, label)                                        \
+        ori     reg,reg,(label)@l;      /* virt addr of handler ... */
+#endif
+
 #define EXCEPTION_PROLOG_PSERIES(area, label)                           \
         mfspr   r13,SPRN_SPRG3;         /* get paca address into r13 */ \
         std     r9,area+EX_R9(r13);     /* save r9 - r12 */             \
@@ -212,7 +230,7 @@ exception_marker:
         clrrdi  r12,r13,32;             /* get high part of &label */   \
         mfmsr   r10;                                                    \
         mfspr   r11,SPRN_SRR0;          /* save SRR0 */                 \
-        ori     r12,r12,(label)@l;      /* virt addr of handler */      \
+        LOAD_HANDLER(r12,label)                                         \
         ori     r10,r10,MSR_IR|MSR_DR|MSR_RI;                           \
         mtspr   SPRN_SRR0,r12;                                          \
         mfspr   r12,SPRN_SRR1;          /* and SRR1 */                  \
@@ -553,6 +571,7 @@ slb_miss_user_pseries:
  * Vectors for the FWNMI option.  Share common code.
  */
         .globl system_reset_fwnmi
+      .align 7
 system_reset_fwnmi:
         HMT_MEDIUM
         mtspr   SPRN_SPRG1,r13          /* save r13 */
@@ -560,6 +579,7 @@ system_reset_fwnmi:
         EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, system_reset_common)
 
         .globl machine_check_fwnmi
+      .align 7
 machine_check_fwnmi:
         HMT_MEDIUM
         mtspr   SPRN_SPRG1,r13          /* save r13 */
@@ -726,7 +746,8 @@ iSeries_secondary_smp_loop:
 decrementer_iSeries_masked:
         li      r11,1
         stb     r11,PACALPPACA+LPPACADECRINT(r13)
-        lwz     r12,PACADEFAULTDECR(r13)
+        LOADBASE(r12,tb_ticks_per_jiffy)
+        lwz     r12,OFF(tb_ticks_per_jiffy)(r12)
         mtspr   SPRN_DEC,r12
         /* fall through */
 
@@ -1345,7 +1366,7 @@ _GLOBAL(do_stab_bolted)
  * fixed address (the linker can't compute (u64)&initial_stab >>
  * PAGE_SHIFT).
  */
-        . = STAB0_PHYS_ADDR     /* 0x6000 */
+        . = STAB0_OFFSET        /* 0x6000 */
         .globl initial_stab
 initial_stab:
         .space  4096
@@ -1485,11 +1506,13 @@ _STATIC(__mmu_off)
  *
  */
 _GLOBAL(__start_initialization_multiplatform)
+#ifdef CONFIG_PPC_MULTIPLATFORM
         /*
          * Are we booted from a PROM Of-type client-interface ?
          */
         cmpldi  cr0,r5,0
         bne     .__boot_from_prom               /* yes -> prom */
+#endif
 
         /* Save parameters */
         mr      r31,r3
@@ -1510,6 +1533,7 @@ _GLOBAL(__start_initialization_multiplatform)
         bl      .__mmu_off
         b       .__after_prom_start
 
+#ifdef CONFIG_PPC_MULTIPLATFORM
 _STATIC(__boot_from_prom)
         /* Save parameters */
         mr      r31,r3
@@ -1542,6 +1566,7 @@ _STATIC(__boot_from_prom)
         bl      .prom_init
         /* We never return */
         trap
+#endif
 
 /*
  * At this point, r3 contains the physical address we are running at,
@@ -1550,7 +1575,7 @@ _STATIC(__boot_from_prom)
 _STATIC(__after_prom_start)
 
 /*
- * We need to run with __start at physical address 0.
+ * We need to run with __start at physical address PHYSICAL_START.
  * This will leave some code in the first 256B of
  * real memory, which are reserved for software use.
  * The remainder of the first page is loaded with the fixed
@@ -1565,7 +1590,7 @@ _STATIC(__after_prom_start)
         mr      r26,r3
         SET_REG_TO_CONST(r27,KERNELBASE)
 
-        li      r3,0                    /* target addr */
+        LOADADDR(r3, PHYSICAL_START)    /* target addr */
 
         // XXX FIXME: Use phys returned by OF (r30)
         add     r4,r27,r26              /* source addr                   */
@@ -1846,7 +1871,7 @@ _STATIC(start_here_multiplatform)
         mulli   r13,r27,PACA_SIZE       /* Calculate vaddr of right paca */
         add     r13,r13,r24             /* for this processor.           */
         add     r13,r13,r26             /* convert to physical addr      */
-        mtspr   SPRN_SPRG3,r13          /* PPPBBB: Temp... -Peter */
+        mtspr   SPRN_SPRG3,r13
         
         /* Do very early kernel initializations, including initial hash table,
          * stab and slb setup before we turn on relocation.     */
diff --git a/arch/powerpc/kernel/ibmebus.c b/arch/powerpc/kernel/ibmebus.c
new file mode 100644
index 000000000000..e47d40ac6f39
--- /dev/null
+++ b/arch/powerpc/kernel/ibmebus.c
@@ -0,0 +1,396 @@
+/*
+ * IBM PowerPC IBM eBus Infrastructure Support.
+ *
+ * Copyright (c) 2005 IBM Corporation
+ *  Heiko J Schick <schickhj@de.ibm.com>
+ *    
+ * All rights reserved.
+ *
+ * This source code is distributed under a dual license of GPL v2.0 and OpenIB 
+ * BSD. 
+ *
+ * OpenIB BSD License
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions are met: 
+ *
+ * Redistributions of source code must retain the above copyright notice, this 
+ * list of conditions and the following disclaimer. 
+ *
+ * Redistributions in binary form must reproduce the above copyright notice, 
+ * this list of conditions and the following disclaimer in the documentation 
+ * and/or other materials
+ * provided with the distribution. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/init.h>
+#include <linux/console.h>
+#include <linux/kobject.h>
+#include <linux/dma-mapping.h>
+#include <linux/interrupt.h>
+#include <asm/ibmebus.h>
+#include <asm/abs_addr.h>
+
+static struct ibmebus_dev ibmebus_bus_device = { /* fake "parent" device */
+        .name = ibmebus_bus_device.ofdev.dev.bus_id,
+        .ofdev.dev.bus_id = "ibmebus",
+        .ofdev.dev.bus    = &ibmebus_bus_type,
+};
+
+static void *ibmebus_alloc_coherent(struct device *dev,
+                                    size_t size,
+                                    dma_addr_t *dma_handle,
+                                    gfp_t flag)
+{
+        void *mem;
+        
+        mem = kmalloc(size, flag);
+        *dma_handle = (dma_addr_t)mem;
+
+        return mem;
+}
+
+static void ibmebus_free_coherent(struct device *dev,
+                                  size_t size, void *vaddr, 
+                                  dma_addr_t dma_handle)
+{
+        kfree(vaddr);
+}
+
+static dma_addr_t ibmebus_map_single(struct device *dev,
+                                     void *ptr,
+                                     size_t size,
+                                     enum dma_data_direction direction)
+{
+        return (dma_addr_t)(ptr);
+}
+
+static void ibmebus_unmap_single(struct device *dev,
+                                 dma_addr_t dma_addr,
+                                 size_t size, 
+                                 enum dma_data_direction direction)
+{
+        return;
+}
+
+static int ibmebus_map_sg(struct device *dev,
+                          struct scatterlist *sg,
+                          int nents, enum dma_data_direction direction)
+{
+        int i;
+        
+        for (i = 0; i < nents; i++) {
+                sg[i].dma_address = (dma_addr_t)page_address(sg[i].page) 
+                        + sg[i].offset;
+                sg[i].dma_length = sg[i].length;
+        }
+        
+        return nents;
+}
+
+static void ibmebus_unmap_sg(struct device *dev,
+                             struct scatterlist *sg,
+                             int nents, enum dma_data_direction direction)
+{
+        return;
+}
+
+static int ibmebus_dma_supported(struct device *dev, u64 mask)
+{
+        return 1;
+}
+
+struct dma_mapping_ops ibmebus_dma_ops = {
+        .alloc_coherent = ibmebus_alloc_coherent,
+        .free_coherent  = ibmebus_free_coherent,
+        .map_single     = ibmebus_map_single,
+        .unmap_single   = ibmebus_unmap_single,
+        .map_sg         = ibmebus_map_sg,
+        .unmap_sg       = ibmebus_unmap_sg,
+        .dma_supported  = ibmebus_dma_supported,
+};
+
+static int ibmebus_bus_probe(struct device *dev)
+{
+        struct ibmebus_dev *ibmebusdev    = to_ibmebus_dev(dev);
+        struct ibmebus_driver *ibmebusdrv = to_ibmebus_driver(dev->driver);
+        const struct of_device_id *id;
+        int error = -ENODEV;
+        
+        if (!ibmebusdrv->probe)
+                return error;
+        
+        id = of_match_device(ibmebusdrv->id_table, &ibmebusdev->ofdev);
+        if (id) {
+                error = ibmebusdrv->probe(ibmebusdev, id);
+        }
+        
+        return error;
+}
+
+static int ibmebus_bus_remove(struct device *dev)
+{
+        struct ibmebus_dev *ibmebusdev    = to_ibmebus_dev(dev);
+        struct ibmebus_driver *ibmebusdrv = to_ibmebus_driver(dev->driver);
+        
+        if (ibmebusdrv->remove) {
+                return ibmebusdrv->remove(ibmebusdev);
+        }
+        
+        return 0;
+}
+
+static void __devinit ibmebus_dev_release(struct device *dev)
+{
+        of_node_put(to_ibmebus_dev(dev)->ofdev.node);
+        kfree(to_ibmebus_dev(dev));
+}
+
+static ssize_t ibmebusdev_show_name(struct device *dev, 
+                                    struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%s\n", to_ibmebus_dev(dev)->name);
+}
+static DEVICE_ATTR(name, S_IRUSR | S_IRGRP | S_IROTH, ibmebusdev_show_name, 
+                   NULL);
+
+static struct ibmebus_dev* __devinit ibmebus_register_device_common(
+        struct ibmebus_dev *dev, char *name)
+{
+        int err = 0;
+
+        dev->name = name;
+        dev->ofdev.dev.parent  = &ibmebus_bus_device.ofdev.dev;
+        dev->ofdev.dev.bus     = &ibmebus_bus_type;
+        dev->ofdev.dev.release = ibmebus_dev_release;
+
+        /* An ibmebusdev is based on a of_device. We have to change the
+         * bus type to use our own DMA mapping operations. 
+         */       
+        if ((err = of_device_register(&dev->ofdev)) != 0) {
+                printk(KERN_ERR "%s: failed to register device (%d).\n",
+                       __FUNCTION__, err);
+                return NULL;
+        }
+        
+        device_create_file(&dev->ofdev.dev, &dev_attr_name);
+        
+        return dev;
+}
+
+static struct ibmebus_dev* __devinit ibmebus_register_device_node(
+        struct device_node *dn)
+{
+        struct ibmebus_dev *dev;
+        char *loc_code;
+        int length;
+
+        loc_code = (char *)get_property(dn, "ibm,loc-code", NULL);
+        if (!loc_code) {
+                printk(KERN_WARNING "%s: node %s missing 'ibm,loc-code'\n",
+                       __FUNCTION__, dn->name ? dn->name : "<unknown>");
+                return NULL;
+        }
+        
+        if (strlen(loc_code) == 0) {
+                printk(KERN_WARNING "%s: 'ibm,loc-code' is invalid\n",
+                       __FUNCTION__);
+                return NULL;
+        }
+
+        dev = kmalloc(sizeof(struct ibmebus_dev), GFP_KERNEL);
+        if (!dev) {
+                return NULL;
+        }
+        memset(dev, 0, sizeof(struct ibmebus_dev));
+
+        dev->ofdev.node = of_node_get(dn);
+       
+        length = strlen(loc_code);
+        memcpy(dev->ofdev.dev.bus_id, loc_code 
+                + (length - min(length, BUS_ID_SIZE - 1)), 
+                min(length, BUS_ID_SIZE - 1));
+
+        /* Register with generic device framework. */
+        if (ibmebus_register_device_common(dev, dn->name) == NULL) {
+                kfree(dev);
+                return NULL;
+        }
+
+        return dev;
+}
+
+static void ibmebus_probe_of_nodes(char* name)
+{
+        struct device_node *dn = NULL;
+        
+        while ((dn = of_find_node_by_name(dn, name))) {
+                if (ibmebus_register_device_node(dn) == NULL) {
+                        of_node_put(dn);
+                        
+                        return;
+                }
+        }
+        
+        of_node_put(dn);
+        
+        return;
+}
+
+static void ibmebus_add_devices_by_id(struct of_device_id *idt)
+{
+        while (strlen(idt->name) > 0) {
+                ibmebus_probe_of_nodes(idt->name);
+                idt++;
+        }
+
+        return;
+}
+
+static int ibmebus_match_helper(struct device *dev, void *data)
+{
+        if (strcmp((char*)data, to_ibmebus_dev(dev)->name) == 0)
+                return 1;
+        
+        return 0;
+}
+
+static int ibmebus_unregister_device(struct device *dev)
+{
+        device_remove_file(dev, &dev_attr_name);
+        of_device_unregister(to_of_device(dev));
+
+        return 0;
+}
+
+static void ibmebus_remove_devices_by_id(struct of_device_id *idt)
+{
+        struct device *dev;
+        
+        while (strlen(idt->name) > 0) {
+                while ((dev = bus_find_device(&ibmebus_bus_type, NULL, 
+                                              (void*)idt->name,
+                                              ibmebus_match_helper))) {
+                        ibmebus_unregister_device(dev);
+                }
+                idt++;
+                
+        }
+        
+        return;
+}
+
+int ibmebus_register_driver(struct ibmebus_driver *drv)
+{
+        int err = 0;
+
+        drv->driver.name   = drv->name;
+        drv->driver.bus    = &ibmebus_bus_type;
+        drv->driver.probe  = ibmebus_bus_probe;
+        drv->driver.remove = ibmebus_bus_remove;
+
+        if ((err = driver_register(&drv->driver) != 0))
+                return err;
+
+        ibmebus_add_devices_by_id(drv->id_table);
+        
+        return 0;
+}
+EXPORT_SYMBOL(ibmebus_register_driver);
+
+void ibmebus_unregister_driver(struct ibmebus_driver *drv)
+{       
+        driver_unregister(&drv->driver);
+        ibmebus_remove_devices_by_id(drv->id_table);
+}
+EXPORT_SYMBOL(ibmebus_unregister_driver);
+
+int ibmebus_request_irq(struct ibmebus_dev *dev,
+                        u32 ist, 
+                        irqreturn_t (*handler)(int, void*, struct pt_regs *),
+                        unsigned long irq_flags, const char * devname,
+                        void *dev_id)
+{
+        unsigned int irq = virt_irq_create_mapping(ist);
+        
+        if (irq == NO_IRQ)
+                return -EINVAL;
+        
+        irq = irq_offset_up(irq);
+        
+        return request_irq(irq, handler,
+                           irq_flags, devname, dev_id);
+}
+EXPORT_SYMBOL(ibmebus_request_irq);
+
+void ibmebus_free_irq(struct ibmebus_dev *dev, u32 ist, void *dev_id)
+{
+        unsigned int irq = virt_irq_create_mapping(ist);
+        
+        irq = irq_offset_up(irq);
+        free_irq(irq, dev_id);
+        
+        return;
+}
+EXPORT_SYMBOL(ibmebus_free_irq);
+
+static int ibmebus_bus_match(struct device *dev, struct device_driver *drv)
+{       
+        const struct ibmebus_dev *ebus_dev = to_ibmebus_dev(dev);
+        struct ibmebus_driver *ebus_drv    = to_ibmebus_driver(drv);
+        const struct of_device_id *ids     = ebus_drv->id_table;
+        const struct of_device_id *found_id;
+        
+        if (!ids)
+                return 0;
+        
+        found_id = of_match_device(ids, &ebus_dev->ofdev);
+        if (found_id)
+                return 1;
+        
+        return 0;
+}
+
+struct bus_type ibmebus_bus_type = {
+        .name = "ibmebus",
+        .match = ibmebus_bus_match,
+};
+EXPORT_SYMBOL(ibmebus_bus_type);
+
+static int __init ibmebus_bus_init(void)
+{
+        int err;
+        
+        printk(KERN_INFO "IBM eBus Device Driver\n");
+        
+        err = bus_register(&ibmebus_bus_type);
+        if (err) {
+                printk(KERN_ERR ":%s: failed to register IBM eBus.\n",
+                       __FUNCTION__);
+                return err;
+        }
+        
+        err = device_register(&ibmebus_bus_device.ofdev.dev);
+        if (err) {
+                printk(KERN_WARNING "%s: device_register returned %i\n", 
+                       __FUNCTION__, err);
+                bus_unregister(&ibmebus_bus_type);
+
+                return err;
+        }
+        
+        return 0;
+}
+__initcall(ibmebus_bus_init);
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 5a71ed9612fe..5651032d8706 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -31,7 +31,6 @@
  * to reduce code space and undefined function references.
  */
 
-#include <linux/errno.h>
 #include <linux/module.h>
 #include <linux/threads.h>
 #include <linux/kernel_stat.h>
@@ -44,18 +43,12 @@
 #include <linux/config.h>
 #include <linux/init.h>
 #include <linux/slab.h>
-#include <linux/pci.h>
 #include <linux/delay.h>
 #include <linux/irq.h>
-#include <linux/proc_fs.h>
-#include <linux/random.h>
 #include <linux/seq_file.h>
 #include <linux/cpumask.h>
 #include <linux/profile.h>
 #include <linux/bitops.h>
-#ifdef CONFIG_PPC64
-#include <linux/kallsyms.h>
-#endif
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -66,8 +59,7 @@
 #include <asm/prom.h>
 #include <asm/ptrace.h>
 #include <asm/machdep.h>
-#ifdef CONFIG_PPC64
-#include <asm/iseries/it_lp_queue.h>
+#ifdef CONFIG_PPC_ISERIES
 #include <asm/paca.h>
 #endif
 
@@ -78,10 +70,6 @@ EXPORT_SYMBOL(__irq_offset_value);
 
 static int ppc_spurious_interrupts;
 
-#if defined(CONFIG_PPC_ISERIES) && defined(CONFIG_SMP)
-extern void iSeries_smp_message_recv(struct pt_regs *);
-#endif
-
 #ifdef CONFIG_PPC32
 #define NR_MASK_WORDS   ((NR_IRQS + 31) / 32)
 
@@ -195,49 +183,6 @@ void fixup_irqs(cpumask_t map)
 }
 #endif
 
-#ifdef CONFIG_PPC_ISERIES
-void do_IRQ(struct pt_regs *regs)
-{
-        struct paca_struct *lpaca;
-
-        irq_enter();
-
-#ifdef CONFIG_DEBUG_STACKOVERFLOW
-        /* Debugging check for stack overflow: is there less than 2KB free? */
-        {
-                long sp;
-
-                sp = __get_SP() & (THREAD_SIZE-1);
-
-                if (unlikely(sp < (sizeof(struct thread_info) + 2048))) {
-                        printk("do_IRQ: stack overflow: %ld\n",
-                                sp - sizeof(struct thread_info));
-                        dump_stack();
-                }
-        }
-#endif
-
-        lpaca = get_paca();
-#ifdef CONFIG_SMP
-        if (lpaca->lppaca.int_dword.fields.ipi_cnt) {
-                lpaca->lppaca.int_dword.fields.ipi_cnt = 0;
-                iSeries_smp_message_recv(regs);
-        }
-#endif /* CONFIG_SMP */
-        if (hvlpevent_is_pending())
-                process_hvlpevents(regs);
-
-        irq_exit();
-
-        if (lpaca->lppaca.int_dword.fields.decr_int) {
-                lpaca->lppaca.int_dword.fields.decr_int = 0;
-                /* Signal a fake decrementer interrupt */
-                timer_interrupt(regs);
-        }
-}
-
-#else   /* CONFIG_PPC_ISERIES */
-
 void do_IRQ(struct pt_regs *regs)
 {
         int irq;
@@ -286,16 +231,24 @@ void do_IRQ(struct pt_regs *regs)
                 } else
 #endif
                         __do_IRQ(irq, regs);
-        } else
-#ifdef CONFIG_PPC32
-                if (irq != -2)
-#endif
-                        /* That's not SMP safe ... but who cares ? */
-                        ppc_spurious_interrupts++;
+        } else if (irq != -2)
+                /* That's not SMP safe ... but who cares ? */
+                ppc_spurious_interrupts++;
+
         irq_exit();
-}
 
-#endif  /* CONFIG_PPC_ISERIES */
+#ifdef CONFIG_PPC_ISERIES
+        {
+                struct paca_struct *lpaca = get_paca();
+
+                if (lpaca->lppaca.int_dword.fields.decr_int) {
+                        lpaca->lppaca.int_dword.fields.decr_int = 0;
+                        /* Signal a fake decrementer interrupt */
+                        timer_interrupt(regs);
+                }
+        }
+#endif
+}
 
 void __init init_IRQ(void)
 {
diff --git a/arch/powerpc/kernel/legacy_serial.c b/arch/powerpc/kernel/legacy_serial.c
new file mode 100644
index 000000000000..f970ace208d3
--- /dev/null
+++ b/arch/powerpc/kernel/legacy_serial.c
@@ -0,0 +1,557 @@
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/serial.h>
+#include <linux/serial_8250.h>
+#include <linux/serial_core.h>
+#include <linux/console.h>
+#include <linux/pci.h>
+#include <asm/io.h>
+#include <asm/mmu.h>
+#include <asm/prom.h>
+#include <asm/serial.h>
+#include <asm/udbg.h>
+#include <asm/pci-bridge.h>
+#include <asm/ppc-pci.h>
+
+#undef DEBUG
+
+#ifdef DEBUG
+#define DBG(fmt...) do { printk(fmt); } while(0)
+#else
+#define DBG(fmt...) do { } while(0)
+#endif
+
+#define MAX_LEGACY_SERIAL_PORTS 8
+
+static struct plat_serial8250_port
+legacy_serial_ports[MAX_LEGACY_SERIAL_PORTS+1];
+static struct legacy_serial_info {
+        struct device_node              *np;
+        unsigned int                    speed;
+        unsigned int                    clock;
+        phys_addr_t                     taddr;
+} legacy_serial_infos[MAX_LEGACY_SERIAL_PORTS];
+static unsigned int legacy_serial_count;
+static int legacy_serial_console = -1;
+
+static int __init add_legacy_port(struct device_node *np, int want_index,
+                                  int iotype, phys_addr_t base,
+                                  phys_addr_t taddr, unsigned long irq,
+                                  unsigned int flags)
+{
+        u32 *clk, *spd, clock = BASE_BAUD * 16;
+        int index;
+
+        /* get clock freq. if present */
+        clk = (u32 *)get_property(np, "clock-frequency", NULL);
+        if (clk && *clk)
+                clock = *clk;
+
+        /* get default speed if present */
+        spd = (u32 *)get_property(np, "current-speed", NULL);
+
+        /* If we have a location index, then try to use it */
+        if (want_index >= 0 && want_index < MAX_LEGACY_SERIAL_PORTS)
+                index = want_index;
+        else
+                index = legacy_serial_count;
+
+        /* if our index is still out of range, that mean that
+         * array is full, we could scan for a free slot but that
+         * make little sense to bother, just skip the port
+         */
+        if (index >= MAX_LEGACY_SERIAL_PORTS)
+                return -1;
+        if (index >= legacy_serial_count)
+                legacy_serial_count = index + 1;
+
+        /* Check if there is a port who already claimed our slot */
+        if (legacy_serial_infos[index].np != 0) {
+                /* if we still have some room, move it, else override */
+                if (legacy_serial_count < MAX_LEGACY_SERIAL_PORTS) {
+                        printk(KERN_INFO "Moved legacy port %d -> %d\n",
+                               index, legacy_serial_count);
+                        legacy_serial_ports[legacy_serial_count] =
+                                legacy_serial_ports[index];
+                        legacy_serial_infos[legacy_serial_count] =
+                                legacy_serial_infos[index];
+                        legacy_serial_count++;
+                } else {
+                        printk(KERN_INFO "Replacing legacy port %d\n", index);
+                }
+        }
+
+        /* Now fill the entry */
+        memset(&legacy_serial_ports[index], 0,
+               sizeof(struct plat_serial8250_port));
+        if (iotype == UPIO_PORT)
+                legacy_serial_ports[index].iobase = base;
+        else
+                legacy_serial_ports[index].mapbase = base;
+        legacy_serial_ports[index].iotype = iotype;
+        legacy_serial_ports[index].uartclk = clock;
+        legacy_serial_ports[index].irq = irq;
+        legacy_serial_ports[index].flags = flags;
+        legacy_serial_infos[index].taddr = taddr;
+        legacy_serial_infos[index].np = of_node_get(np);
+        legacy_serial_infos[index].clock = clock;
+        legacy_serial_infos[index].speed = spd ? *spd : 0;
+
+        printk(KERN_INFO "Found legacy serial port %d for %s\n",
+               index, np->full_name);
+        printk(KERN_INFO "  %s=%llx, taddr=%llx, irq=%lx, clk=%d, speed=%d\n",
+               (iotype == UPIO_PORT) ? "port" : "mem",
+               (unsigned long long)base, (unsigned long long)taddr, irq,
+               legacy_serial_ports[index].uartclk,
+               legacy_serial_infos[index].speed);
+
+        return index;
+}
+
+static int __init add_legacy_soc_port(struct device_node *np,
+                                      struct device_node *soc_dev)
+{
+        phys_addr_t addr;
+        u32 *addrp;
+        unsigned int flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | UPF_SHARE_IRQ;
+
+        /* We only support ports that have a clock frequency properly
+         * encoded in the device-tree.
+         */
+        if (get_property(np, "clock-frequency", NULL) == NULL)
+                return -1;
+
+        /* Get the address */
+        addrp = of_get_address(soc_dev, 0, NULL, NULL);
+        if (addrp == NULL)
+                return -1;
+
+        addr = of_translate_address(soc_dev, addrp);
+
+        /* Add port, irq will be dealt with later. We passed a translated
+         * IO port value. It will be fixed up later along with the irq
+         */
+        return add_legacy_port(np, -1, UPIO_MEM, addr, addr, NO_IRQ, flags);
+}
+
+#ifdef CONFIG_ISA
+static int __init add_legacy_isa_port(struct device_node *np,
+                                      struct device_node *isa_brg)
+{
+        u32 *reg;
+        char *typep;
+        int index = -1;
+        phys_addr_t taddr;
+
+        /* Get the ISA port number */
+        reg = (u32 *)get_property(np, "reg", NULL);
+        if (reg == NULL)
+                return -1;
+
+        /* Verify it's an IO port, we don't support anything else */
+        if (!(reg[0] & 0x00000001))
+                return -1;
+
+        /* Now look for an "ibm,aix-loc" property that gives us ordering
+         * if any...
+         */
+        typep = (char *)get_property(np, "ibm,aix-loc", NULL);
+
+        /* If we have a location index, then use it */
+        if (typep && *typep == 'S')
+                index = simple_strtol(typep+1, NULL, 0) - 1;
+
+        /* Translate ISA address */
+        taddr = of_translate_address(np, reg);
+
+        /* Add port, irq will be dealt with later */
+        return add_legacy_port(np, index, UPIO_PORT, reg[1], taddr, NO_IRQ, UPF_BOOT_AUTOCONF);
+
+}
+#endif
+
+#ifdef CONFIG_PCI
+static int __init add_legacy_pci_port(struct device_node *np,
+                                      struct device_node *pci_dev)
+{
+        phys_addr_t addr, base;
+        u32 *addrp;
+        unsigned int flags;
+        int iotype, index = -1, lindex = 0;
+
+        /* We only support ports that have a clock frequency properly
+         * encoded in the device-tree (that is have an fcode). Anything
+         * else can't be used that early and will be normally probed by
+         * the generic 8250_pci driver later on. The reason is that 8250
+         * compatible UARTs on PCI need all sort of quirks (port offsets
+         * etc...) that this code doesn't know about
+         */
+        if (get_property(np, "clock-frequency", NULL) == NULL)
+                return -1;
+
+        /* Get the PCI address. Assume BAR 0 */
+        addrp = of_get_pci_address(pci_dev, 0, NULL, &flags);
+        if (addrp == NULL)
+                return -1;
+
+        /* We only support BAR 0 for now */
+        iotype = (flags & IORESOURCE_MEM) ? UPIO_MEM : UPIO_PORT;
+        addr = of_translate_address(pci_dev, addrp);
+
+        /* Set the IO base to the same as the translated address for MMIO,
+         * or to the domain local IO base for PIO (it will be fixed up later)
+         */
+        if (iotype == UPIO_MEM)
+                base = addr;
+        else
+                base = addrp[2];
+
+        /* Try to guess an index... If we have subdevices of the pci dev,
+         * we get to their "reg" property
+         */
+        if (np != pci_dev) {
+                u32 *reg = (u32 *)get_property(np, "reg", NULL);
+                if (reg && (*reg < 4))
+                        index = lindex = *reg;
+        }
+
+        /* Local index means it's the Nth port in the PCI chip. Unfortunately
+         * the offset to add here is device specific. We know about those
+         * EXAR ports and we default to the most common case. If your UART
+         * doesn't work for these settings, you'll have to add your own special
+         * cases here
+         */
+        if (device_is_compatible(pci_dev, "pci13a8,152") ||
+            device_is_compatible(pci_dev, "pci13a8,154") ||
+            device_is_compatible(pci_dev, "pci13a8,158")) {
+                addr += 0x200 * lindex;
+                base += 0x200 * lindex;
+        } else {
+                addr += 8 * lindex;
+                base += 8 * lindex;
+        }
+
+        /* Add port, irq will be dealt with later. We passed a translated
+         * IO port value. It will be fixed up later along with the irq
+         */
+        return add_legacy_port(np, index, iotype, base, addr, NO_IRQ, UPF_BOOT_AUTOCONF);
+}
+#endif
+
+/*
+ * This is called very early, as part of setup_system() or eventually
+ * setup_arch(), basically before anything else in this file. This function
+ * will try to build a list of all the available 8250-compatible serial ports
+ * in the machine using the Open Firmware device-tree. It currently only deals
+ * with ISA and PCI busses but could be extended. It allows a very early boot
+ * console to be initialized, that list is also used later to provide 8250 with
+ * the machine non-PCI ports and to properly pick the default console port
+ */
+void __init find_legacy_serial_ports(void)
+{
+        struct device_node *np, *stdout = NULL;
+        char *path;
+        int index;
+
+        DBG(" -> find_legacy_serial_port()\n");
+
+        /* Now find out if one of these is out firmware console */
+        path = (char *)get_property(of_chosen, "linux,stdout-path", NULL);
+        if (path != NULL) {
+                stdout = of_find_node_by_path(path);
+                if (stdout)
+                        DBG("stdout is %s\n", stdout->full_name);
+        } else {
+                DBG(" no linux,stdout-path !\n");
+        }
+
+        /* First fill our array with SOC ports */
+        for (np = NULL; (np = of_find_compatible_node(np, "serial", "ns16550")) != NULL;) {
+                struct device_node *soc = of_get_parent(np);
+                if (soc && !strcmp(soc->type, "soc")) {
+                        index = add_legacy_soc_port(np, np);
+                        if (index >= 0 && np == stdout)
+                                legacy_serial_console = index;
+                }
+                of_node_put(soc);
+        }
+
+#ifdef CONFIG_ISA
+        /* First fill our array with ISA ports */
+        for (np = NULL; (np = of_find_node_by_type(np, "serial"));) {
+                struct device_node *isa = of_get_parent(np);
+                if (isa && !strcmp(isa->name, "isa")) {
+                        index = add_legacy_isa_port(np, isa);
+                        if (index >= 0 && np == stdout)
+                                legacy_serial_console = index;
+                }
+                of_node_put(isa);
+        }
+#endif
+
+#ifdef CONFIG_PCI
+        /* Next, try to locate PCI ports */
+        for (np = NULL; (np = of_find_all_nodes(np));) {
+                struct device_node *pci, *parent = of_get_parent(np);
+                if (parent && !strcmp(parent->name, "isa")) {
+                        of_node_put(parent);
+                        continue;
+                }
+                if (strcmp(np->name, "serial") && strcmp(np->type, "serial")) {
+                        of_node_put(parent);
+                        continue;
+                }
+                /* Check for known pciclass, and also check wether we have
+                 * a device with child nodes for ports or not
+                 */
+                if (device_is_compatible(np, "pciclass,0700") ||
+                    device_is_compatible(np, "pciclass,070002"))
+                        pci = np;
+                else if (device_is_compatible(parent, "pciclass,0700") ||
+                         device_is_compatible(parent, "pciclass,070002"))
+                        pci = parent;
+                else {
+                        of_node_put(parent);
+                        continue;
+                }
+                index = add_legacy_pci_port(np, pci);
+                if (index >= 0 && np == stdout)
+                        legacy_serial_console = index;
+                of_node_put(parent);
+        }
+#endif
+
+        DBG("legacy_serial_console = %d\n", legacy_serial_console);
+
+        /* udbg is 64 bits only for now, that will change soon though ... */
+        while (legacy_serial_console >= 0) {
+                struct legacy_serial_info *info =
+                        &legacy_serial_infos[legacy_serial_console];
+                void __iomem *addr;
+
+                if (info->taddr == 0)
+                        break;
+                addr = ioremap(info->taddr, 0x1000);
+                if (addr == NULL)
+                        break;
+                if (info->speed == 0)
+                        info->speed = udbg_probe_uart_speed(addr, info->clock);
+                DBG("default console speed = %d\n", info->speed);
+                udbg_init_uart(addr, info->speed, info->clock);
+                break;
+        }
+
+        DBG(" <- find_legacy_serial_port()\n");
+}
+
+static struct platform_device serial_device = {
+        .name   = "serial8250",
+        .id     = PLAT8250_DEV_PLATFORM,
+        .dev    = {
+                .platform_data = legacy_serial_ports,
+        },
+};
+
+static void __init fixup_port_irq(int index,
+                                  struct device_node *np,
+                                  struct plat_serial8250_port *port)
+{
+        DBG("fixup_port_irq(%d)\n", index);
+
+        /* Check for interrupts in that node */
+        if (np->n_intrs > 0) {
+                port->irq = np->intrs[0].line;
+                DBG(" port %d (%s), irq=%d\n",
+                    index, np->full_name, port->irq);
+                return;
+        }
+
+        /* Check for interrupts in the parent */
+        np = of_get_parent(np);
+        if (np == NULL)
+                return;
+
+        if (np->n_intrs > 0) {
+                port->irq = np->intrs[0].line;
+                DBG(" port %d (%s), irq=%d\n",
+                    index, np->full_name, port->irq);
+        }
+        of_node_put(np);
+}
+
+static void __init fixup_port_pio(int index,
+                                  struct device_node *np,
+                                  struct plat_serial8250_port *port)
+{
+#ifdef CONFIG_PCI
+        struct pci_controller *hose;
+
+        DBG("fixup_port_pio(%d)\n", index);
+
+        hose = pci_find_hose_for_OF_device(np);
+        if (hose) {
+                unsigned long offset = (unsigned long)hose->io_base_virt -
+#ifdef CONFIG_PPC64
+                        pci_io_base;
+#else
+                        isa_io_base;
+#endif
+                DBG("port %d, IO %lx -> %lx\n",
+                    index, port->iobase, port->iobase + offset);
+                port->iobase += offset;
+        }
+#endif
+}
+
+static void __init fixup_port_mmio(int index,
+                                   struct device_node *np,
+                                   struct plat_serial8250_port *port)
+{
+        DBG("fixup_port_mmio(%d)\n", index);
+
+        port->membase = ioremap(port->mapbase, 0x100);
+}
+
+/*
+ * This is called as an arch initcall, hopefully before the PCI bus is
+ * probed and/or the 8250 driver loaded since we need to register our
+ * platform devices before 8250 PCI ones are detected as some of them
+ * must properly "override" the platform ones.
+ *
+ * This function fixes up the interrupt value for platform ports as it
+ * couldn't be done earlier before interrupt maps have been parsed. It
+ * also "corrects" the IO address for PIO ports for the same reason,
+ * since earlier, the PHBs virtual IO space wasn't assigned yet. It then
+ * registers all those platform ports for use by the 8250 driver when it
+ * finally loads.
+ */
+static int __init serial_dev_init(void)
+{
+        int i;
+
+        if (legacy_serial_count == 0)
+                return -ENODEV;
+
+        /*
+         * Before we register the platfrom serial devices, we need
+         * to fixup their interrutps and their IO ports.
+         */
+        DBG("Fixing serial ports interrupts and IO ports ...\n");
+
+        for (i = 0; i < legacy_serial_count; i++) {
+                struct plat_serial8250_port *port = &legacy_serial_ports[i];
+                struct device_node *np = legacy_serial_infos[i].np;
+
+                if (port->irq == NO_IRQ)
+                        fixup_port_irq(i, np, port);
+                if (port->iotype == UPIO_PORT)
+                        fixup_port_pio(i, np, port);
+                if (port->iotype == UPIO_MEM)
+                        fixup_port_mmio(i, np, port);
+        }
+
+        DBG("Registering platform serial ports\n");
+
+        return platform_device_register(&serial_device);
+}
+arch_initcall(serial_dev_init);
+
+
+/*
+ * This is called very early, as part of console_init() (typically just after
+ * time_init()). This function is respondible for trying to find a good
+ * default console on serial ports. It tries to match the open firmware
+ * default output with one of the available serial console drivers, either
+ * one of the platform serial ports that have been probed earlier by
+ * find_legacy_serial_ports() or some more platform specific ones.
+ */
+static int __init check_legacy_serial_console(void)
+{
+        struct device_node *prom_stdout = NULL;
+        int speed = 0, offset = 0;
+        char *name;
+        u32 *spd;
+
+        DBG(" -> check_legacy_serial_console()\n");
+
+        /* The user has requested a console so this is already set up. */
+        if (strstr(saved_command_line, "console=")) {
+                DBG(" console was specified !\n");
+                return -EBUSY;
+        }
+
+        if (!of_chosen) {
+                DBG(" of_chosen is NULL !\n");
+                return -ENODEV;
+        }
+
+        if (legacy_serial_console < 0) {
+                DBG(" legacy_serial_console not found !\n");
+                return -ENODEV;
+        }
+        /* We are getting a weird phandle from OF ... */
+        /* ... So use the full path instead */
+        name = (char *)get_property(of_chosen, "linux,stdout-path", NULL);
+        if (name == NULL) {
+                DBG(" no linux,stdout-path !\n");
+                return -ENODEV;
+        }
+        prom_stdout = of_find_node_by_path(name);
+        if (!prom_stdout) {
+                DBG(" can't find stdout package %s !\n", name);
+                return -ENODEV;
+        }
+        DBG("stdout is %s\n", prom_stdout->full_name);
+
+        name = (char *)get_property(prom_stdout, "name", NULL);
+        if (!name) {
+                DBG(" stdout package has no name !\n");
+                goto not_found;
+        }
+        spd = (u32 *)get_property(prom_stdout, "current-speed", NULL);
+        if (spd)
+                speed = *spd;
+
+        if (0)
+                ;
+#ifdef CONFIG_SERIAL_8250_CONSOLE
+        else if (strcmp(name, "serial") == 0) {
+                int i;
+                /* Look for it in probed array */
+                for (i = 0; i < legacy_serial_count; i++) {
+                        if (prom_stdout != legacy_serial_infos[i].np)
+                                continue;
+                        offset = i;
+                        speed = legacy_serial_infos[i].speed;
+                        break;
+                }
+                if (i >= legacy_serial_count)
+                        goto not_found;
+        }
+#endif /* CONFIG_SERIAL_8250_CONSOLE */
+#ifdef CONFIG_SERIAL_PMACZILOG_CONSOLE
+        else if (strcmp(name, "ch-a") == 0)
+                offset = 0;
+        else if (strcmp(name, "ch-b") == 0)
+                offset = 1;
+#endif /* CONFIG_SERIAL_PMACZILOG_CONSOLE */
+        else
+                goto not_found;
+        of_node_put(prom_stdout);
+
+        DBG("Found serial console at ttyS%d\n", offset);
+
+        if (speed) {
+                static char __initdata opt[16];
+                sprintf(opt, "%d", speed);
+                return add_preferred_console("ttyS", offset, opt);
+        } else
+                return add_preferred_console("ttyS", offset, NULL);
+
+ not_found:
+        DBG("No preferred console found !\n");
+        of_node_put(prom_stdout);
+        return -ENODEV;
+}
+console_initcall(check_legacy_serial_console);
+
diff --git a/arch/powerpc/kernel/lparmap.c b/arch/powerpc/kernel/lparmap.c
index 5a05a797485f..584d1e3c013d 100644
--- a/arch/powerpc/kernel/lparmap.c
+++ b/arch/powerpc/kernel/lparmap.c
@@ -7,7 +7,7 @@
  * 2 of the License, or (at your option) any later version.
  */
 #include <asm/mmu.h>
-#include <asm/page.h>
+#include <asm/pgtable.h>
 #include <asm/iseries/lpar_map.h>
 
 const struct LparMap __attribute__((__section__(".text"))) xLparMap = {
@@ -16,16 +16,16 @@ const struct LparMap __attribute__((__section__(".text"))) xLparMap = {
         .xSegmentTableOffs = STAB0_PAGE,
 
         .xEsids = {
-                { .xKernelEsid = GET_ESID(KERNELBASE),
-                  .xKernelVsid = KERNEL_VSID(KERNELBASE), },
-                { .xKernelEsid = GET_ESID(VMALLOCBASE),
-                  .xKernelVsid = KERNEL_VSID(VMALLOCBASE), },
+                { .xKernelEsid = GET_ESID(PAGE_OFFSET),
+                  .xKernelVsid = KERNEL_VSID(PAGE_OFFSET), },
+                { .xKernelEsid = GET_ESID(VMALLOC_START),
+                  .xKernelVsid = KERNEL_VSID(VMALLOC_START), },
         },
 
         .xRanges = {
                 { .xPages = HvPagesToMap,
                   .xOffset = 0,
-                  .xVPN = KERNEL_VSID(KERNELBASE) << (SID_SHIFT - HW_PAGE_SHIFT),
+                  .xVPN = KERNEL_VSID(PAGE_OFFSET) << (SID_SHIFT - HW_PAGE_SHIFT),
                 },
         },
 };
diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c
new file mode 100644
index 000000000000..a91e40c9ae45
--- /dev/null
+++ b/arch/powerpc/kernel/machine_kexec.c
@@ -0,0 +1,67 @@
+/*
+ * Code to handle transition of Linux booting another kernel.
+ *
+ * Copyright (C) 2002-2003 Eric Biederman  <ebiederm@xmission.com>
+ * GameCube/ppc32 port Copyright (C) 2004 Albert Herranz
+ * Copyright (C) 2005 IBM Corporation.
+ *
+ * This source code is licensed under the GNU General Public License,
+ * Version 2.  See the file COPYING for more details.
+ */
+
+#include <linux/kexec.h>
+#include <linux/reboot.h>
+#include <linux/threads.h>
+#include <asm/machdep.h>
+
+/*
+ * Provide a dummy crash_notes definition until crash dump is implemented.
+ * This prevents breakage of crash_notes attribute in kernel/ksysfs.c.
+ */
+note_buf_t crash_notes[NR_CPUS];
+
+void machine_crash_shutdown(struct pt_regs *regs)
+{
+        if (ppc_md.machine_crash_shutdown)
+                ppc_md.machine_crash_shutdown(regs);
+}
+
+/*
+ * Do what every setup is needed on image and the
+ * reboot code buffer to allow us to avoid allocations
+ * later.
+ */
+int machine_kexec_prepare(struct kimage *image)
+{
+        if (ppc_md.machine_kexec_prepare)
+                return ppc_md.machine_kexec_prepare(image);
+        /*
+         * Fail if platform doesn't provide its own machine_kexec_prepare
+         * implementation.
+         */
+        return -ENOSYS;
+}
+
+void machine_kexec_cleanup(struct kimage *image)
+{
+        if (ppc_md.machine_kexec_cleanup)
+                ppc_md.machine_kexec_cleanup(image);
+}
+
+/*
+ * Do not allocate memory (or fail in any way) in machine_kexec().
+ * We are past the point of no return, committed to rebooting now.
+ */
+NORET_TYPE void machine_kexec(struct kimage *image)
+{
+        if (ppc_md.machine_kexec)
+                ppc_md.machine_kexec(image);
+        else {
+                /*
+                 * Fall back to normal restart if platform doesn't provide
+                 * its own kexec function, and user insist to kexec...
+                 */
+                machine_restart(NULL);
+        }
+        for(;;);
+}
diff --git a/arch/powerpc/kernel/machine_kexec_32.c b/arch/powerpc/kernel/machine_kexec_32.c
new file mode 100644
index 000000000000..443606134dff
--- /dev/null
+++ b/arch/powerpc/kernel/machine_kexec_32.c
@@ -0,0 +1,65 @@
+/*
+ * PPC32 code to handle Linux booting another kernel.
+ *
+ * Copyright (C) 2002-2003 Eric Biederman  <ebiederm@xmission.com>
+ * GameCube/ppc32 port Copyright (C) 2004 Albert Herranz
+ * Copyright (C) 2005 IBM Corporation.
+ *
+ * This source code is licensed under the GNU General Public License,
+ * Version 2.  See the file COPYING for more details.
+ */
+
+#include <linux/kexec.h>
+#include <linux/mm.h>
+#include <linux/string.h>
+#include <asm/cacheflush.h>
+#include <asm/hw_irq.h>
+#include <asm/io.h>
+
+typedef NORET_TYPE void (*relocate_new_kernel_t)(
+                                unsigned long indirection_page,
+                                unsigned long reboot_code_buffer,
+                                unsigned long start_address) ATTRIB_NORET;
+
+/*
+ * This is a generic machine_kexec function suitable at least for
+ * non-OpenFirmware embedded platforms.
+ * It merely copies the image relocation code to the control page and
+ * jumps to it.
+ * A platform specific function may just call this one.
+ */
+void default_machine_kexec(struct kimage *image)
+{
+        const extern unsigned char relocate_new_kernel[];
+        const extern unsigned int relocate_new_kernel_size;
+        unsigned long page_list;
+        unsigned long reboot_code_buffer, reboot_code_buffer_phys;
+        relocate_new_kernel_t rnk;
+
+        /* Interrupts aren't acceptable while we reboot */
+        local_irq_disable();
+
+        page_list = image->head;
+
+        /* we need both effective and real address here */
+        reboot_code_buffer =
+                        (unsigned long)page_address(image->control_code_page);
+        reboot_code_buffer_phys = virt_to_phys((void *)reboot_code_buffer);
+
+        /* copy our kernel relocation code to the control code page */
+        memcpy((void *)reboot_code_buffer, relocate_new_kernel,
+                                                relocate_new_kernel_size);
+
+        flush_icache_range(reboot_code_buffer,
+                                reboot_code_buffer + KEXEC_CONTROL_CODE_SIZE);
+        printk(KERN_INFO "Bye!\n");
+
+        /* now call it */
+        rnk = (relocate_new_kernel_t) reboot_code_buffer;
+        (*rnk)(page_list, reboot_code_buffer_phys, image->start);
+}
+
+int default_machine_kexec_prepare(struct kimage *image)
+{
+        return 0;
+}
diff --git a/arch/powerpc/kernel/machine_kexec_64.c b/arch/powerpc/kernel/machine_kexec_64.c
index 97c51e452be7..d6431440c54f 100644
--- a/arch/powerpc/kernel/machine_kexec_64.c
+++ b/arch/powerpc/kernel/machine_kexec_64.c
@@ -1,5 +1,5 @@
 /*
- * machine_kexec.c - handle transition of Linux booting another kernel
+ * PPC64 code to handle Linux booting another kernel.
  *
  * Copyright (C) 2004-2005, IBM Corp.
  *
@@ -28,21 +28,7 @@
 
 #define HASH_GROUP_SIZE 0x80    /* size of each hash group, asm/mmu.h */
 
-/* Have this around till we move it into crash specific file */
-note_buf_t crash_notes[NR_CPUS];
-
-/* Dummy for now. Not sure if we need to have a crash shutdown in here
- * and if what it will achieve. Letting it be now to compile the code
- * in generic kexec environment
- */
-void machine_crash_shutdown(struct pt_regs *regs)
-{
-        /* do nothing right now */
-        /* smp_relase_cpus() if we want smp on panic kernel */
-        /* cpu_irq_down to isolate us until we are ready */
-}
-
-int machine_kexec_prepare(struct kimage *image)
+int default_machine_kexec_prepare(struct kimage *image)
 {
         int i;
         unsigned long begin, end;       /* limits of segment */
@@ -111,11 +97,6 @@ int machine_kexec_prepare(struct kimage *image)
         return 0;
 }
 
-void machine_kexec_cleanup(struct kimage *image)
-{
-        /* we do nothing in prepare that needs to be undone */
-}
-
 #define IND_FLAGS (IND_DESTINATION | IND_INDIRECTION | IND_DONE | IND_SOURCE)
 
 static void copy_segments(unsigned long ind)
@@ -172,9 +153,8 @@ void kexec_copy_flush(struct kimage *image)
          * including ones that were in place on the original copy
          */
         for (i = 0; i < nr_segments; i++)
-                flush_icache_range(ranges[i].mem + KERNELBASE,
-                                ranges[i].mem + KERNELBASE +
-                                ranges[i].memsz);
+                flush_icache_range((unsigned long)__va(ranges[i].mem),
+                        (unsigned long)__va(ranges[i].mem + ranges[i].memsz));
 }
 
 #ifdef CONFIG_SMP
@@ -283,13 +263,20 @@ extern NORET_TYPE void kexec_sequence(void *newstack, unsigned long start,
                                         void (*clear_all)(void)) ATTRIB_NORET;
 
 /* too late to fail here */
-void machine_kexec(struct kimage *image)
+void default_machine_kexec(struct kimage *image)
 {
-
         /* prepare control code if any */
 
-        /* shutdown other cpus into our wait loop and quiesce interrupts */
-        kexec_prepare_cpus();
+        /*
+        * If the kexec boot is the normal one, need to shutdown other cpus
+        * into our wait loop and quiesce interrupts.
+        * Otherwise, in the case of crashed mode (crashing_cpu >= 0),
+        * stopping other CPUs and collecting their pt_regs is done before
+        * using debugger IPI.
+        */
+
+       if (crashing_cpu == -1)
+               kexec_prepare_cpus();
 
         /* switch to a staticly allocated stack.  Based on irq stack code.
          * XXX: the task struct will likely be invalid once we do the copy!
diff --git a/arch/powerpc/kernel/misc_32.S b/arch/powerpc/kernel/misc_32.S
index 624a983a9676..01d0d97a16e1 100644
--- a/arch/powerpc/kernel/misc_32.S
+++ b/arch/powerpc/kernel/misc_32.S
@@ -5,6 +5,10 @@
  * Largely rewritten by Cort Dougan (cort@cs.nmt.edu)
  * and Paul Mackerras.
  *
+ * kexec bits:
+ * Copyright (C) 2002-2003 Eric Biederman  <ebiederm@xmission.com>
+ * GameCube/ppc32 port Copyright (C) 2004 Albert Herranz
+ *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * as published by the Free Software Foundation; either version
@@ -24,6 +28,8 @@
 #include <asm/ppc_asm.h>
 #include <asm/thread_info.h>
 #include <asm/asm-offsets.h>
+#include <asm/processor.h>
+#include <asm/kexec.h>
 
         .text
 
@@ -1006,3 +1012,110 @@ _GLOBAL(execve)
  */
 _GLOBAL(__main)
         blr
+
+#ifdef CONFIG_KEXEC
+        /*
+         * Must be relocatable PIC code callable as a C function.
+         */
+        .globl relocate_new_kernel
+relocate_new_kernel:
+        /* r3 = page_list   */
+        /* r4 = reboot_code_buffer */
+        /* r5 = start_address      */
+
+        li      r0, 0
+
+        /*
+         * Set Machine Status Register to a known status,
+         * switch the MMU off and jump to 1: in a single step.
+         */
+
+        mr      r8, r0
+        ori     r8, r8, MSR_RI|MSR_ME
+        mtspr   SPRN_SRR1, r8
+        addi    r8, r4, 1f - relocate_new_kernel
+        mtspr   SPRN_SRR0, r8
+        sync
+        rfi
+
+1:
+        /* from this point address translation is turned off */
+        /* and interrupts are disabled */
+
+        /* set a new stack at the bottom of our page... */
+        /* (not really needed now) */
+        addi    r1, r4, KEXEC_CONTROL_CODE_SIZE - 8 /* for LR Save+Back Chain */
+        stw     r0, 0(r1)
+
+        /* Do the copies */
+        li      r6, 0 /* checksum */
+        mr      r0, r3
+        b       1f
+
+0:      /* top, read another word for the indirection page */
+        lwzu    r0, 4(r3)
+
+1:
+        /* is it a destination page? (r8) */
+        rlwinm. r7, r0, 0, 31, 31 /* IND_DESTINATION (1<<0) */
+        beq     2f
+
+        rlwinm  r8, r0, 0, 0, 19 /* clear kexec flags, page align */
+        b       0b
+
+2:      /* is it an indirection page? (r3) */
+        rlwinm. r7, r0, 0, 30, 30 /* IND_INDIRECTION (1<<1) */
+        beq     2f
+
+        rlwinm  r3, r0, 0, 0, 19 /* clear kexec flags, page align */
+        subi    r3, r3, 4
+        b       0b
+
+2:      /* are we done? */
+        rlwinm. r7, r0, 0, 29, 29 /* IND_DONE (1<<2) */
+        beq     2f
+        b       3f
+
+2:      /* is it a source page? (r9) */
+        rlwinm. r7, r0, 0, 28, 28 /* IND_SOURCE (1<<3) */
+        beq     0b
+
+        rlwinm  r9, r0, 0, 0, 19 /* clear kexec flags, page align */
+
+        li      r7, PAGE_SIZE / 4
+        mtctr   r7
+        subi    r9, r9, 4
+        subi    r8, r8, 4
+9:
+        lwzu    r0, 4(r9)  /* do the copy */
+        xor     r6, r6, r0
+        stwu    r0, 4(r8)
+        dcbst   0, r8
+        sync
+        icbi    0, r8
+        bdnz    9b
+
+        addi    r9, r9, 4
+        addi    r8, r8, 4
+        b       0b
+
+3:
+
+        /* To be certain of avoiding problems with self-modifying code
+         * execute a serializing instruction here.
+         */
+        isync
+        sync
+
+        /* jump to the entry point, usually the setup routine */
+        mtlr    r5
+        blrl
+
+1:      b       1b
+
+relocate_new_kernel_end:
+
+        .globl relocate_new_kernel_size
+relocate_new_kernel_size:
+        .long relocate_new_kernel_end - relocate_new_kernel
+#endif
diff --git a/arch/powerpc/kernel/nvram_64.c b/arch/powerpc/kernel/nvram_64.c
index c0fcd29918ce..fd7db8d542db 100644
--- a/arch/powerpc/kernel/nvram_64.c
+++ b/arch/powerpc/kernel/nvram_64.c
@@ -80,80 +80,74 @@ static loff_t dev_nvram_llseek(struct file *file, loff_t offset, int origin)
 static ssize_t dev_nvram_read(struct file *file, char __user *buf,
                           size_t count, loff_t *ppos)
 {
-        ssize_t len;
-        char *tmp_buffer;
-        int size;
+        ssize_t ret;
+        char *tmp = NULL;
+        ssize_t size;
 
-        if (ppc_md.nvram_size == NULL)
-                return -ENODEV;
+        ret = -ENODEV;
+        if (!ppc_md.nvram_size)
+                goto out;
+
+        ret = 0;
         size = ppc_md.nvram_size();
+        if (*ppos >= size || size < 0)
+                goto out;
 
-        if (!access_ok(VERIFY_WRITE, buf, count))
-                return -EFAULT;
-        if (*ppos >= size)
-                return 0;
-        if (count > size) 
-                count = size;
+        count = min_t(size_t, count, size - *ppos);
+        count = min(count, PAGE_SIZE);
 
-        tmp_buffer = (char *) kmalloc(count, GFP_KERNEL);
-        if (!tmp_buffer) {
-                printk(KERN_ERR "dev_read_nvram: kmalloc failed\n");
-                return -ENOMEM;
-        }
+        ret = -ENOMEM;
+        tmp = kmalloc(count, GFP_KERNEL);
+        if (!tmp)
+                goto out;
 
-        len = ppc_md.nvram_read(tmp_buffer, count, ppos);
-        if ((long)len <= 0) {
-                kfree(tmp_buffer);
-                return len;
-        }
+        ret = ppc_md.nvram_read(tmp, count, ppos);
+        if (ret <= 0)
+                goto out;
 
-        if (copy_to_user(buf, tmp_buffer, len)) {
-                kfree(tmp_buffer);
-                return -EFAULT;
-        }
+        if (copy_to_user(buf, tmp, ret))
+                ret = -EFAULT;
 
-        kfree(tmp_buffer);
-        return len;
+out:
+        kfree(tmp);
+        return ret;
 
 }
 
 static ssize_t dev_nvram_write(struct file *file, const char __user *buf,
-                           size_t count, loff_t *ppos)
+                          size_t count, loff_t *ppos)
 {
-        ssize_t len;
-        char * tmp_buffer;
-        int size;
+        ssize_t ret;
+        char *tmp = NULL;
+        ssize_t size;
 
-        if (ppc_md.nvram_size == NULL)
-                return -ENODEV;
+        ret = -ENODEV;
+        if (!ppc_md.nvram_size)
+                goto out;
+
+        ret = 0;
         size = ppc_md.nvram_size();
+        if (*ppos >= size || size < 0)
+                goto out;
 
-        if (!access_ok(VERIFY_READ, buf, count))
-                return -EFAULT;
-        if (*ppos >= size)
-                return 0;
-        if (count > size)
-                count = size;
+        count = min_t(size_t, count, size - *ppos);
+        count = min(count, PAGE_SIZE);
 
-        tmp_buffer = (char *) kmalloc(count, GFP_KERNEL);
-        if (!tmp_buffer) {
-                printk(KERN_ERR "dev_nvram_write: kmalloc failed\n");
-                return -ENOMEM;
-        }
-        
-        if (copy_from_user(tmp_buffer, buf, count)) {
-                kfree(tmp_buffer);
-                return -EFAULT;
-        }
+        ret = -ENOMEM;
+        tmp = kmalloc(count, GFP_KERNEL);
+        if (!tmp)
+                goto out;
 
-        len = ppc_md.nvram_write(tmp_buffer, count, ppos);
-        if ((long)len <= 0) {
-                kfree(tmp_buffer);
-                return len;
-        }
+        ret = -EFAULT;
+        if (copy_from_user(tmp, buf, count))
+                goto out;
+
+        ret = ppc_md.nvram_write(tmp, count, ppos);
+
+out:
+        kfree(tmp);
+        return ret;
 
-        kfree(tmp_buffer);
-        return len;
 }
 
 static int dev_nvram_ioctl(struct inode *inode, struct file *file,
diff --git a/arch/powerpc/kernel/paca.c b/arch/powerpc/kernel/paca.c
index a7b68f911eb1..999bdd816769 100644
--- a/arch/powerpc/kernel/paca.c
+++ b/arch/powerpc/kernel/paca.c
@@ -17,6 +17,7 @@
 #include <asm/page.h>
 #include <asm/lppaca.h>
 #include <asm/iseries/it_lp_queue.h>
+#include <asm/iseries/it_lp_reg_save.h>
 #include <asm/paca.h>
 
 
@@ -26,8 +27,7 @@ extern unsigned long __toc_start;
 
 /* The Paca is an array with one entry per processor.  Each contains an
  * lppaca, which contains the information shared between the
- * hypervisor and Linux.  Each also contains an ItLpRegSave area which
- * is used by the hypervisor to save registers.
+ * hypervisor and Linux.
  * On systems with hardware multi-threading, there are two threads
  * per processor.  The Paca array must contain an entry for each thread.
  * The VPD Areas will give a max logical processors = 2 * max physical
@@ -37,7 +37,6 @@ extern unsigned long __toc_start;
 #define PACA_INIT_COMMON(number, start, asrr, asrv)                         \
         .lock_token = 0x8000,                                               \
         .paca_index = (number),         /* Paca Index */                    \
-        .default_decr = 0x00ff0000,     /* Initial Decr */                  \
         .kernel_toc = (unsigned long)(&__toc_start) + 0x8000UL,             \
         .stab_real = (asrr),            /* Real pointer to segment table */ \
         .stab_addr = (asrv),            /* Virt pointer to segment table */ \
@@ -57,11 +56,7 @@ extern unsigned long __toc_start;
 #ifdef CONFIG_PPC_ISERIES
 #define PACA_INIT_ISERIES(number)                                           \
         .lppaca_ptr = &paca[number].lppaca,                                 \
-        .reg_save_ptr = &paca[number].reg_save,                             \
-        .reg_save = {                                                       \
-                .xDesc = 0xd397d9e2,    /* "LpRS" */                        \
-                .xSize = sizeof(struct ItLpRegSave)                         \
-        }
+        .reg_save_ptr = &iseries_reg_save[number],
 
 #define PACA_INIT(number)                                                   \
 {                                                                           \
diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
index 8b6008ab217d..fc60a773af7d 100644
--- a/arch/powerpc/kernel/pci_64.c
+++ b/arch/powerpc/kernel/pci_64.c
@@ -34,7 +34,7 @@
 
 #ifdef DEBUG
 #include <asm/udbg.h>
-#define DBG(fmt...) udbg_printf(fmt)
+#define DBG(fmt...) printk(fmt)
 #else
 #define DBG(fmt...)
 #endif
@@ -251,7 +251,7 @@ void pcibios_free_controller(struct pci_controller *phb)
                 kfree(phb);
 }
 
-static void __init pcibios_claim_one_bus(struct pci_bus *b)
+void __devinit pcibios_claim_one_bus(struct pci_bus *b)
 {
         struct pci_dev *dev;
         struct pci_bus *child_bus;
@@ -323,6 +323,7 @@ static void pci_parse_of_addrs(struct device_node *node, struct pci_dev *dev)
         addrs = (u32 *) get_property(node, "assigned-addresses", &proplen);
         if (!addrs)
                 return;
+        DBG("    parse addresses (%d bytes) @ %p\n", proplen, addrs);
         for (; proplen >= 20; proplen -= 20, addrs += 5) {
                 flags = pci_parse_of_flags(addrs[0]);
                 if (!flags)
@@ -332,6 +333,9 @@ static void pci_parse_of_addrs(struct device_node *node, struct pci_dev *dev)
                 if (!size)
                         continue;
                 i = addrs[0] & 0xff;
+                DBG("  base: %llx, size: %llx, i: %x\n",
+                    (unsigned long long)base, (unsigned long long)size, i);
+
                 if (PCI_BASE_ADDRESS_0 <= i && i <= PCI_BASE_ADDRESS_5) {
                         res = &dev->resource[(i - PCI_BASE_ADDRESS_0) >> 2];
                 } else if (i == dev->rom_base_reg) {
@@ -362,6 +366,8 @@ struct pci_dev *of_create_pci_dev(struct device_node *node,
         if (type == NULL)
                 type = "";
 
+        DBG("    create device, devfn: %x, type: %s\n", devfn, type);
+
         memset(dev, 0, sizeof(struct pci_dev));
         dev->bus = bus;
         dev->sysdata = node;
@@ -381,6 +387,8 @@ struct pci_dev *of_create_pci_dev(struct device_node *node,
                 dev->bus->number, PCI_SLOT(devfn), PCI_FUNC(devfn));
         dev->class = get_int_prop(node, "class-code", 0);
 
+        DBG("    class: 0x%x\n", dev->class);
+
         dev->current_state = 4;         /* unknown power state */
 
         if (!strcmp(type, "pci")) {
@@ -402,6 +410,8 @@ struct pci_dev *of_create_pci_dev(struct device_node *node,
 
         pci_parse_of_addrs(node, dev);
 
+        DBG("    adding to system ...\n");
+
         pci_device_add(dev, bus);
 
         /* XXX pci_scan_msi_device(dev); */
@@ -418,15 +428,21 @@ void __devinit of_scan_bus(struct device_node *node,
         int reglen, devfn;
         struct pci_dev *dev;
 
+        DBG("of_scan_bus(%s) bus no %d... \n", node->full_name, bus->number);
+
         while ((child = of_get_next_child(node, child)) != NULL) {
+                DBG("  * %s\n", child->full_name);
                 reg = (u32 *) get_property(child, "reg", &reglen);
                 if (reg == NULL || reglen < 20)
                         continue;
                 devfn = (reg[0] >> 8) & 0xff;
+
                 /* create a new pci_dev for this device */
                 dev = of_create_pci_dev(child, bus, devfn);
                 if (!dev)
                         continue;
+                DBG("dev header type: %x\n", dev->hdr_type);
+
                 if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE ||
                     dev->hdr_type == PCI_HEADER_TYPE_CARDBUS)
                         of_scan_pci_bridge(child, dev);
@@ -446,16 +462,18 @@ void __devinit of_scan_pci_bridge(struct device_node *node,
         unsigned int flags;
         u64 size;
 
+        DBG("of_scan_pci_bridge(%s)\n", node->full_name);
+
         /* parse bus-range property */
         busrange = (u32 *) get_property(node, "bus-range", &len);
         if (busrange == NULL || len != 8) {
-                printk(KERN_ERR "Can't get bus-range for PCI-PCI bridge %s\n",
+                printk(KERN_DEBUG "Can't get bus-range for PCI-PCI bridge %s\n",
                        node->full_name);
                 return;
         }
         ranges = (u32 *) get_property(node, "ranges", &len);
         if (ranges == NULL) {
-                printk(KERN_ERR "Can't get ranges for PCI-PCI bridge %s\n",
+                printk(KERN_DEBUG "Can't get ranges for PCI-PCI bridge %s\n",
                        node->full_name);
                 return;
         }
@@ -509,10 +527,13 @@ void __devinit of_scan_pci_bridge(struct device_node *node,
         }
         sprintf(bus->name, "PCI Bus %04x:%02x", pci_domain_nr(bus),
                 bus->number);
+        DBG("    bus name: %s\n", bus->name);
 
         mode = PCI_PROBE_NORMAL;
         if (ppc_md.pci_probe_mode)
                 mode = ppc_md.pci_probe_mode(bus);
+        DBG("    probe mode: %d\n", mode);
+
         if (mode == PCI_PROBE_DEVTREE)
                 of_scan_bus(node, bus);
         else if (mode == PCI_PROBE_NORMAL)
@@ -528,6 +549,8 @@ void __devinit scan_phb(struct pci_controller *hose)
         int i, mode;
         struct resource *res;
 
+        DBG("Scanning PHB %s\n", node ? node->full_name : "<NO NAME>");
+
         bus = pci_create_bus(NULL, hose->first_busno, hose->ops, node);
         if (bus == NULL) {
                 printk(KERN_ERR "Failed to create bus for PCI domain %04x\n",
@@ -552,8 +575,9 @@ void __devinit scan_phb(struct pci_controller *hose)
 
         mode = PCI_PROBE_NORMAL;
 #ifdef CONFIG_PPC_MULTIPLATFORM
-        if (ppc_md.pci_probe_mode)
+        if (node && ppc_md.pci_probe_mode)
                 mode = ppc_md.pci_probe_mode(bus);
+        DBG("    probe mode: %d\n", mode);
         if (mode == PCI_PROBE_DEVTREE) {
                 bus->subordinate = hose->last_busno;
                 of_scan_bus(node, bus);
@@ -842,8 +866,7 @@ pgprot_t pci_phys_mem_access_prot(struct file *file,
  * Returns a negative error code on failure, zero on success.
  */
 int pci_mmap_page_range(struct pci_dev *dev, struct vm_area_struct *vma,
-                        enum pci_mmap_state mmap_state,
-                        int write_combine)
+                        enum pci_mmap_state mmap_state, int write_combine)
 {
         unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
         struct resource *rp;
@@ -896,6 +919,25 @@ static void __devinit pci_process_ISA_OF_ranges(struct device_node *isa_node,
                                       unsigned long phb_io_base_phys,
                                       void __iomem * phb_io_base_virt)
 {
+        /* Remove these asap */
+
+        struct pci_address {
+                u32 a_hi;
+                u32 a_mid;
+                u32 a_lo;
+        };
+
+        struct isa_address {
+                u32 a_hi;
+                u32 a_lo;
+        };
+
+        struct isa_range {
+                struct isa_address isa_addr;
+                struct pci_address pci_addr;
+                unsigned int size;
+        };
+
         struct isa_range *range;
         unsigned long pci_addr;
         unsigned int isa_addr;
@@ -1223,6 +1265,7 @@ void __devinit pcibios_fixup_device_resources(struct pci_dev *dev,
 }
 EXPORT_SYMBOL(pcibios_fixup_device_resources);
 
+
 static void __devinit do_bus_setup(struct pci_bus *bus)
 {
         struct pci_dev *dev;
@@ -1306,8 +1349,38 @@ void pci_resource_to_user(const struct pci_dev *dev, int bar,
         *end = rsrc->end + offset;
 }
 
+struct pci_controller* pci_find_hose_for_OF_device(struct device_node* node)
+{
+        if (!have_of)
+                return NULL;
+        while(node) {
+                struct pci_controller *hose, *tmp;
+                list_for_each_entry_safe(hose, tmp, &hose_list, list_node)
+                        if (hose->arch_data == node)
+                                return hose;
+                node = node->parent;
+        }
+        return NULL;
+}
+
 #endif /* CONFIG_PPC_MULTIPLATFORM */
 
+unsigned long pci_address_to_pio(phys_addr_t address)
+{
+        struct pci_controller *hose, *tmp;
+
+        list_for_each_entry_safe(hose, tmp, &hose_list, list_node) {
+                if (address >= hose->io_base_phys &&
+                    address < (hose->io_base_phys + hose->pci_io_size)) {
+                        unsigned long base =
+                                (unsigned long)hose->io_base_virt - pci_io_base;
+                        return base + (address - hose->io_base_phys);
+                }
+        }
+        return (unsigned int)-1;
+}
+EXPORT_SYMBOL_GPL(pci_address_to_pio);
+
 
 #define IOBASE_BRIDGE_NUMBER    0
 #define IOBASE_MEMORY           1
diff --git a/arch/powerpc/kernel/pmc.c b/arch/powerpc/kernel/pmc.c
index 2d333cc84082..e6fb194fe537 100644
--- a/arch/powerpc/kernel/pmc.c
+++ b/arch/powerpc/kernel/pmc.c
@@ -43,8 +43,13 @@ static void dummy_perf(struct pt_regs *regs)
         mtspr(SPRN_MMCR0, mmcr0);
 }
 #else
+/* Ensure exceptions are disabled */
 static void dummy_perf(struct pt_regs *regs)
 {
+        unsigned int mmcr0 = mfspr(SPRN_MMCR0);
+
+        mmcr0 &= ~(MMCR0_PMXE);
+        mtspr(SPRN_MMCR0, mmcr0);
 }
 #endif
 
diff --git a/arch/powerpc/kernel/ppc_ksyms.c b/arch/powerpc/kernel/ppc_ksyms.c
index 94db25708456..b2758148a0de 100644
--- a/arch/powerpc/kernel/ppc_ksyms.c
+++ b/arch/powerpc/kernel/ppc_ksyms.c
@@ -76,11 +76,6 @@ EXPORT_SYMBOL(single_step_exception);
 EXPORT_SYMBOL(sys_sigreturn);
 #endif
 
-#if defined(CONFIG_PPC_PREP)
-EXPORT_SYMBOL(_prep_type);
-EXPORT_SYMBOL(ucSystemType);
-#endif
-
 EXPORT_SYMBOL(strcpy);
 EXPORT_SYMBOL(strncpy);
 EXPORT_SYMBOL(strcat);
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index 3bf968e74095..977ee3adaf2d 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -29,6 +29,7 @@
 #include <linux/initrd.h>
 #include <linux/bitops.h>
 #include <linux/module.h>
+#include <linux/kexec.h>
 
 #include <asm/prom.h>
 #include <asm/rtas.h>
@@ -37,6 +38,7 @@
 #include <asm/processor.h>
 #include <asm/irq.h>
 #include <asm/io.h>
+#include <asm/kdump.h>
 #include <asm/smp.h>
 #include <asm/system.h>
 #include <asm/mmu.h>
@@ -55,21 +57,6 @@
 #define DBG(fmt...)
 #endif
 
-struct pci_reg_property {
-        struct pci_address addr;
-        u32 size_hi;
-        u32 size_lo;
-};
-
-struct isa_reg_property {
-        u32 space;
-        u32 address;
-        u32 size;
-};
-
-
-typedef int interpret_func(struct device_node *, unsigned long *,
-                           int, int, int);
 
 static int __initdata dt_root_addr_cells;
 static int __initdata dt_root_size_cells;
@@ -311,6 +298,16 @@ static int __devinit finish_node_interrupts(struct device_node *np,
         int i, j, n, sense;
         unsigned int *irq, virq;
         struct device_node *ic;
+        int trace = 0;
+
+        //#define TRACE(fmt...) do { if (trace) { printk(fmt); mdelay(1000); } } while(0)
+#define TRACE(fmt...)
+
+        if (!strcmp(np->name, "smu-doorbell"))
+                trace = 1;
+
+        TRACE("Finishing SMU doorbell ! num_interrupt_controllers = %d\n",
+              num_interrupt_controllers);
 
         if (num_interrupt_controllers == 0) {
                 /*
@@ -345,11 +342,12 @@ static int __devinit finish_node_interrupts(struct device_node *np,
         }
 
         ints = (unsigned int *) get_property(np, "interrupts", &intlen);
+        TRACE("ints=%p, intlen=%d\n", ints, intlen);
         if (ints == NULL)
                 return 0;
         intrcells = prom_n_intr_cells(np);
         intlen /= intrcells * sizeof(unsigned int);
-
+        TRACE("intrcells=%d, new intlen=%d\n", intrcells, intlen);
         np->intrs = prom_alloc(intlen * sizeof(*(np->intrs)), mem_start);
         if (!np->intrs)
                 return -ENOMEM;
@@ -360,6 +358,7 @@ static int __devinit finish_node_interrupts(struct device_node *np,
         intrcount = 0;
         for (i = 0; i < intlen; ++i, ints += intrcells) {
                 n = map_interrupt(&irq, &ic, np, ints, intrcells);
+                TRACE("map, irq=%d, ic=%p, n=%d\n", irq, ic, n);
                 if (n <= 0)
                         continue;
 
@@ -370,6 +369,7 @@ static int __devinit finish_node_interrupts(struct device_node *np,
                         np->intrs[intrcount].sense = map_isa_senses[sense];
                 } else {
                         virq = virt_irq_create_mapping(irq[0]);
+                        TRACE("virq=%d\n", virq);
 #ifdef CONFIG_PPC64
                         if (virq == NO_IRQ) {
                                 printk(KERN_CRIT "Could not allocate interrupt"
@@ -379,6 +379,12 @@ static int __devinit finish_node_interrupts(struct device_node *np,
 #endif
                         np->intrs[intrcount].line = irq_offset_up(virq);
                         sense = (n > 1)? (irq[1] & 3): 1;
+
+                        /* Apple uses bits in there in a different way, let's
+                         * only keep the real sense bit on macs
+                         */
+                        if (_machine == PLATFORM_POWERMAC)
+                                sense &= 0x1;
                         np->intrs[intrcount].sense = map_mpic_senses[sense];
                 }
 
@@ -388,12 +394,13 @@ static int __devinit finish_node_interrupts(struct device_node *np,
                         char *name = get_property(ic->parent, "name", NULL);
                         if (name && !strcmp(name, "u3"))
                                 np->intrs[intrcount].line += 128;
-                        else if (!(name && !strcmp(name, "mac-io")))
+                        else if (!(name && (!strcmp(name, "mac-io") ||
+                                            !strcmp(name, "u4"))))
                                 /* ignore other cascaded controllers, such as
                                    the k2-sata-root */
                                 break;
                 }
-#endif
+#endif /* CONFIG_PPC64 */
                 if (n > 2) {
                         printk("hmmm, got %d intr cells for %s:", n,
                                np->full_name);
@@ -408,234 +415,19 @@ static int __devinit finish_node_interrupts(struct device_node *np,
         return 0;
 }
 
-static int __devinit interpret_pci_props(struct device_node *np,
-                                         unsigned long *mem_start,
-                                         int naddrc, int nsizec,
-                                         int measure_only)
-{
-        struct address_range *adr;
-        struct pci_reg_property *pci_addrs;
-        int i, l, n_addrs;
-
-        pci_addrs = (struct pci_reg_property *)
-                get_property(np, "assigned-addresses", &l);
-        if (!pci_addrs)
-                return 0;
-
-        n_addrs = l / sizeof(*pci_addrs);
-
-        adr = prom_alloc(n_addrs * sizeof(*adr), mem_start);
-        if (!adr)
-                return -ENOMEM;
-
-        if (measure_only)
-                return 0;
-
-        np->addrs = adr;
-        np->n_addrs = n_addrs;
-
-        for (i = 0; i < n_addrs; i++) {
-                adr[i].space = pci_addrs[i].addr.a_hi;
-                adr[i].address = pci_addrs[i].addr.a_lo |
-                        ((u64)pci_addrs[i].addr.a_mid << 32);
-                adr[i].size = pci_addrs[i].size_lo;
-        }
-
-        return 0;
-}
-
-static int __init interpret_dbdma_props(struct device_node *np,
-                                        unsigned long *mem_start,
-                                        int naddrc, int nsizec,
-                                        int measure_only)
-{
-        struct reg_property32 *rp;
-        struct address_range *adr;
-        unsigned long base_address;
-        int i, l;
-        struct device_node *db;
-
-        base_address = 0;
-        if (!measure_only) {
-                for (db = np->parent; db != NULL; db = db->parent) {
-                        if (!strcmp(db->type, "dbdma") && db->n_addrs != 0) {
-                                base_address = db->addrs[0].address;
-                                break;
-                        }
-                }
-        }
-
-        rp = (struct reg_property32 *) get_property(np, "reg", &l);
-        if (rp != 0 && l >= sizeof(struct reg_property32)) {
-                i = 0;
-                adr = (struct address_range *) (*mem_start);
-                while ((l -= sizeof(struct reg_property32)) >= 0) {
-                        if (!measure_only) {
-                                adr[i].space = 2;
-                                adr[i].address = rp[i].address + base_address;
-                                adr[i].size = rp[i].size;
-                        }
-                        ++i;
-                }
-                np->addrs = adr;
-                np->n_addrs = i;
-                (*mem_start) += i * sizeof(struct address_range);
-        }
-
-        return 0;
-}
-
-static int __init interpret_macio_props(struct device_node *np,
-                                        unsigned long *mem_start,
-                                        int naddrc, int nsizec,
-                                        int measure_only)
-{
-        struct reg_property32 *rp;
-        struct address_range *adr;
-        unsigned long base_address;
-        int i, l;
-        struct device_node *db;
-
-        base_address = 0;
-        if (!measure_only) {
-                for (db = np->parent; db != NULL; db = db->parent) {
-                        if (!strcmp(db->type, "mac-io") && db->n_addrs != 0) {
-                                base_address = db->addrs[0].address;
-                                break;
-                        }
-                }
-        }
-
-        rp = (struct reg_property32 *) get_property(np, "reg", &l);
-        if (rp != 0 && l >= sizeof(struct reg_property32)) {
-                i = 0;
-                adr = (struct address_range *) (*mem_start);
-                while ((l -= sizeof(struct reg_property32)) >= 0) {
-                        if (!measure_only) {
-                                adr[i].space = 2;
-                                adr[i].address = rp[i].address + base_address;
-                                adr[i].size = rp[i].size;
-                        }
-                        ++i;
-                }
-                np->addrs = adr;
-                np->n_addrs = i;
-                (*mem_start) += i * sizeof(struct address_range);
-        }
-
-        return 0;
-}
-
-static int __init interpret_isa_props(struct device_node *np,
-                                      unsigned long *mem_start,
-                                      int naddrc, int nsizec,
-                                      int measure_only)
-{
-        struct isa_reg_property *rp;
-        struct address_range *adr;
-        int i, l;
-
-        rp = (struct isa_reg_property *) get_property(np, "reg", &l);
-        if (rp != 0 && l >= sizeof(struct isa_reg_property)) {
-                i = 0;
-                adr = (struct address_range *) (*mem_start);
-                while ((l -= sizeof(struct isa_reg_property)) >= 0) {
-                        if (!measure_only) {
-                                adr[i].space = rp[i].space;
-                                adr[i].address = rp[i].address;
-                                adr[i].size = rp[i].size;
-                        }
-                        ++i;
-                }
-                np->addrs = adr;
-                np->n_addrs = i;
-                (*mem_start) += i * sizeof(struct address_range);
-        }
-
-        return 0;
-}
-
-static int __init interpret_root_props(struct device_node *np,
-                                       unsigned long *mem_start,
-                                       int naddrc, int nsizec,
-                                       int measure_only)
-{
-        struct address_range *adr;
-        int i, l;
-        unsigned int *rp;
-        int rpsize = (naddrc + nsizec) * sizeof(unsigned int);
-
-        rp = (unsigned int *) get_property(np, "reg", &l);
-        if (rp != 0 && l >= rpsize) {
-                i = 0;
-                adr = (struct address_range *) (*mem_start);
-                while ((l -= rpsize) >= 0) {
-                        if (!measure_only) {
-                                adr[i].space = 0;
-                                adr[i].address = rp[naddrc - 1];
-                                adr[i].size = rp[naddrc + nsizec - 1];
-                        }
-                        ++i;
-                        rp += naddrc + nsizec;
-                }
-                np->addrs = adr;
-                np->n_addrs = i;
-                (*mem_start) += i * sizeof(struct address_range);
-        }
-
-        return 0;
-}
-
 static int __devinit finish_node(struct device_node *np,
                                  unsigned long *mem_start,
-                                 interpret_func *ifunc,
-                                 int naddrc, int nsizec,
                                  int measure_only)
 {
         struct device_node *child;
-        int *ip, rc = 0;
-
-        /* get the device addresses and interrupts */
-        if (ifunc != NULL)
-                rc = ifunc(np, mem_start, naddrc, nsizec, measure_only);
-        if (rc)
-                goto out;
+        int rc = 0;
 
         rc = finish_node_interrupts(np, mem_start, measure_only);
         if (rc)
                 goto out;
 
-        /* Look for #address-cells and #size-cells properties. */
-        ip = (int *) get_property(np, "#address-cells", NULL);
-        if (ip != NULL)
-                naddrc = *ip;
-        ip = (int *) get_property(np, "#size-cells", NULL);
-        if (ip != NULL)
-                nsizec = *ip;
-
-        if (!strcmp(np->name, "device-tree") || np->parent == NULL)
-                ifunc = interpret_root_props;
-        else if (np->type == 0)
-                ifunc = NULL;
-        else if (!strcmp(np->type, "pci") || !strcmp(np->type, "vci"))
-                ifunc = interpret_pci_props;
-        else if (!strcmp(np->type, "dbdma"))
-                ifunc = interpret_dbdma_props;
-        else if (!strcmp(np->type, "mac-io") || ifunc == interpret_macio_props)
-                ifunc = interpret_macio_props;
-        else if (!strcmp(np->type, "isa"))
-                ifunc = interpret_isa_props;
-        else if (!strcmp(np->name, "uni-n") || !strcmp(np->name, "u3"))
-                ifunc = interpret_root_props;
-        else if (!((ifunc == interpret_dbdma_props
-                    || ifunc == interpret_macio_props)
-                   && (!strcmp(np->type, "escc")
-                       || !strcmp(np->type, "media-bay"))))
-                ifunc = NULL;
-
         for (child = np->child; child != NULL; child = child->sibling) {
-                rc = finish_node(child, mem_start, ifunc,
-                                 naddrc, nsizec, measure_only);
+                rc = finish_node(child, mem_start, measure_only);
                 if (rc)
                         goto out;
         }
@@ -697,10 +489,10 @@ void __init finish_device_tree(void)
          * reason and then remove those additional 16 bytes
          */
         size = 16;
-        finish_node(allnodes, &size, NULL, 0, 0, 1);
+        finish_node(allnodes, &size, 1);
         size -= 16;
         end = start = (unsigned long) __va(lmb_alloc(size, 128));
-        finish_node(allnodes, &end, NULL, 0, 0, 0);
+        finish_node(allnodes, &end, 0);
         BUG_ON(end != start + size);
 
         DBG(" <- finish_device_tree\n");
@@ -1197,6 +989,16 @@ static int __init early_init_dt_scan_chosen(unsigned long node,
         }
 #endif /* CONFIG_PPC_RTAS */
 
+#ifdef CONFIG_KEXEC
+       lprop = (u64*)of_get_flat_dt_prop(node, "linux,crashkernel-base", NULL);
+       if (lprop)
+               crashk_res.start = *lprop;
+
+       lprop = (u64*)of_get_flat_dt_prop(node, "linux,crashkernel-size", NULL);
+       if (lprop)
+               crashk_res.end = crashk_res.start + *lprop - 1;
+#endif
+
         /* break now */
         return 1;
 }
@@ -1263,7 +1065,9 @@ static int __init early_init_dt_scan_memory(unsigned long node,
         } else if (strcmp(type, "memory") != 0)
                 return 0;
 
-        reg = (cell_t *)of_get_flat_dt_prop(node, "reg", &l);
+        reg = (cell_t *)of_get_flat_dt_prop(node, "linux,usable-memory", &l);
+        if (reg == NULL)
+                reg = (cell_t *)of_get_flat_dt_prop(node, "reg", &l);
         if (reg == NULL)
                 return 0;
 
@@ -1335,11 +1139,14 @@ void __init early_init_devtree(void *params)
         of_scan_flat_dt(early_init_dt_scan_memory, NULL);
         lmb_enforce_memory_limit(memory_limit);
         lmb_analyze();
-        lmb_reserve(0, __pa(klimit));
 
         DBG("Phys. mem: %lx\n", lmb_phys_mem_size());
 
         /* Reserve LMB regions used by kernel, initrd, dt, etc... */
+        lmb_reserve(PHYSICAL_START, __pa(klimit) - PHYSICAL_START);
+#ifdef CONFIG_CRASH_DUMP
+        lmb_reserve(0, KDUMP_RESERVE_LIMIT);
+#endif
         early_reserve_mem();
 
         DBG("Scanning CPUs ...\n");
@@ -1802,7 +1609,6 @@ static void of_node_release(struct kref *kref)
                 prop = next;
         }
         kfree(node->intrs);
-        kfree(node->addrs);
         kfree(node->full_name);
         kfree(node->data);
         kfree(node);
@@ -1884,9 +1690,7 @@ void of_detach_node(const struct device_node *np)
  * This should probably be split up into smaller chunks.
  */
 
-static int of_finish_dynamic_node(struct device_node *node,
-                                  unsigned long *unused1, int unused2,
-                                  int unused3, int unused4)
+static int of_finish_dynamic_node(struct device_node *node)
 {
         struct device_node *parent = of_get_parent(node);
         int err = 0;
@@ -1907,7 +1711,8 @@ static int of_finish_dynamic_node(struct device_node *node,
                 return -ENODEV;
 
         /* fix up new node's linux_phandle field */
-        if ((ibm_phandle = (unsigned int *)get_property(node, "ibm,phandle", NULL)))
+        if ((ibm_phandle = (unsigned int *)get_property(node,
+                                                        "ibm,phandle", NULL)))
                 node->linux_phandle = *ibm_phandle;
 
 out:
@@ -1922,7 +1727,9 @@ static int prom_reconfig_notifier(struct notifier_block *nb,
 
         switch (action) {
         case PSERIES_RECONFIG_ADD:
-                err = finish_node(node, NULL, of_finish_dynamic_node, 0, 0, 0);
+                err = of_finish_dynamic_node(node);
+                if (!err)
+                        finish_node(node, NULL, 0);
                 if (err < 0) {
                         printk(KERN_ERR "finish_node returned %d\n", err);
                         err = NOTIFY_BAD;
@@ -1996,175 +1803,4 @@ int prom_add_property(struct device_node* np, struct property* prop)
         return 0;
 }
 
-/* I quickly hacked that one, check against spec ! */
-static inline unsigned long
-bus_space_to_resource_flags(unsigned int bus_space)
-{
-        u8 space = (bus_space >> 24) & 0xf;
-        if (space == 0)
-                space = 0x02;
-        if (space == 0x02)
-                return IORESOURCE_MEM;
-        else if (space == 0x01)
-                return IORESOURCE_IO;
-        else {
-                printk(KERN_WARNING "prom.c: bus_space_to_resource_flags(), space: %x\n",
-                        bus_space);
-                return 0;
-        }
-}
-
-#ifdef CONFIG_PCI
-static struct resource *find_parent_pci_resource(struct pci_dev* pdev,
-                                                 struct address_range *range)
-{
-        unsigned long mask;
-        int i;
-
-        /* Check this one */
-        mask = bus_space_to_resource_flags(range->space);
-        for (i=0; i<DEVICE_COUNT_RESOURCE; i++) {
-                if ((pdev->resource[i].flags & mask) == mask &&
-                        pdev->resource[i].start <= range->address &&
-                        pdev->resource[i].end > range->address) {
-                                if ((range->address + range->size - 1) > pdev->resource[i].end) {
-                                        /* Add better message */
-                                        printk(KERN_WARNING "PCI/OF resource overlap !\n");
-                                        return NULL;
-                                }
-                                break;
-                        }
-        }
-        if (i == DEVICE_COUNT_RESOURCE)
-                return NULL;
-        return &pdev->resource[i];
-}
-
-/*
- * Request an OF device resource. Currently handles child of PCI devices,
- * or other nodes attached to the root node. Ultimately, put some
- * link to resources in the OF node.
- */
-struct resource *request_OF_resource(struct device_node* node, int index,
-                                     const char* name_postfix)
-{
-        struct pci_dev* pcidev;
-        u8 pci_bus, pci_devfn;
-        unsigned long iomask;
-        struct device_node* nd;
-        struct resource* parent;
-        struct resource *res = NULL;
-        int nlen, plen;
-
-        if (index >= node->n_addrs)
-                goto fail;
-
-        /* Sanity check on bus space */
-        iomask = bus_space_to_resource_flags(node->addrs[index].space);
-        if (iomask & IORESOURCE_MEM)
-                parent = &iomem_resource;
-        else if (iomask & IORESOURCE_IO)
-                parent = &ioport_resource;
-        else
-                goto fail;
-
-        /* Find a PCI parent if any */
-        nd = node;
-        pcidev = NULL;
-        while (nd) {
-                if (!pci_device_from_OF_node(nd, &pci_bus, &pci_devfn))
-                        pcidev = pci_find_slot(pci_bus, pci_devfn);
-                if (pcidev) break;
-                nd = nd->parent;
-        }
-        if (pcidev)
-                parent = find_parent_pci_resource(pcidev, &node->addrs[index]);
-        if (!parent) {
-                printk(KERN_WARNING "request_OF_resource(%s), parent not found\n",
-                        node->name);
-                goto fail;
-        }
 
-        res = __request_region(parent, node->addrs[index].address,
-                               node->addrs[index].size, NULL);
-        if (!res)
-                goto fail;
-        nlen = strlen(node->name);
-        plen = name_postfix ? strlen(name_postfix) : 0;
-        res->name = (const char *)kmalloc(nlen+plen+1, GFP_KERNEL);
-        if (res->name) {
-                strcpy((char *)res->name, node->name);
-                if (plen)
-                        strcpy((char *)res->name+nlen, name_postfix);
-        }
-        return res;
-fail:
-        return NULL;
-}
-EXPORT_SYMBOL(request_OF_resource);
-
-int release_OF_resource(struct device_node *node, int index)
-{
-        struct pci_dev* pcidev;
-        u8 pci_bus, pci_devfn;
-        unsigned long iomask, start, end;
-        struct device_node* nd;
-        struct resource* parent;
-        struct resource *res = NULL;
-
-        if (index >= node->n_addrs)
-                return -EINVAL;
-
-        /* Sanity check on bus space */
-        iomask = bus_space_to_resource_flags(node->addrs[index].space);
-        if (iomask & IORESOURCE_MEM)
-                parent = &iomem_resource;
-        else if (iomask & IORESOURCE_IO)
-                parent = &ioport_resource;
-        else
-                return -EINVAL;
-
-        /* Find a PCI parent if any */
-        nd = node;
-        pcidev = NULL;
-        while(nd) {
-                if (!pci_device_from_OF_node(nd, &pci_bus, &pci_devfn))
-                        pcidev = pci_find_slot(pci_bus, pci_devfn);
-                if (pcidev) break;
-                nd = nd->parent;
-        }
-        if (pcidev)
-                parent = find_parent_pci_resource(pcidev, &node->addrs[index]);
-        if (!parent) {
-                printk(KERN_WARNING "release_OF_resource(%s), parent not found\n",
-                        node->name);
-                return -ENODEV;
-        }
-
-        /* Find us in the parent and its childs */
-        res = parent->child;
-        start = node->addrs[index].address;
-        end = start + node->addrs[index].size - 1;
-        while (res) {
-                if (res->start == start && res->end == end &&
-                    (res->flags & IORESOURCE_BUSY))
-                        break;
-                if (res->start <= start && res->end >= end)
-                        res = res->child;
-                else
-                        res = res->sibling;
-        }
-        if (!res)
-                return -ENODEV;
-
-        if (res->name) {
-                kfree(res->name);
-                res->name = NULL;
-        }
-        release_resource(res);
-        kfree(res);
-
-        return 0;
-}
-EXPORT_SYMBOL(release_OF_resource);
-#endif /* CONFIG_PCI */
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index bcdc209dca85..e381f2fc121c 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -192,6 +192,11 @@ static unsigned long __initdata alloc_bottom;
 static unsigned long __initdata rmo_top;
 static unsigned long __initdata ram_top;
 
+#ifdef CONFIG_KEXEC
+static unsigned long __initdata prom_crashk_base;
+static unsigned long __initdata prom_crashk_size;
+#endif
+
 static struct mem_map_entry __initdata mem_reserve_map[MEM_RESERVE_MAP_SIZE];
 static int __initdata mem_reserve_cnt;
 
@@ -553,7 +558,8 @@ unsigned long prom_memparse(const char *ptr, const char **retptr)
 static void __init early_cmdline_parse(void)
 {
         struct prom_t *_prom = &RELOC(prom);
-        char *opt, *p;
+        const char *opt;
+        char *p;
         int l = 0;
 
         RELOC(prom_cmd_line[0]) = 0;
@@ -590,6 +596,34 @@ static void __init early_cmdline_parse(void)
                 RELOC(prom_memory_limit) = ALIGN(RELOC(prom_memory_limit), 0x1000000);
 #endif
         }
+
+#ifdef CONFIG_KEXEC
+        /*
+         * crashkernel=size@addr specifies the location to reserve for
+         * crash kernel.
+         */
+        opt = strstr(RELOC(prom_cmd_line), RELOC("crashkernel="));
+        if (opt) {
+                opt += 12;
+                RELOC(prom_crashk_size) = prom_memparse(opt, &opt);
+
+                if (ALIGN(RELOC(prom_crashk_size), 0x1000000) !=
+                        RELOC(prom_crashk_size)) {
+                        prom_printf("Warning: crashkernel size is not "
+                                        "aligned to 16MB\n");
+                }
+
+                /*
+                 * At present, the crash kernel always run at 32MB.
+                 * Just ignore whatever user passed.
+                 */
+                RELOC(prom_crashk_base) = 0x2000000;
+                if (*opt == '@') {
+                        prom_printf("Warning: PPC64 kdump kernel always runs "
+                                        "at 32 MB\n");
+                }
+        }
+#endif
 }
 
 #ifdef CONFIG_PPC_PSERIES
@@ -1011,6 +1045,12 @@ static void __init prom_init_mem(void)
         prom_printf("  alloc_top_hi : %x\n", RELOC(alloc_top_high));
         prom_printf("  rmo_top      : %x\n", RELOC(rmo_top));
         prom_printf("  ram_top      : %x\n", RELOC(ram_top));
+#ifdef CONFIG_KEXEC
+        if (RELOC(prom_crashk_base)) {
+                prom_printf("  crashk_base  : %x\n",  RELOC(prom_crashk_base));
+                prom_printf("  crashk_size  : %x\n", RELOC(prom_crashk_size));
+        }
+#endif
 }
 
 
@@ -1500,6 +1540,8 @@ static int __init prom_find_machine_type(void)
 #ifdef CONFIG_PPC64
                         if (strstr(p, RELOC("Momentum,Maple")))
                                 return PLATFORM_MAPLE;
+                        if (strstr(p, RELOC("IBM,CPB")))
+                                return PLATFORM_CELL;
 #endif
                         i += sl + 1;
                 }
@@ -1994,7 +2036,7 @@ static void __init prom_check_initrd(unsigned long r3, unsigned long r4)
         if (r3 && r4 && r4 != 0xdeadbeef) {
                 unsigned long val;
 
-                RELOC(prom_initrd_start) = (r3 >= KERNELBASE) ? __pa(r3) : r3;
+                RELOC(prom_initrd_start) = is_kernel_addr(r3) ? __pa(r3) : r3;
                 RELOC(prom_initrd_end) = RELOC(prom_initrd_start) + r4;
 
                 val = RELOC(prom_initrd_start);
@@ -2094,6 +2136,10 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
          */
         prom_init_mem();
 
+#ifdef CONFIG_KEXEC
+        if (RELOC(prom_crashk_base))
+                reserve_mem(RELOC(prom_crashk_base), RELOC(prom_crashk_size));
+#endif
         /*
          * Determine which cpu is actually running right _now_
          */
@@ -2150,6 +2196,16 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
         }
 #endif
 
+#ifdef CONFIG_KEXEC
+        if (RELOC(prom_crashk_base)) {
+                prom_setprop(_prom->chosen, "/chosen", "linux,crashkernel-base",
+                        PTRRELOC(&prom_crashk_base),
+                        sizeof(RELOC(prom_crashk_base)));
+                prom_setprop(_prom->chosen, "/chosen", "linux,crashkernel-size",
+                        PTRRELOC(&prom_crashk_size),
+                        sizeof(RELOC(prom_crashk_size)));
+        }
+#endif
         /*
          * Fixup any known bugs in the device-tree
          */
diff --git a/arch/powerpc/kernel/prom_parse.c b/arch/powerpc/kernel/prom_parse.c
new file mode 100644
index 000000000000..309ae1d5fa77
--- /dev/null
+++ b/arch/powerpc/kernel/prom_parse.c
@@ -0,0 +1,547 @@
+#undef DEBUG
+
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/pci_regs.h>
+#include <linux/module.h>
+#include <linux/ioport.h>
+#include <asm/prom.h>
+#include <asm/pci-bridge.h>
+
+#ifdef DEBUG
+#define DBG(fmt...) do { printk(fmt); } while(0)
+#else
+#define DBG(fmt...) do { } while(0)
+#endif
+
+#ifdef CONFIG_PPC64
+#define PRu64   "%lx"
+#else
+#define PRu64   "%llx"
+#endif
+
+/* Max address size we deal with */
+#define OF_MAX_ADDR_CELLS       4
+#define OF_CHECK_COUNTS(na, ns) ((na) > 0 && (na) <= OF_MAX_ADDR_CELLS && \
+                        (ns) > 0)
+
+/* Debug utility */
+#ifdef DEBUG
+static void of_dump_addr(const char *s, u32 *addr, int na)
+{
+        printk("%s", s);
+        while(na--)
+                printk(" %08x", *(addr++));
+        printk("\n");
+}
+#else
+static void of_dump_addr(const char *s, u32 *addr, int na) { }
+#endif
+
+/* Read a big address */
+static inline u64 of_read_addr(u32 *cell, int size)
+{
+        u64 r = 0;
+        while (size--)
+                r = (r << 32) | *(cell++);
+        return r;
+}
+
+/* Callbacks for bus specific translators */
+struct of_bus {
+        const char      *name;
+        const char      *addresses;
+        int             (*match)(struct device_node *parent);
+        void            (*count_cells)(struct device_node *child,
+                                       int *addrc, int *sizec);
+        u64             (*map)(u32 *addr, u32 *range, int na, int ns, int pna);
+        int             (*translate)(u32 *addr, u64 offset, int na);
+        unsigned int    (*get_flags)(u32 *addr);
+};
+
+
+/*
+ * Default translator (generic bus)
+ */
+
+static void of_bus_default_count_cells(struct device_node *dev,
+                                       int *addrc, int *sizec)
+{
+        if (addrc)
+                *addrc = prom_n_addr_cells(dev);
+        if (sizec)
+                *sizec = prom_n_size_cells(dev);
+}
+
+static u64 of_bus_default_map(u32 *addr, u32 *range, int na, int ns, int pna)
+{
+        u64 cp, s, da;
+
+        cp = of_read_addr(range, na);
+        s  = of_read_addr(range + na + pna, ns);
+        da = of_read_addr(addr, na);
+
+        DBG("OF: default map, cp="PRu64", s="PRu64", da="PRu64"\n",
+            cp, s, da);
+
+        if (da < cp || da >= (cp + s))
+                return OF_BAD_ADDR;
+        return da - cp;
+}
+
+static int of_bus_default_translate(u32 *addr, u64 offset, int na)
+{
+        u64 a = of_read_addr(addr, na);
+        memset(addr, 0, na * 4);
+        a += offset;
+        if (na > 1)
+                addr[na - 2] = a >> 32;
+        addr[na - 1] = a & 0xffffffffu;
+
+        return 0;
+}
+
+static unsigned int of_bus_default_get_flags(u32 *addr)
+{
+        return IORESOURCE_MEM;
+}
+
+
+/*
+ * PCI bus specific translator
+ */
+
+static int of_bus_pci_match(struct device_node *np)
+{
+        return !strcmp(np->type, "pci");
+}
+
+static void of_bus_pci_count_cells(struct device_node *np,
+                                   int *addrc, int *sizec)
+{
+        if (addrc)
+                *addrc = 3;
+        if (sizec)
+                *sizec = 2;
+}
+
+static u64 of_bus_pci_map(u32 *addr, u32 *range, int na, int ns, int pna)
+{
+        u64 cp, s, da;
+
+        /* Check address type match */
+        if ((addr[0] ^ range[0]) & 0x03000000)
+                return OF_BAD_ADDR;
+
+        /* Read address values, skipping high cell */
+        cp = of_read_addr(range + 1, na - 1);
+        s  = of_read_addr(range + na + pna, ns);
+        da = of_read_addr(addr + 1, na - 1);
+
+        DBG("OF: PCI map, cp="PRu64", s="PRu64", da="PRu64"\n", cp, s, da);
+
+        if (da < cp || da >= (cp + s))
+                return OF_BAD_ADDR;
+        return da - cp;
+}
+
+static int of_bus_pci_translate(u32 *addr, u64 offset, int na)
+{
+        return of_bus_default_translate(addr + 1, offset, na - 1);
+}
+
+static unsigned int of_bus_pci_get_flags(u32 *addr)
+{
+        unsigned int flags = 0;
+        u32 w = addr[0];
+
+        switch((w >> 24) & 0x03) {
+        case 0x01:
+                flags |= IORESOURCE_IO;
+        case 0x02: /* 32 bits */
+        case 0x03: /* 64 bits */
+                flags |= IORESOURCE_MEM;
+        }
+        if (w & 0x40000000)
+                flags |= IORESOURCE_PREFETCH;
+        return flags;
+}
+
+/*
+ * ISA bus specific translator
+ */
+
+static int of_bus_isa_match(struct device_node *np)
+{
+        return !strcmp(np->name, "isa");
+}
+
+static void of_bus_isa_count_cells(struct device_node *child,
+                                   int *addrc, int *sizec)
+{
+        if (addrc)
+                *addrc = 2;
+        if (sizec)
+                *sizec = 1;
+}
+
+static u64 of_bus_isa_map(u32 *addr, u32 *range, int na, int ns, int pna)
+{
+        u64 cp, s, da;
+
+        /* Check address type match */
+        if ((addr[0] ^ range[0]) & 0x00000001)
+                return OF_BAD_ADDR;
+
+        /* Read address values, skipping high cell */
+        cp = of_read_addr(range + 1, na - 1);
+        s  = of_read_addr(range + na + pna, ns);
+        da = of_read_addr(addr + 1, na - 1);
+
+        DBG("OF: ISA map, cp="PRu64", s="PRu64", da="PRu64"\n", cp, s, da);
+
+        if (da < cp || da >= (cp + s))
+                return OF_BAD_ADDR;
+        return da - cp;
+}
+
+static int of_bus_isa_translate(u32 *addr, u64 offset, int na)
+{
+        return of_bus_default_translate(addr + 1, offset, na - 1);
+}
+
+static unsigned int of_bus_isa_get_flags(u32 *addr)
+{
+        unsigned int flags = 0;
+        u32 w = addr[0];
+
+        if (w & 1)
+                flags |= IORESOURCE_IO;
+        else
+                flags |= IORESOURCE_MEM;
+        return flags;
+}
+
+
+/*
+ * Array of bus specific translators
+ */
+
+static struct of_bus of_busses[] = {
+        /* PCI */
+        {
+                .name = "pci",
+                .addresses = "assigned-addresses",
+                .match = of_bus_pci_match,
+                .count_cells = of_bus_pci_count_cells,
+                .map = of_bus_pci_map,
+                .translate = of_bus_pci_translate,
+                .get_flags = of_bus_pci_get_flags,
+        },
+        /* ISA */
+        {
+                .name = "isa",
+                .addresses = "reg",
+                .match = of_bus_isa_match,
+                .count_cells = of_bus_isa_count_cells,
+                .map = of_bus_isa_map,
+                .translate = of_bus_isa_translate,
+                .get_flags = of_bus_isa_get_flags,
+        },
+        /* Default */
+        {
+                .name = "default",
+                .addresses = "reg",
+                .match = NULL,
+                .count_cells = of_bus_default_count_cells,
+                .map = of_bus_default_map,
+                .translate = of_bus_default_translate,
+                .get_flags = of_bus_default_get_flags,
+        },
+};
+
+static struct of_bus *of_match_bus(struct device_node *np)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(of_busses); i ++)
+                if (!of_busses[i].match || of_busses[i].match(np))
+                        return &of_busses[i];
+        BUG();
+        return NULL;
+}
+
+static int of_translate_one(struct device_node *parent, struct of_bus *bus,
+                            struct of_bus *pbus, u32 *addr,
+                            int na, int ns, int pna)
+{
+        u32 *ranges;
+        unsigned int rlen;
+        int rone;
+        u64 offset = OF_BAD_ADDR;
+
+        /* Normally, an absence of a "ranges" property means we are
+         * crossing a non-translatable boundary, and thus the addresses
+         * below the current not cannot be converted to CPU physical ones.
+         * Unfortunately, while this is very clear in the spec, it's not
+         * what Apple understood, and they do have things like /uni-n or
+         * /ht nodes with no "ranges" property and a lot of perfectly
+         * useable mapped devices below them. Thus we treat the absence of
+         * "ranges" as equivalent to an empty "ranges" property which means
+         * a 1:1 translation at that level. It's up to the caller not to try
+         * to translate addresses that aren't supposed to be translated in
+         * the first place. --BenH.
+         */
+        ranges = (u32 *)get_property(parent, "ranges", &rlen);
+        if (ranges == NULL || rlen == 0) {
+                offset = of_read_addr(addr, na);
+                memset(addr, 0, pna * 4);
+                DBG("OF: no ranges, 1:1 translation\n");
+                goto finish;
+        }
+
+        DBG("OF: walking ranges...\n");
+
+        /* Now walk through the ranges */
+        rlen /= 4;
+        rone = na + pna + ns;
+        for (; rlen >= rone; rlen -= rone, ranges += rone) {
+                offset = bus->map(addr, ranges, na, ns, pna);
+                if (offset != OF_BAD_ADDR)
+                        break;
+        }
+        if (offset == OF_BAD_ADDR) {
+                DBG("OF: not found !\n");
+                return 1;
+        }
+        memcpy(addr, ranges + na, 4 * pna);
+
+ finish:
+        of_dump_addr("OF: parent translation for:", addr, pna);
+        DBG("OF: with offset: "PRu64"\n", offset);
+
+        /* Translate it into parent bus space */
+        return pbus->translate(addr, offset, pna);
+}
+
+
+/*
+ * Translate an address from the device-tree into a CPU physical address,
+ * this walks up the tree and applies the various bus mappings on the
+ * way.
+ *
+ * Note: We consider that crossing any level with #size-cells == 0 to mean
+ * that translation is impossible (that is we are not dealing with a value
+ * that can be mapped to a cpu physical address). This is not really specified
+ * that way, but this is traditionally the way IBM at least do things
+ */
+u64 of_translate_address(struct device_node *dev, u32 *in_addr)
+{
+        struct device_node *parent = NULL;
+        struct of_bus *bus, *pbus;
+        u32 addr[OF_MAX_ADDR_CELLS];
+        int na, ns, pna, pns;
+        u64 result = OF_BAD_ADDR;
+
+        DBG("OF: ** translation for device %s **\n", dev->full_name);
+
+        /* Increase refcount at current level */
+        of_node_get(dev);
+
+        /* Get parent & match bus type */
+        parent = of_get_parent(dev);
+        if (parent == NULL)
+                goto bail;
+        bus = of_match_bus(parent);
+
+        /* Cound address cells & copy address locally */
+        bus->count_cells(dev, &na, &ns);
+        if (!OF_CHECK_COUNTS(na, ns)) {
+                printk(KERN_ERR "prom_parse: Bad cell count for %s\n",
+                       dev->full_name);
+                goto bail;
+        }
+        memcpy(addr, in_addr, na * 4);
+
+        DBG("OF: bus is %s (na=%d, ns=%d) on %s\n",
+            bus->name, na, ns, parent->full_name);
+        of_dump_addr("OF: translating address:", addr, na);
+
+        /* Translate */
+        for (;;) {
+                /* Switch to parent bus */
+                of_node_put(dev);
+                dev = parent;
+                parent = of_get_parent(dev);
+
+                /* If root, we have finished */
+                if (parent == NULL) {
+                        DBG("OF: reached root node\n");
+                        result = of_read_addr(addr, na);
+                        break;
+                }
+
+                /* Get new parent bus and counts */
+                pbus = of_match_bus(parent);
+                pbus->count_cells(dev, &pna, &pns);
+                if (!OF_CHECK_COUNTS(pna, pns)) {
+                        printk(KERN_ERR "prom_parse: Bad cell count for %s\n",
+                               dev->full_name);
+                        break;
+                }
+
+                DBG("OF: parent bus is %s (na=%d, ns=%d) on %s\n",
+                    pbus->name, pna, pns, parent->full_name);
+
+                /* Apply bus translation */
+                if (of_translate_one(dev, bus, pbus, addr, na, ns, pna))
+                        break;
+
+                /* Complete the move up one level */
+                na = pna;
+                ns = pns;
+                bus = pbus;
+
+                of_dump_addr("OF: one level translation:", addr, na);
+        }
+ bail:
+        of_node_put(parent);
+        of_node_put(dev);
+
+        return result;
+}
+EXPORT_SYMBOL(of_translate_address);
+
+u32 *of_get_address(struct device_node *dev, int index, u64 *size,
+                    unsigned int *flags)
+{
+        u32 *prop;
+        unsigned int psize;
+        struct device_node *parent;
+        struct of_bus *bus;
+        int onesize, i, na, ns;
+
+        /* Get parent & match bus type */
+        parent = of_get_parent(dev);
+        if (parent == NULL)
+                return NULL;
+        bus = of_match_bus(parent);
+        bus->count_cells(dev, &na, &ns);
+        of_node_put(parent);
+        if (!OF_CHECK_COUNTS(na, ns))
+                return NULL;
+
+        /* Get "reg" or "assigned-addresses" property */
+        prop = (u32 *)get_property(dev, bus->addresses, &psize);
+        if (prop == NULL)
+                return NULL;
+        psize /= 4;
+
+        onesize = na + ns;
+        for (i = 0; psize >= onesize; psize -= onesize, prop += onesize, i++)
+                if (i == index) {
+                        if (size)
+                                *size = of_read_addr(prop + na, ns);
+                        if (flags)
+                                *flags = bus->get_flags(prop);
+                        return prop;
+                }
+        return NULL;
+}
+EXPORT_SYMBOL(of_get_address);
+
+u32 *of_get_pci_address(struct device_node *dev, int bar_no, u64 *size,
+                        unsigned int *flags)
+{
+        u32 *prop;
+        unsigned int psize;
+        struct device_node *parent;
+        struct of_bus *bus;
+        int onesize, i, na, ns;
+
+        /* Get parent & match bus type */
+        parent = of_get_parent(dev);
+        if (parent == NULL)
+                return NULL;
+        bus = of_match_bus(parent);
+        if (strcmp(bus->name, "pci"))
+                return NULL;
+        bus->count_cells(dev, &na, &ns);
+        of_node_put(parent);
+        if (!OF_CHECK_COUNTS(na, ns))
+                return NULL;
+
+        /* Get "reg" or "assigned-addresses" property */
+        prop = (u32 *)get_property(dev, bus->addresses, &psize);
+        if (prop == NULL)
+                return NULL;
+        psize /= 4;
+
+        onesize = na + ns;
+        for (i = 0; psize >= onesize; psize -= onesize, prop += onesize, i++)
+                if ((prop[0] & 0xff) == ((bar_no * 4) + PCI_BASE_ADDRESS_0)) {
+                        if (size)
+                                *size = of_read_addr(prop + na, ns);
+                        if (flags)
+                                *flags = bus->get_flags(prop);
+                        return prop;
+                }
+        return NULL;
+}
+EXPORT_SYMBOL(of_get_pci_address);
+
+static int __of_address_to_resource(struct device_node *dev, u32 *addrp,
+                                    u64 size, unsigned int flags,
+                                    struct resource *r)
+{
+        u64 taddr;
+
+        if ((flags & (IORESOURCE_IO | IORESOURCE_MEM)) == 0)
+                return -EINVAL;
+        taddr = of_translate_address(dev, addrp);
+        if (taddr == OF_BAD_ADDR)
+                return -EINVAL;
+        memset(r, 0, sizeof(struct resource));
+        if (flags & IORESOURCE_IO) {
+                unsigned long port;
+                port = pci_address_to_pio(taddr);
+                if (port == (unsigned long)-1)
+                        return -EINVAL;
+                r->start = port;
+                r->end = port + size - 1;
+        } else {
+                r->start = taddr;
+                r->end = taddr + size - 1;
+        }
+        r->flags = flags;
+        r->name = dev->name;
+        return 0;
+}
+
+int of_address_to_resource(struct device_node *dev, int index,
+                           struct resource *r)
+{
+        u32             *addrp;
+        u64             size;
+        unsigned int    flags;
+
+        addrp = of_get_address(dev, index, &size, &flags);
+        if (addrp == NULL)
+                return -EINVAL;
+        return __of_address_to_resource(dev, addrp, size, flags, r);
+}
+EXPORT_SYMBOL_GPL(of_address_to_resource);
+
+int of_pci_address_to_resource(struct device_node *dev, int bar,
+                               struct resource *r)
+{
+        u32             *addrp;
+        u64             size;
+        unsigned int    flags;
+
+        addrp = of_get_pci_address(dev, bar, &size, &flags);
+        if (addrp == NULL)
+                return -EINVAL;
+        return __of_address_to_resource(dev, addrp, size, flags, r);
+}
+EXPORT_SYMBOL_GPL(of_pci_address_to_resource);
diff --git a/arch/powerpc/kernel/rtas_pci.c b/arch/powerpc/kernel/rtas_pci.c
index 60dec2401c26..45b8109951fe 100644
--- a/arch/powerpc/kernel/rtas_pci.c
+++ b/arch/powerpc/kernel/rtas_pci.c
@@ -188,39 +188,19 @@ int is_python(struct device_node *dev)
         return 0;
 }
 
-static int get_phb_reg_prop(struct device_node *dev,
-                            unsigned int addr_size_words,
-                            struct reg_property64 *reg)
+static void python_countermeasures(struct device_node *dev)
 {
-        unsigned int *ui_ptr = NULL, len;
-
-        /* Found a PHB, now figure out where his registers are mapped. */
-        ui_ptr = (unsigned int *)get_property(dev, "reg", &len);
-        if (ui_ptr == NULL)
-                return 1;
-
-        if (addr_size_words == 1) {
-                reg->address = ((struct reg_property32 *)ui_ptr)->address;
-                reg->size    = ((struct reg_property32 *)ui_ptr)->size;
-        } else {
-                *reg = *((struct reg_property64 *)ui_ptr);
-        }
-
-        return 0;
-}
-
-static void python_countermeasures(struct device_node *dev,
-                                   unsigned int addr_size_words)
-{
-        struct reg_property64 reg_struct;
+        struct resource registers;
         void __iomem *chip_regs;
         volatile u32 val;
 
-        if (get_phb_reg_prop(dev, addr_size_words, &reg_struct))
+        if (of_address_to_resource(dev, 0, &registers)) {
+                printk(KERN_ERR "Can't get address for Python workarounds !\n");
                 return;
+        }
 
         /* Python's register file is 1 MB in size. */
-        chip_regs = ioremap(reg_struct.address & ~(0xfffffUL), 0x100000);
+        chip_regs = ioremap(registers.start & ~(0xfffffUL), 0x100000);
 
         /*
          * Firmware doesn't always clear this bit which is critical
@@ -301,11 +281,10 @@ static int phb_set_bus_ranges(struct device_node *dev,
 }
 
 static int __devinit setup_phb(struct device_node *dev,
-                               struct pci_controller *phb,
-                               unsigned int addr_size_words)
+                               struct pci_controller *phb)
 {
         if (is_python(dev))
-                python_countermeasures(dev, addr_size_words);
+                python_countermeasures(dev);
 
         if (phb_set_bus_ranges(dev, phb))
                 return 1;
@@ -320,8 +299,8 @@ unsigned long __init find_and_init_phbs(void)
 {
         struct device_node *node;
         struct pci_controller *phb;
-        unsigned int root_size_cells = 0;
         unsigned int index;
+        unsigned int root_size_cells = 0;
         unsigned int *opprop = NULL;
         struct device_node *root = of_find_node_by_path("/");
 
@@ -343,10 +322,11 @@ unsigned long __init find_and_init_phbs(void)
                 phb = pcibios_alloc_controller(node);
                 if (!phb)
                         continue;
-                setup_phb(node, phb, root_size_cells);
+                setup_phb(node, phb);
                 pci_process_bridge_OF_ranges(phb, node, 0);
                 pci_setup_phb_io(phb, index == 0);
 #ifdef CONFIG_PPC_PSERIES
+                /* XXX This code need serious fixing ... --BenH */
                 if (ppc64_interrupt_controller == IC_OPEN_PIC && pSeries_mpic) {
                         int addr = root_size_cells * (index + 2) - 1;
                         mpic_assign_isu(pSeries_mpic, index, opprop[addr]);
@@ -381,22 +361,17 @@ unsigned long __init find_and_init_phbs(void)
 
 struct pci_controller * __devinit init_phb_dynamic(struct device_node *dn)
 {
-        struct device_node *root = of_find_node_by_path("/");
-        unsigned int root_size_cells = 0;
         struct pci_controller *phb;
         int primary;
 
-        root_size_cells = prom_n_size_cells(root);
-
         primary = list_empty(&hose_list);
         phb = pcibios_alloc_controller(dn);
         if (!phb)
                 return NULL;
-        setup_phb(dn, phb, root_size_cells);
+        setup_phb(dn, phb);
         pci_process_bridge_OF_ranges(phb, dn, primary);
 
         pci_setup_phb_io_dynamic(phb, primary);
-        of_node_put(root);
 
         pci_devs_phb_init_dynamic(phb);
         scan_phb(phb);
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index bd3eb4292b53..d5c52fae023a 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -93,8 +93,8 @@ EXPORT_SYMBOL(ppc_do_canonicalize_irqs);
 /* also used by kexec */
 void machine_shutdown(void)
 {
-        if (ppc_md.nvram_sync)
-                ppc_md.nvram_sync();
+        if (ppc_md.machine_shutdown)
+                ppc_md.machine_shutdown();
 }
 
 void machine_restart(char *cmd)
@@ -294,129 +294,6 @@ struct seq_operations cpuinfo_op = {
         .show = show_cpuinfo,
 };
 
-#ifdef CONFIG_PPC_MULTIPLATFORM
-static int __init set_preferred_console(void)
-{
-        struct device_node *prom_stdout = NULL;
-        char *name;
-        u32 *spd;
-        int offset = 0;
-
-        DBG(" -> set_preferred_console()\n");
-
-        /* The user has requested a console so this is already set up. */
-        if (strstr(saved_command_line, "console=")) {
-                DBG(" console was specified !\n");
-                return -EBUSY;
-        }
-
-        if (!of_chosen) {
-                DBG(" of_chosen is NULL !\n");
-                return -ENODEV;
-        }
-        /* We are getting a weird phandle from OF ... */
-        /* ... So use the full path instead */
-        name = (char *)get_property(of_chosen, "linux,stdout-path", NULL);
-        if (name == NULL) {
-                DBG(" no linux,stdout-path !\n");
-                return -ENODEV;
-        }
-        prom_stdout = of_find_node_by_path(name);
-        if (!prom_stdout) {
-                DBG(" can't find stdout package %s !\n", name);
-                return -ENODEV;
-        }       
-        DBG("stdout is %s\n", prom_stdout->full_name);
-
-        name = (char *)get_property(prom_stdout, "name", NULL);
-        if (!name) {
-                DBG(" stdout package has no name !\n");
-                goto not_found;
-        }
-        spd = (u32 *)get_property(prom_stdout, "current-speed", NULL);
-
-        if (0)
-                ;
-#ifdef CONFIG_SERIAL_8250_CONSOLE
-        else if (strcmp(name, "serial") == 0) {
-                int i;
-                u32 *reg = (u32 *)get_property(prom_stdout, "reg", &i);
-                if (i > 8) {
-                        switch (reg[1]) {
-                                case 0x3f8:
-                                        offset = 0;
-                                        break;
-                                case 0x2f8:
-                                        offset = 1;
-                                        break;
-                                case 0x898:
-                                        offset = 2;
-                                        break;
-                                case 0x890:
-                                        offset = 3;
-                                        break;
-                                default:
-                                        /* We dont recognise the serial port */
-                                        goto not_found;
-                        }
-                }
-        }
-#endif /* CONFIG_SERIAL_8250_CONSOLE */
-#ifdef CONFIG_PPC_PSERIES
-        else if (strcmp(name, "vty") == 0) {
-                u32 *reg = (u32 *)get_property(prom_stdout, "reg", NULL);
-                char *compat = (char *)get_property(prom_stdout, "compatible", NULL);
-
-                if (reg && compat && (strcmp(compat, "hvterm-protocol") == 0)) {
-                        /* Host Virtual Serial Interface */
-                        switch (reg[0]) {
-                                case 0x30000000:
-                                        offset = 0;
-                                        break;
-                                case 0x30000001:
-                                        offset = 1;
-                                        break;
-                                default:
-                                        goto not_found;
-                        }
-                        of_node_put(prom_stdout);
-                        DBG("Found hvsi console at offset %d\n", offset);
-                        return add_preferred_console("hvsi", offset, NULL);
-                } else {
-                        /* pSeries LPAR virtual console */
-                        of_node_put(prom_stdout);
-                        DBG("Found hvc console\n");
-                        return add_preferred_console("hvc", 0, NULL);
-                }
-        }
-#endif /* CONFIG_PPC_PSERIES */
-#ifdef CONFIG_SERIAL_PMACZILOG_CONSOLE
-        else if (strcmp(name, "ch-a") == 0)
-                offset = 0;
-        else if (strcmp(name, "ch-b") == 0)
-                offset = 1;
-#endif /* CONFIG_SERIAL_PMACZILOG_CONSOLE */
-        else
-                goto not_found;
-        of_node_put(prom_stdout);
-
-        DBG("Found serial console at ttyS%d\n", offset);
-
-        if (spd) {
-                static char __initdata opt[16];
-                sprintf(opt, "%d", *spd);
-                return add_preferred_console("ttyS", offset, opt);
-        } else
-                return add_preferred_console("ttyS", offset, NULL);
-
- not_found:
-        DBG("No preferred console found !\n");
-        of_node_put(prom_stdout);
-        return -ENODEV;
-}
-console_initcall(set_preferred_console);
-#endif /* CONFIG_PPC_MULTIPLATFORM */
-
 void __init check_for_initrd(void)
 {
 #ifdef CONFIG_BLK_DEV_INITRD
@@ -442,7 +319,7 @@ void __init check_for_initrd(void)
         /* If we were passed an initrd, set the ROOT_DEV properly if the values
          * look sensible. If not, clear initrd reference.
          */
-        if (initrd_start >= KERNELBASE && initrd_end >= KERNELBASE &&
+        if (is_kernel_addr(initrd_start) && is_kernel_addr(initrd_end) &&
             initrd_end > initrd_start)
                 ROOT_DEV = Root_RAM0;
         else
diff --git a/arch/powerpc/kernel/setup_32.c b/arch/powerpc/kernel/setup_32.c
index e5694335bf10..e5d285adb496 100644
--- a/arch/powerpc/kernel/setup_32.c
+++ b/arch/powerpc/kernel/setup_32.c
@@ -39,6 +39,8 @@
 #include <asm/nvram.h>
 #include <asm/xmon.h>
 #include <asm/time.h>
+#include <asm/serial.h>
+#include <asm/udbg.h>
 
 #include "setup.h"
 
@@ -172,12 +174,23 @@ void __init platform_init(void)
  */
 void __init machine_init(unsigned long dt_ptr, unsigned long phys)
 {
+        /* If btext is enabled, we might have a BAT setup for early display,
+         * thus we do enable some very basic udbg output
+         */
+#ifdef CONFIG_BOOTX_TEXT
+        udbg_putc = btext_drawchar;
+#endif
+
+        /* Do some early initialization based on the flat device tree */
         early_init_devtree(__va(dt_ptr));
 
+        /* Check default command line */
 #ifdef CONFIG_CMDLINE
-        strlcpy(cmd_line, CONFIG_CMDLINE, sizeof(cmd_line));
+        if (cmd_line[0] == 0)
+                strlcpy(cmd_line, CONFIG_CMDLINE, sizeof(cmd_line));
 #endif /* CONFIG_CMDLINE */
 
+        /* Base init based on machine type */
         platform_init();
 
 #ifdef CONFIG_6xx
@@ -282,25 +295,22 @@ void __init setup_arch(char **cmdline_p)
 
         unflatten_device_tree();
         check_for_initrd();
-        finish_device_tree();
 
-        smp_setup_cpu_maps();
+        if (ppc_md.init_early)
+                ppc_md.init_early();
 
-#ifdef CONFIG_BOOTX_TEXT
-        init_boot_display();
+#ifdef CONFIG_SERIAL_8250
+        find_legacy_serial_ports();
 #endif
+        finish_device_tree();
 
-#ifdef CONFIG_PPC_PMAC
-        /* This could be called "early setup arch", it must be done
-         * now because xmon need it
-         */
-        if (_machine == _MACH_Pmac)
-                pmac_feature_init();    /* New cool way */
-#endif
+        smp_setup_cpu_maps();
 
 #ifdef CONFIG_XMON_DEFAULT
         xmon_init(1);
 #endif
+        /* Register early console */
+        register_early_udbg_console();
 
 #if defined(CONFIG_KGDB)
         if (ppc_md.kgdb_map_scc)
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index e3fb78397dc6..98e9f0595dd8 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -34,6 +34,7 @@
 #include <linux/serial.h>
 #include <linux/serial_8250.h>
 #include <asm/io.h>
+#include <asm/kdump.h>
 #include <asm/prom.h>
 #include <asm/processor.h>
 #include <asm/pgtable.h>
@@ -268,6 +269,10 @@ void __init early_setup(unsigned long dt_ptr)
         }
         ppc_md = **mach;
 
+#ifdef CONFIG_CRASH_DUMP
+        kdump_setup();
+#endif
+
         DBG("Found, Initializing memory management...\n");
 
         /*
@@ -317,6 +322,7 @@ void early_setup_secondary(void)
 void smp_release_cpus(void)
 {
         extern unsigned long __secondary_hold_spinloop;
+        unsigned long *ptr;
 
         DBG(" -> smp_release_cpus()\n");
 
@@ -327,7 +333,9 @@ void smp_release_cpus(void)
          * This is useless but harmless on iSeries, secondaries are already
          * waiting on their paca spinloops. */
 
-        __secondary_hold_spinloop = 1;
+        ptr  = (unsigned long *)((unsigned long)&__secondary_hold_spinloop
+                        - PHYSICAL_START);
+        *ptr = 1;
         mb();
 
         DBG(" <- smp_release_cpus()\n");
@@ -459,16 +467,21 @@ void __init setup_system(void)
          */
         ppc_md.init_early();
 
+        /*
+         * We can discover serial ports now since the above did setup the
+         * hash table management for us, thus ioremap works. We do that early
+         * so that further code can be debugged
+         */
+#ifdef CONFIG_SERIAL_8250
+        find_legacy_serial_ports();
+#endif
+
         /*
          * "Finish" the device-tree, that is do the actual parsing of
          * some of the properties like the interrupt map
          */
         finish_device_tree();
 
-#ifdef CONFIG_BOOTX_TEXT
-        init_boot_display();
-#endif
-
         /*
          * Initialize xmon
          */
@@ -507,6 +520,9 @@ void __init setup_system(void)
                ppc64_caches.iline_size);
         printk("htab_address                  = 0x%p\n", htab_address);
         printk("htab_hash_mask                = 0x%lx\n", htab_hash_mask);
+#if PHYSICAL_START > 0
+        printk("physical_start                = 0x%x\n", PHYSICAL_START);
+#endif
         printk("-----------------------------------------------------\n");
 
         mm_init_ppc64();
@@ -657,187 +673,6 @@ void ppc64_terminate_msg(unsigned int src, const char *msg)
         printk("[terminate]%04x %s\n", src, msg);
 }
 
-#ifndef CONFIG_PPC_ISERIES
-/*
- * This function can be used by platforms to "find" legacy serial ports.
- * It works for "serial" nodes under an "isa" node, and will try to
- * respect the "ibm,aix-loc" property if any. It works with up to 8
- * ports.
- */
-
-#define MAX_LEGACY_SERIAL_PORTS 8
-static struct plat_serial8250_port serial_ports[MAX_LEGACY_SERIAL_PORTS+1];
-static unsigned int old_serial_count;
-
-void __init generic_find_legacy_serial_ports(u64 *physport,
-                unsigned int *default_speed)
-{
-        struct device_node *np;
-        u32 *sizeprop;
-
-        struct isa_reg_property {
-                u32 space;
-                u32 address;
-                u32 size;
-        };
-        struct pci_reg_property {
-                struct pci_address addr;
-                u32 size_hi;
-                u32 size_lo;
-        };                                                                        
-
-        DBG(" -> generic_find_legacy_serial_port()\n");
-
-        *physport = 0;
-        if (default_speed)
-                *default_speed = 0;
-
-        np = of_find_node_by_path("/");
-        if (!np)
-                return;
-
-        /* First fill our array */
-        for (np = NULL; (np = of_find_node_by_type(np, "serial"));) {
-                struct device_node *isa, *pci;
-                struct isa_reg_property *reg;
-                unsigned long phys_size, addr_size, io_base;
-                u32 *rangesp;
-                u32 *interrupts, *clk, *spd;
-                char *typep;
-                int index, rlen, rentsize;
-
-                /* Ok, first check if it's under an "isa" parent */
-                isa = of_get_parent(np);
-                if (!isa || strcmp(isa->name, "isa")) {
-                        DBG("%s: no isa parent found\n", np->full_name);
-                        continue;
-                }
-                
-                /* Now look for an "ibm,aix-loc" property that gives us ordering
-                 * if any...
-                 */
-                typep = (char *)get_property(np, "ibm,aix-loc", NULL);
-
-                /* Get the ISA port number */
-                reg = (struct isa_reg_property *)get_property(np, "reg", NULL); 
-                if (reg == NULL)
-                        goto next_port;
-                /* We assume the interrupt number isn't translated ... */
-                interrupts = (u32 *)get_property(np, "interrupts", NULL);
-                /* get clock freq. if present */
-                clk = (u32 *)get_property(np, "clock-frequency", NULL);
-                /* get default speed if present */
-                spd = (u32 *)get_property(np, "current-speed", NULL);
-                /* Default to locate at end of array */
-                index = old_serial_count; /* end of the array by default */
-
-                /* If we have a location index, then use it */
-                if (typep && *typep == 'S') {
-                        index = simple_strtol(typep+1, NULL, 0) - 1;
-                        /* if index is out of range, use end of array instead */
-                        if (index >= MAX_LEGACY_SERIAL_PORTS)
-                                index = old_serial_count;
-                        /* if our index is still out of range, that mean that
-                         * array is full, we could scan for a free slot but that
-                         * make little sense to bother, just skip the port
-                         */
-                        if (index >= MAX_LEGACY_SERIAL_PORTS)
-                                goto next_port;
-                        if (index >= old_serial_count)
-                                old_serial_count = index + 1;
-                        /* Check if there is a port who already claimed our slot */
-                        if (serial_ports[index].iobase != 0) {
-                                /* if we still have some room, move it, else override */
-                                if (old_serial_count < MAX_LEGACY_SERIAL_PORTS) {
-                                        DBG("Moved legacy port %d -> %d\n", index,
-                                            old_serial_count);
-                                        serial_ports[old_serial_count++] =
-                                                serial_ports[index];
-                                } else {
-                                        DBG("Replacing legacy port %d\n", index);
-                                }
-                        }
-                }
-                if (index >= MAX_LEGACY_SERIAL_PORTS)
-                        goto next_port;
-                if (index >= old_serial_count)
-                        old_serial_count = index + 1;
-
-                /* Now fill the entry */
-                memset(&serial_ports[index], 0, sizeof(struct plat_serial8250_port));
-                serial_ports[index].uartclk = clk ? *clk : BASE_BAUD * 16;
-                serial_ports[index].iobase = reg->address;
-                serial_ports[index].irq = interrupts ? interrupts[0] : 0;
-                serial_ports[index].flags = ASYNC_BOOT_AUTOCONF;
-
-                DBG("Added legacy port, index: %d, port: %x, irq: %d, clk: %d\n",
-                    index,
-                    serial_ports[index].iobase,
-                    serial_ports[index].irq,
-                    serial_ports[index].uartclk);
-
-                /* Get phys address of IO reg for port 1 */
-                if (index != 0)
-                        goto next_port;
-
-                pci = of_get_parent(isa);
-                if (!pci) {
-                        DBG("%s: no pci parent found\n", np->full_name);
-                        goto next_port;
-                }
-
-                rangesp = (u32 *)get_property(pci, "ranges", &rlen);
-                if (rangesp == NULL) {
-                        of_node_put(pci);
-                        goto next_port;
-                }
-                rlen /= 4;
-
-                /* we need the #size-cells of the PCI bridge node itself */
-                phys_size = 1;
-                sizeprop = (u32 *)get_property(pci, "#size-cells", NULL);
-                if (sizeprop != NULL)
-                        phys_size = *sizeprop;
-                /* we need the parent #addr-cells */
-                addr_size = prom_n_addr_cells(pci);
-                rentsize = 3 + addr_size + phys_size;
-                io_base = 0;
-                for (;rlen >= rentsize; rlen -= rentsize,rangesp += rentsize) {
-                        if (((rangesp[0] >> 24) & 0x3) != 1)
-                                continue; /* not IO space */
-                        io_base = rangesp[3];
-                        if (addr_size == 2)
-                                io_base = (io_base << 32) | rangesp[4];
-                }
-                if (io_base != 0) {
-                        *physport = io_base + reg->address;
-                        if (default_speed && spd)
-                                *default_speed = *spd;
-                }
-                of_node_put(pci);
-        next_port:
-                of_node_put(isa);
-        }
-
-        DBG(" <- generic_find_legacy_serial_port()\n");
-}
-
-static struct platform_device serial_device = {
-        .name   = "serial8250",
-        .id     = PLAT8250_DEV_PLATFORM,
-        .dev    = {
-                .platform_data = serial_ports,
-        },
-};
-
-static int __init serial_dev_init(void)
-{
-        return platform_device_register(&serial_device);
-}
-arch_initcall(serial_dev_init);
-
-#endif /* CONFIG_PPC_ISERIES */
-
 int check_legacy_ioport(unsigned long base_port)
 {
         if (ppc_md.check_legacy_ioport == NULL)
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 5a2eba60dd39..d3f0b6d452fb 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -76,7 +76,6 @@
  * registers from *regs.  This is what we need
  * to do when a signal has been delivered.
  */
-#define sigreturn_exit(regs)    return 0
 
 #define GP_REGS_SIZE    min(sizeof(elf_gregset_t32), sizeof(struct pt_regs32))
 #undef __SIGNAL_FRAMESIZE
@@ -156,9 +155,17 @@ static inline int save_general_regs(struct pt_regs *regs,
         elf_greg_t64 *gregs = (elf_greg_t64 *)regs;
         int i;
 
-        for (i = 0; i <= PT_RESULT; i ++)
+        if (!FULL_REGS(regs)) {
+                set_thread_flag(TIF_SAVE_NVGPRS);
+                current_thread_info()->nvgprs_frame = frame->mc_gregs;
+        }
+
+        for (i = 0; i <= PT_RESULT; i ++) {
+                if (i == 14 && !FULL_REGS(regs))
+                        i = 32;
                 if (__put_user((unsigned int)gregs[i], &frame->mc_gregs[i]))
                         return -EFAULT;
+        }
         return 0;
 }
 
@@ -179,8 +186,6 @@ static inline int restore_general_regs(struct pt_regs *regs,
 
 #else /* CONFIG_PPC64 */
 
-extern void sigreturn_exit(struct pt_regs *);
-
 #define GP_REGS_SIZE    min(sizeof(elf_gregset_t), sizeof(struct pt_regs))
 
 static inline int put_sigset_t(sigset_t __user *uset, sigset_t *set)
@@ -214,6 +219,15 @@ static inline int get_old_sigaction(struct k_sigaction *new_ka,
 static inline int save_general_regs(struct pt_regs *regs,
                 struct mcontext __user *frame)
 {
+        if (!FULL_REGS(regs)) {
+                /* Zero out the unsaved GPRs to avoid information
+                   leak, and set TIF_SAVE_NVGPRS to ensure that the
+                   registers do actually get saved later. */
+                memset(&regs->gpr[14], 0, 18 * sizeof(unsigned long));
+                current_thread_info()->nvgprs_frame = &frame->mc_gregs;
+                set_thread_flag(TIF_SAVE_NVGPRS);
+        }
+
         return __copy_to_user(&frame->mc_gregs, regs, GP_REGS_SIZE);
 }
 
@@ -256,8 +270,10 @@ long sys_sigsuspend(old_sigset_t mask, int p2, int p3, int p4, int p6, int p7,
         while (1) {
                 current->state = TASK_INTERRUPTIBLE;
                 schedule();
-                if (do_signal(&saveset, regs))
-                        sigreturn_exit(regs);
+                if (do_signal(&saveset, regs)) {
+                        set_thread_flag(TIF_RESTOREALL);
+                        return 0;
+                }
         }
 }
 
@@ -292,8 +308,10 @@ long sys_rt_sigsuspend(
         while (1) {
                 current->state = TASK_INTERRUPTIBLE;
                 schedule();
-                if (do_signal(&saveset, regs))
-                        sigreturn_exit(regs);
+                if (do_signal(&saveset, regs)) {
+                        set_thread_flag(TIF_RESTOREALL);
+                        return 0;
+                }
         }
 }
 
@@ -391,9 +409,6 @@ struct rt_sigframe {
 static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
                 int sigret)
 {
-#ifdef CONFIG_PPC32
-        CHECK_FULL_REGS(regs);
-#endif
         /* Make sure floating point registers are stored in regs */
         flush_fp_to_thread(current);
 
@@ -828,12 +843,6 @@ static int handle_rt_signal(unsigned long sig, struct k_sigaction *ka,
         regs->gpr[6] = (unsigned long) rt_sf;
         regs->nip = (unsigned long) ka->sa.sa_handler;
         regs->trap = 0;
-#ifdef CONFIG_PPC64
-        regs->result = 0;
-
-        if (test_thread_flag(TIF_SINGLESTEP))
-                ptrace_notify(SIGTRAP);
-#endif
         return 1;
 
 badframe:
@@ -911,8 +920,8 @@ long sys_swapcontext(struct ucontext __user *old_ctx,
          */
         if (do_setcontext(new_ctx, regs, 0))
                 do_exit(SIGSEGV);
-        sigreturn_exit(regs);
-        /* doesn't actually return back to here */
+
+        set_thread_flag(TIF_RESTOREALL);
         return 0;
 }
 
@@ -945,12 +954,11 @@ long sys_rt_sigreturn(int r3, int r4, int r5, int r6, int r7, int r8,
          * nobody does any...
          */
         compat_sys_sigaltstack((u32)(u64)&rt_sf->uc.uc_stack, 0, 0, 0, 0, 0, regs);
-        return (int)regs->result;
 #else
         do_sigaltstack(&rt_sf->uc.uc_stack, NULL, regs->gpr[1]);
-        sigreturn_exit(regs);           /* doesn't return here */
-        return 0;
 #endif
+        set_thread_flag(TIF_RESTOREALL);
+        return 0;
 
  bad:
         force_sig(SIGSEGV, current);
@@ -1041,9 +1049,7 @@ int sys_debug_setcontext(struct ucontext __user *ctx,
          */
         do_sigaltstack(&ctx->uc_stack, NULL, regs->gpr[1]);
 
-        sigreturn_exit(regs);
-        /* doesn't actually return back to here */
-
+        set_thread_flag(TIF_RESTOREALL);
  out:
         return 0;
 }
@@ -1107,12 +1113,6 @@ static int handle_signal(unsigned long sig, struct k_sigaction *ka,
         regs->gpr[4] = (unsigned long) sc;
         regs->nip = (unsigned long) ka->sa.sa_handler;
         regs->trap = 0;
-#ifdef CONFIG_PPC64
-        regs->result = 0;
-
-        if (test_thread_flag(TIF_SINGLESTEP))
-                ptrace_notify(SIGTRAP);
-#endif
 
         return 1;
 
@@ -1160,12 +1160,8 @@ long sys_sigreturn(int r3, int r4, int r5, int r6, int r7, int r8,
             || restore_user_regs(regs, sr, 1))
                 goto badframe;
 
-#ifdef CONFIG_PPC64
-        return (int)regs->result;
-#else
-        sigreturn_exit(regs);           /* doesn't return */
+        set_thread_flag(TIF_RESTOREALL);
         return 0;
-#endif
 
 badframe:
         force_sig(SIGSEGV, current);
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 1decf2785530..5462bef898f6 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -96,8 +96,10 @@ long sys_rt_sigsuspend(sigset_t __user *unewset, size_t sigsetsize, int p3, int
         while (1) {
                 current->state = TASK_INTERRUPTIBLE;
                 schedule();
-                if (do_signal(&saveset, regs))
+                if (do_signal(&saveset, regs)) {
+                        set_thread_flag(TIF_RESTOREALL);
                         return 0;
+                }
         }
 }
 
@@ -152,6 +154,14 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
         err |= __put_user(0, &sc->v_regs);
 #endif /* CONFIG_ALTIVEC */
         err |= __put_user(&sc->gp_regs, &sc->regs);
+        if (!FULL_REGS(regs)) {
+                /* Zero out the unsaved GPRs to avoid information
+                   leak, and set TIF_SAVE_NVGPRS to ensure that the
+                   registers do actually get saved later. */
+                memset(&regs->gpr[14], 0, 18 * sizeof(unsigned long));
+                set_thread_flag(TIF_SAVE_NVGPRS);
+                current_thread_info()->nvgprs_frame = &sc->gp_regs;
+        }
         err |= __copy_to_user(&sc->gp_regs, regs, GP_REGS_SIZE);
         err |= __copy_to_user(&sc->fp_regs, &current->thread.fpr, FP_REGS_SIZE);
         err |= __put_user(signr, &sc->signal);
@@ -340,6 +350,7 @@ int sys_swapcontext(struct ucontext __user *old_ctx,
                 do_exit(SIGSEGV);
 
         /* This returns like rt_sigreturn */
+        set_thread_flag(TIF_RESTOREALL);
         return 0;
 }
 
@@ -372,7 +383,8 @@ int sys_rt_sigreturn(unsigned long r3, unsigned long r4, unsigned long r5,
          */
         do_sigaltstack(&uc->uc_stack, NULL, regs->gpr[1]);
 
-        return regs->result;
+        set_thread_flag(TIF_RESTOREALL);
+        return 0;
 
 badframe:
 #if DEBUG_SIG
@@ -454,9 +466,6 @@ static int setup_rt_frame(int signr, struct k_sigaction *ka, siginfo_t *info,
         if (err)
                 goto badframe;
 
-        if (test_thread_flag(TIF_SINGLESTEP))
-                ptrace_notify(SIGTRAP);
-
         return 1;
 
 badframe:
@@ -502,6 +511,8 @@ static inline void syscall_restart(struct pt_regs *regs, struct k_sigaction *ka)
                  * we only get here if there is a handler, we dont restart.
                  */
                 regs->result = -EINTR;
+                regs->gpr[3] = EINTR;
+                regs->ccr |= 0x10000000;
                 break;
         case -ERESTARTSYS:
                 /* ERESTARTSYS means to restart the syscall if there is no
@@ -509,6 +520,8 @@ static inline void syscall_restart(struct pt_regs *regs, struct k_sigaction *ka)
                  */
                 if (!(ka->sa.sa_flags & SA_RESTART)) {
                         regs->result = -EINTR;
+                        regs->gpr[3] = EINTR;
+                        regs->ccr |= 0x10000000;
                         break;
                 }
                 /* fallthrough */
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 30374d2f88e5..d381ec90b759 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -31,6 +31,7 @@
 #include <linux/sysdev.h>
 #include <linux/cpu.h>
 #include <linux/notifier.h>
+#include <linux/topology.h>
 
 #include <asm/ptrace.h>
 #include <asm/atomic.h>
@@ -75,6 +76,8 @@ void smp_call_function_interrupt(void);
 
 int smt_enabled_at_boot = 1;
 
+static void (*crash_ipi_function_ptr)(struct pt_regs *) = NULL;
+
 #ifdef CONFIG_MPIC
 int __init smp_mpic_probe(void)
 {
@@ -123,11 +126,16 @@ void smp_message_recv(int msg, struct pt_regs *regs)
                 /* XXX Do we have to do this? */
                 set_need_resched();
                 break;
-#ifdef CONFIG_DEBUGGER
         case PPC_MSG_DEBUGGER_BREAK:
+                if (crash_ipi_function_ptr) {
+                        crash_ipi_function_ptr(regs);
+                        break;
+                }
+#ifdef CONFIG_DEBUGGER
                 debugger_ipi(regs);
                 break;
-#endif
+#endif /* CONFIG_DEBUGGER */
+                /* FALLTHROUGH */
         default:
                 printk("SMP %d: smp_message_recv(): unknown msg %d\n",
                        smp_processor_id(), msg);
@@ -147,6 +155,17 @@ void smp_send_debugger_break(int cpu)
 }
 #endif
 
+#ifdef CONFIG_KEXEC
+void crash_send_ipi(void (*crash_ipi_callback)(struct pt_regs *))
+{
+        crash_ipi_function_ptr = crash_ipi_callback;
+        if (crash_ipi_callback) {
+                mb();
+                smp_ops->message_pass(MSG_ALL_BUT_SELF, PPC_MSG_DEBUGGER_BREAK);
+        }
+}
+#endif
+
 static void stop_this_cpu(void *dummy)
 {
         local_irq_disable();
@@ -452,10 +471,6 @@ int __devinit __cpu_up(unsigned int cpu)
         if (smp_ops->cpu_bootable && !smp_ops->cpu_bootable(cpu))
                 return -EINVAL;
 
-#ifdef CONFIG_PPC64
-        paca[cpu].default_decr = tb_ticks_per_jiffy;
-#endif
-
         /* Make sure callin-map entry is 0 (can be leftover a CPU
          * hotplug
          */
@@ -554,6 +569,8 @@ void __init smp_cpus_done(unsigned int max_cpus)
         smp_ops->setup_cpu(boot_cpuid);
 
         set_cpus_allowed(current, old_mask);
+
+        dump_numa_cpu_topology();
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
diff --git a/arch/powerpc/kernel/syscalls.c b/arch/powerpc/kernel/syscalls.c
index 91b93d917b64..ad895c99813b 100644
--- a/arch/powerpc/kernel/syscalls.c
+++ b/arch/powerpc/kernel/syscalls.c
@@ -43,9 +43,6 @@
 #include <asm/time.h>
 #include <asm/unistd.h>
 
-extern unsigned long wall_jiffies;
-
-
 /*
  * sys_ipc() is the de-multiplexer for the SysV IPC calls..
  *
@@ -311,31 +308,6 @@ int sys_olduname(struct oldold_utsname __user *name)
         return error? -EFAULT: 0;
 }
 
-#ifdef CONFIG_PPC64
-time_t sys64_time(time_t __user * tloc)
-{
-        time_t secs;
-        time_t usecs;
-
-        long tb_delta = tb_ticks_since(tb_last_stamp);
-        tb_delta += (jiffies - wall_jiffies) * tb_ticks_per_jiffy;
-
-        secs  = xtime.tv_sec;  
-        usecs = (xtime.tv_nsec/1000) + tb_delta / tb_ticks_per_usec;
-        while (usecs >= USEC_PER_SEC) {
-                ++secs;
-                usecs -= USEC_PER_SEC;
-        }
-
-        if (tloc) {
-                if (put_user(secs,tloc))
-                        secs = -EFAULT;
-        }
-
-        return secs;
-}
-#endif
-
 long ppc_fadvise64_64(int fd, int advice, u32 offset_high, u32 offset_low,
                       u32 len_high, u32 len_low)
 {
diff --git a/arch/powerpc/kernel/systbl.S b/arch/powerpc/kernel/systbl.S
index 65eaea91b499..65463a1076e8 100644
--- a/arch/powerpc/kernel/systbl.S
+++ b/arch/powerpc/kernel/systbl.S
@@ -54,7 +54,7 @@ SYSCALL(link)
 SYSCALL(unlink)
 COMPAT_SYS(execve)
 SYSCALL(chdir)
-SYSX(sys64_time,compat_sys_time,sys_time)
+COMPAT_SYS(time)
 SYSCALL(mknod)
 SYSCALL(chmod)
 SYSCALL(lchown)
@@ -113,7 +113,7 @@ SYSCALL(sgetmask)
 COMPAT_SYS(ssetmask)
 SYSCALL(setreuid)
 SYSCALL(setregid)
-SYSX(sys_ni_syscall,ppc32_sigsuspend,ppc_sigsuspend)
+SYS32ONLY(sigsuspend)
 COMPAT_SYS(sigpending)
 COMPAT_SYS(sethostname)
 COMPAT_SYS(setrlimit)
@@ -160,7 +160,7 @@ SYSCALL(swapoff)
 COMPAT_SYS(sysinfo)
 COMPAT_SYS(ipc)
 SYSCALL(fsync)
-SYSX(sys_ni_syscall,ppc32_sigreturn,sys_sigreturn)
+SYS32ONLY(sigreturn)
 PPC_SYS(clone)
 COMPAT_SYS(setdomainname)
 PPC_SYS(newuname)
@@ -213,13 +213,13 @@ COMPAT_SYS(nfsservctl)
 SYSCALL(setresgid)
 SYSCALL(getresgid)
 COMPAT_SYS(prctl)
-SYSX(ppc64_rt_sigreturn,ppc32_rt_sigreturn,sys_rt_sigreturn)
+COMPAT_SYS(rt_sigreturn)
 COMPAT_SYS(rt_sigaction)
 COMPAT_SYS(rt_sigprocmask)
 COMPAT_SYS(rt_sigpending)
 COMPAT_SYS(rt_sigtimedwait)
 COMPAT_SYS(rt_sigqueueinfo)
-SYSX(ppc64_rt_sigsuspend,ppc32_rt_sigsuspend,ppc_rt_sigsuspend)
+COMPAT_SYS(rt_sigsuspend)
 COMPAT_SYS(pread64)
 COMPAT_SYS(pwrite64)
 SYSCALL(chown)
@@ -290,7 +290,7 @@ COMPAT_SYS(clock_settime)
 COMPAT_SYS(clock_gettime)
 COMPAT_SYS(clock_getres)
 COMPAT_SYS(clock_nanosleep)
-SYSX(ppc64_swapcontext,ppc32_swapcontext,ppc_swapcontext)
+COMPAT_SYS(swapcontext)
 COMPAT_SYS(tgkill)
 COMPAT_SYS(utimes)
 COMPAT_SYS(statfs64)
@@ -319,3 +319,5 @@ COMPAT_SYS(ioprio_get)
 SYSCALL(inotify_init)
 SYSCALL(inotify_add_watch)
 SYSCALL(inotify_rm_watch)
+SYSCALL(spu_run)
+SYSCALL(spu_create)
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index de8479769bb7..56f50e91bddb 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -699,10 +699,6 @@ void __init time_init(void)
         div128_by_32(1024*1024, 0, tb_ticks_per_sec, &res);
         tb_to_xs = res.result_low;
 
-#ifdef CONFIG_PPC64
-        get_paca()->default_decr = tb_ticks_per_jiffy;
-#endif
-
         /*
          * Compute scale factor for sched_clock.
          * The calibrate_decr() function has set tb_ticks_per_sec,
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 1511454c4690..7509aa6474f2 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -31,6 +31,7 @@
 #include <linux/prctl.h>
 #include <linux/delay.h>
 #include <linux/kprobes.h>
+#include <linux/kexec.h>
 
 #include <asm/kdebug.h>
 #include <asm/pgtable.h>
@@ -95,7 +96,7 @@ static DEFINE_SPINLOCK(die_lock);
 
 int die(const char *str, struct pt_regs *regs, long err)
 {
-        static int die_counter;
+        static int die_counter, crash_dump_start = 0;
         int nl = 0;
 
         if (debugger(regs))
@@ -156,7 +157,21 @@ int die(const char *str, struct pt_regs *regs, long err)
         print_modules();
         show_regs(regs);
         bust_spinlocks(0);
+
+        if (!crash_dump_start && kexec_should_crash(current)) {
+                crash_dump_start = 1;
+                spin_unlock_irq(&die_lock);
+                crash_kexec(regs);
+                /* NOTREACHED */
+        }
         spin_unlock_irq(&die_lock);
+        if (crash_dump_start)
+                /*
+                 * Only for soft-reset: Other CPUs will be responded to an IPI
+                 * sent by first kexec CPU.
+                 */
+                for(;;)
+                        ;
 
         if (in_interrupt())
                 panic("Fatal exception in interrupt");
@@ -215,8 +230,10 @@ void _exception(int signr, struct pt_regs *regs, int code, unsigned long addr)
 void system_reset_exception(struct pt_regs *regs)
 {
         /* See if any machine dependent calls */
-        if (ppc_md.system_reset_exception)
-                ppc_md.system_reset_exception(regs);
+        if (ppc_md.system_reset_exception) {
+                if (ppc_md.system_reset_exception(regs))
+                        return;
+        }
 
         die("System Reset", regs, SIGABRT);
 
@@ -886,12 +903,10 @@ void altivec_unavailable_exception(struct pt_regs *regs)
         die("Unrecoverable VMX/Altivec Unavailable Exception", regs, SIGABRT);
 }
 
-#if defined(CONFIG_PPC64) || defined(CONFIG_E500)
 void performance_monitor_exception(struct pt_regs *regs)
 {
         perf_irq(regs);
 }
-#endif
 
 #ifdef CONFIG_8xx
 void SoftwareEmulation(struct pt_regs *regs)
diff --git a/arch/powerpc/kernel/udbg.c b/arch/powerpc/kernel/udbg.c
index 0d878e72fc44..558c1ceb2b93 100644
--- a/arch/powerpc/kernel/udbg.c
+++ b/arch/powerpc/kernel/udbg.c
@@ -16,8 +16,8 @@
 #include <linux/console.h>
 #include <asm/processor.h>
 
-void (*udbg_putc)(unsigned char c);
-unsigned char (*udbg_getc)(void);
+void (*udbg_putc)(char c);
+int (*udbg_getc)(void);
 int (*udbg_getc_poll)(void);
 
 /* udbg library, used by xmon et al */
@@ -57,8 +57,8 @@ int udbg_write(const char *s, int n)
 
 int udbg_read(char *buf, int buflen)
 {
-        char c, *p = buf;
-        int i;
+        char *p = buf;
+        int i, c;
 
         if (!udbg_getc)
                 return 0;
@@ -66,8 +66,11 @@ int udbg_read(char *buf, int buflen)
         for (i = 0; i < buflen; ++i) {
                 do {
                         c = udbg_getc();
+                        if (c == -1 && i == 0)
+                                return -1;
+
                 } while (c == 0x11 || c == 0x13);
-                if (c == 0)
+                if (c == 0 || c == -1)
                         break;
                 *p++ = c;
         }
@@ -78,7 +81,7 @@ int udbg_read(char *buf, int buflen)
 #define UDBG_BUFSIZE 256
 void udbg_printf(const char *fmt, ...)
 {
-        unsigned char buf[UDBG_BUFSIZE];
+        char buf[UDBG_BUFSIZE];
         va_list args;
 
         va_start(args, fmt);
@@ -87,6 +90,12 @@ void udbg_printf(const char *fmt, ...)
         va_end(args);
 }
 
+void __init udbg_progress(char *s, unsigned short hex)
+{
+        udbg_puts(s);
+        udbg_puts("\n");
+}
+
 /*
  * Early boot console based on udbg
  */
@@ -99,7 +108,7 @@ static void udbg_console_write(struct console *con, const char *s,
 static struct console udbg_console = {
         .name   = "udbg",
         .write  = udbg_console_write,
-        .flags  = CON_PRINTBUFFER,
+        .flags  = CON_PRINTBUFFER | CON_ENABLED,
         .index  = -1,
 };
 
@@ -107,15 +116,19 @@ static int early_console_initialized;
 
 void __init disable_early_printk(void)
 {
+#if 1
         if (!early_console_initialized)
                 return;
         unregister_console(&udbg_console);
         early_console_initialized = 0;
+#endif
 }
 
 /* called by setup_system */
 void register_early_udbg_console(void)
 {
+        if (early_console_initialized)
+                return;
         early_console_initialized = 1;
         register_console(&udbg_console);
 }
diff --git a/arch/powerpc/kernel/udbg_16550.c b/arch/powerpc/kernel/udbg_16550.c
index 9313574ab935..7541bf44d2da 100644
--- a/arch/powerpc/kernel/udbg_16550.c
+++ b/arch/powerpc/kernel/udbg_16550.c
@@ -43,9 +43,11 @@ struct NS16550 {
 #define LSR_TEMT 0x40  /* Xmitter empty */
 #define LSR_ERR  0x80  /* Error */
 
+#define LCR_DLAB 0x80
+
 static volatile struct NS16550 __iomem *udbg_comport;
 
-static void udbg_550_putc(unsigned char c)
+static void udbg_550_putc(char c)
 {
         if (udbg_comport) {
                 while ((in_8(&udbg_comport->lsr) & LSR_THRE) == 0)
@@ -67,39 +69,80 @@ static int udbg_550_getc_poll(void)
         return -1;
 }
 
-static unsigned char udbg_550_getc(void)
+static int udbg_550_getc(void)
 {
         if (udbg_comport) {
                 while ((in_8(&udbg_comport->lsr) & LSR_DR) == 0)
                         /* wait for char */;
                 return in_8(&udbg_comport->rbr);
         }
-        return 0;
+        return -1;
 }
 
-void udbg_init_uart(void __iomem *comport, unsigned int speed)
+void udbg_init_uart(void __iomem *comport, unsigned int speed,
+                    unsigned int clock)
 {
-        u16 dll = speed ? (115200 / speed) : 12;
+        unsigned int dll, base_bauds = clock / 16;
+
+        if (speed == 0)
+                speed = 9600;
+        dll = base_bauds / speed;
 
         if (comport) {
                 udbg_comport = (struct NS16550 __iomem *)comport;
                 out_8(&udbg_comport->lcr, 0x00);
                 out_8(&udbg_comport->ier, 0xff);
                 out_8(&udbg_comport->ier, 0x00);
-                out_8(&udbg_comport->lcr, 0x80);        /* Access baud rate */
-                out_8(&udbg_comport->dll, dll & 0xff);  /* 1 = 115200,  2 = 57600,
-                                                           3 = 38400, 12 = 9600 baud */
-                out_8(&udbg_comport->dlm, dll >> 8);    /* dll >> 8 which should be zero
-                                                           for fast rates; */
-                out_8(&udbg_comport->lcr, 0x03);        /* 8 data, 1 stop, no parity */
-                out_8(&udbg_comport->mcr, 0x03);        /* RTS/DTR */
-                out_8(&udbg_comport->fcr ,0x07);        /* Clear & enable FIFOs */
+                out_8(&udbg_comport->lcr, LCR_DLAB);
+                out_8(&udbg_comport->dll, dll & 0xff);
+                out_8(&udbg_comport->dlm, dll >> 8);
+                /* 8 data, 1 stop, no parity */
+                out_8(&udbg_comport->lcr, 0x03);
+                /* RTS/DTR */
+                out_8(&udbg_comport->mcr, 0x03);
+                /* Clear & enable FIFOs */
+                out_8(&udbg_comport->fcr ,0x07);
                 udbg_putc = udbg_550_putc;
                 udbg_getc = udbg_550_getc;
                 udbg_getc_poll = udbg_550_getc_poll;
         }
 }
 
+unsigned int udbg_probe_uart_speed(void __iomem *comport, unsigned int clock)
+{
+        unsigned int dll, dlm, divisor, prescaler, speed;
+        u8 old_lcr;
+        volatile struct NS16550 __iomem *port = comport;
+
+        old_lcr = in_8(&port->lcr);
+
+        /* select divisor latch registers.  */
+        out_8(&port->lcr, LCR_DLAB);
+
+        /* now, read the divisor */
+        dll = in_8(&port->dll);
+        dlm = in_8(&port->dlm);
+        divisor = dlm << 8 | dll;
+
+        /* check prescaling */
+        if (in_8(&port->mcr) & 0x80)
+                prescaler = 4;
+        else
+                prescaler = 1;
+
+        /* restore the LCR */
+        out_8(&port->lcr, old_lcr);
+
+        /* calculate speed */
+        speed = (clock / prescaler) / (divisor * 16);
+
+        /* sanity check */
+        if (speed < 0 || speed > (clock / 16))
+                speed = 9600;
+
+        return speed;
+}
+
 #ifdef CONFIG_PPC_MAPLE
 void udbg_maple_real_putc(unsigned char c)
 {
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 93d4fbfdb724..a4815d316722 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -81,7 +81,8 @@ static int store_updates_sp(struct pt_regs *regs)
 }
 
 #if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE))
-static void do_dabr(struct pt_regs *regs, unsigned long error_code)
+static void do_dabr(struct pt_regs *regs, unsigned long address,
+                    unsigned long error_code)
 {
         siginfo_t info;
 
@@ -99,7 +100,7 @@ static void do_dabr(struct pt_regs *regs, unsigned long error_code)
         info.si_signo = SIGTRAP;
         info.si_errno = 0;
         info.si_code = TRAP_HWBKPT;
-        info.si_addr = (void __user *)regs->nip;
+        info.si_addr = (void __user *)address;
         force_sig_info(SIGTRAP, &info, current);
 }
 #endif /* !(CONFIG_4xx || CONFIG_BOOKE)*/
@@ -159,7 +160,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
 #if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE))
         if (error_code & DSISR_DABRMATCH) {
                 /* DABR match */
-                do_dabr(regs, error_code);
+                do_dabr(regs, address, error_code);
                 return 0;
         }
 #endif /* !(CONFIG_4xx || CONFIG_BOOKE)*/
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index a606504678bd..5bb433cbe41b 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -456,7 +456,7 @@ void __init htab_initialize(void)
 
         /* create bolted the linear mapping in the hash table */
         for (i=0; i < lmb.memory.cnt; i++) {
-                base = lmb.memory.region[i].base + KERNELBASE;
+                base = (unsigned long)__va(lmb.memory.region[i].base);
                 size = lmb.memory.region[i].size;
 
                 DBG("creating mapping for region: %lx : %lx\n", base, size);
@@ -498,8 +498,8 @@ void __init htab_initialize(void)
          * for either 4K or 16MB pages.
          */
         if (tce_alloc_start) {
-                tce_alloc_start += KERNELBASE;
-                tce_alloc_end += KERNELBASE;
+                tce_alloc_start = (unsigned long)__va(tce_alloc_start);
+                tce_alloc_end = (unsigned long)__va(tce_alloc_end);
 
                 if (base + size >= tce_alloc_start)
                         tce_alloc_start = base + size + 1;
@@ -644,6 +644,7 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
         DBG_LOW(" -> rc=%d\n", rc);
         return rc;
 }
+EXPORT_SYMBOL_GPL(hash_page);
 
 void hash_preload(struct mm_struct *mm, unsigned long ea,
                   unsigned long access, unsigned long trap)
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 54131b877da3..b51bb28c054b 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -549,6 +549,17 @@ fail:
         return addr;
 }
 
+static int htlb_check_hinted_area(unsigned long addr, unsigned long len)
+{
+        struct vm_area_struct *vma;
+
+        vma = find_vma(current->mm, addr);
+        if (!vma || ((addr + len) <= vma->vm_start))
+                return 0;
+
+        return -ENOMEM;
+}
+
 static unsigned long htlb_get_low_area(unsigned long len, u16 segmask)
 {
         unsigned long addr = 0;
@@ -618,15 +629,28 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
         if (!cpu_has_feature(CPU_FTR_16M_PAGE))
                 return -EINVAL;
 
+        /* Paranoia, caller should have dealt with this */
+        BUG_ON((addr + len)  < addr);
+
         if (test_thread_flag(TIF_32BIT)) {
+                /* Paranoia, caller should have dealt with this */
+                BUG_ON((addr + len) > 0x100000000UL);
+
                 curareas = current->mm->context.low_htlb_areas;
 
-                /* First see if we can do the mapping in the existing
-                 * low areas */
+                /* First see if we can use the hint address */
+                if (addr && (htlb_check_hinted_area(addr, len) == 0)) {
+                        areamask = LOW_ESID_MASK(addr, len);
+                        if (open_low_hpage_areas(current->mm, areamask) == 0)
+                                return addr;
+                }
+
+                /* Next see if we can map in the existing low areas */
                 addr = htlb_get_low_area(len, curareas);
                 if (addr != -ENOMEM)
                         return addr;
 
+                /* Finally go looking for areas to open */
                 lastshift = 0;
                 for (areamask = LOW_ESID_MASK(0x100000000UL-len, len);
                      ! lastshift; areamask >>=1) {
@@ -641,12 +665,22 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
         } else {
                 curareas = current->mm->context.high_htlb_areas;
 
-                /* First see if we can do the mapping in the existing
-                 * high areas */
+                /* First see if we can use the hint address */
+                /* We discourage 64-bit processes from doing hugepage
+                 * mappings below 4GB (must use MAP_FIXED) */
+                if ((addr >= 0x100000000UL)
+                    && (htlb_check_hinted_area(addr, len) == 0)) {
+                        areamask = HTLB_AREA_MASK(addr, len);
+                        if (open_high_hpage_areas(current->mm, areamask) == 0)
+                                return addr;
+                }
+
+                /* Next see if we can map in the existing high areas */
                 addr = htlb_get_high_area(len, curareas);
                 if (addr != -ENOMEM)
                         return addr;
 
+                /* Finally go looking for areas to open */
                 lastshift = 0;
                 for (areamask = HTLB_AREA_MASK(TASK_SIZE_USER64-len, len);
                      ! lastshift; areamask >>=1) {
diff --git a/arch/powerpc/mm/imalloc.c b/arch/powerpc/mm/imalloc.c
index f9587bcc6a48..8b0c132bc163 100644
--- a/arch/powerpc/mm/imalloc.c
+++ b/arch/powerpc/mm/imalloc.c
@@ -107,6 +107,7 @@ static int im_region_status(unsigned long v_addr, unsigned long size,
                 if (v_addr < (unsigned long) tmp->addr + tmp->size)
                         break;
 
+        *vm = NULL;
         if (tmp) {
                 if (im_region_overlaps(v_addr, size, tmp))
                         return IM_REGION_OVERLAP;
@@ -127,7 +128,6 @@ static int im_region_status(unsigned long v_addr, unsigned long size,
                 }
         }
 
-        *vm = NULL;
         return IM_REGION_UNUSED;
 }
 
diff --git a/arch/powerpc/mm/init_32.c b/arch/powerpc/mm/init_32.c
index 7d4b8b5f0606..7d0d75c11848 100644
--- a/arch/powerpc/mm/init_32.c
+++ b/arch/powerpc/mm/init_32.c
@@ -188,6 +188,11 @@ void __init MMU_init(void)
 
         if (ppc_md.progress)
                 ppc_md.progress("MMU:exit", 0x211);
+
+        /* From now on, btext is no longer BAT mapped if it was at all */
+#ifdef CONFIG_BOOTX_TEXT
+        btext_unmap();
+#endif
 }
 
 /* This is only called until mem_init is done. */
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index ed6ed2e30dac..15aac0d78dfa 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -114,19 +114,18 @@ void online_page(struct page *page)
         num_physpages++;
 }
 
-/*
- * This works only for the non-NUMA case.  Later, we'll need a lookup
- * to convert from real physical addresses to nid, that doesn't use
- * pfn_to_nid().
- */
 int __devinit add_memory(u64 start, u64 size)
 {
-        struct pglist_data *pgdata = NODE_DATA(0);
+        struct pglist_data *pgdata;
         struct zone *zone;
+        int nid;
         unsigned long start_pfn = start >> PAGE_SHIFT;
         unsigned long nr_pages = size >> PAGE_SHIFT;
 
-        start += KERNELBASE;
+        nid = hot_add_scn_to_nid(start);
+        pgdata = NODE_DATA(nid);
+
+        start = __va(start);
         create_section_mapping(start, start + size);
 
         /* this should work for most non-highmem platforms */
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index ba7a3055a9fc..2863a912bcd0 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -37,6 +37,7 @@ EXPORT_SYMBOL(node_data);
 
 static bootmem_data_t __initdata plat_node_bdata[MAX_NUMNODES];
 static int min_common_depth;
+static int n_mem_addr_cells, n_mem_size_cells;
 
 /*
  * We need somewhere to store start/end/node for each region until we have
@@ -254,32 +255,20 @@ static int __init find_min_common_depth(void)
         return depth;
 }
 
-static int __init get_mem_addr_cells(void)
+static void __init get_n_mem_cells(int *n_addr_cells, int *n_size_cells)
 {
         struct device_node *memory = NULL;
-        int rc;
 
         memory = of_find_node_by_type(memory, "memory");
         if (!memory)
-                return 0; /* it won't matter */
+                panic("numa.c: No memory nodes found!");
 
-        rc = prom_n_addr_cells(memory);
-        return rc;
+        *n_addr_cells = prom_n_addr_cells(memory);
+        *n_size_cells = prom_n_size_cells(memory);
+        of_node_put(memory);
 }
 
-static int __init get_mem_size_cells(void)
-{
-        struct device_node *memory = NULL;
-        int rc;
-
-        memory = of_find_node_by_type(memory, "memory");
-        if (!memory)
-                return 0; /* it won't matter */
-        rc = prom_n_size_cells(memory);
-        return rc;
-}
-
-static unsigned long __init read_n_cells(int n, unsigned int **buf)
+static unsigned long __devinit read_n_cells(int n, unsigned int **buf)
 {
         unsigned long result = 0;
 
@@ -386,7 +375,6 @@ static int __init parse_numa_properties(void)
 {
         struct device_node *cpu = NULL;
         struct device_node *memory = NULL;
-        int addr_cells, size_cells;
         int max_domain;
         unsigned long i;
 
@@ -425,8 +413,7 @@ static int __init parse_numa_properties(void)
                 }
         }
 
-        addr_cells = get_mem_addr_cells();
-        size_cells = get_mem_size_cells();
+        get_n_mem_cells(&n_mem_addr_cells, &n_mem_size_cells);
         memory = NULL;
         while ((memory = of_find_node_by_type(memory, "memory")) != NULL) {
                 unsigned long start;
@@ -436,15 +423,21 @@ static int __init parse_numa_properties(void)
                 unsigned int *memcell_buf;
                 unsigned int len;
 
-                memcell_buf = (unsigned int *)get_property(memory, "reg", &len);
+                memcell_buf = (unsigned int *)get_property(memory,
+                        "linux,usable-memory", &len);
+                if (!memcell_buf || len <= 0)
+                        memcell_buf =
+                                (unsigned int *)get_property(memory, "reg",
+                                        &len);
                 if (!memcell_buf || len <= 0)
                         continue;
 
-                ranges = memory->n_addrs;
+                /* ranges in cell */
+                ranges = (len >> 2) / (n_mem_addr_cells + n_mem_size_cells);
 new_range:
                 /* these are order-sensitive, and modify the buffer pointer */
-                start = read_n_cells(addr_cells, &memcell_buf);
-                size = read_n_cells(size_cells, &memcell_buf);
+                start = read_n_cells(n_mem_addr_cells, &memcell_buf);
+                size = read_n_cells(n_mem_size_cells, &memcell_buf);
 
                 numa_domain = of_node_numa_domain(memory);
 
@@ -497,7 +490,41 @@ static void __init setup_nonnuma(void)
         node_set_online(0);
 }
 
-static void __init dump_numa_topology(void)
+void __init dump_numa_cpu_topology(void)
+{
+        unsigned int node;
+        unsigned int cpu, count;
+
+        if (min_common_depth == -1 || !numa_enabled)
+                return;
+
+        for_each_online_node(node) {
+                printk(KERN_INFO "Node %d CPUs:", node);
+
+                count = 0;
+                /*
+                 * If we used a CPU iterator here we would miss printing
+                 * the holes in the cpumap.
+                 */
+                for (cpu = 0; cpu < NR_CPUS; cpu++) {
+                        if (cpu_isset(cpu, numa_cpumask_lookup_table[node])) {
+                                if (count == 0)
+                                        printk(" %u", cpu);
+                                ++count;
+                        } else {
+                                if (count > 1)
+                                        printk("-%u", cpu - 1);
+                                count = 0;
+                        }
+                }
+
+                if (count > 1)
+                        printk("-%u", NR_CPUS - 1);
+                printk("\n");
+        }
+}
+
+static void __init dump_numa_memory_topology(void)
 {
         unsigned int node;
         unsigned int count;
@@ -529,7 +556,6 @@ static void __init dump_numa_topology(void)
                         printk("-0x%lx", i);
                 printk("\n");
         }
-        return;
 }
 
 /*
@@ -591,7 +617,7 @@ void __init do_init_bootmem(void)
         if (parse_numa_properties())
                 setup_nonnuma();
         else
-                dump_numa_topology();
+                dump_numa_memory_topology();
 
         register_cpu_notifier(&ppc64_numa_nb);
 
@@ -730,3 +756,60 @@ static int __init early_numa(char *p)
         return 0;
 }
 early_param("numa", early_numa);
+
+#ifdef CONFIG_MEMORY_HOTPLUG
+/*
+ * Find the node associated with a hot added memory section.  Section
+ * corresponds to a SPARSEMEM section, not an LMB.  It is assumed that
+ * sections are fully contained within a single LMB.
+ */
+int hot_add_scn_to_nid(unsigned long scn_addr)
+{
+        struct device_node *memory = NULL;
+        nodemask_t nodes;
+        int numa_domain = 0;
+
+        if (!numa_enabled || (min_common_depth < 0))
+                return numa_domain;
+
+        while ((memory = of_find_node_by_type(memory, "memory")) != NULL) {
+                unsigned long start, size;
+                int ranges;
+                unsigned int *memcell_buf;
+                unsigned int len;
+
+                memcell_buf = (unsigned int *)get_property(memory, "reg", &len);
+                if (!memcell_buf || len <= 0)
+                        continue;
+
+                /* ranges in cell */
+                ranges = (len >> 2) / (n_mem_addr_cells + n_mem_size_cells);
+ha_new_range:
+                start = read_n_cells(n_mem_addr_cells, &memcell_buf);
+                size = read_n_cells(n_mem_size_cells, &memcell_buf);
+                numa_domain = of_node_numa_domain(memory);
+
+                /* Domains not present at boot default to 0 */
+                if (!node_online(numa_domain))
+                        numa_domain = any_online_node(NODE_MASK_ALL);
+
+                if ((scn_addr >= start) && (scn_addr < (start + size))) {
+                        of_node_put(memory);
+                        goto got_numa_domain;
+                }
+
+                if (--ranges)           /* process all ranges in cell */
+                        goto ha_new_range;
+        }
+        BUG();  /* section address should be found above */
+
+        /* Temporary code to ensure that returned node is not empty */
+got_numa_domain:
+        nodes_setall(nodes);
+        while (NODE_DATA(numa_domain)->node_spanned_pages == 0) {
+                node_clear(numa_domain, nodes);
+                numa_domain = any_online_node(nodes);
+        }
+        return numa_domain;
+}
+#endif /* CONFIG_MEMORY_HOTPLUG */
diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c
index 60e852f2f8e5..ffc8ed4de62d 100644
--- a/arch/powerpc/mm/slb.c
+++ b/arch/powerpc/mm/slb.c
@@ -75,7 +75,7 @@ static void slb_flush_and_rebolt(void)
         vflags = SLB_VSID_KERNEL | virtual_llp;
 
         ksp_esid_data = mk_esid_data(get_paca()->kstack, 2);
-        if ((ksp_esid_data & ESID_MASK) == KERNELBASE)
+        if ((ksp_esid_data & ESID_MASK) == PAGE_OFFSET)
                 ksp_esid_data &= ~SLB_ESID_V;
 
         /* We need to do this all in asm, so we're sure we don't touch
@@ -87,8 +87,8 @@ static void slb_flush_and_rebolt(void)
                      /* Slot 2 - kernel stack */
                      "slbmte    %2,%3\n"
                      "isync"
-                     :: "r"(mk_vsid_data(VMALLOCBASE, vflags)),
-                        "r"(mk_esid_data(VMALLOCBASE, 1)),
+                     :: "r"(mk_vsid_data(VMALLOC_START, vflags)),
+                        "r"(mk_esid_data(VMALLOC_START, 1)),
                         "r"(mk_vsid_data(ksp_esid_data, lflags)),
                         "r"(ksp_esid_data)
                      : "memory");
@@ -134,14 +134,14 @@ void switch_slb(struct task_struct *tsk, struct mm_struct *mm)
         else
                 unmapped_base = TASK_UNMAPPED_BASE_USER64;
 
-        if (pc >= KERNELBASE)
+        if (is_kernel_addr(pc))
                 return;
         slb_allocate(pc);
 
         if (GET_ESID(pc) == GET_ESID(stack))
                 return;
 
-        if (stack >= KERNELBASE)
+        if (is_kernel_addr(stack))
                 return;
         slb_allocate(stack);
 
@@ -149,7 +149,7 @@ void switch_slb(struct task_struct *tsk, struct mm_struct *mm)
             || (GET_ESID(stack) == GET_ESID(unmapped_base)))
                 return;
 
-        if (unmapped_base >= KERNELBASE)
+        if (is_kernel_addr(unmapped_base))
                 return;
         slb_allocate(unmapped_base);
 }
@@ -213,10 +213,10 @@ void slb_initialize(void)
         asm volatile("isync":::"memory");
         asm volatile("slbmte  %0,%0"::"r" (0) : "memory");
         asm volatile("isync; slbia; isync":::"memory");
-        create_slbe(KERNELBASE, lflags, 0);
+        create_slbe(PAGE_OFFSET, lflags, 0);
 
         /* VMALLOC space has 4K pages always for now */
-        create_slbe(VMALLOCBASE, vflags, 1);
+        create_slbe(VMALLOC_START, vflags, 1);
 
         /* We don't bolt the stack for the time being - we're in boot,
          * so the stack is in the bolted segment.  By the time it goes
diff --git a/arch/powerpc/mm/slb_low.S b/arch/powerpc/mm/slb_low.S
index 950ffc5848c7..d1acee38f163 100644
--- a/arch/powerpc/mm/slb_low.S
+++ b/arch/powerpc/mm/slb_low.S
@@ -37,9 +37,9 @@ _GLOBAL(slb_allocate_realmode)
 
         srdi    r9,r3,60                /* get region */
         srdi    r10,r3,28               /* get esid */
-        cmpldi  cr7,r9,0xc              /* cmp KERNELBASE for later use */
+        cmpldi  cr7,r9,0xc              /* cmp PAGE_OFFSET for later use */
 
-        /* r3 = address, r10 = esid, cr7 = <>KERNELBASE */
+        /* r3 = address, r10 = esid, cr7 = <> PAGE_OFFSET */
         blt     cr7,0f                  /* user or kernel? */
 
         /* kernel address: proto-VSID = ESID */
@@ -166,7 +166,7 @@ _GLOBAL(slb_allocate_user)
 /*
  * Finish loading of an SLB entry and return
  *
- * r3 = EA, r10 = proto-VSID, r11 = flags, clobbers r9, cr7 = <>KERNELBASE
+ * r3 = EA, r10 = proto-VSID, r11 = flags, clobbers r9, cr7 = <> PAGE_OFFSET
  */
 slb_finish_load:
         ASM_VSID_SCRAMBLE(r10,r9)
diff --git a/arch/powerpc/mm/stab.c b/arch/powerpc/mm/stab.c
index 51e7951414e5..82e4951826bc 100644
--- a/arch/powerpc/mm/stab.c
+++ b/arch/powerpc/mm/stab.c
@@ -40,7 +40,7 @@ static int make_ste(unsigned long stab, unsigned long esid, unsigned long vsid)
         unsigned long entry, group, old_esid, castout_entry, i;
         unsigned int global_entry;
         struct stab_entry *ste, *castout_ste;
-        unsigned long kernel_segment = (esid << SID_SHIFT) >= KERNELBASE;
+        unsigned long kernel_segment = (esid << SID_SHIFT) >= PAGE_OFFSET;
 
         vsid_data = vsid << STE_VSID_SHIFT;
         esid_data = esid << SID_SHIFT | STE_ESID_KP | STE_ESID_V;
@@ -83,7 +83,7 @@ static int make_ste(unsigned long stab, unsigned long esid, unsigned long vsid)
                 }
 
                 /* Dont cast out the first kernel segment */
-                if ((castout_ste->esid_data & ESID_MASK) != KERNELBASE)
+                if ((castout_ste->esid_data & ESID_MASK) != PAGE_OFFSET)
                         break;
 
                 castout_entry = (castout_entry + 1) & 0xf;
@@ -122,7 +122,7 @@ static int __ste_allocate(unsigned long ea, struct mm_struct *mm)
         unsigned long offset;
 
         /* Kernel or user address? */
-        if (ea >= KERNELBASE) {
+        if (is_kernel_addr(ea)) {
                 vsid = get_kernel_vsid(ea);
         } else {
                 if ((ea >= TASK_SIZE_USER64) || (! mm))
@@ -133,7 +133,7 @@ static int __ste_allocate(unsigned long ea, struct mm_struct *mm)
 
         stab_entry = make_ste(get_paca()->stab_addr, GET_ESID(ea), vsid);
 
-        if (ea < KERNELBASE) {
+        if (!is_kernel_addr(ea)) {
                 offset = __get_cpu_var(stab_cache_ptr);
                 if (offset < NR_STAB_CACHE_ENTRIES)
                         __get_cpu_var(stab_cache[offset++]) = stab_entry;
@@ -190,7 +190,7 @@ void switch_stab(struct task_struct *tsk, struct mm_struct *mm)
                      entry++, ste++) {
                         unsigned long ea;
                         ea = ste->esid_data & ESID_MASK;
-                        if (ea < KERNELBASE) {
+                        if (!is_kernel_addr(ea)) {
                                 ste->esid_data = 0;
                         }
                 }
@@ -251,7 +251,7 @@ void stabs_alloc(void)
                         panic("Unable to allocate segment table for CPU %d.\n",
                               cpu);
 
-                newstab += KERNELBASE;
+                newstab = (unsigned long)__va(newstab);
 
                 memset((void *)newstab, 0, HW_PAGE_SIZE);
 
@@ -270,11 +270,11 @@ void stabs_alloc(void)
  */
 void stab_initialize(unsigned long stab)
 {
-        unsigned long vsid = get_kernel_vsid(KERNELBASE);
+        unsigned long vsid = get_kernel_vsid(PAGE_OFFSET);
         unsigned long stabreal;
 
         asm volatile("isync; slbia; isync":::"memory");
-        make_ste(stab, GET_ESID(KERNELBASE), vsid);
+        make_ste(stab, GET_ESID(PAGE_OFFSET), vsid);
 
         /* Order update */
         asm volatile("sync":::"memory");
diff --git a/arch/powerpc/mm/tlb_64.c b/arch/powerpc/mm/tlb_64.c
index 859d29a0cac5..bb3afb6e6317 100644
--- a/arch/powerpc/mm/tlb_64.c
+++ b/arch/powerpc/mm/tlb_64.c
@@ -168,7 +168,7 @@ void hpte_update(struct mm_struct *mm, unsigned long addr,
                 batch->mm = mm;
                 batch->psize = psize;
         }
-        if (addr < KERNELBASE) {
+        if (!is_kernel_addr(addr)) {
                 vsid = get_vsid(mm->context.id, addr);
                 WARN_ON(vsid == 0);
         } else
diff --git a/arch/powerpc/oprofile/Makefile b/arch/powerpc/oprofile/Makefile
index 0782d0cca89c..554cd7c75321 100644
--- a/arch/powerpc/oprofile/Makefile
+++ b/arch/powerpc/oprofile/Makefile
@@ -9,3 +9,4 @@ DRIVER_OBJS := $(addprefix ../../../drivers/oprofile/, \
 oprofile-y := $(DRIVER_OBJS) common.o
 oprofile-$(CONFIG_PPC64) += op_model_rs64.o op_model_power4.o
 oprofile-$(CONFIG_FSL_BOOKE) += op_model_fsl_booke.o
+oprofile-$(CONFIG_PPC32) += op_model_7450.o
diff --git a/arch/powerpc/oprofile/common.c b/arch/powerpc/oprofile/common.c
index af2c05d20ba5..71615eb70b2b 100644
--- a/arch/powerpc/oprofile/common.c
+++ b/arch/powerpc/oprofile/common.c
@@ -14,9 +14,6 @@
  */
 
 #include <linux/oprofile.h>
-#ifndef __powerpc64__
-#include <linux/slab.h>
-#endif /* ! __powerpc64__ */
 #include <linux/init.h>
 #include <linux/smp.h>
 #include <linux/errno.h>
@@ -31,10 +28,6 @@ static struct op_powerpc_model *model;
 static struct op_counter_config ctr[OP_MAX_COUNTER];
 static struct op_system_config sys;
 
-#ifndef __powerpc64__
-static char *cpu_type;
-#endif /* ! __powerpc64__ */
-
 static void op_handle_interrupt(struct pt_regs *regs)
 {
         model->handle_interrupt(regs, ctr);
@@ -53,14 +46,7 @@ static int op_powerpc_setup(void)
         model->reg_setup(ctr, &sys, model->num_counters);
 
         /* Configure the registers on all cpus.  */
-#ifdef __powerpc64__
         on_each_cpu(model->cpu_setup, NULL, 0, 1);
-#else /* __powerpc64__ */
-#if 0
-        /* FIXME: Make multi-cpu work */
-        on_each_cpu(model->reg_setup, NULL, 0, 1);
-#endif
-#endif /* __powerpc64__ */
 
         return 0;
 }
@@ -95,7 +81,7 @@ static int op_powerpc_create_files(struct super_block *sb, struct dentry *root)
 {
         int i;
 
-#ifdef __powerpc64__
+#ifdef CONFIG_PPC64
         /*
          * There is one mmcr0, mmcr1 and mmcra for setting the events for
          * all of the counters.
@@ -103,7 +89,7 @@ static int op_powerpc_create_files(struct super_block *sb, struct dentry *root)
         oprofilefs_create_ulong(sb, root, "mmcr0", &sys.mmcr0);
         oprofilefs_create_ulong(sb, root, "mmcr1", &sys.mmcr1);
         oprofilefs_create_ulong(sb, root, "mmcra", &sys.mmcra);
-#endif /* __powerpc64__ */
+#endif
 
         for (i = 0; i < model->num_counters; ++i) {
                 struct dentry *dir;
@@ -115,65 +101,68 @@ static int op_powerpc_create_files(struct super_block *sb, struct dentry *root)
                 oprofilefs_create_ulong(sb, dir, "enabled", &ctr[i].enabled);
                 oprofilefs_create_ulong(sb, dir, "event", &ctr[i].event);
                 oprofilefs_create_ulong(sb, dir, "count", &ctr[i].count);
-#ifdef __powerpc64__
+
                 /*
-                 * We dont support per counter user/kernel selection, but
-                 * we leave the entries because userspace expects them
+                 * Classic PowerPC doesn't support per-counter
+                 * control like this, but the options are
+                 * expected, so they remain.  For Freescale
+                 * Book-E style performance monitors, we do
+                 * support them.
                  */
-#endif /* __powerpc64__ */
                 oprofilefs_create_ulong(sb, dir, "kernel", &ctr[i].kernel);
                 oprofilefs_create_ulong(sb, dir, "user", &ctr[i].user);
 
-#ifndef __powerpc64__
-                /* FIXME: Not sure if this is used */
-#endif /* ! __powerpc64__ */
                 oprofilefs_create_ulong(sb, dir, "unit_mask", &ctr[i].unit_mask);
         }
 
         oprofilefs_create_ulong(sb, root, "enable_kernel", &sys.enable_kernel);
         oprofilefs_create_ulong(sb, root, "enable_user", &sys.enable_user);
-#ifdef __powerpc64__
+#ifdef CONFIG_PPC64
         oprofilefs_create_ulong(sb, root, "backtrace_spinlocks",
                                 &sys.backtrace_spinlocks);
-#endif /* __powerpc64__ */
+#endif
 
         /* Default to tracing both kernel and user */
         sys.enable_kernel = 1;
         sys.enable_user = 1;
-#ifdef __powerpc64__
+#ifdef CONFIG_PPC64
         /* Turn on backtracing through spinlocks by default */
         sys.backtrace_spinlocks = 1;
-#endif /* __powerpc64__ */
+#endif
 
         return 0;
 }
 
 int __init oprofile_arch_init(struct oprofile_operations *ops)
 {
-#ifndef __powerpc64__
-#ifdef CONFIG_FSL_BOOKE
-        model = &op_model_fsl_booke;
+        if (!cur_cpu_spec->oprofile_cpu_type)
+                return -ENODEV;
+
+        switch (cur_cpu_spec->oprofile_type) {
+#ifdef CONFIG_PPC64
+                case RS64:
+                        model = &op_model_rs64;
+                        break;
+                case POWER4:
+                        model = &op_model_power4;
+                        break;
 #else
-        return -ENODEV;
+                case G4:
+                        model = &op_model_7450;
+                        break;
 #endif
+#ifdef CONFIG_FSL_BOOKE
+                case BOOKE:
+                        model = &op_model_fsl_booke;
+                        break;
+#endif
+                default:
+                        return -ENODEV;
+        }
 
-        cpu_type = kmalloc(32, GFP_KERNEL);
-        if (NULL == cpu_type)
-                return -ENOMEM;
-
-        sprintf(cpu_type, "ppc/%s", cur_cpu_spec->cpu_name);
-
-        model->num_counters = cur_cpu_spec->num_pmcs;
-
-        ops->cpu_type = cpu_type;
-#else /* __powerpc64__ */
-        if (!cur_cpu_spec->oprofile_model || !cur_cpu_spec->oprofile_cpu_type)
-                return -ENODEV;
-        model = cur_cpu_spec->oprofile_model;
         model->num_counters = cur_cpu_spec->num_pmcs;
 
         ops->cpu_type = cur_cpu_spec->oprofile_cpu_type;
-#endif /* __powerpc64__ */
         ops->create_files = op_powerpc_create_files;
         ops->setup = op_powerpc_setup;
         ops->shutdown = op_powerpc_shutdown;
@@ -188,8 +177,4 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
 
 void oprofile_arch_exit(void)
 {
-#ifndef __powerpc64__
-        kfree(cpu_type);
-        cpu_type = NULL;
-#endif /* ! __powerpc64__ */
 }
diff --git a/arch/powerpc/oprofile/op_model_7450.c b/arch/powerpc/oprofile/op_model_7450.c
new file mode 100644
index 000000000000..32abfdbb0eb1
--- /dev/null
+++ b/arch/powerpc/oprofile/op_model_7450.c
@@ -0,0 +1,206 @@
+/*
+ * oprofile/op_model_7450.c
+ *
+ * Freescale 745x/744x oprofile support, based on fsl_booke support
+ * Copyright (C) 2004 Anton Blanchard <anton@au.ibm.com>, IBM
+ *
+ * Copyright (c) 2004 Freescale Semiconductor, Inc
+ *
+ * Author: Andy Fleming
+ * Maintainer: Kumar Gala <galak@kernel.crashing.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/oprofile.h>
+#include <linux/init.h>
+#include <linux/smp.h>
+#include <asm/ptrace.h>
+#include <asm/system.h>
+#include <asm/processor.h>
+#include <asm/cputable.h>
+#include <asm/page.h>
+#include <asm/pmc.h>
+#include <asm/oprofile_impl.h>
+
+static unsigned long reset_value[OP_MAX_COUNTER];
+
+static int oprofile_running;
+static u32 mmcr0_val, mmcr1_val, mmcr2_val;
+
+#define MMCR0_PMC1_SHIFT        6
+#define MMCR0_PMC2_SHIFT        0
+#define MMCR1_PMC3_SHIFT        27
+#define MMCR1_PMC4_SHIFT        22
+#define MMCR1_PMC5_SHIFT        17
+#define MMCR1_PMC6_SHIFT        11
+
+#define mmcr0_event1(event) \
+        ((event << MMCR0_PMC1_SHIFT) & MMCR0_PMC1SEL)
+#define mmcr0_event2(event) \
+        ((event << MMCR0_PMC2_SHIFT) & MMCR0_PMC2SEL)
+
+#define mmcr1_event3(event) \
+        ((event << MMCR1_PMC3_SHIFT) & MMCR1_PMC3SEL)
+#define mmcr1_event4(event) \
+        ((event << MMCR1_PMC4_SHIFT) & MMCR1_PMC4SEL)
+#define mmcr1_event5(event) \
+        ((event << MMCR1_PMC5_SHIFT) & MMCR1_PMC5SEL)
+#define mmcr1_event6(event) \
+        ((event << MMCR1_PMC6_SHIFT) & MMCR1_PMC6SEL)
+
+#define MMCR0_INIT (MMCR0_FC | MMCR0_FCS | MMCR0_FCP | MMCR0_FCM1 | MMCR0_FCM0)
+
+/* Unfreezes the counters on this CPU, enables the interrupt,
+ * enables the counters to trigger the interrupt, and sets the
+ * counters to only count when the mark bit is not set.
+ */
+static void pmc_start_ctrs(void)
+{
+        u32 mmcr0 = mfspr(SPRN_MMCR0);
+
+        mmcr0 &= ~(MMCR0_FC | MMCR0_FCM0);
+        mmcr0 |= (MMCR0_FCECE | MMCR0_PMC1CE | MMCR0_PMCnCE | MMCR0_PMXE);
+
+        mtspr(SPRN_MMCR0, mmcr0);
+}
+
+/* Disables the counters on this CPU, and freezes them */
+static void pmc_stop_ctrs(void)
+{
+        u32 mmcr0 = mfspr(SPRN_MMCR0);
+
+        mmcr0 |= MMCR0_FC;
+        mmcr0 &= ~(MMCR0_FCECE | MMCR0_PMC1CE | MMCR0_PMCnCE | MMCR0_PMXE);
+
+        mtspr(SPRN_MMCR0, mmcr0);
+}
+
+/* Configures the counters on this CPU based on the global
+ * settings */
+static void fsl7450_cpu_setup(void *unused)
+{
+        /* freeze all counters */
+        pmc_stop_ctrs();
+
+        mtspr(SPRN_MMCR0, mmcr0_val);
+        mtspr(SPRN_MMCR1, mmcr1_val);
+        mtspr(SPRN_MMCR2, mmcr2_val);
+}
+
+#define NUM_CTRS 6
+
+/* Configures the global settings for the countes on all CPUs. */
+static void fsl7450_reg_setup(struct op_counter_config *ctr,
+                             struct op_system_config *sys,
+                             int num_ctrs)
+{
+        int i;
+
+        /* Our counters count up, and "count" refers to
+         * how much before the next interrupt, and we interrupt
+         * on overflow.  So we calculate the starting value
+         * which will give us "count" until overflow.
+         * Then we set the events on the enabled counters */
+        for (i = 0; i < NUM_CTRS; ++i)
+                reset_value[i] = 0x80000000UL - ctr[i].count;
+
+        /* Set events for Counters 1 & 2 */
+        mmcr0_val = MMCR0_INIT | mmcr0_event1(ctr[0].event)
+                | mmcr0_event2(ctr[1].event);
+
+        /* Setup user/kernel bits */
+        if (sys->enable_kernel)
+                mmcr0_val &= ~(MMCR0_FCS);
+
+        if (sys->enable_user)
+                mmcr0_val &= ~(MMCR0_FCP);
+
+        /* Set events for Counters 3-6 */
+        mmcr1_val = mmcr1_event3(ctr[2].event)
+                | mmcr1_event4(ctr[3].event)
+                | mmcr1_event5(ctr[4].event)
+                | mmcr1_event6(ctr[5].event);
+
+        mmcr2_val = 0;
+}
+
+/* Sets the counters on this CPU to the chosen values, and starts them */
+static void fsl7450_start(struct op_counter_config *ctr)
+{
+        int i;
+
+        mtmsr(mfmsr() | MSR_PMM);
+
+        for (i = 0; i < NUM_CTRS; ++i) {
+                if (ctr[i].enabled)
+                        ctr_write(i, reset_value[i]);
+                else
+                        ctr_write(i, 0);
+        }
+
+        /* Clear the freeze bit, and enable the interrupt.
+         * The counters won't actually start until the rfi clears
+         * the PMM bit */
+        pmc_start_ctrs();
+
+        oprofile_running = 1;
+}
+
+/* Stop the counters on this CPU */
+static void fsl7450_stop(void)
+{
+        /* freeze counters */
+        pmc_stop_ctrs();
+
+        oprofile_running = 0;
+
+        mb();
+}
+
+
+/* Handle the interrupt on this CPU, and log a sample for each
+ * event that triggered the interrupt */
+static void fsl7450_handle_interrupt(struct pt_regs *regs,
+                                    struct op_counter_config *ctr)
+{
+        unsigned long pc;
+        int is_kernel;
+        int val;
+        int i;
+
+        /* set the PMM bit (see comment below) */
+        mtmsr(mfmsr() | MSR_PMM);
+
+        pc = mfspr(SPRN_SIAR);
+        is_kernel = (pc >= KERNELBASE);
+
+        for (i = 0; i < NUM_CTRS; ++i) {
+                val = ctr_read(i);
+                if (val < 0) {
+                        if (oprofile_running && ctr[i].enabled) {
+                                oprofile_add_pc(pc, is_kernel, i);
+                                ctr_write(i, reset_value[i]);
+                        } else {
+                                ctr_write(i, 0);
+                        }
+                }
+        }
+
+        /* The freeze bit was set by the interrupt. */
+        /* Clear the freeze bit, and reenable the interrupt.
+         * The counters won't actually start until the rfi clears
+         * the PMM bit */
+        pmc_start_ctrs();
+}
+
+struct op_powerpc_model op_model_7450= {
+        .reg_setup              = fsl7450_reg_setup,
+        .cpu_setup              = fsl7450_cpu_setup,
+        .start                  = fsl7450_start,
+        .stop                   = fsl7450_stop,
+        .handle_interrupt       = fsl7450_handle_interrupt,
+};
diff --git a/arch/powerpc/oprofile/op_model_power4.c b/arch/powerpc/oprofile/op_model_power4.c
index a3401b46f3ba..659a021da0c7 100644
--- a/arch/powerpc/oprofile/op_model_power4.c
+++ b/arch/powerpc/oprofile/op_model_power4.c
@@ -252,7 +252,7 @@ static unsigned long get_pc(struct pt_regs *regs)
                 return (unsigned long)__va(pc);
 
         /* Not sure where we were */
-        if (pc < KERNELBASE)
+        if (!is_kernel_addr(pc))
                 /* function descriptor madness */
                 return *((unsigned long *)kernel_unknown_bucket);
 
@@ -264,7 +264,7 @@ static int get_kernel(unsigned long pc)
         int is_kernel;
 
         if (!mmcra_has_sihv) {
-                is_kernel = (pc >= KERNELBASE);
+                is_kernel = is_kernel_addr(pc);
         } else {
                 unsigned long mmcra = mfspr(SPRN_MMCRA);
                 is_kernel = ((mmcra & MMCRA_SIPR) == 0);
diff --git a/arch/powerpc/oprofile/op_model_rs64.c b/arch/powerpc/oprofile/op_model_rs64.c
index e010b85996e8..5c909ee609fe 100644
--- a/arch/powerpc/oprofile/op_model_rs64.c
+++ b/arch/powerpc/oprofile/op_model_rs64.c
@@ -178,7 +178,6 @@ static void rs64_handle_interrupt(struct pt_regs *regs,
         int val;
         int i;
         unsigned long pc = mfspr(SPRN_SIAR);
-        int is_kernel = (pc >= KERNELBASE);
 
         /* set the PMM bit (see comment below) */
         mtmsrd(mfmsr() | MSR_PMM);
@@ -187,7 +186,7 @@ static void rs64_handle_interrupt(struct pt_regs *regs,
                 val = ctr_read(i);
                 if (val < 0) {
                         if (ctr[i].enabled) {
-                                oprofile_add_pc(pc, is_kernel, i);
+                                oprofile_add_pc(pc, is_kernel_addr(pc), i);
                                 ctr_write(i, reset_value[i]);
                         } else {
                                 ctr_write(i, 0);
diff --git a/arch/powerpc/platforms/cell/Kconfig b/arch/powerpc/platforms/cell/Kconfig
new file mode 100644
index 000000000000..3157071e241c
--- /dev/null
+++ b/arch/powerpc/platforms/cell/Kconfig
@@ -0,0 +1,13 @@
+menu "Cell Broadband Engine options"
+        depends on PPC_CELL
+
+config SPU_FS
+        tristate "SPU file system"
+        default m
+        depends on PPC_CELL
+        help
+          The SPU file system is used to access Synergistic Processing
+          Units on machines implementing the Broadband Processor
+          Architecture.
+
+endmenu
diff --git a/arch/powerpc/platforms/cell/Makefile b/arch/powerpc/platforms/cell/Makefile
index 55e094b96bc0..16031b565be4 100644
--- a/arch/powerpc/platforms/cell/Makefile
+++ b/arch/powerpc/platforms/cell/Makefile
@@ -1,2 +1,10 @@
 obj-y                   += interrupt.o iommu.o setup.o spider-pic.o
+obj-y                   += pervasive.o
+
 obj-$(CONFIG_SMP)       += smp.o
+obj-$(CONFIG_SPU_FS)    += spufs/ spu-base.o
+
+spu-base-y              += spu_base.o spu_priv1.o
+
+builtin-spufs-$(CONFIG_SPU_FS)  += spu_syscalls.o
+obj-y                   += $(builtin-spufs-m)
diff --git a/arch/powerpc/platforms/cell/interrupt.c b/arch/powerpc/platforms/cell/interrupt.c
index 7fbe78a9327d..63aa52acf441 100644
--- a/arch/powerpc/platforms/cell/interrupt.c
+++ b/arch/powerpc/platforms/cell/interrupt.c
@@ -23,6 +23,7 @@
 #include <linux/config.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
+#include <linux/module.h>
 #include <linux/percpu.h>
 #include <linux/types.h>
 
@@ -55,6 +56,7 @@ struct iic_regs {
 
 struct iic {
         struct iic_regs __iomem *regs;
+        u8 target_id;
 };
 
 static DEFINE_PER_CPU(struct iic, iic);
@@ -172,12 +174,11 @@ int iic_get_irq(struct pt_regs *regs)
         return irq;
 }
 
-static struct iic_regs __iomem *find_iic(int cpu)
+static int setup_iic(int cpu, struct iic *iic)
 {
         struct device_node *np;
         int nodeid = cpu / 2;
         unsigned long regs;
-        struct iic_regs __iomem *iic_regs;
 
         for (np = of_find_node_by_type(NULL, "cpu");
              np;
@@ -188,20 +189,23 @@ static struct iic_regs __iomem *find_iic(int cpu)
 
         if (!np) {
                 printk(KERN_WARNING "IIC: CPU %d not found\n", cpu);
-                iic_regs = NULL;
-        } else {
-                regs = *(long *)get_property(np, "iic", NULL);
-
-                /* hack until we have decided on the devtree info */
-                regs += 0x400;
-                if (cpu & 1)
-                        regs += 0x20;
-
-                printk(KERN_DEBUG "IIC for CPU %d at %lx\n", cpu, regs);
-                iic_regs = __ioremap(regs, sizeof(struct iic_regs),
-                                                 _PAGE_NO_CACHE);
+                iic->regs = NULL;
+                iic->target_id = 0xff;
+                return -ENODEV;
         }
-        return iic_regs;
+
+        regs = *(long *)get_property(np, "iic", NULL);
+
+        /* hack until we have decided on the devtree info */
+        regs += 0x400;
+        if (cpu & 1)
+                regs += 0x20;
+
+        printk(KERN_DEBUG "IIC for CPU %d at %lx\n", cpu, regs);
+        iic->regs = __ioremap(regs, sizeof(struct iic_regs),
+                                         _PAGE_NO_CACHE);
+        iic->target_id = (nodeid << 4) + ((cpu & 1) ? 0xf : 0xe);
+        return 0;
 }
 
 #ifdef CONFIG_SMP
@@ -227,6 +231,12 @@ void iic_cause_IPI(int cpu, int mesg)
         out_be64(&per_cpu(iic, cpu).regs->generate, (IIC_NUM_IPIS - 1 - mesg) << 4);
 }
 
+u8 iic_get_target_id(int cpu)
+{
+        return per_cpu(iic, cpu).target_id;
+}
+EXPORT_SYMBOL_GPL(iic_get_target_id);
+
 static irqreturn_t iic_ipi_action(int irq, void *dev_id, struct pt_regs *regs)
 {
         smp_message_recv(iic_irq_to_ipi(irq), regs);
@@ -276,7 +286,7 @@ void iic_init_IRQ(void)
         irq_offset = 0;
         for_each_cpu(cpu) {
                 iic = &per_cpu(iic, cpu);
-                iic->regs = find_iic(cpu);
+                setup_iic(cpu, iic);
                 if (iic->regs)
                         out_be64(&iic->regs->prio, 0xff);
         }
diff --git a/arch/powerpc/platforms/cell/interrupt.h b/arch/powerpc/platforms/cell/interrupt.h
index 37d58e6fd0c6..a14bd38791c0 100644
--- a/arch/powerpc/platforms/cell/interrupt.h
+++ b/arch/powerpc/platforms/cell/interrupt.h
@@ -54,6 +54,7 @@ extern void iic_setup_cpu(void);
 extern void iic_local_enable(void);
 extern void iic_local_disable(void);
 
+extern u8 iic_get_target_id(int cpu);
 
 extern void spider_init_IRQ(void);
 extern int spider_get_irq(unsigned long int_pending);
diff --git a/arch/powerpc/platforms/cell/iommu.c b/arch/powerpc/platforms/cell/iommu.c
index 74f999b4ac9e..46e7cb9c3e64 100644
--- a/arch/powerpc/platforms/cell/iommu.c
+++ b/arch/powerpc/platforms/cell/iommu.c
@@ -29,6 +29,8 @@
 #include <linux/bootmem.h>
 #include <linux/mm.h>
 #include <linux/dma-mapping.h>
+#include <linux/kernel.h>
+#include <linux/compiler.h>
 
 #include <asm/sections.h>
 #include <asm/iommu.h>
@@ -40,6 +42,7 @@
 #include <asm/abs_addr.h>
 #include <asm/system.h>
 #include <asm/ppc-pci.h>
+#include <asm/udbg.h>
 
 #include "iommu.h"
 
@@ -220,8 +223,6 @@ set_iopt_cache(void __iomem *base, unsigned long index,
 {
         unsigned long __iomem *tags = base + IOC_PT_CACHE_DIR;
         unsigned long __iomem *p = base + IOC_PT_CACHE_REG;
-        pr_debug("iopt %02lx was v%016lx/t%016lx, store v%016lx/t%016lx\n",
-                index, get_iopt_cache(base, index, &oldtag), oldtag, val, tag);
 
         out_be64(p, val);
         out_be64(&tags[index], tag);
@@ -248,67 +249,176 @@ set_iocmd_config(void __iomem *base)
         out_be64(p, conf | IOCMD_CONF_TE);
 }
 
-/* FIXME: get these from the device tree */
-#define ioc_base        0x20000511000ull
-#define ioc_mmio_base   0x20000510000ull
-#define ioid            0x48a
-#define iopt_phys_offset (- 0x20000000) /* We have a 512MB offset from the SB */
-#define io_page_size    0x1000000
-
-static unsigned long map_iopt_entry(unsigned long address)
+static void enable_mapping(void __iomem *base, void __iomem *mmio_base)
 {
-        switch (address >> 20) {
-        case 0x600:
-                address = 0x24020000000ull; /* spider i/o */
-                break;
-        default:
-                address += iopt_phys_offset;
-                break;
-        }
-
-        return get_iopt_entry(address, ioid, IOPT_PROT_RW);
+        set_iocmd_config(base);
+        set_iost_origin(mmio_base);
 }
 
-static void iommu_bus_setup_null(struct pci_bus *b) { }
 static void iommu_dev_setup_null(struct pci_dev *d) { }
+static void iommu_bus_setup_null(struct pci_bus *b) { }
+
+struct cell_iommu {
+        unsigned long base;
+        unsigned long mmio_base;
+        void __iomem *mapped_base;
+        void __iomem *mapped_mmio_base;
+};
+
+static struct cell_iommu cell_iommus[NR_CPUS];
 
 /* initialize the iommu to support a simple linear mapping
  * for each DMA window used by any device. For now, we
  * happen to know that there is only one DMA window in use,
  * starting at iopt_phys_offset. */
-static void cell_map_iommu(void)
+static void cell_do_map_iommu(struct cell_iommu *iommu,
+                              unsigned int ioid,
+                              unsigned long map_start,
+                              unsigned long map_size)
 {
-        unsigned long address;
-        void __iomem *base;
+        unsigned long io_address, real_address;
+        void __iomem *ioc_base, *ioc_mmio_base;
         ioste ioste;
         unsigned long index;
 
-        base = __ioremap(ioc_base, 0x1000, _PAGE_NO_CACHE);
-        pr_debug("%lx mapped to %p\n", ioc_base, base);
-        set_iocmd_config(base);
-        iounmap(base);
+        /* we pretend the io page table was at a very high address */
+        const unsigned long fake_iopt = 0x10000000000ul;
+        const unsigned long io_page_size = 0x1000000; /* use 16M pages */
+        const unsigned long io_segment_size = 0x10000000; /* 256M */
+
+        ioc_base = iommu->mapped_base;
+        ioc_mmio_base = iommu->mapped_mmio_base;
+
+        for (real_address = 0, io_address = 0;
+             io_address <= map_start + map_size;
+             real_address += io_page_size, io_address += io_page_size) {
+                ioste = get_iost_entry(fake_iopt, io_address, io_page_size);
+                if ((real_address % io_segment_size) == 0) /* segment start */
+                        set_iost_cache(ioc_mmio_base,
+                                       io_address >> 28, ioste);
+                index = get_ioc_hash_1way(ioste, io_address);
+                pr_debug("addr %08lx, index %02lx, ioste %016lx\n",
+                                         io_address, index, ioste.val);
+                set_iopt_cache(ioc_mmio_base,
+                        get_ioc_hash_1way(ioste, io_address),
+                        get_ioc_tag(ioste, io_address),
+                        get_iopt_entry(real_address-map_start, ioid, IOPT_PROT_RW));
+        }
+}
 
-        base = __ioremap(ioc_mmio_base, 0x1000, _PAGE_NO_CACHE);
-        pr_debug("%lx mapped to %p\n", ioc_mmio_base, base);
+static void iommu_devnode_setup(struct device_node *d)
+{
+        unsigned int *ioid;
+        unsigned long *dma_window, map_start, map_size, token;
+        struct cell_iommu *iommu;
 
-        set_iost_origin(base);
+        ioid = (unsigned int *)get_property(d, "ioid", NULL);
+        if (!ioid)
+                pr_debug("No ioid entry found !\n");
 
-        for (address = 0; address < 0x100000000ul; address += io_page_size) {
-                ioste = get_iost_entry(0x10000000000ul, address, io_page_size);
-                if ((address & 0xfffffff) == 0) /* segment start */
-                        set_iost_cache(base, address >> 28, ioste);
-                index = get_ioc_hash_1way(ioste, address);
-                pr_debug("addr %08lx, index %02lx, ioste %016lx\n",
-                                         address, index, ioste.val);
-                set_iopt_cache(base,
-                        get_ioc_hash_1way(ioste, address),
-                        get_ioc_tag(ioste, address),
-                        map_iopt_entry(address));
-        }
-        iounmap(base);
+        dma_window = (unsigned long *)get_property(d, "ibm,dma-window", NULL);
+        if (!dma_window)
+                pr_debug("No ibm,dma-window entry found !\n");
+
+        map_start = dma_window[1];
+        map_size = dma_window[2];
+        token = dma_window[0] >> 32;
+
+        iommu = &cell_iommus[token];
+
+        cell_do_map_iommu(iommu, *ioid, map_start, map_size);
+}
+
+static void iommu_bus_setup(struct pci_bus *b)
+{
+        struct device_node *d = (struct device_node *)b->sysdata;
+        iommu_devnode_setup(d);
+}
+
+
+static int cell_map_iommu_hardcoded(int num_nodes)
+{
+        struct cell_iommu *iommu = NULL;
+
+        pr_debug("%s(%d): Using hardcoded defaults\n", __FUNCTION__, __LINE__);
+
+        /* node 0 */
+        iommu = &cell_iommus[0];
+        iommu->mapped_base = __ioremap(0x20000511000, 0x1000, _PAGE_NO_CACHE);
+        iommu->mapped_mmio_base = __ioremap(0x20000510000, 0x1000, _PAGE_NO_CACHE);
+
+        enable_mapping(iommu->mapped_base, iommu->mapped_mmio_base);
+
+        cell_do_map_iommu(iommu, 0x048a,
+                          0x20000000ul,0x20000000ul);
+
+        if (num_nodes < 2)
+                return 0;
+
+        /* node 1 */
+        iommu = &cell_iommus[1];
+        iommu->mapped_base = __ioremap(0x30000511000, 0x1000, _PAGE_NO_CACHE);
+        iommu->mapped_mmio_base = __ioremap(0x30000510000, 0x1000, _PAGE_NO_CACHE);
+
+        enable_mapping(iommu->mapped_base, iommu->mapped_mmio_base);
+
+        cell_do_map_iommu(iommu, 0x048a,
+                          0x20000000,0x20000000ul);
+
+        return 0;
 }
 
 
+static int cell_map_iommu(void)
+{
+        unsigned int num_nodes = 0, *node_id;
+        unsigned long *base, *mmio_base;
+        struct device_node *dn;
+        struct cell_iommu *iommu = NULL;
+
+        /* determine number of nodes (=iommus) */
+        pr_debug("%s(%d): determining number of nodes...", __FUNCTION__, __LINE__);
+        for(dn = of_find_node_by_type(NULL, "cpu");
+            dn;
+            dn = of_find_node_by_type(dn, "cpu")) {
+                node_id = (unsigned int *)get_property(dn, "node-id", NULL);
+
+                if (num_nodes < *node_id)
+                        num_nodes = *node_id;
+                }
+
+        num_nodes++;
+        pr_debug("%i found.\n", num_nodes);
+
+        /* map the iommu registers for each node */
+        pr_debug("%s(%d): Looping through nodes\n", __FUNCTION__, __LINE__);
+        for(dn = of_find_node_by_type(NULL, "cpu");
+            dn;
+            dn = of_find_node_by_type(dn, "cpu")) {
+
+                node_id = (unsigned int *)get_property(dn, "node-id", NULL);
+                base = (unsigned long *)get_property(dn, "ioc-cache", NULL);
+                mmio_base = (unsigned long *)get_property(dn, "ioc-translation", NULL);
+
+                if (!base || !mmio_base || !node_id)
+                        return cell_map_iommu_hardcoded(num_nodes);
+
+                iommu = &cell_iommus[*node_id];
+                iommu->base = *base;
+                iommu->mmio_base = *mmio_base;
+
+                iommu->mapped_base = __ioremap(*base, 0x1000, _PAGE_NO_CACHE);
+                iommu->mapped_mmio_base = __ioremap(*mmio_base, 0x1000, _PAGE_NO_CACHE);
+
+                enable_mapping(iommu->mapped_base,
+                               iommu->mapped_mmio_base);
+
+                /* everything else will be done in iommu_bus_setup */
+        }
+
+        return 1;
+}
+
 static void *cell_alloc_coherent(struct device *hwdev, size_t size,
                            dma_addr_t *dma_handle, gfp_t flag)
 {
@@ -365,11 +475,28 @@ static int cell_dma_supported(struct device *dev, u64 mask)
 
 void cell_init_iommu(void)
 {
-        cell_map_iommu();
-
-        /* Direct I/O, IOMMU off */
-        ppc_md.iommu_dev_setup = iommu_dev_setup_null;
-        ppc_md.iommu_bus_setup = iommu_bus_setup_null;
+        int setup_bus = 0;
+
+        if (of_find_node_by_path("/mambo")) {
+                pr_info("Not using iommu on systemsim\n");
+        } else {
+
+                if (!(of_chosen &&
+                      get_property(of_chosen, "linux,iommu-off", NULL)))
+                        setup_bus = cell_map_iommu();
+
+                if (setup_bus) {
+                        pr_debug("%s: IOMMU mapping activated\n", __FUNCTION__);
+                        ppc_md.iommu_dev_setup = iommu_dev_setup_null;
+                        ppc_md.iommu_bus_setup = iommu_bus_setup;
+                } else {
+                        pr_debug("%s: IOMMU mapping activated, "
+                                 "no device action necessary\n", __FUNCTION__);
+                        /* Direct I/O, IOMMU off */
+                        ppc_md.iommu_dev_setup = iommu_dev_setup_null;
+                        ppc_md.iommu_bus_setup = iommu_bus_setup_null;
+                }
+        }
 
         pci_dma_ops.alloc_coherent = cell_alloc_coherent;
         pci_dma_ops.free_coherent = cell_free_coherent;
diff --git a/arch/powerpc/platforms/cell/pervasive.c b/arch/powerpc/platforms/cell/pervasive.c
new file mode 100644
index 000000000000..85152544c153
--- /dev/null
+++ b/arch/powerpc/platforms/cell/pervasive.c
@@ -0,0 +1,229 @@
+/*
+ * CBE Pervasive Monitor and Debug
+ *
+ * (C) Copyright IBM Corporation 2005
+ *
+ * Authors: Maximino Aguilar (maguilar@us.ibm.com)
+ *          Michael N. Day (mnday@us.ibm.com)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#undef DEBUG
+
+#include <linux/config.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/percpu.h>
+#include <linux/types.h>
+#include <linux/kallsyms.h>
+
+#include <asm/io.h>
+#include <asm/machdep.h>
+#include <asm/prom.h>
+#include <asm/pgtable.h>
+#include <asm/reg.h>
+
+#include "pervasive.h"
+
+static DEFINE_SPINLOCK(cbe_pervasive_lock);
+struct cbe_pervasive {
+        struct pmd_regs __iomem *regs;
+        unsigned int thread;
+};
+
+/* can't use per_cpu from setup_arch */
+static struct cbe_pervasive cbe_pervasive[NR_CPUS];
+
+static void __init cbe_enable_pause_zero(void)
+{
+        unsigned long thread_switch_control;
+        unsigned long temp_register;
+        struct cbe_pervasive *p;
+        int thread;
+
+        spin_lock_irq(&cbe_pervasive_lock);
+        p = &cbe_pervasive[smp_processor_id()];
+
+        if (!cbe_pervasive->regs)
+                goto out;
+
+        pr_debug("Power Management: CPU %d\n", smp_processor_id());
+
+         /* Enable Pause(0) control bit */
+        temp_register = in_be64(&p->regs->pm_control);
+
+        out_be64(&p->regs->pm_control,
+                 temp_register|PMD_PAUSE_ZERO_CONTROL);
+
+        /* Enable DEC and EE interrupt request */
+        thread_switch_control  = mfspr(SPRN_TSC_CELL);
+        thread_switch_control |= TSC_CELL_EE_ENABLE | TSC_CELL_EE_BOOST;
+
+        switch ((mfspr(SPRN_CTRLF) & CTRL_CT)) {
+        case CTRL_CT0:
+                thread_switch_control |= TSC_CELL_DEC_ENABLE_0;
+                thread = 0;
+                break;
+        case CTRL_CT1:
+                thread_switch_control |= TSC_CELL_DEC_ENABLE_1;
+                thread = 1;
+                break;
+        default:
+                printk(KERN_WARNING "%s: unknown configuration\n",
+                        __FUNCTION__);
+                thread = -1;
+                break;
+        }
+
+        if (p->thread != thread)
+                printk(KERN_WARNING "%s: device tree inconsistant, "
+                                     "cpu %i: %d/%d\n", __FUNCTION__,
+                                     smp_processor_id(),
+                                     p->thread, thread);
+
+        mtspr(SPRN_TSC_CELL, thread_switch_control);
+
+out:
+        spin_unlock_irq(&cbe_pervasive_lock);
+}
+
+static void cbe_idle(void)
+{
+        unsigned long ctrl;
+
+        cbe_enable_pause_zero();
+
+        while (1) {
+                if (!need_resched()) {
+                        local_irq_disable();
+                        while (!need_resched()) {
+                                /* go into low thread priority */
+                                HMT_low();
+
+                                /*
+                                 * atomically disable thread execution
+                                 * and runlatch.
+                                 * External and Decrementer exceptions
+                                 * are still handled when the thread
+                                 * is disabled but now enter in
+                                 * cbe_system_reset_exception()
+                                 */
+                                ctrl = mfspr(SPRN_CTRLF);
+                                ctrl &= ~(CTRL_RUNLATCH | CTRL_TE);
+                                mtspr(SPRN_CTRLT, ctrl);
+                        }
+                        /* restore thread prio */
+                        HMT_medium();
+                        local_irq_enable();
+                }
+
+                /*
+                 * turn runlatch on again before scheduling the
+                 * process we just woke up
+                 */
+                ppc64_runlatch_on();
+
+                preempt_enable_no_resched();
+                schedule();
+                preempt_disable();
+        }
+}
+
+int cbe_system_reset_exception(struct pt_regs *regs)
+{
+        switch (regs->msr & SRR1_WAKEMASK) {
+        case SRR1_WAKEEE:
+                do_IRQ(regs);
+                break;
+        case SRR1_WAKEDEC:
+                timer_interrupt(regs);
+                break;
+        case SRR1_WAKEMT:
+                /* no action required */
+                break;
+        default:
+                /* do system reset */
+                return 0;
+        }
+        /* everything handled */
+        return 1;
+}
+
+static int __init cbe_find_pmd_mmio(int cpu, struct cbe_pervasive *p)
+{
+        struct device_node *node;
+        unsigned int *int_servers;
+        char *addr;
+        unsigned long real_address;
+        unsigned int size;
+
+        struct pmd_regs __iomem *pmd_mmio_area;
+        int hardid, thread;
+        int proplen;
+
+        pmd_mmio_area = NULL;
+        hardid = get_hard_smp_processor_id(cpu);
+        for (node = NULL; (node = of_find_node_by_type(node, "cpu"));) {
+                int_servers = (void *) get_property(node,
+                                "ibm,ppc-interrupt-server#s", &proplen);
+                if (!int_servers) {
+                        printk(KERN_WARNING "%s misses "
+                                "ibm,ppc-interrupt-server#s property",
+                                node->full_name);
+                        continue;
+                }
+                for (thread = 0; thread < proplen / sizeof (int); thread++) {
+                        if (hardid == int_servers[thread]) {
+                                addr = get_property(node, "pervasive", NULL);
+                                goto found;
+                        }
+                }
+        }
+
+        printk(KERN_WARNING "%s: CPU %d not found\n", __FUNCTION__, cpu);
+        return -EINVAL;
+
+found:
+        real_address = *(unsigned long*) addr;
+        addr += sizeof (unsigned long);
+        size = *(unsigned int*) addr;
+
+        pr_debug("pervasive area for CPU %d at %lx, size %x\n",
+                        cpu, real_address, size);
+        p->regs = __ioremap(real_address, size, _PAGE_NO_CACHE);
+        p->thread = thread;
+        return 0;
+}
+
+void __init cell_pervasive_init(void)
+{
+        struct cbe_pervasive *p;
+        int cpu;
+        int ret;
+
+        if (!cpu_has_feature(CPU_FTR_PAUSE_ZERO))
+                return;
+
+        for_each_cpu(cpu) {
+                p = &cbe_pervasive[cpu];
+                ret = cbe_find_pmd_mmio(cpu, p);
+                if (ret)
+                        return;
+        }
+
+        ppc_md.idle_loop = cbe_idle;
+        ppc_md.system_reset_exception = cbe_system_reset_exception;
+}
diff --git a/arch/powerpc/platforms/cell/pervasive.h b/arch/powerpc/platforms/cell/pervasive.h
new file mode 100644
index 000000000000..da1fb85ca3e8
--- /dev/null
+++ b/arch/powerpc/platforms/cell/pervasive.h
@@ -0,0 +1,62 @@
+/*
+ * Cell Pervasive Monitor and Debug interface and HW structures
+ *
+ * (C) Copyright IBM Corporation 2005
+ *
+ * Authors: Maximino Aguilar (maguilar@us.ibm.com)
+ *          David J. Erb (djerb@us.ibm.com)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+
+#ifndef PERVASIVE_H
+#define PERVASIVE_H
+
+struct pmd_regs {
+        u8 pad_0x0000_0x0800[0x0800 - 0x0000];                  /* 0x0000 */
+
+        /* Thermal Sensor Registers */
+        u64  ts_ctsr1;                                          /* 0x0800 */
+        u64  ts_ctsr2;                                          /* 0x0808 */
+        u64  ts_mtsr1;                                          /* 0x0810 */
+        u64  ts_mtsr2;                                          /* 0x0818 */
+        u64  ts_itr1;                                           /* 0x0820 */
+        u64  ts_itr2;                                           /* 0x0828 */
+        u64  ts_gitr;                                           /* 0x0830 */
+        u64  ts_isr;                                            /* 0x0838 */
+        u64  ts_imr;                                            /* 0x0840 */
+        u64  tm_cr1;                                            /* 0x0848 */
+        u64  tm_cr2;                                            /* 0x0850 */
+        u64  tm_simr;                                           /* 0x0858 */
+        u64  tm_tpr;                                            /* 0x0860 */
+        u64  tm_str1;                                           /* 0x0868 */
+        u64  tm_str2;                                           /* 0x0870 */
+        u64  tm_tsr;                                            /* 0x0878 */
+
+        /* Power Management */
+        u64  pm_control;                                        /* 0x0880 */
+#define PMD_PAUSE_ZERO_CONTROL          0x10000
+        u64  pm_status;                                         /* 0x0888 */
+
+        /* Time Base Register */
+        u64  tbr;                                               /* 0x0890 */
+
+        u8   pad_0x0898_0x1000 [0x1000 - 0x0898];               /* 0x0898 */
+};
+
+void __init cell_pervasive_init(void);
+
+#endif
diff --git a/arch/powerpc/platforms/cell/setup.c b/arch/powerpc/platforms/cell/setup.c
index 9a495634d0c2..18e25e65c04b 100644
--- a/arch/powerpc/platforms/cell/setup.c
+++ b/arch/powerpc/platforms/cell/setup.c
@@ -33,6 +33,7 @@
 #include <asm/mmu.h>
 #include <asm/processor.h>
 #include <asm/io.h>
+#include <asm/kexec.h>
 #include <asm/pgtable.h>
 #include <asm/prom.h>
 #include <asm/rtas.h>
@@ -48,6 +49,7 @@
 
 #include "interrupt.h"
 #include "iommu.h"
+#include "pervasive.h"
 
 #ifdef DEBUG
 #define DBG(fmt...) udbg_printf(fmt)
@@ -67,6 +69,77 @@ void cell_show_cpuinfo(struct seq_file *m)
         of_node_put(root);
 }
 
+#ifdef CONFIG_SPARSEMEM
+static int __init find_spu_node_id(struct device_node *spe)
+{
+        unsigned int *id;
+#ifdef CONFIG_NUMA
+        struct device_node *cpu;
+        cpu = spe->parent->parent;
+        id = (unsigned int *)get_property(cpu, "node-id", NULL);
+#else
+        id = NULL;
+#endif
+        return id ? *id : 0;
+}
+
+static void __init cell_spuprop_present(struct device_node *spe,
+                                       const char *prop, int early)
+{
+        struct address_prop {
+                unsigned long address;
+                unsigned int len;
+        } __attribute__((packed)) *p;
+        int proplen;
+
+        unsigned long start_pfn, end_pfn, pfn;
+        int node_id;
+
+        p = (void*)get_property(spe, prop, &proplen);
+        WARN_ON(proplen != sizeof (*p));
+
+        node_id = find_spu_node_id(spe);
+
+        start_pfn = p->address >> PAGE_SHIFT;
+        end_pfn = (p->address + p->len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+
+        /* We need to call memory_present *before* the call to sparse_init,
+           but we can initialize the page structs only *after* that call.
+           Thus, we're being called twice. */
+        if (early)
+                memory_present(node_id, start_pfn, end_pfn);
+        else {
+                /* As the pages backing SPU LS and I/O are outside the range
+                   of regular memory, their page structs were not initialized
+                   by free_area_init. Do it here instead. */
+                for (pfn = start_pfn; pfn < end_pfn; pfn++) {
+                        struct page *page = pfn_to_page(pfn);
+                        set_page_links(page, ZONE_DMA, node_id, pfn);
+                        set_page_count(page, 1);
+                        reset_page_mapcount(page);
+                        SetPageReserved(page);
+                        INIT_LIST_HEAD(&page->lru);
+                }
+        }
+}
+
+static void __init cell_spumem_init(int early)
+{
+        struct device_node *node;
+        for (node = of_find_node_by_type(NULL, "spe");
+                        node; node = of_find_node_by_type(node, "spe")) {
+                cell_spuprop_present(node, "local-store", early);
+                cell_spuprop_present(node, "problem", early);
+                cell_spuprop_present(node, "priv1", early);
+                cell_spuprop_present(node, "priv2", early);
+        }
+}
+#else
+static void __init cell_spumem_init(int early)
+{
+}
+#endif
+
 static void cell_progress(char *s, unsigned short hex)
 {
         printk("*** %04x : %s\n", hex, s ? s : "");
@@ -93,11 +166,14 @@ static void __init cell_setup_arch(void)
         init_pci_config_tokens();
         find_and_init_phbs();
         spider_init_IRQ();
+        cell_pervasive_init();
 #ifdef CONFIG_DUMMY_CONSOLE
         conswitchp = &dummy_con;
 #endif
 
         mmio_nvram_init();
+
+        cell_spumem_init(0);
 }
 
 /*
@@ -113,6 +189,8 @@ static void __init cell_init_early(void)
 
         ppc64_interrupt_controller = IC_CELL_PIC;
 
+        cell_spumem_init(1);
+
         DBG(" <- cell_init_early()\n");
 }
 
@@ -125,6 +203,15 @@ static int __init cell_probe(int platform)
         return 1;
 }
 
+/*
+ * Cell has no legacy IO; anything calling this function has to
+ * fail or bad things will happen
+ */
+static int cell_check_legacy_ioport(unsigned int baseport)
+{
+        return -ENODEV;
+}
+
 struct machdep_calls __initdata cell_md = {
         .probe                  = cell_probe,
         .setup_arch             = cell_setup_arch,
@@ -137,5 +224,11 @@ struct machdep_calls __initdata cell_md = {
         .get_rtc_time           = rtas_get_rtc_time,
         .set_rtc_time           = rtas_set_rtc_time,
         .calibrate_decr         = generic_calibrate_decr,
+        .check_legacy_ioport    = cell_check_legacy_ioport,
         .progress               = cell_progress,
+#ifdef CONFIG_KEXEC
+        .machine_kexec          = default_machine_kexec,
+        .machine_kexec_prepare  = default_machine_kexec_prepare,
+        .machine_crash_shutdown = default_machine_crash_shutdown,
+#endif
 };
diff --git a/arch/powerpc/platforms/cell/spu_base.c b/arch/powerpc/platforms/cell/spu_base.c
new file mode 100644
index 000000000000..d75ae03df686
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spu_base.c
@@ -0,0 +1,711 @@
+/*
+ * Low-level SPU handling
+ *
+ * (C) Copyright IBM Deutschland Entwicklung GmbH 2005
+ *
+ * Author: Arnd Bergmann <arndb@de.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#undef DEBUG
+
+#include <linux/interrupt.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/poll.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/wait.h>
+
+#include <asm/io.h>
+#include <asm/prom.h>
+#include <asm/semaphore.h>
+#include <asm/spu.h>
+#include <asm/mmu_context.h>
+
+#include "interrupt.h"
+
+static int __spu_trap_invalid_dma(struct spu *spu)
+{
+        pr_debug("%s\n", __FUNCTION__);
+        force_sig(SIGBUS, /* info, */ current);
+        return 0;
+}
+
+static int __spu_trap_dma_align(struct spu *spu)
+{
+        pr_debug("%s\n", __FUNCTION__);
+        force_sig(SIGBUS, /* info, */ current);
+        return 0;
+}
+
+static int __spu_trap_error(struct spu *spu)
+{
+        pr_debug("%s\n", __FUNCTION__);
+        force_sig(SIGILL, /* info, */ current);
+        return 0;
+}
+
+static void spu_restart_dma(struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        if (!test_bit(SPU_CONTEXT_SWITCH_PENDING, &spu->flags))
+                out_be64(&priv2->mfc_control_RW, MFC_CNTL_RESTART_DMA_COMMAND);
+}
+
+static int __spu_trap_data_seg(struct spu *spu, unsigned long ea)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        struct mm_struct *mm = spu->mm;
+        u64 esid, vsid;
+
+        pr_debug("%s\n", __FUNCTION__);
+
+        if (test_bit(SPU_CONTEXT_SWITCH_ACTIVE, &spu->flags)) {
+                /* SLBs are pre-loaded for context switch, so
+                 * we should never get here!
+                 */
+                printk("%s: invalid access during switch!\n", __func__);
+                return 1;
+        }
+        if (!mm || (REGION_ID(ea) != USER_REGION_ID)) {
+                /* Future: support kernel segments so that drivers
+                 * can use SPUs.
+                 */
+                pr_debug("invalid region access at %016lx\n", ea);
+                return 1;
+        }
+
+        esid = (ea & ESID_MASK) | SLB_ESID_V;
+        vsid = (get_vsid(mm->context.id, ea) << SLB_VSID_SHIFT) | SLB_VSID_USER;
+        if (in_hugepage_area(mm->context, ea))
+                vsid |= SLB_VSID_L;
+
+        out_be64(&priv2->slb_index_W, spu->slb_replace);
+        out_be64(&priv2->slb_vsid_RW, vsid);
+        out_be64(&priv2->slb_esid_RW, esid);
+
+        spu->slb_replace++;
+        if (spu->slb_replace >= 8)
+                spu->slb_replace = 0;
+
+        spu_restart_dma(spu);
+
+        return 0;
+}
+
+extern int hash_page(unsigned long ea, unsigned long access, unsigned long trap); //XXX
+static int __spu_trap_data_map(struct spu *spu, unsigned long ea, u64 dsisr)
+{
+        pr_debug("%s\n", __FUNCTION__);
+
+        /* Handle kernel space hash faults immediately.
+           User hash faults need to be deferred to process context. */
+        if ((dsisr & MFC_DSISR_PTE_NOT_FOUND)
+            && REGION_ID(ea) != USER_REGION_ID
+            && hash_page(ea, _PAGE_PRESENT, 0x300) == 0) {
+                spu_restart_dma(spu);
+                return 0;
+        }
+
+        if (test_bit(SPU_CONTEXT_SWITCH_ACTIVE, &spu->flags)) {
+                printk("%s: invalid access during switch!\n", __func__);
+                return 1;
+        }
+
+        spu->dar = ea;
+        spu->dsisr = dsisr;
+        mb();
+        if (spu->stop_callback)
+                spu->stop_callback(spu);
+        return 0;
+}
+
+static int __spu_trap_mailbox(struct spu *spu)
+{
+        if (spu->ibox_callback)
+                spu->ibox_callback(spu);
+
+        /* atomically disable SPU mailbox interrupts */
+        spin_lock(&spu->register_lock);
+        spu_int_mask_and(spu, 2, ~0x1);
+        spin_unlock(&spu->register_lock);
+        return 0;
+}
+
+static int __spu_trap_stop(struct spu *spu)
+{
+        pr_debug("%s\n", __FUNCTION__);
+        spu->stop_code = in_be32(&spu->problem->spu_status_R);
+        if (spu->stop_callback)
+                spu->stop_callback(spu);
+        return 0;
+}
+
+static int __spu_trap_halt(struct spu *spu)
+{
+        pr_debug("%s\n", __FUNCTION__);
+        spu->stop_code = in_be32(&spu->problem->spu_status_R);
+        if (spu->stop_callback)
+                spu->stop_callback(spu);
+        return 0;
+}
+
+static int __spu_trap_tag_group(struct spu *spu)
+{
+        pr_debug("%s\n", __FUNCTION__);
+        /* wake_up(&spu->dma_wq); */
+        return 0;
+}
+
+static int __spu_trap_spubox(struct spu *spu)
+{
+        if (spu->wbox_callback)
+                spu->wbox_callback(spu);
+
+        /* atomically disable SPU mailbox interrupts */
+        spin_lock(&spu->register_lock);
+        spu_int_mask_and(spu, 2, ~0x10);
+        spin_unlock(&spu->register_lock);
+        return 0;
+}
+
+static irqreturn_t
+spu_irq_class_0(int irq, void *data, struct pt_regs *regs)
+{
+        struct spu *spu;
+
+        spu = data;
+        spu->class_0_pending = 1;
+        if (spu->stop_callback)
+                spu->stop_callback(spu);
+
+        return IRQ_HANDLED;
+}
+
+int
+spu_irq_class_0_bottom(struct spu *spu)
+{
+        unsigned long stat, mask;
+
+        spu->class_0_pending = 0;
+
+        mask = spu_int_mask_get(spu, 0);
+        stat = spu_int_stat_get(spu, 0);
+
+        stat &= mask;
+
+        if (stat & 1) /* invalid MFC DMA */
+                __spu_trap_invalid_dma(spu);
+
+        if (stat & 2) /* invalid DMA alignment */
+                __spu_trap_dma_align(spu);
+
+        if (stat & 4) /* error on SPU */
+                __spu_trap_error(spu);
+
+        spu_int_stat_clear(spu, 0, stat);
+
+        return (stat & 0x7) ? -EIO : 0;
+}
+EXPORT_SYMBOL_GPL(spu_irq_class_0_bottom);
+
+static irqreturn_t
+spu_irq_class_1(int irq, void *data, struct pt_regs *regs)
+{
+        struct spu *spu;
+        unsigned long stat, mask, dar, dsisr;
+
+        spu = data;
+
+        /* atomically read & clear class1 status. */
+        spin_lock(&spu->register_lock);
+        mask  = spu_int_mask_get(spu, 1);
+        stat  = spu_int_stat_get(spu, 1) & mask;
+        dar   = spu_mfc_dar_get(spu);
+        dsisr = spu_mfc_dsisr_get(spu);
+        if (stat & 2) /* mapping fault */
+                spu_mfc_dsisr_set(spu, 0ul);
+        spu_int_stat_clear(spu, 1, stat);
+        spin_unlock(&spu->register_lock);
+
+        if (stat & 1) /* segment fault */
+                __spu_trap_data_seg(spu, dar);
+
+        if (stat & 2) { /* mapping fault */
+                __spu_trap_data_map(spu, dar, dsisr);
+        }
+
+        if (stat & 4) /* ls compare & suspend on get */
+                ;
+
+        if (stat & 8) /* ls compare & suspend on put */
+                ;
+
+        return stat ? IRQ_HANDLED : IRQ_NONE;
+}
+EXPORT_SYMBOL_GPL(spu_irq_class_1_bottom);
+
+static irqreturn_t
+spu_irq_class_2(int irq, void *data, struct pt_regs *regs)
+{
+        struct spu *spu;
+        unsigned long stat;
+        unsigned long mask;
+
+        spu = data;
+        stat = spu_int_stat_get(spu, 2);
+        mask = spu_int_mask_get(spu, 2);
+
+        pr_debug("class 2 interrupt %d, %lx, %lx\n", irq, stat, mask);
+
+        stat &= mask;
+
+        if (stat & 1)  /* PPC core mailbox */
+                __spu_trap_mailbox(spu);
+
+        if (stat & 2) /* SPU stop-and-signal */
+                __spu_trap_stop(spu);
+
+        if (stat & 4) /* SPU halted */
+                __spu_trap_halt(spu);
+
+        if (stat & 8) /* DMA tag group complete */
+                __spu_trap_tag_group(spu);
+
+        if (stat & 0x10) /* SPU mailbox threshold */
+                __spu_trap_spubox(spu);
+
+        spu_int_stat_clear(spu, 2, stat);
+        return stat ? IRQ_HANDLED : IRQ_NONE;
+}
+
+static int
+spu_request_irqs(struct spu *spu)
+{
+        int ret;
+        int irq_base;
+
+        irq_base = IIC_NODE_STRIDE * spu->node + IIC_SPE_OFFSET;
+
+        snprintf(spu->irq_c0, sizeof (spu->irq_c0), "spe%02d.0", spu->number);
+        ret = request_irq(irq_base + spu->isrc,
+                 spu_irq_class_0, 0, spu->irq_c0, spu);
+        if (ret)
+                goto out;
+
+        snprintf(spu->irq_c1, sizeof (spu->irq_c1), "spe%02d.1", spu->number);
+        ret = request_irq(irq_base + IIC_CLASS_STRIDE + spu->isrc,
+                 spu_irq_class_1, 0, spu->irq_c1, spu);
+        if (ret)
+                goto out1;
+
+        snprintf(spu->irq_c2, sizeof (spu->irq_c2), "spe%02d.2", spu->number);
+        ret = request_irq(irq_base + 2*IIC_CLASS_STRIDE + spu->isrc,
+                 spu_irq_class_2, 0, spu->irq_c2, spu);
+        if (ret)
+                goto out2;
+        goto out;
+
+out2:
+        free_irq(irq_base + IIC_CLASS_STRIDE + spu->isrc, spu);
+out1:
+        free_irq(irq_base + spu->isrc, spu);
+out:
+        return ret;
+}
+
+static void
+spu_free_irqs(struct spu *spu)
+{
+        int irq_base;
+
+        irq_base = IIC_NODE_STRIDE * spu->node + IIC_SPE_OFFSET;
+
+        free_irq(irq_base + spu->isrc, spu);
+        free_irq(irq_base + IIC_CLASS_STRIDE + spu->isrc, spu);
+        free_irq(irq_base + 2*IIC_CLASS_STRIDE + spu->isrc, spu);
+}
+
+static LIST_HEAD(spu_list);
+static DECLARE_MUTEX(spu_mutex);
+
+static void spu_init_channels(struct spu *spu)
+{
+        static const struct {
+                 unsigned channel;
+                 unsigned count;
+        } zero_list[] = {
+                { 0x00, 1, }, { 0x01, 1, }, { 0x03, 1, }, { 0x04, 1, },
+                { 0x18, 1, }, { 0x19, 1, }, { 0x1b, 1, }, { 0x1d, 1, },
+        }, count_list[] = {
+                { 0x00, 0, }, { 0x03, 0, }, { 0x04, 0, }, { 0x15, 16, },
+                { 0x17, 1, }, { 0x18, 0, }, { 0x19, 0, }, { 0x1b, 0, },
+                { 0x1c, 1, }, { 0x1d, 0, }, { 0x1e, 1, },
+        };
+        struct spu_priv2 __iomem *priv2;
+        int i;
+
+        priv2 = spu->priv2;
+
+        /* initialize all channel data to zero */
+        for (i = 0; i < ARRAY_SIZE(zero_list); i++) {
+                int count;
+
+                out_be64(&priv2->spu_chnlcntptr_RW, zero_list[i].channel);
+                for (count = 0; count < zero_list[i].count; count++)
+                        out_be64(&priv2->spu_chnldata_RW, 0);
+        }
+
+        /* initialize channel counts to meaningful values */
+        for (i = 0; i < ARRAY_SIZE(count_list); i++) {
+                out_be64(&priv2->spu_chnlcntptr_RW, count_list[i].channel);
+                out_be64(&priv2->spu_chnlcnt_RW, count_list[i].count);
+        }
+}
+
+struct spu *spu_alloc(void)
+{
+        struct spu *spu;
+
+        down(&spu_mutex);
+        if (!list_empty(&spu_list)) {
+                spu = list_entry(spu_list.next, struct spu, list);
+                list_del_init(&spu->list);
+                pr_debug("Got SPU %x %d\n", spu->isrc, spu->number);
+        } else {
+                pr_debug("No SPU left\n");
+                spu = NULL;
+        }
+        up(&spu_mutex);
+
+        if (spu)
+                spu_init_channels(spu);
+
+        return spu;
+}
+EXPORT_SYMBOL_GPL(spu_alloc);
+
+void spu_free(struct spu *spu)
+{
+        down(&spu_mutex);
+        list_add_tail(&spu->list, &spu_list);
+        up(&spu_mutex);
+}
+EXPORT_SYMBOL_GPL(spu_free);
+
+static int spu_handle_mm_fault(struct spu *spu)
+{
+        struct mm_struct *mm = spu->mm;
+        struct vm_area_struct *vma;
+        u64 ea, dsisr, is_write;
+        int ret;
+
+        ea = spu->dar;
+        dsisr = spu->dsisr;
+#if 0
+        if (!IS_VALID_EA(ea)) {
+                return -EFAULT;
+        }
+#endif /* XXX */
+        if (mm == NULL) {
+                return -EFAULT;
+        }
+        if (mm->pgd == NULL) {
+                return -EFAULT;
+        }
+
+        down_read(&mm->mmap_sem);
+        vma = find_vma(mm, ea);
+        if (!vma)
+                goto bad_area;
+        if (vma->vm_start <= ea)
+                goto good_area;
+        if (!(vma->vm_flags & VM_GROWSDOWN))
+                goto bad_area;
+#if 0
+        if (expand_stack(vma, ea))
+                goto bad_area;
+#endif /* XXX */
+good_area:
+        is_write = dsisr & MFC_DSISR_ACCESS_PUT;
+        if (is_write) {
+                if (!(vma->vm_flags & VM_WRITE))
+                        goto bad_area;
+        } else {
+                if (dsisr & MFC_DSISR_ACCESS_DENIED)
+                        goto bad_area;
+                if (!(vma->vm_flags & (VM_READ | VM_EXEC)))
+                        goto bad_area;
+        }
+        ret = 0;
+        switch (handle_mm_fault(mm, vma, ea, is_write)) {
+        case VM_FAULT_MINOR:
+                current->min_flt++;
+                break;
+        case VM_FAULT_MAJOR:
+                current->maj_flt++;
+                break;
+        case VM_FAULT_SIGBUS:
+                ret = -EFAULT;
+                goto bad_area;
+        case VM_FAULT_OOM:
+                ret = -ENOMEM;
+                goto bad_area;
+        default:
+                BUG();
+        }
+        up_read(&mm->mmap_sem);
+        return ret;
+
+bad_area:
+        up_read(&mm->mmap_sem);
+        return -EFAULT;
+}
+
+int spu_irq_class_1_bottom(struct spu *spu)
+{
+        u64 ea, dsisr, access, error = 0UL;
+        int ret = 0;
+
+        ea = spu->dar;
+        dsisr = spu->dsisr;
+        if (dsisr & MFC_DSISR_PTE_NOT_FOUND) {
+                access = (_PAGE_PRESENT | _PAGE_USER);
+                access |= (dsisr & MFC_DSISR_ACCESS_PUT) ? _PAGE_RW : 0UL;
+                if (hash_page(ea, access, 0x300) != 0)
+                        error |= CLASS1_ENABLE_STORAGE_FAULT_INTR;
+        }
+        if ((error & CLASS1_ENABLE_STORAGE_FAULT_INTR) ||
+            (dsisr & MFC_DSISR_ACCESS_DENIED)) {
+                if ((ret = spu_handle_mm_fault(spu)) != 0)
+                        error |= CLASS1_ENABLE_STORAGE_FAULT_INTR;
+                else
+                        error &= ~CLASS1_ENABLE_STORAGE_FAULT_INTR;
+        }
+        spu->dar = 0UL;
+        spu->dsisr = 0UL;
+        if (!error) {
+                spu_restart_dma(spu);
+        } else {
+                __spu_trap_invalid_dma(spu);
+        }
+        return ret;
+}
+
+void spu_irq_setaffinity(struct spu *spu, int cpu)
+{
+        u64 target = iic_get_target_id(cpu);
+        u64 route = target << 48 | target << 32 | target << 16;
+        spu_int_route_set(spu, route);
+}
+EXPORT_SYMBOL_GPL(spu_irq_setaffinity);
+
+static void __iomem * __init map_spe_prop(struct device_node *n,
+                                                 const char *name)
+{
+        struct address_prop {
+                unsigned long address;
+                unsigned int len;
+        } __attribute__((packed)) *prop;
+
+        void *p;
+        int proplen;
+
+        p = get_property(n, name, &proplen);
+        if (proplen != sizeof (struct address_prop))
+                return NULL;
+
+        prop = p;
+
+        return ioremap(prop->address, prop->len);
+}
+
+static void spu_unmap(struct spu *spu)
+{
+        iounmap(spu->priv2);
+        iounmap(spu->priv1);
+        iounmap(spu->problem);
+        iounmap((u8 __iomem *)spu->local_store);
+}
+
+static int __init spu_map_device(struct spu *spu, struct device_node *spe)
+{
+        char *prop;
+        int ret;
+
+        ret = -ENODEV;
+        prop = get_property(spe, "isrc", NULL);
+        if (!prop)
+                goto out;
+        spu->isrc = *(unsigned int *)prop;
+
+        spu->name = get_property(spe, "name", NULL);
+        if (!spu->name)
+                goto out;
+
+        prop = get_property(spe, "local-store", NULL);
+        if (!prop)
+                goto out;
+        spu->local_store_phys = *(unsigned long *)prop;
+
+        /* we use local store as ram, not io memory */
+        spu->local_store = (void __force *)map_spe_prop(spe, "local-store");
+        if (!spu->local_store)
+                goto out;
+
+        spu->problem= map_spe_prop(spe, "problem");
+        if (!spu->problem)
+                goto out_unmap;
+
+        spu->priv1= map_spe_prop(spe, "priv1");
+        /* priv1 is not available on a hypervisor */
+
+        spu->priv2= map_spe_prop(spe, "priv2");
+        if (!spu->priv2)
+                goto out_unmap;
+        ret = 0;
+        goto out;
+
+out_unmap:
+        spu_unmap(spu);
+out:
+        return ret;
+}
+
+static int __init find_spu_node_id(struct device_node *spe)
+{
+        unsigned int *id;
+        struct device_node *cpu;
+
+        cpu = spe->parent->parent;
+        id = (unsigned int *)get_property(cpu, "node-id", NULL);
+
+        return id ? *id : 0;
+}
+
+static int __init create_spu(struct device_node *spe)
+{
+        struct spu *spu;
+        int ret;
+        static int number;
+
+        ret = -ENOMEM;
+        spu = kmalloc(sizeof (*spu), GFP_KERNEL);
+        if (!spu)
+                goto out;
+
+        ret = spu_map_device(spu, spe);
+        if (ret)
+                goto out_free;
+
+        spu->node = find_spu_node_id(spe);
+        spu->stop_code = 0;
+        spu->slb_replace = 0;
+        spu->mm = NULL;
+        spu->ctx = NULL;
+        spu->rq = NULL;
+        spu->pid = 0;
+        spu->class_0_pending = 0;
+        spu->flags = 0UL;
+        spu->dar = 0UL;
+        spu->dsisr = 0UL;
+        spin_lock_init(&spu->register_lock);
+
+        spu_mfc_sdr_set(spu, mfspr(SPRN_SDR1));
+        spu_mfc_sr1_set(spu, 0x33);
+
+        spu->ibox_callback = NULL;
+        spu->wbox_callback = NULL;
+        spu->stop_callback = NULL;
+
+        down(&spu_mutex);
+        spu->number = number++;
+        ret = spu_request_irqs(spu);
+        if (ret)
+                goto out_unmap;
+
+        list_add(&spu->list, &spu_list);
+        up(&spu_mutex);
+
+        pr_debug(KERN_DEBUG "Using SPE %s %02x %p %p %p %p %d\n",
+                spu->name, spu->isrc, spu->local_store,
+                spu->problem, spu->priv1, spu->priv2, spu->number);
+        goto out;
+
+out_unmap:
+        up(&spu_mutex);
+        spu_unmap(spu);
+out_free:
+        kfree(spu);
+out:
+        return ret;
+}
+
+static void destroy_spu(struct spu *spu)
+{
+        list_del_init(&spu->list);
+
+        spu_free_irqs(spu);
+        spu_unmap(spu);
+        kfree(spu);
+}
+
+static void cleanup_spu_base(void)
+{
+        struct spu *spu, *tmp;
+        down(&spu_mutex);
+        list_for_each_entry_safe(spu, tmp, &spu_list, list)
+                destroy_spu(spu);
+        up(&spu_mutex);
+}
+module_exit(cleanup_spu_base);
+
+static int __init init_spu_base(void)
+{
+        struct device_node *node;
+        int ret;
+
+        ret = -ENODEV;
+        for (node = of_find_node_by_type(NULL, "spe");
+                        node; node = of_find_node_by_type(node, "spe")) {
+                ret = create_spu(node);
+                if (ret) {
+                        printk(KERN_WARNING "%s: Error initializing %s\n",
+                                __FUNCTION__, node->name);
+                        cleanup_spu_base();
+                        break;
+                }
+        }
+        /* in some old firmware versions, the spe is called 'spc', so we
+           look for that as well */
+        for (node = of_find_node_by_type(NULL, "spc");
+                        node; node = of_find_node_by_type(node, "spc")) {
+                ret = create_spu(node);
+                if (ret) {
+                        printk(KERN_WARNING "%s: Error initializing %s\n",
+                                __FUNCTION__, node->name);
+                        cleanup_spu_base();
+                        break;
+                }
+        }
+        return ret;
+}
+module_init(init_spu_base);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Arnd Bergmann <arndb@de.ibm.com>");
diff --git a/arch/powerpc/platforms/cell/spu_priv1.c b/arch/powerpc/platforms/cell/spu_priv1.c
new file mode 100644
index 000000000000..b2656421c7b5
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spu_priv1.c
@@ -0,0 +1,133 @@
+/*
+ * access to SPU privileged registers
+ */
+#include <linux/module.h>
+
+#include <asm/io.h>
+#include <asm/spu.h>
+
+void spu_int_mask_and(struct spu *spu, int class, u64 mask)
+{
+        u64 old_mask;
+
+        old_mask = in_be64(&spu->priv1->int_mask_RW[class]);
+        out_be64(&spu->priv1->int_mask_RW[class], old_mask & mask);
+}
+EXPORT_SYMBOL_GPL(spu_int_mask_and);
+
+void spu_int_mask_or(struct spu *spu, int class, u64 mask)
+{
+        u64 old_mask;
+
+        old_mask = in_be64(&spu->priv1->int_mask_RW[class]);
+        out_be64(&spu->priv1->int_mask_RW[class], old_mask | mask);
+}
+EXPORT_SYMBOL_GPL(spu_int_mask_or);
+
+void spu_int_mask_set(struct spu *spu, int class, u64 mask)
+{
+        out_be64(&spu->priv1->int_mask_RW[class], mask);
+}
+EXPORT_SYMBOL_GPL(spu_int_mask_set);
+
+u64 spu_int_mask_get(struct spu *spu, int class)
+{
+        return in_be64(&spu->priv1->int_mask_RW[class]);
+}
+EXPORT_SYMBOL_GPL(spu_int_mask_get);
+
+void spu_int_stat_clear(struct spu *spu, int class, u64 stat)
+{
+        out_be64(&spu->priv1->int_stat_RW[class], stat);
+}
+EXPORT_SYMBOL_GPL(spu_int_stat_clear);
+
+u64 spu_int_stat_get(struct spu *spu, int class)
+{
+        return in_be64(&spu->priv1->int_stat_RW[class]);
+}
+EXPORT_SYMBOL_GPL(spu_int_stat_get);
+
+void spu_int_route_set(struct spu *spu, u64 route)
+{
+        out_be64(&spu->priv1->int_route_RW, route);
+}
+EXPORT_SYMBOL_GPL(spu_int_route_set);
+
+u64 spu_mfc_dar_get(struct spu *spu)
+{
+        return in_be64(&spu->priv1->mfc_dar_RW);
+}
+EXPORT_SYMBOL_GPL(spu_mfc_dar_get);
+
+u64 spu_mfc_dsisr_get(struct spu *spu)
+{
+        return in_be64(&spu->priv1->mfc_dsisr_RW);
+}
+EXPORT_SYMBOL_GPL(spu_mfc_dsisr_get);
+
+void spu_mfc_dsisr_set(struct spu *spu, u64 dsisr)
+{
+        out_be64(&spu->priv1->mfc_dsisr_RW, dsisr);
+}
+EXPORT_SYMBOL_GPL(spu_mfc_dsisr_set);
+
+void spu_mfc_sdr_set(struct spu *spu, u64 sdr)
+{
+        out_be64(&spu->priv1->mfc_sdr_RW, sdr);
+}
+EXPORT_SYMBOL_GPL(spu_mfc_sdr_set);
+
+void spu_mfc_sr1_set(struct spu *spu, u64 sr1)
+{
+        out_be64(&spu->priv1->mfc_sr1_RW, sr1);
+}
+EXPORT_SYMBOL_GPL(spu_mfc_sr1_set);
+
+u64 spu_mfc_sr1_get(struct spu *spu)
+{
+        return in_be64(&spu->priv1->mfc_sr1_RW);
+}
+EXPORT_SYMBOL_GPL(spu_mfc_sr1_get);
+
+void spu_mfc_tclass_id_set(struct spu *spu, u64 tclass_id)
+{
+        out_be64(&spu->priv1->mfc_tclass_id_RW, tclass_id);
+}
+EXPORT_SYMBOL_GPL(spu_mfc_tclass_id_set);
+
+u64 spu_mfc_tclass_id_get(struct spu *spu)
+{
+        return in_be64(&spu->priv1->mfc_tclass_id_RW);
+}
+EXPORT_SYMBOL_GPL(spu_mfc_tclass_id_get);
+
+void spu_tlb_invalidate(struct spu *spu)
+{
+        out_be64(&spu->priv1->tlb_invalidate_entry_W, 0ul);
+}
+EXPORT_SYMBOL_GPL(spu_tlb_invalidate);
+
+void spu_resource_allocation_groupID_set(struct spu *spu, u64 id)
+{
+        out_be64(&spu->priv1->resource_allocation_groupID_RW, id);
+}
+EXPORT_SYMBOL_GPL(spu_resource_allocation_groupID_set);
+
+u64 spu_resource_allocation_groupID_get(struct spu *spu)
+{
+        return in_be64(&spu->priv1->resource_allocation_groupID_RW);
+}
+EXPORT_SYMBOL_GPL(spu_resource_allocation_groupID_get);
+
+void spu_resource_allocation_enable_set(struct spu *spu, u64 enable)
+{
+        out_be64(&spu->priv1->resource_allocation_enable_RW, enable);
+}
+EXPORT_SYMBOL_GPL(spu_resource_allocation_enable_set);
+
+u64 spu_resource_allocation_enable_get(struct spu *spu)
+{
+        return in_be64(&spu->priv1->resource_allocation_enable_RW);
+}
+EXPORT_SYMBOL_GPL(spu_resource_allocation_enable_get);
diff --git a/arch/powerpc/platforms/cell/spu_syscalls.c b/arch/powerpc/platforms/cell/spu_syscalls.c
new file mode 100644
index 000000000000..261b507a901a
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spu_syscalls.c
@@ -0,0 +1,88 @@
+/*
+ * SPU file system -- system call stubs
+ *
+ * (C) Copyright IBM Deutschland Entwicklung GmbH 2005
+ *
+ * Author: Arnd Bergmann <arndb@de.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+#include <linux/file.h>
+#include <linux/module.h>
+#include <linux/syscalls.h>
+
+#include <asm/spu.h>
+
+struct spufs_calls spufs_calls = {
+        .owner = NULL,
+};
+
+/* These stub syscalls are needed to have the actual implementation
+ * within a loadable module. When spufs is built into the kernel,
+ * this file is not used and the syscalls directly enter the fs code */
+
+asmlinkage long sys_spu_create(const char __user *name,
+                unsigned int flags, mode_t mode)
+{
+        long ret;
+        struct module *owner = spufs_calls.owner;
+
+        ret = -ENOSYS;
+        if (owner && try_module_get(owner)) {
+                ret = spufs_calls.create_thread(name, flags, mode);
+                module_put(owner);
+        }
+        return ret;
+}
+
+asmlinkage long sys_spu_run(int fd, __u32 __user *unpc, __u32 __user *ustatus)
+{
+        long ret;
+        struct file *filp;
+        int fput_needed;
+        struct module *owner = spufs_calls.owner;
+
+        ret = -ENOSYS;
+        if (owner && try_module_get(owner)) {
+                ret = -EBADF;
+                filp = fget_light(fd, &fput_needed);
+                if (filp) {
+                        ret = spufs_calls.spu_run(filp, unpc, ustatus);
+                        fput_light(filp, fput_needed);
+                }
+                module_put(owner);
+        }
+        return ret;
+}
+
+int register_spu_syscalls(struct spufs_calls *calls)
+{
+        if (spufs_calls.owner)
+                return -EBUSY;
+
+        spufs_calls.create_thread = calls->create_thread;
+        spufs_calls.spu_run = calls->spu_run;
+        smp_mb();
+        spufs_calls.owner = calls->owner;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(register_spu_syscalls);
+
+void unregister_spu_syscalls(struct spufs_calls *calls)
+{
+        BUG_ON(spufs_calls.owner != calls->owner);
+        spufs_calls.owner = NULL;
+}
+EXPORT_SYMBOL_GPL(unregister_spu_syscalls);
diff --git a/arch/powerpc/platforms/cell/spufs/Makefile b/arch/powerpc/platforms/cell/spufs/Makefile
new file mode 100644
index 000000000000..a7cddf40e3d9
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/Makefile
@@ -0,0 +1,54 @@
+obj-$(CONFIG_SPU_FS) += spufs.o
+spufs-y += inode.o file.o context.o switch.o syscalls.o
+spufs-y += sched.o backing_ops.o hw_ops.o run.o
+
+# Rules to build switch.o with the help of SPU tool chain
+SPU_CROSS       := spu-
+SPU_CC          := $(SPU_CROSS)gcc
+SPU_AS          := $(SPU_CROSS)gcc
+SPU_LD          := $(SPU_CROSS)ld
+SPU_OBJCOPY     := $(SPU_CROSS)objcopy
+SPU_CFLAGS      := -O2 -Wall -I$(srctree)/include -I$(objtree)/include2
+SPU_AFLAGS      := -c -D__ASSEMBLY__ -I$(srctree)/include -I$(objtree)/include2
+SPU_LDFLAGS     := -N -Ttext=0x0
+
+$(obj)/switch.o: $(obj)/spu_save_dump.h $(obj)/spu_restore_dump.h
+
+# Compile SPU files
+      cmd_spu_cc = $(SPU_CC) $(SPU_CFLAGS) -c -o $@ $<
+quiet_cmd_spu_cc = SPU_CC  $@
+$(obj)/spu_%.o: $(src)/spu_%.c
+        $(call if_changed,spu_cc)
+
+# Assemble SPU files
+      cmd_spu_as = $(SPU_AS) $(SPU_AFLAGS) -o $@ $<
+quiet_cmd_spu_as = SPU_AS  $@
+$(obj)/spu_%.o: $(src)/spu_%.S
+        $(call if_changed,spu_as)
+
+# Link SPU Executables
+      cmd_spu_ld = $(SPU_LD) $(SPU_LDFLAGS) -o $@ $^
+quiet_cmd_spu_ld = SPU_LD  $@
+$(obj)/spu_%: $(obj)/spu_%_crt0.o $(obj)/spu_%.o
+        $(call if_changed,spu_ld)
+
+# Copy into binary format
+      cmd_spu_objcopy = $(SPU_OBJCOPY) -O binary $< $@
+quiet_cmd_spu_objcopy = OBJCOPY $@
+$(obj)/spu_%.bin: $(src)/spu_%
+        $(call if_changed,spu_objcopy)
+
+# create C code from ELF executable
+cmd_hexdump   = ( \
+                echo "/*" ; \
+                echo " * $*_dump.h: Copyright (C) 2005 IBM." ; \
+                echo " * Hex-dump auto generated from $*.c." ; \
+                echo " * Do not edit!" ; \
+                echo " */" ; \
+                echo "static unsigned int $*_code[] __page_aligned = {" ; \
+                hexdump -v -e '"0x" 4/1 "%02x" "," "\n"' $< ; \
+                echo "};" ; \
+                ) > $@
+quiet_cmd_hexdump = HEXDUMP $@
+$(obj)/%_dump.h: $(obj)/%.bin
+        $(call if_changed,hexdump)
diff --git a/arch/powerpc/platforms/cell/spufs/backing_ops.c b/arch/powerpc/platforms/cell/spufs/backing_ops.c
new file mode 100644
index 000000000000..a5c489a53c61
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/backing_ops.c
@@ -0,0 +1,308 @@
+/* backing_ops.c - query/set operations on saved SPU context.
+ *
+ * Copyright (C) IBM 2005
+ * Author: Mark Nutter <mnutter@us.ibm.com>
+ *
+ * These register operations allow SPUFS to operate on saved
+ * SPU contexts rather than hardware.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/errno.h>
+#include <linux/sched.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/vmalloc.h>
+#include <linux/smp.h>
+#include <linux/smp_lock.h>
+#include <linux/stddef.h>
+#include <linux/unistd.h>
+#include <linux/poll.h>
+
+#include <asm/io.h>
+#include <asm/spu.h>
+#include <asm/spu_csa.h>
+#include <asm/mmu_context.h>
+#include "spufs.h"
+
+/*
+ * Reads/writes to various problem and priv2 registers require
+ * state changes, i.e.  generate SPU events, modify channel
+ * counts, etc.
+ */
+
+static void gen_spu_event(struct spu_context *ctx, u32 event)
+{
+        u64 ch0_cnt;
+        u64 ch0_data;
+        u64 ch1_data;
+
+        ch0_cnt = ctx->csa.spu_chnlcnt_RW[0];
+        ch0_data = ctx->csa.spu_chnldata_RW[0];
+        ch1_data = ctx->csa.spu_chnldata_RW[1];
+        ctx->csa.spu_chnldata_RW[0] |= event;
+        if ((ch0_cnt == 0) && !(ch0_data & event) && (ch1_data & event)) {
+                ctx->csa.spu_chnlcnt_RW[0] = 1;
+        }
+}
+
+static int spu_backing_mbox_read(struct spu_context *ctx, u32 * data)
+{
+        u32 mbox_stat;
+        int ret = 0;
+
+        spin_lock(&ctx->csa.register_lock);
+        mbox_stat = ctx->csa.prob.mb_stat_R;
+        if (mbox_stat & 0x0000ff) {
+                /* Read the first available word.
+                 * Implementation note: the depth
+                 * of pu_mb_R is currently 1.
+                 */
+                *data = ctx->csa.prob.pu_mb_R;
+                ctx->csa.prob.mb_stat_R &= ~(0x0000ff);
+                ctx->csa.spu_chnlcnt_RW[28] = 1;
+                gen_spu_event(ctx, MFC_PU_MAILBOX_AVAILABLE_EVENT);
+                ret = 4;
+        }
+        spin_unlock(&ctx->csa.register_lock);
+        return ret;
+}
+
+static u32 spu_backing_mbox_stat_read(struct spu_context *ctx)
+{
+        return ctx->csa.prob.mb_stat_R;
+}
+
+static unsigned int spu_backing_mbox_stat_poll(struct spu_context *ctx,
+                                          unsigned int events)
+{
+        int ret;
+        u32 stat;
+
+        ret = 0;
+        spin_lock_irq(&ctx->csa.register_lock);
+        stat = ctx->csa.prob.mb_stat_R;
+
+        /* if the requested event is there, return the poll
+           mask, otherwise enable the interrupt to get notified,
+           but first mark any pending interrupts as done so
+           we don't get woken up unnecessarily */
+
+        if (events & (POLLIN | POLLRDNORM)) {
+                if (stat & 0xff0000)
+                        ret |= POLLIN | POLLRDNORM;
+                else {
+                        ctx->csa.priv1.int_stat_class0_RW &= ~0x1;
+                        ctx->csa.priv1.int_mask_class2_RW |= 0x1;
+                }
+        }
+        if (events & (POLLOUT | POLLWRNORM)) {
+                if (stat & 0x00ff00)
+                        ret = POLLOUT | POLLWRNORM;
+                else {
+                        ctx->csa.priv1.int_stat_class0_RW &= ~0x10;
+                        ctx->csa.priv1.int_mask_class2_RW |= 0x10;
+                }
+        }
+        spin_unlock_irq(&ctx->csa.register_lock);
+        return ret;
+}
+
+static int spu_backing_ibox_read(struct spu_context *ctx, u32 * data)
+{
+        int ret;
+
+        spin_lock(&ctx->csa.register_lock);
+        if (ctx->csa.prob.mb_stat_R & 0xff0000) {
+                /* Read the first available word.
+                 * Implementation note: the depth
+                 * of puint_mb_R is currently 1.
+                 */
+                *data = ctx->csa.priv2.puint_mb_R;
+                ctx->csa.prob.mb_stat_R &= ~(0xff0000);
+                ctx->csa.spu_chnlcnt_RW[30] = 1;
+                gen_spu_event(ctx, MFC_PU_INT_MAILBOX_AVAILABLE_EVENT);
+                ret = 4;
+        } else {
+                /* make sure we get woken up by the interrupt */
+                ctx->csa.priv1.int_mask_class2_RW |= 0x1UL;
+                ret = 0;
+        }
+        spin_unlock(&ctx->csa.register_lock);
+        return ret;
+}
+
+static int spu_backing_wbox_write(struct spu_context *ctx, u32 data)
+{
+        int ret;
+
+        spin_lock(&ctx->csa.register_lock);
+        if ((ctx->csa.prob.mb_stat_R) & 0x00ff00) {
+                int slot = ctx->csa.spu_chnlcnt_RW[29];
+                int avail = (ctx->csa.prob.mb_stat_R & 0x00ff00) >> 8;
+
+                /* We have space to write wbox_data.
+                 * Implementation note: the depth
+                 * of spu_mb_W is currently 4.
+                 */
+                BUG_ON(avail != (4 - slot));
+                ctx->csa.spu_mailbox_data[slot] = data;
+                ctx->csa.spu_chnlcnt_RW[29] = ++slot;
+                ctx->csa.prob.mb_stat_R = (((4 - slot) & 0xff) << 8);
+                gen_spu_event(ctx, MFC_SPU_MAILBOX_WRITTEN_EVENT);
+                ret = 4;
+        } else {
+                /* make sure we get woken up by the interrupt when space
+                   becomes available */
+                ctx->csa.priv1.int_mask_class2_RW |= 0x10;
+                ret = 0;
+        }
+        spin_unlock(&ctx->csa.register_lock);
+        return ret;
+}
+
+static u32 spu_backing_signal1_read(struct spu_context *ctx)
+{
+        return ctx->csa.spu_chnldata_RW[3];
+}
+
+static void spu_backing_signal1_write(struct spu_context *ctx, u32 data)
+{
+        spin_lock(&ctx->csa.register_lock);
+        if (ctx->csa.priv2.spu_cfg_RW & 0x1)
+                ctx->csa.spu_chnldata_RW[3] |= data;
+        else
+                ctx->csa.spu_chnldata_RW[3] = data;
+        ctx->csa.spu_chnlcnt_RW[3] = 1;
+        gen_spu_event(ctx, MFC_SIGNAL_1_EVENT);
+        spin_unlock(&ctx->csa.register_lock);
+}
+
+static u32 spu_backing_signal2_read(struct spu_context *ctx)
+{
+        return ctx->csa.spu_chnldata_RW[4];
+}
+
+static void spu_backing_signal2_write(struct spu_context *ctx, u32 data)
+{
+        spin_lock(&ctx->csa.register_lock);
+        if (ctx->csa.priv2.spu_cfg_RW & 0x2)
+                ctx->csa.spu_chnldata_RW[4] |= data;
+        else
+                ctx->csa.spu_chnldata_RW[4] = data;
+        ctx->csa.spu_chnlcnt_RW[4] = 1;
+        gen_spu_event(ctx, MFC_SIGNAL_2_EVENT);
+        spin_unlock(&ctx->csa.register_lock);
+}
+
+static void spu_backing_signal1_type_set(struct spu_context *ctx, u64 val)
+{
+        u64 tmp;
+
+        spin_lock(&ctx->csa.register_lock);
+        tmp = ctx->csa.priv2.spu_cfg_RW;
+        if (val)
+                tmp |= 1;
+        else
+                tmp &= ~1;
+        ctx->csa.priv2.spu_cfg_RW = tmp;
+        spin_unlock(&ctx->csa.register_lock);
+}
+
+static u64 spu_backing_signal1_type_get(struct spu_context *ctx)
+{
+        return ((ctx->csa.priv2.spu_cfg_RW & 1) != 0);
+}
+
+static void spu_backing_signal2_type_set(struct spu_context *ctx, u64 val)
+{
+        u64 tmp;
+
+        spin_lock(&ctx->csa.register_lock);
+        tmp = ctx->csa.priv2.spu_cfg_RW;
+        if (val)
+                tmp |= 2;
+        else
+                tmp &= ~2;
+        ctx->csa.priv2.spu_cfg_RW = tmp;
+        spin_unlock(&ctx->csa.register_lock);
+}
+
+static u64 spu_backing_signal2_type_get(struct spu_context *ctx)
+{
+        return ((ctx->csa.priv2.spu_cfg_RW & 2) != 0);
+}
+
+static u32 spu_backing_npc_read(struct spu_context *ctx)
+{
+        return ctx->csa.prob.spu_npc_RW;
+}
+
+static void spu_backing_npc_write(struct spu_context *ctx, u32 val)
+{
+        ctx->csa.prob.spu_npc_RW = val;
+}
+
+static u32 spu_backing_status_read(struct spu_context *ctx)
+{
+        return ctx->csa.prob.spu_status_R;
+}
+
+static char *spu_backing_get_ls(struct spu_context *ctx)
+{
+        return ctx->csa.lscsa->ls;
+}
+
+static void spu_backing_runcntl_write(struct spu_context *ctx, u32 val)
+{
+        spin_lock(&ctx->csa.register_lock);
+        ctx->csa.prob.spu_runcntl_RW = val;
+        if (val & SPU_RUNCNTL_RUNNABLE) {
+                ctx->csa.prob.spu_status_R |= SPU_STATUS_RUNNING;
+        } else {
+                ctx->csa.prob.spu_status_R &= ~SPU_STATUS_RUNNING;
+        }
+        spin_unlock(&ctx->csa.register_lock);
+}
+
+static void spu_backing_runcntl_stop(struct spu_context *ctx)
+{
+        spu_backing_runcntl_write(ctx, SPU_RUNCNTL_STOP);
+}
+
+struct spu_context_ops spu_backing_ops = {
+        .mbox_read = spu_backing_mbox_read,
+        .mbox_stat_read = spu_backing_mbox_stat_read,
+        .mbox_stat_poll = spu_backing_mbox_stat_poll,
+        .ibox_read = spu_backing_ibox_read,
+        .wbox_write = spu_backing_wbox_write,
+        .signal1_read = spu_backing_signal1_read,
+        .signal1_write = spu_backing_signal1_write,
+        .signal2_read = spu_backing_signal2_read,
+        .signal2_write = spu_backing_signal2_write,
+        .signal1_type_set = spu_backing_signal1_type_set,
+        .signal1_type_get = spu_backing_signal1_type_get,
+        .signal2_type_set = spu_backing_signal2_type_set,
+        .signal2_type_get = spu_backing_signal2_type_get,
+        .npc_read = spu_backing_npc_read,
+        .npc_write = spu_backing_npc_write,
+        .status_read = spu_backing_status_read,
+        .get_ls = spu_backing_get_ls,
+        .runcntl_write = spu_backing_runcntl_write,
+        .runcntl_stop = spu_backing_runcntl_stop,
+};
diff --git a/arch/powerpc/platforms/cell/spufs/context.c b/arch/powerpc/platforms/cell/spufs/context.c
new file mode 100644
index 000000000000..336f238102fd
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/context.c
@@ -0,0 +1,167 @@
+/*
+ * SPU file system -- SPU context management
+ *
+ * (C) Copyright IBM Deutschland Entwicklung GmbH 2005
+ *
+ * Author: Arnd Bergmann <arndb@de.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/fs.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <asm/spu.h>
+#include <asm/spu_csa.h>
+#include "spufs.h"
+
+struct spu_context *alloc_spu_context(struct address_space *local_store)
+{
+        struct spu_context *ctx;
+        ctx = kmalloc(sizeof *ctx, GFP_KERNEL);
+        if (!ctx)
+                goto out;
+        /* Binding to physical processor deferred
+         * until spu_activate().
+         */
+        spu_init_csa(&ctx->csa);
+        if (!ctx->csa.lscsa) {
+                goto out_free;
+        }
+        spin_lock_init(&ctx->mmio_lock);
+        kref_init(&ctx->kref);
+        init_rwsem(&ctx->state_sema);
+        init_MUTEX(&ctx->run_sema);
+        init_waitqueue_head(&ctx->ibox_wq);
+        init_waitqueue_head(&ctx->wbox_wq);
+        init_waitqueue_head(&ctx->stop_wq);
+        ctx->ibox_fasync = NULL;
+        ctx->wbox_fasync = NULL;
+        ctx->state = SPU_STATE_SAVED;
+        ctx->local_store = local_store;
+        ctx->spu = NULL;
+        ctx->ops = &spu_backing_ops;
+        ctx->owner = get_task_mm(current);
+        goto out;
+out_free:
+        kfree(ctx);
+        ctx = NULL;
+out:
+        return ctx;
+}
+
+void destroy_spu_context(struct kref *kref)
+{
+        struct spu_context *ctx;
+        ctx = container_of(kref, struct spu_context, kref);
+        down_write(&ctx->state_sema);
+        spu_deactivate(ctx);
+        ctx->ibox_fasync = NULL;
+        ctx->wbox_fasync = NULL;
+        up_write(&ctx->state_sema);
+        spu_fini_csa(&ctx->csa);
+        kfree(ctx);
+}
+
+struct spu_context * get_spu_context(struct spu_context *ctx)
+{
+        kref_get(&ctx->kref);
+        return ctx;
+}
+
+int put_spu_context(struct spu_context *ctx)
+{
+        return kref_put(&ctx->kref, &destroy_spu_context);
+}
+
+/* give up the mm reference when the context is about to be destroyed */
+void spu_forget(struct spu_context *ctx)
+{
+        struct mm_struct *mm;
+        spu_acquire_saved(ctx);
+        mm = ctx->owner;
+        ctx->owner = NULL;
+        mmput(mm);
+        spu_release(ctx);
+}
+
+void spu_acquire(struct spu_context *ctx)
+{
+        down_read(&ctx->state_sema);
+}
+
+void spu_release(struct spu_context *ctx)
+{
+        up_read(&ctx->state_sema);
+}
+
+void spu_unmap_mappings(struct spu_context *ctx)
+{
+        unmap_mapping_range(ctx->local_store, 0, LS_SIZE, 1);
+}
+
+int spu_acquire_runnable(struct spu_context *ctx)
+{
+        int ret = 0;
+
+        down_read(&ctx->state_sema);
+        if (ctx->state == SPU_STATE_RUNNABLE) {
+                ctx->spu->prio = current->prio;
+                return 0;
+        }
+        up_read(&ctx->state_sema);
+
+        down_write(&ctx->state_sema);
+        /* ctx is about to be freed, can't acquire any more */
+        if (!ctx->owner) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (ctx->state == SPU_STATE_SAVED) {
+                ret = spu_activate(ctx, 0);
+                if (ret)
+                        goto out;
+                ctx->state = SPU_STATE_RUNNABLE;
+        }
+
+        downgrade_write(&ctx->state_sema);
+        /* On success, we return holding the lock */
+
+        return ret;
+out:
+        /* Release here, to simplify calling code. */
+        up_write(&ctx->state_sema);
+
+        return ret;
+}
+
+void spu_acquire_saved(struct spu_context *ctx)
+{
+        down_read(&ctx->state_sema);
+
+        if (ctx->state == SPU_STATE_SAVED)
+                return;
+
+        up_read(&ctx->state_sema);
+        down_write(&ctx->state_sema);
+
+        if (ctx->state == SPU_STATE_RUNNABLE) {
+                spu_deactivate(ctx);
+                ctx->state = SPU_STATE_SAVED;
+        }
+
+        downgrade_write(&ctx->state_sema);
+}
diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c
new file mode 100644
index 000000000000..dfa649c9b956
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/file.c
@@ -0,0 +1,794 @@
+/*
+ * SPU file system -- file contents
+ *
+ * (C) Copyright IBM Deutschland Entwicklung GmbH 2005
+ *
+ * Author: Arnd Bergmann <arndb@de.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/fs.h>
+#include <linux/ioctl.h>
+#include <linux/module.h>
+#include <linux/pagemap.h>
+#include <linux/poll.h>
+#include <linux/ptrace.h>
+
+#include <asm/io.h>
+#include <asm/semaphore.h>
+#include <asm/spu.h>
+#include <asm/uaccess.h>
+
+#include "spufs.h"
+
+
+static int
+spufs_mem_open(struct inode *inode, struct file *file)
+{
+        struct spufs_inode_info *i = SPUFS_I(inode);
+        file->private_data = i->i_ctx;
+        file->f_mapping = i->i_ctx->local_store;
+        return 0;
+}
+
+static ssize_t
+spufs_mem_read(struct file *file, char __user *buffer,
+                                size_t size, loff_t *pos)
+{
+        struct spu_context *ctx = file->private_data;
+        char *local_store;
+        int ret;
+
+        spu_acquire(ctx);
+
+        local_store = ctx->ops->get_ls(ctx);
+        ret = simple_read_from_buffer(buffer, size, pos, local_store, LS_SIZE);
+
+        spu_release(ctx);
+        return ret;
+}
+
+static ssize_t
+spufs_mem_write(struct file *file, const char __user *buffer,
+                                        size_t size, loff_t *pos)
+{
+        struct spu_context *ctx = file->private_data;
+        char *local_store;
+        int ret;
+
+        size = min_t(ssize_t, LS_SIZE - *pos, size);
+        if (size <= 0)
+                return -EFBIG;
+        *pos += size;
+
+        spu_acquire(ctx);
+
+        local_store = ctx->ops->get_ls(ctx);
+        ret = copy_from_user(local_store + *pos - size,
+                             buffer, size) ? -EFAULT : size;
+
+        spu_release(ctx);
+        return ret;
+}
+
+#ifdef CONFIG_SPARSEMEM
+static struct page *
+spufs_mem_mmap_nopage(struct vm_area_struct *vma,
+                      unsigned long address, int *type)
+{
+        struct page *page = NOPAGE_SIGBUS;
+
+        struct spu_context *ctx = vma->vm_file->private_data;
+        unsigned long offset = address - vma->vm_start;
+        offset += vma->vm_pgoff << PAGE_SHIFT;
+
+        spu_acquire(ctx);
+
+        if (ctx->state == SPU_STATE_SAVED)
+                page = vmalloc_to_page(ctx->csa.lscsa->ls + offset);
+        else
+                page = pfn_to_page((ctx->spu->local_store_phys + offset)
+                                   >> PAGE_SHIFT);
+
+        spu_release(ctx);
+
+        if (type)
+                *type = VM_FAULT_MINOR;
+
+        page_cache_get(page);
+        return page;
+}
+
+static struct vm_operations_struct spufs_mem_mmap_vmops = {
+        .nopage = spufs_mem_mmap_nopage,
+};
+
+static int
+spufs_mem_mmap(struct file *file, struct vm_area_struct *vma)
+{
+        if (!(vma->vm_flags & VM_SHARED))
+                return -EINVAL;
+
+        /* FIXME: */
+        vma->vm_page_prot = __pgprot(pgprot_val(vma->vm_page_prot)
+                                     | _PAGE_NO_CACHE);
+
+        vma->vm_ops = &spufs_mem_mmap_vmops;
+        return 0;
+}
+#endif
+
+static struct file_operations spufs_mem_fops = {
+        .open    = spufs_mem_open,
+        .read    = spufs_mem_read,
+        .write   = spufs_mem_write,
+        .llseek  = generic_file_llseek,
+#ifdef CONFIG_SPARSEMEM
+        .mmap    = spufs_mem_mmap,
+#endif
+};
+
+static int
+spufs_regs_open(struct inode *inode, struct file *file)
+{
+        struct spufs_inode_info *i = SPUFS_I(inode);
+        file->private_data = i->i_ctx;
+        return 0;
+}
+
+static ssize_t
+spufs_regs_read(struct file *file, char __user *buffer,
+                size_t size, loff_t *pos)
+{
+        struct spu_context *ctx = file->private_data;
+        struct spu_lscsa *lscsa = ctx->csa.lscsa;
+        int ret;
+
+        spu_acquire_saved(ctx);
+
+        ret = simple_read_from_buffer(buffer, size, pos,
+                                      lscsa->gprs, sizeof lscsa->gprs);
+
+        spu_release(ctx);
+        return ret;
+}
+
+static ssize_t
+spufs_regs_write(struct file *file, const char __user *buffer,
+                 size_t size, loff_t *pos)
+{
+        struct spu_context *ctx = file->private_data;
+        struct spu_lscsa *lscsa = ctx->csa.lscsa;
+        int ret;
+
+        size = min_t(ssize_t, sizeof lscsa->gprs - *pos, size);
+        if (size <= 0)
+                return -EFBIG;
+        *pos += size;
+
+        spu_acquire_saved(ctx);
+
+        ret = copy_from_user(lscsa->gprs + *pos - size,
+                             buffer, size) ? -EFAULT : size;
+
+        spu_release(ctx);
+        return ret;
+}
+
+static struct file_operations spufs_regs_fops = {
+        .open    = spufs_regs_open,
+        .read    = spufs_regs_read,
+        .write   = spufs_regs_write,
+        .llseek  = generic_file_llseek,
+};
+
+static ssize_t
+spufs_fpcr_read(struct file *file, char __user * buffer,
+                size_t size, loff_t * pos)
+{
+        struct spu_context *ctx = file->private_data;
+        struct spu_lscsa *lscsa = ctx->csa.lscsa;
+        int ret;
+
+        spu_acquire_saved(ctx);
+
+        ret = simple_read_from_buffer(buffer, size, pos,
+                                      &lscsa->fpcr, sizeof(lscsa->fpcr));
+
+        spu_release(ctx);
+        return ret;
+}
+
+static ssize_t
+spufs_fpcr_write(struct file *file, const char __user * buffer,
+                 size_t size, loff_t * pos)
+{
+        struct spu_context *ctx = file->private_data;
+        struct spu_lscsa *lscsa = ctx->csa.lscsa;
+        int ret;
+
+        size = min_t(ssize_t, sizeof(lscsa->fpcr) - *pos, size);
+        if (size <= 0)
+                return -EFBIG;
+        *pos += size;
+
+        spu_acquire_saved(ctx);
+
+        ret = copy_from_user((char *)&lscsa->fpcr + *pos - size,
+                             buffer, size) ? -EFAULT : size;
+
+        spu_release(ctx);
+        return ret;
+}
+
+static struct file_operations spufs_fpcr_fops = {
+        .open = spufs_regs_open,
+        .read = spufs_fpcr_read,
+        .write = spufs_fpcr_write,
+        .llseek = generic_file_llseek,
+};
+
+/* generic open function for all pipe-like files */
+static int spufs_pipe_open(struct inode *inode, struct file *file)
+{
+        struct spufs_inode_info *i = SPUFS_I(inode);
+        file->private_data = i->i_ctx;
+
+        return nonseekable_open(inode, file);
+}
+
+static ssize_t spufs_mbox_read(struct file *file, char __user *buf,
+                        size_t len, loff_t *pos)
+{
+        struct spu_context *ctx = file->private_data;
+        u32 mbox_data;
+        int ret;
+
+        if (len < 4)
+                return -EINVAL;
+
+        spu_acquire(ctx);
+        ret = ctx->ops->mbox_read(ctx, &mbox_data);
+        spu_release(ctx);
+
+        if (!ret)
+                return -EAGAIN;
+
+        if (copy_to_user(buf, &mbox_data, sizeof mbox_data))
+                return -EFAULT;
+
+        return 4;
+}
+
+static struct file_operations spufs_mbox_fops = {
+        .open   = spufs_pipe_open,
+        .read   = spufs_mbox_read,
+};
+
+static ssize_t spufs_mbox_stat_read(struct file *file, char __user *buf,
+                        size_t len, loff_t *pos)
+{
+        struct spu_context *ctx = file->private_data;
+        u32 mbox_stat;
+
+        if (len < 4)
+                return -EINVAL;
+
+        spu_acquire(ctx);
+
+        mbox_stat = ctx->ops->mbox_stat_read(ctx) & 0xff;
+
+        spu_release(ctx);
+
+        if (copy_to_user(buf, &mbox_stat, sizeof mbox_stat))
+                return -EFAULT;
+
+        return 4;
+}
+
+static struct file_operations spufs_mbox_stat_fops = {
+        .open   = spufs_pipe_open,
+        .read   = spufs_mbox_stat_read,
+};
+
+/* low-level ibox access function */
+size_t spu_ibox_read(struct spu_context *ctx, u32 *data)
+{
+        return ctx->ops->ibox_read(ctx, data);
+}
+
+static int spufs_ibox_fasync(int fd, struct file *file, int on)
+{
+        struct spu_context *ctx = file->private_data;
+
+        return fasync_helper(fd, file, on, &ctx->ibox_fasync);
+}
+
+/* interrupt-level ibox callback function. */
+void spufs_ibox_callback(struct spu *spu)
+{
+        struct spu_context *ctx = spu->ctx;
+
+        wake_up_all(&ctx->ibox_wq);
+        kill_fasync(&ctx->ibox_fasync, SIGIO, POLLIN);
+}
+
+static ssize_t spufs_ibox_read(struct file *file, char __user *buf,
+                        size_t len, loff_t *pos)
+{
+        struct spu_context *ctx = file->private_data;
+        u32 ibox_data;
+        ssize_t ret;
+
+        if (len < 4)
+                return -EINVAL;
+
+        spu_acquire(ctx);
+
+        ret = 0;
+        if (file->f_flags & O_NONBLOCK) {
+                if (!spu_ibox_read(ctx, &ibox_data))
+                        ret = -EAGAIN;
+        } else {
+                ret = spufs_wait(ctx->ibox_wq, spu_ibox_read(ctx, &ibox_data));
+        }
+
+        spu_release(ctx);
+
+        if (ret)
+                return ret;
+
+        ret = 4;
+        if (copy_to_user(buf, &ibox_data, sizeof ibox_data))
+                ret = -EFAULT;
+
+        return ret;
+}
+
+static unsigned int spufs_ibox_poll(struct file *file, poll_table *wait)
+{
+        struct spu_context *ctx = file->private_data;
+        unsigned int mask;
+
+        poll_wait(file, &ctx->ibox_wq, wait);
+
+        spu_acquire(ctx);
+        mask = ctx->ops->mbox_stat_poll(ctx, POLLIN | POLLRDNORM);
+        spu_release(ctx);
+
+        return mask;
+}
+
+static struct file_operations spufs_ibox_fops = {
+        .open   = spufs_pipe_open,
+        .read   = spufs_ibox_read,
+        .poll   = spufs_ibox_poll,
+        .fasync = spufs_ibox_fasync,
+};
+
+static ssize_t spufs_ibox_stat_read(struct file *file, char __user *buf,
+                        size_t len, loff_t *pos)
+{
+        struct spu_context *ctx = file->private_data;
+        u32 ibox_stat;
+
+        if (len < 4)
+                return -EINVAL;
+
+        spu_acquire(ctx);
+        ibox_stat = (ctx->ops->mbox_stat_read(ctx) >> 16) & 0xff;
+        spu_release(ctx);
+
+        if (copy_to_user(buf, &ibox_stat, sizeof ibox_stat))
+                return -EFAULT;
+
+        return 4;
+}
+
+static struct file_operations spufs_ibox_stat_fops = {
+        .open   = spufs_pipe_open,
+        .read   = spufs_ibox_stat_read,
+};
+
+/* low-level mailbox write */
+size_t spu_wbox_write(struct spu_context *ctx, u32 data)
+{
+        return ctx->ops->wbox_write(ctx, data);
+}
+
+static int spufs_wbox_fasync(int fd, struct file *file, int on)
+{
+        struct spu_context *ctx = file->private_data;
+        int ret;
+
+        ret = fasync_helper(fd, file, on, &ctx->wbox_fasync);
+
+        return ret;
+}
+
+/* interrupt-level wbox callback function. */
+void spufs_wbox_callback(struct spu *spu)
+{
+        struct spu_context *ctx = spu->ctx;
+
+        wake_up_all(&ctx->wbox_wq);
+        kill_fasync(&ctx->wbox_fasync, SIGIO, POLLOUT);
+}
+
+static ssize_t spufs_wbox_write(struct file *file, const char __user *buf,
+                        size_t len, loff_t *pos)
+{
+        struct spu_context *ctx = file->private_data;
+        u32 wbox_data;
+        int ret;
+
+        if (len < 4)
+                return -EINVAL;
+
+        if (copy_from_user(&wbox_data, buf, sizeof wbox_data))
+                return -EFAULT;
+
+        spu_acquire(ctx);
+
+        ret = 0;
+        if (file->f_flags & O_NONBLOCK) {
+                if (!spu_wbox_write(ctx, wbox_data))
+                        ret = -EAGAIN;
+        } else {
+                ret = spufs_wait(ctx->wbox_wq, spu_wbox_write(ctx, wbox_data));
+        }
+
+        spu_release(ctx);
+
+        return ret ? ret : sizeof wbox_data;
+}
+
+static unsigned int spufs_wbox_poll(struct file *file, poll_table *wait)
+{
+        struct spu_context *ctx = file->private_data;
+        unsigned int mask;
+
+        poll_wait(file, &ctx->wbox_wq, wait);
+
+        spu_acquire(ctx);
+        mask = ctx->ops->mbox_stat_poll(ctx, POLLOUT | POLLWRNORM);
+        spu_release(ctx);
+
+        return mask;
+}
+
+static struct file_operations spufs_wbox_fops = {
+        .open   = spufs_pipe_open,
+        .write  = spufs_wbox_write,
+        .poll   = spufs_wbox_poll,
+        .fasync = spufs_wbox_fasync,
+};
+
+static ssize_t spufs_wbox_stat_read(struct file *file, char __user *buf,
+                        size_t len, loff_t *pos)
+{
+        struct spu_context *ctx = file->private_data;
+        u32 wbox_stat;
+
+        if (len < 4)
+                return -EINVAL;
+
+        spu_acquire(ctx);
+        wbox_stat = (ctx->ops->mbox_stat_read(ctx) >> 8) & 0xff;
+        spu_release(ctx);
+
+        if (copy_to_user(buf, &wbox_stat, sizeof wbox_stat))
+                return -EFAULT;
+
+        return 4;
+}
+
+static struct file_operations spufs_wbox_stat_fops = {
+        .open   = spufs_pipe_open,
+        .read   = spufs_wbox_stat_read,
+};
+
+static ssize_t spufs_signal1_read(struct file *file, char __user *buf,
+                        size_t len, loff_t *pos)
+{
+        struct spu_context *ctx = file->private_data;
+        u32 data;
+
+        if (len < 4)
+                return -EINVAL;
+
+        spu_acquire(ctx);
+        data = ctx->ops->signal1_read(ctx);
+        spu_release(ctx);
+
+        if (copy_to_user(buf, &data, 4))
+                return -EFAULT;
+
+        return 4;
+}
+
+static ssize_t spufs_signal1_write(struct file *file, const char __user *buf,
+                        size_t len, loff_t *pos)
+{
+        struct spu_context *ctx;
+        u32 data;
+
+        ctx = file->private_data;
+
+        if (len < 4)
+                return -EINVAL;
+
+        if (copy_from_user(&data, buf, 4))
+                return -EFAULT;
+
+        spu_acquire(ctx);
+        ctx->ops->signal1_write(ctx, data);
+        spu_release(ctx);
+
+        return 4;
+}
+
+static struct file_operations spufs_signal1_fops = {
+        .open = spufs_pipe_open,
+        .read = spufs_signal1_read,
+        .write = spufs_signal1_write,
+};
+
+static ssize_t spufs_signal2_read(struct file *file, char __user *buf,
+                        size_t len, loff_t *pos)
+{
+        struct spu_context *ctx;
+        u32 data;
+
+        ctx = file->private_data;
+
+        if (len < 4)
+                return -EINVAL;
+
+        spu_acquire(ctx);
+        data = ctx->ops->signal2_read(ctx);
+        spu_release(ctx);
+
+        if (copy_to_user(buf, &data, 4))
+                return -EFAULT;
+
+        return 4;
+}
+
+static ssize_t spufs_signal2_write(struct file *file, const char __user *buf,
+                        size_t len, loff_t *pos)
+{
+        struct spu_context *ctx;
+        u32 data;
+
+        ctx = file->private_data;
+
+        if (len < 4)
+                return -EINVAL;
+
+        if (copy_from_user(&data, buf, 4))
+                return -EFAULT;
+
+        spu_acquire(ctx);
+        ctx->ops->signal2_write(ctx, data);
+        spu_release(ctx);
+
+        return 4;
+}
+
+static struct file_operations spufs_signal2_fops = {
+        .open = spufs_pipe_open,
+        .read = spufs_signal2_read,
+        .write = spufs_signal2_write,
+};
+
+static void spufs_signal1_type_set(void *data, u64 val)
+{
+        struct spu_context *ctx = data;
+
+        spu_acquire(ctx);
+        ctx->ops->signal1_type_set(ctx, val);
+        spu_release(ctx);
+}
+
+static u64 spufs_signal1_type_get(void *data)
+{
+        struct spu_context *ctx = data;
+        u64 ret;
+
+        spu_acquire(ctx);
+        ret = ctx->ops->signal1_type_get(ctx);
+        spu_release(ctx);
+
+        return ret;
+}
+DEFINE_SIMPLE_ATTRIBUTE(spufs_signal1_type, spufs_signal1_type_get,
+                                        spufs_signal1_type_set, "%llu");
+
+static void spufs_signal2_type_set(void *data, u64 val)
+{
+        struct spu_context *ctx = data;
+
+        spu_acquire(ctx);
+        ctx->ops->signal2_type_set(ctx, val);
+        spu_release(ctx);
+}
+
+static u64 spufs_signal2_type_get(void *data)
+{
+        struct spu_context *ctx = data;
+        u64 ret;
+
+        spu_acquire(ctx);
+        ret = ctx->ops->signal2_type_get(ctx);
+        spu_release(ctx);
+
+        return ret;
+}
+DEFINE_SIMPLE_ATTRIBUTE(spufs_signal2_type, spufs_signal2_type_get,
+                                        spufs_signal2_type_set, "%llu");
+
+static void spufs_npc_set(void *data, u64 val)
+{
+        struct spu_context *ctx = data;
+        spu_acquire(ctx);
+        ctx->ops->npc_write(ctx, val);
+        spu_release(ctx);
+}
+
+static u64 spufs_npc_get(void *data)
+{
+        struct spu_context *ctx = data;
+        u64 ret;
+        spu_acquire(ctx);
+        ret = ctx->ops->npc_read(ctx);
+        spu_release(ctx);
+        return ret;
+}
+DEFINE_SIMPLE_ATTRIBUTE(spufs_npc_ops, spufs_npc_get, spufs_npc_set, "%llx\n")
+
+static void spufs_decr_set(void *data, u64 val)
+{
+        struct spu_context *ctx = data;
+        struct spu_lscsa *lscsa = ctx->csa.lscsa;
+        spu_acquire_saved(ctx);
+        lscsa->decr.slot[0] = (u32) val;
+        spu_release(ctx);
+}
+
+static u64 spufs_decr_get(void *data)
+{
+        struct spu_context *ctx = data;
+        struct spu_lscsa *lscsa = ctx->csa.lscsa;
+        u64 ret;
+        spu_acquire_saved(ctx);
+        ret = lscsa->decr.slot[0];
+        spu_release(ctx);
+        return ret;
+}
+DEFINE_SIMPLE_ATTRIBUTE(spufs_decr_ops, spufs_decr_get, spufs_decr_set,
+                        "%llx\n")
+
+static void spufs_decr_status_set(void *data, u64 val)
+{
+        struct spu_context *ctx = data;
+        struct spu_lscsa *lscsa = ctx->csa.lscsa;
+        spu_acquire_saved(ctx);
+        lscsa->decr_status.slot[0] = (u32) val;
+        spu_release(ctx);
+}
+
+static u64 spufs_decr_status_get(void *data)
+{
+        struct spu_context *ctx = data;
+        struct spu_lscsa *lscsa = ctx->csa.lscsa;
+        u64 ret;
+        spu_acquire_saved(ctx);
+        ret = lscsa->decr_status.slot[0];
+        spu_release(ctx);
+        return ret;
+}
+DEFINE_SIMPLE_ATTRIBUTE(spufs_decr_status_ops, spufs_decr_status_get,
+                        spufs_decr_status_set, "%llx\n")
+
+static void spufs_spu_tag_mask_set(void *data, u64 val)
+{
+        struct spu_context *ctx = data;
+        struct spu_lscsa *lscsa = ctx->csa.lscsa;
+        spu_acquire_saved(ctx);
+        lscsa->tag_mask.slot[0] = (u32) val;
+        spu_release(ctx);
+}
+
+static u64 spufs_spu_tag_mask_get(void *data)
+{
+        struct spu_context *ctx = data;
+        struct spu_lscsa *lscsa = ctx->csa.lscsa;
+        u64 ret;
+        spu_acquire_saved(ctx);
+        ret = lscsa->tag_mask.slot[0];
+        spu_release(ctx);
+        return ret;
+}
+DEFINE_SIMPLE_ATTRIBUTE(spufs_spu_tag_mask_ops, spufs_spu_tag_mask_get,
+                        spufs_spu_tag_mask_set, "%llx\n")
+
+static void spufs_event_mask_set(void *data, u64 val)
+{
+        struct spu_context *ctx = data;
+        struct spu_lscsa *lscsa = ctx->csa.lscsa;
+        spu_acquire_saved(ctx);
+        lscsa->event_mask.slot[0] = (u32) val;
+        spu_release(ctx);
+}
+
+static u64 spufs_event_mask_get(void *data)
+{
+        struct spu_context *ctx = data;
+        struct spu_lscsa *lscsa = ctx->csa.lscsa;
+        u64 ret;
+        spu_acquire_saved(ctx);
+        ret = lscsa->event_mask.slot[0];
+        spu_release(ctx);
+        return ret;
+}
+DEFINE_SIMPLE_ATTRIBUTE(spufs_event_mask_ops, spufs_event_mask_get,
+                        spufs_event_mask_set, "%llx\n")
+
+static void spufs_srr0_set(void *data, u64 val)
+{
+        struct spu_context *ctx = data;
+        struct spu_lscsa *lscsa = ctx->csa.lscsa;
+        spu_acquire_saved(ctx);
+        lscsa->srr0.slot[0] = (u32) val;
+        spu_release(ctx);
+}
+
+static u64 spufs_srr0_get(void *data)
+{
+        struct spu_context *ctx = data;
+        struct spu_lscsa *lscsa = ctx->csa.lscsa;
+        u64 ret;
+        spu_acquire_saved(ctx);
+        ret = lscsa->srr0.slot[0];
+        spu_release(ctx);
+        return ret;
+}
+DEFINE_SIMPLE_ATTRIBUTE(spufs_srr0_ops, spufs_srr0_get, spufs_srr0_set,
+                        "%llx\n")
+
+struct tree_descr spufs_dir_contents[] = {
+        { "mem",  &spufs_mem_fops,  0666, },
+        { "regs", &spufs_regs_fops,  0666, },
+        { "mbox", &spufs_mbox_fops, 0444, },
+        { "ibox", &spufs_ibox_fops, 0444, },
+        { "wbox", &spufs_wbox_fops, 0222, },
+        { "mbox_stat", &spufs_mbox_stat_fops, 0444, },
+        { "ibox_stat", &spufs_ibox_stat_fops, 0444, },
+        { "wbox_stat", &spufs_wbox_stat_fops, 0444, },
+        { "signal1", &spufs_signal1_fops, 0666, },
+        { "signal2", &spufs_signal2_fops, 0666, },
+        { "signal1_type", &spufs_signal1_type, 0666, },
+        { "signal2_type", &spufs_signal2_type, 0666, },
+        { "npc", &spufs_npc_ops, 0666, },
+        { "fpcr", &spufs_fpcr_fops, 0666, },
+        { "decr", &spufs_decr_ops, 0666, },
+        { "decr_status", &spufs_decr_status_ops, 0666, },
+        { "spu_tag_mask", &spufs_spu_tag_mask_ops, 0666, },
+        { "event_mask", &spufs_event_mask_ops, 0666, },
+        { "srr0", &spufs_srr0_ops, 0666, },
+        {},
+};
diff --git a/arch/powerpc/platforms/cell/spufs/hw_ops.c b/arch/powerpc/platforms/cell/spufs/hw_ops.c
new file mode 100644
index 000000000000..5445719bff79
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/hw_ops.c
@@ -0,0 +1,255 @@
+/* hw_ops.c - query/set operations on active SPU context.
+ *
+ * Copyright (C) IBM 2005
+ * Author: Mark Nutter <mnutter@us.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/errno.h>
+#include <linux/sched.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/poll.h>
+#include <linux/smp.h>
+#include <linux/smp_lock.h>
+#include <linux/stddef.h>
+#include <linux/unistd.h>
+
+#include <asm/io.h>
+#include <asm/spu.h>
+#include <asm/spu_csa.h>
+#include <asm/mmu_context.h>
+#include "spufs.h"
+
+static int spu_hw_mbox_read(struct spu_context *ctx, u32 * data)
+{
+        struct spu *spu = ctx->spu;
+        struct spu_problem __iomem *prob = spu->problem;
+        u32 mbox_stat;
+        int ret = 0;
+
+        spin_lock_irq(&spu->register_lock);
+        mbox_stat = in_be32(&prob->mb_stat_R);
+        if (mbox_stat & 0x0000ff) {
+                *data = in_be32(&prob->pu_mb_R);
+                ret = 4;
+        }
+        spin_unlock_irq(&spu->register_lock);
+        return ret;
+}
+
+static u32 spu_hw_mbox_stat_read(struct spu_context *ctx)
+{
+        return in_be32(&ctx->spu->problem->mb_stat_R);
+}
+
+static unsigned int spu_hw_mbox_stat_poll(struct spu_context *ctx,
+                                          unsigned int events)
+{
+        struct spu *spu = ctx->spu;
+        int ret = 0;
+        u32 stat;
+
+        spin_lock_irq(&spu->register_lock);
+        stat = in_be32(&spu->problem->mb_stat_R);
+
+        /* if the requested event is there, return the poll
+           mask, otherwise enable the interrupt to get notified,
+           but first mark any pending interrupts as done so
+           we don't get woken up unnecessarily */
+
+        if (events & (POLLIN | POLLRDNORM)) {
+                if (stat & 0xff0000)
+                        ret |= POLLIN | POLLRDNORM;
+                else {
+                        spu_int_stat_clear(spu, 2, 0x1);
+                        spu_int_mask_or(spu, 2, 0x1);
+                }
+        }
+        if (events & (POLLOUT | POLLWRNORM)) {
+                if (stat & 0x00ff00)
+                        ret = POLLOUT | POLLWRNORM;
+                else {
+                        spu_int_stat_clear(spu, 2, 0x10);
+                        spu_int_mask_or(spu, 2, 0x10);
+                }
+        }
+        spin_unlock_irq(&spu->register_lock);
+        return ret;
+}
+
+static int spu_hw_ibox_read(struct spu_context *ctx, u32 * data)
+{
+        struct spu *spu = ctx->spu;
+        struct spu_problem __iomem *prob = spu->problem;
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        int ret;
+
+        spin_lock_irq(&spu->register_lock);
+        if (in_be32(&prob->mb_stat_R) & 0xff0000) {
+                /* read the first available word */
+                *data = in_be64(&priv2->puint_mb_R);
+                ret = 4;
+        } else {
+                /* make sure we get woken up by the interrupt */
+                spu_int_mask_or(spu, 2, 0x1);
+                ret = 0;
+        }
+        spin_unlock_irq(&spu->register_lock);
+        return ret;
+}
+
+static int spu_hw_wbox_write(struct spu_context *ctx, u32 data)
+{
+        struct spu *spu = ctx->spu;
+        struct spu_problem __iomem *prob = spu->problem;
+        int ret;
+
+        spin_lock_irq(&spu->register_lock);
+        if (in_be32(&prob->mb_stat_R) & 0x00ff00) {
+                /* we have space to write wbox_data to */
+                out_be32(&prob->spu_mb_W, data);
+                ret = 4;
+        } else {
+                /* make sure we get woken up by the interrupt when space
+                   becomes available */
+                spu_int_mask_or(spu, 2, 0x10);
+                ret = 0;
+        }
+        spin_unlock_irq(&spu->register_lock);
+        return ret;
+}
+
+static u32 spu_hw_signal1_read(struct spu_context *ctx)
+{
+        return in_be32(&ctx->spu->problem->signal_notify1);
+}
+
+static void spu_hw_signal1_write(struct spu_context *ctx, u32 data)
+{
+        out_be32(&ctx->spu->problem->signal_notify1, data);
+}
+
+static u32 spu_hw_signal2_read(struct spu_context *ctx)
+{
+        return in_be32(&ctx->spu->problem->signal_notify1);
+}
+
+static void spu_hw_signal2_write(struct spu_context *ctx, u32 data)
+{
+        out_be32(&ctx->spu->problem->signal_notify2, data);
+}
+
+static void spu_hw_signal1_type_set(struct spu_context *ctx, u64 val)
+{
+        struct spu *spu = ctx->spu;
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        u64 tmp;
+
+        spin_lock_irq(&spu->register_lock);
+        tmp = in_be64(&priv2->spu_cfg_RW);
+        if (val)
+                tmp |= 1;
+        else
+                tmp &= ~1;
+        out_be64(&priv2->spu_cfg_RW, tmp);
+        spin_unlock_irq(&spu->register_lock);
+}
+
+static u64 spu_hw_signal1_type_get(struct spu_context *ctx)
+{
+        return ((in_be64(&ctx->spu->priv2->spu_cfg_RW) & 1) != 0);
+}
+
+static void spu_hw_signal2_type_set(struct spu_context *ctx, u64 val)
+{
+        struct spu *spu = ctx->spu;
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        u64 tmp;
+
+        spin_lock_irq(&spu->register_lock);
+        tmp = in_be64(&priv2->spu_cfg_RW);
+        if (val)
+                tmp |= 2;
+        else
+                tmp &= ~2;
+        out_be64(&priv2->spu_cfg_RW, tmp);
+        spin_unlock_irq(&spu->register_lock);
+}
+
+static u64 spu_hw_signal2_type_get(struct spu_context *ctx)
+{
+        return ((in_be64(&ctx->spu->priv2->spu_cfg_RW) & 2) != 0);
+}
+
+static u32 spu_hw_npc_read(struct spu_context *ctx)
+{
+        return in_be32(&ctx->spu->problem->spu_npc_RW);
+}
+
+static void spu_hw_npc_write(struct spu_context *ctx, u32 val)
+{
+        out_be32(&ctx->spu->problem->spu_npc_RW, val);
+}
+
+static u32 spu_hw_status_read(struct spu_context *ctx)
+{
+        return in_be32(&ctx->spu->problem->spu_status_R);
+}
+
+static char *spu_hw_get_ls(struct spu_context *ctx)
+{
+        return ctx->spu->local_store;
+}
+
+static void spu_hw_runcntl_write(struct spu_context *ctx, u32 val)
+{
+        eieio();
+        out_be32(&ctx->spu->problem->spu_runcntl_RW, val);
+}
+
+static void spu_hw_runcntl_stop(struct spu_context *ctx)
+{
+        spin_lock_irq(&ctx->spu->register_lock);
+        out_be32(&ctx->spu->problem->spu_runcntl_RW, SPU_RUNCNTL_STOP);
+        while (in_be32(&ctx->spu->problem->spu_status_R) & SPU_STATUS_RUNNING)
+                cpu_relax();
+        spin_unlock_irq(&ctx->spu->register_lock);
+}
+
+struct spu_context_ops spu_hw_ops = {
+        .mbox_read = spu_hw_mbox_read,
+        .mbox_stat_read = spu_hw_mbox_stat_read,
+        .mbox_stat_poll = spu_hw_mbox_stat_poll,
+        .ibox_read = spu_hw_ibox_read,
+        .wbox_write = spu_hw_wbox_write,
+        .signal1_read = spu_hw_signal1_read,
+        .signal1_write = spu_hw_signal1_write,
+        .signal2_read = spu_hw_signal2_read,
+        .signal2_write = spu_hw_signal2_write,
+        .signal1_type_set = spu_hw_signal1_type_set,
+        .signal1_type_get = spu_hw_signal1_type_get,
+        .signal2_type_set = spu_hw_signal2_type_set,
+        .signal2_type_get = spu_hw_signal2_type_get,
+        .npc_read = spu_hw_npc_read,
+        .npc_write = spu_hw_npc_write,
+        .status_read = spu_hw_status_read,
+        .get_ls = spu_hw_get_ls,
+        .runcntl_write = spu_hw_runcntl_write,
+        .runcntl_stop = spu_hw_runcntl_stop,
+};
diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
new file mode 100644
index 000000000000..1f3507c75e90
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/inode.c
@@ -0,0 +1,486 @@
+/*
+ * SPU file system
+ *
+ * (C) Copyright IBM Deutschland Entwicklung GmbH 2005
+ *
+ * Author: Arnd Bergmann <arndb@de.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/backing-dev.h>
+#include <linux/init.h>
+#include <linux/ioctl.h>
+#include <linux/module.h>
+#include <linux/mount.h>
+#include <linux/namei.h>
+#include <linux/pagemap.h>
+#include <linux/poll.h>
+#include <linux/slab.h>
+#include <linux/parser.h>
+
+#include <asm/io.h>
+#include <asm/semaphore.h>
+#include <asm/spu.h>
+#include <asm/uaccess.h>
+
+#include "spufs.h"
+
+static kmem_cache_t *spufs_inode_cache;
+
+static struct inode *
+spufs_alloc_inode(struct super_block *sb)
+{
+        struct spufs_inode_info *ei;
+
+        ei = kmem_cache_alloc(spufs_inode_cache, SLAB_KERNEL);
+        if (!ei)
+                return NULL;
+        return &ei->vfs_inode;
+}
+
+static void
+spufs_destroy_inode(struct inode *inode)
+{
+        kmem_cache_free(spufs_inode_cache, SPUFS_I(inode));
+}
+
+static void
+spufs_init_once(void *p, kmem_cache_t * cachep, unsigned long flags)
+{
+        struct spufs_inode_info *ei = p;
+
+        if ((flags & (SLAB_CTOR_VERIFY|SLAB_CTOR_CONSTRUCTOR)) ==
+            SLAB_CTOR_CONSTRUCTOR) {
+                inode_init_once(&ei->vfs_inode);
+        }
+}
+
+static struct inode *
+spufs_new_inode(struct super_block *sb, int mode)
+{
+        struct inode *inode;
+
+        inode = new_inode(sb);
+        if (!inode)
+                goto out;
+
+        inode->i_mode = mode;
+        inode->i_uid = current->fsuid;
+        inode->i_gid = current->fsgid;
+        inode->i_blksize = PAGE_CACHE_SIZE;
+        inode->i_blocks = 0;
+        inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+out:
+        return inode;
+}
+
+static int
+spufs_setattr(struct dentry *dentry, struct iattr *attr)
+{
+        struct inode *inode = dentry->d_inode;
+
+        if ((attr->ia_valid & ATTR_SIZE) &&
+            (attr->ia_size != inode->i_size))
+                return -EINVAL;
+        return inode_setattr(inode, attr);
+}
+
+
+static int
+spufs_new_file(struct super_block *sb, struct dentry *dentry,
+                struct file_operations *fops, int mode,
+                struct spu_context *ctx)
+{
+        static struct inode_operations spufs_file_iops = {
+                .setattr = spufs_setattr,
+        };
+        struct inode *inode;
+        int ret;
+
+        ret = -ENOSPC;
+        inode = spufs_new_inode(sb, S_IFREG | mode);
+        if (!inode)
+                goto out;
+
+        ret = 0;
+        inode->i_op = &spufs_file_iops;
+        inode->i_fop = fops;
+        inode->u.generic_ip = SPUFS_I(inode)->i_ctx = get_spu_context(ctx);
+        d_add(dentry, inode);
+out:
+        return ret;
+}
+
+static void
+spufs_delete_inode(struct inode *inode)
+{
+        if (SPUFS_I(inode)->i_ctx)
+                put_spu_context(SPUFS_I(inode)->i_ctx);
+        clear_inode(inode);
+}
+
+static void spufs_prune_dir(struct dentry *dir)
+{
+        struct dentry *dentry, *tmp;
+        down(&dir->d_inode->i_sem);
+        list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_child) {
+                spin_lock(&dcache_lock);
+                spin_lock(&dentry->d_lock);
+                if (!(d_unhashed(dentry)) && dentry->d_inode) {
+                        dget_locked(dentry);
+                        __d_drop(dentry);
+                        spin_unlock(&dentry->d_lock);
+                        simple_unlink(dir->d_inode, dentry);
+                        spin_unlock(&dcache_lock);
+                        dput(dentry);
+                } else {
+                        spin_unlock(&dentry->d_lock);
+                        spin_unlock(&dcache_lock);
+                }
+        }
+        shrink_dcache_parent(dir);
+        up(&dir->d_inode->i_sem);
+}
+
+static int spufs_rmdir(struct inode *root, struct dentry *dir_dentry)
+{
+        struct spu_context *ctx;
+
+        /* remove all entries */
+        down(&root->i_sem);
+        spufs_prune_dir(dir_dentry);
+        up(&root->i_sem);
+
+        /* We have to give up the mm_struct */
+        ctx = SPUFS_I(dir_dentry->d_inode)->i_ctx;
+        spu_forget(ctx);
+
+        /* XXX Do we need to hold i_sem here ? */
+        return simple_rmdir(root, dir_dentry);
+}
+
+static int spufs_fill_dir(struct dentry *dir, struct tree_descr *files,
+                          int mode, struct spu_context *ctx)
+{
+        struct dentry *dentry;
+        int ret;
+
+        while (files->name && files->name[0]) {
+                ret = -ENOMEM;
+                dentry = d_alloc_name(dir, files->name);
+                if (!dentry)
+                        goto out;
+                ret = spufs_new_file(dir->d_sb, dentry, files->ops,
+                                        files->mode & mode, ctx);
+                if (ret)
+                        goto out;
+                files++;
+        }
+        return 0;
+out:
+        spufs_prune_dir(dir);
+        return ret;
+}
+
+static int spufs_dir_close(struct inode *inode, struct file *file)
+{
+        struct inode *dir;
+        struct dentry *dentry;
+        int ret;
+
+        dentry = file->f_dentry;
+        dir = dentry->d_parent->d_inode;
+
+        ret = spufs_rmdir(dir, dentry);
+        WARN_ON(ret);
+
+        return dcache_dir_close(inode, file);
+}
+
+struct inode_operations spufs_dir_inode_operations = {
+        .lookup = simple_lookup,
+};
+
+struct file_operations spufs_context_fops = {
+        .open           = dcache_dir_open,
+        .release        = spufs_dir_close,
+        .llseek         = dcache_dir_lseek,
+        .read           = generic_read_dir,
+        .readdir        = dcache_readdir,
+        .fsync          = simple_sync_file,
+};
+
+static int
+spufs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
+{
+        int ret;
+        struct inode *inode;
+        struct spu_context *ctx;
+
+        ret = -ENOSPC;
+        inode = spufs_new_inode(dir->i_sb, mode | S_IFDIR);
+        if (!inode)
+                goto out;
+
+        if (dir->i_mode & S_ISGID) {
+                inode->i_gid = dir->i_gid;
+                inode->i_mode &= S_ISGID;
+        }
+        ctx = alloc_spu_context(inode->i_mapping);
+        SPUFS_I(inode)->i_ctx = ctx;
+        if (!ctx)
+                goto out_iput;
+
+        inode->i_op = &spufs_dir_inode_operations;
+        inode->i_fop = &simple_dir_operations;
+        ret = spufs_fill_dir(dentry, spufs_dir_contents, mode, ctx);
+        if (ret)
+                goto out_free_ctx;
+
+        d_instantiate(dentry, inode);
+        dget(dentry);
+        dir->i_nlink++;
+        dentry->d_inode->i_nlink++;
+        goto out;
+
+out_free_ctx:
+        put_spu_context(ctx);
+out_iput:
+        iput(inode);
+out:
+        return ret;
+}
+
+static int spufs_context_open(struct dentry *dentry, struct vfsmount *mnt)
+{
+        int ret;
+        struct file *filp;
+
+        ret = get_unused_fd();
+        if (ret < 0) {
+                dput(dentry);
+                mntput(mnt);
+                goto out;
+        }
+
+        filp = dentry_open(dentry, mnt, O_RDONLY);
+        if (IS_ERR(filp)) {
+                put_unused_fd(ret);
+                ret = PTR_ERR(filp);
+                goto out;
+        }
+
+        filp->f_op = &spufs_context_fops;
+        fd_install(ret, filp);
+out:
+        return ret;
+}
+
+static struct file_system_type spufs_type;
+
+long spufs_create_thread(struct nameidata *nd,
+                         unsigned int flags, mode_t mode)
+{
+        struct dentry *dentry;
+        int ret;
+
+        /* need to be at the root of spufs */
+        ret = -EINVAL;
+        if (nd->dentry->d_sb->s_type != &spufs_type ||
+            nd->dentry != nd->dentry->d_sb->s_root)
+                goto out;
+
+        dentry = lookup_create(nd, 1);
+        ret = PTR_ERR(dentry);
+        if (IS_ERR(dentry))
+                goto out_dir;
+
+        ret = -EEXIST;
+        if (dentry->d_inode)
+                goto out_dput;
+
+        mode &= ~current->fs->umask;
+        ret = spufs_mkdir(nd->dentry->d_inode, dentry, mode & S_IRWXUGO);
+        if (ret)
+                goto out_dput;
+
+        /*
+         * get references for dget and mntget, will be released
+         * in error path of *_open().
+         */
+        ret = spufs_context_open(dget(dentry), mntget(nd->mnt));
+        if (ret < 0)
+                spufs_rmdir(nd->dentry->d_inode, dentry);
+
+out_dput:
+        dput(dentry);
+out_dir:
+        up(&nd->dentry->d_inode->i_sem);
+out:
+        return ret;
+}
+
+/* File system initialization */
+enum {
+        Opt_uid, Opt_gid, Opt_err,
+};
+
+static match_table_t spufs_tokens = {
+        { Opt_uid, "uid=%d" },
+        { Opt_gid, "gid=%d" },
+        { Opt_err, NULL  },
+};
+
+static int
+spufs_parse_options(char *options, struct inode *root)
+{
+        char *p;
+        substring_t args[MAX_OPT_ARGS];
+
+        while ((p = strsep(&options, ",")) != NULL) {
+                int token, option;
+
+                if (!*p)
+                        continue;
+
+                token = match_token(p, spufs_tokens, args);
+                switch (token) {
+                case Opt_uid:
+                        if (match_int(&args[0], &option))
+                                return 0;
+                        root->i_uid = option;
+                        break;
+                case Opt_gid:
+                        if (match_int(&args[0], &option))
+                                return 0;
+                        root->i_gid = option;
+                        break;
+                default:
+                        return 0;
+                }
+        }
+        return 1;
+}
+
+static int
+spufs_create_root(struct super_block *sb, void *data)
+{
+        struct inode *inode;
+        int ret;
+
+        ret = -ENOMEM;
+        inode = spufs_new_inode(sb, S_IFDIR | 0775);
+        if (!inode)
+                goto out;
+
+        inode->i_op = &spufs_dir_inode_operations;
+        inode->i_fop = &simple_dir_operations;
+        SPUFS_I(inode)->i_ctx = NULL;
+
+        ret = -EINVAL;
+        if (!spufs_parse_options(data, inode))
+                goto out_iput;
+
+        ret = -ENOMEM;
+        sb->s_root = d_alloc_root(inode);
+        if (!sb->s_root)
+                goto out_iput;
+
+        return 0;
+out_iput:
+        iput(inode);
+out:
+        return ret;
+}
+
+static int
+spufs_fill_super(struct super_block *sb, void *data, int silent)
+{
+        static struct super_operations s_ops = {
+                .alloc_inode = spufs_alloc_inode,
+                .destroy_inode = spufs_destroy_inode,
+                .statfs = simple_statfs,
+                .delete_inode = spufs_delete_inode,
+                .drop_inode = generic_delete_inode,
+        };
+
+        sb->s_maxbytes = MAX_LFS_FILESIZE;
+        sb->s_blocksize = PAGE_CACHE_SIZE;
+        sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
+        sb->s_magic = SPUFS_MAGIC;
+        sb->s_op = &s_ops;
+
+        return spufs_create_root(sb, data);
+}
+
+static struct super_block *
+spufs_get_sb(struct file_system_type *fstype, int flags,
+                const char *name, void *data)
+{
+        return get_sb_single(fstype, flags, data, spufs_fill_super);
+}
+
+static struct file_system_type spufs_type = {
+        .owner = THIS_MODULE,
+        .name = "spufs",
+        .get_sb = spufs_get_sb,
+        .kill_sb = kill_litter_super,
+};
+
+static int spufs_init(void)
+{
+        int ret;
+        ret = -ENOMEM;
+        spufs_inode_cache = kmem_cache_create("spufs_inode_cache",
+                        sizeof(struct spufs_inode_info), 0,
+                        SLAB_HWCACHE_ALIGN, spufs_init_once, NULL);
+
+        if (!spufs_inode_cache)
+                goto out;
+        if (spu_sched_init() != 0) {
+                kmem_cache_destroy(spufs_inode_cache);
+                goto out;
+        }
+        ret = register_filesystem(&spufs_type);
+        if (ret)
+                goto out_cache;
+        ret = register_spu_syscalls(&spufs_calls);
+        if (ret)
+                goto out_fs;
+        return 0;
+out_fs:
+        unregister_filesystem(&spufs_type);
+out_cache:
+        kmem_cache_destroy(spufs_inode_cache);
+out:
+        return ret;
+}
+module_init(spufs_init);
+
+static void spufs_exit(void)
+{
+        spu_sched_exit();
+        unregister_spu_syscalls(&spufs_calls);
+        unregister_filesystem(&spufs_type);
+        kmem_cache_destroy(spufs_inode_cache);
+}
+module_exit(spufs_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Arnd Bergmann <arndb@de.ibm.com>");
+
diff --git a/arch/powerpc/platforms/cell/spufs/run.c b/arch/powerpc/platforms/cell/spufs/run.c
new file mode 100644
index 000000000000..18ea8866c61a
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/run.c
@@ -0,0 +1,131 @@
+#include <linux/wait.h>
+#include <linux/ptrace.h>
+
+#include <asm/spu.h>
+
+#include "spufs.h"
+
+/* interrupt-level stop callback function. */
+void spufs_stop_callback(struct spu *spu)
+{
+        struct spu_context *ctx = spu->ctx;
+
+        wake_up_all(&ctx->stop_wq);
+}
+
+static inline int spu_stopped(struct spu_context *ctx, u32 * stat)
+{
+        struct spu *spu;
+        u64 pte_fault;
+
+        *stat = ctx->ops->status_read(ctx);
+        if (ctx->state != SPU_STATE_RUNNABLE)
+                return 1;
+        spu = ctx->spu;
+        pte_fault = spu->dsisr &
+            (MFC_DSISR_PTE_NOT_FOUND | MFC_DSISR_ACCESS_DENIED);
+        return (!(*stat & 0x1) || pte_fault || spu->class_0_pending) ? 1 : 0;
+}
+
+static inline int spu_run_init(struct spu_context *ctx, u32 * npc,
+                               u32 * status)
+{
+        int ret;
+
+        if ((ret = spu_acquire_runnable(ctx)) != 0)
+                return ret;
+        ctx->ops->npc_write(ctx, *npc);
+        ctx->ops->runcntl_write(ctx, SPU_RUNCNTL_RUNNABLE);
+        return 0;
+}
+
+static inline int spu_run_fini(struct spu_context *ctx, u32 * npc,
+                               u32 * status)
+{
+        int ret = 0;
+
+        *status = ctx->ops->status_read(ctx);
+        *npc = ctx->ops->npc_read(ctx);
+        spu_release(ctx);
+
+        if (signal_pending(current))
+                ret = -ERESTARTSYS;
+        if (unlikely(current->ptrace & PT_PTRACED)) {
+                if ((*status & SPU_STATUS_STOPPED_BY_STOP)
+                    && (*status >> SPU_STOP_STATUS_SHIFT) == 0x3fff) {
+                        force_sig(SIGTRAP, current);
+                        ret = -ERESTARTSYS;
+                }
+        }
+        return ret;
+}
+
+static inline int spu_reacquire_runnable(struct spu_context *ctx, u32 *npc,
+                                         u32 *status)
+{
+        int ret;
+
+        if ((ret = spu_run_fini(ctx, npc, status)) != 0)
+                return ret;
+        if (*status & (SPU_STATUS_STOPPED_BY_STOP |
+                       SPU_STATUS_STOPPED_BY_HALT)) {
+                return *status;
+        }
+        if ((ret = spu_run_init(ctx, npc, status)) != 0)
+                return ret;
+        return 0;
+}
+
+static inline int spu_process_events(struct spu_context *ctx)
+{
+        struct spu *spu = ctx->spu;
+        u64 pte_fault = MFC_DSISR_PTE_NOT_FOUND | MFC_DSISR_ACCESS_DENIED;
+        int ret = 0;
+
+        if (spu->dsisr & pte_fault)
+                ret = spu_irq_class_1_bottom(spu);
+        if (spu->class_0_pending)
+                ret = spu_irq_class_0_bottom(spu);
+        if (!ret && signal_pending(current))
+                ret = -ERESTARTSYS;
+        return ret;
+}
+
+long spufs_run_spu(struct file *file, struct spu_context *ctx,
+                   u32 * npc, u32 * status)
+{
+        int ret;
+
+        if (down_interruptible(&ctx->run_sema))
+                return -ERESTARTSYS;
+
+        ret = spu_run_init(ctx, npc, status);
+        if (ret)
+                goto out;
+
+        do {
+                ret = spufs_wait(ctx->stop_wq, spu_stopped(ctx, status));
+                if (unlikely(ret))
+                        break;
+                if (unlikely(ctx->state != SPU_STATE_RUNNABLE)) {
+                        ret = spu_reacquire_runnable(ctx, npc, status);
+                        if (ret)
+                                goto out;
+                        continue;
+                }
+                ret = spu_process_events(ctx);
+
+        } while (!ret && !(*status & (SPU_STATUS_STOPPED_BY_STOP |
+                                      SPU_STATUS_STOPPED_BY_HALT)));
+
+        ctx->ops->runcntl_stop(ctx);
+        ret = spu_run_fini(ctx, npc, status);
+        if (!ret)
+                ret = *status;
+        spu_yield(ctx);
+
+out:
+        up(&ctx->run_sema);
+        return ret;
+}
+
diff --git a/arch/powerpc/platforms/cell/spufs/sched.c b/arch/powerpc/platforms/cell/spufs/sched.c
new file mode 100644
index 000000000000..963182fbd1aa
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/sched.c
@@ -0,0 +1,461 @@
+/* sched.c - SPU scheduler.
+ *
+ * Copyright (C) IBM 2005
+ * Author: Mark Nutter <mnutter@us.ibm.com>
+ *
+ * SPU scheduler, based on Linux thread priority.  For now use
+ * a simple "cooperative" yield model with no preemption.  SPU
+ * scheduling will eventually be preemptive: When a thread with
+ * a higher static priority gets ready to run, then an active SPU
+ * context will be preempted and returned to the waitq.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#undef DEBUG
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/errno.h>
+#include <linux/sched.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/completion.h>
+#include <linux/vmalloc.h>
+#include <linux/smp.h>
+#include <linux/smp_lock.h>
+#include <linux/stddef.h>
+#include <linux/unistd.h>
+
+#include <asm/io.h>
+#include <asm/mmu_context.h>
+#include <asm/spu.h>
+#include <asm/spu_csa.h>
+#include "spufs.h"
+
+#define SPU_MIN_TIMESLICE       (100 * HZ / 1000)
+
+#define SPU_BITMAP_SIZE (((MAX_PRIO+BITS_PER_LONG)/BITS_PER_LONG)+1)
+struct spu_prio_array {
+        atomic_t nr_blocked;
+        unsigned long bitmap[SPU_BITMAP_SIZE];
+        wait_queue_head_t waitq[MAX_PRIO];
+};
+
+/* spu_runqueue - This is the main runqueue data structure for SPUs. */
+struct spu_runqueue {
+        struct semaphore sem;
+        unsigned long nr_active;
+        unsigned long nr_idle;
+        unsigned long nr_switches;
+        struct list_head active_list;
+        struct list_head idle_list;
+        struct spu_prio_array prio;
+};
+
+static struct spu_runqueue *spu_runqueues = NULL;
+
+static inline struct spu_runqueue *spu_rq(void)
+{
+        /* Future: make this a per-NODE array,
+         * and use cpu_to_node(smp_processor_id())
+         */
+        return spu_runqueues;
+}
+
+static inline struct spu *del_idle(struct spu_runqueue *rq)
+{
+        struct spu *spu;
+
+        BUG_ON(rq->nr_idle <= 0);
+        BUG_ON(list_empty(&rq->idle_list));
+        /* Future: Move SPU out of low-power SRI state. */
+        spu = list_entry(rq->idle_list.next, struct spu, sched_list);
+        list_del_init(&spu->sched_list);
+        rq->nr_idle--;
+        return spu;
+}
+
+static inline void del_active(struct spu_runqueue *rq, struct spu *spu)
+{
+        BUG_ON(rq->nr_active <= 0);
+        BUG_ON(list_empty(&rq->active_list));
+        list_del_init(&spu->sched_list);
+        rq->nr_active--;
+}
+
+static inline void add_idle(struct spu_runqueue *rq, struct spu *spu)
+{
+        /* Future: Put SPU into low-power SRI state. */
+        list_add_tail(&spu->sched_list, &rq->idle_list);
+        rq->nr_idle++;
+}
+
+static inline void add_active(struct spu_runqueue *rq, struct spu *spu)
+{
+        rq->nr_active++;
+        rq->nr_switches++;
+        list_add_tail(&spu->sched_list, &rq->active_list);
+}
+
+static void prio_wakeup(struct spu_runqueue *rq)
+{
+        if (atomic_read(&rq->prio.nr_blocked) && rq->nr_idle) {
+                int best = sched_find_first_bit(rq->prio.bitmap);
+                if (best < MAX_PRIO) {
+                        wait_queue_head_t *wq = &rq->prio.waitq[best];
+                        wake_up_interruptible_nr(wq, 1);
+                }
+        }
+}
+
+static void prio_wait(struct spu_runqueue *rq, struct spu_context *ctx,
+                      u64 flags)
+{
+        int prio = current->prio;
+        wait_queue_head_t *wq = &rq->prio.waitq[prio];
+        DEFINE_WAIT(wait);
+
+        __set_bit(prio, rq->prio.bitmap);
+        atomic_inc(&rq->prio.nr_blocked);
+        prepare_to_wait_exclusive(wq, &wait, TASK_INTERRUPTIBLE);
+        if (!signal_pending(current)) {
+                up(&rq->sem);
+                up_write(&ctx->state_sema);
+                pr_debug("%s: pid=%d prio=%d\n", __FUNCTION__,
+                         current->pid, current->prio);
+                schedule();
+                down_write(&ctx->state_sema);
+                down(&rq->sem);
+        }
+        finish_wait(wq, &wait);
+        atomic_dec(&rq->prio.nr_blocked);
+        if (!waitqueue_active(wq))
+                __clear_bit(prio, rq->prio.bitmap);
+}
+
+static inline int is_best_prio(struct spu_runqueue *rq)
+{
+        int best_prio;
+
+        best_prio = sched_find_first_bit(rq->prio.bitmap);
+        return (current->prio < best_prio) ? 1 : 0;
+}
+
+static inline void mm_needs_global_tlbie(struct mm_struct *mm)
+{
+        /* Global TLBIE broadcast required with SPEs. */
+#if (NR_CPUS > 1)
+        __cpus_setall(&mm->cpu_vm_mask, NR_CPUS);
+#else
+        __cpus_setall(&mm->cpu_vm_mask, NR_CPUS+1); /* is this ok? */
+#endif
+}
+
+static inline void bind_context(struct spu *spu, struct spu_context *ctx)
+{
+        pr_debug("%s: pid=%d SPU=%d\n", __FUNCTION__, current->pid,
+                 spu->number);
+        spu->ctx = ctx;
+        spu->flags = 0;
+        ctx->flags = 0;
+        ctx->spu = spu;
+        ctx->ops = &spu_hw_ops;
+        spu->pid = current->pid;
+        spu->prio = current->prio;
+        spu->mm = ctx->owner;
+        mm_needs_global_tlbie(spu->mm);
+        spu->ibox_callback = spufs_ibox_callback;
+        spu->wbox_callback = spufs_wbox_callback;
+        spu->stop_callback = spufs_stop_callback;
+        mb();
+        spu_unmap_mappings(ctx);
+        spu_restore(&ctx->csa, spu);
+        spu->timestamp = jiffies;
+}
+
+static inline void unbind_context(struct spu *spu, struct spu_context *ctx)
+{
+        pr_debug("%s: unbind pid=%d SPU=%d\n", __FUNCTION__,
+                 spu->pid, spu->number);
+        spu_unmap_mappings(ctx);
+        spu_save(&ctx->csa, spu);
+        spu->timestamp = jiffies;
+        ctx->state = SPU_STATE_SAVED;
+        spu->ibox_callback = NULL;
+        spu->wbox_callback = NULL;
+        spu->stop_callback = NULL;
+        spu->mm = NULL;
+        spu->pid = 0;
+        spu->prio = MAX_PRIO;
+        ctx->ops = &spu_backing_ops;
+        ctx->spu = NULL;
+        ctx->flags = 0;
+        spu->flags = 0;
+        spu->ctx = NULL;
+}
+
+static void spu_reaper(void *data)
+{
+        struct spu_context *ctx = data;
+        struct spu *spu;
+
+        down_write(&ctx->state_sema);
+        spu = ctx->spu;
+        if (spu && test_bit(SPU_CONTEXT_PREEMPT, &ctx->flags)) {
+                if (atomic_read(&spu->rq->prio.nr_blocked)) {
+                        pr_debug("%s: spu=%d\n", __func__, spu->number);
+                        ctx->ops->runcntl_stop(ctx);
+                        spu_deactivate(ctx);
+                        wake_up_all(&ctx->stop_wq);
+                } else {
+                        clear_bit(SPU_CONTEXT_PREEMPT, &ctx->flags);
+                }
+        }
+        up_write(&ctx->state_sema);
+        put_spu_context(ctx);
+}
+
+static void schedule_spu_reaper(struct spu_runqueue *rq, struct spu *spu)
+{
+        struct spu_context *ctx = get_spu_context(spu->ctx);
+        unsigned long now = jiffies;
+        unsigned long expire = spu->timestamp + SPU_MIN_TIMESLICE;
+
+        set_bit(SPU_CONTEXT_PREEMPT, &ctx->flags);
+        INIT_WORK(&ctx->reap_work, spu_reaper, ctx);
+        if (time_after(now, expire))
+                schedule_work(&ctx->reap_work);
+        else
+                schedule_delayed_work(&ctx->reap_work, expire - now);
+}
+
+static void check_preempt_active(struct spu_runqueue *rq)
+{
+        struct list_head *p;
+        struct spu *worst = NULL;
+
+        list_for_each(p, &rq->active_list) {
+                struct spu *spu = list_entry(p, struct spu, sched_list);
+                struct spu_context *ctx = spu->ctx;
+                if (!test_bit(SPU_CONTEXT_PREEMPT, &ctx->flags)) {
+                        if (!worst || (spu->prio > worst->prio)) {
+                                worst = spu;
+                        }
+                }
+        }
+        if (worst && (current->prio < worst->prio))
+                schedule_spu_reaper(rq, worst);
+}
+
+static struct spu *get_idle_spu(struct spu_context *ctx, u64 flags)
+{
+        struct spu_runqueue *rq;
+        struct spu *spu = NULL;
+
+        rq = spu_rq();
+        down(&rq->sem);
+        for (;;) {
+                if (rq->nr_idle > 0) {
+                        if (is_best_prio(rq)) {
+                                /* Fall through. */
+                                spu = del_idle(rq);
+                                break;
+                        } else {
+                                prio_wakeup(rq);
+                                up(&rq->sem);
+                                yield();
+                                if (signal_pending(current)) {
+                                        return NULL;
+                                }
+                                rq = spu_rq();
+                                down(&rq->sem);
+                                continue;
+                        }
+                } else {
+                        check_preempt_active(rq);
+                        prio_wait(rq, ctx, flags);
+                        if (signal_pending(current)) {
+                                prio_wakeup(rq);
+                                spu = NULL;
+                                break;
+                        }
+                        continue;
+                }
+        }
+        up(&rq->sem);
+        return spu;
+}
+
+static void put_idle_spu(struct spu *spu)
+{
+        struct spu_runqueue *rq = spu->rq;
+
+        down(&rq->sem);
+        add_idle(rq, spu);
+        prio_wakeup(rq);
+        up(&rq->sem);
+}
+
+static int get_active_spu(struct spu *spu)
+{
+        struct spu_runqueue *rq = spu->rq;
+        struct list_head *p;
+        struct spu *tmp;
+        int rc = 0;
+
+        down(&rq->sem);
+        list_for_each(p, &rq->active_list) {
+                tmp = list_entry(p, struct spu, sched_list);
+                if (tmp == spu) {
+                        del_active(rq, spu);
+                        rc = 1;
+                        break;
+                }
+        }
+        up(&rq->sem);
+        return rc;
+}
+
+static void put_active_spu(struct spu *spu)
+{
+        struct spu_runqueue *rq = spu->rq;
+
+        down(&rq->sem);
+        add_active(rq, spu);
+        up(&rq->sem);
+}
+
+/* Lock order:
+ *      spu_activate() & spu_deactivate() require the
+ *      caller to have down_write(&ctx->state_sema).
+ *
+ *      The rq->sem is breifly held (inside or outside a
+ *      given ctx lock) for list management, but is never
+ *      held during save/restore.
+ */
+
+int spu_activate(struct spu_context *ctx, u64 flags)
+{
+        struct spu *spu;
+
+        if (ctx->spu)
+                return 0;
+        spu = get_idle_spu(ctx, flags);
+        if (!spu)
+                return (signal_pending(current)) ? -ERESTARTSYS : -EAGAIN;
+        bind_context(spu, ctx);
+        /*
+         * We're likely to wait for interrupts on the same
+         * CPU that we are now on, so send them here.
+         */
+        spu_irq_setaffinity(spu, raw_smp_processor_id());
+        put_active_spu(spu);
+        return 0;
+}
+
+void spu_deactivate(struct spu_context *ctx)
+{
+        struct spu *spu;
+        int needs_idle;
+
+        spu = ctx->spu;
+        if (!spu)
+                return;
+        needs_idle = get_active_spu(spu);
+        unbind_context(spu, ctx);
+        if (needs_idle)
+                put_idle_spu(spu);
+}
+
+void spu_yield(struct spu_context *ctx)
+{
+        struct spu *spu;
+        int need_yield = 0;
+
+        down_write(&ctx->state_sema);
+        spu = ctx->spu;
+        if (spu && (sched_find_first_bit(spu->rq->prio.bitmap) < MAX_PRIO)) {
+                pr_debug("%s: yielding SPU %d\n", __FUNCTION__, spu->number);
+                spu_deactivate(ctx);
+                ctx->state = SPU_STATE_SAVED;
+                need_yield = 1;
+        } else if (spu) {
+                spu->prio = MAX_PRIO;
+        }
+        up_write(&ctx->state_sema);
+        if (unlikely(need_yield))
+                yield();
+}
+
+int __init spu_sched_init(void)
+{
+        struct spu_runqueue *rq;
+        struct spu *spu;
+        int i;
+
+        rq = spu_runqueues = kmalloc(sizeof(struct spu_runqueue), GFP_KERNEL);
+        if (!rq) {
+                printk(KERN_WARNING "%s: Unable to allocate runqueues.\n",
+                       __FUNCTION__);
+                return 1;
+        }
+        memset(rq, 0, sizeof(struct spu_runqueue));
+        init_MUTEX(&rq->sem);
+        INIT_LIST_HEAD(&rq->active_list);
+        INIT_LIST_HEAD(&rq->idle_list);
+        rq->nr_active = 0;
+        rq->nr_idle = 0;
+        rq->nr_switches = 0;
+        atomic_set(&rq->prio.nr_blocked, 0);
+        for (i = 0; i < MAX_PRIO; i++) {
+                init_waitqueue_head(&rq->prio.waitq[i]);
+                __clear_bit(i, rq->prio.bitmap);
+        }
+        __set_bit(MAX_PRIO, rq->prio.bitmap);
+        for (;;) {
+                spu = spu_alloc();
+                if (!spu)
+                        break;
+                pr_debug("%s: adding SPU[%d]\n", __FUNCTION__, spu->number);
+                add_idle(rq, spu);
+                spu->rq = rq;
+                spu->timestamp = jiffies;
+        }
+        if (!rq->nr_idle) {
+                printk(KERN_WARNING "%s: No available SPUs.\n", __FUNCTION__);
+                kfree(rq);
+                return 1;
+        }
+        return 0;
+}
+
+void __exit spu_sched_exit(void)
+{
+        struct spu_runqueue *rq = spu_rq();
+        struct spu *spu;
+
+        if (!rq) {
+                printk(KERN_WARNING "%s: no runqueues!\n", __FUNCTION__);
+                return;
+        }
+        while (rq->nr_idle > 0) {
+                spu = del_idle(rq);
+                if (!spu)
+                        break;
+                spu_free(spu);
+        }
+        kfree(rq);
+}
diff --git a/arch/powerpc/platforms/cell/spufs/spu_restore.c b/arch/powerpc/platforms/cell/spufs/spu_restore.c
new file mode 100644
index 000000000000..0bf723dcd677
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/spu_restore.c
@@ -0,0 +1,336 @@
+/*
+ * spu_restore.c
+ *
+ * (C) Copyright IBM Corp. 2005
+ *
+ * SPU-side context restore sequence outlined in
+ * Synergistic Processor Element Book IV
+ *
+ * Author: Mark Nutter <mnutter@us.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ */
+
+
+#ifndef LS_SIZE
+#define LS_SIZE                 0x40000 /* 256K (in bytes) */
+#endif
+
+typedef unsigned int u32;
+typedef unsigned long long u64;
+
+#include <spu_intrinsics.h>
+#include <asm/spu_csa.h>
+#include "spu_utils.h"
+
+#define BR_INSTR                0x327fff80      /* br -4         */
+#define NOP_INSTR               0x40200000      /* nop           */
+#define HEQ_INSTR               0x7b000000      /* heq $0, $0    */
+#define STOP_INSTR              0x00000000      /* stop 0x0      */
+#define ILLEGAL_INSTR           0x00800000      /* illegal instr */
+#define RESTORE_COMPLETE        0x00003ffc      /* stop 0x3ffc   */
+
+static inline void fetch_regs_from_mem(addr64 lscsa_ea)
+{
+        unsigned int ls = (unsigned int)&regs_spill[0];
+        unsigned int size = sizeof(regs_spill);
+        unsigned int tag_id = 0;
+        unsigned int cmd = 0x40;        /* GET */
+
+        spu_writech(MFC_LSA, ls);
+        spu_writech(MFC_EAH, lscsa_ea.ui[0]);
+        spu_writech(MFC_EAL, lscsa_ea.ui[1]);
+        spu_writech(MFC_Size, size);
+        spu_writech(MFC_TagID, tag_id);
+        spu_writech(MFC_Cmd, cmd);
+}
+
+static inline void restore_upper_240kb(addr64 lscsa_ea)
+{
+        unsigned int ls = 16384;
+        unsigned int list = (unsigned int)&dma_list[0];
+        unsigned int size = sizeof(dma_list);
+        unsigned int tag_id = 0;
+        unsigned int cmd = 0x44;        /* GETL */
+
+        /* Restore, Step 4:
+         *    Enqueue the GETL command (tag 0) to the MFC SPU command
+         *    queue to transfer the upper 240 kb of LS from CSA.
+         */
+        spu_writech(MFC_LSA, ls);
+        spu_writech(MFC_EAH, lscsa_ea.ui[0]);
+        spu_writech(MFC_EAL, list);
+        spu_writech(MFC_Size, size);
+        spu_writech(MFC_TagID, tag_id);
+        spu_writech(MFC_Cmd, cmd);
+}
+
+static inline void restore_decr(void)
+{
+        unsigned int offset;
+        unsigned int decr_running;
+        unsigned int decr;
+
+        /* Restore, Step 6:
+         *    If the LSCSA "decrementer running" flag is set
+         *    then write the SPU_WrDec channel with the
+         *    decrementer value from LSCSA.
+         */
+        offset = LSCSA_QW_OFFSET(decr_status);
+        decr_running = regs_spill[offset].slot[0];
+        if (decr_running) {
+                offset = LSCSA_QW_OFFSET(decr);
+                decr = regs_spill[offset].slot[0];
+                spu_writech(SPU_WrDec, decr);
+        }
+}
+
+static inline void write_ppu_mb(void)
+{
+        unsigned int offset;
+        unsigned int data;
+
+        /* Restore, Step 11:
+         *    Write the MFC_WrOut_MB channel with the PPU_MB
+         *    data from LSCSA.
+         */
+        offset = LSCSA_QW_OFFSET(ppu_mb);
+        data = regs_spill[offset].slot[0];
+        spu_writech(SPU_WrOutMbox, data);
+}
+
+static inline void write_ppuint_mb(void)
+{
+        unsigned int offset;
+        unsigned int data;
+
+        /* Restore, Step 12:
+         *    Write the MFC_WrInt_MB channel with the PPUINT_MB
+         *    data from LSCSA.
+         */
+        offset = LSCSA_QW_OFFSET(ppuint_mb);
+        data = regs_spill[offset].slot[0];
+        spu_writech(SPU_WrOutIntrMbox, data);
+}
+
+static inline void restore_fpcr(void)
+{
+        unsigned int offset;
+        vector unsigned int fpcr;
+
+        /* Restore, Step 13:
+         *    Restore the floating-point status and control
+         *    register from the LSCSA.
+         */
+        offset = LSCSA_QW_OFFSET(fpcr);
+        fpcr = regs_spill[offset].v;
+        spu_mtfpscr(fpcr);
+}
+
+static inline void restore_srr0(void)
+{
+        unsigned int offset;
+        unsigned int srr0;
+
+        /* Restore, Step 14:
+         *    Restore the SPU SRR0 data from the LSCSA.
+         */
+        offset = LSCSA_QW_OFFSET(srr0);
+        srr0 = regs_spill[offset].slot[0];
+        spu_writech(SPU_WrSRR0, srr0);
+}
+
+static inline void restore_event_mask(void)
+{
+        unsigned int offset;
+        unsigned int event_mask;
+
+        /* Restore, Step 15:
+         *    Restore the SPU_RdEventMsk data from the LSCSA.
+         */
+        offset = LSCSA_QW_OFFSET(event_mask);
+        event_mask = regs_spill[offset].slot[0];
+        spu_writech(SPU_WrEventMask, event_mask);
+}
+
+static inline void restore_tag_mask(void)
+{
+        unsigned int offset;
+        unsigned int tag_mask;
+
+        /* Restore, Step 16:
+         *    Restore the SPU_RdTagMsk data from the LSCSA.
+         */
+        offset = LSCSA_QW_OFFSET(tag_mask);
+        tag_mask = regs_spill[offset].slot[0];
+        spu_writech(MFC_WrTagMask, tag_mask);
+}
+
+static inline void restore_complete(void)
+{
+        extern void exit_fini(void);
+        unsigned int *exit_instrs = (unsigned int *)exit_fini;
+        unsigned int offset;
+        unsigned int stopped_status;
+        unsigned int stopped_code;
+
+        /* Restore, Step 18:
+         *    Issue a stop-and-signal instruction with
+         *    "good context restore" signal value.
+         *
+         * Restore, Step 19:
+         *    There may be additional instructions placed
+         *    here by the PPE Sequence for SPU Context
+         *    Restore in order to restore the correct
+         *    "stopped state".
+         *
+         *    This step is handled here by analyzing the
+         *    LSCSA.stopped_status and then modifying the
+         *    exit() function to behave appropriately.
+         */
+
+        offset = LSCSA_QW_OFFSET(stopped_status);
+        stopped_status = regs_spill[offset].slot[0];
+        stopped_code = regs_spill[offset].slot[1];
+
+        switch (stopped_status) {
+        case SPU_STOPPED_STATUS_P_I:
+                /* SPU_Status[P,I]=1.  Add illegal instruction
+                 * followed by stop-and-signal instruction after
+                 * end of restore code.
+                 */
+                exit_instrs[0] = RESTORE_COMPLETE;
+                exit_instrs[1] = ILLEGAL_INSTR;
+                exit_instrs[2] = STOP_INSTR | stopped_code;
+                break;
+        case SPU_STOPPED_STATUS_P_H:
+                /* SPU_Status[P,H]=1.  Add 'heq $0, $0' followed
+                 * by stop-and-signal instruction after end of
+                 * restore code.
+                 */
+                exit_instrs[0] = RESTORE_COMPLETE;
+                exit_instrs[1] = HEQ_INSTR;
+                exit_instrs[2] = STOP_INSTR | stopped_code;
+                break;
+        case SPU_STOPPED_STATUS_S_P:
+                /* SPU_Status[S,P]=1.  Add nop instruction
+                 * followed by 'br -4' after end of restore
+                 * code.
+                 */
+                exit_instrs[0] = RESTORE_COMPLETE;
+                exit_instrs[1] = STOP_INSTR | stopped_code;
+                exit_instrs[2] = NOP_INSTR;
+                exit_instrs[3] = BR_INSTR;
+                break;
+        case SPU_STOPPED_STATUS_S_I:
+                /* SPU_Status[S,I]=1.  Add  illegal instruction
+                 * followed by 'br -4' after end of restore code.
+                 */
+                exit_instrs[0] = RESTORE_COMPLETE;
+                exit_instrs[1] = ILLEGAL_INSTR;
+                exit_instrs[2] = NOP_INSTR;
+                exit_instrs[3] = BR_INSTR;
+                break;
+        case SPU_STOPPED_STATUS_I:
+                /* SPU_Status[I]=1. Add illegal instruction followed
+                 * by infinite loop after end of restore sequence.
+                 */
+                exit_instrs[0] = RESTORE_COMPLETE;
+                exit_instrs[1] = ILLEGAL_INSTR;
+                exit_instrs[2] = NOP_INSTR;
+                exit_instrs[3] = BR_INSTR;
+                break;
+        case SPU_STOPPED_STATUS_S:
+                /* SPU_Status[S]=1. Add two 'nop' instructions. */
+                exit_instrs[0] = RESTORE_COMPLETE;
+                exit_instrs[1] = NOP_INSTR;
+                exit_instrs[2] = NOP_INSTR;
+                exit_instrs[3] = BR_INSTR;
+                break;
+        case SPU_STOPPED_STATUS_H:
+                /* SPU_Status[H]=1. Add 'heq $0, $0' instruction
+                 * after end of restore code.
+                 */
+                exit_instrs[0] = RESTORE_COMPLETE;
+                exit_instrs[1] = HEQ_INSTR;
+                exit_instrs[2] = NOP_INSTR;
+                exit_instrs[3] = BR_INSTR;
+                break;
+        case SPU_STOPPED_STATUS_P:
+                /* SPU_Status[P]=1. Add stop-and-signal instruction
+                 * after end of restore code.
+                 */
+                exit_instrs[0] = RESTORE_COMPLETE;
+                exit_instrs[1] = STOP_INSTR | stopped_code;
+                break;
+        case SPU_STOPPED_STATUS_R:
+                /* SPU_Status[I,S,H,P,R]=0. Add infinite loop. */
+                exit_instrs[0] = RESTORE_COMPLETE;
+                exit_instrs[1] = NOP_INSTR;
+                exit_instrs[2] = NOP_INSTR;
+                exit_instrs[3] = BR_INSTR;
+                break;
+        default:
+                /* SPU_Status[R]=1. No additonal instructions. */
+                break;
+        }
+        spu_sync();
+}
+
+/**
+ * main - entry point for SPU-side context restore.
+ *
+ * This code deviates from the documented sequence in the
+ * following aspects:
+ *
+ *      1. The EA for LSCSA is passed from PPE in the
+ *         signal notification channels.
+ *      2. The register spill area is pulled by SPU
+ *         into LS, rather than pushed by PPE.
+ *      3. All 128 registers are restored by exit().
+ *      4. The exit() function is modified at run
+ *         time in order to properly restore the
+ *         SPU_Status register.
+ */
+int main()
+{
+        addr64 lscsa_ea;
+
+        lscsa_ea.ui[0] = spu_readch(SPU_RdSigNotify1);
+        lscsa_ea.ui[1] = spu_readch(SPU_RdSigNotify2);
+        fetch_regs_from_mem(lscsa_ea);
+
+        set_event_mask();               /* Step 1.  */
+        set_tag_mask();                 /* Step 2.  */
+        build_dma_list(lscsa_ea);       /* Step 3.  */
+        restore_upper_240kb(lscsa_ea);  /* Step 4.  */
+                                        /* Step 5: done by 'exit'. */
+        restore_decr();                 /* Step 6. */
+        enqueue_putllc(lscsa_ea);       /* Step 7. */
+        set_tag_update();               /* Step 8. */
+        read_tag_status();              /* Step 9. */
+        read_llar_status();             /* Step 10. */
+        write_ppu_mb();                 /* Step 11. */
+        write_ppuint_mb();              /* Step 12. */
+        restore_fpcr();                 /* Step 13. */
+        restore_srr0();                 /* Step 14. */
+        restore_event_mask();           /* Step 15. */
+        restore_tag_mask();             /* Step 16. */
+                                        /* Step 17. done by 'exit'. */
+        restore_complete();             /* Step 18. */
+
+        return 0;
+}
diff --git a/arch/powerpc/platforms/cell/spufs/spu_restore_crt0.S b/arch/powerpc/platforms/cell/spufs/spu_restore_crt0.S
new file mode 100644
index 000000000000..2905949debe1
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/spu_restore_crt0.S
@@ -0,0 +1,116 @@
+/*
+ * crt0_r.S: Entry function for SPU-side context restore.
+ *
+ * Copyright (C) 2005 IBM
+ *
+ * Entry and exit function for SPU-side of the context restore
+ * sequence.  Sets up an initial stack frame, then branches to
+ * 'main'.  On return, restores all 128 registers from the LSCSA
+ * and exits.
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <asm/spu_csa.h>
+
+.data
+.align 7
+.globl regs_spill
+regs_spill:
+.space SIZEOF_SPU_SPILL_REGS, 0x0
+
+.text
+.global _start
+_start:
+        /* Initialize the stack pointer to point to 16368
+         * (16kb-16). The back chain pointer is initialized
+         * to NULL.
+         */
+        il      $0, 0
+        il      $SP, 16368
+        stqd    $0, 0($SP)
+
+        /* Allocate a minimum stack frame for the called main.
+         * This is needed so that main has a place to save the
+         * link register when it calls another function.
+         */
+        stqd    $SP, -160($SP)
+        ai      $SP, $SP, -160
+
+        /* Call the program's main function. */
+        brsl    $0, main
+
+.global exit
+.global _exit
+exit:
+_exit:
+        /* SPU Context Restore, Step 5: Restore the remaining 112 GPRs. */
+        ila     $3, regs_spill + 256
+restore_regs:
+        lqr     $4, restore_reg_insts
+restore_reg_loop:
+        ai      $4, $4, 4
+        .balignl 16, 0x40200000
+restore_reg_insts:       /* must be quad-word aligned. */
+        lqd     $16, 0($3)
+        lqd     $17, 16($3)
+        lqd     $18, 32($3)
+        lqd     $19, 48($3)
+        andi    $5, $4, 0x7F
+        stqr    $4, restore_reg_insts
+        ai      $3, $3, 64
+        brnz    $5, restore_reg_loop
+
+        /* SPU Context Restore Step 17: Restore the first 16 GPRs. */
+        lqa $0, regs_spill + 0
+        lqa $1, regs_spill + 16
+        lqa $2, regs_spill + 32
+        lqa $3, regs_spill + 48
+        lqa $4, regs_spill + 64
+        lqa $5, regs_spill + 80
+        lqa $6, regs_spill + 96
+        lqa $7, regs_spill + 112
+        lqa $8, regs_spill + 128
+        lqa $9, regs_spill + 144
+        lqa $10, regs_spill + 160
+        lqa $11, regs_spill + 176
+        lqa $12, regs_spill + 192
+        lqa $13, regs_spill + 208
+        lqa $14, regs_spill + 224
+        lqa $15, regs_spill + 240
+
+        /* Under normal circumstances, the 'exit' function
+         * terminates with 'stop SPU_RESTORE_COMPLETE',
+         * indicating that the SPU-side restore code has
+         * completed.
+         *
+         * However it is possible that instructions immediately
+         * following the 'stop 0x3ffc' have been modified at run
+         * time so as to recreate the exact SPU_Status settings
+         * from the application, e.g. illegal instruciton, halt,
+         * etc.
+         */
+.global exit_fini
+.global _exit_fini
+exit_fini:
+_exit_fini:
+        stop    SPU_RESTORE_COMPLETE
+        stop    0
+        stop    0
+        stop    0
+
+        /* Pad the size of this crt0.o to be multiple of 16 bytes. */
+.balignl 16, 0x0
diff --git a/arch/powerpc/platforms/cell/spufs/spu_restore_dump.h_shipped b/arch/powerpc/platforms/cell/spufs/spu_restore_dump.h_shipped
new file mode 100644
index 000000000000..1b2355ff7036
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/spu_restore_dump.h_shipped
@@ -0,0 +1,231 @@
+/*
+ * spu_restore_dump.h: Copyright (C) 2005 IBM.
+ * Hex-dump auto generated from spu_restore.c.
+ * Do not edit!
+ */
+static unsigned int spu_restore_code[] __page_aligned = {
+0x40800000, 0x409ff801, 0x24000080, 0x24fd8081,
+0x1cd80081, 0x33001180, 0x42030003, 0x33800284,
+0x1c010204, 0x40200000, 0x40200000, 0x40200000,
+0x34000190, 0x34004191, 0x34008192, 0x3400c193,
+0x141fc205, 0x23fffd84, 0x1c100183, 0x217ffa85,
+0x3080a000, 0x3080a201, 0x3080a402, 0x3080a603,
+0x3080a804, 0x3080aa05, 0x3080ac06, 0x3080ae07,
+0x3080b008, 0x3080b209, 0x3080b40a, 0x3080b60b,
+0x3080b80c, 0x3080ba0d, 0x3080bc0e, 0x3080be0f,
+0x00003ffc, 0x00000000, 0x00000000, 0x00000000,
+0x01a00182, 0x3ec00083, 0xb0a14103, 0x01a00204,
+0x3ec10082, 0x4202800e, 0x04000703, 0xb0a14202,
+0x21a00803, 0x3fbf028d, 0x3f20068d, 0x3fbe0682,
+0x3fe30102, 0x21a00882, 0x3f82028f, 0x3fe3078f,
+0x3fbf0784, 0x3f200204, 0x3fbe0204, 0x3fe30204,
+0x04000203, 0x21a00903, 0x40848002, 0x21a00982,
+0x40800003, 0x21a00a03, 0x40802002, 0x21a00a82,
+0x21a00083, 0x40800082, 0x21a00b02, 0x10002818,
+0x40a80002, 0x32800007, 0x4207000c, 0x18008208,
+0x40a0000b, 0x4080020a, 0x40800709, 0x00200000,
+0x42070002, 0x3ac30384, 0x1cffc489, 0x00200000,
+0x18008383, 0x38830382, 0x4cffc486, 0x3ac28185,
+0xb0408584, 0x28830382, 0x1c020387, 0x38828182,
+0xb0408405, 0x1802c408, 0x28828182, 0x217ff886,
+0x04000583, 0x21a00803, 0x3fbe0682, 0x3fe30102,
+0x04000106, 0x21a00886, 0x04000603, 0x21a00903,
+0x40803c02, 0x21a00982, 0x40800003, 0x04000184,
+0x21a00a04, 0x40802202, 0x21a00a82, 0x42028005,
+0x34208702, 0x21002282, 0x21a00804, 0x21a00886,
+0x3fbf0782, 0x3f200102, 0x3fbe0102, 0x3fe30102,
+0x21a00902, 0x40804003, 0x21a00983, 0x21a00a04,
+0x40805a02, 0x21a00a82, 0x40800083, 0x21a00b83,
+0x01a00c02, 0x01a00d83, 0x3420c282, 0x21a00e02,
+0x34210283, 0x21a00f03, 0x34200284, 0x77400200,
+0x3421c282, 0x21a00702, 0x34218283, 0x21a00083,
+0x34214282, 0x21a00b02, 0x4200480c, 0x00200000,
+0x1c010286, 0x34220284, 0x34220302, 0x0f608203,
+0x5c024204, 0x3b81810b, 0x42013c02, 0x00200000,
+0x18008185, 0x38808183, 0x3b814182, 0x21004e84,
+0x4020007f, 0x35000100, 0x000004e0, 0x000002a0,
+0x000002e8, 0x00000428, 0x00000360, 0x000002e8,
+0x000004a0, 0x00000468, 0x000003c8, 0x00000360,
+0x409ffe02, 0x30801203, 0x40800204, 0x3ec40085,
+0x10009c09, 0x3ac10606, 0xb060c105, 0x4020007f,
+0x4020007f, 0x20801203, 0x38810602, 0xb0408586,
+0x28810602, 0x32004180, 0x34204702, 0x21a00382,
+0x4020007f, 0x327fdc80, 0x409ffe02, 0x30801203,
+0x40800204, 0x3ec40087, 0x40800405, 0x00200000,
+0x40800606, 0x3ac10608, 0x3ac14609, 0x3ac1860a,
+0xb060c107, 0x20801203, 0x41004003, 0x38810602,
+0x4020007f, 0xb0408188, 0x4020007f, 0x28810602,
+0x41201002, 0x38814603, 0x10009c09, 0xb060c109,
+0x4020007f, 0x28814603, 0x41193f83, 0x38818602,
+0x60ffc003, 0xb040818a, 0x28818602, 0x32003080,
+0x409ffe02, 0x30801203, 0x40800204, 0x3ec40087,
+0x41201008, 0x10009c14, 0x40800405, 0x3ac10609,
+0x40800606, 0x3ac1460a, 0xb060c107, 0x3ac1860b,
+0x20801203, 0x38810602, 0xb0408409, 0x28810602,
+0x38814603, 0xb060c40a, 0x4020007f, 0x28814603,
+0x41193f83, 0x38818602, 0x60ffc003, 0xb040818b,
+0x28818602, 0x32002380, 0x409ffe02, 0x30801204,
+0x40800205, 0x3ec40083, 0x40800406, 0x3ac14607,
+0x3ac18608, 0xb0810103, 0x41004002, 0x20801204,
+0x4020007f, 0x38814603, 0x10009c0b, 0xb060c107,
+0x4020007f, 0x4020007f, 0x28814603, 0x38818602,
+0x4020007f, 0x4020007f, 0xb0408588, 0x28818602,
+0x4020007f, 0x32001780, 0x409ffe02, 0x1000640e,
+0x40800204, 0x30801203, 0x40800405, 0x3ec40087,
+0x40800606, 0x3ac10608, 0x3ac14609, 0x3ac1860a,
+0xb060c107, 0x20801203, 0x413d8003, 0x38810602,
+0x4020007f, 0x327fd780, 0x409ffe02, 0x10007f0c,
+0x40800205, 0x30801204, 0x40800406, 0x3ec40083,
+0x3ac14607, 0x3ac18608, 0xb0810103, 0x413d8002,
+0x20801204, 0x38814603, 0x4020007f, 0x327feb80,
+0x409ffe02, 0x30801203, 0x40800204, 0x3ec40087,
+0x40800405, 0x1000650a, 0x40800606, 0x3ac10608,
+0x3ac14609, 0x3ac1860a, 0xb060c107, 0x20801203,
+0x38810602, 0xb0408588, 0x4020007f, 0x327fc980,
+0x00400000, 0x40800003, 0x4020007f, 0x35000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+};
diff --git a/arch/powerpc/platforms/cell/spufs/spu_save.c b/arch/powerpc/platforms/cell/spufs/spu_save.c
new file mode 100644
index 000000000000..196033b8a579
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/spu_save.c
@@ -0,0 +1,195 @@
+/*
+ * spu_save.c
+ *
+ * (C) Copyright IBM Corp. 2005
+ *
+ * SPU-side context save sequence outlined in
+ * Synergistic Processor Element Book IV
+ *
+ * Author: Mark Nutter <mnutter@us.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ */
+
+
+#ifndef LS_SIZE
+#define LS_SIZE                 0x40000 /* 256K (in bytes) */
+#endif
+
+typedef unsigned int u32;
+typedef unsigned long long u64;
+
+#include <spu_intrinsics.h>
+#include <asm/spu_csa.h>
+#include "spu_utils.h"
+
+static inline void save_event_mask(void)
+{
+        unsigned int offset;
+
+        /* Save, Step 2:
+         *    Read the SPU_RdEventMsk channel and save to the LSCSA.
+         */
+        offset = LSCSA_QW_OFFSET(event_mask);
+        regs_spill[offset].slot[0] = spu_readch(SPU_RdEventStatMask);
+}
+
+static inline void save_tag_mask(void)
+{
+        unsigned int offset;
+
+        /* Save, Step 3:
+         *    Read the SPU_RdTagMsk channel and save to the LSCSA.
+         */
+        offset = LSCSA_QW_OFFSET(tag_mask);
+        regs_spill[offset].slot[0] = spu_readch(MFC_RdTagMask);
+}
+
+static inline void save_upper_240kb(addr64 lscsa_ea)
+{
+        unsigned int ls = 16384;
+        unsigned int list = (unsigned int)&dma_list[0];
+        unsigned int size = sizeof(dma_list);
+        unsigned int tag_id = 0;
+        unsigned int cmd = 0x24;        /* PUTL */
+
+        /* Save, Step 7:
+         *    Enqueue the PUTL command (tag 0) to the MFC SPU command
+         *    queue to transfer the remaining 240 kb of LS to CSA.
+         */
+        spu_writech(MFC_LSA, ls);
+        spu_writech(MFC_EAH, lscsa_ea.ui[0]);
+        spu_writech(MFC_EAL, list);
+        spu_writech(MFC_Size, size);
+        spu_writech(MFC_TagID, tag_id);
+        spu_writech(MFC_Cmd, cmd);
+}
+
+static inline void save_fpcr(void)
+{
+        // vector unsigned int fpcr;
+        unsigned int offset;
+
+        /* Save, Step 9:
+         *    Issue the floating-point status and control register
+         *    read instruction, and save to the LSCSA.
+         */
+        offset = LSCSA_QW_OFFSET(fpcr);
+        regs_spill[offset].v = spu_mffpscr();
+}
+
+static inline void save_decr(void)
+{
+        unsigned int offset;
+
+        /* Save, Step 10:
+         *    Read and save the SPU_RdDec channel data to
+         *    the LSCSA.
+         */
+        offset = LSCSA_QW_OFFSET(decr);
+        regs_spill[offset].slot[0] = spu_readch(SPU_RdDec);
+}
+
+static inline void save_srr0(void)
+{
+        unsigned int offset;
+
+        /* Save, Step 11:
+         *    Read and save the SPU_WSRR0 channel data to
+         *    the LSCSA.
+         */
+        offset = LSCSA_QW_OFFSET(srr0);
+        regs_spill[offset].slot[0] = spu_readch(SPU_RdSRR0);
+}
+
+static inline void spill_regs_to_mem(addr64 lscsa_ea)
+{
+        unsigned int ls = (unsigned int)&regs_spill[0];
+        unsigned int size = sizeof(regs_spill);
+        unsigned int tag_id = 0;
+        unsigned int cmd = 0x20;        /* PUT */
+
+        /* Save, Step 13:
+         *    Enqueue a PUT command (tag 0) to send the LSCSA
+         *    to the CSA.
+         */
+        spu_writech(MFC_LSA, ls);
+        spu_writech(MFC_EAH, lscsa_ea.ui[0]);
+        spu_writech(MFC_EAL, lscsa_ea.ui[1]);
+        spu_writech(MFC_Size, size);
+        spu_writech(MFC_TagID, tag_id);
+        spu_writech(MFC_Cmd, cmd);
+}
+
+static inline void enqueue_sync(addr64 lscsa_ea)
+{
+        unsigned int tag_id = 0;
+        unsigned int cmd = 0xCC;
+
+        /* Save, Step 14:
+         *    Enqueue an MFC_SYNC command (tag 0).
+         */
+        spu_writech(MFC_TagID, tag_id);
+        spu_writech(MFC_Cmd, cmd);
+}
+
+static inline void save_complete(void)
+{
+        /* Save, Step 18:
+         *    Issue a stop-and-signal instruction indicating
+         *    "save complete".  Note: This function will not
+         *    return!!
+         */
+        spu_stop(SPU_SAVE_COMPLETE);
+}
+
+/**
+ * main - entry point for SPU-side context save.
+ *
+ * This code deviates from the documented sequence as follows:
+ *
+ *      1. The EA for LSCSA is passed from PPE in the
+ *         signal notification channels.
+ *      2. All 128 registers are saved by crt0.o.
+ */
+int main()
+{
+        addr64 lscsa_ea;
+
+        lscsa_ea.ui[0] = spu_readch(SPU_RdSigNotify1);
+        lscsa_ea.ui[1] = spu_readch(SPU_RdSigNotify2);
+
+        /* Step 1: done by exit(). */
+        save_event_mask();      /* Step 2.  */
+        save_tag_mask();        /* Step 3.  */
+        set_event_mask();       /* Step 4.  */
+        set_tag_mask();         /* Step 5.  */
+        build_dma_list(lscsa_ea);       /* Step 6.  */
+        save_upper_240kb(lscsa_ea);     /* Step 7.  */
+        /* Step 8: done by exit(). */
+        save_fpcr();            /* Step 9.  */
+        save_decr();            /* Step 10. */
+        save_srr0();            /* Step 11. */
+        enqueue_putllc(lscsa_ea);       /* Step 12. */
+        spill_regs_to_mem(lscsa_ea);    /* Step 13. */
+        enqueue_sync(lscsa_ea); /* Step 14. */
+        set_tag_update();       /* Step 15. */
+        read_tag_status();      /* Step 16. */
+        read_llar_status();     /* Step 17. */
+        save_complete();        /* Step 18. */
+
+        return 0;
+}
diff --git a/arch/powerpc/platforms/cell/spufs/spu_save_crt0.S b/arch/powerpc/platforms/cell/spufs/spu_save_crt0.S
new file mode 100644
index 000000000000..6659d6a66faa
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/spu_save_crt0.S
@@ -0,0 +1,102 @@
+/*
+ * crt0_s.S: Entry function for SPU-side context save.
+ *
+ * Copyright (C) 2005 IBM
+ *
+ * Entry function for SPU-side of the context save sequence.
+ * Saves all 128 GPRs, sets up an initial stack frame, then
+ * branches to 'main'.
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <asm/spu_csa.h>
+
+.data
+.align 7
+.globl regs_spill
+regs_spill:
+.space SIZEOF_SPU_SPILL_REGS, 0x0
+
+.text
+.global _start
+_start:
+        /* SPU Context Save Step 1: Save the first 16 GPRs. */
+        stqa $0, regs_spill + 0
+        stqa $1, regs_spill + 16
+        stqa $2, regs_spill + 32
+        stqa $3, regs_spill + 48
+        stqa $4, regs_spill + 64
+        stqa $5, regs_spill + 80
+        stqa $6, regs_spill + 96
+        stqa $7, regs_spill + 112
+        stqa $8, regs_spill + 128
+        stqa $9, regs_spill + 144
+        stqa $10, regs_spill + 160
+        stqa $11, regs_spill + 176
+        stqa $12, regs_spill + 192
+        stqa $13, regs_spill + 208
+        stqa $14, regs_spill + 224
+        stqa $15, regs_spill + 240
+
+        /* SPU Context Save, Step 8: Save the remaining 112 GPRs. */
+        ila     $3, regs_spill + 256
+save_regs:
+        lqr     $4, save_reg_insts
+save_reg_loop:
+        ai      $4, $4, 4
+        .balignl 16, 0x40200000
+save_reg_insts:       /* must be quad-word aligned. */
+        stqd    $16, 0($3)
+        stqd    $17, 16($3)
+        stqd    $18, 32($3)
+        stqd    $19, 48($3)
+        andi    $5, $4, 0x7F
+        stqr    $4, save_reg_insts
+        ai      $3, $3, 64
+        brnz    $5, save_reg_loop
+
+        /* Initialize the stack pointer to point to 16368
+         * (16kb-16). The back chain pointer is initialized
+         * to NULL.
+         */
+        il      $0, 0
+        il      $SP, 16368
+        stqd    $0, 0($SP)
+
+        /* Allocate a minimum stack frame for the called main.
+         * This is needed so that main has a place to save the
+         * link register when it calls another function.
+         */
+        stqd    $SP, -160($SP)
+        ai      $SP, $SP, -160
+
+        /* Call the program's main function. */
+        brsl    $0, main
+
+        /* In this case main should not return; if it does
+         * there has been an error in the sequence.  Execute
+         * stop-and-signal with code=0.
+         */
+.global exit
+.global _exit
+exit:
+_exit:
+        stop    0x0
+
+        /* Pad the size of this crt0.o to be multiple of 16 bytes. */
+.balignl 16, 0x0
+
diff --git a/arch/powerpc/platforms/cell/spufs/spu_save_dump.h_shipped b/arch/powerpc/platforms/cell/spufs/spu_save_dump.h_shipped
new file mode 100644
index 000000000000..39e54003f1df
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/spu_save_dump.h_shipped
@@ -0,0 +1,191 @@
+/*
+ * spu_save_dump.h: Copyright (C) 2005 IBM.
+ * Hex-dump auto generated from spu_save.c.
+ * Do not edit!
+ */
+static unsigned int spu_save_code[] __page_aligned = {
+0x20805000, 0x20805201, 0x20805402, 0x20805603,
+0x20805804, 0x20805a05, 0x20805c06, 0x20805e07,
+0x20806008, 0x20806209, 0x2080640a, 0x2080660b,
+0x2080680c, 0x20806a0d, 0x20806c0e, 0x20806e0f,
+0x4201c003, 0x33800184, 0x1c010204, 0x40200000,
+0x24000190, 0x24004191, 0x24008192, 0x2400c193,
+0x141fc205, 0x23fffd84, 0x1c100183, 0x217ffb85,
+0x40800000, 0x409ff801, 0x24000080, 0x24fd8081,
+0x1cd80081, 0x33000180, 0x00000000, 0x00000000,
+0x01a00182, 0x3ec00083, 0xb1c38103, 0x01a00204,
+0x3ec10082, 0x4201400d, 0xb1c38202, 0x01a00583,
+0x34218682, 0x3ed80684, 0xb0408184, 0x24218682,
+0x01a00603, 0x00200000, 0x34214682, 0x3ed40684,
+0xb0408184, 0x40800003, 0x24214682, 0x21a00083,
+0x40800082, 0x21a00b02, 0x4020007f, 0x1000251e,
+0x40a80002, 0x32800008, 0x4205c00c, 0x00200000,
+0x40a0000b, 0x3f82070f, 0x4080020a, 0x40800709,
+0x3fe3078f, 0x3fbf0783, 0x3f200183, 0x3fbe0183,
+0x3fe30187, 0x18008387, 0x4205c002, 0x3ac30404,
+0x1cffc489, 0x00200000, 0x18008403, 0x38830402,
+0x4cffc486, 0x3ac28185, 0xb0408584, 0x28830402,
+0x1c020408, 0x38828182, 0xb0408385, 0x1802c387,
+0x28828182, 0x217ff886, 0x04000582, 0x32800007,
+0x21a00802, 0x3fbf0705, 0x3f200285, 0x3fbe0285,
+0x3fe30285, 0x21a00885, 0x04000603, 0x21a00903,
+0x40803c02, 0x21a00982, 0x04000386, 0x21a00a06,
+0x40801202, 0x21a00a82, 0x73000003, 0x24200683,
+0x01a00404, 0x00200000, 0x34204682, 0x3ec40683,
+0xb0408203, 0x24204682, 0x01a00783, 0x00200000,
+0x3421c682, 0x3edc0684, 0xb0408184, 0x2421c682,
+0x21a00806, 0x21a00885, 0x3fbf0784, 0x3f200204,
+0x3fbe0204, 0x3fe30204, 0x21a00904, 0x40804002,
+0x21a00982, 0x21a00a06, 0x40805a02, 0x21a00a82,
+0x04000683, 0x21a00803, 0x21a00885, 0x21a00904,
+0x40848002, 0x21a00982, 0x21a00a06, 0x40801002,
+0x21a00a82, 0x21a00a06, 0x40806602, 0x00200000,
+0x35800009, 0x21a00a82, 0x40800083, 0x21a00b83,
+0x01a00c02, 0x01a00d83, 0x00003ffb, 0x40800003,
+0x4020007f, 0x35000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+0x00000000, 0x00000000, 0x00000000, 0x00000000,
+};
diff --git a/arch/powerpc/platforms/cell/spufs/spu_utils.h b/arch/powerpc/platforms/cell/spufs/spu_utils.h
new file mode 100644
index 000000000000..58359feb6c95
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/spu_utils.h
@@ -0,0 +1,160 @@
+/*
+ * utils.h: Utilities for SPU-side of the context switch operation.
+ *
+ * (C) Copyright IBM 2005
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef _SPU_CONTEXT_UTILS_H_
+#define _SPU_CONTEXT_UTILS_H_
+
+/*
+ * 64-bit safe EA.
+ */
+typedef union {
+        unsigned long long ull;
+        unsigned int ui[2];
+} addr64;
+
+/*
+ * 128-bit register template.
+ */
+typedef union {
+        unsigned int slot[4];
+        vector unsigned int v;
+} spu_reg128v;
+
+/*
+ * DMA list structure.
+ */
+struct dma_list_elem {
+        unsigned int size;
+        unsigned int ea_low;
+};
+
+/*
+ * Declare storage for 8-byte aligned DMA list.
+ */
+struct dma_list_elem dma_list[15] __attribute__ ((aligned(8)));
+
+/*
+ * External definition for storage
+ * declared in crt0.
+ */
+extern spu_reg128v regs_spill[NR_SPU_SPILL_REGS];
+
+/*
+ * Compute LSCSA byte offset for a given field.
+ */
+static struct spu_lscsa *dummy = (struct spu_lscsa *)0;
+#define LSCSA_BYTE_OFFSET(_field)  \
+        ((char *)(&(dummy->_field)) - (char *)(&(dummy->gprs[0].slot[0])))
+#define LSCSA_QW_OFFSET(_field)  (LSCSA_BYTE_OFFSET(_field) >> 4)
+
+static inline void set_event_mask(void)
+{
+        unsigned int event_mask = 0;
+
+        /* Save, Step 4:
+         * Restore, Step 1:
+         *    Set the SPU_RdEventMsk channel to zero to mask
+         *    all events.
+         */
+        spu_writech(SPU_WrEventMask, event_mask);
+}
+
+static inline void set_tag_mask(void)
+{
+        unsigned int tag_mask = 1;
+
+        /* Save, Step 5:
+         * Restore, Step 2:
+         *    Set the SPU_WrTagMsk channel to '01' to unmask
+         *    only tag group 0.
+         */
+        spu_writech(MFC_WrTagMask, tag_mask);
+}
+
+static inline void build_dma_list(addr64 lscsa_ea)
+{
+        unsigned int ea_low;
+        int i;
+
+        /* Save, Step 6:
+         * Restore, Step 3:
+         *    Update the effective address for the CSA in the
+         *    pre-canned DMA-list in local storage.
+         */
+        ea_low = lscsa_ea.ui[1];
+        ea_low += LSCSA_BYTE_OFFSET(ls[16384]);
+
+        for (i = 0; i < 15; i++, ea_low += 16384) {
+                dma_list[i].size = 16384;
+                dma_list[i].ea_low = ea_low;
+        }
+}
+
+static inline void enqueue_putllc(addr64 lscsa_ea)
+{
+        unsigned int ls = 0;
+        unsigned int size = 128;
+        unsigned int tag_id = 0;
+        unsigned int cmd = 0xB4;        /* PUTLLC */
+
+        /* Save, Step 12:
+         * Restore, Step 7:
+         *    Send a PUTLLC (tag 0) command to the MFC using
+         *    an effective address in the CSA in order to
+         *    remove any possible lock-line reservation.
+         */
+        spu_writech(MFC_LSA, ls);
+        spu_writech(MFC_EAH, lscsa_ea.ui[0]);
+        spu_writech(MFC_EAL, lscsa_ea.ui[1]);
+        spu_writech(MFC_Size, size);
+        spu_writech(MFC_TagID, tag_id);
+        spu_writech(MFC_Cmd, cmd);
+}
+
+static inline void set_tag_update(void)
+{
+        unsigned int update_any = 1;
+
+        /* Save, Step 15:
+         * Restore, Step 8:
+         *    Write the MFC_TagUpdate channel with '01'.
+         */
+        spu_writech(MFC_WrTagUpdate, update_any);
+}
+
+static inline void read_tag_status(void)
+{
+        /* Save, Step 16:
+         * Restore, Step 9:
+         *    Read the MFC_TagStat channel data.
+         */
+        spu_readch(MFC_RdTagStat);
+}
+
+static inline void read_llar_status(void)
+{
+        /* Save, Step 17:
+         * Restore, Step 10:
+         *    Read the MFC_AtomicStat channel data.
+         */
+        spu_readch(MFC_RdAtomicStat);
+}
+
+#endif                          /* _SPU_CONTEXT_UTILS_H_ */
diff --git a/arch/powerpc/platforms/cell/spufs/spufs.h b/arch/powerpc/platforms/cell/spufs/spufs.h
new file mode 100644
index 000000000000..db2601f0abd5
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/spufs.h
@@ -0,0 +1,163 @@
+/*
+ * SPU file system
+ *
+ * (C) Copyright IBM Deutschland Entwicklung GmbH 2005
+ *
+ * Author: Arnd Bergmann <arndb@de.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+#ifndef SPUFS_H
+#define SPUFS_H
+
+#include <linux/kref.h>
+#include <linux/rwsem.h>
+#include <linux/spinlock.h>
+#include <linux/fs.h>
+
+#include <asm/spu.h>
+#include <asm/spu_csa.h>
+
+/* The magic number for our file system */
+enum {
+        SPUFS_MAGIC = 0x23c9b64e,
+};
+
+struct spu_context_ops;
+
+#define SPU_CONTEXT_PREEMPT          0UL
+
+struct spu_context {
+        struct spu *spu;                  /* pointer to a physical SPU */
+        struct spu_state csa;             /* SPU context save area. */
+        spinlock_t mmio_lock;             /* protects mmio access */
+        struct address_space *local_store;/* local store backing store */
+
+        enum { SPU_STATE_RUNNABLE, SPU_STATE_SAVED } state;
+        struct rw_semaphore state_sema;
+        struct semaphore run_sema;
+
+        struct mm_struct *owner;
+
+        struct kref kref;
+        wait_queue_head_t ibox_wq;
+        wait_queue_head_t wbox_wq;
+        wait_queue_head_t stop_wq;
+        struct fasync_struct *ibox_fasync;
+        struct fasync_struct *wbox_fasync;
+        struct spu_context_ops *ops;
+        struct work_struct reap_work;
+        u64 flags;
+};
+
+/* SPU context query/set operations. */
+struct spu_context_ops {
+        int (*mbox_read) (struct spu_context * ctx, u32 * data);
+         u32(*mbox_stat_read) (struct spu_context * ctx);
+        unsigned int (*mbox_stat_poll)(struct spu_context *ctx,
+                                        unsigned int events);
+        int (*ibox_read) (struct spu_context * ctx, u32 * data);
+        int (*wbox_write) (struct spu_context * ctx, u32 data);
+         u32(*signal1_read) (struct spu_context * ctx);
+        void (*signal1_write) (struct spu_context * ctx, u32 data);
+         u32(*signal2_read) (struct spu_context * ctx);
+        void (*signal2_write) (struct spu_context * ctx, u32 data);
+        void (*signal1_type_set) (struct spu_context * ctx, u64 val);
+         u64(*signal1_type_get) (struct spu_context * ctx);
+        void (*signal2_type_set) (struct spu_context * ctx, u64 val);
+         u64(*signal2_type_get) (struct spu_context * ctx);
+         u32(*npc_read) (struct spu_context * ctx);
+        void (*npc_write) (struct spu_context * ctx, u32 data);
+         u32(*status_read) (struct spu_context * ctx);
+        char*(*get_ls) (struct spu_context * ctx);
+        void (*runcntl_write) (struct spu_context * ctx, u32 data);
+        void (*runcntl_stop) (struct spu_context * ctx);
+};
+
+extern struct spu_context_ops spu_hw_ops;
+extern struct spu_context_ops spu_backing_ops;
+
+struct spufs_inode_info {
+        struct spu_context *i_ctx;
+        struct inode vfs_inode;
+};
+#define SPUFS_I(inode) \
+        container_of(inode, struct spufs_inode_info, vfs_inode)
+
+extern struct tree_descr spufs_dir_contents[];
+
+/* system call implementation */
+long spufs_run_spu(struct file *file,
+                   struct spu_context *ctx, u32 *npc, u32 *status);
+long spufs_create_thread(struct nameidata *nd,
+                         unsigned int flags, mode_t mode);
+extern struct file_operations spufs_context_fops;
+
+/* context management */
+struct spu_context * alloc_spu_context(struct address_space *local_store);
+void destroy_spu_context(struct kref *kref);
+struct spu_context * get_spu_context(struct spu_context *ctx);
+int put_spu_context(struct spu_context *ctx);
+void spu_unmap_mappings(struct spu_context *ctx);
+
+void spu_forget(struct spu_context *ctx);
+void spu_acquire(struct spu_context *ctx);
+void spu_release(struct spu_context *ctx);
+int spu_acquire_runnable(struct spu_context *ctx);
+void spu_acquire_saved(struct spu_context *ctx);
+
+int spu_activate(struct spu_context *ctx, u64 flags);
+void spu_deactivate(struct spu_context *ctx);
+void spu_yield(struct spu_context *ctx);
+int __init spu_sched_init(void);
+void __exit spu_sched_exit(void);
+
+/*
+ * spufs_wait
+ *      Same as wait_event_interruptible(), except that here
+ *      we need to call spu_release(ctx) before sleeping, and
+ *      then spu_acquire(ctx) when awoken.
+ */
+
+#define spufs_wait(wq, condition)                                       \
+({                                                                      \
+        int __ret = 0;                                                  \
+        DEFINE_WAIT(__wait);                                            \
+        for (;;) {                                                      \
+                prepare_to_wait(&(wq), &__wait, TASK_INTERRUPTIBLE);    \
+                if (condition)                                          \
+                        break;                                          \
+                if (!signal_pending(current)) {                         \
+                        spu_release(ctx);                               \
+                        schedule();                                     \
+                        spu_acquire(ctx);                               \
+                        continue;                                       \
+                }                                                       \
+                __ret = -ERESTARTSYS;                                   \
+                break;                                                  \
+        }                                                               \
+        finish_wait(&(wq), &__wait);                                    \
+        __ret;                                                          \
+})
+
+size_t spu_wbox_write(struct spu_context *ctx, u32 data);
+size_t spu_ibox_read(struct spu_context *ctx, u32 *data);
+
+/* irq callback funcs. */
+void spufs_ibox_callback(struct spu *spu);
+void spufs_wbox_callback(struct spu *spu);
+void spufs_stop_callback(struct spu *spu);
+
+#endif
diff --git a/arch/powerpc/platforms/cell/spufs/switch.c b/arch/powerpc/platforms/cell/spufs/switch.c
new file mode 100644
index 000000000000..1061c12b2edb
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/switch.c
@@ -0,0 +1,2180 @@
+/*
+ * spu_switch.c
+ *
+ * (C) Copyright IBM Corp. 2005
+ *
+ * Author: Mark Nutter <mnutter@us.ibm.com>
+ *
+ * Host-side part of SPU context switch sequence outlined in
+ * Synergistic Processor Element, Book IV.
+ *
+ * A fully premptive switch of an SPE is very expensive in terms
+ * of time and system resources.  SPE Book IV indicates that SPE
+ * allocation should follow a "serially reusable device" model,
+ * in which the SPE is assigned a task until it completes.  When
+ * this is not possible, this sequence may be used to premptively
+ * save, and then later (optionally) restore the context of a
+ * program executing on an SPE.
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/errno.h>
+#include <linux/sched.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/vmalloc.h>
+#include <linux/smp.h>
+#include <linux/smp_lock.h>
+#include <linux/stddef.h>
+#include <linux/unistd.h>
+
+#include <asm/io.h>
+#include <asm/spu.h>
+#include <asm/spu_csa.h>
+#include <asm/mmu_context.h>
+
+#include "spu_save_dump.h"
+#include "spu_restore_dump.h"
+
+#if 0
+#define POLL_WHILE_TRUE(_c) {                           \
+    do {                                                \
+    } while (_c);                                       \
+  }
+#else
+#define RELAX_SPIN_COUNT                                1000
+#define POLL_WHILE_TRUE(_c) {                           \
+    do {                                                \
+        int _i;                                         \
+        for (_i=0; _i<RELAX_SPIN_COUNT && (_c); _i++) { \
+            cpu_relax();                                \
+        }                                               \
+        if (unlikely(_c)) yield();                      \
+        else break;                                     \
+    } while (_c);                                       \
+  }
+#endif                          /* debug */
+
+#define POLL_WHILE_FALSE(_c)    POLL_WHILE_TRUE(!(_c))
+
+static inline void acquire_spu_lock(struct spu *spu)
+{
+        /* Save, Step 1:
+         * Restore, Step 1:
+         *    Acquire SPU-specific mutual exclusion lock.
+         *    TBD.
+         */
+}
+
+static inline void release_spu_lock(struct spu *spu)
+{
+        /* Restore, Step 76:
+         *    Release SPU-specific mutual exclusion lock.
+         *    TBD.
+         */
+}
+
+static inline int check_spu_isolate(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+        u32 isolate_state;
+
+        /* Save, Step 2:
+         * Save, Step 6:
+         *     If SPU_Status[E,L,IS] any field is '1', this
+         *     SPU is in isolate state and cannot be context
+         *     saved at this time.
+         */
+        isolate_state = SPU_STATUS_ISOLATED_STATE |
+            SPU_STATUS_ISOLATED_LOAD_STAUTUS | SPU_STATUS_ISOLATED_EXIT_STAUTUS;
+        return (in_be32(&prob->spu_status_R) & isolate_state) ? 1 : 0;
+}
+
+static inline void disable_interrupts(struct spu_state *csa, struct spu *spu)
+{
+        /* Save, Step 3:
+         * Restore, Step 2:
+         *     Save INT_Mask_class0 in CSA.
+         *     Write INT_MASK_class0 with value of 0.
+         *     Save INT_Mask_class1 in CSA.
+         *     Write INT_MASK_class1 with value of 0.
+         *     Save INT_Mask_class2 in CSA.
+         *     Write INT_MASK_class2 with value of 0.
+         */
+        spin_lock_irq(&spu->register_lock);
+        if (csa) {
+                csa->priv1.int_mask_class0_RW = spu_int_mask_get(spu, 0);
+                csa->priv1.int_mask_class1_RW = spu_int_mask_get(spu, 1);
+                csa->priv1.int_mask_class2_RW = spu_int_mask_get(spu, 2);
+        }
+        spu_int_mask_set(spu, 0, 0ul);
+        spu_int_mask_set(spu, 1, 0ul);
+        spu_int_mask_set(spu, 2, 0ul);
+        eieio();
+        spin_unlock_irq(&spu->register_lock);
+}
+
+static inline void set_watchdog_timer(struct spu_state *csa, struct spu *spu)
+{
+        /* Save, Step 4:
+         * Restore, Step 25.
+         *    Set a software watchdog timer, which specifies the
+         *    maximum allowable time for a context save sequence.
+         *
+         *    For present, this implementation will not set a global
+         *    watchdog timer, as virtualization & variable system load
+         *    may cause unpredictable execution times.
+         */
+}
+
+static inline void inhibit_user_access(struct spu_state *csa, struct spu *spu)
+{
+        /* Save, Step 5:
+         * Restore, Step 3:
+         *     Inhibit user-space access (if provided) to this
+         *     SPU by unmapping the virtual pages assigned to
+         *     the SPU memory-mapped I/O (MMIO) for problem
+         *     state. TBD.
+         */
+}
+
+static inline void set_switch_pending(struct spu_state *csa, struct spu *spu)
+{
+        /* Save, Step 7:
+         * Restore, Step 5:
+         *     Set a software context switch pending flag.
+         */
+        set_bit(SPU_CONTEXT_SWITCH_PENDING, &spu->flags);
+        mb();
+}
+
+static inline void save_mfc_cntl(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 8:
+         *     Read and save MFC_CNTL[Ss].
+         */
+        if (csa) {
+                csa->priv2.mfc_control_RW = in_be64(&priv2->mfc_control_RW) &
+                    MFC_CNTL_SUSPEND_DMA_STATUS_MASK;
+        }
+}
+
+static inline void save_spu_runcntl(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Save, Step 9:
+         *     Save SPU_Runcntl in the CSA.  This value contains
+         *     the "Application Desired State".
+         */
+        csa->prob.spu_runcntl_RW = in_be32(&prob->spu_runcntl_RW);
+}
+
+static inline void save_mfc_sr1(struct spu_state *csa, struct spu *spu)
+{
+        /* Save, Step 10:
+         *     Save MFC_SR1 in the CSA.
+         */
+        csa->priv1.mfc_sr1_RW = spu_mfc_sr1_get(spu);
+}
+
+static inline void save_spu_status(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Save, Step 11:
+         *     Read SPU_Status[R], and save to CSA.
+         */
+        if ((in_be32(&prob->spu_status_R) & SPU_STATUS_RUNNING) == 0) {
+                csa->prob.spu_status_R = in_be32(&prob->spu_status_R);
+        } else {
+                u32 stopped;
+
+                out_be32(&prob->spu_runcntl_RW, SPU_RUNCNTL_STOP);
+                eieio();
+                POLL_WHILE_TRUE(in_be32(&prob->spu_status_R) &
+                                SPU_STATUS_RUNNING);
+                stopped =
+                    SPU_STATUS_INVALID_INSTR | SPU_STATUS_SINGLE_STEP |
+                    SPU_STATUS_STOPPED_BY_HALT | SPU_STATUS_STOPPED_BY_STOP;
+                if ((in_be32(&prob->spu_status_R) & stopped) == 0)
+                        csa->prob.spu_status_R = SPU_STATUS_RUNNING;
+                else
+                        csa->prob.spu_status_R = in_be32(&prob->spu_status_R);
+        }
+}
+
+static inline void save_mfc_decr(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 12:
+         *     Read MFC_CNTL[Ds].  Update saved copy of
+         *     CSA.MFC_CNTL[Ds].
+         */
+        if (in_be64(&priv2->mfc_control_RW) & MFC_CNTL_DECREMENTER_RUNNING) {
+                csa->priv2.mfc_control_RW |= MFC_CNTL_DECREMENTER_RUNNING;
+                csa->suspend_time = get_cycles();
+                out_be64(&priv2->spu_chnlcntptr_RW, 7ULL);
+                eieio();
+                csa->spu_chnldata_RW[7] = in_be64(&priv2->spu_chnldata_RW);
+                eieio();
+        }
+}
+
+static inline void halt_mfc_decr(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 13:
+         *     Write MFC_CNTL[Dh] set to a '1' to halt
+         *     the decrementer.
+         */
+        out_be64(&priv2->mfc_control_RW, MFC_CNTL_DECREMENTER_HALTED);
+        eieio();
+}
+
+static inline void save_timebase(struct spu_state *csa, struct spu *spu)
+{
+        /* Save, Step 14:
+         *    Read PPE Timebase High and Timebase low registers
+         *    and save in CSA.  TBD.
+         */
+        csa->suspend_time = get_cycles();
+}
+
+static inline void remove_other_spu_access(struct spu_state *csa,
+                                           struct spu *spu)
+{
+        /* Save, Step 15:
+         *     Remove other SPU access to this SPU by unmapping
+         *     this SPU's pages from their address space.  TBD.
+         */
+}
+
+static inline void do_mfc_mssync(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Save, Step 16:
+         * Restore, Step 11.
+         *     Write SPU_MSSync register. Poll SPU_MSSync[P]
+         *     for a value of 0.
+         */
+        out_be64(&prob->spc_mssync_RW, 1UL);
+        POLL_WHILE_TRUE(in_be64(&prob->spc_mssync_RW) & MS_SYNC_PENDING);
+}
+
+static inline void issue_mfc_tlbie(struct spu_state *csa, struct spu *spu)
+{
+        /* Save, Step 17:
+         * Restore, Step 12.
+         * Restore, Step 48.
+         *     Write TLB_Invalidate_Entry[IS,VPN,L,Lp]=0 register.
+         *     Then issue a PPE sync instruction.
+         */
+        spu_tlb_invalidate(spu);
+        mb();
+}
+
+static inline void handle_pending_interrupts(struct spu_state *csa,
+                                             struct spu *spu)
+{
+        /* Save, Step 18:
+         *     Handle any pending interrupts from this SPU
+         *     here.  This is OS or hypervisor specific.  One
+         *     option is to re-enable interrupts to handle any
+         *     pending interrupts, with the interrupt handlers
+         *     recognizing the software Context Switch Pending
+         *     flag, to ensure the SPU execution or MFC command
+         *     queue is not restarted.  TBD.
+         */
+}
+
+static inline void save_mfc_queues(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        int i;
+
+        /* Save, Step 19:
+         *     If MFC_Cntl[Se]=0 then save
+         *     MFC command queues.
+         */
+        if ((in_be64(&priv2->mfc_control_RW) & MFC_CNTL_DMA_QUEUES_EMPTY) == 0) {
+                for (i = 0; i < 8; i++) {
+                        csa->priv2.puq[i].mfc_cq_data0_RW =
+                            in_be64(&priv2->puq[i].mfc_cq_data0_RW);
+                        csa->priv2.puq[i].mfc_cq_data1_RW =
+                            in_be64(&priv2->puq[i].mfc_cq_data1_RW);
+                        csa->priv2.puq[i].mfc_cq_data2_RW =
+                            in_be64(&priv2->puq[i].mfc_cq_data2_RW);
+                        csa->priv2.puq[i].mfc_cq_data3_RW =
+                            in_be64(&priv2->puq[i].mfc_cq_data3_RW);
+                }
+                for (i = 0; i < 16; i++) {
+                        csa->priv2.spuq[i].mfc_cq_data0_RW =
+                            in_be64(&priv2->spuq[i].mfc_cq_data0_RW);
+                        csa->priv2.spuq[i].mfc_cq_data1_RW =
+                            in_be64(&priv2->spuq[i].mfc_cq_data1_RW);
+                        csa->priv2.spuq[i].mfc_cq_data2_RW =
+                            in_be64(&priv2->spuq[i].mfc_cq_data2_RW);
+                        csa->priv2.spuq[i].mfc_cq_data3_RW =
+                            in_be64(&priv2->spuq[i].mfc_cq_data3_RW);
+                }
+        }
+}
+
+static inline void save_ppu_querymask(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Save, Step 20:
+         *     Save the PPU_QueryMask register
+         *     in the CSA.
+         */
+        csa->prob.dma_querymask_RW = in_be32(&prob->dma_querymask_RW);
+}
+
+static inline void save_ppu_querytype(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Save, Step 21:
+         *     Save the PPU_QueryType register
+         *     in the CSA.
+         */
+        csa->prob.dma_querytype_RW = in_be32(&prob->dma_querytype_RW);
+}
+
+static inline void save_mfc_csr_tsq(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 22:
+         *     Save the MFC_CSR_TSQ register
+         *     in the LSCSA.
+         */
+        csa->priv2.spu_tag_status_query_RW =
+            in_be64(&priv2->spu_tag_status_query_RW);
+}
+
+static inline void save_mfc_csr_cmd(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 23:
+         *     Save the MFC_CSR_CMD1 and MFC_CSR_CMD2
+         *     registers in the CSA.
+         */
+        csa->priv2.spu_cmd_buf1_RW = in_be64(&priv2->spu_cmd_buf1_RW);
+        csa->priv2.spu_cmd_buf2_RW = in_be64(&priv2->spu_cmd_buf2_RW);
+}
+
+static inline void save_mfc_csr_ato(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 24:
+         *     Save the MFC_CSR_ATO register in
+         *     the CSA.
+         */
+        csa->priv2.spu_atomic_status_RW = in_be64(&priv2->spu_atomic_status_RW);
+}
+
+static inline void save_mfc_tclass_id(struct spu_state *csa, struct spu *spu)
+{
+        /* Save, Step 25:
+         *     Save the MFC_TCLASS_ID register in
+         *     the CSA.
+         */
+        csa->priv1.mfc_tclass_id_RW = spu_mfc_tclass_id_get(spu);
+}
+
+static inline void set_mfc_tclass_id(struct spu_state *csa, struct spu *spu)
+{
+        /* Save, Step 26:
+         * Restore, Step 23.
+         *     Write the MFC_TCLASS_ID register with
+         *     the value 0x10000000.
+         */
+        spu_mfc_tclass_id_set(spu, 0x10000000);
+        eieio();
+}
+
+static inline void purge_mfc_queue(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 27:
+         * Restore, Step 14.
+         *     Write MFC_CNTL[Pc]=1 (purge queue).
+         */
+        out_be64(&priv2->mfc_control_RW, MFC_CNTL_PURGE_DMA_REQUEST);
+        eieio();
+}
+
+static inline void wait_purge_complete(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 28:
+         *     Poll MFC_CNTL[Ps] until value '11' is read
+         *     (purge complete).
+         */
+        POLL_WHILE_FALSE(in_be64(&priv2->mfc_control_RW) &
+                         MFC_CNTL_PURGE_DMA_COMPLETE);
+}
+
+static inline void save_mfc_slbs(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        int i;
+
+        /* Save, Step 29:
+         *     If MFC_SR1[R]='1', save SLBs in CSA.
+         */
+        if (spu_mfc_sr1_get(spu) & MFC_STATE1_RELOCATE_MASK) {
+                csa->priv2.slb_index_W = in_be64(&priv2->slb_index_W);
+                for (i = 0; i < 8; i++) {
+                        out_be64(&priv2->slb_index_W, i);
+                        eieio();
+                        csa->slb_esid_RW[i] = in_be64(&priv2->slb_esid_RW);
+                        csa->slb_vsid_RW[i] = in_be64(&priv2->slb_vsid_RW);
+                        eieio();
+                }
+        }
+}
+
+static inline void setup_mfc_sr1(struct spu_state *csa, struct spu *spu)
+{
+        /* Save, Step 30:
+         * Restore, Step 18:
+         *     Write MFC_SR1 with MFC_SR1[D=0,S=1] and
+         *     MFC_SR1[TL,R,Pr,T] set correctly for the
+         *     OS specific environment.
+         *
+         *     Implementation note: The SPU-side code
+         *     for save/restore is privileged, so the
+         *     MFC_SR1[Pr] bit is not set.
+         *
+         */
+        spu_mfc_sr1_set(spu, (MFC_STATE1_MASTER_RUN_CONTROL_MASK |
+                              MFC_STATE1_RELOCATE_MASK |
+                              MFC_STATE1_BUS_TLBIE_MASK));
+}
+
+static inline void save_spu_npc(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Save, Step 31:
+         *     Save SPU_NPC in the CSA.
+         */
+        csa->prob.spu_npc_RW = in_be32(&prob->spu_npc_RW);
+}
+
+static inline void save_spu_privcntl(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 32:
+         *     Save SPU_PrivCntl in the CSA.
+         */
+        csa->priv2.spu_privcntl_RW = in_be64(&priv2->spu_privcntl_RW);
+}
+
+static inline void reset_spu_privcntl(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 33:
+         * Restore, Step 16:
+         *     Write SPU_PrivCntl[S,Le,A] fields reset to 0.
+         */
+        out_be64(&priv2->spu_privcntl_RW, 0UL);
+        eieio();
+}
+
+static inline void save_spu_lslr(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 34:
+         *     Save SPU_LSLR in the CSA.
+         */
+        csa->priv2.spu_lslr_RW = in_be64(&priv2->spu_lslr_RW);
+}
+
+static inline void reset_spu_lslr(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 35:
+         * Restore, Step 17.
+         *     Reset SPU_LSLR.
+         */
+        out_be64(&priv2->spu_lslr_RW, LS_ADDR_MASK);
+        eieio();
+}
+
+static inline void save_spu_cfg(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 36:
+         *     Save SPU_Cfg in the CSA.
+         */
+        csa->priv2.spu_cfg_RW = in_be64(&priv2->spu_cfg_RW);
+}
+
+static inline void save_pm_trace(struct spu_state *csa, struct spu *spu)
+{
+        /* Save, Step 37:
+         *     Save PM_Trace_Tag_Wait_Mask in the CSA.
+         *     Not performed by this implementation.
+         */
+}
+
+static inline void save_mfc_rag(struct spu_state *csa, struct spu *spu)
+{
+        /* Save, Step 38:
+         *     Save RA_GROUP_ID register and the
+         *     RA_ENABLE reigster in the CSA.
+         */
+        csa->priv1.resource_allocation_groupID_RW =
+                spu_resource_allocation_groupID_get(spu);
+        csa->priv1.resource_allocation_enable_RW =
+                spu_resource_allocation_enable_get(spu);
+}
+
+static inline void save_ppu_mb_stat(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Save, Step 39:
+         *     Save MB_Stat register in the CSA.
+         */
+        csa->prob.mb_stat_R = in_be32(&prob->mb_stat_R);
+}
+
+static inline void save_ppu_mb(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Save, Step 40:
+         *     Save the PPU_MB register in the CSA.
+         */
+        csa->prob.pu_mb_R = in_be32(&prob->pu_mb_R);
+}
+
+static inline void save_ppuint_mb(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 41:
+         *     Save the PPUINT_MB register in the CSA.
+         */
+        csa->priv2.puint_mb_R = in_be64(&priv2->puint_mb_R);
+}
+
+static inline void save_ch_part1(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        u64 idx, ch_indices[7] = { 0UL, 1UL, 3UL, 4UL, 24UL, 25UL, 27UL };
+        int i;
+
+        /* Save, Step 42:
+         *     Save the following CH: [0,1,3,4,24,25,27]
+         */
+        for (i = 0; i < 7; i++) {
+                idx = ch_indices[i];
+                out_be64(&priv2->spu_chnlcntptr_RW, idx);
+                eieio();
+                csa->spu_chnldata_RW[idx] = in_be64(&priv2->spu_chnldata_RW);
+                csa->spu_chnlcnt_RW[idx] = in_be64(&priv2->spu_chnlcnt_RW);
+                out_be64(&priv2->spu_chnldata_RW, 0UL);
+                out_be64(&priv2->spu_chnlcnt_RW, 0UL);
+                eieio();
+        }
+}
+
+static inline void save_spu_mb(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        int i;
+
+        /* Save, Step 43:
+         *     Save SPU Read Mailbox Channel.
+         */
+        out_be64(&priv2->spu_chnlcntptr_RW, 29UL);
+        eieio();
+        csa->spu_chnlcnt_RW[29] = in_be64(&priv2->spu_chnlcnt_RW);
+        for (i = 0; i < 4; i++) {
+                csa->spu_mailbox_data[i] = in_be64(&priv2->spu_chnldata_RW);
+        }
+        out_be64(&priv2->spu_chnlcnt_RW, 0UL);
+        eieio();
+}
+
+static inline void save_mfc_cmd(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 44:
+         *     Save MFC_CMD Channel.
+         */
+        out_be64(&priv2->spu_chnlcntptr_RW, 21UL);
+        eieio();
+        csa->spu_chnlcnt_RW[21] = in_be64(&priv2->spu_chnlcnt_RW);
+        eieio();
+}
+
+static inline void reset_ch(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        u64 ch_indices[4] = { 21UL, 23UL, 28UL, 30UL };
+        u64 ch_counts[4] = { 16UL, 1UL, 1UL, 1UL };
+        u64 idx;
+        int i;
+
+        /* Save, Step 45:
+         *     Reset the following CH: [21, 23, 28, 30]
+         */
+        for (i = 0; i < 4; i++) {
+                idx = ch_indices[i];
+                out_be64(&priv2->spu_chnlcntptr_RW, idx);
+                eieio();
+                out_be64(&priv2->spu_chnlcnt_RW, ch_counts[i]);
+                eieio();
+        }
+}
+
+static inline void resume_mfc_queue(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 46:
+         * Restore, Step 25.
+         *     Write MFC_CNTL[Sc]=0 (resume queue processing).
+         */
+        out_be64(&priv2->mfc_control_RW, MFC_CNTL_RESUME_DMA_QUEUE);
+}
+
+static inline void invalidate_slbs(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Save, Step 45:
+         * Restore, Step 19:
+         *     If MFC_SR1[R]=1, write 0 to SLB_Invalidate_All.
+         */
+        if (spu_mfc_sr1_get(spu) & MFC_STATE1_RELOCATE_MASK) {
+                out_be64(&priv2->slb_invalidate_all_W, 0UL);
+                eieio();
+        }
+}
+
+static inline void get_kernel_slb(u64 ea, u64 slb[2])
+{
+        slb[0] = (get_kernel_vsid(ea) << SLB_VSID_SHIFT) | SLB_VSID_KERNEL;
+        slb[1] = (ea & ESID_MASK) | SLB_ESID_V;
+
+        /* Large pages are used for kernel text/data, but not vmalloc.  */
+        if (cpu_has_feature(CPU_FTR_16M_PAGE)
+            && REGION_ID(ea) == KERNEL_REGION_ID)
+                slb[0] |= SLB_VSID_L;
+}
+
+static inline void load_mfc_slb(struct spu *spu, u64 slb[2], int slbe)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        out_be64(&priv2->slb_index_W, slbe);
+        eieio();
+        out_be64(&priv2->slb_vsid_RW, slb[0]);
+        out_be64(&priv2->slb_esid_RW, slb[1]);
+        eieio();
+}
+
+static inline void setup_mfc_slbs(struct spu_state *csa, struct spu *spu)
+{
+        u64 code_slb[2];
+        u64 lscsa_slb[2];
+
+        /* Save, Step 47:
+         * Restore, Step 30.
+         *     If MFC_SR1[R]=1, write 0 to SLB_Invalidate_All
+         *     register, then initialize SLB_VSID and SLB_ESID
+         *     to provide access to SPU context save code and
+         *     LSCSA.
+         *
+         *     This implementation places both the context
+         *     switch code and LSCSA in kernel address space.
+         *
+         *     Further this implementation assumes that the
+         *     MFC_SR1[R]=1 (in other words, assume that
+         *     translation is desired by OS environment).
+         */
+        invalidate_slbs(csa, spu);
+        get_kernel_slb((unsigned long)&spu_save_code[0], code_slb);
+        get_kernel_slb((unsigned long)csa->lscsa, lscsa_slb);
+        load_mfc_slb(spu, code_slb, 0);
+        if ((lscsa_slb[0] != code_slb[0]) || (lscsa_slb[1] != code_slb[1]))
+                load_mfc_slb(spu, lscsa_slb, 1);
+}
+
+static inline void set_switch_active(struct spu_state *csa, struct spu *spu)
+{
+        /* Save, Step 48:
+         * Restore, Step 23.
+         *     Change the software context switch pending flag
+         *     to context switch active.
+         */
+        set_bit(SPU_CONTEXT_SWITCH_ACTIVE, &spu->flags);
+        clear_bit(SPU_CONTEXT_SWITCH_PENDING, &spu->flags);
+        mb();
+}
+
+static inline void enable_interrupts(struct spu_state *csa, struct spu *spu)
+{
+        unsigned long class1_mask = CLASS1_ENABLE_SEGMENT_FAULT_INTR |
+            CLASS1_ENABLE_STORAGE_FAULT_INTR;
+
+        /* Save, Step 49:
+         * Restore, Step 22:
+         *     Reset and then enable interrupts, as
+         *     needed by OS.
+         *
+         *     This implementation enables only class1
+         *     (translation) interrupts.
+         */
+        spin_lock_irq(&spu->register_lock);
+        spu_int_stat_clear(spu, 0, ~0ul);
+        spu_int_stat_clear(spu, 1, ~0ul);
+        spu_int_stat_clear(spu, 2, ~0ul);
+        spu_int_mask_set(spu, 0, 0ul);
+        spu_int_mask_set(spu, 1, class1_mask);
+        spu_int_mask_set(spu, 2, 0ul);
+        spin_unlock_irq(&spu->register_lock);
+}
+
+static inline int send_mfc_dma(struct spu *spu, unsigned long ea,
+                               unsigned int ls_offset, unsigned int size,
+                               unsigned int tag, unsigned int rclass,
+                               unsigned int cmd)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+        union mfc_tag_size_class_cmd command;
+        unsigned int transfer_size;
+        volatile unsigned int status = 0x0;
+
+        while (size > 0) {
+                transfer_size =
+                    (size > MFC_MAX_DMA_SIZE) ? MFC_MAX_DMA_SIZE : size;
+                command.u.mfc_size = transfer_size;
+                command.u.mfc_tag = tag;
+                command.u.mfc_rclassid = rclass;
+                command.u.mfc_cmd = cmd;
+                do {
+                        out_be32(&prob->mfc_lsa_W, ls_offset);
+                        out_be64(&prob->mfc_ea_W, ea);
+                        out_be64(&prob->mfc_union_W.all64, command.all64);
+                        status =
+                            in_be32(&prob->mfc_union_W.by32.mfc_class_cmd32);
+                        if (unlikely(status & 0x2)) {
+                                cpu_relax();
+                        }
+                } while (status & 0x3);
+                size -= transfer_size;
+                ea += transfer_size;
+                ls_offset += transfer_size;
+        }
+        return 0;
+}
+
+static inline void save_ls_16kb(struct spu_state *csa, struct spu *spu)
+{
+        unsigned long addr = (unsigned long)&csa->lscsa->ls[0];
+        unsigned int ls_offset = 0x0;
+        unsigned int size = 16384;
+        unsigned int tag = 0;
+        unsigned int rclass = 0;
+        unsigned int cmd = MFC_PUT_CMD;
+
+        /* Save, Step 50:
+         *     Issue a DMA command to copy the first 16K bytes
+         *     of local storage to the CSA.
+         */
+        send_mfc_dma(spu, addr, ls_offset, size, tag, rclass, cmd);
+}
+
+static inline void set_spu_npc(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Save, Step 51:
+         * Restore, Step 31.
+         *     Write SPU_NPC[IE]=0 and SPU_NPC[LSA] to entry
+         *     point address of context save code in local
+         *     storage.
+         *
+         *     This implementation uses SPU-side save/restore
+         *     programs with entry points at LSA of 0.
+         */
+        out_be32(&prob->spu_npc_RW, 0);
+        eieio();
+}
+
+static inline void set_signot1(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+        union {
+                u64 ull;
+                u32 ui[2];
+        } addr64;
+
+        /* Save, Step 52:
+         * Restore, Step 32:
+         *    Write SPU_Sig_Notify_1 register with upper 32-bits
+         *    of the CSA.LSCSA effective address.
+         */
+        addr64.ull = (u64) csa->lscsa;
+        out_be32(&prob->signal_notify1, addr64.ui[0]);
+        eieio();
+}
+
+static inline void set_signot2(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+        union {
+                u64 ull;
+                u32 ui[2];
+        } addr64;
+
+        /* Save, Step 53:
+         * Restore, Step 33:
+         *    Write SPU_Sig_Notify_2 register with lower 32-bits
+         *    of the CSA.LSCSA effective address.
+         */
+        addr64.ull = (u64) csa->lscsa;
+        out_be32(&prob->signal_notify2, addr64.ui[1]);
+        eieio();
+}
+
+static inline void send_save_code(struct spu_state *csa, struct spu *spu)
+{
+        unsigned long addr = (unsigned long)&spu_save_code[0];
+        unsigned int ls_offset = 0x0;
+        unsigned int size = sizeof(spu_save_code);
+        unsigned int tag = 0;
+        unsigned int rclass = 0;
+        unsigned int cmd = MFC_GETFS_CMD;
+
+        /* Save, Step 54:
+         *     Issue a DMA command to copy context save code
+         *     to local storage and start SPU.
+         */
+        send_mfc_dma(spu, addr, ls_offset, size, tag, rclass, cmd);
+}
+
+static inline void set_ppu_querymask(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Save, Step 55:
+         * Restore, Step 38.
+         *     Write PPU_QueryMask=1 (enable Tag Group 0)
+         *     and issue eieio instruction.
+         */
+        out_be32(&prob->dma_querymask_RW, MFC_TAGID_TO_TAGMASK(0));
+        eieio();
+}
+
+static inline void wait_tag_complete(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+        u32 mask = MFC_TAGID_TO_TAGMASK(0);
+        unsigned long flags;
+
+        /* Save, Step 56:
+         * Restore, Step 39.
+         * Restore, Step 39.
+         * Restore, Step 46.
+         *     Poll PPU_TagStatus[gn] until 01 (Tag group 0 complete)
+         *     or write PPU_QueryType[TS]=01 and wait for Tag Group
+         *     Complete Interrupt.  Write INT_Stat_Class0 or
+         *     INT_Stat_Class2 with value of 'handled'.
+         */
+        POLL_WHILE_FALSE(in_be32(&prob->dma_tagstatus_R) & mask);
+
+        local_irq_save(flags);
+        spu_int_stat_clear(spu, 0, ~(0ul));
+        spu_int_stat_clear(spu, 2, ~(0ul));
+        local_irq_restore(flags);
+}
+
+static inline void wait_spu_stopped(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+        unsigned long flags;
+
+        /* Save, Step 57:
+         * Restore, Step 40.
+         *     Poll until SPU_Status[R]=0 or wait for SPU Class 0
+         *     or SPU Class 2 interrupt.  Write INT_Stat_class0
+         *     or INT_Stat_class2 with value of handled.
+         */
+        POLL_WHILE_TRUE(in_be32(&prob->spu_status_R) & SPU_STATUS_RUNNING);
+
+        local_irq_save(flags);
+        spu_int_stat_clear(spu, 0, ~(0ul));
+        spu_int_stat_clear(spu, 2, ~(0ul));
+        local_irq_restore(flags);
+}
+
+static inline int check_save_status(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+        u32 complete;
+
+        /* Save, Step 54:
+         *     If SPU_Status[P]=1 and SPU_Status[SC] = "success",
+         *     context save succeeded, otherwise context save
+         *     failed.
+         */
+        complete = ((SPU_SAVE_COMPLETE << SPU_STOP_STATUS_SHIFT) |
+                    SPU_STATUS_STOPPED_BY_STOP);
+        return (in_be32(&prob->spu_status_R) != complete) ? 1 : 0;
+}
+
+static inline void terminate_spu_app(struct spu_state *csa, struct spu *spu)
+{
+        /* Restore, Step 4:
+         *    If required, notify the "using application" that
+         *    the SPU task has been terminated.  TBD.
+         */
+}
+
+static inline void suspend_mfc(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Restore, Step 7:
+         * Restore, Step 47.
+         *     Write MFC_Cntl[Dh,Sc]='1','1' to suspend
+         *     the queue and halt the decrementer.
+         */
+        out_be64(&priv2->mfc_control_RW, MFC_CNTL_SUSPEND_DMA_QUEUE |
+                 MFC_CNTL_DECREMENTER_HALTED);
+        eieio();
+}
+
+static inline void wait_suspend_mfc_complete(struct spu_state *csa,
+                                             struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Restore, Step 8:
+         * Restore, Step 47.
+         *     Poll MFC_CNTL[Ss] until 11 is returned.
+         */
+        POLL_WHILE_FALSE(in_be64(&priv2->mfc_control_RW) &
+                         MFC_CNTL_SUSPEND_COMPLETE);
+}
+
+static inline int suspend_spe(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Restore, Step 9:
+         *    If SPU_Status[R]=1, stop SPU execution
+         *    and wait for stop to complete.
+         *
+         *    Returns       1 if SPU_Status[R]=1 on entry.
+         *                  0 otherwise
+         */
+        if (in_be32(&prob->spu_status_R) & SPU_STATUS_RUNNING) {
+                if (in_be32(&prob->spu_status_R) &
+                    SPU_STATUS_ISOLATED_EXIT_STAUTUS) {
+                        POLL_WHILE_TRUE(in_be32(&prob->spu_status_R) &
+                                        SPU_STATUS_RUNNING);
+                }
+                if ((in_be32(&prob->spu_status_R) &
+                     SPU_STATUS_ISOLATED_LOAD_STAUTUS)
+                    || (in_be32(&prob->spu_status_R) &
+                        SPU_STATUS_ISOLATED_STATE)) {
+                        out_be32(&prob->spu_runcntl_RW, SPU_RUNCNTL_STOP);
+                        eieio();
+                        POLL_WHILE_TRUE(in_be32(&prob->spu_status_R) &
+                                        SPU_STATUS_RUNNING);
+                        out_be32(&prob->spu_runcntl_RW, 0x2);
+                        eieio();
+                        POLL_WHILE_TRUE(in_be32(&prob->spu_status_R) &
+                                        SPU_STATUS_RUNNING);
+                }
+                if (in_be32(&prob->spu_status_R) &
+                    SPU_STATUS_WAITING_FOR_CHANNEL) {
+                        out_be32(&prob->spu_runcntl_RW, SPU_RUNCNTL_STOP);
+                        eieio();
+                        POLL_WHILE_TRUE(in_be32(&prob->spu_status_R) &
+                                        SPU_STATUS_RUNNING);
+                }
+                return 1;
+        }
+        return 0;
+}
+
+static inline void clear_spu_status(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Restore, Step 10:
+         *    If SPU_Status[R]=0 and SPU_Status[E,L,IS]=1,
+         *    release SPU from isolate state.
+         */
+        if (!(in_be32(&prob->spu_status_R) & SPU_STATUS_RUNNING)) {
+                if (in_be32(&prob->spu_status_R) &
+                    SPU_STATUS_ISOLATED_EXIT_STAUTUS) {
+                        spu_mfc_sr1_set(spu,
+                                        MFC_STATE1_MASTER_RUN_CONTROL_MASK);
+                        eieio();
+                        out_be32(&prob->spu_runcntl_RW, SPU_RUNCNTL_RUNNABLE);
+                        eieio();
+                        POLL_WHILE_TRUE(in_be32(&prob->spu_status_R) &
+                                        SPU_STATUS_RUNNING);
+                }
+                if ((in_be32(&prob->spu_status_R) &
+                     SPU_STATUS_ISOLATED_LOAD_STAUTUS)
+                    || (in_be32(&prob->spu_status_R) &
+                        SPU_STATUS_ISOLATED_STATE)) {
+                        spu_mfc_sr1_set(spu,
+                                        MFC_STATE1_MASTER_RUN_CONTROL_MASK);
+                        eieio();
+                        out_be32(&prob->spu_runcntl_RW, 0x2);
+                        eieio();
+                        POLL_WHILE_TRUE(in_be32(&prob->spu_status_R) &
+                                        SPU_STATUS_RUNNING);
+                }
+        }
+}
+
+static inline void reset_ch_part1(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        u64 ch_indices[7] = { 0UL, 1UL, 3UL, 4UL, 24UL, 25UL, 27UL };
+        u64 idx;
+        int i;
+
+        /* Restore, Step 20:
+         *     Reset the following CH: [0,1,3,4,24,25,27]
+         */
+        for (i = 0; i < 7; i++) {
+                idx = ch_indices[i];
+                out_be64(&priv2->spu_chnlcntptr_RW, idx);
+                eieio();
+                out_be64(&priv2->spu_chnldata_RW, 0UL);
+                out_be64(&priv2->spu_chnlcnt_RW, 0UL);
+                eieio();
+        }
+}
+
+static inline void reset_ch_part2(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        u64 ch_indices[5] = { 21UL, 23UL, 28UL, 29UL, 30UL };
+        u64 ch_counts[5] = { 16UL, 1UL, 1UL, 0UL, 1UL };
+        u64 idx;
+        int i;
+
+        /* Restore, Step 21:
+         *     Reset the following CH: [21, 23, 28, 29, 30]
+         */
+        for (i = 0; i < 5; i++) {
+                idx = ch_indices[i];
+                out_be64(&priv2->spu_chnlcntptr_RW, idx);
+                eieio();
+                out_be64(&priv2->spu_chnlcnt_RW, ch_counts[i]);
+                eieio();
+        }
+}
+
+static inline void setup_spu_status_part1(struct spu_state *csa,
+                                          struct spu *spu)
+{
+        u32 status_P = SPU_STATUS_STOPPED_BY_STOP;
+        u32 status_I = SPU_STATUS_INVALID_INSTR;
+        u32 status_H = SPU_STATUS_STOPPED_BY_HALT;
+        u32 status_S = SPU_STATUS_SINGLE_STEP;
+        u32 status_S_I = SPU_STATUS_SINGLE_STEP | SPU_STATUS_INVALID_INSTR;
+        u32 status_S_P = SPU_STATUS_SINGLE_STEP | SPU_STATUS_STOPPED_BY_STOP;
+        u32 status_P_H = SPU_STATUS_STOPPED_BY_HALT |SPU_STATUS_STOPPED_BY_STOP;
+        u32 status_P_I = SPU_STATUS_STOPPED_BY_STOP |SPU_STATUS_INVALID_INSTR;
+        u32 status_code;
+
+        /* Restore, Step 27:
+         *     If the CSA.SPU_Status[I,S,H,P]=1 then add the correct
+         *     instruction sequence to the end of the SPU based restore
+         *     code (after the "context restored" stop and signal) to
+         *     restore the correct SPU status.
+         *
+         *     NOTE: Rather than modifying the SPU executable, we
+         *     instead add a new 'stopped_status' field to the
+         *     LSCSA.  The SPU-side restore reads this field and
+         *     takes the appropriate action when exiting.
+         */
+
+        status_code =
+            (csa->prob.spu_status_R >> SPU_STOP_STATUS_SHIFT) & 0xFFFF;
+        if ((csa->prob.spu_status_R & status_P_I) == status_P_I) {
+
+                /* SPU_Status[P,I]=1 - Illegal Instruction followed
+                 * by Stop and Signal instruction, followed by 'br -4'.
+                 *
+                 */
+                csa->lscsa->stopped_status.slot[0] = SPU_STOPPED_STATUS_P_I;
+                csa->lscsa->stopped_status.slot[1] = status_code;
+
+        } else if ((csa->prob.spu_status_R & status_P_H) == status_P_H) {
+
+                /* SPU_Status[P,H]=1 - Halt Conditional, followed
+                 * by Stop and Signal instruction, followed by
+                 * 'br -4'.
+                 */
+                csa->lscsa->stopped_status.slot[0] = SPU_STOPPED_STATUS_P_H;
+                csa->lscsa->stopped_status.slot[1] = status_code;
+
+        } else if ((csa->prob.spu_status_R & status_S_P) == status_S_P) {
+
+                /* SPU_Status[S,P]=1 - Stop and Signal instruction
+                 * followed by 'br -4'.
+                 */
+                csa->lscsa->stopped_status.slot[0] = SPU_STOPPED_STATUS_S_P;
+                csa->lscsa->stopped_status.slot[1] = status_code;
+
+        } else if ((csa->prob.spu_status_R & status_S_I) == status_S_I) {
+
+                /* SPU_Status[S,I]=1 - Illegal instruction followed
+                 * by 'br -4'.
+                 */
+                csa->lscsa->stopped_status.slot[0] = SPU_STOPPED_STATUS_S_I;
+                csa->lscsa->stopped_status.slot[1] = status_code;
+
+        } else if ((csa->prob.spu_status_R & status_P) == status_P) {
+
+                /* SPU_Status[P]=1 - Stop and Signal instruction
+                 * followed by 'br -4'.
+                 */
+                csa->lscsa->stopped_status.slot[0] = SPU_STOPPED_STATUS_P;
+                csa->lscsa->stopped_status.slot[1] = status_code;
+
+        } else if ((csa->prob.spu_status_R & status_H) == status_H) {
+
+                /* SPU_Status[H]=1 - Halt Conditional, followed
+                 * by 'br -4'.
+                 */
+                csa->lscsa->stopped_status.slot[0] = SPU_STOPPED_STATUS_H;
+
+        } else if ((csa->prob.spu_status_R & status_S) == status_S) {
+
+                /* SPU_Status[S]=1 - Two nop instructions.
+                 */
+                csa->lscsa->stopped_status.slot[0] = SPU_STOPPED_STATUS_S;
+
+        } else if ((csa->prob.spu_status_R & status_I) == status_I) {
+
+                /* SPU_Status[I]=1 - Illegal instruction followed
+                 * by 'br -4'.
+                 */
+                csa->lscsa->stopped_status.slot[0] = SPU_STOPPED_STATUS_I;
+
+        }
+}
+
+static inline void setup_spu_status_part2(struct spu_state *csa,
+                                          struct spu *spu)
+{
+        u32 mask;
+
+        /* Restore, Step 28:
+         *     If the CSA.SPU_Status[I,S,H,P,R]=0 then
+         *     add a 'br *' instruction to the end of
+         *     the SPU based restore code.
+         *
+         *     NOTE: Rather than modifying the SPU executable, we
+         *     instead add a new 'stopped_status' field to the
+         *     LSCSA.  The SPU-side restore reads this field and
+         *     takes the appropriate action when exiting.
+         */
+        mask = SPU_STATUS_INVALID_INSTR |
+            SPU_STATUS_SINGLE_STEP |
+            SPU_STATUS_STOPPED_BY_HALT |
+            SPU_STATUS_STOPPED_BY_STOP | SPU_STATUS_RUNNING;
+        if (!(csa->prob.spu_status_R & mask)) {
+                csa->lscsa->stopped_status.slot[0] = SPU_STOPPED_STATUS_R;
+        }
+}
+
+static inline void restore_mfc_rag(struct spu_state *csa, struct spu *spu)
+{
+        /* Restore, Step 29:
+         *     Restore RA_GROUP_ID register and the
+         *     RA_ENABLE reigster from the CSA.
+         */
+        spu_resource_allocation_groupID_set(spu,
+                        csa->priv1.resource_allocation_groupID_RW);
+        spu_resource_allocation_enable_set(spu,
+                        csa->priv1.resource_allocation_enable_RW);
+}
+
+static inline void send_restore_code(struct spu_state *csa, struct spu *spu)
+{
+        unsigned long addr = (unsigned long)&spu_restore_code[0];
+        unsigned int ls_offset = 0x0;
+        unsigned int size = sizeof(spu_restore_code);
+        unsigned int tag = 0;
+        unsigned int rclass = 0;
+        unsigned int cmd = MFC_GETFS_CMD;
+
+        /* Restore, Step 37:
+         *     Issue MFC DMA command to copy context
+         *     restore code to local storage.
+         */
+        send_mfc_dma(spu, addr, ls_offset, size, tag, rclass, cmd);
+}
+
+static inline void setup_decr(struct spu_state *csa, struct spu *spu)
+{
+        /* Restore, Step 34:
+         *     If CSA.MFC_CNTL[Ds]=1 (decrementer was
+         *     running) then adjust decrementer, set
+         *     decrementer running status in LSCSA,
+         *     and set decrementer "wrapped" status
+         *     in LSCSA.
+         */
+        if (csa->priv2.mfc_control_RW & MFC_CNTL_DECREMENTER_RUNNING) {
+                cycles_t resume_time = get_cycles();
+                cycles_t delta_time = resume_time - csa->suspend_time;
+
+                csa->lscsa->decr.slot[0] = delta_time;
+        }
+}
+
+static inline void setup_ppu_mb(struct spu_state *csa, struct spu *spu)
+{
+        /* Restore, Step 35:
+         *     Copy the CSA.PU_MB data into the LSCSA.
+         */
+        csa->lscsa->ppu_mb.slot[0] = csa->prob.pu_mb_R;
+}
+
+static inline void setup_ppuint_mb(struct spu_state *csa, struct spu *spu)
+{
+        /* Restore, Step 36:
+         *     Copy the CSA.PUINT_MB data into the LSCSA.
+         */
+        csa->lscsa->ppuint_mb.slot[0] = csa->priv2.puint_mb_R;
+}
+
+static inline int check_restore_status(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+        u32 complete;
+
+        /* Restore, Step 40:
+         *     If SPU_Status[P]=1 and SPU_Status[SC] = "success",
+         *     context restore succeeded, otherwise context restore
+         *     failed.
+         */
+        complete = ((SPU_RESTORE_COMPLETE << SPU_STOP_STATUS_SHIFT) |
+                    SPU_STATUS_STOPPED_BY_STOP);
+        return (in_be32(&prob->spu_status_R) != complete) ? 1 : 0;
+}
+
+static inline void restore_spu_privcntl(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Restore, Step 41:
+         *     Restore SPU_PrivCntl from the CSA.
+         */
+        out_be64(&priv2->spu_privcntl_RW, csa->priv2.spu_privcntl_RW);
+        eieio();
+}
+
+static inline void restore_status_part1(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+        u32 mask;
+
+        /* Restore, Step 42:
+         *     If any CSA.SPU_Status[I,S,H,P]=1, then
+         *     restore the error or single step state.
+         */
+        mask = SPU_STATUS_INVALID_INSTR |
+            SPU_STATUS_SINGLE_STEP |
+            SPU_STATUS_STOPPED_BY_HALT | SPU_STATUS_STOPPED_BY_STOP;
+        if (csa->prob.spu_status_R & mask) {
+                out_be32(&prob->spu_runcntl_RW, SPU_RUNCNTL_RUNNABLE);
+                eieio();
+                POLL_WHILE_TRUE(in_be32(&prob->spu_status_R) &
+                                SPU_STATUS_RUNNING);
+        }
+}
+
+static inline void restore_status_part2(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+        u32 mask;
+
+        /* Restore, Step 43:
+         *     If all CSA.SPU_Status[I,S,H,P,R]=0 then write
+         *     SPU_RunCntl[R0R1]='01', wait for SPU_Status[R]=1,
+         *     then write '00' to SPU_RunCntl[R0R1] and wait
+         *     for SPU_Status[R]=0.
+         */
+        mask = SPU_STATUS_INVALID_INSTR |
+            SPU_STATUS_SINGLE_STEP |
+            SPU_STATUS_STOPPED_BY_HALT |
+            SPU_STATUS_STOPPED_BY_STOP | SPU_STATUS_RUNNING;
+        if (!(csa->prob.spu_status_R & mask)) {
+                out_be32(&prob->spu_runcntl_RW, SPU_RUNCNTL_RUNNABLE);
+                eieio();
+                POLL_WHILE_FALSE(in_be32(&prob->spu_status_R) &
+                                 SPU_STATUS_RUNNING);
+                out_be32(&prob->spu_runcntl_RW, SPU_RUNCNTL_STOP);
+                eieio();
+                POLL_WHILE_TRUE(in_be32(&prob->spu_status_R) &
+                                SPU_STATUS_RUNNING);
+        }
+}
+
+static inline void restore_ls_16kb(struct spu_state *csa, struct spu *spu)
+{
+        unsigned long addr = (unsigned long)&csa->lscsa->ls[0];
+        unsigned int ls_offset = 0x0;
+        unsigned int size = 16384;
+        unsigned int tag = 0;
+        unsigned int rclass = 0;
+        unsigned int cmd = MFC_GET_CMD;
+
+        /* Restore, Step 44:
+         *     Issue a DMA command to restore the first
+         *     16kb of local storage from CSA.
+         */
+        send_mfc_dma(spu, addr, ls_offset, size, tag, rclass, cmd);
+}
+
+static inline void clear_interrupts(struct spu_state *csa, struct spu *spu)
+{
+        /* Restore, Step 49:
+         *     Write INT_MASK_class0 with value of 0.
+         *     Write INT_MASK_class1 with value of 0.
+         *     Write INT_MASK_class2 with value of 0.
+         *     Write INT_STAT_class0 with value of -1.
+         *     Write INT_STAT_class1 with value of -1.
+         *     Write INT_STAT_class2 with value of -1.
+         */
+        spin_lock_irq(&spu->register_lock);
+        spu_int_mask_set(spu, 0, 0ul);
+        spu_int_mask_set(spu, 1, 0ul);
+        spu_int_mask_set(spu, 2, 0ul);
+        spu_int_stat_clear(spu, 0, ~0ul);
+        spu_int_stat_clear(spu, 1, ~0ul);
+        spu_int_stat_clear(spu, 2, ~0ul);
+        spin_unlock_irq(&spu->register_lock);
+}
+
+static inline void restore_mfc_queues(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        int i;
+
+        /* Restore, Step 50:
+         *     If MFC_Cntl[Se]!=0 then restore
+         *     MFC command queues.
+         */
+        if ((csa->priv2.mfc_control_RW & MFC_CNTL_DMA_QUEUES_EMPTY_MASK) == 0) {
+                for (i = 0; i < 8; i++) {
+                        out_be64(&priv2->puq[i].mfc_cq_data0_RW,
+                                 csa->priv2.puq[i].mfc_cq_data0_RW);
+                        out_be64(&priv2->puq[i].mfc_cq_data1_RW,
+                                 csa->priv2.puq[i].mfc_cq_data1_RW);
+                        out_be64(&priv2->puq[i].mfc_cq_data2_RW,
+                                 csa->priv2.puq[i].mfc_cq_data2_RW);
+                        out_be64(&priv2->puq[i].mfc_cq_data3_RW,
+                                 csa->priv2.puq[i].mfc_cq_data3_RW);
+                }
+                for (i = 0; i < 16; i++) {
+                        out_be64(&priv2->spuq[i].mfc_cq_data0_RW,
+                                 csa->priv2.spuq[i].mfc_cq_data0_RW);
+                        out_be64(&priv2->spuq[i].mfc_cq_data1_RW,
+                                 csa->priv2.spuq[i].mfc_cq_data1_RW);
+                        out_be64(&priv2->spuq[i].mfc_cq_data2_RW,
+                                 csa->priv2.spuq[i].mfc_cq_data2_RW);
+                        out_be64(&priv2->spuq[i].mfc_cq_data3_RW,
+                                 csa->priv2.spuq[i].mfc_cq_data3_RW);
+                }
+        }
+        eieio();
+}
+
+static inline void restore_ppu_querymask(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Restore, Step 51:
+         *     Restore the PPU_QueryMask register from CSA.
+         */
+        out_be32(&prob->dma_querymask_RW, csa->prob.dma_querymask_RW);
+        eieio();
+}
+
+static inline void restore_ppu_querytype(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Restore, Step 52:
+         *     Restore the PPU_QueryType register from CSA.
+         */
+        out_be32(&prob->dma_querytype_RW, csa->prob.dma_querytype_RW);
+        eieio();
+}
+
+static inline void restore_mfc_csr_tsq(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Restore, Step 53:
+         *     Restore the MFC_CSR_TSQ register from CSA.
+         */
+        out_be64(&priv2->spu_tag_status_query_RW,
+                 csa->priv2.spu_tag_status_query_RW);
+        eieio();
+}
+
+static inline void restore_mfc_csr_cmd(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Restore, Step 54:
+         *     Restore the MFC_CSR_CMD1 and MFC_CSR_CMD2
+         *     registers from CSA.
+         */
+        out_be64(&priv2->spu_cmd_buf1_RW, csa->priv2.spu_cmd_buf1_RW);
+        out_be64(&priv2->spu_cmd_buf2_RW, csa->priv2.spu_cmd_buf2_RW);
+        eieio();
+}
+
+static inline void restore_mfc_csr_ato(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Restore, Step 55:
+         *     Restore the MFC_CSR_ATO register from CSA.
+         */
+        out_be64(&priv2->spu_atomic_status_RW, csa->priv2.spu_atomic_status_RW);
+}
+
+static inline void restore_mfc_tclass_id(struct spu_state *csa, struct spu *spu)
+{
+        /* Restore, Step 56:
+         *     Restore the MFC_TCLASS_ID register from CSA.
+         */
+        spu_mfc_tclass_id_set(spu, csa->priv1.mfc_tclass_id_RW);
+        eieio();
+}
+
+static inline void set_llr_event(struct spu_state *csa, struct spu *spu)
+{
+        u64 ch0_cnt, ch0_data;
+        u64 ch1_data;
+
+        /* Restore, Step 57:
+         *    Set the Lock Line Reservation Lost Event by:
+         *      1. OR CSA.SPU_Event_Status with bit 21 (Lr) set to 1.
+         *      2. If CSA.SPU_Channel_0_Count=0 and
+         *         CSA.SPU_Wr_Event_Mask[Lr]=1 and
+         *         CSA.SPU_Event_Status[Lr]=0 then set
+         *         CSA.SPU_Event_Status_Count=1.
+         */
+        ch0_cnt = csa->spu_chnlcnt_RW[0];
+        ch0_data = csa->spu_chnldata_RW[0];
+        ch1_data = csa->spu_chnldata_RW[1];
+        csa->spu_chnldata_RW[0] |= MFC_LLR_LOST_EVENT;
+        if ((ch0_cnt == 0) && !(ch0_data & MFC_LLR_LOST_EVENT) &&
+            (ch1_data & MFC_LLR_LOST_EVENT)) {
+                csa->spu_chnlcnt_RW[0] = 1;
+        }
+}
+
+static inline void restore_decr_wrapped(struct spu_state *csa, struct spu *spu)
+{
+        /* Restore, Step 58:
+         *     If the status of the CSA software decrementer
+         *     "wrapped" flag is set, OR in a '1' to
+         *     CSA.SPU_Event_Status[Tm].
+         */
+        if (csa->lscsa->decr_status.slot[0] == 1) {
+                csa->spu_chnldata_RW[0] |= 0x20;
+        }
+        if ((csa->lscsa->decr_status.slot[0] == 1) &&
+            (csa->spu_chnlcnt_RW[0] == 0 &&
+             ((csa->spu_chnldata_RW[2] & 0x20) == 0x0) &&
+             ((csa->spu_chnldata_RW[0] & 0x20) != 0x1))) {
+                csa->spu_chnlcnt_RW[0] = 1;
+        }
+}
+
+static inline void restore_ch_part1(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        u64 idx, ch_indices[7] = { 0UL, 1UL, 3UL, 4UL, 24UL, 25UL, 27UL };
+        int i;
+
+        /* Restore, Step 59:
+         *     Restore the following CH: [0,1,3,4,24,25,27]
+         */
+        for (i = 0; i < 7; i++) {
+                idx = ch_indices[i];
+                out_be64(&priv2->spu_chnlcntptr_RW, idx);
+                eieio();
+                out_be64(&priv2->spu_chnldata_RW, csa->spu_chnldata_RW[idx]);
+                out_be64(&priv2->spu_chnlcnt_RW, csa->spu_chnlcnt_RW[idx]);
+                eieio();
+        }
+}
+
+static inline void restore_ch_part2(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        u64 ch_indices[3] = { 9UL, 21UL, 23UL };
+        u64 ch_counts[3] = { 1UL, 16UL, 1UL };
+        u64 idx;
+        int i;
+
+        /* Restore, Step 60:
+         *     Restore the following CH: [9,21,23].
+         */
+        ch_counts[0] = 1UL;
+        ch_counts[1] = csa->spu_chnlcnt_RW[21];
+        ch_counts[2] = 1UL;
+        for (i = 0; i < 3; i++) {
+                idx = ch_indices[i];
+                out_be64(&priv2->spu_chnlcntptr_RW, idx);
+                eieio();
+                out_be64(&priv2->spu_chnlcnt_RW, ch_counts[i]);
+                eieio();
+        }
+}
+
+static inline void restore_spu_lslr(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Restore, Step 61:
+         *     Restore the SPU_LSLR register from CSA.
+         */
+        out_be64(&priv2->spu_lslr_RW, csa->priv2.spu_lslr_RW);
+        eieio();
+}
+
+static inline void restore_spu_cfg(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Restore, Step 62:
+         *     Restore the SPU_Cfg register from CSA.
+         */
+        out_be64(&priv2->spu_cfg_RW, csa->priv2.spu_cfg_RW);
+        eieio();
+}
+
+static inline void restore_pm_trace(struct spu_state *csa, struct spu *spu)
+{
+        /* Restore, Step 63:
+         *     Restore PM_Trace_Tag_Wait_Mask from CSA.
+         *     Not performed by this implementation.
+         */
+}
+
+static inline void restore_spu_npc(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Restore, Step 64:
+         *     Restore SPU_NPC from CSA.
+         */
+        out_be32(&prob->spu_npc_RW, csa->prob.spu_npc_RW);
+        eieio();
+}
+
+static inline void restore_spu_mb(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        int i;
+
+        /* Restore, Step 65:
+         *     Restore MFC_RdSPU_MB from CSA.
+         */
+        out_be64(&priv2->spu_chnlcntptr_RW, 29UL);
+        eieio();
+        out_be64(&priv2->spu_chnlcnt_RW, csa->spu_chnlcnt_RW[29]);
+        for (i = 0; i < 4; i++) {
+                out_be64(&priv2->spu_chnldata_RW, csa->spu_mailbox_data[i]);
+        }
+        eieio();
+}
+
+static inline void check_ppu_mb_stat(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+        u32 dummy = 0;
+
+        /* Restore, Step 66:
+         *     If CSA.MB_Stat[P]=0 (mailbox empty) then
+         *     read from the PPU_MB register.
+         */
+        if ((csa->prob.mb_stat_R & 0xFF) == 0) {
+                dummy = in_be32(&prob->pu_mb_R);
+                eieio();
+        }
+}
+
+static inline void check_ppuint_mb_stat(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        u64 dummy = 0UL;
+
+        /* Restore, Step 66:
+         *     If CSA.MB_Stat[I]=0 (mailbox empty) then
+         *     read from the PPUINT_MB register.
+         */
+        if ((csa->prob.mb_stat_R & 0xFF0000) == 0) {
+                dummy = in_be64(&priv2->puint_mb_R);
+                eieio();
+                spu_int_stat_clear(spu, 2, CLASS2_ENABLE_MAILBOX_INTR);
+                eieio();
+        }
+}
+
+static inline void restore_mfc_slbs(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+        int i;
+
+        /* Restore, Step 68:
+         *     If MFC_SR1[R]='1', restore SLBs from CSA.
+         */
+        if (csa->priv1.mfc_sr1_RW & MFC_STATE1_RELOCATE_MASK) {
+                for (i = 0; i < 8; i++) {
+                        out_be64(&priv2->slb_index_W, i);
+                        eieio();
+                        out_be64(&priv2->slb_esid_RW, csa->slb_esid_RW[i]);
+                        out_be64(&priv2->slb_vsid_RW, csa->slb_vsid_RW[i]);
+                        eieio();
+                }
+                out_be64(&priv2->slb_index_W, csa->priv2.slb_index_W);
+                eieio();
+        }
+}
+
+static inline void restore_mfc_sr1(struct spu_state *csa, struct spu *spu)
+{
+        /* Restore, Step 69:
+         *     Restore the MFC_SR1 register from CSA.
+         */
+        spu_mfc_sr1_set(spu, csa->priv1.mfc_sr1_RW);
+        eieio();
+}
+
+static inline void restore_other_spu_access(struct spu_state *csa,
+                                            struct spu *spu)
+{
+        /* Restore, Step 70:
+         *     Restore other SPU mappings to this SPU. TBD.
+         */
+}
+
+static inline void restore_spu_runcntl(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_problem __iomem *prob = spu->problem;
+
+        /* Restore, Step 71:
+         *     If CSA.SPU_Status[R]=1 then write
+         *     SPU_RunCntl[R0R1]='01'.
+         */
+        if (csa->prob.spu_status_R & SPU_STATUS_RUNNING) {
+                out_be32(&prob->spu_runcntl_RW, SPU_RUNCNTL_RUNNABLE);
+                eieio();
+        }
+}
+
+static inline void restore_mfc_cntl(struct spu_state *csa, struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        /* Restore, Step 72:
+         *    Restore the MFC_CNTL register for the CSA.
+         */
+        out_be64(&priv2->mfc_control_RW, csa->priv2.mfc_control_RW);
+        eieio();
+}
+
+static inline void enable_user_access(struct spu_state *csa, struct spu *spu)
+{
+        /* Restore, Step 73:
+         *     Enable user-space access (if provided) to this
+         *     SPU by mapping the virtual pages assigned to
+         *     the SPU memory-mapped I/O (MMIO) for problem
+         *     state. TBD.
+         */
+}
+
+static inline void reset_switch_active(struct spu_state *csa, struct spu *spu)
+{
+        /* Restore, Step 74:
+         *     Reset the "context switch active" flag.
+         */
+        clear_bit(SPU_CONTEXT_SWITCH_ACTIVE, &spu->flags);
+        mb();
+}
+
+static inline void reenable_interrupts(struct spu_state *csa, struct spu *spu)
+{
+        /* Restore, Step 75:
+         *     Re-enable SPU interrupts.
+         */
+        spin_lock_irq(&spu->register_lock);
+        spu_int_mask_set(spu, 0, csa->priv1.int_mask_class0_RW);
+        spu_int_mask_set(spu, 1, csa->priv1.int_mask_class1_RW);
+        spu_int_mask_set(spu, 2, csa->priv1.int_mask_class2_RW);
+        spin_unlock_irq(&spu->register_lock);
+}
+
+static int quiece_spu(struct spu_state *prev, struct spu *spu)
+{
+        /*
+         * Combined steps 2-18 of SPU context save sequence, which
+         * quiesce the SPU state (disable SPU execution, MFC command
+         * queues, decrementer, SPU interrupts, etc.).
+         *
+         * Returns      0 on success.
+         *              2 if failed step 2.
+         *              6 if failed step 6.
+         */
+
+        if (check_spu_isolate(prev, spu)) {     /* Step 2. */
+                return 2;
+        }
+        disable_interrupts(prev, spu);          /* Step 3. */
+        set_watchdog_timer(prev, spu);          /* Step 4. */
+        inhibit_user_access(prev, spu);         /* Step 5. */
+        if (check_spu_isolate(prev, spu)) {     /* Step 6. */
+                return 6;
+        }
+        set_switch_pending(prev, spu);          /* Step 7. */
+        save_mfc_cntl(prev, spu);               /* Step 8. */
+        save_spu_runcntl(prev, spu);            /* Step 9. */
+        save_mfc_sr1(prev, spu);                /* Step 10. */
+        save_spu_status(prev, spu);             /* Step 11. */
+        save_mfc_decr(prev, spu);               /* Step 12. */
+        halt_mfc_decr(prev, spu);               /* Step 13. */
+        save_timebase(prev, spu);               /* Step 14. */
+        remove_other_spu_access(prev, spu);     /* Step 15. */
+        do_mfc_mssync(prev, spu);               /* Step 16. */
+        issue_mfc_tlbie(prev, spu);             /* Step 17. */
+        handle_pending_interrupts(prev, spu);   /* Step 18. */
+
+        return 0;
+}
+
+static void save_csa(struct spu_state *prev, struct spu *spu)
+{
+        /*
+         * Combine steps 19-44 of SPU context save sequence, which
+         * save regions of the privileged & problem state areas.
+         */
+
+        save_mfc_queues(prev, spu);     /* Step 19. */
+        save_ppu_querymask(prev, spu);  /* Step 20. */
+        save_ppu_querytype(prev, spu);  /* Step 21. */
+        save_mfc_csr_tsq(prev, spu);    /* Step 22. */
+        save_mfc_csr_cmd(prev, spu);    /* Step 23. */
+        save_mfc_csr_ato(prev, spu);    /* Step 24. */
+        save_mfc_tclass_id(prev, spu);  /* Step 25. */
+        set_mfc_tclass_id(prev, spu);   /* Step 26. */
+        purge_mfc_queue(prev, spu);     /* Step 27. */
+        wait_purge_complete(prev, spu); /* Step 28. */
+        save_mfc_slbs(prev, spu);       /* Step 29. */
+        setup_mfc_sr1(prev, spu);       /* Step 30. */
+        save_spu_npc(prev, spu);        /* Step 31. */
+        save_spu_privcntl(prev, spu);   /* Step 32. */
+        reset_spu_privcntl(prev, spu);  /* Step 33. */
+        save_spu_lslr(prev, spu);       /* Step 34. */
+        reset_spu_lslr(prev, spu);      /* Step 35. */
+        save_spu_cfg(prev, spu);        /* Step 36. */
+        save_pm_trace(prev, spu);       /* Step 37. */
+        save_mfc_rag(prev, spu);        /* Step 38. */
+        save_ppu_mb_stat(prev, spu);    /* Step 39. */
+        save_ppu_mb(prev, spu);         /* Step 40. */
+        save_ppuint_mb(prev, spu);      /* Step 41. */
+        save_ch_part1(prev, spu);       /* Step 42. */
+        save_spu_mb(prev, spu);         /* Step 43. */
+        save_mfc_cmd(prev, spu);        /* Step 44. */
+        reset_ch(prev, spu);            /* Step 45. */
+}
+
+static void save_lscsa(struct spu_state *prev, struct spu *spu)
+{
+        /*
+         * Perform steps 46-57 of SPU context save sequence,
+         * which save regions of the local store and register
+         * file.
+         */
+
+        resume_mfc_queue(prev, spu);    /* Step 46. */
+        setup_mfc_slbs(prev, spu);      /* Step 47. */
+        set_switch_active(prev, spu);   /* Step 48. */
+        enable_interrupts(prev, spu);   /* Step 49. */
+        save_ls_16kb(prev, spu);        /* Step 50. */
+        set_spu_npc(prev, spu);         /* Step 51. */
+        set_signot1(prev, spu);         /* Step 52. */
+        set_signot2(prev, spu);         /* Step 53. */
+        send_save_code(prev, spu);      /* Step 54. */
+        set_ppu_querymask(prev, spu);   /* Step 55. */
+        wait_tag_complete(prev, spu);   /* Step 56. */
+        wait_spu_stopped(prev, spu);    /* Step 57. */
+}
+
+static void harvest(struct spu_state *prev, struct spu *spu)
+{
+        /*
+         * Perform steps 2-25 of SPU context restore sequence,
+         * which resets an SPU either after a failed save, or
+         * when using SPU for first time.
+         */
+
+        disable_interrupts(prev, spu);          /* Step 2.  */
+        inhibit_user_access(prev, spu);         /* Step 3.  */
+        terminate_spu_app(prev, spu);           /* Step 4.  */
+        set_switch_pending(prev, spu);          /* Step 5.  */
+        remove_other_spu_access(prev, spu);     /* Step 6.  */
+        suspend_mfc(prev, spu);                 /* Step 7.  */
+        wait_suspend_mfc_complete(prev, spu);   /* Step 8.  */
+        if (!suspend_spe(prev, spu))            /* Step 9.  */
+                clear_spu_status(prev, spu);    /* Step 10. */
+        do_mfc_mssync(prev, spu);               /* Step 11. */
+        issue_mfc_tlbie(prev, spu);             /* Step 12. */
+        handle_pending_interrupts(prev, spu);   /* Step 13. */
+        purge_mfc_queue(prev, spu);             /* Step 14. */
+        wait_purge_complete(prev, spu);         /* Step 15. */
+        reset_spu_privcntl(prev, spu);          /* Step 16. */
+        reset_spu_lslr(prev, spu);              /* Step 17. */
+        setup_mfc_sr1(prev, spu);               /* Step 18. */
+        invalidate_slbs(prev, spu);             /* Step 19. */
+        reset_ch_part1(prev, spu);              /* Step 20. */
+        reset_ch_part2(prev, spu);              /* Step 21. */
+        enable_interrupts(prev, spu);           /* Step 22. */
+        set_switch_active(prev, spu);           /* Step 23. */
+        set_mfc_tclass_id(prev, spu);           /* Step 24. */
+        resume_mfc_queue(prev, spu);            /* Step 25. */
+}
+
+static void restore_lscsa(struct spu_state *next, struct spu *spu)
+{
+        /*
+         * Perform steps 26-40 of SPU context restore sequence,
+         * which restores regions of the local store and register
+         * file.
+         */
+
+        set_watchdog_timer(next, spu);          /* Step 26. */
+        setup_spu_status_part1(next, spu);      /* Step 27. */
+        setup_spu_status_part2(next, spu);      /* Step 28. */
+        restore_mfc_rag(next, spu);             /* Step 29. */
+        setup_mfc_slbs(next, spu);              /* Step 30. */
+        set_spu_npc(next, spu);                 /* Step 31. */
+        set_signot1(next, spu);                 /* Step 32. */
+        set_signot2(next, spu);                 /* Step 33. */
+        setup_decr(next, spu);                  /* Step 34. */
+        setup_ppu_mb(next, spu);                /* Step 35. */
+        setup_ppuint_mb(next, spu);             /* Step 36. */
+        send_restore_code(next, spu);           /* Step 37. */
+        set_ppu_querymask(next, spu);           /* Step 38. */
+        wait_tag_complete(next, spu);           /* Step 39. */
+        wait_spu_stopped(next, spu);            /* Step 40. */
+}
+
+static void restore_csa(struct spu_state *next, struct spu *spu)
+{
+        /*
+         * Combine steps 41-76 of SPU context restore sequence, which
+         * restore regions of the privileged & problem state areas.
+         */
+
+        restore_spu_privcntl(next, spu);        /* Step 41. */
+        restore_status_part1(next, spu);        /* Step 42. */
+        restore_status_part2(next, spu);        /* Step 43. */
+        restore_ls_16kb(next, spu);             /* Step 44. */
+        wait_tag_complete(next, spu);           /* Step 45. */
+        suspend_mfc(next, spu);                 /* Step 46. */
+        wait_suspend_mfc_complete(next, spu);   /* Step 47. */
+        issue_mfc_tlbie(next, spu);             /* Step 48. */
+        clear_interrupts(next, spu);            /* Step 49. */
+        restore_mfc_queues(next, spu);          /* Step 50. */
+        restore_ppu_querymask(next, spu);       /* Step 51. */
+        restore_ppu_querytype(next, spu);       /* Step 52. */
+        restore_mfc_csr_tsq(next, spu);         /* Step 53. */
+        restore_mfc_csr_cmd(next, spu);         /* Step 54. */
+        restore_mfc_csr_ato(next, spu);         /* Step 55. */
+        restore_mfc_tclass_id(next, spu);       /* Step 56. */
+        set_llr_event(next, spu);               /* Step 57. */
+        restore_decr_wrapped(next, spu);        /* Step 58. */
+        restore_ch_part1(next, spu);            /* Step 59. */
+        restore_ch_part2(next, spu);            /* Step 60. */
+        restore_spu_lslr(next, spu);            /* Step 61. */
+        restore_spu_cfg(next, spu);             /* Step 62. */
+        restore_pm_trace(next, spu);            /* Step 63. */
+        restore_spu_npc(next, spu);             /* Step 64. */
+        restore_spu_mb(next, spu);              /* Step 65. */
+        check_ppu_mb_stat(next, spu);           /* Step 66. */
+        check_ppuint_mb_stat(next, spu);        /* Step 67. */
+        restore_mfc_slbs(next, spu);            /* Step 68. */
+        restore_mfc_sr1(next, spu);             /* Step 69. */
+        restore_other_spu_access(next, spu);    /* Step 70. */
+        restore_spu_runcntl(next, spu);         /* Step 71. */
+        restore_mfc_cntl(next, spu);            /* Step 72. */
+        enable_user_access(next, spu);          /* Step 73. */
+        reset_switch_active(next, spu);         /* Step 74. */
+        reenable_interrupts(next, spu);         /* Step 75. */
+}
+
+static int __do_spu_save(struct spu_state *prev, struct spu *spu)
+{
+        int rc;
+
+        /*
+         * SPU context save can be broken into three phases:
+         *
+         *     (a) quiesce [steps 2-16].
+         *     (b) save of CSA, performed by PPE [steps 17-42]
+         *     (c) save of LSCSA, mostly performed by SPU [steps 43-52].
+         *
+         * Returns      0 on success.
+         *              2,6 if failed to quiece SPU
+         *              53 if SPU-side of save failed.
+         */
+
+        rc = quiece_spu(prev, spu);             /* Steps 2-16. */
+        switch (rc) {
+        default:
+        case 2:
+        case 6:
+                harvest(prev, spu);
+                return rc;
+                break;
+        case 0:
+                break;
+        }
+        save_csa(prev, spu);                    /* Steps 17-43. */
+        save_lscsa(prev, spu);                  /* Steps 44-53. */
+        return check_save_status(prev, spu);    /* Step 54.     */
+}
+
+static int __do_spu_restore(struct spu_state *next, struct spu *spu)
+{
+        int rc;
+
+        /*
+         * SPU context restore can be broken into three phases:
+         *
+         *    (a) harvest (or reset) SPU [steps 2-24].
+         *    (b) restore LSCSA [steps 25-40], mostly performed by SPU.
+         *    (c) restore CSA [steps 41-76], performed by PPE.
+         *
+         * The 'harvest' step is not performed here, but rather
+         * as needed below.
+         */
+
+        restore_lscsa(next, spu);               /* Steps 24-39. */
+        rc = check_restore_status(next, spu);   /* Step 40.     */
+        switch (rc) {
+        default:
+                /* Failed. Return now. */
+                return rc;
+                break;
+        case 0:
+                /* Fall through to next step. */
+                break;
+        }
+        restore_csa(next, spu);
+
+        return 0;
+}
+
+/**
+ * spu_save - SPU context save, with locking.
+ * @prev: pointer to SPU context save area, to be saved.
+ * @spu: pointer to SPU iomem structure.
+ *
+ * Acquire locks, perform the save operation then return.
+ */
+int spu_save(struct spu_state *prev, struct spu *spu)
+{
+        int rc;
+
+        acquire_spu_lock(spu);          /* Step 1.     */
+        rc = __do_spu_save(prev, spu);  /* Steps 2-53. */
+        release_spu_lock(spu);
+        if (rc) {
+                panic("%s failed on SPU[%d], rc=%d.\n",
+                      __func__, spu->number, rc);
+        }
+        return rc;
+}
+
+/**
+ * spu_restore - SPU context restore, with harvest and locking.
+ * @new: pointer to SPU context save area, to be restored.
+ * @spu: pointer to SPU iomem structure.
+ *
+ * Perform harvest + restore, as we may not be coming
+ * from a previous succesful save operation, and the
+ * hardware state is unknown.
+ */
+int spu_restore(struct spu_state *new, struct spu *spu)
+{
+        int rc;
+
+        acquire_spu_lock(spu);
+        harvest(NULL, spu);
+        spu->stop_code = 0;
+        spu->dar = 0;
+        spu->dsisr = 0;
+        spu->slb_replace = 0;
+        spu->class_0_pending = 0;
+        rc = __do_spu_restore(new, spu);
+        release_spu_lock(spu);
+        if (rc) {
+                panic("%s failed on SPU[%d] rc=%d.\n",
+                       __func__, spu->number, rc);
+        }
+        return rc;
+}
+
+/**
+ * spu_harvest - SPU harvest (reset) operation
+ * @spu: pointer to SPU iomem structure.
+ *
+ * Perform SPU harvest (reset) operation.
+ */
+void spu_harvest(struct spu *spu)
+{
+        acquire_spu_lock(spu);
+        harvest(NULL, spu);
+        release_spu_lock(spu);
+}
+
+static void init_prob(struct spu_state *csa)
+{
+        csa->spu_chnlcnt_RW[9] = 1;
+        csa->spu_chnlcnt_RW[21] = 16;
+        csa->spu_chnlcnt_RW[23] = 1;
+        csa->spu_chnlcnt_RW[28] = 1;
+        csa->spu_chnlcnt_RW[30] = 1;
+        csa->prob.spu_runcntl_RW = SPU_RUNCNTL_STOP;
+}
+
+static void init_priv1(struct spu_state *csa)
+{
+        /* Enable decode, relocate, tlbie response, master runcntl. */
+        csa->priv1.mfc_sr1_RW = MFC_STATE1_LOCAL_STORAGE_DECODE_MASK |
+            MFC_STATE1_MASTER_RUN_CONTROL_MASK |
+            MFC_STATE1_PROBLEM_STATE_MASK |
+            MFC_STATE1_RELOCATE_MASK | MFC_STATE1_BUS_TLBIE_MASK;
+
+        /* Set storage description.  */
+        csa->priv1.mfc_sdr_RW = mfspr(SPRN_SDR1);
+
+        /* Enable OS-specific set of interrupts. */
+        csa->priv1.int_mask_class0_RW = CLASS0_ENABLE_DMA_ALIGNMENT_INTR |
+            CLASS0_ENABLE_INVALID_DMA_COMMAND_INTR |
+            CLASS0_ENABLE_SPU_ERROR_INTR;
+        csa->priv1.int_mask_class1_RW = CLASS1_ENABLE_SEGMENT_FAULT_INTR |
+            CLASS1_ENABLE_STORAGE_FAULT_INTR;
+        csa->priv1.int_mask_class2_RW = CLASS2_ENABLE_SPU_STOP_INTR |
+            CLASS2_ENABLE_SPU_HALT_INTR;
+}
+
+static void init_priv2(struct spu_state *csa)
+{
+        csa->priv2.spu_lslr_RW = LS_ADDR_MASK;
+        csa->priv2.mfc_control_RW = MFC_CNTL_RESUME_DMA_QUEUE |
+            MFC_CNTL_NORMAL_DMA_QUEUE_OPERATION |
+            MFC_CNTL_DMA_QUEUES_EMPTY_MASK;
+}
+
+/**
+ * spu_alloc_csa - allocate and initialize an SPU context save area.
+ *
+ * Allocate and initialize the contents of an SPU context save area.
+ * This includes enabling address translation, interrupt masks, etc.,
+ * as appropriate for the given OS environment.
+ *
+ * Note that storage for the 'lscsa' is allocated separately,
+ * as it is by far the largest of the context save regions,
+ * and may need to be pinned or otherwise specially aligned.
+ */
+void spu_init_csa(struct spu_state *csa)
+{
+        struct spu_lscsa *lscsa;
+        unsigned char *p;
+
+        if (!csa)
+                return;
+        memset(csa, 0, sizeof(struct spu_state));
+
+        lscsa = vmalloc(sizeof(struct spu_lscsa));
+        if (!lscsa)
+                return;
+
+        memset(lscsa, 0, sizeof(struct spu_lscsa));
+        csa->lscsa = lscsa;
+        csa->register_lock = SPIN_LOCK_UNLOCKED;
+
+        /* Set LS pages reserved to allow for user-space mapping. */
+        for (p = lscsa->ls; p < lscsa->ls + LS_SIZE; p += PAGE_SIZE)
+                SetPageReserved(vmalloc_to_page(p));
+
+        init_prob(csa);
+        init_priv1(csa);
+        init_priv2(csa);
+}
+
+void spu_fini_csa(struct spu_state *csa)
+{
+        /* Clear reserved bit before vfree. */
+        unsigned char *p;
+        for (p = csa->lscsa->ls; p < csa->lscsa->ls + LS_SIZE; p += PAGE_SIZE)
+                ClearPageReserved(vmalloc_to_page(p));
+
+        vfree(csa->lscsa);
+}
diff --git a/arch/powerpc/platforms/cell/spufs/syscalls.c b/arch/powerpc/platforms/cell/spufs/syscalls.c
new file mode 100644
index 000000000000..d549aa7ebea6
--- /dev/null
+++ b/arch/powerpc/platforms/cell/spufs/syscalls.c
@@ -0,0 +1,101 @@
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/module.h>
+#include <linux/mount.h>
+#include <linux/namei.h>
+
+#include <asm/uaccess.h>
+
+#include "spufs.h"
+
+/**
+ * sys_spu_run - run code loaded into an SPU
+ *
+ * @unpc:    next program counter for the SPU
+ * @ustatus: status of the SPU
+ *
+ * This system call transfers the control of execution of a
+ * user space thread to an SPU. It will return when the
+ * SPU has finished executing or when it hits an error
+ * condition and it will be interrupted if a signal needs
+ * to be delivered to a handler in user space.
+ *
+ * The next program counter is set to the passed value
+ * before the SPU starts fetching code and the user space
+ * pointer gets updated with the new value when returning
+ * from kernel space.
+ *
+ * The status value returned from spu_run reflects the
+ * value of the spu_status register after the SPU has stopped.
+ *
+ */
+long do_spu_run(struct file *filp, __u32 __user *unpc, __u32 __user *ustatus)
+{
+        long ret;
+        struct spufs_inode_info *i;
+        u32 npc, status;
+
+        ret = -EFAULT;
+        if (get_user(npc, unpc) || get_user(status, ustatus))
+                goto out;
+
+        /* check if this file was created by spu_create */
+        ret = -EINVAL;
+        if (filp->f_op != &spufs_context_fops)
+                goto out;
+
+        i = SPUFS_I(filp->f_dentry->d_inode);
+        ret = spufs_run_spu(filp, i->i_ctx, &npc, &status);
+
+        if (put_user(npc, unpc) || put_user(status, ustatus))
+                ret = -EFAULT;
+out:
+        return ret;
+}
+
+#ifndef MODULE
+asmlinkage long sys_spu_run(int fd, __u32 __user *unpc, __u32 __user *ustatus)
+{
+        int fput_needed;
+        struct file *filp;
+        long ret;
+
+        ret = -EBADF;
+        filp = fget_light(fd, &fput_needed);
+        if (filp) {
+                ret = do_spu_run(filp, unpc, ustatus);
+                fput_light(filp, fput_needed);
+        }
+
+        return ret;
+}
+#endif
+
+asmlinkage long sys_spu_create(const char __user *pathname,
+                                        unsigned int flags, mode_t mode)
+{
+        char *tmp;
+        int ret;
+
+        tmp = getname(pathname);
+        ret = PTR_ERR(tmp);
+        if (!IS_ERR(tmp)) {
+                struct nameidata nd;
+
+                ret = path_lookup(tmp, LOOKUP_PARENT|
+                                LOOKUP_OPEN|LOOKUP_CREATE, &nd);
+                if (!ret) {
+                        ret = spufs_create_thread(&nd, flags, mode);
+                        path_release(&nd);
+                }
+                putname(tmp);
+        }
+
+        return ret;
+}
+
+struct spufs_calls spufs_calls = {
+        .create_thread = sys_spu_create,
+        .spu_run = do_spu_run,
+        .owner = THIS_MODULE,
+};
diff --git a/arch/powerpc/platforms/chrp/setup.c b/arch/powerpc/platforms/chrp/setup.c
index dda5f2c72c25..4ec8ba737e7d 100644
--- a/arch/powerpc/platforms/chrp/setup.c
+++ b/arch/powerpc/platforms/chrp/setup.c
@@ -49,7 +49,6 @@
 #include <asm/hydra.h>
 #include <asm/sections.h>
 #include <asm/time.h>
-#include <asm/btext.h>
 #include <asm/i8259.h>
 #include <asm/mpic.h>
 #include <asm/rtas.h>
@@ -58,7 +57,6 @@
 #include "chrp.h"
 
 void rtas_indicator_progress(char *, unsigned short);
-void btext_progress(char *, unsigned short);
 
 int _chrp_type;
 EXPORT_SYMBOL(_chrp_type);
@@ -264,11 +262,6 @@ void __init chrp_setup_arch(void)
                 ppc_md.set_rtc_time     = rtas_set_rtc_time;
         }
 
-#ifdef CONFIG_BOOTX_TEXT
-        if (ppc_md.progress == NULL && boot_text_mapped)
-                ppc_md.progress = btext_progress;
-#endif
-
 #ifdef CONFIG_BLK_DEV_INITRD
         /* this is fine for chrp */
         initrd_below_start_ok = 1;
@@ -522,12 +515,3 @@ void __init chrp_init(void)
         smp_ops = &chrp_smp_ops;
 #endif /* CONFIG_SMP */
 }
-
-#ifdef CONFIG_BOOTX_TEXT
-void
-btext_progress(char *s, unsigned short hex)
-{
-        btext_drawstring(s);
-        btext_drawstring("\n");
-}
-#endif /* CONFIG_BOOTX_TEXT */
diff --git a/arch/powerpc/platforms/iseries/irq.c b/arch/powerpc/platforms/iseries/irq.c
index a58daa153686..42e978e4897a 100644
--- a/arch/powerpc/platforms/iseries/irq.c
+++ b/arch/powerpc/platforms/iseries/irq.c
@@ -35,161 +35,138 @@
 #include <linux/irq.h>
 #include <linux/spinlock.h>
 
+#include <asm/paca.h>
 #include <asm/iseries/hv_types.h>
 #include <asm/iseries/hv_lp_event.h>
 #include <asm/iseries/hv_call_xm.h>
+#include <asm/iseries/it_lp_queue.h>
 
 #include "irq.h"
 #include "call_pci.h"
 
-static long Pci_Interrupt_Count;
-static long Pci_Event_Count;
-
-enum XmPciLpEvent_Subtype {
-        XmPciLpEvent_BusCreated         = 0,    // PHB has been created
-        XmPciLpEvent_BusError           = 1,    // PHB has failed
-        XmPciLpEvent_BusFailed          = 2,    // Msg to Secondary, Primary failed bus
-        XmPciLpEvent_NodeFailed         = 4,    // Multi-adapter bridge has failed
-        XmPciLpEvent_NodeRecovered      = 5,    // Multi-adapter bridge has recovered
-        XmPciLpEvent_BusRecovered       = 12,   // PHB has been recovered
-        XmPciLpEvent_UnQuiesceBus       = 18,   // Secondary bus unqiescing
-        XmPciLpEvent_BridgeError        = 21,   // Bridge Error
-        XmPciLpEvent_SlotInterrupt      = 22    // Slot interrupt
-};
-
-struct XmPciLpEvent_BusInterrupt {
-        HvBusNumber     busNumber;
-        HvSubBusNumber  subBusNumber;
-};
+#if defined(CONFIG_SMP)
+extern void iSeries_smp_message_recv(struct pt_regs *);
+#endif
 
-struct XmPciLpEvent_NodeInterrupt {
-        HvBusNumber     busNumber;
-        HvSubBusNumber  subBusNumber;
-        HvAgentId       deviceId;
+enum pci_event_type {
+        pe_bus_created          = 0,    /* PHB has been created */
+        pe_bus_error            = 1,    /* PHB has failed */
+        pe_bus_failed           = 2,    /* Msg to Secondary, Primary failed bus */
+        pe_node_failed          = 4,    /* Multi-adapter bridge has failed */
+        pe_node_recovered       = 5,    /* Multi-adapter bridge has recovered */
+        pe_bus_recovered        = 12,   /* PHB has been recovered */
+        pe_unquiese_bus         = 18,   /* Secondary bus unqiescing */
+        pe_bridge_error         = 21,   /* Bridge Error */
+        pe_slot_interrupt       = 22    /* Slot interrupt */
 };
 
-struct XmPciLpEvent {
-        struct HvLpEvent hvLpEvent;
-
+struct pci_event {
+        struct HvLpEvent event;
         union {
-                u64 alignData;                  // Align on an 8-byte boundary
-
+                u64 __align;            /* Align on an 8-byte boundary */
                 struct {
                         u32             fisr;
-                        HvBusNumber     busNumber;
-                        HvSubBusNumber  subBusNumber;
-                        HvAgentId       deviceId;
-                } slotInterrupt;
-
-                struct XmPciLpEvent_BusInterrupt busFailed;
-                struct XmPciLpEvent_BusInterrupt busRecovered;
-                struct XmPciLpEvent_BusInterrupt busCreated;
-
-                struct XmPciLpEvent_NodeInterrupt nodeFailed;
-                struct XmPciLpEvent_NodeInterrupt nodeRecovered;
-
-        } eventData;
-
+                        HvBusNumber     bus_number;
+                        HvSubBusNumber  sub_bus_number;
+                        HvAgentId       dev_id;
+                } slot;
+                struct {
+                        HvBusNumber     bus_number;
+                        HvSubBusNumber  sub_bus_number;
+                } bus;
+                struct {
+                        HvBusNumber     bus_number;
+                        HvSubBusNumber  sub_bus_number;
+                        HvAgentId       dev_id;
+                } node;
+        } data;
 };
 
-static void intReceived(struct XmPciLpEvent *eventParm,
-                struct pt_regs *regsParm)
+static DEFINE_SPINLOCK(pending_irqs_lock);
+static int num_pending_irqs;
+static int pending_irqs[NR_IRQS];
+
+static void int_received(struct pci_event *event, struct pt_regs *regs)
 {
         int irq;
-#ifdef CONFIG_IRQSTACKS
-        struct thread_info *curtp, *irqtp;
-#endif
 
-        ++Pci_Interrupt_Count;
-
-        switch (eventParm->hvLpEvent.xSubtype) {
-        case XmPciLpEvent_SlotInterrupt:
-                irq = eventParm->hvLpEvent.xCorrelationToken;
-                /* Dispatch the interrupt handlers for this irq */
-#ifdef CONFIG_IRQSTACKS
-                /* Switch to the irq stack to handle this */
-                curtp = current_thread_info();
-                irqtp = hardirq_ctx[smp_processor_id()];
-                if (curtp != irqtp) {
-                        irqtp->task = curtp->task;
-                        irqtp->flags = 0;
-                        call___do_IRQ(irq, regsParm, irqtp);
-                        irqtp->task = NULL;
-                        if (irqtp->flags)
-                                set_bits(irqtp->flags, &curtp->flags);
-                } else
-#endif
-                        __do_IRQ(irq, regsParm);
-                HvCallPci_eoi(eventParm->eventData.slotInterrupt.busNumber,
-                        eventParm->eventData.slotInterrupt.subBusNumber,
-                        eventParm->eventData.slotInterrupt.deviceId);
+        switch (event->event.xSubtype) {
+        case pe_slot_interrupt:
+                irq = event->event.xCorrelationToken;
+                if (irq < NR_IRQS) {
+                        spin_lock(&pending_irqs_lock);
+                        pending_irqs[irq]++;
+                        num_pending_irqs++;
+                        spin_unlock(&pending_irqs_lock);
+                } else {
+                        printk(KERN_WARNING "int_received: bad irq number %d\n",
+                                        irq);
+                        HvCallPci_eoi(event->data.slot.bus_number,
+                                        event->data.slot.sub_bus_number,
+                                        event->data.slot.dev_id);
+                }
                 break;
                 /* Ignore error recovery events for now */
-        case XmPciLpEvent_BusCreated:
-                printk(KERN_INFO "intReceived: system bus %d created\n",
-                        eventParm->eventData.busCreated.busNumber);
+        case pe_bus_created:
+                printk(KERN_INFO "int_received: system bus %d created\n",
+                        event->data.bus.bus_number);
                 break;
-        case XmPciLpEvent_BusError:
-        case XmPciLpEvent_BusFailed:
-                printk(KERN_INFO "intReceived: system bus %d failed\n",
-                        eventParm->eventData.busFailed.busNumber);
+        case pe_bus_error:
+        case pe_bus_failed:
+                printk(KERN_INFO "int_received: system bus %d failed\n",
+                        event->data.bus.bus_number);
                 break;
-        case XmPciLpEvent_BusRecovered:
-        case XmPciLpEvent_UnQuiesceBus:
-                printk(KERN_INFO "intReceived: system bus %d recovered\n",
-                        eventParm->eventData.busRecovered.busNumber);
+        case pe_bus_recovered:
+        case pe_unquiese_bus:
+                printk(KERN_INFO "int_received: system bus %d recovered\n",
+                        event->data.bus.bus_number);
                 break;
-        case XmPciLpEvent_NodeFailed:
-        case XmPciLpEvent_BridgeError:
+        case pe_node_failed:
+        case pe_bridge_error:
                 printk(KERN_INFO
-                        "intReceived: multi-adapter bridge %d/%d/%d failed\n",
-                        eventParm->eventData.nodeFailed.busNumber,
-                        eventParm->eventData.nodeFailed.subBusNumber,
-                        eventParm->eventData.nodeFailed.deviceId);
+                        "int_received: multi-adapter bridge %d/%d/%d failed\n",
+                        event->data.node.bus_number,
+                        event->data.node.sub_bus_number,
+                        event->data.node.dev_id);
                 break;
-        case XmPciLpEvent_NodeRecovered:
+        case pe_node_recovered:
                 printk(KERN_INFO
-                        "intReceived: multi-adapter bridge %d/%d/%d recovered\n",
-                        eventParm->eventData.nodeRecovered.busNumber,
-                        eventParm->eventData.nodeRecovered.subBusNumber,
-                        eventParm->eventData.nodeRecovered.deviceId);
+                        "int_received: multi-adapter bridge %d/%d/%d recovered\n",
+                        event->data.node.bus_number,
+                        event->data.node.sub_bus_number,
+                        event->data.node.dev_id);
                 break;
         default:
                 printk(KERN_ERR
-                        "intReceived: unrecognized event subtype 0x%x\n",
-                        eventParm->hvLpEvent.xSubtype);
+                        "int_received: unrecognized event subtype 0x%x\n",
+                        event->event.xSubtype);
                 break;
         }
 }
 
-static void XmPciLpEvent_handler(struct HvLpEvent *eventParm,
-                struct pt_regs *regsParm)
+static void pci_event_handler(struct HvLpEvent *event, struct pt_regs *regs)
 {
-#ifdef CONFIG_PCI
-        ++Pci_Event_Count;
-
-        if (eventParm && (eventParm->xType == HvLpEvent_Type_PciIo)) {
-                switch (eventParm->xFlags.xFunction) {
+        if (event && (event->xType == HvLpEvent_Type_PciIo)) {
+                switch (event->xFlags.xFunction) {
                 case HvLpEvent_Function_Int:
-                        intReceived((struct XmPciLpEvent *)eventParm, regsParm);
+                        int_received((struct pci_event *)event, regs);
                         break;
                 case HvLpEvent_Function_Ack:
                         printk(KERN_ERR
-                                "XmPciLpEvent_handler: unexpected ack received\n");
+                                "pci_event_handler: unexpected ack received\n");
                         break;
                 default:
                         printk(KERN_ERR
-                                "XmPciLpEvent_handler: unexpected event function %d\n",
-                                (int)eventParm->xFlags.xFunction);
+                                "pci_event_handler: unexpected event function %d\n",
+                                (int)event->xFlags.xFunction);
                         break;
                 }
-        } else if (eventParm)
+        } else if (event)
                 printk(KERN_ERR
-                        "XmPciLpEvent_handler: Unrecognized PCI event type 0x%x\n",
-                        (int)eventParm->xType);
+                        "pci_event_handler: Unrecognized PCI event type 0x%x\n",
+                        (int)event->xType);
         else
-                printk(KERN_ERR "XmPciLpEvent_handler: NULL event received\n");
-#endif
+                printk(KERN_ERR "pci_event_handler: NULL event received\n");
 }
 
 /*
@@ -199,20 +176,21 @@ static void XmPciLpEvent_handler(struct HvLpEvent *eventParm,
 void __init iSeries_init_IRQ(void)
 {
         /* Register PCI event handler and open an event path */
-        int xRc;
-
-        xRc = HvLpEvent_registerHandler(HvLpEvent_Type_PciIo,
-                        &XmPciLpEvent_handler);
-        if (xRc == 0) {
-                xRc = HvLpEvent_openPath(HvLpEvent_Type_PciIo, 0);
-                if (xRc != 0)
-                        printk(KERN_ERR "iSeries_init_IRQ: open event path "
-                                        "failed with rc 0x%x\n", xRc);
+        int ret;
+
+        ret = HvLpEvent_registerHandler(HvLpEvent_Type_PciIo,
+                        &pci_event_handler);
+        if (ret == 0) {
+                ret = HvLpEvent_openPath(HvLpEvent_Type_PciIo, 0);
+                if (ret != 0)
+                        printk(KERN_ERR "iseries_init_IRQ: open event path "
+                                        "failed with rc 0x%x\n", ret);
         } else
-                printk(KERN_ERR "iSeries_init_IRQ: register handler "
-                                "failed with rc 0x%x\n", xRc);
+                printk(KERN_ERR "iseries_init_IRQ: register handler "
+                                "failed with rc 0x%x\n", ret);
 }
 
+#define REAL_IRQ_TO_SUBBUS(irq) (((irq) >> 14) & 0xff)
 #define REAL_IRQ_TO_BUS(irq)    ((((irq) >> 6) & 0xff) + 1)
 #define REAL_IRQ_TO_IDSEL(irq)  ((((irq) >> 3) & 7) + 1)
 #define REAL_IRQ_TO_FUNC(irq)   ((irq) & 7)
@@ -221,40 +199,40 @@ void __init iSeries_init_IRQ(void)
  * This will be called by device drivers (via enable_IRQ)
  * to enable INTA in the bridge interrupt status register.
  */
-static void iSeries_enable_IRQ(unsigned int irq)
+static void iseries_enable_IRQ(unsigned int irq)
 {
-        u32 bus, deviceId, function, mask;
-        const u32 subBus = 0;
+        u32 bus, dev_id, function, mask;
+        const u32 sub_bus = 0;
         unsigned int rirq = virt_irq_to_real_map[irq];
 
         /* The IRQ has already been locked by the caller */
         bus = REAL_IRQ_TO_BUS(rirq);
         function = REAL_IRQ_TO_FUNC(rirq);
-        deviceId = (REAL_IRQ_TO_IDSEL(rirq) << 4) + function;
+        dev_id = (REAL_IRQ_TO_IDSEL(rirq) << 4) + function;
 
         /* Unmask secondary INTA */
         mask = 0x80000000;
-        HvCallPci_unmaskInterrupts(bus, subBus, deviceId, mask);
+        HvCallPci_unmaskInterrupts(bus, sub_bus, dev_id, mask);
 }
 
-/* This is called by iSeries_activate_IRQs */
-static unsigned int iSeries_startup_IRQ(unsigned int irq)
+/* This is called by iseries_activate_IRQs */
+static unsigned int iseries_startup_IRQ(unsigned int irq)
 {
-        u32 bus, deviceId, function, mask;
-        const u32 subBus = 0;
+        u32 bus, dev_id, function, mask;
+        const u32 sub_bus = 0;
         unsigned int rirq = virt_irq_to_real_map[irq];
 
         bus = REAL_IRQ_TO_BUS(rirq);
         function = REAL_IRQ_TO_FUNC(rirq);
-        deviceId = (REAL_IRQ_TO_IDSEL(rirq) << 4) + function;
+        dev_id = (REAL_IRQ_TO_IDSEL(rirq) << 4) + function;
 
         /* Link the IRQ number to the bridge */
-        HvCallXm_connectBusUnit(bus, subBus, deviceId, irq);
+        HvCallXm_connectBusUnit(bus, sub_bus, dev_id, irq);
 
         /* Unmask bridge interrupts in the FISR */
         mask = 0x01010000 << function;
-        HvCallPci_unmaskFisr(bus, subBus, deviceId, mask);
-        iSeries_enable_IRQ(irq);
+        HvCallPci_unmaskFisr(bus, sub_bus, dev_id, mask);
+        iseries_enable_IRQ(irq);
         return 0;
 }
 
@@ -279,78 +257,115 @@ void __init iSeries_activate_IRQs()
 }
 
 /*  this is not called anywhere currently */
-static void iSeries_shutdown_IRQ(unsigned int irq)
+static void iseries_shutdown_IRQ(unsigned int irq)
 {
-        u32 bus, deviceId, function, mask;
-        const u32 subBus = 0;
+        u32 bus, dev_id, function, mask;
+        const u32 sub_bus = 0;
         unsigned int rirq = virt_irq_to_real_map[irq];
 
         /* irq should be locked by the caller */
         bus = REAL_IRQ_TO_BUS(rirq);
         function = REAL_IRQ_TO_FUNC(rirq);
-        deviceId = (REAL_IRQ_TO_IDSEL(rirq) << 4) + function;
+        dev_id = (REAL_IRQ_TO_IDSEL(rirq) << 4) + function;
 
         /* Invalidate the IRQ number in the bridge */
-        HvCallXm_connectBusUnit(bus, subBus, deviceId, 0);
+        HvCallXm_connectBusUnit(bus, sub_bus, dev_id, 0);
 
         /* Mask bridge interrupts in the FISR */
         mask = 0x01010000 << function;
-        HvCallPci_maskFisr(bus, subBus, deviceId, mask);
+        HvCallPci_maskFisr(bus, sub_bus, dev_id, mask);
 }
 
 /*
  * This will be called by device drivers (via disable_IRQ)
  * to disable INTA in the bridge interrupt status register.
  */
-static void iSeries_disable_IRQ(unsigned int irq)
+static void iseries_disable_IRQ(unsigned int irq)
 {
-        u32 bus, deviceId, function, mask;
-        const u32 subBus = 0;
+        u32 bus, dev_id, function, mask;
+        const u32 sub_bus = 0;
         unsigned int rirq = virt_irq_to_real_map[irq];
 
         /* The IRQ has already been locked by the caller */
         bus = REAL_IRQ_TO_BUS(rirq);
         function = REAL_IRQ_TO_FUNC(rirq);
-        deviceId = (REAL_IRQ_TO_IDSEL(rirq) << 4) + function;
+        dev_id = (REAL_IRQ_TO_IDSEL(rirq) << 4) + function;
 
         /* Mask secondary INTA   */
         mask = 0x80000000;
-        HvCallPci_maskInterrupts(bus, subBus, deviceId, mask);
+        HvCallPci_maskInterrupts(bus, sub_bus, dev_id, mask);
 }
 
-/*
- * This does nothing because there is not enough information
- * provided to do the EOI HvCall.  This is done by XmPciLpEvent.c
- */
-static void iSeries_end_IRQ(unsigned int irq)
+static void iseries_end_IRQ(unsigned int irq)
 {
+        unsigned int rirq = virt_irq_to_real_map[irq];
+
+        HvCallPci_eoi(REAL_IRQ_TO_BUS(rirq), REAL_IRQ_TO_SUBBUS(rirq),
+                (REAL_IRQ_TO_IDSEL(rirq) << 4) + REAL_IRQ_TO_FUNC(rirq));
 }
 
 static hw_irq_controller iSeries_IRQ_handler = {
         .typename = "iSeries irq controller",
-        .startup = iSeries_startup_IRQ,
-        .shutdown = iSeries_shutdown_IRQ,
-        .enable = iSeries_enable_IRQ,
-        .disable = iSeries_disable_IRQ,
-        .end = iSeries_end_IRQ
+        .startup = iseries_startup_IRQ,
+        .shutdown = iseries_shutdown_IRQ,
+        .enable = iseries_enable_IRQ,
+        .disable = iseries_disable_IRQ,
+        .end = iseries_end_IRQ
 };
 
 /*
  * This is called out of iSeries_scan_slot to allocate an IRQ for an EADS slot
  * It calculates the irq value for the slot.
- * Note that subBusNumber is always 0 (at the moment at least).
+ * Note that sub_bus is always 0 (at the moment at least).
  */
-int __init iSeries_allocate_IRQ(HvBusNumber busNumber,
-                HvSubBusNumber subBusNumber, HvAgentId deviceId)
+int __init iSeries_allocate_IRQ(HvBusNumber bus,
+                HvSubBusNumber sub_bus, HvAgentId dev_id)
 {
         int virtirq;
         unsigned int realirq;
-        u8 idsel = (deviceId >> 4);
-        u8 function = deviceId & 7;
+        u8 idsel = (dev_id >> 4);
+        u8 function = dev_id & 7;
 
-        realirq = ((busNumber - 1) << 6) + ((idsel - 1) << 3) + function;
+        realirq = (((((sub_bus << 8) + (bus - 1)) << 3) + (idsel - 1)) << 3)
+                + function;
         virtirq = virt_irq_create_mapping(realirq);
 
         irq_desc[virtirq].handler = &iSeries_IRQ_handler;
         return virtirq;
 }
+
+/*
+ * Get the next pending IRQ.
+ */
+int iSeries_get_irq(struct pt_regs *regs)
+{
+        struct paca_struct *lpaca;
+        /* -2 means ignore this interrupt */
+        int irq = -2;
+
+        lpaca = get_paca();
+#ifdef CONFIG_SMP
+        if (lpaca->lppaca.int_dword.fields.ipi_cnt) {
+                lpaca->lppaca.int_dword.fields.ipi_cnt = 0;
+                iSeries_smp_message_recv(regs);
+        }
+#endif /* CONFIG_SMP */
+        if (hvlpevent_is_pending())
+                process_hvlpevents(regs);
+
+        if (num_pending_irqs) {
+                spin_lock(&pending_irqs_lock);
+                for (irq = 0; irq < NR_IRQS; irq++) {
+                        if (pending_irqs[irq]) {
+                                pending_irqs[irq]--;
+                                num_pending_irqs--;
+                                break;
+                        }
+                }
+                spin_unlock(&pending_irqs_lock);
+                if (irq >= NR_IRQS)
+                        irq = -2;
+        }
+
+        return irq;
+}
diff --git a/arch/powerpc/platforms/iseries/irq.h b/arch/powerpc/platforms/iseries/irq.h
index 5f643f16ecc0..b9c801ba5a47 100644
--- a/arch/powerpc/platforms/iseries/irq.h
+++ b/arch/powerpc/platforms/iseries/irq.h
@@ -4,5 +4,6 @@
 extern void iSeries_init_IRQ(void);
 extern int  iSeries_allocate_IRQ(HvBusNumber, HvSubBusNumber, HvAgentId);
 extern void iSeries_activate_IRQs(void);
+extern int iSeries_get_irq(struct pt_regs *);
 
 #endif /* _ISERIES_IRQ_H */
diff --git a/arch/powerpc/platforms/iseries/lpardata.c b/arch/powerpc/platforms/iseries/lpardata.c
index bb8c91537f35..ea72385aaf0a 100644
--- a/arch/powerpc/platforms/iseries/lpardata.c
+++ b/arch/powerpc/platforms/iseries/lpardata.c
@@ -225,3 +225,10 @@ struct ItVpdAreas itVpdAreas = {
                 0,0
         }
 };
+
+struct ItLpRegSave iseries_reg_save[] = {
+        [0 ... (NR_CPUS-1)] = {
+                .xDesc = 0xd397d9e2,    /* "LpRS" */
+                .xSize = sizeof(struct ItLpRegSave),
+        },
+};
diff --git a/arch/powerpc/platforms/iseries/setup.c b/arch/powerpc/platforms/iseries/setup.c
index da26639190db..ad5ef80500ce 100644
--- a/arch/powerpc/platforms/iseries/setup.c
+++ b/arch/powerpc/platforms/iseries/setup.c
@@ -571,16 +571,6 @@ static void iSeries_show_cpuinfo(struct seq_file *m)
 
 /*
  * Document me.
- * and Implement me.
- */
-static int iSeries_get_irq(struct pt_regs *regs)
-{
-        /* -2 means ignore this interrupt */
-        return -2;
-}
-
-/*
- * Document me.
  */
 static void iSeries_restart(char *cmd)
 {
diff --git a/arch/powerpc/platforms/maple/setup.c b/arch/powerpc/platforms/maple/setup.c
index 7ece8983a105..dd73e38bfb7d 100644
--- a/arch/powerpc/platforms/maple/setup.c
+++ b/arch/powerpc/platforms/maple/setup.c
@@ -51,6 +51,7 @@
 #include <asm/pgtable.h>
 #include <asm/bitops.h>
 #include <asm/io.h>
+#include <asm/kexec.h>
 #include <asm/pci-bridge.h>
 #include <asm/iommu.h>
 #include <asm/machdep.h>
@@ -191,24 +192,10 @@ static void __init maple_init_early(void)
          */
         hpte_init_native();
 
-        /* Find the serial port */
-        generic_find_legacy_serial_ports(&physport, &default_speed);
-
-        DBG("phys port addr: %lx\n", (long)physport);
-
-        if (physport) {
-                void *comport;
-                /* Map the uart for udbg. */
-                comport = (void *)ioremap(physport, 16);
-                udbg_init_uart(comport, default_speed);
-
-                DBG("Hello World !\n");
-        }
-
         /* Setup interrupt mapping options */
         ppc64_interrupt_controller = IC_OPEN_PIC;
 
-        iommu_init_early_u3();
+        iommu_init_early_dart();
 
         DBG(" <- maple_init_early\n");
 }
@@ -270,7 +257,7 @@ static int __init maple_probe(int platform)
          * occupies having to be broken up so the DART itself is not
          * part of the cacheable linar mapping
          */
-        alloc_u3_dart_table();
+        alloc_dart_table();
 
         return 1;
 }
@@ -292,4 +279,9 @@ struct machdep_calls __initdata maple_md = {
         .calibrate_decr         = generic_calibrate_decr,
         .progress               = maple_progress,
         .idle_loop              = native_idle,
+#ifdef CONFIG_KEXEC
+        .machine_kexec          = default_machine_kexec,
+        .machine_kexec_prepare  = default_machine_kexec_prepare,
+        .machine_crash_shutdown = default_machine_crash_shutdown,
+#endif
 };
diff --git a/arch/powerpc/platforms/powermac/Makefile b/arch/powerpc/platforms/powermac/Makefile
index c9df44fcf571..78093d7f97af 100644
--- a/arch/powerpc/platforms/powermac/Makefile
+++ b/arch/powerpc/platforms/powermac/Makefile
@@ -1,9 +1,14 @@
+CFLAGS_bootx_init.o             += -fPIC
+
 obj-y                           += pic.o setup.o time.o feature.o pci.o \
-                                   sleep.o low_i2c.o cache.o
+                                   sleep.o low_i2c.o cache.o pfunc_core.o \
+                                   pfunc_base.o
 obj-$(CONFIG_PMAC_BACKLIGHT)    += backlight.o
 obj-$(CONFIG_CPU_FREQ_PMAC)     += cpufreq_32.o
 obj-$(CONFIG_CPU_FREQ_PMAC64)   += cpufreq_64.o
 obj-$(CONFIG_NVRAM)             += nvram.o
 # ppc64 pmac doesn't define CONFIG_NVRAM but needs nvram stuff
 obj-$(CONFIG_PPC64)             += nvram.o
+obj-$(CONFIG_PPC32)             += bootx_init.o
 obj-$(CONFIG_SMP)               += smp.o
+obj-$(CONFIG_PPC_MERGE)         += udbg_scc.o udbg_adb.o
diff --git a/arch/powerpc/platforms/powermac/bootx_init.c b/arch/powerpc/platforms/powermac/bootx_init.c
new file mode 100644
index 000000000000..fa8b4d7b5ded
--- /dev/null
+++ b/arch/powerpc/platforms/powermac/bootx_init.c
@@ -0,0 +1,547 @@
+/*
+ *  Early boot support code for BootX bootloader
+ *
+ *  Copyright (C) 2005 Ben. Herrenschmidt (benh@kernel.crashing.org)
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  as published by the Free Software Foundation; either version
+ *  2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/init.h>
+#include <linux/version.h>
+#include <asm/sections.h>
+#include <asm/prom.h>
+#include <asm/page.h>
+#include <asm/bootx.h>
+#include <asm/bootinfo.h>
+#include <asm/btext.h>
+#include <asm/io.h>
+
+#undef DEBUG
+#define SET_BOOT_BAT
+
+#ifdef DEBUG
+#define DBG(fmt...) do { bootx_printf(fmt); } while(0)
+#else
+#define DBG(fmt...) do { } while(0)
+#endif
+
+extern void __start(unsigned long r3, unsigned long r4, unsigned long r5);
+
+static unsigned long __initdata bootx_dt_strbase;
+static unsigned long __initdata bootx_dt_strend;
+static unsigned long __initdata bootx_node_chosen;
+static boot_infos_t * __initdata bootx_info;
+static char __initdata bootx_disp_path[256];
+
+/* Is boot-info compatible ? */
+#define BOOT_INFO_IS_COMPATIBLE(bi) \
+        ((bi)->compatible_version <= BOOT_INFO_VERSION)
+#define BOOT_INFO_IS_V2_COMPATIBLE(bi)  ((bi)->version >= 2)
+#define BOOT_INFO_IS_V4_COMPATIBLE(bi)  ((bi)->version >= 4)
+
+#ifdef CONFIG_BOOTX_TEXT
+static void __init bootx_printf(const char *format, ...)
+{
+        const char *p, *q, *s;
+        va_list args;
+        unsigned long v;
+
+        va_start(args, format);
+        for (p = format; *p != 0; p = q) {
+                for (q = p; *q != 0 && *q != '\n' && *q != '%'; ++q)
+                        ;
+                if (q > p)
+                        btext_drawtext(p, q - p);
+                if (*q == 0)
+                        break;
+                if (*q == '\n') {
+                        ++q;
+                        btext_flushline();
+                        btext_drawstring("\r\n");
+                        btext_flushline();
+                        continue;
+                }
+                ++q;
+                if (*q == 0)
+                        break;
+                switch (*q) {
+                case 's':
+                        ++q;
+                        s = va_arg(args, const char *);
+                        if (s == NULL)
+                                s = "<NULL>";
+                        btext_drawstring(s);
+                        break;
+                case 'x':
+                        ++q;
+                        v = va_arg(args, unsigned long);
+                        btext_drawhex(v);
+                        break;
+                }
+        }
+}
+#else /* CONFIG_BOOTX_TEXT */
+static void __init bootx_printf(const char *format, ...) {}
+#endif /* CONFIG_BOOTX_TEXT */
+
+static void * __init bootx_early_getprop(unsigned long base,
+                                         unsigned long node,
+                                         char *prop)
+{
+        struct bootx_dt_node *np = (struct bootx_dt_node *)(base + node);
+        u32 *ppp = &np->properties;
+
+        while(*ppp) {
+                struct bootx_dt_prop *pp =
+                        (struct bootx_dt_prop *)(base + *ppp);
+
+                if (strcmp((char *)((unsigned long)pp->name + base),
+                           prop) == 0) {
+                        return (void *)((unsigned long)pp->value + base);
+                }
+                ppp = &pp->next;
+        }
+        return NULL;
+}
+
+#define dt_push_token(token, mem) \
+        do { \
+                *(mem) = _ALIGN_UP(*(mem),4); \
+                *((u32 *)*(mem)) = token; \
+                *(mem) += 4; \
+        } while(0)
+
+static unsigned long __init bootx_dt_find_string(char *str)
+{
+        char *s, *os;
+
+        s = os = (char *)bootx_dt_strbase;
+        s += 4;
+        while (s <  (char *)bootx_dt_strend) {
+                if (strcmp(s, str) == 0)
+                        return s - os;
+                s += strlen(s) + 1;
+        }
+        return 0;
+}
+
+static void __init bootx_dt_add_prop(char *name, void *data, int size,
+                                  unsigned long *mem_end)
+{
+        unsigned long soff = bootx_dt_find_string(name);
+        if (data == NULL)
+                size = 0;
+        if (soff == 0) {
+                bootx_printf("WARNING: Can't find string index for <%s>\n",
+                             name);
+                return;
+        }
+        if (size > 0x20000) {
+                bootx_printf("WARNING: ignoring large property ");
+                bootx_printf("%s length 0x%x\n", name, size);
+                return;
+        }
+        dt_push_token(OF_DT_PROP, mem_end);
+        dt_push_token(size, mem_end);
+        dt_push_token(soff, mem_end);
+
+        /* push property content */
+        if (size && data) {
+                memcpy((void *)*mem_end, data, size);
+                *mem_end = _ALIGN_UP(*mem_end + size, 4);
+        }
+}
+
+static void __init bootx_add_chosen_props(unsigned long base,
+                                          unsigned long *mem_end)
+{
+        u32 val = _MACH_Pmac;
+
+        bootx_dt_add_prop("linux,platform", &val, 4, mem_end);
+
+        if (bootx_info->kernelParamsOffset) {
+                char *args = (char *)((unsigned long)bootx_info) +
+                        bootx_info->kernelParamsOffset;
+                bootx_dt_add_prop("bootargs", args, strlen(args) + 1, mem_end);
+        }
+        if (bootx_info->ramDisk) {
+                val = ((unsigned long)bootx_info) + bootx_info->ramDisk;
+                bootx_dt_add_prop("linux,initrd-start", &val, 4, mem_end);
+                val += bootx_info->ramDiskSize;
+                bootx_dt_add_prop("linux,initrd-end", &val, 4, mem_end);
+        }
+        if (strlen(bootx_disp_path))
+                bootx_dt_add_prop("linux,stdout-path", bootx_disp_path,
+                                  strlen(bootx_disp_path) + 1, mem_end);
+}
+
+static void __init bootx_add_display_props(unsigned long base,
+                                           unsigned long *mem_end)
+{
+        bootx_dt_add_prop("linux,boot-display", NULL, 0, mem_end);
+        bootx_dt_add_prop("linux,opened", NULL, 0, mem_end);
+}
+
+static void __init bootx_dt_add_string(char *s, unsigned long *mem_end)
+{
+        unsigned int l = strlen(s) + 1;
+        memcpy((void *)*mem_end, s, l);
+        bootx_dt_strend = *mem_end = *mem_end + l;
+}
+
+static void __init bootx_scan_dt_build_strings(unsigned long base,
+                                               unsigned long node,
+                                               unsigned long *mem_end)
+{
+        struct bootx_dt_node *np = (struct bootx_dt_node *)(base + node);
+        u32 *cpp, *ppp = &np->properties;
+        unsigned long soff;
+        char *namep;
+
+        /* Keep refs to known nodes */
+        namep = np->full_name ? (char *)(base + np->full_name) : NULL;
+        if (namep == NULL) {
+                bootx_printf("Node without a full name !\n");
+                namep = "";
+        }
+        DBG("* strings: %s\n", namep);
+
+        if (!strcmp(namep, "/chosen")) {
+                DBG(" detected /chosen ! adding properties names !\n");
+                bootx_dt_add_string("linux,platform", mem_end);
+                bootx_dt_add_string("linux,stdout-path", mem_end);
+                bootx_dt_add_string("linux,initrd-start", mem_end);
+                bootx_dt_add_string("linux,initrd-end", mem_end);
+                bootx_dt_add_string("bootargs", mem_end);
+                bootx_node_chosen = node;
+        }
+        if (node == bootx_info->dispDeviceRegEntryOffset) {
+                DBG(" detected display ! adding properties names !\n");
+                bootx_dt_add_string("linux,boot-display", mem_end);
+                bootx_dt_add_string("linux,opened", mem_end);
+                strncpy(bootx_disp_path, namep, 255);
+        }
+
+        /* get and store all property names */
+        while (*ppp) {
+                struct bootx_dt_prop *pp =
+                        (struct bootx_dt_prop *)(base + *ppp);
+
+                namep = pp->name ? (char *)(base + pp->name) : NULL;
+                if (namep == NULL || strcmp(namep, "name") == 0)
+                        goto next;
+                /* get/create string entry */
+                soff = bootx_dt_find_string(namep);
+                if (soff == 0)
+                        bootx_dt_add_string(namep, mem_end);
+        next:
+                ppp = &pp->next;
+        }
+
+        /* do all our children */
+        cpp = &np->child;
+        while(*cpp) {
+                np = (struct bootx_dt_node *)(base + *cpp);
+                bootx_scan_dt_build_strings(base, *cpp, mem_end);
+                cpp = &np->sibling;
+        }
+}
+
+static void __init bootx_scan_dt_build_struct(unsigned long base,
+                                              unsigned long node,
+                                              unsigned long *mem_end)
+{
+        struct bootx_dt_node *np = (struct bootx_dt_node *)(base + node);
+        u32 *cpp, *ppp = &np->properties;
+        char *namep, *p, *ep, *lp;
+        int l;
+
+        dt_push_token(OF_DT_BEGIN_NODE, mem_end);
+
+        /* get the node's full name */
+        namep = np->full_name ? (char *)(base + np->full_name) : NULL;
+        if (namep == NULL)
+                namep = "";
+        l = strlen(namep);
+
+        DBG("* struct: %s\n", namep);
+
+        /* Fixup an Apple bug where they have bogus \0 chars in the
+         * middle of the path in some properties, and extract
+         * the unit name (everything after the last '/').
+         */
+        memcpy((void *)*mem_end, namep, l + 1);
+        namep = (char *)*mem_end;
+        for (lp = p = namep, ep = namep + l; p < ep; p++) {
+                if (*p == '/')
+                        lp = namep;
+                else if (*p != 0)
+                        *lp++ = *p;
+        }
+        *lp = 0;
+        *mem_end = _ALIGN_UP((unsigned long)lp + 1, 4);
+
+        /* get and store all properties */
+        while (*ppp) {
+                struct bootx_dt_prop *pp =
+                        (struct bootx_dt_prop *)(base + *ppp);
+
+                namep = pp->name ? (char *)(base + pp->name) : NULL;
+                /* Skip "name" */
+                if (namep == NULL || !strcmp(namep, "name"))
+                        goto next;
+                /* Skip "bootargs" in /chosen too as we replace it */
+                if (node == bootx_node_chosen && !strcmp(namep, "bootargs"))
+                        goto next;
+
+                /* push property head */
+                bootx_dt_add_prop(namep,
+                                  pp->value ? (void *)(base + pp->value): NULL,
+                                  pp->length, mem_end);
+        next:
+                ppp = &pp->next;
+        }
+
+        if (node == bootx_node_chosen)
+                bootx_add_chosen_props(base, mem_end);
+        if (node == bootx_info->dispDeviceRegEntryOffset)
+                bootx_add_display_props(base, mem_end);
+
+        /* do all our children */
+        cpp = &np->child;
+        while(*cpp) {
+                np = (struct bootx_dt_node *)(base + *cpp);
+                bootx_scan_dt_build_struct(base, *cpp, mem_end);
+                cpp = &np->sibling;
+        }
+
+        dt_push_token(OF_DT_END_NODE, mem_end);
+}
+
+static unsigned long __init bootx_flatten_dt(unsigned long start)
+{
+        boot_infos_t *bi = bootx_info;
+        unsigned long mem_start, mem_end;
+        struct boot_param_header *hdr;
+        unsigned long base;
+        u64 *rsvmap;
+
+        /* Start using memory after the big blob passed by BootX, get
+         * some space for the header
+         */
+        mem_start = mem_end = _ALIGN_UP(((unsigned long)bi) + start, 4);
+        DBG("Boot params header at: %x\n", mem_start);
+        hdr = (struct boot_param_header *)mem_start;
+        mem_end += sizeof(struct boot_param_header);
+        rsvmap = (u64 *)(_ALIGN_UP(mem_end, 8));
+        hdr->off_mem_rsvmap = ((unsigned long)rsvmap) - mem_start;
+        mem_end = ((unsigned long)rsvmap) + 8 * sizeof(u64);
+
+        /* Get base of tree */
+        base = ((unsigned long)bi) + bi->deviceTreeOffset;
+
+        /* Build string array */
+        DBG("Building string array at: %x\n", mem_end);
+        DBG("Device Tree Base=%x\n", base);
+        bootx_dt_strbase = mem_end;
+        mem_end += 4;
+        bootx_dt_strend = mem_end;
+        bootx_scan_dt_build_strings(base, 4, &mem_end);
+        hdr->off_dt_strings = bootx_dt_strbase - mem_start;
+        hdr->dt_strings_size = bootx_dt_strend - bootx_dt_strbase;
+
+        /* Build structure */
+        mem_end = _ALIGN(mem_end, 16);
+        DBG("Building device tree structure at: %x\n", mem_end);
+        hdr->off_dt_struct = mem_end - mem_start;
+        bootx_scan_dt_build_struct(base, 4, &mem_end);
+        dt_push_token(OF_DT_END, &mem_end);
+
+        /* Finish header */
+        hdr->boot_cpuid_phys = 0;
+        hdr->magic = OF_DT_HEADER;
+        hdr->totalsize = mem_end - mem_start;
+        hdr->version = OF_DT_VERSION;
+        /* Version 16 is not backward compatible */
+        hdr->last_comp_version = 0x10;
+
+        /* Reserve the whole thing and copy the reserve map in, we
+         * also bump mem_reserve_cnt to cause further reservations to
+         * fail since it's too late.
+         */
+        mem_end = _ALIGN(mem_end, PAGE_SIZE);
+        DBG("End of boot params: %x\n", mem_end);
+        rsvmap[0] = mem_start;
+        rsvmap[1] = mem_end;
+        rsvmap[2] = 0;
+        rsvmap[3] = 0;
+
+        return (unsigned long)hdr;
+}
+
+
+#ifdef CONFIG_BOOTX_TEXT
+static void __init btext_welcome(boot_infos_t *bi)
+{
+        unsigned long flags;
+        unsigned long pvr;
+
+        bootx_printf("Welcome to Linux, kernel " UTS_RELEASE "\n");
+        bootx_printf("\nlinked at        : 0x%x", KERNELBASE);
+        bootx_printf("\nframe buffer at  : 0x%x", bi->dispDeviceBase);
+        bootx_printf(" (phys), 0x%x", bi->logicalDisplayBase);
+        bootx_printf(" (log)");
+        bootx_printf("\nklimit           : 0x%x",(unsigned long)klimit);
+        bootx_printf("\nboot_info at     : 0x%x", bi);
+        __asm__ __volatile__ ("mfmsr %0" : "=r" (flags));
+        bootx_printf("\nMSR              : 0x%x", flags);
+        __asm__ __volatile__ ("mfspr %0, 287" : "=r" (pvr));
+        bootx_printf("\nPVR              : 0x%x", pvr);
+        pvr >>= 16;
+        if (pvr > 1) {
+            __asm__ __volatile__ ("mfspr %0, 1008" : "=r" (flags));
+            bootx_printf("\nHID0             : 0x%x", flags);
+        }
+        if (pvr == 8 || pvr == 12 || pvr == 0x800c) {
+            __asm__ __volatile__ ("mfspr %0, 1019" : "=r" (flags));
+            bootx_printf("\nICTC             : 0x%x", flags);
+        }
+#ifdef DEBUG
+        bootx_printf("\n\n");
+        bootx_printf("bi->deviceTreeOffset   : 0x%x\n",
+                     bi->deviceTreeOffset);
+        bootx_printf("bi->deviceTreeSize     : 0x%x\n",
+                     bi->deviceTreeSize);
+#endif
+        bootx_printf("\n\n");
+}
+#endif /* CONFIG_BOOTX_TEXT */
+
+void __init bootx_init(unsigned long r3, unsigned long r4)
+{
+        boot_infos_t *bi = (boot_infos_t *) r4;
+        unsigned long hdr;
+        unsigned long space;
+        unsigned long ptr, x;
+        char *model;
+        unsigned long offset = reloc_offset();
+
+        reloc_got2(offset);
+
+        bootx_info = bi;
+
+        /* We haven't cleared any bss at this point, make sure
+         * what we need is initialized
+         */
+        bootx_dt_strbase = bootx_dt_strend = 0;
+        bootx_node_chosen = 0;
+        bootx_disp_path[0] = 0;
+
+        if (!BOOT_INFO_IS_V2_COMPATIBLE(bi))
+                bi->logicalDisplayBase = bi->dispDeviceBase;
+
+#ifdef CONFIG_BOOTX_TEXT
+        btext_setup_display(bi->dispDeviceRect[2] - bi->dispDeviceRect[0],
+                            bi->dispDeviceRect[3] - bi->dispDeviceRect[1],
+                            bi->dispDeviceDepth, bi->dispDeviceRowBytes,
+                            (unsigned long)bi->logicalDisplayBase);
+        btext_clearscreen();
+        btext_flushscreen();
+#endif /* CONFIG_BOOTX_TEXT */
+
+        /*
+         * Test if boot-info is compatible.  Done only in config
+         * CONFIG_BOOTX_TEXT since there is nothing much we can do
+         * with an incompatible version, except display a message
+         * and eventually hang the processor...
+         *
+         * I'll try to keep enough of boot-info compatible in the
+         * future to always allow display of this message;
+         */
+        if (!BOOT_INFO_IS_COMPATIBLE(bi)) {
+                bootx_printf(" !!! WARNING - Incompatible version"
+                             " of BootX !!!\n\n\n");
+                for (;;)
+                        ;
+        }
+        if (bi->architecture != BOOT_ARCH_PCI) {
+                bootx_printf(" !!! WARNING - Usupported machine"
+                             " architecture !\n");
+                for (;;)
+                        ;
+        }
+
+#ifdef CONFIG_BOOTX_TEXT
+        btext_welcome(bi);
+#endif
+        /* New BootX enters kernel with MMU off, i/os are not allowed
+         * here. This hack will have been done by the boostrap anyway.
+         */
+        if (bi->version < 4) {
+                /*
+                 * XXX If this is an iMac, turn off the USB controller.
+                 */
+                model = (char *) bootx_early_getprop(r4 + bi->deviceTreeOffset,
+                                                     4, "model");
+                if (model
+                    && (strcmp(model, "iMac,1") == 0
+                        || strcmp(model, "PowerMac1,1") == 0)) {
+                        bootx_printf("iMac,1 detected, shutting down USB \n");
+                        out_le32((unsigned *)0x80880008, 1);    /* XXX */
+                }
+        }
+
+        /* Get a pointer that points above the device tree, args, ramdisk,
+         * etc... to use for generating the flattened tree
+         */
+        if (bi->version < 5) {
+                space = bi->deviceTreeOffset + bi->deviceTreeSize;
+                if (bi->ramDisk)
+                        space = bi->ramDisk + bi->ramDiskSize;
+        } else
+                space = bi->totalParamsSize;
+
+        bootx_printf("Total space used by parameters & ramdisk: %x \n", space);
+
+        /* New BootX will have flushed all TLBs and enters kernel with
+         * MMU switched OFF, so this should not be useful anymore.
+         */
+        if (bi->version < 4) {
+                bootx_printf("Touching pages...\n");
+
+                /*
+                 * Touch each page to make sure the PTEs for them
+                 * are in the hash table - the aim is to try to avoid
+                 * getting DSI exceptions while copying the kernel image.
+                 */
+                for (ptr = ((unsigned long) &_stext) & PAGE_MASK;
+                     ptr < (unsigned long)bi + space; ptr += PAGE_SIZE)
+                        x = *(volatile unsigned long *)ptr;
+        }
+
+        /* Ok, now we need to generate a flattened device-tree to pass
+         * to the kernel
+         */
+        bootx_printf("Preparing boot params...\n");
+
+        hdr = bootx_flatten_dt(space);
+
+#ifdef CONFIG_BOOTX_TEXT
+#ifdef SET_BOOT_BAT
+        bootx_printf("Preparing BAT...\n");
+        btext_prepare_BAT();
+#else
+        btext_unmap();
+#endif
+#endif
+
+        reloc_got2(-offset);
+
+        __start(hdr, KERNELBASE + offset, 0);
+}
diff --git a/arch/powerpc/platforms/powermac/cpufreq_64.c b/arch/powerpc/platforms/powermac/cpufreq_64.c
index 39150342c6f1..a4b50c4109c2 100644
--- a/arch/powerpc/platforms/powermac/cpufreq_64.c
+++ b/arch/powerpc/platforms/powermac/cpufreq_64.c
@@ -28,6 +28,7 @@
 #include <asm/cputable.h>
 #include <asm/time.h>
 #include <asm/smu.h>
+#include <asm/pmac_pfunc.h>
 
 #undef DEBUG
 
@@ -85,6 +86,10 @@ static u32 *g5_pmode_data;
 static int g5_pmode_max;
 static int g5_pmode_cur;
 
+static void (*g5_switch_volt)(int speed_mode);
+static int (*g5_switch_freq)(int speed_mode);
+static int (*g5_query_freq)(void);
+
 static DECLARE_MUTEX(g5_switch_mutex);
 
 
@@ -92,9 +97,11 @@ static struct smu_sdbp_fvt *g5_fvt_table;	/* table of op. points */
 static int g5_fvt_count;                        /* number of op. points */
 static int g5_fvt_cur;                          /* current op. point */
 
-/* ----------------- real hardware interface */
+/*
+ * SMU based voltage switching for Neo2 platforms
+ */
 
-static void g5_switch_volt(int speed_mode)
+static void g5_smu_switch_volt(int speed_mode)
 {
         struct smu_simple_cmd   cmd;
 
@@ -105,26 +112,57 @@ static void g5_switch_volt(int speed_mode)
         wait_for_completion(&comp);
 }
 
-static int g5_switch_freq(int speed_mode)
+/*
+ * Platform function based voltage/vdnap switching for Neo2
+ */
+
+static struct pmf_function *pfunc_set_vdnap0;
+static struct pmf_function *pfunc_vdnap0_complete;
+
+static void g5_vdnap_switch_volt(int speed_mode)
 {
-        struct cpufreq_freqs freqs;
-        int to;
+        struct pmf_args args;
+        u32 slew, done = 0;
+        unsigned long timeout;
 
-        if (g5_pmode_cur == speed_mode)
-                return 0;
+        slew = (speed_mode == CPUFREQ_LOW) ? 1 : 0;
+        args.count = 1;
+        args.u[0].p = &slew;
 
-        down(&g5_switch_mutex);
+        pmf_call_one(pfunc_set_vdnap0, &args);
 
-        freqs.old = g5_cpu_freqs[g5_pmode_cur].frequency;
-        freqs.new = g5_cpu_freqs[speed_mode].frequency;
-        freqs.cpu = 0;
+        /* It's an irq GPIO so we should be able to just block here,
+         * I'll do that later after I've properly tested the IRQ code for
+         * platform functions
+         */
+        timeout = jiffies + HZ/10;
+        while(!time_after(jiffies, timeout)) {
+                args.count = 1;
+                args.u[0].p = &done;
+                pmf_call_one(pfunc_vdnap0_complete, &args);
+                if (done)
+                        break;
+                msleep(1);
+        }
+        if (done == 0)
+                printk(KERN_WARNING "cpufreq: Timeout in clock slewing !\n");
+}
 
-        cpufreq_notify_transition(&freqs, CPUFREQ_PRECHANGE);
+
+/*
+ * SCOM based frequency switching for 970FX rev3
+ */
+static int g5_scom_switch_freq(int speed_mode)
+{
+        unsigned long flags;
+        int to;
 
         /* If frequency is going up, first ramp up the voltage */
         if (speed_mode < g5_pmode_cur)
                 g5_switch_volt(speed_mode);
 
+        local_irq_save(flags);
+
         /* Clear PCR high */
         scom970_write(SCOM_PCR, 0);
         /* Clear PCR low */
@@ -147,6 +185,8 @@ static int g5_switch_freq(int speed_mode)
                 udelay(100);
         }
 
+        local_irq_restore(flags);
+
         /* If frequency is going down, last ramp the voltage */
         if (speed_mode > g5_pmode_cur)
                 g5_switch_volt(speed_mode);
@@ -154,14 +194,10 @@ static int g5_switch_freq(int speed_mode)
         g5_pmode_cur = speed_mode;
         ppc_proc_freq = g5_cpu_freqs[speed_mode].frequency * 1000ul;
 
-        cpufreq_notify_transition(&freqs, CPUFREQ_POSTCHANGE);
-
-        up(&g5_switch_mutex);
-
         return 0;
 }
 
-static int g5_query_freq(void)
+static int g5_scom_query_freq(void)
 {
         unsigned long psr = scom970_read(SCOM_PSR);
         int i;
@@ -173,7 +209,104 @@ static int g5_query_freq(void)
         return i;
 }
 
-/* ----------------- cpufreq bookkeeping */
+/*
+ * Platform function based voltage switching for PowerMac7,2 & 7,3
+ */
+
+static struct pmf_function *pfunc_cpu0_volt_high;
+static struct pmf_function *pfunc_cpu0_volt_low;
+static struct pmf_function *pfunc_cpu1_volt_high;
+static struct pmf_function *pfunc_cpu1_volt_low;
+
+static void g5_pfunc_switch_volt(int speed_mode)
+{
+        if (speed_mode == CPUFREQ_HIGH) {
+                if (pfunc_cpu0_volt_high)
+                        pmf_call_one(pfunc_cpu0_volt_high, NULL);
+                if (pfunc_cpu1_volt_high)
+                        pmf_call_one(pfunc_cpu1_volt_high, NULL);
+        } else {
+                if (pfunc_cpu0_volt_low)
+                        pmf_call_one(pfunc_cpu0_volt_low, NULL);
+                if (pfunc_cpu1_volt_low)
+                        pmf_call_one(pfunc_cpu1_volt_low, NULL);
+        }
+        msleep(10); /* should be faster , to fix */
+}
+
+/*
+ * Platform function based frequency switching for PowerMac7,2 & 7,3
+ */
+
+static struct pmf_function *pfunc_cpu_setfreq_high;
+static struct pmf_function *pfunc_cpu_setfreq_low;
+static struct pmf_function *pfunc_cpu_getfreq;
+static struct pmf_function *pfunc_slewing_done;;
+
+static int g5_pfunc_switch_freq(int speed_mode)
+{
+        struct pmf_args args;
+        u32 done = 0;
+        unsigned long timeout;
+
+        /* If frequency is going up, first ramp up the voltage */
+        if (speed_mode < g5_pmode_cur)
+                g5_switch_volt(speed_mode);
+
+        /* Do it */
+        if (speed_mode == CPUFREQ_HIGH)
+                pmf_call_one(pfunc_cpu_setfreq_high, NULL);
+        else
+                pmf_call_one(pfunc_cpu_setfreq_low, NULL);
+
+        /* It's an irq GPIO so we should be able to just block here,
+         * I'll do that later after I've properly tested the IRQ code for
+         * platform functions
+         */
+        timeout = jiffies + HZ/10;
+        while(!time_after(jiffies, timeout)) {
+                args.count = 1;
+                args.u[0].p = &done;
+                pmf_call_one(pfunc_slewing_done, &args);
+                if (done)
+                        break;
+                msleep(1);
+        }
+        if (done == 0)
+                printk(KERN_WARNING "cpufreq: Timeout in clock slewing !\n");
+
+        /* If frequency is going down, last ramp the voltage */
+        if (speed_mode > g5_pmode_cur)
+                g5_switch_volt(speed_mode);
+
+        g5_pmode_cur = speed_mode;
+        ppc_proc_freq = g5_cpu_freqs[speed_mode].frequency * 1000ul;
+
+        return 0;
+}
+
+static int g5_pfunc_query_freq(void)
+{
+        struct pmf_args args;
+        u32 val = 0;
+
+        args.count = 1;
+        args.u[0].p = &val;
+        pmf_call_one(pfunc_cpu_getfreq, &args);
+        return val ? CPUFREQ_HIGH : CPUFREQ_LOW;
+}
+
+/*
+ * Fake voltage switching for platforms with missing support
+ */
+
+static void g5_dummy_switch_volt(int speed_mode)
+{
+}
+
+/*
+ * Common interface to the cpufreq core
+ */
 
 static int g5_cpufreq_verify(struct cpufreq_policy *policy)
 {
@@ -183,13 +316,30 @@ static int g5_cpufreq_verify(struct cpufreq_policy *policy)
 static int g5_cpufreq_target(struct cpufreq_policy *policy,
         unsigned int target_freq, unsigned int relation)
 {
-        unsigned int    newstate = 0;
+        unsigned int newstate = 0;
+        struct cpufreq_freqs freqs;
+        int rc;
 
         if (cpufreq_frequency_table_target(policy, g5_cpu_freqs,
                         target_freq, relation, &newstate))
                 return -EINVAL;
 
-        return g5_switch_freq(newstate);
+        if (g5_pmode_cur == newstate)
+                return 0;
+
+        down(&g5_switch_mutex);
+
+        freqs.old = g5_cpu_freqs[g5_pmode_cur].frequency;
+        freqs.new = g5_cpu_freqs[newstate].frequency;
+        freqs.cpu = 0;
+
+        cpufreq_notify_transition(&freqs, CPUFREQ_PRECHANGE);
+        rc = g5_switch_freq(newstate);
+        cpufreq_notify_transition(&freqs, CPUFREQ_POSTCHANGE);
+
+        up(&g5_switch_mutex);
+
+        return rc;
 }
 
 static unsigned int g5_cpufreq_get_speed(unsigned int cpu)
@@ -205,6 +355,7 @@ static int g5_cpufreq_cpu_init(struct cpufreq_policy *policy)
         policy->governor = CPUFREQ_DEFAULT_GOVERNOR;
         policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
         policy->cur = g5_cpu_freqs[g5_query_freq()].frequency;
+        policy->cpus = cpu_possible_map;
         cpufreq_frequency_table_get_attr(g5_cpu_freqs, policy->cpu);
 
         return cpufreq_frequency_table_cpuinfo(policy,
@@ -224,19 +375,39 @@ static struct cpufreq_driver g5_cpufreq_driver = {
 };
 
 
-static int __init g5_cpufreq_init(void)
+static int __init g5_neo2_cpufreq_init(struct device_node *cpus)
 {
         struct device_node *cpunode;
         unsigned int psize, ssize;
-        struct smu_sdbp_header *shdr;
         unsigned long max_freq;
-        u32 *valp;
+        char *freq_method, *volt_method;
+        u32 *valp, pvr_hi;
+        int use_volts_vdnap = 0;
+        int use_volts_smu = 0;
         int rc = -ENODEV;
 
-        /* Look for CPU and SMU nodes */
-        cpunode = of_find_node_by_type(NULL, "cpu");
-        if (!cpunode) {
-                DBG("No CPU node !\n");
+        /* Check supported platforms */
+        if (machine_is_compatible("PowerMac8,1") ||
+            machine_is_compatible("PowerMac8,2") ||
+            machine_is_compatible("PowerMac9,1"))
+                use_volts_smu = 1;
+        else if (machine_is_compatible("PowerMac11,2"))
+                use_volts_vdnap = 1;
+        else
+                return -ENODEV;
+
+        /* Get first CPU node */
+        for (cpunode = NULL;
+             (cpunode = of_get_next_child(cpus, cpunode)) != NULL;) {
+                u32 *reg =
+                        (u32 *)get_property(cpunode, "reg", NULL);
+                if (reg == NULL || (*reg) != 0)
+                        continue;
+                if (!strcmp(cpunode->type, "cpu"))
+                        break;
+        }
+        if (cpunode == NULL) {
+                printk(KERN_ERR "cpufreq: Can't find any CPU 0 node\n");
                 return -ENODEV;
         }
 
@@ -246,8 +417,9 @@ static int __init g5_cpufreq_init(void)
                 DBG("No cpu-version property !\n");
                 goto bail_noprops;
         }
-        if (((*valp) >> 16) != 0x3c) {
-                DBG("Wrong CPU version: %08x\n", *valp);
+        pvr_hi = (*valp) >> 16;
+        if (pvr_hi != 0x3c && pvr_hi != 0x44) {
+                printk(KERN_ERR "cpufreq: Unsupported CPU version\n");
                 goto bail_noprops;
         }
 
@@ -259,18 +431,50 @@ static int __init g5_cpufreq_init(void)
         }
         g5_pmode_max = psize / sizeof(u32) - 1;
 
-        /* Look for the FVT table */
-        shdr = smu_get_sdb_partition(SMU_SDB_FVT_ID, NULL);
-        if (!shdr)
-                goto bail_noprops;
-        g5_fvt_table = (struct smu_sdbp_fvt *)&shdr[1];
-        ssize = (shdr->len * sizeof(u32)) - sizeof(struct smu_sdbp_header);
-        g5_fvt_count = ssize / sizeof(struct smu_sdbp_fvt);
-        g5_fvt_cur = 0;
-
-        /* Sanity checking */
-        if (g5_fvt_count < 1 || g5_pmode_max < 1)
-                goto bail_noprops;
+        if (use_volts_smu) {
+                struct smu_sdbp_header *shdr;
+
+                /* Look for the FVT table */
+                shdr = smu_get_sdb_partition(SMU_SDB_FVT_ID, NULL);
+                if (!shdr)
+                        goto bail_noprops;
+                g5_fvt_table = (struct smu_sdbp_fvt *)&shdr[1];
+                ssize = (shdr->len * sizeof(u32)) -
+                        sizeof(struct smu_sdbp_header);
+                g5_fvt_count = ssize / sizeof(struct smu_sdbp_fvt);
+                g5_fvt_cur = 0;
+
+                /* Sanity checking */
+                if (g5_fvt_count < 1 || g5_pmode_max < 1)
+                        goto bail_noprops;
+
+                g5_switch_volt = g5_smu_switch_volt;
+                volt_method = "SMU";
+        } else if (use_volts_vdnap) {
+                struct device_node *root;
+
+                root = of_find_node_by_path("/");
+                if (root == NULL) {
+                        printk(KERN_ERR "cpufreq: Can't find root of "
+                               "device tree\n");
+                        goto bail_noprops;
+                }
+                pfunc_set_vdnap0 = pmf_find_function(root, "set-vdnap0");
+                pfunc_vdnap0_complete =
+                        pmf_find_function(root, "slewing-done");
+                if (pfunc_set_vdnap0 == NULL ||
+                    pfunc_vdnap0_complete == NULL) {
+                        printk(KERN_ERR "cpufreq: Can't find required "
+                               "platform function\n");
+                        goto bail_noprops;
+                }
+
+                g5_switch_volt = g5_vdnap_switch_volt;
+                volt_method = "GPIO";
+        } else {
+                g5_switch_volt = g5_dummy_switch_volt;
+                volt_method = "none";
+        }
 
         /*
          * From what I see, clock-frequency is always the maximal frequency.
@@ -286,19 +490,23 @@ static int __init g5_cpufreq_init(void)
         g5_cpu_freqs[0].frequency = max_freq;
         g5_cpu_freqs[1].frequency = max_freq/2;
 
-        /* Check current frequency */
-        g5_pmode_cur = g5_query_freq();
-        if (g5_pmode_cur > 1)
-                /* We don't support anything but 1:1 and 1:2, fixup ... */
-                g5_pmode_cur = 1;
+        /* Set callbacks */
+        g5_switch_freq = g5_scom_switch_freq;
+        g5_query_freq = g5_scom_query_freq;
+        freq_method = "SCOM";
 
         /* Force apply current frequency to make sure everything is in
          * sync (voltage is right for example). Firmware may leave us with
          * a strange setting ...
          */
-        g5_switch_freq(g5_pmode_cur);
+        g5_switch_volt(CPUFREQ_HIGH);
+        msleep(10);
+        g5_pmode_cur = -1;
+        g5_switch_freq(g5_query_freq());
 
         printk(KERN_INFO "Registering G5 CPU frequency driver\n");
+        printk(KERN_INFO "Frequency method: %s, Voltage method: %s\n",
+               freq_method, volt_method);
         printk(KERN_INFO "Low: %d Mhz, High: %d Mhz, Cur: %d MHz\n",
                 g5_cpu_freqs[1].frequency/1000,
                 g5_cpu_freqs[0].frequency/1000,
@@ -317,6 +525,200 @@ static int __init g5_cpufreq_init(void)
         return rc;
 }
 
+static int __init g5_pm72_cpufreq_init(struct device_node *cpus)
+{
+        struct device_node *cpuid = NULL, *hwclock = NULL, *cpunode = NULL;
+        u8 *eeprom = NULL;
+        u32 *valp;
+        u64 max_freq, min_freq, ih, il;
+        int has_volt = 1, rc = 0;
+
+        /* Get first CPU node */
+        for (cpunode = NULL;
+             (cpunode = of_get_next_child(cpus, cpunode)) != NULL;) {
+                if (!strcmp(cpunode->type, "cpu"))
+                        break;
+        }
+        if (cpunode == NULL) {
+                printk(KERN_ERR "cpufreq: Can't find any CPU node\n");
+                return -ENODEV;
+        }
+
+        /* Lookup the cpuid eeprom node */
+        cpuid = of_find_node_by_path("/u3@0,f8000000/i2c@f8001000/cpuid@a0");
+        if (cpuid != NULL)
+                eeprom = (u8 *)get_property(cpuid, "cpuid", NULL);
+        if (eeprom == NULL) {
+                printk(KERN_ERR "cpufreq: Can't find cpuid EEPROM !\n");
+                rc = -ENODEV;
+                goto bail;
+        }
+
+        /* Lookup the i2c hwclock */
+        for (hwclock = NULL;
+             (hwclock = of_find_node_by_name(hwclock, "i2c-hwclock")) != NULL;){
+                char *loc = get_property(hwclock, "hwctrl-location", NULL);
+                if (loc == NULL)
+                        continue;
+                if (strcmp(loc, "CPU CLOCK"))
+                        continue;
+                if (!get_property(hwclock, "platform-get-frequency", NULL))
+                        continue;
+                break;
+        }
+        if (hwclock == NULL) {
+                printk(KERN_ERR "cpufreq: Can't find i2c clock chip !\n");
+                rc = -ENODEV;
+                goto bail;
+        }
+
+        DBG("cpufreq: i2c clock chip found: %s\n", hwclock->full_name);
+
+        /* Now get all the platform functions */
+        pfunc_cpu_getfreq =
+                pmf_find_function(hwclock, "get-frequency");
+        pfunc_cpu_setfreq_high =
+                pmf_find_function(hwclock, "set-frequency-high");
+        pfunc_cpu_setfreq_low =
+                pmf_find_function(hwclock, "set-frequency-low");
+        pfunc_slewing_done =
+                pmf_find_function(hwclock, "slewing-done");
+        pfunc_cpu0_volt_high =
+                pmf_find_function(hwclock, "set-voltage-high-0");
+        pfunc_cpu0_volt_low =
+                pmf_find_function(hwclock, "set-voltage-low-0");
+        pfunc_cpu1_volt_high =
+                pmf_find_function(hwclock, "set-voltage-high-1");
+        pfunc_cpu1_volt_low =
+                pmf_find_function(hwclock, "set-voltage-low-1");
+
+        /* Check we have minimum requirements */
+        if (pfunc_cpu_getfreq == NULL || pfunc_cpu_setfreq_high == NULL ||
+            pfunc_cpu_setfreq_low == NULL || pfunc_slewing_done == NULL) {
+                printk(KERN_ERR "cpufreq: Can't find platform functions !\n");
+                rc = -ENODEV;
+                goto bail;
+        }
+
+        /* Check that we have complete sets */
+        if (pfunc_cpu0_volt_high == NULL || pfunc_cpu0_volt_low == NULL) {
+                pmf_put_function(pfunc_cpu0_volt_high);
+                pmf_put_function(pfunc_cpu0_volt_low);
+                pfunc_cpu0_volt_high = pfunc_cpu0_volt_low = NULL;
+                has_volt = 0;
+        }
+        if (!has_volt ||
+            pfunc_cpu1_volt_high == NULL || pfunc_cpu1_volt_low == NULL) {
+                pmf_put_function(pfunc_cpu1_volt_high);
+                pmf_put_function(pfunc_cpu1_volt_low);
+                pfunc_cpu1_volt_high = pfunc_cpu1_volt_low = NULL;
+        }
+
+        /* Note: The device tree also contains a "platform-set-values"
+         * function for which I haven't quite figured out the usage. It
+         * might have to be called on init and/or wakeup, I'm not too sure
+         * but things seem to work fine without it so far ...
+         */
+
+        /* Get max frequency from device-tree */
+        valp = (u32 *)get_property(cpunode, "clock-frequency", NULL);
+        if (!valp) {
+                printk(KERN_ERR "cpufreq: Can't find CPU frequency !\n");
+                rc = -ENODEV;
+                goto bail;
+        }
+
+        max_freq = (*valp)/1000;
+
+        /* Now calculate reduced frequency by using the cpuid input freq
+         * ratio. This requires 64 bits math unless we are willing to lose
+         * some precision
+         */
+        ih = *((u32 *)(eeprom + 0x10));
+        il = *((u32 *)(eeprom + 0x20));
+        min_freq = 0;
+        if (ih != 0 && il != 0)
+                min_freq = (max_freq * il) / ih;
+
+        /* Sanity check */
+        if (min_freq >= max_freq || min_freq < 1000) {
+                printk(KERN_ERR "cpufreq: Can't calculate low frequency !\n");
+                rc = -ENODEV;
+                goto bail;
+        }
+        g5_cpu_freqs[0].frequency = max_freq;
+        g5_cpu_freqs[1].frequency = min_freq;
+
+        /* Set callbacks */
+        g5_switch_volt = g5_pfunc_switch_volt;
+        g5_switch_freq = g5_pfunc_switch_freq;
+        g5_query_freq = g5_pfunc_query_freq;
+
+        /* Force apply current frequency to make sure everything is in
+         * sync (voltage is right for example). Firmware may leave us with
+         * a strange setting ...
+         */
+        g5_switch_volt(CPUFREQ_HIGH);
+        msleep(10);
+        g5_pmode_cur = -1;
+        g5_switch_freq(g5_query_freq());
+
+        printk(KERN_INFO "Registering G5 CPU frequency driver\n");
+        printk(KERN_INFO "Frequency method: i2c/pfunc, "
+               "Voltage method: %s\n", has_volt ? "i2c/pfunc" : "none");
+        printk(KERN_INFO "Low: %d Mhz, High: %d Mhz, Cur: %d MHz\n",
+                g5_cpu_freqs[1].frequency/1000,
+                g5_cpu_freqs[0].frequency/1000,
+                g5_cpu_freqs[g5_pmode_cur].frequency/1000);
+
+        rc = cpufreq_register_driver(&g5_cpufreq_driver);
+ bail:
+        if (rc != 0) {
+                pmf_put_function(pfunc_cpu_getfreq);
+                pmf_put_function(pfunc_cpu_setfreq_high);
+                pmf_put_function(pfunc_cpu_setfreq_low);
+                pmf_put_function(pfunc_slewing_done);
+                pmf_put_function(pfunc_cpu0_volt_high);
+                pmf_put_function(pfunc_cpu0_volt_low);
+                pmf_put_function(pfunc_cpu1_volt_high);
+                pmf_put_function(pfunc_cpu1_volt_low);
+        }
+        of_node_put(hwclock);
+        of_node_put(cpuid);
+        of_node_put(cpunode);
+
+        return rc;
+}
+
+static int __init g5_rm31_cpufreq_init(struct device_node *cpus)
+{
+        /* NYI */
+        return 0;
+}
+
+static int __init g5_cpufreq_init(void)
+{
+        struct device_node *cpus;
+        int rc;
+
+        cpus = of_find_node_by_path("/cpus");
+        if (cpus == NULL) {
+                DBG("No /cpus node !\n");
+                return -ENODEV;
+        }
+
+        if (machine_is_compatible("PowerMac7,2") ||
+            machine_is_compatible("PowerMac7,3"))
+                rc = g5_pm72_cpufreq_init(cpus);
+        else if (machine_is_compatible("RackMac3,1"))
+                rc = g5_rm31_cpufreq_init(cpus);
+        else
+                rc = g5_neo2_cpufreq_init(cpus);
+
+        of_node_put(cpus);
+        return rc;
+}
+
 module_init(g5_cpufreq_init);
 
 
diff --git a/arch/powerpc/platforms/powermac/feature.c b/arch/powerpc/platforms/powermac/feature.c
index f6e22da2a5da..558dd0692092 100644
--- a/arch/powerpc/platforms/powermac/feature.c
+++ b/arch/powerpc/platforms/powermac/feature.c
@@ -58,12 +58,11 @@ extern int powersave_lowspeed;
 extern int powersave_nap;
 extern struct device_node *k2_skiplist[2];
 
-
 /*
  * We use a single global lock to protect accesses. Each driver has
  * to take care of its own locking
  */
-static DEFINE_SPINLOCK(feature_lock);
+DEFINE_SPINLOCK(feature_lock);
 
 #define LOCK(flags)     spin_lock_irqsave(&feature_lock, flags);
 #define UNLOCK(flags)   spin_unlock_irqrestore(&feature_lock, flags);
@@ -101,26 +100,17 @@ static const char *macio_names[] =
         "Keylargo",
         "Pangea",
         "Intrepid",
-        "K2"
+        "K2",
+        "Shasta",
 };
 
 
+struct device_node *uninorth_node;
+u32 __iomem *uninorth_base;
 
-/*
- * Uninorth reg. access. Note that Uni-N regs are big endian
- */
-
-#define UN_REG(r)       (uninorth_base + ((r) >> 2))
-#define UN_IN(r)        (in_be32(UN_REG(r)))
-#define UN_OUT(r,v)     (out_be32(UN_REG(r), (v)))
-#define UN_BIS(r,v)     (UN_OUT((r), UN_IN(r) | (v)))
-#define UN_BIC(r,v)     (UN_OUT((r), UN_IN(r) & ~(v)))
-
-static struct device_node *uninorth_node;
-static u32 __iomem *uninorth_base;
 static u32 uninorth_rev;
-static int uninorth_u3;
-static void __iomem *u3_ht;
+static int uninorth_maj;
+static void __iomem *u3_ht_base;
 
 /*
  * For each motherboard family, we have a table of functions pointers
@@ -1399,8 +1389,15 @@ static long g5_fw_enable(struct device_node *node, long param, long value)
 static long g5_mpic_enable(struct device_node *node, long param, long value)
 {
         unsigned long flags;
+        struct device_node *parent = of_get_parent(node);
+        int is_u3;
 
-        if (node->parent == NULL || strcmp(node->parent->name, "u3"))
+        if (parent == NULL)
+                return 0;
+        is_u3 = strcmp(parent->name, "u3") == 0 ||
+                strcmp(parent->name, "u4") == 0;
+        of_node_put(parent);
+        if (!is_u3)
                 return 0;
 
         LOCK(flags);
@@ -1445,20 +1442,53 @@ static long g5_i2s_enable(struct device_node *node, long param, long value)
         /* Very crude implementation for now */
         struct macio_chip *macio = &macio_chips[0];
         unsigned long flags;
-
-        if (value == 0)
-                return 0; /* don't disable yet */
+        int cell;
+        u32 fcrs[3][3] = {
+                { 0,
+                  K2_FCR1_I2S0_CELL_ENABLE |
+                  K2_FCR1_I2S0_CLK_ENABLE_BIT | K2_FCR1_I2S0_ENABLE,
+                  KL3_I2S0_CLK18_ENABLE
+                },
+                { KL0_SCC_A_INTF_ENABLE,
+                  K2_FCR1_I2S1_CELL_ENABLE |
+                  K2_FCR1_I2S1_CLK_ENABLE_BIT | K2_FCR1_I2S1_ENABLE,
+                  KL3_I2S1_CLK18_ENABLE
+                },
+                { KL0_SCC_B_INTF_ENABLE,
+                  SH_FCR1_I2S2_CELL_ENABLE |
+                  SH_FCR1_I2S2_CLK_ENABLE_BIT | SH_FCR1_I2S2_ENABLE,
+                  SH_FCR3_I2S2_CLK18_ENABLE
+                },
+        };
+
+        if (macio->type != macio_keylargo2 && macio->type != macio_shasta)
+                return -ENODEV;
+        if (strncmp(node->name, "i2s-", 4))
+                return -ENODEV;
+        cell = node->name[4] - 'a';
+        switch(cell) {
+        case 0:
+        case 1:
+                break;
+        case 2:
+                if (macio->type == macio_shasta)
+                        break;
+        default:
+                return -ENODEV;
+        }
 
         LOCK(flags);
-        MACIO_BIS(KEYLARGO_FCR3, KL3_CLK45_ENABLE | KL3_CLK49_ENABLE |
-                  KL3_I2S0_CLK18_ENABLE);
-        udelay(10);
-        MACIO_BIS(KEYLARGO_FCR1, K2_FCR1_I2S0_CELL_ENABLE |
-                  K2_FCR1_I2S0_CLK_ENABLE_BIT | K2_FCR1_I2S0_ENABLE);
+        if (value) {
+                MACIO_BIC(KEYLARGO_FCR0, fcrs[cell][0]);
+                MACIO_BIS(KEYLARGO_FCR1, fcrs[cell][1]);
+                MACIO_BIS(KEYLARGO_FCR3, fcrs[cell][2]);
+        } else {
+                MACIO_BIC(KEYLARGO_FCR3, fcrs[cell][2]);
+                MACIO_BIC(KEYLARGO_FCR1, fcrs[cell][1]);
+                MACIO_BIS(KEYLARGO_FCR0, fcrs[cell][0]);
+        }
         udelay(10);
-        MACIO_BIC(KEYLARGO_FCR1, K2_FCR1_I2S0_RESET);
         UNLOCK(flags);
-        udelay(10);
 
         return 0;
 }
@@ -1473,7 +1503,7 @@ static long g5_reset_cpu(struct device_node *node, long param, long value)
         struct device_node *np;
 
         macio = &macio_chips[0];
-        if (macio->type != macio_keylargo2)
+        if (macio->type != macio_keylargo2 && macio->type != macio_shasta)
                 return -ENODEV;
 
         np = find_path_device("/cpus");
@@ -1512,14 +1542,17 @@ static long g5_reset_cpu(struct device_node *node, long param, long value)
  */
 void g5_phy_disable_cpu1(void)
 {
-        UN_OUT(U3_API_PHY_CONFIG_1, 0);
+        if (uninorth_maj == 3)
+                UN_OUT(U3_API_PHY_CONFIG_1, 0);
 }
 #endif /* CONFIG_POWER4 */
 
 #ifndef CONFIG_POWER4
 
-static void
-keylargo_shutdown(struct macio_chip *macio, int sleep_mode)
+
+#ifdef CONFIG_PM
+
+static void keylargo_shutdown(struct macio_chip *macio, int sleep_mode)
 {
         u32 temp;
 
@@ -1572,8 +1605,7 @@ keylargo_shutdown(struct macio_chip *macio, int sleep_mode)
         (void)MACIO_IN32(KEYLARGO_FCR0); mdelay(1);
 }
 
-static void
-pangea_shutdown(struct macio_chip *macio, int sleep_mode)
+static void pangea_shutdown(struct macio_chip *macio, int sleep_mode)
 {
         u32 temp;
 
@@ -1606,8 +1638,7 @@ pangea_shutdown(struct macio_chip *macio, int sleep_mode)
         (void)MACIO_IN32(KEYLARGO_FCR0); mdelay(1);
 }
 
-static void
-intrepid_shutdown(struct macio_chip *macio, int sleep_mode)
+static void intrepid_shutdown(struct macio_chip *macio, int sleep_mode)
 {
         u32 temp;
 
@@ -1635,124 +1666,6 @@ intrepid_shutdown(struct macio_chip *macio, int sleep_mode)
 }
 
 
-void pmac_tweak_clock_spreading(int enable)
-{
-        struct macio_chip *macio = &macio_chips[0];
-
-        /* Hack for doing clock spreading on some machines PowerBooks and
-         * iBooks. This implements the "platform-do-clockspreading" OF
-         * property as decoded manually on various models. For safety, we also
-         * check the product ID in the device-tree in cases we'll whack the i2c
-         * chip to make reasonably sure we won't set wrong values in there
-         *
-         * Of course, ultimately, we have to implement a real parser for
-         * the platform-do-* stuff...
-         */
-
-        if (macio->type == macio_intrepid) {
-                struct device_node *clock =
-                        of_find_node_by_path("/uni-n@f8000000/hw-clock");
-                if (clock && get_property(clock, "platform-do-clockspreading",
-                                          NULL)) {
-                        printk(KERN_INFO "%sabling clock spreading on Intrepid"
-                               " ASIC\n", enable ? "En" : "Dis");
-                        if (enable)
-                                UN_OUT(UNI_N_CLOCK_SPREADING, 2);
-                        else
-                                UN_OUT(UNI_N_CLOCK_SPREADING, 0);
-                        mdelay(40);
-                }
-                of_node_put(clock);
-        }
-
-        while (machine_is_compatible("PowerBook5,2") ||
-               machine_is_compatible("PowerBook5,3") ||
-               machine_is_compatible("PowerBook6,2") ||
-               machine_is_compatible("PowerBook6,3")) {
-                struct device_node *ui2c = of_find_node_by_type(NULL, "i2c");
-                struct device_node *dt = of_find_node_by_name(NULL, "device-tree");
-                u8 buffer[9];
-                u32 *productID;
-                int i, rc, changed = 0;
-
-                if (dt == NULL)
-                        break;
-                productID = (u32 *)get_property(dt, "pid#", NULL);
-                if (productID == NULL)
-                        break;
-                while(ui2c) {
-                        struct device_node *p = of_get_parent(ui2c);
-                        if (p && !strcmp(p->name, "uni-n"))
-                                break;
-                        ui2c = of_find_node_by_type(ui2c, "i2c");
-                }
-                if (ui2c == NULL)
-                        break;
-                DBG("Trying to bump clock speed for PID: %08x...\n", *productID);
-                rc = pmac_low_i2c_open(ui2c, 1);
-                if (rc != 0)
-                        break;
-                pmac_low_i2c_setmode(ui2c, pmac_low_i2c_mode_combined);
-                rc = pmac_low_i2c_xfer(ui2c, 0xd2 | pmac_low_i2c_read, 0x80, buffer, 9);
-                DBG("read result: %d,", rc);
-                if (rc != 0) {
-                        pmac_low_i2c_close(ui2c);
-                        break;
-                }
-                for (i=0; i<9; i++)
-                        DBG(" %02x", buffer[i]);
-                DBG("\n");
-
-                switch(*productID) {
-                case 0x1182:    /* AlBook 12" rev 2 */
-                case 0x1183:    /* iBook G4 12" */
-                        buffer[0] = (buffer[0] & 0x8f) | 0x70;
-                        buffer[2] = (buffer[2] & 0x7f) | 0x00;
-                        buffer[5] = (buffer[5] & 0x80) | 0x31;
-                        buffer[6] = (buffer[6] & 0x40) | 0xb0;
-                        buffer[7] = (buffer[7] & 0x00) | (enable ? 0xc0 : 0xba);
-                        buffer[8] = (buffer[8] & 0x00) | 0x30;
-                        changed = 1;
-                        break;
-                case 0x3142:    /* AlBook 15" (ATI M10) */
-                case 0x3143:    /* AlBook 17" (ATI M10) */
-                        buffer[0] = (buffer[0] & 0xaf) | 0x50;
-                        buffer[2] = (buffer[2] & 0x7f) | 0x00;
-                        buffer[5] = (buffer[5] & 0x80) | 0x31;
-                        buffer[6] = (buffer[6] & 0x40) | 0xb0;
-                        buffer[7] = (buffer[7] & 0x00) | (enable ? 0xd0 : 0xc0);
-                        buffer[8] = (buffer[8] & 0x00) | 0x30;
-                        changed = 1;
-                        break;
-                default:
-                        DBG("i2c-hwclock: Machine model not handled\n");
-                        break;
-                }
-                if (!changed) {
-                        pmac_low_i2c_close(ui2c);
-                        break;
-                }
-                printk(KERN_INFO "%sabling clock spreading on i2c clock chip\n",
-                       enable ? "En" : "Dis");
-
-                pmac_low_i2c_setmode(ui2c, pmac_low_i2c_mode_stdsub);
-                rc = pmac_low_i2c_xfer(ui2c, 0xd2 | pmac_low_i2c_write, 0x80, buffer, 9);
-                DBG("write result: %d,", rc);
-                pmac_low_i2c_setmode(ui2c, pmac_low_i2c_mode_combined);
-                rc = pmac_low_i2c_xfer(ui2c, 0xd2 | pmac_low_i2c_read, 0x80, buffer, 9);
-                DBG("read result: %d,", rc);
-                if (rc != 0) {
-                        pmac_low_i2c_close(ui2c);
-                        break;
-                }
-                for (i=0; i<9; i++)
-                        DBG(" %02x", buffer[i]);
-                pmac_low_i2c_close(ui2c);
-                break;
-        }
-}
-
-
 static int
 core99_sleep(void)
 {
@@ -1909,6 +1822,8 @@ core99_wake_up(void)
         return 0;
 }
 
+#endif /* CONFIG_PM */
+
 static long
 core99_sleep_state(struct device_node *node, long param, long value)
 {
@@ -1930,10 +1845,13 @@ core99_sleep_state(struct device_node *node, long param, long value)
         if ((pmac_mb.board_flags & PMAC_MB_CAN_SLEEP) == 0)
                 return -EPERM;
 
+#ifdef CONFIG_PM
         if (value == 1)
                 return core99_sleep();
         else if (value == 0)
                 return core99_wake_up();
+
+#endif /* CONFIG_PM */
         return 0;
 }
 
@@ -2057,7 +1975,9 @@ static struct feature_table_entry core99_features[] = {
         { PMAC_FTR_USB_ENABLE,          core99_usb_enable },
         { PMAC_FTR_1394_ENABLE,         core99_firewire_enable },
         { PMAC_FTR_1394_CABLE_POWER,    core99_firewire_cable_power },
+#ifdef CONFIG_PM
         { PMAC_FTR_SLEEP_STATE,         core99_sleep_state },
+#endif
 #ifdef CONFIG_SMP
         { PMAC_FTR_RESET_CPU,           core99_reset_cpu },
 #endif /* CONFIG_SMP */
@@ -2427,6 +2347,14 @@ static struct pmac_mb_def pmac_mb_defs[] = {
                 PMAC_TYPE_POWERMAC_G5_U3L,      g5_features,
                 0,
         },
+        {       "PowerMac11,2",                 "PowerMac G5 Dual Core",
+                PMAC_TYPE_POWERMAC_G5_U3L,      g5_features,
+                0,
+        },
+        {       "PowerMac12,1",                 "iMac G5 (iSight)",
+                PMAC_TYPE_POWERMAC_G5_U3L,      g5_features,
+                0,
+        },
         {       "RackMac3,1",                   "XServe G5",
                 PMAC_TYPE_XSERVE_G5,            g5_features,
                 0,
@@ -2539,6 +2467,11 @@ static int __init probe_motherboard(void)
                 pmac_mb.model_name = "Unknown K2-based";
                 pmac_mb.features = g5_features;
                 break;
+        case macio_shasta:
+                pmac_mb.model_id = PMAC_TYPE_UNKNOWN_SHASTA;
+                pmac_mb.model_name = "Unknown Shasta-based";
+                pmac_mb.features = g5_features;
+                break;
 #endif /* CONFIG_POWER4 */
         default:
                 return -ENODEV;
@@ -2607,6 +2540,8 @@ found:
  */
 static void __init probe_uninorth(void)
 {
+        u32 *addrp;
+        phys_addr_t address;
         unsigned long actrl;
 
         /* Locate core99 Uni-N */
@@ -2614,22 +2549,31 @@ static void __init probe_uninorth(void)
         /* Locate G5 u3 */
         if (uninorth_node == NULL) {
                 uninorth_node = of_find_node_by_name(NULL, "u3");
-                uninorth_u3 = 1;
-        }
-        if (uninorth_node && uninorth_node->n_addrs > 0) {
-                unsigned long address = uninorth_node->addrs[0].address;
-                uninorth_base = ioremap(address, 0x40000);
-                uninorth_rev = in_be32(UN_REG(UNI_N_VERSION));
-                if (uninorth_u3)
-                        u3_ht = ioremap(address + U3_HT_CONFIG_BASE, 0x1000);
-        } else
-                uninorth_node = NULL;
-
-        if (!uninorth_node)
+                uninorth_maj = 3;
+        }
+        /* Locate G5 u4 */
+        if (uninorth_node == NULL) {
+                uninorth_node = of_find_node_by_name(NULL, "u4");
+                uninorth_maj = 4;
+        }
+        if (uninorth_node == NULL)
                 return;
 
-        printk(KERN_INFO "Found %s memory controller & host bridge, revision: %d\n",
-               uninorth_u3 ? "U3" : "UniNorth", uninorth_rev);
+        addrp = (u32 *)get_property(uninorth_node, "reg", NULL);
+        if (addrp == NULL)
+                return;
+        address = of_translate_address(uninorth_node, addrp);
+        if (address == 0)
+                return;
+        uninorth_base = ioremap(address, 0x40000);
+        uninorth_rev = in_be32(UN_REG(UNI_N_VERSION));
+        if (uninorth_maj == 3 || uninorth_maj == 4)
+                u3_ht_base = ioremap(address + U3_HT_CONFIG_BASE, 0x1000);
+
+        printk(KERN_INFO "Found %s memory controller & host bridge"
+               " @ 0x%08x revision: 0x%02x\n", uninorth_maj == 3 ? "U3" :
+               uninorth_maj == 4 ? "U4" : "UniNorth",
+               (unsigned int)address, uninorth_rev);
         printk(KERN_INFO "Mapped at 0x%08lx\n", (unsigned long)uninorth_base);
 
         /* Set the arbitrer QAck delay according to what Apple does
@@ -2637,7 +2581,8 @@ static void __init probe_uninorth(void)
         if (uninorth_rev < 0x11) {
                 actrl = UN_IN(UNI_N_ARB_CTRL) & ~UNI_N_ARB_CTRL_QACK_DELAY_MASK;
                 actrl |= ((uninorth_rev < 3) ? UNI_N_ARB_CTRL_QACK_DELAY105 :
-                        UNI_N_ARB_CTRL_QACK_DELAY) << UNI_N_ARB_CTRL_QACK_DELAY_SHIFT;
+                        UNI_N_ARB_CTRL_QACK_DELAY) <<
+                        UNI_N_ARB_CTRL_QACK_DELAY_SHIFT;
                 UN_OUT(UNI_N_ARB_CTRL, actrl);
         }
 
@@ -2645,7 +2590,8 @@ static void __init probe_uninorth(void)
          * revs 1.5 to 2.O and Pangea. Seem to toggle the UniN Maxbus/PCI
          * memory timeout
          */
-        if ((uninorth_rev >= 0x11 && uninorth_rev <= 0x24) || uninorth_rev == 0xc0)
+        if ((uninorth_rev >= 0x11 && uninorth_rev <= 0x24) ||
+            uninorth_rev == 0xc0)
                 UN_OUT(0x2160, UN_IN(0x2160) & 0x00ffffff);
 }
 
@@ -2653,18 +2599,17 @@ static void __init probe_one_macio(const char *name, const char *compat, int typ
 {
         struct device_node*     node;
         int                     i;
-        volatile u32 __iomem *  base;
-        u32*                    revp;
+        volatile u32 __iomem    *base;
+        u32                     *addrp, *revp;
+        phys_addr_t             addr;
+        u64                     size;
 
-        node = find_devices(name);
-        if (!node || !node->n_addrs)
-                return;
-        if (compat)
-                do {
-                        if (device_is_compatible(node, compat))
-                                break;
-                        node = node->next;
-                } while (node);
+        for (node = NULL; (node = of_find_node_by_name(node, name)) != NULL;) {
+                if (!compat)
+                        break;
+                if (device_is_compatible(node, compat))
+                        break;
+        }
         if (!node)
                 return;
         for(i=0; i<MAX_MACIO_CHIPS; i++) {
@@ -2673,22 +2618,38 @@ static void __init probe_one_macio(const char *name, const char *compat, int typ
                 if (macio_chips[i].of_node == node)
                         return;
         }
+
         if (i >= MAX_MACIO_CHIPS) {
                 printk(KERN_ERR "pmac_feature: Please increase MAX_MACIO_CHIPS !\n");
                 printk(KERN_ERR "pmac_feature: %s skipped\n", node->full_name);
                 return;
         }
-        base = ioremap(node->addrs[0].address, node->addrs[0].size);
+        addrp = of_get_pci_address(node, 0, &size, NULL);
+        if (addrp == NULL) {
+                printk(KERN_ERR "pmac_feature: %s: can't find base !\n",
+                       node->full_name);
+                return;
+        }
+        addr = of_translate_address(node, addrp);
+        if (addr == 0) {
+                printk(KERN_ERR "pmac_feature: %s, can't translate base !\n",
+                       node->full_name);
+                return;
+        }
+        base = ioremap(addr, (unsigned long)size);
         if (!base) {
-                printk(KERN_ERR "pmac_feature: Can't map mac-io chip !\n");
+                printk(KERN_ERR "pmac_feature: %s, can't map mac-io chip !\n",
+                       node->full_name);
                 return;
         }
-        if (type == macio_keylargo) {
+        if (type == macio_keylargo || type == macio_keylargo2) {
                 u32 *did = (u32 *)get_property(node, "device-id", NULL);
                 if (*did == 0x00000025)
                         type = macio_pangea;
                 if (*did == 0x0000003e)
                         type = macio_intrepid;
+                if (*did == 0x0000004f)
+                        type = macio_shasta;
         }
         macio_chips[i].of_node  = node;
         macio_chips[i].type     = type;
@@ -2787,7 +2748,8 @@ set_initial_features(void)
         }
 
 #ifdef CONFIG_POWER4
-        if (macio_chips[0].type == macio_keylargo2) {
+        if (macio_chips[0].type == macio_keylargo2 ||
+            macio_chips[0].type == macio_shasta) {
 #ifndef CONFIG_SMP
                 /* On SMP machines running UP, we have the second CPU eating
                  * bus cycles. We need to take it off the bus. This is done
@@ -2896,12 +2858,6 @@ set_initial_features(void)
                 MACIO_BIC(HEATHROW_FCR, HRW_SOUND_POWER_N);
         }
 
-        /* Some machine models need the clock chip to be properly setup for
-         * clock spreading now. This should be a platform function but we
-         * don't do these at the moment
-         */
-        pmac_tweak_clock_spreading(1);
-
 #endif /* CONFIG_POWER4 */
 
         /* On all machines, switch modem & serial ports off */
@@ -2929,9 +2885,6 @@ pmac_feature_init(void)
                 return;
         }
 
-        /* Setup low-level i2c stuffs */
-        pmac_init_low_i2c();
-
         /* Probe machine type */
         if (probe_motherboard())
                 printk(KERN_WARNING "Unknown PowerMac !\n");
@@ -2942,26 +2895,6 @@ pmac_feature_init(void)
         set_initial_features();
 }
 
-int __init pmac_feature_late_init(void)
-{
-#if 0
-        struct device_node *np;
-
-        /* Request some resources late */
-        if (uninorth_node)
-                request_OF_resource(uninorth_node, 0, NULL);
-        np = find_devices("hammerhead");
-        if (np)
-                request_OF_resource(np, 0, NULL);
-        np = find_devices("interrupt-controller");
-        if (np)
-                request_OF_resource(np, 0, NULL);
-#endif
-        return 0;
-}
-
-device_initcall(pmac_feature_late_init);
-
 #if 0
 static void dump_HT_speeds(char *name, u32 cfg, u32 frq)
 {
@@ -2984,9 +2917,9 @@ void __init pmac_check_ht_link(void)
         u8      px_bus, px_devfn;
         struct pci_controller *px_hose;
 
-        (void)in_be32(u3_ht + U3_HT_LINK_COMMAND);
-        ucfg = cfg = in_be32(u3_ht + U3_HT_LINK_CONFIG);
-        ufreq = freq = in_be32(u3_ht + U3_HT_LINK_FREQ);
+        (void)in_be32(u3_ht_base + U3_HT_LINK_COMMAND);
+        ucfg = cfg = in_be32(u3_ht_base + U3_HT_LINK_CONFIG);
+        ufreq = freq = in_be32(u3_ht_base + U3_HT_LINK_FREQ);
         dump_HT_speeds("U3 HyperTransport", cfg, freq);
 
         pcix_node = of_find_compatible_node(NULL, "pci", "pci-x");
diff --git a/arch/powerpc/platforms/powermac/low_i2c.c b/arch/powerpc/platforms/powermac/low_i2c.c
index f3f39e8e337a..535c802b369f 100644
--- a/arch/powerpc/platforms/powermac/low_i2c.c
+++ b/arch/powerpc/platforms/powermac/low_i2c.c
@@ -1,22 +1,34 @@
 /*
- *  arch/ppc/platforms/pmac_low_i2c.c
+ * arch/powerpc/platforms/powermac/low_i2c.c
  *
- *  Copyright (C) 2003 Ben. Herrenschmidt (benh@kernel.crashing.org)
+ *  Copyright (C) 2003-2005 Ben. Herrenschmidt (benh@kernel.crashing.org)
  *
  *  This program is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU General Public License
  *  as published by the Free Software Foundation; either version
  *  2 of the License, or (at your option) any later version.
  *
- *  This file contains some low-level i2c access routines that
- *  need to be used by various bits of the PowerMac platform code
- *  at times where the real asynchronous & interrupt driven driver
- *  cannot be used. The API borrows some semantics from the darwin
- *  driver in order to ease the implementation of the platform
- *  properties parser
+ * The linux i2c layer isn't completely suitable for our needs for various
+ * reasons ranging from too late initialisation to semantics not perfectly
+ * matching some requirements of the apple platform functions etc...
+ *
+ * This file thus provides a simple low level unified i2c interface for
+ * powermac that covers the various types of i2c busses used in Apple machines.
+ * For now, keywest, PMU and SMU, though we could add Cuda, or other bit
+ * banging busses found on older chipstes in earlier machines if we ever need
+ * one of them.
+ *
+ * The drivers in this file are synchronous/blocking. In addition, the
+ * keywest one is fairly slow due to the use of msleep instead of interrupts
+ * as the interrupt is currently used by i2c-keywest. In the long run, we
+ * might want to get rid of those high-level interfaces to linux i2c layer
+ * either completely (converting all drivers) or replacing them all with a
+ * single stub driver on top of this one. Once done, the interrupt will be
+ * available for our use.
  */
 
 #undef DEBUG
+#undef DEBUG_LOW
 
 #include <linux/config.h>
 #include <linux/types.h>
@@ -25,66 +37,91 @@
 #include <linux/module.h>
 #include <linux/adb.h>
 #include <linux/pmu.h>
+#include <linux/delay.h>
+#include <linux/completion.h>
+#include <linux/platform_device.h>
+#include <linux/interrupt.h>
+#include <linux/completion.h>
+#include <linux/timer.h>
 #include <asm/keylargo.h>
 #include <asm/uninorth.h>
 #include <asm/io.h>
 #include <asm/prom.h>
 #include <asm/machdep.h>
+#include <asm/smu.h>
+#include <asm/pmac_pfunc.h>
 #include <asm/pmac_low_i2c.h>
 
-#define MAX_LOW_I2C_HOST        4
-
 #ifdef DEBUG
 #define DBG(x...) do {\
-                printk(KERN_DEBUG "KW:" x);     \
+                printk(KERN_DEBUG "low_i2c:" x);        \
         } while(0)
 #else
 #define DBG(x...)
 #endif
 
-struct low_i2c_host;
-
-typedef int (*low_i2c_func_t)(struct low_i2c_host *host, u8 addr, u8 sub, u8 *data, int len);
+#ifdef DEBUG_LOW
+#define DBG_LOW(x...) do {\
+                printk(KERN_DEBUG "low_i2c:" x);        \
+        } while(0)
+#else
+#define DBG_LOW(x...)
+#endif
 
-struct low_i2c_host
-{
-        struct device_node      *np;            /* OF device node */
-        struct semaphore        mutex;          /* Access mutex for use by i2c-keywest */
-        low_i2c_func_t          func;           /* Access function */
-        unsigned int            is_open : 1;    /* Poor man's access control */
-        int                     mode;           /* Current mode */
-        int                     channel;        /* Current channel */
-        int                     num_channels;   /* Number of channels */
-        void __iomem            *base;          /* For keywest-i2c, base address */
-        int                     bsteps;         /* And register stepping */
-        int                     speed;          /* And speed */
-};
 
-static struct low_i2c_host      low_i2c_hosts[MAX_LOW_I2C_HOST];
+static int pmac_i2c_force_poll = 1;
 
-/* No locking is necessary on allocation, we are running way before
- * anything can race with us
+/*
+ * A bus structure. Each bus in the system has such a structure associated.
  */
-static struct low_i2c_host *find_low_i2c_host(struct device_node *np)
+struct pmac_i2c_bus
 {
-        int i;
+        struct list_head        link;
+        struct device_node      *controller;
+        struct device_node      *busnode;
+        int                     type;
+        int                     flags;
+        struct i2c_adapter      *adapter;
+        void                    *hostdata;
+        int                     channel;        /* some hosts have multiple */
+        int                     mode;           /* current mode */
+        struct semaphore        sem;
+        int                     opened;
+        int                     polled;         /* open mode */
+        struct platform_device  *platform_dev;
+
+        /* ops */
+        int (*open)(struct pmac_i2c_bus *bus);
+        void (*close)(struct pmac_i2c_bus *bus);
+        int (*xfer)(struct pmac_i2c_bus *bus, u8 addrdir, int subsize,
+                    u32 subaddr, u8 *data, int len);
+};
 
-        for (i = 0; i < MAX_LOW_I2C_HOST; i++)
-                if (low_i2c_hosts[i].np == np)
-                        return &low_i2c_hosts[i];
-        return NULL;
-}
+static LIST_HEAD(pmac_i2c_busses);
 
 /*
- *
- * i2c-keywest implementation (UniNorth, U2, U3, Keylargo's)
- *
+ * Keywest implementation
  */
 
-/*
- * Keywest i2c definitions borrowed from drivers/i2c/i2c-keywest.h,
- * should be moved somewhere in include/asm-ppc/
- */
+struct pmac_i2c_host_kw
+{
+        struct semaphore        mutex;          /* Access mutex for use by
+                                                 * i2c-keywest */
+        void __iomem            *base;          /* register base address */
+        int                     bsteps;         /* register stepping */
+        int                     speed;          /* speed */
+        int                     irq;
+        u8                      *data;
+        unsigned                len;
+        int                     state;
+        int                     rw;
+        int                     polled;
+        int                     result;
+        struct completion       complete;
+        spinlock_t              lock;
+        struct timer_list       timeout_timer;
+};
+
 /* Register indices */
 typedef enum {
         reg_mode = 0,
@@ -97,6 +134,8 @@ typedef enum {
         reg_data
 } reg_t;
 
+/* The Tumbler audio equalizer can be really slow sometimes */
+#define KW_POLL_TIMEOUT         (2*HZ)
 
 /* Mode register */
 #define KW_I2C_MODE_100KHZ      0x00
@@ -140,8 +179,9 @@ enum {
 };
 
 #define WRONG_STATE(name) do {\
-                printk(KERN_DEBUG "KW: wrong state. Got %s, state: %s (isr: %02x)\n", \
-                       name, __kw_state_names[state], isr); \
+                printk(KERN_DEBUG "KW: wrong state. Got %s, state: %s " \
+                       "(isr: %02x)\n", \
+                       name, __kw_state_names[host->state], isr); \
         } while(0)
 
 static const char *__kw_state_names[] = {
@@ -153,120 +193,137 @@ static const char *__kw_state_names[] = {
         "state_dead"
 };
 
-static inline u8 __kw_read_reg(struct low_i2c_host *host, reg_t reg)
+static inline u8 __kw_read_reg(struct pmac_i2c_host_kw *host, reg_t reg)
 {
         return readb(host->base + (((unsigned int)reg) << host->bsteps));
 }
 
-static inline void __kw_write_reg(struct low_i2c_host *host, reg_t reg, u8 val)
+static inline void __kw_write_reg(struct pmac_i2c_host_kw *host,
+                                  reg_t reg, u8 val)
 {
         writeb(val, host->base + (((unsigned)reg) << host->bsteps));
         (void)__kw_read_reg(host, reg_subaddr);
 }
 
-#define kw_write_reg(reg, val)  __kw_write_reg(host, reg, val) 
-#define kw_read_reg(reg)        __kw_read_reg(host, reg) 
-
+#define kw_write_reg(reg, val)  __kw_write_reg(host, reg, val)
+#define kw_read_reg(reg)        __kw_read_reg(host, reg)
 
-/* Don't schedule, the g5 fan controller is too
- * timing sensitive
- */
-static u8 kw_wait_interrupt(struct low_i2c_host* host)
+static u8 kw_i2c_wait_interrupt(struct pmac_i2c_host_kw *host)
 {
         int i, j;
         u8 isr;
         
-        for (i = 0; i < 100000; i++) {
+        for (i = 0; i < 1000; i++) {
                 isr = kw_read_reg(reg_isr) & KW_I2C_IRQ_MASK;
                 if (isr != 0)
                         return isr;
 
                 /* This code is used with the timebase frozen, we cannot rely
-                 * on udelay ! For now, just use a bogus loop
+                 * on udelay nor schedule when in polled mode !
+                 * For now, just use a bogus loop....
                  */
-                for (j = 1; j < 10000; j++)
-                        mb();
+                if (host->polled) {
+                        for (j = 1; j < 100000; j++)
+                                mb();
+                } else
+                        msleep(1);
         }
         return isr;
 }
 
-static int kw_handle_interrupt(struct low_i2c_host *host, int state, int rw, int *rc, u8 **data, int *len, u8 isr)
+static void kw_i2c_handle_interrupt(struct pmac_i2c_host_kw *host, u8 isr)
 {
         u8 ack;
 
-        DBG("kw_handle_interrupt(%s, isr: %x)\n", __kw_state_names[state], isr);
+        DBG_LOW("kw_handle_interrupt(%s, isr: %x)\n",
+                __kw_state_names[host->state], isr);
+
+        if (host->state == state_idle) {
+                printk(KERN_WARNING "low_i2c: Keywest got an out of state"
+                       " interrupt, ignoring\n");
+                kw_write_reg(reg_isr, isr);
+                return;
+        }
 
         if (isr == 0) {
-                if (state != state_stop) {
-                        DBG("KW: Timeout !\n");
-                        *rc = -EIO;
+                if (host->state != state_stop) {
+                        DBG_LOW("KW: Timeout !\n");
+                        host->result = -EIO;
                         goto stop;
                 }
-                if (state == state_stop) {
+                if (host->state == state_stop) {
                         ack = kw_read_reg(reg_status);
-                        if (!(ack & KW_I2C_STAT_BUSY)) {
-                                state = state_idle;
-                                kw_write_reg(reg_ier, 0x00);
-                        }
+                        if (ack & KW_I2C_STAT_BUSY)
+                                kw_write_reg(reg_status, 0);
+                        host->state = state_idle;
+                        kw_write_reg(reg_ier, 0x00);
+                        if (!host->polled)
+                                complete(&host->complete);
                 }
-                return state;
+                return;
         }
 
         if (isr & KW_I2C_IRQ_ADDR) {
                 ack = kw_read_reg(reg_status);
-                if (state != state_addr) {
+                if (host->state != state_addr) {
                         kw_write_reg(reg_isr, KW_I2C_IRQ_ADDR);
                         WRONG_STATE("KW_I2C_IRQ_ADDR"); 
-                        *rc = -EIO;
+                        host->result = -EIO;
                         goto stop;
                 }
-                if ((ack & KW_I2C_STAT_LAST_AAK) == 0) {                        
-                        *rc = -ENODEV;
-                        DBG("KW: NAK on address\n");
-                        return state_stop;                   
+                if ((ack & KW_I2C_STAT_LAST_AAK) == 0) {
+                        host->result = -ENODEV;
+                        DBG_LOW("KW: NAK on address\n");
+                        host->state = state_stop;
+                        return;
                 } else {
-                        if (rw) {
-                                state = state_read;
-                                if (*len > 1)
-                                        kw_write_reg(reg_control, KW_I2C_CTL_AAK);
+                        if (host->len == 0) {
+                                kw_write_reg(reg_isr, KW_I2C_IRQ_ADDR);
+                                goto stop;
+                        }
+                        if (host->rw) {
+                                host->state = state_read;
+                                if (host->len > 1)
+                                        kw_write_reg(reg_control,
+                                                     KW_I2C_CTL_AAK);
                         } else {
-                                state = state_write;
-                                kw_write_reg(reg_data, **data);
-                                (*data)++; (*len)--;
+                                host->state = state_write;
+                                kw_write_reg(reg_data, *(host->data++));
+                                host->len--;
                         }
                 }
                 kw_write_reg(reg_isr, KW_I2C_IRQ_ADDR);
         }
 
         if (isr & KW_I2C_IRQ_DATA) {
-                if (state == state_read) {
-                        **data = kw_read_reg(reg_data);
-                        (*data)++; (*len)--;
+                if (host->state == state_read) {
+                        *(host->data++) = kw_read_reg(reg_data);
+                        host->len--;
                         kw_write_reg(reg_isr, KW_I2C_IRQ_DATA);
-                        if ((*len) == 0)
-                                state = state_stop;
-                        else if ((*len) == 1)
+                        if (host->len == 0)
+                                host->state = state_stop;
+                        else if (host->len == 1)
                                 kw_write_reg(reg_control, 0);
-                } else if (state == state_write) {
+                } else if (host->state == state_write) {
                         ack = kw_read_reg(reg_status);
                         if ((ack & KW_I2C_STAT_LAST_AAK) == 0) {
-                                DBG("KW: nack on data write\n");
-                                *rc = -EIO;
+                                DBG_LOW("KW: nack on data write\n");
+                                host->result = -EIO;
                                 goto stop;
-                        } else if (*len) {
-                                kw_write_reg(reg_data, **data);
-                                (*data)++; (*len)--;
+                        } else if (host->len) {
+                                kw_write_reg(reg_data, *(host->data++));
+                                host->len--;
                         } else {
                                 kw_write_reg(reg_control, KW_I2C_CTL_STOP);
-                                state = state_stop;
-                                *rc = 0;
+                                host->state = state_stop;
+                                host->result = 0;
                         }
                         kw_write_reg(reg_isr, KW_I2C_IRQ_DATA);
                 } else {
                         kw_write_reg(reg_isr, KW_I2C_IRQ_DATA);
                         WRONG_STATE("KW_I2C_IRQ_DATA"); 
-                        if (state != state_stop) {
-                                *rc = -EIO;
+                        if (host->state != state_stop) {
+                                host->result = -EIO;
                                 goto stop;
                         }
                 }
@@ -274,98 +331,194 @@ static int kw_handle_interrupt(struct low_i2c_host *host, int state, int rw, int
 
         if (isr & KW_I2C_IRQ_STOP) {
                 kw_write_reg(reg_isr, KW_I2C_IRQ_STOP);
-                if (state != state_stop) {
+                if (host->state != state_stop) {
                         WRONG_STATE("KW_I2C_IRQ_STOP");
-                        *rc = -EIO;
+                        host->result = -EIO;
                 }
-                return state_idle;
+                host->state = state_idle;
+                if (!host->polled)
+                        complete(&host->complete);
         }
 
         if (isr & KW_I2C_IRQ_START)
                 kw_write_reg(reg_isr, KW_I2C_IRQ_START);
 
-        return state;
-
+        return;
  stop:
         kw_write_reg(reg_control, KW_I2C_CTL_STOP);     
-        return state_stop;
+        host->state = state_stop;
+        return;
 }
 
-static int keywest_low_i2c_func(struct low_i2c_host *host, u8 addr, u8 subaddr, u8 *data, int len)
+/* Interrupt handler */
+static irqreturn_t kw_i2c_irq(int irq, void *dev_id, struct pt_regs *regs)
 {
+        struct pmac_i2c_host_kw *host = dev_id;
+        unsigned long flags;
+
+        spin_lock_irqsave(&host->lock, flags);
+        del_timer(&host->timeout_timer);
+        kw_i2c_handle_interrupt(host, kw_read_reg(reg_isr));
+        if (host->state != state_idle) {
+                host->timeout_timer.expires = jiffies + KW_POLL_TIMEOUT;
+                add_timer(&host->timeout_timer);
+        }
+        spin_unlock_irqrestore(&host->lock, flags);
+        return IRQ_HANDLED;
+}
+
+static void kw_i2c_timeout(unsigned long data)
+{
+        struct pmac_i2c_host_kw *host = (struct pmac_i2c_host_kw *)data;
+        unsigned long flags;
+
+        spin_lock_irqsave(&host->lock, flags);
+        kw_i2c_handle_interrupt(host, kw_read_reg(reg_isr));
+        if (host->state != state_idle) {
+                host->timeout_timer.expires = jiffies + KW_POLL_TIMEOUT;
+                add_timer(&host->timeout_timer);
+        }
+        spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static int kw_i2c_open(struct pmac_i2c_bus *bus)
+{
+        struct pmac_i2c_host_kw *host = bus->hostdata;
+        down(&host->mutex);
+        return 0;
+}
+
+static void kw_i2c_close(struct pmac_i2c_bus *bus)
+{
+        struct pmac_i2c_host_kw *host = bus->hostdata;
+        up(&host->mutex);
+}
+
+static int kw_i2c_xfer(struct pmac_i2c_bus *bus, u8 addrdir, int subsize,
+                       u32 subaddr, u8 *data, int len)
+{
+        struct pmac_i2c_host_kw *host = bus->hostdata;
         u8 mode_reg = host->speed;
-        int state = state_addr;
-        int rc = 0;
+        int use_irq = host->irq != NO_IRQ && !bus->polled;
 
         /* Setup mode & subaddress if any */
-        switch(host->mode) {
-        case pmac_low_i2c_mode_dumb:
-                printk(KERN_ERR "low_i2c: Dumb mode not supported !\n");
+        switch(bus->mode) {
+        case pmac_i2c_mode_dumb:
                 return -EINVAL;
-        case pmac_low_i2c_mode_std:
+        case pmac_i2c_mode_std:
                 mode_reg |= KW_I2C_MODE_STANDARD;
+                if (subsize != 0)
+                        return -EINVAL;
                 break;
-        case pmac_low_i2c_mode_stdsub:
+        case pmac_i2c_mode_stdsub:
                 mode_reg |= KW_I2C_MODE_STANDARDSUB;
+                if (subsize != 1)
+                        return -EINVAL;
                 break;
-        case pmac_low_i2c_mode_combined:
+        case pmac_i2c_mode_combined:
                 mode_reg |= KW_I2C_MODE_COMBINED;
+                if (subsize != 1)
+                        return -EINVAL;
                 break;
         }
 
         /* Setup channel & clear pending irqs */
         kw_write_reg(reg_isr, kw_read_reg(reg_isr));
-        kw_write_reg(reg_mode, mode_reg | (host->channel << 4));
+        kw_write_reg(reg_mode, mode_reg | (bus->channel << 4));
         kw_write_reg(reg_status, 0);
 
-        /* Set up address and r/w bit */
-        kw_write_reg(reg_addr, addr);
+        /* Set up address and r/w bit, strip possible stale bus number from
+         * address top bits
+         */
+        kw_write_reg(reg_addr, addrdir & 0xff);
 
         /* Set up the sub address */
         if ((mode_reg & KW_I2C_MODE_MODE_MASK) == KW_I2C_MODE_STANDARDSUB
             || (mode_reg & KW_I2C_MODE_MODE_MASK) == KW_I2C_MODE_COMBINED)
                 kw_write_reg(reg_subaddr, subaddr);
 
-        /* Start sending address & disable interrupt*/
-        kw_write_reg(reg_ier, 0 /*KW_I2C_IRQ_MASK*/);
+        /* Prepare for async operations */
+        host->data = data;
+        host->len = len;
+        host->state = state_addr;
+        host->result = 0;
+        host->rw = (addrdir & 1);
+        host->polled = bus->polled;
+
+        /* Enable interrupt if not using polled mode and interrupt is
+         * available
+         */
+        if (use_irq) {
+                /* Clear completion */
+                INIT_COMPLETION(host->complete);
+                /* Ack stale interrupts */
+                kw_write_reg(reg_isr, kw_read_reg(reg_isr));
+                /* Arm timeout */
+                host->timeout_timer.expires = jiffies + KW_POLL_TIMEOUT;
+                add_timer(&host->timeout_timer);
+                /* Enable emission */
+                kw_write_reg(reg_ier, KW_I2C_IRQ_MASK);
+        }
+
+        /* Start sending address */
         kw_write_reg(reg_control, KW_I2C_CTL_XADDR);
 
-        /* State machine, to turn into an interrupt handler */
-        while(state != state_idle) {
-                u8 isr = kw_wait_interrupt(host);
-                state = kw_handle_interrupt(host, state, addr & 1, &rc, &data, &len, isr);
+        /* Wait for completion */
+        if (use_irq)
+                wait_for_completion(&host->complete);
+        else {
+                while(host->state != state_idle) {
+                        unsigned long flags;
+
+                        u8 isr = kw_i2c_wait_interrupt(host);
+                        spin_lock_irqsave(&host->lock, flags);
+                        kw_i2c_handle_interrupt(host, isr);
+                        spin_unlock_irqrestore(&host->lock, flags);
+                }
         }
 
-        return rc;
+        /* Disable emission */
+        kw_write_reg(reg_ier, 0);
+
+        return host->result;
 }
 
-static void keywest_low_i2c_add(struct device_node *np)
+static struct pmac_i2c_host_kw *__init kw_i2c_host_init(struct device_node *np)
 {
-        struct low_i2c_host     *host = find_low_i2c_host(NULL);
-        u32                     *psteps, *prate, steps, aoffset = 0;
-        struct device_node      *parent;
+        struct pmac_i2c_host_kw *host;
+        u32                     *psteps, *prate, *addrp, steps;
 
+        host = kzalloc(sizeof(struct pmac_i2c_host_kw), GFP_KERNEL);
         if (host == NULL) {
                 printk(KERN_ERR "low_i2c: Can't allocate host for %s\n",
                        np->full_name);
-                return;
+                return NULL;
         }
-        memset(host, 0, sizeof(*host));
 
+        /* Apple is kind enough to provide a valid AAPL,address property
+         * on all i2c keywest nodes so far ... we would have to fallback
+         * to macio parsing if that wasn't the case
+         */
+        addrp = (u32 *)get_property(np, "AAPL,address", NULL);
+        if (addrp == NULL) {
+                printk(KERN_ERR "low_i2c: Can't find address for %s\n",
+                       np->full_name);
+                kfree(host);
+                return NULL;
+        }
         init_MUTEX(&host->mutex);
-        host->np = of_node_get(np);     
+        init_completion(&host->complete);
+        spin_lock_init(&host->lock);
+        init_timer(&host->timeout_timer);
+        host->timeout_timer.function = kw_i2c_timeout;
+        host->timeout_timer.data = (unsigned long)host;
+
         psteps = (u32 *)get_property(np, "AAPL,address-step", NULL);
         steps = psteps ? (*psteps) : 0x10;
         for (host->bsteps = 0; (steps & 0x01) == 0; host->bsteps++)
                 steps >>= 1;
-        parent = of_get_parent(np);
-        host->num_channels = 1;
-        if (parent && parent->name[0] == 'u') {
-                host->num_channels = 2;
-                aoffset = 3;
-        }
         /* Select interface rate */
-        host->speed = KW_I2C_MODE_100KHZ;
+        host->speed = KW_I2C_MODE_25KHZ;
         prate = (u32 *)get_property(np, "AAPL,i2c-rate", NULL);
         if (prate) switch(*prate) {
         case 100:
@@ -378,146 +531,981 @@ static void keywest_low_i2c_add(struct device_node *np)
                 host->speed = KW_I2C_MODE_25KHZ;
                 break;
         }       
+        if (np->n_intrs > 0)
+                host->irq = np->intrs[0].line;
+        else
+                host->irq = NO_IRQ;
+
+        host->base = ioremap((*addrp), 0x1000);
+        if (host->base == NULL) {
+                printk(KERN_ERR "low_i2c: Can't map registers for %s\n",
+                       np->full_name);
+                kfree(host);
+                return NULL;
+        }
+
+        /* Make sure IRA is disabled */
+        kw_write_reg(reg_ier, 0);
+
+        /* Request chip interrupt */
+        if (request_irq(host->irq, kw_i2c_irq, SA_SHIRQ, "keywest i2c", host))
+                host->irq = NO_IRQ;
+
+        printk(KERN_INFO "KeyWest i2c @0x%08x irq %d %s\n",
+               *addrp, host->irq, np->full_name);
 
-        host->mode = pmac_low_i2c_mode_std;
-        host->base = ioremap(np->addrs[0].address + aoffset,
-                                                np->addrs[0].size);
-        host->func = keywest_low_i2c_func;
+        return host;
 }
 
+
+static void __init kw_i2c_add(struct pmac_i2c_host_kw *host,
+                              struct device_node *controller,
+                              struct device_node *busnode,
+                              int channel)
+{
+        struct pmac_i2c_bus *bus;
+
+        bus = kzalloc(sizeof(struct pmac_i2c_bus), GFP_KERNEL);
+        if (bus == NULL)
+                return;
+
+        bus->controller = of_node_get(controller);
+        bus->busnode = of_node_get(busnode);
+        bus->type = pmac_i2c_bus_keywest;
+        bus->hostdata = host;
+        bus->channel = channel;
+        bus->mode = pmac_i2c_mode_std;
+        bus->open = kw_i2c_open;
+        bus->close = kw_i2c_close;
+        bus->xfer = kw_i2c_xfer;
+        init_MUTEX(&bus->sem);
+        if (controller == busnode)
+                bus->flags = pmac_i2c_multibus;
+        list_add(&bus->link, &pmac_i2c_busses);
+
+        printk(KERN_INFO " channel %d bus %s\n", channel,
+               (controller == busnode) ? "<multibus>" : busnode->full_name);
+}
+
+static void __init kw_i2c_probe(void)
+{
+        struct device_node *np, *child, *parent;
+
+        /* Probe keywest-i2c busses */
+        for (np = NULL;
+             (np = of_find_compatible_node(np, "i2c","keywest-i2c")) != NULL;){
+                struct pmac_i2c_host_kw *host;
+                int multibus, chans, i;
+
+                /* Found one, init a host structure */
+                host = kw_i2c_host_init(np);
+                if (host == NULL)
+                        continue;
+
+                /* Now check if we have a multibus setup (old style) or if we
+                 * have proper bus nodes. Note that the "new" way (proper bus
+                 * nodes) might cause us to not create some busses that are
+                 * kept hidden in the device-tree. In the future, we might
+                 * want to work around that by creating busses without a node
+                 * but not for now
+                 */
+                child = of_get_next_child(np, NULL);
+                multibus = !child || strcmp(child->name, "i2c-bus");
+                of_node_put(child);
+
+                /* For a multibus setup, we get the bus count based on the
+                 * parent type
+                 */
+                if (multibus) {
+                        parent = of_get_parent(np);
+                        if (parent == NULL)
+                                continue;
+                        chans = parent->name[0] == 'u' ? 2 : 1;
+                        for (i = 0; i < chans; i++)
+                                kw_i2c_add(host, np, np, i);
+                } else {
+                        for (child = NULL;
+                             (child = of_get_next_child(np, child)) != NULL;) {
+                                u32 *reg =
+                                        (u32 *)get_property(child, "reg", NULL);
+                                if (reg == NULL)
+                                        continue;
+                                kw_i2c_add(host, np, child, *reg);
+                        }
+                }
+        }
+}
+
+
 /*
  *
  * PMU implementation
  *
  */
 
-
 #ifdef CONFIG_ADB_PMU
 
-static int pmu_low_i2c_func(struct low_i2c_host *host, u8 addr, u8 sub, u8 *data, int len)
+/*
+ * i2c command block to the PMU
+ */
+struct pmu_i2c_hdr {
+        u8      bus;
+        u8      mode;
+        u8      bus2;
+        u8      address;
+        u8      sub_addr;
+        u8      comb_addr;
+        u8      count;
+        u8      data[];
+};
+
+static void pmu_i2c_complete(struct adb_request *req)
 {
-        // TODO
-        return -ENODEV;
+        complete(req->arg);
 }
 
-static void pmu_low_i2c_add(struct device_node *np)
+static int pmu_i2c_xfer(struct pmac_i2c_bus *bus, u8 addrdir, int subsize,
+                        u32 subaddr, u8 *data, int len)
 {
-        struct low_i2c_host     *host = find_low_i2c_host(NULL);
+        struct adb_request *req = bus->hostdata;
+        struct pmu_i2c_hdr *hdr = (struct pmu_i2c_hdr *)&req->data[1];
+        struct completion comp;
+        int read = addrdir & 1;
+        int retry;
+        int rc = 0;
 
-        if (host == NULL) {
-                printk(KERN_ERR "low_i2c: Can't allocate host for %s\n",
-                       np->full_name);
-                return;
+        /* For now, limit ourselves to 16 bytes transfers */
+        if (len > 16)
+                return -EINVAL;
+
+        init_completion(&comp);
+
+        for (retry = 0; retry < 16; retry++) {
+                memset(req, 0, sizeof(struct adb_request));
+                hdr->bus = bus->channel;
+                hdr->count = len;
+
+                switch(bus->mode) {
+                case pmac_i2c_mode_std:
+                        if (subsize != 0)
+                                return -EINVAL;
+                        hdr->address = addrdir;
+                        hdr->mode = PMU_I2C_MODE_SIMPLE;
+                        break;
+                case pmac_i2c_mode_stdsub:
+                case pmac_i2c_mode_combined:
+                        if (subsize != 1)
+                                return -EINVAL;
+                        hdr->address = addrdir & 0xfe;
+                        hdr->comb_addr = addrdir;
+                        hdr->sub_addr = subaddr;
+                        if (bus->mode == pmac_i2c_mode_stdsub)
+                                hdr->mode = PMU_I2C_MODE_STDSUB;
+                        else
+                                hdr->mode = PMU_I2C_MODE_COMBINED;
+                        break;
+                default:
+                        return -EINVAL;
+                }
+
+                INIT_COMPLETION(comp);
+                req->data[0] = PMU_I2C_CMD;
+                req->reply[0] = 0xff;
+                req->nbytes = sizeof(struct pmu_i2c_hdr) + 1;
+                req->done = pmu_i2c_complete;
+                req->arg = &comp;
+                if (!read && len) {
+                        memcpy(hdr->data, data, len);
+                        req->nbytes += len;
+                }
+                rc = pmu_queue_request(req);
+                if (rc)
+                        return rc;
+                wait_for_completion(&comp);
+                if (req->reply[0] == PMU_I2C_STATUS_OK)
+                        break;
+                msleep(15);
         }
-        memset(host, 0, sizeof(*host));
+        if (req->reply[0] != PMU_I2C_STATUS_OK)
+                return -EIO;
 
-        init_MUTEX(&host->mutex);
-        host->np = of_node_get(np);     
-        host->num_channels = 3;
-        host->mode = pmac_low_i2c_mode_std;
-        host->func = pmu_low_i2c_func;
+        for (retry = 0; retry < 16; retry++) {
+                memset(req, 0, sizeof(struct adb_request));
+
+                /* I know that looks like a lot, slow as hell, but darwin
+                 * does it so let's be on the safe side for now
+                 */
+                msleep(15);
+
+                hdr->bus = PMU_I2C_BUS_STATUS;
+
+                INIT_COMPLETION(comp);
+                req->data[0] = PMU_I2C_CMD;
+                req->reply[0] = 0xff;
+                req->nbytes = 2;
+                req->done = pmu_i2c_complete;
+                req->arg = &comp;
+                rc = pmu_queue_request(req);
+                if (rc)
+                        return rc;
+                wait_for_completion(&comp);
+
+                if (req->reply[0] == PMU_I2C_STATUS_OK && !read)
+                        return 0;
+                if (req->reply[0] == PMU_I2C_STATUS_DATAREAD && read) {
+                        int rlen = req->reply_len - 1;
+
+                        if (rlen != len) {
+                                printk(KERN_WARNING "low_i2c: PMU returned %d"
+                                       " bytes, expected %d !\n", rlen, len);
+                                return -EIO;
+                        }
+                        if (len)
+                                memcpy(data, &req->reply[1], len);
+                        return 0;
+                }
+        }
+        return -EIO;
+}
+
+static void __init pmu_i2c_probe(void)
+{
+        struct pmac_i2c_bus *bus;
+        struct device_node *busnode;
+        int channel, sz;
+
+        if (!pmu_present())
+                return;
+
+        /* There might or might not be a "pmu-i2c" node, we use that
+         * or via-pmu itself, whatever we find. I haven't seen a machine
+         * with separate bus nodes, so we assume a multibus setup
+         */
+        busnode = of_find_node_by_name(NULL, "pmu-i2c");
+        if (busnode == NULL)
+                busnode = of_find_node_by_name(NULL, "via-pmu");
+        if (busnode == NULL)
+                return;
+
+        printk(KERN_INFO "PMU i2c %s\n", busnode->full_name);
+
+        /*
+         * We add bus 1 and 2 only for now, bus 0 is "special"
+         */
+        for (channel = 1; channel <= 2; channel++) {
+                sz = sizeof(struct pmac_i2c_bus) + sizeof(struct adb_request);
+                bus = kzalloc(sz, GFP_KERNEL);
+                if (bus == NULL)
+                        return;
+
+                bus->controller = busnode;
+                bus->busnode = busnode;
+                bus->type = pmac_i2c_bus_pmu;
+                bus->channel = channel;
+                bus->mode = pmac_i2c_mode_std;
+                bus->hostdata = bus + 1;
+                bus->xfer = pmu_i2c_xfer;
+                init_MUTEX(&bus->sem);
+                bus->flags = pmac_i2c_multibus;
+                list_add(&bus->link, &pmac_i2c_busses);
+
+                printk(KERN_INFO " channel %d bus <multibus>\n", channel);
+        }
 }
 
 #endif /* CONFIG_ADB_PMU */
 
-void __init pmac_init_low_i2c(void)
+
+/*
+ *
+ * SMU implementation
+ *
+ */
+
+#ifdef CONFIG_PMAC_SMU
+
+static void smu_i2c_complete(struct smu_i2c_cmd *cmd, void *misc)
 {
-        struct device_node *np;
+        complete(misc);
+}
 
-        /* Probe keywest-i2c busses */
-        np = of_find_compatible_node(NULL, "i2c", "keywest-i2c");
-        while(np) {
-                keywest_low_i2c_add(np);
-                np = of_find_compatible_node(np, "i2c", "keywest-i2c");
+static int smu_i2c_xfer(struct pmac_i2c_bus *bus, u8 addrdir, int subsize,
+                        u32 subaddr, u8 *data, int len)
+{
+        struct smu_i2c_cmd *cmd = bus->hostdata;
+        struct completion comp;
+        int read = addrdir & 1;
+        int rc = 0;
+
+        if ((read && len > SMU_I2C_READ_MAX) ||
+            ((!read) && len > SMU_I2C_WRITE_MAX))
+                return -EINVAL;
+
+        memset(cmd, 0, sizeof(struct smu_i2c_cmd));
+        cmd->info.bus = bus->channel;
+        cmd->info.devaddr = addrdir;
+        cmd->info.datalen = len;
+
+        switch(bus->mode) {
+        case pmac_i2c_mode_std:
+                if (subsize != 0)
+                        return -EINVAL;
+                cmd->info.type = SMU_I2C_TRANSFER_SIMPLE;
+                break;
+        case pmac_i2c_mode_stdsub:
+        case pmac_i2c_mode_combined:
+                if (subsize > 3 || subsize < 1)
+                        return -EINVAL;
+                cmd->info.sublen = subsize;
+                /* that's big-endian only but heh ! */
+                memcpy(&cmd->info.subaddr, ((char *)&subaddr) + (4 - subsize),
+                       subsize);
+                if (bus->mode == pmac_i2c_mode_stdsub)
+                        cmd->info.type = SMU_I2C_TRANSFER_STDSUB;
+                else
+                        cmd->info.type = SMU_I2C_TRANSFER_COMBINED;
+                break;
+        default:
+                return -EINVAL;
         }
+        if (!read && len)
+                memcpy(cmd->info.data, data, len);
+
+        init_completion(&comp);
+        cmd->done = smu_i2c_complete;
+        cmd->misc = &comp;
+        rc = smu_queue_i2c(cmd);
+        if (rc < 0)
+                return rc;
+        wait_for_completion(&comp);
+        rc = cmd->status;
+
+        if (read && len)
+                memcpy(data, cmd->info.data, len);
+        return rc < 0 ? rc : 0;
+}
+
+static void __init smu_i2c_probe(void)
+{
+        struct device_node *controller, *busnode;
+        struct pmac_i2c_bus *bus;
+        u32 *reg;
+        int sz;
+
+        if (!smu_present())
+                return;
+
+        controller = of_find_node_by_name(NULL, "smu-i2c-control");
+        if (controller == NULL)
+                controller = of_find_node_by_name(NULL, "smu");
+        if (controller == NULL)
+                return;
+
+        printk(KERN_INFO "SMU i2c %s\n", controller->full_name);
+
+        /* Look for childs, note that they might not be of the right
+         * type as older device trees mix i2c busses and other thigns
+         * at the same level
+         */
+        for (busnode = NULL;
+             (busnode = of_get_next_child(controller, busnode)) != NULL;) {
+                if (strcmp(busnode->type, "i2c") &&
+                    strcmp(busnode->type, "i2c-bus"))
+                        continue;
+                reg = (u32 *)get_property(busnode, "reg", NULL);
+                if (reg == NULL)
+                        continue;
+
+                sz = sizeof(struct pmac_i2c_bus) + sizeof(struct smu_i2c_cmd);
+                bus = kzalloc(sz, GFP_KERNEL);
+                if (bus == NULL)
+                        return;
+
+                bus->controller = controller;
+                bus->busnode = of_node_get(busnode);
+                bus->type = pmac_i2c_bus_smu;
+                bus->channel = *reg;
+                bus->mode = pmac_i2c_mode_std;
+                bus->hostdata = bus + 1;
+                bus->xfer = smu_i2c_xfer;
+                init_MUTEX(&bus->sem);
+                bus->flags = 0;
+                list_add(&bus->link, &pmac_i2c_busses);
+
+                printk(KERN_INFO " channel %x bus %s\n",
+                       bus->channel, busnode->full_name);
+        }
+}
+
+#endif /* CONFIG_PMAC_SMU */
+
+/*
+ *
+ * Core code
+ *
+ */
 
-#ifdef CONFIG_ADB_PMU
-        /* Probe PMU busses */
-        np = of_find_node_by_name(NULL, "via-pmu");
-        if (np)
-                pmu_low_i2c_add(np);
-#endif /* CONFIG_ADB_PMU */
 
-        /* TODO: Add CUDA support as well */
+struct pmac_i2c_bus *pmac_i2c_find_bus(struct device_node *node)
+{
+        struct device_node *p = of_node_get(node);
+        struct device_node *prev = NULL;
+        struct pmac_i2c_bus *bus;
+
+        while(p) {
+                list_for_each_entry(bus, &pmac_i2c_busses, link) {
+                        if (p == bus->busnode) {
+                                if (prev && bus->flags & pmac_i2c_multibus) {
+                                        u32 *reg;
+                                        reg = (u32 *)get_property(prev, "reg",
+                                                                  NULL);
+                                        if (!reg)
+                                                continue;
+                                        if (((*reg) >> 8) != bus->channel)
+                                                continue;
+                                }
+                                of_node_put(p);
+                                of_node_put(prev);
+                                return bus;
+                        }
+                }
+                of_node_put(prev);
+                prev = p;
+                p = of_get_parent(p);
+        }
+        return NULL;
 }
+EXPORT_SYMBOL_GPL(pmac_i2c_find_bus);
+
+u8 pmac_i2c_get_dev_addr(struct device_node *device)
+{
+        u32 *reg = (u32 *)get_property(device, "reg", NULL);
+
+        if (reg == NULL)
+                return 0;
+
+        return (*reg) & 0xff;
+}
+EXPORT_SYMBOL_GPL(pmac_i2c_get_dev_addr);
+
+struct device_node *pmac_i2c_get_controller(struct pmac_i2c_bus *bus)
+{
+        return bus->controller;
+}
+EXPORT_SYMBOL_GPL(pmac_i2c_get_controller);
+
+struct device_node *pmac_i2c_get_bus_node(struct pmac_i2c_bus *bus)
+{
+        return bus->busnode;
+}
+EXPORT_SYMBOL_GPL(pmac_i2c_get_bus_node);
+
+int pmac_i2c_get_type(struct pmac_i2c_bus *bus)
+{
+        return bus->type;
+}
+EXPORT_SYMBOL_GPL(pmac_i2c_get_type);
+
+int pmac_i2c_get_flags(struct pmac_i2c_bus *bus)
+{
+        return bus->flags;
+}
+EXPORT_SYMBOL_GPL(pmac_i2c_get_flags);
+
+int pmac_i2c_get_channel(struct pmac_i2c_bus *bus)
+{
+        return bus->channel;
+}
+EXPORT_SYMBOL_GPL(pmac_i2c_get_channel);
+
+
+void pmac_i2c_attach_adapter(struct pmac_i2c_bus *bus,
+                             struct i2c_adapter *adapter)
+{
+        WARN_ON(bus->adapter != NULL);
+        bus->adapter = adapter;
+}
+EXPORT_SYMBOL_GPL(pmac_i2c_attach_adapter);
+
+void pmac_i2c_detach_adapter(struct pmac_i2c_bus *bus,
+                             struct i2c_adapter *adapter)
+{
+        WARN_ON(bus->adapter != adapter);
+        bus->adapter = NULL;
+}
+EXPORT_SYMBOL_GPL(pmac_i2c_detach_adapter);
+
+struct i2c_adapter *pmac_i2c_get_adapter(struct pmac_i2c_bus *bus)
+{
+        return bus->adapter;
+}
+EXPORT_SYMBOL_GPL(pmac_i2c_get_adapter);
+
+struct pmac_i2c_bus *pmac_i2c_adapter_to_bus(struct i2c_adapter *adapter)
+{
+        struct pmac_i2c_bus *bus;
+
+        list_for_each_entry(bus, &pmac_i2c_busses, link)
+                if (bus->adapter == adapter)
+                        return bus;
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(pmac_i2c_adapter_to_bus);
+
+extern int pmac_i2c_match_adapter(struct device_node *dev,
+                                  struct i2c_adapter *adapter)
+{
+        struct pmac_i2c_bus *bus = pmac_i2c_find_bus(dev);
+
+        if (bus == NULL)
+                return 0;
+        return (bus->adapter == adapter);
+}
+EXPORT_SYMBOL_GPL(pmac_i2c_match_adapter);
 
 int pmac_low_i2c_lock(struct device_node *np)
 {
-        struct low_i2c_host *host = find_low_i2c_host(np);
+        struct pmac_i2c_bus *bus, *found = NULL;
 
-        if (!host)
+        list_for_each_entry(bus, &pmac_i2c_busses, link) {
+                if (np == bus->controller) {
+                        found = bus;
+                        break;
+                }
+        }
+        if (!found)
                 return -ENODEV;
-        down(&host->mutex);
-        return 0;
+        return pmac_i2c_open(bus, 0);
 }
-EXPORT_SYMBOL(pmac_low_i2c_lock);
+EXPORT_SYMBOL_GPL(pmac_low_i2c_lock);
 
 int pmac_low_i2c_unlock(struct device_node *np)
 {
-        struct low_i2c_host *host = find_low_i2c_host(np);
+        struct pmac_i2c_bus *bus, *found = NULL;
 
-        if (!host)
+        list_for_each_entry(bus, &pmac_i2c_busses, link) {
+                if (np == bus->controller) {
+                        found = bus;
+                        break;
+                }
+        }
+        if (!found)
                 return -ENODEV;
-        up(&host->mutex);
+        pmac_i2c_close(bus);
         return 0;
 }
-EXPORT_SYMBOL(pmac_low_i2c_unlock);
+EXPORT_SYMBOL_GPL(pmac_low_i2c_unlock);
 
 
-int pmac_low_i2c_open(struct device_node *np, int channel)
+int pmac_i2c_open(struct pmac_i2c_bus *bus, int polled)
 {
-        struct low_i2c_host *host = find_low_i2c_host(np);
+        int rc;
+
+        down(&bus->sem);
+        bus->polled = polled || pmac_i2c_force_poll;
+        bus->opened = 1;
+        bus->mode = pmac_i2c_mode_std;
+        if (bus->open && (rc = bus->open(bus)) != 0) {
+                bus->opened = 0;
+                up(&bus->sem);
+                return rc;
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(pmac_i2c_open);
 
-        if (!host)
-                return -ENODEV;
+void pmac_i2c_close(struct pmac_i2c_bus *bus)
+{
+        WARN_ON(!bus->opened);
+        if (bus->close)
+                bus->close(bus);
+        bus->opened = 0;
+        up(&bus->sem);
+}
+EXPORT_SYMBOL_GPL(pmac_i2c_close);
 
-        if (channel >= host->num_channels)
+int pmac_i2c_setmode(struct pmac_i2c_bus *bus, int mode)
+{
+        WARN_ON(!bus->opened);
+
+        /* Report me if you see the error below as there might be a new
+         * "combined4" mode that I need to implement for the SMU bus
+         */
+        if (mode < pmac_i2c_mode_dumb || mode > pmac_i2c_mode_combined) {
+                printk(KERN_ERR "low_i2c: Invalid mode %d requested on"
+                       " bus %s !\n", mode, bus->busnode->full_name);
                 return -EINVAL;
-
-        down(&host->mutex);
-        host->is_open = 1;
-        host->channel = channel;
+        }
+        bus->mode = mode;
 
         return 0;
 }
-EXPORT_SYMBOL(pmac_low_i2c_open);
+EXPORT_SYMBOL_GPL(pmac_i2c_setmode);
 
-int pmac_low_i2c_close(struct device_node *np)
+int pmac_i2c_xfer(struct pmac_i2c_bus *bus, u8 addrdir, int subsize,
+                  u32 subaddr, u8 *data, int len)
 {
-        struct low_i2c_host *host = find_low_i2c_host(np);
+        int rc;
 
-        if (!host)
-                return -ENODEV;
+        WARN_ON(!bus->opened);
 
-        host->is_open = 0;
-        up(&host->mutex);
+        DBG("xfer() chan=%d, addrdir=0x%x, mode=%d, subsize=%d, subaddr=0x%x,"
+            " %d bytes, bus %s\n", bus->channel, addrdir, bus->mode, subsize,
+            subaddr, len, bus->busnode->full_name);
 
-        return 0;
+        rc = bus->xfer(bus, addrdir, subsize, subaddr, data, len);
+
+#ifdef DEBUG
+        if (rc)
+                DBG("xfer error %d\n", rc);
+#endif
+        return rc;
 }
-EXPORT_SYMBOL(pmac_low_i2c_close);
+EXPORT_SYMBOL_GPL(pmac_i2c_xfer);
+
+/* some quirks for platform function decoding */
+enum {
+        pmac_i2c_quirk_invmask = 0x00000001u,
+};
 
-int pmac_low_i2c_setmode(struct device_node *np, int mode)
+static void pmac_i2c_devscan(void (*callback)(struct device_node *dev,
+                                              int quirks))
 {
-        struct low_i2c_host *host = find_low_i2c_host(np);
+        struct pmac_i2c_bus *bus;
+        struct device_node *np;
+        static struct whitelist_ent {
+                char *name;
+                char *compatible;
+                int quirks;
+        } whitelist[] = {
+                /* XXX Study device-tree's & apple drivers are get the quirks
+                 * right !
+                 */
+                { "i2c-hwclock", NULL, pmac_i2c_quirk_invmask },
+                { "i2c-cpu-voltage", NULL, 0},
+                {  "temp-monitor", NULL, 0 },
+                {  "supply-monitor", NULL, 0 },
+                { NULL, NULL, 0 },
+        };
+
+        /* Only some devices need to have platform functions instanciated
+         * here. For now, we have a table. Others, like 9554 i2c GPIOs used
+         * on Xserve, if we ever do a driver for them, will use their own
+         * platform function instance
+         */
+        list_for_each_entry(bus, &pmac_i2c_busses, link) {
+                for (np = NULL;
+                     (np = of_get_next_child(bus->busnode, np)) != NULL;) {
+                        struct whitelist_ent *p;
+                        /* If multibus, check if device is on that bus */
+                        if (bus->flags & pmac_i2c_multibus)
+                                if (bus != pmac_i2c_find_bus(np))
+                                        continue;
+                        for (p = whitelist; p->name != NULL; p++) {
+                                if (strcmp(np->name, p->name))
+                                        continue;
+                                if (p->compatible &&
+                                    !device_is_compatible(np, p->compatible))
+                                        continue;
+                                callback(np, p->quirks);
+                                break;
+                        }
+                }
+        }
+}
 
-        if (!host)
-                return -ENODEV;
-        WARN_ON(!host->is_open);
-        host->mode = mode;
+#define MAX_I2C_DATA    64
+
+struct pmac_i2c_pf_inst
+{
+        struct pmac_i2c_bus     *bus;
+        u8                      addr;
+        u8                      buffer[MAX_I2C_DATA];
+        u8                      scratch[MAX_I2C_DATA];
+        int                     bytes;
+        int                     quirks;
+};
+
+static void* pmac_i2c_do_begin(struct pmf_function *func, struct pmf_args *args)
+{
+        struct pmac_i2c_pf_inst *inst;
+        struct pmac_i2c_bus     *bus;
+
+        bus = pmac_i2c_find_bus(func->node);
+        if (bus == NULL) {
+                printk(KERN_ERR "low_i2c: Can't find bus for %s (pfunc)\n",
+                       func->node->full_name);
+                return NULL;
+        }
+        if (pmac_i2c_open(bus, 0)) {
+                printk(KERN_ERR "low_i2c: Can't open i2c bus for %s (pfunc)\n",
+                       func->node->full_name);
+                return NULL;
+        }
+
+        /* XXX might need GFP_ATOMIC when called during the suspend process,
+         * but then, there are already lots of issues with suspending when
+         * near OOM that need to be resolved, the allocator itself should
+         * probably make GFP_NOIO implicit during suspend
+         */
+        inst = kzalloc(sizeof(struct pmac_i2c_pf_inst), GFP_KERNEL);
+        if (inst == NULL) {
+                pmac_i2c_close(bus);
+                return NULL;
+        }
+        inst->bus = bus;
+        inst->addr = pmac_i2c_get_dev_addr(func->node);
+        inst->quirks = (int)(long)func->driver_data;
+        return inst;
+}
+
+static void pmac_i2c_do_end(struct pmf_function *func, void *instdata)
+{
+        struct pmac_i2c_pf_inst *inst = instdata;
+
+        if (inst == NULL)
+                return;
+        pmac_i2c_close(inst->bus);
+        if (inst)
+                kfree(inst);
+}
+
+static int pmac_i2c_do_read(PMF_STD_ARGS, u32 len)
+{
+        struct pmac_i2c_pf_inst *inst = instdata;
+
+        inst->bytes = len;
+        return pmac_i2c_xfer(inst->bus, inst->addr | pmac_i2c_read, 0, 0,
+                             inst->buffer, len);
+}
+
+static int pmac_i2c_do_write(PMF_STD_ARGS, u32 len, const u8 *data)
+{
+        struct pmac_i2c_pf_inst *inst = instdata;
+
+        return pmac_i2c_xfer(inst->bus, inst->addr | pmac_i2c_write, 0, 0,
+                             (u8 *)data, len);
+}
+
+/* This function is used to do the masking & OR'ing for the "rmw" type
+ * callbacks. Ze should apply the mask and OR in the values in the
+ * buffer before writing back. The problem is that it seems that
+ * various darwin drivers implement the mask/or differently, thus
+ * we need to check the quirks first
+ */
+static void pmac_i2c_do_apply_rmw(struct pmac_i2c_pf_inst *inst,
+                                  u32 len, const u8 *mask, const u8 *val)
+{
+        int i;
+
+        if (inst->quirks & pmac_i2c_quirk_invmask) {
+                for (i = 0; i < len; i ++)
+                        inst->scratch[i] = (inst->buffer[i] & mask[i]) | val[i];
+        } else {
+                for (i = 0; i < len; i ++)
+                        inst->scratch[i] = (inst->buffer[i] & ~mask[i])
+                                | (val[i] & mask[i]);
+        }
+}
+
+static int pmac_i2c_do_rmw(PMF_STD_ARGS, u32 masklen, u32 valuelen,
+                           u32 totallen, const u8 *maskdata,
+                           const u8 *valuedata)
+{
+        struct pmac_i2c_pf_inst *inst = instdata;
+
+        if (masklen > inst->bytes || valuelen > inst->bytes ||
+            totallen > inst->bytes || valuelen > masklen)
+                return -EINVAL;
+
+        pmac_i2c_do_apply_rmw(inst, masklen, maskdata, valuedata);
+
+        return pmac_i2c_xfer(inst->bus, inst->addr | pmac_i2c_write, 0, 0,
+                             inst->scratch, totallen);
+}
+
+static int pmac_i2c_do_read_sub(PMF_STD_ARGS, u8 subaddr, u32 len)
+{
+        struct pmac_i2c_pf_inst *inst = instdata;
+
+        inst->bytes = len;
+        return pmac_i2c_xfer(inst->bus, inst->addr | pmac_i2c_read, 1, subaddr,
+                             inst->buffer, len);
+}
+
+static int pmac_i2c_do_write_sub(PMF_STD_ARGS, u8 subaddr, u32 len,
+                                     const u8 *data)
+{
+        struct pmac_i2c_pf_inst *inst = instdata;
+
+        return pmac_i2c_xfer(inst->bus, inst->addr | pmac_i2c_write, 1,
+                             subaddr, (u8 *)data, len);
+}
 
+static int pmac_i2c_do_set_mode(PMF_STD_ARGS, int mode)
+{
+        struct pmac_i2c_pf_inst *inst = instdata;
+
+        return pmac_i2c_setmode(inst->bus, mode);
+}
+
+static int pmac_i2c_do_rmw_sub(PMF_STD_ARGS, u8 subaddr, u32 masklen,
+                               u32 valuelen, u32 totallen, const u8 *maskdata,
+                               const u8 *valuedata)
+{
+        struct pmac_i2c_pf_inst *inst = instdata;
+
+        if (masklen > inst->bytes || valuelen > inst->bytes ||
+            totallen > inst->bytes || valuelen > masklen)
+                return -EINVAL;
+
+        pmac_i2c_do_apply_rmw(inst, masklen, maskdata, valuedata);
+
+        return pmac_i2c_xfer(inst->bus, inst->addr | pmac_i2c_write, 1,
+                             subaddr, inst->scratch, totallen);
+}
+
+static int pmac_i2c_do_mask_and_comp(PMF_STD_ARGS, u32 len,
+                                     const u8 *maskdata,
+                                     const u8 *valuedata)
+{
+        struct pmac_i2c_pf_inst *inst = instdata;
+        int i, match;
+
+        /* Get return value pointer, it's assumed to be a u32 */
+        if (!args || !args->count || !args->u[0].p)
+                return -EINVAL;
+
+        /* Check buffer */
+        if (len > inst->bytes)
+                return -EINVAL;
+
+        for (i = 0, match = 1; match && i < len; i ++)
+                if ((inst->buffer[i] & maskdata[i]) != valuedata[i])
+                        match = 0;
+        *args->u[0].p = match;
         return 0;
 }
-EXPORT_SYMBOL(pmac_low_i2c_setmode);
 
-int pmac_low_i2c_xfer(struct device_node *np, u8 addrdir, u8 subaddr, u8 *data, int len)
+static int pmac_i2c_do_delay(PMF_STD_ARGS, u32 duration)
 {
-        struct low_i2c_host *host = find_low_i2c_host(np);
+        msleep((duration + 999) / 1000);
+        return 0;
+}
 
-        if (!host)
-                return -ENODEV;
-        WARN_ON(!host->is_open);
 
-        return host->func(host, addrdir, subaddr, data, len);
+static struct pmf_handlers pmac_i2c_pfunc_handlers = {
+        .begin                  = pmac_i2c_do_begin,
+        .end                    = pmac_i2c_do_end,
+        .read_i2c               = pmac_i2c_do_read,
+        .write_i2c              = pmac_i2c_do_write,
+        .rmw_i2c                = pmac_i2c_do_rmw,
+        .read_i2c_sub           = pmac_i2c_do_read_sub,
+        .write_i2c_sub          = pmac_i2c_do_write_sub,
+        .rmw_i2c_sub            = pmac_i2c_do_rmw_sub,
+        .set_i2c_mode           = pmac_i2c_do_set_mode,
+        .mask_and_compare       = pmac_i2c_do_mask_and_comp,
+        .delay                  = pmac_i2c_do_delay,
+};
+
+static void __init pmac_i2c_dev_create(struct device_node *np, int quirks)
+{
+        DBG("dev_create(%s)\n", np->full_name);
+
+        pmf_register_driver(np, &pmac_i2c_pfunc_handlers,
+                            (void *)(long)quirks);
+}
+
+static void __init pmac_i2c_dev_init(struct device_node *np, int quirks)
+{
+        DBG("dev_create(%s)\n", np->full_name);
+
+        pmf_do_functions(np, NULL, 0, PMF_FLAGS_ON_INIT, NULL);
+}
+
+static void pmac_i2c_dev_suspend(struct device_node *np, int quirks)
+{
+        DBG("dev_suspend(%s)\n", np->full_name);
+        pmf_do_functions(np, NULL, 0, PMF_FLAGS_ON_SLEEP, NULL);
+}
+
+static void pmac_i2c_dev_resume(struct device_node *np, int quirks)
+{
+        DBG("dev_resume(%s)\n", np->full_name);
+        pmf_do_functions(np, NULL, 0, PMF_FLAGS_ON_WAKE, NULL);
+}
+
+void pmac_pfunc_i2c_suspend(void)
+{
+        pmac_i2c_devscan(pmac_i2c_dev_suspend);
+}
+
+void pmac_pfunc_i2c_resume(void)
+{
+        pmac_i2c_devscan(pmac_i2c_dev_resume);
+}
+
+/*
+ * Initialize us: probe all i2c busses on the machine, instantiate
+ * busses and platform functions as needed.
+ */
+/* This is non-static as it might be called early by smp code */
+int __init pmac_i2c_init(void)
+{
+        static int i2c_inited;
+
+        if (i2c_inited)
+                return 0;
+        i2c_inited = 1;
+
+        /* Probe keywest-i2c busses */
+        kw_i2c_probe();
+
+#ifdef CONFIG_ADB_PMU
+        /* Probe PMU i2c busses */
+        pmu_i2c_probe();
+#endif
+
+#ifdef CONFIG_PMAC_SMU
+        /* Probe SMU i2c busses */
+        smu_i2c_probe();
+#endif
+
+        /* Now add plaform functions for some known devices */
+        pmac_i2c_devscan(pmac_i2c_dev_create);
+
+        return 0;
 }
-EXPORT_SYMBOL(pmac_low_i2c_xfer);
+arch_initcall(pmac_i2c_init);
+
+/* Since pmac_i2c_init can be called too early for the platform device
+ * registration, we need to do it at a later time. In our case, subsys
+ * happens to fit well, though I agree it's a bit of a hack...
+ */
+static int __init pmac_i2c_create_platform_devices(void)
+{
+        struct pmac_i2c_bus *bus;
+        int i = 0;
+
+        /* In the case where we are initialized from smp_init(), we must
+         * not use the timer (and thus the irq). It's safe from now on
+         * though
+         */
+        pmac_i2c_force_poll = 0;
+
+        /* Create platform devices */
+        list_for_each_entry(bus, &pmac_i2c_busses, link) {
+                bus->platform_dev =
+                        platform_device_alloc("i2c-powermac", i++);
+                if (bus->platform_dev == NULL)
+                        return -ENOMEM;
+                bus->platform_dev->dev.platform_data = bus;
+                platform_device_add(bus->platform_dev);
+        }
+
+        /* Now call platform "init" functions */
+        pmac_i2c_devscan(pmac_i2c_dev_init);
 
+        return 0;
+}
+subsys_initcall(pmac_i2c_create_platform_devices);
diff --git a/arch/powerpc/platforms/powermac/nvram.c b/arch/powerpc/platforms/powermac/nvram.c
index 4042e2f06ee0..3ebd045a3350 100644
--- a/arch/powerpc/platforms/powermac/nvram.c
+++ b/arch/powerpc/platforms/powermac/nvram.c
@@ -514,7 +514,7 @@ static void core99_nvram_sync(void)
 #endif
 }
 
-static int __init core99_nvram_setup(struct device_node *dp)
+static int __init core99_nvram_setup(struct device_node *dp, unsigned long addr)
 {
         int i;
         u32 gen_bank0, gen_bank1;
@@ -528,7 +528,7 @@ static int __init core99_nvram_setup(struct device_node *dp)
                 printk(KERN_ERR "nvram: can't allocate ram image\n");
                 return -ENOMEM;
         }
-        nvram_data = ioremap(dp->addrs[0].address, NVRAM_SIZE*2);
+        nvram_data = ioremap(addr, NVRAM_SIZE*2);
         nvram_naddrs = 1; /* Make sure we get the correct case */
 
         DBG("nvram: Checking bank 0...\n");
@@ -549,6 +549,7 @@ static int __init core99_nvram_setup(struct device_node *dp)
         ppc_md.nvram_write      = core99_nvram_write;
         ppc_md.nvram_size       = core99_nvram_size;
         ppc_md.nvram_sync       = core99_nvram_sync;
+        ppc_md.machine_shutdown = core99_nvram_sync;
         /* 
          * Maybe we could be smarter here though making an exclusive list
          * of known flash chips is a bit nasty as older OF didn't provide us
@@ -569,34 +570,48 @@ static int __init core99_nvram_setup(struct device_node *dp)
 int __init pmac_nvram_init(void)
 {
         struct device_node *dp;
+        struct resource r1, r2;
+        unsigned int s1 = 0, s2 = 0;
         int err = 0;
 
         nvram_naddrs = 0;
 
-        dp = find_devices("nvram");
+        dp = of_find_node_by_name(NULL, "nvram");
         if (dp == NULL) {
                 printk(KERN_ERR "Can't find NVRAM device\n");
                 return -ENODEV;
         }
-        nvram_naddrs = dp->n_addrs;
+
+        /* Try to obtain an address */
+        if (of_address_to_resource(dp, 0, &r1) == 0) {
+                nvram_naddrs = 1;
+                s1 = (r1.end - r1.start) + 1;
+                if (of_address_to_resource(dp, 1, &r2) == 0) {
+                        nvram_naddrs = 2;
+                        s2 = (r2.end - r2.start) + 1;
+                }
+        }
+
         is_core_99 = device_is_compatible(dp, "nvram,flash");
-        if (is_core_99)
-                err = core99_nvram_setup(dp);
+        if (is_core_99) {
+                err = core99_nvram_setup(dp, r1.start);
+                goto bail;
+        }
+
 #ifdef CONFIG_PPC32
-        else if (_machine == _MACH_chrp && nvram_naddrs == 1) {
-                nvram_data = ioremap(dp->addrs[0].address + isa_mem_base,
-                                     dp->addrs[0].size);
+        if (_machine == _MACH_chrp && nvram_naddrs == 1) {
+                nvram_data = ioremap(r1.start, s1);
                 nvram_mult = 1;
                 ppc_md.nvram_read_val   = direct_nvram_read_byte;
                 ppc_md.nvram_write_val  = direct_nvram_write_byte;
         } else if (nvram_naddrs == 1) {
-                nvram_data = ioremap(dp->addrs[0].address, dp->addrs[0].size);
-                nvram_mult = (dp->addrs[0].size + NVRAM_SIZE - 1) / NVRAM_SIZE;
+                nvram_data = ioremap(r1.start, s1);
+                nvram_mult = (s1 + NVRAM_SIZE - 1) / NVRAM_SIZE;
                 ppc_md.nvram_read_val   = direct_nvram_read_byte;
                 ppc_md.nvram_write_val  = direct_nvram_write_byte;
         } else if (nvram_naddrs == 2) {
-                nvram_addr = ioremap(dp->addrs[0].address, dp->addrs[0].size);
-                nvram_data = ioremap(dp->addrs[1].address, dp->addrs[1].size);
+                nvram_addr = ioremap(r1.start, s1);
+                nvram_data = ioremap(r2.start, s2);
                 ppc_md.nvram_read_val   = indirect_nvram_read_byte;
                 ppc_md.nvram_write_val  = indirect_nvram_write_byte;
         } else if (nvram_naddrs == 0 && sys_ctrler == SYS_CTRLER_PMU) {
@@ -605,13 +620,15 @@ int __init pmac_nvram_init(void)
                 ppc_md.nvram_read_val   = pmu_nvram_read_byte;
                 ppc_md.nvram_write_val  = pmu_nvram_write_byte;
 #endif /* CONFIG_ADB_PMU */
-        }
-#endif
-        else {
+        } else {
                 printk(KERN_ERR "Incompatible type of NVRAM\n");
-                return -ENXIO;
+                err = -ENXIO;
         }
-        lookup_partitions();
+#endif /* CONFIG_PPC32 */
+bail:
+        of_node_put(dp);
+        if (err == 0)
+                lookup_partitions();
         return err;
 }
 
diff --git a/arch/powerpc/platforms/powermac/pci.c b/arch/powerpc/platforms/powermac/pci.c
index 443be526cde7..f671ed253901 100644
--- a/arch/powerpc/platforms/powermac/pci.c
+++ b/arch/powerpc/platforms/powermac/pci.c
@@ -1,7 +1,7 @@
 /*
  * Support for PCI bridges found on Power Macintoshes.
  *
- * Copyright (C) 2003 Benjamin Herrenschmuidt (benh@kernel.crashing.org)
+ * Copyright (C) 2003-2005 Benjamin Herrenschmuidt (benh@kernel.crashing.org)
  * Copyright (C) 1997 Paul Mackerras (paulus@samba.org)
  *
  * This program is free software; you can redistribute it and/or
@@ -25,7 +25,7 @@
 #include <asm/pmac_feature.h>
 #include <asm/grackle.h>
 #ifdef CONFIG_PPC64
-#include <asm/iommu.h>
+//#include <asm/iommu.h>
 #include <asm/ppc-pci.h>
 #endif
 
@@ -44,6 +44,7 @@ static int add_bridge(struct device_node *dev);
 static int has_uninorth;
 #ifdef CONFIG_PPC64
 static struct pci_controller *u3_agp;
+static struct pci_controller *u4_pcie;
 static struct pci_controller *u3_ht;
 #endif /* CONFIG_PPC64 */
 
@@ -97,11 +98,8 @@ static void __init fixup_bus_range(struct device_node *bridge)
 
         /* Lookup the "bus-range" property for the hose */
         bus_range = (int *) get_property(bridge, "bus-range", &len);
-        if (bus_range == NULL || len < 2 * sizeof(int)) {
-                printk(KERN_WARNING "Can't get bus-range for %s\n",
-                               bridge->full_name);
+        if (bus_range == NULL || len < 2 * sizeof(int))
                 return;
-        }
         bus_range[1] = fixup_one_level_bus_range(bridge->child, bus_range[1]);
 }
 
@@ -128,14 +126,14 @@ static void __init fixup_bus_range(struct device_node *bridge)
  */
 
 #define MACRISC_CFA0(devfn, off)        \
-        ((1 << (unsigned long)PCI_SLOT(dev_fn)) \
-        | (((unsigned long)PCI_FUNC(dev_fn)) << 8) \
-        | (((unsigned long)(off)) & 0xFCUL))
+        ((1 << (unsigned int)PCI_SLOT(dev_fn)) \
+        | (((unsigned int)PCI_FUNC(dev_fn)) << 8) \
+        | (((unsigned int)(off)) & 0xFCUL))
 
 #define MACRISC_CFA1(bus, devfn, off)   \
-        ((((unsigned long)(bus)) << 16) \
-        |(((unsigned long)(devfn)) << 8) \
-        |(((unsigned long)(off)) & 0xFCUL) \
+        ((((unsigned int)(bus)) << 16) \
+        |(((unsigned int)(devfn)) << 8) \
+        |(((unsigned int)(off)) & 0xFCUL) \
         |1UL)
 
 static unsigned long macrisc_cfg_access(struct pci_controller* hose,
@@ -168,7 +166,8 @@ static int macrisc_read_config(struct pci_bus *bus, unsigned int devfn,
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
                 return PCIBIOS_DEVICE_NOT_FOUND;
-
+        if (offset >= 0x100)
+                return  PCIBIOS_BAD_REGISTER_NUMBER;
         addr = macrisc_cfg_access(hose, bus->number, devfn, offset);
         if (!addr)
                 return PCIBIOS_DEVICE_NOT_FOUND;
@@ -199,7 +198,8 @@ static int macrisc_write_config(struct pci_bus *bus, unsigned int devfn,
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
                 return PCIBIOS_DEVICE_NOT_FOUND;
-
+        if (offset >= 0x100)
+                return  PCIBIOS_BAD_REGISTER_NUMBER;
         addr = macrisc_cfg_access(hose, bus->number, devfn, offset);
         if (!addr)
                 return PCIBIOS_DEVICE_NOT_FOUND;
@@ -234,12 +234,13 @@ static struct pci_ops macrisc_pci_ops =
 /*
  * Verify that a specific (bus, dev_fn) exists on chaos
  */
-static int
-chaos_validate_dev(struct pci_bus *bus, int devfn, int offset)
+static int chaos_validate_dev(struct pci_bus *bus, int devfn, int offset)
 {
         struct device_node *np;
         u32 *vendor, *device;
 
+        if (offset >= 0x100)
+                return  PCIBIOS_BAD_REGISTER_NUMBER;
         np = pci_busdev_to_OF_node(bus, devfn);
         if (np == NULL)
                 return PCIBIOS_DEVICE_NOT_FOUND;
@@ -285,15 +286,13 @@ static struct pci_ops chaos_pci_ops =
 };
 
 static void __init setup_chaos(struct pci_controller *hose,
-                               struct reg_property *addr)
+                               struct resource *addr)
 {
         /* assume a `chaos' bridge */
         hose->ops = &chaos_pci_ops;
-        hose->cfg_addr = ioremap(addr->address + 0x800000, 0x1000);
-        hose->cfg_data = ioremap(addr->address + 0xc00000, 0x1000);
+        hose->cfg_addr = ioremap(addr->start + 0x800000, 0x1000);
+        hose->cfg_data = ioremap(addr->start + 0xc00000, 0x1000);
 }
-#else
-#define setup_chaos(hose, addr)
 #endif /* CONFIG_PPC32 */
 
 #ifdef CONFIG_PPC64
@@ -326,7 +325,7 @@ static int u3_ht_skip_device(struct pci_controller *hose,
         else
                 busdn = hose->arch_data;
         for (dn = busdn->child; dn; dn = dn->sibling)
-                if (dn->data && PCI_DN(dn)->devfn == devfn)
+                if (PCI_DN(dn) && PCI_DN(dn)->devfn == devfn)
                         break;
         if (dn == NULL)
                 return -1;
@@ -343,10 +342,10 @@ static int u3_ht_skip_device(struct pci_controller *hose,
 }
 
 #define U3_HT_CFA0(devfn, off)          \
-                ((((unsigned long)devfn) << 8) | offset)
+                ((((unsigned int)devfn) << 8) | offset)
 #define U3_HT_CFA1(bus, devfn, off)     \
                 (U3_HT_CFA0(devfn, off) \
-                + (((unsigned long)bus) << 16) \
+                + (((unsigned int)bus) << 16) \
                 + 0x01000000UL)
 
 static unsigned long u3_ht_cfg_access(struct pci_controller* hose,
@@ -356,9 +355,11 @@ static unsigned long u3_ht_cfg_access(struct pci_controller* hose,
                 /* For now, we don't self probe U3 HT bridge */
                 if (PCI_SLOT(devfn) == 0)
                         return 0;
-                return ((unsigned long)hose->cfg_data) + U3_HT_CFA0(devfn, offset);
+                return ((unsigned long)hose->cfg_data) +
+                        U3_HT_CFA0(devfn, offset);
         } else
-                return ((unsigned long)hose->cfg_data) + U3_HT_CFA1(bus, devfn, offset);
+                return ((unsigned long)hose->cfg_data) +
+                        U3_HT_CFA1(bus, devfn, offset);
 }
 
 static int u3_ht_read_config(struct pci_bus *bus, unsigned int devfn,
@@ -370,7 +371,8 @@ static int u3_ht_read_config(struct pci_bus *bus, unsigned int devfn,
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
                 return PCIBIOS_DEVICE_NOT_FOUND;
-
+        if (offset >= 0x100)
+                return  PCIBIOS_BAD_REGISTER_NUMBER;
         addr = u3_ht_cfg_access(hose, bus->number, devfn, offset);
         if (!addr)
                 return PCIBIOS_DEVICE_NOT_FOUND;
@@ -419,7 +421,8 @@ static int u3_ht_write_config(struct pci_bus *bus, unsigned int devfn,
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
                 return PCIBIOS_DEVICE_NOT_FOUND;
-
+        if (offset >= 0x100)
+                return  PCIBIOS_BAD_REGISTER_NUMBER;
         addr = u3_ht_cfg_access(hose, bus->number, devfn, offset);
         if (!addr)
                 return PCIBIOS_DEVICE_NOT_FOUND;
@@ -459,6 +462,112 @@ static struct pci_ops u3_ht_pci_ops =
         u3_ht_read_config,
         u3_ht_write_config
 };
+
+#define U4_PCIE_CFA0(devfn, off)        \
+        ((1 << ((unsigned int)PCI_SLOT(dev_fn)))        \
+         | (((unsigned int)PCI_FUNC(dev_fn)) << 8)      \
+         | ((((unsigned int)(off)) >> 8) << 28) \
+         | (((unsigned int)(off)) & 0xfcU))
+
+#define U4_PCIE_CFA1(bus, devfn, off)   \
+        ((((unsigned int)(bus)) << 16) \
+         |(((unsigned int)(devfn)) << 8)        \
+         | ((((unsigned int)(off)) >> 8) << 28) \
+         |(((unsigned int)(off)) & 0xfcU)       \
+         |1UL)
+
+static unsigned long u4_pcie_cfg_access(struct pci_controller* hose,
+                                        u8 bus, u8 dev_fn, int offset)
+{
+        unsigned int caddr;
+
+        if (bus == hose->first_busno) {
+                caddr = U4_PCIE_CFA0(dev_fn, offset);
+        } else
+                caddr = U4_PCIE_CFA1(bus, dev_fn, offset);
+
+        /* Uninorth will return garbage if we don't read back the value ! */
+        do {
+                out_le32(hose->cfg_addr, caddr);
+        } while (in_le32(hose->cfg_addr) != caddr);
+
+        offset &= 0x03;
+        return ((unsigned long)hose->cfg_data) + offset;
+}
+
+static int u4_pcie_read_config(struct pci_bus *bus, unsigned int devfn,
+                               int offset, int len, u32 *val)
+{
+        struct pci_controller *hose;
+        unsigned long addr;
+
+        hose = pci_bus_to_host(bus);
+        if (hose == NULL)
+                return PCIBIOS_DEVICE_NOT_FOUND;
+        if (offset >= 0x1000)
+                return  PCIBIOS_BAD_REGISTER_NUMBER;
+        addr = u4_pcie_cfg_access(hose, bus->number, devfn, offset);
+        if (!addr)
+                return PCIBIOS_DEVICE_NOT_FOUND;
+        /*
+         * Note: the caller has already checked that offset is
+         * suitably aligned and that len is 1, 2 or 4.
+         */
+        switch (len) {
+        case 1:
+                *val = in_8((u8 *)addr);
+                break;
+        case 2:
+                *val = in_le16((u16 *)addr);
+                break;
+        default:
+                *val = in_le32((u32 *)addr);
+                break;
+        }
+        return PCIBIOS_SUCCESSFUL;
+}
+
+static int u4_pcie_write_config(struct pci_bus *bus, unsigned int devfn,
+                                int offset, int len, u32 val)
+{
+        struct pci_controller *hose;
+        unsigned long addr;
+
+        hose = pci_bus_to_host(bus);
+        if (hose == NULL)
+                return PCIBIOS_DEVICE_NOT_FOUND;
+        if (offset >= 0x1000)
+                return  PCIBIOS_BAD_REGISTER_NUMBER;
+        addr = u4_pcie_cfg_access(hose, bus->number, devfn, offset);
+        if (!addr)
+                return PCIBIOS_DEVICE_NOT_FOUND;
+        /*
+         * Note: the caller has already checked that offset is
+         * suitably aligned and that len is 1, 2 or 4.
+         */
+        switch (len) {
+        case 1:
+                out_8((u8 *)addr, val);
+                (void) in_8((u8 *)addr);
+                break;
+        case 2:
+                out_le16((u16 *)addr, val);
+                (void) in_le16((u16 *)addr);
+                break;
+        default:
+                out_le32((u32 *)addr, val);
+                (void) in_le32((u32 *)addr);
+                break;
+        }
+        return PCIBIOS_SUCCESSFUL;
+}
+
+static struct pci_ops u4_pcie_pci_ops =
+{
+        u4_pcie_read_config,
+        u4_pcie_write_config
+};
+
 #endif /* CONFIG_PPC64 */
 
 #ifdef CONFIG_PPC32
@@ -532,7 +641,8 @@ static void __init init_p2pbridge(void)
         }
         if (early_read_config_word(hose, bus, devfn,
                                    PCI_BRIDGE_CONTROL, &val) < 0) {
-                printk(KERN_ERR "init_p2pbridge: couldn't read bridge control\n");
+                printk(KERN_ERR "init_p2pbridge: couldn't read bridge"
+                       " control\n");
                 return;
         }
         val &= ~PCI_BRIDGE_CTL_MASTER_ABORT;
@@ -576,36 +686,38 @@ static void __init fixup_nec_usb2(void)
                         continue;
                 early_read_config_dword(hose, bus, devfn, 0xe4, &data);
                 if (data & 1UL) {
-                        printk("Found NEC PD720100A USB2 chip with disabled EHCI, fixing up...\n");
+                        printk("Found NEC PD720100A USB2 chip with disabled"
+                               " EHCI, fixing up...\n");
                         data &= ~1UL;
                         early_write_config_dword(hose, bus, devfn, 0xe4, data);
-                        early_write_config_byte(hose, bus, devfn | 2, PCI_INTERRUPT_LINE,
+                        early_write_config_byte(hose, bus,
+                                                devfn | 2, PCI_INTERRUPT_LINE,
                                 nec->intrs[0].line);
                 }
         }
 }
 
 static void __init setup_bandit(struct pci_controller *hose,
-                                struct reg_property *addr)
+                                struct resource *addr)
 {
         hose->ops = &macrisc_pci_ops;
-        hose->cfg_addr = ioremap(addr->address + 0x800000, 0x1000);
-        hose->cfg_data = ioremap(addr->address + 0xc00000, 0x1000);
+        hose->cfg_addr = ioremap(addr->start + 0x800000, 0x1000);
+        hose->cfg_data = ioremap(addr->start + 0xc00000, 0x1000);
         init_bandit(hose);
 }
 
 static int __init setup_uninorth(struct pci_controller *hose,
-                                 struct reg_property *addr)
+                                 struct resource *addr)
 {
         pci_assign_all_buses = 1;
         has_uninorth = 1;
         hose->ops = &macrisc_pci_ops;
-        hose->cfg_addr = ioremap(addr->address + 0x800000, 0x1000);
-        hose->cfg_data = ioremap(addr->address + 0xc00000, 0x1000);
+        hose->cfg_addr = ioremap(addr->start + 0x800000, 0x1000);
+        hose->cfg_data = ioremap(addr->start + 0xc00000, 0x1000);
         /* We "know" that the bridge at f2000000 has the PCI slots. */
-        return addr->address == 0xf2000000;
+        return addr->start == 0xf2000000;
 }
-#endif
+#endif /* CONFIG_PPC32 */
 
 #ifdef CONFIG_PPC64
 static void __init setup_u3_agp(struct pci_controller* hose)
@@ -625,15 +737,36 @@ static void __init setup_u3_agp(struct pci_controller* hose)
         hose->ops = &macrisc_pci_ops;
         hose->cfg_addr = ioremap(0xf0000000 + 0x800000, 0x1000);
         hose->cfg_data = ioremap(0xf0000000 + 0xc00000, 0x1000);
-
         u3_agp = hose;
 }
 
+static void __init setup_u4_pcie(struct pci_controller* hose)
+{
+        /* We currently only implement the "non-atomic" config space, to
+         * be optimised later.
+         */
+        hose->ops = &u4_pcie_pci_ops;
+        hose->cfg_addr = ioremap(0xf0000000 + 0x800000, 0x1000);
+        hose->cfg_data = ioremap(0xf0000000 + 0xc00000, 0x1000);
+
+        /* The bus contains a bridge from root -> device, we need to
+         * make it visible on bus 0 so that we pick the right type
+         * of config cycles. If we didn't, we would have to force all
+         * config cycles to be type 1. So we override the "bus-range"
+         * property here
+         */
+        hose->first_busno = 0x00;
+        hose->last_busno = 0xff;
+        u4_pcie = hose;
+}
+
 static void __init setup_u3_ht(struct pci_controller* hose)
 {
         struct device_node *np = (struct device_node *)hose->arch_data;
+        struct pci_controller *other = NULL;
         int i, cur;
 
+
         hose->ops = &u3_ht_pci_ops;
 
         /* We hard code the address because of the different size of
@@ -667,11 +800,20 @@ static void __init setup_u3_ht(struct pci_controller* hose)
 
         u3_ht = hose;
 
-        if (u3_agp == NULL) {
-                DBG("U3 has no AGP, using full resource range\n");
+        if (u3_agp != NULL)
+                other = u3_agp;
+        else if (u4_pcie != NULL)
+                other = u4_pcie;
+
+        if (other == NULL) {
+                DBG("U3/4 has no AGP/PCIE, using full resource range\n");
                 return;
         }
 
+        /* Fixup bus range vs. PCIE */
+        if (u4_pcie)
+                hose->last_busno = u4_pcie->first_busno - 1;
+
         /* We "remove" the AGP resources from the resources allocated to HT,
          * that is we create "holes". However, that code does assumptions
          * that so far happen to be true (cross fingers...), typically that
@@ -679,7 +821,7 @@ static void __init setup_u3_ht(struct pci_controller* hose)
          */
         cur = 0;
         for (i=0; i<3; i++) {
-                struct resource *res = &u3_agp->mem_resources[i];
+                struct resource *res = &other->mem_resources[i];
                 if (res->flags != IORESOURCE_MEM)
                         continue;
                 /* We don't care about "fine" resources */
@@ -722,7 +864,7 @@ static void __init setup_u3_ht(struct pci_controller* hose)
                 hose->mem_resources[cur-1].end = res->start - 1;
         }
 }
-#endif
+#endif /* CONFIG_PPC64 */
 
 /*
  * We assume that if we have a G3 powermac, we have one bridge called
@@ -733,24 +875,17 @@ static int __init add_bridge(struct device_node *dev)
 {
         int len;
         struct pci_controller *hose;
-#ifdef CONFIG_PPC32
-        struct reg_property *addr;
-#endif
+        struct resource rsrc;
         char *disp_name;
         int *bus_range;
-        int primary = 1;
+        int primary = 1, has_address = 0;
 
         DBG("Adding PCI host bridge %s\n", dev->full_name);
 
-#ifdef CONFIG_PPC32
-        /* XXX fix this */
-        addr = (struct reg_property *) get_property(dev, "reg", &len);
-        if (addr == NULL || len < sizeof(*addr)) {
-                printk(KERN_WARNING "Can't use %s: no address\n",
-                       dev->full_name);
-                return -ENODEV;
-        }
-#endif
+        /* Fetch host bridge registers address */
+        has_address = (of_address_to_resource(dev, 0, &rsrc) == 0);
+
+        /* Get bus range if any */
         bus_range = (int *) get_property(dev, "bus-range", &len);
         if (bus_range == NULL || len < 2 * sizeof(int)) {
                 printk(KERN_WARNING "Can't get bus-range for %s, assume"
@@ -770,6 +905,8 @@ static int __init add_bridge(struct device_node *dev)
         hose->last_busno = bus_range ? bus_range[1] : 0xff;
 
         disp_name = NULL;
+
+        /* 64 bits only bridges */
 #ifdef CONFIG_PPC64
         if (device_is_compatible(dev, "u3-agp")) {
                 setup_u3_agp(hose);
@@ -779,28 +916,37 @@ static int __init add_bridge(struct device_node *dev)
                 setup_u3_ht(hose);
                 disp_name = "U3-HT";
                 primary = 1;
+        } else if (device_is_compatible(dev, "u4-pcie")) {
+                setup_u4_pcie(hose);
+                disp_name = "U4-PCIE";
+                primary = 0;
         }
-        printk(KERN_INFO "Found %s PCI host bridge.  Firmware bus number: %d->%d\n",
-                disp_name, hose->first_busno, hose->last_busno);
-#else
+        printk(KERN_INFO "Found %s PCI host bridge.  Firmware bus number:"
+               " %d->%d\n", disp_name, hose->first_busno, hose->last_busno);
+#endif /* CONFIG_PPC64 */
+
+        /* 32 bits only bridges */
+#ifdef CONFIG_PPC32
         if (device_is_compatible(dev, "uni-north")) {
-                primary = setup_uninorth(hose, addr);
+                primary = setup_uninorth(hose, &rsrc);
                 disp_name = "UniNorth";
         } else if (strcmp(dev->name, "pci") == 0) {
                 /* XXX assume this is a mpc106 (grackle) */
                 setup_grackle(hose);
                 disp_name = "Grackle (MPC106)";
         } else if (strcmp(dev->name, "bandit") == 0) {
-                setup_bandit(hose, addr);
+                setup_bandit(hose, &rsrc);
                 disp_name = "Bandit";
         } else if (strcmp(dev->name, "chaos") == 0) {
-                setup_chaos(hose, addr);
+                setup_chaos(hose, &rsrc);
                 disp_name = "Chaos";
                 primary = 0;
         }
-        printk(KERN_INFO "Found %s PCI host bridge at 0x%08lx. Firmware bus number: %d->%d\n",
-                disp_name, addr->address, hose->first_busno, hose->last_busno);
-#endif
+        printk(KERN_INFO "Found %s PCI host bridge at 0x%08lx. "
+               "Firmware bus number: %d->%d\n",
+                disp_name, rsrc.start, hose->first_busno, hose->last_busno);
+#endif /* CONFIG_PPC32 */
+
         DBG(" ->Hose at 0x%p, cfg_addr=0x%p,cfg_data=0x%p\n",
                 hose, hose->cfg_addr, hose->cfg_data);
 
@@ -814,8 +960,7 @@ static int __init add_bridge(struct device_node *dev)
         return 0;
 }
 
-static void __init
-pcibios_fixup_OF_interrupts(void)
+static void __init pcibios_fixup_OF_interrupts(void)
 {
         struct pci_dev* dev = NULL;
 
@@ -835,8 +980,7 @@ pcibios_fixup_OF_interrupts(void)
         }
 }
 
-void __init
-pmac_pcibios_fixup(void)
+void __init pmac_pcibios_fixup(void)
 {
         /* Fixup interrupts according to OF tree */
         pcibios_fixup_OF_interrupts();
@@ -899,6 +1043,8 @@ void __init pmac_pci_init(void)
                 pci_setup_phb_io(u3_ht, 1);
         if (u3_agp)
                 pci_setup_phb_io(u3_agp, 0);
+        if (u4_pcie)
+                pci_setup_phb_io(u4_pcie, 0);
 
         /*
          * On ppc64, fixup the IO resources on our host bridges as
@@ -911,7 +1057,8 @@ void __init pmac_pci_init(void)
 
         /* Fixup the PCI<->OF mapping for U3 AGP due to bus renumbering. We
          * assume there is no P2P bridge on the AGP bus, which should be a
-         * safe assumptions hopefully.
+         * safe assumptions for now. We should do something better in the
+         * future though
          */
         if (u3_agp) {
                 struct device_node *np = u3_agp->arch_data;
@@ -919,7 +1066,6 @@ void __init pmac_pci_init(void)
                 for (np = np->child; np; np = np->sibling)
                         PCI_DN(np)->busno = 0xf0;
         }
-
         /* pmac_check_ht_link(); */
 
         /* Tell pci.c to not use the common resource allocation mechanism */
@@ -1126,7 +1272,8 @@ void pmac_pci_fixup_pciata(struct pci_dev* dev)
  good:
         pci_read_config_byte(dev, PCI_CLASS_PROG, &progif);
         if ((progif & 5) != 5) {
-                printk(KERN_INFO "Forcing PCI IDE into native mode: %s\n", pci_name(dev));
+                printk(KERN_INFO "Forcing PCI IDE into native mode: %s\n",
+                       pci_name(dev));
                 (void) pci_write_config_byte(dev, PCI_CLASS_PROG, progif|5);
                 if (pci_read_config_byte(dev, PCI_CLASS_PROG, &progif) ||
                     (progif & 5) != 5)
@@ -1152,7 +1299,8 @@ static void fixup_k2_sata(struct pci_dev* dev)
                 for (i = 0; i < 6; i++) {
                         dev->resource[i].start = dev->resource[i].end = 0;
                         dev->resource[i].flags = 0;
-                        pci_write_config_dword(dev, PCI_BASE_ADDRESS_0 + 4 * i, 0);
+                        pci_write_config_dword(dev, PCI_BASE_ADDRESS_0 + 4 * i,
+                                               0);
                 }
         } else {
                 pci_read_config_word(dev, PCI_COMMAND, &cmd);
@@ -1161,7 +1309,8 @@ static void fixup_k2_sata(struct pci_dev* dev)
                 for (i = 0; i < 5; i++) {
                         dev->resource[i].start = dev->resource[i].end = 0;
                         dev->resource[i].flags = 0;
-                        pci_write_config_dword(dev, PCI_BASE_ADDRESS_0 + 4 * i, 0);
+                        pci_write_config_dword(dev, PCI_BASE_ADDRESS_0 + 4 * i,
+                                               0);
                 }
         }
 }
diff --git a/arch/powerpc/platforms/powermac/pfunc_base.c b/arch/powerpc/platforms/powermac/pfunc_base.c
new file mode 100644
index 000000000000..4ffd2a9832a0
--- /dev/null
+++ b/arch/powerpc/platforms/powermac/pfunc_base.c
@@ -0,0 +1,405 @@
+#include <linux/config.h>
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/kernel.h>
+#include <linux/interrupt.h>
+#include <linux/spinlock.h>
+
+#include <asm/pmac_feature.h>
+#include <asm/pmac_pfunc.h>
+
+#define DBG(fmt...)     printk(fmt)
+
+static irqreturn_t macio_gpio_irq(int irq, void *data, struct pt_regs *regs)
+{
+        pmf_do_irq(data);
+
+        return IRQ_HANDLED;
+}
+
+static int macio_do_gpio_irq_enable(struct pmf_function *func)
+{
+        if (func->node->n_intrs < 1)
+                return -EINVAL;
+
+        return request_irq(func->node->intrs[0].line, macio_gpio_irq, 0,
+                           func->node->name, func);
+}
+
+static int macio_do_gpio_irq_disable(struct pmf_function *func)
+{
+        if (func->node->n_intrs < 1)
+                return -EINVAL;
+
+        free_irq(func->node->intrs[0].line, func);
+        return 0;
+}
+
+static int macio_do_gpio_write(PMF_STD_ARGS, u8 value, u8 mask)
+{
+        u8 __iomem *addr = (u8 __iomem *)func->driver_data;
+        unsigned long flags;
+        u8 tmp;
+
+        /* Check polarity */
+        if (args && args->count && !args->u[0].v)
+                value = ~value;
+
+        /* Toggle the GPIO */
+        spin_lock_irqsave(&feature_lock, flags);
+        tmp = readb(addr);
+        tmp = (tmp & ~mask) | (value & mask);
+        DBG("Do write 0x%02x to GPIO %s (%p)\n",
+            tmp, func->node->full_name, addr);
+        writeb(tmp, addr);
+        spin_unlock_irqrestore(&feature_lock, flags);
+
+        return 0;
+}
+
+static int macio_do_gpio_read(PMF_STD_ARGS, u8 mask, int rshift, u8 xor)
+{
+        u8 __iomem *addr = (u8 __iomem *)func->driver_data;
+        u32 value;
+
+        /* Check if we have room for reply */
+        if (args == NULL || args->count == 0 || args->u[0].p == NULL)
+                return -EINVAL;
+
+        value = readb(addr);
+        *args->u[0].p = ((value & mask) >> rshift) ^ xor;
+
+        return 0;
+}
+
+static int macio_do_delay(PMF_STD_ARGS, u32 duration)
+{
+        /* assume we can sleep ! */
+        msleep((duration + 999) / 1000);
+        return 0;
+}
+
+static struct pmf_handlers macio_gpio_handlers = {
+        .irq_enable     = macio_do_gpio_irq_enable,
+        .irq_disable    = macio_do_gpio_irq_disable,
+        .write_gpio     = macio_do_gpio_write,
+        .read_gpio      = macio_do_gpio_read,
+        .delay          = macio_do_delay,
+};
+
+static void macio_gpio_init_one(struct macio_chip *macio)
+{
+        struct device_node *gparent, *gp;
+
+        /*
+         * Find the "gpio" parent node
+         */
+
+        for (gparent = NULL;
+             (gparent = of_get_next_child(macio->of_node, gparent)) != NULL;)
+                if (strcmp(gparent->name, "gpio") == 0)
+                        break;
+        if (gparent == NULL)
+                return;
+
+        DBG("Installing GPIO functions for macio %s\n",
+            macio->of_node->full_name);
+
+        /*
+         * Ok, got one, we dont need anything special to track them down, so
+         * we just create them all
+         */
+        for (gp = NULL; (gp = of_get_next_child(gparent, gp)) != NULL;) {
+                u32 *reg = (u32 *)get_property(gp, "reg", NULL);
+                unsigned long offset;
+                if (reg == NULL)
+                        continue;
+                offset = *reg;
+                /* Deal with old style device-tree. We can safely hard code the
+                 * offset for now too even if it's a bit gross ...
+                 */
+                if (offset < 0x50)
+                        offset += 0x50;
+                offset += (unsigned long)macio->base;
+                pmf_register_driver(gp, &macio_gpio_handlers, (void *)offset);
+        }
+
+        DBG("Calling initial GPIO functions for macio %s\n",
+            macio->of_node->full_name);
+
+        /* And now we run all the init ones */
+        for (gp = NULL; (gp = of_get_next_child(gparent, gp)) != NULL;)
+                pmf_do_functions(gp, NULL, 0, PMF_FLAGS_ON_INIT, NULL);
+
+        /* Note: We do not at this point implement the "at sleep" or "at wake"
+         * functions. I yet to find any for GPIOs anyway
+         */
+}
+
+static int macio_do_write_reg32(PMF_STD_ARGS, u32 offset, u32 value, u32 mask)
+{
+        struct macio_chip *macio = func->driver_data;
+        unsigned long flags;
+
+        spin_lock_irqsave(&feature_lock, flags);
+        MACIO_OUT32(offset, (MACIO_IN32(offset) & ~mask) | (value & mask));
+        spin_unlock_irqrestore(&feature_lock, flags);
+        return 0;
+}
+
+static int macio_do_read_reg32(PMF_STD_ARGS, u32 offset)
+{
+        struct macio_chip *macio = func->driver_data;
+
+        /* Check if we have room for reply */
+        if (args == NULL || args->count == 0 || args->u[0].p == NULL)
+                return -EINVAL;
+
+        *args->u[0].p = MACIO_IN32(offset);
+        return 0;
+}
+
+static int macio_do_write_reg8(PMF_STD_ARGS, u32 offset, u8 value, u8 mask)
+{
+        struct macio_chip *macio = func->driver_data;
+        unsigned long flags;
+
+        spin_lock_irqsave(&feature_lock, flags);
+        MACIO_OUT8(offset, (MACIO_IN8(offset) & ~mask) | (value & mask));
+        spin_unlock_irqrestore(&feature_lock, flags);
+        return 0;
+}
+
+static int macio_do_read_reg8(PMF_STD_ARGS, u32 offset)
+{
+        struct macio_chip *macio = func->driver_data;
+
+        /* Check if we have room for reply */
+        if (args == NULL || args->count == 0 || args->u[0].p == NULL)
+                return -EINVAL;
+
+        *((u8 *)(args->u[0].p)) = MACIO_IN8(offset);
+        return 0;
+}
+
+static int macio_do_read_reg32_msrx(PMF_STD_ARGS, u32 offset, u32 mask,
+                                    u32 shift, u32 xor)
+{
+        struct macio_chip *macio = func->driver_data;
+
+        /* Check if we have room for reply */
+        if (args == NULL || args->count == 0 || args->u[0].p == NULL)
+                return -EINVAL;
+
+        *args->u[0].p = ((MACIO_IN32(offset) & mask) >> shift) ^ xor;
+        return 0;
+}
+
+static int macio_do_read_reg8_msrx(PMF_STD_ARGS, u32 offset, u32 mask,
+                                   u32 shift, u32 xor)
+{
+        struct macio_chip *macio = func->driver_data;
+
+        /* Check if we have room for reply */
+        if (args == NULL || args->count == 0 || args->u[0].p == NULL)
+                return -EINVAL;
+
+        *((u8 *)(args->u[0].p)) = ((MACIO_IN8(offset) & mask) >> shift) ^ xor;
+        return 0;
+}
+
+static int macio_do_write_reg32_slm(PMF_STD_ARGS, u32 offset, u32 shift,
+                                    u32 mask)
+{
+        struct macio_chip *macio = func->driver_data;
+        unsigned long flags;
+        u32 tmp, val;
+
+        /* Check args */
+        if (args == NULL || args->count == 0)
+                return -EINVAL;
+
+        spin_lock_irqsave(&feature_lock, flags);
+        tmp = MACIO_IN32(offset);
+        val = args->u[0].v << shift;
+        tmp = (tmp & ~mask) | (val & mask);
+        MACIO_OUT32(offset, tmp);
+        spin_unlock_irqrestore(&feature_lock, flags);
+        return 0;
+}
+
+static int macio_do_write_reg8_slm(PMF_STD_ARGS, u32 offset, u32 shift,
+                                   u32 mask)
+{
+        struct macio_chip *macio = func->driver_data;
+        unsigned long flags;
+        u32 tmp, val;
+
+        /* Check args */
+        if (args == NULL || args->count == 0)
+                return -EINVAL;
+
+        spin_lock_irqsave(&feature_lock, flags);
+        tmp = MACIO_IN8(offset);
+        val = args->u[0].v << shift;
+        tmp = (tmp & ~mask) | (val & mask);
+        MACIO_OUT8(offset, tmp);
+        spin_unlock_irqrestore(&feature_lock, flags);
+        return 0;
+}
+
+static struct pmf_handlers macio_mmio_handlers = {
+        .write_reg32            = macio_do_write_reg32,
+        .read_reg32             = macio_do_read_reg32,
+        .write_reg8             = macio_do_write_reg8,
+        .read_reg32             = macio_do_read_reg8,
+        .read_reg32_msrx        = macio_do_read_reg32_msrx,
+        .read_reg8_msrx         = macio_do_read_reg8_msrx,
+        .write_reg32_slm        = macio_do_write_reg32_slm,
+        .write_reg8_slm         = macio_do_write_reg8_slm,
+        .delay                  = macio_do_delay,
+};
+
+static void macio_mmio_init_one(struct macio_chip *macio)
+{
+        DBG("Installing MMIO functions for macio %s\n",
+            macio->of_node->full_name);
+
+        pmf_register_driver(macio->of_node, &macio_mmio_handlers, macio);
+}
+
+static struct device_node *unin_hwclock;
+
+static int unin_do_write_reg32(PMF_STD_ARGS, u32 offset, u32 value, u32 mask)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&feature_lock, flags);
+        /* This is fairly bogus in darwin, but it should work for our needs
+         * implemeted that way:
+         */
+        UN_OUT(offset, (UN_IN(offset) & ~mask) | (value & mask));
+        spin_unlock_irqrestore(&feature_lock, flags);
+        return 0;
+}
+
+
+static struct pmf_handlers unin_mmio_handlers = {
+        .write_reg32            = unin_do_write_reg32,
+        .delay                  = macio_do_delay,
+};
+
+static void uninorth_install_pfunc(void)
+{
+        struct device_node *np;
+
+        DBG("Installing functions for UniN %s\n",
+            uninorth_node->full_name);
+
+        /*
+         * Install handlers for the bridge itself
+         */
+        pmf_register_driver(uninorth_node, &unin_mmio_handlers, NULL);
+        pmf_do_functions(uninorth_node, NULL, 0, PMF_FLAGS_ON_INIT, NULL);
+
+
+        /*
+         * Install handlers for the hwclock child if any
+         */
+        for (np = NULL; (np = of_get_next_child(uninorth_node, np)) != NULL;)
+                if (strcmp(np->name, "hw-clock") == 0) {
+                        unin_hwclock = np;
+                        break;
+                }
+        if (unin_hwclock) {
+                DBG("Installing functions for UniN clock %s\n",
+                    unin_hwclock->full_name);
+                pmf_register_driver(unin_hwclock, &unin_mmio_handlers, NULL);
+                pmf_do_functions(unin_hwclock, NULL, 0, PMF_FLAGS_ON_INIT,
+                                 NULL);
+        }
+}
+
+/* We export this as the SMP code might init us early */
+int __init pmac_pfunc_base_install(void)
+{
+        static int pfbase_inited;
+        int i;
+
+        if (pfbase_inited)
+                return 0;
+        pfbase_inited = 1;
+
+
+        DBG("Installing base platform functions...\n");
+
+        /*
+         * Locate mac-io chips and install handlers
+         */
+        for (i = 0 ; i < MAX_MACIO_CHIPS; i++) {
+                if (macio_chips[i].of_node) {
+                        macio_mmio_init_one(&macio_chips[i]);
+                        macio_gpio_init_one(&macio_chips[i]);
+                }
+        }
+
+        /*
+         * Install handlers for northbridge and direct mapped hwclock
+         * if any. We do not implement the config space access callback
+         * which is only ever used for functions that we do not call in
+         * the current driver (enabling/disabling cells in U2, mostly used
+         * to restore the PCI settings, we do that differently)
+         */
+        if (uninorth_node && uninorth_base)
+                uninorth_install_pfunc();
+
+        DBG("All base functions installed\n");
+
+        return 0;
+}
+
+arch_initcall(pmac_pfunc_base_install);
+
+#ifdef CONFIG_PM
+
+/* Those can be called by pmac_feature. Ultimately, I should use a sysdev
+ * or a device, but for now, that's good enough until I sort out some
+ * ordering issues. Also, we do not bother with GPIOs, as so far I yet have
+ * to see a case where a GPIO function has the on-suspend or on-resume bit
+ */
+void pmac_pfunc_base_suspend(void)
+{
+        int i;
+
+        for (i = 0 ; i < MAX_MACIO_CHIPS; i++) {
+                if (macio_chips[i].of_node)
+                        pmf_do_functions(macio_chips[i].of_node, NULL, 0,
+                                         PMF_FLAGS_ON_SLEEP, NULL);
+        }
+        if (uninorth_node)
+                pmf_do_functions(uninorth_node, NULL, 0,
+                                 PMF_FLAGS_ON_SLEEP, NULL);
+        if (unin_hwclock)
+                pmf_do_functions(unin_hwclock, NULL, 0,
+                                 PMF_FLAGS_ON_SLEEP, NULL);
+}
+
+void pmac_pfunc_base_resume(void)
+{
+        int i;
+
+        if (unin_hwclock)
+                pmf_do_functions(unin_hwclock, NULL, 0,
+                                 PMF_FLAGS_ON_WAKE, NULL);
+        if (uninorth_node)
+                pmf_do_functions(uninorth_node, NULL, 0,
+                                 PMF_FLAGS_ON_WAKE, NULL);
+        for (i = 0 ; i < MAX_MACIO_CHIPS; i++) {
+                if (macio_chips[i].of_node)
+                        pmf_do_functions(macio_chips[i].of_node, NULL, 0,
+                                         PMF_FLAGS_ON_WAKE, NULL);
+        }
+}
+
+#endif /* CONFIG_PM */
diff --git a/arch/powerpc/platforms/powermac/pfunc_core.c b/arch/powerpc/platforms/powermac/pfunc_core.c
new file mode 100644
index 000000000000..c32c623001dc
--- /dev/null
+++ b/arch/powerpc/platforms/powermac/pfunc_core.c
@@ -0,0 +1,989 @@
+/*
+ *
+ * FIXME: Properly make this race free with refcounting etc...
+ *
+ * FIXME: LOCKING !!!
+ */
+
+#include <linux/config.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/kernel.h>
+#include <linux/spinlock.h>
+#include <linux/module.h>
+
+#include <asm/semaphore.h>
+#include <asm/prom.h>
+#include <asm/pmac_pfunc.h>
+
+/* Debug */
+#define LOG_PARSE(fmt...)
+#define LOG_ERROR(fmt...)       printk(fmt)
+#define LOG_BLOB(t,b,c)
+#define DBG(fmt...)             printk(fmt)
+
+/* Command numbers */
+#define PMF_CMD_LIST                    0
+#define PMF_CMD_WRITE_GPIO              1
+#define PMF_CMD_READ_GPIO               2
+#define PMF_CMD_WRITE_REG32             3
+#define PMF_CMD_READ_REG32              4
+#define PMF_CMD_WRITE_REG16             5
+#define PMF_CMD_READ_REG16              6
+#define PMF_CMD_WRITE_REG8              7
+#define PMF_CMD_READ_REG8               8
+#define PMF_CMD_DELAY                   9
+#define PMF_CMD_WAIT_REG32              10
+#define PMF_CMD_WAIT_REG16              11
+#define PMF_CMD_WAIT_REG8               12
+#define PMF_CMD_READ_I2C                13
+#define PMF_CMD_WRITE_I2C               14
+#define PMF_CMD_RMW_I2C                 15
+#define PMF_CMD_GEN_I2C                 16
+#define PMF_CMD_SHIFT_BYTES_RIGHT       17
+#define PMF_CMD_SHIFT_BYTES_LEFT        18
+#define PMF_CMD_READ_CFG                19
+#define PMF_CMD_WRITE_CFG               20
+#define PMF_CMD_RMW_CFG                 21
+#define PMF_CMD_READ_I2C_SUBADDR        22
+#define PMF_CMD_WRITE_I2C_SUBADDR       23
+#define PMF_CMD_SET_I2C_MODE            24
+#define PMF_CMD_RMW_I2C_SUBADDR         25
+#define PMF_CMD_READ_REG32_MASK_SHR_XOR 26
+#define PMF_CMD_READ_REG16_MASK_SHR_XOR 27
+#define PMF_CMD_READ_REG8_MASK_SHR_XOR  28
+#define PMF_CMD_WRITE_REG32_SHL_MASK    29
+#define PMF_CMD_WRITE_REG16_SHL_MASK    30
+#define PMF_CMD_WRITE_REG8_SHL_MASK     31
+#define PMF_CMD_MASK_AND_COMPARE        32
+#define PMF_CMD_COUNT                   33
+
+/* This structure holds the state of the parser while walking through
+ * a function definition
+ */
+struct pmf_cmd {
+        const void              *cmdptr;
+        const void              *cmdend;
+        struct pmf_function     *func;
+        void                    *instdata;
+        struct pmf_args         *args;
+        int                     error;
+};
+
+#if 0
+/* Debug output */
+static void print_blob(const char *title, const void *blob, int bytes)
+{
+        printk("%s", title);
+        while(bytes--) {
+                printk("%02x ", *((u8 *)blob));
+                blob += 1;
+        }
+        printk("\n");
+}
+#endif
+
+/*
+ * Parser helpers
+ */
+
+static u32 pmf_next32(struct pmf_cmd *cmd)
+{
+        u32 value;
+        if ((cmd->cmdend - cmd->cmdptr) < 4) {
+                cmd->error = 1;
+                return 0;
+        }
+        value = *((u32 *)cmd->cmdptr);
+        cmd->cmdptr += 4;
+        return value;
+}
+
+static const void* pmf_next_blob(struct pmf_cmd *cmd, int count)
+{
+        const void *value;
+        if ((cmd->cmdend - cmd->cmdptr) < count) {
+                cmd->error = 1;
+                return NULL;
+        }
+        value = cmd->cmdptr;
+        cmd->cmdptr += count;
+        return value;
+}
+
+/*
+ * Individual command parsers
+ */
+
+#define PMF_PARSE_CALL(name, cmd, handlers, p...) \
+        do { \
+                if (cmd->error) \
+                        return -ENXIO; \
+                if (handlers == NULL) \
+                        return 0; \
+                if (handlers->name)                                   \
+                        return handlers->name(cmd->func, cmd->instdata, \
+                                              cmd->args, p);          \
+                return -1; \
+        } while(0) \
+
+
+static int pmf_parser_write_gpio(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u8 value = (u8)pmf_next32(cmd);
+        u8 mask = (u8)pmf_next32(cmd);
+
+        LOG_PARSE("pmf: write_gpio(value: %02x, mask: %02x)\n", value, mask);
+
+        PMF_PARSE_CALL(write_gpio, cmd, h, value, mask);
+}
+
+static int pmf_parser_read_gpio(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u8 mask = (u8)pmf_next32(cmd);
+        int rshift = (int)pmf_next32(cmd);
+        u8 xor = (u8)pmf_next32(cmd);
+
+        LOG_PARSE("pmf: read_gpio(mask: %02x, rshift: %d, xor: %02x)\n",
+                  mask, rshift, xor);
+
+        PMF_PARSE_CALL(read_gpio, cmd, h, mask, rshift, xor);
+}
+
+static int pmf_parser_write_reg32(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+        u32 value = pmf_next32(cmd);
+        u32 mask = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: write_reg32(offset: %08x, value: %08x, mask: %08x)\n",
+                  offset, value, mask);
+
+        PMF_PARSE_CALL(write_reg32, cmd, h, offset, value, mask);
+}
+
+static int pmf_parser_read_reg32(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: read_reg32(offset: %08x)\n", offset);
+
+        PMF_PARSE_CALL(read_reg32, cmd, h, offset);
+}
+
+
+static int pmf_parser_write_reg16(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+        u16 value = (u16)pmf_next32(cmd);
+        u16 mask = (u16)pmf_next32(cmd);
+
+        LOG_PARSE("pmf: write_reg16(offset: %08x, value: %04x, mask: %04x)\n",
+                  offset, value, mask);
+
+        PMF_PARSE_CALL(write_reg16, cmd, h, offset, value, mask);
+}
+
+static int pmf_parser_read_reg16(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: read_reg16(offset: %08x)\n", offset);
+
+        PMF_PARSE_CALL(read_reg16, cmd, h, offset);
+}
+
+
+static int pmf_parser_write_reg8(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+        u8 value = (u16)pmf_next32(cmd);
+        u8 mask = (u16)pmf_next32(cmd);
+
+        LOG_PARSE("pmf: write_reg8(offset: %08x, value: %02x, mask: %02x)\n",
+                  offset, value, mask);
+
+        PMF_PARSE_CALL(write_reg8, cmd, h, offset, value, mask);
+}
+
+static int pmf_parser_read_reg8(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: read_reg8(offset: %08x)\n", offset);
+
+        PMF_PARSE_CALL(read_reg8, cmd, h, offset);
+}
+
+static int pmf_parser_delay(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 duration = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: delay(duration: %d us)\n", duration);
+
+        PMF_PARSE_CALL(delay, cmd, h, duration);
+}
+
+static int pmf_parser_wait_reg32(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+        u32 value = pmf_next32(cmd);
+        u32 mask = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: wait_reg32(offset: %08x, comp_value: %08x,mask: %08x)\n",
+                  offset, value, mask);
+
+        PMF_PARSE_CALL(wait_reg32, cmd, h, offset, value, mask);
+}
+
+static int pmf_parser_wait_reg16(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+        u16 value = (u16)pmf_next32(cmd);
+        u16 mask = (u16)pmf_next32(cmd);
+
+        LOG_PARSE("pmf: wait_reg16(offset: %08x, comp_value: %04x,mask: %04x)\n",
+                  offset, value, mask);
+
+        PMF_PARSE_CALL(wait_reg16, cmd, h, offset, value, mask);
+}
+
+static int pmf_parser_wait_reg8(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+        u8 value = (u8)pmf_next32(cmd);
+        u8 mask = (u8)pmf_next32(cmd);
+
+        LOG_PARSE("pmf: wait_reg8(offset: %08x, comp_value: %02x,mask: %02x)\n",
+                  offset, value, mask);
+
+        PMF_PARSE_CALL(wait_reg8, cmd, h, offset, value, mask);
+}
+
+static int pmf_parser_read_i2c(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 bytes = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: read_i2c(bytes: %ud)\n", bytes);
+
+        PMF_PARSE_CALL(read_i2c, cmd, h, bytes);
+}
+
+static int pmf_parser_write_i2c(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 bytes = pmf_next32(cmd);
+        const void *blob = pmf_next_blob(cmd, bytes);
+
+        LOG_PARSE("pmf: write_i2c(bytes: %ud) ...\n", bytes);
+        LOG_BLOB("pmf:   data: \n", blob, bytes);
+
+        PMF_PARSE_CALL(write_i2c, cmd, h, bytes, blob);
+}
+
+
+static int pmf_parser_rmw_i2c(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 maskbytes = pmf_next32(cmd);
+        u32 valuesbytes = pmf_next32(cmd);
+        u32 totalbytes = pmf_next32(cmd);
+        const void *maskblob = pmf_next_blob(cmd, maskbytes);
+        const void *valuesblob = pmf_next_blob(cmd, valuesbytes);
+
+        LOG_PARSE("pmf: rmw_i2c(maskbytes: %ud, valuebytes: %ud, "
+                  "totalbytes: %d) ...\n",
+                  maskbytes, valuesbytes, totalbytes);
+        LOG_BLOB("pmf:   mask data: \n", maskblob, maskbytes);
+        LOG_BLOB("pmf:   values data: \n", valuesblob, valuesbytes);
+
+        PMF_PARSE_CALL(rmw_i2c, cmd, h, maskbytes, valuesbytes, totalbytes,
+                       maskblob, valuesblob);
+}
+
+static int pmf_parser_read_cfg(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+        u32 bytes = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: read_cfg(offset: %x, bytes: %ud)\n", offset, bytes);
+
+        PMF_PARSE_CALL(read_cfg, cmd, h, offset, bytes);
+}
+
+
+static int pmf_parser_write_cfg(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+        u32 bytes = pmf_next32(cmd);
+        const void *blob = pmf_next_blob(cmd, bytes);
+
+        LOG_PARSE("pmf: write_cfg(offset: %x, bytes: %ud)\n", offset, bytes);
+        LOG_BLOB("pmf:   data: \n", blob, bytes);
+
+        PMF_PARSE_CALL(write_cfg, cmd, h, offset, bytes, blob);
+}
+
+static int pmf_parser_rmw_cfg(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+        u32 maskbytes = pmf_next32(cmd);
+        u32 valuesbytes = pmf_next32(cmd);
+        u32 totalbytes = pmf_next32(cmd);
+        const void *maskblob = pmf_next_blob(cmd, maskbytes);
+        const void *valuesblob = pmf_next_blob(cmd, valuesbytes);
+
+        LOG_PARSE("pmf: rmw_cfg(maskbytes: %ud, valuebytes: %ud,"
+                  " totalbytes: %d) ...\n",
+                  maskbytes, valuesbytes, totalbytes);
+        LOG_BLOB("pmf:   mask data: \n", maskblob, maskbytes);
+        LOG_BLOB("pmf:   values data: \n", valuesblob, valuesbytes);
+
+        PMF_PARSE_CALL(rmw_cfg, cmd, h, offset, maskbytes, valuesbytes,
+                       totalbytes, maskblob, valuesblob);
+}
+
+
+static int pmf_parser_read_i2c_sub(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u8 subaddr = (u8)pmf_next32(cmd);
+        u32 bytes = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: read_i2c_sub(subaddr: %x, bytes: %ud)\n",
+                  subaddr, bytes);
+
+        PMF_PARSE_CALL(read_i2c_sub, cmd, h, subaddr, bytes);
+}
+
+static int pmf_parser_write_i2c_sub(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u8 subaddr = (u8)pmf_next32(cmd);
+        u32 bytes = pmf_next32(cmd);
+        const void *blob = pmf_next_blob(cmd, bytes);
+
+        LOG_PARSE("pmf: write_i2c_sub(subaddr: %x, bytes: %ud) ...\n",
+                  subaddr, bytes);
+        LOG_BLOB("pmf:   data: \n", blob, bytes);
+
+        PMF_PARSE_CALL(write_i2c_sub, cmd, h, subaddr, bytes, blob);
+}
+
+static int pmf_parser_set_i2c_mode(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u32 mode = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: set_i2c_mode(mode: %d)\n", mode);
+
+        PMF_PARSE_CALL(set_i2c_mode, cmd, h, mode);
+}
+
+
+static int pmf_parser_rmw_i2c_sub(struct pmf_cmd *cmd, struct pmf_handlers *h)
+{
+        u8 subaddr = (u8)pmf_next32(cmd);
+        u32 maskbytes = pmf_next32(cmd);
+        u32 valuesbytes = pmf_next32(cmd);
+        u32 totalbytes = pmf_next32(cmd);
+        const void *maskblob = pmf_next_blob(cmd, maskbytes);
+        const void *valuesblob = pmf_next_blob(cmd, valuesbytes);
+
+        LOG_PARSE("pmf: rmw_i2c_sub(subaddr: %x, maskbytes: %ud, valuebytes: %ud"
+                  ", totalbytes: %d) ...\n",
+                  subaddr, maskbytes, valuesbytes, totalbytes);
+        LOG_BLOB("pmf:   mask data: \n", maskblob, maskbytes);
+        LOG_BLOB("pmf:   values data: \n", valuesblob, valuesbytes);
+
+        PMF_PARSE_CALL(rmw_i2c_sub, cmd, h, subaddr, maskbytes, valuesbytes,
+                       totalbytes, maskblob, valuesblob);
+}
+
+static int pmf_parser_read_reg32_msrx(struct pmf_cmd *cmd,
+                                      struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+        u32 mask = pmf_next32(cmd);
+        u32 shift = pmf_next32(cmd);
+        u32 xor = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: read_reg32_msrx(offset: %x, mask: %x, shift: %x,"
+                  " xor: %x\n", offset, mask, shift, xor);
+
+        PMF_PARSE_CALL(read_reg32_msrx, cmd, h, offset, mask, shift, xor);
+}
+
+static int pmf_parser_read_reg16_msrx(struct pmf_cmd *cmd,
+                                      struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+        u32 mask = pmf_next32(cmd);
+        u32 shift = pmf_next32(cmd);
+        u32 xor = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: read_reg16_msrx(offset: %x, mask: %x, shift: %x,"
+                  " xor: %x\n", offset, mask, shift, xor);
+
+        PMF_PARSE_CALL(read_reg16_msrx, cmd, h, offset, mask, shift, xor);
+}
+static int pmf_parser_read_reg8_msrx(struct pmf_cmd *cmd,
+                                     struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+        u32 mask = pmf_next32(cmd);
+        u32 shift = pmf_next32(cmd);
+        u32 xor = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: read_reg8_msrx(offset: %x, mask: %x, shift: %x,"
+                  " xor: %x\n", offset, mask, shift, xor);
+
+        PMF_PARSE_CALL(read_reg8_msrx, cmd, h, offset, mask, shift, xor);
+}
+
+static int pmf_parser_write_reg32_slm(struct pmf_cmd *cmd,
+                                      struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+        u32 shift = pmf_next32(cmd);
+        u32 mask = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: write_reg32_slm(offset: %x, shift: %x, mask: %x\n",
+                  offset, shift, mask);
+
+        PMF_PARSE_CALL(write_reg32_slm, cmd, h, offset, shift, mask);
+}
+
+static int pmf_parser_write_reg16_slm(struct pmf_cmd *cmd,
+                                      struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+        u32 shift = pmf_next32(cmd);
+        u32 mask = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: write_reg16_slm(offset: %x, shift: %x, mask: %x\n",
+                  offset, shift, mask);
+
+        PMF_PARSE_CALL(write_reg16_slm, cmd, h, offset, shift, mask);
+}
+
+static int pmf_parser_write_reg8_slm(struct pmf_cmd *cmd,
+                                     struct pmf_handlers *h)
+{
+        u32 offset = pmf_next32(cmd);
+        u32 shift = pmf_next32(cmd);
+        u32 mask = pmf_next32(cmd);
+
+        LOG_PARSE("pmf: write_reg8_slm(offset: %x, shift: %x, mask: %x\n",
+                  offset, shift, mask);
+
+        PMF_PARSE_CALL(write_reg8_slm, cmd, h, offset, shift, mask);
+}
+
+static int pmf_parser_mask_and_compare(struct pmf_cmd *cmd,
+                                       struct pmf_handlers *h)
+{
+        u32 bytes = pmf_next32(cmd);
+        const void *maskblob = pmf_next_blob(cmd, bytes);
+        const void *valuesblob = pmf_next_blob(cmd, bytes);
+
+        LOG_PARSE("pmf: mask_and_compare(length: %ud ...\n", bytes);
+        LOG_BLOB("pmf:   mask data: \n", maskblob, bytes);
+        LOG_BLOB("pmf:   values data: \n", valuesblob, bytes);
+
+        PMF_PARSE_CALL(mask_and_compare, cmd, h,
+                       bytes, maskblob, valuesblob);
+}
+
+
+typedef int (*pmf_cmd_parser_t)(struct pmf_cmd *cmd, struct pmf_handlers *h);
+
+static pmf_cmd_parser_t pmf_parsers[PMF_CMD_COUNT] =
+{
+        NULL,
+        pmf_parser_write_gpio,
+        pmf_parser_read_gpio,
+        pmf_parser_write_reg32,
+        pmf_parser_read_reg32,
+        pmf_parser_write_reg16,
+        pmf_parser_read_reg16,
+        pmf_parser_write_reg8,
+        pmf_parser_read_reg8,
+        pmf_parser_delay,
+        pmf_parser_wait_reg32,
+        pmf_parser_wait_reg16,
+        pmf_parser_wait_reg8,
+        pmf_parser_read_i2c,
+        pmf_parser_write_i2c,
+        pmf_parser_rmw_i2c,
+        NULL, /* Bogus command */
+        NULL, /* Shift bytes right: NYI */
+        NULL, /* Shift bytes left: NYI */
+        pmf_parser_read_cfg,
+        pmf_parser_write_cfg,
+        pmf_parser_rmw_cfg,
+        pmf_parser_read_i2c_sub,
+        pmf_parser_write_i2c_sub,
+        pmf_parser_set_i2c_mode,
+        pmf_parser_rmw_i2c_sub,
+        pmf_parser_read_reg32_msrx,
+        pmf_parser_read_reg16_msrx,
+        pmf_parser_read_reg8_msrx,
+        pmf_parser_write_reg32_slm,
+        pmf_parser_write_reg16_slm,
+        pmf_parser_write_reg8_slm,
+        pmf_parser_mask_and_compare,
+};
+
+struct pmf_device {
+        struct list_head        link;
+        struct device_node      *node;
+        struct pmf_handlers     *handlers;
+        struct list_head        functions;
+        struct kref             ref;
+};
+
+static LIST_HEAD(pmf_devices);
+static spinlock_t pmf_lock = SPIN_LOCK_UNLOCKED;
+
+static void pmf_release_device(struct kref *kref)
+{
+        struct pmf_device *dev = container_of(kref, struct pmf_device, ref);
+        kfree(dev);
+}
+
+static inline void pmf_put_device(struct pmf_device *dev)
+{
+        kref_put(&dev->ref, pmf_release_device);
+}
+
+static inline struct pmf_device *pmf_get_device(struct pmf_device *dev)
+{
+        kref_get(&dev->ref);
+        return dev;
+}
+
+static inline struct pmf_device *pmf_find_device(struct device_node *np)
+{
+        struct pmf_device *dev;
+
+        list_for_each_entry(dev, &pmf_devices, link) {
+                if (dev->node == np)
+                        return pmf_get_device(dev);
+        }
+        return NULL;
+}
+
+static int pmf_parse_one(struct pmf_function *func,
+                         struct pmf_handlers *handlers,
+                         void *instdata, struct pmf_args *args)
+{
+        struct pmf_cmd cmd;
+        u32 ccode;
+        int count, rc;
+
+        cmd.cmdptr              = func->data;
+        cmd.cmdend              = func->data + func->length;
+        cmd.func                = func;
+        cmd.instdata            = instdata;
+        cmd.args                = args;
+        cmd.error               = 0;
+
+        LOG_PARSE("pmf: func %s, %d bytes, %s...\n",
+                  func->name, func->length,
+                  handlers ? "executing" : "parsing");
+
+        /* One subcommand to parse for now */
+        count = 1;
+
+        while(count-- && cmd.cmdptr < cmd.cmdend) {
+                /* Get opcode */
+                ccode = pmf_next32(&cmd);
+                /* Check if we are hitting a command list, fetch new count */
+                if (ccode == 0) {
+                        count = pmf_next32(&cmd) - 1;
+                        ccode = pmf_next32(&cmd);
+                }
+                if (cmd.error) {
+                        LOG_ERROR("pmf: parse error, not enough data\n");
+                        return -ENXIO;
+                }
+                if (ccode >= PMF_CMD_COUNT) {
+                        LOG_ERROR("pmf: command code %d unknown !\n", ccode);
+                        return -ENXIO;
+                }
+                if (pmf_parsers[ccode] == NULL) {
+                        LOG_ERROR("pmf: no parser for command %d !\n", ccode);
+                        return -ENXIO;
+                }
+                rc = pmf_parsers[ccode](&cmd, handlers);
+                if (rc != 0) {
+                        LOG_ERROR("pmf: parser for command %d returned"
+                                  " error %d\n", ccode, rc);
+                        return rc;
+                }
+        }
+
+        /* We are doing an initial parse pass, we need to adjust the size */
+        if (handlers == NULL)
+                func->length = cmd.cmdptr - func->data;
+
+        return 0;
+}
+
+static int pmf_add_function_prop(struct pmf_device *dev, void *driverdata,
+                                 const char *name, u32 *data,
+                                 unsigned int length)
+{
+        int count = 0;
+        struct pmf_function *func = NULL;
+
+        DBG("pmf: Adding functions for platform-do-%s\n", name);
+
+        while (length >= 12) {
+                /* Allocate a structure */
+                func = kzalloc(sizeof(struct pmf_function), GFP_KERNEL);
+                if (func == NULL)
+                        goto bail;
+                kref_init(&func->ref);
+                INIT_LIST_HEAD(&func->irq_clients);
+                func->node = dev->node;
+                func->driver_data = driverdata;
+                func->name = name;
+                func->phandle = data[0];
+                func->flags = data[1];
+                data += 2;
+                length -= 8;
+                func->data = data;
+                func->length = length;
+                func->dev = dev;
+                DBG("pmf: idx %d: flags=%08x, phandle=%08x "
+                    " %d bytes remaining, parsing...\n",
+                    count+1, func->flags, func->phandle, length);
+                if (pmf_parse_one(func, NULL, NULL, NULL)) {
+                        kfree(func);
+                        goto bail;
+                }
+                length -= func->length;
+                data = (u32 *)(((u8 *)data) + func->length);
+                list_add(&func->link, &dev->functions);
+                pmf_get_device(dev);
+                count++;
+        }
+ bail:
+        DBG("pmf: Added %d functions\n", count);
+
+        return count;
+}
+
+static int pmf_add_functions(struct pmf_device *dev, void *driverdata)
+{
+        struct property *pp;
+#define PP_PREFIX "platform-do-"
+        const int plen = strlen(PP_PREFIX);
+        int count = 0;
+
+        for (pp = dev->node->properties; pp != 0; pp = pp->next) {
+                char *name;
+                if (strncmp(pp->name, PP_PREFIX, plen) != 0)
+                        continue;
+                name = pp->name + plen;
+                if (strlen(name) && pp->length >= 12)
+                        count += pmf_add_function_prop(dev, driverdata, name,
+                                                       (u32 *)pp->value,
+                                                       pp->length);
+        }
+        return count;
+}
+
+
+int pmf_register_driver(struct device_node *np,
+                        struct pmf_handlers *handlers,
+                        void *driverdata)
+{
+        struct pmf_device *dev;
+        unsigned long flags;
+        int rc = 0;
+
+        if (handlers == NULL)
+                return -EINVAL;
+
+        DBG("pmf: registering driver for node %s\n", np->full_name);
+
+        spin_lock_irqsave(&pmf_lock, flags);
+        dev = pmf_find_device(np);
+        spin_unlock_irqrestore(&pmf_lock, flags);
+        if (dev != NULL) {
+                DBG("pmf: already there !\n");
+                pmf_put_device(dev);
+                return -EBUSY;
+        }
+
+        dev = kzalloc(sizeof(struct pmf_device), GFP_KERNEL);
+        if (dev == NULL) {
+                DBG("pmf: no memory !\n");
+                return -ENOMEM;
+        }
+        kref_init(&dev->ref);
+        dev->node = of_node_get(np);
+        dev->handlers = handlers;
+        INIT_LIST_HEAD(&dev->functions);
+
+        rc = pmf_add_functions(dev, driverdata);
+        if (rc == 0) {
+                DBG("pmf: no functions, disposing.. \n");
+                of_node_put(np);
+                kfree(dev);
+                return -ENODEV;
+        }
+
+        spin_lock_irqsave(&pmf_lock, flags);
+        list_add(&dev->link, &pmf_devices);
+        spin_unlock_irqrestore(&pmf_lock, flags);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(pmf_register_driver);
+
+struct pmf_function *pmf_get_function(struct pmf_function *func)
+{
+        if (!try_module_get(func->dev->handlers->owner))
+                return NULL;
+        kref_get(&func->ref);
+        return func;
+}
+EXPORT_SYMBOL_GPL(pmf_get_function);
+
+static void pmf_release_function(struct kref *kref)
+{
+        struct pmf_function *func =
+                container_of(kref, struct pmf_function, ref);
+        pmf_put_device(func->dev);
+        kfree(func);
+}
+
+static inline void __pmf_put_function(struct pmf_function *func)
+{
+        kref_put(&func->ref, pmf_release_function);
+}
+
+void pmf_put_function(struct pmf_function *func)
+{
+        if (func == NULL)
+                return;
+        module_put(func->dev->handlers->owner);
+        __pmf_put_function(func);
+}
+EXPORT_SYMBOL_GPL(pmf_put_function);
+
+void pmf_unregister_driver(struct device_node *np)
+{
+        struct pmf_device *dev;
+        unsigned long flags;
+
+        DBG("pmf: unregistering driver for node %s\n", np->full_name);
+
+        spin_lock_irqsave(&pmf_lock, flags);
+        dev = pmf_find_device(np);
+        if (dev == NULL) {
+                DBG("pmf: not such driver !\n");
+                spin_unlock_irqrestore(&pmf_lock, flags);
+                return;
+        }
+        list_del(&dev->link);
+
+        while(!list_empty(&dev->functions)) {
+                struct pmf_function *func =
+                        list_entry(dev->functions.next, typeof(*func), link);
+                list_del(&func->link);
+                __pmf_put_function(func);
+        }
+
+        pmf_put_device(dev);
+        spin_unlock_irqrestore(&pmf_lock, flags);
+}
+EXPORT_SYMBOL_GPL(pmf_unregister_driver);
+
+struct pmf_function *__pmf_find_function(struct device_node *target,
+                                         const char *name, u32 flags)
+{
+        struct device_node *actor = of_node_get(target);
+        struct pmf_device *dev;
+        struct pmf_function *func, *result = NULL;
+        char fname[64];
+        u32 *prop, ph;
+
+        /*
+         * Look for a "platform-*" function reference. If we can't find
+         * one, then we fallback to a direct call attempt
+         */
+        snprintf(fname, 63, "platform-%s", name);
+        prop = (u32 *)get_property(target, fname, NULL);
+        if (prop == NULL)
+                goto find_it;
+        ph = *prop;
+        if (ph == 0)
+                goto find_it;
+
+        /*
+         * Ok, now try to find the actor. If we can't find it, we fail,
+         * there is no point in falling back there
+         */
+        of_node_put(actor);
+        actor = of_find_node_by_phandle(ph);
+        if (actor == NULL)
+                return NULL;
+ find_it:
+        dev = pmf_find_device(actor);
+        if (dev == NULL)
+                return NULL;
+
+        list_for_each_entry(func, &dev->functions, link) {
+                if (name && strcmp(name, func->name))
+                        continue;
+                if (func->phandle && target->node != func->phandle)
+                        continue;
+                if ((func->flags & flags) == 0)
+                        continue;
+                result = func;
+                break;
+        }
+        of_node_put(actor);
+        pmf_put_device(dev);
+        return result;
+}
+
+
+int pmf_register_irq_client(struct device_node *target,
+                            const char *name,
+                            struct pmf_irq_client *client)
+{
+        struct pmf_function *func;
+        unsigned long flags;
+
+        spin_lock_irqsave(&pmf_lock, flags);
+        func = __pmf_find_function(target, name, PMF_FLAGS_INT_GEN);
+        if (func == NULL) {
+                spin_unlock_irqrestore(&pmf_lock, flags);
+                return -ENODEV;
+        }
+        list_add(&client->link, &func->irq_clients);
+        spin_unlock_irqrestore(&pmf_lock, flags);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(pmf_register_irq_client);
+
+void pmf_unregister_irq_client(struct device_node *np,
+                              const char *name,
+                              struct pmf_irq_client *client)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&pmf_lock, flags);
+        list_del(&client->link);
+        spin_unlock_irqrestore(&pmf_lock, flags);
+}
+EXPORT_SYMBOL_GPL(pmf_unregister_irq_client);
+
+
+void pmf_do_irq(struct pmf_function *func)
+{
+        unsigned long flags;
+        struct pmf_irq_client *client;
+
+        /* For now, using a spinlock over the whole function. Can be made
+         * to drop the lock using 2 lists if necessary
+         */
+        spin_lock_irqsave(&pmf_lock, flags);
+        list_for_each_entry(client, &func->irq_clients, link) {
+                if (!try_module_get(client->owner))
+                        continue;
+                client->handler(client->data);
+                module_put(client->owner);
+        }
+        spin_unlock_irqrestore(&pmf_lock, flags);
+}
+EXPORT_SYMBOL_GPL(pmf_do_irq);
+
+
+int pmf_call_one(struct pmf_function *func, struct pmf_args *args)
+{
+        struct pmf_device *dev = func->dev;
+        void *instdata = NULL;
+        int rc = 0;
+
+        DBG(" ** pmf_call_one(%s/%s) **\n", dev->node->full_name, func->name);
+
+        if (dev->handlers->begin)
+                instdata = dev->handlers->begin(func, args);
+        rc = pmf_parse_one(func, dev->handlers, instdata, args);
+        if (dev->handlers->end)
+                dev->handlers->end(func, instdata);
+
+        return rc;
+}
+EXPORT_SYMBOL_GPL(pmf_call_one);
+
+int pmf_do_functions(struct device_node *np, const char *name,
+                     u32 phandle, u32 fflags, struct pmf_args *args)
+{
+        struct pmf_device *dev;
+        struct pmf_function *func, *tmp;
+        unsigned long flags;
+        int rc = -ENODEV;
+
+        spin_lock_irqsave(&pmf_lock, flags);
+
+        dev = pmf_find_device(np);
+        if (dev == NULL) {
+                spin_unlock_irqrestore(&pmf_lock, flags);
+                return -ENODEV;
+        }
+        list_for_each_entry_safe(func, tmp, &dev->functions, link) {
+                if (name && strcmp(name, func->name))
+                        continue;
+                if (phandle && func->phandle && phandle != func->phandle)
+                        continue;
+                if ((func->flags & fflags) == 0)
+                        continue;
+                if (pmf_get_function(func) == NULL)
+                        continue;
+                spin_unlock_irqrestore(&pmf_lock, flags);
+                rc = pmf_call_one(func, args);
+                pmf_put_function(func);
+                spin_lock_irqsave(&pmf_lock, flags);
+        }
+        pmf_put_device(dev);
+        spin_unlock_irqrestore(&pmf_lock, flags);
+
+        return rc;
+}
+EXPORT_SYMBOL_GPL(pmf_do_functions);
+
+
+struct pmf_function *pmf_find_function(struct device_node *target,
+                                       const char *name)
+{
+        struct pmf_function *func;
+        unsigned long flags;
+
+        spin_lock_irqsave(&pmf_lock, flags);
+        func = __pmf_find_function(target, name, PMF_FLAGS_ON_DEMAND);
+        if (func)
+                func = pmf_get_function(func);
+        spin_unlock_irqrestore(&pmf_lock, flags);
+        return func;
+}
+EXPORT_SYMBOL_GPL(pmf_find_function);
+
+int pmf_call_function(struct device_node *target, const char *name,
+                      struct pmf_args *args)
+{
+        struct pmf_function *func = pmf_find_function(target, name);
+        int rc;
+
+        if (func == NULL)
+                return -ENODEV;
+
+        rc = pmf_call_one(func, args);
+        pmf_put_function(func);
+        return rc;
+}
+EXPORT_SYMBOL_GPL(pmf_call_function);
+
diff --git a/arch/powerpc/platforms/powermac/pic.c b/arch/powerpc/platforms/powermac/pic.c
index 90040c49494d..18bf3011d1e3 100644
--- a/arch/powerpc/platforms/powermac/pic.c
+++ b/arch/powerpc/platforms/powermac/pic.c
@@ -5,8 +5,8 @@
  *  in a separate file
  *
  *  Copyright (C) 1997 Paul Mackerras (paulus@samba.org)
- *
- *  Maintained by Benjamin Herrenschmidt (benh@kernel.crashing.org)
+ *  Copyright (C) 2005 Benjamin Herrenschmidt (benh@kernel.crashing.org)
+ *                     IBM, Corp.
  *
  *  This program is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU General Public License
@@ -54,12 +54,7 @@ struct pmac_irq_hw {
 };
 
 /* Default addresses */
-static volatile struct pmac_irq_hw *pmac_irq_hw[4] = {
-        (struct pmac_irq_hw *) 0xf3000020,
-        (struct pmac_irq_hw *) 0xf3000010,
-        (struct pmac_irq_hw *) 0xf4000020,
-        (struct pmac_irq_hw *) 0xf4000010,
-};
+static volatile struct pmac_irq_hw __iomem *pmac_irq_hw[4];
 
 #define GC_LEVEL_MASK           0x3ff00000
 #define OHARE_LEVEL_MASK        0x1ff00000
@@ -82,8 +77,7 @@ static unsigned long ppc_lost_interrupts[NR_MASK_WORDS];
  * since it can lose interrupts (see pmac_set_irq_mask).
  * -- Cort
  */
-void
-__set_lost(unsigned long irq_nr, int nokick)
+void __set_lost(unsigned long irq_nr, int nokick)
 {
         if (!test_and_set_bit(irq_nr, ppc_lost_interrupts)) {
                 atomic_inc(&ppc_n_lost_interrupts);
@@ -92,8 +86,7 @@ __set_lost(unsigned long irq_nr, int nokick)
         }
 }
 
-static void
-pmac_mask_and_ack_irq(unsigned int irq_nr)
+static void pmac_mask_and_ack_irq(unsigned int irq_nr)
 {
         unsigned long bit = 1UL << (irq_nr & 0x1f);
         int i = irq_nr >> 5;
@@ -224,8 +217,7 @@ static irqreturn_t gatwick_action(int cpl, void *dev_id, struct pt_regs *regs)
         return IRQ_NONE;
 }
 
-int
-pmac_get_irq(struct pt_regs *regs)
+static int pmac_get_irq(struct pt_regs *regs)
 {
         int irq;
         unsigned long bits = 0;
@@ -256,34 +248,40 @@ pmac_get_irq(struct pt_regs *regs)
 
 /* This routine will fix some missing interrupt values in the device tree
  * on the gatwick mac-io controller used by some PowerBooks
+ *
+ * Walking of OF nodes could use a bit more fixing up here, but it's not
+ * very important as this is all boot time code on static portions of the
+ * device-tree.
+ *
+ * However, the modifications done to "intrs" will have to be removed and
+ * replaced with proper updates of the "interrupts" properties or
+ * AAPL,interrupts, yet to be decided, once the dynamic parsing is there.
  */
-static void __init
-pmac_fix_gatwick_interrupts(struct device_node *gw, int irq_base)
+static void __init pmac_fix_gatwick_interrupts(struct device_node *gw,
+                                               int irq_base)
 {
         struct device_node *node;
         int count;
 
         memset(gatwick_int_pool, 0, sizeof(gatwick_int_pool));
-        node = gw->child;
         count = 0;
-        while(node)
-        {
+        for (node = NULL; (node = of_get_next_child(gw, node)) != NULL;) {
                 /* Fix SCC */
-                if (strcasecmp(node->name, "escc") == 0)
-                        if (node->child) {
-                                if (node->child->n_intrs < 3) {
-                                        node->child->intrs = &gatwick_int_pool[count];
-                                        count += 3;
-                                }
-                                node->child->n_intrs = 3;
-                                node->child->intrs[0].line = 15+irq_base;
-                                node->child->intrs[1].line =  4+irq_base;
-                                node->child->intrs[2].line =  5+irq_base;
-                                printk(KERN_INFO "irq: fixed SCC on second controller (%d,%d,%d)\n",
-                                        node->child->intrs[0].line,
-                                        node->child->intrs[1].line,
-                                        node->child->intrs[2].line);
+                if ((strcasecmp(node->name, "escc") == 0) && node->child) {
+                        if (node->child->n_intrs < 3) {
+                                node->child->intrs = &gatwick_int_pool[count];
+                                count += 3;
                         }
+                        node->child->n_intrs = 3;
+                        node->child->intrs[0].line = 15+irq_base;
+                        node->child->intrs[1].line =  4+irq_base;
+                        node->child->intrs[2].line =  5+irq_base;
+                        printk(KERN_INFO "irq: fixed SCC on gatwick"
+                               " (%d,%d,%d)\n",
+                               node->child->intrs[0].line,
+                               node->child->intrs[1].line,
+                               node->child->intrs[2].line);
+                }
                 /* Fix media-bay & left SWIM */
                 if (strcasecmp(node->name, "media-bay") == 0) {
                         struct device_node* ya_node;
@@ -292,12 +290,11 @@ pmac_fix_gatwick_interrupts(struct device_node *gw, int irq_base)
                                 node->intrs = &gatwick_int_pool[count++];
                         node->n_intrs = 1;
                         node->intrs[0].line = 29+irq_base;
-                        printk(KERN_INFO "irq: fixed media-bay on second controller (%d)\n",
-                                        node->intrs[0].line);
+                        printk(KERN_INFO "irq: fixed media-bay on gatwick"
+                               " (%d)\n", node->intrs[0].line);
 
                         ya_node = node->child;
-                        while(ya_node)
-                        {
+                        while(ya_node) {
                                 if (strcasecmp(ya_node->name, "floppy") == 0) {
                                         if (ya_node->n_intrs < 2) {
                                                 ya_node->intrs = &gatwick_int_pool[count];
@@ -323,7 +320,6 @@ pmac_fix_gatwick_interrupts(struct device_node *gw, int irq_base)
                                 ya_node = ya_node->sibling;
                         }
                 }
-                node = node->sibling;
         }
         if (count > 10) {
                 printk("WARNING !! Gatwick interrupt pool overflow\n");
@@ -338,45 +334,41 @@ pmac_fix_gatwick_interrupts(struct device_node *gw, int irq_base)
  * controller.  If we find this second ohare, set it up and fix the
  * interrupt value in the device tree for the ethernet chip.
  */
-static int __init enable_second_ohare(void)
+static void __init enable_second_ohare(struct device_node *np)
 {
         unsigned char bus, devfn;
         unsigned short cmd;
-        unsigned long addr;
-        struct device_node *irqctrler = find_devices("pci106b,7");
         struct device_node *ether;
 
-        if (irqctrler == NULL || irqctrler->n_addrs <= 0)
-                return -1;
-        addr = (unsigned long) ioremap(irqctrler->addrs[0].address, 0x40);
-        pmac_irq_hw[1] = (volatile struct pmac_irq_hw *)(addr + 0x20);
-        max_irqs = 64;
-        if (pci_device_from_OF_node(irqctrler, &bus, &devfn) == 0) {
-                struct pci_controller* hose = pci_find_hose_for_OF_device(irqctrler);
-                if (!hose)
-                    printk(KERN_ERR "Can't find PCI hose for OHare2 !\n");
-                else {
-                    early_read_config_word(hose, bus, devfn, PCI_COMMAND, &cmd);
-                    cmd |= PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER;
-                    cmd &= ~PCI_COMMAND_IO;
-                    early_write_config_word(hose, bus, devfn, PCI_COMMAND, cmd);
+        /* This code doesn't strictly belong here, it could be part of
+         * either the PCI initialisation or the feature code. It's kept
+         * here for historical reasons.
+         */
+        if (pci_device_from_OF_node(np, &bus, &devfn) == 0) {
+                struct pci_controller* hose =
+                        pci_find_hose_for_OF_device(np);
+                if (!hose) {
+                        printk(KERN_ERR "Can't find PCI hose for OHare2 !\n");
+                        return;
                 }
+                early_read_config_word(hose, bus, devfn, PCI_COMMAND, &cmd);
+                cmd |= PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER;
+                cmd &= ~PCI_COMMAND_IO;
+                early_write_config_word(hose, bus, devfn, PCI_COMMAND, cmd);
         }
 
         /* Fix interrupt for the modem/ethernet combo controller. The number
-           in the device tree (27) is bogus (correct for the ethernet-only
-           board but not the combo ethernet/modem board).
-           The real interrupt is 28 on the second controller -> 28+32 = 60.
-        */
-        ether = find_devices("pci1011,14");
+         * in the device tree (27) is bogus (correct for the ethernet-only
+         * board but not the combo ethernet/modem board).
+         * The real interrupt is 28 on the second controller -> 28+32 = 60.
+         */
+        ether = of_find_node_by_name(NULL, "pci1011,14");
         if (ether && ether->n_intrs > 0) {
                 ether->intrs[0].line = 60;
                 printk(KERN_INFO "irq: Fixed ethernet IRQ to %d\n",
                        ether->intrs[0].line);
         }
-
-        /* Return the interrupt number of the cascade */
-        return irqctrler->intrs[0].line;
+        of_node_put(ether);
 }
 
 #ifdef CONFIG_XMON
@@ -394,189 +386,251 @@ static struct irqaction gatwick_cascade_action = {
         .mask           = CPU_MASK_NONE,
         .name           = "cascade",
 };
-#endif /* CONFIG_PPC32 */
 
-static int pmac_u3_cascade(struct pt_regs *regs, void *data)
+static void __init pmac_pic_probe_oldstyle(void)
 {
-        return mpic_get_one_irq((struct mpic *)data, regs);
-}
-
-void __init pmac_pic_init(void)
-{
-        struct device_node *irqctrler  = NULL;
-        struct device_node *irqctrler2 = NULL;
-        struct device_node *np;
-#ifdef CONFIG_PPC32
         int i;
-        unsigned long addr;
         int irq_cascade = -1;
-#endif
-        struct mpic *mpic1, *mpic2;
+        struct device_node *master = NULL;
+        struct device_node *slave = NULL;
+        u8 __iomem *addr;
+        struct resource r;
 
-        /* We first try to detect Apple's new Core99 chipset, since mac-io
-         * is quite different on those machines and contains an IBM MPIC2.
-         */
-        np = find_type_devices("open-pic");
-        while (np) {
-                if (np->parent && !strcmp(np->parent->name, "u3"))
-                        irqctrler2 = np;
-                else
-                        irqctrler = np;
-                np = np->next;
-        }
-        if (irqctrler != NULL && irqctrler->n_addrs > 0) {
-                unsigned char senses[128];
-
-                printk(KERN_INFO "PowerMac using OpenPIC irq controller at 0x%08x\n",
-                       (unsigned int)irqctrler->addrs[0].address);
-                pmac_call_feature(PMAC_FTR_ENABLE_MPIC, irqctrler, 0, 0);
-
-                prom_get_irq_senses(senses, 0, 128);
-                mpic1 = mpic_alloc(irqctrler->addrs[0].address,
-                                   MPIC_PRIMARY | MPIC_WANTS_RESET,
-                                   0, 0, 128, 252, senses, 128, " OpenPIC  ");
-                BUG_ON(mpic1 == NULL);
-                mpic_init(mpic1);               
-
-                if (irqctrler2 != NULL && irqctrler2->n_intrs > 0 &&
-                    irqctrler2->n_addrs > 0) {
-                        printk(KERN_INFO "Slave OpenPIC at 0x%08x hooked on IRQ %d\n",
-                               (u32)irqctrler2->addrs[0].address,
-                               irqctrler2->intrs[0].line);
-
-                        pmac_call_feature(PMAC_FTR_ENABLE_MPIC, irqctrler2, 0, 0);
-                        prom_get_irq_senses(senses, 128, 128 + 124);
-
-                        /* We don't need to set MPIC_BROKEN_U3 here since we don't have
-                         * hypertransport interrupts routed to it
-                         */
-                        mpic2 = mpic_alloc(irqctrler2->addrs[0].address,
-                                           MPIC_BIG_ENDIAN | MPIC_WANTS_RESET,
-                                           0, 128, 124, 0, senses, 124,
-                                           " U3-MPIC  ");
-                        BUG_ON(mpic2 == NULL);
-                        mpic_init(mpic2);
-                        mpic_setup_cascade(irqctrler2->intrs[0].line,
-                                           pmac_u3_cascade, mpic2);
-                }
-#if defined(CONFIG_XMON) && defined(CONFIG_PPC32)
-                {
-                        struct device_node* pswitch;
-                        int nmi_irq;
-
-                        pswitch = find_devices("programmer-switch");
-                        if (pswitch && pswitch->n_intrs) {
-                                nmi_irq = pswitch->intrs[0].line;
-                                mpic_irq_set_priority(nmi_irq, 9);
-                                setup_irq(nmi_irq, &xmon_action);
-                        }
-                }
-#endif  /* CONFIG_XMON */
-                return;
-        }
-        irqctrler = NULL;
+        /* Set our get_irq function */
+        ppc_md.get_irq = pmac_get_irq;
 
-#ifdef CONFIG_PPC32
-        /* Get the level/edge settings, assume if it's not
-         * a Grand Central nor an OHare, then it's an Heathrow
-         * (or Paddington).
+        /*
+         * Find the interrupt controller type & node
          */
-        ppc_md.get_irq = pmac_get_irq;
-        if (find_devices("gc"))
+
+        if ((master = of_find_node_by_name(NULL, "gc")) != NULL) {
+                max_irqs = max_real_irqs = 32;
                 level_mask[0] = GC_LEVEL_MASK;
-        else if (find_devices("ohare")) {
+        } else if ((master = of_find_node_by_name(NULL, "ohare")) != NULL) {
+                max_irqs = max_real_irqs = 32;
                 level_mask[0] = OHARE_LEVEL_MASK;
+
                 /* We might have a second cascaded ohare */
-                level_mask[1] = OHARE_LEVEL_MASK;
-        } else {
+                slave = of_find_node_by_name(NULL, "pci106b,7");
+                if (slave) {
+                        max_irqs = 64;
+                        level_mask[1] = OHARE_LEVEL_MASK;
+                        enable_second_ohare(slave);
+                }
+        } else if ((master = of_find_node_by_name(NULL, "mac-io")) != NULL) {
+                max_irqs = max_real_irqs = 64;
                 level_mask[0] = HEATHROW_LEVEL_MASK;
                 level_mask[1] = 0;
+
                 /* We might have a second cascaded heathrow */
-                level_mask[2] = HEATHROW_LEVEL_MASK;
-                level_mask[3] = 0;
-        }
+                slave = of_find_node_by_name(master, "mac-io");
+
+                /* Check ordering of master & slave */
+                if (device_is_compatible(master, "gatwick")) {
+                        struct device_node *tmp;
+                        BUG_ON(slave == NULL);
+                        tmp = master;
+                        master = slave;
+                        slave = tmp;
+                }
 
-        /*
-         * G3 powermacs and 1999 G3 PowerBooks have 64 interrupts,
-         * 1998 G3 Series PowerBooks have 128,
-         * other powermacs have 32.
-         * The combo ethernet/modem card for the Powerstar powerbooks
-         * (2400/3400/3500, ohare based) has a second ohare chip
-         * effectively making a total of 64.
-         */
-        max_irqs = max_real_irqs = 32;
-        irqctrler = find_devices("mac-io");
-        if (irqctrler)
-        {
-                max_real_irqs = 64;
-                if (irqctrler->next)
+                /* We found a slave */
+                if (slave) {
                         max_irqs = 128;
-                else
-                        max_irqs = 64;
+                        level_mask[2] = HEATHROW_LEVEL_MASK;
+                        level_mask[3] = 0;
+                        pmac_fix_gatwick_interrupts(slave, max_real_irqs);
+                }
         }
+        BUG_ON(master == NULL);
+
+        /* Set the handler for the main PIC */
         for ( i = 0; i < max_real_irqs ; i++ )
                 irq_desc[i].handler = &pmac_pic;
 
-        /* get addresses of first controller */
-        if (irqctrler) {
-                if  (irqctrler->n_addrs > 0) {
-                        addr = (unsigned long)
-                                ioremap(irqctrler->addrs[0].address, 0x40);
-                        for (i = 0; i < 2; ++i)
-                                pmac_irq_hw[i] = (volatile struct pmac_irq_hw*)
-                                        (addr + (2 - i) * 0x10);
-                }
+        /* Get addresses of first controller if we have a node for it */
+        BUG_ON(of_address_to_resource(master, 0, &r));
 
-                /* get addresses of second controller */
-                irqctrler = irqctrler->next;
-                if (irqctrler && irqctrler->n_addrs > 0) {
-                        addr = (unsigned long)
-                                ioremap(irqctrler->addrs[0].address, 0x40);
-                        for (i = 2; i < 4; ++i)
-                                pmac_irq_hw[i] = (volatile struct pmac_irq_hw*)
-                                        (addr + (4 - i) * 0x10);
-                        irq_cascade = irqctrler->intrs[0].line;
-                        if (device_is_compatible(irqctrler, "gatwick"))
-                                pmac_fix_gatwick_interrupts(irqctrler, max_real_irqs);
-                }
-        } else {
-                /* older powermacs have a GC (grand central) or ohare at
-                   f3000000, with interrupt control registers at f3000020. */
-                addr = (unsigned long) ioremap(0xf3000000, 0x40);
-                pmac_irq_hw[0] = (volatile struct pmac_irq_hw *) (addr + 0x20);
+        /* Map interrupts of primary controller */
+        addr = (u8 __iomem *) ioremap(r.start, 0x40);
+        i = 0;
+        pmac_irq_hw[i++] = (volatile struct pmac_irq_hw __iomem *)
+                (addr + 0x20);
+        if (max_real_irqs > 32)
+                pmac_irq_hw[i++] = (volatile struct pmac_irq_hw __iomem *)
+                        (addr + 0x10);
+        of_node_put(master);
+
+        printk(KERN_INFO "irq: Found primary Apple PIC %s for %d irqs\n",
+               master->full_name, max_real_irqs);
+
+        /* Map interrupts of cascaded controller */
+        if (slave && !of_address_to_resource(slave, 0, &r)) {
+                addr = (u8 __iomem *)ioremap(r.start, 0x40);
+                pmac_irq_hw[i++] = (volatile struct pmac_irq_hw __iomem *)
+                        (addr + 0x20);
+                if (max_irqs > 64)
+                        pmac_irq_hw[i++] =
+                                (volatile struct pmac_irq_hw __iomem *)
+                                (addr + 0x10);
+                irq_cascade = slave->intrs[0].line;
+
+                printk(KERN_INFO "irq: Found slave Apple PIC %s for %d irqs"
+                       " cascade: %d\n", slave->full_name,
+                       max_irqs - max_real_irqs, irq_cascade);
         }
-
-        /* PowerBooks 3400 and 3500 can have a second controller in a second
-           ohare chip, on the combo ethernet/modem card */
-        if (machine_is_compatible("AAPL,3400/2400")
-             || machine_is_compatible("AAPL,3500"))
-                irq_cascade = enable_second_ohare();
+        of_node_put(slave);
 
         /* disable all interrupts in all controllers */
         for (i = 0; i * 32 < max_irqs; ++i)
                 out_le32(&pmac_irq_hw[i]->enable, 0);
+
         /* mark level interrupts */
         for (i = 0; i < max_irqs; i++)
                 if (level_mask[i >> 5] & (1UL << (i & 0x1f)))
                         irq_desc[i].status = IRQ_LEVEL;
 
-        /* get interrupt line of secondary interrupt controller */
-        if (irq_cascade >= 0) {
-                printk(KERN_INFO "irq: secondary controller on irq %d\n",
-                        (int)irq_cascade);
+        /* Setup handlers for secondary controller and hook cascade irq*/
+        if (slave) {
                 for ( i = max_real_irqs ; i < max_irqs ; i++ )
                         irq_desc[i].handler = &gatwick_pic;
                 setup_irq(irq_cascade, &gatwick_cascade_action);
         }
-        printk("System has %d possible interrupts\n", max_irqs);
-        if (max_irqs != max_real_irqs)
-                printk(KERN_DEBUG "%d interrupts on main controller\n",
-                        max_real_irqs);
-
+        printk(KERN_INFO "irq: System has %d possible interrupts\n", max_irqs);
 #ifdef CONFIG_XMON
         setup_irq(20, &xmon_action);
-#endif  /* CONFIG_XMON */
-#endif  /* CONFIG_PPC32 */
+#endif
+}
+#endif /* CONFIG_PPC32 */
+
+static int pmac_u3_cascade(struct pt_regs *regs, void *data)
+{
+        return mpic_get_one_irq((struct mpic *)data, regs);
+}
+
+static void __init pmac_pic_setup_mpic_nmi(struct mpic *mpic)
+{
+#if defined(CONFIG_XMON) && defined(CONFIG_PPC32)
+        struct device_node* pswitch;
+        int nmi_irq;
+
+        pswitch = of_find_node_by_name(NULL, "programmer-switch");
+        if (pswitch && pswitch->n_intrs) {
+                nmi_irq = pswitch->intrs[0].line;
+                mpic_irq_set_priority(nmi_irq, 9);
+                setup_irq(nmi_irq, &xmon_action);
+        }
+        of_node_put(pswitch);
+#endif  /* defined(CONFIG_XMON) && defined(CONFIG_PPC32) */
+}
+
+static struct mpic * __init pmac_setup_one_mpic(struct device_node *np,
+                                                int master)
+{
+        unsigned char senses[128];
+        int offset = master ? 0 : 128;
+        int count = master ? 128 : 124;
+        const char *name = master ? " MPIC 1   " : " MPIC 2   ";
+        struct resource r;
+        struct mpic *mpic;
+        unsigned int flags = master ? MPIC_PRIMARY : 0;
+        int rc;
+
+        rc = of_address_to_resource(np, 0, &r);
+        if (rc)
+                return NULL;
+
+        pmac_call_feature(PMAC_FTR_ENABLE_MPIC, np, 0, 0);
+
+        prom_get_irq_senses(senses, offset, offset + count);
+
+        flags |= MPIC_WANTS_RESET;
+        if (get_property(np, "big-endian", NULL))
+                flags |= MPIC_BIG_ENDIAN;
+
+        /* Primary Big Endian means HT interrupts. This is quite dodgy
+         * but works until I find a better way
+         */
+        if (master && (flags & MPIC_BIG_ENDIAN))
+                flags |= MPIC_BROKEN_U3;
+
+        mpic = mpic_alloc(r.start, flags, 0, offset, count, master ? 252 : 0,
+                          senses, count, name);
+        if (mpic == NULL)
+                return NULL;
+
+        mpic_init(mpic);
+
+        return mpic;
+ }
+
+static int __init pmac_pic_probe_mpic(void)
+{
+        struct mpic *mpic1, *mpic2;
+        struct device_node *np, *master = NULL, *slave = NULL;
+
+        /* We can have up to 2 MPICs cascaded */
+        for (np = NULL; (np = of_find_node_by_type(np, "open-pic"))
+                     != NULL;) {
+                if (master == NULL &&
+                    get_property(np, "interrupts", NULL) == NULL)
+                        master = of_node_get(np);
+                else if (slave == NULL)
+                        slave = of_node_get(np);
+                if (master && slave)
+                        break;
+        }
+
+        /* Check for bogus setups */
+        if (master == NULL && slave != NULL) {
+                master = slave;
+                slave = NULL;
+        }
+
+        /* Not found, default to good old pmac pic */
+        if (master == NULL)
+                return -ENODEV;
+
+        /* Set master handler */
+        ppc_md.get_irq = mpic_get_irq;
+
+        /* Setup master */
+        mpic1 = pmac_setup_one_mpic(master, 1);
+        BUG_ON(mpic1 == NULL);
+
+        /* Install NMI if any */
+        pmac_pic_setup_mpic_nmi(mpic1);
+
+        of_node_put(master);
+
+        /* No slave, let's go out */
+        if (slave == NULL || slave->n_intrs < 1)
+                return 0;
+
+        mpic2 = pmac_setup_one_mpic(slave, 0);
+        if (mpic2 == NULL) {
+                printk(KERN_ERR "Failed to setup slave MPIC\n");
+                of_node_put(slave);
+                return 0;
+        }
+        mpic_setup_cascade(slave->intrs[0].line, pmac_u3_cascade, mpic2);
+
+        of_node_put(slave);
+        return 0;
+}
+
+
+void __init pmac_pic_init(void)
+{
+        /* We first try to detect Apple's new Core99 chipset, since mac-io
+         * is quite different on those machines and contains an IBM MPIC2.
+         */
+        if (pmac_pic_probe_mpic() == 0)
+                return;
+
+#ifdef CONFIG_PPC32
+        pmac_pic_probe_oldstyle();
+#endif
 }
 
 #if defined(CONFIG_PM) && defined(CONFIG_PPC32)
diff --git a/arch/powerpc/platforms/powermac/pmac.h b/arch/powerpc/platforms/powermac/pmac.h
index 2ad25e13423e..21c7b0f8f329 100644
--- a/arch/powerpc/platforms/powermac/pmac.h
+++ b/arch/powerpc/platforms/powermac/pmac.h
@@ -42,10 +42,6 @@ extern void pmac_ide_init_hwif_ports(hw_regs_t *hw,
         unsigned long data_port, unsigned long ctrl_port, int *irq);
 
 extern int pmac_nvram_init(void);
-
-extern struct hw_interrupt_type pmac_pic;
-
-void pmac_pic_init(void);
-int pmac_get_irq(struct pt_regs *regs);
+extern void pmac_pic_init(void);
 
 #endif /* __PMAC_H__ */
diff --git a/arch/powerpc/platforms/powermac/setup.c b/arch/powerpc/platforms/powermac/setup.c
index 7acb0546671f..3b1a9d4fcbc6 100644
--- a/arch/powerpc/platforms/powermac/setup.c
+++ b/arch/powerpc/platforms/powermac/setup.c
@@ -60,6 +60,7 @@
 #include <asm/system.h>
 #include <asm/pgtable.h>
 #include <asm/io.h>
+#include <asm/kexec.h>
 #include <asm/pci-bridge.h>
 #include <asm/ohare.h>
 #include <asm/mediabay.h>
@@ -74,8 +75,8 @@
 #include <asm/iommu.h>
 #include <asm/smu.h>
 #include <asm/pmc.h>
-#include <asm/mpic.h>
 #include <asm/lmb.h>
+#include <asm/udbg.h>
 
 #include "pmac.h"
 
@@ -321,16 +322,6 @@ void __init pmac_setup_arch(void)
         l2cr_init();
 #endif /* CONFIG_PPC32 */
 
-#ifdef CONFIG_PPC64
-        /* Probe motherboard chipset */
-        /* this is done earlier in setup_arch for 32-bit */
-        pmac_feature_init();
-
-        /* We can NAP */
-        powersave_nap = 1;
-        printk(KERN_INFO "Using native/NAP idle loop\n");
-#endif
-
 #ifdef CONFIG_KGDB
         zs_kgdb_hook(0);
 #endif
@@ -354,7 +345,7 @@ void __init pmac_setup_arch(void)
 
 #ifdef CONFIG_SMP
         /* Check for Core99 */
-        if (find_devices("uni-n") || find_devices("u3"))
+        if (find_devices("uni-n") || find_devices("u3") || find_devices("u4"))
                 smp_ops = &core99_smp_ops;
 #ifdef CONFIG_PPC32
         else
@@ -621,35 +612,31 @@ static void __init pmac_init_early(void)
          * and call ioremap
          */
         hpte_init_native();
+#endif
 
-        /* Init SCC */
-        if (strstr(cmd_line, "sccdbg")) {
-                sccdbg = 1;
-                udbg_init_scc(NULL);
+        /* Enable early btext debug if requested */
+        if (strstr(cmd_line, "btextdbg")) {
+                udbg_adb_init_early();
+                register_early_udbg_console();
         }
 
-        /* Setup interrupt mapping options */
-        ppc64_interrupt_controller = IC_OPEN_PIC;
+        /* Probe motherboard chipset */
+        pmac_feature_init();
 
-        iommu_init_early_u3();
-#endif
-}
+        /* We can NAP */
+        powersave_nap = 1;
+        printk(KERN_INFO "Using native/NAP idle loop\n");
+
+        /* Initialize debug stuff */
+        udbg_scc_init(!!strstr(cmd_line, "sccdbg"));
+        udbg_adb_init(!!strstr(cmd_line, "btextdbg"));
 
-static void __init pmac_progress(char *s, unsigned short hex)
-{
 #ifdef CONFIG_PPC64
-        if (sccdbg) {
-                udbg_puts(s);
-                udbg_puts("\n");
-                return;
-        }
+        /* Setup interrupt mapping options */
+        ppc64_interrupt_controller = IC_OPEN_PIC;
+
+        iommu_init_early_dart();
 #endif
-#ifdef CONFIG_BOOTX_TEXT
-        if (boot_text_mapped) {
-                btext_drawstring(s);
-                btext_drawchar('\n');
-        }
-#endif /* CONFIG_BOOTX_TEXT */
 }
 
 /*
@@ -663,35 +650,14 @@ static int pmac_check_legacy_ioport(unsigned int baseport)
 
 static int __init pmac_declare_of_platform_devices(void)
 {
-        struct device_node *np, *npp;
-
-        np = find_devices("uni-n");
-        if (np) {
-                for (np = np->child; np != NULL; np = np->sibling)
-                        if (strncmp(np->name, "i2c", 3) == 0) {
-                                of_platform_device_create(np, "uni-n-i2c",
-                                                          NULL);
-                                break;
-                        }
-        }
-        np = find_devices("valkyrie");
+        struct device_node *np;
+
+        np = of_find_node_by_name(NULL, "valkyrie");
         if (np)
                 of_platform_device_create(np, "valkyrie", NULL);
-        np = find_devices("platinum");
+        np = of_find_node_by_name(NULL, "platinum");
         if (np)
                 of_platform_device_create(np, "platinum", NULL);
-
-        npp = of_find_node_by_name(NULL, "u3");
-        if (npp) {
-                for (np = NULL; (np = of_get_next_child(npp, np)) != NULL;) {
-                        if (strncmp(np->name, "i2c", 3) == 0) {
-                                of_platform_device_create(np, "u3-i2c", NULL);
-                                of_node_put(np);
-                                break;
-                        }
-                }
-                of_node_put(npp);
-        }
         np = of_find_node_by_type(NULL, "smu");
         if (np) {
                 of_platform_device_create(np, "smu", NULL);
@@ -718,7 +684,7 @@ static int __init pmac_probe(int platform)
          * occupies having to be broken up so the DART itself is not
          * part of the cacheable linar mapping
          */
-        alloc_u3_dart_table();
+        alloc_dart_table();
 #endif
 
 #ifdef CONFIG_PMAC_SMU
@@ -734,15 +700,17 @@ static int __init pmac_probe(int platform)
 }
 
 #ifdef CONFIG_PPC64
-static int pmac_probe_mode(struct pci_bus *bus)
+/* Move that to pci.c */
+static int pmac_pci_probe_mode(struct pci_bus *bus)
 {
         struct device_node *node = bus->sysdata;
 
         /* We need to use normal PCI probing for the AGP bus,
-           since the device for the AGP bridge isn't in the tree. */
-        if (bus->self == NULL && device_is_compatible(node, "u3-agp"))
+         * since the device for the AGP bridge isn't in the tree.
+         */
+        if (bus->self == NULL && (device_is_compatible(node, "u3-agp") ||
+                                  device_is_compatible(node, "u4-pcie")))
                 return PCI_PROBE_NORMAL;
-
         return PCI_PROBE_DEVTREE;
 }
 #endif
@@ -756,7 +724,7 @@ struct machdep_calls __initdata pmac_md = {
         .init_early             = pmac_init_early,
         .show_cpuinfo           = pmac_show_cpuinfo,
         .init_IRQ               = pmac_pic_init,
-        .get_irq                = mpic_get_irq, /* changed later */
+        .get_irq                = NULL, /* changed later */
         .pcibios_fixup          = pmac_pcibios_fixup,
         .restart                = pmac_restart,
         .power_off              = pmac_power_off,
@@ -768,12 +736,17 @@ struct machdep_calls __initdata pmac_md = {
         .calibrate_decr         = pmac_calibrate_decr,
         .feature_call           = pmac_do_feature_call,
         .check_legacy_ioport    = pmac_check_legacy_ioport,
-        .progress               = pmac_progress,
+        .progress               = udbg_progress,
 #ifdef CONFIG_PPC64
-        .pci_probe_mode         = pmac_probe_mode,
+        .pci_probe_mode         = pmac_pci_probe_mode,
         .idle_loop              = native_idle,
         .enable_pmcs            = power4_enable_pmcs,
+#ifdef CONFIG_KEXEC
+        .machine_kexec          = default_machine_kexec,
+        .machine_kexec_prepare  = default_machine_kexec_prepare,
+        .machine_crash_shutdown = default_machine_crash_shutdown,
 #endif
+#endif /* CONFIG_PPC64 */
 #ifdef CONFIG_PPC32
         .pcibios_enable_device_hook = pmac_pci_enable_device_hook,
         .pcibios_after_init     = pmac_pcibios_after_init,
diff --git a/arch/powerpc/platforms/powermac/smp.c b/arch/powerpc/platforms/powermac/smp.c
index fb2a7c798e82..0df2cdcd805c 100644
--- a/arch/powerpc/platforms/powermac/smp.c
+++ b/arch/powerpc/platforms/powermac/smp.c
@@ -52,8 +52,9 @@
 #include <asm/cacheflush.h>
 #include <asm/keylargo.h>
 #include <asm/pmac_low_i2c.h>
+#include <asm/pmac_pfunc.h>
 
-#undef DEBUG
+#define DEBUG
 
 #ifdef DEBUG
 #define DBG(fmt...) udbg_printf(fmt)
@@ -62,6 +63,7 @@
 #endif
 
 extern void __secondary_start_pmac_0(void);
+extern int pmac_pfunc_base_install(void);
 
 #ifdef CONFIG_PPC32
 
@@ -361,7 +363,6 @@ static void __init psurge_dual_sync_tb(int cpu_nr)
         set_dec(tb_ticks_per_jiffy);
         /* XXX fixme */
         set_tb(0, 0);
-        last_jiffy_stamp(cpu_nr) = 0;
 
         if (cpu_nr > 0) {
                 mb();
@@ -429,15 +430,62 @@ struct smp_ops_t psurge_smp_ops = {
 };
 #endif /* CONFIG_PPC32 - actually powersurge support */
 
+/*
+ * Core 99 and later support
+ */
+
+static void (*pmac_tb_freeze)(int freeze);
+static unsigned long timebase;
+static int tb_req;
+
+static void smp_core99_give_timebase(void)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+
+        while(!tb_req)
+                barrier();
+        tb_req = 0;
+        (*pmac_tb_freeze)(1);
+        mb();
+        timebase = get_tb();
+        mb();
+        while (timebase)
+                barrier();
+        mb();
+        (*pmac_tb_freeze)(0);
+        mb();
+
+        local_irq_restore(flags);
+}
+
+
+static void __devinit smp_core99_take_timebase(void)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+
+        tb_req = 1;
+        mb();
+        while (!timebase)
+                barrier();
+        mb();
+        set_tb(timebase >> 32, timebase & 0xffffffff);
+        timebase = 0;
+        mb();
+        set_dec(tb_ticks_per_jiffy/2);
+
+        local_irq_restore(flags);
+}
+
 #ifdef CONFIG_PPC64
 /*
  * G5s enable/disable the timebase via an i2c-connected clock chip.
  */
-static struct device_node *pmac_tb_clock_chip_host;
+static struct pmac_i2c_bus *pmac_tb_clock_chip_host;
 static u8 pmac_tb_pulsar_addr;
-static void (*pmac_tb_freeze)(int freeze);
-static DEFINE_SPINLOCK(timebase_lock);
-static unsigned long timebase;
 
 static void smp_core99_cypress_tb_freeze(int freeze)
 {
@@ -447,19 +495,20 @@ static void smp_core99_cypress_tb_freeze(int freeze)
         /* Strangely, the device-tree says address is 0xd2, but darwin
          * accesses 0xd0 ...
          */
-        pmac_low_i2c_setmode(pmac_tb_clock_chip_host, pmac_low_i2c_mode_combined);
-        rc = pmac_low_i2c_xfer(pmac_tb_clock_chip_host,
-                               0xd0 | pmac_low_i2c_read,
-                               0x81, &data, 1);
+        pmac_i2c_setmode(pmac_tb_clock_chip_host,
+                         pmac_i2c_mode_combined);
+        rc = pmac_i2c_xfer(pmac_tb_clock_chip_host,
+                           0xd0 | pmac_i2c_read,
+                           1, 0x81, &data, 1);
         if (rc != 0)
                 goto bail;
 
         data = (data & 0xf3) | (freeze ? 0x00 : 0x0c);
 
-        pmac_low_i2c_setmode(pmac_tb_clock_chip_host, pmac_low_i2c_mode_stdsub);
-        rc = pmac_low_i2c_xfer(pmac_tb_clock_chip_host,
-                               0xd0 | pmac_low_i2c_write,
-                               0x81, &data, 1);
+        pmac_i2c_setmode(pmac_tb_clock_chip_host, pmac_i2c_mode_stdsub);
+        rc = pmac_i2c_xfer(pmac_tb_clock_chip_host,
+                           0xd0 | pmac_i2c_write,
+                           1, 0x81, &data, 1);
 
  bail:
         if (rc != 0) {
@@ -475,19 +524,20 @@ static void smp_core99_pulsar_tb_freeze(int freeze)
         u8 data;
         int rc;
 
-        pmac_low_i2c_setmode(pmac_tb_clock_chip_host, pmac_low_i2c_mode_combined);
-        rc = pmac_low_i2c_xfer(pmac_tb_clock_chip_host,
-                               pmac_tb_pulsar_addr | pmac_low_i2c_read,
-                               0x2e, &data, 1);
+        pmac_i2c_setmode(pmac_tb_clock_chip_host,
+                         pmac_i2c_mode_combined);
+        rc = pmac_i2c_xfer(pmac_tb_clock_chip_host,
+                           pmac_tb_pulsar_addr | pmac_i2c_read,
+                           1, 0x2e, &data, 1);
         if (rc != 0)
                 goto bail;
 
         data = (data & 0x88) | (freeze ? 0x11 : 0x22);
 
-        pmac_low_i2c_setmode(pmac_tb_clock_chip_host, pmac_low_i2c_mode_stdsub);
-        rc = pmac_low_i2c_xfer(pmac_tb_clock_chip_host,
-                               pmac_tb_pulsar_addr | pmac_low_i2c_write,
-                               0x2e, &data, 1);
+        pmac_i2c_setmode(pmac_tb_clock_chip_host, pmac_i2c_mode_stdsub);
+        rc = pmac_i2c_xfer(pmac_tb_clock_chip_host,
+                           pmac_tb_pulsar_addr | pmac_i2c_write,
+                           1, 0x2e, &data, 1);
  bail:
         if (rc != 0) {
                 printk(KERN_ERR "Pulsar Timebase %s rc: %d\n",
@@ -496,54 +546,14 @@ static void smp_core99_pulsar_tb_freeze(int freeze)
         }
 }
 
-
-static void smp_core99_give_timebase(void)
-{
-        /* Open i2c bus for synchronous access */
-        if (pmac_low_i2c_open(pmac_tb_clock_chip_host, 0))
-                panic("Can't open i2c for TB sync !\n");
-
-        spin_lock(&timebase_lock);
-        (*pmac_tb_freeze)(1);
-        mb();
-        timebase = get_tb();
-        spin_unlock(&timebase_lock);
-
-        while (timebase)
-                barrier();
-
-        spin_lock(&timebase_lock);
-        (*pmac_tb_freeze)(0);
-        spin_unlock(&timebase_lock);
-
-        /* Close i2c bus */
-        pmac_low_i2c_close(pmac_tb_clock_chip_host);
-}
-
-
-static void __devinit smp_core99_take_timebase(void)
-{
-        while (!timebase)
-                barrier();
-        spin_lock(&timebase_lock);
-        set_tb(timebase >> 32, timebase & 0xffffffff);
-        timebase = 0;
-        spin_unlock(&timebase_lock);
-}
-
-static void __init smp_core99_setup(int ncpus)
+static void __init smp_core99_setup_i2c_hwsync(int ncpus)
 {
         struct device_node *cc = NULL;  
         struct device_node *p;
+        const char *name = NULL;
         u32 *reg;
         int ok;
 
-        /* HW sync only on these platforms */
-        if (!machine_is_compatible("PowerMac7,2") &&
-            !machine_is_compatible("PowerMac7,3") &&
-            !machine_is_compatible("RackMac3,1"))
-                return;
-
         /* Look for the clock chip */
         while ((cc = of_find_node_by_name(cc, "i2c-hwclock")) != NULL) {
                 p = of_get_parent(cc);
@@ -552,124 +562,86 @@ static void __init smp_core99_setup(int ncpus)
                 if (!ok)
                         continue;
 
+                pmac_tb_clock_chip_host = pmac_i2c_find_bus(cc);
+                if (pmac_tb_clock_chip_host == NULL)
+                        continue;
                 reg = (u32 *)get_property(cc, "reg", NULL);
                 if (reg == NULL)
                         continue;
-
                 switch (*reg) {
                 case 0xd2:
-                        if (device_is_compatible(cc, "pulsar-legacy-slewing")) {
+                        if (device_is_compatible(cc,"pulsar-legacy-slewing")) {
                                 pmac_tb_freeze = smp_core99_pulsar_tb_freeze;
                                 pmac_tb_pulsar_addr = 0xd2;
-                                printk(KERN_INFO "Timebase clock is Pulsar chip\n");
+                                name = "Pulsar";
                         } else if (device_is_compatible(cc, "cy28508")) {
                                 pmac_tb_freeze = smp_core99_cypress_tb_freeze;
-                                printk(KERN_INFO "Timebase clock is Cypress chip\n");
+                                name = "Cypress";
                         }
                         break;
                 case 0xd4:
                         pmac_tb_freeze = smp_core99_pulsar_tb_freeze;
                         pmac_tb_pulsar_addr = 0xd4;
-                        printk(KERN_INFO "Timebase clock is Pulsar chip\n");
+                        name = "Pulsar";
                         break;
                 }
-                if (pmac_tb_freeze != NULL) {
-                        pmac_tb_clock_chip_host = of_get_parent(cc);
-                        of_node_put(cc);
+                if (pmac_tb_freeze != NULL)
                         break;
-                }
         }
-        if (pmac_tb_freeze == NULL) {
-                smp_ops->give_timebase = smp_generic_give_timebase;
-                smp_ops->take_timebase = smp_generic_take_timebase;
+        if (pmac_tb_freeze != NULL) {
+                /* Open i2c bus for synchronous access */
+                if (pmac_i2c_open(pmac_tb_clock_chip_host, 1)) {
+                        printk(KERN_ERR "Failed top open i2c bus for clock"
+                               " sync, fallback to software sync !\n");
+                        goto no_i2c_sync;
+                }
+                printk(KERN_INFO "Processor timebase sync using %s i2c clock\n",
+                       name);
+                return;
         }
+ no_i2c_sync:
+        pmac_tb_freeze = NULL;
+        pmac_tb_clock_chip_host = NULL;
 }
 
-/* nothing to do here, caches are already set up by service processor */
-static inline void __devinit core99_init_caches(int cpu)
+
+
+/*
+ * Newer G5s uses a platform function
+ */
+
+static void smp_core99_pfunc_tb_freeze(int freeze)
 {
+        struct device_node *cpus;
+        struct pmf_args args;
+
+        cpus = of_find_node_by_path("/cpus");
+        BUG_ON(cpus == NULL);
+        args.count = 1;
+        args.u[0].v = !freeze;
+        pmf_call_function(cpus, "cpu-timebase", &args);
+        of_node_put(cpus);
 }
 
 #else /* CONFIG_PPC64 */
 
 /*
- * SMP G4 powermacs use a GPIO to enable/disable the timebase.
+ * SMP G4 use a GPIO to enable/disable the timebase.
  */
 
 static unsigned int core99_tb_gpio;     /* Timebase freeze GPIO */
 
-static unsigned int pri_tb_hi, pri_tb_lo;
-static unsigned int pri_tb_stamp;
-
-/* not __init, called in sleep/wakeup code */
-void smp_core99_give_timebase(void)
+static void smp_core99_gpio_tb_freeze(int freeze)
 {
-        unsigned long flags;
-        unsigned int t;
-
-        /* wait for the secondary to be in take_timebase */
-        for (t = 100000; t > 0 && !sec_tb_reset; --t)
-                udelay(10);
-        if (!sec_tb_reset) {
-                printk(KERN_WARNING "Timeout waiting sync on second CPU\n");
-                return;
-        }
-
-        /* freeze the timebase and read it */
-        /* disable interrupts so the timebase is disabled for the
-           shortest possible time */
-        local_irq_save(flags);
-        pmac_call_feature(PMAC_FTR_WRITE_GPIO, NULL, core99_tb_gpio, 4);
+        if (freeze)
+                pmac_call_feature(PMAC_FTR_WRITE_GPIO, NULL, core99_tb_gpio, 4);
+        else
+                pmac_call_feature(PMAC_FTR_WRITE_GPIO, NULL, core99_tb_gpio, 0);
         pmac_call_feature(PMAC_FTR_READ_GPIO, NULL, core99_tb_gpio, 0);
-        mb();
-        pri_tb_hi = get_tbu();
-        pri_tb_lo = get_tbl();
-        pri_tb_stamp = last_jiffy_stamp(smp_processor_id());
-        mb();
-
-        /* tell the secondary we're ready */
-        sec_tb_reset = 2;
-        mb();
-
-        /* wait for the secondary to have taken it */
-        /* note: can't use udelay here, since it needs the timebase running */
-        for (t = 10000000; t > 0 && sec_tb_reset; --t)
-                barrier();
-        if (sec_tb_reset)
-                /* XXX BUG_ON here? */
-                printk(KERN_WARNING "Timeout waiting sync(2) on second CPU\n");
-
-        /* Now, restart the timebase by leaving the GPIO to an open collector */
-        pmac_call_feature(PMAC_FTR_WRITE_GPIO, NULL, core99_tb_gpio, 0);
-        pmac_call_feature(PMAC_FTR_READ_GPIO, NULL, core99_tb_gpio, 0);
-        local_irq_restore(flags);
 }
 
-/* not __init, called in sleep/wakeup code */
-void smp_core99_take_timebase(void)
-{
-        unsigned long flags;
-
-        /* tell the primary we're here */
-        sec_tb_reset = 1;
-        mb();
-
-        /* wait for the primary to set pri_tb_hi/lo */
-        while (sec_tb_reset < 2)
-                mb();
-
-        /* set our stuff the same as the primary */
-        local_irq_save(flags);
-        set_dec(1);
-        set_tb(pri_tb_hi, pri_tb_lo);
-        last_jiffy_stamp(smp_processor_id()) = pri_tb_stamp;
-        mb();
 
-        /* tell the primary we're done */
-        sec_tb_reset = 0;
-        mb();
-        local_irq_restore(flags);
-}
+#endif /* !CONFIG_PPC64 */
 
 /* L2 and L3 cache settings to pass from CPU0 to CPU1 on G4 cpus */
 volatile static long int core99_l2_cache;
@@ -677,6 +649,7 @@ volatile static long int core99_l3_cache;
 
 static void __devinit core99_init_caches(int cpu)
 {
+#ifndef CONFIG_PPC64
         if (!cpu_has_feature(CPU_FTR_L2CR))
                 return;
 
@@ -702,30 +675,76 @@ static void __devinit core99_init_caches(int cpu)
                 _set_L3CR(core99_l3_cache);
                 printk("CPU%d: L3CR set to %lx\n", cpu, core99_l3_cache);
         }
+#endif /* !CONFIG_PPC64 */
 }
 
 static void __init smp_core99_setup(int ncpus)
 {
-        struct device_node *cpu;
-        u32 *tbprop = NULL;
-        int i;
+#ifdef CONFIG_PPC64
+
+        /* i2c based HW sync on some G5s */
+        if (machine_is_compatible("PowerMac7,2") ||
+            machine_is_compatible("PowerMac7,3") ||
+            machine_is_compatible("RackMac3,1"))
+                smp_core99_setup_i2c_hwsync(ncpus);
 
-        core99_tb_gpio = KL_GPIO_TB_ENABLE;     /* default value */
-        cpu = of_find_node_by_type(NULL, "cpu");
-        if (cpu != NULL) {
-                tbprop = (u32 *)get_property(cpu, "timebase-enable", NULL);
-                if (tbprop)
-                        core99_tb_gpio = *tbprop;
-                of_node_put(cpu);
+        /* pfunc based HW sync on recent G5s */
+        if (pmac_tb_freeze == NULL) {
+                struct device_node *cpus =
+                        of_find_node_by_path("/cpus");
+                if (cpus &&
+                    get_property(cpus, "platform-cpu-timebase", NULL)) {
+                        pmac_tb_freeze = smp_core99_pfunc_tb_freeze;
+                        printk(KERN_INFO "Processor timebase sync using"
+                               " platform function\n");
+                }
         }
 
-        /* XXX should get this from reg properties */
-        for (i = 1; i < ncpus; ++i)
-                smp_hw_index[i] = i;
-        powersave_nap = 0;
-}
+#else /* CONFIG_PPC64 */
+
+        /* GPIO based HW sync on ppc32 Core99 */
+        if (pmac_tb_freeze == NULL && !machine_is_compatible("MacRISC4")) {
+                struct device_node *cpu;
+                u32 *tbprop = NULL;
+
+                core99_tb_gpio = KL_GPIO_TB_ENABLE;     /* default value */
+                cpu = of_find_node_by_type(NULL, "cpu");
+                if (cpu != NULL) {
+                        tbprop = (u32 *)get_property(cpu, "timebase-enable",
+                                                     NULL);
+                        if (tbprop)
+                                core99_tb_gpio = *tbprop;
+                        of_node_put(cpu);
+                }
+                pmac_tb_freeze = smp_core99_gpio_tb_freeze;
+                printk(KERN_INFO "Processor timebase sync using"
+                       " GPIO 0x%02x\n", core99_tb_gpio);
+        }
+
+#endif /* CONFIG_PPC64 */
+
+        /* No timebase sync, fallback to software */
+        if (pmac_tb_freeze == NULL) {
+                smp_ops->give_timebase = smp_generic_give_timebase;
+                smp_ops->take_timebase = smp_generic_take_timebase;
+                printk(KERN_INFO "Processor timebase sync using software\n");
+        }
+
+#ifndef CONFIG_PPC64
+        {
+                int i;
+
+                /* XXX should get this from reg properties */
+                for (i = 1; i < ncpus; ++i)
+                        smp_hw_index[i] = i;
+        }
 #endif
 
+        /* 32 bits SMP can't NAP */
+        if (!machine_is_compatible("MacRISC4"))
+                powersave_nap = 0;
+}
+
 static int __init smp_core99_probe(void)
 {
         struct device_node *cpus;
@@ -743,8 +762,19 @@ static int __init smp_core99_probe(void)
         if (ncpus <= 1)
                 return 1;
 
+        /* We need to perform some early initialisations before we can start
+         * setting up SMP as we are running before initcalls
+         */
+        pmac_pfunc_base_install();
+        pmac_i2c_init();
+
+        /* Setup various bits like timebase sync method, ability to nap, ... */
         smp_core99_setup(ncpus);
+
+        /* Install IPIs */
         mpic_request_ipis();
+
+        /* Collect l2cr and l3cr values from CPU 0 */
         core99_init_caches(0);
 
         return ncpus;
@@ -753,14 +783,15 @@ static int __init smp_core99_probe(void)
 static void __devinit smp_core99_kick_cpu(int nr)
 {
         unsigned int save_vector;
-        unsigned long new_vector;
-        unsigned long flags;
+        unsigned long target, flags;
         volatile unsigned int *vector
                  = ((volatile unsigned int *)(KERNELBASE+0x100));
 
         if (nr < 0 || nr > 3)
                 return;
-        if (ppc_md.progress) ppc_md.progress("smp_core99_kick_cpu", 0x346);
+
+        if (ppc_md.progress)
+                ppc_md.progress("smp_core99_kick_cpu", 0x346);
 
         local_irq_save(flags);
         local_irq_disable();
@@ -768,14 +799,11 @@ static void __devinit smp_core99_kick_cpu(int nr)
         /* Save reset vector */
         save_vector = *vector;
 
-        /* Setup fake reset vector that does    
+        /* Setup fake reset vector that does
          *   b __secondary_start_pmac_0 + nr*8 - KERNELBASE
          */
-        new_vector = (unsigned long) __secondary_start_pmac_0 + nr * 8;
-        *vector = 0x48000002 + new_vector - KERNELBASE;
-
-        /* flush data cache and inval instruction cache */
-        flush_icache_range((unsigned long) vector, (unsigned long) vector + 4);
+        target = (unsigned long) __secondary_start_pmac_0 + nr * 8;
+        create_branch((unsigned long)vector, target, BRANCH_SET_LINK);
 
         /* Put some life in our friend */
         pmac_call_feature(PMAC_FTR_RESET_CPU, NULL, nr, 0);
@@ -805,17 +833,25 @@ static void __devinit smp_core99_setup_cpu(int cpu_nr)
         mpic_setup_this_cpu();
 
         if (cpu_nr == 0) {
-#ifdef CONFIG_POWER4
+#ifdef CONFIG_PPC64
                 extern void g5_phy_disable_cpu1(void);
 
+                /* Close i2c bus if it was used for tb sync */
+                if (pmac_tb_clock_chip_host) {
+                        pmac_i2c_close(pmac_tb_clock_chip_host);
+                        pmac_tb_clock_chip_host = NULL;
+                }
+
                 /* If we didn't start the second CPU, we must take
                  * it off the bus
                  */
                 if (machine_is_compatible("MacRISC4") &&
                     num_online_cpus() < 2)              
                         g5_phy_disable_cpu1();
-#endif /* CONFIG_POWER4 */
-                if (ppc_md.progress) ppc_md.progress("core99_setup_cpu 0 done", 0x349);
+#endif /* CONFIG_PPC64 */
+
+                if (ppc_md.progress)
+                        ppc_md.progress("core99_setup_cpu 0 done", 0x349);
         }
 }
 
diff --git a/arch/powerpc/platforms/powermac/time.c b/arch/powerpc/platforms/powermac/time.c
index feb0a94e7819..5d9afa1fa02d 100644
--- a/arch/powerpc/platforms/powermac/time.c
+++ b/arch/powerpc/platforms/powermac/time.c
@@ -258,15 +258,20 @@ int __init via_calibrate_decr(void)
         volatile unsigned char __iomem *via;
         int count = VIA_TIMER_FREQ_6 / 100;
         unsigned int dstart, dend;
+        struct resource rsrc;
 
-        vias = find_devices("via-cuda");
+        vias = of_find_node_by_name(NULL, "via-cuda");
         if (vias == 0)
-                vias = find_devices("via-pmu");
+                vias = of_find_node_by_name(NULL, "via-pmu");
         if (vias == 0)
-                vias = find_devices("via");
-        if (vias == 0 || vias->n_addrs == 0)
+                vias = of_find_node_by_name(NULL, "via");
+        if (vias == 0 || of_address_to_resource(vias, 0, &rsrc))
                 return 0;
-        via = ioremap(vias->addrs[0].address, vias->addrs[0].size);
+        via = ioremap(rsrc.start, rsrc.end - rsrc.start + 1);
+        if (via == NULL) {
+                printk(KERN_ERR "Failed to map VIA for timer calibration !\n");
+                return 0;
+        }
 
         /* set timer 1 for continuous interrupts */
         out_8(&via[ACR], (via[ACR] & ~T1MODE) | T1MODE_CONT);
diff --git a/arch/powerpc/platforms/powermac/udbg_adb.c b/arch/powerpc/platforms/powermac/udbg_adb.c
new file mode 100644
index 000000000000..06c8265c2baf
--- /dev/null
+++ b/arch/powerpc/platforms/powermac/udbg_adb.c
@@ -0,0 +1,221 @@
+#include <linux/config.h>
+#include <linux/string.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/bitops.h>
+#include <linux/ptrace.h>
+#include <linux/adb.h>
+#include <linux/pmu.h>
+#include <linux/cuda.h>
+#include <asm/machdep.h>
+#include <asm/io.h>
+#include <asm/page.h>
+#include <asm/xmon.h>
+#include <asm/prom.h>
+#include <asm/bootx.h>
+#include <asm/machdep.h>
+#include <asm/errno.h>
+#include <asm/pmac_feature.h>
+#include <asm/processor.h>
+#include <asm/delay.h>
+#include <asm/btext.h>
+#include <asm/time.h>
+#include <asm/udbg.h>
+
+/*
+ * This implementation is "special", it can "patch" the current
+ * udbg implementation and work on top of it. It must thus be
+ * initialized last
+ */
+
+static void (*udbg_adb_old_putc)(char c);
+static int (*udbg_adb_old_getc)(void);
+static int (*udbg_adb_old_getc_poll)(void);
+
+static enum {
+        input_adb_none,
+        input_adb_pmu,
+        input_adb_cuda,
+} input_type = input_adb_none;
+
+int xmon_wants_key, xmon_adb_keycode;
+
+static inline void udbg_adb_poll(void)
+{
+#ifdef CONFIG_ADB_PMU
+        if (input_type == input_adb_pmu)
+                pmu_poll_adb();
+#endif /* CONFIG_ADB_PMU */
+#ifdef CONFIG_ADB_CUDA
+        if (input_type == input_adb_cuda)
+                cuda_poll();
+#endif /* CONFIG_ADB_CUDA */
+}
+
+#ifdef CONFIG_BOOTX_TEXT
+
+static int udbg_adb_use_btext;
+static int xmon_adb_shiftstate;
+
+static unsigned char xmon_keytab[128] =
+        "asdfhgzxcv\000bqwer"                           /* 0x00 - 0x0f */
+        "yt123465=97-80]o"                              /* 0x10 - 0x1f */
+        "u[ip\rlj'k;\\,/nm."                            /* 0x20 - 0x2f */
+        "\t `\177\0\033\0\0\0\0\0\0\0\0\0\0"            /* 0x30 - 0x3f */
+        "\0.\0*\0+\0\0\0\0\0/\r\0-\0"                   /* 0x40 - 0x4f */
+        "\0\0000123456789\0\0\0";                       /* 0x50 - 0x5f */
+
+static unsigned char xmon_shift_keytab[128] =
+        "ASDFHGZXCV\000BQWER"                           /* 0x00 - 0x0f */
+        "YT!@#$^%+(&_*)}O"                              /* 0x10 - 0x1f */
+        "U{IP\rLJ\"K:|<?NM>"                            /* 0x20 - 0x2f */
+        "\t ~\177\0\033\0\0\0\0\0\0\0\0\0\0"            /* 0x30 - 0x3f */
+        "\0.\0*\0+\0\0\0\0\0/\r\0-\0"                   /* 0x40 - 0x4f */
+        "\0\0000123456789\0\0\0";                       /* 0x50 - 0x5f */
+
+static int udbg_adb_local_getc(void)
+{
+        int k, t, on;
+
+        xmon_wants_key = 1;
+        for (;;) {
+                xmon_adb_keycode = -1;
+                t = 0;
+                on = 0;
+                k = -1;
+                do {
+                        if (--t < 0) {
+                                on = 1 - on;
+                                btext_drawchar(on? 0xdb: 0x20);
+                                btext_drawchar('\b');
+                                t = 200000;
+                        }
+                        udbg_adb_poll();
+                        if (udbg_adb_old_getc_poll)
+                                k = udbg_adb_old_getc_poll();
+                } while (k == -1 && xmon_adb_keycode == -1);
+                if (on)
+                        btext_drawstring(" \b");
+                if (k != -1)
+                        return k;
+                k = xmon_adb_keycode;
+
+                /* test for shift keys */
+                if ((k & 0x7f) == 0x38 || (k & 0x7f) == 0x7b) {
+                        xmon_adb_shiftstate = (k & 0x80) == 0;
+                        continue;
+                }
+                if (k >= 0x80)
+                        continue;       /* ignore up transitions */
+                k = (xmon_adb_shiftstate? xmon_shift_keytab: xmon_keytab)[k];
+                if (k != 0)
+                        break;
+        }
+        xmon_wants_key = 0;
+        return k;
+}
+#endif /* CONFIG_BOOTX_TEXT */
+
+static int udbg_adb_getc(void)
+{
+#ifdef CONFIG_BOOTX_TEXT
+        if (udbg_adb_use_btext && input_type != input_adb_none)
+                return udbg_adb_local_getc();
+#endif
+        if (udbg_adb_old_getc)
+                return udbg_adb_old_getc();
+        return -1;
+}
+
+/* getc_poll() is not really used, unless you have the xmon-over modem
+ * hack that doesn't quite concern us here, thus we just poll the low level
+ * ADB driver to prevent it from timing out and call back the original poll
+ * routine.
+ */
+static int udbg_adb_getc_poll(void)
+{
+        udbg_adb_poll();
+
+        if (udbg_adb_old_getc_poll)
+                return udbg_adb_old_getc_poll();
+        return -1;
+}
+
+static void udbg_adb_putc(char c)
+{
+#ifdef CONFIG_BOOTX_TEXT
+        if (udbg_adb_use_btext)
+                btext_drawchar(c);
+#endif
+        if (udbg_adb_old_putc)
+                return udbg_adb_old_putc(c);
+}
+
+void udbg_adb_init_early(void)
+{
+#ifdef CONFIG_BOOTX_TEXT
+        if (btext_find_display(1) == 0) {
+                udbg_adb_use_btext = 1;
+                udbg_putc = udbg_adb_putc;
+        }
+#endif
+}
+
+int udbg_adb_init(int force_btext)
+{
+        struct device_node *np;
+
+        /* Capture existing callbacks */
+        udbg_adb_old_putc = udbg_putc;
+        udbg_adb_old_getc = udbg_getc;
+        udbg_adb_old_getc_poll = udbg_getc_poll;
+
+        /* Check if our early init was already called */
+        if (udbg_adb_old_putc == udbg_adb_putc)
+                udbg_adb_old_putc = NULL;
+#ifdef CONFIG_BOOTX_TEXT
+        if (udbg_adb_old_putc == btext_drawchar)
+                udbg_adb_old_putc = NULL;
+#endif
+
+        /* Set ours as output */
+        udbg_putc = udbg_adb_putc;
+        udbg_getc = udbg_adb_getc;
+        udbg_getc_poll = udbg_adb_getc_poll;
+
+#ifdef CONFIG_BOOTX_TEXT
+        /* Check if we should use btext output */
+        if (btext_find_display(force_btext) == 0)
+                udbg_adb_use_btext = 1;
+#endif
+
+        /* See if there is a keyboard in the device tree with a parent
+         * of type "adb". If not, we return a failure, but we keep the
+         * bext output set for now
+         */
+        for (np = NULL; (np = of_find_node_by_name(np, "keyboard")) != NULL;) {
+                struct device_node *parent = of_get_parent(np);
+                int found = (parent && strcmp(parent->type, "adb") == 0);
+                of_node_put(parent);
+                if (found)
+                        break;
+        }
+        if (np == NULL)
+                return -ENODEV;
+        of_node_put(np);
+
+#ifdef CONFIG_ADB_PMU
+        if (find_via_pmu())
+                input_type = input_adb_pmu;
+#endif
+#ifdef CONFIG_ADB_CUDA
+        if (find_via_cuda())
+                input_type = input_adb_cuda;
+#endif
+
+        /* Same as above: nothing found, keep btext set for output */
+        if (input_type == input_adb_none)
+                return -ENODEV;
+
+        return 0;
+}
diff --git a/arch/powerpc/kernel/udbg_scc.c b/arch/powerpc/platforms/powermac/udbg_scc.c
index 820c53551507..e87d53acfb61 100644
--- a/arch/powerpc/kernel/udbg_scc.c
+++ b/arch/powerpc/platforms/powermac/udbg_scc.c
@@ -25,7 +25,7 @@ extern void real_writeb(u8 data, volatile u8 __iomem *addr);
 static volatile u8 __iomem *sccc;
 static volatile u8 __iomem *sccd;
 
-static void udbg_scc_putc(unsigned char c)
+static void udbg_scc_putc(char c)
 {
         if (sccc) {
                 while ((in_8(sccc) & SCC_TXRDY) == 0)
@@ -47,14 +47,14 @@ static int udbg_scc_getc_poll(void)
         return -1;
 }
 
-static unsigned char udbg_scc_getc(void)
+static int udbg_scc_getc(void)
 {
         if (sccc) {
                 while ((in_8(sccc) & SCC_RXRDY) == 0)
                         ;
                 return in_8(sccd);
         }
-        return 0;
+        return -1;
 }
 
 static unsigned char scc_inittab[] = {
@@ -67,38 +67,59 @@ static unsigned char scc_inittab[] = {
     3,  0xc1,           /* rx enable, 8 bits */
 };
 
-void udbg_init_scc(struct device_node *np)
+void udbg_scc_init(int force_scc)
 {
         u32 *reg;
         unsigned long addr;
+        struct device_node *stdout = NULL, *escc = NULL, *macio = NULL;
+        struct device_node *ch, *ch_def = NULL, *ch_a = NULL;
+        char *path;
         int i, x;
 
-        if (np == NULL)
-                np = of_find_node_by_name(NULL, "escc");
-        if (np == NULL || np->parent == NULL)
-                return;
+        escc = of_find_node_by_name(NULL, "escc");
+        if (escc == NULL)
+                goto bail;
+        macio = of_get_parent(escc);
+        if (macio == NULL)
+                goto bail;
+        path = (char *)get_property(of_chosen, "linux,stdout-path", NULL);
+        if (path != NULL)
+                stdout = of_find_node_by_path(path);
+        for (ch = NULL; (ch = of_get_next_child(escc, ch)) != NULL;) {
+                if (ch == stdout)
+                        ch_def = of_node_get(ch);
+                if (strcmp(ch->name, "ch-a") == 0)
+                        ch_a = of_node_get(ch);
+        }
+        if (ch_def == NULL && !force_scc)
+                goto bail;
+
+        ch = ch_def ? ch_def : ch_a;
 
-        udbg_printf("found SCC...\n");
         /* Get address within mac-io ASIC */
-        reg = (u32 *)get_property(np, "reg", NULL);
+        reg = (u32 *)get_property(escc, "reg", NULL);
         if (reg == NULL)
-                return;
+                goto bail;
         addr = reg[0];
-        udbg_printf("local addr: %lx\n", addr);
+
         /* Get address of mac-io PCI itself */
-        reg = (u32 *)get_property(np->parent, "assigned-addresses", NULL);
+        reg = (u32 *)get_property(macio, "assigned-addresses", NULL);
         if (reg == NULL)
-                return;
+                goto bail;
         addr += reg[2];
-        udbg_printf("final addr: %lx\n", addr);
+
+        /* Lock the serial port */
+        pmac_call_feature(PMAC_FTR_SCC_ENABLE, ch,
+                          PMAC_SCC_ASYNC | PMAC_SCC_FLAG_XMON, 1);
+
 
         /* Setup for 57600 8N1 */
-        addr += 0x20;
+        if (ch == ch_a)
+                addr += 0x20;
         sccc = (volatile u8 * __iomem) ioremap(addr & PAGE_MASK, PAGE_SIZE) ;
         sccc += addr & ~PAGE_MASK;
         sccd = sccc + 0x10;
 
-        udbg_printf("ioremap result sccc: %p\n", sccc);
         mb();
 
         for (i = 20000; i != 0; --i)
@@ -113,9 +134,17 @@ void udbg_init_scc(struct device_node *np)
         udbg_getc_poll = udbg_scc_getc_poll;
 
         udbg_puts("Hello World !\n");
+
+ bail:
+        of_node_put(macio);
+        of_node_put(escc);
+        of_node_put(stdout);
+        of_node_put(ch_def);
+        of_node_put(ch_a);
 }
 
-static void udbg_real_scc_putc(unsigned char c)
+#ifdef CONFIG_PPC64
+static void udbg_real_scc_putc(char c)
 {
         while ((real_readb(sccc) & SCC_TXRDY) == 0)
                 ;
@@ -133,3 +162,4 @@ void udbg_init_pmac_realmode(void)
         udbg_getc = NULL;
         udbg_getc_poll = NULL;
 }
+#endif /* CONFIG_PPC64 */
diff --git a/arch/powerpc/platforms/pseries/Makefile b/arch/powerpc/platforms/pseries/Makefile
index 06d5ef501218..6accdd155505 100644
--- a/arch/powerpc/platforms/pseries/Makefile
+++ b/arch/powerpc/platforms/pseries/Makefile
@@ -1,5 +1,5 @@
 obj-y                   := pci.o lpar.o hvCall.o nvram.o reconfig.o \
-                           setup.o iommu.o ras.o rtasd.o
+                           setup.o iommu.o ras.o rtasd.o pci_dlpar.o
 obj-$(CONFIG_SMP)       += smp.o
 obj-$(CONFIG_IBMVIO)    += vio.o
 obj-$(CONFIG_XICS)      += xics.o
diff --git a/arch/powerpc/platforms/pseries/eeh.c b/arch/powerpc/platforms/pseries/eeh.c
index c8d2a40dc5b4..7fbfd16d72b7 100644
--- a/arch/powerpc/platforms/pseries/eeh.c
+++ b/arch/powerpc/platforms/pseries/eeh.c
@@ -1093,6 +1093,15 @@ void eeh_add_device_early(struct device_node *dn)
 }
 EXPORT_SYMBOL_GPL(eeh_add_device_early);
 
+void eeh_add_device_tree_early(struct device_node *dn)
+{
+        struct device_node *sib;
+        for (sib = dn->child; sib; sib = sib->sibling)
+                eeh_add_device_tree_early(sib);
+        eeh_add_device_early(dn);
+}
+EXPORT_SYMBOL_GPL(eeh_add_device_tree_early);
+
 /**
  * eeh_add_device_late - perform EEH initialization for the indicated pci device
  * @dev: pci device for which to set up EEH
@@ -1147,6 +1156,23 @@ void eeh_remove_device(struct pci_dev *dev)
 }
 EXPORT_SYMBOL_GPL(eeh_remove_device);
 
+void eeh_remove_bus_device(struct pci_dev *dev)
+{
+        eeh_remove_device(dev);
+        if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
+                struct pci_bus *bus = dev->subordinate;
+                struct list_head *ln;
+                if (!bus)
+                        return; 
+                for (ln = bus->devices.next; ln != &bus->devices; ln = ln->next) {
+                        struct pci_dev *pdev = pci_dev_b(ln);
+                        if (pdev)
+                                eeh_remove_bus_device(pdev);
+                }
+        }
+}
+EXPORT_SYMBOL_GPL(eeh_remove_bus_device);
+
 static int proc_eeh_show(struct seq_file *m, void *v)
 {
         unsigned int cpu;
diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
index 2043659ea7b1..169f9148789c 100644
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -436,7 +436,7 @@ static void iommu_bus_setup_pSeriesLP(struct pci_bus *bus)
                 return;
         }
 
-        ppci = pdn->data;
+        ppci = PCI_DN(pdn);
         if (!ppci->iommu_table) {
                 /* Bussubno hasn't been copied yet.
                  * Do it now because iommu_table_setparms_lpar needs it.
@@ -483,10 +483,10 @@ static void iommu_dev_setup_pSeries(struct pci_dev *dev)
          * an already allocated iommu table is found and use that.
          */
 
-        while (dn && dn->data && PCI_DN(dn)->iommu_table == NULL)
+        while (dn && PCI_DN(dn) && PCI_DN(dn)->iommu_table == NULL)
                 dn = dn->parent;
 
-        if (dn && dn->data) {
+        if (dn && PCI_DN(dn)) {
                 PCI_DN(mydn)->iommu_table = PCI_DN(dn)->iommu_table;
         } else {
                 DBG("iommu_dev_setup_pSeries, dev %p (%s) has no iommu table\n", dev, pci_name(dev));
@@ -497,7 +497,7 @@ static int iommu_reconfig_notifier(struct notifier_block *nb, unsigned long acti
 {
         int err = NOTIFY_OK;
         struct device_node *np = node;
-        struct pci_dn *pci = np->data;
+        struct pci_dn *pci = PCI_DN(np);
 
         switch (action) {
         case PSERIES_RECONFIG_REMOVE:
@@ -533,7 +533,7 @@ static void iommu_dev_setup_pSeriesLP(struct pci_dev *dev)
          */
         dn = pci_device_to_OF_node(dev);
 
-        for (pdn = dn; pdn && pdn->data && !PCI_DN(pdn)->iommu_table;
+        for (pdn = dn; pdn && PCI_DN(pdn) && !PCI_DN(pdn)->iommu_table;
              pdn = pdn->parent) {
                 dma_window = (unsigned int *)
                         get_property(pdn, "ibm,dma-window", NULL);
@@ -552,7 +552,7 @@ static void iommu_dev_setup_pSeriesLP(struct pci_dev *dev)
                 DBG("Found DMA window, allocating table\n");
         }
 
-        pci = pdn->data;
+        pci = PCI_DN(pdn);
         if (!pci->iommu_table) {
                 /* iommu_table_setparms_lpar needs bussubno. */
                 pci->bussubno = pci->phb->bus->number;
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index cf1bc11b3346..1fe445ab78a6 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -24,6 +24,7 @@
 #include <linux/config.h>
 #include <linux/kernel.h>
 #include <linux/dma-mapping.h>
+#include <linux/console.h>
 #include <asm/processor.h>
 #include <asm/mmu.h>
 #include <asm/page.h>
@@ -60,7 +61,7 @@ extern void pSeries_find_serial_port(void);
 int vtermno;    /* virtual terminal# for udbg  */
 
 #define __ALIGNED__ __attribute__((__aligned__(sizeof(long))))
-static void udbg_hvsi_putc(unsigned char c)
+static void udbg_hvsi_putc(char c)
 {
         /* packet's seqno isn't used anyways */
         uint8_t packet[] __ALIGNED__ = { 0xff, 5, 0, 0, c };
@@ -111,7 +112,7 @@ static int udbg_hvsi_getc_poll(void)
         return ch;
 }
 
-static unsigned char udbg_hvsi_getc(void)
+static int udbg_hvsi_getc(void)
 {
         int ch;
         for (;;) {
@@ -127,7 +128,7 @@ static unsigned char udbg_hvsi_getc(void)
         }
 }
 
-static void udbg_putcLP(unsigned char c)
+static void udbg_putcLP(char c)
 {
         char buf[16];
         unsigned long rc;
@@ -172,7 +173,7 @@ static int udbg_getc_pollLP(void)
         return ch;
 }
 
-static unsigned char udbg_getcLP(void)
+static int udbg_getcLP(void)
 {
         int ch;
         for (;;) {
@@ -191,7 +192,7 @@ static unsigned char udbg_getcLP(void)
 /* call this from early_init() for a working debug console on
  * vterm capable LPAR machines
  */
-void udbg_init_debug_lpar(void)
+void __init udbg_init_debug_lpar(void)
 {
         vtermno = 0;
         udbg_putc = udbg_putcLP;
@@ -200,63 +201,54 @@ void udbg_init_debug_lpar(void)
 }
 
 /* returns 0 if couldn't find or use /chosen/stdout as console */
-int find_udbg_vterm(void)
+void __init find_udbg_vterm(void)
 {
         struct device_node *stdout_node;
         u32 *termno;
         char *name;
-        int found = 0;
+        int add_console;
 
         /* find the boot console from /chosen/stdout */
         if (!of_chosen)
-                return 0;
+                return;
         name = (char *)get_property(of_chosen, "linux,stdout-path", NULL);
         if (name == NULL)
-                return 0;
+                return;
         stdout_node = of_find_node_by_path(name);
         if (!stdout_node)
-                return 0;
-
-        /* now we have the stdout node; figure out what type of device it is. */
+                return;
         name = (char *)get_property(stdout_node, "name", NULL);
         if (!name) {
                 printk(KERN_WARNING "stdout node missing 'name' property!\n");
                 goto out;
         }
+        /* The user has requested a console so this is already set up. */
+        add_console = !strstr(cmd_line, "console=");
 
-        if (strncmp(name, "vty", 3) == 0) {
-                if (device_is_compatible(stdout_node, "hvterm1")) {
-                        termno = (u32 *)get_property(stdout_node, "reg", NULL);
-                        if (termno) {
-                                vtermno = termno[0];
-                                udbg_putc = udbg_putcLP;
-                                udbg_getc = udbg_getcLP;
-                                udbg_getc_poll = udbg_getc_pollLP;
-                                found = 1;
-                        }
-                } else if (device_is_compatible(stdout_node, "hvterm-protocol")) {
-                        termno = (u32 *)get_property(stdout_node, "reg", NULL);
-                        if (termno) {
-                                vtermno = termno[0];
-                                udbg_putc = udbg_hvsi_putc;
-                                udbg_getc = udbg_hvsi_getc;
-                                udbg_getc_poll = udbg_hvsi_getc_poll;
-                                found = 1;
-                        }
-                }
-        } else if (strncmp(name, "serial", 6)) {
-                /* XXX fix ISA serial console */
-                printk(KERN_WARNING "serial stdout on LPAR ('%s')! "
-                                "can't print udbg messages\n",
-                       stdout_node->full_name);
-        } else {
-                printk(KERN_WARNING "don't know how to print to stdout '%s'\n",
-                       stdout_node->full_name);
+        /* Check if it's a virtual terminal */
+        if (strncmp(name, "vty", 3) != 0)
+                goto out;
+        termno = (u32 *)get_property(stdout_node, "reg", NULL);
+        if (termno == NULL)
+                goto out;
+        vtermno = termno[0];
+
+        if (device_is_compatible(stdout_node, "hvterm1")) {
+                udbg_putc = udbg_putcLP;
+                udbg_getc = udbg_getcLP;
+                udbg_getc_poll = udbg_getc_pollLP;
+                if (add_console)
+                        add_preferred_console("hvc", termno[0] & 0xff, NULL);
+        } else if (device_is_compatible(stdout_node, "hvterm-protocol")) {
+                vtermno = termno[0];
+                udbg_putc = udbg_hvsi_putc;
+                udbg_getc = udbg_hvsi_getc;
+                udbg_getc_poll = udbg_hvsi_getc_poll;
+                if (add_console)
+                        add_preferred_console("hvsi", termno[0] & 0xff, NULL);
         }
-
 out:
         of_node_put(stdout_node);
-        return found;
 }
 
 void vpa_init(int cpu)
diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c
new file mode 100644
index 000000000000..21934784f936
--- /dev/null
+++ b/arch/powerpc/platforms/pseries/pci_dlpar.c
@@ -0,0 +1,174 @@
+/*
+ * PCI Dynamic LPAR, PCI Hot Plug and PCI EEH recovery code
+ * for RPA-compliant PPC64 platform.
+ * Copyright (C) 2003 Linda Xie <lxie@us.ibm.com>
+ * Copyright (C) 2005 International Business Machines
+ *
+ * Updates, 2005, John Rose <johnrose@austin.ibm.com>
+ * Updates, 2005, Linas Vepstas <linas@austin.ibm.com>
+ *
+ * All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ * NON INFRINGEMENT.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/pci.h>
+#include <asm/pci-bridge.h>
+
+static struct pci_bus *
+find_bus_among_children(struct pci_bus *bus,
+                        struct device_node *dn)
+{
+        struct pci_bus *child = NULL;
+        struct list_head *tmp;
+        struct device_node *busdn;
+
+        busdn = pci_bus_to_OF_node(bus);
+        if (busdn == dn)
+                return bus;
+
+        list_for_each(tmp, &bus->children) {
+                child = find_bus_among_children(pci_bus_b(tmp), dn);
+                if (child)
+                        break;
+        };
+        return child;
+}
+
+struct pci_bus *
+pcibios_find_pci_bus(struct device_node *dn)
+{
+        struct pci_dn *pdn = dn->data;
+
+        if (!pdn  || !pdn->phb || !pdn->phb->bus)
+                return NULL;
+
+        return find_bus_among_children(pdn->phb->bus, dn);
+}
+
+/**
+ * pcibios_remove_pci_devices - remove all devices under this bus
+ *
+ * Remove all of the PCI devices under this bus both from the
+ * linux pci device tree, and from the powerpc EEH address cache.
+ */
+void
+pcibios_remove_pci_devices(struct pci_bus *bus)
+{
+        struct pci_dev *dev, *tmp;
+
+        list_for_each_entry_safe(dev, tmp, &bus->devices, bus_list) {
+                eeh_remove_bus_device(dev);
+                pci_remove_bus_device(dev);
+        }
+}
+
+/* Must be called before pci_bus_add_devices */
+void
+pcibios_fixup_new_pci_devices(struct pci_bus *bus, int fix_bus)
+{
+        struct pci_dev *dev;
+
+        list_for_each_entry(dev, &bus->devices, bus_list) {
+                /*
+                 * Skip already-present devices (which are on the
+                 * global device list.)
+                 */
+                if (list_empty(&dev->global_list)) {
+                        int i;
+
+                        /* Need to setup IOMMU tables */
+                        ppc_md.iommu_dev_setup(dev);
+
+                        if(fix_bus)
+                                pcibios_fixup_device_resources(dev, bus);
+                        pci_read_irq_line(dev);
+                        for (i = 0; i < PCI_NUM_RESOURCES; i++) {
+                                struct resource *r = &dev->resource[i];
+
+                                if (r->parent || !r->start || !r->flags)
+                                        continue;
+                                pci_claim_resource(dev, i);
+                        }
+                }
+        }
+}
+
+static int
+pcibios_pci_config_bridge(struct pci_dev *dev)
+{
+        u8 sec_busno;
+        struct pci_bus *child_bus;
+        struct pci_dev *child_dev;
+
+        /* Get busno of downstream bus */
+        pci_read_config_byte(dev, PCI_SECONDARY_BUS, &sec_busno);
+
+        /* Add to children of PCI bridge dev->bus */
+        child_bus = pci_add_new_bus(dev->bus, dev, sec_busno);
+        if (!child_bus) {
+                printk (KERN_ERR "%s: could not add second bus\n", __FUNCTION__);
+                return -EIO;
+        }
+        sprintf(child_bus->name, "PCI Bus #%02x", child_bus->number);
+
+        pci_scan_child_bus(child_bus);
+
+        list_for_each_entry(child_dev, &child_bus->devices, bus_list) {
+                eeh_add_device_late(child_dev);
+        }
+
+        /* Fixup new pci devices without touching bus struct */
+        pcibios_fixup_new_pci_devices(child_bus, 0);
+
+        /* Make the discovered devices available */
+        pci_bus_add_devices(child_bus);
+        return 0;
+}
+
+/**
+ * pcibios_add_pci_devices - adds new pci devices to bus
+ *
+ * This routine will find and fixup new pci devices under
+ * the indicated bus. This routine presumes that there
+ * might already be some devices under this bridge, so
+ * it carefully tries to add only new devices.  (And that
+ * is how this routine differs from other, similar pcibios
+ * routines.)
+ */
+void
+pcibios_add_pci_devices(struct pci_bus * bus)
+{
+        int slotno, num;
+        struct pci_dev *dev;
+        struct device_node *dn = pci_bus_to_OF_node(bus);
+
+        eeh_add_device_tree_early(dn);
+
+        /* pci_scan_slot should find all children */
+        slotno = PCI_SLOT(PCI_DN(dn->child)->devfn);
+        num = pci_scan_slot(bus, PCI_DEVFN(slotno, 0));
+        if (num) {
+                pcibios_fixup_new_pci_devices(bus, 1);
+                pci_bus_add_devices(bus);
+        }
+
+        list_for_each_entry(dev, &bus->devices, bus_list) {
+                eeh_add_device_late (dev);
+                if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE)
+                        pcibios_pci_config_bridge(dev);
+        }
+}
diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
index fbd214d68b07..b046bcf7443d 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -49,14 +49,14 @@
 #include <asm/machdep.h>
 #include <asm/rtas.h>
 #include <asm/udbg.h>
+#include <asm/firmware.h>
+
+#include "ras.h"
 
 static unsigned char ras_log_buf[RTAS_ERROR_LOG_MAX];
 static DEFINE_SPINLOCK(ras_log_buf_lock);
 
-char mce_data_buf[RTAS_ERROR_LOG_MAX]
-;
-/* This is true if we are using the firmware NMI handler (typically LPAR) */
-extern int fwnmi_active;
+char mce_data_buf[RTAS_ERROR_LOG_MAX];
 
 static int ras_get_sensor_state_token;
 static int ras_check_exception_token;
@@ -280,7 +280,7 @@ static void fwnmi_release_errinfo(void)
                 printk("FWNMI: nmi-interlock failed: %d\n", ret);
 }
 
-void pSeries_system_reset_exception(struct pt_regs *regs)
+int pSeries_system_reset_exception(struct pt_regs *regs)
 {
         if (fwnmi_active) {
                 struct rtas_error_log *errhdr = fwnmi_get_errinfo(regs);
@@ -289,6 +289,7 @@ void pSeries_system_reset_exception(struct pt_regs *regs)
                 }
                 fwnmi_release_errinfo();
         }
+        return 0; /* need to perform reset */
 }
 
 /*
diff --git a/arch/powerpc/platforms/pseries/ras.h b/arch/powerpc/platforms/pseries/ras.h
new file mode 100644
index 000000000000..0e66b0da55e2
--- /dev/null
+++ b/arch/powerpc/platforms/pseries/ras.h
@@ -0,0 +1,9 @@
+#ifndef _PSERIES_RAS_H
+#define _PSERIES_RAS_H
+
+struct pt_regs;
+
+extern int pSeries_system_reset_exception(struct pt_regs *regs);
+extern int pSeries_machine_check_exception(struct pt_regs *regs);
+
+#endif /* _PSERIES_RAS_H */
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 4a465f067ede..8903cf63236a 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -56,6 +56,7 @@
 #include <asm/dma.h>
 #include <asm/machdep.h>
 #include <asm/irq.h>
+#include <asm/kexec.h>
 #include <asm/time.h>
 #include <asm/nvram.h>
 #include "xics.h"
@@ -68,6 +69,7 @@
 #include <asm/smp.h>
 
 #include "plpar_wrappers.h"
+#include "ras.h"
 
 #ifdef DEBUG
 #define DBG(fmt...) udbg_printf(fmt)
@@ -76,16 +78,9 @@
 #endif
 
 extern void find_udbg_vterm(void);
-extern void system_reset_fwnmi(void);   /* from head.S */
-extern void machine_check_fwnmi(void);  /* from head.S */
-extern void generic_find_legacy_serial_ports(u64 *physport,
-                unsigned int *default_speed);
 
 int fwnmi_active;  /* TRUE if an FWNMI handler is present */
 
-extern void pSeries_system_reset_exception(struct pt_regs *regs);
-extern int pSeries_machine_check_exception(struct pt_regs *regs);
-
 static void pseries_shared_idle(void);
 static void pseries_dedicated_idle(void);
 
@@ -105,18 +100,22 @@ void pSeries_show_cpuinfo(struct seq_file *m)
 
 /* Initialize firmware assisted non-maskable interrupts if
  * the firmware supports this feature.
- *
  */
 static void __init fwnmi_init(void)
 {
-        int ret;
+        unsigned long system_reset_addr, machine_check_addr;
+
         int ibm_nmi_register = rtas_token("ibm,nmi-register");
         if (ibm_nmi_register == RTAS_UNKNOWN_SERVICE)
                 return;
-        ret = rtas_call(ibm_nmi_register, 2, 1, NULL,
-                        __pa((unsigned long)system_reset_fwnmi),
-                        __pa((unsigned long)machine_check_fwnmi));
-        if (ret == 0)
+
+        /* If the kernel's not linked at zero we point the firmware at low
+         * addresses anyway, and use a trampoline to get to the real code. */
+        system_reset_addr  = __pa(system_reset_fwnmi) - PHYSICAL_START;
+        machine_check_addr = __pa(machine_check_fwnmi) - PHYSICAL_START;
+
+        if (0 == rtas_call(ibm_nmi_register, 2, 1, NULL, system_reset_addr,
+                                machine_check_addr))
                 fwnmi_active = 1;
 }
 
@@ -323,15 +322,18 @@ static  void __init pSeries_discover_pic(void)
         ppc64_interrupt_controller = IC_INVALID;
         for (np = NULL; (np = of_find_node_by_name(np, "interrupt-controller"));) {
                 typep = (char *)get_property(np, "compatible", NULL);
-                if (strstr(typep, "open-pic"))
+                if (strstr(typep, "open-pic")) {
                         ppc64_interrupt_controller = IC_OPEN_PIC;
-                else if (strstr(typep, "ppc-xicp"))
+                        break;
+                } else if (strstr(typep, "ppc-xicp")) {
                         ppc64_interrupt_controller = IC_PPC_XIC;
-                else
-                        printk("pSeries_discover_pic: failed to recognize"
-                               " interrupt-controller\n");
-                break;
+                        break;
+                }
         }
+        if (ppc64_interrupt_controller == IC_INVALID)
+                printk("pSeries_discover_pic: failed to recognize"
+                        " interrupt-controller\n");
+
 }
 
 static void pSeries_mach_cpu_die(void)
@@ -365,10 +367,7 @@ static int pseries_set_xdabr(unsigned long dabr)
  */
 static void __init pSeries_init_early(void)
 {
-        void *comport;
         int iommu_off = 0;
-        unsigned int default_speed;
-        u64 physport;
 
         DBG(" -> pSeries_init_early()\n");
 
@@ -382,17 +381,8 @@ static void __init pSeries_init_early(void)
                              get_property(of_chosen, "linux,iommu-off", NULL));
         }
 
-        generic_find_legacy_serial_ports(&physport, &default_speed);
-
         if (platform_is_lpar())
                 find_udbg_vterm();
-        else if (physport) {
-                /* Map the uart for udbg. */
-                comport = (void *)ioremap(physport, 16);
-                udbg_init_uart(comport, default_speed);
-
-                DBG("Hello World !\n");
-        }
 
         if (firmware_has_feature(FW_FEATURE_DABR))
                 ppc_md.set_dabr = pseries_set_dabr;
@@ -638,5 +628,8 @@ struct machdep_calls __initdata pSeries_md = {
         .machine_check_exception = pSeries_machine_check_exception,
 #ifdef CONFIG_KEXEC
         .kexec_cpu_down         = pseries_kexec_cpu_down,
+        .machine_kexec          = default_machine_kexec,
+        .machine_kexec_prepare  = default_machine_kexec_prepare,
+        .machine_crash_shutdown = default_machine_crash_shutdown,
 #endif
 };
diff --git a/arch/powerpc/platforms/pseries/xics.c b/arch/powerpc/platforms/pseries/xics.c
index 0377decc0719..0c0cfa32eb58 100644
--- a/arch/powerpc/platforms/pseries/xics.c
+++ b/arch/powerpc/platforms/pseries/xics.c
@@ -407,7 +407,7 @@ irqreturn_t xics_ipi_action(int irq, void *dev_id, struct pt_regs *regs)
                         smp_message_recv(PPC_MSG_MIGRATE_TASK, regs);
                 }
 #endif
-#ifdef CONFIG_DEBUGGER
+#if defined(CONFIG_DEBUGGER) || defined(CONFIG_KEXEC)
                 if (test_and_clear_bit(PPC_MSG_DEBUGGER_BREAK,
                                        &xics_ipi_message[cpu].value)) {
                         mb();
diff --git a/arch/powerpc/sysdev/Makefile b/arch/powerpc/sysdev/Makefile
index 6b7efcfc352a..14b9abde2d27 100644
--- a/arch/powerpc/sysdev/Makefile
+++ b/arch/powerpc/sysdev/Makefile
@@ -4,5 +4,6 @@ obj-$(CONFIG_PPC_I8259)		+= i8259.o
 obj-$(CONFIG_PPC_MPC106)        += grackle.o
 obj-$(CONFIG_BOOKE)             += dcr.o
 obj-$(CONFIG_40x)               += dcr.o
-obj-$(CONFIG_U3_DART)           += u3_iommu.o
+obj-$(CONFIG_U3_DART)           += dart_iommu.o
 obj-$(CONFIG_MMIO_NVRAM)        += mmio_nvram.o
+obj-$(CONFIG_83xx)              += ipic.o
diff --git a/arch/powerpc/sysdev/dart.h b/arch/powerpc/sysdev/dart.h
index 33ed9ed7fc1e..c2d05763ccbe 100644
--- a/arch/powerpc/sysdev/dart.h
+++ b/arch/powerpc/sysdev/dart.h
@@ -20,29 +20,44 @@
 #define _POWERPC_SYSDEV_DART_H
 
 
-/* physical base of DART registers */
-#define DART_BASE        0xf8033000UL
-
 /* Offset from base to control register */
-#define DARTCNTL   0
+#define DART_CNTL       0
+
 /* Offset from base to exception register */
-#define DARTEXCP   0x10
+#define DART_EXCP_U3    0x10
 /* Offset from base to TLB tag registers */
-#define DARTTAG    0x1000
+#define DART_TAGS_U3    0x1000
 
+/* U4 registers */
+#define DART_BASE_U4    0x10
+#define DART_SIZE_U4    0x20
+#define DART_EXCP_U4    0x30
+#define DART_TAGS_U4    0x1000
 
 /* Control Register fields */
 
-/* base address of table (pfn) */
-#define DARTCNTL_BASE_MASK    0xfffff
-#define DARTCNTL_BASE_SHIFT   12
+/* U3 registers */
+#define DART_CNTL_U3_BASE_MASK  0xfffff
+#define DART_CNTL_U3_BASE_SHIFT 12
+#define DART_CNTL_U3_FLUSHTLB   0x400
+#define DART_CNTL_U3_ENABLE     0x200
+#define DART_CNTL_U3_SIZE_MASK  0x1ff
+#define DART_CNTL_U3_SIZE_SHIFT 0
+
+/* U4 registers */
+#define DART_BASE_U4_BASE_MASK  0xffffff
+#define DART_BASE_U4_BASE_SHIFT 0
+#define DART_CNTL_U4_FLUSHTLB   0x20000000
+#define DART_CNTL_U4_ENABLE     0x80000000
+#define DART_SIZE_U4_SIZE_MASK  0x1fff
+#define DART_SIZE_U4_SIZE_SHIFT 0
+
+#define DART_REG(r)     (dart + ((r) >> 2))
+#define DART_IN(r)      (in_be32(DART_REG(r)))
+#define DART_OUT(r,v)   (out_be32(DART_REG(r), (v)))
 
-#define DARTCNTL_FLUSHTLB     0x400
-#define DARTCNTL_ENABLE       0x200
 
 /* size of table in pages */
-#define DARTCNTL_SIZE_MASK    0x1ff
-#define DARTCNTL_SIZE_SHIFT   0
 
 
 /* DART table fields */
diff --git a/arch/powerpc/sysdev/u3_iommu.c b/arch/powerpc/sysdev/dart_iommu.c
index 5c1a26a6d00c..e00b46b9514e 100644
--- a/arch/powerpc/sysdev/u3_iommu.c
+++ b/arch/powerpc/sysdev/dart_iommu.c
@@ -1,25 +1,27 @@
 /*
- * arch/powerpc/sysdev/u3_iommu.c
+ * arch/powerpc/sysdev/dart_iommu.c
  *
  * Copyright (C) 2004 Olof Johansson <olof@lixom.net>, IBM Corporation
+ * Copyright (C) 2005 Benjamin Herrenschmidt <benh@kernel.crashing.org>,
+ *                    IBM Corporation
  *
  * Based on pSeries_iommu.c:
  * Copyright (C) 2001 Mike Corrigan & Dave Engebretsen, IBM Corporation
  * Copyright (C) 2004 Olof Johansson <olof@lixom.net>, IBM Corporation
  *
- * Dynamic DMA mapping support, Apple U3 & IBM CPC925 "DART" iommu.
+ * Dynamic DMA mapping support, Apple U3, U4 & IBM CPC925 "DART" iommu.
+ *
  *
- * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
- * 
+ *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- * 
+ *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
@@ -57,21 +59,22 @@ static unsigned long dart_tablesize;
 static u32 *dart_vbase;
 
 /* Mapped base address for the dart */
-static unsigned int *dart; 
+static unsigned int *__iomem dart;
 
 /* Dummy val that entries are set to when unused */
 static unsigned int dart_emptyval;
 
-static struct iommu_table iommu_table_u3;
-static int iommu_table_u3_inited;
+static struct iommu_table iommu_table_dart;
+static int iommu_table_dart_inited;
 static int dart_dirty;
+static int dart_is_u4;
 
 #define DBG(...)
 
 static inline void dart_tlb_invalidate_all(void)
 {
         unsigned long l = 0;
-        unsigned int reg;
+        unsigned int reg, inv_bit;
         unsigned long limit;
 
         DBG("dart: flush\n");
@@ -81,29 +84,28 @@ static inline void dart_tlb_invalidate_all(void)
          *
          * Gotcha: Sometimes, the DART won't detect that the bit gets
          * set. If so, clear it and set it again.
-         */ 
+         */
 
         limit = 0;
 
+        inv_bit = dart_is_u4 ? DART_CNTL_U4_FLUSHTLB : DART_CNTL_U3_FLUSHTLB;
 retry:
-        reg = in_be32((unsigned int *)dart+DARTCNTL);
-        reg |= DARTCNTL_FLUSHTLB;
-        out_be32((unsigned int *)dart+DARTCNTL, reg);
-
         l = 0;
-        while ((in_be32((unsigned int *)dart+DARTCNTL) & DARTCNTL_FLUSHTLB) &&
-                l < (1L<<limit)) {
+        reg = DART_IN(DART_CNTL);
+        reg |= inv_bit;
+        DART_OUT(DART_CNTL, reg);
+
+        while ((DART_IN(DART_CNTL) & inv_bit) && l < (1L << limit))
                 l++;
-        }
-        if (l == (1L<<limit)) {
+        if (l == (1L << limit)) {
                 if (limit < 4) {
                         limit++;
-                        reg = in_be32((unsigned int *)dart+DARTCNTL);
-                        reg &= ~DARTCNTL_FLUSHTLB;
-                        out_be32((unsigned int *)dart+DARTCNTL, reg);
+                        reg = DART_IN(DART_CNTL);
+                        reg &= ~inv_bit;
+                        DART_OUT(DART_CNTL, reg);
                         goto retry;
                 } else
-                        panic("U3-DART: TLB did not flush after waiting a long "
+                        panic("DART: TLB did not flush after waiting a long "
                               "time. Buggy U3 ?");
         }
 }
@@ -115,7 +117,7 @@ static void dart_flush(struct iommu_table *tbl)
         dart_dirty = 0;
 }
 
-static void dart_build(struct iommu_table *tbl, long index, 
+static void dart_build(struct iommu_table *tbl, long index,
                        long npages, unsigned long uaddr,
                        enum dma_data_direction direction)
 {
@@ -128,7 +130,7 @@ static void dart_build(struct iommu_table *tbl, long index,
         npages <<= DART_PAGE_FACTOR;
 
         dp = ((unsigned int*)tbl->it_base) + index;
-        
+
         /* On U3, all memory is contigous, so we can move this
          * out of the loop.
          */
@@ -148,7 +150,7 @@ static void dart_build(struct iommu_table *tbl, long index,
 static void dart_free(struct iommu_table *tbl, long index, long npages)
 {
         unsigned int *dp;
-        
+
         /* We don't worry about flushing the TLB cache. The only drawback of
          * not doing it is that we won't catch buggy device drivers doing
          * bad DMAs, but then no 32-bit architecture ever does either.
@@ -160,7 +162,7 @@ static void dart_free(struct iommu_table *tbl, long index, long npages)
         npages <<= DART_PAGE_FACTOR;
 
         dp  = ((unsigned int *)tbl->it_base) + index;
-                
+
         while (npages--)
                 *(dp++) = dart_emptyval;
 }
@@ -168,20 +170,25 @@ static void dart_free(struct iommu_table *tbl, long index, long npages)
 
 static int dart_init(struct device_node *dart_node)
 {
-        unsigned int regword;
         unsigned int i;
-        unsigned long tmp;
+        unsigned long tmp, base, size;
+        struct resource r;
 
         if (dart_tablebase == 0 || dart_tablesize == 0) {
-                printk(KERN_INFO "U3-DART: table not allocated, using direct DMA\n");
+                printk(KERN_INFO "DART: table not allocated, using "
+                       "direct DMA\n");
                 return -ENODEV;
         }
 
+        if (of_address_to_resource(dart_node, 0, &r))
+                panic("DART: can't get register base ! ");
+
         /* Make sure nothing from the DART range remains in the CPU cache
          * from a previous mapping that existed before the kernel took
          * over
          */
-        flush_dcache_phys_range(dart_tablebase, dart_tablebase + dart_tablesize);
+        flush_dcache_phys_range(dart_tablebase,
+                                dart_tablebase + dart_tablesize);
 
         /* Allocate a spare page to map all invalid DART pages. We need to do
          * that to work around what looks like a problem with the HT bridge
@@ -189,21 +196,16 @@ static int dart_init(struct device_node *dart_node)
          */
         tmp = lmb_alloc(DART_PAGE_SIZE, DART_PAGE_SIZE);
         if (!tmp)
-                panic("U3-DART: Cannot allocate spare page!");
-        dart_emptyval = DARTMAP_VALID | ((tmp >> DART_PAGE_SHIFT) & DARTMAP_RPNMASK);
+                panic("DART: Cannot allocate spare page!");
+        dart_emptyval = DARTMAP_VALID | ((tmp >> DART_PAGE_SHIFT) &
+                                         DARTMAP_RPNMASK);
 
-        /* Map in DART registers. FIXME: Use device node to get base address */
-        dart = ioremap(DART_BASE, 0x7000);
+        /* Map in DART registers */
+        dart = ioremap(r.start, r.end - r.start + 1);
         if (dart == NULL)
-                panic("U3-DART: Cannot map registers!");
+                panic("DART: Cannot map registers!");
 
-        /* Set initial control register contents: table base, 
-         * table size and enable bit
-         */
-        regword = DARTCNTL_ENABLE | 
-                ((dart_tablebase >> DART_PAGE_SHIFT) << DARTCNTL_BASE_SHIFT) |
-                (((dart_tablesize >> DART_PAGE_SHIFT) & DARTCNTL_SIZE_MASK)
-                                 << DARTCNTL_SIZE_SHIFT);
+        /* Map in DART table */
         dart_vbase = ioremap(virt_to_abs(dart_tablebase), dart_tablesize);
 
         /* Fill initial table */
@@ -211,36 +213,50 @@ static int dart_init(struct device_node *dart_node)
                 dart_vbase[i] = dart_emptyval;
 
         /* Initialize DART with table base and enable it. */
-        out_be32((unsigned int *)dart, regword);
+        base = dart_tablebase >> DART_PAGE_SHIFT;
+        size = dart_tablesize >> DART_PAGE_SHIFT;
+        if (dart_is_u4) {
+                size &= DART_SIZE_U4_SIZE_MASK;
+                DART_OUT(DART_BASE_U4, base);
+                DART_OUT(DART_SIZE_U4, size);
+                DART_OUT(DART_CNTL, DART_CNTL_U4_ENABLE);
+        } else {
+                size &= DART_CNTL_U3_SIZE_MASK;
+                DART_OUT(DART_CNTL,
+                         DART_CNTL_U3_ENABLE |
+                         (base << DART_CNTL_U3_BASE_SHIFT) |
+                         (size << DART_CNTL_U3_SIZE_SHIFT));
+        }
 
         /* Invalidate DART to get rid of possible stale TLBs */
         dart_tlb_invalidate_all();
 
-        printk(KERN_INFO "U3/CPC925 DART IOMMU initialized\n");
+        printk(KERN_INFO "DART IOMMU initialized for %s type chipset\n",
+               dart_is_u4 ? "U4" : "U3");
 
         return 0;
 }
 
-static void iommu_table_u3_setup(void)
+static void iommu_table_dart_setup(void)
 {
-        iommu_table_u3.it_busno = 0;
-        iommu_table_u3.it_offset = 0;
+        iommu_table_dart.it_busno = 0;
+        iommu_table_dart.it_offset = 0;
         /* it_size is in number of entries */
-        iommu_table_u3.it_size = (dart_tablesize / sizeof(u32)) >> DART_PAGE_FACTOR;
+        iommu_table_dart.it_size = (dart_tablesize / sizeof(u32)) >> DART_PAGE_FACTOR;
 
         /* Initialize the common IOMMU code */
-        iommu_table_u3.it_base = (unsigned long)dart_vbase;
-        iommu_table_u3.it_index = 0;
-        iommu_table_u3.it_blocksize = 1;
-        iommu_init_table(&iommu_table_u3);
+        iommu_table_dart.it_base = (unsigned long)dart_vbase;
+        iommu_table_dart.it_index = 0;
+        iommu_table_dart.it_blocksize = 1;
+        iommu_init_table(&iommu_table_dart);
 
         /* Reserve the last page of the DART to avoid possible prefetch
          * past the DART mapped area
          */
-        set_bit(iommu_table_u3.it_size - 1, iommu_table_u3.it_map);
+        set_bit(iommu_table_dart.it_size - 1, iommu_table_dart.it_map);
 }
 
-static void iommu_dev_setup_u3(struct pci_dev *dev)
+static void iommu_dev_setup_dart(struct pci_dev *dev)
 {
         struct device_node *dn;
 
@@ -254,35 +270,39 @@ static void iommu_dev_setup_u3(struct pci_dev *dev)
         dn = pci_device_to_OF_node(dev);
 
         if (dn)
-                PCI_DN(dn)->iommu_table = &iommu_table_u3;
+                PCI_DN(dn)->iommu_table = &iommu_table_dart;
 }
 
-static void iommu_bus_setup_u3(struct pci_bus *bus)
+static void iommu_bus_setup_dart(struct pci_bus *bus)
 {
         struct device_node *dn;
 
-        if (!iommu_table_u3_inited) {
-                iommu_table_u3_inited = 1;
-                iommu_table_u3_setup();
+        if (!iommu_table_dart_inited) {
+                iommu_table_dart_inited = 1;
+                iommu_table_dart_setup();
         }
 
         dn = pci_bus_to_OF_node(bus);
 
         if (dn)
-                PCI_DN(dn)->iommu_table = &iommu_table_u3;
+                PCI_DN(dn)->iommu_table = &iommu_table_dart;
 }
 
 static void iommu_dev_setup_null(struct pci_dev *dev) { }
 static void iommu_bus_setup_null(struct pci_bus *bus) { }
 
-void iommu_init_early_u3(void)
+void iommu_init_early_dart(void)
 {
         struct device_node *dn;
 
         /* Find the DART in the device-tree */
         dn = of_find_compatible_node(NULL, "dart", "u3-dart");
-        if (dn == NULL)
-                return;
+        if (dn == NULL) {
+                dn = of_find_compatible_node(NULL, "dart", "u4-dart");
+                if (dn == NULL)
+                        goto bail;
+                dart_is_u4 = 1;
+        }
 
         /* Setup low level TCE operations for the core IOMMU code */
         ppc_md.tce_build = dart_build;
@@ -290,24 +310,27 @@ void iommu_init_early_u3(void)
         ppc_md.tce_flush = dart_flush;
 
         /* Initialize the DART HW */
-        if (dart_init(dn)) {
-                /* If init failed, use direct iommu and null setup functions */
-                ppc_md.iommu_dev_setup = iommu_dev_setup_null;
-                ppc_md.iommu_bus_setup = iommu_bus_setup_null;
-
-                /* Setup pci_dma ops */
-                pci_direct_iommu_init();
-        } else {
-                ppc_md.iommu_dev_setup = iommu_dev_setup_u3;
-                ppc_md.iommu_bus_setup = iommu_bus_setup_u3;
+        if (dart_init(dn) == 0) {
+                ppc_md.iommu_dev_setup = iommu_dev_setup_dart;
+                ppc_md.iommu_bus_setup = iommu_bus_setup_dart;
 
                 /* Setup pci_dma ops */
                 pci_iommu_init();
+
+                return;
         }
+
+ bail:
+        /* If init failed, use direct iommu and null setup functions */
+        ppc_md.iommu_dev_setup = iommu_dev_setup_null;
+        ppc_md.iommu_bus_setup = iommu_bus_setup_null;
+
+        /* Setup pci_dma ops */
+        pci_direct_iommu_init();
 }
 
 
-void __init alloc_u3_dart_table(void)
+void __init alloc_dart_table(void)
 {
         /* Only reserve DART space if machine has more than 2GB of RAM
          * or if requested with iommu=on on cmdline.
@@ -323,5 +346,5 @@ void __init alloc_u3_dart_table(void)
         dart_tablebase = (unsigned long)
                 abs_to_virt(lmb_alloc_base(1UL<<24, 1UL<<24, 0x80000000L));
 
-        printk(KERN_INFO "U3-DART allocated at: %lx\n", dart_tablebase);
+        printk(KERN_INFO "DART table allocated at: %lx\n", dart_tablebase);
 }
diff --git a/arch/powerpc/sysdev/ipic.c b/arch/powerpc/sysdev/ipic.c
new file mode 100644
index 000000000000..8f01e0f1d847
--- /dev/null
+++ b/arch/powerpc/sysdev/ipic.c
@@ -0,0 +1,646 @@
+/*
+ * include/asm-ppc/ipic.c
+ *
+ * IPIC routines implementations.
+ *
+ * Copyright 2005 Freescale Semiconductor, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/reboot.h>
+#include <linux/slab.h>
+#include <linux/stddef.h>
+#include <linux/sched.h>
+#include <linux/signal.h>
+#include <linux/sysdev.h>
+#include <asm/irq.h>
+#include <asm/io.h>
+#include <asm/ipic.h>
+#include <asm/mpc83xx.h>
+
+#include "ipic.h"
+
+static struct ipic p_ipic;
+static struct ipic * primary_ipic;
+
+static struct ipic_info ipic_info[] = {
+        [9] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_H,
+                .prio   = IPIC_SIPRR_D,
+                .force  = IPIC_SIFCR_H,
+                .bit    = 24,
+                .prio_mask = 0,
+        },
+        [10] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_H,
+                .prio   = IPIC_SIPRR_D,
+                .force  = IPIC_SIFCR_H,
+                .bit    = 25,
+                .prio_mask = 1,
+        },
+        [11] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_H,
+                .prio   = IPIC_SIPRR_D,
+                .force  = IPIC_SIFCR_H,
+                .bit    = 26,
+                .prio_mask = 2,
+        },
+        [14] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_H,
+                .prio   = IPIC_SIPRR_D,
+                .force  = IPIC_SIFCR_H,
+                .bit    = 29,
+                .prio_mask = 5,
+        },
+        [15] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_H,
+                .prio   = IPIC_SIPRR_D,
+                .force  = IPIC_SIFCR_H,
+                .bit    = 30,
+                .prio_mask = 6,
+        },
+        [16] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_H,
+                .prio   = IPIC_SIPRR_D,
+                .force  = IPIC_SIFCR_H,
+                .bit    = 31,
+                .prio_mask = 7,
+        },
+        [17] = {
+                .pend   = IPIC_SEPNR,
+                .mask   = IPIC_SEMSR,
+                .prio   = IPIC_SMPRR_A,
+                .force  = IPIC_SEFCR,
+                .bit    = 1,
+                .prio_mask = 5,
+        },
+        [18] = {
+                .pend   = IPIC_SEPNR,
+                .mask   = IPIC_SEMSR,
+                .prio   = IPIC_SMPRR_A,
+                .force  = IPIC_SEFCR,
+                .bit    = 2,
+                .prio_mask = 6,
+        },
+        [19] = {
+                .pend   = IPIC_SEPNR,
+                .mask   = IPIC_SEMSR,
+                .prio   = IPIC_SMPRR_A,
+                .force  = IPIC_SEFCR,
+                .bit    = 3,
+                .prio_mask = 7,
+        },
+        [20] = {
+                .pend   = IPIC_SEPNR,
+                .mask   = IPIC_SEMSR,
+                .prio   = IPIC_SMPRR_B,
+                .force  = IPIC_SEFCR,
+                .bit    = 4,
+                .prio_mask = 4,
+        },
+        [21] = {
+                .pend   = IPIC_SEPNR,
+                .mask   = IPIC_SEMSR,
+                .prio   = IPIC_SMPRR_B,
+                .force  = IPIC_SEFCR,
+                .bit    = 5,
+                .prio_mask = 5,
+        },
+        [22] = {
+                .pend   = IPIC_SEPNR,
+                .mask   = IPIC_SEMSR,
+                .prio   = IPIC_SMPRR_B,
+                .force  = IPIC_SEFCR,
+                .bit    = 6,
+                .prio_mask = 6,
+        },
+        [23] = {
+                .pend   = IPIC_SEPNR,
+                .mask   = IPIC_SEMSR,
+                .prio   = IPIC_SMPRR_B,
+                .force  = IPIC_SEFCR,
+                .bit    = 7,
+                .prio_mask = 7,
+        },
+        [32] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_H,
+                .prio   = IPIC_SIPRR_A,
+                .force  = IPIC_SIFCR_H,
+                .bit    = 0,
+                .prio_mask = 0,
+        },
+        [33] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_H,
+                .prio   = IPIC_SIPRR_A,
+                .force  = IPIC_SIFCR_H,
+                .bit    = 1,
+                .prio_mask = 1,
+        },
+        [34] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_H,
+                .prio   = IPIC_SIPRR_A,
+                .force  = IPIC_SIFCR_H,
+                .bit    = 2,
+                .prio_mask = 2,
+        },
+        [35] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_H,
+                .prio   = IPIC_SIPRR_A,
+                .force  = IPIC_SIFCR_H,
+                .bit    = 3,
+                .prio_mask = 3,
+        },
+        [36] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_H,
+                .prio   = IPIC_SIPRR_A,
+                .force  = IPIC_SIFCR_H,
+                .bit    = 4,
+                .prio_mask = 4,
+        },
+        [37] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_H,
+                .prio   = IPIC_SIPRR_A,
+                .force  = IPIC_SIFCR_H,
+                .bit    = 5,
+                .prio_mask = 5,
+        },
+        [38] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_H,
+                .prio   = IPIC_SIPRR_A,
+                .force  = IPIC_SIFCR_H,
+                .bit    = 6,
+                .prio_mask = 6,
+        },
+        [39] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_H,
+                .prio   = IPIC_SIPRR_A,
+                .force  = IPIC_SIFCR_H,
+                .bit    = 7,
+                .prio_mask = 7,
+        },
+        [48] = {
+                .pend   = IPIC_SEPNR,
+                .mask   = IPIC_SEMSR,
+                .prio   = IPIC_SMPRR_A,
+                .force  = IPIC_SEFCR,
+                .bit    = 0,
+                .prio_mask = 4,
+        },
+        [64] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = IPIC_SMPRR_A,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 0,
+                .prio_mask = 0,
+        },
+        [65] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = IPIC_SMPRR_A,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 1,
+                .prio_mask = 1,
+        },
+        [66] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = IPIC_SMPRR_A,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 2,
+                .prio_mask = 2,
+        },
+        [67] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = IPIC_SMPRR_A,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 3,
+                .prio_mask = 3,
+        },
+        [68] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = IPIC_SMPRR_B,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 4,
+                .prio_mask = 0,
+        },
+        [69] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = IPIC_SMPRR_B,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 5,
+                .prio_mask = 1,
+        },
+        [70] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = IPIC_SMPRR_B,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 6,
+                .prio_mask = 2,
+        },
+        [71] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = IPIC_SMPRR_B,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 7,
+                .prio_mask = 3,
+        },
+        [72] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = 0,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 8,
+        },
+        [73] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = 0,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 9,
+        },
+        [74] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = 0,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 10,
+        },
+        [75] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = 0,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 11,
+        },
+        [76] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = 0,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 12,
+        },
+        [77] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = 0,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 13,
+        },
+        [78] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = 0,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 14,
+        },
+        [79] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = 0,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 15,
+        },
+        [80] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = 0,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 16,
+        },
+        [84] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = 0,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 20,
+        },
+        [85] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = 0,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 21,
+        },
+        [90] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = 0,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 26,
+        },
+        [91] = {
+                .pend   = IPIC_SIPNR_H,
+                .mask   = IPIC_SIMSR_L,
+                .prio   = 0,
+                .force  = IPIC_SIFCR_L,
+                .bit    = 27,
+        },
+};
+
+static inline u32 ipic_read(volatile u32 __iomem *base, unsigned int reg)
+{
+        return in_be32(base + (reg >> 2));
+}
+
+static inline void ipic_write(volatile u32 __iomem *base, unsigned int reg, u32 value)
+{
+        out_be32(base + (reg >> 2), value);
+}
+
+static inline struct ipic * ipic_from_irq(unsigned int irq)
+{
+        return primary_ipic;
+}
+
+static void ipic_enable_irq(unsigned int irq)
+{
+        struct ipic *ipic = ipic_from_irq(irq);
+        unsigned int src = irq - ipic->irq_offset;
+        u32 temp;
+
+        temp = ipic_read(ipic->regs, ipic_info[src].mask);
+        temp |= (1 << (31 - ipic_info[src].bit));
+        ipic_write(ipic->regs, ipic_info[src].mask, temp);
+}
+
+static void ipic_disable_irq(unsigned int irq)
+{
+        struct ipic *ipic = ipic_from_irq(irq);
+        unsigned int src = irq - ipic->irq_offset;
+        u32 temp;
+
+        temp = ipic_read(ipic->regs, ipic_info[src].mask);
+        temp &= ~(1 << (31 - ipic_info[src].bit));
+        ipic_write(ipic->regs, ipic_info[src].mask, temp);
+}
+
+static void ipic_disable_irq_and_ack(unsigned int irq)
+{
+        struct ipic *ipic = ipic_from_irq(irq);
+        unsigned int src = irq - ipic->irq_offset;
+        u32 temp;
+
+        ipic_disable_irq(irq);
+
+        temp = ipic_read(ipic->regs, ipic_info[src].pend);
+        temp |= (1 << (31 - ipic_info[src].bit));
+        ipic_write(ipic->regs, ipic_info[src].pend, temp);
+}
+
+static void ipic_end_irq(unsigned int irq)
+{
+        if (!(irq_desc[irq].status & (IRQ_DISABLED|IRQ_INPROGRESS)))
+                ipic_enable_irq(irq);
+}
+
+struct hw_interrupt_type ipic = {
+        .typename = " IPIC  ",
+        .enable = ipic_enable_irq,
+        .disable = ipic_disable_irq,
+        .ack = ipic_disable_irq_and_ack,
+        .end = ipic_end_irq,
+};
+
+void __init ipic_init(phys_addr_t phys_addr,
+                unsigned int flags,
+                unsigned int irq_offset,
+                unsigned char *senses,
+                unsigned int senses_count)
+{
+        u32 i, temp = 0;
+
+        primary_ipic = &p_ipic;
+        primary_ipic->regs = ioremap(phys_addr, MPC83xx_IPIC_SIZE);
+
+        primary_ipic->irq_offset = irq_offset;
+
+        ipic_write(primary_ipic->regs, IPIC_SICNR, 0x0);
+
+        /* default priority scheme is grouped. If spread mode is required
+         * configure SICFR accordingly */
+        if (flags & IPIC_SPREADMODE_GRP_A)
+                temp |= SICFR_IPSA;
+        if (flags & IPIC_SPREADMODE_GRP_D)
+                temp |= SICFR_IPSD;
+        if (flags & IPIC_SPREADMODE_MIX_A)
+                temp |= SICFR_MPSA;
+        if (flags & IPIC_SPREADMODE_MIX_B)
+                temp |= SICFR_MPSB;
+
+        ipic_write(primary_ipic->regs, IPIC_SICNR, temp);
+
+        /* handle MCP route */
+        temp = 0;
+        if (flags & IPIC_DISABLE_MCP_OUT)
+                temp = SERCR_MCPR;
+        ipic_write(primary_ipic->regs, IPIC_SERCR, temp);
+
+        /* handle routing of IRQ0 to MCP */
+        temp = ipic_read(primary_ipic->regs, IPIC_SEMSR);
+
+        if (flags & IPIC_IRQ0_MCP)
+                temp |= SEMSR_SIRQ0;
+        else
+                temp &= ~SEMSR_SIRQ0;
+
+        ipic_write(primary_ipic->regs, IPIC_SEMSR, temp);
+
+        for (i = 0 ; i < NR_IPIC_INTS ; i++) {
+                irq_desc[i+irq_offset].handler = &ipic;
+                irq_desc[i+irq_offset].status = IRQ_LEVEL;
+        }
+
+        temp = 0;
+        for (i = 0 ; i < senses_count ; i++) {
+                if ((senses[i] & IRQ_SENSE_MASK) == IRQ_SENSE_EDGE) {
+                        temp |= 1 << (15 - i);
+                        if (i != 0)
+                                irq_desc[i + irq_offset + MPC83xx_IRQ_EXT1 - 1].status = 0;
+                        else
+                                irq_desc[irq_offset + MPC83xx_IRQ_EXT0].status = 0;
+                }
+        }
+        ipic_write(primary_ipic->regs, IPIC_SECNR, temp);
+
+        printk ("IPIC (%d IRQ sources, %d External IRQs) at %p\n", NR_IPIC_INTS,
+                        senses_count, primary_ipic->regs);
+}
+
+int ipic_set_priority(unsigned int irq, unsigned int priority)
+{
+        struct ipic *ipic = ipic_from_irq(irq);
+        unsigned int src = irq - ipic->irq_offset;
+        u32 temp;
+
+        if (priority > 7)
+                return -EINVAL;
+        if (src > 127)
+                return -EINVAL;
+        if (ipic_info[src].prio == 0)
+                return -EINVAL;
+
+        temp = ipic_read(ipic->regs, ipic_info[src].prio);
+
+        if (priority < 4) {
+                temp &= ~(0x7 << (20 + (3 - priority) * 3));
+                temp |= ipic_info[src].prio_mask << (20 + (3 - priority) * 3);
+        } else {
+                temp &= ~(0x7 << (4 + (7 - priority) * 3));
+                temp |= ipic_info[src].prio_mask << (4 + (7 - priority) * 3);
+        }
+
+        ipic_write(ipic->regs, ipic_info[src].prio, temp);
+
+        return 0;
+}
+
+void ipic_set_highest_priority(unsigned int irq)
+{
+        struct ipic *ipic = ipic_from_irq(irq);
+        unsigned int src = irq - ipic->irq_offset;
+        u32 temp;
+
+        temp = ipic_read(ipic->regs, IPIC_SICFR);
+
+        /* clear and set HPI */
+        temp &= 0x7f000000;
+        temp |= (src & 0x7f) << 24;
+
+        ipic_write(ipic->regs, IPIC_SICFR, temp);
+}
+
+void ipic_set_default_priority(void)
+{
+        ipic_set_priority(MPC83xx_IRQ_TSEC1_TX, 0);
+        ipic_set_priority(MPC83xx_IRQ_TSEC1_RX, 1);
+        ipic_set_priority(MPC83xx_IRQ_TSEC1_ERROR, 2);
+        ipic_set_priority(MPC83xx_IRQ_TSEC2_TX, 3);
+        ipic_set_priority(MPC83xx_IRQ_TSEC2_RX, 4);
+        ipic_set_priority(MPC83xx_IRQ_TSEC2_ERROR, 5);
+        ipic_set_priority(MPC83xx_IRQ_USB2_DR, 6);
+        ipic_set_priority(MPC83xx_IRQ_USB2_MPH, 7);
+
+        ipic_set_priority(MPC83xx_IRQ_UART1, 0);
+        ipic_set_priority(MPC83xx_IRQ_UART2, 1);
+        ipic_set_priority(MPC83xx_IRQ_SEC2, 2);
+        ipic_set_priority(MPC83xx_IRQ_IIC1, 5);
+        ipic_set_priority(MPC83xx_IRQ_IIC2, 6);
+        ipic_set_priority(MPC83xx_IRQ_SPI, 7);
+        ipic_set_priority(MPC83xx_IRQ_RTC_SEC, 0);
+        ipic_set_priority(MPC83xx_IRQ_PIT, 1);
+        ipic_set_priority(MPC83xx_IRQ_PCI1, 2);
+        ipic_set_priority(MPC83xx_IRQ_PCI2, 3);
+        ipic_set_priority(MPC83xx_IRQ_EXT0, 4);
+        ipic_set_priority(MPC83xx_IRQ_EXT1, 5);
+        ipic_set_priority(MPC83xx_IRQ_EXT2, 6);
+        ipic_set_priority(MPC83xx_IRQ_EXT3, 7);
+        ipic_set_priority(MPC83xx_IRQ_RTC_ALR, 0);
+        ipic_set_priority(MPC83xx_IRQ_MU, 1);
+        ipic_set_priority(MPC83xx_IRQ_SBA, 2);
+        ipic_set_priority(MPC83xx_IRQ_DMA, 3);
+        ipic_set_priority(MPC83xx_IRQ_EXT4, 4);
+        ipic_set_priority(MPC83xx_IRQ_EXT5, 5);
+        ipic_set_priority(MPC83xx_IRQ_EXT6, 6);
+        ipic_set_priority(MPC83xx_IRQ_EXT7, 7);
+}
+
+void ipic_enable_mcp(enum ipic_mcp_irq mcp_irq)
+{
+        struct ipic *ipic = primary_ipic;
+        u32 temp;
+
+        temp = ipic_read(ipic->regs, IPIC_SERMR);
+        temp |= (1 << (31 - mcp_irq));
+        ipic_write(ipic->regs, IPIC_SERMR, temp);
+}
+
+void ipic_disable_mcp(enum ipic_mcp_irq mcp_irq)
+{
+        struct ipic *ipic = primary_ipic;
+        u32 temp;
+
+        temp = ipic_read(ipic->regs, IPIC_SERMR);
+        temp &= (1 << (31 - mcp_irq));
+        ipic_write(ipic->regs, IPIC_SERMR, temp);
+}
+
+u32 ipic_get_mcp_status(void)
+{
+        return ipic_read(primary_ipic->regs, IPIC_SERMR);
+}
+
+void ipic_clear_mcp_status(u32 mask)
+{
+        ipic_write(primary_ipic->regs, IPIC_SERMR, mask);
+}
+
+/* Return an interrupt vector or -1 if no interrupt is pending. */
+int ipic_get_irq(struct pt_regs *regs)
+{
+        int irq;
+
+        irq = ipic_read(primary_ipic->regs, IPIC_SIVCR) & 0x7f;
+
+        if (irq == 0)    /* 0 --> no irq is pending */
+                irq = -1;
+
+        return irq;
+}
+
+static struct sysdev_class ipic_sysclass = {
+        set_kset_name("ipic"),
+};
+
+static struct sys_device device_ipic = {
+        .id             = 0,
+        .cls            = &ipic_sysclass,
+};
+
+static int __init init_ipic_sysfs(void)
+{
+        int rc;
+
+        if (!primary_ipic->regs)
+                return -ENODEV;
+        printk(KERN_DEBUG "Registering ipic with sysfs...\n");
+
+        rc = sysdev_class_register(&ipic_sysclass);
+        if (rc) {
+                printk(KERN_ERR "Failed registering ipic sys class\n");
+                return -ENODEV;
+        }
+        rc = sysdev_register(&device_ipic);
+        if (rc) {
+                printk(KERN_ERR "Failed registering ipic sys device\n");
+                return -ENODEV;
+        }
+        return 0;
+}
+
+subsys_initcall(init_ipic_sysfs);
diff --git a/arch/powerpc/sysdev/ipic.h b/arch/powerpc/sysdev/ipic.h
new file mode 100644
index 000000000000..a7ce7da8785c
--- /dev/null
+++ b/arch/powerpc/sysdev/ipic.h
@@ -0,0 +1,49 @@
+/*
+ * arch/ppc/kernel/ipic.h
+ *
+ * IPIC private definitions and structure.
+ *
+ * Maintainer: Kumar Gala <galak@kernel.crashing.org>
+ *
+ * Copyright 2005 Freescale Semiconductor, Inc
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#ifndef __IPIC_H__
+#define __IPIC_H__
+
+#include <asm/ipic.h>
+
+#define MPC83xx_IPIC_SIZE       (0x00100)
+
+/* System Global Interrupt Configuration Register */
+#define SICFR_IPSA      0x00010000
+#define SICFR_IPSD      0x00080000
+#define SICFR_MPSA      0x00200000
+#define SICFR_MPSB      0x00400000
+
+/* System External Interrupt Mask Register */
+#define SEMSR_SIRQ0     0x00008000
+
+/* System Error Control Register */
+#define SERCR_MCPR      0x00000001
+
+struct ipic {
+        volatile u32 __iomem    *regs;
+        unsigned int            irq_offset;
+};
+
+struct ipic_info {
+        u8      pend;           /* pending register offset from base */
+        u8      mask;           /* mask register offset from base */
+        u8      prio;           /* priority register offset from base */
+        u8      force;          /* force register offset from base */
+        u8      bit;            /* register bit position (as per doc)
+                                   bit mask = 1 << (31 - bit) */
+        u8      prio_mask;      /* priority mask value */
+};
+
+#endif /* __IPIC_H__ */
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 58d1cc2023c8..4f26304d0263 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -13,6 +13,9 @@
  */
 
 #undef DEBUG
+#undef DEBUG_IPI
+#undef DEBUG_IRQ
+#undef DEBUG_LOW
 
 #include <linux/config.h>
 #include <linux/types.h>
@@ -45,7 +48,11 @@ static struct mpic *mpic_primary;
 static DEFINE_SPINLOCK(mpic_lock);
 
 #ifdef CONFIG_PPC32     /* XXX for now */
-#define distribute_irqs CONFIG_IRQ_ALL_CPUS
+#ifdef CONFIG_IRQ_ALL_CPUS
+#define distribute_irqs (1)
+#else
+#define distribute_irqs (0)
+#endif
 #endif
 
 /*
@@ -164,70 +171,129 @@ static void __init mpic_test_broken_ipi(struct mpic *mpic)
 /* Test if an interrupt is sourced from HyperTransport (used on broken U3s)
  * to force the edge setting on the MPIC and do the ack workaround.
  */
-static inline int mpic_is_ht_interrupt(struct mpic *mpic, unsigned int source_no)
+static inline int mpic_is_ht_interrupt(struct mpic *mpic, unsigned int source)
 {
-        if (source_no >= 128 || !mpic->fixups)
+        if (source >= 128 || !mpic->fixups)
                 return 0;
-        return mpic->fixups[source_no].base != NULL;
+        return mpic->fixups[source].base != NULL;
 }
 
-static inline void mpic_apic_end_irq(struct mpic *mpic, unsigned int source_no)
+
+static inline void mpic_ht_end_irq(struct mpic *mpic, unsigned int source)
 {
-        struct mpic_irq_fixup *fixup = &mpic->fixups[source_no];
-        u32 tmp;
+        struct mpic_irq_fixup *fixup = &mpic->fixups[source];
 
-        spin_lock(&mpic->fixup_lock);
-        writeb(0x11 + 2 * fixup->irq, fixup->base);
-        tmp = readl(fixup->base + 2);
-        writel(tmp | 0x80000000ul, fixup->base + 2);
-        /* config writes shouldn't be posted but let's be safe ... */
-        (void)readl(fixup->base + 2);
-        spin_unlock(&mpic->fixup_lock);
+        if (fixup->applebase) {
+                unsigned int soff = (fixup->index >> 3) & ~3;
+                unsigned int mask = 1U << (fixup->index & 0x1f);
+                writel(mask, fixup->applebase + soff);
+        } else {
+                spin_lock(&mpic->fixup_lock);
+                writeb(0x11 + 2 * fixup->index, fixup->base + 2);
+                writel(fixup->data, fixup->base + 4);
+                spin_unlock(&mpic->fixup_lock);
+        }
 }
 
+static void mpic_startup_ht_interrupt(struct mpic *mpic, unsigned int source,
+                                      unsigned int irqflags)
+{
+        struct mpic_irq_fixup *fixup = &mpic->fixups[source];
+        unsigned long flags;
+        u32 tmp;
 
-static void __init mpic_amd8111_read_irq(struct mpic *mpic, u8 __iomem *devbase)
+        if (fixup->base == NULL)
+                return;
+
+        DBG("startup_ht_interrupt(%u, %u) index: %d\n",
+            source, irqflags, fixup->index);
+        spin_lock_irqsave(&mpic->fixup_lock, flags);
+        /* Enable and configure */
+        writeb(0x10 + 2 * fixup->index, fixup->base + 2);
+        tmp = readl(fixup->base + 4);
+        tmp &= ~(0x23U);
+        if (irqflags & IRQ_LEVEL)
+                tmp |= 0x22;
+        writel(tmp, fixup->base + 4);
+        spin_unlock_irqrestore(&mpic->fixup_lock, flags);
+}
+
+static void mpic_shutdown_ht_interrupt(struct mpic *mpic, unsigned int source,
+                                       unsigned int irqflags)
 {
-        int i, irq;
+        struct mpic_irq_fixup *fixup = &mpic->fixups[source];
+        unsigned long flags;
         u32 tmp;
 
-        printk(KERN_INFO "mpic:    - Workarounds on AMD 8111 @ %p\n", devbase);
+        if (fixup->base == NULL)
+                return;
 
-        for (i=0; i < 24; i++) {
-                writeb(0x10 + 2*i, devbase + 0xf2);
-                tmp = readl(devbase + 0xf4);
-                if ((tmp & 0x1) || !(tmp & 0x20))
-                        continue;
-                irq = (tmp >> 16) & 0xff;
-                mpic->fixups[irq].irq = i;
-                mpic->fixups[irq].base = devbase + 0xf2;
-        }
+        DBG("shutdown_ht_interrupt(%u, %u)\n", source, irqflags);
+
+        /* Disable */
+        spin_lock_irqsave(&mpic->fixup_lock, flags);
+        writeb(0x10 + 2 * fixup->index, fixup->base + 2);
+        tmp = readl(fixup->base + 4);
+        tmp &= ~1U;
+        writel(tmp, fixup->base + 4);
+        spin_unlock_irqrestore(&mpic->fixup_lock, flags);
 }
- 
-static void __init mpic_amd8131_read_irq(struct mpic *mpic, u8 __iomem *devbase)
+
+static void __init mpic_scan_ht_pic(struct mpic *mpic, u8 __iomem *devbase,
+                                    unsigned int devfn, u32 vdid)
 {
-        int i, irq;
+        int i, irq, n;
+        u8 __iomem *base;
         u32 tmp;
+        u8 pos;
+
+        for (pos = readb(devbase + PCI_CAPABILITY_LIST); pos != 0;
+             pos = readb(devbase + pos + PCI_CAP_LIST_NEXT)) {
+                u8 id = readb(devbase + pos + PCI_CAP_LIST_ID);
+                if (id == PCI_CAP_ID_HT_IRQCONF) {
+                        id = readb(devbase + pos + 3);
+                        if (id == 0x80)
+                                break;
+                }
+        }
+        if (pos == 0)
+                return;
 
-        printk(KERN_INFO "mpic:    - Workarounds on AMD 8131 @ %p\n", devbase);
+        base = devbase + pos;
+        writeb(0x01, base + 2);
+        n = (readl(base + 4) >> 16) & 0xff;
 
-        for (i=0; i < 4; i++) {
-                writeb(0x10 + 2*i, devbase + 0xba);
-                tmp = readl(devbase + 0xbc);
-                if ((tmp & 0x1) || !(tmp & 0x20))
-                        continue;
+        printk(KERN_INFO "mpic:   - HT:%02x.%x [0x%02x] vendor %04x device %04x"
+               " has %d irqs\n",
+               devfn >> 3, devfn & 0x7, pos, vdid & 0xffff, vdid >> 16, n + 1);
+
+        for (i = 0; i <= n; i++) {
+                writeb(0x10 + 2 * i, base + 2);
+                tmp = readl(base + 4);
                 irq = (tmp >> 16) & 0xff;
-                mpic->fixups[irq].irq = i;
-                mpic->fixups[irq].base = devbase + 0xba;
+                DBG("HT PIC index 0x%x, irq 0x%x, tmp: %08x\n", i, irq, tmp);
+                /* mask it , will be unmasked later */
+                tmp |= 0x1;
+                writel(tmp, base + 4);
+                mpic->fixups[irq].index = i;
+                mpic->fixups[irq].base = base;
+                /* Apple HT PIC has a non-standard way of doing EOIs */
+                if ((vdid & 0xffff) == 0x106b)
+                        mpic->fixups[irq].applebase = devbase + 0x60;
+                else
+                        mpic->fixups[irq].applebase = NULL;
+                writeb(0x11 + 2 * i, base + 2);
+                mpic->fixups[irq].data = readl(base + 4) | 0x80000000;
         }
 }
  
-static void __init mpic_scan_ioapics(struct mpic *mpic)
+
+static void __init mpic_scan_ht_pics(struct mpic *mpic)
 {
         unsigned int devfn;
         u8 __iomem *cfgspace;
 
-        printk(KERN_INFO "mpic: Setting up IO-APICs workarounds for U3\n");
+        printk(KERN_INFO "mpic: Setting up HT PICs workarounds for U3/U4\n");
 
         /* Allocate fixups array */
         mpic->fixups = alloc_bootmem(128 * sizeof(struct mpic_irq_fixup));
@@ -237,21 +303,20 @@ static void __init mpic_scan_ioapics(struct mpic *mpic)
         /* Init spinlock */
         spin_lock_init(&mpic->fixup_lock);
 
-        /* Map u3 config space. We assume all IO-APICs are on the primary bus
-         * and slot will never be above "0xf" so we only need to map 32k
+        /* Map U3 config space. We assume all IO-APICs are on the primary bus
+         * so we only need to map 64kB.
          */
-        cfgspace = (unsigned char __iomem *)ioremap(0xf2000000, 0x8000);
+        cfgspace = ioremap(0xf2000000, 0x10000);
         BUG_ON(cfgspace == NULL);
 
-        /* Now we scan all slots. We do a very quick scan, we read the header type,
-         * vendor ID and device ID only, that's plenty enough
+        /* Now we scan all slots. We do a very quick scan, we read the header
+         * type, vendor ID and device ID only, that's plenty enough
          */
-        for (devfn = 0; devfn < PCI_DEVFN(0x10,0); devfn ++) {
+        for (devfn = 0; devfn < 0x100; devfn++) {
                 u8 __iomem *devbase = cfgspace + (devfn << 8);
                 u8 hdr_type = readb(devbase + PCI_HEADER_TYPE);
                 u32 l = readl(devbase + PCI_VENDOR_ID);
-                u16 vendor_id, device_id;
-                int multifunc = 0;
+                u16 s;
 
                 DBG("devfn %x, l: %x\n", devfn, l);
 
@@ -259,22 +324,16 @@ static void __init mpic_scan_ioapics(struct mpic *mpic)
                 if (l == 0xffffffff || l == 0x00000000 ||
                     l == 0x0000ffff || l == 0xffff0000)
                         goto next;
+                /* Check if is supports capability lists */
+                s = readw(devbase + PCI_STATUS);
+                if (!(s & PCI_STATUS_CAP_LIST))
+                        goto next;
+
+                mpic_scan_ht_pic(mpic, devbase, devfn, l);
 
-                /* Check if it's a multifunction device (only really used
-                 * to function 0 though
-                 */
-                multifunc = !!(hdr_type & 0x80);
-                vendor_id = l & 0xffff;
-                device_id = (l >> 16) & 0xffff;
-
-                /* If a known device, go to fixup setup code */
-                if (vendor_id == PCI_VENDOR_ID_AMD && device_id == 0x7460)
-                        mpic_amd8111_read_irq(mpic, devbase);
-                if (vendor_id == PCI_VENDOR_ID_AMD && device_id == 0x7450)
-                        mpic_amd8131_read_irq(mpic, devbase);
         next:
                 /* next device, if function 0 */
-                if ((PCI_FUNC(devfn) == 0) && !multifunc)
+                if (PCI_FUNC(devfn) == 0 && (hdr_type & 0x80) == 0)
                         devfn += 7;
         }
 }
@@ -371,6 +430,31 @@ static void mpic_enable_irq(unsigned int irq)
                         break;
                 }
         } while(mpic_irq_read(src, MPIC_IRQ_VECTOR_PRI) & MPIC_VECPRI_MASK);    
+
+#ifdef CONFIG_MPIC_BROKEN_U3
+        if (mpic->flags & MPIC_BROKEN_U3) {
+                unsigned int src = irq - mpic->irq_offset;
+                if (mpic_is_ht_interrupt(mpic, src) &&
+                    (irq_desc[irq].status & IRQ_LEVEL))
+                        mpic_ht_end_irq(mpic, src);
+        }
+#endif /* CONFIG_MPIC_BROKEN_U3 */
+}
+
+static unsigned int mpic_startup_irq(unsigned int irq)
+{
+#ifdef CONFIG_MPIC_BROKEN_U3
+        struct mpic *mpic = mpic_from_irq(irq);
+        unsigned int src = irq - mpic->irq_offset;
+
+        if (mpic_is_ht_interrupt(mpic, src))
+                mpic_startup_ht_interrupt(mpic, src, irq_desc[irq].status);
+
+#endif /* CONFIG_MPIC_BROKEN_U3 */
+
+        mpic_enable_irq(irq);
+
+        return 0;
 }
 
 static void mpic_disable_irq(unsigned int irq)
@@ -394,12 +478,27 @@ static void mpic_disable_irq(unsigned int irq)
         } while(!(mpic_irq_read(src, MPIC_IRQ_VECTOR_PRI) & MPIC_VECPRI_MASK));
 }
 
+static void mpic_shutdown_irq(unsigned int irq)
+{
+#ifdef CONFIG_MPIC_BROKEN_U3
+        struct mpic *mpic = mpic_from_irq(irq);
+        unsigned int src = irq - mpic->irq_offset;
+
+        if (mpic_is_ht_interrupt(mpic, src))
+                mpic_shutdown_ht_interrupt(mpic, src, irq_desc[irq].status);
+
+#endif /* CONFIG_MPIC_BROKEN_U3 */
+
+        mpic_disable_irq(irq);
+}
+
 static void mpic_end_irq(unsigned int irq)
 {
         struct mpic *mpic = mpic_from_irq(irq);
 
+#ifdef DEBUG_IRQ
         DBG("%s: end_irq: %d\n", mpic->name, irq);
-
+#endif
         /* We always EOI on end_irq() even for edge interrupts since that
          * should only lower the priority, the MPIC should have properly
          * latched another edge interrupt coming in anyway
@@ -408,8 +507,9 @@ static void mpic_end_irq(unsigned int irq)
 #ifdef CONFIG_MPIC_BROKEN_U3
         if (mpic->flags & MPIC_BROKEN_U3) {
                 unsigned int src = irq - mpic->irq_offset;
-                if (mpic_is_ht_interrupt(mpic, src))
-                        mpic_apic_end_irq(mpic, src);
+                if (mpic_is_ht_interrupt(mpic, src) &&
+                    (irq_desc[irq].status & IRQ_LEVEL))
+                        mpic_ht_end_irq(mpic, src);
         }
 #endif /* CONFIG_MPIC_BROKEN_U3 */
 
@@ -490,6 +590,8 @@ struct mpic * __init mpic_alloc(unsigned long phys_addr,
         mpic->name = name;
 
         mpic->hc_irq.typename = name;
+        mpic->hc_irq.startup = mpic_startup_irq;
+        mpic->hc_irq.shutdown = mpic_shutdown_irq;
         mpic->hc_irq.enable = mpic_enable_irq;
         mpic->hc_irq.disable = mpic_disable_irq;
         mpic->hc_irq.end = mpic_end_irq;
@@ -658,10 +760,10 @@ void __init mpic_init(struct mpic *mpic)
                 mpic->irq_count = mpic->num_sources;
 
 #ifdef CONFIG_MPIC_BROKEN_U3
-        /* Do the ioapic fixups on U3 broken mpic */
+        /* Do the HT PIC fixups on U3 broken mpic */
         DBG("MPIC flags: %x\n", mpic->flags);
         if ((mpic->flags & MPIC_BROKEN_U3) && (mpic->flags & MPIC_PRIMARY))
-                mpic_scan_ioapics(mpic);
+                mpic_scan_ht_pics(mpic);
 #endif /* CONFIG_MPIC_BROKEN_U3 */
 
         for (i = 0; i < mpic->num_sources; i++) {
@@ -848,7 +950,9 @@ void mpic_send_ipi(unsigned int ipi_no, unsigned int cpu_mask)
 
         BUG_ON(mpic == NULL);
 
+#ifdef DEBUG_IPI
         DBG("%s: send_ipi(ipi_no: %d)\n", mpic->name, ipi_no);
+#endif
 
         mpic_cpu_write(MPIC_CPU_IPI_DISPATCH_0 + ipi_no * 0x10,
                        mpic_physmask(cpu_mask & cpus_addr(cpu_online_map)[0]));
@@ -859,19 +963,28 @@ int mpic_get_one_irq(struct mpic *mpic, struct pt_regs *regs)
         u32 irq;
 
         irq = mpic_cpu_read(MPIC_CPU_INTACK) & MPIC_VECPRI_VECTOR_MASK;
+#ifdef DEBUG_LOW
         DBG("%s: get_one_irq(): %d\n", mpic->name, irq);
-
+#endif
         if (mpic->cascade && irq == mpic->cascade_vec) {
+#ifdef DEBUG_LOW
                 DBG("%s: cascading ...\n", mpic->name);
+#endif
                 irq = mpic->cascade(regs, mpic->cascade_data);
                 mpic_eoi(mpic);
                 return irq;
         }
         if (unlikely(irq == MPIC_VEC_SPURRIOUS))
                 return -1;
-        if (irq < MPIC_VEC_IPI_0) 
+        if (irq < MPIC_VEC_IPI_0) {
+#ifdef DEBUG_IRQ
+                DBG("%s: irq %d\n", mpic->name, irq + mpic->irq_offset);
+#endif
                 return irq + mpic->irq_offset;
+        }
+#ifdef DEBUG_IPI
         DBG("%s: ipi %d !\n", mpic->name, irq - MPIC_VEC_IPI_0);
+#endif
         return irq - MPIC_VEC_IPI_0 + mpic->ipi_offset;
 }
 
diff --git a/arch/powerpc/xmon/Makefile b/arch/powerpc/xmon/Makefile
index b20312e5ed27..109d874ecfbe 100644
--- a/arch/powerpc/xmon/Makefile
+++ b/arch/powerpc/xmon/Makefile
@@ -3,9 +3,5 @@
 ifdef CONFIG_PPC64
 EXTRA_CFLAGS += -mno-minimal-toc
 endif
-
-obj-$(CONFIG_8xx)       += start_8xx.o
-obj-$(CONFIG_6xx)       += start_32.o
-obj-$(CONFIG_4xx)       += start_32.o
-obj-$(CONFIG_PPC64)     += start_64.o
-obj-y                   += xmon.o ppc-dis.o ppc-opc.o setjmp.o nonstdio.o
+obj-y                   += xmon.o ppc-dis.o ppc-opc.o setjmp.o start.o \
+                           nonstdio.o
diff --git a/arch/powerpc/xmon/start_64.c b/arch/powerpc/xmon/start.c
index 712552c4f242..712552c4f242 100644
--- a/arch/powerpc/xmon/start_64.c
+++ b/arch/powerpc/xmon/start.c
diff --git a/arch/powerpc/xmon/start_32.c b/arch/powerpc/xmon/start_32.c
deleted file mode 100644
index c2464df4217e..000000000000
--- a/arch/powerpc/xmon/start_32.c
+++ /dev/null
@@ -1,441 +0,0 @@
-/*
- * Copyright (C) 1996 Paul Mackerras.
- */
-#include <linux/config.h>
-#include <linux/string.h>
-#include <asm/machdep.h>
-#include <asm/io.h>
-#include <asm/page.h>
-#include <linux/adb.h>
-#include <linux/pmu.h>
-#include <linux/cuda.h>
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/bitops.h>
-#include <asm/xmon.h>
-#include <asm/prom.h>
-#include <asm/bootx.h>
-#include <asm/machdep.h>
-#include <asm/errno.h>
-#include <asm/pmac_feature.h>
-#include <asm/processor.h>
-#include <asm/delay.h>
-#include <asm/btext.h>
-#include <asm/time.h>
-#include "nonstdio.h"
-
-static volatile unsigned char __iomem *sccc, *sccd;
-unsigned int TXRDY, RXRDY, DLAB;
-
-static int use_serial;
-static int use_screen;
-static int via_modem;
-static int xmon_use_sccb;
-static struct device_node *channel_node;
-
-void buf_access(void)
-{
-        if (DLAB)
-                sccd[3] &= ~DLAB;       /* reset DLAB */
-}
-
-extern int adb_init(void);
-
-#ifdef CONFIG_PPC_CHRP
-/*
- * This looks in the "ranges" property for the primary PCI host bridge
- * to find the physical address of the start of PCI/ISA I/O space.
- * It is basically a cut-down version of pci_process_bridge_OF_ranges.
- */
-static unsigned long chrp_find_phys_io_base(void)
-{
-        struct device_node *node;
-        unsigned int *ranges;
-        unsigned long base = CHRP_ISA_IO_BASE;
-        int rlen = 0;
-        int np;
-
-        node = find_devices("isa");
-        if (node != NULL) {
-                node = node->parent;
-                if (node == NULL || node->type == NULL
-                    || strcmp(node->type, "pci") != 0)
-                        node = NULL;
-        }
-        if (node == NULL)
-                node = find_devices("pci");
-        if (node == NULL)
-                return base;
-
-        ranges = (unsigned int *) get_property(node, "ranges", &rlen);
-        np = prom_n_addr_cells(node) + 5;
-        while ((rlen -= np * sizeof(unsigned int)) >= 0) {
-                if ((ranges[0] >> 24) == 1 && ranges[2] == 0) {
-                        /* I/O space starting at 0, grab the phys base */
-                        base = ranges[np - 3];
-                        break;
-                }
-                ranges += np;
-        }
-        return base;
-}
-#endif /* CONFIG_PPC_CHRP */
-
-void xmon_map_scc(void)
-{
-#ifdef CONFIG_PPC_MULTIPLATFORM
-        volatile unsigned char __iomem *base;
-
-        if (_machine == _MACH_Pmac) {
-                struct device_node *np;
-                unsigned long addr;
-#ifdef CONFIG_BOOTX_TEXT
-                if (!use_screen && !use_serial
-                    && !machine_is_compatible("iMac")) {
-                        /* see if there is a keyboard in the device tree
-                           with a parent of type "adb" */
-                        for (np = find_devices("keyboard"); np; np = np->next)
-                                if (np->parent && np->parent->type
-                                    && strcmp(np->parent->type, "adb") == 0)
-                                        break;
-
-                        /* needs to be hacked if xmon_printk is to be used
-                           from within find_via_pmu() */
-#ifdef CONFIG_ADB_PMU
-                        if (np != NULL && boot_text_mapped && find_via_pmu())
-                                use_screen = 1;
-#endif
-#ifdef CONFIG_ADB_CUDA
-                        if (np != NULL && boot_text_mapped && find_via_cuda())
-                                use_screen = 1;
-#endif
-                }
-                if (!use_screen && (np = find_devices("escc")) != NULL) {
-                        /*
-                         * look for the device node for the serial port
-                         * we're using and see if it says it has a modem
-                         */
-                        char *name = xmon_use_sccb? "ch-b": "ch-a";
-                        char *slots;
-                        int l;
-
-                        np = np->child;
-                        while (np != NULL && strcmp(np->name, name) != 0)
-                                np = np->sibling;
-                        if (np != NULL) {
-                                /* XXX should parse this properly */
-                                channel_node = np;
-                                slots = get_property(np, "slot-names", &l);
-                                if (slots != NULL && l >= 10
-                                    && strcmp(slots+4, "Modem") == 0)
-                                        via_modem = 1;
-                        }
-                }
-                btext_drawstring("xmon uses ");
-                if (use_screen)
-                        btext_drawstring("screen and keyboard\n");
-                else {
-                        if (via_modem)
-                                btext_drawstring("modem on ");
-                        btext_drawstring(xmon_use_sccb? "printer": "modem");
-                        btext_drawstring(" port\n");
-                }
-
-#endif /* CONFIG_BOOTX_TEXT */
-
-#ifdef CHRP_ESCC
-                addr = 0xc1013020;
-#else
-                addr = 0xf3013020;
-#endif
-                TXRDY = 4;
-                RXRDY = 1;
-        
-                np = find_devices("mac-io");
-                if (np && np->n_addrs)
-                        addr = np->addrs[0].address + 0x13020;
-                base = (volatile unsigned char *) ioremap(addr & PAGE_MASK, PAGE_SIZE);
-                sccc = base + (addr & ~PAGE_MASK);
-                sccd = sccc + 0x10;
-
-        } else {
-                base = (volatile unsigned char *) isa_io_base;
-
-#ifdef CONFIG_PPC_CHRP
-                if (_machine == _MACH_chrp)
-                        base = (volatile unsigned char __iomem *)
-                                ioremap(chrp_find_phys_io_base(), 0x1000);
-#endif
-
-                sccc = base + 0x3fd;
-                sccd = base + 0x3f8;
-                if (xmon_use_sccb) {
-                        sccc -= 0x100;
-                        sccd -= 0x100;
-                }
-                TXRDY = 0x20;
-                RXRDY = 1;
-                DLAB = 0x80;
-        }
-#elif defined(CONFIG_GEMINI)
-        /* should already be mapped by the kernel boot */
-        sccc = (volatile unsigned char __iomem *) 0xffeffb0d;
-        sccd = (volatile unsigned char __iomem *) 0xffeffb08;
-        TXRDY = 0x20;
-        RXRDY = 1;
-        DLAB = 0x80;
-#elif defined(CONFIG_405GP)
-        sccc = (volatile unsigned char __iomem *)0xef600305;
-        sccd = (volatile unsigned char __iomem *)0xef600300;
-        TXRDY = 0x20;
-        RXRDY = 1;
-        DLAB = 0x80;
-#endif /* platform */
-}
-
-static int scc_initialized = 0;
-
-void xmon_init_scc(void);
-extern void cuda_poll(void);
-
-static inline void do_poll_adb(void)
-{
-#ifdef CONFIG_ADB_PMU
-        if (sys_ctrler == SYS_CTRLER_PMU)
-                pmu_poll_adb();
-#endif /* CONFIG_ADB_PMU */
-#ifdef CONFIG_ADB_CUDA
-        if (sys_ctrler == SYS_CTRLER_CUDA)
-                cuda_poll();
-#endif /* CONFIG_ADB_CUDA */
-}
-
-int xmon_write(void *ptr, int nb)
-{
-        char *p = ptr;
-        int i, c, ct;
-
-#ifdef CONFIG_SMP
-        static unsigned long xmon_write_lock;
-        int lock_wait = 1000000;
-        int locked;
-
-        while ((locked = test_and_set_bit(0, &xmon_write_lock)) != 0)
-                if (--lock_wait == 0)
-                        break;
-#endif
-
-#ifdef CONFIG_BOOTX_TEXT
-        if (use_screen) {
-                /* write it on the screen */
-                for (i = 0; i < nb; ++i)
-                        btext_drawchar(*p++);
-                goto out;
-        }
-#endif
-        if (!scc_initialized)
-                xmon_init_scc();
-        ct = 0;
-        for (i = 0; i < nb; ++i) {
-                while ((*sccc & TXRDY) == 0)
-                        do_poll_adb();
-                c = p[i];
-                if (c == '\n' && !ct) {
-                        c = '\r';
-                        ct = 1;
-                        --i;
-                } else {
-                        ct = 0;
-                }
-                buf_access();
-                *sccd = c;
-                eieio();
-        }
-
- out:
-#ifdef CONFIG_SMP
-        if (!locked)
-                clear_bit(0, &xmon_write_lock);
-#endif
-        return nb;
-}
-
-int xmon_wants_key;
-int xmon_adb_keycode;
-
-#ifdef CONFIG_BOOTX_TEXT
-static int xmon_adb_shiftstate;
-
-static unsigned char xmon_keytab[128] =
-        "asdfhgzxcv\000bqwer"                           /* 0x00 - 0x0f */
-        "yt123465=97-80]o"                              /* 0x10 - 0x1f */
-        "u[ip\rlj'k;\\,/nm."                            /* 0x20 - 0x2f */
-        "\t `\177\0\033\0\0\0\0\0\0\0\0\0\0"            /* 0x30 - 0x3f */
-        "\0.\0*\0+\0\0\0\0\0/\r\0-\0"                   /* 0x40 - 0x4f */
-        "\0\0000123456789\0\0\0";                       /* 0x50 - 0x5f */
-
-static unsigned char xmon_shift_keytab[128] =
-        "ASDFHGZXCV\000BQWER"                           /* 0x00 - 0x0f */
-        "YT!@#$^%+(&_*)}O"                              /* 0x10 - 0x1f */
-        "U{IP\rLJ\"K:|<?NM>"                            /* 0x20 - 0x2f */
-        "\t ~\177\0\033\0\0\0\0\0\0\0\0\0\0"            /* 0x30 - 0x3f */
-        "\0.\0*\0+\0\0\0\0\0/\r\0-\0"                   /* 0x40 - 0x4f */
-        "\0\0000123456789\0\0\0";                       /* 0x50 - 0x5f */
-
-static int xmon_get_adb_key(void)
-{
-        int k, t, on;
-
-        xmon_wants_key = 1;
-        for (;;) {
-                xmon_adb_keycode = -1;
-                t = 0;
-                on = 0;
-                do {
-                        if (--t < 0) {
-                                on = 1 - on;
-                                btext_drawchar(on? 0xdb: 0x20);
-                                btext_drawchar('\b');
-                                t = 200000;
-                        }
-                        do_poll_adb();
-                } while (xmon_adb_keycode == -1);
-                k = xmon_adb_keycode;
-                if (on)
-                        btext_drawstring(" \b");
-
-                /* test for shift keys */
-                if ((k & 0x7f) == 0x38 || (k & 0x7f) == 0x7b) {
-                        xmon_adb_shiftstate = (k & 0x80) == 0;
-                        continue;
-                }
-                if (k >= 0x80)
-                        continue;       /* ignore up transitions */
-                k = (xmon_adb_shiftstate? xmon_shift_keytab: xmon_keytab)[k];
-                if (k != 0)
-                        break;
-        }
-        xmon_wants_key = 0;
-        return k;
-}
-#endif /* CONFIG_BOOTX_TEXT */
-
-int xmon_readchar(void)
-{
-#ifdef CONFIG_BOOTX_TEXT
-        if (use_screen)
-                return xmon_get_adb_key();
-#endif
-        if (!scc_initialized)
-                xmon_init_scc();
-        while ((*sccc & RXRDY) == 0)
-                do_poll_adb();
-        buf_access();
-        return *sccd;
-}
-
-int xmon_read_poll(void)
-{
-        if ((*sccc & RXRDY) == 0) {
-                do_poll_adb();
-                return -1;
-        }
-        buf_access();
-        return *sccd;
-}
-
-static unsigned char scc_inittab[] = {
-    13, 0,              /* set baud rate divisor */
-    12, 1,
-    14, 1,              /* baud rate gen enable, src=rtxc */
-    11, 0x50,           /* clocks = br gen */
-    5,  0xea,           /* tx 8 bits, assert DTR & RTS */
-    4,  0x46,           /* x16 clock, 1 stop */
-    3,  0xc1,           /* rx enable, 8 bits */
-};
-
-void xmon_init_scc(void)
-{
-        if ( _machine == _MACH_chrp )
-        {
-                sccd[3] = 0x83; eieio();        /* LCR = 8N1 + DLAB */
-                sccd[0] = 12; eieio();          /* DLL = 9600 baud */
-                sccd[1] = 0; eieio();
-                sccd[2] = 0; eieio();           /* FCR = 0 */
-                sccd[3] = 3; eieio();           /* LCR = 8N1 */
-                sccd[1] = 0; eieio();           /* IER = 0 */
-        }
-        else if ( _machine == _MACH_Pmac )
-        {
-                int i, x;
-                unsigned long timeout;
-
-                if (channel_node != 0)
-                        pmac_call_feature(
-                                PMAC_FTR_SCC_ENABLE,
-                                channel_node,
-                                PMAC_SCC_ASYNC | PMAC_SCC_FLAG_XMON, 1);
-                        printk(KERN_INFO "Serial port locked ON by debugger !\n");
-                if (via_modem && channel_node != 0) {
-                        unsigned int t0;
-
-                        pmac_call_feature(
-                                PMAC_FTR_MODEM_ENABLE,
-                                channel_node, 0, 1);
-                        printk(KERN_INFO "Modem powered up by debugger !\n");
-                        t0 = get_tbl();
-                        timeout = 3 * tb_ticks_per_sec;
-                        if (timeout == 0)
-                                /* assume 25MHz if tb_ticks_per_sec not set */
-                                timeout = 75000000;
-                        while (get_tbl() - t0 < timeout)
-                                eieio();
-                }
-                /* use the B channel if requested */
-                if (xmon_use_sccb) {
-                        sccc = (volatile unsigned char *)
-                                ((unsigned long)sccc & ~0x20);
-                        sccd = sccc + 0x10;
-                }
-                for (i = 20000; i != 0; --i) {
-                        x = *sccc; eieio();
-                }
-                *sccc = 9; eieio();             /* reset A or B side */
-                *sccc = ((unsigned long)sccc & 0x20)? 0x80: 0x40; eieio();
-                for (i = 0; i < sizeof(scc_inittab); ++i) {
-                        *sccc = scc_inittab[i];
-                        eieio();
-                }
-        }
-        scc_initialized = 1;
-        if (via_modem) {
-                for (;;) {
-                        xmon_write("ATE1V1\r", 7);
-                        if (xmon_expect("OK", 5)) {
-                                xmon_write("ATA\r", 4);
-                                if (xmon_expect("CONNECT", 40))
-                                        break;
-                        }
-                        xmon_write("+++", 3);
-                        xmon_expect("OK", 3);
-                }
-        }
-}
-
-void xmon_enter(void)
-{
-#ifdef CONFIG_ADB_PMU
-        if (_machine == _MACH_Pmac) {
-                pmu_suspend();
-        }
-#endif
-}
-
-void xmon_leave(void)
-{
-#ifdef CONFIG_ADB_PMU
-        if (_machine == _MACH_Pmac) {
-                pmu_resume();
-        }
-#endif
-}
diff --git a/arch/powerpc/xmon/start_8xx.c b/arch/powerpc/xmon/start_8xx.c
deleted file mode 100644
index 4c17b0486ad5..000000000000
--- a/arch/powerpc/xmon/start_8xx.c
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright (C) 1996 Paul Mackerras.
- * Copyright (C) 2000 Dan Malek.
- * Quick hack of Paul's code to make XMON work on 8xx processors.  Lots
- * of assumptions, like the SMC1 is used, it has been initialized by the
- * loader at some point, and we can just stuff and suck bytes.
- * We rely upon the 8xx uart driver to support us, as the interface
- * changes between boot up and operational phases of the kernel.
- */
-#include <linux/string.h>
-#include <asm/machdep.h>
-#include <asm/io.h>
-#include <asm/page.h>
-#include <linux/kernel.h>
-#include <asm/8xx_immap.h>
-#include <asm/mpc8xx.h>
-#include <asm/commproc.h>
-#include "nonstdio.h"
-
-extern int xmon_8xx_write(char *str, int nb);
-extern int xmon_8xx_read_poll(void);
-extern int xmon_8xx_read_char(void);
-
-void xmon_map_scc(void)
-{
-        cpmp = (cpm8xx_t *)&(((immap_t *)IMAP_ADDR)->im_cpm);
-}
-
-void xmon_init_scc(void);
-
-int xmon_write(void *ptr, int nb)
-{
-        return(xmon_8xx_write(ptr, nb));
-}
-
-int xmon_readchar(void)
-{
-        return xmon_8xx_read_char();
-}
-
-int xmon_read_poll(void)
-{
-        return(xmon_8xx_read_poll());
-}
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index c45a6ad5f3b7..22612ed5379c 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -450,7 +450,6 @@ int xmon_core(struct pt_regs *regs, int fromipi)
  leave:
         cpu_clear(cpu, cpus_in_xmon);
         xmon_fault_jmp[cpu] = NULL;
-
 #else
         /* UP is simple... */
         if (in_xmon) {
@@ -805,7 +804,10 @@ cmds(struct pt_regs *excp)
                         break;
                 case 'x':
                 case 'X':
+                        return cmd;
                 case EOF:
+                        printf(" <no input ...>\n");
+                        mdelay(2000);
                         return cmd;
                 case '?':
                         printf(help_string);
@@ -1011,7 +1013,7 @@ static long check_bp_loc(unsigned long addr)
         unsigned int instr;
 
         addr &= ~3;
-        if (addr < KERNELBASE) {
+        if (!is_kernel_addr(addr)) {
                 printf("Breakpoints may only be placed at kernel addresses\n");
                 return 0;
         }
@@ -1062,7 +1064,7 @@ bpt_cmds(void)
                 dabr.address = 0;
                 dabr.enabled = 0;
                 if (scanhex(&dabr.address)) {
-                        if (dabr.address < KERNELBASE) {
+                        if (!is_kernel_addr(dabr.address)) {
                                 printf(badaddr);
                                 break;
                         }