30 files changed, 1154 insertions, 341 deletions

diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 9e43e39dc35c..d08bb4ee1307 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -610,6 +610,13 @@ config HVC_RTAS
         help
           IBM Console device driver which makes use of RTAS
 
+config HVC_BEAT
+        bool "Toshiba's Beat Hypervisor Console support"
+        depends on PPC_CELLEB
+        select HVC_DRIVER
+        help
+          Toshiba's Cell Reference Set Beat Console device driver
+
 config HVCS
         tristate "IBM Hypervisor Virtual Console Server support"
         depends on PPC_PSERIES
diff --git a/drivers/char/Makefile b/drivers/char/Makefile
index fc110637ced6..ae8567cc529c 100644
--- a/drivers/char/Makefile
+++ b/drivers/char/Makefile
@@ -45,6 +45,7 @@ obj-$(CONFIG_RIO)		+= rio/ generic_serial.o
 obj-$(CONFIG_HVC_CONSOLE)       += hvc_vio.o hvsi.o
 obj-$(CONFIG_HVC_ISERIES)       += hvc_iseries.o
 obj-$(CONFIG_HVC_RTAS)          += hvc_rtas.o
+obj-$(CONFIG_HVC_BEAT)          += hvc_beat.o
 obj-$(CONFIG_HVC_DRIVER)        += hvc_console.o
 obj-$(CONFIG_RAW_DRIVER)        += raw.o
 obj-$(CONFIG_SGI_SNSC)          += snsc.o snsc_event.o
@@ -59,6 +60,8 @@ obj-$(CONFIG_BRIQ_PANEL)	+= briq_panel.o
 obj-$(CONFIG_PRINTER)           += lp.o
 obj-$(CONFIG_TIPAR)             += tipar.o
 
+obj-$(CONFIG_APM_EMULATION)     += apm-emulation.o
+
 obj-$(CONFIG_DTLK)              += dtlk.o
 obj-$(CONFIG_R3964)             += n_r3964.o
 obj-$(CONFIG_APPLICOM)          += applicom.o
diff --git a/drivers/char/apm-emulation.c b/drivers/char/apm-emulation.c
new file mode 100644
index 000000000000..179c7a3b6e75
--- /dev/null
+++ b/drivers/char/apm-emulation.c
@@ -0,0 +1,672 @@
+/*
+ * bios-less APM driver for ARM Linux
+ *  Jamey Hicks <jamey@crl.dec.com>
+ *  adapted from the APM BIOS driver for Linux by Stephen Rothwell (sfr@linuxcare.com)
+ *
+ * APM 1.2 Reference:
+ *   Intel Corporation, Microsoft Corporation. Advanced Power Management
+ *   (APM) BIOS Interface Specification, Revision 1.2, February 1996.
+ *
+ * [This document is available from Microsoft at:
+ *    http://www.microsoft.com/hwdev/busbios/amp_12.htm]
+ */
+#include <linux/module.h>
+#include <linux/poll.h>
+#include <linux/slab.h>
+#include <linux/proc_fs.h>
+#include <linux/miscdevice.h>
+#include <linux/apm_bios.h>
+#include <linux/capability.h>
+#include <linux/sched.h>
+#include <linux/pm.h>
+#include <linux/apm-emulation.h>
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/init.h>
+#include <linux/completion.h>
+#include <linux/kthread.h>
+#include <linux/delay.h>
+
+#include <asm/system.h>
+
+/*
+ * The apm_bios device is one of the misc char devices.
+ * This is its minor number.
+ */
+#define APM_MINOR_DEV   134
+
+/*
+ * See Documentation/Config.help for the configuration options.
+ *
+ * Various options can be changed at boot time as follows:
+ * (We allow underscores for compatibility with the modules code)
+ *      apm=on/off                      enable/disable APM
+ */
+
+/*
+ * Maximum number of events stored
+ */
+#define APM_MAX_EVENTS          16
+
+struct apm_queue {
+        unsigned int            event_head;
+        unsigned int            event_tail;
+        apm_event_t             events[APM_MAX_EVENTS];
+};
+
+/*
+ * The per-file APM data
+ */
+struct apm_user {
+        struct list_head        list;
+
+        unsigned int            suser: 1;
+        unsigned int            writer: 1;
+        unsigned int            reader: 1;
+
+        int                     suspend_result;
+        unsigned int            suspend_state;
+#define SUSPEND_NONE    0               /* no suspend pending */
+#define SUSPEND_PENDING 1               /* suspend pending read */
+#define SUSPEND_READ    2               /* suspend read, pending ack */
+#define SUSPEND_ACKED   3               /* suspend acked */
+#define SUSPEND_WAIT    4               /* waiting for suspend */
+#define SUSPEND_DONE    5               /* suspend completed */
+
+        struct apm_queue        queue;
+};
+
+/*
+ * Local variables
+ */
+static int suspends_pending;
+static int apm_disabled;
+static struct task_struct *kapmd_tsk;
+
+static DECLARE_WAIT_QUEUE_HEAD(apm_waitqueue);
+static DECLARE_WAIT_QUEUE_HEAD(apm_suspend_waitqueue);
+
+/*
+ * This is a list of everyone who has opened /dev/apm_bios
+ */
+static DECLARE_RWSEM(user_list_lock);
+static LIST_HEAD(apm_user_list);
+
+/*
+ * kapmd info.  kapmd provides us a process context to handle
+ * "APM" events within - specifically necessary if we're going
+ * to be suspending the system.
+ */
+static DECLARE_WAIT_QUEUE_HEAD(kapmd_wait);
+static DEFINE_SPINLOCK(kapmd_queue_lock);
+static struct apm_queue kapmd_queue;
+
+static DEFINE_MUTEX(state_lock);
+
+static const char driver_version[] = "1.13";    /* no spaces */
+
+
+
+/*
+ * Compatibility cruft until the IPAQ people move over to the new
+ * interface.
+ */
+static void __apm_get_power_status(struct apm_power_info *info)
+{
+}
+
+/*
+ * This allows machines to provide their own "apm get power status" function.
+ */
+void (*apm_get_power_status)(struct apm_power_info *) = __apm_get_power_status;
+EXPORT_SYMBOL(apm_get_power_status);
+
+
+/*
+ * APM event queue management.
+ */
+static inline int queue_empty(struct apm_queue *q)
+{
+        return q->event_head == q->event_tail;
+}
+
+static inline apm_event_t queue_get_event(struct apm_queue *q)
+{
+        q->event_tail = (q->event_tail + 1) % APM_MAX_EVENTS;
+        return q->events[q->event_tail];
+}
+
+static void queue_add_event(struct apm_queue *q, apm_event_t event)
+{
+        q->event_head = (q->event_head + 1) % APM_MAX_EVENTS;
+        if (q->event_head == q->event_tail) {
+                static int notified;
+
+                if (notified++ == 0)
+                    printk(KERN_ERR "apm: an event queue overflowed\n");
+                q->event_tail = (q->event_tail + 1) % APM_MAX_EVENTS;
+        }
+        q->events[q->event_head] = event;
+}
+
+static void queue_event(apm_event_t event)
+{
+        struct apm_user *as;
+
+        down_read(&user_list_lock);
+        list_for_each_entry(as, &apm_user_list, list) {
+                if (as->reader)
+                        queue_add_event(&as->queue, event);
+        }
+        up_read(&user_list_lock);
+        wake_up_interruptible(&apm_waitqueue);
+}
+
+/*
+ * queue_suspend_event - queue an APM suspend event.
+ *
+ * Check that we're in a state where we can suspend.  If not,
+ * return -EBUSY.  Otherwise, queue an event to all "writer"
+ * users.  If there are no "writer" users, return '1' to
+ * indicate that we can immediately suspend.
+ */
+static int queue_suspend_event(apm_event_t event, struct apm_user *sender)
+{
+        struct apm_user *as;
+        int ret = 1;
+
+        mutex_lock(&state_lock);
+        down_read(&user_list_lock);
+
+        /*
+         * If a thread is still processing, we can't suspend, so reject
+         * the request.
+         */
+        list_for_each_entry(as, &apm_user_list, list) {
+                if (as != sender && as->reader && as->writer && as->suser &&
+                    as->suspend_state != SUSPEND_NONE) {
+                        ret = -EBUSY;
+                        goto out;
+                }
+        }
+
+        list_for_each_entry(as, &apm_user_list, list) {
+                if (as != sender && as->reader && as->writer && as->suser) {
+                        as->suspend_state = SUSPEND_PENDING;
+                        suspends_pending++;
+                        queue_add_event(&as->queue, event);
+                        ret = 0;
+                }
+        }
+ out:
+        up_read(&user_list_lock);
+        mutex_unlock(&state_lock);
+        wake_up_interruptible(&apm_waitqueue);
+        return ret;
+}
+
+static void apm_suspend(void)
+{
+        struct apm_user *as;
+        int err = pm_suspend(PM_SUSPEND_MEM);
+
+        /*
+         * Anyone on the APM queues will think we're still suspended.
+         * Send a message so everyone knows we're now awake again.
+         */
+        queue_event(APM_NORMAL_RESUME);
+
+        /*
+         * Finally, wake up anyone who is sleeping on the suspend.
+         */
+        mutex_lock(&state_lock);
+        down_read(&user_list_lock);
+        list_for_each_entry(as, &apm_user_list, list) {
+                if (as->suspend_state == SUSPEND_WAIT ||
+                    as->suspend_state == SUSPEND_ACKED) {
+                        as->suspend_result = err;
+                        as->suspend_state = SUSPEND_DONE;
+                }
+        }
+        up_read(&user_list_lock);
+        mutex_unlock(&state_lock);
+
+        wake_up(&apm_suspend_waitqueue);
+}
+
+static ssize_t apm_read(struct file *fp, char __user *buf, size_t count, loff_t *ppos)
+{
+        struct apm_user *as = fp->private_data;
+        apm_event_t event;
+        int i = count, ret = 0;
+
+        if (count < sizeof(apm_event_t))
+                return -EINVAL;
+
+        if (queue_empty(&as->queue) && fp->f_flags & O_NONBLOCK)
+                return -EAGAIN;
+
+        wait_event_interruptible(apm_waitqueue, !queue_empty(&as->queue));
+
+        while ((i >= sizeof(event)) && !queue_empty(&as->queue)) {
+                event = queue_get_event(&as->queue);
+
+                ret = -EFAULT;
+                if (copy_to_user(buf, &event, sizeof(event)))
+                        break;
+
+                mutex_lock(&state_lock);
+                if (as->suspend_state == SUSPEND_PENDING &&
+                    (event == APM_SYS_SUSPEND || event == APM_USER_SUSPEND))
+                        as->suspend_state = SUSPEND_READ;
+                mutex_unlock(&state_lock);
+
+                buf += sizeof(event);
+                i -= sizeof(event);
+        }
+
+        if (i < count)
+                ret = count - i;
+
+        return ret;
+}
+
+static unsigned int apm_poll(struct file *fp, poll_table * wait)
+{
+        struct apm_user *as = fp->private_data;
+
+        poll_wait(fp, &apm_waitqueue, wait);
+        return queue_empty(&as->queue) ? 0 : POLLIN | POLLRDNORM;
+}
+
+/*
+ * apm_ioctl - handle APM ioctl
+ *
+ * APM_IOC_SUSPEND
+ *   This IOCTL is overloaded, and performs two functions.  It is used to:
+ *     - initiate a suspend
+ *     - acknowledge a suspend read from /dev/apm_bios.
+ *   Only when everyone who has opened /dev/apm_bios with write permission
+ *   has acknowledge does the actual suspend happen.
+ */
+static int
+apm_ioctl(struct inode * inode, struct file *filp, u_int cmd, u_long arg)
+{
+        struct apm_user *as = filp->private_data;
+        unsigned long flags;
+        int err = -EINVAL;
+
+        if (!as->suser || !as->writer)
+                return -EPERM;
+
+        switch (cmd) {
+        case APM_IOC_SUSPEND:
+                mutex_lock(&state_lock);
+
+                as->suspend_result = -EINTR;
+
+                if (as->suspend_state == SUSPEND_READ) {
+                        int pending;
+
+                        /*
+                         * If we read a suspend command from /dev/apm_bios,
+                         * then the corresponding APM_IOC_SUSPEND ioctl is
+                         * interpreted as an acknowledge.
+                         */
+                        as->suspend_state = SUSPEND_ACKED;
+                        suspends_pending--;
+                        pending = suspends_pending == 0;
+                        mutex_unlock(&state_lock);
+
+                        /*
+                         * If there are no further acknowledges required,
+                         * suspend the system.
+                         */
+                        if (pending)
+                                apm_suspend();
+
+                        /*
+                         * Wait for the suspend/resume to complete.  If there
+                         * are pending acknowledges, we wait here for them.
+                         *
+                         * Note: we need to ensure that the PM subsystem does
+                         * not kick us out of the wait when it suspends the
+                         * threads.
+                         */
+                        flags = current->flags;
+                        current->flags |= PF_NOFREEZE;
+
+                        wait_event(apm_suspend_waitqueue,
+                                   as->suspend_state == SUSPEND_DONE);
+                } else {
+                        as->suspend_state = SUSPEND_WAIT;
+                        mutex_unlock(&state_lock);
+
+                        /*
+                         * Otherwise it is a request to suspend the system.
+                         * Queue an event for all readers, and expect an
+                         * acknowledge from all writers who haven't already
+                         * acknowledged.
+                         */
+                        err = queue_suspend_event(APM_USER_SUSPEND, as);
+                        if (err < 0) {
+                                /*
+                                 * Avoid taking the lock here - this
+                                 * should be fine.
+                                 */
+                                as->suspend_state = SUSPEND_NONE;
+                                break;
+                        }
+
+                        if (err > 0)
+                                apm_suspend();
+
+                        /*
+                         * Wait for the suspend/resume to complete.  If there
+                         * are pending acknowledges, we wait here for them.
+                         *
+                         * Note: we need to ensure that the PM subsystem does
+                         * not kick us out of the wait when it suspends the
+                         * threads.
+                         */
+                        flags = current->flags;
+                        current->flags |= PF_NOFREEZE;
+
+                        wait_event_interruptible(apm_suspend_waitqueue,
+                                         as->suspend_state == SUSPEND_DONE);
+                }
+
+                current->flags = flags;
+
+                mutex_lock(&state_lock);
+                err = as->suspend_result;
+                as->suspend_state = SUSPEND_NONE;
+                mutex_unlock(&state_lock);
+                break;
+        }
+
+        return err;
+}
+
+static int apm_release(struct inode * inode, struct file * filp)
+{
+        struct apm_user *as = filp->private_data;
+        int pending = 0;
+
+        filp->private_data = NULL;
+
+        down_write(&user_list_lock);
+        list_del(&as->list);
+        up_write(&user_list_lock);
+
+        /*
+         * We are now unhooked from the chain.  As far as new
+         * events are concerned, we no longer exist.  However, we
+         * need to balance suspends_pending, which means the
+         * possibility of sleeping.
+         */
+        mutex_lock(&state_lock);
+        if (as->suspend_state != SUSPEND_NONE) {
+                suspends_pending -= 1;
+                pending = suspends_pending == 0;
+        }
+        mutex_unlock(&state_lock);
+        if (pending)
+                apm_suspend();
+
+        kfree(as);
+        return 0;
+}
+
+static int apm_open(struct inode * inode, struct file * filp)
+{
+        struct apm_user *as;
+
+        as = kzalloc(sizeof(*as), GFP_KERNEL);
+        if (as) {
+                /*
+                 * XXX - this is a tiny bit broken, when we consider BSD
+                 * process accounting. If the device is opened by root, we
+                 * instantly flag that we used superuser privs. Who knows,
+                 * we might close the device immediately without doing a
+                 * privileged operation -- cevans
+                 */
+                as->suser = capable(CAP_SYS_ADMIN);
+                as->writer = (filp->f_mode & FMODE_WRITE) == FMODE_WRITE;
+                as->reader = (filp->f_mode & FMODE_READ) == FMODE_READ;
+
+                down_write(&user_list_lock);
+                list_add(&as->list, &apm_user_list);
+                up_write(&user_list_lock);
+
+                filp->private_data = as;
+        }
+
+        return as ? 0 : -ENOMEM;
+}
+
+static struct file_operations apm_bios_fops = {
+        .owner          = THIS_MODULE,
+        .read           = apm_read,
+        .poll           = apm_poll,
+        .ioctl          = apm_ioctl,
+        .open           = apm_open,
+        .release        = apm_release,
+};
+
+static struct miscdevice apm_device = {
+        .minor          = APM_MINOR_DEV,
+        .name           = "apm_bios",
+        .fops           = &apm_bios_fops
+};
+
+
+#ifdef CONFIG_PROC_FS
+/*
+ * Arguments, with symbols from linux/apm_bios.h.
+ *
+ *   0) Linux driver version (this will change if format changes)
+ *   1) APM BIOS Version.  Usually 1.0, 1.1 or 1.2.
+ *   2) APM flags from APM Installation Check (0x00):
+ *      bit 0: APM_16_BIT_SUPPORT
+ *      bit 1: APM_32_BIT_SUPPORT
+ *      bit 2: APM_IDLE_SLOWS_CLOCK
+ *      bit 3: APM_BIOS_DISABLED
+ *      bit 4: APM_BIOS_DISENGAGED
+ *   3) AC line status
+ *      0x00: Off-line
+ *      0x01: On-line
+ *      0x02: On backup power (BIOS >= 1.1 only)
+ *      0xff: Unknown
+ *   4) Battery status
+ *      0x00: High
+ *      0x01: Low
+ *      0x02: Critical
+ *      0x03: Charging
+ *      0x04: Selected battery not present (BIOS >= 1.2 only)
+ *      0xff: Unknown
+ *   5) Battery flag
+ *      bit 0: High
+ *      bit 1: Low
+ *      bit 2: Critical
+ *      bit 3: Charging
+ *      bit 7: No system battery
+ *      0xff: Unknown
+ *   6) Remaining battery life (percentage of charge):
+ *      0-100: valid
+ *      -1: Unknown
+ *   7) Remaining battery life (time units):
+ *      Number of remaining minutes or seconds
+ *      -1: Unknown
+ *   8) min = minutes; sec = seconds
+ */
+static int apm_get_info(char *buf, char **start, off_t fpos, int length)
+{
+        struct apm_power_info info;
+        char *units;
+        int ret;
+
+        info.ac_line_status = 0xff;
+        info.battery_status = 0xff;
+        info.battery_flag   = 0xff;
+        info.battery_life   = -1;
+        info.time           = -1;
+        info.units          = -1;
+
+        if (apm_get_power_status)
+                apm_get_power_status(&info);
+
+        switch (info.units) {
+        default:        units = "?";    break;
+        case 0:         units = "min";  break;
+        case 1:         units = "sec";  break;
+        }
+
+        ret = sprintf(buf, "%s 1.2 0x%02x 0x%02x 0x%02x 0x%02x %d%% %d %s\n",
+                     driver_version, APM_32_BIT_SUPPORT,
+                     info.ac_line_status, info.battery_status,
+                     info.battery_flag, info.battery_life,
+                     info.time, units);
+
+        return ret;
+}
+#endif
+
+static int kapmd(void *arg)
+{
+        do {
+                apm_event_t event;
+                int ret;
+
+                wait_event_interruptible(kapmd_wait,
+                                !queue_empty(&kapmd_queue) || kthread_should_stop());
+
+                if (kthread_should_stop())
+                        break;
+
+                spin_lock_irq(&kapmd_queue_lock);
+                event = 0;
+                if (!queue_empty(&kapmd_queue))
+                        event = queue_get_event(&kapmd_queue);
+                spin_unlock_irq(&kapmd_queue_lock);
+
+                switch (event) {
+                case 0:
+                        break;
+
+                case APM_LOW_BATTERY:
+                case APM_POWER_STATUS_CHANGE:
+                        queue_event(event);
+                        break;
+
+                case APM_USER_SUSPEND:
+                case APM_SYS_SUSPEND:
+                        ret = queue_suspend_event(event, NULL);
+                        if (ret < 0) {
+                                /*
+                                 * We were busy.  Try again in 50ms.
+                                 */
+                                queue_add_event(&kapmd_queue, event);
+                                msleep(50);
+                        }
+                        if (ret > 0)
+                                apm_suspend();
+                        break;
+
+                case APM_CRITICAL_SUSPEND:
+                        apm_suspend();
+                        break;
+                }
+        } while (1);
+
+        return 0;
+}
+
+static int __init apm_init(void)
+{
+        int ret;
+
+        if (apm_disabled) {
+                printk(KERN_NOTICE "apm: disabled on user request.\n");
+                return -ENODEV;
+        }
+
+        kapmd_tsk = kthread_create(kapmd, NULL, "kapmd");
+        if (IS_ERR(kapmd_tsk)) {
+                ret = PTR_ERR(kapmd_tsk);
+                kapmd_tsk = NULL;
+                return ret;
+        }
+        kapmd_tsk->flags |= PF_NOFREEZE;
+        wake_up_process(kapmd_tsk);
+
+#ifdef CONFIG_PROC_FS
+        create_proc_info_entry("apm", 0, NULL, apm_get_info);
+#endif
+
+        ret = misc_register(&apm_device);
+        if (ret != 0) {
+                remove_proc_entry("apm", NULL);
+                kthread_stop(kapmd_tsk);
+        }
+
+        return ret;
+}
+
+static void __exit apm_exit(void)
+{
+        misc_deregister(&apm_device);
+        remove_proc_entry("apm", NULL);
+
+        kthread_stop(kapmd_tsk);
+}
+
+module_init(apm_init);
+module_exit(apm_exit);
+
+MODULE_AUTHOR("Stephen Rothwell");
+MODULE_DESCRIPTION("Advanced Power Management");
+MODULE_LICENSE("GPL");
+
+#ifndef MODULE
+static int __init apm_setup(char *str)
+{
+        while ((str != NULL) && (*str != '\0')) {
+                if (strncmp(str, "off", 3) == 0)
+                        apm_disabled = 1;
+                if (strncmp(str, "on", 2) == 0)
+                        apm_disabled = 0;
+                str = strchr(str, ',');
+                if (str != NULL)
+                        str += strspn(str, ", \t");
+        }
+        return 1;
+}
+
+__setup("apm=", apm_setup);
+#endif
+
+/**
+ * apm_queue_event - queue an APM event for kapmd
+ * @event: APM event
+ *
+ * Queue an APM event for kapmd to process and ultimately take the
+ * appropriate action.  Only a subset of events are handled:
+ *   %APM_LOW_BATTERY
+ *   %APM_POWER_STATUS_CHANGE
+ *   %APM_USER_SUSPEND
+ *   %APM_SYS_SUSPEND
+ *   %APM_CRITICAL_SUSPEND
+ */
+void apm_queue_event(apm_event_t event)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&kapmd_queue_lock, flags);
+        queue_add_event(&kapmd_queue, event);
+        spin_unlock_irqrestore(&kapmd_queue_lock, flags);
+
+        wake_up_interruptible(&kapmd_wait);
+}
+EXPORT_SYMBOL(apm_queue_event);
diff --git a/drivers/char/drm/drmP.h b/drivers/char/drm/drmP.h
index 6dcdceb81203..85d99e21e188 100644
--- a/drivers/char/drm/drmP.h
+++ b/drivers/char/drm/drmP.h
@@ -532,11 +532,13 @@ typedef struct drm_mm_node {
         int free;
         unsigned long start;
         unsigned long size;
+        struct drm_mm *mm;
         void *private;
 } drm_mm_node_t;
 
 typedef struct drm_mm {
-        drm_mm_node_t root_node;
+        struct list_head fl_entry;
+        struct list_head ml_entry;
 } drm_mm_t;
 
 /**
@@ -843,9 +845,6 @@ extern void drm_mem_init(void);
 extern int drm_mem_info(char *buf, char **start, off_t offset,
                         int request, int *eof, void *data);
 extern void *drm_realloc(void *oldpt, size_t oldsize, size_t size, int area);
-extern void *drm_ioremap(unsigned long offset, unsigned long size,
-                         drm_device_t * dev);
-extern void drm_ioremapfree(void *pt, unsigned long size, drm_device_t * dev);
 
 extern DRM_AGP_MEM *drm_alloc_agp(drm_device_t * dev, int pages, u32 type);
 extern int drm_free_agp(DRM_AGP_MEM * handle, int pages);
@@ -1053,33 +1052,18 @@ extern void drm_sysfs_device_remove(struct class_device *class_dev);
 extern drm_mm_node_t *drm_mm_get_block(drm_mm_node_t * parent,
                                        unsigned long size,
                                        unsigned alignment);
-extern void drm_mm_put_block(drm_mm_t *mm, drm_mm_node_t *cur);
+void drm_mm_put_block(drm_mm_node_t * cur);
 extern drm_mm_node_t *drm_mm_search_free(const drm_mm_t *mm, unsigned long size,
                                          unsigned alignment, int best_match);
 extern int drm_mm_init(drm_mm_t *mm, unsigned long start, unsigned long size);
 extern void drm_mm_takedown(drm_mm_t *mm);
+extern int drm_mm_clean(drm_mm_t *mm);
+extern unsigned long drm_mm_tail_space(drm_mm_t *mm);
+extern int drm_mm_remove_space_from_tail(drm_mm_t *mm, unsigned long size);
+extern int drm_mm_add_space_to_tail(drm_mm_t *mm, unsigned long size);
 
-/* Inline replacements for DRM_IOREMAP macros */
-static __inline__ void drm_core_ioremap(struct drm_map *map,
-                                        struct drm_device *dev)
-{
-        map->handle = drm_ioremap(map->offset, map->size, dev);
-}
-
-#if 0
-static __inline__ void drm_core_ioremap_nocache(struct drm_map *map,
-                                                struct drm_device *dev)
-{
-        map->handle = drm_ioremap_nocache(map->offset, map->size, dev);
-}
-#endif  /*  0  */
-
-static __inline__ void drm_core_ioremapfree(struct drm_map *map,
-                                            struct drm_device *dev)
-{
-        if (map->handle && map->size)
-                drm_ioremapfree(map->handle, map->size, dev);
-}
+extern void drm_core_ioremap(struct drm_map *map, struct drm_device *dev);
+extern void drm_core_ioremapfree(struct drm_map *map, struct drm_device *dev);
 
 static __inline__ struct drm_map *drm_core_findmap(struct drm_device *dev,
                                                    unsigned int token)
diff --git a/drivers/char/drm/drm_bufs.c b/drivers/char/drm/drm_bufs.c
index 9f65f5697ba8..a6828cc14e58 100644
--- a/drivers/char/drm/drm_bufs.c
+++ b/drivers/char/drm/drm_bufs.c
@@ -79,14 +79,14 @@ static int drm_map_handle(drm_device_t *dev, drm_hash_item_t *hash,
 
         if (!use_hashed_handle) {
                 int ret;
-                hash->key = user_token;
+                hash->key = user_token >> PAGE_SHIFT;
                 ret = drm_ht_insert_item(&dev->map_hash, hash);
                 if (ret != -EINVAL)
                         return ret;
         }
         return drm_ht_just_insert_please(&dev->map_hash, hash,
                                          user_token, 32 - PAGE_SHIFT - 3,
-                                         PAGE_SHIFT, DRM_MAP_HASH_OFFSET);
+                                         0, DRM_MAP_HASH_OFFSET >> PAGE_SHIFT);
 }
 
 /**
@@ -178,11 +178,11 @@ static int drm_addmap_core(drm_device_t * dev, unsigned int offset,
                         }
                 }
                 if (map->type == _DRM_REGISTERS)
-                        map->handle = drm_ioremap(map->offset, map->size, dev);
+                        map->handle = ioremap(map->offset, map->size);
                 break;
 
         case _DRM_SHM:
-                map->handle = vmalloc_32(map->size);
+                map->handle = vmalloc_user(map->size);
                 DRM_DEBUG("%lu %d %p\n",
                           map->size, drm_order(map->size), map->handle);
                 if (!map->handle) {
@@ -238,7 +238,7 @@ static int drm_addmap_core(drm_device_t * dev, unsigned int offset,
         list = drm_alloc(sizeof(*list), DRM_MEM_MAPS);
         if (!list) {
                 if (map->type == _DRM_REGISTERS)
-                        drm_ioremapfree(map->handle, map->size, dev);
+                        iounmap(map->handle);
                 drm_free(map, sizeof(*map), DRM_MEM_MAPS);
                 return -EINVAL;
         }
@@ -255,14 +255,14 @@ static int drm_addmap_core(drm_device_t * dev, unsigned int offset,
         ret = drm_map_handle(dev, &list->hash, user_token, 0);
         if (ret) {
                 if (map->type == _DRM_REGISTERS)
-                        drm_ioremapfree(map->handle, map->size, dev);
+                        iounmap(map->handle);
                 drm_free(map, sizeof(*map), DRM_MEM_MAPS);
                 drm_free(list, sizeof(*list), DRM_MEM_MAPS);
                 mutex_unlock(&dev->struct_mutex);
                 return ret;
         }
 
-        list->user_token = list->hash.key;
+        list->user_token = list->hash.key << PAGE_SHIFT;
         mutex_unlock(&dev->struct_mutex);
 
         *maplist = list;
@@ -347,7 +347,8 @@ int drm_rmmap_locked(drm_device_t *dev, drm_local_map_t *map)
 
                 if (r_list->map == map) {
                         list_del(list);
-                        drm_ht_remove_key(&dev->map_hash, r_list->user_token);
+                        drm_ht_remove_key(&dev->map_hash,
+                                          r_list->user_token >> PAGE_SHIFT);
                         drm_free(list, sizeof(*list), DRM_MEM_MAPS);
                         break;
                 }
@@ -362,7 +363,7 @@ int drm_rmmap_locked(drm_device_t *dev, drm_local_map_t *map)
 
         switch (map->type) {
         case _DRM_REGISTERS:
-                drm_ioremapfree(map->handle, map->size, dev);
+                iounmap(map->handle);
                 /* FALLTHROUGH */
         case _DRM_FRAME_BUFFER:
                 if (drm_core_has_MTRR(dev) && map->mtrr >= 0) {
diff --git a/drivers/char/drm/drm_memory.c b/drivers/char/drm/drm_memory.c
index 5681cae1d404..92a867082376 100644
--- a/drivers/char/drm/drm_memory.c
+++ b/drivers/char/drm/drm_memory.c
@@ -79,28 +79,6 @@ void *drm_realloc(void *oldpt, size_t oldsize, size_t size, int area)
 }
 
 #if __OS_HAS_AGP
-/*
- * Find the drm_map that covers the range [offset, offset+size).
- */
-static drm_map_t *drm_lookup_map(unsigned long offset,
-                                 unsigned long size, drm_device_t * dev)
-{
-        struct list_head *list;
-        drm_map_list_t *r_list;
-        drm_map_t *map;
-
-        list_for_each(list, &dev->maplist->head) {
-                r_list = (drm_map_list_t *) list;
-                map = r_list->map;
-                if (!map)
-                        continue;
-                if (map->offset <= offset
-                    && (offset + size) <= (map->offset + map->size))
-                        return map;
-        }
-        return NULL;
-}
-
 static void *agp_remap(unsigned long offset, unsigned long size,
                        drm_device_t * dev)
 {
@@ -169,13 +147,6 @@ int drm_unbind_agp(DRM_AGP_MEM * handle)
 }
 
 #else  /*  __OS_HAS_AGP  */
-
-static inline drm_map_t *drm_lookup_map(unsigned long offset,
-                                        unsigned long size, drm_device_t * dev)
-{
-        return NULL;
-}
-
 static inline void *agp_remap(unsigned long offset, unsigned long size,
                               drm_device_t * dev)
 {
@@ -184,57 +155,28 @@ static inline void *agp_remap(unsigned long offset, unsigned long size,
 
 #endif                          /* agp */
 
-void *drm_ioremap(unsigned long offset, unsigned long size,
-                                drm_device_t * dev)
-{
-        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture) {
-                drm_map_t *map = drm_lookup_map(offset, size, dev);
-
-                if (map && map->type == _DRM_AGP)
-                        return agp_remap(offset, size, dev);
-        }
-        return ioremap(offset, size);
-}
-EXPORT_SYMBOL(drm_ioremap);
+#endif                          /* debug_memory */
 
-#if 0
-void *drm_ioremap_nocache(unsigned long offset,
-                                        unsigned long size, drm_device_t * dev)
+void drm_core_ioremap(struct drm_map *map, struct drm_device *dev)
 {
-        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture) {
-                drm_map_t *map = drm_lookup_map(offset, size, dev);
-
-                if (map && map->type == _DRM_AGP)
-                        return agp_remap(offset, size, dev);
-        }
-        return ioremap_nocache(offset, size);
+        if (drm_core_has_AGP(dev) &&
+            dev->agp && dev->agp->cant_use_aperture && map->type == _DRM_AGP)
+                map->handle = agp_remap(map->offset, map->size, dev);
+        else
+                map->handle = ioremap(map->offset, map->size);
 }
-#endif  /*  0  */
+EXPORT_SYMBOL(drm_core_ioremap);
 
-void drm_ioremapfree(void *pt, unsigned long size,
-                                   drm_device_t * dev)
+void drm_core_ioremapfree(struct drm_map *map, struct drm_device *dev)
 {
-        /*
-         * This is a bit ugly.  It would be much cleaner if the DRM API would use separate
-         * routines for handling mappings in the AGP space.  Hopefully this can be done in
-         * a future revision of the interface...
-         */
-        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture
-            && ((unsigned long)pt >= VMALLOC_START
-                && (unsigned long)pt < VMALLOC_END)) {
-                unsigned long offset;
-                drm_map_t *map;
-
-                offset = drm_follow_page(pt) | ((unsigned long)pt & ~PAGE_MASK);
-                map = drm_lookup_map(offset, size, dev);
-                if (map && map->type == _DRM_AGP) {
-                        vunmap(pt);
-                        return;
-                }
-        }
-
-        iounmap(pt);
+        if (!map->handle || !map->size)
+                return;
+
+        if (drm_core_has_AGP(dev) &&
+            dev->agp && dev->agp->cant_use_aperture && map->type == _DRM_AGP)
+                vunmap(map->handle);
+        else
+                iounmap(map->handle);
 }
-EXPORT_SYMBOL(drm_ioremapfree);
+EXPORT_SYMBOL(drm_core_ioremapfree);
 
-#endif                          /* debug_memory */
diff --git a/drivers/char/drm/drm_memory.h b/drivers/char/drm/drm_memory.h
index f1b97aff10cf..63e425b5ea82 100644
--- a/drivers/char/drm/drm_memory.h
+++ b/drivers/char/drm/drm_memory.h
@@ -56,26 +56,6 @@
 # endif
 #endif
 
-static inline unsigned long drm_follow_page(void *vaddr)
-{
-        pgd_t *pgd = pgd_offset_k((unsigned long)vaddr);
-        pud_t *pud = pud_offset(pgd, (unsigned long)vaddr);
-        pmd_t *pmd = pmd_offset(pud, (unsigned long)vaddr);
-        pte_t *ptep = pte_offset_kernel(pmd, (unsigned long)vaddr);
-        return pte_pfn(*ptep) << PAGE_SHIFT;
-}
-
 #else                           /* __OS_HAS_AGP */
 
-static inline unsigned long drm_follow_page(void *vaddr)
-{
-        return 0;
-}
-
 #endif
-
-void *drm_ioremap(unsigned long offset, unsigned long size,
-                                drm_device_t * dev);
-
-void drm_ioremapfree(void *pt, unsigned long size,
-                                   drm_device_t * dev);
diff --git a/drivers/char/drm/drm_memory_debug.h b/drivers/char/drm/drm_memory_debug.h
index 74581af806e1..6463271deea8 100644
--- a/drivers/char/drm/drm_memory_debug.h
+++ b/drivers/char/drm/drm_memory_debug.h
@@ -205,76 +205,6 @@ void drm_free (void *pt, size_t size, int area) {
         }
 }
 
-void *drm_ioremap (unsigned long offset, unsigned long size,
-                    drm_device_t * dev) {
-        void *pt;
-
-        if (!size) {
-                DRM_MEM_ERROR(DRM_MEM_MAPPINGS,
-                              "Mapping 0 bytes at 0x%08lx\n", offset);
-                return NULL;
-        }
-
-        if (!(pt = drm_ioremap(offset, size, dev))) {
-                spin_lock(&drm_mem_lock);
-                ++drm_mem_stats[DRM_MEM_MAPPINGS].fail_count;
-                spin_unlock(&drm_mem_lock);
-                return NULL;
-        }
-        spin_lock(&drm_mem_lock);
-        ++drm_mem_stats[DRM_MEM_MAPPINGS].succeed_count;
-        drm_mem_stats[DRM_MEM_MAPPINGS].bytes_allocated += size;
-        spin_unlock(&drm_mem_lock);
-        return pt;
-}
-
-#if 0
-void *drm_ioremap_nocache (unsigned long offset, unsigned long size,
-                            drm_device_t * dev) {
-        void *pt;
-
-        if (!size) {
-                DRM_MEM_ERROR(DRM_MEM_MAPPINGS,
-                              "Mapping 0 bytes at 0x%08lx\n", offset);
-                return NULL;
-        }
-
-        if (!(pt = drm_ioremap_nocache(offset, size, dev))) {
-                spin_lock(&drm_mem_lock);
-                ++drm_mem_stats[DRM_MEM_MAPPINGS].fail_count;
-                spin_unlock(&drm_mem_lock);
-                return NULL;
-        }
-        spin_lock(&drm_mem_lock);
-        ++drm_mem_stats[DRM_MEM_MAPPINGS].succeed_count;
-        drm_mem_stats[DRM_MEM_MAPPINGS].bytes_allocated += size;
-        spin_unlock(&drm_mem_lock);
-        return pt;
-}
-#endif  /*  0  */
-
-void drm_ioremapfree (void *pt, unsigned long size, drm_device_t * dev) {
-        int alloc_count;
-        int free_count;
-
-        if (!pt)
-                DRM_MEM_ERROR(DRM_MEM_MAPPINGS,
-                              "Attempt to free NULL pointer\n");
-        else
-                drm_ioremapfree(pt, size, dev);
-
-        spin_lock(&drm_mem_lock);
-        drm_mem_stats[DRM_MEM_MAPPINGS].bytes_freed += size;
-        free_count = ++drm_mem_stats[DRM_MEM_MAPPINGS].free_count;
-        alloc_count = drm_mem_stats[DRM_MEM_MAPPINGS].succeed_count;
-        spin_unlock(&drm_mem_lock);
-        if (free_count > alloc_count) {
-                DRM_MEM_ERROR(DRM_MEM_MAPPINGS,
-                              "Excess frees: %d frees, %d allocs\n",
-                              free_count, alloc_count);
-        }
-}
-
 #if __OS_HAS_AGP
 
 DRM_AGP_MEM *drm_alloc_agp (drm_device_t *dev, int pages, u32 type) {
diff --git a/drivers/char/drm/drm_mm.c b/drivers/char/drm/drm_mm.c
index 617526bd5b0c..9b46b85027d0 100644
--- a/drivers/char/drm/drm_mm.c
+++ b/drivers/char/drm/drm_mm.c
@@ -42,36 +42,131 @@
  */
 
 #include "drmP.h"
+#include <linux/slab.h>
+
+unsigned long drm_mm_tail_space(drm_mm_t *mm)
+{
+        struct list_head *tail_node;
+        drm_mm_node_t *entry;
+
+        tail_node = mm->ml_entry.prev;
+        entry = list_entry(tail_node, drm_mm_node_t, ml_entry);
+        if (!entry->free)
+                return 0;
+
+        return entry->size;
+}
+
+int drm_mm_remove_space_from_tail(drm_mm_t *mm, unsigned long size)
+{
+        struct list_head *tail_node;
+        drm_mm_node_t *entry;
+
+        tail_node = mm->ml_entry.prev;
+        entry = list_entry(tail_node, drm_mm_node_t, ml_entry);
+        if (!entry->free)
+                return -ENOMEM;
+
+        if (entry->size <= size)
+                return -ENOMEM;
+
+        entry->size -= size;
+        return 0;
+}
+
+
+static int drm_mm_create_tail_node(drm_mm_t *mm,
+                            unsigned long start,
+                            unsigned long size)
+{
+        drm_mm_node_t *child;
+
+        child = (drm_mm_node_t *)
+                drm_alloc(sizeof(*child), DRM_MEM_MM);
+        if (!child)
+                return -ENOMEM;
+
+        child->free = 1;
+        child->size = size;
+        child->start = start;
+        child->mm = mm;
+
+        list_add_tail(&child->ml_entry, &mm->ml_entry);
+        list_add_tail(&child->fl_entry, &mm->fl_entry);
+
+        return 0;
+}
+
+
+int drm_mm_add_space_to_tail(drm_mm_t *mm, unsigned long size)
+{
+        struct list_head *tail_node;
+        drm_mm_node_t *entry;
+
+        tail_node = mm->ml_entry.prev;
+        entry = list_entry(tail_node, drm_mm_node_t, ml_entry);
+        if (!entry->free) {
+                return drm_mm_create_tail_node(mm, entry->start + entry->size, size);
+        }
+        entry->size += size;
+        return 0;
+}
+
+static drm_mm_node_t *drm_mm_split_at_start(drm_mm_node_t *parent,
+                                            unsigned long size)
+{
+        drm_mm_node_t *child;
+
+        child = (drm_mm_node_t *)
+                drm_alloc(sizeof(*child), DRM_MEM_MM);
+        if (!child)
+                return NULL;
+
+        INIT_LIST_HEAD(&child->fl_entry);
+
+        child->free = 0;
+        child->size = size;
+        child->start = parent->start;
+        child->mm = parent->mm;
+
+        list_add_tail(&child->ml_entry, &parent->ml_entry);
+        INIT_LIST_HEAD(&child->fl_entry);
+
+        parent->size -= size;
+        parent->start += size;
+        return child;
+}
+
+
 
 drm_mm_node_t *drm_mm_get_block(drm_mm_node_t * parent,
                                 unsigned long size, unsigned alignment)
 {
 
+        drm_mm_node_t *align_splitoff = NULL;
         drm_mm_node_t *child;
+        unsigned tmp = 0;
 
         if (alignment)
-                size += alignment - 1;
+                tmp = parent->start % alignment;
+
+        if (tmp) {
+                align_splitoff = drm_mm_split_at_start(parent, alignment - tmp);
+                if (!align_splitoff)
+                        return NULL;
+        }
 
         if (parent->size == size) {
                 list_del_init(&parent->fl_entry);
                 parent->free = 0;
                 return parent;
         } else {
-                child = (drm_mm_node_t *) drm_alloc(sizeof(*child), DRM_MEM_MM);
-                if (!child)
-                        return NULL;
-
-                INIT_LIST_HEAD(&child->ml_entry);
-                INIT_LIST_HEAD(&child->fl_entry);
+                child = drm_mm_split_at_start(parent, size);
+        }
 
-                child->free = 0;
-                child->size = size;
-                child->start = parent->start;
+        if (align_splitoff)
+                drm_mm_put_block(align_splitoff);
 
-                list_add_tail(&child->ml_entry, &parent->ml_entry);
-                parent->size -= size;
-                parent->start += size;
-        }
         return child;
 }
 
@@ -80,12 +175,12 @@ drm_mm_node_t *drm_mm_get_block(drm_mm_node_t * parent,
  * Otherwise add to the free stack.
  */
 
-void drm_mm_put_block(drm_mm_t * mm, drm_mm_node_t * cur)
+void drm_mm_put_block(drm_mm_node_t * cur)
 {
 
-        drm_mm_node_t *list_root = &mm->root_node;
+        drm_mm_t *mm = cur->mm;
         struct list_head *cur_head = &cur->ml_entry;
-        struct list_head *root_head = &list_root->ml_entry;
+        struct list_head *root_head = &mm->ml_entry;
         drm_mm_node_t *prev_node = NULL;
         drm_mm_node_t *next_node;
 
@@ -116,7 +211,7 @@ void drm_mm_put_block(drm_mm_t * mm, drm_mm_node_t * cur)
         }
         if (!merged) {
                 cur->free = 1;
-                list_add(&cur->fl_entry, &list_root->fl_entry);
+                list_add(&cur->fl_entry, &mm->fl_entry);
         } else {
                 list_del(&cur->ml_entry);
                 drm_free(cur, sizeof(*cur), DRM_MEM_MM);
@@ -128,20 +223,30 @@ drm_mm_node_t *drm_mm_search_free(const drm_mm_t * mm,
                                   unsigned alignment, int best_match)
 {
         struct list_head *list;
-        const struct list_head *free_stack = &mm->root_node.fl_entry;
+        const struct list_head *free_stack = &mm->fl_entry;
         drm_mm_node_t *entry;
         drm_mm_node_t *best;
         unsigned long best_size;
+        unsigned wasted;
 
         best = NULL;
         best_size = ~0UL;
 
-        if (alignment)
-                size += alignment - 1;
-
         list_for_each(list, free_stack) {
                 entry = list_entry(list, drm_mm_node_t, fl_entry);
-                if (entry->size >= size) {
+                wasted = 0;
+
+                if (entry->size < size)
+                        continue;
+
+                if (alignment) {
+                        register unsigned tmp = entry->start % alignment;
+                        if (tmp)
+                                wasted += alignment - tmp;
+                }
+
+
+                if (entry->size >= size + wasted) {
                         if (!best_match)
                                 return entry;
                         if (size < best_size) {
@@ -154,40 +259,32 @@ drm_mm_node_t *drm_mm_search_free(const drm_mm_t * mm,
         return best;
 }
 
-int drm_mm_init(drm_mm_t * mm, unsigned long start, unsigned long size)
+int drm_mm_clean(drm_mm_t * mm)
 {
-        drm_mm_node_t *child;
-
-        INIT_LIST_HEAD(&mm->root_node.ml_entry);
-        INIT_LIST_HEAD(&mm->root_node.fl_entry);
-        child = (drm_mm_node_t *) drm_alloc(sizeof(*child), DRM_MEM_MM);
-        if (!child)
-                return -ENOMEM;
-
-        INIT_LIST_HEAD(&child->ml_entry);
-        INIT_LIST_HEAD(&child->fl_entry);
+        struct list_head *head = &mm->ml_entry;
 
-        child->start = start;
-        child->size = size;
-        child->free = 1;
+        return (head->next->next == head);
+}
 
-        list_add(&child->fl_entry, &mm->root_node.fl_entry);
-        list_add(&child->ml_entry, &mm->root_node.ml_entry);
+int drm_mm_init(drm_mm_t * mm, unsigned long start, unsigned long size)
+{
+        INIT_LIST_HEAD(&mm->ml_entry);
+        INIT_LIST_HEAD(&mm->fl_entry);
 
-        return 0;
+        return drm_mm_create_tail_node(mm, start, size);
 }
 
 EXPORT_SYMBOL(drm_mm_init);
 
 void drm_mm_takedown(drm_mm_t * mm)
 {
-        struct list_head *bnode = mm->root_node.fl_entry.next;
+        struct list_head *bnode = mm->fl_entry.next;
         drm_mm_node_t *entry;
 
         entry = list_entry(bnode, drm_mm_node_t, fl_entry);
 
-        if (entry->ml_entry.next != &mm->root_node.ml_entry ||
-            entry->fl_entry.next != &mm->root_node.fl_entry) {
+        if (entry->ml_entry.next != &mm->ml_entry ||
+            entry->fl_entry.next != &mm->fl_entry) {
                 DRM_ERROR("Memory manager not clean. Delaying takedown\n");
                 return;
         }
diff --git a/drivers/char/drm/drm_pciids.h b/drivers/char/drm/drm_pciids.h
index 09398d5fbd3f..ad54b845978b 100644
--- a/drivers/char/drm/drm_pciids.h
+++ b/drivers/char/drm/drm_pciids.h
@@ -226,12 +226,14 @@
         {0x1106, 0x3022, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
         {0x1106, 0x3118, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_PRO_GROUP_A}, \
         {0x1106, 0x3122, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+        {0x1106, 0x7204, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
         {0x1106, 0x7205, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
         {0x1106, 0x3108, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
         {0x1106, 0x3304, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
         {0x1106, 0x3157, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
         {0x1106, 0x3344, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x1106, 0x7204, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+        {0x1106, 0x3343, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+        {0x1106, 0x3230, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_DX9_0}, \
         {0, 0, 0}
 
 #define i810_PCI_IDS \
diff --git a/drivers/char/drm/drm_proc.c b/drivers/char/drm/drm_proc.c
index 62d5fe15f046..7fd0da712142 100644
--- a/drivers/char/drm/drm_proc.c
+++ b/drivers/char/drm/drm_proc.c
@@ -500,7 +500,7 @@ static int drm__vma_info(char *buf, char **start, off_t offset, int request,
         for (pt = dev->vmalist; pt; pt = pt->next) {
                 if (!(vma = pt->vma))
                         continue;
-                DRM_PROC_PRINT("\n%5d 0x%08lx-0x%08lx %c%c%c%c%c%c 0x%08lx",
+                DRM_PROC_PRINT("\n%5d 0x%08lx-0x%08lx %c%c%c%c%c%c 0x%08lx000",
                                pt->pid,
                                vma->vm_start,
                                vma->vm_end,
@@ -510,7 +510,7 @@ static int drm__vma_info(char *buf, char **start, off_t offset, int request,
                                vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
                                vma->vm_flags & VM_LOCKED ? 'l' : '-',
                                vma->vm_flags & VM_IO ? 'i' : '-',
-                               vma->vm_pgoff << PAGE_SHIFT);
+                               vma->vm_pgoff);
 
 #if defined(__i386__)
                 pgprot = pgprot_val(vma->vm_page_prot);
diff --git a/drivers/char/drm/drm_sman.c b/drivers/char/drm/drm_sman.c
index 19c81d2e13d0..e15db6d6bea9 100644
--- a/drivers/char/drm/drm_sman.c
+++ b/drivers/char/drm/drm_sman.c
@@ -101,10 +101,9 @@ static void *drm_sman_mm_allocate(void *private, unsigned long size,
 
 static void drm_sman_mm_free(void *private, void *ref)
 {
-        drm_mm_t *mm = (drm_mm_t *) private;
         drm_mm_node_t *node = (drm_mm_node_t *) ref;
 
-        drm_mm_put_block(mm, node);
+        drm_mm_put_block(node);
 }
 
 static void drm_sman_mm_destroy(void *private)
diff --git a/drivers/char/drm/drm_vm.c b/drivers/char/drm/drm_vm.c
index b9cfc077f6bc..54a632848955 100644
--- a/drivers/char/drm/drm_vm.c
+++ b/drivers/char/drm/drm_vm.c
@@ -70,7 +70,7 @@ static __inline__ struct page *drm_do_vm_nopage(struct vm_area_struct *vma,
         if (!dev->agp || !dev->agp->cant_use_aperture)
                 goto vm_nopage_error;
 
-        if (drm_ht_find_item(&dev->map_hash, vma->vm_pgoff << PAGE_SHIFT, &hash))
+        if (drm_ht_find_item(&dev->map_hash, vma->vm_pgoff, &hash))
                 goto vm_nopage_error;
 
         r_list = drm_hash_entry(hash, drm_map_list_t, hash);
@@ -227,7 +227,7 @@ static void drm_vm_shm_close(struct vm_area_struct *vma)
                                                            map->size);
                                         DRM_DEBUG("mtrr_del = %d\n", retcode);
                                 }
-                                drm_ioremapfree(map->handle, map->size, dev);
+                                iounmap(map->handle);
                                 break;
                         case _DRM_SHM:
                                 vfree(map->handle);
@@ -463,8 +463,8 @@ static int drm_mmap_dma(struct file *filp, struct vm_area_struct *vma)
         lock_kernel();
         dev = priv->head->dev;
         dma = dev->dma;
-        DRM_DEBUG("start = 0x%lx, end = 0x%lx, offset = 0x%lx\n",
-                  vma->vm_start, vma->vm_end, vma->vm_pgoff << PAGE_SHIFT);
+        DRM_DEBUG("start = 0x%lx, end = 0x%lx, page offset = 0x%lx\n",
+                  vma->vm_start, vma->vm_end, vma->vm_pgoff);
 
         /* Length must match exact page count */
         if (!dma || (length >> PAGE_SHIFT) != dma->page_count) {
@@ -537,8 +537,8 @@ int drm_mmap(struct file *filp, struct vm_area_struct *vma)
         unsigned long offset = 0;
         drm_hash_item_t *hash;
 
-        DRM_DEBUG("start = 0x%lx, end = 0x%lx, offset = 0x%lx\n",
-                  vma->vm_start, vma->vm_end, vma->vm_pgoff << PAGE_SHIFT);
+        DRM_DEBUG("start = 0x%lx, end = 0x%lx, page offset = 0x%lx\n",
+                  vma->vm_start, vma->vm_end, vma->vm_pgoff);
 
         if (!priv->authenticated)
                 return -EACCES;
@@ -547,7 +547,7 @@ int drm_mmap(struct file *filp, struct vm_area_struct *vma)
          * the AGP mapped at physical address 0
          * --BenH.
          */
-        if (!(vma->vm_pgoff << PAGE_SHIFT)
+        if (!vma->vm_pgoff
 #if __OS_HAS_AGP
             && (!dev->agp
                 || dev->agp->agp_info.device->vendor != PCI_VENDOR_ID_APPLE)
@@ -555,7 +555,7 @@ int drm_mmap(struct file *filp, struct vm_area_struct *vma)
             )
                 return drm_mmap_dma(filp, vma);
 
-        if (drm_ht_find_item(&dev->map_hash, vma->vm_pgoff << PAGE_SHIFT, &hash)) {
+        if (drm_ht_find_item(&dev->map_hash, vma->vm_pgoff, &hash)) {
                 DRM_ERROR("Could not find map\n");
                 return -EINVAL;
         }
diff --git a/drivers/char/drm/i810_dma.c b/drivers/char/drm/i810_dma.c
index fa2de70f7401..60cb4e45a75e 100644
--- a/drivers/char/drm/i810_dma.c
+++ b/drivers/char/drm/i810_dma.c
@@ -219,8 +219,7 @@ static int i810_dma_cleanup(drm_device_t * dev)
                     (drm_i810_private_t *) dev->dev_private;
 
                 if (dev_priv->ring.virtual_start) {
-                        drm_ioremapfree((void *)dev_priv->ring.virtual_start,
-                                        dev_priv->ring.Size, dev);
+                        drm_core_ioremapfree(&dev_priv->ring.map, dev);
                 }
                 if (dev_priv->hw_status_page) {
                         pci_free_consistent(dev->pdev, PAGE_SIZE,
@@ -236,9 +235,9 @@ static int i810_dma_cleanup(drm_device_t * dev)
                 for (i = 0; i < dma->buf_count; i++) {
                         drm_buf_t *buf = dma->buflist[i];
                         drm_i810_buf_priv_t *buf_priv = buf->dev_private;
+
                         if (buf_priv->kernel_virtual && buf->total)
-                                drm_ioremapfree(buf_priv->kernel_virtual,
-                                                buf->total, dev);
+                                drm_core_ioremapfree(&buf_priv->map, dev);
                 }
         }
         return 0;
@@ -311,8 +310,15 @@ static int i810_freelist_init(drm_device_t * dev, drm_i810_private_t * dev_priv)
 
                 *buf_priv->in_use = I810_BUF_FREE;
 
-                buf_priv->kernel_virtual = drm_ioremap(buf->bus_address,
-                                                       buf->total, dev);
+                buf_priv->map.offset = buf->bus_address;
+                buf_priv->map.size = buf->total;
+                buf_priv->map.type = _DRM_AGP;
+                buf_priv->map.flags = 0;
+                buf_priv->map.mtrr = 0;
+
+                drm_core_ioremap(&buf_priv->map, dev);
+                buf_priv->kernel_virtual = buf_priv->map.handle;
+
         }
         return 0;
 }
@@ -363,18 +369,24 @@ static int i810_dma_initialize(drm_device_t * dev,
         dev_priv->ring.End = init->ring_end;
         dev_priv->ring.Size = init->ring_size;
 
-        dev_priv->ring.virtual_start = drm_ioremap(dev->agp->base +
-                                                   init->ring_start,
-                                                   init->ring_size, dev);
+        dev_priv->ring.map.offset = dev->agp->base + init->ring_start;
+        dev_priv->ring.map.size = init->ring_size;
+        dev_priv->ring.map.type = _DRM_AGP;
+        dev_priv->ring.map.flags = 0;
+        dev_priv->ring.map.mtrr = 0;
 
-        if (dev_priv->ring.virtual_start == NULL) {
+        drm_core_ioremap(&dev_priv->ring.map, dev);
+
+        if (dev_priv->ring.map.handle == NULL) {
                 dev->dev_private = (void *)dev_priv;
                 i810_dma_cleanup(dev);
                 DRM_ERROR("can not ioremap virtual address for"
                           " ring buffer\n");
-                return -ENOMEM;
+                return DRM_ERR(ENOMEM);
         }
 
+        dev_priv->ring.virtual_start = dev_priv->ring.map.handle;
+
         dev_priv->ring.tail_mask = dev_priv->ring.Size - 1;
 
         dev_priv->w = init->w;
diff --git a/drivers/char/drm/i810_drv.h b/drivers/char/drm/i810_drv.h
index e8cf3ff606f0..e6df49f4928a 100644
--- a/drivers/char/drm/i810_drv.h
+++ b/drivers/char/drm/i810_drv.h
@@ -61,6 +61,7 @@ typedef struct drm_i810_buf_priv {
         int currently_mapped;
         void *virtual;
         void *kernel_virtual;
+        drm_local_map_t map;
 } drm_i810_buf_priv_t;
 
 typedef struct _drm_i810_ring_buffer {
@@ -72,6 +73,7 @@ typedef struct _drm_i810_ring_buffer {
         int head;
         int tail;
         int space;
+        drm_local_map_t map;
 } drm_i810_ring_buffer_t;
 
 typedef struct drm_i810_private {
diff --git a/drivers/char/drm/i830_dma.c b/drivers/char/drm/i830_dma.c
index 4f0e5746ab33..95224455ec0c 100644
--- a/drivers/char/drm/i830_dma.c
+++ b/drivers/char/drm/i830_dma.c
@@ -223,8 +223,7 @@ static int i830_dma_cleanup(drm_device_t * dev)
                     (drm_i830_private_t *) dev->dev_private;
 
                 if (dev_priv->ring.virtual_start) {
-                        drm_ioremapfree((void *)dev_priv->ring.virtual_start,
-                                        dev_priv->ring.Size, dev);
+                        drm_core_ioremapfree(&dev_priv->ring.map, dev);
                 }
                 if (dev_priv->hw_status_page) {
                         pci_free_consistent(dev->pdev, PAGE_SIZE,
@@ -242,8 +241,7 @@ static int i830_dma_cleanup(drm_device_t * dev)
                         drm_buf_t *buf = dma->buflist[i];
                         drm_i830_buf_priv_t *buf_priv = buf->dev_private;
                         if (buf_priv->kernel_virtual && buf->total)
-                                drm_ioremapfree(buf_priv->kernel_virtual,
-                                                buf->total, dev);
+                                drm_core_ioremapfree(&buf_priv->map, dev);
                 }
         }
         return 0;
@@ -320,8 +318,14 @@ static int i830_freelist_init(drm_device_t * dev, drm_i830_private_t * dev_priv)
 
                 *buf_priv->in_use = I830_BUF_FREE;
 
-                buf_priv->kernel_virtual = drm_ioremap(buf->bus_address,
-                                                       buf->total, dev);
+                buf_priv->map.offset = buf->bus_address;
+                buf_priv->map.size = buf->total;
+                buf_priv->map.type = _DRM_AGP;
+                buf_priv->map.flags = 0;
+                buf_priv->map.mtrr = 0;
+
+                drm_core_ioremap(&buf_priv->map, dev);
+                buf_priv->kernel_virtual = buf_priv->map.handle;
         }
         return 0;
 }
@@ -373,18 +377,24 @@ static int i830_dma_initialize(drm_device_t * dev,
         dev_priv->ring.End = init->ring_end;
         dev_priv->ring.Size = init->ring_size;
 
-        dev_priv->ring.virtual_start = drm_ioremap(dev->agp->base +
-                                                   init->ring_start,
-                                                   init->ring_size, dev);
+        dev_priv->ring.map.offset = dev->agp->base + init->ring_start;
+        dev_priv->ring.map.size = init->ring_size;
+        dev_priv->ring.map.type = _DRM_AGP;
+        dev_priv->ring.map.flags = 0;
+        dev_priv->ring.map.mtrr = 0;
+
+        drm_core_ioremap(&dev_priv->ring.map, dev);
 
-        if (dev_priv->ring.virtual_start == NULL) {
+        if (dev_priv->ring.map.handle == NULL) {
                 dev->dev_private = (void *)dev_priv;
                 i830_dma_cleanup(dev);
                 DRM_ERROR("can not ioremap virtual address for"
                           " ring buffer\n");
-                return -ENOMEM;
+                return DRM_ERR(ENOMEM);
         }
 
+        dev_priv->ring.virtual_start = dev_priv->ring.map.handle;
+
         dev_priv->ring.tail_mask = dev_priv->ring.Size - 1;
 
         dev_priv->w = init->w;
diff --git a/drivers/char/drm/i830_drv.h b/drivers/char/drm/i830_drv.h
index 85bc5be6f916..e91f94afb4bb 100644
--- a/drivers/char/drm/i830_drv.h
+++ b/drivers/char/drm/i830_drv.h
@@ -68,6 +68,7 @@ typedef struct drm_i830_buf_priv {
         int currently_mapped;
         void __user *virtual;
         void *kernel_virtual;
+        drm_local_map_t map;
 } drm_i830_buf_priv_t;
 
 typedef struct _drm_i830_ring_buffer {
@@ -79,6 +80,7 @@ typedef struct _drm_i830_ring_buffer {
         int head;
         int tail;
         int space;
+        drm_local_map_t map;
 } drm_i830_ring_buffer_t;
 
 typedef struct drm_i830_private {
diff --git a/drivers/char/drm/via_dma.c b/drivers/char/drm/via_dma.c
index a691ae74129d..c0539c6299cf 100644
--- a/drivers/char/drm/via_dma.c
+++ b/drivers/char/drm/via_dma.c
@@ -190,6 +190,11 @@ static int via_initialize(drm_device_t * dev,
                 return DRM_ERR(EFAULT);
         }
 
+        if (dev_priv->chipset == VIA_DX9_0) {
+                DRM_ERROR("AGP DMA is not supported on this chip\n");
+                return DRM_ERR(EINVAL);
+        }
+
         dev_priv->ring.map.offset = dev->agp->base + init->offset;
         dev_priv->ring.map.size = init->size;
         dev_priv->ring.map.type = 0;
@@ -480,6 +485,7 @@ static int via_hook_segment(drm_via_private_t * dev_priv,
                         VIA_WRITE(VIA_REG_TRANSET, (HC_ParaType_PreCR << 16));
                         VIA_WRITE(VIA_REG_TRANSPACE, pause_addr_hi);
                         VIA_WRITE(VIA_REG_TRANSPACE, pause_addr_lo);
+                        VIA_READ(VIA_REG_TRANSPACE);
                 }
         }
         return paused;
@@ -557,8 +563,9 @@ static void via_cmdbuf_start(drm_via_private_t * dev_priv)
 
         VIA_WRITE(VIA_REG_TRANSPACE, pause_addr_hi);
         VIA_WRITE(VIA_REG_TRANSPACE, pause_addr_lo);
-
+        DRM_WRITEMEMORYBARRIER();
         VIA_WRITE(VIA_REG_TRANSPACE, command | HC_HAGPCMNT_MASK);
+        VIA_READ(VIA_REG_TRANSPACE);
 }
 
 static void via_pad_cache(drm_via_private_t * dev_priv, int qwords)
diff --git a/drivers/char/drm/via_dmablit.c b/drivers/char/drm/via_dmablit.c
index 806f9ce5f47b..2054d5773717 100644
--- a/drivers/char/drm/via_dmablit.c
+++ b/drivers/char/drm/via_dmablit.c
@@ -218,7 +218,9 @@ via_fire_dmablit(drm_device_t *dev, drm_via_sg_info_t *vsg, int engine)
         VIA_WRITE(VIA_PCI_DMA_MR0  + engine*0x04, VIA_DMA_MR_CM | VIA_DMA_MR_TDIE);
         VIA_WRITE(VIA_PCI_DMA_BCR0 + engine*0x10, 0);
         VIA_WRITE(VIA_PCI_DMA_DPR0 + engine*0x10, vsg->chain_start);
+        DRM_WRITEMEMORYBARRIER();
         VIA_WRITE(VIA_PCI_DMA_CSR0 + engine*0x04, VIA_DMA_CSR_DE | VIA_DMA_CSR_TS);
+        VIA_READ(VIA_PCI_DMA_CSR0 + engine*0x04);
 }
 
 /*
diff --git a/drivers/char/drm/via_drv.h b/drivers/char/drm/via_drv.h
index d21b5b75da0f..8b8778d4a423 100644
--- a/drivers/char/drm/via_drv.h
+++ b/drivers/char/drm/via_drv.h
@@ -29,10 +29,10 @@
 
 #define DRIVER_NAME             "via"
 #define DRIVER_DESC             "VIA Unichrome / Pro"
-#define DRIVER_DATE             "20060529"
+#define DRIVER_DATE             "20061227"
 
 #define DRIVER_MAJOR            2
-#define DRIVER_MINOR            10
+#define DRIVER_MINOR            11
 #define DRIVER_PATCHLEVEL       0
 
 #include "via_verifier.h"
@@ -79,7 +79,7 @@ typedef struct drm_via_private {
         char pci_buf[VIA_PCI_BUF_SIZE];
         const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
         uint32_t num_fire_offsets;
-        int pro_group_a;
+        int chipset;
         drm_via_irq_t via_irqs[VIA_NUM_IRQS];
         unsigned num_irqs;
         maskarray_t *irq_masks;
@@ -96,8 +96,9 @@ typedef struct drm_via_private {
 } drm_via_private_t;
 
 enum via_family {
-        VIA_OTHER = 0,
-        VIA_PRO_GROUP_A,
+  VIA_OTHER = 0,     /* Baseline */
+  VIA_PRO_GROUP_A,   /* Another video engine and DMA commands */
+  VIA_DX9_0          /* Same video as pro_group_a, but 3D is unsupported */
 };
 
 /* VIA MMIO register access */
diff --git a/drivers/char/drm/via_irq.c b/drivers/char/drm/via_irq.c
index c33d068cde19..1ac5941ad237 100644
--- a/drivers/char/drm/via_irq.c
+++ b/drivers/char/drm/via_irq.c
@@ -258,12 +258,16 @@ void via_driver_irq_preinstall(drm_device_t * dev)
                 dev_priv->irq_enable_mask = VIA_IRQ_VBLANK_ENABLE;
                 dev_priv->irq_pending_mask = VIA_IRQ_VBLANK_PENDING;
 
-                dev_priv->irq_masks = (dev_priv->pro_group_a) ?
-                    via_pro_group_a_irqs : via_unichrome_irqs;
-                dev_priv->num_irqs = (dev_priv->pro_group_a) ?
-                    via_num_pro_group_a : via_num_unichrome;
-                dev_priv->irq_map = (dev_priv->pro_group_a) ?
-                        via_irqmap_pro_group_a : via_irqmap_unichrome;
+                if (dev_priv->chipset == VIA_PRO_GROUP_A ||
+                    dev_priv->chipset == VIA_DX9_0) {
+                        dev_priv->irq_masks = via_pro_group_a_irqs;
+                        dev_priv->num_irqs = via_num_pro_group_a;
+                        dev_priv->irq_map = via_irqmap_pro_group_a;
+                } else {
+                        dev_priv->irq_masks = via_unichrome_irqs;
+                        dev_priv->num_irqs = via_num_unichrome;
+                        dev_priv->irq_map = via_irqmap_unichrome;
+                }
 
                 for (i = 0; i < dev_priv->num_irqs; ++i) {
                         atomic_set(&cur_irq->irq_received, 0);
diff --git a/drivers/char/drm/via_map.c b/drivers/char/drm/via_map.c
index 782011e0a58d..4e3fc072aa3b 100644
--- a/drivers/char/drm/via_map.c
+++ b/drivers/char/drm/via_map.c
@@ -106,8 +106,7 @@ int via_driver_load(drm_device_t *dev, unsigned long chipset)
 
         dev->dev_private = (void *)dev_priv;
 
-        if (chipset == VIA_PRO_GROUP_A)
-                dev_priv->pro_group_a = 1;
+        dev_priv->chipset = chipset;
 
         ret = drm_sman_init(&dev_priv->sman, 2, 12, 8);
         if (ret) {
diff --git a/drivers/char/drm/via_verifier.c b/drivers/char/drm/via_verifier.c
index 70c897c88766..2e7e08078287 100644
--- a/drivers/char/drm/via_verifier.c
+++ b/drivers/char/drm/via_verifier.c
@@ -306,6 +306,7 @@ static __inline__ int finish_current_sequence(drm_via_state_t * cur_seq)
                         unsigned long lo = ~0, hi = 0, tmp;
                         uint32_t *addr, *pitch, *height, tex;
                         unsigned i;
+                        int npot;
 
                         if (end > 9)
                                 end = 9;
@@ -316,12 +317,15 @@ static __inline__ int finish_current_sequence(drm_via_state_t * cur_seq)
                             &(cur_seq->t_addr[tex = cur_seq->texture][start]);
                         pitch = &(cur_seq->pitch[tex][start]);
                         height = &(cur_seq->height[tex][start]);
-
+                        npot = cur_seq->tex_npot[tex];
                         for (i = start; i <= end; ++i) {
                                 tmp = *addr++;
                                 if (tmp < lo)
                                         lo = tmp;
-                                tmp += (*height++ << *pitch++);
+                                if (i == 0 && npot)
+                                        tmp += (*height++ * *pitch++);
+                                else
+                                        tmp += (*height++ << *pitch++);
                                 if (tmp > hi)
                                         hi = tmp;
                         }
@@ -443,13 +447,21 @@ investigate_hazard(uint32_t cmd, hazard_t hz, drm_via_state_t * cur_seq)
                 return 0;
         case check_texture_addr3:
                 cur_seq->unfinished = tex_address;
-                tmp = ((cmd >> 24) - 0x2B);
-                cur_seq->pitch[cur_seq->texture][tmp] =
-                    (cmd & 0x00F00000) >> 20;
-                if (!tmp && (cmd & 0x000FFFFF)) {
-                        DRM_ERROR
-                            ("Unimplemented texture level 0 pitch mode.\n");
-                        return 2;
+                tmp = ((cmd >> 24) - HC_SubA_HTXnL0Pit);
+                if (tmp == 0 &&
+                    (cmd & HC_HTXnEnPit_MASK)) {
+                        cur_seq->pitch[cur_seq->texture][tmp] =
+                                (cmd & HC_HTXnLnPit_MASK);
+                        cur_seq->tex_npot[cur_seq->texture] = 1;
+                } else {
+                        cur_seq->pitch[cur_seq->texture][tmp] =
+                                (cmd & HC_HTXnLnPitE_MASK) >> HC_HTXnLnPitE_SHIFT;
+                        cur_seq->tex_npot[cur_seq->texture] = 0;
+                        if (cmd & 0x000FFFFF) {
+                                DRM_ERROR
+                                        ("Unimplemented texture level 0 pitch mode.\n");
+                                return 2;
+                        }
                 }
                 return 0;
         case check_texture_addr4:
@@ -961,7 +973,13 @@ via_verify_command_stream(const uint32_t * buf, unsigned int size,
         uint32_t cmd;
         const uint32_t *buf_end = buf + (size >> 2);
         verifier_state_t state = state_command;
-        int pro_group_a = dev_priv->pro_group_a;
+        int cme_video;
+        int supported_3d;
+
+        cme_video = (dev_priv->chipset == VIA_PRO_GROUP_A ||
+                     dev_priv->chipset == VIA_DX9_0);
+
+        supported_3d = dev_priv->chipset != VIA_DX9_0;
 
         hc_state->dev = dev;
         hc_state->unfinished = no_sequence;
@@ -986,17 +1004,21 @@ via_verify_command_stream(const uint32_t * buf, unsigned int size,
                         state = via_check_vheader6(&buf, buf_end);
                         break;
                 case state_command:
-                        if (HALCYON_HEADER2 == (cmd = *buf))
+                        if ((HALCYON_HEADER2 == (cmd = *buf)) &&
+                            supported_3d)
                                 state = state_header2;
                         else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
                                 state = state_header1;
-                        else if (pro_group_a
+                        else if (cme_video
                                  && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
                                 state = state_vheader5;
-                        else if (pro_group_a
+                        else if (cme_video
                                  && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
                                 state = state_vheader6;
-                        else {
+                        else if ((cmd == HALCYON_HEADER2) && !supported_3d) {
+                                DRM_ERROR("Accelerated 3D is not supported on this chipset yet.\n");
+                                state = state_error;
+                        } else {
                                 DRM_ERROR
                                     ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
                                      cmd);
diff --git a/drivers/char/drm/via_verifier.h b/drivers/char/drm/via_verifier.h
index 256590fcc22a..b77f59df0278 100644
--- a/drivers/char/drm/via_verifier.h
+++ b/drivers/char/drm/via_verifier.h
@@ -43,6 +43,7 @@ typedef struct {
         uint32_t tex_level_lo[2];
         uint32_t tex_level_hi[2];
         uint32_t tex_palette_size[2];
+        uint32_t tex_npot[2];
         drm_via_sequence_t unfinished;
         int agp_texture;
         int multitex;
diff --git a/drivers/char/hvc_beat.c b/drivers/char/hvc_beat.c
new file mode 100644
index 000000000000..6f019f19be71
--- /dev/null
+++ b/drivers/char/hvc_beat.c
@@ -0,0 +1,134 @@
+/*
+ * Beat hypervisor console driver
+ *
+ * (C) Copyright 2006 TOSHIBA CORPORATION
+ *
+ * This code is based on drivers/char/hvc_rtas.c:
+ * (C) Copyright IBM Corporation 2001-2005
+ * (C) Copyright Red Hat, Inc. 2005
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/err.h>
+#include <linux/string.h>
+#include <linux/console.h>
+#include <asm/prom.h>
+#include <asm/hvconsole.h>
+#include <asm/firmware.h>
+
+#include "hvc_console.h"
+
+extern int64_t beat_get_term_char(uint64_t, uint64_t *, uint64_t *, uint64_t *);
+extern int64_t beat_put_term_char(uint64_t, uint64_t, uint64_t, uint64_t);
+
+struct hvc_struct *hvc_beat_dev = NULL;
+
+/* bug: only one queue is available regardless of vtermno */
+static int hvc_beat_get_chars(uint32_t vtermno, char *buf, int cnt)
+{
+        static unsigned char q[sizeof(unsigned long) * 2]
+                __attribute__((aligned(sizeof(unsigned long))));
+        static int qlen = 0;
+        unsigned long got;
+
+again:
+        if (qlen) {
+                if (qlen > cnt) {
+                        memcpy(buf, q, cnt);
+                        qlen -= cnt;
+                        memmove(q + cnt, q, qlen);
+                        return cnt;
+                } else {        /* qlen <= cnt */
+                        int     r;
+
+                        memcpy(buf, q, qlen);
+                        r = qlen;
+                        qlen = 0;
+                        return r;
+                }
+        }
+        if (beat_get_term_char(vtermno, &got,
+                ((unsigned long *)q), ((unsigned long *)q) + 1) == 0) {
+                qlen = got;
+                goto again;
+        }
+        return 0;
+}
+
+static int hvc_beat_put_chars(uint32_t vtermno, const char *buf, int cnt)
+{
+        unsigned long kb[2];
+        int rest, nlen;
+
+        for (rest = cnt; rest > 0; rest -= nlen) {
+                nlen = (rest > 16) ? 16 : rest;
+                memcpy(kb, buf, nlen);
+                beat_put_term_char(vtermno, rest, kb[0], kb[1]);
+                rest -= nlen;
+        }
+        return cnt;
+}
+
+static struct hv_ops hvc_beat_get_put_ops = {
+        .get_chars = hvc_beat_get_chars,
+        .put_chars = hvc_beat_put_chars,
+};
+
+static int hvc_beat_useit = 1;
+
+static int hvc_beat_config(char *p)
+{
+        hvc_beat_useit = simple_strtoul(p, NULL, 0);
+        return 0;
+}
+
+static int hvc_beat_console_init(void)
+{
+        if (hvc_beat_useit && machine_is_compatible("Beat")) {
+                hvc_instantiate(0, 0, &hvc_beat_get_put_ops);
+        }
+        return 0;
+}
+
+/* temp */
+static int hvc_beat_init(void)
+{
+        struct hvc_struct *hp;
+
+        if (!firmware_has_feature(FW_FEATURE_BEAT))
+                return -ENODEV;
+
+        hp = hvc_alloc(0, NO_IRQ, &hvc_beat_get_put_ops, 16);
+        if (IS_ERR(hp))
+                return PTR_ERR(hp);
+        hvc_beat_dev = hp;
+        return 0;
+}
+
+static void __exit hvc_beat_exit(void)
+{
+        if (hvc_beat_dev)
+                hvc_remove(hvc_beat_dev);
+}
+
+module_init(hvc_beat_init);
+module_exit(hvc_beat_exit);
+
+__setup("hvc_beat=", hvc_beat_config);
+
+console_initcall(hvc_beat_console_init);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index f1afd26a509f..a7b33d2f5991 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -1802,7 +1802,7 @@ static __devinit int try_init_acpi(struct SPMITable *spmi)
             return -ENODEV;
         }
 
-        if (spmi->addr.address_space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
+        if (spmi->addr.space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
                 addr_space = IPMI_MEM_ADDR_SPACE;
         else
                 addr_space = IPMI_IO_ADDR_SPACE;
@@ -1848,19 +1848,19 @@ static __devinit int try_init_acpi(struct SPMITable *spmi)
                 info->irq_setup = NULL;
         }
 
-        if (spmi->addr.register_bit_width) {
+        if (spmi->addr.bit_width) {
                 /* A (hopefully) properly formed register bit width. */
-                info->io.regspacing = spmi->addr.register_bit_width / 8;
+                info->io.regspacing = spmi->addr.bit_width / 8;
         } else {
                 info->io.regspacing = DEFAULT_REGSPACING;
         }
         info->io.regsize = info->io.regspacing;
-        info->io.regshift = spmi->addr.register_bit_offset;
+        info->io.regshift = spmi->addr.bit_offset;
 
-        if (spmi->addr.address_space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
+        if (spmi->addr.space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
                 info->io_setup = mem_setup;
                 info->io.addr_type = IPMI_IO_ADDR_SPACE;
-        } else if (spmi->addr.address_space_id == ACPI_ADR_SPACE_SYSTEM_IO) {
+        } else if (spmi->addr.space_id == ACPI_ADR_SPACE_SYSTEM_IO) {
                 info->io_setup = port_setup;
                 info->io.addr_type = IPMI_MEM_ADDR_SPACE;
         } else {
@@ -1888,10 +1888,8 @@ static __devinit void acpi_find_bmc(void)
                 return;
 
         for (i = 0; ; i++) {
-                status = acpi_get_firmware_table("SPMI", i+1,
-                                                 ACPI_LOGICAL_ADDRESSING,
-                                                 (struct acpi_table_header **)
-                                                 &spmi);
+                status = acpi_get_table(ACPI_SIG_SPMI, i+1,
+                                        (struct acpi_table_header **)&spmi);
                 if (status != AE_OK)
                         return;
 
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 13935235e066..7fd3cd5ddf21 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -215,7 +215,7 @@ static void sysrq_handle_showstate_blocked(int key, struct tty_struct *tty)
 }
 static struct sysrq_key_op sysrq_showstate_blocked_op = {
         .handler        = sysrq_handle_showstate_blocked,
-        .help_msg       = "showBlockedTasks",
+        .help_msg       = "shoW-blocked-tasks",
         .action_msg     = "Show Blocked State",
         .enable_mask    = SYSRQ_ENABLE_DUMP,
 };
@@ -315,15 +315,16 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         &sysrq_loglevel_op,             /* 9 */
 
         /*
-         * Don't use for system provided sysrqs, it is handled specially on
-         * sparc and will never arrive
+         * a: Don't use for system provided sysrqs, it is handled specially on
+         * sparc and will never arrive.
          */
         NULL,                           /* a */
         &sysrq_reboot_op,               /* b */
-        &sysrq_crashdump_op,            /* c */
+        &sysrq_crashdump_op,            /* c & ibm_emac driver debug */
         &sysrq_showlocks_op,            /* d */
         &sysrq_term_op,                 /* e */
         &sysrq_moom_op,                 /* f */
+        /* g: May be registered by ppc for kgdb */
         NULL,                           /* g */
         NULL,                           /* h */
         &sysrq_kill_op,                 /* i */
@@ -332,18 +333,19 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         NULL,                           /* l */
         &sysrq_showmem_op,              /* m */
         &sysrq_unrt_op,                 /* n */
-        /* This will often be registered as 'Off' at init time */
+        /* o: This will often be registered as 'Off' at init time */
         NULL,                           /* o */
         &sysrq_showregs_op,             /* p */
         NULL,                           /* q */
-        &sysrq_unraw_op,                        /* r */
+        &sysrq_unraw_op,                /* r */
         &sysrq_sync_op,                 /* s */
         &sysrq_showstate_op,            /* t */
         &sysrq_mountro_op,              /* u */
-        /* May be assigned at init time by SMP VOYAGER */
+        /* v: May be registered at init time by SMP VOYAGER */
         NULL,                           /* v */
-        NULL,                           /* w */
-        &sysrq_showstate_blocked_op,    /* x */
+        &sysrq_showstate_blocked_op,    /* w */
+        /* x: May be registered on ppc/powerpc for xmon */
+        NULL,                           /* x */
         NULL,                           /* y */
         NULL                            /* z */
 };
diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
index a611972024e6..7fca5f470beb 100644
--- a/drivers/char/tpm/tpm_bios.c
+++ b/drivers/char/tpm/tpm_bios.c
@@ -372,10 +372,8 @@ static int read_log(struct tpm_bios_log *log)
         }
 
         /* Find TCPA entry in RSDT (ACPI_LOGICAL_ADDRESSING) */
-        status = acpi_get_firmware_table(ACPI_TCPA_SIG, 1,
-                                         ACPI_LOGICAL_ADDRESSING,
-                                         (struct acpi_table_header **)
-                                         &buff);
+        status = acpi_get_table(ACPI_SIG_TCPA, 1,
+                                (struct acpi_table_header **)&buff);
 
         if (ACPI_FAILURE(status)) {
                 printk(KERN_ERR "%s: ERROR - Could not get TCPA table\n",
@@ -409,7 +407,7 @@ static int read_log(struct tpm_bios_log *log)
 
         log->bios_event_log_end = log->bios_event_log + len;
 
-        acpi_os_map_memory(start, len, (void *) &virt);
+        virt = acpi_os_map_memory(start, len);
 
         memcpy(log->bios_event_log, virt, len);
 
diff --git a/drivers/char/watchdog/booke_wdt.c b/drivers/char/watchdog/booke_wdt.c
index 488902231cc2..0e23f29f71ab 100644
--- a/drivers/char/watchdog/booke_wdt.c
+++ b/drivers/char/watchdog/booke_wdt.c
@@ -35,7 +35,7 @@
 #ifdef  CONFIG_FSL_BOOKE
 #define WDT_PERIOD_DEFAULT 63   /* Ex. wdt_period=28 bus=333Mhz , reset=~40sec */
 #else
-#define WDT_PERIOD_DEFAULT 4    /* Refer to the PPC40x and PPC4xx manuals */
+#define WDT_PERIOD_DEFAULT 3    /* Refer to the PPC40x and PPC4xx manuals */
 #endif                          /* for timing information */
 
 u32 booke_wdt_enabled = 0;
@@ -48,12 +48,22 @@ u32 booke_wdt_period = WDT_PERIOD_DEFAULT;
 #endif
 
 /*
+ * booke_wdt_ping:
+ */
+static __inline__ void booke_wdt_ping(void)
+{
+        mtspr(SPRN_TSR, TSR_ENW|TSR_WIS);
+}
+
+/*
  * booke_wdt_enable:
  */
 static __inline__ void booke_wdt_enable(void)
 {
         u32 val;
 
+        /* clear status before enabling watchdog */
+        booke_wdt_ping();
         val = mfspr(SPRN_TCR);
         val |= (TCR_WIE|TCR_WRC(WRC_CHIP)|WDTP(booke_wdt_period));
 
@@ -61,14 +71,6 @@ static __inline__ void booke_wdt_enable(void)
 }
 
 /*
- * booke_wdt_ping:
- */
-static __inline__ void booke_wdt_ping(void)
-{
-        mtspr(SPRN_TSR, TSR_ENW|TSR_WIS);
-}
-
-/*
  * booke_wdt_write:
  */
 static ssize_t booke_wdt_write (struct file *file, const char __user *buf,
diff --git a/drivers/char/watchdog/machzwd.c b/drivers/char/watchdog/machzwd.c
index 276577d08fba..4d730fdbd528 100644
--- a/drivers/char/watchdog/machzwd.c
+++ b/drivers/char/watchdog/machzwd.c
@@ -325,7 +325,7 @@ static int zf_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
                         return put_user(0, p);
 
                 case WDIOC_KEEPALIVE:
-                        zf_ping(0);
+                        zf_ping(NULL);
                         break;
 
                 default: