40 files changed, 574 insertions, 380 deletions

diff --git a/drivers/char/agp/agp.h b/drivers/char/agp/agp.h
index 8b3317fd46c9..1d59e2a5b9aa 100644
--- a/drivers/char/agp/agp.h
+++ b/drivers/char/agp/agp.h
@@ -225,6 +225,10 @@ struct agp_bridge_data {
 #define I810_GMS_DISABLE        0x00000000
 #define I810_PGETBL_CTL         0x2020
 #define I810_PGETBL_ENABLED     0x00000001
+#define I965_PGETBL_SIZE_MASK   0x0000000e
+#define I965_PGETBL_SIZE_512KB  (0 << 1)
+#define I965_PGETBL_SIZE_256KB  (1 << 1)
+#define I965_PGETBL_SIZE_128KB  (2 << 1)
 #define I810_DRAM_CTL           0x3000
 #define I810_DRAM_ROW_0         0x00000001
 #define I810_DRAM_ROW_0_SDRAM   0x00000001
diff --git a/drivers/char/agp/amd-k7-agp.c b/drivers/char/agp/amd-k7-agp.c
index 51d0d562d01e..c85c8cadb6df 100644
--- a/drivers/char/agp/amd-k7-agp.c
+++ b/drivers/char/agp/amd-k7-agp.c
@@ -101,6 +101,11 @@ static int amd_create_gatt_pages(int nr_tables)
         for (i = 0; i < nr_tables; i++) {
                 entry = kzalloc(sizeof(struct amd_page_map), GFP_KERNEL);
                 if (entry == NULL) {
+                        while (i > 0) {
+                                kfree(tables[i-1]);
+                                i--;
+                        }
+                        kfree(tables);
                         retval = -ENOMEM;
                         break;
                 }
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 2f2c4efff8a3..93d2209fee4c 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -650,6 +650,15 @@ static struct pci_device_id agp_amd64_pci_table[] = {
         .subvendor      = PCI_ANY_ID,
         .subdevice      = PCI_ANY_ID,
         },
+        /* VIA K8M890 / K8N890 */
+        {
+        .class          = (PCI_CLASS_BRIDGE_HOST << 8),
+        .class_mask     = ~0,
+        .vendor         = PCI_VENDOR_ID_VIA,
+        .device         = PCI_DEVICE_ID_VIA_VT3336,
+        .subvendor      = PCI_ANY_ID,
+        .subdevice      = PCI_ANY_ID,
+        },
         /* VIA K8T890 */
         {
         .class          = (PCI_CLASS_BRIDGE_HOST << 8),
diff --git a/drivers/char/agp/ati-agp.c b/drivers/char/agp/ati-agp.c
index f244c6682738..9987dc2e0c3f 100644
--- a/drivers/char/agp/ati-agp.c
+++ b/drivers/char/agp/ati-agp.c
@@ -41,18 +41,18 @@ static struct gatt_mask ati_generic_masks[] =
 };
 
 
-typedef struct _ati_page_map {
+struct ati_page_map {
         unsigned long *real;
         unsigned long __iomem *remapped;
-} ati_page_map;
+};
 
 static struct _ati_generic_private {
         volatile u8 __iomem *registers;
-        ati_page_map **gatt_pages;
+        struct ati_page_map **gatt_pages;
         int num_tables;
 } ati_generic_private;
 
-static int ati_create_page_map(ati_page_map *page_map)
+static int ati_create_page_map(struct ati_page_map *page_map)
 {
         int i, err = 0;
 
@@ -82,7 +82,7 @@ static int ati_create_page_map(ati_page_map *page_map)
 }
 
 
-static void ati_free_page_map(ati_page_map *page_map)
+static void ati_free_page_map(struct ati_page_map *page_map)
 {
         unmap_page_from_agp(virt_to_page(page_map->real));
         iounmap(page_map->remapped);
@@ -94,8 +94,8 @@ static void ati_free_page_map(ati_page_map *page_map)
 static void ati_free_gatt_pages(void)
 {
         int i;
-        ati_page_map **tables;
-        ati_page_map *entry;
+        struct ati_page_map **tables;
+        struct ati_page_map *entry;
 
         tables = ati_generic_private.gatt_pages;
         for (i = 0; i < ati_generic_private.num_tables; i++) {
@@ -112,30 +112,30 @@ static void ati_free_gatt_pages(void)
 
 static int ati_create_gatt_pages(int nr_tables)
 {
-        ati_page_map **tables;
-        ati_page_map *entry;
+        struct ati_page_map **tables;
+        struct ati_page_map *entry;
         int retval = 0;
         int i;
 
-        tables = kzalloc((nr_tables + 1) * sizeof(ati_page_map *),GFP_KERNEL);
+        tables = kzalloc((nr_tables + 1) * sizeof(struct ati_page_map *),GFP_KERNEL);
         if (tables == NULL)
                 return -ENOMEM;
 
         for (i = 0; i < nr_tables; i++) {
-                entry = kzalloc(sizeof(ati_page_map), GFP_KERNEL);
+                entry = kzalloc(sizeof(struct ati_page_map), GFP_KERNEL);
                 if (entry == NULL) {
-                        while (i>0) {
-                                kfree (tables[i-1]);
+                        while (i > 0) {
+                                kfree(tables[i-1]);
                                 i--;
                         }
-                        kfree (tables);
-                        tables = NULL;
+                        kfree(tables);
                         retval = -ENOMEM;
                         break;
                 }
                 tables[i] = entry;
                 retval = ati_create_page_map(entry);
-                if (retval != 0) break;
+                if (retval != 0)
+                        break;
         }
         ati_generic_private.num_tables = nr_tables;
         ati_generic_private.gatt_pages = tables;
@@ -340,7 +340,7 @@ static int ati_remove_memory(struct agp_memory * mem, off_t pg_start,
 static int ati_create_gatt_table(struct agp_bridge_data *bridge)
 {
         struct aper_size_info_lvl2 *value;
-        ati_page_map page_dir;
+        struct ati_page_map page_dir;
         unsigned long addr;
         int retval;
         u32 temp;
@@ -400,7 +400,7 @@ static int ati_create_gatt_table(struct agp_bridge_data *bridge)
 
 static int ati_free_gatt_table(struct agp_bridge_data *bridge)
 {
-        ati_page_map page_dir;
+        struct ati_page_map page_dir;
 
         page_dir.real = (unsigned long *)agp_bridge->gatt_table_real;
         page_dir.remapped = (unsigned long __iomem *)agp_bridge->gatt_table;
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 883a36a27833..3491d6f84bc6 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -965,6 +965,9 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
         if (!bridge)
                 return -EINVAL;
 
+        if (mem->page_count == 0)
+                return 0;
+
         temp = bridge->current_size;
 
         switch (bridge->driver->size_type) {
@@ -1016,8 +1019,8 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 writel(bridge->driver->mask_memory(bridge, mem->memory[i], mem->type), bridge->gatt_table+j);
-                readl(bridge->gatt_table+j);    /* PCI Posting. */
         }
+        readl(bridge->gatt_table+j-1);  /* PCI Posting. */
 
         bridge->driver->tlb_flush(mem);
         return 0;
@@ -1034,6 +1037,9 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
         if (!bridge)
                 return -EINVAL;
 
+        if (mem->page_count == 0)
+                return 0;
+
         if (type != 0 || mem->type != 0) {
                 /* The generic routines know nothing of memory types */
                 return -EINVAL;
@@ -1042,10 +1048,9 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
         /* AK: bogus, should encode addresses > 4GB */
         for (i = pg_start; i < (mem->page_count + pg_start); i++) {
                 writel(bridge->scratch_page, bridge->gatt_table+i);
-                readl(bridge->gatt_table+i);    /* PCI Posting. */
         }
+        readl(bridge->gatt_table+i-1);  /* PCI Posting. */
 
-        global_cache_flush();
         bridge->driver->tlb_flush(mem);
         return 0;
 }
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 555b3a8ab49c..a3011de51f7c 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -207,6 +207,9 @@ static int intel_i810_insert_entries(struct agp_memory *mem, off_t pg_start,
         int i, j, num_entries;
         void *temp;
 
+        if (mem->page_count == 0)
+                return 0;
+
         temp = agp_bridge->current_size;
         num_entries = A_SIZE_FIX(temp)->num_entries;
 
@@ -221,12 +224,16 @@ static int intel_i810_insert_entries(struct agp_memory *mem, off_t pg_start,
         if (type != 0 || mem->type != 0) {
                 if ((type == AGP_DCACHE_MEMORY) && (mem->type == AGP_DCACHE_MEMORY)) {
                         /* special insert */
-                        global_cache_flush();
+                        if (!mem->is_flushed) {
+                                global_cache_flush();
+                                mem->is_flushed = TRUE;
+                        }
+
                         for (i = pg_start; i < (pg_start + mem->page_count); i++) {
                                 writel((i*4096)|I810_PTE_LOCAL|I810_PTE_VALID, intel_i810_private.registers+I810_PTE_BASE+(i*4));
-                                readl(intel_i810_private.registers+I810_PTE_BASE+(i*4));        /* PCI Posting. */
                         }
-                        global_cache_flush();
+                        readl(intel_i810_private.registers+I810_PTE_BASE+((i-1)*4));    /* PCI Posting. */
+
                         agp_bridge->driver->tlb_flush(mem);
                         return 0;
                 }
@@ -236,14 +243,17 @@ static int intel_i810_insert_entries(struct agp_memory *mem, off_t pg_start,
         }
 
 insert:
-        global_cache_flush();
+        if (!mem->is_flushed) {
+                global_cache_flush();
+                mem->is_flushed = TRUE;
+        }
+
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 writel(agp_bridge->driver->mask_memory(agp_bridge,
                         mem->memory[i], mem->type),
                         intel_i810_private.registers+I810_PTE_BASE+(j*4));
-                readl(intel_i810_private.registers+I810_PTE_BASE+(j*4));        /* PCI Posting. */
         }
-        global_cache_flush();
+        readl(intel_i810_private.registers+I810_PTE_BASE+((j-1)*4));    /* PCI Posting. */
 
         agp_bridge->driver->tlb_flush(mem);
         return 0;
@@ -254,12 +264,14 @@ static int intel_i810_remove_entries(struct agp_memory *mem, off_t pg_start,
 {
         int i;
 
+        if (mem->page_count == 0)
+                return 0;
+
         for (i = pg_start; i < (mem->page_count + pg_start); i++) {
                 writel(agp_bridge->scratch_page, intel_i810_private.registers+I810_PTE_BASE+(i*4));
-                readl(intel_i810_private.registers+I810_PTE_BASE+(i*4));        /* PCI Posting. */
         }
+        readl(intel_i810_private.registers+I810_PTE_BASE+((i-1)*4));
 
-        global_cache_flush();
         agp_bridge->driver->tlb_flush(mem);
         return 0;
 }
@@ -370,6 +382,11 @@ static struct _intel_i830_private {
         struct pci_dev *i830_dev;               /* device one */
         volatile u8 __iomem *registers;
         volatile u32 __iomem *gtt;              /* I915G */
+        /* gtt_entries is the number of gtt entries that are already mapped
+         * to stolen memory.  Stolen memory is larger than the memory mapped
+         * through gtt_entries, as it includes some reserved space for the BIOS
+         * popup and for the GTT.
+         */
         int gtt_entries;
 } intel_i830_private;
 
@@ -380,14 +397,41 @@ static void intel_i830_init_gtt_entries(void)
         u8 rdct;
         int local = 0;
         static const int ddt[4] = { 0, 16, 32, 64 };
-        int size;
+        int size; /* reserved space (in kb) at the top of stolen memory */
 
         pci_read_config_word(agp_bridge->dev,I830_GMCH_CTRL,&gmch_ctrl);
 
-        /* We obtain the size of the GTT, which is also stored (for some
-         * reason) at the top of stolen memory. Then we add 4KB to that
-         * for the video BIOS popup, which is also stored in there. */
-        size = agp_bridge->driver->fetch_size() + 4;
+        if (IS_I965) {
+                u32 pgetbl_ctl;
+
+                pci_read_config_dword(agp_bridge->dev, I810_PGETBL_CTL,
+                                      &pgetbl_ctl);
+                /* The 965 has a field telling us the size of the GTT,
+                 * which may be larger than what is necessary to map the
+                 * aperture.
+                 */
+                switch (pgetbl_ctl & I965_PGETBL_SIZE_MASK) {
+                case I965_PGETBL_SIZE_128KB:
+                        size = 128;
+                        break;
+                case I965_PGETBL_SIZE_256KB:
+                        size = 256;
+                        break;
+                case I965_PGETBL_SIZE_512KB:
+                        size = 512;
+                        break;
+                default:
+                        printk(KERN_INFO PFX "Unknown page table size, "
+                               "assuming 512KB\n");
+                        size = 512;
+                }
+                size += 4; /* add in BIOS popup space */
+        } else {
+                /* On previous hardware, the GTT size was just what was
+                 * required to map the aperture.
+                 */
+                size = agp_bridge->driver->fetch_size() + 4;
+        }
 
         if (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82830_HB ||
             agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82845G_HB) {
@@ -576,6 +620,9 @@ static int intel_i830_insert_entries(struct agp_memory *mem,off_t pg_start, int
         int i,j,num_entries;
         void *temp;
 
+        if (mem->page_count == 0)
+                return 0;
+
         temp = agp_bridge->current_size;
         num_entries = A_SIZE_FIX(temp)->num_entries;
 
@@ -598,16 +645,18 @@ static int intel_i830_insert_entries(struct agp_memory *mem,off_t pg_start, int
                 (mem->type != 0 && mem->type != AGP_PHYS_MEMORY))
                 return -EINVAL;
 
-        global_cache_flush();   /* FIXME: Necessary ?*/
+        if (!mem->is_flushed) {
+                global_cache_flush();
+                mem->is_flushed = TRUE;
+        }
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 writel(agp_bridge->driver->mask_memory(agp_bridge,
                         mem->memory[i], mem->type),
                         intel_i830_private.registers+I810_PTE_BASE+(j*4));
-                readl(intel_i830_private.registers+I810_PTE_BASE+(j*4));        /* PCI Posting. */
         }
+        readl(intel_i830_private.registers+I810_PTE_BASE+((j-1)*4));
 
-        global_cache_flush();
         agp_bridge->driver->tlb_flush(mem);
         return 0;
 }
@@ -617,7 +666,8 @@ static int intel_i830_remove_entries(struct agp_memory *mem,off_t pg_start,
 {
         int i;
 
-        global_cache_flush();
+        if (mem->page_count == 0)
+                return 0;
 
         if (pg_start < intel_i830_private.gtt_entries) {
                 printk (KERN_INFO PFX "Trying to disable local/stolen memory\n");
@@ -626,10 +676,9 @@ static int intel_i830_remove_entries(struct agp_memory *mem,off_t pg_start,
 
         for (i = pg_start; i < (mem->page_count + pg_start); i++) {
                 writel(agp_bridge->scratch_page, intel_i830_private.registers+I810_PTE_BASE+(i*4));
-                readl(intel_i830_private.registers+I810_PTE_BASE+(i*4));        /* PCI Posting. */
         }
+        readl(intel_i830_private.registers+I810_PTE_BASE+((i-1)*4));
 
-        global_cache_flush();
         agp_bridge->driver->tlb_flush(mem);
         return 0;
 }
@@ -686,6 +735,9 @@ static int intel_i915_insert_entries(struct agp_memory *mem,off_t pg_start,
         int i,j,num_entries;
         void *temp;
 
+        if (mem->page_count == 0)
+                return 0;
+
         temp = agp_bridge->current_size;
         num_entries = A_SIZE_FIX(temp)->num_entries;
 
@@ -708,15 +760,17 @@ static int intel_i915_insert_entries(struct agp_memory *mem,off_t pg_start,
                 (mem->type != 0 && mem->type != AGP_PHYS_MEMORY))
                 return -EINVAL;
 
-        global_cache_flush();
+        if (!mem->is_flushed) {
+                global_cache_flush();
+                mem->is_flushed = TRUE;
+        }
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 writel(agp_bridge->driver->mask_memory(agp_bridge,
                         mem->memory[i], mem->type), intel_i830_private.gtt+j);
-                readl(intel_i830_private.gtt+j);        /* PCI Posting. */
         }
+        readl(intel_i830_private.gtt+j-1);
 
-        global_cache_flush();
         agp_bridge->driver->tlb_flush(mem);
         return 0;
 }
@@ -726,7 +780,8 @@ static int intel_i915_remove_entries(struct agp_memory *mem,off_t pg_start,
 {
         int i;
 
-        global_cache_flush();
+        if (mem->page_count == 0)
+                return 0;
 
         if (pg_start < intel_i830_private.gtt_entries) {
                 printk (KERN_INFO PFX "Trying to disable local/stolen memory\n");
@@ -735,30 +790,34 @@ static int intel_i915_remove_entries(struct agp_memory *mem,off_t pg_start,
 
         for (i = pg_start; i < (mem->page_count + pg_start); i++) {
                 writel(agp_bridge->scratch_page, intel_i830_private.gtt+i);
-                readl(intel_i830_private.gtt+i);
         }
+        readl(intel_i830_private.gtt+i-1);
 
-        global_cache_flush();
         agp_bridge->driver->tlb_flush(mem);
         return 0;
 }
 
-static int intel_i915_fetch_size(void)
+/* Return the aperture size by just checking the resource length.  The effect
+ * described in the spec of the MSAC registers is just changing of the
+ * resource size.
+ */
+static int intel_i9xx_fetch_size(void)
 {
-        struct aper_size_info_fixed *values;
-        u32 temp, offset;
+        int num_sizes = sizeof(intel_i830_sizes) / sizeof(*intel_i830_sizes);
+        int aper_size; /* size in megabytes */
+        int i;
 
-#define I915_256MB_ADDRESS_MASK (1<<27)
+        aper_size = pci_resource_len(intel_i830_private.i830_dev, 2) / MB(1);
 
-        values = A_SIZE_FIX(agp_bridge->driver->aperture_sizes);
+        for (i = 0; i < num_sizes; i++) {
+                if (aper_size == intel_i830_sizes[i].size) {
+                        agp_bridge->current_size = intel_i830_sizes + i;
+                        agp_bridge->previous_size = agp_bridge->current_size;
+                        return aper_size;
+                }
+        }
 
-        pci_read_config_dword(intel_i830_private.i830_dev, I915_GMADDR, &temp);
-        if (temp & I915_256MB_ADDRESS_MASK)
-                offset = 0;     /* 128MB aperture */
-        else
-                offset = 2;     /* 256MB aperture */
-        agp_bridge->previous_size = agp_bridge->current_size = (void *)(values + offset);
-        return values[offset].size;
+        return 0;
 }
 
 /* The intel i915 automatically initializes the agp aperture during POST.
@@ -821,40 +880,9 @@ static unsigned long intel_i965_mask_memory(struct agp_bridge_data *bridge,
         return addr | bridge->driver->masks[type].mask;
 }
 
-static int intel_i965_fetch_size(void)
-{
-       struct aper_size_info_fixed *values;
-       u32 offset = 0;
-       u8 temp;
-
-#define I965_512MB_ADDRESS_MASK (3<<1)
-
-       values = A_SIZE_FIX(agp_bridge->driver->aperture_sizes);
-
-       pci_read_config_byte(intel_i830_private.i830_dev, I965_MSAC, &temp);
-       temp &= I965_512MB_ADDRESS_MASK;
-       switch (temp) {
-       case 0x00:
-               offset = 0; /* 128MB */
-               break;
-       case 0x06:
-               offset = 3; /* 512MB */
-               break;
-       default:
-       case 0x02:
-               offset = 2; /* 256MB */
-               break;
-       }
-
-       agp_bridge->previous_size = agp_bridge->current_size = (void *)(values + offset);
-
-        /* The i965 GTT is always sized as if it had a 512kB aperture size */
-        return 512;
-}
-
 /* The intel i965 automatically initializes the agp aperture during POST.
-+ * Use the memory already set aside for in the GTT.
-+ */
+ * Use the memory already set aside for in the GTT.
+ */
 static int intel_i965_create_gatt_table(struct agp_bridge_data *bridge)
 {
        int page_order;
@@ -1574,7 +1602,7 @@ static struct agp_bridge_driver intel_915_driver = {
         .num_aperture_sizes     = 4,
         .needs_scratch_page     = TRUE,
         .configure              = intel_i915_configure,
-        .fetch_size             = intel_i915_fetch_size,
+        .fetch_size             = intel_i9xx_fetch_size,
         .cleanup                = intel_i915_cleanup,
         .tlb_flush              = intel_i810_tlbflush,
         .mask_memory            = intel_i810_mask_memory,
@@ -1598,7 +1626,7 @@ static struct agp_bridge_driver intel_i965_driver = {
        .num_aperture_sizes     = 4,
        .needs_scratch_page     = TRUE,
        .configure              = intel_i915_configure,
-       .fetch_size             = intel_i965_fetch_size,
+       .fetch_size             = intel_i9xx_fetch_size,
        .cleanup                = intel_i915_cleanup,
        .tlb_flush              = intel_i810_tlbflush,
        .mask_memory            = intel_i965_mask_memory,
@@ -1927,6 +1955,15 @@ static int agp_intel_resume(struct pci_dev *pdev)
 
         pci_restore_state(pdev);
 
+        /* We should restore our graphics device's config space,
+         * as host bridge (00:00) resumes before graphics device (02:00),
+         * then our access to its pci space can work right.
+         */
+        if (intel_i810_private.i810_dev)
+                pci_restore_state(intel_i810_private.i810_dev);
+        if (intel_i830_private.i830_dev)
+                pci_restore_state(intel_i830_private.i830_dev);
+
         if (bridge->driver == &intel_generic_driver)
                 intel_configure();
         else if (bridge->driver == &intel_850_driver)
diff --git a/drivers/char/agp/sgi-agp.c b/drivers/char/agp/sgi-agp.c
index d73be4c2db8a..902648db7efa 100644
--- a/drivers/char/agp/sgi-agp.c
+++ b/drivers/char/agp/sgi-agp.c
@@ -281,10 +281,11 @@ static int __devinit agp_sgi_init(void)
         else
                 return 0;
 
-        sgi_tioca_agp_bridges =
-            (struct agp_bridge_data **)kmalloc(tioca_gart_found *
-                                               sizeof(struct agp_bridge_data *),
-                                               GFP_KERNEL);
+        sgi_tioca_agp_bridges = kmalloc(tioca_gart_found *
+                                        sizeof(struct agp_bridge_data *),
+                                        GFP_KERNEL);
+        if (!sgi_tioca_agp_bridges)
+                return -ENOMEM;
 
         j = 0;
         list_for_each_entry(info, &tioca_list, ca_list) {
diff --git a/drivers/char/agp/via-agp.c b/drivers/char/agp/via-agp.c
index c149ac9ce9a7..2ded7a280d7f 100644
--- a/drivers/char/agp/via-agp.c
+++ b/drivers/char/agp/via-agp.c
@@ -380,9 +380,23 @@ static struct agp_device_ids via_agp_device_ids[] __devinitdata =
         /* P4M800CE */
         {
                 .device_id      = PCI_DEVICE_ID_VIA_P4M800CE,
-                .chipset_name   = "P4M800CE",
+                .chipset_name   = "VT3314",
+        },
+        /* CX700 */
+        {
+                .device_id  = PCI_DEVICE_ID_VIA_CX700,
+                .chipset_name   = "CX700",
+        },
+        /* VT3336 */
+        {
+                .device_id  = PCI_DEVICE_ID_VIA_VT3336,
+                .chipset_name   = "VT3336",
+        },
+        /* P4M890 */
+        {
+                .device_id  = PCI_DEVICE_ID_VIA_P4M890,
+                .chipset_name   = "P4M890",
         },
-
         { }, /* dummy final entry, always present */
 };
 
@@ -524,6 +538,9 @@ static const struct pci_device_id agp_via_pci_table[] = {
         ID(PCI_DEVICE_ID_VIA_83_87XX_1),
         ID(PCI_DEVICE_ID_VIA_3296_0),
         ID(PCI_DEVICE_ID_VIA_P4M800CE),
+        ID(PCI_DEVICE_ID_VIA_CX700),
+        ID(PCI_DEVICE_ID_VIA_VT3336),
+        ID(PCI_DEVICE_ID_VIA_P4M890),
         { }
 };
 
diff --git a/drivers/char/drm/drmP.h b/drivers/char/drm/drmP.h
index 0bbb04f2390f..6dcdceb81203 100644
--- a/drivers/char/drm/drmP.h
+++ b/drivers/char/drm/drmP.h
@@ -561,8 +561,7 @@ struct drm_driver {
         int (*context_dtor) (struct drm_device * dev, int context);
         int (*kernel_context_switch) (struct drm_device * dev, int old,
                                       int new);
-        void (*kernel_context_switch_unlock) (struct drm_device * dev,
-                                              drm_lock_t *lock);
+        void (*kernel_context_switch_unlock) (struct drm_device * dev);
         int (*vblank_wait) (struct drm_device * dev, unsigned int *sequence);
         int (*vblank_wait2) (struct drm_device * dev, unsigned int *sequence);
         int (*dri_library_name) (struct drm_device *dev, char *buf);
@@ -1143,9 +1142,5 @@ extern void *drm_calloc(size_t nmemb, size_t size, int area);
 extern unsigned long drm_core_get_map_ofs(drm_map_t * map);
 extern unsigned long drm_core_get_reg_ofs(struct drm_device *dev);
 
-#ifndef pci_pretty_name
-#define pci_pretty_name(dev) ""
-#endif
-
 #endif                          /* __KERNEL__ */
 #endif
diff --git a/drivers/char/drm/drm_lock.c b/drivers/char/drm/drm_lock.c
index 116ed0f2ac09..e9993ba461a2 100644
--- a/drivers/char/drm/drm_lock.c
+++ b/drivers/char/drm/drm_lock.c
@@ -182,7 +182,7 @@ int drm_unlock(struct inode *inode, struct file *filp,
          * modules but is required by the Sparc driver.
          */
         if (dev->driver->kernel_context_switch_unlock)
-                dev->driver->kernel_context_switch_unlock(dev, &lock);
+                dev->driver->kernel_context_switch_unlock(dev);
         else {
                 drm_lock_transfer(dev, &dev->lock.hw_lock->lock,
                                   DRM_KERNEL_CONTEXT);
diff --git a/drivers/char/drm/drm_stub.c b/drivers/char/drm/drm_stub.c
index 5fd6dc0870cf..120d10256feb 100644
--- a/drivers/char/drm/drm_stub.c
+++ b/drivers/char/drm/drm_stub.c
@@ -211,14 +211,16 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
         if (!dev)
                 return -ENOMEM;
 
-        pci_enable_device(pdev);
+        ret = pci_enable_device(pdev);
+        if (ret)
+                goto err_g1;
 
         if ((ret = drm_fill_in_dev(dev, pdev, ent, driver))) {
                 printk(KERN_ERR "DRM: Fill_in_dev failed.\n");
-                goto err_g1;
+                goto err_g2;
         }
         if ((ret = drm_get_head(dev, &dev->primary)))
-                goto err_g1;
+                goto err_g2;
         
         DRM_INFO("Initialized %s %d.%d.%d %s on minor %d\n",
                  driver->name, driver->major, driver->minor, driver->patchlevel,
@@ -226,7 +228,9 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
 
         return 0;
 
-      err_g1:
+err_g2:
+        pci_disable_device(pdev);
+err_g1:
         drm_free(dev, sizeof(*dev), DRM_MEM_STUB);
         return ret;
 }
diff --git a/drivers/char/drm/drm_sysfs.c b/drivers/char/drm/drm_sysfs.c
index ba4b8de83cf0..cc8e2ebe128c 100644
--- a/drivers/char/drm/drm_sysfs.c
+++ b/drivers/char/drm/drm_sysfs.c
@@ -45,8 +45,8 @@ struct class *drm_sysfs_create(struct module *owner, char *name)
         int err;
 
         class = class_create(owner, name);
-        if (!class) {
-                err = -ENOMEM;
+        if (IS_ERR(class)) {
+                err = PTR_ERR(class);
                 goto err_out;
         }
 
@@ -113,8 +113,8 @@ struct class_device *drm_sysfs_device_add(struct class *cs, drm_head_t *head)
                                         MKDEV(DRM_MAJOR, head->minor),
                                         &(head->dev->pdev)->dev,
                                         "card%d", head->minor);
-        if (!class_dev) {
-                err = -ENOMEM;
+        if (IS_ERR(class_dev)) {
+                err = PTR_ERR(class_dev);
                 goto err_out;
         }
 
diff --git a/drivers/char/drm/i915_irq.c b/drivers/char/drm/i915_irq.c
index e5463b111fc0..78c1ae28f17c 100644
--- a/drivers/char/drm/i915_irq.c
+++ b/drivers/char/drm/i915_irq.c
@@ -46,88 +46,167 @@ static void i915_vblank_tasklet(drm_device_t *dev)
 {
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
         unsigned long irqflags;
-        struct list_head *list, *tmp;
+        struct list_head *list, *tmp, hits, *hit;
+        int nhits, nrects, slice[2], upper[2], lower[2], i;
+        unsigned counter[2] = { atomic_read(&dev->vbl_received),
+                                atomic_read(&dev->vbl_received2) };
+        drm_drawable_info_t *drw;
+        drm_i915_sarea_t *sarea_priv = dev_priv->sarea_priv;
+        u32 cpp = dev_priv->cpp;
+        u32 cmd = (cpp == 4) ? (XY_SRC_COPY_BLT_CMD |
+                                XY_SRC_COPY_BLT_WRITE_ALPHA |
+                                XY_SRC_COPY_BLT_WRITE_RGB)
+                             : XY_SRC_COPY_BLT_CMD;
+        u32 pitchropcpp = (sarea_priv->pitch * cpp) | (0xcc << 16) |
+                          (cpp << 23) | (1 << 24);
+        RING_LOCALS;
 
         DRM_DEBUG("\n");
 
+        INIT_LIST_HEAD(&hits);
+
+        nhits = nrects = 0;
+
         spin_lock_irqsave(&dev_priv->swaps_lock, irqflags);
 
+        /* Find buffer swaps scheduled for this vertical blank */
         list_for_each_safe(list, tmp, &dev_priv->vbl_swaps.head) {
                 drm_i915_vbl_swap_t *vbl_swap =
                         list_entry(list, drm_i915_vbl_swap_t, head);
-                atomic_t *counter = vbl_swap->pipe ? &dev->vbl_received2 :
-                        &dev->vbl_received;
-
-                if ((atomic_read(counter) - vbl_swap->sequence) <= (1<<23)) {
-                        drm_drawable_info_t *drw;
-
-                        spin_unlock(&dev_priv->swaps_lock);
-
-                        spin_lock(&dev->drw_lock);
-
-                        drw = drm_get_drawable_info(dev, vbl_swap->drw_id);
-                                
-                        if (drw) {
-                                int i, num_rects = drw->num_rects;
-                                drm_clip_rect_t *rect = drw->rects;
-                                drm_i915_sarea_t *sarea_priv =
-                                    dev_priv->sarea_priv;
-                                u32 cpp = dev_priv->cpp;
-                                u32 cmd = (cpp == 4) ? (XY_SRC_COPY_BLT_CMD |
-                                                        XY_SRC_COPY_BLT_WRITE_ALPHA |
-                                                        XY_SRC_COPY_BLT_WRITE_RGB)
-                                                     : XY_SRC_COPY_BLT_CMD;
-                                u32 pitchropcpp = (sarea_priv->pitch * cpp) |
-                                                  (0xcc << 16) | (cpp << 23) |
-                                                  (1 << 24);
-                                RING_LOCALS;
-
-                                i915_kernel_lost_context(dev);
-
-                                BEGIN_LP_RING(6);
-
-                                OUT_RING(GFX_OP_DRAWRECT_INFO);
-                                OUT_RING(0);
-                                OUT_RING(0);
-                                OUT_RING(sarea_priv->width |
-                                         sarea_priv->height << 16);
-                                OUT_RING(sarea_priv->width |
-                                         sarea_priv->height << 16);
-                                OUT_RING(0);
 
-                                ADVANCE_LP_RING();
+                if ((counter[vbl_swap->pipe] - vbl_swap->sequence) > (1<<23))
+                        continue;
+
+                list_del(list);
+                dev_priv->swaps_pending--;
 
-                                sarea_priv->ctxOwner = DRM_KERNEL_CONTEXT;
+                spin_unlock(&dev_priv->swaps_lock);
+                spin_lock(&dev->drw_lock);
 
-                                for (i = 0; i < num_rects; i++, rect++) {
-                                        BEGIN_LP_RING(8);
+                drw = drm_get_drawable_info(dev, vbl_swap->drw_id);
+
+                if (!drw) {
+                        spin_unlock(&dev->drw_lock);
+                        drm_free(vbl_swap, sizeof(*vbl_swap), DRM_MEM_DRIVER);
+                        spin_lock(&dev_priv->swaps_lock);
+                        continue;
+                }
 
-                                        OUT_RING(cmd);
-                                        OUT_RING(pitchropcpp);
-                                        OUT_RING((rect->y1 << 16) | rect->x1);
-                                        OUT_RING((rect->y2 << 16) | rect->x2);
-                                        OUT_RING(sarea_priv->front_offset);
-                                        OUT_RING((rect->y1 << 16) | rect->x1);
-                                        OUT_RING(pitchropcpp & 0xffff);
-                                        OUT_RING(sarea_priv->back_offset);
+                list_for_each(hit, &hits) {
+                        drm_i915_vbl_swap_t *swap_cmp =
+                                list_entry(hit, drm_i915_vbl_swap_t, head);
+                        drm_drawable_info_t *drw_cmp =
+                                drm_get_drawable_info(dev, swap_cmp->drw_id);
 
-                                        ADVANCE_LP_RING();
-                                }
+                        if (drw_cmp &&
+                            drw_cmp->rects[0].y1 > drw->rects[0].y1) {
+                                list_add_tail(list, hit);
+                                break;
                         }
+                }
 
-                        spin_unlock(&dev->drw_lock);
+                spin_unlock(&dev->drw_lock);
 
-                        spin_lock(&dev_priv->swaps_lock);
+                /* List of hits was empty, or we reached the end of it */
+                if (hit == &hits)
+                        list_add_tail(list, hits.prev);
 
-                        list_del(list);
+                nhits++;
 
-                        drm_free(vbl_swap, sizeof(*vbl_swap), DRM_MEM_DRIVER);
+                spin_lock(&dev_priv->swaps_lock);
+        }
+
+        if (nhits == 0) {
+                spin_unlock_irqrestore(&dev_priv->swaps_lock, irqflags);
+                return;
+        }
+
+        spin_unlock(&dev_priv->swaps_lock);
 
-                        dev_priv->swaps_pending--;
+        i915_kernel_lost_context(dev);
+
+        BEGIN_LP_RING(6);
+
+        OUT_RING(GFX_OP_DRAWRECT_INFO);
+        OUT_RING(0);
+        OUT_RING(0);
+        OUT_RING(sarea_priv->width | sarea_priv->height << 16);
+        OUT_RING(sarea_priv->width | sarea_priv->height << 16);
+        OUT_RING(0);
+
+        ADVANCE_LP_RING();
+
+        sarea_priv->ctxOwner = DRM_KERNEL_CONTEXT;
+
+        upper[0] = upper[1] = 0;
+        slice[0] = max(sarea_priv->pipeA_h / nhits, 1);
+        slice[1] = max(sarea_priv->pipeB_h / nhits, 1);
+        lower[0] = sarea_priv->pipeA_y + slice[0];
+        lower[1] = sarea_priv->pipeB_y + slice[0];
+
+        spin_lock(&dev->drw_lock);
+
+        /* Emit blits for buffer swaps, partitioning both outputs into as many
+         * slices as there are buffer swaps scheduled in order to avoid tearing
+         * (based on the assumption that a single buffer swap would always
+         * complete before scanout starts).
+         */
+        for (i = 0; i++ < nhits;
+             upper[0] = lower[0], lower[0] += slice[0],
+             upper[1] = lower[1], lower[1] += slice[1]) {
+                if (i == nhits)
+                        lower[0] = lower[1] = sarea_priv->height;
+
+                list_for_each(hit, &hits) {
+                        drm_i915_vbl_swap_t *swap_hit =
+                                list_entry(hit, drm_i915_vbl_swap_t, head);
+                        drm_clip_rect_t *rect;
+                        int num_rects, pipe;
+                        unsigned short top, bottom;
+
+                        drw = drm_get_drawable_info(dev, swap_hit->drw_id);
+
+                        if (!drw)
+                                continue;
+
+                        rect = drw->rects;
+                        pipe = swap_hit->pipe;
+                        top = upper[pipe];
+                        bottom = lower[pipe];
+
+                        for (num_rects = drw->num_rects; num_rects--; rect++) {
+                                int y1 = max(rect->y1, top);
+                                int y2 = min(rect->y2, bottom);
+
+                                if (y1 >= y2)
+                                        continue;
+
+                                BEGIN_LP_RING(8);
+
+                                OUT_RING(cmd);
+                                OUT_RING(pitchropcpp);
+                                OUT_RING((y1 << 16) | rect->x1);
+                                OUT_RING((y2 << 16) | rect->x2);
+                                OUT_RING(sarea_priv->front_offset);
+                                OUT_RING((y1 << 16) | rect->x1);
+                                OUT_RING(pitchropcpp & 0xffff);
+                                OUT_RING(sarea_priv->back_offset);
+
+                                ADVANCE_LP_RING();
+                        }
                 }
         }
 
-        spin_unlock_irqrestore(&dev_priv->swaps_lock, irqflags);
+        spin_unlock_irqrestore(&dev->drw_lock, irqflags);
+
+        list_for_each_safe(hit, tmp, &hits) {
+                drm_i915_vbl_swap_t *swap_hit =
+                        list_entry(hit, drm_i915_vbl_swap_t, head);
+
+                list_del(hit);
+
+                drm_free(swap_hit, sizeof(*swap_hit), DRM_MEM_DRIVER);
+        }
 }
 
 irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
@@ -421,7 +500,7 @@ int i915_vblank_swap(DRM_IOCTL_ARGS)
 
         if (!drm_get_drawable_info(dev, swap.drawable)) {
                 spin_unlock_irqrestore(&dev->drw_lock, irqflags);
-                DRM_ERROR("Invalid drawable ID %d\n", swap.drawable);
+                DRM_DEBUG("Invalid drawable ID %d\n", swap.drawable);
                 return DRM_ERR(EINVAL);
         }
 
diff --git a/drivers/char/drm/r128_drm.h b/drivers/char/drm/r128_drm.h
index 5d835b006f55..6e8af313f2b4 100644
--- a/drivers/char/drm/r128_drm.h
+++ b/drivers/char/drm/r128_drm.h
@@ -1,7 +1,8 @@
 /* r128_drm.h -- Public header for the r128 driver -*- linux-c -*-
  * Created: Wed Apr  5 19:24:19 2000 by kevin@precisioninsight.com
  */
-/* Copyright 2000 Precision Insight, Inc., Cedar Park, Texas.
+/*
+ * Copyright 2000 Precision Insight, Inc., Cedar Park, Texas.
  * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
  * All rights reserved.
  *
diff --git a/drivers/char/drm/r128_drv.h b/drivers/char/drm/r128_drv.h
index 94abffb2cca5..f1efb49de8df 100644
--- a/drivers/char/drm/r128_drv.h
+++ b/drivers/char/drm/r128_drv.h
@@ -1,7 +1,8 @@
 /* r128_drv.h -- Private header for r128 driver -*- linux-c -*-
  * Created: Mon Dec 13 09:51:11 1999 by faith@precisioninsight.com
  */
-/* Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
+/*
+ * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
  * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
  * All rights reserved.
  *
diff --git a/drivers/char/drm/r128_state.c b/drivers/char/drm/r128_state.c
index a080cdd6081e..17b11e7d8f32 100644
--- a/drivers/char/drm/r128_state.c
+++ b/drivers/char/drm/r128_state.c
@@ -1,7 +1,8 @@
 /* r128_state.c -- State support for r128 -*- linux-c -*-
  * Created: Thu Jan 27 02:53:43 2000 by gareth@valinux.com
  */
-/* Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
+/*
+ * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
  * All Rights Reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
diff --git a/drivers/char/drm/r300_cmdbuf.c b/drivers/char/drm/r300_cmdbuf.c
index d14477ba3679..032a022ec6a8 100644
--- a/drivers/char/drm/r300_cmdbuf.c
+++ b/drivers/char/drm/r300_cmdbuf.c
@@ -242,26 +242,6 @@ static __inline__ int r300_check_range(unsigned reg, int count)
         return 0;
 }
 
-/*
- * we expect offsets passed to the framebuffer to be either within video 
- * memory or within AGP space 
- */
-static __inline__ int r300_check_offset(drm_radeon_private_t *dev_priv,
-                                        u32 offset)
-{
-        /* we realy want to check against end of video aperture
-           but this value is not being kept.
-           This code is correct for now (does the same thing as the
-           code that sets MC_FB_LOCATION) in radeon_cp.c */
-        if (offset >= dev_priv->fb_location &&
-            offset < (dev_priv->fb_location + dev_priv->fb_size))
-                return 0;
-        if (offset >= dev_priv->gart_vm_start &&
-            offset < (dev_priv->gart_vm_start + dev_priv->gart_size))
-                return 0;
-        return 1;
-}
-
 static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t *
                                                           dev_priv,
                                                           drm_radeon_kcmd_buffer_t
@@ -290,7 +270,7 @@ static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t *
                 case MARK_SAFE:
                         break;
                 case MARK_CHECK_OFFSET:
-                        if (r300_check_offset(dev_priv, (u32) values[i])) {
+                        if (!radeon_check_offset(dev_priv, (u32) values[i])) {
                                 DRM_ERROR
                                     ("Offset failed range check (reg=%04x sz=%d)\n",
                                      reg, sz);
@@ -452,7 +432,7 @@ static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t *dev_priv,
         i = 1;
         while ((k < narrays) && (i < (count + 1))) {
                 i++;            /* skip attribute field */
-                if (r300_check_offset(dev_priv, payload[i])) {
+                if (!radeon_check_offset(dev_priv, payload[i])) {
                         DRM_ERROR
                             ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n",
                              k, i);
@@ -463,7 +443,7 @@ static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t *dev_priv,
                 if (k == narrays)
                         break;
                 /* have one more to process, they come in pairs */
-                if (r300_check_offset(dev_priv, payload[i])) {
+                if (!radeon_check_offset(dev_priv, payload[i])) {
                         DRM_ERROR
                             ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n",
                              k, i);
@@ -508,7 +488,7 @@ static __inline__ int r300_emit_bitblt_multi(drm_radeon_private_t *dev_priv,
                 if (cmd[1] & (RADEON_GMC_SRC_PITCH_OFFSET_CNTL 
                               | RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
                         offset = cmd[2] << 10;
-                        ret = r300_check_offset(dev_priv, offset);
+                        ret = !radeon_check_offset(dev_priv, offset);
                         if (ret) {
                                 DRM_ERROR("Invalid bitblt first offset is %08X\n", offset);
                                 return DRM_ERR(EINVAL);
@@ -518,7 +498,7 @@ static __inline__ int r300_emit_bitblt_multi(drm_radeon_private_t *dev_priv,
                 if ((cmd[1] & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
                     (cmd[1] & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
                         offset = cmd[3] << 10;
-                        ret = r300_check_offset(dev_priv, offset);
+                        ret = !radeon_check_offset(dev_priv, offset);
                         if (ret) {
                                 DRM_ERROR("Invalid bitblt second offset is %08X\n", offset);
                                 return DRM_ERR(EINVAL);
@@ -551,7 +531,7 @@ static __inline__ int r300_emit_indx_buffer(drm_radeon_private_t *dev_priv,
                 DRM_ERROR("Invalid indx_buffer reg address %08X\n", cmd[1]);
                 return DRM_ERR(EINVAL);
         }
-        ret = r300_check_offset(dev_priv, cmd[2]);
+        ret = !radeon_check_offset(dev_priv, cmd[2]);
         if (ret) {
                 DRM_ERROR("Invalid indx_buffer offset is %08X\n", cmd[2]);
                 return DRM_ERR(EINVAL);
diff --git a/drivers/char/drm/radeon_drv.h b/drivers/char/drm/radeon_drv.h
index f45cd7f147a5..8b105f1460a7 100644
--- a/drivers/char/drm/radeon_drv.h
+++ b/drivers/char/drm/radeon_drv.h
@@ -303,6 +303,21 @@ extern int radeon_no_wb;
 extern drm_ioctl_desc_t radeon_ioctls[];
 extern int radeon_max_ioctl;
 
+/* Check whether the given hardware address is inside the framebuffer or the
+ * GART area.
+ */
+static __inline__ int radeon_check_offset(drm_radeon_private_t *dev_priv,
+                                          u64 off)
+{
+        u32 fb_start = dev_priv->fb_location;
+        u32 fb_end = fb_start + dev_priv->fb_size - 1;
+        u32 gart_start = dev_priv->gart_vm_start;
+        u32 gart_end = gart_start + dev_priv->gart_size - 1;
+
+        return ((off >= fb_start && off <= fb_end) ||
+                (off >= gart_start && off <= gart_end));
+}
+
                                 /* radeon_cp.c */
 extern int radeon_cp_init(DRM_IOCTL_ARGS);
 extern int radeon_cp_start(DRM_IOCTL_ARGS);
diff --git a/drivers/char/drm/radeon_irq.c b/drivers/char/drm/radeon_irq.c
index d60519de887b..3ff0baa2fbfa 100644
--- a/drivers/char/drm/radeon_irq.c
+++ b/drivers/char/drm/radeon_irq.c
@@ -1,5 +1,5 @@
-/* radeon_irq.c -- IRQ handling for radeon -*- linux-c -*-
- *
+/* radeon_irq.c -- IRQ handling for radeon -*- linux-c -*- */
+/*
  * Copyright (C) The Weather Channel, Inc.  2002.  All Rights Reserved.
  *
  * The Weather Channel (TM) funded Tungsten Graphics to develop the
diff --git a/drivers/char/drm/radeon_mem.c b/drivers/char/drm/radeon_mem.c
index 030a6fad0d86..517cad8b6e3a 100644
--- a/drivers/char/drm/radeon_mem.c
+++ b/drivers/char/drm/radeon_mem.c
@@ -1,5 +1,5 @@
-/* radeon_mem.c -- Simple GART/fb memory manager for radeon -*- linux-c -*-
- *
+/* radeon_mem.c -- Simple GART/fb memory manager for radeon -*- linux-c -*- */
+/*
  * Copyright (C) The Weather Channel, Inc.  2002.  All Rights Reserved.
  *
  * The Weather Channel (TM) funded Tungsten Graphics to develop the
diff --git a/drivers/char/drm/radeon_state.c b/drivers/char/drm/radeon_state.c
index 6e04fdd732ac..938eccb78cc0 100644
--- a/drivers/char/drm/radeon_state.c
+++ b/drivers/char/drm/radeon_state.c
@@ -43,10 +43,7 @@ static __inline__ int radeon_check_and_fixup_offset(drm_radeon_private_t *
                                                     u32 *offset)
 {
         u64 off = *offset;
-        u32 fb_start = dev_priv->fb_location;
-        u32 fb_end = fb_start + dev_priv->fb_size - 1;
-        u32 gart_start = dev_priv->gart_vm_start;
-        u32 gart_end = gart_start + dev_priv->gart_size - 1;
+        u32 fb_end = dev_priv->fb_location + dev_priv->fb_size - 1;
         struct drm_radeon_driver_file_fields *radeon_priv;
 
         /* Hrm ... the story of the offset ... So this function converts
@@ -66,8 +63,7 @@ static __inline__ int radeon_check_and_fixup_offset(drm_radeon_private_t *
         /* First, the best case, the offset already lands in either the
          * framebuffer or the GART mapped space
          */
-        if ((off >= fb_start && off <= fb_end) ||
-            (off >= gart_start && off <= gart_end))
+        if (radeon_check_offset(dev_priv, off))
                 return 0;
 
         /* Ok, that didn't happen... now check if we have a zero based
@@ -81,11 +77,10 @@ static __inline__ int radeon_check_and_fixup_offset(drm_radeon_private_t *
 
         /* Finally, assume we aimed at a GART offset if beyond the fb */
         if (off > fb_end)
-                off = off - fb_end - 1 + gart_start;
+                off = off - fb_end - 1 + dev_priv->gart_vm_start;
 
         /* Now recheck and fail if out of bounds */
-        if ((off >= fb_start && off <= fb_end) ||
-            (off >= gart_start && off <= gart_end)) {
+        if (radeon_check_offset(dev_priv, off)) {
                 DRM_DEBUG("offset fixed up to 0x%x\n", (unsigned int)off);
                 *offset = off;
                 return 0;
diff --git a/drivers/char/drm/savage_bci.c b/drivers/char/drm/savage_bci.c
index a9a84f88df5e..b94fab556809 100644
--- a/drivers/char/drm/savage_bci.c
+++ b/drivers/char/drm/savage_bci.c
@@ -963,8 +963,8 @@ static int savage_bci_event_emit(DRM_IOCTL_ARGS)
 
         event.count = savage_bci_emit_event(dev_priv, event.flags);
         event.count |= dev_priv->event_wrap << 16;
-        DRM_COPY_TO_USER_IOCTL(&((drm_savage_event_emit_t __user *) data)->
-                               count, event.count, sizeof(event.count));
+        DRM_COPY_TO_USER_IOCTL((drm_savage_event_emit_t __user *) data,
+                               event, sizeof(event));
         return 0;
 }
 
diff --git a/drivers/char/hw_random/amd-rng.c b/drivers/char/hw_random/amd-rng.c
index 71e4e0f3fd54..556fd81fa815 100644
--- a/drivers/char/hw_random/amd-rng.c
+++ b/drivers/char/hw_random/amd-rng.c
@@ -144,7 +144,7 @@ static void __exit mod_exit(void)
         hwrng_unregister(&amd_rng);
 }
 
-subsys_initcall(mod_init);
+module_init(mod_init);
 module_exit(mod_exit);
 
 MODULE_AUTHOR("The Linux Kernel team");
diff --git a/drivers/char/hw_random/geode-rng.c b/drivers/char/hw_random/geode-rng.c
index d37ced0d132b..8e8658dcd2e3 100644
--- a/drivers/char/hw_random/geode-rng.c
+++ b/drivers/char/hw_random/geode-rng.c
@@ -125,7 +125,7 @@ static void __exit mod_exit(void)
         iounmap(mem);
 }
 
-subsys_initcall(mod_init);
+module_init(mod_init);
 module_exit(mod_exit);
 
 MODULE_DESCRIPTION("H/W RNG driver for AMD Geode LX CPUs");
diff --git a/drivers/char/hw_random/intel-rng.c b/drivers/char/hw_random/intel-rng.c
index 8efbc9c0e545..f22e78e3c70f 100644
--- a/drivers/char/hw_random/intel-rng.c
+++ b/drivers/char/hw_random/intel-rng.c
@@ -143,6 +143,11 @@ static const struct pci_device_id pci_tbl[] = {
 };
 MODULE_DEVICE_TABLE(pci, pci_tbl);
 
+static __initdata int no_fwh_detect;
+module_param(no_fwh_detect, int, 0);
+MODULE_PARM_DESC(no_fwh_detect, "Skip FWH detection:\n"
+                                " positive value - skip if FWH space locked read-only\n"
+                                " negative value - skip always");
 
 static inline u8 hwstatus_get(void __iomem *mem)
 {
@@ -240,6 +245,11 @@ static int __init mod_init(void)
         if (!dev)
                 goto out; /* Device not found. */
 
+        if (no_fwh_detect < 0) {
+                pci_dev_put(dev);
+                goto fwh_done;
+        }
+
         /* Check for Intel 82802 */
         if (dev->device < 0x2640) {
                 fwh_dec_en1_off = FWH_DEC_EN1_REG_OLD;
@@ -252,6 +262,23 @@ static int __init mod_init(void)
         pci_read_config_byte(dev, fwh_dec_en1_off, &fwh_dec_en1_val);
         pci_read_config_byte(dev, bios_cntl_off, &bios_cntl_val);
 
+        if ((bios_cntl_val &
+             (BIOS_CNTL_LOCK_ENABLE_MASK|BIOS_CNTL_WRITE_ENABLE_MASK))
+            == BIOS_CNTL_LOCK_ENABLE_MASK) {
+                static __initdata /*const*/ char warning[] =
+                        KERN_WARNING PFX "Firmware space is locked read-only. If you can't or\n"
+                        KERN_WARNING PFX "don't want to disable this in firmware setup, and if\n"
+                        KERN_WARNING PFX "you are certain that your system has a functional\n"
+                        KERN_WARNING PFX "RNG, try using the 'no_fwh_detect' option.\n";
+
+                pci_dev_put(dev);
+                if (no_fwh_detect)
+                        goto fwh_done;
+                printk(warning);
+                err = -EBUSY;
+                goto out;
+        }
+
         mem = ioremap_nocache(INTEL_FWH_ADDR, INTEL_FWH_ADDR_LEN);
         if (mem == NULL) {
                 pci_dev_put(dev);
@@ -280,8 +307,7 @@ static int __init mod_init(void)
                 pci_write_config_byte(dev,
                                       fwh_dec_en1_off,
                                       fwh_dec_en1_val | FWH_F8_EN_MASK);
-        if (!(bios_cntl_val &
-              (BIOS_CNTL_LOCK_ENABLE_MASK|BIOS_CNTL_WRITE_ENABLE_MASK)))
+        if (!(bios_cntl_val & BIOS_CNTL_WRITE_ENABLE_MASK))
                 pci_write_config_byte(dev,
                                       bios_cntl_off,
                                       bios_cntl_val | BIOS_CNTL_WRITE_ENABLE_MASK);
@@ -315,6 +341,8 @@ static int __init mod_init(void)
                 goto out;
         }
 
+fwh_done:
+
         err = -ENOMEM;
         mem = ioremap(INTEL_RNG_ADDR, INTEL_RNG_ADDR_LEN);
         if (!mem)
@@ -350,7 +378,7 @@ static void __exit mod_exit(void)
         iounmap(mem);
 }
 
-subsys_initcall(mod_init);
+module_init(mod_init);
 module_exit(mod_exit);
 
 MODULE_DESCRIPTION("H/W RNG driver for Intel chipsets");
diff --git a/drivers/char/hw_random/ixp4xx-rng.c b/drivers/char/hw_random/ixp4xx-rng.c
index c9caff57db85..bab43ca32ac1 100644
--- a/drivers/char/hw_random/ixp4xx-rng.c
+++ b/drivers/char/hw_random/ixp4xx-rng.c
@@ -64,7 +64,7 @@ static void __exit ixp4xx_rng_exit(void)
         iounmap(rng_base);
 }
 
-subsys_initcall(ixp4xx_rng_init);
+module_init(ixp4xx_rng_init);
 module_exit(ixp4xx_rng_exit);
 
 MODULE_AUTHOR("Deepak Saxena <dsaxena@plexity.net>");
diff --git a/drivers/char/hw_random/via-rng.c b/drivers/char/hw_random/via-rng.c
index 0e786b617bb8..9ebf84d18655 100644
--- a/drivers/char/hw_random/via-rng.c
+++ b/drivers/char/hw_random/via-rng.c
@@ -176,7 +176,7 @@ static void __exit mod_exit(void)
         hwrng_unregister(&via_rng);
 }
 
-subsys_initcall(mod_init);
+module_init(mod_init);
 module_exit(mod_exit);
 
 MODULE_DESCRIPTION("H/W RNG driver for VIA chipsets");
diff --git a/drivers/char/ip2/i2ellis.h b/drivers/char/ip2/i2ellis.h
index 5eabe47b0bc8..433305062fb8 100644
--- a/drivers/char/ip2/i2ellis.h
+++ b/drivers/char/ip2/i2ellis.h
@@ -606,9 +606,9 @@ static int iiDownloadAll(i2eBordStrPtr, loadHdrStrPtr, int, int);
 // code and returning.
 //
 #define COMPLETE(pB,code) \
-        if(1){ \
+        do { \
                  pB->i2eError = code; \
                  return (code == I2EE_GOOD);\
-        }
+        } while (0)
 
 #endif   // I2ELLIS_H
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 4e4691a53890..53582b53da95 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3649,8 +3649,6 @@ static void ipmi_timeout_handler(long timeout_period)
         unsigned long        flags;
         int                  i;
 
-        INIT_LIST_HEAD(&timeouts);
-
         rcu_read_lock();
         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
                 /* See if any waiting messages need to be processed. */
@@ -3671,6 +3669,7 @@ static void ipmi_timeout_handler(long timeout_period)
                 /* Go through the seq table and find any messages that
                    have timed out, putting them in the timeouts
                    list. */
+                INIT_LIST_HEAD(&timeouts);
                 spin_lock_irqsave(&intf->seq_lock, flags);
                 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
                         check_msg_timeout(intf, &(intf->seq_table[i]),
diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
index 78280380a905..6b634e8d9519 100644
--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@@ -216,13 +216,13 @@ static int set_param_str(const char *val, struct kernel_param *kp)
 {
         action_fn  fn = (action_fn) kp->arg;
         int        rv = 0;
-        char       *dup, *s;
+        char       valcp[16];
+        char       *s;
 
-        dup = kstrdup(val, GFP_KERNEL);
-        if (!dup)
-                return -ENOMEM;
+        strncpy(valcp, val, 16);
+        valcp[15] = '\0';
 
-        s = strstrip(dup);
+        s = strstrip(valcp);
 
         down_read(&register_sem);
         rv = fn(s, NULL);
@@ -235,7 +235,6 @@ static int set_param_str(const char *val, struct kernel_param *kp)
 
  out_unlock:
         up_read(&register_sem);
-        kfree(dup);
         return rv;
 }
 
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index 5a747e685993..01084abffddf 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -230,6 +230,20 @@ static struct isi_port  isi_ports[PORT_COUNT];
  *      it wants to talk.
  */
 
+static inline int WaitTillCardIsFree(u16 base)
+{
+        unsigned int count = 0;
+        unsigned int a = in_atomic(); /* do we run under spinlock? */
+
+        while (!(inw(base + 0xe) & 0x1) && count++ < 100)
+                if (a)
+                        mdelay(1);
+                else
+                        msleep(1);
+
+        return !(inw(base + 0xe) & 0x1);
+}
+
 static int lock_card(struct isi_board *card)
 {
         char            retries;
@@ -276,69 +290,71 @@ static void unlock_card(struct isi_board *card)
  *  ISI Card specific ops ...
  */
 
+/* card->lock HAS to be held */
 static void raise_dtr(struct isi_port *port)
 {
         struct isi_board *card = port->card;
         unsigned long base = card->base;
         u16 channel = port->channel;
 
-        if (!lock_card(card))
+        if (WaitTillCardIsFree(base))
                 return;
 
         outw(0x8000 | (channel << card->shift_count) | 0x02, base);
         outw(0x0504, base);
         InterruptTheCard(base);
         port->status |= ISI_DTR;
-        unlock_card(card);
 }
 
+/* card->lock HAS to be held */
 static inline void drop_dtr(struct isi_port *port)
 {
         struct isi_board *card = port->card;
         unsigned long base = card->base;
         u16 channel = port->channel;
 
-        if (!lock_card(card))
+        if (WaitTillCardIsFree(base))
                 return;
 
         outw(0x8000 | (channel << card->shift_count) | 0x02, base);
         outw(0x0404, base);
         InterruptTheCard(base);
         port->status &= ~ISI_DTR;
-        unlock_card(card);
 }
 
+/* card->lock HAS to be held */
 static inline void raise_rts(struct isi_port *port)
 {
         struct isi_board *card = port->card;
         unsigned long base = card->base;
         u16 channel = port->channel;
 
-        if (!lock_card(card))
+        if (WaitTillCardIsFree(base))
                 return;
 
         outw(0x8000 | (channel << card->shift_count) | 0x02, base);
         outw(0x0a04, base);
         InterruptTheCard(base);
         port->status |= ISI_RTS;
-        unlock_card(card);
 }
+
+/* card->lock HAS to be held */
 static inline void drop_rts(struct isi_port *port)
 {
         struct isi_board *card = port->card;
         unsigned long base = card->base;
         u16 channel = port->channel;
 
-        if (!lock_card(card))
+        if (WaitTillCardIsFree(base))
                 return;
 
         outw(0x8000 | (channel << card->shift_count) | 0x02, base);
         outw(0x0804, base);
         InterruptTheCard(base);
         port->status &= ~ISI_RTS;
-        unlock_card(card);
 }
 
+/* card->lock MUST NOT be held */
 static inline void raise_dtr_rts(struct isi_port *port)
 {
         struct isi_board *card = port->card;
@@ -355,35 +371,20 @@ static inline void raise_dtr_rts(struct isi_port *port)
         unlock_card(card);
 }
 
+/* card->lock HAS to be held */
 static void drop_dtr_rts(struct isi_port *port)
 {
         struct isi_board *card = port->card;
         unsigned long base = card->base;
         u16 channel = port->channel;
 
-        if (!lock_card(card))
+        if (WaitTillCardIsFree(base))
                 return;
 
         outw(0x8000 | (channel << card->shift_count) | 0x02, base);
         outw(0x0c04, base);
         InterruptTheCard(base);
         port->status &= ~(ISI_RTS | ISI_DTR);
-        unlock_card(card);
-}
-
-static inline void kill_queue(struct isi_port *port, short queue)
-{
-        struct isi_board *card = port->card;
-        unsigned long base = card->base;
-        u16 channel = port->channel;
-
-        if (!lock_card(card))
-                return;
-
-        outw(0x8000 | (channel << card->shift_count) | 0x02, base);
-        outw((queue << 8) | 0x06, base);
-        InterruptTheCard(base);
-        unlock_card(card);
 }
 
 /*
@@ -744,7 +745,7 @@ static void isicom_config_port(struct isi_port *port)
         else
                 raise_dtr(port);
 
-        if (lock_card(card)) {
+        if (WaitTillCardIsFree(base) == 0) {
                 outw(0x8000 | (channel << shift_count) |0x03, base);
                 outw(linuxb_to_isib[baud] << 8 | 0x03, base);
                 channel_setup = 0;
@@ -772,7 +773,6 @@ static void isicom_config_port(struct isi_port *port)
                 }
                 outw(channel_setup, base);
                 InterruptTheCard(base);
-                unlock_card(card);
         }
         if (C_CLOCAL(tty))
                 port->flags &= ~ASYNC_CHECK_CD;
@@ -791,12 +791,11 @@ static void isicom_config_port(struct isi_port *port)
         if (I_IXOFF(tty))
                 flow_ctrl |= ISICOM_INITIATE_XONXOFF;
 
-        if (lock_card(card)) {
+        if (WaitTillCardIsFree(base) == 0) {
                 outw(0x8000 | (channel << shift_count) |0x04, base);
                 outw(flow_ctrl << 8 | 0x05, base);
                 outw((STOP_CHAR(tty)) << 8 | (START_CHAR(tty)), base);
                 InterruptTheCard(base);
-                unlock_card(card);
         }
 
         /*      rx enabled -> enable port for rx on the card    */
@@ -821,10 +820,9 @@ static inline void isicom_setup_board(struct isi_board *bp)
         }
         port = bp->ports;
         bp->status |= BOARD_ACTIVE;
-        spin_unlock_irqrestore(&bp->card_lock, flags);
         for (channel = 0; channel < bp->port_count; channel++, port++)
                 drop_dtr_rts(port);
-        return;
+        spin_unlock_irqrestore(&bp->card_lock, flags);
 }
 
 static int isicom_setup_port(struct isi_port *port)
@@ -857,7 +855,12 @@ static int isicom_setup_port(struct isi_port *port)
         port->xmit_cnt = port->xmit_head = port->xmit_tail = 0;
 
         /*      discard any residual data       */
-        kill_queue(port, ISICOM_KILLTX | ISICOM_KILLRX);
+        if (WaitTillCardIsFree(card->base) == 0) {
+                outw(0x8000 | (port->channel << card->shift_count) | 0x02,
+                                card->base);
+                outw(((ISICOM_KILLTX | ISICOM_KILLRX) << 8) | 0x06, card->base);
+                InterruptTheCard(card->base);
+        }
 
         isicom_config_port(port);
         port->flags |= ASYNC_INITIALIZED;
@@ -983,28 +986,22 @@ static int isicom_open(struct tty_struct *tty, struct file *filp)
 
 static inline void isicom_shutdown_board(struct isi_board *bp)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&bp->card_lock, flags);
         if (bp->status & BOARD_ACTIVE) {
                 bp->status &= ~BOARD_ACTIVE;
         }
-        spin_unlock_irqrestore(&bp->card_lock, flags);
 }
 
+/* card->lock HAS to be held */
 static void isicom_shutdown_port(struct isi_port *port)
 {
         struct isi_board *card = port->card;
         struct tty_struct *tty;
-        unsigned long flags;
 
         tty = port->tty;
 
-        spin_lock_irqsave(&card->card_lock, flags);
-        if (!(port->flags & ASYNC_INITIALIZED)) {
-                spin_unlock_irqrestore(&card->card_lock, flags);
+        if (!(port->flags & ASYNC_INITIALIZED))
                 return;
-        }
+
         if (port->xmit_buf) {
                 free_page((unsigned long) port->xmit_buf);
                 port->xmit_buf = NULL;
@@ -1012,7 +1009,6 @@ static void isicom_shutdown_port(struct isi_port *port)
         port->flags &= ~ASYNC_INITIALIZED;
         /* 3rd October 2000 : Vinayak P Risbud */
         port->tty = NULL;
-        spin_unlock_irqrestore(&card->card_lock, flags);
 
         /*Fix done by Anil .S on 30-04-2001
         remote login through isi port has dtr toggle problem
@@ -1258,10 +1254,12 @@ static int isicom_tiocmset(struct tty_struct *tty, struct file *file,
         unsigned int set, unsigned int clear)
 {
         struct isi_port *port = tty->driver_data;
+        unsigned long flags;
 
         if (isicom_paranoia_check(port, tty->name, "isicom_ioctl"))
                 return -ENODEV;
 
+        spin_lock_irqsave(&port->card->card_lock, flags);
         if (set & TIOCM_RTS)
                 raise_rts(port);
         if (set & TIOCM_DTR)
@@ -1271,6 +1269,7 @@ static int isicom_tiocmset(struct tty_struct *tty, struct file *file,
                 drop_rts(port);
         if (clear & TIOCM_DTR)
                 drop_dtr(port);
+        spin_unlock_irqrestore(&port->card->card_lock, flags);
 
         return 0;
 }
@@ -1303,7 +1302,10 @@ static int isicom_set_serial_info(struct isi_port *port,
                                 (newinfo.flags & ASYNC_FLAGS));
         }
         if (reconfig_port) {
+                unsigned long flags;
+                spin_lock_irqsave(&port->card->card_lock, flags);
                 isicom_config_port(port);
+                spin_unlock_irqrestore(&port->card->card_lock, flags);
         }
         return 0;
 }
@@ -1384,6 +1386,7 @@ static void isicom_set_termios(struct tty_struct *tty,
         struct ktermios *old_termios)
 {
         struct isi_port *port = tty->driver_data;
+        unsigned long flags;
 
         if (isicom_paranoia_check(port, tty->name, "isicom_set_termios"))
                 return;
@@ -1392,7 +1395,9 @@ static void isicom_set_termios(struct tty_struct *tty,
                         tty->termios->c_iflag == old_termios->c_iflag)
                 return;
 
+        spin_lock_irqsave(&port->card->card_lock, flags);
         isicom_config_port(port);
+        spin_unlock_irqrestore(&port->card->card_lock, flags);
 
         if ((old_termios->c_cflag & CRTSCTS) &&
                         !(tty->termios->c_cflag & CRTSCTS)) {
@@ -1469,11 +1474,15 @@ static void do_isicom_hangup(struct work_struct *work)
 static void isicom_hangup(struct tty_struct *tty)
 {
         struct isi_port *port = tty->driver_data;
+        unsigned long flags;
 
         if (isicom_paranoia_check(port, tty->name, "isicom_hangup"))
                 return;
 
+        spin_lock_irqsave(&port->card->card_lock, flags);
         isicom_shutdown_port(port);
+        spin_unlock_irqrestore(&port->card->card_lock, flags);
+
         port->count = 0;
         port->flags &= ~ASYNC_NORMAL_ACTIVE;
         port->tty = NULL;
@@ -1578,16 +1587,6 @@ end:
         return retval;
 }
 
-static inline int WaitTillCardIsFree(u16 base)
-{
-        unsigned long count = 0;
-
-        while (!(inw(base + 0xe) & 0x1) && count++ < 100)
-                msleep(5);
-
-        return !(inw(base + 0xe) & 0x1);
-}
-
 static int __devinit load_firmware(struct pci_dev *pdev,
         const unsigned int index, const unsigned int signature)
 {
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 4f1813e04754..f5c160caf9f4 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -293,8 +293,8 @@ static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
 {
         unsigned long pfn;
 
-        /* Turn a pfn offset into an absolute pfn */
-        pfn = PFN_DOWN(virt_to_phys((void *)PAGE_OFFSET)) + vma->vm_pgoff;
+        /* Turn a kernel-virtual address into a physical page frame */
+        pfn = __pa((u64)vma->vm_pgoff << PAGE_SHIFT) >> PAGE_SHIFT;
 
         /*
          * RED-PEN: on some architectures there is more mapped memory
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index c063359baf78..83f604b19290 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -717,6 +717,7 @@ static int mxser_init(void)
 
         /* Initialize the tty_driver structure */
         memset(mxvar_sdriver, 0, sizeof(struct tty_driver));
+        mxvar_sdriver->owner = THIS_MODULE;
         mxvar_sdriver->magic = TTY_DRIVER_MAGIC;
         mxvar_sdriver->name = "ttyMI";
         mxvar_sdriver->major = ttymajor;
diff --git a/drivers/char/mxser_new.c b/drivers/char/mxser_new.c
index cd989dce7c53..1bb030b3a51a 100644
--- a/drivers/char/mxser_new.c
+++ b/drivers/char/mxser_new.c
@@ -2690,6 +2690,7 @@ static int __init mxser_module_init(void)
                 MXSER_VERSION);
 
         /* Initialize the tty_driver structure */
+        mxvar_sdriver->owner = THIS_MODULE;
         mxvar_sdriver->magic = TTY_DRIVER_MAGIC;
         mxvar_sdriver->name = "ttyMI";
         mxvar_sdriver->major = ttymajor;
diff --git a/drivers/char/rtc.c b/drivers/char/rtc.c
index e1d70e8b6268..664f36c98e6a 100644
--- a/drivers/char/rtc.c
+++ b/drivers/char/rtc.c
@@ -113,7 +113,12 @@ static int rtc_has_irq = 1;
 #define hpet_set_rtc_irq_bit(arg)               0
 #define hpet_rtc_timer_init()                   do { } while (0)
 #define hpet_rtc_dropped_irq()                  0
-static irqreturn_t hpet_rtc_interrupt(int irq, void *dev_id) {return 0;}
+#ifdef RTC_IRQ
+static irqreturn_t hpet_rtc_interrupt(int irq, void *dev_id)
+{
+        return 0;
+}
+#endif
 #else
 extern irqreturn_t hpet_rtc_interrupt(int irq, void *dev_id);
 #endif
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 13935235e066..7fd3cd5ddf21 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -215,7 +215,7 @@ static void sysrq_handle_showstate_blocked(int key, struct tty_struct *tty)
 }
 static struct sysrq_key_op sysrq_showstate_blocked_op = {
         .handler        = sysrq_handle_showstate_blocked,
-        .help_msg       = "showBlockedTasks",
+        .help_msg       = "shoW-blocked-tasks",
         .action_msg     = "Show Blocked State",
         .enable_mask    = SYSRQ_ENABLE_DUMP,
 };
@@ -315,15 +315,16 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         &sysrq_loglevel_op,             /* 9 */
 
         /*
-         * Don't use for system provided sysrqs, it is handled specially on
-         * sparc and will never arrive
+         * a: Don't use for system provided sysrqs, it is handled specially on
+         * sparc and will never arrive.
          */
         NULL,                           /* a */
         &sysrq_reboot_op,               /* b */
-        &sysrq_crashdump_op,            /* c */
+        &sysrq_crashdump_op,            /* c & ibm_emac driver debug */
         &sysrq_showlocks_op,            /* d */
         &sysrq_term_op,                 /* e */
         &sysrq_moom_op,                 /* f */
+        /* g: May be registered by ppc for kgdb */
         NULL,                           /* g */
         NULL,                           /* h */
         &sysrq_kill_op,                 /* i */
@@ -332,18 +333,19 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         NULL,                           /* l */
         &sysrq_showmem_op,              /* m */
         &sysrq_unrt_op,                 /* n */
-        /* This will often be registered as 'Off' at init time */
+        /* o: This will often be registered as 'Off' at init time */
         NULL,                           /* o */
         &sysrq_showregs_op,             /* p */
         NULL,                           /* q */
-        &sysrq_unraw_op,                        /* r */
+        &sysrq_unraw_op,                /* r */
         &sysrq_sync_op,                 /* s */
         &sysrq_showstate_op,            /* t */
         &sysrq_mountro_op,              /* u */
-        /* May be assigned at init time by SMP VOYAGER */
+        /* v: May be registered at init time by SMP VOYAGER */
         NULL,                           /* v */
-        NULL,                           /* w */
-        &sysrq_showstate_blocked_op,    /* x */
+        &sysrq_showstate_blocked_op,    /* w */
+        /* x: May be registered on ppc/powerpc for xmon */
+        NULL,                           /* x */
         NULL,                           /* y */
         NULL                            /* z */
 };
diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 244d30a03fef..4fac2bdf6215 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -186,6 +186,7 @@ static int got_event;		/* if events processing have been done */
 static void switchover_timeout(unsigned long data);
 static struct timer_list switchover_timer =
         TIMER_INITIALIZER(switchover_timeout , 0, 0);
+static unsigned long tlclk_timer_data;
 
 static struct tlclk_alarms *alarm_events;
 
@@ -197,10 +198,19 @@ static irqreturn_t tlclk_interrupt(int irq, void *dev_id);
 
 static DECLARE_WAIT_QUEUE_HEAD(wq);
 
+static unsigned long useflags;
+static DEFINE_MUTEX(tlclk_mutex);
+
 static int tlclk_open(struct inode *inode, struct file *filp)
 {
         int result;
 
+        if (test_and_set_bit(0, &useflags))
+                return -EBUSY;
+                /* this legacy device is always one per system and it doesn't
+                 * know how to handle multiple concurrent clients.
+                 */
+
         /* Make sure there is no interrupt pending while
          * initialising interrupt handler */
         inb(TLCLK_REG6);
@@ -221,6 +231,7 @@ static int tlclk_open(struct inode *inode, struct file *filp)
 static int tlclk_release(struct inode *inode, struct file *filp)
 {
         free_irq(telclk_interrupt, tlclk_interrupt);
+        clear_bit(0, &useflags);
 
         return 0;
 }
@@ -230,26 +241,25 @@ static ssize_t tlclk_read(struct file *filp, char __user *buf, size_t count,
 {
         if (count < sizeof(struct tlclk_alarms))
                 return -EIO;
+        if (mutex_lock_interruptible(&tlclk_mutex))
+                return -EINTR;
+
 
         wait_event_interruptible(wq, got_event);
-        if (copy_to_user(buf, alarm_events, sizeof(struct tlclk_alarms)))
+        if (copy_to_user(buf, alarm_events, sizeof(struct tlclk_alarms))) {
+                mutex_unlock(&tlclk_mutex);
                 return -EFAULT;
+        }
 
         memset(alarm_events, 0, sizeof(struct tlclk_alarms));
         got_event = 0;
 
+        mutex_unlock(&tlclk_mutex);
         return  sizeof(struct tlclk_alarms);
 }
 
-static ssize_t tlclk_write(struct file *filp, const char __user *buf, size_t count,
-            loff_t *f_pos)
-{
-        return 0;
-}
-
 static const struct file_operations tlclk_fops = {
         .read = tlclk_read,
-        .write = tlclk_write,
         .open = tlclk_open,
         .release = tlclk_release,
 
@@ -540,7 +550,7 @@ static ssize_t store_select_amcb1_transmit_clock(struct device *d,
                         SET_PORT_BITS(TLCLK_REG3, 0xf8, 0x7);
                         switch (val) {
                         case CLK_8_592MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
+                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
                                 break;
                         case CLK_11_184MHz:
                                 SET_PORT_BITS(TLCLK_REG0, 0xfc, 0);
@@ -549,7 +559,7 @@ static ssize_t store_select_amcb1_transmit_clock(struct device *d,
                                 SET_PORT_BITS(TLCLK_REG0, 0xfc, 3);
                                 break;
                         case CLK_44_736MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
+                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
                                 break;
                         }
                 } else
@@ -807,8 +817,6 @@ static int __init tlclk_init(void)
                         &tlclk_attribute_group);
         if (ret) {
                 printk(KERN_ERR "tlclk: failed to create sysfs device attributes.\n");
-                sysfs_remove_group(&tlclk_device->dev.kobj,
-                        &tlclk_attribute_group);
                 goto out5;
         }
 
@@ -841,11 +849,13 @@ static void __exit tlclk_cleanup(void)
 
 static void switchover_timeout(unsigned long data)
 {
-        if ((data & 1)) {
-                if ((inb(TLCLK_REG1) & 0x08) != (data & 0x08))
+        unsigned long flags = *(unsigned long *) data;
+
+        if ((flags & 1)) {
+                if ((inb(TLCLK_REG1) & 0x08) != (flags & 0x08))
                         alarm_events->switchover_primary++;
         } else {
-                if ((inb(TLCLK_REG1) & 0x08) != (data & 0x08))
+                if ((inb(TLCLK_REG1) & 0x08) != (flags & 0x08))
                         alarm_events->switchover_secondary++;
         }
 
@@ -903,8 +913,9 @@ static irqreturn_t tlclk_interrupt(int irq, void *dev_id)
 
                 /* TIMEOUT in ~10ms */
                 switchover_timer.expires = jiffies + msecs_to_jiffies(10);
-                switchover_timer.data = inb(TLCLK_REG1);
-                add_timer(&switchover_timer);
+                tlclk_timer_data = inb(TLCLK_REG1);
+                switchover_timer.data = (unsigned long) &tlclk_timer_data;
+                mod_timer(&switchover_timer, switchover_timer.expires);
         } else {
                 got_event = 1;
                 wake_up(&wq);
diff --git a/drivers/char/viocons.c b/drivers/char/viocons.c
index 0e0da443cbd5..8de6b95aeb84 100644
--- a/drivers/char/viocons.c
+++ b/drivers/char/viocons.c
@@ -42,6 +42,7 @@
 #include <linux/tty_flip.h>
 #include <linux/sysrq.h>
 
+#include <asm/firmware.h>
 #include <asm/iseries/vio.h>
 #include <asm/iseries/hv_lp_event.h>
 #include <asm/iseries/hv_call_event.h>
@@ -1060,6 +1061,9 @@ static int __init viocons_init2(void)
         atomic_t wait_flag;
         int rc;
 
+        if (!firmware_has_feature(FW_FEATURE_ISERIES))
+                return -ENODEV;
+
         /* +2 for fudge */
         rc = viopath_open(HvLpConfig_getPrimaryLpIndex(),
                         viomajorsubtype_chario, VIOCHAR_WINDOW + 2);
@@ -1145,6 +1149,9 @@ static int __init viocons_init(void)
 {
         int i;
 
+        if (!firmware_has_feature(FW_FEATURE_ISERIES))
+                return -ENODEV;
+
         printk(VIOCONS_KERN_INFO "registering console\n");
         for (i = 0; i < VTTY_PORTS; i++) {
                 port_info[i].lp = HvLpIndexInvalid;
diff --git a/drivers/char/viotape.c b/drivers/char/viotape.c
index 94d79cb8ce8d..9438512b17f1 100644
--- a/drivers/char/viotape.c
+++ b/drivers/char/viotape.c
@@ -49,7 +49,7 @@
 
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
-
+#include <asm/firmware.h>
 #include <asm/vio.h>
 #include <asm/iseries/vio.h>
 #include <asm/iseries/hv_lp_event.h>
@@ -997,6 +997,9 @@ int __init viotap_init(void)
         int ret;
         struct proc_dir_entry *e;
 
+        if (!firmware_has_feature(FW_FEATURE_ISERIES))
+                return -ENODEV;
+
         op_struct_list = NULL;
         if ((ret = add_op_structs(VIOTAPE_MAXREQ)) < 0) {
                 printk(VIOTAPE_KERN_WARN "couldn't allocate op structs\n");
diff --git a/drivers/char/vr41xx_giu.c b/drivers/char/vr41xx_giu.c
index a744dad9cf45..0cea8d4907df 100644
--- a/drivers/char/vr41xx_giu.c
+++ b/drivers/char/vr41xx_giu.c
@@ -3,7 +3,7 @@
  *
  *  Copyright (C) 2002 MontaVista Software Inc.
  *      Author: Yoichi Yuasa <yyuasa@mvista.com or source@mvista.com>
- *  Copyright (C) 2003-2005  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
+ *  Copyright (C) 2003-2007  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -125,30 +125,17 @@ static inline uint16_t giu_clear(uint16_t offset, uint16_t clear)
         return data;
 }
 
-static unsigned int startup_giuint_low_irq(unsigned int irq)
+static void ack_giuint_low(unsigned int irq)
 {
-        unsigned int pin;
-
-        pin = GPIO_PIN_OF_IRQ(irq);
-        giu_write(GIUINTSTATL, 1 << pin);
-        giu_set(GIUINTENL, 1 << pin);
-
-        return 0;
+        giu_write(GIUINTSTATL, 1 << GPIO_PIN_OF_IRQ(irq));
 }
 
-static void shutdown_giuint_low_irq(unsigned int irq)
+static void mask_giuint_low(unsigned int irq)
 {
         giu_clear(GIUINTENL, 1 << GPIO_PIN_OF_IRQ(irq));
 }
 
-static void enable_giuint_low_irq(unsigned int irq)
-{
-        giu_set(GIUINTENL, 1 << GPIO_PIN_OF_IRQ(irq));
-}
-
-#define disable_giuint_low_irq  shutdown_giuint_low_irq
-
-static void ack_giuint_low_irq(unsigned int irq)
+static void mask_ack_giuint_low(unsigned int irq)
 {
         unsigned int pin;
 
@@ -157,46 +144,30 @@ static void ack_giuint_low_irq(unsigned int irq)
         giu_write(GIUINTSTATL, 1 << pin);
 }
 
-static void end_giuint_low_irq(unsigned int irq)
+static void unmask_giuint_low(unsigned int irq)
 {
-        if (!(irq_desc[irq].status & (IRQ_DISABLED | IRQ_INPROGRESS)))
-                giu_set(GIUINTENL, 1 << GPIO_PIN_OF_IRQ(irq));
+        giu_set(GIUINTENL, 1 << GPIO_PIN_OF_IRQ(irq));
 }
 
-static struct hw_interrupt_type giuint_low_irq_type = {
-        .typename       = "GIUINTL",
-        .startup        = startup_giuint_low_irq,
-        .shutdown       = shutdown_giuint_low_irq,
-        .enable         = enable_giuint_low_irq,
-        .disable        = disable_giuint_low_irq,
-        .ack            = ack_giuint_low_irq,
-        .end            = end_giuint_low_irq,
+static struct irq_chip giuint_low_irq_chip = {
+        .name           = "GIUINTL",
+        .ack            = ack_giuint_low,
+        .mask           = mask_giuint_low,
+        .mask_ack       = mask_ack_giuint_low,
+        .unmask         = unmask_giuint_low,
 };
 
-static unsigned int startup_giuint_high_irq(unsigned int irq)
+static void ack_giuint_high(unsigned int irq)
 {
-        unsigned int pin;
-
-        pin = GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET;
-        giu_write(GIUINTSTATH, 1 << pin);
-        giu_set(GIUINTENH, 1 << pin);
-
-        return 0;
+        giu_write(GIUINTSTATH, 1 << (GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET));
 }
 
-static void shutdown_giuint_high_irq(unsigned int irq)
+static void mask_giuint_high(unsigned int irq)
 {
         giu_clear(GIUINTENH, 1 << (GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET));
 }
 
-static void enable_giuint_high_irq(unsigned int irq)
-{
-        giu_set(GIUINTENH, 1 << (GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET));
-}
-
-#define disable_giuint_high_irq shutdown_giuint_high_irq
-
-static void ack_giuint_high_irq(unsigned int irq)
+static void mask_ack_giuint_high(unsigned int irq)
 {
         unsigned int pin;
 
@@ -205,20 +176,17 @@ static void ack_giuint_high_irq(unsigned int irq)
         giu_write(GIUINTSTATH, 1 << pin);
 }
 
-static void end_giuint_high_irq(unsigned int irq)
+static void unmask_giuint_high(unsigned int irq)
 {
-        if (!(irq_desc[irq].status & (IRQ_DISABLED | IRQ_INPROGRESS)))
-                giu_set(GIUINTENH, 1 << (GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET));
+        giu_set(GIUINTENH, 1 << (GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET));
 }
 
-static struct hw_interrupt_type giuint_high_irq_type = {
-        .typename       = "GIUINTH",
-        .startup        = startup_giuint_high_irq,
-        .shutdown       = shutdown_giuint_high_irq,
-        .enable         = enable_giuint_high_irq,
-        .disable        = disable_giuint_high_irq,
-        .ack            = ack_giuint_high_irq,
-        .end            = end_giuint_high_irq,
+static struct irq_chip giuint_high_irq_chip = {
+        .name           = "GIUINTH",
+        .ack            = ack_giuint_high,
+        .mask           = mask_giuint_high,
+        .mask_ack       = mask_ack_giuint_high,
+        .unmask         = unmask_giuint_high,
 };
 
 static int giu_get_irq(unsigned int irq)
@@ -282,9 +250,15 @@ void vr41xx_set_irq_trigger(unsigned int pin, irq_trigger_t trigger, irq_signal_
                                         break;
                                 }
                         }
+                        set_irq_chip_and_handler(GIU_IRQ(pin),
+                                                 &giuint_low_irq_chip,
+                                                 handle_edge_irq);
                 } else {
                         giu_clear(GIUINTTYPL, mask);
                         giu_clear(GIUINTHTSELL, mask);
+                        set_irq_chip_and_handler(GIU_IRQ(pin),
+                                                 &giuint_low_irq_chip,
+                                                 handle_level_irq);
                 }
                 giu_write(GIUINTSTATL, mask);
         } else if (pin < GIUINT_HIGH_MAX) {
@@ -311,9 +285,15 @@ void vr41xx_set_irq_trigger(unsigned int pin, irq_trigger_t trigger, irq_signal_
                                         break;
                                 }
                         }
+                        set_irq_chip_and_handler(GIU_IRQ(pin),
+                                                 &giuint_high_irq_chip,
+                                                 handle_edge_irq);
                 } else {
                         giu_clear(GIUINTTYPH, mask);
                         giu_clear(GIUINTHTSELH, mask);
+                        set_irq_chip_and_handler(GIU_IRQ(pin),
+                                                 &giuint_high_irq_chip,
+                                                 handle_level_irq);
                 }
                 giu_write(GIUINTSTATH, mask);
         }
@@ -617,10 +597,11 @@ static const struct file_operations gpio_fops = {
 static int __devinit giu_probe(struct platform_device *dev)
 {
         unsigned long start, size, flags = 0;
-        unsigned int nr_pins = 0;
+        unsigned int nr_pins = 0, trigger, i, pin;
         struct resource *res1, *res2 = NULL;
         void *base;
-        int retval, i;
+        struct irq_chip *chip;
+        int retval;
 
         switch (current_cpu_data.cputype) {
         case CPU_VR4111:
@@ -688,11 +669,20 @@ static int __devinit giu_probe(struct platform_device *dev)
         giu_write(GIUINTENL, 0);
         giu_write(GIUINTENH, 0);
 
+        trigger = giu_read(GIUINTTYPH) << 16;
+        trigger |= giu_read(GIUINTTYPL);
         for (i = GIU_IRQ_BASE; i <= GIU_IRQ_LAST; i++) {
-                if (i < GIU_IRQ(GIUINT_HIGH_OFFSET))
-                        irq_desc[i].chip = &giuint_low_irq_type;
+                pin = GPIO_PIN_OF_IRQ(i);
+                if (pin < GIUINT_HIGH_OFFSET)
+                        chip = &giuint_low_irq_chip;
                 else
-                        irq_desc[i].chip = &giuint_high_irq_type;
+                        chip = &giuint_high_irq_chip;
+
+                if (trigger & (1 << pin))
+                        set_irq_chip_and_handler(i, chip, handle_edge_irq);
+                else
+                        set_irq_chip_and_handler(i, chip, handle_level_irq);
+
         }
 
         return cascade_irq(GIUINT_IRQ, giu_get_irq);