22 files changed, 725 insertions, 235 deletions

diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index a85ea9d37f05..ff7ae6b664e8 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -271,6 +271,25 @@ config SCHED_SMT
           Intel IA64 chips with MultiThreading at a cost of slightly increased
           overhead in some places. If unsure say N here.
 
+config PERMIT_BSP_REMOVE
+        bool "Support removal of Bootstrap Processor"
+        depends on HOTPLUG_CPU
+        default n
+        ---help---
+        Say Y here if your platform SAL will support removal of BSP with HOTPLUG_CPU
+        support. 
+
+config FORCE_CPEI_RETARGET
+        bool "Force assumption that CPEI can be re-targetted"
+        depends on PERMIT_BSP_REMOVE
+        default n
+        ---help---
+        Say Y if you need to force the assumption that CPEI can be re-targetted to
+        any cpu in the system. This hint is available via ACPI 3.0 specifications.
+        Tiger4 systems are capable of re-directing CPEI to any CPU other than BSP.
+        This option it useful to enable this feature on older BIOS's as well.
+        You can also enable this by using boot command line option force_cpei=1.
+
 config PREEMPT
         bool "Preemptible Kernel"
         help
diff --git a/arch/ia64/configs/tiger_defconfig b/arch/ia64/configs/tiger_defconfig
index 125568118b84..766bf4955432 100644
--- a/arch/ia64/configs/tiger_defconfig
+++ b/arch/ia64/configs/tiger_defconfig
@@ -116,6 +116,8 @@ CONFIG_FORCE_MAX_ZONEORDER=17
 CONFIG_SMP=y
 CONFIG_NR_CPUS=4
 CONFIG_HOTPLUG_CPU=y
+CONFIG_PERMIT_BSP_REMOVE=y
+CONFIG_FORCE_CPEI_RETARGET=y
 # CONFIG_SCHED_SMT is not set
 # CONFIG_PREEMPT is not set
 CONFIG_SELECT_MEMORY_MODEL=y
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index ecd44bdc8394..4722ec51c70c 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -284,19 +284,24 @@ acpi_parse_plat_int_src(acpi_table_entry_header * header,
         return 0;
 }
 
+#ifdef CONFIG_HOTPLUG_CPU
 unsigned int can_cpei_retarget(void)
 {
         extern int cpe_vector;
+        extern unsigned int force_cpei_retarget;
 
         /*
          * Only if CPEI is supported and the override flag
          * is present, otherwise return that its re-targettable
          * if we are in polling mode.
          */
-        if (cpe_vector > 0 && !acpi_cpei_override)
-                return 0;
-        else
-                return 1;
+        if (cpe_vector > 0) {
+                if (acpi_cpei_override || force_cpei_retarget)
+                        return 1;
+                else
+                        return 0;
+        }
+        return 1;
 }
 
 unsigned int is_cpu_cpei_target(unsigned int cpu)
@@ -315,6 +320,7 @@ void set_cpei_target_cpu(unsigned int cpu)
 {
         acpi_cpei_phys_cpuid = cpu_physical_id(cpu);
 }
+#endif
 
 unsigned int get_cpei_target_cpu(void)
 {
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index 930fdfca6ddb..0e3eda99e549 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -1102,9 +1102,6 @@ skip_rbs_switch:
         st8 [r2]=r8
         st8 [r3]=r10
 .work_pending:
-        tbit.nz p6,p0=r31,TIF_SIGDELAYED                // signal delayed from  MCA/INIT/NMI/PMI context?
-(p6)    br.cond.sptk.few .sigdelayed
-        ;;
         tbit.z p6,p0=r31,TIF_NEED_RESCHED               // current_thread_info()->need_resched==0?
 (p6)    br.cond.sptk.few .notify
 #ifdef CONFIG_PREEMPT
@@ -1131,17 +1128,6 @@ skip_rbs_switch:
 (pLvSys)br.cond.sptk.few  .work_pending_syscall_end
         br.cond.sptk.many .work_processed_kernel        // don't re-check
 
-// There is a delayed signal that was detected in MCA/INIT/NMI/PMI context where
-// it could not be delivered.  Deliver it now.  The signal might be for us and
-// may set TIF_SIGPENDING, so redrive ia64_leave_* after processing the delayed
-// signal.
-
-.sigdelayed:
-        br.call.sptk.many rp=do_sigdelayed
-        cmp.eq p6,p0=r0,r0                              // p6 <- 1, always re-check
-(pLvSys)br.cond.sptk.few  .work_pending_syscall_end
-        br.cond.sptk.many .work_processed_kernel        // re-check
-
 .work_pending_syscall_end:
         adds r2=PT(R8)+16,r12
         adds r3=PT(R10)+16,r12
diff --git a/arch/ia64/kernel/iosapic.c b/arch/ia64/kernel/iosapic.c
index 574084f343fa..8832c553230a 100644
--- a/arch/ia64/kernel/iosapic.c
+++ b/arch/ia64/kernel/iosapic.c
@@ -631,6 +631,7 @@ get_target_cpu (unsigned int gsi, int vector)
 {
 #ifdef CONFIG_SMP
         static int cpu = -1;
+        extern int cpe_vector;
 
         /*
          * In case of vector shared by multiple RTEs, all RTEs that
@@ -653,6 +654,11 @@ get_target_cpu (unsigned int gsi, int vector)
         if (!cpu_online(smp_processor_id()))
                 return cpu_physical_id(smp_processor_id());
 
+#ifdef CONFIG_ACPI
+        if (cpe_vector > 0 && vector == IA64_CPEP_VECTOR)
+                return get_cpei_target_cpu();
+#endif
+
 #ifdef CONFIG_NUMA
         {
                 int num_cpus, cpu_index, iosapic_index, numa_cpu, i = 0;
diff --git a/arch/ia64/kernel/irq.c b/arch/ia64/kernel/irq.c
index d33244c32759..5ce908ef9c95 100644
--- a/arch/ia64/kernel/irq.c
+++ b/arch/ia64/kernel/irq.c
@@ -163,8 +163,19 @@ void fixup_irqs(void)
 {
         unsigned int irq;
         extern void ia64_process_pending_intr(void);
+        extern void ia64_disable_timer(void);
+        extern volatile int time_keeper_id;
+
+        ia64_disable_timer();
+
+        /*
+         * Find a new timesync master
+         */
+        if (smp_processor_id() == time_keeper_id) {
+                time_keeper_id = first_cpu(cpu_online_map);
+                printk ("CPU %d is now promoted to time-keeper master\n", time_keeper_id);
+        }
 
-        ia64_set_itv(1<<16);
         /*
          * Phase 1: Locate irq's bound to this cpu and
          * relocate them for cpu removal.
diff --git a/arch/ia64/kernel/mca.c b/arch/ia64/kernel/mca.c
index ee7eec9ee576..b57e723f194c 100644
--- a/arch/ia64/kernel/mca.c
+++ b/arch/ia64/kernel/mca.c
@@ -281,14 +281,10 @@ ia64_mca_log_sal_error_record(int sal_info_type)
                 ia64_sal_clear_state_info(sal_info_type);
 }
 
-/*
- * platform dependent error handling
- */
-#ifndef PLATFORM_MCA_HANDLERS
-
 #ifdef CONFIG_ACPI
 
 int cpe_vector = -1;
+int ia64_cpe_irq = -1;
 
 static irqreturn_t
 ia64_mca_cpe_int_handler (int cpe_irq, void *arg, struct pt_regs *ptregs)
@@ -377,8 +373,6 @@ ia64_mca_register_cpev (int cpev)
 }
 #endif /* CONFIG_ACPI */
 
-#endif /* PLATFORM_MCA_HANDLERS */
-
 /*
  * ia64_mca_cmc_vector_setup
  *
@@ -630,6 +624,32 @@ copy_reg(const u64 *fr, u64 fnat, u64 *tr, u64 *tnat)
         *tnat |= (nat << tslot);
 }
 
+/* Change the comm field on the MCA/INT task to include the pid that
+ * was interrupted, it makes for easier debugging.  If that pid was 0
+ * (swapper or nested MCA/INIT) then use the start of the previous comm
+ * field suffixed with its cpu.
+ */
+
+static void
+ia64_mca_modify_comm(const task_t *previous_current)
+{
+        char *p, comm[sizeof(current->comm)];
+        if (previous_current->pid)
+                snprintf(comm, sizeof(comm), "%s %d",
+                        current->comm, previous_current->pid);
+        else {
+                int l;
+                if ((p = strchr(previous_current->comm, ' ')))
+                        l = p - previous_current->comm;
+                else
+                        l = strlen(previous_current->comm);
+                snprintf(comm, sizeof(comm), "%s %*s %d",
+                        current->comm, l, previous_current->comm,
+                        task_thread_info(previous_current)->cpu);
+        }
+        memcpy(current->comm, comm, sizeof(current->comm));
+}
+
 /* On entry to this routine, we are running on the per cpu stack, see
  * mca_asm.h.  The original stack has not been touched by this event.  Some of
  * the original stack's registers will be in the RBS on this stack.  This stack
@@ -648,7 +668,7 @@ ia64_mca_modify_original_stack(struct pt_regs *regs,
                 struct ia64_sal_os_state *sos,
                 const char *type)
 {
-        char *p, comm[sizeof(current->comm)];
+        char *p;
         ia64_va va;
         extern char ia64_leave_kernel[];        /* Need asm address, not function descriptor */
         const pal_min_state_area_t *ms = sos->pal_min_state;
@@ -721,6 +741,10 @@ ia64_mca_modify_original_stack(struct pt_regs *regs,
         /* Verify the previous stack state before we change it */
         if (user_mode(regs)) {
                 msg = "occurred in user space";
+                /* previous_current is guaranteed to be valid when the task was
+                 * in user space, so ...
+                 */
+                ia64_mca_modify_comm(previous_current);
                 goto no_mod;
         }
         if (r13 != sos->prev_IA64_KR_CURRENT) {
@@ -750,25 +774,7 @@ ia64_mca_modify_original_stack(struct pt_regs *regs,
                 goto no_mod;
         }
 
-        /* Change the comm field on the MCA/INT task to include the pid that
-         * was interrupted, it makes for easier debugging.  If that pid was 0
-         * (swapper or nested MCA/INIT) then use the start of the previous comm
-         * field suffixed with its cpu.
-         */
-        if (previous_current->pid)
-                snprintf(comm, sizeof(comm), "%s %d",
-                        current->comm, previous_current->pid);
-        else {
-                int l;
-                if ((p = strchr(previous_current->comm, ' ')))
-                        l = p - previous_current->comm;
-                else
-                        l = strlen(previous_current->comm);
-                snprintf(comm, sizeof(comm), "%s %*s %d",
-                        current->comm, l, previous_current->comm,
-                        task_thread_info(previous_current)->cpu);
-        }
-        memcpy(current->comm, comm, sizeof(current->comm));
+        ia64_mca_modify_comm(previous_current);
 
         /* Make the original task look blocked.  First stack a struct pt_regs,
          * describing the state at the time of interrupt.  mca_asm.S built a
@@ -908,7 +914,7 @@ no_mod:
 static void
 ia64_wait_for_slaves(int monarch)
 {
-        int c, wait = 0;
+        int c, wait = 0, missing = 0;
         for_each_online_cpu(c) {
                 if (c == monarch)
                         continue;
@@ -919,15 +925,32 @@ ia64_wait_for_slaves(int monarch)
                 }
         }
         if (!wait)
-                return;
+                goto all_in;
         for_each_online_cpu(c) {
                 if (c == monarch)
                         continue;
                 if (ia64_mc_info.imi_rendez_checkin[c] == IA64_MCA_RENDEZ_CHECKIN_NOTDONE) {
                         udelay(5*1000000);      /* wait 5 seconds for slaves (arbitrary) */
+                        if (ia64_mc_info.imi_rendez_checkin[c] == IA64_MCA_RENDEZ_CHECKIN_NOTDONE)
+                                missing = 1;
                         break;
                 }
         }
+        if (!missing)
+                goto all_in;
+        printk(KERN_INFO "OS MCA slave did not rendezvous on cpu");
+        for_each_online_cpu(c) {
+                if (c == monarch)
+                        continue;
+                if (ia64_mc_info.imi_rendez_checkin[c] == IA64_MCA_RENDEZ_CHECKIN_NOTDONE)
+                        printk(" %d", c);
+        }
+        printk("\n");
+        return;
+
+all_in:
+        printk(KERN_INFO "All OS MCA slaves have reached rendezvous\n");
+        return;
 }
 
 /*
@@ -953,6 +976,10 @@ ia64_mca_handler(struct pt_regs *regs, struct switch_stack *sw,
         task_t *previous_current;
 
         oops_in_progress = 1;   /* FIXME: make printk NMI/MCA/INIT safe */
+        console_loglevel = 15;  /* make sure printks make it to console */
+        printk(KERN_INFO "Entered OS MCA handler. PSP=%lx cpu=%d monarch=%ld\n",
+                sos->proc_state_param, cpu, sos->monarch);
+
         previous_current = ia64_mca_modify_original_stack(regs, sw, sos, "MCA");
         monarch_cpu = cpu;
         if (notify_die(DIE_MCA_MONARCH_ENTER, "MCA", regs, 0, 0, 0)
@@ -1444,11 +1471,13 @@ void __devinit
 ia64_mca_cpu_init(void *cpu_data)
 {
         void *pal_vaddr;
+        static int first_time = 1;
 
-        if (smp_processor_id() == 0) {
+        if (first_time) {
                 void *mca_data;
                 int cpu;
 
+                first_time = 0;
                 mca_data = alloc_bootmem(sizeof(struct ia64_mca_cpu)
                                          * NR_CPUS + KERNEL_STACK_SIZE);
                 mca_data = (void *)(((unsigned long)mca_data +
@@ -1704,6 +1733,7 @@ ia64_mca_late_init(void)
                                         desc = irq_descp(irq);
                                         desc->status |= IRQ_PER_CPU;
                                         setup_irq(irq, &mca_cpe_irqaction);
+                                        ia64_cpe_irq = irq;
                                 }
                         ia64_mca_register_cpev(cpe_vector);
                         IA64_MCA_DEBUG("%s: CPEI/P setup and enabled.\n", __FUNCTION__);
diff --git a/arch/ia64/kernel/perfmon.c b/arch/ia64/kernel/perfmon.c
index 9c5194b385da..077f21216b65 100644
--- a/arch/ia64/kernel/perfmon.c
+++ b/arch/ia64/kernel/perfmon.c
@@ -6722,6 +6722,7 @@ __initcall(pfm_init);
 void
 pfm_init_percpu (void)
 {
+        static int first_time=1;
         /*
          * make sure no measurement is active
          * (may inherit programmed PMCs from EFI).
@@ -6734,8 +6735,10 @@ pfm_init_percpu (void)
          */
         pfm_unfreeze_pmu();
 
-        if (smp_processor_id() == 0)
+        if (first_time) {
                 register_percpu_irq(IA64_PERFMON_VECTOR, &perfmon_irqaction);
+                first_time=0;
+        }
 
         ia64_setreg(_IA64_REG_CR_PMV, IA64_PERFMON_VECTOR);
         ia64_srlz_d();
diff --git a/arch/ia64/kernel/signal.c b/arch/ia64/kernel/signal.c
index 463f6bb44d07..1d7903ee2126 100644
--- a/arch/ia64/kernel/signal.c
+++ b/arch/ia64/kernel/signal.c
@@ -588,104 +588,3 @@ ia64_do_signal (sigset_t *oldset, struct sigscratch *scr, long in_syscall)
         }
         return 0;
 }
-
-/* Set a delayed signal that was detected in MCA/INIT/NMI/PMI context where it
- * could not be delivered.  It is important that the target process is not
- * allowed to do any more work in user space.  Possible cases for the target
- * process:
- *
- * - It is sleeping and will wake up soon.  Store the data in the current task,
- *   the signal will be sent when the current task returns from the next
- *   interrupt.
- *
- * - It is running in user context.  Store the data in the current task, the
- *   signal will be sent when the current task returns from the next interrupt.
- *
- * - It is running in kernel context on this or another cpu and will return to
- *   user context.  Store the data in the target task, the signal will be sent
- *   to itself when the target task returns to user space.
- *
- * - It is running in kernel context on this cpu and will sleep before
- *   returning to user context.  Because this is also the current task, the
- *   signal will not get delivered and the task could sleep indefinitely.
- *   Store the data in the idle task for this cpu, the signal will be sent
- *   after the idle task processes its next interrupt.
- *
- * To cover all cases, store the data in the target task, the current task and
- * the idle task on this cpu.  Whatever happens, the signal will be delivered
- * to the target task before it can do any useful user space work.  Multiple
- * deliveries have no unwanted side effects.
- *
- * Note: This code is executed in MCA/INIT/NMI/PMI context, with interrupts
- * disabled.  It must not take any locks nor use kernel structures or services
- * that require locks.
- */
-
-/* To ensure that we get the right pid, check its start time.  To avoid extra
- * include files in thread_info.h, convert the task start_time to unsigned long,
- * giving us a cycle time of > 580 years.
- */
-static inline unsigned long
-start_time_ul(const struct task_struct *t)
-{
-        return t->start_time.tv_sec * NSEC_PER_SEC + t->start_time.tv_nsec;
-}
-
-void
-set_sigdelayed(pid_t pid, int signo, int code, void __user *addr)
-{
-        struct task_struct *t;
-        unsigned long start_time =  0;
-        int i;
-
-        for (i = 1; i <= 3; ++i) {
-                switch (i) {
-                case 1:
-                        t = find_task_by_pid(pid);
-                        if (t)
-                                start_time = start_time_ul(t);
-                        break;
-                case 2:
-                        t = current;
-                        break;
-                default:
-                        t = idle_task(smp_processor_id());
-                        break;
-                }
-
-                if (!t)
-                        return;
-                task_thread_info(t)->sigdelayed.signo = signo;
-                task_thread_info(t)->sigdelayed.code = code;
-                task_thread_info(t)->sigdelayed.addr = addr;
-                task_thread_info(t)->sigdelayed.start_time = start_time;
-                task_thread_info(t)->sigdelayed.pid = pid;
-                wmb();
-                set_tsk_thread_flag(t, TIF_SIGDELAYED);
-        }
-}
-
-/* Called from entry.S when it detects TIF_SIGDELAYED, a delayed signal that
- * was detected in MCA/INIT/NMI/PMI context where it could not be delivered.
- */
-
-void
-do_sigdelayed(void)
-{
-        struct siginfo siginfo;
-        pid_t pid;
-        struct task_struct *t;
-
-        clear_thread_flag(TIF_SIGDELAYED);
-        memset(&siginfo, 0, sizeof(siginfo));
-        siginfo.si_signo = current_thread_info()->sigdelayed.signo;
-        siginfo.si_code = current_thread_info()->sigdelayed.code;
-        siginfo.si_addr = current_thread_info()->sigdelayed.addr;
-        pid = current_thread_info()->sigdelayed.pid;
-        t = find_task_by_pid(pid);
-        if (!t)
-                return;
-        if (current_thread_info()->sigdelayed.start_time != start_time_ul(t))
-                return;
-        force_sig_info(siginfo.si_signo, &siginfo, t);
-}
diff --git a/arch/ia64/kernel/smpboot.c b/arch/ia64/kernel/smpboot.c
index b681ef34a86e..c4b633b36dab 100644
--- a/arch/ia64/kernel/smpboot.c
+++ b/arch/ia64/kernel/smpboot.c
@@ -70,6 +70,12 @@
 #endif
 
 #ifdef CONFIG_HOTPLUG_CPU
+#ifdef CONFIG_PERMIT_BSP_REMOVE
+#define bsp_remove_ok   1
+#else
+#define bsp_remove_ok   0
+#endif
+
 /*
  * Store all idle threads, this can be reused instead of creating
  * a new thread. Also avoids complicated thread destroy functionality
@@ -104,7 +110,7 @@ struct sal_to_os_boot *sal_state_for_booting_cpu = &sal_boot_rendez_state[0];
 /*
  * ITC synchronization related stuff:
  */
-#define MASTER  0
+#define MASTER  (0)
 #define SLAVE   (SMP_CACHE_BYTES/8)
 
 #define NUM_ROUNDS      64      /* magic value */
@@ -151,6 +157,27 @@ char __initdata no_int_routing;
 
 unsigned char smp_int_redirect; /* are INT and IPI redirectable by the chipset? */
 
+#ifdef CONFIG_FORCE_CPEI_RETARGET
+#define CPEI_OVERRIDE_DEFAULT   (1)
+#else
+#define CPEI_OVERRIDE_DEFAULT   (0)
+#endif
+
+unsigned int force_cpei_retarget = CPEI_OVERRIDE_DEFAULT;
+
+static int __init
+cmdl_force_cpei(char *str)
+{
+        int value=0;
+
+        get_option (&str, &value);
+        force_cpei_retarget = value;
+
+        return 1;
+}
+
+__setup("force_cpei=", cmdl_force_cpei);
+
 static int __init
 nointroute (char *str)
 {
@@ -161,6 +188,27 @@ nointroute (char *str)
 
 __setup("nointroute", nointroute);
 
+static void fix_b0_for_bsp(void)
+{
+#ifdef CONFIG_HOTPLUG_CPU
+        int cpuid;
+        static int fix_bsp_b0 = 1;
+
+        cpuid = smp_processor_id();
+
+        /*
+         * Cache the b0 value on the first AP that comes up
+         */
+        if (!(fix_bsp_b0 && cpuid))
+                return;
+
+        sal_boot_rendez_state[0].br[0] = sal_boot_rendez_state[cpuid].br[0];
+        printk ("Fixed BSP b0 value from CPU %d\n", cpuid);
+
+        fix_bsp_b0 = 0;
+#endif
+}
+
 void
 sync_master (void *arg)
 {
@@ -327,8 +375,9 @@ smp_setup_percpu_timer (void)
 static void __devinit
 smp_callin (void)
 {
-        int cpuid, phys_id;
+        int cpuid, phys_id, itc_master;
         extern void ia64_init_itm(void);
+        extern volatile int time_keeper_id;
 
 #ifdef CONFIG_PERFMON
         extern void pfm_init_percpu(void);
@@ -336,6 +385,7 @@ smp_callin (void)
 
         cpuid = smp_processor_id();
         phys_id = hard_smp_processor_id();
+        itc_master = time_keeper_id;
 
         if (cpu_online(cpuid)) {
                 printk(KERN_ERR "huh, phys CPU#0x%x, CPU#0x%x already present??\n",
@@ -343,6 +393,8 @@ smp_callin (void)
                 BUG();
         }
 
+        fix_b0_for_bsp();
+
         lock_ipi_calllock();
         cpu_set(cpuid, cpu_online_map);
         unlock_ipi_calllock();
@@ -365,8 +417,8 @@ smp_callin (void)
                  * calls spin_unlock_bh(), which calls spin_unlock_bh(), which calls
                  * local_bh_enable(), which bugs out if irqs are not enabled...
                  */
-                Dprintk("Going to syncup ITC with BP.\n");
-                ia64_sync_itc(0);
+                Dprintk("Going to syncup ITC with ITC Master.\n");
+                ia64_sync_itc(itc_master);
         }
 
         /*
@@ -635,6 +687,47 @@ remove_siblinginfo(int cpu)
 }
 
 extern void fixup_irqs(void);
+
+int migrate_platform_irqs(unsigned int cpu)
+{
+        int new_cpei_cpu;
+        irq_desc_t *desc = NULL;
+        cpumask_t       mask;
+        int             retval = 0;
+
+        /*
+         * dont permit CPEI target to removed.
+         */
+        if (cpe_vector > 0 && is_cpu_cpei_target(cpu)) {
+                printk ("CPU (%d) is CPEI Target\n", cpu);
+                if (can_cpei_retarget()) {
+                        /*
+                         * Now re-target the CPEI to a different processor
+                         */
+                        new_cpei_cpu = any_online_cpu(cpu_online_map);
+                        mask = cpumask_of_cpu(new_cpei_cpu);
+                        set_cpei_target_cpu(new_cpei_cpu);
+                        desc = irq_descp(ia64_cpe_irq);
+                        /*
+                         * Switch for now, immediatly, we need to do fake intr
+                         * as other interrupts, but need to study CPEI behaviour with
+                         * polling before making changes.
+                         */
+                        if (desc) {
+                                desc->handler->disable(ia64_cpe_irq);
+                                desc->handler->set_affinity(ia64_cpe_irq, mask);
+                                desc->handler->enable(ia64_cpe_irq);
+                                printk ("Re-targetting CPEI to cpu %d\n", new_cpei_cpu);
+                        }
+                }
+                if (!desc) {
+                        printk ("Unable to retarget CPEI, offline cpu [%d] failed\n", cpu);
+                        retval = -EBUSY;
+                }
+        }
+        return retval;
+}
+
 /* must be called with cpucontrol mutex held */
 int __cpu_disable(void)
 {
@@ -643,8 +736,17 @@ int __cpu_disable(void)
         /*
          * dont permit boot processor for now
          */
-        if (cpu == 0)
-                return -EBUSY;
+        if (cpu == 0 && !bsp_remove_ok) {
+                printk ("Your platform does not support removal of BSP\n");
+                return (-EBUSY);
+        }
+
+        cpu_clear(cpu, cpu_online_map);
+
+        if (migrate_platform_irqs(cpu)) {
+                cpu_set(cpu, cpu_online_map);
+                return (-EBUSY);
+        }
 
         remove_siblinginfo(cpu);
         cpu_clear(cpu, cpu_online_map);
diff --git a/arch/ia64/kernel/time.c b/arch/ia64/kernel/time.c
index 307d01e15b2e..ac167436e936 100644
--- a/arch/ia64/kernel/time.c
+++ b/arch/ia64/kernel/time.c
@@ -32,7 +32,7 @@
 
 extern unsigned long wall_jiffies;
 
-#define TIME_KEEPER_ID  0       /* smp_processor_id() of time-keeper */
+volatile int time_keeper_id = 0; /* smp_processor_id() of time-keeper */
 
 #ifdef CONFIG_IA64_DEBUG_IRQ
 
@@ -71,7 +71,7 @@ timer_interrupt (int irq, void *dev_id, struct pt_regs *regs)
 
                 new_itm += local_cpu_data->itm_delta;
 
-                if (smp_processor_id() == TIME_KEEPER_ID) {
+                if (smp_processor_id() == time_keeper_id) {
                         /*
                          * Here we are in the timer irq handler. We have irqs locally
                          * disabled, but we don't know if the timer_bh is running on
@@ -236,6 +236,11 @@ static struct irqaction timer_irqaction = {
         .name =         "timer"
 };
 
+void __devinit ia64_disable_timer(void)
+{
+        ia64_set_itv(1 << 16);
+}
+
 void __init
 time_init (void)
 {
diff --git a/arch/ia64/kernel/topology.c b/arch/ia64/kernel/topology.c
index 6e5eea19fa67..3b6fd798c4d6 100644
--- a/arch/ia64/kernel/topology.c
+++ b/arch/ia64/kernel/topology.c
@@ -36,7 +36,7 @@ int arch_register_cpu(int num)
         parent = &sysfs_nodes[cpu_to_node(num)];
 #endif /* CONFIG_NUMA */
 
-#ifdef CONFIG_ACPI
+#if defined (CONFIG_ACPI) && defined (CONFIG_HOTPLUG_CPU)
         /*
          * If CPEI cannot be re-targetted, and this is
          * CPEI target, then dont create the control file
diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c
index acaaec4e4681..9855ba318094 100644
--- a/arch/ia64/mm/contig.c
+++ b/arch/ia64/mm/contig.c
@@ -181,13 +181,15 @@ per_cpu_init (void)
 {
         void *cpu_data;
         int cpu;
+        static int first_time=1;
 
         /*
          * get_free_pages() cannot be used before cpu_init() done.  BSP
          * allocates "NR_CPUS" pages for all CPUs to avoid that AP calls
          * get_zeroed_page().
          */
-        if (smp_processor_id() == 0) {
+        if (first_time) {
+                first_time=0;
                 cpu_data = __alloc_bootmem(PERCPU_PAGE_SIZE * NR_CPUS,
                                            PERCPU_PAGE_SIZE, __pa(MAX_DMA_ADDRESS));
                 for (cpu = 0; cpu < NR_CPUS; cpu++) {
diff --git a/arch/ia64/mm/discontig.c b/arch/ia64/mm/discontig.c
index c87d6d1d5813..573d5cc63e2b 100644
--- a/arch/ia64/mm/discontig.c
+++ b/arch/ia64/mm/discontig.c
@@ -528,12 +528,17 @@ void __init find_memory(void)
 void *per_cpu_init(void)
 {
         int cpu;
+        static int first_time = 1;
+
 
         if (smp_processor_id() != 0)
                 return __per_cpu_start + __per_cpu_offset[smp_processor_id()];
 
-        for (cpu = 0; cpu < NR_CPUS; cpu++)
-                per_cpu(local_per_cpu_offset, cpu) = __per_cpu_offset[cpu];
+        if (first_time) {
+                first_time = 0;
+                for (cpu = 0; cpu < NR_CPUS; cpu++)
+                        per_cpu(local_per_cpu_offset, cpu) = __per_cpu_offset[cpu];
+        }
 
         return __per_cpu_start + __per_cpu_offset[smp_processor_id()];
 }
diff --git a/arch/ia64/sn/kernel/Makefile b/arch/ia64/sn/kernel/Makefile
index 3e9b4eea7418..ab9c48c88012 100644
--- a/arch/ia64/sn/kernel/Makefile
+++ b/arch/ia64/sn/kernel/Makefile
@@ -10,7 +10,8 @@
 CPPFLAGS += -I$(srctree)/arch/ia64/sn/include
 
 obj-y                           += setup.o bte.o bte_error.o irq.o mca.o idle.o \
-                                   huberror.o io_init.o iomv.o klconflib.o sn2/
+                                   huberror.o io_init.o iomv.o klconflib.o pio_phys.o \
+                                   sn2/
 obj-$(CONFIG_IA64_GENERIC)      += machvec.o
 obj-$(CONFIG_SGI_TIOCX)         += tiocx.o
 obj-$(CONFIG_IA64_SGI_SN_XP)    += xp.o
diff --git a/arch/ia64/sn/kernel/pio_phys.S b/arch/ia64/sn/kernel/pio_phys.S
new file mode 100644
index 000000000000..3c7d48d6ecb8
--- /dev/null
+++ b/arch/ia64/sn/kernel/pio_phys.S
@@ -0,0 +1,71 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2000-2005 Silicon Graphics, Inc. All rights reserved.
+ *
+ * This file contains macros used to access MMR registers via
+ * uncached physical addresses.
+ *      pio_phys_read_mmr  - read an MMR
+ *      pio_phys_write_mmr - write an MMR
+ *      pio_atomic_phys_write_mmrs - atomically write 1 or 2 MMRs with psr.ic=0
+ *              Second MMR will be skipped if address is NULL
+ *
+ * Addresses passed to these routines should be uncached physical addresses
+ *      ie., 0x80000....
+ */
+
+
+
+#include <asm/asmmacro.h>
+#include <asm/page.h>
+
+GLOBAL_ENTRY(pio_phys_read_mmr)
+        .prologue
+        .regstk 1,0,0,0
+        .body
+        mov r2=psr
+        rsm psr.i | psr.dt
+        ;;
+        srlz.d
+        ld8.acq r8=[r32]
+        ;;
+        mov psr.l=r2;;
+        srlz.d
+        br.ret.sptk.many rp
+END(pio_phys_read_mmr)
+
+GLOBAL_ENTRY(pio_phys_write_mmr)
+        .prologue
+        .regstk 2,0,0,0
+        .body
+        mov r2=psr
+        rsm psr.i | psr.dt
+        ;;
+        srlz.d
+        st8.rel [r32]=r33
+        ;;
+        mov psr.l=r2;;
+        srlz.d
+        br.ret.sptk.many rp
+END(pio_phys_write_mmr)
+
+GLOBAL_ENTRY(pio_atomic_phys_write_mmrs)
+        .prologue
+        .regstk 4,0,0,0
+        .body
+        mov r2=psr
+        cmp.ne p9,p0=r34,r0;
+        rsm psr.i | psr.dt | psr.ic
+        ;;
+        srlz.d
+        st8.rel [r32]=r33
+(p9)    st8.rel [r34]=r35
+        ;;
+        mov psr.l=r2;;
+        srlz.d
+        br.ret.sptk.many rp
+END(pio_atomic_phys_write_mmrs)
+
+
diff --git a/arch/ia64/sn/kernel/setup.c b/arch/ia64/sn/kernel/setup.c
index 5b84836c2171..8b6d5c844708 100644
--- a/arch/ia64/sn/kernel/setup.c
+++ b/arch/ia64/sn/kernel/setup.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1999,2001-2005 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 1999,2001-2006 Silicon Graphics, Inc. All rights reserved.
  */
 
 #include <linux/config.h>
@@ -498,6 +498,7 @@ void __init sn_setup(char **cmdline_p)
          * for sn.
          */
         pm_power_off = ia64_sn_power_down;
+        current->thread.flags |= IA64_THREAD_MIGRATION;
 }
 
 /**
@@ -660,7 +661,8 @@ void __init sn_cpu_init(void)
                         SH2_PIO_WRITE_STATUS_1, SH2_PIO_WRITE_STATUS_3};
                 u64 *pio;
                 pio = is_shub1() ? pio1 : pio2;
-                pda->pio_write_status_addr = (volatile unsigned long *) LOCAL_MMR_ADDR(pio[slice]);
+                pda->pio_write_status_addr =
+                   (volatile unsigned long *)GLOBAL_MMR_ADDR(nasid, pio[slice]);
                 pda->pio_write_status_val = is_shub1() ? SH_PIO_WRITE_STATUS_PENDING_WRITE_COUNT_MASK : 0;
         }
 
diff --git a/arch/ia64/sn/kernel/sn2/sn2_smp.c b/arch/ia64/sn/kernel/sn2/sn2_smp.c
index b2e1e746b47f..d9d306c79f2d 100644
--- a/arch/ia64/sn/kernel/sn2/sn2_smp.c
+++ b/arch/ia64/sn/kernel/sn2/sn2_smp.c
@@ -93,6 +93,27 @@ static inline unsigned long wait_piowc(void)
         return (ws & SH_PIO_WRITE_STATUS_WRITE_DEADLOCK_MASK) != 0;
 }
 
+/**
+ * sn_migrate - SN-specific task migration actions
+ * @task: Task being migrated to new CPU
+ *
+ * SN2 PIO writes from separate CPUs are not guaranteed to arrive in order.
+ * Context switching user threads which have memory-mapped MMIO may cause
+ * PIOs to issue from seperate CPUs, thus the PIO writes must be drained
+ * from the previous CPU's Shub before execution resumes on the new CPU.
+ */
+void sn_migrate(struct task_struct *task)
+{
+        pda_t *last_pda = pdacpu(task_thread_info(task)->last_cpu);
+        volatile unsigned long *adr = last_pda->pio_write_status_addr;
+        unsigned long val = last_pda->pio_write_status_val;
+
+        /* Drain PIO writes from old CPU's Shub */
+        while (unlikely((*adr & SH_PIO_WRITE_STATUS_PENDING_WRITE_COUNT_MASK)
+                        != val))
+                cpu_relax();
+}
+
 void sn_tlb_migrate_finish(struct mm_struct *mm)
 {
         /* flush_tlb_mm is inefficient if more than 1 users of mm */
diff --git a/arch/ia64/sn/kernel/xpc_channel.c b/arch/ia64/sn/kernel/xpc_channel.c
index cdf6856ce089..d0abddd9ffe6 100644
--- a/arch/ia64/sn/kernel/xpc_channel.c
+++ b/arch/ia64/sn/kernel/xpc_channel.c
@@ -21,7 +21,6 @@
 #include <linux/sched.h>
 #include <linux/cache.h>
 #include <linux/interrupt.h>
-#include <linux/slab.h>
 #include <linux/mutex.h>
 #include <linux/completion.h>
 #include <asm/sn/bte.h>
@@ -30,6 +29,31 @@
 
 
 /*
+ * Guarantee that the kzalloc'd memory is cacheline aligned.
+ */
+static void *
+xpc_kzalloc_cacheline_aligned(size_t size, gfp_t flags, void **base)
+{
+        /* see if kzalloc will give us cachline aligned memory by default */
+        *base = kzalloc(size, flags);
+        if (*base == NULL) {
+                return NULL;
+        }
+        if ((u64) *base == L1_CACHE_ALIGN((u64) *base)) {
+                return *base;
+        }
+        kfree(*base);
+
+        /* nope, we'll have to do it ourselves */
+        *base = kzalloc(size + L1_CACHE_BYTES, flags);
+        if (*base == NULL) {
+                return NULL;
+        }
+        return (void *) L1_CACHE_ALIGN((u64) *base);
+}
+
+
+/*
  * Set up the initial values for the XPartition Communication channels.
  */
 static void
@@ -93,20 +117,19 @@ xpc_setup_infrastructure(struct xpc_partition *part)
          * Allocate all of the channel structures as a contiguous chunk of
          * memory.
          */
-        part->channels = kmalloc(sizeof(struct xpc_channel) * XPC_NCHANNELS,
+        part->channels = kzalloc(sizeof(struct xpc_channel) * XPC_NCHANNELS,
                                                                 GFP_KERNEL);
         if (part->channels == NULL) {
                 dev_err(xpc_chan, "can't get memory for channels\n");
                 return xpcNoMemory;
         }
-        memset(part->channels, 0, sizeof(struct xpc_channel) * XPC_NCHANNELS);
 
         part->nchannels = XPC_NCHANNELS;
 
 
         /* allocate all the required GET/PUT values */
 
-        part->local_GPs = xpc_kmalloc_cacheline_aligned(XPC_GP_SIZE,
+        part->local_GPs = xpc_kzalloc_cacheline_aligned(XPC_GP_SIZE,
                                         GFP_KERNEL, &part->local_GPs_base);
         if (part->local_GPs == NULL) {
                 kfree(part->channels);
@@ -115,55 +138,51 @@ xpc_setup_infrastructure(struct xpc_partition *part)
                         "values\n");
                 return xpcNoMemory;
         }
-        memset(part->local_GPs, 0, XPC_GP_SIZE);
 
-        part->remote_GPs = xpc_kmalloc_cacheline_aligned(XPC_GP_SIZE,
+        part->remote_GPs = xpc_kzalloc_cacheline_aligned(XPC_GP_SIZE,
                                         GFP_KERNEL, &part->remote_GPs_base);
         if (part->remote_GPs == NULL) {
-                kfree(part->channels);
-                part->channels = NULL;
-                kfree(part->local_GPs_base);
-                part->local_GPs = NULL;
                 dev_err(xpc_chan, "can't get memory for remote get/put "
                         "values\n");
+                kfree(part->local_GPs_base);
+                part->local_GPs = NULL;
+                kfree(part->channels);
+                part->channels = NULL;
                 return xpcNoMemory;
         }
-        memset(part->remote_GPs, 0, XPC_GP_SIZE);
 
 
         /* allocate all the required open and close args */
 
-        part->local_openclose_args = xpc_kmalloc_cacheline_aligned(
+        part->local_openclose_args = xpc_kzalloc_cacheline_aligned(
                                         XPC_OPENCLOSE_ARGS_SIZE, GFP_KERNEL,
                                         &part->local_openclose_args_base);
         if (part->local_openclose_args == NULL) {
-                kfree(part->channels);
-                part->channels = NULL;
-                kfree(part->local_GPs_base);
-                part->local_GPs = NULL;
+                dev_err(xpc_chan, "can't get memory for local connect args\n");
                 kfree(part->remote_GPs_base);
                 part->remote_GPs = NULL;
-                dev_err(xpc_chan, "can't get memory for local connect args\n");
+                kfree(part->local_GPs_base);
+                part->local_GPs = NULL;
+                kfree(part->channels);
+                part->channels = NULL;
                 return xpcNoMemory;
         }
-        memset(part->local_openclose_args, 0, XPC_OPENCLOSE_ARGS_SIZE);
 
-        part->remote_openclose_args = xpc_kmalloc_cacheline_aligned(
+        part->remote_openclose_args = xpc_kzalloc_cacheline_aligned(
                                         XPC_OPENCLOSE_ARGS_SIZE, GFP_KERNEL,
                                         &part->remote_openclose_args_base);
         if (part->remote_openclose_args == NULL) {
-                kfree(part->channels);
-                part->channels = NULL;
-                kfree(part->local_GPs_base);
-                part->local_GPs = NULL;
-                kfree(part->remote_GPs_base);
-                part->remote_GPs = NULL;
+                dev_err(xpc_chan, "can't get memory for remote connect args\n");
                 kfree(part->local_openclose_args_base);
                 part->local_openclose_args = NULL;
-                dev_err(xpc_chan, "can't get memory for remote connect args\n");
+                kfree(part->remote_GPs_base);
+                part->remote_GPs = NULL;
+                kfree(part->local_GPs_base);
+                part->local_GPs = NULL;
+                kfree(part->channels);
+                part->channels = NULL;
                 return xpcNoMemory;
         }
-        memset(part->remote_openclose_args, 0, XPC_OPENCLOSE_ARGS_SIZE);
 
 
         xpc_initialize_channels(part, partid);
@@ -186,18 +205,18 @@ xpc_setup_infrastructure(struct xpc_partition *part)
         ret = request_irq(SGI_XPC_NOTIFY, xpc_notify_IRQ_handler, SA_SHIRQ,
                                 part->IPI_owner, (void *) (u64) partid);
         if (ret != 0) {
-                kfree(part->channels);
-                part->channels = NULL;
-                kfree(part->local_GPs_base);
-                part->local_GPs = NULL;
-                kfree(part->remote_GPs_base);
-                part->remote_GPs = NULL;
-                kfree(part->local_openclose_args_base);
-                part->local_openclose_args = NULL;
-                kfree(part->remote_openclose_args_base);
-                part->remote_openclose_args = NULL;
                 dev_err(xpc_chan, "can't register NOTIFY IRQ handler, "
                         "errno=%d\n", -ret);
+                kfree(part->remote_openclose_args_base);
+                part->remote_openclose_args = NULL;
+                kfree(part->local_openclose_args_base);
+                part->local_openclose_args = NULL;
+                kfree(part->remote_GPs_base);
+                part->remote_GPs = NULL;
+                kfree(part->local_GPs_base);
+                part->local_GPs = NULL;
+                kfree(part->channels);
+                part->channels = NULL;
                 return xpcLackOfResources;
         }
 
@@ -446,22 +465,20 @@ xpc_allocate_local_msgqueue(struct xpc_channel *ch)
         for (nentries = ch->local_nentries; nentries > 0; nentries--) {
 
                 nbytes = nentries * ch->msg_size;
-                ch->local_msgqueue = xpc_kmalloc_cacheline_aligned(nbytes,
+                ch->local_msgqueue = xpc_kzalloc_cacheline_aligned(nbytes,
                                                 GFP_KERNEL,
                                                 &ch->local_msgqueue_base);
                 if (ch->local_msgqueue == NULL) {
                         continue;
                 }
-                memset(ch->local_msgqueue, 0, nbytes);
 
                 nbytes = nentries * sizeof(struct xpc_notify);
-                ch->notify_queue = kmalloc(nbytes, GFP_KERNEL);
+                ch->notify_queue = kzalloc(nbytes, GFP_KERNEL);
                 if (ch->notify_queue == NULL) {
                         kfree(ch->local_msgqueue_base);
                         ch->local_msgqueue = NULL;
                         continue;
                 }
-                memset(ch->notify_queue, 0, nbytes);
 
                 spin_lock_irqsave(&ch->lock, irq_flags);
                 if (nentries < ch->local_nentries) {
@@ -501,13 +518,12 @@ xpc_allocate_remote_msgqueue(struct xpc_channel *ch)
         for (nentries = ch->remote_nentries; nentries > 0; nentries--) {
 
                 nbytes = nentries * ch->msg_size;
-                ch->remote_msgqueue = xpc_kmalloc_cacheline_aligned(nbytes,
+                ch->remote_msgqueue = xpc_kzalloc_cacheline_aligned(nbytes,
                                                 GFP_KERNEL,
                                                 &ch->remote_msgqueue_base);
                 if (ch->remote_msgqueue == NULL) {
                         continue;
                 }
-                memset(ch->remote_msgqueue, 0, nbytes);
 
                 spin_lock_irqsave(&ch->lock, irq_flags);
                 if (nentries < ch->remote_nentries) {
diff --git a/arch/ia64/sn/kernel/xpc_main.c b/arch/ia64/sn/kernel/xpc_main.c
index 8cbf16432570..99b123a6421a 100644
--- a/arch/ia64/sn/kernel/xpc_main.c
+++ b/arch/ia64/sn/kernel/xpc_main.c
@@ -52,7 +52,6 @@
 #include <linux/syscalls.h>
 #include <linux/cache.h>
 #include <linux/interrupt.h>
-#include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/reboot.h>
 #include <linux/completion.h>
diff --git a/arch/ia64/sn/kernel/xpc_partition.c b/arch/ia64/sn/kernel/xpc_partition.c
index 88a730e6cfdb..94211429fd0c 100644
--- a/arch/ia64/sn/kernel/xpc_partition.c
+++ b/arch/ia64/sn/kernel/xpc_partition.c
@@ -81,6 +81,31 @@ char ____cacheline_aligned xpc_remote_copy_buffer[XPC_RP_HEADER_SIZE +
 
 
 /*
+ * Guarantee that the kmalloc'd memory is cacheline aligned.
+ */
+static void *
+xpc_kmalloc_cacheline_aligned(size_t size, gfp_t flags, void **base)
+{
+        /* see if kmalloc will give us cachline aligned memory by default */
+        *base = kmalloc(size, flags);
+        if (*base == NULL) {
+                return NULL;
+        }
+        if ((u64) *base == L1_CACHE_ALIGN((u64) *base)) {
+                return *base;
+        }
+        kfree(*base);
+
+        /* nope, we'll have to do it ourselves */
+        *base = kmalloc(size + L1_CACHE_BYTES, flags);
+        if (*base == NULL) {
+                return NULL;
+        }
+        return (void *) L1_CACHE_ALIGN((u64) *base);
+}
+
+
+/*
  * Given a nasid, get the physical address of the  partition's reserved page
  * for that nasid. This function returns 0 on any error.
  */
@@ -1038,13 +1063,12 @@ xpc_discovery(void)
         remote_vars = (struct xpc_vars *) remote_rp;
 
 
-        discovered_nasids = kmalloc(sizeof(u64) * xp_nasid_mask_words,
+        discovered_nasids = kzalloc(sizeof(u64) * xp_nasid_mask_words,
                                                         GFP_KERNEL);
         if (discovered_nasids == NULL) {
                 kfree(remote_rp_base);
                 return;
         }
-        memset(discovered_nasids, 0, sizeof(u64) * xp_nasid_mask_words);
 
         rp = (struct xpc_rsvd_page *) xpc_rsvd_page;
 
diff --git a/arch/ia64/sn/pci/tioce_provider.c b/arch/ia64/sn/pci/tioce_provider.c
index e52831ed93eb..fa073cc4b565 100644
--- a/arch/ia64/sn/pci/tioce_provider.c
+++ b/arch/ia64/sn/pci/tioce_provider.c
@@ -15,6 +15,124 @@
 #include <asm/sn/pcidev.h>
 #include <asm/sn/pcibus_provider_defs.h>
 #include <asm/sn/tioce_provider.h>
+#include <asm/sn/sn2/sn_hwperf.h>
+
+/*
+ * 1/26/2006
+ *
+ * WAR for SGI PV 944642.  For revA TIOCE, need to use the following recipe
+ * (taken from the above PV) before and after accessing tioce internal MMR's
+ * to avoid tioce lockups.
+ *
+ * The recipe as taken from the PV:
+ *
+ *      if(mmr address < 0x45000) {
+ *              if(mmr address == 0 or 0x80)
+ *                      mmr wrt or read address 0xc0
+ *              else if(mmr address == 0x148 or 0x200)
+ *                      mmr wrt or read address 0x28
+ *              else
+ *                      mmr wrt or read address 0x158
+ *
+ *              do desired mmr access (rd or wrt)
+ *
+ *              if(mmr address == 0x100)
+ *                      mmr wrt or read address 0x38
+ *              mmr wrt or read address 0xb050
+ *      } else
+ *              do desired mmr access
+ *
+ * According to hw, we can use reads instead of writes to the above addres
+ *
+ * Note this WAR can only to be used for accessing internal MMR's in the
+ * TIOCE Coretalk Address Range 0x0 - 0x07ff_ffff.  This includes the
+ * "Local CE Registers and Memories" and "PCI Compatible Config Space" address
+ * spaces from table 2-1 of the "CE Programmer's Reference Overview" document.
+ *
+ * All registers defined in struct tioce will meet that criteria.
+ */
+
+static void inline
+tioce_mmr_war_pre(struct tioce_kernel *kern, void *mmr_addr)
+{
+        u64 mmr_base;
+        u64 mmr_offset;
+
+        if (kern->ce_common->ce_rev != TIOCE_REV_A)
+                return;
+
+        mmr_base = kern->ce_common->ce_pcibus.bs_base;
+        mmr_offset = (u64)mmr_addr - mmr_base;
+
+        if (mmr_offset < 0x45000) {
+                u64 mmr_war_offset;
+
+                if (mmr_offset == 0 || mmr_offset == 0x80)
+                        mmr_war_offset = 0xc0;
+                else if (mmr_offset == 0x148 || mmr_offset == 0x200)
+                        mmr_war_offset = 0x28;
+                else
+                        mmr_war_offset = 0x158;
+
+                readq_relaxed((void *)(mmr_base + mmr_war_offset));
+        }
+}
+
+static void inline
+tioce_mmr_war_post(struct tioce_kernel *kern, void *mmr_addr)
+{
+        u64 mmr_base;
+        u64 mmr_offset;
+
+        if (kern->ce_common->ce_rev != TIOCE_REV_A)
+                return;
+
+        mmr_base = kern->ce_common->ce_pcibus.bs_base;
+        mmr_offset = (u64)mmr_addr - mmr_base;
+
+        if (mmr_offset < 0x45000) {
+                if (mmr_offset == 0x100)
+                        readq_relaxed((void *)(mmr_base + 0x38));
+                readq_relaxed((void *)(mmr_base + 0xb050));
+        }
+}
+
+/* load mmr contents into a variable */
+#define tioce_mmr_load(kern, mmrp, varp) do {\
+        tioce_mmr_war_pre(kern, mmrp); \
+        *(varp) = readq_relaxed(mmrp); \
+        tioce_mmr_war_post(kern, mmrp); \
+} while (0)
+
+/* store variable contents into mmr */
+#define tioce_mmr_store(kern, mmrp, varp) do {\
+        tioce_mmr_war_pre(kern, mmrp); \
+        writeq(*varp, mmrp); \
+        tioce_mmr_war_post(kern, mmrp); \
+} while (0)
+
+/* store immediate value into mmr */
+#define tioce_mmr_storei(kern, mmrp, val) do {\
+        tioce_mmr_war_pre(kern, mmrp); \
+        writeq(val, mmrp); \
+        tioce_mmr_war_post(kern, mmrp); \
+} while (0)
+
+/* set bits (immediate value) into mmr */
+#define tioce_mmr_seti(kern, mmrp, bits) do {\
+        u64 tmp; \
+        tioce_mmr_load(kern, mmrp, &tmp); \
+        tmp |= (bits); \
+        tioce_mmr_store(kern, mmrp, &tmp); \
+} while (0)
+
+/* clear bits (immediate value) into mmr */
+#define tioce_mmr_clri(kern, mmrp, bits) do { \
+        u64 tmp; \
+        tioce_mmr_load(kern, mmrp, &tmp); \
+        tmp &= ~(bits); \
+        tioce_mmr_store(kern, mmrp, &tmp); \
+} while (0)
 
 /**
  * Bus address ranges for the 5 flavors of TIOCE DMA
@@ -62,9 +180,9 @@
 #define TIOCE_ATE_M40   2
 #define TIOCE_ATE_M40S  3
 
-#define KB(x)   ((x) << 10)
-#define MB(x)   ((x) << 20)
-#define GB(x)   ((x) << 30)
+#define KB(x)   ((u64)(x) << 10)
+#define MB(x)   ((u64)(x) << 20)
+#define GB(x)   ((u64)(x) << 30)
 
 /**
  * tioce_dma_d64 - create a DMA mapping using 64-bit direct mode
@@ -151,7 +269,7 @@ tioce_alloc_map(struct tioce_kernel *ce_kern, int type, int port,
         int last;
         int entries;
         int nates;
-        int pagesize;
+        u64 pagesize;
         u64 *ate_shadow;
         u64 *ate_reg;
         u64 addr;
@@ -228,7 +346,7 @@ tioce_alloc_map(struct tioce_kernel *ce_kern, int type, int port,
 
                 ate = ATE_MAKE(addr, pagesize);
                 ate_shadow[i + j] = ate;
-                writeq(ate, &ate_reg[i + j]);
+                tioce_mmr_storei(ce_kern, &ate_reg[i + j], ate);
                 addr += pagesize;
         }
 
@@ -272,7 +390,8 @@ tioce_dma_d32(struct pci_dev *pdev, u64 ct_addr)
                 u64 tmp;
 
                 ce_kern->ce_port[port].dirmap_shadow = ct_upper;
-                writeq(ct_upper, &ce_mmr->ce_ure_dir_map[port]);
+                tioce_mmr_storei(ce_kern, &ce_mmr->ce_ure_dir_map[port],
+                                 ct_upper);
                 tmp = ce_mmr->ce_ure_dir_map[port];
                 dma_ok = 1;
         } else
@@ -344,7 +463,8 @@ tioce_dma_unmap(struct pci_dev *pdev, dma_addr_t bus_addr, int dir)
         if (TIOCE_D32_ADDR(bus_addr)) {
                 if (--ce_kern->ce_port[port].dirmap_refcnt == 0) {
                         ce_kern->ce_port[port].dirmap_shadow = 0;
-                        writeq(0, &ce_mmr->ce_ure_dir_map[port]);
+                        tioce_mmr_storei(ce_kern, &ce_mmr->ce_ure_dir_map[port],
+                                         0);
                 }
         } else {
                 struct tioce_dmamap *map;
@@ -365,7 +485,7 @@ tioce_dma_unmap(struct pci_dev *pdev, dma_addr_t bus_addr, int dir)
                 } else if (--map->refcnt == 0) {
                         for (i = 0; i < map->ate_count; i++) {
                                 map->ate_shadow[i] = 0;
-                                map->ate_hw[i] = 0;
+                                tioce_mmr_storei(ce_kern, &map->ate_hw[i], 0);
                         }
 
                         list_del(&map->ce_dmamap_list);
@@ -486,7 +606,7 @@ tioce_do_dma_map(struct pci_dev *pdev, u64 paddr, size_t byte_count,
         spin_unlock_irqrestore(&ce_kern->ce_lock, flags);
 
 dma_map_done:
-        if (mapaddr & barrier)
+        if (mapaddr && barrier)
                 mapaddr = tioce_dma_barrier(mapaddr, 1);
 
         return mapaddr;
@@ -541,17 +661,61 @@ tioce_error_intr_handler(int irq, void *arg, struct pt_regs *pt)
                         soft->ce_pcibus.bs_persist_segment,
                         soft->ce_pcibus.bs_persist_busnum, 0, 0, 0, 0, 0);
 
+        if (ret_stuff.v0)
+                panic("tioce_error_intr_handler:  Fatal TIOCE error");
+
         return IRQ_HANDLED;
 }
 
 /**
+ * tioce_reserve_m32 - reserve M32 ate's for the indicated address range
+ * @tioce_kernel: TIOCE context to reserve ate's for
+ * @base: starting bus address to reserve
+ * @limit: last bus address to reserve
+ *
+ * If base/limit falls within the range of bus space mapped through the
+ * M32 space, reserve the resources corresponding to the range.
+ */
+static void
+tioce_reserve_m32(struct tioce_kernel *ce_kern, u64 base, u64 limit)
+{
+        int ate_index, last_ate, ps;
+        struct tioce *ce_mmr;
+
+        if (!TIOCE_M32_ADDR(base))
+                return;
+
+        ce_mmr = (struct tioce *)ce_kern->ce_common->ce_pcibus.bs_base;
+        ps = ce_kern->ce_ate3240_pagesize;
+        ate_index = ATE_PAGE(base, ps);
+        last_ate = ate_index + ATE_NPAGES(base, limit-base+1, ps) - 1;
+
+        if (ate_index < 64)
+                ate_index = 64;
+
+        while (ate_index <= last_ate) {
+                u64 ate;
+
+                ate = ATE_MAKE(0xdeadbeef, ps);
+                ce_kern->ce_ate3240_shadow[ate_index] = ate;
+                tioce_mmr_storei(ce_kern, &ce_mmr->ce_ure_ate3240[ate_index],
+                                 ate);
+                ate_index++;
+        }
+}
+
+/**
  * tioce_kern_init - init kernel structures related to a given TIOCE
  * @tioce_common: ptr to a cached tioce_common struct that originated in prom
- */ static struct tioce_kernel *
+ */
+static struct tioce_kernel *
 tioce_kern_init(struct tioce_common *tioce_common)
 {
         int i;
+        int ps;
+        int dev;
         u32 tmp;
+        unsigned int seg, bus;
         struct tioce *tioce_mmr;
         struct tioce_kernel *tioce_kern;
 
@@ -572,9 +736,10 @@ tioce_kern_init(struct tioce_common *tioce_common)
          * here to use pci_read_config_xxx() so use the raw_pci_ops vector.
          */
 
-        raw_pci_ops->read(tioce_common->ce_pcibus.bs_persist_segment,
-                          tioce_common->ce_pcibus.bs_persist_busnum,
-                          PCI_DEVFN(2, 0), PCI_SECONDARY_BUS, 1, &tmp);
+        seg = tioce_common->ce_pcibus.bs_persist_segment;
+        bus = tioce_common->ce_pcibus.bs_persist_busnum;
+
+        raw_pci_ops->read(seg, bus, PCI_DEVFN(2, 0), PCI_SECONDARY_BUS, 1,&tmp);
         tioce_kern->ce_port1_secondary = (u8) tmp;
 
         /*
@@ -583,18 +748,76 @@ tioce_kern_init(struct tioce_common *tioce_common)
          */
 
         tioce_mmr = (struct tioce *)tioce_common->ce_pcibus.bs_base;
-        __sn_clrq_relaxed(&tioce_mmr->ce_ure_page_map, CE_URE_PAGESIZE_MASK);
-        __sn_setq_relaxed(&tioce_mmr->ce_ure_page_map, CE_URE_256K_PAGESIZE);
-        tioce_kern->ce_ate3240_pagesize = KB(256);
+        tioce_mmr_clri(tioce_kern, &tioce_mmr->ce_ure_page_map,
+                       CE_URE_PAGESIZE_MASK);
+        tioce_mmr_seti(tioce_kern, &tioce_mmr->ce_ure_page_map,
+                       CE_URE_256K_PAGESIZE);
+        ps = tioce_kern->ce_ate3240_pagesize = KB(256);
 
         for (i = 0; i < TIOCE_NUM_M40_ATES; i++) {
                 tioce_kern->ce_ate40_shadow[i] = 0;
-                writeq(0, &tioce_mmr->ce_ure_ate40[i]);
+                tioce_mmr_storei(tioce_kern, &tioce_mmr->ce_ure_ate40[i], 0);
         }
 
         for (i = 0; i < TIOCE_NUM_M3240_ATES; i++) {
                 tioce_kern->ce_ate3240_shadow[i] = 0;
-                writeq(0, &tioce_mmr->ce_ure_ate3240[i]);
+                tioce_mmr_storei(tioce_kern, &tioce_mmr->ce_ure_ate3240[i], 0);
+        }
+
+        /*
+         * Reserve ATE's corresponding to reserved address ranges.  These
+         * include:
+         *
+         *      Memory space covered by each PPB mem base/limit register
+         *      Memory space covered by each PPB prefetch base/limit register
+         *
+         * These bus ranges are for pio (downstream) traffic only, and so
+         * cannot be used for DMA.
+         */
+
+        for (dev = 1; dev <= 2; dev++) {
+                u64 base, limit;
+
+                /* mem base/limit */
+
+                raw_pci_ops->read(seg, bus, PCI_DEVFN(dev, 0),
+                                  PCI_MEMORY_BASE, 2, &tmp);
+                base = (u64)tmp << 16;
+
+                raw_pci_ops->read(seg, bus, PCI_DEVFN(dev, 0),
+                                  PCI_MEMORY_LIMIT, 2, &tmp);
+                limit = (u64)tmp << 16;
+                limit |= 0xfffffUL;
+
+                if (base < limit)
+                        tioce_reserve_m32(tioce_kern, base, limit);
+
+                /*
+                 * prefetch mem base/limit.  The tioce ppb's have 64-bit
+                 * decoders, so read the upper portions w/o checking the
+                 * attributes.
+                 */
+
+                raw_pci_ops->read(seg, bus, PCI_DEVFN(dev, 0),
+                                  PCI_PREF_MEMORY_BASE, 2, &tmp);
+                base = ((u64)tmp & PCI_PREF_RANGE_MASK) << 16;
+
+                raw_pci_ops->read(seg, bus, PCI_DEVFN(dev, 0),
+                                  PCI_PREF_BASE_UPPER32, 4, &tmp);
+                base |= (u64)tmp << 32;
+
+                raw_pci_ops->read(seg, bus, PCI_DEVFN(dev, 0),
+                                  PCI_PREF_MEMORY_LIMIT, 2, &tmp);
+
+                limit = ((u64)tmp & PCI_PREF_RANGE_MASK) << 16;
+                limit |= 0xfffffUL;
+
+                raw_pci_ops->read(seg, bus, PCI_DEVFN(dev, 0),
+                                  PCI_PREF_LIMIT_UPPER32, 4, &tmp);
+                limit |= (u64)tmp << 32;
+
+                if ((base < limit) && TIOCE_M32_ADDR(base))
+                        tioce_reserve_m32(tioce_kern, base, limit);
         }
 
         return tioce_kern;
@@ -614,6 +837,7 @@ tioce_force_interrupt(struct sn_irq_info *sn_irq_info)
 {
         struct pcidev_info *pcidev_info;
         struct tioce_common *ce_common;
+        struct tioce_kernel *ce_kern;
         struct tioce *ce_mmr;
         u64 force_int_val;
 
@@ -629,6 +853,29 @@ tioce_force_interrupt(struct sn_irq_info *sn_irq_info)
 
         ce_common = (struct tioce_common *)pcidev_info->pdi_pcibus_info;
         ce_mmr = (struct tioce *)ce_common->ce_pcibus.bs_base;
+        ce_kern = (struct tioce_kernel *)ce_common->ce_kernel_private;
+
+        /*
+         * TIOCE Rev A workaround (PV 945826), force an interrupt by writing
+         * the TIO_INTx register directly (1/26/2006)
+         */
+        if (ce_common->ce_rev == TIOCE_REV_A) {
+                u64 int_bit_mask = (1ULL << sn_irq_info->irq_int_bit);
+                u64 status;
+
+                tioce_mmr_load(ce_kern, &ce_mmr->ce_adm_int_status, &status);
+                if (status & int_bit_mask) {
+                        u64 force_irq = (1 << 8) | sn_irq_info->irq_irq;
+                        u64 ctalk = sn_irq_info->irq_xtalkaddr;
+                        u64 nasid, offset;
+
+                        nasid = (ctalk & CTALK_NASID_MASK) >> CTALK_NASID_SHFT;
+                        offset = (ctalk & CTALK_NODE_OFFSET);
+                        HUB_S(TIO_IOSPACE_ADDR(nasid, offset), force_irq);
+                }
+
+                return;
+        }
 
         /*
          * irq_int_bit is originally set up by prom, and holds the interrupt
@@ -666,7 +913,7 @@ tioce_force_interrupt(struct sn_irq_info *sn_irq_info)
         default:
                 return;
         }
-        writeq(force_int_val, &ce_mmr->ce_adm_force_int);
+        tioce_mmr_storei(ce_kern, &ce_mmr->ce_adm_force_int, force_int_val);
 }
 
 /**
@@ -685,6 +932,7 @@ tioce_target_interrupt(struct sn_irq_info *sn_irq_info)
 {
         struct pcidev_info *pcidev_info;
         struct tioce_common *ce_common;
+        struct tioce_kernel *ce_kern;
         struct tioce *ce_mmr;
         int bit;
         u64 vector;
@@ -695,14 +943,15 @@ tioce_target_interrupt(struct sn_irq_info *sn_irq_info)
 
         ce_common = (struct tioce_common *)pcidev_info->pdi_pcibus_info;
         ce_mmr = (struct tioce *)ce_common->ce_pcibus.bs_base;
+        ce_kern = (struct tioce_kernel *)ce_common->ce_kernel_private;
 
         bit = sn_irq_info->irq_int_bit;
 
-        __sn_setq_relaxed(&ce_mmr->ce_adm_int_mask, (1UL << bit));
+        tioce_mmr_seti(ce_kern, &ce_mmr->ce_adm_int_mask, (1UL << bit));
         vector = (u64)sn_irq_info->irq_irq << INTR_VECTOR_SHFT;
         vector |= sn_irq_info->irq_xtalkaddr;
-        writeq(vector, &ce_mmr->ce_adm_int_dest[bit]);
-        __sn_clrq_relaxed(&ce_mmr->ce_adm_int_mask, (1UL << bit));
+        tioce_mmr_storei(ce_kern, &ce_mmr->ce_adm_int_dest[bit], vector);
+        tioce_mmr_clri(ce_kern, &ce_mmr->ce_adm_int_mask, (1UL << bit));
 
         tioce_force_interrupt(sn_irq_info);
 }
@@ -721,7 +970,11 @@ tioce_target_interrupt(struct sn_irq_info *sn_irq_info)
 static void *
 tioce_bus_fixup(struct pcibus_bussoft *prom_bussoft, struct pci_controller *controller)
 {
+        int my_nasid;
+        cnodeid_t my_cnode, mem_cnode;
         struct tioce_common *tioce_common;
+        struct tioce_kernel *tioce_kern;
+        struct tioce *tioce_mmr;
 
         /*
          * Allocate kernel bus soft and copy from prom.
@@ -734,11 +987,23 @@ tioce_bus_fixup(struct pcibus_bussoft *prom_bussoft, struct pci_controller *cont
         memcpy(tioce_common, prom_bussoft, sizeof(struct tioce_common));
         tioce_common->ce_pcibus.bs_base |= __IA64_UNCACHED_OFFSET;
 
-        if (tioce_kern_init(tioce_common) == NULL) {
+        tioce_kern = tioce_kern_init(tioce_common);
+        if (tioce_kern == NULL) {
                 kfree(tioce_common);
                 return NULL;
         }
 
+        /*
+         * Clear out any transient errors before registering the error
+         * interrupt handler.
+         */
+
+        tioce_mmr = (struct tioce *)tioce_common->ce_pcibus.bs_base;
+        tioce_mmr_seti(tioce_kern, &tioce_mmr->ce_adm_int_status_alias, ~0ULL);
+        tioce_mmr_seti(tioce_kern, &tioce_mmr->ce_adm_error_summary_alias,
+                       ~0ULL);
+        tioce_mmr_seti(tioce_kern, &tioce_mmr->ce_dre_comp_err_addr, ~0ULL);
+
         if (request_irq(SGI_PCIASIC_ERROR,
                         tioce_error_intr_handler,
                         SA_SHIRQ, "TIOCE error", (void *)tioce_common))
@@ -750,6 +1015,21 @@ tioce_bus_fixup(struct pcibus_bussoft *prom_bussoft, struct pci_controller *cont
                        tioce_common->ce_pcibus.bs_persist_segment,
                        tioce_common->ce_pcibus.bs_persist_busnum);
 
+        /*
+         * identify closest nasid for memory allocations
+         */
+
+        my_nasid = NASID_GET(tioce_common->ce_pcibus.bs_base);
+        my_cnode = nasid_to_cnodeid(my_nasid);
+
+        if (sn_hwperf_get_nearest_node(my_cnode, &mem_cnode, NULL) < 0) {
+                printk(KERN_WARNING "tioce_bus_fixup: failed to find "
+                       "closest node with MEM to TIO node %d\n", my_cnode);
+                mem_cnode = (cnodeid_t)-1; /* use any node */
+        }
+
+        controller->node = mem_cnode;
+
         return tioce_common;
 }