Merge ../linux-2.6

157 files changed, 5774 insertions, 1489 deletions

diff --git a/include/asm-arm/irq.h b/include/asm-arm/irq.h
index 7772432d3fd7..60b5105c9c93 100644
--- a/include/asm-arm/irq.h
+++ b/include/asm-arm/irq.h
@@ -27,7 +27,7 @@ extern void enable_irq(unsigned int);
 
 /*
  * These correspond with the SA_TRIGGER_* defines, and therefore the
- * IRQRESOURCE_IRQ_* defines.
+ * IORESOURCE_IRQ_* defines.
  */
 #define __IRQT_RISEDGE  (1 << 0)
 #define __IRQT_FALEDGE  (1 << 1)
diff --git a/include/asm-arm/system.h b/include/asm-arm/system.h
index eb2de8c10515..ec91d1ff032a 100644
--- a/include/asm-arm/system.h
+++ b/include/asm-arm/system.h
@@ -415,6 +415,9 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, int size
         return ret;
 }
 
+extern void disable_hlt(void);
+extern void enable_hlt(void);
+
 #endif /* __ASSEMBLY__ */
 
 #define arch_align_stack(x) (x)
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 35de20cf8fac..9d11550b4818 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -58,6 +58,13 @@
                 VMLINUX_SYMBOL(__stop___ksymtab_gpl) = .;               \
         }                                                               \
                                                                         \
+        /* Kernel symbol table: GPL-future-only symbols */              \
+        __ksymtab_gpl_future : AT(ADDR(__ksymtab_gpl_future) - LOAD_OFFSET) { \
+                VMLINUX_SYMBOL(__start___ksymtab_gpl_future) = .;       \
+                *(__ksymtab_gpl_future)                                 \
+                VMLINUX_SYMBOL(__stop___ksymtab_gpl_future) = .;        \
+        }                                                               \
+                                                                        \
         /* Kernel symbol table: Normal symbols */                       \
         __kcrctab         : AT(ADDR(__kcrctab) - LOAD_OFFSET) {         \
                 VMLINUX_SYMBOL(__start___kcrctab) = .;                  \
@@ -72,6 +79,13 @@
                 VMLINUX_SYMBOL(__stop___kcrctab_gpl) = .;               \
         }                                                               \
                                                                         \
+        /* Kernel symbol table: GPL-future-only symbols */              \
+        __kcrctab_gpl_future : AT(ADDR(__kcrctab_gpl_future) - LOAD_OFFSET) { \
+                VMLINUX_SYMBOL(__start___kcrctab_gpl_future) = .;       \
+                *(__kcrctab_gpl_future)                                 \
+                VMLINUX_SYMBOL(__stop___kcrctab_gpl_future) = .;        \
+        }                                                               \
+                                                                        \
         /* Kernel symbol table: strings */                              \
         __ksymtab_strings : AT(ADDR(__ksymtab_strings) - LOAD_OFFSET) { \
                 *(__ksymtab_strings)                                    \
diff --git a/include/asm-mips/byteorder.h b/include/asm-mips/byteorder.h
index 584f8128fffd..aefc02f16fd8 100644
--- a/include/asm-mips/byteorder.h
+++ b/include/asm-mips/byteorder.h
@@ -39,6 +39,24 @@ static __inline__ __attribute_const__ __u32 ___arch__swab32(__u32 x)
 }
 #define __arch__swab32(x)       ___arch__swab32(x)
 
+#ifdef CONFIG_CPU_MIPS64_R2
+
+static __inline__ __attribute_const__ __u64 ___arch__swab64(__u64 x)
+{
+        __asm__(
+        "       dsbh    %0, %1                  \n"
+        "       dshd    %0, %0                  \n"
+        "       drotr   %0, %0, 32              \n"
+        : "=r" (x)
+        : "r" (x));
+
+        return x;
+}
+
+#define __arch__swab64(x)       ___arch__swab64(x)
+
+#endif /* CONFIG_CPU_MIPS64_R2 */
+
 #endif /* CONFIG_CPU_MIPSR2 */
 
 #if !defined(__STRICT_ANSI__) || defined(__KERNEL__)
diff --git a/include/asm-mips/compat.h b/include/asm-mips/compat.h
index 35d2604fe69c..0012bd804d2d 100644
--- a/include/asm-mips/compat.h
+++ b/include/asm-mips/compat.h
@@ -128,17 +128,17 @@ typedef u32		compat_sigset_word;
  */
 typedef u32             compat_uptr_t;
 
-static inline void *compat_ptr(compat_uptr_t uptr)
+static inline void __user *compat_ptr(compat_uptr_t uptr)
 {
-        return (void *)(long)uptr;
+        return (void __user *)(long)uptr;
 }
 
-static inline void *compat_alloc_user_space(long len)
+static inline void __user *compat_alloc_user_space(long len)
 {
         struct pt_regs *regs = (struct pt_regs *)
                 ((unsigned long) current_thread_info() + THREAD_SIZE - 32) - 1;
 
-        return (void *) (regs->regs[29] - len);
+        return (void __user *) (regs->regs[29] - len);
 }
 #if defined (__MIPSEL__)
 #define __COMPAT_ENDIAN_SWAP__  1
diff --git a/include/asm-mips/cpu-features.h b/include/asm-mips/cpu-features.h
index 78c9cc2735d5..3f2b6d9ac45e 100644
--- a/include/asm-mips/cpu-features.h
+++ b/include/asm-mips/cpu-features.h
@@ -96,6 +96,9 @@
 #ifndef cpu_has_ic_fills_f_dc
 #define cpu_has_ic_fills_f_dc   (cpu_data[0].icache.flags & MIPS_CACHE_IC_F_DC)
 #endif
+#ifndef cpu_has_pindexed_dcache
+#define cpu_has_pindexed_dcache (cpu_data[0].dcache.flags & MIPS_CACHE_PINDEX)
+#endif
 
 /*
  * I-Cache snoops remote store.  This only matters on SMP.  Some multiprocessors
diff --git a/include/asm-mips/cpu-info.h b/include/asm-mips/cpu-info.h
index d5cf519f8fcc..140be1c67da7 100644
--- a/include/asm-mips/cpu-info.h
+++ b/include/asm-mips/cpu-info.h
@@ -39,6 +39,7 @@ struct cache_desc {
 #define MIPS_CACHE_ALIASES      0x00000004      /* Cache could have aliases */
 #define MIPS_CACHE_IC_F_DC      0x00000008      /* Ic can refill from D-cache */
 #define MIPS_IC_SNOOPS_REMOTE   0x00000010      /* Ic snoops remote stores */
+#define MIPS_CACHE_PINDEX       0x00000020      /* Physically indexed cache */
 
 struct cpuinfo_mips {
         unsigned long           udelay_val;
diff --git a/include/asm-mips/hazards.h b/include/asm-mips/hazards.h
index 6111a0ce58c4..feb29a793888 100644
--- a/include/asm-mips/hazards.h
+++ b/include/asm-mips/hazards.h
@@ -3,7 +3,9 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2003, 2004 Ralf Baechle
+ * Copyright (C) 2003, 2004 Ralf Baechle <ralf@linux-mips.org>
+ * Copyright (C) MIPS Technologies, Inc.
+ *   written by Ralf Baechle <ralf@linux-mips.org>
  */
 #ifndef _ASM_HAZARDS_H
 #define _ASM_HAZARDS_H
@@ -74,8 +76,7 @@
 #define irq_disable_hazard
         _ehb
 
-#elif defined(CONFIG_CPU_R10000) || defined(CONFIG_CPU_RM9000) || \
-      defined(CONFIG_CPU_SB1)
+#elif defined(CONFIG_CPU_R10000) || defined(CONFIG_CPU_RM9000)
 
 /*
  * R10000 rocks - all hazards handled in hardware, so this becomes a nobrainer.
@@ -99,13 +100,13 @@
 #else /* __ASSEMBLY__ */
 
 __asm__(
-        "       .macro  _ssnop                                  \n\t"
-        "       sll     $0, $0, 1                               \n\t"
-        "       .endm                                           \n\t"
-        "                                                       \n\t"
-        "       .macro  _ehb                                    \n\t"
-        "       sll     $0, $0, 3                               \n\t"
-        "       .endm                                           \n\t");
+        "       .macro  _ssnop                                  \n"
+        "       sll     $0, $0, 1                               \n"
+        "       .endm                                           \n"
+        "                                                       \n"
+        "       .macro  _ehb                                    \n"
+        "       sll     $0, $0, 3                               \n"
+        "       .endm                                           \n");
 
 #ifdef CONFIG_CPU_RM9000
 
@@ -117,17 +118,21 @@ __asm__(
 
 #define mtc0_tlbw_hazard()                                              \
         __asm__ __volatile__(                                           \
-                ".set\tmips32\n\t"                                      \
-                "_ssnop; _ssnop; _ssnop; _ssnop\n\t"                    \
-                ".set\tmips0")
+        "       .set    mips32                                  \n"     \
+        "       _ssnop                                          \n"     \
+        "       _ssnop                                          \n"     \
+        "       _ssnop                                          \n"     \
+        "       _ssnop                                          \n"     \
+        "       .set    mips0                                   \n")
 
 #define tlbw_use_hazard()                                               \
         __asm__ __volatile__(                                           \
-                ".set\tmips32\n\t"                                      \
-                "_ssnop; _ssnop; _ssnop; _ssnop\n\t"                    \
-                ".set\tmips0")
-
-#define back_to_back_c0_hazard()        do { } while (0)
+        "       .set    mips32                                  \n"     \
+        "       _ssnop                                          \n"     \
+        "       _ssnop                                          \n"     \
+        "       _ssnop                                          \n"     \
+        "       _ssnop                                          \n"     \
+        "       .set    mips0                                   \n")
 
 #else
 
@@ -136,15 +141,25 @@ __asm__(
  */
 #define mtc0_tlbw_hazard()                                              \
         __asm__ __volatile__(                                           \
-                ".set noreorder\n\t"                                    \
-                "nop; nop; nop; nop; nop; nop;\n\t"                     \
-                ".set reorder\n\t")
+        "       .set    noreorder                               \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       .set    reorder                                 \n")
 
 #define tlbw_use_hazard()                                               \
         __asm__ __volatile__(                                           \
-                ".set noreorder\n\t"                                    \
-                "nop; nop; nop; nop; nop; nop;\n\t"                     \
-                ".set reorder\n\t")
+        "       .set    noreorder                               \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       .set    reorder                                 \n")
 
 #endif
 
@@ -156,49 +171,26 @@ __asm__(
 
 #ifdef CONFIG_CPU_MIPSR2
 
-__asm__(
-        "       .macro\tirq_enable_hazard                       \n\t"
-        "       _ehb                                            \n\t"
-        "       .endm                                           \n\t"
-        "                                                       \n\t"
-        "       .macro\tirq_disable_hazard                      \n\t"
-        "       _ehb                                            \n\t"
-        "       .endm                                           \n\t"
-        "                                                       \n\t"
-        "       .macro\tback_to_back_c0_hazard                  \n\t"
-        "       _ehb                                            \n\t"
-        "       .endm");
-
-#define irq_enable_hazard()                                             \
-        __asm__ __volatile__(                                           \
-        "irq_enable_hazard")
+__asm__("       .macro  irq_enable_hazard                       \n"
+        "       _ehb                                            \n"
+        "       .endm                                           \n"
+        "                                                       \n"
+        "       .macro  irq_disable_hazard                      \n"
+        "       _ehb                                            \n"
+        "       .endm                                           \n");
 
-#define irq_disable_hazard()                                            \
-        __asm__ __volatile__(                                           \
-        "irq_disable_hazard")
-
-#define back_to_back_c0_hazard()                                        \
-        __asm__ __volatile__(                                           \
-        "back_to_back_c0_hazard")
-
-#elif defined(CONFIG_CPU_R10000) || defined(CONFIG_CPU_RM9000) || \
-      defined(CONFIG_CPU_SB1)
+#elif defined(CONFIG_CPU_R10000) || defined(CONFIG_CPU_RM9000)
 
 /*
  * R10000 rocks - all hazards handled in hardware, so this becomes a nobrainer.
  */
 
 __asm__(
-        "       .macro\tirq_enable_hazard                       \n\t"
-        "       .endm                                           \n\t"
-        "                                                       \n\t"
-        "       .macro\tirq_disable_hazard                      \n\t"
-        "       .endm");
-
-#define irq_enable_hazard()     do { } while (0)
-#define irq_disable_hazard()    do { } while (0)
-
-#define back_to_back_c0_hazard()        do { } while (0)
+        "       .macro  irq_enable_hazard                       \n"
+        "       .endm                                           \n"
+        "                                                       \n"
+        "       .macro  irq_disable_hazard                      \n"
+        "       .endm                                           \n");
 
 #else
 
@@ -209,29 +201,63 @@ __asm__(
  */
 
 __asm__(
-        "       #                                               \n\t"
-        "       # There is a hazard but we do not care          \n\t"
-        "       #                                               \n\t"
-        "       .macro\tirq_enable_hazard                       \n\t"
-        "       .endm                                           \n\t"
-        "                                                       \n\t"
-        "       .macro\tirq_disable_hazard                      \n\t"
-        "       _ssnop; _ssnop; _ssnop                          \n\t"
-        "       .endm");
+        "       #                                               \n"
+        "       # There is a hazard but we do not care          \n"
+        "       #                                               \n"
+        "       .macro\tirq_enable_hazard                       \n"
+        "       .endm                                           \n"
+        "                                                       \n"
+        "       .macro\tirq_disable_hazard                      \n"
+        "       _ssnop                                          \n"
+        "       _ssnop                                          \n"
+        "       _ssnop                                          \n"
+        "       .endm                                           \n");
 
-#define irq_enable_hazard()     do { } while (0)
+#endif
+
+#define irq_enable_hazard()                                             \
+        __asm__ __volatile__("irq_enable_hazard")
 #define irq_disable_hazard()                                            \
-        __asm__ __volatile__(                                           \
-        "irq_disable_hazard")
+        __asm__ __volatile__("irq_disable_hazard")
 
-#define back_to_back_c0_hazard()                                        \
-        __asm__ __volatile__(                                           \
-        "       .set noreorder                          \n"             \
-        "       nop; nop; nop                           \n"             \
-        "       .set reorder                            \n")
+
+/*
+ * Back-to-back hazards -
+ *
+ * What is needed to separate a move to cp0 from a subsequent read from the
+ * same cp0 register?
+ */
+#ifdef CONFIG_CPU_MIPSR2
+
+__asm__("       .macro  back_to_back_c0_hazard                  \n"
+        "       _ehb                                            \n"
+        "       .endm                                           \n");
+
+#elif defined(CONFIG_CPU_R10000) || defined(CONFIG_CPU_RM9000) || \
+      defined(CONFIG_CPU_SB1)
+
+__asm__("       .macro  back_to_back_c0_hazard                  \n"
+        "       .endm                                           \n");
+
+#else
+
+__asm__("       .macro  back_to_back_c0_hazard                  \n"
+        "       .set    noreorder                               \n"
+        "       _ssnop                                          \n"
+        "       _ssnop                                          \n"
+        "       _ssnop                                          \n"
+        "       .set    reorder                                 \n"
+        "       .endm");
 
 #endif
 
+#define back_to_back_c0_hazard()                                        \
+        __asm__ __volatile__("back_to_back_c0_hazard")
+
+
+/*
+ * Instruction execution hazard
+ */
 #ifdef CONFIG_CPU_MIPSR2
 /*
  * gcc has a tradition of misscompiling the previous construct using the
diff --git a/include/asm-mips/io.h b/include/asm-mips/io.h
index 8c011aa61afa..546a17e56a9b 100644
--- a/include/asm-mips/io.h
+++ b/include/asm-mips/io.h
@@ -4,7 +4,7 @@
  * for more details.
  *
  * Copyright (C) 1994, 1995 Waldorf GmbH
- * Copyright (C) 1994 - 2000 Ralf Baechle
+ * Copyright (C) 1994 - 2000, 06 Ralf Baechle
  * Copyright (C) 1999, 2000 Silicon Graphics, Inc.
  * Copyright (C) 2004, 2005  MIPS Technologies, Inc.  All rights reserved.
  *      Author: Maciej W. Rozycki <macro@mips.com>
@@ -40,56 +40,13 @@
  * hardware.  An example use would be for flash memory that's used for
  * execute in place.
  */
-# define __raw_ioswabb(x)       (x)
-# define __raw_ioswabw(x)       (x)
-# define __raw_ioswabl(x)       (x)
-# define __raw_ioswabq(x)       (x)
-# define ____raw_ioswabq(x)     (x)
+# define __raw_ioswabb(a,x)     (x)
+# define __raw_ioswabw(a,x)     (x)
+# define __raw_ioswabl(a,x)     (x)
+# define __raw_ioswabq(a,x)     (x)
+# define ____raw_ioswabq(a,x)   (x)
 
-/*
- * Sane hardware offers swapping of PCI/ISA I/O space accesses in hardware;
- * less sane hardware forces software to fiddle with this...
- *
- * Regardless, if the host bus endianness mismatches that of PCI/ISA, then
- * you can't have the numerical value of data and byte addresses within
- * multibyte quantities both preserved at the same time.  Hence two
- * variations of functions: non-prefixed ones that preserve the value
- * and prefixed ones that preserve byte addresses.  The latters are
- * typically used for moving raw data between a peripheral and memory (cf.
- * string I/O functions), hence the "__mem_" prefix.
- */
-#if defined(CONFIG_SWAP_IO_SPACE)
-
-# define ioswabb(x)             (x)
-# define __mem_ioswabb(x)       (x)
-# ifdef CONFIG_SGI_IP22
-/*
- * IP22 seems braindead enough to swap 16bits values in hardware, but
- * not 32bits.  Go figure... Can't tell without documentation.
- */
-#  define ioswabw(x)            (x)
-#  define __mem_ioswabw(x)      le16_to_cpu(x)
-# else
-#  define ioswabw(x)            le16_to_cpu(x)
-#  define __mem_ioswabw(x)      (x)
-# endif
-# define ioswabl(x)             le32_to_cpu(x)
-# define __mem_ioswabl(x)       (x)
-# define ioswabq(x)             le64_to_cpu(x)
-# define __mem_ioswabq(x)       (x)
-
-#else
-
-# define ioswabb(x)             (x)
-# define __mem_ioswabb(x)       (x)
-# define ioswabw(x)             (x)
-# define __mem_ioswabw(x)       cpu_to_le16(x)
-# define ioswabl(x)             (x)
-# define __mem_ioswabl(x)       cpu_to_le32(x)
-# define ioswabq(x)             (x)
-# define __mem_ioswabq(x)       cpu_to_le32(x)
-
-#endif
+/* ioswab[bwlq], __mem_ioswab[bwlq] are defined in mangle-port.h */
 
 #define IO_SPACE_LIMIT 0xffff
 
@@ -103,8 +60,20 @@
  */
 extern const unsigned long mips_io_port_base;
 
-#define set_io_port_base(base)  \
-        do { * (unsigned long *) &mips_io_port_base = (base); } while (0)
+/*
+ * Gcc will generate code to load the value of mips_io_port_base after each
+ * function call which may be fairly wasteful in some cases.  So we don't
+ * play quite by the book.  We tell gcc mips_io_port_base is a long variable
+ * which solves the code generation issue.  Now we need to violate the
+ * aliasing rules a little to make initialization possible and finally we
+ * will need the barrier() to fight side effects of the aliasing chat.
+ * This trickery will eventually collapse under gcc's optimizer.  Oh well.
+ */
+static inline void set_io_port_base(unsigned long base)
+{
+        * (unsigned long *) &mips_io_port_base = base;
+        barrier();
+}
 
 /*
  * Thanks to James van Artsdalen for a better timing-fix than
@@ -334,7 +303,7 @@ static inline void pfx##write##bwlq(type val,				\
                                                                         \
         __mem = (void *)__swizzle_addr_##bwlq((unsigned long)(mem));    \
                                                                         \
-        __val = pfx##ioswab##bwlq(val);                                 \
+        __val = pfx##ioswab##bwlq(__mem, val);                          \
                                                                         \
         if (sizeof(type) != sizeof(u64) || sizeof(u64) == sizeof(long)) \
                 *__mem = __val;                                         \
@@ -389,7 +358,7 @@ static inline type pfx##read##bwlq(const volatile void __iomem *mem)	\
                 BUG();                                                  \
         }                                                               \
                                                                         \
-        return pfx##ioswab##bwlq(__val);                                \
+        return pfx##ioswab##bwlq(__mem, __val);                         \
 }
 
 #define __BUILD_IOPORT_SINGLE(pfx, bwlq, type, p, slow)                 \
@@ -399,10 +368,9 @@ static inline void pfx##out##bwlq##p(type val, unsigned long port)	\
         volatile type *__addr;                                          \
         type __val;                                                     \
                                                                         \
-        port = __swizzle_addr_##bwlq(port);                             \
-        __addr = (void *)(mips_io_port_base + port);                    \
+        __addr = (void *)__swizzle_addr_##bwlq(mips_io_port_base + port); \
                                                                         \
-        __val = pfx##ioswab##bwlq(val);                                 \
+        __val = pfx##ioswab##bwlq(__addr, val);                         \
                                                                         \
         /* Really, we want this to be atomic */                         \
         BUILD_BUG_ON(sizeof(type) > sizeof(unsigned long));             \
@@ -416,15 +384,14 @@ static inline type pfx##in##bwlq##p(unsigned long port)			\
         volatile type *__addr;                                          \
         type __val;                                                     \
                                                                         \
-        port = __swizzle_addr_##bwlq(port);                             \
-        __addr = (void *)(mips_io_port_base + port);                    \
+        __addr = (void *)__swizzle_addr_##bwlq(mips_io_port_base + port); \
                                                                         \
         BUILD_BUG_ON(sizeof(type) > sizeof(unsigned long));             \
                                                                         \
         __val = *__addr;                                                \
         slow;                                                           \
                                                                         \
-        return pfx##ioswab##bwlq(__val);                                \
+        return pfx##ioswab##bwlq(__addr, __val);                        \
 }
 
 #define __BUILD_MEMORY_PFX(bus, bwlq, type)                             \
diff --git a/include/asm-mips/mach-cobalt/cobalt.h b/include/asm-mips/mach-cobalt/cobalt.h
index 78e1df2095fb..b3c5ecbec03c 100644
--- a/include/asm-mips/mach-cobalt/cobalt.h
+++ b/include/asm-mips/mach-cobalt/cobalt.h
@@ -113,4 +113,6 @@ do {									\
 # define COBALT_KEY_SELECT      (1 << 7)
 # define COBALT_KEY_MASK        0xfe
 
+#define COBALT_UART             ((volatile unsigned char *) CKSEG1ADDR(0x1c800000))
+
 #endif /* __ASM_COBALT_H */
diff --git a/include/asm-mips/mach-generic/mangle-port.h b/include/asm-mips/mach-generic/mangle-port.h
index 4a98d83b8ec7..6e1b0c075de7 100644
--- a/include/asm-mips/mach-generic/mangle-port.h
+++ b/include/asm-mips/mach-generic/mangle-port.h
@@ -13,4 +13,40 @@
 #define __swizzle_addr_l(port)  (port)
 #define __swizzle_addr_q(port)  (port)
 
+/*
+ * Sane hardware offers swapping of PCI/ISA I/O space accesses in hardware;
+ * less sane hardware forces software to fiddle with this...
+ *
+ * Regardless, if the host bus endianness mismatches that of PCI/ISA, then
+ * you can't have the numerical value of data and byte addresses within
+ * multibyte quantities both preserved at the same time.  Hence two
+ * variations of functions: non-prefixed ones that preserve the value
+ * and prefixed ones that preserve byte addresses.  The latters are
+ * typically used for moving raw data between a peripheral and memory (cf.
+ * string I/O functions), hence the "__mem_" prefix.
+ */
+#if defined(CONFIG_SWAP_IO_SPACE)
+
+# define ioswabb(a,x)           (x)
+# define __mem_ioswabb(a,x)     (x)
+# define ioswabw(a,x)           le16_to_cpu(x)
+# define __mem_ioswabw(a,x)     (x)
+# define ioswabl(a,x)           le32_to_cpu(x)
+# define __mem_ioswabl(a,x)     (x)
+# define ioswabq(a,x)           le64_to_cpu(x)
+# define __mem_ioswabq(a,x)     (x)
+
+#else
+
+# define ioswabb(a,x)           (x)
+# define __mem_ioswabb(a,x)     (x)
+# define ioswabw(a,x)           (x)
+# define __mem_ioswabw(a,x)     cpu_to_le16(x)
+# define ioswabl(a,x)           (x)
+# define __mem_ioswabl(a,x)     cpu_to_le32(x)
+# define ioswabq(a,x)           (x)
+# define __mem_ioswabq(a,x)     cpu_to_le32(x)
+
+#endif
+
 #endif /* __ASM_MACH_GENERIC_MANGLE_PORT_H */
diff --git a/include/asm-mips/mach-ip27/mangle-port.h b/include/asm-mips/mach-ip27/mangle-port.h
index f76c44880451..d615312a451a 100644
--- a/include/asm-mips/mach-ip27/mangle-port.h
+++ b/include/asm-mips/mach-ip27/mangle-port.h
@@ -13,4 +13,13 @@
 #define __swizzle_addr_l(port)  (port)
 #define __swizzle_addr_q(port)  (port)
 
+# define ioswabb(a,x)           (x)
+# define __mem_ioswabb(a,x)     (x)
+# define ioswabw(a,x)           (x)
+# define __mem_ioswabw(a,x)     cpu_to_le16(x)
+# define ioswabl(a,x)           (x)
+# define __mem_ioswabl(a,x)     cpu_to_le32(x)
+# define ioswabq(a,x)           (x)
+# define __mem_ioswabq(a,x)     cpu_to_le32(x)
+
 #endif /* __ASM_MACH_IP27_MANGLE_PORT_H */
diff --git a/include/asm-mips/mach-ip32/mangle-port.h b/include/asm-mips/mach-ip32/mangle-port.h
index 6e25b52ed8f2..81320eb55324 100644
--- a/include/asm-mips/mach-ip32/mangle-port.h
+++ b/include/asm-mips/mach-ip32/mangle-port.h
@@ -14,4 +14,13 @@
 #define __swizzle_addr_l(port)  (port)
 #define __swizzle_addr_q(port)  (port)
 
+# define ioswabb(a,x)           (x)
+# define __mem_ioswabb(a,x)     (x)
+# define ioswabw(a,x)           (x)
+# define __mem_ioswabw(a,x)     cpu_to_le16(x)
+# define ioswabl(a,x)           (x)
+# define __mem_ioswabl(a,x)     cpu_to_le32(x)
+# define ioswabq(a,x)           (x)
+# define __mem_ioswabq(a,x)     cpu_to_le32(x)
+
 #endif /* __ASM_MACH_IP32_MANGLE_PORT_H */
diff --git a/include/asm-mips/mach-mips/cpu-feature-overrides.h b/include/asm-mips/mach-mips/cpu-feature-overrides.h
index 9f92aed17754..e06af6c86f86 100644
--- a/include/asm-mips/mach-mips/cpu-feature-overrides.h
+++ b/include/asm-mips/mach-mips/cpu-feature-overrides.h
@@ -29,7 +29,11 @@
 /* #define cpu_has_prefetch     ? */
 #define cpu_has_mcheck          1
 /* #define cpu_has_ejtag        ? */
+#ifdef CONFIG_CPU_HAS_LLSC
 #define cpu_has_llsc            1
+#else
+#define cpu_has_llsc            0
+#endif
 /* #define cpu_has_vtag_icache  ? */
 /* #define cpu_has_dc_aliases   ? */
 /* #define cpu_has_ic_fills_f_dc ? */
diff --git a/include/asm-mips/mmu_context.h b/include/asm-mips/mmu_context.h
index 19cdf7642e66..61cf22588137 100644
--- a/include/asm-mips/mmu_context.h
+++ b/include/asm-mips/mmu_context.h
@@ -33,12 +33,7 @@ extern unsigned long pgd_current[];
         write_c0_context((unsigned long) smp_processor_id() << 25);     \
         TLBMISS_HANDLER_SETUP_PGD(swapper_pg_dir)
 #endif
-#if defined(CONFIG_64BIT) && !defined(CONFIG_BUILD_ELF64)
-#define TLBMISS_HANDLER_SETUP()                                         \
-        write_c0_context((unsigned long) &pgd_current[smp_processor_id()] << 23); \
-        TLBMISS_HANDLER_SETUP_PGD(swapper_pg_dir)
-#endif
-#if defined(CONFIG_64BIT) && defined(CONFIG_BUILD_ELF64)
+#ifdef CONFIG_64BIT
 #define TLBMISS_HANDLER_SETUP()                                         \
         write_c0_context((unsigned long) smp_processor_id() << 26);     \
         TLBMISS_HANDLER_SETUP_PGD(swapper_pg_dir)
diff --git a/include/asm-mips/pgtable-32.h b/include/asm-mips/pgtable-32.h
index 0cff64ce0fb8..4d6bc45df594 100644
--- a/include/asm-mips/pgtable-32.h
+++ b/include/asm-mips/pgtable-32.h
@@ -206,7 +206,7 @@ pfn_pte(unsigned long pfn, pgprot_t prot)
         /* fixme */
 #define pte_to_pgoff(_pte) (((_pte).pte_high >> 6) + ((_pte).pte_high & 0x3f))
 #define pgoff_to_pte(off) \
-        ((pte_t){(((off) & 0x3f) + ((off) << 6) + _PAGE_FILE)})
+        ((pte_t){(((off) & 0x3f) + ((off) << 6) + _PAGE_FILE)})
 
 #else
 #define pte_to_pgoff(_pte) \
diff --git a/include/asm-mips/r4kcache.h b/include/asm-mips/r4kcache.h
index 9632c27dad15..90c374700977 100644
--- a/include/asm-mips/r4kcache.h
+++ b/include/asm-mips/r4kcache.h
@@ -257,7 +257,8 @@ static inline void blast_##pfx##cache##lsize##_page(unsigned long page)	\
                                                                         \
 static inline void blast_##pfx##cache##lsize##_page_indexed(unsigned long page) \
 {                                                                       \
-        unsigned long start = page;                                     \
+        unsigned long indexmask = current_cpu_data.desc.waysize - 1;    \
+        unsigned long start = INDEX_BASE + (page & indexmask);          \
         unsigned long end = start + PAGE_SIZE;                          \
         unsigned long ws_inc = 1UL << current_cpu_data.desc.waybit;     \
         unsigned long ws_end = current_cpu_data.desc.ways <<            \
@@ -302,5 +303,6 @@ __BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, )
 __BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, )
 /* blast_inv_dcache_range */
 __BUILD_BLAST_CACHE_RANGE(inv_d, dcache, Hit_Invalidate_D, )
+__BUILD_BLAST_CACHE_RANGE(inv_s, scache, Hit_Invalidate_SD, )
 
 #endif /* _ASM_R4KCACHE_H */
diff --git a/include/asm-mips/sibyte/sb1250.h b/include/asm-mips/sibyte/sb1250.h
index a474c29cd701..b09e16c93ca0 100644
--- a/include/asm-mips/sibyte/sb1250.h
+++ b/include/asm-mips/sibyte/sb1250.h
@@ -45,8 +45,8 @@ extern unsigned int soc_type;
 extern unsigned int periph_rev;
 extern unsigned int zbbus_mhz;
 
+extern void sb1250_hpt_setup(void);
 extern void sb1250_time_init(void);
-extern unsigned long sb1250_gettimeoffset(void);
 extern void sb1250_mask_irq(int cpu, int irq);
 extern void sb1250_unmask_irq(int cpu, int irq);
 extern void sb1250_smp_finish(void);
diff --git a/include/asm-mips/sibyte/sb1250_scd.h b/include/asm-mips/sibyte/sb1250_scd.h
index a667bc14a7cd..f4178bdcfcb0 100644
--- a/include/asm-mips/sibyte/sb1250_scd.h
+++ b/include/asm-mips/sibyte/sb1250_scd.h
@@ -359,14 +359,15 @@
  */
 
 #define V_SCD_TIMER_FREQ            1000000
+#define V_SCD_TIMER_WIDTH           23
 
 #define S_SCD_TIMER_INIT            0
-#define M_SCD_TIMER_INIT            _SB_MAKEMASK(20,S_SCD_TIMER_INIT)
+#define M_SCD_TIMER_INIT            _SB_MAKEMASK(V_SCD_TIMER_WIDTH,S_SCD_TIMER_INIT)
 #define V_SCD_TIMER_INIT(x)         _SB_MAKEVALUE(x,S_SCD_TIMER_INIT)
 #define G_SCD_TIMER_INIT(x)         _SB_GETVALUE(x,S_SCD_TIMER_INIT,M_SCD_TIMER_INIT)
 
 #define S_SCD_TIMER_CNT             0
-#define M_SCD_TIMER_CNT             _SB_MAKEMASK(20,S_SCD_TIMER_CNT)
+#define M_SCD_TIMER_CNT             _SB_MAKEMASK(V_SCD_TIMER_WIDTH,S_SCD_TIMER_CNT)
 #define V_SCD_TIMER_CNT(x)         _SB_MAKEVALUE(x,S_SCD_TIMER_CNT)
 #define G_SCD_TIMER_CNT(x)         _SB_GETVALUE(x,S_SCD_TIMER_CNT,M_SCD_TIMER_CNT)
 
diff --git a/include/asm-mips/signal.h b/include/asm-mips/signal.h
index 6fe903e09c62..d8349e4b55ee 100644
--- a/include/asm-mips/signal.h
+++ b/include/asm-mips/signal.h
@@ -147,16 +147,34 @@ struct k_sigaction {
 
 /* IRIX compatible stack_t  */
 typedef struct sigaltstack {
-        void *ss_sp;
+        void __user *ss_sp;
         size_t ss_size;
         int ss_flags;
 } stack_t;
 
 #ifdef __KERNEL__
 #include <asm/sigcontext.h>
+#include <asm/siginfo.h>
 
 #define ptrace_signal_deliver(regs, cookie) do { } while (0)
 
+struct pt_regs;
+extern void do_signal(struct pt_regs *regs);
+extern void do_signal32(struct pt_regs *regs);
+
+extern int setup_frame(struct k_sigaction * ka, struct pt_regs *regs,
+        int signr, sigset_t *set);
+extern int setup_rt_frame(struct k_sigaction * ka, struct pt_regs *regs,
+        int signr, sigset_t *set, siginfo_t *info);
+
+extern int setup_frame_32(struct k_sigaction * ka, struct pt_regs *regs,
+        int signr, sigset_t *set);
+extern int setup_rt_frame_32(struct k_sigaction * ka, struct pt_regs *regs,
+        int signr, sigset_t *set, siginfo_t *info);
+
+extern int setup_rt_frame_n32(struct k_sigaction * ka, struct pt_regs *regs,
+        int signr, sigset_t *set, siginfo_t *info);
+
 #endif /* __KERNEL__ */
 
 #endif /* _ASM_SIGNAL_H */
diff --git a/include/asm-mips/sn/klconfig.h b/include/asm-mips/sn/klconfig.h
index d028e28d6239..9709ff701d9b 100644
--- a/include/asm-mips/sn/klconfig.h
+++ b/include/asm-mips/sn/klconfig.h
@@ -99,7 +99,7 @@ typedef s32 klconf_off_t;
 #define ENABLE_BOARD            0x01
 #define FAILED_BOARD            0x02
 #define DUPLICATE_BOARD         0x04    /* Boards like midplanes/routers which
-                                           are discovered twice. Use one of them */
+                                           are discovered twice. Use one of them */
 #define VISITED_BOARD           0x08    /* Used for compact hub numbering. */
 #define LOCAL_MASTER_IO6        0x10    /* master io6 for that node */
 #define GLOBAL_MASTER_IO6       0x20
diff --git a/include/asm-mips/sn/mapped_kernel.h b/include/asm-mips/sn/mapped_kernel.h
index 3a17846df849..59edb20f8ec5 100644
--- a/include/asm-mips/sn/mapped_kernel.h
+++ b/include/asm-mips/sn/mapped_kernel.h
@@ -23,11 +23,7 @@
 #include <linux/config.h>
 #include <asm/addrspace.h>
 
-#ifdef CONFIG_BUILD_ELF64
 #define REP_BASE        CAC_BASE
-#else
-#define REP_BASE        CKSEG0
-#endif
 
 #ifdef CONFIG_MAPPED_KERNEL
 
diff --git a/include/asm-mips/sn/sn0/hubio.h b/include/asm-mips/sn/sn0/hubio.h
index 80cf6a52ed3b..f314da21b970 100644
--- a/include/asm-mips/sn/sn0/hubio.h
+++ b/include/asm-mips/sn/sn0/hubio.h
@@ -229,7 +229,7 @@ typedef union hubii_ilcsr_u {
                         icsr_llp_en:     1,     /* LLP enable bit */
                         icsr_rsvd2:      1,     /* reserver */
                         icsr_wrm_reset:  1,     /* Warm reset bit */
-                        icsr_rsvd1:      2,     /* Data ready offset */
+                        icsr_rsvd1:      2,     /* Data ready offset */
                         icsr_null_to:    6;     /* Null timeout   */
 
         } icsr_fields_s;
@@ -274,9 +274,9 @@ typedef union io_perf_sel {
         u64 perf_sel_reg;
         struct {
                 u64     perf_rsvd  : 48,
-                        perf_icct  :  8,
-                        perf_ippr1 :  4,
-                        perf_ippr0 :  4;
+                        perf_icct  :  8,
+                        perf_ippr1 :  4,
+                        perf_ippr0 :  4;
         } perf_sel_bits;
 } io_perf_sel_t;
 
@@ -287,8 +287,8 @@ typedef union io_perf_cnt {
         u64     perf_cnt;
         struct {
                 u64     perf_rsvd1 : 32,
-                                perf_rsvd2 : 12,
-                                perf_cnt   : 20;
+                        perf_rsvd2 : 12,
+                        perf_cnt   : 20;
         } perf_cnt_bits;
 } io_perf_cnt_t;
 
diff --git a/include/asm-mips/stackframe.h b/include/asm-mips/stackframe.h
index a8919dcc93c8..2acf3e844f00 100644
--- a/include/asm-mips/stackframe.h
+++ b/include/asm-mips/stackframe.h
@@ -63,17 +63,7 @@
                 addu    k1, k0
                 LONG_L  k1, %lo(kernelsp)(k1)
 #endif
-#if defined(CONFIG_64BIT) && !defined(CONFIG_BUILD_ELF64)
-                MFC0    k1, CP0_CONTEXT
-                dsra    k1, 23
-                lui     k0, %hi(pgd_current)
-                addiu   k0, %lo(pgd_current)
-                dsubu   k1, k0
-                lui     k0, %hi(kernelsp)
-                daddu   k1, k0
-                LONG_L  k1, %lo(kernelsp)(k1)
-#endif
-#if defined(CONFIG_64BIT) && defined(CONFIG_BUILD_ELF64)
+#ifdef CONFIG_64BIT
                 MFC0    k1, CP0_CONTEXT
                 lui     k0, %highest(kernelsp)
                 dsrl    k1, 23
@@ -91,11 +81,7 @@
                 mfc0    \temp, CP0_CONTEXT
                 srl     \temp, 23
 #endif
-#if defined(CONFIG_64BIT) && !defined(CONFIG_BUILD_ELF64)
-                lw      \temp, TI_CPU(gp)
-                dsll    \temp, 3
-#endif
-#if defined(CONFIG_64BIT) && defined(CONFIG_BUILD_ELF64)
+#ifdef CONFIG_64BIT
                 MFC0    \temp, CP0_CONTEXT
                 dsrl    \temp, 23
 #endif
@@ -103,7 +89,7 @@
                 .endm
 #else
                 .macro  get_saved_sp    /* Uniprocessor variation */
-#if defined(CONFIG_64BIT) && defined(CONFIG_BUILD_ELF64)
+#ifdef CONFIG_64BIT
                 lui     k1, %highest(kernelsp)
                 daddiu  k1, %higher(kernelsp)
                 dsll    k1, k1, 16
diff --git a/include/asm-mips/system.h b/include/asm-mips/system.h
index ddae9bae31af..4097fac5ac3c 100644
--- a/include/asm-mips/system.h
+++ b/include/asm-mips/system.h
@@ -286,10 +286,10 @@ extern void __xchg_called_with_bad_pointer(void);
 static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int size)
 {
         switch (size) {
-                case 4:
-                        return __xchg_u32(ptr, x);
-                case 8:
-                        return __xchg_u64(ptr, x);
+        case 4:
+                return __xchg_u32(ptr, x);
+        case 8:
+                return __xchg_u64(ptr, x);
         }
         __xchg_called_with_bad_pointer();
         return x;
diff --git a/include/asm-mips/thread_info.h b/include/asm-mips/thread_info.h
index fa193f861e71..f8d97dafd2f4 100644
--- a/include/asm-mips/thread_info.h
+++ b/include/asm-mips/thread_info.h
@@ -31,7 +31,7 @@ struct thread_info {
         int                     preempt_count;  /* 0 => preemptable, <0 => BUG */
 
         mm_segment_t            addr_limit;     /* thread address space:
-                                                   0-0xBFFFFFFF for user-thead
+                                                   0-0xBFFFFFFF for user-thead
                                                    0-0xFFFFFFFF for kernel-thread
                                                 */
         struct restart_block    restart_block;
diff --git a/include/asm-powerpc/ppc-pci.h b/include/asm-powerpc/ppc-pci.h
index f80482c7231f..cf79bc7ebb55 100644
--- a/include/asm-powerpc/ppc-pci.h
+++ b/include/asm-powerpc/ppc-pci.h
@@ -38,6 +38,7 @@ void *traverse_pci_devices(struct device_node *start, traverse_func pre,
 
 void pci_devs_phb_init(void);
 void pci_devs_phb_init_dynamic(struct pci_controller *phb);
+int setup_phb(struct device_node *dev, struct pci_controller *phb);
 void __devinit scan_phb(struct pci_controller *hose);
 
 /* From rtas_pci.h */
diff --git a/include/asm-sparc/idprom.h b/include/asm-sparc/idprom.h
index d856e640acd3..59083ed85232 100644
--- a/include/asm-sparc/idprom.h
+++ b/include/asm-sparc/idprom.h
@@ -7,27 +7,19 @@
 #ifndef _SPARC_IDPROM_H
 #define _SPARC_IDPROM_H
 
-/* Offset into the EEPROM where the id PROM is located on the 4c */
-#define IDPROM_OFFSET  0x7d8
+#include <linux/types.h>
 
-/* On sun4m; physical. */
-/* MicroSPARC(-II) does not decode 31rd bit, but it works. */
-#define IDPROM_OFFSET_M  0xfd8
-
-struct idprom
-{
-        unsigned char   id_format;      /* Format identifier (always 0x01) */
-        unsigned char   id_machtype;    /* Machine type */
-        unsigned char   id_ethaddr[6];  /* Hardware ethernet address */
-        long            id_date;        /* Date of manufacture */
-        unsigned int    id_sernum:24;   /* Unique serial number */
-        unsigned char   id_cksum;       /* Checksum - xor of the data bytes */
-        unsigned char   reserved[16];
+struct idprom {
+        u8              id_format;      /* Format identifier (always 0x01) */
+        u8              id_machtype;    /* Machine type */
+        u8              id_ethaddr[6];  /* Hardware ethernet address */
+        s32             id_date;        /* Date of manufacture */
+        u32             id_sernum:24;   /* Unique serial number */
+        u8              id_cksum;       /* Checksum - xor of the data bytes */
+        u8              reserved[16];
 };
 
 extern struct idprom *idprom;
 extern void idprom_init(void);
 
-#define IDPROM_SIZE  (sizeof(struct idprom))
-
 #endif /* !(_SPARC_IDPROM_H) */
diff --git a/include/asm-sparc/oplib.h b/include/asm-sparc/oplib.h
index d0d76b30eb4c..f283f8aaf6a9 100644
--- a/include/asm-sparc/oplib.h
+++ b/include/asm-sparc/oplib.h
@@ -165,6 +165,7 @@ enum prom_input_device {
         PROMDEV_ITTYA,                  /* input from ttya */
         PROMDEV_ITTYB,                  /* input from ttyb */
         PROMDEV_IRSC,                   /* input from rsc */
+        PROMDEV_IVCONS,                 /* input from virtual-console */
         PROMDEV_I_UNK,
 };
 
@@ -177,6 +178,7 @@ enum prom_output_device {
         PROMDEV_OTTYA,                  /* to ttya */
         PROMDEV_OTTYB,                  /* to ttyb */
         PROMDEV_ORSC,                   /* to rsc */
+        PROMDEV_OVCONS,                 /* to virtual-console */
         PROMDEV_O_UNK,
 };
 
diff --git a/include/asm-sparc/socket.h b/include/asm-sparc/socket.h
index 09575b608adb..4e0ce3a35ea9 100644
--- a/include/asm-sparc/socket.h
+++ b/include/asm-sparc/socket.h
@@ -47,7 +47,7 @@
 #define SO_TIMESTAMP            0x001d
 #define SCM_TIMESTAMP           SO_TIMESTAMP
 
-#define SO_PEERSEC              0x100e
+#define SO_PEERSEC              0x001e
 
 /* Security levels - as per NRL IPv6 - don't actually do anything */
 #define SO_SECURITY_AUTHENTICATION              0x5001
diff --git a/include/asm-sparc/uaccess.h b/include/asm-sparc/uaccess.h
index f8f1ec1f06e6..3cf132e1aa25 100644
--- a/include/asm-sparc/uaccess.h
+++ b/include/asm-sparc/uaccess.h
@@ -120,17 +120,6 @@ case 8: __put_user_asm(x,d,addr,__pu_ret); break; \
 default: __pu_ret = __put_user_bad(); break; \
 } } else { __pu_ret = -EFAULT; } __pu_ret; })
 
-#define __put_user_check_ret(x,addr,size,retval) ({ \
-register int __foo __asm__ ("l1"); \
-if (__access_ok(addr,size)) { \
-switch (size) { \
-case 1: __put_user_asm_ret(x,b,addr,retval,__foo); break; \
-case 2: __put_user_asm_ret(x,h,addr,retval,__foo); break; \
-case 4: __put_user_asm_ret(x,,addr,retval,__foo); break; \
-case 8: __put_user_asm_ret(x,d,addr,retval,__foo); break; \
-default: if (__put_user_bad()) return retval; break; \
-} } else return retval; })
-
 #define __put_user_nocheck(x,addr,size) ({ \
 register int __pu_ret; \
 switch (size) { \
@@ -141,16 +130,6 @@ case 8: __put_user_asm(x,d,addr,__pu_ret); break; \
 default: __pu_ret = __put_user_bad(); break; \
 } __pu_ret; })
 
-#define __put_user_nocheck_ret(x,addr,size,retval) ({ \
-register int __foo __asm__ ("l1"); \
-switch (size) { \
-case 1: __put_user_asm_ret(x,b,addr,retval,__foo); break; \
-case 2: __put_user_asm_ret(x,h,addr,retval,__foo); break; \
-case 4: __put_user_asm_ret(x,,addr,retval,__foo); break; \
-case 8: __put_user_asm_ret(x,d,addr,retval,__foo); break; \
-default: if (__put_user_bad()) return retval; break; \
-} })
-
 #define __put_user_asm(x,size,addr,ret)                                 \
 __asm__ __volatile__(                                                   \
         "/* Put user asm, inline. */\n"                                 \
@@ -170,32 +149,6 @@ __asm__ __volatile__(							\
        : "=&r" (ret) : "r" (x), "m" (*__m(addr)),                       \
          "i" (-EFAULT))
 
-#define __put_user_asm_ret(x,size,addr,ret,foo)                         \
-if (__builtin_constant_p(ret) && ret == -EFAULT)                        \
-__asm__ __volatile__(                                                   \
-        "/* Put user asm ret, inline. */\n"                             \
-"1:\t"  "st"#size " %1, %2\n\n\t"                                       \
-        ".section __ex_table,#alloc\n\t"                                \
-        ".align 4\n\t"                                                  \
-        ".word  1b, __ret_efault\n\n\t"                                 \
-        ".previous\n\n\t"                                               \
-       : "=r" (foo) : "r" (x), "m" (*__m(addr)));                       \
-else                                                                    \
-__asm__ __volatile(                                                     \
-        "/* Put user asm ret, inline. */\n"                             \
-"1:\t"  "st"#size " %1, %2\n\n\t"                                       \
-        ".section .fixup,#alloc,#execinstr\n\t"                         \
-        ".align 4\n"                                                    \
-"3:\n\t"                                                                \
-        "ret\n\t"                                                       \
-        " restore %%g0, %3, %%o0\n\t"                                   \
-        ".previous\n\n\t"                                               \
-        ".section __ex_table,#alloc\n\t"                                \
-        ".align 4\n\t"                                                  \
-        ".word  1b, 3b\n\n\t"                                           \
-        ".previous\n\n\t"                                               \
-       : "=r" (foo) : "r" (x), "m" (*__m(addr)), "i" (ret))
-
 extern int __put_user_bad(void);
 
 #define __get_user_check(x,addr,size,type) ({ \
diff --git a/include/asm-sparc64/a.out.h b/include/asm-sparc64/a.out.h
index 02af289e3f46..35cb5c9e0c92 100644
--- a/include/asm-sparc64/a.out.h
+++ b/include/asm-sparc64/a.out.h
@@ -95,7 +95,11 @@ struct relocation_info /* used when header.a_machtype == M_SPARC */
 
 #ifdef __KERNEL__
 
-#define STACK_TOP (test_thread_flag(TIF_32BIT) ? 0xf0000000 : 0x80000000000L)
+#define STACK_TOP32     ((1UL << 32UL) - PAGE_SIZE)
+#define STACK_TOP64     (0x0000080000000000UL - (1UL << 32UL))
+
+#define STACK_TOP (test_thread_flag(TIF_32BIT) ? \
+                   STACK_TOP32 : STACK_TOP64)
 
 #endif
 
diff --git a/include/asm-sparc64/asi.h b/include/asm-sparc64/asi.h
index 534855660f2a..662a21107ae6 100644
--- a/include/asm-sparc64/asi.h
+++ b/include/asm-sparc64/asi.h
@@ -25,14 +25,27 @@
 
 /* SpitFire and later extended ASIs.  The "(III)" marker designates
  * UltraSparc-III and later specific ASIs.  The "(CMT)" marker designates
- * Chip Multi Threading specific ASIs.
+ * Chip Multi Threading specific ASIs.  "(NG)" designates Niagara specific
+ * ASIs, "(4V)" designates SUN4V specific ASIs.
  */
 #define ASI_PHYS_USE_EC         0x14 /* PADDR, E-cachable               */
 #define ASI_PHYS_BYPASS_EC_E    0x15 /* PADDR, E-bit                    */
+#define ASI_BLK_AIUP_4V         0x16 /* (4V) Prim, user, block ld/st    */
+#define ASI_BLK_AIUS_4V         0x17 /* (4V) Sec, user, block ld/st     */
 #define ASI_PHYS_USE_EC_L       0x1c /* PADDR, E-cachable, little endian*/
 #define ASI_PHYS_BYPASS_EC_E_L  0x1d /* PADDR, E-bit, little endian     */
+#define ASI_BLK_AIUP_L_4V       0x1e /* (4V) Prim, user, block, l-endian*/
+#define ASI_BLK_AIUS_L_4V       0x1f /* (4V) Sec, user, block, l-endian */
+#define ASI_SCRATCHPAD          0x20 /* (4V) Scratch Pad Registers      */
+#define ASI_MMU                 0x21 /* (4V) MMU Context Registers      */
+#define ASI_BLK_INIT_QUAD_LDD_AIUS 0x23 /* (NG) init-store, twin load,
+                                         * secondary, user
+                                         */
 #define ASI_NUCLEUS_QUAD_LDD    0x24 /* Cachable, qword load            */
+#define ASI_QUEUE               0x25 /* (4V) Interrupt Queue Registers  */
+#define ASI_QUAD_LDD_PHYS_4V    0x26 /* (4V) Physical, qword load       */
 #define ASI_NUCLEUS_QUAD_LDD_L  0x2c /* Cachable, qword load, l-endian  */
+#define ASI_QUAD_LDD_PHYS_L_4V  0x2e /* (4V) Phys, qword load, l-endian */
 #define ASI_PCACHE_DATA_STATUS  0x30 /* (III) PCache data stat RAM diag */
 #define ASI_PCACHE_DATA         0x31 /* (III) PCache data RAM diag      */
 #define ASI_PCACHE_TAG          0x32 /* (III) PCache tag RAM diag       */
@@ -137,6 +150,9 @@
 #define ASI_FL16_SL             0xdb /* Secondary, 1 16-bit, fpu ld/st,L*/
 #define ASI_BLK_COMMIT_P        0xe0 /* Primary, blk store commit       */
 #define ASI_BLK_COMMIT_S        0xe1 /* Secondary, blk store commit     */
+#define ASI_BLK_INIT_QUAD_LDD_P 0xe2 /* (NG) init-store, twin load,
+                                      * primary, implicit
+                                      */
 #define ASI_BLK_P               0xf0 /* Primary, blk ld/st              */
 #define ASI_BLK_S               0xf1 /* Secondary, blk ld/st            */
 #define ASI_BLK_PL              0xf8 /* Primary, blk ld/st, little      */
diff --git a/include/asm-sparc64/cpudata.h b/include/asm-sparc64/cpudata.h
index 74de79dca915..c66a81bbc84d 100644
--- a/include/asm-sparc64/cpudata.h
+++ b/include/asm-sparc64/cpudata.h
@@ -1,41 +1,224 @@
 /* cpudata.h: Per-cpu parameters.
  *
- * Copyright (C) 2003, 2005 David S. Miller (davem@redhat.com)
+ * Copyright (C) 2003, 2005, 2006 David S. Miller (davem@davemloft.net)
  */
 
 #ifndef _SPARC64_CPUDATA_H
 #define _SPARC64_CPUDATA_H
 
+#include <asm/hypervisor.h>
+#include <asm/asi.h>
+
+#ifndef __ASSEMBLY__
+
 #include <linux/percpu.h>
+#include <linux/threads.h>
 
 typedef struct {
         /* Dcache line 1 */
         unsigned int    __softirq_pending; /* must be 1st, see rtrap.S */
         unsigned int    multiplier;
         unsigned int    counter;
-        unsigned int    idle_volume;
+        unsigned int    __pad1;
         unsigned long   clock_tick;     /* %tick's per second */
         unsigned long   udelay_val;
 
-        /* Dcache line 2 */
-        unsigned int    pgcache_size;
-        unsigned int    __pad1;
-        unsigned long   *pte_cache[2];
-        unsigned long   *pgd_cache;
-
-        /* Dcache line 3, rarely used */
+        /* Dcache line 2, rarely used */
         unsigned int    dcache_size;
         unsigned int    dcache_line_size;
         unsigned int    icache_size;
         unsigned int    icache_line_size;
         unsigned int    ecache_size;
         unsigned int    ecache_line_size;
-        unsigned int    __pad2;
         unsigned int    __pad3;
+        unsigned int    __pad4;
 } cpuinfo_sparc;
 
 DECLARE_PER_CPU(cpuinfo_sparc, __cpu_data);
 #define cpu_data(__cpu)         per_cpu(__cpu_data, (__cpu))
 #define local_cpu_data()        __get_cpu_var(__cpu_data)
 
+/* Trap handling code needs to get at a few critical values upon
+ * trap entry and to process TSB misses.  These cannot be in the
+ * per_cpu() area as we really need to lock them into the TLB and
+ * thus make them part of the main kernel image.  As a result we
+ * try to make this as small as possible.
+ *
+ * This is padded out and aligned to 64-bytes to avoid false sharing
+ * on SMP.
+ */
+
+/* If you modify the size of this structure, please update
+ * TRAP_BLOCK_SZ_SHIFT below.
+ */
+struct thread_info;
+struct trap_per_cpu {
+/* D-cache line 1: Basic thread information, cpu and device mondo queues */
+        struct thread_info      *thread;
+        unsigned long           pgd_paddr;
+        unsigned long           cpu_mondo_pa;
+        unsigned long           dev_mondo_pa;
+
+/* D-cache line 2: Error Mondo Queue and kernel buffer pointers */
+        unsigned long           resum_mondo_pa;
+        unsigned long           resum_kernel_buf_pa;
+        unsigned long           nonresum_mondo_pa;
+        unsigned long           nonresum_kernel_buf_pa;
+
+/* Dcache lines 3, 4, 5, and 6: Hypervisor Fault Status */
+        struct hv_fault_status  fault_info;
+
+/* Dcache line 7: Physical addresses of CPU send mondo block and CPU list.  */
+        unsigned long           cpu_mondo_block_pa;
+        unsigned long           cpu_list_pa;
+        unsigned long           __pad1[2];
+
+/* Dcache line 8: Unused, needed to keep trap_block a power-of-2 in size.  */
+        unsigned long           __pad2[4];
+} __attribute__((aligned(64)));
+extern struct trap_per_cpu trap_block[NR_CPUS];
+extern void init_cur_cpu_trap(struct thread_info *);
+extern void setup_tba(void);
+
+struct cpuid_patch_entry {
+        unsigned int    addr;
+        unsigned int    cheetah_safari[4];
+        unsigned int    cheetah_jbus[4];
+        unsigned int    starfire[4];
+        unsigned int    sun4v[4];
+};
+extern struct cpuid_patch_entry __cpuid_patch, __cpuid_patch_end;
+
+struct sun4v_1insn_patch_entry {
+        unsigned int    addr;
+        unsigned int    insn;
+};
+extern struct sun4v_1insn_patch_entry __sun4v_1insn_patch,
+        __sun4v_1insn_patch_end;
+
+struct sun4v_2insn_patch_entry {
+        unsigned int    addr;
+        unsigned int    insns[2];
+};
+extern struct sun4v_2insn_patch_entry __sun4v_2insn_patch,
+        __sun4v_2insn_patch_end;
+
+#endif /* !(__ASSEMBLY__) */
+
+#define TRAP_PER_CPU_THREAD             0x00
+#define TRAP_PER_CPU_PGD_PADDR          0x08
+#define TRAP_PER_CPU_CPU_MONDO_PA       0x10
+#define TRAP_PER_CPU_DEV_MONDO_PA       0x18
+#define TRAP_PER_CPU_RESUM_MONDO_PA     0x20
+#define TRAP_PER_CPU_RESUM_KBUF_PA      0x28
+#define TRAP_PER_CPU_NONRESUM_MONDO_PA  0x30
+#define TRAP_PER_CPU_NONRESUM_KBUF_PA   0x38
+#define TRAP_PER_CPU_FAULT_INFO         0x40
+#define TRAP_PER_CPU_CPU_MONDO_BLOCK_PA 0xc0
+#define TRAP_PER_CPU_CPU_LIST_PA        0xc8
+
+#define TRAP_BLOCK_SZ_SHIFT             8
+
+#include <asm/scratchpad.h>
+
+#define __GET_CPUID(REG)                                \
+        /* Spitfire implementation (default). */        \
+661:    ldxa            [%g0] ASI_UPA_CONFIG, REG;      \
+        srlx            REG, 17, REG;                   \
+         and            REG, 0x1f, REG;                 \
+        nop;                                            \
+        .section        .cpuid_patch, "ax";             \
+        /* Instruction location. */                     \
+        .word           661b;                           \
+        /* Cheetah Safari implementation. */            \
+        ldxa            [%g0] ASI_SAFARI_CONFIG, REG;   \
+        srlx            REG, 17, REG;                   \
+        and             REG, 0x3ff, REG;                \
+        nop;                                            \
+        /* Cheetah JBUS implementation. */              \
+        ldxa            [%g0] ASI_JBUS_CONFIG, REG;     \
+        srlx            REG, 17, REG;                   \
+        and             REG, 0x1f, REG;                 \
+        nop;                                            \
+        /* Starfire implementation. */                  \
+        sethi           %hi(0x1fff40000d0 >> 9), REG;   \
+        sllx            REG, 9, REG;                    \
+        or              REG, 0xd0, REG;                 \
+        lduwa           [REG] ASI_PHYS_BYPASS_EC_E, REG;\
+        /* sun4v implementation. */                     \
+        mov             SCRATCHPAD_CPUID, REG;          \
+        ldxa            [REG] ASI_SCRATCHPAD, REG;      \
+        nop;                                            \
+        nop;                                            \
+        .previous;
+
+#ifdef CONFIG_SMP
+
+#define TRAP_LOAD_TRAP_BLOCK(DEST, TMP)         \
+        __GET_CPUID(TMP)                        \
+        sethi   %hi(trap_block), DEST;          \
+        sllx    TMP, TRAP_BLOCK_SZ_SHIFT, TMP;  \
+        or      DEST, %lo(trap_block), DEST;    \
+        add     DEST, TMP, DEST;                \
+
+/* Clobbers TMP, current address space PGD phys address into DEST.  */
+#define TRAP_LOAD_PGD_PHYS(DEST, TMP)           \
+        TRAP_LOAD_TRAP_BLOCK(DEST, TMP)         \
+        ldx     [DEST + TRAP_PER_CPU_PGD_PADDR], DEST;
+
+/* Clobbers TMP, loads local processor's IRQ work area into DEST.  */
+#define TRAP_LOAD_IRQ_WORK(DEST, TMP)           \
+        __GET_CPUID(TMP)                        \
+        sethi   %hi(__irq_work), DEST;          \
+        sllx    TMP, 6, TMP;                    \
+        or      DEST, %lo(__irq_work), DEST;    \
+        add     DEST, TMP, DEST;
+
+/* Clobbers TMP, loads DEST with current thread info pointer.  */
+#define TRAP_LOAD_THREAD_REG(DEST, TMP)         \
+        TRAP_LOAD_TRAP_BLOCK(DEST, TMP)         \
+        ldx     [DEST + TRAP_PER_CPU_THREAD], DEST;
+
+/* Given the current thread info pointer in THR, load the per-cpu
+ * area base of the current processor into DEST.  REG1, REG2, and REG3 are
+ * clobbered.
+ *
+ * You absolutely cannot use DEST as a temporary in this code.  The
+ * reason is that traps can happen during execution, and return from
+ * trap will load the fully resolved DEST per-cpu base.  This can corrupt
+ * the calculations done by the macro mid-stream.
+ */
+#define LOAD_PER_CPU_BASE(DEST, THR, REG1, REG2, REG3)  \
+        ldub    [THR + TI_CPU], REG1;                   \
+        sethi   %hi(__per_cpu_shift), REG3;             \
+        sethi   %hi(__per_cpu_base), REG2;              \
+        ldx     [REG3 + %lo(__per_cpu_shift)], REG3;    \
+        ldx     [REG2 + %lo(__per_cpu_base)], REG2;     \
+        sllx    REG1, REG3, REG3;                       \
+        add     REG3, REG2, DEST;
+
+#else
+
+#define TRAP_LOAD_TRAP_BLOCK(DEST, TMP)         \
+        sethi   %hi(trap_block), DEST;          \
+        or      DEST, %lo(trap_block), DEST;    \
+
+/* Uniprocessor versions, we know the cpuid is zero.  */
+#define TRAP_LOAD_PGD_PHYS(DEST, TMP)           \
+        TRAP_LOAD_TRAP_BLOCK(DEST, TMP)         \
+        ldx     [DEST + TRAP_PER_CPU_PGD_PADDR], DEST;
+
+#define TRAP_LOAD_IRQ_WORK(DEST, TMP)           \
+        sethi   %hi(__irq_work), DEST;          \
+        or      DEST, %lo(__irq_work), DEST;
+
+#define TRAP_LOAD_THREAD_REG(DEST, TMP)         \
+        TRAP_LOAD_TRAP_BLOCK(DEST, TMP)         \
+        ldx     [DEST + TRAP_PER_CPU_THREAD], DEST;
+
+/* No per-cpu areas on uniprocessor, so no need to load DEST.  */
+#define LOAD_PER_CPU_BASE(DEST, THR, REG1, REG2, REG3)
+
+#endif /* !(CONFIG_SMP) */
+
 #endif /* _SPARC64_CPUDATA_H */
diff --git a/include/asm-sparc64/elf.h b/include/asm-sparc64/elf.h
index 69539a8ab833..303d85e2f82e 100644
--- a/include/asm-sparc64/elf.h
+++ b/include/asm-sparc64/elf.h
@@ -10,6 +10,7 @@
 #ifdef __KERNEL__
 #include <asm/processor.h>
 #include <asm/uaccess.h>
+#include <asm/spitfire.h>
 #endif
 
 /*
@@ -68,6 +69,7 @@
 #define HWCAP_SPARC_MULDIV      8
 #define HWCAP_SPARC_V9          16
 #define HWCAP_SPARC_ULTRA3      32
+#define HWCAP_SPARC_BLKINIT     64
 
 /*
  * These are used to set parameters in the core dumps.
@@ -145,11 +147,21 @@ typedef struct {
    instruction set this cpu supports.  */
 
 /* On Ultra, we support all of the v8 capabilities. */
-#define ELF_HWCAP       ((HWCAP_SPARC_FLUSH | HWCAP_SPARC_STBAR | \
-                          HWCAP_SPARC_SWAP | HWCAP_SPARC_MULDIV | \
-                          HWCAP_SPARC_V9) | \
-                         ((tlb_type == cheetah || tlb_type == cheetah_plus) ? \
-                          HWCAP_SPARC_ULTRA3 : 0))
+static inline unsigned int sparc64_elf_hwcap(void)
+{
+        unsigned int cap = (HWCAP_SPARC_FLUSH | HWCAP_SPARC_STBAR |
+                            HWCAP_SPARC_SWAP | HWCAP_SPARC_MULDIV |
+                            HWCAP_SPARC_V9);
+
+        if (tlb_type == cheetah || tlb_type == cheetah_plus)
+                cap |= HWCAP_SPARC_ULTRA3;
+        else if (tlb_type == hypervisor)
+                cap |= HWCAP_SPARC_BLKINIT;
+
+        return cap;
+}
+
+#define ELF_HWCAP       sparc64_elf_hwcap();
 
 /* This yields a string that ld.so will use to load implementation
    specific libraries for optimization.  This is more specific in
diff --git a/include/asm-sparc64/head.h b/include/asm-sparc64/head.h
index 0abd3a674e8f..67960a751f4d 100644
--- a/include/asm-sparc64/head.h
+++ b/include/asm-sparc64/head.h
@@ -4,12 +4,21 @@
 
 #include <asm/pstate.h>
 
+        /* wrpr %g0, val, %gl */
+#define SET_GL(val)     \
+        .word   0xa1902000 | val
+
+        /* rdpr %gl, %gN */
+#define GET_GL_GLOBAL(N)        \
+        .word   0x81540000 | (N << 25)
+
 #define KERNBASE        0x400000
 
 #define PTREGS_OFF      (STACK_BIAS + STACKFRAME_SZ)
 
 #define __CHEETAH_ID    0x003e0014
 #define __JALAPENO_ID   0x003e0016
+#define __SERRANO_ID    0x003e0022
 
 #define CHEETAH_MANUF           0x003e
 #define CHEETAH_IMPL            0x0014 /* Ultra-III   */
@@ -19,6 +28,12 @@
 #define PANTHER_IMPL            0x0019 /* Ultra-IV+   */
 #define SERRANO_IMPL            0x0022 /* Ultra-IIIi+ */
 
+#define BRANCH_IF_SUN4V(tmp1,label)             \
+        sethi   %hi(is_sun4v), %tmp1;           \
+        lduw    [%tmp1 + %lo(is_sun4v)], %tmp1; \
+        brnz,pn %tmp1, label;                   \
+         nop
+
 #define BRANCH_IF_CHEETAH_BASE(tmp1,tmp2,label) \
         rdpr    %ver, %tmp1;                    \
         sethi   %hi(__CHEETAH_ID), %tmp2;       \
diff --git a/include/asm-sparc64/hypervisor.h b/include/asm-sparc64/hypervisor.h
new file mode 100644
index 000000000000..612bf319753f
--- /dev/null
+++ b/include/asm-sparc64/hypervisor.h
@@ -0,0 +1,2128 @@
+#ifndef _SPARC64_HYPERVISOR_H
+#define _SPARC64_HYPERVISOR_H
+
+/* Sun4v hypervisor interfaces and defines.
+ *
+ * Hypervisor calls are made via traps to software traps number 0x80
+ * and above.  Registers %o0 to %o5 serve as argument, status, and
+ * return value registers.
+ *
+ * There are two kinds of these traps.  First there are the normal
+ * "fast traps" which use software trap 0x80 and encode the function
+ * to invoke by number in register %o5.  Argument and return value
+ * handling is as follows:
+ *
+ * -----------------------------------------------
+ * |  %o5  | function number |     undefined     |
+ * |  %o0  |   argument 0    |   return status   |
+ * |  %o1  |   argument 1    |   return value 1  |
+ * |  %o2  |   argument 2    |   return value 2  |
+ * |  %o3  |   argument 3    |   return value 3  |
+ * |  %o4  |   argument 4    |   return value 4  |
+ * -----------------------------------------------
+ *
+ * The second type are "hyper-fast traps" which encode the function
+ * number in the software trap number itself.  So these use trap
+ * numbers > 0x80.  The register usage for hyper-fast traps is as
+ * follows:
+ *
+ * -----------------------------------------------
+ * |  %o0  |   argument 0    |   return status   |
+ * |  %o1  |   argument 1    |   return value 1  |
+ * |  %o2  |   argument 2    |   return value 2  |
+ * |  %o3  |   argument 3    |   return value 3  |
+ * |  %o4  |   argument 4    |   return value 4  |
+ * -----------------------------------------------
+ *
+ * Registers providing explicit arguments to the hypervisor calls
+ * are volatile across the call.  Upon return their values are
+ * undefined unless explicitly specified as containing a particular
+ * return value by the specific call.  The return status is always
+ * returned in register %o0, zero indicates a successful execution of
+ * the hypervisor call and other values indicate an error status as
+ * defined below.  So, for example, if a hyper-fast trap takes
+ * arguments 0, 1, and 2, then %o0, %o1, and %o2 are volatile across
+ * the call and %o3, %o4, and %o5 would be preserved.
+ *
+ * If the hypervisor trap is invalid, or the fast trap function number
+ * is invalid, HV_EBADTRAP will be returned in %o0.  Also, all 64-bits
+ * of the argument and return values are significant.
+ */
+
+/* Trap numbers.  */
+#define HV_FAST_TRAP            0x80
+#define HV_MMU_MAP_ADDR_TRAP    0x83
+#define HV_MMU_UNMAP_ADDR_TRAP  0x84
+#define HV_TTRACE_ADDENTRY_TRAP 0x85
+#define HV_CORE_TRAP            0xff
+
+/* Error codes.  */
+#define HV_EOK                          0  /* Successful return            */
+#define HV_ENOCPU                       1  /* Invalid CPU id               */
+#define HV_ENORADDR                     2  /* Invalid real address         */
+#define HV_ENOINTR                      3  /* Invalid interrupt id         */
+#define HV_EBADPGSZ                     4  /* Invalid pagesize encoding    */
+#define HV_EBADTSB                      5  /* Invalid TSB description      */
+#define HV_EINVAL                       6  /* Invalid argument             */
+#define HV_EBADTRAP                     7  /* Invalid function number      */
+#define HV_EBADALIGN                    8  /* Invalid address alignment    */
+#define HV_EWOULDBLOCK                  9  /* Cannot complete w/o blocking */
+#define HV_ENOACCESS                    10 /* No access to resource        */
+#define HV_EIO                          11 /* I/O error                    */
+#define HV_ECPUERROR                    12 /* CPU in error state           */
+#define HV_ENOTSUPPORTED                13 /* Function not supported       */
+#define HV_ENOMAP                       14 /* No mapping found             */
+#define HV_ETOOMANY                     15 /* Too many items specified     */
+
+/* mach_exit()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MACH_EXIT
+ * ARG0:        exit code
+ * ERRORS:      This service does not return.
+ *
+ * Stop all CPUs in the virtual domain and place them into the stopped
+ * state.  The 64-bit exit code may be passed to a service entity as
+ * the domain's exit status.  On systems without a service entity, the
+ * domain will undergo a reset, and the boot firmware will be
+ * reloaded.
+ *
+ * This function will never return to the guest that invokes it.
+ *
+ * Note: By convention an exit code of zero denotes a successful exit by
+ *       the guest code.  A non-zero exit code denotes a guest specific
+ *       error indication.
+ *
+ */
+#define HV_FAST_MACH_EXIT               0x00
+
+/* Domain services.  */
+
+/* mach_desc()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MACH_DESC
+ * ARG0:        buffer
+ * ARG1:        length
+ * RET0:        status
+ * RET1:        length
+ * ERRORS:      HV_EBADALIGN    Buffer is badly aligned
+ *              HV_ENORADDR     Buffer is to an illegal real address.
+ *              HV_EINVAL       Buffer length is too small for complete
+ *                              machine description.
+ *
+ * Copy the most current machine description into the buffer indicated
+ * by the real address in ARG0.  The buffer provided must be 16 byte
+ * aligned.  Upon success or HV_EINVAL, this service returns the
+ * actual size of the machine description in the RET1 return value.
+ *
+ * Note: A method of determining the appropriate buffer size for the
+ *       machine description is to first call this service with a buffer
+ *       length of 0 bytes.
+ */
+#define HV_FAST_MACH_DESC               0x01
+
+/* mach_exit()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MACH_SIR
+ * ERRORS:      This service does not return.
+ *
+ * Perform a software initiated reset of the virtual machine domain.
+ * All CPUs are captured as soon as possible, all hardware devices are
+ * returned to the entry default state, and the domain is restarted at
+ * the SIR (trap type 0x04) real trap table (RTBA) entry point on one
+ * of the CPUs.  The single CPU restarted is selected as determined by
+ * platform specific policy.  Memory is preserved across this
+ * operation.
+ */
+#define HV_FAST_MACH_SIR                0x02
+
+/* mach_set_soft_state()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MACH_SET_SOFT_STATE
+ * ARG0:        software state
+ * ARG1:        software state description pointer
+ * RET0:        status
+ * ERRORS:      EINVAL          software state not valid or software state
+ *                              description is not NULL terminated
+ *              ENORADDR        software state description pointer is not a
+ *                              valid real address
+ *              EBADALIGNED     software state description is not correctly
+ *                              aligned
+ *
+ * This allows the guest to report it's soft state to the hypervisor.  There
+ * are two primary components to this state.  The first part states whether
+ * the guest software is running or not.  The second containts optional
+ * details specific to the software.
+ *
+ * The software state argument is defined below in HV_SOFT_STATE_*, and
+ * indicates whether the guest is operating normally or in a transitional
+ * state.
+ *
+ * The software state description argument is a real address of a data buffer
+ * of size 32-bytes aligned on a 32-byte boundary.  It is treated as a NULL
+ * terminated 7-bit ASCII string of up to 31 characters not including the
+ * NULL termination.
+ */
+#define HV_FAST_MACH_SET_SOFT_STATE     0x03
+#define  HV_SOFT_STATE_NORMAL            0x01
+#define  HV_SOFT_STATE_TRANSITION        0x02
+
+/* mach_get_soft_state()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MACH_GET_SOFT_STATE
+ * ARG0:        software state description pointer
+ * RET0:        status
+ * RET1:        software state
+ * ERRORS:      ENORADDR        software state description pointer is not a
+ *                              valid real address
+ *              EBADALIGNED     software state description is not correctly
+ *                              aligned
+ *
+ * Retrieve the current value of the guest's software state.  The rules
+ * for the software state pointer are the same as for mach_set_soft_state()
+ * above.
+ */
+#define HV_FAST_MACH_GET_SOFT_STATE     0x04
+
+/* CPU services.
+ *
+ * CPUs represent devices that can execute software threads.  A single
+ * chip that contains multiple cores or strands is represented as
+ * multiple CPUs with unique CPU identifiers.  CPUs are exported to
+ * OBP via the machine description (and to the OS via the OBP device
+ * tree).  CPUs are always in one of three states: stopped, running,
+ * or error.
+ *
+ * A CPU ID is a pre-assigned 16-bit value that uniquely identifies a
+ * CPU within a logical domain.  Operations that are to be performed
+ * on multiple CPUs specify them via a CPU list.  A CPU list is an
+ * array in real memory, of which each 16-bit word is a CPU ID.  CPU
+ * lists are passed through the API as two arguments.  The first is
+ * the number of entries (16-bit words) in the CPU list, and the
+ * second is the (real address) pointer to the CPU ID list.
+ */
+
+/* cpu_start()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_CPU_START
+ * ARG0:        CPU ID
+ * ARG1:        PC
+ * ARG1:        RTBA
+ * ARG1:        target ARG0
+ * RET0:        status
+ * ERRORS:      ENOCPU          Invalid CPU ID
+ *              EINVAL          Target CPU ID is not in the stopped state
+ *              ENORADDR        Invalid PC or RTBA real address
+ *              EBADALIGN       Unaligned PC or unaligned RTBA
+ *              EWOULDBLOCK     Starting resources are not available
+ *
+ * Start CPU with given CPU ID with PC in %pc and with a real trap
+ * base address value of RTBA.  The indicated CPU must be in the
+ * stopped state.  The supplied RTBA must be aligned on a 256 byte
+ * boundary.  On successful completion, the specified CPU will be in
+ * the running state and will be supplied with "target ARG0" in %o0
+ * and RTBA in %tba.
+ */
+#define HV_FAST_CPU_START               0x10
+
+/* cpu_stop()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_CPU_STOP
+ * ARG0:        CPU ID
+ * RET0:        status
+ * ERRORS:      ENOCPU          Invalid CPU ID
+ *              EINVAL          Target CPU ID is the current cpu
+ *              EINVAL          Target CPU ID is not in the running state
+ *              EWOULDBLOCK     Stopping resources are not available
+ *              ENOTSUPPORTED   Not supported on this platform
+ *
+ * The specified CPU is stopped.  The indicated CPU must be in the
+ * running state.  On completion, it will be in the stopped state.  It
+ * is not legal to stop the current CPU.
+ *
+ * Note: As this service cannot be used to stop the current cpu, this service
+ *       may not be used to stop the last running CPU in a domain.  To stop
+ *       and exit a running domain, a guest must use the mach_exit() service.
+ */
+#define HV_FAST_CPU_STOP                0x11
+
+/* cpu_yield()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_CPU_YIELD
+ * RET0:        status
+ * ERRORS:      No possible error.
+ *
+ * Suspend execution on the current CPU.  Execution will resume when
+ * an interrupt (device, %stick_compare, or cross-call) is targeted to
+ * the CPU.  On some CPUs, this API may be used by the hypervisor to
+ * save power by disabling hardware strands.
+ */
+#define HV_FAST_CPU_YIELD               0x12
+
+#ifndef __ASSEMBLY__
+extern unsigned long sun4v_cpu_yield(void);
+#endif
+
+/* cpu_qconf()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_CPU_QCONF
+ * ARG0:        queue
+ * ARG1:        base real address
+ * ARG2:        number of entries
+ * RET0:        status
+ * ERRORS:      ENORADDR        Invalid base real address
+ *              EINVAL          Invalid queue or number of entries is less
+ *                              than 2 or too large.
+ *              EBADALIGN       Base real address is not correctly aligned
+ *                              for size.
+ *
+ * Configure the given queue to be placed at the given base real
+ * address, with the given number of entries.  The number of entries
+ * must be a power of 2.  The base real address must be aligned
+ * exactly to match the queue size.  Each queue entry is 64 bytes
+ * long, so for example a 32 entry queue must be aligned on a 2048
+ * byte real address boundary.
+ *
+ * The specified queue is unconfigured if the number of entries is given
+ * as zero.
+ *
+ * For the current version of this API service, the argument queue is defined
+ * as follows:
+ *
+ *      queue           description
+ *      -----           -------------------------
+ *      0x3c            cpu mondo queue
+ *      0x3d            device mondo queue
+ *      0x3e            resumable error queue
+ *      0x3f            non-resumable error queue
+ *
+ * Note: The maximum number of entries for each queue for a specific cpu may
+ *       be determined from the machine description.
+ */
+#define HV_FAST_CPU_QCONF               0x14
+#define  HV_CPU_QUEUE_CPU_MONDO          0x3c
+#define  HV_CPU_QUEUE_DEVICE_MONDO       0x3d
+#define  HV_CPU_QUEUE_RES_ERROR          0x3e
+#define  HV_CPU_QUEUE_NONRES_ERROR       0x3f
+
+#ifndef __ASSEMBLY__
+extern unsigned long sun4v_cpu_qconf(unsigned long type,
+                                     unsigned long queue_paddr,
+                                     unsigned long num_queue_entries);
+#endif
+
+/* cpu_qinfo()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_CPU_QINFO
+ * ARG0:        queue
+ * RET0:        status
+ * RET1:        base real address
+ * RET1:        number of entries
+ * ERRORS:      EINVAL          Invalid queue
+ *
+ * Return the configuration info for the given queue.  The base real
+ * address and number of entries of the defined queue are returned.
+ * The queue argument values are the same as for cpu_qconf() above.
+ *
+ * If the specified queue is a valid queue number, but no queue has
+ * been defined, the number of entries will be set to zero and the
+ * base real address returned is undefined.
+ */
+#define HV_FAST_CPU_QINFO               0x15
+
+/* cpu_mondo_send()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_CPU_MONDO_SEND
+ * ARG0-1:      CPU list
+ * ARG2:        data real address
+ * RET0:        status
+ * ERRORS:      EBADALIGN       Mondo data is not 64-byte aligned or CPU list
+ *                              is not 2-byte aligned.
+ *              ENORADDR        Invalid data mondo address, or invalid cpu list
+ *                              address.
+ *              ENOCPU          Invalid cpu in CPU list
+ *              EWOULDBLOCK     Some or all of the listed CPUs did not receive
+ *                              the mondo
+ *              ECPUERROR       One or more of the listed CPUs are in error
+ *                              state, use HV_FAST_CPU_STATE to see which ones
+ *              EINVAL          CPU list includes caller's CPU ID
+ *
+ * Send a mondo interrupt to the CPUs in the given CPU list with the
+ * 64-bytes at the given data real address.  The data must be 64-byte
+ * aligned.  The mondo data will be delivered to the cpu_mondo queues
+ * of the recipient CPUs.
+ *
+ * In all cases, error or not, the CPUs in the CPU list to which the
+ * mondo has been successfully delivered will be indicated by having
+ * their entry in CPU list updated with the value 0xffff.
+ */
+#define HV_FAST_CPU_MONDO_SEND          0x42
+
+#ifndef __ASSEMBLY__
+extern unsigned long sun4v_cpu_mondo_send(unsigned long cpu_count, unsigned long cpu_list_pa, unsigned long mondo_block_pa);
+#endif
+
+/* cpu_myid()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_CPU_MYID
+ * RET0:        status
+ * RET1:        CPU ID
+ * ERRORS:      No errors defined.
+ *
+ * Return the hypervisor ID handle for the current CPU.  Use by a
+ * virtual CPU to discover it's own identity.
+ */
+#define HV_FAST_CPU_MYID                0x16
+
+/* cpu_state()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_CPU_STATE
+ * ARG0:        CPU ID
+ * RET0:        status
+ * RET1:        state
+ * ERRORS:      ENOCPU          Invalid CPU ID
+ *
+ * Retrieve the current state of the CPU with the given CPU ID.
+ */
+#define HV_FAST_CPU_STATE               0x17
+#define  HV_CPU_STATE_STOPPED            0x01
+#define  HV_CPU_STATE_RUNNING            0x02
+#define  HV_CPU_STATE_ERROR              0x03
+
+#ifndef __ASSEMBLY__
+extern long sun4v_cpu_state(unsigned long cpuid);
+#endif
+
+/* cpu_set_rtba()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_CPU_SET_RTBA
+ * ARG0:        RTBA
+ * RET0:        status
+ * RET1:        previous RTBA
+ * ERRORS:      ENORADDR        Invalid RTBA real address
+ *              EBADALIGN       RTBA is incorrectly aligned for a trap table
+ *
+ * Set the real trap base address of the local cpu to the given RTBA.
+ * The supplied RTBA must be aligned on a 256 byte boundary.  Upon
+ * success the previous value of the RTBA is returned in RET1.
+ *
+ * Note: This service does not affect %tba
+ */
+#define HV_FAST_CPU_SET_RTBA            0x18
+
+/* cpu_set_rtba()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_CPU_GET_RTBA
+ * RET0:        status
+ * RET1:        previous RTBA
+ * ERRORS:      No possible error.
+ *
+ * Returns the current value of RTBA in RET1.
+ */
+#define HV_FAST_CPU_GET_RTBA            0x19
+
+/* MMU services.
+ *
+ * Layout of a TSB description for mmu_tsb_ctx{,non}0() calls.
+ */
+#ifndef __ASSEMBLY__
+struct hv_tsb_descr {
+        unsigned short          pgsz_idx;
+        unsigned short          assoc;
+        unsigned int            num_ttes;       /* in TTEs */
+        unsigned int            ctx_idx;
+        unsigned int            pgsz_mask;
+        unsigned long           tsb_base;
+        unsigned long           resv;
+};
+#endif
+#define HV_TSB_DESCR_PGSZ_IDX_OFFSET    0x00
+#define HV_TSB_DESCR_ASSOC_OFFSET       0x02
+#define HV_TSB_DESCR_NUM_TTES_OFFSET    0x04
+#define HV_TSB_DESCR_CTX_IDX_OFFSET     0x08
+#define HV_TSB_DESCR_PGSZ_MASK_OFFSET   0x0c
+#define HV_TSB_DESCR_TSB_BASE_OFFSET    0x10
+#define HV_TSB_DESCR_RESV_OFFSET        0x18
+
+/* Page size bitmask.  */
+#define HV_PGSZ_MASK_8K                 (1 << 0)
+#define HV_PGSZ_MASK_64K                (1 << 1)
+#define HV_PGSZ_MASK_512K               (1 << 2)
+#define HV_PGSZ_MASK_4MB                (1 << 3)
+#define HV_PGSZ_MASK_32MB               (1 << 4)
+#define HV_PGSZ_MASK_256MB              (1 << 5)
+#define HV_PGSZ_MASK_2GB                (1 << 6)
+#define HV_PGSZ_MASK_16GB               (1 << 7)
+
+/* Page size index.  The value given in the TSB descriptor must correspond
+ * to the smallest page size specified in the pgsz_mask page size bitmask.
+ */
+#define HV_PGSZ_IDX_8K                  0
+#define HV_PGSZ_IDX_64K                 1
+#define HV_PGSZ_IDX_512K                2
+#define HV_PGSZ_IDX_4MB                 3
+#define HV_PGSZ_IDX_32MB                4
+#define HV_PGSZ_IDX_256MB               5
+#define HV_PGSZ_IDX_2GB                 6
+#define HV_PGSZ_IDX_16GB                7
+
+/* MMU fault status area.
+ *
+ * MMU related faults have their status and fault address information
+ * placed into a memory region made available by privileged code.  Each
+ * virtual processor must make a mmu_fault_area_conf() call to tell the
+ * hypervisor where that processor's fault status should be stored.
+ *
+ * The fault status block is a multiple of 64-bytes and must be aligned
+ * on a 64-byte boundary.
+ */
+#ifndef __ASSEMBLY__
+struct hv_fault_status {
+        unsigned long           i_fault_type;
+        unsigned long           i_fault_addr;
+        unsigned long           i_fault_ctx;
+        unsigned long           i_reserved[5];
+        unsigned long           d_fault_type;
+        unsigned long           d_fault_addr;
+        unsigned long           d_fault_ctx;
+        unsigned long           d_reserved[5];
+};
+#endif
+#define HV_FAULT_I_TYPE_OFFSET  0x00
+#define HV_FAULT_I_ADDR_OFFSET  0x08
+#define HV_FAULT_I_CTX_OFFSET   0x10
+#define HV_FAULT_D_TYPE_OFFSET  0x40
+#define HV_FAULT_D_ADDR_OFFSET  0x48
+#define HV_FAULT_D_CTX_OFFSET   0x50
+
+#define HV_FAULT_TYPE_FAST_MISS 1
+#define HV_FAULT_TYPE_FAST_PROT 2
+#define HV_FAULT_TYPE_MMU_MISS  3
+#define HV_FAULT_TYPE_INV_RA    4
+#define HV_FAULT_TYPE_PRIV_VIOL 5
+#define HV_FAULT_TYPE_PROT_VIOL 6
+#define HV_FAULT_TYPE_NFO       7
+#define HV_FAULT_TYPE_NFO_SEFF  8
+#define HV_FAULT_TYPE_INV_VA    9
+#define HV_FAULT_TYPE_INV_ASI   10
+#define HV_FAULT_TYPE_NC_ATOMIC 11
+#define HV_FAULT_TYPE_PRIV_ACT  12
+#define HV_FAULT_TYPE_RESV1     13
+#define HV_FAULT_TYPE_UNALIGNED 14
+#define HV_FAULT_TYPE_INV_PGSZ  15
+/* Values 16 --> -2 are reserved.  */
+#define HV_FAULT_TYPE_MULTIPLE  -1
+
+/* Flags argument for mmu_{map,unmap}_addr(), mmu_demap_{page,context,all}(),
+ * and mmu_{map,unmap}_perm_addr().
+ */
+#define HV_MMU_DMMU                     0x01
+#define HV_MMU_IMMU                     0x02
+#define HV_MMU_ALL                      (HV_MMU_DMMU | HV_MMU_IMMU)
+
+/* mmu_map_addr()
+ * TRAP:        HV_MMU_MAP_ADDR_TRAP
+ * ARG0:        virtual address
+ * ARG1:        mmu context
+ * ARG2:        TTE
+ * ARG3:        flags (HV_MMU_{IMMU,DMMU})
+ * ERRORS:      EINVAL          Invalid virtual address, mmu context, or flags
+ *              EBADPGSZ        Invalid page size value
+ *              ENORADDR        Invalid real address in TTE
+ *
+ * Create a non-permanent mapping using the given TTE, virtual
+ * address, and mmu context.  The flags argument determines which
+ * (data, or instruction, or both) TLB the mapping gets loaded into.
+ *
+ * The behavior is undefined if the valid bit is clear in the TTE.
+ *
+ * Note: This API call is for privileged code to specify temporary translation
+ *       mappings without the need to create and manage a TSB.
+ */
+
+/* mmu_unmap_addr()
+ * TRAP:        HV_MMU_UNMAP_ADDR_TRAP
+ * ARG0:        virtual address
+ * ARG1:        mmu context
+ * ARG2:        flags (HV_MMU_{IMMU,DMMU})
+ * ERRORS:      EINVAL          Invalid virtual address, mmu context, or flags
+ *
+ * Demaps the given virtual address in the given mmu context on this
+ * CPU.  This function is intended to be used to demap pages mapped
+ * with mmu_map_addr.  This service is equivalent to invoking
+ * mmu_demap_page() with only the current CPU in the CPU list. The
+ * flags argument determines which (data, or instruction, or both) TLB
+ * the mapping gets unmapped from.
+ *
+ * Attempting to perform an unmap operation for a previously defined
+ * permanent mapping will have undefined results.
+ */
+
+/* mmu_tsb_ctx0()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MMU_TSB_CTX0
+ * ARG0:        number of TSB descriptions
+ * ARG1:        TSB descriptions pointer
+ * RET0:        status
+ * ERRORS:      ENORADDR                Invalid TSB descriptions pointer or
+ *                                      TSB base within a descriptor
+ *              EBADALIGN               TSB descriptions pointer is not aligned
+ *                                      to an 8-byte boundary, or TSB base
+ *                                      within a descriptor is not aligned for
+ *                                      the given TSB size
+ *              EBADPGSZ                Invalid page size in a TSB descriptor
+ *              EBADTSB                 Invalid associativity or size in a TSB
+ *                                      descriptor
+ *              EINVAL                  Invalid number of TSB descriptions, or
+ *                                      invalid context index in a TSB
+ *                                      descriptor, or index page size not
+ *                                      equal to smallest page size in page
+ *                                      size bitmask field.
+ *
+ * Configures the TSBs for the current CPU for virtual addresses with
+ * context zero.  The TSB descriptions pointer is a pointer to an
+ * array of the given number of TSB descriptions.
+ *
+ * Note: The maximum number of TSBs available to a virtual CPU is given by the
+ *       mmu-max-#tsbs property of the cpu's corresponding "cpu" node in the
+ *       machine description.
+ */
+#define HV_FAST_MMU_TSB_CTX0            0x20
+
+/* mmu_tsb_ctxnon0()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MMU_TSB_CTXNON0
+ * ARG0:        number of TSB descriptions
+ * ARG1:        TSB descriptions pointer
+ * RET0:        status
+ * ERRORS:      Same as for mmu_tsb_ctx0() above.
+ *
+ * Configures the TSBs for the current CPU for virtual addresses with
+ * non-zero contexts.  The TSB descriptions pointer is a pointer to an
+ * array of the given number of TSB descriptions.
+ *
+ * Note: A maximum of 16 TSBs may be specified in the TSB description list.
+ */
+#define HV_FAST_MMU_TSB_CTXNON0         0x21
+
+/* mmu_demap_page()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MMU_DEMAP_PAGE
+ * ARG0:        reserved, must be zero
+ * ARG1:        reserved, must be zero
+ * ARG2:        virtual address
+ * ARG3:        mmu context
+ * ARG4:        flags (HV_MMU_{IMMU,DMMU})
+ * RET0:        status
+ * ERRORS:      EINVAL                  Invalid virutal address, context, or
+ *                                      flags value
+ *              ENOTSUPPORTED           ARG0 or ARG1 is non-zero
+ *
+ * Demaps any page mapping of the given virtual address in the given
+ * mmu context for the current virtual CPU.  Any virtually tagged
+ * caches are guaranteed to be kept consistent.  The flags argument
+ * determines which TLB (instruction, or data, or both) participate in
+ * the operation.
+ *
+ * ARG0 and ARG1 are both reserved and must be set to zero.
+ */
+#define HV_FAST_MMU_DEMAP_PAGE          0x22
+
+/* mmu_demap_ctx()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MMU_DEMAP_CTX
+ * ARG0:        reserved, must be zero
+ * ARG1:        reserved, must be zero
+ * ARG2:        mmu context
+ * ARG3:        flags (HV_MMU_{IMMU,DMMU})
+ * RET0:        status
+ * ERRORS:      EINVAL                  Invalid context or flags value
+ *              ENOTSUPPORTED           ARG0 or ARG1 is non-zero
+ *
+ * Demaps all non-permanent virtual page mappings previously specified
+ * for the given context for the current virtual CPU.  Any virtual
+ * tagged caches are guaranteed to be kept consistent.  The flags
+ * argument determines which TLB (instruction, or data, or both)
+ * participate in the operation.
+ *
+ * ARG0 and ARG1 are both reserved and must be set to zero.
+ */
+#define HV_FAST_MMU_DEMAP_CTX           0x23
+
+/* mmu_demap_all()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MMU_DEMAP_ALL
+ * ARG0:        reserved, must be zero
+ * ARG1:        reserved, must be zero
+ * ARG2:        flags (HV_MMU_{IMMU,DMMU})
+ * RET0:        status
+ * ERRORS:      EINVAL                  Invalid flags value
+ *              ENOTSUPPORTED           ARG0 or ARG1 is non-zero
+ *
+ * Demaps all non-permanent virtual page mappings previously specified
+ * for the current virtual CPU.  Any virtual tagged caches are
+ * guaranteed to be kept consistent.  The flags argument determines
+ * which TLB (instruction, or data, or both) participate in the
+ * operation.
+ *
+ * ARG0 and ARG1 are both reserved and must be set to zero.
+ */
+#define HV_FAST_MMU_DEMAP_ALL           0x24
+
+/* mmu_map_perm_addr()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MMU_MAP_PERM_ADDR
+ * ARG0:        virtual address
+ * ARG1:        reserved, must be zero
+ * ARG2:        TTE
+ * ARG3:        flags (HV_MMU_{IMMU,DMMU})
+ * RET0:        status
+ * ERRORS:      EINVAL                  Invalid virutal address or flags value
+ *              EBADPGSZ                Invalid page size value
+ *              ENORADDR                Invalid real address in TTE
+ *              ETOOMANY                Too many mappings (max of 8 reached)
+ *
+ * Create a permanent mapping using the given TTE and virtual address
+ * for context 0 on the calling virtual CPU.  A maximum of 8 such
+ * permanent mappings may be specified by privileged code.  Mappings
+ * may be removed with mmu_unmap_perm_addr().
+ *
+ * The behavior is undefined if a TTE with the valid bit clear is given.
+ *
+ * Note: This call is used to specify address space mappings for which
+ *       privileged code does not expect to receive misses.  For example,
+ *       this mechanism can be used to map kernel nucleus code and data.
+ */
+#define HV_FAST_MMU_MAP_PERM_ADDR       0x25
+
+/* mmu_fault_area_conf()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MMU_FAULT_AREA_CONF
+ * ARG0:        real address
+ * RET0:        status
+ * RET1:        previous mmu fault area real address
+ * ERRORS:      ENORADDR                Invalid real address
+ *              EBADALIGN               Invalid alignment for fault area
+ *
+ * Configure the MMU fault status area for the calling CPU.  A 64-byte
+ * aligned real address specifies where MMU fault status information
+ * is placed.  The return value is the previously specified area, or 0
+ * for the first invocation.  Specifying a fault area at real address
+ * 0 is not allowed.
+ */
+#define HV_FAST_MMU_FAULT_AREA_CONF     0x26
+
+/* mmu_enable()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MMU_ENABLE
+ * ARG0:        enable flag
+ * ARG1:        return target address
+ * RET0:        status
+ * ERRORS:      ENORADDR                Invalid real address when disabling
+ *                                      translation.
+ *              EBADALIGN               The return target address is not
+ *                                      aligned to an instruction.
+ *              EINVAL                  The enable flag request the current
+ *                                      operating mode (e.g. disable if already
+ *                                      disabled)
+ *
+ * Enable or disable virtual address translation for the calling CPU
+ * within the virtual machine domain.  If the enable flag is zero,
+ * translation is disabled, any non-zero value will enable
+ * translation.
+ *
+ * When this function returns, the newly selected translation mode
+ * will be active.  If the mmu is being enabled, then the return
+ * target address is a virtual address else it is a real address.
+ *
+ * Upon successful completion, control will be returned to the given
+ * return target address (ie. the cpu will jump to that address).  On
+ * failure, the previous mmu mode remains and the trap simply returns
+ * as normal with the appropriate error code in RET0.
+ */
+#define HV_FAST_MMU_ENABLE              0x27
+
+/* mmu_unmap_perm_addr()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MMU_UNMAP_PERM_ADDR
+ * ARG0:        virtual address
+ * ARG1:        reserved, must be zero
+ * ARG2:        flags (HV_MMU_{IMMU,DMMU})
+ * RET0:        status
+ * ERRORS:      EINVAL                  Invalid virutal address or flags value
+ *              ENOMAP                  Specified mapping was not found
+ *
+ * Demaps any permanent page mapping (established via
+ * mmu_map_perm_addr()) at the given virtual address for context 0 on
+ * the current virtual CPU.  Any virtual tagged caches are guaranteed
+ * to be kept consistent.
+ */
+#define HV_FAST_MMU_UNMAP_PERM_ADDR     0x28
+
+/* mmu_tsb_ctx0_info()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MMU_TSB_CTX0_INFO
+ * ARG0:        max TSBs
+ * ARG1:        buffer pointer
+ * RET0:        status
+ * RET1:        number of TSBs
+ * ERRORS:      EINVAL                  Supplied buffer is too small
+ *              EBADALIGN               The buffer pointer is badly aligned
+ *              ENORADDR                Invalid real address for buffer pointer
+ *
+ * Return the TSB configuration as previous defined by mmu_tsb_ctx0()
+ * into the provided buffer.  The size of the buffer is given in ARG1
+ * in terms of the number of TSB description entries.
+ *
+ * Upon return, RET1 always contains the number of TSB descriptions
+ * previously configured.  If zero TSBs were configured, EOK is
+ * returned with RET1 containing 0.
+ */
+#define HV_FAST_MMU_TSB_CTX0_INFO       0x29
+
+/* mmu_tsb_ctxnon0_info()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MMU_TSB_CTXNON0_INFO
+ * ARG0:        max TSBs
+ * ARG1:        buffer pointer
+ * RET0:        status
+ * RET1:        number of TSBs
+ * ERRORS:      EINVAL                  Supplied buffer is too small
+ *              EBADALIGN               The buffer pointer is badly aligned
+ *              ENORADDR                Invalid real address for buffer pointer
+ *
+ * Return the TSB configuration as previous defined by
+ * mmu_tsb_ctxnon0() into the provided buffer.  The size of the buffer
+ * is given in ARG1 in terms of the number of TSB description entries.
+ *
+ * Upon return, RET1 always contains the number of TSB descriptions
+ * previously configured.  If zero TSBs were configured, EOK is
+ * returned with RET1 containing 0.
+ */
+#define HV_FAST_MMU_TSB_CTXNON0_INFO    0x2a
+
+/* mmu_fault_area_info()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MMU_FAULT_AREA_INFO
+ * RET0:        status
+ * RET1:        fault area real address
+ * ERRORS:      No errors defined.
+ *
+ * Return the currently defined MMU fault status area for the current
+ * CPU.  The real address of the fault status area is returned in
+ * RET1, or 0 is returned in RET1 if no fault status area is defined.
+ *
+ * Note: mmu_fault_area_conf() may be called with the return value (RET1)
+ *       from this service if there is a need to save and restore the fault
+ *       area for a cpu.
+ */
+#define HV_FAST_MMU_FAULT_AREA_INFO     0x2b
+
+/* Cache and Memory services. */
+
+/* mem_scrub()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MEM_SCRUB
+ * ARG0:        real address
+ * ARG1:        length
+ * RET0:        status
+ * RET1:        length scrubbed
+ * ERRORS:      ENORADDR        Invalid real address
+ *              EBADALIGN       Start address or length are not correctly
+ *                              aligned
+ *              EINVAL          Length is zero
+ *
+ * Zero the memory contents in the range real address to real address
+ * plus length minus 1.  Also, valid ECC will be generated for that
+ * memory address range.  Scrubbing is started at the given real
+ * address, but may not scrub the entire given length.  The actual
+ * length scrubbed will be returned in RET1.
+ *
+ * The real address and length must be aligned on an 8K boundary, or
+ * contain the start address and length from a sun4v error report.
+ *
+ * Note: There are two uses for this function.  The first use is to block clear
+ *       and initialize memory and the second is to scrub an u ncorrectable
+ *       error reported via a resumable or non-resumable trap.  The second
+ *       use requires the arguments to be equal to the real address and length
+ *       provided in a sun4v memory error report.
+ */
+#define HV_FAST_MEM_SCRUB               0x31
+
+/* mem_sync()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MEM_SYNC
+ * ARG0:        real address
+ * ARG1:        length
+ * RET0:        status
+ * RET1:        length synced
+ * ERRORS:      ENORADDR        Invalid real address
+ *              EBADALIGN       Start address or length are not correctly
+ *                              aligned
+ *              EINVAL          Length is zero
+ *
+ * Force the next access within the real address to real address plus
+ * length minus 1 to be fetches from main system memory.  Less than
+ * the given length may be synced, the actual amount synced is
+ * returned in RET1.  The real address and length must be aligned on
+ * an 8K boundary.
+ */
+#define HV_FAST_MEM_SYNC                0x32
+
+/* Time of day services.
+ *
+ * The hypervisor maintains the time of day on a per-domain basis.
+ * Changing the time of day in one domain does not affect the time of
+ * day on any other domain.
+ *
+ * Time is described by a single unsigned 64-bit word which is the
+ * number of seconds since the UNIX Epoch (00:00:00 UTC, January 1,
+ * 1970).
+ */
+
+/* tod_get()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_TOD_GET
+ * RET0:        status
+ * RET1:        TOD
+ * ERRORS:      EWOULDBLOCK     TOD resource is temporarily unavailable
+ *              ENOTSUPPORTED   If TOD not supported on this platform
+ *
+ * Return the current time of day.  May block if TOD access is
+ * temporarily not possible.
+ */
+#define HV_FAST_TOD_GET                 0x50
+
+/* tod_set()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_TOD_SET
+ * ARG0:        TOD
+ * RET0:        status
+ * ERRORS:      EWOULDBLOCK     TOD resource is temporarily unavailable
+ *              ENOTSUPPORTED   If TOD not supported on this platform
+ *
+ * The current time of day is set to the value specified in ARG0.  May
+ * block if TOD access is temporarily not possible.
+ */
+#define HV_FAST_TOD_SET                 0x51
+
+/* Console services */
+
+/* con_getchar()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_CONS_GETCHAR
+ * RET0:        status
+ * RET1:        character
+ * ERRORS:      EWOULDBLOCK     No character available.
+ *
+ * Returns a character from the console device.  If no character is
+ * available then an EWOULDBLOCK error is returned.  If a character is
+ * available, then the returned status is EOK and the character value
+ * is in RET1.
+ *
+ * A virtual BREAK is represented by the 64-bit value -1.
+ *
+ * A virtual HUP signal is represented by the 64-bit value -2.
+ */
+#define HV_FAST_CONS_GETCHAR            0x60
+
+/* con_putchar()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_CONS_PUTCHAR
+ * ARG0:        character
+ * RET0:        status
+ * ERRORS:      EINVAL          Illegal character
+ *              EWOULDBLOCK     Output buffer currently full, would block
+ *
+ * Send a character to the console device.  Only character values
+ * between 0 and 255 may be used.  Values outside this range are
+ * invalid except for the 64-bit value -1 which is used to send a
+ * virtual BREAK.
+ */
+#define HV_FAST_CONS_PUTCHAR            0x61
+
+/* Trap trace services.
+ *
+ * The hypervisor provides a trap tracing capability for privileged
+ * code running on each virtual CPU.  Privileged code provides a
+ * round-robin trap trace queue within which the hypervisor writes
+ * 64-byte entries detailing hyperprivileged traps taken n behalf of
+ * privileged code.  This is provided as a debugging capability for
+ * privileged code.
+ *
+ * The trap trace control structure is 64-bytes long and placed at the
+ * start (offset 0) of the trap trace buffer, and is described as
+ * follows:
+ */
+#ifndef __ASSEMBLY__
+struct hv_trap_trace_control {
+        unsigned long           head_offset;
+        unsigned long           tail_offset;
+        unsigned long           __reserved[0x30 / sizeof(unsigned long)];
+};
+#endif
+#define HV_TRAP_TRACE_CTRL_HEAD_OFFSET  0x00
+#define HV_TRAP_TRACE_CTRL_TAIL_OFFSET  0x08
+
+/* The head offset is the offset of the most recently completed entry
+ * in the trap-trace buffer.  The tail offset is the offset of the
+ * next entry to be written.  The control structure is owned and
+ * modified by the hypervisor.  A guest may not modify the control
+ * structure contents.  Attempts to do so will result in undefined
+ * behavior for the guest.
+ *
+ * Each trap trace buffer entry is layed out as follows:
+ */
+#ifndef __ASSEMBLY__
+struct hv_trap_trace_entry {
+        unsigned char   type;           /* Hypervisor or guest entry?   */
+        unsigned char   hpstate;        /* Hyper-privileged state       */
+        unsigned char   tl;             /* Trap level                   */
+        unsigned char   gl;             /* Global register level        */
+        unsigned short  tt;             /* Trap type                    */
+        unsigned short  tag;            /* Extended trap identifier     */
+        unsigned long   tstate;         /* Trap state                   */
+        unsigned long   tick;           /* Tick                         */
+        unsigned long   tpc;            /* Trap PC                      */
+        unsigned long   f1;             /* Entry specific               */
+        unsigned long   f2;             /* Entry specific               */
+        unsigned long   f3;             /* Entry specific               */
+        unsigned long   f4;             /* Entry specific               */
+};
+#endif
+#define HV_TRAP_TRACE_ENTRY_TYPE        0x00
+#define HV_TRAP_TRACE_ENTRY_HPSTATE     0x01
+#define HV_TRAP_TRACE_ENTRY_TL          0x02
+#define HV_TRAP_TRACE_ENTRY_GL          0x03
+#define HV_TRAP_TRACE_ENTRY_TT          0x04
+#define HV_TRAP_TRACE_ENTRY_TAG         0x06
+#define HV_TRAP_TRACE_ENTRY_TSTATE      0x08
+#define HV_TRAP_TRACE_ENTRY_TICK        0x10
+#define HV_TRAP_TRACE_ENTRY_TPC         0x18
+#define HV_TRAP_TRACE_ENTRY_F1          0x20
+#define HV_TRAP_TRACE_ENTRY_F2          0x28
+#define HV_TRAP_TRACE_ENTRY_F3          0x30
+#define HV_TRAP_TRACE_ENTRY_F4          0x38
+
+/* The type field is encoded as follows.  */
+#define HV_TRAP_TYPE_UNDEF              0x00 /* Entry content undefined     */
+#define HV_TRAP_TYPE_HV                 0x01 /* Hypervisor trap entry       */
+#define HV_TRAP_TYPE_GUEST              0xff /* Added via ttrace_addentry() */
+
+/* ttrace_buf_conf()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_TTRACE_BUF_CONF
+ * ARG0:        real address
+ * ARG1:        number of entries
+ * RET0:        status
+ * RET1:        number of entries
+ * ERRORS:      ENORADDR        Invalid real address
+ *              EINVAL          Size is too small
+ *              EBADALIGN       Real address not aligned on 64-byte boundary
+ *
+ * Requests hypervisor trap tracing and declares a virtual CPU's trap
+ * trace buffer to the hypervisor.  The real address supplies the real
+ * base address of the trap trace queue and must be 64-byte aligned.
+ * Specifying a value of 0 for the number of entries disables trap
+ * tracing for the calling virtual CPU.  The buffer allocated must be
+ * sized for a power of two number of 64-byte trap trace entries plus
+ * an initial 64-byte control structure.
+ * 
+ * This may be invoked any number of times so that a virtual CPU may
+ * relocate a trap trace buffer or create "snapshots" of information.
+ *
+ * If the real address is illegal or badly aligned, then trap tracing
+ * is disabled and an error is returned.
+ *
+ * Upon failure with EINVAL, this service call returns in RET1 the
+ * minimum number of buffer entries required.  Upon other failures
+ * RET1 is undefined.
+ */
+#define HV_FAST_TTRACE_BUF_CONF         0x90
+
+/* ttrace_buf_info()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_TTRACE_BUF_INFO
+ * RET0:        status
+ * RET1:        real address
+ * RET2:        size
+ * ERRORS:      None defined.
+ *
+ * Returns the size and location of the previously declared trap-trace
+ * buffer.  In the event that no buffer was previously defined, or the
+ * buffer is disabled, this call will return a size of zero bytes.
+ */
+#define HV_FAST_TTRACE_BUF_INFO         0x91
+
+/* ttrace_enable()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_TTRACE_ENABLE
+ * ARG0:        enable
+ * RET0:        status
+ * RET1:        previous enable state
+ * ERRORS:      EINVAL          No trap trace buffer currently defined
+ *
+ * Enable or disable trap tracing, and return the previous enabled
+ * state in RET1.  Future systems may define various flags for the
+ * enable argument (ARG0), for the moment a guest should pass
+ * "(uint64_t) -1" to enable, and "(uint64_t) 0" to disable all
+ * tracing - which will ensure future compatability.
+ */
+#define HV_FAST_TTRACE_ENABLE           0x92
+
+/* ttrace_freeze()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_TTRACE_FREEZE
+ * ARG0:        freeze
+ * RET0:        status
+ * RET1:        previous freeze state
+ * ERRORS:      EINVAL          No trap trace buffer currently defined
+ *
+ * Freeze or unfreeze trap tracing, returning the previous freeze
+ * state in RET1.  A guest should pass a non-zero value to freeze and
+ * a zero value to unfreeze all tracing.  The returned previous state
+ * is 0 for not frozen and 1 for frozen.
+ */
+#define HV_FAST_TTRACE_FREEZE           0x93
+
+/* ttrace_addentry()
+ * TRAP:        HV_TTRACE_ADDENTRY_TRAP
+ * ARG0:        tag (16-bits)
+ * ARG1:        data word 0
+ * ARG2:        data word 1
+ * ARG3:        data word 2
+ * ARG4:        data word 3
+ * RET0:        status
+ * ERRORS:      EINVAL          No trap trace buffer currently defined
+ *
+ * Add an entry to the trap trace buffer.  Upon return only ARG0/RET0
+ * is modified - none of the other registers holding arguments are
+ * volatile across this hypervisor service.
+ */
+
+/* Core dump services.
+ *
+ * Since the hypervisor viraulizes and thus obscures a lot of the
+ * physical machine layout and state, traditional OS crash dumps can
+ * be difficult to diagnose especially when the problem is a
+ * configuration error of some sort.
+ *
+ * The dump services provide an opaque buffer into which the
+ * hypervisor can place it's internal state in order to assist in
+ * debugging such situations.  The contents are opaque and extremely
+ * platform and hypervisor implementation specific.  The guest, during
+ * a core dump, requests that the hypervisor update any information in
+ * the dump buffer in preparation to being dumped as part of the
+ * domain's memory image.
+ */
+
+/* dump_buf_update()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_DUMP_BUF_UPDATE
+ * ARG0:        real address
+ * ARG1:        size
+ * RET0:        status
+ * RET1:        required size of dump buffer
+ * ERRORS:      ENORADDR        Invalid real address
+ *              EBADALIGN       Real address is not aligned on a 64-byte
+ *                              boundary
+ *              EINVAL          Size is non-zero but less than minimum size
+ *                              required
+ *              ENOTSUPPORTED   Operation not supported on current logical
+ *                              domain
+ *
+ * Declare a domain dump buffer to the hypervisor.  The real address
+ * provided for the domain dump buffer must be 64-byte aligned.  The
+ * size specifies the size of the dump buffer and may be larger than
+ * the minimum size specified in the machine description.  The
+ * hypervisor will fill the dump buffer with opaque data.
+ *
+ * Note: A guest may elect to include dump buffer contents as part of a crash
+ *       dump to assist with debugging.  This function may be called any number
+ *       of times so that a guest may relocate a dump buffer, or create
+ *       "snapshots" of any dump-buffer information.  Each call to
+ *       dump_buf_update() atomically declares the new dump buffer to the
+ *       hypervisor.
+ *
+ * A specified size of 0 unconfigures the dump buffer.  If the real
+ * address is illegal or badly aligned, then any currently active dump
+ * buffer is disabled and an error is returned.
+ *
+ * In the event that the call fails with EINVAL, RET1 contains the
+ * minimum size requires by the hypervisor for a valid dump buffer.
+ */
+#define HV_FAST_DUMP_BUF_UPDATE         0x94
+
+/* dump_buf_info()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_DUMP_BUF_INFO
+ * RET0:        status
+ * RET1:        real address of current dump buffer
+ * RET2:        size of current dump buffer
+ * ERRORS:      No errors defined.
+ *
+ * Return the currently configures dump buffer description.  A
+ * returned size of 0 bytes indicates an undefined dump buffer.  In
+ * this case the return address in RET1 is undefined.
+ */
+#define HV_FAST_DUMP_BUF_INFO           0x95
+
+/* Device interrupt services.
+ *
+ * Device interrupts are allocated to system bus bridges by the hypervisor,
+ * and described to OBP in the machine description.  OBP then describes
+ * these interrupts to the OS via properties in the device tree.
+ *
+ * Terminology:
+ *
+ *      cpuid           Unique opaque value which represents a target cpu.
+ *
+ *      devhandle       Device handle.  It uniquely identifies a device, and
+ *                      consistes of the lower 28-bits of the hi-cell of the
+ *                      first entry of the device's "reg" property in the
+ *                      OBP device tree.
+ *
+ *      devino          Device interrupt number.  Specifies the relative
+ *                      interrupt number within the device.  The unique
+ *                      combination of devhandle and devino are used to
+ *                      identify a specific device interrupt.
+ *
+ *                      Note: The devino value is the same as the values in the
+ *                            "interrupts" property or "interrupt-map" property
+ *                            in the OBP device tree for that device.
+ *
+ *      sysino          System interrupt number.  A 64-bit unsigned interger
+ *                      representing a unique interrupt within a virtual
+ *                      machine.
+ *
+ *      intr_state      A flag representing the interrupt state for a given
+ *                      sysino.  The state values are defined below.
+ *
+ *      intr_enabled    A flag representing the 'enabled' state for a given
+ *                      sysino.  The enable values are defined below.
+ */
+
+#define HV_INTR_STATE_IDLE              0 /* Nothing pending */
+#define HV_INTR_STATE_RECEIVED          1 /* Interrupt received by hardware */
+#define HV_INTR_STATE_DELIVERED         2 /* Interrupt delivered to queue */
+
+#define HV_INTR_DISABLED                0 /* sysino not enabled */
+#define HV_INTR_ENABLED                 1 /* sysino enabled */
+
+/* intr_devino_to_sysino()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_INTR_DEVINO2SYSINO
+ * ARG0:        devhandle
+ * ARG1:        devino
+ * RET0:        status
+ * RET1:        sysino
+ * ERRORS:      EINVAL          Invalid devhandle/devino
+ *
+ * Converts a device specific interrupt number of the given
+ * devhandle/devino into a system specific ino (sysino).
+ */
+#define HV_FAST_INTR_DEVINO2SYSINO      0xa0
+
+#ifndef __ASSEMBLY__
+extern unsigned long sun4v_devino_to_sysino(unsigned long devhandle,
+                                            unsigned long devino);
+#endif
+
+/* intr_getenabled()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_INTR_GETENABLED
+ * ARG0:        sysino
+ * RET0:        status
+ * RET1:        intr_enabled (HV_INTR_{DISABLED,ENABLED})
+ * ERRORS:      EINVAL          Invalid sysino
+ *
+ * Returns interrupt enabled state in RET1 for the interrupt defined
+ * by the given sysino.
+ */
+#define HV_FAST_INTR_GETENABLED         0xa1
+
+#ifndef __ASSEMBLY__
+extern unsigned long sun4v_intr_getenabled(unsigned long sysino);
+#endif
+
+/* intr_setenabled()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_INTR_SETENABLED
+ * ARG0:        sysino
+ * ARG1:        intr_enabled (HV_INTR_{DISABLED,ENABLED})
+ * RET0:        status
+ * ERRORS:      EINVAL          Invalid sysino or intr_enabled value
+ *
+ * Set the 'enabled' state of the interrupt sysino.
+ */
+#define HV_FAST_INTR_SETENABLED         0xa2
+
+#ifndef __ASSEMBLY__
+extern unsigned long sun4v_intr_setenabled(unsigned long sysino, unsigned long intr_enabled);
+#endif
+
+/* intr_getstate()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_INTR_GETSTATE
+ * ARG0:        sysino
+ * RET0:        status
+ * RET1:        intr_state (HV_INTR_STATE_*)
+ * ERRORS:      EINVAL          Invalid sysino
+ *
+ * Returns current state of the interrupt defined by the given sysino.
+ */
+#define HV_FAST_INTR_GETSTATE           0xa3
+
+#ifndef __ASSEMBLY__
+extern unsigned long sun4v_intr_getstate(unsigned long sysino);
+#endif
+
+/* intr_setstate()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_INTR_SETSTATE
+ * ARG0:        sysino
+ * ARG1:        intr_state (HV_INTR_STATE_*)
+ * RET0:        status
+ * ERRORS:      EINVAL          Invalid sysino or intr_state value
+ *
+ * Sets the current state of the interrupt described by the given sysino
+ * value.
+ *
+ * Note: Setting the state to HV_INTR_STATE_IDLE clears any pending
+ *       interrupt for sysino.
+ */
+#define HV_FAST_INTR_SETSTATE           0xa4
+
+#ifndef __ASSEMBLY__
+extern unsigned long sun4v_intr_setstate(unsigned long sysino, unsigned long intr_state);
+#endif
+
+/* intr_gettarget()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_INTR_GETTARGET
+ * ARG0:        sysino
+ * RET0:        status
+ * RET1:        cpuid
+ * ERRORS:      EINVAL          Invalid sysino
+ *
+ * Returns CPU that is the current target of the interrupt defined by
+ * the given sysino.  The CPU value returned is undefined if the target
+ * has not been set via intr_settarget().
+ */
+#define HV_FAST_INTR_GETTARGET          0xa5
+
+#ifndef __ASSEMBLY__
+extern unsigned long sun4v_intr_gettarget(unsigned long sysino);
+#endif
+
+/* intr_settarget()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_INTR_SETTARGET
+ * ARG0:        sysino
+ * ARG1:        cpuid
+ * RET0:        status
+ * ERRORS:      EINVAL          Invalid sysino
+ *              ENOCPU          Invalid cpuid
+ *
+ * Set the target CPU for the interrupt defined by the given sysino.
+ */
+#define HV_FAST_INTR_SETTARGET          0xa6
+
+#ifndef __ASSEMBLY__
+extern unsigned long sun4v_intr_settarget(unsigned long sysino, unsigned long cpuid);
+#endif
+
+/* PCI IO services.
+ *
+ * See the terminology descriptions in the device interrupt services
+ * section above as those apply here too.  Here are terminology
+ * definitions specific to these PCI IO services:
+ *
+ *      tsbnum          TSB number.  Indentifies which io-tsb is used.
+ *                      For this version of the specification, tsbnum
+ *                      must be zero.
+ *
+ *      tsbindex        TSB index.  Identifies which entry in the TSB
+ *                      is used.  The first entry is zero.
+ *
+ *      tsbid           A 64-bit aligned data structure which contains
+ *                      a tsbnum and a tsbindex.  Bits 63:32 contain the
+ *                      tsbnum and bits 31:00 contain the tsbindex.
+ *
+ *                      Use the HV_PCI_TSBID() macro to construct such
+ *                      values.
+ *
+ *      io_attributes   IO attributes for IOMMU mappings.  One of more
+ *                      of the attritbute bits are stores in a 64-bit
+ *                      value.  The values are defined below.
+ *
+ *      r_addr          64-bit real address
+ *
+ *      pci_device      PCI device address.  A PCI device address identifies
+ *                      a specific device on a specific PCI bus segment.
+ *                      A PCI device address ia a 32-bit unsigned integer
+ *                      with the following format:
+ *
+ *                              00000000.bbbbbbbb.dddddfff.00000000
+ *
+ *                      Use the HV_PCI_DEVICE_BUILD() macro to construct
+ *                      such values.
+ *
+ *      pci_config_offset
+ *                      PCI configureation space offset.  For conventional
+ *                      PCI a value between 0 and 255.  For extended
+ *                      configuration space, a value between 0 and 4095.
+ *
+ *                      Note: For PCI configuration space accesses, the offset
+ *                            must be aligned to the access size.
+ *
+ *      error_flag      A return value which specifies if the action succeeded
+ *                      or failed.  0 means no error, non-0 means some error
+ *                      occurred while performing the service.
+ *
+ *      io_sync_direction
+ *                      Direction definition for pci_dma_sync(), defined
+ *                      below in HV_PCI_SYNC_*.
+ *
+ *      io_page_list    A list of io_page_addresses, an io_page_address is
+ *                      a real address.
+ *
+ *      io_page_list_p  A pointer to an io_page_list.
+ *
+ *      "size based byte swap" - Some functions do size based byte swapping
+ *                               which allows sw to access pointers and
+ *                               counters in native form when the processor
+ *                               operates in a different endianness than the
+ *                               IO bus.  Size-based byte swapping converts a
+ *                               multi-byte field between big-endian and
+ *                               little-endian format.
+ */
+
+#define HV_PCI_MAP_ATTR_READ            0x01
+#define HV_PCI_MAP_ATTR_WRITE           0x02
+
+#define HV_PCI_DEVICE_BUILD(b,d,f)      \
+        ((((b) & 0xff) << 16) | \
+         (((d) & 0x1f) << 11) | \
+         (((f) & 0x07) <<  8))
+
+#define HV_PCI_TSBID(__tsb_num, __tsb_index) \
+        ((((u64)(__tsb_num)) << 32UL) | ((u64)(__tsb_index)))
+
+#define HV_PCI_SYNC_FOR_DEVICE          0x01
+#define HV_PCI_SYNC_FOR_CPU             0x02
+
+/* pci_iommu_map()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_IOMMU_MAP
+ * ARG0:        devhandle
+ * ARG1:        tsbid
+ * ARG2:        #ttes
+ * ARG3:        io_attributes
+ * ARG4:        io_page_list_p
+ * RET0:        status
+ * RET1:        #ttes mapped
+ * ERRORS:      EINVAL          Invalid devhandle/tsbnum/tsbindex/io_attributes
+ *              EBADALIGN       Improperly aligned real address
+ *              ENORADDR        Invalid real address
+ *
+ * Create IOMMU mappings in the sun4v device defined by the given
+ * devhandle.  The mappings are created in the TSB defined by the
+ * tsbnum component of the given tsbid.  The first mapping is created
+ * in the TSB i ndex defined by the tsbindex component of the given tsbid.
+ * The call creates up to #ttes mappings, the first one at tsbnum, tsbindex,
+ * the second at tsbnum, tsbindex + 1, etc.
+ *
+ * All mappings are created with the attributes defined by the io_attributes
+ * argument.  The page mapping addresses are described in the io_page_list
+ * defined by the given io_page_list_p, which is a pointer to the io_page_list.
+ * The first entry in the io_page_list is the address for the first iotte, the
+ * 2nd for the 2nd iotte, and so on.
+ *
+ * Each io_page_address in the io_page_list must be appropriately aligned.
+ * #ttes must be greater than zero.  For this version of the spec, the tsbnum
+ * component of the given tsbid must be zero.
+ *
+ * Returns the actual number of mappings creates, which may be less than
+ * or equal to the argument #ttes.  If the function returns a value which
+ * is less than the #ttes, the caller may continus to call the function with
+ * an updated tsbid, #ttes, io_page_list_p arguments until all pages are
+ * mapped.
+ *
+ * Note: This function does not imply an iotte cache flush.  The guest must
+ *       demap an entry before re-mapping it.
+ */
+#define HV_FAST_PCI_IOMMU_MAP           0xb0
+
+/* pci_iommu_demap()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_IOMMU_DEMAP
+ * ARG0:        devhandle
+ * ARG1:        tsbid
+ * ARG2:        #ttes
+ * RET0:        status
+ * RET1:        #ttes demapped
+ * ERRORS:      EINVAL          Invalid devhandle/tsbnum/tsbindex
+ *
+ * Demap and flush IOMMU mappings in the device defined by the given
+ * devhandle.  Demaps up to #ttes entries in the TSB defined by the tsbnum
+ * component of the given tsbid, starting at the TSB index defined by the
+ * tsbindex component of the given tsbid.
+ *
+ * For this version of the spec, the tsbnum of the given tsbid must be zero.
+ * #ttes must be greater than zero.
+ *
+ * Returns the actual number of ttes demapped, which may be less than or equal
+ * to the argument #ttes.  If #ttes demapped is less than #ttes, the caller
+ * may continue to call this function with updated tsbid and #ttes arguments
+ * until all pages are demapped.
+ *
+ * Note: Entries do not have to be mapped to be demapped.  A demap of an
+ *       unmapped page will flush the entry from the tte cache.
+ */
+#define HV_FAST_PCI_IOMMU_DEMAP         0xb1
+
+/* pci_iommu_getmap()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_IOMMU_GETMAP
+ * ARG0:        devhandle
+ * ARG1:        tsbid
+ * RET0:        status
+ * RET1:        io_attributes
+ * RET2:        real address
+ * ERRORS:      EINVAL          Invalid devhandle/tsbnum/tsbindex
+ *              ENOMAP          Mapping is not valid, no translation exists
+ *
+ * Read and return the mapping in the device described by the given devhandle
+ * and tsbid.  If successful, the io_attributes shall be returned in RET1
+ * and the page address of the mapping shall be returned in RET2.
+ *
+ * For this version of the spec, the tsbnum component of the given tsbid
+ * must be zero.
+ */
+#define HV_FAST_PCI_IOMMU_GETMAP        0xb2
+
+/* pci_iommu_getbypass()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_IOMMU_GETBYPASS
+ * ARG0:        devhandle
+ * ARG1:        real address
+ * ARG2:        io_attributes
+ * RET0:        status
+ * RET1:        io_addr
+ * ERRORS:      EINVAL          Invalid devhandle/io_attributes
+ *              ENORADDR        Invalid real address
+ *              ENOTSUPPORTED   Function not supported in this implementation.
+ *
+ * Create a "special" mapping in the device described by the given devhandle,
+ * for the given real address and attributes.  Return the IO address in RET1
+ * if successful.
+ */
+#define HV_FAST_PCI_IOMMU_GETBYPASS     0xb3
+
+/* pci_config_get()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_CONFIG_GET
+ * ARG0:        devhandle
+ * ARG1:        pci_device
+ * ARG2:        pci_config_offset
+ * ARG3:        size
+ * RET0:        status
+ * RET1:        error_flag
+ * RET2:        data
+ * ERRORS:      EINVAL          Invalid devhandle/pci_device/offset/size
+ *              EBADALIGN       pci_config_offset not size aligned
+ *              ENOACCESS       Access to this offset is not permitted
+ *
+ * Read PCI configuration space for the adapter described by the given
+ * devhandle.  Read size (1, 2, or 4) bytes of data from the given
+ * pci_device, at pci_config_offset from the beginning of the device's
+ * configuration space.  If there was no error, RET1 is set to zero and
+ * RET2 is set to the data read.  Insignificant bits in RET2 are not
+ * guarenteed to have any specific value and therefore must be ignored.
+ *
+ * The data returned in RET2 is size based byte swapped.
+ *
+ * If an error occurs during the read, set RET1 to a non-zero value.  The
+ * given pci_config_offset must be 'size' aligned.
+ */
+#define HV_FAST_PCI_CONFIG_GET          0xb4
+
+/* pci_config_put()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_CONFIG_PUT
+ * ARG0:        devhandle
+ * ARG1:        pci_device
+ * ARG2:        pci_config_offset
+ * ARG3:        size
+ * ARG4:        data
+ * RET0:        status
+ * RET1:        error_flag
+ * ERRORS:      EINVAL          Invalid devhandle/pci_device/offset/size
+ *              EBADALIGN       pci_config_offset not size aligned
+ *              ENOACCESS       Access to this offset is not permitted
+ *
+ * Write PCI configuration space for the adapter described by the given
+ * devhandle.  Write size (1, 2, or 4) bytes of data in a single operation,
+ * at pci_config_offset from the beginning of the device's configuration
+ * space.  The data argument contains the data to be written to configuration
+ * space.  Prior to writing, the data is size based byte swapped.
+ *
+ * If an error occurs during the write access, do not generate an error
+ * report, do set RET1 to a non-zero value.  Otherwise RET1 is zero.
+ * The given pci_config_offset must be 'size' aligned.
+ *
+ * This function is permitted to read from offset zero in the configuration
+ * space described by the given pci_device if necessary to ensure that the
+ * write access to config space completes.
+ */
+#define HV_FAST_PCI_CONFIG_PUT          0xb5
+
+/* pci_peek()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_PEEK
+ * ARG0:        devhandle
+ * ARG1:        real address
+ * ARG2:        size
+ * RET0:        status
+ * RET1:        error_flag
+ * RET2:        data
+ * ERRORS:      EINVAL          Invalid devhandle or size
+ *              EBADALIGN       Improperly aligned real address
+ *              ENORADDR        Bad real address
+ *              ENOACCESS       Guest access prohibited
+ *
+ * Attempt to read the IO address given by the given devhandle, real address,
+ * and size.  Size must be 1, 2, 4, or 8.  The read is performed as a single
+ * access operation using the given size.  If an error occurs when reading
+ * from the given location, do not generate an error report, but return a
+ * non-zero value in RET1.  If the read was successful, return zero in RET1
+ * and return the actual data read in RET2.  The data returned is size based
+ * byte swapped.
+ *
+ * Non-significant bits in RET2 are not guarenteed to have any specific value
+ * and therefore must be ignored.  If RET1 is returned as non-zero, the data 
+ * value is not guarenteed to have any specific value and should be ignored.
+ *
+ * The caller must have permission to read from the given devhandle, real
+ * address, which must be an IO address.  The argument real address must be a
+ * size aligned address.
+ *
+ * The hypervisor implementation of this function must block access to any
+ * IO address that the guest does not have explicit permission to access.
+ */
+#define HV_FAST_PCI_PEEK                0xb6
+
+/* pci_poke()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_POKE
+ * ARG0:        devhandle
+ * ARG1:        real address
+ * ARG2:        size
+ * ARG3:        data
+ * ARG4:        pci_device
+ * RET0:        status
+ * RET1:        error_flag
+ * ERRORS:      EINVAL          Invalid devhandle, size, or pci_device
+ *              EBADALIGN       Improperly aligned real address
+ *              ENORADDR        Bad real address
+ *              ENOACCESS       Guest access prohibited
+ *              ENOTSUPPORTED   Function is not supported by implementation
+ *
+ * Attempt to write data to the IO address given by the given devhandle,
+ * real address, and size.  Size must be 1, 2, 4, or 8.  The write is
+ * performed as a single access operation using the given size. Prior to
+ * writing the data is size based swapped.
+ *
+ * If an error occurs when writing to the given location, do not generate an
+ * error report, but return a non-zero value in RET1.  If the write was
+ * successful, return zero in RET1.
+ *
+ * pci_device describes the configuration address of the device being
+ * written to.  The implementation may safely read from offset 0 with
+ * the configuration space of the device described by devhandle and
+ * pci_device in order to guarantee that the write portion of the operation
+ * completes
+ *
+ * Any error that occurs due to the read shall be reported using the normal
+ * error reporting mechanisms .. the read error is not suppressed.
+ *
+ * The caller must have permission to write to the given devhandle, real
+ * address, which must be an IO address.  The argument real address must be a
+ * size aligned address.  The caller must have permission to read from
+ * the given devhandle, pci_device cofiguration space offset 0.
+ *
+ * The hypervisor implementation of this function must block access to any
+ * IO address that the guest does not have explicit permission to access.
+ */
+#define HV_FAST_PCI_POKE                0xb7
+
+/* pci_dma_sync()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_DMA_SYNC
+ * ARG0:        devhandle
+ * ARG1:        real address
+ * ARG2:        size
+ * ARG3:        io_sync_direction
+ * RET0:        status
+ * RET1:        #synced
+ * ERRORS:      EINVAL          Invalid devhandle or io_sync_direction
+ *              ENORADDR        Bad real address
+ *
+ * Synchronize a memory region described by the given real address and size,
+ * for the device defined by the given devhandle using the direction(s)
+ * defined by the given io_sync_direction.  The argument size is the size of
+ * the memory region in bytes.
+ *
+ * Return the actual number of bytes synchronized in the return value #synced,
+ * which may be less than or equal to the argument size.  If the return
+ * value #synced is less than size, the caller must continue to call this
+ * function with updated real address and size arguments until the entire
+ * memory region is synchronized.
+ */
+#define HV_FAST_PCI_DMA_SYNC            0xb8
+
+/* PCI MSI services.  */
+
+#define HV_MSITYPE_MSI32                0x00
+#define HV_MSITYPE_MSI64                0x01
+
+#define HV_MSIQSTATE_IDLE               0x00
+#define HV_MSIQSTATE_ERROR              0x01
+
+#define HV_MSIQ_INVALID                 0x00
+#define HV_MSIQ_VALID                   0x01
+
+#define HV_MSISTATE_IDLE                0x00
+#define HV_MSISTATE_DELIVERED           0x01
+
+#define HV_MSIVALID_INVALID             0x00
+#define HV_MSIVALID_VALID               0x01
+
+#define HV_PCIE_MSGTYPE_PME_MSG         0x18
+#define HV_PCIE_MSGTYPE_PME_ACK_MSG     0x1b
+#define HV_PCIE_MSGTYPE_CORR_MSG        0x30
+#define HV_PCIE_MSGTYPE_NONFATAL_MSG    0x31
+#define HV_PCIE_MSGTYPE_FATAL_MSG       0x33
+
+#define HV_MSG_INVALID                  0x00
+#define HV_MSG_VALID                    0x01
+
+/* pci_msiq_conf()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSIQ_CONF
+ * ARG0:        devhandle
+ * ARG1:        msiqid
+ * ARG2:        real address
+ * ARG3:        number of entries
+ * RET0:        status
+ * ERRORS:      EINVAL          Invalid devhandle, msiqid or nentries
+ *              EBADALIGN       Improperly aligned real address
+ *              ENORADDR        Bad real address
+ *
+ * Configure the MSI queue given by the devhandle and msiqid arguments,
+ * and to be placed at the given real address and be of the given
+ * number of entries.  The real address must be aligned exactly to match
+ * the queue size.  Each queue entry is 64-bytes long, so f.e. a 32 entry
+ * queue must be aligned on a 2048 byte real address boundary.  The MSI-EQ
+ * Head and Tail are initialized so that the MSI-EQ is 'empty'.
+ *
+ * Implementation Note: Certain implementations have fixed sized queues.  In
+ *                      that case, number of entries must contain the correct
+ *                      value.
+ */
+#define HV_FAST_PCI_MSIQ_CONF           0xc0
+
+/* pci_msiq_info()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSIQ_INFO
+ * ARG0:        devhandle
+ * ARG1:        msiqid
+ * RET0:        status
+ * RET1:        real address
+ * RET2:        number of entries
+ * ERRORS:      EINVAL          Invalid devhandle or msiqid
+ *
+ * Return the configuration information for the MSI queue described
+ * by the given devhandle and msiqid.  The base address of the queue
+ * is returned in ARG1 and the number of entries is returned in ARG2.
+ * If the queue is unconfigured, the real address is undefined and the
+ * number of entries will be returned as zero.
+ */
+#define HV_FAST_PCI_MSIQ_INFO           0xc1
+
+/* pci_msiq_getvalid()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSIQ_GETVALID
+ * ARG0:        devhandle
+ * ARG1:        msiqid
+ * RET0:        status
+ * RET1:        msiqvalid       (HV_MSIQ_VALID or HV_MSIQ_INVALID)
+ * ERRORS:      EINVAL          Invalid devhandle or msiqid
+ *
+ * Get the valid state of the MSI-EQ described by the given devhandle and
+ * msiqid.
+ */
+#define HV_FAST_PCI_MSIQ_GETVALID       0xc2
+
+/* pci_msiq_setvalid()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSIQ_SETVALID
+ * ARG0:        devhandle
+ * ARG1:        msiqid
+ * ARG2:        msiqvalid       (HV_MSIQ_VALID or HV_MSIQ_INVALID)
+ * RET0:        status
+ * ERRORS:      EINVAL          Invalid devhandle or msiqid or msiqvalid
+ *                              value or MSI EQ is uninitialized
+ *
+ * Set the valid state of the MSI-EQ described by the given devhandle and
+ * msiqid to the given msiqvalid.
+ */
+#define HV_FAST_PCI_MSIQ_SETVALID       0xc3
+
+/* pci_msiq_getstate()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSIQ_GETSTATE
+ * ARG0:        devhandle
+ * ARG1:        msiqid
+ * RET0:        status
+ * RET1:        msiqstate       (HV_MSIQSTATE_IDLE or HV_MSIQSTATE_ERROR)
+ * ERRORS:      EINVAL          Invalid devhandle or msiqid
+ *
+ * Get the state of the MSI-EQ described by the given devhandle and
+ * msiqid.
+ */
+#define HV_FAST_PCI_MSIQ_GETSTATE       0xc4
+
+/* pci_msiq_getvalid()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSIQ_GETVALID
+ * ARG0:        devhandle
+ * ARG1:        msiqid
+ * ARG2:        msiqstate       (HV_MSIQSTATE_IDLE or HV_MSIQSTATE_ERROR)
+ * RET0:        status
+ * ERRORS:      EINVAL          Invalid devhandle or msiqid or msiqstate
+ *                              value or MSI EQ is uninitialized
+ *
+ * Set the state of the MSI-EQ described by the given devhandle and
+ * msiqid to the given msiqvalid.
+ */
+#define HV_FAST_PCI_MSIQ_SETSTATE       0xc5
+
+/* pci_msiq_gethead()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSIQ_GETHEAD
+ * ARG0:        devhandle
+ * ARG1:        msiqid
+ * RET0:        status
+ * RET1:        msiqhead
+ * ERRORS:      EINVAL          Invalid devhandle or msiqid
+ *
+ * Get the current MSI EQ queue head for the MSI-EQ described by the
+ * given devhandle and msiqid.
+ */
+#define HV_FAST_PCI_MSIQ_GETHEAD        0xc6
+
+/* pci_msiq_sethead()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSIQ_SETHEAD
+ * ARG0:        devhandle
+ * ARG1:        msiqid
+ * ARG2:        msiqhead
+ * RET0:        status
+ * ERRORS:      EINVAL          Invalid devhandle or msiqid or msiqhead,
+ *                              or MSI EQ is uninitialized
+ *
+ * Set the current MSI EQ queue head for the MSI-EQ described by the
+ * given devhandle and msiqid.
+ */
+#define HV_FAST_PCI_MSIQ_SETHEAD        0xc7
+
+/* pci_msiq_gettail()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSIQ_GETTAIL
+ * ARG0:        devhandle
+ * ARG1:        msiqid
+ * RET0:        status
+ * RET1:        msiqtail
+ * ERRORS:      EINVAL          Invalid devhandle or msiqid
+ *
+ * Get the current MSI EQ queue tail for the MSI-EQ described by the
+ * given devhandle and msiqid.
+ */
+#define HV_FAST_PCI_MSIQ_GETTAIL        0xc8
+
+/* pci_msi_getvalid()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSI_GETVALID
+ * ARG0:        devhandle
+ * ARG1:        msinum
+ * RET0:        status
+ * RET1:        msivalidstate
+ * ERRORS:      EINVAL          Invalid devhandle or msinum
+ *
+ * Get the current valid/enabled state for the MSI defined by the
+ * given devhandle and msinum.
+ */
+#define HV_FAST_PCI_MSI_GETVALID        0xc9
+
+/* pci_msi_setvalid()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSI_SETVALID
+ * ARG0:        devhandle
+ * ARG1:        msinum
+ * ARG2:        msivalidstate
+ * RET0:        status
+ * ERRORS:      EINVAL          Invalid devhandle or msinum or msivalidstate
+ *
+ * Set the current valid/enabled state for the MSI defined by the
+ * given devhandle and msinum.
+ */
+#define HV_FAST_PCI_MSI_SETVALID        0xca
+
+/* pci_msi_getmsiq()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSI_GETMSIQ
+ * ARG0:        devhandle
+ * ARG1:        msinum
+ * RET0:        status
+ * RET1:        msiqid
+ * ERRORS:      EINVAL          Invalid devhandle or msinum or MSI is unbound
+ *
+ * Get the MSI EQ that the MSI defined by the given devhandle and
+ * msinum is bound to.
+ */
+#define HV_FAST_PCI_MSI_GETMSIQ         0xcb
+
+/* pci_msi_setmsiq()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSI_SETMSIQ
+ * ARG0:        devhandle
+ * ARG1:        msinum
+ * ARG2:        msitype
+ * ARG3:        msiqid
+ * RET0:        status
+ * ERRORS:      EINVAL          Invalid devhandle or msinum or msiqid
+ *
+ * Set the MSI EQ that the MSI defined by the given devhandle and
+ * msinum is bound to.
+ */
+#define HV_FAST_PCI_MSI_SETMSIQ         0xcc
+
+/* pci_msi_getstate()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSI_GETSTATE
+ * ARG0:        devhandle
+ * ARG1:        msinum
+ * RET0:        status
+ * RET1:        msistate
+ * ERRORS:      EINVAL          Invalid devhandle or msinum
+ *
+ * Get the state of the MSI defined by the given devhandle and msinum.
+ * If not initialized, return HV_MSISTATE_IDLE.
+ */
+#define HV_FAST_PCI_MSI_GETSTATE        0xcd
+
+/* pci_msi_setstate()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSI_SETSTATE
+ * ARG0:        devhandle
+ * ARG1:        msinum
+ * ARG2:        msistate
+ * RET0:        status
+ * ERRORS:      EINVAL          Invalid devhandle or msinum or msistate
+ *
+ * Set the state of the MSI defined by the given devhandle and msinum.
+ */
+#define HV_FAST_PCI_MSI_SETSTATE        0xce
+
+/* pci_msg_getmsiq()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSG_GETMSIQ
+ * ARG0:        devhandle
+ * ARG1:        msgtype
+ * RET0:        status
+ * RET1:        msiqid
+ * ERRORS:      EINVAL          Invalid devhandle or msgtype
+ *
+ * Get the MSI EQ of the MSG defined by the given devhandle and msgtype.
+ */
+#define HV_FAST_PCI_MSG_GETMSIQ         0xd0
+
+/* pci_msg_setmsiq()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSG_SETMSIQ
+ * ARG0:        devhandle
+ * ARG1:        msgtype
+ * ARG2:        msiqid
+ * RET0:        status
+ * ERRORS:      EINVAL          Invalid devhandle, msgtype, or msiqid
+ *
+ * Set the MSI EQ of the MSG defined by the given devhandle and msgtype.
+ */
+#define HV_FAST_PCI_MSG_SETMSIQ         0xd1
+
+/* pci_msg_getvalid()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSG_GETVALID
+ * ARG0:        devhandle
+ * ARG1:        msgtype
+ * RET0:        status
+ * RET1:        msgvalidstate
+ * ERRORS:      EINVAL          Invalid devhandle or msgtype
+ *
+ * Get the valid/enabled state of the MSG defined by the given
+ * devhandle and msgtype.
+ */
+#define HV_FAST_PCI_MSG_GETVALID        0xd2
+
+/* pci_msg_setvalid()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_PCI_MSG_SETVALID
+ * ARG0:        devhandle
+ * ARG1:        msgtype
+ * ARG2:        msgvalidstate
+ * RET0:        status
+ * ERRORS:      EINVAL          Invalid devhandle or msgtype or msgvalidstate
+ *
+ * Set the valid/enabled state of the MSG defined by the given
+ * devhandle and msgtype.
+ */
+#define HV_FAST_PCI_MSG_SETVALID        0xd3
+
+/* Performance counter services.  */
+
+#define HV_PERF_JBUS_PERF_CTRL_REG      0x00
+#define HV_PERF_JBUS_PERF_CNT_REG       0x01
+#define HV_PERF_DRAM_PERF_CTRL_REG_0    0x02
+#define HV_PERF_DRAM_PERF_CNT_REG_0     0x03
+#define HV_PERF_DRAM_PERF_CTRL_REG_1    0x04
+#define HV_PERF_DRAM_PERF_CNT_REG_1     0x05
+#define HV_PERF_DRAM_PERF_CTRL_REG_2    0x06
+#define HV_PERF_DRAM_PERF_CNT_REG_2     0x07
+#define HV_PERF_DRAM_PERF_CTRL_REG_3    0x08
+#define HV_PERF_DRAM_PERF_CNT_REG_3     0x09
+
+/* get_perfreg()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_GET_PERFREG
+ * ARG0:        performance reg number
+ * RET0:        status
+ * RET1:        performance reg value
+ * ERRORS:      EINVAL          Invalid performance register number
+ *              ENOACCESS       No access allowed to performance counters
+ *
+ * Read the value of the given DRAM/JBUS performance counter/control register.
+ */
+#define HV_FAST_GET_PERFREG             0x100
+
+/* set_perfreg()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_SET_PERFREG
+ * ARG0:        performance reg number
+ * ARG1:        performance reg value
+ * RET0:        status
+ * ERRORS:      EINVAL          Invalid performance register number
+ *              ENOACCESS       No access allowed to performance counters
+ *
+ * Write the given performance reg value to the given DRAM/JBUS
+ * performance counter/control register.
+ */
+#define HV_FAST_SET_PERFREG             0x101
+
+/* MMU statistics services.
+ *
+ * The hypervisor maintains MMU statistics and privileged code provides
+ * a buffer where these statistics can be collected.  It is continually
+ * updated once configured.  The layout is as follows:
+ */
+#ifndef __ASSEMBLY__
+struct hv_mmu_statistics {
+        unsigned long immu_tsb_hits_ctx0_8k_tte;
+        unsigned long immu_tsb_ticks_ctx0_8k_tte;
+        unsigned long immu_tsb_hits_ctx0_64k_tte;
+        unsigned long immu_tsb_ticks_ctx0_64k_tte;
+        unsigned long __reserved1[2];
+        unsigned long immu_tsb_hits_ctx0_4mb_tte;
+        unsigned long immu_tsb_ticks_ctx0_4mb_tte;
+        unsigned long __reserved2[2];
+        unsigned long immu_tsb_hits_ctx0_256mb_tte;
+        unsigned long immu_tsb_ticks_ctx0_256mb_tte;
+        unsigned long __reserved3[4];
+        unsigned long immu_tsb_hits_ctxnon0_8k_tte;
+        unsigned long immu_tsb_ticks_ctxnon0_8k_tte;
+        unsigned long immu_tsb_hits_ctxnon0_64k_tte;
+        unsigned long immu_tsb_ticks_ctxnon0_64k_tte;
+        unsigned long __reserved4[2];
+        unsigned long immu_tsb_hits_ctxnon0_4mb_tte;
+        unsigned long immu_tsb_ticks_ctxnon0_4mb_tte;
+        unsigned long __reserved5[2];
+        unsigned long immu_tsb_hits_ctxnon0_256mb_tte;
+        unsigned long immu_tsb_ticks_ctxnon0_256mb_tte;
+        unsigned long __reserved6[4];
+        unsigned long dmmu_tsb_hits_ctx0_8k_tte;
+        unsigned long dmmu_tsb_ticks_ctx0_8k_tte;
+        unsigned long dmmu_tsb_hits_ctx0_64k_tte;
+        unsigned long dmmu_tsb_ticks_ctx0_64k_tte;
+        unsigned long __reserved7[2];
+        unsigned long dmmu_tsb_hits_ctx0_4mb_tte;
+        unsigned long dmmu_tsb_ticks_ctx0_4mb_tte;
+        unsigned long __reserved8[2];
+        unsigned long dmmu_tsb_hits_ctx0_256mb_tte;
+        unsigned long dmmu_tsb_ticks_ctx0_256mb_tte;
+        unsigned long __reserved9[4];
+        unsigned long dmmu_tsb_hits_ctxnon0_8k_tte;
+        unsigned long dmmu_tsb_ticks_ctxnon0_8k_tte;
+        unsigned long dmmu_tsb_hits_ctxnon0_64k_tte;
+        unsigned long dmmu_tsb_ticks_ctxnon0_64k_tte;
+        unsigned long __reserved10[2];
+        unsigned long dmmu_tsb_hits_ctxnon0_4mb_tte;
+        unsigned long dmmu_tsb_ticks_ctxnon0_4mb_tte;
+        unsigned long __reserved11[2];
+        unsigned long dmmu_tsb_hits_ctxnon0_256mb_tte;
+        unsigned long dmmu_tsb_ticks_ctxnon0_256mb_tte;
+        unsigned long __reserved12[4];
+};
+#endif
+
+/* mmustat_conf()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MMUSTAT_CONF
+ * ARG0:        real address
+ * RET0:        status
+ * RET1:        real address
+ * ERRORS:      ENORADDR        Invalid real address
+ *              EBADALIGN       Real address not aligned on 64-byte boundary
+ *              EBADTRAP        API not supported on this processor
+ *
+ * Enable MMU statistic gathering using the buffer at the given real
+ * address on the current virtual CPU.  The new buffer real address
+ * is given in ARG1, and the previously specified buffer real address
+ * is returned in RET1, or is returned as zero for the first invocation.
+ *
+ * If the passed in real address argument is zero, this will disable
+ * MMU statistic collection on the current virtual CPU.  If an error is
+ * returned then no statistics are collected.
+ *
+ * The buffer contents should be initialized to all zeros before being
+ * given to the hypervisor or else the statistics will be meaningless.
+ */
+#define HV_FAST_MMUSTAT_CONF            0x102
+
+/* mmustat_info()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_MMUSTAT_INFO
+ * RET0:        status
+ * RET1:        real address
+ * ERRORS:      EBADTRAP        API not supported on this processor
+ *
+ * Return the current state and real address of the currently configured
+ * MMU statistics buffer on the current virtual CPU.
+ */
+#define HV_FAST_MMUSTAT_INFO            0x103
+
+/* Function numbers for HV_CORE_TRAP.  */
+#define HV_CORE_VER                     0x00
+#define HV_CORE_PUTCHAR                 0x01
+#define HV_CORE_EXIT                    0x02
+
+#endif /* !(_SPARC64_HYPERVISOR_H) */
diff --git a/include/asm-sparc64/idprom.h b/include/asm-sparc64/idprom.h
index 701483c5465d..77fbf987385f 100644
--- a/include/asm-sparc64/idprom.h
+++ b/include/asm-sparc64/idprom.h
@@ -9,15 +9,7 @@
 
 #include <linux/types.h>
 
-/* Offset into the EEPROM where the id PROM is located on the 4c */
-#define IDPROM_OFFSET  0x7d8
-
-/* On sun4m; physical. */
-/* MicroSPARC(-II) does not decode 31rd bit, but it works. */
-#define IDPROM_OFFSET_M  0xfd8
-
-struct idprom
-{
+struct idprom {
         u8              id_format;      /* Format identifier (always 0x01) */
         u8              id_machtype;    /* Machine type */
         u8              id_ethaddr[6];  /* Hardware ethernet address */
@@ -30,6 +22,4 @@ struct idprom
 extern struct idprom *idprom;
 extern void idprom_init(void);
 
-#define IDPROM_SIZE  (sizeof(struct idprom))
-
 #endif /* !(_SPARC_IDPROM_H) */
diff --git a/include/asm-sparc64/intr_queue.h b/include/asm-sparc64/intr_queue.h
new file mode 100644
index 000000000000..206077dedc2a
--- /dev/null
+++ b/include/asm-sparc64/intr_queue.h
@@ -0,0 +1,15 @@
+#ifndef _SPARC64_INTR_QUEUE_H
+#define _SPARC64_INTR_QUEUE_H
+
+/* Sun4v interrupt queue registers, accessed via ASI_QUEUE.  */
+
+#define INTRQ_CPU_MONDO_HEAD      0x3c0 /* CPU mondo head                 */
+#define INTRQ_CPU_MONDO_TAIL      0x3c8 /* CPU mondo tail                 */
+#define INTRQ_DEVICE_MONDO_HEAD   0x3d0 /* Device mondo head              */
+#define INTRQ_DEVICE_MONDO_TAIL   0x3d8 /* Device mondo tail              */
+#define INTRQ_RESUM_MONDO_HEAD    0x3e0 /* Resumable error mondo head     */
+#define INTRQ_RESUM_MONDO_TAIL    0x3e8 /* Resumable error mondo tail     */
+#define INTRQ_NONRESUM_MONDO_HEAD 0x3f0 /* Non-resumable error mondo head */
+#define INTRQ_NONRESUM_MONDO_TAIL 0x3f8 /* Non-resumable error mondo head */
+
+#endif /* !(_SPARC64_INTR_QUEUE_H) */
diff --git a/include/asm-sparc64/irq.h b/include/asm-sparc64/irq.h
index 8b70edcb80dc..de33d6e1afb5 100644
--- a/include/asm-sparc64/irq.h
+++ b/include/asm-sparc64/irq.h
@@ -72,8 +72,11 @@ struct ino_bucket {
 #define IMAP_VALID              0x80000000      /* IRQ Enabled          */
 #define IMAP_TID_UPA            0x7c000000      /* UPA TargetID         */
 #define IMAP_TID_JBUS           0x7c000000      /* JBUS TargetID        */
+#define IMAP_TID_SHIFT          26
 #define IMAP_AID_SAFARI         0x7c000000      /* Safari AgentID       */
+#define IMAP_AID_SHIFT          26
 #define IMAP_NID_SAFARI         0x03e00000      /* Safari NodeID        */
+#define IMAP_NID_SHIFT          21
 #define IMAP_IGN                0x000007c0      /* IRQ Group Number     */
 #define IMAP_INO                0x0000003f      /* IRQ Number           */
 #define IMAP_INR                0x000007ff      /* Full interrupt number*/
@@ -111,6 +114,7 @@ extern void disable_irq(unsigned int);
 #define disable_irq_nosync disable_irq
 extern void enable_irq(unsigned int);
 extern unsigned int build_irq(int pil, int inofixup, unsigned long iclr, unsigned long imap);
+extern unsigned int sun4v_build_irq(u32 devhandle, unsigned int devino, int pil, unsigned char flags);
 extern unsigned int sbus_build_irq(void *sbus, unsigned int ino);
 
 static __inline__ void set_softint(unsigned long bits)
diff --git a/include/asm-sparc64/mmu.h b/include/asm-sparc64/mmu.h
index 8627eed6e83d..230ba678d3b0 100644
--- a/include/asm-sparc64/mmu.h
+++ b/include/asm-sparc64/mmu.h
@@ -4,20 +4,9 @@
 #include <linux/config.h>
 #include <asm/page.h>
 #include <asm/const.h>
+#include <asm/hypervisor.h>
 
-/*
- * For the 8k pagesize kernel, use only 10 hw context bits to optimize some
- * shifts in the fast tlbmiss handlers, instead of all 13 bits (specifically
- * for vpte offset calculation). For other pagesizes, this optimization in
- * the tlbhandlers can not be done; but still, all 13 bits can not be used
- * because the tlb handlers use "andcc" instruction which sign extends 13
- * bit arguments.
- */
-#if PAGE_SHIFT == 13
-#define CTX_NR_BITS             10
-#else
-#define CTX_NR_BITS             12
-#endif
+#define CTX_NR_BITS             13
 
 #define TAG_CONTEXT_BITS        ((_AC(1,UL) << CTX_NR_BITS) - _AC(1,UL))
 
@@ -90,8 +79,27 @@
 
 #ifndef __ASSEMBLY__
 
+#define TSB_ENTRY_ALIGNMENT     16
+
+struct tsb {
+        unsigned long tag;
+        unsigned long pte;
+} __attribute__((aligned(TSB_ENTRY_ALIGNMENT)));
+
+extern void __tsb_insert(unsigned long ent, unsigned long tag, unsigned long pte);
+extern void tsb_flush(unsigned long ent, unsigned long tag);
+extern void tsb_init(struct tsb *tsb, unsigned long size);
+
 typedef struct {
-        unsigned long   sparc64_ctx_val;
+        spinlock_t              lock;
+        unsigned long           sparc64_ctx_val;
+        struct tsb              *tsb;
+        unsigned long           tsb_rss_limit;
+        unsigned long           tsb_nentries;
+        unsigned long           tsb_reg_val;
+        unsigned long           tsb_map_vaddr;
+        unsigned long           tsb_map_pte;
+        struct hv_tsb_descr     tsb_descr;
 } mm_context_t;
 
 #endif /* !__ASSEMBLY__ */
diff --git a/include/asm-sparc64/mmu_context.h b/include/asm-sparc64/mmu_context.h
index 57ee7b306189..e7974321d052 100644
--- a/include/asm-sparc64/mmu_context.h
+++ b/include/asm-sparc64/mmu_context.h
@@ -19,96 +19,98 @@ extern unsigned long tlb_context_cache;
 extern unsigned long mmu_context_bmap[];
 
 extern void get_new_mmu_context(struct mm_struct *mm);
+#ifdef CONFIG_SMP
+extern void smp_new_mmu_context_version(void);
+#else
+#define smp_new_mmu_context_version() do { } while (0)
+#endif
+
+extern int init_new_context(struct task_struct *tsk, struct mm_struct *mm);
+extern void destroy_context(struct mm_struct *mm);
+
+extern void __tsb_context_switch(unsigned long pgd_pa,
+                                 unsigned long tsb_reg,
+                                 unsigned long tsb_vaddr,
+                                 unsigned long tsb_pte,
+                                 unsigned long tsb_descr_pa);
+
+static inline void tsb_context_switch(struct mm_struct *mm)
+{
+        __tsb_context_switch(__pa(mm->pgd), mm->context.tsb_reg_val,
+                             mm->context.tsb_map_vaddr,
+                             mm->context.tsb_map_pte,
+                             __pa(&mm->context.tsb_descr));
+}
 
-/* Initialize a new mmu context.  This is invoked when a new
- * address space instance (unique or shared) is instantiated.
- * This just needs to set mm->context to an invalid context.
- */
-#define init_new_context(__tsk, __mm)   \
-        (((__mm)->context.sparc64_ctx_val = 0UL), 0)
-
-/* Destroy a dead context.  This occurs when mmput drops the
- * mm_users count to zero, the mmaps have been released, and
- * all the page tables have been flushed.  Our job is to destroy
- * any remaining processor-specific state, and in the sparc64
- * case this just means freeing up the mmu context ID held by
- * this task if valid.
- */
-#define destroy_context(__mm)                                   \
-do {    spin_lock(&ctx_alloc_lock);                             \
-        if (CTX_VALID((__mm)->context)) {                       \
-                unsigned long nr = CTX_NRBITS((__mm)->context); \
-                mmu_context_bmap[nr>>6] &= ~(1UL << (nr & 63)); \
-        }                                                       \
-        spin_unlock(&ctx_alloc_lock);                           \
-} while(0)
-
-/* Reload the two core values used by TLB miss handler
- * processing on sparc64.  They are:
- * 1) The physical address of mm->pgd, when full page
- *    table walks are necessary, this is where the
- *    search begins.
- * 2) A "PGD cache".  For 32-bit tasks only pgd[0] is
- *    ever used since that maps the entire low 4GB
- *    completely.  To speed up TLB miss processing we
- *    make this value available to the handlers.  This
- *    decreases the amount of memory traffic incurred.
- */
-#define reload_tlbmiss_state(__tsk, __mm) \
-do { \
-        register unsigned long paddr asm("o5"); \
-        register unsigned long pgd_cache asm("o4"); \
-        paddr = __pa((__mm)->pgd); \
-        pgd_cache = 0UL; \
-        if (task_thread_info(__tsk)->flags & _TIF_32BIT) \
-                pgd_cache = get_pgd_cache((__mm)->pgd); \
-        __asm__ __volatile__("wrpr      %%g0, 0x494, %%pstate\n\t" \
-                             "mov       %3, %%g4\n\t" \
-                             "mov       %0, %%g7\n\t" \
-                             "stxa      %1, [%%g4] %2\n\t" \
-                             "membar    #Sync\n\t" \
-                             "wrpr      %%g0, 0x096, %%pstate" \
-                             : /* no outputs */ \
-                             : "r" (paddr), "r" (pgd_cache),\
-                               "i" (ASI_DMMU), "i" (TSB_REG)); \
-} while(0)
+extern void tsb_grow(struct mm_struct *mm, unsigned long mm_rss);
+#ifdef CONFIG_SMP
+extern void smp_tsb_sync(struct mm_struct *mm);
+#else
+#define smp_tsb_sync(__mm) do { } while (0)
+#endif
 
 /* Set MMU context in the actual hardware. */
 #define load_secondary_context(__mm) \
-        __asm__ __volatile__("stxa      %0, [%1] %2\n\t" \
-                             "flush     %%g6" \
-                             : /* No outputs */ \
-                             : "r" (CTX_HWBITS((__mm)->context)), \
-                               "r" (SECONDARY_CONTEXT), "i" (ASI_DMMU))
+        __asm__ __volatile__( \
+        "\n661: stxa            %0, [%1] %2\n" \
+        "       .section        .sun4v_1insn_patch, \"ax\"\n" \
+        "       .word           661b\n" \
+        "       stxa            %0, [%1] %3\n" \
+        "       .previous\n" \
+        "       flush           %%g6\n" \
+        : /* No outputs */ \
+        : "r" (CTX_HWBITS((__mm)->context)), \
+          "r" (SECONDARY_CONTEXT), "i" (ASI_DMMU), "i" (ASI_MMU))
 
 extern void __flush_tlb_mm(unsigned long, unsigned long);
 
-/* Switch the current MM context. */
+/* Switch the current MM context.  Interrupts are disabled.  */
 static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, struct task_struct *tsk)
 {
-        unsigned long ctx_valid;
+        unsigned long ctx_valid, flags;
         int cpu;
 
-        /* Note: page_table_lock is used here to serialize switch_mm
-         * and activate_mm, and their calls to get_new_mmu_context.
-         * This use of page_table_lock is unrelated to its other uses.
-         */ 
-        spin_lock(&mm->page_table_lock);
+        spin_lock_irqsave(&mm->context.lock, flags);
         ctx_valid = CTX_VALID(mm->context);
         if (!ctx_valid)
                 get_new_mmu_context(mm);
-        spin_unlock(&mm->page_table_lock);
 
-        if (!ctx_valid || (old_mm != mm)) {
-                load_secondary_context(mm);
-                reload_tlbmiss_state(tsk, mm);
-        }
+        /* We have to be extremely careful here or else we will miss
+         * a TSB grow if we switch back and forth between a kernel
+         * thread and an address space which has it's TSB size increased
+         * on another processor.
+         *
+         * It is possible to play some games in order to optimize the
+         * switch, but the safest thing to do is to unconditionally
+         * perform the secondary context load and the TSB context switch.
+         *
+         * For reference the bad case is, for address space "A":
+         *
+         *              CPU 0                   CPU 1
+         *      run address space A
+         *      set cpu0's bits in cpu_vm_mask
+         *      switch to kernel thread, borrow
+         *      address space A via entry_lazy_tlb
+         *                                      run address space A
+         *                                      set cpu1's bit in cpu_vm_mask
+         *                                      flush_tlb_pending()
+         *                                      reset cpu_vm_mask to just cpu1
+         *                                      TSB grow
+         *      run address space A
+         *      context was valid, so skip
+         *      TSB context switch
+         *
+         * At that point cpu0 continues to use a stale TSB, the one from
+         * before the TSB grow performed on cpu1.  cpu1 did not cross-call
+         * cpu0 to update it's TSB because at that point the cpu_vm_mask
+         * only had cpu1 set in it.
+         */
+        load_secondary_context(mm);
+        tsb_context_switch(mm);
 
-        /* Even if (mm == old_mm) we _must_ check
-         * the cpu_vm_mask.  If we do not we could
-         * corrupt the TLB state because of how
-         * smp_flush_tlb_{page,range,mm} on sparc64
-         * and lazy tlb switches work. -DaveM
+        /* Any time a processor runs a context on an address space
+         * for the first time, we must flush that context out of the
+         * local TLB.
          */
         cpu = smp_processor_id();
         if (!ctx_valid || !cpu_isset(cpu, mm->cpu_vm_mask)) {
@@ -116,6 +118,7 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str
                 __flush_tlb_mm(CTX_HWBITS(mm->context),
                                SECONDARY_CONTEXT);
         }
+        spin_unlock_irqrestore(&mm->context.lock, flags);
 }
 
 #define deactivate_mm(tsk,mm)   do { } while (0)
@@ -123,23 +126,20 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str
 /* Activate a new MM instance for the current task. */
 static inline void activate_mm(struct mm_struct *active_mm, struct mm_struct *mm)
 {
+        unsigned long flags;
         int cpu;
 
-        /* Note: page_table_lock is used here to serialize switch_mm
-         * and activate_mm, and their calls to get_new_mmu_context.
-         * This use of page_table_lock is unrelated to its other uses.
-         */ 
-        spin_lock(&mm->page_table_lock);
+        spin_lock_irqsave(&mm->context.lock, flags);
         if (!CTX_VALID(mm->context))
                 get_new_mmu_context(mm);
         cpu = smp_processor_id();
         if (!cpu_isset(cpu, mm->cpu_vm_mask))
                 cpu_set(cpu, mm->cpu_vm_mask);
-        spin_unlock(&mm->page_table_lock);
 
         load_secondary_context(mm);
         __flush_tlb_mm(CTX_HWBITS(mm->context), SECONDARY_CONTEXT);
-        reload_tlbmiss_state(current, mm);
+        tsb_context_switch(mm);
+        spin_unlock_irqrestore(&mm->context.lock, flags);
 }
 
 #endif /* !(__ASSEMBLY__) */
diff --git a/include/asm-sparc64/numnodes.h b/include/asm-sparc64/numnodes.h
new file mode 100644
index 000000000000..017e7e74f5e7
--- /dev/null
+++ b/include/asm-sparc64/numnodes.h
@@ -0,0 +1,6 @@
+#ifndef _SPARC64_NUMNODES_H
+#define _SPARC64_NUMNODES_H
+
+#define NODES_SHIFT     0
+
+#endif /* !(_SPARC64_NUMNODES_H) */
diff --git a/include/asm-sparc64/oplib.h b/include/asm-sparc64/oplib.h
index 3c59b2693fb9..c754676e13ef 100644
--- a/include/asm-sparc64/oplib.h
+++ b/include/asm-sparc64/oplib.h
@@ -12,18 +12,8 @@
 #include <linux/config.h>
 #include <asm/openprom.h>
 
-/* Enumeration to describe the prom major version we have detected. */
-enum prom_major_version {
-        PROM_V0,      /* Original sun4c V0 prom */
-        PROM_V2,      /* sun4c and early sun4m V2 prom */
-        PROM_V3,      /* sun4m and later, up to sun4d/sun4e machines V3 */
-        PROM_P1275,   /* IEEE compliant ISA based Sun PROM, only sun4u */
-        PROM_AP1000,  /* actually no prom at all */
-};
-
-extern enum prom_major_version prom_vers;
-/* Revision, and firmware revision. */
-extern unsigned int prom_rev, prom_prev;
+/* OBP version string. */
+extern char prom_version[];
 
 /* Root node of the prom device tree, this stays constant after
  * initialization is complete.
@@ -39,6 +29,9 @@ extern int prom_stdin, prom_stdout;
 extern int prom_chosen_node;
 
 /* Helper values and strings in arch/sparc64/kernel/head.S */
+extern const char prom_peer_name[];
+extern const char prom_compatible_name[];
+extern const char prom_root_compatible[];
 extern const char prom_finddev_name[];
 extern const char prom_chosen_path[];
 extern const char prom_getprop_name[];
@@ -130,15 +123,6 @@ extern void prom_setcallback(callback_func_t func_ptr);
  */
 extern unsigned char prom_get_idprom(char *idp_buffer, int idpbuf_size);
 
-/* Get the prom major version. */
-extern int prom_version(void);
-
-/* Get the prom plugin revision. */
-extern int prom_getrev(void);
-
-/* Get the prom firmware revision. */
-extern int prom_getprev(void);
-
 /* Character operations to/from the console.... */
 
 /* Non-blocking get character from console. */
@@ -164,6 +148,7 @@ enum prom_input_device {
         PROMDEV_ITTYA,                  /* input from ttya */
         PROMDEV_ITTYB,                  /* input from ttyb */
         PROMDEV_IRSC,                   /* input from rsc */
+        PROMDEV_IVCONS,                 /* input from virtual-console */
         PROMDEV_I_UNK,
 };
 
@@ -176,6 +161,7 @@ enum prom_output_device {
         PROMDEV_OTTYA,                  /* to ttya */
         PROMDEV_OTTYB,                  /* to ttyb */
         PROMDEV_ORSC,                   /* to rsc */
+        PROMDEV_OVCONS,                 /* to virtual-console */
         PROMDEV_O_UNK,
 };
 
@@ -183,10 +169,18 @@ extern enum prom_output_device prom_query_output_device(void);
 
 /* Multiprocessor operations... */
 #ifdef CONFIG_SMP
-/* Start the CPU with the given device tree node, context table, and context
- * at the passed program counter.
+/* Start the CPU with the given device tree node at the passed program
+ * counter with the given arg passed in via register %o0.
+ */
+extern void prom_startcpu(int cpunode, unsigned long pc, unsigned long arg);
+
+/* Start the CPU with the given cpu ID at the passed program
+ * counter with the given arg passed in via register %o0.
  */
-extern void prom_startcpu(int cpunode, unsigned long pc, unsigned long o0);
+extern void prom_startcpu_cpuid(int cpuid, unsigned long pc, unsigned long arg);
+
+/* Stop the CPU with the given cpu ID.  */
+extern void prom_stopcpu_cpuid(int cpuid);
 
 /* Stop the current CPU. */
 extern void prom_stopself(void);
@@ -335,6 +329,7 @@ int cpu_find_by_mid(int mid, int *prom_node);
 
 /* Client interface level routines. */
 extern void prom_set_trap_table(unsigned long tba);
+extern void prom_set_trap_table_sun4v(unsigned long tba, unsigned long mmfsa);
 
 extern long p1275_cmd(const char *, long, ...);
                                    
diff --git a/include/asm-sparc64/page.h b/include/asm-sparc64/page.h
index 5426bb28a993..fcb2812265f4 100644
--- a/include/asm-sparc64/page.h
+++ b/include/asm-sparc64/page.h
@@ -104,10 +104,12 @@ typedef unsigned long pgprot_t;
 #define HUGETLB_PAGE_ORDER      (HPAGE_SHIFT - PAGE_SHIFT)
 #define ARCH_HAS_SETCLEAR_HUGE_PTE
 #define ARCH_HAS_HUGETLB_PREFAULT_HOOK
+#define HAVE_ARCH_HUGETLB_UNMAPPED_AREA
 #endif
 
 #define TASK_UNMAPPED_BASE      (test_thread_flag(TIF_32BIT) ? \
-                                 (_AC(0x0000000070000000,UL)) : (PAGE_OFFSET))
+                                 (_AC(0x0000000070000000,UL)) : \
+                                 (_AC(0xfffff80000000000,UL) + (1UL << 32UL)))
 
 #endif /* !(__ASSEMBLY__) */
 
@@ -124,17 +126,10 @@ typedef unsigned long pgprot_t;
 #define __pa(x)                 ((unsigned long)(x) - PAGE_OFFSET)
 #define __va(x)                 ((void *)((unsigned long) (x) + PAGE_OFFSET))
 
-/* PFNs are real physical page numbers.  However, mem_map only begins to record
- * per-page information starting at pfn_base.  This is to handle systems where
- * the first physical page in the machine is at some huge physical address,
- * such as 4GB.   This is common on a partitioned E10000, for example.
- */
-extern struct page *pfn_to_page(unsigned long pfn);
-extern unsigned long page_to_pfn(struct page *);
+#define pfn_to_kaddr(pfn)       __va((pfn) << PAGE_SHIFT)
 
 #define virt_to_page(kaddr)     pfn_to_page(__pa(kaddr)>>PAGE_SHIFT)
 
-#define pfn_valid(pfn)          (((pfn)-(pfn_base)) < max_mapnr)
 #define virt_addr_valid(kaddr)  pfn_valid(__pa(kaddr) >> PAGE_SHIFT)
 
 #define virt_to_phys __pa
diff --git a/include/asm-sparc64/pbm.h b/include/asm-sparc64/pbm.h
index dd35a2c7798a..1396f110939a 100644
--- a/include/asm-sparc64/pbm.h
+++ b/include/asm-sparc64/pbm.h
@@ -139,6 +139,9 @@ struct pci_pbm_info {
         /* Opaque 32-bit system bus Port ID. */
         u32                             portid;
 
+        /* Opaque 32-bit handle used for hypervisor calls.  */
+        u32                             devhandle;
+
         /* Chipset version information. */
         int                             chip_type;
 #define PBM_CHIP_TYPE_SABRE             1
diff --git a/include/asm-sparc64/pci.h b/include/asm-sparc64/pci.h
index 89bd71b1c0d8..7c5a589ea437 100644
--- a/include/asm-sparc64/pci.h
+++ b/include/asm-sparc64/pci.h
@@ -41,10 +41,26 @@ static inline void pcibios_penalize_isa_irq(int irq, int active)
 
 struct pci_dev;
 
+struct pci_iommu_ops {
+        void *(*alloc_consistent)(struct pci_dev *, size_t, dma_addr_t *);
+        void (*free_consistent)(struct pci_dev *, size_t, void *, dma_addr_t);
+        dma_addr_t (*map_single)(struct pci_dev *, void *, size_t, int);
+        void (*unmap_single)(struct pci_dev *, dma_addr_t, size_t, int);
+        int (*map_sg)(struct pci_dev *, struct scatterlist *, int, int);
+        void (*unmap_sg)(struct pci_dev *, struct scatterlist *, int, int);
+        void (*dma_sync_single_for_cpu)(struct pci_dev *, dma_addr_t, size_t, int);
+        void (*dma_sync_sg_for_cpu)(struct pci_dev *, struct scatterlist *, int, int);
+};
+
+extern struct pci_iommu_ops *pci_iommu_ops;
+
 /* Allocate and map kernel buffer using consistent mode DMA for a device.
  * hwdev should be valid struct pci_dev pointer for PCI devices.
  */
-extern void *pci_alloc_consistent(struct pci_dev *hwdev, size_t size, dma_addr_t *dma_handle);
+static inline void *pci_alloc_consistent(struct pci_dev *hwdev, size_t size, dma_addr_t *dma_handle)
+{
+        return pci_iommu_ops->alloc_consistent(hwdev, size, dma_handle);
+}
 
 /* Free and unmap a consistent DMA buffer.
  * cpu_addr is what was returned from pci_alloc_consistent,
@@ -54,7 +70,10 @@ extern void *pci_alloc_consistent(struct pci_dev *hwdev, size_t size, dma_addr_t
  * References to the memory and mappings associated with cpu_addr/dma_addr
  * past this call are illegal.
  */
-extern void pci_free_consistent(struct pci_dev *hwdev, size_t size, void *vaddr, dma_addr_t dma_handle);
+static inline void pci_free_consistent(struct pci_dev *hwdev, size_t size, void *vaddr, dma_addr_t dma_handle)
+{
+        return pci_iommu_ops->free_consistent(hwdev, size, vaddr, dma_handle);
+}
 
 /* Map a single buffer of the indicated size for DMA in streaming mode.
  * The 32-bit bus address to use is returned.
@@ -62,7 +81,10 @@ extern void pci_free_consistent(struct pci_dev *hwdev, size_t size, void *vaddr,
  * Once the device is given the dma address, the device owns this memory
  * until either pci_unmap_single or pci_dma_sync_single_for_cpu is performed.
  */
-extern dma_addr_t pci_map_single(struct pci_dev *hwdev, void *ptr, size_t size, int direction);
+static inline dma_addr_t pci_map_single(struct pci_dev *hwdev, void *ptr, size_t size, int direction)
+{
+        return pci_iommu_ops->map_single(hwdev, ptr, size, direction);
+}
 
 /* Unmap a single streaming mode DMA translation.  The dma_addr and size
  * must match what was provided for in a previous pci_map_single call.  All
@@ -71,7 +93,10 @@ extern dma_addr_t pci_map_single(struct pci_dev *hwdev, void *ptr, size_t size,
  * After this call, reads by the cpu to the buffer are guaranteed to see
  * whatever the device wrote there.
  */
-extern void pci_unmap_single(struct pci_dev *hwdev, dma_addr_t dma_addr, size_t size, int direction);
+static inline void pci_unmap_single(struct pci_dev *hwdev, dma_addr_t dma_addr, size_t size, int direction)
+{
+        pci_iommu_ops->unmap_single(hwdev, dma_addr, size, direction);
+}
 
 /* No highmem on sparc64, plus we have an IOMMU, so mapping pages is easy. */
 #define pci_map_page(dev, page, off, size, dir) \
@@ -107,15 +132,19 @@ extern void pci_unmap_single(struct pci_dev *hwdev, dma_addr_t dma_addr, size_t
  * Device ownership issues as mentioned above for pci_map_single are
  * the same here.
  */
-extern int pci_map_sg(struct pci_dev *hwdev, struct scatterlist *sg,
-                      int nents, int direction);
+static inline int pci_map_sg(struct pci_dev *hwdev, struct scatterlist *sg, int nents, int direction)
+{
+        return pci_iommu_ops->map_sg(hwdev, sg, nents, direction);
+}
 
 /* Unmap a set of streaming mode DMA translations.
  * Again, cpu read rules concerning calls here are the same as for
  * pci_unmap_single() above.
  */
-extern void pci_unmap_sg(struct pci_dev *hwdev, struct scatterlist *sg,
-                         int nhwents, int direction);
+static inline void pci_unmap_sg(struct pci_dev *hwdev, struct scatterlist *sg, int nhwents, int direction)
+{
+        pci_iommu_ops->unmap_sg(hwdev, sg, nhwents, direction);
+}
 
 /* Make physical memory consistent for a single
  * streaming mode DMA translation after a transfer.
@@ -127,8 +156,10 @@ extern void pci_unmap_sg(struct pci_dev *hwdev, struct scatterlist *sg,
  * must first perform a pci_dma_sync_for_device, and then the
  * device again owns the buffer.
  */
-extern void pci_dma_sync_single_for_cpu(struct pci_dev *hwdev, dma_addr_t dma_handle,
-                                        size_t size, int direction);
+static inline void pci_dma_sync_single_for_cpu(struct pci_dev *hwdev, dma_addr_t dma_handle, size_t size, int direction)
+{
+        pci_iommu_ops->dma_sync_single_for_cpu(hwdev, dma_handle, size, direction);
+}
 
 static inline void
 pci_dma_sync_single_for_device(struct pci_dev *hwdev, dma_addr_t dma_handle,
@@ -144,7 +175,10 @@ pci_dma_sync_single_for_device(struct pci_dev *hwdev, dma_addr_t dma_handle,
  * The same as pci_dma_sync_single_* but for a scatter-gather list,
  * same rules and usage.
  */
-extern void pci_dma_sync_sg_for_cpu(struct pci_dev *hwdev, struct scatterlist *sg, int nelems, int direction);
+static inline void pci_dma_sync_sg_for_cpu(struct pci_dev *hwdev, struct scatterlist *sg, int nelems, int direction)
+{
+        pci_iommu_ops->dma_sync_sg_for_cpu(hwdev, sg, nelems, direction);
+}
 
 static inline void
 pci_dma_sync_sg_for_device(struct pci_dev *hwdev, struct scatterlist *sg,
diff --git a/include/asm-sparc64/pgalloc.h b/include/asm-sparc64/pgalloc.h
index a96067cca963..12e4a273bd43 100644
--- a/include/asm-sparc64/pgalloc.h
+++ b/include/asm-sparc64/pgalloc.h
@@ -6,6 +6,7 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
+#include <linux/slab.h>
 
 #include <asm/spitfire.h>
 #include <asm/cpudata.h>
@@ -13,172 +14,59 @@
 #include <asm/page.h>
 
 /* Page table allocation/freeing. */
-#ifdef CONFIG_SMP
-/* Sliiiicck */
-#define pgt_quicklists  local_cpu_data()
-#else
-extern struct pgtable_cache_struct {
-        unsigned long *pgd_cache;
-        unsigned long *pte_cache[2];
-        unsigned int pgcache_size;
-} pgt_quicklists;
-#endif
-#define pgd_quicklist           (pgt_quicklists.pgd_cache)
-#define pmd_quicklist           ((unsigned long *)0)
-#define pte_quicklist           (pgt_quicklists.pte_cache)
-#define pgtable_cache_size      (pgt_quicklists.pgcache_size)
+extern kmem_cache_t *pgtable_cache;
 
-static __inline__ void free_pgd_fast(pgd_t *pgd)
+static inline pgd_t *pgd_alloc(struct mm_struct *mm)
 {
-        preempt_disable();
-        *(unsigned long *)pgd = (unsigned long) pgd_quicklist;
-        pgd_quicklist = (unsigned long *) pgd;
-        pgtable_cache_size++;
-        preempt_enable();
+        return kmem_cache_alloc(pgtable_cache, GFP_KERNEL);
 }
 
-static __inline__ pgd_t *get_pgd_fast(void)
+static inline void pgd_free(pgd_t *pgd)
 {
-        unsigned long *ret;
-
-        preempt_disable();
-        if((ret = pgd_quicklist) != NULL) {
-                pgd_quicklist = (unsigned long *)(*ret);
-                ret[0] = 0;
-                pgtable_cache_size--;
-                preempt_enable();
-        } else {
-                preempt_enable();
-                ret = (unsigned long *) __get_free_page(GFP_KERNEL|__GFP_REPEAT);
-                if(ret)
-                        memset(ret, 0, PAGE_SIZE);
-        }
-        return (pgd_t *)ret;
+        kmem_cache_free(pgtable_cache, pgd);
 }
 
-static __inline__ void free_pgd_slow(pgd_t *pgd)
-{
-        free_page((unsigned long)pgd);
-}
-
-#ifdef DCACHE_ALIASING_POSSIBLE
-#define VPTE_COLOR(address)             (((address) >> (PAGE_SHIFT + 10)) & 1UL)
-#define DCACHE_COLOR(address)           (((address) >> PAGE_SHIFT) & 1UL)
-#else
-#define VPTE_COLOR(address)             0
-#define DCACHE_COLOR(address)           0
-#endif
-
 #define pud_populate(MM, PUD, PMD)      pud_set(PUD, PMD)
 
-static __inline__ pmd_t *pmd_alloc_one_fast(struct mm_struct *mm, unsigned long address)
+static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
-        unsigned long *ret;
-        int color = 0;
-
-        preempt_disable();
-        if (pte_quicklist[color] == NULL)
-                color = 1;
-
-        if((ret = (unsigned long *)pte_quicklist[color]) != NULL) {
-                pte_quicklist[color] = (unsigned long *)(*ret);
-                ret[0] = 0;
-                pgtable_cache_size--;
-        }
-        preempt_enable();
-
-        return (pmd_t *)ret;
+        return kmem_cache_alloc(pgtable_cache,
+                                GFP_KERNEL|__GFP_REPEAT);
 }
 
-static __inline__ pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
+static inline void pmd_free(pmd_t *pmd)
 {
-        pmd_t *pmd;
-
-        pmd = pmd_alloc_one_fast(mm, address);
-        if (!pmd) {
-                pmd = (pmd_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT);
-                if (pmd)
-                        memset(pmd, 0, PAGE_SIZE);
-        }
-        return pmd;
+        kmem_cache_free(pgtable_cache, pmd);
 }
 
-static __inline__ void free_pmd_fast(pmd_t *pmd)
+static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
+                                          unsigned long address)
 {
-        unsigned long color = DCACHE_COLOR((unsigned long)pmd);
-
-        preempt_disable();
-        *(unsigned long *)pmd = (unsigned long) pte_quicklist[color];
-        pte_quicklist[color] = (unsigned long *) pmd;
-        pgtable_cache_size++;
-        preempt_enable();
+        return kmem_cache_alloc(pgtable_cache,
+                                GFP_KERNEL|__GFP_REPEAT);
 }
 
-static __inline__ void free_pmd_slow(pmd_t *pmd)
+static inline struct page *pte_alloc_one(struct mm_struct *mm,
+                                         unsigned long address)
 {
-        free_page((unsigned long)pmd);
+        return virt_to_page(pte_alloc_one_kernel(mm, address));
 }
-
-#define pmd_populate_kernel(MM, PMD, PTE)       pmd_set(PMD, PTE)
-#define pmd_populate(MM,PMD,PTE_PAGE)           \
-        pmd_populate_kernel(MM,PMD,page_address(PTE_PAGE))
-
-extern pte_t *pte_alloc_one_kernel(struct mm_struct *mm, unsigned long address);
-
-static inline struct page *
-pte_alloc_one(struct mm_struct *mm, unsigned long addr)
-{
-        pte_t *pte = pte_alloc_one_kernel(mm, addr);
-
-        if (pte)
-                return virt_to_page(pte);
-
-        return NULL;
-}
-
-static __inline__ pte_t *pte_alloc_one_fast(struct mm_struct *mm, unsigned long address)
-{
-        unsigned long color = VPTE_COLOR(address);
-        unsigned long *ret;
-
-        preempt_disable();
-        if((ret = (unsigned long *)pte_quicklist[color]) != NULL) {
-                pte_quicklist[color] = (unsigned long *)(*ret);
-                ret[0] = 0;
-                pgtable_cache_size--;
-        }
-        preempt_enable();
-        return (pte_t *)ret;
-}
-
-static __inline__ void free_pte_fast(pte_t *pte)
-{
-        unsigned long color = DCACHE_COLOR((unsigned long)pte);
-
-        preempt_disable();
-        *(unsigned long *)pte = (unsigned long) pte_quicklist[color];
-        pte_quicklist[color] = (unsigned long *) pte;
-        pgtable_cache_size++;
-        preempt_enable();
-}
-
-static __inline__ void free_pte_slow(pte_t *pte)
-{
-        free_page((unsigned long)pte);
-}
-
+                
 static inline void pte_free_kernel(pte_t *pte)
 {
-        free_pte_fast(pte);
+        kmem_cache_free(pgtable_cache, pte);
 }
 
 static inline void pte_free(struct page *ptepage)
 {
-        free_pte_fast(page_address(ptepage));
+        pte_free_kernel(page_address(ptepage));
 }
 
-#define pmd_free(pmd)           free_pmd_fast(pmd)
-#define pgd_free(pgd)           free_pgd_fast(pgd)
-#define pgd_alloc(mm)           get_pgd_fast()
+
+#define pmd_populate_kernel(MM, PMD, PTE)       pmd_set(PMD, PTE)
+#define pmd_populate(MM,PMD,PTE_PAGE)           \
+        pmd_populate_kernel(MM,PMD,page_address(PTE_PAGE))
+
+#define check_pgt_cache()       do { } while (0)
 
 #endif /* _SPARC64_PGALLOC_H */
diff --git a/include/asm-sparc64/pgtable.h b/include/asm-sparc64/pgtable.h
index f0a9b44d3eb5..ed4124edf837 100644
--- a/include/asm-sparc64/pgtable.h
+++ b/include/asm-sparc64/pgtable.h
@@ -25,7 +25,8 @@
 #include <asm/const.h>
 
 /* The kernel image occupies 0x4000000 to 0x1000000 (4MB --> 32MB).
- * The page copy blockops can use 0x2000000 to 0x10000000.
+ * The page copy blockops can use 0x2000000 to 0x4000000.
+ * The TSB is mapped in the 0x4000000 to 0x6000000 range.
  * The PROM resides in an area spanning 0xf0000000 to 0x100000000.
  * The vmalloc area spans 0x100000000 to 0x200000000.
  * Since modules need to be in the lowest 32-bits of the address space,
@@ -34,6 +35,7 @@
  * 0x400000000.
  */
 #define TLBTEMP_BASE            _AC(0x0000000002000000,UL)
+#define TSBMAP_BASE             _AC(0x0000000004000000,UL)
 #define MODULES_VADDR           _AC(0x0000000010000000,UL)
 #define MODULES_LEN             _AC(0x00000000e0000000,UL)
 #define MODULES_END             _AC(0x00000000f0000000,UL)
@@ -88,162 +90,538 @@
 
 #endif /* !(__ASSEMBLY__) */
 
-/* Spitfire/Cheetah TTE bits. */
-#define _PAGE_VALID     _AC(0x8000000000000000,UL) /* Valid TTE              */
-#define _PAGE_R         _AC(0x8000000000000000,UL) /* Keep ref bit up to date*/
-#define _PAGE_SZ4MB     _AC(0x6000000000000000,UL) /* 4MB Page               */
-#define _PAGE_SZ512K    _AC(0x4000000000000000,UL) /* 512K Page              */
-#define _PAGE_SZ64K     _AC(0x2000000000000000,UL) /* 64K Page               */
-#define _PAGE_SZ8K      _AC(0x0000000000000000,UL) /* 8K Page                */
-#define _PAGE_NFO       _AC(0x1000000000000000,UL) /* No Fault Only          */
-#define _PAGE_IE        _AC(0x0800000000000000,UL) /* Invert Endianness      */
-#define _PAGE_SOFT2     _AC(0x07FC000000000000,UL) /* Software bits, set 2   */
-#define _PAGE_RES1      _AC(0x0002000000000000,UL) /* Reserved               */
-#define _PAGE_SZ32MB    _AC(0x0001000000000000,UL) /* (Panther) 32MB page    */
-#define _PAGE_SZ256MB   _AC(0x2001000000000000,UL) /* (Panther) 256MB page   */
-#define _PAGE_SN        _AC(0x0000800000000000,UL) /* (Cheetah) Snoop        */
-#define _PAGE_RES2      _AC(0x0000780000000000,UL) /* Reserved               */
-#define _PAGE_PADDR_SF  _AC(0x000001FFFFFFE000,UL) /* (Spitfire) paddr[40:13]*/
-#define _PAGE_PADDR     _AC(0x000007FFFFFFE000,UL) /* (Cheetah) paddr[42:13] */
-#define _PAGE_SOFT      _AC(0x0000000000001F80,UL) /* Software bits          */
-#define _PAGE_L         _AC(0x0000000000000040,UL) /* Locked TTE             */
-#define _PAGE_CP        _AC(0x0000000000000020,UL) /* Cacheable in P-Cache   */
-#define _PAGE_CV        _AC(0x0000000000000010,UL) /* Cacheable in V-Cache   */
-#define _PAGE_E         _AC(0x0000000000000008,UL) /* side-Effect            */
-#define _PAGE_P         _AC(0x0000000000000004,UL) /* Privileged Page        */
-#define _PAGE_W         _AC(0x0000000000000002,UL) /* Writable               */
-#define _PAGE_G         _AC(0x0000000000000001,UL) /* Global                 */
-
-/* Here are the SpitFire software bits we use in the TTE's.
- *
- * WARNING: If you are going to try and start using some
- *          of the soft2 bits, you will need to make
- *          modifications to the swap entry implementation.
- *          For example, one thing that could happen is that
- *          swp_entry_to_pte() would BUG_ON() if you tried
- *          to use one of the soft2 bits for _PAGE_FILE.
- *
- * Like other architectures, I have aliased _PAGE_FILE with
- * _PAGE_MODIFIED.  This works because _PAGE_FILE is never
- * interpreted that way unless _PAGE_PRESENT is clear.
- */
-#define _PAGE_EXEC      _AC(0x0000000000001000,UL)      /* Executable SW bit */
-#define _PAGE_MODIFIED  _AC(0x0000000000000800,UL)      /* Modified (dirty)  */
-#define _PAGE_FILE      _AC(0x0000000000000800,UL)      /* Pagecache page    */
-#define _PAGE_ACCESSED  _AC(0x0000000000000400,UL)      /* Accessed (ref'd)  */
-#define _PAGE_READ      _AC(0x0000000000000200,UL)      /* Readable SW Bit   */
-#define _PAGE_WRITE     _AC(0x0000000000000100,UL)      /* Writable SW Bit   */
-#define _PAGE_PRESENT   _AC(0x0000000000000080,UL)      /* Present           */
+/* PTE bits which are the same in SUN4U and SUN4V format.  */
+#define _PAGE_VALID       _AC(0x8000000000000000,UL) /* Valid TTE            */
+#define _PAGE_R           _AC(0x8000000000000000,UL) /* Keep ref bit uptodate*/
+
+/* SUN4U pte bits... */
+#define _PAGE_SZ4MB_4U    _AC(0x6000000000000000,UL) /* 4MB Page             */
+#define _PAGE_SZ512K_4U   _AC(0x4000000000000000,UL) /* 512K Page            */
+#define _PAGE_SZ64K_4U    _AC(0x2000000000000000,UL) /* 64K Page             */
+#define _PAGE_SZ8K_4U     _AC(0x0000000000000000,UL) /* 8K Page              */
+#define _PAGE_NFO_4U      _AC(0x1000000000000000,UL) /* No Fault Only        */
+#define _PAGE_IE_4U       _AC(0x0800000000000000,UL) /* Invert Endianness    */
+#define _PAGE_SOFT2_4U    _AC(0x07FC000000000000,UL) /* Software bits, set 2 */
+#define _PAGE_RES1_4U     _AC(0x0002000000000000,UL) /* Reserved             */
+#define _PAGE_SZ32MB_4U   _AC(0x0001000000000000,UL) /* (Panther) 32MB page  */
+#define _PAGE_SZ256MB_4U  _AC(0x2001000000000000,UL) /* (Panther) 256MB page */
+#define _PAGE_SN_4U       _AC(0x0000800000000000,UL) /* (Cheetah) Snoop      */
+#define _PAGE_RES2_4U     _AC(0x0000780000000000,UL) /* Reserved             */
+#define _PAGE_PADDR_4U    _AC(0x000007FFFFFFE000,UL) /* (Cheetah) pa[42:13]  */
+#define _PAGE_SOFT_4U     _AC(0x0000000000001F80,UL) /* Software bits:       */
+#define _PAGE_EXEC_4U     _AC(0x0000000000001000,UL) /* Executable SW bit    */
+#define _PAGE_MODIFIED_4U _AC(0x0000000000000800,UL) /* Modified (dirty)     */
+#define _PAGE_FILE_4U     _AC(0x0000000000000800,UL) /* Pagecache page       */
+#define _PAGE_ACCESSED_4U _AC(0x0000000000000400,UL) /* Accessed (ref'd)     */
+#define _PAGE_READ_4U     _AC(0x0000000000000200,UL) /* Readable SW Bit      */
+#define _PAGE_WRITE_4U    _AC(0x0000000000000100,UL) /* Writable SW Bit      */
+#define _PAGE_PRESENT_4U  _AC(0x0000000000000080,UL) /* Present              */
+#define _PAGE_L_4U        _AC(0x0000000000000040,UL) /* Locked TTE           */
+#define _PAGE_CP_4U       _AC(0x0000000000000020,UL) /* Cacheable in P-Cache */
+#define _PAGE_CV_4U       _AC(0x0000000000000010,UL) /* Cacheable in V-Cache */
+#define _PAGE_E_4U        _AC(0x0000000000000008,UL) /* side-Effect          */
+#define _PAGE_P_4U        _AC(0x0000000000000004,UL) /* Privileged Page      */
+#define _PAGE_W_4U        _AC(0x0000000000000002,UL) /* Writable             */
+
+/* SUN4V pte bits... */
+#define _PAGE_NFO_4V      _AC(0x4000000000000000,UL) /* No Fault Only        */
+#define _PAGE_SOFT2_4V    _AC(0x3F00000000000000,UL) /* Software bits, set 2 */
+#define _PAGE_MODIFIED_4V _AC(0x2000000000000000,UL) /* Modified (dirty)     */
+#define _PAGE_ACCESSED_4V _AC(0x1000000000000000,UL) /* Accessed (ref'd)     */
+#define _PAGE_READ_4V     _AC(0x0800000000000000,UL) /* Readable SW Bit      */
+#define _PAGE_WRITE_4V    _AC(0x0400000000000000,UL) /* Writable SW Bit      */
+#define _PAGE_PADDR_4V    _AC(0x00FFFFFFFFFFE000,UL) /* paddr[55:13]         */
+#define _PAGE_IE_4V       _AC(0x0000000000001000,UL) /* Invert Endianness    */
+#define _PAGE_E_4V        _AC(0x0000000000000800,UL) /* side-Effect          */
+#define _PAGE_CP_4V       _AC(0x0000000000000400,UL) /* Cacheable in P-Cache */
+#define _PAGE_CV_4V       _AC(0x0000000000000200,UL) /* Cacheable in V-Cache */
+#define _PAGE_P_4V        _AC(0x0000000000000100,UL) /* Privileged Page      */
+#define _PAGE_EXEC_4V     _AC(0x0000000000000080,UL) /* Executable Page      */
+#define _PAGE_W_4V        _AC(0x0000000000000040,UL) /* Writable             */
+#define _PAGE_SOFT_4V     _AC(0x0000000000000030,UL) /* Software bits        */
+#define _PAGE_FILE_4V     _AC(0x0000000000000020,UL) /* Pagecache page       */
+#define _PAGE_PRESENT_4V  _AC(0x0000000000000010,UL) /* Present              */
+#define _PAGE_RESV_4V     _AC(0x0000000000000008,UL) /* Reserved             */
+#define _PAGE_SZ16GB_4V   _AC(0x0000000000000007,UL) /* 16GB Page            */
+#define _PAGE_SZ2GB_4V    _AC(0x0000000000000006,UL) /* 2GB Page             */
+#define _PAGE_SZ256MB_4V  _AC(0x0000000000000005,UL) /* 256MB Page           */
+#define _PAGE_SZ32MB_4V   _AC(0x0000000000000004,UL) /* 32MB Page            */
+#define _PAGE_SZ4MB_4V    _AC(0x0000000000000003,UL) /* 4MB Page             */
+#define _PAGE_SZ512K_4V   _AC(0x0000000000000002,UL) /* 512K Page            */
+#define _PAGE_SZ64K_4V    _AC(0x0000000000000001,UL) /* 64K Page             */
+#define _PAGE_SZ8K_4V     _AC(0x0000000000000000,UL) /* 8K Page              */
 
 #if PAGE_SHIFT == 13
-#define _PAGE_SZBITS    _PAGE_SZ8K
+#define _PAGE_SZBITS_4U _PAGE_SZ8K_4U
+#define _PAGE_SZBITS_4V _PAGE_SZ8K_4V
 #elif PAGE_SHIFT == 16
-#define _PAGE_SZBITS    _PAGE_SZ64K
+#define _PAGE_SZBITS_4U _PAGE_SZ64K_4U
+#define _PAGE_SZBITS_4V _PAGE_SZ64K_4V
 #elif PAGE_SHIFT == 19
-#define _PAGE_SZBITS    _PAGE_SZ512K
+#define _PAGE_SZBITS_4U _PAGE_SZ512K_4U
+#define _PAGE_SZBITS_4V _PAGE_SZ512K_4V
 #elif PAGE_SHIFT == 22
-#define _PAGE_SZBITS    _PAGE_SZ4MB
+#define _PAGE_SZBITS_4U _PAGE_SZ4MB_4U
+#define _PAGE_SZBITS_4V _PAGE_SZ4MB_4V
 #else
 #error Wrong PAGE_SHIFT specified
 #endif
 
 #if defined(CONFIG_HUGETLB_PAGE_SIZE_4MB)
-#define _PAGE_SZHUGE    _PAGE_SZ4MB
+#define _PAGE_SZHUGE_4U _PAGE_SZ4MB_4U
+#define _PAGE_SZHUGE_4V _PAGE_SZ4MB_4V
 #elif defined(CONFIG_HUGETLB_PAGE_SIZE_512K)
-#define _PAGE_SZHUGE    _PAGE_SZ512K
+#define _PAGE_SZHUGE_4U _PAGE_SZ512K_4U
+#define _PAGE_SZHUGE_4V _PAGE_SZ512K_4V
 #elif defined(CONFIG_HUGETLB_PAGE_SIZE_64K)
-#define _PAGE_SZHUGE    _PAGE_SZ64K
+#define _PAGE_SZHUGE_4U _PAGE_SZ64K_4U
+#define _PAGE_SZHUGE_4V _PAGE_SZ64K_4V
 #endif
 
-#define _PAGE_CACHE     (_PAGE_CP | _PAGE_CV)
+/* These are actually filled in at boot time by sun4{u,v}_pgprot_init() */
+#define __P000  __pgprot(0)
+#define __P001  __pgprot(0)
+#define __P010  __pgprot(0)
+#define __P011  __pgprot(0)
+#define __P100  __pgprot(0)
+#define __P101  __pgprot(0)
+#define __P110  __pgprot(0)
+#define __P111  __pgprot(0)
+
+#define __S000  __pgprot(0)
+#define __S001  __pgprot(0)
+#define __S010  __pgprot(0)
+#define __S011  __pgprot(0)
+#define __S100  __pgprot(0)
+#define __S101  __pgprot(0)
+#define __S110  __pgprot(0)
+#define __S111  __pgprot(0)
 
-#define __DIRTY_BITS    (_PAGE_MODIFIED | _PAGE_WRITE | _PAGE_W)
-#define __ACCESS_BITS   (_PAGE_ACCESSED | _PAGE_READ | _PAGE_R)
-#define __PRIV_BITS     _PAGE_P
+#ifndef __ASSEMBLY__
 
-#define PAGE_NONE       __pgprot (_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_CACHE)
+extern pte_t mk_pte_io(unsigned long, pgprot_t, int, unsigned long);
 
-/* Don't set the TTE _PAGE_W bit here, else the dirty bit never gets set. */
-#define PAGE_SHARED     __pgprot (_PAGE_PRESENT | _PAGE_VALID | _PAGE_CACHE | \
-                                  __ACCESS_BITS | _PAGE_WRITE | _PAGE_EXEC)
+extern unsigned long pte_sz_bits(unsigned long size);
 
-#define PAGE_COPY       __pgprot (_PAGE_PRESENT | _PAGE_VALID | _PAGE_CACHE | \
-                                  __ACCESS_BITS | _PAGE_EXEC)
+extern pgprot_t PAGE_KERNEL;
+extern pgprot_t PAGE_KERNEL_LOCKED;
+extern pgprot_t PAGE_COPY;
+extern pgprot_t PAGE_SHARED;
 
-#define PAGE_READONLY   __pgprot (_PAGE_PRESENT | _PAGE_VALID | _PAGE_CACHE | \
-                                  __ACCESS_BITS | _PAGE_EXEC)
+/* XXX This uglyness is for the atyfb driver's sparc mmap() support. XXX */
+extern unsigned long _PAGE_IE;
+extern unsigned long _PAGE_E;
+extern unsigned long _PAGE_CACHE;
 
-#define PAGE_KERNEL     __pgprot (_PAGE_PRESENT | _PAGE_VALID | _PAGE_CACHE | \
-                                  __PRIV_BITS | \
-                                  __ACCESS_BITS | __DIRTY_BITS | _PAGE_EXEC)
+extern unsigned long pg_iobits;
+extern unsigned long _PAGE_ALL_SZ_BITS;
+extern unsigned long _PAGE_SZBITS;
 
-#define PAGE_SHARED_NOEXEC      __pgprot (_PAGE_PRESENT | _PAGE_VALID | \
-                                          _PAGE_CACHE | \
-                                          __ACCESS_BITS | _PAGE_WRITE)
+extern struct page *mem_map_zero;
+#define ZERO_PAGE(vaddr)        (mem_map_zero)
 
-#define PAGE_COPY_NOEXEC        __pgprot (_PAGE_PRESENT | _PAGE_VALID | \
-                                          _PAGE_CACHE | __ACCESS_BITS)
+/* PFNs are real physical page numbers.  However, mem_map only begins to record
+ * per-page information starting at pfn_base.  This is to handle systems where
+ * the first physical page in the machine is at some huge physical address,
+ * such as 4GB.   This is common on a partitioned E10000, for example.
+ */
+static inline pte_t pfn_pte(unsigned long pfn, pgprot_t prot)
+{
+        unsigned long paddr = pfn << PAGE_SHIFT;
+        unsigned long sz_bits;
+
+        sz_bits = 0UL;
+        if (_PAGE_SZBITS_4U != 0UL || _PAGE_SZBITS_4V != 0UL) {
+                __asm__ __volatile__(
+                "\n661: sethi           %uhi(%1), %0\n"
+                "       sllx            %0, 32, %0\n"
+                "       .section        .sun4v_2insn_patch, \"ax\"\n"
+                "       .word           661b\n"
+                "       mov             %2, %0\n"
+                "       nop\n"
+                "       .previous\n"
+                : "=r" (sz_bits)
+                : "i" (_PAGE_SZBITS_4U), "i" (_PAGE_SZBITS_4V));
+        }
+        return __pte(paddr | sz_bits | pgprot_val(prot));
+}
+#define mk_pte(page, pgprot)    pfn_pte(page_to_pfn(page), (pgprot))
 
-#define PAGE_READONLY_NOEXEC    __pgprot (_PAGE_PRESENT | _PAGE_VALID | \
-                                          _PAGE_CACHE | __ACCESS_BITS)
+/* This one can be done with two shifts.  */
+static inline unsigned long pte_pfn(pte_t pte)
+{
+        unsigned long ret;
+
+        __asm__ __volatile__(
+        "\n661: sllx            %1, %2, %0\n"
+        "       srlx            %0, %3, %0\n"
+        "       .section        .sun4v_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       sllx            %1, %4, %0\n"
+        "       srlx            %0, %5, %0\n"
+        "       .previous\n"
+        : "=r" (ret)
+        : "r" (pte_val(pte)),
+          "i" (21), "i" (21 + PAGE_SHIFT),
+          "i" (8), "i" (8 + PAGE_SHIFT));
+
+        return ret;
+}
+#define pte_page(x) pfn_to_page(pte_pfn(x))
 
-#define _PFN_MASK       _PAGE_PADDR
+static inline pte_t pte_modify(pte_t pte, pgprot_t prot)
+{
+        unsigned long mask, tmp;
+
+        /* SUN4U: 0x600307ffffffecb8 (negated == 0x9ffcf80000001347)
+         * SUN4V: 0x30ffffffffffee17 (negated == 0xcf000000000011e8)
+         *
+         * Even if we use negation tricks the result is still a 6
+         * instruction sequence, so don't try to play fancy and just
+         * do the most straightforward implementation.
+         *
+         * Note: We encode this into 3 sun4v 2-insn patch sequences.
+         */
 
-#define pg_iobits (_PAGE_VALID | _PAGE_PRESENT | __DIRTY_BITS | \
-                   __ACCESS_BITS | _PAGE_E)
+        __asm__ __volatile__(
+        "\n661: sethi           %%uhi(%2), %1\n"
+        "       sethi           %%hi(%2), %0\n"
+        "\n662: or              %1, %%ulo(%2), %1\n"
+        "       or              %0, %%lo(%2), %0\n"
+        "\n663: sllx            %1, 32, %1\n"
+        "       or              %0, %1, %0\n"
+        "       .section        .sun4v_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       sethi           %%uhi(%3), %1\n"
+        "       sethi           %%hi(%3), %0\n"
+        "       .word           662b\n"
+        "       or              %1, %%ulo(%3), %1\n"
+        "       or              %0, %%lo(%3), %0\n"
+        "       .word           663b\n"
+        "       sllx            %1, 32, %1\n"
+        "       or              %0, %1, %0\n"
+        "       .previous\n"
+        : "=r" (mask), "=r" (tmp)
+        : "i" (_PAGE_PADDR_4U | _PAGE_MODIFIED_4U | _PAGE_ACCESSED_4U |
+               _PAGE_CP_4U | _PAGE_CV_4U | _PAGE_E_4U | _PAGE_PRESENT_4U |
+               _PAGE_SZBITS_4U),
+          "i" (_PAGE_PADDR_4V | _PAGE_MODIFIED_4V | _PAGE_ACCESSED_4V |
+               _PAGE_CP_4V | _PAGE_CV_4V | _PAGE_E_4V | _PAGE_PRESENT_4V |
+               _PAGE_SZBITS_4V));
+
+        return __pte((pte_val(pte) & mask) | (pgprot_val(prot) & ~mask));
+}
 
-#define __P000  PAGE_NONE
-#define __P001  PAGE_READONLY_NOEXEC
-#define __P010  PAGE_COPY_NOEXEC
-#define __P011  PAGE_COPY_NOEXEC
-#define __P100  PAGE_READONLY
-#define __P101  PAGE_READONLY
-#define __P110  PAGE_COPY
-#define __P111  PAGE_COPY
+static inline pte_t pgoff_to_pte(unsigned long off)
+{
+        off <<= PAGE_SHIFT;
+
+        __asm__ __volatile__(
+        "\n661: or              %0, %2, %0\n"
+        "       .section        .sun4v_1insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       or              %0, %3, %0\n"
+        "       .previous\n"
+        : "=r" (off)
+        : "0" (off), "i" (_PAGE_FILE_4U), "i" (_PAGE_FILE_4V));
+
+        return __pte(off);
+}
 
-#define __S000  PAGE_NONE
-#define __S001  PAGE_READONLY_NOEXEC
-#define __S010  PAGE_SHARED_NOEXEC
-#define __S011  PAGE_SHARED_NOEXEC
-#define __S100  PAGE_READONLY
-#define __S101  PAGE_READONLY
-#define __S110  PAGE_SHARED
-#define __S111  PAGE_SHARED
+static inline pgprot_t pgprot_noncached(pgprot_t prot)
+{
+        unsigned long val = pgprot_val(prot);
+
+        __asm__ __volatile__(
+        "\n661: andn            %0, %2, %0\n"
+        "       or              %0, %3, %0\n"
+        "       .section        .sun4v_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       andn            %0, %4, %0\n"
+        "       or              %0, %3, %0\n"
+        "       .previous\n"
+        : "=r" (val)
+        : "0" (val), "i" (_PAGE_CP_4U | _PAGE_CV_4U), "i" (_PAGE_E_4U),
+                     "i" (_PAGE_CP_4V | _PAGE_CV_4V), "i" (_PAGE_E_4V));
+
+        return __pgprot(val);
+}
+/* Various pieces of code check for platform support by ifdef testing
+ * on "pgprot_noncached".  That's broken and should be fixed, but for
+ * now...
+ */
+#define pgprot_noncached pgprot_noncached
 
-#ifndef __ASSEMBLY__
+#ifdef CONFIG_HUGETLB_PAGE
+static inline pte_t pte_mkhuge(pte_t pte)
+{
+        unsigned long mask;
+
+        __asm__ __volatile__(
+        "\n661: sethi           %%uhi(%1), %0\n"
+        "       sllx            %0, 32, %0\n"
+        "       .section        .sun4v_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       mov             %2, %0\n"
+        "       nop\n"
+        "       .previous\n"
+        : "=r" (mask)
+        : "i" (_PAGE_SZHUGE_4U), "i" (_PAGE_SZHUGE_4V));
+
+        return __pte(pte_val(pte) | mask);
+}
+#endif
 
-extern unsigned long phys_base;
-extern unsigned long pfn_base;
+static inline pte_t pte_mkdirty(pte_t pte)
+{
+        unsigned long val = pte_val(pte), tmp;
+
+        __asm__ __volatile__(
+        "\n661: or              %0, %3, %0\n"
+        "       nop\n"
+        "\n662: nop\n"
+        "       nop\n"
+        "       .section        .sun4v_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       sethi           %%uhi(%4), %1\n"
+        "       sllx            %1, 32, %1\n"
+        "       .word           662b\n"
+        "       or              %1, %%lo(%4), %1\n"
+        "       or              %0, %1, %0\n"
+        "       .previous\n"
+        : "=r" (val), "=r" (tmp)
+        : "0" (val), "i" (_PAGE_MODIFIED_4U | _PAGE_W_4U),
+          "i" (_PAGE_MODIFIED_4V | _PAGE_W_4V));
+
+        return __pte(val);
+}
 
-extern struct page *mem_map_zero;
-#define ZERO_PAGE(vaddr)        (mem_map_zero)
+static inline pte_t pte_mkclean(pte_t pte)
+{
+        unsigned long val = pte_val(pte), tmp;
+
+        __asm__ __volatile__(
+        "\n661: andn            %0, %3, %0\n"
+        "       nop\n"
+        "\n662: nop\n"
+        "       nop\n"
+        "       .section        .sun4v_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       sethi           %%uhi(%4), %1\n"
+        "       sllx            %1, 32, %1\n"
+        "       .word           662b\n"
+        "       or              %1, %%lo(%4), %1\n"
+        "       andn            %0, %1, %0\n"
+        "       .previous\n"
+        : "=r" (val), "=r" (tmp)
+        : "0" (val), "i" (_PAGE_MODIFIED_4U | _PAGE_W_4U),
+          "i" (_PAGE_MODIFIED_4V | _PAGE_W_4V));
+
+        return __pte(val);
+}
 
-/* PFNs are real physical page numbers.  However, mem_map only begins to record
- * per-page information starting at pfn_base.  This is to handle systems where
- * the first physical page in the machine is at some huge physical address,
- * such as 4GB.   This is common on a partitioned E10000, for example.
- */
+static inline pte_t pte_mkwrite(pte_t pte)
+{
+        unsigned long val = pte_val(pte), mask;
+
+        __asm__ __volatile__(
+        "\n661: mov             %1, %0\n"
+        "       nop\n"
+        "       .section        .sun4v_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       sethi           %%uhi(%2), %0\n"
+        "       sllx            %0, 32, %0\n"
+        "       .previous\n"
+        : "=r" (mask)
+        : "i" (_PAGE_WRITE_4U), "i" (_PAGE_WRITE_4V));
+
+        return __pte(val | mask);
+}
 
-#define pfn_pte(pfn, prot)      \
-        __pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot) | _PAGE_SZBITS)
-#define mk_pte(page, pgprot)    pfn_pte(page_to_pfn(page), (pgprot))
+static inline pte_t pte_wrprotect(pte_t pte)
+{
+        unsigned long val = pte_val(pte), tmp;
+
+        __asm__ __volatile__(
+        "\n661: andn            %0, %3, %0\n"
+        "       nop\n"
+        "\n662: nop\n"
+        "       nop\n"
+        "       .section        .sun4v_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       sethi           %%uhi(%4), %1\n"
+        "       sllx            %1, 32, %1\n"
+        "       .word           662b\n"
+        "       or              %1, %%lo(%4), %1\n"
+        "       andn            %0, %1, %0\n"
+        "       .previous\n"
+        : "=r" (val), "=r" (tmp)
+        : "0" (val), "i" (_PAGE_WRITE_4U | _PAGE_W_4U),
+          "i" (_PAGE_WRITE_4V | _PAGE_W_4V));
+
+        return __pte(val);
+}
+
+static inline pte_t pte_mkold(pte_t pte)
+{
+        unsigned long mask;
+
+        __asm__ __volatile__(
+        "\n661: mov             %1, %0\n"
+        "       nop\n"
+        "       .section        .sun4v_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       sethi           %%uhi(%2), %0\n"
+        "       sllx            %0, 32, %0\n"
+        "       .previous\n"
+        : "=r" (mask)
+        : "i" (_PAGE_ACCESSED_4U), "i" (_PAGE_ACCESSED_4V));
+
+        mask |= _PAGE_R;
+
+        return __pte(pte_val(pte) & ~mask);
+}
+
+static inline pte_t pte_mkyoung(pte_t pte)
+{
+        unsigned long mask;
+
+        __asm__ __volatile__(
+        "\n661: mov             %1, %0\n"
+        "       nop\n"
+        "       .section        .sun4v_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       sethi           %%uhi(%2), %0\n"
+        "       sllx            %0, 32, %0\n"
+        "       .previous\n"
+        : "=r" (mask)
+        : "i" (_PAGE_ACCESSED_4U), "i" (_PAGE_ACCESSED_4V));
+
+        mask |= _PAGE_R;
+
+        return __pte(pte_val(pte) | mask);
+}
 
-#define pte_pfn(x)              ((pte_val(x) & _PAGE_PADDR)>>PAGE_SHIFT)
-#define pte_page(x)             pfn_to_page(pte_pfn(x))
+static inline unsigned long pte_young(pte_t pte)
+{
+        unsigned long mask;
+
+        __asm__ __volatile__(
+        "\n661: mov             %1, %0\n"
+        "       nop\n"
+        "       .section        .sun4v_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       sethi           %%uhi(%2), %0\n"
+        "       sllx            %0, 32, %0\n"
+        "       .previous\n"
+        : "=r" (mask)
+        : "i" (_PAGE_ACCESSED_4U), "i" (_PAGE_ACCESSED_4V));
+
+        return (pte_val(pte) & mask);
+}
+
+static inline unsigned long pte_dirty(pte_t pte)
+{
+        unsigned long mask;
+
+        __asm__ __volatile__(
+        "\n661: mov             %1, %0\n"
+        "       nop\n"
+        "       .section        .sun4v_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       sethi           %%uhi(%2), %0\n"
+        "       sllx            %0, 32, %0\n"
+        "       .previous\n"
+        : "=r" (mask)
+        : "i" (_PAGE_MODIFIED_4U), "i" (_PAGE_MODIFIED_4V));
+
+        return (pte_val(pte) & mask);
+}
 
-static inline pte_t pte_modify(pte_t orig_pte, pgprot_t new_prot)
+static inline unsigned long pte_write(pte_t pte)
 {
-        pte_t __pte;
-        const unsigned long preserve_mask = (_PFN_MASK |
-                                             _PAGE_MODIFIED | _PAGE_ACCESSED |
-                                             _PAGE_CACHE | _PAGE_E |
-                                             _PAGE_PRESENT | _PAGE_SZBITS);
+        unsigned long mask;
+
+        __asm__ __volatile__(
+        "\n661: mov             %1, %0\n"
+        "       nop\n"
+        "       .section        .sun4v_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       sethi           %%uhi(%2), %0\n"
+        "       sllx            %0, 32, %0\n"
+        "       .previous\n"
+        : "=r" (mask)
+        : "i" (_PAGE_WRITE_4U), "i" (_PAGE_WRITE_4V));
+
+        return (pte_val(pte) & mask);
+}
 
-        pte_val(__pte) = (pte_val(orig_pte) & preserve_mask) |
-                (pgprot_val(new_prot) & ~preserve_mask);
+static inline unsigned long pte_exec(pte_t pte)
+{
+        unsigned long mask;
+
+        __asm__ __volatile__(
+        "\n661: sethi           %%hi(%1), %0\n"
+        "       .section        .sun4v_1insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       mov             %2, %0\n"
+        "       .previous\n"
+        : "=r" (mask)
+        : "i" (_PAGE_EXEC_4U), "i" (_PAGE_EXEC_4V));
+
+        return (pte_val(pte) & mask);
+}
 
-        return __pte;
+static inline unsigned long pte_read(pte_t pte)
+{
+        unsigned long mask;
+
+        __asm__ __volatile__(
+        "\n661: mov             %1, %0\n"
+        "       nop\n"
+        "       .section        .sun4v_2insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       sethi           %%uhi(%2), %0\n"
+        "       sllx            %0, 32, %0\n"
+        "       .previous\n"
+        : "=r" (mask)
+        : "i" (_PAGE_READ_4U), "i" (_PAGE_READ_4V));
+
+        return (pte_val(pte) & mask);
 }
+
+static inline unsigned long pte_file(pte_t pte)
+{
+        unsigned long val = pte_val(pte);
+
+        __asm__ __volatile__(
+        "\n661: and             %0, %2, %0\n"
+        "       .section        .sun4v_1insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       and             %0, %3, %0\n"
+        "       .previous\n"
+        : "=r" (val)
+        : "0" (val), "i" (_PAGE_FILE_4U), "i" (_PAGE_FILE_4V));
+
+        return val;
+}
+
+static inline unsigned long pte_present(pte_t pte)
+{
+        unsigned long val = pte_val(pte);
+
+        __asm__ __volatile__(
+        "\n661: and             %0, %2, %0\n"
+        "       .section        .sun4v_1insn_patch, \"ax\"\n"
+        "       .word           661b\n"
+        "       and             %0, %3, %0\n"
+        "       .previous\n"
+        : "=r" (val)
+        : "0" (val), "i" (_PAGE_PRESENT_4U), "i" (_PAGE_PRESENT_4V));
+
+        return val;
+}
+
 #define pmd_set(pmdp, ptep)     \
         (pmd_val(*(pmdp)) = (__pa((unsigned long) (ptep)) >> 11UL))
 #define pud_set(pudp, pmdp)     \
@@ -253,8 +631,6 @@ static inline pte_t pte_modify(pte_t orig_pte, pgprot_t new_prot)
 #define pmd_page(pmd)                   virt_to_page((void *)__pmd_page(pmd))
 #define pud_page(pud)           \
         ((unsigned long) __va((((unsigned long)pud_val(pud))<<11UL)))
-#define pte_none(pte)                   (!pte_val(pte))
-#define pte_present(pte)                (pte_val(pte) & _PAGE_PRESENT)
 #define pmd_none(pmd)                   (!pmd_val(pmd))
 #define pmd_bad(pmd)                    (0)
 #define pmd_present(pmd)                (pmd_val(pmd) != 0U)
@@ -264,30 +640,8 @@ static inline pte_t pte_modify(pte_t orig_pte, pgprot_t new_prot)
 #define pud_present(pud)                (pud_val(pud) != 0U)
 #define pud_clear(pudp)                 (pud_val(*(pudp)) = 0U)
 
-/* The following only work if pte_present() is true.
- * Undefined behaviour if not..
- */
-#define pte_read(pte)           (pte_val(pte) & _PAGE_READ)
-#define pte_exec(pte)           (pte_val(pte) & _PAGE_EXEC)
-#define pte_write(pte)          (pte_val(pte) & _PAGE_WRITE)
-#define pte_dirty(pte)          (pte_val(pte) & _PAGE_MODIFIED)
-#define pte_young(pte)          (pte_val(pte) & _PAGE_ACCESSED)
-#define pte_wrprotect(pte)      (__pte(pte_val(pte) & ~(_PAGE_WRITE|_PAGE_W)))
-#define pte_rdprotect(pte)      \
-        (__pte(((pte_val(pte)<<1UL)>>1UL) & ~_PAGE_READ))
-#define pte_mkclean(pte)        \
-        (__pte(pte_val(pte) & ~(_PAGE_MODIFIED|_PAGE_W)))
-#define pte_mkold(pte)          \
-        (__pte(((pte_val(pte)<<1UL)>>1UL) & ~_PAGE_ACCESSED))
-
-/* Permanent address of a page. */
-#define __page_address(page)    page_address(page)
-
-/* Be very careful when you change these three, they are delicate. */
-#define pte_mkyoung(pte)        (__pte(pte_val(pte) | _PAGE_ACCESSED | _PAGE_R))
-#define pte_mkwrite(pte)        (__pte(pte_val(pte) | _PAGE_WRITE))
-#define pte_mkdirty(pte)        (__pte(pte_val(pte) | _PAGE_MODIFIED | _PAGE_W))
-#define pte_mkhuge(pte)         (__pte(pte_val(pte) | _PAGE_SZHUGE))
+/* Same in both SUN4V and SUN4U.  */
+#define pte_none(pte)                   (!pte_val(pte))
 
 /* to find an entry in a page-table-directory. */
 #define pgd_index(address)      (((address) >> PGDIR_SHIFT) & (PTRS_PER_PGD - 1))
@@ -296,11 +650,6 @@ static inline pte_t pte_modify(pte_t orig_pte, pgprot_t new_prot)
 /* to find an entry in a kernel page-table-directory */
 #define pgd_offset_k(address) pgd_offset(&init_mm, address)
 
-/* extract the pgd cache used for optimizing the tlb miss
- * slow path when executing 32-bit compat processes
- */
-#define get_pgd_cache(pgd)      ((unsigned long) pgd_val(*pgd) << 11)
-
 /* Find an entry in the second-level page table.. */
 #define pmd_offset(pudp, address)       \
         ((pmd_t *) pud_page(*(pudp)) + \
@@ -327,6 +676,9 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr, pte_t *p
 
         /* It is more efficient to let flush_tlb_kernel_range()
          * handle init_mm tlb flushes.
+         *
+         * SUN4V NOTE: _PAGE_VALID is the same value in both the SUN4U
+         *             and SUN4V pte layout, so this inline test is fine.
          */
         if (likely(mm != &init_mm) && (pte_val(orig) & _PAGE_VALID))
                 tlb_batch_add(mm, addr, ptep, orig);
@@ -361,42 +713,23 @@ extern void update_mmu_cache(struct vm_area_struct *, unsigned long, pte_t);
 #define __swp_entry_to_pte(x)           ((pte_t) { (x).val })
 
 /* File offset in PTE support. */
-#define pte_file(pte)           (pte_val(pte) & _PAGE_FILE)
+extern unsigned long pte_file(pte_t);
 #define pte_to_pgoff(pte)       (pte_val(pte) >> PAGE_SHIFT)
-#define pgoff_to_pte(off)       (__pte(((off) << PAGE_SHIFT) | _PAGE_FILE))
+extern pte_t pgoff_to_pte(unsigned long);
 #define PTE_FILE_MAX_BITS       (64UL - PAGE_SHIFT - 1UL)
 
 extern unsigned long prom_virt_to_phys(unsigned long, int *);
 
-static __inline__ unsigned long
-sun4u_get_pte (unsigned long addr)
-{
-        pgd_t *pgdp;
-        pud_t *pudp;
-        pmd_t *pmdp;
-        pte_t *ptep;
-
-        if (addr >= PAGE_OFFSET)
-                return addr & _PAGE_PADDR;
-        if ((addr >= LOW_OBP_ADDRESS) && (addr < HI_OBP_ADDRESS))
-                return prom_virt_to_phys(addr, NULL);
-        pgdp = pgd_offset_k(addr);
-        pudp = pud_offset(pgdp, addr);
-        pmdp = pmd_offset(pudp, addr);
-        ptep = pte_offset_kernel(pmdp, addr);
-        return pte_val(*ptep) & _PAGE_PADDR;
-}
+extern unsigned long sun4u_get_pte(unsigned long);
 
-static __inline__ unsigned long
-__get_phys (unsigned long addr)
+static inline unsigned long __get_phys(unsigned long addr)
 {
-        return sun4u_get_pte (addr);
+        return sun4u_get_pte(addr);
 }
 
-static __inline__ int
-__get_iospace (unsigned long addr)
+static inline int __get_iospace(unsigned long addr)
 {
-        return ((sun4u_get_pte (addr) & 0xf0000000) >> 28);
+        return ((sun4u_get_pte(addr) & 0xf0000000) >> 28);
 }
 
 extern unsigned long *sparc64_valid_addr_bitmap;
@@ -409,11 +742,6 @@ extern int io_remap_pfn_range(struct vm_area_struct *vma, unsigned long from,
                                unsigned long pfn,
                                unsigned long size, pgprot_t prot);
 
-/* Clear virtual and physical cachability, set side-effect bit.  */
-#define pgprot_noncached(prot) \
-        (__pgprot((pgprot_val(prot) & ~(_PAGE_CP | _PAGE_CV)) | \
-         _PAGE_E))
-
 /*
  * For sparc32&64, the pfn in io_remap_pfn_range() carries <iospace> in
  * its high 4 bits.  These macros/functions put it there or get it from there.
@@ -424,8 +752,11 @@ extern int io_remap_pfn_range(struct vm_area_struct *vma, unsigned long from,
 
 #include <asm-generic/pgtable.h>
 
-/* We provide our own get_unmapped_area to cope with VA holes for userland */
+/* We provide our own get_unmapped_area to cope with VA holes and
+ * SHM area cache aliasing for userland.
+ */
 #define HAVE_ARCH_UNMAPPED_AREA
+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
 
 /* We provide a special get_unmapped_area for framebuffer mmaps to try and use
  * the largest alignment possible such that larget PTEs can be used.
@@ -435,12 +766,9 @@ extern unsigned long get_fb_unmapped_area(struct file *filp, unsigned long,
                                           unsigned long);
 #define HAVE_ARCH_FB_UNMAPPED_AREA
 
-/*
- * No page table caches to initialise
- */
-#define pgtable_cache_init()    do { } while (0)
-
-extern void check_pgt_cache(void);
+extern void pgtable_cache_init(void);
+extern void sun4v_register_fault_status(void);
+extern void sun4v_ktsb_register(void);
 
 #endif /* !(__ASSEMBLY__) */
 
diff --git a/include/asm-sparc64/pil.h b/include/asm-sparc64/pil.h
index 8f87750c3517..79f827eb3f5d 100644
--- a/include/asm-sparc64/pil.h
+++ b/include/asm-sparc64/pil.h
@@ -16,11 +16,13 @@
 #define PIL_SMP_CALL_FUNC       1
 #define PIL_SMP_RECEIVE_SIGNAL  2
 #define PIL_SMP_CAPTURE         3
+#define PIL_SMP_CTX_NEW_VERSION 4
 
 #ifndef __ASSEMBLY__
 #define PIL_RESERVED(PIL)       ((PIL) == PIL_SMP_CALL_FUNC || \
                                  (PIL) == PIL_SMP_RECEIVE_SIGNAL || \
-                                 (PIL) == PIL_SMP_CAPTURE)
+                                 (PIL) == PIL_SMP_CAPTURE || \
+                                 (PIL) == PIL_SMP_CTX_NEW_VERSION)
 #endif
 
 #endif /* !(_SPARC64_PIL_H) */
diff --git a/include/asm-sparc64/processor.h b/include/asm-sparc64/processor.h
index cd8d9b4c8658..c6896b88283e 100644
--- a/include/asm-sparc64/processor.h
+++ b/include/asm-sparc64/processor.h
@@ -28,6 +28,8 @@
  * User lives in his very own context, and cannot reference us. Note
  * that TASK_SIZE is a misnomer, it really gives maximum user virtual 
  * address that the kernel will allocate out.
+ *
+ * XXX No longer using virtual page tables, kill this upper limit...
  */
 #define VA_BITS         44
 #ifndef __ASSEMBLY__
@@ -37,18 +39,6 @@
 #endif
 #define TASK_SIZE       ((unsigned long)-VPTE_SIZE)
 
-/*
- * The vpte base must be able to hold the entire vpte, half
- * of which lives above, and half below, the base. And it
- * is placed as close to the highest address range as possible.
- */
-#define VPTE_BASE_SPITFIRE      (-(VPTE_SIZE/2))
-#if 1
-#define VPTE_BASE_CHEETAH       VPTE_BASE_SPITFIRE
-#else
-#define VPTE_BASE_CHEETAH       0xffe0000000000000
-#endif
-
 #ifndef __ASSEMBLY__
 
 typedef struct {
@@ -101,7 +91,8 @@ extern unsigned long thread_saved_pc(struct task_struct *);
 /* Do necessary setup to start up a newly executed thread. */
 #define start_thread(regs, pc, sp) \
 do { \
-        regs->tstate = (regs->tstate & (TSTATE_CWP)) | (TSTATE_INITIAL_MM|TSTATE_IE) | (ASI_PNF << 24); \
+        unsigned long __asi = ASI_PNF; \
+        regs->tstate = (regs->tstate & (TSTATE_CWP)) | (TSTATE_INITIAL_MM|TSTATE_IE) | (__asi << 24UL); \
         regs->tpc = ((pc & (~3)) - 4); \
         regs->tnpc = regs->tpc + 4; \
         regs->y = 0; \
@@ -138,10 +129,10 @@ do { \
 
 #define start_thread32(regs, pc, sp) \
 do { \
+        unsigned long __asi = ASI_PNF; \
         pc &= 0x00000000ffffffffUL; \
         sp &= 0x00000000ffffffffUL; \
-\
-        regs->tstate = (regs->tstate & (TSTATE_CWP))|(TSTATE_INITIAL_MM|TSTATE_IE|TSTATE_AM); \
+        regs->tstate = (regs->tstate & (TSTATE_CWP))|(TSTATE_INITIAL_MM|TSTATE_IE|TSTATE_AM) | (__asi << 24UL); \
         regs->tpc = ((pc & (~3)) - 4); \
         regs->tnpc = regs->tpc + 4; \
         regs->y = 0; \
@@ -226,6 +217,8 @@ static inline void prefetchw(const void *x)
 
 #define spin_lock_prefetch(x)   prefetchw(x)
 
+#define HAVE_ARCH_PICK_MMAP_LAYOUT
+
 #endif /* !(__ASSEMBLY__) */
 
 #endif /* !(__ASM_SPARC64_PROCESSOR_H) */
diff --git a/include/asm-sparc64/pstate.h b/include/asm-sparc64/pstate.h
index 29fb74aa805d..49a7924a89ab 100644
--- a/include/asm-sparc64/pstate.h
+++ b/include/asm-sparc64/pstate.h
@@ -28,11 +28,12 @@
 
 /* The V9 TSTATE Register (with SpitFire and Linux extensions).
  *
- * ---------------------------------------------------------------
- * |  Resv  |  CCR  |  ASI  |  %pil  |  PSTATE  |  Resv  |  CWP  |
- * ---------------------------------------------------------------
- *  63    40 39   32 31   24 23    20 19       8 7      5 4     0
+ * ---------------------------------------------------------------------
+ * |  Resv |  GL  |  CCR  |  ASI  |  %pil  |  PSTATE  |  Resv  |  CWP  |
+ * ---------------------------------------------------------------------
+ *  63   43 42  40 39   32 31   24 23    20 19       8 7      5 4     0
  */
+#define TSTATE_GL       _AC(0x0000070000000000,UL) /* Global reg level  */
 #define TSTATE_CCR      _AC(0x000000ff00000000,UL) /* Condition Codes.  */
 #define TSTATE_XCC      _AC(0x000000f000000000,UL) /* Condition Codes.  */
 #define TSTATE_XNEG     _AC(0x0000008000000000,UL) /* %xcc Negative.    */
diff --git a/include/asm-sparc64/scratchpad.h b/include/asm-sparc64/scratchpad.h
new file mode 100644
index 000000000000..5e8b01fb3343
--- /dev/null
+++ b/include/asm-sparc64/scratchpad.h
@@ -0,0 +1,14 @@
+#ifndef _SPARC64_SCRATCHPAD_H
+#define _SPARC64_SCRATCHPAD_H
+
+/* Sun4v scratchpad registers, accessed via ASI_SCRATCHPAD.  */
+
+#define SCRATCHPAD_MMU_MISS     0x00 /* Shared with OBP - set by OBP        */
+#define SCRATCHPAD_CPUID        0x08 /* Shared with OBP - set by hypervisor */
+#define SCRATCHPAD_UTSBREG1     0x10
+#define SCRATCHPAD_UTSBREG2     0x18
+        /* 0x20 and 0x28, hypervisor only... */
+#define SCRATCHPAD_UNUSED1      0x30
+#define SCRATCHPAD_UNUSED2      0x38 /* Reserved for OBP                    */
+
+#endif /* !(_SPARC64_SCRATCHPAD_H) */
diff --git a/include/asm-sparc64/smp.h b/include/asm-sparc64/smp.h
index 473edb2603ec..89d86ecaab24 100644
--- a/include/asm-sparc64/smp.h
+++ b/include/asm-sparc64/smp.h
@@ -33,37 +33,13 @@
 extern cpumask_t phys_cpu_present_map;
 #define cpu_possible_map phys_cpu_present_map
 
+extern cpumask_t cpu_sibling_map[NR_CPUS];
+
 /*
  *      General functions that each host system must provide.
  */
 
-static __inline__ int hard_smp_processor_id(void)
-{
-        if (tlb_type == cheetah || tlb_type == cheetah_plus) {
-                unsigned long cfg, ver;
-                __asm__ __volatile__("rdpr %%ver, %0" : "=r" (ver));
-                if ((ver >> 32) == 0x003e0016) {
-                        __asm__ __volatile__("ldxa [%%g0] %1, %0"
-                                             : "=r" (cfg)
-                                             : "i" (ASI_JBUS_CONFIG));
-                        return ((cfg >> 17) & 0x1f);
-                } else {
-                        __asm__ __volatile__("ldxa [%%g0] %1, %0"
-                                             : "=r" (cfg)
-                                             : "i" (ASI_SAFARI_CONFIG));
-                        return ((cfg >> 17) & 0x3ff);
-                }
-        } else if (this_is_starfire != 0) {
-                return starfire_hard_smp_processor_id();
-        } else {
-                unsigned long upaconfig;
-                __asm__ __volatile__("ldxa      [%%g0] %1, %0"
-                                     : "=r" (upaconfig)
-                                     : "i" (ASI_UPA_CONFIG));
-                return ((upaconfig >> 17) & 0x1f);
-        }
-}
-
+extern int hard_smp_processor_id(void);
 #define raw_smp_processor_id() (current_thread_info()->cpu)
 
 extern void smp_setup_cpu_possible_map(void);
diff --git a/include/asm-sparc64/sparsemem.h b/include/asm-sparc64/sparsemem.h
new file mode 100644
index 000000000000..ed5c9d8541e2
--- /dev/null
+++ b/include/asm-sparc64/sparsemem.h
@@ -0,0 +1,12 @@
+#ifndef _SPARC64_SPARSEMEM_H
+#define _SPARC64_SPARSEMEM_H
+
+#ifdef __KERNEL__
+
+#define SECTION_SIZE_BITS       26
+#define MAX_PHYSADDR_BITS       42
+#define MAX_PHYSMEM_BITS        42
+
+#endif /* !(__KERNEL__) */
+
+#endif /* !(_SPARC64_SPARSEMEM_H) */
diff --git a/include/asm-sparc64/spitfire.h b/include/asm-sparc64/spitfire.h
index 962638c9d122..23ad8a7987ad 100644
--- a/include/asm-sparc64/spitfire.h
+++ b/include/asm-sparc64/spitfire.h
@@ -44,6 +44,7 @@ enum ultra_tlb_layout {
         spitfire = 0,
         cheetah = 1,
         cheetah_plus = 2,
+        hypervisor = 3,
 };
 
 extern enum ultra_tlb_layout tlb_type;
diff --git a/include/asm-sparc64/system.h b/include/asm-sparc64/system.h
index af254e581834..a18ec87a52c1 100644
--- a/include/asm-sparc64/system.h
+++ b/include/asm-sparc64/system.h
@@ -209,9 +209,10 @@ do {	if (test_thread_flag(TIF_PERFCTR)) {				\
         /* so that ASI is only written if it changes, think again. */   \
         __asm__ __volatile__("wr %%g0, %0, %%asi"                       \
         : : "r" (__thread_flag_byte_ptr(task_thread_info(next))[TI_FLAG_BYTE_CURRENT_DS]));\
+        trap_block[current_thread_info()->cpu].thread =                 \
+                task_thread_info(next);                                 \
         __asm__ __volatile__(                                           \
         "mov    %%g4, %%g7\n\t"                                         \
-        "wrpr   %%g0, 0x95, %%pstate\n\t"                               \
         "stx    %%i6, [%%sp + 2047 + 0x70]\n\t"                         \
         "stx    %%i7, [%%sp + 2047 + 0x78]\n\t"                         \
         "rdpr   %%wstate, %%o5\n\t"                                     \
@@ -225,14 +226,10 @@ do {	if (test_thread_flag(TIF_PERFCTR)) {				\
         "ldx    [%%g6 + %3], %%o6\n\t"                                  \
         "ldub   [%%g6 + %2], %%o5\n\t"                                  \
         "ldub   [%%g6 + %4], %%o7\n\t"                                  \
-        "mov    %%g6, %%l2\n\t"                                         \
         "wrpr   %%o5, 0x0, %%wstate\n\t"                                \
         "ldx    [%%sp + 2047 + 0x70], %%i6\n\t"                         \
         "ldx    [%%sp + 2047 + 0x78], %%i7\n\t"                         \
-        "wrpr   %%g0, 0x94, %%pstate\n\t"                               \
-        "mov    %%l2, %%g6\n\t"                                         \
         "ldx    [%%g6 + %6], %%g4\n\t"                                  \
-        "wrpr   %%g0, 0x96, %%pstate\n\t"                               \
         "brz,pt %%o7, 1f\n\t"                                           \
         " mov   %%g7, %0\n\t"                                           \
         "b,a ret_from_syscall\n\t"                                      \
diff --git a/include/asm-sparc64/thread_info.h b/include/asm-sparc64/thread_info.h
index ac9d068aab4f..2ebf7f27bf91 100644
--- a/include/asm-sparc64/thread_info.h
+++ b/include/asm-sparc64/thread_info.h
@@ -64,8 +64,6 @@ struct thread_info {
         __u64                   kernel_cntd0, kernel_cntd1;
         __u64                   pcr_reg;
 
-        __u64                   cee_stuff;
-
         struct restart_block    restart_block;
 
         struct pt_regs          *kern_una_regs;
@@ -104,10 +102,9 @@ struct thread_info {
 #define TI_KERN_CNTD0   0x00000480
 #define TI_KERN_CNTD1   0x00000488
 #define TI_PCR          0x00000490
-#define TI_CEE_STUFF    0x00000498
-#define TI_RESTART_BLOCK 0x000004a0
-#define TI_KUNA_REGS    0x000004c8
-#define TI_KUNA_INSN    0x000004d0
+#define TI_RESTART_BLOCK 0x00000498
+#define TI_KUNA_REGS    0x000004c0
+#define TI_KUNA_INSN    0x000004c8
 #define TI_FPREGS       0x00000500
 
 /* We embed this in the uppermost byte of thread_info->flags */
diff --git a/include/asm-sparc64/timex.h b/include/asm-sparc64/timex.h
index 9e8d4175bcb2..2a5e4ebaad80 100644
--- a/include/asm-sparc64/timex.h
+++ b/include/asm-sparc64/timex.h
@@ -14,4 +14,10 @@
 typedef unsigned long cycles_t;
 #define get_cycles()    tick_ops->get_tick()
 
+#define ARCH_HAS_READ_CURRENT_TIMER     1
+#define read_current_timer(timer_val_p)         \
+({      *timer_val_p = tick_ops->get_tick();    \
+        0;                                      \
+})
+
 #endif
diff --git a/include/asm-sparc64/tlbflush.h b/include/asm-sparc64/tlbflush.h
index 3ef9909ac3ac..9ad5d9c51d42 100644
--- a/include/asm-sparc64/tlbflush.h
+++ b/include/asm-sparc64/tlbflush.h
@@ -5,6 +5,11 @@
 #include <linux/mm.h>
 #include <asm/mmu_context.h>
 
+/* TSB flush operations. */
+struct mmu_gather;
+extern void flush_tsb_kernel_range(unsigned long start, unsigned long end);
+extern void flush_tsb_user(struct mmu_gather *mp);
+
 /* TLB flush operations. */
 
 extern void flush_tlb_pending(void);
@@ -14,28 +19,36 @@ extern void flush_tlb_pending(void);
 #define flush_tlb_page(vma,addr)        flush_tlb_pending()
 #define flush_tlb_mm(mm)                flush_tlb_pending()
 
+/* Local cpu only.  */
 extern void __flush_tlb_all(void);
+
 extern void __flush_tlb_page(unsigned long context, unsigned long page, unsigned long r);
 
 extern void __flush_tlb_kernel_range(unsigned long start, unsigned long end);
 
 #ifndef CONFIG_SMP
 
-#define flush_tlb_all()         __flush_tlb_all()
 #define flush_tlb_kernel_range(start,end) \
-        __flush_tlb_kernel_range(start,end)
+do {    flush_tsb_kernel_range(start,end); \
+        __flush_tlb_kernel_range(start,end); \
+} while (0)
 
 #else /* CONFIG_SMP */
 
-extern void smp_flush_tlb_all(void);
 extern void smp_flush_tlb_kernel_range(unsigned long start, unsigned long end);
 
-#define flush_tlb_all()         smp_flush_tlb_all()
 #define flush_tlb_kernel_range(start, end) \
-        smp_flush_tlb_kernel_range(start, end)
+do {    flush_tsb_kernel_range(start,end); \
+        smp_flush_tlb_kernel_range(start, end); \
+} while (0)
 
 #endif /* ! CONFIG_SMP */
 
-extern void flush_tlb_pgtables(struct mm_struct *, unsigned long, unsigned long);
+static inline void flush_tlb_pgtables(struct mm_struct *mm, unsigned long start, unsigned long end)
+{
+        /* We don't use virtual page tables for TLB miss processing
+         * any more.  Nowadays we use the TSB.
+         */
+}
 
 #endif /* _SPARC64_TLBFLUSH_H */
diff --git a/include/asm-sparc64/tsb.h b/include/asm-sparc64/tsb.h
new file mode 100644
index 000000000000..e82612cd9f33
--- /dev/null
+++ b/include/asm-sparc64/tsb.h
@@ -0,0 +1,281 @@
+#ifndef _SPARC64_TSB_H
+#define _SPARC64_TSB_H
+
+/* The sparc64 TSB is similar to the powerpc hashtables.  It's a
+ * power-of-2 sized table of TAG/PTE pairs.  The cpu precomputes
+ * pointers into this table for 8K and 64K page sizes, and also a
+ * comparison TAG based upon the virtual address and context which
+ * faults.
+ *
+ * TLB miss trap handler software does the actual lookup via something
+ * of the form:
+ *
+ *      ldxa            [%g0] ASI_{D,I}MMU_TSB_8KB_PTR, %g1
+ *      ldxa            [%g0] ASI_{D,I}MMU, %g6
+ *      sllx            %g6, 22, %g6
+ *      srlx            %g6, 22, %g6
+ *      ldda            [%g1] ASI_NUCLEUS_QUAD_LDD, %g4
+ *      cmp             %g4, %g6
+ *      bne,pn  %xcc, tsb_miss_{d,i}tlb
+ *       mov            FAULT_CODE_{D,I}TLB, %g3
+ *      stxa            %g5, [%g0] ASI_{D,I}TLB_DATA_IN
+ *      retry
+ *
+ *
+ * Each 16-byte slot of the TSB is the 8-byte tag and then the 8-byte
+ * PTE.  The TAG is of the same layout as the TLB TAG TARGET mmu
+ * register which is:
+ *
+ * -------------------------------------------------
+ * |  -  |  CONTEXT |  -  |    VADDR bits 63:22    |
+ * -------------------------------------------------
+ *  63 61 60      48 47 42 41                     0
+ *
+ * But actually, since we use per-mm TSB's, we zero out the CONTEXT
+ * field.
+ *
+ * Like the powerpc hashtables we need to use locking in order to
+ * synchronize while we update the entries.  PTE updates need locking
+ * as well.
+ *
+ * We need to carefully choose a lock bits for the TSB entry.  We
+ * choose to use bit 47 in the tag.  Also, since we never map anything
+ * at page zero in context zero, we use zero as an invalid tag entry.
+ * When the lock bit is set, this forces a tag comparison failure.
+ */
+
+#define TSB_TAG_LOCK_BIT        47
+#define TSB_TAG_LOCK_HIGH       (1 << (TSB_TAG_LOCK_BIT - 32))
+
+#define TSB_TAG_INVALID_BIT     46
+#define TSB_TAG_INVALID_HIGH    (1 << (TSB_TAG_INVALID_BIT - 32))
+
+#define TSB_MEMBAR      membar  #StoreStore
+
+/* Some cpus support physical address quad loads.  We want to use
+ * those if possible so we don't need to hard-lock the TSB mapping
+ * into the TLB.  We encode some instruction patching in order to
+ * support this.
+ *
+ * The kernel TSB is locked into the TLB by virtue of being in the
+ * kernel image, so we don't play these games for swapper_tsb access.
+ */
+#ifndef __ASSEMBLY__
+struct tsb_ldquad_phys_patch_entry {
+        unsigned int    addr;
+        unsigned int    sun4u_insn;
+        unsigned int    sun4v_insn;
+};
+extern struct tsb_ldquad_phys_patch_entry __tsb_ldquad_phys_patch,
+        __tsb_ldquad_phys_patch_end;
+
+struct tsb_phys_patch_entry {
+        unsigned int    addr;
+        unsigned int    insn;
+};
+extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
+#endif
+#define TSB_LOAD_QUAD(TSB, REG) \
+661:    ldda            [TSB] ASI_NUCLEUS_QUAD_LDD, REG; \
+        .section        .tsb_ldquad_phys_patch, "ax"; \
+        .word           661b; \
+        ldda            [TSB] ASI_QUAD_LDD_PHYS, REG; \
+        ldda            [TSB] ASI_QUAD_LDD_PHYS_4V, REG; \
+        .previous
+
+#define TSB_LOAD_TAG_HIGH(TSB, REG) \
+661:    lduwa           [TSB] ASI_N, REG; \
+        .section        .tsb_phys_patch, "ax"; \
+        .word           661b; \
+        lduwa           [TSB] ASI_PHYS_USE_EC, REG; \
+        .previous
+
+#define TSB_LOAD_TAG(TSB, REG) \
+661:    ldxa            [TSB] ASI_N, REG; \
+        .section        .tsb_phys_patch, "ax"; \
+        .word           661b; \
+        ldxa            [TSB] ASI_PHYS_USE_EC, REG; \
+        .previous
+
+#define TSB_CAS_TAG_HIGH(TSB, REG1, REG2) \
+661:    casa            [TSB] ASI_N, REG1, REG2; \
+        .section        .tsb_phys_patch, "ax"; \
+        .word           661b; \
+        casa            [TSB] ASI_PHYS_USE_EC, REG1, REG2; \
+        .previous
+
+#define TSB_CAS_TAG(TSB, REG1, REG2) \
+661:    casxa           [TSB] ASI_N, REG1, REG2; \
+        .section        .tsb_phys_patch, "ax"; \
+        .word           661b; \
+        casxa           [TSB] ASI_PHYS_USE_EC, REG1, REG2; \
+        .previous
+
+#define TSB_STORE(ADDR, VAL) \
+661:    stxa            VAL, [ADDR] ASI_N; \
+        .section        .tsb_phys_patch, "ax"; \
+        .word           661b; \
+        stxa            VAL, [ADDR] ASI_PHYS_USE_EC; \
+        .previous
+
+#define TSB_LOCK_TAG(TSB, REG1, REG2)   \
+99:     TSB_LOAD_TAG_HIGH(TSB, REG1);   \
+        sethi   %hi(TSB_TAG_LOCK_HIGH), REG2;\
+        andcc   REG1, REG2, %g0;        \
+        bne,pn  %icc, 99b;              \
+         nop;                           \
+        TSB_CAS_TAG_HIGH(TSB, REG1, REG2);      \
+        cmp     REG1, REG2;             \
+        bne,pn  %icc, 99b;              \
+         nop;                           \
+        TSB_MEMBAR
+
+#define TSB_WRITE(TSB, TTE, TAG) \
+        add     TSB, 0x8, TSB;   \
+        TSB_STORE(TSB, TTE);     \
+        sub     TSB, 0x8, TSB;   \
+        TSB_MEMBAR;              \
+        TSB_STORE(TSB, TAG);
+
+#define KTSB_LOAD_QUAD(TSB, REG) \
+        ldda            [TSB] ASI_NUCLEUS_QUAD_LDD, REG;
+
+#define KTSB_STORE(ADDR, VAL) \
+        stxa            VAL, [ADDR] ASI_N;
+
+#define KTSB_LOCK_TAG(TSB, REG1, REG2)  \
+99:     lduwa   [TSB] ASI_N, REG1;      \
+        sethi   %hi(TSB_TAG_LOCK_HIGH), REG2;\
+        andcc   REG1, REG2, %g0;        \
+        bne,pn  %icc, 99b;              \
+         nop;                           \
+        casa    [TSB] ASI_N, REG1, REG2;\
+        cmp     REG1, REG2;             \
+        bne,pn  %icc, 99b;              \
+         nop;                           \
+        TSB_MEMBAR
+
+#define KTSB_WRITE(TSB, TTE, TAG) \
+        add     TSB, 0x8, TSB;   \
+        stxa    TTE, [TSB] ASI_N;     \
+        sub     TSB, 0x8, TSB;   \
+        TSB_MEMBAR;              \
+        stxa    TAG, [TSB] ASI_N;
+
+        /* Do a kernel page table walk.  Leaves physical PTE pointer in
+         * REG1.  Jumps to FAIL_LABEL on early page table walk termination.
+         * VADDR will not be clobbered, but REG2 will.
+         */
+#define KERN_PGTABLE_WALK(VADDR, REG1, REG2, FAIL_LABEL)        \
+        sethi           %hi(swapper_pg_dir), REG1; \
+        or              REG1, %lo(swapper_pg_dir), REG1; \
+        sllx            VADDR, 64 - (PGDIR_SHIFT + PGDIR_BITS), REG2; \
+        srlx            REG2, 64 - PAGE_SHIFT, REG2; \
+        andn            REG2, 0x3, REG2; \
+        lduw            [REG1 + REG2], REG1; \
+        brz,pn          REG1, FAIL_LABEL; \
+         sllx           VADDR, 64 - (PMD_SHIFT + PMD_BITS), REG2; \
+        srlx            REG2, 64 - PAGE_SHIFT, REG2; \
+        sllx            REG1, 11, REG1; \
+        andn            REG2, 0x3, REG2; \
+        lduwa           [REG1 + REG2] ASI_PHYS_USE_EC, REG1; \
+        brz,pn          REG1, FAIL_LABEL; \
+         sllx           VADDR, 64 - PMD_SHIFT, REG2; \
+        srlx            REG2, 64 - PAGE_SHIFT, REG2; \
+        sllx            REG1, 11, REG1; \
+        andn            REG2, 0x7, REG2; \
+        add             REG1, REG2, REG1;
+
+        /* Do a user page table walk in MMU globals.  Leaves physical PTE
+         * pointer in REG1.  Jumps to FAIL_LABEL on early page table walk
+         * termination.  Physical base of page tables is in PHYS_PGD which
+         * will not be modified.
+         *
+         * VADDR will not be clobbered, but REG1 and REG2 will.
+         */
+#define USER_PGTABLE_WALK_TL1(VADDR, PHYS_PGD, REG1, REG2, FAIL_LABEL)  \
+        sllx            VADDR, 64 - (PGDIR_SHIFT + PGDIR_BITS), REG2; \
+        srlx            REG2, 64 - PAGE_SHIFT, REG2; \
+        andn            REG2, 0x3, REG2; \
+        lduwa           [PHYS_PGD + REG2] ASI_PHYS_USE_EC, REG1; \
+        brz,pn          REG1, FAIL_LABEL; \
+         sllx           VADDR, 64 - (PMD_SHIFT + PMD_BITS), REG2; \
+        srlx            REG2, 64 - PAGE_SHIFT, REG2; \
+        sllx            REG1, 11, REG1; \
+        andn            REG2, 0x3, REG2; \
+        lduwa           [REG1 + REG2] ASI_PHYS_USE_EC, REG1; \
+        brz,pn          REG1, FAIL_LABEL; \
+         sllx           VADDR, 64 - PMD_SHIFT, REG2; \
+        srlx            REG2, 64 - PAGE_SHIFT, REG2; \
+        sllx            REG1, 11, REG1; \
+        andn            REG2, 0x7, REG2; \
+        add             REG1, REG2, REG1;
+
+/* Lookup a OBP mapping on VADDR in the prom_trans[] table at TL>0.
+ * If no entry is found, FAIL_LABEL will be branched to.  On success
+ * the resulting PTE value will be left in REG1.  VADDR is preserved
+ * by this routine.
+ */
+#define OBP_TRANS_LOOKUP(VADDR, REG1, REG2, REG3, FAIL_LABEL) \
+        sethi           %hi(prom_trans), REG1; \
+        or              REG1, %lo(prom_trans), REG1; \
+97:     ldx             [REG1 + 0x00], REG2; \
+        brz,pn          REG2, FAIL_LABEL; \
+         nop; \
+        ldx             [REG1 + 0x08], REG3; \
+        add             REG2, REG3, REG3; \
+        cmp             REG2, VADDR; \
+        bgu,pt          %xcc, 98f; \
+         cmp            VADDR, REG3; \
+        bgeu,pt         %xcc, 98f; \
+         ldx            [REG1 + 0x10], REG3; \
+        sub             VADDR, REG2, REG2; \
+        ba,pt           %xcc, 99f; \
+         add            REG3, REG2, REG1; \
+98:     ba,pt           %xcc, 97b; \
+         add            REG1, (3 * 8), REG1; \
+99:
+
+        /* We use a 32K TSB for the whole kernel, this allows to
+         * handle about 16MB of modules and vmalloc mappings without
+         * incurring many hash conflicts.
+         */
+#define KERNEL_TSB_SIZE_BYTES   (32 * 1024)
+#define KERNEL_TSB_NENTRIES     \
+        (KERNEL_TSB_SIZE_BYTES / 16)
+#define KERNEL_TSB4M_NENTRIES   4096
+
+        /* Do a kernel TSB lookup at tl>0 on VADDR+TAG, branch to OK_LABEL
+         * on TSB hit.  REG1, REG2, REG3, and REG4 are used as temporaries
+         * and the found TTE will be left in REG1.  REG3 and REG4 must
+         * be an even/odd pair of registers.
+         *
+         * VADDR and TAG will be preserved and not clobbered by this macro.
+         */
+#define KERN_TSB_LOOKUP_TL1(VADDR, TAG, REG1, REG2, REG3, REG4, OK_LABEL) \
+        sethi           %hi(swapper_tsb), REG1; \
+        or              REG1, %lo(swapper_tsb), REG1; \
+        srlx            VADDR, PAGE_SHIFT, REG2; \
+        and             REG2, (KERNEL_TSB_NENTRIES - 1), REG2; \
+        sllx            REG2, 4, REG2; \
+        add             REG1, REG2, REG2; \
+        KTSB_LOAD_QUAD(REG2, REG3); \
+        cmp             REG3, TAG; \
+        be,a,pt         %xcc, OK_LABEL; \
+         mov            REG4, REG1;
+
+        /* This version uses a trick, the TAG is already (VADDR >> 22) so
+         * we can make use of that for the index computation.
+         */
+#define KERN_TSB4M_LOOKUP_TL1(TAG, REG1, REG2, REG3, REG4, OK_LABEL) \
+        sethi           %hi(swapper_4m_tsb), REG1; \
+        or              REG1, %lo(swapper_4m_tsb), REG1; \
+        and             TAG, (KERNEL_TSB_NENTRIES - 1), REG2; \
+        sllx            REG2, 4, REG2; \
+        add             REG1, REG2, REG2; \
+        KTSB_LOAD_QUAD(REG2, REG3); \
+        cmp             REG3, TAG; \
+        be,a,pt         %xcc, OK_LABEL; \
+         mov            REG4, REG1;
+
+#endif /* !(_SPARC64_TSB_H) */
diff --git a/include/asm-sparc64/ttable.h b/include/asm-sparc64/ttable.h
index 2784f80094c3..2d5e3c464df5 100644
--- a/include/asm-sparc64/ttable.h
+++ b/include/asm-sparc64/ttable.h
@@ -93,7 +93,7 @@
         
 #define SYSCALL_TRAP(routine, systbl)                   \
         sethi   %hi(109f), %g7;                         \
-        ba,pt   %xcc, scetrap;                          \
+        ba,pt   %xcc, etrap;                            \
 109:     or     %g7, %lo(109b), %g7;                    \
         sethi   %hi(systbl), %l7;                       \
         ba,pt   %xcc, routine;                          \
@@ -109,14 +109,14 @@
         nop;nop;nop;
         
 #define TRAP_UTRAP(handler,lvl)                         \
-        ldx     [%g6 + TI_UTRAPS], %g1;                 \
-        sethi   %hi(109f), %g7;                         \
-        brz,pn  %g1, utrap;                             \
-         or     %g7, %lo(109f), %g7;                    \
-        ba,pt   %xcc, utrap;                            \
-109:     ldx    [%g1 + handler*8], %g1;                 \
-        ba,pt   %xcc, utrap_ill;                        \
-         mov    lvl, %o1;
+        mov     handler, %g3;                           \
+        ba,pt   %xcc, utrap_trap;                       \
+         mov    lvl, %g4;                               \
+        nop;                                            \
+        nop;                                            \
+        nop;                                            \
+        nop;                                            \
+        nop;
 
 #ifdef CONFIG_SUNOS_EMUL
 #define SUNOS_SYSCALL_TRAP SYSCALL_TRAP(linux_sparc_syscall32, sunos_sys_table)
@@ -136,8 +136,6 @@
 #else
 #define SOLARIS_SYSCALL_TRAP TRAP(solaris_syscall)
 #endif
-/* FIXME: Write these actually */       
-#define NETBSD_SYSCALL_TRAP TRAP(netbsd_syscall)
 #define BREAKPOINT_TRAP TRAP(breakpoint_trap)
 
 #define TRAP_IRQ(routine, level)                        \
@@ -182,6 +180,26 @@
 #define KPROBES_TRAP(lvl) TRAP_ARG(bad_trap, lvl)
 #endif
 
+#define SUN4V_ITSB_MISS                                 \
+        ldxa    [%g0] ASI_SCRATCHPAD, %g2;              \
+        ldx     [%g2 + HV_FAULT_I_ADDR_OFFSET], %g4;    \
+        ldx     [%g2 + HV_FAULT_I_CTX_OFFSET], %g5;     \
+        srlx    %g4, 22, %g6;                           \
+        ba,pt   %xcc, sun4v_itsb_miss;                  \
+         nop;                                           \
+        nop;                                            \
+        nop;
+
+#define SUN4V_DTSB_MISS                                 \
+        ldxa    [%g0] ASI_SCRATCHPAD, %g2;              \
+        ldx     [%g2 + HV_FAULT_D_ADDR_OFFSET], %g4;    \
+        ldx     [%g2 + HV_FAULT_D_CTX_OFFSET], %g5;     \
+        srlx    %g4, 22, %g6;                           \
+        ba,pt   %xcc, sun4v_dtsb_miss;                  \
+         nop;                                           \
+        nop;                                            \
+        nop;
+
 /* Before touching these macros, you owe it to yourself to go and
  * see how arch/sparc64/kernel/winfixup.S works... -DaveM
  *
@@ -221,6 +239,31 @@
         saved; retry; nop; nop; nop; nop; nop; nop;     \
         nop; nop; nop; nop; nop; nop; nop; nop;
 
+#define SPILL_0_NORMAL_ETRAP                            \
+etrap_kernel_spill:                                     \
+        stx     %l0, [%sp + STACK_BIAS + 0x00];         \
+        stx     %l1, [%sp + STACK_BIAS + 0x08];         \
+        stx     %l2, [%sp + STACK_BIAS + 0x10];         \
+        stx     %l3, [%sp + STACK_BIAS + 0x18];         \
+        stx     %l4, [%sp + STACK_BIAS + 0x20];         \
+        stx     %l5, [%sp + STACK_BIAS + 0x28];         \
+        stx     %l6, [%sp + STACK_BIAS + 0x30];         \
+        stx     %l7, [%sp + STACK_BIAS + 0x38];         \
+        stx     %i0, [%sp + STACK_BIAS + 0x40];         \
+        stx     %i1, [%sp + STACK_BIAS + 0x48];         \
+        stx     %i2, [%sp + STACK_BIAS + 0x50];         \
+        stx     %i3, [%sp + STACK_BIAS + 0x58];         \
+        stx     %i4, [%sp + STACK_BIAS + 0x60];         \
+        stx     %i5, [%sp + STACK_BIAS + 0x68];         \
+        stx     %i6, [%sp + STACK_BIAS + 0x70];         \
+        stx     %i7, [%sp + STACK_BIAS + 0x78];         \
+        saved;                                          \
+        sub     %g1, 2, %g1;                            \
+        ba,pt   %xcc, etrap_save;                       \
+        wrpr    %g1, %cwp;                              \
+        nop; nop; nop; nop; nop; nop; nop; nop;         \
+        nop; nop; nop; nop;
+
 /* Normal 64bit spill */
 #define SPILL_1_GENERIC(ASI)                            \
         add     %sp, STACK_BIAS + 0x00, %g1;            \
@@ -254,6 +297,67 @@
         b,a,pt  %xcc, spill_fixup_mna;                  \
         b,a,pt  %xcc, spill_fixup;
 
+#define SPILL_1_GENERIC_ETRAP                           \
+etrap_user_spill_64bit:                                 \
+        stxa    %l0, [%sp + STACK_BIAS + 0x00] %asi;    \
+        stxa    %l1, [%sp + STACK_BIAS + 0x08] %asi;    \
+        stxa    %l2, [%sp + STACK_BIAS + 0x10] %asi;    \
+        stxa    %l3, [%sp + STACK_BIAS + 0x18] %asi;    \
+        stxa    %l4, [%sp + STACK_BIAS + 0x20] %asi;    \
+        stxa    %l5, [%sp + STACK_BIAS + 0x28] %asi;    \
+        stxa    %l6, [%sp + STACK_BIAS + 0x30] %asi;    \
+        stxa    %l7, [%sp + STACK_BIAS + 0x38] %asi;    \
+        stxa    %i0, [%sp + STACK_BIAS + 0x40] %asi;    \
+        stxa    %i1, [%sp + STACK_BIAS + 0x48] %asi;    \
+        stxa    %i2, [%sp + STACK_BIAS + 0x50] %asi;    \
+        stxa    %i3, [%sp + STACK_BIAS + 0x58] %asi;    \
+        stxa    %i4, [%sp + STACK_BIAS + 0x60] %asi;    \
+        stxa    %i5, [%sp + STACK_BIAS + 0x68] %asi;    \
+        stxa    %i6, [%sp + STACK_BIAS + 0x70] %asi;    \
+        stxa    %i7, [%sp + STACK_BIAS + 0x78] %asi;    \
+        saved;                                          \
+        sub     %g1, 2, %g1;                            \
+        ba,pt   %xcc, etrap_save;                       \
+         wrpr   %g1, %cwp;                              \
+        nop; nop; nop; nop; nop;                        \
+        nop; nop; nop; nop;                             \
+        ba,a,pt %xcc, etrap_spill_fixup_64bit;          \
+        ba,a,pt %xcc, etrap_spill_fixup_64bit;          \
+        ba,a,pt %xcc, etrap_spill_fixup_64bit;
+
+#define SPILL_1_GENERIC_ETRAP_FIXUP                     \
+etrap_spill_fixup_64bit:                                \
+        ldub    [%g6 + TI_WSAVED], %g1;                 \
+        sll     %g1, 3, %g3;                            \
+        add     %g6, %g3, %g3;                          \
+        stx     %sp, [%g3 + TI_RWIN_SPTRS];             \
+        sll     %g1, 7, %g3;                            \
+        add     %g6, %g3, %g3;                          \
+        stx     %l0, [%g3 + TI_REG_WINDOW + 0x00];      \
+        stx     %l1, [%g3 + TI_REG_WINDOW + 0x08];      \
+        stx     %l2, [%g3 + TI_REG_WINDOW + 0x10];      \
+        stx     %l3, [%g3 + TI_REG_WINDOW + 0x18];      \
+        stx     %l4, [%g3 + TI_REG_WINDOW + 0x20];      \
+        stx     %l5, [%g3 + TI_REG_WINDOW + 0x28];      \
+        stx     %l6, [%g3 + TI_REG_WINDOW + 0x30];      \
+        stx     %l7, [%g3 + TI_REG_WINDOW + 0x38];      \
+        stx     %i0, [%g3 + TI_REG_WINDOW + 0x40];      \
+        stx     %i1, [%g3 + TI_REG_WINDOW + 0x48];      \
+        stx     %i2, [%g3 + TI_REG_WINDOW + 0x50];      \
+        stx     %i3, [%g3 + TI_REG_WINDOW + 0x58];      \
+        stx     %i4, [%g3 + TI_REG_WINDOW + 0x60];      \
+        stx     %i5, [%g3 + TI_REG_WINDOW + 0x68];      \
+        stx     %i6, [%g3 + TI_REG_WINDOW + 0x70];      \
+        stx     %i7, [%g3 + TI_REG_WINDOW + 0x78];      \
+        add     %g1, 1, %g1;                            \
+        stb     %g1, [%g6 + TI_WSAVED];                 \
+        saved;                                          \
+        rdpr    %cwp, %g1;                              \
+        sub     %g1, 2, %g1;                            \
+        ba,pt   %xcc, etrap_save;                       \
+         wrpr   %g1, %cwp;                              \
+        nop; nop; nop
+
 /* Normal 32bit spill */
 #define SPILL_2_GENERIC(ASI)                            \
         srl     %sp, 0, %sp;                            \
@@ -287,6 +391,68 @@
         b,a,pt  %xcc, spill_fixup_mna;                  \
         b,a,pt  %xcc, spill_fixup;
 
+#define SPILL_2_GENERIC_ETRAP           \
+etrap_user_spill_32bit:                 \
+        srl     %sp, 0, %sp;            \
+        stwa    %l0, [%sp + 0x00] %asi; \
+        stwa    %l1, [%sp + 0x04] %asi; \
+        stwa    %l2, [%sp + 0x08] %asi; \
+        stwa    %l3, [%sp + 0x0c] %asi; \
+        stwa    %l4, [%sp + 0x10] %asi; \
+        stwa    %l5, [%sp + 0x14] %asi; \
+        stwa    %l6, [%sp + 0x18] %asi; \
+        stwa    %l7, [%sp + 0x1c] %asi; \
+        stwa    %i0, [%sp + 0x20] %asi; \
+        stwa    %i1, [%sp + 0x24] %asi; \
+        stwa    %i2, [%sp + 0x28] %asi; \
+        stwa    %i3, [%sp + 0x2c] %asi; \
+        stwa    %i4, [%sp + 0x30] %asi; \
+        stwa    %i5, [%sp + 0x34] %asi; \
+        stwa    %i6, [%sp + 0x38] %asi; \
+        stwa    %i7, [%sp + 0x3c] %asi; \
+        saved;                          \
+        sub     %g1, 2, %g1;            \
+        ba,pt   %xcc, etrap_save;       \
+         wrpr   %g1, %cwp;              \
+        nop; nop; nop; nop;             \
+        nop; nop; nop; nop;             \
+        ba,a,pt %xcc, etrap_spill_fixup_32bit; \
+        ba,a,pt %xcc, etrap_spill_fixup_32bit; \
+        ba,a,pt %xcc, etrap_spill_fixup_32bit;
+
+#define SPILL_2_GENERIC_ETRAP_FIXUP                     \
+etrap_spill_fixup_32bit:                                \
+        ldub    [%g6 + TI_WSAVED], %g1;                 \
+        sll     %g1, 3, %g3;                            \
+        add     %g6, %g3, %g3;                          \
+        stx     %sp, [%g3 + TI_RWIN_SPTRS];             \
+        sll     %g1, 7, %g3;                            \
+        add     %g6, %g3, %g3;                          \
+        stw     %l0, [%g3 + TI_REG_WINDOW + 0x00];      \
+        stw     %l1, [%g3 + TI_REG_WINDOW + 0x04];      \
+        stw     %l2, [%g3 + TI_REG_WINDOW + 0x08];      \
+        stw     %l3, [%g3 + TI_REG_WINDOW + 0x0c];      \
+        stw     %l4, [%g3 + TI_REG_WINDOW + 0x10];      \
+        stw     %l5, [%g3 + TI_REG_WINDOW + 0x14];      \
+        stw     %l6, [%g3 + TI_REG_WINDOW + 0x18];      \
+        stw     %l7, [%g3 + TI_REG_WINDOW + 0x1c];      \
+        stw     %i0, [%g3 + TI_REG_WINDOW + 0x20];      \
+        stw     %i1, [%g3 + TI_REG_WINDOW + 0x24];      \
+        stw     %i2, [%g3 + TI_REG_WINDOW + 0x28];      \
+        stw     %i3, [%g3 + TI_REG_WINDOW + 0x2c];      \
+        stw     %i4, [%g3 + TI_REG_WINDOW + 0x30];      \
+        stw     %i5, [%g3 + TI_REG_WINDOW + 0x34];      \
+        stw     %i6, [%g3 + TI_REG_WINDOW + 0x38];      \
+        stw     %i7, [%g3 + TI_REG_WINDOW + 0x3c];      \
+        add     %g1, 1, %g1;                            \
+        stb     %g1, [%g6 + TI_WSAVED];                 \
+        saved;                                          \
+        rdpr    %cwp, %g1;                              \
+        sub     %g1, 2, %g1;                            \
+        ba,pt   %xcc, etrap_save;                       \
+         wrpr   %g1, %cwp;                              \
+        nop; nop; nop
+
 #define SPILL_1_NORMAL SPILL_1_GENERIC(ASI_AIUP)
 #define SPILL_2_NORMAL SPILL_2_GENERIC(ASI_AIUP)
 #define SPILL_3_NORMAL SPILL_0_NORMAL
@@ -325,6 +491,35 @@
         restored; retry; nop; nop; nop; nop; nop; nop;  \
         nop; nop; nop; nop; nop; nop; nop; nop;
 
+#define FILL_0_NORMAL_RTRAP                             \
+kern_rtt_fill:                                          \
+        rdpr    %cwp, %g1;                              \
+        sub     %g1, 1, %g1;                            \
+        wrpr    %g1, %cwp;                              \
+        ldx     [%sp + STACK_BIAS + 0x00], %l0;         \
+        ldx     [%sp + STACK_BIAS + 0x08], %l1;         \
+        ldx     [%sp + STACK_BIAS + 0x10], %l2;         \
+        ldx     [%sp + STACK_BIAS + 0x18], %l3;         \
+        ldx     [%sp + STACK_BIAS + 0x20], %l4;         \
+        ldx     [%sp + STACK_BIAS + 0x28], %l5;         \
+        ldx     [%sp + STACK_BIAS + 0x30], %l6;         \
+        ldx     [%sp + STACK_BIAS + 0x38], %l7;         \
+        ldx     [%sp + STACK_BIAS + 0x40], %i0;         \
+        ldx     [%sp + STACK_BIAS + 0x48], %i1;         \
+        ldx     [%sp + STACK_BIAS + 0x50], %i2;         \
+        ldx     [%sp + STACK_BIAS + 0x58], %i3;         \
+        ldx     [%sp + STACK_BIAS + 0x60], %i4;         \
+        ldx     [%sp + STACK_BIAS + 0x68], %i5;         \
+        ldx     [%sp + STACK_BIAS + 0x70], %i6;         \
+        ldx     [%sp + STACK_BIAS + 0x78], %i7;         \
+        restored;                                       \
+        add     %g1, 1, %g1;                            \
+        ba,pt   %xcc, kern_rtt_restore;                 \
+         wrpr   %g1, %cwp;                              \
+        nop; nop; nop; nop; nop;                        \
+        nop; nop; nop; nop;
+
+
 /* Normal 64bit fill */
 #define FILL_1_GENERIC(ASI)                             \
         add     %sp, STACK_BIAS + 0x00, %g1;            \
@@ -356,6 +551,33 @@
         b,a,pt  %xcc, fill_fixup_mna;                   \
         b,a,pt  %xcc, fill_fixup;
 
+#define FILL_1_GENERIC_RTRAP                            \
+user_rtt_fill_64bit:                                    \
+        ldxa    [%sp + STACK_BIAS + 0x00] %asi, %l0;    \
+        ldxa    [%sp + STACK_BIAS + 0x08] %asi, %l1;    \
+        ldxa    [%sp + STACK_BIAS + 0x10] %asi, %l2;    \
+        ldxa    [%sp + STACK_BIAS + 0x18] %asi, %l3;    \
+        ldxa    [%sp + STACK_BIAS + 0x20] %asi, %l4;    \
+        ldxa    [%sp + STACK_BIAS + 0x28] %asi, %l5;    \
+        ldxa    [%sp + STACK_BIAS + 0x30] %asi, %l6;    \
+        ldxa    [%sp + STACK_BIAS + 0x38] %asi, %l7;    \
+        ldxa    [%sp + STACK_BIAS + 0x40] %asi, %i0;    \
+        ldxa    [%sp + STACK_BIAS + 0x48] %asi, %i1;    \
+        ldxa    [%sp + STACK_BIAS + 0x50] %asi, %i2;    \
+        ldxa    [%sp + STACK_BIAS + 0x58] %asi, %i3;    \
+        ldxa    [%sp + STACK_BIAS + 0x60] %asi, %i4;    \
+        ldxa    [%sp + STACK_BIAS + 0x68] %asi, %i5;    \
+        ldxa    [%sp + STACK_BIAS + 0x70] %asi, %i6;    \
+        ldxa    [%sp + STACK_BIAS + 0x78] %asi, %i7;    \
+        ba,pt   %xcc, user_rtt_pre_restore;             \
+         restored;                                      \
+        nop; nop; nop; nop; nop; nop;                   \
+        nop; nop; nop; nop; nop;                        \
+        ba,a,pt %xcc, user_rtt_fill_fixup;              \
+        ba,a,pt %xcc, user_rtt_fill_fixup;              \
+        ba,a,pt %xcc, user_rtt_fill_fixup;
+
+
 /* Normal 32bit fill */
 #define FILL_2_GENERIC(ASI)                             \
         srl     %sp, 0, %sp;                            \
@@ -387,6 +609,34 @@
         b,a,pt  %xcc, fill_fixup_mna;                   \
         b,a,pt  %xcc, fill_fixup;
 
+#define FILL_2_GENERIC_RTRAP                            \
+user_rtt_fill_32bit:                                    \
+        srl     %sp, 0, %sp;                            \
+        lduwa   [%sp + 0x00] %asi, %l0;                 \
+        lduwa   [%sp + 0x04] %asi, %l1;                 \
+        lduwa   [%sp + 0x08] %asi, %l2;                 \
+        lduwa   [%sp + 0x0c] %asi, %l3;                 \
+        lduwa   [%sp + 0x10] %asi, %l4;                 \
+        lduwa   [%sp + 0x14] %asi, %l5;                 \
+        lduwa   [%sp + 0x18] %asi, %l6;                 \
+        lduwa   [%sp + 0x1c] %asi, %l7;                 \
+        lduwa   [%sp + 0x20] %asi, %i0;                 \
+        lduwa   [%sp + 0x24] %asi, %i1;                 \
+        lduwa   [%sp + 0x28] %asi, %i2;                 \
+        lduwa   [%sp + 0x2c] %asi, %i3;                 \
+        lduwa   [%sp + 0x30] %asi, %i4;                 \
+        lduwa   [%sp + 0x34] %asi, %i5;                 \
+        lduwa   [%sp + 0x38] %asi, %i6;                 \
+        lduwa   [%sp + 0x3c] %asi, %i7;                 \
+        ba,pt   %xcc, user_rtt_pre_restore;             \
+         restored;                                      \
+        nop; nop; nop; nop; nop;                        \
+        nop; nop; nop; nop; nop;                        \
+        ba,a,pt %xcc, user_rtt_fill_fixup;              \
+        ba,a,pt %xcc, user_rtt_fill_fixup;              \
+        ba,a,pt %xcc, user_rtt_fill_fixup;
+                
+
 #define FILL_1_NORMAL FILL_1_GENERIC(ASI_AIUP)
 #define FILL_2_NORMAL FILL_2_GENERIC(ASI_AIUP)
 #define FILL_3_NORMAL FILL_0_NORMAL
diff --git a/include/asm-sparc64/uaccess.h b/include/asm-sparc64/uaccess.h
index c91d1e38eac6..afe236ba555b 100644
--- a/include/asm-sparc64/uaccess.h
+++ b/include/asm-sparc64/uaccess.h
@@ -114,16 +114,6 @@ case 8: __put_user_asm(data,x,addr,__pu_ret); break; \
 default: __pu_ret = __put_user_bad(); break; \
 } __pu_ret; })
 
-#define __put_user_nocheck_ret(data,addr,size,retval) ({ \
-register int __foo __asm__ ("l1"); \
-switch (size) { \
-case 1: __put_user_asm_ret(data,b,addr,retval,__foo); break; \
-case 2: __put_user_asm_ret(data,h,addr,retval,__foo); break; \
-case 4: __put_user_asm_ret(data,w,addr,retval,__foo); break; \
-case 8: __put_user_asm_ret(data,x,addr,retval,__foo); break; \
-default: if (__put_user_bad()) return retval; break; \
-} })
-
 #define __put_user_asm(x,size,addr,ret)                                 \
 __asm__ __volatile__(                                                   \
         "/* Put user asm, inline. */\n"                                 \
@@ -143,33 +133,6 @@ __asm__ __volatile__(							\
        : "=r" (ret) : "r" (x), "r" (__m(addr)),                         \
          "i" (-EFAULT))
 
-#define __put_user_asm_ret(x,size,addr,ret,foo)                         \
-if (__builtin_constant_p(ret) && ret == -EFAULT)                        \
-__asm__ __volatile__(                                                   \
-        "/* Put user asm ret, inline. */\n"                             \
-"1:\t"  "st"#size "a %1, [%2] %%asi\n\n\t"                              \
-        ".section __ex_table,\"a\"\n\t"                                 \
-        ".align 4\n\t"                                                  \
-        ".word  1b, __ret_efault\n\n\t"                                 \
-        ".previous\n\n\t"                                               \
-       : "=r" (foo) : "r" (x), "r" (__m(addr)));                        \
-else                                                                    \
-__asm__ __volatile__(                                                   \
-        "/* Put user asm ret, inline. */\n"                             \
-"1:\t"  "st"#size "a %1, [%2] %%asi\n\n\t"                              \
-        ".section .fixup,#alloc,#execinstr\n\t"                         \
-        ".align 4\n"                                                    \
-"3:\n\t"                                                                \
-        "ret\n\t"                                                       \
-        " restore %%g0, %3, %%o0\n\n\t"                                 \
-        ".previous\n\t"                                                 \
-        ".section __ex_table,\"a\"\n\t"                                 \
-        ".align 4\n\t"                                                  \
-        ".word  1b, 3b\n\n\t"                                           \
-        ".previous\n\n\t"                                               \
-       : "=r" (foo) : "r" (x), "r" (__m(addr)),                         \
-         "i" (ret))
-
 extern int __put_user_bad(void);
 
 #define __get_user_nocheck(data,addr,size,type) ({ \
@@ -289,14 +252,7 @@ copy_in_user(void __user *to, void __user *from, unsigned long size)
 }
 #define __copy_in_user copy_in_user
 
-extern unsigned long __must_check __bzero_noasi(void __user *, unsigned long);
-
-static inline unsigned long __must_check
-__clear_user(void __user *addr, unsigned long size)
-{
-        
-        return __bzero_noasi(addr, size);
-}
+extern unsigned long __must_check __clear_user(void __user *, unsigned long);
 
 #define clear_user __clear_user
 
diff --git a/include/asm-sparc64/vdev.h b/include/asm-sparc64/vdev.h
new file mode 100644
index 000000000000..996e6be7b976
--- /dev/null
+++ b/include/asm-sparc64/vdev.h
@@ -0,0 +1,16 @@
+/* vdev.h: SUN4V virtual device interfaces and defines.
+ *
+ * Copyright (C) 2006 David S. Miller <davem@davemloft.net>
+ */
+
+#ifndef _SPARC64_VDEV_H
+#define _SPARC64_VDEV_H
+
+#include <linux/types.h>
+
+extern u32 sun4v_vdev_devhandle;
+extern int sun4v_vdev_root;
+
+extern unsigned int sun4v_vdev_device_interrupt(unsigned int);
+
+#endif /* !(_SPARC64_VDEV_H) */
diff --git a/include/asm-sparc64/xor.h b/include/asm-sparc64/xor.h
index 8b3a7e4b6062..8ce3f1813e28 100644
--- a/include/asm-sparc64/xor.h
+++ b/include/asm-sparc64/xor.h
@@ -2,9 +2,11 @@
  * include/asm-sparc64/xor.h
  *
  * High speed xor_block operation for RAID4/5 utilizing the
- * UltraSparc Visual Instruction Set.
+ * UltraSparc Visual Instruction Set and Niagara block-init
+ * twin-load instructions.
  *
  * Copyright (C) 1997, 1999 Jakub Jelinek (jj@ultra.linux.cz)
+ * Copyright (C) 2006 David S. Miller <davem@davemloft.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -16,8 +18,7 @@
  * Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
-#include <asm/pstate.h>
-#include <asm/asi.h>
+#include <asm/spitfire.h>
 
 extern void xor_vis_2(unsigned long, unsigned long *, unsigned long *);
 extern void xor_vis_3(unsigned long, unsigned long *, unsigned long *,
@@ -37,4 +38,29 @@ static struct xor_block_template xor_block_VIS = {
         .do_5   = xor_vis_5,
 };
 
-#define XOR_TRY_TEMPLATES       xor_speed(&xor_block_VIS)
+extern void xor_niagara_2(unsigned long, unsigned long *, unsigned long *);
+extern void xor_niagara_3(unsigned long, unsigned long *, unsigned long *,
+                          unsigned long *);
+extern void xor_niagara_4(unsigned long, unsigned long *, unsigned long *,
+                          unsigned long *, unsigned long *);
+extern void xor_niagara_5(unsigned long, unsigned long *, unsigned long *,
+                          unsigned long *, unsigned long *, unsigned long *);
+
+static struct xor_block_template xor_block_niagara = {
+        .name   = "Niagara",
+        .do_2   = xor_niagara_2,
+        .do_3   = xor_niagara_3,
+        .do_4   = xor_niagara_4,
+        .do_5   = xor_niagara_5,
+};
+
+#undef XOR_TRY_TEMPLATES
+#define XOR_TRY_TEMPLATES                               \
+        do {                                            \
+                xor_speed(&xor_block_VIS);              \
+                xor_speed(&xor_block_niagara);          \
+        } while (0)
+
+/* For VIS for everything except Niagara.  */
+#define XOR_SELECT_TEMPLATE(FASTEST) \
+        (tlb_type == hypervisor ? &xor_block_niagara : &xor_block_VIS)
diff --git a/include/linux/amba/clcd.h b/include/linux/amba/clcd.h
index 6b8d73dc1ab0..9cf64b1b688b 100644
--- a/include/linux/amba/clcd.h
+++ b/include/linux/amba/clcd.h
@@ -54,6 +54,7 @@
 #define CNTL_LCDBPP4            (2 << 1)
 #define CNTL_LCDBPP8            (3 << 1)
 #define CNTL_LCDBPP16           (4 << 1)
+#define CNTL_LCDBPP16_565       (6 << 1)
 #define CNTL_LCDBPP24           (5 << 1)
 #define CNTL_LCDBW              (1 << 4)
 #define CNTL_LCDTFT             (1 << 5)
@@ -209,7 +210,16 @@ static inline void clcdfb_decode(struct clcd_fb *fb, struct clcd_regs *regs)
                 val |= CNTL_LCDBPP8;
                 break;
         case 16:
-                val |= CNTL_LCDBPP16;
+                /*
+                 * PL110 cannot choose between 5551 and 565 modes in
+                 * its control register
+                 */
+                if ((fb->dev->periphid & 0x000fffff) == 0x00041110)
+                        val |= CNTL_LCDBPP16;
+                else if (fb->fb.var.green.length == 5)
+                        val |= CNTL_LCDBPP16;
+                else
+                        val |= CNTL_LCDBPP16_565;
                 break;
         case 32:
                 val |= CNTL_LCDBPP24;
diff --git a/include/linux/arcdevice.h b/include/linux/arcdevice.h
index 7198f129e135..231ba090ae34 100644
--- a/include/linux/arcdevice.h
+++ b/include/linux/arcdevice.h
@@ -206,7 +206,6 @@ struct ArcProto {
 
 extern struct ArcProto *arc_proto_map[256], *arc_proto_default,
         *arc_bcast_proto, *arc_raw_proto;
-extern struct ArcProto arc_proto_null;
 
 
 /*
@@ -334,17 +333,9 @@ void arcnet_dump_skb(struct net_device *dev, struct sk_buff *skb, char *desc);
 #define arcnet_dump_skb(dev,skb,desc) ;
 #endif
 
-#if (ARCNET_DEBUG_MAX & D_RX) || (ARCNET_DEBUG_MAX & D_TX)
-void arcnet_dump_packet(struct net_device *dev, int bufnum, char *desc,
-                        int take_arcnet_lock);
-#else
-#define arcnet_dump_packet(dev, bufnum, desc,take_arcnet_lock) ;
-#endif
-
 void arcnet_unregister_proto(struct ArcProto *proto);
 irqreturn_t arcnet_interrupt(int irq, void *dev_id, struct pt_regs *regs);
 struct net_device *alloc_arcdev(char *name);
-void arcnet_rx(struct net_device *dev, int bufnum);
 
 #endif                          /* __KERNEL__ */
 #endif                          /* _LINUX_ARCDEVICE_H */
diff --git a/include/linux/ata.h b/include/linux/ata.h
index 94f77cce27fa..b02a16c435e7 100644
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -267,6 +267,16 @@ struct ata_taskfile {
           ((u64) (id)[(n) + 1] << 16) | \
           ((u64) (id)[(n) + 0]) )
 
+static inline unsigned int ata_id_major_version(const u16 *id)
+{
+        unsigned int mver;
+
+        for (mver = 14; mver >= 1; mver--)
+                if (id[ATA_ID_MAJOR_VER] & (1 << mver))
+                        break;
+        return mver;
+}
+
 static inline int ata_id_current_chs_valid(const u16 *id)
 {
         /* For ATA-1 devices, if the INITIALIZE DEVICE PARAMETERS command 
@@ -302,4 +312,16 @@ static inline int ata_ok(u8 status)
                         == ATA_DRDY);
 }
 
+static inline int lba_28_ok(u64 block, u32 n_block)
+{
+        /* check the ending block number */
+        return ((block + n_block - 1) < ((u64)1 << 28)) && (n_block <= 256);
+}
+
+static inline int lba_48_ok(u64 block, u32 n_block)
+{
+        /* check the ending block number */
+        return ((block + n_block - 1) < ((u64)1 << 48)) && (n_block <= 65536);
+}
+
 #endif /* __LINUX_ATA_H__ */
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 860e7a485a5f..56bb6a4e15f3 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -58,7 +58,7 @@ struct cfq_io_context {
          * circular list of cfq_io_contexts belonging to a process io context
          */
         struct list_head list;
-        struct cfq_queue *cfqq;
+        struct cfq_queue *cfqq[2];
         void *key;
 
         struct io_context *ioc;
@@ -69,6 +69,8 @@ struct cfq_io_context {
         unsigned long ttime_samples;
         unsigned long ttime_mean;
 
+        struct list_head queue_list;
+
         void (*dtor)(struct cfq_io_context *);
         void (*exit)(struct cfq_io_context *);
 };
@@ -404,8 +406,6 @@ struct request_queue
 
         struct blk_queue_tag    *queue_tags;
 
-        atomic_t                refcnt;
-
         unsigned int            nr_sorted;
         unsigned int            in_flight;
 
@@ -424,6 +424,8 @@ struct request_queue
         struct request          pre_flush_rq, bar_rq, post_flush_rq;
         struct request          *orig_bar_rq;
         unsigned int            bi_size;
+
+        struct mutex            sysfs_lock;
 };
 
 #define RQ_INACTIVE             (-1)
@@ -725,7 +727,7 @@ extern long nr_blockdev_pages(void);
 int blk_get_queue(request_queue_t *);
 request_queue_t *blk_alloc_queue(gfp_t);
 request_queue_t *blk_alloc_queue_node(gfp_t, int);
-#define blk_put_queue(q) blk_cleanup_queue((q))
+extern void blk_put_queue(request_queue_t *);
 
 /*
  * tag stuff
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index 0ed1d4853c69..d612b89dce33 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -32,7 +32,7 @@ struct cpu {
 };
 
 extern int register_cpu(struct cpu *, int, struct node *);
-extern struct sys_device *get_cpu_sysdev(int cpu);
+extern struct sys_device *get_cpu_sysdev(unsigned cpu);
 #ifdef CONFIG_HOTPLUG_CPU
 extern void unregister_cpu(struct cpu *, struct node *);
 #endif
diff --git a/include/linux/crypto.h b/include/linux/crypto.h
index d88bf8aa8b47..0ab1bc1152ca 100644
--- a/include/linux/crypto.h
+++ b/include/linux/crypto.h
@@ -229,6 +229,8 @@ struct crypto_tfm {
         } crt_u;
         
         struct crypto_alg *__crt_alg;
+
+        char __crt_ctx[] __attribute__ ((__aligned__));
 };
 
 /* 
@@ -301,7 +303,13 @@ static inline unsigned int crypto_tfm_alg_alignmask(struct crypto_tfm *tfm)
 
 static inline void *crypto_tfm_ctx(struct crypto_tfm *tfm)
 {
-        return (void *)&tfm[1];
+        return tfm->__crt_ctx;
+}
+
+static inline unsigned int crypto_tfm_ctx_alignment(void)
+{
+        struct crypto_tfm *tfm;
+        return __alignof__(tfm->__crt_ctx);
 }
 
 /*
diff --git a/include/linux/dccp.h b/include/linux/dccp.h
index 088529f54965..676333b9fad0 100644
--- a/include/linux/dccp.h
+++ b/include/linux/dccp.h
@@ -18,7 +18,7 @@
  * @dccph_seq - sequence number high or low order 24 bits, depends on dccph_x
  */
 struct dccp_hdr {
-        __u16   dccph_sport,
+        __be16  dccph_sport,
                 dccph_dport;
         __u8    dccph_doff;
 #if defined(__LITTLE_ENDIAN_BITFIELD)
@@ -32,18 +32,18 @@ struct dccp_hdr {
 #endif
         __u16   dccph_checksum;
 #if defined(__LITTLE_ENDIAN_BITFIELD)
-        __u32   dccph_x:1,
+        __u8    dccph_x:1,
                 dccph_type:4,
-                dccph_reserved:3,
-                dccph_seq:24;
+                dccph_reserved:3;
 #elif defined(__BIG_ENDIAN_BITFIELD)
-        __u32   dccph_reserved:3,
+        __u8    dccph_reserved:3,
                 dccph_type:4,
-                dccph_x:1,
-                dccph_seq:24;
+                dccph_x:1;
 #else
 #error  "Adjust your <asm/byteorder.h> defines"
 #endif
+        __u8    dccph_seq2;
+        __be16  dccph_seq;
 };
 
 /**
@@ -52,7 +52,7 @@ struct dccp_hdr {
  * @dccph_seq_low - low 24 bits of a 48 bit seq packet
  */
 struct dccp_hdr_ext {
-        __u32   dccph_seq_low;
+        __be32  dccph_seq_low;
 };
 
 /**
@@ -62,7 +62,7 @@ struct dccp_hdr_ext {
  * @dccph_req_options - list of options (must be a multiple of 32 bits
  */
 struct dccp_hdr_request {
-        __u32   dccph_req_service;
+        __be32  dccph_req_service;
 };
 /**
  * struct dccp_hdr_ack_bits - acknowledgment bits common to most packets
@@ -71,9 +71,9 @@ struct dccp_hdr_request {
  * @dccph_resp_ack_nr_low - 48 bit ack number low order bits, contains GSR
  */
 struct dccp_hdr_ack_bits {
-        __u32   dccph_reserved1:8,
-                dccph_ack_nr_high:24;
-        __u32   dccph_ack_nr_low;
+        __be16  dccph_reserved1;
+        __be16  dccph_ack_nr_high;
+        __be32  dccph_ack_nr_low;
 };
 /**
  * struct dccp_hdr_response - Conection initiation response header
@@ -85,7 +85,7 @@ struct dccp_hdr_ack_bits {
  */
 struct dccp_hdr_response {
         struct dccp_hdr_ack_bits        dccph_resp_ack;
-        __u32                           dccph_resp_service;
+        __be32                          dccph_resp_service;
 };
 
 /**
@@ -154,6 +154,10 @@ enum {
         DCCPO_MANDATORY = 1,
         DCCPO_MIN_RESERVED = 3,
         DCCPO_MAX_RESERVED = 31,
+        DCCPO_CHANGE_L = 32,
+        DCCPO_CONFIRM_L = 33,
+        DCCPO_CHANGE_R = 34,
+        DCCPO_CONFIRM_R = 35,
         DCCPO_NDP_COUNT = 37,
         DCCPO_ACK_VECTOR_0 = 38,
         DCCPO_ACK_VECTOR_1 = 39,
@@ -168,7 +172,9 @@ enum {
 /* DCCP features */
 enum {
         DCCPF_RESERVED = 0,
+        DCCPF_CCID = 1,
         DCCPF_SEQUENCE_WINDOW = 3,
+        DCCPF_ACK_RATIO = 5,
         DCCPF_SEND_ACK_VECTOR = 6,
         DCCPF_SEND_NDP_COUNT = 7,
         /* 10-127 reserved */
@@ -176,9 +182,18 @@ enum {
         DCCPF_MAX_CCID_SPECIFIC = 255,
 };
 
+/* this structure is argument to DCCP_SOCKOPT_CHANGE_X */
+struct dccp_so_feat {
+        __u8 dccpsf_feat;
+        __u8 *dccpsf_val;
+        __u8 dccpsf_len;
+};
+
 /* DCCP socket options */
 #define DCCP_SOCKOPT_PACKET_SIZE        1
 #define DCCP_SOCKOPT_SERVICE            2
+#define DCCP_SOCKOPT_CHANGE_L           3
+#define DCCP_SOCKOPT_CHANGE_R           4
 #define DCCP_SOCKOPT_CCID_RX_INFO       128
 #define DCCP_SOCKOPT_CCID_TX_INFO       192
 
@@ -254,16 +269,12 @@ static inline unsigned int dccp_basic_hdr_len(const struct sk_buff *skb)
 static inline __u64 dccp_hdr_seq(const struct sk_buff *skb)
 {
         const struct dccp_hdr *dh = dccp_hdr(skb);
-#if defined(__LITTLE_ENDIAN_BITFIELD)
-        __u64 seq_nr = ntohl(dh->dccph_seq << 8);
-#elif defined(__BIG_ENDIAN_BITFIELD)
-        __u64 seq_nr = ntohl(dh->dccph_seq);
-#else
-#error  "Adjust your <asm/byteorder.h> defines"
-#endif
+        __u64 seq_nr =  ntohs(dh->dccph_seq);
 
         if (dh->dccph_x != 0)
                 seq_nr = (seq_nr << 32) + ntohl(dccp_hdrx(skb)->dccph_seq_low);
+        else
+                seq_nr += (u32)dh->dccph_seq2 << 16;
 
         return seq_nr;
 }
@@ -281,13 +292,7 @@ static inline struct dccp_hdr_ack_bits *dccp_hdr_ack_bits(const struct sk_buff *
 static inline u64 dccp_hdr_ack_seq(const struct sk_buff *skb)
 {
         const struct dccp_hdr_ack_bits *dhack = dccp_hdr_ack_bits(skb);
-#if defined(__LITTLE_ENDIAN_BITFIELD)
-        return (((u64)ntohl(dhack->dccph_ack_nr_high << 8)) << 32) + ntohl(dhack->dccph_ack_nr_low);
-#elif defined(__BIG_ENDIAN_BITFIELD)
-        return (((u64)ntohl(dhack->dccph_ack_nr_high)) << 32) + ntohl(dhack->dccph_ack_nr_low);
-#else
-#error  "Adjust your <asm/byteorder.h> defines"
-#endif
+        return ((u64)ntohs(dhack->dccph_ack_nr_high) << 32) + ntohl(dhack->dccph_ack_nr_low);
 }
 
 static inline struct dccp_hdr_response *dccp_hdr_response(struct sk_buff *skb)
@@ -314,38 +319,60 @@ static inline unsigned int dccp_hdr_len(const struct sk_buff *skb)
 
 /* initial values for each feature */
 #define DCCPF_INITIAL_SEQUENCE_WINDOW           100
-/* FIXME: for now we're using CCID 3 (TFRC) */
-#define DCCPF_INITIAL_CCID                      3
-#define DCCPF_INITIAL_SEND_ACK_VECTOR           0
+#define DCCPF_INITIAL_ACK_RATIO                 2
+#define DCCPF_INITIAL_CCID                      2
+#define DCCPF_INITIAL_SEND_ACK_VECTOR           1
 /* FIXME: for now we're default to 1 but it should really be 0 */
 #define DCCPF_INITIAL_SEND_NDP_COUNT            1
 
 #define DCCP_NDP_LIMIT 0xFFFFFF
 
 /**
-  * struct dccp_options - option values for a DCCP connection
-  *     @dccpo_sequence_window - Sequence Window Feature (section 7.5.2)
-  *     @dccpo_ccid - Congestion Control Id (CCID) (section 10)
-  *     @dccpo_send_ack_vector - Send Ack Vector Feature (section 11.5)
-  *     @dccpo_send_ndp_count - Send NDP Count Feature (7.7.2)
+  * struct dccp_minisock - Minimal DCCP connection representation
+  *
+  * Will be used to pass the state from dccp_request_sock to dccp_sock.
+  *
+  * @dccpms_sequence_window - Sequence Window Feature (section 7.5.2)
+  * @dccpms_ccid - Congestion Control Id (CCID) (section 10)
+  * @dccpms_send_ack_vector - Send Ack Vector Feature (section 11.5)
+  * @dccpms_send_ndp_count - Send NDP Count Feature (7.7.2)
   */
-struct dccp_options {
-        __u64   dccpo_sequence_window;
-        __u8    dccpo_rx_ccid;
-        __u8    dccpo_tx_ccid;
-        __u8    dccpo_send_ack_vector;
-        __u8    dccpo_send_ndp_count;
+struct dccp_minisock {
+        __u64                   dccpms_sequence_window;
+        __u8                    dccpms_rx_ccid;
+        __u8                    dccpms_tx_ccid;
+        __u8                    dccpms_send_ack_vector;
+        __u8                    dccpms_send_ndp_count;
+        __u8                    dccpms_ack_ratio;
+        struct list_head        dccpms_pending;
+        struct list_head        dccpms_conf;
+};
+
+struct dccp_opt_conf {
+        __u8                    *dccpoc_val;
+        __u8                    dccpoc_len;
+};
+
+struct dccp_opt_pend {
+        struct list_head        dccpop_node;
+        __u8                    dccpop_type;
+        __u8                    dccpop_feat;
+        __u8                    *dccpop_val;
+        __u8                    dccpop_len;
+        int                     dccpop_conf;
+        struct dccp_opt_conf    *dccpop_sc;
 };
 
-extern void __dccp_options_init(struct dccp_options *dccpo);
-extern void dccp_options_init(struct dccp_options *dccpo);
+extern void __dccp_minisock_init(struct dccp_minisock *dmsk);
+extern void dccp_minisock_init(struct dccp_minisock *dmsk);
+
 extern int dccp_parse_options(struct sock *sk, struct sk_buff *skb);
 
 struct dccp_request_sock {
         struct inet_request_sock dreq_inet_rsk;
         __u64                    dreq_iss;
         __u64                    dreq_isr;
-        __u32                    dreq_service;
+        __be32                   dreq_service;
 };
 
 static inline struct dccp_request_sock *dccp_rsk(const struct request_sock *req)
@@ -373,13 +400,13 @@ enum dccp_role {
 
 struct dccp_service_list {
         __u32   dccpsl_nr;
-        __u32   dccpsl_list[0];
+        __be32  dccpsl_list[0];
 };
 
 #define DCCP_SERVICE_INVALID_VALUE htonl((__u32)-1)
 
 static inline int dccp_list_has_service(const struct dccp_service_list *sl,
-                                        const u32 service)
+                                        const __be32 service)
 {
         if (likely(sl != NULL)) {
                 u32 i = sl->dccpsl_nr;
@@ -425,17 +452,17 @@ struct dccp_sock {
         __u64                           dccps_gss;
         __u64                           dccps_gsr;
         __u64                           dccps_gar;
-        __u32                           dccps_service;
+        __be32                          dccps_service;
         struct dccp_service_list        *dccps_service_list;
         struct timeval                  dccps_timestamp_time;
         __u32                           dccps_timestamp_echo;
         __u32                           dccps_packet_size;
+        __u16                           dccps_l_ack_ratio;
+        __u16                           dccps_r_ack_ratio;
         unsigned long                   dccps_ndp_count;
         __u32                           dccps_mss_cache;
-        struct dccp_options             dccps_options;
+        struct dccp_minisock            dccps_minisock;
         struct dccp_ackvec              *dccps_hc_rx_ackvec;
-        void                            *dccps_hc_rx_ccid_private;
-        void                            *dccps_hc_tx_ccid_private;
         struct ccid                     *dccps_hc_rx_ccid;
         struct ccid                     *dccps_hc_tx_ccid;
         struct dccp_options_received    dccps_options_received;
@@ -450,6 +477,11 @@ static inline struct dccp_sock *dccp_sk(const struct sock *sk)
         return (struct dccp_sock *)sk;
 }
 
+static inline struct dccp_minisock *dccp_msk(const struct sock *sk)
+{
+        return (struct dccp_minisock *)&dccp_sk(sk)->dccps_minisock;
+}
+
 static inline int dccp_service_not_initialized(const struct sock *sk)
 {
         return dccp_sk(sk)->dccps_service == DCCP_SERVICE_INVALID_VALUE;
diff --git a/include/linux/debugfs.h b/include/linux/debugfs.h
index a5fa6a6eede8..4b0428e335be 100644
--- a/include/linux/debugfs.h
+++ b/include/linux/debugfs.h
@@ -21,6 +21,11 @@
 
 struct file_operations;
 
+struct debugfs_blob_wrapper {
+        void *data;
+        unsigned long size;
+};
+
 #if defined(CONFIG_DEBUG_FS)
 struct dentry *debugfs_create_file(const char *name, mode_t mode,
                                    struct dentry *parent, void *data,
@@ -39,6 +44,9 @@ struct dentry *debugfs_create_u32(const char *name, mode_t mode,
 struct dentry *debugfs_create_bool(const char *name, mode_t mode,
                                   struct dentry *parent, u32 *value);
 
+struct dentry *debugfs_create_blob(const char *name, mode_t mode,
+                                  struct dentry *parent,
+                                  struct debugfs_blob_wrapper *blob);
 #else
 
 #include <linux/err.h>
@@ -94,6 +102,13 @@ static inline struct dentry *debugfs_create_bool(const char *name, mode_t mode,
         return ERR_PTR(-ENODEV);
 }
 
+static inline struct dentry *debugfs_create_blob(const char *name, mode_t mode,
+                                  struct dentry *parent,
+                                  struct debugfs_blob_wrapper *blob)
+{
+        return ERR_PTR(-ENODEV);
+}
+
 #endif
 
 #endif
diff --git a/include/linux/device.h b/include/linux/device.h
index e8ac5bcfbec7..6d2345d86082 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -425,6 +425,8 @@ extern void firmware_unregister(struct subsystem *);
         dev_printk(KERN_INFO , dev , format , ## arg)
 #define dev_warn(dev, format, arg...)           \
         dev_printk(KERN_WARNING , dev , format , ## arg)
+#define dev_notice(dev, format, arg...)         \
+        dev_printk(KERN_NOTICE , dev , format , ## arg)
 
 /* Create alias, so I can be autoloaded. */
 #define MODULE_ALIAS_CHARDEV(major,minor) \
diff --git a/include/linux/dn.h b/include/linux/dn.h
index 782cae49e64c..10b6a6fd5837 100644
--- a/include/linux/dn.h
+++ b/include/linux/dn.h
@@ -71,17 +71,17 @@
 
 struct dn_naddr 
 {
-        unsigned short          a_len;
-        unsigned char a_addr[DN_MAXADDL];
+        __le16          a_len;
+        __u8 a_addr[DN_MAXADDL]; /* Two bytes little endian */
 };
 
 struct sockaddr_dn
 {
-        unsigned short          sdn_family;
-        unsigned char           sdn_flags;
-        unsigned char           sdn_objnum;
-        unsigned short          sdn_objnamel;
-        unsigned char           sdn_objname[DN_MAXOBJL];
+        __u16           sdn_family;
+        __u8            sdn_flags;
+        __u8            sdn_objnum;
+        __le16          sdn_objnamel;
+        __u8            sdn_objname[DN_MAXOBJL];
         struct   dn_naddr       sdn_add;
 };
 #define sdn_nodeaddrl   sdn_add.a_len   /* Node address length  */
@@ -93,38 +93,38 @@ struct sockaddr_dn
  * DECnet set/get DSO_CONDATA, DSO_DISDATA (optional data) structure
  */
 struct optdata_dn {
-        unsigned short  opt_status;     /* Extended status return */
+        __le16  opt_status;     /* Extended status return */
 #define opt_sts opt_status
-        unsigned short  opt_optl;       /* Length of user data    */
-        unsigned char   opt_data[16];   /* User data              */
+        __le16  opt_optl;       /* Length of user data    */
+        __u8   opt_data[16];   /* User data              */
 };
 
 struct accessdata_dn
 {
-        unsigned char           acc_accl;
-        unsigned char           acc_acc[DN_MAXACCL];
-        unsigned char           acc_passl;
-        unsigned char           acc_pass[DN_MAXACCL];
-        unsigned char           acc_userl;
-        unsigned char           acc_user[DN_MAXACCL];
+        __u8            acc_accl;
+        __u8            acc_acc[DN_MAXACCL];
+        __u8            acc_passl;
+        __u8            acc_pass[DN_MAXACCL];
+        __u8            acc_userl;
+        __u8            acc_user[DN_MAXACCL];
 };
 
 /*
  * DECnet logical link information structure
  */
 struct linkinfo_dn {
-        unsigned short  idn_segsize;    /* Segment size for link */
-        unsigned char   idn_linkstate;  /* Logical link state    */
+        __le16  idn_segsize;    /* Segment size for link */
+        __u8   idn_linkstate;  /* Logical link state    */
 };
 
 /*
  * Ethernet address format (for DECnet)
  */
 union etheraddress {
-        unsigned char dne_addr[6];             /* Full ethernet address */
+        __u8 dne_addr[6];             /* Full ethernet address */
   struct {
-                unsigned char dne_hiord[4];    /* DECnet HIORD prefix   */
-                unsigned char dne_nodeaddr[2]; /* DECnet node address   */
+                __u8 dne_hiord[4];    /* DECnet HIORD prefix   */
+                __u8 dne_nodeaddr[2]; /* DECnet node address   */
   } dne_remote;
 };
 
@@ -133,7 +133,7 @@ union etheraddress {
  * DECnet physical socket address format
  */
 struct dn_addr {
-        unsigned short dna_family;      /* AF_DECnet               */
+        __le16 dna_family;      /* AF_DECnet               */
         union etheraddress dna_netaddr; /* DECnet ethernet address */
 };
 
diff --git a/include/linux/dvb/audio.h b/include/linux/dvb/audio.h
index 2b8797084685..0874a67c6b92 100644
--- a/include/linux/dvb/audio.h
+++ b/include/linux/dvb/audio.h
@@ -121,4 +121,17 @@ typedef uint16_t audio_attributes_t;
 #define AUDIO_SET_ATTRIBUTES       _IOW('o', 17, audio_attributes_t)
 #define AUDIO_SET_KARAOKE          _IOW('o', 18, audio_karaoke_t)
 
+/**
+ * AUDIO_GET_PTS
+ *
+ * Read the 33 bit presentation time stamp as defined
+ * in ITU T-REC-H.222.0 / ISO/IEC 13818-1.
+ *
+ * The PTS should belong to the currently played
+ * frame if possible, but may also be a value close to it
+ * like the PTS of the last decoded frame or the last PTS
+ * extracted by the PES parser.
+ */
+#define AUDIO_GET_PTS              _IOR('o', 19, __u64)
+
 #endif /* _DVBAUDIO_H_ */
diff --git a/include/linux/dvb/video.h b/include/linux/dvb/video.h
index b81e58b2ebf8..faebfda397ff 100644
--- a/include/linux/dvb/video.h
+++ b/include/linux/dvb/video.h
@@ -200,4 +200,17 @@ typedef uint16_t video_attributes_t;
 #define VIDEO_GET_SIZE             _IOR('o', 55, video_size_t)
 #define VIDEO_GET_FRAME_RATE       _IOR('o', 56, unsigned int)
 
+/**
+ * VIDEO_GET_PTS
+ *
+ * Read the 33 bit presentation time stamp as defined
+ * in ITU T-REC-H.222.0 / ISO/IEC 13818-1.
+ *
+ * The PTS should belong to the currently played
+ * frame if possible, but may also be a value close to it
+ * like the PTS of the last decoded frame or the last PTS
+ * extracted by the PES parser.
+ */
+#define VIDEO_GET_PTS              _IOR('o', 57, __u64)
+
 #endif /*_DVBVIDEO_H_*/
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index 18cf1f3e1184..ad133fcfb239 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -48,10 +48,17 @@ struct elevator_ops
 
         elevator_init_fn *elevator_init_fn;
         elevator_exit_fn *elevator_exit_fn;
+        void (*trim)(struct io_context *);
 };
 
 #define ELV_NAME_MAX    (16)
 
+struct elv_fs_entry {
+        struct attribute attr;
+        ssize_t (*show)(elevator_t *, char *);
+        ssize_t (*store)(elevator_t *, const char *, size_t);
+};
+
 /*
  * identifies an elevator type, such as AS or deadline
  */
@@ -60,7 +67,7 @@ struct elevator_type
         struct list_head list;
         struct elevator_ops ops;
         struct elevator_type *elevator_type;
-        struct kobj_type *elevator_ktype;
+        struct elv_fs_entry *elevator_attrs;
         char elevator_name[ELV_NAME_MAX];
         struct module *elevator_owner;
 };
@@ -74,6 +81,7 @@ struct elevator_queue
         void *elevator_data;
         struct kobject kobj;
         struct elevator_type *elevator_type;
+        struct mutex sysfs_lock;
 };
 
 /*
diff --git a/include/linux/fsl_devices.h b/include/linux/fsl_devices.h
index a9f1cfd096ff..a3a0e078f79d 100644
--- a/include/linux/fsl_devices.h
+++ b/include/linux/fsl_devices.h
@@ -83,5 +83,32 @@ struct fsl_i2c_platform_data {
 #define FSL_I2C_DEV_SEPARATE_DFSRR      0x00000001
 #define FSL_I2C_DEV_CLOCK_5200          0x00000002
 
+
+enum fsl_usb2_operating_modes {
+        FSL_USB2_MPH_HOST,
+        FSL_USB2_DR_HOST,
+        FSL_USB2_DR_DEVICE,
+        FSL_USB2_DR_OTG,
+};
+
+enum fsl_usb2_phy_modes {
+        FSL_USB2_PHY_NONE,
+        FSL_USB2_PHY_ULPI,
+        FSL_USB2_PHY_UTMI,
+        FSL_USB2_PHY_UTMI_WIDE,
+        FSL_USB2_PHY_SERIAL,
+};
+
+struct fsl_usb2_platform_data {
+        /* board specific information */
+        enum fsl_usb2_operating_modes operating_mode;
+        enum fsl_usb2_phy_modes phy_mode;
+        unsigned int port_enables;
+};
+
+/* Flags in fsl_usb2_mph_platform_data */
+#define FSL_USB2_PORT0_ENABLED  0x00000001
+#define FSL_USB2_PORT1_ENABLED  0x00000002
+
 #endif                          /* _FSL_DEVICE_H_ */
 #endif                          /* __KERNEL__ */
diff --git a/include/linux/icmpv6.h b/include/linux/icmpv6.h
index 0cf6c8b12caf..c771a7db9871 100644
--- a/include/linux/icmpv6.h
+++ b/include/linux/icmpv6.h
@@ -40,14 +40,16 @@ struct icmp6hdr {
                 struct icmpv6_nd_ra {
                         __u8            hop_limit;
 #if defined(__LITTLE_ENDIAN_BITFIELD)
-                        __u8            reserved:6,
+                        __u8            reserved:4,
+                                        router_pref:2,
                                         other:1,
                                         managed:1;
 
 #elif defined(__BIG_ENDIAN_BITFIELD)
                         __u8            managed:1,
                                         other:1,
-                                        reserved:6;
+                                        router_pref:2,
+                                        reserved:4;
 #else
 #error  "Please fix <asm/byteorder.h>"
 #endif
@@ -70,8 +72,13 @@ struct icmp6hdr {
 #define icmp6_addrconf_managed  icmp6_dataun.u_nd_ra.managed
 #define icmp6_addrconf_other    icmp6_dataun.u_nd_ra.other
 #define icmp6_rt_lifetime       icmp6_dataun.u_nd_ra.rt_lifetime
+#define icmp6_router_pref       icmp6_dataun.u_nd_ra.router_pref
 };
 
+#define ICMPV6_ROUTER_PREF_LOW          0x3
+#define ICMPV6_ROUTER_PREF_MEDIUM       0x0
+#define ICMPV6_ROUTER_PREF_HIGH         0x1
+#define ICMPV6_ROUTER_PREF_INVALID      0x2
 
 #define ICMPV6_DEST_UNREACH             1
 #define ICMPV6_PKT_TOOBIG               2
diff --git a/include/linux/if.h b/include/linux/if.h
index ce627d9092ef..374e20ad8b0d 100644
--- a/include/linux/if.h
+++ b/include/linux/if.h
@@ -33,7 +33,7 @@
 #define IFF_LOOPBACK    0x8             /* is a loopback net            */
 #define IFF_POINTOPOINT 0x10            /* interface is has p-p link    */
 #define IFF_NOTRAILERS  0x20            /* avoid use of trailers        */
-#define IFF_RUNNING     0x40            /* interface running and carrier ok */
+#define IFF_RUNNING     0x40            /* interface RFC2863 OPER_UP    */
 #define IFF_NOARP       0x80            /* no ARP protocol              */
 #define IFF_PROMISC     0x100           /* receive all packets          */
 #define IFF_ALLMULTI    0x200           /* receive all multicast packets*/
@@ -43,15 +43,22 @@
 
 #define IFF_MULTICAST   0x1000          /* Supports multicast           */
 
-#define IFF_VOLATILE    (IFF_LOOPBACK|IFF_POINTOPOINT|IFF_BROADCAST|IFF_MASTER|IFF_SLAVE|IFF_RUNNING)
-
 #define IFF_PORTSEL     0x2000          /* can set media type           */
 #define IFF_AUTOMEDIA   0x4000          /* auto media select active     */
 #define IFF_DYNAMIC     0x8000          /* dialup device with changing addresses*/
 
+#define IFF_LOWER_UP    0x10000         /* driver signals L1 up         */
+#define IFF_DORMANT     0x20000         /* driver signals dormant       */
+
+#define IFF_VOLATILE    (IFF_LOOPBACK|IFF_POINTOPOINT|IFF_BROADCAST|\
+                IFF_MASTER|IFF_SLAVE|IFF_RUNNING|IFF_LOWER_UP|IFF_DORMANT)
+
 /* Private (from user) interface flags (netdevice->priv_flags). */
 #define IFF_802_1Q_VLAN 0x1             /* 802.1Q VLAN device.          */
 #define IFF_EBRIDGE     0x2             /* Ethernet bridging device.    */
+#define IFF_SLAVE_INACTIVE      0x4     /* bonding slave not the curr. active */
+#define IFF_MASTER_8023AD       0x8     /* bonding master, 802.3ad.     */
+#define IFF_MASTER_ALB  0x10            /* bonding master, balance-alb. */
 
 #define IF_GET_IFACE    0x0001          /* for querying only */
 #define IF_GET_PROTO    0x0002
@@ -80,6 +87,22 @@
 #define IF_PROTO_FR_ETH_PVC 0x200B
 #define IF_PROTO_RAW    0x200C          /* RAW Socket                   */
 
+/* RFC 2863 operational status */
+enum {
+        IF_OPER_UNKNOWN,
+        IF_OPER_NOTPRESENT,
+        IF_OPER_DOWN,
+        IF_OPER_LOWERLAYERDOWN,
+        IF_OPER_TESTING,
+        IF_OPER_DORMANT,
+        IF_OPER_UP,
+};
+
+/* link modes */
+enum {
+        IF_LINK_MODE_DEFAULT,
+        IF_LINK_MODE_DORMANT,   /* limit upward transition to dormant */
+};
 
 /*
  *      Device mapping structure. I'd just gone off and designed a 
diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
index 7a92c1ce1457..ab08f35cbc35 100644
--- a/include/linux/if_ether.h
+++ b/include/linux/if_ether.h
@@ -61,6 +61,7 @@
 #define ETH_P_8021Q     0x8100          /* 802.1Q VLAN Extended Header  */
 #define ETH_P_IPX       0x8137          /* IPX over DIX                 */
 #define ETH_P_IPV6      0x86DD          /* IPv6 over bluebook           */
+#define ETH_P_SLOW      0x8809          /* Slow Protocol. See 802.3ad 43B */
 #define ETH_P_WCCP      0x883E          /* Web-cache coordination protocol
                                          * defined in draft-wilson-wrec-wccp-v2-00.txt */
 #define ETH_P_PPP_DISC  0x8863          /* PPPoE discovery messages     */
diff --git a/include/linux/in.h b/include/linux/in.h
index ba355384016a..94f557fa4636 100644
--- a/include/linux/in.h
+++ b/include/linux/in.h
@@ -72,6 +72,7 @@ struct in_addr {
 #define IP_FREEBIND     15
 #define IP_IPSEC_POLICY 16
 #define IP_XFRM_POLICY  17
+#define IP_PASSSEC      18
 
 /* BSD compatibility */
 #define IP_RECVRETOPTS  IP_RETOPTS
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index fd7af86151b1..92297ff24e85 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -25,6 +25,7 @@ struct ipv4_devconf
         int     arp_filter;
         int     arp_announce;
         int     arp_ignore;
+        int     arp_accept;
         int     medium_id;
         int     no_xfrm;
         int     no_policy;
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 9c8f4c9ed429..1263d8cb3c18 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -145,6 +145,15 @@ struct ipv6_devconf {
         __s32           max_desync_factor;
 #endif
         __s32           max_addresses;
+        __s32           accept_ra_defrtr;
+        __s32           accept_ra_pinfo;
+#ifdef CONFIG_IPV6_ROUTER_PREF
+        __s32           accept_ra_rtr_pref;
+        __s32           rtr_probe_interval;
+#ifdef CONFIG_IPV6_ROUTE_INFO
+        __s32           accept_ra_rt_info_max_plen;
+#endif
+#endif
         void            *sysctl;
 };
 
@@ -167,6 +176,11 @@ enum {
         DEVCONF_MAX_DESYNC_FACTOR,
         DEVCONF_MAX_ADDRESSES,
         DEVCONF_FORCE_MLD_VERSION,
+        DEVCONF_ACCEPT_RA_DEFRTR,
+        DEVCONF_ACCEPT_RA_PINFO,
+        DEVCONF_ACCEPT_RA_RTR_PREF,
+        DEVCONF_RTR_PROBE_INTERVAL,
+        DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN,
         DEVCONF_MAX
 };
 
diff --git a/include/linux/ipv6_route.h b/include/linux/ipv6_route.h
index d7c41d1d706a..b323ff577967 100644
--- a/include/linux/ipv6_route.h
+++ b/include/linux/ipv6_route.h
@@ -23,12 +23,22 @@
 #define RTF_NONEXTHOP   0x00200000      /* route with no nexthop        */
 #define RTF_EXPIRES     0x00400000
 
+#define RTF_ROUTEINFO   0x00800000      /* route information - RA       */
+
 #define RTF_CACHE       0x01000000      /* cache entry                  */
 #define RTF_FLOW        0x02000000      /* flow significant route       */
 #define RTF_POLICY      0x04000000      /* policy route                 */
 
+#define RTF_PREF(pref)  ((pref) << 27)
+#define RTF_PREF_MASK   0x18000000
+
 #define RTF_LOCAL       0x80000000
 
+#ifdef __KERNEL__
+#define IPV6_EXTRACT_PREF(flag) (((flag) & RTF_PREF_MASK) >> 27)
+#define IPV6_DECODE_PREF(pref)  ((pref) ^ 2)    /* 1:low,2:med,3:high */
+#endif
+
 struct in6_rtmsg {
         struct in6_addr         rtmsg_dst;
         struct in6_addr         rtmsg_src;
diff --git a/include/linux/irda.h b/include/linux/irda.h
index 95dee174cdc5..09d8f105a5a8 100644
--- a/include/linux/irda.h
+++ b/include/linux/irda.h
@@ -76,6 +76,7 @@ typedef enum {
         IRDA_MCP2120_DONGLE      = 9,
         IRDA_ACT200L_DONGLE      = 10,
         IRDA_MA600_DONGLE        = 11,
+        IRDA_TOIM3232_DONGLE     = 12,
 } IRDA_DONGLE;
 
 /* Protocol types to be used for SOCK_DGRAM */
diff --git a/include/linux/kobj_map.h b/include/linux/kobj_map.h
index cbe7d8008042..bafe178a381f 100644
--- a/include/linux/kobj_map.h
+++ b/include/linux/kobj_map.h
@@ -1,6 +1,6 @@
 #ifdef __KERNEL__
 
-#include <asm/semaphore.h>
+#include <linux/mutex.h>
 
 typedef struct kobject *kobj_probe_t(dev_t, int *, void *);
 struct kobj_map;
@@ -9,6 +9,6 @@ int kobj_map(struct kobj_map *, dev_t, unsigned long, struct module *,
              kobj_probe_t *, int (*)(dev_t, void *), void *);
 void kobj_unmap(struct kobj_map *, dev_t, unsigned long);
 struct kobject *kobj_lookup(struct kobj_map *, dev_t, int *);
-struct kobj_map *kobj_map_init(kobj_probe_t *, struct semaphore *);
+struct kobj_map *kobj_map_init(kobj_probe_t *, struct mutex *);
 
 #endif
diff --git a/include/linux/kobject.h b/include/linux/kobject.h
index c374b5fa8d3b..4cb1214ec290 100644
--- a/include/linux/kobject.h
+++ b/include/linux/kobject.h
@@ -80,6 +80,8 @@ extern void kobject_unregister(struct kobject *);
 extern struct kobject * kobject_get(struct kobject *);
 extern void kobject_put(struct kobject *);
 
+extern struct kobject *kobject_add_dir(struct kobject *, const char *);
+
 extern char * kobject_get_path(struct kobject *, gfp_t);
 
 struct kobj_type {
@@ -255,7 +257,7 @@ struct subsys_attribute {
 extern int subsys_create_file(struct subsystem * , struct subsys_attribute *);
 extern void subsys_remove_file(struct subsystem * , struct subsys_attribute *);
 
-#if defined(CONFIG_HOTPLUG) & defined(CONFIG_NET)
+#if defined(CONFIG_HOTPLUG) && defined(CONFIG_NET)
 void kobject_uevent(struct kobject *kobj, enum kobject_action action);
 
 int add_uevent_var(char **envp, int num_envp, int *cur_index,
diff --git a/include/linux/libata.h b/include/linux/libata.h
index c91be5e64ede..239408ecfddf 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -35,7 +35,8 @@
 #include <linux/workqueue.h>
 
 /*
- * compile-time options
+ * compile-time options: to be removed as soon as all the drivers are
+ * converted to the new debugging mechanism
  */
 #undef ATA_DEBUG                /* debugging output */
 #undef ATA_VERBOSE_DEBUG        /* yet more debugging output */
@@ -61,15 +62,37 @@
 
 #define BPRINTK(fmt, args...) if (ap->flags & ATA_FLAG_DEBUGMSG) printk(KERN_ERR "%s: " fmt, __FUNCTION__, ## args)
 
-#ifdef ATA_NDEBUG
-#define assert(expr)
-#else
-#define assert(expr) \
-        if(unlikely(!(expr))) {                                   \
-        printk(KERN_ERR "Assertion failed! %s,%s,%s,line=%d\n", \
-        #expr,__FILE__,__FUNCTION__,__LINE__);          \
-        }
-#endif
+/* NEW: debug levels */
+#define HAVE_LIBATA_MSG 1
+
+enum {
+        ATA_MSG_DRV     = 0x0001,
+        ATA_MSG_INFO    = 0x0002,
+        ATA_MSG_PROBE   = 0x0004,
+        ATA_MSG_WARN    = 0x0008,
+        ATA_MSG_MALLOC  = 0x0010,
+        ATA_MSG_CTL     = 0x0020,
+        ATA_MSG_INTR    = 0x0040,
+        ATA_MSG_ERR     = 0x0080,
+};
+
+#define ata_msg_drv(p)    ((p)->msg_enable & ATA_MSG_DRV)
+#define ata_msg_info(p)   ((p)->msg_enable & ATA_MSG_INFO)
+#define ata_msg_probe(p)  ((p)->msg_enable & ATA_MSG_PROBE)
+#define ata_msg_warn(p)   ((p)->msg_enable & ATA_MSG_WARN)
+#define ata_msg_malloc(p) ((p)->msg_enable & ATA_MSG_MALLOC)
+#define ata_msg_ctl(p)    ((p)->msg_enable & ATA_MSG_CTL)
+#define ata_msg_intr(p)   ((p)->msg_enable & ATA_MSG_INTR)
+#define ata_msg_err(p)    ((p)->msg_enable & ATA_MSG_ERR)
+
+static inline u32 ata_msg_init(int dval, int default_msg_enable_bits)
+{
+        if (dval < 0 || dval >= (sizeof(u32) * 8))
+                return default_msg_enable_bits; /* should be 0x1 - only driver info msgs */
+        if (!dval)
+                return 0;
+        return (1 << dval) - 1;
+}
 
 /* defines only for the constants which don't work well as enums */
 #define ATA_TAG_POISON          0xfafbfcfdU
@@ -99,8 +122,7 @@ enum {
         /* struct ata_device stuff */
         ATA_DFLAG_LBA48         = (1 << 0), /* device supports LBA48 */
         ATA_DFLAG_PIO           = (1 << 1), /* device currently in PIO mode */
-        ATA_DFLAG_LOCK_SECTORS  = (1 << 2), /* don't adjust max_sectors */
-        ATA_DFLAG_LBA           = (1 << 3), /* device supports LBA */
+        ATA_DFLAG_LBA           = (1 << 2), /* device supports LBA */
 
         ATA_DEV_UNKNOWN         = 0,    /* unknown device */
         ATA_DEV_ATA             = 1,    /* ATA device */
@@ -115,9 +137,9 @@ enum {
         ATA_FLAG_PORT_DISABLED  = (1 << 2), /* port is disabled, ignore it */
         ATA_FLAG_SATA           = (1 << 3),
         ATA_FLAG_NO_LEGACY      = (1 << 4), /* no legacy mode check */
-        ATA_FLAG_SRST           = (1 << 5), /* use ATA SRST, not E.D.D. */
+        ATA_FLAG_SRST           = (1 << 5), /* (obsolete) use ATA SRST, not E.D.D. */
         ATA_FLAG_MMIO           = (1 << 6), /* use MMIO, not PIO */
-        ATA_FLAG_SATA_RESET     = (1 << 7), /* use COMRESET */
+        ATA_FLAG_SATA_RESET     = (1 << 7), /* (obsolete) use COMRESET */
         ATA_FLAG_PIO_DMA        = (1 << 8), /* PIO cmds via DMA */
         ATA_FLAG_NOINTR         = (1 << 9), /* FIXME: Remove this once
                                              * proper HSM is in place. */
@@ -129,10 +151,14 @@ enum {
         ATA_FLAG_PIO_LBA48      = (1 << 13), /* Host DMA engine is LBA28 only */
         ATA_FLAG_IRQ_MASK       = (1 << 14), /* Mask IRQ in PIO xfers */
 
+        ATA_FLAG_FLUSH_PORT_TASK = (1 << 15), /* Flush port task */
+        ATA_FLAG_IN_EH          = (1 << 16), /* EH in progress */
+
         ATA_QCFLAG_ACTIVE       = (1 << 1), /* cmd not yet ack'd to scsi lyer */
         ATA_QCFLAG_SG           = (1 << 3), /* have s/g table? */
         ATA_QCFLAG_SINGLE       = (1 << 4), /* no s/g, just a single buffer */
         ATA_QCFLAG_DMAMAP       = ATA_QCFLAG_SG | ATA_QCFLAG_SINGLE,
+        ATA_QCFLAG_EH_SCHEDULED = (1 << 5), /* EH scheduled */
 
         /* various lengths of time */
         ATA_TMOUT_EDD           = 5 * HZ,       /* heuristic */
@@ -162,11 +188,19 @@ enum {
         PORT_DISABLED           = 2,
 
         /* encoding various smaller bitmaps into a single
-         * unsigned long bitmap
+         * unsigned int bitmap
          */
-        ATA_SHIFT_UDMA          = 0,
-        ATA_SHIFT_MWDMA         = 8,
-        ATA_SHIFT_PIO           = 11,
+        ATA_BITS_PIO            = 5,
+        ATA_BITS_MWDMA          = 3,
+        ATA_BITS_UDMA           = 8,
+
+        ATA_SHIFT_PIO           = 0,
+        ATA_SHIFT_MWDMA         = ATA_SHIFT_PIO + ATA_BITS_PIO,
+        ATA_SHIFT_UDMA          = ATA_SHIFT_MWDMA + ATA_BITS_MWDMA,
+
+        ATA_MASK_PIO            = ((1 << ATA_BITS_PIO) - 1) << ATA_SHIFT_PIO,
+        ATA_MASK_MWDMA          = ((1 << ATA_BITS_MWDMA) - 1) << ATA_SHIFT_MWDMA,
+        ATA_MASK_UDMA           = ((1 << ATA_BITS_UDMA) - 1) << ATA_SHIFT_UDMA,
 
         /* size of buffer to pad xfers ending on unaligned boundaries */
         ATA_DMA_PAD_SZ          = 4,
@@ -189,10 +223,15 @@ enum hsm_task_states {
 };
 
 enum ata_completion_errors {
-        AC_ERR_OTHER            = (1 << 0),
-        AC_ERR_DEV              = (1 << 1),
-        AC_ERR_ATA_BUS          = (1 << 2),
-        AC_ERR_HOST_BUS         = (1 << 3),
+        AC_ERR_DEV              = (1 << 0), /* device reported error */
+        AC_ERR_HSM              = (1 << 1), /* host state machine violation */
+        AC_ERR_TIMEOUT          = (1 << 2), /* timeout */
+        AC_ERR_MEDIA            = (1 << 3), /* media error */
+        AC_ERR_ATA_BUS          = (1 << 4), /* ATA bus error */
+        AC_ERR_HOST_BUS         = (1 << 5), /* host bus error */
+        AC_ERR_SYSTEM           = (1 << 6), /* system error */
+        AC_ERR_INVALID          = (1 << 7), /* invalid argument */
+        AC_ERR_OTHER            = (1 << 8), /* unknown */
 };
 
 /* forward declarations */
@@ -202,7 +241,10 @@ struct ata_port;
 struct ata_queued_cmd;
 
 /* typedefs */
-typedef int (*ata_qc_cb_t) (struct ata_queued_cmd *qc);
+typedef void (*ata_qc_cb_t) (struct ata_queued_cmd *qc);
+typedef void (*ata_probeinit_fn_t)(struct ata_port *);
+typedef int (*ata_reset_fn_t)(struct ata_port *, int, unsigned int *);
+typedef void (*ata_postreset_fn_t)(struct ata_port *ap, unsigned int *);
 
 struct ata_ioports {
         unsigned long           cmd_addr;
@@ -305,7 +347,7 @@ struct ata_device {
         unsigned long           flags;          /* ATA_DFLAG_xxx */
         unsigned int            class;          /* ATA_DEV_xxx */
         unsigned int            devno;          /* 0 or 1 */
-        u16                     id[ATA_ID_WORDS]; /* IDENTIFY xxx DEVICE data */
+        u16                     *id;            /* IDENTIFY xxx DEVICE data */
         u8                      pio_mode;
         u8                      dma_mode;
         u8                      xfer_mode;
@@ -313,6 +355,8 @@ struct ata_device {
 
         unsigned int            multi_count;    /* sectors count for
                                                    READ/WRITE MULTIPLE */
+        unsigned int            max_sectors;    /* per-device max sectors */
+        unsigned int            cdb_len;
 
         /* for CHS addressing */
         u16                     cylinders;      /* Number of cylinders */
@@ -342,7 +386,6 @@ struct ata_port {
         unsigned int            mwdma_mask;
         unsigned int            udma_mask;
         unsigned int            cbl;    /* cable type; ATA_CBL_xxx */
-        unsigned int            cdb_len;
 
         struct ata_device       device[ATA_MAX_DEVICES];
 
@@ -353,12 +396,14 @@ struct ata_port {
         struct ata_host_stats   stats;
         struct ata_host_set     *host_set;
 
-        struct work_struct      packet_task;
+        struct work_struct      port_task;
 
-        struct work_struct      pio_task;
         unsigned int            hsm_task_state;
         unsigned long           pio_task_timeout;
 
+        u32                     msg_enable;
+        struct list_head        eh_done_q;
+
         void                    *private_data;
 };
 
@@ -378,7 +423,9 @@ struct ata_port_operations {
         u8   (*check_altstatus)(struct ata_port *ap);
         void (*dev_select)(struct ata_port *ap, unsigned int device);
 
-        void (*phy_reset) (struct ata_port *ap);
+        void (*phy_reset) (struct ata_port *ap); /* obsolete */
+        int (*probe_reset) (struct ata_port *ap, unsigned int *classes);
+
         void (*post_set_mode) (struct ata_port *ap);
 
         int (*check_atapi_dma) (struct ata_queued_cmd *qc);
@@ -387,7 +434,7 @@ struct ata_port_operations {
         void (*bmdma_start) (struct ata_queued_cmd *qc);
 
         void (*qc_prep) (struct ata_queued_cmd *qc);
-        int (*qc_issue) (struct ata_queued_cmd *qc);
+        unsigned int (*qc_issue) (struct ata_queued_cmd *qc);
 
         void (*eng_timeout) (struct ata_port *ap);
 
@@ -435,6 +482,18 @@ extern void ata_port_probe(struct ata_port *);
 extern void __sata_phy_reset(struct ata_port *ap);
 extern void sata_phy_reset(struct ata_port *ap);
 extern void ata_bus_reset(struct ata_port *ap);
+extern int ata_drive_probe_reset(struct ata_port *ap,
+                        ata_probeinit_fn_t probeinit,
+                        ata_reset_fn_t softreset, ata_reset_fn_t hardreset,
+                        ata_postreset_fn_t postreset, unsigned int *classes);
+extern void ata_std_probeinit(struct ata_port *ap);
+extern int ata_std_softreset(struct ata_port *ap, int verbose,
+                             unsigned int *classes);
+extern int sata_std_hardreset(struct ata_port *ap, int verbose,
+                              unsigned int *class);
+extern void ata_std_postreset(struct ata_port *ap, unsigned int *classes);
+extern int ata_dev_revalidate(struct ata_port *ap, struct ata_device *dev,
+                              int post_reset);
 extern void ata_port_disable(struct ata_port *);
 extern void ata_std_ports(struct ata_ioports *ioaddr);
 #ifdef CONFIG_PCI
@@ -449,7 +508,10 @@ extern void ata_host_set_remove(struct ata_host_set *host_set);
 extern int ata_scsi_detect(struct scsi_host_template *sht);
 extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
 extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
+extern enum scsi_eh_timer_return ata_scsi_timed_out(struct scsi_cmnd *cmd);
 extern int ata_scsi_error(struct Scsi_Host *host);
+extern void ata_eh_qc_complete(struct ata_queued_cmd *qc);
+extern void ata_eh_qc_retry(struct ata_queued_cmd *qc);
 extern int ata_scsi_release(struct Scsi_Host *host);
 extern unsigned int ata_host_intr(struct ata_port *ap, struct ata_queued_cmd *qc);
 extern int ata_scsi_device_resume(struct scsi_device *);
@@ -457,6 +519,11 @@ extern int ata_scsi_device_suspend(struct scsi_device *);
 extern int ata_device_resume(struct ata_port *, struct ata_device *);
 extern int ata_device_suspend(struct ata_port *, struct ata_device *);
 extern int ata_ratelimit(void);
+extern unsigned int ata_busy_sleep(struct ata_port *ap,
+                                   unsigned long timeout_pat,
+                                   unsigned long timeout);
+extern void ata_port_queue_task(struct ata_port *ap, void (*fn)(void *),
+                                void *data, unsigned long delay);
 
 /*
  * Default driver ops implementations
@@ -470,26 +537,28 @@ extern void ata_std_dev_select (struct ata_port *ap, unsigned int device);
 extern u8 ata_check_status(struct ata_port *ap);
 extern u8 ata_altstatus(struct ata_port *ap);
 extern void ata_exec_command(struct ata_port *ap, const struct ata_taskfile *tf);
+extern int ata_std_probe_reset(struct ata_port *ap, unsigned int *classes);
 extern int ata_port_start (struct ata_port *ap);
 extern void ata_port_stop (struct ata_port *ap);
 extern void ata_host_stop (struct ata_host_set *host_set);
 extern irqreturn_t ata_interrupt (int irq, void *dev_instance, struct pt_regs *regs);
 extern void ata_qc_prep(struct ata_queued_cmd *qc);
-extern int ata_qc_issue_prot(struct ata_queued_cmd *qc);
+extern unsigned int ata_qc_issue_prot(struct ata_queued_cmd *qc);
 extern void ata_sg_init_one(struct ata_queued_cmd *qc, void *buf,
                 unsigned int buflen);
 extern void ata_sg_init(struct ata_queued_cmd *qc, struct scatterlist *sg,
                  unsigned int n_elem);
 extern unsigned int ata_dev_classify(const struct ata_taskfile *tf);
-extern void ata_dev_id_string(const u16 *id, unsigned char *s,
-                              unsigned int ofs, unsigned int len);
-extern void ata_dev_config(struct ata_port *ap, unsigned int i);
+extern void ata_id_string(const u16 *id, unsigned char *s,
+                          unsigned int ofs, unsigned int len);
+extern void ata_id_c_string(const u16 *id, unsigned char *s,
+                            unsigned int ofs, unsigned int len);
 extern void ata_bmdma_setup (struct ata_queued_cmd *qc);
 extern void ata_bmdma_start (struct ata_queued_cmd *qc);
 extern void ata_bmdma_stop(struct ata_queued_cmd *qc);
 extern u8   ata_bmdma_status(struct ata_port *ap);
 extern void ata_bmdma_irq_clear(struct ata_port *ap);
-extern void ata_qc_complete(struct ata_queued_cmd *qc);
+extern void __ata_qc_complete(struct ata_queued_cmd *qc);
 extern void ata_eng_timeout(struct ata_port *ap);
 extern void ata_scsi_simulate(struct ata_port *ap, struct ata_device *dev,
                               struct scsi_cmnd *cmd,
@@ -586,10 +655,14 @@ static inline unsigned int ata_tag_valid(unsigned int tag)
         return (tag < ATA_MAX_QUEUE) ? 1 : 0;
 }
 
+static inline unsigned int ata_class_present(unsigned int class)
+{
+        return class == ATA_DEV_ATA || class == ATA_DEV_ATAPI;
+}
+
 static inline unsigned int ata_dev_present(const struct ata_device *dev)
 {
-        return ((dev->class == ATA_DEV_ATA) ||
-                (dev->class == ATA_DEV_ATAPI));
+        return ata_class_present(dev->class);
 }
 
 static inline u8 ata_chk_status(struct ata_port *ap)
@@ -657,9 +730,9 @@ static inline u8 ata_wait_idle(struct ata_port *ap)
 
         if (status & (ATA_BUSY | ATA_DRQ)) {
                 unsigned long l = ap->ioaddr.status_addr;
-                printk(KERN_WARNING
-                       "ATA: abnormal status 0x%X on port 0x%lX\n",
-                       status, l);
+                if (ata_msg_warn(ap))
+                        printk(KERN_WARNING "ATA: abnormal status 0x%X on port 0x%lX\n",
+                                status, l);
         }
 
         return status;
@@ -701,6 +774,24 @@ static inline void ata_qc_reinit(struct ata_queued_cmd *qc)
         ata_tf_init(qc->ap, &qc->tf, qc->dev->devno);
 }
 
+/**
+ *      ata_qc_complete - Complete an active ATA command
+ *      @qc: Command to complete
+ *      @err_mask: ATA Status register contents
+ *
+ *      Indicate to the mid and upper layers that an ATA
+ *      command has completed, with either an ok or not-ok status.
+ *
+ *      LOCKING:
+ *      spin_lock_irqsave(host_set lock)
+ */
+static inline void ata_qc_complete(struct ata_queued_cmd *qc)
+{
+        if (unlikely(qc->flags & ATA_QCFLAG_EH_SCHEDULED))
+                return;
+
+        __ata_qc_complete(qc);
+}
 
 /**
  *      ata_irq_on - Enable interrupts on a port.
@@ -751,7 +842,8 @@ static inline u8 ata_irq_ack(struct ata_port *ap, unsigned int chk_drq)
 
         status = ata_busy_wait(ap, bits, 1000);
         if (status & bits)
-                DPRINTK("abnormal status 0x%X\n", status);
+                if (ata_msg_err(ap))
+                        printk(KERN_ERR "abnormal status 0x%X\n", status);
 
         /* get controller status; clear intr, err bits */
         if (ap->flags & ATA_FLAG_MMIO) {
@@ -769,8 +861,10 @@ static inline u8 ata_irq_ack(struct ata_port *ap, unsigned int chk_drq)
                 post_stat = inb(ap->ioaddr.bmdma_addr + ATA_DMA_STATUS);
         }
 
-        VPRINTK("irq ack: host_stat 0x%X, new host_stat 0x%X, drv_stat 0x%X\n",
-                host_stat, post_stat, status);
+        if (ata_msg_intr(ap))
+                printk(KERN_INFO "%s: irq ack: host_stat 0x%X, new host_stat 0x%X, drv_stat 0x%X\n",
+                        __FUNCTION__,
+                        host_stat, post_stat, status);
 
         return status;
 }
@@ -807,7 +901,7 @@ static inline int ata_try_flush_cache(const struct ata_device *dev)
 static inline unsigned int ac_err_mask(u8 status)
 {
         if (status & ATA_BUSY)
-                return AC_ERR_ATA_BUS;
+                return AC_ERR_HSM;
         if (status & (ATA_ERR | ATA_DF))
                 return AC_ERR_DEV;
         return 0;
diff --git a/include/linux/list.h b/include/linux/list.h
index 47208bd99f9e..67258b47e9ca 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -411,6 +411,17 @@ static inline void list_splice_init(struct list_head *list,
              pos = list_entry(pos->member.next, typeof(*pos), member))
 
 /**
+ * list_for_each_entry_from -   iterate over list of given type
+ *                      continuing from existing point
+ * @pos:        the type * to use as a loop counter.
+ * @head:       the head for your list.
+ * @member:     the name of the list_struct within the struct.
+ */
+#define list_for_each_entry_from(pos, head, member)                     \
+        for (; prefetch(pos->member.next), &pos->member != (head);      \
+             pos = list_entry(pos->member.next, typeof(*pos), member))
+
+/**
  * list_for_each_entry_safe - iterate over list of given type safe against removal of list entry
  * @pos:        the type * to use as a loop counter.
  * @n:          another type * to use as temporary storage
@@ -438,6 +449,19 @@ static inline void list_splice_init(struct list_head *list,
              pos = n, n = list_entry(n->member.next, typeof(*n), member))
 
 /**
+ * list_for_each_entry_safe_from - iterate over list of given type
+ *                      from existing point safe against removal of list entry
+ * @pos:        the type * to use as a loop counter.
+ * @n:          another type * to use as temporary storage
+ * @head:       the head for your list.
+ * @member:     the name of the list_struct within the struct.
+ */
+#define list_for_each_entry_safe_from(pos, n, head, member)                     \
+        for (n = list_entry(pos->member.next, typeof(*pos), member);            \
+             &pos->member != (head);                                            \
+             pos = n, n = list_entry(n->member.next, typeof(*n), member))
+
+/**
  * list_for_each_entry_safe_reverse - iterate backwards over list of given type safe against
  *                                    removal of list entry
  * @pos:        the type * to use as a loop counter.
diff --git a/include/linux/module.h b/include/linux/module.h
index 84d75f3a8aca..70bd843c71cb 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -198,6 +198,9 @@ void *__symbol_get_gpl(const char *symbol);
 #define EXPORT_SYMBOL_GPL(sym)                                  \
         __EXPORT_SYMBOL(sym, "_gpl")
 
+#define EXPORT_SYMBOL_GPL_FUTURE(sym)                           \
+        __EXPORT_SYMBOL(sym, "_gpl_future")
+
 #endif
 
 struct module_ref
@@ -242,6 +245,7 @@ struct module
         /* Sysfs stuff. */
         struct module_kobject mkobj;
         struct module_param_attrs *param_attrs;
+        struct module_attribute *modinfo_attrs;
         const char *version;
         const char *srcversion;
 
@@ -255,6 +259,11 @@ struct module
         unsigned int num_gpl_syms;
         const unsigned long *gpl_crcs;
 
+        /* symbols that will be GPL-only in the near future. */
+        const struct kernel_symbol *gpl_future_syms;
+        unsigned int num_gpl_future_syms;
+        const unsigned long *gpl_future_crcs;
+
         /* Exception table */
         unsigned int num_exentries;
         const struct exception_table_entry *extable;
@@ -441,6 +450,7 @@ void module_remove_driver(struct device_driver *);
 #else /* !CONFIG_MODULES... */
 #define EXPORT_SYMBOL(sym)
 #define EXPORT_SYMBOL_GPL(sym)
+#define EXPORT_SYMBOL_GPL_FUTURE(sym)
 
 /* Given an address, look for it in the exception tables. */
 static inline const struct exception_table_entry *
diff --git a/include/linux/mv643xx.h b/include/linux/mv643xx.h
index 0b08cd692201..955d3069d727 100644
--- a/include/linux/mv643xx.h
+++ b/include/linux/mv643xx.h
@@ -1214,6 +1214,7 @@ struct mv64xxx_i2c_pdata {
 #define MV643XX_ETH_FORCE_BP_MODE_NO_JAM                0
 #define MV643XX_ETH_FORCE_BP_MODE_JAM_TX                (1<<7)
 #define MV643XX_ETH_FORCE_BP_MODE_JAM_TX_ON_RX_ERR      (1<<8)
+#define MV643XX_ETH_SERIAL_PORT_CONTROL_RESERVED        (1<<9)
 #define MV643XX_ETH_FORCE_LINK_FAIL                     0
 #define MV643XX_ETH_DO_NOT_FORCE_LINK_FAIL              (1<<10)
 #define MV643XX_ETH_RETRANSMIT_16_ATTEMPTS              0
@@ -1243,6 +1244,8 @@ struct mv64xxx_i2c_pdata {
 #define MV643XX_ETH_SET_MII_SPEED_TO_10                 0
 #define MV643XX_ETH_SET_MII_SPEED_TO_100                (1<<24)
 
+#define MV643XX_ETH_MAX_RX_PACKET_MASK                  (0x7<<17)
+
 #define MV643XX_ETH_PORT_SERIAL_CONTROL_DEFAULT_VALUE           \
                 MV643XX_ETH_DO_NOT_FORCE_LINK_PASS      |       \
                 MV643XX_ETH_ENABLE_AUTO_NEG_FOR_DUPLX   |       \
@@ -1285,23 +1288,15 @@ struct mv64xxx_i2c_pdata {
 #define MV643XX_ETH_NAME        "mv643xx_eth"
 
 struct mv643xx_eth_platform_data {
-        /* 
-         * Non-values for mac_addr, phy_addr, port_config, etc.
-         * override the default value.  Setting the corresponding
-         * force_* field, causes the default value to be overridden
-         * even when zero.
-         */
-        unsigned int    force_phy_addr:1;
-        unsigned int    force_port_config:1;
-        unsigned int    force_port_config_extend:1;
-        unsigned int    force_port_sdma_config:1;
-        unsigned int    force_port_serial_control:1;
-        int             phy_addr;
         char            *mac_addr;      /* pointer to mac address */
-        u32             port_config;
-        u32             port_config_extend;
-        u32             port_sdma_config;
-        u32             port_serial_control;
+        u16             force_phy_addr; /* force override if phy_addr == 0 */
+        u16             phy_addr;
+
+        /* If speed is 0, then speed and duplex are autonegotiated. */
+        int             speed;          /* 0, SPEED_10, SPEED_100, SPEED_1000 */
+        int             duplex;         /* DUPLEX_HALF or DUPLEX_FULL */
+
+        /* non-zero values of the following fields override defaults */
         u32             tx_queue_size;
         u32             rx_queue_size;
         u32             tx_sram_addr;
diff --git a/include/linux/net.h b/include/linux/net.h
index 28195a2d8ff0..152fa6551fd8 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -149,6 +149,10 @@ struct proto_ops {
                                       int optname, char __user *optval, int optlen);
         int             (*getsockopt)(struct socket *sock, int level,
                                       int optname, char __user *optval, int __user *optlen);
+        int             (*compat_setsockopt)(struct socket *sock, int level,
+                                      int optname, char __user *optval, int optlen);
+        int             (*compat_getsockopt)(struct socket *sock, int level,
+                                      int optname, char __user *optval, int __user *optlen);
         int             (*sendmsg)   (struct kiocb *iocb, struct socket *sock,
                                       struct msghdr *m, size_t total_len);
         int             (*recvmsg)   (struct kiocb *iocb, struct socket *sock,
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 7fda03d338d1..950dc55e5192 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -230,7 +230,8 @@ enum netdev_state_t
         __LINK_STATE_SCHED,
         __LINK_STATE_NOCARRIER,
         __LINK_STATE_RX_SCHED,
-        __LINK_STATE_LINKWATCH_PENDING
+        __LINK_STATE_LINKWATCH_PENDING,
+        __LINK_STATE_DORMANT,
 };
 
 
@@ -335,11 +336,14 @@ struct net_device
          */
 
 
-        unsigned short          flags;  /* interface flags (a la BSD)   */
+        unsigned int            flags;  /* interface flags (a la BSD)   */
         unsigned short          gflags;
         unsigned short          priv_flags; /* Like 'flags' but invisible to userspace. */
         unsigned short          padded; /* How much padding added by alloc_netdev() */
 
+        unsigned char           operstate; /* RFC2863 operstate */
+        unsigned char           link_mode; /* mapping policy to operstate */
+
         unsigned                mtu;    /* interface MTU value          */
         unsigned short          type;   /* interface hardware type      */
         unsigned short          hard_header_len;        /* hardware hdr length  */
@@ -708,12 +712,18 @@ static inline void dev_put(struct net_device *dev)
         atomic_dec(&dev->refcnt);
 }
 
-#define __dev_put(dev) atomic_dec(&(dev)->refcnt)
-#define dev_hold(dev) atomic_inc(&(dev)->refcnt)
+static inline void dev_hold(struct net_device *dev)
+{
+        atomic_inc(&dev->refcnt);
+}
 
 /* Carrier loss detection, dial on demand. The functions netif_carrier_on
  * and _off may be called from IRQ context, but it is caller
  * who is responsible for serialization of these calls.
+ *
+ * The name carrier is inappropriate, these functions should really be
+ * called netif_lowerlayer_*() because they represent the state of any
+ * kind of lower layer not just hardware media.
  */
 
 extern void linkwatch_fire_event(struct net_device *dev);
@@ -729,6 +739,29 @@ extern void netif_carrier_on(struct net_device *dev);
 
 extern void netif_carrier_off(struct net_device *dev);
 
+static inline void netif_dormant_on(struct net_device *dev)
+{
+        if (!test_and_set_bit(__LINK_STATE_DORMANT, &dev->state))
+                linkwatch_fire_event(dev);
+}
+
+static inline void netif_dormant_off(struct net_device *dev)
+{
+        if (test_and_clear_bit(__LINK_STATE_DORMANT, &dev->state))
+                linkwatch_fire_event(dev);
+}
+
+static inline int netif_dormant(const struct net_device *dev)
+{
+        return test_bit(__LINK_STATE_DORMANT, &dev->state);
+}
+
+
+static inline int netif_oper_up(const struct net_device *dev) {
+        return (dev->operstate == IF_OPER_UP ||
+                dev->operstate == IF_OPER_UNKNOWN /* backward compat */);
+}
+
 /* Hot-plugging. */
 static inline int netif_device_present(struct net_device *dev)
 {
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 468896939843..412e52ca9720 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -80,10 +80,14 @@ struct nf_sockopt_ops
         int set_optmin;
         int set_optmax;
         int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);
+        int (*compat_set)(struct sock *sk, int optval,
+                        void __user *user, unsigned int len);
 
         int get_optmin;
         int get_optmax;
         int (*get)(struct sock *sk, int optval, void __user *user, int *len);
+        int (*compat_get)(struct sock *sk, int optval,
+                        void __user *user, int *len);
 
         /* Number of users inside set() or get(). */
         unsigned int use;
@@ -246,6 +250,11 @@ int nf_setsockopt(struct sock *sk, int pf, int optval, char __user *opt,
 int nf_getsockopt(struct sock *sk, int pf, int optval, char __user *opt,
                   int *len);
 
+int compat_nf_setsockopt(struct sock *sk, int pf, int optval,
+                char __user *opt, int len);
+int compat_nf_getsockopt(struct sock *sk, int pf, int optval,
+                char __user *opt, int *len);
+
 /* Packet queuing */
 struct nf_queue_handler {
         int (*outfn)(struct sk_buff *skb, struct nf_info *info,
diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
index 934a2479f160..9f5b12cf489b 100644
--- a/include/linux/netfilter/nfnetlink.h
+++ b/include/linux/netfilter/nfnetlink.h
@@ -164,6 +164,7 @@ extern void nfattr_parse(struct nfattr *tb[], int maxattr,
         __res;                                                          \
 })
 
+extern int nfnetlink_has_listeners(unsigned int group);
 extern int nfnetlink_send(struct sk_buff *skb, u32 pid, unsigned group, 
                           int echo);
 extern int nfnetlink_unicast(struct sk_buff *skb, u_int32_t pid, int flags);
diff --git a/include/linux/netfilter/nfnetlink_log.h b/include/linux/netfilter/nfnetlink_log.h
index b04b03880595..a7497c7436df 100644
--- a/include/linux/netfilter/nfnetlink_log.h
+++ b/include/linux/netfilter/nfnetlink_log.h
@@ -47,6 +47,8 @@ enum nfulnl_attr_type {
         NFULA_PAYLOAD,                  /* opaque data payload */
         NFULA_PREFIX,                   /* string prefix */
         NFULA_UID,                      /* user id of socket */
+        NFULA_SEQ,                      /* instance-local sequence number */
+        NFULA_SEQ_GLOBAL,               /* global sequence number */
 
         __NFULA_MAX
 };
@@ -77,6 +79,7 @@ enum nfulnl_attr_config {
         NFULA_CFG_NLBUFSIZ,             /* u_int32_t buffer size */
         NFULA_CFG_TIMEOUT,              /* u_int32_t in 1/100 s */
         NFULA_CFG_QTHRESH,              /* u_int32_t */
+        NFULA_CFG_FLAGS,                /* u_int16_t */
         __NFULA_CFG_MAX
 };
 #define NFULA_CFG_MAX (__NFULA_CFG_MAX -1)
@@ -85,4 +88,7 @@ enum nfulnl_attr_config {
 #define NFULNL_COPY_META        0x01
 #define NFULNL_COPY_PACKET      0x02
 
+#define NFULNL_CFG_F_SEQ        0x0001
+#define NFULNL_CFG_F_SEQ_GLOBAL 0x0002
+
 #endif /* _NFNETLINK_LOG_H */
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 6500d4e59d46..46a0f974f87c 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -92,8 +92,6 @@ struct xt_match
 
         const char name[XT_FUNCTION_MAXNAMELEN-1];
 
-        u_int8_t revision;
-
         /* Return true or false: return FALSE and set *hotdrop = 1 to
            force immediate packet drop. */
         /* Arguments changed since 2.6.9, as this must now handle
@@ -102,6 +100,7 @@ struct xt_match
         int (*match)(const struct sk_buff *skb,
                      const struct net_device *in,
                      const struct net_device *out,
+                     const struct xt_match *match,
                      const void *matchinfo,
                      int offset,
                      unsigned int protoff,
@@ -111,15 +110,25 @@ struct xt_match
         /* Should return true or false. */
         int (*checkentry)(const char *tablename,
                           const void *ip,
+                          const struct xt_match *match,
                           void *matchinfo,
                           unsigned int matchinfosize,
                           unsigned int hook_mask);
 
         /* Called when entry of this type deleted. */
-        void (*destroy)(void *matchinfo, unsigned int matchinfosize);
+        void (*destroy)(const struct xt_match *match, void *matchinfo,
+                        unsigned int matchinfosize);
 
         /* Set this to THIS_MODULE if you are a module, otherwise NULL */
         struct module *me;
+
+        char *table;
+        unsigned int matchsize;
+        unsigned int hooks;
+        unsigned short proto;
+
+        unsigned short family;
+        u_int8_t revision;
 };
 
 /* Registration hooks for targets. */
@@ -129,8 +138,6 @@ struct xt_target
 
         const char name[XT_FUNCTION_MAXNAMELEN-1];
 
-        u_int8_t revision;
-
         /* Returns verdict. Argument order changed since 2.6.9, as this
            must now handle non-linear skbs, using skb_copy_bits and
            skb_ip_make_writable. */
@@ -138,6 +145,7 @@ struct xt_target
                                const struct net_device *in,
                                const struct net_device *out,
                                unsigned int hooknum,
+                               const struct xt_target *target,
                                const void *targinfo,
                                void *userdata);
 
@@ -147,15 +155,25 @@ struct xt_target
         /* Should return true or false. */
         int (*checkentry)(const char *tablename,
                           const void *entry,
+                          const struct xt_target *target,
                           void *targinfo,
                           unsigned int targinfosize,
                           unsigned int hook_mask);
 
         /* Called when entry of this type deleted. */
-        void (*destroy)(void *targinfo, unsigned int targinfosize);
+        void (*destroy)(const struct xt_target *target, void *targinfo,
+                        unsigned int targinfosize);
 
         /* Set this to THIS_MODULE if you are a module, otherwise NULL */
         struct module *me;
+
+        char *table;
+        unsigned int targetsize;
+        unsigned int hooks;
+        unsigned short proto;
+
+        unsigned short family;
+        u_int8_t revision;
 };
 
 /* Furniture shopping... */
@@ -207,6 +225,13 @@ extern void xt_unregister_target(int af, struct xt_target *target);
 extern int xt_register_match(int af, struct xt_match *target);
 extern void xt_unregister_match(int af, struct xt_match *target);
 
+extern int xt_check_match(const struct xt_match *match, unsigned short family,
+                          unsigned int size, const char *table, unsigned int hook,
+                          unsigned short proto, int inv_proto);
+extern int xt_check_target(const struct xt_target *target, unsigned short family,
+                           unsigned int size, const char *table, unsigned int hook,
+                           unsigned short proto, int inv_proto);
+
 extern int xt_register_table(struct xt_table *table,
                              struct xt_table_info *bootstrap,
                              struct xt_table_info *newinfo);
diff --git a/include/linux/netfilter/xt_policy.h b/include/linux/netfilter/xt_policy.h
new file mode 100644
index 000000000000..a8132ec076fb
--- /dev/null
+++ b/include/linux/netfilter/xt_policy.h
@@ -0,0 +1,58 @@
+#ifndef _XT_POLICY_H
+#define _XT_POLICY_H
+
+#define XT_POLICY_MAX_ELEM      4
+
+enum xt_policy_flags
+{
+        XT_POLICY_MATCH_IN      = 0x1,
+        XT_POLICY_MATCH_OUT     = 0x2,
+        XT_POLICY_MATCH_NONE    = 0x4,
+        XT_POLICY_MATCH_STRICT  = 0x8,
+};
+
+enum xt_policy_modes
+{
+        XT_POLICY_MODE_TRANSPORT,
+        XT_POLICY_MODE_TUNNEL
+};
+
+struct xt_policy_spec
+{
+        u_int8_t        saddr:1,
+                        daddr:1,
+                        proto:1,
+                        mode:1,
+                        spi:1,
+                        reqid:1;
+};
+
+union xt_policy_addr
+{
+        struct in_addr  a4;
+        struct in6_addr a6;
+};
+
+struct xt_policy_elem
+{
+        union xt_policy_addr    saddr;
+        union xt_policy_addr    smask;
+        union xt_policy_addr    daddr;
+        union xt_policy_addr    dmask;
+        u_int32_t               spi;
+        u_int32_t               reqid;
+        u_int8_t                proto;
+        u_int8_t                mode;
+
+        struct xt_policy_spec   match;
+        struct xt_policy_spec   invert;
+};
+
+struct xt_policy_info
+{
+        struct xt_policy_elem pol[XT_POLICY_MAX_ELEM];
+        u_int16_t flags;
+        u_int16_t len;
+};
+
+#endif /* _XT_POLICY_H */
diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
index de4d397865ce..a75b84bb9a88 100644
--- a/include/linux/netfilter_bridge.h
+++ b/include/linux/netfilter_bridge.h
@@ -47,22 +47,6 @@ enum nf_br_hook_priorities {
 #define BRNF_BRIDGED                    0x08
 #define BRNF_NF_BRIDGE_PREROUTING       0x10
 
-static inline
-struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
-{
-        struct nf_bridge_info **nf_bridge = &(skb->nf_bridge);
-
-        if ((*nf_bridge = kmalloc(sizeof(**nf_bridge), GFP_ATOMIC)) != NULL) {
-                atomic_set(&(*nf_bridge)->use, 1);
-                (*nf_bridge)->mask = 0;
-                (*nf_bridge)->physindev = (*nf_bridge)->physoutdev = NULL;
-#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
-                (*nf_bridge)->netoutdev = NULL;
-#endif
-        }
-
-        return *nf_bridge;
-}
 
 /* Only used in br_forward.c */
 static inline
@@ -77,17 +61,6 @@ void nf_bridge_maybe_copy_header(struct sk_buff *skb)
         }
 }
 
-static inline
-void nf_bridge_save_header(struct sk_buff *skb)
-{
-        int header_size = 16;
-
-        if (skb->protocol == __constant_htons(ETH_P_8021Q))
-                header_size = 18;
-
-        memcpy(skb->nf_bridge->data, skb->data - header_size, header_size);
-}
-
 /* This is called by the IP fragmenting code and it ensures there is
  * enough room for the encapsulating header (if there is one). */
 static inline
diff --git a/include/linux/netfilter_ipv4/ip_conntrack.h b/include/linux/netfilter_ipv4/ip_conntrack.h
index 215765f043e6..f32d75c4f4cf 100644
--- a/include/linux/netfilter_ipv4/ip_conntrack.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack.h
@@ -29,6 +29,7 @@ union ip_conntrack_expect_proto {
 };
 
 /* Add protocol helper include file here */
+#include <linux/netfilter_ipv4/ip_conntrack_h323.h>
 #include <linux/netfilter_ipv4/ip_conntrack_pptp.h>
 #include <linux/netfilter_ipv4/ip_conntrack_amanda.h>
 #include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
@@ -37,6 +38,7 @@ union ip_conntrack_expect_proto {
 /* per conntrack: application helper private data */
 union ip_conntrack_help {
         /* insert conntrack helper private data (master) here */
+        struct ip_ct_h323_master ct_h323_info;
         struct ip_ct_pptp_master ct_pptp_info;
         struct ip_ct_ftp_master ct_ftp_info;
         struct ip_ct_irc_master ct_irc_info;
diff --git a/include/linux/netfilter_ipv4/ip_conntrack_h323.h b/include/linux/netfilter_ipv4/ip_conntrack_h323.h
new file mode 100644
index 000000000000..0987cea53840
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ip_conntrack_h323.h
@@ -0,0 +1,30 @@
+#ifndef _IP_CONNTRACK_H323_H
+#define _IP_CONNTRACK_H323_H
+
+#ifdef __KERNEL__
+
+#define RAS_PORT 1719
+#define Q931_PORT 1720
+#define H323_RTP_CHANNEL_MAX 4  /* Audio, video, FAX and other */
+
+/* This structure exists only once per master */
+struct ip_ct_h323_master {
+
+        /* Original and NATed Q.931 or H.245 signal ports */
+        u_int16_t sig_port[IP_CT_DIR_MAX];
+
+        /* Original and NATed RTP ports */
+        u_int16_t rtp_port[H323_RTP_CHANNEL_MAX][IP_CT_DIR_MAX];
+
+        union {
+                /* RAS connection timeout */
+                u_int32_t timeout;
+
+                /* Next TPKT length (for separate TPKT header and data) */
+                u_int16_t tpkt_len[IP_CT_DIR_MAX];
+        };
+};
+
+#endif
+
+#endif
diff --git a/include/linux/netfilter_ipv4/ip_nat.h b/include/linux/netfilter_ipv4/ip_nat.h
index 41a107de17cf..e9f5ed1d9f68 100644
--- a/include/linux/netfilter_ipv4/ip_nat.h
+++ b/include/linux/netfilter_ipv4/ip_nat.h
@@ -23,7 +23,7 @@ struct ip_nat_seq {
          * modification (if any) */
         u_int32_t correction_pos;
         /* sequence number offset before and after last modification */
-        int32_t offset_before, offset_after;
+        int16_t offset_before, offset_after;
 };
 
 /* Single range specification. */
diff --git a/include/linux/netfilter_ipv4/ipt_policy.h b/include/linux/netfilter_ipv4/ipt_policy.h
index a3f6eff39d33..b9478a255301 100644
--- a/include/linux/netfilter_ipv4/ipt_policy.h
+++ b/include/linux/netfilter_ipv4/ipt_policy.h
@@ -1,58 +1,21 @@
 #ifndef _IPT_POLICY_H
 #define _IPT_POLICY_H
 
-#define IPT_POLICY_MAX_ELEM     4
-
-enum ipt_policy_flags
-{
-        IPT_POLICY_MATCH_IN     = 0x1,
-        IPT_POLICY_MATCH_OUT    = 0x2,
-        IPT_POLICY_MATCH_NONE   = 0x4,
-        IPT_POLICY_MATCH_STRICT = 0x8,
-};
-
-enum ipt_policy_modes
-{
-        IPT_POLICY_MODE_TRANSPORT,
-        IPT_POLICY_MODE_TUNNEL
-};
-
-struct ipt_policy_spec
-{
-        u_int8_t        saddr:1,
-                        daddr:1,
-                        proto:1,
-                        mode:1,
-                        spi:1,
-                        reqid:1;
-};
-
-union ipt_policy_addr
-{
-        struct in_addr  a4;
-        struct in6_addr a6;
-};
-
-struct ipt_policy_elem
-{
-        union ipt_policy_addr   saddr;
-        union ipt_policy_addr   smask;
-        union ipt_policy_addr   daddr;
-        union ipt_policy_addr   dmask;
-        u_int32_t               spi;
-        u_int32_t               reqid;
-        u_int8_t                proto;
-        u_int8_t                mode;
-
-        struct ipt_policy_spec  match;
-        struct ipt_policy_spec  invert;
-};
-
-struct ipt_policy_info
-{
-        struct ipt_policy_elem pol[IPT_POLICY_MAX_ELEM];
-        u_int16_t flags;
-        u_int16_t len;
-};
+#define IPT_POLICY_MAX_ELEM             XT_POLICY_MAX_ELEM
+
+/* ipt_policy_flags */
+#define IPT_POLICY_MATCH_IN             XT_POLICY_MATCH_IN
+#define IPT_POLICY_MATCH_OUT            XT_POLICY_MATCH_OUT
+#define IPT_POLICY_MATCH_NONE           XT_POLICY_MATCH_NONE
+#define IPT_POLICY_MATCH_STRICT         XT_POLICY_MATCH_STRICT
+
+/* ipt_policy_modes */
+#define IPT_POLICY_MODE_TRANSPORT       XT_POLICY_MODE_TRANSPORT
+#define IPT_POLICY_MODE_TUNNEL          XT_POLICY_MODE_TUNNEL
+
+#define ipt_policy_spec                 xt_policy_spec
+#define ipt_policy_addr                 xt_policy_addr
+#define ipt_policy_elem                 xt_policy_elem
+#define ipt_policy_info                 xt_policy_info
 
 #endif /* _IPT_POLICY_H */
diff --git a/include/linux/netfilter_ipv6/ip6t_policy.h b/include/linux/netfilter_ipv6/ip6t_policy.h
index 671bd818300f..6bab3163d2fb 100644
--- a/include/linux/netfilter_ipv6/ip6t_policy.h
+++ b/include/linux/netfilter_ipv6/ip6t_policy.h
@@ -1,58 +1,21 @@
 #ifndef _IP6T_POLICY_H
 #define _IP6T_POLICY_H
 
-#define IP6T_POLICY_MAX_ELEM    4
-
-enum ip6t_policy_flags
-{
-        IP6T_POLICY_MATCH_IN            = 0x1,
-        IP6T_POLICY_MATCH_OUT           = 0x2,
-        IP6T_POLICY_MATCH_NONE          = 0x4,
-        IP6T_POLICY_MATCH_STRICT        = 0x8,
-};
-
-enum ip6t_policy_modes
-{
-        IP6T_POLICY_MODE_TRANSPORT,
-        IP6T_POLICY_MODE_TUNNEL
-};
-
-struct ip6t_policy_spec
-{
-        u_int8_t        saddr:1,
-                        daddr:1,
-                        proto:1,
-                        mode:1,
-                        spi:1,
-                        reqid:1;
-};
-
-union ip6t_policy_addr
-{
-        struct in_addr  a4;
-        struct in6_addr a6;
-};
-
-struct ip6t_policy_elem
-{
-        union ip6t_policy_addr  saddr;
-        union ip6t_policy_addr  smask;
-        union ip6t_policy_addr  daddr;
-        union ip6t_policy_addr  dmask;
-        u_int32_t               spi;
-        u_int32_t               reqid;
-        u_int8_t                proto;
-        u_int8_t                mode;
-
-        struct ip6t_policy_spec match;
-        struct ip6t_policy_spec invert;
-};
-
-struct ip6t_policy_info
-{
-        struct ip6t_policy_elem pol[IP6T_POLICY_MAX_ELEM];
-        u_int16_t flags;
-        u_int16_t len;
-};
+#define IP6T_POLICY_MAX_ELEM            XT_POLICY_MAX_ELEM
+
+/* ip6t_policy_flags */
+#define IP6T_POLICY_MATCH_IN            XT_POLICY_MATCH_IN
+#define IP6T_POLICY_MATCH_OUT           XT_POLICY_MATCH_OUT
+#define IP6T_POLICY_MATCH_NONE          XT_POLICY_MATCH_NONE
+#define IP6T_POLICY_MATCH_STRICT        XT_POLICY_MATCH_STRICT
+
+/* ip6t_policy_modes */
+#define IP6T_POLICY_MODE_TRANSPORT      XT_POLICY_MODE_TRANSPORT
+#define IP6T_POLICY_MODE_TUNNEL         XT_POLICY_MODE_TUNNEL
+
+#define ip6t_policy_spec                xt_policy_spec
+#define ip6t_policy_addr                xt_policy_addr
+#define ip6t_policy_elem                xt_policy_elem
+#define ip6t_policy_info                xt_policy_info
 
 #endif /* _IP6T_POLICY_H */
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index c256ebe2a7b4..f8f3d1c927f8 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -151,6 +151,7 @@ struct netlink_skb_parms
 
 extern struct sock *netlink_kernel_create(int unit, unsigned int groups, void (*input)(struct sock *sk, int len), struct module *module);
 extern void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err);
+extern int netlink_has_listeners(struct sock *sk, unsigned int group);
 extern int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 pid, int nonblock);
 extern int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 pid,
                              __u32 group, gfp_t allocation);
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index a6fdbe13a245..ec3c32932620 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -1367,6 +1367,7 @@
 #define PCI_DEVICE_ID_SERVERWORKS_HE      0x0008
 #define PCI_DEVICE_ID_SERVERWORKS_LE      0x0009
 #define PCI_DEVICE_ID_SERVERWORKS_GCNB_LE 0x0017
+#define PCI_DEVICE_ID_SERVERWORKS_EPB     0x0103
 #define PCI_DEVICE_ID_SERVERWORKS_OSB4    0x0200
 #define PCI_DEVICE_ID_SERVERWORKS_CSB5    0x0201
 #define PCI_DEVICE_ID_SERVERWORKS_CSB6    0x0203
@@ -1858,16 +1859,22 @@
 #define PCI_DEVICE_ID_TIGON3_5705M      0x165d
 #define PCI_DEVICE_ID_TIGON3_5705M_2    0x165e
 #define PCI_DEVICE_ID_TIGON3_5714       0x1668
+#define PCI_DEVICE_ID_TIGON3_5714S      0x1669
 #define PCI_DEVICE_ID_TIGON3_5780       0x166a
 #define PCI_DEVICE_ID_TIGON3_5780S      0x166b
 #define PCI_DEVICE_ID_TIGON3_5705F      0x166e
+#define PCI_DEVICE_ID_TIGON3_5754M      0x1672
 #define PCI_DEVICE_ID_TIGON3_5750       0x1676
 #define PCI_DEVICE_ID_TIGON3_5751       0x1677
 #define PCI_DEVICE_ID_TIGON3_5715       0x1678
+#define PCI_DEVICE_ID_TIGON3_5715S      0x1679
+#define PCI_DEVICE_ID_TIGON3_5754       0x167a
 #define PCI_DEVICE_ID_TIGON3_5750M      0x167c
 #define PCI_DEVICE_ID_TIGON3_5751M      0x167d
 #define PCI_DEVICE_ID_TIGON3_5751F      0x167e
+#define PCI_DEVICE_ID_TIGON3_5787M      0x1693
 #define PCI_DEVICE_ID_TIGON3_5782       0x1696
+#define PCI_DEVICE_ID_TIGON3_5787       0x169b
 #define PCI_DEVICE_ID_TIGON3_5788       0x169c
 #define PCI_DEVICE_ID_TIGON3_5789       0x169d
 #define PCI_DEVICE_ID_TIGON3_5702X      0x16a6
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index d50482ba27fe..d572d5376319 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -199,6 +199,7 @@ enum
 #define RTPROT_BIRD     12      /* BIRD */
 #define RTPROT_DNROUTED 13      /* DECnet routing daemon */
 #define RTPROT_XORP     14      /* XORP */
+#define RTPROT_NTK      15      /* Netsukuku */
 
 /* rtm_scope
 
@@ -733,6 +734,8 @@ enum
 #define IFLA_MAP IFLA_MAP
         IFLA_WEIGHT,
 #define IFLA_WEIGHT IFLA_WEIGHT
+        IFLA_OPERSTATE,
+        IFLA_LINKMODE,
         __IFLA_MAX
 };
 
@@ -905,6 +908,7 @@ struct tcamsg
 #ifdef __KERNEL__
 
 #include <linux/config.h>
+#include <linux/mutex.h>
 
 extern size_t rtattr_strlcpy(char *dest, const struct rtattr *rta, size_t size);
 static __inline__ int rtattr_strcmp(const struct rtattr *rta, const char *str)
@@ -1036,24 +1040,17 @@ __rta_reserve(struct sk_buff *skb, int attrtype, int attrlen)
 
 extern void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change);
 
-extern struct semaphore rtnl_sem;
-
-#define rtnl_shlock()           down(&rtnl_sem)
-#define rtnl_shlock_nowait()    down_trylock(&rtnl_sem)
-
-#define rtnl_shunlock() do { up(&rtnl_sem); \
-                             if (rtnl && rtnl->sk_receive_queue.qlen) \
-                                     rtnl->sk_data_ready(rtnl, 0); \
-                        } while(0)
-
+/* RTNL is used as a global lock for all changes to network configuration  */
 extern void rtnl_lock(void);
-extern int rtnl_lock_interruptible(void);
 extern void rtnl_unlock(void);
+extern int rtnl_trylock(void);
+
 extern void rtnetlink_init(void);
+extern void __rtnl_unlock(void);
 
 #define ASSERT_RTNL() do { \
-        if (unlikely(down_trylock(&rtnl_sem) == 0)) { \
-                up(&rtnl_sem); \
+        if (unlikely(rtnl_trylock())) { \
+                rtnl_unlock(); \
                 printk(KERN_ERR "RTNL: assertion failed at %s (%d)\n", \
                        __FILE__,  __LINE__); \
                 dump_stack(); \
diff --git a/include/linux/security.h b/include/linux/security.h
index 7cbef482e13a..b18eb8cfa639 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1286,7 +1286,8 @@ struct security_operations {
         int (*socket_setsockopt) (struct socket * sock, int level, int optname);
         int (*socket_shutdown) (struct socket * sock, int how);
         int (*socket_sock_rcv_skb) (struct sock * sk, struct sk_buff * skb);
-        int (*socket_getpeersec) (struct socket *sock, char __user *optval, int __user *optlen, unsigned len);
+        int (*socket_getpeersec_stream) (struct socket *sock, char __user *optval, int __user *optlen, unsigned len);
+        int (*socket_getpeersec_dgram) (struct sk_buff *skb, char **secdata, u32 *seclen);
         int (*sk_alloc_security) (struct sock *sk, int family, gfp_t priority);
         void (*sk_free_security) (struct sock *sk);
         unsigned int (*sk_getsid) (struct sock *sk, struct flowi *fl, u8 dir);
@@ -2741,10 +2742,16 @@ static inline int security_sock_rcv_skb (struct sock * sk,
         return security_ops->socket_sock_rcv_skb (sk, skb);
 }
 
-static inline int security_socket_getpeersec(struct socket *sock, char __user *optval,
-                                             int __user *optlen, unsigned len)
+static inline int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
+                                                    int __user *optlen, unsigned len)
 {
-        return security_ops->socket_getpeersec(sock, optval, optlen, len);
+        return security_ops->socket_getpeersec_stream(sock, optval, optlen, len);
+}
+
+static inline int security_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata,
+                                                   u32 *seclen)
+{
+        return security_ops->socket_getpeersec_dgram(skb, secdata, seclen);
 }
 
 static inline int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
@@ -2863,8 +2870,14 @@ static inline int security_sock_rcv_skb (struct sock * sk,
         return 0;
 }
 
-static inline int security_socket_getpeersec(struct socket *sock, char __user *optval,
-                                             int __user *optlen, unsigned len)
+static inline int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
+                                                    int __user *optlen, unsigned len)
+{
+        return -ENOPROTOOPT;
+}
+
+static inline int security_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata,
+                                                   u32 *seclen)
 {
         return -ENOPROTOOPT;
 }
diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
index 4041122dabfc..57abcea1cb5d 100644
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h
@@ -127,6 +127,9 @@
 /* Hilscher netx */
 #define PORT_NETX       71
 
+/* SUN4V Hypervisor Console */
+#define PORT_SUNHV      72
+
 #ifdef __KERNEL__
 
 #include <linux/config.h>
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index ad7cc22bd424..613b9513f8b9 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -270,7 +270,6 @@ struct sk_buff {
 
         void                    (*destructor)(struct sk_buff *skb);
 #ifdef CONFIG_NETFILTER
-        __u32                   nfmark;
         struct nf_conntrack     *nfct;
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
         struct sk_buff          *nfct_reasm;
@@ -278,6 +277,7 @@ struct sk_buff {
 #ifdef CONFIG_BRIDGE_NETFILTER
         struct nf_bridge_info   *nf_bridge;
 #endif
+        __u32                   nfmark;
 #endif /* CONFIG_NETFILTER */
 #ifdef CONFIG_NET_SCHED
         __u16                   tc_index;       /* traffic control index */
@@ -304,6 +304,7 @@ struct sk_buff {
 
 #include <asm/system.h>
 
+extern void kfree_skb(struct sk_buff *skb);
 extern void            __kfree_skb(struct sk_buff *skb);
 extern struct sk_buff *__alloc_skb(unsigned int size,
                                    gfp_t priority, int fclone);
@@ -404,22 +405,6 @@ static inline struct sk_buff *skb_get(struct sk_buff *skb)
  */
 
 /**
- *      kfree_skb - free an sk_buff
- *      @skb: buffer to free
- *
- *      Drop a reference to the buffer and free it if the usage count has
- *      hit zero.
- */
-static inline void kfree_skb(struct sk_buff *skb)
-{
-        if (likely(atomic_read(&skb->users) == 1))
-                smp_rmb();
-        else if (likely(!atomic_dec_and_test(&skb->users)))
-                return;
-        __kfree_skb(skb);
-}
-
-/**
  *      skb_cloned - is the buffer a clone
  *      @skb: buffer to check
  *
@@ -1174,12 +1159,14 @@ static inline int skb_linearize(struct sk_buff *skb, gfp_t gfp)
  */
 
 static inline void skb_postpull_rcsum(struct sk_buff *skb,
-                                         const void *start, int len)
+                                      const void *start, unsigned int len)
 {
         if (skb->ip_summed == CHECKSUM_HW)
                 skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0));
 }
 
+unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len);
+
 /**
  *      pskb_trim_rcsum - trim received skb and update checksum
  *      @skb: buffer to trim
@@ -1351,16 +1338,6 @@ static inline void nf_conntrack_put_reasm(struct sk_buff *skb)
                 kfree_skb(skb);
 }
 #endif
-static inline void nf_reset(struct sk_buff *skb)
-{
-        nf_conntrack_put(skb->nfct);
-        skb->nfct = NULL;
-#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
-        nf_conntrack_put_reasm(skb->nfct_reasm);
-        skb->nfct_reasm = NULL;
-#endif
-}
-
 #ifdef CONFIG_BRIDGE_NETFILTER
 static inline void nf_bridge_put(struct nf_bridge_info *nf_bridge)
 {
@@ -1373,6 +1350,20 @@ static inline void nf_bridge_get(struct nf_bridge_info *nf_bridge)
                 atomic_inc(&nf_bridge->use);
 }
 #endif /* CONFIG_BRIDGE_NETFILTER */
+static inline void nf_reset(struct sk_buff *skb)
+{
+        nf_conntrack_put(skb->nfct);
+        skb->nfct = NULL;
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+        nf_conntrack_put_reasm(skb->nfct_reasm);
+        skb->nfct_reasm = NULL;
+#endif
+#ifdef CONFIG_BRIDGE_NETFILTER
+        nf_bridge_put(skb->nf_bridge);
+        skb->nf_bridge = NULL;
+#endif
+}
+
 #else /* CONFIG_NETFILTER */
 static inline void nf_reset(struct sk_buff *skb) {}
 #endif /* CONFIG_NETFILTER */
diff --git a/include/linux/socket.h b/include/linux/socket.h
index b02dda4ee83d..9ab2ddd80221 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -150,6 +150,7 @@ __KINLINE struct cmsghdr * cmsg_nxthdr (struct msghdr *__msg, struct cmsghdr *__
 
 #define SCM_RIGHTS      0x01            /* rw: access rights (array of int) */
 #define SCM_CREDENTIALS 0x02            /* rw: struct ucred             */
+#define SCM_SECURITY    0x03            /* rw: security label           */
 
 struct ucred {
         __u32   pid;
diff --git a/include/linux/sunrpc/svcsock.h b/include/linux/sunrpc/svcsock.h
index d33c6face032..b4acb3d37c3f 100644
--- a/include/linux/sunrpc/svcsock.h
+++ b/include/linux/sunrpc/svcsock.h
@@ -36,7 +36,7 @@ struct svc_sock {
 
         struct list_head        sk_deferred;    /* deferred requests that need to
                                                  * be revisted */
-        struct semaphore        sk_sem;         /* to serialize sending data */
+        struct mutex            sk_mutex;       /* to serialize sending data */
 
         int                     (*sk_recvfrom)(struct svc_rqst *rqstp);
         int                     (*sk_sendto)(struct svc_rqst *rqstp);
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index bac61db26456..76eaeff76f82 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -211,6 +211,7 @@ enum
         NET_SCTP=17,
         NET_LLC=18,
         NET_NETFILTER=19,
+        NET_DCCP=20,
 };
 
 /* /proc/sys/kernel/random */
@@ -261,6 +262,8 @@ enum
         NET_CORE_DEV_WEIGHT=17,
         NET_CORE_SOMAXCONN=18,
         NET_CORE_BUDGET=19,
+        NET_CORE_AEVENT_ETIME=20,
+        NET_CORE_AEVENT_RSEQTH=21,
 };
 
 /* /proc/sys/net/ethernet */
@@ -397,6 +400,9 @@ enum
         NET_TCP_CONG_CONTROL=110,
         NET_TCP_ABC=111,
         NET_IPV4_IPFRAG_MAX_DIST=112,
+        NET_TCP_MTU_PROBING=113,
+        NET_TCP_BASE_MSS=114,
+        NET_IPV4_TCP_WORKAROUND_SIGNED_WINDOWS=115,
 };
 
 enum {
@@ -451,6 +457,7 @@ enum
         NET_IPV4_CONF_ARP_ANNOUNCE=18,
         NET_IPV4_CONF_ARP_IGNORE=19,
         NET_IPV4_CONF_PROMOTE_SECONDARIES=20,
+        NET_IPV4_CONF_ARP_ACCEPT=21,
         __NET_IPV4_CONF_MAX
 };
 
@@ -531,6 +538,11 @@ enum {
         NET_IPV6_MAX_DESYNC_FACTOR=15,
         NET_IPV6_MAX_ADDRESSES=16,
         NET_IPV6_FORCE_MLD_VERSION=17,
+        NET_IPV6_ACCEPT_RA_DEFRTR=18,
+        NET_IPV6_ACCEPT_RA_PINFO=19,
+        NET_IPV6_ACCEPT_RA_RTR_PREF=20,
+        NET_IPV6_RTR_PROBE_INTERVAL=21,
+        NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN=22,
         __NET_IPV6_MAX
 };
 
@@ -562,6 +574,21 @@ enum {
         __NET_NEIGH_MAX
 };
 
+/* /proc/sys/net/dccp */
+enum {
+        NET_DCCP_DEFAULT=1,
+};
+
+/* /proc/sys/net/dccp/default */
+enum {
+        NET_DCCP_DEFAULT_SEQ_WINDOW  = 1,
+        NET_DCCP_DEFAULT_RX_CCID     = 2,
+        NET_DCCP_DEFAULT_TX_CCID     = 3,
+        NET_DCCP_DEFAULT_ACK_RATIO   = 4,
+        NET_DCCP_DEFAULT_SEND_ACKVEC = 5,
+        NET_DCCP_DEFAULT_SEND_NDP    = 6,
+};
+
 /* /proc/sys/net/ipx */
 enum {
         NET_IPX_PPROP_BROADCASTING=1,
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index f2bb2396853f..542d39596bd8 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -343,6 +343,12 @@ struct tcp_sock {
                 __u32   seq;
                 __u32   time;
         } rcvq_space;
+
+/* TCP-specific MTU probe information. */
+        struct {
+                __u32             probe_seq_start;
+                __u32             probe_seq_end;
+        } mtu_probe;
 };
 
 static inline struct tcp_sock *tcp_sk(const struct sock *sk)
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 827cc6de5f5c..130d125fda12 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1018,8 +1018,6 @@ extern int usb_get_descriptor(struct usb_device *dev, unsigned char desctype,
         unsigned char descindex, void *buf, int size);
 extern int usb_get_status(struct usb_device *dev,
         int type, int target, void *data);
-extern int usb_get_string(struct usb_device *dev,
-        unsigned short langid, unsigned char index, void *buf, int size);
 extern int usb_string(struct usb_device *dev, int index,
         char *buf, size_t size);
 
diff --git a/include/linux/usb_gadget.h b/include/linux/usb_gadget.h
index ff81117eb733..1d78870ed8af 100644
--- a/include/linux/usb_gadget.h
+++ b/include/linux/usb_gadget.h
@@ -801,7 +801,9 @@ struct usb_gadget_driver {
  * Call this in your gadget driver's module initialization function,
  * to tell the underlying usb controller driver about your driver.
  * The driver's bind() function will be called to bind it to a
- * gadget.  This function must be called in a context that can sleep.
+ * gadget before this registration call returns.  It's expected that
+ * the bind() functions will be in init sections.
+ * This function must be called in a context that can sleep.
  */
 int usb_gadget_register_driver (struct usb_gadget_driver *driver);
 
@@ -814,7 +816,8 @@ int usb_gadget_register_driver (struct usb_gadget_driver *driver);
  * going away.  If the controller is connected to a USB host,
  * it will first disconnect().  The driver is also requested
  * to unbind() and clean up any device state, before this procedure
- * finally returns.
+ * finally returns.  It's expected that the unbind() functions
+ * will in in exit sections, so may not be linked in some kernels.
  * This function must be called in a context that can sleep.
  */
 int usb_gadget_unregister_driver (struct usb_gadget_driver *driver);
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index 5208b12d5550..724cfbf54b8a 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -17,11 +17,12 @@
 #include <linux/time.h> /* need struct timeval */
 #include <linux/poll.h>
 #include <linux/device.h>
+#include <linux/mutex.h>
 #endif
 #include <linux/compiler.h> /* need __user */
 
 
-#define OBSOLETE_OWNER 1 /* It will be removed for 2.6.15 */
+#define OBSOLETE_OWNER 1 /* It will be removed for 2.6.17 */
 #define HAVE_V4L2 1
 
 /*
@@ -48,6 +49,16 @@
 
 #ifdef __KERNEL__
 
+/* Minor device allocation */
+#define MINOR_VFL_TYPE_GRABBER_MIN   0
+#define MINOR_VFL_TYPE_GRABBER_MAX  63
+#define MINOR_VFL_TYPE_RADIO_MIN    64
+#define MINOR_VFL_TYPE_RADIO_MAX   127
+#define MINOR_VFL_TYPE_VTX_MIN     192
+#define MINOR_VFL_TYPE_VTX_MAX     223
+#define MINOR_VFL_TYPE_VBI_MIN     224
+#define MINOR_VFL_TYPE_VBI_MAX     255
+
 #define VFL_TYPE_GRABBER        0
 #define VFL_TYPE_VBI            1
 #define VFL_TYPE_RADIO          2
@@ -80,7 +91,7 @@ struct video_device
 
         /* for videodev.c intenal usage -- please don't touch */
         int users;                     /* video_exclusive_{open|close} ... */
-        struct semaphore lock;         /* ... helper function uses these   */
+        struct mutex lock;             /* ... helper function uses these   */
         char devfs_name[64];           /* devfs */
         struct class_device class_dev; /* sysfs */
 };
@@ -952,13 +963,68 @@ struct v4l2_sliced_vbi_format
         __u32   reserved[2];            /* must be zero */
 };
 
-#define V4L2_SLICED_TELETEXT_B          (0x0001)
-#define V4L2_SLICED_VPS                 (0x0400)
-#define V4L2_SLICED_CAPTION_525         (0x1000)
-#define V4L2_SLICED_WSS_625             (0x4000)
-
-#define V4L2_SLICED_VBI_525             (V4L2_SLICED_CAPTION_525)
-#define V4L2_SLICED_VBI_625             (V4L2_SLICED_TELETEXT_B | V4L2_SLICED_VPS | V4L2_SLICED_WSS_625)
+/* Teletext World System Teletext
+   (WST), defined on ITU-R BT.653-2 */
+#define V4L2_SLICED_TELETEXT_PAL_B      (0x000001)
+#define V4L2_SLICED_TELETEXT_PAL_C      (0x000002)
+#define V4L2_SLICED_TELETEXT_NTSC_B     (0x000010)
+#define V4L2_SLICED_TELETEXT_SECAM      (0x000020)
+
+/* Teletext North American Broadcast Teletext Specification
+   (NABTS), defined on ITU-R BT.653-2 */
+#define V4L2_SLICED_TELETEXT_NTSC_C     (0x000040)
+#define V4L2_SLICED_TELETEXT_NTSC_D     (0x000080)
+
+/* Video Program System, defined on ETS 300 231*/
+#define V4L2_SLICED_VPS                 (0x000400)
+
+/* Closed Caption, defined on EIA-608 */
+#define V4L2_SLICED_CAPTION_525         (0x001000)
+#define V4L2_SLICED_CAPTION_625         (0x002000)
+
+/* Wide Screen System, defined on ITU-R BT1119.1 */
+#define V4L2_SLICED_WSS_625             (0x004000)
+
+/* Wide Screen System, defined on IEC 61880 */
+#define V4L2_SLICED_WSS_525             (0x008000)
+
+/* Vertical Interval Timecode (VITC), defined on SMPTE 12M */
+#define V4l2_SLICED_VITC_625            (0x010000)
+#define V4l2_SLICED_VITC_525            (0x020000)
+
+#define V4L2_SLICED_TELETEXT_B          (V4L2_SLICED_TELETEXT_PAL_B  |\
+                                         V4L2_SLICED_TELETEXT_NTSC_B)
+
+#define V4L2_SLICED_TELETEXT            (V4L2_SLICED_TELETEXT_PAL_B  |\
+                                         V4L2_SLICED_TELETEXT_PAL_C  |\
+                                         V4L2_SLICED_TELETEXT_SECAM  |\
+                                         V4L2_SLICED_TELETEXT_NTSC_B |\
+                                         V4L2_SLICED_TELETEXT_NTSC_C |\
+                                         V4L2_SLICED_TELETEXT_NTSC_D)
+
+#define V4L2_SLICED_CAPTION             (V4L2_SLICED_CAPTION_525     |\
+                                         V4L2_SLICED_CAPTION_625)
+
+#define V4L2_SLICED_WSS                 (V4L2_SLICED_WSS_525         |\
+                                         V4L2_SLICED_WSS_625)
+
+#define V4L2_SLICED_VITC                (V4L2_SLICED_VITC_525        |\
+                                         V4L2_SLICED_VITC_625)
+
+#define V4L2_SLICED_VBI_525             (V4L2_SLICED_TELETEXT_NTSC_B |\
+                                         V4L2_SLICED_TELETEXT_NTSC_C |\
+                                         V4L2_SLICED_TELETEXT_NTSC_D |\
+                                         V4L2_SLICED_CAPTION_525     |\
+                                         V4L2_SLICED_WSS_525         |\
+                                         V4l2_SLICED_VITC_525)
+
+#define V4L2_SLICED_VBI_625             (V4L2_SLICED_TELETEXT_PAL_B  |\
+                                         V4L2_SLICED_TELETEXT_PAL_C  |\
+                                         V4L2_SLICED_TELETEXT_SECAM  |\
+                                         V4L2_SLICED_VPS             |\
+                                         V4L2_SLICED_CAPTION_625     |\
+                                         V4L2_SLICED_WSS_625         |\
+                                         V4l2_SLICED_VITC_625)
 
 struct v4l2_sliced_vbi_cap
 {
diff --git a/include/linux/xfrm.h b/include/linux/xfrm.h
index 82fbb758e28f..6b42cc474c01 100644
--- a/include/linux/xfrm.h
+++ b/include/linux/xfrm.h
@@ -156,6 +156,10 @@ enum {
         XFRM_MSG_FLUSHPOLICY,
 #define XFRM_MSG_FLUSHPOLICY XFRM_MSG_FLUSHPOLICY
 
+        XFRM_MSG_NEWAE,
+#define XFRM_MSG_NEWAE XFRM_MSG_NEWAE
+        XFRM_MSG_GETAE,
+#define XFRM_MSG_GETAE XFRM_MSG_GETAE
         __XFRM_MSG_MAX
 };
 #define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1)
@@ -194,6 +198,21 @@ struct xfrm_encap_tmpl {
         xfrm_address_t  encap_oa;
 };
 
+/* AEVENT flags  */
+enum xfrm_ae_ftype_t {
+        XFRM_AE_UNSPEC,
+        XFRM_AE_RTHR=1, /* replay threshold*/
+        XFRM_AE_RVAL=2, /* replay value */
+        XFRM_AE_LVAL=4, /* lifetime value */
+        XFRM_AE_ETHR=8, /* expiry timer threshold */
+        XFRM_AE_CR=16, /* Event cause is replay update */
+        XFRM_AE_CE=32, /* Event cause is timer expiry */
+        XFRM_AE_CU=64, /* Event cause is policy update */
+        __XFRM_AE_MAX
+
+#define XFRM_AE_MAX (__XFRM_AE_MAX - 1)
+};
+
 /* Netlink message attributes.  */
 enum xfrm_attr_type_t {
         XFRMA_UNSPEC,
@@ -205,6 +224,10 @@ enum xfrm_attr_type_t {
         XFRMA_SA,
         XFRMA_POLICY,
         XFRMA_SEC_CTX,          /* struct xfrm_sec_ctx */
+        XFRMA_LTIME_VAL,
+        XFRMA_REPLAY_VAL,
+        XFRMA_REPLAY_THRESH,
+        XFRMA_ETIMER_THRESH,
         __XFRMA_MAX
 
 #define XFRMA_MAX (__XFRMA_MAX - 1)
@@ -235,6 +258,11 @@ struct xfrm_usersa_id {
         __u8                            proto;
 };
 
+struct xfrm_aevent_id {
+        struct xfrm_usersa_id           sa_id;
+        __u32                           flags;
+};
+
 struct xfrm_userspi_info {
         struct xfrm_usersa_info         info;
         __u32                           min;
@@ -306,6 +334,8 @@ enum xfrm_nlgroups {
 #define XFRMNLGRP_SA            XFRMNLGRP_SA
         XFRMNLGRP_POLICY,
 #define XFRMNLGRP_POLICY        XFRMNLGRP_POLICY
+        XFRMNLGRP_AEVENTS,
+#define XFRMNLGRP_AEVENTS       XFRMNLGRP_AEVENTS
         __XFRMNLGRP_MAX
 };
 #define XFRMNLGRP_MAX   (__XFRMNLGRP_MAX - 1)
diff --git a/include/media/ir-common.h b/include/media/ir-common.h
index ad3e9bb670c3..302d5b3946e7 100644
--- a/include/media/ir-common.h
+++ b/include/media/ir-common.h
@@ -47,13 +47,6 @@ struct ir_input_state {
         int                keypressed;  /* current state */
 };
 
-extern IR_KEYTAB_TYPE ir_codes_rc5_tv[IR_KEYTAB_SIZE];
-extern IR_KEYTAB_TYPE ir_codes_winfast[IR_KEYTAB_SIZE];
-extern IR_KEYTAB_TYPE ir_codes_pinnacle[IR_KEYTAB_SIZE];
-extern IR_KEYTAB_TYPE ir_codes_empty[IR_KEYTAB_SIZE];
-extern IR_KEYTAB_TYPE ir_codes_hauppauge_new[IR_KEYTAB_SIZE];
-extern IR_KEYTAB_TYPE ir_codes_pixelview[IR_KEYTAB_SIZE];
-
 void ir_input_init(struct input_dev *dev, struct ir_input_state *ir,
                    int ir_type, IR_KEYTAB_TYPE *ir_codes);
 void ir_input_nokey(struct input_dev *dev, struct ir_input_state *ir);
@@ -64,6 +57,39 @@ int  ir_dump_samples(u32 *samples, int count);
 int  ir_decode_biphase(u32 *samples, int count, int low, int high);
 int  ir_decode_pulsedistance(u32 *samples, int count, int low, int high);
 
+/* Keymaps to be used by other modules */
+
+extern IR_KEYTAB_TYPE ir_codes_empty[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_avermedia[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_avermedia_dvbt[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_apac_viewcomp[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_pixelview[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_nebula[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_dntv_live_dvb_t[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_iodata_bctv7e[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_adstech_dvb_t_pci[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_msi_tvanywhere[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_cinergy_1400[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_avertv_303[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_dntv_live_dvbt_pro[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_em_terratec[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_em_pinnacle_usb[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_flyvideo[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_flydvb[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_cinergy[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_eztv[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_avermedia[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_videomate_tv_pvr[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_manli[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_gotview7135[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_purpletv[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_pctv_sedna[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_pv951[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_rc5_tv[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_winfast[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_pinnacle[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_hauppauge_new[IR_KEYTAB_SIZE];
+
 #endif
 
 /*
diff --git a/include/media/saa7146.h b/include/media/saa7146.h
index 2bc634fcb7bb..fee579f10b32 100644
--- a/include/media/saa7146.h
+++ b/include/media/saa7146.h
@@ -11,6 +11,8 @@
 #include <linux/i2c.h>          /* for i2c subsystem */
 #include <asm/io.h>             /* for accessing devices */
 #include <linux/stringify.h>
+#include <linux/mutex.h>
+
 #include <linux/vmalloc.h>      /* for vmalloc() */
 #include <linux/mm.h>           /* for vmalloc_to_page() */
 
@@ -112,7 +114,7 @@ struct saa7146_dev
 
         /* different device locks */
         spinlock_t                      slock;
-        struct semaphore                lock;
+        struct mutex                    lock;
 
         unsigned char                   __iomem *mem;           /* pointer to mapped IO memory */
         int                             revision;       /* chip revision; needed for bug-workarounds*/
@@ -133,15 +135,16 @@ struct saa7146_dev
         void (*vv_callback)(struct saa7146_dev *dev, unsigned long status);
 
         /* i2c-stuff */
-        struct semaphore        i2c_lock;
-        u32                     i2c_bitrate;
-        struct saa7146_dma      d_i2c;  /* pointer to i2c memory */
-        wait_queue_head_t       i2c_wq;
-        int                     i2c_op;
+        struct mutex                    i2c_lock;
+
+        u32                             i2c_bitrate;
+        struct saa7146_dma              d_i2c;  /* pointer to i2c memory */
+        wait_queue_head_t               i2c_wq;
+        int                             i2c_op;
 
         /* memories */
-        struct saa7146_dma      d_rps0;
-        struct saa7146_dma      d_rps1;
+        struct saa7146_dma              d_rps0;
+        struct saa7146_dma              d_rps1;
 };
 
 /* from saa7146_i2c.c */
@@ -150,7 +153,7 @@ int saa7146_i2c_transfer(struct saa7146_dev *saa, const struct i2c_msg *msgs, in
 
 /* from saa7146_core.c */
 extern struct list_head saa7146_devices;
-extern struct semaphore saa7146_devices_lock;
+extern struct mutex saa7146_devices_lock;
 int saa7146_register_extension(struct saa7146_extension*);
 int saa7146_unregister_extension(struct saa7146_extension*);
 struct saa7146_format* format_by_fourcc(struct saa7146_dev *dev, int fourcc);
diff --git a/include/media/tuner-types.h b/include/media/tuner-types.h
index 15821ab14a9e..ad9c171bfa07 100644
--- a/include/media/tuner-types.h
+++ b/include/media/tuner-types.h
@@ -14,6 +14,7 @@ enum param_type {
 
 struct tuner_range {
         unsigned short limit;
+        unsigned char config;
         unsigned char cb;
 };
 
@@ -38,7 +39,6 @@ struct tuner_params {
          * static unless the control byte was sent first.
          */
         unsigned int cb_first_if_lower_freq:1;
-        unsigned char config; /* to be moved into struct tuner_range for dvb-pll merge */
 
         unsigned int count;
         struct tuner_range *ranges;
@@ -46,6 +46,7 @@ struct tuner_params {
 
 struct tunertype {
         char *name;
+        unsigned int count;
         struct tuner_params *params;
 };
 
diff --git a/include/media/tuner.h b/include/media/tuner.h
index a5beeac495c7..017fed7d5e4d 100644
--- a/include/media/tuner.h
+++ b/include/media/tuner.h
@@ -110,12 +110,15 @@
 
 #define TUNER_LG_TDVS_H062F             64      /* DViCO FusionHDTV 5 */
 #define TUNER_YMEC_TVF66T5_B_DFF        65      /* Acorp Y878F */
-#define TUNER_LG_NTSC_TALN_MINI         66
+#define TUNER_LG_TALN                   66
 #define TUNER_PHILIPS_TD1316            67
 
 #define TUNER_PHILIPS_TUV1236D          68      /* ATI HDTV Wonder */
 #define TUNER_TNF_5335MF                69      /* Sabrent Bt848   */
 #define TUNER_SAMSUNG_TCPN_2121P30A     70      /* Hauppauge PVR-500MCE NTSC */
+#define TUNER_XCEIVE_XC3028             71
+
+#define TUNER_THOMSON_FE6600            72      /* DViCO FusionHDTV DVB-T Hybrid */
 
 /* tv card specific */
 #define TDA9887_PRESENT                 (1<<0)
@@ -209,6 +212,7 @@ struct tuner {
 extern unsigned const int tuner_count;
 
 extern int microtune_init(struct i2c_client *c);
+extern int xc3028_init(struct i2c_client *c);
 extern int tda8290_init(struct i2c_client *c);
 extern int tda8290_probe(struct i2c_client *c);
 extern int tea5767_tuner_init(struct i2c_client *c);
diff --git a/include/media/v4l2-common.h b/include/media/v4l2-common.h
index d4030a7e16e0..2360453e7496 100644
--- a/include/media/v4l2-common.h
+++ b/include/media/v4l2-common.h
@@ -58,6 +58,9 @@
 /* Prints the ioctl in a human-readable format */
 extern void v4l_printk_ioctl(unsigned int cmd);
 
+/* Prints the ioctl and arg in a human-readable format */
+extern void v4l_printk_ioctl_arg(char *s,unsigned int cmd, void *arg);
+
 /* Use this macro for non-I2C drivers. Pass the driver name as the first arg. */
 #define v4l_print_ioctl(name, cmd)               \
         do {                                     \
@@ -100,6 +103,7 @@ enum v4l2_chip_ident {
         V4L2_IDENT_UNKNOWN = 0,
 
         /* module saa7115: reserved range 100-149 */
+        V4L2_IDENT_SAA7113 = 103,
         V4L2_IDENT_SAA7114 = 104,
         V4L2_IDENT_SAA7115 = 105,
 
@@ -115,12 +119,15 @@ enum v4l2_chip_ident {
 };
 
 /* audio ioctls */
-/* v4l device was opened in Radio mode */
+
+/* v4l device was opened in Radio mode, to be replaced by VIDIOC_INT_S_TUNER_MODE */
 #define AUDC_SET_RADIO        _IO('d',88)
-/* select from TV,radio,extern,MUTE */
+
+/* select from TV,radio,extern,MUTE, to be replaced with VIDIOC_INT_S_AUDIO_ROUTING */
 #define AUDC_SET_INPUT        _IOW('d',89,int)
 
-/* msp3400 ioctl: will be removed in the near future */
+/* msp3400 ioctl: will be removed in the near future, to be replaced by
+   VIDIOC_INT_S_AUDIO_ROUTING. */
 struct msp_matrix {
   int input;
   int output;
@@ -128,12 +135,25 @@ struct msp_matrix {
 #define MSP_SET_MATRIX     _IOW('m',17,struct msp_matrix)
 
 /* tuner ioctls */
+
 /* Sets tuner type and its I2C addr */
-#define TUNER_SET_TYPE_ADDR          _IOW('d',90,int)
-/* Puts tuner on powersaving state, disabling it, except for i2c */
-#define TUNER_SET_STANDBY            _IOW('d',91,int)
+#define TUNER_SET_TYPE_ADDR          _IOW('d', 90, int)
+
+/* Puts tuner on powersaving state, disabling it, except for i2c. To be replaced
+   by VIDIOC_INT_S_STANDBY. */
+#define TUNER_SET_STANDBY            _IOW('d', 91, int)
+
 /* Sets tda9887 specific stuff, like port1, port2 and qss */
-#define TDA9887_SET_CONFIG           _IOW('d',92,int)
+#define TDA9887_SET_CONFIG           _IOW('d', 92, int)
+
+/* Switch the tuner to a specific tuner mode. Replacement of AUDC_SET_RADIO */
+#define VIDIOC_INT_S_TUNER_MODE      _IOW('d', 93, enum v4l2_tuner_type)
+
+/* Generic standby command. Passing -1 (all bits set to 1) will put the whole
+   chip into standby mode, value 0 will make the chip fully active. Specific
+   bits can be used by certain chips to enable/disable specific subsystems.
+   Replacement of TUNER_SET_STANDBY. */
+#define VIDIOC_INT_S_STANDBY         _IOW('d', 94, u32)
 
 /* only implemented if CONFIG_VIDEO_ADV_DEBUG is defined */
 #define VIDIOC_INT_S_REGISTER           _IOR ('d', 100, struct v4l2_register)
@@ -160,7 +180,8 @@ struct msp_matrix {
 
 /* Used to generate VBI signals on a video signal. v4l2_sliced_vbi_data is
    filled with the data packets that should be output. Note that if you set
-   the line field to 0, then that VBI signal is disabled. */
+   the line field to 0, then that VBI signal is disabled. If no
+   valid VBI data was found, then the type field is set to 0 on return. */
 #define VIDIOC_INT_S_VBI_DATA           _IOW ('d', 105, struct v4l2_sliced_vbi_data)
 
 /* Used to obtain the sliced VBI packet from a readback register. Not all
@@ -168,11 +189,11 @@ struct msp_matrix {
    register contains invalid or erroneous data -EIO is returned. Note that
    you must fill in the 'id' member and the 'field' member (to determine
    whether CC data from the first or second field should be obtained). */
-#define VIDIOC_INT_G_VBI_DATA           _IOWR('d', 106, struct v4l2_sliced_vbi_data *)
+#define VIDIOC_INT_G_VBI_DATA           _IOWR('d', 106, struct v4l2_sliced_vbi_data)
 
 /* Returns the chip identifier or V4L2_IDENT_UNKNOWN if no identification can
    be made. */
-#define VIDIOC_INT_G_CHIP_IDENT         _IOR ('d', 107, enum v4l2_chip_ident *)
+#define VIDIOC_INT_G_CHIP_IDENT         _IOR ('d', 107, enum v4l2_chip_ident)
 
 /* Sets I2S speed in bps. This is used to provide a standard way to select I2S
    clock used by driving digital audio streams at some board designs.
@@ -180,4 +201,25 @@ struct msp_matrix {
    If the frequency is not supported, then -EINVAL is returned. */
 #define VIDIOC_INT_I2S_CLOCK_FREQ       _IOW ('d', 108, u32)
 
+/* Routing definition, device dependent. It specifies which inputs (if any)
+   should be routed to which outputs (if any). */
+struct v4l2_routing {
+        u32 input;
+        u32 output;
+};
+
+/* These internal commands should be used to define the inputs and outputs
+   of an audio/video chip. They will replace AUDC_SET_INPUT.
+   The v4l2 API commands VIDIOC_S/G_INPUT, VIDIOC_S/G_OUTPUT,
+   VIDIOC_S/G_AUDIO and VIDIOC_S/G_AUDOUT are meant to be used by the
+   user. Internally these commands should be used to switch inputs/outputs
+   because only the driver knows how to map a 'Television' input to the precise
+   input/output routing of an A/D converter, or a DSP, or a video digitizer.
+   These four commands should only be sent directly to an i2c device, they
+   should not be broadcast as the routing is very device specific. */
+#define VIDIOC_INT_S_AUDIO_ROUTING      _IOW ('d', 109, struct v4l2_routing)
+#define VIDIOC_INT_G_AUDIO_ROUTING      _IOR ('d', 110, struct v4l2_routing)
+#define VIDIOC_INT_S_VIDEO_ROUTING      _IOW ('d', 111, struct v4l2_routing)
+#define VIDIOC_INT_G_VIDEO_ROUTING      _IOR ('d', 112, struct v4l2_routing)
+
 #endif /* V4L2_COMMON_H_ */
diff --git a/include/media/video-buf-dvb.h b/include/media/video-buf-dvb.h
index ad0a07a3a895..b78d90fe629f 100644
--- a/include/media/video-buf-dvb.h
+++ b/include/media/video-buf-dvb.h
@@ -11,7 +11,7 @@ struct videobuf_dvb {
         struct videobuf_queue      dvbq;
 
         /* video-buf-dvb state info */
-        struct semaphore           lock;
+        struct mutex               lock;
         struct task_struct         *thread;
         int                        nfeeds;
 
diff --git a/include/media/video-buf.h b/include/media/video-buf.h
index 8ecfd78e0027..d90dec5484ee 100644
--- a/include/media/video-buf.h
+++ b/include/media/video-buf.h
@@ -177,7 +177,7 @@ struct videobuf_queue_ops {
 };
 
 struct videobuf_queue {
-        struct semaphore           lock;
+        struct mutex               lock;
         spinlock_t                 *irqlock;
         struct pci_dev             *pci;
 
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index bfc1779fc753..427dac94bc7e 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -4,6 +4,7 @@
 #include <linux/config.h>
 #include <linux/socket.h>
 #include <linux/un.h>
+#include <linux/mutex.h>
 #include <net/sock.h>
 
 extern void unix_inflight(struct file *fp);
@@ -71,7 +72,7 @@ struct unix_sock {
         struct unix_address     *addr;
         struct dentry           *dentry;
         struct vfsmount         *mnt;
-        struct semaphore        readsem;
+        struct mutex            readlock;
         struct sock             *peer;
         struct sock             *other;
         struct sock             *gc_tree;
diff --git a/include/net/ax25.h b/include/net/ax25.h
index 2250a18b0cbb..d052b221dbcd 100644
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -110,8 +110,15 @@ enum {
 enum {
         AX25_PROTO_STD_SIMPLEX,
         AX25_PROTO_STD_DUPLEX,
+#ifdef CONFIG_AX25_DAMA_SLAVE
         AX25_PROTO_DAMA_SLAVE,
-        AX25_PROTO_DAMA_MASTER
+#ifdef CONFIG_AX25_DAMA_MASTER
+        AX25_PROTO_DAMA_MASTER,
+#define AX25_PROTO_MAX AX25_PROTO_DAMA_MASTER
+#endif
+#endif
+        __AX25_PROTO_MAX,
+        AX25_PROTO_MAX = __AX25_PROTO_MAX -1
 };
 
 enum {
diff --git a/include/net/dn.h b/include/net/dn.h
index a4b6168e1e25..465b78302782 100644
--- a/include/net/dn.h
+++ b/include/net/dn.h
@@ -6,10 +6,8 @@
 #include <net/tcp.h>
 #include <asm/byteorder.h>
 
-typedef unsigned short dn_address;
-
-#define dn_ntohs(x) le16_to_cpu((unsigned short)(x))
-#define dn_htons(x) cpu_to_le16((unsigned short)(x))
+#define dn_ntohs(x) le16_to_cpu(x)
+#define dn_htons(x) cpu_to_le16(x)
 
 struct dn_scp                                   /* Session Control Port */
 {
@@ -31,36 +29,36 @@ struct dn_scp                                   /* Session Control Port */
 #define DN_CL    15                     /* Closed               */
 #define DN_CN    16                     /* Closed Notification  */
 
-        unsigned short          addrloc;
-        unsigned short          addrrem;
-        unsigned short          numdat;
-        unsigned short          numoth;
-        unsigned short          numoth_rcv;
-        unsigned short          numdat_rcv;
-        unsigned short          ackxmt_dat;
-        unsigned short          ackxmt_oth;
-        unsigned short          ackrcv_dat;
-        unsigned short          ackrcv_oth;
-        unsigned char           flowrem_sw;
-        unsigned char           flowloc_sw;
+        __le16          addrloc;
+        __le16          addrrem;
+        __u16          numdat;
+        __u16          numoth;
+        __u16          numoth_rcv;
+        __u16          numdat_rcv;
+        __u16          ackxmt_dat;
+        __u16          ackxmt_oth;
+        __u16          ackrcv_dat;
+        __u16          ackrcv_oth;
+        __u8           flowrem_sw;
+        __u8           flowloc_sw;
 #define DN_SEND         2
 #define DN_DONTSEND     1
 #define DN_NOCHANGE     0
-        unsigned short          flowrem_dat;
-        unsigned short          flowrem_oth;
-        unsigned short          flowloc_dat;
-        unsigned short          flowloc_oth;
-        unsigned char           services_rem;
-        unsigned char           services_loc;
-        unsigned char           info_rem;
-        unsigned char           info_loc;
-
-        unsigned short          segsize_rem;
-        unsigned short          segsize_loc;
-
-        unsigned char           nonagle;
-        unsigned char           multi_ireq;
-        unsigned char           accept_mode;
+        __u16           flowrem_dat;
+        __u16           flowrem_oth;
+        __u16           flowloc_dat;
+        __u16           flowloc_oth;
+        __u8            services_rem;
+        __u8            services_loc;
+        __u8            info_rem;
+        __u8            info_loc;
+
+        __u16           segsize_rem;
+        __u16           segsize_loc;
+
+        __u8            nonagle;
+        __u8            multi_ireq;
+        __u8            accept_mode;
         unsigned long           seg_total; /* Running total of current segment */
 
         struct optdata_dn     conndata_in;
@@ -160,40 +158,41 @@ static inline struct dn_scp *DN_SK(struct sock *sk)
  */
 #define DN_SKB_CB(skb) ((struct dn_skb_cb *)(skb)->cb)
 struct dn_skb_cb {
-        unsigned short dst;
-        unsigned short src;
-        unsigned short hops;
-        unsigned short dst_port;
-        unsigned short src_port;
-        unsigned char services;
-        unsigned char info;
-        unsigned char rt_flags;
-        unsigned char nsp_flags;
-        unsigned short segsize;
-        unsigned short segnum;
-        unsigned short xmit_count;
+        __le16 dst;
+        __le16 src;
+        __u16 hops;
+        __le16 dst_port;
+        __le16 src_port;
+        __u8 services;
+        __u8 info;
+        __u8 rt_flags;
+        __u8 nsp_flags;
+        __u16 segsize;
+        __u16 segnum;
+        __u16 xmit_count;
         unsigned long stamp;
         int iif;
 };
 
-static inline dn_address dn_eth2dn(unsigned char *ethaddr)
+static inline __le16 dn_eth2dn(unsigned char *ethaddr)
 {
-        return ethaddr[4] | (ethaddr[5] << 8);
+        return dn_htons(ethaddr[4] | (ethaddr[5] << 8));
 }
 
-static inline dn_address dn_saddr2dn(struct sockaddr_dn *saddr)
+static inline __le16 dn_saddr2dn(struct sockaddr_dn *saddr)
 {
-        return *(dn_address *)saddr->sdn_nodeaddr;
+        return *(__le16 *)saddr->sdn_nodeaddr;
 }
 
-static inline void dn_dn2eth(unsigned char *ethaddr, dn_address addr)
+static inline void dn_dn2eth(unsigned char *ethaddr, __le16 addr)
 {
+        __u16 a = dn_ntohs(addr);
         ethaddr[0] = 0xAA;
         ethaddr[1] = 0x00;
         ethaddr[2] = 0x04;
         ethaddr[3] = 0x00;
-        ethaddr[4] = (unsigned char)(addr & 0xff);
-        ethaddr[5] = (unsigned char)(addr >> 8);
+        ethaddr[4] = (__u8)(a & 0xff);
+        ethaddr[5] = (__u8)(a >> 8);
 }
 
 static inline void dn_sk_ports_copy(struct flowi *fl, struct dn_scp *scp)
@@ -202,7 +201,7 @@ static inline void dn_sk_ports_copy(struct flowi *fl, struct dn_scp *scp)
         fl->uli_u.dnports.dport = scp->addrrem;
         fl->uli_u.dnports.objnum = scp->addr.sdn_objnum;
         if (fl->uli_u.dnports.objnum == 0) {
-                fl->uli_u.dnports.objnamel = scp->addr.sdn_objnamel;
+                fl->uli_u.dnports.objnamel = (__u8)dn_ntohs(scp->addr.sdn_objnamel);
                 memcpy(fl->uli_u.dnports.objname, scp->addr.sdn_objname, 16);
         }
 }
@@ -217,7 +216,7 @@ extern unsigned dn_mss_from_pmtu(struct net_device *dev, int mtu);
 extern struct sock *dn_sklist_find_listener(struct sockaddr_dn *addr);
 extern struct sock *dn_find_by_skb(struct sk_buff *skb);
 #define DN_ASCBUF_LEN 9
-extern char *dn_addr2asc(dn_address, char *);
+extern char *dn_addr2asc(__u16, char *);
 extern int dn_destroy_timer(struct sock *sk);
 
 extern int dn_sockaddr2username(struct sockaddr_dn *addr, unsigned char *buf, unsigned char type);
@@ -226,7 +225,7 @@ extern int dn_username2sockaddr(unsigned char *data, int len, struct sockaddr_dn
 extern void dn_start_slow_timer(struct sock *sk);
 extern void dn_stop_slow_timer(struct sock *sk);
 
-extern dn_address decnet_address;
+extern __le16 decnet_address;
 extern int decnet_debug_level;
 extern int decnet_time_wait;
 extern int decnet_dn_count;
diff --git a/include/net/dn_dev.h b/include/net/dn_dev.h
index 5a86e78081bf..cee46821dc53 100644
--- a/include/net/dn_dev.h
+++ b/include/net/dn_dev.h
@@ -7,11 +7,11 @@ struct dn_dev;
 struct dn_ifaddr {
         struct dn_ifaddr *ifa_next;
         struct dn_dev    *ifa_dev;
-        dn_address       ifa_local;
-        dn_address       ifa_address;
-        unsigned char    ifa_flags;
-        unsigned char    ifa_scope;
-        char             ifa_label[IFNAMSIZ];
+        __le16            ifa_local;
+        __le16            ifa_address;
+        __u8              ifa_flags;
+        __u8              ifa_scope;
+        char              ifa_label[IFNAMSIZ];
 };
 
 #define DN_DEV_S_RU  0 /* Run - working normally   */
@@ -91,7 +91,7 @@ struct dn_dev {
         struct timer_list timer;
         unsigned long t3;
         struct neigh_parms *neigh_parms;
-        unsigned char addr[ETH_ALEN];
+        __u8 addr[ETH_ALEN];
         struct neighbour *router; /* Default router on circuit */
         struct neighbour *peer;   /* Peer on pointopoint links */
         unsigned long uptime;     /* Time device went up in jiffies */
@@ -99,56 +99,56 @@ struct dn_dev {
 
 struct dn_short_packet
 {
-        unsigned char   msgflg;
-        unsigned short  dstnode;
-        unsigned short  srcnode;
-        unsigned char   forward;
+        __u8    msgflg;
+        __le16 dstnode;
+        __le16 srcnode;
+        __u8   forward;
 } __attribute__((packed));
 
 struct dn_long_packet
 {
-        unsigned char   msgflg;
-        unsigned char   d_area;
-        unsigned char   d_subarea;
-        unsigned char   d_id[6];
-        unsigned char   s_area;
-        unsigned char   s_subarea;
-        unsigned char   s_id[6];
-        unsigned char   nl2;
-        unsigned char   visit_ct;
-        unsigned char   s_class;
-        unsigned char   pt;
+        __u8   msgflg;
+        __u8   d_area;
+        __u8   d_subarea;
+        __u8   d_id[6];
+        __u8   s_area;
+        __u8   s_subarea;
+        __u8   s_id[6];
+        __u8   nl2;
+        __u8   visit_ct;
+        __u8   s_class;
+        __u8   pt;
 } __attribute__((packed));
 
 /*------------------------- DRP - Routing messages ---------------------*/
 
 struct endnode_hello_message
 {
-        unsigned char   msgflg;
-        unsigned char   tiver[3];
-        unsigned char   id[6];
-        unsigned char   iinfo;
-        unsigned short  blksize;
-        unsigned char   area;
-        unsigned char   seed[8];
-        unsigned char   neighbor[6];
-        unsigned short  timer;
-        unsigned char   mpd;
-        unsigned char   datalen;
-        unsigned char   data[2];
+        __u8   msgflg;
+        __u8   tiver[3];
+        __u8   id[6];
+        __u8   iinfo;
+        __le16 blksize;
+        __u8   area;
+        __u8   seed[8];
+        __u8   neighbor[6];
+        __le16 timer;
+        __u8   mpd;
+        __u8   datalen;
+        __u8   data[2];
 } __attribute__((packed));
 
 struct rtnode_hello_message
 {
-        unsigned char   msgflg;
-        unsigned char   tiver[3];
-        unsigned char   id[6];
-        unsigned char   iinfo;
-        unsigned short  blksize;
-        unsigned char   priority;
-        unsigned char   area;
-        unsigned short  timer;
-        unsigned char   mpd;
+        __u8   msgflg;
+        __u8   tiver[3];
+        __u8   id[6];
+        __u8   iinfo;
+        __le16  blksize;
+        __u8   priority;
+        __u8   area;
+        __le16  timer;
+        __u8   mpd;
 } __attribute__((packed));
 
 
@@ -169,12 +169,12 @@ extern void dn_dev_down(struct net_device *);
 
 extern int dn_dev_set_default(struct net_device *dev, int force);
 extern struct net_device *dn_dev_get_default(void);
-extern int dn_dev_bind_default(dn_address *addr);
+extern int dn_dev_bind_default(__le16 *addr);
 
 extern int register_dnaddr_notifier(struct notifier_block *nb);
 extern int unregister_dnaddr_notifier(struct notifier_block *nb);
 
-static inline int dn_dev_islocal(struct net_device *dev, dn_address addr)
+static inline int dn_dev_islocal(struct net_device *dev, __le16 addr)
 {
         struct dn_dev *dn_db = dev->dn_ptr;
         struct dn_ifaddr *ifa;
diff --git a/include/net/dn_fib.h b/include/net/dn_fib.h
index cd3c96d9601b..a15dcf0d5c1e 100644
--- a/include/net/dn_fib.h
+++ b/include/net/dn_fib.h
@@ -37,7 +37,7 @@ struct dn_fib_nh {
         int                     nh_weight;
         int                     nh_power;
         int                     nh_oif;
-        u32                     nh_gw;
+        __le16                  nh_gw;
 };
 
 struct dn_fib_info {
@@ -48,7 +48,7 @@ struct dn_fib_info {
         int                     fib_dead;
         unsigned                fib_flags;
         int                     fib_protocol;
-        dn_address              fib_prefsrc;
+        __le16                  fib_prefsrc;
         __u32                   fib_priority;
         __u32                   fib_metrics[RTAX_MAX];
 #define dn_fib_mtu  fib_metrics[RTAX_MTU-1]
@@ -71,15 +71,15 @@ struct dn_fib_info {
 #define DN_FIB_RES_OIF(res)     (DN_FIB_RES_NH(res).nh_oif)
 
 typedef struct {
-        u16     datum;
+        __le16  datum;
 } dn_fib_key_t;
 
 typedef struct {
-        u16     datum;
+        __le16  datum;
 } dn_fib_hash_t;
 
 typedef struct {
-        u16     datum;
+        __u16   datum;
 } dn_fib_idx_t;
 
 struct dn_fib_node {
@@ -126,11 +126,11 @@ extern int dn_fib_semantic_match(int type, struct dn_fib_info *fi,
                         const struct flowi *fl,
                         struct dn_fib_res *res);
 extern void dn_fib_release_info(struct dn_fib_info *fi);
-extern u16 dn_fib_get_attr16(struct rtattr *attr, int attrlen, int type);
+extern __le16 dn_fib_get_attr16(struct rtattr *attr, int attrlen, int type);
 extern void dn_fib_flush(void);
 extern void dn_fib_select_multipath(const struct flowi *fl,
                                         struct dn_fib_res *res);
-extern int dn_fib_sync_down(dn_address local, struct net_device *dev, 
+extern int dn_fib_sync_down(__le16 local, struct net_device *dev,
                                 int force);
 extern int dn_fib_sync_up(struct net_device *dev);
 
@@ -148,8 +148,8 @@ extern void dn_fib_table_cleanup(void);
 extern void dn_fib_rules_init(void);
 extern void dn_fib_rules_cleanup(void);
 extern void dn_fib_rule_put(struct dn_fib_rule *);
-extern __u16 dn_fib_rules_policy(__u16 saddr, struct dn_fib_res *res, unsigned *flags);
-extern unsigned dnet_addr_type(__u16 addr);
+extern __le16 dn_fib_rules_policy(__le16 saddr, struct dn_fib_res *res, unsigned *flags);
+extern unsigned dnet_addr_type(__le16 addr);
 extern int dn_fib_lookup(const struct flowi *fl, struct dn_fib_res *res);
 
 /*
@@ -194,10 +194,10 @@ extern struct dn_fib_table *dn_fib_tables[];
 
 #endif /* CONFIG_DECNET_ROUTER */
 
-static inline u16 dnet_make_mask(int n)
+static inline __le16 dnet_make_mask(int n)
 {
         if (n)
-                return htons(~((1<<(16-n))-1));
+                return dn_htons(~((1<<(16-n))-1));
         return 0;
 }
 
diff --git a/include/net/dn_neigh.h b/include/net/dn_neigh.h
index 4b1eb038d637..4cb4ae7fb81f 100644
--- a/include/net/dn_neigh.h
+++ b/include/net/dn_neigh.h
@@ -7,13 +7,13 @@
  */
 struct dn_neigh {
         struct neighbour n;
-        dn_address addr;
+        __le16 addr;
         unsigned long flags;
 #define DN_NDFLAG_R1    0x0001 /* Router L1      */
 #define DN_NDFLAG_R2    0x0002 /* Router L2      */
 #define DN_NDFLAG_P3    0x0004 /* Phase III Node */
         unsigned long blksize;
-        unsigned char priority;
+        __u8 priority;
 };
 
 extern void dn_neigh_init(void);
diff --git a/include/net/dn_nsp.h b/include/net/dn_nsp.h
index e6182b86262b..96e816b6974d 100644
--- a/include/net/dn_nsp.h
+++ b/include/net/dn_nsp.h
@@ -72,77 +72,77 @@ extern struct sk_buff *dn_alloc_send_skb(struct sock *sk, size_t *size, int nobl
 
 struct nsp_data_seg_msg
 {
-        unsigned char   msgflg;
-        unsigned short  dstaddr;
-        unsigned short  srcaddr;
+        __u8   msgflg;
+        __le16 dstaddr;
+        __le16 srcaddr;
 } __attribute__((packed));
 
 struct nsp_data_opt_msg
 {
-        unsigned short  acknum;
-        unsigned short  segnum;
-        unsigned short  lsflgs;
+        __le16 acknum;
+        __le16 segnum;
+        __le16 lsflgs;
 } __attribute__((packed));
 
 struct nsp_data_opt_msg1
 {
-        unsigned short  acknum;
-        unsigned short  segnum;
+        __le16 acknum;
+        __le16 segnum;
 } __attribute__((packed));
 
 
 /* Acknowledgment Message (data/other data)                             */
 struct nsp_data_ack_msg
 {
-        unsigned char   msgflg;
-        unsigned short  dstaddr;
-        unsigned short  srcaddr;
-        unsigned short  acknum;
+        __u8   msgflg;
+        __le16 dstaddr;
+        __le16 srcaddr;
+        __le16 acknum;
 } __attribute__((packed));
 
 /* Connect Acknowledgment Message */
 struct  nsp_conn_ack_msg
 {
-        unsigned char   msgflg;
-        unsigned short  dstaddr;
+        __u8 msgflg;
+        __le16 dstaddr;
 } __attribute__((packed));
 
 
 /* Connect Initiate/Retransmit Initiate/Connect Confirm */
 struct  nsp_conn_init_msg
 {
-        unsigned char   msgflg;
+        __u8   msgflg;
 #define NSP_CI      0x18            /* Connect Initiate     */
 #define NSP_RCI     0x68            /* Retrans. Conn Init   */
-        unsigned short  dstaddr;
-        unsigned short  srcaddr;
-        unsigned char   services;
+        __le16 dstaddr;
+        __le16 srcaddr;
+        __u8   services;
 #define NSP_FC_NONE   0x00            /* Flow Control None    */
 #define NSP_FC_SRC    0x04            /* Seg Req. Count       */
 #define NSP_FC_SCMC   0x08            /* Sess. Control Mess   */
 #define NSP_FC_MASK   0x0c            /* FC type mask         */
-        unsigned char   info;
-        unsigned short  segsize;
+        __u8   info;
+        __le16 segsize;
 } __attribute__((packed));
 
 /* Disconnect Initiate/Disconnect Confirm */
 struct  nsp_disconn_init_msg
 {
-        unsigned char   msgflg;
-        unsigned short  dstaddr;
-        unsigned short  srcaddr;
-        unsigned short  reason;
+        __u8   msgflg;
+        __le16 dstaddr;
+        __le16 srcaddr;
+        __le16 reason;
 } __attribute__((packed));
 
 
 
 struct  srcobj_fmt
 {
-        char            format;
-        unsigned char   task;
-        unsigned short  grpcode;
-        unsigned short  usrcode;
-        char            dlen;
+        __u8   format;
+        __u8   task;
+        __le16 grpcode;
+        __le16 usrcode;
+        __u8   dlen;
 } __attribute__((packed));
 
 /*
@@ -150,7 +150,7 @@ struct  srcobj_fmt
  * numbers used in NSP. Similar in operation to the functions
  * of the same name in TCP.
  */
-static __inline__ int dn_before(unsigned short seq1, unsigned short seq2)
+static __inline__ int dn_before(__u16 seq1, __u16 seq2)
 {
         seq1 &= 0x0fff;
         seq2 &= 0x0fff;
@@ -159,7 +159,7 @@ static __inline__ int dn_before(unsigned short seq1, unsigned short seq2)
 }
 
 
-static __inline__ int dn_after(unsigned short seq1, unsigned short seq2)
+static __inline__ int dn_after(__u16 seq1, __u16 seq2)
 {
         seq1 &= 0x0fff;
         seq2 &= 0x0fff;
@@ -167,23 +167,23 @@ static __inline__ int dn_after(unsigned short seq1, unsigned short seq2)
         return (int)((seq2 - seq1) & 0x0fff) > 2048;
 }
 
-static __inline__ int dn_equal(unsigned short seq1, unsigned short seq2)
+static __inline__ int dn_equal(__u16 seq1, __u16 seq2)
 {
         return ((seq1 ^ seq2) & 0x0fff) == 0;
 }
 
-static __inline__ int dn_before_or_equal(unsigned short seq1, unsigned short seq2)
+static __inline__ int dn_before_or_equal(__u16 seq1, __u16 seq2)
 {
         return (dn_before(seq1, seq2) || dn_equal(seq1, seq2));
 }
 
-static __inline__ void seq_add(unsigned short *seq, unsigned short off)
+static __inline__ void seq_add(__u16 *seq, __u16 off)
 {
         (*seq) += off;
         (*seq) &= 0x0fff;
 }
 
-static __inline__ int seq_next(unsigned short seq1, unsigned short seq2)
+static __inline__ int seq_next(__u16 seq1, __u16 seq2)
 {
         return dn_equal(seq1 + 1, seq2);
 }
@@ -191,7 +191,7 @@ static __inline__ int seq_next(unsigned short seq1, unsigned short seq2)
 /*
  * Can we delay the ack ?
  */
-static __inline__ int sendack(unsigned short seq)
+static __inline__ int sendack(__u16 seq)
 {
         return (int)((seq & 0x1000) ? 0 : 1);
 }
diff --git a/include/net/dn_route.h b/include/net/dn_route.h
index 5122da3f2eb3..76f957e258b0 100644
--- a/include/net/dn_route.h
+++ b/include/net/dn_route.h
@@ -71,12 +71,12 @@ struct dn_route {
                 struct dn_route *rt_next;
         } u;
 
-        __u16 rt_saddr;
-        __u16 rt_daddr;
-        __u16 rt_gateway;
-        __u16 rt_local_src;     /* Source used for forwarding packets */
-        __u16 rt_src_map;
-        __u16 rt_dst_map;
+        __le16 rt_saddr;
+        __le16 rt_daddr;
+        __le16 rt_gateway;
+        __le16 rt_local_src;    /* Source used for forwarding packets */
+        __le16 rt_src_map;
+        __le16 rt_dst_map;
 
         unsigned rt_flags;
         unsigned rt_type;
diff --git a/include/net/flow.h b/include/net/flow.h
index ec7eb86eb203..04d89f763451 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -30,8 +30,8 @@ struct flowi {
                 } ip6_u;
 
                 struct {
-                        __u16                   daddr;
-                        __u16                   saddr;
+                        __le16                  daddr;
+                        __le16                  saddr;
                         __u32                   fwmark;
                         __u8                    scope;
                 } dn_u;
@@ -64,8 +64,8 @@ struct flowi {
                 } icmpt;
 
                 struct {
-                        __u16   sport;
-                        __u16   dport;
+                        __le16  sport;
+                        __le16  dport;
                         __u8    objnum;
                         __u8    objnamel; /* Not 16 bits since max val is 16 */
                         __u8    objname[16]; /* Not zero terminated */
diff --git a/include/net/ieee80211.h b/include/net/ieee80211.h
index 9a92aef8b0b2..4725ff861c57 100644
--- a/include/net/ieee80211.h
+++ b/include/net/ieee80211.h
@@ -220,6 +220,7 @@ struct ieee80211_snap_hdr {
 /* Authentication algorithms */
 #define WLAN_AUTH_OPEN 0
 #define WLAN_AUTH_SHARED_KEY 1
+#define WLAN_AUTH_LEAP 2
 
 #define WLAN_AUTH_CHALLENGE_LEN 128
 
@@ -299,6 +300,23 @@ enum ieee80211_reasoncode {
         WLAN_REASON_CIPHER_SUITE_REJECTED = 24,
 };
 
+/* Action categories - 802.11h */
+enum ieee80211_actioncategories {
+        WLAN_ACTION_SPECTRUM_MGMT = 0,
+        /* Reserved 1-127  */
+        /* Error    128-255 */
+};
+
+/* Action details - 802.11h */
+enum ieee80211_actiondetails {
+        WLAN_ACTION_CATEGORY_MEASURE_REQUEST = 0,
+        WLAN_ACTION_CATEGORY_MEASURE_REPORT = 1,
+        WLAN_ACTION_CATEGORY_TPC_REQUEST = 2,
+        WLAN_ACTION_CATEGORY_TPC_REPORT = 3,
+        WLAN_ACTION_CATEGORY_CHANNEL_SWITCH = 4,
+        /* 5 - 255 Reserved */
+};
+
 #define IEEE80211_STATMASK_SIGNAL (1<<0)
 #define IEEE80211_STATMASK_RSSI (1<<1)
 #define IEEE80211_STATMASK_NOISE (1<<2)
@@ -377,6 +395,8 @@ struct ieee80211_rx_stats {
         u8 mask;
         u8 freq;
         u16 len;
+        u64 tsf;
+        u32 beacon_time;
 };
 
 /* IEEE 802.11 requires that STA supports concurrent reception of at least
@@ -608,6 +628,28 @@ struct ieee80211_auth {
         struct ieee80211_info_element info_element[0];
 } __attribute__ ((packed));
 
+struct ieee80211_channel_switch {
+        u8 id;
+        u8 len;
+        u8 mode;
+        u8 channel;
+        u8 count;
+} __attribute__ ((packed));
+
+struct ieee80211_action {
+        struct ieee80211_hdr_3addr header;
+        u8 category;
+        u8 action;
+        union {
+                struct ieee80211_action_exchange {
+                        u8 token;
+                        struct ieee80211_info_element info_element[0];
+                } exchange;
+                struct ieee80211_channel_switch channel_switch;
+
+        } format;
+} __attribute__ ((packed));
+
 struct ieee80211_disassoc {
         struct ieee80211_hdr_3addr header;
         __le16 reason;
@@ -692,7 +734,15 @@ struct ieee80211_txb {
 /* QoS structure */
 #define NETWORK_HAS_QOS_PARAMETERS      (1<<3)
 #define NETWORK_HAS_QOS_INFORMATION     (1<<4)
-#define NETWORK_HAS_QOS_MASK            (NETWORK_HAS_QOS_PARAMETERS | NETWORK_HAS_QOS_INFORMATION)
+#define NETWORK_HAS_QOS_MASK            (NETWORK_HAS_QOS_PARAMETERS | \
+                                         NETWORK_HAS_QOS_INFORMATION)
+
+/* 802.11h */
+#define NETWORK_HAS_POWER_CONSTRAINT    (1<<5)
+#define NETWORK_HAS_CSA                 (1<<6)
+#define NETWORK_HAS_QUIET               (1<<7)
+#define NETWORK_HAS_IBSS_DFS            (1<<8)
+#define NETWORK_HAS_TPC_REPORT          (1<<9)
 
 #define QOS_QUEUE_NUM                   4
 #define QOS_OUI_LEN                     3
@@ -748,6 +798,91 @@ struct ieee80211_tim_parameters {
 
 /*******************************************************/
 
+enum {                          /* ieee80211_basic_report.map */
+        IEEE80211_BASIC_MAP_BSS = (1 << 0),
+        IEEE80211_BASIC_MAP_OFDM = (1 << 1),
+        IEEE80211_BASIC_MAP_UNIDENTIFIED = (1 << 2),
+        IEEE80211_BASIC_MAP_RADAR = (1 << 3),
+        IEEE80211_BASIC_MAP_UNMEASURED = (1 << 4),
+        /* Bits 5-7 are reserved */
+
+};
+struct ieee80211_basic_report {
+        u8 channel;
+        __le64 start_time;
+        __le16 duration;
+        u8 map;
+} __attribute__ ((packed));
+
+enum {                          /* ieee80211_measurement_request.mode */
+        /* Bit 0 is reserved */
+        IEEE80211_MEASUREMENT_ENABLE = (1 << 1),
+        IEEE80211_MEASUREMENT_REQUEST = (1 << 2),
+        IEEE80211_MEASUREMENT_REPORT = (1 << 3),
+        /* Bits 4-7 are reserved */
+};
+
+enum {
+        IEEE80211_REPORT_BASIC = 0,     /* required */
+        IEEE80211_REPORT_CCA = 1,       /* optional */
+        IEEE80211_REPORT_RPI = 2,       /* optional */
+        /* 3-255 reserved */
+};
+
+struct ieee80211_measurement_params {
+        u8 channel;
+        __le64 start_time;
+        __le16 duration;
+} __attribute__ ((packed));
+
+struct ieee80211_measurement_request {
+        struct ieee80211_info_element ie;
+        u8 token;
+        u8 mode;
+        u8 type;
+        struct ieee80211_measurement_params params[0];
+} __attribute__ ((packed));
+
+struct ieee80211_measurement_report {
+        struct ieee80211_info_element ie;
+        u8 token;
+        u8 mode;
+        u8 type;
+        union {
+                struct ieee80211_basic_report basic[0];
+        } u;
+} __attribute__ ((packed));
+
+struct ieee80211_tpc_report {
+        u8 transmit_power;
+        u8 link_margin;
+} __attribute__ ((packed));
+
+struct ieee80211_channel_map {
+        u8 channel;
+        u8 map;
+} __attribute__ ((packed));
+
+struct ieee80211_ibss_dfs {
+        struct ieee80211_info_element ie;
+        u8 owner[ETH_ALEN];
+        u8 recovery_interval;
+        struct ieee80211_channel_map channel_map[0];
+};
+
+struct ieee80211_csa {
+        u8 mode;
+        u8 channel;
+        u8 count;
+} __attribute__ ((packed));
+
+struct ieee80211_quiet {
+        u8 count;
+        u8 period;
+        u8 duration;
+        u8 offset;
+} __attribute__ ((packed));
+
 struct ieee80211_network {
         /* These entries are used to identify a unique network */
         u8 bssid[ETH_ALEN];
@@ -767,7 +902,7 @@ struct ieee80211_network {
         u8 rates_ex_len;
         unsigned long last_scanned;
         u8 mode;
-        u8 flags;
+        u32 flags;
         u32 last_associate;
         u32 time_stamp[2];
         u16 beacon_interval;
@@ -779,6 +914,25 @@ struct ieee80211_network {
         u8 rsn_ie[MAX_WPA_IE_LEN];
         size_t rsn_ie_len;
         struct ieee80211_tim_parameters tim;
+
+        /* 802.11h info */
+
+        /* Power Constraint - mandatory if spctrm mgmt required */
+        u8 power_constraint;
+
+        /* TPC Report - mandatory if spctrm mgmt required */
+        struct ieee80211_tpc_report tpc_report;
+
+        /* IBSS DFS - mandatory if spctrm mgmt required and IBSS
+         * NOTE: This is variable length and so must be allocated dynamically */
+        struct ieee80211_ibss_dfs *ibss_dfs;
+
+        /* Channel Switch Announcement - optional if spctrm mgmt required */
+        struct ieee80211_csa csa;
+
+        /* Quiet - optional if spctrm mgmt required */
+        struct ieee80211_quiet quiet;
+
         struct list_head list;
 };
 
@@ -924,7 +1078,10 @@ struct ieee80211_device {
         int (*handle_auth) (struct net_device * dev,
                             struct ieee80211_auth * auth);
         int (*handle_deauth) (struct net_device * dev,
-                              struct ieee80211_auth * auth);
+                              struct ieee80211_deauth * auth);
+        int (*handle_action) (struct net_device * dev,
+                              struct ieee80211_action * action,
+                              struct ieee80211_rx_stats * stats);
         int (*handle_disassoc) (struct net_device * dev,
                                 struct ieee80211_disassoc * assoc);
         int (*handle_beacon) (struct net_device * dev,
@@ -1093,6 +1250,7 @@ extern int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
 extern void ieee80211_rx_mgt(struct ieee80211_device *ieee,
                              struct ieee80211_hdr_4addr *header,
                              struct ieee80211_rx_stats *stats);
+extern void ieee80211_network_reset(struct ieee80211_network *network);
 
 /* ieee80211_geo.c */
 extern const struct ieee80211_geo *ieee80211_get_geo(struct ieee80211_device
@@ -1105,6 +1263,11 @@ extern int ieee80211_is_valid_channel(struct ieee80211_device *ieee,
 extern int ieee80211_channel_to_index(struct ieee80211_device *ieee,
                                       u8 channel);
 extern u8 ieee80211_freq_to_channel(struct ieee80211_device *ieee, u32 freq);
+extern u8 ieee80211_get_channel_flags(struct ieee80211_device *ieee,
+                                      u8 channel);
+extern const struct ieee80211_channel *ieee80211_get_channel(struct
+                                                             ieee80211_device
+                                                             *ieee, u8 channel);
 
 /* ieee80211_wx.c */
 extern int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
@@ -1122,6 +1285,14 @@ extern int ieee80211_wx_set_encodeext(struct ieee80211_device *ieee,
 extern int ieee80211_wx_get_encodeext(struct ieee80211_device *ieee,
                                       struct iw_request_info *info,
                                       union iwreq_data *wrqu, char *extra);
+extern int ieee80211_wx_set_auth(struct net_device *dev,
+                                 struct iw_request_info *info,
+                                 union iwreq_data *wrqu,
+                                 char *extra);
+extern int ieee80211_wx_get_auth(struct net_device *dev,
+                                 struct iw_request_info *info,
+                                 union iwreq_data *wrqu,
+                                 char *extra);
 
 static inline void ieee80211_increment_scans(struct ieee80211_device *ieee)
 {
diff --git a/include/net/ieee80211_crypt.h b/include/net/ieee80211_crypt.h
index cd82c3e998e4..eb476414fd72 100644
--- a/include/net/ieee80211_crypt.h
+++ b/include/net/ieee80211_crypt.h
@@ -47,7 +47,8 @@ struct ieee80211_crypto_ops {
         /* deinitialize crypto context and free allocated private data */
         void (*deinit) (void *priv);
 
-        int (*build_iv) (struct sk_buff * skb, int hdr_len, void *priv);
+        int (*build_iv) (struct sk_buff * skb, int hdr_len,
+                         u8 *key, int keylen, void *priv);
 
         /* encrypt/decrypt return < 0 on error or >= 0 on success. The return
          * value from decrypt_mpdu is passed as the keyidx value for
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index eb8afe3499a9..e459e1a0ae4a 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -180,11 +180,8 @@ struct inet6_dev
 
 #ifdef CONFIG_IPV6_PRIVACY
         u8                      rndid[8];
-        u8                      entropy[8];
         struct timer_list       regen_timer;
         struct inet6_ifaddr     *tempaddr_list;
-        __u8                    work_eui64[8];
-        __u8                    work_digest[16];
 #endif
 
         struct neigh_parms      *nd_parms;
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index fa587c94e9d0..9bf73fe50948 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -50,6 +50,12 @@ struct inet_connection_sock_af_ops {
                                   char __user *optval, int optlen);
         int         (*getsockopt)(struct sock *sk, int level, int optname, 
                                   char __user *optval, int __user *optlen);
+        int         (*compat_setsockopt)(struct sock *sk,
+                                int level, int optname,
+                                char __user *optval, int optlen);
+        int         (*compat_getsockopt)(struct sock *sk,
+                                int level, int optname,
+                                char __user *optval, int __user *optlen);
         void        (*addr2sockaddr)(struct sock *sk, struct sockaddr *);
         int sockaddr_len;
 };
@@ -72,6 +78,7 @@ struct inet_connection_sock_af_ops {
  * @icsk_probes_out:       unanswered 0 window probes
  * @icsk_ext_hdr_len:      Network protocol overhead (IP/IPv6 options)
  * @icsk_ack:              Delayed ACK control data
+ * @icsk_mtup;             MTU probing control data
  */
 struct inet_connection_sock {
         /* inet_sock has to be the first member! */
@@ -104,6 +111,16 @@ struct inet_connection_sock {
                 __u16             last_seg_size; /* Size of last incoming segment          */
                 __u16             rcv_mss;       /* MSS used for delayed ACK decisions     */ 
         } icsk_ack;
+        struct {
+                int               enabled;
+
+                /* Range of MTUs to search */
+                int               search_high;
+                int               search_low;
+
+                /* Information on the current probe. */
+                int               probe_size;
+        } icsk_mtup;
         u32                       icsk_ca_priv[16];
 #define ICSK_CA_PRIV_SIZE       (16 * sizeof(u32))
 };
@@ -310,4 +327,13 @@ extern void inet_csk_listen_stop(struct sock *sk);
 
 extern void inet_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr);
 
+extern int inet_csk_ctl_sock_create(struct socket **sock,
+                                    unsigned short family,
+                                    unsigned short type,
+                                    unsigned char protocol);
+
+extern int inet_csk_compat_getsockopt(struct sock *sk, int level, int optname,
+                                      char __user *optval, int __user *optlen);
+extern int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname,
+                                      char __user *optval, int optlen);
 #endif /* _INET_CONNECTION_SOCK_H */
diff --git a/include/net/ip.h b/include/net/ip.h
index fab3d5b3ab1c..8fe6156ca9b0 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -356,6 +356,10 @@ extern void	ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb);
 extern int      ip_cmsg_send(struct msghdr *msg, struct ipcm_cookie *ipc);
 extern int      ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval, int optlen);
 extern int      ip_getsockopt(struct sock *sk, int level, int optname, char __user *optval, int __user *optlen);
+extern int      compat_ip_setsockopt(struct sock *sk, int level,
+                        int optname, char __user *optval, int optlen);
+extern int      compat_ip_getsockopt(struct sock *sk, int level,
+                        int optname, char __user *optval, int __user *optlen);
 extern int      ip_ra_control(struct sock *sk, unsigned char on, void (*destructor)(struct sock *));
 
 extern int      ip_recv_error(struct sock *sk, struct msghdr *msg, int len);
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 1f2e428ca364..a398ae5e30f9 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -7,6 +7,23 @@
 #define IP6_RT_PRIO_KERN        512
 #define IP6_RT_FLOW_MASK        0x00ff
 
+struct route_info {
+        __u8                    type;
+        __u8                    length;
+        __u8                    prefix_len;
+#if defined(__BIG_ENDIAN_BITFIELD)
+        __u8                    reserved_h:3,
+                                route_pref:2,
+                                reserved_l:3;
+#elif defined(__LITTLE_ENDIAN_BITFIELD)
+        __u8                    reserved_l:3,
+                                route_pref:2,
+                                reserved_h:3;
+#endif
+        __u32                   lifetime;
+        __u8                    prefix[0];      /* 0,8 or 16 */
+};
+
 #ifdef __KERNEL__
 
 #include <net/flow.h>
@@ -87,11 +104,14 @@ extern struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
 extern struct rt6_info *        rt6_get_dflt_router(struct in6_addr *addr,
                                                     struct net_device *dev);
 extern struct rt6_info *        rt6_add_dflt_router(struct in6_addr *gwaddr,
-                                                    struct net_device *dev);
+                                                    struct net_device *dev,
+                                                    unsigned int pref);
 
 extern void                     rt6_purge_dflt_routers(void);
 
-extern void                     rt6_reset_dflt_pointer(struct rt6_info *rt);
+extern int                      rt6_route_rcv(struct net_device *dev,
+                                              u8 *opt, int len,
+                                              struct in6_addr *gwaddr);
 
 extern void                     rt6_redirect(struct in6_addr *dest,
                                              struct in6_addr *saddr,
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 3b1d963d396c..6d6f0634ae41 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -282,6 +282,18 @@ static inline int ipv6_addr_cmp(const struct in6_addr *a1, const struct in6_addr
         return memcmp((const void *) a1, (const void *) a2, sizeof(struct in6_addr));
 }
 
+static inline int
+ipv6_masked_addr_cmp(const struct in6_addr *a1, const struct in6_addr *m,
+                     const struct in6_addr *a2)
+{
+        unsigned int i;
+
+        for (i = 0; i < 4; i++)
+                if ((a1->s6_addr32[i] ^ a2->s6_addr32[i]) & m->s6_addr32[i])
+                        return 1;
+        return 0;
+}
+
 static inline void ipv6_addr_copy(struct in6_addr *a1, const struct in6_addr *a2)
 {
         memcpy((void *) a1, (const void *) a2, sizeof(struct in6_addr));
@@ -508,6 +520,16 @@ extern int			ipv6_getsockopt(struct sock *sk, int level,
                                                 int optname,
                                                 char __user *optval, 
                                                 int __user *optlen);
+extern int                      compat_ipv6_setsockopt(struct sock *sk,
+                                                int level,
+                                                int optname,
+                                                char __user *optval,
+                                                int optlen);
+extern int                      compat_ipv6_getsockopt(struct sock *sk,
+                                                int level,
+                                                int optname,
+                                                char __user *optval,
+                                                int __user *optlen);
 
 extern void                     ipv6_packet_init(void);
 
diff --git a/include/net/llc.h b/include/net/llc.h
index 1adb2ef3f6f7..f5024583fc8b 100644
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -71,7 +71,7 @@ extern int llc_rcv(struct sk_buff *skb, struct net_device *dev,
                    struct packet_type *pt, struct net_device *orig_dev);
 
 extern int llc_mac_hdr_init(struct sk_buff *skb,
-                            unsigned char *sa, unsigned char *da);
+                            const unsigned char *sa, const unsigned char *da);
 
 extern void llc_add_pack(int type, void (*handler)(struct llc_sap *sap,
                                                    struct sk_buff *skb));
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index bbac87eeb422..91fa271a0064 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -22,6 +22,8 @@ enum {
         ND_OPT_PREFIX_INFO = 3,         /* RFC2461 */
         ND_OPT_REDIRECT_HDR = 4,        /* RFC2461 */
         ND_OPT_MTU = 5,                 /* RFC2461 */
+        __ND_OPT_ARRAY_MAX,
+        ND_OPT_ROUTE_INFO = 24,         /* RFC4191 */
         __ND_OPT_MAX
 };
 
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 6fa9ae190741..b0666d66293f 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -68,6 +68,7 @@ struct neigh_parms
         struct net_device *dev;
         struct neigh_parms *next;
         int     (*neigh_setup)(struct neighbour *);
+        void    (*neigh_destructor)(struct neighbour *);
         struct neigh_table *tbl;
 
         void    *sysctl_table;
@@ -145,7 +146,6 @@ struct neighbour
 struct neigh_ops
 {
         int                     family;
-        void                    (*destructor)(struct neighbour *);
         void                    (*solicit)(struct neighbour *, struct sk_buff*);
         void                    (*error_report)(struct neighbour *, struct sk_buff*);
         int                     (*output)(struct sk_buff*);
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 6d075ca16e6e..2743c156caa0 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -67,6 +67,18 @@ do {									\
 
 struct nf_conntrack_helper;
 
+/* nf_conn feature for connections that have a helper */
+struct nf_conn_help {
+        /* Helper. if any */
+        struct nf_conntrack_helper *helper;
+
+        union nf_conntrack_help help;
+
+        /* Current number of expected connections */
+        unsigned int expecting;
+};
+
+
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 struct nf_conn
 {
@@ -81,6 +93,9 @@ struct nf_conn
         /* Have we seen traffic both ways yet? (bitset) */
         unsigned long status;
 
+        /* If we were expected by an expectation, this will be it */
+        struct nf_conn *master;
+
         /* Timer function; drops refcnt when it goes off. */
         struct timer_list timeout;
 
@@ -88,38 +103,22 @@ struct nf_conn
         /* Accounting Information (same cache line as other written members) */
         struct ip_conntrack_counter counters[IP_CT_DIR_MAX];
 #endif
-        /* If we were expected by an expectation, this will be it */
-        struct nf_conn *master;
-        
-        /* Current number of expected connections */
-        unsigned int expecting;
 
         /* Unique ID that identifies this conntrack*/
         unsigned int id;
 
-        /* Helper. if any */
-        struct nf_conntrack_helper *helper;
-
         /* features - nat, helper, ... used by allocating system */
         u_int32_t features;
 
-        /* Storage reserved for other modules: */
-
-        union nf_conntrack_proto proto;
-
 #if defined(CONFIG_NF_CONNTRACK_MARK)
         u_int32_t mark;
 #endif
 
-        /* These members are dynamically allocated. */
-
-        union nf_conntrack_help *help;
+        /* Storage reserved for other modules: */
+        union nf_conntrack_proto proto;
 
-        /* Layer 3 dependent members. (ex: NAT) */
-        union {
-                struct nf_conntrack_ipv4 *ipv4;
-        } l3proto;
-        void *data[0];
+        /* features dynamically at the end: helper, nat (both optional) */
+        char data[0];
 };
 
 struct nf_conntrack_expect
@@ -373,10 +372,23 @@ nf_conntrack_expect_event(enum ip_conntrack_expect_events event,
 #define NF_CT_F_NUM     4
 
 extern int
-nf_conntrack_register_cache(u_int32_t features, const char *name, size_t size,
-                            int (*init_conntrack)(struct nf_conn *, u_int32_t));
+nf_conntrack_register_cache(u_int32_t features, const char *name, size_t size);
 extern void
 nf_conntrack_unregister_cache(u_int32_t features);
 
+/* valid combinations:
+ * basic: nf_conn, nf_conn .. nf_conn_help
+ * nat: nf_conn .. nf_conn_nat, nf_conn .. nf_conn_nat, nf_conn help
+ */
+static inline struct nf_conn_help *nfct_help(const struct nf_conn *ct)
+{
+        unsigned int offset = sizeof(struct nf_conn);
+
+        if (!(ct->features & NF_CT_F_HELP))
+                return NULL;
+
+        return (struct nf_conn_help *) ((void *)ct + offset);
+}
+
 #endif /* __KERNEL__ */
 #endif /* _NF_CONNTRACK_H */
diff --git a/include/net/scm.h b/include/net/scm.h
index c3fa3d5ab606..540619cb7160 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -37,10 +37,12 @@ static __inline__ void scm_destroy(struct scm_cookie *scm)
 static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
                                struct scm_cookie *scm)
 {
-        memset(scm, 0, sizeof(*scm));
-        scm->creds.uid = current->uid;
-        scm->creds.gid = current->gid;
-        scm->creds.pid = current->tgid;
+        struct task_struct *p = current;
+        scm->creds.uid = p->uid;
+        scm->creds.gid = p->gid;
+        scm->creds.pid = p->tgid;
+        scm->fp = NULL;
+        scm->seq = 0;
         if (msg->msg_controllen <= 0)
                 return 0;
         return __scm_send(sock, msg, scm);
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 072f407848a6..eba99f375517 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -514,6 +514,16 @@ struct sctp_af {
                                          int optname,
                                          char __user *optval,
                                          int __user *optlen);
+        int             (*compat_setsockopt)    (struct sock *sk,
+                                         int level,
+                                         int optname,
+                                         char __user *optval,
+                                         int optlen);
+        int             (*compat_getsockopt)    (struct sock *sk,
+                                         int level,
+                                         int optname,
+                                         char __user *optval,
+                                         int __user *optlen);
         struct dst_entry *(*get_dst)    (struct sctp_association *asoc,
                                          union sctp_addr *daddr,
                                          union sctp_addr *saddr);
diff --git a/include/net/sock.h b/include/net/sock.h
index 30758035d616..ec226f31dc2a 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -478,9 +478,9 @@ static inline void sk_add_backlog(struct sock *sk, struct sk_buff *skb)
         rc = __condition;                                       \
         if (!rc) {                                              \
                 *(__timeo) = schedule_timeout(*(__timeo));      \
-                rc = __condition;                               \
         }                                                       \
         lock_sock(__sk);                                        \
+        rc = __condition;                                       \
         rc;                                                     \
 })
 
@@ -520,6 +520,14 @@ struct proto {
         int                     (*getsockopt)(struct sock *sk, int level, 
                                         int optname, char __user *optval, 
                                         int __user *option);     
+        int                     (*compat_setsockopt)(struct sock *sk,
+                                        int level,
+                                        int optname, char __user *optval,
+                                        int optlen);
+        int                     (*compat_getsockopt)(struct sock *sk,
+                                        int level,
+                                        int optname, char __user *optval,
+                                        int __user *option);
         int                     (*sendmsg)(struct kiocb *iocb, struct sock *sk,
                                            struct msghdr *msg, size_t len);
         int                     (*recvmsg)(struct kiocb *iocb, struct sock *sk,
@@ -816,6 +824,10 @@ extern int sock_common_recvmsg(struct kiocb *iocb, struct socket *sock,
                                struct msghdr *msg, size_t size, int flags);
 extern int sock_common_setsockopt(struct socket *sock, int level, int optname,
                                   char __user *optval, int optlen);
+extern int compat_sock_common_getsockopt(struct socket *sock, int level,
+                int optname, char __user *optval, int __user *optlen);
+extern int compat_sock_common_setsockopt(struct socket *sock, int level,
+                int optname, char __user *optval, int optlen);
 
 extern void sk_common_release(struct sock *sk);
 
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 77f21c65bbca..9418f4d1afbb 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -60,6 +60,9 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 /* Minimal RCV_MSS. */
 #define TCP_MIN_RCVMSS          536U
 
+/* The least MTU to use for probing */
+#define TCP_BASE_MSS            512
+
 /* After receiving this amount of duplicate ACKs fast retransmit starts. */
 #define TCP_FASTRETRANS_THRESH 3
 
@@ -219,6 +222,9 @@ extern int sysctl_tcp_nometrics_save;
 extern int sysctl_tcp_moderate_rcvbuf;
 extern int sysctl_tcp_tso_win_divisor;
 extern int sysctl_tcp_abc;
+extern int sysctl_tcp_mtu_probing;
+extern int sysctl_tcp_base_mss;
+extern int sysctl_tcp_workaround_signed_windows;
 
 extern atomic_t tcp_memory_allocated;
 extern atomic_t tcp_sockets_allocated;
@@ -347,6 +353,12 @@ extern int			tcp_getsockopt(struct sock *sk, int level,
 extern int                      tcp_setsockopt(struct sock *sk, int level, 
                                                int optname, char __user *optval, 
                                                int optlen);
+extern int                      compat_tcp_getsockopt(struct sock *sk,
+                                        int level, int optname,
+                                        char __user *optval, int __user *optlen);
+extern int                      compat_tcp_setsockopt(struct sock *sk,
+                                        int level, int optname,
+                                        char __user *optval, int optlen);
 extern void                     tcp_set_keepalive(struct sock *sk, int val);
 extern int                      tcp_recvmsg(struct kiocb *iocb, struct sock *sk,
                                             struct msghdr *msg,
@@ -447,6 +459,10 @@ extern int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
 
 extern void tcp_initialize_rcv_mss(struct sock *sk);
 
+extern int tcp_mtu_to_mss(struct sock *sk, int pmtu);
+extern int tcp_mss_to_mtu(struct sock *sk, int mss);
+extern void tcp_mtup_init(struct sock *sk);
+
 static inline void __tcp_fast_path_on(struct tcp_sock *tp, u32 snd_wnd)
 {
         tp->pred_flags = htonl((tp->tcp_header_len << 26) |
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 8d362c49b8a9..61b7504fc2ba 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -11,6 +11,7 @@
 #include <linux/crypto.h>
 #include <linux/pfkeyv2.h>
 #include <linux/in6.h>
+#include <linux/mutex.h>
 
 #include <net/sock.h>
 #include <net/dst.h>
@@ -20,7 +21,11 @@
 
 #define XFRM_ALIGN8(len)        (((len) + 7) & ~7)
 
-extern struct semaphore xfrm_cfg_sem;
+extern struct sock *xfrm_nl;
+extern u32 sysctl_xfrm_aevent_etime;
+extern u32 sysctl_xfrm_aevent_rseqth;
+
+extern struct mutex xfrm_cfg_mutex;
 
 /* Organization of SPD aka "XFRM rules"
    ------------------------------------
@@ -135,6 +140,16 @@ struct xfrm_state
         /* State for replay detection */
         struct xfrm_replay_state replay;
 
+        /* Replay detection state at the time we sent the last notification */
+        struct xfrm_replay_state preplay;
+
+        /* Replay detection notification settings */
+        u32                     replay_maxage;
+        u32                     replay_maxdiff;
+
+        /* Replay detection notification timer */
+        struct timer_list       rtimer;
+
         /* Statistics */
         struct xfrm_stats       stats;
 
@@ -169,6 +184,7 @@ struct km_event
                 u32 hard;
                 u32 proto;
                 u32 byid;
+                u32 aevent;
         } data;
 
         u32     seq;
@@ -199,10 +215,13 @@ extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
 extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
 extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c);
 extern void km_state_notify(struct xfrm_state *x, struct km_event *c);
-
 #define XFRM_ACQ_EXPIRES        30
 
 struct xfrm_tmpl;
+extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
+extern void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
+extern int __xfrm_state_delete(struct xfrm_state *x);
+
 struct xfrm_state_afinfo {
         unsigned short          family;
         rwlock_t                lock;
@@ -305,7 +324,21 @@ struct xfrm_policy
         struct xfrm_tmpl        xfrm_vec[XFRM_MAX_DEPTH];
 };
 
-#define XFRM_KM_TIMEOUT         30
+#define XFRM_KM_TIMEOUT                30
+/* which seqno */
+#define XFRM_REPLAY_SEQ         1
+#define XFRM_REPLAY_OSEQ        2
+#define XFRM_REPLAY_SEQ_MASK    3
+/* what happened */
+#define XFRM_REPLAY_UPDATE      XFRM_AE_CR
+#define XFRM_REPLAY_TIMEOUT     XFRM_AE_CE
+
+/* default aevent timeout in units of 100ms */
+#define XFRM_AE_ETIME                   10
+/* Async Event timer multiplier */
+#define XFRM_AE_ETH_M                   10
+/* default seq threshold size */
+#define XFRM_AE_SEQT_SIZE               2
 
 struct xfrm_mgr
 {
@@ -865,6 +898,7 @@ extern int xfrm_state_delete(struct xfrm_state *x);
 extern void xfrm_state_flush(u8 proto);
 extern int xfrm_replay_check(struct xfrm_state *x, u32 seq);
 extern void xfrm_replay_advance(struct xfrm_state *x, u32 seq);
+extern void xfrm_replay_notify(struct xfrm_state *x, int event);
 extern int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
 extern int xfrm_init_state(struct xfrm_state *x);
@@ -924,7 +958,7 @@ extern void xfrm_init_pmtu(struct dst_entry *dst);
 
 extern wait_queue_head_t km_waitq;
 extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);
-extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard);
+extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid);
 
 extern void xfrm_input_init(void);
 extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq);
@@ -965,4 +999,24 @@ static inline int xfrm_policy_id2dir(u32 index)
         return index & 7;
 }
 
+static inline int xfrm_aevent_is_on(void)
+{
+        struct sock *nlsk;
+        int ret = 0;
+
+        rcu_read_lock();
+        nlsk = rcu_dereference(xfrm_nl);
+        if (nlsk)
+                ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
+        rcu_read_unlock();
+        return ret;
+}
+
+static inline void xfrm_aevent_doreplay(struct xfrm_state *x)
+{
+        if (xfrm_aevent_is_on())
+                xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
+}
+
+
 #endif  /* _NET_XFRM_H */
diff --git a/include/rdma/ib_fmr_pool.h b/include/rdma/ib_fmr_pool.h
index 86b7e93f198b..4ace54cd0cce 100644
--- a/include/rdma/ib_fmr_pool.h
+++ b/include/rdma/ib_fmr_pool.h
@@ -43,6 +43,7 @@ struct ib_fmr_pool;
 /**
  * struct ib_fmr_pool_param - Parameters for creating FMR pool
  * @max_pages_per_fmr:Maximum number of pages per map request.
+ * @page_shift: Log2 of sizeof "pages" mapped by this fmr
  * @access:Access flags for FMRs in pool.
  * @pool_size:Number of FMRs to allocate for pool.
  * @dirty_watermark:Flush is triggered when @dirty_watermark dirty
@@ -55,6 +56,7 @@ struct ib_fmr_pool;
  */
 struct ib_fmr_pool_param {
         int                     max_pages_per_fmr;
+        int                     page_shift;
         enum ib_access_flags    access;
         int                     pool_size;
         int                     dirty_watermark;
diff --git a/include/rdma/ib_mad.h b/include/rdma/ib_mad.h
index 2c133506742b..51ab8eddb295 100644
--- a/include/rdma/ib_mad.h
+++ b/include/rdma/ib_mad.h
@@ -33,7 +33,7 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  *
- * $Id: ib_mad.h 2775 2005-07-02 13:42:12Z halr $
+ * $Id: ib_mad.h 5596 2006-03-03 01:00:07Z sean.hefty $
  */
 
 #if !defined( IB_MAD_H )
@@ -208,15 +208,23 @@ struct ib_class_port_info
 /**
  * ib_mad_send_buf - MAD data buffer and work request for sends.
  * @next: A pointer used to chain together MADs for posting.
- * @mad: References an allocated MAD data buffer.
+ * @mad: References an allocated MAD data buffer for MADs that do not have
+ *   RMPP active.  For MADs using RMPP, references the common and management
+ *   class specific headers.
  * @mad_agent: MAD agent that allocated the buffer.
  * @ah: The address handle to use when sending the MAD.
  * @context: User-controlled context fields.
+ * @hdr_len: Indicates the size of the data header of the MAD.  This length
+ *   includes the common MAD, RMPP, and class specific headers.
+ * @data_len: Indicates the total size of user-transferred data.
+ * @seg_count: The number of RMPP segments allocated for this send.
+ * @seg_size: Size of each RMPP segment.
  * @timeout_ms: Time to wait for a response.
  * @retries: Number of times to retry a request for a response.
  *
  * Users are responsible for initializing the MAD buffer itself, with the
- * exception of specifying the payload length field in any RMPP MAD.
+ * exception of any RMPP header.  Additional segment buffer space allocated
+ * beyond data_len is padding.
  */
 struct ib_mad_send_buf {
         struct ib_mad_send_buf  *next;
@@ -224,6 +232,10 @@ struct ib_mad_send_buf {
         struct ib_mad_agent     *mad_agent;
         struct ib_ah            *ah;
         void                    *context[2];
+        int                     hdr_len;
+        int                     data_len;
+        int                     seg_count;
+        int                     seg_size;
         int                     timeout_ms;
         int                     retries;
 };
@@ -299,7 +311,7 @@ typedef void (*ib_mad_snoop_handler)(struct ib_mad_agent *mad_agent,
  * @mad_recv_wc: Received work completion information on the received MAD.
  *
  * MADs received in response to a send request operation will be handed to
- * the user after the send operation completes.  All data buffers given
+ * the user before the send operation completes.  All data buffers given
  * to registered agents through this routine are owned by the receiving
  * client, except for snooping agents.  Clients snooping MADs should not
  * modify the data referenced by @mad_recv_wc.
@@ -485,17 +497,6 @@ int ib_unregister_mad_agent(struct ib_mad_agent *mad_agent);
 int ib_post_send_mad(struct ib_mad_send_buf *send_buf,
                      struct ib_mad_send_buf **bad_send_buf);
 
-/**
- * ib_coalesce_recv_mad - Coalesces received MAD data into a single buffer.
- * @mad_recv_wc: Work completion information for a received MAD.
- * @buf: User-provided data buffer to receive the coalesced buffers.  The
- *   referenced buffer should be at least the size of the mad_len specified
- *   by @mad_recv_wc.
- *
- * This call copies a chain of received MAD segments into a single data buffer,
- * removing duplicated headers.
- */
-void ib_coalesce_recv_mad(struct ib_mad_recv_wc *mad_recv_wc, void *buf);
 
 /**
  * ib_free_recv_mad - Returns data buffers used to receive a MAD.
@@ -590,9 +591,10 @@ int ib_process_mad_wc(struct ib_mad_agent *mad_agent,
  * with an initialized work request structure.  Users may modify the returned
  * MAD data buffer before posting the send.
  *
- * The returned data buffer will be cleared.  Users are responsible for
- * initializing the common MAD and any class specific headers.  If @rmpp_active
- * is set, the RMPP header will be initialized for sending.
+ * The returned MAD header, class specific headers, and any padding will be
+ * cleared.  Users are responsible for initializing the common MAD header,
+ * any class specific header, and MAD data area.
+ * If @rmpp_active is set, the RMPP header will be initialized for sending.
  */
 struct ib_mad_send_buf * ib_create_send_mad(struct ib_mad_agent *mad_agent,
                                             u32 remote_qpn, u16 pkey_index,
@@ -601,6 +603,16 @@ struct ib_mad_send_buf * ib_create_send_mad(struct ib_mad_agent *mad_agent,
                                             gfp_t gfp_mask);
 
 /**
+ * ib_get_rmpp_segment - returns the data buffer for a given RMPP segment.
+ * @send_buf: Previously allocated send data buffer.
+ * @seg_num: number of segment to return
+ *
+ * This routine returns a pointer to the data buffer of an RMPP MAD.
+ * Users must provide synchronization to @send_buf around this call.
+ */
+void *ib_get_rmpp_segment(struct ib_mad_send_buf *send_buf, int seg_num);
+
+/**
  * ib_free_send_mad - Returns data buffers used to send a MAD.
  * @send_buf: Previously allocated send data buffer.
  */
diff --git a/include/rdma/ib_user_verbs.h b/include/rdma/ib_user_verbs.h
index 5ff1490c08db..338ed4333063 100644
--- a/include/rdma/ib_user_verbs.h
+++ b/include/rdma/ib_user_verbs.h
@@ -1,7 +1,8 @@
 /*
  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
- * Copyright (c) 2005 Cisco Systems.  All rights reserved.
+ * Copyright (c) 2005, 2006 Cisco Systems.  All rights reserved.
  * Copyright (c) 2005 PathScale, Inc.  All rights reserved.
+ * Copyright (c) 2006 Mellanox Technologies.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -43,7 +44,7 @@
  * Increment this value if any changes that break userspace ABI
  * compatibility are made.
  */
-#define IB_USER_VERBS_ABI_VERSION       4
+#define IB_USER_VERBS_ABI_VERSION       6
 
 enum {
         IB_USER_VERBS_CMD_GET_CONTEXT,
@@ -265,6 +266,17 @@ struct ib_uverbs_create_cq_resp {
         __u32 cqe;
 };
 
+struct ib_uverbs_resize_cq {
+        __u64 response;
+        __u32 cq_handle;
+        __u32 cqe;
+        __u64 driver_data[0];
+};
+
+struct ib_uverbs_resize_cq_resp {
+        __u32 cqe;
+};
+
 struct ib_uverbs_poll_cq {
         __u64 response;
         __u32 cq_handle;
@@ -338,6 +350,7 @@ struct ib_uverbs_create_qp_resp {
         __u32 max_send_sge;
         __u32 max_recv_sge;
         __u32 max_inline_data;
+        __u32 reserved;
 };
 
 /*
@@ -359,6 +372,47 @@ struct ib_uverbs_qp_dest {
         __u8  port_num;
 };
 
+struct ib_uverbs_query_qp {
+        __u64 response;
+        __u32 qp_handle;
+        __u32 attr_mask;
+        __u64 driver_data[0];
+};
+
+struct ib_uverbs_query_qp_resp {
+        struct ib_uverbs_qp_dest dest;
+        struct ib_uverbs_qp_dest alt_dest;
+        __u32 max_send_wr;
+        __u32 max_recv_wr;
+        __u32 max_send_sge;
+        __u32 max_recv_sge;
+        __u32 max_inline_data;
+        __u32 qkey;
+        __u32 rq_psn;
+        __u32 sq_psn;
+        __u32 dest_qp_num;
+        __u32 qp_access_flags;
+        __u16 pkey_index;
+        __u16 alt_pkey_index;
+        __u8  qp_state;
+        __u8  cur_qp_state;
+        __u8  path_mtu;
+        __u8  path_mig_state;
+        __u8  en_sqd_async_notify;
+        __u8  max_rd_atomic;
+        __u8  max_dest_rd_atomic;
+        __u8  min_rnr_timer;
+        __u8  port_num;
+        __u8  timeout;
+        __u8  retry_cnt;
+        __u8  rnr_retry;
+        __u8  alt_port_num;
+        __u8  alt_timeout;
+        __u8  sq_sig_all;
+        __u8  reserved[5];
+        __u64 driver_data[0];
+};
+
 struct ib_uverbs_modify_qp {
         struct ib_uverbs_qp_dest dest;
         struct ib_uverbs_qp_dest alt_dest;
@@ -415,7 +469,7 @@ struct ib_uverbs_sge {
 };
 
 struct ib_uverbs_send_wr {
-        __u64 wr_id; 
+        __u64 wr_id;
         __u32 num_sge;
         __u32 opcode;
         __u32 send_flags;
@@ -489,7 +543,7 @@ struct ib_uverbs_post_srq_recv_resp {
 
 struct ib_uverbs_global_route {
         __u8  dgid[16];
-        __u32 flow_label;    
+        __u32 flow_label;
         __u8  sgid_index;
         __u8  hop_limit;
         __u8  traffic_class;
@@ -551,6 +605,9 @@ struct ib_uverbs_create_srq {
 
 struct ib_uverbs_create_srq_resp {
         __u32 srq_handle;
+        __u32 max_wr;
+        __u32 max_sge;
+        __u32 reserved;
 };
 
 struct ib_uverbs_modify_srq {
@@ -561,6 +618,20 @@ struct ib_uverbs_modify_srq {
         __u64 driver_data[0];
 };
 
+struct ib_uverbs_query_srq {
+        __u64 response;
+        __u32 srq_handle;
+        __u32 reserved;
+        __u64 driver_data[0];
+};
+
+struct ib_uverbs_query_srq_resp {
+        __u32 max_wr;
+        __u32 max_sge;
+        __u32 srq_limit;
+        __u32 reserved;
+};
+
 struct ib_uverbs_destroy_srq {
         __u64 response;
         __u32 srq_handle;
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 22fc886b9695..c1ad6273ac6c 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -5,7 +5,7 @@
  * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
  * Copyright (c) 2004 Voltaire Corporation.  All rights reserved.
  * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
- * Copyright (c) 2005 Cisco Systems.  All rights reserved.
+ * Copyright (c) 2005, 2006 Cisco Systems.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -222,11 +222,13 @@ struct ib_port_attr {
 };
 
 enum ib_device_modify_flags {
-        IB_DEVICE_MODIFY_SYS_IMAGE_GUID = 1
+        IB_DEVICE_MODIFY_SYS_IMAGE_GUID = 1 << 0,
+        IB_DEVICE_MODIFY_NODE_DESC      = 1 << 1
 };
 
 struct ib_device_modify {
         u64     sys_image_guid;
+        char    node_desc[64];
 };
 
 enum ib_port_modify_flags {
@@ -649,7 +651,7 @@ struct ib_mw_bind {
 struct ib_fmr_attr {
         int     max_pages;
         int     max_maps;
-        u8      page_size;
+        u8      page_shift;
 };
 
 struct ib_ucontext {
@@ -880,7 +882,8 @@ struct ib_device {
                                                 struct ib_ucontext *context,
                                                 struct ib_udata *udata);
         int                        (*destroy_cq)(struct ib_cq *cq);
-        int                        (*resize_cq)(struct ib_cq *cq, int cqe);
+        int                        (*resize_cq)(struct ib_cq *cq, int cqe,
+                                                struct ib_udata *udata);
         int                        (*poll_cq)(struct ib_cq *cq, int num_entries,
                                               struct ib_wc *wc);
         int                        (*peek_cq)(struct ib_cq *cq, int wc_cnt);
@@ -950,6 +953,7 @@ struct ib_device {
         u64                          uverbs_cmd_mask;
         int                          uverbs_abi_ver;
 
+        char                         node_desc[64];
         __be64                       node_guid;
         u8                           node_type;
         u8                           phys_port_cnt;
@@ -986,6 +990,24 @@ static inline int ib_copy_to_udata(struct ib_udata *udata, void *src, size_t len
         return copy_to_user(udata->outbuf, src, len) ? -EFAULT : 0;
 }
 
+/**
+ * ib_modify_qp_is_ok - Check that the supplied attribute mask
+ * contains all required attributes and no attributes not allowed for
+ * the given QP state transition.
+ * @cur_state: Current QP state
+ * @next_state: Next QP state
+ * @type: QP type
+ * @mask: Mask of supplied QP attributes
+ *
+ * This function is a helper function that a low-level driver's
+ * modify_qp method can use to validate the consumer's input.  It
+ * checks that cur_state and next_state are valid QP states, that a
+ * transition from cur_state to next_state is allowed by the IB spec,
+ * and that the attribute mask supplied is allowed for the transition.
+ */
+int ib_modify_qp_is_ok(enum ib_qp_state cur_state, enum ib_qp_state next_state,
+                       enum ib_qp_type type, enum ib_qp_attr_mask mask);
+
 int ib_register_event_handler  (struct ib_event_handler *event_handler);
 int ib_unregister_event_handler(struct ib_event_handler *event_handler);
 void ib_dispatch_event(struct ib_event *event);
@@ -1078,7 +1100,9 @@ int ib_destroy_ah(struct ib_ah *ah);
  * ib_create_srq - Creates a SRQ associated with the specified protection
  *   domain.
  * @pd: The protection domain associated with the SRQ.
- * @srq_init_attr: A list of initial attributes required to create the SRQ.
+ * @srq_init_attr: A list of initial attributes required to create the
+ *   SRQ.  If SRQ creation succeeds, then the attributes are updated to
+ *   the actual capabilities of the created SRQ.
  *
  * srq_attr->max_wr and srq_attr->max_sge are read the determine the
  * requested size of the SRQ, and set to the actual values allocated
@@ -1137,7 +1161,9 @@ static inline int ib_post_srq_recv(struct ib_srq *srq,
  * ib_create_qp - Creates a QP associated with the specified protection
  *   domain.
  * @pd: The protection domain associated with the QP.
- * @qp_init_attr: A list of initial attributes required to create the QP.
+ * @qp_init_attr: A list of initial attributes required to create the
+ *   QP.  If QP creation succeeds, then the attributes are updated to
+ *   the actual capabilities of the created QP.
  */
 struct ib_qp *ib_create_qp(struct ib_pd *pd,
                            struct ib_qp_init_attr *qp_init_attr);
diff --git a/include/scsi/scsi_eh.h b/include/scsi/scsi_eh.h
index fabd879c2f2e..d160880b2a87 100644
--- a/include/scsi/scsi_eh.h
+++ b/include/scsi/scsi_eh.h
@@ -35,6 +35,9 @@ static inline int scsi_sense_valid(struct scsi_sense_hdr *sshdr)
 }
 
 
+extern void scsi_eh_finish_cmd(struct scsi_cmnd *scmd,
+                               struct list_head *done_q);
+extern void scsi_eh_flush_done_q(struct list_head *done_q);
 extern void scsi_report_bus_reset(struct Scsi_Host *, int);
 extern void scsi_report_device_reset(struct Scsi_Host *, int, int);
 extern int scsi_block_when_processing_errors(struct scsi_device *);