Merge branch 'upstream' into max-sect

78 files changed, 1535 insertions, 286 deletions

diff --git a/include/asm-i386/atomic.h b/include/asm-i386/atomic.h
index 22d80ece95cb..4ddce5296a78 100644
--- a/include/asm-i386/atomic.h
+++ b/include/asm-i386/atomic.h
@@ -183,6 +183,7 @@ static __inline__ int atomic_add_return(int i, atomic_t *v)
 {
         int __i;
 #ifdef CONFIG_M386
+        unsigned long flags;
         if(unlikely(boot_cpu_data.x86==3))
                 goto no_xadd;
 #endif
@@ -196,10 +197,10 @@ static __inline__ int atomic_add_return(int i, atomic_t *v)
 
 #ifdef CONFIG_M386
 no_xadd: /* Legacy 386 processor */
-        local_irq_disable();
+        local_irq_save(flags);
         __i = atomic_read(v);
         atomic_set(v, i + __i);
-        local_irq_enable();
+        local_irq_restore(flags);
         return i + __i;
 #endif
 }
diff --git a/include/asm-i386/cpufeature.h b/include/asm-i386/cpufeature.h
index 5c0b5876b931..b44bfc6239cb 100644
--- a/include/asm-i386/cpufeature.h
+++ b/include/asm-i386/cpufeature.h
@@ -71,6 +71,7 @@
 #define X86_FEATURE_P4          (3*32+ 7) /* P4 */
 #define X86_FEATURE_CONSTANT_TSC (3*32+ 8) /* TSC ticks at a constant rate */
 #define X86_FEATURE_UP          (3*32+ 9) /* smp kernel running on up */
+#define X86_FEATURE_FXSAVE_LEAK (3*32+10) /* FXSAVE leaks FOP/FIP/FOP */
 
 /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */
 #define X86_FEATURE_XMM3        (4*32+ 0) /* Streaming SIMD Extensions-3 */
diff --git a/include/asm-i386/i387.h b/include/asm-i386/i387.h
index 152d0baa576a..7b1f01191e70 100644
--- a/include/asm-i386/i387.h
+++ b/include/asm-i386/i387.h
@@ -13,6 +13,7 @@
 
 #include <linux/sched.h>
 #include <linux/init.h>
+#include <linux/kernel_stat.h>
 #include <asm/processor.h>
 #include <asm/sigcontext.h>
 #include <asm/user.h>
@@ -38,17 +39,38 @@ extern void init_fpu(struct task_struct *);
 extern void kernel_fpu_begin(void);
 #define kernel_fpu_end() do { stts(); preempt_enable(); } while(0)
 
+/* We need a safe address that is cheap to find and that is already
+   in L1 during context switch. The best choices are unfortunately
+   different for UP and SMP */
+#ifdef CONFIG_SMP
+#define safe_address (__per_cpu_offset[0])
+#else
+#define safe_address (kstat_cpu(0).cpustat.user)
+#endif
+
 /*
  * These must be called with preempt disabled
  */
 static inline void __save_init_fpu( struct task_struct *tsk )
 {
+        /* Use more nops than strictly needed in case the compiler
+           varies code */
         alternative_input(
-                "fnsave %1 ; fwait ;" GENERIC_NOP2,
-                "fxsave %1 ; fnclex",
+                "fnsave %[fx] ;fwait;" GENERIC_NOP8 GENERIC_NOP4,
+                "fxsave %[fx]\n"
+                "bt $7,%[fsw] ; jc 1f ; fnclex\n1:",
                 X86_FEATURE_FXSR,
-                "m" (tsk->thread.i387.fxsave)
-                :"memory");
+                [fx] "m" (tsk->thread.i387.fxsave),
+                [fsw] "m" (tsk->thread.i387.fxsave.swd) : "memory");
+        /* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception
+           is pending.  Clear the x87 state here by setting it to fixed
+           values. __per_cpu_offset[0] is a random variable that should be in L1 */
+        alternative_input(
+                GENERIC_NOP8 GENERIC_NOP2,
+                "emms\n\t"              /* clear stack tags */
+                "fildl %[addr]",        /* set F?P to defined value */
+                X86_FEATURE_FXSAVE_LEAK,
+                [addr] "m" (safe_address));
         task_thread_info(tsk)->status &= ~TS_USEDFPU;
 }
 
diff --git a/include/asm-i386/unistd.h b/include/asm-i386/unistd.h
index d81d6cfc1bb4..eb4b152c82fc 100644
--- a/include/asm-i386/unistd.h
+++ b/include/asm-i386/unistd.h
@@ -321,8 +321,9 @@
 #define __NR_splice             313
 #define __NR_sync_file_range    314
 #define __NR_tee                315
+#define __NR_vmsplice           316
 
-#define NR_syscalls 316
+#define NR_syscalls 317
 
 /*
  * user-visible error numbers are in the range -1 - -128: see
diff --git a/include/asm-ia64/unistd.h b/include/asm-ia64/unistd.h
index a40ebec6aeeb..7107763168bf 100644
--- a/include/asm-ia64/unistd.h
+++ b/include/asm-ia64/unistd.h
@@ -290,12 +290,13 @@
 #define __NR_get_robust_list            1299
 #define __NR_sync_file_range            1300
 #define __NR_tee                        1301
+#define __NR_vmsplice                   1302
 
 #ifdef __KERNEL__
 
 #include <linux/config.h>
 
-#define NR_syscalls                     278 /* length of syscall table */
+#define NR_syscalls                     279 /* length of syscall table */
 
 #define __ARCH_WANT_SYS_RT_SIGACTION
 
diff --git a/include/asm-m32r/assembler.h b/include/asm-m32r/assembler.h
index b7f4d8aaeb46..1a1aa17edd33 100644
--- a/include/asm-m32r/assembler.h
+++ b/include/asm-m32r/assembler.h
@@ -109,6 +109,9 @@
         push    r13
         mvfachi r13
         push    r13
+        ldi     r13, #0
+        push    r13             ; dummy push acc1h
+        push    r13             ; dummy push acc1l
 #else
 #error unknown isa configuration
 #endif
@@ -156,6 +159,8 @@
         pop     r13
         mvtaclo r13, a1
 #elif defined(CONFIG_ISA_M32R2) || defined(CONFIG_ISA_M32R)
+        pop     r13             ; dummy pop acc1h
+        pop     r13             ; dummy pop acc1l
         pop     r13
         mvtachi r13
         pop     r13
diff --git a/include/asm-m32r/mappi3/mappi3_pld.h b/include/asm-m32r/mappi3/mappi3_pld.h
index 1d3c25d61bcb..031369a7afc8 100644
--- a/include/asm-m32r/mappi3/mappi3_pld.h
+++ b/include/asm-m32r/mappi3/mappi3_pld.h
@@ -53,16 +53,14 @@
 /* Power Control of MMC and CF */
 #define PLD_CPCR                __reg16(PLD_BASE + 0x14000)
 
-
-/*==== ICU ====*/
-#define  M32R_IRQ_PC104        (5)   /* INT4(PC/104) */
-#define  M32R_IRQ_I2C          (28)  /* I2C-BUS     */
-#define  PLD_IRQ_CFIREQ       (6)  /* INT5 CFC Card Interrupt */
-#define  PLD_IRQ_CFC_INSERT   (7)  /* INT6 CFC Card Insert */
-#define  PLD_IRQ_IDEIREQ      (8)  /* INT7 IDE Interrupt   */
-#define  PLD_IRQ_MMCCARD      (43)  /* MMC Card Insert */
-#define  PLD_IRQ_MMCIRQ       (44)  /* MMC Transfer Done */
-
+/* ICU */
+#define M32R_IRQ_PC104          (5)     /* INT4(PC/104) */
+#define M32R_IRQ_I2C            (28)    /* I2C-BUS */
+#define PLD_IRQ_CFIREQ          (6)     /* INT5 CFC Card Interrupt */
+#define PLD_IRQ_CFC_INSERT      (7)     /* INT6 CFC Card Insert & Eject */
+#define PLD_IRQ_IDEIREQ         (8)     /* INT7 IDE Interrupt */
+#define PLD_IRQ_MMCCARD         (43)    /* MMC Card Insert */
+#define PLD_IRQ_MMCIRQ          (44)    /* MMC Transfer Done */
 
 #if 0
 /* LED Control
@@ -97,7 +95,6 @@
 #define PLD_CRC16ADATA          __reg16(PLD_BASE + 0x18008)
 #define PLD_CRC16AINDATA        __reg16(PLD_BASE + 0x1800a)
 
-
 #if 0
 /* RTC */
 #define PLD_RTCCR               __reg16(PLD_BASE + 0x1c000)
@@ -140,4 +137,7 @@
 
 #endif
 
+/* Reset Control */
+#define PLD_REBOOT              __reg16(PLD_BASE + 0x38000)
+
 #endif  /* _MAPPI3_PLD.H */
diff --git a/include/asm-m32r/ptrace.h b/include/asm-m32r/ptrace.h
index 0d058b2d844e..53c792452dfc 100644
--- a/include/asm-m32r/ptrace.h
+++ b/include/asm-m32r/ptrace.h
@@ -43,6 +43,14 @@
 #define PT_ACC1L        18
 #define PT_ACCH         PT_ACC0H
 #define PT_ACCL         PT_ACC0L
+#elif defined(CONFIG_ISA_M32R2) || defined(CONFIG_ISA_M32R)
+#define PT_ACCH         15
+#define PT_ACCL         16
+#define PT_DUMMY_ACC1H  17
+#define PT_DUMMY_ACC1L  18
+#else
+#error unknown isa conifiguration
+#endif
 #define PT_PSW          19
 #define PT_BPC          20
 #define PT_BBPSW        21
@@ -52,21 +60,6 @@
 #define PT_LR           25
 #define PT_SPI          26
 #define PT_ORIGR0       27
-#elif defined(CONFIG_ISA_M32R2) || defined(CONFIG_ISA_M32R)
-#define PT_ACCH         15
-#define PT_ACCL         16
-#define PT_PSW          17
-#define PT_BPC          18
-#define PT_BBPSW        19
-#define PT_BBPC         20
-#define PT_SPU          21
-#define PT_FP           22
-#define PT_LR           23
-#define PT_SPI          24
-#define PT_ORIGR0       25
-#else
-#error unknown isa conifiguration
-#endif
 
 /* virtual pt_reg entry for gdb */
 #define PT_PC           30
@@ -121,6 +114,8 @@ struct pt_regs {
 #elif defined(CONFIG_ISA_M32R2) || defined(CONFIG_ISA_M32R)
         unsigned long acch;
         unsigned long accl;
+        unsigned long dummy_acc1h;
+        unsigned long dummy_acc1l;
 #else
 #error unknown isa configuration
 #endif
diff --git a/include/asm-m32r/semaphore.h b/include/asm-m32r/semaphore.h
index bf447c52a0a1..81750edc8916 100644
--- a/include/asm-m32r/semaphore.h
+++ b/include/asm-m32r/semaphore.h
@@ -9,7 +9,7 @@
  * SMP- and interrupt-safe semaphores..
  *
  * Copyright (C) 1996  Linus Torvalds
- * Copyright (C) 2004  Hirokazu Takata <takata at linux-m32r.org>
+ * Copyright (C) 2004, 2006  Hirokazu Takata <takata at linux-m32r.org>
  */
 
 #include <linux/config.h>
@@ -77,27 +77,8 @@ asmlinkage void __up(struct semaphore * sem);
  */
 static inline void down(struct semaphore * sem)
 {
-        unsigned long flags;
-        long count;
-
         might_sleep();
-        local_irq_save(flags);
-        __asm__ __volatile__ (
-                "# down                         \n\t"
-                DCACHE_CLEAR("%0", "r4", "%1")
-                M32R_LOCK" %0, @%1;             \n\t"
-                "addi   %0, #-1;                \n\t"
-                M32R_UNLOCK" %0, @%1;           \n\t"
-                : "=&r" (count)
-                : "r" (&sem->count)
-                : "memory"
-#ifdef CONFIG_CHIP_M32700_TS1
-                , "r4"
-#endif  /* CONFIG_CHIP_M32700_TS1 */
-        );
-        local_irq_restore(flags);
-
-        if (unlikely(count < 0))
+        if (unlikely(atomic_dec_return(&sem->count) < 0))
                 __down(sem);
 }
 
@@ -107,28 +88,10 @@ static inline void down(struct semaphore * sem)
  */
 static inline int down_interruptible(struct semaphore * sem)
 {
-        unsigned long flags;
-        long count;
         int result = 0;
 
         might_sleep();
-        local_irq_save(flags);
-        __asm__ __volatile__ (
-                "# down_interruptible           \n\t"
-                DCACHE_CLEAR("%0", "r4", "%1")
-                M32R_LOCK" %0, @%1;             \n\t"
-                "addi   %0, #-1;                \n\t"
-                M32R_UNLOCK" %0, @%1;           \n\t"
-                : "=&r" (count)
-                : "r" (&sem->count)
-                : "memory"
-#ifdef CONFIG_CHIP_M32700_TS1
-                , "r4"
-#endif  /* CONFIG_CHIP_M32700_TS1 */
-        );
-        local_irq_restore(flags);
-
-        if (unlikely(count < 0))
+        if (unlikely(atomic_dec_return(&sem->count) < 0))
                 result = __down_interruptible(sem);
 
         return result;
@@ -174,26 +137,7 @@ static inline int down_trylock(struct semaphore * sem)
  */
 static inline void up(struct semaphore * sem)
 {
-        unsigned long flags;
-        long count;
-
-        local_irq_save(flags);
-        __asm__ __volatile__ (
-                "# up                           \n\t"
-                DCACHE_CLEAR("%0", "r4", "%1")
-                M32R_LOCK" %0, @%1;             \n\t"
-                "addi   %0, #1;                 \n\t"
-                M32R_UNLOCK" %0, @%1;           \n\t"
-                : "=&r" (count)
-                : "r" (&sem->count)
-                : "memory"
-#ifdef CONFIG_CHIP_M32700_TS1
-                , "r4"
-#endif  /* CONFIG_CHIP_M32700_TS1 */
-        );
-        local_irq_restore(flags);
-
-        if (unlikely(count <= 0))
+        if (unlikely(atomic_inc_return(&sem->count) <= 0))
                 __up(sem);
 }
 
diff --git a/include/asm-m32r/sigcontext.h b/include/asm-m32r/sigcontext.h
index c233e2def2a3..942b8a30937d 100644
--- a/include/asm-m32r/sigcontext.h
+++ b/include/asm-m32r/sigcontext.h
@@ -32,6 +32,8 @@ struct sigcontext {
 #elif defined(CONFIG_ISA_M32R2) || defined(CONFIG_ISA_M32R)
         unsigned long sc_acch;
         unsigned long sc_accl;
+        unsigned long sc_dummy_acc1h;
+        unsigned long sc_dummy_acc1l;
 #else
 #error unknown isa configuration
 #endif
diff --git a/include/asm-m32r/system.h b/include/asm-m32r/system.h
index c5ab5da56d21..e55013f378e5 100644
--- a/include/asm-m32r/system.h
+++ b/include/asm-m32r/system.h
@@ -6,8 +6,8 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2001  by Hiroyuki Kondo, Hirokazu Takata, and Hitoshi Yamamoto
- * Copyright (C) 2004  Hirokazu Takata <takata at linux-m32r.org>
+ * Copyright (C) 2001  Hiroyuki Kondo, Hirokazu Takata, and Hitoshi Yamamoto
+ * Copyright (C) 2004, 2006  Hirokazu Takata <takata at linux-m32r.org>
  */
 
 #include <linux/config.h>
@@ -19,49 +19,28 @@
  * switch_to(prev, next) should switch from task `prev' to `next'
  * `prev' will never be the same as `next'.
  *
- * `next' and `prev' should be struct task_struct, but it isn't always defined
+ * `next' and `prev' should be task_t, but it isn't always defined
  */
 
 #define switch_to(prev, next, last)  do { \
-        register unsigned long  arg0 __asm__ ("r0") = (unsigned long)prev; \
-        register unsigned long  arg1 __asm__ ("r1") = (unsigned long)next; \
-        register unsigned long  *oldsp __asm__ ("r2") = &(prev->thread.sp); \
-        register unsigned long  *newsp __asm__ ("r3") = &(next->thread.sp); \
-        register unsigned long  *oldlr __asm__ ("r4") = &(prev->thread.lr); \
-        register unsigned long  *newlr __asm__ ("r5") = &(next->thread.lr); \
-        register struct task_struct  *__last __asm__ ("r6"); \
         __asm__ __volatile__ ( \
-                "st     r8, @-r15                                 \n\t" \
-                "st     r9, @-r15                                 \n\t" \
-                "st    r10, @-r15                                 \n\t" \
-                "st    r11, @-r15                                 \n\t" \
-                "st    r12, @-r15                                 \n\t" \
-                "st    r13, @-r15                                 \n\t" \
-                "st    r14, @-r15                                 \n\t" \
-                "seth  r14, #high(1f)                             \n\t" \
-                "or3   r14, r14, #low(1f)                         \n\t" \
-                "st    r14, @r4    ; store old LR                 \n\t" \
-                "st    r15, @r2    ; store old SP                 \n\t" \
-                "ld    r15, @r3    ; load new SP                  \n\t" \
-                "st     r0, @-r15  ; store 'prev' onto new stack  \n\t" \
-                "ld    r14, @r5    ; load new LR                  \n\t" \
-                "jmp   r14                                        \n\t" \
-                ".fillinsn                                        \n  " \
-                "1:                                               \n\t" \
-                "ld     r6, @r15+  ; load 'prev' from new stack   \n\t" \
-                "ld    r14, @r15+                                 \n\t" \
-                "ld    r13, @r15+                                 \n\t" \
-                "ld    r12, @r15+                                 \n\t" \
-                "ld    r11, @r15+                                 \n\t" \
-                "ld    r10, @r15+                                 \n\t" \
-                "ld     r9, @r15+                                 \n\t" \
-                "ld     r8, @r15+                                 \n\t" \
-                : "=&r" (__last) \
-                : "r" (arg0), "r" (arg1), "r" (oldsp), "r" (newsp), \
-                  "r" (oldlr), "r" (newlr) \
-                : "memory" \
+                "       seth    lr, #high(1f)                           \n" \
+                "       or3     lr, lr, #low(1f)                        \n" \
+                "       st      lr, @%4  ; store old LR                 \n" \
+                "       ld      lr, @%5  ; load new LR                  \n" \
+                "       st      sp, @%2  ; store old SP                 \n" \
+                "       ld      sp, @%3  ; load new SP                  \n" \
+                "       push    %1  ; store `prev' on new stack         \n" \
+                "       jmp     lr                                      \n" \
+                "       .fillinsn                                       \n" \
+                "1:                                                     \n" \
+                "       pop     %0  ; restore `__last' from new stack   \n" \
+                : "=r" (last) \
+                : "0" (prev), \
+                  "r" (&(prev->thread.sp)), "r" (&(next->thread.sp)), \
+                  "r" (&(prev->thread.lr)), "r" (&(next->thread.lr)) \
+                : "memory", "lr" \
         ); \
-        last = __last; \
 } while(0)
 
 /*
@@ -167,8 +146,8 @@ extern void  __xchg_called_with_bad_pointer(void);
 #define DCACHE_CLEAR(reg0, reg1, addr)
 #endif  /* CONFIG_CHIP_M32700_TS1 */
 
-static __inline__ unsigned long __xchg(unsigned long x, volatile void * ptr,
-        int size)
+static inline unsigned long
+__xchg(unsigned long x, volatile void * ptr, int size)
 {
         unsigned long flags;
         unsigned long tmp = 0;
@@ -220,7 +199,7 @@ static __inline__ unsigned long __xchg(unsigned long x, volatile void * ptr,
 
 #define __HAVE_ARCH_CMPXCHG     1
 
-static __inline__ unsigned long
+static inline unsigned long
 __cmpxchg_u32(volatile unsigned int *p, unsigned int old, unsigned int new)
 {
         unsigned long flags;
@@ -254,7 +233,7 @@ __cmpxchg_u32(volatile unsigned int *p, unsigned int old, unsigned int new)
    if something tries to do an invalid cmpxchg().  */
 extern void __cmpxchg_called_with_bad_pointer(void);
 
-static __inline__ unsigned long
+static inline unsigned long
 __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new, int size)
 {
         switch (size) {
diff --git a/include/asm-mips/asmmacro.h b/include/asm-mips/asmmacro.h
index 30b18ea6cb11..f54aa147ec19 100644
--- a/include/asm-mips/asmmacro.h
+++ b/include/asm-mips/asmmacro.h
@@ -17,7 +17,26 @@
 #ifdef CONFIG_64BIT
 #include <asm/asmmacro-64.h>
 #endif
+#ifdef CONFIG_MIPS_MT_SMTC
+#include <asm/mipsmtregs.h>
+#endif
 
+#ifdef CONFIG_MIPS_MT_SMTC
+        .macro  local_irq_enable reg=t0
+        mfc0    \reg, CP0_TCSTATUS
+        ori     \reg, \reg, TCSTATUS_IXMT
+        xori    \reg, \reg, TCSTATUS_IXMT
+        mtc0    \reg, CP0_TCSTATUS
+        ehb
+        .endm
+
+        .macro  local_irq_disable reg=t0
+        mfc0    \reg, CP0_TCSTATUS
+        ori     \reg, \reg, TCSTATUS_IXMT
+        mtc0    \reg, CP0_TCSTATUS
+        ehb
+        .endm
+#else
         .macro  local_irq_enable reg=t0
         mfc0    \reg, CP0_STATUS
         ori     \reg, \reg, 1
@@ -32,6 +51,7 @@
         mtc0    \reg, CP0_STATUS
         irq_disable_hazard
         .endm
+#endif /* CONFIG_MIPS_MT_SMTC */
 
 #ifdef CONFIG_CPU_SB1
         .macro  fpu_enable_hazard
@@ -48,4 +68,31 @@
         .endm
 #endif
 
+/*
+ * Temporary until all gas have MT ASE support
+ */
+        .macro  DMT     reg=0
+        .word   (0x41600bc1 | (\reg << 16))
+        .endm
+
+        .macro  EMT     reg=0
+        .word   (0x41600be1 | (\reg << 16))
+        .endm
+
+        .macro  DVPE    reg=0
+        .word   (0x41600001 | (\reg << 16))
+        .endm
+
+        .macro  EVPE    reg=0
+        .word   (0x41600021 | (\reg << 16))
+        .endm
+
+        .macro  MFTR    rt=0, rd=0, u=0, sel=0
+         .word  (0x41000000 | (\rt << 16) | (\rd << 11) | (\u << 5) | (\sel))
+        .endm
+
+        .macro  MTTR    rt=0, rd=0, u=0, sel=0
+         .word  (0x41800000 | (\rt << 16) | (\rd << 11) | (\u << 5) | (\sel))
+        .endm
+
 #endif /* _ASM_ASMMACRO_H */
diff --git a/include/asm-mips/cacheflush.h b/include/asm-mips/cacheflush.h
index aeae9fabf4a9..47bc8f6c20d2 100644
--- a/include/asm-mips/cacheflush.h
+++ b/include/asm-mips/cacheflush.h
@@ -74,6 +74,7 @@ static inline void copy_from_user_page(struct vm_area_struct *vma,
 
 extern void (*flush_cache_sigtramp)(unsigned long addr);
 extern void (*flush_icache_all)(void);
+extern void (*local_flush_data_cache_page)(void * addr);
 extern void (*flush_data_cache_page)(unsigned long addr);
 
 /*
diff --git a/include/asm-mips/cpu-features.h b/include/asm-mips/cpu-features.h
index 3f2b6d9ac45e..254e11ed247b 100644
--- a/include/asm-mips/cpu-features.h
+++ b/include/asm-mips/cpu-features.h
@@ -40,7 +40,7 @@
 #define cpu_has_sb1_cache       (cpu_data[0].options & MIPS_CPU_SB1_CACHE)
 #endif
 #ifndef cpu_has_fpu
-#define cpu_has_fpu             (cpu_data[0].options & MIPS_CPU_FPU)
+#define cpu_has_fpu             (current_cpu_data.options & MIPS_CPU_FPU)
 #endif
 #ifndef cpu_has_32fpr
 #define cpu_has_32fpr           (cpu_data[0].options & MIPS_CPU_32FPR)
diff --git a/include/asm-mips/cpu-info.h b/include/asm-mips/cpu-info.h
index 140be1c67da7..6572ac703662 100644
--- a/include/asm-mips/cpu-info.h
+++ b/include/asm-mips/cpu-info.h
@@ -73,6 +73,16 @@ struct cpuinfo_mips {
         struct cache_desc       dcache; /* Primary D or combined I/D cache */
         struct cache_desc       scache; /* Secondary cache */
         struct cache_desc       tcache; /* Tertiary/split secondary cache */
+#if defined(CONFIG_MIPS_MT_SMTC)
+        /*
+         * In the MIPS MT "SMTC" model, each TC is considered
+         * to be a "CPU" for the purposes of scheduling, but
+         * exception resources, ASID spaces, etc, are common
+         * to all TCs within the same VPE.
+         */
+        int                     vpe_id;  /* Virtual Processor number */
+        int                     tc_id;   /* Thread Context number */
+#endif /* CONFIG_MIPS_MT */
         void                    *data;  /* Additional data */
 } __attribute__((aligned(SMP_CACHE_BYTES)));
 
diff --git a/include/asm-mips/ds1742.h b/include/asm-mips/ds1742.h
new file mode 100644
index 000000000000..c2f2c32da637
--- /dev/null
+++ b/include/asm-mips/ds1742.h
@@ -0,0 +1,13 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2006 by Ralf Baechle (ralf@linux-mips.org)
+ */
+#ifndef _ASM_DS1742_H
+#define _ASM_DS1742_H
+
+#include <ds1742.h>
+
+#endif /* _ASM_DS1742_H */
diff --git a/include/asm-mips/elf.h b/include/asm-mips/elf.h
index 851f013adad3..bdc9de2df1ef 100644
--- a/include/asm-mips/elf.h
+++ b/include/asm-mips/elf.h
@@ -119,8 +119,49 @@
 #define SHT_MIPS_CONFLICT       0x70000002
 #define SHT_MIPS_GPTAB          0x70000003
 #define SHT_MIPS_UCODE          0x70000004
-
-#define SHF_MIPS_GPREL  0x10000000
+#define SHT_MIPS_DEBUG          0x70000005
+#define SHT_MIPS_REGINFO        0x70000006
+#define SHT_MIPS_PACKAGE        0x70000007
+#define SHT_MIPS_PACKSYM        0x70000008
+#define SHT_MIPS_RELD           0x70000009
+#define SHT_MIPS_IFACE          0x7000000b
+#define SHT_MIPS_CONTENT        0x7000000c
+#define SHT_MIPS_OPTIONS        0x7000000d
+#define SHT_MIPS_SHDR           0x70000010
+#define SHT_MIPS_FDESC          0x70000011
+#define SHT_MIPS_EXTSYM         0x70000012
+#define SHT_MIPS_DENSE          0x70000013
+#define SHT_MIPS_PDESC          0x70000014
+#define SHT_MIPS_LOCSYM         0x70000015
+#define SHT_MIPS_AUXSYM         0x70000016
+#define SHT_MIPS_OPTSYM         0x70000017
+#define SHT_MIPS_LOCSTR         0x70000018
+#define SHT_MIPS_LINE           0x70000019
+#define SHT_MIPS_RFDESC         0x7000001a
+#define SHT_MIPS_DELTASYM       0x7000001b
+#define SHT_MIPS_DELTAINST      0x7000001c
+#define SHT_MIPS_DELTACLASS     0x7000001d
+#define SHT_MIPS_DWARF          0x7000001e
+#define SHT_MIPS_DELTADECL      0x7000001f
+#define SHT_MIPS_SYMBOL_LIB     0x70000020
+#define SHT_MIPS_EVENTS         0x70000021
+#define SHT_MIPS_TRANSLATE      0x70000022
+#define SHT_MIPS_PIXIE          0x70000023
+#define SHT_MIPS_XLATE          0x70000024
+#define SHT_MIPS_XLATE_DEBUG    0x70000025
+#define SHT_MIPS_WHIRL          0x70000026
+#define SHT_MIPS_EH_REGION      0x70000027
+#define SHT_MIPS_XLATE_OLD      0x70000028
+#define SHT_MIPS_PDR_EXCEPTION  0x70000029
+
+#define SHF_MIPS_GPREL          0x10000000
+#define SHF_MIPS_MERGE          0x20000000
+#define SHF_MIPS_ADDR           0x40000000
+#define SHF_MIPS_STRING         0x80000000
+#define SHF_MIPS_NOSTRIP        0x08000000
+#define SHF_MIPS_LOCAL          0x04000000
+#define SHF_MIPS_NAMES          0x02000000
+#define SHF_MIPS_NODUPES        0x01000000
 
 #ifndef ELF_ARCH
 /* ELF register definitions */
diff --git a/include/asm-mips/fpu.h b/include/asm-mips/fpu.h
index 9c828b1f8218..b0f50015e252 100644
--- a/include/asm-mips/fpu.h
+++ b/include/asm-mips/fpu.h
@@ -21,6 +21,10 @@
 #include <asm/processor.h>
 #include <asm/current.h>
 
+#ifdef CONFIG_MIPS_MT_FPAFF
+#include <asm/mips_mt.h>
+#endif
+
 struct sigcontext;
 struct sigcontext32;
 
diff --git a/include/asm-mips/hazards.h b/include/asm-mips/hazards.h
index feb29a793888..dadc05188db7 100644
--- a/include/asm-mips/hazards.h
+++ b/include/asm-mips/hazards.h
@@ -284,6 +284,8 @@ do {									\
 #define instruction_hazard() do { } while (0)
 #endif
 
+extern void mips_ihb(void);
+
 #endif /* __ASSEMBLY__ */
 
 #endif /* _ASM_HAZARDS_H */
diff --git a/include/asm-mips/interrupt.h b/include/asm-mips/interrupt.h
index 774348734fa0..4bb9c06f4410 100644
--- a/include/asm-mips/interrupt.h
+++ b/include/asm-mips/interrupt.h
@@ -19,7 +19,12 @@ __asm__ (
         "       .set    push                                            \n"
         "       .set    reorder                                         \n"
         "       .set    noat                                            \n"
-#ifdef CONFIG_CPU_MIPSR2
+#ifdef CONFIG_MIPS_MT_SMTC
+        "       mfc0    $1, $2, 1       # SMTC - clear TCStatus.IXMT    \n"
+        "       ori     $1, 0x400                                       \n"
+        "       xori    $1, 0x400                                       \n"
+        "       mtc0    $1, $2, 1                                       \n"
+#elif defined(CONFIG_CPU_MIPSR2)
         "       ei                                                      \n"
 #else
         "       mfc0    $1,$12                                          \n"
@@ -62,7 +67,12 @@ __asm__ (
         "       .macro  local_irq_disable\n"
         "       .set    push                                            \n"
         "       .set    noat                                            \n"
-#ifdef CONFIG_CPU_MIPSR2
+#ifdef CONFIG_MIPS_MT_SMTC
+        "       mfc0    $1, $2, 1                                       \n"
+        "       ori     $1, 0x400                                       \n"
+        "       .set    noreorder                                       \n"
+        "       mtc0    $1, $2, 1                                       \n"
+#elif defined(CONFIG_CPU_MIPSR2)
         "       di                                                      \n"
 #else
         "       mfc0    $1,$12                                          \n"
@@ -88,7 +98,11 @@ __asm__ (
         "       .macro  local_save_flags flags                          \n"
         "       .set    push                                            \n"
         "       .set    reorder                                         \n"
+#ifdef CONFIG_MIPS_MT_SMTC
+        "       mfc0    \\flags, $2, 1                                  \n"
+#else
         "       mfc0    \\flags, $12                                    \n"
+#endif
         "       .set    pop                                             \n"
         "       .endm                                                   \n");
 
@@ -102,7 +116,13 @@ __asm__ (
         "       .set    push                                            \n"
         "       .set    reorder                                         \n"
         "       .set    noat                                            \n"
-#ifdef CONFIG_CPU_MIPSR2
+#ifdef CONFIG_MIPS_MT_SMTC
+        "       mfc0    \\result, $2, 1                                 \n"
+        "       ori     $1, \\result, 0x400                             \n"
+        "       .set    noreorder                                       \n"
+        "       mtc0    $1, $2, 1                                       \n"
+        "       andi    \\result, \\result, 0x400                       \n"
+#elif defined(CONFIG_CPU_MIPSR2)
         "       di      \\result                                        \n"
         "       andi    \\result, 1                                     \n"
 #else
@@ -128,7 +148,14 @@ __asm__ (
         "       .set    push                                            \n"
         "       .set    noreorder                                       \n"
         "       .set    noat                                            \n"
-#if defined(CONFIG_CPU_MIPSR2) && defined(CONFIG_IRQ_CPU)
+#ifdef CONFIG_MIPS_MT_SMTC
+        "mfc0   $1, $2, 1                                               \n"
+        "andi   \\flags, 0x400                                          \n"
+        "ori    $1, 0x400                                               \n"
+        "xori   $1, 0x400                                               \n"
+        "or     \\flags, $1                                             \n"
+        "mtc0   \\flags, $2, 1                                          \n"
+#elif defined(CONFIG_CPU_MIPSR2) && defined(CONFIG_IRQ_CPU)
         /*
          * Slow, but doesn't suffer from a relativly unlikely race
          * condition we're having since days 1.
@@ -167,11 +194,29 @@ do {									\
                 : "memory");                                            \
 } while(0)
 
-#define irqs_disabled()                                                 \
-({                                                                      \
-        unsigned long flags;                                            \
-        local_save_flags(flags);                                        \
-        !(flags & 1);                                                   \
-})
+static inline int irqs_disabled(void)
+{
+#ifdef CONFIG_MIPS_MT_SMTC
+        /*
+         * SMTC model uses TCStatus.IXMT to disable interrupts for a thread/CPU
+         */
+        unsigned long __result;
+
+        __asm__ __volatile__(
+        "       .set    noreorder                                       \n"
+        "       mfc0    %0, $2, 1                                       \n"
+        "       andi    %0, 0x400                                       \n"
+        "       slt     %0, $0, %0                                      \n"
+        "       .set    reorder                                         \n"
+        : "=r" (__result));
+
+        return __result;
+#else
+        unsigned long flags;
+        local_save_flags(flags);
+
+        return !(flags & 1);
+#endif
+}
 
 #endif /* _ASM_INTERRUPT_H */
diff --git a/include/asm-mips/irq.h b/include/asm-mips/irq.h
index 8a342ccb34a8..dde677f02bc0 100644
--- a/include/asm-mips/irq.h
+++ b/include/asm-mips/irq.h
@@ -11,6 +11,9 @@
 
 #include <linux/config.h>
 #include <linux/linkage.h>
+
+#include <asm/mipsmtregs.h>
+
 #include <irq.h>
 
 #ifdef CONFIG_I8259
@@ -26,6 +29,23 @@ struct pt_regs;
 
 extern asmlinkage unsigned int do_IRQ(unsigned int irq, struct pt_regs *regs);
 
+#ifdef CONFIG_MIPS_MT_SMTC
+/*
+ * Clear interrupt mask handling "backstop" if irq_hwmask
+ * entry so indicates. This implies that the ack() or end()
+ * functions will take over re-enabling the low-level mask.
+ * Otherwise it will be done on return from exception.
+ */
+#define __DO_IRQ_SMTC_HOOK()                                            \
+do {                                                                    \
+        if (irq_hwmask[irq] & 0x0000ff00)                               \
+                write_c0_tccontext(read_c0_tccontext() &                \
+                                   ~(irq_hwmask[irq] & 0x0000ff00));    \
+} while (0)
+#else
+#define __DO_IRQ_SMTC_HOOK() do { } while (0)
+#endif
+
 #ifdef CONFIG_PREEMPT
 
 /*
@@ -39,6 +59,7 @@ extern asmlinkage unsigned int do_IRQ(unsigned int irq, struct pt_regs *regs);
 #define do_IRQ(irq, regs)                                               \
 do {                                                                    \
         irq_enter();                                                    \
+        __DO_IRQ_SMTC_HOOK();                                           \
         __do_IRQ((irq), (regs));                                        \
         irq_exit();                                                     \
 } while (0)
@@ -46,5 +67,14 @@ do {									\
 #endif
 
 extern void arch_init_irq(void);
+extern void spurious_interrupt(struct pt_regs *regs);
+
+#ifdef CONFIG_MIPS_MT_SMTC
+struct irqaction;
+
+extern unsigned long irq_hwmask[];
+extern int setup_irq_smtc(unsigned int irq, struct irqaction * new,
+                          unsigned long hwmask);
+#endif /* CONFIG_MIPS_MT_SMTC */
 
 #endif /* _ASM_IRQ_H */
diff --git a/include/asm-mips/kspd.h b/include/asm-mips/kspd.h
new file mode 100644
index 000000000000..4e9e724c8935
--- /dev/null
+++ b/include/asm-mips/kspd.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2005 MIPS Technologies, Inc.  All rights reserved.
+ *
+ *  This program is free software; you can distribute it and/or modify it
+ *  under the terms of the GNU General Public License (Version 2) as
+ *  published by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope it will be useful, but WITHOUT
+ *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ *  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ *  for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
+ *
+ */
+
+#ifndef _ASM_KSPD_H
+#define _ASM_KSPD_H
+
+struct kspd_notifications {
+        void (*kspd_sp_exit)(int sp_id);
+
+        struct list_head list;
+};
+
+#ifdef CONFIG_MIPS_APSP_KSPD
+extern void kspd_notify(struct kspd_notifications *notify);
+#else
+static inline void kspd_notify(struct kspd_notifications *notify)
+{
+}
+#endif
+
+#endif
diff --git a/include/asm-mips/mach-generic/ide.h b/include/asm-mips/mach-generic/ide.h
index 550979a9ea9d..e3315359500a 100644
--- a/include/asm-mips/mach-generic/ide.h
+++ b/include/asm-mips/mach-generic/ide.h
@@ -104,65 +104,107 @@ static __inline__ unsigned long ide_default_io_base(int index)
 #endif
 
 /* MIPS port and memory-mapped I/O string operations.  */
+static inline void __ide_flush_prologue(void)
+{
+#ifdef CONFIG_SMP
+        if (cpu_has_dc_aliases)
+                preempt_disable();
+#endif
+}
+
+static inline void __ide_flush_epilogue(void)
+{
+#ifdef CONFIG_SMP
+        if (cpu_has_dc_aliases)
+                preempt_enable();
+#endif
+}
 
 static inline void __ide_flush_dcache_range(unsigned long addr, unsigned long size)
 {
         if (cpu_has_dc_aliases) {
                 unsigned long end = addr + size;
-                for (; addr < end; addr += PAGE_SIZE)
-                        flush_dcache_page(virt_to_page(addr));
+
+                while (addr < end) {
+                        local_flush_data_cache_page((void *)addr);
+                        addr += PAGE_SIZE;
+                }
         }
 }
 
+/*
+ * insw() and gang might be called with interrupts disabled, so we can't
+ * send IPIs for flushing due to the potencial of deadlocks, see the comment
+ * above smp_call_function() in arch/mips/kernel/smp.c.  We work around the
+ * problem by disabling preemption so we know we actually perform the flush
+ * on the processor that actually has the lines to be flushed which hopefully
+ * is even better for performance anyway.
+ */
 static inline void __ide_insw(unsigned long port, void *addr,
         unsigned int count)
 {
+        __ide_flush_prologue();
         insw(port, addr, count);
         __ide_flush_dcache_range((unsigned long)addr, count * 2);
+        __ide_flush_epilogue();
 }
 
 static inline void __ide_insl(unsigned long port, void *addr, unsigned int count)
 {
+        __ide_flush_prologue();
         insl(port, addr, count);
         __ide_flush_dcache_range((unsigned long)addr, count * 4);
+        __ide_flush_epilogue();
 }
 
 static inline void __ide_outsw(unsigned long port, const void *addr,
         unsigned long count)
 {
+        __ide_flush_prologue();
         outsw(port, addr, count);
         __ide_flush_dcache_range((unsigned long)addr, count * 2);
+        __ide_flush_epilogue();
 }
 
 static inline void __ide_outsl(unsigned long port, const void *addr,
         unsigned long count)
 {
+        __ide_flush_prologue();
         outsl(port, addr, count);
         __ide_flush_dcache_range((unsigned long)addr, count * 4);
+        __ide_flush_epilogue();
 }
 
 static inline void __ide_mm_insw(void __iomem *port, void *addr, u32 count)
 {
+        __ide_flush_prologue();
         readsw(port, addr, count);
         __ide_flush_dcache_range((unsigned long)addr, count * 2);
+        __ide_flush_epilogue();
 }
 
 static inline void __ide_mm_insl(void __iomem *port, void *addr, u32 count)
 {
+        __ide_flush_prologue();
         readsl(port, addr, count);
         __ide_flush_dcache_range((unsigned long)addr, count * 4);
+        __ide_flush_epilogue();
 }
 
 static inline void __ide_mm_outsw(void __iomem *port, void *addr, u32 count)
 {
+        __ide_flush_prologue();
         writesw(port, addr, count);
         __ide_flush_dcache_range((unsigned long)addr, count * 2);
+        __ide_flush_epilogue();
 }
 
 static inline void __ide_mm_outsl(void __iomem * port, void *addr, u32 count)
 {
+        __ide_flush_prologue();
         writesl(port, addr, count);
         __ide_flush_dcache_range((unsigned long)addr, count * 4);
+        __ide_flush_epilogue();
 }
 
 /* ide_insw calls insw, not __ide_insw.  Why? */
diff --git a/include/asm-mips/mach-jmr3927/ds1742.h b/include/asm-mips/mach-jmr3927/ds1742.h
index cff6192d4bdb..8a8fef6d07fa 100644
--- a/include/asm-mips/mach-jmr3927/ds1742.h
+++ b/include/asm-mips/mach-jmr3927/ds1742.h
@@ -3,14 +3,14 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2003 by Ralf Baechle
+ * Copyright (C) 2003, 06 by Ralf Baechle
  */
 #ifndef __ASM_MACH_JMR3927_DS1742_H
 #define __ASM_MACH_JMR3927_DS1742_H
 
 #include <asm/jmr3927/jmr3927.h>
 
-#define rtc_read(reg)           (jmr3927_nvram_in(addr))
+#define rtc_read(reg)           (jmr3927_nvram_in(reg))
 #define rtc_write(data, reg)    (jmr3927_nvram_out((data),(reg)))
 
 #endif /* __ASM_MACH_JMR3927_DS1742_H */
diff --git a/include/asm-mips/mach-mips/param.h b/include/asm-mips/mach-mips/param.h
new file mode 100644
index 000000000000..805ef6d27d3c
--- /dev/null
+++ b/include/asm-mips/mach-mips/param.h
@@ -0,0 +1,13 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2003 by Ralf Baechle
+ */
+#ifndef __ASM_MACH_MIPS_PARAM_H
+#define __ASM_MACH_MIPS_PARAM_H
+
+#define HZ              100             /* Internal kernel timer frequency */
+
+#endif /* __ASM_MACH_MIPS_PARAM_H */
diff --git a/include/asm-mips/marvell.h b/include/asm-mips/marvell.h
index 9225b3397a4f..6bb2125bb053 100644
--- a/include/asm-mips/marvell.h
+++ b/include/asm-mips/marvell.h
@@ -53,4 +53,6 @@ struct mv_pci_controller {
         unsigned long   config_vreg;
 };
 
+extern void ll_mv64340_irq(struct pt_regs *regs);
+
 #endif  /* __ASM_MIPS_MARVELL_H */
diff --git a/include/asm-mips/mips-boards/atlas.h b/include/asm-mips/mips-boards/atlas.h
index 0998151fb3a1..a8ae12d120ee 100644
--- a/include/asm-mips/mips-boards/atlas.h
+++ b/include/asm-mips/mips-boards/atlas.h
@@ -33,13 +33,29 @@
 #define ATLAS_RTC_ADR_REG       0x1f000800
 #define ATLAS_RTC_DAT_REG       0x1f000808
 
-
 /*
  * Atlas interrupt controller register base.
  */
 #define ATLAS_ICTRL_REGS_BASE   0x1f000000
 
 /*
+ * Atlas registers are memory mapped on 64-bit aligned boundaries and
+ * only word access are allowed.
+ */
+struct atlas_ictrl_regs {
+        volatile unsigned int intraw;
+        int dummy1;
+        volatile unsigned int intseten;
+        int dummy2;
+        volatile unsigned int intrsten;
+        int dummy3;
+        volatile unsigned int intenable;
+        int dummy4;
+        volatile unsigned int intstatus;
+        int dummy5;
+};
+
+/*
  * Atlas UART register base.
  */
 #define ATLAS_UART_REGS_BASE    0x1f000900
diff --git a/include/asm-mips/mips-boards/atlasint.h b/include/asm-mips/mips-boards/atlasint.h
index bba35c183d08..fd7ebc54fa90 100644
--- a/include/asm-mips/mips-boards/atlasint.h
+++ b/include/asm-mips/mips-boards/atlasint.h
@@ -62,23 +62,4 @@
 #define ATLASINT_RES31          (ATLASINT_BASE+31)
 #define ATLASINT_END            (ATLASINT_BASE+31)
 
-/*
- * Atlas registers are memory mapped on 64-bit aligned boundaries and
- * only word access are allowed.
- */
-struct atlas_ictrl_regs {
-        volatile unsigned int intraw;
-        int dummy1;
-        volatile unsigned int intseten;
-        int dummy2;
-        volatile unsigned int intrsten;
-        int dummy3;
-        volatile unsigned int intenable;
-        int dummy4;
-        volatile unsigned int intstatus;
-        int dummy5;
-};
-
-extern void atlasint_init(void);
-
 #endif /* !(_MIPS_ATLASINT_H) */
diff --git a/include/asm-mips/mips_mt.h b/include/asm-mips/mips_mt.h
new file mode 100644
index 000000000000..c31a312b9783
--- /dev/null
+++ b/include/asm-mips/mips_mt.h
@@ -0,0 +1,15 @@
+/*
+ * Definitions and decalrations for MIPS MT support
+ * that are common between SMTC, VSMP, and/or AP/SP
+ * kernel models.
+ */
+#ifndef __ASM_MIPS_MT_H
+#define __ASM_MIPS_MT_H
+
+extern cpumask_t mt_fpu_cpumask;
+extern unsigned long mt_fpemul_threshold;
+
+extern void mips_mt_regdump(unsigned long previous_mvpcontrol_value);
+extern void mips_mt_set_cpuoptions(void);
+
+#endif /* __ASM_MIPS_MT_H */
diff --git a/include/asm-mips/mipsmtregs.h b/include/asm-mips/mipsmtregs.h
index a669c0702c66..f637ce70758f 100644
--- a/include/asm-mips/mipsmtregs.h
+++ b/include/asm-mips/mipsmtregs.h
@@ -165,7 +165,7 @@
 
 #ifndef __ASSEMBLY__
 
-extern void mips_mt_regdump(void);
+extern void mips_mt_regdump(unsigned long previous_mvpcontrol_value);
 
 static inline unsigned int dvpe(void)
 {
@@ -234,7 +234,7 @@ static inline void __raw_emt(void)
         __asm__ __volatile__(
         "       .set    noreorder                                       \n"
         "       .set    mips32r2                                        \n"
-        "       emt                                                     \n"
+        "       .word   0x41600be1                      # emt           \n"
         "       ehb                                                     \n"
         "       .set    mips0                                           \n"
         "       .set    reorder");
@@ -282,8 +282,11 @@ static inline void ehb(void)
                                                                         \
         __asm__ __volatile__(                                           \
         "       .set    push                                    \n"     \
+        "       .set    noat                                    \n"     \
         "       .set    mips32r2                                \n"     \
-        "       mftgpr  %0," #rt "                              \n"     \
+        "       # mftgpr $1," #rt "                             \n"     \
+        "       .word   0x41000820 | (" #rt " << 16)            \n"     \
+        "       move    %0, $1                                  \n"     \
         "       .set    pop                                     \n"     \
         : "=r" (__res));                                                \
                                                                         \
@@ -295,9 +298,7 @@ static inline void ehb(void)
         unsigned long __res;                                            \
                                                                         \
         __asm__ __volatile__(                                           \
-        ".set noat\n\t"                                                 \
-        "mftr\t%0, " #rt ", " #u ", " #sel "\n\t"                       \
-        ".set at\n\t"                                                   \
+        "       mftr    %0, " #rt ", " #u ", " #sel "           \n"     \
         : "=r" (__res));                                                \
                                                                         \
         __res;                                                          \
@@ -364,6 +365,9 @@ do {									\
 #define read_vpe_c0_ebase()             mftc0(15,1)
 #define write_vpe_c0_ebase(val)         mttc0(15, 1, val)
 #define write_vpe_c0_compare(val)       mttc0(11, 0, val)
+#define read_vpe_c0_badvaddr()          mftc0(8, 0)
+#define read_vpe_c0_epc()               mftc0(14, 0)
+#define write_vpe_c0_epc(val)           mttc0(14, 0, val)
 
 
 /* TC */
diff --git a/include/asm-mips/mipsregs.h b/include/asm-mips/mipsregs.h
index 035ba0a9b0df..a2ef579f6b1a 100644
--- a/include/asm-mips/mipsregs.h
+++ b/include/asm-mips/mipsregs.h
@@ -836,6 +836,9 @@ do {									\
 #define read_c0_cache()         __read_32bit_c0_register($7, 0) /* TX39xx */
 #define write_c0_cache(val)     __write_32bit_c0_register($7, 0, val)
 
+#define read_c0_badvaddr()      __read_ulong_c0_register($8, 0)
+#define write_c0_badvaddr(val)  __write_ulong_c0_register($8, 0, val)
+
 #define read_c0_count()         __read_32bit_c0_register($9, 0)
 #define write_c0_count(val)     __write_32bit_c0_register($9, 0, val)
 
@@ -858,7 +861,19 @@ do {									\
 #define write_c0_compare3(val)  __write_32bit_c0_register($11, 7, val)
 
 #define read_c0_status()        __read_32bit_c0_register($12, 0)
+#ifdef CONFIG_MIPS_MT_SMTC
+#define write_c0_status(val)                                            \
+do {                                                                    \
+        __write_32bit_c0_register($12, 0, val);                         \
+        __ehb();                                                        \
+} while (0)
+#else
+/*
+ * Legacy non-SMTC code, which may be hazardous
+ * but which might not support EHB
+ */
 #define write_c0_status(val)    __write_32bit_c0_register($12, 0, val)
+#endif /* CONFIG_MIPS_MT_SMTC */
 
 #define read_c0_cause()         __read_32bit_c0_register($13, 0)
 #define write_c0_cause(val)     __write_32bit_c0_register($13, 0, val)
@@ -1001,6 +1016,9 @@ do {									\
 #define read_c0_taglo()         __read_32bit_c0_register($28, 0)
 #define write_c0_taglo(val)     __write_32bit_c0_register($28, 0, val)
 
+#define read_c0_dtaglo()        __read_32bit_c0_register($28, 2)
+#define write_c0_dtaglo(val)    __write_32bit_c0_register($28, 2, val)
+
 #define read_c0_taghi()         __read_32bit_c0_register($29, 0)
 #define write_c0_taghi(val)     __write_32bit_c0_register($29, 0, val)
 
@@ -1354,15 +1372,119 @@ static inline void tlb_write_random(void)
 /*
  * Manipulate bits in a c0 register.
  */
+#ifndef CONFIG_MIPS_MT_SMTC
+/*
+ * SMTC Linux requires shutting-down microthread scheduling
+ * during CP0 register read-modify-write sequences.
+ */
+#define __BUILD_SET_C0(name)                                    \
+static inline unsigned int                                      \
+set_c0_##name(unsigned int set)                                 \
+{                                                               \
+        unsigned int res;                                       \
+                                                                \
+        res = read_c0_##name();                                 \
+        res |= set;                                             \
+        write_c0_##name(res);                                   \
+                                                                \
+        return res;                                             \
+}                                                               \
+                                                                \
+static inline unsigned int                                      \
+clear_c0_##name(unsigned int clear)                             \
+{                                                               \
+        unsigned int res;                                       \
+                                                                \
+        res = read_c0_##name();                                 \
+        res &= ~clear;                                          \
+        write_c0_##name(res);                                   \
+                                                                \
+        return res;                                             \
+}                                                               \
+                                                                \
+static inline unsigned int                                      \
+change_c0_##name(unsigned int change, unsigned int new)         \
+{                                                               \
+        unsigned int res;                                       \
+                                                                \
+        res = read_c0_##name();                                 \
+        res &= ~change;                                         \
+        res |= (new & change);                                  \
+        write_c0_##name(res);                                   \
+                                                                \
+        return res;                                             \
+}
+
+#else /* SMTC versions that manage MT scheduling */
+
+#include <asm/interrupt.h>
+
+/*
+ * This is a duplicate of dmt() in mipsmtregs.h to avoid problems with
+ * header file recursion.
+ */
+static inline unsigned int __dmt(void)
+{
+        int res;
+
+        __asm__ __volatile__(
+        "       .set    push                                            \n"
+        "       .set    mips32r2                                        \n"
+        "       .set    noat                                            \n"
+        "       .word   0x41610BC1                      # dmt $1        \n"
+        "       ehb                                                     \n"
+        "       move    %0, $1                                          \n"
+        "       .set    pop                                             \n"
+        : "=r" (res));
+
+        instruction_hazard();
+
+        return res;
+}
+
+#define __VPECONTROL_TE_SHIFT   15
+#define __VPECONTROL_TE         (1UL << __VPECONTROL_TE_SHIFT)
+
+#define __EMT_ENABLE            __VPECONTROL_TE
+
+static inline void __emt(unsigned int previous)
+{
+        if ((previous & __EMT_ENABLE))
+                __asm__ __volatile__(
+                "       .set    noreorder                               \n"
+                "       .set    mips32r2                                \n"
+                "       .word   0x41600be1              # emt           \n"
+                "       ehb                                             \n"
+                "       .set    mips0                                   \n"
+                "       .set    reorder                                 \n");
+}
+
+static inline void __ehb(void)
+{
+        __asm__ __volatile__(
+        "       ehb                                                     \n");
+}
+
+/*
+ * Note that local_irq_save/restore affect TC-specific IXMT state,
+ * not Status.IE as in non-SMTC kernel.
+ */
+
 #define __BUILD_SET_C0(name)                                    \
 static inline unsigned int                                      \
 set_c0_##name(unsigned int set)                                 \
 {                                                               \
         unsigned int res;                                       \
+        unsigned int omt;                                       \
+        unsigned int flags;                                     \
                                                                 \
+        local_irq_save(flags);                                  \
+        omt = __dmt();                                          \
         res = read_c0_##name();                                 \
         res |= set;                                             \
         write_c0_##name(res);                                   \
+        __emt(omt);                                             \
+        local_irq_restore(flags);                               \
                                                                 \
         return res;                                             \
 }                                                               \
@@ -1371,10 +1493,16 @@ static inline unsigned int					\
 clear_c0_##name(unsigned int clear)                             \
 {                                                               \
         unsigned int res;                                       \
+        unsigned int omt;                                       \
+        unsigned int flags;                                     \
                                                                 \
+        local_irq_save(flags);                                  \
+        omt = __dmt();                                          \
         res = read_c0_##name();                                 \
         res &= ~clear;                                          \
         write_c0_##name(res);                                   \
+        __emt(omt);                                             \
+        local_irq_restore(flags);                               \
                                                                 \
         return res;                                             \
 }                                                               \
@@ -1383,14 +1511,22 @@ static inline unsigned int					\
 change_c0_##name(unsigned int change, unsigned int new)         \
 {                                                               \
         unsigned int res;                                       \
+        unsigned int omt;                                       \
+        unsigned int flags;                                     \
                                                                 \
+        local_irq_save(flags);                                  \
+                                                                \
+        omt = __dmt();                                          \
         res = read_c0_##name();                                 \
         res &= ~change;                                         \
         res |= (new & change);                                  \
         write_c0_##name(res);                                   \
+        __emt(omt);                                             \
+        local_irq_restore(flags);                               \
                                                                 \
         return res;                                             \
 }
+#endif
 
 __BUILD_SET_C0(status)
 __BUILD_SET_C0(cause)
diff --git a/include/asm-mips/mmu_context.h b/include/asm-mips/mmu_context.h
index 61cf22588137..6e09f4c87211 100644
--- a/include/asm-mips/mmu_context.h
+++ b/include/asm-mips/mmu_context.h
@@ -17,6 +17,10 @@
 #include <linux/slab.h>
 #include <asm/cacheflush.h>
 #include <asm/tlbflush.h>
+#ifdef CONFIG_MIPS_MT_SMTC
+#include <asm/mipsmtregs.h>
+#include <asm/smtc.h>
+#endif /* SMTC */
 
 /*
  * For the fast tlb miss handlers, we keep a per cpu array of pointers
@@ -54,6 +58,14 @@ extern unsigned long pgd_current[];
 #define ASID_INC        0x1
 #define ASID_MASK       0xfff
 
+/* SMTC/34K debug hack - but maybe we'll keep it */
+#elif defined(CONFIG_MIPS_MT_SMTC)
+
+#define ASID_INC        0x1
+extern unsigned long smtc_asid_mask;
+#define ASID_MASK       (smtc_asid_mask)
+#define HW_ASID_MASK    0xff
+/* End SMTC/34K debug hack */
 #else /* FIXME: not correct for R6000 */
 
 #define ASID_INC        0x1
@@ -76,6 +88,8 @@ static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
 #define ASID_VERSION_MASK  ((unsigned long)~(ASID_MASK|(ASID_MASK-1)))
 #define ASID_FIRST_VERSION ((unsigned long)(~ASID_VERSION_MASK) + 1)
 
+#ifndef CONFIG_MIPS_MT_SMTC
+/* Normal, classic MIPS get_new_mmu_context */
 static inline void
 get_new_mmu_context(struct mm_struct *mm, unsigned long cpu)
 {
@@ -91,6 +105,12 @@ get_new_mmu_context(struct mm_struct *mm, unsigned long cpu)
         cpu_context(cpu, mm) = asid_cache(cpu) = asid;
 }
 
+#else /* CONFIG_MIPS_MT_SMTC */
+
+#define get_new_mmu_context(mm,cpu) smtc_get_new_mmu_context((mm),(cpu))
+
+#endif /* CONFIG_MIPS_MT_SMTC */
+
 /*
  * Initialize the context related info for a new mm_struct
  * instance.
@@ -111,14 +131,46 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
 {
         unsigned int cpu = smp_processor_id();
         unsigned long flags;
-
+#ifdef CONFIG_MIPS_MT_SMTC
+        unsigned long oldasid;
+        unsigned long mtflags;
+        int mytlb = (smtc_status & SMTC_TLB_SHARED) ? 0 : cpu_data[cpu].vpe_id;
         local_irq_save(flags);
+        mtflags = dvpe();
+#else /* Not SMTC */
+        local_irq_save(flags);
+#endif /* CONFIG_MIPS_MT_SMTC */
 
         /* Check if our ASID is of an older version and thus invalid */
         if ((cpu_context(cpu, next) ^ asid_cache(cpu)) & ASID_VERSION_MASK)
                 get_new_mmu_context(next, cpu);
-
+#ifdef CONFIG_MIPS_MT_SMTC
+        /*
+         * If the EntryHi ASID being replaced happens to be
+         * the value flagged at ASID recycling time as having
+         * an extended life, clear the bit showing it being
+         * in use by this "CPU", and if that's the last bit,
+         * free up the ASID value for use and flush any old
+         * instances of it from the TLB.
+         */
+        oldasid = (read_c0_entryhi() & ASID_MASK);
+        if(smtc_live_asid[mytlb][oldasid]) {
+                smtc_live_asid[mytlb][oldasid] &= ~(0x1 << cpu);
+                if(smtc_live_asid[mytlb][oldasid] == 0)
+                        smtc_flush_tlb_asid(oldasid);
+        }
+        /*
+         * Tread softly on EntryHi, and so long as we support
+         * having ASID_MASK smaller than the hardware maximum,
+         * make sure no "soft" bits become "hard"...
+         */
+        write_c0_entryhi((read_c0_entryhi() & ~HW_ASID_MASK)
+                        | (cpu_context(cpu, next) & ASID_MASK));
+        ehb(); /* Make sure it propagates to TCStatus */
+        evpe(mtflags);
+#else
         write_c0_entryhi(cpu_context(cpu, next));
+#endif /* CONFIG_MIPS_MT_SMTC */
         TLBMISS_HANDLER_SETUP_PGD(next->pgd);
 
         /*
@@ -151,12 +203,34 @@ activate_mm(struct mm_struct *prev, struct mm_struct *next)
         unsigned long flags;
         unsigned int cpu = smp_processor_id();
 
+#ifdef CONFIG_MIPS_MT_SMTC
+        unsigned long oldasid;
+        unsigned long mtflags;
+        int mytlb = (smtc_status & SMTC_TLB_SHARED) ? 0 : cpu_data[cpu].vpe_id;
+#endif /* CONFIG_MIPS_MT_SMTC */
+
         local_irq_save(flags);
 
         /* Unconditionally get a new ASID.  */
         get_new_mmu_context(next, cpu);
 
+#ifdef CONFIG_MIPS_MT_SMTC
+        /* See comments for similar code above */
+        mtflags = dvpe();
+        oldasid = read_c0_entryhi() & ASID_MASK;
+        if(smtc_live_asid[mytlb][oldasid]) {
+                smtc_live_asid[mytlb][oldasid] &= ~(0x1 << cpu);
+                if(smtc_live_asid[mytlb][oldasid] == 0)
+                         smtc_flush_tlb_asid(oldasid);
+        }
+        /* See comments for similar code above */
+        write_c0_entryhi((read_c0_entryhi() & ~HW_ASID_MASK) |
+                         (cpu_context(cpu, next) & ASID_MASK));
+        ehb(); /* Make sure it propagates to TCStatus */
+        evpe(mtflags);
+#else
         write_c0_entryhi(cpu_context(cpu, next));
+#endif /* CONFIG_MIPS_MT_SMTC */
         TLBMISS_HANDLER_SETUP_PGD(next->pgd);
 
         /* mark mmu ownership change */
@@ -174,17 +248,49 @@ static inline void
 drop_mmu_context(struct mm_struct *mm, unsigned cpu)
 {
         unsigned long flags;
+#ifdef CONFIG_MIPS_MT_SMTC
+        unsigned long oldasid;
+        /* Can't use spinlock because called from TLB flush within DVPE */
+        unsigned int prevvpe;
+        int mytlb = (smtc_status & SMTC_TLB_SHARED) ? 0 : cpu_data[cpu].vpe_id;
+#endif /* CONFIG_MIPS_MT_SMTC */
 
         local_irq_save(flags);
 
         if (cpu_isset(cpu, mm->cpu_vm_mask))  {
                 get_new_mmu_context(mm, cpu);
+#ifdef CONFIG_MIPS_MT_SMTC
+                /* See comments for similar code above */
+                prevvpe = dvpe();
+                oldasid = (read_c0_entryhi() & ASID_MASK);
+                if(smtc_live_asid[mytlb][oldasid]) {
+                  smtc_live_asid[mytlb][oldasid] &= ~(0x1 << cpu);
+                  if(smtc_live_asid[mytlb][oldasid] == 0)
+                        smtc_flush_tlb_asid(oldasid);
+                }
+                /* See comments for similar code above */
+                write_c0_entryhi((read_c0_entryhi() & ~HW_ASID_MASK)
+                                | cpu_asid(cpu, mm));
+                ehb(); /* Make sure it propagates to TCStatus */
+                evpe(prevvpe);
+#else /* not CONFIG_MIPS_MT_SMTC */
                 write_c0_entryhi(cpu_asid(cpu, mm));
+#endif /* CONFIG_MIPS_MT_SMTC */
         } else {
                 /* will get a new context next time */
+#ifndef CONFIG_MIPS_MT_SMTC
                 cpu_context(cpu, mm) = 0;
+#else /* SMTC */
+                int i;
+
+                /* SMTC shares the TLB (and ASIDs) across VPEs */
+                for (i = 0; i < num_online_cpus(); i++) {
+                    if((smtc_status & SMTC_TLB_SHARED)
+                    || (cpu_data[i].vpe_id == cpu_data[cpu].vpe_id))
+                        cpu_context(i, mm) = 0;
+                }
+#endif /* CONFIG_MIPS_MT_SMTC */
         }
-
         local_irq_restore(flags);
 }
 
diff --git a/include/asm-mips/processor.h b/include/asm-mips/processor.h
index 39d2bd50fece..0fb75f0762e0 100644
--- a/include/asm-mips/processor.h
+++ b/include/asm-mips/processor.h
@@ -12,6 +12,7 @@
 #define _ASM_PROCESSOR_H
 
 #include <linux/config.h>
+#include <linux/cpumask.h>
 #include <linux/threads.h>
 
 #include <asm/cachectl.h>
@@ -107,6 +108,10 @@ struct mips_dsp_state {
 
 #define INIT_DSP {{0,},}
 
+#define INIT_CPUMASK { \
+        {0,} \
+}
+
 typedef struct {
         unsigned long seg;
 } mm_segment_t;
@@ -129,6 +134,12 @@ struct thread_struct {
 
         /* Saved fpu/fpu emulator stuff. */
         union mips_fpu_union fpu;
+#ifdef CONFIG_MIPS_MT_FPAFF
+        /* Emulated instruction count */
+        unsigned long emulated_fp;
+        /* Saved per-thread scheduler affinity mask */
+        cpumask_t user_cpus_allowed;
+#endif /* CONFIG_MIPS_MT_FPAFF */
 
         /* Saved state of the DSP ASE, if available. */
         struct mips_dsp_state dsp;
@@ -142,6 +153,7 @@ struct thread_struct {
 #define MF_LOGADE       2               /* Log address errors to syslog */
 #define MF_32BIT_REGS   4               /* also implies 16/32 fprs */
 #define MF_32BIT_ADDR   8               /* 32-bit address space (o32/n32) */
+#define MF_FPUBOUND     0x10            /* thread bound to FPU-full CPU set */
         unsigned long mflags;
         unsigned long irix_trampoline;  /* Wheee... */
         unsigned long irix_oldctx;
@@ -153,6 +165,12 @@ struct thread_struct {
 #define MF_N32          MF_32BIT_ADDR
 #define MF_N64          0
 
+#ifdef CONFIG_MIPS_MT_FPAFF
+#define FPAFF_INIT 0, INIT_CPUMASK,
+#else
+#define FPAFF_INIT
+#endif /* CONFIG_MIPS_MT_FPAFF */
+
 #define INIT_THREAD  { \
         /* \
          * saved main processor registers \
@@ -168,6 +186,10 @@ struct thread_struct {
          */ \
         INIT_FPU, \
         /* \
+         * fpu affinity state (null if not FPAFF) \
+         */ \
+        FPAFF_INIT \
+        /* \
          * saved dsp/dsp emulator stuff \
          */ \
         INIT_DSP, \
diff --git a/include/asm-mips/ptrace.h b/include/asm-mips/ptrace.h
index 95c5839ac465..fa9d8713c12a 100644
--- a/include/asm-mips/ptrace.h
+++ b/include/asm-mips/ptrace.h
@@ -45,6 +45,10 @@ struct pt_regs {
         unsigned long cp0_badvaddr;
         unsigned long cp0_cause;
         unsigned long cp0_epc;
+#ifdef CONFIG_MIPS_MT_SMTC
+        unsigned long cp0_tcstatus;
+        unsigned long smtc_pad;
+#endif /* CONFIG_MIPS_MT_SMTC */
 };
 
 /* Arbitrarily choose the same ptrace numbers as used by the Sparc code. */
diff --git a/include/asm-mips/r4kcache.h b/include/asm-mips/r4kcache.h
index 90c374700977..3c8e3c8d1a9a 100644
--- a/include/asm-mips/r4kcache.h
+++ b/include/asm-mips/r4kcache.h
@@ -15,6 +15,7 @@
 #include <asm/asm.h>
 #include <asm/cacheops.h>
 #include <asm/cpu-features.h>
+#include <asm/mipsmtregs.h>
 
 /*
  * This macro return a properly sign-extended address suitable as base address
@@ -37,16 +38,120 @@
         "       cache   %0, %1                                  \n"     \
         "       .set    pop                                     \n"     \
         :                                                               \
-        : "i" (op), "m" (*(unsigned char *)(addr)))
+        : "i" (op), "R" (*(unsigned char *)(addr)))
+
+#ifdef CONFIG_MIPS_MT
+/*
+ * Temporary hacks for SMTC debug. Optionally force single-threaded
+ * execution during I-cache flushes.
+ */
+
+#define PROTECT_CACHE_FLUSHES 1
+
+#ifdef PROTECT_CACHE_FLUSHES
+
+extern int mt_protiflush;
+extern int mt_protdflush;
+extern void mt_cflush_lockdown(void);
+extern void mt_cflush_release(void);
+
+#define BEGIN_MT_IPROT \
+        unsigned long flags = 0;                        \
+        unsigned long mtflags = 0;                      \
+        if(mt_protiflush) {                             \
+                local_irq_save(flags);                  \
+                ehb();                                  \
+                mtflags = dvpe();                       \
+                mt_cflush_lockdown();                   \
+        }
+
+#define END_MT_IPROT \
+        if(mt_protiflush) {                             \
+                mt_cflush_release();                    \
+                evpe(mtflags);                          \
+                local_irq_restore(flags);               \
+        }
+
+#define BEGIN_MT_DPROT \
+        unsigned long flags = 0;                        \
+        unsigned long mtflags = 0;                      \
+        if(mt_protdflush) {                             \
+                local_irq_save(flags);                  \
+                ehb();                                  \
+                mtflags = dvpe();                       \
+                mt_cflush_lockdown();                   \
+        }
+
+#define END_MT_DPROT \
+        if(mt_protdflush) {                             \
+                mt_cflush_release();                    \
+                evpe(mtflags);                          \
+                local_irq_restore(flags);               \
+        }
+
+#else
+
+#define BEGIN_MT_IPROT
+#define BEGIN_MT_DPROT
+#define END_MT_IPROT
+#define END_MT_DPROT
+
+#endif /* PROTECT_CACHE_FLUSHES */
+
+#define __iflush_prologue                                               \
+        unsigned long redundance;                                       \
+        extern int mt_n_iflushes;                                       \
+        BEGIN_MT_IPROT                                                  \
+        for (redundance = 0; redundance < mt_n_iflushes; redundance++) {
+
+#define __iflush_epilogue                                               \
+        END_MT_IPROT                                                    \
+        }
+
+#define __dflush_prologue                                               \
+        unsigned long redundance;                                       \
+        extern int mt_n_dflushes;                                       \
+        BEGIN_MT_DPROT                                                  \
+        for (redundance = 0; redundance < mt_n_dflushes; redundance++) {
+
+#define __dflush_epilogue \
+        END_MT_DPROT     \
+        }
+
+#define __inv_dflush_prologue __dflush_prologue
+#define __inv_dflush_epilogue __dflush_epilogue
+#define __sflush_prologue {
+#define __sflush_epilogue }
+#define __inv_sflush_prologue __sflush_prologue
+#define __inv_sflush_epilogue __sflush_epilogue
+
+#else /* CONFIG_MIPS_MT */
+
+#define __iflush_prologue {
+#define __iflush_epilogue }
+#define __dflush_prologue {
+#define __dflush_epilogue }
+#define __inv_dflush_prologue {
+#define __inv_dflush_epilogue }
+#define __sflush_prologue {
+#define __sflush_epilogue }
+#define __inv_sflush_prologue {
+#define __inv_sflush_epilogue }
+
+#endif /* CONFIG_MIPS_MT */
 
 static inline void flush_icache_line_indexed(unsigned long addr)
 {
+        __iflush_prologue
         cache_op(Index_Invalidate_I, addr);
+        __iflush_epilogue
 }
 
 static inline void flush_dcache_line_indexed(unsigned long addr)
 {
+        __dflush_prologue
         cache_op(Index_Writeback_Inv_D, addr);
+        __dflush_epilogue
 }
 
 static inline void flush_scache_line_indexed(unsigned long addr)
@@ -56,17 +161,23 @@ static inline void flush_scache_line_indexed(unsigned long addr)
 
 static inline void flush_icache_line(unsigned long addr)
 {
+        __iflush_prologue
         cache_op(Hit_Invalidate_I, addr);
+        __iflush_epilogue
 }
 
 static inline void flush_dcache_line(unsigned long addr)
 {
+        __dflush_prologue
         cache_op(Hit_Writeback_Inv_D, addr);
+        __dflush_epilogue
 }
 
 static inline void invalidate_dcache_line(unsigned long addr)
 {
+        __dflush_prologue
         cache_op(Hit_Invalidate_D, addr);
+        __dflush_epilogue
 }
 
 static inline void invalidate_scache_line(unsigned long addr)
@@ -239,9 +350,13 @@ static inline void blast_##pfx##cache##lsize(void)			\
                                current_cpu_data.desc.waybit;            \
         unsigned long ws, addr;                                         \
                                                                         \
+        __##pfx##flush_prologue                                         \
+                                                                        \
         for (ws = 0; ws < ws_end; ws += ws_inc)                         \
                 for (addr = start; addr < end; addr += lsize * 32)      \
                         cache##lsize##_unroll32(addr|ws,indexop);       \
+                                                                        \
+        __##pfx##flush_epilogue                                         \
 }                                                                       \
                                                                         \
 static inline void blast_##pfx##cache##lsize##_page(unsigned long page) \
@@ -249,10 +364,14 @@ static inline void blast_##pfx##cache##lsize##_page(unsigned long page)	\
         unsigned long start = page;                                     \
         unsigned long end = page + PAGE_SIZE;                           \
                                                                         \
+        __##pfx##flush_prologue                                         \
+                                                                        \
         do {                                                            \
                 cache##lsize##_unroll32(start,hitop);                   \
                 start += lsize * 32;                                    \
         } while (start < end);                                          \
+                                                                        \
+        __##pfx##flush_epilogue                                         \
 }                                                                       \
                                                                         \
 static inline void blast_##pfx##cache##lsize##_page_indexed(unsigned long page) \
@@ -265,9 +384,13 @@ static inline void blast_##pfx##cache##lsize##_page_indexed(unsigned long page)
                                current_cpu_data.desc.waybit;            \
         unsigned long ws, addr;                                         \
                                                                         \
+        __##pfx##flush_prologue                                         \
+                                                                        \
         for (ws = 0; ws < ws_end; ws += ws_inc)                         \
                 for (addr = start; addr < end; addr += lsize * 32)      \
                         cache##lsize##_unroll32(addr|ws,indexop);       \
+                                                                        \
+        __##pfx##flush_epilogue                                         \
 }
 
 __BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 16)
@@ -288,12 +411,17 @@ static inline void prot##blast_##pfx##cache##_range(unsigned long start, \
         unsigned long lsize = cpu_##desc##_line_size();                 \
         unsigned long addr = start & ~(lsize - 1);                      \
         unsigned long aend = (end - 1) & ~(lsize - 1);                  \
+                                                                        \
+        __##pfx##flush_prologue                                         \
+                                                                        \
         while (1) {                                                     \
                 prot##cache_op(hitop, addr);                            \
                 if (addr == aend)                                       \
                         break;                                          \
                 addr += lsize;                                          \
         }                                                               \
+                                                                        \
+        __##pfx##flush_epilogue                                         \
 }
 
 __BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, protected_)
diff --git a/include/asm-mips/rtc.h b/include/asm-mips/rtc.h
index a2abc4572b63..82ad401c7dca 100644
--- a/include/asm-mips/rtc.h
+++ b/include/asm-mips/rtc.h
@@ -32,7 +32,7 @@ static inline unsigned int get_rtc_time(struct rtc_time *time)
 {
         unsigned long nowtime;
 
-        nowtime = rtc_get_time();
+        nowtime = rtc_mips_get_time();
         to_tm(nowtime, time);
         time->tm_year -= 1900;
 
@@ -47,7 +47,7 @@ static inline int set_rtc_time(struct rtc_time *time)
         nowtime = mktime(time->tm_year+1900, time->tm_mon+1,
                         time->tm_mday, time->tm_hour, time->tm_min,
                         time->tm_sec);
-        ret = rtc_set_time(nowtime);
+        ret = rtc_mips_set_time(nowtime);
 
         return ret;
 }
diff --git a/include/asm-mips/rtlx.h b/include/asm-mips/rtlx.h
index 1298c3fdf6c9..76cd51c6be39 100644
--- a/include/asm-mips/rtlx.h
+++ b/include/asm-mips/rtlx.h
@@ -3,32 +3,46 @@
  *
  */
 
-#ifndef _RTLX_H
-#define _RTLX_H_
+#ifndef __ASM_RTLX_H
+#define __ASM_RTLX_H_
 
 #define LX_NODE_BASE 10
 
 #define MIPSCPU_INT_BASE       16
 #define MIPS_CPU_RTLX_IRQ 0
 
-#define RTLX_VERSION 1
+#define RTLX_VERSION 2
 #define RTLX_xID 0x12345600
 #define RTLX_ID (RTLX_xID | RTLX_VERSION)
 #define RTLX_CHANNELS 8
 
-#define RTLX_BUFFER_SIZE 1024
+#define RTLX_CHANNEL_STDIO      0
+#define RTLX_CHANNEL_DBG        1
+#define RTLX_CHANNEL_SYSIO      2
 
-/*
- * lx_state bits
- */
-#define RTLX_STATE_OPENED 1UL
+extern int rtlx_open(int index, int can_sleep);
+extern int rtlx_release(int index);
+extern ssize_t rtlx_read(int index, void *buff, size_t count, int user);
+extern ssize_t rtlx_write(int index, void *buffer, size_t count, int user);
+extern unsigned int rtlx_read_poll(int index, int can_sleep);
+extern unsigned int rtlx_write_poll(int index);
+
+enum rtlx_state {
+        RTLX_STATE_UNUSED,
+        RTLX_STATE_INITIALISED,
+        RTLX_STATE_REMOTE_READY,
+        RTLX_STATE_OPENED
+};
+
+#define RTLX_BUFFER_SIZE 1024
 
 /* each channel supports read and write.
    linux (vpe0) reads lx_buffer  and writes rt_buffer
    SP (vpe1) reads rt_buffer and writes lx_buffer
 */
 struct rtlx_channel {
-        unsigned long lx_state;
+        enum rtlx_state rt_state;
+        enum rtlx_state lx_state;
 
         int buffer_size;
 
@@ -38,15 +52,13 @@ struct rtlx_channel {
 
         int lx_write, lx_read;
         char *lx_buffer;
-
-        void *queues;
-
 };
 
 struct rtlx_info {
         unsigned long id;
+        enum rtlx_state state;
 
         struct rtlx_channel channel[RTLX_CHANNELS];
 };
 
-#endif /* _RTLX_H_ */
+#endif /* __ASM_RTLX_H_ */
diff --git a/include/asm-mips/serial.h b/include/asm-mips/serial.h
index 7b2366412203..7196ceb0e948 100644
--- a/include/asm-mips/serial.h
+++ b/include/asm-mips/serial.h
@@ -77,15 +77,15 @@
 #include <asm/it8712.h>
 #define ITE_SERIAL_PORT_DEFNS                                  \
     { .baud_base = BASE_BAUD, .port = (IT8172_PCI_IO_BASE + IT_UART_BASE), \
-      .irq = IT8172_UART_IRQ, .flags = STD_COM_FLAGS, .type = 0x3 }, \
+      .irq = IT8172_UART_IRQ, .flags = STD_COM_FLAGS, .port = PORT_16550 }, \
     { .baud_base = (24000000/(16*13)), .port = (IT8172_PCI_IO_BASE + IT8712_UART1_PORT), \
-      .irq = IT8172_SERIRQ_4, .flags = STD_COM_FLAGS, .type = 0x3 }, \
+      .irq = IT8172_SERIRQ_4, .flags = STD_COM_FLAGS, .port = PORT_16550 }, \
     /* Smart Card Reader 0 */ \
     { .baud_base = BASE_BAUD, .port = (IT8172_PCI_IO_BASE + IT_SCR0_BASE), \
-      .irq = IT8172_SCR0_IRQ, .flags = STD_COM_FLAGS, .type = 0x3 }, \
+      .irq = IT8172_SCR0_IRQ, .flags = STD_COM_FLAGS, .port = PORT_16550 }, \
     /* Smart Card Reader 1 */ \
     { .baud_base = BASE_BAUD, .port = (IT8172_PCI_IO_BASE + IT_SCR1_BASE), \
-      .irq = IT8172_SCR1_IRQ, .flags = STD_COM_FLAGS, .type = 0x3 },
+      .irq = IT8172_SCR1_IRQ, .flags = STD_COM_FLAGS, .port = PORT_16550 },
 #else
 #define ITE_SERIAL_PORT_DEFNS
 #endif
@@ -95,10 +95,10 @@
 #include <asm/it8172/it8172_int.h>
 #define IVR_SERIAL_PORT_DEFNS                                  \
     { .baud_base = BASE_BAUD, .port = (IT8172_PCI_IO_BASE + IT_UART_BASE), \
-      .irq = IT8172_UART_IRQ, .flags = STD_COM_FLAGS, .type = 0x3 },         \
+      .irq = IT8172_UART_IRQ, .flags = STD_COM_FLAGS, .port = PORT_16550 },         \
     /* Smart Card Reader 1 */ \
     { .baud_base = BASE_BAUD, .port = (IT8172_PCI_IO_BASE + IT_SCR1_BASE), \
-      .irq = IT8172_SCR1_IRQ, .flags = STD_COM_FLAGS, .type = 0x3 },
+      .irq = IT8172_SCR1_IRQ, .flags = STD_COM_FLAGS, .port = PORT_16550 },
 #else
 #define IVR_SERIAL_PORT_DEFNS
 #endif
diff --git a/include/asm-mips/smtc.h b/include/asm-mips/smtc.h
new file mode 100644
index 000000000000..e1941d1b8726
--- /dev/null
+++ b/include/asm-mips/smtc.h
@@ -0,0 +1,55 @@
+#ifndef _ASM_SMTC_MT_H
+#define _ASM_SMTC_MT_H
+
+/*
+ * Definitions for SMTC multitasking on MIPS MT cores
+ */
+
+#include <asm/mips_mt.h>
+
+/*
+ * System-wide SMTC status information
+ */
+
+extern unsigned int smtc_status;
+
+#define SMTC_TLB_SHARED 0x00000001
+#define SMTC_MTC_ACTIVE 0x00000002
+
+/*
+ * TLB/ASID Management information
+ */
+
+#define MAX_SMTC_TLBS 2
+#define MAX_SMTC_ASIDS 256
+#if NR_CPUS <= 8
+typedef char asiduse;
+#else
+#if NR_CPUS <= 16
+typedef short asiduse;
+#else
+typedef long asiduse;
+#endif
+#endif
+
+extern asiduse smtc_live_asid[MAX_SMTC_TLBS][MAX_SMTC_ASIDS];
+
+void smtc_get_new_mmu_context(struct mm_struct *mm, unsigned long cpu);
+
+void smtc_flush_tlb_asid(unsigned long asid);
+extern int mipsmt_build_cpu_map(int startslot);
+extern void mipsmt_prepare_cpus(void);
+extern void smtc_smp_finish(void);
+extern void smtc_boot_secondary(int cpu, struct task_struct *t);
+
+/*
+ * Sharing the TLB between multiple VPEs means that the
+ * "random" index selection function is not allowed to
+ * select the current value of the Index register. To
+ * avoid additional TLB pressure, the Index registers
+ * are "parked" with an non-Valid value.
+ */
+
+#define PARKED_INDEX    ((unsigned int)0x80000000)
+
+#endif /*  _ASM_SMTC_MT_H */
diff --git a/include/asm-mips/smtc_ipi.h b/include/asm-mips/smtc_ipi.h
new file mode 100644
index 000000000000..f22c3e2f993a
--- /dev/null
+++ b/include/asm-mips/smtc_ipi.h
@@ -0,0 +1,118 @@
+/*
+ * Definitions used in MIPS MT SMTC "Interprocessor Interrupt" code.
+ */
+#ifndef __ASM_SMTC_IPI_H
+#define __ASM_SMTC_IPI_H
+
+//#define SMTC_IPI_DEBUG
+
+#ifdef SMTC_IPI_DEBUG
+#include <asm/mipsregs.h>
+#include <asm/mipsmtregs.h>
+#endif /* SMTC_IPI_DEBUG */
+
+/*
+ * An IPI "message"
+ */
+
+struct smtc_ipi {
+        struct smtc_ipi *flink;
+        int type;
+        void *arg;
+        int dest;
+#ifdef  SMTC_IPI_DEBUG
+        int sender;
+        long stamp;
+#endif /* SMTC_IPI_DEBUG */
+};
+
+/*
+ * Defined IPI Types
+ */
+
+#define LINUX_SMP_IPI 1
+#define SMTC_CLOCK_TICK 2
+
+/*
+ * A queue of IPI messages
+ */
+
+struct smtc_ipi_q {
+        struct smtc_ipi *head;
+        spinlock_t lock;
+        struct smtc_ipi *tail;
+        int depth;
+};
+
+extern struct smtc_ipi_q IPIQ[NR_CPUS];
+extern struct smtc_ipi_q freeIPIq;
+
+static inline void smtc_ipi_nq(struct smtc_ipi_q *q, struct smtc_ipi *p)
+{
+        long flags;
+
+        spin_lock_irqsave(&q->lock, flags);
+        if (q->head == NULL)
+                q->head = q->tail = p;
+        else
+                q->tail->flink = p;
+        p->flink = NULL;
+        q->tail = p;
+        q->depth++;
+#ifdef  SMTC_IPI_DEBUG
+        p->sender = read_c0_tcbind();
+        p->stamp = read_c0_count();
+#endif /* SMTC_IPI_DEBUG */
+        spin_unlock_irqrestore(&q->lock, flags);
+}
+
+static inline struct smtc_ipi *smtc_ipi_dq(struct smtc_ipi_q *q)
+{
+        struct smtc_ipi *p;
+        long flags;
+
+        spin_lock_irqsave(&q->lock, flags);
+        if (q->head == NULL)
+                p = NULL;
+        else {
+                p = q->head;
+                q->head = q->head->flink;
+                q->depth--;
+                /* Arguably unnecessary, but leaves queue cleaner */
+                if (q->head == NULL)
+                        q->tail = NULL;
+        }
+        spin_unlock_irqrestore(&q->lock, flags);
+        return p;
+}
+
+static inline void smtc_ipi_req(struct smtc_ipi_q *q, struct smtc_ipi *p)
+{
+        long flags;
+
+        spin_lock_irqsave(&q->lock, flags);
+        if (q->head == NULL) {
+                q->head = q->tail = p;
+                p->flink = NULL;
+        } else {
+                p->flink = q->head;
+                q->head = p;
+        }
+        q->depth++;
+        spin_unlock_irqrestore(&q->lock, flags);
+}
+
+static inline int smtc_ipi_qdepth(struct smtc_ipi_q *q)
+{
+        long flags;
+        int retval;
+
+        spin_lock_irqsave(&q->lock, flags);
+        retval = q->depth;
+        spin_unlock_irqrestore(&q->lock, flags);
+        return retval;
+}
+
+extern void smtc_send_ipi(int cpu, int type, unsigned int action);
+
+#endif /* __ASM_SMTC_IPI_H */
diff --git a/include/asm-mips/smtc_proc.h b/include/asm-mips/smtc_proc.h
new file mode 100644
index 000000000000..25da651f1f5f
--- /dev/null
+++ b/include/asm-mips/smtc_proc.h
@@ -0,0 +1,23 @@
+/*
+ * Definitions for SMTC /proc entries
+ * Copyright(C) 2005 MIPS Technologies Inc.
+ */
+#ifndef __ASM_SMTC_PROC_H
+#define __ASM_SMTC_PROC_H
+
+/*
+ * per-"CPU" statistics
+ */
+
+struct smtc_cpu_proc {
+        unsigned long timerints;
+        unsigned long selfipis;
+};
+
+extern struct smtc_cpu_proc smtc_cpu_stats[NR_CPUS];
+
+/* Count of number of recoveries of "stolen" FPU access rights on 34K */
+
+extern atomic_t smtc_fpu_recoveries;
+
+#endif /* __ASM_SMTC_PROC_H */
diff --git a/include/asm-mips/stackframe.h b/include/asm-mips/stackframe.h
index 2acf3e844f00..c4856a874965 100644
--- a/include/asm-mips/stackframe.h
+++ b/include/asm-mips/stackframe.h
@@ -14,9 +14,14 @@
 #include <linux/threads.h>
 
 #include <asm/asm.h>
+#include <asm/asmmacro.h>
 #include <asm/mipsregs.h>
 #include <asm/asm-offsets.h>
 
+#ifdef CONFIG_MIPS_MT_SMTC
+#include <asm/mipsmtregs.h>
+#endif /* CONFIG_MIPS_MT_SMTC */
+
                 .macro  SAVE_AT
                 .set    push
                 .set    noat
@@ -57,13 +62,30 @@
 #ifdef CONFIG_SMP
                 .macro  get_saved_sp    /* SMP variation */
 #ifdef CONFIG_32BIT
+#ifdef CONFIG_MIPS_MT_SMTC
+                .set    mips32
+                mfc0    k0, CP0_TCBIND;
+                .set    mips0
+                lui     k1, %hi(kernelsp)
+                srl     k0, k0, 19
+                /* No need to shift down and up to clear bits 0-1 */
+#else
                 mfc0    k0, CP0_CONTEXT
                 lui     k1, %hi(kernelsp)
                 srl     k0, k0, 23
+#endif
                 addu    k1, k0
                 LONG_L  k1, %lo(kernelsp)(k1)
 #endif
 #ifdef CONFIG_64BIT
+#ifdef CONFIG_MIPS_MT_SMTC
+                .set    mips64
+                mfc0    k0, CP0_TCBIND;
+                .set    mips0
+                lui     k0, %highest(kernelsp)
+                dsrl    k1, 19
+                /* No need to shift down and up to clear bits 0-2 */
+#else
                 MFC0    k1, CP0_CONTEXT
                 lui     k0, %highest(kernelsp)
                 dsrl    k1, 23
@@ -71,20 +93,31 @@
                 dsll    k0, k0, 16
                 daddiu  k0, %hi(kernelsp)
                 dsll    k0, k0, 16
+#endif /* CONFIG_MIPS_MT_SMTC */
                 daddu   k1, k1, k0
                 LONG_L  k1, %lo(kernelsp)(k1)
-#endif
+#endif /* CONFIG_64BIT */
                 .endm
 
                 .macro  set_saved_sp stackp temp temp2
 #ifdef CONFIG_32BIT
+#ifdef CONFIG_MIPS_MT_SMTC
+                mfc0    \temp, CP0_TCBIND
+                srl     \temp, 19
+#else
                 mfc0    \temp, CP0_CONTEXT
                 srl     \temp, 23
 #endif
+#endif
 #ifdef CONFIG_64BIT
+#ifdef CONFIG_MIPS_MT_SMTC
+                mfc0    \temp, CP0_TCBIND
+                dsrl    \temp, 19
+#else
                 MFC0    \temp, CP0_CONTEXT
                 dsrl    \temp, 23
 #endif
+#endif
                 LONG_S  \stackp, kernelsp(\temp)
                 .endm
 #else
@@ -122,10 +155,25 @@
                 PTR_SUBU sp, k1, PT_SIZE
                 LONG_S  k0, PT_R29(sp)
                 LONG_S  $3, PT_R3(sp)
+                /*
+                 * You might think that you don't need to save $0,
+                 * but the FPU emulator and gdb remote debug stub
+                 * need it to operate correctly
+                 */
                 LONG_S  $0, PT_R0(sp)
                 mfc0    v1, CP0_STATUS
                 LONG_S  $2, PT_R2(sp)
                 LONG_S  v1, PT_STATUS(sp)
+#ifdef CONFIG_MIPS_MT_SMTC
+                /*
+                 * Ideally, these instructions would be shuffled in
+                 * to cover the pipeline delay.
+                 */
+                .set    mips32
+                mfc0    v1, CP0_TCSTATUS
+                .set    mips0
+                LONG_S  v1, PT_TCSTATUS(sp)
+#endif /* CONFIG_MIPS_MT_SMTC */
                 LONG_S  $4, PT_R4(sp)
                 mfc0    v1, CP0_CAUSE
                 LONG_S  $5, PT_R5(sp)
@@ -234,14 +282,36 @@
                 .endm
 
 #else
+/*
+ * For SMTC kernel, global IE should be left set, and interrupts
+ * controlled exclusively via IXMT.
+ */
 
+#ifdef CONFIG_MIPS_MT_SMTC
+#define STATMASK 0x1e
+#else
+#define STATMASK 0x1f
+#endif
                 .macro  RESTORE_SOME
                 .set    push
                 .set    reorder
                 .set    noat
+#ifdef CONFIG_MIPS_MT_SMTC
+                .set    mips32r2
+                /*
+                 * This may not really be necessary if ints are already
+                 * inhibited here.
+                 */
+                mfc0    v0, CP0_TCSTATUS
+                ori     v0, TCSTATUS_IXMT
+                mtc0    v0, CP0_TCSTATUS
+                ehb
+                DMT     5                               # dmt a1
+                jal     mips_ihb
+#endif /* CONFIG_MIPS_MT_SMTC */
                 mfc0    a0, CP0_STATUS
-                ori     a0, 0x1f
-                xori    a0, 0x1f
+                ori     a0, STATMASK
+                xori    a0, STATMASK
                 mtc0    a0, CP0_STATUS
                 li      v1, 0xff00
                 and     a0, v1
@@ -250,6 +320,26 @@
                 and     v0, v1
                 or      v0, a0
                 mtc0    v0, CP0_STATUS
+#ifdef CONFIG_MIPS_MT_SMTC
+/*
+ * Only after EXL/ERL have been restored to status can we
+ * restore TCStatus.IXMT.
+ */
+                LONG_L  v1, PT_TCSTATUS(sp)
+                ehb
+                mfc0    v0, CP0_TCSTATUS
+                andi    v1, TCSTATUS_IXMT
+                /* We know that TCStatua.IXMT should be set from above */
+                xori    v0, v0, TCSTATUS_IXMT
+                or      v0, v0, v1
+                mtc0    v0, CP0_TCSTATUS
+                ehb
+                andi    a1, a1, VPECONTROL_TE
+                beqz    a1, 1f
+                emt
+1:
+                .set    mips0
+#endif /* CONFIG_MIPS_MT_SMTC */
                 LONG_L  v1, PT_EPC(sp)
                 MTC0    v1, CP0_EPC
                 LONG_L  $31, PT_R31(sp)
@@ -302,11 +392,33 @@
  * Set cp0 enable bit as sign that we're running on the kernel stack
  */
                 .macro  CLI
+#if !defined(CONFIG_MIPS_MT_SMTC)
                 mfc0    t0, CP0_STATUS
                 li      t1, ST0_CU0 | 0x1f
                 or      t0, t1
                 xori    t0, 0x1f
                 mtc0    t0, CP0_STATUS
+#else /* CONFIG_MIPS_MT_SMTC */
+                /*
+                 * For SMTC, we need to set privilege
+                 * and disable interrupts only for the
+                 * current TC, using the TCStatus register.
+                 */
+                mfc0    t0,CP0_TCSTATUS
+                /* Fortunately CU 0 is in the same place in both registers */
+                /* Set TCU0, TMX, TKSU (for later inversion) and IXMT */
+                li      t1, ST0_CU0 | 0x08001c00
+                or      t0,t1
+                /* Clear TKSU, leave IXMT */
+                xori    t0, 0x00001800
+                mtc0    t0, CP0_TCSTATUS
+                ehb
+                /* We need to leave the global IE bit set, but clear EXL...*/
+                mfc0    t0, CP0_STATUS
+                ori     t0, ST0_EXL | ST0_ERL
+                xori    t0, ST0_EXL | ST0_ERL
+                mtc0    t0, CP0_STATUS
+#endif /* CONFIG_MIPS_MT_SMTC */
                 irq_disable_hazard
                 .endm
 
@@ -315,11 +427,35 @@
  * Set cp0 enable bit as sign that we're running on the kernel stack
  */
                 .macro  STI
+#if !defined(CONFIG_MIPS_MT_SMTC)
                 mfc0    t0, CP0_STATUS
                 li      t1, ST0_CU0 | 0x1f
                 or      t0, t1
                 xori    t0, 0x1e
                 mtc0    t0, CP0_STATUS
+#else /* CONFIG_MIPS_MT_SMTC */
+                /*
+                 * For SMTC, we need to set privilege
+                 * and enable interrupts only for the
+                 * current TC, using the TCStatus register.
+                 */
+                ehb
+                mfc0    t0,CP0_TCSTATUS
+                /* Fortunately CU 0 is in the same place in both registers */
+                /* Set TCU0, TKSU (for later inversion) and IXMT */
+                li      t1, ST0_CU0 | 0x08001c00
+                or      t0,t1
+                /* Clear TKSU *and* IXMT */
+                xori    t0, 0x00001c00
+                mtc0    t0, CP0_TCSTATUS
+                ehb
+                /* We need to leave the global IE bit set, but clear EXL...*/
+                mfc0    t0, CP0_STATUS
+                ori     t0, ST0_EXL
+                xori    t0, ST0_EXL
+                mtc0    t0, CP0_STATUS
+                /* irq_enable_hazard below should expand to EHB for 24K/34K cpus */
+#endif /* CONFIG_MIPS_MT_SMTC */
                 irq_enable_hazard
                 .endm
 
@@ -328,11 +464,56 @@
  * Set cp0 enable bit as sign that we're running on the kernel stack
  */
                 .macro  KMODE
+#ifdef CONFIG_MIPS_MT_SMTC
+                /*
+                 * This gets baroque in SMTC.  We want to
+                 * protect the non-atomic clearing of EXL
+                 * with DMT/EMT, but we don't want to take
+                 * an interrupt while DMT is still in effect.
+                 */
+
+                /* KMODE gets invoked from both reorder and noreorder code */
+                .set    push
+                .set    mips32r2
+                .set    noreorder
+                mfc0    v0, CP0_TCSTATUS
+                andi    v1, v0, TCSTATUS_IXMT
+                ori     v0, TCSTATUS_IXMT
+                mtc0    v0, CP0_TCSTATUS
+                ehb
+                DMT     2                               # dmt   v0
+                /*
+                 * We don't know a priori if ra is "live"
+                 */
+                move    t0, ra
+                jal     mips_ihb
+                nop     /* delay slot */
+                move    ra, t0
+#endif /* CONFIG_MIPS_MT_SMTC */
                 mfc0    t0, CP0_STATUS
                 li      t1, ST0_CU0 | 0x1e
                 or      t0, t1
                 xori    t0, 0x1e
                 mtc0    t0, CP0_STATUS
+#ifdef CONFIG_MIPS_MT_SMTC
+                ehb
+                andi    v0, v0, VPECONTROL_TE
+                beqz    v0, 2f
+                nop     /* delay slot */
+                emt
+2:
+                mfc0    v0, CP0_TCSTATUS
+                /* Clear IXMT, then OR in previous value */
+                ori     v0, TCSTATUS_IXMT
+                xori    v0, TCSTATUS_IXMT
+                or      v0, v1, v0
+                mtc0    v0, CP0_TCSTATUS
+                /*
+                 * irq_disable_hazard below should expand to EHB
+                 * on 24K/34K CPUS
+                 */
+                .set pop
+#endif /* CONFIG_MIPS_MT_SMTC */
                 irq_disable_hazard
                 .endm
 
diff --git a/include/asm-mips/system.h b/include/asm-mips/system.h
index 4097fac5ac3c..261f71d16a07 100644
--- a/include/asm-mips/system.h
+++ b/include/asm-mips/system.h
@@ -155,6 +155,37 @@ extern asmlinkage void *resume(void *last, void *next, void *next_ti);
 
 struct task_struct;
 
+#ifdef CONFIG_MIPS_MT_FPAFF
+
+/*
+ * Handle the scheduler resume end of FPU affinity management.  We do this
+ * inline to try to keep the overhead down. If we have been forced to run on
+ * a "CPU" with an FPU because of a previous high level of FP computation,
+ * but did not actually use the FPU during the most recent time-slice (CU1
+ * isn't set), we undo the restriction on cpus_allowed.
+ *
+ * We're not calling set_cpus_allowed() here, because we have no need to
+ * force prompt migration - we're already switching the current CPU to a
+ * different thread.
+ */
+
+#define switch_to(prev,next,last)                                       \
+do {                                                                    \
+        if (cpu_has_fpu &&                                              \
+            (prev->thread.mflags & MF_FPUBOUND) &&                      \
+             (!(KSTK_STATUS(prev) & ST0_CU1))) {                        \
+                prev->thread.mflags &= ~MF_FPUBOUND;                    \
+                prev->cpus_allowed = prev->thread.user_cpus_allowed;    \
+        }                                                               \
+        if (cpu_has_dsp)                                                \
+                __save_dsp(prev);                                       \
+        next->thread.emulated_fp = 0;                                   \
+        (last) = resume(prev, next, next->thread_info);                 \
+        if (cpu_has_dsp)                                                \
+                __restore_dsp(current);                                 \
+} while(0)
+
+#else
 #define switch_to(prev,next,last)                                       \
 do {                                                                    \
         if (cpu_has_dsp)                                                \
@@ -163,6 +194,7 @@ do {									\
         if (cpu_has_dsp)                                                \
                 __restore_dsp(current);                                 \
 } while(0)
+#endif
 
 /*
  * On SMP systems, when the scheduler does migration-cost autodetection,
@@ -440,8 +472,8 @@ static inline unsigned long __cmpxchg(volatile void * ptr, unsigned long old,
 extern void set_handler (unsigned long offset, void *addr, unsigned long len);
 extern void set_uncached_handler (unsigned long offset, void *addr, unsigned long len);
 extern void *set_vi_handler (int n, void *addr);
-extern void *set_vi_srs_handler (int n, void *addr, int regset);
 extern void *set_except_vector(int n, void *addr);
+extern unsigned long ebase;
 extern void per_cpu_trap_init(void);
 
 extern NORET_TYPE void die(const char *, struct pt_regs *);
diff --git a/include/asm-mips/unistd.h b/include/asm-mips/unistd.h
index b5c78a4a0192..1068fe9a0a58 100644
--- a/include/asm-mips/unistd.h
+++ b/include/asm-mips/unistd.h
@@ -324,16 +324,18 @@
 #define __NR_pselect6                   (__NR_Linux + 301)
 #define __NR_ppoll                      (__NR_Linux + 302)
 #define __NR_unshare                    (__NR_Linux + 303)
+#define __NR_splice                     (__NR_Linux + 304)
+#define __NR_sync_file_range            (__NR_Linux + 305)
 
 /*
  * Offset of the last Linux o32 flavoured syscall
  */
-#define __NR_Linux_syscalls             303
+#define __NR_Linux_syscalls             305
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
 
 #define __NR_O32_Linux                  4000
-#define __NR_O32_Linux_syscalls         303
+#define __NR_O32_Linux_syscalls         305
 
 #if _MIPS_SIM == _MIPS_SIM_ABI64
 
@@ -604,16 +606,18 @@
 #define __NR_pselect6                   (__NR_Linux + 260)
 #define __NR_ppoll                      (__NR_Linux + 261)
 #define __NR_unshare                    (__NR_Linux + 262)
+#define __NR_splice                     (__NR_Linux + 263)
+#define __NR_sync_file_range            (__NR_Linux + 264)
 
 /*
  * Offset of the last Linux 64-bit flavoured syscall
  */
-#define __NR_Linux_syscalls             262
+#define __NR_Linux_syscalls             264
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
 
 #define __NR_64_Linux                   5000
-#define __NR_64_Linux_syscalls          262
+#define __NR_64_Linux_syscalls          264
 
 #if _MIPS_SIM == _MIPS_SIM_NABI32
 
@@ -888,16 +892,18 @@
 #define __NR_pselect6                   (__NR_Linux + 264)
 #define __NR_ppoll                      (__NR_Linux + 265)
 #define __NR_unshare                    (__NR_Linux + 266)
+#define __NR_splice                     (__NR_Linux + 267)
+#define __NR_sync_file_range            (__NR_Linux + 268)
 
 /*
  * Offset of the last N32 flavoured syscall
  */
-#define __NR_Linux_syscalls             266
+#define __NR_Linux_syscalls             268
 
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
 
 #define __NR_N32_Linux                  6000
-#define __NR_N32_Linux_syscalls         266
+#define __NR_N32_Linux_syscalls         268
 
 #ifndef __ASSEMBLY__
 
diff --git a/include/asm-mips/vpe.h b/include/asm-mips/vpe.h
new file mode 100644
index 000000000000..c6e1b961537d
--- /dev/null
+++ b/include/asm-mips/vpe.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2005 MIPS Technologies, Inc.  All rights reserved.
+ *
+ *  This program is free software; you can distribute it and/or modify it
+ *  under the terms of the GNU General Public License (Version 2) as
+ *  published by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope it will be useful, but WITHOUT
+ *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ *  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ *  for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
+ *
+ */
+
+#ifndef _ASM_VPE_H
+#define _ASM_VPE_H
+
+struct vpe_notifications {
+        void (*start)(int vpe);
+        void (*stop)(int vpe);
+
+        struct list_head list;
+};
+
+
+extern int vpe_notify(int index, struct vpe_notifications *notify);
+
+extern void *vpe_get_shared(int index);
+extern int vpe_getuid(int index);
+extern int vpe_getgid(int index);
+extern char *vpe_getcwd(int index);
+
+#endif /* _ASM_VPE_H */
diff --git a/include/asm-parisc/io.h b/include/asm-parisc/io.h
index 29da31194b91..244f6b8883f4 100644
--- a/include/asm-parisc/io.h
+++ b/include/asm-parisc/io.h
@@ -126,24 +126,17 @@ static inline void gsc_writeq(unsigned long long val, unsigned long addr)
 
 extern void __iomem * __ioremap(unsigned long offset, unsigned long size, unsigned long flags);
 
-extern inline void __iomem * ioremap(unsigned long offset, unsigned long size)
-{
-        return __ioremap(offset, size, 0);
-}
-
-/*
- * This one maps high address device memory and turns off caching for that area.
- * it's useful if some control registers are in such an area and write combining
- * or read caching is not desirable:
+/* Most machines react poorly to I/O-space being cacheable... Instead let's
+ * define ioremap() in terms of ioremap_nocache().
  */
-extern inline void * ioremap_nocache(unsigned long offset, unsigned long size)
+extern inline void __iomem * ioremap(unsigned long offset, unsigned long size)
 {
-        return __ioremap(offset, size, _PAGE_NO_CACHE /* _PAGE_PCD */);
+        return __ioremap(offset, size, _PAGE_NO_CACHE);
 }
+#define ioremap_nocache(off, sz)        ioremap((off), (sz))
 
 extern void iounmap(void __iomem *addr);
 
-
 static inline unsigned char __raw_readb(const volatile void __iomem *addr)
 {
         return (*(volatile unsigned char __force *) (addr));
diff --git a/include/asm-parisc/page.h b/include/asm-parisc/page.h
index 45e02aa5bf4b..c0dd461fb8f1 100644
--- a/include/asm-parisc/page.h
+++ b/include/asm-parisc/page.h
@@ -1,13 +1,30 @@
 #ifndef _PARISC_PAGE_H
 #define _PARISC_PAGE_H
 
-/* PAGE_SHIFT determines the page size */
-#define PAGE_SHIFT      12
-#define PAGE_SIZE       (1UL << PAGE_SHIFT)
-#define PAGE_MASK       (~(PAGE_SIZE-1))
+#if !defined(__KERNEL__)
+/* this is for userspace applications (4k page size) */
+# define PAGE_SHIFT     12      /* 4k */
+# define PAGE_SIZE      (1UL << PAGE_SHIFT)
+# define PAGE_MASK      (~(PAGE_SIZE-1))
+#endif
+
 
 #ifdef __KERNEL__
 #include <linux/config.h>
+
+#if defined(CONFIG_PARISC_PAGE_SIZE_4KB)
+# define PAGE_SHIFT     12      /* 4k */
+#elif defined(CONFIG_PARISC_PAGE_SIZE_16KB)
+# define PAGE_SHIFT     14      /* 16k */
+#elif defined(CONFIG_PARISC_PAGE_SIZE_64KB)
+# define PAGE_SHIFT     16      /* 64k */
+#else
+# error "unknown default kernel page size"
+#endif
+#define PAGE_SIZE       (1UL << PAGE_SHIFT)
+#define PAGE_MASK       (~(PAGE_SIZE-1))
+
+
 #ifndef __ASSEMBLY__
 
 #include <asm/types.h>
diff --git a/include/asm-parisc/pgtable.h b/include/asm-parisc/pgtable.h
index 4e34c6b44059..aec089eb8b85 100644
--- a/include/asm-parisc/pgtable.h
+++ b/include/asm-parisc/pgtable.h
@@ -59,16 +59,15 @@
 #define  ISTACK_SIZE  32768 /* Interrupt Stack Size */
 #define  ISTACK_ORDER 3
 
-/* This is the size of the initially mapped kernel memory (i.e. currently
- * 0 to 1<<23 == 8MB */
+/* This is the size of the initially mapped kernel memory */
 #ifdef CONFIG_64BIT
-#define KERNEL_INITIAL_ORDER    24
+#define KERNEL_INITIAL_ORDER    24      /* 0 to 1<<24 = 16MB */
 #else
-#define KERNEL_INITIAL_ORDER    23
+#define KERNEL_INITIAL_ORDER    23      /* 0 to 1<<23 = 8MB */
 #endif
 #define KERNEL_INITIAL_SIZE     (1 << KERNEL_INITIAL_ORDER)
 
-#ifdef CONFIG_64BIT
+#if defined(CONFIG_64BIT) && defined(CONFIG_PARISC_PAGE_SIZE_4KB)
 #define PT_NLEVELS      3
 #define PGD_ORDER       1 /* Number of pages per pgd */
 #define PMD_ORDER       1 /* Number of pages per pmd */
@@ -111,11 +110,15 @@
 #define MAX_ADDRBITS    (PGDIR_SHIFT + BITS_PER_PGD)
 #define MAX_ADDRESS     (1UL << MAX_ADDRBITS)
 
-#define SPACEID_SHIFT (MAX_ADDRBITS - 32)
+#define SPACEID_SHIFT   (MAX_ADDRBITS - 32)
 
 /* This calculates the number of initial pages we need for the initial
  * page tables */
-#define PT_INITIAL      (1 << (KERNEL_INITIAL_ORDER - PMD_SHIFT))
+#if (KERNEL_INITIAL_ORDER) >= (PMD_SHIFT)
+# define PT_INITIAL     (1 << (KERNEL_INITIAL_ORDER - PMD_SHIFT))
+#else
+# define PT_INITIAL     (1)  /* all initial PTEs fit into one page */
+#endif
 
 /*
  * pgd entries used up by user/kernel:
@@ -160,6 +163,10 @@ extern  void *vmalloc_start;
  * to zero */
 #define PTE_SHIFT               xlate_pabit(_PAGE_USER_BIT)
 
+/* PFN_PTE_SHIFT defines the shift of a PTE value to access the PFN field */
+#define PFN_PTE_SHIFT           12
+
+
 /* this is how many bits may be used by the file functions */
 #define PTE_FILE_MAX_BITS       (BITS_PER_LONG - PTE_SHIFT)
 
@@ -188,7 +195,8 @@ extern  void *vmalloc_start;
 /* The pgd/pmd contains a ptr (in phys addr space); since all pgds/pmds
  * are page-aligned, we don't care about the PAGE_OFFSET bits, except
  * for a few meta-information bits, so we shift the address to be
- * able to effectively address 40-bits of physical address space. */
+ * able to effectively address 40/42/44-bits of physical address space
+ * depending on 4k/16k/64k PAGE_SIZE */
 #define _PxD_PRESENT_BIT   31
 #define _PxD_ATTACHED_BIT  30
 #define _PxD_VALID_BIT     29
@@ -198,7 +206,7 @@ extern  void *vmalloc_start;
 #define PxD_FLAG_VALID    (1 << xlate_pabit(_PxD_VALID_BIT))
 #define PxD_FLAG_MASK     (0xf)
 #define PxD_FLAG_SHIFT    (4)
-#define PxD_VALUE_SHIFT   (8)
+#define PxD_VALUE_SHIFT   (8) /* (PAGE_SHIFT-PxD_FLAG_SHIFT) */
 
 #ifndef __ASSEMBLY__
 
@@ -246,6 +254,7 @@ extern  void *vmalloc_start;
 #define __S110  PAGE_RWX
 #define __S111  PAGE_RWX
 
+
 extern pgd_t swapper_pg_dir[]; /* declared in init_task.c */
 
 /* initial page tables for 0-8MB for kernel */
@@ -272,7 +281,7 @@ extern unsigned long *empty_zero_page;
 #define pgd_flag(x)     (pgd_val(x) & PxD_FLAG_MASK)
 #define pgd_address(x)  ((unsigned long)(pgd_val(x) &~ PxD_FLAG_MASK) << PxD_VALUE_SHIFT)
 
-#ifdef CONFIG_64BIT
+#if PT_NLEVELS == 3
 /* The first entry of the permanent pmd is not there if it contains
  * the gateway marker */
 #define pmd_none(x)     (!pmd_val(x) || pmd_flag(x) == PxD_FLAG_ATTACHED)
@@ -282,7 +291,7 @@ extern unsigned long *empty_zero_page;
 #define pmd_bad(x)      (!(pmd_flag(x) & PxD_FLAG_VALID))
 #define pmd_present(x)  (pmd_flag(x) & PxD_FLAG_PRESENT)
 static inline void pmd_clear(pmd_t *pmd) {
-#ifdef CONFIG_64BIT
+#if PT_NLEVELS == 3
         if (pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
                 /* This is the entry pointing to the permanent pmd
                  * attached to the pgd; cannot clear it */
@@ -303,7 +312,7 @@ static inline void pmd_clear(pmd_t *pmd) {
 #define pgd_bad(x)      (!(pgd_flag(x) & PxD_FLAG_VALID))
 #define pgd_present(x)  (pgd_flag(x) & PxD_FLAG_PRESENT)
 static inline void pgd_clear(pgd_t *pgd) {
-#ifdef CONFIG_64BIT
+#if PT_NLEVELS == 3
         if(pgd_flag(*pgd) & PxD_FLAG_ATTACHED)
                 /* This is the permanent pmd attached to the pgd; cannot
                  * free it */
@@ -351,7 +360,7 @@ extern inline pte_t pte_mkwrite(pte_t pte)	{ pte_val(pte) |= _PAGE_WRITE; return
 ({                                                                      \
         pte_t __pte;                                                    \
                                                                         \
-        pte_val(__pte) = ((addr)+pgprot_val(pgprot));                   \
+        pte_val(__pte) = ((((addr)>>PAGE_SHIFT)<<PFN_PTE_SHIFT) + pgprot_val(pgprot));  \
                                                                         \
         __pte;                                                          \
 })
@@ -361,20 +370,16 @@ extern inline pte_t pte_mkwrite(pte_t pte)	{ pte_val(pte) |= _PAGE_WRITE; return
 static inline pte_t pfn_pte(unsigned long pfn, pgprot_t pgprot)
 {
         pte_t pte;
-        pte_val(pte) = (pfn << PAGE_SHIFT) | pgprot_val(pgprot);
+        pte_val(pte) = (pfn << PFN_PTE_SHIFT) | pgprot_val(pgprot);
         return pte;
 }
 
-/* This takes a physical page address that is used by the remapping functions */
-#define mk_pte_phys(physpage, pgprot) \
-({ pte_t __pte; pte_val(__pte) = physpage + pgprot_val(pgprot); __pte; })
-
 extern inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 { pte_val(pte) = (pte_val(pte) & _PAGE_CHG_MASK) | pgprot_val(newprot); return pte; }
 
 /* Permanent address of a page.  On parisc we don't have highmem. */
 
-#define pte_pfn(x) (pte_val(x) >> PAGE_SHIFT)
+#define pte_pfn(x)              (pte_val(x) >> PFN_PTE_SHIFT)
 
 #define pte_page(pte)           (pfn_to_page(pte_pfn(pte)))
 
@@ -499,6 +504,26 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr,
 
 #endif /* !__ASSEMBLY__ */
 
+
+/* TLB page size encoding - see table 3-1 in parisc20.pdf */
+#define _PAGE_SIZE_ENCODING_4K          0
+#define _PAGE_SIZE_ENCODING_16K 1
+#define _PAGE_SIZE_ENCODING_64K 2
+#define _PAGE_SIZE_ENCODING_256K        3
+#define _PAGE_SIZE_ENCODING_1M          4
+#define _PAGE_SIZE_ENCODING_4M          5
+#define _PAGE_SIZE_ENCODING_16M 6
+#define _PAGE_SIZE_ENCODING_64M 7
+
+#if defined(CONFIG_PARISC_PAGE_SIZE_4KB)
+# define _PAGE_SIZE_ENCODING_DEFAULT _PAGE_SIZE_ENCODING_4K
+#elif defined(CONFIG_PARISC_PAGE_SIZE_16KB)
+# define _PAGE_SIZE_ENCODING_DEFAULT _PAGE_SIZE_ENCODING_16K
+#elif defined(CONFIG_PARISC_PAGE_SIZE_64KB)
+# define _PAGE_SIZE_ENCODING_DEFAULT _PAGE_SIZE_ENCODING_64K
+#endif
+
+
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot)         \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
 
diff --git a/include/asm-parisc/unistd.h b/include/asm-parisc/unistd.h
index c56fccbf34ad..0e1a30be2e30 100644
--- a/include/asm-parisc/unistd.h
+++ b/include/asm-parisc/unistd.h
@@ -780,8 +780,14 @@
 #define __NR_readlinkat         (__NR_Linux + 285)
 #define __NR_fchmodat           (__NR_Linux + 286)
 #define __NR_faccessat          (__NR_Linux + 287)
+#define __NR_unshare            (__NR_Linux + 288)
+#define __NR_set_robust_list    (__NR_Linux + 289)
+#define __NR_get_robust_list    (__NR_Linux + 290)
+#define __NR_splice             (__NR_Linux + 291)
+#define __NR_sync_file_range    (__NR_Linux + 292)
+#define __NR_tee                (__NR_Linux + 293)
 
-#define __NR_Linux_syscalls     288
+#define __NR_Linux_syscalls     294
 
 #define HPUX_GATEWAY_ADDR       0xC0000004
 #define LINUX_GATEWAY_ADDR      0x100
diff --git a/include/asm-powerpc/iommu.h b/include/asm-powerpc/iommu.h
index d5677cbec200..18ca29e9105a 100644
--- a/include/asm-powerpc/iommu.h
+++ b/include/asm-powerpc/iommu.h
@@ -70,17 +70,18 @@ extern void iommu_free_table(struct device_node *dn);
 extern struct iommu_table *iommu_init_table(struct iommu_table * tbl);
 
 extern int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
-                struct scatterlist *sglist, int nelems,
+                struct scatterlist *sglist, int nelems, unsigned long mask,
                 enum dma_data_direction direction);
 extern void iommu_unmap_sg(struct iommu_table *tbl, struct scatterlist *sglist,
                 int nelems, enum dma_data_direction direction);
 
 extern void *iommu_alloc_coherent(struct iommu_table *tbl, size_t size,
-                dma_addr_t *dma_handle, gfp_t flag);
+                dma_addr_t *dma_handle, unsigned long mask, gfp_t flag);
 extern void iommu_free_coherent(struct iommu_table *tbl, size_t size,
                 void *vaddr, dma_addr_t dma_handle);
 extern dma_addr_t iommu_map_single(struct iommu_table *tbl, void *vaddr,
-                size_t size, enum dma_data_direction direction);
+                size_t size, unsigned long mask,
+                enum dma_data_direction direction);
 extern void iommu_unmap_single(struct iommu_table *tbl, dma_addr_t dma_handle,
                 size_t size, enum dma_data_direction direction);
 
diff --git a/include/asm-powerpc/irq.h b/include/asm-powerpc/irq.h
index 51f87d9993b6..7bc6d73b2823 100644
--- a/include/asm-powerpc/irq.h
+++ b/include/asm-powerpc/irq.h
@@ -54,6 +54,13 @@
  */
 extern unsigned int virt_irq_to_real_map[NR_IRQS];
 
+/* The maximum virtual IRQ number that we support.  This
+ * can be set by the platform and will be reduced by the
+ * value of __irq_offset_value.  It defaults to and is
+ * capped by (NR_IRQS - 1).
+ */
+extern unsigned int virt_irq_max;
+
 /* Create a mapping for a real_irq if it doesn't already exist.
  * Return the virtual irq as a convenience.
  */
diff --git a/include/asm-powerpc/machdep.h b/include/asm-powerpc/machdep.h
index 5ed847680754..0f9254c18914 100644
--- a/include/asm-powerpc/machdep.h
+++ b/include/asm-powerpc/machdep.h
@@ -253,7 +253,11 @@ extern struct machdep_calls *machine_id;
 
 #define __machine_desc __attribute__ ((__section__ (".machine.desc")))
 
-#define define_machine(name) struct machdep_calls mach_##name __machine_desc =
+#define define_machine(name)                                    \
+        extern struct machdep_calls mach_##name;                \
+        EXPORT_SYMBOL(mach_##name);                             \
+        struct machdep_calls mach_##name __machine_desc =
+
 #define machine_is(name) \
         ({ \
                 extern struct machdep_calls mach_##name \
diff --git a/include/asm-powerpc/thread_info.h b/include/asm-powerpc/thread_info.h
index ffc7462d77ba..88b553c6b26c 100644
--- a/include/asm-powerpc/thread_info.h
+++ b/include/asm-powerpc/thread_info.h
@@ -37,6 +37,8 @@ struct thread_info {
         int             preempt_count;          /* 0 => preemptable,
                                                    <0 => BUG */
         struct restart_block restart_block;
+        unsigned long   local_flags;            /* private flags for thread */
+
         /* low level flags - has atomic operations done on it */
         unsigned long   flags ____cacheline_aligned_in_smp;
 };
@@ -143,6 +145,12 @@ static inline struct thread_info *current_thread_info(void)
                                  _TIF_NEED_RESCHED | _TIF_RESTORE_SIGMASK)
 #define _TIF_PERSYSCALL_MASK    (_TIF_RESTOREALL|_TIF_NOERROR)
 
+/* Bits in local_flags */
+/* Don't move TLF_NAPPING without adjusting the code in entry_32.S */
+#define TLF_NAPPING             0       /* idle thread enabled NAP mode */
+
+#define _TLF_NAPPING            (1 << TLF_NAPPING)
+
 #endif /* __KERNEL__ */
 
 #endif /* _ASM_POWERPC_THREAD_INFO_H */
diff --git a/include/asm-powerpc/unistd.h b/include/asm-powerpc/unistd.h
index c612f1a62772..34325e292596 100644
--- a/include/asm-powerpc/unistd.h
+++ b/include/asm-powerpc/unistd.h
@@ -303,8 +303,9 @@
 #define __NR_unshare            282
 #define __NR_splice             283
 #define __NR_tee                284
+#define __NR_vmsplice           285
 
-#define __NR_syscalls           285
+#define __NR_syscalls           286
 
 #ifdef __KERNEL__
 #define __NR__exit __NR_exit
diff --git a/include/asm-sparc/unistd.h b/include/asm-sparc/unistd.h
index 2a911aa4cae9..32a48f623e2b 100644
--- a/include/asm-sparc/unistd.h
+++ b/include/asm-sparc/unistd.h
@@ -248,7 +248,7 @@
 #define __NR_setfsgid           229 /* Linux Specific                              */
 #define __NR__newselect         230 /* Linux Specific                              */
 #define __NR_time               231 /* Linux Specific                              */
-#define __NR_sys_splice         232 /* Linux Specific                              */
+#define __NR_splice             232 /* Linux Specific                              */
 #define __NR_stime              233 /* Linux Specific                              */
 #define __NR_statfs64           234 /* Linux Specific                              */
 #define __NR_fstatfs64          235 /* Linux Specific                              */
@@ -271,7 +271,7 @@
 #define __NR_getsid             252
 #define __NR_fdatasync          253
 #define __NR_nfsservctl         254
-#define __NR_sys_sync_file_range 255
+#define __NR_sync_file_range    255
 #define __NR_clock_settime      256
 #define __NR_clock_gettime      257
 #define __NR_clock_getres       258
diff --git a/include/asm-sparc64/unistd.h b/include/asm-sparc64/unistd.h
index 6ada6a871cc8..ca80e8aca128 100644
--- a/include/asm-sparc64/unistd.h
+++ b/include/asm-sparc64/unistd.h
@@ -250,7 +250,7 @@
 #ifdef __KERNEL__
 #define __NR_time               231 /* Linux sparc32                               */
 #endif
-#define __NR_sys_splice         232 /* Linux Specific                              */
+#define __NR_splice             232 /* Linux Specific                              */
 #define __NR_stime              233 /* Linux Specific                              */
 #define __NR_statfs64           234 /* Linux Specific                              */
 #define __NR_fstatfs64          235 /* Linux Specific                              */
@@ -273,7 +273,7 @@
 #define __NR_getsid             252
 #define __NR_fdatasync          253
 #define __NR_nfsservctl         254
-#define __NR_sys_sync_file_range 255
+#define __NR_sync_file_range    255
 #define __NR_clock_settime      256
 #define __NR_clock_gettime      257
 #define __NR_clock_getres       258
diff --git a/include/asm-x86_64/cache.h b/include/asm-x86_64/cache.h
index c8043a16152e..f8dff1c67538 100644
--- a/include/asm-x86_64/cache.h
+++ b/include/asm-x86_64/cache.h
@@ -20,8 +20,8 @@
        __attribute__((__section__(".data.page_aligned")))
 #endif
 
-#define __read_mostly __attribute__((__section__(".data.read_mostly")))
-
 #endif
 
+#define __read_mostly __attribute__((__section__(".data.read_mostly")))
+
 #endif
diff --git a/include/asm-x86_64/cpufeature.h b/include/asm-x86_64/cpufeature.h
index 76bb6193ae91..662964b74e34 100644
--- a/include/asm-x86_64/cpufeature.h
+++ b/include/asm-x86_64/cpufeature.h
@@ -64,6 +64,7 @@
 #define X86_FEATURE_REP_GOOD    (3*32+ 4) /* rep microcode works well on this CPU */
 #define X86_FEATURE_CONSTANT_TSC (3*32+5) /* TSC runs at constant rate */
 #define X86_FEATURE_SYNC_RDTSC  (3*32+6)  /* RDTSC syncs CPU core */
+#define X86_FEATURE_FXSAVE_LEAK (3*32+7)  /* FIP/FOP/FDP leaks through FXSAVE */
 
 /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */
 #define X86_FEATURE_XMM3        (4*32+ 0) /* Streaming SIMD Extensions-3 */
diff --git a/include/asm-x86_64/i387.h b/include/asm-x86_64/i387.h
index 876eb9a2fe78..cba8a3b0cded 100644
--- a/include/asm-x86_64/i387.h
+++ b/include/asm-x86_64/i387.h
@@ -72,6 +72,23 @@ extern int set_fpregs(struct task_struct *tsk,
 #define set_fpu_swd(t,val) ((t)->thread.i387.fxsave.swd = (val))
 #define set_fpu_fxsr_twd(t,val) ((t)->thread.i387.fxsave.twd = (val))
 
+#define X87_FSW_ES (1 << 7)     /* Exception Summary */
+
+/* AMD CPUs don't save/restore FDP/FIP/FOP unless an exception
+   is pending. Clear the x87 state here by setting it to fixed
+   values. The kernel data segment can be sometimes 0 and sometimes
+   new user value. Both should be ok.
+   Use the PDA as safe address because it should be already in L1. */
+static inline void clear_fpu_state(struct i387_fxsave_struct *fx)
+{
+        if (unlikely(fx->swd & X87_FSW_ES))
+                 asm volatile("fnclex");
+        alternative_input(ASM_NOP8 ASM_NOP2,
+                     "    emms\n"               /* clear stack tags */
+                     "    fildl %%gs:0",        /* load to clear state */
+                     X86_FEATURE_FXSAVE_LEAK);
+}
+
 static inline int restore_fpu_checking(struct i387_fxsave_struct *fx) 
 { 
         int err;
@@ -119,6 +136,7 @@ static inline int save_i387_checking(struct i387_fxsave_struct __user *fx)
 #endif
         if (unlikely(err))
                 __clear_user(fx, sizeof(struct i387_fxsave_struct));
+        /* No need to clear here because the caller clears USED_MATH */
         return err;
 } 
 
@@ -149,7 +167,7 @@ static inline void __fxsave_clear(struct task_struct *tsk)
                                 "i" (offsetof(__typeof__(*tsk),
                                               thread.i387.fxsave)));
 #endif
-        __asm__ __volatile__("fnclex");
+        clear_fpu_state(&tsk->thread.i387.fxsave);
 }
 
 static inline void kernel_fpu_begin(void)
diff --git a/include/asm-x86_64/mmzone.h b/include/asm-x86_64/mmzone.h
index 6b18cd8f293d..6944e7122df5 100644
--- a/include/asm-x86_64/mmzone.h
+++ b/include/asm-x86_64/mmzone.h
@@ -12,7 +12,8 @@
 
 #include <asm/smp.h>
 
-#define NODEMAPSIZE 0xfff
+/* Should really switch to dynamic allocation at some point */
+#define NODEMAPSIZE 0x4fff
 
 /* Simple perfect hash to map physical addresses to node numbers */
 struct memnode {
diff --git a/include/asm-x86_64/percpu.h b/include/asm-x86_64/percpu.h
index 4405b4adeaba..7f33aaf9f7b1 100644
--- a/include/asm-x86_64/percpu.h
+++ b/include/asm-x86_64/percpu.h
@@ -26,7 +26,7 @@
 #define percpu_modcopy(pcpudst, src, size)                      \
 do {                                                            \
         unsigned int __i;                                       \
-        for_each_cpu(__i)                                       \
+        for_each_possible_cpu(__i)                              \
                 memcpy((pcpudst)+__per_cpu_offset(__i),         \
                        (src), (size));                          \
 } while (0)
diff --git a/include/asm-x86_64/unistd.h b/include/asm-x86_64/unistd.h
index d86494e23b63..feb77cb8c044 100644
--- a/include/asm-x86_64/unistd.h
+++ b/include/asm-x86_64/unistd.h
@@ -613,8 +613,12 @@ __SYSCALL(__NR_get_robust_list, sys_get_robust_list)
 __SYSCALL(__NR_splice, sys_splice)
 #define __NR_tee                276
 __SYSCALL(__NR_tee, sys_tee)
+#define __NR_sync_file_range    277
+__SYSCALL(__NR_sync_file_range, sys_sync_file_range)
+#define __NR_vmsplice           278
+__SYSCALL(__NR_vmsplice, sys_vmsplice)
 
-#define __NR_syscall_max __NR_tee
+#define __NR_syscall_max __NR_vmsplice
 
 #ifndef __NO_STUBS
 
diff --git a/include/asm-xtensa/ioctls.h b/include/asm-xtensa/ioctls.h
index 10c443435c11..3b89a772d0a0 100644
--- a/include/asm-xtensa/ioctls.h
+++ b/include/asm-xtensa/ioctls.h
@@ -107,6 +107,6 @@
 #define TIOCSERSETMULTI _IOW('T', 91, struct serial_multiport_struct) /* Set multiport config */
 
 #define TIOCMIWAIT      _IO('T', 92) /* wait for a change on serial input line(s) */
-#define TIOCGICOUNT     _IOR('T', 93, struct async_icount) /* read serial port inline interrupt counts */
+#define TIOCGICOUNT     0x545D  /* read serial port inline interrupt counts */
 
 #endif /* _XTENSA_IOCTLS_H */
diff --git a/include/linux/ide.h b/include/linux/ide.h
index 8d2db412ba9c..a8bef1d1371c 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -1220,7 +1220,6 @@ typedef struct ide_pci_enablebit_s {
 enum {
         /* Uses ISA control ports not PCI ones. */
         IDEPCI_FLAG_ISA_PORTS           = (1 << 0),
-        IDEPCI_FLAG_FORCE_PDC           = (1 << 1),
 };
 
 typedef struct ide_pci_device_s {
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index 4ca3e6ad03ec..911206386171 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -99,10 +99,7 @@ static inline int __remove_pages(struct zone *zone, unsigned long start_pfn,
         return -ENOSYS;
 }
 
-#if defined(CONFIG_MEMORY_HOTPLUG) || defined(CONFIG_ACPI_HOTPLUG_MEMORY) \
-        || defined(CONFIG_ACPI_HOTPLUG_MEMORY_MODULE)
 extern int add_memory(u64 start, u64 size);
 extern int remove_memory(u64 start, u64 size);
-#endif
 
 #endif /* __LINUX_MEMORY_HOTPLUG_H */
diff --git a/include/linux/mv643xx.h b/include/linux/mv643xx.h
index 955d3069d727..edfa012fad3a 100644
--- a/include/linux/mv643xx.h
+++ b/include/linux/mv643xx.h
@@ -13,7 +13,7 @@
 #ifndef __ASM_MV643XX_H
 #define __ASM_MV643XX_H
 
-#ifdef __MIPS__
+#ifdef __mips__
 #include <asm/addrspace.h>
 #include <asm/marvell.h>
 #endif
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 40ccf8cc4239..01db7b88a2b1 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -829,19 +829,21 @@ static inline void netif_rx_schedule(struct net_device *dev)
                 __netif_rx_schedule(dev);
 }
 
-/* Try to reschedule poll. Called by dev->poll() after netif_rx_complete().
- * Do not inline this?
- */
+
+static inline void  __netif_rx_reschedule(struct net_device *dev, int undo)
+{
+        dev->quota += undo;
+        list_add_tail(&dev->poll_list, &__get_cpu_var(softnet_data).poll_list);
+        __raise_softirq_irqoff(NET_RX_SOFTIRQ);
+}
+
+/* Try to reschedule poll. Called by dev->poll() after netif_rx_complete(). */
 static inline int netif_rx_reschedule(struct net_device *dev, int undo)
 {
         if (netif_rx_schedule_prep(dev)) {
                 unsigned long flags;
-
-                dev->quota += undo;
-
                 local_irq_save(flags);
-                list_add_tail(&dev->poll_list, &__get_cpu_var(softnet_data).poll_list);
-                __raise_softirq_irqoff(NET_RX_SOFTIRQ);
+                __netif_rx_reschedule(dev, undo);
                 local_irq_restore(flags);
                 return 1;
         }
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index f6bdef82a322..38701454e197 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -361,7 +361,11 @@ struct compat_xt_entry_target
 
 struct compat_xt_counters
 {
+#if defined(CONFIG_X86_64) || defined(CONFIG_IA64)
         u_int32_t cnt[4];
+#else
+        u_int64_t cnt[2];
+#endif
 };
 
 struct compat_xt_counters_info
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 8d03e10212f5..d6fe048376ab 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -356,6 +356,10 @@
 #define PCI_DEVICE_ID_ATI_IXP300_SATA   0x436e
 #define PCI_DEVICE_ID_ATI_IXP400_IDE    0x4376
 #define PCI_DEVICE_ID_ATI_IXP400_SATA   0x4379
+#define PCI_DEVICE_ID_ATI_IXP400_SATA2  0x437a
+#define PCI_DEVICE_ID_ATI_IXP600_SATA   0x4380
+#define PCI_DEVICE_ID_ATI_IXP600_SRAID  0x4381
+#define PCI_DEVICE_ID_ATI_IXP600_IDE    0x438c
 
 #define PCI_VENDOR_ID_VLSI              0x1004
 #define PCI_DEVICE_ID_VLSI_82C592       0x0005
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index ef7f33c0be19..0008d4bd4059 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -61,4 +61,21 @@ void __free_pipe_info(struct pipe_inode_info *);
                                  /* from/to, of course */
 #define SPLICE_F_MORE   (0x04)  /* expect more data */
 
+/*
+ * Passed to the actors
+ */
+struct splice_desc {
+        unsigned int len, total_len;    /* current and remaining length */
+        unsigned int flags;             /* splice flags */
+        struct file *file;              /* file to read/write */
+        loff_t pos;                     /* file position */
+};
+
+typedef int (splice_actor)(struct pipe_inode_info *, struct pipe_buffer *,
+                           struct splice_desc *);
+
+extern ssize_t splice_from_pipe(struct pipe_inode_info *, struct file *,
+                                loff_t *, size_t, unsigned int,
+                                splice_actor *);
+
 #endif
diff --git a/include/linux/sched.h b/include/linux/sched.h
index b7d31e2e1729..29b7d4f87d20 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1192,8 +1192,7 @@ extern void wait_task_inactive(task_t * p);
 #define remove_parent(p)        list_del_init(&(p)->sibling)
 #define add_parent(p)           list_add_tail(&(p)->sibling,&(p)->parent->children)
 
-#define next_task(p)    list_entry((p)->tasks.next, struct task_struct, tasks)
-#define prev_task(p)    list_entry((p)->tasks.prev, struct task_struct, tasks)
+#define next_task(p)    list_entry(rcu_dereference((p)->tasks.next), struct task_struct, tasks)
 
 #define for_each_process(p) \
         for (p = &init_task ; (p = next_task(p)) != &init_task ; )
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index c4619a428d9b..f8f234708b98 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -344,6 +344,13 @@ extern void	      skb_over_panic(struct sk_buff *skb, int len,
                                      void *here);
 extern void           skb_under_panic(struct sk_buff *skb, int len,
                                       void *here);
+extern void           skb_truesize_bug(struct sk_buff *skb);
+
+static inline void skb_truesize_check(struct sk_buff *skb)
+{
+        if (unlikely((int)skb->truesize < sizeof(struct sk_buff) + skb->len))
+                skb_truesize_bug(skb);
+}
 
 extern int skb_append_datato_frags(struct sock *sk, struct sk_buff *skb,
                         int getfrag(void *from, char *to, int offset,
diff --git a/include/linux/sunrpc/metrics.h b/include/linux/sunrpc/metrics.h
index 8f96e9dc369a..77f78e56c481 100644
--- a/include/linux/sunrpc/metrics.h
+++ b/include/linux/sunrpc/metrics.h
@@ -69,9 +69,21 @@ struct rpc_clnt;
 /*
  * EXPORTed functions for managing rpc_iostats structures
  */
+
+#ifdef CONFIG_PROC_FS
+
 struct rpc_iostats *    rpc_alloc_iostats(struct rpc_clnt *);
 void                    rpc_count_iostats(struct rpc_task *);
 void                    rpc_print_iostats(struct seq_file *, struct rpc_clnt *);
 void                    rpc_free_iostats(struct rpc_iostats *);
 
+#else  /*  CONFIG_PROC_FS  */
+
+static inline struct rpc_iostats *rpc_alloc_iostats(struct rpc_clnt *clnt) { return NULL; }
+static inline void rpc_count_iostats(struct rpc_task *task) {}
+static inline void rpc_print_iostats(struct seq_file *seq, struct rpc_clnt *clnt) {}
+static inline void rpc_free_iostats(struct rpc_iostats *stats) {}
+
+#endif  /*  CONFIG_PROC_FS  */
+
 #endif /* _LINUX_SUNRPC_METRICS_H */
diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
index 7eebbab7160b..e8bbe8118de8 100644
--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -53,6 +53,7 @@ struct rpc_timeout {
 
 struct rpc_task;
 struct rpc_xprt;
+struct seq_file;
 
 /*
  * This describes a complete RPC request
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index d3ebc0e68b2b..3996960fc565 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -574,6 +574,9 @@ asmlinkage long sys_splice(int fd_in, loff_t __user *off_in,
                            int fd_out, loff_t __user *off_out,
                            size_t len, unsigned int flags);
 
+asmlinkage long sys_vmsplice(int fd, const struct iovec __user *iov,
+                             unsigned long nr_segs, unsigned int flags);
+
 asmlinkage long sys_tee(int fdin, int fdout, size_t len, unsigned int flags);
 
 asmlinkage long sys_sync_file_range(int fd, loff_t offset, loff_t nbytes,
diff --git a/include/net/ieee80211softmac.h b/include/net/ieee80211softmac.h
index b971d8c82bdd..b1ebfbae397f 100644
--- a/include/net/ieee80211softmac.h
+++ b/include/net/ieee80211softmac.h
@@ -96,10 +96,13 @@ struct ieee80211softmac_assoc_info {
          *
          * bssvalid is true if we found a matching network
          * and saved it's BSSID into the bssid above.
+         *
+         * bssfixed is used for SIOCSIWAP.
          */
         u8 static_essid:1,
            associating:1,
-           bssvalid:1;
+           bssvalid:1,
+           bssfixed:1;
 
         /* Scan retries remaining */
         int scan_retry;
@@ -267,8 +270,9 @@ extern void ieee80211softmac_stop(struct net_device *dev);
 #define IEEE80211SOFTMAC_EVENT_AUTH_FAILED              5
 #define IEEE80211SOFTMAC_EVENT_AUTH_TIMEOUT             6
 #define IEEE80211SOFTMAC_EVENT_ASSOCIATE_NET_NOT_FOUND  7
+#define IEEE80211SOFTMAC_EVENT_DISASSOCIATED            8
 /* keep this updated! */
-#define IEEE80211SOFTMAC_EVENT_LAST                     7
+#define IEEE80211SOFTMAC_EVENT_LAST                     8
 /*
  * If you want to be notified of certain events, you can call
  * ieee80211softmac_notify[_atomic] with
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 6d6f0634ae41..4abedb8eaece 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -230,7 +230,7 @@ extern int 			ip6_ra_control(struct sock *sk, int sel,
                                                void (*destructor)(struct sock *));
 
 
-extern int                      ipv6_parse_hopopts(struct sk_buff *skb, int);
+extern int                      ipv6_parse_hopopts(struct sk_buff *skb);
 
 extern struct ipv6_txoptions *  ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt);
 extern struct ipv6_txoptions *  ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
diff --git a/include/net/sock.h b/include/net/sock.h
index af2b0544586e..ff8b0dad7b0f 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -454,6 +454,7 @@ static inline void sk_stream_set_owner_r(struct sk_buff *skb, struct sock *sk)
 
 static inline void sk_stream_free_skb(struct sock *sk, struct sk_buff *skb)
 {
+        skb_truesize_check(skb);
         sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
         sk->sk_wmem_queued   -= skb->truesize;
         sk->sk_forward_alloc += skb->truesize;