38 files changed, 1046 insertions, 253 deletions

diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 6c6751b1405b..8206fc1ecc58 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -39,6 +39,17 @@
 #include <linux/moduleparam.h>
 #include <linux/sched.h>        /* need_resched() */
 #include <linux/latency.h>
+#include <linux/clockchips.h>
+
+/*
+ * Include the apic definitions for x86 to have the APIC timer related defines
+ * available also for UP (on SMP it gets magically included via linux/smp.h).
+ * asm/acpi.h is not an option, as it would require more include magic. Also
+ * creating an empty asm-ia64/apic.h would just trade pest vs. cholera.
+ */
+#ifdef CONFIG_X86
+#include <asm/apic.h>
+#endif
 
 #include <asm/io.h>
 #include <asm/uaccess.h>
@@ -238,6 +249,81 @@ static void acpi_cstate_enter(struct acpi_processor_cx *cstate)
         }
 }
 
+#ifdef ARCH_APICTIMER_STOPS_ON_C3
+
+/*
+ * Some BIOS implementations switch to C3 in the published C2 state.
+ * This seems to be a common problem on AMD boxen, but other vendors
+ * are affected too. We pick the most conservative approach: we assume
+ * that the local APIC stops in both C2 and C3.
+ */
+static void acpi_timer_check_state(int state, struct acpi_processor *pr,
+                                   struct acpi_processor_cx *cx)
+{
+        struct acpi_processor_power *pwr = &pr->power;
+
+        /*
+         * Check, if one of the previous states already marked the lapic
+         * unstable
+         */
+        if (pwr->timer_broadcast_on_state < state)
+                return;
+
+        if (cx->type >= ACPI_STATE_C2)
+                pr->power.timer_broadcast_on_state = state;
+}
+
+static void acpi_propagate_timer_broadcast(struct acpi_processor *pr)
+{
+#ifdef CONFIG_GENERIC_CLOCKEVENTS
+        unsigned long reason;
+
+        reason = pr->power.timer_broadcast_on_state < INT_MAX ?
+                CLOCK_EVT_NOTIFY_BROADCAST_ON : CLOCK_EVT_NOTIFY_BROADCAST_OFF;
+
+        clockevents_notify(reason, &pr->id);
+#else
+        cpumask_t mask = cpumask_of_cpu(pr->id);
+
+        if (pr->power.timer_broadcast_on_state < INT_MAX)
+                on_each_cpu(switch_APIC_timer_to_ipi, &mask, 1, 1);
+        else
+                on_each_cpu(switch_ipi_to_APIC_timer, &mask, 1, 1);
+#endif
+}
+
+/* Power(C) State timer broadcast control */
+static void acpi_state_timer_broadcast(struct acpi_processor *pr,
+                                       struct acpi_processor_cx *cx,
+                                       int broadcast)
+{
+#ifdef CONFIG_GENERIC_CLOCKEVENTS
+
+        int state = cx - pr->power.states;
+
+        if (state >= pr->power.timer_broadcast_on_state) {
+                unsigned long reason;
+
+                reason = broadcast ?  CLOCK_EVT_NOTIFY_BROADCAST_ENTER :
+                        CLOCK_EVT_NOTIFY_BROADCAST_EXIT;
+                clockevents_notify(reason, &pr->id);
+        }
+#endif
+}
+
+#else
+
+static void acpi_timer_check_state(int state, struct acpi_processor *pr,
+                                   struct acpi_processor_cx *cstate) { }
+static void acpi_propagate_timer_broadcast(struct acpi_processor *pr) { }
+static void acpi_state_timer_broadcast(struct acpi_processor *pr,
+                                       struct acpi_processor_cx *cx,
+                                       int broadcast)
+{
+}
+
+#endif
+
 static void acpi_processor_idle(void)
 {
         struct acpi_processor *pr = NULL;
@@ -382,6 +468,7 @@ static void acpi_processor_idle(void)
                 /* Get start time (ticks) */
                 t1 = inl(acpi_gbl_FADT.xpm_timer_block.address);
                 /* Invoke C2 */
+                acpi_state_timer_broadcast(pr, cx, 1);
                 acpi_cstate_enter(cx);
                 /* Get end time (ticks) */
                 t2 = inl(acpi_gbl_FADT.xpm_timer_block.address);
@@ -396,6 +483,7 @@ static void acpi_processor_idle(void)
                 /* Compute time (ticks) that we were actually asleep */
                 sleep_ticks =
                     ticks_elapsed(t1, t2) - cx->latency_ticks - C2_OVERHEAD;
+                acpi_state_timer_broadcast(pr, cx, 0);
                 break;
 
         case ACPI_STATE_C3:
@@ -417,6 +505,7 @@ static void acpi_processor_idle(void)
                 /* Get start time (ticks) */
                 t1 = inl(acpi_gbl_FADT.xpm_timer_block.address);
                 /* Invoke C3 */
+                acpi_state_timer_broadcast(pr, cx, 1);
                 acpi_cstate_enter(cx);
                 /* Get end time (ticks) */
                 t2 = inl(acpi_gbl_FADT.xpm_timer_block.address);
@@ -436,6 +525,7 @@ static void acpi_processor_idle(void)
                 /* Compute time (ticks) that we were actually asleep */
                 sleep_ticks =
                     ticks_elapsed(t1, t2) - cx->latency_ticks - C3_OVERHEAD;
+                acpi_state_timer_broadcast(pr, cx, 0);
                 break;
 
         default:
@@ -904,11 +994,7 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
         unsigned int i;
         unsigned int working = 0;
 
-#ifdef ARCH_APICTIMER_STOPS_ON_C3
-        int timer_broadcast = 0;
-        cpumask_t mask = cpumask_of_cpu(pr->id);
-        on_each_cpu(switch_ipi_to_APIC_timer, &mask, 1, 1);
-#endif
+        pr->power.timer_broadcast_on_state = INT_MAX;
 
         for (i = 1; i < ACPI_PROCESSOR_MAX_POWER; i++) {
                 struct acpi_processor_cx *cx = &pr->power.states[i];
@@ -920,21 +1006,14 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
 
                 case ACPI_STATE_C2:
                         acpi_processor_power_verify_c2(cx);
-#ifdef ARCH_APICTIMER_STOPS_ON_C3
-                        /* Some AMD systems fake C3 as C2, but still
-                           have timer troubles */
-                        if (cx->valid && 
-                                boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
-                                timer_broadcast++;
-#endif
+                        if (cx->valid)
+                                acpi_timer_check_state(i, pr, cx);
                         break;
 
                 case ACPI_STATE_C3:
                         acpi_processor_power_verify_c3(pr, cx);
-#ifdef ARCH_APICTIMER_STOPS_ON_C3
                         if (cx->valid)
-                                timer_broadcast++;
-#endif
+                                acpi_timer_check_state(i, pr, cx);
                         break;
                 }
 
@@ -942,10 +1021,7 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
                         working++;
         }
 
-#ifdef ARCH_APICTIMER_STOPS_ON_C3
-        if (timer_broadcast)
-                on_each_cpu(switch_APIC_timer_to_ipi, &mask, 1, 1);
-#endif
+        acpi_propagate_timer_broadcast(pr);
 
         return (working);
 }
diff --git a/drivers/char/agp/Makefile b/drivers/char/agp/Makefile
index 3e581603d0a8..a0d04a23dacd 100644
--- a/drivers/char/agp/Makefile
+++ b/drivers/char/agp/Makefile
@@ -1,6 +1,7 @@
 agpgart-y := backend.o frontend.o generic.o isoch.o
 
 obj-$(CONFIG_AGP)               += agpgart.o
+obj-$(CONFIG_COMPAT)            += compat_ioctl.o
 obj-$(CONFIG_AGP_ALI)           += ali-agp.o
 obj-$(CONFIG_AGP_ATI)           += ati-agp.o
 obj-$(CONFIG_AGP_AMD)           += amd-k7-agp.o
diff --git a/drivers/char/agp/agp.h b/drivers/char/agp/agp.h
index 1d59e2a5b9aa..9bd68d9f0f59 100644
--- a/drivers/char/agp/agp.h
+++ b/drivers/char/agp/agp.h
@@ -114,6 +114,7 @@ struct agp_bridge_driver {
         void (*free_by_type)(struct agp_memory *);
         void *(*agp_alloc_page)(struct agp_bridge_data *);
         void (*agp_destroy_page)(void *);
+        int (*agp_type_to_mask_type) (struct agp_bridge_data *, int);
 };
 
 struct agp_bridge_data {
@@ -218,6 +219,7 @@ struct agp_bridge_data {
 #define I810_PTE_MAIN_UNCACHED  0x00000000
 #define I810_PTE_LOCAL          0x00000002
 #define I810_PTE_VALID          0x00000001
+#define I830_PTE_SYSTEM_CACHED  0x00000006
 #define I810_SMRAM_MISCC        0x70
 #define I810_GFX_MEM_WIN_SIZE   0x00010000
 #define I810_GFX_MEM_WIN_32M    0x00010000
@@ -270,8 +272,16 @@ void global_cache_flush(void);
 void get_agp_version(struct agp_bridge_data *bridge);
 unsigned long agp_generic_mask_memory(struct agp_bridge_data *bridge,
         unsigned long addr, int type);
+int agp_generic_type_to_mask_type(struct agp_bridge_data *bridge,
+                                  int type);
 struct agp_bridge_data *agp_generic_find_bridge(struct pci_dev *pdev);
 
+/* generic functions for user-populated AGP memory types */
+struct agp_memory *agp_generic_alloc_user(size_t page_count, int type);
+void agp_alloc_page_array(size_t size, struct agp_memory *mem);
+void agp_free_page_array(struct agp_memory *mem);
+
+
 /* generic routines for agp>=3 */
 int agp3_generic_fetch_size(void);
 void agp3_generic_tlbflush(struct agp_memory *mem);
@@ -288,6 +298,8 @@ extern struct aper_size_info_16 agp3_generic_sizes[];
 extern int agp_off;
 extern int agp_try_unsupported_boot;
 
+long compat_agp_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
+
 /* Chipset independant registers (from AGP Spec) */
 #define AGP_APBASE      0x10
 
diff --git a/drivers/char/agp/ali-agp.c b/drivers/char/agp/ali-agp.c
index 5a31ec7c62fc..98177a93076f 100644
--- a/drivers/char/agp/ali-agp.c
+++ b/drivers/char/agp/ali-agp.c
@@ -214,6 +214,7 @@ static struct agp_bridge_driver ali_generic_bridge = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = ali_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver ali_m1541_bridge = {
@@ -237,6 +238,7 @@ static struct agp_bridge_driver ali_m1541_bridge = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = m1541_alloc_page,
         .agp_destroy_page       = m1541_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 
diff --git a/drivers/char/agp/alpha-agp.c b/drivers/char/agp/alpha-agp.c
index b4e00a343da9..b0acf41c0db9 100644
--- a/drivers/char/agp/alpha-agp.c
+++ b/drivers/char/agp/alpha-agp.c
@@ -91,6 +91,9 @@ static int alpha_core_agp_insert_memory(struct agp_memory *mem, off_t pg_start,
         int num_entries, status;
         void *temp;
 
+        if (type >= AGP_USER_TYPES || mem->type >= AGP_USER_TYPES)
+                return -EINVAL;
+
         temp = agp_bridge->current_size;
         num_entries = A_SIZE_FIX(temp)->num_entries;
         if ((pg_start + mem->page_count) > num_entries)
@@ -142,6 +145,7 @@ struct agp_bridge_driver alpha_core_agp_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 struct agp_bridge_data *alpha_bridge;
diff --git a/drivers/char/agp/amd-k7-agp.c b/drivers/char/agp/amd-k7-agp.c
index c85c8cadb6df..3d8d448bf394 100644
--- a/drivers/char/agp/amd-k7-agp.c
+++ b/drivers/char/agp/amd-k7-agp.c
@@ -381,6 +381,7 @@ static struct agp_bridge_driver amd_irongate_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_device_ids amd_agp_device_ids[] __devinitdata =
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 93d2209fee4c..636d984ed4a6 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -62,12 +62,18 @@ static int amd64_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
 {
         int i, j, num_entries;
         long long tmp;
+        int mask_type;
+        struct agp_bridge_data *bridge = mem->bridge;
         u32 pte;
 
         num_entries = agp_num_entries();
 
-        if (type != 0 || mem->type != 0)
+        if (type != mem->type)
                 return -EINVAL;
+        mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);
+        if (mask_type != 0)
+                return -EINVAL;
+
 
         /* Make sure we can fit the range in the gatt table. */
         /* FIXME: could wrap */
@@ -90,7 +96,7 @@ static int amd64_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 tmp = agp_bridge->driver->mask_memory(agp_bridge,
-                        mem->memory[i], mem->type);
+                        mem->memory[i], mask_type);
 
                 BUG_ON(tmp & 0xffffff0000000ffcULL);
                 pte = (tmp & 0x000000ff00000000ULL) >> 28;
@@ -247,6 +253,7 @@ static struct agp_bridge_driver amd_8151_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 /* Some basic sanity checks for the aperture. */
diff --git a/drivers/char/agp/ati-agp.c b/drivers/char/agp/ati-agp.c
index 9987dc2e0c3f..77c9ad68fba9 100644
--- a/drivers/char/agp/ati-agp.c
+++ b/drivers/char/agp/ati-agp.c
@@ -431,6 +431,7 @@ static struct agp_bridge_driver ati_generic_bridge = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 
diff --git a/drivers/char/agp/backend.c b/drivers/char/agp/backend.c
index d59e037ddd12..ebdd6dd66edb 100644
--- a/drivers/char/agp/backend.c
+++ b/drivers/char/agp/backend.c
@@ -43,7 +43,7 @@
  * fix some real stupidity. It's only by chance we can bump
  * past 0.99 at all due to some boolean logic error. */
 #define AGPGART_VERSION_MAJOR 0
-#define AGPGART_VERSION_MINOR 101
+#define AGPGART_VERSION_MINOR 102
 static const struct agp_version agp_current_version =
 {
         .major = AGPGART_VERSION_MAJOR,
diff --git a/drivers/char/agp/compat_ioctl.c b/drivers/char/agp/compat_ioctl.c
new file mode 100644
index 000000000000..fcb4b1bf0d4e
--- /dev/null
+++ b/drivers/char/agp/compat_ioctl.c
@@ -0,0 +1,282 @@
+/*
+ * AGPGART driver frontend compatibility ioctls
+ * Copyright (C) 2004 Silicon Graphics, Inc.
+ * Copyright (C) 2002-2003 Dave Jones
+ * Copyright (C) 1999 Jeff Hartmann
+ * Copyright (C) 1999 Precision Insight, Inc.
+ * Copyright (C) 1999 Xi Graphics, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included
+ * in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * JEFF HARTMANN, OR ANY OTHER CONTRIBUTORS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE
+ * OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/pci.h>
+#include <linux/agpgart.h>
+#include <asm/uaccess.h>
+#include "agp.h"
+#include "compat_ioctl.h"
+
+static int compat_agpioc_info_wrap(struct agp_file_private *priv, void __user *arg)
+{
+        struct agp_info32 userinfo;
+        struct agp_kern_info kerninfo;
+
+        agp_copy_info(agp_bridge, &kerninfo);
+
+        userinfo.version.major = kerninfo.version.major;
+        userinfo.version.minor = kerninfo.version.minor;
+        userinfo.bridge_id = kerninfo.device->vendor |
+            (kerninfo.device->device << 16);
+        userinfo.agp_mode = kerninfo.mode;
+        userinfo.aper_base = (compat_long_t)kerninfo.aper_base;
+        userinfo.aper_size = kerninfo.aper_size;
+        userinfo.pg_total = userinfo.pg_system = kerninfo.max_memory;
+        userinfo.pg_used = kerninfo.current_memory;
+
+        if (copy_to_user(arg, &userinfo, sizeof(userinfo)))
+                return -EFAULT;
+
+        return 0;
+}
+
+static int compat_agpioc_reserve_wrap(struct agp_file_private *priv, void __user *arg)
+{
+        struct agp_region32 ureserve;
+        struct agp_region kreserve;
+        struct agp_client *client;
+        struct agp_file_private *client_priv;
+
+        DBG("");
+        if (copy_from_user(&ureserve, arg, sizeof(ureserve)))
+                return -EFAULT;
+
+        if ((unsigned) ureserve.seg_count >= ~0U/sizeof(struct agp_segment32))
+                return -EFAULT;
+
+        kreserve.pid = ureserve.pid;
+        kreserve.seg_count = ureserve.seg_count;
+
+        client = agp_find_client_by_pid(kreserve.pid);
+
+        if (kreserve.seg_count == 0) {
+                /* remove a client */
+                client_priv = agp_find_private(kreserve.pid);
+
+                if (client_priv != NULL) {
+                        set_bit(AGP_FF_IS_CLIENT, &client_priv->access_flags);
+                        set_bit(AGP_FF_IS_VALID, &client_priv->access_flags);
+                }
+                if (client == NULL) {
+                        /* client is already removed */
+                        return 0;
+                }
+                return agp_remove_client(kreserve.pid);
+        } else {
+                struct agp_segment32 *usegment;
+                struct agp_segment *ksegment;
+                int seg;
+
+                if (ureserve.seg_count >= 16384)
+                        return -EINVAL;
+
+                usegment = kmalloc(sizeof(*usegment) * ureserve.seg_count, GFP_KERNEL);
+                if (!usegment)
+                        return -ENOMEM;
+
+                ksegment = kmalloc(sizeof(*ksegment) * kreserve.seg_count, GFP_KERNEL);
+                if (!ksegment) {
+                        kfree(usegment);
+                        return -ENOMEM;
+                }
+
+                if (copy_from_user(usegment, (void __user *) ureserve.seg_list,
+                                   sizeof(*usegment) * ureserve.seg_count)) {
+                        kfree(usegment);
+                        kfree(ksegment);
+                        return -EFAULT;
+                }
+
+                for (seg = 0; seg < ureserve.seg_count; seg++) {
+                        ksegment[seg].pg_start = usegment[seg].pg_start;
+                        ksegment[seg].pg_count = usegment[seg].pg_count;
+                        ksegment[seg].prot = usegment[seg].prot;
+                }
+
+                kfree(usegment);
+                kreserve.seg_list = ksegment;
+
+                if (client == NULL) {
+                        /* Create the client and add the segment */
+                        client = agp_create_client(kreserve.pid);
+
+                        if (client == NULL) {
+                                kfree(ksegment);
+                                return -ENOMEM;
+                        }
+                        client_priv = agp_find_private(kreserve.pid);
+
+                        if (client_priv != NULL) {
+                                set_bit(AGP_FF_IS_CLIENT, &client_priv->access_flags);
+                                set_bit(AGP_FF_IS_VALID, &client_priv->access_flags);
+                        }
+                }
+                return agp_create_segment(client, &kreserve);
+        }
+        /* Will never really happen */
+        return -EINVAL;
+}
+
+static int compat_agpioc_allocate_wrap(struct agp_file_private *priv, void __user *arg)
+{
+        struct agp_memory *memory;
+        struct agp_allocate32 alloc;
+
+        DBG("");
+        if (copy_from_user(&alloc, arg, sizeof(alloc)))
+                return -EFAULT;
+
+        memory = agp_allocate_memory_wrap(alloc.pg_count, alloc.type);
+
+        if (memory == NULL)
+                return -ENOMEM;
+
+        alloc.key = memory->key;
+        alloc.physical = memory->physical;
+
+        if (copy_to_user(arg, &alloc, sizeof(alloc))) {
+                agp_free_memory_wrap(memory);
+                return -EFAULT;
+        }
+        return 0;
+}
+
+static int compat_agpioc_bind_wrap(struct agp_file_private *priv, void __user *arg)
+{
+        struct agp_bind32 bind_info;
+        struct agp_memory *memory;
+
+        DBG("");
+        if (copy_from_user(&bind_info, arg, sizeof(bind_info)))
+                return -EFAULT;
+
+        memory = agp_find_mem_by_key(bind_info.key);
+
+        if (memory == NULL)
+                return -EINVAL;
+
+        return agp_bind_memory(memory, bind_info.pg_start);
+}
+
+static int compat_agpioc_unbind_wrap(struct agp_file_private *priv, void __user *arg)
+{
+        struct agp_memory *memory;
+        struct agp_unbind32 unbind;
+
+        DBG("");
+        if (copy_from_user(&unbind, arg, sizeof(unbind)))
+                return -EFAULT;
+
+        memory = agp_find_mem_by_key(unbind.key);
+
+        if (memory == NULL)
+                return -EINVAL;
+
+        return agp_unbind_memory(memory);
+}
+
+long compat_agp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+        struct agp_file_private *curr_priv = file->private_data;
+        int ret_val = -ENOTTY;
+
+        mutex_lock(&(agp_fe.agp_mutex));
+
+        if ((agp_fe.current_controller == NULL) &&
+            (cmd != AGPIOC_ACQUIRE32)) {
+                ret_val = -EINVAL;
+                goto ioctl_out;
+        }
+        if ((agp_fe.backend_acquired != TRUE) &&
+            (cmd != AGPIOC_ACQUIRE32)) {
+                ret_val = -EBUSY;
+                goto ioctl_out;
+        }
+        if (cmd != AGPIOC_ACQUIRE32) {
+                if (!(test_bit(AGP_FF_IS_CONTROLLER, &curr_priv->access_flags))) {
+                        ret_val = -EPERM;
+                        goto ioctl_out;
+                }
+                /* Use the original pid of the controller,
+                 * in case it's threaded */
+
+                if (agp_fe.current_controller->pid != curr_priv->my_pid) {
+                        ret_val = -EBUSY;
+                        goto ioctl_out;
+                }
+        }
+
+        switch (cmd) {
+        case AGPIOC_INFO32:
+                ret_val = compat_agpioc_info_wrap(curr_priv, (void __user *) arg);
+                break;
+
+        case AGPIOC_ACQUIRE32:
+                ret_val = agpioc_acquire_wrap(curr_priv);
+                break;
+
+        case AGPIOC_RELEASE32:
+                ret_val = agpioc_release_wrap(curr_priv);
+                break;
+
+        case AGPIOC_SETUP32:
+                ret_val = agpioc_setup_wrap(curr_priv, (void __user *) arg);
+                break;
+
+        case AGPIOC_RESERVE32:
+                ret_val = compat_agpioc_reserve_wrap(curr_priv, (void __user *) arg);
+                break;
+
+        case AGPIOC_PROTECT32:
+                ret_val = agpioc_protect_wrap(curr_priv);
+                break;
+
+        case AGPIOC_ALLOCATE32:
+                ret_val = compat_agpioc_allocate_wrap(curr_priv, (void __user *) arg);
+                break;
+
+        case AGPIOC_DEALLOCATE32:
+                ret_val = agpioc_deallocate_wrap(curr_priv, (int) arg);
+                break;
+
+        case AGPIOC_BIND32:
+                ret_val = compat_agpioc_bind_wrap(curr_priv, (void __user *) arg);
+                break;
+
+        case AGPIOC_UNBIND32:
+                ret_val = compat_agpioc_unbind_wrap(curr_priv, (void __user *) arg);
+                break;
+        }
+
+ioctl_out:
+        DBG("ioctl returns %d\n", ret_val);
+        mutex_unlock(&(agp_fe.agp_mutex));
+        return ret_val;
+}
+
diff --git a/drivers/char/agp/compat_ioctl.h b/drivers/char/agp/compat_ioctl.h
new file mode 100644
index 000000000000..71939d637236
--- /dev/null
+++ b/drivers/char/agp/compat_ioctl.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 1999 Jeff Hartmann
+ * Copyright (C) 1999 Precision Insight, Inc.
+ * Copyright (C) 1999 Xi Graphics, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included
+ * in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * JEFF HARTMANN, OR ANY OTHER CONTRIBUTORS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE
+ * OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#ifndef _AGP_COMPAT_IOCTL_H
+#define _AGP_COMPAT_IOCTL_H
+
+#include <linux/compat.h>
+#include <linux/agpgart.h>
+
+#define AGPIOC_INFO32       _IOR (AGPIOC_BASE, 0, compat_uptr_t)
+#define AGPIOC_ACQUIRE32    _IO  (AGPIOC_BASE, 1)
+#define AGPIOC_RELEASE32    _IO  (AGPIOC_BASE, 2)
+#define AGPIOC_SETUP32      _IOW (AGPIOC_BASE, 3, compat_uptr_t)
+#define AGPIOC_RESERVE32    _IOW (AGPIOC_BASE, 4, compat_uptr_t)
+#define AGPIOC_PROTECT32    _IOW (AGPIOC_BASE, 5, compat_uptr_t)
+#define AGPIOC_ALLOCATE32   _IOWR(AGPIOC_BASE, 6, compat_uptr_t)
+#define AGPIOC_DEALLOCATE32 _IOW (AGPIOC_BASE, 7, compat_int_t)
+#define AGPIOC_BIND32       _IOW (AGPIOC_BASE, 8, compat_uptr_t)
+#define AGPIOC_UNBIND32     _IOW (AGPIOC_BASE, 9, compat_uptr_t)
+
+struct agp_info32 {
+        struct agp_version version;     /* version of the driver        */
+        u32 bridge_id;          /* bridge vendor/device         */
+        u32 agp_mode;           /* mode info of bridge          */
+        compat_long_t aper_base;        /* base of aperture             */
+        compat_size_t aper_size;        /* size of aperture             */
+        compat_size_t pg_total; /* max pages (swap + system)    */
+        compat_size_t pg_system;        /* max pages (system)           */
+        compat_size_t pg_used;          /* current pages used           */
+};
+
+/*
+ * The "prot" down below needs still a "sleep" flag somehow ...
+ */
+struct agp_segment32 {
+        compat_off_t pg_start;          /* starting page to populate    */
+        compat_size_t pg_count; /* number of pages              */
+        compat_int_t prot;              /* prot flags for mmap          */
+};
+
+struct agp_region32 {
+        compat_pid_t pid;               /* pid of process               */
+        compat_size_t seg_count;        /* number of segments           */
+        struct agp_segment32 *seg_list;
+};
+
+struct agp_allocate32 {
+        compat_int_t key;               /* tag of allocation            */
+        compat_size_t pg_count; /* number of pages              */
+        u32 type;               /* 0 == normal, other devspec   */
+        u32 physical;           /* device specific (some devices
+                                 * need a phys address of the
+                                 * actual page behind the gatt
+                                 * table)                        */
+};
+
+struct agp_bind32 {
+        compat_int_t key;               /* tag of allocation            */
+        compat_off_t pg_start;          /* starting page to populate    */
+};
+
+struct agp_unbind32 {
+        compat_int_t key;               /* tag of allocation            */
+        u32 priority;           /* priority for paging out      */
+};
+
+extern struct agp_front_data agp_fe;
+
+int agpioc_acquire_wrap(struct agp_file_private *priv);
+int agpioc_release_wrap(struct agp_file_private *priv);
+int agpioc_protect_wrap(struct agp_file_private *priv);
+int agpioc_setup_wrap(struct agp_file_private *priv, void __user *arg);
+int agpioc_deallocate_wrap(struct agp_file_private *priv, int arg);
+struct agp_file_private *agp_find_private(pid_t pid);
+struct agp_client *agp_create_client(pid_t id);
+int agp_remove_client(pid_t id);
+int agp_create_segment(struct agp_client *client, struct agp_region *region);
+void agp_free_memory_wrap(struct agp_memory *memory);
+struct agp_memory *agp_allocate_memory_wrap(size_t pg_count, u32 type);
+struct agp_memory *agp_find_mem_by_key(int key);
+struct agp_client *agp_find_client_by_pid(pid_t id);
+
+#endif /* _AGP_COMPAT_H */
diff --git a/drivers/char/agp/efficeon-agp.c b/drivers/char/agp/efficeon-agp.c
index 30f730ff81c1..658cb1a72d2c 100644
--- a/drivers/char/agp/efficeon-agp.c
+++ b/drivers/char/agp/efficeon-agp.c
@@ -335,6 +335,7 @@ static struct agp_bridge_driver efficeon_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static int __devinit agp_efficeon_probe(struct pci_dev *pdev,
diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
index 0f2ed2aa2d81..679d7f972439 100644
--- a/drivers/char/agp/frontend.c
+++ b/drivers/char/agp/frontend.c
@@ -41,9 +41,9 @@
 #include <asm/pgtable.h>
 #include "agp.h"
 
-static struct agp_front_data agp_fe;
+struct agp_front_data agp_fe;
 
-static struct agp_memory *agp_find_mem_by_key(int key)
+struct agp_memory *agp_find_mem_by_key(int key)
 {
         struct agp_memory *curr;
 
@@ -159,7 +159,7 @@ static pgprot_t agp_convert_mmap_flags(int prot)
         return vm_get_page_prot(prot_bits);
 }
 
-static int agp_create_segment(struct agp_client *client, struct agp_region *region)
+int agp_create_segment(struct agp_client *client, struct agp_region *region)
 {
         struct agp_segment_priv **ret_seg;
         struct agp_segment_priv *seg;
@@ -211,7 +211,7 @@ static void agp_insert_into_pool(struct agp_memory * temp)
 
 /* File private list routines */
 
-static struct agp_file_private *agp_find_private(pid_t pid)
+struct agp_file_private *agp_find_private(pid_t pid)
 {
         struct agp_file_private *curr;
 
@@ -266,13 +266,13 @@ static void agp_remove_file_private(struct agp_file_private * priv)
  * Wrappers for agp_free_memory & agp_allocate_memory
  * These make sure that internal lists are kept updated.
  */
-static void agp_free_memory_wrap(struct agp_memory *memory)
+void agp_free_memory_wrap(struct agp_memory *memory)
 {
         agp_remove_from_pool(memory);
         agp_free_memory(memory);
 }
 
-static struct agp_memory *agp_allocate_memory_wrap(size_t pg_count, u32 type)
+struct agp_memory *agp_allocate_memory_wrap(size_t pg_count, u32 type)
 {
         struct agp_memory *memory;
 
@@ -484,7 +484,7 @@ static struct agp_controller *agp_find_controller_for_client(pid_t id)
         return NULL;
 }
 
-static struct agp_client *agp_find_client_by_pid(pid_t id)
+struct agp_client *agp_find_client_by_pid(pid_t id)
 {
         struct agp_client *temp;
 
@@ -509,7 +509,7 @@ static void agp_insert_client(struct agp_client *client)
         agp_fe.current_controller->num_clients++;
 }
 
-static struct agp_client *agp_create_client(pid_t id)
+struct agp_client *agp_create_client(pid_t id)
 {
         struct agp_client *new_client;
 
@@ -522,7 +522,7 @@ static struct agp_client *agp_create_client(pid_t id)
         return new_client;
 }
 
-static int agp_remove_client(pid_t id)
+int agp_remove_client(pid_t id)
 {
         struct agp_client *client;
         struct agp_client *prev_client;
@@ -746,7 +746,7 @@ static int agpioc_info_wrap(struct agp_file_private *priv, void __user *arg)
         return 0;
 }
 
-static int agpioc_acquire_wrap(struct agp_file_private *priv)
+int agpioc_acquire_wrap(struct agp_file_private *priv)
 {
         struct agp_controller *controller;
 
@@ -789,14 +789,14 @@ static int agpioc_acquire_wrap(struct agp_file_private *priv)
         return 0;
 }
 
-static int agpioc_release_wrap(struct agp_file_private *priv)
+int agpioc_release_wrap(struct agp_file_private *priv)
 {
         DBG("");
         agp_controller_release_current(agp_fe.current_controller, priv);
         return 0;
 }
 
-static int agpioc_setup_wrap(struct agp_file_private *priv, void __user *arg)
+int agpioc_setup_wrap(struct agp_file_private *priv, void __user *arg)
 {
         struct agp_setup mode;
 
@@ -876,7 +876,7 @@ static int agpioc_reserve_wrap(struct agp_file_private *priv, void __user *arg)
         return -EINVAL;
 }
 
-static int agpioc_protect_wrap(struct agp_file_private *priv)
+int agpioc_protect_wrap(struct agp_file_private *priv)
 {
         DBG("");
         /* This function is not currently implemented */
@@ -892,6 +892,9 @@ static int agpioc_allocate_wrap(struct agp_file_private *priv, void __user *arg)
         if (copy_from_user(&alloc, arg, sizeof(struct agp_allocate)))
                 return -EFAULT;
 
+        if (alloc.type >= AGP_USER_TYPES)
+                return -EINVAL;
+
         memory = agp_allocate_memory_wrap(alloc.pg_count, alloc.type);
 
         if (memory == NULL)
@@ -907,7 +910,7 @@ static int agpioc_allocate_wrap(struct agp_file_private *priv, void __user *arg)
         return 0;
 }
 
-static int agpioc_deallocate_wrap(struct agp_file_private *priv, int arg)
+int agpioc_deallocate_wrap(struct agp_file_private *priv, int arg)
 {
         struct agp_memory *memory;
 
@@ -1043,6 +1046,9 @@ static const struct file_operations agp_fops =
         .read           = agp_read,
         .write          = agp_write,
         .ioctl          = agp_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = compat_agp_ioctl,
+#endif
         .mmap           = agp_mmap,
         .open           = agp_open,
         .release        = agp_release,
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 3491d6f84bc6..7923337c3d26 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -101,6 +101,63 @@ static int agp_get_key(void)
         return -1;
 }
 
+/*
+ * Use kmalloc if possible for the page list. Otherwise fall back to
+ * vmalloc. This speeds things up and also saves memory for small AGP
+ * regions.
+ */
+
+void agp_alloc_page_array(size_t size, struct agp_memory *mem)
+{
+        mem->memory = NULL;
+        mem->vmalloc_flag = 0;
+
+        if (size <= 2*PAGE_SIZE)
+                mem->memory = kmalloc(size, GFP_KERNEL | __GFP_NORETRY);
+        if (mem->memory == NULL) {
+                mem->memory = vmalloc(size);
+                mem->vmalloc_flag = 1;
+        }
+}
+EXPORT_SYMBOL(agp_alloc_page_array);
+
+void agp_free_page_array(struct agp_memory *mem)
+{
+        if (mem->vmalloc_flag) {
+                vfree(mem->memory);
+        } else {
+                kfree(mem->memory);
+        }
+}
+EXPORT_SYMBOL(agp_free_page_array);
+
+
+static struct agp_memory *agp_create_user_memory(unsigned long num_agp_pages)
+{
+        struct agp_memory *new;
+        unsigned long alloc_size = num_agp_pages*sizeof(struct page *);
+
+        new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
+        if (new == NULL)
+                return NULL;
+
+        new->key = agp_get_key();
+
+        if (new->key < 0) {
+                kfree(new);
+                return NULL;
+        }
+
+        agp_alloc_page_array(alloc_size, new);
+
+        if (new->memory == NULL) {
+                agp_free_key(new->key);
+                kfree(new);
+                return NULL;
+        }
+        new->num_scratch_pages = 0;
+        return new;
+}
 
 struct agp_memory *agp_create_memory(int scratch_pages)
 {
@@ -116,7 +173,8 @@ struct agp_memory *agp_create_memory(int scratch_pages)
                 kfree(new);
                 return NULL;
         }
-        new->memory = vmalloc(PAGE_SIZE * scratch_pages);
+
+        agp_alloc_page_array(PAGE_SIZE * scratch_pages, new);
 
         if (new->memory == NULL) {
                 agp_free_key(new->key);
@@ -124,6 +182,7 @@ struct agp_memory *agp_create_memory(int scratch_pages)
                 return NULL;
         }
         new->num_scratch_pages = scratch_pages;
+        new->type = AGP_NORMAL_MEMORY;
         return new;
 }
 EXPORT_SYMBOL(agp_create_memory);
@@ -146,6 +205,11 @@ void agp_free_memory(struct agp_memory *curr)
         if (curr->is_bound == TRUE)
                 agp_unbind_memory(curr);
 
+        if (curr->type >= AGP_USER_TYPES) {
+                agp_generic_free_by_type(curr);
+                return;
+        }
+
         if (curr->type != 0) {
                 curr->bridge->driver->free_by_type(curr);
                 return;
@@ -157,7 +221,7 @@ void agp_free_memory(struct agp_memory *curr)
                 flush_agp_mappings();
         }
         agp_free_key(curr->key);
-        vfree(curr->memory);
+        agp_free_page_array(curr);
         kfree(curr);
 }
 EXPORT_SYMBOL(agp_free_memory);
@@ -188,6 +252,13 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,
         if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp)
                 return NULL;
 
+        if (type >= AGP_USER_TYPES) {
+                new = agp_generic_alloc_user(page_count, type);
+                if (new)
+                        new->bridge = bridge;
+                return new;
+        }
+
         if (type != 0) {
                 new = bridge->driver->alloc_by_type(page_count, type);
                 if (new)
@@ -960,6 +1031,7 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
         off_t j;
         void *temp;
         struct agp_bridge_data *bridge;
+        int mask_type;
 
         bridge = mem->bridge;
         if (!bridge)
@@ -995,7 +1067,11 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
         num_entries -= agp_memory_reserved/PAGE_SIZE;
         if (num_entries < 0) num_entries = 0;
 
-        if (type != 0 || mem->type != 0) {
+        if (type != mem->type)
+                return -EINVAL;
+
+        mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);
+        if (mask_type != 0) {
                 /* The generic routines know nothing of memory types */
                 return -EINVAL;
         }
@@ -1018,7 +1094,8 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
         }
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
-                writel(bridge->driver->mask_memory(bridge, mem->memory[i], mem->type), bridge->gatt_table+j);
+                writel(bridge->driver->mask_memory(bridge, mem->memory[i], mask_type),
+                       bridge->gatt_table+j);
         }
         readl(bridge->gatt_table+j-1);  /* PCI Posting. */
 
@@ -1032,6 +1109,7 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
 {
         size_t i;
         struct agp_bridge_data *bridge;
+        int mask_type;
 
         bridge = mem->bridge;
         if (!bridge)
@@ -1040,7 +1118,11 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
         if (mem->page_count == 0)
                 return 0;
 
-        if (type != 0 || mem->type != 0) {
+        if (type != mem->type)
+                return -EINVAL;
+
+        mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);
+        if (mask_type != 0) {
                 /* The generic routines know nothing of memory types */
                 return -EINVAL;
         }
@@ -1056,22 +1138,40 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
 }
 EXPORT_SYMBOL(agp_generic_remove_memory);
 
-
 struct agp_memory *agp_generic_alloc_by_type(size_t page_count, int type)
 {
         return NULL;
 }
 EXPORT_SYMBOL(agp_generic_alloc_by_type);
 
-
 void agp_generic_free_by_type(struct agp_memory *curr)
 {
-        vfree(curr->memory);
+        agp_free_page_array(curr);
         agp_free_key(curr->key);
         kfree(curr);
 }
 EXPORT_SYMBOL(agp_generic_free_by_type);
 
+struct agp_memory *agp_generic_alloc_user(size_t page_count, int type)
+{
+        struct agp_memory *new;
+        int i;
+        int pages;
+
+        pages = (page_count + ENTRIES_PER_PAGE - 1) / ENTRIES_PER_PAGE;
+        new = agp_create_user_memory(page_count);
+        if (new == NULL)
+                return NULL;
+
+        for (i = 0; i < page_count; i++)
+                new->memory[i] = 0;
+        new->page_count = 0;
+        new->type = type;
+        new->num_scratch_pages = pages;
+
+        return new;
+}
+EXPORT_SYMBOL(agp_generic_alloc_user);
 
 /*
  * Basic Page Allocation Routines -
@@ -1165,6 +1265,15 @@ unsigned long agp_generic_mask_memory(struct agp_bridge_data *bridge,
 }
 EXPORT_SYMBOL(agp_generic_mask_memory);
 
+int agp_generic_type_to_mask_type(struct agp_bridge_data *bridge,
+                                  int type)
+{
+        if (type >= AGP_USER_TYPES)
+                return 0;
+        return type;
+}
+EXPORT_SYMBOL(agp_generic_type_to_mask_type);
+
 /*
  * These functions are implemented according to the AGPv3 spec,
  * which covers implementation details that had previously been
diff --git a/drivers/char/agp/hp-agp.c b/drivers/char/agp/hp-agp.c
index 907fb66ec4a9..847deabf7f9b 100644
--- a/drivers/char/agp/hp-agp.c
+++ b/drivers/char/agp/hp-agp.c
@@ -438,6 +438,7 @@ struct agp_bridge_driver hp_zx1_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
         .cant_use_aperture      = 1,
 };
 
diff --git a/drivers/char/agp/i460-agp.c b/drivers/char/agp/i460-agp.c
index 91769443d8fe..3e7618653abd 100644
--- a/drivers/char/agp/i460-agp.c
+++ b/drivers/char/agp/i460-agp.c
@@ -293,6 +293,9 @@ static int i460_insert_memory_small_io_page (struct agp_memory *mem,
         pr_debug("i460_insert_memory_small_io_page(mem=%p, pg_start=%ld, type=%d, paddr0=0x%lx)\n",
                  mem, pg_start, type, mem->memory[0]);
 
+        if (type >= AGP_USER_TYPES || mem->type >= AGP_USER_TYPES)
+                return -EINVAL;
+
         io_pg_start = I460_IOPAGES_PER_KPAGE * pg_start;
 
         temp = agp_bridge->current_size;
@@ -396,6 +399,9 @@ static int i460_insert_memory_large_io_page (struct agp_memory *mem,
         struct lp_desc *start, *end, *lp;
         void *temp;
 
+        if (type >= AGP_USER_TYPES || mem->type >= AGP_USER_TYPES)
+                return -EINVAL;
+
         temp = agp_bridge->current_size;
         num_entries = A_SIZE_8(temp)->num_entries;
 
@@ -572,6 +578,7 @@ struct agp_bridge_driver intel_i460_driver = {
 #endif
         .alloc_by_type          = agp_generic_alloc_by_type,
         .free_by_type           = agp_generic_free_by_type,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
         .cant_use_aperture      = 1,
 };
 
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index a3011de51f7c..06b0bb6d982f 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -5,6 +5,7 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/init.h>
+#include <linux/kernel.h>
 #include <linux/pagemap.h>
 #include <linux/agp_backend.h>
 #include "agp.h"
@@ -24,6 +25,9 @@
                  agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965G_HB)
 
 
+extern int agp_memory_reserved;
+
+
 /* Intel 815 register */
 #define INTEL_815_APCONT        0x51
 #define INTEL_815_ATTBASE_MASK  ~0x1FFFFFFF
@@ -68,12 +72,15 @@ static struct aper_size_info_fixed intel_i810_sizes[] =
 
 #define AGP_DCACHE_MEMORY       1
 #define AGP_PHYS_MEMORY         2
+#define INTEL_AGP_CACHED_MEMORY 3
 
 static struct gatt_mask intel_i810_masks[] =
 {
         {.mask = I810_PTE_VALID, .type = 0},
         {.mask = (I810_PTE_VALID | I810_PTE_LOCAL), .type = AGP_DCACHE_MEMORY},
-        {.mask = I810_PTE_VALID, .type = 0}
+        {.mask = I810_PTE_VALID, .type = 0},
+        {.mask = I810_PTE_VALID | I830_PTE_SYSTEM_CACHED,
+         .type = INTEL_AGP_CACHED_MEMORY}
 };
 
 static struct _intel_i810_private {
@@ -117,13 +124,15 @@ static int intel_i810_configure(void)
 
         current_size = A_SIZE_FIX(agp_bridge->current_size);
 
-        pci_read_config_dword(intel_i810_private.i810_dev, I810_MMADDR, &temp);
-        temp &= 0xfff80000;
-
-        intel_i810_private.registers = ioremap(temp, 128 * 4096);
         if (!intel_i810_private.registers) {
-                printk(KERN_ERR PFX "Unable to remap memory.\n");
-                return -ENOMEM;
+                pci_read_config_dword(intel_i810_private.i810_dev, I810_MMADDR, &temp);
+                temp &= 0xfff80000;
+
+                intel_i810_private.registers = ioremap(temp, 128 * 4096);
+                if (!intel_i810_private.registers) {
+                        printk(KERN_ERR PFX "Unable to remap memory.\n");
+                        return -ENOMEM;
+                }
         }
 
         if ((readl(intel_i810_private.registers+I810_DRAM_CTL)
@@ -201,62 +210,79 @@ static void i8xx_destroy_pages(void *addr)
         atomic_dec(&agp_bridge->current_memory_agp);
 }
 
+static int intel_i830_type_to_mask_type(struct agp_bridge_data *bridge,
+                                        int type)
+{
+        if (type < AGP_USER_TYPES)
+                return type;
+        else if (type == AGP_USER_CACHED_MEMORY)
+                return INTEL_AGP_CACHED_MEMORY;
+        else
+                return 0;
+}
+
 static int intel_i810_insert_entries(struct agp_memory *mem, off_t pg_start,
                                 int type)
 {
         int i, j, num_entries;
         void *temp;
+        int ret = -EINVAL;
+        int mask_type;
 
         if (mem->page_count == 0)
-                return 0;
+                goto out;
 
         temp = agp_bridge->current_size;
         num_entries = A_SIZE_FIX(temp)->num_entries;
 
         if ((pg_start + mem->page_count) > num_entries)
-                return -EINVAL;
+                goto out_err;
 
-        for (j = pg_start; j < (pg_start + mem->page_count); j++) {
-                if (!PGE_EMPTY(agp_bridge, readl(agp_bridge->gatt_table+j)))
-                        return -EBUSY;
-        }
 
-        if (type != 0 || mem->type != 0) {
-                if ((type == AGP_DCACHE_MEMORY) && (mem->type == AGP_DCACHE_MEMORY)) {
-                        /* special insert */
-                        if (!mem->is_flushed) {
-                                global_cache_flush();
-                                mem->is_flushed = TRUE;
-                        }
-
-                        for (i = pg_start; i < (pg_start + mem->page_count); i++) {
-                                writel((i*4096)|I810_PTE_LOCAL|I810_PTE_VALID, intel_i810_private.registers+I810_PTE_BASE+(i*4));
-                        }
-                        readl(intel_i810_private.registers+I810_PTE_BASE+((i-1)*4));    /* PCI Posting. */
-
-                        agp_bridge->driver->tlb_flush(mem);
-                        return 0;
+        for (j = pg_start; j < (pg_start + mem->page_count); j++) {
+                if (!PGE_EMPTY(agp_bridge, readl(agp_bridge->gatt_table+j))) {
+                        ret = -EBUSY;
+                        goto out_err;
                 }
-                if ((type == AGP_PHYS_MEMORY) && (mem->type == AGP_PHYS_MEMORY))
-                        goto insert;
-                return -EINVAL;
         }
 
-insert:
-        if (!mem->is_flushed) {
-                global_cache_flush();
-                mem->is_flushed = TRUE;
-        }
+        if (type != mem->type)
+                goto out_err;
 
-        for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
-                writel(agp_bridge->driver->mask_memory(agp_bridge,
-                        mem->memory[i], mem->type),
-                        intel_i810_private.registers+I810_PTE_BASE+(j*4));
+        mask_type = agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type);
+
+        switch (mask_type) {
+        case AGP_DCACHE_MEMORY:
+                if (!mem->is_flushed)
+                        global_cache_flush();
+                for (i = pg_start; i < (pg_start + mem->page_count); i++) {
+                        writel((i*4096)|I810_PTE_LOCAL|I810_PTE_VALID,
+                               intel_i810_private.registers+I810_PTE_BASE+(i*4));
+                }
+                readl(intel_i810_private.registers+I810_PTE_BASE+((i-1)*4));
+                break;
+        case AGP_PHYS_MEMORY:
+        case AGP_NORMAL_MEMORY:
+                if (!mem->is_flushed)
+                        global_cache_flush();
+                for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
+                        writel(agp_bridge->driver->mask_memory(agp_bridge,
+                                                               mem->memory[i],
+                                                               mask_type),
+                               intel_i810_private.registers+I810_PTE_BASE+(j*4));
+                }
+                readl(intel_i810_private.registers+I810_PTE_BASE+((j-1)*4));
+                break;
+        default:
+                goto out_err;
         }
-        readl(intel_i810_private.registers+I810_PTE_BASE+((j-1)*4));    /* PCI Posting. */
 
         agp_bridge->driver->tlb_flush(mem);
-        return 0;
+out:
+        ret = 0;
+out_err:
+        mem->is_flushed = 1;
+        return ret;
 }
 
 static int intel_i810_remove_entries(struct agp_memory *mem, off_t pg_start,
@@ -337,12 +363,11 @@ static struct agp_memory *intel_i810_alloc_by_type(size_t pg_count, int type)
                 new->type = AGP_DCACHE_MEMORY;
                 new->page_count = pg_count;
                 new->num_scratch_pages = 0;
-                vfree(new->memory);
+                agp_free_page_array(new);
                 return new;
         }
         if (type == AGP_PHYS_MEMORY)
                 return alloc_agpphysmem_i8xx(pg_count, type);
-
         return NULL;
 }
 
@@ -357,7 +382,7 @@ static void intel_i810_free_by_type(struct agp_memory *curr)
                                  gart_to_virt(curr->memory[0]));
                         global_flush_tlb();
                 }
-                vfree(curr->memory);
+                agp_free_page_array(curr);
         }
         kfree(curr);
 }
@@ -619,9 +644,11 @@ static int intel_i830_insert_entries(struct agp_memory *mem,off_t pg_start, int
 {
         int i,j,num_entries;
         void *temp;
+        int ret = -EINVAL;
+        int mask_type;
 
         if (mem->page_count == 0)
-                return 0;
+                goto out;
 
         temp = agp_bridge->current_size;
         num_entries = A_SIZE_FIX(temp)->num_entries;
@@ -631,34 +658,41 @@ static int intel_i830_insert_entries(struct agp_memory *mem,off_t pg_start, int
                                 pg_start,intel_i830_private.gtt_entries);
 
                 printk (KERN_INFO PFX "Trying to insert into local/stolen memory\n");
-                return -EINVAL;
+                goto out_err;
         }
 
         if ((pg_start + mem->page_count) > num_entries)
-                return -EINVAL;
+                goto out_err;
 
         /* The i830 can't check the GTT for entries since its read only,
          * depend on the caller to make the correct offset decisions.
          */
 
-        if ((type != 0 && type != AGP_PHYS_MEMORY) ||
-                (mem->type != 0 && mem->type != AGP_PHYS_MEMORY))
-                return -EINVAL;
+        if (type != mem->type)
+                goto out_err;
+
+        mask_type = agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type);
 
-        if (!mem->is_flushed) {
+        if (mask_type != 0 && mask_type != AGP_PHYS_MEMORY &&
+            mask_type != INTEL_AGP_CACHED_MEMORY)
+                goto out_err;
+
+        if (!mem->is_flushed)
                 global_cache_flush();
-                mem->is_flushed = TRUE;
-        }
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 writel(agp_bridge->driver->mask_memory(agp_bridge,
-                        mem->memory[i], mem->type),
-                        intel_i830_private.registers+I810_PTE_BASE+(j*4));
+                                                       mem->memory[i], mask_type),
+                       intel_i830_private.registers+I810_PTE_BASE+(j*4));
         }
         readl(intel_i830_private.registers+I810_PTE_BASE+((j-1)*4));
-
         agp_bridge->driver->tlb_flush(mem);
-        return 0;
+
+out:
+        ret = 0;
+out_err:
+        mem->is_flushed = 1;
+        return ret;
 }
 
 static int intel_i830_remove_entries(struct agp_memory *mem,off_t pg_start,
@@ -687,7 +721,6 @@ static struct agp_memory *intel_i830_alloc_by_type(size_t pg_count,int type)
 {
         if (type == AGP_PHYS_MEMORY)
                 return alloc_agpphysmem_i8xx(pg_count, type);
-
         /* always return NULL for other allocation types for now */
         return NULL;
 }
@@ -734,9 +767,11 @@ static int intel_i915_insert_entries(struct agp_memory *mem,off_t pg_start,
 {
         int i,j,num_entries;
         void *temp;
+        int ret = -EINVAL;
+        int mask_type;
 
         if (mem->page_count == 0)
-                return 0;
+                goto out;
 
         temp = agp_bridge->current_size;
         num_entries = A_SIZE_FIX(temp)->num_entries;
@@ -746,33 +781,41 @@ static int intel_i915_insert_entries(struct agp_memory *mem,off_t pg_start,
                                 pg_start,intel_i830_private.gtt_entries);
 
                 printk (KERN_INFO PFX "Trying to insert into local/stolen memory\n");
-                return -EINVAL;
+                goto out_err;
         }
 
         if ((pg_start + mem->page_count) > num_entries)
-                return -EINVAL;
+                goto out_err;
 
-        /* The i830 can't check the GTT for entries since its read only,
+        /* The i915 can't check the GTT for entries since its read only,
          * depend on the caller to make the correct offset decisions.
          */
 
-        if ((type != 0 && type != AGP_PHYS_MEMORY) ||
-                (mem->type != 0 && mem->type != AGP_PHYS_MEMORY))
-                return -EINVAL;
+        if (type != mem->type)
+                goto out_err;
+
+        mask_type = agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type);
 
-        if (!mem->is_flushed) {
+        if (mask_type != 0 && mask_type != AGP_PHYS_MEMORY &&
+            mask_type != INTEL_AGP_CACHED_MEMORY)
+                goto out_err;
+
+        if (!mem->is_flushed)
                 global_cache_flush();
-                mem->is_flushed = TRUE;
-        }
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 writel(agp_bridge->driver->mask_memory(agp_bridge,
-                        mem->memory[i], mem->type), intel_i830_private.gtt+j);
+                        mem->memory[i], mask_type), intel_i830_private.gtt+j);
         }
-        readl(intel_i830_private.gtt+j-1);
 
+        readl(intel_i830_private.gtt+j-1);
         agp_bridge->driver->tlb_flush(mem);
-        return 0;
+
+ out:
+        ret = 0;
+ out_err:
+        mem->is_flushed = 1;
+        return ret;
 }
 
 static int intel_i915_remove_entries(struct agp_memory *mem,off_t pg_start,
@@ -803,7 +846,7 @@ static int intel_i915_remove_entries(struct agp_memory *mem,off_t pg_start,
  */
 static int intel_i9xx_fetch_size(void)
 {
-        int num_sizes = sizeof(intel_i830_sizes) / sizeof(*intel_i830_sizes);
+        int num_sizes = ARRAY_SIZE(intel_i830_sizes);
         int aper_size; /* size in megabytes */
         int i;
 
@@ -1384,6 +1427,7 @@ static struct agp_bridge_driver intel_generic_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_810_driver = {
@@ -1408,6 +1452,7 @@ static struct agp_bridge_driver intel_810_driver = {
         .free_by_type           = intel_i810_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_815_driver = {
@@ -1431,6 +1476,7 @@ static struct agp_bridge_driver intel_815_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_830_driver = {
@@ -1455,6 +1501,7 @@ static struct agp_bridge_driver intel_830_driver = {
         .free_by_type           = intel_i810_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = intel_i830_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_820_driver = {
@@ -1478,6 +1525,7 @@ static struct agp_bridge_driver intel_820_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_830mp_driver = {
@@ -1501,6 +1549,7 @@ static struct agp_bridge_driver intel_830mp_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_840_driver = {
@@ -1524,6 +1573,7 @@ static struct agp_bridge_driver intel_840_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_845_driver = {
@@ -1547,6 +1597,7 @@ static struct agp_bridge_driver intel_845_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_850_driver = {
@@ -1570,6 +1621,7 @@ static struct agp_bridge_driver intel_850_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_860_driver = {
@@ -1593,6 +1645,7 @@ static struct agp_bridge_driver intel_860_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_915_driver = {
@@ -1617,6 +1670,7 @@ static struct agp_bridge_driver intel_915_driver = {
         .free_by_type           = intel_i810_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = intel_i830_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_i965_driver = {
@@ -1641,6 +1695,7 @@ static struct agp_bridge_driver intel_i965_driver = {
        .free_by_type           = intel_i810_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
        .agp_destroy_page       = agp_generic_destroy_page,
+       .agp_type_to_mask_type  = intel_i830_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_7505_driver = {
@@ -1664,6 +1719,7 @@ static struct agp_bridge_driver intel_7505_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static int find_i810(u16 device)
diff --git a/drivers/char/agp/nvidia-agp.c b/drivers/char/agp/nvidia-agp.c
index df7f37b2739a..2563286b2fcf 100644
--- a/drivers/char/agp/nvidia-agp.c
+++ b/drivers/char/agp/nvidia-agp.c
@@ -310,6 +310,7 @@ static struct agp_bridge_driver nvidia_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static int __devinit agp_nvidia_probe(struct pci_dev *pdev,
diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
index 17c50b0f83f0..b7b4590673ae 100644
--- a/drivers/char/agp/parisc-agp.c
+++ b/drivers/char/agp/parisc-agp.c
@@ -228,6 +228,7 @@ struct agp_bridge_driver parisc_agp_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
         .cant_use_aperture      = 1,
 };
 
diff --git a/drivers/char/agp/sgi-agp.c b/drivers/char/agp/sgi-agp.c
index 902648db7efa..92d1dc45b9be 100644
--- a/drivers/char/agp/sgi-agp.c
+++ b/drivers/char/agp/sgi-agp.c
@@ -265,6 +265,7 @@ struct agp_bridge_driver sgi_tioca_driver = {
         .free_by_type = agp_generic_free_by_type,
         .agp_alloc_page = sgi_tioca_alloc_page,
         .agp_destroy_page = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
         .cant_use_aperture = 1,
         .needs_scratch_page = 0,
         .num_aperture_sizes = 1,
diff --git a/drivers/char/agp/sis-agp.c b/drivers/char/agp/sis-agp.c
index a00fd48a6f05..60342b708152 100644
--- a/drivers/char/agp/sis-agp.c
+++ b/drivers/char/agp/sis-agp.c
@@ -140,6 +140,7 @@ static struct agp_bridge_driver sis_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_device_ids sis_agp_device_ids[] __devinitdata =
diff --git a/drivers/char/agp/sworks-agp.c b/drivers/char/agp/sworks-agp.c
index 4f2d7d99902f..9f5ae7714f85 100644
--- a/drivers/char/agp/sworks-agp.c
+++ b/drivers/char/agp/sworks-agp.c
@@ -444,6 +444,7 @@ static struct agp_bridge_driver sworks_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static int __devinit agp_serverworks_probe(struct pci_dev *pdev,
diff --git a/drivers/char/agp/uninorth-agp.c b/drivers/char/agp/uninorth-agp.c
index dffc19382f7e..6c45702e542c 100644
--- a/drivers/char/agp/uninorth-agp.c
+++ b/drivers/char/agp/uninorth-agp.c
@@ -510,6 +510,7 @@ struct agp_bridge_driver uninorth_agp_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
         .cant_use_aperture      = 1,
 };
 
@@ -534,6 +535,7 @@ struct agp_bridge_driver u3_agp_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
         .cant_use_aperture      = 1,
         .needs_scratch_page     = 1,
 };
diff --git a/drivers/char/agp/via-agp.c b/drivers/char/agp/via-agp.c
index 2ded7a280d7f..2e7c04370cd9 100644
--- a/drivers/char/agp/via-agp.c
+++ b/drivers/char/agp/via-agp.c
@@ -191,6 +191,7 @@ static struct agp_bridge_driver via_agp3_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver via_driver = {
@@ -214,6 +215,7 @@ static struct agp_bridge_driver via_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_device_ids via_agp_device_ids[] __devinitdata =
diff --git a/drivers/char/hangcheck-timer.c b/drivers/char/hangcheck-timer.c
index 1aa93a752a9c..ae76a9ffe89f 100644
--- a/drivers/char/hangcheck-timer.c
+++ b/drivers/char/hangcheck-timer.c
@@ -117,7 +117,7 @@ __setup("hcheck_reboot", hangcheck_parse_reboot);
 __setup("hcheck_dump_tasks", hangcheck_parse_dump_tasks);
 #endif /* not MODULE */
 
-#if defined(CONFIG_X86_64) || defined(CONFIG_S390)
+#if defined(CONFIG_S390)
 # define HAVE_MONOTONIC
 # define TIMER_FREQ 1000000000ULL
 #elif defined(CONFIG_IA64)
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index be73c80d699d..1d8c4ae61551 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -36,6 +36,7 @@
 #include <linux/workqueue.h>
 #include <linux/kexec.h>
 #include <linux/irq.h>
+#include <linux/hrtimer.h>
 
 #include <asm/ptrace.h>
 #include <asm/irq_regs.h>
@@ -158,6 +159,17 @@ static struct sysrq_key_op sysrq_sync_op = {
         .enable_mask    = SYSRQ_ENABLE_SYNC,
 };
 
+static void sysrq_handle_show_timers(int key, struct tty_struct *tty)
+{
+        sysrq_timer_list_show();
+}
+
+static struct sysrq_key_op sysrq_show_timers_op = {
+        .handler        = sysrq_handle_show_timers,
+        .help_msg       = "show-all-timers(Q)",
+        .action_msg     = "Show Pending Timers",
+};
+
 static void sysrq_handle_mountro(int key, struct tty_struct *tty)
 {
         emergency_remount();
@@ -335,7 +347,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         /* o: This will often be registered as 'Off' at init time */
         NULL,                           /* o */
         &sysrq_showregs_op,             /* p */
-        NULL,                           /* q */
+        &sysrq_show_timers_op,          /* q */
         &sysrq_unraw_op,                /* r */
         &sysrq_sync_op,                 /* s */
         &sysrq_showstate_op,            /* t */
diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c
index b6bcdbbf57b3..ccaa6a39cb4b 100644
--- a/drivers/clocksource/acpi_pm.c
+++ b/drivers/clocksource/acpi_pm.c
@@ -16,15 +16,13 @@
  * This file is licensed under the GPL v2.
  */
 
+#include <linux/acpi_pmtmr.h>
 #include <linux/clocksource.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <asm/io.h>
 
-/* Number of PMTMR ticks expected during calibration run */
-#define PMTMR_TICKS_PER_SEC 3579545
-
 /*
  * The I/O port the PMTMR resides at.
  * The location is detected during setup_arch(),
@@ -32,15 +30,13 @@
  */
 u32 pmtmr_ioport __read_mostly;
 
-#define ACPI_PM_MASK CLOCKSOURCE_MASK(24) /* limit it to 24 bits */
-
 static inline u32 read_pmtmr(void)
 {
         /* mask the output to 24 bits */
         return inl(pmtmr_ioport) & ACPI_PM_MASK;
 }
 
-static cycle_t acpi_pm_read_verified(void)
+u32 acpi_pm_read_verified(void)
 {
         u32 v1 = 0, v2 = 0, v3 = 0;
 
@@ -57,7 +53,12 @@ static cycle_t acpi_pm_read_verified(void)
         } while (unlikely((v1 > v2 && v1 < v3) || (v2 > v3 && v2 < v1)
                           || (v3 > v1 && v3 < v2)));
 
-        return (cycle_t)v2;
+        return v2;
+}
+
+static cycle_t acpi_pm_read_slow(void)
+{
+        return (cycle_t)acpi_pm_read_verified();
 }
 
 static cycle_t acpi_pm_read(void)
@@ -72,7 +73,8 @@ static struct clocksource clocksource_acpi_pm = {
         .mask           = (cycle_t)ACPI_PM_MASK,
         .mult           = 0, /*to be caluclated*/
         .shift          = 22,
-        .is_continuous  = 1,
+        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
+
 };
 
 
@@ -87,7 +89,7 @@ __setup("acpi_pm_good", acpi_pm_good_setup);
 
 static inline void acpi_pm_need_workaround(void)
 {
-        clocksource_acpi_pm.read = acpi_pm_read_verified;
+        clocksource_acpi_pm.read = acpi_pm_read_slow;
         clocksource_acpi_pm.rating = 110;
 }
 
diff --git a/drivers/clocksource/cyclone.c b/drivers/clocksource/cyclone.c
index bf4d3d50d1c4..4f3925ceb360 100644
--- a/drivers/clocksource/cyclone.c
+++ b/drivers/clocksource/cyclone.c
@@ -31,7 +31,7 @@ static struct clocksource clocksource_cyclone = {
         .mask           = CYCLONE_TIMER_MASK,
         .mult           = 10,
         .shift          = 0,
-        .is_continuous  = 1,
+        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 
 static int __init init_cyclone_clocksource(void)
diff --git a/drivers/clocksource/scx200_hrt.c b/drivers/clocksource/scx200_hrt.c
index 22915cc46ba7..b92da677aa5d 100644
--- a/drivers/clocksource/scx200_hrt.c
+++ b/drivers/clocksource/scx200_hrt.c
@@ -57,7 +57,7 @@ static struct clocksource cs_hrt = {
         .rating         = 250,
         .read           = read_hrt,
         .mask           = CLOCKSOURCE_MASK(32),
-        .is_continuous  = 1,
+        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
         /* mult, shift are set based on mhz27 flag */
 };
 
diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig
index 491779af8d55..d155e81b5c97 100644
--- a/drivers/cpufreq/Kconfig
+++ b/drivers/cpufreq/Kconfig
@@ -16,7 +16,7 @@ config CPU_FREQ
 if CPU_FREQ
 
 config CPU_FREQ_TABLE
-       def_tristate m
+       tristate
 
 config CPU_FREQ_DEBUG
         bool "Enable CPUfreq debugging"
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index a45cc89e387a..f52facc570f5 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -41,8 +41,67 @@ static struct cpufreq_driver *cpufreq_driver;
 static struct cpufreq_policy *cpufreq_cpu_data[NR_CPUS];
 static DEFINE_SPINLOCK(cpufreq_driver_lock);
 
+/*
+ * cpu_policy_rwsem is a per CPU reader-writer semaphore designed to cure
+ * all cpufreq/hotplug/workqueue/etc related lock issues.
+ *
+ * The rules for this semaphore:
+ * - Any routine that wants to read from the policy structure will
+ *   do a down_read on this semaphore.
+ * - Any routine that will write to the policy structure and/or may take away
+ *   the policy altogether (eg. CPU hotplug), will hold this lock in write
+ *   mode before doing so.
+ *
+ * Additional rules:
+ * - All holders of the lock should check to make sure that the CPU they
+ *   are concerned with are online after they get the lock.
+ * - Governor routines that can be called in cpufreq hotplug path should not
+ *   take this sem as top level hotplug notifier handler takes this.
+ */
+static DEFINE_PER_CPU(int, policy_cpu);
+static DEFINE_PER_CPU(struct rw_semaphore, cpu_policy_rwsem);
+
+#define lock_policy_rwsem(mode, cpu)                                    \
+int lock_policy_rwsem_##mode                                            \
+(int cpu)                                                               \
+{                                                                       \
+        int policy_cpu = per_cpu(policy_cpu, cpu);                      \
+        BUG_ON(policy_cpu == -1);                                       \
+        down_##mode(&per_cpu(cpu_policy_rwsem, policy_cpu));            \
+        if (unlikely(!cpu_online(cpu))) {                               \
+                up_##mode(&per_cpu(cpu_policy_rwsem, policy_cpu));      \
+                return -1;                                              \
+        }                                                               \
+                                                                        \
+        return 0;                                                       \
+}
+
+lock_policy_rwsem(read, cpu);
+EXPORT_SYMBOL_GPL(lock_policy_rwsem_read);
+
+lock_policy_rwsem(write, cpu);
+EXPORT_SYMBOL_GPL(lock_policy_rwsem_write);
+
+void unlock_policy_rwsem_read(int cpu)
+{
+        int policy_cpu = per_cpu(policy_cpu, cpu);
+        BUG_ON(policy_cpu == -1);
+        up_read(&per_cpu(cpu_policy_rwsem, policy_cpu));
+}
+EXPORT_SYMBOL_GPL(unlock_policy_rwsem_read);
+
+void unlock_policy_rwsem_write(int cpu)
+{
+        int policy_cpu = per_cpu(policy_cpu, cpu);
+        BUG_ON(policy_cpu == -1);
+        up_write(&per_cpu(cpu_policy_rwsem, policy_cpu));
+}
+EXPORT_SYMBOL_GPL(unlock_policy_rwsem_write);
+
+
 /* internal prototypes */
 static int __cpufreq_governor(struct cpufreq_policy *policy, unsigned int event);
+static unsigned int __cpufreq_get(unsigned int cpu);
 static void handle_update(struct work_struct *work);
 
 /**
@@ -415,12 +474,8 @@ static ssize_t store_##file_name					\
         if (ret != 1)                                                   \
                 return -EINVAL;                                         \
                                                                         \
-        lock_cpu_hotplug();                                             \
-        mutex_lock(&policy->lock);                                      \
         ret = __cpufreq_set_policy(policy, &new_policy);                \
         policy->user_policy.object = policy->object;                    \
-        mutex_unlock(&policy->lock);                                    \
-        unlock_cpu_hotplug();                                           \
                                                                         \
         return ret ? ret : count;                                       \
 }
@@ -434,7 +489,7 @@ store_one(scaling_max_freq,max);
 static ssize_t show_cpuinfo_cur_freq (struct cpufreq_policy * policy,
                                                         char *buf)
 {
-        unsigned int cur_freq = cpufreq_get(policy->cpu);
+        unsigned int cur_freq = __cpufreq_get(policy->cpu);
         if (!cur_freq)
                 return sprintf(buf, "<unknown>");
         return sprintf(buf, "%u\n", cur_freq);
@@ -479,18 +534,12 @@ static ssize_t store_scaling_governor (struct cpufreq_policy * policy,
                                                 &new_policy.governor))
                 return -EINVAL;
 
-        lock_cpu_hotplug();
-
         /* Do not use cpufreq_set_policy here or the user_policy.max
            will be wrongly overridden */
-        mutex_lock(&policy->lock);
         ret = __cpufreq_set_policy(policy, &new_policy);
 
         policy->user_policy.policy = policy->policy;
         policy->user_policy.governor = policy->governor;
-        mutex_unlock(&policy->lock);
-
-        unlock_cpu_hotplug();
 
         if (ret)
                 return ret;
@@ -595,11 +644,17 @@ static ssize_t show(struct kobject * kobj, struct attribute * attr ,char * buf)
         policy = cpufreq_cpu_get(policy->cpu);
         if (!policy)
                 return -EINVAL;
+
+        if (lock_policy_rwsem_read(policy->cpu) < 0)
+                return -EINVAL;
+
         if (fattr->show)
                 ret = fattr->show(policy, buf);
         else
                 ret = -EIO;
 
+        unlock_policy_rwsem_read(policy->cpu);
+
         cpufreq_cpu_put(policy);
         return ret;
 }
@@ -613,11 +668,17 @@ static ssize_t store(struct kobject * kobj, struct attribute * attr,
         policy = cpufreq_cpu_get(policy->cpu);
         if (!policy)
                 return -EINVAL;
+
+        if (lock_policy_rwsem_write(policy->cpu) < 0)
+                return -EINVAL;
+
         if (fattr->store)
                 ret = fattr->store(policy, buf, count);
         else
                 ret = -EIO;
 
+        unlock_policy_rwsem_write(policy->cpu);
+
         cpufreq_cpu_put(policy);
         return ret;
 }
@@ -691,8 +752,10 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
         policy->cpu = cpu;
         policy->cpus = cpumask_of_cpu(cpu);
 
-        mutex_init(&policy->lock);
-        mutex_lock(&policy->lock);
+        /* Initially set CPU itself as the policy_cpu */
+        per_cpu(policy_cpu, cpu) = cpu;
+        lock_policy_rwsem_write(cpu);
+
         init_completion(&policy->kobj_unregister);
         INIT_WORK(&policy->update, handle_update);
 
@@ -702,7 +765,7 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
         ret = cpufreq_driver->init(policy);
         if (ret) {
                 dprintk("initialization failed\n");
-                mutex_unlock(&policy->lock);
+                unlock_policy_rwsem_write(cpu);
                 goto err_out;
         }
 
@@ -716,6 +779,14 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
                  */
                 managed_policy = cpufreq_cpu_get(j);
                 if (unlikely(managed_policy)) {
+
+                        /* Set proper policy_cpu */
+                        unlock_policy_rwsem_write(cpu);
+                        per_cpu(policy_cpu, cpu) = managed_policy->cpu;
+
+                        if (lock_policy_rwsem_write(cpu) < 0)
+                                goto err_out_driver_exit;
+
                         spin_lock_irqsave(&cpufreq_driver_lock, flags);
                         managed_policy->cpus = policy->cpus;
                         cpufreq_cpu_data[cpu] = managed_policy;
@@ -726,13 +797,13 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
                                                 &managed_policy->kobj,
                                                 "cpufreq");
                         if (ret) {
-                                mutex_unlock(&policy->lock);
+                                unlock_policy_rwsem_write(cpu);
                                 goto err_out_driver_exit;
                         }
 
                         cpufreq_debug_enable_ratelimit();
-                        mutex_unlock(&policy->lock);
                         ret = 0;
+                        unlock_policy_rwsem_write(cpu);
                         goto err_out_driver_exit; /* call driver->exit() */
                 }
         }
@@ -746,7 +817,7 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
 
         ret = kobject_register(&policy->kobj);
         if (ret) {
-                mutex_unlock(&policy->lock);
+                unlock_policy_rwsem_write(cpu);
                 goto err_out_driver_exit;
         }
         /* set up files for this cpu device */
@@ -761,8 +832,10 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
                 sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr);
 
         spin_lock_irqsave(&cpufreq_driver_lock, flags);
-        for_each_cpu_mask(j, policy->cpus)
+        for_each_cpu_mask(j, policy->cpus) {
                 cpufreq_cpu_data[j] = policy;
+                per_cpu(policy_cpu, j) = policy->cpu;
+        }
         spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
 
         /* symlink affected CPUs */
@@ -778,14 +851,14 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
                 ret = sysfs_create_link(&cpu_sys_dev->kobj, &policy->kobj,
                                         "cpufreq");
                 if (ret) {
-                        mutex_unlock(&policy->lock);
+                        unlock_policy_rwsem_write(cpu);
                         goto err_out_unregister;
                 }
         }
 
         policy->governor = NULL; /* to assure that the starting sequence is
                                   * run in cpufreq_set_policy */
-        mutex_unlock(&policy->lock);
+        unlock_policy_rwsem_write(cpu);
 
         /* set default policy */
         ret = cpufreq_set_policy(&new_policy);
@@ -826,11 +899,13 @@ module_out:
 
 
 /**
- * cpufreq_remove_dev - remove a CPU device
+ * __cpufreq_remove_dev - remove a CPU device
  *
  * Removes the cpufreq interface for a CPU device.
+ * Caller should already have policy_rwsem in write mode for this CPU.
+ * This routine frees the rwsem before returning.
  */
-static int cpufreq_remove_dev (struct sys_device * sys_dev)
+static int __cpufreq_remove_dev (struct sys_device * sys_dev)
 {
         unsigned int cpu = sys_dev->id;
         unsigned long flags;
@@ -849,6 +924,7 @@ static int cpufreq_remove_dev (struct sys_device * sys_dev)
         if (!data) {
                 spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
                 cpufreq_debug_enable_ratelimit();
+                unlock_policy_rwsem_write(cpu);
                 return -EINVAL;
         }
         cpufreq_cpu_data[cpu] = NULL;
@@ -865,6 +941,7 @@ static int cpufreq_remove_dev (struct sys_device * sys_dev)
                 sysfs_remove_link(&sys_dev->kobj, "cpufreq");
                 cpufreq_cpu_put(data);
                 cpufreq_debug_enable_ratelimit();
+                unlock_policy_rwsem_write(cpu);
                 return 0;
         }
 #endif
@@ -873,6 +950,7 @@ static int cpufreq_remove_dev (struct sys_device * sys_dev)
         if (!kobject_get(&data->kobj)) {
                 spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
                 cpufreq_debug_enable_ratelimit();
+                unlock_policy_rwsem_write(cpu);
                 return -EFAULT;
         }
 
@@ -906,10 +984,10 @@ static int cpufreq_remove_dev (struct sys_device * sys_dev)
         spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
 #endif
 
-        mutex_lock(&data->lock);
         if (cpufreq_driver->target)
                 __cpufreq_governor(data, CPUFREQ_GOV_STOP);
-        mutex_unlock(&data->lock);
+
+        unlock_policy_rwsem_write(cpu);
 
         kobject_unregister(&data->kobj);
 
@@ -933,6 +1011,18 @@ static int cpufreq_remove_dev (struct sys_device * sys_dev)
 }
 
 
+static int cpufreq_remove_dev (struct sys_device * sys_dev)
+{
+        unsigned int cpu = sys_dev->id;
+        int retval;
+        if (unlikely(lock_policy_rwsem_write(cpu)))
+                BUG();
+
+        retval = __cpufreq_remove_dev(sys_dev);
+        return retval;
+}
+
+
 static void handle_update(struct work_struct *work)
 {
         struct cpufreq_policy *policy =
@@ -980,9 +1070,12 @@ unsigned int cpufreq_quick_get(unsigned int cpu)
         unsigned int ret_freq = 0;
 
         if (policy) {
-                mutex_lock(&policy->lock);
+                if (unlikely(lock_policy_rwsem_read(cpu)))
+                        return ret_freq;
+
                 ret_freq = policy->cur;
-                mutex_unlock(&policy->lock);
+
+                unlock_policy_rwsem_read(cpu);
                 cpufreq_cpu_put(policy);
         }
 
@@ -991,24 +1084,13 @@ unsigned int cpufreq_quick_get(unsigned int cpu)
 EXPORT_SYMBOL(cpufreq_quick_get);
 
 
-/**
- * cpufreq_get - get the current CPU frequency (in kHz)
- * @cpu: CPU number
- *
- * Get the CPU current (static) CPU frequency
- */
-unsigned int cpufreq_get(unsigned int cpu)
+static unsigned int __cpufreq_get(unsigned int cpu)
 {
-        struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
+        struct cpufreq_policy *policy = cpufreq_cpu_data[cpu];
         unsigned int ret_freq = 0;
 
-        if (!policy)
-                return 0;
-
         if (!cpufreq_driver->get)
-                goto out;
-
-        mutex_lock(&policy->lock);
+                return (ret_freq);
 
         ret_freq = cpufreq_driver->get(cpu);
 
@@ -1022,11 +1104,33 @@ unsigned int cpufreq_get(unsigned int cpu)
                 }
         }
 
-        mutex_unlock(&policy->lock);
+        return (ret_freq);
+}
 
-out:
-        cpufreq_cpu_put(policy);
+/**
+ * cpufreq_get - get the current CPU frequency (in kHz)
+ * @cpu: CPU number
+ *
+ * Get the CPU current (static) CPU frequency
+ */
+unsigned int cpufreq_get(unsigned int cpu)
+{
+        unsigned int ret_freq = 0;
+        struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
+
+        if (!policy)
+                goto out;
+
+        if (unlikely(lock_policy_rwsem_read(cpu)))
+                goto out_policy;
+
+        ret_freq = __cpufreq_get(cpu);
 
+        unlock_policy_rwsem_read(cpu);
+
+out_policy:
+        cpufreq_cpu_put(policy);
+out:
         return (ret_freq);
 }
 EXPORT_SYMBOL(cpufreq_get);
@@ -1278,7 +1382,6 @@ EXPORT_SYMBOL(cpufreq_unregister_notifier);
  *********************************************************************/
 
 
-/* Must be called with lock_cpu_hotplug held */
 int __cpufreq_driver_target(struct cpufreq_policy *policy,
                             unsigned int target_freq,
                             unsigned int relation)
@@ -1304,20 +1407,19 @@ int cpufreq_driver_target(struct cpufreq_policy *policy,
         if (!policy)
                 return -EINVAL;
 
-        lock_cpu_hotplug();
-        mutex_lock(&policy->lock);
+        if (unlikely(lock_policy_rwsem_write(policy->cpu)))
+                return -EINVAL;
 
         ret = __cpufreq_driver_target(policy, target_freq, relation);
 
-        mutex_unlock(&policy->lock);
-        unlock_cpu_hotplug();
+        unlock_policy_rwsem_write(policy->cpu);
 
         cpufreq_cpu_put(policy);
         return ret;
 }
 EXPORT_SYMBOL_GPL(cpufreq_driver_target);
 
-int cpufreq_driver_getavg(struct cpufreq_policy *policy)
+int __cpufreq_driver_getavg(struct cpufreq_policy *policy)
 {
         int ret = 0;
 
@@ -1325,20 +1427,15 @@ int cpufreq_driver_getavg(struct cpufreq_policy *policy)
         if (!policy)
                 return -EINVAL;
 
-        mutex_lock(&policy->lock);
-
         if (cpu_online(policy->cpu) && cpufreq_driver->getavg)
                 ret = cpufreq_driver->getavg(policy->cpu);
 
-        mutex_unlock(&policy->lock);
-
         cpufreq_cpu_put(policy);
         return ret;
 }
-EXPORT_SYMBOL_GPL(cpufreq_driver_getavg);
+EXPORT_SYMBOL_GPL(__cpufreq_driver_getavg);
 
 /*
- * Locking: Must be called with the lock_cpu_hotplug() lock held
  * when "event" is CPUFREQ_GOV_LIMITS
  */
 
@@ -1420,9 +1517,7 @@ int cpufreq_get_policy(struct cpufreq_policy *policy, unsigned int cpu)
         if (!cpu_policy)
                 return -EINVAL;
 
-        mutex_lock(&cpu_policy->lock);
         memcpy(policy, cpu_policy, sizeof(struct cpufreq_policy));
-        mutex_unlock(&cpu_policy->lock);
 
         cpufreq_cpu_put(cpu_policy);
         return 0;
@@ -1433,7 +1528,6 @@ EXPORT_SYMBOL(cpufreq_get_policy);
 /*
  * data   : current policy.
  * policy : policy to be set.
- * Locking: Must be called with the lock_cpu_hotplug() lock held
  */
 static int __cpufreq_set_policy(struct cpufreq_policy *data,
                                 struct cpufreq_policy *policy)
@@ -1539,10 +1633,9 @@ int cpufreq_set_policy(struct cpufreq_policy *policy)
         if (!data)
                 return -EINVAL;
 
-        lock_cpu_hotplug();
+        if (unlikely(lock_policy_rwsem_write(policy->cpu)))
+                return -EINVAL;
 
-        /* lock this CPU */
-        mutex_lock(&data->lock);
 
         ret = __cpufreq_set_policy(data, policy);
         data->user_policy.min = data->min;
@@ -1550,9 +1643,8 @@ int cpufreq_set_policy(struct cpufreq_policy *policy)
         data->user_policy.policy = data->policy;
         data->user_policy.governor = data->governor;
 
-        mutex_unlock(&data->lock);
+        unlock_policy_rwsem_write(policy->cpu);
 
-        unlock_cpu_hotplug();
         cpufreq_cpu_put(data);
 
         return ret;
@@ -1576,8 +1668,8 @@ int cpufreq_update_policy(unsigned int cpu)
         if (!data)
                 return -ENODEV;
 
-        lock_cpu_hotplug();
-        mutex_lock(&data->lock);
+        if (unlikely(lock_policy_rwsem_write(cpu)))
+                return -EINVAL;
 
         dprintk("updating policy for CPU %u\n", cpu);
         memcpy(&policy, data, sizeof(struct cpufreq_policy));
@@ -1602,8 +1694,8 @@ int cpufreq_update_policy(unsigned int cpu)
 
         ret = __cpufreq_set_policy(data, &policy);
 
-        mutex_unlock(&data->lock);
-        unlock_cpu_hotplug();
+        unlock_policy_rwsem_write(cpu);
+
         cpufreq_cpu_put(data);
         return ret;
 }
@@ -1613,31 +1705,28 @@ static int cpufreq_cpu_callback(struct notifier_block *nfb,
                                         unsigned long action, void *hcpu)
 {
         unsigned int cpu = (unsigned long)hcpu;
-        struct cpufreq_policy *policy;
         struct sys_device *sys_dev;
+        struct cpufreq_policy *policy;
 
         sys_dev = get_cpu_sysdev(cpu);
-
         if (sys_dev) {
                 switch (action) {
                 case CPU_ONLINE:
                         cpufreq_add_dev(sys_dev);
                         break;
                 case CPU_DOWN_PREPARE:
-                        /*
-                         * We attempt to put this cpu in lowest frequency
-                         * possible before going down. This will permit
-                         * hardware-managed P-State to switch other related
-                         * threads to min or higher speeds if possible.
-                         */
+                        if (unlikely(lock_policy_rwsem_write(cpu)))
+                                BUG();
+
                         policy = cpufreq_cpu_data[cpu];
                         if (policy) {
-                                cpufreq_driver_target(policy, policy->min,
+                                __cpufreq_driver_target(policy, policy->min,
                                                 CPUFREQ_RELATION_H);
                         }
+                        __cpufreq_remove_dev(sys_dev);
                         break;
-                case CPU_DEAD:
-                        cpufreq_remove_dev(sys_dev);
+                case CPU_DOWN_FAILED:
+                        cpufreq_add_dev(sys_dev);
                         break;
                 }
         }
@@ -1751,3 +1840,16 @@ int cpufreq_unregister_driver(struct cpufreq_driver *driver)
         return 0;
 }
 EXPORT_SYMBOL_GPL(cpufreq_unregister_driver);
+
+static int __init cpufreq_core_init(void)
+{
+        int cpu;
+
+        for_each_possible_cpu(cpu) {
+                per_cpu(policy_cpu, cpu) = -1;
+                init_rwsem(&per_cpu(cpu_policy_rwsem, cpu));
+        }
+        return 0;
+}
+
+core_initcall(cpufreq_core_init);
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 05d6c22ba07c..26f440ccc3fb 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -429,14 +429,12 @@ static void dbs_check_cpu(int cpu)
 static void do_dbs_timer(struct work_struct *work)
 { 
         int i;
-        lock_cpu_hotplug();
         mutex_lock(&dbs_mutex);
         for_each_online_cpu(i)
                 dbs_check_cpu(i);
         schedule_delayed_work(&dbs_work, 
                         usecs_to_jiffies(dbs_tuners_ins.sampling_rate));
         mutex_unlock(&dbs_mutex);
-        unlock_cpu_hotplug();
 } 
 
 static inline void dbs_timer_init(void)
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index f697449327c6..d60bcb9d14cc 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -52,19 +52,20 @@ static unsigned int def_sampling_rate;
 static void do_dbs_timer(struct work_struct *work);
 
 /* Sampling types */
-enum dbs_sample {DBS_NORMAL_SAMPLE, DBS_SUB_SAMPLE};
+enum {DBS_NORMAL_SAMPLE, DBS_SUB_SAMPLE};
 
 struct cpu_dbs_info_s {
         cputime64_t prev_cpu_idle;
         cputime64_t prev_cpu_wall;
         struct cpufreq_policy *cur_policy;
         struct delayed_work work;
-        enum dbs_sample sample_type;
-        unsigned int enable;
         struct cpufreq_frequency_table *freq_table;
         unsigned int freq_lo;
         unsigned int freq_lo_jiffies;
         unsigned int freq_hi_jiffies;
+        int cpu;
+        unsigned int enable:1,
+                     sample_type:1;
 };
 static DEFINE_PER_CPU(struct cpu_dbs_info_s, cpu_dbs_info);
 
@@ -402,7 +403,7 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
         if (load < (dbs_tuners_ins.up_threshold - 10)) {
                 unsigned int freq_next, freq_cur;
 
-                freq_cur = cpufreq_driver_getavg(policy);
+                freq_cur = __cpufreq_driver_getavg(policy);
                 if (!freq_cur)
                         freq_cur = policy->cur;
 
@@ -423,9 +424,11 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
 
 static void do_dbs_timer(struct work_struct *work)
 {
-        unsigned int cpu = smp_processor_id();
-        struct cpu_dbs_info_s *dbs_info = &per_cpu(cpu_dbs_info, cpu);
-        enum dbs_sample sample_type = dbs_info->sample_type;
+        struct cpu_dbs_info_s *dbs_info =
+                container_of(work, struct cpu_dbs_info_s, work.work);
+        unsigned int cpu = dbs_info->cpu;
+        int sample_type = dbs_info->sample_type;
+
         /* We want all CPUs to do sampling nearly on same jiffy */
         int delay = usecs_to_jiffies(dbs_tuners_ins.sampling_rate);
 
@@ -434,15 +437,19 @@ static void do_dbs_timer(struct work_struct *work)
 
         delay -= jiffies % delay;
 
-        if (!dbs_info->enable)
+        if (lock_policy_rwsem_write(cpu) < 0)
+                return;
+
+        if (!dbs_info->enable) {
+                unlock_policy_rwsem_write(cpu);
                 return;
+        }
+
         /* Common NORMAL_SAMPLE setup */
         dbs_info->sample_type = DBS_NORMAL_SAMPLE;
         if (!dbs_tuners_ins.powersave_bias ||
             sample_type == DBS_NORMAL_SAMPLE) {
-                lock_cpu_hotplug();
                 dbs_check_cpu(dbs_info);
-                unlock_cpu_hotplug();
                 if (dbs_info->freq_lo) {
                         /* Setup timer for SUB_SAMPLE */
                         dbs_info->sample_type = DBS_SUB_SAMPLE;
@@ -454,26 +461,27 @@ static void do_dbs_timer(struct work_struct *work)
                                         CPUFREQ_RELATION_H);
         }
         queue_delayed_work_on(cpu, kondemand_wq, &dbs_info->work, delay);
+        unlock_policy_rwsem_write(cpu);
 }
 
-static inline void dbs_timer_init(unsigned int cpu)
+static inline void dbs_timer_init(struct cpu_dbs_info_s *dbs_info)
 {
-        struct cpu_dbs_info_s *dbs_info = &per_cpu(cpu_dbs_info, cpu);
         /* We want all CPUs to do sampling nearly on same jiffy */
         int delay = usecs_to_jiffies(dbs_tuners_ins.sampling_rate);
         delay -= jiffies % delay;
 
+        dbs_info->enable = 1;
         ondemand_powersave_bias_init();
-        INIT_DELAYED_WORK_NAR(&dbs_info->work, do_dbs_timer);
         dbs_info->sample_type = DBS_NORMAL_SAMPLE;
-        queue_delayed_work_on(cpu, kondemand_wq, &dbs_info->work, delay);
+        INIT_DELAYED_WORK_NAR(&dbs_info->work, do_dbs_timer);
+        queue_delayed_work_on(dbs_info->cpu, kondemand_wq, &dbs_info->work,
+                              delay);
 }
 
 static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
 {
         dbs_info->enable = 0;
         cancel_delayed_work(&dbs_info->work);
-        flush_workqueue(kondemand_wq);
 }
 
 static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
@@ -502,21 +510,9 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
 
                 mutex_lock(&dbs_mutex);
                 dbs_enable++;
-                if (dbs_enable == 1) {
-                        kondemand_wq = create_workqueue("kondemand");
-                        if (!kondemand_wq) {
-                                printk(KERN_ERR
-                                         "Creation of kondemand failed\n");
-                                dbs_enable--;
-                                mutex_unlock(&dbs_mutex);
-                                return -ENOSPC;
-                        }
-                }
 
                 rc = sysfs_create_group(&policy->kobj, &dbs_attr_group);
                 if (rc) {
-                        if (dbs_enable == 1)
-                                destroy_workqueue(kondemand_wq);
                         dbs_enable--;
                         mutex_unlock(&dbs_mutex);
                         return rc;
@@ -530,7 +526,7 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                         j_dbs_info->prev_cpu_idle = get_cpu_idle_time(j);
                         j_dbs_info->prev_cpu_wall = get_jiffies_64();
                 }
-                this_dbs_info->enable = 1;
+                this_dbs_info->cpu = cpu;
                 /*
                  * Start the timerschedule work, when this governor
                  * is used for first time
@@ -550,7 +546,7 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
 
                         dbs_tuners_ins.sampling_rate = def_sampling_rate;
                 }
-                dbs_timer_init(policy->cpu);
+                dbs_timer_init(this_dbs_info);
 
                 mutex_unlock(&dbs_mutex);
                 break;
@@ -560,9 +556,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                 dbs_timer_exit(this_dbs_info);
                 sysfs_remove_group(&policy->kobj, &dbs_attr_group);
                 dbs_enable--;
-                if (dbs_enable == 0)
-                        destroy_workqueue(kondemand_wq);
-
                 mutex_unlock(&dbs_mutex);
 
                 break;
@@ -591,12 +584,18 @@ static struct cpufreq_governor cpufreq_gov_dbs = {
 
 static int __init cpufreq_gov_dbs_init(void)
 {
+        kondemand_wq = create_workqueue("kondemand");
+        if (!kondemand_wq) {
+                printk(KERN_ERR "Creation of kondemand failed\n");
+                return -EFAULT;
+        }
         return cpufreq_register_governor(&cpufreq_gov_dbs);
 }
 
 static void __exit cpufreq_gov_dbs_exit(void)
 {
         cpufreq_unregister_governor(&cpufreq_gov_dbs);
+        destroy_workqueue(kondemand_wq);
 }
 
 
@@ -608,3 +607,4 @@ MODULE_LICENSE("GPL");
 
 module_init(cpufreq_gov_dbs_init);
 module_exit(cpufreq_gov_dbs_exit);
+
diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
index 91ad342a6051..d1c7cac9316c 100644
--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -370,12 +370,10 @@ __exit cpufreq_stats_exit(void)
         cpufreq_unregister_notifier(&notifier_trans_block,
                         CPUFREQ_TRANSITION_NOTIFIER);
         unregister_hotcpu_notifier(&cpufreq_stat_cpu_notifier);
-        lock_cpu_hotplug();
         for_each_online_cpu(cpu) {
                 cpufreq_stat_cpu_callback(&cpufreq_stat_cpu_notifier,
                                                 CPU_DEAD, (void *)(long)cpu);
         }
-        unlock_cpu_hotplug();
 }
 
 MODULE_AUTHOR ("Zou Nan hai <nanhai.zou@intel.com>");
diff --git a/drivers/cpufreq/cpufreq_userspace.c b/drivers/cpufreq/cpufreq_userspace.c
index 2a4eb0bfaf30..860345c7799a 100644
--- a/drivers/cpufreq/cpufreq_userspace.c
+++ b/drivers/cpufreq/cpufreq_userspace.c
@@ -71,7 +71,6 @@ static int cpufreq_set(unsigned int freq, struct cpufreq_policy *policy)
 
         dprintk("cpufreq_set for cpu %u, freq %u kHz\n", policy->cpu, freq);
 
-        lock_cpu_hotplug();
         mutex_lock(&userspace_mutex);
         if (!cpu_is_managed[policy->cpu])
                 goto err;
@@ -94,7 +93,6 @@ static int cpufreq_set(unsigned int freq, struct cpufreq_policy *policy)
 
  err:
         mutex_unlock(&userspace_mutex);
-        unlock_cpu_hotplug();
         return ret;
 }
 
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index cd251efda410..0a26e0663542 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -546,7 +546,7 @@ static void ads7846_rx(void *ads)
                         ts->spi->dev.bus_id, ts->tc.ignore, Rt);
 #endif
                 hrtimer_start(&ts->timer, ktime_set(0, TS_POLL_PERIOD),
-                              HRTIMER_REL);
+                              HRTIMER_MODE_REL);
                 return;
         }
 
@@ -578,7 +578,8 @@ static void ads7846_rx(void *ads)
 #endif
         }
 
-        hrtimer_start(&ts->timer, ktime_set(0, TS_POLL_PERIOD), HRTIMER_REL);
+        hrtimer_start(&ts->timer, ktime_set(0, TS_POLL_PERIOD),
+                        HRTIMER_MODE_REL);
 }
 
 static int ads7846_debounce(void *ads, int data_idx, int *val)
@@ -667,7 +668,7 @@ static void ads7846_rx_val(void *ads)
                                 status);
 }
 
-static int ads7846_timer(struct hrtimer *handle)
+static enum hrtimer_restart ads7846_timer(struct hrtimer *handle)
 {
         struct ads7846  *ts = container_of(handle, struct ads7846, timer);
         int             status = 0;
@@ -724,7 +725,7 @@ static irqreturn_t ads7846_irq(int irq, void *handle)
                         disable_irq(ts->spi->irq);
                         ts->pending = 1;
                         hrtimer_start(&ts->timer, ktime_set(0, TS_POLL_DELAY),
-                                        HRTIMER_REL);
+                                        HRTIMER_MODE_REL);
                 }
         }
         spin_unlock_irqrestore(&ts->lock, flags);
@@ -862,7 +863,7 @@ static int __devinit ads7846_probe(struct spi_device *spi)
         ts->spi = spi;
         ts->input = input_dev;
 
-        hrtimer_init(&ts->timer, CLOCK_MONOTONIC, HRTIMER_REL);
+        hrtimer_init(&ts->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
         ts->timer.function = ads7846_timer;
 
         spin_lock_init(&ts->lock);
diff --git a/drivers/isdn/gigaset/Makefile b/drivers/isdn/gigaset/Makefile
index 835b806a9de7..077e297d8c72 100644
--- a/drivers/isdn/gigaset/Makefile
+++ b/drivers/isdn/gigaset/Makefile
@@ -5,4 +5,4 @@ ser_gigaset-y := ser-gigaset.o asyncdata.o
 
 obj-$(CONFIG_GIGASET_M105) += usb_gigaset.o gigaset.o
 obj-$(CONFIG_GIGASET_BASE) += bas_gigaset.o gigaset.o
-obj-$(CONFIG_GIGASET_M105) += ser_gigaset.o gigaset.o
+obj-$(CONFIG_GIGASET_M101) += ser_gigaset.o gigaset.o
diff --git a/drivers/video/s3c2410fb.c b/drivers/video/s3c2410fb.c
index ccef56d0c157..ed3426062a8b 100644
--- a/drivers/video/s3c2410fb.c
+++ b/drivers/video/s3c2410fb.c
@@ -791,6 +791,8 @@ static int __init s3c2410fb_probe(struct platform_device *pdev)
 
         info = fbinfo->par;
         info->fb = fbinfo;
+        info->dev = &pdev->dev;
+
         platform_set_drvdata(pdev, fbinfo);
 
         dprintk("devinit\n");