92 files changed, 2293 insertions, 1790 deletions

diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 3d44ec724c17..43d3395325c5 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -493,6 +493,21 @@ config LEGACY_PTY_COUNT
           When not in use, each legacy PTY occupies 12 bytes on 32-bit
           architectures and 24 bytes on 64-bit architectures.
 
+config TTY_PRINTK
+        bool "TTY driver to output user messages via printk"
+        depends on EMBEDDED
+        default n
+        ---help---
+          If you say Y here, the support for writing user messages (i.e.
+          console messages) via printk is available.
+
+          The feature is useful to inline user messages with kernel
+          messages.
+          In order to use this feature, you should output user messages
+          to /dev/ttyprintk or redirect console to this TTY.
+
+          If unsure, say N.
+
 config BRIQ_PANEL
         tristate 'Total Impact briQ front panel driver'
         depends on PPC_CHRP
diff --git a/drivers/char/Makefile b/drivers/char/Makefile
index dc9641660605..3a9c01416839 100644
--- a/drivers/char/Makefile
+++ b/drivers/char/Makefile
@@ -12,6 +12,7 @@ obj-y	 += mem.o random.o tty_io.o n_tty.o tty_ioctl.o tty_ldisc.o tty_buffer.o t
 obj-y                           += tty_mutex.o
 obj-$(CONFIG_LEGACY_PTYS)       += pty.o
 obj-$(CONFIG_UNIX98_PTYS)       += pty.o
+obj-$(CONFIG_TTY_PRINTK)        += ttyprintk.o
 obj-y                           += misc.o
 obj-$(CONFIG_VT)                += vt_ioctl.o vc_screen.o selection.o keyboard.o
 obj-$(CONFIG_BFIN_JTAG_COMM)    += bfin_jtag_comm.o
diff --git a/drivers/char/agp/Kconfig b/drivers/char/agp/Kconfig
index 5ddf67e76f8b..fcd867d923ba 100644
--- a/drivers/char/agp/Kconfig
+++ b/drivers/char/agp/Kconfig
@@ -34,7 +34,7 @@ config AGP_ALI
           X on the following ALi chipsets.  The supported chipsets
           include M1541, M1621, M1631, M1632, M1641,M1647,and M1651.
           For the ALi-chipset question, ALi suggests you refer to
-          <http://www.ali.com.tw/eng/support/index.shtml>.
+          <http://www.ali.com.tw/>.
 
           The M1541 chipset can do AGP 1x and 2x, but note that there is an
           acknowledged incompatibility with Matrox G200 cards. Due to
diff --git a/drivers/char/agp/Makefile b/drivers/char/agp/Makefile
index 627f542827c7..8eb56e273e75 100644
--- a/drivers/char/agp/Makefile
+++ b/drivers/char/agp/Makefile
@@ -13,6 +13,7 @@ obj-$(CONFIG_AGP_HP_ZX1)	+= hp-agp.o
 obj-$(CONFIG_AGP_PARISC)        += parisc-agp.o
 obj-$(CONFIG_AGP_I460)          += i460-agp.o
 obj-$(CONFIG_AGP_INTEL)         += intel-agp.o
+obj-$(CONFIG_AGP_INTEL)         += intel-gtt.o
 obj-$(CONFIG_AGP_NVIDIA)        += nvidia-agp.o
 obj-$(CONFIG_AGP_SGI_TIOCA)     += sgi-agp.o
 obj-$(CONFIG_AGP_SIS)           += sis-agp.o
diff --git a/drivers/char/agp/agp.h b/drivers/char/agp/agp.h
index 120490949997..5259065f3c79 100644
--- a/drivers/char/agp/agp.h
+++ b/drivers/char/agp/agp.h
@@ -121,11 +121,6 @@ struct agp_bridge_driver {
         void (*agp_destroy_pages)(struct agp_memory *);
         int (*agp_type_to_mask_type) (struct agp_bridge_data *, int);
         void (*chipset_flush)(struct agp_bridge_data *);
-
-        int (*agp_map_page)(struct page *page, dma_addr_t *ret);
-        void (*agp_unmap_page)(struct page *page, dma_addr_t dma);
-        int (*agp_map_memory)(struct agp_memory *mem);
-        void (*agp_unmap_memory)(struct agp_memory *mem);
 };
 
 struct agp_bridge_data {
diff --git a/drivers/char/agp/amd-k7-agp.c b/drivers/char/agp/amd-k7-agp.c
index b6b1568314c8..b1b4362bc648 100644
--- a/drivers/char/agp/amd-k7-agp.c
+++ b/drivers/char/agp/amd-k7-agp.c
@@ -309,7 +309,8 @@ static int amd_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
 
         num_entries = A_SIZE_LVL2(agp_bridge->current_size)->num_entries;
 
-        if (type != 0 || mem->type != 0)
+        if (type != mem->type ||
+            agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type))
                 return -EINVAL;
 
         if ((pg_start + mem->page_count) > num_entries)
@@ -348,7 +349,8 @@ static int amd_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
         unsigned long __iomem *cur_gatt;
         unsigned long addr;
 
-        if (type != 0 || mem->type != 0)
+        if (type != mem->type ||
+            agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type))
                 return -EINVAL;
 
         for (i = pg_start; i < (mem->page_count + pg_start); i++) {
diff --git a/drivers/char/agp/backend.c b/drivers/char/agp/backend.c
index ee4f855611b6..f27d0d0816d3 100644
--- a/drivers/char/agp/backend.c
+++ b/drivers/char/agp/backend.c
@@ -151,17 +151,7 @@ static int agp_backend_initialize(struct agp_bridge_data *bridge)
                 }
 
                 bridge->scratch_page_page = page;
-                if (bridge->driver->agp_map_page) {
-                        if (bridge->driver->agp_map_page(page,
-                                                         &bridge->scratch_page_dma)) {
-                                dev_err(&bridge->dev->dev,
-                                        "unable to dma-map scratch page\n");
-                                rc = -ENOMEM;
-                                goto err_out_nounmap;
-                        }
-                } else {
-                        bridge->scratch_page_dma = page_to_phys(page);
-                }
+                bridge->scratch_page_dma = page_to_phys(page);
 
                 bridge->scratch_page = bridge->driver->mask_memory(bridge,
                                                    bridge->scratch_page_dma, 0);
@@ -204,12 +194,6 @@ static int agp_backend_initialize(struct agp_bridge_data *bridge)
         return 0;
 
 err_out:
-        if (bridge->driver->needs_scratch_page &&
-            bridge->driver->agp_unmap_page) {
-                bridge->driver->agp_unmap_page(bridge->scratch_page_page,
-                                               bridge->scratch_page_dma);
-        }
-err_out_nounmap:
         if (bridge->driver->needs_scratch_page) {
                 void *va = page_address(bridge->scratch_page_page);
 
@@ -240,10 +224,6 @@ static void agp_backend_cleanup(struct agp_bridge_data *bridge)
             bridge->driver->needs_scratch_page) {
                 void *va = page_address(bridge->scratch_page_page);
 
-                if (bridge->driver->agp_unmap_page)
-                        bridge->driver->agp_unmap_page(bridge->scratch_page_page,
-                                                       bridge->scratch_page_dma);
-
                 bridge->driver->agp_destroy_page(va, AGP_PAGE_DESTROY_UNMAP);
                 bridge->driver->agp_destroy_page(va, AGP_PAGE_DESTROY_FREE);
         }
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 64255cef8a7d..4956f1c8f9d5 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -437,11 +437,6 @@ int agp_bind_memory(struct agp_memory *curr, off_t pg_start)
                 curr->is_flushed = true;
         }
 
-        if (curr->bridge->driver->agp_map_memory) {
-                ret_val = curr->bridge->driver->agp_map_memory(curr);
-                if (ret_val)
-                        return ret_val;
-        }
         ret_val = curr->bridge->driver->insert_memory(curr, pg_start, curr->type);
 
         if (ret_val != 0)
@@ -483,9 +478,6 @@ int agp_unbind_memory(struct agp_memory *curr)
         if (ret_val != 0)
                 return ret_val;
 
-        if (curr->bridge->driver->agp_unmap_memory)
-                curr->bridge->driver->agp_unmap_memory(curr);
-
         curr->is_bound = false;
         curr->pg_start = 0;
         spin_lock(&curr->bridge->mapped_lock);
diff --git a/drivers/char/agp/i460-agp.c b/drivers/char/agp/i460-agp.c
index e763d3312ce7..75b763cb3ea1 100644
--- a/drivers/char/agp/i460-agp.c
+++ b/drivers/char/agp/i460-agp.c
@@ -1,7 +1,7 @@
 /*
  * For documentation on the i460 AGP interface, see Chapter 7 (AGP Subsystem) of
  * the "Intel 460GTX Chipset Software Developer's Manual":
- * http://developer.intel.com/design/itanium/downloads/24870401s.htm
+ * http://www.intel.com/design/archives/itanium/downloads/248704.htm 
  */
 /*
  * 460GX support by Chris Ahna <christopher.j.ahna@intel.com>
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index cd18493c9527..e72f49d52202 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -12,9 +12,6 @@
 #include <asm/smp.h>
 #include "agp.h"
 #include "intel-agp.h"
-#include <linux/intel-gtt.h>
-
-#include "intel-gtt.c"
 
 int intel_agp_enabled;
 EXPORT_SYMBOL(intel_agp_enabled);
@@ -703,179 +700,37 @@ static const struct agp_bridge_driver intel_7505_driver = {
         .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
-static int find_gmch(u16 device)
-{
-        struct pci_dev *gmch_device;
-
-        gmch_device = pci_get_device(PCI_VENDOR_ID_INTEL, device, NULL);
-        if (gmch_device && PCI_FUNC(gmch_device->devfn) != 0) {
-                gmch_device = pci_get_device(PCI_VENDOR_ID_INTEL,
-                                             device, gmch_device);
-        }
-
-        if (!gmch_device)
-                return 0;
-
-        intel_private.pcidev = gmch_device;
-        return 1;
-}
-
 /* Table to describe Intel GMCH and AGP/PCIE GART drivers.  At least one of
  * driver and gmch_driver must be non-null, and find_gmch will determine
  * which one should be used if a gmch_chip_id is present.
  */
-static const struct intel_driver_description {
+static const struct intel_agp_driver_description {
         unsigned int chip_id;
-        unsigned int gmch_chip_id;
         char *name;
         const struct agp_bridge_driver *driver;
-        const struct agp_bridge_driver *gmch_driver;
 } intel_agp_chipsets[] = {
-        { PCI_DEVICE_ID_INTEL_82443LX_0, 0, "440LX", &intel_generic_driver, NULL },
-        { PCI_DEVICE_ID_INTEL_82443BX_0, 0, "440BX", &intel_generic_driver, NULL },
-        { PCI_DEVICE_ID_INTEL_82443GX_0, 0, "440GX", &intel_generic_driver, NULL },
-        { PCI_DEVICE_ID_INTEL_82810_MC1, PCI_DEVICE_ID_INTEL_82810_IG1, "i810",
-                NULL, &intel_810_driver },
-        { PCI_DEVICE_ID_INTEL_82810_MC3, PCI_DEVICE_ID_INTEL_82810_IG3, "i810",
-                NULL, &intel_810_driver },
-        { PCI_DEVICE_ID_INTEL_82810E_MC, PCI_DEVICE_ID_INTEL_82810E_IG, "i810",
-                NULL, &intel_810_driver },
-        { PCI_DEVICE_ID_INTEL_82815_MC, PCI_DEVICE_ID_INTEL_82815_CGC, "i815",
-                &intel_815_driver, &intel_810_driver },
-        { PCI_DEVICE_ID_INTEL_82820_HB, 0, "i820", &intel_820_driver, NULL },
-        { PCI_DEVICE_ID_INTEL_82820_UP_HB, 0, "i820", &intel_820_driver, NULL },
-        { PCI_DEVICE_ID_INTEL_82830_HB, PCI_DEVICE_ID_INTEL_82830_CGC, "830M",
-                &intel_830mp_driver, &intel_830_driver },
-        { PCI_DEVICE_ID_INTEL_82840_HB, 0, "i840", &intel_840_driver, NULL },
-        { PCI_DEVICE_ID_INTEL_82845_HB, 0, "845G", &intel_845_driver, NULL },
-        { PCI_DEVICE_ID_INTEL_82845G_HB, PCI_DEVICE_ID_INTEL_82845G_IG, "830M",
-                &intel_845_driver, &intel_830_driver },
-        { PCI_DEVICE_ID_INTEL_82850_HB, 0, "i850", &intel_850_driver, NULL },
-        { PCI_DEVICE_ID_INTEL_82854_HB, PCI_DEVICE_ID_INTEL_82854_IG, "854",
-                &intel_845_driver, &intel_830_driver },
-        { PCI_DEVICE_ID_INTEL_82855PM_HB, 0, "855PM", &intel_845_driver, NULL },
-        { PCI_DEVICE_ID_INTEL_82855GM_HB, PCI_DEVICE_ID_INTEL_82855GM_IG, "855GM",
-                &intel_845_driver, &intel_830_driver },
-        { PCI_DEVICE_ID_INTEL_82860_HB, 0, "i860", &intel_860_driver, NULL },
-        { PCI_DEVICE_ID_INTEL_82865_HB, PCI_DEVICE_ID_INTEL_82865_IG, "865",
-                &intel_845_driver, &intel_830_driver },
-        { PCI_DEVICE_ID_INTEL_82875_HB, 0, "i875", &intel_845_driver, NULL },
-        { PCI_DEVICE_ID_INTEL_E7221_HB, PCI_DEVICE_ID_INTEL_E7221_IG, "E7221 (i915)",
-                NULL, &intel_915_driver },
-        { PCI_DEVICE_ID_INTEL_82915G_HB, PCI_DEVICE_ID_INTEL_82915G_IG, "915G",
-                NULL, &intel_915_driver },
-        { PCI_DEVICE_ID_INTEL_82915GM_HB, PCI_DEVICE_ID_INTEL_82915GM_IG, "915GM",
-                NULL, &intel_915_driver },
-        { PCI_DEVICE_ID_INTEL_82945G_HB, PCI_DEVICE_ID_INTEL_82945G_IG, "945G",
-                NULL, &intel_915_driver },
-        { PCI_DEVICE_ID_INTEL_82945GM_HB, PCI_DEVICE_ID_INTEL_82945GM_IG, "945GM",
-                NULL, &intel_915_driver },
-        { PCI_DEVICE_ID_INTEL_82945GME_HB, PCI_DEVICE_ID_INTEL_82945GME_IG, "945GME",
-                NULL, &intel_915_driver },
-        { PCI_DEVICE_ID_INTEL_82946GZ_HB, PCI_DEVICE_ID_INTEL_82946GZ_IG, "946GZ",
-                NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_82G35_HB, PCI_DEVICE_ID_INTEL_82G35_IG, "G35",
-                NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_82965Q_HB, PCI_DEVICE_ID_INTEL_82965Q_IG, "965Q",
-                NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_82965G_HB, PCI_DEVICE_ID_INTEL_82965G_IG, "965G",
-                NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_82965GM_HB, PCI_DEVICE_ID_INTEL_82965GM_IG, "965GM",
-                NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_82965GME_HB, PCI_DEVICE_ID_INTEL_82965GME_IG, "965GME/GLE",
-                NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_7505_0, 0, "E7505", &intel_7505_driver, NULL },
-        { PCI_DEVICE_ID_INTEL_7205_0, 0, "E7205", &intel_7505_driver, NULL },
-        { PCI_DEVICE_ID_INTEL_G33_HB, PCI_DEVICE_ID_INTEL_G33_IG, "G33",
-                NULL, &intel_g33_driver },
-        { PCI_DEVICE_ID_INTEL_Q35_HB, PCI_DEVICE_ID_INTEL_Q35_IG, "Q35",
-                NULL, &intel_g33_driver },
-        { PCI_DEVICE_ID_INTEL_Q33_HB, PCI_DEVICE_ID_INTEL_Q33_IG, "Q33",
-                NULL, &intel_g33_driver },
-        { PCI_DEVICE_ID_INTEL_PINEVIEW_M_HB, PCI_DEVICE_ID_INTEL_PINEVIEW_M_IG, "GMA3150",
-                NULL, &intel_g33_driver },
-        { PCI_DEVICE_ID_INTEL_PINEVIEW_HB, PCI_DEVICE_ID_INTEL_PINEVIEW_IG, "GMA3150",
-                NULL, &intel_g33_driver },
-        { PCI_DEVICE_ID_INTEL_GM45_HB, PCI_DEVICE_ID_INTEL_GM45_IG,
-            "GM45", NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_EAGLELAKE_HB, PCI_DEVICE_ID_INTEL_EAGLELAKE_IG,
-            "Eaglelake", NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_Q45_HB, PCI_DEVICE_ID_INTEL_Q45_IG,
-            "Q45/Q43", NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_G45_HB, PCI_DEVICE_ID_INTEL_G45_IG,
-            "G45/G43", NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_B43_HB, PCI_DEVICE_ID_INTEL_B43_IG,
-            "B43", NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_B43_1_HB, PCI_DEVICE_ID_INTEL_B43_1_IG,
-            "B43", NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_G41_HB, PCI_DEVICE_ID_INTEL_G41_IG,
-            "G41", NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB, PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG,
-            "HD Graphics", NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB, PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG,
-            "HD Graphics", NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB, PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG,
-            "HD Graphics", NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB, PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG,
-            "HD Graphics", NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT1_IG,
-            "Sandybridge", NULL, &intel_gen6_driver },
-        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT2_IG,
-            "Sandybridge", NULL, &intel_gen6_driver },
-        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT2_PLUS_IG,
-            "Sandybridge", NULL, &intel_gen6_driver },
-        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT1_IG,
-            "Sandybridge", NULL, &intel_gen6_driver },
-        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT2_IG,
-            "Sandybridge", NULL, &intel_gen6_driver },
-        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT2_PLUS_IG,
-            "Sandybridge", NULL, &intel_gen6_driver },
-        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_IG,
-            "Sandybridge", NULL, &intel_gen6_driver },
-        { 0, 0, NULL, NULL, NULL }
+        { PCI_DEVICE_ID_INTEL_82443LX_0, "440LX", &intel_generic_driver },
+        { PCI_DEVICE_ID_INTEL_82443BX_0, "440BX", &intel_generic_driver },
+        { PCI_DEVICE_ID_INTEL_82443GX_0, "440GX", &intel_generic_driver },
+        { PCI_DEVICE_ID_INTEL_82815_MC, "i815", &intel_815_driver },
+        { PCI_DEVICE_ID_INTEL_82820_HB, "i820", &intel_820_driver },
+        { PCI_DEVICE_ID_INTEL_82820_UP_HB, "i820", &intel_820_driver },
+        { PCI_DEVICE_ID_INTEL_82830_HB, "830M", &intel_830mp_driver },
+        { PCI_DEVICE_ID_INTEL_82840_HB, "i840", &intel_840_driver },
+        { PCI_DEVICE_ID_INTEL_82845_HB, "845G", &intel_845_driver },
+        { PCI_DEVICE_ID_INTEL_82845G_HB, "830M", &intel_845_driver },
+        { PCI_DEVICE_ID_INTEL_82850_HB, "i850", &intel_850_driver },
+        { PCI_DEVICE_ID_INTEL_82854_HB, "854", &intel_845_driver },
+        { PCI_DEVICE_ID_INTEL_82855PM_HB, "855PM", &intel_845_driver },
+        { PCI_DEVICE_ID_INTEL_82855GM_HB, "855GM", &intel_845_driver },
+        { PCI_DEVICE_ID_INTEL_82860_HB, "i860", &intel_860_driver },
+        { PCI_DEVICE_ID_INTEL_82865_HB, "865", &intel_845_driver },
+        { PCI_DEVICE_ID_INTEL_82875_HB, "i875", &intel_845_driver },
+        { PCI_DEVICE_ID_INTEL_7505_0, "E7505", &intel_7505_driver },
+        { PCI_DEVICE_ID_INTEL_7205_0, "E7205", &intel_7505_driver },
+        { 0, NULL, NULL }
 };
 
-static int __devinit intel_gmch_probe(struct pci_dev *pdev,
-                                      struct agp_bridge_data *bridge)
-{
-        int i, mask;
-
-        bridge->driver = NULL;
-
-        for (i = 0; intel_agp_chipsets[i].name != NULL; i++) {
-                if ((intel_agp_chipsets[i].gmch_chip_id != 0) &&
-                        find_gmch(intel_agp_chipsets[i].gmch_chip_id)) {
-                        bridge->driver =
-                                intel_agp_chipsets[i].gmch_driver;
-                        break;
-                }
-        }
-
-        if (!bridge->driver)
-                return 0;
-
-        bridge->dev_private_data = &intel_private;
-        bridge->dev = pdev;
-
-        dev_info(&pdev->dev, "Intel %s Chipset\n", intel_agp_chipsets[i].name);
-
-        if (bridge->driver->mask_memory == intel_gen6_mask_memory)
-                mask = 40;
-        else if (bridge->driver->mask_memory == intel_i965_mask_memory)
-                mask = 36;
-        else
-                mask = 32;
-
-        if (pci_set_dma_mask(intel_private.pcidev, DMA_BIT_MASK(mask)))
-                dev_err(&intel_private.pcidev->dev,
-                        "set gfx device dma mask %d-bit failed!\n", mask);
-        else
-                pci_set_consistent_dma_mask(intel_private.pcidev,
-                                            DMA_BIT_MASK(mask));
-
-        return 1;
-}
-
 static int __devinit agp_intel_probe(struct pci_dev *pdev,
                                      const struct pci_device_id *ent)
 {
@@ -905,7 +760,7 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
                 }
         }
 
-        if (intel_agp_chipsets[i].name == NULL) {
+        if (!bridge->driver) {
                 if (cap_ptr)
                         dev_warn(&pdev->dev, "unsupported Intel chipset [%04x/%04x]\n",
                                  pdev->vendor, pdev->device);
@@ -913,14 +768,6 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
                 return -ENODEV;
         }
 
-        if (!bridge->driver) {
-                if (cap_ptr)
-                        dev_warn(&pdev->dev, "can't find bridge device (chip_id: %04x)\n",
-                                 intel_agp_chipsets[i].gmch_chip_id);
-                agp_put_bridge(bridge);
-                return -ENODEV;
-        }
-
         bridge->dev = pdev;
         bridge->dev_private_data = NULL;
 
@@ -972,8 +819,7 @@ static void __devexit agp_intel_remove(struct pci_dev *pdev)
 
         agp_remove_bridge(bridge);
 
-        if (intel_private.pcidev)
-                pci_dev_put(intel_private.pcidev);
+        intel_gmch_remove(pdev);
 
         agp_put_bridge(bridge);
 }
@@ -1049,6 +895,7 @@ static struct pci_device_id agp_intel_pci_table[] = {
         ID(PCI_DEVICE_ID_INTEL_G45_HB),
         ID(PCI_DEVICE_ID_INTEL_G41_HB),
         ID(PCI_DEVICE_ID_INTEL_B43_HB),
+        ID(PCI_DEVICE_ID_INTEL_B43_1_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB),
diff --git a/drivers/char/agp/intel-agp.h b/drivers/char/agp/intel-agp.h
index d09b1ab7e8ab..90539df02504 100644
--- a/drivers/char/agp/intel-agp.h
+++ b/drivers/char/agp/intel-agp.h
@@ -215,44 +215,7 @@
 #define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_HB            0x0108  /* Server */
 #define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_IG            0x010A
 
-/* cover 915 and 945 variants */
-#define IS_I915 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_E7221_HB || \
-                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82915G_HB || \
-                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82915GM_HB || \
-                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82945G_HB || \
-                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82945GM_HB || \
-                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82945GME_HB)
-
-#define IS_I965 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82946GZ_HB || \
-                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82G35_HB || \
-                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965Q_HB || \
-                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965G_HB || \
-                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GM_HB || \
-                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GME_HB)
-
-#define IS_G33 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G33_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q35_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q33_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_PINEVIEW_M_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_PINEVIEW_HB)
-
-#define IS_PINEVIEW (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_PINEVIEW_M_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_PINEVIEW_HB)
-
-#define IS_SNB (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_HB)
-
-#define IS_G4X (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_EAGLELAKE_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q45_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G41_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_B43_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB || \
-                IS_SNB)
-
+int intel_gmch_probe(struct pci_dev *pdev,
+                               struct agp_bridge_data *bridge);
+void intel_gmch_remove(struct pci_dev *pdev);
 #endif
diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index 75e0a3497888..6b6760ea2435 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -15,6 +15,18 @@
  * /fairy-tale-mode off
  */
 
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/pagemap.h>
+#include <linux/agp_backend.h>
+#include <asm/smp.h>
+#include "agp.h"
+#include "intel-agp.h"
+#include <linux/intel-gtt.h>
+#include <drm/intel-gtt.h>
+
 /*
  * If we have Intel graphics, we're not going to have anything other than
  * an Intel IOMMU. So make the correct use of the PCI DMA API contingent
@@ -23,11 +35,12 @@
  */
 #ifdef CONFIG_DMAR
 #define USE_PCI_DMA_API 1
+#else
+#define USE_PCI_DMA_API 0
 #endif
 
 /* Max amount of stolen space, anything above will be returned to Linux */
 int intel_max_stolen = 32 * 1024 * 1024;
-EXPORT_SYMBOL(intel_max_stolen);
 
 static const struct aper_size_info_fixed intel_i810_sizes[] =
 {
@@ -55,32 +68,36 @@ static struct gatt_mask intel_i810_masks[] =
 #define INTEL_AGP_CACHED_MEMORY_LLC_MLC        3
 #define INTEL_AGP_CACHED_MEMORY_LLC_MLC_GFDT   4
 
-static struct gatt_mask intel_gen6_masks[] =
-{
-        {.mask = I810_PTE_VALID | GEN6_PTE_UNCACHED,
-         .type = INTEL_AGP_UNCACHED_MEMORY },
-        {.mask = I810_PTE_VALID | GEN6_PTE_LLC,
-         .type = INTEL_AGP_CACHED_MEMORY_LLC },
-        {.mask = I810_PTE_VALID | GEN6_PTE_LLC | GEN6_PTE_GFDT,
-         .type = INTEL_AGP_CACHED_MEMORY_LLC_GFDT },
-        {.mask = I810_PTE_VALID | GEN6_PTE_LLC_MLC,
-         .type = INTEL_AGP_CACHED_MEMORY_LLC_MLC },
-        {.mask = I810_PTE_VALID | GEN6_PTE_LLC_MLC | GEN6_PTE_GFDT,
-         .type = INTEL_AGP_CACHED_MEMORY_LLC_MLC_GFDT },
+struct intel_gtt_driver {
+        unsigned int gen : 8;
+        unsigned int is_g33 : 1;
+        unsigned int is_pineview : 1;
+        unsigned int is_ironlake : 1;
+        unsigned int dma_mask_size : 8;
+        /* Chipset specific GTT setup */
+        int (*setup)(void);
+        /* This should undo anything done in ->setup() save the unmapping
+         * of the mmio register file, that's done in the generic code. */
+        void (*cleanup)(void);
+        void (*write_entry)(dma_addr_t addr, unsigned int entry, unsigned int flags);
+        /* Flags is a more or less chipset specific opaque value.
+         * For chipsets that need to support old ums (non-gem) code, this
+         * needs to be identical to the various supported agp memory types! */
+        bool (*check_flags)(unsigned int flags);
+        void (*chipset_flush)(void);
 };
 
 static struct _intel_private {
+        struct intel_gtt base;
+        const struct intel_gtt_driver *driver;
         struct pci_dev *pcidev; /* device one */
+        struct pci_dev *bridge_dev;
         u8 __iomem *registers;
+        phys_addr_t gtt_bus_addr;
+        phys_addr_t gma_bus_addr;
+        phys_addr_t pte_bus_addr;
         u32 __iomem *gtt;               /* I915G */
         int num_dcache_entries;
-        /* gtt_entries is the number of gtt entries that are already mapped
-         * to stolen memory.  Stolen memory is larger than the memory mapped
-         * through gtt_entries, as it includes some reserved space for the BIOS
-         * popup and for the GTT.
-         */
-        int gtt_entries;                        /* i830+ */
-        int gtt_total_size;
         union {
                 void __iomem *i9xx_flush_page;
                 void *i8xx_flush_page;
@@ -88,23 +105,14 @@ static struct _intel_private {
         struct page *i8xx_page;
         struct resource ifp_resource;
         int resource_valid;
+        struct page *scratch_page;
+        dma_addr_t scratch_page_dma;
 } intel_private;
 
-#ifdef USE_PCI_DMA_API
-static int intel_agp_map_page(struct page *page, dma_addr_t *ret)
-{
-        *ret = pci_map_page(intel_private.pcidev, page, 0,
-                            PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
-        if (pci_dma_mapping_error(intel_private.pcidev, *ret))
-                return -EINVAL;
-        return 0;
-}
-
-static void intel_agp_unmap_page(struct page *page, dma_addr_t dma)
-{
-        pci_unmap_page(intel_private.pcidev, dma,
-                       PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
-}
+#define INTEL_GTT_GEN   intel_private.driver->gen
+#define IS_G33          intel_private.driver->is_g33
+#define IS_PINEVIEW     intel_private.driver->is_pineview
+#define IS_IRONLAKE     intel_private.driver->is_ironlake
 
 static void intel_agp_free_sglist(struct agp_memory *mem)
 {
@@ -125,6 +133,9 @@ static int intel_agp_map_memory(struct agp_memory *mem)
         struct scatterlist *sg;
         int i;
 
+        if (mem->sg_list)
+                return 0; /* already mapped (for e.g. resume */
+
         DBG("try mapping %lu pages\n", (unsigned long)mem->page_count);
 
         if (sg_alloc_table(&st, mem->page_count, GFP_KERNEL))
@@ -156,70 +167,17 @@ static void intel_agp_unmap_memory(struct agp_memory *mem)
         intel_agp_free_sglist(mem);
 }
 
-static void intel_agp_insert_sg_entries(struct agp_memory *mem,
-                                        off_t pg_start, int mask_type)
-{
-        struct scatterlist *sg;
-        int i, j;
-
-        j = pg_start;
-
-        WARN_ON(!mem->num_sg);
-
-        if (mem->num_sg == mem->page_count) {
-                for_each_sg(mem->sg_list, sg, mem->page_count, i) {
-                        writel(agp_bridge->driver->mask_memory(agp_bridge,
-                                        sg_dma_address(sg), mask_type),
-                                        intel_private.gtt+j);
-                        j++;
-                }
-        } else {
-                /* sg may merge pages, but we have to separate
-                 * per-page addr for GTT */
-                unsigned int len, m;
-
-                for_each_sg(mem->sg_list, sg, mem->num_sg, i) {
-                        len = sg_dma_len(sg) / PAGE_SIZE;
-                        for (m = 0; m < len; m++) {
-                                writel(agp_bridge->driver->mask_memory(agp_bridge,
-                                                                       sg_dma_address(sg) + m * PAGE_SIZE,
-                                                                       mask_type),
-                                       intel_private.gtt+j);
-                                j++;
-                        }
-                }
-        }
-        readl(intel_private.gtt+j-1);
-}
-
-#else
-
-static void intel_agp_insert_sg_entries(struct agp_memory *mem,
-                                        off_t pg_start, int mask_type)
-{
-        int i, j;
-
-        for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
-                writel(agp_bridge->driver->mask_memory(agp_bridge,
-                                page_to_phys(mem->pages[i]), mask_type),
-                       intel_private.gtt+j);
-        }
-
-        readl(intel_private.gtt+j-1);
-}
-
-#endif
-
 static int intel_i810_fetch_size(void)
 {
         u32 smram_miscc;
         struct aper_size_info_fixed *values;
 
-        pci_read_config_dword(agp_bridge->dev, I810_SMRAM_MISCC, &smram_miscc);
+        pci_read_config_dword(intel_private.bridge_dev,
+                              I810_SMRAM_MISCC, &smram_miscc);
         values = A_SIZE_FIX(agp_bridge->driver->aperture_sizes);
 
         if ((smram_miscc & I810_GMS) == I810_GMS_DISABLE) {
-                dev_warn(&agp_bridge->dev->dev, "i810 is disabled\n");
+                dev_warn(&intel_private.bridge_dev->dev, "i810 is disabled\n");
                 return 0;
         }
         if ((smram_miscc & I810_GFX_MEM_WIN_SIZE) == I810_GFX_MEM_WIN_32M) {
@@ -284,7 +242,7 @@ static void intel_i810_cleanup(void)
         iounmap(intel_private.registers);
 }
 
-static void intel_i810_agp_enable(struct agp_bridge_data *bridge, u32 mode)
+static void intel_fake_agp_enable(struct agp_bridge_data *bridge, u32 mode)
 {
         return;
 }
@@ -319,34 +277,6 @@ static void i8xx_destroy_pages(struct page *page)
         atomic_dec(&agp_bridge->current_memory_agp);
 }
 
-static int intel_i830_type_to_mask_type(struct agp_bridge_data *bridge,
-                                        int type)
-{
-        if (type < AGP_USER_TYPES)
-                return type;
-        else if (type == AGP_USER_CACHED_MEMORY)
-                return INTEL_AGP_CACHED_MEMORY;
-        else
-                return 0;
-}
-
-static int intel_gen6_type_to_mask_type(struct agp_bridge_data *bridge,
-                                        int type)
-{
-        unsigned int type_mask = type & ~AGP_USER_CACHED_MEMORY_GFDT;
-        unsigned int gfdt = type & AGP_USER_CACHED_MEMORY_GFDT;
-
-        if (type_mask == AGP_USER_UNCACHED_MEMORY)
-                return INTEL_AGP_UNCACHED_MEMORY;
-        else if (type_mask == AGP_USER_CACHED_MEMORY_LLC_MLC)
-                return gfdt ? INTEL_AGP_CACHED_MEMORY_LLC_MLC_GFDT :
-                              INTEL_AGP_CACHED_MEMORY_LLC_MLC;
-        else /* set 'normal'/'cached' to LLC by default */
-                return gfdt ? INTEL_AGP_CACHED_MEMORY_LLC_GFDT :
-                              INTEL_AGP_CACHED_MEMORY_LLC;
-}
-
-
 static int intel_i810_insert_entries(struct agp_memory *mem, off_t pg_start,
                                 int type)
 {
@@ -514,8 +444,33 @@ static unsigned long intel_i810_mask_memory(struct agp_bridge_data *bridge,
         return addr | bridge->driver->masks[type].mask;
 }
 
-static struct aper_size_info_fixed intel_i830_sizes[] =
+static int intel_gtt_setup_scratch_page(void)
 {
+        struct page *page;
+        dma_addr_t dma_addr;
+
+        page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO);
+        if (page == NULL)
+                return -ENOMEM;
+        get_page(page);
+        set_pages_uc(page, 1);
+
+        if (USE_PCI_DMA_API && INTEL_GTT_GEN > 2) {
+                dma_addr = pci_map_page(intel_private.pcidev, page, 0,
+                                    PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
+                if (pci_dma_mapping_error(intel_private.pcidev, dma_addr))
+                        return -EINVAL;
+
+                intel_private.scratch_page_dma = dma_addr;
+        } else
+                intel_private.scratch_page_dma = page_to_phys(page);
+
+        intel_private.scratch_page = page;
+
+        return 0;
+}
+
+static const struct aper_size_info_fixed const intel_fake_agp_sizes[] = {
         {128, 32768, 5},
         /* The 64M mode still requires a 128k gatt */
         {64, 16384, 5},
@@ -523,102 +478,49 @@ static struct aper_size_info_fixed intel_i830_sizes[] =
         {512, 131072, 7},
 };
 
-static void intel_i830_init_gtt_entries(void)
+static unsigned int intel_gtt_stolen_entries(void)
 {
         u16 gmch_ctrl;
-        int gtt_entries = 0;
         u8 rdct;
         int local = 0;
         static const int ddt[4] = { 0, 16, 32, 64 };
-        int size; /* reserved space (in kb) at the top of stolen memory */
+        unsigned int overhead_entries, stolen_entries;
+        unsigned int stolen_size = 0;
 
-        pci_read_config_word(agp_bridge->dev, I830_GMCH_CTRL, &gmch_ctrl);
+        pci_read_config_word(intel_private.bridge_dev,
+                             I830_GMCH_CTRL, &gmch_ctrl);
 
-        if (IS_I965) {
-                u32 pgetbl_ctl;
-                pgetbl_ctl = readl(intel_private.registers+I810_PGETBL_CTL);
+        if (INTEL_GTT_GEN > 4 || IS_PINEVIEW)
+                overhead_entries = 0;
+        else
+                overhead_entries = intel_private.base.gtt_mappable_entries
+                        / 1024;
 
-                /* The 965 has a field telling us the size of the GTT,
-                 * which may be larger than what is necessary to map the
-                 * aperture.
-                 */
-                switch (pgetbl_ctl & I965_PGETBL_SIZE_MASK) {
-                case I965_PGETBL_SIZE_128KB:
-                        size = 128;
-                        break;
-                case I965_PGETBL_SIZE_256KB:
-                        size = 256;
-                        break;
-                case I965_PGETBL_SIZE_512KB:
-                        size = 512;
-                        break;
-                case I965_PGETBL_SIZE_1MB:
-                        size = 1024;
-                        break;
-                case I965_PGETBL_SIZE_2MB:
-                        size = 2048;
-                        break;
-                case I965_PGETBL_SIZE_1_5MB:
-                        size = 1024 + 512;
-                        break;
-                default:
-                        dev_info(&intel_private.pcidev->dev,
-                                 "unknown page table size, assuming 512KB\n");
-                        size = 512;
-                }
-                size += 4; /* add in BIOS popup space */
-        } else if (IS_G33 && !IS_PINEVIEW) {
-        /* G33's GTT size defined in gmch_ctrl */
-                switch (gmch_ctrl & G33_PGETBL_SIZE_MASK) {
-                case G33_PGETBL_SIZE_1M:
-                        size = 1024;
-                        break;
-                case G33_PGETBL_SIZE_2M:
-                        size = 2048;
-                        break;
-                default:
-                        dev_info(&agp_bridge->dev->dev,
-                                 "unknown page table size 0x%x, assuming 512KB\n",
-                                (gmch_ctrl & G33_PGETBL_SIZE_MASK));
-                        size = 512;
-                }
-                size += 4;
-        } else if (IS_G4X || IS_PINEVIEW) {
-                /* On 4 series hardware, GTT stolen is separate from graphics
-                 * stolen, ignore it in stolen gtt entries counting.  However,
-                 * 4KB of the stolen memory doesn't get mapped to the GTT.
-                 */
-                size = 4;
-        } else {
-                /* On previous hardware, the GTT size was just what was
-                 * required to map the aperture.
-                 */
-                size = agp_bridge->driver->fetch_size() + 4;
-        }
+        overhead_entries += 1; /* BIOS popup */
 
-        if (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82830_HB ||
-            agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82845G_HB) {
+        if (intel_private.bridge_dev->device == PCI_DEVICE_ID_INTEL_82830_HB ||
+            intel_private.bridge_dev->device == PCI_DEVICE_ID_INTEL_82845G_HB) {
                 switch (gmch_ctrl & I830_GMCH_GMS_MASK) {
                 case I830_GMCH_GMS_STOLEN_512:
-                        gtt_entries = KB(512) - KB(size);
+                        stolen_size = KB(512);
                         break;
                 case I830_GMCH_GMS_STOLEN_1024:
-                        gtt_entries = MB(1) - KB(size);
+                        stolen_size = MB(1);
                         break;
                 case I830_GMCH_GMS_STOLEN_8192:
-                        gtt_entries = MB(8) - KB(size);
+                        stolen_size = MB(8);
                         break;
                 case I830_GMCH_GMS_LOCAL:
                         rdct = readb(intel_private.registers+I830_RDRAM_CHANNEL_TYPE);
-                        gtt_entries = (I830_RDRAM_ND(rdct) + 1) *
+                        stolen_size = (I830_RDRAM_ND(rdct) + 1) *
                                         MB(ddt[I830_RDRAM_DDT(rdct)]);
                         local = 1;
                         break;
                 default:
-                        gtt_entries = 0;
+                        stolen_size = 0;
                         break;
                 }
-        } else if (IS_SNB) {
+        } else if (INTEL_GTT_GEN == 6) {
                 /*
                  * SandyBridge has new memory control reg at 0x50.w
                  */
@@ -626,149 +528,292 @@ static void intel_i830_init_gtt_entries(void)
                 pci_read_config_word(intel_private.pcidev, SNB_GMCH_CTRL, &snb_gmch_ctl);
                 switch (snb_gmch_ctl & SNB_GMCH_GMS_STOLEN_MASK) {
                 case SNB_GMCH_GMS_STOLEN_32M:
-                        gtt_entries = MB(32) - KB(size);
+                        stolen_size = MB(32);
                         break;
                 case SNB_GMCH_GMS_STOLEN_64M:
-                        gtt_entries = MB(64) - KB(size);
+                        stolen_size = MB(64);
                         break;
                 case SNB_GMCH_GMS_STOLEN_96M:
-                        gtt_entries = MB(96) - KB(size);
+                        stolen_size = MB(96);
                         break;
                 case SNB_GMCH_GMS_STOLEN_128M:
-                        gtt_entries = MB(128) - KB(size);
+                        stolen_size = MB(128);
                         break;
                 case SNB_GMCH_GMS_STOLEN_160M:
-                        gtt_entries = MB(160) - KB(size);
+                        stolen_size = MB(160);
                         break;
                 case SNB_GMCH_GMS_STOLEN_192M:
-                        gtt_entries = MB(192) - KB(size);
+                        stolen_size = MB(192);
                         break;
                 case SNB_GMCH_GMS_STOLEN_224M:
-                        gtt_entries = MB(224) - KB(size);
+                        stolen_size = MB(224);
                         break;
                 case SNB_GMCH_GMS_STOLEN_256M:
-                        gtt_entries = MB(256) - KB(size);
+                        stolen_size = MB(256);
                         break;
                 case SNB_GMCH_GMS_STOLEN_288M:
-                        gtt_entries = MB(288) - KB(size);
+                        stolen_size = MB(288);
                         break;
                 case SNB_GMCH_GMS_STOLEN_320M:
-                        gtt_entries = MB(320) - KB(size);
+                        stolen_size = MB(320);
                         break;
                 case SNB_GMCH_GMS_STOLEN_352M:
-                        gtt_entries = MB(352) - KB(size);
+                        stolen_size = MB(352);
                         break;
                 case SNB_GMCH_GMS_STOLEN_384M:
-                        gtt_entries = MB(384) - KB(size);
+                        stolen_size = MB(384);
                         break;
                 case SNB_GMCH_GMS_STOLEN_416M:
-                        gtt_entries = MB(416) - KB(size);
+                        stolen_size = MB(416);
                         break;
                 case SNB_GMCH_GMS_STOLEN_448M:
-                        gtt_entries = MB(448) - KB(size);
+                        stolen_size = MB(448);
                         break;
                 case SNB_GMCH_GMS_STOLEN_480M:
-                        gtt_entries = MB(480) - KB(size);
+                        stolen_size = MB(480);
                         break;
                 case SNB_GMCH_GMS_STOLEN_512M:
-                        gtt_entries = MB(512) - KB(size);
+                        stolen_size = MB(512);
                         break;
                 }
         } else {
                 switch (gmch_ctrl & I855_GMCH_GMS_MASK) {
                 case I855_GMCH_GMS_STOLEN_1M:
-                        gtt_entries = MB(1) - KB(size);
+                        stolen_size = MB(1);
                         break;
                 case I855_GMCH_GMS_STOLEN_4M:
-                        gtt_entries = MB(4) - KB(size);
+                        stolen_size = MB(4);
                         break;
                 case I855_GMCH_GMS_STOLEN_8M:
-                        gtt_entries = MB(8) - KB(size);
+                        stolen_size = MB(8);
                         break;
                 case I855_GMCH_GMS_STOLEN_16M:
-                        gtt_entries = MB(16) - KB(size);
+                        stolen_size = MB(16);
                         break;
                 case I855_GMCH_GMS_STOLEN_32M:
-                        gtt_entries = MB(32) - KB(size);
+                        stolen_size = MB(32);
                         break;
                 case I915_GMCH_GMS_STOLEN_48M:
-                        /* Check it's really I915G */
-                        if (IS_I915 || IS_I965 || IS_G33 || IS_G4X)
-                                gtt_entries = MB(48) - KB(size);
-                        else
-                                gtt_entries = 0;
+                        stolen_size = MB(48);
                         break;
                 case I915_GMCH_GMS_STOLEN_64M:
-                        /* Check it's really I915G */
-                        if (IS_I915 || IS_I965 || IS_G33 || IS_G4X)
-                                gtt_entries = MB(64) - KB(size);
-                        else
-                                gtt_entries = 0;
+                        stolen_size = MB(64);
                         break;
                 case G33_GMCH_GMS_STOLEN_128M:
-                        if (IS_G33 || IS_I965 || IS_G4X)
-                                gtt_entries = MB(128) - KB(size);
-                        else
-                                gtt_entries = 0;
+                        stolen_size = MB(128);
                         break;
                 case G33_GMCH_GMS_STOLEN_256M:
-                        if (IS_G33 || IS_I965 || IS_G4X)
-                                gtt_entries = MB(256) - KB(size);
-                        else
-                                gtt_entries = 0;
+                        stolen_size = MB(256);
                         break;
                 case INTEL_GMCH_GMS_STOLEN_96M:
-                        if (IS_I965 || IS_G4X)
-                                gtt_entries = MB(96) - KB(size);
-                        else
-                                gtt_entries = 0;
+                        stolen_size = MB(96);
                         break;
                 case INTEL_GMCH_GMS_STOLEN_160M:
-                        if (IS_I965 || IS_G4X)
-                                gtt_entries = MB(160) - KB(size);
-                        else
-                                gtt_entries = 0;
+                        stolen_size = MB(160);
                         break;
                 case INTEL_GMCH_GMS_STOLEN_224M:
-                        if (IS_I965 || IS_G4X)
-                                gtt_entries = MB(224) - KB(size);
-                        else
-                                gtt_entries = 0;
+                        stolen_size = MB(224);
                         break;
                 case INTEL_GMCH_GMS_STOLEN_352M:
-                        if (IS_I965 || IS_G4X)
-                                gtt_entries = MB(352) - KB(size);
-                        else
-                                gtt_entries = 0;
+                        stolen_size = MB(352);
                         break;
                 default:
-                        gtt_entries = 0;
+                        stolen_size = 0;
                         break;
                 }
         }
-        if (!local && gtt_entries > intel_max_stolen) {
-                dev_info(&agp_bridge->dev->dev,
+
+        if (!local && stolen_size > intel_max_stolen) {
+                dev_info(&intel_private.bridge_dev->dev,
                          "detected %dK stolen memory, trimming to %dK\n",
-                         gtt_entries / KB(1), intel_max_stolen / KB(1));
-                gtt_entries = intel_max_stolen / KB(4);
-        } else if (gtt_entries > 0) {
-                dev_info(&agp_bridge->dev->dev, "detected %dK %s memory\n",
-                       gtt_entries / KB(1), local ? "local" : "stolen");
-                gtt_entries /= KB(4);
+                         stolen_size / KB(1), intel_max_stolen / KB(1));
+                stolen_size = intel_max_stolen;
+        } else if (stolen_size > 0) {
+                dev_info(&intel_private.bridge_dev->dev, "detected %dK %s memory\n",
+                       stolen_size / KB(1), local ? "local" : "stolen");
         } else {
-                dev_info(&agp_bridge->dev->dev,
+                dev_info(&intel_private.bridge_dev->dev,
                        "no pre-allocated video memory detected\n");
-                gtt_entries = 0;
+                stolen_size = 0;
+        }
+
+        stolen_entries = stolen_size/KB(4) - overhead_entries;
+
+        return stolen_entries;
+}
+
+static unsigned int intel_gtt_total_entries(void)
+{
+        int size;
+
+        if (IS_G33 || INTEL_GTT_GEN == 4 || INTEL_GTT_GEN == 5) {
+                u32 pgetbl_ctl;
+                pgetbl_ctl = readl(intel_private.registers+I810_PGETBL_CTL);
+
+                switch (pgetbl_ctl & I965_PGETBL_SIZE_MASK) {
+                case I965_PGETBL_SIZE_128KB:
+                        size = KB(128);
+                        break;
+                case I965_PGETBL_SIZE_256KB:
+                        size = KB(256);
+                        break;
+                case I965_PGETBL_SIZE_512KB:
+                        size = KB(512);
+                        break;
+                case I965_PGETBL_SIZE_1MB:
+                        size = KB(1024);
+                        break;
+                case I965_PGETBL_SIZE_2MB:
+                        size = KB(2048);
+                        break;
+                case I965_PGETBL_SIZE_1_5MB:
+                        size = KB(1024 + 512);
+                        break;
+                default:
+                        dev_info(&intel_private.pcidev->dev,
+                                 "unknown page table size, assuming 512KB\n");
+                        size = KB(512);
+                }
+
+                return size/4;
+        } else if (INTEL_GTT_GEN == 6) {
+                u16 snb_gmch_ctl;
+
+                pci_read_config_word(intel_private.pcidev, SNB_GMCH_CTRL, &snb_gmch_ctl);
+                switch (snb_gmch_ctl & SNB_GTT_SIZE_MASK) {
+                default:
+                case SNB_GTT_SIZE_0M:
+                        printk(KERN_ERR "Bad GTT size mask: 0x%04x.\n", snb_gmch_ctl);
+                        size = MB(0);
+                        break;
+                case SNB_GTT_SIZE_1M:
+                        size = MB(1);
+                        break;
+                case SNB_GTT_SIZE_2M:
+                        size = MB(2);
+                        break;
+                }
+                return size/4;
+        } else {
+                /* On previous hardware, the GTT size was just what was
+                 * required to map the aperture.
+                 */
+                return intel_private.base.gtt_mappable_entries;
+        }
+}
+
+static unsigned int intel_gtt_mappable_entries(void)
+{
+        unsigned int aperture_size;
+
+        if (INTEL_GTT_GEN == 2) {
+                u16 gmch_ctrl;
+
+                pci_read_config_word(intel_private.bridge_dev,
+                                     I830_GMCH_CTRL, &gmch_ctrl);
+
+                if ((gmch_ctrl & I830_GMCH_MEM_MASK) == I830_GMCH_MEM_64M)
+                        aperture_size = MB(64);
+                else
+                        aperture_size = MB(128);
+        } else {
+                /* 9xx supports large sizes, just look at the length */
+                aperture_size = pci_resource_len(intel_private.pcidev, 2);
         }
 
-        intel_private.gtt_entries = gtt_entries;
+        return aperture_size >> PAGE_SHIFT;
 }
 
-static void intel_i830_fini_flush(void)
+static void intel_gtt_teardown_scratch_page(void)
+{
+        set_pages_wb(intel_private.scratch_page, 1);
+        pci_unmap_page(intel_private.pcidev, intel_private.scratch_page_dma,
+                       PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
+        put_page(intel_private.scratch_page);
+        __free_page(intel_private.scratch_page);
+}
+
+static void intel_gtt_cleanup(void)
+{
+        intel_private.driver->cleanup();
+
+        iounmap(intel_private.gtt);
+        iounmap(intel_private.registers);
+        
+        intel_gtt_teardown_scratch_page();
+}
+
+static int intel_gtt_init(void)
+{
+        u32 gtt_map_size;
+        int ret;
+
+        ret = intel_private.driver->setup();
+        if (ret != 0)
+                return ret;
+
+        intel_private.base.gtt_mappable_entries = intel_gtt_mappable_entries();
+        intel_private.base.gtt_total_entries = intel_gtt_total_entries();
+
+        dev_info(&intel_private.bridge_dev->dev,
+                        "detected gtt size: %dK total, %dK mappable\n",
+                        intel_private.base.gtt_total_entries * 4,
+                        intel_private.base.gtt_mappable_entries * 4);
+
+        gtt_map_size = intel_private.base.gtt_total_entries * 4;
+
+        intel_private.gtt = ioremap(intel_private.gtt_bus_addr,
+                                    gtt_map_size);
+        if (!intel_private.gtt) {
+                intel_private.driver->cleanup();
+                iounmap(intel_private.registers);
+                return -ENOMEM;
+        }
+
+        global_cache_flush();   /* FIXME: ? */
+
+        /* we have to call this as early as possible after the MMIO base address is known */
+        intel_private.base.gtt_stolen_entries = intel_gtt_stolen_entries();
+        if (intel_private.base.gtt_stolen_entries == 0) {
+                intel_private.driver->cleanup();
+                iounmap(intel_private.registers);
+                iounmap(intel_private.gtt);
+                return -ENOMEM;
+        }
+
+        ret = intel_gtt_setup_scratch_page();
+        if (ret != 0) {
+                intel_gtt_cleanup();
+                return ret;
+        }
+
+        return 0;
+}
+
+static int intel_fake_agp_fetch_size(void)
+{
+        int num_sizes = ARRAY_SIZE(intel_fake_agp_sizes);
+        unsigned int aper_size;
+        int i;
+
+        aper_size = (intel_private.base.gtt_mappable_entries << PAGE_SHIFT)
+                    / MB(1);
+
+        for (i = 0; i < num_sizes; i++) {
+                if (aper_size == intel_fake_agp_sizes[i].size) {
+                        agp_bridge->current_size =
+                                (void *) (intel_fake_agp_sizes + i);
+                        return aper_size;
+                }
+        }
+
+        return 0;
+}
+
+static void i830_cleanup(void)
 {
         kunmap(intel_private.i8xx_page);
         intel_private.i8xx_flush_page = NULL;
-        unmap_page_from_agp(intel_private.i8xx_page);
 
         __free_page(intel_private.i8xx_page);
         intel_private.i8xx_page = NULL;
@@ -780,13 +825,13 @@ static void intel_i830_setup_flush(void)
         if (intel_private.i8xx_page)
                 return;
 
-        intel_private.i8xx_page = alloc_page(GFP_KERNEL | __GFP_ZERO | GFP_DMA32);
+        intel_private.i8xx_page = alloc_page(GFP_KERNEL);
         if (!intel_private.i8xx_page)
                 return;
 
         intel_private.i8xx_flush_page = kmap(intel_private.i8xx_page);
         if (!intel_private.i8xx_flush_page)
-                intel_i830_fini_flush();
+                i830_cleanup();
 }
 
 /* The chipset_flush interface needs to get data that has already been
@@ -799,7 +844,7 @@ static void intel_i830_setup_flush(void)
  * that buffer out, we just fill 1KB and clflush it out, on the assumption
  * that it'll push whatever was in there out.  It appears to work.
  */
-static void intel_i830_chipset_flush(struct agp_bridge_data *bridge)
+static void i830_chipset_flush(void)
 {
         unsigned int *pg = intel_private.i8xx_flush_page;
 
@@ -811,169 +856,184 @@ static void intel_i830_chipset_flush(struct agp_bridge_data *bridge)
                 printk(KERN_ERR "Timed out waiting for cache flush.\n");
 }
 
-/* The intel i830 automatically initializes the agp aperture during POST.
- * Use the memory already set aside for in the GTT.
- */
-static int intel_i830_create_gatt_table(struct agp_bridge_data *bridge)
+static void i830_write_entry(dma_addr_t addr, unsigned int entry,
+                             unsigned int flags)
 {
-        int page_order;
-        struct aper_size_info_fixed *size;
-        int num_entries;
-        u32 temp;
+        u32 pte_flags = I810_PTE_VALID;
+        
+        switch (flags) {
+        case AGP_DCACHE_MEMORY:
+                pte_flags |= I810_PTE_LOCAL;
+                break;
+        case AGP_USER_CACHED_MEMORY:
+                pte_flags |= I830_PTE_SYSTEM_CACHED;
+                break;
+        }
 
-        size = agp_bridge->current_size;
-        page_order = size->page_order;
-        num_entries = size->num_entries;
-        agp_bridge->gatt_table_real = NULL;
+        writel(addr | pte_flags, intel_private.gtt + entry);
+}
 
-        pci_read_config_dword(intel_private.pcidev, I810_MMADDR, &temp);
-        temp &= 0xfff80000;
+static void intel_enable_gtt(void)
+{
+        u32 gma_addr;
+        u16 gmch_ctrl;
 
-        intel_private.registers = ioremap(temp, 128 * 4096);
-        if (!intel_private.registers)
-                return -ENOMEM;
+        if (INTEL_GTT_GEN == 2)
+                pci_read_config_dword(intel_private.pcidev, I810_GMADDR,
+                                      &gma_addr);
+        else
+                pci_read_config_dword(intel_private.pcidev, I915_GMADDR,
+                                      &gma_addr);
 
-        temp = readl(intel_private.registers+I810_PGETBL_CTL) & 0xfffff000;
-        global_cache_flush();   /* FIXME: ?? */
+        intel_private.gma_bus_addr = (gma_addr & PCI_BASE_ADDRESS_MEM_MASK);
 
-        /* we have to call this as early as possible after the MMIO base address is known */
-        intel_i830_init_gtt_entries();
-        if (intel_private.gtt_entries == 0) {
-                iounmap(intel_private.registers);
+        pci_read_config_word(intel_private.bridge_dev, I830_GMCH_CTRL, &gmch_ctrl);
+        gmch_ctrl |= I830_GMCH_ENABLED;
+        pci_write_config_word(intel_private.bridge_dev, I830_GMCH_CTRL, gmch_ctrl);
+
+        writel(intel_private.pte_bus_addr|I810_PGETBL_ENABLED,
+               intel_private.registers+I810_PGETBL_CTL);
+        readl(intel_private.registers+I810_PGETBL_CTL); /* PCI Posting. */
+}
+
+static int i830_setup(void)
+{
+        u32 reg_addr;
+
+        pci_read_config_dword(intel_private.pcidev, I810_MMADDR, &reg_addr);
+        reg_addr &= 0xfff80000;
+
+        intel_private.registers = ioremap(reg_addr, KB(64));
+        if (!intel_private.registers)
                 return -ENOMEM;
-        }
 
-        agp_bridge->gatt_table = NULL;
+        intel_private.gtt_bus_addr = reg_addr + I810_PTE_BASE;
+        intel_private.pte_bus_addr =
+                readl(intel_private.registers+I810_PGETBL_CTL) & 0xfffff000;
 
-        agp_bridge->gatt_bus_addr = temp;
+        intel_i830_setup_flush();
 
         return 0;
 }
 
-/* Return the gatt table to a sane state. Use the top of stolen
- * memory for the GTT.
- */
-static int intel_i830_free_gatt_table(struct agp_bridge_data *bridge)
+static int intel_fake_agp_create_gatt_table(struct agp_bridge_data *bridge)
 {
+        agp_bridge->gatt_table_real = NULL;
+        agp_bridge->gatt_table = NULL;
+        agp_bridge->gatt_bus_addr = 0;
+
         return 0;
 }
 
-static int intel_i830_fetch_size(void)
+static int intel_fake_agp_free_gatt_table(struct agp_bridge_data *bridge)
 {
-        u16 gmch_ctrl;
-        struct aper_size_info_fixed *values;
-
-        values = A_SIZE_FIX(agp_bridge->driver->aperture_sizes);
-
-        if (agp_bridge->dev->device != PCI_DEVICE_ID_INTEL_82830_HB &&
-            agp_bridge->dev->device != PCI_DEVICE_ID_INTEL_82845G_HB) {
-                /* 855GM/852GM/865G has 128MB aperture size */
-                agp_bridge->current_size = (void *) values;
-                agp_bridge->aperture_size_idx = 0;
-                return values[0].size;
-        }
-
-        pci_read_config_word(agp_bridge->dev, I830_GMCH_CTRL, &gmch_ctrl);
-
-        if ((gmch_ctrl & I830_GMCH_MEM_MASK) == I830_GMCH_MEM_128M) {
-                agp_bridge->current_size = (void *) values;
-                agp_bridge->aperture_size_idx = 0;
-                return values[0].size;
-        } else {
-                agp_bridge->current_size = (void *) (values + 1);
-                agp_bridge->aperture_size_idx = 1;
-                return values[1].size;
-        }
-
         return 0;
 }
 
-static int intel_i830_configure(void)
+static int intel_fake_agp_configure(void)
 {
-        struct aper_size_info_fixed *current_size;
-        u32 temp;
-        u16 gmch_ctrl;
         int i;
 
-        current_size = A_SIZE_FIX(agp_bridge->current_size);
-
-        pci_read_config_dword(intel_private.pcidev, I810_GMADDR, &temp);
-        agp_bridge->gart_bus_addr = (temp & PCI_BASE_ADDRESS_MEM_MASK);
-
-        pci_read_config_word(agp_bridge->dev, I830_GMCH_CTRL, &gmch_ctrl);
-        gmch_ctrl |= I830_GMCH_ENABLED;
-        pci_write_config_word(agp_bridge->dev, I830_GMCH_CTRL, gmch_ctrl);
+        intel_enable_gtt();
 
-        writel(agp_bridge->gatt_bus_addr|I810_PGETBL_ENABLED, intel_private.registers+I810_PGETBL_CTL);
-        readl(intel_private.registers+I810_PGETBL_CTL); /* PCI Posting. */
+        agp_bridge->gart_bus_addr = intel_private.gma_bus_addr;
 
-        if (agp_bridge->driver->needs_scratch_page) {
-                for (i = intel_private.gtt_entries; i < current_size->num_entries; i++) {
-                        writel(agp_bridge->scratch_page, intel_private.registers+I810_PTE_BASE+(i*4));
-                }
-                readl(intel_private.registers+I810_PTE_BASE+((i-1)*4)); /* PCI Posting. */
+        for (i = intel_private.base.gtt_stolen_entries;
+                        i < intel_private.base.gtt_total_entries; i++) {
+                intel_private.driver->write_entry(intel_private.scratch_page_dma,
+                                                  i, 0);
         }
+        readl(intel_private.gtt+i-1);   /* PCI Posting. */
 
         global_cache_flush();
 
-        intel_i830_setup_flush();
         return 0;
 }
 
-static void intel_i830_cleanup(void)
+static bool i830_check_flags(unsigned int flags)
 {
-        iounmap(intel_private.registers);
+        switch (flags) {
+        case 0:
+        case AGP_PHYS_MEMORY:
+        case AGP_USER_CACHED_MEMORY:
+        case AGP_USER_MEMORY:
+                return true;
+        }
+
+        return false;
 }
 
-static int intel_i830_insert_entries(struct agp_memory *mem, off_t pg_start,
-                                     int type)
+static void intel_gtt_insert_sg_entries(struct scatterlist *sg_list,
+                                        unsigned int sg_len,
+                                        unsigned int pg_start,
+                                        unsigned int flags)
 {
-        int i, j, num_entries;
-        void *temp;
+        struct scatterlist *sg;
+        unsigned int len, m;
+        int i, j;
+
+        j = pg_start;
+
+        /* sg may merge pages, but we have to separate
+         * per-page addr for GTT */
+        for_each_sg(sg_list, sg, sg_len, i) {
+                len = sg_dma_len(sg) >> PAGE_SHIFT;
+                for (m = 0; m < len; m++) {
+                        dma_addr_t addr = sg_dma_address(sg) + (m << PAGE_SHIFT);
+                        intel_private.driver->write_entry(addr,
+                                                          j, flags);
+                        j++;
+                }
+        }
+        readl(intel_private.gtt+j-1);
+}
+
+static int intel_fake_agp_insert_entries(struct agp_memory *mem,
+                                         off_t pg_start, int type)
+{
+        int i, j;
         int ret = -EINVAL;
-        int mask_type;
 
         if (mem->page_count == 0)
                 goto out;
 
-        temp = agp_bridge->current_size;
-        num_entries = A_SIZE_FIX(temp)->num_entries;
-
-        if (pg_start < intel_private.gtt_entries) {
+        if (pg_start < intel_private.base.gtt_stolen_entries) {
                 dev_printk(KERN_DEBUG, &intel_private.pcidev->dev,
-                           "pg_start == 0x%.8lx, intel_private.gtt_entries == 0x%.8x\n",
-                           pg_start, intel_private.gtt_entries);
+                           "pg_start == 0x%.8lx, gtt_stolen_entries == 0x%.8x\n",
+                           pg_start, intel_private.base.gtt_stolen_entries);
 
                 dev_info(&intel_private.pcidev->dev,
                          "trying to insert into local/stolen memory\n");
                 goto out_err;
         }
 
-        if ((pg_start + mem->page_count) > num_entries)
+        if ((pg_start + mem->page_count) > intel_private.base.gtt_total_entries)
                 goto out_err;
 
-        /* The i830 can't check the GTT for entries since its read only,
-         * depend on the caller to make the correct offset decisions.
-         */
-
         if (type != mem->type)
                 goto out_err;
 
-        mask_type = agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type);
-
-        if (mask_type != 0 && mask_type != AGP_PHYS_MEMORY &&
-            mask_type != INTEL_AGP_CACHED_MEMORY)
+        if (!intel_private.driver->check_flags(type))
                 goto out_err;
 
         if (!mem->is_flushed)
                 global_cache_flush();
 
-        for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
-                writel(agp_bridge->driver->mask_memory(agp_bridge,
-                                page_to_phys(mem->pages[i]), mask_type),
-                       intel_private.registers+I810_PTE_BASE+(j*4));
+        if (USE_PCI_DMA_API && INTEL_GTT_GEN > 2) {
+                ret = intel_agp_map_memory(mem);
+                if (ret != 0)
+                        return ret;
+
+                intel_gtt_insert_sg_entries(mem->sg_list, mem->num_sg,
+                                            pg_start, type);
+        } else {
+                for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
+                        dma_addr_t addr = page_to_phys(mem->pages[i]);
+                        intel_private.driver->write_entry(addr,
+                                                          j, type);
+                }
+                readl(intel_private.gtt+j-1);
         }
-        readl(intel_private.registers+I810_PTE_BASE+((j-1)*4));
 
 out:
         ret = 0;
@@ -982,29 +1042,39 @@ out_err:
         return ret;
 }
 
-static int intel_i830_remove_entries(struct agp_memory *mem, off_t pg_start,
-                                     int type)
+static int intel_fake_agp_remove_entries(struct agp_memory *mem,
+                                         off_t pg_start, int type)
 {
         int i;
 
         if (mem->page_count == 0)
                 return 0;
 
-        if (pg_start < intel_private.gtt_entries) {
+        if (pg_start < intel_private.base.gtt_stolen_entries) {
                 dev_info(&intel_private.pcidev->dev,
                          "trying to disable local/stolen memory\n");
                 return -EINVAL;
         }
 
+        if (USE_PCI_DMA_API && INTEL_GTT_GEN > 2)
+                intel_agp_unmap_memory(mem);
+
         for (i = pg_start; i < (mem->page_count + pg_start); i++) {
-                writel(agp_bridge->scratch_page, intel_private.registers+I810_PTE_BASE+(i*4));
+                intel_private.driver->write_entry(intel_private.scratch_page_dma,
+                                                  i, 0);
         }
-        readl(intel_private.registers+I810_PTE_BASE+((i-1)*4));
+        readl(intel_private.gtt+i-1);
 
         return 0;
 }
 
-static struct agp_memory *intel_i830_alloc_by_type(size_t pg_count, int type)
+static void intel_fake_agp_chipset_flush(struct agp_bridge_data *bridge)
+{
+        intel_private.driver->chipset_flush();
+}
+
+static struct agp_memory *intel_fake_agp_alloc_by_type(size_t pg_count,
+                                                       int type)
 {
         if (type == AGP_PHYS_MEMORY)
                 return alloc_agpphysmem_i8xx(pg_count, type);
@@ -1015,9 +1085,9 @@ static struct agp_memory *intel_i830_alloc_by_type(size_t pg_count, int type)
 static int intel_alloc_chipset_flush_resource(void)
 {
         int ret;
-        ret = pci_bus_alloc_resource(agp_bridge->dev->bus, &intel_private.ifp_resource, PAGE_SIZE,
+        ret = pci_bus_alloc_resource(intel_private.bridge_dev->bus, &intel_private.ifp_resource, PAGE_SIZE,
                                      PAGE_SIZE, PCIBIOS_MIN_MEM, 0,
-                                     pcibios_align_resource, agp_bridge->dev);
+                                     pcibios_align_resource, intel_private.bridge_dev);
 
         return ret;
 }
@@ -1027,11 +1097,11 @@ static void intel_i915_setup_chipset_flush(void)
         int ret;
         u32 temp;
 
-        pci_read_config_dword(agp_bridge->dev, I915_IFPADDR, &temp);
+        pci_read_config_dword(intel_private.bridge_dev, I915_IFPADDR, &temp);
         if (!(temp & 0x1)) {
                 intel_alloc_chipset_flush_resource();
                 intel_private.resource_valid = 1;
-                pci_write_config_dword(agp_bridge->dev, I915_IFPADDR, (intel_private.ifp_resource.start & 0xffffffff) | 0x1);
+                pci_write_config_dword(intel_private.bridge_dev, I915_IFPADDR, (intel_private.ifp_resource.start & 0xffffffff) | 0x1);
         } else {
                 temp &= ~1;
 
@@ -1050,17 +1120,17 @@ static void intel_i965_g33_setup_chipset_flush(void)
         u32 temp_hi, temp_lo;
         int ret;
 
-        pci_read_config_dword(agp_bridge->dev, I965_IFPADDR + 4, &temp_hi);
-        pci_read_config_dword(agp_bridge->dev, I965_IFPADDR, &temp_lo);
+        pci_read_config_dword(intel_private.bridge_dev, I965_IFPADDR + 4, &temp_hi);
+        pci_read_config_dword(intel_private.bridge_dev, I965_IFPADDR, &temp_lo);
 
         if (!(temp_lo & 0x1)) {
 
                 intel_alloc_chipset_flush_resource();
 
                 intel_private.resource_valid = 1;
-                pci_write_config_dword(agp_bridge->dev, I965_IFPADDR + 4,
+                pci_write_config_dword(intel_private.bridge_dev, I965_IFPADDR + 4,
                         upper_32_bits(intel_private.ifp_resource.start));
-                pci_write_config_dword(agp_bridge->dev, I965_IFPADDR, (intel_private.ifp_resource.start & 0xffffffff) | 0x1);
+                pci_write_config_dword(intel_private.bridge_dev, I965_IFPADDR, (intel_private.ifp_resource.start & 0xffffffff) | 0x1);
         } else {
                 u64 l64;
 
@@ -1083,7 +1153,7 @@ static void intel_i9xx_setup_flush(void)
         if (intel_private.ifp_resource.start)
                 return;
 
-        if (IS_SNB)
+        if (INTEL_GTT_GEN == 6)
                 return;
 
         /* setup a resource for this object */
@@ -1091,7 +1161,7 @@ static void intel_i9xx_setup_flush(void)
         intel_private.ifp_resource.flags = IORESOURCE_MEM;
 
         /* Setup chipset flush for 915 */
-        if (IS_I965 || IS_G33 || IS_G4X) {
+        if (IS_G33 || INTEL_GTT_GEN >= 4) {
                 intel_i965_g33_setup_chipset_flush();
         } else {
                 intel_i915_setup_chipset_flush();
@@ -1104,41 +1174,7 @@ static void intel_i9xx_setup_flush(void)
                         "can't ioremap flush page - no chipset flushing\n");
 }
 
-static int intel_i9xx_configure(void)
-{
-        struct aper_size_info_fixed *current_size;
-        u32 temp;
-        u16 gmch_ctrl;
-        int i;
-
-        current_size = A_SIZE_FIX(agp_bridge->current_size);
-
-        pci_read_config_dword(intel_private.pcidev, I915_GMADDR, &temp);
-
-        agp_bridge->gart_bus_addr = (temp & PCI_BASE_ADDRESS_MEM_MASK);
-
-        pci_read_config_word(agp_bridge->dev, I830_GMCH_CTRL, &gmch_ctrl);
-        gmch_ctrl |= I830_GMCH_ENABLED;
-        pci_write_config_word(agp_bridge->dev, I830_GMCH_CTRL, gmch_ctrl);
-
-        writel(agp_bridge->gatt_bus_addr|I810_PGETBL_ENABLED, intel_private.registers+I810_PGETBL_CTL);
-        readl(intel_private.registers+I810_PGETBL_CTL); /* PCI Posting. */
-
-        if (agp_bridge->driver->needs_scratch_page) {
-                for (i = intel_private.gtt_entries; i < intel_private.gtt_total_size; i++) {
-                        writel(agp_bridge->scratch_page, intel_private.gtt+i);
-                }
-                readl(intel_private.gtt+i-1);   /* PCI Posting. */
-        }
-
-        global_cache_flush();
-
-        intel_i9xx_setup_flush();
-
-        return 0;
-}
-
-static void intel_i915_cleanup(void)
+static void i9xx_cleanup(void)
 {
         if (intel_private.i9xx_flush_page)
                 iounmap(intel_private.i9xx_flush_page);
@@ -1146,320 +1182,93 @@ static void intel_i915_cleanup(void)
                 release_resource(&intel_private.ifp_resource);
         intel_private.ifp_resource.start = 0;
         intel_private.resource_valid = 0;
-        iounmap(intel_private.gtt);
-        iounmap(intel_private.registers);
 }
 
-static void intel_i915_chipset_flush(struct agp_bridge_data *bridge)
+static void i9xx_chipset_flush(void)
 {
         if (intel_private.i9xx_flush_page)
                 writel(1, intel_private.i9xx_flush_page);
 }
 
-static int intel_i915_insert_entries(struct agp_memory *mem, off_t pg_start,
-                                     int type)
+static void i965_write_entry(dma_addr_t addr, unsigned int entry,
+                             unsigned int flags)
 {
-        int num_entries;
-        void *temp;
-        int ret = -EINVAL;
-        int mask_type;
-
-        if (mem->page_count == 0)
-                goto out;
-
-        temp = agp_bridge->current_size;
-        num_entries = A_SIZE_FIX(temp)->num_entries;
-
-        if (pg_start < intel_private.gtt_entries) {
-                dev_printk(KERN_DEBUG, &intel_private.pcidev->dev,
-                           "pg_start == 0x%.8lx, intel_private.gtt_entries == 0x%.8x\n",
-                           pg_start, intel_private.gtt_entries);
-
-                dev_info(&intel_private.pcidev->dev,
-                         "trying to insert into local/stolen memory\n");
-                goto out_err;
-        }
-
-        if ((pg_start + mem->page_count) > num_entries)
-                goto out_err;
-
-        /* The i915 can't check the GTT for entries since it's read only;
-         * depend on the caller to make the correct offset decisions.
-         */
-
-        if (type != mem->type)
-                goto out_err;
-
-        mask_type = agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type);
-
-        if (!IS_SNB && mask_type != 0 && mask_type != AGP_PHYS_MEMORY &&
-            mask_type != INTEL_AGP_CACHED_MEMORY)
-                goto out_err;
-
-        if (!mem->is_flushed)
-                global_cache_flush();
-
-        intel_agp_insert_sg_entries(mem, pg_start, mask_type);
-
- out:
-        ret = 0;
- out_err:
-        mem->is_flushed = true;
-        return ret;
+        /* Shift high bits down */
+        addr |= (addr >> 28) & 0xf0;
+        writel(addr | I810_PTE_VALID, intel_private.gtt + entry);
 }
 
-static int intel_i915_remove_entries(struct agp_memory *mem, off_t pg_start,
-                                     int type)
+static bool gen6_check_flags(unsigned int flags)
 {
-        int i;
-
-        if (mem->page_count == 0)
-                return 0;
-
-        if (pg_start < intel_private.gtt_entries) {
-                dev_info(&intel_private.pcidev->dev,
-                         "trying to disable local/stolen memory\n");
-                return -EINVAL;
-        }
-
-        for (i = pg_start; i < (mem->page_count + pg_start); i++)
-                writel(agp_bridge->scratch_page, intel_private.gtt+i);
-
-        readl(intel_private.gtt+i-1);
-
-        return 0;
+        return true;
 }
 
-/* Return the aperture size by just checking the resource length.  The effect
- * described in the spec of the MSAC registers is just changing of the
- * resource size.
- */
-static int intel_i9xx_fetch_size(void)
+static void gen6_write_entry(dma_addr_t addr, unsigned int entry,
+                             unsigned int flags)
 {
-        int num_sizes = ARRAY_SIZE(intel_i830_sizes);
-        int aper_size; /* size in megabytes */
-        int i;
-
-        aper_size = pci_resource_len(intel_private.pcidev, 2) / MB(1);
+        unsigned int type_mask = flags & ~AGP_USER_CACHED_MEMORY_GFDT;
+        unsigned int gfdt = flags & AGP_USER_CACHED_MEMORY_GFDT;
+        u32 pte_flags;
 
-        for (i = 0; i < num_sizes; i++) {
-                if (aper_size == intel_i830_sizes[i].size) {
-                        agp_bridge->current_size = intel_i830_sizes + i;
-                        return aper_size;
-                }
+        if (type_mask == AGP_USER_UNCACHED_MEMORY)
+                pte_flags = GEN6_PTE_UNCACHED | I810_PTE_VALID;
+        else if (type_mask == AGP_USER_CACHED_MEMORY_LLC_MLC) {
+                pte_flags = GEN6_PTE_LLC | I810_PTE_VALID;
+                if (gfdt)
+                        pte_flags |= GEN6_PTE_GFDT;
+        } else { /* set 'normal'/'cached' to LLC by default */
+                pte_flags = GEN6_PTE_LLC_MLC | I810_PTE_VALID;
+                if (gfdt)
+                        pte_flags |= GEN6_PTE_GFDT;
         }
 
-        return 0;
+        /* gen6 has bit11-4 for physical addr bit39-32 */
+        addr |= (addr >> 28) & 0xff0;
+        writel(addr | pte_flags, intel_private.gtt + entry);
 }
 
-static int intel_i915_get_gtt_size(void)
+static void gen6_cleanup(void)
 {
-        int size;
-
-        if (IS_G33) {
-                u16 gmch_ctrl;
-
-                /* G33's GTT size defined in gmch_ctrl */
-                pci_read_config_word(agp_bridge->dev, I830_GMCH_CTRL, &gmch_ctrl);
-                switch (gmch_ctrl & I830_GMCH_GMS_MASK) {
-                case I830_GMCH_GMS_STOLEN_512:
-                        size = 512;
-                        break;
-                case I830_GMCH_GMS_STOLEN_1024:
-                        size = 1024;
-                        break;
-                case I830_GMCH_GMS_STOLEN_8192:
-                        size = 8*1024;
-                        break;
-                default:
-                        dev_info(&agp_bridge->dev->dev,
-                                 "unknown page table size 0x%x, assuming 512KB\n",
-                                (gmch_ctrl & I830_GMCH_GMS_MASK));
-                        size = 512;
-                }
-        } else {
-                /* On previous hardware, the GTT size was just what was
-                 * required to map the aperture.
-                 */
-                size = agp_bridge->driver->fetch_size();
-        }
-
-        return KB(size);
 }
 
-/* The intel i915 automatically initializes the agp aperture during POST.
- * Use the memory already set aside for in the GTT.
- */
-static int intel_i915_create_gatt_table(struct agp_bridge_data *bridge)
+static int i9xx_setup(void)
 {
-        int page_order;
-        struct aper_size_info_fixed *size;
-        int num_entries;
-        u32 temp, temp2;
-        int gtt_map_size;
-
-        size = agp_bridge->current_size;
-        page_order = size->page_order;
-        num_entries = size->num_entries;
-        agp_bridge->gatt_table_real = NULL;
-
-        pci_read_config_dword(intel_private.pcidev, I915_MMADDR, &temp);
-        pci_read_config_dword(intel_private.pcidev, I915_PTEADDR, &temp2);
+        u32 reg_addr;
 
-        gtt_map_size = intel_i915_get_gtt_size();
-
-        intel_private.gtt = ioremap(temp2, gtt_map_size);
-        if (!intel_private.gtt)
-                return -ENOMEM;
-
-        intel_private.gtt_total_size = gtt_map_size / 4;
-
-        temp &= 0xfff80000;
-
-        intel_private.registers = ioremap(temp, 128 * 4096);
-        if (!intel_private.registers) {
-                iounmap(intel_private.gtt);
-                return -ENOMEM;
-        }
+        pci_read_config_dword(intel_private.pcidev, I915_MMADDR, &reg_addr);
 
-        temp = readl(intel_private.registers+I810_PGETBL_CTL) & 0xfffff000;
-        global_cache_flush();   /* FIXME: ? */
+        reg_addr &= 0xfff80000;
 
-        /* we have to call this as early as possible after the MMIO base address is known */
-        intel_i830_init_gtt_entries();
-        if (intel_private.gtt_entries == 0) {
-                iounmap(intel_private.gtt);
-                iounmap(intel_private.registers);
+        intel_private.registers = ioremap(reg_addr, 128 * 4096);
+        if (!intel_private.registers)
                 return -ENOMEM;
-        }
-
-        agp_bridge->gatt_table = NULL;
-
-        agp_bridge->gatt_bus_addr = temp;
-
-        return 0;
-}
-
-/*
- * The i965 supports 36-bit physical addresses, but to keep
- * the format of the GTT the same, the bits that don't fit
- * in a 32-bit word are shifted down to bits 4..7.
- *
- * Gcc is smart enough to notice that "(addr >> 28) & 0xf0"
- * is always zero on 32-bit architectures, so no need to make
- * this conditional.
- */
-static unsigned long intel_i965_mask_memory(struct agp_bridge_data *bridge,
-                                            dma_addr_t addr, int type)
-{
-        /* Shift high bits down */
-        addr |= (addr >> 28) & 0xf0;
-
-        /* Type checking must be done elsewhere */
-        return addr | bridge->driver->masks[type].mask;
-}
 
-static unsigned long intel_gen6_mask_memory(struct agp_bridge_data *bridge,
-                                            dma_addr_t addr, int type)
-{
-        /* gen6 has bit11-4 for physical addr bit39-32 */
-        addr |= (addr >> 28) & 0xff0;
+        if (INTEL_GTT_GEN == 3) {
+                u32 gtt_addr;
 
-        /* Type checking must be done elsewhere */
-        return addr | bridge->driver->masks[type].mask;
-}
-
-static void intel_i965_get_gtt_range(int *gtt_offset, int *gtt_size)
-{
-        u16 snb_gmch_ctl;
-
-        switch (agp_bridge->dev->device) {
-        case PCI_DEVICE_ID_INTEL_GM45_HB:
-        case PCI_DEVICE_ID_INTEL_EAGLELAKE_HB:
-        case PCI_DEVICE_ID_INTEL_Q45_HB:
-        case PCI_DEVICE_ID_INTEL_G45_HB:
-        case PCI_DEVICE_ID_INTEL_G41_HB:
-        case PCI_DEVICE_ID_INTEL_B43_HB:
-        case PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB:
-        case PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB:
-        case PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB:
-        case PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB:
-                *gtt_offset = *gtt_size = MB(2);
-                break;
-        case PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB:
-        case PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB:
-        case PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_HB:
-                *gtt_offset = MB(2);
+                pci_read_config_dword(intel_private.pcidev,
+                                      I915_PTEADDR, &gtt_addr);
+                intel_private.gtt_bus_addr = gtt_addr;
+        } else {
+                u32 gtt_offset;
 
-                pci_read_config_word(intel_private.pcidev, SNB_GMCH_CTRL, &snb_gmch_ctl);
-                switch (snb_gmch_ctl & SNB_GTT_SIZE_MASK) {
-                default:
-                case SNB_GTT_SIZE_0M:
-                        printk(KERN_ERR "Bad GTT size mask: 0x%04x.\n", snb_gmch_ctl);
-                        *gtt_size = MB(0);
+                switch (INTEL_GTT_GEN) {
+                case 5:
+                case 6:
+                        gtt_offset = MB(2);
                         break;
-                case SNB_GTT_SIZE_1M:
-                        *gtt_size = MB(1);
-                        break;
-                case SNB_GTT_SIZE_2M:
-                        *gtt_size = MB(2);
+                case 4:
+                default:
+                        gtt_offset =  KB(512);
                         break;
                 }
-                break;
-        default:
-                *gtt_offset = *gtt_size = KB(512);
+                intel_private.gtt_bus_addr = reg_addr + gtt_offset;
         }
-}
-
-/* The intel i965 automatically initializes the agp aperture during POST.
- * Use the memory already set aside for in the GTT.
- */
-static int intel_i965_create_gatt_table(struct agp_bridge_data *bridge)
-{
-        int page_order;
-        struct aper_size_info_fixed *size;
-        int num_entries;
-        u32 temp;
-        int gtt_offset, gtt_size;
-
-        size = agp_bridge->current_size;
-        page_order = size->page_order;
-        num_entries = size->num_entries;
-        agp_bridge->gatt_table_real = NULL;
-
-        pci_read_config_dword(intel_private.pcidev, I915_MMADDR, &temp);
-
-        temp &= 0xfff00000;
-
-        intel_i965_get_gtt_range(&gtt_offset, &gtt_size);
 
-        intel_private.gtt = ioremap((temp + gtt_offset) , gtt_size);
+        intel_private.pte_bus_addr =
+                readl(intel_private.registers+I810_PGETBL_CTL) & 0xfffff000;
 
-        if (!intel_private.gtt)
-                return -ENOMEM;
-
-        intel_private.gtt_total_size = gtt_size / 4;
-
-        intel_private.registers = ioremap(temp, 128 * 4096);
-        if (!intel_private.registers) {
-                iounmap(intel_private.gtt);
-                return -ENOMEM;
-        }
-
-        temp = readl(intel_private.registers+I810_PGETBL_CTL) & 0xfffff000;
-        global_cache_flush();   /* FIXME: ? */
-
-        /* we have to call this as early as possible after the MMIO base address is known */
-        intel_i830_init_gtt_entries();
-        if (intel_private.gtt_entries == 0) {
-                iounmap(intel_private.gtt);
-                iounmap(intel_private.registers);
-                return -ENOMEM;
-        }
-
-        agp_bridge->gatt_table = NULL;
-
-        agp_bridge->gatt_bus_addr = temp;
+        intel_i9xx_setup_flush();
 
         return 0;
 }
@@ -1475,7 +1284,7 @@ static const struct agp_bridge_driver intel_810_driver = {
         .cleanup                = intel_i810_cleanup,
         .mask_memory            = intel_i810_mask_memory,
         .masks                  = intel_i810_masks,
-        .agp_enable             = intel_i810_agp_enable,
+        .agp_enable             = intel_fake_agp_enable,
         .cache_flush            = global_cache_flush,
         .create_gatt_table      = agp_generic_create_gatt_table,
         .free_gatt_table        = agp_generic_free_gatt_table,
@@ -1490,161 +1299,282 @@ static const struct agp_bridge_driver intel_810_driver = {
         .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
-static const struct agp_bridge_driver intel_830_driver = {
+static const struct agp_bridge_driver intel_fake_agp_driver = {
         .owner                  = THIS_MODULE,
-        .aperture_sizes         = intel_i830_sizes,
         .size_type              = FIXED_APER_SIZE,
-        .num_aperture_sizes     = 4,
-        .needs_scratch_page     = true,
-        .configure              = intel_i830_configure,
-        .fetch_size             = intel_i830_fetch_size,
-        .cleanup                = intel_i830_cleanup,
-        .mask_memory            = intel_i810_mask_memory,
-        .masks                  = intel_i810_masks,
-        .agp_enable             = intel_i810_agp_enable,
+        .aperture_sizes         = intel_fake_agp_sizes,
+        .num_aperture_sizes     = ARRAY_SIZE(intel_fake_agp_sizes),
+        .configure              = intel_fake_agp_configure,
+        .fetch_size             = intel_fake_agp_fetch_size,
+        .cleanup                = intel_gtt_cleanup,
+        .agp_enable             = intel_fake_agp_enable,
         .cache_flush            = global_cache_flush,
-        .create_gatt_table      = intel_i830_create_gatt_table,
-        .free_gatt_table        = intel_i830_free_gatt_table,
-        .insert_memory          = intel_i830_insert_entries,
-        .remove_memory          = intel_i830_remove_entries,
-        .alloc_by_type          = intel_i830_alloc_by_type,
+        .create_gatt_table      = intel_fake_agp_create_gatt_table,
+        .free_gatt_table        = intel_fake_agp_free_gatt_table,
+        .insert_memory          = intel_fake_agp_insert_entries,
+        .remove_memory          = intel_fake_agp_remove_entries,
+        .alloc_by_type          = intel_fake_agp_alloc_by_type,
         .free_by_type           = intel_i810_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_alloc_pages        = agp_generic_alloc_pages,
         .agp_destroy_page       = agp_generic_destroy_page,
         .agp_destroy_pages      = agp_generic_destroy_pages,
-        .agp_type_to_mask_type  = intel_i830_type_to_mask_type,
-        .chipset_flush          = intel_i830_chipset_flush,
+        .chipset_flush          = intel_fake_agp_chipset_flush,
 };
 
-static const struct agp_bridge_driver intel_915_driver = {
-        .owner                  = THIS_MODULE,
-        .aperture_sizes         = intel_i830_sizes,
-        .size_type              = FIXED_APER_SIZE,
-        .num_aperture_sizes     = 4,
-        .needs_scratch_page     = true,
-        .configure              = intel_i9xx_configure,
-        .fetch_size             = intel_i9xx_fetch_size,
-        .cleanup                = intel_i915_cleanup,
-        .mask_memory            = intel_i810_mask_memory,
-        .masks                  = intel_i810_masks,
-        .agp_enable             = intel_i810_agp_enable,
-        .cache_flush            = global_cache_flush,
-        .create_gatt_table      = intel_i915_create_gatt_table,
-        .free_gatt_table        = intel_i830_free_gatt_table,
-        .insert_memory          = intel_i915_insert_entries,
-        .remove_memory          = intel_i915_remove_entries,
-        .alloc_by_type          = intel_i830_alloc_by_type,
-        .free_by_type           = intel_i810_free_by_type,
-        .agp_alloc_page         = agp_generic_alloc_page,
-        .agp_alloc_pages        = agp_generic_alloc_pages,
-        .agp_destroy_page       = agp_generic_destroy_page,
-        .agp_destroy_pages      = agp_generic_destroy_pages,
-        .agp_type_to_mask_type  = intel_i830_type_to_mask_type,
-        .chipset_flush          = intel_i915_chipset_flush,
-#ifdef USE_PCI_DMA_API
-        .agp_map_page           = intel_agp_map_page,
-        .agp_unmap_page         = intel_agp_unmap_page,
-        .agp_map_memory         = intel_agp_map_memory,
-        .agp_unmap_memory       = intel_agp_unmap_memory,
-#endif
+static const struct intel_gtt_driver i81x_gtt_driver = {
+        .gen = 1,
+        .dma_mask_size = 32,
 };
-
-static const struct agp_bridge_driver intel_i965_driver = {
-        .owner                  = THIS_MODULE,
-        .aperture_sizes         = intel_i830_sizes,
-        .size_type              = FIXED_APER_SIZE,
-        .num_aperture_sizes     = 4,
-        .needs_scratch_page     = true,
-        .configure              = intel_i9xx_configure,
-        .fetch_size             = intel_i9xx_fetch_size,
-        .cleanup                = intel_i915_cleanup,
-        .mask_memory            = intel_i965_mask_memory,
-        .masks                  = intel_i810_masks,
-        .agp_enable             = intel_i810_agp_enable,
-        .cache_flush            = global_cache_flush,
-        .create_gatt_table      = intel_i965_create_gatt_table,
-        .free_gatt_table        = intel_i830_free_gatt_table,
-        .insert_memory          = intel_i915_insert_entries,
-        .remove_memory          = intel_i915_remove_entries,
-        .alloc_by_type          = intel_i830_alloc_by_type,
-        .free_by_type           = intel_i810_free_by_type,
-        .agp_alloc_page         = agp_generic_alloc_page,
-        .agp_alloc_pages        = agp_generic_alloc_pages,
-        .agp_destroy_page       = agp_generic_destroy_page,
-        .agp_destroy_pages      = agp_generic_destroy_pages,
-        .agp_type_to_mask_type  = intel_i830_type_to_mask_type,
-        .chipset_flush          = intel_i915_chipset_flush,
-#ifdef USE_PCI_DMA_API
-        .agp_map_page           = intel_agp_map_page,
-        .agp_unmap_page         = intel_agp_unmap_page,
-        .agp_map_memory         = intel_agp_map_memory,
-        .agp_unmap_memory       = intel_agp_unmap_memory,
-#endif
+static const struct intel_gtt_driver i8xx_gtt_driver = {
+        .gen = 2,
+        .setup = i830_setup,
+        .cleanup = i830_cleanup,
+        .write_entry = i830_write_entry,
+        .dma_mask_size = 32,
+        .check_flags = i830_check_flags,
+        .chipset_flush = i830_chipset_flush,
 };
-
-static const struct agp_bridge_driver intel_gen6_driver = {
-        .owner                  = THIS_MODULE,
-        .aperture_sizes         = intel_i830_sizes,
-        .size_type              = FIXED_APER_SIZE,
-        .num_aperture_sizes     = 4,
-        .needs_scratch_page     = true,
-        .configure              = intel_i9xx_configure,
-        .fetch_size             = intel_i9xx_fetch_size,
-        .cleanup                = intel_i915_cleanup,
-        .mask_memory            = intel_gen6_mask_memory,
-        .masks                  = intel_gen6_masks,
-        .agp_enable             = intel_i810_agp_enable,
-        .cache_flush            = global_cache_flush,
-        .create_gatt_table      = intel_i965_create_gatt_table,
-        .free_gatt_table        = intel_i830_free_gatt_table,
-        .insert_memory          = intel_i915_insert_entries,
-        .remove_memory          = intel_i915_remove_entries,
-        .alloc_by_type          = intel_i830_alloc_by_type,
-        .free_by_type           = intel_i810_free_by_type,
-        .agp_alloc_page         = agp_generic_alloc_page,
-        .agp_alloc_pages        = agp_generic_alloc_pages,
-        .agp_destroy_page       = agp_generic_destroy_page,
-        .agp_destroy_pages      = agp_generic_destroy_pages,
-        .agp_type_to_mask_type  = intel_gen6_type_to_mask_type,
-        .chipset_flush          = intel_i915_chipset_flush,
-#ifdef USE_PCI_DMA_API
-        .agp_map_page           = intel_agp_map_page,
-        .agp_unmap_page         = intel_agp_unmap_page,
-        .agp_map_memory         = intel_agp_map_memory,
-        .agp_unmap_memory       = intel_agp_unmap_memory,
-#endif
+static const struct intel_gtt_driver i915_gtt_driver = {
+        .gen = 3,
+        .setup = i9xx_setup,
+        .cleanup = i9xx_cleanup,
+        /* i945 is the last gpu to need phys mem (for overlay and cursors). */
+        .write_entry = i830_write_entry, 
+        .dma_mask_size = 32,
+        .check_flags = i830_check_flags,
+        .chipset_flush = i9xx_chipset_flush,
+};
+static const struct intel_gtt_driver g33_gtt_driver = {
+        .gen = 3,
+        .is_g33 = 1,
+        .setup = i9xx_setup,
+        .cleanup = i9xx_cleanup,
+        .write_entry = i965_write_entry,
+        .dma_mask_size = 36,
+        .check_flags = i830_check_flags,
+        .chipset_flush = i9xx_chipset_flush,
+};
+static const struct intel_gtt_driver pineview_gtt_driver = {
+        .gen = 3,
+        .is_pineview = 1, .is_g33 = 1,
+        .setup = i9xx_setup,
+        .cleanup = i9xx_cleanup,
+        .write_entry = i965_write_entry,
+        .dma_mask_size = 36,
+        .check_flags = i830_check_flags,
+        .chipset_flush = i9xx_chipset_flush,
+};
+static const struct intel_gtt_driver i965_gtt_driver = {
+        .gen = 4,
+        .setup = i9xx_setup,
+        .cleanup = i9xx_cleanup,
+        .write_entry = i965_write_entry,
+        .dma_mask_size = 36,
+        .check_flags = i830_check_flags,
+        .chipset_flush = i9xx_chipset_flush,
+};
+static const struct intel_gtt_driver g4x_gtt_driver = {
+        .gen = 5,
+        .setup = i9xx_setup,
+        .cleanup = i9xx_cleanup,
+        .write_entry = i965_write_entry,
+        .dma_mask_size = 36,
+        .check_flags = i830_check_flags,
+        .chipset_flush = i9xx_chipset_flush,
+};
+static const struct intel_gtt_driver ironlake_gtt_driver = {
+        .gen = 5,
+        .is_ironlake = 1,
+        .setup = i9xx_setup,
+        .cleanup = i9xx_cleanup,
+        .write_entry = i965_write_entry,
+        .dma_mask_size = 36,
+        .check_flags = i830_check_flags,
+        .chipset_flush = i9xx_chipset_flush,
+};
+static const struct intel_gtt_driver sandybridge_gtt_driver = {
+        .gen = 6,
+        .setup = i9xx_setup,
+        .cleanup = gen6_cleanup,
+        .write_entry = gen6_write_entry,
+        .dma_mask_size = 40,
+        .check_flags = gen6_check_flags,
+        .chipset_flush = i9xx_chipset_flush,
 };
 
-static const struct agp_bridge_driver intel_g33_driver = {
-        .owner                  = THIS_MODULE,
-        .aperture_sizes         = intel_i830_sizes,
-        .size_type              = FIXED_APER_SIZE,
-        .num_aperture_sizes     = 4,
-        .needs_scratch_page     = true,
-        .configure              = intel_i9xx_configure,
-        .fetch_size             = intel_i9xx_fetch_size,
-        .cleanup                = intel_i915_cleanup,
-        .mask_memory            = intel_i965_mask_memory,
-        .masks                  = intel_i810_masks,
-        .agp_enable             = intel_i810_agp_enable,
-        .cache_flush            = global_cache_flush,
-        .create_gatt_table      = intel_i915_create_gatt_table,
-        .free_gatt_table        = intel_i830_free_gatt_table,
-        .insert_memory          = intel_i915_insert_entries,
-        .remove_memory          = intel_i915_remove_entries,
-        .alloc_by_type          = intel_i830_alloc_by_type,
-        .free_by_type           = intel_i810_free_by_type,
-        .agp_alloc_page         = agp_generic_alloc_page,
-        .agp_alloc_pages        = agp_generic_alloc_pages,
-        .agp_destroy_page       = agp_generic_destroy_page,
-        .agp_destroy_pages      = agp_generic_destroy_pages,
-        .agp_type_to_mask_type  = intel_i830_type_to_mask_type,
-        .chipset_flush          = intel_i915_chipset_flush,
-#ifdef USE_PCI_DMA_API
-        .agp_map_page           = intel_agp_map_page,
-        .agp_unmap_page         = intel_agp_unmap_page,
-        .agp_map_memory         = intel_agp_map_memory,
-        .agp_unmap_memory       = intel_agp_unmap_memory,
-#endif
+/* Table to describe Intel GMCH and AGP/PCIE GART drivers.  At least one of
+ * driver and gmch_driver must be non-null, and find_gmch will determine
+ * which one should be used if a gmch_chip_id is present.
+ */
+static const struct intel_gtt_driver_description {
+        unsigned int gmch_chip_id;
+        char *name;
+        const struct agp_bridge_driver *gmch_driver;
+        const struct intel_gtt_driver *gtt_driver;
+} intel_gtt_chipsets[] = {
+        { PCI_DEVICE_ID_INTEL_82810_IG1, "i810", &intel_810_driver,
+                &i81x_gtt_driver},
+        { PCI_DEVICE_ID_INTEL_82810_IG3, "i810", &intel_810_driver,
+                &i81x_gtt_driver},
+        { PCI_DEVICE_ID_INTEL_82810E_IG, "i810", &intel_810_driver,
+                &i81x_gtt_driver},
+        { PCI_DEVICE_ID_INTEL_82815_CGC, "i815", &intel_810_driver,
+                &i81x_gtt_driver},
+        { PCI_DEVICE_ID_INTEL_82830_CGC, "830M",
+                &intel_fake_agp_driver, &i8xx_gtt_driver},
+        { PCI_DEVICE_ID_INTEL_82845G_IG, "830M",
+                &intel_fake_agp_driver, &i8xx_gtt_driver},
+        { PCI_DEVICE_ID_INTEL_82854_IG, "854",
+                &intel_fake_agp_driver, &i8xx_gtt_driver},
+        { PCI_DEVICE_ID_INTEL_82855GM_IG, "855GM",
+                &intel_fake_agp_driver, &i8xx_gtt_driver},
+        { PCI_DEVICE_ID_INTEL_82865_IG, "865",
+                &intel_fake_agp_driver, &i8xx_gtt_driver},
+        { PCI_DEVICE_ID_INTEL_E7221_IG, "E7221 (i915)",
+                &intel_fake_agp_driver, &i915_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_82915G_IG, "915G",
+                &intel_fake_agp_driver, &i915_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_82915GM_IG, "915GM",
+                &intel_fake_agp_driver, &i915_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_82945G_IG, "945G",
+                &intel_fake_agp_driver, &i915_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_82945GM_IG, "945GM",
+                &intel_fake_agp_driver, &i915_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_82945GME_IG, "945GME",
+                &intel_fake_agp_driver, &i915_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_82946GZ_IG, "946GZ",
+                &intel_fake_agp_driver, &i965_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_82G35_IG, "G35",
+                &intel_fake_agp_driver, &i965_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_82965Q_IG, "965Q",
+                &intel_fake_agp_driver, &i965_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_82965G_IG, "965G",
+                &intel_fake_agp_driver, &i965_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_82965GM_IG, "965GM",
+                &intel_fake_agp_driver, &i965_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_82965GME_IG, "965GME/GLE",
+                &intel_fake_agp_driver, &i965_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_G33_IG, "G33",
+                &intel_fake_agp_driver, &g33_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_Q35_IG, "Q35",
+                &intel_fake_agp_driver, &g33_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_Q33_IG, "Q33",
+                &intel_fake_agp_driver, &g33_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_PINEVIEW_M_IG, "GMA3150",
+                &intel_fake_agp_driver, &pineview_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_PINEVIEW_IG, "GMA3150",
+                &intel_fake_agp_driver, &pineview_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_GM45_IG, "GM45",
+                &intel_fake_agp_driver, &g4x_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_EAGLELAKE_IG, "Eaglelake",
+                &intel_fake_agp_driver, &g4x_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_Q45_IG, "Q45/Q43",
+                &intel_fake_agp_driver, &g4x_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_G45_IG, "G45/G43",
+                &intel_fake_agp_driver, &g4x_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_B43_IG, "B43",
+                &intel_fake_agp_driver, &g4x_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_B43_1_IG, "B43",
+                &intel_fake_agp_driver, &g4x_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_G41_IG, "G41",
+                &intel_fake_agp_driver, &g4x_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG,
+            "HD Graphics", &intel_fake_agp_driver, &ironlake_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG,
+            "HD Graphics", &intel_fake_agp_driver, &ironlake_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT1_IG,
+            "Sandybridge", &intel_fake_agp_driver, &sandybridge_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT2_IG,
+            "Sandybridge", &intel_fake_agp_driver, &sandybridge_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT2_PLUS_IG,
+            "Sandybridge", &intel_fake_agp_driver, &sandybridge_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT1_IG,
+            "Sandybridge", &intel_fake_agp_driver, &sandybridge_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT2_IG,
+            "Sandybridge", &intel_fake_agp_driver, &sandybridge_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT2_PLUS_IG,
+            "Sandybridge", &intel_fake_agp_driver, &sandybridge_gtt_driver },
+        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_IG,
+            "Sandybridge", &intel_fake_agp_driver, &sandybridge_gtt_driver },
+        { 0, NULL, NULL }
 };
+
+static int find_gmch(u16 device)
+{
+        struct pci_dev *gmch_device;
+
+        gmch_device = pci_get_device(PCI_VENDOR_ID_INTEL, device, NULL);
+        if (gmch_device && PCI_FUNC(gmch_device->devfn) != 0) {
+                gmch_device = pci_get_device(PCI_VENDOR_ID_INTEL,
+                                             device, gmch_device);
+        }
+
+        if (!gmch_device)
+                return 0;
+
+        intel_private.pcidev = gmch_device;
+        return 1;
+}
+
+int intel_gmch_probe(struct pci_dev *pdev,
+                                      struct agp_bridge_data *bridge)
+{
+        int i, mask;
+        bridge->driver = NULL;
+
+        for (i = 0; intel_gtt_chipsets[i].name != NULL; i++) {
+                if (find_gmch(intel_gtt_chipsets[i].gmch_chip_id)) {
+                        bridge->driver =
+                                intel_gtt_chipsets[i].gmch_driver;
+                        intel_private.driver = 
+                                intel_gtt_chipsets[i].gtt_driver;
+                        break;
+                }
+        }
+
+        if (!bridge->driver)
+                return 0;
+
+        bridge->dev_private_data = &intel_private;
+        bridge->dev = pdev;
+
+        intel_private.bridge_dev = pci_dev_get(pdev);
+
+        dev_info(&pdev->dev, "Intel %s Chipset\n", intel_gtt_chipsets[i].name);
+
+        mask = intel_private.driver->dma_mask_size;
+        if (pci_set_dma_mask(intel_private.pcidev, DMA_BIT_MASK(mask)))
+                dev_err(&intel_private.pcidev->dev,
+                        "set gfx device dma mask %d-bit failed!\n", mask);
+        else
+                pci_set_consistent_dma_mask(intel_private.pcidev,
+                                            DMA_BIT_MASK(mask));
+
+        if (bridge->driver == &intel_810_driver)
+                return 1;
+
+        if (intel_gtt_init() != 0)
+                return 0;
+
+        return 1;
+}
+EXPORT_SYMBOL(intel_gmch_probe);
+
+struct intel_gtt *intel_gtt_get(void)
+{
+        return &intel_private.base;
+}
+EXPORT_SYMBOL(intel_gtt_get);
+
+void intel_gmch_remove(struct pci_dev *pdev)
+{
+        if (intel_private.pcidev)
+                pci_dev_put(intel_private.pcidev);
+        if (intel_private.bridge_dev)
+                pci_dev_put(intel_private.bridge_dev);
+}
+EXPORT_SYMBOL(intel_gmch_remove);
+
+MODULE_AUTHOR("Dave Jones <davej@redhat.com>");
+MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c
index a11c8c9ca3d4..b0a70461a12c 100644
--- a/drivers/char/amiserial.c
+++ b/drivers/char/amiserial.c
@@ -1263,6 +1263,36 @@ static int rs_break(struct tty_struct *tty, int break_state)
         return 0;
 }
 
+/*
+ * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
+ * Return: write counters to the user passed counter struct
+ * NB: both 1->0 and 0->1 transitions are counted except for
+ *     RI where only 0->1 is counted.
+ */
+static int rs_get_icount(struct tty_struct *tty,
+                                struct serial_icounter_struct *icount)
+{
+        struct async_struct *info = tty->driver_data;
+        struct async_icount cnow;
+        unsigned long flags;
+
+        local_irq_save(flags);
+        cnow = info->state->icount;
+        local_irq_restore(flags);
+        icount->cts = cnow.cts;
+        icount->dsr = cnow.dsr;
+        icount->rng = cnow.rng;
+        icount->dcd = cnow.dcd;
+        icount->rx = cnow.rx;
+        icount->tx = cnow.tx;
+        icount->frame = cnow.frame;
+        icount->overrun = cnow.overrun;
+        icount->parity = cnow.parity;
+        icount->brk = cnow.brk;
+        icount->buf_overrun = cnow.buf_overrun;
+
+        return 0;
+}
 
 static int rs_ioctl(struct tty_struct *tty, struct file * file,
                     unsigned int cmd, unsigned long arg)
@@ -1332,31 +1362,6 @@ static int rs_ioctl(struct tty_struct *tty, struct file * file,
                         }
                         /* NOTREACHED */
 
-                /* 
-                 * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
-                 * Return: write counters to the user passed counter struct
-                 * NB: both 1->0 and 0->1 transitions are counted except for
-                 *     RI where only 0->1 is counted.
-                 */
-                case TIOCGICOUNT:
-                        local_irq_save(flags);
-                        cnow = info->state->icount;
-                        local_irq_restore(flags);
-                        icount.cts = cnow.cts;
-                        icount.dsr = cnow.dsr;
-                        icount.rng = cnow.rng;
-                        icount.dcd = cnow.dcd;
-                        icount.rx = cnow.rx;
-                        icount.tx = cnow.tx;
-                        icount.frame = cnow.frame;
-                        icount.overrun = cnow.overrun;
-                        icount.parity = cnow.parity;
-                        icount.brk = cnow.brk;
-                        icount.buf_overrun = cnow.buf_overrun;
-
-                        if (copy_to_user(argp, &icount, sizeof(icount)))
-                                return -EFAULT;
-                        return 0;
                 case TIOCSERGWILD:
                 case TIOCSERSWILD:
                         /* "setserial -W" is called in Debian boot */
@@ -1958,6 +1963,7 @@ static const struct tty_operations serial_ops = {
         .wait_until_sent = rs_wait_until_sent,
         .tiocmget = rs_tiocmget,
         .tiocmset = rs_tiocmset,
+        .get_icount = rs_get_icount,
         .proc_fops = &rs_proc_fops,
 };
 
diff --git a/drivers/char/apm-emulation.c b/drivers/char/apm-emulation.c
index 033e1505fca9..45b987c9889e 100644
--- a/drivers/char/apm-emulation.c
+++ b/drivers/char/apm-emulation.c
@@ -7,13 +7,13 @@
  *   Intel Corporation, Microsoft Corporation. Advanced Power Management
  *   (APM) BIOS Interface Specification, Revision 1.2, February 1996.
  *
- * [This document is available from Microsoft at:
- *    http://www.microsoft.com/hwdev/busbios/amp_12.htm]
+ * This document is available from Microsoft at:
+ *    http://www.microsoft.com/whdc/archive/amp_12.mspx
  */
 #include <linux/module.h>
 #include <linux/poll.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/miscdevice.h>
@@ -126,6 +126,7 @@ struct apm_user {
 /*
  * Local variables
  */
+static DEFINE_MUTEX(apm_mutex);
 static atomic_t suspend_acks_pending = ATOMIC_INIT(0);
 static atomic_t userspace_notification_inhibit = ATOMIC_INIT(0);
 static int apm_disabled;
@@ -274,7 +275,7 @@ apm_ioctl(struct file *filp, u_int cmd, u_long arg)
         if (!as->suser || !as->writer)
                 return -EPERM;
 
-        lock_kernel();
+        mutex_lock(&apm_mutex);
         switch (cmd) {
         case APM_IOC_SUSPEND:
                 mutex_lock(&state_lock);
@@ -335,7 +336,7 @@ apm_ioctl(struct file *filp, u_int cmd, u_long arg)
                 mutex_unlock(&state_lock);
                 break;
         }
-        unlock_kernel();
+        mutex_unlock(&apm_mutex);
 
         return err;
 }
@@ -370,7 +371,7 @@ static int apm_open(struct inode * inode, struct file * filp)
 {
         struct apm_user *as;
 
-        lock_kernel();
+        mutex_lock(&apm_mutex);
         as = kzalloc(sizeof(*as), GFP_KERNEL);
         if (as) {
                 /*
@@ -390,7 +391,7 @@ static int apm_open(struct inode * inode, struct file * filp)
 
                 filp->private_data = as;
         }
-        unlock_kernel();
+        mutex_unlock(&apm_mutex);
 
         return as ? 0 : -ENOMEM;
 }
@@ -402,6 +403,7 @@ static const struct file_operations apm_bios_fops = {
         .unlocked_ioctl = apm_ioctl,
         .open           = apm_open,
         .release        = apm_release,
+        .llseek         = noop_llseek,
 };
 
 static struct miscdevice apm_device = {
diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
index f4ae0e0fb631..25373df1dcf8 100644
--- a/drivers/char/applicom.c
+++ b/drivers/char/applicom.c
@@ -26,7 +26,7 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/errno.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/miscdevice.h>
 #include <linux/pci.h>
 #include <linux/wait.h>
@@ -60,6 +60,7 @@
 #define PCI_DEVICE_ID_APPLICOM_PCI2000PFB     0x0003
 #endif
 
+static DEFINE_MUTEX(ac_mutex);
 static char *applicom_pci_devnames[] = {
         "PCI board",
         "PCI2000IBS / PCI2000CAN",
@@ -565,6 +566,7 @@ static ssize_t ac_read (struct file *filp, char __user *buf, size_t count, loff_
                                 struct mailbox mailbox;
 
                                 /* Got a packet for us */
+                                memset(&st_loc, 0, sizeof(st_loc));
                                 ret = do_ac_read(i, buf, &st_loc, &mailbox);
                                 spin_unlock_irqrestore(&apbs[i].mutex, flags);
                                 set_current_state(TASK_RUNNING);
@@ -707,7 +709,7 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         if (IS_ERR(adgl))
                 return PTR_ERR(adgl);
 
-        lock_kernel();  
+        mutex_lock(&ac_mutex);  
         IndexCard = adgl->num_card-1;
          
         if(cmd != 6 && ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) {
@@ -717,7 +719,7 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                         warncount--;
                 }
                 kfree(adgl);
-                unlock_kernel();
+                mutex_unlock(&ac_mutex);
                 return -EINVAL;
         }
 
@@ -835,7 +837,7 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         }
         Dummy = readb(apbs[IndexCard].RamIO + VERS);
         kfree(adgl);
-        unlock_kernel();
+        mutex_unlock(&ac_mutex);
         return 0;
 }
 
diff --git a/drivers/char/bfin-otp.c b/drivers/char/bfin-otp.c
index 836d4f0a876f..44660f1c4849 100644
--- a/drivers/char/bfin-otp.c
+++ b/drivers/char/bfin-otp.c
@@ -222,6 +222,7 @@ static const struct file_operations bfin_otp_fops = {
         .unlocked_ioctl = bfin_otp_ioctl,
         .read           = bfin_otp_read,
         .write          = bfin_otp_write,
+        .llseek         = default_llseek,
 };
 
 static struct miscdevice bfin_otp_misc_device = {
diff --git a/drivers/char/briq_panel.c b/drivers/char/briq_panel.c
index d5fa113afe37..f6718f05dad4 100644
--- a/drivers/char/briq_panel.c
+++ b/drivers/char/briq_panel.c
@@ -186,6 +186,7 @@ static const struct file_operations briq_panel_fops = {
         .write          = briq_panel_write,
         .open           = briq_panel_open,
         .release        = briq_panel_release,
+        .llseek         = noop_llseek,
 };
 
 static struct miscdevice briq_panel_miscdev = {
diff --git a/drivers/char/bsr.c b/drivers/char/bsr.c
index 91917133ae0a..a4a6c2f044b5 100644
--- a/drivers/char/bsr.c
+++ b/drivers/char/bsr.c
@@ -155,6 +155,7 @@ static const struct file_operations bsr_fops = {
         .owner = THIS_MODULE,
         .mmap  = bsr_mmap,
         .open  = bsr_open,
+        .llseek = noop_llseek,
 };
 
 static void bsr_cleanup_devs(void)
diff --git a/drivers/char/cs5535_gpio.c b/drivers/char/cs5535_gpio.c
index 4d830dc482ef..0cf1e5fad9ab 100644
--- a/drivers/char/cs5535_gpio.c
+++ b/drivers/char/cs5535_gpio.c
@@ -169,7 +169,8 @@ static const struct file_operations cs5535_gpio_fops = {
         .owner  = THIS_MODULE,
         .write  = cs5535_gpio_write,
         .read   = cs5535_gpio_read,
-        .open   = cs5535_gpio_open
+        .open   = cs5535_gpio_open,
+        .llseek = no_llseek,
 };
 
 static int __init cs5535_gpio_init(void)
diff --git a/drivers/char/cyclades.c b/drivers/char/cyclades.c
index 27aad9422332..4f152c28f40e 100644
--- a/drivers/char/cyclades.c
+++ b/drivers/char/cyclades.c
@@ -2790,29 +2790,6 @@ cy_ioctl(struct tty_struct *tty, struct file *file,
                  * NB: both 1->0 and 0->1 transitions are counted except for
                  *     RI where only 0->1 is counted.
                  */
-        case TIOCGICOUNT: {
-                struct serial_icounter_struct sic = { };
-
-                spin_lock_irqsave(&info->card->card_lock, flags);
-                cnow = info->icount;
-                spin_unlock_irqrestore(&info->card->card_lock, flags);
-
-                sic.cts = cnow.cts;
-                sic.dsr = cnow.dsr;
-                sic.rng = cnow.rng;
-                sic.dcd = cnow.dcd;
-                sic.rx = cnow.rx;
-                sic.tx = cnow.tx;
-                sic.frame = cnow.frame;
-                sic.overrun = cnow.overrun;
-                sic.parity = cnow.parity;
-                sic.brk = cnow.brk;
-                sic.buf_overrun = cnow.buf_overrun;
-
-                if (copy_to_user(argp, &sic, sizeof(sic)))
-                        ret_val = -EFAULT;
-                break;
-        }
         default:
                 ret_val = -ENOIOCTLCMD;
         }
@@ -2823,6 +2800,31 @@ cy_ioctl(struct tty_struct *tty, struct file *file,
         return ret_val;
 }                               /* cy_ioctl */
 
+static int cy_get_icount(struct tty_struct *tty,
+                                struct serial_icounter_struct *sic)
+{
+        struct cyclades_port *info = tty->driver_data;
+        struct cyclades_icount cnow;    /* Used to snapshot */
+        unsigned long flags;
+
+        spin_lock_irqsave(&info->card->card_lock, flags);
+        cnow = info->icount;
+        spin_unlock_irqrestore(&info->card->card_lock, flags);
+
+        sic->cts = cnow.cts;
+        sic->dsr = cnow.dsr;
+        sic->rng = cnow.rng;
+        sic->dcd = cnow.dcd;
+        sic->rx = cnow.rx;
+        sic->tx = cnow.tx;
+        sic->frame = cnow.frame;
+        sic->overrun = cnow.overrun;
+        sic->parity = cnow.parity;
+        sic->brk = cnow.brk;
+        sic->buf_overrun = cnow.buf_overrun;
+        return 0;
+}
+
 /*
  * This routine allows the tty driver to be notified when
  * device's termios settings have changed.  Note that a
@@ -4084,6 +4086,7 @@ static const struct tty_operations cy_ops = {
         .wait_until_sent = cy_wait_until_sent,
         .tiocmget = cy_tiocmget,
         .tiocmset = cy_tiocmset,
+        .get_icount = cy_get_icount,
         .proc_fops = &cyclades_proc_fops,
 };
 
diff --git a/drivers/char/ds1302.c b/drivers/char/ds1302.c
index 170693c93c73..ed8303f9890c 100644
--- a/drivers/char/ds1302.c
+++ b/drivers/char/ds1302.c
@@ -20,7 +20,7 @@
 #include <linux/miscdevice.h>
 #include <linux/delay.h>
 #include <linux/bcd.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/uaccess.h>
 #include <linux/io.h>
 
@@ -32,6 +32,7 @@
 
 #define RTC_MAJOR_NR 121 /* local major, change later */
 
+static DEFINE_MUTEX(rtc_mutex);
 static const char ds1302_name[] = "ds1302";
 
 /* Send 8 bits. */
@@ -164,9 +165,9 @@ static long rtc_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                         struct rtc_time rtc_tm;
 
                         memset(&rtc_tm, 0, sizeof (struct rtc_time));
-                        lock_kernel();
+                        mutex_lock(&rtc_mutex);
                         get_rtc_time(&rtc_tm);
-                        unlock_kernel();
+                        mutex_unlock(&rtc_mutex);
                         if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
                                 return -EFAULT;
                         return 0;
@@ -218,7 +219,7 @@ static long rtc_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                         mon = bin2bcd(mon);
                         yrs = bin2bcd(yrs);
 
-                        lock_kernel();
+                        mutex_lock(&rtc_mutex);
                         local_irq_save(flags);
                         CMOS_WRITE(yrs, RTC_YEAR);
                         CMOS_WRITE(mon, RTC_MONTH);
@@ -227,7 +228,7 @@ static long rtc_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                         CMOS_WRITE(min, RTC_MINUTES);
                         CMOS_WRITE(sec, RTC_SECONDS);
                         local_irq_restore(flags);
-                        unlock_kernel();
+                        mutex_unlock(&rtc_mutex);
 
                         /* Notice that at this point, the RTC is updated but
                          * the kernel is still running with the old time.
@@ -247,10 +248,10 @@ static long rtc_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                         if(copy_from_user(&tcs_val, (int*)arg, sizeof(int)))
                                 return -EFAULT;
 
-                        lock_kernel();
+                        mutex_lock(&rtc_mutex);
                         tcs_val = RTC_TCR_PATTERN | (tcs_val & 0x0F);
                         ds1302_writereg(RTC_TRICKLECHARGER, tcs_val);
-                        unlock_kernel();
+                        mutex_unlock(&rtc_mutex);
                         return 0;
                 }
                 default:
@@ -288,6 +289,7 @@ get_rtc_status(char *buf)
 static const struct file_operations rtc_fops = {
         .owner          = THIS_MODULE,
         .unlocked_ioctl = rtc_ioctl,
+        .llseek         = noop_llseek,
 };
 
 /* Probe for the chip by writing something to its RAM and try reading it back. */
diff --git a/drivers/char/ds1620.c b/drivers/char/ds1620.c
index dbee8688f75c..aab9605f0b43 100644
--- a/drivers/char/ds1620.c
+++ b/drivers/char/ds1620.c
@@ -8,7 +8,7 @@
 #include <linux/proc_fs.h>
 #include <linux/capability.h>
 #include <linux/init.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 
 #include <mach/hardware.h>
 #include <asm/mach-types.h>
@@ -34,6 +34,7 @@
 #define CFG_CPU                 2
 #define CFG_1SHOT               1
 
+static DEFINE_MUTEX(ds1620_mutex);
 static const char *fan_state[] = { "off", "on", "on (hardwired)" };
 
 /*
@@ -210,7 +211,6 @@ static void ds1620_read_state(struct therm *therm)
 
 static int ds1620_open(struct inode *inode, struct file *file)
 {
-        cycle_kernel_lock();
         return nonseekable_open(inode, file);
 }
 
@@ -321,9 +321,9 @@ ds1620_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
         int ret;
 
-        lock_kernel();
+        mutex_lock(&ds1620_mutex);
         ret = ds1620_ioctl(file, cmd, arg);
-        unlock_kernel();
+        mutex_unlock(&ds1620_mutex);
 
         return ret;
 }
@@ -357,6 +357,7 @@ static const struct file_operations ds1620_fops = {
         .open           = ds1620_open,
         .read           = ds1620_read,
         .unlocked_ioctl = ds1620_unlocked_ioctl,
+        .llseek         = no_llseek,
 };
 
 static struct miscdevice ds1620_miscdev = {
diff --git a/drivers/char/dsp56k.c b/drivers/char/dsp56k.c
index 8a1b28a10ef0..052797b32bd3 100644
--- a/drivers/char/dsp56k.c
+++ b/drivers/char/dsp56k.c
@@ -32,7 +32,7 @@
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/device.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/firmware.h>
 #include <linux/platform_device.h>
 #include <linux/uaccess.h>      /* For put_user and get_user */
@@ -94,6 +94,7 @@
         } \
 }
 
+static DEFINE_MUTEX(dsp56k_mutex);
 static struct dsp56k_device {
         unsigned long in_use;
         long maxio, timeout;
@@ -330,9 +331,9 @@ static long dsp56k_ioctl(struct file *file, unsigned int cmd,
                         if (len > DSP56K_MAX_BINARY_LENGTH) {
                                 return -EINVAL;
                         }
-                        lock_kernel();
+                        mutex_lock(&dsp56k_mutex);
                         r = dsp56k_upload(bin, len);
-                        unlock_kernel();
+                        mutex_unlock(&dsp56k_mutex);
                         if (r < 0) {
                                 return r;
                         }
@@ -342,16 +343,16 @@ static long dsp56k_ioctl(struct file *file, unsigned int cmd,
                 case DSP56K_SET_TX_WSIZE:
                         if (arg > 4 || arg < 1)
                                 return -EINVAL;
-                        lock_kernel();
+                        mutex_lock(&dsp56k_mutex);
                         dsp56k.tx_wsize = (int) arg;
-                        unlock_kernel();
+                        mutex_unlock(&dsp56k_mutex);
                         break;
                 case DSP56K_SET_RX_WSIZE:
                         if (arg > 4 || arg < 1)
                                 return -EINVAL;
-                        lock_kernel();
+                        mutex_lock(&dsp56k_mutex);
                         dsp56k.rx_wsize = (int) arg;
-                        unlock_kernel();
+                        mutex_unlock(&dsp56k_mutex);
                         break;
                 case DSP56K_HOST_FLAGS:
                 {
@@ -363,7 +364,7 @@ static long dsp56k_ioctl(struct file *file, unsigned int cmd,
                         if(get_user(out, &hf->out) < 0)
                                 return -EFAULT;
 
-                        lock_kernel();
+                        mutex_lock(&dsp56k_mutex);
                         if ((dir & 0x1) && (out & 0x1))
                                 dsp56k_host_interface.icr |= DSP56K_ICR_HF0;
                         else if (dir & 0x1)
@@ -378,16 +379,16 @@ static long dsp56k_ioctl(struct file *file, unsigned int cmd,
                         if (dsp56k_host_interface.icr & DSP56K_ICR_HF1) status |= 0x2;
                         if (dsp56k_host_interface.isr & DSP56K_ISR_HF2) status |= 0x4;
                         if (dsp56k_host_interface.isr & DSP56K_ISR_HF3) status |= 0x8;
-                        unlock_kernel();
+                        mutex_unlock(&dsp56k_mutex);
                         return put_user(status, &hf->status);
                 }
                 case DSP56K_HOST_CMD:
                         if (arg > 31 || arg < 0)
                                 return -EINVAL;
-                        lock_kernel();
+                        mutex_lock(&dsp56k_mutex);
                         dsp56k_host_interface.cvr = (u_char)((arg & DSP56K_CVR_HV_MASK) |
                                                              DSP56K_CVR_HC);
-                        unlock_kernel();
+                        mutex_unlock(&dsp56k_mutex);
                         break;
                 default:
                         return -EINVAL;
@@ -427,7 +428,7 @@ static int dsp56k_open(struct inode *inode, struct file *file)
         int dev = iminor(inode) & 0x0f;
         int ret = 0;
 
-        lock_kernel();
+        mutex_lock(&dsp56k_mutex);
         switch(dev)
         {
         case DSP56K_DEV_56001:
@@ -454,7 +455,7 @@ static int dsp56k_open(struct inode *inode, struct file *file)
                 ret = -ENODEV;
         }
 out:
-        unlock_kernel();
+        mutex_unlock(&dsp56k_mutex);
         return ret;
 }
 
@@ -482,6 +483,7 @@ static const struct file_operations dsp56k_fops = {
         .unlocked_ioctl = dsp56k_ioctl,
         .open           = dsp56k_open,
         .release        = dsp56k_release,
+        .llseek         = noop_llseek,
 };
 
 
diff --git a/drivers/char/dtlk.c b/drivers/char/dtlk.c
index e3859d4eaead..85156dd0caee 100644
--- a/drivers/char/dtlk.c
+++ b/drivers/char/dtlk.c
@@ -57,7 +57,7 @@
 #include <linux/ioport.h>       /* for request_region */
 #include <linux/delay.h>        /* for loops_per_jiffy */
 #include <linux/sched.h>
-#include <linux/smp_lock.h>     /* cycle_kernel_lock() */
+#include <linux/mutex.h>
 #include <asm/io.h>             /* for inb_p, outb_p, inb, outb, etc. */
 #include <asm/uaccess.h>        /* for get_user, etc. */
 #include <linux/wait.h>         /* for wait_queue */
@@ -73,6 +73,7 @@
 #define TRACE_RET ((void) 0)
 #endif                          /* TRACING */
 
+static DEFINE_MUTEX(dtlk_mutex);
 static void dtlk_timer_tick(unsigned long data);
 
 static int dtlk_major;
@@ -105,6 +106,7 @@ static const struct file_operations dtlk_fops =
         .unlocked_ioctl = dtlk_ioctl,
         .open           = dtlk_open,
         .release        = dtlk_release,
+        .llseek         = no_llseek,
 };
 
 /* local prototypes */
@@ -275,9 +277,9 @@ static long dtlk_ioctl(struct file *file,
         switch (cmd) {
 
         case DTLK_INTERROGATE:
-                lock_kernel();
+                mutex_lock(&dtlk_mutex);
                 sp = dtlk_interrogate();
-                unlock_kernel();
+                mutex_unlock(&dtlk_mutex);
                 if (copy_to_user(argp, sp, sizeof(struct dtlk_settings)))
                         return -EINVAL;
                 return 0;
@@ -296,7 +298,6 @@ static int dtlk_open(struct inode *inode, struct file *file)
 {
         TRACE_TEXT("(dtlk_open");
 
-        cycle_kernel_lock();
         nonseekable_open(inode, file);
         switch (iminor(inode)) {
         case DTLK_MINOR:
diff --git a/drivers/char/generic_nvram.c b/drivers/char/generic_nvram.c
index 82b5a88a82d7..0e941b57482e 100644
--- a/drivers/char/generic_nvram.c
+++ b/drivers/char/generic_nvram.c
@@ -19,7 +19,7 @@
 #include <linux/miscdevice.h>
 #include <linux/fcntl.h>
 #include <linux/init.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <asm/uaccess.h>
 #include <asm/nvram.h>
 #ifdef CONFIG_PPC_PMAC
@@ -28,6 +28,7 @@
 
 #define NVRAM_SIZE      8192
 
+static DEFINE_MUTEX(nvram_mutex);
 static ssize_t nvram_len;
 
 static loff_t nvram_llseek(struct file *file, loff_t offset, int origin)
@@ -120,9 +121,9 @@ static long nvram_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned l
 {
         int ret;
 
-        lock_kernel();
+        mutex_lock(&nvram_mutex);
         ret = nvram_ioctl(file, cmd, arg);
-        unlock_kernel();
+        mutex_unlock(&nvram_mutex);
 
         return ret;
 }
diff --git a/drivers/char/genrtc.c b/drivers/char/genrtc.c
index b6c2cc167c11..f773a9dd14f3 100644
--- a/drivers/char/genrtc.c
+++ b/drivers/char/genrtc.c
@@ -52,7 +52,7 @@
 #include <linux/init.h>
 #include <linux/poll.h>
 #include <linux/proc_fs.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/workqueue.h>
 
 #include <asm/uaccess.h>
@@ -66,6 +66,7 @@
  *      ioctls.
  */
 
+static DEFINE_MUTEX(gen_rtc_mutex);
 static DECLARE_WAIT_QUEUE_HEAD(gen_rtc_wait);
 
 /*
@@ -337,9 +338,9 @@ static long gen_rtc_unlocked_ioctl(struct file *file, unsigned int cmd,
 {
         int ret;
 
-        lock_kernel();
+        mutex_lock(&gen_rtc_mutex);
         ret = gen_rtc_ioctl(file, cmd, arg);
-        unlock_kernel();
+        mutex_unlock(&gen_rtc_mutex);
 
         return ret;
 }
@@ -352,16 +353,16 @@ static long gen_rtc_unlocked_ioctl(struct file *file, unsigned int cmd,
 
 static int gen_rtc_open(struct inode *inode, struct file *file)
 {
-        lock_kernel();
+        mutex_lock(&gen_rtc_mutex);
         if (gen_rtc_status & RTC_IS_OPEN) {
-                unlock_kernel();
+                mutex_unlock(&gen_rtc_mutex);
                 return -EBUSY;
         }
 
         gen_rtc_status |= RTC_IS_OPEN;
         gen_rtc_irq_data = 0;
         irq_active = 0;
-        unlock_kernel();
+        mutex_unlock(&gen_rtc_mutex);
 
         return 0;
 }
@@ -497,6 +498,7 @@ static const struct file_operations gen_rtc_fops = {
         .unlocked_ioctl = gen_rtc_unlocked_ioctl,
         .open           = gen_rtc_open,
         .release        = gen_rtc_release,
+        .llseek         = noop_llseek,
 };
 
 static struct miscdevice rtc_gen_dev =
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index a0a1829d3198..55b8667f739f 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -30,13 +30,14 @@
 #include <linux/bcd.h>
 #include <linux/seq_file.h>
 #include <linux/bitops.h>
+#include <linux/compat.h>
 #include <linux/clocksource.h>
+#include <linux/uaccess.h>
 #include <linux/slab.h>
+#include <linux/io.h>
 
 #include <asm/current.h>
-#include <asm/uaccess.h>
 #include <asm/system.h>
-#include <asm/io.h>
 #include <asm/irq.h>
 #include <asm/div64.h>
 
@@ -67,6 +68,7 @@
 #define read_counter(MC)        readl(MC)
 #endif
 
+static DEFINE_MUTEX(hpet_mutex); /* replaces BKL */
 static u32 hpet_nhpet, hpet_max_freq = HPET_USER_FREQ;
 
 /* This clocksource driver currently only works on ia64 */
@@ -79,13 +81,13 @@ static cycle_t read_hpet(struct clocksource *cs)
 }
 
 static struct clocksource clocksource_hpet = {
-        .name           = "hpet",
-        .rating         = 250,
-        .read           = read_hpet,
-        .mask           = CLOCKSOURCE_MASK(64),
-        .mult           = 0, /* to be calculated */
-        .shift          = 10,
-        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
+        .name           = "hpet",
+        .rating         = 250,
+        .read           = read_hpet,
+        .mask           = CLOCKSOURCE_MASK(64),
+        .mult           = 0,            /* to be calculated */
+        .shift          = 10,
+        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 static struct clocksource *hpet_clocksource;
 #endif
@@ -250,7 +252,7 @@ static int hpet_open(struct inode *inode, struct file *file)
         if (file->f_mode & FMODE_WRITE)
                 return -EINVAL;
 
-        lock_kernel();
+        mutex_lock(&hpet_mutex);
         spin_lock_irq(&hpet_lock);
 
         for (devp = NULL, hpetp = hpets; hpetp && !devp; hpetp = hpetp->hp_next)
@@ -264,7 +266,7 @@ static int hpet_open(struct inode *inode, struct file *file)
 
         if (!devp) {
                 spin_unlock_irq(&hpet_lock);
-                unlock_kernel();
+                mutex_unlock(&hpet_mutex);
                 return -EBUSY;
         }
 
@@ -272,7 +274,7 @@ static int hpet_open(struct inode *inode, struct file *file)
         devp->hd_irqdata = 0;
         devp->hd_flags |= HPET_OPEN;
         spin_unlock_irq(&hpet_lock);
-        unlock_kernel();
+        mutex_unlock(&hpet_mutex);
 
         hpet_timer_set_irq(devp);
 
@@ -429,22 +431,6 @@ static int hpet_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-static int hpet_ioctl_common(struct hpet_dev *, int, unsigned long, int);
-
-static long hpet_ioctl(struct file *file, unsigned int cmd,
-                        unsigned long arg)
-{
-        struct hpet_dev *devp;
-        int ret;
-
-        devp = file->private_data;
-        lock_kernel();
-        ret = hpet_ioctl_common(devp, cmd, arg, 0);
-        unlock_kernel();
-
-        return ret;
-}
-
 static int hpet_ioctl_ieon(struct hpet_dev *devp)
 {
         struct hpet_timer __iomem *timer;
@@ -479,6 +465,21 @@ static int hpet_ioctl_ieon(struct hpet_dev *devp)
         if (irq) {
                 unsigned long irq_flags;
 
+                if (devp->hd_flags & HPET_SHARED_IRQ) {
+                        /*
+                         * To prevent the interrupt handler from seeing an
+                         * unwanted interrupt status bit, program the timer
+                         * so that it will not fire in the near future ...
+                         */
+                        writel(readl(&timer->hpet_config) & ~Tn_TYPE_CNF_MASK,
+                               &timer->hpet_config);
+                        write_counter(read_counter(&hpet->hpet_mc),
+                                      &timer->hpet_compare);
+                        /* ... and clear any left-over status. */
+                        isr = 1 << (devp - devp->hd_hpets->hp_dev);
+                        writel(isr, &hpet->hpet_isr);
+                }
+
                 sprintf(devp->hd_name, "hpet%d", (int)(devp - hpetp->hp_dev));
                 irq_flags = devp->hd_flags & HPET_SHARED_IRQ
                                                 ? IRQF_SHARED : IRQF_DISABLED;
@@ -553,7 +554,8 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
 }
 
 static int
-hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
+hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
+                  struct hpet_info *info)
 {
         struct hpet_timer __iomem *timer;
         struct hpet __iomem *hpet;
@@ -594,23 +596,14 @@ hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
                 break;
         case HPET_INFO:
                 {
-                        struct hpet_info info;
-
+                        memset(info, 0, sizeof(*info));
                         if (devp->hd_ireqfreq)
-                                info.hi_ireqfreq =
+                                info->hi_ireqfreq =
                                         hpet_time_div(hpetp, devp->hd_ireqfreq);
-                        else
-                                info.hi_ireqfreq = 0;
-                        info.hi_flags =
+                        info->hi_flags =
                             readq(&timer->hpet_config) & Tn_PER_INT_CAP_MASK;
-                        info.hi_hpet = hpetp->hp_which;
-                        info.hi_timer = devp - hpetp->hp_dev;
-                        if (kernel)
-                                memcpy((void *)arg, &info, sizeof(info));
-                        else
-                                if (copy_to_user((void __user *)arg, &info,
-                                                 sizeof(info)))
-                                        err = -EFAULT;
+                        info->hi_hpet = hpetp->hp_which;
+                        info->hi_timer = devp - hpetp->hp_dev;
                         break;
                 }
         case HPET_EPI:
@@ -636,7 +629,7 @@ hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
                 devp->hd_flags &= ~HPET_PERIODIC;
                 break;
         case HPET_IRQFREQ:
-                if (!kernel && (arg > hpet_max_freq) &&
+                if ((arg > hpet_max_freq) &&
                     !capable(CAP_SYS_RESOURCE)) {
                         err = -EACCES;
                         break;
@@ -653,12 +646,63 @@ hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
         return err;
 }
 
+static long
+hpet_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+        struct hpet_info info;
+        int err;
+
+        mutex_lock(&hpet_mutex);
+        err = hpet_ioctl_common(file->private_data, cmd, arg, &info);
+        mutex_unlock(&hpet_mutex);
+
+        if ((cmd == HPET_INFO) && !err &&
+            (copy_to_user((void __user *)arg, &info, sizeof(info))))
+                err = -EFAULT;
+
+        return err;
+}
+
+#ifdef CONFIG_COMPAT
+struct compat_hpet_info {
+        compat_ulong_t hi_ireqfreq;     /* Hz */
+        compat_ulong_t hi_flags;        /* information */
+        unsigned short hi_hpet;
+        unsigned short hi_timer;
+};
+
+static long
+hpet_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+        struct hpet_info info;
+        int err;
+
+        mutex_lock(&hpet_mutex);
+        err = hpet_ioctl_common(file->private_data, cmd, arg, &info);
+        mutex_unlock(&hpet_mutex);
+
+        if ((cmd == HPET_INFO) && !err) {
+                struct compat_hpet_info __user *u = compat_ptr(arg);
+                if (put_user(info.hi_ireqfreq, &u->hi_ireqfreq) ||
+                    put_user(info.hi_flags, &u->hi_flags) ||
+                    put_user(info.hi_hpet, &u->hi_hpet) ||
+                    put_user(info.hi_timer, &u->hi_timer))
+                        err = -EFAULT;
+        }
+
+        return err;
+}
+#endif
+
 static const struct file_operations hpet_fops = {
         .owner = THIS_MODULE,
         .llseek = no_llseek,
         .read = hpet_read,
         .poll = hpet_poll,
         .unlocked_ioctl = hpet_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = hpet_compat_ioctl,
+#endif
         .open = hpet_open,
         .release = hpet_release,
         .fasync = hpet_fasync,
@@ -781,7 +825,7 @@ int hpet_alloc(struct hpet_data *hdp)
         struct hpets *hpetp;
         size_t siz;
         struct hpet __iomem *hpet;
-        static struct hpets *last = NULL;
+        static struct hpets *last;
         unsigned long period;
         unsigned long long temp;
         u32 remainder;
@@ -970,6 +1014,8 @@ static int hpet_acpi_add(struct acpi_device *device)
                 return -ENODEV;
 
         if (!data.hd_address || !data.hd_nirqs) {
+                if (data.hd_address)
+                        iounmap(data.hd_address);
                 printk("%s: no address or irqs in _CRS\n", __func__);
                 return -ENODEV;
         }
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index 3afd62e856eb..e9cba13ee800 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -713,7 +713,6 @@ static int khvcd(void *unused)
         struct hvc_struct *hp;
 
         set_freezable();
-        __set_current_state(TASK_RUNNING);
         do {
                 poll_mask = 0;
                 hvc_kicked = 0;
diff --git a/drivers/char/hvc_iucv.c b/drivers/char/hvc_iucv.c
index 7b01bc609de3..c3425bb3a1f6 100644
--- a/drivers/char/hvc_iucv.c
+++ b/drivers/char/hvc_iucv.c
@@ -1303,13 +1303,11 @@ static int __init hvc_iucv_init(void)
         if (rc) {
                 pr_err("Registering IUCV handlers failed with error code=%d\n",
                         rc);
-                goto out_error_iucv;
+                goto out_error_hvc;
         }
 
         return 0;
 
-out_error_iucv:
-        iucv_unregister(&hvc_iucv_handler, 0);
 out_error_hvc:
         for (i = 0; i < hvc_iucv_devices; i++)
                 if (hvc_iucv_table[i])
diff --git a/drivers/char/hvc_tile.c b/drivers/char/hvc_tile.c
index c4efb55cbc03..7a84a0595477 100644
--- a/drivers/char/hvc_tile.c
+++ b/drivers/char/hvc_tile.c
@@ -61,7 +61,8 @@ console_initcall(hvc_tile_console_init);
 
 static int __init hvc_tile_init(void)
 {
-        hvc_alloc(0, 0, &hvc_tile_get_put_ops, 128);
-        return 0;
+        struct hvc_struct *s;
+        s = hvc_alloc(0, 0, &hvc_tile_get_put_ops, 128);
+        return IS_ERR(s) ? PTR_ERR(s) : 0;
 }
 device_initcall(hvc_tile_init);
diff --git a/drivers/char/hvc_xen.c b/drivers/char/hvc_xen.c
index 60446f82a3fc..6b8e6d18a8e6 100644
--- a/drivers/char/hvc_xen.c
+++ b/drivers/char/hvc_xen.c
@@ -74,7 +74,8 @@ static int __write_console(const char *data, int len)
         wmb();                  /* write ring before updating pointer */
         intf->out_prod = prod;
 
-        notify_daemon();
+        if (sent)
+                notify_daemon();
         return sent;
 }
 
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 3d9c61e5acbf..788da05190cc 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -170,6 +170,7 @@ static const struct file_operations rng_chrdev_ops = {
         .owner          = THIS_MODULE,
         .open           = rng_dev_open,
         .read           = rng_dev_read,
+        .llseek         = noop_llseek,
 };
 
 static struct miscdevice rng_miscdev = {
diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
index 4cd8b227c11f..3bc0eef88717 100644
--- a/drivers/char/i8k.c
+++ b/drivers/char/i8k.c
@@ -23,7 +23,7 @@
 #include <linux/seq_file.h>
 #include <linux/dmi.h>
 #include <linux/capability.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
 
@@ -56,6 +56,7 @@
 
 #define I8K_TEMPERATURE_BUG     1
 
+static DEFINE_MUTEX(i8k_mutex);
 static char bios_version[4];
 
 MODULE_AUTHOR("Massimo Dal Zotto (dz@debian.org)");
@@ -399,9 +400,9 @@ static long i8k_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
 {
         long ret;
 
-        lock_kernel();
+        mutex_lock(&i8k_mutex);
         ret = i8k_ioctl_unlocked(fp, cmd, arg);
-        unlock_kernel();
+        mutex_unlock(&i8k_mutex);
 
         return ret;
 }
diff --git a/drivers/char/ip2/Makefile b/drivers/char/ip2/Makefile
index bc397d92b499..7b78e0dfc5b0 100644
--- a/drivers/char/ip2/Makefile
+++ b/drivers/char/ip2/Makefile
@@ -4,5 +4,5 @@
 
 obj-$(CONFIG_COMPUTONE)         += ip2.o
 
-ip2-objs                        := ip2main.o
+ip2-y                   := ip2main.o
 
diff --git a/drivers/char/ip2/ip2main.c b/drivers/char/ip2/ip2main.c
index d4b71e8d0d23..fcd02baa7d65 100644
--- a/drivers/char/ip2/ip2main.c
+++ b/drivers/char/ip2/ip2main.c
@@ -98,7 +98,7 @@
 #include <linux/major.h>
 #include <linux/wait.h>
 #include <linux/device.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/firmware.h>
 #include <linux/platform_device.h>
 
@@ -138,6 +138,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 
+static DEFINE_MUTEX(ip2_mutex);
 static const struct file_operations ip2mem_proc_fops;
 static const struct file_operations ip2_proc_fops;
 
@@ -183,6 +184,8 @@ static void ip2_hangup(PTTY);
 static int  ip2_tiocmget(struct tty_struct *tty, struct file *file);
 static int  ip2_tiocmset(struct tty_struct *tty, struct file *file,
                          unsigned int set, unsigned int clear);
+static int ip2_get_icount(struct tty_struct *tty,
+                struct serial_icounter_struct *icount);
 
 static void set_irq(int, int);
 static void ip2_interrupt_bh(struct work_struct *work);
@@ -236,6 +239,7 @@ static const struct file_operations ip2_ipl = {
         .write          = ip2_ipl_write,
         .unlocked_ioctl = ip2_ipl_ioctl,
         .open           = ip2_ipl_open,
+        .llseek         = noop_llseek,
 }; 
 
 static unsigned long irq_counter;
@@ -454,6 +458,7 @@ static const struct tty_operations ip2_ops = {
         .hangup          = ip2_hangup,
         .tiocmget        = ip2_tiocmget,
         .tiocmset        = ip2_tiocmset,
+        .get_icount      = ip2_get_icount,
         .proc_fops       = &ip2_proc_fops,
 };
 
@@ -2128,7 +2133,6 @@ ip2_ioctl ( PTTY tty, struct file *pFile, UINT cmd, ULONG arg )
         i2ChanStrPtr pCh = DevTable[tty->index];
         i2eBordStrPtr pB;
         struct async_icount cprev, cnow;        /* kernel counter temps */
-        struct serial_icounter_struct __user *p_cuser;
         int rc = 0;
         unsigned long flags;
         void __user *argp = (void __user *)arg;
@@ -2297,34 +2301,6 @@ ip2_ioctl ( PTTY tty, struct file *pFile, UINT cmd, ULONG arg )
                 break;
 
         /*
-         * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
-         * Return: write counters to the user passed counter struct
-         * NB: both 1->0 and 0->1 transitions are counted except for RI where
-         * only 0->1 is counted. The controller is quite capable of counting
-         * both, but this done to preserve compatibility with the standard
-         * serial driver.
-         */
-        case TIOCGICOUNT:
-                ip2trace (CHANN, ITRC_IOCTL, 11, 1, rc );
-
-                write_lock_irqsave(&pB->read_fifo_spinlock, flags);
-                cnow = pCh->icount;
-                write_unlock_irqrestore(&pB->read_fifo_spinlock, flags);
-                p_cuser = argp;
-                rc = put_user(cnow.cts, &p_cuser->cts);
-                rc = put_user(cnow.dsr, &p_cuser->dsr);
-                rc = put_user(cnow.rng, &p_cuser->rng);
-                rc = put_user(cnow.dcd, &p_cuser->dcd);
-                rc = put_user(cnow.rx, &p_cuser->rx);
-                rc = put_user(cnow.tx, &p_cuser->tx);
-                rc = put_user(cnow.frame, &p_cuser->frame);
-                rc = put_user(cnow.overrun, &p_cuser->overrun);
-                rc = put_user(cnow.parity, &p_cuser->parity);
-                rc = put_user(cnow.brk, &p_cuser->brk);
-                rc = put_user(cnow.buf_overrun, &p_cuser->buf_overrun);
-                break;
-
-        /*
          * The rest are not supported by this driver. By returning -ENOIOCTLCMD they
          * will be passed to the line discipline for it to handle.
          */
@@ -2348,6 +2324,46 @@ ip2_ioctl ( PTTY tty, struct file *pFile, UINT cmd, ULONG arg )
         return rc;
 }
 
+static int ip2_get_icount(struct tty_struct *tty,
+                struct serial_icounter_struct *icount)
+{
+        i2ChanStrPtr pCh = DevTable[tty->index];
+        i2eBordStrPtr pB;
+        struct async_icount cnow;       /* kernel counter temp */
+        unsigned long flags;
+
+        if ( pCh == NULL )
+                return -ENODEV;
+
+        pB = pCh->pMyBord;
+
+        /*
+         * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
+         * Return: write counters to the user passed counter struct
+         * NB: both 1->0 and 0->1 transitions are counted except for RI where
+         * only 0->1 is counted. The controller is quite capable of counting
+         * both, but this done to preserve compatibility with the standard
+         * serial driver.
+         */
+
+        write_lock_irqsave(&pB->read_fifo_spinlock, flags);
+        cnow = pCh->icount;
+        write_unlock_irqrestore(&pB->read_fifo_spinlock, flags);
+
+        icount->cts = cnow.cts;
+        icount->dsr = cnow.dsr;
+        icount->rng = cnow.rng;
+        icount->dcd = cnow.dcd;
+        icount->rx = cnow.rx;
+        icount->tx = cnow.tx;
+        icount->frame = cnow.frame;
+        icount->overrun = cnow.overrun;
+        icount->parity = cnow.parity;
+        icount->brk = cnow.brk;
+        icount->buf_overrun = cnow.buf_overrun;
+        return 0;
+}
+
 /******************************************************************************/
 /* Function:   GetSerialInfo()                                                */
 /* Parameters: Pointer to channel structure                                   */
@@ -2897,7 +2913,7 @@ ip2_ipl_ioctl (struct file *pFile, UINT cmd, ULONG arg )
         printk (KERN_DEBUG "IP2IPL: ioctl cmd %d, arg %ld\n", cmd, arg );
 #endif
 
-        lock_kernel();
+        mutex_lock(&ip2_mutex);
 
         switch ( iplminor ) {
         case 0:     // IPL device
@@ -2961,7 +2977,7 @@ ip2_ipl_ioctl (struct file *pFile, UINT cmd, ULONG arg )
                 rc = -ENODEV;
                 break;
         }
-        unlock_kernel();
+        mutex_unlock(&ip2_mutex);
         return rc;
 }
 
@@ -2982,7 +2998,6 @@ ip2_ipl_open( struct inode *pInode, struct file *pFile )
 #ifdef IP2DEBUG_IPL
         printk (KERN_DEBUG "IP2IPL: open\n" );
 #endif
-        cycle_kernel_lock();
         return 0;
 }
 
diff --git a/drivers/char/ipmi/Makefile b/drivers/char/ipmi/Makefile
index eb8a1a8c188e..16a93648d54e 100644
--- a/drivers/char/ipmi/Makefile
+++ b/drivers/char/ipmi/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the ipmi drivers.
 #
 
-ipmi_si-objs := ipmi_si_intf.o ipmi_kcs_sm.o ipmi_smic_sm.o ipmi_bt_sm.o
+ipmi_si-y := ipmi_si_intf.o ipmi_kcs_sm.o ipmi_smic_sm.o ipmi_bt_sm.o
 
 obj-$(CONFIG_IPMI_HANDLER) += ipmi_msghandler.o
 obj-$(CONFIG_IPMI_DEVICE_INTERFACE) += ipmi_devintf.o
diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
index 7b98c067190a..3ed20e8abc0d 100644
--- a/drivers/char/ipmi/ipmi_bt_sm.c
+++ b/drivers/char/ipmi/ipmi_bt_sm.c
@@ -2,7 +2,7 @@
  *  ipmi_bt_sm.c
  *
  *  The state machine for an Open IPMI BT sub-driver under ipmi_si.c, part
- *  of the driver architecture at http://sourceforge.net/project/openipmi
+ *  of the driver architecture at http://sourceforge.net/projects/openipmi 
  *
  *  Author:     Rocky Craig <first.last@hp.com>
  *
diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
index d8ec92a38980..2aa3977aae5e 100644
--- a/drivers/char/ipmi/ipmi_devintf.c
+++ b/drivers/char/ipmi/ipmi_devintf.c
@@ -44,7 +44,6 @@
 #include <linux/init.h>
 #include <linux/device.h>
 #include <linux/compat.h>
-#include <linux/smp_lock.h>
 
 struct ipmi_file_private
 {
@@ -59,6 +58,7 @@ struct ipmi_file_private
         unsigned int         default_retry_time_ms;
 };
 
+static DEFINE_MUTEX(ipmi_mutex);
 static void file_receive_handler(struct ipmi_recv_msg *msg,
                                  void                 *handler_data)
 {
@@ -102,9 +102,9 @@ static int ipmi_fasync(int fd, struct file *file, int on)
         struct ipmi_file_private *priv = file->private_data;
         int                      result;
 
-        lock_kernel(); /* could race against open() otherwise */
+        mutex_lock(&ipmi_mutex); /* could race against open() otherwise */
         result = fasync_helper(fd, file, on, &priv->fasync_queue);
-        unlock_kernel();
+        mutex_unlock(&ipmi_mutex);
 
         return (result);
 }
@@ -125,7 +125,7 @@ static int ipmi_open(struct inode *inode, struct file *file)
         if (!priv)
                 return -ENOMEM;
 
-        lock_kernel();
+        mutex_lock(&ipmi_mutex);
         priv->file = file;
 
         rv = ipmi_create_user(if_num,
@@ -150,7 +150,7 @@ static int ipmi_open(struct inode *inode, struct file *file)
         priv->default_retry_time_ms = 0;
 
 out:
-        unlock_kernel();
+        mutex_unlock(&ipmi_mutex);
         return rv;
 }
 
@@ -639,9 +639,9 @@ static long ipmi_unlocked_ioctl(struct file   *file,
 {
         int ret;
 
-        lock_kernel();
+        mutex_lock(&ipmi_mutex);
         ret = ipmi_ioctl(file, cmd, data);
-        unlock_kernel();
+        mutex_unlock(&ipmi_mutex);
 
         return ret;
 }
@@ -850,6 +850,7 @@ static const struct file_operations ipmi_fops = {
         .release        = ipmi_release,
         .fasync         = ipmi_fasync,
         .poll           = ipmi_poll,
+        .llseek         = noop_llseek,
 };
 
 #define DEVICE_NAME     "ipmidev"
@@ -915,7 +916,7 @@ static struct ipmi_smi_watcher smi_watcher =
         .smi_gone = ipmi_smi_gone,
 };
 
-static __init int init_ipmi_devintf(void)
+static int __init init_ipmi_devintf(void)
 {
         int rv;
 
@@ -953,7 +954,7 @@ static __init int init_ipmi_devintf(void)
 }
 module_init(init_ipmi_devintf);
 
-static __exit void cleanup_ipmi(void)
+static void __exit cleanup_ipmi(void)
 {
         struct ipmi_reg_list *entry, *entry2;
         mutex_lock(&reg_list_mutex);
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 4f3f8c9ec262..2fe72f8edf44 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -4442,13 +4442,13 @@ static int ipmi_init_msghandler(void)
         return 0;
 }
 
-static __init int ipmi_init_msghandler_mod(void)
+static int __init ipmi_init_msghandler_mod(void)
 {
         ipmi_init_msghandler();
         return 0;
 }
 
-static __exit void cleanup_ipmi(void)
+static void __exit cleanup_ipmi(void)
 {
         int count;
 
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 7bd7c45b53ef..035da9e64a17 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -1665,6 +1665,17 @@ static int check_hotmod_int_op(const char *curr, const char *option,
         return 0;
 }
 
+static struct smi_info *smi_info_alloc(void)
+{
+        struct smi_info *info = kzalloc(sizeof(*info), GFP_KERNEL);
+
+        if (info) {
+                spin_lock_init(&info->si_lock);
+                spin_lock_init(&info->msg_lock);
+        }
+        return info;
+}
+
 static int hotmod_handler(const char *val, struct kernel_param *kp)
 {
         char *str = kstrdup(val, GFP_KERNEL);
@@ -1779,7 +1790,7 @@ static int hotmod_handler(const char *val, struct kernel_param *kp)
                 }
 
                 if (op == HM_ADD) {
-                        info = kzalloc(sizeof(*info), GFP_KERNEL);
+                        info = smi_info_alloc();
                         if (!info) {
                                 rv = -ENOMEM;
                                 goto out;
@@ -1835,7 +1846,7 @@ static int hotmod_handler(const char *val, struct kernel_param *kp)
         return rv;
 }
 
-static __devinit void hardcode_find_bmc(void)
+static void __devinit hardcode_find_bmc(void)
 {
         int             i;
         struct smi_info *info;
@@ -1844,7 +1855,7 @@ static __devinit void hardcode_find_bmc(void)
                 if (!ports[i] && !addrs[i])
                         continue;
 
-                info = kzalloc(sizeof(*info), GFP_KERNEL);
+                info = smi_info_alloc();
                 if (!info)
                         return;
 
@@ -1974,8 +1985,7 @@ static int acpi_gpe_irq_setup(struct smi_info *info)
 
 /*
  * Defined at
- * http://h21007.www2.hp.com/portal/download/files
- * /unprot/hpspmi.pdf
+ * http://h21007.www2.hp.com/portal/download/files/unprot/hpspmi.pdf
  */
 struct SPMITable {
         s8      Signature[4];
@@ -2019,7 +2029,7 @@ struct SPMITable {
         s8      spmi_id[1]; /* A '\0' terminated array starts here. */
 };
 
-static __devinit int try_init_spmi(struct SPMITable *spmi)
+static int __devinit try_init_spmi(struct SPMITable *spmi)
 {
         struct smi_info  *info;
 
@@ -2028,7 +2038,7 @@ static __devinit int try_init_spmi(struct SPMITable *spmi)
                 return -ENODEV;
         }
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = smi_info_alloc();
         if (!info) {
                 printk(KERN_ERR PFX "Could not allocate SI data (3)\n");
                 return -ENOMEM;
@@ -2102,7 +2112,7 @@ static __devinit int try_init_spmi(struct SPMITable *spmi)
         return 0;
 }
 
-static __devinit void spmi_find_bmc(void)
+static void __devinit spmi_find_bmc(void)
 {
         acpi_status      status;
         struct SPMITable *spmi;
@@ -2138,7 +2148,7 @@ static int __devinit ipmi_pnp_probe(struct pnp_dev *dev,
         if (!acpi_dev)
                 return -ENODEV;
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = smi_info_alloc();
         if (!info)
                 return -ENOMEM;
 
@@ -2315,11 +2325,11 @@ static int __devinit decode_dmi(const struct dmi_header *dm,
         return 0;
 }
 
-static __devinit void try_init_dmi(struct dmi_ipmi_data *ipmi_data)
+static void __devinit try_init_dmi(struct dmi_ipmi_data *ipmi_data)
 {
         struct smi_info *info;
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = smi_info_alloc();
         if (!info) {
                 printk(KERN_ERR PFX "Could not allocate SI data\n");
                 return;
@@ -2426,7 +2436,7 @@ static int __devinit ipmi_pci_probe(struct pci_dev *pdev,
         int class_type = pdev->class & PCI_ERMC_CLASSCODE_TYPE_MASK;
         struct smi_info *info;
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = smi_info_alloc();
         if (!info)
                 return -ENOMEM;
 
@@ -2567,7 +2577,7 @@ static int __devinit ipmi_of_probe(struct platform_device *dev,
                 return -EINVAL;
         }
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = smi_info_alloc();
 
         if (!info) {
                 dev_err(&dev->dev,
@@ -3002,7 +3012,7 @@ static __devinitdata struct ipmi_default_vals
         { .port = 0 }
 };
 
-static __devinit void default_find_bmc(void)
+static void __devinit default_find_bmc(void)
 {
         struct smi_info *info;
         int             i;
@@ -3014,7 +3024,7 @@ static __devinit void default_find_bmc(void)
                 if (check_legacy_ioport(ipmi_defaults[i].port))
                         continue;
 #endif
-                info = kzalloc(sizeof(*info), GFP_KERNEL);
+                info = smi_info_alloc();
                 if (!info)
                         return;
 
@@ -3139,9 +3149,6 @@ static int try_smi_init(struct smi_info *new_smi)
                 goto out_err;
         }
 
-        spin_lock_init(&(new_smi->si_lock));
-        spin_lock_init(&(new_smi->msg_lock));
-
         /* Do low-level detection first. */
         if (new_smi->handlers->detect(new_smi->si_sm)) {
                 if (new_smi->addr_source)
@@ -3305,7 +3312,7 @@ static int try_smi_init(struct smi_info *new_smi)
         return rv;
 }
 
-static __devinit int init_ipmi_si(void)
+static int __devinit init_ipmi_si(void)
 {
         int  i;
         char *str;
@@ -3518,7 +3525,7 @@ static void cleanup_one_si(struct smi_info *to_clean)
         kfree(to_clean);
 }
 
-static __exit void cleanup_ipmi_si(void)
+static void __exit cleanup_ipmi_si(void)
 {
         struct smi_info *e, *tmp_e;
 
diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
index 654d566ca57c..f4d334f2536e 100644
--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@@ -35,7 +35,7 @@
 #include <linux/moduleparam.h>
 #include <linux/ipmi.h>
 #include <linux/ipmi_smi.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/watchdog.h>
 #include <linux/miscdevice.h>
 #include <linux/init.h>
@@ -149,6 +149,7 @@
 #define WDIOC_GET_PRETIMEOUT     _IOW(WATCHDOG_IOCTL_BASE, 22, int)
 #endif
 
+static DEFINE_MUTEX(ipmi_watchdog_mutex);
 static int nowayout = WATCHDOG_NOWAYOUT;
 
 static ipmi_user_t watchdog_user;
@@ -748,9 +749,9 @@ static long ipmi_unlocked_ioctl(struct file *file,
 {
         int ret;
 
-        lock_kernel();
+        mutex_lock(&ipmi_watchdog_mutex);
         ret = ipmi_ioctl(file, cmd, arg);
-        unlock_kernel();
+        mutex_unlock(&ipmi_watchdog_mutex);
 
         return ret;
 }
@@ -844,7 +845,6 @@ static int ipmi_open(struct inode *ino, struct file *filep)
                 if (test_and_set_bit(0, &ipmi_wdog_open))
                         return -EBUSY;
 
-                cycle_kernel_lock();
 
                 /*
                  * Don't start the timer now, let it start on the
@@ -909,6 +909,7 @@ static const struct file_operations ipmi_wdog_fops = {
         .open    = ipmi_open,
         .release = ipmi_close,
         .fasync  = ipmi_fasync,
+        .llseek  = no_llseek,
 };
 
 static struct miscdevice ipmi_wdog_miscdev = {
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index be28391adb79..667abd23ad6a 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -704,6 +704,7 @@ static const struct file_operations	stli_fsiomem = {
         .read           = stli_memread,
         .write          = stli_memwrite,
         .unlocked_ioctl = stli_memioctl,
+        .llseek         = default_llseek,
 };
 
 /*****************************************************************************/
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index a7ca75212bfe..e95d7876ca6b 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -175,8 +175,7 @@ EXPORT_SYMBOL_GPL(unregister_keyboard_notifier);
  */
 
 struct getset_keycode_data {
-        unsigned int scancode;
-        unsigned int keycode;
+        struct input_keymap_entry ke;
         int error;
 };
 
@@ -184,32 +183,50 @@ static int getkeycode_helper(struct input_handle *handle, void *data)
 {
         struct getset_keycode_data *d = data;
 
-        d->error = input_get_keycode(handle->dev, d->scancode, &d->keycode);
+        d->error = input_get_keycode(handle->dev, &d->ke);
 
         return d->error == 0; /* stop as soon as we successfully get one */
 }
 
 int getkeycode(unsigned int scancode)
 {
-        struct getset_keycode_data d = { scancode, 0, -ENODEV };
+        struct getset_keycode_data d = {
+                .ke     = {
+                        .flags          = 0,
+                        .len            = sizeof(scancode),
+                        .keycode        = 0,
+                },
+                .error  = -ENODEV,
+        };
+
+        memcpy(d.ke.scancode, &scancode, sizeof(scancode));
 
         input_handler_for_each_handle(&kbd_handler, &d, getkeycode_helper);
 
-        return d.error ?: d.keycode;
+        return d.error ?: d.ke.keycode;
 }
 
 static int setkeycode_helper(struct input_handle *handle, void *data)
 {
         struct getset_keycode_data *d = data;
 
-        d->error = input_set_keycode(handle->dev, d->scancode, d->keycode);
+        d->error = input_set_keycode(handle->dev, &d->ke);
 
         return d->error == 0; /* stop as soon as we successfully set one */
 }
 
 int setkeycode(unsigned int scancode, unsigned int keycode)
 {
-        struct getset_keycode_data d = { scancode, keycode, -ENODEV };
+        struct getset_keycode_data d = {
+                .ke     = {
+                        .flags          = 0,
+                        .len            = sizeof(scancode),
+                        .keycode        = keycode,
+                },
+                .error  = -ENODEV,
+        };
+
+        memcpy(d.ke.scancode, &scancode, sizeof(scancode));
 
         input_handler_for_each_handle(&kbd_handler, &d, setkeycode_helper);
 
diff --git a/drivers/char/lp.c b/drivers/char/lp.c
index 938a3a273886..97c3edb95ae7 100644
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -126,7 +126,7 @@
 #include <linux/device.h>
 #include <linux/wait.h>
 #include <linux/jiffies.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/compat.h>
 
 #include <linux/parport.h>
@@ -140,6 +140,7 @@
 /* if you have more than 8 printers, remember to increase LP_NO */
 #define LP_NO 8
 
+static DEFINE_MUTEX(lp_mutex);
 static struct lp_struct lp_table[LP_NO];
 
 static unsigned int lp_count = 0;
@@ -493,7 +494,7 @@ static int lp_open(struct inode * inode, struct file * file)
         unsigned int minor = iminor(inode);
         int ret = 0;
 
-        lock_kernel();
+        mutex_lock(&lp_mutex);
         if (minor >= LP_NO) {
                 ret = -ENXIO;
                 goto out;
@@ -554,7 +555,7 @@ static int lp_open(struct inode * inode, struct file * file)
         lp_release_parport (&lp_table[minor]);
         lp_table[minor].current_mode = IEEE1284_MODE_COMPAT;
 out:
-        unlock_kernel();
+        mutex_unlock(&lp_mutex);
         return ret;
 }
 
@@ -680,7 +681,7 @@ static long lp_ioctl(struct file *file, unsigned int cmd,
         int ret;
 
         minor = iminor(file->f_path.dentry->d_inode);
-        lock_kernel();
+        mutex_lock(&lp_mutex);
         switch (cmd) {
         case LPSETTIMEOUT:
                 if (copy_from_user(&par_timeout, (void __user *)arg,
@@ -694,7 +695,7 @@ static long lp_ioctl(struct file *file, unsigned int cmd,
                 ret = lp_do_ioctl(minor, cmd, arg, (void __user *)arg);
                 break;
         }
-        unlock_kernel();
+        mutex_unlock(&lp_mutex);
 
         return ret;
 }
@@ -709,7 +710,7 @@ static long lp_compat_ioctl(struct file *file, unsigned int cmd,
         int ret;
 
         minor = iminor(file->f_path.dentry->d_inode);
-        lock_kernel();
+        mutex_lock(&lp_mutex);
         switch (cmd) {
         case LPSETTIMEOUT:
                 tc = compat_ptr(arg);
@@ -730,7 +731,7 @@ static long lp_compat_ioctl(struct file *file, unsigned int cmd,
                 ret = lp_do_ioctl(minor, cmd, arg, compat_ptr(arg));
                 break;
         }
-        unlock_kernel();
+        mutex_unlock(&lp_mutex);
 
         return ret;
 }
@@ -748,6 +749,7 @@ static const struct file_operations lp_fops = {
 #ifdef CONFIG_PARPORT_1284
         .read           = lp_read,
 #endif
+        .llseek         = noop_llseek,
 };
 
 /* --- support for console on the line printer ----------------- */
diff --git a/drivers/char/mbcs.c b/drivers/char/mbcs.c
index 83bef4efe376..1aeaaba680d2 100644
--- a/drivers/char/mbcs.c
+++ b/drivers/char/mbcs.c
@@ -25,7 +25,6 @@
 #include <linux/mm.h>
 #include <linux/uio.h>
 #include <linux/mutex.h>
-#include <linux/smp_lock.h>
 #include <linux/slab.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
@@ -42,6 +41,7 @@
 #else
 #define DBG(fmt...)
 #endif
+static DEFINE_MUTEX(mbcs_mutex);
 static int mbcs_major;
 
 static LIST_HEAD(soft_list);
@@ -385,19 +385,19 @@ static int mbcs_open(struct inode *ip, struct file *fp)
         struct mbcs_soft *soft;
         int minor;
 
-        lock_kernel();
+        mutex_lock(&mbcs_mutex);
         minor = iminor(ip);
 
         /* Nothing protects access to this list... */
         list_for_each_entry(soft, &soft_list, list) {
                 if (soft->nasid == minor) {
                         fp->private_data = soft->cxdev;
-                        unlock_kernel();
+                        mutex_unlock(&mbcs_mutex);
                         return 0;
                 }
         }
 
-        unlock_kernel();
+        mutex_unlock(&mbcs_mutex);
         return -ENODEV;
 }
 
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 1f528fad3516..1256454b2d43 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -805,6 +805,7 @@ static const struct file_operations full_fops = {
 static const struct file_operations oldmem_fops = {
         .read   = read_oldmem,
         .open   = open_oldmem,
+        .llseek = default_llseek,
 };
 #endif
 
@@ -831,6 +832,7 @@ static ssize_t kmsg_write(struct file *file, const char __user *buf,
 
 static const struct file_operations kmsg_fops = {
         .write = kmsg_write,
+        .llseek = noop_llseek,
 };
 
 static const struct memdev {
@@ -874,6 +876,10 @@ static int memory_open(struct inode *inode, struct file *filp)
         if (dev->dev_info)
                 filp->f_mapping->backing_dev_info = dev->dev_info;
 
+        /* Is /dev/mem or /dev/kmem ? */
+        if (dev->dev_info == &directly_mappable_cdev_bdi)
+                filp->f_mode |= FMODE_UNSIGNED_OFFSET;
+
         if (dev->fops->open)
                 return dev->fops->open(inode, filp);
 
@@ -882,6 +888,7 @@ static int memory_open(struct inode *inode, struct file *filp)
 
 static const struct file_operations memory_fops = {
         .open = memory_open,
+        .llseek = noop_llseek,
 };
 
 static char *mem_devnode(struct device *dev, mode_t *mode)
diff --git a/drivers/char/misc.c b/drivers/char/misc.c
index abdafd488980..778273c93242 100644
--- a/drivers/char/misc.c
+++ b/drivers/char/misc.c
@@ -162,6 +162,7 @@ static struct class *misc_class;
 static const struct file_operations misc_fops = {
         .owner          = THIS_MODULE,
         .open           = misc_open,
+        .llseek         = noop_llseek,
 };
 
 /**
diff --git a/drivers/char/mmtimer.c b/drivers/char/mmtimer.c
index ea7c99fa978f..e6d75627c6c8 100644
--- a/drivers/char/mmtimer.c
+++ b/drivers/char/mmtimer.c
@@ -32,7 +32,7 @@
 #include <linux/interrupt.h>
 #include <linux/time.h>
 #include <linux/math64.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/slab.h>
 
 #include <asm/uaccess.h>
@@ -59,6 +59,7 @@ extern unsigned long sn_rtc_cycles_per_second;
 
 #define rtc_time()              (*RTC_COUNTER_ADDR)
 
+static DEFINE_MUTEX(mmtimer_mutex);
 static long mmtimer_ioctl(struct file *file, unsigned int cmd,
                                                 unsigned long arg);
 static int mmtimer_mmap(struct file *file, struct vm_area_struct *vma);
@@ -72,6 +73,7 @@ static const struct file_operations mmtimer_fops = {
         .owner = THIS_MODULE,
         .mmap = mmtimer_mmap,
         .unlocked_ioctl = mmtimer_ioctl,
+        .llseek = noop_llseek,
 };
 
 /*
@@ -174,9 +176,9 @@ static void mmtimer_setup_int_2(int cpu, u64 expires)
  * in order to insure that the setup succeeds in a deterministic time frame.
  * It will check if the interrupt setup succeeded.
  */
-static int mmtimer_setup(int cpu, int comparator, unsigned long expires)
+static int mmtimer_setup(int cpu, int comparator, unsigned long expires,
+        u64 *set_completion_time)
 {
-
         switch (comparator) {
         case 0:
                 mmtimer_setup_int_0(cpu, expires);
@@ -189,7 +191,8 @@ static int mmtimer_setup(int cpu, int comparator, unsigned long expires)
                 break;
         }
         /* We might've missed our expiration time */
-        if (rtc_time() <= expires)
+        *set_completion_time = rtc_time();
+        if (*set_completion_time <= expires)
                 return 1;
 
         /*
@@ -225,6 +228,8 @@ static int mmtimer_disable_int(long nasid, int comparator)
 #define TIMER_OFF       0xbadcabLL      /* Timer is not setup */
 #define TIMER_SET       0               /* Comparator is set for this timer */
 
+#define MMTIMER_INTERVAL_RETRY_INCREMENT_DEFAULT 40
+
 /* There is one of these for each timer */
 struct mmtimer {
         struct rb_node list;
@@ -240,6 +245,11 @@ struct mmtimer_node {
 };
 static struct mmtimer_node *timers;
 
+static unsigned mmtimer_interval_retry_increment =
+        MMTIMER_INTERVAL_RETRY_INCREMENT_DEFAULT;
+module_param(mmtimer_interval_retry_increment, uint, 0644);
+MODULE_PARM_DESC(mmtimer_interval_retry_increment,
+        "RTC ticks to add to expiration on interval retry (default 40)");
 
 /*
  * Add a new mmtimer struct to the node's mmtimer list.
@@ -287,7 +297,8 @@ static void mmtimer_set_next_timer(int nodeid)
         struct mmtimer_node *n = &timers[nodeid];
         struct mmtimer *x;
         struct k_itimer *t;
-        int o;
+        u64 expires, exp, set_completion_time;
+        int i;
 
 restart:
         if (n->next == NULL)
@@ -298,7 +309,8 @@ restart:
         if (!t->it.mmtimer.incr) {
                 /* Not an interval timer */
                 if (!mmtimer_setup(x->cpu, COMPARATOR,
-                                        t->it.mmtimer.expires)) {
+                                        t->it.mmtimer.expires,
+                                        &set_completion_time)) {
                         /* Late setup, fire now */
                         tasklet_schedule(&n->tasklet);
                 }
@@ -306,14 +318,23 @@ restart:
         }
 
         /* Interval timer */
-        o = 0;
-        while (!mmtimer_setup(x->cpu, COMPARATOR, t->it.mmtimer.expires)) {
-                unsigned long e, e1;
-                struct rb_node *next;
-                t->it.mmtimer.expires += t->it.mmtimer.incr << o;
-                t->it_overrun += 1 << o;
-                o++;
-                if (o > 20) {
+        i = 0;
+        expires = exp = t->it.mmtimer.expires;
+        while (!mmtimer_setup(x->cpu, COMPARATOR, expires,
+                                &set_completion_time)) {
+                int to;
+
+                i++;
+                expires = set_completion_time +
+                                mmtimer_interval_retry_increment + (1 << i);
+                /* Calculate overruns as we go. */
+                to = ((u64)(expires - exp) / t->it.mmtimer.incr);
+                if (to) {
+                        t->it_overrun += to;
+                        t->it.mmtimer.expires += t->it.mmtimer.incr * to;
+                        exp = t->it.mmtimer.expires;
+                }
+                if (i > 20) {
                         printk(KERN_ALERT "mmtimer: cannot reschedule timer\n");
                         t->it.mmtimer.clock = TIMER_OFF;
                         n->next = rb_next(&x->list);
@@ -321,21 +342,6 @@ restart:
                         kfree(x);
                         goto restart;
                 }
-
-                e = t->it.mmtimer.expires;
-                next = rb_next(&x->list);
-
-                if (next == NULL)
-                        continue;
-
-                e1 = rb_entry(next, struct mmtimer, list)->
-                        timer->it.mmtimer.expires;
-                if (e > e1) {
-                        n->next = next;
-                        rb_erase(&x->list, &n->timer_head);
-                        mmtimer_add_list(x);
-                        goto restart;
-                }
         }
 }
 
@@ -371,7 +377,7 @@ static long mmtimer_ioctl(struct file *file, unsigned int cmd,
 {
         int ret = 0;
 
-        lock_kernel();
+        mutex_lock(&mmtimer_mutex);
 
         switch (cmd) {
         case MMTIMER_GETOFFSET: /* offset of the counter */
@@ -414,7 +420,7 @@ static long mmtimer_ioctl(struct file *file, unsigned int cmd,
                 ret = -ENOTTY;
                 break;
         }
-        unlock_kernel();
+        mutex_unlock(&mmtimer_mutex);
         return ret;
 }
 
diff --git a/drivers/char/mspec.c b/drivers/char/mspec.c
index ecb89d798e35..966a95bc974b 100644
--- a/drivers/char/mspec.c
+++ b/drivers/char/mspec.c
@@ -316,7 +316,8 @@ uncached_mmap(struct file *file, struct vm_area_struct *vma)
 
 static const struct file_operations fetchop_fops = {
         .owner = THIS_MODULE,
-        .mmap = fetchop_mmap
+        .mmap = fetchop_mmap,
+        .llseek = noop_llseek,
 };
 
 static struct miscdevice fetchop_miscdev = {
@@ -327,7 +328,8 @@ static struct miscdevice fetchop_miscdev = {
 
 static const struct file_operations cached_fops = {
         .owner = THIS_MODULE,
-        .mmap = cached_mmap
+        .mmap = cached_mmap,
+        .llseek = noop_llseek,
 };
 
 static struct miscdevice cached_miscdev = {
@@ -338,7 +340,8 @@ static struct miscdevice cached_miscdev = {
 
 static const struct file_operations uncached_fops = {
         .owner = THIS_MODULE,
-        .mmap = uncached_mmap
+        .mmap = uncached_mmap,
+        .llseek = noop_llseek,
 };
 
 static struct miscdevice uncached_miscdev = {
diff --git a/drivers/char/mwave/Makefile b/drivers/char/mwave/Makefile
index 754c9e2058ed..26b4fce217b6 100644
--- a/drivers/char/mwave/Makefile
+++ b/drivers/char/mwave/Makefile
@@ -6,10 +6,10 @@
 
 obj-$(CONFIG_MWAVE) += mwave.o
 
-mwave-objs := mwavedd.o smapi.o tp3780i.o 3780i.o
+mwave-y := mwavedd.o smapi.o tp3780i.o 3780i.o
 
 # To have the mwave driver disable other uarts if necessary
 # EXTRA_CFLAGS += -DMWAVE_FUTZ_WITH_OTHER_DEVICES
 
 # To compile in lots (~20 KiB) of run-time enablable printk()s for debugging:
-EXTRA_CFLAGS += -DMW_TRACE
+ccflags-y := -DMW_TRACE
diff --git a/drivers/char/mwave/mwavedd.c b/drivers/char/mwave/mwavedd.c
index a4ec50c95072..1d82d5838f0c 100644
--- a/drivers/char/mwave/mwavedd.c
+++ b/drivers/char/mwave/mwavedd.c
@@ -56,7 +56,7 @@
 #include <linux/serial.h>
 #include <linux/sched.h>
 #include <linux/spinlock.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/delay.h>
 #include <linux/serial_8250.h>
 #include "smapi.h"
@@ -73,6 +73,7 @@ MODULE_LICENSE("GPL");
 * checks are made against other devices (ie. superio) for conflicts.
 * We'll depend on users using the tpctl utility to do that for now
 */
+static DEFINE_MUTEX(mwave_mutex);
 int mwave_debug = 0;
 int mwave_3780i_irq = 0;
 int mwave_3780i_io = 0;
@@ -101,7 +102,6 @@ static int mwave_open(struct inode *inode, struct file *file)
         PRINTK_2(TRACE_MWAVE,
                 "mwavedd::mwave_open, exit return retval %x\n", retval);
 
-        cycle_kernel_lock();
         return retval;
 }
 
@@ -136,9 +136,9 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                         PRINTK_1(TRACE_MWAVE,
                                 "mwavedd::mwave_ioctl, IOCTL_MW_RESET"
                                 " calling tp3780I_ResetDSP\n");
-                        lock_kernel();
+                        mutex_lock(&mwave_mutex);
                         retval = tp3780I_ResetDSP(&pDrvData->rBDData);
-                        unlock_kernel();
+                        mutex_unlock(&mwave_mutex);
                         PRINTK_2(TRACE_MWAVE,
                                 "mwavedd::mwave_ioctl, IOCTL_MW_RESET"
                                 " retval %x from tp3780I_ResetDSP\n",
@@ -149,9 +149,9 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                         PRINTK_1(TRACE_MWAVE,
                                 "mwavedd::mwave_ioctl, IOCTL_MW_RUN"
                                 " calling tp3780I_StartDSP\n");
-                        lock_kernel();
+                        mutex_lock(&mwave_mutex);
                         retval = tp3780I_StartDSP(&pDrvData->rBDData);
-                        unlock_kernel();
+                        mutex_unlock(&mwave_mutex);
                         PRINTK_2(TRACE_MWAVE,
                                 "mwavedd::mwave_ioctl, IOCTL_MW_RUN"
                                 " retval %x from tp3780I_StartDSP\n",
@@ -165,10 +165,10 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                 "mwavedd::mwave_ioctl,"
                                 " IOCTL_MW_DSP_ABILITIES calling"
                                 " tp3780I_QueryAbilities\n");
-                        lock_kernel();
+                        mutex_lock(&mwave_mutex);
                         retval = tp3780I_QueryAbilities(&pDrvData->rBDData,
                                         &rAbilities);
-                        unlock_kernel();
+                        mutex_unlock(&mwave_mutex);
                         PRINTK_2(TRACE_MWAVE,
                                 "mwavedd::mwave_ioctl, IOCTL_MW_DSP_ABILITIES"
                                 " retval %x from tp3780I_QueryAbilities\n",
@@ -199,13 +199,13 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                 "mwavedd::mwave_ioctl IOCTL_MW_READ_DATA,"
                                 " size %lx, ioarg %lx pusBuffer %p\n",
                                 rReadData.ulDataLength, ioarg, pusBuffer);
-                        lock_kernel();
+                        mutex_lock(&mwave_mutex);
                         retval = tp3780I_ReadWriteDspDStore(&pDrvData->rBDData,
                                         iocmd,
                                         pusBuffer,
                                         rReadData.ulDataLength,
                                         rReadData.usDspAddress);
-                        unlock_kernel();
+                        mutex_unlock(&mwave_mutex);
                 }
                         break;
         
@@ -223,12 +223,12 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                 " size %lx, ioarg %lx pusBuffer %p\n",
                                 rReadData.ulDataLength / 2, ioarg,
                                 pusBuffer);
-                        lock_kernel();
+                        mutex_lock(&mwave_mutex);
                         retval = tp3780I_ReadWriteDspDStore(&pDrvData->rBDData,
                                 iocmd, pusBuffer,
                                 rReadData.ulDataLength / 2,
                                 rReadData.usDspAddress);
-                        unlock_kernel();
+                        mutex_unlock(&mwave_mutex);
                 }
                         break;
         
@@ -246,12 +246,12 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                 " size %lx, ioarg %lx pusBuffer %p\n",
                                 rWriteData.ulDataLength, ioarg,
                                 pusBuffer);
-                        lock_kernel();
+                        mutex_lock(&mwave_mutex);
                         retval = tp3780I_ReadWriteDspDStore(&pDrvData->rBDData,
                                         iocmd, pusBuffer,
                                         rWriteData.ulDataLength,
                                         rWriteData.usDspAddress);
-                        unlock_kernel();
+                        mutex_unlock(&mwave_mutex);
                 }
                         break;
         
@@ -269,12 +269,12 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                 " size %lx, ioarg %lx pusBuffer %p\n",
                                 rWriteData.ulDataLength, ioarg,
                                 pusBuffer);
-                        lock_kernel();
+                        mutex_lock(&mwave_mutex);
                         retval = tp3780I_ReadWriteDspIStore(&pDrvData->rBDData,
                                         iocmd, pusBuffer,
                                         rWriteData.ulDataLength,
                                         rWriteData.usDspAddress);
-                        unlock_kernel();
+                        mutex_unlock(&mwave_mutex);
                 }
                         break;
         
@@ -295,10 +295,10 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                 ipcnum,
                                 pDrvData->IPCs[ipcnum].usIntCount);
 
-                        lock_kernel();
+                        mutex_lock(&mwave_mutex);
                         pDrvData->IPCs[ipcnum].bIsHere = FALSE;
                         pDrvData->IPCs[ipcnum].bIsEnabled = TRUE;
-                        unlock_kernel();
+                        mutex_unlock(&mwave_mutex);
         
                         PRINTK_2(TRACE_MWAVE,
                                 "mwavedd::mwave_ioctl IOCTL_MW_REGISTER_IPC"
@@ -323,7 +323,7 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                 ipcnum,
                                 pDrvData->IPCs[ipcnum].usIntCount);
         
-                        lock_kernel();
+                        mutex_lock(&mwave_mutex);
                         if (pDrvData->IPCs[ipcnum].bIsEnabled == TRUE) {
                                 DECLARE_WAITQUEUE(wait, current);
 
@@ -364,7 +364,7 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                         " processing\n",
                                         ipcnum);
                         }
-                        unlock_kernel();
+                        mutex_unlock(&mwave_mutex);
                 }
                         break;
         
@@ -383,14 +383,14 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                                 ipcnum);
                                 return -EINVAL;
                         }
-                        lock_kernel();
+                        mutex_lock(&mwave_mutex);
                         if (pDrvData->IPCs[ipcnum].bIsEnabled == TRUE) {
                                 pDrvData->IPCs[ipcnum].bIsEnabled = FALSE;
                                 if (pDrvData->IPCs[ipcnum].bIsHere == TRUE) {
                                         wake_up_interruptible(&pDrvData->IPCs[ipcnum].ipc_wait_queue);
                                 }
                         }
-                        unlock_kernel();
+                        mutex_unlock(&mwave_mutex);
                 }
                         break;
         
@@ -479,7 +479,8 @@ static const struct file_operations mwave_fops = {
         .write          = mwave_write,
         .unlocked_ioctl = mwave_ioctl,
         .open           = mwave_open,
-        .release        = mwave_close
+        .release        = mwave_close,
+        .llseek         = default_llseek,
 };
 
 
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index 3fc89da856ae..dd9d75351cd6 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -303,6 +303,7 @@ static void mxser_enable_must_enchance_mode(unsigned long baseio)
         outb(oldlcr, baseio + UART_LCR);
 }
 
+#ifdef  CONFIG_PCI
 static void mxser_disable_must_enchance_mode(unsigned long baseio)
 {
         u8 oldlcr;
@@ -317,6 +318,7 @@ static void mxser_disable_must_enchance_mode(unsigned long baseio)
         outb(efr, baseio + MOXA_MUST_EFR_REGISTER);
         outb(oldlcr, baseio + UART_LCR);
 }
+#endif
 
 static void mxser_set_must_xon1_value(unsigned long baseio, u8 value)
 {
@@ -388,6 +390,7 @@ static void mxser_set_must_enum_value(unsigned long baseio, u8 value)
         outb(oldlcr, baseio + UART_LCR);
 }
 
+#ifdef CONFIG_PCI
 static void mxser_get_must_hardware_id(unsigned long baseio, u8 *pId)
 {
         u8 oldlcr;
@@ -404,6 +407,7 @@ static void mxser_get_must_hardware_id(unsigned long baseio, u8 *pId)
         *pId = inb(baseio + MOXA_MUST_HWID_REGISTER);
         outb(oldlcr, baseio + UART_LCR);
 }
+#endif
 
 static void SET_MOXA_MUST_NO_SOFTWARE_FLOW_CONTROL(unsigned long baseio)
 {
@@ -1700,7 +1704,7 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
                 return 0;
         }
 
-        if (cmd != TIOCGSERIAL && cmd != TIOCMIWAIT && cmd != TIOCGICOUNT &&
+        if (cmd != TIOCGSERIAL && cmd != TIOCMIWAIT &&
                         test_bit(TTY_IO_ERROR, &tty->flags))
                 return -EIO;
 
@@ -1730,32 +1734,6 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
 
                 return wait_event_interruptible(info->port.delta_msr_wait,
                                 mxser_cflags_changed(info, arg, &cnow));
-        /*
-         * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
-         * Return: write counters to the user passed counter struct
-         * NB: both 1->0 and 0->1 transitions are counted except for
-         *     RI where only 0->1 is counted.
-         */
-        case TIOCGICOUNT: {
-                struct serial_icounter_struct icnt = { 0 };
-                spin_lock_irqsave(&info->slock, flags);
-                cnow = info->icount;
-                spin_unlock_irqrestore(&info->slock, flags);
-
-                icnt.frame = cnow.frame;
-                icnt.brk = cnow.brk;
-                icnt.overrun = cnow.overrun;
-                icnt.buf_overrun = cnow.buf_overrun;
-                icnt.parity = cnow.parity;
-                icnt.rx = cnow.rx;
-                icnt.tx = cnow.tx;
-                icnt.cts = cnow.cts;
-                icnt.dsr = cnow.dsr;
-                icnt.rng = cnow.rng;
-                icnt.dcd = cnow.dcd;
-
-                return copy_to_user(argp, &icnt, sizeof(icnt)) ? -EFAULT : 0;
-        }
         case MOXA_HighSpeedOn:
                 return put_user(info->baud_base != 115200 ? 1 : 0, (int __user *)argp);
         case MOXA_SDS_RSTICOUNTER:
@@ -1828,6 +1806,39 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
         return 0;
 }
 
+        /*
+         * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
+         * Return: write counters to the user passed counter struct
+         * NB: both 1->0 and 0->1 transitions are counted except for
+         *     RI where only 0->1 is counted.
+         */
+
+static int mxser_get_icount(struct tty_struct *tty,
+                struct serial_icounter_struct *icount)
+
+{
+        struct mxser_port *info = tty->driver_data;
+        struct async_icount cnow;
+        unsigned long flags;
+
+        spin_lock_irqsave(&info->slock, flags);
+        cnow = info->icount;
+        spin_unlock_irqrestore(&info->slock, flags);
+
+        icount->frame = cnow.frame;
+        icount->brk = cnow.brk;
+        icount->overrun = cnow.overrun;
+        icount->buf_overrun = cnow.buf_overrun;
+        icount->parity = cnow.parity;
+        icount->rx = cnow.rx;
+        icount->tx = cnow.tx;
+        icount->cts = cnow.cts;
+        icount->dsr = cnow.dsr;
+        icount->rng = cnow.rng;
+        icount->dcd = cnow.dcd;
+        return 0;
+}
+
 static void mxser_stoprx(struct tty_struct *tty)
 {
         struct mxser_port *info = tty->driver_data;
@@ -2326,6 +2337,7 @@ static const struct tty_operations mxser_ops = {
         .wait_until_sent = mxser_wait_until_sent,
         .tiocmget = mxser_tiocmget,
         .tiocmset = mxser_tiocmset,
+        .get_icount = mxser_get_icount,
 };
 
 struct tty_port_operations mxser_port_ops = {
@@ -2339,20 +2351,11 @@ struct tty_port_operations mxser_port_ops = {
  * The MOXA Smartio/Industio serial driver boot-time initialization code!
  */
 
-static void mxser_release_res(struct mxser_board *brd, struct pci_dev *pdev,
-                unsigned int irq)
+static void mxser_release_ISA_res(struct mxser_board *brd)
 {
-        if (irq)
-                free_irq(brd->irq, brd);
-        if (pdev != NULL) {     /* PCI */
-#ifdef CONFIG_PCI
-                pci_release_region(pdev, 2);
-                pci_release_region(pdev, 3);
-#endif
-        } else {
-                release_region(brd->ports[0].ioaddr, 8 * brd->info->nports);
-                release_region(brd->vector, 1);
-        }
+        free_irq(brd->irq, brd);
+        release_region(brd->ports[0].ioaddr, 8 * brd->info->nports);
+        release_region(brd->vector, 1);
 }
 
 static int __devinit mxser_initbrd(struct mxser_board *brd,
@@ -2397,13 +2400,11 @@ static int __devinit mxser_initbrd(struct mxser_board *brd,
 
         retval = request_irq(brd->irq, mxser_interrupt, IRQF_SHARED, "mxser",
                         brd);
-        if (retval) {
+        if (retval)
                 printk(KERN_ERR "Board %s: Request irq failed, IRQ (%d) may "
                         "conflict with another device.\n",
                         brd->info->name, brd->irq);
-                /* We hold resources, we need to release them. */
-                mxser_release_res(brd, pdev, 0);
-        }
+
         return retval;
 }
 
@@ -2555,7 +2556,7 @@ static int __devinit mxser_probe(struct pci_dev *pdev,
         ioaddress = pci_resource_start(pdev, 2);
         retval = pci_request_region(pdev, 2, "mxser(IO)");
         if (retval)
-                goto err;
+                goto err_dis;
 
         brd->info = &mxser_cards[ent->driver_data];
         for (i = 0; i < brd->info->nports; i++)
@@ -2565,7 +2566,7 @@ static int __devinit mxser_probe(struct pci_dev *pdev,
         ioaddress = pci_resource_start(pdev, 3);
         retval = pci_request_region(pdev, 3, "mxser(vector)");
         if (retval)
-                goto err_relio;
+                goto err_zero;
         brd->vector = ioaddress;
 
         /* irq */
@@ -2608,7 +2609,7 @@ static int __devinit mxser_probe(struct pci_dev *pdev,
         /* mxser_initbrd will hook ISR. */
         retval = mxser_initbrd(brd, pdev);
         if (retval)
-                goto err_null;
+                goto err_rel3;
 
         for (i = 0; i < brd->info->nports; i++)
                 tty_register_device(mxvar_sdriver, brd->idx + i, &pdev->dev);
@@ -2616,10 +2617,13 @@ static int __devinit mxser_probe(struct pci_dev *pdev,
         pci_set_drvdata(pdev, brd);
 
         return 0;
-err_relio:
-        pci_release_region(pdev, 2);
-err_null:
+err_rel3:
+        pci_release_region(pdev, 3);
+err_zero:
         brd->info = NULL;
+        pci_release_region(pdev, 2);
+err_dis:
+        pci_disable_device(pdev);
 err:
         return retval;
 #else
@@ -2629,14 +2633,19 @@ err:
 
 static void __devexit mxser_remove(struct pci_dev *pdev)
 {
+#ifdef CONFIG_PCI
         struct mxser_board *brd = pci_get_drvdata(pdev);
         unsigned int i;
 
         for (i = 0; i < brd->info->nports; i++)
                 tty_unregister_device(mxvar_sdriver, brd->idx + i);
 
-        mxser_release_res(brd, pdev, 1);
+        free_irq(pdev->irq, brd);
+        pci_release_region(pdev, 2);
+        pci_release_region(pdev, 3);
+        pci_disable_device(pdev);
         brd->info = NULL;
+#endif
 }
 
 static struct pci_driver mxser_driver = {
@@ -2741,7 +2750,7 @@ static void __exit mxser_module_exit(void)
 
         for (i = 0; i < MXSER_BOARDS; i++)
                 if (mxser_boards[i].info != NULL)
-                        mxser_release_res(&mxser_boards[i], NULL, 1);
+                        mxser_release_ISA_res(&mxser_boards[i]);
 }
 
 module_init(mxser_module_init);
diff --git a/drivers/char/n_r3964.c b/drivers/char/n_r3964.c
index a98290d7a2c5..88dda0c45ee0 100644
--- a/drivers/char/n_r3964.c
+++ b/drivers/char/n_r3964.c
@@ -4,7 +4,6 @@
  * Copyright by 
  * Philips Automation Projects
  * Kassel (Germany)
- * http://www.pap-philips.de
  * -----------------------------------------------------------
  * This software may be used and distributed according to the terms of
  * the GNU General Public License, incorporated herein by reference.
diff --git a/drivers/char/nozomi.c b/drivers/char/nozomi.c
index 817169cbb245..dd3f9b1f11b4 100644
--- a/drivers/char/nozomi.c
+++ b/drivers/char/nozomi.c
@@ -1804,24 +1804,24 @@ static int ntty_cflags_changed(struct port *port, unsigned long flags,
         return ret;
 }
 
-static int ntty_ioctl_tiocgicount(struct port *port, void __user *argp)
+static int ntty_tiocgicount(struct tty_struct *tty,
+                                struct serial_icounter_struct *icount)
 {
+        struct port *port = tty->driver_data;
         const struct async_icount cnow = port->tty_icount;
-        struct serial_icounter_struct icount;
-
-        icount.cts = cnow.cts;
-        icount.dsr = cnow.dsr;
-        icount.rng = cnow.rng;
-        icount.dcd = cnow.dcd;
-        icount.rx = cnow.rx;
-        icount.tx = cnow.tx;
-        icount.frame = cnow.frame;
-        icount.overrun = cnow.overrun;
-        icount.parity = cnow.parity;
-        icount.brk = cnow.brk;
-        icount.buf_overrun = cnow.buf_overrun;
-
-        return copy_to_user(argp, &icount, sizeof(icount)) ? -EFAULT : 0;
+
+        icount->cts = cnow.cts;
+        icount->dsr = cnow.dsr;
+        icount->rng = cnow.rng;
+        icount->dcd = cnow.dcd;
+        icount->rx = cnow.rx;
+        icount->tx = cnow.tx;
+        icount->frame = cnow.frame;
+        icount->overrun = cnow.overrun;
+        icount->parity = cnow.parity;
+        icount->brk = cnow.brk;
+        icount->buf_overrun = cnow.buf_overrun;
+        return 0;
 }
 
 static int ntty_ioctl(struct tty_struct *tty, struct file *file,
@@ -1840,9 +1840,7 @@ static int ntty_ioctl(struct tty_struct *tty, struct file *file,
                 rval = wait_event_interruptible(port->tty_wait,
                                 ntty_cflags_changed(port, arg, &cprev));
                 break;
-        } case TIOCGICOUNT:
-                rval = ntty_ioctl_tiocgicount(port, argp);
-                break;
+        }
         default:
                 DBG1("ERR: 0x%08X, %d", cmd, cmd);
                 break;
@@ -1922,6 +1920,7 @@ static const struct tty_operations tty_ops = {
         .chars_in_buffer = ntty_chars_in_buffer,
         .tiocmget = ntty_tiocmget,
         .tiocmset = ntty_tiocmset,
+        .get_icount = ntty_tiocgicount,
         .install = ntty_install,
         .cleanup = ntty_cleanup,
 };
diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
index 66d2917b003f..166f1e7aaa7e 100644
--- a/drivers/char/nvram.c
+++ b/drivers/char/nvram.c
@@ -109,10 +109,11 @@
 #include <linux/spinlock.h>
 #include <linux/io.h>
 #include <linux/uaccess.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 
 #include <asm/system.h>
 
+static DEFINE_MUTEX(nvram_mutex);
 static DEFINE_SPINLOCK(nvram_state_lock);
 static int nvram_open_cnt;      /* #times opened */
 static int nvram_open_mode;     /* special open modes */
@@ -308,7 +309,7 @@ static long nvram_ioctl(struct file *file, unsigned int cmd,
                 if (!capable(CAP_SYS_ADMIN))
                         return -EACCES;
 
-                lock_kernel();
+                mutex_lock(&nvram_mutex);
                 spin_lock_irq(&rtc_lock);
 
                 for (i = 0; i < NVRAM_BYTES; ++i)
@@ -316,7 +317,7 @@ static long nvram_ioctl(struct file *file, unsigned int cmd,
                 __nvram_set_checksum();
 
                 spin_unlock_irq(&rtc_lock);
-                unlock_kernel();
+                mutex_unlock(&nvram_mutex);
                 return 0;
 
         case NVRAM_SETCKS:
@@ -325,11 +326,11 @@ static long nvram_ioctl(struct file *file, unsigned int cmd,
                 if (!capable(CAP_SYS_ADMIN))
                         return -EACCES;
 
-                lock_kernel();
+                mutex_lock(&nvram_mutex);
                 spin_lock_irq(&rtc_lock);
                 __nvram_set_checksum();
                 spin_unlock_irq(&rtc_lock);
-                unlock_kernel();
+                mutex_unlock(&nvram_mutex);
                 return 0;
 
         default:
diff --git a/drivers/char/nwbutton.c b/drivers/char/nwbutton.c
index 2604246501e4..8994ce32e6c7 100644
--- a/drivers/char/nwbutton.c
+++ b/drivers/char/nwbutton.c
@@ -182,6 +182,7 @@ static int button_read (struct file *filp, char __user *buffer,
 static const struct file_operations button_fops = {
         .owner          = THIS_MODULE,
         .read           = button_read,
+        .llseek         = noop_llseek,
 };
 
 /* 
diff --git a/drivers/char/nwflash.c b/drivers/char/nwflash.c
index 043a1c7b86be..a12f52400dbc 100644
--- a/drivers/char/nwflash.c
+++ b/drivers/char/nwflash.c
@@ -25,7 +25,6 @@
 #include <linux/spinlock.h>
 #include <linux/rwsem.h>
 #include <linux/init.h>
-#include <linux/smp_lock.h>
 #include <linux/mutex.h>
 #include <linux/jiffies.h>
 
@@ -41,6 +40,7 @@
 
 #define NWFLASH_VERSION "6.4"
 
+static DEFINE_MUTEX(flash_mutex);
 static void kick_open(void);
 static int get_flash_id(void);
 static int erase_block(int nBlock);
@@ -96,7 +96,7 @@ static int get_flash_id(void)
 
 static long flash_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
 {
-        lock_kernel();
+        mutex_lock(&flash_mutex);
         switch (cmd) {
         case CMD_WRITE_DISABLE:
                 gbWriteBase64Enable = 0;
@@ -114,10 +114,10 @@ static long flash_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
         default:
                 gbWriteBase64Enable = 0;
                 gbWriteEnable = 0;
-                unlock_kernel();
+                mutex_unlock(&flash_mutex);
                 return -EINVAL;
         }
-        unlock_kernel();
+        mutex_unlock(&flash_mutex);
         return 0;
 }
 
@@ -282,7 +282,7 @@ static loff_t flash_llseek(struct file *file, loff_t offset, int orig)
 {
         loff_t ret;
 
-        lock_kernel();
+        mutex_lock(&flash_mutex);
         if (flashdebug)
                 printk(KERN_DEBUG "flash_llseek: offset=0x%X, orig=0x%X.\n",
                        (unsigned int) offset, orig);
@@ -317,7 +317,7 @@ static loff_t flash_llseek(struct file *file, loff_t offset, int orig)
         default:
                 ret = -EINVAL;
         }
-        unlock_kernel();
+        mutex_unlock(&flash_mutex);
         return ret;
 }
 
diff --git a/drivers/char/pc8736x_gpio.c b/drivers/char/pc8736x_gpio.c
index 8ecbcc174c15..b304ec052501 100644
--- a/drivers/char/pc8736x_gpio.c
+++ b/drivers/char/pc8736x_gpio.c
@@ -234,6 +234,7 @@ static const struct file_operations pc8736x_gpio_fileops = {
         .open   = pc8736x_gpio_open,
         .write  = nsc_gpio_write,
         .read   = nsc_gpio_read,
+        .llseek = no_llseek,
 };
 
 static void __init pc8736x_init_shadow(void)
diff --git a/drivers/char/pcmcia/Kconfig b/drivers/char/pcmcia/Kconfig
index ffa0efce0aed..6614416a8623 100644
--- a/drivers/char/pcmcia/Kconfig
+++ b/drivers/char/pcmcia/Kconfig
@@ -28,7 +28,7 @@ config CARDMAN_4000
 
           This kernel driver requires additional userspace support, either
           by the vendor-provided PC/SC ifd_handler (http://www.omnikey.com/),
-          or via the cm4000 backend of OpenCT (http://www.opensc.com/).
+          or via the cm4000 backend of OpenCT (http://www.opensc-project.org/opensc).
 
 config CARDMAN_4040
         tristate "Omnikey CardMan 4040 support"
@@ -41,7 +41,7 @@ config CARDMAN_4040
           in I/O space.  To use the kernel driver, you will need either the
           PC/SC ifdhandler provided from the Omnikey homepage
           (http://www.omnikey.com/), or a current development version of OpenCT
-          (http://www.opensc.org/).
+          (http://www.opensc-project.org/opensc).
 
 config IPWIRELESS
         tristate "IPWireless 3G UMTS PCMCIA card support"
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index c7b482d15e2a..d962f25dcc2a 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -30,7 +30,7 @@
 #include <linux/fs.h>
 #include <linux/delay.h>
 #include <linux/bitrev.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/uaccess.h>
 #include <linux/io.h>
 
@@ -54,6 +54,8 @@
                            __func__ , ## args);         \
         } while (0)
 
+static DEFINE_MUTEX(cmm_mutex);
+
 #define T_1SEC          (HZ)
 #define T_10MSEC        msecs_to_jiffies(10)
 #define T_20MSEC        msecs_to_jiffies(20)
@@ -1415,7 +1417,7 @@ static long cmm_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                iminor(inode), ioctl_names[_IOC_NR(cmd)]);
 #endif
 
-        lock_kernel();
+        mutex_lock(&cmm_mutex);
         rc = -ENODEV;
         link = dev_table[iminor(inode)];
         if (!pcmcia_dev_present(link)) {
@@ -1623,7 +1625,7 @@ static long cmm_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 rc = -ENOTTY;
         }
 out:
-        unlock_kernel();
+        mutex_unlock(&cmm_mutex);
         return rc;
 }
 
@@ -1637,7 +1639,7 @@ static int cmm_open(struct inode *inode, struct file *filp)
         if (minor >= CM4000_MAX_DEV)
                 return -ENODEV;
 
-        lock_kernel();
+        mutex_lock(&cmm_mutex);
         link = dev_table[minor];
         if (link == NULL || !pcmcia_dev_present(link)) {
                 ret = -ENODEV;
@@ -1664,7 +1666,7 @@ static int cmm_open(struct inode *inode, struct file *filp)
         /* opening will always block since the
          * monitor will be started by open, which
          * means we have to wait for ATR becoming
-         * vaild = block until valid (or card
+         * valid = block until valid (or card
          * inserted)
          */
         if (filp->f_flags & O_NONBLOCK) {
@@ -1682,7 +1684,7 @@ static int cmm_open(struct inode *inode, struct file *filp)
         DEBUGP(2, dev, "<- cmm_open\n");
         ret = nonseekable_open(inode, filp);
 out:
-        unlock_kernel();
+        mutex_unlock(&cmm_mutex);
         return ret;
 }
 
@@ -1864,6 +1866,7 @@ static const struct file_operations cm4000_fops = {
         .unlocked_ioctl = cmm_ioctl,
         .open   = cmm_open,
         .release= cmm_close,
+        .llseek = no_llseek,
 };
 
 static struct pcmcia_device_id cm4000_ids[] = {
diff --git a/drivers/char/pcmcia/cm4040_cs.c b/drivers/char/pcmcia/cm4040_cs.c
index bf2f046fc2c1..5d8d59e865f4 100644
--- a/drivers/char/pcmcia/cm4040_cs.c
+++ b/drivers/char/pcmcia/cm4040_cs.c
@@ -24,7 +24,7 @@
 #include <linux/fs.h>
 #include <linux/delay.h>
 #include <linux/poll.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/wait.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -48,6 +48,8 @@
                            __func__ , ## args);         \
         } while (0)
 
+static DEFINE_MUTEX(cm4040_mutex);
+
 #define CCID_DRIVER_BULK_DEFAULT_TIMEOUT        (150*HZ)
 #define CCID_DRIVER_ASYNC_POWERUP_TIMEOUT       (35*HZ)
 #define CCID_DRIVER_MINIMUM_TIMEOUT             (3*HZ)
@@ -440,7 +442,7 @@ static int cm4040_open(struct inode *inode, struct file *filp)
         if (minor >= CM_MAX_DEV)
                 return -ENODEV;
 
-        lock_kernel();
+        mutex_lock(&cm4040_mutex);
         link = dev_table[minor];
         if (link == NULL || !pcmcia_dev_present(link)) {
                 ret = -ENODEV;
@@ -469,7 +471,7 @@ static int cm4040_open(struct inode *inode, struct file *filp)
         DEBUGP(2, dev, "<- cm4040_open (successfully)\n");
         ret = nonseekable_open(inode, filp);
 out:
-        unlock_kernel();
+        mutex_unlock(&cm4040_mutex);
         return ret;
 }
 
@@ -628,6 +630,7 @@ static const struct file_operations reader_fops = {
         .open           = cm4040_open,
         .release        = cm4040_close,
         .poll           = cm4040_poll,
+        .llseek         = no_llseek,
 };
 
 static struct pcmcia_device_id cm4040_ids[] = {
diff --git a/drivers/char/pcmcia/ipwireless/Makefile b/drivers/char/pcmcia/ipwireless/Makefile
index b71eb593643d..db80873d7f20 100644
--- a/drivers/char/pcmcia/ipwireless/Makefile
+++ b/drivers/char/pcmcia/ipwireless/Makefile
@@ -6,5 +6,5 @@
 
 obj-$(CONFIG_IPWIRELESS) += ipwireless.o
 
-ipwireless-objs := hardware.o main.o network.o tty.o
+ipwireless-y := hardware.o main.o network.o tty.o
 
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index be1810057607..bfc10f89d951 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -2191,6 +2191,32 @@ static int mgslpc_break(struct tty_struct *tty, int break_state)
         return 0;
 }
 
+static int mgslpc_get_icount(struct tty_struct *tty,
+                                struct serial_icounter_struct *icount)
+{
+        MGSLPC_INFO * info = (MGSLPC_INFO *)tty->driver_data;
+        struct mgsl_icount cnow;        /* kernel counter temps */
+        unsigned long flags;
+
+        spin_lock_irqsave(&info->lock,flags);
+        cnow = info->icount;
+        spin_unlock_irqrestore(&info->lock,flags);
+
+        icount->cts = cnow.cts;
+        icount->dsr = cnow.dsr;
+        icount->rng = cnow.rng;
+        icount->dcd = cnow.dcd;
+        icount->rx = cnow.rx;
+        icount->tx = cnow.tx;
+        icount->frame = cnow.frame;
+        icount->overrun = cnow.overrun;
+        icount->parity = cnow.parity;
+        icount->brk = cnow.brk;
+        icount->buf_overrun = cnow.buf_overrun;
+
+        return 0;
+}
+
 /* Service an IOCTL request
  *
  * Arguments:
@@ -2206,11 +2232,7 @@ static int mgslpc_ioctl(struct tty_struct *tty, struct file * file,
                         unsigned int cmd, unsigned long arg)
 {
         MGSLPC_INFO * info = (MGSLPC_INFO *)tty->driver_data;
-        int error;
-        struct mgsl_icount cnow;        /* kernel counter temps */
-        struct serial_icounter_struct __user *p_cuser;  /* user space */
         void __user *argp = (void __user *)arg;
-        unsigned long flags;
 
         if (debug_level >= DEBUG_LEVEL_INFO)
                 printk("%s(%d):mgslpc_ioctl %s cmd=%08X\n", __FILE__,__LINE__,
@@ -2220,7 +2242,7 @@ static int mgslpc_ioctl(struct tty_struct *tty, struct file * file,
                 return -ENODEV;
 
         if ((cmd != TIOCGSERIAL) && (cmd != TIOCSSERIAL) &&
-            (cmd != TIOCMIWAIT) && (cmd != TIOCGICOUNT)) {
+            (cmd != TIOCMIWAIT)) {
                 if (tty->flags & (1 << TTY_IO_ERROR))
                     return -EIO;
         }
@@ -2250,34 +2272,6 @@ static int mgslpc_ioctl(struct tty_struct *tty, struct file * file,
                 return wait_events(info, argp);
         case TIOCMIWAIT:
                 return modem_input_wait(info,(int)arg);
-        case TIOCGICOUNT:
-                spin_lock_irqsave(&info->lock,flags);
-                cnow = info->icount;
-                spin_unlock_irqrestore(&info->lock,flags);
-                p_cuser = argp;
-                PUT_USER(error,cnow.cts, &p_cuser->cts);
-                if (error) return error;
-                PUT_USER(error,cnow.dsr, &p_cuser->dsr);
-                if (error) return error;
-                PUT_USER(error,cnow.rng, &p_cuser->rng);
-                if (error) return error;
-                PUT_USER(error,cnow.dcd, &p_cuser->dcd);
-                if (error) return error;
-                PUT_USER(error,cnow.rx, &p_cuser->rx);
-                if (error) return error;
-                PUT_USER(error,cnow.tx, &p_cuser->tx);
-                if (error) return error;
-                PUT_USER(error,cnow.frame, &p_cuser->frame);
-                if (error) return error;
-                PUT_USER(error,cnow.overrun, &p_cuser->overrun);
-                if (error) return error;
-                PUT_USER(error,cnow.parity, &p_cuser->parity);
-                if (error) return error;
-                PUT_USER(error,cnow.brk, &p_cuser->brk);
-                if (error) return error;
-                PUT_USER(error,cnow.buf_overrun, &p_cuser->buf_overrun);
-                if (error) return error;
-                return 0;
         default:
                 return -ENOIOCTLCMD;
         }
diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index 02abfddce45a..f176dbaeb15a 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -67,7 +67,7 @@
 #include <linux/slab.h>
 #include <linux/major.h>
 #include <linux/ppdev.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/uaccess.h>
 
 #define PP_VERSION "ppdev: user-space parallel port driver"
@@ -97,6 +97,7 @@ struct pp_struct {
 /* ROUND_UP macro from fs/select.c */
 #define ROUND_UP(x,y) (((x)+(y)-1)/(y))
 
+static DEFINE_MUTEX(pp_do_mutex);
 static inline void pp_enable_irq (struct pp_struct *pp)
 {
         struct parport *port = pp->pdev->port;
@@ -612,6 +613,7 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
         case PPGETTIME:
                 to_jiffies = pp->pdev->timeout;
+                memset(&par_timeout, 0, sizeof(par_timeout));
                 par_timeout.tv_sec = to_jiffies / HZ;
                 par_timeout.tv_usec = (to_jiffies % (long)HZ) * (1000000/HZ);
                 if (copy_to_user (argp, &par_timeout, sizeof(struct timeval)))
@@ -630,9 +632,9 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 static long pp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
         long ret;
-        lock_kernel();
+        mutex_lock(&pp_do_mutex);
         ret = pp_do_ioctl(file, cmd, arg);
-        unlock_kernel();
+        mutex_unlock(&pp_do_mutex);
         return ret;
 }
 
@@ -641,7 +643,6 @@ static int pp_open (struct inode * inode, struct file * file)
         unsigned int minor = iminor(inode);
         struct pp_struct *pp;
 
-        cycle_kernel_lock();
         if (minor >= PARPORT_MAX)
                 return -ENXIO;
 
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index c350d01716bd..923a48585501 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -676,7 +676,9 @@ static int ptmx_open(struct inode *inode, struct file *filp)
 
         set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
 
-        tty_add_file(tty, filp);
+        retval = tty_add_file(tty, filp);
+        if (retval)
+                goto out;
 
         retval = devpts_pty_new(inode, tty->link);
         if (retval)
diff --git a/drivers/char/ramoops.c b/drivers/char/ramoops.c
index 74f00b5ffa36..73dcb0ee41fd 100644
--- a/drivers/char/ramoops.c
+++ b/drivers/char/ramoops.c
@@ -25,6 +25,8 @@
 #include <linux/time.h>
 #include <linux/io.h>
 #include <linux/ioport.h>
+#include <linux/platform_device.h>
+#include <linux/ramoops.h>
 
 #define RAMOOPS_KERNMSG_HDR "===="
 #define RAMOOPS_HEADER_SIZE   (5 + sizeof(struct timeval))
@@ -91,11 +93,17 @@ static void ramoops_do_dump(struct kmsg_dumper *dumper,
         cxt->count = (cxt->count + 1) % cxt->max_count;
 }
 
-static int __init ramoops_init(void)
+static int __init ramoops_probe(struct platform_device *pdev)
 {
+        struct ramoops_platform_data *pdata = pdev->dev.platform_data;
         struct ramoops_context *cxt = &oops_cxt;
         int err = -EINVAL;
 
+        if (pdata) {
+                mem_size = pdata->mem_size;
+                mem_address = pdata->mem_address;
+        }
+
         if (!mem_size) {
                 printk(KERN_ERR "ramoops: invalid size specification");
                 goto fail3;
@@ -142,7 +150,7 @@ fail3:
         return err;
 }
 
-static void __exit ramoops_exit(void)
+static int __exit ramoops_remove(struct platform_device *pdev)
 {
         struct ramoops_context *cxt = &oops_cxt;
 
@@ -151,8 +159,26 @@ static void __exit ramoops_exit(void)
 
         iounmap(cxt->virt_addr);
         release_mem_region(cxt->phys_addr, cxt->size);
+        return 0;
 }
 
+static struct platform_driver ramoops_driver = {
+        .remove         = __exit_p(ramoops_remove),
+        .driver         = {
+                .name   = "ramoops",
+                .owner  = THIS_MODULE,
+        },
+};
+
+static int __init ramoops_init(void)
+{
+        return platform_driver_probe(&ramoops_driver, ramoops_probe);
+}
+
+static void __exit ramoops_exit(void)
+{
+        platform_driver_unregister(&ramoops_driver);
+}
 
 module_init(ramoops_init);
 module_exit(ramoops_exit);
diff --git a/drivers/char/random.c b/drivers/char/random.c
index caef35a46890..5a1aa64f4e76 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1165,6 +1165,7 @@ const struct file_operations random_fops = {
         .poll  = random_poll,
         .unlocked_ioctl = random_ioctl,
         .fasync = random_fasync,
+        .llseek = noop_llseek,
 };
 
 const struct file_operations urandom_fops = {
@@ -1172,6 +1173,7 @@ const struct file_operations urandom_fops = {
         .write = random_write,
         .unlocked_ioctl = random_ioctl,
         .fasync = random_fasync,
+        .llseek = noop_llseek,
 };
 
 /***************************************************************
diff --git a/drivers/char/raw.c b/drivers/char/raw.c
index b38942f6bf31..bfe25ea9766b 100644
--- a/drivers/char/raw.c
+++ b/drivers/char/raw.c
@@ -19,8 +19,8 @@
 #include <linux/cdev.h>
 #include <linux/device.h>
 #include <linux/mutex.h>
-#include <linux/smp_lock.h>
 #include <linux/gfp.h>
+#include <linux/compat.h>
 
 #include <asm/uaccess.h>
 
@@ -55,7 +55,6 @@ static int raw_open(struct inode *inode, struct file *filp)
                 return 0;
         }
 
-        lock_kernel();
         mutex_lock(&raw_mutex);
 
         /*
@@ -82,7 +81,6 @@ static int raw_open(struct inode *inode, struct file *filp)
                         bdev->bd_inode->i_mapping;
         filp->private_data = bdev;
         mutex_unlock(&raw_mutex);
-        unlock_kernel();
         return 0;
 
 out2:
@@ -91,7 +89,6 @@ out1:
         blkdev_put(bdev, filp->f_mode);
 out:
         mutex_unlock(&raw_mutex);
-        unlock_kernel();
         return err;
 }
 
@@ -125,20 +122,84 @@ static long
 raw_ioctl(struct file *filp, unsigned int command, unsigned long arg)
 {
         struct block_device *bdev = filp->private_data;
-        int ret;
+        return blkdev_ioctl(bdev, 0, command, arg);
+}
+
+static int bind_set(int number, u64 major, u64 minor)
+{
+        dev_t dev = MKDEV(major, minor);
+        struct raw_device_data *rawdev;
+        int err = 0;
 
-        lock_kernel();
-        ret = blkdev_ioctl(bdev, 0, command, arg);
-        unlock_kernel();
+        if (number <= 0 || number >= MAX_RAW_MINORS)
+                return -EINVAL;
 
-        return ret;
+        if (MAJOR(dev) != major || MINOR(dev) != minor)
+                return -EINVAL;
+
+        rawdev = &raw_devices[number];
+
+        /*
+         * This is like making block devices, so demand the
+         * same capability
+         */
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        /*
+         * For now, we don't need to check that the underlying
+         * block device is present or not: we can do that when
+         * the raw device is opened.  Just check that the
+         * major/minor numbers make sense.
+         */
+
+        if (MAJOR(dev) == 0 && dev != 0)
+                return -EINVAL;
+
+        mutex_lock(&raw_mutex);
+        if (rawdev->inuse) {
+                mutex_unlock(&raw_mutex);
+                return -EBUSY;
+        }
+        if (rawdev->binding) {
+                bdput(rawdev->binding);
+                module_put(THIS_MODULE);
+        }
+        if (!dev) {
+                /* unbind */
+                rawdev->binding = NULL;
+                device_destroy(raw_class, MKDEV(RAW_MAJOR, number));
+        } else {
+                rawdev->binding = bdget(dev);
+                if (rawdev->binding == NULL) {
+                        err = -ENOMEM;
+                } else {
+                        dev_t raw = MKDEV(RAW_MAJOR, number);
+                        __module_get(THIS_MODULE);
+                        device_destroy(raw_class, raw);
+                        device_create(raw_class, NULL, raw, NULL,
+                                      "raw%d", number);
+                }
+        }
+        mutex_unlock(&raw_mutex);
+        return err;
 }
 
-static void bind_device(struct raw_config_request *rq)
+static int bind_get(int number, dev_t *dev)
 {
-        device_destroy(raw_class, MKDEV(RAW_MAJOR, rq->raw_minor));
-        device_create(raw_class, NULL, MKDEV(RAW_MAJOR, rq->raw_minor), NULL,
-                      "raw%d", rq->raw_minor);
+        struct raw_device_data *rawdev;
+        struct block_device *bdev;
+
+        if (number <= 0 || number >= MAX_RAW_MINORS)
+                return -EINVAL;
+
+        rawdev = &raw_devices[number];
+
+        mutex_lock(&raw_mutex);
+        bdev = rawdev->binding;
+        *dev = bdev ? bdev->bd_dev : 0;
+        mutex_unlock(&raw_mutex);
+        return 0;
 }
 
 /*
@@ -149,105 +210,78 @@ static long raw_ctl_ioctl(struct file *filp, unsigned int command,
                           unsigned long arg)
 {
         struct raw_config_request rq;
-        struct raw_device_data *rawdev;
-        int err = 0;
+        dev_t dev;
+        int err;
 
-        lock_kernel();
         switch (command) {
         case RAW_SETBIND:
+                if (copy_from_user(&rq, (void __user *) arg, sizeof(rq)))
+                        return -EFAULT;
+
+                return bind_set(rq.raw_minor, rq.block_major, rq.block_minor);
+
         case RAW_GETBIND:
+                if (copy_from_user(&rq, (void __user *) arg, sizeof(rq)))
+                        return -EFAULT;
 
-                /* First, find out which raw minor we want */
+                err = bind_get(rq.raw_minor, &dev);
+                if (err)
+                        return err;
 
-                if (copy_from_user(&rq, (void __user *) arg, sizeof(rq))) {
-                        err = -EFAULT;
-                        goto out;
-                }
+                rq.block_major = MAJOR(dev);
+                rq.block_minor = MINOR(dev);
 
-                if (rq.raw_minor <= 0 || rq.raw_minor >= MAX_RAW_MINORS) {
-                        err = -EINVAL;
-                        goto out;
-                }
-                rawdev = &raw_devices[rq.raw_minor];
-
-                if (command == RAW_SETBIND) {
-                        dev_t dev;
-
-                        /*
-                         * This is like making block devices, so demand the
-                         * same capability
-                         */
-                        if (!capable(CAP_SYS_ADMIN)) {
-                                err = -EPERM;
-                                goto out;
-                        }
-
-                        /*
-                         * For now, we don't need to check that the underlying
-                         * block device is present or not: we can do that when
-                         * the raw device is opened.  Just check that the
-                         * major/minor numbers make sense.
-                         */
-
-                        dev = MKDEV(rq.block_major, rq.block_minor);
-                        if ((rq.block_major == 0 && rq.block_minor != 0) ||
-                                        MAJOR(dev) != rq.block_major ||
-                                        MINOR(dev) != rq.block_minor) {
-                                err = -EINVAL;
-                                goto out;
-                        }
-
-                        mutex_lock(&raw_mutex);
-                        if (rawdev->inuse) {
-                                mutex_unlock(&raw_mutex);
-                                err = -EBUSY;
-                                goto out;
-                        }
-                        if (rawdev->binding) {
-                                bdput(rawdev->binding);
-                                module_put(THIS_MODULE);
-                        }
-                        if (rq.block_major == 0 && rq.block_minor == 0) {
-                                /* unbind */
-                                rawdev->binding = NULL;
-                                device_destroy(raw_class,
-                                                MKDEV(RAW_MAJOR, rq.raw_minor));
-                        } else {
-                                rawdev->binding = bdget(dev);
-                                if (rawdev->binding == NULL)
-                                        err = -ENOMEM;
-                                else {
-                                        __module_get(THIS_MODULE);
-                                        bind_device(&rq);
-                                }
-                        }
-                        mutex_unlock(&raw_mutex);
-                } else {
-                        struct block_device *bdev;
-
-                        mutex_lock(&raw_mutex);
-                        bdev = rawdev->binding;
-                        if (bdev) {
-                                rq.block_major = MAJOR(bdev->bd_dev);
-                                rq.block_minor = MINOR(bdev->bd_dev);
-                        } else {
-                                rq.block_major = rq.block_minor = 0;
-                        }
-                        mutex_unlock(&raw_mutex);
-                        if (copy_to_user((void __user *)arg, &rq, sizeof(rq))) {
-                                err = -EFAULT;
-                                goto out;
-                        }
-                }
-                break;
-        default:
-                err = -EINVAL;
-                break;
+                if (copy_to_user((void __user *)arg, &rq, sizeof(rq)))
+                        return -EFAULT;
+
+                return 0;
         }
-out:
-        unlock_kernel();
-        return err;
+
+        return -EINVAL;
+}
+
+#ifdef CONFIG_COMPAT
+struct raw32_config_request {
+        compat_int_t    raw_minor;
+        compat_u64      block_major;
+        compat_u64      block_minor;
+};
+
+static long raw_ctl_compat_ioctl(struct file *file, unsigned int cmd,
+                                unsigned long arg)
+{
+        struct raw32_config_request __user *user_req = compat_ptr(arg);
+        struct raw32_config_request rq;
+        dev_t dev;
+        int err = 0;
+
+        switch (cmd) {
+        case RAW_SETBIND:
+                if (copy_from_user(&rq, user_req, sizeof(rq)))
+                        return -EFAULT;
+
+                return bind_set(rq.raw_minor, rq.block_major, rq.block_minor);
+
+        case RAW_GETBIND:
+                if (copy_from_user(&rq, user_req, sizeof(rq)))
+                        return -EFAULT;
+
+                err = bind_get(rq.raw_minor, &dev);
+                if (err)
+                        return err;
+
+                rq.block_major = MAJOR(dev);
+                rq.block_minor = MINOR(dev);
+
+                if (copy_to_user(user_req, &rq, sizeof(rq)))
+                        return -EFAULT;
+
+                return 0;
+        }
+
+        return -EINVAL;
 }
+#endif
 
 static const struct file_operations raw_fops = {
         .read           = do_sync_read,
@@ -258,13 +292,18 @@ static const struct file_operations raw_fops = {
         .open           = raw_open,
         .release        = raw_release,
         .unlocked_ioctl = raw_ioctl,
+        .llseek         = default_llseek,
         .owner          = THIS_MODULE,
 };
 
 static const struct file_operations raw_ctl_fops = {
         .unlocked_ioctl = raw_ctl_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = raw_ctl_compat_ioctl,
+#endif
         .open           = raw_open,
         .owner          = THIS_MODULE,
+        .llseek         = noop_llseek,
 };
 
 static struct cdev raw_cdev;
diff --git a/drivers/char/rio/Makefile b/drivers/char/rio/Makefile
index 2d1c5a7cba7d..1661875883fb 100644
--- a/drivers/char/rio/Makefile
+++ b/drivers/char/rio/Makefile
@@ -8,5 +8,5 @@
 
 obj-$(CONFIG_RIO) += rio.o
 
-rio-objs := rio_linux.o rioinit.o rioboot.o riocmd.o rioctrl.o riointr.o \
+rio-y := rio_linux.o rioinit.o rioboot.o riocmd.o rioctrl.o riointr.o \
             rioparam.o rioroute.o riotable.o riotty.o
diff --git a/drivers/char/rio/rio_linux.c b/drivers/char/rio/rio_linux.c
index d58c2eb07f07..5e33293d24e3 100644
--- a/drivers/char/rio/rio_linux.c
+++ b/drivers/char/rio/rio_linux.c
@@ -44,7 +44,7 @@
 #include <linux/delay.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/miscdevice.h>
 #include <linux/init.h>
 
@@ -122,6 +122,7 @@ more than 512 ports.... */
 
 
 /* These constants are derived from SCO Source */
+static DEFINE_MUTEX(rio_fw_mutex);
 static struct Conf
  RIOConf = {
         /* locator */ "RIO Config here",
@@ -241,6 +242,7 @@ static struct real_driver rio_real_driver = {
 static const struct file_operations rio_fw_fops = {
         .owner = THIS_MODULE,
         .unlocked_ioctl = rio_fw_ioctl,
+        .llseek = noop_llseek,
 };
 
 static struct miscdevice rio_fw_device = {
@@ -566,9 +568,9 @@ static long rio_fw_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
         func_enter();
 
         /* The "dev" argument isn't used. */
-        lock_kernel();
+        mutex_lock(&rio_fw_mutex);
         rc = riocontrol(p, 0, cmd, arg, capable(CAP_SYS_ADMIN));
-        unlock_kernel();
+        mutex_unlock(&rio_fw_mutex);
 
         func_exit();
         return rc;
diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
index 7c79d243acc9..86308830ac42 100644
--- a/drivers/char/rocket.c
+++ b/drivers/char/rocket.c
@@ -2345,7 +2345,7 @@ static int __init rp_init(void)
         ret = tty_register_driver(rocket_driver);
         if (ret < 0) {
                 printk(KERN_ERR "Couldn't install tty RocketPort driver\n");
-                goto err_tty;
+                goto err_controller;
         }
 
 #ifdef ROCKET_DEBUG_OPEN
@@ -2380,6 +2380,9 @@ static int __init rp_init(void)
         return 0;
 err_ttyu:
         tty_unregister_driver(rocket_driver);
+err_controller:
+        if (controller)
+                release_region(controller, 4);
 err_tty:
         put_tty_driver(rocket_driver);
 err:
diff --git a/drivers/char/scx200_gpio.c b/drivers/char/scx200_gpio.c
index 99e5272e3c53..0bc135b9b16f 100644
--- a/drivers/char/scx200_gpio.c
+++ b/drivers/char/scx200_gpio.c
@@ -67,6 +67,7 @@ static const struct file_operations scx200_gpio_fileops = {
         .read    = nsc_gpio_read,
         .open    = scx200_gpio_open,
         .release = scx200_gpio_release,
+        .llseek  = no_llseek,
 };
 
 static struct cdev scx200_gpio_cdev;  /* use 1 cdev for all pins */
diff --git a/drivers/char/snsc.c b/drivers/char/snsc.c
index 32b74de18f5f..5816b39ff5a9 100644
--- a/drivers/char/snsc.c
+++ b/drivers/char/snsc.c
@@ -21,7 +21,7 @@
 #include <linux/poll.h>
 #include <linux/module.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <asm/sn/io.h>
 #include <asm/sn/sn_sal.h>
 #include <asm/sn/module.h>
@@ -34,6 +34,7 @@
 #define SCDRV_BUFSZ     2048
 #define SCDRV_TIMEOUT   1000
 
+static DEFINE_MUTEX(scdrv_mutex);
 static irqreturn_t
 scdrv_interrupt(int irq, void *subch_data)
 {
@@ -105,7 +106,7 @@ scdrv_open(struct inode *inode, struct file *file)
         file->private_data = sd;
 
         /* hook this subchannel up to the system controller interrupt */
-        lock_kernel();
+        mutex_lock(&scdrv_mutex);
         rv = request_irq(SGI_UART_VECTOR, scdrv_interrupt,
                          IRQF_SHARED | IRQF_DISABLED,
                          SYSCTL_BASENAME, sd);
@@ -113,10 +114,10 @@ scdrv_open(struct inode *inode, struct file *file)
                 ia64_sn_irtr_close(sd->sd_nasid, sd->sd_subch);
                 kfree(sd);
                 printk("%s: irq request failed (%d)\n", __func__, rv);
-                unlock_kernel();
+                mutex_unlock(&scdrv_mutex);
                 return -EBUSY;
         }
-        unlock_kernel();
+        mutex_unlock(&scdrv_mutex);
         return 0;
 }
 
@@ -357,6 +358,7 @@ static const struct file_operations scdrv_fops = {
         .poll =         scdrv_poll,
         .open =         scdrv_open,
         .release =      scdrv_release,
+        .llseek =       noop_llseek,
 };
 
 static struct class *snsc_class;
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index f2167f8e5aab..4bef6ab83622 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -608,6 +608,7 @@ static unsigned int	sc26198_baudtable[] = {
 static const struct file_operations     stl_fsiomem = {
         .owner          = THIS_MODULE,
         .unlocked_ioctl = stl_memioctl,
+        .llseek         = noop_llseek,
 };
 
 static struct class *stallion_class;
@@ -3180,7 +3181,7 @@ static void stl_cd1400flush(struct stlport *portp)
 
 /*
  *      Return the current state of data flow on this port. This is only
- *      really interresting when determining if data has fully completed
+ *      really interesting when determining if data has fully completed
  *      transmission or not... This is easy for the cd1400, it accurately
  *      maintains the busy port flag.
  */
@@ -4130,7 +4131,7 @@ static void stl_sc26198flush(struct stlport *portp)
 
 /*
  *      Return the current state of data flow on this port. This is only
- *      really interresting when determining if data has fully completed
+ *      really interesting when determining if data has fully completed
  *      transmission or not... The sc26198 interrupt scheme cannot
  *      determine when all data has actually drained, so we need to
  *      check the port statusy register to be sure.
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index 5b24db4ff7f1..e53f16865397 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -397,6 +397,7 @@ static struct real_driver sx_real_driver = {
 static const struct file_operations sx_fw_fops = {
         .owner = THIS_MODULE,
         .unlocked_ioctl = sx_fw_ioctl,
+        .llseek = noop_llseek,
 };
 
 static struct miscdevice sx_fw_device = {
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index a2a58004e188..3a6824f12be2 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -2925,6 +2925,38 @@ static int mgsl_break(struct tty_struct *tty, int break_state)
         
 }       /* end of mgsl_break() */
 
+/*
+ * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
+ * Return: write counters to the user passed counter struct
+ * NB: both 1->0 and 0->1 transitions are counted except for
+ *     RI where only 0->1 is counted.
+ */
+static int msgl_get_icount(struct tty_struct *tty,
+                                struct serial_icounter_struct *icount)
+
+{
+        struct mgsl_struct * info = tty->driver_data;
+        struct mgsl_icount cnow;        /* kernel counter temps */
+        unsigned long flags;
+
+        spin_lock_irqsave(&info->irq_spinlock,flags);
+        cnow = info->icount;
+        spin_unlock_irqrestore(&info->irq_spinlock,flags);
+
+        icount->cts = cnow.cts;
+        icount->dsr = cnow.dsr;
+        icount->rng = cnow.rng;
+        icount->dcd = cnow.dcd;
+        icount->rx = cnow.rx;
+        icount->tx = cnow.tx;
+        icount->frame = cnow.frame;
+        icount->overrun = cnow.overrun;
+        icount->parity = cnow.parity;
+        icount->brk = cnow.brk;
+        icount->buf_overrun = cnow.buf_overrun;
+        return 0;
+}
+
 /* mgsl_ioctl() Service an IOCTL request
  *      
  * Arguments:
@@ -2949,7 +2981,7 @@ static int mgsl_ioctl(struct tty_struct *tty, struct file * file,
                 return -ENODEV;
 
         if ((cmd != TIOCGSERIAL) && (cmd != TIOCSSERIAL) &&
-            (cmd != TIOCMIWAIT) && (cmd != TIOCGICOUNT)) {
+            (cmd != TIOCMIWAIT)) {
                 if (tty->flags & (1 << TTY_IO_ERROR))
                     return -EIO;
         }
@@ -2959,11 +2991,7 @@ static int mgsl_ioctl(struct tty_struct *tty, struct file * file,
 
 static int mgsl_ioctl_common(struct mgsl_struct *info, unsigned int cmd, unsigned long arg)
 {
-        int error;
-        struct mgsl_icount cnow;        /* kernel counter temps */
         void __user *argp = (void __user *)arg;
-        struct serial_icounter_struct __user *p_cuser;  /* user space */
-        unsigned long flags;
         
         switch (cmd) {
                 case MGSL_IOCGPARAMS:
@@ -2992,40 +3020,6 @@ static int mgsl_ioctl_common(struct mgsl_struct *info, unsigned int cmd, unsigne
                 case TIOCMIWAIT:
                         return modem_input_wait(info,(int)arg);
 
-                /* 
-                 * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
-                 * Return: write counters to the user passed counter struct
-                 * NB: both 1->0 and 0->1 transitions are counted except for
-                 *     RI where only 0->1 is counted.
-                 */
-                case TIOCGICOUNT:
-                        spin_lock_irqsave(&info->irq_spinlock,flags);
-                        cnow = info->icount;
-                        spin_unlock_irqrestore(&info->irq_spinlock,flags);
-                        p_cuser = argp;
-                        PUT_USER(error,cnow.cts, &p_cuser->cts);
-                        if (error) return error;
-                        PUT_USER(error,cnow.dsr, &p_cuser->dsr);
-                        if (error) return error;
-                        PUT_USER(error,cnow.rng, &p_cuser->rng);
-                        if (error) return error;
-                        PUT_USER(error,cnow.dcd, &p_cuser->dcd);
-                        if (error) return error;
-                        PUT_USER(error,cnow.rx, &p_cuser->rx);
-                        if (error) return error;
-                        PUT_USER(error,cnow.tx, &p_cuser->tx);
-                        if (error) return error;
-                        PUT_USER(error,cnow.frame, &p_cuser->frame);
-                        if (error) return error;
-                        PUT_USER(error,cnow.overrun, &p_cuser->overrun);
-                        if (error) return error;
-                        PUT_USER(error,cnow.parity, &p_cuser->parity);
-                        if (error) return error;
-                        PUT_USER(error,cnow.brk, &p_cuser->brk);
-                        if (error) return error;
-                        PUT_USER(error,cnow.buf_overrun, &p_cuser->buf_overrun);
-                        if (error) return error;
-                        return 0;
                 default:
                         return -ENOIOCTLCMD;
         }
@@ -4328,6 +4322,7 @@ static const struct tty_operations mgsl_ops = {
         .hangup = mgsl_hangup,
         .tiocmget = tiocmget,
         .tiocmset = tiocmset,
+        .get_icount = msgl_get_icount,
         .proc_fops = &mgsl_proc_fops,
 };
 
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index e63b830c86cc..d01fffeac951 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -301,6 +301,8 @@ struct slgt_info {
         unsigned int rx_pio;
         unsigned int if_mode;
         unsigned int base_clock;
+        unsigned int xsync;
+        unsigned int xctrl;
 
         /* device status */
 
@@ -405,6 +407,8 @@ static MGSL_PARAMS default_params = {
 #define TDCSR 0x94 /* tx DMA control/status */
 #define RDDAR 0x98 /* rx DMA descriptor address */
 #define TDDAR 0x9c /* tx DMA descriptor address */
+#define XSR   0x40 /* extended sync pattern */
+#define XCR   0x44 /* extended control */
 
 #define RXIDLE      BIT14
 #define RXBREAK     BIT14
@@ -517,6 +521,10 @@ static int  set_interface(struct slgt_info *info, int if_mode);
 static int  set_gpio(struct slgt_info *info, struct gpio_desc __user *gpio);
 static int  get_gpio(struct slgt_info *info, struct gpio_desc __user *gpio);
 static int  wait_gpio(struct slgt_info *info, struct gpio_desc __user *gpio);
+static int  get_xsync(struct slgt_info *info, int __user *if_mode);
+static int  set_xsync(struct slgt_info *info, int if_mode);
+static int  get_xctrl(struct slgt_info *info, int __user *if_mode);
+static int  set_xctrl(struct slgt_info *info, int if_mode);
 
 /*
  * driver functions
@@ -1032,9 +1040,6 @@ static int ioctl(struct tty_struct *tty, struct file *file,
                  unsigned int cmd, unsigned long arg)
 {
         struct slgt_info *info = tty->driver_data;
-        struct mgsl_icount cnow;        /* kernel counter temps */
-        struct serial_icounter_struct __user *p_cuser;  /* user space */
-        unsigned long flags;
         void __user *argp = (void __user *)arg;
         int ret;
 
@@ -1043,7 +1048,7 @@ static int ioctl(struct tty_struct *tty, struct file *file,
         DBGINFO(("%s ioctl() cmd=%08X\n", info->device_name, cmd));
 
         if ((cmd != TIOCGSERIAL) && (cmd != TIOCSSERIAL) &&
-            (cmd != TIOCMIWAIT) && (cmd != TIOCGICOUNT)) {
+            (cmd != TIOCMIWAIT)) {
                 if (tty->flags & (1 << TTY_IO_ERROR))
                     return -EIO;
         }
@@ -1053,30 +1058,20 @@ static int ioctl(struct tty_struct *tty, struct file *file,
                 return wait_mgsl_event(info, argp);
         case TIOCMIWAIT:
                 return modem_input_wait(info,(int)arg);
-        case TIOCGICOUNT:
-                spin_lock_irqsave(&info->lock,flags);
-                cnow = info->icount;
-                spin_unlock_irqrestore(&info->lock,flags);
-                p_cuser = argp;
-                if (put_user(cnow.cts, &p_cuser->cts) ||
-                    put_user(cnow.dsr, &p_cuser->dsr) ||
-                    put_user(cnow.rng, &p_cuser->rng) ||
-                    put_user(cnow.dcd, &p_cuser->dcd) ||
-                    put_user(cnow.rx, &p_cuser->rx) ||
-                    put_user(cnow.tx, &p_cuser->tx) ||
-                    put_user(cnow.frame, &p_cuser->frame) ||
-                    put_user(cnow.overrun, &p_cuser->overrun) ||
-                    put_user(cnow.parity, &p_cuser->parity) ||
-                    put_user(cnow.brk, &p_cuser->brk) ||
-                    put_user(cnow.buf_overrun, &p_cuser->buf_overrun))
-                        return -EFAULT;
-                return 0;
         case MGSL_IOCSGPIO:
                 return set_gpio(info, argp);
         case MGSL_IOCGGPIO:
                 return get_gpio(info, argp);
         case MGSL_IOCWAITGPIO:
                 return wait_gpio(info, argp);
+        case MGSL_IOCGXSYNC:
+                return get_xsync(info, argp);
+        case MGSL_IOCSXSYNC:
+                return set_xsync(info, (int)arg);
+        case MGSL_IOCGXCTRL:
+                return get_xctrl(info, argp);
+        case MGSL_IOCSXCTRL:
+                return set_xctrl(info, (int)arg);
         }
         mutex_lock(&info->port.mutex);
         switch (cmd) {
@@ -1117,6 +1112,33 @@ static int ioctl(struct tty_struct *tty, struct file *file,
         return ret;
 }
 
+static int get_icount(struct tty_struct *tty,
+                                struct serial_icounter_struct *icount)
+
+{
+        struct slgt_info *info = tty->driver_data;
+        struct mgsl_icount cnow;        /* kernel counter temps */
+        unsigned long flags;
+
+        spin_lock_irqsave(&info->lock,flags);
+        cnow = info->icount;
+        spin_unlock_irqrestore(&info->lock,flags);
+
+        icount->cts = cnow.cts;
+        icount->dsr = cnow.dsr;
+        icount->rng = cnow.rng;
+        icount->dcd = cnow.dcd;
+        icount->rx = cnow.rx;
+        icount->tx = cnow.tx;
+        icount->frame = cnow.frame;
+        icount->overrun = cnow.overrun;
+        icount->parity = cnow.parity;
+        icount->brk = cnow.brk;
+        icount->buf_overrun = cnow.buf_overrun;
+
+        return 0;
+}
+
 /*
  * support for 32 bit ioctl calls on 64 bit systems
  */
@@ -1126,6 +1148,7 @@ static long get_params32(struct slgt_info *info, struct MGSL_PARAMS32 __user *us
         struct MGSL_PARAMS32 tmp_params;
 
         DBGINFO(("%s get_params32\n", info->device_name));
+        memset(&tmp_params, 0, sizeof(tmp_params));
         tmp_params.mode            = (compat_ulong_t)info->params.mode;
         tmp_params.loopback        = info->params.loopback;
         tmp_params.flags           = info->params.flags;
@@ -1206,16 +1229,16 @@ static long slgt_compat_ioctl(struct tty_struct *tty, struct file *file,
         case MGSL_IOCSGPIO:
         case MGSL_IOCGGPIO:
         case MGSL_IOCWAITGPIO:
-        case TIOCGICOUNT:
-                rc = ioctl(tty, file, cmd, (unsigned long)(compat_ptr(arg)));
-                break;
-
+        case MGSL_IOCGXSYNC:
+        case MGSL_IOCGXCTRL:
         case MGSL_IOCSTXIDLE:
         case MGSL_IOCTXENABLE:
         case MGSL_IOCRXENABLE:
         case MGSL_IOCTXABORT:
         case TIOCMIWAIT:
         case MGSL_IOCSIF:
+        case MGSL_IOCSXSYNC:
+        case MGSL_IOCSXCTRL:
                 rc = ioctl(tty, file, cmd, arg);
                 break;
         }
@@ -1615,6 +1638,8 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         if (cmd != SIOCWANDEV)
                 return hdlc_ioctl(dev, ifr, cmd);
 
+        memset(&new_line, 0, sizeof(new_line));
+
         switch(ifr->ifr_settings.type) {
         case IF_GET_IFACE: /* return current sync_serial_settings */
 
@@ -1956,6 +1981,7 @@ static void bh_handler(struct work_struct *work)
                         case MGSL_MODE_RAW:
                         case MGSL_MODE_MONOSYNC:
                         case MGSL_MODE_BISYNC:
+                        case MGSL_MODE_XSYNC:
                                 while(rx_get_buf(info));
                                 break;
                         }
@@ -2355,26 +2381,27 @@ static irqreturn_t slgt_interrupt(int dummy, void *dev_id)
 
         DBGISR(("slgt_interrupt irq=%d entry\n", info->irq_level));
 
-        spin_lock(&info->lock);
-
         while((gsr = rd_reg32(info, GSR) & 0xffffff00)) {
                 DBGISR(("%s gsr=%08x\n", info->device_name, gsr));
                 info->irq_occurred = true;
                 for(i=0; i < info->port_count ; i++) {
                         if (info->port_array[i] == NULL)
                                 continue;
+                        spin_lock(&info->port_array[i]->lock);
                         if (gsr & (BIT8 << i))
                                 isr_serial(info->port_array[i]);
                         if (gsr & (BIT16 << (i*2)))
                                 isr_rdma(info->port_array[i]);
                         if (gsr & (BIT17 << (i*2)))
                                 isr_tdma(info->port_array[i]);
+                        spin_unlock(&info->port_array[i]->lock);
                 }
         }
 
         if (info->gpio_present) {
                 unsigned int state;
                 unsigned int changed;
+                spin_lock(&info->lock);
                 while ((changed = rd_reg32(info, IOSR)) != 0) {
                         DBGISR(("%s iosr=%08x\n", info->device_name, changed));
                         /* read latched state of GPIO signals */
@@ -2386,22 +2413,24 @@ static irqreturn_t slgt_interrupt(int dummy, void *dev_id)
                                         isr_gpio(info->port_array[i], changed, state);
                         }
                 }
+                spin_unlock(&info->lock);
         }
 
         for(i=0; i < info->port_count ; i++) {
                 struct slgt_info *port = info->port_array[i];
-
-                if (port && (port->port.count || port->netcount) &&
+                if (port == NULL)
+                        continue;
+                spin_lock(&port->lock);
+                if ((port->port.count || port->netcount) &&
                     port->pending_bh && !port->bh_running &&
                     !port->bh_requested) {
                         DBGISR(("%s bh queued\n", port->device_name));
                         schedule_work(&port->task);
                         port->bh_requested = true;
                 }
+                spin_unlock(&port->lock);
         }
 
-        spin_unlock(&info->lock);
-
         DBGISR(("slgt_interrupt irq=%d exit\n", info->irq_level));
         return IRQ_HANDLED;
 }
@@ -2881,6 +2910,69 @@ static int set_interface(struct slgt_info *info, int if_mode)
         return 0;
 }
 
+static int get_xsync(struct slgt_info *info, int __user *xsync)
+{
+        DBGINFO(("%s get_xsync=%x\n", info->device_name, info->xsync));
+        if (put_user(info->xsync, xsync))
+                return -EFAULT;
+        return 0;
+}
+
+/*
+ * set extended sync pattern (1 to 4 bytes) for extended sync mode
+ *
+ * sync pattern is contained in least significant bytes of value
+ * most significant byte of sync pattern is oldest (1st sent/detected)
+ */
+static int set_xsync(struct slgt_info *info, int xsync)
+{
+        unsigned long flags;
+
+        DBGINFO(("%s set_xsync=%x)\n", info->device_name, xsync));
+        spin_lock_irqsave(&info->lock, flags);
+        info->xsync = xsync;
+        wr_reg32(info, XSR, xsync);
+        spin_unlock_irqrestore(&info->lock, flags);
+        return 0;
+}
+
+static int get_xctrl(struct slgt_info *info, int __user *xctrl)
+{
+        DBGINFO(("%s get_xctrl=%x\n", info->device_name, info->xctrl));
+        if (put_user(info->xctrl, xctrl))
+                return -EFAULT;
+        return 0;
+}
+
+/*
+ * set extended control options
+ *
+ * xctrl[31:19] reserved, must be zero
+ * xctrl[18:17] extended sync pattern length in bytes
+ *              00 = 1 byte  in xsr[7:0]
+ *              01 = 2 bytes in xsr[15:0]
+ *              10 = 3 bytes in xsr[23:0]
+ *              11 = 4 bytes in xsr[31:0]
+ * xctrl[16]    1 = enable terminal count, 0=disabled
+ * xctrl[15:0]  receive terminal count for fixed length packets
+ *              value is count minus one (0 = 1 byte packet)
+ *              when terminal count is reached, receiver
+ *              automatically returns to hunt mode and receive
+ *              FIFO contents are flushed to DMA buffers with
+ *              end of frame (EOF) status
+ */
+static int set_xctrl(struct slgt_info *info, int xctrl)
+{
+        unsigned long flags;
+
+        DBGINFO(("%s set_xctrl=%x)\n", info->device_name, xctrl));
+        spin_lock_irqsave(&info->lock, flags);
+        info->xctrl = xctrl;
+        wr_reg32(info, XCR, xctrl);
+        spin_unlock_irqrestore(&info->lock, flags);
+        return 0;
+}
+
 /*
  * set general purpose IO pin state and direction
  *
@@ -2904,7 +2996,7 @@ static int set_gpio(struct slgt_info *info, struct gpio_desc __user *user_gpio)
                  info->device_name, gpio.state, gpio.smask,
                  gpio.dir, gpio.dmask));
 
-        spin_lock_irqsave(&info->lock,flags);
+        spin_lock_irqsave(&info->port_array[0]->lock, flags);
         if (gpio.dmask) {
                 data = rd_reg32(info, IODR);
                 data |= gpio.dmask & gpio.dir;
@@ -2917,7 +3009,7 @@ static int set_gpio(struct slgt_info *info, struct gpio_desc __user *user_gpio)
                 data &= ~(gpio.smask & ~gpio.state);
                 wr_reg32(info, IOVR, data);
         }
-        spin_unlock_irqrestore(&info->lock,flags);
+        spin_unlock_irqrestore(&info->port_array[0]->lock, flags);
 
         return 0;
 }
@@ -3018,7 +3110,7 @@ static int wait_gpio(struct slgt_info *info, struct gpio_desc __user *user_gpio)
                 return -EINVAL;
         init_cond_wait(&wait, gpio.smask);
 
-        spin_lock_irqsave(&info->lock, flags);
+        spin_lock_irqsave(&info->port_array[0]->lock, flags);
         /* enable interrupts for watched pins */
         wr_reg32(info, IOER, rd_reg32(info, IOER) | gpio.smask);
         /* get current pin states */
@@ -3030,20 +3122,20 @@ static int wait_gpio(struct slgt_info *info, struct gpio_desc __user *user_gpio)
         } else {
                 /* wait for target state */
                 add_cond_wait(&info->gpio_wait_q, &wait);
-                spin_unlock_irqrestore(&info->lock, flags);
+                spin_unlock_irqrestore(&info->port_array[0]->lock, flags);
                 schedule();
                 if (signal_pending(current))
                         rc = -ERESTARTSYS;
                 else
                         gpio.state = wait.data;
-                spin_lock_irqsave(&info->lock, flags);
+                spin_lock_irqsave(&info->port_array[0]->lock, flags);
                 remove_cond_wait(&info->gpio_wait_q, &wait);
         }
 
         /* disable all GPIO interrupts if no waiting processes */
         if (info->gpio_wait_q == NULL)
                 wr_reg32(info, IOER, 0);
-        spin_unlock_irqrestore(&info->lock,flags);
+        spin_unlock_irqrestore(&info->port_array[0]->lock, flags);
 
         if ((rc == 0) && copy_to_user(user_gpio, &gpio, sizeof(gpio)))
                 rc = -EFAULT;
@@ -3576,7 +3668,6 @@ static void device_init(int adapter_num, struct pci_dev *pdev)
 
                 /* copy resource information from first port to others */
                 for (i = 1; i < port_count; ++i) {
-                        port_array[i]->lock      = port_array[0]->lock;
                         port_array[i]->irq_level = port_array[0]->irq_level;
                         port_array[i]->reg_addr  = port_array[0]->reg_addr;
                         alloc_dma_bufs(port_array[i]);
@@ -3642,6 +3733,7 @@ static const struct tty_operations ops = {
         .hangup = hangup,
         .tiocmget = tiocmget,
         .tiocmset = tiocmset,
+        .get_icount = get_icount,
         .proc_fops = &synclink_gt_proc_fops,
 };
 
@@ -3760,7 +3852,9 @@ module_exit(slgt_exit);
 #define CALC_REGADDR() \
         unsigned long reg_addr = ((unsigned long)info->reg_addr) + addr; \
         if (addr >= 0x80) \
-                reg_addr += (info->port_num) * 32;
+                reg_addr += (info->port_num) * 32; \
+        else if (addr >= 0x40)  \
+                reg_addr += (info->port_num) * 16;
 
 static __u8 rd_reg8(struct slgt_info *info, unsigned int addr)
 {
@@ -4179,7 +4273,13 @@ static void sync_mode(struct slgt_info *info)
 
         /* TCR (tx control)
          *
-         * 15..13  mode, 000=HDLC 001=raw 010=async 011=monosync 100=bisync
+         * 15..13  mode
+         *         000=HDLC/SDLC
+         *         001=raw bit synchronous
+         *         010=asynchronous/isochronous
+         *         011=monosync byte synchronous
+         *         100=bisync byte synchronous
+         *         101=xsync byte synchronous
          * 12..10  encoding
          * 09      CRC enable
          * 08      CRC32
@@ -4194,6 +4294,9 @@ static void sync_mode(struct slgt_info *info)
         val = BIT2;
 
         switch(info->params.mode) {
+        case MGSL_MODE_XSYNC:
+                val |= BIT15 + BIT13;
+                break;
         case MGSL_MODE_MONOSYNC: val |= BIT14 + BIT13; break;
         case MGSL_MODE_BISYNC:   val |= BIT15; break;
         case MGSL_MODE_RAW:      val |= BIT13; break;
@@ -4248,7 +4351,13 @@ static void sync_mode(struct slgt_info *info)
 
         /* RCR (rx control)
          *
-         * 15..13  mode, 000=HDLC 001=raw 010=async 011=monosync 100=bisync
+         * 15..13  mode
+         *         000=HDLC/SDLC
+         *         001=raw bit synchronous
+         *         010=asynchronous/isochronous
+         *         011=monosync byte synchronous
+         *         100=bisync byte synchronous
+         *         101=xsync byte synchronous
          * 12..10  encoding
          * 09      CRC enable
          * 08      CRC32
@@ -4260,6 +4369,9 @@ static void sync_mode(struct slgt_info *info)
         val = 0;
 
         switch(info->params.mode) {
+        case MGSL_MODE_XSYNC:
+                val |= BIT15 + BIT13;
+                break;
         case MGSL_MODE_MONOSYNC: val |= BIT14 + BIT13; break;
         case MGSL_MODE_BISYNC:   val |= BIT15; break;
         case MGSL_MODE_RAW:      val |= BIT13; break;
@@ -4676,6 +4788,7 @@ static bool rx_get_buf(struct slgt_info *info)
         switch(info->params.mode) {
         case MGSL_MODE_MONOSYNC:
         case MGSL_MODE_BISYNC:
+        case MGSL_MODE_XSYNC:
                 /* ignore residue in byte synchronous modes */
                 if (desc_residue(info->rbufs[i]))
                         count--;
diff --git a/drivers/char/synclinkmp.c b/drivers/char/synclinkmp.c
index e56caf7d82aa..2f9eb4b0dec1 100644
--- a/drivers/char/synclinkmp.c
+++ b/drivers/char/synclinkmp.c
@@ -1258,10 +1258,6 @@ static int ioctl(struct tty_struct *tty, struct file *file,
                  unsigned int cmd, unsigned long arg)
 {
         SLMP_INFO *info = tty->driver_data;
-        int error;
-        struct mgsl_icount cnow;        /* kernel counter temps */
-        struct serial_icounter_struct __user *p_cuser;  /* user space */
-        unsigned long flags;
         void __user *argp = (void __user *)arg;
 
         if (debug_level >= DEBUG_LEVEL_INFO)
@@ -1272,7 +1268,7 @@ static int ioctl(struct tty_struct *tty, struct file *file,
                 return -ENODEV;
 
         if ((cmd != TIOCGSERIAL) && (cmd != TIOCSSERIAL) &&
-            (cmd != TIOCMIWAIT) && (cmd != TIOCGICOUNT)) {
+            (cmd != TIOCMIWAIT)) {
                 if (tty->flags & (1 << TTY_IO_ERROR))
                     return -EIO;
         }
@@ -1310,40 +1306,38 @@ static int ioctl(struct tty_struct *tty, struct file *file,
                  * NB: both 1->0 and 0->1 transitions are counted except for
                  *     RI where only 0->1 is counted.
                  */
-        case TIOCGICOUNT:
-                spin_lock_irqsave(&info->lock,flags);
-                cnow = info->icount;
-                spin_unlock_irqrestore(&info->lock,flags);
-                p_cuser = argp;
-                PUT_USER(error,cnow.cts, &p_cuser->cts);
-                if (error) return error;
-                PUT_USER(error,cnow.dsr, &p_cuser->dsr);
-                if (error) return error;
-                PUT_USER(error,cnow.rng, &p_cuser->rng);
-                if (error) return error;
-                PUT_USER(error,cnow.dcd, &p_cuser->dcd);
-                if (error) return error;
-                PUT_USER(error,cnow.rx, &p_cuser->rx);
-                if (error) return error;
-                PUT_USER(error,cnow.tx, &p_cuser->tx);
-                if (error) return error;
-                PUT_USER(error,cnow.frame, &p_cuser->frame);
-                if (error) return error;
-                PUT_USER(error,cnow.overrun, &p_cuser->overrun);
-                if (error) return error;
-                PUT_USER(error,cnow.parity, &p_cuser->parity);
-                if (error) return error;
-                PUT_USER(error,cnow.brk, &p_cuser->brk);
-                if (error) return error;
-                PUT_USER(error,cnow.buf_overrun, &p_cuser->buf_overrun);
-                if (error) return error;
-                return 0;
         default:
                 return -ENOIOCTLCMD;
         }
         return 0;
 }
 
+static int get_icount(struct tty_struct *tty,
+                                struct serial_icounter_struct *icount)
+{
+        SLMP_INFO *info = tty->driver_data;
+        struct mgsl_icount cnow;        /* kernel counter temps */
+        unsigned long flags;
+
+        spin_lock_irqsave(&info->lock,flags);
+        cnow = info->icount;
+        spin_unlock_irqrestore(&info->lock,flags);
+
+        icount->cts = cnow.cts;
+        icount->dsr = cnow.dsr;
+        icount->rng = cnow.rng;
+        icount->dcd = cnow.dcd;
+        icount->rx = cnow.rx;
+        icount->tx = cnow.tx;
+        icount->frame = cnow.frame;
+        icount->overrun = cnow.overrun;
+        icount->parity = cnow.parity;
+        icount->brk = cnow.brk;
+        icount->buf_overrun = cnow.buf_overrun;
+
+        return 0;
+}
+
 /*
  * /proc fs routines....
  */
@@ -3909,6 +3903,7 @@ static const struct tty_operations ops = {
         .hangup = hangup,
         .tiocmget = tiocmget,
         .tiocmset = tiocmset,
+        .get_icount = get_icount,
         .proc_fops = &synclinkmp_proc_fops,
 };
 
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index ef31bb81e843..eaa5d3efa79d 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -566,10 +566,16 @@ static const unsigned char sysrq_xlate[KEY_MAX + 1] =
 static bool sysrq_down;
 static int sysrq_alt_use;
 static int sysrq_alt;
+static DEFINE_SPINLOCK(sysrq_event_lock);
 
 static bool sysrq_filter(struct input_handle *handle, unsigned int type,
                          unsigned int code, int value)
 {
+        bool suppress;
+
+        /* We are called with interrupts disabled, just take the lock */
+        spin_lock(&sysrq_event_lock);
+
         if (type != EV_KEY)
                 goto out;
 
@@ -601,7 +607,10 @@ static bool sysrq_filter(struct input_handle *handle, unsigned int type,
         }
 
 out:
-        return sysrq_down;
+        suppress = sysrq_down;
+        spin_unlock(&sysrq_event_lock);
+
+        return suppress;
 }
 
 static int sysrq_connect(struct input_handler *handler,
@@ -652,8 +661,8 @@ static void sysrq_disconnect(struct input_handle *handle)
 }
 
 /*
- * We are matching on KEY_LEFTALT insteard of KEY_SYSRQ because not all
- * keyboards have SysRq ikey predefined and so user may add it to keymap
+ * We are matching on KEY_LEFTALT instead of KEY_SYSRQ because not all
+ * keyboards have SysRq key predefined and so user may add it to keymap
  * later, but we expect all such keyboards to have left alt.
  */
 static const struct input_device_id sysrq_ids[] = {
@@ -772,6 +781,7 @@ static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf,
 
 static const struct file_operations proc_sysrq_trigger_operations = {
         .write          = write_sysrq_trigger,
+        .llseek         = noop_llseek,
 };
 
 static void sysrq_init_procfs(void)
diff --git a/drivers/char/tb0219.c b/drivers/char/tb0219.c
index cad4eb65f13d..ad264185eb10 100644
--- a/drivers/char/tb0219.c
+++ b/drivers/char/tb0219.c
@@ -261,6 +261,7 @@ static const struct file_operations tb0219_fops = {
         .write          = tanbac_tb0219_write,
         .open           = tanbac_tb0219_open,
         .release        = tanbac_tb0219_release,
+        .llseek         = no_llseek,
 };
 
 static void tb0219_restart(char *command)
diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 80ea6bcfffdc..0c964cdcc223 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -37,7 +37,7 @@
 #include <linux/ioport.h>
 #include <linux/interrupt.h>
 #include <linux/spinlock.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/timer.h>
 #include <linux/sysfs.h>
 #include <linux/device.h>
@@ -206,7 +206,7 @@ static int tlclk_open(struct inode *inode, struct file *filp)
 {
         int result;
 
-        lock_kernel();
+        mutex_lock(&tlclk_mutex);
         if (test_and_set_bit(0, &useflags)) {
                 result = -EBUSY;
                 /* this legacy device is always one per system and it doesn't
@@ -229,7 +229,7 @@ static int tlclk_open(struct inode *inode, struct file *filp)
                 inb(TLCLK_REG6);        /* Clear interrupt events */
 
 out:
-        unlock_kernel();
+        mutex_unlock(&tlclk_mutex);
         return result;
 }
 
@@ -267,6 +267,7 @@ static const struct file_operations tlclk_fops = {
         .read = tlclk_read,
         .open = tlclk_open,
         .release = tlclk_release,
+        .llseek = noop_llseek,
 
 };
 
diff --git a/drivers/char/toshiba.c b/drivers/char/toshiba.c
index f8bc79f6de34..014c9d90d297 100644
--- a/drivers/char/toshiba.c
+++ b/drivers/char/toshiba.c
@@ -68,7 +68,7 @@
 #include <linux/stat.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/toshiba.h>
 
 #define TOSH_MINOR_DEV 181
@@ -78,6 +78,7 @@ MODULE_AUTHOR("Jonathan Buzzard <jonathan@buzzard.org.uk>");
 MODULE_DESCRIPTION("Toshiba laptop SMM driver");
 MODULE_SUPPORTED_DEVICE("toshiba");
 
+static DEFINE_MUTEX(tosh_mutex);
 static int tosh_fn;
 module_param_named(fn, tosh_fn, int, 0);
 MODULE_PARM_DESC(fn, "User specified Fn key detection port");
@@ -95,6 +96,7 @@ static long tosh_ioctl(struct file *, unsigned int,
 static const struct file_operations tosh_fops = {
         .owner          = THIS_MODULE,
         .unlocked_ioctl = tosh_ioctl,
+        .llseek         = noop_llseek,
 };
 
 static struct miscdevice tosh_device = {
@@ -274,16 +276,16 @@ static long tosh_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
                                 return -EINVAL;
 
                         /* do we need to emulate the fan ? */
-                        lock_kernel();
+                        mutex_lock(&tosh_mutex);
                         if (tosh_fan==1) {
                                 if (((ax==0xf300) || (ax==0xf400)) && (bx==0x0004)) {
                                         err = tosh_emulate_fan(&regs);
-                                        unlock_kernel();
+                                        mutex_unlock(&tosh_mutex);
                                         break;
                                 }
                         }
                         err = tosh_smm(&regs);
-                        unlock_kernel();
+                        mutex_unlock(&tosh_mutex);
                         break;
                 default:
                         return -EINVAL;
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index 4dc338f3d1aa..f6595aba4f0f 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -58,6 +58,6 @@ config TCG_INFINEON
           To compile this driver as a module, choose M here; the module
           will be called tpm_infineon.
           Further information on this driver and the supported hardware
-          can be found at http://www.prosec.rub.de/tpm
+          can be found at http://www.trust.rub.de/projects/linux-device-driver-infineon-tpm/ 
 
 endif # TCG_TPM
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index f58440791e65..76da32e11f18 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -7,7 +7,7 @@
  * Copyright (C) 2005, Marcel Selhorst <m.selhorst@sirrix.com>
  * Sirrix AG - security technologies, http://www.sirrix.com and
  * Applied Data Security Group, Ruhr-University Bochum, Germany
- * Project-Homepage: http://www.prosec.rub.de/tpm
+ * Project-Homepage: http://www.trust.rub.de/projects/linux-device-driver-infineon-tpm/ 
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 613c852ee0fe..c05c5af5aa04 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -96,6 +96,7 @@
 #include <linux/bitops.h>
 #include <linux/delay.h>
 #include <linux/seq_file.h>
+#include <linux/serial.h>
 
 #include <linux/uaccess.h>
 #include <asm/system.h>
@@ -183,6 +184,8 @@ struct tty_struct *alloc_tty_struct(void)
 
 void free_tty_struct(struct tty_struct *tty)
 {
+        if (tty->dev)
+                put_device(tty->dev);
         kfree(tty->write_buf);
         tty_buffer_free_all(tty);
         kfree(tty);
@@ -194,12 +197,13 @@ static inline struct tty_struct *file_tty(struct file *file)
 }
 
 /* Associate a new file with the tty structure */
-void tty_add_file(struct tty_struct *tty, struct file *file)
+int tty_add_file(struct tty_struct *tty, struct file *file)
 {
         struct tty_file_private *priv;
 
-        /* XXX: must implement proper error handling in callers */
-        priv = kmalloc(sizeof(*priv), GFP_KERNEL|__GFP_NOFAIL);
+        priv = kmalloc(sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
 
         priv->tty = tty;
         priv->file = file;
@@ -208,6 +212,8 @@ void tty_add_file(struct tty_struct *tty, struct file *file)
         spin_lock(&tty_files_lock);
         list_add(&priv->list, &tty->tty_files);
         spin_unlock(&tty_files_lock);
+
+        return 0;
 }
 
 /* Delete file from its tty */
@@ -1875,7 +1881,11 @@ got_driver:
                 return PTR_ERR(tty);
         }
 
-        tty_add_file(tty, filp);
+        retval = tty_add_file(tty, filp);
+        if (retval) {
+                tty_unlock();
+                return retval;
+        }
 
         check_tty_count(tty, "tty_open");
         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
@@ -2502,6 +2512,20 @@ static int tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int
         return tty->ops->tiocmset(tty, file, set, clear);
 }
 
+static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
+{
+        int retval = -EINVAL;
+        struct serial_icounter_struct icount;
+        memset(&icount, 0, sizeof(icount));
+        if (tty->ops->get_icount)
+                retval = tty->ops->get_icount(tty, &icount);
+        if (retval != 0)
+                return retval;
+        if (copy_to_user(arg, &icount, sizeof(icount)))
+                return -EFAULT;
+        return 0;
+}
+
 struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
 {
         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
@@ -2622,6 +2646,12 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         case TIOCMBIC:
         case TIOCMBIS:
                 return tty_tiocmset(tty, file, cmd, p);
+        case TIOCGICOUNT:
+                retval = tty_tiocgicount(tty, p);
+                /* For the moment allow fall through to the old method */
+                if (retval != -EINVAL)
+                        return retval;
+                break;
         case TCFLSH:
                 switch (arg) {
                 case TCIFLUSH:
@@ -2783,6 +2813,20 @@ void do_SAK(struct tty_struct *tty)
 
 EXPORT_SYMBOL(do_SAK);
 
+static int dev_match_devt(struct device *dev, void *data)
+{
+        dev_t *devt = data;
+        return dev->devt == *devt;
+}
+
+/* Must put_device() after it's unused! */
+static struct device *tty_get_device(struct tty_struct *tty)
+{
+        dev_t devt = tty_devnum(tty);
+        return class_find_device(tty_class, NULL, &devt, dev_match_devt);
+}
+
+
 /**
  *      initialize_tty_struct
  *      @tty: tty to initialize
@@ -2823,6 +2867,7 @@ void initialize_tty_struct(struct tty_struct *tty,
         tty->ops = driver->ops;
         tty->index = idx;
         tty_line_name(driver, idx, tty->name);
+        tty->dev = tty_get_device(tty);
 }
 
 /**
@@ -2980,6 +3025,7 @@ int tty_register_driver(struct tty_driver *driver)
         int i;
         dev_t dev;
         void **p = NULL;
+        struct device *d;
 
         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM) && driver->num) {
                 p = kzalloc(driver->num * 2 * sizeof(void *), GFP_KERNEL);
@@ -3027,12 +3073,31 @@ int tty_register_driver(struct tty_driver *driver)
         mutex_unlock(&tty_mutex);
 
         if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
-                for (i = 0; i < driver->num; i++)
-                    tty_register_device(driver, i, NULL);
+                for (i = 0; i < driver->num; i++) {
+                        d = tty_register_device(driver, i, NULL);
+                        if (IS_ERR(d)) {
+                                error = PTR_ERR(d);
+                                goto err;
+                        }
+                }
         }
         proc_tty_register_driver(driver);
         driver->flags |= TTY_DRIVER_INSTALLED;
         return 0;
+
+err:
+        for (i--; i >= 0; i--)
+                tty_unregister_device(driver, i);
+
+        mutex_lock(&tty_mutex);
+        list_del(&driver->tty_drivers);
+        mutex_unlock(&tty_mutex);
+
+        unregister_chrdev_region(dev, driver->num);
+        driver->ttys = NULL;
+        driver->termios = NULL;
+        kfree(p);
+        return error;
 }
 
 EXPORT_SYMBOL(tty_register_driver);
diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
new file mode 100644
index 000000000000..c40c1612c8a7
--- /dev/null
+++ b/drivers/char/ttyprintk.c
@@ -0,0 +1,225 @@
+/*
+ *  linux/drivers/char/ttyprintk.c
+ *
+ *  Copyright (C) 2010  Samo Pogacnik
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the smems of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ */
+
+/*
+ * This pseudo device allows user to make printk messages. It is possible
+ * to store "console" messages inline with kernel messages for better analyses
+ * of the boot process, for example.
+ */
+
+#include <linux/device.h>
+#include <linux/serial.h>
+#include <linux/tty.h>
+
+struct ttyprintk_port {
+        struct tty_port port;
+        struct mutex port_write_mutex;
+};
+
+static struct ttyprintk_port tpk_port;
+
+/*
+ * Our simple preformatting supports transparent output of (time-stamped)
+ * printk messages (also suitable for logging service):
+ * - any cr is replaced by nl
+ * - adds a ttyprintk source tag in front of each line
+ * - too long message is fragmeted, with '\'nl between fragments
+ * - TPK_STR_SIZE isn't really the write_room limiting factor, bcause
+ *   it is emptied on the fly during preformatting.
+ */
+#define TPK_STR_SIZE 508 /* should be bigger then max expected line length */
+#define TPK_MAX_ROOM 4096 /* we could assume 4K for instance */
+static const char *tpk_tag = "[U] "; /* U for User */
+static int tpk_curr;
+
+static int tpk_printk(const unsigned char *buf, int count)
+{
+        static char tmp[TPK_STR_SIZE + 4];
+        int i = tpk_curr;
+
+        if (buf == NULL) {
+                /* flush tmp[] */
+                if (tpk_curr > 0) {
+                        /* non nl or cr terminated message - add nl */
+                        tmp[tpk_curr + 0] = '\n';
+                        tmp[tpk_curr + 1] = '\0';
+                        printk(KERN_INFO "%s%s", tpk_tag, tmp);
+                        tpk_curr = 0;
+                }
+                return i;
+        }
+
+        for (i = 0; i < count; i++) {
+                tmp[tpk_curr] = buf[i];
+                if (tpk_curr < TPK_STR_SIZE) {
+                        switch (buf[i]) {
+                        case '\r':
+                                /* replace cr with nl */
+                                tmp[tpk_curr + 0] = '\n';
+                                tmp[tpk_curr + 1] = '\0';
+                                printk(KERN_INFO "%s%s", tpk_tag, tmp);
+                                tpk_curr = 0;
+                                if (buf[i + 1] == '\n')
+                                        i++;
+                                break;
+                        case '\n':
+                                tmp[tpk_curr + 1] = '\0';
+                                printk(KERN_INFO "%s%s", tpk_tag, tmp);
+                                tpk_curr = 0;
+                                break;
+                        default:
+                                tpk_curr++;
+                        }
+                } else {
+                        /* end of tmp buffer reached: cut the message in two */
+                        tmp[tpk_curr + 1] = '\\';
+                        tmp[tpk_curr + 2] = '\n';
+                        tmp[tpk_curr + 3] = '\0';
+                        printk(KERN_INFO "%s%s", tpk_tag, tmp);
+                        tpk_curr = 0;
+                }
+        }
+
+        return count;
+}
+
+/*
+ * TTY operations open function.
+ */
+static int tpk_open(struct tty_struct *tty, struct file *filp)
+{
+        tty->driver_data = &tpk_port;
+
+        return tty_port_open(&tpk_port.port, tty, filp);
+}
+
+/*
+ * TTY operations close function.
+ */
+static void tpk_close(struct tty_struct *tty, struct file *filp)
+{
+        struct ttyprintk_port *tpkp = tty->driver_data;
+
+        mutex_lock(&tpkp->port_write_mutex);
+        /* flush tpk_printk buffer */
+        tpk_printk(NULL, 0);
+        mutex_unlock(&tpkp->port_write_mutex);
+
+        tty_port_close(&tpkp->port, tty, filp);
+}
+
+/*
+ * TTY operations write function.
+ */
+static int tpk_write(struct tty_struct *tty,
+                const unsigned char *buf, int count)
+{
+        struct ttyprintk_port *tpkp = tty->driver_data;
+        int ret;
+
+
+        /* exclusive use of tpk_printk within this tty */
+        mutex_lock(&tpkp->port_write_mutex);
+        ret = tpk_printk(buf, count);
+        mutex_unlock(&tpkp->port_write_mutex);
+
+        return ret;
+}
+
+/*
+ * TTY operations write_room function.
+ */
+static int tpk_write_room(struct tty_struct *tty)
+{
+        return TPK_MAX_ROOM;
+}
+
+/*
+ * TTY operations ioctl function.
+ */
+static int tpk_ioctl(struct tty_struct *tty, struct file *file,
+                        unsigned int cmd, unsigned long arg)
+{
+        struct ttyprintk_port *tpkp = tty->driver_data;
+
+        if (!tpkp)
+                return -EINVAL;
+
+        switch (cmd) {
+        /* Stop TIOCCONS */
+        case TIOCCONS:
+                return -EOPNOTSUPP;
+        default:
+                return -ENOIOCTLCMD;
+        }
+        return 0;
+}
+
+static const struct tty_operations ttyprintk_ops = {
+        .open = tpk_open,
+        .close = tpk_close,
+        .write = tpk_write,
+        .write_room = tpk_write_room,
+        .ioctl = tpk_ioctl,
+};
+
+struct tty_port_operations null_ops = { };
+
+static struct tty_driver *ttyprintk_driver;
+
+static int __init ttyprintk_init(void)
+{
+        int ret = -ENOMEM;
+        void *rp;
+
+        ttyprintk_driver = alloc_tty_driver(1);
+        if (!ttyprintk_driver)
+                return ret;
+
+        ttyprintk_driver->owner = THIS_MODULE;
+        ttyprintk_driver->driver_name = "ttyprintk";
+        ttyprintk_driver->name = "ttyprintk";
+        ttyprintk_driver->major = TTYAUX_MAJOR;
+        ttyprintk_driver->minor_start = 3;
+        ttyprintk_driver->num = 1;
+        ttyprintk_driver->type = TTY_DRIVER_TYPE_CONSOLE;
+        ttyprintk_driver->init_termios = tty_std_termios;
+        ttyprintk_driver->init_termios.c_oflag = OPOST | OCRNL | ONOCR | ONLRET;
+        ttyprintk_driver->flags = TTY_DRIVER_RESET_TERMIOS |
+                TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
+        tty_set_operations(ttyprintk_driver, &ttyprintk_ops);
+
+        ret = tty_register_driver(ttyprintk_driver);
+        if (ret < 0) {
+                printk(KERN_ERR "Couldn't register ttyprintk driver\n");
+                goto error;
+        }
+
+        /* create our unnumbered device */
+        rp = device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 3), NULL,
+                                ttyprintk_driver->name);
+        if (IS_ERR(rp)) {
+                printk(KERN_ERR "Couldn't create ttyprintk device\n");
+                ret = PTR_ERR(rp);
+                goto error;
+        }
+
+        tty_port_init(&tpk_port.port);
+        tpk_port.port.ops = &null_ops;
+        mutex_init(&tpk_port.port_write_mutex);
+
+        return 0;
+
+error:
+        put_tty_driver(ttyprintk_driver);
+        ttyprintk_driver = NULL;
+        return ret;
+}
+module_init(ttyprintk_init);
diff --git a/drivers/char/uv_mmtimer.c b/drivers/char/uv_mmtimer.c
index c7072ba14f48..493b47a0d511 100644
--- a/drivers/char/uv_mmtimer.c
+++ b/drivers/char/uv_mmtimer.c
@@ -52,6 +52,7 @@ static const struct file_operations uv_mmtimer_fops = {
         .owner = THIS_MODULE,
         .mmap = uv_mmtimer_mmap,
         .unlocked_ioctl = uv_mmtimer_ioctl,
+        .llseek = noop_llseek,
 };
 
 /**
diff --git a/drivers/char/vc_screen.c b/drivers/char/vc_screen.c
index bcce46c96b88..273ab44cc91d 100644
--- a/drivers/char/vc_screen.c
+++ b/drivers/char/vc_screen.c
@@ -35,6 +35,12 @@
 #include <linux/console.h>
 #include <linux/device.h>
 #include <linux/smp_lock.h>
+#include <linux/sched.h>
+#include <linux/fs.h>
+#include <linux/poll.h>
+#include <linux/signal.h>
+#include <linux/slab.h>
+#include <linux/notifier.h>
 
 #include <asm/uaccess.h>
 #include <asm/byteorder.h>
@@ -45,6 +51,86 @@
 #undef addr
 #define HEADER_SIZE     4
 
+struct vcs_poll_data {
+        struct notifier_block notifier;
+        unsigned int cons_num;
+        bool seen_last_update;
+        wait_queue_head_t waitq;
+        struct fasync_struct *fasync;
+};
+
+static int
+vcs_notifier(struct notifier_block *nb, unsigned long code, void *_param)
+{
+        struct vt_notifier_param *param = _param;
+        struct vc_data *vc = param->vc;
+        struct vcs_poll_data *poll =
+                container_of(nb, struct vcs_poll_data, notifier);
+        int currcons = poll->cons_num;
+
+        if (code != VT_UPDATE)
+                return NOTIFY_DONE;
+
+        if (currcons == 0)
+                currcons = fg_console;
+        else
+                currcons--;
+        if (currcons != vc->vc_num)
+                return NOTIFY_DONE;
+
+        poll->seen_last_update = false;
+        wake_up_interruptible(&poll->waitq);
+        kill_fasync(&poll->fasync, SIGIO, POLL_IN);
+        return NOTIFY_OK;
+}
+
+static void
+vcs_poll_data_free(struct vcs_poll_data *poll)
+{
+        unregister_vt_notifier(&poll->notifier);
+        kfree(poll);
+}
+
+static struct vcs_poll_data *
+vcs_poll_data_get(struct file *file)
+{
+        struct vcs_poll_data *poll = file->private_data;
+
+        if (poll)
+                return poll;
+
+        poll = kzalloc(sizeof(*poll), GFP_KERNEL);
+        if (!poll)
+                return NULL;
+        poll->cons_num = iminor(file->f_path.dentry->d_inode) & 127;
+        init_waitqueue_head(&poll->waitq);
+        poll->notifier.notifier_call = vcs_notifier;
+        if (register_vt_notifier(&poll->notifier) != 0) {
+                kfree(poll);
+                return NULL;
+        }
+
+        /*
+         * This code may be called either through ->poll() or ->fasync().
+         * If we have two threads using the same file descriptor, they could
+         * both enter this function, both notice that the structure hasn't
+         * been allocated yet and go ahead allocating it in parallel, but
+         * only one of them must survive and be shared otherwise we'd leak
+         * memory with a dangling notifier callback.
+         */
+        spin_lock(&file->f_lock);
+        if (!file->private_data) {
+                file->private_data = poll;
+        } else {
+                /* someone else raced ahead of us */
+                vcs_poll_data_free(poll);
+                poll = file->private_data;
+        }
+        spin_unlock(&file->f_lock);
+
+        return poll;
+}
+
 static int
 vcs_size(struct inode *inode)
 {
@@ -102,6 +188,7 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
         struct inode *inode = file->f_path.dentry->d_inode;
         unsigned int currcons = iminor(inode);
         struct vc_data *vc;
+        struct vcs_poll_data *poll;
         long pos;
         long viewed, attr, read;
         int col, maxcol;
@@ -134,6 +221,9 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
         ret = -EINVAL;
         if (pos < 0)
                 goto unlock_out;
+        poll = file->private_data;
+        if (count && poll)
+                poll->seen_last_update = true;
         read = 0;
         ret = 0;
         while (count) {
@@ -448,6 +538,8 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
         }
         *ppos += written;
         ret = written;
+        if (written)
+                vcs_scr_updated(vc);
 
 unlock_out:
         release_console_sem();
@@ -457,6 +549,37 @@ unlock_out:
         return ret;
 }
 
+static unsigned int
+vcs_poll(struct file *file, poll_table *wait)
+{
+        struct vcs_poll_data *poll = vcs_poll_data_get(file);
+        int ret = 0;
+
+        if (poll) {
+                poll_wait(file, &poll->waitq, wait);
+                if (!poll->seen_last_update)
+                        ret = POLLIN | POLLRDNORM;
+        }
+        return ret;
+}
+
+static int
+vcs_fasync(int fd, struct file *file, int on)
+{
+        struct vcs_poll_data *poll = file->private_data;
+
+        if (!poll) {
+                /* don't allocate anything if all we want is disable fasync */
+                if (!on)
+                        return 0;
+                poll = vcs_poll_data_get(file);
+                if (!poll)
+                        return -ENOMEM;
+        }
+
+        return fasync_helper(fd, file, on, &poll->fasync);
+}
+
 static int
 vcs_open(struct inode *inode, struct file *filp)
 {
@@ -470,11 +593,23 @@ vcs_open(struct inode *inode, struct file *filp)
         return ret;
 }
 
+static int vcs_release(struct inode *inode, struct file *file)
+{
+        struct vcs_poll_data *poll = file->private_data;
+
+        if (poll)
+                vcs_poll_data_free(poll);
+        return 0;
+}
+
 static const struct file_operations vcs_fops = {
         .llseek         = vcs_lseek,
         .read           = vcs_read,
         .write          = vcs_write,
+        .poll           = vcs_poll,
+        .fasync         = vcs_fasync,
         .open           = vcs_open,
+        .release        = vcs_release,
 };
 
 static struct class *vc_class;
diff --git a/drivers/char/viotape.c b/drivers/char/viotape.c
index 42f7fa442ff8..ad6e64a2912d 100644
--- a/drivers/char/viotape.c
+++ b/drivers/char/viotape.c
@@ -46,7 +46,7 @@
 #include <linux/completion.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/slab.h>
 
 #include <asm/uaccess.h>
@@ -64,6 +64,7 @@
 #define VIOTAPE_KERN_WARN       KERN_WARNING "viotape: "
 #define VIOTAPE_KERN_INFO       KERN_INFO "viotape: "
 
+static DEFINE_MUTEX(proc_viotape_mutex);
 static int viotape_numdev;
 
 /*
@@ -684,9 +685,9 @@ static long viotap_unlocked_ioctl(struct file *file,
 {
         long rc;
 
-        lock_kernel();
+        mutex_lock(&proc_viotape_mutex);
         rc = viotap_ioctl(file->f_path.dentry->d_inode, file, cmd, arg);
-        unlock_kernel();
+        mutex_unlock(&proc_viotape_mutex);
         return rc;
 }
 
@@ -700,7 +701,7 @@ static int viotap_open(struct inode *inode, struct file *file)
         if (op == NULL)
                 return -ENOMEM;
 
-        lock_kernel();
+        mutex_lock(&proc_viotape_mutex);
         get_dev_info(file->f_path.dentry->d_inode, &devi);
 
         /* Note: We currently only support one mode! */
@@ -731,7 +732,7 @@ static int viotap_open(struct inode *inode, struct file *file)
 
 free_op:
         free_op_struct(op);
-        unlock_kernel();
+        mutex_unlock(&proc_viotape_mutex);
         return ret;
 }
 
@@ -804,6 +805,7 @@ const struct file_operations viotap_fops = {
         .unlocked_ioctl =       viotap_unlocked_ioctl,
         .open =                 viotap_open,
         .release =              viotap_release,
+        .llseek =               noop_llseek,
 };
 
 /* Handle interrupt events for tape */
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 281aada7b4a1..a8ec48ed14d9 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -4182,6 +4182,11 @@ void vcs_scr_writew(struct vc_data *vc, u16 val, u16 *org)
         }
 }
 
+void vcs_scr_updated(struct vc_data *vc)
+{
+        notify_update(vc);
+}
+
 /*
  *      Visible symbols for modules
  */
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 38df8c19e74c..6b68a0fb4611 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -503,6 +503,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
         struct kbd_struct * kbd;
         unsigned int console;
         unsigned char ucval;
+        unsigned int uival;
         void __user *up = (void __user *)arg;
         int i, perm;
         int ret = 0;
@@ -657,7 +658,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 break;
 
         case KDGETMODE:
-                ucval = vc->vc_mode;
+                uival = vc->vc_mode;
                 goto setint;
 
         case KDMAPDISP:
@@ -695,7 +696,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 break;
 
         case KDGKBMODE:
-                ucval = ((kbd->kbdmode == VC_RAW) ? K_RAW :
+                uival = ((kbd->kbdmode == VC_RAW) ? K_RAW :
                                  (kbd->kbdmode == VC_MEDIUMRAW) ? K_MEDIUMRAW :
                                  (kbd->kbdmode == VC_UNICODE) ? K_UNICODE :
                                  K_XLATE);
@@ -717,9 +718,9 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 break;
 
         case KDGKBMETA:
-                ucval = (vc_kbd_mode(kbd, VC_META) ? K_ESCPREFIX : K_METABIT);
+                uival = (vc_kbd_mode(kbd, VC_META) ? K_ESCPREFIX : K_METABIT);
         setint:
-                ret = put_user(ucval, (int __user *)arg);
+                ret = put_user(uival, (int __user *)arg);
                 break;
 
         case KDGETKEYCODE:
@@ -949,7 +950,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 for (i = 0; i < MAX_NR_CONSOLES; ++i)
                         if (! VT_IS_IN_USE(i))
                                 break;
-                ucval = i < MAX_NR_CONSOLES ? (i+1) : -1;
+                uival = i < MAX_NR_CONSOLES ? (i+1) : -1;
                 goto setint;             
 
         /*
diff --git a/drivers/char/xilinx_hwicap/xilinx_hwicap.c b/drivers/char/xilinx_hwicap/xilinx_hwicap.c
index b663d573aad9..9f2272e6de1c 100644
--- a/drivers/char/xilinx_hwicap/xilinx_hwicap.c
+++ b/drivers/char/xilinx_hwicap/xilinx_hwicap.c
@@ -81,7 +81,6 @@
 #include <linux/poll.h>
 #include <linux/proc_fs.h>
 #include <linux/mutex.h>
-#include <linux/smp_lock.h>
 #include <linux/sysctl.h>
 #include <linux/fs.h>
 #include <linux/cdev.h>
@@ -112,6 +111,7 @@
 #define HWICAP_DEVICES 1
 
 /* An array, which is set to true when the device is registered. */
+static DEFINE_MUTEX(hwicap_mutex);
 static bool probed_devices[HWICAP_DEVICES];
 static struct mutex icap_sem;
 
@@ -502,7 +502,7 @@ static int hwicap_open(struct inode *inode, struct file *file)
         struct hwicap_drvdata *drvdata;
         int status;
 
-        lock_kernel();
+        mutex_lock(&hwicap_mutex);
         drvdata = container_of(inode->i_cdev, struct hwicap_drvdata, cdev);
 
         status = mutex_lock_interruptible(&drvdata->sem);
@@ -528,7 +528,7 @@ static int hwicap_open(struct inode *inode, struct file *file)
  error:
         mutex_unlock(&drvdata->sem);
  out:
-        unlock_kernel();
+        mutex_unlock(&hwicap_mutex);
         return status;
 }
 
@@ -567,6 +567,7 @@ static const struct file_operations hwicap_fops = {
         .read = hwicap_read,
         .open = hwicap_open,
         .release = hwicap_release,
+        .llseek = noop_llseek,
 };
 
 static int __devinit hwicap_setup(struct device *dev, int id,