ENGR00308456-1 gpu:viante 5.0.11 kernel part integration

Integrated 5.0.11 kernel part change.

Signed-off-by: Loren HUANG <b02279@freescale.com>
Acked-by: Shawn Guo

50 files changed, 5196 insertions, 2978 deletions

diff --git a/drivers/mxc/gpu-viv/Kbuild b/drivers/mxc/gpu-viv/Kbuild
index 6dee194661f0..15da76a25d29 100644
--- a/drivers/mxc/gpu-viv/Kbuild
+++ b/drivers/mxc/gpu-viv/Kbuild
@@ -34,6 +34,8 @@ ARCH_KERNEL_DIR := hal/kernel/arch
 ARCH_VG_KERNEL_DIR := hal/kernel/archvg
 HAL_KERNEL_DIR  := hal/kernel
 
+CUSTOMER_ALLOCATOR_OBJS :=
+
 EXTRA_CFLAGS += -Werror
 
 OBJS := $(OS_KERNEL_DIR)/gc_hal_kernel_device.o \
@@ -41,7 +43,8 @@ OBJS := $(OS_KERNEL_DIR)/gc_hal_kernel_device.o \
         $(OS_KERNEL_DIR)/gc_hal_kernel_linux.o \
         $(OS_KERNEL_DIR)/gc_hal_kernel_math.o \
         $(OS_KERNEL_DIR)/gc_hal_kernel_os.o \
-        $(OS_KERNEL_DIR)/gc_hal_kernel_debugfs.o
+        $(OS_KERNEL_DIR)/gc_hal_kernel_debugfs.o \
+        $(OS_KERNEL_DIR)/gc_hal_kernel_allocator.o \
 
 
 OBJS += $(HAL_KERNEL_DIR)/gc_hal_kernel.o \
@@ -71,6 +74,11 @@ ifneq ($(CONFIG_SYNC),)
 OBJS += $(OS_KERNEL_DIR)/gc_hal_kernel_sync.o
 endif
 
+
+ifneq ($(CUSTOMER_ALLOCATOR_OBJS),)
+OBJS += $(CUSTOMER_ALLOCATOR_OBJS)
+endif
+
 ifeq ($(KERNELRELEASE), )
 
 .PHONY: all clean install
@@ -92,12 +100,6 @@ else
 
 EXTRA_CFLAGS += -DLINUX -DDRIVER
 
-ifeq ($(ENUM_WORKAROUND), 1)
-EXTRA_CFLAGS += -DENUM_WORKAROUND=1
-else
-EXTRA_CFLAGS += -DENUM_WORKAROUND=0
-endif
-
 ifeq ($(FLAREON),1)
 EXTRA_CFLAGS += -DFLAREON
 endif
@@ -209,6 +211,7 @@ else
 EXTRA_CFLAGS += -DgcdFPGA_BUILD=0
 endif
 
+
 EXTRA_CFLAGS += -I$(AQROOT)/hal/kernel/inc
 EXTRA_CFLAGS += -I$(AQROOT)/hal/kernel
 EXTRA_CFLAGS += -I$(AQROOT)/hal/kernel/arch
diff --git a/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_context.c b/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_context.c
index 9371ccf32578..d0deb3b47918 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_context.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_context.c
@@ -142,14 +142,14 @@
     (((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27))) | (((gctUINT32) (0x03 | 0xC0FFEE & ((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27))))
 
 #if !defined(VIVANTE_NO_3D)
-static gctSIZE_T
+static gctUINT32
 _TerminateStateBlock(
     IN gckCONTEXT Context,
-    IN gctSIZE_T Index
+    IN gctUINT32 Index
     )
 {
     gctUINT32_PTR buffer;
-    gctSIZE_T align;
+    gctUINT32 align;
 
     /* Determine if we need alignment. */
     align = (Index & 1) ? 1 : 0;
@@ -175,15 +175,15 @@ _TerminateStateBlock(
 #endif
 
 
-static gctSIZE_T
+static gctUINT32
 _FlushPipe(
     IN gckCONTEXT Context,
-    IN gctSIZE_T Index,
+    IN gctUINT32 Index,
     IN gcePIPE_SELECT Pipe
     )
 {
     gctBOOL fcFlushStall;
-    gctSIZE_T flushSlots;
+    gctUINT32 flushSlots;
 
     fcFlushStall
         = gckHARDWARE_IsFeatureAvailable(Context->hardware, gcvFEATURE_FC_FLUSH_STALL);
@@ -245,10 +245,10 @@ _FlushPipe(
 }
 
 #if !defined(VIVANTE_NO_3D)
-static gctSIZE_T
+static gctUINT32
 _SemaphoreStall(
     IN gckCONTEXT Context,
-    IN gctSIZE_T Index
+    IN gctUINT32 Index
     )
 {
     if (Context->buffer != gcvNULL)
@@ -282,10 +282,10 @@ _SemaphoreStall(
 }
 #endif
 
-static gctSIZE_T
+static gctUINT32
 _SwitchPipe(
     IN gckCONTEXT Context,
-    IN gctSIZE_T Index,
+    IN gctUINT32 Index,
     IN gcePIPE_SELECT Pipe
     )
 {
@@ -312,19 +312,20 @@ _SwitchPipe(
 }
 
 #if !defined(VIVANTE_NO_3D)
-static gctSIZE_T
+static gctUINT32
 _State(
     IN gckCONTEXT Context,
-    IN gctSIZE_T Index,
+    IN gctUINT32 Index,
     IN gctUINT32 Address,
     IN gctUINT32 Value,
-    IN gctSIZE_T Size,
+    IN gctUINT32 Size,
     IN gctBOOL FixedPoint,
     IN gctBOOL Hinted
     )
 {
     gctUINT32_PTR buffer;
-    gctSIZE_T align, i;
+    gctUINT32 align;
+    gctUINT32 i;
 
     /* Determine if we need alignment. */
     align = (Index & 1) ? 1 : 0;
@@ -372,13 +373,13 @@ _State(
             }
 
             /* Walk all the states. */
-            for (i = 0; i < Size; i += 1)
+            for (i = 0; i < (gctUINT32)Size; i += 1)
             {
                 /* Set state to uninitialized value. */
                 buffer[Index + 1 + i] = Value;
 
                 /* Set index in state mapping table. */
-                Context->map[Address + i].index = Index + 1 + i;
+                Context->map[Address + i].index = (gctUINT)Index + 1 + i;
 
 #if gcdSECURE_USER
                 /* Save hint. */
@@ -391,8 +392,8 @@ _State(
         }
 
         /* Save information for this LoadState. */
-        Context->lastIndex   = Index;
-        Context->lastAddress = Address + Size;
+        Context->lastIndex   = (gctUINT)Index;
+        Context->lastAddress = Address + (gctUINT32)Size;
         Context->lastSize    = Size;
         Context->lastFixed   = FixedPoint;
 
@@ -408,13 +409,13 @@ _State(
             ((((gctUINT32) (buffer[Context->lastIndex])) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 25:16) - (0 ? 25:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 25:16) - (0 ? 25:16) + 1))))))) << (0 ? 25:16))) | (((gctUINT32) ((gctUINT32) (Context->lastSize + Size) & ((gctUINT32) ((((1 ? 25:16) - (0 ? 25:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 25:16) - (0 ? 25:16) + 1))))))) << (0 ? 25:16)));
 
         /* Walk all the states. */
-        for (i = 0; i < Size; i += 1)
+        for (i = 0; i < (gctUINT32)Size; i += 1)
         {
             /* Set state to uninitialized value. */
             buffer[Index + i] = Value;
 
             /* Set index in state mapping table. */
-            Context->map[Address + i].index = Index + i;
+            Context->map[Address + i].index = (gctUINT)Index + i;
 
 #if gcdSECURE_USER
             /* Save hint. */
@@ -427,22 +428,22 @@ _State(
     }
 
     /* Update last address and size. */
-    Context->lastAddress += Size;
+    Context->lastAddress += (gctUINT32)Size;
     Context->lastSize    += Size;
 
     /* Return number of slots required. */
     return Size;
 }
 
-static gctSIZE_T
+static gctUINT32
 _StateMirror(
     IN gckCONTEXT Context,
     IN gctUINT32 Address,
-    IN gctSIZE_T Size,
+    IN gctUINT32 Size,
     IN gctUINT32 AddressMirror
     )
 {
-    gctSIZE_T i;
+    gctUINT32 i;
 
     /* Process when buffer is set. */
     if (Context->buffer != gcvNULL)
@@ -467,13 +468,13 @@ _InitializeContextBuffer(
     )
 {
     gctUINT32_PTR buffer;
-    gctSIZE_T index;
+    gctUINT32 index;
 
 #if !defined(VIVANTE_NO_3D)
     gctBOOL halti0, halti1, halti2, halti3;
     gctUINT i;
-    gctUINT vertexUniforms, fragmentUniforms;
-    gctBOOL unifiedUnforms;
+    gctUINT vertexUniforms, fragmentUniforms, unifiedConst, vsConstBase, psConstBase, constMax;
+    gctBOOL unifiedUniform;
     gctUINT fe2vsCount;
 #endif
 
@@ -502,12 +503,20 @@ _InitializeContextBuffer(
     halti2 = (((((gctUINT32) (Context->hardware->identity.chipMinorFeatures4)) >> (0 ? 16:16)) & ((gctUINT32) ((((1 ? 16:16) - (0 ? 16:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 16:16) - (0 ? 16:16) + 1)))))) );
     halti3 = (((((gctUINT32) (Context->hardware->identity.chipMinorFeatures5)) >> (0 ? 9:9)) & ((gctUINT32) ((((1 ? 9:9) - (0 ? 9:9) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 9:9) - (0 ? 9:9) + 1)))))) );
 
-    /* Query shader support. */
-    gcmkVERIFY_OK(gckHARDWARE_QueryShaderCaps(
-        Context->hardware, &vertexUniforms, &fragmentUniforms, &unifiedUnforms));
+    /* Query how many uniforms can support for non-unified uniform mode. */
+    {    if (Context->hardware->identity.chipModel == gcv2000 && Context->hardware->identity.chipRevision == 0x5118)    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vertexUniforms   = 256;        fragmentUniforms   = 64;        constMax     = 320;    }    else if (Context->hardware->identity.numConstants == 320)    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vertexUniforms   = 256;        fragmentUniforms   = 64;        constMax     = 320;    }    else if (Context->hardware->identity.numConstants > 256 && Context->hardware->identity.chipModel == gcv1000)    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vertexUniforms   = 256;        fragmentUniforms   = 64;        constMax     = 320;    }    else if (Context->hardware->identity.numConstants > 256)    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vertexUniforms   = 256;        fragmentUniforms   = 256;        constMax     = 512;    }    else if (Context->hardware->identity.numConstants == 256)    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vertexUniforms   = 256;        fragmentUniforms   = 256;        constMax     = 512;    }    else    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vertexUniforms   = 168;        fragmentUniforms   = 64;        constMax     = 232;    }};
+
+    if (Context->hardware->identity.numConstants > 256)
+    {
+        unifiedUniform = gcvTRUE;
+    }
+    else
+    {
+        unifiedUniform = gcvFALSE;
+    }
 
     /* Store the 3D entry index. */
-    Context->entryOffset3D = index * gcmSIZEOF(gctUINT32);
+    Context->entryOffset3D = (gctUINT)index * gcmSIZEOF(gctUINT32);
 
     /* Flush 2D pipe. */
     index += _FlushPipe(Context, index, gcvPIPE_2D);
@@ -583,11 +592,6 @@ _InitializeContextBuffer(
 
     index += _CLOSE_RANGE();
 
-    if (! unifiedUnforms)
-    {
-        index += _State(Context, index, 0x05000 >> 2, 0x00000000, vertexUniforms * 4, gcvFALSE, gcvFALSE);
-    }
-
     /* Primitive Assembly states. */
     index += _State(Context, index, 0x00A00 >> 2, 0x00000000, 1, gcvTRUE, gcvFALSE);
     index += _State(Context, index, 0x00A04 >> 2, 0x00000000, 1, gcvTRUE, gcvFALSE);
@@ -609,6 +613,11 @@ _InitializeContextBuffer(
     index += _State(Context, index, 0x00A8C >> 2, 0x00000000, 1, gcvFALSE, gcvFALSE);
     index += _State(Context, index, 0x00A88 >> 2, 0x00000000, 1, gcvFALSE, gcvFALSE);
 
+#if gcdMULTI_GPU
+    index += _State(Context, index, 0x03A00 >> 2, 0x00000000, 1, gcvFALSE, gcvFALSE);
+    index += _State(Context, index, 0x03A04 >> 2, 0x00000000, 1, gcvFALSE, gcvFALSE);
+    index += _State(Context, index, 0x03A08 >> 2, 0x00000000, 1, gcvFALSE, gcvFALSE);
+#endif
     /* Setup states. */
     index += _State(Context, index, 0x00C00 >> 2, 0x00000000, 1, gcvTRUE, gcvFALSE);
     index += _State(Context, index, 0x00C04 >> 2, 0x00000000, 1, gcvTRUE, gcvFALSE);
@@ -651,11 +660,6 @@ _InitializeContextBuffer(
 
     index += _CLOSE_RANGE();
 
-    if (! unifiedUnforms)
-    {
-        index += _State(Context, index, 0x07000 >> 2, 0x00000000, fragmentUniforms * 4, gcvFALSE, gcvFALSE);
-    }
-
     /* Texture states. */
     index += _State(Context, index, 0x02000 >> 2, 0x00000000, 12, gcvFALSE, gcvFALSE);
     index += _State(Context, index, 0x02040 >> 2, 0x00000000, 12, gcvFALSE, gcvFALSE);
@@ -739,6 +743,11 @@ _InitializeContextBuffer(
         index += _State(Context, index, 0x10700 >> 2, 0x00000F00, 32, gcvFALSE, gcvFALSE);
     }
 
+    if (halti3)
+    {
+        index += _State(Context, index, 0x10780 >> 2, 0x00030000, 32, gcvFALSE, gcvFALSE);
+    }
+
     /* ASTC */
     if ((((((gctUINT32) (Context->hardware->identity.chipMinorFeatures4)) >> (0 ? 13:13)) & ((gctUINT32) ((((1 ? 13:13) - (0 ? 13:13) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 13:13) - (0 ? 13:13) + 1)))))) ))
     {
@@ -836,25 +845,37 @@ _InitializeContextBuffer(
         _StateMirror(Context, 0x08000 >> 2, Context->hardware->identity.instructionCount << 2 , 0x0C000 >> 2);
     }
 
-    if (unifiedUnforms)
+    if (unifiedUniform)
     {
+        gctINT numConstants = Context->hardware->identity.numConstants;
+
         index += _State(Context, index, 0x01024 >> 2, 0x00000100, 1, gcvFALSE, gcvFALSE);
         index += _State(Context, index, 0x00864 >> 2, 0x00000000, 1, gcvFALSE, gcvFALSE);
         index += _CLOSE_RANGE();
 
         for (i = 0;
-             i < Context->hardware->identity.numConstants << 2;
-             i += 256 << 2
+             numConstants > 0;
+             i += 256 << 2,
+             numConstants -= 256
              )
         {
-            index += _State(Context, index, (0x30000 >> 2) + i, 0x00000000, 256 << 2, gcvFALSE, gcvFALSE);
+            if (numConstants >= 256)
+            {
+                index += _State(Context, index, (0x30000 >> 2) + i, 0x00000000, 256 << 2, gcvFALSE, gcvFALSE);
+            }
+            else
+            {
+                index += _State(Context, index, (0x30000 >> 2) + i, 0x00000000, numConstants << 2, gcvFALSE, gcvFALSE);
+            }
             index += _CLOSE_RANGE();
         }
-        index += _CLOSE_RANGE();
     }
 
+    index += _State(Context, index, 0x05000 >> 2, 0x00000000, vertexUniforms * 4, gcvFALSE, gcvFALSE);
+    index += _State(Context, index, 0x07000 >> 2, 0x00000000, fragmentUniforms * 4, gcvFALSE, gcvFALSE);
+
     /* Store the index of the "XD" entry. */
-    Context->entryOffsetXDFrom3D = index * gcmSIZEOF(gctUINT32);
+    Context->entryOffsetXDFrom3D = (gctUINT)index * gcmSIZEOF(gctUINT32);
 
 
     /* Pixel Engine states. */
@@ -1028,6 +1049,12 @@ _InitializeContextBuffer(
         index += _CLOSE_RANGE();
     }
 
+    if (halti3)
+    {
+        index += _State(Context, index, 0x01A80 >> 2, 0x00000000, 8, gcvFALSE, gcvTRUE);
+        index += _CLOSE_RANGE();
+    }
+
     /* Semaphore/stall. */
     index += _SemaphoreStall(Context, index);
 #endif
@@ -1035,7 +1062,7 @@ _InitializeContextBuffer(
     /**************************************************************************/
     /* Link to another address. ***********************************************/
 
-    Context->linkIndex3D = index;
+    Context->linkIndex3D = (gctUINT)index;
 
     if (buffer != gcvNULL)
     {
@@ -1057,7 +1084,7 @@ _InitializeContextBuffer(
     /* Pipe switch for the case where neither 2D nor 3D are used. *************/
 
     /* Store the 3D entry index. */
-    Context->entryOffsetXDFrom2D = index * gcmSIZEOF(gctUINT32);
+    Context->entryOffsetXDFrom2D = (gctUINT)index * gcmSIZEOF(gctUINT32);
 
     /* Flush 2D pipe. */
     index += _FlushPipe(Context, index, gcvPIPE_2D);
@@ -1066,7 +1093,7 @@ _InitializeContextBuffer(
     index += _SwitchPipe(Context, index, gcvPIPE_3D);
 
     /* Store the location of the link. */
-    Context->linkIndexXD = index;
+    Context->linkIndexXD = (gctUINT)index;
 
     if (buffer != gcvNULL)
     {
@@ -1229,9 +1256,10 @@ gckCONTEXT_Construct(
 {
     gceSTATUS status;
     gckCONTEXT context = gcvNULL;
-    gctSIZE_T allocationSize;
+    gctUINT32 allocationSize;
     gctUINT i;
     gctPOINTER pointer = gcvNULL;
+    gctUINT32 address;
 
     gcmkHEADER_ARG("Os=0x%08X Hardware=0x%08X", Os, Hardware);
 
@@ -1299,7 +1327,7 @@ gckCONTEXT_Construct(
     /* Compute the size of the record array. **********************************/
 
     context->recordArraySize
-        = gcmSIZEOF(gcsSTATE_DELTA_RECORD) * context->stateCount;
+        = gcmSIZEOF(gcsSTATE_DELTA_RECORD) * (gctUINT)context->stateCount;
 
 
     if (context->stateCount > 0)
@@ -1345,6 +1373,8 @@ gckCONTEXT_Construct(
         /* Allocate a context buffer. */
         gcsCONTEXT_PTR buffer;
 
+        gctSIZE_T totalSize = context->totalSize;
+
         /* Allocate the context buffer structure. */
         gcmkONERROR(gckOS_Allocate(
             Os,
@@ -1392,23 +1422,38 @@ gckCONTEXT_Construct(
             gcmkONERROR(gckKERNEL_AllocateVirtualCommandBuffer(
                 context->hardware->kernel,
                 gcvFALSE,
-                &context->totalSize,
+                &totalSize,
                 &buffer->physical,
                 &pointer
                 ));
+
+            gcmkONERROR(gckKERNEL_GetGPUAddress(
+                context->hardware->kernel,
+                pointer,
+                gcvFALSE,
+                &address
+                ));
         }
         else
         {
             gcmkONERROR(gckOS_AllocateContiguous(
                 Os,
                 gcvFALSE,
-                &context->totalSize,
+                &totalSize,
                 &buffer->physical,
                 &pointer
                 ));
+
+            gcmkONERROR(gckHARDWARE_ConvertLogical(
+                context->hardware,
+                pointer,
+                gcvFALSE,
+                &address
+                ));
         }
 
         buffer->logical = pointer;
+        buffer->address = address;
 
         /* Set gckEVENT object pointer. */
         buffer->eventObj = Hardware->kernel->eventObj;
@@ -1427,16 +1472,16 @@ gckCONTEXT_Construct(
         if (context->linkIndexXD != 0)
         {
             gctPOINTER xdLink;
-            gctUINT8_PTR xdEntryLogical;
-            gctSIZE_T xdEntrySize;
-            gctSIZE_T linkBytes;
+            gctUINT32 xdEntryAddress;
+            gctUINT32 xdEntrySize;
+            gctUINT32 linkBytes;
 
             /* Determine LINK parameters. */
             xdLink
                 = &buffer->logical[context->linkIndexXD];
 
-            xdEntryLogical
-                = (gctUINT8_PTR) buffer->logical
+            xdEntryAddress
+                = buffer->address
                 + context->entryOffsetXDFrom3D;
 
             xdEntrySize
@@ -1445,14 +1490,14 @@ gckCONTEXT_Construct(
 
             /* Query LINK size. */
             gcmkONERROR(gckHARDWARE_Link(
-                Hardware, gcvNULL, gcvNULL, 0, &linkBytes
+                Hardware, gcvNULL, 0, 0, &linkBytes
                 ));
 
             /* Generate a LINK. */
             gcmkONERROR(gckHARDWARE_Link(
                 Hardware,
                 xdLink,
-                xdEntryLogical,
+                xdEntryAddress,
                 xdEntrySize,
                 &linkBytes
                 ));
@@ -1640,7 +1685,7 @@ gckCONTEXT_Update(
 #if gcmIS_DEBUG(gcdDEBUG_CODE) && 1 && !defined(VIVANTE_NO_3D)
     /* Update current context token. */
     buffer->logical[Context->map[0x0E14].index]
-        = gcmPTR2INT(Context);
+        = (gctUINT32)gcmPTR2INT32(Context);
 #endif
 
     /* Are there any pending deltas? */
@@ -1968,11 +2013,10 @@ gckCONTEXT_MapBuffer(
             commandBuffer = (gckVIRTUAL_COMMAND_BUFFER_PTR)buffer->physical;
             physical = commandBuffer->physical;
 
-            gcmkONERROR(gckOS_LockPages(
+            gcmkONERROR(gckOS_CreateUserVirtualMapping(
                 kernel->os,
                 physical,
-                (gctSIZE_T)Context->totalSize,
-                gcvFALSE,
+                Context->totalSize,
                 &logical,
                 &pageCount));
         }
@@ -1983,7 +2027,7 @@ gckCONTEXT_MapBuffer(
             gcmkONERROR(gckOS_MapMemory(
                 kernel->os,
                 physical,
-                (gctSIZE_T)Context->totalSize,
+                Context->totalSize,
                 &logical));
         }
 
@@ -1994,7 +2038,7 @@ gckCONTEXT_MapBuffer(
         buffer = buffer->next;
     }
 
-    *Bytes = Context->totalSize;
+    *Bytes = (gctUINT)Context->totalSize;
 
     gcmkFOOTER_NO();
     return gcvSTATUS_OK;
diff --git a/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_context.h b/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_context.h
index d02e16b714e6..9b9cda624eea 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_context.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_context.h
@@ -62,6 +62,9 @@ typedef struct _gcsCONTEXT
     /* Logical address of the context buffer. */
     gctUINT32_PTR               logical;
 
+    /* Hardware address of the context buffer. */
+    gctUINT32                   address;
+
     /* Pointer to the LINK commands. */
     gctPOINTER                  link2D;
     gctPOINTER                  link3D;
@@ -90,14 +93,14 @@ struct _gckCONTEXT
     gckHARDWARE                 hardware;
 
     /* Command buffer alignment. */
-    gctSIZE_T                   alignment;
-    gctSIZE_T                   reservedHead;
-    gctSIZE_T                   reservedTail;
+    gctUINT32                   alignment;
+    gctUINT32                   reservedHead;
+    gctUINT32                   reservedTail;
 
     /* Context buffer metrics. */
     gctSIZE_T                   stateCount;
-    gctSIZE_T                   totalSize;
-    gctSIZE_T                   bufferSize;
+    gctUINT32                   totalSize;
+    gctUINT32                   bufferSize;
     gctUINT32                   linkIndex2D;
     gctUINT32                   linkIndex3D;
     gctUINT32                   linkIndexXD;
diff --git a/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.c b/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.c
index b39284df5faa..e7e7f7d1fa84 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.c
@@ -63,6 +63,7 @@ typedef struct _gcsiDEBUG_REGISTERS
     gctUINT32       signature;
 }
 gcsiDEBUG_REGISTERS;
+
 #ifdef LINUX
 extern int gpu3DMinClock;
 #endif
@@ -112,7 +113,6 @@ _IdentifyHardware(
 #if gcdMULTI_GPU
     gctUINT32 gpuCoreCount = 0;
 #endif
-    gctBOOL useHZ;
 
     gcmkHEADER_ARG("Os=0x%x", Os);
 
@@ -143,7 +143,8 @@ _IdentifyHardware(
 
 
         if (((Identity->chipModel & 0xFF00) == 0x0400)
-          && (Identity->chipModel != 0x0420))
+          && (Identity->chipModel != 0x0420)
+          && (Identity->chipModel != 0x0428))
         {
             Identity->chipModel = (gceCHIPMODEL) (Identity->chipModel & 0x0400);
         }
@@ -251,12 +252,6 @@ _IdentifyHardware(
                                      0x00088,
                                      &Identity->chipMinorFeatures3));
 
-            /*The chip has no compression supertiled*/
-            if(Identity->chipModel == gcv1000 && Identity->chipRevision == 0x5036)
-            {
-                Identity->chipMinorFeatures3
-                    = ((((gctUINT32) (Identity->chipMinorFeatures3)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 5:5) - (0 ? 5:5) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 5:5) - (0 ? 5:5) + 1))))))) << (0 ? 5:5))) | (((gctUINT32) (0x0 & ((gctUINT32) ((((1 ? 5:5) - (0 ? 5:5) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 5:5) - (0 ? 5:5) + 1))))))) << (0 ? 5:5)));
-            }
 
             /* Read chip minor featuress register #4. */
             gcmkONERROR(
@@ -300,6 +295,7 @@ _IdentifyHardware(
     if (((Identity->chipModel == gcv1000) && ((Identity->chipRevision == 0x5035)
                                            || (Identity->chipRevision == 0x5036)
                                            || (Identity->chipRevision == 0x5037)
+                                           || (Identity->chipRevision == 0x5039)
                                            || (Identity->chipRevision >= 0x5040)))
     || ((Identity->chipModel == gcv800) && (Identity->chipRevision == 0x4612))
     || ((Identity->chipModel == gcv600) && (Identity->chipRevision >= 0x4650))
@@ -309,48 +305,6 @@ _IdentifyHardware(
         Identity->superTileMode = 1;
     }
 
-    if (((Identity->chipModel == gcv4000) && (Identity->chipRevision == 0x5245))
-     || ((Identity->chipModel == gcv5000) && (Identity->chipRevision == 0x5309))
-     || ((Identity->chipModel == gcv2500) && (Identity->chipRevision == 0x5410))
-     || ((Identity->chipModel == gcv5200) && (Identity->chipRevision == 0x5410))
-     || ((Identity->chipModel == gcv6400) && (Identity->chipRevision == 0x5420))
-     || ((Identity->chipModel == gcv6400) && (Identity->chipRevision == 0x5422))
-     || ((Identity->chipModel == gcv5000) && (Identity->chipRevision == 0x5434))
-       )
-
-    {
-        useHZ = ((((gctUINT32) (Identity->chipMinorFeatures3)) >> (0 ? 26:26) & ((gctUINT32) ((((1 ? 26:26) - (0 ? 26:26) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 26:26) - (0 ? 26:26) + 1)))))) == (0x1 & ((gctUINT32) ((((1 ? 26:26) - (0 ? 26:26) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 26:26) - (0 ? 26:26) + 1)))))))
-             || ((((gctUINT32) (Identity->chipMinorFeatures3)) >> (0 ? 8:8) & ((gctUINT32) ((((1 ? 8:8) - (0 ? 8:8) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 8:8) - (0 ? 8:8) + 1)))))) == (0x1 & ((gctUINT32) ((((1 ? 8:8) - (0 ? 8:8) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 8:8) - (0 ? 8:8) + 1)))))));
-    }
-    else
-    {
-        useHZ = gcvFALSE;
-    }
-
-    /* If new HZ is available, disable other early z modes. */
-    if (useHZ)
-    {
-        /* Disable EZ. */
-        Identity->chipFeatures
-            = ((((gctUINT32) (Identity->chipFeatures)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 16:16) - (0 ? 16:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 16:16) - (0 ? 16:16) + 1))))))) << (0 ? 16:16))) | (((gctUINT32) (0x1 & ((gctUINT32) ((((1 ? 16:16) - (0 ? 16:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 16:16) - (0 ? 16:16) + 1))))))) << (0 ? 16:16)));
-    }
-
-    /* Disable HZ when EZ is present for older chips. */
-    else if (!((((gctUINT32) (Identity->chipFeatures)) >> (0 ? 16:16) & ((gctUINT32) ((((1 ? 16:16) - (0 ? 16:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 16:16) - (0 ? 16:16) + 1)))))) == (0x1 & ((gctUINT32) ((((1 ? 16:16) - (0 ? 16:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 16:16) - (0 ? 16:16) + 1))))))))
-    {
-        /* Disable HIERARCHICAL_Z. */
-        Identity->chipMinorFeatures
-            = ((((gctUINT32) (Identity->chipMinorFeatures)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 27:27) - (0 ? 27:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 27:27) - (0 ? 27:27) + 1))))))) << (0 ? 27:27))) | (((gctUINT32) (0x0 & ((gctUINT32) ((((1 ? 27:27) - (0 ? 27:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 27:27) - (0 ? 27:27) + 1))))))) << (0 ? 27:27)));
-    }
-
-    /* Disable rectangle primitive when chip is gc880_5_1_0_rc6*/
-    if ((Identity->chipModel == gcv880) && (Identity->chipRevision == 0x5106))
-    {
-        /* Disable rectangle primitive. */
-        Identity->chipMinorFeatures2
-            = ((((gctUINT32) (Identity->chipMinorFeatures2)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 5:5) - (0 ? 5:5) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 5:5) - (0 ? 5:5) + 1))))))) << (0 ? 5:5))) | (((gctUINT32) (0x0 & ((gctUINT32) ((((1 ? 5:5) - (0 ? 5:5) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 5:5) - (0 ? 5:5) + 1))))))) << (0 ? 5:5)));
-    }
-
     gcmkTRACE_ZONE(gcvLEVEL_INFO, gcvZONE_HARDWARE,
                    "Identity: chipFeatures=0x%08X",
                    Identity->chipFeatures);
@@ -592,6 +546,36 @@ _IdentifyHardware(
          Identity->varyingsCount -= 1;
      }
 
+    Identity->chip2DControl = 0;
+    if (Identity->chipModel == gcv320)
+    {
+        gctUINT32 data;
+
+        gcmkONERROR(
+            gckOS_ReadRegisterEx(Os,
+                                 Core,
+                                 0x0002C,
+                                 &data));
+
+        if ((data != 33956864) &&
+            ((Identity->chipRevision == 0x5007) ||
+            (Identity->chipRevision == 0x5220)))
+        {
+            Identity->chip2DControl |= 0xFF &
+                (Identity->chipRevision == 0x5220 ? 8 :
+                (Identity->chipRevision == 0x5007 ? 12 : 0));
+        }
+
+        if  (Identity->chipRevision == 0x5007)
+        {
+            /* Disable splitting rectangle. */
+            Identity->chip2DControl |= 0x100;
+
+            /* Enable 2D Flush. */
+            Identity->chip2DControl |= 0x200;
+        }
+    }
+
 #if gcdMULTI_GPU
 #if gcdMULTI_GPU > 1
      Identity->gpuCoreCount = gpuCoreCount + 1;
@@ -618,6 +602,8 @@ OnError:
 #define gcdDISABLE_PA_CLOCK_GATING     0
 #define gcdDISABLE_SE_CLOCK_GATING     0
 #define gcdDISABLE_RA_CLOCK_GATING     0
+#define gcdDISABLE_RA_EZ_CLOCK_GATING  0
+#define gcdDISABLE_RA_HZ_CLOCK_GATING  0
 #define gcdDISABLE_TX_CLOCK_GATING     0
 
 #if gcdDEBUG_MODULE_CLOCK_GATING
@@ -663,6 +649,14 @@ _ConfigureModuleLevelClockGating(
     data = ((((gctUINT32) (data)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 7:7) - (0 ? 7:7) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 7:7) - (0 ? 7:7) + 1))))))) << (0 ? 7:7))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 7:7) - (0 ? 7:7) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 7:7) - (0 ? 7:7) + 1))))))) << (0 ? 7:7)));
 #endif
 
+#if gcdDISABLE_RA_EZ_CLOCK_GATING
+    data = ((((gctUINT32) (data)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 16:16) - (0 ? 16:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 16:16) - (0 ? 16:16) + 1))))))) << (0 ? 16:16))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 16:16) - (0 ? 16:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 16:16) - (0 ? 16:16) + 1))))))) << (0 ? 16:16)));
+#endif
+
+#if gcdDISABLE_RA_HZ_CLOCK_GATING
+    data = ((((gctUINT32) (data)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 17:17) - (0 ? 17:17) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 17:17) - (0 ? 17:17) + 1))))))) << (0 ? 17:17))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 17:17) - (0 ? 17:17) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 17:17) - (0 ? 17:17) + 1))))))) << (0 ? 17:17)));
+#endif
+
     gcmkVERIFY_OK(
         gckOS_WriteRegisterEx(Hardware->os,
                               Hardware->core,
@@ -863,7 +857,7 @@ _FlushCache(
     )
 {
     gceSTATUS status;
-    gctSIZE_T bytes, requested;
+    gctUINT32 bytes, requested;
     gctPOINTER buffer;
 
     /* Get the size of the flush command. */
@@ -968,9 +962,12 @@ gckHARDWARE_Construct(
         hardware->type = gcvHARDWARE_VG;
         break;
 
+    case gcv200:
     case gcv300:
     case gcv320:
+    case gcv328:
     case gcv420:
+    case gcv428:
         hardware->type = gcvHARDWARE_2D;
         /*set outstanding limit*/
         gcmkONERROR(gckOS_ReadRegisterEx(Os, Core, 0x00414, &axi_ot));
@@ -1097,6 +1094,17 @@ gckHARDWARE_Construct(
     /* Disable profiler by default */
     hardware->gpuProfiler = gcvFALSE;
 
+#if defined(LINUX) || defined(__QNXNTO__) || defined(UNDERCE)
+    if (hardware->mmuVersion)
+    {
+        hardware->endAfterFlushMmuCache = gcvTRUE;
+    }
+    else
+#endif
+    {
+        hardware->endAfterFlushMmuCache = gcvFALSE;
+    }
+
     /* Return pointer to the gckHARDWARE object. */
     *Hardware = hardware;
 
@@ -1257,6 +1265,7 @@ gckHARDWARE_InitializeHardware(
     gctUINT32 chipRev;
     gctUINT32 control;
     gctUINT32 data;
+    gctUINT32 regPMC = 0;
 
     gcmkHEADER_ARG("Hardware=0x%x", Hardware);
 
@@ -1361,26 +1370,22 @@ gckHARDWARE_InitializeHardware(
         /* Disable PE clock gating on revs < 5.0 when HZ is present without a
         ** bug fix. */
         if ((Hardware->identity.chipRevision < 0x5000)
+        &&  gckHARDWARE_IsFeatureAvailable(Hardware, gcvFEATURE_HZ)
         &&  ((((gctUINT32) (Hardware->identity.chipMinorFeatures1)) >> (0 ? 9:9) & ((gctUINT32) ((((1 ? 9:9) - (0 ? 9:9) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 9:9) - (0 ? 9:9) + 1)))))) == (0x0 & ((gctUINT32) ((((1 ? 9:9) - (0 ? 9:9) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 9:9) - (0 ? 9:9) + 1)))))))
-        &&  ((((gctUINT32) (Hardware->identity.chipMinorFeatures)) >> (0 ? 27:27) & ((gctUINT32) ((((1 ? 27:27) - (0 ? 27:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 27:27) - (0 ? 27:27) + 1)))))) == (0x1 & ((gctUINT32) ((((1 ? 27:27) - (0 ? 27:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 27:27) - (0 ? 27:27) + 1)))))))
         )
         {
-            gcmkONERROR(
-                gckOS_ReadRegisterEx(Hardware->os,
-                                     Hardware->core,
-                                     Hardware->powerBaseAddress
-                                     + 0x00104,
-                                     &data));
+            if (regPMC == 0)
+            {
+                gcmkONERROR(
+                    gckOS_ReadRegisterEx(Hardware->os,
+                                         Hardware->core,
+                                         Hardware->powerBaseAddress
+                                         + 0x00104,
+                                         &regPMC));
+            }
 
             /* Disable PE clock gating. */
-            data = ((((gctUINT32) (data)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 2:2) - (0 ? 2:2) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 2:2) - (0 ? 2:2) + 1))))))) << (0 ? 2:2))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 2:2) - (0 ? 2:2) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 2:2) - (0 ? 2:2) + 1))))))) << (0 ? 2:2)));
-
-            gcmkONERROR(
-                gckOS_WriteRegisterEx(Hardware->os,
-                                      Hardware->core,
-                                      Hardware->powerBaseAddress
-                                      + 0x00104,
-                                      data));
+            regPMC = ((((gctUINT32) (regPMC)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 2:2) - (0 ? 2:2) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 2:2) - (0 ? 2:2) + 1))))))) << (0 ? 2:2))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 2:2) - (0 ? 2:2) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 2:2) - (0 ? 2:2) + 1))))))) << (0 ? 2:2)));
         }
 
 #endif
@@ -1397,32 +1402,25 @@ gckHARDWARE_InitializeHardware(
                                   ((((gctUINT32) (0x01590880)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 23:23) - (0 ? 23:23) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 23:23) - (0 ? 23:23) + 1))))))) << (0 ? 23:23))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 23:23) - (0 ? 23:23) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 23:23) - (0 ? 23:23) + 1))))))) << (0 ? 23:23)))));
     }
 
-    if ((gckHARDWARE_IsFeatureAvailable(Hardware, gcvFEATURE_HALTI2) == gcvFALSE)
-     || (gckHARDWARE_IsFeatureAvailable(Hardware, gcvFEATURE_HALTI2) && (Hardware->identity.chipRevision < 0x5422))
+    if ((gckHARDWARE_IsFeatureAvailable(Hardware, gcvFEATURE_HALTI2) == gcvSTATUS_FALSE)
+     || (Hardware->identity.chipRevision < 0x5422)
     )
     {
-        gcmkONERROR(
-            gckOS_ReadRegisterEx(Hardware->os,
-                                 Hardware->core,
-                                 Hardware->powerBaseAddress
-                                 + 0x00104,
-                                 &data));
-
-
-        data = ((((gctUINT32) (data)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 15:15) - (0 ? 15:15) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:15) - (0 ? 15:15) + 1))))))) << (0 ? 15:15))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 15:15) - (0 ? 15:15) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:15) - (0 ? 15:15) + 1))))))) << (0 ? 15:15)));
-
+        if (regPMC == 0)
+        {
+            gcmkONERROR(
+                gckOS_ReadRegisterEx(Hardware->os,
+                                     Hardware->core,
+                                     Hardware->powerBaseAddress
+                                     + 0x00104,
+                                     &regPMC));
+        }
 
-        gcmkONERROR(
-            gckOS_WriteRegisterEx(Hardware->os,
-                                  Hardware->core,
-                                  Hardware->powerBaseAddress
-                                  + 0x00104,
-                                  data));
+        regPMC = ((((gctUINT32) (regPMC)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 15:15) - (0 ? 15:15) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:15) - (0 ? 15:15) + 1))))))) << (0 ? 15:15))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 15:15) - (0 ? 15:15) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:15) - (0 ? 15:15) + 1))))))) << (0 ? 15:15)));
     }
 
 
-    if ((Hardware->identity.chipModel == gcv2000)
-    &&  (Hardware->identity.chipRevision  == 0x5108))
+    if (_IsHardwareMatch(Hardware, gcv2000, 0x5108))
     {
         gcmkONERROR(
             gckOS_ReadRegisterEx(Hardware->os,
@@ -1458,26 +1456,22 @@ gckHARDWARE_InitializeHardware(
     if (Hardware->identity.chipModel >= gcv400
     &&  Hardware->identity.chipModel != gcv420)
     {
+        if (regPMC == 0)
+        {
         gcmkONERROR(
             gckOS_ReadRegisterEx(Hardware->os,
                                  Hardware->core,
                                  Hardware->powerBaseAddress
                                  + 0x00104,
-                                 &data));
+                                 &regPMC));
+        }
 
         /* Disable PA clock gating. */
-        data = ((((gctUINT32) (data)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 4:4) - (0 ? 4:4) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 4:4) - (0 ? 4:4) + 1))))))) << (0 ? 4:4))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 4:4) - (0 ? 4:4) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 4:4) - (0 ? 4:4) + 1))))))) << (0 ? 4:4)));
-
-        gcmkONERROR(
-            gckOS_WriteRegisterEx(Hardware->os,
-                                  Hardware->core,
-                                  Hardware->powerBaseAddress
-                                  + 0x00104,
-                                  data));
+        regPMC = ((((gctUINT32) (regPMC)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 4:4) - (0 ? 4:4) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 4:4) - (0 ? 4:4) + 1))))))) << (0 ? 4:4))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 4:4) - (0 ? 4:4) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 4:4) - (0 ? 4:4) + 1))))))) << (0 ? 4:4)));
     }
 
     /* Limit 2D outstanding request. */
-    if(Hardware->identity.chipModel == gcv880 && Hardware->identity.chipRevision == 0x5107)
+    if (_IsHardwareMatch(Hardware, gcv880, 0x5107))
     {
         gctUINT32 axi_ot;
         gcmkONERROR(gckOS_ReadRegisterEx(Hardware->os, Hardware->core, 0x00414, &axi_ot));
@@ -1485,31 +1479,23 @@ gckHARDWARE_InitializeHardware(
         gcmkONERROR(gckOS_WriteRegisterEx(Hardware->os, Hardware->core, 0x00414, axi_ot));
     }
 
-    if ((Hardware->identity.chipModel == gcv320)
-        && ((Hardware->identity.chipRevision == 0x5007)
-        || (Hardware->identity.chipRevision == 0x5220)))
+    if (Hardware->identity.chip2DControl & 0xFF)
     {
+        gctUINT32 data;
+
         gcmkONERROR(
             gckOS_ReadRegisterEx(Hardware->os,
                                  Hardware->core,
-                                 0x0002C,
+                                 0x00414,
                                  &data));
-        if (data != 33956864)
-        {
-            gcmkONERROR(
-                gckOS_ReadRegisterEx(Hardware->os,
-                                     Hardware->core,
-                                     0x00414,
-                                     &data));
 
-            data = ((((gctUINT32) (data)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 7:0) - (0 ? 7:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 7:0) - (0 ? 7:0) + 1))))))) << (0 ? 7:0))) | (((gctUINT32) ((gctUINT32) (Hardware->identity.chipRevision == 0x5220 ? 8 : (Hardware->identity.chipRevision == 0x5007 ? 16 : 0)) & ((gctUINT32) ((((1 ? 7:0) - (0 ? 7:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 7:0) - (0 ? 7:0) + 1))))))) << (0 ? 7:0)));
+        data = ((((gctUINT32) (data)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 7:0) - (0 ? 7:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 7:0) - (0 ? 7:0) + 1))))))) << (0 ? 7:0))) | (((gctUINT32) ((gctUINT32) (Hardware->identity.chip2DControl & 0xFF) & ((gctUINT32) ((((1 ? 7:0) - (0 ? 7:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 7:0) - (0 ? 7:0) + 1))))))) << (0 ? 7:0)));
 
-            gcmkONERROR(
-                gckOS_WriteRegisterEx(Hardware->os,
-                                      Hardware->core,
-                                      0x00414,
-                                      data));
-        }
+        gcmkONERROR(
+            gckOS_WriteRegisterEx(Hardware->os,
+                                  Hardware->core,
+                                  0x00414,
+                                  data));
     }
 
     if (_IsHardwareMatch(Hardware, gcv1000, 0x5035))
@@ -1532,22 +1518,18 @@ gckHARDWARE_InitializeHardware(
 
     if (_IsHardwareMatch(Hardware, gcv4000, 0x5222))
     {
+        if (regPMC == 0)
+        {
         gcmkONERROR(
             gckOS_ReadRegisterEx(Hardware->os,
                                  Hardware->core,
                                  Hardware->powerBaseAddress
                                  + 0x00104,
-                                 &data));
+                                 &regPMC));
+        }
 
         /* Disable TX clock gating. */
-        data = ((((gctUINT32) (data)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 7:7) - (0 ? 7:7) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 7:7) - (0 ? 7:7) + 1))))))) << (0 ? 7:7))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 7:7) - (0 ? 7:7) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 7:7) - (0 ? 7:7) + 1))))))) << (0 ? 7:7)));
-
-        gcmkONERROR(
-            gckOS_WriteRegisterEx(Hardware->os,
-                                  Hardware->core,
-                                  Hardware->powerBaseAddress
-                                  + 0x00104,
-                                  data));
+        regPMC = ((((gctUINT32) (regPMC)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 7:7) - (0 ? 7:7) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 7:7) - (0 ? 7:7) + 1))))))) << (0 ? 7:7))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 7:7) - (0 ? 7:7) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 7:7) - (0 ? 7:7) + 1))))))) << (0 ? 7:7)));
     }
 
     if (_IsHardwareMatch(Hardware, gcv880, 0x5106))
@@ -1561,6 +1543,34 @@ gckHARDWARE_InitializeHardware(
                                       0x00008,
                                       0x00002200));
 
+
+    /*VIV: Disable RA HZ/EZ clock gating until the bug is resolved */
+    if (regPMC == 0)
+    {
+        gcmkONERROR(
+            gckOS_ReadRegisterEx(Hardware->os,
+                                 Hardware->core,
+                                 Hardware->powerBaseAddress
+                                 + 0x00104,
+                                 &regPMC));
+    }
+
+    /* Disable RA HZ clock gating. */
+    regPMC = ((((gctUINT32) (regPMC)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 17:17) - (0 ? 17:17) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 17:17) - (0 ? 17:17) + 1))))))) << (0 ? 17:17))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 17:17) - (0 ? 17:17) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 17:17) - (0 ? 17:17) + 1))))))) << (0 ? 17:17)));
+
+    /* Disable RA EZ clock gating. */
+    regPMC = ((((gctUINT32) (regPMC)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 16:16) - (0 ? 16:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 16:16) - (0 ? 16:16) + 1))))))) << (0 ? 16:16))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 16:16) - (0 ? 16:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 16:16) - (0 ? 16:16) + 1))))))) << (0 ? 16:16)));
+
+    if (regPMC != 0)
+    {
+        gcmkONERROR(
+            gckOS_WriteRegisterEx(Hardware->os,
+                                  Hardware->core,
+                                  Hardware->powerBaseAddress
+                                  + 0x00104,
+                                  regPMC));
+    }
+
 #if gcdDEBUG_MODULE_CLOCK_GATING
     _ConfigureModuleLevelClockGating(Hardware);
 #endif
@@ -1769,6 +1779,7 @@ gckHARDWARE_QueryChipIdentity(
 #if gcdMULTI_GPU
     Identity->gpuCoreCount           = Hardware->identity.gpuCoreCount;
 #endif
+    Identity->chip2DControl          = Hardware->identity.chip2DControl;
 
     /* Success. */
     gcmkFOOTER_NO();
@@ -1859,8 +1870,8 @@ gckHARDWARE_SplitMemory(
 **      gckHARDWARE Hardware
 **          Pointer to the gckHARDWARE object.
 **
-**      gctPOINTER Logical
-**          Logical address of command buffer.
+**      gctUINT32 Address
+**          Hardware address of command buffer.
 **
 **      gctSIZE_T Bytes
 **          Number of bytes for the prefetch unit (until after the first LINK).
@@ -1872,94 +1883,18 @@ gckHARDWARE_SplitMemory(
 gceSTATUS
 gckHARDWARE_Execute(
     IN gckHARDWARE Hardware,
-    IN gctPOINTER Logical,
-#ifdef __QNXNTO__
-    IN gctPOINTER Physical,
-    IN gctBOOL PhysicalAddresses,
-#endif
-    IN gctSIZE_T Bytes
-    )
-{
-    gceSTATUS status;
-    gctUINT32 address = 0, control;
-
-    gcmkHEADER_ARG("Hardware=0x%x Logical=0x%x Bytes=%lu",
-                   Hardware, Logical, Bytes);
-
-    /* Verify the arguments. */
-    gcmkVERIFY_OBJECT(Hardware, gcvOBJ_HARDWARE);
-    gcmkVERIFY_ARGUMENT(Logical != gcvNULL);
-
-#ifdef __QNXNTO__
-    if (PhysicalAddresses && (Hardware->mmuVersion == 0))
-    {
-        /* Convert physical into hardware specific address. */
-        gcmkONERROR(
-            gckHARDWARE_ConvertPhysical(Hardware, Physical, &address));
-    }
-    else
-    {
-#endif
-    /* Convert logical into hardware specific address. */
-    gcmkONERROR(
-        gckHARDWARE_ConvertLogical(Hardware, Logical, &address));
-#ifdef __QNXNTO__
-    }
-#endif
-
-    /* Enable all events. */
-    gcmkONERROR(
-        gckOS_WriteRegisterEx(Hardware->os, Hardware->core, 0x00014, ~0U));
-
-    /* Write address register. */
-    gcmkONERROR(
-        gckOS_WriteRegisterEx(Hardware->os, Hardware->core, 0x00654, address));
-
-    /* Build control register. */
-    control = ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 16:16) - (0 ? 16:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 16:16) - (0 ? 16:16) + 1))))))) << (0 ? 16:16))) | (((gctUINT32) (0x1 & ((gctUINT32) ((((1 ? 16:16) - (0 ? 16:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 16:16) - (0 ? 16:16) + 1))))))) << (0 ? 16:16)))
-            | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 15:0) - (0 ? 15:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:0) - (0 ? 15:0) + 1))))))) << (0 ? 15:0))) | (((gctUINT32) ((gctUINT32) ((Bytes + 7) >> 3) & ((gctUINT32) ((((1 ? 15:0) - (0 ? 15:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:0) - (0 ? 15:0) + 1))))))) << (0 ? 15:0)));
-
-    /* Set big endian */
-    if (Hardware->bigEndian)
-    {
-        control |= ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 21:20) - (0 ? 21:20) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 21:20) - (0 ? 21:20) + 1))))))) << (0 ? 21:20))) | (((gctUINT32) (0x2 & ((gctUINT32) ((((1 ? 21:20) - (0 ? 21:20) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 21:20) - (0 ? 21:20) + 1))))))) << (0 ? 21:20)));
-    }
-
-    /* Write control register. */
-    gcmkONERROR(
-        gckOS_WriteRegisterEx(Hardware->os, Hardware->core, 0x00658, control));
-
-    gcmkTRACE_ZONE(gcvLEVEL_INFO, gcvZONE_HARDWARE,
-                  "Started command buffer @ 0x%08x",
-                  address);
-
-    /* Success. */
-    gcmkFOOTER_NO();
-    return gcvSTATUS_OK;
-
-OnError:
-    /* Return the status. */
-    gcmkFOOTER();
-    return status;
-}
-
-#if gcdPROCESS_ADDRESS_SPACE
-gceSTATUS
-gckHARDWARE_ExecutePhysical(
-    IN gckHARDWARE Hardware,
-    IN gctUINT32 Physical,
+    IN gctUINT32 Address,
     IN gctSIZE_T Bytes
     )
 {
     gceSTATUS status;
-    gctUINT32 address = Physical, control;
+    gctUINT32 control;
 
-    gcmkHEADER_ARG("Hardware=0x%x Physical=0x%x Bytes=%lu",
-                   Hardware, Physical, Bytes);
+    gcmkHEADER_ARG("Hardware=0x%x Address=0x%x Bytes=%lu",
+                   Hardware, Address, Bytes);
 
     /* Verify the arguments. */
     gcmkVERIFY_OBJECT(Hardware, gcvOBJ_HARDWARE);
-    gcmkVERIFY_ARGUMENT(Physical != 0);
 
     /* Enable all events. */
     gcmkONERROR(
@@ -1967,7 +1902,7 @@ gckHARDWARE_ExecutePhysical(
 
     /* Write address register. */
     gcmkONERROR(
-        gckOS_WriteRegisterEx(Hardware->os, Hardware->core, 0x00654, address));
+        gckOS_WriteRegisterEx(Hardware->os, Hardware->core, 0x00654, Address));
 
     /* Build control register. */
     control = ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 16:16) - (0 ? 16:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 16:16) - (0 ? 16:16) + 1))))))) << (0 ? 16:16))) | (((gctUINT32) (0x1 & ((gctUINT32) ((((1 ? 16:16) - (0 ? 16:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 16:16) - (0 ? 16:16) + 1))))))) << (0 ? 16:16)))
@@ -1985,7 +1920,7 @@ gckHARDWARE_ExecutePhysical(
 
     gcmkTRACE_ZONE(gcvLEVEL_INFO, gcvZONE_HARDWARE,
                   "Started command buffer @ 0x%08x",
-                  address);
+                  Address);
 
     /* Success. */
     gcmkFOOTER_NO();
@@ -1996,7 +1931,6 @@ OnError:
     gcmkFOOTER();
     return status;
 }
-#endif
 
 /*******************************************************************************
 **
@@ -2043,9 +1977,9 @@ gckHARDWARE_WaitLink(
     IN gckHARDWARE Hardware,
     IN gctPOINTER Logical,
     IN gctUINT32 Offset,
-    IN OUT gctSIZE_T * Bytes,
+    IN OUT gctUINT32 * Bytes,
     OUT gctUINT32 * WaitOffset,
-    OUT gctSIZE_T * WaitSize
+    OUT gctUINT32 * WaitSize
     )
 {
     static const gctUINT waitCount = 200;
@@ -2053,7 +1987,7 @@ gckHARDWARE_WaitLink(
     gceSTATUS status;
     gctUINT32 address;
     gctUINT32_PTR logical;
-    gctSIZE_T bytes;
+    gctUINT32 bytes;
 
     gcmkHEADER_ARG("Hardware=0x%x Logical=0x%x Offset=0x%08x *Bytes=%lu",
                    Hardware, Logical, Offset, gcmOPT_VALUE(Bytes));
@@ -2081,7 +2015,7 @@ gckHARDWARE_WaitLink(
         }
 
         /* Convert logical into hardware specific address. */
-        gcmkONERROR(gckHARDWARE_ConvertLogical(Hardware, logical, &address));
+        gcmkONERROR(gckHARDWARE_ConvertLogical(Hardware, logical, gcvFALSE, &address));
 
         /* Store the WAIT/LINK address. */
         Hardware->lastWaitLink = address;
@@ -2213,7 +2147,7 @@ gceSTATUS
 gckHARDWARE_End(
     IN gckHARDWARE Hardware,
     IN gctPOINTER Logical,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     )
 {
     gctUINT32_PTR logical = (gctUINT32_PTR) Logical;
@@ -2386,101 +2320,6 @@ OnError:
 
 /*******************************************************************************
 **
-**  gckHARDWARE_Wait
-**
-**  Append a WAIT command at the specified location in the command queue.
-**
-**  INPUT:
-**
-**      gckHARDWARE Hardware
-**          Pointer to an gckHARDWARE object.
-**
-**      gctPOINTER Logical
-**          Pointer to the current location inside the command queue to append
-**          WAIT command at or gcvNULL just to query the size of the WAIT command.
-**
-**      gctUINT32 Count
-**          Number of cycles to wait.
-**
-**      gctSIZE_T * Bytes
-**          Pointer to the number of bytes available for the WAIT command.  If
-**          'Logical' is gcvNULL, this argument will be ignored.
-**
-**  OUTPUT:
-**
-**      gctSIZE_T * Bytes
-**          Pointer to a variable that will receive the number of bytes required
-**          for the NOP command.  If 'Bytes' is gcvNULL, nothing will be returned.
-*/
-gceSTATUS
-gckHARDWARE_Wait(
-    IN gckHARDWARE Hardware,
-    IN gctPOINTER Logical,
-    IN gctUINT32 Count,
-    IN OUT gctSIZE_T * Bytes
-    )
-{
-    gceSTATUS status;
-    gctUINT32_PTR logical;
-
-    gcmkHEADER_ARG("Hardware=0x%x Logical=0x%x Count=%u *Bytes=%lu",
-                   Hardware, Logical, Count, gcmOPT_VALUE(Bytes));
-
-    /* Verify the arguments. */
-    gcmkVERIFY_OBJECT(Hardware, gcvOBJ_HARDWARE);
-    gcmkVERIFY_ARGUMENT((Logical == gcvNULL) || (Bytes != gcvNULL));
-
-    /* Cast the input pointer. */
-    logical = (gctUINT32_PTR) Logical;
-
-    if (Logical != gcvNULL)
-    {
-        if (*Bytes < 8)
-        {
-            /* Command queue too small. */
-            gcmkONERROR(gcvSTATUS_BUFFER_TOO_SMALL);
-        }
-
-        /* Append WAIT. */
-        logical[0] = ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27))) | (((gctUINT32) (0x07 & ((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27)))
-                   | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 15:0) - (0 ? 15:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:0) - (0 ? 15:0) + 1))))))) << (0 ? 15:0))) | (((gctUINT32) ((gctUINT32) (Count) & ((gctUINT32) ((((1 ? 15:0) - (0 ? 15:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:0) - (0 ? 15:0) + 1))))))) << (0 ? 15:0)));
-
-#if gcmIS_DEBUG(gcdDEBUG_TRACE)
-        {
-            gctUINT32 address;
-
-            /* Convert logical into hardware specific address. */
-            gcmkONERROR(gckHARDWARE_ConvertLogical(
-                Hardware, logical, &address
-                ));
-
-            gcmkTRACE_ZONE(
-                gcvLEVEL_INFO, gcvZONE_HARDWARE,
-                "0x%08x: WAIT %u", address, Count
-                );
-        }
-#endif
-    }
-
-    if (Bytes != gcvNULL)
-    {
-        /* Return number of bytes required by the WAIT command. */
-        *Bytes = 8;
-    }
-
-    /* Success. */
-    gcmkFOOTER_ARG("*Bytes=%lu", gcmOPT_VALUE(Bytes));
-    return gcvSTATUS_OK;
-
-OnError:
-    /* Return the status. */
-    gcmkFOOTER();
-    return status;
-}
-
-
-/*******************************************************************************
-**
 **  gckHARDWARE_Event
 **
 **  Append an EVENT command at the specified location in the command queue.
@@ -2518,7 +2357,7 @@ gckHARDWARE_Event(
     IN gctPOINTER Logical,
     IN gctUINT8 Event,
     IN gceKERNEL_WHERE FromWhere,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     )
 {
     gctUINT size;
@@ -2534,6 +2373,11 @@ gckHARDWARE_Event(
     gcmkVERIFY_ARGUMENT((Logical == gcvNULL) || (Bytes != gcvNULL));
     gcmkVERIFY_ARGUMENT(Event < 32);
 
+
+#if gcdMULTI_GPU
+    if (FromWhere == gcvKERNEL_COMMAND) FromWhere = gcvKERNEL_PIXEL;
+#endif
+
     /* Determine the size of the command. */
 
     size = (Hardware->extraEventStates && (FromWhere == gcvKERNEL_PIXEL))
@@ -2652,7 +2496,7 @@ gckHARDWARE_PipeSelect(
     IN gckHARDWARE Hardware,
     IN gctPOINTER Logical,
     IN gcePIPE_SELECT Pipe,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     )
 {
     gctUINT32_PTR logical = (gctUINT32_PTR) Logical;
@@ -2761,8 +2605,8 @@ OnError:
 **          the LINK command at or gcvNULL just to query the size of the LINK
 **          command.
 **
-**      gctPOINTER FetchAddress
-**          Logical address of destination of LINK.
+**      gctUINT32 FetchAddress
+**          Hardware address of destination of LINK.
 **
 **      gctSIZE_T FetchSize
 **          Number of bytes in destination of LINK.
@@ -2781,14 +2625,13 @@ gceSTATUS
 gckHARDWARE_Link(
     IN gckHARDWARE Hardware,
     IN gctPOINTER Logical,
-    IN gctPOINTER FetchAddress,
-    IN gctSIZE_T FetchSize,
-    IN OUT gctSIZE_T * Bytes
+    IN gctUINT32 FetchAddress,
+    IN gctUINT32 FetchSize,
+    IN OUT gctUINT32 * Bytes
     )
 {
     gceSTATUS status;
     gctSIZE_T bytes;
-    gctUINT32 address;
     gctUINT32 link;
     gctUINT32_PTR logical = (gctUINT32_PTR) Logical;
 
@@ -2809,19 +2652,15 @@ gckHARDWARE_Link(
             gcmkONERROR(gcvSTATUS_BUFFER_TOO_SMALL);
         }
 
-        /* Convert logical address to hardware address. */
         gcmkONERROR(
-            gckHARDWARE_ConvertLogical(Hardware, FetchAddress, &address));
-
-        gcmkONERROR(
-            gckOS_WriteMemory(Hardware->os, logical + 1, address));
+            gckOS_WriteMemory(Hardware->os, logical + 1, FetchAddress));
 
         /* Make sure the address got written before the LINK command. */
         gcmkONERROR(
             gckOS_MemoryBarrier(Hardware->os, logical + 1));
 
         /* Compute number of 64-byte aligned bytes to fetch. */
-        bytes = gcmALIGN(address + FetchSize, 64) - address;
+        bytes = gcmALIGN(FetchAddress + FetchSize, 64) - FetchAddress;
 
         /* Append LINK(bytes / 8), FetchAddress. */
         link = ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27))) | (((gctUINT32) (0x08 & ((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27)))
@@ -2849,7 +2688,8 @@ gckHARDWARE_Link(
                 /* Record user command buffer and context buffer link
                 ** information for stuck dump.
                 **/
-                gckLINKQUEUE_Enqueue(&Hardware->linkQueue, address, address + bytes);
+                gckLINKQUEUE_Enqueue(
+                    &Hardware->linkQueue, FetchAddress, FetchAddress + (gctUINT)bytes);
             }
         }
 #endif
@@ -2954,6 +2794,9 @@ OnError:
 **      gctPOINTER Logical
 **          Logical address to convert.
 **
+**      gctBOOL InUserSpace
+**          gcvTRUE if the memory in user space.
+**
 **      gctUINT32* Address
 **          Return hardware specific address.
 **
@@ -2965,102 +2808,36 @@ gceSTATUS
 gckHARDWARE_ConvertLogical(
     IN gckHARDWARE Hardware,
     IN gctPOINTER Logical,
+    IN gctBOOL InUserSpace,
     OUT gctUINT32 * Address
     )
 {
     gctUINT32 address;
-    gceSTATUS status = gcvSTATUS_INVALID_ADDRESS;
+    gceSTATUS status;
     gctUINT32 baseAddress;
 
-    gcmkHEADER_ARG("Hardware=0x%x Logical=0x%x", Hardware, Logical);
+    gcmkHEADER_ARG("Hardware=0x%x Logical=0x%x InUserSpace=%d",
+                   Hardware, Logical, InUserSpace);
 
     /* Verify the arguments. */
     gcmkVERIFY_OBJECT(Hardware, gcvOBJ_HARDWARE);
     gcmkVERIFY_ARGUMENT(Logical != gcvNULL);
     gcmkVERIFY_ARGUMENT(Address != gcvNULL);
 
-    if (Hardware->kernel->virtualCommandBuffer)
+    /* Convert logical address into a physical address. */
+    if (InUserSpace)
     {
-        status = gckKERNEL_GetGPUAddress(Hardware->kernel, Logical, Address);
+        gcmkONERROR(gckOS_UserLogicalToPhysical(Hardware->os, Logical, &address));
     }
-
-    if (status == gcvSTATUS_INVALID_ADDRESS)
+    else
     {
-        /* Convert logical address into a physical address. */
-        gcmkONERROR(
-            gckOS_GetPhysicalAddress(Hardware->os, Logical, &address));
-
-        /* For old MMU, get GPU address according to baseAddress. */
-        if (Hardware->mmuVersion == 0)
-        {
-            gcmkONERROR(gckOS_GetBaseAddress(Hardware->os, &baseAddress));
-
-            /* Subtract base address to get a GPU address. */
-            gcmkASSERT(address >= baseAddress);
-            address -= baseAddress;
-        }
-
-        /* Return hardware specific address. */
-        *Address = (Hardware->mmuVersion == 0)
-                 ? ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 31:31) - (0 ? 31:31) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:31) - (0 ? 31:31) + 1))))))) << (0 ? 31:31))) | (((gctUINT32) (0x0 & ((gctUINT32) ((((1 ? 31:31) - (0 ? 31:31) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:31) - (0 ? 31:31) + 1))))))) << (0 ? 31:31)))
-                   | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 30:0) - (0 ? 30:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 30:0) - (0 ? 30:0) + 1))))))) << (0 ? 30:0))) | (((gctUINT32) ((gctUINT32) (address) & ((gctUINT32) ((((1 ? 30:0) - (0 ? 30:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 30:0) - (0 ? 30:0) + 1))))))) << (0 ? 30:0)))
-                 : address;
+        gcmkONERROR(gckOS_GetPhysicalAddress(Hardware->os, Logical, &address));
     }
 
-    /* Success. */
-    gcmkFOOTER_ARG("*Address=0x%08x", *Address);
-    return gcvSTATUS_OK;
-
-OnError:
-    /* Return the status. */
-    gcmkFOOTER();
-    return status;
-}
-
-/*******************************************************************************
-**
-**  gckHARDWARE_ConvertPhysical
-**
-**  Convert a physical address into a hardware specific address.
-**
-**  INPUT:
-**
-**      gckHARDWARE Hardware
-**          Pointer to an gckHARDWARE object.
-**
-**      gctPHYS_ADDR Physical
-**          Physical address to convert.
-**
-**      gctUINT32* Address
-**          Return hardware specific address.
-**
-**  OUTPUT:
-**
-**      Nothing.
-*/
-gceSTATUS
-gckHARDWARE_ConvertPhysical(
-    IN gckHARDWARE Hardware,
-    IN gctPHYS_ADDR Physical,
-    OUT gctUINT32 * Address
-    )
-{
-    gctUINT32 address;
-    gctUINT32 baseAddress;
-
-    gcmkHEADER_ARG("Hardware=0x%x Physical=0x%x", Hardware, Physical);
-
-    /* Verify the arguments. */
-    gcmkVERIFY_OBJECT(Hardware, gcvOBJ_HARDWARE);
-    gcmkVERIFY_ARGUMENT(Physical != gcvNULL);
-    gcmkVERIFY_ARGUMENT(Address != gcvNULL);
-
-    address = gcmPTR2INT(Physical);
-
     /* For old MMU, get GPU address according to baseAddress. */
     if (Hardware->mmuVersion == 0)
     {
-        gcmkVERIFY_OK(gckOS_GetBaseAddress(Hardware->os, &baseAddress));
+        gcmkONERROR(gckOS_GetBaseAddress(Hardware->os, &baseAddress));
 
         /* Subtract base address to get a GPU address. */
         gcmkASSERT(address >= baseAddress);
@@ -3073,9 +2850,14 @@ gckHARDWARE_ConvertPhysical(
                | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 30:0) - (0 ? 30:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 30:0) - (0 ? 30:0) + 1))))))) << (0 ? 30:0))) | (((gctUINT32) ((gctUINT32) (address) & ((gctUINT32) ((((1 ? 30:0) - (0 ? 30:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 30:0) - (0 ? 30:0) + 1))))))) << (0 ? 30:0)))
              : address;
 
-    /* Return the status. */
+    /* Success. */
     gcmkFOOTER_ARG("*Address=0x%08x", *Address);
     return gcvSTATUS_OK;
+
+OnError:
+    /* Return the status. */
+    gcmkFOOTER();
+    return status;
 }
 
 /*******************************************************************************
@@ -3205,9 +2987,9 @@ OnError:
 gceSTATUS
 gckHARDWARE_QueryCommandBuffer(
     IN gckHARDWARE Hardware,
-    OUT gctSIZE_T * Alignment,
-    OUT gctSIZE_T * ReservedHead,
-    OUT gctSIZE_T * ReservedTail
+    OUT gctUINT32 * Alignment,
+    OUT gctUINT32 * ReservedHead,
+    OUT gctUINT32 * ReservedTail
     )
 {
     gcmkHEADER_ARG("Hardware=0x%x", Hardware);
@@ -3328,13 +3110,14 @@ gckHARDWARE_QueryShaderCaps(
     gctUINT32 psConstMax;
     gctUINT32 vsConstBase;
     gctUINT32 psConstBase;
+    gctUINT32 ConstMax;
 
     gcmkHEADER_ARG("Hardware=0x%x VertexUniforms=0x%x "
                    "FragmentUniforms=0x%x UnifiedUnforms=0x%x",
                    Hardware, VertexUniforms,
                    FragmentUniforms, UnifiedUnforms);
 
-    {    if (Hardware->identity.chipModel == gcv2000 && Hardware->identity.chipRevision == 0x5118)    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vsConstMax   = 256;        psConstMax   = 64;    }    else if (Hardware->identity.numConstants == 320)    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vsConstMax   = 256;        psConstMax   = 64;    }    else if (Hardware->identity.numConstants > 256 && Hardware->identity.chipModel == gcv1000)    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vsConstMax   = 256;        psConstMax   = 64;    }    else if (Hardware->identity.numConstants > 256)    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vsConstMax   = 256;        psConstMax   = 256;    }    else if (Hardware->identity.numConstants == 256)    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vsConstMax   = 256;        psConstMax   = 256;    }    else    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vsConstMax   = 168;        psConstMax   = 64;    }};
+    {    if (Hardware->identity.chipModel == gcv2000 && Hardware->identity.chipRevision == 0x5118)    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vsConstMax   = 256;        psConstMax   = 64;        ConstMax = 320;    }    else if (Hardware->identity.numConstants == 320)    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vsConstMax   = 256;        psConstMax   = 64;        ConstMax = 320;    }    else if (Hardware->identity.numConstants > 256 && Hardware->identity.chipModel == gcv1000)    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vsConstMax   = 256;        psConstMax   = 64;        ConstMax = 320;    }    else if (Hardware->identity.numConstants > 256)    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vsConstMax   = 256;        psConstMax   = 256;        ConstMax = 512;    }    else if (Hardware->identity.numConstants == 256)    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vsConstMax   = 256;        psConstMax   = 256;        ConstMax = 512;    }    else    {        unifiedConst = gcvFALSE;        vsConstBase  = 0x1400;        psConstBase  = 0x1C00;        vsConstMax   = 168;        psConstMax   = 64;        ConstMax = 232;    }};
 
     if (VertexUniforms != gcvNULL)
     {
@@ -3386,7 +3169,6 @@ gckHARDWARE_SetMMU(
 {
     gceSTATUS status;
     gctUINT32 address = 0;
-    gctUINT32 baseAddress;
 
     gcmkHEADER_ARG("Hardware=0x%x Logical=0x%x", Hardware, Logical);
 
@@ -3394,38 +3176,33 @@ gckHARDWARE_SetMMU(
     gcmkVERIFY_OBJECT(Hardware, gcvOBJ_HARDWARE);
     gcmkVERIFY_ARGUMENT(Logical != gcvNULL);
 
-    /* Convert the logical address into an hardware address. */
-    gcmkONERROR(
-        gckHARDWARE_ConvertLogical(Hardware, Logical, &address));
-
-    /* Also get the base address - we need a real physical address. */
-    gcmkONERROR(
-        gckOS_GetBaseAddress(Hardware->os, &baseAddress));
+    /* Convert the logical address into physical address. */
+    gcmkONERROR(gckOS_GetPhysicalAddress(Hardware->os, Logical, &address));
 
     gcmkTRACE_ZONE(gcvLEVEL_INFO, gcvZONE_HARDWARE,
                    "Setting page table to 0x%08X",
-                   address + baseAddress);
+                   address);
 
     /* Write the AQMemoryFePageTable register. */
     gcmkONERROR(
         gckOS_WriteRegisterEx(Hardware->os,
                               Hardware->core,
                               0x00400,
-                              address + baseAddress));
+                              address));
 
     /* Write the AQMemoryRaPageTable register. */
     gcmkONERROR(
         gckOS_WriteRegisterEx(Hardware->os,
                               Hardware->core,
                               0x00410,
-                              address + baseAddress));
+                              address));
 
     /* Write the AQMemoryTxPageTable register. */
     gcmkONERROR(
         gckOS_WriteRegisterEx(Hardware->os,
                               Hardware->core,
                               0x00404,
-                              address + baseAddress));
+                              address));
 
 
     /* Write the AQMemoryPePageTable register. */
@@ -3433,14 +3210,14 @@ gckHARDWARE_SetMMU(
         gckOS_WriteRegisterEx(Hardware->os,
                               Hardware->core,
                               0x00408,
-                              address + baseAddress));
+                              address));
 
     /* Write the AQMemoryPezPageTable register. */
     gcmkONERROR(
         gckOS_WriteRegisterEx(Hardware->os,
                               Hardware->core,
                               0x0040C,
-                              address + baseAddress));
+                              address));
 
     /* Return the status. */
     gcmkFOOTER_NO();
@@ -3475,8 +3252,7 @@ gckHARDWARE_FlushMMU(
     gceSTATUS status;
     gckCOMMAND command;
     gctUINT32_PTR buffer;
-    gctSIZE_T bufferSize;
-    gctBOOL commitEntered = gcvFALSE;
+    gctUINT32 bufferSize;
     gctPOINTER pointer = gcvNULL;
     gctUINT32 flushSize;
     gctUINT32 count;
@@ -3490,10 +3266,6 @@ gckHARDWARE_FlushMMU(
     /* Verify the gckCOMMAND object pointer. */
     command = Hardware->kernel->command;
 
-    /* Acquire the command queue. */
-    gcmkONERROR(gckCOMMAND_EnterCommit(command, gcvFALSE));
-    commitEntered = gcvTRUE;
-
     /* Flush the memory controller. */
     if (Hardware->mmuVersion == 0)
     {
@@ -3527,7 +3299,7 @@ gckHARDWARE_FlushMMU(
 
         buffer = (gctUINT32_PTR) pointer;
 
-        count = (bufferSize - flushSize + 7) >> 3;
+        count = ((gctUINT)bufferSize - flushSize + 7) >> 3;
 
         gcmkONERROR(gckOS_GetPhysicalAddress(command->os, buffer, &physical));
 
@@ -3608,21 +3380,11 @@ gckHARDWARE_FlushMMU(
         gcmkONERROR(gckCOMMAND_Execute(command, flushSize));
     }
 
-    /* Release the command queue. */
-    gcmkONERROR(gckCOMMAND_ExitCommit(command, gcvFALSE));
-    commitEntered = gcvFALSE;
-
     /* Success. */
     gcmkFOOTER_NO();
     return gcvSTATUS_OK;
 
 OnError:
-    if (commitEntered)
-    {
-        /* Release the command queue mutex. */
-        gcmkVERIFY_OK(gckCOMMAND_ExitCommit(Hardware->kernel->command,
-                                            gcvFALSE));
-    }
 
     /* Return the status. */
     gcmkFOOTER();
@@ -3658,7 +3420,7 @@ gckHARDWARE_SetMMUv2(
     gctUINT32 config, address;
     gckCOMMAND command;
     gctUINT32_PTR buffer;
-    gctSIZE_T bufferSize;
+    gctUINT32 bufferSize;
     gctBOOL commitEntered = gcvFALSE;
     gctPOINTER pointer = gcvNULL;
     gctBOOL acquired = gcvFALSE;
@@ -4300,15 +4062,18 @@ gckHARDWARE_Flush(
     IN gckHARDWARE Hardware,
     IN gceKERNEL_FLUSH Flush,
     IN gctPOINTER Logical,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     )
 {
     gctUINT32 pipe;
     gctUINT32 flush = 0;
+    gctBOOL flushTileStatus;
     gctUINT32_PTR logical = (gctUINT32_PTR) Logical;
     gceSTATUS status;
     gctBOOL fcFlushStall;
-    gctUINT32 reserveBytes = 8;
+    gctUINT32 reserveBytes
+        /* Semaphore/Stall */
+        = 4 * gcmSIZEOF(gctUINT32);
 
     gcmkHEADER_ARG("Hardware=0x%x Flush=0x%x Logical=0x%x *Bytes=%lu",
                    Hardware, Flush, Logical, gcmOPT_VALUE(Bytes));
@@ -4320,14 +4085,10 @@ gckHARDWARE_Flush(
     pipe = Hardware->kernel->command->pipeSelect;
 
     fcFlushStall
-        = ((((gctUINT32) (Hardware->identity.chipMinorFeatures1)) >> (0 ? 31:31) & ((gctUINT32) ((((1 ? 31:31) - (0 ? 31:31) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:31) - (0 ? 31:31) + 1)))))) == (0x1 & ((gctUINT32) ((((1 ? 31:31) - (0 ? 31:31) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:31) - (0 ? 31:31) + 1)))))))
-        && (Flush == gcvFLUSH_ALL)
-        ;
+        = ((((gctUINT32) (Hardware->identity.chipMinorFeatures1)) >> (0 ? 31:31) & ((gctUINT32) ((((1 ? 31:31) - (0 ? 31:31) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:31) - (0 ? 31:31) + 1)))))) == (0x1 & ((gctUINT32) ((((1 ? 31:31) - (0 ? 31:31) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:31) - (0 ? 31:31) + 1)))))));
 
-    if (fcFlushStall)
-    {
-        reserveBytes += 8;
-    }
+    /* Flush tile status cache. */
+    flushTileStatus = (Flush & gcvFLUSH_TILE_STATUS) && fcFlushStall;
 
     /* Flush 3D color cache. */
     if ((Flush & gcvFLUSH_COLOR) && (pipe == 0x0))
@@ -4361,8 +4122,19 @@ gckHARDWARE_Flush(
     }
 #endif
 
+    /* Determine reserve bytes. */
+    if (flush)
+    {
+        reserveBytes += 2 * gcmSIZEOF(gctUINT32);
+    }
+
+    if (flushTileStatus)
+    {
+        reserveBytes += 2 * gcmSIZEOF(gctUINT32);
+    }
+
     /* See if there is a valid flush. */
-    if (flush == 0)
+    if ((flush == 0) && (flushTileStatus == gcvFALSE))
     {
         if (Bytes != gcvNULL)
         {
@@ -4382,29 +4154,52 @@ gckHARDWARE_Flush(
                 gcmkONERROR(gcvSTATUS_BUFFER_TOO_SMALL);
             }
 
-            /* Append LOAD_STATE to AQFlush. */
-            logical[0] = ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27))) | (((gctUINT32) (0x01 & ((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27)))
-                       | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 15:0) - (0 ? 15:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:0) - (0 ? 15:0) + 1))))))) << (0 ? 15:0))) | (((gctUINT32) ((gctUINT32) (0x0E03) & ((gctUINT32) ((((1 ? 15:0) - (0 ? 15:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:0) - (0 ? 15:0) + 1))))))) << (0 ? 15:0)))
-                       | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 25:16) - (0 ? 25:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 25:16) - (0 ? 25:16) + 1))))))) << (0 ? 25:16))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 25:16) - (0 ? 25:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 25:16) - (0 ? 25:16) + 1))))))) << (0 ? 25:16)));
+            if (flush)
+            {
+                /* Append LOAD_STATE to AQFlush. */
+                *logical++
+                    = ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27))) | (((gctUINT32) (0x01 & ((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27)))
+                    | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 15:0) - (0 ? 15:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:0) - (0 ? 15:0) + 1))))))) << (0 ? 15:0))) | (((gctUINT32) ((gctUINT32) (0x0E03) & ((gctUINT32) ((((1 ? 15:0) - (0 ? 15:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:0) - (0 ? 15:0) + 1))))))) << (0 ? 15:0)))
+                    | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 25:16) - (0 ? 25:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 25:16) - (0 ? 25:16) + 1))))))) << (0 ? 25:16))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 25:16) - (0 ? 25:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 25:16) - (0 ? 25:16) + 1))))))) << (0 ? 25:16)));
 
-            logical[1] = flush;
+                *logical++
+                    = flush;
 
-            gcmkTRACE_ZONE(gcvLEVEL_INFO, gcvZONE_HARDWARE,
-                           "0x%x: FLUSH 0x%x", logical, flush);
+                gcmkTRACE_ZONE(gcvLEVEL_INFO, gcvZONE_HARDWARE,
+                        "0x%x: FLUSH 0x%x", logical - 1, flush);
+            }
 
-            if (fcFlushStall)
+            if (flushTileStatus)
             {
-                logical[2] = ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27))) | (((gctUINT32) (0x01 & ((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27)))
-                           | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 15:0) - (0 ? 15:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:0) - (0 ? 15:0) + 1))))))) << (0 ? 15:0))) | (((gctUINT32) ((gctUINT32) (0x0594) & ((gctUINT32) ((((1 ? 15:0) - (0 ? 15:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:0) - (0 ? 15:0) + 1))))))) << (0 ? 15:0)))
-                           | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 25:16) - (0 ? 25:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 25:16) - (0 ? 25:16) + 1))))))) << (0 ? 25:16))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 25:16) - (0 ? 25:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 25:16) - (0 ? 25:16) + 1))))))) << (0 ? 25:16)));
-
-                logical[3] = ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 0:0) - (0 ? 0:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 0:0) - (0 ? 0:0) + 1))))))) << (0 ? 0:0))) | (((gctUINT32) (0x1 & ((gctUINT32) ((((1 ? 0:0) - (0 ? 0:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 0:0) - (0 ? 0:0) + 1))))))) << (0 ? 0:0)));
+                *logical++
+                    = ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27))) | (((gctUINT32) (0x01 & ((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27)))
+                    | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 15:0) - (0 ? 15:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:0) - (0 ? 15:0) + 1))))))) << (0 ? 15:0))) | (((gctUINT32) ((gctUINT32) (0x0594) & ((gctUINT32) ((((1 ? 15:0) - (0 ? 15:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:0) - (0 ? 15:0) + 1))))))) << (0 ? 15:0)))
+                    | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 25:16) - (0 ? 25:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 25:16) - (0 ? 25:16) + 1))))))) << (0 ? 25:16))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 25:16) - (0 ? 25:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 25:16) - (0 ? 25:16) + 1))))))) << (0 ? 25:16)));
 
+                *logical++
+                    = ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 0:0) - (0 ? 0:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 0:0) - (0 ? 0:0) + 1))))))) << (0 ? 0:0))) | (((gctUINT32) (0x1 & ((gctUINT32) ((((1 ? 0:0) - (0 ? 0:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 0:0) - (0 ? 0:0) + 1))))))) << (0 ? 0:0)));
 
                 gcmkTRACE_ZONE(gcvLEVEL_INFO, gcvZONE_HARDWARE,
-                               "0x%x: FLUSH 0x%x", logical + 3, logical[3]);
+                               "0x%x: FLUSH TILE STATUS 0x%x", logical - 1, logical[-1]);
             }
 
+            /* Semaphore. */
+            *logical++
+                = ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27))) | (((gctUINT32) (0x01 & ((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27)))
+                | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 25:16) - (0 ? 25:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 25:16) - (0 ? 25:16) + 1))))))) << (0 ? 25:16))) | (((gctUINT32) ((gctUINT32) (1) & ((gctUINT32) ((((1 ? 25:16) - (0 ? 25:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 25:16) - (0 ? 25:16) + 1))))))) << (0 ? 25:16)))
+                | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 15:0) - (0 ? 15:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:0) - (0 ? 15:0) + 1))))))) << (0 ? 15:0))) | (((gctUINT32) ((gctUINT32) (0x0E02) & ((gctUINT32) ((((1 ? 15:0) - (0 ? 15:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 15:0) - (0 ? 15:0) + 1))))))) << (0 ? 15:0)));
+
+            *logical++
+                = ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 4:0) - (0 ? 4:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 4:0) - (0 ? 4:0) + 1))))))) << (0 ? 4:0))) | (((gctUINT32) (0x01 & ((gctUINT32) ((((1 ? 4:0) - (0 ? 4:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 4:0) - (0 ? 4:0) + 1))))))) << (0 ? 4:0)))
+                | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 12:8) - (0 ? 12:8) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 12:8) - (0 ? 12:8) + 1))))))) << (0 ? 12:8))) | (((gctUINT32) (0x07 & ((gctUINT32) ((((1 ? 12:8) - (0 ? 12:8) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 12:8) - (0 ? 12:8) + 1))))))) << (0 ? 12:8)));
+
+            /* Stall. */
+            *logical++
+                = ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27))) | (((gctUINT32) (0x09 & ((gctUINT32) ((((1 ? 31:27) - (0 ? 31:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 31:27) - (0 ? 31:27) + 1))))))) << (0 ? 31:27)));
+
+            *logical++
+                = ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 4:0) - (0 ? 4:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 4:0) - (0 ? 4:0) + 1))))))) << (0 ? 4:0))) | (((gctUINT32) (0x05 & ((gctUINT32) ((((1 ? 4:0) - (0 ? 4:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 4:0) - (0 ? 4:0) + 1))))))) << (0 ? 4:0)))
+                | ((((gctUINT32) (0)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 12:8) - (0 ? 12:8) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 12:8) - (0 ? 12:8) + 1))))))) << (0 ? 12:8))) | (((gctUINT32) (0x07 & ((gctUINT32) ((((1 ? 12:8) - (0 ? 12:8) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 12:8) - (0 ? 12:8) + 1))))))) << (0 ? 12:8)));
         }
 
         if (Bytes != gcvNULL)
@@ -4570,7 +4365,7 @@ gckHARDWARE_SetPowerManagementState(
     gckOS os;
     gctUINT flag, clock;
     gctPOINTER buffer;
-    gctSIZE_T bytes, requested;
+    gctUINT32 bytes, requested;
     gctBOOL acquired = gcvFALSE;
     gctBOOL mutexAcquired = gcvFALSE;
     gctBOOL stall = gcvTRUE;
@@ -5499,7 +5294,7 @@ gckHARDWARE_SetGpuProfiler(
 
     if (GpuProfiler == gcvTRUE)
     {
-        gctUINT32 data;
+        gctUINT32 data = 0;
 
         /* Need to disable clock gating when doing profiling. */
         gcmkVERIFY_OK(
@@ -6245,7 +6040,7 @@ gckHARDWARE_UpdateContextProfile(
     gcsPROFILER_COUNTERS * profiler = &Context->latestProfiler;
     gcsPROFILER_COUNTERS * profilerHistroy = &Context->histroyProfiler;
     gctUINT i, clock;
-    gctUINT32 colorKilled, colorDrawn, depthKilled, depthDrawn;
+    gctUINT32 colorKilled = 0, colorDrawn = 0, depthKilled = 0, depthDrawn = 0;
     gctUINT32 totalRead, totalWrite;
     gceCHIPMODEL chipModel;
     gctUINT32 chipRevision;
@@ -6349,8 +6144,6 @@ gckHARDWARE_UpdateContextProfile(
                                       clock));
 
 
-
-
     /* Reset counters. */
     gcmkONERROR(
         gckOS_WriteRegisterEx(Hardware->os, Hardware->core, 0x0003C, 1));
@@ -6577,6 +6370,34 @@ OnError:
 }
 #endif
 
+
+#if VIVANTE_PROFILER_NEW
+gceSTATUS
+gckHARDWARE_InitProfiler(
+    IN gckHARDWARE Hardware
+    )
+{
+    gceSTATUS status;
+    gctUINT32 control;
+
+    gcmkHEADER_ARG("Hardware=0x%x", Hardware);
+    gcmkONERROR(gckOS_ReadRegisterEx(Hardware->os,
+                                     Hardware->core,
+                                     0x00000,
+                                     &control));
+    /* Enable debug register. */
+    gcmkONERROR(gckOS_WriteRegisterEx(Hardware->os,
+                                      Hardware->core,
+                                      0x00000,
+                                      ((((gctUINT32) (control)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 11:11) - (0 ? 11:11) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 11:11) - (0 ? 11:11) + 1))))))) << (0 ? 11:11))) | (((gctUINT32) ((gctUINT32) (0) & ((gctUINT32) ((((1 ? 11:11) - (0 ? 11:11) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 11:11) - (0 ? 11:11) + 1))))))) << (0 ? 11:11)))));
+
+OnError:
+    /* Return the status. */
+    gcmkFOOTER();
+    return status;
+}
+#endif
+
 static gceSTATUS
 _ResetGPU(
     IN gckHARDWARE Hardware,
@@ -7068,6 +6889,18 @@ gckHARDWARE_IsFeatureAvailable(
         available = ((((gctUINT32) (Hardware->identity.chipMinorFeatures)) >> (0 ? 22:22) & ((gctUINT32) ((((1 ? 22:22) - (0 ? 22:22) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 22:22) - (0 ? 22:22) + 1)))))) == (0x1  & ((gctUINT32) ((((1 ? 22:22) - (0 ? 22:22) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 22:22) - (0 ? 22:22) + 1)))))));
         break;
 
+    case gcvFEATURE_EARLY_Z:
+        available = ((((gctUINT32) (Hardware->identity.chipFeatures)) >> (0 ? 16:16) & ((gctUINT32) ((((1 ? 16:16) - (0 ? 16:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 16:16) - (0 ? 16:16) + 1)))))) == (0x0 & ((gctUINT32) ((((1 ? 16:16) - (0 ? 16:16) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 16:16) - (0 ? 16:16) + 1)))))));
+        break;
+
+    case gcvFEATURE_HZ:
+        available = ((((gctUINT32) (Hardware->identity.chipMinorFeatures)) >> (0 ? 27:27) & ((gctUINT32) ((((1 ? 27:27) - (0 ? 27:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 27:27) - (0 ? 27:27) + 1)))))) == (0x1 & ((gctUINT32) ((((1 ? 27:27) - (0 ? 27:27) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 27:27) - (0 ? 27:27) + 1)))))));
+        break;
+
+    case gcvFEATURE_NEW_HZ:
+        available = ((((gctUINT32) (Hardware->identity.chipMinorFeatures3)) >> (0 ? 26:26) & ((gctUINT32) ((((1 ? 26:26) - (0 ? 26:26) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 26:26) - (0 ? 26:26) + 1)))))) == (0x1 & ((gctUINT32) ((((1 ? 26:26) - (0 ? 26:26) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 26:26) - (0 ? 26:26) + 1)))))));
+        break;
+
     case gcvFEATURE_FAST_MSAA:
         available = ((((gctUINT32) (Hardware->identity.chipMinorFeatures3)) >> (0 ? 8:8) & ((gctUINT32) ((((1 ? 8:8) - (0 ? 8:8) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 8:8) - (0 ? 8:8) + 1)))))) == (0x1 & ((gctUINT32) ((((1 ? 8:8) - (0 ? 8:8) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 8:8) - (0 ? 8:8) + 1)))))));
         break;
@@ -7112,8 +6945,8 @@ gckHARDWARE_IsFeatureAvailable(
     }
 
     /* Return result. */
-    gcmkFOOTER_ARG("%d", available ? gcvSTATUS_TRUE : gcvSTATUS_OK);
-    return available ? gcvSTATUS_TRUE : gcvSTATUS_OK;
+    gcmkFOOTER_ARG("%d", available ? gcvSTATUS_TRUE : gcvSTATUS_FALSE);
+    return available ? gcvSTATUS_TRUE : gcvSTATUS_FALSE;
 }
 
 /*******************************************************************************
@@ -7136,8 +6969,13 @@ gckHARDWARE_DumpMMUException(
     IN gckHARDWARE Hardware
     )
 {
-    gctUINT32 mmu, mmuStatus, address, i;
-    gctUINT32 mtlb, stlb, offset;
+    gctUINT32 mmu       = 0;
+    gctUINT32 mmuStatus = 0;
+    gctUINT32 address   = 0;
+    gctUINT32 i         = 0;
+    gctUINT32 mtlb      = 0;
+    gctUINT32 stlb      = 0;
+    gctUINT32 offset    = 0;
 #if gcdPROCESS_ADDRESS_SPACE
     gcsDATABASE_PTR database;
 #endif
@@ -7308,16 +7146,16 @@ gckHARDWARE_DumpGPUState(
     };
 
     gceSTATUS status;
-    gckKERNEL kernel;
-    gctUINT32 idle, axi;
-    gctUINT32 dmaAddress1, dmaAddress2;
-    gctUINT32 dmaState1, dmaState2;
-    gctUINT32 dmaLow, dmaHigh;
-    gctUINT32 cmdState, cmdDmaState, cmdFetState;
-    gctUINT32 dmaReqState, calState, veReqState;
+    gckKERNEL kernel = gcvNULL;
+    gctUINT32 idle = 0, axi = 0;
+    gctUINT32 dmaAddress1 = 0, dmaAddress2 = 0;
+    gctUINT32 dmaState1 = 0, dmaState2 = 0;
+    gctUINT32 dmaLow = 0, dmaHigh = 0;
+    gctUINT32 cmdState = 0, cmdDmaState = 0, cmdFetState = 0;
+    gctUINT32 dmaReqState = 0, calState = 0, veReqState = 0;
     gctUINT i;
-    gctUINT pipe, pixelPipes;
-    gctUINT32 control, oldControl;
+    gctUINT pipe = 0, pixelPipes = 0;
+    gctUINT32 control = 0, oldControl = 0;
     gckOS os = Hardware->os;
     gceCORE core = Hardware->core;
 
diff --git a/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.h b/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.h
index e3f9c6f9b12a..2fd731cb6886 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.h
@@ -92,6 +92,8 @@ struct _gckHARDWARE
 
     gctBOOL                     powerManagement;
     gctBOOL                     gpuProfiler;
+
+    gctBOOL                     endAfterFlushMmuCache;
 };
 
 gceSTATUS
diff --git a/drivers/mxc/gpu-viv/hal/kernel/archvg/gc_hal_kernel_hardware_command_vg.c b/drivers/mxc/gpu-viv/hal/kernel/archvg/gc_hal_kernel_hardware_command_vg.c
index 225a10ac83a3..049071d6c505 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/archvg/gc_hal_kernel_hardware_command_vg.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/archvg/gc_hal_kernel_hardware_command_vg.c
@@ -177,8 +177,8 @@ gckVGCOMMAND_StateCommand(
     IN gctUINT32 Pipe,
     IN gctPOINTER Logical,
     IN gctUINT32 Address,
-    IN gctSIZE_T Count,
-    IN OUT gctSIZE_T * Bytes
+    IN gctUINT32 Count,
+    IN OUT gctUINT32 * Bytes
     )
 {
     gcmkHEADER_ARG("Command=0x%x Pipe=0x%x Logical=0x%x Address=0x%x Count=0x%x Bytes = 0x%x",
@@ -278,7 +278,7 @@ gckVGCOMMAND_RestartCommand(
     IN gctPOINTER Logical,
     IN gctUINT32 FetchAddress,
     IN gctUINT FetchCount,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     )
 {
     gcmkHEADER_ARG("Command=0x%x Logical=0x%x FetchAddress=0x%x FetchCount=0x%x Bytes = 0x%x",
@@ -369,7 +369,7 @@ gckVGCOMMAND_FetchCommand(
     IN gctPOINTER Logical,
     IN gctUINT32 FetchAddress,
     IN gctUINT FetchCount,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     )
 {
     gcmkHEADER_ARG("Command=0x%x Logical=0x%x FetchAddress=0x%x FetchCount=0x%x Bytes = 0x%x",
@@ -471,7 +471,7 @@ gckVGCOMMAND_CallCommand(
     IN gctPOINTER Logical,
     IN gctUINT32 FetchAddress,
     IN gctUINT FetchCount,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     )
 {
     gcmkHEADER_ARG("Command=0x%x Logical=0x%x FetchAddress=0x%x FetchCount=0x%x Bytes = 0x%x",
@@ -543,7 +543,7 @@ gceSTATUS
 gckVGCOMMAND_ReturnCommand(
     IN gckVGCOMMAND Command,
     IN gctPOINTER Logical,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     )
 {
     gcmkHEADER_ARG("Command=0x%x Logical=0x%x  Bytes = 0x%x",
@@ -620,7 +620,7 @@ gckVGCOMMAND_EventCommand(
     IN gctPOINTER Logical,
     IN gceBLOCK Block,
     IN gctINT32 InterruptId,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     )
 {
     gcmkHEADER_ARG("Command=0x%x Logical=0x%x Block=0x%x InterruptId=0x%x Bytes = 0x%x",
@@ -858,7 +858,7 @@ gckVGCOMMAND_EndCommand(
     IN gckVGCOMMAND Command,
     IN gctPOINTER Logical,
     IN gctINT32 InterruptId,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     )
 {
     gcmkHEADER_ARG("Command=0x%x Logical=0x%x InterruptId=0x%x Bytes = 0x%x",
diff --git a/drivers/mxc/gpu-viv/hal/kernel/archvg/gc_hal_kernel_hardware_command_vg.h b/drivers/mxc/gpu-viv/hal/kernel/archvg/gc_hal_kernel_hardware_command_vg.h
index d033fda14340..ad4fecd5585f 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/archvg/gc_hal_kernel_hardware_command_vg.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/archvg/gc_hal_kernel_hardware_command_vg.h
@@ -255,8 +255,8 @@ gckVGCOMMAND_StateCommand(
     IN gctUINT32 Pipe,
     IN gctPOINTER Logical,
     IN gctUINT32 Address,
-    IN gctSIZE_T Count,
-    IN OUT gctSIZE_T * Bytes
+    IN gctUINT32 Count,
+    IN OUT gctUINT32 * Bytes
     );
 
 /* Form a RESTART command at the specified location in the command buffer. */
@@ -266,7 +266,7 @@ gckVGCOMMAND_RestartCommand(
     IN gctPOINTER Logical,
     IN gctUINT32 FetchAddress,
     IN gctUINT FetchCount,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     );
 
 /* Form a FETCH command at the specified location in the command buffer. */
@@ -276,7 +276,7 @@ gckVGCOMMAND_FetchCommand(
     IN gctPOINTER Logical,
     IN gctUINT32 FetchAddress,
     IN gctUINT FetchCount,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     );
 
 /* Form a CALL command at the specified location in the command buffer. */
@@ -286,7 +286,7 @@ gckVGCOMMAND_CallCommand(
     IN gctPOINTER Logical,
     IN gctUINT32 FetchAddress,
     IN gctUINT FetchCount,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     );
 
 /* Form a RETURN command at the specified location in the command buffer. */
@@ -294,7 +294,7 @@ gceSTATUS
 gckVGCOMMAND_ReturnCommand(
     IN gckVGCOMMAND Command,
     IN gctPOINTER Logical,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     );
 
 /* Form an EVENT command at the specified location in the command buffer. */
@@ -304,7 +304,7 @@ gckVGCOMMAND_EventCommand(
     IN gctPOINTER Logical,
     IN gceBLOCK Block,
     IN gctINT32 InterruptId,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     );
 
 /* Form an END command at the specified location in the command buffer. */
@@ -313,7 +313,7 @@ gckVGCOMMAND_EndCommand(
     IN gckVGCOMMAND Command,
     IN gctPOINTER Logical,
     IN gctINT32 InterruptId,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     );
 
 #endif  /* __gc_hal_kernel_hardware_command_h_ */
diff --git a/drivers/mxc/gpu-viv/hal/kernel/archvg/gc_hal_kernel_hardware_vg.c b/drivers/mxc/gpu-viv/hal/kernel/archvg/gc_hal_kernel_hardware_vg.c
index 3677d4682b23..07f582de3ad6 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/archvg/gc_hal_kernel_hardware_vg.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/archvg/gc_hal_kernel_hardware_vg.c
@@ -311,8 +311,8 @@ gckVGHARDWARE_Construct(
         hardware->clockState            = gcvTRUE;
         hardware->powerState            = gcvTRUE;
 
-        hardware->powerOffTime          = 0;
 #if gcdPOWEROFF_TIMEOUT
+        hardware->powerOffTime          = 0;
         hardware->powerOffTimeout       = gcdPOWEROFF_TIMEOUT;
 
         gcmkVERIFY_OK(gckOS_CreateTimer(Os,
@@ -890,7 +890,7 @@ gceSTATUS
 gckVGHARDWARE_Execute(
     IN gckVGHARDWARE Hardware,
     IN gctUINT32 Address,
-    IN gctSIZE_T Count
+    IN gctUINT32 Count
     )
 {
     gceSTATUS status;
@@ -1043,6 +1043,9 @@ gckVGHARDWARE_AlignToTile(
 **      gctPOINTER Logical
 **          Logical address to convert.
 **
+**      gctBOOL InUserSpace
+**          gcvTRUE if the memory in user space.
+**
 **      gctUINT32* Address
 **          Return hardware specific address.
 **
@@ -1054,14 +1057,15 @@ gceSTATUS
 gckVGHARDWARE_ConvertLogical(
     IN gckVGHARDWARE Hardware,
     IN gctPOINTER Logical,
+    IN gctBOOL InUserSpace,
     OUT gctUINT32 * Address
     )
 {
     gctUINT32 address;
     gceSTATUS status;
 
-    gcmkHEADER_ARG("Hardware=0x%x Logical=0x%x Address=0x%x",
-                   Hardware, Logical, Address);
+    gcmkHEADER_ARG("Hardware=0x%x Logical=0x%x InUserSpace=%d Address=0x%x",
+                   Hardware, Logical, InUserSpace, Address);
 
     /* Verify the arguments. */
     gcmkVERIFY_OBJECT(Hardware, gcvOBJ_HARDWARE);
@@ -1071,9 +1075,18 @@ gckVGHARDWARE_ConvertLogical(
     do
     {
         /* Convert logical address into a physical address. */
-        gcmkERR_BREAK(gckOS_GetPhysicalAddress(
-            Hardware->os, Logical, &address
-            ));
+        if (InUserSpace)
+        {
+            gcmkERR_BREAK(gckOS_UserLogicalToPhysical(
+                Hardware->os, Logical, &address
+                ));
+        }
+        else
+        {
+            gcmkERR_BREAK(gckOS_GetPhysicalAddress(
+                Hardware->os, Logical, &address
+                ));
+        }
 
         /* Return hardware specific address. */
         *Address = ((((gctUINT32) (address)) & ~(((gctUINT32) (((gctUINT32) ((((1 ? 1:0) - (0 ? 1:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 1:0) - (0 ? 1:0) + 1))))))) << (0 ? 1:0))) | (((gctUINT32) (0x0 & ((gctUINT32) ((((1 ? 1:0) - (0 ? 1:0) + 1) == 32) ? ~0 : (~(~0 << ((1 ? 1:0) - (0 ? 1:0) + 1))))))) << (0 ? 1:0)));
@@ -1175,32 +1188,33 @@ gceSTATUS gckVGHARDWARE_SetMMU(
     do
     {
         /* Convert the logical address into an hardware address. */
-        gcmkERR_BREAK(gckVGHARDWARE_ConvertLogical(Hardware, Logical, &address) );
+        gcmkERR_BREAK(gckVGHARDWARE_ConvertLogical(Hardware, Logical,
+                                      gcvFALSE, &address));
 
         /* Write the AQMemoryFePageTable register. */
         gcmkERR_BREAK(gckOS_WriteRegisterEx(Hardware->os, gcvCORE_VG,
                                       0x00400,
-                                      gcmkFIXADDRESS(address)) );
+                                      gcmkFIXADDRESS(address)));
 
         /* Write the AQMemoryTxPageTable register. */
         gcmkERR_BREAK(gckOS_WriteRegisterEx(Hardware->os, gcvCORE_VG,
                                       0x00404,
-                                      gcmkFIXADDRESS(address)) );
+                                      gcmkFIXADDRESS(address)));
 
         /* Write the AQMemoryPePageTable register. */
         gcmkERR_BREAK(gckOS_WriteRegisterEx(Hardware->os, gcvCORE_VG,
                                       0x00408,
-                                      gcmkFIXADDRESS(address)) );
+                                      gcmkFIXADDRESS(address)));
 
         /* Write the AQMemoryPezPageTable register. */
         gcmkERR_BREAK(gckOS_WriteRegisterEx(Hardware->os, gcvCORE_VG,
                                       0x0040C,
-                                      gcmkFIXADDRESS(address)) );
+                                      gcmkFIXADDRESS(address)));
 
         /* Write the AQMemoryRaPageTable register. */
         gcmkERR_BREAK(gckOS_WriteRegisterEx(Hardware->os, gcvCORE_VG,
                                       0x00410,
-                                      gcmkFIXADDRESS(address)) );
+                                      gcmkFIXADDRESS(address)));
     }
     while (gcvFALSE);
 
@@ -2017,6 +2031,7 @@ gckVGHARDWARE_SetPowerManagement(
     return gcvSTATUS_OK;
 }
 
+#if gcdPOWEROFF_TIMEOUT
 gceSTATUS
 gckVGHARDWARE_SetPowerOffTimeout(
     IN gckVGHARDWARE  Hardware,
@@ -2045,6 +2060,7 @@ gckVGHARDWARE_QueryPowerOffTimeout(
     gcmkFOOTER_ARG("*Timeout=%d", *Timeout);
     return gcvSTATUS_OK;
 }
+#endif
 
 gceSTATUS
 gckVGHARDWARE_QueryIdle(
diff --git a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel.c b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel.c
index 274fee19ea6a..092ba444b3db 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel.c
@@ -101,7 +101,6 @@ gctCONST_STRING _DispatchText[] =
 };
 #endif
 
-#if gcdENABLE_RECOVERY
 void
 _ResetFinishFunction(
     gctPOINTER Data
@@ -111,7 +110,6 @@ _ResetFinishFunction(
 
     gckOS_AtomSet(kernel->os, kernel->resetAtom, 0);
 }
-#endif
 
 #if gcdPROCESS_ADDRESS_SPACE
 gceSTATUS
@@ -330,11 +328,12 @@ gckKERNEL_Construct(
         /* Initialize virtual command buffer. */
         /* TODO: Remove platform limitation after porting. */
 #if (defined(LINUX) || defined(__QNXNTO__))
-        kernel->virtualCommandBuffer = kernel->hardware->mmuVersion;
+        kernel->virtualCommandBuffer = gcvTRUE;
 #else
         kernel->virtualCommandBuffer = gcvFALSE;
 #endif
 
+
         /* Construct the gckCOMMAND object. */
         gcmkONERROR(
             gckCOMMAND_Construct(kernel, &kernel->command));
@@ -347,7 +346,6 @@ gckKERNEL_Construct(
         gcmkONERROR(
             gckMMU_Construct(kernel, gcdMMU_SIZE, &kernel->mmu));
 
-#if gcdENABLE_RECOVERY
         gcmkONERROR(
             gckOS_AtomConstruct(Os, &kernel->resetAtom));
 
@@ -357,8 +355,7 @@ gckKERNEL_Construct(
                               (gctPOINTER)kernel,
                               &kernel->resetFlagClearTimer));
 
-        kernel->resetTimeStamp = 0;
-#endif
+        gcmkVERIFY_OK(gckOS_GetTime(&kernel->resetTimeStamp));
 
 #if gcdDVFS
         if (gckHARDWARE_IsFeatureAvailable(kernel->hardware,
@@ -389,6 +386,7 @@ gckKERNEL_Construct(
     gcmkONERROR(
         gckOS_CreateMutex(Os, (gctPOINTER)&kernel->virtualBufferLock));
 
+
     /* Return pointer to the gckKERNEL object. */
     *Kernel = kernel;
 
@@ -429,7 +427,6 @@ OnError:
             gcmkVERIFY_OK(gckOS_AtomDestroy(Os, kernel->atomClients));
         }
 
-#if gcdENABLE_RECOVERY
         if (kernel->resetAtom != gcvNULL)
         {
             gcmkVERIFY_OK(gckOS_AtomDestroy(Os, kernel->resetAtom));
@@ -440,7 +437,6 @@ OnError:
             gcmkVERIFY_OK(gckOS_StopTimer(Os, kernel->resetFlagClearTimer));
             gcmkVERIFY_OK(gckOS_DestroyTimer(Os, kernel->resetFlagClearTimer));
         }
-#endif
 
         if (kernel->dbCreated && kernel->db != gcvNULL)
         {
@@ -590,7 +586,6 @@ gckKERNEL_Destroy(
         /* Destroy the gckHARDWARE object. */
         gcmkVERIFY_OK(gckHARDWARE_Destroy(Kernel->hardware));
 
-#if gcdENABLE_RECOVERY
         gcmkVERIFY_OK(gckOS_AtomDestroy(Kernel->os, Kernel->resetAtom));
 
         if (Kernel->resetFlagClearTimer)
@@ -598,7 +593,6 @@ gckKERNEL_Destroy(
             gcmkVERIFY_OK(gckOS_StopTimer(Kernel->os, Kernel->resetFlagClearTimer));
             gcmkVERIFY_OK(gckOS_DestroyTimer(Kernel->os, Kernel->resetFlagClearTimer));
         }
-#endif
     }
 
     /* Detsroy the client atom. */
@@ -618,6 +612,7 @@ gckKERNEL_Destroy(
     gcmkVERIFY_OK(gckOS_DestroySyncTimeline(Kernel->os, Kernel->timeline));
 #endif
 
+
     /* Mark the gckKERNEL object as unknown. */
     Kernel->object.type = gcvOBJ_UNKNOWN;
 
@@ -749,7 +744,7 @@ gckKERNEL_AllocateLinearMemory(
     IN gctUINT32 ProcessID,
     IN OUT gcePOOL * Pool,
     IN gctSIZE_T Bytes,
-    IN gctSIZE_T Alignment,
+    IN gctUINT32 Alignment,
     IN gceSURF_TYPE Type,
     OUT gctUINT32 * Node
     )
@@ -905,6 +900,7 @@ _AllocateMemory_Retry:
                                                   Bytes,
                                                   Alignment,
                                                   Type,
+                                                  (*Pool == gcvPOOL_SYSTEM),
                                                   &node);
 
                 if (gcmIS_SUCCESS(status))
@@ -1127,11 +1123,11 @@ gckKERNEL_LockVideoMemory(
 {
     gceSTATUS status;
     gckVIDMEM_NODE nodeObject = gcvNULL;
-    gcuVIDMEM_NODE_PTR node = gcvNULL;
-    gctBOOL locked = gcvFALSE;
-    gctBOOL asynchronous;
+    gcuVIDMEM_NODE_PTR node   = gcvNULL;
+    gctBOOL locked            = gcvFALSE;
+    gctBOOL asynchronous      = gcvFALSE;
 #ifndef __QNXNTO__
-    gctPOINTER pointer;
+    gctPOINTER pointer        = gcvNULL;
 #endif
 
     gcmkHEADER_ARG("Kernel=0x%08X ProcessID=%d",
@@ -1633,6 +1629,7 @@ gckKERNEL_Dispatch(
         gcmkONERROR(gckHARDWARE_ConvertLogical(
             Kernel->hardware,
             logical,
+            gcvTRUE,
             &Interface->u.AllocateContiguousMemory.address));
 
         gcmkVERIFY_OK(gckKERNEL_AddProcessDB(
@@ -2207,7 +2204,12 @@ gckKERNEL_Dispatch(
 #if VIVANTE_PROFILER
         /* Set profile setting */
         if(Kernel->hardware->gpuProfiler)
+        {
             Kernel->profileEnable = Interface->u.SetProfileSetting.enable;
+#if VIVANTE_PROFILER_NEW
+            gckHARDWARE_InitProfiler(Kernel->hardware);
+#endif
+        }
         else
         {
             status = gcvSTATUS_NOT_SUPPORTED;
@@ -2519,11 +2521,7 @@ gckKERNEL_Dispatch(
         break;
 
     case gcvHAL_QUERY_RESET_TIME_STAMP:
-#if gcdENABLE_RECOVERY
         Interface->u.QueryResetTimeStamp.timeStamp = Kernel->resetTimeStamp;
-#else
-        Interface->u.QueryResetTimeStamp.timeStamp = 0;
-#endif
         break;
 
     case gcvHAL_FREE_VIRTUAL_COMMAND_BUFFER:
@@ -2535,7 +2533,7 @@ gckKERNEL_Dispatch(
             gcvDB_COMMAND_BUFFER,
             gcmUINT64_TO_PTR(Interface->u.FreeVirtualCommandBuffer.logical)));
 
-        gcmkONERROR(gckOS_UnlockPages(
+        gcmkONERROR(gckOS_DestroyUserVirtualMapping(
             Kernel->os,
             buffer->physical,
             (gctSIZE_T)Interface->u.FreeVirtualCommandBuffer.bytes,
@@ -2988,7 +2986,7 @@ gckKERNEL_MapLogicalToPhysical(
 #elif gcdSECURE_CACHE_METHOD == gcdSECURE_CACHE_HASH
     {
         gctINT i;
-        gctUINT32 data = gcmPTR2INT(*Data);
+        gctUINT32 data = gcmPTR2INT32(*Data);
         gctUINT32 key, index;
         gcskLOGICAL_CACHE_PTR hash;
 
@@ -3065,7 +3063,7 @@ gckKERNEL_MapLogicalToPhysical(
     }
 #elif gcdSECURE_CACHE_METHOD == gcdSECURE_CACHE_TABLE
     {
-        gctUINT32 index = (gcmPTR2INT(*Data) % gcdSECURE_CACHE_SLOTS) + 1;
+        gctUINT32 index = (gcmPTR2INT32(*Data) % gcdSECURE_CACHE_SLOTS) + 1;
 
         /* Get cache slot. */
         slot = &Cache->cache[index];
@@ -3277,7 +3275,7 @@ gckKERNEL_FlushTranslationCache(
         for (i = 1; (low < high) && (i <= gcdSECURE_CACHE_SLOTS); ++i)
         {
             /* Get index into cache for this range. */
-            index = (gcmPTR2INT(low) % gcdSECURE_CACHE_SLOTS) + 1;
+            index = (gcmPTR2INT32(low) % gcdSECURE_CACHE_SLOTS) + 1;
             slot  = &Cache->cache[index];
 
             /* Test if this slot falls within the range to flush. */
@@ -3320,7 +3318,6 @@ gckKERNEL_Recovery(
     IN gckKERNEL Kernel
     )
 {
-#if gcdENABLE_RECOVERY
 #define gcdEVENT_MASK 0x3FFFFFFF
     gceSTATUS status;
     gckEVENT eventObj;
@@ -3478,7 +3475,7 @@ gckKERNEL_Recovery(
 #endif
     gcmkONERROR(gckEVENT_Notify(eventObj, 2));
 
-    Kernel->resetTimeStamp = 0;
+    gcmkVERIFY_OK(gckOS_GetTime(&Kernel->resetTimeStamp));
 
     /* Success. */
     gcmkFOOTER_NO();
@@ -3488,9 +3485,6 @@ OnError:
     /* Return the status. */
     gcmkFOOTER();
     return status;
-#else
-    return gcvSTATUS_OK;
-#endif
 }
 
 /*******************************************************************************
@@ -3687,12 +3681,12 @@ gckKERNEL_AllocateVirtualCommandBuffer(
     OUT gctPOINTER * Logical
     )
 {
-    gckOS os = Kernel->os;
+    gckOS os                             = Kernel->os;
     gceSTATUS status;
-    gctPOINTER logical;
+    gctPOINTER logical                   = gcvNULL;
     gctSIZE_T pageCount;
-    gctSIZE_T bytes = *Bytes;
-    gckVIRTUAL_COMMAND_BUFFER_PTR buffer;
+    gctSIZE_T bytes                      = *Bytes;
+    gckVIRTUAL_COMMAND_BUFFER_PTR buffer = gcvNULL;
 #if gcdPROCESS_ADDRESS_SPACE
     gckMMU mmu;
 #endif
@@ -3722,23 +3716,23 @@ gckKERNEL_AllocateVirtualCommandBuffer(
 
     if (InUserSpace)
     {
-        gcmkONERROR(gckOS_LockPages(os,
-                                    buffer->physical,
-                                    bytes,
-                                    gcvFALSE,
-                                    &logical,
-                                    &pageCount));
+        gcmkONERROR(gckOS_CreateUserVirtualMapping(os,
+                                                   buffer->physical,
+                                                   bytes,
+                                                   &logical,
+                                                   &pageCount));
 
         *Logical =
         buffer->userLogical = logical;
     }
     else
     {
-        gcmkONERROR(
-            gckOS_CreateKernelVirtualMapping(buffer->physical,
-                                             bytes,
-                                             &pageCount,
-                                             &logical));
+        gcmkONERROR(gckOS_CreateKernelVirtualMapping(os,
+                                                     buffer->physical,
+                                                     bytes,
+                                                     &logical,
+                                                     &pageCount));
+
         *Logical =
         buffer->kernelLogical = logical;
     }
@@ -3770,26 +3764,17 @@ gckKERNEL_AllocateVirtualCommandBuffer(
                                      &buffer->pageTable,
                                      &buffer->gpuAddress));
 
-#ifdef __QNXNTO__
-    gcmkONERROR(gckOS_MapPagesEx(os,
-                                 Kernel->core,
-                                 buffer->physical,
-                                 logical,
-                                 pageCount,
-                                 buffer->pageTable));
-#else
     gcmkONERROR(gckOS_MapPagesEx(os,
                                  Kernel->core,
                                  buffer->physical,
                                  pageCount,
                                  buffer->pageTable));
 #endif
-#endif
 
 #if gcdPROCESS_ADDRESS_SPACE
     gcmkONERROR(gckMMU_Flush(mmu));
 #else
-    gcmkONERROR(gckMMU_Flush(Kernel->mmu));
+    gcmkONERROR(gckMMU_Flush(Kernel->mmu, gcvSURF_INDEX));
 #endif
 
     *Physical = buffer;
@@ -3833,13 +3818,19 @@ OnError:
     if (buffer->userLogical)
     {
         gcmkVERIFY_OK(
-            gckOS_UnlockPages(os, buffer->physical, bytes, buffer->userLogical));
+            gckOS_DestroyUserVirtualMapping(os,
+                                            buffer->physical,
+                                            bytes,
+                                            buffer->userLogical));
     }
 
     if (buffer->kernelLogical)
     {
         gcmkVERIFY_OK(
-            gckOS_DestroyKernelVirtualMapping(buffer->physical, buffer->kernelLogical, bytes));
+            gckOS_DestroyKernelVirtualMapping(os,
+                                              buffer->physical,
+                                              bytes,
+                                              buffer->kernelLogical));
     }
 
     if (buffer->physical)
@@ -3874,7 +3865,10 @@ gckKERNEL_DestroyVirtualCommandBuffer(
 
     if (!buffer->userLogical)
     {
-        gcmkVERIFY_OK(gckOS_DestroyKernelVirtualMapping(buffer->physical, Logical, Bytes));
+        gcmkVERIFY_OK(gckOS_DestroyKernelVirtualMapping(os,
+                                                        buffer->physical,
+                                                        Bytes,
+                                                        Logical));
     }
 
 #if !gcdPROCESS_ADDRESS_SPACE
@@ -3919,6 +3913,7 @@ gceSTATUS
 gckKERNEL_GetGPUAddress(
     IN gckKERNEL Kernel,
     IN gctPOINTER Logical,
+    IN gctBOOL InUserSpace,
     OUT gctUINT32 * Address
     )
 {
@@ -3927,9 +3922,9 @@ gckKERNEL_GetGPUAddress(
     gctPOINTER start;
     gctUINT32 pid;
 
-    gcmkHEADER_ARG("Logical = %x", Logical);
+    gcmkHEADER_ARG("Logical = %x InUserSpace=%d.", Logical, InUserSpace);
 
-    gckOS_GetProcessID(&pid);
+    gcmkVERIFY_OK(gckOS_GetProcessID(&pid));
 
     status = gcvSTATUS_INVALID_ADDRESS;
 
@@ -3938,7 +3933,7 @@ gckKERNEL_GetGPUAddress(
     /* Walk all command buffer. */
     for (buffer = Kernel->virtualBufferHead; buffer != gcvNULL; buffer = buffer->next)
     {
-        if (buffer->userLogical)
+        if (InUserSpace)
         {
             start = buffer->userLogical;
         }
@@ -3947,12 +3942,17 @@ gckKERNEL_GetGPUAddress(
             start = buffer->kernelLogical;
         }
 
+        if (start == gcvNULL)
+        {
+            continue;
+        }
+
         if (Logical >= start
         && (Logical < (gctPOINTER)((gctUINT8_PTR)start + buffer->pageCount * 4096))
         && pid == buffer->pid
         )
         {
-            * Address = buffer->gpuAddress + ((gctUINT8_PTR)Logical - (gctUINT8_PTR)start);
+            * Address = buffer->gpuAddress + (gctUINT32)((gctUINT8_PTR)Logical - (gctUINT8_PTR)start);
             status = gcvSTATUS_OK;
             break;
         }
@@ -4046,41 +4046,57 @@ gckLINKQUEUE_GetData(
 }
 #endif
 
-#if gcdPROCESS_ADDRESS_SPACE
-void
-gckENTRYQUEUE_Dequeue(
-    IN gckENTRYQUEUE Queue
-    )
-{
-    Queue->count--;
-    Queue->front = (Queue->front + 1) % gcdENTRY_QUEUE_SIZE;
-}
-
-void
+/*
+* gckENTRYQUEUE_Enqueue is called with Command->mutexQueue acquired.
+*/
+gceSTATUS
 gckENTRYQUEUE_Enqueue(
+    IN gckKERNEL Kernel,
     IN gckENTRYQUEUE Queue,
     IN gctUINT32 physical,
     IN gctUINT32 bytes
     )
 {
-    Queue->count++;
+    gctUINT32 next = (Queue->rear + 1) % gcdENTRY_QUEUE_SIZE;
+
+    if (next == Queue->front)
+    {
+        /* Queue is full. */
+        return gcvSTATUS_INVALID_REQUEST;
+    }
 
+    /* Copy data. */
     Queue->data[Queue->rear].physical = physical;
     Queue->data[Queue->rear].bytes = bytes;
 
-    Queue->rear = (Queue->rear + 1) % gcdENTRY_QUEUE_SIZE;
+    gcmkVERIFY_OK(gckOS_MemoryBarrier(Kernel->os, &Queue->rear));
+
+    /* Update rear. */
+    Queue->rear = next;
+
+    return gcvSTATUS_OK;
 }
 
-void
-gckENTRYQUEUE_GetData(
+gceSTATUS
+gckENTRYQUEUE_Dequeue(
     IN gckENTRYQUEUE Queue,
-    IN gctUINT32 Index,
     OUT gckENTRYDATA * Data
     )
 {
-    *Data = &Queue->data[(Index + Queue->front) % gcdENTRY_QUEUE_SIZE];
+    if (Queue->front == Queue->rear)
+    {
+        /* Queue is empty. */
+        return gcvSTATUS_INVALID_REQUEST;
+    }
+
+    /* Copy data. */
+    *Data = &Queue->data[Queue->front];
+
+    /* Update front. */
+    Queue->front = (Queue->front + 1) % gcdENTRY_QUEUE_SIZE;
+
+    return gcvSTATUS_OK;
 }
-#endif
 
 /******************************************************************************\
 *************************** Pointer - ID translation ***************************
diff --git a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel.h b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel.h
index bd9a3fd9a047..e2e93dfcc991 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel.h
@@ -31,6 +31,7 @@
 #include "gc_hal_kernel_vg.h"
 #endif
 
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -92,6 +93,9 @@ extern "C" {
 #define gcdSECURE_CACHE_HASH        3
 #define gcdSECURE_CACHE_TABLE       4
 
+#define gcvPAGE_TABLE_DIRTY_BIT_OTHER   (1 << 0)
+#define gcvPAGE_TABLE_DIRTY_BIT_FE      (1 << 1)
+
 typedef struct _gcskLOGICAL_CACHE * gcskLOGICAL_CACHE_PTR;
 typedef struct _gcskLOGICAL_CACHE   gcskLOGICAL_CACHE;
 struct _gcskLOGICAL_CACHE
@@ -509,11 +513,9 @@ struct _gckKERNEL
     gckDB                       db;
     gctBOOL                     dbCreated;
 
-#if gcdENABLE_RECOVERY
     gctPOINTER                  resetFlagClearTimer;
     gctPOINTER                  resetAtom;
     gctUINT64                   resetTimeStamp;
-#endif
 
     /* Pointer to gckEVENT object. */
     gcsTIMER                    timers[8];
@@ -544,6 +546,7 @@ struct _gckKERNEL
 
     /* Level of dump information after stuck. */
     gctUINT                     stuckDump;
+
 };
 
 struct _FrequencyHistory
@@ -577,7 +580,7 @@ struct _gckCOMMAND
     gckOS                       os;
 
     /* Number of bytes per page. */
-    gctSIZE_T                   pageSize;
+    gctUINT32                   pageSize;
 
     /* Current pipe select. */
     gcePIPE_SELECT              pipeSelect;
@@ -609,11 +612,13 @@ struct _gckCOMMAND
         gctSIGNAL               signal;
         gctPHYS_ADDR            physical;
         gctPOINTER              logical;
+        gctUINT32               address;
     }
     queues[gcdCOMMAND_QUEUES];
 
     gctPHYS_ADDR                physical;
     gctPOINTER                  logical;
+    gctUINT32                   address;
     gctUINT32                   offset;
     gctINT                      index;
 #if gcmIS_DEBUG(gcdDEBUG_TRACE)
@@ -629,12 +634,12 @@ struct _gckCOMMAND
     /* Pointer to last WAIT command. */
     gctPHYS_ADDR                waitPhysical;
     gctPOINTER                  waitLogical;
-    gctSIZE_T                   waitSize;
+    gctUINT32                   waitSize;
 
     /* Command buffer alignment. */
-    gctSIZE_T                   alignment;
-    gctSIZE_T                   reservedHead;
-    gctSIZE_T                   reservedTail;
+    gctUINT32                   alignment;
+    gctUINT32                   reservedHead;
+    gctUINT32                   reservedTail;
 
     /* Commit counter. */
     gctPOINTER                  atomCommit;
@@ -654,8 +659,8 @@ struct _gckCOMMAND
 
 #if gcdPROCESS_ADDRESS_SPACE
     gckMMU                      currentMmu;
-    struct _gckENTRYQUEUE       queue;
 #endif
+    struct _gckENTRYQUEUE       queue;
 };
 
 typedef struct _gcsEVENT *      gcsEVENT_PTR;
@@ -691,6 +696,11 @@ typedef struct _gcsEVENT_QUEUE
     /* Source of the event. */
     gceKERNEL_WHERE             source;
 
+#if gcdMULTI_GPU
+    /* Which chip(s) of the event */
+    gceCORE_3D_MASK             chipEnable;
+#endif
+
     /* Pointer to head of event queue. */
     gcsEVENT_PTR                head;
 
@@ -734,11 +744,7 @@ struct _gckEVENT
     gctPOINTER                  eventQueueMutex;
 
     /* Array of event queues. */
-#if gcdPROCESS_ADDRESS_SPACE
     gcsEVENT_QUEUE              queues[29];
-#else
-    gcsEVENT_QUEUE              queues[30];
-#endif
     gctUINT8                    lastID;
     gctPOINTER                  freeAtom;
 
@@ -746,12 +752,14 @@ struct _gckEVENT
 #if gcdSMP
 #if gcdMULTI_GPU
     gctPOINTER                  pending3D[gcdMULTI_GPU];
+    gctPOINTER                  pending3DMask[gcdMULTI_GPU];
     gctPOINTER                  pendingMask;
 #endif
     gctPOINTER                  pending;
 #else
 #if gcdMULTI_GPU
     volatile gctUINT            pending3D[gcdMULTI_GPU];
+    volatile gctUINT            pending3DMask[gcdMULTI_GPU];
     volatile gctUINT            pendingMask;
 #endif
     volatile gctUINT            pending;
@@ -793,7 +801,7 @@ gckEVENT_Stop(
     IN gctPHYS_ADDR Handle,
     IN gctPOINTER Logical,
     IN gctSIGNAL Signal,
-    IN OUT gctSIZE_T * waitSize
+    IN OUT gctUINT32 * waitSize
     );
 
 typedef struct _gcsLOCK_INFO * gcsLOCK_INFO_PTR;
@@ -835,12 +843,12 @@ typedef union _gcuVIDMEM_NODE
         gcuVIDMEM_NODE_PTR      prevFree;
 
         /* Information for this node. */
-        gctUINT32               offset;
+        gctSIZE_T               offset;
         gctSIZE_T               bytes;
         gctUINT32               alignment;
 
 #ifdef __QNXNTO__
-        /* Client/server vaddr (mapped using mmap_join). */
+        /* Client virtual address. */
         gctPOINTER              logical;
 #endif
 
@@ -1105,17 +1113,36 @@ struct _gckMMU
 
 gceSTATUS
 gckOS_CreateKernelVirtualMapping(
+    IN gckOS Os,
     IN gctPHYS_ADDR Physical,
     IN gctSIZE_T Bytes,
-    OUT gctSIZE_T * PageCount,
-    OUT gctPOINTER * Logical
+    OUT gctPOINTER * Logical,
+    OUT gctSIZE_T * PageCount
     );
 
 gceSTATUS
 gckOS_DestroyKernelVirtualMapping(
-    IN gctPHYS_ADDR physical,
-    IN gctPOINTER Logical,
-    IN gctSIZE_T Bytes
+    IN gckOS Os,
+    IN gctPHYS_ADDR Physical,
+    IN gctSIZE_T Bytes,
+    IN gctPOINTER Logical
+    );
+
+gceSTATUS
+gckOS_CreateUserVirtualMapping(
+    IN gckOS Os,
+    IN gctPHYS_ADDR Physical,
+    IN gctSIZE_T Bytes,
+    OUT gctPOINTER * Logical,
+    OUT gctSIZE_T * PageCount
+    );
+
+gceSTATUS
+gckOS_DestroyUserVirtualMapping(
+    IN gckOS Os,
+    IN gctPHYS_ADDR Physical,
+    IN gctSIZE_T Bytes,
+    IN gctPOINTER Logical
     );
 
 gceSTATUS
@@ -1139,6 +1166,7 @@ gceSTATUS
 gckKERNEL_GetGPUAddress(
     IN gckKERNEL Kernel,
     IN gctPOINTER Logical,
+    IN gctBOOL InUserSpace,
     OUT gctUINT32 * Address
     );
 
@@ -1185,6 +1213,7 @@ gckHARDWARE_QueryIdle(
     OUT gctBOOL_PTR IsIdle
     );
 
+
 /******************************************************************************\
 ******************************* gckCONTEXT Object *******************************
 \******************************************************************************/
@@ -1233,27 +1262,20 @@ gckLINKQUEUE_GetData(
     );
 #endif
 
-#if gcdPROCESS_ADDRESS_SPACE
-void
+gceSTATUS
 gckENTRYQUEUE_Enqueue(
+    IN gckKERNEL Kernel,
     IN gckENTRYQUEUE Queue,
     IN gctUINT32 physical,
     IN gctUINT32 bytes
     );
 
-void
-gckENTRYQUEUE_GetData(
+gceSTATUS
+gckENTRYQUEUE_Dequeue(
     IN gckENTRYQUEUE Queue,
-    IN gctUINT32 Index,
     OUT gckENTRYDATA * Data
     );
 
-void
-gckENTRYQUEUE_Dequeue(
-    IN gckENTRYQUEUE Queue
-    );
-#endif
-
 #ifdef __cplusplus
 }
 #endif
diff --git a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_command.c b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_command.c
index 20a5257c6e34..cf43706cb2ec 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_command.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_command.c
@@ -23,10 +23,6 @@
 #include "gc_hal_kernel_precomp.h"
 #include "gc_hal_kernel_context.h"
 
-#ifdef __QNXNTO__
-#include <sys/slog.h>
-#endif
-
 #define _GC_OBJ_ZONE            gcvZONE_COMMAND
 
 /******************************************************************************\
@@ -106,14 +102,14 @@ _NewQueue(
     Command->index    = newIndex;
     Command->newQueue = gcvTRUE;
     Command->logical  = Command->queues[newIndex].logical;
+    Command->address  = Command->queues[newIndex].address;
     Command->offset   = 0;
 
-    gcmkONERROR(
-        gckOS_GetPhysicalAddress(
-            Command->os,
-            Command->logical,
-            (gctUINT32 *) &Command->physical
-            ));
+    gcmkONERROR(gckOS_GetPhysicalAddress(
+        Command->os,
+        Command->logical,
+        (gctUINT32 *) &Command->physical
+        ));
 
     if (currentIndex != -1)
     {
@@ -322,7 +318,6 @@ OnError:
 }
 #endif
 
-#if !gcdPROCESS_ADDRESS_SPACE
 static gceSTATUS
 _FlushMMU(
     IN gckCOMMAND Command
@@ -331,6 +326,14 @@ _FlushMMU(
     gceSTATUS status;
     gctUINT32 oldValue;
     gckHARDWARE hardware = Command->kernel->hardware;
+    gctBOOL pause = gcvFALSE;
+
+    gctUINT8_PTR pointer;
+    gctUINT32 eventBytes;
+    gctUINT32 endBytes;
+    gctUINT32 bufferSize;
+    gctUINT32 executeBytes;
+    gctUINT32 waitLinkBytes;
 
     gcmkONERROR(gckOS_AtomicExchange(Command->os,
                                      hardware->pageTableDirty,
@@ -341,13 +344,68 @@ _FlushMMU(
     {
         /* Page Table is upated, flush mmu before commit. */
         gcmkONERROR(gckHARDWARE_FlushMMU(hardware));
+
+        if ((oldValue & gcvPAGE_TABLE_DIRTY_BIT_FE)
+          && (hardware->endAfterFlushMmuCache)
+        )
+        {
+            pause = gcvTRUE;
+        }
+    }
+
+    if (pause)
+    {
+        /* Query size. */
+        gcmkONERROR(gckHARDWARE_Event(hardware, gcvNULL, 0, 0, &eventBytes));
+        gcmkONERROR(gckHARDWARE_End(hardware, gcvNULL, &endBytes));
+
+        executeBytes = eventBytes + endBytes;
+
+        gcmkONERROR(gckHARDWARE_WaitLink(
+            hardware,
+            gcvNULL,
+            Command->offset + executeBytes,
+            &waitLinkBytes,
+            gcvNULL,
+            gcvNULL
+            ));
+
+        /* Reserve space. */
+        gcmkONERROR(gckCOMMAND_Reserve(
+            Command,
+            executeBytes,
+            (gctPOINTER *)&pointer,
+            &bufferSize
+            ));
+
+        /* Append EVENT(29). */
+        gcmkONERROR(gckHARDWARE_Event(
+            hardware,
+            pointer,
+            29,
+            gcvKERNEL_PIXEL,
+            &eventBytes
+            ));
+
+        /* Append END. */
+        pointer += eventBytes;
+        gcmkONERROR(gckHARDWARE_End(hardware, pointer, &endBytes));
+
+        /* Store address to queue. */
+        gcmkONERROR(gckENTRYQUEUE_Enqueue(
+            Command->kernel,
+            &Command->queue,
+            Command->address + Command->offset + executeBytes,
+            waitLinkBytes
+            ));
+
+        gcmkONERROR(gckCOMMAND_Execute(Command, executeBytes));
     }
 
     return gcvSTATUS_OK;
 OnError:
     return status;
 }
-#endif
 
 static void
 _DumpBuffer(
@@ -356,13 +414,12 @@ _DumpBuffer(
     IN gctSIZE_T Size
     )
 {
-    gctINT i, line, left;
+    gctSIZE_T i, line, left;
     gctUINT32_PTR data = Buffer;
 
     line = Size / 32;
     left = Size % 32;
 
-
     for (i = 0; i < line; i++)
     {
         gcmkPRINT("%X : %08X %08X %08X %08X %08X %08X %08X %08X ",
@@ -409,11 +466,11 @@ _DumpBuffer(
 static void
 _DumpKernelCommandBuffer(
     IN gckCOMMAND Command
-)
+    )
 {
     gctINT i;
-    gctUINT32 physical;
-    gctPOINTER entry;
+    gctUINT32 physical = 0;
+    gctPOINTER entry   = gcvNULL;
 
     for (i = 0; i < gcdCOMMAND_QUEUES; i++)
     {
@@ -459,6 +516,7 @@ gckCOMMAND_Construct(
     gceSTATUS status;
     gctINT i;
     gctPOINTER pointer = gcvNULL;
+    gctSIZE_T pageSize;
 
     gcmkHEADER_ARG("Kernel=0x%x", Kernel);
 
@@ -507,7 +565,9 @@ gckCOMMAND_Construct(
     gcmkONERROR(gckOS_AtomConstruct(os, &command->atomCommit));
 
     /* Get the page size from teh OS. */
-    gcmkONERROR(gckOS_GetPageSize(os, &command->pageSize));
+    gcmkONERROR(gckOS_GetPageSize(os, &pageSize));
+
+    gcmkSAFECASTSIZET(command->pageSize, pageSize);
 
     /* Get process ID. */
     gcmkONERROR(gckOS_GetProcessID(&command->kernelProcessID));
@@ -521,11 +581,18 @@ gckCOMMAND_Construct(
         gcmkONERROR(gckOS_AllocateNonPagedMemory(
             os,
             gcvFALSE,
-            &command->pageSize,
+            &pageSize,
             &command->queues[i].physical,
             &command->queues[i].logical
             ));
 
+        gcmkONERROR(gckHARDWARE_ConvertLogical(
+            Kernel->hardware,
+            command->queues[i].logical,
+            gcvFALSE,
+            &command->queues[i].address
+            ));
+
         gcmkONERROR(gckOS_CreateSignal(
             os, gcvFALSE, &command->queues[i].signal
             ));
@@ -552,11 +619,9 @@ gckCOMMAND_Construct(
     /* END event signal not created. */
     command->endEventSignal = gcvNULL;
 
-#if gcdPROCESS_ADDRESS_SPACE
     command->queue.front = 0;
     command->queue.rear = 0;
     command->queue.count = 0;
-#endif
 
     /* Return pointer to the gckCOMMAND object. */
     *Command = command;
@@ -875,7 +940,7 @@ gckCOMMAND_Start(
     gceSTATUS status;
     gckHARDWARE hardware;
     gctUINT32 waitOffset = 0;
-    gctSIZE_T waitLinkBytes;
+    gctUINT32 waitLinkBytes;
 
     gcmkHEADER_ARG("Command=0x%x", Command);
 
@@ -935,21 +1000,11 @@ gckCOMMAND_Start(
     Command->newQueue = gcvFALSE;
 
     /* Enable command processor. */
-#ifdef __QNXNTO__
     gcmkONERROR(gckHARDWARE_Execute(
         hardware,
-        Command->logical,
-        Command->physical,
-        gcvTRUE,
+        Command->address,
         waitLinkBytes
         ));
-#else
-    gcmkONERROR(gckHARDWARE_Execute(
-        hardware,
-        Command->logical,
-        waitLinkBytes
-        ));
-#endif
 
     /* Command queue is running. */
     Command->running = gcvTRUE;
@@ -1031,6 +1086,7 @@ gckCOMMAND_Stop(
             hardware, Command->waitLogical, &Command->waitSize
             ));
 
+
         /* Update queue tail pointer. */
         gcmkONERROR(gckHARDWARE_UpdateQueueTail(Command->kernel->hardware,
                                                 Command->logical,
@@ -1130,35 +1186,47 @@ gckCOMMAND_Commit(
     gcsCONTEXT_PTR contextBuffer;
     struct _gcoCMDBUF _commandBufferObject;
     gctPHYS_ADDR commandBufferPhysical;
-    gctUINT8_PTR commandBufferLogical;
-    gctUINT8_PTR commandBufferLink;
+    gctUINT8_PTR commandBufferLogical = gcvNULL;
+    gctUINT32 commandBufferAddress = 0;
+    gctUINT8_PTR commandBufferLink = gcvNULL;
     gctUINT commandBufferSize;
     gctSIZE_T nopBytes;
-    gctSIZE_T pipeBytes;
-    gctSIZE_T linkBytes;
+    gctUINT32 pipeBytes;
+    gctUINT32 linkBytes;
     gctSIZE_T bytes;
     gctUINT32 offset;
 #if gcdNONPAGED_MEMORY_CACHEABLE
     gctPHYS_ADDR entryPhysical;
 #endif
     gctPOINTER entryLogical;
-    gctSIZE_T entryBytes;
+    gctUINT32 entryAddress;
+    gctUINT32 entryBytes;
 #if gcdNONPAGED_MEMORY_CACHEABLE
     gctPHYS_ADDR exitPhysical;
 #endif
     gctPOINTER exitLogical;
-    gctSIZE_T exitBytes;
+    gctUINT32 exitAddress;
+    gctUINT32 exitBytes;
     gctPHYS_ADDR waitLinkPhysical;
     gctPOINTER waitLinkLogical;
-    gctSIZE_T waitLinkBytes;
+    gctUINT32 waitLinkAddress;
+    gctUINT32 waitLinkBytes;
     gctPHYS_ADDR waitPhysical;
     gctPOINTER waitLogical;
     gctUINT32 waitOffset;
-    gctSIZE_T waitSize;
+    gctUINT32 waitSize;
+
+#ifdef __QNXNTO__
+    gctPOINTER userCommandBufferLogical       = gcvNULL;
+    gctBOOL    userCommandBufferLogicalMapped = gcvFALSE;
+    gctPOINTER userCommandBufferLink          = gcvNULL;
+    gctBOOL    userCommandBufferLinkMapped    = gcvFALSE;
+#endif
 
 #if gcdPROCESS_ADDRESS_SPACE
     gctSIZE_T mmuConfigureBytes;
     gctPOINTER mmuConfigureLogical = gcvNULL;
+    gctUINT32 mmuConfigureAddress;
     gctPOINTER mmuConfigurePhysical = 0;
     gctSIZE_T mmuConfigureWaitLinkOffset;
     gckMMU mmu;
@@ -1192,7 +1260,7 @@ gckCOMMAND_Commit(
     /* Verify the arguments. */
     gcmkVERIFY_OBJECT(Command, gcvOBJ_COMMAND);
 
-    if (Command->kernel->core == gcvCORE_2D)
+    if (Command->kernel->hardware->type== gcvHARDWARE_2D)
     {
         /* There is no context for 2D. */
         Context = gcvNULL;
@@ -1206,7 +1274,6 @@ gckCOMMAND_Commit(
                                      0,
                                      &oldValue));
 #else
-    gcmkONERROR(_FlushMMU(Command));
 #endif
 
 #if VIVANTE_PROFILER_CONTEXT
@@ -1287,7 +1354,7 @@ gckCOMMAND_Commit(
 
     /* Query the size of LINK command. */
     gcmkONERROR(gckHARDWARE_Link(
-        hardware, gcvNULL, gcvNULL, 0, &linkBytes
+        hardware, gcvNULL, 0, 0, &linkBytes
         ));
 
 #if gcdMULTI_GPU
@@ -1302,17 +1369,54 @@ gckCOMMAND_Commit(
         = (gctUINT8_PTR) gcmUINT64_TO_PTR(commandBufferObject->logical)
         +                commandBufferObject->startOffset;
 
-    gcmkONERROR(gckOS_GetPhysicalAddress(
+    /* Get the hardware address. */
+    if (Command->kernel->virtualCommandBuffer)
+    {
+        gcmkONERROR(gckKERNEL_GetGPUAddress(
+            Command->kernel,
+            commandBufferLogical,
+            gcvTRUE,
+            &commandBufferAddress
+            ));
+    }
+    else
+    {
+        gcmkONERROR(gckHARDWARE_ConvertLogical(
+            hardware,
+            commandBufferLogical,
+            gcvTRUE,
+            &commandBufferAddress
+            ));
+    }
+
+    /* Get the physical address. */
+    gcmkONERROR(gckOS_UserLogicalToPhysical(
         Command->os,
         commandBufferLogical,
         (gctUINT32_PTR)&commandBufferPhysical
         ));
 
+#ifdef __QNXNTO__
+    userCommandBufferLogical = (gctPOINTER) commandBufferLogical;
+
+    gcmkONERROR(gckOS_MapUserPointer(
+        Command->os,
+        userCommandBufferLogical,
+        0,
+        &pointer));
+
+    commandBufferLogical = pointer;
+
+    userCommandBufferLogicalMapped = gcvTRUE;
+#endif
+
     commandBufferSize
         = commandBufferObject->offset
         + Command->reservedTail
         - commandBufferObject->startOffset;
 
+    gcmkONERROR(_FlushMMU(Command));
+
     /* Get the current offset. */
     offset = Command->offset;
 
@@ -1356,79 +1460,35 @@ gckCOMMAND_Commit(
     }
 #endif
 
-#if gcdPROCESS_ADDRESS_SPACE
-    if (Command->currentMmu != mmu || oldValue)
-    {
-        /* Query the size of PAGE TABLE SWITCH command sequence. */
-        gcmkONERROR(gckHARDWARE_ConfigMMU(
-            hardware,
-            gcvNULL,
-            gcvNULL,
-            offset,
-            &mmuConfigureBytes,
-            &mmuConfigureWaitLinkOffset,
-            &waitLinkBytes
-            ));
-
-        /* Is there enough space in the current command queue? */
-        if (bytes < mmuConfigureBytes)
-        {
-            /* No, create a new one. */
-            gcmkONERROR(_NewQueue(Command));
-
-            /* Get the new current offset. */
-            offset = Command->offset;
-
-            /* Recompute the number of bytes in the new kernel command queue. */
-            bytes = Command->pageSize - offset;
-            gcmkASSERT(bytes >= mmuConfigureBytes);
-        }
-
-        mmuConfigurePhysical = (gctUINT8_PTR) Command->physical + offset;
-        mmuConfigureLogical  = (gctUINT8_PTR) Command->logical  + offset;
-
-        /* Compute the location if WAIT/LINK command sequence. */
-        waitLinkPhysical = (gctUINT8_PTR) mmuConfigurePhysical + mmuConfigureWaitLinkOffset;
-        waitLinkLogical  = (gctUINT8_PTR) mmuConfigureLogical  + mmuConfigureWaitLinkOffset;
+    /* Query the size of WAIT/LINK command sequence. */
+    gcmkONERROR(gckHARDWARE_WaitLink(
+        hardware,
+        gcvNULL,
+        offset,
+        &waitLinkBytes,
+        gcvNULL,
+        gcvNULL
+        ));
 
-        reservedBytes = mmuConfigureBytes;
-    }
-    else
-#endif
+    /* Is there enough space in the current command queue? */
+    if (bytes < waitLinkBytes)
     {
-        /* Query the size of WAIT/LINK command sequence. */
-        gcmkONERROR(gckHARDWARE_WaitLink(
-            hardware,
-            gcvNULL,
-            offset,
-            &waitLinkBytes,
-            gcvNULL,
-            gcvNULL
-            ));
-
-        /* Is there enough space in the current command queue? */
-        if (bytes < waitLinkBytes)
-        {
-            /* No, create a new one. */
-            gcmkONERROR(_NewQueue(Command));
-
-            /* Get the new current offset. */
-            offset = Command->offset;
-
-            /* Recompute the number of bytes in the new kernel command queue. */
-            bytes = Command->pageSize - offset;
-            gcmkASSERT(bytes >= waitLinkBytes);
-        }
+        /* No, create a new one. */
+        gcmkONERROR(_NewQueue(Command));
 
-        /* Compute the location if WAIT/LINK command sequence. */
-        waitLinkPhysical = (gctUINT8_PTR) Command->physical + offset;
-        waitLinkLogical  = (gctUINT8_PTR) Command->logical  + offset;
+        /* Get the new current offset. */
+        offset = Command->offset;
 
-#if gcdPROCESS_ADDRESS_SPACE
-        reservedBytes = waitLinkBytes;
-#endif
+        /* Recompute the number of bytes in the new kernel command queue. */
+        bytes = Command->pageSize - offset;
+        gcmkASSERT(bytes >= waitLinkBytes);
     }
 
+    /* Compute the location if WAIT/LINK command sequence. */
+    waitLinkPhysical = (gctUINT8_PTR) Command->physical + offset;
+    waitLinkLogical  = (gctUINT8_PTR) Command->logical  + offset;
+    waitLinkAddress  =                Command->address  + offset;
+
     /* Context switch required? */
     if (Context == gcvNULL)
     {
@@ -1458,6 +1518,7 @@ gckCOMMAND_Commit(
         entryPhysical = (gctUINT8_PTR) commandBufferPhysical + offset;
 #endif
         entryLogical  =                commandBufferLogical  + offset;
+        entryAddress  =                commandBufferAddress  + offset;
         entryBytes    =                commandBufferSize     - offset;
     }
     else if (Command->currContext != Context)
@@ -1493,6 +1554,7 @@ gckCOMMAND_Commit(
                     entryPhysical = (gctUINT8_PTR) contextBuffer->physical + pipeBytes;
 #endif
                     entryLogical  = (gctUINT8_PTR) contextBuffer->logical  + pipeBytes;
+                    entryAddress  =                contextBuffer->address  + pipeBytes;
                     entryBytes    =                Context->bufferSize     - pipeBytes;
                 }
                 else
@@ -1501,6 +1563,7 @@ gckCOMMAND_Commit(
                     entryPhysical = (gctUINT8_PTR) contextBuffer->physical;
 #endif
                     entryLogical  = (gctUINT8_PTR) contextBuffer->logical;
+                    entryAddress  =                contextBuffer->address;
                     entryBytes    =                Context->bufferSize;
                 }
 
@@ -1539,7 +1602,7 @@ gckCOMMAND_Commit(
                 gcmkONERROR(gckHARDWARE_Link(
                     hardware,
                     contextBuffer->link3D,
-                    commandBufferLogical + offset,
+                    commandBufferAddress + offset,
                     commandBufferSize    - offset,
                     &linkBytes
                     ));
@@ -1563,6 +1626,7 @@ gckCOMMAND_Commit(
                     entryPhysical = (gctUINT8_PTR) contextBuffer->physical + pipeBytes;
 #endif
                     entryLogical  = (gctUINT8_PTR) contextBuffer->logical  + pipeBytes;
+                    entryAddress  =                contextBuffer->address  + pipeBytes;
                     entryBytes    =                Context->entryOffset3D  - pipeBytes;
                 }
                 else
@@ -1571,6 +1635,7 @@ gckCOMMAND_Commit(
                     entryPhysical = (gctUINT8_PTR) contextBuffer->physical;
 #endif
                     entryLogical  = (gctUINT8_PTR) contextBuffer->logical;
+                    entryAddress  =                contextBuffer->address;
                     entryBytes    =                Context->entryOffset3D;
                 }
 
@@ -1604,7 +1669,7 @@ gckCOMMAND_Commit(
                 gcmkONERROR(gckHARDWARE_Link(
                     hardware,
                     contextBuffer->link2D,
-                    commandBufferLogical + offset,
+                    commandBufferAddress + offset,
                     commandBufferSize    - offset,
                     &linkBytes
                     ));
@@ -1643,6 +1708,7 @@ gckCOMMAND_Commit(
                 entryPhysical = (gctUINT8_PTR) contextBuffer->physical + offset;
 #endif
                 entryLogical  = (gctUINT8_PTR) contextBuffer->logical  + offset;
+                entryAddress  =                contextBuffer->address  + offset;
                 entryBytes    =                Context->bufferSize     - offset;
 
                 /* See if we have to switch pipes between the context
@@ -1672,7 +1738,7 @@ gckCOMMAND_Commit(
                 gcmkONERROR(gckHARDWARE_Link(
                     hardware,
                     contextBuffer->link3D,
-                    commandBufferLogical + offset,
+                    commandBufferAddress + offset,
                     commandBufferSize    - offset,
                     &linkBytes
                     ));
@@ -1698,6 +1764,10 @@ gckCOMMAND_Commit(
                         = (gctUINT8_PTR) contextBuffer->logical
                         + Context->entryOffsetXDFrom3D;
 
+                    entryAddress
+                        = contextBuffer->address
+                        + Context->entryOffsetXDFrom3D;
+
                     entryBytes
                         = Context->bufferSize
                         - Context->entryOffsetXDFrom3D;
@@ -1713,6 +1783,10 @@ gckCOMMAND_Commit(
                         = (gctUINT8_PTR) contextBuffer->logical
                         + Context->entryOffsetXDFrom2D;
 
+                    entryAddress
+                        = contextBuffer->address
+                        + Context->entryOffsetXDFrom2D;
+
                     entryBytes
                         = Context->totalSize
                         - Context->entryOffsetXDFrom2D;
@@ -1745,7 +1819,7 @@ gckCOMMAND_Commit(
                 gcmkONERROR(gckHARDWARE_Link(
                     hardware,
                     contextBuffer->link3D,
-                    commandBufferLogical + offset,
+                    commandBufferAddress + offset,
                     commandBufferSize    - offset,
                     &linkBytes
                     ));
@@ -1771,6 +1845,7 @@ gckCOMMAND_Commit(
         contextDumpLogical = entryLogical;
         contextDumpBytes   = entryBytes;
 #endif
+
     }
 
     /* Same context. */
@@ -1797,6 +1872,7 @@ gckCOMMAND_Commit(
                     entryPhysical = (gctUINT8_PTR) contextBuffer->physical + pipeBytes;
 #endif
                     entryLogical  = (gctUINT8_PTR) contextBuffer->logical  + pipeBytes;
+                    entryAddress  =                contextBuffer->address  + pipeBytes;
                     entryBytes    =                Context->bufferSize     - pipeBytes;
                 }
                 else
@@ -1805,6 +1881,7 @@ gckCOMMAND_Commit(
                     entryPhysical = (gctUINT8_PTR) contextBuffer->physical;
 #endif
                     entryLogical  = (gctUINT8_PTR) contextBuffer->logical;
+                    entryAddress  =                contextBuffer->address;
                     entryBytes    =                Context->bufferSize;
                 }
 
@@ -1843,7 +1920,7 @@ gckCOMMAND_Commit(
                 gcmkONERROR(gckHARDWARE_Link(
                     hardware,
                     contextBuffer->link3D,
-                    commandBufferLogical + offset,
+                    commandBufferAddress + offset,
                     commandBufferSize    - offset,
                     &linkBytes
                     ));
@@ -1857,6 +1934,7 @@ gckCOMMAND_Commit(
                     entryPhysical = (gctUINT8_PTR) contextBuffer->physical + pipeBytes;
 #endif
                     entryLogical  = (gctUINT8_PTR) contextBuffer->logical  + pipeBytes;
+                    entryAddress  =                contextBuffer->address  + pipeBytes;
                     entryBytes    =                Context->entryOffset3D  - pipeBytes;
                 }
                 else
@@ -1865,6 +1943,7 @@ gckCOMMAND_Commit(
                     entryPhysical = (gctUINT8_PTR) contextBuffer->physical;
 #endif
                     entryLogical  = (gctUINT8_PTR) contextBuffer->logical;
+                    entryAddress  =                contextBuffer->address;
                     entryBytes    =                Context->entryOffset3D;
                 }
 
@@ -1895,7 +1974,7 @@ gckCOMMAND_Commit(
                 gcmkONERROR(gckHARDWARE_Link(
                     hardware,
                     contextBuffer->link2D,
-                    commandBufferLogical + offset,
+                    commandBufferAddress + offset,
                     commandBufferSize    - offset,
                     &linkBytes
                     ));
@@ -1925,6 +2004,7 @@ gckCOMMAND_Commit(
                 entryPhysical = (gctUINT8_PTR) contextBuffer->physical + offset;
 #endif
                 entryLogical  = (gctUINT8_PTR) contextBuffer->logical  + offset;
+                entryAddress  =                contextBuffer->address  + offset;
                 entryBytes    =                Context->bufferSize     - offset;
 
                 /* See if we have to switch pipes between the context
@@ -1954,7 +2034,7 @@ gckCOMMAND_Commit(
                 gcmkONERROR(gckHARDWARE_Link(
                     hardware,
                     contextBuffer->link3D,
-                    commandBufferLogical + offset,
+                    commandBufferAddress + offset,
                     commandBufferSize    - offset,
                     &linkBytes
                     ));
@@ -1987,6 +2067,7 @@ gckCOMMAND_Commit(
                 entryPhysical = (gctUINT8_PTR) commandBufferPhysical + offset;
 #endif
                 entryLogical  =                commandBufferLogical  + offset;
+                entryAddress  =                commandBufferAddress  + offset;
                 entryBytes    =                commandBufferSize     - offset;
             }
         }
@@ -2011,13 +2092,9 @@ gckCOMMAND_Commit(
         exitPhysical = Command->physical;
 #endif
 
-#if gcdPROCESS_ADDRESS_SPACE
-        exitLogical  = waitLinkLogical;
-        exitBytes    = waitLinkBytes;
-#else
         exitLogical  = Command->logical;
+        exitAddress  = Command->address;
         exitBytes    = Command->offset + waitLinkBytes;
-#endif
     }
     else
     {
@@ -2027,6 +2104,7 @@ gckCOMMAND_Commit(
         exitPhysical = waitLinkPhysical;
 #endif
         exitLogical  = waitLinkLogical;
+        exitAddress  = waitLinkAddress;
         exitBytes    = waitLinkBytes;
     }
 
@@ -2063,6 +2141,20 @@ gckCOMMAND_Commit(
         = (gctUINT8_PTR) gcmUINT64_TO_PTR(commandBufferObject->logical)
         +                commandBufferObject->offset;
 
+#ifdef __QNXNTO__
+    userCommandBufferLink = (gctPOINTER) commandBufferLink;
+
+    gcmkONERROR(gckOS_MapUserPointer(
+        Command->os,
+        userCommandBufferLink,
+        0,
+        &pointer));
+
+    commandBufferLink = pointer;
+
+    userCommandBufferLinkMapped = gcvTRUE;
+#endif
+
 #if gcdMULTI_GPU
     if (Command->kernel->core == gcvCORE_MAJOR)
     {
@@ -2079,11 +2171,21 @@ gckCOMMAND_Commit(
     gcmkONERROR(gckHARDWARE_Link(
         hardware,
         commandBufferLink,
-        exitLogical,
+        exitAddress,
         exitBytes,
         &linkBytes
         ));
 
+#ifdef __QNXNTO__
+    gcmkONERROR(gckOS_UnmapUserPointer(
+        Command->os,
+        userCommandBufferLink,
+        0,
+        commandBufferLink));
+
+    userCommandBufferLinkMapped = gcvFALSE;
+#endif
+
 #if gcdNONPAGED_MEMORY_CACHEABLE
     /* Flush the command buffer cache. */
     gcmkONERROR(gckOS_CacheClean(
@@ -2096,40 +2198,6 @@ gckCOMMAND_Commit(
         ));
 #endif
 
-#if gcdPROCESS_ADDRESS_SPACE
-    if (Command->currentMmu != mmu || oldValue)
-    {
-        gctUINT32 targetPhysical;
-
-        /* Fill MMU configuration command seqeunce. */
-        gcmkONERROR(gckHARDWARE_ConfigMMU(
-            hardware,
-            mmuConfigureLogical,
-            mmu->mtlbLogical,
-            offset,
-            gcvNULL,
-            gcvNULL,
-            gcvNULL
-            ));
-
-        gcmkONERROR(
-            gckHARDWARE_ConvertLogical(hardware, entryLogical, &targetPhysical));
-
-        gckENTRYQUEUE_Enqueue(&Command->queue,
-                             targetPhysical,
-                             entryBytes);
-
-        /* Update entryLogical. */
-        entryLogical = mmuConfigureLogical;
-
-        /* Update entryBytes. */
-        entryBytes = mmuConfigureBytes;
-
-        /* Update current MMU. */
-        Command->currentMmu = mmu;
-    }
-#endif
-
     /* Generate a LINK from the previous WAIT/LINK command sequence to the
        entry determined above (either the context or the command buffer).
        This LINK replaces the WAIT instruction from the previous WAIT/LINK
@@ -2138,7 +2206,7 @@ gckCOMMAND_Commit(
     gcmkONERROR(gckHARDWARE_Link(
         hardware,
         Command->waitLogical,
-        entryLogical,
+        entryAddress,
         entryBytes,
         &Command->waitSize
         ));
@@ -2191,11 +2259,7 @@ gckCOMMAND_Commit(
     Command->pipeSelect = commandBufferObject->exitPipe;
 
     /* Update command queue offset. */
-#if gcdPROCESS_ADDRESS_SPACE
-    Command->offset  += reservedBytes;
-#else
     Command->offset  += waitLinkBytes;
-#endif
     Command->newQueue = gcvFALSE;
 
     /* Update address of last WAIT. */
@@ -2316,6 +2380,19 @@ gckCOMMAND_Commit(
         gcmkONERROR(status);
     }
 
+#ifdef __QNXNTO__
+    if (userCommandBufferLogicalMapped)
+    {
+        gcmkONERROR(gckOS_UnmapUserPointer(
+            Command->os,
+            userCommandBufferLogical,
+            0,
+            commandBufferLogical));
+
+        userCommandBufferLogicalMapped = gcvFALSE;
+    }
+#endif
+
     /* Unmap the command buffer pointer. */
     if (commandBufferMapped)
     {
@@ -2365,6 +2442,26 @@ OnError:
     }
 #endif
 
+#ifdef __QNXNTO__
+    if (userCommandBufferLinkMapped)
+    {
+        gcmkONERROR(gckOS_UnmapUserPointer(
+            Command->os,
+            userCommandBufferLink,
+            0,
+            commandBufferLink));
+    }
+
+    if (userCommandBufferLogicalMapped)
+    {
+        gcmkVERIFY_OK(gckOS_UnmapUserPointer(
+            Command->os,
+            userCommandBufferLogical,
+            0,
+            commandBufferLogical));
+    }
+#endif
+
     /* Unmap the command buffer pointer. */
     if (commandBufferMapped)
     {
@@ -2408,14 +2505,14 @@ OnError:
 gceSTATUS
 gckCOMMAND_Reserve(
     IN gckCOMMAND Command,
-    IN gctSIZE_T RequestedBytes,
+    IN gctUINT32 RequestedBytes,
     OUT gctPOINTER * Buffer,
-    OUT gctSIZE_T * BufferSize
+    OUT gctUINT32 * BufferSize
     )
 {
     gceSTATUS status;
-    gctSIZE_T bytes;
-    gctSIZE_T requiredBytes;
+    gctUINT32 bytes;
+    gctUINT32 requiredBytes;
     gctUINT32 requestedAligned;
 
     gcmkHEADER_ARG("Command=0x%x RequestedBytes=%lu", Command, RequestedBytes);
@@ -2500,7 +2597,7 @@ OnError:
 gceSTATUS
 gckCOMMAND_Execute(
     IN gckCOMMAND Command,
-    IN gctSIZE_T RequestedBytes
+    IN gctUINT32 RequestedBytes
     )
 {
     gceSTATUS status;
@@ -2508,18 +2605,19 @@ gckCOMMAND_Execute(
     gctPHYS_ADDR waitLinkPhysical;
     gctUINT8_PTR waitLinkLogical;
     gctUINT32 waitLinkOffset;
-    gctSIZE_T waitLinkBytes;
+    gctUINT32 waitLinkBytes;
 
     gctPHYS_ADDR waitPhysical;
     gctPOINTER waitLogical;
     gctUINT32 waitOffset;
-    gctSIZE_T waitBytes;
+    gctUINT32 waitBytes;
 
 #if gcdNONPAGED_MEMORY_CACHEABLE
     gctPHYS_ADDR execPhysical;
 #endif
     gctPOINTER execLogical;
-    gctSIZE_T execBytes;
+    gctUINT32 execAddress;
+    gctUINT32 execBytes;
 
     gcmkHEADER_ARG("Command=0x%x RequestedBytes=%lu", Command, RequestedBytes);
 
@@ -2559,6 +2657,7 @@ gckCOMMAND_Execute(
         execPhysical = Command->physical;
 #endif
         execLogical  = Command->logical;
+        execAddress  = Command->address;
         execBytes    = waitLinkOffset + waitLinkBytes;
     }
     else
@@ -2569,6 +2668,7 @@ gckCOMMAND_Execute(
         execPhysical = (gctUINT8 *) Command->physical + Command->offset;
 #endif
         execLogical  = (gctUINT8 *) Command->logical  + Command->offset;
+        execAddress  =              Command->address  + Command->offset;
         execBytes    = RequestedBytes + waitLinkBytes;
     }
 
@@ -2588,7 +2688,7 @@ gckCOMMAND_Execute(
     gcmkONERROR(gckHARDWARE_Link(
         Command->kernel->hardware,
         Command->waitLogical,
-        execLogical,
+        execAddress,
         execBytes,
         &Command->waitSize
         ));
@@ -2756,47 +2856,9 @@ gckCOMMAND_Stall(
                 __FUNCTION__, __LINE__, idle
                 );
 
-            gcmkONERROR(gckOS_MemoryBarrier(os, gcvNULL));
-
-#ifdef __QNXNTO__
-            gctUINT32 reg_cmdbuf_fetch;
-            gctUINT32 reg_intr;
-
-            gcmkVERIFY_OK(gckOS_ReadRegisterEx(
-                Command->kernel->hardware->os, Command->kernel->core, 0x0664, &reg_cmdbuf_fetch
-                ));
-
-            if (idle == 0x7FFFFFFE)
-            {
-                /*
-                 * GPU is idle so there should not be pending interrupts.
-                 * Just double check.
-                 *
-                 * Note that reading interrupt register clears it.
-                 * That's why we don't read it in all cases.
-                 */
-                gcmkVERIFY_OK(gckOS_ReadRegisterEx(
-                    Command->kernel->hardware->os, Command->kernel->core, 0x10, &reg_intr
-                    ));
-
-                slogf(
-                    _SLOG_SETCODE(1, 0),
-                    _SLOG_CRITICAL,
-                    "GALcore: Stall timeout (idle = 0x%X, command buffer fetch = 0x%X, interrupt = 0x%X)",
-                    idle, reg_cmdbuf_fetch, reg_intr
-                    );
-            }
-            else
-            {
-                slogf(
-                    _SLOG_SETCODE(1, 0),
-                    _SLOG_CRITICAL,
-                    "GALcore: Stall timeout (idle = 0x%X, command buffer fetch = 0x%X)",
-                    idle, reg_cmdbuf_fetch
-                    );
-            }
-#endif
+            gcmkVERIFY_OK(gckOS_MemoryBarrier(os, gcvNULL));
 #endif
+
             /* Advance timer. */
             timer += gcdGPU_ADVANCETIMER;
         }
@@ -3189,10 +3251,11 @@ gckCOMMAND_DumpExecutingBuffer(
             {
                 /* Make it accessiable by kernel if it is a user command buffer. */
                 gcmkVERIFY_OK(
-                    gckOS_CreateKernelVirtualMapping(buffer->physical,
+                    gckOS_CreateKernelVirtualMapping(os,
+                                                     buffer->physical,
                                                      buffer->bytes,
-                                                     &pageCount,
-                                                     &entry));
+                                                     &entry,
+                                                     &pageCount));
                 gcmkPRINT("User Command Buffer:");
             }
 
@@ -3202,7 +3265,11 @@ gckCOMMAND_DumpExecutingBuffer(
             /* Release kernel logical address if neccessary. */
             if (!buffer->kernelLogical)
             {
-                gcmkVERIFY_OK(gckOS_DestroyKernelVirtualMapping(buffer->physical, entry, buffer->bytes));
+                gcmkVERIFY_OK(
+                    gckOS_DestroyKernelVirtualMapping(os,
+                                                      buffer->physical,
+                                                      buffer->bytes,
+                                                      entry));
             }
         }
 
@@ -3224,7 +3291,11 @@ gckCOMMAND_DumpExecutingBuffer(
         if (gcmIS_SUCCESS(status))
         {
             gcmkVERIFY_OK(
-                gckOS_CreateKernelVirtualMapping(buffer->physical, buffer->bytes, &pageCount, &entry));
+                gckOS_CreateKernelVirtualMapping(os,
+                                                 buffer->physical,
+                                                 buffer->bytes,
+                                                 &entry,
+                                                 &pageCount));
 
             if (entry)
             {
@@ -3248,7 +3319,10 @@ gckCOMMAND_DumpExecutingBuffer(
             }
 
             gcmkVERIFY_OK(
-                gckOS_DestroyKernelVirtualMapping(buffer->physical, entry, buffer->bytes));
+                gckOS_DestroyKernelVirtualMapping(os,
+                                                  buffer->physical,
+                                                  buffer->bytes,
+                                                  entry));
         }
         else
         {
@@ -3262,7 +3336,7 @@ gckCOMMAND_DumpExecutingBuffer(
 gceSTATUS
 gckCOMMAND_AddressInKernelCommandBuffer(
     IN gckCOMMAND Command,
-    IN gctPOINTER Logical,
+    IN gctUINT32 Address,
     OUT gctBOOL *In
     )
 {
@@ -3271,8 +3345,8 @@ gckCOMMAND_AddressInKernelCommandBuffer(
 
     for (i = 0; i < gcdCOMMAND_QUEUES; i++)
     {
-        if ((Logical >= Command->queues[i].logical)
-         && (Logical < (gctPOINTER)((gctUINT8_PTR)Command->queues[i].logical + Command->pageSize))
+        if ((Address >= Command->queues[i].address)
+         && (Address < (Command->queues[i].address + Command->pageSize))
         )
         {
             in = gcvTRUE;
@@ -3283,4 +3357,3 @@ gckCOMMAND_AddressInKernelCommandBuffer(
     *In = in;
     return gcvSTATUS_OK;
 }
-
diff --git a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_command_vg.c b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_command_vg.c
index d62607aee146..c3e0201c2b81 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_command_vg.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_command_vg.c
@@ -537,7 +537,7 @@ _FreeTaskContainer(
     gcsTASK_CONTAINER_PTR next;
     gcsTASK_CONTAINER_PTR merged;
 
-    gctSIZE_T mergedSize;
+    gctUINT32 mergedSize;
 
     /* Verify arguments. */
     gcmkASSERT(Buffer != gcvNULL);
@@ -614,8 +614,8 @@ _RemoveRecordFromProcesDB(
     gctUINT32 size;
     gctUINT32 handle;
     gckKERNEL kernel = Command->kernel->kernel;
-    gckVIDMEM_NODE unlockNode;
-    gckVIDMEM_NODE nodeObject;
+    gckVIDMEM_NODE unlockNode = gcvNULL;
+    gckVIDMEM_NODE nodeObject = gcvNULL;
     gceDATABASE_TYPE type;
 
     /* Get the total size of all tasks. */
@@ -638,13 +638,14 @@ _RemoveRecordFromProcesDB(
                 handle,
                 &nodeObject);
 
-            freeVideoMemory->node = gcmALL_TO_UINT32(nodeObject);
-
-            if(gcmIS_SUCCESS(status))
+            if (gcmIS_ERROR(status))
             {
-                gckVIDMEM_HANDLE_Dereference(kernel, pid, handle);
+                return status;
             }
 
+            gckVIDMEM_HANDLE_Dereference(kernel, pid, handle);
+            freeVideoMemory->node = gcmALL_TO_UINT32(nodeObject);
+
             type = gcvDB_VIDEO_MEMORY
                 | (nodeObject->type << gcdDB_VIDEO_MEMORY_TYPE_SHIFT)
                 | (nodeObject->pool << gcdDB_VIDEO_MEMORY_POOL_SHIFT);
@@ -678,13 +679,15 @@ _RemoveRecordFromProcesDB(
                 pid,
                 handle,
                 &unlockNode);
-            unlockVideoMemory->node = gcmPTR_TO_UINT64(unlockNode);
 
-            if(gcmIS_SUCCESS(status))
+            if (gcmIS_ERROR(status))
             {
-                gckVIDMEM_HANDLE_Dereference(kernel, pid, handle);
+                return status;
             }
 
+            gckVIDMEM_HANDLE_Dereference(kernel, pid, handle);
+            unlockVideoMemory->node = gcmPTR_TO_UINT64(unlockNode);
+
             /* Advance to next task. */
             size -= sizeof(gcsTASK_UNLOCK_VIDEO_MEMORY);
             Task = (gcsTASK_HEADER_PTR)(unlockVideoMemory + 1);
@@ -725,6 +728,11 @@ _ScheduleTasks(
         gctINT32 interrupt;
         gctUINT8_PTR eventCommand;
 
+#ifdef __QNXNTO__
+        gcsTASK_PTR oldUserTask = gcvNULL;
+        gctPOINTER pointer;
+#endif
+
         /* Nothing to schedule? */
         if (TaskTable->size == 0)
         {
@@ -822,7 +830,21 @@ _ScheduleTasks(
                 /* Copy tasks. */
                 do
                 {
-                    gcsTASK_HEADER_PTR taskHeader = (gcsTASK_HEADER_PTR) (userTask + 1);
+                    gcsTASK_HEADER_PTR taskHeader;
+
+#ifdef __QNXNTO__
+                    oldUserTask = userTask;
+
+                    gcmkERR_BREAK(gckOS_MapUserPointer(
+                        Command->os,
+                        oldUserTask,
+                        0,
+                        &pointer));
+
+                    userTask = pointer;
+#endif
+
+                    taskHeader = (gcsTASK_HEADER_PTR) (userTask + 1);
 
                     gcmkVERIFY_OK(_RemoveRecordFromProcesDB(Command, taskHeader));
 
@@ -839,7 +861,8 @@ _ScheduleTasks(
                         ((gcsTASK_SIGNAL_PTR)taskHeader)->coid  = TaskTable->coid;
                         ((gcsTASK_SIGNAL_PTR)taskHeader)->rcvid = TaskTable->rcvid;
                     }
-#endif /* __QNXNTO__ */
+#endif
+
                     /* Copy the task data. */
                     gcmkVERIFY_OK(gckOS_MemCopy(
                         kernelTask, taskHeader, userTask->size
@@ -848,6 +871,14 @@ _ScheduleTasks(
                     /* Advance to the next task. */
                     kernelTask += userTask->size;
                     userTask    = userTask->next;
+
+#ifdef __QNXNTO__
+                    gcmkERR_BREAK(gckOS_UnmapUserPointer(
+                        Command->os,
+                        oldUserTask,
+                        0,
+                        pointer));
+#endif
                 }
                 while (userTask != gcvNULL);
 
@@ -1038,7 +1069,7 @@ _ConvertUserCommandBufferPointer(
         gcmkERR_BREAK(gckVIDMEM_HANDLE_Lookup(
             kernel,
             pid,
-            gcmPTR2INT(mappedUserCommandBuffer->node),
+            gcmPTR2INT32(mappedUserCommandBuffer->node),
             &node));
 
         /* Translate the logical address to the kernel space. */
@@ -1198,17 +1229,17 @@ _AllocateCommandBuffer(
 
         /* Determine the aligned header size. */
         alignedHeaderSize
-            = gcmALIGN(gcmSIZEOF(gcsCMDBUFFER), Command->info.addressAlignment);
+            = (gctUINT32)gcmALIGN(gcmSIZEOF(gcsCMDBUFFER), Command->info.addressAlignment);
 
         /* Align the requested size. */
         requestedSize
-            = gcmALIGN(Size, Command->info.commandAlignment);
+            = (gctUINT32)gcmALIGN(Size, Command->info.commandAlignment);
 
         /* Determine the size of the buffer to allocate. */
         allocationSize
             = alignedHeaderSize
             + requestedSize
-            + Command->info.staticTailSize;
+            + (gctUINT32)Command->info.staticTailSize;
 
         /* Allocate the command buffer. */
         gcmkERR_BREAK(_AllocateLinear(
@@ -3480,6 +3511,14 @@ gckVGCOMMAND_Commit(
 
     gceSTATUS status, last;
 
+#ifdef __QNXNTO__
+    gcsVGCONTEXT_PTR userContext = gcvNULL;
+    gctBOOL userContextMapped = gcvFALSE;
+    gcsTASK_MASTER_TABLE_PTR userTaskTable = gcvNULL;
+    gctBOOL userTaskTableMapped = gcvFALSE;
+    gctPOINTER pointer = gcvNULL;
+#endif
+
     gcmkHEADER_ARG("Command=0x%x Context=0x%x Queue=0x%x EntryCount=0x%x TaskTable=0x%x",
         Command, Context, Queue, EntryCount, TaskTable);
 
@@ -3489,11 +3528,6 @@ gckVGCOMMAND_Commit(
     gcmkVERIFY_ARGUMENT(Queue != gcvNULL);
     gcmkVERIFY_ARGUMENT(EntryCount > 1);
 
-#ifdef __QNXNTO__
-    TaskTable->coid     = Context->coid;
-    TaskTable->rcvid    = Context->rcvid;
-#endif /* __QNXNTO__ */
-
     do
     {
         gctBOOL haveFETasks;
@@ -3510,6 +3544,38 @@ gckVGCOMMAND_Commit(
         gctBOOL previousExecuted;
         gctUINT controlIndex;
 
+#ifdef __QNXNTO__
+        /* Map the context into the kernel space. */
+        userContext = Context;
+
+        gcmkERR_BREAK(gckOS_MapUserPointer(
+            Command->os,
+            userContext,
+            gcmSIZEOF(*userContext),
+            &pointer));
+
+        Context = pointer;
+
+        userContextMapped = gcvTRUE;
+
+        /* Map the taskTable into the kernel space. */
+        userTaskTable = TaskTable;
+
+        gcmkERR_BREAK(gckOS_MapUserPointer(
+            Command->os,
+            userTaskTable,
+            gcmSIZEOF(*userTaskTable),
+            &pointer));
+
+        TaskTable = pointer;
+
+        userTaskTableMapped = gcvTRUE;
+
+        /* Update the signal info. */
+        TaskTable->coid  = Context->coid;
+        TaskTable->rcvid = Context->rcvid;
+#endif
+
         gcmkERR_BREAK(gckVGHARDWARE_SetPowerManagementState(
             Command->hardware, gcvPOWER_ON_AUTO
             ));
@@ -3772,6 +3838,28 @@ gckVGCOMMAND_Commit(
     }
     while (gcvFALSE);
 
+#ifdef __QNXNTO__
+    if (userContextMapped)
+    {
+        /* Unmap the user context. */
+        gcmkVERIFY_OK(gckOS_UnmapUserPointer(
+            Command->os,
+            userContext,
+            gcmSIZEOF(*userContext),
+            Context));
+    }
+
+    if (userTaskTableMapped)
+    {
+        /* Unmap the user taskTable. */
+        gcmkVERIFY_OK(gckOS_UnmapUserPointer(
+            Command->os,
+            userTaskTable,
+            gcmSIZEOF(*userTaskTable),
+            TaskTable));
+    }
+#endif
+
     gcmkFOOTER();
     /* Return status. */
     return status;
diff --git a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_db.c b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_db.c
index 5433e02a27d8..db2f077ad394 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_db.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_db.c
@@ -493,7 +493,6 @@ gckKERNEL_DeleteRecord(
         gckOS_AcquireMutex(Kernel->os, Kernel->db->dbMutex, gcvINFINITE));
     acquired = gcvTRUE;
 
-
     /* Scan the database for this record. */
     for (record = Database->list[slot], previous = gcvNULL;
          record != gcvNULL;
@@ -650,7 +649,6 @@ OnError:
     return status;
 }
 
-
 /*******************************************************************************
 ***** Public API **************************************************************/
 
@@ -1264,18 +1262,17 @@ gckKERNEL_DestroyProcessDB(
         case gcvDB_VIDEO_MEMORY:
             gcmkERR_BREAK(gckVIDMEM_HANDLE_Lookup(record->kernel,
                                                   ProcessID,
-                                                  gcmPTR2INT(record->data),
+                                                  gcmPTR2INT32(record->data),
                                                   &nodeObject));
 
             /* Free the video memory. */
             gcmkVERIFY_OK(gckVIDMEM_HANDLE_Dereference(record->kernel,
                                                        ProcessID,
-                                                       gcmPTR2INT(record->data)));
+                                                       gcmPTR2INT32(record->data)));
 
             gcmkVERIFY_OK(gckVIDMEM_NODE_Dereference(record->kernel,
                                                      nodeObject));
 
-
             gcmkTRACE_ZONE(gcvLEVEL_WARNING, gcvZONE_DATABASE,
                            "DB: VIDEO_MEMORY 0x%x (status=%d)",
                            record->data, status);
@@ -1290,10 +1287,11 @@ gckKERNEL_DestroyProcessDB(
                                             record->data);
 
             /* Free the non paged memory. */
-            status = gckOS_FreeNonPagedMemory(Kernel->os,
-                                              record->bytes,
-                                              physical,
-                                              record->data);
+            status = gckEVENT_FreeNonPagedMemory(Kernel->eventObj,
+                                                 record->bytes,
+                                                 physical,
+                                                 record->data,
+                                                 gcvKERNEL_PIXEL);
             gcmRELEASE_NAME(record->physical);
 
             gcmkTRACE_ZONE(gcvLEVEL_WARNING, gcvZONE_DATABASE,
@@ -1342,7 +1340,7 @@ gckKERNEL_DestroyProcessDB(
 #else
             /* Free the user signal. */
             status = gckOS_DestroyUserSignal(Kernel->os,
-                                             gcmPTR2INT(record->data));
+                                             gcmPTR2INT32(record->data));
 #endif /* USE_NEW_LINUX_SIGNAL */
 
             gcmkTRACE_ZONE(gcvLEVEL_WARNING, gcvZONE_DATABASE,
@@ -1351,7 +1349,7 @@ gckKERNEL_DestroyProcessDB(
             break;
 
         case gcvDB_VIDEO_MEMORY_LOCKED:
-            handle = gcmPTR2INT(record->data);
+            handle = gcmPTR2INT32(record->data);
 
             gcmkERR_BREAK(gckVIDMEM_HANDLE_Lookup(record->kernel,
                                                   ProcessID,
@@ -1361,7 +1359,7 @@ gckKERNEL_DestroyProcessDB(
             /* Unlock what we still locked */
             status = gckVIDMEM_Unlock(record->kernel,
                                       nodeObject->node,
-                                      gcvSURF_TYPE_UNKNOWN,
+                                      nodeObject->type,
                                       &asynchronous);
 
 #if gcdENABLE_VG
@@ -1372,7 +1370,7 @@ gckKERNEL_DestroyProcessDB(
                     /* TODO: we maybe need to schedule a event here */
                     status = gckVIDMEM_Unlock(record->kernel,
                                               nodeObject->node,
-                                              gcvSURF_TYPE_UNKNOWN,
+                                              nodeObject->type,
                                               gcvNULL);
                 }
 
@@ -1392,11 +1390,10 @@ gckKERNEL_DestroyProcessDB(
 
                 if (gcmIS_SUCCESS(status) && (gcvTRUE == asynchronous))
                 {
-
                     status = gckEVENT_Unlock(record->kernel->eventObj,
                                              gcvKERNEL_PIXEL,
                                              nodeObject,
-                                             gcvSURF_TYPE_UNKNOWN);
+                                             nodeObject->type);
                 }
                 else
                 {
@@ -1429,7 +1426,7 @@ gckKERNEL_DestroyProcessDB(
 
             gcmkTRACE_ZONE(gcvLEVEL_WARNING, gcvZONE_DATABASE,
                            "DB: MAP MEMORY %d (status=%d)",
-                           gcmPTR2INT(record->data), status);
+                           gcmPTR2INT32(record->data), status);
             break;
 
         case gcvDB_MAP_USER_MEMORY:
@@ -1444,7 +1441,7 @@ gckKERNEL_DestroyProcessDB(
 
             gcmkTRACE_ZONE(gcvLEVEL_WARNING, gcvZONE_DATABASE,
                            "DB: MAP USER MEMORY %d (status=%d)",
-                           gcmPTR2INT(record->data), status);
+                           gcmPTR2INT32(record->data), status);
             break;
 
 #if gcdANDROID_NATIVE_FENCE_SYNC
@@ -1831,4 +1828,3 @@ OnError:
     gcmkFOOTER();
     return status;
 }
-
diff --git a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_debug.c b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_debug.c
index 7a71dbe7abc7..c6d690efa4c1 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_debug.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_debug.c
@@ -139,7 +139,7 @@ static gctUINT32 _debugZones = gcvZONE_NONE;
 
 #define gcmPTRALIGNMENT(Pointer, Alignemnt) \
 ( \
-    gcmALIGN(gcmPTR2INT(Pointer), Alignemnt) - gcmPTR2INT(Pointer) \
+    gcmALIGN(gcmPTR2INT32(Pointer), Alignemnt) - gcmPTR2INT32(Pointer) \
 )
 
 #if gcdALIGNBYSIZE
@@ -147,7 +147,7 @@ static gctUINT32 _debugZones = gcvZONE_NONE;
         (((Offset) & ((Alignment) - 1)) == 0)
 
 #   define gcmkALIGNPTR(Type, Pointer, Alignment) \
-        Pointer = (Type) gcmINT2PTR(gcmALIGN(gcmPTR2INT(Pointer), Alignment))
+        Pointer = (Type) gcmINT2PTR(gcmALIGN(gcmPTR2INT32(Pointer), Alignment))
 #else
 #   define gcmISALIGNED(Offset, Alignment) \
         gcvTRUE
@@ -503,7 +503,7 @@ _DirectPrint(
     gctARGUMENTS arguments;
 
     gcmkARGUMENTS_START(arguments, Message);
-    len = gcmkVSPRINTF(buffer, gcmSIZEOF(buffer), Message, arguments);
+    len = gcmkVSPRINTF(buffer, gcmSIZEOF(buffer), Message, &arguments);
     gcmkARGUMENTS_END(arguments);
 
     buffer[len] = '\0';
@@ -1712,7 +1712,7 @@ _Print(
     IN gctUINT ArgumentSize,
     IN gctBOOL CopyMessage,
     IN gctCONST_STRING Message,
-    IN gctARGUMENTS Arguments
+    IN gctARGUMENTS * Arguments
     )
 {
     gcsBUFFERED_OUTPUT_PTR outputBuffer;
@@ -1760,14 +1760,14 @@ _Print(
     {
         gcdOUTPUTCOPY(
             outputBuffer, outputBuffer->indent,
-            Message, ArgumentSize, * (gctPOINTER *) &Arguments
+            Message, ArgumentSize, (gctPOINTER) Arguments
             );
     }
     else
     {
         gcdOUTPUTSTRING(
             outputBuffer, outputBuffer->indent,
-            Message, ArgumentSize, * (gctPOINTER *) &Arguments
+            Message, ArgumentSize, ((gctPOINTER) Arguments)
             );
     }
 
@@ -1795,7 +1795,7 @@ extern volatile unsigned g_nQnxInIsrs;
     { \
         gctARGUMENTS __arguments__; \
         gcmkARGUMENTS_START(__arguments__, Message); \
-        _Print(ArgumentSize, CopyMessage, Message, __arguments__); \
+        _Print(ArgumentSize, CopyMessage, Message, &__arguments__); \
         gcmkARGUMENTS_END(__arguments__); \
     } \
     atomic_sub(&g_nQnxInIsrs, 1); \
@@ -1807,7 +1807,7 @@ extern volatile unsigned g_nQnxInIsrs;
 { \
     gctARGUMENTS __arguments__; \
     gcmkARGUMENTS_START(__arguments__, Message); \
-    _Print(ArgumentSize, CopyMessage, Message, __arguments__); \
+    _Print(ArgumentSize, CopyMessage, Message, &__arguments__); \
     gcmkARGUMENTS_END(__arguments__); \
 }
 
@@ -1941,10 +1941,10 @@ gckOS_DumpBuffer(
     IN gctBOOL CopyMessage
     )
 {
-    gctUINT32 address;
-    gcsBUFFERED_OUTPUT_PTR outputBuffer;
+    gctUINT32 address                   = 0;
+    gcsBUFFERED_OUTPUT_PTR outputBuffer = gcvNULL;
     static gctBOOL userLocked;
-    gctCHAR *buffer = (gctCHAR*)Buffer;
+    gctCHAR *buffer                     = (gctCHAR*)Buffer;
 
     gcmkDECLARE_LOCK(lockHandle);
 
@@ -2609,7 +2609,7 @@ _VerifyMessage(
 
     /* Get function name. */
     function = (gctSTRING)&message->payload;
-    functionBytes = strlen(function) + 1;
+    functionBytes = (gctUINT32)strlen(function) + 1;
 
     /* Get arguments number. */
     numArguments = message->numArguments;
@@ -2629,7 +2629,7 @@ _VerifyMessage(
 
     if (numArguments)
     {
-        gcmkVSPRINTF(arguments, 150, format, *(gctARGUMENTS *) &args);
+        gcmkVSPRINTF(arguments, 150, format, (gctARGUMENTS *) &args);
     }
 
     gcmkPRINT("[%d](%d): %s(%d) %s",
@@ -2720,7 +2720,7 @@ gckOS_BinaryTrace(
     payload = (gctSTRING)&message->payload;
 
     /* Function name. */
-    functionBytes = gcmkSTRLEN(Function) + 1;
+    functionBytes = (gctUINT32)gcmkSTRLEN(Function) + 1;
     gcmkMEMCPY(payload, Function, functionBytes);
 
     /* Advance to next payload. */
@@ -2746,6 +2746,6 @@ gckOS_BinaryTrace(
 
 
     /* Send buffer to ring buffer. */
-    gckOS_WriteToRingBuffer(buffer, payload - buffer);
+    gckOS_WriteToRingBuffer(buffer, (gctUINT32)(payload - buffer));
 }
 
diff --git a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_event.c b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_event.c
index fa1cb6338ea6..7adadb36efa0 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_event.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_event.c
@@ -367,6 +367,68 @@ OnError:
     return status;
 }
 
+/*******************************************************************************
+**
+**  _QueryFlush
+**
+**  Check the type of surfaces which will be released by current event and
+**  determine the cache needed to flush.
+**
+*/
+static gceSTATUS
+_QueryFlush(
+    IN gckEVENT Event,
+    IN gcsEVENT_PTR Record,
+    OUT gceKERNEL_FLUSH *Flush
+    )
+{
+    gceKERNEL_FLUSH flush = 0;
+    gcmkHEADER_ARG("Event=0x%x Record=0x%x", Event, Record);
+    gcmkVERIFY_ARGUMENT(Record != gcvNULL);
+
+    while (Record != gcvNULL)
+    {
+        switch (Record->info.command)
+        {
+        case gcvHAL_UNLOCK_VIDEO_MEMORY:
+            switch(Record->info.u.UnlockVideoMemory.type)
+            {
+            case gcvSURF_TILE_STATUS:
+                flush |= gcvFLUSH_TILE_STATUS;
+                break;
+            case gcvSURF_RENDER_TARGET:
+                flush |= gcvFLUSH_COLOR;
+                break;
+            case gcvSURF_DEPTH:
+                flush |= gcvFLUSH_DEPTH;
+                break;
+            case gcvSURF_TEXTURE:
+                flush |= gcvFLUSH_TEXTURE;
+                break;
+            case gcvSURF_TYPE_UNKNOWN:
+                gcmkASSERT(0);
+                break;
+            default:
+                break;
+            }
+            break;
+        case gcvHAL_UNMAP_USER_MEMORY:
+            *Flush = gcvFLUSH_ALL;
+            return gcvSTATUS_OK;
+
+        default:
+            break;
+        }
+
+        Record = Record->next;
+    }
+
+    *Flush = flush;
+
+    gcmkFOOTER_NO();
+    return gcvSTATUS_OK;
+}
+
 void
 _SubmitTimerFunction(
     gctPOINTER Data
@@ -475,6 +537,7 @@ gckEVENT_Construct(
     for (i = 0; i < gcdMULTI_GPU; i++)
     {
         gcmkONERROR(gckOS_AtomConstruct(os, &eventObj->pending3D[i]));
+        gcmkONERROR(gckOS_AtomConstruct(os, &eventObj->pending3DMask[i]));
     }
 
     gcmkONERROR(gckOS_AtomConstruct(os, &eventObj->pendingMask));
@@ -544,6 +607,11 @@ OnError:
             {
                 gcmkVERIFY_OK(gckOS_AtomDestroy(os, eventObj->pending3D[i]));
             }
+
+            if (eventObj->pending3DMask[i] != gcvNULL)
+            {
+                gcmkVERIFY_OK(gckOS_AtomDestroy(os, eventObj->pending3DMask[i]));
+            }
         }
 #endif
 #endif
@@ -663,6 +731,7 @@ gckEVENT_Destroy(
         for (i = 0; i < gcdMULTI_GPU; i++)
         {
             gcmkVERIFY_OK(gckOS_AtomDestroy(Event->os, Event->pending3D[i]));
+            gcmkVERIFY_OK(gckOS_AtomDestroy(Event->os, Event->pending3DMask[i]));
         }
     }
 #endif
@@ -706,6 +775,18 @@ gckEVENT_Destroy(
 **      gctUINT8 * EventID
 **          Reserved event ID.
 */
+#define gcdINVALID_EVENT_PTR    ((gcsEVENT_PTR)gcvMAXUINTPTR_T)
+
+#if gcdMULTI_GPU
+gceSTATUS
+gckEVENT_GetEvent(
+    IN gckEVENT Event,
+    IN gctBOOL Wait,
+    OUT gctUINT8 * EventID,
+    IN gceKERNEL_WHERE Source,
+    IN gceCORE_3D_MASK ChipEnable
+    )
+#else
 gceSTATUS
 gckEVENT_GetEvent(
     IN gckEVENT Event,
@@ -713,11 +794,15 @@ gckEVENT_GetEvent(
     OUT gctUINT8 * EventID,
     IN gceKERNEL_WHERE Source
     )
+#endif
 {
     gctINT i, id;
     gceSTATUS status;
     gctBOOL acquired = gcvFALSE;
     gctINT32 free;
+#if gcdMULTI_GPU
+    gctINT j;
+#endif
 
 #if gcdGPU_TIMEOUT
     gctUINT32 timer = 0;
@@ -747,9 +832,34 @@ gckEVENT_GetEvent(
                 Event->lastID = (gctUINT8) nextID;
 
                 /* Save time stamp of event. */
+                Event->queues[id].head   = gcdINVALID_EVENT_PTR;
                 Event->queues[id].stamp  = ++(Event->stamp);
                 Event->queues[id].source = Source;
 
+#if gcdMULTI_GPU
+                Event->queues[id].chipEnable = ChipEnable;
+
+                if (ChipEnable == gcvCORE_3D_ALL_MASK)
+                {
+                    gckOS_AtomSetMask(Event->pendingMask, (1 << id));
+
+                    for (j = 0; j < gcdMULTI_GPU; j++)
+                    {
+                        gckOS_AtomSetMask(Event->pending3DMask[j], (1 << id));
+                    }
+                }
+                else
+                {
+                    for (j = 0; j < gcdMULTI_GPU; j++)
+                    {
+                        if (ChipEnable & (1 << j))
+                        {
+                            gckOS_AtomSetMask(Event->pending3DMask[j], (1 << id));
+                        }
+                    }
+                }
+#endif
+
                 gcmkONERROR(gckOS_AtomDecrement(Event->os,
                                                 Event->freeAtom,
                                                 &free));
@@ -1114,7 +1224,7 @@ gckEVENT_AddList(
         buffer = (gckVIRTUAL_COMMAND_BUFFER_PTR)gcmNAME_TO_PTR(Interface->u.FreeVirtualCommandBuffer.physical);
         if (buffer->userLogical)
         {
-            gcmkONERROR(gckOS_UnlockPages(
+            gcmkONERROR(gckOS_DestroyUserVirtualMapping(
                             Event->os,
                             buffer->physical,
                             (gctSIZE_T) Interface->u.FreeVirtualCommandBuffer.bytes,
@@ -1575,7 +1685,7 @@ gckEVENT_Submit(
     gckCOMMAND command = gcvNULL;
     gctBOOL commitEntered = gcvFALSE;
 #if !gcdNULL_DRIVER
-    gctSIZE_T bytes;
+    gctUINT32 bytes;
     gctPOINTER buffer;
 #endif
 
@@ -1587,10 +1697,20 @@ gckEVENT_Submit(
     gctUINT32 oldValue;
 #endif
 
+
+    gctUINT32 flushBytes;
+    gctUINT32 executeBytes;
+    gckHARDWARE hardware;
+
+    gceKERNEL_FLUSH flush = gcvFALSE;
+
     gcmkHEADER_ARG("Event=0x%x Wait=%d", Event, Wait);
 
     /* Get gckCOMMAND object. */
     command = Event->kernel->command;
+    hardware = Event->kernel->hardware;
+
+    gcmkVERIFY_OBJECT(hardware, gcvOBJ_HARDWARE);
 
     /* Are there event queues? */
     if (Event->queueHead != gcvNULL)
@@ -1612,13 +1732,12 @@ gckEVENT_Submit(
             queue = Event->queueHead;
 
             /* Allocate an event ID. */
-            gcmkONERROR(gckEVENT_GetEvent(Event, Wait, &id, queue->source));
 #if gcdMULTI_GPU
-            if (ChipEnable == gcvCORE_3D_ALL_MASK)
-            {
-                gckOS_AtomSetMask(Event->pendingMask, (1 << id));
-            }
+            gcmkONERROR(gckEVENT_GetEvent(Event, Wait, &id, queue->source, ChipEnable));
+#else
+            gcmkONERROR(gckEVENT_GetEvent(Event, Wait, &id, queue->source));
 #endif
+
             /* Copy event list to event ID queue. */
             Event->queues[id].head   = queue->head;
 
@@ -1640,10 +1759,15 @@ gckEVENT_Submit(
             gcmkONERROR(gckOS_ReleaseMutex(Event->os, Event->eventListMutex));
             acquired = gcvFALSE;
 
+            /* Determine cache needed to flush. */
+            gcmkVERIFY_OK(_QueryFlush(Event, Event->queues[id].head, &flush));
+
 #if gcdINTERRUPT_STATISTIC
-            gcmkVERIFY_OK(gckOS_AtomIncrement(Event->os,
-                                              Event->interruptCount,
-                                              &oldValue));
+            gcmkVERIFY_OK(gckOS_AtomIncrement(
+                Event->os,
+                Event->interruptCount,
+                &oldValue
+                ));
 #endif
 
 #if gcdNULL_DRIVER
@@ -1653,58 +1777,86 @@ gckEVENT_Submit(
             gcmkONERROR(gckEVENT_Notify(Event, 0));
 #else
             /* Get the size of the hardware event. */
-            gcmkONERROR(gckHARDWARE_Event(Event->kernel->hardware,
-                                          gcvNULL,
-                                          id,
-                                          Event->queues[id].source,
-                                          &bytes));
+            gcmkONERROR(gckHARDWARE_Event(
+                hardware,
+                gcvNULL,
+                id,
+                Event->queues[id].source,
+                &bytes
+                ));
+
+            /* Get the size of flush command. */
+            gcmkONERROR(gckHARDWARE_Flush(
+                hardware,
+                flush,
+                gcvNULL,
+                &flushBytes
+                ));
+
+            bytes += flushBytes;
 
 #if gcdMULTI_GPU
-            gcmkONERROR(gckHARDWARE_ChipEnable(Event->kernel->hardware,
-                                               gcvNULL,
-                                               0,
-                                               &chipEnableBytes));
+            gcmkONERROR(gckHARDWARE_ChipEnable(
+                hardware,
+                gcvNULL,
+                0,
+                &chipEnableBytes
+                ));
 
             bytes += chipEnableBytes * 2;
 #endif
 
+            /* Total bytes need to execute. */
+            executeBytes = bytes;
+
             /* Reserve space in the command queue. */
-            gcmkONERROR(gckCOMMAND_Reserve(command,
-                                           bytes,
-                                           &buffer,
-                                           &bytes));
+            gcmkONERROR(gckCOMMAND_Reserve(command, bytes, &buffer, &bytes));
 
 #if gcdMULTI_GPU
-            gcmkONERROR(gckHARDWARE_ChipEnable(Event->kernel->hardware,
-                                               buffer,
-                                               ChipEnable,
-                                               &chipEnableBytes));
+            gcmkONERROR(gckHARDWARE_ChipEnable(
+                hardware,
+                buffer,
+                ChipEnable,
+                &chipEnableBytes
+                ));
 
-            /* Set the hardware event in the command queue. */
-            gcmkONERROR(gckHARDWARE_Event(Event->kernel->hardware,
-                                          buffer + chipEnableBytes,
-                                          id,
-                                          Event->queues[id].source,
-                                          &bytes));
+            buffer = (gctUINT8_PTR)buffer + chipEnableBytes;
+#endif
 
-            gcmkONERROR(gckHARDWARE_ChipEnable(Event->kernel->hardware,
-                                               buffer + bytes + chipEnableBytes,
-                                               gcvCORE_3D_ALL_MASK,
-                                               &chipEnableBytes));
+            /* Set the flush in the command queue. */
+            gcmkONERROR(gckHARDWARE_Flush(
+                hardware,
+                flush,
+                buffer,
+                &flushBytes
+                ));
+
+            /* Advance to next command. */
+            buffer = (gctUINT8_PTR)buffer + flushBytes;
 
-            /* Execute the hardware event. */
-            gcmkONERROR(gckCOMMAND_Execute(command, bytes + chipEnableBytes * 2));
-#else
             /* Set the hardware event in the command queue. */
-            gcmkONERROR(gckHARDWARE_Event(Event->kernel->hardware,
-                                          buffer,
-                                          id,
-                                          Event->queues[id].source,
-                                          &bytes));
+            gcmkONERROR(gckHARDWARE_Event(
+                hardware,
+                buffer,
+                id,
+                Event->queues[id].source,
+                &bytes
+                ));
 
-            /* Execute the hardware event. */
-            gcmkONERROR(gckCOMMAND_Execute(command, bytes));
+            /* Advance to next command. */
+            buffer = (gctUINT8_PTR)buffer + bytes;
+
+#if gcdMULTI_GPU
+            gcmkONERROR(gckHARDWARE_ChipEnable(
+                hardware,
+                buffer,
+                gcvCORE_3D_ALL_MASK,
+                &chipEnableBytes
+                ));
 #endif
+
+            /* Execute the hardware event. */
+            gcmkONERROR(gckCOMMAND_Execute(command, executeBytes));
 #endif
         }
 
@@ -1915,7 +2067,11 @@ gckEVENT_Compose(
     gcmkVERIFY_ARGUMENT(Info != gcvNULL);
 
     /* Allocate an event ID. */
+#if gcdMULTI_GPU
+    gcmkONERROR(gckEVENT_GetEvent(Event, gcvTRUE, &id, gcvKERNEL_PIXEL, gcvCORE_3D_ALL_MASK));
+#else
     gcmkONERROR(gckEVENT_GetEvent(Event, gcvTRUE, &id, gcvKERNEL_PIXEL));
+#endif
 
     /* Get process ID. */
     gcmkONERROR(gckOS_GetProcessID(&processID));
@@ -2034,42 +2190,39 @@ gckEVENT_Interrupt(
     /* Verify the arguments. */
     gcmkVERIFY_OBJECT(Event, gcvOBJ_EVENT);
 
-#if gcdPROCESS_ADDRESS_SPACE
     if (Data & 0x20000000)
     {
-        gctUINT32 physical;
-        gctUINT32 bytes;
         gckENTRYDATA data;
         gctUINT32 idle;
         Data &= ~0x20000000;
 
-        /* Get first entry information. */
-        gckENTRYQUEUE_GetData(&Event->kernel->command->queue, 0, &data);
-
-        physical = data->physical;
-        bytes = data->bytes;
-
-        gckENTRYQUEUE_Dequeue(&Event->kernel->command->queue);
-
-        /* Make sure FE is idle. */
-        do
+#if gcdMULTI_GPU
+        if (Event->kernel->core == gcvCORE_MAJOR)
+#endif
         {
-            gcmkVERIFY_OK(gckOS_ReadRegisterEx(
-                Event->os,
-                Event->kernel->core,
-                0x4,
-                &idle));
+            /* Get first entry information. */
+            gcmkVERIFY_OK(
+                gckENTRYQUEUE_Dequeue(&Event->kernel->command->queue, &data));
+
+            /* Make sure FE is idle. */
+            do
+            {
+                gcmkVERIFY_OK(gckOS_ReadRegisterEx(
+                    Event->os,
+                    Event->kernel->core,
+                    0x4,
+                    &idle));
+            }
+            while (idle != 0x7FFFFFFF);
+
+            /* Start Command Parser. */
+            gcmkVERIFY_OK(gckHARDWARE_Execute(
+                Event->kernel->hardware,
+                data->physical,
+                data->bytes
+                ));
         }
-        while (idle != 0x7FFFFFFF);
-
-        /* Start Command Parser. */
-        gcmkVERIFY_OK(gckHARDWARE_ExecutePhysical(
-            Event->kernel->hardware,
-            physical,
-            bytes
-            ));
     }
-#endif
 
     /* Combine current interrupt status with pending flags. */
 #if gcdSMP
@@ -2226,8 +2379,15 @@ gckEVENT_Notify(
         gcsEVENT_PTR record;
 #if gcdMULTI_GPU
         gctUINT32 pend[gcdMULTI_GPU];
+        gctUINT32 pendMask[gcdMULTI_GPU];
 #endif
 
+        /* Grab the mutex queue. */
+        gcmkONERROR(gckOS_AcquireMutex(Event->os,
+                                       Event->eventQueueMutex,
+                                       gcvINFINITE));
+        acquired = gcvTRUE;
+
 #if gcdSMP
 #if gcdMULTI_GPU
         if (core == gcvCORE_MAJOR)
@@ -2236,6 +2396,7 @@ gckEVENT_Notify(
             for (i = 0; i < gcdMULTI_GPU; i++)
             {
                 gckOS_AtomGet(Event->os, Event->pending3D[i], (gctINT32_PTR)&pend[i]);
+                gckOS_AtomGet(Event->os, Event->pending3DMask[i], (gctINT32_PTR)&pendMask[i]);
             }
 
             gckOS_AtomGet(Event->os, Event->pendingMask, (gctINT32_PTR)&pendingMask);
@@ -2257,6 +2418,7 @@ gckEVENT_Notify(
             {
                 /* Get current interrupts. */
                 pend[i] = Event->pending3D[i];
+                pendMask[i] = Event->pending3DMask[i];
             }
 
             pendingMask = Event->pendingMask;
@@ -2275,14 +2437,37 @@ gckEVENT_Notify(
 #if gcdMULTI_GPU
         if (core == gcvCORE_MAJOR)
         {
+            for (i = 0; i < gcdMULTI_GPU; i++)
+            {
+                gctUINT32 bad_pend = (pend[i] & ~pendMask[i]);
+
+                if (bad_pend != 0)
+                {
+                    gcmkTRACE_ZONE_N(
+                        gcvLEVEL_ERROR, gcvZONE_EVENT,
+                        gcmSIZEOF(bad_pend) + gcmSIZEOF(i),
+                        "Interrupts 0x%x are not unexpected for Core%d.",
+                        bad_pend, i
+                        );
+
+                    gckOS_AtomClearMask(Event->pending3D[i], bad_pend);
+
+                    pend[i] &= pendMask[i];
+                }
+            }
+
             pending = (pend[0] & pend[1] & pendingMask) /* Check combined events on both GPUs */
-                        | (pend[0] & ~pendingMask)          /* Check individual events on GPU 0   */
-                        | (pend[1] & ~pendingMask);         /* Check individual events on GPU 1   */
+                    | (pend[0] & ~pendingMask)          /* Check individual events on GPU 0   */
+                    | (pend[1] & ~pendingMask);         /* Check individual events on GPU 1   */
         }
 #endif
 
         if (pending == 0)
         {
+            /* Release the mutex queue. */
+            gcmkONERROR(gckOS_ReleaseMutex(Event->os, Event->eventQueueMutex));
+            acquired = gcvFALSE;
+
             /* No more pending interrupts - done. */
             break;
         }
@@ -2364,6 +2549,7 @@ gckEVENT_Notify(
                 for (i = 0; i < gcdMULTI_GPU; i++)
                 {
                     gckOS_AtomClearMask(Event->pending3D[i], pending);
+                    gckOS_AtomClearMask(Event->pending3DMask[i], pending);
                 }
 
                 gckOS_AtomClearMask(Event->pendingMask, pending);
@@ -2381,7 +2567,10 @@ gckEVENT_Notify(
                 for (i = 0; i < gcdMULTI_GPU; i++)
                 {
                     atomic_clr((gctUINT32_PTR)&Event->pending3D[i], pending);
+                    atomic_clr((gctUINT32_PTR)&Event->pending3DMask[i], pending);
                 }
+
+                atomic_clr((gctUINT32_PTR)&Event->pendingMask, pending);
             }
             else
 #endif
@@ -2400,6 +2589,7 @@ gckEVENT_Notify(
                 {
                     /* Mark pending interrupts as handled. */
                     Event->pending3D[i] &= ~pending;
+                    Event->pending3DMask[i] &= ~pending;
                 }
             }
             else
@@ -2412,6 +2602,10 @@ gckEVENT_Notify(
             gcmkONERROR(gckOS_ResumeInterruptEx(Event->os, Event->kernel->core));
             suspended = gcvFALSE;
 #endif
+
+            /* Release the mutex queue. */
+            gcmkONERROR(gckOS_ReleaseMutex(Event->os, Event->eventQueueMutex));
+            acquired = gcvFALSE;
             break;
         }
 
@@ -2421,6 +2615,9 @@ gckEVENT_Notify(
             if ((Event->queues[i].head != gcvNULL)
             &&  (Event->queues[i].stamp < queue->stamp)
             &&  (Event->queues[i].source <= queue->source)
+#if gcdMULTI_GPU
+            &&  (Event->queues[i].chipEnable == queue->chipEnable)
+#endif
             )
             {
                 gcmkTRACE_N(
@@ -2456,6 +2653,7 @@ gckEVENT_Notify(
             {
                 /* Mark pending interrupt as handled. */
                 gckOS_AtomClearMask(Event->pending3D[i], mask);
+                gckOS_AtomClearMask(Event->pending3DMask[i], mask);
             }
 
             gckOS_AtomClearMask(Event->pendingMask, mask);
@@ -2473,7 +2671,10 @@ gckEVENT_Notify(
             for (i = 0; i < gcdMULTI_GPU; i++)
             {
                 atomic_clr(&Event->pending3D[i], mask);
+                atomic_clr(&Event->pending3DMask[i], mask);
             }
+
+            atomic_clr(&Event->pendingMask, mask);
         }
         else
 #endif
@@ -2492,7 +2693,10 @@ gckEVENT_Notify(
             {
                 /* Mark pending interrupt as handled. */
                 Event->pending3D[i] &= ~mask;
+                Event->pending3DMask[i] &= ~mask;
             }
+
+            Event->pendingMask &= ~mask;
         }
         else
 #endif
@@ -2505,12 +2709,6 @@ gckEVENT_Notify(
         suspended = gcvFALSE;
 #endif
 
-        /* Grab the mutex queue. */
-        gcmkONERROR(gckOS_AcquireMutex(Event->os,
-                                       Event->eventQueueMutex,
-                                       gcvINFINITE));
-        acquired = gcvTRUE;
-
         /* Grab the event head. */
         record = queue->head;
 
@@ -3060,7 +3258,7 @@ gckEVENT_Stop(
     IN gctPHYS_ADDR Handle,
     IN gctPOINTER Logical,
     IN gctSIGNAL Signal,
-    IN OUT gctSIZE_T * waitSize
+    IN OUT gctUINT32 * waitSize
     )
 {
     gceSTATUS status;
@@ -3081,8 +3279,11 @@ gckEVENT_Stop(
 #else
     gcmkONERROR(gckEVENT_Submit(Event, gcvTRUE, gcvFALSE));
 #endif
-
+#if gcdMULTI_GPU
+    gcmkONERROR(gckEVENT_GetEvent(Event, gcvTRUE, &id, gcvKERNEL_PIXEL, gcvCORE_3D_ALL_MASK));
+#else
     gcmkONERROR(gckEVENT_GetEvent(Event, gcvTRUE, &id, gcvKERNEL_PIXEL));
+#endif
 
     /* Allocate a record. */
     gcmkONERROR(gckEVENT_AllocateRecord(Event, gcvTRUE, &record));
diff --git a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_heap.c b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_heap.c
index bc02f428fc28..4c25f395bddd 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_heap.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_heap.c
@@ -34,8 +34,7 @@
 /*******************************************************************************
 ***** Structures ***************************************************************
 *******************************************************************************/
-
-#define gcdIN_USE               ((gcskNODE_PTR) ~0)
+#define gcdIN_USE               ((gcskNODE_PTR)gcvMAXUINTPTR_T)
 
 typedef struct _gcskNODE *      gcskNODE_PTR;
 typedef struct _gcskNODE
diff --git a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_mmu.c b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_mmu.c
index e2feb69505de..8721c0b70976 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_mmu.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_mmu.c
@@ -47,7 +47,7 @@ gceMMU_TYPE;
 #   define gcdMMU_CLEAR_VALUE                   0x00000ABC
 #endif
 
-/*! Start GPU address for gcvSURF_VERTEX.  */
+/*VIV: Start GPU address for gcvSURF_VERTEX.  */
 #define gcdVERTEX_START      (128 << 10)
 
 typedef struct _gcsMMU_STLB *gcsMMU_STLB_PTR;
@@ -726,7 +726,7 @@ _SetupDynamicSpace(
 
     Mmu->pageTableSize = numEntries * 4096;
 
-    Mmu->pageTableEntries = Mmu->pageTableSize / gcmSIZEOF(gctUINT32);
+    gcmkSAFECASTSIZET(Mmu->pageTableEntries, Mmu->pageTableSize / gcmSIZEOF(gctUINT32));
 
     gcmkONERROR(gckOS_Allocate(Mmu->os,
                                Mmu->pageTableSize,
@@ -915,7 +915,7 @@ _Construct(
 
 
         /* Compute number of entries in page table. */
-        mmu->pageTableEntries = mmu->pageTableSize / sizeof(gctUINT32);
+        gcmkSAFECASTSIZET(mmu->pageTableEntries, mmu->pageTableSize / sizeof(gctUINT32));
 
         /* Mark all pages as free. */
         map      = mmu->mapLogical;
@@ -1394,6 +1394,7 @@ _AllocatePages(
     gctUINT32_PTR map;
     gctBOOL gotIt;
     gctUINT32 address;
+    gctUINT32 pageCount;
 
     gcmkHEADER_ARG("Mmu=0x%x PageCount=%lu", Mmu, PageCount);
 
@@ -1408,6 +1409,8 @@ _AllocatePages(
         gcmkONERROR(gcvSTATUS_OUT_OF_RESOURCES);
     }
 
+    gcmkSAFECASTSIZET(pageCount, PageCount);
+
     /* Grab the mutex. */
     gcmkONERROR(gckOS_AcquireMutex(Mmu->os, Mmu->pageTableMutex, gcvINFINITE));
     mutex = gcvTRUE;
@@ -1422,7 +1425,7 @@ _AllocatePages(
             gcmkONERROR(_AdjustIndex(
                 Mmu,
                 index,
-                PageCount,
+                pageCount,
                 gcdVERTEX_START / gcmSIZEOF(gctUINT32),
                 &index
                 ));
@@ -1436,7 +1439,7 @@ _AllocatePages(
             {
             case gcvMMU_SINGLE:
                 /* Single odes are valid if we only need 1 page. */
-                if (PageCount == 1)
+                if (pageCount == 1)
                 {
                     gotIt = gcvTRUE;
                 }
@@ -1450,7 +1453,7 @@ _AllocatePages(
 
             case gcvMMU_FREE:
                 /* Test if the node has enough space. */
-                if (PageCount <= (_ReadPageEntry(&map[index]) >> 8))
+                if (pageCount <= (_ReadPageEntry(&map[index]) >> 8))
                 {
                     gotIt = gcvTRUE;
                 }
@@ -1494,7 +1497,7 @@ _AllocatePages(
 
     case gcvMMU_FREE:
         /* Check how many pages will be left. */
-        left = (_ReadPageEntry(&map[index]) >> 8) - PageCount;
+        left = (_ReadPageEntry(&map[index]) >> 8) - pageCount;
         switch (left)
         {
         case 0:
@@ -1521,7 +1524,7 @@ _AllocatePages(
     }
 
     /* Mark node as used. */
-    gcmkONERROR(_FillPageTable(&map[index], PageCount, gcvMMU_USED));
+    gcmkONERROR(_FillPageTable(&map[index], pageCount, gcvMMU_USED));
 
     /* Return pointer to page table. */
     *PageTable = &Mmu->pageTableLogical[index];
@@ -1599,6 +1602,7 @@ _FreePages(
     gctUINT32_PTR node;
     gceSTATUS status;
     gctBOOL acquired = gcvFALSE;
+    gctUINT32 pageCount;
 
     gcmkHEADER_ARG("Mmu=0x%x PageTable=0x%x PageCount=%lu",
                    Mmu, PageTable, PageCount);
@@ -1608,6 +1612,8 @@ _FreePages(
     gcmkVERIFY_ARGUMENT(PageTable != gcvNULL);
     gcmkVERIFY_ARGUMENT(PageCount > 0);
 
+    gcmkSAFECASTSIZET(pageCount, PageCount);
+
     /* Get the node by index. */
     node = Mmu->mapLogical + ((gctUINT32_PTR)PageTable - Mmu->pageTableLogical);
 
@@ -1617,7 +1623,7 @@ _FreePages(
 #if gcdMMU_CLEAR_VALUE
     if (Mmu->hardware->mmuVersion == 0)
     {
-        _FillPageTable(PageTable, PageCount, gcdMMU_CLEAR_VALUE);
+        _FillPageTable(PageTable, pageCount, gcdMMU_CLEAR_VALUE);
     }
 #endif
 
@@ -1633,12 +1639,12 @@ _FreePages(
     else
     {
         /* Mark the node as free. */
-        _WritePageEntry(node, (PageCount << 8) | gcvMMU_FREE);
+        _WritePageEntry(node, (pageCount << 8) | gcvMMU_FREE);
         _WritePageEntry(node + 1, ~0U);
 
 #if gcdUSE_MMU_EXCEPTION
         /* Enable exception */
-        gcmkVERIFY_OK(_FillPageTable(PageTable, PageCount, 1 << 1));
+        gcmkVERIFY_OK(_FillPageTable(PageTable, pageCount, 1 << 1));
 #endif
     }
 
@@ -1671,7 +1677,7 @@ gckMMU_AllocatePages(
     )
 {
     return gckMMU_AllocatePagesEx(
-                Mmu, PageCount, gcvSURF_UNKNOWN, PageTable, Address);
+                Mmu, PageCount, gcvSURF_TYPE_UNKNOWN, PageTable, Address);
 }
 
 gceSTATUS
@@ -2207,50 +2213,52 @@ OnError:
 
 gceSTATUS
 gckMMU_Flush(
-    IN gckMMU Mmu
+    IN gckMMU Mmu,
+    IN gceSURF_TYPE Type
     )
 {
-#if gcdPROCESS_ADDRESS_SPACE
+    gckHARDWARE hardware;
+    gctUINT32 mask;
     gctINT i;
+
+    if (Type == gcvSURF_VERTEX || Type == gcvSURF_INDEX)
+    {
+        mask = gcvPAGE_TABLE_DIRTY_BIT_FE;
+    }
+    else
+    {
+        mask = gcvPAGE_TABLE_DIRTY_BIT_OTHER;
+    }
+
+#if gcdPROCESS_ADDRESS_SPACE
     for (i = 0; i < gcdMAX_GPU_COUNT; i++)
     {
         gcmkVERIFY_OK(
-            gckOS_AtomSet(Mmu->os, Mmu->pageTableDirty[i], 1));
+            gckOS_AtomSetMask(Mmu->pageTableDirty[i], mask));
     }
 #else
-    gckHARDWARE hardware;
 #if gcdSHARED_PAGETABLE
-    gctINT i;
     for (i = 0; i < gcdMAX_GPU_COUNT; i++)
     {
-#if gcdENABLE_VG
-        if (i == gcvCORE_VG)
-        {
-            continue;
-        }
-#endif
         hardware = sharedPageTable->hardwares[i];
         if (hardware)
         {
-            /* Notify cores who use this page table. */
-            gcmkVERIFY_OK(
-                gckOS_AtomSet(hardware->os, hardware->pageTableDirty, 1));
+            gcmkVERIFY_OK(gckOS_AtomSetMask(hardware->pageTableDirty, mask));
         }
     }
 #elif gcdMIRROR_PAGETABLE
-    gctINT i;
     for (i = 0; i < (gctINT)mirrorPageTable->reference; i++)
     {
         hardware = mirrorPageTable->hardwares[i];
 
         /* Notify cores who use this page table. */
         gcmkVERIFY_OK(
-            gckOS_AtomSet(hardware->os, hardware->pageTableDirty, 1));
+            gckOS_AtomSetMask(hardware->pageTableDirty, mask));
     }
 #else
     hardware = Mmu->hardware;
     gcmkVERIFY_OK(
-        gckOS_AtomSet(hardware->os, hardware->pageTableDirty, 1));
+        gckOS_AtomSetMask(hardware->pageTableDirty, mask));
 #endif
 #endif
 
diff --git a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_mmu_vg.c b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_mmu_vg.c
index 540e353c7dda..3909edda4b56 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_mmu_vg.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_mmu_vg.c
@@ -47,7 +47,7 @@
 */
 gceSTATUS gckVGMMU_Construct(
     IN gckVGKERNEL Kernel,
-    IN gctSIZE_T MmuSize,
+    IN gctUINT32 MmuSize,
     OUT gckVGMMU * Mmu
     )
 {
@@ -108,7 +108,7 @@ gceSTATUS gckVGMMU_Construct(
     }
 
     /* Allocate the page table. */
-    mmu->pageTableSize = MmuSize;
+    mmu->pageTableSize = (gctUINT32)MmuSize;
     status = gckOS_AllocateContiguous(os,
                                       gcvFALSE,
                                       &mmu->pageTableSize,
@@ -134,7 +134,7 @@ gceSTATUS gckVGMMU_Construct(
     }
 
     /* Compute number of entries in page table. */
-    mmu->entryCount = mmu->pageTableSize / sizeof(gctUINT32);
+    mmu->entryCount = (gctUINT32)mmu->pageTableSize / sizeof(gctUINT32);
     mmu->entry = 0;
 
     /* Mark the entire page table as available. */
@@ -314,7 +314,7 @@ gceSTATUS gckVGMMU_AllocatePages(
     }
 
     /* Compute the tail for this allocation. */
-    tail = Mmu->entryCount - PageCount;
+    tail = Mmu->entryCount - (gctUINT32)PageCount;
 
     /* Walk all entries until we find enough slots. */
     for (index = Mmu->entry; index <= tail;)
@@ -396,7 +396,7 @@ gceSTATUS gckVGMMU_AllocatePages(
         if (status >= 0)
         {
             /* Update current entry into page table. */
-            Mmu->entry = index + PageCount;
+            Mmu->entry = index + (gctUINT32)PageCount;
 
             /* Return pointer to page table. */
             *PageTable = (gctUINT32 *)  Mmu->pageTableLogical + index;
diff --git a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_security.c b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_security.c
new file mode 100644
index 000000000000..f9caa17e32d8
--- /dev/null
+++ b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_security.c
@@ -0,0 +1,29 @@
+/****************************************************************************
+*
+*    Copyright (C) 2005 - 2014 by Vivante Corp.
+*
+*    This program is free software; you can redistribute it and/or modify
+*    it under the terms of the GNU General Public License as published by
+*    the Free Software Foundation; either version 2 of the license, or
+*    (at your option) any later version.
+*
+*    This program is distributed in the hope that it will be useful,
+*    but WITHOUT ANY WARRANTY; without even the implied warranty of
+*    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+*    GNU General Public License for more details.
+*
+*    You should have received a copy of the GNU General Public License
+*    along with this program; if not write to the Free Software
+*    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*
+*****************************************************************************/
+
+
+
+#include "gc_hal_kernel_precomp.h"
+
+
+
+
+#define _GC_OBJ_ZONE    gcvZONE_KERNEL
+
diff --git a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_vg.c b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_vg.c
index 942a0a7c2776..2f5107b327a7 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_vg.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_vg.c
@@ -293,7 +293,7 @@ gceSTATUS gckVGKERNEL_Dispatch(
     case gcvHAL_ALLOCATE_NON_PAGED_MEMORY:
         bytes = (gctSIZE_T) kernelInterface->u.AllocateNonPagedMemory.bytes;
         /* Allocate non-paged memory. */
-        gcmkERR_BREAK(gckOS_AllocateContiguous(
+        gcmkERR_BREAK(gckOS_AllocateNonPagedMemory(
             Kernel->os,
             gcvTRUE,
             &bytes,
diff --git a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_video_memory.c b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_video_memory.c
index 43c69eb78503..5b1619a97953 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_video_memory.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_video_memory.c
@@ -409,6 +409,8 @@ gckVIDMEM_Construct(
     gcuVIDMEM_NODE_PTR node;
     gctINT i, banks = 0;
     gctPOINTER pointer = gcvNULL;
+    gctUINT32 heapBytes;
+    gctUINT32 bankSize;
 
     gcmkHEADER_ARG("Os=0x%x BaseAddress=%08x Bytes=%lu Threshold=%lu "
                    "BankSize=%lu",
@@ -419,6 +421,9 @@ gckVIDMEM_Construct(
     gcmkVERIFY_ARGUMENT(Bytes > 0);
     gcmkVERIFY_ARGUMENT(Memory != gcvNULL);
 
+    gcmkSAFECASTSIZET(heapBytes, Bytes);
+    gcmkSAFECASTSIZET(bankSize, BankSize);
+
     /* Allocate the gckVIDMEM object. */
     gcmkONERROR(gckOS_Allocate(Os, gcmSIZEOF(struct _gckVIDMEM), &pointer));
 
@@ -430,8 +435,8 @@ gckVIDMEM_Construct(
 
     /* Set video memory heap information. */
     memory->baseAddress = BaseAddress;
-    memory->bytes       = Bytes;
-    memory->freeBytes   = Bytes;
+    memory->bytes       = heapBytes;
+    memory->freeBytes   = heapBytes;
     memory->threshold   = Threshold;
     memory->mutex       = gcvNULL;
 
@@ -440,22 +445,22 @@ gckVIDMEM_Construct(
     /* Walk all possible banks. */
     for (i = 0; i < gcmCOUNTOF(memory->sentinel); ++i)
     {
-        gctSIZE_T bytes;
+        gctUINT32 bytes;
 
         if (BankSize == 0)
         {
             /* Use all bytes for the first bank. */
-            bytes = Bytes;
+            bytes = heapBytes;
         }
         else
         {
             /* Compute number of bytes for this bank. */
-            bytes = gcmALIGN(BaseAddress + 1, BankSize) - BaseAddress;
+            bytes = gcmALIGN(BaseAddress + 1, bankSize) - BaseAddress;
 
-            if (bytes > Bytes)
+            if (bytes > heapBytes)
             {
                 /* Make sure we don't exceed the total number of bytes. */
-                bytes = Bytes;
+                bytes = heapBytes;
             }
         }
 
@@ -490,15 +495,15 @@ gckVIDMEM_Construct(
 
         node->VidMem.locked    = 0;
 
-#if gcdDYNAMIC_MAP_RESERVED_MEMORY && gcdENABLE_VG
-        node->VidMem.kernelVirtual = gcvNULL;
-#endif
-
 #ifdef __QNXNTO__
         node->VidMem.processID = 0;
         node->VidMem.logical   = gcvNULL;
 #endif
 
+#if gcdDYNAMIC_MAP_RESERVED_MEMORY && gcdENABLE_VG
+        node->VidMem.kernelVirtual = gcvNULL;
+#endif
+
         /* Initialize the linked list of nodes. */
         memory->sentinel[i].VidMem.next     =
         memory->sentinel[i].VidMem.prev     =
@@ -510,7 +515,7 @@ gckVIDMEM_Construct(
 
         /* Adjust address for next bank. */
         BaseAddress += bytes;
-        Bytes       -= bytes;
+        heapBytes       -= bytes;
         banks       ++;
     }
 
@@ -820,8 +825,13 @@ _FindNode(
          node->VidMem.bytes != 0;
          node = node->VidMem.nextFree)
     {
+        gctUINT offset;
+
+        gctINT modulo;
+
+        gcmkSAFECASTSIZET(offset, node->VidMem.offset);
 
-        gctINT modulo = gckMATH_ModuloInt(node->VidMem.offset, *Alignment);
+        modulo = gckMATH_ModuloInt(offset, *Alignment);
 
         /* Compute number of bytes to skip for alignment. */
         alignment = (*Alignment == 0) ? 0 : (*Alignment - modulo);
@@ -867,6 +877,11 @@ OnError:
 **      gceSURF_TYPE Type
 **          Type of surface to allocate (use by bank optimization).
 **
+**      gctBOOL Specified
+**          If user must use this pool, it should set Specified to gcvTRUE,
+**          otherwise allocator may reserve some memory for other usage, such
+**          as small block size allocation request.
+**
 **  OUTPUT:
 **
 **      gcuVIDMEM_NODE_PTR * Node
@@ -879,6 +894,7 @@ gckVIDMEM_AllocateLinear(
     IN gctSIZE_T Bytes,
     IN gctUINT32 Alignment,
     IN gceSURF_TYPE Type,
+    IN gctBOOL Specified,
     OUT gcuVIDMEM_NODE_PTR * Node
     )
 {
@@ -912,6 +928,7 @@ gckVIDMEM_AllocateLinear(
 #if gcdSMALL_BLOCK_SIZE
     if ((Memory->freeBytes < (Memory->bytes/gcdRATIO_FOR_SMALL_MEMORY))
     &&  (Bytes >= gcdSMALL_BLOCK_SIZE)
+    &&  (Specified == gcvFALSE)
     )
     {
         /* The left memory is for small memory.*/
@@ -1283,6 +1300,7 @@ _NeedVirtualMapping(
     gcePOOL pool;
     gctUINT32 offset;
     gctUINT32 baseAddress;
+    gctUINT32 bytes;
 
     gcmkHEADER_ARG("Node=0x%X", Node);
 
@@ -1303,8 +1321,9 @@ _NeedVirtualMapping(
 #endif
         {
             /* Convert logical address into a physical address. */
-            gcmkONERROR(
-                gckOS_GetPhysicalAddress(Kernel->os, Node->Virtual.logical, &phys));
+            gcmkONERROR(gckOS_UserLogicalToPhysical(
+                        Kernel->os, Node->Virtual.logical, &phys
+                        ));
 
             gcmkONERROR(gckOS_GetBaseAddress(Kernel->os, &baseAddress));
 
@@ -1315,7 +1334,8 @@ _NeedVirtualMapping(
 
             /* If part of region is belong to gcvPOOL_VIRTUAL,
             ** whole region has to be mapped. */
-            end = phys + Node->Virtual.bytes - 1;
+            gcmkSAFECASTSIZET(bytes, Node->Virtual.bytes);
+            end = phys + bytes - 1;
 
             gcmkONERROR(gckHARDWARE_SplitMemory(
                         Kernel->hardware, end, &pool, &offset
@@ -1484,6 +1504,8 @@ gckVIDMEM_Lock(
 
     if (Node->VidMem.memory->object.type == gcvOBJ_VIDMEM)
     {
+        gctUINT32 offset;
+
         if (Cacheable == gcvTRUE)
         {
             gcmkONERROR(gcvSTATUS_INVALID_REQUEST);
@@ -1493,8 +1515,10 @@ gckVIDMEM_Lock(
         Node->VidMem.locked ++;
 
         /* Return the physical address of the node. */
+        gcmkSAFECASTSIZET(offset, Node->VidMem.offset);
+
         *Address = Node->VidMem.memory->baseAddress
-                 + Node->VidMem.offset
+                 + offset
                  + Node->VidMem.alignment;
 
         /* Get hardware specific address. */
@@ -1560,15 +1584,19 @@ gckVIDMEM_Lock(
 #if gcdENABLE_VG
                 if (Kernel->vg != gcvNULL)
                 {
-                    gcmkONERROR(gckVGHARDWARE_ConvertLogical(Kernel->vg->hardware,
+                    gcmkONERROR(gckVGHARDWARE_ConvertLogical(
+                                Kernel->vg->hardware,
                                 Node->Virtual.logical,
+                                gcvTRUE,
                                 &Node->Virtual.addresses[Kernel->core]));
                 }
                 else
 #endif
                 {
-                    gcmkONERROR(gckHARDWARE_ConvertLogical(Kernel->hardware,
+                    gcmkONERROR(gckHARDWARE_ConvertLogical(
+                                Kernel->hardware,
                                 Node->Virtual.logical,
+                                gcvTRUE,
                                 &Node->Virtual.addresses[Kernel->core]));
                 }
             }
@@ -1599,22 +1627,12 @@ gckVIDMEM_Lock(
                 Node->Virtual.lockKernels[Kernel->core] = Kernel;
 
                 /* Map the pages. */
-#ifdef __QNXNTO__
                 gcmkONERROR(
                     gckOS_MapPagesEx(os,
                                      Kernel->core,
                                      Node->Virtual.physical,
-                                     Node->Virtual.logical,
                                      Node->Virtual.pageCount,
                                      Node->Virtual.pageTables[Kernel->core]));
-#else
-                gcmkONERROR(
-                    gckOS_MapPagesEx(os,
-                                     Kernel->core,
-                                     Node->Virtual.physical,
-                                     Node->Virtual.pageCount,
-                                     Node->Virtual.pageTables[Kernel->core]));
-#endif
 
 #if gcdENABLE_VG
                 if (Kernel->core == gcvCORE_VG)
@@ -1624,7 +1642,7 @@ gckVIDMEM_Lock(
                 else
 #endif
                 {
-                    gcmkONERROR(gckMMU_Flush(Kernel->mmu));
+                    gcmkONERROR(gckMMU_Flush(Kernel->mmu, Node->Virtual.type));
                 }
             }
             gcmkTRACE_ZONE(gcvLEVEL_INFO, gcvZONE_VIDMEM,
@@ -2120,13 +2138,13 @@ gckVIDMEM_HANDLE_Allocate(
     )
 {
     gceSTATUS status;
-    gctUINT32 processID;
-    gctPOINTER pointer = gcvNULL;
-    gctPOINTER handleDatabase;
-    gctPOINTER mutex;
-    gctUINT32 handle;
+    gctUINT32 processID           = 0;
+    gctPOINTER pointer            = gcvNULL;
+    gctPOINTER handleDatabase     = gcvNULL;
+    gctPOINTER mutex              = gcvNULL;
+    gctUINT32 handle              = 0;
     gckVIDMEM_HANDLE handleObject = gcvNULL;
-    gckOS os = Kernel->os;
+    gckOS os                      = Kernel->os;
 
     gcmkHEADER_ARG("Kernel=0x%X, Node=0x%X", Kernel, Node);
 
@@ -2202,11 +2220,11 @@ gckVIDMEM_HANDLE_Reference(
     )
 {
     gceSTATUS status;
-    gckVIDMEM_HANDLE handleObject;
-    gctPOINTER database;
-    gctPOINTER mutex;
-    gctINT32 oldValue;
-    gctBOOL acquired = gcvFALSE;
+    gckVIDMEM_HANDLE handleObject = gcvNULL;
+    gctPOINTER database           = gcvNULL;
+    gctPOINTER mutex              = gcvNULL;
+    gctINT32 oldValue             = 0;
+    gctBOOL acquired              = gcvFALSE;
 
     gcmkHEADER_ARG("Handle=%d PrcoessID=%d", Handle, ProcessID);
 
@@ -2247,11 +2265,11 @@ gckVIDMEM_HANDLE_Dereference(
     )
 {
     gceSTATUS status;
-    gctPOINTER handleDatabase;
-    gctPOINTER mutex;
-    gctINT32 oldValue;
-    gckVIDMEM_HANDLE handleObject;
-    gctBOOL acquired = gcvFALSE;
+    gctPOINTER handleDatabase     = gcvNULL;
+    gctPOINTER mutex              = gcvNULL;
+    gctINT32 oldValue             = 0;
+    gckVIDMEM_HANDLE handleObject = gcvNULL;
+    gctBOOL acquired              = gcvFALSE;
 
     gcmkHEADER_ARG("Handle=%d PrcoessID=%d", Handle, ProcessID);
 
@@ -2306,12 +2324,12 @@ gckVIDMEM_HANDLE_LookupAndReference(
     )
 {
     gceSTATUS status;
-    gckVIDMEM_HANDLE handleObject;
-    gckVIDMEM_NODE node;
-    gctPOINTER database;
-    gctPOINTER mutex;
-    gctUINT32 processID;
-    gctBOOL acquired = gcvFALSE;
+    gckVIDMEM_HANDLE handleObject = gcvNULL;
+    gckVIDMEM_NODE node           = gcvNULL;
+    gctPOINTER database           = gcvNULL;
+    gctPOINTER mutex              = gcvNULL;
+    gctUINT32 processID           = 0;
+    gctBOOL acquired              = gcvFALSE;
 
     gcmkHEADER_ARG("Kernel=0x%X Handle=%d", Kernel, Handle);
 
@@ -2361,11 +2379,11 @@ gckVIDMEM_HANDLE_Lookup(
     )
 {
     gceSTATUS status;
-    gckVIDMEM_HANDLE handleObject;
-    gckVIDMEM_NODE node;
-    gctPOINTER database;
-    gctPOINTER mutex;
-    gctBOOL acquired = gcvFALSE;
+    gckVIDMEM_HANDLE handleObject = gcvNULL;
+    gckVIDMEM_NODE node           = gcvNULL;
+    gctPOINTER database           = gcvNULL;
+    gctPOINTER mutex              = gcvNULL;
+    gctBOOL acquired              = gcvFALSE;
 
     gcmkHEADER_ARG("Kernel=0x%X ProcessID=%d Handle=%d",
                    Kernel, ProcessID, Handle);
@@ -2430,9 +2448,9 @@ gckVIDMEM_NODE_Allocate(
 {
     gceSTATUS status;
     gckVIDMEM_NODE node = gcvNULL;
-    gctPOINTER pointer = gcvNULL;
-    gctUINT32 handle = 0;
-    gckOS os = Kernel->os;
+    gctPOINTER pointer  = gcvNULL;
+    gctUINT32 handle    = 0;
+    gckOS os            = Kernel->os;
 
     gcmkHEADER_ARG("Kernel=0x%X VideoNode=0x%X", Kernel, VideoNode);
 
@@ -2492,9 +2510,9 @@ gckVIDMEM_NODE_Dereference(
     IN gckVIDMEM_NODE Node
     )
 {
-    gctINT32 oldValue;
+    gctINT32 oldValue   = 0;
     gctPOINTER database = Kernel->db->nameDatabase;
-    gctPOINTER mutex = Kernel->db->nameDatabaseMutex;
+    gctPOINTER mutex    = Kernel->db->nameDatabaseMutex;
 
     gcmkHEADER_ARG("Kernel=0x%X Node=0x%X", Kernel, Node);
 
@@ -2554,12 +2572,12 @@ gckVIDMEM_NODE_Name(
 {
     gceSTATUS status;
     gckVIDMEM_NODE node = gcvNULL;
-    gctUINT32 name;
-    gctUINT32 processID;
+    gctUINT32 name      = 0;
+    gctUINT32 processID = 0;
     gctPOINTER database = Kernel->db->nameDatabase;
-    gctPOINTER mutex = Kernel->db->nameDatabaseMutex;
-    gctBOOL acquired = gcvFALSE;
-    gctBOOL referenced = gcvFALSE;
+    gctPOINTER mutex    = Kernel->db->nameDatabaseMutex;
+    gctBOOL acquired    = gcvFALSE;
+    gctBOOL referenced  = gcvFALSE;
     gcmkHEADER_ARG("Kernel=0x%X Handle=%d", Kernel, Handle);
 
     gcmkONERROR(gckOS_GetProcessID(&processID));
@@ -2582,7 +2600,10 @@ gckVIDMEM_NODE_Name(
 
     gcmkVERIFY_OK(gckVIDMEM_NODE_Dereference(Kernel, node));
 
-    *Name = node->name;
+    if(node)
+    {
+        *Name = node->name;
+    }
 
     gcmkFOOTER_ARG("*Name=%d", *Name);
     return gcvSTATUS_OK;
@@ -2632,9 +2653,9 @@ gckVIDMEM_NODE_Import(
     gceSTATUS status;
     gckVIDMEM_NODE node = gcvNULL;
     gctPOINTER database = Kernel->db->nameDatabase;
-    gctPOINTER mutex = Kernel->db->nameDatabaseMutex;
-    gctBOOL acquired = gcvFALSE;
-    gctBOOL referenced = gcvFALSE;
+    gctPOINTER mutex    = Kernel->db->nameDatabaseMutex;
+    gctBOOL acquired    = gcvFALSE;
+    gctBOOL referenced  = gcvFALSE;
 
     gcmkHEADER_ARG("Kernel=0x%X Name=%d", Kernel, Name);
 
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal.h
index ece4fc6f3d57..83e350ee3bb7 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal.h
@@ -33,6 +33,7 @@
 #include "gc_hal_statistics.h"
 #endif
 
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -84,8 +85,6 @@ extern "C" {
 #define gcmRELEASE_NAME(na) \
         gckKERNEL_DeleteName(kernel, gcmALL_TO_UINT32(na))
 
-#ifdef __LP64__
-
 #define gcmALL_TO_UINT32(t) \
 ( \
     (gctUINT32) (gctUINTPTR_T) (t)\
@@ -93,23 +92,6 @@ extern "C" {
 
 #define gcmPTR_TO_UINT64(p) \
 ( \
-    (gctUINT64) (p)\
-)
-
-#define gcmUINT64_TO_PTR(u) \
-( \
-    (gctPOINTER) (u)\
-)
-
-#else /* 32 bit */
-
-#define gcmALL_TO_UINT32(t) \
-( \
-    (gctUINT32) (t)\
-)
-
-#define gcmPTR_TO_UINT64(p) \
-( \
     (gctUINT64) (gctUINTPTR_T) (p)\
 )
 
@@ -118,8 +100,6 @@ extern "C" {
     (gctPOINTER) (gctUINTPTR_T) (u)\
 )
 
-#endif
-
 #define gcmUINT64_TO_TYPE(u, t) \
 ( \
     (t) (gctUINTPTR_T) (u)\
@@ -396,9 +376,6 @@ gceSTATUS
 gckOS_MapPages(
     IN gckOS Os,
     IN gctPHYS_ADDR Physical,
-#ifdef __QNXNTO__
-    IN gctPOINTER Logical,
-#endif
     IN gctSIZE_T PageCount,
     IN gctPOINTER PageTable
     );
@@ -409,9 +386,6 @@ gckOS_MapPagesEx(
     IN gckOS Os,
     IN gceCORE Core,
     IN gctPHYS_ADDR Physical,
-#ifdef __QNXNTO__
-    IN gctPOINTER Logical,
-#endif
     IN gctSIZE_T PageCount,
 #if gcdPROCESS_ADDRESS_SPACE
     IN gctUINT32 Address,
@@ -489,6 +463,14 @@ gckOS_GetPhysicalAddress(
     OUT gctUINT32 * Address
     );
 
+/* Get the physical address of a corresponding user logical address. */
+gceSTATUS
+gckOS_UserLogicalToPhysical(
+    IN gckOS Os,
+    IN gctPOINTER Logical,
+    OUT gctUINT32 * Address
+    );
+
 /* Get the physical address of a corresponding logical address. */
 gceSTATUS
 gckOS_GetPhysicalAddressProcess(
@@ -663,7 +645,6 @@ gckOS_AtomicExchangePtr(
     OUT gctPOINTER * OldValue
     );
 
-#if gcdSMP
 gceSTATUS
 gckOS_AtomSetMask(
     IN gctPOINTER Atom,
@@ -675,7 +656,6 @@ gckOS_AtomClearMask(
     IN gctPOINTER Atom,
     IN gctUINT32 Mask
     );
-#endif
 
 gceSTATUS
 gckOS_DumpCallStack(
@@ -1086,6 +1066,7 @@ gckOS_GetThreadID(
     OUT gctUINT32_PTR ThreadID
     );
 
+
 /******************************************************************************\
 ********************************** Signal Object *********************************
 \******************************************************************************/
@@ -1609,6 +1590,7 @@ gckVIDMEM_AllocateLinear(
     IN gctSIZE_T Bytes,
     IN gctUINT32 Alignment,
     IN gceSURF_TYPE Type,
+    IN gctBOOL Specified,
     OUT gcuVIDMEM_NODE_PTR * Node
     );
 
@@ -1677,6 +1659,7 @@ typedef enum _gceKERNEL_FLUSH
 #if gcdMULTI_GPU
     gcvFLUSH_L2                 = 0x10,
 #endif
+    gcvFLUSH_TILE_STATUS        = 0x20,
     gcvFLUSH_ALL                = gcvFLUSH_COLOR
                                 | gcvFLUSH_DEPTH
                                 | gcvFLUSH_TEXTURE
@@ -1684,6 +1667,7 @@ typedef enum _gceKERNEL_FLUSH
 #if gcdMULTI_GPU
                                 | gcvFLUSH_L2
 #endif
+                                | gcvFLUSH_TILE_STATUS
 }
 gceKERNEL_FLUSH;
 
@@ -1732,7 +1716,7 @@ gckKERNEL_AllocateLinearMemory(
     IN gctUINT32 ProcessID,
     IN OUT gcePOOL * Pool,
     IN gctSIZE_T Bytes,
-    IN gctSIZE_T Alignment,
+    IN gctUINT32 Alignment,
     IN gceSURF_TYPE Type,
     OUT gctUINT32 * Node
     );
@@ -1949,9 +1933,9 @@ gckHARDWARE_BuildVirtualAddress(
 gceSTATUS
 gckHARDWARE_QueryCommandBuffer(
     IN gckHARDWARE Hardware,
-    OUT gctSIZE_T * Alignment,
-    OUT gctSIZE_T * ReservedHead,
-    OUT gctSIZE_T * ReservedTail
+    OUT gctUINT32 * Alignment,
+    OUT gctUINT32 * ReservedHead,
+    OUT gctUINT32 * ReservedTail
     );
 
 /* Add a WAIT/LINK pair in the command queue. */
@@ -1960,39 +1944,25 @@ gckHARDWARE_WaitLink(
     IN gckHARDWARE Hardware,
     IN gctPOINTER Logical,
     IN gctUINT32 Offset,
-    IN OUT gctSIZE_T * Bytes,
+    IN OUT gctUINT32 * Bytes,
     OUT gctUINT32 * WaitOffset,
-    OUT gctSIZE_T * WaitBytes
+    OUT gctUINT32 * WaitBytes
     );
 
 /* Kickstart the command processor. */
 gceSTATUS
 gckHARDWARE_Execute(
     IN gckHARDWARE Hardware,
-    IN gctPOINTER Logical,
-#ifdef __QNXNTO__
-    IN gctPOINTER Physical,
-    IN gctBOOL PhysicalAddresses,
-#endif
-    IN gctSIZE_T Bytes
-    );
-
-#if gcdPROCESS_ADDRESS_SPACE
-/* Kickstart the command processor with GPU adddress. */
-gceSTATUS
-gckHARDWARE_ExecutePhysical(
-    IN gckHARDWARE Hardware,
-    IN gctUINT32 Physical,
+    IN gctUINT32 Address,
     IN gctSIZE_T Bytes
     );
-#endif
 
 /* Add an END command in the command queue. */
 gceSTATUS
 gckHARDWARE_End(
     IN gckHARDWARE Hardware,
     IN gctPOINTER Logical,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     );
 
 #if gcdMULTI_GPU
@@ -2013,22 +1983,13 @@ gckHARDWARE_Nop(
     IN OUT gctSIZE_T * Bytes
     );
 
-/* Add a WAIT command in the command queue. */
-gceSTATUS
-gckHARDWARE_Wait(
-    IN gckHARDWARE Hardware,
-    IN gctPOINTER Logical,
-    IN gctUINT32 Count,
-    IN OUT gctSIZE_T * Bytes
-    );
-
 /* Add a PIPESELECT command in the command queue. */
 gceSTATUS
 gckHARDWARE_PipeSelect(
     IN gckHARDWARE Hardware,
     IN gctPOINTER Logical,
     IN gcePIPE_SELECT Pipe,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     );
 
 /* Add a LINK command in the command queue. */
@@ -2036,9 +1997,9 @@ gceSTATUS
 gckHARDWARE_Link(
     IN gckHARDWARE Hardware,
     IN gctPOINTER Logical,
-    IN gctPOINTER FetchAddress,
-    IN gctSIZE_T FetchSize,
-    IN OUT gctSIZE_T * Bytes
+    IN gctUINT32 FetchAddress,
+    IN gctUINT32 FetchSize,
+    IN OUT gctUINT32 * Bytes
     );
 
 /* Add an EVENT command in the command queue. */
@@ -2048,7 +2009,7 @@ gckHARDWARE_Event(
     IN gctPOINTER Logical,
     IN gctUINT8 Event,
     IN gceKERNEL_WHERE FromWhere,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     );
 
 /* Query the available memory. */
@@ -2103,19 +2064,10 @@ gceSTATUS
 gckHARDWARE_ConvertLogical(
     IN gckHARDWARE Hardware,
     IN gctPOINTER Logical,
+    IN gctBOOL InUserSpace,
     OUT gctUINT32 * Address
     );
 
-#ifdef __QNXNTO__
-/* Convert physical address to hardware specific address. */
-gceSTATUS
-gckHARDWARE_ConvertPhysical(
-    IN gckHARDWARE Hardware,
-    IN gctPHYS_ADDR Physical,
-    OUT gctUINT32 * Address
-    );
-#endif
-
 /* Interrupt manager. */
 gceSTATUS
 gckHARDWARE_Interrupt(
@@ -2178,7 +2130,7 @@ gckHARDWARE_Flush(
     IN gckHARDWARE Hardware,
     IN gceKERNEL_FLUSH Flush,
     IN gctPOINTER Logical,
-    IN OUT gctSIZE_T * Bytes
+    IN OUT gctUINT32 * Bytes
     );
 
 /* Enable/disable fast clear. */
@@ -2378,6 +2330,16 @@ gckEVENT_Destroy(
     );
 
 /* Reserve the next available hardware event. */
+#if gcdMULTI_GPU
+gceSTATUS
+gckEVENT_GetEvent(
+    IN gckEVENT Event,
+    IN gctBOOL Wait,
+    OUT gctUINT8 * EventID,
+    IN gceKERNEL_WHERE Source,
+    IN gceCORE_3D_MASK ChipEnable
+    );
+#else
 gceSTATUS
 gckEVENT_GetEvent(
     IN gckEVENT Event,
@@ -2385,6 +2347,7 @@ gckEVENT_GetEvent(
     OUT gctUINT8 * EventID,
     IN gceKERNEL_WHERE Source
    );
+#endif
 
 /* Add a new event to the list of events. */
 gceSTATUS
@@ -2591,16 +2554,16 @@ gckCOMMAND_Commit(
 gceSTATUS
 gckCOMMAND_Reserve(
     IN gckCOMMAND Command,
-    IN gctSIZE_T RequestedBytes,
+    IN gctUINT32 RequestedBytes,
     OUT gctPOINTER * Buffer,
-    OUT gctSIZE_T * BufferSize
+    OUT gctUINT32 * BufferSize
     );
 
 /* Execute reserved space in the command buffer. */
 gceSTATUS
 gckCOMMAND_Execute(
     IN gckCOMMAND Command,
-    IN gctSIZE_T RequstedBytes
+    IN gctUINT32 RequstedBytes
     );
 
 /* Stall the command queue. */
@@ -2645,7 +2608,7 @@ gckCOMMAND_DumpExecutingBuffer(
 gceSTATUS
 gckCOMMAND_AddressInKernelCommandBuffer(
     IN gckCOMMAND Command,
-    IN gctPOINTER Logical,
+    IN gctUINT32 Address,
     OUT gctBOOL *In
     );
 
@@ -2713,7 +2676,8 @@ gckMMU_SetPage(
 
 gceSTATUS
 gckMMU_Flush(
-    IN gckMMU Mmu
+    IN gckMMU Mmu,
+    IN gceSURF_TYPE Type
     );
 
 gceSTATUS
@@ -2748,6 +2712,13 @@ gckHARDWARE_UpdateContextProfile(
     );
 #endif
 
+#if VIVANTE_PROFILER_NEW
+gceSTATUS
+gckHARDWARE_InitProfiler(
+    IN gckHARDWARE Hardware
+    );
+#endif
+
 gceSTATUS
 gckOS_SignalQueryHardware(
     IN gckOS Os,
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_base.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_base.h
index 8adfd3d5a2f7..ffeac7e40b44 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_base.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_base.h
@@ -19,7 +19,6 @@
 *****************************************************************************/
 
 
-
 #ifndef __gc_hal_base_h_
 #define __gc_hal_base_h_
 
@@ -81,6 +80,91 @@ typedef struct _gcoOS_SymbolsList gcoOS_SymbolsList;
 
 typedef struct _gcsPLS * gcsPLS_PTR;
 
+#ifndef VIVANTE_NO_3D
+/******************************************************************************
+**
+** Patch defines which should be moved to dedicate file later
+**
+** !!! ALWAYS ADD new ID in the TAIL, otherwise will break exising TRACE FILE
+*******************************************************************************/
+typedef enum _gcePATCH_ID
+{
+    gcvPATCH_INVALID = 0,
+
+#if gcdDEBUG_OPTION
+    gcvPATCH_DEBUG,
+#endif
+
+    gcvPATCH_GTFES30,
+    gcvPATCH_CTGL11,
+    gcvPATCH_CTGL20,
+    gcvPATCH_GLBM11,
+    gcvPATCH_GLBM21,
+    gcvPATCH_GLBM25,
+    gcvPATCH_GLBM27,
+    gcvPATCH_GLBMGUI,
+    gcvPATCH_GFXBENCH,
+    gcvPATCH_ANTUTU,        /* Antutu 3.x */
+    gcvPATCH_ANTUTU4X,      /* Antutu 4.x */
+    gcvPATCH_QUADRANT,
+    gcvPATCH_GPUBENCH,
+    gcvPATCH_DUOKAN,
+    gcvPATCH_GLOFTSXHM,
+    gcvPATCH_XRUNNER,
+    gcvPATCH_BUSPARKING3D,
+    gcvPATCH_SIEGECRAFT,
+    gcvPATCH_PREMIUM,
+    gcvPATCH_RACEILLEGAL,
+    gcvPATCH_MEGARUN,
+    gcvPATCH_BMGUI,
+    gcvPATCH_NENAMARK,
+    gcvPATCH_NENAMARK2,
+    gcvPATCH_FISHNOODLE,
+    gcvPATCH_MM06,
+    gcvPATCH_MM07,
+    gcvPATCH_BM21,
+    gcvPATCH_SMARTBENCH,
+    gcvPATCH_JPCT,
+    gcvPATCH_NEOCORE,
+    gcvPATCH_RTESTVA,
+    gcvPATCH_NBA2013,
+    gcvPATCH_BARDTALE,
+    gcvPATCH_F18,
+    gcvPATCH_CARPARK,
+    gcvPATCH_CARCHALLENGE,
+    gcvPATCH_HEROESCALL,
+    gcvPATCH_GLOFTF3HM,
+    gcvPATCH_CRAZYRACING,
+    gcvPATCH_FIREFOX,
+    gcvPATCH_CHROME,
+    gcvPATCH_MONOPOLY,
+    gcvPATCH_SNOWCOLD,
+    gcvPATCH_BM3,
+    gcvPATCH_BASEMARKX,
+    gcvPATCH_DEQP,
+    gcvPATCH_SF4,
+    gcePATCH_MGOHEAVEN2,
+    gcePATCH_SILIBILI,
+    gcePATCH_ELEMENTSDEF,
+    gcePATCH_GLOFTKRHM,
+    gcvPATCH_OCLCTS,
+    gcvPATCH_A8HP,
+    gcvPATCH_WISTONESG,
+    gcvPATCH_SPEEDRACE,
+    gcvPATCH_FSBHAWAIIF,
+    gcvPATCH_AIRNAVY,
+    gcvPATCH_F18NEW,
+    gcvPATCH_CKZOMBIES2,
+    gcvPATCH_EADGKEEPER,
+    gcvPATCH_BASEMARK2V2,
+    gcvPATCH_RIPTIDEGP2,
+    gcvPATCH_OESCTS,
+    gcvPATCH_GANGSTAR,
+
+    gcvPATCH_COUNT
+} gcePATCH_ID;
+#endif /* VIVANTE_NO_3D */
+
 typedef void (* gctPLS_DESTRUCTOR) (
     gcsPLS_PTR
     );
@@ -129,11 +213,42 @@ typedef struct _gcsPLS
     ** We can use this mutex for every PLS access.
     */
     gctPOINTER                  accessLock;
+#ifndef VIVANTE_NO_3D
+    /* Global patchID to overwrite the detection */
+    gcePATCH_ID                 patchID;
+#endif
 }
 gcsPLS;
 
 extern gcsPLS gcPLS;
 
+#ifndef VIVANTE_NO_3D
+#define gcPLS_INITIALIZER \
+{ \
+    gcvNULL,         /* gcoOS object.      */ \
+    gcvNULL,         /* gcoHAL object.     */ \
+    0,               /* internalSize       */ \
+    gcvNULL,         /* internalPhysical   */ \
+    gcvNULL,         /* internalLogical    */ \
+    0,               /* externalSize       */ \
+    gcvNULL,         /* externalPhysical   */ \
+    gcvNULL,         /* externalLogical    */ \
+    0,               /* contiguousSize     */ \
+    gcvNULL,         /* contiguousPhysical */ \
+    gcvNULL,         /* contiguousLogical  */ \
+    gcvNULL,         /* eglDisplayInfo     */ \
+    gcvNULL,         /* eglSurfaceInfo     */ \
+    gcvSURF_A8R8G8B8,/* eglConfigFormat    */ \
+    gcvNULL,         /* reference          */ \
+    0,               /* processID          */ \
+    0,               /* threadID           */ \
+    gcvFALSE,        /* exiting            */ \
+    gcvFALSE,        /* Special flag for NP2 texture. */ \
+    gcvNULL,         /* destructor        */ \
+    gcvNULL,         /* accessLock        */ \
+    gcvPATCH_INVALID,/* global patchID    */ \
+}
+#else
 #define gcPLS_INITIALIZER \
 { \
     gcvNULL,         /* gcoOS object.      */ \
@@ -157,7 +272,8 @@ extern gcsPLS gcPLS;
     gcvFALSE,        /* Special flag for NP2 texture. */ \
     gcvNULL,         /* destructor        */ \
     gcvNULL,         /* accessLock        */ \
-} \
+}
+#endif
 
 /******************************************************************************\
 ******************************* Thread local storage *************************
@@ -315,86 +431,6 @@ typedef enum _gceSignalHandlerType
 gceSignalHandlerType;
 
 
-
-/**********************************************************************
-**
-** Patch defines which should be moved to dedicate file later
-**
-**********************************************************************/
-
-typedef enum _gcePATCH_ID
-{
-    gcvPATCH_INVALID = 0,
-
-#if gcdDEBUG_OPTION
-    gcvPATCH_DEBUG,
-#endif
-
-    gcvPATCH_GTFES30,
-    gcvPATCH_CTGL11,
-    gcvPATCH_CTGL20,
-    gcvPATCH_GLBM11,
-    gcvPATCH_GLBM21,
-    gcvPATCH_GLBM25,
-    gcvPATCH_GLBM27,
-    gcvPATCH_GLBMGUI,
-    gcvPATCH_GFXBENCH,
-    gcvPATCH_ANTUTU,        /* Antutu 3.x */
-    gcvPATCH_ANTUTU4X,      /* Antutu 4.x */
-    gcvPATCH_QUADRANT,
-    gcvPATCH_GPUBENCH,
-    gcvPATCH_DUOKAN,
-    gcvPATCH_GLOFTSXHM,
-    gcvPATCH_XRUNNER,
-    gcvPATCH_BUSPARKING3D,
-    gcvPATCH_SIEGECRAFT,
-    gcvPATCH_PREMIUM,
-    gcvPATCH_RACEILLEGAL,
-    gcvPATCH_MEGARUN,
-    gcvPATCH_BMGUI,
-    gcvPATCH_NENAMARK,
-    gcvPATCH_NENAMARK2,
-    gcvPATCH_FISHNOODLE,
-    gcvPATCH_MM06,
-    gcvPATCH_MM07,
-    gcvPATCH_BM21,
-    gcvPATCH_SMARTBENCH,
-    gcvPATCH_JPCT,
-    gcvPATCH_NEOCORE,
-    gcvPATCH_RTESTVA,
-    gcvPATCH_NBA2013,
-    gcvPATCH_BARDTALE,
-    gcvPATCH_F18,
-    gcvPATCH_CARPARK,
-    gcvPATCH_CARCHALLENGE,
-    gcvPATCH_HEROESCALL,
-    gcvPATCH_GLOFTF3HM,
-    gcvPATCH_CRAZYRACING,
-    gcvPATCH_FIREFOX,
-    gcvPATCH_CHROME,
-    gcvPATCH_MONOPOLY,
-    gcvPATCH_SNOWCOLD,
-    gcvPATCH_BM3,
-    gcvPATCH_BASEMARKX,
-    gcvPATCH_DEQP,
-    gcvPATCH_SF4,
-    gcePATCH_MGOHEAVEN2,
-    gcePATCH_SILIBILI,
-    gcePATCH_ELEMENTSDEF,
-    gcePATCH_GLOFTKRHM,
-    gcvPATCH_OCLCTS,
-    gcvPATCH_A8HP,
-    gcvPATCH_WISTONESG,
-    gcvPATCH_SPEEDRACE,
-    gcvPATCH_FSBHAWAIIF,
-    gcvPATCH_GOOGLEMAP,
-    gcvPATCH_GOOGLEPLUS,
-
-    gcvPATCH_COUNT
-} gcePATCH_ID;
-
-
-
 #if gcdENABLE_VG
 /* gcsHAL_Limits*/
 typedef struct _gcsHAL_LIMITS
@@ -522,11 +558,13 @@ gcoHAL_Get2DEngine(
     OUT gco2D * Engine
     );
 
+#ifndef VIVANTE_NO_3D
 gceSTATUS
 gcoHAL_GetSpecialHintData(
     IN gcoHAL Hal,
     OUT gctINT * Hint
     );
+#endif
 
 gceSTATUS
 gcoHAL_GetHardware(
@@ -748,6 +786,13 @@ gcoHAL_GetDump(
     OUT gcoDUMP * Dump
     );
 
+#ifndef VIVANTE_NO_3D
+gceSTATUS
+gcoHAL_SetPatchID(
+    IN  gcoHAL Hal,
+    IN  gcePATCH_ID PatchID
+    );
+
 /* Get Patch ID based on process name */
 gceSTATUS
 gcoHAL_GetPatchID(
@@ -755,6 +800,12 @@ gcoHAL_GetPatchID(
     OUT gcePATCH_ID * PatchID
     );
 
+gceSTATUS
+gcoHAL_SetGlobalPatchID(
+    IN  gcoHAL Hal,
+    IN  gcePATCH_ID PatchID
+    );
+#endif /* VIVANTE_NO_3D */
 /* Call the kernel HAL layer. */
 gceSTATUS
 gcoHAL_Call(
@@ -824,7 +875,12 @@ gcoHAL_Query3DCoreCount(
     );
 
 gceSTATUS
-gcoHAL_QuerySeparated3D2D(
+gcoHAL_QuerySeparated2D(
+    IN gcoHAL Hal
+    );
+
+gceSTATUS
+gcoHAL_Is3DAvailable(
     IN gcoHAL Hal
     );
 
@@ -950,13 +1006,6 @@ gcoOS_FreeSharedMemory(
     IN gctPOINTER Memory
     );
 
-/* Schedule to free memory. */
-gceSTATUS
-gcoOS_ScheduleSharedMemory(
-    IN gcoOS Os,
-    IN gctPOINTER Memory
-    );
-
 /* Allocate memory. */
 gceSTATUS
 gcoOS_AllocateMemory(
@@ -2174,7 +2223,7 @@ gcoSURF_QueryVidMemNode(
     IN gcoSURF Surface,
     OUT gctUINT32 * Node,
     OUT gcePOOL * Pool,
-    OUT gctUINT_PTR Bytes
+    OUT gctSIZE_T_PTR Bytes
     );
 
 /* Set the color type of the surface. */
@@ -2359,7 +2408,7 @@ gcoSURF_Unlock(
 gceSTATUS
 gcoSURF_QueryFlags(
     IN gcoSURF Surface,
-    IN gctUINT Flag
+    IN gceSURF_FLAG Flag
     );
 
 /* Return pixel format parameters; Info is required to be a pointer to an
@@ -2418,11 +2467,11 @@ gcoSURF_ConstructWrapper(
     OUT gcoSURF * Surface
     );
 
-/*. Query surface flags.*/
+/* Set surface flags.*/
 gceSTATUS
 gcoSURF_SetFlags(
     IN gcoSURF Surface,
-    IN gctUINT Flag,
+    IN gceSURF_FLAG Flag,
     IN gctBOOL Value
     );
 
@@ -2498,7 +2547,7 @@ gcoSURF_QueryOrientation(
 gceSTATUS
 gcoSURF_SetOffset(
     IN gcoSURF Surface,
-    IN gctUINT Offset
+    IN gctSIZE_T Offset
     );
 
 gceSTATUS
@@ -2528,7 +2577,7 @@ gceSTATUS
 gcoSURF_NODE_CPUCacheOperation(
     IN gcsSURF_NODE_PTR Node,
     IN gceSURF_TYPE Type,
-    IN gctUINT32 Offset,
+    IN gctSIZE_T Offset,
     IN gctSIZE_T Length,
     IN gceCACHEOPERATION Operation
     );
@@ -2823,6 +2872,15 @@ gcoOS_ReplaceDebugFile(
     IN gctFILE fp
     );
 
+void
+gcoOS_SysTraceBegin(
+    IN gctCONST_STRING FuncName
+    );
+
+void
+gcoOS_SysTraceEnd(
+    IN void);
+
 /*******************************************************************************
 **
 **  gcmFATAL
@@ -3205,6 +3263,9 @@ gcsBINARY_TRACE_MESSAGE;
 
 #define gcdHEADER_LEVEL             gcvLEVEL_VERBOSE
 
+#ifndef gcdEMPTY_HEADER_FOOTER
+#define gcdEMPTY_HEADER_FOOTER 0
+#endif
 
 #if gcdENABLE_PROFILING
 void
@@ -3240,6 +3301,8 @@ gcoOS_ProfileDB(
 
 #ifdef gcdFSL_REL_BUILD
 #define gcmHEADER()
+#elif gcdEMPTY_HEADER_FOOTER
+#   define gcmHEADER()
 #elif gcdHAS_ELLIPSIS
 #define gcmHEADER() \
     gctINT8 __user__ = 1; \
@@ -3259,6 +3322,9 @@ gcoOS_ProfileDB(
 #ifdef gcdFSL_REL_BUILD
 #define gcmHEADER_ARG(Text, ...)
 #elif gcdHAS_ELLIPSIS
+#if gcdEMPTY_HEADER_FOOTER
+#   define gcmHEADER_ARG(Text, ...)
+#else
 #   define gcmHEADER_ARG(Text, ...) \
         gctINT8 __user__ = 1; \
         gctINT8_PTR __user_ptr__ = &__user__; \
@@ -3266,6 +3332,7 @@ gcoOS_ProfileDB(
         gcmBINARY_TRACE(__FUNCTION__, __LINE__, Text, __VA_ARGS__); \
         gcmTRACE_ZONE(gcdHEADER_LEVEL, _GC_OBJ_ZONE, \
                       "++%s(%d): " Text, __FUNCTION__, __LINE__, __VA_ARGS__)
+#endif
 #else
     gcmINLINE static void
     __dummy_header_arg(
@@ -3279,6 +3346,8 @@ gcoOS_ProfileDB(
 
 #ifdef gcdFSL_REL_BUILD
 #   define gcmFOOTER()
+#elif gcdEMPTY_HEADER_FOOTER
+#   define gcmFOOTER()
 #elif gcdHAS_ELLIPSIS
 #   define gcmFOOTER() \
     gcmSTACK_POP(__user_ptr__, __FUNCTION__); \
@@ -3298,6 +3367,8 @@ gcoOS_ProfileDB(
 
 #ifdef gcdFSL_REL_BUILD
 #define gcmFOOTER_NO()
+#elif gcdEMPTY_HEADER_FOOTER
+#   define gcmFOOTER_NO()
 #elif gcdHAS_ELLIPSIS
 #define gcmFOOTER_NO() \
     gcmSTACK_POP(__user_ptr__, __FUNCTION__); \
@@ -3315,6 +3386,8 @@ gcoOS_ProfileDB(
 
 #ifdef gcdFSL_REL_BUILD
 #define gcmFOOTER_KILL()
+#elif gcdEMPTY_HEADER_FOOTER
+#   define gcmFOOTER_KILL()
 #elif gcdHAS_ELLIPSIS
 #define gcmFOOTER_KILL() \
     gcmSTACK_POP(__user_ptr__, __FUNCTION__); \
@@ -3333,12 +3406,16 @@ gcoOS_ProfileDB(
 #ifdef gcdFSL_REL_BUILD
 #   define gcmFOOTER_ARG(Text, ...)
 #elif gcdHAS_ELLIPSIS
+#if gcdEMPTY_HEADER_FOOTER
+#   define gcmFOOTER_ARG(Text, ...)
+#else
 #   define gcmFOOTER_ARG(Text, ...) \
         gcmSTACK_POP(__user_ptr__, __FUNCTION__); \
         gcmBINARY_TRACE(__FUNCTION__, __LINE__, Text, __VA_ARGS__); \
         gcmTRACE_ZONE(gcdHEADER_LEVEL, _GC_OBJ_ZONE, \
                       "--%s(%d): " Text, __FUNCTION__, __LINE__, __VA_ARGS__); \
         *__user_ptr__ -= 1
+#endif
 #else
     gcmINLINE static void
     __dummy_footer_arg(
@@ -4223,6 +4300,50 @@ gckOS_DebugStatus2Name(
 
 /*******************************************************************************
 **
+**  gcmkSAFECASTSIZET
+**
+**      Check wether value of a gctSIZE_T varible beyond the capability
+**      of 32bits GPU hardware.
+**
+**  ASSUMPTIONS:
+**
+**
+**
+**  ARGUMENTS:
+**
+**      x   A gctUINT32 variable
+**      y   A gctSIZE_T variable
+*/
+#define gcmkSAFECASTSIZET(x, y) \
+    do \
+    { \
+        if (gcmSIZEOF(gctSIZE_T) > gcmSIZEOF(gctUINT32)) \
+        { \
+            if (y) \
+            { \
+                gcmkASSERT((y) <= gcvMAXUINT32); \
+            } \
+        } \
+        (x) = (gctUINT32)(y); \
+    } \
+    while (gcvFALSE)
+
+#define gcmSAFECASTSIZET(x, y) \
+    do \
+    { \
+        if (gcmSIZEOF(gctSIZE_T) > gcmSIZEOF(gctUINT32)) \
+        { \
+            if (y) \
+            { \
+                gcmASSERT((y) <= gcvMAXUINT32); \
+            } \
+        } \
+        (x) = (gctUINT32)(y); \
+    } \
+    while (gcvFALSE)
+
+/*******************************************************************************
+**
 **  gcmVERIFY_LOCK
 **
 **      Verifies whether the surface is locked.
@@ -4422,7 +4543,9 @@ gcGetUserDebugOption(
 #if defined(ANDROID)
 struct _gcoOS_SymbolsList
 {
+#ifndef VIVANTE_NO_3D
     gcePATCH_ID patchId;
+#endif
     const char * symList[10];
 };
 #endif
@@ -4445,6 +4568,641 @@ struct _gcoOS_SymbolsList
 #define gcmUSER_DEBUG_WARNING_MSG
 #endif
 
+/*******************************************************************************
+**
+**  A set of macros to aid state loading.
+**
+**  ARGUMENTS:
+**
+**      CommandBuffer   Pointer to a gcoCMDBUF object.
+**      StateDelta      Pointer to a gcsSTATE_DELTA state delta structure.
+**      Memory          Destination memory pointer of gctUINT32_PTR type.
+**      PartOfContext   Whether or not the state is a part of the context.
+**      FixedPoint      Whether or not the state is of the fixed point format.
+**      Count           Number of consecutive states to be loaded.
+**      Address         State address.
+**      Data            Data to be set to the state.
+*/
+
+/*----------------------------------------------------------------------------*/
+
+#if gcmIS_DEBUG(gcdDEBUG_CODE)
+
+#   define gcmSTORELOADSTATE(CommandBuffer, Memory, Address, Count) \
+        CommandBuffer->lastLoadStatePtr     = gcmPTR_TO_UINT64(Memory); \
+        CommandBuffer->lastLoadStateAddress = Address; \
+        CommandBuffer->lastLoadStateCount   = Count
+
+#   define gcmVERIFYLOADSTATE(CommandBuffer, Memory, Address) \
+        gcmASSERT( \
+            (gctUINT) (Memory  - gcmUINT64_TO_TYPE(CommandBuffer->lastLoadStatePtr, gctUINT32_PTR) - 1) \
+            == \
+            (gctUINT) (Address - CommandBuffer->lastLoadStateAddress) \
+            ); \
+        \
+        gcmASSERT(CommandBuffer->lastLoadStateCount > 0); \
+        \
+        CommandBuffer->lastLoadStateCount -= 1
+
+#   define gcmVERIFYLOADSTATEDONE(CommandBuffer) \
+        gcmASSERT(CommandBuffer->lastLoadStateCount == 0);
+
+#   define gcmDEFINELOADSTATEBASE() \
+        gctUINT32_PTR LoadStateBase;
+
+#   define gcmSETLOADSTATEBASE(CommandBuffer, OutSide) \
+        if (OutSide) \
+        {\
+            LoadStateBase = (gctUINT32_PTR)*OutSide; \
+        }\
+        else\
+        {\
+            LoadStateBase = (gctUINT_PTR)CommandBuffer->buffer;\
+        }
+
+
+#   define gcmVERIFYLOADSTATEALIGNED(CommandBuffer, Memory) \
+        gcmASSERT(((Memory - LoadStateBase) & 1) == 0);
+
+#   define gcmUNSETLOADSTATEBASE() \
+        LoadStateBase = LoadStateBase;
+
+#else
+
+#   define gcmSTORELOADSTATE(CommandBuffer, Memory, Address, Count)
+#   define gcmVERIFYLOADSTATE(CommandBuffer, Memory, Address)
+#   define gcmVERIFYLOADSTATEDONE(CommandBuffer)
+
+#   define gcmDEFINELOADSTATEBASE()
+#   define gcmSETLOADSTATEBASE(CommandBuffer, OutSide)
+#   define gcmVERIFYLOADSTATEALIGNED(CommandBuffer, Memory)
+#   define gcmUNSETLOADSTATEBASE()
+
+#endif
+
+#if gcdSECURE_USER
+
+#   define gcmDEFINESECUREUSER() \
+        gctUINT         __secure_user_offset__; \
+        gctUINT32_PTR   __secure_user_hintArray__;
+
+#   define gcmBEGINSECUREUSER() \
+        __secure_user_offset__ = reserve->lastOffset; \
+        \
+        __secure_user_hintArray__ = gcmUINT64_TO_PTR(reserve->hintArrayTail)
+
+#   define gcmENDSECUREUSER() \
+        reserve->hintArrayTail = gcmPTR_TO_UINT64(__secure_user_hintArray__)
+
+#   define gcmSKIPSECUREUSER() \
+        __secure_user_offset__ += gcmSIZEOF(gctUINT32)
+
+#   define gcmUPDATESECUREUSER() \
+        *__secure_user_hintArray__ = __secure_user_offset__; \
+        \
+        __secure_user_offset__    += gcmSIZEOF(gctUINT32); \
+        __secure_user_hintArray__ += 1
+
+#else
+
+#   define gcmDEFINESECUREUSER()
+#   define gcmBEGINSECUREUSER()
+#   define gcmENDSECUREUSER()
+#   define gcmSKIPSECUREUSER()
+#   define gcmUPDATESECUREUSER()
+
+#endif
+
+/*----------------------------------------------------------------------------*/
+
+#if gcdDUMP
+#   define gcmDUMPSTATEDATA(StateDelta, FixedPoint, Address, Data) \
+        if (FixedPoint) \
+        { \
+            gcmDUMP(gcvNULL, "#[state.x 0x%04X 0x%08X]", \
+                Address, Data \
+                ); \
+        } \
+        else \
+        { \
+            gcmDUMP(gcvNULL, "#[state 0x%04X 0x%08X]", \
+                Address, Data \
+                ); \
+        }
+#else
+#   define gcmDUMPSTATEDATA(StateDelta, FixedPoint, Address, Data)
+#endif
+
+#define gcmDEFINESTATEBUFFER(CommandBuffer, StateDelta, Memory, ReserveSize) \
+    gcmDEFINESECUREUSER() \
+    gctSIZE_T ReserveSize; \
+    gcoCMDBUF CommandBuffer; \
+    gctUINT32_PTR Memory; \
+    gcsSTATE_DELTA_PTR StateDelta
+
+#define gcmBEGINSTATEBUFFER(Hardware, CommandBuffer, StateDelta, Memory, ReserveSize) \
+{ \
+    gcmONERROR(gcoBUFFER_Reserve( \
+        Hardware->buffer, ReserveSize, gcvTRUE, &CommandBuffer \
+        )); \
+    \
+    Memory = (gctUINT32_PTR) gcmUINT64_TO_PTR(CommandBuffer->lastReserve); \
+    \
+    StateDelta = Hardware->delta; \
+    \
+    gcmBEGINSECUREUSER(); \
+}
+
+#define gcmENDSTATEBUFFER(Hardware, CommandBuffer, Memory, ReserveSize) \
+{ \
+    gcmENDSECUREUSER(); \
+    \
+    gcmASSERT( \
+        gcmUINT64_TO_TYPE(CommandBuffer->lastReserve, gctUINT8_PTR) + ReserveSize \
+        == \
+         (gctUINT8_PTR) Memory \
+        ); \
+}
+
+/*----------------------------------------------------------------------------*/
+
+#define gcmBEGINSTATEBATCH(CommandBuffer, Memory, FixedPoint, Address, Count) \
+{ \
+    gcmASSERT(((Memory - gcmUINT64_TO_TYPE(CommandBuffer->lastReserve, gctUINT32_PTR)) & 1) == 0); \
+    gcmASSERT((gctUINT32)Count <= 1024); \
+    \
+    gcmVERIFYLOADSTATEDONE(CommandBuffer); \
+    \
+    gcmSTORELOADSTATE(CommandBuffer, Memory, Address, Count); \
+    \
+    *Memory++ \
+        = gcmSETFIELDVALUE(0, AQ_COMMAND_LOAD_STATE_COMMAND, OPCODE,  LOAD_STATE) \
+        | gcmSETFIELD     (0, AQ_COMMAND_LOAD_STATE_COMMAND, FLOAT,   FixedPoint) \
+        | gcmSETFIELD     (0, AQ_COMMAND_LOAD_STATE_COMMAND, COUNT,   Count) \
+        | gcmSETFIELD     (0, AQ_COMMAND_LOAD_STATE_COMMAND, ADDRESS, Address); \
+    \
+    gcmSKIPSECUREUSER(); \
+}
+
+#define gcmENDSTATEBATCH(CommandBuffer, Memory) \
+{ \
+    gcmVERIFYLOADSTATEDONE(CommandBuffer); \
+    \
+    gcmASSERT(((Memory - gcmUINT64_TO_TYPE(CommandBuffer->lastReserve, gctUINT32_PTR)) & 1) == 0); \
+}
+
+/*----------------------------------------------------------------------------*/
+
+#define gcmSETSTATEDATA(StateDelta, CommandBuffer, Memory, FixedPoint, \
+                        Address, Data) \
+{ \
+    gctUINT32 __temp_data32__; \
+    \
+    gcmVERIFYLOADSTATE(CommandBuffer, Memory, Address); \
+    \
+    gcmSAFECASTSIZET(__temp_data32__, Data); \
+    \
+    *Memory++ = __temp_data32__; \
+    \
+    gcoHARDWARE_UpdateDelta( \
+        StateDelta, FixedPoint, Address, 0, __temp_data32__ \
+        ); \
+    \
+    gcmDUMPSTATEDATA(StateDelta, FixedPoint, Address, __temp_data32__); \
+    \
+    gcmUPDATESECUREUSER(); \
+}
+
+#define gcmSETSTATEDATAWITHMASK(StateDelta, CommandBuffer, Memory, FixedPoint, \
+                        Address, Mask, Data) \
+{ \
+    gctUINT32 __temp_data32__; \
+    \
+    gcmVERIFYLOADSTATE(CommandBuffer, Memory, Address); \
+    \
+    __temp_data32__ = Data; \
+    \
+    *Memory++ = __temp_data32__; \
+    \
+    gcoHARDWARE_UpdateDelta( \
+        StateDelta, FixedPoint, Address, Mask, __temp_data32__ \
+        ); \
+    \
+    gcmDUMPSTATEDATA(StateDelta, FixedPoint, Address, __temp_data32__); \
+    \
+    gcmUPDATESECUREUSER(); \
+}
+
+
+#define gcmSETCTRLSTATE(StateDelta, CommandBuffer, Memory, Address, Data) \
+{ \
+    gctUINT32 __temp_data32__; \
+    \
+    gcmVERIFYLOADSTATE(CommandBuffer, Memory, Address); \
+    \
+    __temp_data32__ = Data; \
+    \
+    *Memory++ = __temp_data32__; \
+    \
+    gcmDUMPSTATEDATA(StateDelta, gcvFALSE, Address, __temp_data32__); \
+    \
+    gcmSKIPSECUREUSER(); \
+}
+
+#define gcmSETFILLER(CommandBuffer, Memory) \
+{ \
+    gcmVERIFYLOADSTATEDONE(CommandBuffer); \
+    \
+    Memory += 1; \
+    \
+    gcmSKIPSECUREUSER(); \
+}
+
+/*----------------------------------------------------------------------------*/
+
+#define gcmSETSINGLESTATE(StateDelta, CommandBuffer, Memory, FixedPoint, \
+                          Address, Data) \
+{ \
+    gcmBEGINSTATEBATCH(CommandBuffer, Memory, FixedPoint, Address, 1); \
+    gcmSETSTATEDATA(StateDelta, CommandBuffer, Memory, FixedPoint, \
+                    Address, Data); \
+    gcmENDSTATEBATCH(CommandBuffer, Memory); \
+}
+
+#define gcmSETSINGLESTATEWITHMASK(StateDelta, CommandBuffer, Memory, FixedPoint, \
+                          Address, Mask, Data) \
+{ \
+    gcmBEGINSTATEBATCH(CommandBuffer, Memory, FixedPoint, Address, 1); \
+    gcmSETSTATEDATAWITHMASK(StateDelta, CommandBuffer, Memory, FixedPoint, \
+                    Address, Mask, Data); \
+    gcmENDSTATEBATCH(CommandBuffer, Memory); \
+}
+
+
+#define gcmSETSINGLECTRLSTATE(StateDelta, CommandBuffer, Memory, FixedPoint, \
+                              Address, Data) \
+{ \
+    gcmBEGINSTATEBATCH(CommandBuffer, Memory, FixedPoint, Address, 1); \
+    gcmSETCTRLSTATE(StateDelta, CommandBuffer, Memory, Address, Data); \
+    gcmENDSTATEBATCH(CommandBuffer, Memory); \
+}
+
+
+
+#define gcmSETSEMASTALLPIPE(StateDelta, CommandBuffer, Memory, Data) \
+{ \
+    gcmSETSINGLESTATE(StateDelta, CommandBuffer, Memory, gcvFALSE, AQSemaphoreRegAddrs, Data); \
+    \
+    *Memory++ = gcmSETFIELDVALUE(0, STALL_COMMAND, OPCODE, STALL); \
+    \
+    *Memory++ = Data; \
+    \
+    gcmDUMP(gcvNULL, "#[stall 0x%08X 0x%08X]", \
+        gcmSETFIELDVALUE(0, AQ_SEMAPHORE, SOURCE, FRONT_END), \
+        gcmSETFIELDVALUE(0, AQ_SEMAPHORE, DESTINATION, PIXEL_ENGINE)); \
+    \
+    gcmSKIPSECUREUSER(); \
+}
+
+/*******************************************************************************
+**
+**  gcmSETSTARTDECOMMAND
+**
+**      Form a START_DE command.
+**
+**  ARGUMENTS:
+**
+**      Memory          Destination memory pointer of gctUINT32_PTR type.
+**      Count           Number of the rectangles.
+*/
+
+#define gcmSETSTARTDECOMMAND(Memory, Count) \
+{ \
+    *Memory++ \
+        = gcmSETFIELDVALUE(0, AQ_COMMAND_START_DE_COMMAND, OPCODE,     START_DE) \
+        | gcmSETFIELD     (0, AQ_COMMAND_START_DE_COMMAND, COUNT,      Count) \
+        | gcmSETFIELD     (0, AQ_COMMAND_START_DE_COMMAND, DATA_COUNT, 0); \
+    \
+    *Memory++ = 0xDEADDEED; \
+}
+
+/*****************************************
+** Temp command buffer macro
+*/
+#define gcmDEFINESTATEBUFFER_NEW(CommandBuffer, StateDelta, Memory) \
+    gcmDEFINESECUREUSER() \
+    gcmDEFINELOADSTATEBASE() \
+    gcsTEMPCMDBUF CommandBuffer = gcvNULL; \
+    gctUINT32_PTR Memory; \
+    gcsSTATE_DELTA_PTR StateDelta
+
+
+#define gcmBEGINSTATEBUFFER_NEW(Hardware, CommandBuffer, StateDelta, Memory, OutSide) \
+{ \
+    if (OutSide) \
+    {\
+        Memory = (gctUINT32_PTR)*OutSide; \
+    }\
+    else \
+    {\
+        gcmONERROR(gcoBUFFER_StartTEMPCMDBUF( \
+            Hardware->buffer, &CommandBuffer \
+            ));\
+        \
+        Memory = (gctUINT32_PTR)(CommandBuffer->buffer); \
+        \
+    }\
+    StateDelta = Hardware->delta; \
+    \
+    gcmBEGINSECUREUSER(); \
+    gcmSETLOADSTATEBASE(CommandBuffer,OutSide);\
+}
+
+#define gcmENDSTATEBUFFER_NEW(Hardware, CommandBuffer, Memory, OutSide) \
+{ \
+    gcmENDSECUREUSER(); \
+    \
+    if (OutSide) \
+    {\
+        *OutSide = Memory; \
+    }\
+    else \
+    {\
+        CommandBuffer->currentByteSize = (gctUINT32)((gctUINT8_PTR)Memory -  \
+                                         (gctUINT8_PTR)CommandBuffer->buffer); \
+        \
+        gcmONERROR(gcoBUFFER_EndTEMPCMDBUF(Hardware->buffer));\
+    }\
+    gcmUNSETLOADSTATEBASE()\
+}
+
+/*----------------------------------------------------------------------------*/
+
+#define gcmBEGINSTATEBATCH_NEW(CommandBuffer, Memory, FixedPoint, Address, Count) \
+{ \
+    gcmVERIFYLOADSTATEALIGNED(CommandBuffer,Memory);\
+    gcmASSERT((gctUINT32)Count <= 1024); \
+    \
+    *Memory++ \
+        = gcmSETFIELDVALUE(0, AQ_COMMAND_LOAD_STATE_COMMAND, OPCODE,  LOAD_STATE) \
+        | gcmSETFIELD     (0, AQ_COMMAND_LOAD_STATE_COMMAND, FLOAT,   FixedPoint) \
+        | gcmSETFIELD     (0, AQ_COMMAND_LOAD_STATE_COMMAND, COUNT,   Count) \
+        | gcmSETFIELD     (0, AQ_COMMAND_LOAD_STATE_COMMAND, ADDRESS, Address); \
+    \
+    gcmSKIPSECUREUSER(); \
+}
+
+#define gcmENDSTATEBATCH_NEW(CommandBuffer, Memory) \
+    gcmVERIFYLOADSTATEALIGNED(CommandBuffer,Memory);
+
+/*----------------------------------------------------------------------------*/
+
+#define gcmSETSTATEDATA_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
+                        Address, Data) \
+{ \
+    gctUINT32 __temp_data32__; \
+    \
+    __temp_data32__ = Data; \
+    \
+    *Memory++ = __temp_data32__; \
+    \
+    gcoHARDWARE_UpdateDelta( \
+        StateDelta, FixedPoint, Address, 0, __temp_data32__ \
+        ); \
+    \
+    gcmDUMPSTATEDATA(StateDelta, FixedPoint, Address, __temp_data32__); \
+    \
+    gcmUPDATESECUREUSER(); \
+}
+
+#define gcmSETSTATEDATAWITHMASK_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
+                                Address, Mask, Data) \
+{ \
+    gctUINT32 __temp_data32__; \
+    \
+    __temp_data32__ = Data; \
+    \
+    *Memory++ = __temp_data32__; \
+    \
+    gcoHARDWARE_UpdateDelta( \
+        StateDelta, FixedPoint, Address, Mask, __temp_data32__ \
+        ); \
+    \
+    gcmDUMPSTATEDATA(StateDelta, FixedPoint, Address, __temp_data32__); \
+    \
+    gcmUPDATESECUREUSER(); \
+}
+
+
+#define gcmSETCTRLSTATE_NEW(StateDelta, CommandBuffer, Memory, Address, Data) \
+{ \
+    gctUINT32 __temp_data32__; \
+    \
+    __temp_data32__ = Data; \
+    \
+    *Memory++ = __temp_data32__; \
+    \
+    gcmDUMPSTATEDATA(StateDelta, gcvFALSE, Address, __temp_data32__); \
+    \
+    gcmSKIPSECUREUSER(); \
+}
+
+#define gcmSETFILLER_NEW(CommandBuffer, Memory) \
+{ \
+    Memory += 1; \
+    \
+    gcmSKIPSECUREUSER(); \
+}
+
+/*----------------------------------------------------------------------------*/
+
+#define gcmSETSINGLESTATE_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
+                              Address, Data) \
+{ \
+    gcmBEGINSTATEBATCH_NEW(CommandBuffer, Memory, FixedPoint, Address, 1); \
+    gcmSETSTATEDATA_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
+                    Address, Data); \
+    gcmENDSTATEBATCH_NEW(CommandBuffer, Memory); \
+}
+
+#define gcmSETSINGLESTATEWITHMASK_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
+                                      Address, Mask, Data) \
+{ \
+    gcmBEGINSTATEBATCH_NEW(CommandBuffer, Memory, FixedPoint, Address, 1); \
+    gcmSETSTATEDATAWITHMASK_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
+                    Address, Mask, Data); \
+    gcmENDSTATEBATCH_NEW(CommandBuffer, Memory); \
+}
+
+
+#define gcmSETSINGLECTRLSTATE_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
+                              Address, Data) \
+{ \
+    gcmBEGINSTATEBATCH_NEW(CommandBuffer, Memory, FixedPoint, Address, 1); \
+    gcmSETCTRLSTATE_NEW(StateDelta, CommandBuffer, Memory, Address, Data); \
+    gcmENDSTATEBATCH_NEW(CommandBuffer, Memory); \
+}
+
+
+
+#define gcmSETSEMASTALLPIPE_NEW(StateDelta, CommandBuffer, Memory, Data) \
+{ \
+    gcmSETSINGLESTATE_NEW(StateDelta, CommandBuffer, Memory, gcvFALSE, AQSemaphoreRegAddrs, Data); \
+    \
+    *Memory++ = gcmSETFIELDVALUE(0, STALL_COMMAND, OPCODE, STALL); \
+    \
+    *Memory++ = Data; \
+    \
+    gcmDUMP(gcvNULL, "#[stall 0x%08X 0x%08X]", \
+        gcmSETFIELDVALUE(0, AQ_SEMAPHORE, SOURCE, FRONT_END), \
+        gcmSETFIELDVALUE(0, AQ_SEMAPHORE, DESTINATION, PIXEL_ENGINE)); \
+    \
+    gcmSKIPSECUREUSER(); \
+}
+
+#define gcmSETSTARTDECOMMAND_NEW(CommandBuffer, Memory, Count) \
+{ \
+    *Memory++ \
+        = gcmSETFIELDVALUE(0, AQ_COMMAND_START_DE_COMMAND, OPCODE,     START_DE) \
+        | gcmSETFIELD     (0, AQ_COMMAND_START_DE_COMMAND, COUNT,      Count) \
+        | gcmSETFIELD     (0, AQ_COMMAND_START_DE_COMMAND, DATA_COUNT, 0); \
+    \
+    *Memory++ = 0xDEADDEED; \
+    \
+}
+
+/*******************************************************************************
+**
+**  gcmCONFIGUREUNIFORMS
+**
+**      Configure uniforms according to chip and numConstants.
+*/
+#define gcmCONFIGUREUNIFORMS(ChipModel, ChipRevision, NumConstants, \
+             UnifiedConst, VsConstBase, PsConstBase, VsConstMax, PsConstMax, ConstMax) \
+{ \
+    if (ChipModel == gcv2000 && ChipRevision == 0x5118) \
+    { \
+        UnifiedConst = gcvFALSE; \
+        VsConstBase  = AQVertexShaderConstRegAddrs; \
+        PsConstBase  = AQPixelShaderConstRegAddrs; \
+        VsConstMax   = 256; \
+        PsConstMax   = 64; \
+        ConstMax     = 320; \
+    } \
+    else if (NumConstants == 320) \
+    { \
+        UnifiedConst = gcvFALSE; \
+        VsConstBase  = AQVertexShaderConstRegAddrs; \
+        PsConstBase  = AQPixelShaderConstRegAddrs; \
+        VsConstMax   = 256; \
+        PsConstMax   = 64; \
+        ConstMax     = 320; \
+    } \
+    /* All GC1000 series chips can only support 64 uniforms for ps on non-unified const mode. */ \
+    else if (NumConstants > 256 && ChipModel == gcv1000) \
+    { \
+        UnifiedConst = gcvFALSE; \
+        VsConstBase  = AQVertexShaderConstRegAddrs; \
+        PsConstBase  = AQPixelShaderConstRegAddrs; \
+        VsConstMax   = 256; \
+        PsConstMax   = 64; \
+        ConstMax     = 320; \
+    } \
+    else if (NumConstants > 256) \
+    { \
+        UnifiedConst = gcvFALSE; \
+        VsConstBase  = AQVertexShaderConstRegAddrs; \
+        PsConstBase  = AQPixelShaderConstRegAddrs; \
+        VsConstMax   = 256; \
+        PsConstMax   = 256; \
+        ConstMax     = 512; \
+    } \
+    else if (NumConstants == 256) \
+    { \
+        UnifiedConst = gcvFALSE; \
+        VsConstBase  = AQVertexShaderConstRegAddrs; \
+        PsConstBase  = AQPixelShaderConstRegAddrs; \
+        VsConstMax   = 256; \
+        PsConstMax   = 256; \
+        ConstMax     = 512; \
+    } \
+    else \
+    { \
+        UnifiedConst = gcvFALSE; \
+        VsConstBase  = AQVertexShaderConstRegAddrs; \
+        PsConstBase  = AQPixelShaderConstRegAddrs; \
+        VsConstMax   = 168; \
+        PsConstMax   = 64; \
+        ConstMax     = 232; \
+    } \
+}
+
+/*******************************************************************************
+**
+**  gcmGET_UNIFORM_INFO_FOR_NONUNIFIEDMODE
+**
+**      Configure uniforms according to chip and numConstants.
+*/
+#define gcmGET_UNIFORM_INFO_FOR_NONUNIFIEDMODE(ChipModel, ChipRevision, NumConstants, \
+             UnifiedConst, VsConstBase, PsConstBase, VsConstMax, PsConstMax, ConstMax) \
+{ \
+    if (ChipModel == gcv2000 && ChipRevision == 0x5118) \
+    { \
+        UnifiedConst = gcvFALSE; \
+        VsConstBase  = AQVertexShaderConstRegAddrs; \
+        PsConstBase  = AQPixelShaderConstRegAddrs; \
+        VsConstMax   = 256; \
+        PsConstMax   = 64; \
+        ConstMax     = 320; \
+    } \
+    else if (NumConstants == 320) \
+    { \
+        UnifiedConst = gcvFALSE; \
+        VsConstBase  = AQVertexShaderConstRegAddrs; \
+        PsConstBase  = AQPixelShaderConstRegAddrs; \
+        VsConstMax   = 256; \
+        PsConstMax   = 64; \
+        ConstMax     = 320; \
+    } \
+    /* All GC1000 series chips can only support 64 uniforms for ps on non-unified const mode. */ \
+    else if (NumConstants > 256 && ChipModel == gcv1000) \
+    { \
+        UnifiedConst = gcvFALSE; \
+        VsConstBase  = AQVertexShaderConstRegAddrs; \
+        PsConstBase  = AQPixelShaderConstRegAddrs; \
+        VsConstMax   = 256; \
+        PsConstMax   = 64; \
+        ConstMax     = 320; \
+    } \
+    else if (NumConstants > 256) \
+    { \
+        UnifiedConst = gcvFALSE; \
+        VsConstBase  = AQVertexShaderConstRegAddrs; \
+        PsConstBase  = AQPixelShaderConstRegAddrs; \
+        VsConstMax   = 256; \
+        PsConstMax   = 256; \
+        ConstMax     = 512; \
+    } \
+    else if (NumConstants == 256) \
+    { \
+        UnifiedConst = gcvFALSE; \
+        VsConstBase  = AQVertexShaderConstRegAddrs; \
+        PsConstBase  = AQPixelShaderConstRegAddrs; \
+        VsConstMax   = 256; \
+        PsConstMax   = 256; \
+        ConstMax     = 512; \
+    } \
+    else \
+    { \
+        UnifiedConst = gcvFALSE; \
+        VsConstBase  = AQVertexShaderConstRegAddrs; \
+        PsConstBase  = AQPixelShaderConstRegAddrs; \
+        VsConstMax   = 168; \
+        PsConstMax   = 64; \
+        ConstMax     = 232; \
+    } \
+}
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_driver.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_driver.h
index 4494805b3ece..9cc9626e3b06 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_driver.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_driver.h
@@ -19,7 +19,6 @@
 *****************************************************************************/
 
 
-
 #ifndef __gc_hal_driver_h_
 #define __gc_hal_driver_h_
 
@@ -271,6 +270,9 @@ typedef struct _gcsHAL_QUERY_CHIP_IDENTITY
     /* Number of 3D GPUs */
     gctUINT32                   gpuCoreCount;
 #endif
+
+    /* Special control bits for 2D chip. */
+    gctUINT32                   chip2DControl;
 }
 gcsHAL_QUERY_CHIP_IDENTITY;
 
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_driver_vg.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_driver_vg.h
index fc8954ab37a4..7a7e8b5f4caf 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_driver_vg.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_driver_vg.h
@@ -57,37 +57,37 @@ typedef struct _gcsCOMMAND_BUFFER_INFO
 
     /* Alignment and mask for the buffer address. */
     gctUINT                     addressMask;
-    gctSIZE_T                   addressAlignment;
+    gctUINT32                    addressAlignment;
 
     /* Alignment for each command. */
-    gctSIZE_T                   commandAlignment;
+    gctUINT32                   commandAlignment;
 
     /* Number of bytes required by the STATE command. */
-    gctSIZE_T                   stateCommandSize;
+    gctUINT32                   stateCommandSize;
 
     /* Number of bytes required by the RESTART command. */
-    gctSIZE_T                   restartCommandSize;
+    gctUINT32                   restartCommandSize;
 
     /* Number of bytes required by the FETCH command. */
-    gctSIZE_T                   fetchCommandSize;
+    gctUINT32                   fetchCommandSize;
 
     /* Number of bytes required by the CALL command. */
-    gctSIZE_T                   callCommandSize;
+    gctUINT32                   callCommandSize;
 
     /* Number of bytes required by the RETURN command. */
-    gctSIZE_T                   returnCommandSize;
+    gctUINT32                   returnCommandSize;
 
     /* Number of bytes required by the EVENT command. */
-    gctSIZE_T                   eventCommandSize;
+    gctUINT32                   eventCommandSize;
 
     /* Number of bytes required by the END command. */
-    gctSIZE_T                   endCommandSize;
+    gctUINT32                   endCommandSize;
 
     /* Number of bytes reserved at the tail of a static command buffer. */
-    gctSIZE_T                   staticTailSize;
+    gctUINT32                   staticTailSize;
 
     /* Number of bytes reserved at the tail of a dynamic command buffer. */
-    gctSIZE_T                   dynamicTailSize;
+    gctUINT32                   dynamicTailSize;
 }
 gcsCOMMAND_BUFFER_INFO;
 
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_eglplatform.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_eglplatform.h
index 100bda07ecbb..eb19c70066a1 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_eglplatform.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_eglplatform.h
@@ -19,7 +19,6 @@
 *****************************************************************************/
 
 
-
 #ifndef __gc_hal_eglplatform_h_
 #define __gc_hal_eglplatform_h_
 
@@ -624,6 +623,38 @@ gcoOS_SwapBuffers(
     OUT gctUINT *Width,
     OUT gctUINT *Height
     );
+
+#ifdef EGL_API_DRI
+gceSTATUS
+gcoOS_ResizeWindow(
+    IN gctPOINTER localDisplay,
+    IN HALNativeWindowType Drawable,
+    IN gctUINT Width,
+    IN gctUINT Height)
+    ;
+
+#ifdef USE_FREESCALE_EGL_ACCEL
+gceSTATUS
+gcoOS_SwapBuffersGeneric_Async(
+    IN gctPOINTER localDisplay,
+    IN HALNativeWindowType Drawable,
+    IN gcoSURF RenderTarget,
+    IN gcoSURF ResolveTarget,
+    IN gctPOINTER ResolveBits,
+    OUT gctUINT *Width,
+    OUT gctUINT *Height,
+    IN void * resolveRect
+    );
+
+gceSTATUS
+gcoOS_DrawSurface(
+    IN gctPOINTER localDisplay,
+    IN HALNativeWindowType Drawable
+    );
+#endif
+
+#endif
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_eglplatform_type.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_eglplatform_type.h
index 3136772330c1..aac4bdffdf63 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_eglplatform_type.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_eglplatform_type.h
@@ -33,20 +33,20 @@ extern "C" {
 
 typedef enum _halEventType
 {
-        /* Keyboard event. */
+    /* Keyboard event. */
     HAL_KEYBOARD,
 
-        /* Mouse move event. */
+    /* Mouse move event. */
     HAL_POINTER,
 
-        /* Mouse button event. */
+    /* Mouse button event. */
     HAL_BUTTON,
 
-        /* Application close event. */
-        HAL_CLOSE,
+    /* Application close event. */
+    HAL_CLOSE,
 
-        /* Application window has been updated. */
-        HAL_WINDOW_UPDATE
+    /* Application window has been updated. */
+    HAL_WINDOW_UPDATE
 }
 halEventType;
 
@@ -172,10 +172,10 @@ halKeys;
 /* Structure that defined keyboard mapping. */
 typedef struct _halKeyMap
 {
-        /* Normal key. */
+    /* Normal key. */
     halKeys normal;
 
-        /* Extended key. */
+    /* Extended key. */
     halKeys extended;
 }
 halKeyMap;
@@ -183,50 +183,50 @@ halKeyMap;
 /* Event structure. */
 typedef struct _halEvent
 {
-        /* Event type. */
+    /* Event type. */
     halEventType type;
 
-        /* Event data union. */
+    /* Event data union. */
     union _halEventData
     {
-                /* Event data for keyboard. */
+        /* Event data for keyboard. */
         struct _halKeyboard
         {
-                        /* Scancode. */
-            halKeys     scancode;
+            /* Scancode. */
+            halKeys scancode;
 
-                        /* ASCII characte of the key pressed. */
-            char        key;
+            /* ASCII characte of the key pressed. */
+            char    key;
 
-                        /* Flag whether the key was pressed (1) or released (0). */
-            char        pressed;
+            /* Flag whether the key was pressed (1) or released (0). */
+            char    pressed;
         }
         keyboard;
 
-                /* Event data for pointer. */
+        /* Event data for pointer. */
         struct _halPointer
         {
-                        /* Current pointer coordinate. */
-            int         x;
-            int         y;
+            /* Current pointer coordinate. */
+            int     x;
+            int     y;
         }
         pointer;
 
-                /* Event data for mouse buttons. */
+        /* Event data for mouse buttons. */
         struct _halButton
         {
-                        /* Left button state. */
-            int         left;
+            /* Left button state. */
+            int     left;
 
-                        /* Middle button state. */
-            int         middle;
+            /* Middle button state. */
+            int     middle;
 
-                        /* Right button state. */
-            int         right;
+            /* Right button state. */
+            int     right;
 
-                        /* Current pointer coordinate. */
-                        int             x;
-                        int             y;
+            /* Current pointer coordinate. */
+            int     x;
+            int     y;
         }
         button;
     }
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_engine.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_engine.h
index 6671d11702f9..cc9fef78ad83 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_engine.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_engine.h
@@ -83,13 +83,20 @@ gcoHAL_QueryShaderCapsEx(
 gceSTATUS
 gcoHAL_QuerySamplerBase(
                         IN  gcoHAL Hal,
-                        OUT gctSIZE_T * VertexCount,
+                        OUT gctUINT32 * VertexCount,
                         OUT gctINT_PTR VertexBase,
-                        OUT gctSIZE_T * FragmentCount,
+                        OUT gctUINT32 * FragmentCount,
                         OUT gctINT_PTR FragmentBase
                         );
 
 gceSTATUS
+gcoHAL_QueryUniformBase(
+                                            IN  gcoHAL Hal,
+                                            OUT gctUINT32 * VertexBase,
+                                            OUT gctUINT32 * FragmentBase
+                                            );
+
+gceSTATUS
 gcoHAL_QueryTextureCaps(
     IN gcoHAL Hal,
     OUT gctUINT * MaxWidth,
@@ -141,7 +148,10 @@ typedef struct _gcsSURF_BLIT_ARGS
     gctBOOL     scissorTest;
     gcsRECT     scissor;
     gctUINT     flags;
-} gcsSURF_BLIT_ARGS;
+}
+gcsSURF_BLIT_ARGS;
+
+
 
 
 /* Clear flags. */
@@ -211,9 +221,86 @@ typedef struct _gcsSURF_CLEAR_ARGS
 
 typedef gcsSURF_CLEAR_ARGS* gcsSURF_CLEAR_ARGS_PTR;
 
+typedef struct _gscSURF_BLITDRAW_BLIT
+{
+    gcoSURF  srcSurface;
+    gcoSURF  dstSurface;
+    gcsRECT  srcRect;
+    gcsRECT  dstRect;
+    gceTEXTURE_FILTER  filterMode;
+    gctBOOL  xReverse;
+    gctBOOL  yReverse;
+    gctBOOL  scissorEnabled;
+    gcsRECT  scissor;
+}gscSURF_BLITDRAW_BLIT;
+
+
+typedef enum _gceBLITDRAW_TYPE
+{
+    gcvBLITDRAW_CLEAR = 0,
+    gcvBLITDRAW_BLIT  = 1,
+
+    /* last number, not a real type */
+    gcvBLITDRAW_NUM_TYPE
+ }
+gceBLITDRAW_TYPE;
+
+
+typedef struct _gscSURF_BLITDRAW_ARGS
+{
+    /* always the fist member */
+    gceHAL_ARG_VERSION version;
+
+    union _gcsSURF_BLITDRAW_ARGS_UNION
+    {
+       struct _gscSURF_BLITDRAW_ARG_v1
+       {
+            /* Whether it's clear or blit operation, can be extended. */
+            gceBLITDRAW_TYPE type;
+
+            union _gscSURF_BLITDRAW_UNION
+            {
+                gscSURF_BLITDRAW_BLIT blit;
+
+                struct _gscSURF_BLITDRAW_CLEAR
+                {
+                    gcsSURF_CLEAR_ARGS clearArgs;
+                    gcoSURF rtSurface;
+                    gcoSURF dsSurface;
+                } clear;
+            } u;
+       } v1;
+    } uArgs;
+}
+gcsSURF_BLITDRAW_ARGS;
+
+
+typedef struct _gcsSURF_RESOLVE_ARGS
+{
+    gceHAL_ARG_VERSION version;
+    union _gcsSURF_RESOLVE_ARGS_UNION
+    {
+        struct _gcsSURF_RESOLVE_ARG_v1
+        {
+            gctBOOL yInverted;
+        }v1;
+    } uArgs;
+}
+gcsSURF_RESOLVE_ARGS;
+
 
 /* CPU Blit with format (including linear <-> tile) conversion*/
-gceSTATUS gcoSURF_BlitCPU(gcsSURF_BLIT_ARGS* args);
+gceSTATUS
+gcoSURF_BlitCPU(
+    gcsSURF_BLIT_ARGS* args
+    );
+
+
+gceSTATUS
+gcoSURF_BlitDraw(
+    IN gcsSURF_BLITDRAW_ARGS *args
+    );
+
 
 /* Copy surface. */
 gceSTATUS
@@ -229,6 +316,14 @@ gcoSURF_Clear(
     IN gcsSURF_CLEAR_ARGS_PTR  clearArg
     );
 
+/* Preserve pixels from source. */
+gceSTATUS
+gcoSURF_Preserve(
+    IN gcoSURF Source,
+    IN gcoSURF Dest,
+    IN gcsRECT_PTR MaskRect
+    );
+
 /* Set number of samples for a gcoSURF object. */
 gceSTATUS
 gcoSURF_SetSamples(
@@ -287,6 +382,14 @@ gcoSURF_Resolve(
     IN gcoSURF DestSurface
     );
 
+gceSTATUS
+gcoSURF_ResolveEx(
+    IN gcoSURF SrcSurface,
+    IN gcoSURF DestSurface,
+    IN gcsSURF_RESOLVE_ARGS *args
+    );
+
+
 /* Resolve rectangular area of a surface. */
 gceSTATUS
 gcoSURF_ResolveRect(
@@ -297,6 +400,18 @@ gcoSURF_ResolveRect(
     IN gcsPOINT_PTR RectSize
     );
 
+/* Resolve rectangular area of a surface. */
+gceSTATUS
+gcoSURF_ResolveRectEx(
+    IN gcoSURF SrcSurface,
+    IN gcoSURF DestSurface,
+    IN gcsPOINT_PTR SrcOrigin,
+    IN gcsPOINT_PTR DestOrigin,
+    IN gcsPOINT_PTR RectSize,
+    IN gcsSURF_RESOLVE_ARGS *args
+    );
+
+
 gceSTATUS
 gcoSURF_GetResolveAlignment(
     IN gcoSURF Surface,
@@ -474,7 +589,7 @@ gcoINDEX_Upload(
 gceSTATUS
 gcoINDEX_UploadOffset(
     IN gcoINDEX Index,
-    IN gctUINT32 Offset,
+    IN gctSIZE_T Offset,
     IN gctCONST_POINTER Buffer,
     IN gctSIZE_T Bytes
     );
@@ -595,7 +710,7 @@ gceSTATUS
 gco3D_SetTargetOffsetEx(
     IN gco3D Engine,
     IN gctUINT32 TargetIndex,
-    IN gctUINT32 Offset
+    IN gctSIZE_T Offset
     );
 
 
@@ -616,7 +731,7 @@ gco3D_SetDepth(
 gceSTATUS
 gco3D_SetDepthBufferOffset(
     IN gco3D Engine,
-    IN gctUINT32 Offset
+    IN gctSIZE_T Offset
     );
 
 /* Unset depth buffer. */
@@ -1105,7 +1220,7 @@ gceSTATUS
 gco3D_DrawPrimitives(
     IN gco3D Engine,
     IN gcePRIMITIVE Type,
-    IN gctINT StartVertex,
+    IN gctSIZE_T StartVertex,
     IN gctSIZE_T PrimitiveCount
     );
 
@@ -1114,8 +1229,8 @@ gco3D_DrawInstancedPrimitives(
     IN gco3D Engine,
     IN gcePRIMITIVE Type,
     IN gctBOOL DrawIndex,
-    IN gctINT StartVertex,
-    IN gctINT StartIndex,
+    IN gctSIZE_T StartVertex,
+    IN gctSIZE_T StartIndex,
     IN gctSIZE_T PrimitiveCount,
     IN gctSIZE_T VertexCount,
     IN gctSIZE_T InstanceCount
@@ -1145,8 +1260,8 @@ gceSTATUS
 gco3D_DrawIndexedPrimitives(
     IN gco3D Engine,
     IN gcePRIMITIVE Type,
-    IN gctINT BaseVertex,
-    IN gctINT StartIndex,
+    IN gctSIZE_T BaseVertex,
+    IN gctSIZE_T StartIndex,
     IN gctSIZE_T PrimitiveCount
     );
 
@@ -1570,11 +1685,11 @@ gcoTEXTURE_Upload(
     IN gcoTEXTURE Texture,
     IN gctINT MipMap,
     IN gceTEXTURE_FACE Face,
-    IN gctUINT Width,
-    IN gctUINT Height,
+    IN gctSIZE_T Width,
+    IN gctSIZE_T Height,
     IN gctUINT Slice,
     IN gctCONST_POINTER Memory,
-    IN gctINT Stride,
+    IN gctSIZE_T Stride,
     IN gceSURF_FORMAT Format,
     IN gceSURF_COLOR_SPACE SrcColorSpace
     );
@@ -1585,13 +1700,13 @@ gcoTEXTURE_UploadSub(
     IN gcoTEXTURE Texture,
     IN gctINT MipMap,
     IN gceTEXTURE_FACE Face,
-    IN gctUINT X,
-    IN gctUINT Y,
-    IN gctUINT Width,
-    IN gctUINT Height,
+    IN gctSIZE_T X,
+    IN gctSIZE_T Y,
+    IN gctSIZE_T Width,
+    IN gctSIZE_T Height,
     IN gctUINT Slice,
     IN gctCONST_POINTER Memory,
-    IN gctINT Stride,
+    IN gctSIZE_T Stride,
     IN gceSURF_FORMAT Format,
     IN gceSURF_COLOR_SPACE SrcColorSpace,
     IN gctUINT32 PhysicalAddress
@@ -1617,8 +1732,8 @@ gcoTEXTURE_UploadCompressed(
     IN gcoTEXTURE Texture,
     IN gctINT MipMap,
     IN gceTEXTURE_FACE Face,
-    IN gctUINT Width,
-    IN gctUINT Height,
+    IN gctSIZE_T Width,
+    IN gctSIZE_T Height,
     IN gctUINT Slice,
     IN gctCONST_POINTER Memory,
     IN gctSIZE_T Bytes
@@ -1630,10 +1745,10 @@ gcoTEXTURE_UploadCompressedSub(
     IN gcoTEXTURE Texture,
     IN gctINT MipMap,
     IN gceTEXTURE_FACE Face,
-    IN gctUINT XOffset,
-    IN gctUINT YOffset,
-    IN gctUINT Width,
-    IN gctUINT Height,
+    IN gctSIZE_T XOffset,
+    IN gctSIZE_T YOffset,
+    IN gctSIZE_T Width,
+    IN gctSIZE_T Height,
     IN gctUINT Slice,
     IN gctCONST_POINTER Memory,
     IN gctSIZE_T Size
@@ -1654,7 +1769,7 @@ gcoTEXTURE_GetMipMapFace(
     IN gctUINT MipMap,
     IN gceTEXTURE_FACE Face,
     OUT gcoSURF * Surface,
-    OUT gctUINT32_PTR Offset
+    OUT gctSIZE_T_PTR Offset
     );
 
 gceSTATUS
@@ -1663,7 +1778,7 @@ gcoTEXTURE_GetMipMapSlice(
     IN gctUINT MipMap,
     IN gctUINT Slice,
     OUT gcoSURF * Surface,
-    OUT gctUINT32_PTR Offset
+    OUT gctSIZE_T_PTR Offset
     );
 
 gceSTATUS
@@ -1672,9 +1787,9 @@ gcoTEXTURE_AddMipMap(
     IN gctINT Level,
     IN gctINT InternalFormat,
     IN gceSURF_FORMAT Format,
-    IN gctUINT Width,
-    IN gctUINT Height,
-    IN gctUINT Depth,
+    IN gctSIZE_T Width,
+    IN gctSIZE_T Height,
+    IN gctSIZE_T Depth,
     IN gctUINT Faces,
     IN gcePOOL Pool,
     OUT gcoSURF * Surface
@@ -1853,7 +1968,7 @@ gceSTATUS
 gcoSTREAM_Upload(
     IN gcoSTREAM Stream,
     IN gctCONST_POINTER Buffer,
-    IN gctUINT32 Offset,
+    IN gctSIZE_T Offset,
     IN gctSIZE_T Bytes,
     IN gctBOOL Dynamic
     );
@@ -1937,7 +2052,7 @@ gcoSTREAM_CPUCacheOperation(
 gceSTATUS
 gcoSTREAM_CPUCacheOperation_Range(
     IN gcoSTREAM Stream,
-    IN gctUINT32 Offset,
+    IN gctSIZE_T Offset,
     IN gctSIZE_T Length,
     IN gceCACHEOPERATION Operation
     );
@@ -2015,7 +2130,7 @@ typedef struct _gcsATTRIBUTE
     gctBOOL             normalized;
 
     /* Stride of the component. */
-    gctUINT             stride;
+    gctSIZE_T           stride;
 
     /* Divisor of the attribute */
     gctUINT             divisor;
@@ -2131,7 +2246,7 @@ gcoVERTEXARRAY_Bind_Ex2(
     IN gcoVERTEXARRAY Vertex,
     IN gctUINT32 EnableBits,
     IN gcsATTRIBUTE_PTR VertexArray,
-    IN gctUINT First,
+    IN gctSIZE_T First,
     IN gctSIZE_T Count,
     IN gctBOOL DrawArraysInstanced,
     IN gctSIZE_T InstanceCount,
@@ -2140,7 +2255,7 @@ gcoVERTEXARRAY_Bind_Ex2(
     IN gctPOINTER IndexMemory,
     IN OUT gcePRIMITIVE * PrimitiveType,
 #if gcdUSE_WCLIP_PATCH
-    IN OUT gctUINT * PrimitiveCount,
+    IN OUT gctSIZE_T * PrimitiveCount,
     IN OUT gctFLOAT * wLimitRms,
     IN OUT gctBOOL * wLimitDirty,
 #else
@@ -2330,7 +2445,7 @@ gceSTATUS
 gcoBUFOBJ_Upload(
     IN gcoBUFOBJ BufObj,
     IN gctCONST_POINTER Buffer,
-    IN gctUINT32 Offset,
+    IN gctSIZE_T Offset,
     IN gctSIZE_T Bytes,
     IN gceBUFOBJ_USAGE Usage
     );
@@ -2365,7 +2480,7 @@ gcoBUFOBJ_SetDirty(
 gceSTATUS
 gcoBUFOBJ_AlignIndexBufferWhenNeeded(
     IN gcoBUFOBJ BufObj,
-    IN gctUINT32 Offset,
+    IN gctSIZE_T Offset,
     OUT gcoBUFOBJ * AlignedBufObj
     );
 
@@ -2380,7 +2495,7 @@ gcoBUFOBJ_CPUCacheOperation(
 gceSTATUS
 gcoBUFOBJ_CPUCacheOperation_Range(
     IN gcoBUFOBJ BufObj,
-    IN gctUINT32 Offset,
+    IN gctSIZE_T Offset,
     IN gctSIZE_T Length,
     IN gceCACHEOPERATION Operation
     );
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_engine_vg.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_engine_vg.h
index 09bc6313ce1a..f081ea9598df 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_engine_vg.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_engine_vg.h
@@ -567,7 +567,7 @@ gcoHAL_ReserveTask(
     IN gcoHAL Hal,
     IN gceBLOCK Block,
     IN gctUINT TaskCount,
-    IN gctSIZE_T Bytes,
+    IN gctUINT32 Bytes,
     OUT gctPOINTER * Memory
     );
 /******************************************************************************\
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_enum.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_enum.h
index 589739db5ce6..9c2bce6462b0 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_enum.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_enum.h
@@ -30,13 +30,16 @@ extern "C" {
 /* Chip models. */
 typedef enum _gceCHIPMODEL
 {
+    gcv200  = 0x0200,
     gcv300  = 0x0300,
     gcv320  = 0x0320,
+    gcv328  = 0x0328,
     gcv350  = 0x0350,
     gcv355  = 0x0355,
     gcv400  = 0x0400,
     gcv410  = 0x0410,
     gcv420  = 0x0420,
+    gcv428  = 0x0428,
     gcv450  = 0x0450,
     gcv500  = 0x0500,
     gcv530  = 0x0530,
@@ -226,6 +229,7 @@ typedef enum _gceFEATURE
     gcvFEATURE_TEXTURE_16K,
     gcvFEATURE_PA_FARZCLIPPING_FIX,
     gcvFEATURE_PE_DITHER_COLORMASK_FIX,
+    gcvFEATURE_ZSCALE_FIX,
 
     gcvFEATURE_MULTI_PIXELPIPES,
     gcvFEATURE_PIPE_CL,
@@ -234,6 +238,14 @@ typedef enum _gceFEATURE
 
     gcvFEATURE_UNIFIED_SAMPLERS,
     gcvFEATURE_CL_PS_WALKER,
+    gcvFEATURE_NEW_HZ,
+
+    gcvFEATURE_TX_FRAC_PRECISION_6BIT,
+    gcvFEATURE_SH_INSTRUCTION_PREFETCH,
+    gcvFEATURE_PROBE,
+
+    gcvFEATURE_BUG_FIXES8,
+    gcvFEATURE_2D_ALL_QUAD,
 
     /* Insert features above this comment only. */
     gcvFEATURE_COUNT                /* Not a feature. */
@@ -256,9 +268,9 @@ gceSWWA;
 /* Option Set*/
 typedef enum _gceOPITON
 {
-    /* HW setting we takes PREFER */
+    /* HW setting we take PREFER */
     gcvOPTION_PREFER_MULTIPIPE_RS = 0,
-
+    gcvOPTION_PREFER_ZCONVERT_BYPASS =1,
 
 
     gcvOPTION_HW_NULL = 50,
@@ -404,6 +416,20 @@ typedef enum _gceSURF_ROTATION
 }
 gceSURF_ROTATION;
 
+/* Surface flag */
+typedef enum _gceSURF_FLAG
+{
+    /* None flag */
+    gcvSURF_FLAG_NONE                = 0x0,
+    /* content is preserved after swap */
+    gcvSURF_FLAG_CONTENT_PRESERVED   = 0x1,
+    /* content is updated after swap*/
+    gcvSURF_FLAG_CONTENT_UPDATED     = 0x2,
+    /* content is y inverted */
+    gcvSURF_FLAG_CONTENT_YINVERTED   = 0x4,
+}
+gceSURF_FLAG;
+
 typedef enum _gceMIPMAP_IMAGE_FORMAT
 {
     gcvUNKNOWN_MIPMAP_IMAGE_FORMAT  = -2
@@ -1418,9 +1444,7 @@ gceMULTI_GPU_MODE;
 
 typedef enum _gceMACHINECODE
 {
-    gcvMACHINECODE_HOVERJET0 = 0x0,
-
-    gcvMACHINECODE_ANTUTU0,
+    gcvMACHINECODE_ANTUTU0 = 0x0,
 
     gcvMACHINECODE_GLB27_RELEASE_0,
 
@@ -1433,6 +1457,20 @@ typedef enum _gceMACHINECODE
 }
 gceMACHINECODE;
 
+typedef enum _gceUNIFORMCVT
+{
+    gcvUNIFORMCVT_NONE = 0,
+    gcvUNIFORMCVT_TO_BOOL,
+    gcvUNIFORMCVT_TO_FLOAT,
+} gceUNIFORMCVT;
+
+typedef enum _gceHAL_ARG_VERSION
+{
+    gcvHAL_ARG_VERSION_V1 = 0x0,
+}
+gceHAL_ARG_VERSION;
+
+
 /* GL_VIV internal usage */
 #ifndef GL_MAP_BUFFER_OBJ_VIV
 #define GL_MAP_BUFFER_OBJ_VIV       0x10000
@@ -1445,10 +1483,6 @@ gceMACHINECODE;
 typedef struct _gckCONTEXT          * gckCONTEXT;
 typedef struct _gcoCMDBUF           * gcoCMDBUF;
 
-#if gcdTEMP_CMD_BUFFER_SIZE
-typedef struct _gcsTEMPCMDBUF       * gcsTEMPCMDBUF;
-#endif
-
 typedef struct _gcsSTATE_DELTA      * gcsSTATE_DELTA_PTR;
 typedef struct _gcsQUEUE            * gcsQUEUE_PTR;
 typedef struct _gcoQUEUE            * gcoQUEUE;
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_kernel_buffer.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_kernel_buffer.h
index d23b637d7c0f..e6454ec7412e 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_kernel_buffer.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_kernel_buffer.h
@@ -23,7 +23,6 @@
 #ifndef __gc_hal_kernel_buffer_h_
 #define __gc_hal_kernel_buffer_h_
 
-
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -141,20 +140,20 @@ struct _gcoCMDBUF
     gctUINT64                   logical;
 
     /* Number of bytes in command buffer. */
-    gctUINT                     bytes;
+    gctUINT32                   bytes;
 
     /* Start offset into the command buffer. */
-    gctUINT                     startOffset;
+    gctUINT32                   startOffset;
 
     /* Current offset into the command buffer. */
-    gctUINT                     offset;
+    gctUINT32                   offset;
 
     /* Number of free bytes in command buffer. */
-    gctUINT                     free;
+    gctUINT32                   free;
 
     /* Location of the last reserved area. */
     gctUINT64                   lastReserve;
-    gctUINT                     lastOffset;
+    gctUINT32                   lastOffset;
 
 #if gcdSECURE_USER
     /* Hint array for the current command buffer. */
@@ -202,23 +201,17 @@ struct _gcoQUEUE
     gcsQUEUE_PTR                head;
     gcsQUEUE_PTR                tail;
 
-#ifdef __QNXNTO__
-    /* Buffer for records. */
-    gcsQUEUE_PTR                records;
-    gctUINT32                   freeBytes;
-    gctUINT32                   offset;
-#else
+    /* chunks of the records. */
+    gctPOINTER                  chunks;
+
     /* List of free records. */
     gcsQUEUE_PTR                freeList;
-#endif
+
     #define gcdIN_QUEUE_RECORD_LIMIT 16
     /* Number of records currently in queue */
     gctUINT32                   recordCount;
 };
 
-
-#if gcdTEMP_CMD_BUFFER_SIZE
-
 struct _gcsTEMPCMDBUF
 {
     gctUINT32 currentByteSize;
@@ -226,8 +219,6 @@ struct _gcsTEMPCMDBUF
     gctBOOL  inUse;
 };
 
-#endif
-
 #ifdef __cplusplus
 }
 #endif
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_options.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_options.h
index 34e3e61bb611..bf2b8173efa8 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_options.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_options.h
@@ -19,11 +19,18 @@
 *****************************************************************************/
 
 
-
 #ifndef __gc_hal_options_h_
 #define __gc_hal_options_h_
 
 /*
+    gcdSECURITY
+
+*/
+#ifndef gcdSECURITY
+#   define gcdSECURITY                          0
+#endif
+
+/*
     gcdPRINT_VERSION
 
         Print HAL version.
@@ -63,6 +70,9 @@
 #   define VIVANTE_PROFILER_PERDRAW             0
 #endif
 
+#ifndef VIVANTE_PROFILER_NEW
+#   define VIVANTE_PROFILER_NEW                 0
+#endif
 /*
     gcdUSE_VG
 
@@ -752,15 +762,6 @@
 #endif
 
 /*
-    gcdENABLE_RECOVERY
-
-        This define enables the recovery code.
-*/
-#ifndef gcdENABLE_RECOVERY
-#   define gcdENABLE_RECOVERY                   1
-#endif
-
-/*
     gcdRENDER_THREADS
 
         Number of render threads. Make it zero, and there will be no render
@@ -966,11 +967,19 @@
         Android only for now.
 */
 #ifndef gcdENABLE_RENDER_INTO_WINDOW
-#if gcdDUMP
-#   define gcdENABLE_RENDER_INTO_WINDOW         0
-#else
 #   define gcdENABLE_RENDER_INTO_WINDOW         1
 #endif
+
+/*
+    gcdENABLE_BLIT_BUFFER_PRESERVE
+
+        Render-Into-Window (ie, No-Resolve) does not include preserved swap
+        behavior.  This feature can enable buffer preserve in No-Resolve mode.
+        When enabled, previous buffer (may be part of ) will be resolve-blitted
+        to current buffer.
+*/
+#ifndef gcdENABLE_BLIT_BUFFER_PRESERVE
+#   define gcdENABLE_BLIT_BUFFER_PRESERVE       0
 #endif
 
 /*
@@ -1111,15 +1120,65 @@
 #endif
 
 /*
-    gcdTEMP_CMD_BUFFER_SIZE
-        When it's zero, use original command buffer generation logic.
-        Otherwise, set it as 0x4000 as temp buffer size.
+    gcdYINVERTED_RENDERING
+        When it's not zero, we will rendering display buffer
+        with top-bottom direction. All other offscreen rendering
+        will be bottom-top, which follow OpenGL ES spec.
+*/
+#ifndef gcdYINVERTED_RENDERING
+#   define gcdYINVERTED_RENDERING 1
+#endif
+
+#if gcdYINVERTED_RENDERING
+/* disable unaligned linear composition adjust in Y-inverted rendering mode. */
+#   undef  gcdANDROID_UNALIGNED_LINEAR_COMPOSITION_ADJUST
+#   define gcdANDROID_UNALIGNED_LINEAR_COMPOSITION_ADJUST 0
+#endif
+
+/*
+    gcdFENCE_WAIT_LOOP_COUNT
+        Wait fence, loop count.
 */
+#ifndef gcdFENCE_WAIT_LOOP_COUNT
+#   define gcdFENCE_WAIT_LOOP_COUNT 100
+#endif
 
-#ifndef gcdTEMP_CMD_BUFFER_SIZE
-#define gcdTEMP_CMD_BUFFER_SIZE  0
+/*
+    gcdHAL_3D_DRAWBLIT
+        When it's not zero, we will enable HAL 3D drawblit
+        to replace client 3dblit.
+*/
+#ifndef gcdHAL_3D_DRAWBLIT
+#   define gcdHAL_3D_DRAWBLIT 1
 #endif
 
+/*
+    gcdPARTIAL_FAST_CLEAR
+        When it's not zero, partial fast clear is enabled.
+        Depends on gcdHAL_3D_DRAWBLIT, if gcdHAL_3D_DRAWBLIT is not enabled,
+        only available when scissor box is completely aligned.
+        Expremental, under test.
+*/
+#ifndef gcdPARTIAL_FAST_CLEAR
+#   define gcdPARTIAL_FAST_CLEAR                0
+#endif
+
+/* Force disable bank alignment when partial fast clear enabled. */
+#if gcdPARTIAL_FAST_CLEAR
+#   undef gcdENABLE_BANK_ALIGNMENT
+#   define gcdENABLE_BANK_ALIGNMENT             0
+#endif
+
+/*
+    gcdREMOVE_SURF_ORIENTATION
+        When it's not zero, we will remove surface orientation function.
+        It wil become to a parameter of resolve function.
+*/
+#ifndef gcdREMOVE_SURF_ORIENTATION
+#   define gcdREMOVE_SURF_ORIENTATION 0
+#endif
+
+
 #define LINUX_CMA_FSL 1
 #define DYNAMIC_MEMORY_RECORD 1
 
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_profiler.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_profiler.h
index b416b63674f4..73cd53929ec7 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_profiler.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_profiler.h
@@ -23,6 +23,10 @@
 #ifndef __gc_hal_profiler_h_
 #define __gc_hal_profiler_h_
 
+#if VIVANTE_PROFILER_NEW
+#include "gc_hal_engine.h"
+#endif
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -190,6 +194,7 @@ extern "C" {
 #define VPG_FRAME       0x190000
 #define VPG_ES11_DRAW   0x200000
 #define VPG_ES30_DRAW   0x210000
+#define VPG_VG11_TIME   0x220000
 #define VPG_END         0xff0000
 
 /* Info. */
@@ -417,6 +422,10 @@ typedef struct _gcsPROFILER_COUNTERS
 }
 gcsPROFILER_COUNTERS;
 
+#if VIVANTE_PROFILER_NEW
+#define NumOfDrawBuf 64
+#endif
+
 /* HAL profile information. */
 typedef struct _gcsPROFILER
 {
@@ -477,6 +486,11 @@ typedef struct _gcsPROFILER
     gctUINT32       prevPSTexInstCount;
     gctUINT32       prevPSPixelCount;
 
+#if VIVANTE_PROFILER_NEW
+    gcoBUFOBJ       newCounterBuf[NumOfDrawBuf];
+    gctUINT32       curBufId;
+#endif
+
 }
 gcsPROFILER;
 
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_rename.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_rename.h
index 4d128b70685d..8244b4ecd1c1 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_rename.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_rename.h
@@ -50,8 +50,9 @@
 #define gckOS_FreeContiguous            gcmHAL2D(gckOS_FreeContiguous)
 #define gckOS_GetPageSize               gcmHAL2D(gckOS_GetPageSize)
 #define gckOS_GetPhysicalAddress        gcmHAL2D(gckOS_GetPhysicalAddress)
-#define gckOS_GetPhysicalAddressProcess     gcmHAL2D(gckOS_GetPhysicalAddressProcess)
-#define gckOS_MapPhysical                   gcmHAL2D(gckOS_MapPhysical)
+#define gckOS_UserLogicalToPhysical     gcmHAL2D(gckOS_UserLogicalToPhysical)
+#define gckOS_GetPhysicalAddressProcess gcmHAL2D(gckOS_GetPhysicalAddressProcess)
+#define gckOS_MapPhysical               gcmHAL2D(gckOS_MapPhysical)
 #define gckOS_UnmapPhysical             gcmHAL2D(gckOS_UnmapPhysical)
 #define gckOS_ReadRegister              gcmHAL2D(gckOS_ReadRegister)
 #define gckOS_WriteRegister             gcmHAL2D(gckOS_WriteRegister)
@@ -151,7 +152,6 @@
 #define gckHARDWARE_Execute             gcmHAL2D(gckHARDWARE_Execute)
 #define gckHARDWARE_End                 gcmHAL2D(gckHARDWARE_End)
 #define gckHARDWARE_Nop                 gcmHAL2D(gckHARDWARE_Nop)
-#define gckHARDWARE_Wait                gcmHAL2D(gckHARDWARE_Wait)
 #define gckHARDWARE_PipeSelect          gcmHAL2D(gckHARDWARE_PipeSelect)
 #define gckHARDWARE_Link                gcmHAL2D(gckHARDWARE_Link)
 #define gckHARDWARE_Event               gcmHAL2D(gckHARDWARE_Event)
@@ -164,7 +164,6 @@
 #define gckHARDWARE_AlignToTile         gcmHAL2D(gckHARDWARE_AlignToTile)
 #define gckHARDWARE_UpdateQueueTail     gcmHAL2D(gckHARDWARE_UpdateQueueTail)
 #define gckHARDWARE_ConvertLogical      gcmHAL2D(gckHARDWARE_ConvertLogical)
-#define gckHARDWARE_ConvertPhysical     gcmHAL2D(gckHARDWARE_ConvertPhysical)
 #define gckHARDWARE_Interrupt           gcmHAL2D(gckHARDWARE_Interrupt)
 #define gckHARDWARE_SetMMU              gcmHAL2D(gckHARDWARE_SetMMU)
 #define gckHARDWARE_FlushMMU            gcmHAL2D(gckHARDWARE_FlushMMU)
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_types.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_types.h
index 0fd12154ab4c..fa9a125eaf15 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_types.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_types.h
@@ -26,6 +26,29 @@
 #include "gc_hal_version.h"
 #include "gc_hal_options.h"
 
+#if !defined(VIV_KMD)
+#if defined(__KERNEL__)
+#include "linux/version.h"
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24)
+    typedef unsigned long uintptr_t;
+#   endif
+#   include "linux/types.h"
+#elif defined(UNDER_CE)
+#include <crtdefs.h>
+#elif defined(_MSC_VER) && (_MSC_VER <= 1500)
+#include <crtdefs.h>
+#include "vadefs.h"
+#elif defined(__QNXNTO__)
+#define _QNX_SOURCE
+#include <stdint.h>
+#include <stddef.h>
+#else
+#include <stdlib.h>
+#include <stddef.h>
+#include <stdint.h>
+#endif
+#endif
+
 #ifdef _WIN32
 #pragma warning(disable:4127)   /* Conditional expression is constant (do { }
                                 ** while(0)). */
@@ -130,7 +153,6 @@ typedef int                     gctBOOL;
 typedef gctBOOL *               gctBOOL_PTR;
 
 typedef int                     gctINT;
-typedef long                    gctLONG;
 typedef signed char             gctINT8;
 typedef signed short            gctINT16;
 typedef signed int              gctINT32;
@@ -147,7 +169,7 @@ typedef unsigned char           gctUINT8;
 typedef unsigned short          gctUINT16;
 typedef unsigned int            gctUINT32;
 typedef unsigned long long      gctUINT64;
-typedef unsigned long           gctUINTPTR_T;
+typedef uintptr_t               gctUINTPTR_T;
 
 typedef gctUINT *               gctUINT_PTR;
 typedef gctUINT8 *              gctUINT8_PTR;
@@ -155,7 +177,7 @@ typedef gctUINT16 *             gctUINT16_PTR;
 typedef gctUINT32 *             gctUINT32_PTR;
 typedef gctUINT64 *             gctUINT64_PTR;
 
-typedef unsigned long           gctSIZE_T;
+typedef size_t                  gctSIZE_T;
 typedef gctSIZE_T *             gctSIZE_T_PTR;
 typedef gctUINT32               gctTRACE;
 
@@ -181,6 +203,7 @@ typedef gctUINT32               gctTRACE;
 #define gcvMINUINT32            0x80000000
 #define gcvMAXUINT64            0xffffffffffffffff
 #define gcvMINUINT64            0x8000000000000000
+#define gcvMAXUINTPTR_T         (~(gctUINTPTR_T)0)
 
 typedef float                   gctFLOAT;
 typedef signed int              gctFIXED_POINT;
@@ -670,608 +693,6 @@ gceSTATUS;
     ((Address & (~0U << Name ## _LSB)) == (Name ## _Address >> 2)) \
 )
 
-/*******************************************************************************
-**
-**  A set of macros to aid state loading.
-**
-**  ARGUMENTS:
-**
-**      CommandBuffer   Pointer to a gcoCMDBUF object.
-**      StateDelta      Pointer to a gcsSTATE_DELTA state delta structure.
-**      Memory          Destination memory pointer of gctUINT32_PTR type.
-**      PartOfContext   Whether or not the state is a part of the context.
-**      FixedPoint      Whether or not the state is of the fixed point format.
-**      Count           Number of consecutive states to be loaded.
-**      Address         State address.
-**      Data            Data to be set to the state.
-*/
-
-/*----------------------------------------------------------------------------*/
-
-#if gcmIS_DEBUG(gcdDEBUG_CODE)
-
-#   define gcmSTORELOADSTATE(CommandBuffer, Memory, Address, Count) \
-        CommandBuffer->lastLoadStatePtr     = gcmPTR_TO_UINT64(Memory); \
-        CommandBuffer->lastLoadStateAddress = Address; \
-        CommandBuffer->lastLoadStateCount   = Count
-
-#   define gcmVERIFYLOADSTATE(CommandBuffer, Memory, Address) \
-        gcmASSERT( \
-            (gctUINT) (Memory  - gcmUINT64_TO_TYPE(CommandBuffer->lastLoadStatePtr, gctUINT32_PTR) - 1) \
-            == \
-            (gctUINT) (Address - CommandBuffer->lastLoadStateAddress) \
-            ); \
-        \
-        gcmASSERT(CommandBuffer->lastLoadStateCount > 0); \
-        \
-        CommandBuffer->lastLoadStateCount -= 1
-
-#   define gcmVERIFYLOADSTATEDONE(CommandBuffer) \
-        gcmASSERT(CommandBuffer->lastLoadStateCount == 0)
-
-#else
-
-#   define gcmSTORELOADSTATE(CommandBuffer, Memory, Address, Count)
-#   define gcmVERIFYLOADSTATE(CommandBuffer, Memory, Address)
-#   define gcmVERIFYLOADSTATEDONE(CommandBuffer)
-
-#endif
-
-#if gcdSECURE_USER
-
-#   define gcmDEFINESECUREUSER() \
-        gctUINT         __secure_user_offset__; \
-        gctUINT32_PTR   __secure_user_hintArray__;
-
-#   define gcmBEGINSECUREUSER() \
-        __secure_user_offset__ = reserve->lastOffset; \
-        \
-        __secure_user_hintArray__ = gcmUINT64_TO_PTR(reserve->hintArrayTail)
-
-#   define gcmENDSECUREUSER() \
-        reserve->hintArrayTail = gcmPTR_TO_UINT64(__secure_user_hintArray__)
-
-#   define gcmSKIPSECUREUSER() \
-        __secure_user_offset__ += gcmSIZEOF(gctUINT32)
-
-#   define gcmUPDATESECUREUSER() \
-        *__secure_user_hintArray__ = __secure_user_offset__; \
-        \
-        __secure_user_offset__    += gcmSIZEOF(gctUINT32); \
-        __secure_user_hintArray__ += 1
-
-#else
-
-#   define gcmDEFINESECUREUSER()
-#   define gcmBEGINSECUREUSER()
-#   define gcmENDSECUREUSER()
-#   define gcmSKIPSECUREUSER()
-#   define gcmUPDATESECUREUSER()
-
-#endif
-
-/*----------------------------------------------------------------------------*/
-
-#if gcdDUMP
-#   define gcmDUMPSTATEDATA(StateDelta, FixedPoint, Address, Data) \
-        if (FixedPoint) \
-        { \
-            gcmDUMP(gcvNULL, "#[state.x 0x%04X 0x%08X]", \
-                Address, Data \
-                ); \
-        } \
-        else \
-        { \
-            gcmDUMP(gcvNULL, "#[state 0x%04X 0x%08X]", \
-                Address, Data \
-                ); \
-        }
-#else
-#   define gcmDUMPSTATEDATA(StateDelta, FixedPoint, Address, Data)
-#endif
-
-#define gcmDEFINESTATEBUFFER(CommandBuffer, StateDelta, Memory, ReserveSize) \
-    gcmDEFINESECUREUSER() \
-    gctSIZE_T ReserveSize; \
-    gcoCMDBUF CommandBuffer; \
-    gctUINT32_PTR Memory; \
-    gcsSTATE_DELTA_PTR StateDelta
-
-#define gcmBEGINSTATEBUFFER(Hardware, CommandBuffer, StateDelta, Memory, ReserveSize) \
-{ \
-    gcmONERROR(gcoBUFFER_Reserve( \
-        Hardware->buffer, ReserveSize, gcvTRUE, &CommandBuffer \
-        )); \
-    \
-    Memory = (gctUINT32_PTR) gcmUINT64_TO_PTR(CommandBuffer->lastReserve); \
-    \
-    StateDelta = Hardware->delta; \
-    \
-    gcmBEGINSECUREUSER(); \
-}
-
-#define gcmENDSTATEBUFFER(Hardware, CommandBuffer, Memory, ReserveSize) \
-{ \
-    gcmENDSECUREUSER(); \
-    \
-    gcmASSERT( \
-        gcmUINT64_TO_TYPE(CommandBuffer->lastReserve, gctUINT8_PTR) + ReserveSize \
-        == \
-         (gctUINT8_PTR) Memory \
-        ); \
-}
-
-/*----------------------------------------------------------------------------*/
-
-#define gcmBEGINSTATEBATCH(CommandBuffer, Memory, FixedPoint, Address, Count) \
-{ \
-    gcmASSERT(((Memory - gcmUINT64_TO_TYPE(CommandBuffer->lastReserve, gctUINT32_PTR)) & 1) == 0); \
-    gcmASSERT((gctUINT32)Count <= 1024); \
-    \
-    gcmVERIFYLOADSTATEDONE(CommandBuffer); \
-    \
-    gcmSTORELOADSTATE(CommandBuffer, Memory, Address, Count); \
-    \
-    *Memory++ \
-        = gcmSETFIELDVALUE(0, AQ_COMMAND_LOAD_STATE_COMMAND, OPCODE,  LOAD_STATE) \
-        | gcmSETFIELD     (0, AQ_COMMAND_LOAD_STATE_COMMAND, FLOAT,   FixedPoint) \
-        | gcmSETFIELD     (0, AQ_COMMAND_LOAD_STATE_COMMAND, COUNT,   Count) \
-        | gcmSETFIELD     (0, AQ_COMMAND_LOAD_STATE_COMMAND, ADDRESS, Address); \
-    \
-    gcmSKIPSECUREUSER(); \
-}
-
-#define gcmENDSTATEBATCH(CommandBuffer, Memory) \
-{ \
-    gcmVERIFYLOADSTATEDONE(CommandBuffer); \
-    \
-    gcmASSERT(((Memory - gcmUINT64_TO_TYPE(CommandBuffer->lastReserve, gctUINT32_PTR)) & 1) == 0); \
-}
-
-/*----------------------------------------------------------------------------*/
-
-#define gcmSETSTATEDATA(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                        Address, Data) \
-{ \
-    gctUINT32 __temp_data32__; \
-    \
-    gcmVERIFYLOADSTATE(CommandBuffer, Memory, Address); \
-    \
-    __temp_data32__ = Data; \
-    \
-    *Memory++ = __temp_data32__; \
-    \
-    gcoHARDWARE_UpdateDelta( \
-        StateDelta, FixedPoint, Address, 0, __temp_data32__ \
-        ); \
-    \
-    gcmDUMPSTATEDATA(StateDelta, FixedPoint, Address, __temp_data32__); \
-    \
-    gcmUPDATESECUREUSER(); \
-}
-
-#define gcmSETSTATEDATAWITHMASK(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                        Address, Mask, Data) \
-{ \
-    gctUINT32 __temp_data32__; \
-    \
-    gcmVERIFYLOADSTATE(CommandBuffer, Memory, Address); \
-    \
-    __temp_data32__ = Data; \
-    \
-    *Memory++ = __temp_data32__; \
-    \
-    gcoHARDWARE_UpdateDelta( \
-        StateDelta, FixedPoint, Address, Mask, __temp_data32__ \
-        ); \
-    \
-    gcmDUMPSTATEDATA(StateDelta, FixedPoint, Address, __temp_data32__); \
-    \
-    gcmUPDATESECUREUSER(); \
-}
-
-
-#define gcmSETCTRLSTATE(StateDelta, CommandBuffer, Memory, Address, Data) \
-{ \
-    gctUINT32 __temp_data32__; \
-    \
-    gcmVERIFYLOADSTATE(CommandBuffer, Memory, Address); \
-    \
-    __temp_data32__ = Data; \
-    \
-    *Memory++ = __temp_data32__; \
-    \
-    gcmDUMPSTATEDATA(StateDelta, gcvFALSE, Address, __temp_data32__); \
-    \
-    gcmSKIPSECUREUSER(); \
-}
-
-#define gcmSETFILLER(CommandBuffer, Memory) \
-{ \
-    gcmVERIFYLOADSTATEDONE(CommandBuffer); \
-    \
-    Memory += 1; \
-    \
-    gcmSKIPSECUREUSER(); \
-}
-
-/*----------------------------------------------------------------------------*/
-
-#define gcmSETSINGLESTATE(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                          Address, Data) \
-{ \
-    gcmBEGINSTATEBATCH(CommandBuffer, Memory, FixedPoint, Address, 1); \
-    gcmSETSTATEDATA(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                    Address, Data); \
-    gcmENDSTATEBATCH(CommandBuffer, Memory); \
-}
-
-#define gcmSETSINGLESTATEWITHMASK(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                          Address, Mask, Data) \
-{ \
-    gcmBEGINSTATEBATCH(CommandBuffer, Memory, FixedPoint, Address, 1); \
-    gcmSETSTATEDATAWITHMASK(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                    Address, Mask, Data); \
-    gcmENDSTATEBATCH(CommandBuffer, Memory); \
-}
-
-
-#define gcmSETSINGLECTRLSTATE(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                              Address, Data) \
-{ \
-    gcmBEGINSTATEBATCH(CommandBuffer, Memory, FixedPoint, Address, 1); \
-    gcmSETCTRLSTATE(StateDelta, CommandBuffer, Memory, Address, Data); \
-    gcmENDSTATEBATCH(CommandBuffer, Memory); \
-}
-
-
-
-#define gcmSETSEMASTALLPIPE(StateDelta, CommandBuffer, Memory, Data) \
-{ \
-    gcmSETSINGLESTATE(StateDelta, CommandBuffer, Memory, gcvFALSE, AQSemaphoreRegAddrs, Data); \
-    \
-    *Memory++ = gcmSETFIELDVALUE(0, STALL_COMMAND, OPCODE, STALL); \
-    \
-    *Memory++ = Data; \
-    \
-    gcmDUMP(gcvNULL, "#[stall 0x%08X 0x%08X]", \
-        gcmSETFIELDVALUE(0, AQ_SEMAPHORE, SOURCE, FRONT_END), \
-        gcmSETFIELDVALUE(0, AQ_SEMAPHORE, DESTINATION, PIXEL_ENGINE)); \
-    \
-    gcmSKIPSECUREUSER(); \
-}
-
-/*******************************************************************************
-**
-**  gcmSETSTARTDECOMMAND
-**
-**      Form a START_DE command.
-**
-**  ARGUMENTS:
-**
-**      Memory          Destination memory pointer of gctUINT32_PTR type.
-**      Count           Number of the rectangles.
-*/
-
-#define gcmSETSTARTDECOMMAND(Memory, Count) \
-{ \
-    *Memory++ \
-        = gcmSETFIELDVALUE(0, AQ_COMMAND_START_DE_COMMAND, OPCODE,     START_DE) \
-        | gcmSETFIELD     (0, AQ_COMMAND_START_DE_COMMAND, COUNT,      Count) \
-        | gcmSETFIELD     (0, AQ_COMMAND_START_DE_COMMAND, DATA_COUNT, 0); \
-    \
-    *Memory++ = 0xDEADDEED; \
-}
-
-
-/*----------------------------------------------------------------------------*/
-#if !gcdTEMP_CMD_BUFFER_SIZE
-
-#define gcmDEFINESTATEBUFFER_NEW(CommandBuffer, StateDelta, Memory, ReserveSize) \
-    gcmDEFINESTATEBUFFER(CommandBuffer, StateDelta, Memory, ReserveSize)
-
-#define gcmBEGINSTATEBUFFER_NEW(Hardware, CommandBuffer, StateDelta, Memory, ReserveSize, OutSide) \
-    gcmBEGINSTATEBUFFER(Hardware, CommandBuffer, StateDelta, Memory, ReserveSize)
-
-#define gcmENDSTATEBUFFER_NEW(Hardware, CommandBuffer, Memory, ReserveSize, OutSide) \
-    gcmENDSTATEBUFFER(Hardware, CommandBuffer, Memory, ReserveSize)
-
-/*----------------------------------------------------------------------------*/
-
-#define gcmBEGINSTATEBATCH_NEW(CommandBuffer, Memory, FixedPoint, Address, Count) \
-    gcmBEGINSTATEBATCH(CommandBuffer, Memory, FixedPoint, Address, Count)
-
-#define gcmENDSTATEBATCH_NEW(CommandBuffer, Memory)  \
-    gcmENDSTATEBATCH(CommandBuffer, Memory)
-/*----------------------------------------------------------------------------*/
-
-#define gcmSETSTATEDATA_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                            Address, Data) \
-    gcmSETSTATEDATA(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                            Address, Data)
-
-#define gcmSETSTATEDATAWITHMASK_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                                    Address, Mask, Data) \
-    gcmSETSTATEDATAWITHMASK(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                                    Address, Mask, Data) \
-
-
-#define gcmSETCTRLSTATE_NEW(StateDelta, CommandBuffer, Memory, Address, Data) \
-    gcmSETCTRLSTATE(StateDelta, CommandBuffer, Memory, Address, Data)
-
-#define gcmSETFILLER_NEW(CommandBuffer, Memory) \
-    gcmSETFILLER(CommandBuffer, Memory)
-
-    /*----------------------------------------------------------------------------*/
-
-#define gcmSETSINGLESTATE_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                                  Address, Data) \
-    gcmSETSINGLESTATE(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                                  Address, Data)
-
-#define gcmSETSINGLESTATEWITHMASK_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                                          Address, Mask, Data) \
-    gcmSETSINGLESTATEWITHMASK(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                                          Address, Mask, Data)
-
-
-#define gcmSETSINGLECTRLSTATE_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                                  Address, Data) \
-    gcmSETSINGLECTRLSTATE(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                                  Address, Data)
-
-
-
-#define gcmSETSEMASTALLPIPE_NEW(StateDelta, CommandBuffer, Memory, Data) \
-    gcmSETSEMASTALLPIPE(StateDelta, CommandBuffer, Memory, Data)
-
-#define gcmSETSTARTDECOMMAND_NEW(CommandBuffer, Memory, Count) \
-    gcmSETSTARTDECOMMAND(CommandBuffer, Memory, Count)
-
-
-#else
-
-#define gcmDEFINESTATEBUFFER_NEW(CommandBuffer, StateDelta, Memory, ReserveSize) \
-    gcmDEFINESECUREUSER() \
-    gctSIZE_T ReserveSize = 0; \
-    gcsTEMPCMDBUF CommandBuffer = gcvNULL; \
-    gctUINT32_PTR Memory; \
-    gcsSTATE_DELTA_PTR StateDelta
-
-#define gcmBEGINSTATEBUFFER_NEW(Hardware, CommandBuffer, StateDelta, Memory, ReserveSize, OutSide) \
-{ \
-    if (OutSide) \
-    {\
-        Memory = (gctUINT32_PTR)*OutSide; \
-    }\
-    else \
-    {\
-        gcmONERROR(gcoBUFFER_StartTEMPCMDBUF( \
-            Hardware->buffer, &CommandBuffer \
-            ));\
-        \
-        Memory = (gctUINT32_PTR)(CommandBuffer->buffer); \
-        \
-    }\
-    StateDelta = Hardware->delta; \
-    \
-    gcmBEGINSECUREUSER(); \
-}
-
-#define gcmENDSTATEBUFFER_NEW(Hardware, CommandBuffer, Memory, ReserveSize, OutSide) \
-{ \
-    gcmENDSECUREUSER(); \
-    \
-    ReserveSize = ReserveSize; \
-    \
-    if (OutSide) \
-    {\
-        *OutSide = Memory; \
-    }\
-    else \
-    {\
-        CommandBuffer->currentByteSize = (gctUINT8_PTR)Memory -  \
-                                         (gctUINT8_PTR)CommandBuffer->buffer; \
-        \
-        gcmONERROR(gcoBUFFER_EndTEMPCMDBUF(Hardware->buffer));\
-    }\
-}
-
-/*----------------------------------------------------------------------------*/
-
-#define gcmBEGINSTATEBATCH_NEW(CommandBuffer, Memory, FixedPoint, Address, Count) \
-{ \
-    gcmASSERT((gctUINT32)Count <= 1024); \
-    \
-    *Memory++ \
-        = gcmSETFIELDVALUE(0, AQ_COMMAND_LOAD_STATE_COMMAND, OPCODE,  LOAD_STATE) \
-        | gcmSETFIELD     (0, AQ_COMMAND_LOAD_STATE_COMMAND, FLOAT,   FixedPoint) \
-        | gcmSETFIELD     (0, AQ_COMMAND_LOAD_STATE_COMMAND, COUNT,   Count) \
-        | gcmSETFIELD     (0, AQ_COMMAND_LOAD_STATE_COMMAND, ADDRESS, Address); \
-    \
-    gcmSKIPSECUREUSER(); \
-}
-
-#define gcmENDSTATEBATCH_NEW(CommandBuffer, Memory)
-
-/*----------------------------------------------------------------------------*/
-
-#define gcmSETSTATEDATA_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                        Address, Data) \
-{ \
-    gctUINT32 __temp_data32__; \
-    \
-    __temp_data32__ = Data; \
-    \
-    *Memory++ = __temp_data32__; \
-    \
-    gcoHARDWARE_UpdateDelta( \
-        StateDelta, FixedPoint, Address, 0, __temp_data32__ \
-        ); \
-    \
-    gcmDUMPSTATEDATA(StateDelta, FixedPoint, Address, __temp_data32__); \
-    \
-    gcmUPDATESECUREUSER(); \
-}
-
-#define gcmSETSTATEDATAWITHMASK_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                                Address, Mask, Data) \
-{ \
-    gctUINT32 __temp_data32__; \
-    \
-    __temp_data32__ = Data; \
-    \
-    *Memory++ = __temp_data32__; \
-    \
-    gcoHARDWARE_UpdateDelta( \
-        StateDelta, FixedPoint, Address, Mask, __temp_data32__ \
-        ); \
-    \
-    gcmDUMPSTATEDATA(StateDelta, FixedPoint, Address, __temp_data32__); \
-    \
-    gcmUPDATESECUREUSER(); \
-}
-
-
-#define gcmSETCTRLSTATE_NEW(StateDelta, CommandBuffer, Memory, Address, Data) \
-{ \
-    gctUINT32 __temp_data32__; \
-    \
-    __temp_data32__ = Data; \
-    \
-    *Memory++ = __temp_data32__; \
-    \
-    gcmDUMPSTATEDATA(StateDelta, gcvFALSE, Address, __temp_data32__); \
-    \
-    gcmSKIPSECUREUSER(); \
-}
-
-#define gcmSETFILLER_NEW(CommandBuffer, Memory) \
-{ \
-    Memory += 1; \
-    \
-    gcmSKIPSECUREUSER(); \
-}
-
-/*----------------------------------------------------------------------------*/
-
-#define gcmSETSINGLESTATE_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                              Address, Data) \
-{ \
-    gcmBEGINSTATEBATCH_NEW(CommandBuffer, Memory, FixedPoint, Address, 1); \
-    gcmSETSTATEDATA_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                    Address, Data); \
-    gcmENDSTATEBATCH_NEW(CommandBuffer, Memory); \
-}
-
-#define gcmSETSINGLESTATEWITHMASK_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                                      Address, Mask, Data) \
-{ \
-    gcmBEGINSTATEBATCH_NEW(CommandBuffer, Memory, FixedPoint, Address, 1); \
-    gcmSETSTATEDATAWITHMASK_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                    Address, Mask, Data); \
-    gcmENDSTATEBATCH_NEW(CommandBuffer, Memory); \
-}
-
-
-#define gcmSETSINGLECTRLSTATE_NEW(StateDelta, CommandBuffer, Memory, FixedPoint, \
-                              Address, Data) \
-{ \
-    gcmBEGINSTATEBATCH_NEW(CommandBuffer, Memory, FixedPoint, Address, 1); \
-    gcmSETCTRLSTATE_NEW(StateDelta, CommandBuffer, Memory, Address, Data); \
-    gcmENDSTATEBATCH_NEW(CommandBuffer, Memory); \
-}
-
-
-
-#define gcmSETSEMASTALLPIPE_NEW(StateDelta, CommandBuffer, Memory, Data) \
-{ \
-    gcmSETSINGLESTATE_NEW(StateDelta, CommandBuffer, Memory, gcvFALSE, AQSemaphoreRegAddrs, Data); \
-    \
-    *Memory++ = gcmSETFIELDVALUE(0, STALL_COMMAND, OPCODE, STALL); \
-    \
-    *Memory++ = Data; \
-    \
-    gcmDUMP(gcvNULL, "#[stall 0x%08X 0x%08X]", \
-        gcmSETFIELDVALUE(0, AQ_SEMAPHORE, SOURCE, FRONT_END), \
-        gcmSETFIELDVALUE(0, AQ_SEMAPHORE, DESTINATION, PIXEL_ENGINE)); \
-    \
-    gcmSKIPSECUREUSER(); \
-}
-
-#define gcmSETSTARTDECOMMAND_NEW(CommandBuffer, Memory, Count) \
-{ \
-    *Memory++ \
-        = gcmSETFIELDVALUE(0, AQ_COMMAND_START_DE_COMMAND, OPCODE,     START_DE) \
-        | gcmSETFIELD     (0, AQ_COMMAND_START_DE_COMMAND, COUNT,      Count) \
-        | gcmSETFIELD     (0, AQ_COMMAND_START_DE_COMMAND, DATA_COUNT, 0); \
-    \
-    *Memory++ = 0xDEADDEED; \
-    \
-}
-
-#endif
-
-/*******************************************************************************
-**
-**  gcmCONFIGUREUNIFORMS
-**
-**      Configure uniforms according to chip and numConstants.
-*/
-#define gcmCONFIGUREUNIFORMS(ChipModel, ChipRevision, NumConstants, \
-             UnifiedConst, VsConstBase, PsConstBase, VsConstMax, PsConstMax) \
-{ \
-    if (ChipModel == gcv2000 && ChipRevision == 0x5118) \
-    { \
-        UnifiedConst = gcvFALSE; \
-        VsConstBase  = AQVertexShaderConstRegAddrs; \
-        PsConstBase  = AQPixelShaderConstRegAddrs; \
-        VsConstMax   = 256; \
-        PsConstMax   = 64; \
-    } \
-    else if (NumConstants == 320) \
-    { \
-        UnifiedConst = gcvFALSE; \
-        VsConstBase  = AQVertexShaderConstRegAddrs; \
-        PsConstBase  = AQPixelShaderConstRegAddrs; \
-        VsConstMax   = 256; \
-        PsConstMax   = 64; \
-    } \
-    /* All GC1000 series chips can only support 64 uniforms for ps on non-unified const mode. */ \
-    else if (NumConstants > 256 && ChipModel == gcv1000) \
-    { \
-        UnifiedConst = gcvFALSE; \
-        VsConstBase  = AQVertexShaderConstRegAddrs; \
-        PsConstBase  = AQPixelShaderConstRegAddrs; \
-        VsConstMax   = 256; \
-        PsConstMax   = 64; \
-    } \
-    else if (NumConstants > 256) \
-    { \
-        UnifiedConst = gcvFALSE; \
-        VsConstBase  = AQVertexShaderConstRegAddrs; \
-        PsConstBase  = AQPixelShaderConstRegAddrs; \
-        VsConstMax   = 256; \
-        PsConstMax   = 256; \
-    } \
-    else if (NumConstants == 256) \
-    { \
-        UnifiedConst = gcvFALSE; \
-        VsConstBase  = AQVertexShaderConstRegAddrs; \
-        PsConstBase  = AQPixelShaderConstRegAddrs; \
-        VsConstMax   = 256; \
-        PsConstMax   = 256; \
-    } \
-    else \
-    { \
-        UnifiedConst = gcvFALSE; \
-        VsConstBase  = AQVertexShaderConstRegAddrs; \
-        PsConstBase  = AQPixelShaderConstRegAddrs; \
-        VsConstMax   = 168; \
-        PsConstMax   = 64; \
-    } \
-}
-
 /******************************************************************************\
 ******************************** Ceiling Macro ********************************
 \******************************************************************************/
@@ -1302,24 +723,15 @@ gceSTATUS;
 **
 **      p       Pointer value.
 */
-#if defined(_WIN32) || (defined(__LP64__) && __LP64__)
-#if defined(_WIN64)
-#   define gcmPTR2INT(p) \
-    ( \
-        (gctUINT64) (p) \
-    )
-#else
-#   define gcmPTR2INT(p) \
-    ( \
-        (gctUINT32) (gctUINT64) (p) \
-    )
-#endif
-#else
-#   define gcmPTR2INT(p) \
-    ( \
-        (gctUINT32) (p) \
-    )
-#endif
+#define gcmPTR2INT(p) \
+( \
+    (gctUINTPTR_T) (p) \
+)
+
+#define gcmPTR2INT32(p) \
+( \
+    (gctUINT32)(gctUINTPTR_T) (p) \
+)
 
 /*******************************************************************************
 **
@@ -1331,17 +743,11 @@ gceSTATUS;
 **
 **      v       Integer value.
 */
-#ifdef __LP64__
-#   define gcmINT2PTR(i) \
-    ( \
-        (gctPOINTER) (gctINT64) (i) \
-    )
-#else
-#   define gcmINT2PTR(i) \
-    ( \
-        (gctPOINTER) (i) \
-    )
-#endif
+
+#define gcmINT2PTR(i) \
+( \
+    (gctPOINTER) (gctUINTPTR_T)(i) \
+)
 
 /*******************************************************************************
 **
@@ -1356,7 +762,7 @@ gceSTATUS;
 */
 #define gcmOFFSETOF(s, field) \
 ( \
-    gcmPTR2INT(& (((struct s *) 0)->field)) \
+    gcmPTR2INT32(& (((struct s *) 0)->field)) \
 )
 
 /*******************************************************************************
@@ -1471,7 +877,6 @@ struct _gckLINKQUEUE
 };
 #endif
 
-#if gcdPROCESS_ADDRESS_SPACE
 #define gcdENTRY_QUEUE_SIZE 256
 typedef struct _gckENTRYDATA * gckENTRYDATA;
 struct _gckENTRYDATA
@@ -1488,7 +893,18 @@ struct _gckENTRYQUEUE
     gctUINT32                   front;
     gctUINT32                   count;
 };
-#endif
+
+typedef enum _gceTRACEMODE
+{
+    gcvTRACEMODE_NONE     = 0,
+    gcvTRACEMODE_FULL     = 1,
+    gcvTRACEMODE_LOGGER   = 2,
+    gcvTRACEMODE_PRE      = 3,
+    gcvTRACEMODE_POST     = 4,
+    gcvTRACEMODE_SYSTRACE = 5,
+
+} gceTRACEMODE;
+
 
 #ifdef __cplusplus
 }
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_version.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_version.h
index 1e6aeadb74a0..57e3e4c362e3 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_version.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_version.h
@@ -27,11 +27,11 @@
 
 #define gcvVERSION_MINOR        0
 
-#define gcvVERSION_PATCH        9
+#define gcvVERSION_PATCH        11
 
-#define gcvVERSION_BUILD     17083
+#define gcvVERSION_BUILD     17486
 
-#define gcvVERSION_STRING    "5.0.9.1.17083"
+#define gcvVERSION_STRING    "5.0.11.14786"
 
 #define gcvVERSION_DATE      __DATE__
 
diff --git a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_vg.h b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_vg.h
index 27021a932fb1..c6044de8aefe 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_vg.h
+++ b/drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_vg.h
@@ -422,7 +422,7 @@ gceSTATUS
 gckVGHARDWARE_Execute(
     IN gckVGHARDWARE Hardware,
     IN gctUINT32 Address,
-    IN gctSIZE_T Count
+    IN gctUINT32 Count
     );
 
 /* Query the available memory. */
@@ -482,6 +482,7 @@ gceSTATUS
 gckVGHARDWARE_ConvertLogical(
     IN gckVGHARDWARE Hardware,
     IN gctPOINTER Logical,
+    IN gctBOOL InUserSpace,
     OUT gctUINT32 * Address
     );
 
@@ -568,7 +569,7 @@ gckVGHARDWARE_QueryIdle(
 \******************************************************************************/
 
 /* Vacant command buffer marker. */
-#define gcvVACANT_BUFFER        ((gcsCOMPLETION_SIGNAL_PTR) (1))
+#define gcvVACANT_BUFFER        ((gcsCOMPLETION_SIGNAL_PTR) ((gctSIZE_T)1))
 
 /* Command buffer header. */
 typedef struct _gcsCMDBUFFER * gcsCMDBUFFER_PTR;
@@ -590,7 +591,7 @@ typedef struct _gcsCMDBUFFER
 
     /* Size of the area allocated for the data portion of this particular
        command buffer (headers and tail reserves are excluded). */
-    gctSIZE_T                   size;
+    gctUINT32                   size;
 
     /* Offset into the buffer [0..size]; reflects exactly how much data has
        been put into the command buffer. */
@@ -598,7 +599,7 @@ typedef struct _gcsCMDBUFFER
 
     /* The number of command units in the buffer for the hardware to
        execute. */
-    gctSIZE_T                   dataCount;
+    gctUINT32                   dataCount;
 
     /* MANAGED BY : user HAL (gcoBUFFER object).
        USED BY    : user HAL (gcoBUFFER object).
@@ -653,8 +654,8 @@ typedef struct _gcsVGCONTEXT
     gctUINT32                   currentPipe;
 
     /* State map/mod buffer. */
-    gctSIZE_T                   mapFirst;
-    gctSIZE_T                   mapLast;
+    gctUINT32                   mapFirst;
+    gctUINT32                   mapLast;
     gcsVGCONTEXT_MAP_PTR        mapContainer;
     gcsVGCONTEXT_MAP_PTR        mapPrev;
     gcsVGCONTEXT_MAP_PTR        mapCurr;
@@ -849,7 +850,7 @@ typedef struct _gckVGMMU *          gckVGMMU;
 gceSTATUS
 gckVGMMU_Construct(
     IN gckVGKERNEL Kernel,
-    IN gctSIZE_T MmuSize,
+    IN gctUINT32 MmuSize,
     OUT gckVGMMU * Mmu
     );
 
diff --git a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_allocator.c b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_allocator.c
new file mode 100644
index 000000000000..0342660db900
--- /dev/null
+++ b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_allocator.c
@@ -0,0 +1,969 @@
+/****************************************************************************
+*
+*    Copyright (C) 2005 - 2014 by Vivante Corp.
+*
+*    This program is free software; you can redistribute it and/or modify
+*    it under the terms of the GNU General Public License as published by
+*    the Free Software Foundation; either version 2 of the license, or
+*    (at your option) any later version.
+*
+*    This program is distributed in the hope that it will be useful,
+*    but WITHOUT ANY WARRANTY; without even the implied warranty of
+*    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+*    GNU General Public License for more details.
+*
+*    You should have received a copy of the GNU General Public License
+*    along with this program; if not write to the Free Software
+*    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*
+*****************************************************************************/
+
+
+
+#include "gc_hal_kernel_linux.h"
+#include "gc_hal_kernel_allocator.h"
+#include <linux/pagemap.h>
+#include <linux/seq_file.h>
+#include <linux/mman.h>
+#include <asm/atomic.h>
+#include <linux/dma-mapping.h>
+#include <linux/slab.h>
+
+#include "gc_hal_kernel_allocator_array.h"
+
+#define _GC_OBJ_ZONE    gcvZONE_OS
+
+static void
+_NonContiguousFree(
+    IN struct page ** Pages,
+    IN gctUINT32 NumPages
+    )
+{
+    gctINT i;
+
+    gcmkHEADER_ARG("Pages=0x%X, NumPages=%d", Pages, NumPages);
+
+    gcmkASSERT(Pages != gcvNULL);
+
+    for (i = 0; i < NumPages; i++)
+    {
+        __free_page(Pages[i]);
+    }
+
+    if (is_vmalloc_addr(Pages))
+    {
+        vfree(Pages);
+    }
+    else
+    {
+        kfree(Pages);
+    }
+
+    gcmkFOOTER_NO();
+}
+
+static struct page **
+_NonContiguousAlloc(
+    IN gctUINT32 NumPages
+    )
+{
+    struct page ** pages;
+    struct page *p;
+    gctINT i, size;
+
+    gcmkHEADER_ARG("NumPages=%lu", NumPages);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
+    if (NumPages > totalram_pages)
+#else
+    if (NumPages > num_physpages)
+#endif
+    {
+        gcmkFOOTER_NO();
+        return gcvNULL;
+    }
+
+    size = NumPages * sizeof(struct page *);
+
+    pages = kmalloc(size, GFP_KERNEL | gcdNOWARN);
+
+    if (!pages)
+    {
+        pages = vmalloc(size);
+
+        if (!pages)
+        {
+            gcmkFOOTER_NO();
+            return gcvNULL;
+        }
+    }
+
+    for (i = 0; i < NumPages; i++)
+    {
+        p = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | gcdNOWARN);
+
+        if (!p)
+        {
+            _NonContiguousFree(pages, i);
+            gcmkFOOTER_NO();
+            return gcvNULL;
+        }
+
+        pages[i] = p;
+    }
+
+    gcmkFOOTER_ARG("pages=0x%X", pages);
+    return pages;
+}
+
+gctSTRING
+_CreateKernelVirtualMapping(
+    IN PLINUX_MDL Mdl
+    )
+{
+    gctSTRING addr = 0;
+    gctINT numPages = Mdl->numPages;
+
+#if gcdNONPAGED_MEMORY_CACHEABLE
+    if (Mdl->contiguous)
+    {
+        addr = page_address(Mdl->u.contiguousPages);
+    }
+    else
+    {
+        addr = vmap(Mdl->u.nonContiguousPages,
+                    numPages,
+                    0,
+                    PAGE_KERNEL);
+
+        /* Trigger a page fault. */
+        memset(addr, 0, numPages * PAGE_SIZE);
+    }
+#else
+    struct page ** pages;
+    gctBOOL free = gcvFALSE;
+    gctINT i;
+
+    if (Mdl->contiguous)
+    {
+        pages = kmalloc(sizeof(struct page *) * numPages, GFP_KERNEL | gcdNOWARN);
+
+        if (!pages)
+        {
+            return gcvNULL;
+        }
+
+        for (i = 0; i < numPages; i++)
+        {
+            pages[i] = nth_page(Mdl->u.contiguousPages, i);
+        }
+
+        free = gcvTRUE;
+    }
+    else
+    {
+        pages = Mdl->u.nonContiguousPages;
+    }
+
+    /* ioremap() can't work on system memory since 2.6.38. */
+    addr = vmap(pages, numPages, 0, gcmkNONPAGED_MEMROY_PROT(PAGE_KERNEL));
+
+    if (free)
+    {
+        kfree(pages);
+    }
+
+#endif
+
+    return addr;
+}
+
+void
+_DestoryKernelVirtualMapping(
+    IN gctSTRING Addr
+    )
+{
+#if !gcdNONPAGED_MEMORY_CACHEABLE
+    vunmap(Addr);
+#endif
+}
+
+void
+_UnmapUserLogical(
+    IN gctPOINTER Logical,
+    IN gctUINT32  Size
+)
+{
+    if (unlikely(current->mm == gcvNULL))
+    {
+        /* Do nothing if process is exiting. */
+        return;
+    }
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,5,0)
+    if (vm_munmap((unsigned long)Logical, Size) < 0)
+    {
+        gcmkTRACE_ZONE(
+                gcvLEVEL_WARNING, gcvZONE_OS,
+                "%s(%d): vm_munmap failed",
+                __FUNCTION__, __LINE__
+                );
+    }
+#else
+    down_write(&current->mm->mmap_sem);
+    if (do_munmap(current->mm, (unsigned long)Logical, Size) < 0)
+    {
+        gcmkTRACE_ZONE(
+                gcvLEVEL_WARNING, gcvZONE_OS,
+                "%s(%d): do_munmap failed",
+                __FUNCTION__, __LINE__
+                );
+    }
+    up_write(&current->mm->mmap_sem);
+#endif
+}
+
+/***************************************************************************\
+************************ Default Allocator **********************************
+\***************************************************************************/
+
+static gceSTATUS
+_DefaultAlloc(
+    IN gckALLOCATOR Allocator,
+    INOUT PLINUX_MDL Mdl,
+    IN gctSIZE_T NumPages,
+    IN gctUINT32 Flags
+    )
+{
+    gceSTATUS status;
+    gctUINT32 order;
+    gctSIZE_T bytes;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+    gctPOINTER addr = gcvNULL;
+#endif
+    gctUINT32 numPages;
+    gctUINT i = 0;
+    gctBOOL contiguous = Flags & gcvALLOC_FLAG_CONTIGUOUS;
+
+    gcmkHEADER_ARG("Mdl=%p NumPages=%d", Mdl, NumPages);
+
+    numPages = NumPages;
+    bytes = NumPages * PAGE_SIZE;
+    order = get_order(bytes);
+
+    if (contiguous)
+    {
+        if (order >= MAX_ORDER)
+        {
+            gcmkONERROR(gcvSTATUS_OUT_OF_MEMORY);
+        }
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+        addr =
+            alloc_pages_exact(bytes, GFP_KERNEL | gcdNOWARN | __GFP_NORETRY);
+
+        Mdl->u.contiguousPages = addr
+                               ? virt_to_page(addr)
+                               : gcvNULL;
+
+        Mdl->exact = gcvTRUE;
+#else
+        Mdl->u.contiguousPages =
+            alloc_pages(GFP_KERNEL | gcdNOWARN | __GFP_NORETRY, order);
+#endif
+
+        if (Mdl->u.contiguousPages == gcvNULL)
+        {
+            Mdl->u.contiguousPages =
+                alloc_pages(GFP_KERNEL | __GFP_HIGHMEM | gcdNOWARN, order);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+            Mdl->exact = gcvFALSE;
+#endif
+        }
+    }
+    else
+    {
+        Mdl->u.nonContiguousPages = _NonContiguousAlloc(numPages);
+    }
+
+    if (Mdl->u.contiguousPages == gcvNULL && Mdl->u.nonContiguousPages == gcvNULL)
+    {
+        gcmkONERROR(gcvSTATUS_OUT_OF_MEMORY);
+    }
+
+    for (i = 0; i < numPages; i++)
+    {
+        struct page *page;
+
+        if (contiguous)
+        {
+            page = nth_page(Mdl->u.contiguousPages, i);
+        }
+        else
+        {
+            page = _NonContiguousToPage(Mdl->u.nonContiguousPages, i);
+        }
+
+        SetPageReserved(page);
+
+        if (!PageHighMem(page) && page_to_phys(page))
+        {
+            gcmkVERIFY_OK(
+                gckOS_CacheFlush(Allocator->os, _GetProcessID(), gcvNULL,
+                                 page_to_phys(page),
+                                 page_address(page),
+                                 PAGE_SIZE));
+        }
+        else
+        {
+            flush_dcache_page(page);
+
+#if !gcdCACHE_FUNCTION_UNIMPLEMENTED && defined(CONFIG_OUTER_CACHE) && gcdENABLE_OUTER_CACHE_PATCH
+            if (page_to_phys(page))
+            {
+                _HandleOuterCache(
+                    Allocator->os,
+                    page_to_phys(page),
+                    gcvNULL,
+                    PAGE_SIZE,
+                    gcvCACHE_FLUSH
+                    );
+            }
+#endif
+        }
+    }
+
+    gcmkFOOTER_NO();
+    return gcvSTATUS_OK;
+
+OnError:
+    gcmkFOOTER();
+    return status;
+}
+
+static void
+_DefaultFree(
+    IN gckALLOCATOR Allocator,
+    IN OUT PLINUX_MDL Mdl
+    )
+{
+    gctINT i;
+
+    for (i = 0; i < Mdl->numPages; i++)
+    {
+        if (Mdl->contiguous)
+        {
+            ClearPageReserved(nth_page(Mdl->u.contiguousPages, i));
+        }
+        else
+        {
+            ClearPageReserved(_NonContiguousToPage(Mdl->u.nonContiguousPages, i));
+        }
+    }
+
+    if (Mdl->contiguous)
+    {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+        if (Mdl->exact == gcvTRUE)
+        {
+            free_pages_exact(page_address(Mdl->u.contiguousPages), Mdl->numPages * PAGE_SIZE);
+        }
+        else
+#endif
+        {
+            __free_pages(Mdl->u.contiguousPages, get_order(Mdl->numPages * PAGE_SIZE));
+        }
+    }
+    else
+    {
+        _NonContiguousFree(Mdl->u.nonContiguousPages, Mdl->numPages);
+    }
+}
+
+gctINT
+_DefaultMapUser(
+    gckALLOCATOR Allocator,
+    PLINUX_MDL Mdl,
+    PLINUX_MDL_MAP MdlMap,
+    gctBOOL Cacheable
+    )
+{
+
+    gctSTRING       addr;
+    unsigned long   start;
+    unsigned long   pfn;
+    gctINT i;
+
+    PLINUX_MDL      mdl = Mdl;
+    PLINUX_MDL_MAP  mdlMap = MdlMap;
+
+    gcmkHEADER_ARG("Allocator=%p Mdl=%p MdlMap=%p gctBOOL=%d", Allocator, Mdl, MdlMap, Cacheable);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+    mdlMap->vmaAddr = (gctSTRING)vm_mmap(gcvNULL,
+                    0L,
+                    mdl->numPages * PAGE_SIZE,
+                    PROT_READ | PROT_WRITE,
+                    MAP_SHARED,
+                    0);
+#else
+    down_write(&current->mm->mmap_sem);
+
+    mdlMap->vmaAddr = (gctSTRING)do_mmap_pgoff(gcvNULL,
+                    0L,
+                    mdl->numPages * PAGE_SIZE,
+                    PROT_READ | PROT_WRITE,
+                    MAP_SHARED,
+                    0);
+
+    up_write(&current->mm->mmap_sem);
+#endif
+
+    gcmkTRACE_ZONE(
+        gcvLEVEL_INFO, gcvZONE_OS,
+        "%s(%d): vmaAddr->0x%X for phys_addr->0x%X",
+        __FUNCTION__, __LINE__,
+        (gctUINT32)(gctUINTPTR_T)mdlMap->vmaAddr,
+        (gctUINT32)(gctUINTPTR_T)mdl
+        );
+
+    if (IS_ERR(mdlMap->vmaAddr))
+    {
+        gcmkTRACE_ZONE(
+            gcvLEVEL_INFO, gcvZONE_OS,
+            "%s(%d): do_mmap_pgoff error",
+            __FUNCTION__, __LINE__
+            );
+
+        mdlMap->vmaAddr = gcvNULL;
+
+        gcmkFOOTER_ARG("*status=%d", gcvSTATUS_OUT_OF_MEMORY);
+        return gcvSTATUS_OUT_OF_MEMORY;
+    }
+
+    down_write(&current->mm->mmap_sem);
+
+    mdlMap->vma = find_vma(current->mm, (unsigned long)mdlMap->vmaAddr);
+
+    if (mdlMap->vma == gcvNULL)
+    {
+        up_write(&current->mm->mmap_sem);
+
+        gcmkTRACE_ZONE(
+            gcvLEVEL_INFO, gcvZONE_OS,
+            "%s(%d): find_vma error",
+            __FUNCTION__, __LINE__
+            );
+
+        mdlMap->vmaAddr = gcvNULL;
+
+        gcmkFOOTER_ARG("*status=%d", gcvSTATUS_OUT_OF_RESOURCES);
+        return gcvSTATUS_OUT_OF_RESOURCES;
+    }
+
+
+
+
+    addr = mdl->addr;
+
+    /* Now map all the vmalloc pages to this user address. */
+    if (mdl->contiguous)
+    {
+        /* map kernel memory to user space.. */
+        mdlMap->vma->vm_flags |= gcdVM_FLAGS;
+
+        if (Cacheable == gcvFALSE)
+        {
+            /* Make this mapping non-cached. */
+            mdlMap->vma->vm_page_prot = gcmkPAGED_MEMROY_PROT(mdlMap->vma->vm_page_prot);
+        }
+
+        if (remap_pfn_range(mdlMap->vma,
+                            mdlMap->vma->vm_start,
+                            page_to_pfn(mdl->u.contiguousPages),
+                            mdlMap->vma->vm_end - mdlMap->vma->vm_start,
+                            mdlMap->vma->vm_page_prot) < 0)
+        {
+            up_write(&current->mm->mmap_sem);
+
+            gcmkTRACE_ZONE(
+                gcvLEVEL_INFO, gcvZONE_OS,
+                "%s(%d): unable to mmap ret",
+                __FUNCTION__, __LINE__
+                );
+
+            mdlMap->vmaAddr = gcvNULL;
+
+            gcmkFOOTER_ARG("*status=%d", gcvSTATUS_OUT_OF_MEMORY);
+            return gcvSTATUS_OUT_OF_MEMORY;
+        }
+    }
+    else
+    {
+        mdlMap->vma->vm_flags |= gcdVM_FLAGS;
+
+        if (Cacheable == gcvFALSE)
+        {
+            /* Make this mapping non-cached. */
+            mdlMap->vma->vm_page_prot = gcmkPAGED_MEMROY_PROT(mdlMap->vma->vm_page_prot);
+        }
+
+        start = mdlMap->vma->vm_start;
+
+        for (i = 0; i < mdl->numPages; i++)
+        {
+            pfn = _NonContiguousToPfn(mdl->u.nonContiguousPages, i);
+
+            if (remap_pfn_range(mdlMap->vma,
+                                start,
+                                pfn,
+                                PAGE_SIZE,
+                                mdlMap->vma->vm_page_prot) < 0)
+            {
+                up_write(&current->mm->mmap_sem);
+
+                mdlMap->vmaAddr = gcvNULL;
+
+                gcmkFOOTER_ARG("*status=%d", gcvSTATUS_OUT_OF_MEMORY);
+                return gcvSTATUS_OUT_OF_MEMORY;
+            }
+
+            start += PAGE_SIZE;
+            addr += PAGE_SIZE;
+        }
+    }
+
+    up_write(&current->mm->mmap_sem);
+
+    gcmkFOOTER_NO();
+    return gcvSTATUS_OK;
+}
+
+void
+_DefaultUnmapUser(
+    IN gckALLOCATOR Allocator,
+    IN gctPOINTER Logical,
+    IN gctUINT32 Size
+    )
+{
+    _UnmapUserLogical(Logical, Size);
+}
+
+gceSTATUS
+_DefaultMapKernel(
+    IN gckALLOCATOR Allocator,
+    IN PLINUX_MDL Mdl,
+    OUT gctPOINTER *Logical
+    )
+{
+    if (Mdl->contiguous && Mdl->addr)
+        {
+                /*for the memory allocated from DMA, there is no contiguousPages, 
+                but the kernel virtual address is already got*/
+                *Logical = Mdl->addr;
+        }
+        else
+                *Logical = _CreateKernelVirtualMapping(Mdl);
+    return gcvSTATUS_OK;
+}
+
+gceSTATUS
+_DefaultUnmapKernel(
+    IN gckALLOCATOR Allocator,
+    IN PLINUX_MDL Mdl,
+    IN gctPOINTER Logical
+    )
+{
+    if (!Mdl->addr)
+                _DestoryKernelVirtualMapping(Logical);
+    return gcvSTATUS_OK;
+}
+
+gceSTATUS
+_DefaultLogicalToPhysical(
+    IN gckALLOCATOR Allocator,
+    IN PLINUX_MDL Mdl,
+    IN gctPOINTER Logical,
+    IN gctUINT32 ProcessID,
+    OUT gctUINT32_PTR Physical
+    )
+{
+    return _ConvertLogical2Physical(
+                Allocator->os, Logical, ProcessID, Mdl, Physical);
+}
+
+gceSTATUS
+_DefaultCache(
+    IN gckALLOCATOR Allocator,
+    IN PLINUX_MDL Mdl,
+    IN gctPOINTER Logical,
+    IN gctUINT32 Physical,
+    IN gctUINT32 Bytes,
+    IN gceCACHEOPERATION Operation
+    )
+{
+    return gcvSTATUS_OK;
+}
+
+gceSTATUS
+_DefaultPhysical(
+    IN gckALLOCATOR Allocator,
+    IN PLINUX_MDL Mdl,
+    IN gctUINT32 Offset,
+    OUT gctUINT32_PTR Physical
+    )
+{
+    gcmkASSERT(Mdl->pagedMem && !Mdl->contiguous);
+    *Physical = _NonContiguousToPhys(Mdl->u.nonContiguousPages, Offset);
+
+    return gcvSTATUS_OK;
+}
+
+/* Default allocator operations. */
+gcsALLOCATOR_OPERATIONS DefaultAllocatorOperations = {
+    .Alloc              = _DefaultAlloc,
+    .Free               = _DefaultFree,
+    .MapUser            = _DefaultMapUser,
+    .UnmapUser          = _DefaultUnmapUser,
+    .MapKernel          = _DefaultMapKernel,
+    .UnmapKernel        = _DefaultUnmapKernel,
+    .LogicalToPhysical  = _DefaultLogicalToPhysical,
+    .Cache              = _DefaultCache,
+    .Physical           = _DefaultPhysical,
+};
+
+/* Default allocator entry. */
+gceSTATUS
+_DefaultAlloctorInit(
+    IN gckOS Os,
+    OUT gckALLOCATOR * Allocator
+    )
+{
+    gceSTATUS status;
+    gckALLOCATOR allocator;
+
+    gcmkONERROR(
+        gckALLOCATOR_Construct(Os, &DefaultAllocatorOperations, &allocator));
+
+    *Allocator = allocator;
+
+    return gcvSTATUS_OK;
+
+OnError:
+    return status;
+}
+#if LINUX_CMA_FSL
+
+static gceSTATUS
+_CMAFSLAlloc(
+    IN gckALLOCATOR Allocator,
+    INOUT PLINUX_MDL Mdl,
+    IN gctSIZE_T NumPages,
+    IN gctUINT32 Flags
+    )
+{
+    gceSTATUS status;
+    gctPOINTER addr = gcvNULL;
+
+    gcmkHEADER_ARG("Mdl=%p NumPages=%d", Mdl, NumPages);
+
+    addr = dma_alloc_writecombine(gcvNULL,
+            NumPages * PAGE_SIZE,
+            &Mdl->dmaHandle,
+            GFP_KERNEL | gcdNOWARN);
+
+    if (addr == gcvNULL)
+    {
+        gcmkONERROR(gcvSTATUS_OUT_OF_MEMORY);
+    }
+
+    Mdl->addr = addr;
+
+    gcmkFOOTER_NO();
+    return gcvSTATUS_OK;
+
+OnError:
+    gcmkFOOTER();
+    return status;
+}
+
+static void
+_CMAFSLFree(
+    IN gckALLOCATOR Allocator,
+    IN OUT PLINUX_MDL Mdl
+    )
+{
+    dma_free_writecombine(gcvNULL,
+            Mdl->numPages * PAGE_SIZE,
+            Mdl->addr,
+            Mdl->dmaHandle);
+}
+
+gctINT
+_CMAFSLMapUser(
+    gckALLOCATOR Allocator,
+    PLINUX_MDL Mdl,
+    PLINUX_MDL_MAP MdlMap,
+    gctBOOL Cacheable
+    )
+{
+
+    gctSTRING       addr;
+    PLINUX_MDL      mdl = Mdl;
+    PLINUX_MDL_MAP  mdlMap = MdlMap;
+
+    gcmkHEADER_ARG("Allocator=%p Mdl=%p MdlMap=%p gctBOOL=%d", Allocator, Mdl, MdlMap, Cacheable);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
+    mdlMap->vmaAddr = (gctSTRING)vm_mmap(gcvNULL,
+                    0L,
+                    mdl->numPages * PAGE_SIZE,
+                    PROT_READ | PROT_WRITE,
+                    MAP_SHARED,
+                    0);
+#else
+    down_write(&current->mm->mmap_sem);
+
+    mdlMap->vmaAddr = (gctSTRING)do_mmap_pgoff(gcvNULL,
+                    0L,
+                    mdl->numPages * PAGE_SIZE,
+                    PROT_READ | PROT_WRITE,
+                    MAP_SHARED,
+                    0);
+
+    up_write(&current->mm->mmap_sem);
+#endif
+
+    gcmkTRACE_ZONE(
+        gcvLEVEL_INFO, gcvZONE_OS,
+        "%s(%d): vmaAddr->0x%X for phys_addr->0x%X",
+        __FUNCTION__, __LINE__,
+        (gctUINT32)(gctUINTPTR_T)mdlMap->vmaAddr,
+        (gctUINT32)(gctUINTPTR_T)mdl
+        );
+
+    if (IS_ERR(mdlMap->vmaAddr))
+    {
+        gcmkTRACE_ZONE(
+            gcvLEVEL_INFO, gcvZONE_OS,
+            "%s(%d): do_mmap_pgoff error",
+            __FUNCTION__, __LINE__
+            );
+
+        mdlMap->vmaAddr = gcvNULL;
+
+        gcmkFOOTER_ARG("*status=%d", gcvSTATUS_OUT_OF_MEMORY);
+        return gcvSTATUS_OUT_OF_MEMORY;
+    }
+
+    down_write(&current->mm->mmap_sem);
+
+    mdlMap->vma = find_vma(current->mm, (unsigned long)mdlMap->vmaAddr);
+
+    if (mdlMap->vma == gcvNULL)
+    {
+        up_write(&current->mm->mmap_sem);
+
+        gcmkTRACE_ZONE(
+            gcvLEVEL_INFO, gcvZONE_OS,
+            "%s(%d): find_vma error",
+            __FUNCTION__, __LINE__
+            );
+
+        mdlMap->vmaAddr = gcvNULL;
+
+        gcmkFOOTER_ARG("*status=%d", gcvSTATUS_OUT_OF_RESOURCES);
+        return gcvSTATUS_OUT_OF_RESOURCES;
+    }
+
+    addr = mdl->addr;
+
+    /* Now map all the vmalloc pages to this user address. */
+    if (mdl->contiguous && (!mdl->cacheable))
+    {
+        /* map kernel memory to user space.. */
+        if (dma_mmap_writecombine(gcvNULL,
+                mdlMap->vma,
+                mdl->addr,
+                mdl->dmaHandle,
+                mdl->numPages * PAGE_SIZE) < 0)
+        {
+            up_write(&current->mm->mmap_sem);
+
+            gcmkTRACE_ZONE(
+                gcvLEVEL_WARNING, gcvZONE_OS,
+                "%s(%d): dma_mmap_attrs error",
+                __FUNCTION__, __LINE__
+                );
+
+             mdlMap->vmaAddr = gcvNULL;
+
+            gcmkFOOTER_ARG("*status=%d", gcvSTATUS_OUT_OF_MEMORY);
+            return gcvSTATUS_OUT_OF_MEMORY;
+        }
+    }
+    else
+    {
+        gckOS_Print("incorrect mdl:conti%d:cachable:%d\n",mdl->contiguous, mdl->cacheable);        
+    }
+
+    up_write(&current->mm->mmap_sem);
+
+    gcmkFOOTER_NO();
+    return gcvSTATUS_OK;
+}
+
+
+
+/* Default allocator operations. */
+gcsALLOCATOR_OPERATIONS CMAFSLAllocatorOperations = {
+    .Alloc              = _CMAFSLAlloc,
+    .Free               = _CMAFSLFree,
+    .MapUser            = _CMAFSLMapUser,
+    .UnmapUser          = _DefaultUnmapUser,
+    .MapKernel          = _DefaultMapKernel,
+    .UnmapKernel        = _DefaultUnmapKernel,
+    .LogicalToPhysical  = _DefaultLogicalToPhysical,
+    .Cache              = _DefaultCache,
+    .Physical           = _DefaultPhysical,
+};
+
+/* Default allocator entry. */
+gceSTATUS
+_CMAFSLAlloctorInit(
+    IN gckOS Os,
+    OUT gckALLOCATOR * Allocator
+    )
+{
+    gceSTATUS status;
+    gckALLOCATOR allocator;
+
+    gcmkONERROR(
+        gckALLOCATOR_Construct(Os, &CMAFSLAllocatorOperations, &allocator));
+
+    allocator->privateData = (void *)1;
+        
+    *Allocator = allocator;
+
+    return gcvSTATUS_OK;
+
+OnError:
+    return status;
+}
+
+#endif
+/***************************************************************************\
+************************ Allocator helper ***********************************
+\***************************************************************************/
+
+gceSTATUS
+gckALLOCATOR_Construct(
+    IN gckOS Os,
+    IN gcsALLOCATOR_OPERATIONS * Operations,
+    OUT gckALLOCATOR * Allocator
+    )
+{
+    gceSTATUS status;
+    gckALLOCATOR allocator;
+
+    gcmkHEADER_ARG("Os=%p, Operations=%p, Allocator=%p",
+                   Os, Operations, Allocator);
+
+    gcmkVERIFY_OBJECT(Os, gcvOBJ_OS);
+    gcmkVERIFY_ARGUMENT(Allocator != gcvNULL);
+    gcmkVERIFY_ARGUMENT
+        (  Operations
+        && Operations->Alloc
+        && Operations->Free
+        && Operations->MapUser
+        && Operations->UnmapUser
+        && Operations->MapKernel
+        && Operations->UnmapKernel
+        && Operations->LogicalToPhysical
+        && Operations->Cache
+        && Operations->Physical
+        );
+
+    gcmkONERROR(
+        gckOS_Allocate(Os, gcmSIZEOF(gckALLOCATOR), (gctPOINTER *)&allocator));
+
+    gckOS_ZeroMemory(allocator, gcmSIZEOF(gckALLOCATOR));
+
+    /* Record os. */
+    allocator->os = Os;
+
+    /* Set operations. */
+    allocator->ops = Operations;
+
+    *Allocator = allocator;
+
+    gcmkFOOTER_NO();
+    return gcvSTATUS_OK;
+
+OnError:
+    gcmkFOOTER();
+    return status;
+}
+
+/***************************************************************************\
+************************ Allocator management *******************************
+\***************************************************************************/
+
+gceSTATUS
+gckOS_ImportAllocators(
+    gckOS Os
+    )
+{
+    gceSTATUS status;
+    gctUINT i;
+    gckALLOCATOR allocator;
+
+    INIT_LIST_HEAD(&Os->allocatorList);
+
+    for (i = 0; i < gcmCOUNTOF(allocatorArray); i++)
+    {
+        if (allocatorArray[i].construct)
+        {
+            /* Construct allocator. */
+            status = allocatorArray[i].construct(Os, &allocator);
+
+            if (gcmIS_ERROR(status))
+            {
+                gcmkPRINT("["DEVICE_NAME"]: Can't construct allocator(%s)",
+                          allocatorArray[i].name);
+
+                continue;
+            }
+
+            list_add(&allocator->head, &Os->allocatorList);
+        }
+    }
+
+    return gcvSTATUS_OK;
+}
+
+gceSTATUS
+gckOS_FreeAllocators(
+    gckOS Os
+    )
+{
+    gckALLOCATOR allocator;
+    gckALLOCATOR temp;
+
+    list_for_each_entry_safe(allocator, temp, &Os->allocatorList, head)
+    {
+        list_del(&allocator->head);
+
+        /* Free private data. */
+        if (allocator->privateDataDestructor && allocator->privateData)
+        {
+            allocator->privateDataDestructor(allocator->privateData);
+        }
+
+        gckOS_Free(Os, allocator);
+    }
+
+    return gcvSTATUS_OK;
+}
+
diff --git a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_allocator.h b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_allocator.h
new file mode 100644
index 000000000000..b81e4e7e6e76
--- /dev/null
+++ b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_allocator.h
@@ -0,0 +1,393 @@
+/****************************************************************************
+*
+*    Copyright (C) 2005 - 2014 by Vivante Corp.
+*
+*    This program is free software; you can redistribute it and/or modify
+*    it under the terms of the GNU General Public License as published by
+*    the Free Software Foundation; either version 2 of the license, or
+*    (at your option) any later version.
+*
+*    This program is distributed in the hope that it will be useful,
+*    but WITHOUT ANY WARRANTY; without even the implied warranty of
+*    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+*    GNU General Public License for more details.
+*
+*    You should have received a copy of the GNU General Public License
+*    along with this program; if not write to the Free Software
+*    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*
+*****************************************************************************/
+
+
+
+#ifndef __gc_hal_kernel_allocator_h_
+#define __gc_hal_kernel_allocator_h_
+
+#include <linux/list.h>
+
+#define gcvALLOC_FLAG_CONTIGUOUS (1 << 0)
+#define gcvALLOC_FLAG_CACHEABLE  (1 << 1)
+
+/*
+* Defines
+*/
+
+typedef struct _gcsALLOCATOR * gckALLOCATOR;
+
+typedef struct _gcsALLOCATOR_OPERATIONS
+{
+    /**************************************************************************
+    **
+    ** Alloc
+    **
+    ** Allocte memory, request size is page aligned.
+    **
+    ** INPUT:
+    **
+    **    gckALLOCATOR Allocator
+    **        Pointer to an gckALLOCATOER object.
+    **
+    **    PLINUX_Mdl
+    **        Pointer to Mdl whichs stores information
+    **        about allocated memory.
+    **
+    **    gctSIZE_T NumPages
+    **        Number of pages need to allocate.
+    **
+    **    gctUINT32 Flag
+    **        Allocation option.
+    **
+    ** OUTPUT:
+    **
+    **      Nothing.
+    **
+    */
+    gceSTATUS
+    (*Alloc)(
+        IN gckALLOCATOR Allocator,
+        IN PLINUX_MDL Mdl,
+        IN gctSIZE_T NumPages,
+        IN gctUINT32 Flag
+        );
+
+    /**************************************************************************
+    **
+    ** Free
+    **
+    ** Free memory.
+    **
+    ** INPUT:
+    **
+    **     gckALLOCATOR Allocator
+    **          Pointer to an gckALLOCATOER object.
+    **
+    **     PLINUX_MDL Mdl
+    **          Mdl which stores information.
+    **
+    ** OUTPUT:
+    **
+    **      Nothing.
+    **
+    */
+    void
+    (*Free)(
+        IN gckALLOCATOR Allocator,
+        IN PLINUX_MDL Mdl
+        );
+
+    /**************************************************************************
+    **
+    ** MapUser
+    **
+    ** Map memory to user space.
+    **
+    ** INPUT:
+    **      gckALLOCATOR Allocator
+    **          Pointer to an gckALLOCATOER object.
+    **
+    **      PLINUX_MDL Mdl
+    **          Pointer to a Mdl.
+    **
+    **      PLINUX_MDL_MAP MdlMap
+    **          Pointer to a MdlMap, mapped address is stored
+    **          in MdlMap->vmaAddr
+    **
+    **      gctBOOL Cacheable
+    **          Whether this mapping is cacheable.
+    **
+    ** OUTPUT:
+    **
+    **      Nothing.
+    **
+    */
+    gctINT
+    (*MapUser)(
+        IN gckALLOCATOR Allocator,
+        IN PLINUX_MDL Mdl,
+        IN PLINUX_MDL_MAP MdlMap,
+        IN gctBOOL Cacheable
+        );
+
+    /**************************************************************************
+    **
+    ** UnmapUser
+    **
+    ** Unmap address from user address space.
+    **
+    ** INPUT:
+    **      gckALLOCATOR Allocator
+    **          Pointer to an gckALLOCATOER object.
+    **
+    **      gctPOINTER Logical
+    **          Address to be unmap
+    **
+    **      gctUINT32 Size
+    **          Size of address space
+    **
+    ** OUTPUT:
+    **
+    **      Nothing.
+    **
+    */
+    void
+    (*UnmapUser)(
+        IN gckALLOCATOR Allocator,
+        IN gctPOINTER Logical,
+        IN gctUINT32 Size
+        );
+
+    /**************************************************************************
+    **
+    ** MapKernel
+    **
+    ** Map memory to kernel space.
+    **
+    ** INPUT:
+    **      gckALLOCATOR Allocator
+    **          Pointer to an gckALLOCATOER object.
+    **
+    **      PLINUX_MDL Mdl
+    **          Pointer to a Mdl object.
+    **
+    ** OUTPUT:
+    **      gctPOINTER * Logical
+    **          Mapped kernel address.
+    */
+    gceSTATUS
+    (*MapKernel)(
+        IN gckALLOCATOR Allocator,
+        IN PLINUX_MDL Mdl,
+        OUT gctPOINTER *Logical
+        );
+
+    /**************************************************************************
+    **
+    ** UnmapKernel
+    **
+    ** Unmap memory from kernel space.
+    **
+    ** INPUT:
+    **      gckALLOCATOR Allocator
+    **          Pointer to an gckALLOCATOER object.
+    **
+    **      PLINUX_MDL Mdl
+    **          Pointer to a Mdl object.
+    **
+    **      gctPOINTER Logical
+    **          Mapped kernel address.
+    **
+    ** OUTPUT:
+    **
+    **      Nothing.
+    **
+    */
+    gceSTATUS
+    (*UnmapKernel)(
+        IN gckALLOCATOR Allocator,
+        IN PLINUX_MDL Mdl,
+        IN gctPOINTER Logical
+        );
+
+    /**************************************************************************
+    **
+    ** LogicalToPhysical
+    **
+    ** Get physical address from logical address, logical
+    ** address could be user virtual address or kernel
+    ** virtual address.
+    **
+    ** INPUT:
+    **      gckALLOCATOR Allocator
+    **          Pointer to an gckALLOCATOER object.
+    **
+    **      PLINUX_MDL Mdl
+    **          Pointer to a Mdl object.
+    **
+    **      gctPOINTER Logical
+    **          Mapped kernel address.
+    **
+    **      gctUINT32 ProcessID
+    **          pid of current process.
+    ** OUTPUT:
+    **
+    **      gctUINT32_PTR Physical
+    **          Physical address.
+    **
+    */
+    gceSTATUS
+    (*LogicalToPhysical)(
+        IN gckALLOCATOR Allocator,
+        IN PLINUX_MDL Mdl,
+        IN gctPOINTER Logical,
+        IN gctUINT32 ProcessID,
+        OUT gctUINT32_PTR Physical
+        );
+
+    /**************************************************************************
+    **
+    ** Cache
+    **
+    ** Maintain cache coherency.
+    **
+    ** INPUT:
+    **      gckALLOCATOR Allocator
+    **          Pointer to an gckALLOCATOER object.
+    **
+    **      PLINUX_MDL Mdl
+    **          Pointer to a Mdl object.
+    **
+    **      gctPOINTER Logical
+    **          Logical address, could be user address or kernel address
+    **
+    **      gctUINT32_PTR Physical
+    **          Physical address.
+    **
+    **      gctUINT32 Bytes
+    **          Size of memory region.
+    **
+    **      gceCACHEOPERATION Opertaion
+    **          Cache operation.
+    **
+    ** OUTPUT:
+    **
+    **      Nothing.
+    **
+    */
+    gceSTATUS (*Cache)(
+        IN gckALLOCATOR Allocator,
+        IN PLINUX_MDL Mdl,
+        IN gctPOINTER Logical,
+        IN gctUINT32 Physical,
+        IN gctUINT32 Bytes,
+        IN gceCACHEOPERATION Operation
+        );
+
+    /**************************************************************************
+    **
+    ** Physical
+    **
+    ** Get physical address from a offset in memory region.
+    **
+    ** INPUT:
+    **      gckALLOCATOR Allocator
+    **          Pointer to an gckALLOCATOER object.
+    **
+    **      PLINUX_MDL Mdl
+    **          Pointer to a Mdl object.
+    **
+    **      gctUINT32 Offset
+    **          Offset in this memory region.
+    **
+    ** OUTPUT:
+    **      gctUINT32_PTR Physical
+    **          Physical address.
+    **
+    */
+    gceSTATUS (*Physical)(
+        IN gckALLOCATOR Allocator,
+        IN PLINUX_MDL Mdl,
+        IN gctUINT32 Offset,
+        OUT gctUINT32_PTR Physical
+        );
+}
+gcsALLOCATOR_OPERATIONS;
+
+typedef struct _gcsALLOCATOR
+{
+    /* Pointer to gckOS Object. */
+    gckOS                     os;
+
+    /* Operations. */
+    gcsALLOCATOR_OPERATIONS*  ops;
+
+    struct list_head          head;
+
+    /* Private data used by customer allocator. */
+    void *                    privateData;
+
+    /* Private data destructor. */
+    void                      (*privateDataDestructor)(void *);
+}
+gcsALLOCATOR;
+
+typedef struct _gcsALLOCATOR_DESC
+{
+    /* Name of a allocator. */
+    char *                    name;
+
+    /* Entry function to construct a allocator. */
+    gceSTATUS                 (*construct)(gckOS, gckALLOCATOR *);
+}
+gcsALLOCATOR_DESC;
+
+/*
+* Helpers
+*/
+
+/* Fill a gcsALLOCATOR_DESC structure. */
+#define gcmkDEFINE_ALLOCATOR_DESC(Name, Construct) \
+    { \
+        .name      = Name, \
+        .construct = Construct, \
+    }
+
+/* Construct a allocator. */
+gceSTATUS
+gckALLOCATOR_Construct(
+    IN gckOS Os,
+    IN gcsALLOCATOR_OPERATIONS * Operations,
+    OUT gckALLOCATOR * Allocator
+    );
+
+/*
+    How to implement customer allocator
+
+    Build in customer alloctor
+
+        It is recommanded that customer allocator is implmented in independent
+        source file(s) which is specified by CUSOMTER_ALLOCATOR_OBJS in Kbuld.
+
+    Register gcsALLOCATOR
+
+        For each customer specified allocator, a desciption entry must be added
+        to allocatorArray defined in gc_hal_kernel_allocator_array.h.
+
+        An entry in allocatorArray is a gcsALLOCATOR_DESC structure which describes
+        name and constructor of a gckALLOCATOR object.
+
+
+    Implement gcsALLOCATOR_DESC.init()
+
+        In gcsALLOCATOR_DESC.init(), gckALLOCATOR_Construct should be called
+        to create a gckALLOCATOR object, customer specified private data can
+        be put in gcsALLOCATOR.privateData.
+
+
+    Implement gcsALLOCATOR_OPERATIONS
+
+        When call gckALLOCATOR_Construct to create a gckALLOCATOR object, a
+        gcsALLOCATOR_OPERATIONS structure must be provided whose all members
+        implemented.
+
+*/
+#endif
diff --git a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_allocator_array.h b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_allocator_array.h
new file mode 100644
index 000000000000..2e3259ffdf22
--- /dev/null
+++ b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_allocator_array.h
@@ -0,0 +1,44 @@
+/****************************************************************************
+*
+*    Copyright (C) 2005 - 2014 by Vivante Corp.
+*
+*    This program is free software; you can redistribute it and/or modify
+*    it under the terms of the GNU General Public License as published by
+*    the Free Software Foundation; either version 2 of the license, or
+*    (at your option) any later version.
+*
+*    This program is distributed in the hope that it will be useful,
+*    but WITHOUT ANY WARRANTY; without even the implied warranty of
+*    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+*    GNU General Public License for more details.
+*
+*    You should have received a copy of the GNU General Public License
+*    along with this program; if not write to the Free Software
+*    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*
+*****************************************************************************/
+
+
+
+extern gceSTATUS
+_DefaultAlloctorInit(
+    IN gckOS Os,
+    OUT gckALLOCATOR * Allocator
+    );
+
+extern gceSTATUS
+_CMAFSLAlloctorInit(
+    IN gckOS Os,
+    OUT gckALLOCATOR * Allocator
+    );
+
+gcsALLOCATOR_DESC allocatorArray[] =
+{
+    /* Default allocator. */
+    gcmkDEFINE_ALLOCATOR_DESC("default", _DefaultAlloctorInit),
+#if LINUX_CMA_FSL
+    gcmkDEFINE_ALLOCATOR_DESC("cmafsl", _CMAFSLAlloctorInit),
+#endif
+};
+
+
diff --git a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_debug.h b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_debug.h
index 794953c6171e..69fec425b5a0 100644
--- a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_debug.h
+++ b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_debug.h
@@ -92,7 +92,7 @@ typedef va_list gctARGUMENTS;
     snprintf(Destination, Size, Message, Value1, Value2, Value3)
 
 #define gcmkVSPRINTF(Destination, Size, Message, Arguments) \
-    vsnprintf(Destination, Size, Message, *(va_list *) &Arguments)
+    vsnprintf(Destination, Size, Message, *((va_list*)Arguments))
 
 #define gcmkSTRCAT(Destination, Size, String) \
     strncat(Destination, String, Size)
diff --git a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_debugfs.c b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_debugfs.c
index 3cf3f537fa34..665710129d60 100644
--- a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_debugfs.c
+++ b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_debugfs.c
@@ -102,7 +102,7 @@ typedef va_list gctDBGARGS ;
   { \
       gctDBGARGS __arguments__; \
       gcmkARGS_START(__arguments__, Message); \
-      _debugfs_res = _DebugFSPrint(ArgumentSize, Message, __arguments__);\
+      _debugfs_res = _DebugFSPrint(ArgumentSize, Message, &__arguments__);\
       gcmkARGS_END(__arguments__); \
   }
 
@@ -354,7 +354,7 @@ static ssize_t
 _DebugFSPrint (
                 IN unsigned int ArgumentSize ,
                 IN const char* Message ,
-                IN gctDBGARGS Arguments
+                IN gctDBGARGS * Arguments
 
                 )
 {
@@ -371,7 +371,7 @@ _DebugFSPrint (
     {
          return - ERESTARTSYS ;
     }
-    len = vsnprintf ( buffer , sizeof (buffer ) , Message , *( va_list * ) & Arguments ) ;
+    len = vsnprintf ( buffer , sizeof (buffer ) , Message , *( va_list * ) Arguments ) ;
     buffer[len] = '\0' ;
 
     /* Add end-of-line if missing. */
diff --git a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_device.c b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_device.c
index 49a7daf57dcc..87b01d4dcd6a 100644
--- a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_device.c
+++ b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_device.c
@@ -2360,7 +2360,7 @@ gckGALDEVICE_Start(
         /* Setup the ISR routine. */
         gcmkONERROR(gckGALDEVICE_Setup_ISR_VG(Device));
 
-#if gcdENABLE_VG        
+#if gcdENABLE_VG
         /* Switch to SUSPEND power state. */
         gcmkONERROR(gckVGHARDWARE_SetPowerManagementState(
             Device->kernels[gcvCORE_VG]->vg->hardware, gcvPOWER_OFF_BROADCAST
diff --git a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_driver.c b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_driver.c
index 9a036a60dd8a..1b0da4ffcbd0 100644
--- a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_driver.c
+++ b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_driver.c
@@ -261,17 +261,17 @@ static ssize_t show_meminfo(struct device_driver *dev, char *buf)
     size+= snprintf(buf+size, PAGE_SIZE-size,"Reseverd memory information:\n");
     size+= snprintf(buf+size, PAGE_SIZE-size,"Type\r\tbaseaddress\r\t\t\tsize(bytes)\r\t\t\t\t\tused(bytes)\r\t\t\t\t\t\t\tfree(bytes)\n");
     if(galDevice->internalVidMem)
-       size+= snprintf(buf+size, PAGE_SIZE-size,"Internal\r\t0x%x\r\t\t\t%lu\r\t\t\t\t\t%lu\r\t\t\t\t\t\t\t%lu\n",
+       size+= snprintf(buf+size, PAGE_SIZE-size,"Internal\r\t0x%x\r\t\t\t%u\r\t\t\t\t\t%u\r\t\t\t\t\t\t\t%u\n",
             galDevice->internalVidMem->baseAddress,galDevice->internalVidMem->bytes,
             galDevice->internalVidMem->bytes-galDevice->internalVidMem->freeBytes,
             galDevice->internalVidMem->freeBytes);
     if(galDevice->externalVidMem)
-       size+= snprintf(buf+size, PAGE_SIZE-size,"External\r\t0x%x\r\t\t\t%lu\r\t\t\t\t\t%lu\r\t\t\t\t\t\t\t%lu\n",
+       size+= snprintf(buf+size, PAGE_SIZE-size,"External\r\t0x%x\r\t\t\t%u\r\t\t\t\t\t%u\r\t\t\t\t\t\t\t%u\n",
             galDevice->externalVidMem->baseAddress,galDevice->externalVidMem->bytes,
             galDevice->externalVidMem->bytes-galDevice->externalVidMem->freeBytes,
             galDevice->externalVidMem->freeBytes);
     if(galDevice->contiguousVidMem)
-       size+= snprintf(buf+size, PAGE_SIZE-size,"System\r\t0x%x\r\t\t\t%lu\r\t\t\t\t\t%lu\r\t\t\t\t\t\t\t%lu\n",
+       size+= snprintf(buf+size, PAGE_SIZE-size,"System\r\t0x%x\r\t\t\t%u\r\t\t\t\t\t%u\r\t\t\t\t\t\t\t%u\n",
             galDevice->contiguousVidMem ->baseAddress,galDevice->contiguousVidMem->bytes,
             galDevice->contiguousVidMem->bytes-galDevice->contiguousVidMem->freeBytes,
             galDevice->contiguousVidMem->freeBytes);
@@ -280,15 +280,15 @@ static ssize_t show_meminfo(struct device_driver *dev, char *buf)
     size+= snprintf(buf+size, PAGE_SIZE-size,"Dynamic memory information:\n");
 
     size+= snprintf(buf+size, PAGE_SIZE-size,"Type\r\t\t\t\t\tused size(bytes)\n");
-    size+= snprintf(buf+size, PAGE_SIZE-size,"Cached memory\r\t\t\t\t\t%lu\n",  galDevice->cachedsize);
-    size+= snprintf(buf+size, PAGE_SIZE-size,"Non paged memory\r\t\t\t\t\t%lu\n",  galDevice->nonpagedmemorysize);
+    size+= snprintf(buf+size, PAGE_SIZE-size,"Cached memory\r\t\t\t\t\t%u\n",  galDevice->cachedsize);
+    size+= snprintf(buf+size, PAGE_SIZE-size,"Non paged memory\r\t\t\t\t\t%u\n",  galDevice->nonpagedmemorysize);
 #if LINUX_CMA_FSL
-    size+= snprintf(buf+size, PAGE_SIZE-size,"CMA memory\r\t\t\t\t\t%lu\n",  galDevice->cmasize);
+    size+= snprintf(buf+size, PAGE_SIZE-size,"CMA memory\r\t\t\t\t\t%u\n",  galDevice->cmasize);
 #endif
-    size+= snprintf(buf+size, PAGE_SIZE-size,"Contiguous paged memory(low)\r\t\t\t\t\t%lu\n",  galDevice->contiguouslowmemsize);
-    size+= snprintf(buf+size, PAGE_SIZE-size,"Contiguous paged memory(high)\r\t\t\t\t\t%lu\n",  galDevice->contiguoushighmemsize);
-    size+= snprintf(buf+size, PAGE_SIZE-size,"NonContiguous paged memory(low)\r\t\t\t\t\t%lu\n",  galDevice->noncontiguouslowmemsize);
-    size+= snprintf(buf+size, PAGE_SIZE-size,"NonContiguous paged memory(high)\r\t\t\t\t\t%lu\n",  galDevice->noncontiguoushighmemsize);
+    size+= snprintf(buf+size, PAGE_SIZE-size,"Contiguous paged memory(low)\r\t\t\t\t\t%u\n",  galDevice->contiguouslowmemsize);
+    size+= snprintf(buf+size, PAGE_SIZE-size,"Contiguous paged memory(high)\r\t\t\t\t\t%u\n",  galDevice->contiguoushighmemsize);
+    size+= snprintf(buf+size, PAGE_SIZE-size,"NonContiguous paged memory(low)\r\t\t\t\t\t%u\n",  galDevice->noncontiguouslowmemsize);
+    size+= snprintf(buf+size, PAGE_SIZE-size,"NonContiguous paged memory(high)\r\t\t\t\t\t%u\n",  galDevice->noncontiguoushighmemsize);
 #endif
     return strlen(buf);
 }
@@ -506,12 +506,15 @@ int drv_open(
 
     if ((!galDevice->contiguousMapped) && galDevice->contiguousSize)
     {
-        gcmkONERROR(gckOS_MapMemory(
-            galDevice->os,
-            galDevice->contiguousPhysical,
-            galDevice->contiguousSize,
-            &data->contiguousLogical
-            ));
+        if (galDevice->contiguousPhysical != gcvNULL)
+        {
+            gcmkONERROR(gckOS_MapMemory(
+                galDevice->os,
+                galDevice->contiguousPhysical,
+                galDevice->contiguousSize,
+                &data->contiguousLogical
+                ));
+        }
     }
 
     filp->private_data = data;
@@ -1127,8 +1130,9 @@ static int drv_init(struct device *pdev)
 #endif
 
 
+
     /* Register the character device. */
-    ret = register_chrdev(major, DRV_NAME, &driver_fops);
+    ret = register_chrdev(major, DEVICE_NAME, &driver_fops);
 
     if (ret < 0)
     {
@@ -1161,9 +1165,9 @@ static int drv_init(struct device *pdev)
     }
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
-    device_create(device_class, NULL, MKDEV(major, 0), NULL, "galcore");
+    device_create(device_class, NULL, MKDEV(major, 0), NULL, DEVICE_NAME);
 #else
-    device_create(device_class, NULL, MKDEV(major, 0), "galcore");
+    device_create(device_class, NULL, MKDEV(major, 0), DEVICE_NAME);
 #endif
 
     galDevice = device;
@@ -1224,7 +1228,7 @@ static void drv_exit(void)
     device_destroy(gpuClass, MKDEV(major, 0));
     class_destroy(gpuClass);
 
-    unregister_chrdev(major, DRV_NAME);
+    unregister_chrdev(major, DEVICE_NAME);
 
     gcmkVERIFY_OK(gckGALDEVICE_Stop(galDevice));
     gcmkVERIFY_OK(gckGALDEVICE_Destroy(galDevice));
@@ -1256,15 +1260,9 @@ static void drv_exit(void)
     module_exit(drv_exit);
 #else
 
-#ifdef CONFIG_DOVE_GPU
-#   define DEVICE_NAME "dove_gpu"
-#else
-#   define DEVICE_NAME "galcore"
-#endif
-
 #if gcdENABLE_FSCALE_VAL_ADJUST
 static int thermal_hot_pm_notify(struct notifier_block *nb, unsigned long event,
-        void *dummy)
+       void *dummy)
 {
     static gctUINT orgFscale, minFscale, maxFscale;
     static gctBOOL bAlreadyTooHot = gcvFALSE;
@@ -1289,6 +1287,7 @@ static struct notifier_block thermal_hot_pm_notifier = {
 #endif
 
 
+
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 static int gpu_probe(struct platform_device *pdev)
 #else
@@ -1299,14 +1298,15 @@ static int __devinit gpu_probe(struct platform_device *pdev)
     struct resource* res;
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,0)
-        struct contiguous_mem_pool *pool;
-        struct reset_control *rstc;
+       struct contiguous_mem_pool *pool;
+       struct reset_control *rstc;
 #elif LINUX_VERSION_CODE >= KERNEL_VERSION(3,5,0)
-        struct device_node *dn =pdev->dev.of_node;
-        const u32 *prop;
+       struct device_node *dn =pdev->dev.of_node;
+       const u32 *prop;
 #else
-        struct viv_gpu_platform_data *pdata;
+       struct viv_gpu_platform_data *pdata;
 #endif
+
     gcmkHEADER();
 
     res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "phys_baseaddr");
@@ -1365,10 +1365,10 @@ static int __devinit gpu_probe(struct platform_device *pdev)
         }
         dev_set_drvdata(&pdev->dev, pool);
 #elif LINUX_VERSION_CODE >= KERNEL_VERSION(3,5,0)
-        prop = of_get_property(dn, "contiguousbase", NULL);
-        if(prop)
-                contiguousBase = *prop;
-        of_property_read_u32(dn,"contiguoussize", (u32 *)&contiguousSize);
+       prop = of_get_property(dn, "contiguousbase", NULL);
+       if(prop)
+               contiguousBase = *prop;
+       of_property_read_u32(dn,"contiguoussize", (u32 *)&contiguousSize);
 #else
     pdata = pdev->dev.platform_data;
     if (pdata) {
@@ -1389,9 +1389,11 @@ static int __devinit gpu_probe(struct platform_device *pdev)
         rstc = devm_reset_control_get(&pdev->dev, "gpu2d");
         galDevice->rstc[gcvCORE_2D] = IS_ERR(rstc) ? NULL : rstc;
 
+
         rstc = devm_reset_control_get(&pdev->dev, "gpuvg");
         galDevice->rstc[gcvCORE_VG] = IS_ERR(rstc) ? NULL : rstc;
 #endif
+
         platform_set_drvdata(pdev, galDevice);
 
 #if gcdENABLE_FSCALE_VAL_ADJUST
@@ -1414,6 +1416,7 @@ static int __devinit gpu_probe(struct platform_device *pdev)
         gcmkFOOTER_NO();
         return ret;
     }
+
 #if gcdENABLE_FSCALE_VAL_ADJUST
     UNREG_THERMAL_NOTIFIER(&thermal_hot_pm_notifier);
 #endif
diff --git a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_linux.c b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_linux.c
index ba2a0272da2c..2e7fd157d609 100644
--- a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_linux.c
+++ b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_linux.c
@@ -257,13 +257,14 @@ gckKERNEL_MapVideoMemoryEx(
     OUT gctPOINTER * Logical
     )
 {
-    gckGALDEVICE device;
-    PLINUX_MDL mdl;
-    PLINUX_MDL_MAP mdlMap;
-    gcePOOL pool;
-    gctUINT32 offset, base;
+    gckGALDEVICE device   = gcvNULL;
+    PLINUX_MDL mdl        = gcvNULL;
+    PLINUX_MDL_MAP mdlMap = gcvNULL;
+    gcePOOL pool          = gcvPOOL_UNKNOWN;
+    gctUINT32 offset      = 0;
+    gctUINT32 base        = 0;
     gceSTATUS status;
-    gctPOINTER logical;
+    gctPOINTER logical    = gcvNULL;
 
     gcmkHEADER_ARG("Kernel=%p InUserSpace=%d Address=%08x",
                    Kernel, InUserSpace, Address);
diff --git a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_linux.h b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_linux.h
index 6f7cafdd28d5..58150483bf7c 100644
--- a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_linux.h
+++ b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_linux.h
@@ -38,6 +38,8 @@
 #include <linux/dma-mapping.h>
 #include <linux/kthread.h>
 
+#include <linux/idr.h>
+
 #ifdef MODVERSIONS
 #  include <linux/modversions.h>
 #endif
@@ -70,7 +72,11 @@
 
 #define countof(a)                    (sizeof(a) / sizeof(a[0]))
 
-#define DRV_NAME                      "galcore"
+#ifdef CONFIG_DOVE_GPU
+#   define DEVICE_NAME              "dove_gpu"
+#else
+#   define DEVICE_NAME              "galcore"
+#endif
 
 #define GetPageCount(size, offset)     ((((size) + ((offset) & ~PAGE_CACHE_MASK)) + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT)
 
@@ -80,4 +86,295 @@
 #define gcdVM_FLAGS (VM_IO | VM_DONTCOPY | VM_DONTEXPAND | VM_RESERVED)
 #endif
 
+/* Protection bit when mapping memroy to user sapce */
+#define gcmkPAGED_MEMROY_PROT(x)    pgprot_writecombine(x)
+
+#if gcdNONPAGED_MEMORY_BUFFERABLE
+#define gcmkIOREMAP                 ioremap_wc
+#define gcmkNONPAGED_MEMROY_PROT(x) pgprot_writecombine(x)
+#elif !gcdNONPAGED_MEMORY_CACHEABLE
+#define gcmkIOREMAP                 ioremap_nocache
+#define gcmkNONPAGED_MEMROY_PROT(x) pgprot_noncached(x)
+#endif
+
+#define gcdSUPPRESS_OOM_MESSAGE 1
+
+#if gcdSUPPRESS_OOM_MESSAGE
+#define gcdNOWARN __GFP_NOWARN
+#else
+#define gcdNOWARN 0
+#endif
+
+#define gcdUSE_NON_PAGED_MEMORY_CACHE 0
+
+/******************************************************************************\
+********************************** Structures **********************************
+\******************************************************************************/
+#if gcdUSE_NON_PAGED_MEMORY_CACHE
+typedef struct _gcsNonPagedMemoryCache
+{
+#ifndef NO_DMA_COHERENT
+    gctINT                           size;
+    gctSTRING                        addr;
+    dma_addr_t                       dmaHandle;
+#else
+    long                             order;
+    struct page *                    page;
+#endif
+
+    struct _gcsNonPagedMemoryCache * prev;
+    struct _gcsNonPagedMemoryCache * next;
+}
+gcsNonPagedMemoryCache;
+#endif /* gcdUSE_NON_PAGED_MEMORY_CACHE */
+
+typedef struct _gcsUSER_MAPPING * gcsUSER_MAPPING_PTR;
+typedef struct _gcsUSER_MAPPING
+{
+    /* Pointer to next mapping structure. */
+    gcsUSER_MAPPING_PTR         next;
+
+    /* Physical address of this mapping. */
+    gctUINT32                   physical;
+
+    /* Logical address of this mapping. */
+    gctPOINTER                  logical;
+
+    /* Number of bytes of this mapping. */
+    gctSIZE_T                   bytes;
+
+    /* Starting address of this mapping. */
+    gctINT8_PTR                 start;
+
+    /* Ending address of this mapping. */
+    gctINT8_PTR                 end;
+}
+gcsUSER_MAPPING;
+
+typedef struct _gcsINTEGER_DB * gcsINTEGER_DB_PTR;
+typedef struct _gcsINTEGER_DB
+{
+    struct idr                  idr;
+    spinlock_t                  lock;
+    gctINT                      curr;
+}
+gcsINTEGER_DB;
+
+struct _gckOS
+{
+    /* Object. */
+    gcsOBJECT                   object;
+
+    /* Pointer to device */
+    gckGALDEVICE                device;
+
+    /* Memory management */
+    gctPOINTER                  memoryLock;
+    gctPOINTER                  memoryMapLock;
+
+    struct _LINUX_MDL           *mdlHead;
+    struct _LINUX_MDL           *mdlTail;
+
+    /* Kernel process ID. */
+    gctUINT32                   kernelProcessID;
+
+    /* Signal management. */
+
+    /* Lock. */
+    gctPOINTER                  signalMutex;
+
+    /* signal id database. */
+    gcsINTEGER_DB               signalDB;
+
+#if gcdANDROID_NATIVE_FENCE_SYNC
+    /* Lock. */
+    gctPOINTER                  syncPointMutex;
+
+    /* sync point id database. */
+    gcsINTEGER_DB               syncPointDB;
+#endif
+
+    gcsUSER_MAPPING_PTR         userMap;
+    gctPOINTER                  debugLock;
+
+#if gcdUSE_NON_PAGED_MEMORY_CACHE
+    gctUINT                      cacheSize;
+    gcsNonPagedMemoryCache *     cacheHead;
+    gcsNonPagedMemoryCache *     cacheTail;
+#endif
+
+    /* workqueue for os timer. */
+    struct workqueue_struct *   workqueue;
+
+    /* Allocate extra page to avoid cache overflow */
+    struct page* paddingPage;
+
+    /* Detect unfreed allocation. */
+    atomic_t                    allocateCount;
+
+    struct list_head            allocatorList;
+};
+
+typedef struct _gcsSIGNAL * gcsSIGNAL_PTR;
+typedef struct _gcsSIGNAL
+{
+    /* Kernel sync primitive. */
+    struct completion obj;
+
+    /* Manual reset flag. */
+    gctBOOL manualReset;
+
+    /* The reference counter. */
+    atomic_t ref;
+
+    /* The owner of the signal. */
+    gctHANDLE process;
+
+    gckHARDWARE hardware;
+
+    /* ID. */
+    gctUINT32 id;
+}
+gcsSIGNAL;
+
+#if gcdANDROID_NATIVE_FENCE_SYNC
+typedef struct _gcsSYNC_POINT * gcsSYNC_POINT_PTR;
+typedef struct _gcsSYNC_POINT
+{
+    /* The reference counter. */
+    atomic_t ref;
+
+    /* State. */
+    atomic_t state;
+
+    /* timeline. */
+    struct sync_timeline * timeline;
+
+    /* ID. */
+    gctUINT32 id;
+}
+gcsSYNC_POINT;
+#endif
+
+typedef struct _gcsPageInfo * gcsPageInfo_PTR;
+typedef struct _gcsPageInfo
+{
+    struct page **pages;
+    gctUINT32_PTR pageTable;
+    gctUINT32   extraPage;
+    gctUINT32 address;
+#if gcdPROCESS_ADDRESS_SPACE
+    gckMMU mmu;
+#endif
+}
+gcsPageInfo;
+
+typedef struct _gcsOSTIMER * gcsOSTIMER_PTR;
+typedef struct _gcsOSTIMER
+{
+    struct delayed_work     work;
+    gctTIMERFUNCTION        function;
+    gctPOINTER              data;
+} gcsOSTIMER;
+
+gceSTATUS
+gckOS_ImportAllocators(
+    gckOS Os
+    );
+
+gceSTATUS
+gckOS_FreeAllocators(
+    gckOS Os
+    );
+
+gceSTATUS
+_HandleOuterCache(
+    IN gckOS Os,
+    IN gctUINT32 Physical,
+    IN gctPOINTER Logical,
+    IN gctSIZE_T Bytes,
+    IN gceCACHEOPERATION Type
+    );
+
+gceSTATUS
+_ConvertLogical2Physical(
+    IN gckOS Os,
+    IN gctPOINTER Logical,
+    IN gctUINT32 ProcessID,
+    IN PLINUX_MDL Mdl,
+    OUT gctUINT32_PTR Physical
+    );
+
+gctSTRING
+_CreateKernelVirtualMapping(
+    IN PLINUX_MDL Mdl
+    );
+
+void
+_DestoryKernelVirtualMapping(
+    IN gctSTRING Addr
+    );
+
+void
+_UnmapUserLogical(
+    IN gctPOINTER Logical,
+    IN gctUINT32  Size
+    );
+
+static inline gctINT
+_GetProcessID(
+    void
+    )
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
+    return task_tgid_vnr(current);
+#else
+    return current->tgid;
+#endif
+}
+
+static inline struct page *
+_NonContiguousToPage(
+    IN struct page ** Pages,
+    IN gctUINT32 Index
+    )
+{
+    gcmkASSERT(Pages != gcvNULL);
+    return Pages[Index];
+}
+
+static inline unsigned long
+_NonContiguousToPfn(
+    IN struct page ** Pages,
+    IN gctUINT32 Index
+    )
+{
+    gcmkASSERT(Pages != gcvNULL);
+    return page_to_pfn(_NonContiguousToPage(Pages, Index));
+}
+
+static inline unsigned long
+_NonContiguousToPhys(
+    IN struct page ** Pages,
+    IN gctUINT32 Index
+    )
+{
+    gcmkASSERT(Pages != gcvNULL);
+    return page_to_phys(_NonContiguousToPage(Pages, Index));
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,25)
+static inline int
+is_vmalloc_addr(
+    void *Addr
+    )
+{
+    unsigned long addr = (unsigned long)Addr;
+
+    return addr >= VMALLOC_START && addr < VMALLOC_END;
+}
+#endif
+
+
+
 #endif /* __gc_hal_kernel_linux_h_ */
diff --git a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_os.c b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_os.c
index eda7e53c6f55..a1476d20604f 100644
--- a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_os.c
+++ b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_os.c
@@ -28,12 +28,10 @@
 #include <asm/atomic.h>
 #include <linux/dma-mapping.h>
 #include <linux/slab.h>
-#include <linux/idr.h>
 #if LINUX_VERSION_CODE < KERNEL_VERSION(3,10,0)
 #include <mach/hardware.h>
 #endif
 #include <linux/workqueue.h>
-#include <linux/idr.h>
 #include <linux/irqflags.h>
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,23)
 #include <linux/math64.h>
@@ -54,6 +52,8 @@ static inline void imx_gpc_power_up_pu(bool flag) {}
 
 #define _GC_OBJ_ZONE    gcvZONE_OS
 
+#include "gc_hal_kernel_allocator.h"
+
 /*******************************************************************************
 ***** Version Signature *******************************************************/
 
@@ -63,7 +63,6 @@ const char * _PLATFORM = "\n\0$PLATFORM$Android$\n";
 const char * _PLATFORM = "\n\0$PLATFORM$Linux$\n";
 #endif
 
-#define gcdSUPPRESS_OOM_MESSAGE 1
 
 #define MEMORY_LOCK(os) \
     gcmkVERIFY_OK(gckOS_AcquireMutex( \
@@ -83,209 +82,11 @@ const char * _PLATFORM = "\n\0$PLATFORM$Linux$\n";
 #define MEMORY_MAP_UNLOCK(os) \
     gcmkVERIFY_OK(gckOS_ReleaseMutex((os), (os)->memoryMapLock))
 
-/* Protection bit when mapping memroy to user sapce */
-#define gcmkPAGED_MEMROY_PROT(x)    pgprot_writecombine(x)
-
-#if gcdNONPAGED_MEMORY_BUFFERABLE
-#define gcmkIOREMAP                 ioremap_wc
-#define gcmkNONPAGED_MEMROY_PROT(x) pgprot_writecombine(x)
-#elif !gcdNONPAGED_MEMORY_CACHEABLE
-#define gcmkIOREMAP                 ioremap_nocache
-#define gcmkNONPAGED_MEMROY_PROT(x) pgprot_noncached(x)
-#endif
-
-#if gcdSUPPRESS_OOM_MESSAGE
-#define gcdNOWARN __GFP_NOWARN
-#else
-#define gcdNOWARN 0
-#endif
-
-#define gcdUSE_NON_PAGED_MEMORY_CACHE 10
-
-/******************************************************************************\
-********************************** Structures **********************************
-\******************************************************************************/
-#if gcdUSE_NON_PAGED_MEMORY_CACHE
-typedef struct _gcsNonPagedMemoryCache
-{
-#ifndef NO_DMA_COHERENT
-    gctINT                           size;
-    gctSTRING                        addr;
-    dma_addr_t                       dmaHandle;
-#else
-    long                             order;
-    struct page *                    page;
-#endif
-
-    struct _gcsNonPagedMemoryCache * prev;
-    struct _gcsNonPagedMemoryCache * next;
-}
-gcsNonPagedMemoryCache;
-#endif /* gcdUSE_NON_PAGED_MEMORY_CACHE */
-
-typedef struct _gcsUSER_MAPPING * gcsUSER_MAPPING_PTR;
-typedef struct _gcsUSER_MAPPING
-{
-    /* Pointer to next mapping structure. */
-    gcsUSER_MAPPING_PTR         next;
-
-    /* Physical address of this mapping. */
-    gctUINT32                   physical;
-
-    /* Logical address of this mapping. */
-    gctPOINTER                  logical;
-
-    /* Number of bytes of this mapping. */
-    gctSIZE_T                   bytes;
-
-    /* Starting address of this mapping. */
-    gctINT8_PTR                 start;
-
-    /* Ending address of this mapping. */
-    gctINT8_PTR                 end;
-}
-gcsUSER_MAPPING;
-
-typedef struct _gcsINTEGER_DB * gcsINTEGER_DB_PTR;
-typedef struct _gcsINTEGER_DB
-{
-    struct idr                  idr;
-    spinlock_t                  lock;
-    gctINT                      curr;
-}
-gcsINTEGER_DB;
-
-struct _gckOS
-{
-    /* Object. */
-    gcsOBJECT                   object;
-
-    /* Pointer to device */
-    gckGALDEVICE                device;
-
-    /* Memory management */
-    gctPOINTER                  memoryLock;
-    gctPOINTER                  memoryMapLock;
-
-    struct _LINUX_MDL           *mdlHead;
-    struct _LINUX_MDL           *mdlTail;
-
-    /* Kernel process ID. */
-    gctUINT32                   kernelProcessID;
-
-    /* Signal management. */
-
-    /* Lock. */
-    gctPOINTER                  signalMutex;
-
-    /* signal id database. */
-    gcsINTEGER_DB               signalDB;
-
-#if gcdANDROID_NATIVE_FENCE_SYNC
-    /* Lock. */
-    gctPOINTER                  syncPointMutex;
-
-    /* sync point id database. */
-    gcsINTEGER_DB               syncPointDB;
-#endif
-
-    gcsUSER_MAPPING_PTR         userMap;
-    gctPOINTER                  debugLock;
-
-#if gcdUSE_NON_PAGED_MEMORY_CACHE
-    gctUINT                      cacheSize;
-    gcsNonPagedMemoryCache *     cacheHead;
-    gcsNonPagedMemoryCache *     cacheTail;
-#endif
-
-    /* workqueue for os timer. */
-    struct workqueue_struct *   workqueue;
-
-    /* Allocate extra page to avoid cache overflow */
-    struct page* paddingPage;
-
-    /* Detect unfreed allocation. */
-    atomic_t                    allocateCount;
-};
-
-typedef struct _gcsSIGNAL * gcsSIGNAL_PTR;
-typedef struct _gcsSIGNAL
-{
-    /* Kernel sync primitive. */
-    struct completion obj;
-
-    /* Manual reset flag. */
-    gctBOOL manualReset;
-
-    /* The reference counter. */
-    atomic_t ref;
-
-    /* The owner of the signal. */
-    gctHANDLE process;
-
-    gckHARDWARE hardware;
-
-    /* ID. */
-    gctUINT32 id;
-}
-gcsSIGNAL;
-
-#if gcdANDROID_NATIVE_FENCE_SYNC
-typedef struct _gcsSYNC_POINT * gcsSYNC_POINT_PTR;
-typedef struct _gcsSYNC_POINT
-{
-    /* The reference counter. */
-    atomic_t ref;
-
-    /* State. */
-    atomic_t state;
-
-    /* timeline. */
-    struct sync_timeline * timeline;
-
-    /* ID. */
-    gctUINT32 id;
-}
-gcsSYNC_POINT;
-#endif
-
-typedef struct _gcsPageInfo * gcsPageInfo_PTR;
-typedef struct _gcsPageInfo
-{
-    struct page **pages;
-    gctUINT32_PTR pageTable;
-    gctUINT32   extraPage;
-#if gcdPROCESS_ADDRESS_SPACE
-    gctUINT32 address;
-    gckMMU mmu;
-#endif
-}
-gcsPageInfo;
-
-typedef struct _gcsOSTIMER * gcsOSTIMER_PTR;
-typedef struct _gcsOSTIMER
-{
-    struct delayed_work     work;
-    gctTIMERFUNCTION        function;
-    gctPOINTER              data;
-} gcsOSTIMER;
 
 /******************************************************************************\
 ******************************* Private Functions ******************************
 \******************************************************************************/
 static gctINT
-_GetProcessID(
-    void
-    )
-{
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
-    return task_tgid_vnr(current);
-#else
-    return current->tgid;
-#endif
-}
-
-static gctINT
 _GetThreadID(
     void
     )
@@ -445,140 +246,6 @@ FindMdlMap(
     return gcvNULL;
 }
 
-void
-OnProcessExit(
-    IN gckOS Os,
-    IN gckKERNEL Kernel
-    )
-{
-}
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,25)
-static inline int
-is_vmalloc_addr(
-    void *Addr
-    )
-{
-    unsigned long addr = (unsigned long)Addr;
-
-    return addr >= VMALLOC_START && addr < VMALLOC_END;
-}
-#endif
-
-static void
-_NonContiguousFree(
-    IN struct page ** Pages,
-    IN gctUINT32 NumPages
-    )
-{
-    gctINT i;
-
-    gcmkHEADER_ARG("Pages=0x%X, NumPages=%d", Pages, NumPages);
-
-    gcmkASSERT(Pages != gcvNULL);
-
-    for (i = 0; i < NumPages; i++)
-    {
-        __free_page(Pages[i]);
-    }
-
-    if (is_vmalloc_addr(Pages))
-    {
-        vfree(Pages);
-    }
-    else
-    {
-        kfree(Pages);
-    }
-
-    gcmkFOOTER_NO();
-}
-
-static struct page **
-_NonContiguousAlloc(
-    IN gctUINT32 NumPages
-    )
-{
-    struct page ** pages;
-    struct page *p;
-    gctINT i, size;
-
-    gcmkHEADER_ARG("NumPages=%lu", NumPages);
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
-    if (NumPages > totalram_pages)
-#else
-    if (NumPages > num_physpages)
-#endif
-    {
-        gcmkFOOTER_NO();
-        return gcvNULL;
-    }
-
-    size = NumPages * sizeof(struct page *);
-
-    pages = kmalloc(size, GFP_KERNEL | gcdNOWARN);
-
-    if (!pages)
-    {
-        pages = vmalloc(size);
-
-        if (!pages)
-        {
-            gcmkFOOTER_NO();
-            return gcvNULL;
-        }
-    }
-
-    for (i = 0; i < NumPages; i++)
-    {
-        p = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | gcdNOWARN);
-
-        if (!p)
-        {
-            _NonContiguousFree(pages, i);
-            gcmkFOOTER_NO();
-            return gcvNULL;
-        }
-
-        pages[i] = p;
-    }
-
-    gcmkFOOTER_ARG("pages=0x%X", pages);
-    return pages;
-}
-
-static inline struct page *
-_NonContiguousToPage(
-    IN struct page ** Pages,
-    IN gctUINT32 Index
-    )
-{
-    gcmkASSERT(Pages != gcvNULL);
-    return Pages[Index];
-}
-
-static inline unsigned long
-_NonContiguousToPfn(
-    IN struct page ** Pages,
-    IN gctUINT32 Index
-    )
-{
-    gcmkASSERT(Pages != gcvNULL);
-    return page_to_pfn(_NonContiguousToPage(Pages, Index));
-}
-
-static inline unsigned long
-_NonContiguousToPhys(
-    IN struct page ** Pages,
-    IN gctUINT32 Index
-    )
-{
-    gcmkASSERT(Pages != gcvNULL);
-    return page_to_phys(_NonContiguousToPage(Pages, Index));
-}
-
-
 #if gcdUSE_NON_PAGED_MEMORY_CACHE
 
 static gctBOOL
@@ -916,42 +583,6 @@ _DestroyIntegerId(
     return gcvSTATUS_OK;
 }
 
-static void
-_UnmapUserLogical(
-    IN gctINT Pid,
-    IN gctPOINTER Logical,
-    IN gctUINT32  Size
-)
-{
-    if (unlikely(current->mm == gcvNULL))
-    {
-        /* Do nothing if process is exiting. */
-        return;
-    }
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,5,0)
-    if (vm_munmap((unsigned long)Logical, Size) < 0)
-    {
-        gcmkTRACE_ZONE(
-                gcvLEVEL_WARNING, gcvZONE_OS,
-                "%s(%d): vm_munmap failed",
-                __FUNCTION__, __LINE__
-                );
-    }
-#else
-    down_write(&current->mm->mmap_sem);
-    if (do_munmap(current->mm, (unsigned long)Logical, Size) < 0)
-    {
-        gcmkTRACE_ZONE(
-                gcvLEVEL_WARNING, gcvZONE_OS,
-                "%s(%d): do_munmap failed",
-                __FUNCTION__, __LINE__
-                );
-    }
-    up_write(&current->mm->mmap_sem);
-#endif
-}
-
 gceSTATUS
 _QueryProcessPageTable(
     IN gctPOINTER Logical,
@@ -1055,7 +686,7 @@ outer_func(
 **      gceOUTERCACHE_OPERATION Type
 **          Operation need to be execute.
 */
-static gceSTATUS
+gceSTATUS
 _HandleOuterCache(
     IN gckOS Os,
     IN gctUINT32 Physical,
@@ -1232,6 +863,8 @@ gckOS_Construct(
         SetPageReserved(os->paddingPage);
     }
 
+    gckOS_ImportAllocators(os);
+
     /* Return pointer to the gckOS object. */
     *Os = os;
 
@@ -1350,17 +983,14 @@ gckOS_Destroy(
     /* Destory work queue. */
     destroy_workqueue(Os->workqueue);
 
+    gckOS_FreeAllocators(Os);
+
     /* Flush the debug cache. */
     gcmkDEBUGFLUSH(~0U);
 
     /* Mark the gckOS object as unknown. */
     Os->object.type = gcvOBJ_UNKNOWN;
 
-    if (atomic_read(&Os->allocateCount) != 0)
-    {
-        gcmkPRINT("[galcore]: Memory leak detected, %d allocation not freed",
-                  atomic_read(&Os->allocateCount));
-    }
 
     /* Free the gckOS object. */
     kfree(Os);
@@ -1370,109 +1000,73 @@ gckOS_Destroy(
     return gcvSTATUS_OK;
 }
 
-static gctSTRING
-_CreateKernelVirtualMapping(
-    IN PLINUX_MDL Mdl
+gceSTATUS
+gckOS_CreateKernelVirtualMapping(
+    IN gckOS Os,
+    IN gctPHYS_ADDR Physical,
+    IN gctSIZE_T Bytes,
+    OUT gctPOINTER * Logical,
+    OUT gctSIZE_T * PageCount
     )
 {
-    gctSTRING addr = 0;
-    gctINT numPages = Mdl->numPages;
-
-#if gcdNONPAGED_MEMORY_CACHEABLE
-    if (Mdl->contiguous)
-    {
-        addr = page_address(Mdl->u.contiguousPages);
-    }
-    else
-    {
-        addr = vmap(Mdl->u.nonContiguousPages,
-                    numPages,
-                    0,
-                    PAGE_KERNEL);
-
-        /* Trigger a page fault. */
-        memset(addr, 0, numPages * PAGE_SIZE);
-    }
-#else
-    struct page ** pages;
-    gctBOOL free = gcvFALSE;
-    gctINT i;
-
-    if (Mdl->contiguous)
-    {
-        if(Mdl->addr)
-        {
-            /*for the memory allocated from DMA, there is no contiguousPages,
-            but the kernel virtual address is already got*/
-            return Mdl->addr;
-        }
-        pages = kmalloc(sizeof(struct page *) * numPages, GFP_KERNEL | gcdNOWARN);
-
-        if (!pages)
-        {
-            return gcvNULL;
-        }
-
-        for (i = 0; i < numPages; i++)
-        {
-            pages[i] = nth_page(Mdl->u.contiguousPages, i);
-        }
+    gceSTATUS status;
+    PLINUX_MDL mdl = (PLINUX_MDL)Physical;
+    gckALLOCATOR allocator = mdl->allocator;
 
-        free = gcvTRUE;
-    }
-    else
-    {
-        pages = Mdl->u.nonContiguousPages;
-    }
+    gcmkHEADER();
 
-    /* ioremap() can't work on system memory since 2.6.38. */
-    addr = vmap(pages, numPages, 0, gcmkNONPAGED_MEMROY_PROT(PAGE_KERNEL));
+    *PageCount = mdl->numPages;
 
-    if (free)
-    {
-        kfree(pages);
-    }
+    gcmkONERROR(allocator->ops->MapKernel(allocator, mdl, Logical));
 
-#endif
+    gcmkFOOTER_NO();
+    return gcvSTATUS_OK;
 
-    return addr;
+OnError:
+    gcmkFOOTER();
+    return status;
 }
 
-static void
-_DestoryKernelVirtualMapping(
-    IN PLINUX_MDL Mdl,
-    IN gctSTRING Addr
+gceSTATUS
+gckOS_DestroyKernelVirtualMapping(
+    IN gckOS Os,
+    IN gctPHYS_ADDR Physical,
+    IN gctSIZE_T Bytes,
+    IN gctPOINTER Logical
     )
 {
-#if !gcdNONPAGED_MEMORY_CACHEABLE
-    if(!Mdl->addr)
-        vunmap(Addr);
-#endif
+    PLINUX_MDL mdl = (PLINUX_MDL)Physical;
+    gckALLOCATOR allocator = mdl->allocator;
+
+    gcmkHEADER();
+
+    allocator->ops->UnmapKernel(allocator, mdl, Logical);
+
+    gcmkFOOTER_NO();
+    return gcvSTATUS_OK;
 }
 
 gceSTATUS
-gckOS_CreateKernelVirtualMapping(
+gckOS_CreateUserVirtualMapping(
+    IN gckOS Os,
     IN gctPHYS_ADDR Physical,
     IN gctSIZE_T Bytes,
-    OUT gctSIZE_T * PageCount,
-    OUT gctPOINTER * Logical
+    OUT gctPOINTER * Logical,
+    OUT gctSIZE_T * PageCount
     )
 {
-    *PageCount = ((PLINUX_MDL)Physical)->numPages;
-    *Logical = _CreateKernelVirtualMapping((PLINUX_MDL)Physical);
-
-    return gcvSTATUS_OK;
+    return gckOS_LockPages(Os, Physical, Bytes, gcvFALSE, Logical, PageCount);
 }
 
 gceSTATUS
-gckOS_DestroyKernelVirtualMapping(
-    IN gctPHYS_ADDR physical,
-    IN gctPOINTER Logical,
-    IN gctSIZE_T Bytes
+gckOS_DestroyUserVirtualMapping(
+    IN gckOS Os,
+    IN gctPHYS_ADDR Physical,
+    IN gctSIZE_T Bytes,
+    IN gctPOINTER Logical
     )
 {
-    _DestoryKernelVirtualMapping((PLINUX_MDL)physical, (gctSTRING)Logical);
-    return gcvSTATUS_OK;
+    return gckOS_UnlockPages(Os, Physical, Bytes, Logical);
 }
 
 /*******************************************************************************
@@ -1975,7 +1569,7 @@ gckOS_UnmapMemoryEx(
             return gcvSTATUS_INVALID_ARGUMENT;
         }
 
-        _UnmapUserLogical(PID, mdlMap->vmaAddr, mdl->numPages * PAGE_SIZE);
+        _UnmapUserLogical(mdlMap->vmaAddr, mdl->numPages * PAGE_SIZE);
 
         gcmkVERIFY_OK(_DestroyMdlMap(mdl, mdlMap));
     }
@@ -2072,9 +1666,10 @@ gckOS_AllocateCMAMemoryFSL(
     gctSIZE_T bytes;
     gctINT numPages;
     PLINUX_MDL mdl = gcvNULL;
-    gctSTRING addr;
     gctBOOL locked = gcvFALSE;
     gceSTATUS status;
+    gckALLOCATOR allocator;
+    gctUINT32 flag = 0;
 
     gcmkHEADER_ARG("Os=0x%X *Bytes=%lu",
                    Os, gcmOPT_VALUE(Bytes));
@@ -2098,48 +1693,37 @@ gckOS_AllocateCMAMemoryFSL(
         gcmkONERROR(gcvSTATUS_OUT_OF_MEMORY);
     }
 
-    mdl->pagedMem = 0;
-    mdl->numPages = numPages;
-
-    MEMORY_LOCK(Os);
-    locked = gcvTRUE;
-
-
-    addr = dma_alloc_writecombine(gcvNULL,
-            mdl->numPages * PAGE_SIZE,
-            &mdl->dmaHandle,
-            GFP_KERNEL | gcdNOWARN);
-
-#if gcdUSE_NON_PAGED_MEMORY_CACHE
-    if(addr == gcvNULL)
+    /* Walk all default allocators. */
+    list_for_each_entry(allocator, &Os->allocatorList, head)
     {
-            MEMORY_UNLOCK(Os);
-            locked = gcvFALSE;
-            /*Free all cache and try again*/
-            _FreeAllNonPagedMemoryCache(Os);
-            MEMORY_LOCK(Os);
-            locked = gcvTRUE;
-            addr = dma_alloc_writecombine(gcvNULL,
-                mdl->numPages * PAGE_SIZE,
-                &mdl->dmaHandle,
-                GFP_KERNEL | gcdNOWARN);
+        if(allocator->privateData)
+        {
+            status = allocator->ops->Alloc(allocator, mdl, numPages, flag);
+
+            if (gcmIS_SUCCESS(status))
+            {
+                mdl->allocator = allocator;
+                break;
+            }
+        }
     }
-#endif
+
+    mdl->pagedMem = 0;
+    mdl->numPages = numPages;
     mdl->contiguous = gcvTRUE;
     mdl->cacheable=gcvFALSE;
 
-    if (addr == gcvNULL)
-    {
-        gcmkONERROR(gcvSTATUS_OUT_OF_MEMORY);
-    }
-
     if ((Os->device->baseAddress & 0x80000000) != (mdl->dmaHandle & 0x80000000))
     {
         gckOS_Print("Incorrect memory address allocated from CMA.0x%X!!\n",mdl->dmaHandle);
+        allocator->ops->Free(allocator, mdl);
         gcmkONERROR(gcvSTATUS_OUT_OF_MEMORY);
     }
 
-    mdl->addr = addr;
+
+
+    MEMORY_LOCK(Os);
+    locked = gcvTRUE;
 
     /* Return allocated memory. */
     *Bytes = bytes;
@@ -2221,6 +1805,7 @@ gceSTATUS gckOS_FreeCMAMemoryFSL(
     )
 {
     PLINUX_MDL mdl;
+    gckALLOCATOR allocator;
 
     gcmkHEADER_ARG("Os=0x%X Bytes=%lu Physical=0x%X",
                    Os, Bytes, Physical);
@@ -2232,14 +1817,10 @@ gceSTATUS gckOS_FreeCMAMemoryFSL(
 
     /* Convert physical address into a pointer to a MDL. */
     mdl = (PLINUX_MDL) Physical;
-
+    allocator = (gckALLOCATOR)mdl->allocator;
+    
     MEMORY_LOCK(Os);
 
-    dma_free_writecombine(gcvNULL,
-            mdl->numPages * PAGE_SIZE,
-            mdl->addr,
-            mdl->dmaHandle);
-
 #if DYNAMIC_MEMORY_RECORD
     Os->device->cmasize-=(mdl->numPages * PAGE_SIZE);
 #endif
@@ -2267,11 +1848,14 @@ gceSTATUS gckOS_FreeCMAMemoryFSL(
 
     MEMORY_UNLOCK(Os);
 
+    allocator->ops->Free(allocator, mdl);
+
     gcmkVERIFY_OK(_DestroyMdl(mdl));
 
     /* Success. */
     gcmkFOOTER_NO();
     return gcvSTATUS_OK;
+   
 }
 #endif
 
@@ -2713,7 +2297,7 @@ gceSTATUS gckOS_FreeNonPagedMemory(
         free_pages((unsigned long)mdl->kaddr, get_order(mdl->numPages * PAGE_SIZE));
     }
 
-    _DestoryKernelVirtualMapping(mdl, mdl->addr);
+    _DestoryKernelVirtualMapping(mdl->addr);
 #endif /* NO_DMA_COHERENT */
 
     mdlMap = mdl->maps;
@@ -3021,6 +2605,34 @@ OnError:
     return status;
 }
 
+/*******************************************************************************
+**
+**  gckOS_UserLogicalToPhysical
+**
+**  Get the physical system address of a corresponding user virtual address.
+**
+**  INPUT:
+**
+**      gckOS Os
+**          Pointer to an gckOS object.
+**
+**      gctPOINTER Logical
+**          Logical address.
+**
+**  OUTPUT:
+**
+**      gctUINT32 * Address
+**          Pointer to a variable that receives the 32-bit physical address.
+*/
+gceSTATUS gckOS_UserLogicalToPhysical(
+    IN gckOS Os,
+    IN gctPOINTER Logical,
+    OUT gctUINT32 * Address
+    )
+{
+    return gckOS_GetPhysicalAddress(Os, Logical, Address);
+}
+
 #if gcdSECURE_USER
 static gceSTATUS
 gckOS_AddMapping(
@@ -3106,7 +2718,7 @@ OnError:
 }
 #endif
 
-static gceSTATUS
+gceSTATUS
 _ConvertLogical2Physical(
     IN gckOS Os,
     IN gctPOINTER Logical,
@@ -3142,7 +2754,7 @@ _ConvertLogical2Physical(
         }
         else
         {
-            *Physical = gcmPTR2INT(virt_to_phys(base)) + offset;
+            *Physical = gcmPTR2INT32(virt_to_phys(base)) + offset;
         }
 
         return gcvSTATUS_OK;
@@ -3230,6 +2842,7 @@ gckOS_GetPhysicalAddressProcess(
 {
     PLINUX_MDL mdl;
     gctINT8_PTR base;
+    gckALLOCATOR allocator = gcvNULL;
     gceSTATUS status = gcvSTATUS_INVALID_ADDRESS;
 
     gcmkHEADER_ARG("Os=0x%X Logical=0x%X ProcessID=%d", Os, Logical, ProcessID);
@@ -3272,11 +2885,27 @@ gckOS_GetPhysicalAddressProcess(
         for (mdl = Os->mdlHead; mdl != gcvNULL; mdl = mdl->next)
         {
             /* Try this MDL. */
-            status = _ConvertLogical2Physical(Os,
-                                              Logical,
-                                              ProcessID,
-                                              mdl,
-                                              Address);
+            allocator = mdl->allocator;
+
+            if (allocator)
+            {
+                status = allocator->ops->LogicalToPhysical(
+                            allocator,
+                            mdl,
+                            Logical,
+                            ProcessID,
+                            Address
+                            );
+            }
+            else
+            {
+                status = _ConvertLogical2Physical(Os,
+                            Logical,
+                            ProcessID,
+                            mdl,
+                            Address);
+            }
+
             if (gcmIS_SUCCESS(status))
             {
                 break;
@@ -3471,7 +3100,7 @@ gckOS_UnmapPhysical(
                         char * addr= mdl->addr;
                         /*reset mdl->addr*/
                         mdl->addr = gcvNULL;
-                        _DestoryKernelVirtualMapping(mdl,addr);
+                        _DestoryKernelVirtualMapping(addr);
                 }
                 break;
             }
@@ -3573,7 +3202,7 @@ gckOS_DeleteMutex(
     gcmkVERIFY_ARGUMENT(Mutex != gcvNULL);
 
     /* Destroy the mutex. */
-    mutex_destroy(Mutex);
+    mutex_destroy((struct mutex *)Mutex);
 
     /* Free the mutex structure. */
     gcmkONERROR(gckOS_Free(Os, Mutex));
@@ -3731,6 +3360,7 @@ gckOS_AtomicExchange(
 
     /* Verify the arguments. */
     gcmkVERIFY_OBJECT(Os, gcvOBJ_OS);
+    gcmkVERIFY_ARGUMENT(OldValue != gcvNULL);
 
     /* Exchange the pair of 32-bit values. */
     *OldValue = (gctUINT32) atomic_xchg((atomic_t *) Target, (int) NewValue);
@@ -3776,6 +3406,7 @@ gckOS_AtomicExchangePtr(
 
     /* Verify the arguments. */
     gcmkVERIFY_OBJECT(Os, gcvOBJ_OS);
+    gcmkVERIFY_ARGUMENT(OldValue != gcvNULL);
 
     /* Exchange the pair of pointers. */
     *OldValue = (gctPOINTER)(gctUINTPTR_T) atomic_xchg((atomic_t *) Target, (int)(gctUINTPTR_T) NewValue);
@@ -3785,7 +3416,6 @@ gckOS_AtomicExchangePtr(
     return gcvSTATUS_OK;
 }
 
-#if gcdSMP
 /*******************************************************************************
 **
 **  gckOS_AtomicSetMask
@@ -3861,7 +3491,6 @@ gckOS_AtomClearMask(
     gcmkFOOTER_NO();
     return gcvSTATUS_OK;
 }
-#endif
 
 /*******************************************************************************
 **
@@ -4238,9 +3867,12 @@ gckOS_GetTime(
     OUT gctUINT64_PTR Time
     )
 {
+    struct timeval tv;
     gcmkHEADER();
 
-    *Time = 0;
+    /* Return the time of day in microseconds. */
+    do_gettimeofday(&tv);
+    *Time = (tv.tv_sec * 1000000ULL) + tv.tv_usec;
 
     gcmkFOOTER_NO();
     return gcvSTATUS_OK;
@@ -4373,13 +4005,11 @@ gckOS_AllocatePagedMemoryEx(
     )
 {
     gctINT numPages;
-    gctINT i;
     PLINUX_MDL mdl = gcvNULL;
     gctSIZE_T bytes;
-    gceSTATUS status;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-    gctPOINTER addr = gcvNULL;
-#endif
+    gceSTATUS status = gcvSTATUS_OUT_OF_MEMORY;
+    gckALLOCATOR allocator;
+    gctUINT32 flag = 0;
 
     gcmkHEADER_ARG("Os=0x%X Contiguous=%d Bytes=%lu", Os, Contiguous, Bytes);
 
@@ -4400,45 +4030,26 @@ gckOS_AllocatePagedMemoryEx(
 
     if (Contiguous)
     {
-        gctUINT32 order = get_order(bytes);
-
-        if (order >= MAX_ORDER)
-        {
-            gcmkONERROR(gcvSTATUS_OUT_OF_MEMORY);
-        }
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-        addr =
-            alloc_pages_exact(numPages * PAGE_SIZE, GFP_KERNEL | gcdNOWARN | __GFP_NORETRY);
-
-        mdl->u.contiguousPages = addr
-                               ? virt_to_page(addr)
-                               : gcvNULL;
+        flag |= gcvALLOC_FLAG_CONTIGUOUS;
+    }
 
-        mdl->exact = gcvTRUE;
-#else
-        mdl->u.contiguousPages =
-            alloc_pages(GFP_KERNEL | gcdNOWARN | __GFP_NORETRY, order);
-#endif
-        if (mdl->u.contiguousPages == gcvNULL)
+    /* Walk all default allocators. */
+    list_for_each_entry(allocator, &Os->allocatorList, head)
+    {
+        if(!allocator->privateData)
         {
-            mdl->u.contiguousPages =
-                alloc_pages(GFP_KERNEL | __GFP_HIGHMEM | gcdNOWARN, order);
+            status = allocator->ops->Alloc(allocator, mdl, numPages, flag);
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-            mdl->exact = gcvFALSE;
-#endif
+            if (gcmIS_SUCCESS(status))
+            {
+                mdl->allocator = allocator;
+                break;
+            }
         }
     }
-    else
-    {
-        mdl->u.nonContiguousPages = _NonContiguousAlloc(numPages);
-    }
 
-    if (mdl->u.contiguousPages == gcvNULL && mdl->u.nonContiguousPages == gcvNULL)
-    {
-        gcmkONERROR(gcvSTATUS_OUT_OF_MEMORY);
-    }
+    /* Check status. */
+    gcmkONERROR(status);
 
     mdl->dmaHandle  = 0;
     mdl->addr       = 0;
@@ -4447,48 +4058,6 @@ gckOS_AllocatePagedMemoryEx(
     mdl->contiguous = Contiguous;
     mdl->cacheable=gcvTRUE;
 
-
-    for (i = 0; i < mdl->numPages; i++)
-    {
-        struct page *page;
-
-        if (mdl->contiguous)
-        {
-            page = nth_page(mdl->u.contiguousPages, i);
-        }
-        else
-        {
-            page = _NonContiguousToPage(mdl->u.nonContiguousPages, i);
-        }
-
-        SetPageReserved(page);
-
-        if (!PageHighMem(page) && page_to_phys(page))
-        {
-            gcmkVERIFY_OK(
-                gckOS_CacheFlush(Os, _GetProcessID(), gcvNULL,
-                                 page_to_phys(page),
-                                 page_address(page),
-                                 PAGE_SIZE));
-        }
-        else
-        {
-            flush_dcache_page(page);
-
-#if !gcdCACHE_FUNCTION_UNIMPLEMENTED && defined(CONFIG_OUTER_CACHE) && gcdENABLE_OUTER_CACHE_PATCH
-            if (page_to_phys(page))
-            {
-                _HandleOuterCache(
-                    Os,
-                    page_to_phys(page),
-                    gcvNULL,
-                    PAGE_SIZE,
-                    gcvCACHE_FLUSH
-                    );
-            }
-#endif
-        }
-    }
 #if DYNAMIC_MEMORY_RECORD
         if(mdl->contiguous)
         {
@@ -4575,7 +4144,7 @@ gckOS_FreePagedMemory(
     )
 {
     PLINUX_MDL mdl = (PLINUX_MDL) Physical;
-    gctINT i;
+    gckALLOCATOR allocator = (gckALLOCATOR)mdl->allocator;
 
     gcmkHEADER_ARG("Os=0x%X Physical=0x%X Bytes=%lu", Os, Physical, Bytes);
 
@@ -4627,35 +4196,7 @@ gckOS_FreePagedMemory(
 
     MEMORY_UNLOCK(Os);
 
-    for (i = 0; i < mdl->numPages; i++)
-    {
-        if (mdl->contiguous)
-        {
-            ClearPageReserved(nth_page(mdl->u.contiguousPages, i));
-        }
-        else
-        {
-            ClearPageReserved(_NonContiguousToPage(mdl->u.nonContiguousPages, i));
-        }
-    }
-
-    if (mdl->contiguous)
-    {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-        if (mdl->exact == gcvTRUE)
-        {
-            free_pages_exact(page_address(mdl->u.contiguousPages), mdl->numPages * PAGE_SIZE);
-        }
-        else
-#endif
-        {
-            __free_pages(mdl->u.contiguousPages, get_order(mdl->numPages * PAGE_SIZE));
-        }
-    }
-    else
-    {
-        _NonContiguousFree(mdl->u.nonContiguousPages, mdl->numPages);
-    }
+    allocator->ops->Free(allocator, mdl);
 
     /* Free the structure... */
     gcmkVERIFY_OK(_DestroyMdl(mdl));
@@ -4705,12 +4246,10 @@ gckOS_LockPages(
     OUT gctSIZE_T * PageCount
     )
 {
+    gceSTATUS       status;
     PLINUX_MDL      mdl;
     PLINUX_MDL_MAP  mdlMap;
-    gctSTRING       addr;
-    unsigned long   start;
-    unsigned long   pfn;
-    gctINT          i;
+    gckALLOCATOR    allocator;
 
     gcmkHEADER_ARG("Os=0x%X Physical=0x%X Bytes=%lu", Os, Physical, Logical);
 
@@ -4721,6 +4260,7 @@ gckOS_LockPages(
     gcmkVERIFY_ARGUMENT(PageCount != gcvNULL);
 
     mdl = (PLINUX_MDL) Physical;
+    allocator = mdl->allocator;
 
     MEMORY_LOCK(Os);
 
@@ -4741,187 +4281,15 @@ gckOS_LockPages(
 
     if (mdlMap->vmaAddr == gcvNULL)
     {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)
-        mdlMap->vmaAddr = (gctSTRING)vm_mmap(gcvNULL,
-                        0L,
-                        mdl->numPages * PAGE_SIZE,
-                        PROT_READ | PROT_WRITE,
-                        MAP_SHARED,
-                        0);
-#else
-        down_write(&current->mm->mmap_sem);
-
-        mdlMap->vmaAddr = (gctSTRING)do_mmap_pgoff(gcvNULL,
-                        0L,
-                        mdl->numPages * PAGE_SIZE,
-                        PROT_READ | PROT_WRITE,
-                        MAP_SHARED,
-                        0);
+        status = allocator->ops->MapUser(allocator, mdl, mdlMap, Cacheable);
 
-        up_write(&current->mm->mmap_sem);
-#endif
-
-        gcmkTRACE_ZONE(
-            gcvLEVEL_INFO, gcvZONE_OS,
-            "%s(%d): vmaAddr->0x%X for phys_addr->0x%X",
-            __FUNCTION__, __LINE__,
-            (gctUINT32)(gctUINTPTR_T)mdlMap->vmaAddr,
-            (gctUINT32)(gctUINTPTR_T)mdl
-            );
-
-        if (IS_ERR(mdlMap->vmaAddr))
+        if (gcmIS_ERROR(status))
         {
-            gcmkTRACE_ZONE(
-                gcvLEVEL_INFO, gcvZONE_OS,
-                "%s(%d): do_mmap_pgoff error",
-                __FUNCTION__, __LINE__
-                );
-
-            mdlMap->vmaAddr = gcvNULL;
-
             MEMORY_UNLOCK(Os);
 
-            gcmkFOOTER_ARG("*status=%d", gcvSTATUS_OUT_OF_MEMORY);
-            return gcvSTATUS_OUT_OF_MEMORY;
+            gcmkFOOTER_ARG("*status=%d", status);
+            return status;
         }
-
-        down_write(&current->mm->mmap_sem);
-
-        mdlMap->vma = find_vma(current->mm, (unsigned long)mdlMap->vmaAddr);
-
-        if (mdlMap->vma == gcvNULL)
-        {
-            up_write(&current->mm->mmap_sem);
-
-            gcmkTRACE_ZONE(
-                gcvLEVEL_INFO, gcvZONE_OS,
-                "%s(%d): find_vma error",
-                __FUNCTION__, __LINE__
-                );
-
-            mdlMap->vmaAddr = gcvNULL;
-
-            MEMORY_UNLOCK(Os);
-
-            gcmkFOOTER_ARG("*status=%d", gcvSTATUS_OUT_OF_RESOURCES);
-            return gcvSTATUS_OUT_OF_RESOURCES;
-        }
-
-
-
-        addr = mdl->addr;
-
-        /* Now map all the vmalloc pages to this user address. */
-        if (mdl->contiguous)
-        {
-            /* map kernel memory to user space.. */
-#if  LINUX_CMA_FSL
-            if(!mdl->cacheable)
-            {
-                if (dma_mmap_writecombine(gcvNULL,
-                        mdlMap->vma,
-                        mdl->addr,
-                        mdl->dmaHandle,
-                        mdl->numPages * PAGE_SIZE) < 0)
-                {
-                    up_write(&current->mm->mmap_sem);
-
-                    gcmkTRACE_ZONE(
-                        gcvLEVEL_WARNING, gcvZONE_OS,
-                        "%s(%d): dma_mmap_attrs error",
-                        __FUNCTION__, __LINE__
-                        );
-
-                     mdlMap->vmaAddr = gcvNULL;
-
-                    MEMORY_UNLOCK(Os);
-
-                    gcmkFOOTER_ARG("*status=%d", gcvSTATUS_OUT_OF_MEMORY);
-                    return gcvSTATUS_OUT_OF_MEMORY;
-                }
-            }
-            else
-#endif
-            {
-                mdlMap->vma->vm_flags |= gcdVM_FLAGS;
-
-                if (Cacheable == gcvFALSE)
-                {
-                    /* Make this mapping non-cached. */
-                    mdlMap->vma->vm_page_prot = gcmkPAGED_MEMROY_PROT(mdlMap->vma->vm_page_prot);
-                }
-
-                if (remap_pfn_range(mdlMap->vma,
-                                    mdlMap->vma->vm_start,
-                                    page_to_pfn(mdl->u.contiguousPages),
-                                    mdlMap->vma->vm_end - mdlMap->vma->vm_start,
-                                    mdlMap->vma->vm_page_prot) < 0)
-                {
-                    up_write(&current->mm->mmap_sem);
-
-                    gcmkTRACE_ZONE(
-                        gcvLEVEL_INFO, gcvZONE_OS,
-                        "%s(%d): unable to mmap ret",
-                        __FUNCTION__, __LINE__
-                        );
-
-                    mdlMap->vmaAddr = gcvNULL;
-
-                    MEMORY_UNLOCK(Os);
-
-                    gcmkFOOTER_ARG("*status=%d", gcvSTATUS_OUT_OF_MEMORY);
-                    return gcvSTATUS_OUT_OF_MEMORY;
-                }
-            }
-        }
-        else
-        {
-            mdlMap->vma->vm_flags |= gcdVM_FLAGS;
-
-            if (Cacheable == gcvFALSE)
-            {
-                /* Make this mapping non-cached. */
-                mdlMap->vma->vm_page_prot = gcmkPAGED_MEMROY_PROT(mdlMap->vma->vm_page_prot);
-            }
-
-            start = mdlMap->vma->vm_start;
-
-            for (i = 0; i < mdl->numPages; i++)
-            {
-                pfn = _NonContiguousToPfn(mdl->u.nonContiguousPages, i);
-
-                if (remap_pfn_range(mdlMap->vma,
-                                    start,
-                                    pfn,
-                                    PAGE_SIZE,
-                                    mdlMap->vma->vm_page_prot) < 0)
-                {
-                    up_write(&current->mm->mmap_sem);
-
-                    gcmkTRACE_ZONE(
-                        gcvLEVEL_INFO, gcvZONE_OS,
-                        "%s(%d): gctPHYS_ADDR->0x%X Logical->0x%X Unable to map addr->0x%X to start->0x%X",
-                        __FUNCTION__, __LINE__,
-                        (gctUINT32)(gctUINTPTR_T)Physical,
-                        (gctUINT32)(gctUINTPTR_T)*Logical,
-                        (gctUINT32)(gctUINTPTR_T)addr,
-                        (gctUINT32)(gctUINTPTR_T)start
-                        );
-
-                    mdlMap->vmaAddr = gcvNULL;
-
-                    MEMORY_UNLOCK(Os);
-
-                    gcmkFOOTER_ARG("*status=%d", gcvSTATUS_OUT_OF_MEMORY);
-                    return gcvSTATUS_OUT_OF_MEMORY;
-                }
-
-                start += PAGE_SIZE;
-                addr += PAGE_SIZE;
-            }
-        }
-
-        up_write(&current->mm->mmap_sem);
     }
 
     mdlMap->count++;
@@ -5021,6 +4389,7 @@ gckOS_MapPagesEx(
     gckKERNEL kernel = Os->device->kernels[Core];
     gckMMU      mmu;
 #endif
+    gckALLOCATOR allocator;
 
     gcmkHEADER_ARG("Os=0x%X Core=%d Physical=0x%X PageCount=%u PageTable=0x%X",
                    Os, Core, Physical, PageCount, PageTable);
@@ -5034,6 +4403,8 @@ gckOS_MapPagesEx(
     /* Convert pointer to MDL. */
     mdl = (PLINUX_MDL)Physical;
 
+    allocator = mdl->allocator;
+
     gcmkTRACE_ZONE(
         gcvLEVEL_INFO, gcvZONE_OS,
         "%s(%d): Physical->0x%X PageCount->0x%X PagedMemory->?%d",
@@ -5063,11 +4434,11 @@ gckOS_MapPagesEx(
     while (PageCount-- > 0)
     {
         gctUINT i;
-        unsigned long phys = ~0;
+        gctUINT32 phys = ~0;
 
         if (mdl->pagedMem && !mdl->contiguous)
         {
-            phys = _NonContiguousToPhys(mdl->u.nonContiguousPages, offset);
+            allocator->ops->Physical(allocator, mdl, offset, &phys);
         }
         else
         {
@@ -5175,6 +4546,7 @@ gckOS_UnlockPages(
 {
     PLINUX_MDL_MAP          mdlMap;
     PLINUX_MDL              mdl = (PLINUX_MDL)Physical;
+    gckALLOCATOR            allocator = mdl->allocator;
 
     gcmkHEADER_ARG("Os=0x%X Physical=0x%X Bytes=%u Logical=0x%X",
                    Os, Physical, Bytes, Logical);
@@ -5199,7 +4571,11 @@ gckOS_UnlockPages(
             --mdlMap->count;
              if (mdlMap->count == 0)
             {
-                _UnmapUserLogical(mdlMap->pid, mdlMap->vmaAddr, mdl->numPages * PAGE_SIZE);
+                allocator->ops->UnmapUser(
+                    allocator,
+                    mdlMap->vmaAddr,
+                    mdl->numPages * PAGE_SIZE);
+
                 mdlMap->vmaAddr = gcvNULL;
             }
         }
@@ -6178,12 +5554,12 @@ OnError:
         {
 #if gcdPROCESS_ADDRESS_SPACE
             info->mmu = mmu;
-            info->address = address;
             gcmkONERROR(gckMMU_Flush(mmu));
 #else
-            gcmkONERROR(gckMMU_Flush(Os->device->kernels[Core]->mmu));
+            gcmkONERROR(gckMMU_Flush(Os->device->kernels[Core]->mmu, gcvSURF_TYPE_UNKNOWN));
 #endif
         }
+        info->address = address;
 
         /* Save pointer to page table. */
         info->pageTable = pageTable;
@@ -8319,7 +7695,7 @@ gckOS_WaitSignal(
     else
     {
         /* Convert wait to milliseconds. */
-        gctINT timeout = (Wait == gcvINFINITE)
+        long timeout = (Wait == gcvINFINITE)
             ? MAX_SCHEDULE_TIMEOUT
             : Wait * HZ / 1000;
 
@@ -8483,9 +7859,10 @@ gckOS_CreateUserSignal(
     gctSIZE_T signal;
 
     /* Create a new signal. */
-    status = gckOS_CreateSignal(Os, ManualReset, (gctSIGNAL *) &signal);
+    gcmkONERROR(gckOS_CreateSignal(Os, ManualReset, (gctSIGNAL *) &signal));
     *SignalID = (gctINT) signal;
 
+OnError:
     return status;
 }
 
@@ -9474,3 +8851,5 @@ OnError:
     return status;
 }
 #endif
+
+
diff --git a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_os.h b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_os.h
index 5593041b5498..2eb428f55d17 100644
--- a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_os.h
+++ b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_os.h
@@ -63,6 +63,12 @@ typedef struct _LINUX_MDL
     PLINUX_MDL_MAP          maps;
     struct _LINUX_MDL *     prev;
     struct _LINUX_MDL *     next;
+
+    /* Pointer to allocator which allocates memory for this mdl. */
+    void *                  allocator;
+
+    /* Private data used by allocator. */
+    void *                  priv;
 }
 LINUX_MDL, *PLINUX_MDL;
 
diff --git a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_security_channel.c b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_security_channel.c
new file mode 100644
index 000000000000..0c93cbe11edd
--- /dev/null
+++ b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_security_channel.c
@@ -0,0 +1,373 @@
+/****************************************************************************
+*
+*    Copyright (C) 2005 - 2014 by Vivante Corp.
+*
+*    This program is free software; you can redistribute it and/or modify
+*    it under the terms of the GNU General Public License as published by
+*    the Free Software Foundation; either version 2 of the license, or
+*    (at your option) any later version.
+*
+*    This program is distributed in the hope that it will be useful,
+*    but WITHOUT ANY WARRANTY; without even the implied warranty of
+*    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+*    GNU General Public License for more details.
+*
+*    You should have received a copy of the GNU General Public License
+*    along with this program; if not write to the Free Software
+*    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*
+*****************************************************************************/
+
+
+
+#include "gc_hal_kernel_linux.h"
+#include <linux/slab.h>
+
+#include "tee_client_api.h"
+
+#define _GC_OBJ_ZONE gcvZONE_OS
+
+#define GPU3D_UUID     { 0x111111, 0x1111, 0x1111, { 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11 } }
+static const TEEC_UUID gpu3d_uuid = GPU3D_UUID;
+TEEC_Context teecContext;
+
+typedef struct _gcsSecurityChannel {
+    gckOS               os;
+    TEEC_Session        session;
+    int *               virtual;
+    TEEC_SharedMemory   inputBuffer;
+    gctUINT32           bytes;
+    gctPOINTER          mutex;
+} gcsSecurityChannel;
+
+TEEC_SharedMemory *
+gpu3d_allocate_secure_mem(
+    gckOS Os,
+    unsigned int size
+    )
+{
+    TEEC_Result result;
+    TEEC_Context *context = &teecContext;
+    TEEC_SharedMemory *shm = NULL;
+    void *handle = NULL;
+    unsigned int phyAddr = 0xFFFFFFFF;
+    gceSTATUS status;
+    gctSIZE_T bytes = size;
+
+    shm = kmalloc(sizeof(TEEC_SharedMemory), GFP_KERNEL);
+
+    if (NULL == shm)
+    {
+        return NULL;
+    }
+
+    memset(shm, 0, sizeof(TEEC_SharedMemory));
+
+    status = gckOS_AllocateIonMemory(Os,
+                            gcvTRUE,
+                            &bytes,
+                            (gctPHYS_ADDR *)&handle,
+                            &phyAddr);
+
+    if (gcmIS_ERROR(status))
+    {
+         kfree(shm);
+         return NULL;
+    }
+
+    /* record the handle into shm->user_data */
+    shm->userdata = handle;
+
+    /* [b] Bulk input buffer. */
+    shm->size = size;
+    shm->flags = TEEC_MEM_INPUT;
+
+    /* Use TEE Client API to register the underlying memory buffer. */
+    shm->phyAddr = (void *)phyAddr;
+
+    result = TEEC_RegisterSharedMemory(
+            context,
+            shm);
+    if (result != TEEC_SUCCESS)
+    {
+        gpu_free_memory(handle);
+        kfree(shm);
+        return NULL;
+    }
+
+    return shm;
+}
+
+void gpu3d_release_secure_mem(
+    gckOS Os,
+    void *shm_handle
+    )
+{
+    TEEC_SharedMemory *shm = shm_handle;
+    void * handle;
+
+    if (!shm)
+    {
+        return;
+    }
+
+    handle = shm->userdata;
+
+    TEEC_ReleaseSharedMemory(shm);
+
+    gckOS_FreeIonMemory(Os, (gctPHYS_ADDR)handle);
+
+    kfree(shm);
+
+    return;
+}
+
+static TEEC_Result gpu3d_session_callback(
+    TEEC_Session*   session,
+    uint32_t    commandID,
+    TEEC_Operation* operation,
+    void*   userdata
+    )
+{
+    gcsSecurityChannel *channel = userdata;
+
+    if (channel == gcvNULL)
+    {
+        return TEEC_ERROR_BAD_PARAMETERS;
+    }
+
+    switch(commandID)
+    {
+        case gcvTA_CALLBACK_ALLOC_SECURE_MEM:
+        {
+            uint32_t size = operation->params[0].value.a;
+            TEEC_SharedMemory *shm = NULL;
+
+            shm = gpu3d_allocate_secure_mem(channel->os, size);
+
+            /* use the value to save the pointer in client side */
+            operation->params[0].value.a = (uint32_t)shm;
+            operation->params[0].value.b = (uint32_t)shm->phyAddr;
+
+            break;
+        }
+        case gcvTA_CALLBACK_FREE_SECURE_MEM:
+        {
+            TEEC_SharedMemory *shm = (TEEC_SharedMemory *)operation->params[0].value.a;
+
+            gpu3d_release_secure_mem(channel->os, shm);
+            break;
+        }
+        default:
+            break;
+    }
+
+    return TEEC_SUCCESS;
+}
+
+gceSTATUS
+gckOS_OpenSecurityChannel(
+    IN gckOS Os,
+    IN gceCORE GPU,
+    OUT gctUINT32 *Channel
+    )
+{
+    gceSTATUS status;
+    TEEC_Result result;
+    static bool initialized = gcvFALSE;
+    gcsSecurityChannel *channel = gcvNULL;
+
+    TEEC_Operation operation = {0};
+
+    /* Connect to TEE. */
+    if (initialized == gcvFALSE)
+    {
+        result = TEEC_InitializeContext(NULL, &teecContext);
+
+        if (result != TEEC_SUCCESS) {
+            gcmkONERROR(gcvSTATUS_CHIP_NOT_READY);
+        }
+
+        initialized = gcvTRUE;
+    }
+
+    /* Construct channel. */
+    gcmkONERROR(
+        gckOS_Allocate(Os, gcmSIZEOF(*channel), (gctPOINTER *)&channel));
+
+    gckOS_ZeroMemory(channel, gcmSIZEOF(gcsSecurityChannel));
+
+    channel->os = Os;
+
+    gcmkONERROR(gckOS_CreateMutex(Os, &channel->mutex));
+
+    /* Allocate shared memory for passing gcTA_INTERFACE. */
+    channel->bytes = gcmSIZEOF(gcsTA_INTERFACE);
+    channel->virtual = kmalloc(channel->bytes, GFP_KERNEL | __GFP_NOWARN);
+
+    if (!channel->virtual)
+    {
+        gcmkONERROR(gcvSTATUS_OUT_OF_MEMORY);
+    }
+
+    channel->inputBuffer.size    = channel->bytes;
+    channel->inputBuffer.flags   = TEEC_MEM_INPUT | TEEC_MEM_OUTPUT;
+    channel->inputBuffer.phyAddr = (void *)virt_to_phys(channel->virtual);
+
+    result = TEEC_RegisterSharedMemory(&teecContext, &channel->inputBuffer);
+
+    if (result != TEEC_SUCCESS)
+    {
+        gcmkONERROR(gcvSTATUS_OUT_OF_RESOURCES);
+    }
+
+    operation.paramTypes = TEEC_PARAM_TYPES(
+            TEEC_VALUE_INPUT,
+            TEEC_NONE,
+            TEEC_NONE,
+            TEEC_NONE);
+
+    operation.params[0].value.a = GPU;
+
+    /* Open session with TEE application. */
+    result = TEEC_OpenSession(
+                &teecContext,
+                &channel->session,
+                &gpu3d_uuid,
+                TEEC_LOGIN_USER,
+                NULL,
+                &operation,
+                NULL);
+
+    /* Prepare callback. */
+    TEEC_RegisterCallback(&channel->session, gpu3d_session_callback, channel);
+
+    *Channel = (gctUINT32)channel;
+
+    return gcvSTATUS_OK;
+
+OnError:
+    if (channel)
+    {
+        if (channel->virtual)
+        {
+        }
+
+        if (channel->mutex)
+        {
+            gcmkVERIFY_OK(gckOS_DeleteMutex(Os, channel->mutex));
+        }
+
+        gcmkVERIFY_OK(gckOS_Free(Os, channel));
+    }
+
+    return status;
+}
+
+gceSTATUS
+gckOS_CloseSecurityChannel(
+    IN gctUINT32 Channel
+    )
+{
+    /* TODO . */
+    return gcvSTATUS_OK;
+}
+
+gceSTATUS
+gckOS_CallSecurityService(
+    IN gctUINT32 Channel,
+    IN gcsTA_INTERFACE *Interface
+    )
+{
+    gceSTATUS status;
+    TEEC_Result result;
+    gcsSecurityChannel *channel = (gcsSecurityChannel *)Channel;
+    TEEC_Operation operation = {0};
+
+    gcmkHEADER();
+    gcmkVERIFY_ARGUMENT(Channel != 0);
+
+    gckOS_AcquireMutex(channel->os, channel->mutex, gcvINFINITE);
+
+    gckOS_MemCopy(channel->virtual, Interface, channel->bytes);
+
+    operation.paramTypes = TEEC_PARAM_TYPES(
+            TEEC_MEMREF_PARTIAL_INPUT,
+            TEEC_NONE,
+            TEEC_NONE,
+            TEEC_NONE);
+
+    /* Note: we use the updated size in the MemRef output by the encryption. */
+    operation.params[0].memref.parent = &channel->inputBuffer;
+    operation.params[0].memref.offset = 0;
+    operation.params[0].memref.size = sizeof(gcsTA_INTERFACE);
+    operation.started = true;
+
+    /* Start the commit command within the TEE application. */
+    result = TEEC_InvokeCommand(
+            &channel->session,
+            gcvTA_COMMAND_DISPATCH,
+            &operation,
+            NULL);
+
+    gckOS_MemCopy(Interface, channel->virtual, channel->bytes);
+
+    gckOS_ReleaseMutex(channel->os, channel->mutex);
+
+    if (result != TEEC_SUCCESS)
+    {
+        gcmkONERROR(gcvSTATUS_GENERIC_IO);
+    }
+
+    gcmkFOOTER_NO();
+    return gcvSTATUS_OK;
+
+OnError:
+    gcmkFOOTER();
+    return status;
+}
+
+gceSTATUS
+gckOS_InitSecurityChannel(
+    IN gctUINT32 Channel
+    )
+{
+    gceSTATUS status;
+    TEEC_Result result;
+    gcsSecurityChannel *channel = (gcsSecurityChannel *)Channel;
+    TEEC_Operation operation = {0};
+
+    gcmkHEADER();
+    gcmkVERIFY_ARGUMENT(Channel != 0);
+
+    operation.paramTypes = TEEC_PARAM_TYPES(
+            TEEC_MEMREF_PARTIAL_INPUT,
+            TEEC_NONE,
+            TEEC_NONE,
+            TEEC_NONE);
+
+    /* Note: we use the updated size in the MemRef output by the encryption. */
+    operation.params[0].memref.parent = &channel->inputBuffer;
+    operation.params[0].memref.offset = 0;
+    operation.params[0].memref.size = gcmSIZEOF(gcsTA_INTERFACE);
+    operation.started = true;
+
+    /* Start the commit command within the TEE application. */
+    result = TEEC_InvokeCommand(
+            &channel->session,
+            gcvTA_COMMAND_INIT,
+            &operation,
+            NULL);
+
+    if (result != TEEC_SUCCESS)
+    {
+        gcmkONERROR(gcvSTATUS_GENERIC_IO);
+    }
+
+    gcmkFOOTER_NO();
+    return gcvSTATUS_OK;
+
+OnError:
+    gcmkFOOTER();
+    return status;
+}
diff --git a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_sync.c b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_sync.c
index 54bd8f195dfa..86511e78542b 100644
--- a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_sync.c
+++ b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_sync.c
@@ -20,6 +20,11 @@
 
 
 
+#include <gc_hal.h>
+#include <gc_hal_base.h>
+
+#if gcdANDROID_NATIVE_FENCE_SYNC
+
 #include <linux/kernel.h>
 #include <linux/file.h>
 #include <linux/fs.h>
@@ -30,8 +35,6 @@
 
 #include "gc_hal_kernel_sync.h"
 
-#if gcdANDROID_NATIVE_FENCE_SYNC
-
 static struct sync_pt *
 viv_sync_pt_dup(
     struct sync_pt * sync_pt