227 files changed, 9010 insertions, 2752 deletions
diff --git a/drivers/Kconfig b/drivers/Kconfig
index 48f446d3c671..283c089537bc 100644
--- a/drivers/Kconfig
+++ b/drivers/Kconfig
@@ -44,6 +44,8 @@ source "drivers/char/Kconfig"
 source "drivers/i2c/Kconfig"
+source "drivers/spi/Kconfig"
 source "drivers/w1/Kconfig"
 source "drivers/hwmon/Kconfig"
diff --git a/drivers/Makefile b/drivers/Makefile
index 7fc3f0f08b29..7c45050ecd03 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -41,6 +41,7 @@ obj-$(CONFIG_FUSION)		+= message/
 obj-$(CONFIG_IEEE1394)          += ieee1394/
 obj-y                           += cdrom/
 obj-$(CONFIG_MTD)               += mtd/
+obj-$(CONFIG_SPI)               += spi/
 obj-$(CONFIG_PCCARD)            += pcmcia/
 obj-$(CONFIG_DIO)               += dio/
 obj-$(CONFIG_SBUS)              += sbus/
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 2b905016664d..730a9ce0a14a 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -78,7 +78,13 @@ int driver_probe_device(struct device_driver * drv, struct device * dev)
        pr_debug("%s: Matched Device %s with Driver %s\n",
                 drv->bus->name, dev->bus_id, drv->name);
        dev->driver = drv;
-        if (drv->probe) {
+        if (dev->bus->probe) {
+                ret = dev->bus->probe(dev);
+                if (ret) {
+                        dev->driver = NULL;
+                        goto ProbeFailed;
+                }
+        } else if (drv->probe) {
                ret = drv->probe(dev);
                if (ret) {
                        dev->driver = NULL;
@@ -203,7 +209,9 @@ static void __device_release_driver(struct device * dev)
                sysfs_remove_link(&dev->kobj, "driver");
                klist_remove(&dev->knode_driver);
-                if (drv->remove)
+                if (dev->bus->remove)
+                        dev->bus->remove(dev);
+                else if (drv->remove)
                        drv->remove(dev);
                dev->driver = NULL;
                put_driver(drv);
diff --git a/drivers/base/driver.c b/drivers/base/driver.c
index 161f3a390d90..b400314e1c62 100644
--- a/drivers/base/driver.c
+++ b/drivers/base/driver.c
@@ -171,6 +171,11 @@ static void klist_devices_put(struct klist_node *n)
 */
 int driver_register(struct device_driver * drv)
 {
+        if ((drv->bus->probe && drv->probe) ||
+            (drv->bus->remove && drv->remove) ||
+            (drv->bus->shutdown && drv->shutdown)) {
+                printk(KERN_WARNING "Driver '%s' needs updating - please use bus_type methods\n", drv->name);
+        }
        klist_init(&drv->klist_devices, klist_devices_get, klist_devices_put);
        init_completion(&drv->unloaded);
        return bus_add_driver(drv);
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 0f81731bdfa8..461554a02517 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -327,7 +327,7 @@ EXPORT_SYMBOL_GPL(platform_device_register);
 *      @pdev:  platform device we're unregistering
 *
 *      Unregistration is done in 2 steps. Fisrt we release all resources
- *      and remove it from the sybsystem, then we drop reference count by
+ *      and remove it from the subsystem, then we drop reference count by
 *      calling platform_device_put().
 */
 void platform_device_unregister(struct platform_device * pdev)
diff --git a/drivers/base/power/shutdown.c b/drivers/base/power/shutdown.c
index f50a08be424b..c2475f3134ea 100644
--- a/drivers/base/power/shutdown.c
+++ b/drivers/base/power/shutdown.c
@@ -35,12 +35,15 @@ extern int sysdev_shutdown(void);
 */
 void device_shutdown(void)
 {
-        struct device * dev;
+        struct device * dev, *devn;
        down_write(&devices_subsys.rwsem);
-        list_for_each_entry_reverse(dev, &devices_subsys.kset.list,
+        list_for_each_entry_safe_reverse(dev, devn, &devices_subsys.kset.list,
                                kobj.entry) {
-                if (dev->driver && dev->driver->shutdown) {
+                if (dev->bus && dev->bus->shutdown) {
+                        dev_dbg(dev, "shutdown\n");
+                        dev->bus->shutdown(dev);
+                } else if (dev->driver && dev->driver->shutdown) {
                        dev_dbg(dev, "shutdown\n");
                        dev->driver->shutdown(dev);
                }
diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
index 3c679d30b698..b6e290956214 100644
--- a/drivers/block/amiflop.c
+++ b/drivers/block/amiflop.c
@@ -194,6 +194,8 @@ static DECLARE_WAIT_QUEUE_HEAD(ms_wait);
 */
 #define MAX_ERRORS 12
+#define custom amiga_custom
 /* Prevent "aliased" accesses. */
 static int fd_ref[4] = { 0,0,0,0 };
 static int fd_device[4] = { 0, 0, 0, 0 };
@@ -1439,6 +1441,7 @@ static int fd_ioctl(struct inode *inode, struct file *filp,
 {
        int drive = iminor(inode) & 3;
        static struct floppy_struct getprm;
+        void __user *argp = (void __user *)param;
        switch(cmd){
        case FDFMTBEG:
@@ -1484,9 +1487,7 @@ static int fd_ioctl(struct inode *inode, struct file *filp,
                getprm.head=unit[drive].type->heads;
                getprm.sect=unit[drive].dtype->sects * unit[drive].type->sect_mult;
                getprm.size=unit[drive].blocks;
-                if (copy_to_user((void *)param,
+                if (copy_to_user(argp, &getprm, sizeof(struct floppy_struct)))
-                                 (void *)&getprm,
-                                 sizeof(struct floppy_struct)))
                        return -EFAULT;
                break;
        case FDSETPRM:
@@ -1498,8 +1499,7 @@ static int fd_ioctl(struct inode *inode, struct file *filp,
                break;
 #ifdef RAW_IOCTL
        case IOCTL_RAW_TRACK:
-                if (copy_to_user((void *)param, raw_buf,
+                if (copy_to_user(argp, raw_buf, unit[drive].type->read_size))
-                                 unit[drive].type->read_size))
                        return -EFAULT;
                else
                        return unit[drive].type->read_size;
@@ -1654,12 +1654,6 @@ static struct block_device_operations floppy_fops = {
        .media_changed  = amiga_floppy_change,
 };
-void __init amiga_floppy_setup (char *str, int *ints)
-{
-        printk (KERN_INFO "amiflop: Setting default df0 to %x\n", ints[1]);
-        fd_def_df0 = ints[1];
-}
 static int __init fd_probe_drives(void)
 {
        int drive,drives,nomem;
@@ -1845,4 +1839,18 @@ void cleanup_module(void)
        unregister_blkdev(FLOPPY_MAJOR, "fd");
 }
 #endif
+#else
+static int __init amiga_floppy_setup (char *str)
+{
+        int n;
+        if (!MACH_IS_AMIGA)
+                return 0;
+        if (!get_option(&str, &n))
+                return 0;
+        printk (KERN_INFO "amiflop: Setting default df0 to %x\n", n);
+        fd_def_df0 = n;
+}
+__setup("floppy=", amiga_floppy_setup);
 #endif
diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c
index 3aa68a5447d6..f8ce235ccfc3 100644
--- a/drivers/block/ataflop.c
+++ b/drivers/block/ataflop.c
@@ -1361,7 +1361,7 @@ static int floppy_revalidate(struct gendisk *disk)
                   formats, for 'permanent user-defined' parameter:
                   restore default_params[] here if flagged valid! */
                if (default_params[drive].blocks == 0)
-                        UDT = 0;
+                        UDT = NULL;
                else
                        UDT = &default_params[drive];
        }
@@ -1495,6 +1495,7 @@ static int fd_ioctl(struct inode *inode, struct file *filp,
        struct floppy_struct getprm;
        int settype;
        struct floppy_struct setprm;
+        void __user *argp = (void __user *)param;
        switch (cmd) {
        case FDGETPRM:
@@ -1521,7 +1522,7 @@ static int fd_ioctl(struct inode *inode, struct file *filp,
                getprm.head = 2;
                getprm.track = dtp->blocks/dtp->spt/2;
                getprm.stretch = dtp->stretch;
-                if (copy_to_user((void *)param, &getprm, sizeof(getprm)))
+                if (copy_to_user(argp, &getprm, sizeof(getprm)))
                        return -EFAULT;
                return 0;
        }
@@ -1540,7 +1541,7 @@ static int fd_ioctl(struct inode *inode, struct file *filp,
                /* get the parameters from user space */
                if (floppy->ref != 1 && floppy->ref != -1)
                        return -EBUSY;
-                if (copy_from_user(&setprm, (void *) param, sizeof(setprm)))
+                if (copy_from_user(&setprm, argp, sizeof(setprm)))
                        return -EFAULT;
                /* 
                 * first of all: check for floppy change and revalidate, 
@@ -1647,7 +1648,7 @@ static int fd_ioctl(struct inode *inode, struct file *filp,
        case FDFMTTRK:
                if (floppy->ref != 1 && floppy->ref != -1)
                        return -EBUSY;
-                if (copy_from_user(&fmt_desc, (void *) param, sizeof(fmt_desc)))
+                if (copy_from_user(&fmt_desc, argp, sizeof(fmt_desc)))
                        return -EFAULT;
                return do_format(drive, type, &fmt_desc);
        case FDCLRPRM:
@@ -1950,14 +1951,20 @@ Enomem:
        return -ENOMEM;
 }
+#ifndef MODULE
-void __init atari_floppy_setup( char *str, int *ints )
+static int __init atari_floppy_setup(char *str)
 {
+        int ints[3 + FD_MAX_UNITS];
        int i;
+        if (!MACH_IS_ATARI)
+                return 0;
+        str = get_options(str, 3 + FD_MAX_UNITS, ints);
        
        if (ints[0] < 1) {
                printk(KERN_ERR "ataflop_setup: no arguments!\n" );
-                return;
+                return 0;
        }
        else if (ints[0] > 2+FD_MAX_UNITS) {
                printk(KERN_ERR "ataflop_setup: too many arguments\n" );
@@ -1977,9 +1984,13 @@ void __init atari_floppy_setup( char *str, int *ints )
                else
                        UserSteprate[i-3] = ints[i];
        }
+        return 1;
 }
-static void atari_floppy_exit(void)
+__setup("floppy=", atari_floppy_setup);
+#endif
+static void __exit atari_floppy_exit(void)
 {
        int i;
        blk_unregister_region(MKDEV(FLOPPY_MAJOR, 0), 256);
diff --git a/drivers/block/viodasd.c b/drivers/block/viodasd.c
index d1aaf31bd97e..f63e07bd9f9c 100644
--- a/drivers/block/viodasd.c
+++ b/drivers/block/viodasd.c
@@ -293,6 +293,7 @@ static int send_request(struct request *req)
        u16 viocmd;
        HvLpEvent_Rc hvrc;
        struct vioblocklpevent *bevent;
+        struct HvLpEvent *hev;
        struct scatterlist sg[VIOMAXBLOCKDMA];
        int sgindex;
        int statindex;
@@ -347,22 +348,19 @@ static int send_request(struct request *req)
                 * token so we can match the response up later
                 */
                memset(bevent, 0, sizeof(struct vioblocklpevent));
-                bevent->event.xFlags.xValid = 1;
+                hev = &bevent->event;
-                bevent->event.xFlags.xFunction = HvLpEvent_Function_Int;
+                hev->flags = HV_LP_EVENT_VALID | HV_LP_EVENT_DO_ACK |
-                bevent->event.xFlags.xAckInd = HvLpEvent_AckInd_DoAck;
+                        HV_LP_EVENT_INT;
-                bevent->event.xFlags.xAckType = HvLpEvent_AckType_ImmediateAck;
+                hev->xType = HvLpEvent_Type_VirtualIo;
-                bevent->event.xType = HvLpEvent_Type_VirtualIo;
+                hev->xSubtype = viocmd;
-                bevent->event.xSubtype = viocmd;
+                hev->xSourceLp = HvLpConfig_getLpIndex();
-                bevent->event.xSourceLp = HvLpConfig_getLpIndex();
+                hev->xTargetLp = viopath_hostLp;
-                bevent->event.xTargetLp = viopath_hostLp;
+                hev->xSizeMinus1 =
-                bevent->event.xSizeMinus1 =
                        offsetof(struct vioblocklpevent, u.rw_data.dma_info) +
                        (sizeof(bevent->u.rw_data.dma_info[0]) * nsg) - 1;
-                bevent->event.xSourceInstanceId =
+                hev->xSourceInstanceId = viopath_sourceinst(viopath_hostLp);
-                        viopath_sourceinst(viopath_hostLp);
+                hev->xTargetInstanceId = viopath_targetinst(viopath_hostLp);
-                bevent->event.xTargetInstanceId =
+                hev->xCorrelationToken = (u64)req;
-                        viopath_targetinst(viopath_hostLp);
-                bevent->event.xCorrelationToken = (u64)req;
                bevent->version = VIOVERSION;
                bevent->disk = DEVICE_NO(d);
                bevent->u.rw_data.offset = start;
@@ -649,10 +647,10 @@ static void handle_block_event(struct HvLpEvent *event)
                /* Notification that a partition went away! */
                return;
        /* First, we should NEVER get an int here...only acks */
-        if (event->xFlags.xFunction == HvLpEvent_Function_Int) {
+        if (hvlpevent_is_int(event)) {
                printk(VIOD_KERN_WARNING
                       "Yikes! got an int in viodasd event handler!\n");
-                if (event->xFlags.xAckInd == HvLpEvent_AckInd_DoAck) {
+                if (hvlpevent_need_ack(event)) {
                        event->xRc = HvLpEvent_Rc_InvalidSubtype;
                        HvCallEvent_ackLpEvent(event);
                }
@@ -695,7 +693,7 @@ static void handle_block_event(struct HvLpEvent *event)
        default:
                printk(VIOD_KERN_WARNING "invalid subtype!");
-                if (event->xFlags.xAckInd == HvLpEvent_AckInd_DoAck) {
+                if (hvlpevent_need_ack(event)) {
                        event->xRc = HvLpEvent_Rc_InvalidSubtype;
                        HvCallEvent_ackLpEvent(event);
                }
diff --git a/drivers/cdrom/viocd.c b/drivers/cdrom/viocd.c
index b5191780ecca..193446e6a08a 100644
--- a/drivers/cdrom/viocd.c
+++ b/drivers/cdrom/viocd.c
@@ -542,10 +542,10 @@ static void vio_handle_cd_event(struct HvLpEvent *event)
                /* Notification that a partition went away! */
                return;
        /* First, we should NEVER get an int here...only acks */
-        if (event->xFlags.xFunction == HvLpEvent_Function_Int) {
+        if (hvlpevent_is_int(event)) {
                printk(VIOCD_KERN_WARNING
                                "Yikes! got an int in viocd event handler!\n");
-                if (event->xFlags.xAckInd == HvLpEvent_AckInd_DoAck) {
+                if (hvlpevent_need_ack(event)) {
                        event->xRc = HvLpEvent_Rc_InvalidSubtype;
                        HvCallEvent_ackLpEvent(event);
                }
@@ -616,7 +616,7 @@ return_complete:
                printk(VIOCD_KERN_WARNING
                                "message with invalid subtype %0x04X!\n",
                                event->xSubtype & VIOMINOR_SUBTYPE_MASK);
-                if (event->xFlags.xAckInd == HvLpEvent_AckInd_DoAck) {
+                if (hvlpevent_need_ack(event)) {
                        event->xRc = HvLpEvent_Rc_InvalidSubtype;
                        HvCallEvent_ackLpEvent(event);
                }
diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c
index 869518e4035f..7ac365b5d9ec 100644
--- a/drivers/char/amiserial.c
+++ b/drivers/char/amiserial.c
@@ -99,6 +99,7 @@ static char *serial_version = "4.30";
 #define _INLINE_ inline
 #endif
+#define custom amiga_custom
 static char *serial_name = "Amiga-builtin serial driver";
 static struct tty_driver *serial_driver;
@@ -128,7 +129,6 @@ static struct serial_state rs_table[1];
 * memory if large numbers of serial ports are open.
 */
 static unsigned char *tmp_buf;
-static DECLARE_MUTEX(tmp_buf_sem);
 #include <asm/uaccess.h>
@@ -1088,7 +1088,7 @@ static void rs_unthrottle(struct tty_struct * tty)
 */
 static int get_serial_info(struct async_struct * info,
-                           struct serial_struct * retinfo)
+                           struct serial_struct __user * retinfo)
 {
        struct serial_struct tmp;
        struct serial_state *state = info->state;
@@ -1112,7 +1112,7 @@ static int get_serial_info(struct async_struct * info,
 }
 static int set_serial_info(struct async_struct * info,
-                           struct serial_struct * new_info)
+                           struct serial_struct __user * new_info)
 {
        struct serial_struct new_serial;
        struct serial_state old_state, *state;
@@ -1193,7 +1193,7 @@ check_and_exit:
 *          transmit holding register is empty.  This functionality
 *          allows an RS485 driver to be written in user space. 
 */
-static int get_lsr_info(struct async_struct * info, unsigned int *value)
+static int get_lsr_info(struct async_struct * info, unsigned int __user *value)
 {
        unsigned char status;
        unsigned int result;
@@ -1284,6 +1284,7 @@ static int rs_ioctl(struct tty_struct *tty, struct file * file,
        struct async_struct * info = (struct async_struct *)tty->driver_data;
        struct async_icount cprev, cnow;        /* kernel counter temps */
        struct serial_icounter_struct icount;
+        void __user *argp = (void __user *)arg;
        unsigned long flags;
        if (serial_paranoia_check(info, tty->name, "rs_ioctl"))
@@ -1298,19 +1299,17 @@ static int rs_ioctl(struct tty_struct *tty, struct file * file,
        switch (cmd) {
                case TIOCGSERIAL:
-                        return get_serial_info(info,
+                        return get_serial_info(info, argp);
-                                               (struct serial_struct *) arg);
                case TIOCSSERIAL:
-                        return set_serial_info(info,
+                        return set_serial_info(info, argp);
-                                               (struct serial_struct *) arg);
                case TIOCSERCONFIG:
                        return 0;
                case TIOCSERGETLSR: /* Get line status register */
-                        return get_lsr_info(info, (unsigned int *) arg);
+                        return get_lsr_info(info, argp);
                case TIOCSERGSTRUCT:
-                        if (copy_to_user((struct async_struct *) arg,
+                        if (copy_to_user(argp,
                                         info, sizeof(struct async_struct)))
                                return -EFAULT;
                        return 0;
@@ -1369,7 +1368,7 @@ static int rs_ioctl(struct tty_struct *tty, struct file * file,
                        icount.brk = cnow.brk;
                        icount.buf_overrun = cnow.buf_overrun;
-                        if (copy_to_user((void *)arg, &icount, sizeof(icount)))
+                        if (copy_to_user(argp, &icount, sizeof(icount)))
                                return -EFAULT;
                        return 0;
                case TIOCSERGWILD:
diff --git a/drivers/char/drm/Makefile b/drivers/char/drm/Makefile
index e41060c76226..9d180c42816c 100644
--- a/drivers/char/drm/Makefile
+++ b/drivers/char/drm/Makefile
@@ -3,7 +3,7 @@
 # Direct Rendering Infrastructure (DRI) in XFree86 4.1.0 and higher.
 drm-objs    :=  drm_auth.o drm_bufs.o drm_context.o drm_dma.o drm_drawable.o \
-                drm_drv.o drm_fops.o drm_init.o drm_ioctl.o drm_irq.o \
+                drm_drv.o drm_fops.o drm_ioctl.o drm_irq.o \
                drm_lock.o drm_memory.o drm_proc.o drm_stub.o drm_vm.o \
                drm_agpsupport.o drm_scatter.o ati_pcigart.o drm_pci.o \
                drm_sysfs.o
@@ -18,7 +18,7 @@ radeon-objs := radeon_drv.o radeon_cp.o radeon_state.o radeon_mem.o radeon_irq.o
 ffb-objs    := ffb_drv.o ffb_context.o
 sis-objs    := sis_drv.o sis_ds.o sis_mm.o
 savage-objs := savage_drv.o savage_bci.o savage_state.o
-via-objs    := via_irq.o via_drv.o via_ds.o via_map.o via_mm.o via_dma.o via_verifier.o via_video.o
+via-objs    := via_irq.o via_drv.o via_ds.o via_map.o via_mm.o via_dma.o via_verifier.o via_video.o via_dmablit.o
 ifeq ($(CONFIG_COMPAT),y)
 drm-objs    += drm_ioc32.o
diff --git a/drivers/char/drm/ati_pcigart.c b/drivers/char/drm/ati_pcigart.c
index efff0eec618c..5485382cadec 100644
--- a/drivers/char/drm/ati_pcigart.c
+++ b/drivers/char/drm/ati_pcigart.c
@@ -52,7 +52,7 @@
 # define ATI_MAX_PCIGART_PAGES          8192    /**< 32 MB aperture, 4K pages */
 # define ATI_PCIGART_PAGE_SIZE          4096    /**< PCI GART page size */
-static unsigned long drm_ati_alloc_pcigart_table(void)
+static void *drm_ati_alloc_pcigart_table(void)
 {
        unsigned long address;
        struct page *page;
@@ -72,27 +72,26 @@ static unsigned long drm_ati_alloc_pcigart_table(void)
        }
        DRM_DEBUG("%s: returning 0x%08lx\n", __FUNCTION__, address);
-        return address;
+        return (void *)address;
 }
-static void drm_ati_free_pcigart_table(unsigned long address)
+static void drm_ati_free_pcigart_table(void *address)
 {
        struct page *page;
        int i;
        DRM_DEBUG("%s\n", __FUNCTION__);
-        page = virt_to_page(address);
+        page = virt_to_page((unsigned long)address);
        for (i = 0; i < ATI_PCIGART_TABLE_PAGES; i++, page++) {
                __put_page(page);
                ClearPageReserved(page);
        }
-        free_pages(address, ATI_PCIGART_TABLE_ORDER);
+        free_pages((unsigned long)address, ATI_PCIGART_TABLE_ORDER);
 }
-int drm_ati_pcigart_cleanup(drm_device_t * dev,
+int drm_ati_pcigart_cleanup(drm_device_t *dev, drm_ati_pcigart_info *gart_info)
-                            drm_ati_pcigart_info * gart_info)
 {
        drm_sg_mem_t *entry = dev->sg;
        unsigned long pages;
@@ -136,10 +135,10 @@ int drm_ati_pcigart_cleanup(drm_device_t * dev,
 EXPORT_SYMBOL(drm_ati_pcigart_cleanup);
-int drm_ati_pcigart_init(drm_device_t * dev, drm_ati_pcigart_info * gart_info)
+int drm_ati_pcigart_init(drm_device_t *dev, drm_ati_pcigart_info *gart_info)
 {
        drm_sg_mem_t *entry = dev->sg;
-        unsigned long address = 0;
+        void *address = NULL;
        unsigned long pages;
        u32 *pci_gart, page_base, bus_address = 0;
        int i, j, ret = 0;
@@ -163,7 +162,7 @@ int drm_ati_pcigart_init(drm_device_t * dev, drm_ati_pcigart_info * gart_info)
                        goto done;
                }
-                bus_address = pci_map_single(dev->pdev, (void *)address,
+                bus_address = pci_map_single(dev->pdev, address,
                                             ATI_PCIGART_TABLE_PAGES *
                                             PAGE_SIZE, PCI_DMA_TODEVICE);
                if (bus_address == 0) {
@@ -176,7 +175,7 @@ int drm_ati_pcigart_init(drm_device_t * dev, drm_ati_pcigart_info * gart_info)
                address = gart_info->addr;
                bus_address = gart_info->bus_addr;
                DRM_DEBUG("PCI: Gart Table: VRAM %08X mapped at %08lX\n",
-                          bus_address, address);
+                          bus_address, (unsigned long)address);
        }
        pci_gart = (u32 *) address;
@@ -195,7 +194,7 @@ int drm_ati_pcigart_init(drm_device_t * dev, drm_ati_pcigart_info * gart_info)
                if (entry->busaddr[i] == 0) {
                        DRM_ERROR("unable to map PCIGART pages!\n");
                        drm_ati_pcigart_cleanup(dev, gart_info);
-                        address = 0;
+                        address = NULL;
                        bus_address = 0;
                        goto done;
                }
diff --git a/drivers/char/drm/drm.h b/drivers/char/drm/drm.h
index 64d6237fdd0b..9da0ddb892b5 100644
--- a/drivers/char/drm/drm.h
+++ b/drivers/char/drm/drm.h
@@ -90,8 +90,8 @@
 #define DRM_MAX_ORDER   22        /**< Up to 2^22 bytes = 4MB */
 #define DRM_RAM_PERCENT 10        /**< How much system ram can we lock? */
-#define _DRM_LOCK_HELD  0x80000000 /**< Hardware lock is held */
+#define _DRM_LOCK_HELD  0x80000000U /**< Hardware lock is held */
-#define _DRM_LOCK_CONT  0x40000000 /**< Hardware lock is contended */
+#define _DRM_LOCK_CONT  0x40000000U /**< Hardware lock is contended */
 #define _DRM_LOCK_IS_HELD(lock)    ((lock) & _DRM_LOCK_HELD)
 #define _DRM_LOCK_IS_CONT(lock)    ((lock) & _DRM_LOCK_CONT)
 #define _DRM_LOCKING_CONTEXT(lock) ((lock) & ~(_DRM_LOCK_HELD|_DRM_LOCK_CONT))
diff --git a/drivers/char/drm/drmP.h b/drivers/char/drm/drmP.h
index 3dc3c9d79ae4..54b561e69486 100644
--- a/drivers/char/drm/drmP.h
+++ b/drivers/char/drm/drmP.h
@@ -144,20 +144,6 @@
 /** \name Backward compatibility section */
 /*@{*/
-#ifndef MODULE_LICENSE
-#define MODULE_LICENSE(x)
-#endif
-#ifndef preempt_disable
-#define preempt_disable()
-#define preempt_enable()
-#endif
-#ifndef pte_offset_map
-#define pte_offset_map pte_offset
-#define pte_unmap(pte)
-#endif
 #define DRM_RPR_ARG(vma) vma,
 #define VM_OFFSET(vma) ((vma)->vm_pgoff << PAGE_SHIFT)
@@ -286,10 +272,13 @@ typedef int drm_ioctl_t(struct inode *inode, struct file *filp,
 typedef int drm_ioctl_compat_t(struct file *filp, unsigned int cmd,
                               unsigned long arg);
+#define DRM_AUTH        0x1
+#define DRM_MASTER      0x2
+#define DRM_ROOT_ONLY   0x4
 typedef struct drm_ioctl_desc {
        drm_ioctl_t *func;
-        int auth_needed;
+        int flags;
-        int root_only;
 } drm_ioctl_desc_t;
 typedef struct drm_devstate {
@@ -384,6 +373,7 @@ typedef struct drm_buf_entry {
 /** File private data */
 typedef struct drm_file {
        int authenticated;
+        int master;
        int minor;
        pid_t pid;
        uid_t uid;
@@ -532,8 +522,9 @@ typedef struct drm_vbl_sig {
 typedef struct ati_pcigart_info {
        int gart_table_location;
        int is_pcie;
-        unsigned long addr;
+        void *addr;
        dma_addr_t bus_addr;
+        drm_local_map_t mapping;
 } drm_ati_pcigart_info;
 /**
@@ -544,16 +535,14 @@ typedef struct ati_pcigart_info {
 struct drm_device;
 struct drm_driver {
-        int (*preinit) (struct drm_device *, unsigned long flags);
+        int (*load) (struct drm_device *, unsigned long flags);
-        void (*prerelease) (struct drm_device *, struct file * filp);
+        int (*firstopen) (struct drm_device *);
-        void (*pretakedown) (struct drm_device *);
+        int (*open) (struct drm_device *, drm_file_t *);
-        int (*postcleanup) (struct drm_device *);
+        void (*preclose) (struct drm_device *, struct file * filp);
-        int (*presetup) (struct drm_device *);
+        void (*postclose) (struct drm_device *, drm_file_t *);
-        int (*postsetup) (struct drm_device *);
+        void (*lastclose) (struct drm_device *);
+        int (*unload) (struct drm_device *);
        int (*dma_ioctl) (DRM_IOCTL_ARGS);
-        int (*open_helper) (struct drm_device *, drm_file_t *);
-        void (*free_filp_priv) (struct drm_device *, drm_file_t *);
-        void (*release) (struct drm_device *, struct file * filp);
        void (*dma_ready) (struct drm_device *);
        int (*dma_quiescent) (struct drm_device *);
        int (*context_ctor) (struct drm_device * dev, int context);
@@ -561,8 +550,9 @@ struct drm_driver {
        int (*kernel_context_switch) (struct drm_device * dev, int old,
                                      int new);
        void (*kernel_context_switch_unlock) (struct drm_device * dev,
-                                              drm_lock_t * lock);
+                                              drm_lock_t *lock);
        int (*vblank_wait) (struct drm_device * dev, unsigned int *sequence);
+        int (*dri_library_name) (struct drm_device *dev, char *buf);
        /**
         * Called by \c drm_device_is_agp.  Typically used to determine if a
@@ -579,16 +569,24 @@ struct drm_driver {
        /* these have to be filled in */
-        int (*postinit) (struct drm_device *, unsigned long flags);
+        irqreturn_t(*irq_handler) (DRM_IRQ_ARGS);
-         irqreturn_t(*irq_handler) (DRM_IRQ_ARGS);
        void (*irq_preinstall) (struct drm_device * dev);
        void (*irq_postinstall) (struct drm_device * dev);
        void (*irq_uninstall) (struct drm_device * dev);
        void (*reclaim_buffers) (struct drm_device * dev, struct file * filp);
+        void (*reclaim_buffers_locked) (struct drm_device *dev,
+                                        struct file *filp);
        unsigned long (*get_map_ofs) (drm_map_t * map);
        unsigned long (*get_reg_ofs) (struct drm_device * dev);
        void (*set_version) (struct drm_device * dev, drm_set_version_t * sv);
-        int (*version) (drm_version_t * version);
+        int major;
+        int minor;
+        int patchlevel;
+        char *name;
+        char *desc;
+        char *date;
        u32 driver_features;
        int dev_priv_size;
        drm_ioctl_desc_t *ioctls;
@@ -752,19 +750,43 @@ static inline int drm_core_has_MTRR(struct drm_device *dev)
 {
        return drm_core_check_feature(dev, DRIVER_USE_MTRR);
 }
+#define DRM_MTRR_WC             MTRR_TYPE_WRCOMB
+static inline int drm_mtrr_add(unsigned long offset, unsigned long size,
+                               unsigned int flags)
+{
+        return mtrr_add(offset, size, flags, 1);
+}
+static inline int drm_mtrr_del(int handle, unsigned long offset,
+                               unsigned long size, unsigned int flags)
+{
+        return mtrr_del(handle, offset, size);
+}
 #else
 #define drm_core_has_MTRR(dev) (0)
+#define DRM_MTRR_WC             0
+static inline int drm_mtrr_add(unsigned long offset, unsigned long size,
+                               unsigned int flags)
+{
+        return 0;
+}
+static inline int drm_mtrr_del(int handle, unsigned long offset,
+                               unsigned long size, unsigned int flags)
+{
+        return 0;
+}
 #endif
 /******************************************************************/
 /** \name Internal function definitions */
 /*@{*/
-                                /* Misc. support (drm_init.h) */
-extern int drm_flags;
-extern void drm_parse_options(char *s);
-extern int drm_cpu_valid(void);
                                /* Driver support (drm_drv.h) */
 extern int drm_init(struct drm_driver *driver);
 extern void drm_exit(struct drm_driver *driver);
@@ -772,12 +794,11 @@ extern int drm_ioctl(struct inode *inode, struct file *filp,
                     unsigned int cmd, unsigned long arg);
 extern long drm_compat_ioctl(struct file *filp,
                             unsigned int cmd, unsigned long arg);
-extern int drm_takedown(drm_device_t * dev);
+extern int drm_lastclose(drm_device_t *dev);
                                /* Device support (drm_fops.h) */
 extern int drm_open(struct inode *inode, struct file *filp);
 extern int drm_stub_open(struct inode *inode, struct file *filp);
-extern int drm_flush(struct file *filp);
 extern int drm_fasync(int fd, struct file *filp, int on);
 extern int drm_release(struct inode *inode, struct file *filp);
@@ -819,6 +840,8 @@ extern int drm_getstats(struct inode *inode, struct file *filp,
                        unsigned int cmd, unsigned long arg);
 extern int drm_setversion(struct inode *inode, struct file *filp,
                          unsigned int cmd, unsigned long arg);
+extern int drm_noop(struct inode *inode, struct file *filp,
+                    unsigned int cmd, unsigned long arg);
                                /* Context IOCTL support (drm_context.h) */
 extern int drm_resctx(struct inode *inode, struct file *filp,
@@ -857,10 +880,6 @@ extern int drm_getmagic(struct inode *inode, struct file *filp,
 extern int drm_authmagic(struct inode *inode, struct file *filp,
                         unsigned int cmd, unsigned long arg);
-                                /* Placeholder for ioctls past */
-extern int drm_noop(struct inode *inode, struct file *filp,
-                    unsigned int cmd, unsigned long arg);
                                /* Locking IOCTL support (drm_lock.h) */
 extern int drm_lock(struct inode *inode, struct file *filp,
                    unsigned int cmd, unsigned long arg);
@@ -873,6 +892,7 @@ extern int drm_lock_free(drm_device_t * dev,
                                /* Buffer management support (drm_bufs.h) */
 extern int drm_addbufs_agp(drm_device_t * dev, drm_buf_desc_t * request);
 extern int drm_addbufs_pci(drm_device_t * dev, drm_buf_desc_t * request);
+extern int drm_addbufs_fb(drm_device_t *dev, drm_buf_desc_t *request);
 extern int drm_addmap(drm_device_t * dev, unsigned int offset,
                      unsigned int size, drm_map_type_t type,
                      drm_map_flags_t flags, drm_local_map_t ** map_ptr);
@@ -908,8 +928,8 @@ extern void drm_core_reclaim_buffers(drm_device_t * dev, struct file *filp);
                                /* IRQ support (drm_irq.h) */
 extern int drm_control(struct inode *inode, struct file *filp,
                       unsigned int cmd, unsigned long arg);
-extern int drm_irq_uninstall(drm_device_t * dev);
 extern irqreturn_t drm_irq_handler(DRM_IRQ_ARGS);
+extern int drm_irq_uninstall(drm_device_t * dev);
 extern void drm_driver_irq_preinstall(drm_device_t * dev);
 extern void drm_driver_irq_postinstall(drm_device_t * dev);
 extern void drm_driver_irq_uninstall(drm_device_t * dev);
@@ -933,13 +953,17 @@ extern int drm_agp_enable_ioctl(struct inode *inode, struct file *filp,
 extern int drm_agp_info(drm_device_t * dev, drm_agp_info_t * info);
 extern int drm_agp_info_ioctl(struct inode *inode, struct file *filp,
                              unsigned int cmd, unsigned long arg);
-extern int drm_agp_alloc(struct inode *inode, struct file *filp,
+extern int drm_agp_alloc(drm_device_t *dev, drm_agp_buffer_t *request);
+extern int drm_agp_alloc_ioctl(struct inode *inode, struct file *filp,
                         unsigned int cmd, unsigned long arg);
-extern int drm_agp_free(struct inode *inode, struct file *filp,
+extern int drm_agp_free(drm_device_t *dev, drm_agp_buffer_t *request);
+extern int drm_agp_free_ioctl(struct inode *inode, struct file *filp,
                        unsigned int cmd, unsigned long arg);
-extern int drm_agp_unbind(struct inode *inode, struct file *filp,
+extern int drm_agp_unbind(drm_device_t *dev, drm_agp_binding_t *request);
+extern int drm_agp_unbind_ioctl(struct inode *inode, struct file *filp,
                          unsigned int cmd, unsigned long arg);
-extern int drm_agp_bind(struct inode *inode, struct file *filp,
+extern int drm_agp_bind(drm_device_t *dev, drm_agp_binding_t *request);
+extern int drm_agp_bind_ioctl(struct inode *inode, struct file *filp,
                        unsigned int cmd, unsigned long arg);
 extern DRM_AGP_MEM *drm_agp_allocate_memory(struct agp_bridge_data *bridge,
                                            size_t pages, u32 type);
@@ -991,10 +1015,8 @@ extern struct drm_sysfs_class *drm_sysfs_create(struct module *owner,
                                                char *name);
 extern void drm_sysfs_destroy(struct drm_sysfs_class *cs);
 extern struct class_device *drm_sysfs_device_add(struct drm_sysfs_class *cs,
-                                                 dev_t dev,
+                                                 drm_head_t *head);
-                                                 struct device *device,
+extern void drm_sysfs_device_remove(struct class_device *class_dev);
-                                                 const char *fmt, ...);
-extern void drm_sysfs_device_remove(dev_t dev);
 /* Inline replacements for DRM_IOREMAP macros */
 static __inline__ void drm_core_ioremap(struct drm_map *map,
diff --git a/drivers/char/drm/drm_agpsupport.c b/drivers/char/drm/drm_agpsupport.c
index 2b6453a9ffce..fabc930c67a2 100644
--- a/drivers/char/drm/drm_agpsupport.c
+++ b/drivers/char/drm/drm_agpsupport.c
@@ -1,5 +1,5 @@
 /**
- * \file drm_agpsupport.h
+ * \file drm_agpsupport.c
 * DRM support for AGP/GART backend
 *
 * \author Rickard E. (Rik) Faith <faith@valinux.com>
@@ -91,7 +91,7 @@ int drm_agp_info_ioctl(struct inode *inode, struct file *filp,
 /**
 * Acquire the AGP device.
 *
- * \param dev DRM device that is to acquire AGP
+ * \param dev DRM device that is to acquire AGP.
 * \return zero on success or a negative number on failure.
 *
 * Verifies the AGP device hasn't been acquired before and calls
@@ -134,7 +134,7 @@ int drm_agp_acquire_ioctl(struct inode *inode, struct file *filp,
 /**
 * Release the AGP device.
 *
- * \param dev DRM device that is to release AGP
+ * \param dev DRM device that is to release AGP.
 * \return zero on success or a negative number on failure.
 *
 * Verifies the AGP device has been acquired and calls \c agp_backend_release.
@@ -147,7 +147,6 @@ int drm_agp_release(drm_device_t * dev)
        dev->agp->acquired = 0;
        return 0;
 }
 EXPORT_SYMBOL(drm_agp_release);
 int drm_agp_release_ioctl(struct inode *inode, struct file *filp,
@@ -208,30 +207,22 @@ int drm_agp_enable_ioctl(struct inode *inode, struct file *filp,
 * Verifies the AGP device is present and has been acquired, allocates the
 * memory via alloc_agp() and creates a drm_agp_mem entry for it.
 */
-int drm_agp_alloc(struct inode *inode, struct file *filp,
+int drm_agp_alloc(drm_device_t *dev, drm_agp_buffer_t *request)
-                  unsigned int cmd, unsigned long arg)
 {
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->head->dev;
-        drm_agp_buffer_t request;
        drm_agp_mem_t *entry;
        DRM_AGP_MEM *memory;
        unsigned long pages;
        u32 type;
-        drm_agp_buffer_t __user *argp = (void __user *)arg;
        if (!dev->agp || !dev->agp->acquired)
                return -EINVAL;
-        if (copy_from_user(&request, argp, sizeof(request)))
-                return -EFAULT;
        if (!(entry = drm_alloc(sizeof(*entry), DRM_MEM_AGPLISTS)))
                return -ENOMEM;
        memset(entry, 0, sizeof(*entry));
-        pages = (request.size + PAGE_SIZE - 1) / PAGE_SIZE;
+        pages = (request->size + PAGE_SIZE - 1) / PAGE_SIZE;
-        type = (u32) request.type;
+        type = (u32) request->type;
        if (!(memory = drm_alloc_agp(dev, pages, type))) {
                drm_free(entry, sizeof(*entry), DRM_MEM_AGPLISTS);
                return -ENOMEM;
@@ -247,16 +238,39 @@ int drm_agp_alloc(struct inode *inode, struct file *filp,
                dev->agp->memory->prev = entry;
        dev->agp->memory = entry;
-        request.handle = entry->handle;
+        request->handle = entry->handle;
-        request.physical = memory->physical;
+        request->physical = memory->physical;
+        return 0;
+}
+EXPORT_SYMBOL(drm_agp_alloc);
+int drm_agp_alloc_ioctl(struct inode *inode, struct file *filp,
+                        unsigned int cmd, unsigned long arg)
+{
+        drm_file_t *priv = filp->private_data;
+        drm_device_t *dev = priv->head->dev;
+        drm_agp_buffer_t request;
+        drm_agp_buffer_t __user *argp = (void __user *)arg;
+        int err;
+        if (copy_from_user(&request, argp, sizeof(request)))
+                return -EFAULT;
+        err = drm_agp_alloc(dev, &request);
+        if (err)
+                return err;
        if (copy_to_user(argp, &request, sizeof(request))) {
+                drm_agp_mem_t *entry = dev->agp->memory;
                dev->agp->memory = entry->next;
                dev->agp->memory->prev = NULL;
-                drm_free_agp(memory, pages);
+                drm_free_agp(entry->memory, entry->pages);
                drm_free(entry, sizeof(*entry), DRM_MEM_AGPLISTS);
                return -EFAULT;
        }
        return 0;
 }
@@ -293,21 +307,14 @@ static drm_agp_mem_t *drm_agp_lookup_entry(drm_device_t * dev,
 * Verifies the AGP device is present and acquired, looks-up the AGP memory
 * entry and passes it to the unbind_agp() function.
 */
-int drm_agp_unbind(struct inode *inode, struct file *filp,
+int drm_agp_unbind(drm_device_t *dev, drm_agp_binding_t *request)
-                   unsigned int cmd, unsigned long arg)
 {
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->head->dev;
-        drm_agp_binding_t request;
        drm_agp_mem_t *entry;
        int ret;
        if (!dev->agp || !dev->agp->acquired)
                return -EINVAL;
-        if (copy_from_user
+        if (!(entry = drm_agp_lookup_entry(dev, request->handle)))
-            (&request, (drm_agp_binding_t __user *) arg, sizeof(request)))
-                return -EFAULT;
-        if (!(entry = drm_agp_lookup_entry(dev, request.handle)))
                return -EINVAL;
        if (!entry->bound)
                return -EINVAL;
@@ -316,6 +323,21 @@ int drm_agp_unbind(struct inode *inode, struct file *filp,
                entry->bound = 0;
        return ret;
 }
+EXPORT_SYMBOL(drm_agp_unbind);
+int drm_agp_unbind_ioctl(struct inode *inode, struct file *filp,
+                         unsigned int cmd, unsigned long arg)
+{
+        drm_file_t *priv = filp->private_data;
+        drm_device_t *dev = priv->head->dev;
+        drm_agp_binding_t request;
+        if (copy_from_user
+            (&request, (drm_agp_binding_t __user *) arg, sizeof(request)))
+                return -EFAULT;
+        return drm_agp_unbind(dev, &request);
+}
 /**
 * Bind AGP memory into the GATT (ioctl)
@@ -330,26 +352,19 @@ int drm_agp_unbind(struct inode *inode, struct file *filp,
 * is currently bound into the GATT. Looks-up the AGP memory entry and passes
 * it to bind_agp() function.
 */
-int drm_agp_bind(struct inode *inode, struct file *filp,
+int drm_agp_bind(drm_device_t *dev, drm_agp_binding_t *request)
-                 unsigned int cmd, unsigned long arg)
 {
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->head->dev;
-        drm_agp_binding_t request;
        drm_agp_mem_t *entry;
        int retcode;
        int page;
        if (!dev->agp || !dev->agp->acquired)
                return -EINVAL;
-        if (copy_from_user
+        if (!(entry = drm_agp_lookup_entry(dev, request->handle)))
-            (&request, (drm_agp_binding_t __user *) arg, sizeof(request)))
-                return -EFAULT;
-        if (!(entry = drm_agp_lookup_entry(dev, request.handle)))
                return -EINVAL;
        if (entry->bound)
                return -EINVAL;
-        page = (request.offset + PAGE_SIZE - 1) / PAGE_SIZE;
+        page = (request->offset + PAGE_SIZE - 1) / PAGE_SIZE;
        if ((retcode = drm_bind_agp(entry->memory, page)))
                return retcode;
        entry->bound = dev->agp->base + (page << PAGE_SHIFT);
@@ -357,6 +372,21 @@ int drm_agp_bind(struct inode *inode, struct file *filp,
                  dev->agp->base, entry->bound);
        return 0;
 }
+EXPORT_SYMBOL(drm_agp_bind);
+int drm_agp_bind_ioctl(struct inode *inode, struct file *filp,
+                       unsigned int cmd, unsigned long arg)
+{
+        drm_file_t *priv = filp->private_data;
+        drm_device_t *dev = priv->head->dev;
+        drm_agp_binding_t request;
+        if (copy_from_user
+            (&request, (drm_agp_binding_t __user *) arg, sizeof(request)))
+                return -EFAULT;
+        return drm_agp_bind(dev, &request);
+}
 /**
 * Free AGP memory (ioctl).
@@ -372,20 +402,13 @@ int drm_agp_bind(struct inode *inode, struct file *filp,
 * unbind_agp(). Frees it via free_agp() as well as the entry itself
 * and unlinks from the doubly linked list it's inserted in.
 */
-int drm_agp_free(struct inode *inode, struct file *filp,
+int drm_agp_free(drm_device_t *dev, drm_agp_buffer_t *request)
-                 unsigned int cmd, unsigned long arg)
 {
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->head->dev;
-        drm_agp_buffer_t request;
        drm_agp_mem_t *entry;
        if (!dev->agp || !dev->agp->acquired)
                return -EINVAL;
-        if (copy_from_user
+        if (!(entry = drm_agp_lookup_entry(dev, request->handle)))
-            (&request, (drm_agp_buffer_t __user *) arg, sizeof(request)))
-                return -EFAULT;
-        if (!(entry = drm_agp_lookup_entry(dev, request.handle)))
                return -EINVAL;
        if (entry->bound)
                drm_unbind_agp(entry->memory);
@@ -402,12 +425,30 @@ int drm_agp_free(struct inode *inode, struct file *filp,
        drm_free(entry, sizeof(*entry), DRM_MEM_AGPLISTS);
        return 0;
 }
+EXPORT_SYMBOL(drm_agp_free);
+int drm_agp_free_ioctl(struct inode *inode, struct file *filp,
+                       unsigned int cmd, unsigned long arg)
+{
+        drm_file_t *priv = filp->private_data;
+        drm_device_t *dev = priv->head->dev;
+        drm_agp_buffer_t request;
+        if (copy_from_user
+            (&request, (drm_agp_buffer_t __user *) arg, sizeof(request)))
+                return -EFAULT;
+        return drm_agp_free(dev, &request);
+}
 /**
 * Initialize the AGP resources.
 *
 * \return pointer to a drm_agp_head structure.
 *
+ * Gets the drm_agp_t structure which is made available by the agpgart module
+ * via the inter_module_* functions. Creates and initializes a drm_agp_head
+ * structure.
 */
 drm_agp_head_t *drm_agp_init(drm_device_t * dev)
 {
diff --git a/drivers/char/drm/drm_bufs.c b/drivers/char/drm/drm_bufs.c
index 319bdea8de8a..1db12dcb6802 100644
--- a/drivers/char/drm/drm_bufs.c
+++ b/drivers/char/drm/drm_bufs.c
@@ -36,22 +36,21 @@
 #include <linux/vmalloc.h>
 #include "drmP.h"
-unsigned long drm_get_resource_start(drm_device_t * dev, unsigned int resource)
+unsigned long drm_get_resource_start(drm_device_t *dev, unsigned int resource)
 {
        return pci_resource_start(dev->pdev, resource);
 }
 EXPORT_SYMBOL(drm_get_resource_start);
-unsigned long drm_get_resource_len(drm_device_t * dev, unsigned int resource)
+unsigned long drm_get_resource_len(drm_device_t *dev, unsigned int resource)
 {
        return pci_resource_len(dev->pdev, resource);
 }
 EXPORT_SYMBOL(drm_get_resource_len);
-static drm_map_list_t *drm_find_matching_map(drm_device_t * dev,
+static drm_map_list_t *drm_find_matching_map(drm_device_t *dev,
-                                             drm_local_map_t * map)
+                                             drm_local_map_t *map)
 {
        struct list_head *list;
@@ -74,7 +73,7 @@ static drm_map_list_t *drm_find_matching_map(drm_device_t * dev,
 #ifdef _LP64
 static __inline__ unsigned int HandleID(unsigned long lhandle,
-                                        drm_device_t * dev)
+                                        drm_device_t *dev)
 {
        static unsigned int map32_handle = START_RANGE;
        unsigned int hash;
@@ -155,7 +154,7 @@ static int drm_addmap_core(drm_device_t * dev, unsigned int offset,
        case _DRM_REGISTERS:
        case _DRM_FRAME_BUFFER:
 #if !defined(__sparc__) && !defined(__alpha__) && !defined(__ia64__) && !defined(__powerpc64__) && !defined(__x86_64__)
-                if (map->offset + map->size < map->offset ||
+                if (map->offset + (map->size-1) < map->offset ||
                    map->offset < virt_to_phys(high_memory)) {
                        drm_free(map, sizeof(*map), DRM_MEM_MAPS);
                        return -EINVAL;
@@ -301,6 +300,9 @@ int drm_addmap_ioctl(struct inode *inode, struct file *filp,
                return -EFAULT;
        }
+        if (!(capable(CAP_SYS_ADMIN) || map.type == _DRM_AGP))
+                return -EPERM;
        err = drm_addmap_core(dev, map.offset, map.size, map.type, map.flags,
                              &maplist);
@@ -332,7 +334,7 @@ int drm_addmap_ioctl(struct inode *inode, struct file *filp,
 *
 * \sa drm_addmap
 */
-int drm_rmmap_locked(drm_device_t * dev, drm_local_map_t * map)
+int drm_rmmap_locked(drm_device_t *dev, drm_local_map_t *map)
 {
        struct list_head *list;
        drm_map_list_t *r_list = NULL;
@@ -384,10 +386,9 @@ int drm_rmmap_locked(drm_device_t * dev, drm_local_map_t * map)
        return 0;
 }
 EXPORT_SYMBOL(drm_rmmap_locked);
-int drm_rmmap(drm_device_t * dev, drm_local_map_t * map)
+int drm_rmmap(drm_device_t *dev, drm_local_map_t *map)
 {
        int ret;
@@ -397,7 +398,6 @@ int drm_rmmap(drm_device_t * dev, drm_local_map_t * map)
        return ret;
 }
 EXPORT_SYMBOL(drm_rmmap);
 /* The rmmap ioctl appears to be unnecessary.  All mappings are torn down on
@@ -548,7 +548,7 @@ int drm_addbufs_agp(drm_device_t * dev, drm_buf_desc_t * request)
        DRM_DEBUG("count:      %d\n", count);
        DRM_DEBUG("order:      %d\n", order);
        DRM_DEBUG("size:       %d\n", size);
-        DRM_DEBUG("agp_offset: %lu\n", agp_offset);
+        DRM_DEBUG("agp_offset: %lx\n", agp_offset);
        DRM_DEBUG("alignment:  %d\n", alignment);
        DRM_DEBUG("page_order: %d\n", page_order);
        DRM_DEBUG("total:      %d\n", total);
@@ -649,6 +649,8 @@ int drm_addbufs_agp(drm_device_t * dev, drm_buf_desc_t * request)
        }
        dma->buf_count += entry->buf_count;
+        dma->seg_count += entry->seg_count;
+        dma->page_count += byte_count >> PAGE_SHIFT;
        dma->byte_count += byte_count;
        DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count);
@@ -664,7 +666,6 @@ int drm_addbufs_agp(drm_device_t * dev, drm_buf_desc_t * request)
        atomic_dec(&dev->buf_alloc);
        return 0;
 }
 EXPORT_SYMBOL(drm_addbufs_agp);
 #endif                          /* __OS_HAS_AGP */
@@ -689,9 +690,13 @@ int drm_addbufs_pci(drm_device_t * dev, drm_buf_desc_t * request)
        if (!drm_core_check_feature(dev, DRIVER_PCI_DMA))
                return -EINVAL;
        if (!dma)
                return -EINVAL;
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
        count = request->count;
        order = drm_order(request->size);
        size = 1 << order;
@@ -882,7 +887,6 @@ int drm_addbufs_pci(drm_device_t * dev, drm_buf_desc_t * request)
        return 0;
 }
 EXPORT_SYMBOL(drm_addbufs_pci);
 static int drm_addbufs_sg(drm_device_t * dev, drm_buf_desc_t * request)
@@ -908,6 +912,9 @@ static int drm_addbufs_sg(drm_device_t * dev, drm_buf_desc_t * request)
        if (!dma)
                return -EINVAL;
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
        count = request->count;
        order = drm_order(request->size);
        size = 1 << order;
@@ -1026,6 +1033,8 @@ static int drm_addbufs_sg(drm_device_t * dev, drm_buf_desc_t * request)
        }
        dma->buf_count += entry->buf_count;
+        dma->seg_count += entry->seg_count;
+        dma->page_count += byte_count >> PAGE_SHIFT;
        dma->byte_count += byte_count;
        DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count);
@@ -1042,7 +1051,7 @@ static int drm_addbufs_sg(drm_device_t * dev, drm_buf_desc_t * request)
        return 0;
 }
-static int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
+int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
 {
        drm_device_dma_t *dma = dev->dma;
        drm_buf_entry_t *entry;
@@ -1065,6 +1074,9 @@ static int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
        if (!dma)
                return -EINVAL;
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
        count = request->count;
        order = drm_order(request->size);
        size = 1 << order;
@@ -1181,6 +1193,8 @@ static int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
        }
        dma->buf_count += entry->buf_count;
+        dma->seg_count += entry->seg_count;
+        dma->page_count += byte_count >> PAGE_SHIFT;
        dma->byte_count += byte_count;
        DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count);
@@ -1196,6 +1210,8 @@ static int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
        atomic_dec(&dev->buf_alloc);
        return 0;
 }
+EXPORT_SYMBOL(drm_addbufs_fb);
 /**
 * Add buffers for DMA transfers (ioctl).
@@ -1577,5 +1593,6 @@ int drm_order(unsigned long size)
        return order;
 }
 EXPORT_SYMBOL(drm_order);
diff --git a/drivers/char/drm/drm_context.c b/drivers/char/drm/drm_context.c
index bd958d69a2ac..f84254526949 100644
--- a/drivers/char/drm/drm_context.c
+++ b/drivers/char/drm/drm_context.c
@@ -433,7 +433,7 @@ int drm_addctx(struct inode *inode, struct file *filp,
        if (ctx.handle != DRM_KERNEL_CONTEXT) {
                if (dev->driver->context_ctor)
                        if (!dev->driver->context_ctor(dev, ctx.handle)) {
-                                DRM_DEBUG( "Running out of ctxs or memory.\n");
+                                DRM_DEBUG("Running out of ctxs or memory.\n");
                                return -ENOMEM;
                        }
        }
diff --git a/drivers/char/drm/drm_core.h b/drivers/char/drm/drm_core.h
index cc97bb906dda..f4f9db6c7ed4 100644
--- a/drivers/char/drm/drm_core.h
+++ b/drivers/char/drm/drm_core.h
@@ -24,11 +24,11 @@
 #define CORE_NAME               "drm"
 #define CORE_DESC               "DRM shared core routines"
-#define CORE_DATE               "20040925"
+#define CORE_DATE               "20051102"
 #define DRM_IF_MAJOR    1
 #define DRM_IF_MINOR    2
 #define CORE_MAJOR      1
 #define CORE_MINOR      0
-#define CORE_PATCHLEVEL 0
+#define CORE_PATCHLEVEL 1
diff --git a/drivers/char/drm/drm_drv.c b/drivers/char/drm/drm_drv.c
index 4dff7554eb08..c4fa5a29582b 100644
--- a/drivers/char/drm/drm_drv.c
+++ b/drivers/char/drm/drm_drv.c
@@ -56,66 +56,66 @@ static int drm_version(struct inode *inode, struct file *filp,
 /** Ioctl table */
 static drm_ioctl_desc_t drm_ioctls[] = {
-        [DRM_IOCTL_NR(DRM_IOCTL_VERSION)] = {drm_version, 0, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_VERSION)] = {drm_version, 0},
-        [DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE)] = {drm_getunique, 0, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE)] = {drm_getunique, 0},
-        [DRM_IOCTL_NR(DRM_IOCTL_GET_MAGIC)] = {drm_getmagic, 0, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_GET_MAGIC)] = {drm_getmagic, 0},
-        [DRM_IOCTL_NR(DRM_IOCTL_IRQ_BUSID)] = {drm_irq_by_busid, 0, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_IRQ_BUSID)] = {drm_irq_by_busid, DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_GET_MAP)] = {drm_getmap, 0, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_GET_MAP)] = {drm_getmap, 0},
-        [DRM_IOCTL_NR(DRM_IOCTL_GET_CLIENT)] = {drm_getclient, 0, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_GET_CLIENT)] = {drm_getclient, 0},
-        [DRM_IOCTL_NR(DRM_IOCTL_GET_STATS)] = {drm_getstats, 0, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_GET_STATS)] = {drm_getstats, 0},
-        [DRM_IOCTL_NR(DRM_IOCTL_SET_VERSION)] = {drm_setversion, 0, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_SET_VERSION)] = {drm_setversion, DRM_MASTER|DRM_ROOT_ONLY},
+        [DRM_IOCTL_NR(DRM_IOCTL_SET_UNIQUE)] = {drm_setunique, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_SET_UNIQUE)] = {drm_setunique, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_BLOCK)] = {drm_noop, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_BLOCK)] = {drm_noop, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_UNBLOCK)] = {drm_noop, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_UNBLOCK)] = {drm_noop, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_AUTH_MAGIC)] = {drm_authmagic, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_AUTH_MAGIC)] = {drm_authmagic, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_ADD_MAP)] = {drm_addmap_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_ADD_MAP)] = {drm_addmap_ioctl, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_RM_MAP)] = {drm_rmmap_ioctl, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_IOCTL_RM_MAP)] = {drm_rmmap_ioctl, 1, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_SET_SAREA_CTX)] = {drm_setsareactx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_SET_SAREA_CTX)] = {drm_setsareactx, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_GET_SAREA_CTX)] = {drm_getsareactx, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_IOCTL_GET_SAREA_CTX)] = {drm_getsareactx, 1, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_ADD_CTX)] = {drm_addctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_ADD_CTX)] = {drm_addctx, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_RM_CTX)] = {drm_rmctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_RM_CTX)] = {drm_rmctx, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_MOD_CTX)] = {drm_modctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_MOD_CTX)] = {drm_modctx, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_GET_CTX)] = {drm_getctx, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_IOCTL_GET_CTX)] = {drm_getctx, 1, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_SWITCH_CTX)] = {drm_switchctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_SWITCH_CTX)] = {drm_switchctx, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_NEW_CTX)] = {drm_newctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_NEW_CTX)] = {drm_newctx, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_RES_CTX)] = {drm_resctx, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_IOCTL_RES_CTX)] = {drm_resctx, 1, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_ADD_DRAW)] = {drm_adddraw, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_ADD_DRAW)] = {drm_adddraw, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_RM_DRAW)] = {drm_rmdraw, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_RM_DRAW)] = {drm_rmdraw, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_LOCK)] = {drm_lock, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_IOCTL_LOCK)] = {drm_lock, 1, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_UNLOCK)] = {drm_unlock, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_IOCTL_UNLOCK)] = {drm_unlock, 1, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_FINISH)] = {drm_noop, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_IOCTL_FINISH)] = {drm_noop, 1, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_ADD_BUFS)] = {drm_addbufs, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_ADD_BUFS)] = {drm_addbufs, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_MARK_BUFS)] = {drm_markbufs, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_MARK_BUFS)] = {drm_markbufs, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_INFO_BUFS)] = {drm_infobufs, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_IOCTL_INFO_BUFS)] = {drm_infobufs, 1, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_MAP_BUFS)] = {drm_mapbufs, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_IOCTL_MAP_BUFS)] = {drm_mapbufs, 1, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_FREE_BUFS)] = {drm_freebufs, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_IOCTL_FREE_BUFS)] = {drm_freebufs, 1, 0},
        /* The DRM_IOCTL_DMA ioctl should be defined by the driver. */
+        [DRM_IOCTL_NR(DRM_IOCTL_DMA)] = {NULL, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_IOCTL_CONTROL)] = {drm_control, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_CONTROL)] = {drm_control, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
 #if __OS_HAS_AGP
-        [DRM_IOCTL_NR(DRM_IOCTL_AGP_ACQUIRE)] = {drm_agp_acquire_ioctl, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_AGP_ACQUIRE)] = {drm_agp_acquire_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_AGP_RELEASE)] = {drm_agp_release_ioctl, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_AGP_RELEASE)] = {drm_agp_release_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_AGP_ENABLE)] = {drm_agp_enable_ioctl, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_AGP_ENABLE)] = {drm_agp_enable_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_AGP_INFO)] = {drm_agp_info_ioctl, 1, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_AGP_INFO)] = {drm_agp_info_ioctl, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_IOCTL_AGP_ALLOC)] = {drm_agp_alloc, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_AGP_ALLOC)] = {drm_agp_alloc_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_AGP_FREE)] = {drm_agp_free, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_AGP_FREE)] = {drm_agp_free_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_AGP_BIND)] = {drm_agp_bind, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_AGP_BIND)] = {drm_agp_bind_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_AGP_UNBIND)] = {drm_agp_unbind, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_AGP_UNBIND)] = {drm_agp_unbind_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
 #endif
-        [DRM_IOCTL_NR(DRM_IOCTL_SG_ALLOC)] = {drm_sg_alloc, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_SG_ALLOC)] = {drm_sg_alloc, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_SG_FREE)] = {drm_sg_free, 1, 1},
+        [DRM_IOCTL_NR(DRM_IOCTL_SG_FREE)] = {drm_sg_free, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK)] = {drm_wait_vblank, 0, 0},
+        [DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK)] = {drm_wait_vblank, 0},
 };
 #define DRIVER_IOCTL_COUNT      DRM_ARRAY_SIZE( drm_ioctls )
@@ -129,7 +129,7 @@ static drm_ioctl_desc_t drm_ioctls[] = {
 *
 * \sa drm_device
 */
-int drm_takedown(drm_device_t * dev)
+int drm_lastclose(drm_device_t * dev)
 {
        drm_magic_entry_t *pt, *next;
        drm_map_list_t *r_list;
@@ -138,9 +138,9 @@ int drm_takedown(drm_device_t * dev)
        DRM_DEBUG("\n");
-        if (dev->driver->pretakedown)
+        if (dev->driver->lastclose)
-                dev->driver->pretakedown(dev);
+                dev->driver->lastclose(dev);
-        DRM_DEBUG("driver pretakedown completed\n");
+        DRM_DEBUG("driver lastclose completed\n");
        if (dev->unique) {
                drm_free(dev->unique, strlen(dev->unique) + 1, DRM_MEM_DRIVER);
@@ -233,7 +233,7 @@ int drm_takedown(drm_device_t * dev)
        }
        up(&dev->struct_sem);
-        DRM_DEBUG("takedown completed\n");
+        DRM_DEBUG("lastclose completed\n");
        return 0;
 }
@@ -281,7 +281,7 @@ EXPORT_SYMBOL(drm_init);
 /**
 * Called via cleanup_module() at module unload time.
 *
- * Cleans up all DRM device, calling takedown().
+ * Cleans up all DRM device, calling drm_lastclose().
 *
 * \sa drm_init
 */
@@ -294,7 +294,7 @@ static void drm_cleanup(drm_device_t * dev)
                return;
        }
-        drm_takedown(dev);
+        drm_lastclose(dev);
        if (dev->maplist) {
                drm_free(dev->maplist, sizeof(*dev->maplist), DRM_MEM_MAPS);
@@ -317,8 +317,8 @@ static void drm_cleanup(drm_device_t * dev)
                dev->agp = NULL;
        }
-        if (dev->driver->postcleanup)
+        if (dev->driver->unload)
-                dev->driver->postcleanup(dev);
+                dev->driver->unload(dev);
        drm_put_head(&dev->primary);
        if (drm_put_dev(dev))
@@ -342,12 +342,12 @@ void drm_exit(struct drm_driver *driver)
                if (head->dev->driver != driver)
                        continue;
                dev = head->dev;
-        }
+                if (dev) {
-        if (dev) {
+                        /* release the pci driver */
-                /* release the pci driver */
+                        if (dev->pdev)
-                if (dev->pdev)
+                                pci_dev_put(dev->pdev);
-                        pci_dev_put(dev->pdev);
+                        drm_cleanup(dev);
-                drm_cleanup(dev);
+                }
        }
        DRM_INFO("Module unloaded\n");
 }
@@ -432,14 +432,17 @@ static int drm_version(struct inode *inode, struct file *filp,
        drm_device_t *dev = priv->head->dev;
        drm_version_t __user *argp = (void __user *)arg;
        drm_version_t version;
-        int ret;
+        int len;
        if (copy_from_user(&version, argp, sizeof(version)))
                return -EFAULT;
-        /* version is a required function to return the personality module version */
+        version.version_major = dev->driver->major;
-        if ((ret = dev->driver->version(&version)))
+        version.version_minor = dev->driver->minor;
-                return ret;
+        version.version_patchlevel = dev->driver->patchlevel;
+        DRM_COPY(version.name, dev->driver->name);
+        DRM_COPY(version.date, dev->driver->date);
+        DRM_COPY(version.desc, dev->driver->desc);
        if (copy_to_user(argp, &version, sizeof(version)))
                return -EFAULT;
@@ -493,8 +496,9 @@ int drm_ioctl(struct inode *inode, struct file *filp,
        if (!func) {
                DRM_DEBUG("no function\n");
                retcode = -EINVAL;
-        } else if ((ioctl->root_only && !capable(CAP_SYS_ADMIN)) ||
+        } else if (((ioctl->flags & DRM_ROOT_ONLY) && !capable(CAP_SYS_ADMIN)) ||
-                   (ioctl->auth_needed && !priv->authenticated)) {
+                   ((ioctl->flags & DRM_AUTH) && !priv->authenticated) ||
+                   ((ioctl->flags & DRM_MASTER) && !priv->master)) {
                retcode = -EACCES;
        } else {
                retcode = func(inode, filp, cmd, arg);
diff --git a/drivers/char/drm/drm_fops.c b/drivers/char/drm/drm_fops.c
index bf0a740122bf..403f44a1bf01 100644
--- a/drivers/char/drm/drm_fops.c
+++ b/drivers/char/drm/drm_fops.c
@@ -35,6 +35,7 @@
 */
 #include "drmP.h"
+#include "drm_sarea.h"
 #include <linux/poll.h>
 static int drm_open_helper(struct inode *inode, struct file *filp,
@@ -42,15 +43,21 @@ static int drm_open_helper(struct inode *inode, struct file *filp,
 static int drm_setup(drm_device_t * dev)
 {
+        drm_local_map_t *map;
        int i;
        int ret;
-        if (dev->driver->presetup) {
+        if (dev->driver->firstopen) {
-                ret = dev->driver->presetup(dev);
+                ret = dev->driver->firstopen(dev);
                if (ret != 0)
                        return ret;
        }
+        /* prebuild the SAREA */
+        i = drm_addmap(dev, 0, SAREA_MAX, _DRM_SHM, _DRM_CONTAINS_LOCK, &map);
+        if (i != 0)
+                return i;
        atomic_set(&dev->ioctl_count, 0);
        atomic_set(&dev->vma_count, 0);
        dev->buf_use = 0;
@@ -109,8 +116,6 @@ static int drm_setup(drm_device_t * dev)
         * drm_select_queue fails between the time the interrupt is
         * initialized and the time the queues are initialized.
         */
-        if (dev->driver->postsetup)
-                dev->driver->postsetup(dev);
        return 0;
 }
@@ -154,10 +159,168 @@ int drm_open(struct inode *inode, struct file *filp)
        return retcode;
 }
 EXPORT_SYMBOL(drm_open);
 /**
+ * File \c open operation.
+ *
+ * \param inode device inode.
+ * \param filp file pointer.
+ *
+ * Puts the dev->fops corresponding to the device minor number into
+ * \p filp, call the \c open method, and restore the file operations.
+ */
+int drm_stub_open(struct inode *inode, struct file *filp)
+{
+        drm_device_t *dev = NULL;
+        int minor = iminor(inode);
+        int err = -ENODEV;
+        struct file_operations *old_fops;
+        DRM_DEBUG("\n");
+        if (!((minor >= 0) && (minor < drm_cards_limit)))
+                return -ENODEV;
+        if (!drm_heads[minor])
+                return -ENODEV;
+        if (!(dev = drm_heads[minor]->dev))
+                return -ENODEV;
+        old_fops = filp->f_op;
+        filp->f_op = fops_get(&dev->driver->fops);
+        if (filp->f_op->open && (err = filp->f_op->open(inode, filp))) {
+                fops_put(filp->f_op);
+                filp->f_op = fops_get(old_fops);
+        }
+        fops_put(old_fops);
+        return err;
+}
+/**
+ * Check whether DRI will run on this CPU.
+ *
+ * \return non-zero if the DRI will run on this CPU, or zero otherwise.
+ */
+static int drm_cpu_valid(void)
+{
+#if defined(__i386__)
+        if (boot_cpu_data.x86 == 3)
+                return 0;       /* No cmpxchg on a 386 */
+#endif
+#if defined(__sparc__) && !defined(__sparc_v9__)
+        return 0;               /* No cmpxchg before v9 sparc. */
+#endif
+        return 1;
+}
+/**
+ * Called whenever a process opens /dev/drm.
+ *
+ * \param inode device inode.
+ * \param filp file pointer.
+ * \param dev device.
+ * \return zero on success or a negative number on failure.
+ *
+ * Creates and initializes a drm_file structure for the file private data in \p
+ * filp and add it into the double linked list in \p dev.
+ */
+static int drm_open_helper(struct inode *inode, struct file *filp,
+                           drm_device_t * dev)
+{
+        int minor = iminor(inode);
+        drm_file_t *priv;
+        int ret;
+        if (filp->f_flags & O_EXCL)
+                return -EBUSY;  /* No exclusive opens */
+        if (!drm_cpu_valid())
+                return -EINVAL;
+        DRM_DEBUG("pid = %d, minor = %d\n", current->pid, minor);
+        priv = drm_alloc(sizeof(*priv), DRM_MEM_FILES);
+        if (!priv)
+                return -ENOMEM;
+        memset(priv, 0, sizeof(*priv));
+        filp->private_data = priv;
+        priv->uid = current->euid;
+        priv->pid = current->pid;
+        priv->minor = minor;
+        priv->head = drm_heads[minor];
+        priv->ioctl_count = 0;
+        /* for compatibility root is always authenticated */
+        priv->authenticated = capable(CAP_SYS_ADMIN);
+        priv->lock_count = 0;
+        if (dev->driver->open) {
+                ret = dev->driver->open(dev, priv);
+                if (ret < 0)
+                        goto out_free;
+        }
+        down(&dev->struct_sem);
+        if (!dev->file_last) {
+                priv->next = NULL;
+                priv->prev = NULL;
+                dev->file_first = priv;
+                dev->file_last = priv;
+                /* first opener automatically becomes master */
+                priv->master = 1;
+        } else {
+                priv->next = NULL;
+                priv->prev = dev->file_last;
+                dev->file_last->next = priv;
+                dev->file_last = priv;
+        }
+        up(&dev->struct_sem);
+#ifdef __alpha__
+        /*
+         * Default the hose
+         */
+        if (!dev->hose) {
+                struct pci_dev *pci_dev;
+                pci_dev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, NULL);
+                if (pci_dev) {
+                        dev->hose = pci_dev->sysdata;
+                        pci_dev_put(pci_dev);
+                }
+                if (!dev->hose) {
+                        struct pci_bus *b = pci_bus_b(pci_root_buses.next);
+                        if (b)
+                                dev->hose = b->sysdata;
+                }
+        }
+#endif
+        return 0;
+      out_free:
+        drm_free(priv, sizeof(*priv), DRM_MEM_FILES);
+        filp->private_data = NULL;
+        return ret;
+}
+/** No-op. */
+int drm_fasync(int fd, struct file *filp, int on)
+{
+        drm_file_t *priv = filp->private_data;
+        drm_device_t *dev = priv->head->dev;
+        int retcode;
+        DRM_DEBUG("fd = %d, device = 0x%lx\n", fd,
+                  (long)old_encode_dev(priv->head->device));
+        retcode = fasync_helper(fd, filp, on, &dev->buf_async);
+        if (retcode < 0)
+                return retcode;
+        return 0;
+}
+EXPORT_SYMBOL(drm_fasync);
+/**
 * Release file.
 *
 * \param inode device inode
@@ -167,7 +330,7 @@ EXPORT_SYMBOL(drm_open);
 * If the hardware lock is held then free it, and take it again for the kernel
 * context since it's necessary to reclaim buffers. Unlink the file private
 * data from its list and free it. Decreases the open count and if it reaches
- * zero calls takedown().
+ * zero calls drm_lastclose().
 */
 int drm_release(struct inode *inode, struct file *filp)
 {
@@ -180,8 +343,8 @@ int drm_release(struct inode *inode, struct file *filp)
        DRM_DEBUG("open_count = %d\n", dev->open_count);
-        if (dev->driver->prerelease)
+        if (dev->driver->preclose)
-                dev->driver->prerelease(dev, filp);
+                dev->driver->preclose(dev, filp);
        /* ========================================================
         * Begin inline drm_release
@@ -197,8 +360,8 @@ int drm_release(struct inode *inode, struct file *filp)
                DRM_DEBUG("File %p released, freeing lock for context %d\n",
                          filp, _DRM_LOCKING_CONTEXT(dev->lock.hw_lock->lock));
-                if (dev->driver->release)
+                if (dev->driver->reclaim_buffers_locked)
-                        dev->driver->release(dev, filp);
+                        dev->driver->reclaim_buffers_locked(dev, filp);
                drm_lock_free(dev, &dev->lock.hw_lock->lock,
                              _DRM_LOCKING_CONTEXT(dev->lock.hw_lock->lock));
@@ -207,7 +370,7 @@ int drm_release(struct inode *inode, struct file *filp)
                   hardware at this point, possibly
                   processed via a callback to the X
                   server. */
-        } else if (dev->driver->release && priv->lock_count
+        } else if (dev->driver->reclaim_buffers_locked && priv->lock_count
                   && dev->lock.hw_lock) {
                /* The lock is required to reclaim buffers */
                DECLARE_WAITQUEUE(entry, current);
@@ -237,15 +400,14 @@ int drm_release(struct inode *inode, struct file *filp)
                __set_current_state(TASK_RUNNING);
                remove_wait_queue(&dev->lock.lock_queue, &entry);
                if (!retcode) {
-                        if (dev->driver->release)
+                        dev->driver->reclaim_buffers_locked(dev, filp);
-                                dev->driver->release(dev, filp);
                        drm_lock_free(dev, &dev->lock.hw_lock->lock,
                                      DRM_KERNEL_CONTEXT);
                }
        }
-        if (drm_core_check_feature(dev, DRIVER_HAVE_DMA)
+        if (drm_core_check_feature(dev, DRIVER_HAVE_DMA) &&
-            && !dev->driver->release) {
+            !dev->driver->reclaim_buffers_locked) {
                dev->driver->reclaim_buffers(dev, filp);
        }
@@ -292,9 +454,8 @@ int drm_release(struct inode *inode, struct file *filp)
        }
        up(&dev->struct_sem);
-        if (dev->driver->free_filp_priv)
+        if (dev->driver->postclose)
-                dev->driver->free_filp_priv(dev, priv);
+                dev->driver->postclose(dev, priv);
        drm_free(priv, sizeof(*priv), DRM_MEM_FILES);
        /* ========================================================
@@ -313,7 +474,7 @@ int drm_release(struct inode *inode, struct file *filp)
                }
                spin_unlock(&dev->count_lock);
                unlock_kernel();
-                return drm_takedown(dev);
+                return drm_lastclose(dev);
        }
        spin_unlock(&dev->count_lock);
@@ -321,129 +482,11 @@ int drm_release(struct inode *inode, struct file *filp)
        return retcode;
 }
 EXPORT_SYMBOL(drm_release);
-/**
- * Called whenever a process opens /dev/drm.
- *
- * \param inode device inode.
- * \param filp file pointer.
- * \param dev device.
- * \return zero on success or a negative number on failure.
- *
- * Creates and initializes a drm_file structure for the file private data in \p
- * filp and add it into the double linked list in \p dev.
- */
-static int drm_open_helper(struct inode *inode, struct file *filp,
-                           drm_device_t * dev)
-{
-        int minor = iminor(inode);
-        drm_file_t *priv;
-        int ret;
-        if (filp->f_flags & O_EXCL)
-                return -EBUSY;  /* No exclusive opens */
-        if (!drm_cpu_valid())
-                return -EINVAL;
-        DRM_DEBUG("pid = %d, minor = %d\n", current->pid, minor);
-        priv = drm_alloc(sizeof(*priv), DRM_MEM_FILES);
-        if (!priv)
-                return -ENOMEM;
-        memset(priv, 0, sizeof(*priv));
-        filp->private_data = priv;
-        priv->uid = current->euid;
-        priv->pid = current->pid;
-        priv->minor = minor;
-        priv->head = drm_heads[minor];
-        priv->ioctl_count = 0;
-        priv->authenticated = capable(CAP_SYS_ADMIN);
-        priv->lock_count = 0;
-        if (dev->driver->open_helper) {
-                ret = dev->driver->open_helper(dev, priv);
-                if (ret < 0)
-                        goto out_free;
-        }
-        down(&dev->struct_sem);
-        if (!dev->file_last) {
-                priv->next = NULL;
-                priv->prev = NULL;
-                dev->file_first = priv;
-                dev->file_last = priv;
-        } else {
-                priv->next = NULL;
-                priv->prev = dev->file_last;
-                dev->file_last->next = priv;
-                dev->file_last = priv;
-        }
-        up(&dev->struct_sem);
-#ifdef __alpha__
-        /*
-         * Default the hose
-         */
-        if (!dev->hose) {
-                struct pci_dev *pci_dev;
-                pci_dev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, NULL);
-                if (pci_dev) {
-                        dev->hose = pci_dev->sysdata;
-                        pci_dev_put(pci_dev);
-                }
-                if (!dev->hose) {
-                        struct pci_bus *b = pci_bus_b(pci_root_buses.next);
-                        if (b)
-                                dev->hose = b->sysdata;
-                }
-        }
-#endif
-        return 0;
-      out_free:
-        drm_free(priv, sizeof(*priv), DRM_MEM_FILES);
-        filp->private_data = NULL;
-        return ret;
-}
-/** No-op. */
-int drm_flush(struct file *filp)
-{
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->head->dev;
-        DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
-                  current->pid, (long)old_encode_dev(priv->head->device),
-                  dev->open_count);
-        return 0;
-}
-EXPORT_SYMBOL(drm_flush);
-/** No-op. */
-int drm_fasync(int fd, struct file *filp, int on)
-{
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->head->dev;
-        int retcode;
-        DRM_DEBUG("fd = %d, device = 0x%lx\n", fd,
-                  (long)old_encode_dev(priv->head->device));
-        retcode = fasync_helper(fd, filp, on, &dev->buf_async);
-        if (retcode < 0)
-                return retcode;
-        return 0;
-}
-EXPORT_SYMBOL(drm_fasync);
 /** No-op. */
 unsigned int drm_poll(struct file *filp, struct poll_table_struct *wait)
 {
        return 0;
 }
 EXPORT_SYMBOL(drm_poll);
diff --git a/drivers/char/drm/drm_init.c b/drivers/char/drm/drm_init.c
deleted file mode 100644
index 754b934715c4..000000000000
--- a/drivers/char/drm/drm_init.c
+++ /dev/null
@@ -1,53 +0,0 @@
-/**
- * \file drm_init.c
- * Setup/Cleanup for DRM
- *
- * \author Rickard E. (Rik) Faith <faith@valinux.com>
- * \author Gareth Hughes <gareth@valinux.com>
- */
-/*
- * Created: Mon Jan  4 08:58:31 1999 by faith@valinux.com
- *
- * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
- * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
- * All Rights Reserved.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the next
- * paragraph) shall be included in all copies or substantial portions of the
- * Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
- * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
- * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
- * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-#include "drmP.h"
-/**
- * Check whether DRI will run on this CPU.
- *
- * \return non-zero if the DRI will run on this CPU, or zero otherwise.
- */
-int drm_cpu_valid(void)
-{
-#if defined(__i386__)
-        if (boot_cpu_data.x86 == 3)
-                return 0;       /* No cmpxchg on a 386 */
-#endif
-#if defined(__sparc__) && !defined(__sparc_v9__)
-        return 0;               /* No cmpxchg before v9 sparc. */
-#endif
-        return 1;
-}
diff --git a/drivers/char/drm/drm_ioctl.c b/drivers/char/drm/drm_ioctl.c
index 9b0feba6b063..bcd4e604d3ec 100644
--- a/drivers/char/drm/drm_ioctl.c
+++ b/drivers/char/drm/drm_ioctl.c
@@ -137,17 +137,22 @@ int drm_setunique(struct inode *inode, struct file *filp,
 static int drm_set_busid(drm_device_t * dev)
 {
+        int len;
        if (dev->unique != NULL)
                return EBUSY;
-        dev->unique_len = 20;
+        dev->unique_len = 40;
        dev->unique = drm_alloc(dev->unique_len + 1, DRM_MEM_DRIVER);
        if (dev->unique == NULL)
                return ENOMEM;
-        snprintf(dev->unique, dev->unique_len, "pci:%04x:%02x:%02x.%d",
+        len = snprintf(dev->unique, dev->unique_len, "pci:%04x:%02x:%02x.%d",
                 dev->pci_domain, dev->pci_bus, dev->pci_slot, dev->pci_func);
+        if (len > dev->unique_len)
+                DRM_ERROR("Unique buffer overflowed\n");
        dev->devname =
            drm_alloc(strlen(dev->driver->pci_driver.name) + dev->unique_len +
                      2, DRM_MEM_DRIVER);
@@ -239,7 +244,7 @@ int drm_getclient(struct inode *inode, struct file *filp,
 {
        drm_file_t *priv = filp->private_data;
        drm_device_t *dev = priv->head->dev;
-        drm_client_t __user *argp = (void __user *)arg;
+        drm_client_t __user *argp = (drm_client_t __user *)arg;
        drm_client_t client;
        drm_file_t *pt;
        int idx;
@@ -262,7 +267,7 @@ int drm_getclient(struct inode *inode, struct file *filp,
        client.iocs = pt->ioctl_count;
        up(&dev->struct_sem);
-        if (copy_to_user((drm_client_t __user *) arg, &client, sizeof(client)))
+        if (copy_to_user(argp, &client, sizeof(client)))
                return -EFAULT;
        return 0;
 }
@@ -325,17 +330,13 @@ int drm_setversion(DRM_IOCTL_ARGS)
        drm_set_version_t retv;
        int if_version;
        drm_set_version_t __user *argp = (void __user *)data;
-        drm_version_t version;
        DRM_COPY_FROM_USER_IOCTL(sv, argp, sizeof(sv));
-        memset(&version, 0, sizeof(version));
-        dev->driver->version(&version);
        retv.drm_di_major = DRM_IF_MAJOR;
        retv.drm_di_minor = DRM_IF_MINOR;
-        retv.drm_dd_major = version.version_major;
+        retv.drm_dd_major = dev->driver->major;
-        retv.drm_dd_minor = version.version_minor;
+        retv.drm_dd_minor = dev->driver->minor;
        DRM_COPY_TO_USER_IOCTL(argp, retv, sizeof(sv));
@@ -343,7 +344,7 @@ int drm_setversion(DRM_IOCTL_ARGS)
                if (sv.drm_di_major != DRM_IF_MAJOR ||
                    sv.drm_di_minor < 0 || sv.drm_di_minor > DRM_IF_MINOR)
                        return EINVAL;
-                if_version = DRM_IF_VERSION(sv.drm_di_major, sv.drm_dd_minor);
+                if_version = DRM_IF_VERSION(sv.drm_di_major, sv.drm_di_minor);
                dev->if_version = DRM_MAX(if_version, dev->if_version);
                if (sv.drm_di_minor >= 1) {
                        /*
@@ -354,9 +355,9 @@ int drm_setversion(DRM_IOCTL_ARGS)
        }
        if (sv.drm_dd_major != -1) {
-                if (sv.drm_dd_major != version.version_major ||
+                if (sv.drm_dd_major != dev->driver->major ||
                    sv.drm_dd_minor < 0
-                    || sv.drm_dd_minor > version.version_minor)
+                    || sv.drm_dd_minor > dev->driver->minor)
                        return EINVAL;
                if (dev->driver->set_version)
diff --git a/drivers/char/drm/drm_lock.c b/drivers/char/drm/drm_lock.c
index b48a595d54ec..f9e45303498d 100644
--- a/drivers/char/drm/drm_lock.c
+++ b/drivers/char/drm/drm_lock.c
@@ -130,7 +130,6 @@ int drm_lock(struct inode *inode, struct file *filp,
        /* dev->driver->kernel_context_switch isn't used by any of the x86
         *  drivers but is used by the Sparc driver.
         */
        if (dev->driver->kernel_context_switch &&
            dev->last_context != lock.context) {
                dev->driver->kernel_context_switch(dev, dev->last_context,
diff --git a/drivers/char/drm/drm_memory.c b/drivers/char/drm/drm_memory.c
index abef2acf99f5..8074771e348f 100644
--- a/drivers/char/drm/drm_memory.c
+++ b/drivers/char/drm/drm_memory.c
@@ -145,30 +145,22 @@ DRM_AGP_MEM *drm_alloc_agp(drm_device_t * dev, int pages, u32 type)
        return drm_agp_allocate_memory(dev->agp->bridge, pages, type);
 }
-EXPORT_SYMBOL(drm_alloc_agp);
 /** Wrapper around agp_free_memory() */
 int drm_free_agp(DRM_AGP_MEM * handle, int pages)
 {
        return drm_agp_free_memory(handle) ? 0 : -EINVAL;
 }
-EXPORT_SYMBOL(drm_free_agp);
 /** Wrapper around agp_bind_memory() */
 int drm_bind_agp(DRM_AGP_MEM * handle, unsigned int start)
 {
        return drm_agp_bind_memory(handle, start);
 }
-EXPORT_SYMBOL(drm_bind_agp);
 /** Wrapper around agp_unbind_memory() */
 int drm_unbind_agp(DRM_AGP_MEM * handle)
 {
        return drm_agp_unbind_memory(handle);
 }
-EXPORT_SYMBOL(drm_unbind_agp);
 #endif                          /* agp */
 #endif                          /* debug_memory */
diff --git a/drivers/char/drm/drm_memory_debug.h b/drivers/char/drm/drm_memory_debug.h
index b370aca718d2..e84605fc54af 100644
--- a/drivers/char/drm/drm_memory_debug.h
+++ b/drivers/char/drm/drm_memory_debug.h
@@ -1,5 +1,5 @@
 /**
- * \file drm_memory.h
+ * \file drm_memory_debug.h
 * Memory management wrappers for DRM.
 *
 * \author Rickard E. (Rik) Faith <faith@valinux.com>
@@ -43,42 +43,41 @@ typedef struct drm_mem_stats {
        unsigned long bytes_freed;
 } drm_mem_stats_t;
-static DEFINE_SPINLOCK(DRM(mem_lock));
+static spinlock_t drm_mem_lock = SPIN_LOCK_UNLOCKED;
-static unsigned long DRM(ram_available) = 0;    /* In pages */
+static unsigned long drm_ram_available = 0;     /* In pages */
-static unsigned long DRM(ram_used) = 0;
+static unsigned long drm_ram_used = 0;
-static drm_mem_stats_t DRM(mem_stats)[] =
+static drm_mem_stats_t drm_mem_stats[] =
 {
-        [DRM_MEM_DMA] = {
+        [DRM_MEM_DMA] = {"dmabufs"},
-        "dmabufs"},[DRM_MEM_SAREA] = {
+        [DRM_MEM_SAREA] = {"sareas"},
-        "sareas"},[DRM_MEM_DRIVER] = {
+        [DRM_MEM_DRIVER] = {"driver"},
-        "driver"},[DRM_MEM_MAGIC] = {
+        [DRM_MEM_MAGIC] = {"magic"},
-        "magic"},[DRM_MEM_IOCTLS] = {
+        [DRM_MEM_IOCTLS] = {"ioctltab"},
-        "ioctltab"},[DRM_MEM_MAPS] = {
+        [DRM_MEM_MAPS] = {"maplist"},
-        "maplist"},[DRM_MEM_VMAS] = {
+        [DRM_MEM_VMAS] = {"vmalist"},
-        "vmalist"},[DRM_MEM_BUFS] = {
+        [DRM_MEM_BUFS] = {"buflist"},
-        "buflist"},[DRM_MEM_SEGS] = {
+        [DRM_MEM_SEGS] = {"seglist"},
-        "seglist"},[DRM_MEM_PAGES] = {
+        [DRM_MEM_PAGES] = {"pagelist"},
-        "pagelist"},[DRM_MEM_FILES] = {
+        [DRM_MEM_FILES] = {"files"},
-        "files"},[DRM_MEM_QUEUES] = {
+        [DRM_MEM_QUEUES] = {"queues"},
-        "queues"},[DRM_MEM_CMDS] = {
+        [DRM_MEM_CMDS] = {"commands"},
-        "commands"},[DRM_MEM_MAPPINGS] = {
+        [DRM_MEM_MAPPINGS] = {"mappings"},
-        "mappings"},[DRM_MEM_BUFLISTS] = {
+        [DRM_MEM_BUFLISTS] = {"buflists"},
-        "buflists"},[DRM_MEM_AGPLISTS] = {
+        [DRM_MEM_AGPLISTS] = {"agplist"},
-        "agplist"},[DRM_MEM_SGLISTS] = {
+        [DRM_MEM_SGLISTS] = {"sglist"},
-        "sglist"},[DRM_MEM_TOTALAGP] = {
+        [DRM_MEM_TOTALAGP] = {"totalagp"},
-        "totalagp"},[DRM_MEM_BOUNDAGP] = {
+        [DRM_MEM_BOUNDAGP] = {"boundagp"},
-        "boundagp"},[DRM_MEM_CTXBITMAP] = {
+        [DRM_MEM_CTXBITMAP] = {"ctxbitmap"},
-        "ctxbitmap"},[DRM_MEM_CTXLIST] = {
+        [DRM_MEM_CTXLIST] = {"ctxlist"},
-        "ctxlist"},[DRM_MEM_STUB] = {
+        [DRM_MEM_STUB] = {"stub"},
-        "stub"}, {
+        {NULL, 0,}              /* Last entry must be null */
-        NULL, 0,}               /* Last entry must be null */
 };
-void DRM(mem_init) (void) {
+void drm_mem_init (void) {
        drm_mem_stats_t *mem;
        struct sysinfo si;
-        for (mem = DRM(mem_stats); mem->name; ++mem) {
+        for (mem = drm_mem_stats; mem->name; ++mem) {
                mem->succeed_count = 0;
                mem->free_count = 0;
                mem->fail_count = 0;
@@ -87,13 +86,13 @@ void DRM(mem_init) (void) {
        }
        si_meminfo(&si);
-        DRM(ram_available) = si.totalram;
+        drm_ram_available = si.totalram;
-        DRM(ram_used) = 0;
+        drm_ram_used = 0;
 }
 /* drm_mem_info is called whenever a process reads /dev/drm/mem. */
-static int DRM(_mem_info) (char *buf, char **start, off_t offset,
+static int drm__mem_info (char *buf, char **start, off_t offset,
                           int request, int *eof, void *data) {
        drm_mem_stats_t *pt;
        int len = 0;
@@ -112,11 +111,11 @@ static int DRM(_mem_info) (char *buf, char **start, off_t offset,
                       " | allocs      bytes\n\n");
        DRM_PROC_PRINT("%-9.9s %5d %5d %4d %10lu kB         |\n",
                       "system", 0, 0, 0,
-                       DRM(ram_available) << (PAGE_SHIFT - 10));
+                       drm_ram_available << (PAGE_SHIFT - 10));
        DRM_PROC_PRINT("%-9.9s %5d %5d %4d %10lu kB         |\n",
-                       "locked", 0, 0, 0, DRM(ram_used) >> 10);
+                       "locked", 0, 0, 0, drm_ram_used >> 10);
        DRM_PROC_PRINT("\n");
-        for (pt = DRM(mem_stats); pt->name; pt++) {
+        for (pt = drm_mem_stats; pt->name; pt++) {
                DRM_PROC_PRINT("%-9.9s %5d %5d %4d %10lu %10lu | %6d %10ld\n",
                               pt->name,
                               pt->succeed_count,
@@ -135,17 +134,17 @@ static int DRM(_mem_info) (char *buf, char **start, off_t offset,
        return len - offset;
 }
-int DRM(mem_info) (char *buf, char **start, off_t offset,
+int drm_mem_info (char *buf, char **start, off_t offset,
                   int len, int *eof, void *data) {
        int ret;
-        spin_lock(&DRM(mem_lock));
+        spin_lock(&drm_mem_lock);
-        ret = DRM(_mem_info) (buf, start, offset, len, eof, data);
+        ret = drm__mem_info (buf, start, offset, len, eof, data);
-        spin_unlock(&DRM(mem_lock));
+        spin_unlock(&drm_mem_lock);
        return ret;
 }
-void *DRM(alloc) (size_t size, int area) {
+void *drm_alloc (size_t size, int area) {
        void *pt;
        if (!size) {
@@ -154,41 +153,41 @@ void *DRM(alloc) (size_t size, int area) {
        }
        if (!(pt = kmalloc(size, GFP_KERNEL))) {
-                spin_lock(&DRM(mem_lock));
+                spin_lock(&drm_mem_lock);
-                ++DRM(mem_stats)[area].fail_count;
+                ++drm_mem_stats[area].fail_count;
-                spin_unlock(&DRM(mem_lock));
+                spin_unlock(&drm_mem_lock);
                return NULL;
        }
-        spin_lock(&DRM(mem_lock));
+        spin_lock(&drm_mem_lock);
-        ++DRM(mem_stats)[area].succeed_count;
+        ++drm_mem_stats[area].succeed_count;
-        DRM(mem_stats)[area].bytes_allocated += size;
+        drm_mem_stats[area].bytes_allocated += size;
-        spin_unlock(&DRM(mem_lock));
+        spin_unlock(&drm_mem_lock);
        return pt;
 }
-void *DRM(calloc) (size_t nmemb, size_t size, int area) {
+void *drm_calloc (size_t nmemb, size_t size, int area) {
        void *addr;
-        addr = DRM(alloc) (nmemb * size, area);
+        addr = drm_alloc (nmemb * size, area);
        if (addr != NULL)
                memset((void *)addr, 0, size * nmemb);
        return addr;
 }
-void *DRM(realloc) (void *oldpt, size_t oldsize, size_t size, int area) {
+void *drm_realloc (void *oldpt, size_t oldsize, size_t size, int area) {
        void *pt;
-        if (!(pt = DRM(alloc) (size, area)))
+        if (!(pt = drm_alloc (size, area)))
                return NULL;
        if (oldpt && oldsize) {
                memcpy(pt, oldpt, oldsize);
-                DRM(free) (oldpt, oldsize, area);
+                drm_free (oldpt, oldsize, area);
        }
        return pt;
 }
-void DRM(free) (void *pt, size_t size, int area) {
+void drm_free (void *pt, size_t size, int area) {
        int alloc_count;
        int free_count;
@@ -196,43 +195,43 @@ void DRM(free) (void *pt, size_t size, int area) {
                DRM_MEM_ERROR(area, "Attempt to free NULL pointer\n");
        else
                kfree(pt);
-        spin_lock(&DRM(mem_lock));
+        spin_lock(&drm_mem_lock);
-        DRM(mem_stats)[area].bytes_freed += size;
+        drm_mem_stats[area].bytes_freed += size;
-        free_count = ++DRM(mem_stats)[area].free_count;
+        free_count = ++drm_mem_stats[area].free_count;
-        alloc_count = DRM(mem_stats)[area].succeed_count;
+        alloc_count = drm_mem_stats[area].succeed_count;
-        spin_unlock(&DRM(mem_lock));
+        spin_unlock(&drm_mem_lock);
        if (free_count > alloc_count) {
                DRM_MEM_ERROR(area, "Excess frees: %d frees, %d allocs\n",
                              free_count, alloc_count);
        }
 }
-unsigned long DRM(alloc_pages) (int order, int area) {
+unsigned long drm_alloc_pages (int order, int area) {
        unsigned long address;
        unsigned long bytes = PAGE_SIZE << order;
        unsigned long addr;
        unsigned int sz;
-        spin_lock(&DRM(mem_lock));
+        spin_lock(&drm_mem_lock);
-        if ((DRM(ram_used) >> PAGE_SHIFT)
+        if ((drm_ram_used >> PAGE_SHIFT)
-            > (DRM_RAM_PERCENT * DRM(ram_available)) / 100) {
+            > (DRM_RAM_PERCENT * drm_ram_available) / 100) {
-                spin_unlock(&DRM(mem_lock));
+                spin_unlock(&drm_mem_lock);
                return 0;
        }
-        spin_unlock(&DRM(mem_lock));
+        spin_unlock(&drm_mem_lock);
        address = __get_free_pages(GFP_KERNEL|__GFP_COMP, order);
        if (!address) {
-                spin_lock(&DRM(mem_lock));
+                spin_lock(&drm_mem_lock);
-                ++DRM(mem_stats)[area].fail_count;
+                ++drm_mem_stats[area].fail_count;
-                spin_unlock(&DRM(mem_lock));
+                spin_unlock(&drm_mem_lock);
                return 0;
        }
-        spin_lock(&DRM(mem_lock));
+        spin_lock(&drm_mem_lock);
-        ++DRM(mem_stats)[area].succeed_count;
+        ++drm_mem_stats[area].succeed_count;
-        DRM(mem_stats)[area].bytes_allocated += bytes;
+        drm_mem_stats[area].bytes_allocated += bytes;
-        DRM(ram_used) += bytes;
+        drm_ram_used += bytes;
-        spin_unlock(&DRM(mem_lock));
+        spin_unlock(&drm_mem_lock);
        /* Zero outside the lock */
        memset((void *)address, 0, bytes);
@@ -246,7 +245,7 @@ unsigned long DRM(alloc_pages) (int order, int area) {
        return address;
 }
-void DRM(free_pages) (unsigned long address, int order, int area) {
+void drm_free_pages (unsigned long address, int order, int area) {
        unsigned long bytes = PAGE_SIZE << order;
        int alloc_count;
        int free_count;
@@ -264,12 +263,12 @@ void DRM(free_pages) (unsigned long address, int order, int area) {
                free_pages(address, order);
        }
-        spin_lock(&DRM(mem_lock));
+        spin_lock(&drm_mem_lock);
-        free_count = ++DRM(mem_stats)[area].free_count;
+        free_count = ++drm_mem_stats[area].free_count;
-        alloc_count = DRM(mem_stats)[area].succeed_count;
+        alloc_count = drm_mem_stats[area].succeed_count;
-        DRM(mem_stats)[area].bytes_freed += bytes;
+        drm_mem_stats[area].bytes_freed += bytes;
-        DRM(ram_used) -= bytes;
+        drm_ram_used -= bytes;
-        spin_unlock(&DRM(mem_lock));
+        spin_unlock(&drm_mem_lock);
        if (free_count > alloc_count) {
                DRM_MEM_ERROR(area,
                              "Excess frees: %d frees, %d allocs\n",
@@ -277,7 +276,7 @@ void DRM(free_pages) (unsigned long address, int order, int area) {
        }
 }
-void *DRM(ioremap) (unsigned long offset, unsigned long size,
+void *drm_ioremap (unsigned long offset, unsigned long size,
                    drm_device_t * dev) {
        void *pt;
@@ -288,19 +287,19 @@ void *DRM(ioremap) (unsigned long offset, unsigned long size,
        }
        if (!(pt = drm_ioremap(offset, size, dev))) {
-                spin_lock(&DRM(mem_lock));
+                spin_lock(&drm_mem_lock);
-                ++DRM(mem_stats)[DRM_MEM_MAPPINGS].fail_count;
+                ++drm_mem_stats[DRM_MEM_MAPPINGS].fail_count;
-                spin_unlock(&DRM(mem_lock));
+                spin_unlock(&drm_mem_lock);
                return NULL;
        }
-        spin_lock(&DRM(mem_lock));
+        spin_lock(&drm_mem_lock);
-        ++DRM(mem_stats)[DRM_MEM_MAPPINGS].succeed_count;
+        ++drm_mem_stats[DRM_MEM_MAPPINGS].succeed_count;
-        DRM(mem_stats)[DRM_MEM_MAPPINGS].bytes_allocated += size;
+        drm_mem_stats[DRM_MEM_MAPPINGS].bytes_allocated += size;
-        spin_unlock(&DRM(mem_lock));
+        spin_unlock(&drm_mem_lock);
        return pt;
 }
-void *DRM(ioremap_nocache) (unsigned long offset, unsigned long size,
+void *drm_ioremap_nocache (unsigned long offset, unsigned long size,
                            drm_device_t * dev) {
        void *pt;
@@ -311,19 +310,19 @@ void *DRM(ioremap_nocache) (unsigned long offset, unsigned long size,
        }
        if (!(pt = drm_ioremap_nocache(offset, size, dev))) {
-                spin_lock(&DRM(mem_lock));
+                spin_lock(&drm_mem_lock);
-                ++DRM(mem_stats)[DRM_MEM_MAPPINGS].fail_count;
+                ++drm_mem_stats[DRM_MEM_MAPPINGS].fail_count;
-                spin_unlock(&DRM(mem_lock));
+                spin_unlock(&drm_mem_lock);
                return NULL;
        }
-        spin_lock(&DRM(mem_lock));
+        spin_lock(&drm_mem_lock);
-        ++DRM(mem_stats)[DRM_MEM_MAPPINGS].succeed_count;
+        ++drm_mem_stats[DRM_MEM_MAPPINGS].succeed_count;
-        DRM(mem_stats)[DRM_MEM_MAPPINGS].bytes_allocated += size;
+        drm_mem_stats[DRM_MEM_MAPPINGS].bytes_allocated += size;
-        spin_unlock(&DRM(mem_lock));
+        spin_unlock(&drm_mem_lock);
        return pt;
 }
-void DRM(ioremapfree) (void *pt, unsigned long size, drm_device_t * dev) {
+void drm_ioremapfree (void *pt, unsigned long size, drm_device_t * dev) {
        int alloc_count;
        int free_count;
@@ -333,11 +332,11 @@ void DRM(ioremapfree) (void *pt, unsigned long size, drm_device_t * dev) {
        else
                drm_ioremapfree(pt, size, dev);
-        spin_lock(&DRM(mem_lock));
+        spin_lock(&drm_mem_lock);
-        DRM(mem_stats)[DRM_MEM_MAPPINGS].bytes_freed += size;
+        drm_mem_stats[DRM_MEM_MAPPINGS].bytes_freed += size;
-        free_count = ++DRM(mem_stats)[DRM_MEM_MAPPINGS].free_count;
+        free_count = ++drm_mem_stats[DRM_MEM_MAPPINGS].free_count;
-        alloc_count = DRM(mem_stats)[DRM_MEM_MAPPINGS].succeed_count;
+        alloc_count = drm_mem_stats[DRM_MEM_MAPPINGS].succeed_count;
-        spin_unlock(&DRM(mem_lock));
+        spin_unlock(&drm_mem_lock);
        if (free_count > alloc_count) {
                DRM_MEM_ERROR(DRM_MEM_MAPPINGS,
                              "Excess frees: %d frees, %d allocs\n",
@@ -347,7 +346,7 @@ void DRM(ioremapfree) (void *pt, unsigned long size, drm_device_t * dev) {
 #if __OS_HAS_AGP
-DRM_AGP_MEM *DRM(alloc_agp) (int pages, u32 type) {
+DRM_AGP_MEM *drm_alloc_agp (drm_device_t *dev, int pages, u32 type) {
        DRM_AGP_MEM *handle;
        if (!pages) {
@@ -355,21 +354,21 @@ DRM_AGP_MEM *DRM(alloc_agp) (int pages, u32 type) {
                return NULL;
        }
-        if ((handle = DRM(agp_allocate_memory) (pages, type))) {
+        if ((handle = drm_agp_allocate_memory (pages, type))) {
-                spin_lock(&DRM(mem_lock));
+                spin_lock(&drm_mem_lock);
-                ++DRM(mem_stats)[DRM_MEM_TOTALAGP].succeed_count;
+                ++drm_mem_stats[DRM_MEM_TOTALAGP].succeed_count;
-                DRM(mem_stats)[DRM_MEM_TOTALAGP].bytes_allocated
+                drm_mem_stats[DRM_MEM_TOTALAGP].bytes_allocated
                    += pages << PAGE_SHIFT;
-                spin_unlock(&DRM(mem_lock));
+                spin_unlock(&drm_mem_lock);
                return handle;
        }
-        spin_lock(&DRM(mem_lock));
+        spin_lock(&drm_mem_lock);
-        ++DRM(mem_stats)[DRM_MEM_TOTALAGP].fail_count;
+        ++drm_mem_stats[DRM_MEM_TOTALAGP].fail_count;
-        spin_unlock(&DRM(mem_lock));
+        spin_unlock(&drm_mem_lock);
        return NULL;
 }
-int DRM(free_agp) (DRM_AGP_MEM * handle, int pages) {
+int drm_free_agp (DRM_AGP_MEM * handle, int pages) {
        int alloc_count;
        int free_count;
        int retval = -EINVAL;
@@ -380,13 +379,13 @@ int DRM(free_agp) (DRM_AGP_MEM * handle, int pages) {
                return retval;
        }
-        if (DRM(agp_free_memory) (handle)) {
+        if (drm_agp_free_memory (handle)) {
-                spin_lock(&DRM(mem_lock));
+                spin_lock(&drm_mem_lock);
-                free_count = ++DRM(mem_stats)[DRM_MEM_TOTALAGP].free_count;
+                free_count = ++drm_mem_stats[DRM_MEM_TOTALAGP].free_count;
-                alloc_count = DRM(mem_stats)[DRM_MEM_TOTALAGP].succeed_count;
+                alloc_count = drm_mem_stats[DRM_MEM_TOTALAGP].succeed_count;
-                DRM(mem_stats)[DRM_MEM_TOTALAGP].bytes_freed
+                drm_mem_stats[DRM_MEM_TOTALAGP].bytes_freed
                    += pages << PAGE_SHIFT;
-                spin_unlock(&DRM(mem_lock));
+                spin_unlock(&drm_mem_lock);
                if (free_count > alloc_count) {
                        DRM_MEM_ERROR(DRM_MEM_TOTALAGP,
                                      "Excess frees: %d frees, %d allocs\n",
@@ -397,7 +396,7 @@ int DRM(free_agp) (DRM_AGP_MEM * handle, int pages) {
        return retval;
 }
-int DRM(bind_agp) (DRM_AGP_MEM * handle, unsigned int start) {
+int drm_bind_agp (DRM_AGP_MEM * handle, unsigned int start) {
        int retcode = -EINVAL;
        if (!handle) {
@@ -406,21 +405,21 @@ int DRM(bind_agp) (DRM_AGP_MEM * handle, unsigned int start) {
                return retcode;
        }
-        if (!(retcode = DRM(agp_bind_memory) (handle, start))) {
+        if (!(retcode = drm_agp_bind_memory (handle, start))) {
-                spin_lock(&DRM(mem_lock));
+                spin_lock(&drm_mem_lock);
-                ++DRM(mem_stats)[DRM_MEM_BOUNDAGP].succeed_count;
+                ++drm_mem_stats[DRM_MEM_BOUNDAGP].succeed_count;
-                DRM(mem_stats)[DRM_MEM_BOUNDAGP].bytes_allocated
+                drm_mem_stats[DRM_MEM_BOUNDAGP].bytes_allocated
                    += handle->page_count << PAGE_SHIFT;
-                spin_unlock(&DRM(mem_lock));
+                spin_unlock(&drm_mem_lock);
                return retcode;
        }
-        spin_lock(&DRM(mem_lock));
+        spin_lock(&drm_mem_lock);
-        ++DRM(mem_stats)[DRM_MEM_BOUNDAGP].fail_count;
+        ++drm_mem_stats[DRM_MEM_BOUNDAGP].fail_count;
-        spin_unlock(&DRM(mem_lock));
+        spin_unlock(&drm_mem_lock);
        return retcode;
 }
-int DRM(unbind_agp) (DRM_AGP_MEM * handle) {
+int drm_unbind_agp (DRM_AGP_MEM * handle) {
        int alloc_count;
        int free_count;
        int retcode = -EINVAL;
@@ -431,14 +430,14 @@ int DRM(unbind_agp) (DRM_AGP_MEM * handle) {
                return retcode;
        }
-        if ((retcode = DRM(agp_unbind_memory) (handle)))
+        if ((retcode = drm_agp_unbind_memory (handle)))
                return retcode;
-        spin_lock(&DRM(mem_lock));
+        spin_lock(&drm_mem_lock);
-        free_count = ++DRM(mem_stats)[DRM_MEM_BOUNDAGP].free_count;
+        free_count = ++drm_mem_stats[DRM_MEM_BOUNDAGP].free_count;
-        alloc_count = DRM(mem_stats)[DRM_MEM_BOUNDAGP].succeed_count;
+        alloc_count = drm_mem_stats[DRM_MEM_BOUNDAGP].succeed_count;
-        DRM(mem_stats)[DRM_MEM_BOUNDAGP].bytes_freed
+        drm_mem_stats[DRM_MEM_BOUNDAGP].bytes_freed
            += handle->page_count << PAGE_SHIFT;
-        spin_unlock(&DRM(mem_lock));
+        spin_unlock(&drm_mem_lock);
        if (free_count > alloc_count) {
                DRM_MEM_ERROR(DRM_MEM_BOUNDAGP,
                              "Excess frees: %d frees, %d allocs\n",
diff --git a/drivers/char/drm/drm_os_linux.h b/drivers/char/drm/drm_os_linux.h
index d51aeb4966f4..695115d70382 100644
--- a/drivers/char/drm/drm_os_linux.h
+++ b/drivers/char/drm/drm_os_linux.h
@@ -13,6 +13,7 @@
 #define DRM_ERR(d)                      -(d)
 /** Current process ID */
 #define DRM_CURRENTPID                  current->pid
+#define DRM_SUSER(p)                    capable(CAP_SYS_ADMIN)
 #define DRM_UDELAY(d)                   udelay(d)
 /** Read a byte from a MMIO region */
 #define DRM_READ8(map, offset)          readb(((void __iomem *)(map)->handle) + (offset))
diff --git a/drivers/char/drm/drm_pciids.h b/drivers/char/drm/drm_pciids.h
index d66dc55e29a0..5b1d3a04458d 100644
--- a/drivers/char/drm/drm_pciids.h
+++ b/drivers/char/drm/drm_pciids.h
@@ -46,6 +46,7 @@
        {0x1002, 0x4E50, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
        {0x1002, 0x4E51, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
        {0x1002, 0x4E54, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
+        {0x1002, 0x4E56, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
        {0x1002, 0x5144, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R100|CHIP_SINGLE_CRTC}, \
        {0x1002, 0x5145, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R100|CHIP_SINGLE_CRTC}, \
        {0x1002, 0x5146, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R100|CHIP_SINGLE_CRTC}, \
@@ -69,6 +70,7 @@
        {0x1002, 0x516B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
        {0x1002, 0x516C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
        {0x1002, 0x5460, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
+        {0x1002, 0x554F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
        {0x1002, 0x5834, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|CHIP_IS_IGP}, \
        {0x1002, 0x5835, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|CHIP_IS_IGP|CHIP_IS_MOBILITY}, \
        {0x1002, 0x5836, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|CHIP_IS_IGP}, \
@@ -82,10 +84,13 @@
        {0x1002, 0x5969, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV100}, \
        {0x1002, 0x596A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
        {0x1002, 0x596B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
+        {0x1002, 0x5b60, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
        {0x1002, 0x5c61, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280|CHIP_IS_MOBILITY}, \
        {0x1002, 0x5c62, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
        {0x1002, 0x5c63, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280|CHIP_IS_MOBILITY}, \
        {0x1002, 0x5c64, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
+        {0x1002, 0x5d4d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
+        {0x1002, 0x5e4b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420}, \
        {0, 0, 0}
 #define r128_PCI_IDS \
@@ -176,7 +181,7 @@
 #define viadrv_PCI_IDS \
        {0x1106, 0x3022, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-        {0x1106, 0x3118, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+        {0x1106, 0x3118, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_PRO_GROUP_A}, \
        {0x1106, 0x3122, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
        {0x1106, 0x7205, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
        {0x1106, 0x3108, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
@@ -196,6 +201,10 @@
        {0x8086, 0x2572, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
        {0, 0, 0}
+#define gamma_PCI_IDS \
+        {0x3d3d, 0x0008, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+        {0, 0, 0}
 #define savage_PCI_IDS \
        {0x5333, 0x8a20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE3D}, \
        {0x5333, 0x8a21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE3D}, \
@@ -234,3 +243,4 @@
        {0x8086, 0x2592, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
        {0x8086, 0x2772, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
        {0, 0, 0}
diff --git a/drivers/char/drm/drm_proc.c b/drivers/char/drm/drm_proc.c
index 3f452f763f0f..6f943e3309ef 100644
--- a/drivers/char/drm/drm_proc.c
+++ b/drivers/char/drm/drm_proc.c
@@ -61,16 +61,14 @@ static struct drm_proc_list {
        const char *name;       /**< file name */
        int (*f) (char *, char **, off_t, int, int *, void *);          /**< proc callback*/
 } drm_proc_list[] = {
-        {
+        {"name", drm_name_info},
-        "name", drm_name_info}, {
+        {"mem", drm_mem_info},
-        "mem", drm_mem_info}, {
+        {"vm", drm_vm_info},
-        "vm", drm_vm_info}, {
+        {"clients", drm_clients_info},
-        "clients", drm_clients_info}, {
+        {"queues", drm_queues_info},
-        "queues", drm_queues_info}, {
+        {"bufs", drm_bufs_info},
-        "bufs", drm_bufs_info},
 #if DRM_DEBUG_CODE
-        {
+        {"vma", drm_vma_info},
-        "vma", drm_vma_info},
 #endif
 };
diff --git a/drivers/char/drm/drm_stub.c b/drivers/char/drm/drm_stub.c
index 60b6f8e8bf69..42d766359caa 100644
--- a/drivers/char/drm/drm_stub.c
+++ b/drivers/char/drm/drm_stub.c
@@ -93,8 +93,8 @@ static int drm_fill_in_dev(drm_device_t * dev, struct pci_dev *pdev,
        dev->driver = driver;
-        if (dev->driver->preinit)
+        if (dev->driver->load)
-                if ((retcode = dev->driver->preinit(dev, ent->driver_data)))
+                if ((retcode = dev->driver->load(dev, ent->driver_data)))
                        goto error_out_unreg;
        if (drm_core_has_AGP(dev)) {
@@ -124,47 +124,10 @@ static int drm_fill_in_dev(drm_device_t * dev, struct pci_dev *pdev,
        return 0;
      error_out_unreg:
-        drm_takedown(dev);
+        drm_lastclose(dev);
        return retcode;
 }
-/**
- * File \c open operation.
- *
- * \param inode device inode.
- * \param filp file pointer.
- *
- * Puts the dev->fops corresponding to the device minor number into
- * \p filp, call the \c open method, and restore the file operations.
- */
-int drm_stub_open(struct inode *inode, struct file *filp)
-{
-        drm_device_t *dev = NULL;
-        int minor = iminor(inode);
-        int err = -ENODEV;
-        struct file_operations *old_fops;
-        DRM_DEBUG("\n");
-        if (!((minor >= 0) && (minor < drm_cards_limit)))
-                return -ENODEV;
-        if (!drm_heads[minor])
-                return -ENODEV;
-        if (!(dev = drm_heads[minor]->dev))
-                return -ENODEV;
-        old_fops = filp->f_op;
-        filp->f_op = fops_get(&dev->driver->fops);
-        if (filp->f_op->open && (err = filp->f_op->open(inode, filp))) {
-                fops_put(filp->f_op);
-                filp->f_op = fops_get(old_fops);
-        }
-        fops_put(old_fops);
-        return err;
-}
 /**
 * Get a secondary minor number.
@@ -200,11 +163,7 @@ static int drm_get_head(drm_device_t * dev, drm_head_t * head)
                                goto err_g1;
                        }
-                        head->dev_class = drm_sysfs_device_add(drm_class,
+                        head->dev_class = drm_sysfs_device_add(drm_class, head);
-                                                               MKDEV(DRM_MAJOR,
-                                                                     minor),
-                                                               &dev->pdev->dev,
-                                                               "card%d", minor);
                        if (IS_ERR(head->dev_class)) {
                                printk(KERN_ERR
                                       "DRM: Error sysfs_device_add.\n");
@@ -258,11 +217,10 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
        }
        if ((ret = drm_get_head(dev, &dev->primary)))
                goto err_g1;
+        
-        /* postinit is a required function to display the signon banner */
+        DRM_INFO("Initialized %s %d.%d.%d %s on minor %d\n",
-        /* drivers add secondary heads here if needed */
+                 driver->name, driver->major, driver->minor, driver->patchlevel,
-        if ((ret = dev->driver->postinit(dev, ent->driver_data)))
+                 driver->date, dev->primary.minor);
-                goto err_g1;
        return 0;
@@ -318,10 +276,9 @@ int drm_put_head(drm_head_t * head)
        DRM_DEBUG("release secondary minor %d\n", minor);
        drm_proc_cleanup(minor, drm_proc_root, head->dev_root);
-        drm_sysfs_device_remove(MKDEV(DRM_MAJOR, head->minor));
+        drm_sysfs_device_remove(head->dev_class);
-        *head = (drm_head_t) {
+        *head = (drm_head_t) {.dev = NULL};
-        .dev = NULL};
        drm_heads[minor] = NULL;
diff --git a/drivers/char/drm/drm_sysfs.c b/drivers/char/drm/drm_sysfs.c
index 6d3449761914..68e43ddc16ae 100644
--- a/drivers/char/drm/drm_sysfs.c
+++ b/drivers/char/drm/drm_sysfs.c
@@ -15,8 +15,6 @@
 #include <linux/device.h>
 #include <linux/kdev_t.h>
 #include <linux/err.h>
-#include <linux/slab.h>
-#include <linux/string.h>
 #include "drm_core.h"
 #include "drmP.h"
@@ -28,15 +26,11 @@ struct drm_sysfs_class {
 #define to_drm_sysfs_class(d) container_of(d, struct drm_sysfs_class, class)
 struct simple_dev {
-        struct list_head node;
        dev_t dev;
        struct class_device class_dev;
 };
 #define to_simple_dev(d) container_of(d, struct simple_dev, class_dev)
-static LIST_HEAD(simple_dev_list);
-static DEFINE_SPINLOCK(simple_dev_list_lock);
 static void release_simple_dev(struct class_device *class_dev)
 {
        struct simple_dev *s_dev = to_simple_dev(class_dev);
@@ -124,6 +118,18 @@ void drm_sysfs_destroy(struct drm_sysfs_class *cs)
        class_unregister(&cs->class);
 }
+static ssize_t show_dri(struct class_device *class_device, char *buf)
+{
+        drm_device_t * dev = ((drm_head_t *)class_get_devdata(class_device))->dev;
+        if (dev->driver->dri_library_name)
+                return dev->driver->dri_library_name(dev, buf);
+        return snprintf(buf, PAGE_SIZE, "%s\n", dev->driver->pci_driver.name);
+}
+static struct class_device_attribute class_device_attrs[] = {
+        __ATTR(dri_library_name, S_IRUGO, show_dri, NULL),
+};
 /**
 * drm_sysfs_device_add - adds a class device to sysfs for a character driver
 * @cs: pointer to the struct drm_sysfs_class that this device should be registered to.
@@ -138,13 +144,11 @@ void drm_sysfs_destroy(struct drm_sysfs_class *cs)
 * Note: the struct drm_sysfs_class passed to this function must have previously been
 * created with a call to drm_sysfs_create().
 */
-struct class_device *drm_sysfs_device_add(struct drm_sysfs_class *cs, dev_t dev,
+struct class_device *drm_sysfs_device_add(struct drm_sysfs_class *cs,
-                                          struct device *device,
+                                          drm_head_t *head)
-                                          const char *fmt, ...)
 {
-        va_list args;
        struct simple_dev *s_dev = NULL;
-        int retval;
+        int i, retval;
        if ((cs == NULL) || (IS_ERR(cs))) {
                retval = -ENODEV;
@@ -158,26 +162,23 @@ struct class_device *drm_sysfs_device_add(struct drm_sysfs_class *cs, dev_t dev,
        }
        memset(s_dev, 0x00, sizeof(*s_dev));
-        s_dev->dev = dev;
+        s_dev->dev = MKDEV(DRM_MAJOR, head->minor);
-        s_dev->class_dev.dev = device;
+        s_dev->class_dev.dev = &(head->dev->pdev)->dev;
        s_dev->class_dev.class = &cs->class;
-        va_start(args, fmt);
+        snprintf(s_dev->class_dev.class_id, BUS_ID_SIZE, "card%d", head->minor);
-        vsnprintf(s_dev->class_dev.class_id, BUS_ID_SIZE, fmt, args);
-        va_end(args);
        retval = class_device_register(&s_dev->class_dev);
        if (retval)
                goto error;
        class_device_create_file(&s_dev->class_dev, &cs->attr);
+        class_set_devdata(&s_dev->class_dev, head);
-        spin_lock(&simple_dev_list_lock);
+        for (i = 0; i < ARRAY_SIZE(class_device_attrs); i++)
-        list_add(&s_dev->node, &simple_dev_list);
+                class_device_create_file(&s_dev->class_dev, &class_device_attrs[i]);
-        spin_unlock(&simple_dev_list_lock);
        return &s_dev->class_dev;
-      error:
+error:
        kfree(s_dev);
        return ERR_PTR(retval);
 }
@@ -189,23 +190,12 @@ struct class_device *drm_sysfs_device_add(struct drm_sysfs_class *cs, dev_t dev,
 * This call unregisters and cleans up a class device that was created with a
 * call to drm_sysfs_device_add()
 */
-void drm_sysfs_device_remove(dev_t dev)
+void drm_sysfs_device_remove(struct class_device *class_dev)
 {
-        struct simple_dev *s_dev = NULL;
+        struct simple_dev *s_dev = to_simple_dev(class_dev);
-        int found = 0;
+        int i;
-        spin_lock(&simple_dev_list_lock);
+        for (i = 0; i < ARRAY_SIZE(class_device_attrs); i++)
-        list_for_each_entry(s_dev, &simple_dev_list, node) {
+                class_device_remove_file(&s_dev->class_dev, &class_device_attrs[i]);
-                if (s_dev->dev == dev) {
+        class_device_unregister(&s_dev->class_dev);
-                        found = 1;
-                        break;
-                }
-        }
-        if (found) {
-                list_del(&s_dev->node);
-                spin_unlock(&simple_dev_list_lock);
-                class_device_unregister(&s_dev->class_dev);
-        } else {
-                spin_unlock(&simple_dev_list_lock);
-        }
 }
diff --git a/drivers/char/drm/i810_dma.c b/drivers/char/drm/i810_dma.c
index dba502373da1..cc1b89086876 100644
--- a/drivers/char/drm/i810_dma.c
+++ b/drivers/char/drm/i810_dma.c
@@ -114,7 +114,6 @@ static int i810_mmap_buffers(struct file *filp, struct vm_area_struct *vma)
 static struct file_operations i810_buffer_fops = {
        .open = drm_open,
-        .flush = drm_flush,
        .release = drm_release,
        .ioctl = drm_ioctl,
        .mmap = i810_mmap_buffers,
@@ -1319,12 +1318,24 @@ static int i810_flip_bufs(struct inode *inode, struct file *filp,
        return 0;
 }
-void i810_driver_pretakedown(drm_device_t * dev)
+int i810_driver_load(drm_device_t *dev, unsigned long flags)
+{
+        /* i810 has 4 more counters */
+        dev->counters += 4;
+        dev->types[6] = _DRM_STAT_IRQ;
+        dev->types[7] = _DRM_STAT_PRIMARY;
+        dev->types[8] = _DRM_STAT_SECONDARY;
+        dev->types[9] = _DRM_STAT_DMA;
+        return 0;
+}
+void i810_driver_lastclose(drm_device_t * dev)
 {
        i810_dma_cleanup(dev);
 }
-void i810_driver_prerelease(drm_device_t * dev, DRMFILE filp)
+void i810_driver_preclose(drm_device_t * dev, DRMFILE filp)
 {
        if (dev->dev_private) {
                drm_i810_private_t *dev_priv = dev->dev_private;
@@ -1334,7 +1345,7 @@ void i810_driver_prerelease(drm_device_t * dev, DRMFILE filp)
        }
 }
-void i810_driver_release(drm_device_t * dev, struct file *filp)
+void i810_driver_reclaim_buffers_locked(drm_device_t * dev, struct file *filp)
 {
        i810_reclaim_buffers(dev, filp);
 }
@@ -1346,21 +1357,21 @@ int i810_driver_dma_quiescent(drm_device_t * dev)
 }
 drm_ioctl_desc_t i810_ioctls[] = {
-        [DRM_IOCTL_NR(DRM_I810_INIT)] = {i810_dma_init, 1, 1},
+        [DRM_IOCTL_NR(DRM_I810_INIT)] = {i810_dma_init, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_I810_VERTEX)] = {i810_dma_vertex, 1, 0},
+        [DRM_IOCTL_NR(DRM_I810_VERTEX)] = {i810_dma_vertex, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I810_CLEAR)] = {i810_clear_bufs, 1, 0},
+        [DRM_IOCTL_NR(DRM_I810_CLEAR)] = {i810_clear_bufs, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I810_FLUSH)] = {i810_flush_ioctl, 1, 0},
+        [DRM_IOCTL_NR(DRM_I810_FLUSH)] = {i810_flush_ioctl, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I810_GETAGE)] = {i810_getage, 1, 0},
+        [DRM_IOCTL_NR(DRM_I810_GETAGE)] = {i810_getage, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I810_GETBUF)] = {i810_getbuf, 1, 0},
+        [DRM_IOCTL_NR(DRM_I810_GETBUF)] = {i810_getbuf, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I810_SWAP)] = {i810_swap_bufs, 1, 0},
+        [DRM_IOCTL_NR(DRM_I810_SWAP)] = {i810_swap_bufs, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I810_COPY)] = {i810_copybuf, 1, 0},
+        [DRM_IOCTL_NR(DRM_I810_COPY)] = {i810_copybuf, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I810_DOCOPY)] = {i810_docopy, 1, 0},
+        [DRM_IOCTL_NR(DRM_I810_DOCOPY)] = {i810_docopy, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I810_OV0INFO)] = {i810_ov0_info, 1, 0},
+        [DRM_IOCTL_NR(DRM_I810_OV0INFO)] = {i810_ov0_info, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I810_FSTATUS)] = {i810_fstatus, 1, 0},
+        [DRM_IOCTL_NR(DRM_I810_FSTATUS)] = {i810_fstatus, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I810_OV0FLIP)] = {i810_ov0_flip, 1, 0},
+        [DRM_IOCTL_NR(DRM_I810_OV0FLIP)] = {i810_ov0_flip, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I810_MC)] = {i810_dma_mc, 1, 1},
+        [DRM_IOCTL_NR(DRM_I810_MC)] = {i810_dma_mc, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_I810_RSTATUS)] = {i810_rstatus, 1, 0},
+        [DRM_IOCTL_NR(DRM_I810_RSTATUS)] = {i810_rstatus, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I810_FLIP)] = {i810_flip_bufs, 1, 0}
+        [DRM_IOCTL_NR(DRM_I810_FLIP)] = {i810_flip_bufs, DRM_AUTH}
 };
 int i810_max_ioctl = DRM_ARRAY_SIZE(i810_ioctls);
diff --git a/drivers/char/drm/i810_drv.c b/drivers/char/drm/i810_drv.c
index 070cef6c2b46..dfe6ad2b6a6e 100644
--- a/drivers/char/drm/i810_drv.c
+++ b/drivers/char/drm/i810_drv.c
@@ -38,38 +38,6 @@
 #include "drm_pciids.h"
-static int postinit(struct drm_device *dev, unsigned long flags)
-{
-        /* i810 has 4 more counters */
-        dev->counters += 4;
-        dev->types[6] = _DRM_STAT_IRQ;
-        dev->types[7] = _DRM_STAT_PRIMARY;
-        dev->types[8] = _DRM_STAT_SECONDARY;
-        dev->types[9] = _DRM_STAT_DMA;
-        DRM_INFO("Initialized %s %d.%d.%d %s on minor %d: %s\n",
-                 DRIVER_NAME,
-                 DRIVER_MAJOR,
-                 DRIVER_MINOR,
-                 DRIVER_PATCHLEVEL,
-                 DRIVER_DATE, dev->primary.minor, pci_pretty_name(dev->pdev)
-            );
-        return 0;
-}
-static int version(drm_version_t * version)
-{
-        int len;
-        version->version_major = DRIVER_MAJOR;
-        version->version_minor = DRIVER_MINOR;
-        version->version_patchlevel = DRIVER_PATCHLEVEL;
-        DRM_COPY(version->name, DRIVER_NAME);
-        DRM_COPY(version->date, DRIVER_DATE);
-        DRM_COPY(version->desc, DRIVER_DESC);
-        return 0;
-}
 static struct pci_device_id pciidlist[] = {
        i810_PCI_IDS
 };
@@ -79,16 +47,14 @@ static struct drm_driver driver = {
            DRIVER_USE_AGP | DRIVER_REQUIRE_AGP | DRIVER_USE_MTRR |
            DRIVER_HAVE_DMA | DRIVER_DMA_QUEUE,
        .dev_priv_size = sizeof(drm_i810_buf_priv_t),
-        .pretakedown = i810_driver_pretakedown,
+        .load = i810_driver_load,
-        .prerelease = i810_driver_prerelease,
+        .lastclose = i810_driver_lastclose,
+        .preclose = i810_driver_preclose,
        .device_is_agp = i810_driver_device_is_agp,
-        .release = i810_driver_release,
+        .reclaim_buffers_locked = i810_driver_reclaim_buffers_locked,
        .dma_quiescent = i810_driver_dma_quiescent,
-        .reclaim_buffers = i810_reclaim_buffers,
        .get_map_ofs = drm_core_get_map_ofs,
        .get_reg_ofs = drm_core_get_reg_ofs,
-        .postinit = postinit,
-        .version = version,
        .ioctls = i810_ioctls,
        .fops = {
                 .owner = THIS_MODULE,
@@ -98,13 +64,19 @@ static struct drm_driver driver = {
                 .mmap = drm_mmap,
                 .poll = drm_poll,
                 .fasync = drm_fasync,
-                 }
+        },
-        ,
        .pci_driver = {
-                       .name = DRIVER_NAME,
+                 .name = DRIVER_NAME,
-                       .id_table = pciidlist,
+                 .id_table = pciidlist,
-                       }
+        },
-        ,
+        .name = DRIVER_NAME,
+        .desc = DRIVER_DESC,
+        .date = DRIVER_DATE,
+        .major = DRIVER_MAJOR,
+        .minor = DRIVER_MINOR,
+        .patchlevel = DRIVER_PATCHLEVEL,
 };
 static int __init i810_init(void)
diff --git a/drivers/char/drm/i810_drv.h b/drivers/char/drm/i810_drv.h
index c78f36aaa2f0..a18b80d91920 100644
--- a/drivers/char/drm/i810_drv.h
+++ b/drivers/char/drm/i810_drv.h
@@ -116,9 +116,13 @@ typedef struct drm_i810_private {
 extern void i810_reclaim_buffers(drm_device_t * dev, struct file *filp);
 extern int i810_driver_dma_quiescent(drm_device_t * dev);
-extern void i810_driver_release(drm_device_t * dev, struct file *filp);
+extern void i810_driver_reclaim_buffers_locked(drm_device_t * dev,
-extern void i810_driver_pretakedown(drm_device_t * dev);
+                                               struct file *filp);
-extern void i810_driver_prerelease(drm_device_t * dev, DRMFILE filp);
+extern int i810_driver_load(struct drm_device *, unsigned long flags);
+extern void i810_driver_lastclose(drm_device_t * dev);
+extern void i810_driver_preclose(drm_device_t * dev, DRMFILE filp);
+extern void i810_driver_reclaim_buffers_locked(drm_device_t * dev,
+                                               struct file *filp);
 extern int i810_driver_device_is_agp(drm_device_t * dev);
 extern drm_ioctl_desc_t i810_ioctls[];
diff --git a/drivers/char/drm/i830_dma.c b/drivers/char/drm/i830_dma.c
index dc94f1914425..4fea32aed6d2 100644
--- a/drivers/char/drm/i830_dma.c
+++ b/drivers/char/drm/i830_dma.c
@@ -116,7 +116,6 @@ static int i830_mmap_buffers(struct file *filp, struct vm_area_struct *vma)
 static struct file_operations i830_buffer_fops = {
        .open = drm_open,
-        .flush = drm_flush,
        .release = drm_release,
        .ioctl = drm_ioctl,
        .mmap = i830_mmap_buffers,
@@ -1517,12 +1516,24 @@ static int i830_setparam(struct inode *inode, struct file *filp,
        return 0;
 }
-void i830_driver_pretakedown(drm_device_t * dev)
+int i830_driver_load(drm_device_t *dev, unsigned long flags)
+{
+        /* i830 has 4 more counters */
+        dev->counters += 4;
+        dev->types[6] = _DRM_STAT_IRQ;
+        dev->types[7] = _DRM_STAT_PRIMARY;
+        dev->types[8] = _DRM_STAT_SECONDARY;
+        dev->types[9] = _DRM_STAT_DMA;
+        return 0;
+}
+void i830_driver_lastclose(drm_device_t * dev)
 {
        i830_dma_cleanup(dev);
 }
-void i830_driver_prerelease(drm_device_t * dev, DRMFILE filp)
+void i830_driver_preclose(drm_device_t * dev, DRMFILE filp)
 {
        if (dev->dev_private) {
                drm_i830_private_t *dev_priv = dev->dev_private;
@@ -1532,7 +1543,7 @@ void i830_driver_prerelease(drm_device_t * dev, DRMFILE filp)
        }
 }
-void i830_driver_release(drm_device_t * dev, struct file *filp)
+void i830_driver_reclaim_buffers_locked(drm_device_t * dev, struct file *filp)
 {
        i830_reclaim_buffers(dev, filp);
 }
@@ -1544,20 +1555,20 @@ int i830_driver_dma_quiescent(drm_device_t * dev)
 }
 drm_ioctl_desc_t i830_ioctls[] = {
-        [DRM_IOCTL_NR(DRM_I830_INIT)] = {i830_dma_init, 1, 1},
+        [DRM_IOCTL_NR(DRM_I830_INIT)] = {i830_dma_init, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_I830_VERTEX)] = {i830_dma_vertex, 1, 0},
+        [DRM_IOCTL_NR(DRM_I830_VERTEX)] = {i830_dma_vertex, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I830_CLEAR)] = {i830_clear_bufs, 1, 0},
+        [DRM_IOCTL_NR(DRM_I830_CLEAR)] = {i830_clear_bufs, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I830_FLUSH)] = {i830_flush_ioctl, 1, 0},
+        [DRM_IOCTL_NR(DRM_I830_FLUSH)] = {i830_flush_ioctl, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I830_GETAGE)] = {i830_getage, 1, 0},
+        [DRM_IOCTL_NR(DRM_I830_GETAGE)] = {i830_getage, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I830_GETBUF)] = {i830_getbuf, 1, 0},
+        [DRM_IOCTL_NR(DRM_I830_GETBUF)] = {i830_getbuf, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I830_SWAP)] = {i830_swap_bufs, 1, 0},
+        [DRM_IOCTL_NR(DRM_I830_SWAP)] = {i830_swap_bufs, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I830_COPY)] = {i830_copybuf, 1, 0},
+        [DRM_IOCTL_NR(DRM_I830_COPY)] = {i830_copybuf, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I830_DOCOPY)] = {i830_docopy, 1, 0},
+        [DRM_IOCTL_NR(DRM_I830_DOCOPY)] = {i830_docopy, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I830_FLIP)] = {i830_flip_bufs, 1, 0},
+        [DRM_IOCTL_NR(DRM_I830_FLIP)] = {i830_flip_bufs, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I830_IRQ_EMIT)] = {i830_irq_emit, 1, 0},
+        [DRM_IOCTL_NR(DRM_I830_IRQ_EMIT)] = {i830_irq_emit, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I830_IRQ_WAIT)] = {i830_irq_wait, 1, 0},
+        [DRM_IOCTL_NR(DRM_I830_IRQ_WAIT)] = {i830_irq_wait, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I830_GETPARAM)] = {i830_getparam, 1, 0},
+        [DRM_IOCTL_NR(DRM_I830_GETPARAM)] = {i830_getparam, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I830_SETPARAM)] = {i830_setparam, 1, 0}
+        [DRM_IOCTL_NR(DRM_I830_SETPARAM)] = {i830_setparam, DRM_AUTH}
 };
 int i830_max_ioctl = DRM_ARRAY_SIZE(i830_ioctls);
diff --git a/drivers/char/drm/i830_drv.c b/drivers/char/drm/i830_drv.c
index acd821e8fe4d..722658188f5f 100644
--- a/drivers/char/drm/i830_drv.c
+++ b/drivers/char/drm/i830_drv.c
@@ -40,37 +40,6 @@
 #include "drm_pciids.h"
-static int postinit(struct drm_device *dev, unsigned long flags)
-{
-        dev->counters += 4;
-        dev->types[6] = _DRM_STAT_IRQ;
-        dev->types[7] = _DRM_STAT_PRIMARY;
-        dev->types[8] = _DRM_STAT_SECONDARY;
-        dev->types[9] = _DRM_STAT_DMA;
-        DRM_INFO("Initialized %s %d.%d.%d %s on minor %d: %s\n",
-                 DRIVER_NAME,
-                 DRIVER_MAJOR,
-                 DRIVER_MINOR,
-                 DRIVER_PATCHLEVEL,
-                 DRIVER_DATE, dev->primary.minor, pci_pretty_name(dev->pdev)
-            );
-        return 0;
-}
-static int version(drm_version_t * version)
-{
-        int len;
-        version->version_major = DRIVER_MAJOR;
-        version->version_minor = DRIVER_MINOR;
-        version->version_patchlevel = DRIVER_PATCHLEVEL;
-        DRM_COPY(version->name, DRIVER_NAME);
-        DRM_COPY(version->date, DRIVER_DATE);
-        DRM_COPY(version->desc, DRIVER_DESC);
-        return 0;
-}
 static struct pci_device_id pciidlist[] = {
        i830_PCI_IDS
 };
@@ -83,12 +52,12 @@ static struct drm_driver driver = {
        .driver_features |= DRIVER_HAVE_IRQ | DRIVER_SHARED_IRQ,
 #endif
        .dev_priv_size = sizeof(drm_i830_buf_priv_t),
-        .pretakedown = i830_driver_pretakedown,
+        .load = i830_driver_load,
-        .prerelease = i830_driver_prerelease,
+        .lastclose = i830_driver_lastclose,
+        .preclose = i830_driver_preclose,
        .device_is_agp = i830_driver_device_is_agp,
-        .release = i830_driver_release,
+        .reclaim_buffers_locked = i830_driver_reclaim_buffers_locked,
        .dma_quiescent = i830_driver_dma_quiescent,
-        .reclaim_buffers = i830_reclaim_buffers,
        .get_map_ofs = drm_core_get_map_ofs,
        .get_reg_ofs = drm_core_get_reg_ofs,
 #if USE_IRQS
@@ -97,8 +66,6 @@ static struct drm_driver driver = {
        .irq_uninstall = i830_driver_irq_uninstall,
        .irq_handler = i830_driver_irq_handler,
 #endif
-        .postinit = postinit,
-        .version = version,
        .ioctls = i830_ioctls,
        .fops = {
                 .owner = THIS_MODULE,
@@ -108,13 +75,19 @@ static struct drm_driver driver = {
                 .mmap = drm_mmap,
                 .poll = drm_poll,
                 .fasync = drm_fasync,
-                 }
+        },
-        ,
        .pci_driver = {
-                       .name = DRIVER_NAME,
+                 .name = DRIVER_NAME,
-                       .id_table = pciidlist,
+                 .id_table = pciidlist,
-                       }
+        },
+        .name = DRIVER_NAME,
+        .desc = DRIVER_DESC,
+        .date = DRIVER_DATE,
+        .major = DRIVER_MAJOR,
+        .minor = DRIVER_MINOR,
+        .patchlevel = DRIVER_PATCHLEVEL,
 };
 static int __init i830_init(void)
diff --git a/drivers/char/drm/i830_drv.h b/drivers/char/drm/i830_drv.h
index bc4bd49fb0cc..bf9075b576bd 100644
--- a/drivers/char/drm/i830_drv.h
+++ b/drivers/char/drm/i830_drv.h
@@ -136,10 +136,12 @@ extern irqreturn_t i830_driver_irq_handler(DRM_IRQ_ARGS);
 extern void i830_driver_irq_preinstall(drm_device_t * dev);
 extern void i830_driver_irq_postinstall(drm_device_t * dev);
 extern void i830_driver_irq_uninstall(drm_device_t * dev);
-extern void i830_driver_pretakedown(drm_device_t * dev);
+extern int i830_driver_load(struct drm_device *, unsigned long flags);
-extern void i830_driver_release(drm_device_t * dev, struct file *filp);
+extern void i830_driver_preclose(drm_device_t * dev, DRMFILE filp);
+extern void i830_driver_lastclose(drm_device_t * dev);
+extern void i830_driver_reclaim_buffers_locked(drm_device_t * dev,
+                                               struct file *filp);
 extern int i830_driver_dma_quiescent(drm_device_t * dev);
-extern void i830_driver_prerelease(drm_device_t * dev, DRMFILE filp);
 extern int i830_driver_device_is_agp(drm_device_t * dev);
 #define I830_READ(reg)          DRM_READ32(dev_priv->mmio_map, reg)
diff --git a/drivers/char/drm/i915_dma.c b/drivers/char/drm/i915_dma.c
index f3aa0c370127..9140703da1ba 100644
--- a/drivers/char/drm/i915_dma.c
+++ b/drivers/char/drm/i915_dma.c
@@ -1,7 +1,6 @@
 /* i915_dma.c -- DMA support for the I915 -*- linux-c -*-
 */
-/**************************************************************************
+/*
- *
 * Copyright 2003 Tungsten Graphics, Inc., Cedar Park, Texas.
 * All Rights Reserved.
 *
@@ -25,7 +24,7 @@
 * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 *
- **************************************************************************/
+ */
 #include "drmP.h"
 #include "drm.h"
@@ -196,7 +195,7 @@ static int i915_initialize(drm_device_t * dev,
        return 0;
 }
-static int i915_resume(drm_device_t * dev)
+static int i915_dma_resume(drm_device_t * dev)
 {
        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
@@ -253,7 +252,7 @@ static int i915_dma_init(DRM_IOCTL_ARGS)
                retcode = i915_dma_cleanup(dev);
                break;
        case I915_RESUME_DMA:
-                retcode = i915_resume(dev);
+                retcode = i915_dma_resume(dev);
                break;
        default:
                retcode = -EINVAL;
@@ -654,6 +653,9 @@ static int i915_getparam(DRM_IOCTL_ARGS)
        case I915_PARAM_ALLOW_BATCHBUFFER:
                value = dev_priv->allow_batchbuffer ? 1 : 0;
                break;
+        case I915_PARAM_LAST_DISPATCH:
+                value = READ_BREADCRUMB(dev_priv);
+                break;
        default:
                DRM_ERROR("Unkown parameter %d\n", param.param);
                return DRM_ERR(EINVAL);
@@ -699,7 +701,19 @@ static int i915_setparam(DRM_IOCTL_ARGS)
        return 0;
 }
-void i915_driver_pretakedown(drm_device_t * dev)
+int i915_driver_load(drm_device_t *dev, unsigned long flags)
+{
+        /* i915 has 4 more counters */
+        dev->counters += 4;
+        dev->types[6] = _DRM_STAT_IRQ;
+        dev->types[7] = _DRM_STAT_PRIMARY;
+        dev->types[8] = _DRM_STAT_SECONDARY;
+        dev->types[9] = _DRM_STAT_DMA;
+        return 0;
+}
+void i915_driver_lastclose(drm_device_t * dev)
 {
        if (dev->dev_private) {
                drm_i915_private_t *dev_priv = dev->dev_private;
@@ -708,7 +722,7 @@ void i915_driver_pretakedown(drm_device_t * dev)
        i915_dma_cleanup(dev);
 }
-void i915_driver_prerelease(drm_device_t * dev, DRMFILE filp)
+void i915_driver_preclose(drm_device_t * dev, DRMFILE filp)
 {
        if (dev->dev_private) {
                drm_i915_private_t *dev_priv = dev->dev_private;
@@ -717,18 +731,18 @@ void i915_driver_prerelease(drm_device_t * dev, DRMFILE filp)
 }
 drm_ioctl_desc_t i915_ioctls[] = {
-        [DRM_IOCTL_NR(DRM_I915_INIT)] = {i915_dma_init, 1, 1},
+        [DRM_IOCTL_NR(DRM_I915_INIT)] = {i915_dma_init, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_I915_FLUSH)] = {i915_flush_ioctl, 1, 0},
+        [DRM_IOCTL_NR(DRM_I915_FLUSH)] = {i915_flush_ioctl, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I915_FLIP)] = {i915_flip_bufs, 1, 0},
+        [DRM_IOCTL_NR(DRM_I915_FLIP)] = {i915_flip_bufs, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I915_BATCHBUFFER)] = {i915_batchbuffer, 1, 0},
+        [DRM_IOCTL_NR(DRM_I915_BATCHBUFFER)] = {i915_batchbuffer, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I915_IRQ_EMIT)] = {i915_irq_emit, 1, 0},
+        [DRM_IOCTL_NR(DRM_I915_IRQ_EMIT)] = {i915_irq_emit, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I915_IRQ_WAIT)] = {i915_irq_wait, 1, 0},
+        [DRM_IOCTL_NR(DRM_I915_IRQ_WAIT)] = {i915_irq_wait, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I915_GETPARAM)] = {i915_getparam, 1, 0},
+        [DRM_IOCTL_NR(DRM_I915_GETPARAM)] = {i915_getparam, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I915_SETPARAM)] = {i915_setparam, 1, 1},
+        [DRM_IOCTL_NR(DRM_I915_SETPARAM)] = {i915_setparam, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_I915_ALLOC)] = {i915_mem_alloc, 1, 0},
+        [DRM_IOCTL_NR(DRM_I915_ALLOC)] = {i915_mem_alloc, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I915_FREE)] = {i915_mem_free, 1, 0},
+        [DRM_IOCTL_NR(DRM_I915_FREE)] = {i915_mem_free, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_I915_INIT_HEAP)] = {i915_mem_init_heap, 1, 1},
+        [DRM_IOCTL_NR(DRM_I915_INIT_HEAP)] = {i915_mem_init_heap, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_I915_CMDBUFFER)] = {i915_cmdbuffer, 1, 0}
+        [DRM_IOCTL_NR(DRM_I915_CMDBUFFER)] = {i915_cmdbuffer, DRM_AUTH}
 };
 int i915_max_ioctl = DRM_ARRAY_SIZE(i915_ioctls);
diff --git a/drivers/char/drm/i915_drm.h b/drivers/char/drm/i915_drm.h
index 23e027d29080..77412ddac007 100644
--- a/drivers/char/drm/i915_drm.h
+++ b/drivers/char/drm/i915_drm.h
@@ -1,5 +1,4 @@
-/**************************************************************************
+/*
- *
 * Copyright 2003 Tungsten Graphics, Inc., Cedar Park, Texas.
 * All Rights Reserved.
 *
@@ -23,7 +22,7 @@
 * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 *
- **************************************************************************/
+ */
 #ifndef _I915_DRM_H_
 #define _I915_DRM_H_
@@ -152,6 +151,7 @@ typedef struct drm_i915_irq_wait {
 */
 #define I915_PARAM_IRQ_ACTIVE            1
 #define I915_PARAM_ALLOW_BATCHBUFFER     2
+#define I915_PARAM_LAST_DISPATCH         3
 typedef struct drm_i915_getparam {
        int param;
diff --git a/drivers/char/drm/i915_drv.c b/drivers/char/drm/i915_drv.c
index 0508240f4e3b..8e2e6095c4b3 100644
--- a/drivers/char/drm/i915_drv.c
+++ b/drivers/char/drm/i915_drv.c
@@ -1,6 +1,6 @@
 /* i915_drv.c -- i830,i845,i855,i865,i915 driver -*- linux-c -*-
 */
-/**************************************************************************
+/*
 *
 * Copyright 2003 Tungsten Graphics, Inc., Cedar Park, Texas.
 * All Rights Reserved.
@@ -25,7 +25,7 @@
 * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 *
- **************************************************************************/
+ */
 #include "drmP.h"
 #include "drm.h"
@@ -34,48 +34,22 @@
 #include "drm_pciids.h"
-static int postinit(struct drm_device *dev, unsigned long flags)
-{
-        dev->counters += 4;
-        dev->types[6] = _DRM_STAT_IRQ;
-        dev->types[7] = _DRM_STAT_PRIMARY;
-        dev->types[8] = _DRM_STAT_SECONDARY;
-        dev->types[9] = _DRM_STAT_DMA;
-        DRM_INFO("Initialized %s %d.%d.%d %s on minor %d: %s\n",
-                 DRIVER_NAME,
-                 DRIVER_MAJOR,
-                 DRIVER_MINOR,
-                 DRIVER_PATCHLEVEL,
-                 DRIVER_DATE, dev->primary.minor, pci_pretty_name(dev->pdev)
-            );
-        return 0;
-}
-static int version(drm_version_t * version)
-{
-        int len;
-        version->version_major = DRIVER_MAJOR;
-        version->version_minor = DRIVER_MINOR;
-        version->version_patchlevel = DRIVER_PATCHLEVEL;
-        DRM_COPY(version->name, DRIVER_NAME);
-        DRM_COPY(version->date, DRIVER_DATE);
-        DRM_COPY(version->desc, DRIVER_DESC);
-        return 0;
-}
 static struct pci_device_id pciidlist[] = {
        i915_PCI_IDS
 };
 static struct drm_driver driver = {
+        /* don't use mtrr's here, the Xserver or user space app should
+         * deal with them for intel hardware.
+         */
        .driver_features =
-            DRIVER_USE_AGP | DRIVER_REQUIRE_AGP | DRIVER_USE_MTRR |
+            DRIVER_USE_AGP | DRIVER_REQUIRE_AGP | /* DRIVER_USE_MTRR |*/
-            DRIVER_HAVE_IRQ | DRIVER_IRQ_SHARED,
+            DRIVER_HAVE_IRQ | DRIVER_IRQ_SHARED | DRIVER_IRQ_VBL,
-        .pretakedown = i915_driver_pretakedown,
+        .load = i915_driver_load,
-        .prerelease = i915_driver_prerelease,
+        .lastclose = i915_driver_lastclose,
+        .preclose = i915_driver_preclose,
        .device_is_agp = i915_driver_device_is_agp,
+        .vblank_wait = i915_driver_vblank_wait,
        .irq_preinstall = i915_driver_irq_preinstall,
        .irq_postinstall = i915_driver_irq_postinstall,
        .irq_uninstall = i915_driver_irq_uninstall,
@@ -83,8 +57,6 @@ static struct drm_driver driver = {
        .reclaim_buffers = drm_core_reclaim_buffers,
        .get_map_ofs = drm_core_get_map_ofs,
        .get_reg_ofs = drm_core_get_reg_ofs,
-        .postinit = postinit,
-        .version = version,
        .ioctls = i915_ioctls,
        .fops = {
                 .owner = THIS_MODULE,
@@ -97,11 +69,19 @@ static struct drm_driver driver = {
 #ifdef CONFIG_COMPAT
                 .compat_ioctl = i915_compat_ioctl,
 #endif
-                 },
+        },
        .pci_driver = {
-                       .name = DRIVER_NAME,
+                 .name = DRIVER_NAME,
-                       .id_table = pciidlist,
+                 .id_table = pciidlist,
-                       }
+        },
+        
+        .name = DRIVER_NAME,
+        .desc = DRIVER_DESC,
+        .date = DRIVER_DATE,
+        .major = DRIVER_MAJOR,
+        .minor = DRIVER_MINOR,
+        .patchlevel = DRIVER_PATCHLEVEL,
 };
 static int __init i915_init(void)
diff --git a/drivers/char/drm/i915_drv.h b/drivers/char/drm/i915_drv.h
index 17e457c73dc7..c6c71b45f101 100644
--- a/drivers/char/drm/i915_drv.h
+++ b/drivers/char/drm/i915_drv.h
@@ -1,6 +1,6 @@
 /* i915_drv.h -- Private header for the I915 driver -*- linux-c -*-
 */
-/**************************************************************************
+/*
 *
 * Copyright 2003 Tungsten Graphics, Inc., Cedar Park, Texas.
 * All Rights Reserved.
@@ -25,7 +25,7 @@
 * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 *
- **************************************************************************/
+ */
 #ifndef _I915_DRV_H_
 #define _I915_DRV_H_
@@ -37,21 +37,18 @@
 #define DRIVER_NAME             "i915"
 #define DRIVER_DESC             "Intel Graphics"
-#define DRIVER_DATE             "20040405"
+#define DRIVER_DATE             "20051209"
 /* Interface history:
 *
 * 1.1: Original.
+ * 1.2: Add Power Management
+ * 1.3: Add vblank support
 */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            1
+#define DRIVER_MINOR            3
 #define DRIVER_PATCHLEVEL       0
-/* We use our own dma mechanisms, not the drm template code.  However,
- * the shared IRQ code is useful to us:
- */
-#define __HAVE_PM               1
 typedef struct _drm_i915_ring_buffer {
        int tail_mask;
        unsigned long Start;
@@ -97,6 +94,7 @@ typedef struct drm_i915_private {
        int tex_lru_log_granularity;
        int allow_batchbuffer;
        struct mem_block *agp_heap;
+        unsigned int sr01, adpa, ppcr, dvob, dvoc, lvds;
 } drm_i915_private_t;
 extern drm_ioctl_desc_t i915_ioctls[];
@@ -104,14 +102,18 @@ extern int i915_max_ioctl;
                                /* i915_dma.c */
 extern void i915_kernel_lost_context(drm_device_t * dev);
-extern void i915_driver_pretakedown(drm_device_t * dev);
+extern int i915_driver_load(struct drm_device *, unsigned long flags);
-extern void i915_driver_prerelease(drm_device_t * dev, DRMFILE filp);
+extern void i915_driver_lastclose(drm_device_t * dev);
+extern void i915_driver_preclose(drm_device_t * dev, DRMFILE filp);
 extern int i915_driver_device_is_agp(drm_device_t * dev);
+extern long i915_compat_ioctl(struct file *filp, unsigned int cmd,
+                              unsigned long arg);
 /* i915_irq.c */
 extern int i915_irq_emit(DRM_IOCTL_ARGS);
 extern int i915_irq_wait(DRM_IOCTL_ARGS);
+extern int i915_driver_vblank_wait(drm_device_t *dev, unsigned int *sequence);
 extern irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS);
 extern void i915_driver_irq_preinstall(drm_device_t * dev);
 extern void i915_driver_irq_postinstall(drm_device_t * dev);
@@ -125,13 +127,10 @@ extern void i915_mem_takedown(struct mem_block **heap);
 extern void i915_mem_release(drm_device_t * dev,
                             DRMFILE filp, struct mem_block *heap);
-extern long i915_compat_ioctl(struct file *filp, unsigned int cmd,
+#define I915_READ(reg)          DRM_READ32(dev_priv->mmio_map, (reg))
-                              unsigned long arg);
+#define I915_WRITE(reg,val)     DRM_WRITE32(dev_priv->mmio_map, (reg), (val))
+#define I915_READ16(reg)        DRM_READ16(dev_priv->mmio_map, (reg))
-#define I915_READ(reg)          DRM_READ32(dev_priv->mmio_map, reg)
+#define I915_WRITE16(reg,val)   DRM_WRITE16(dev_priv->mmio_map, (reg), (val))
-#define I915_WRITE(reg,val)     DRM_WRITE32(dev_priv->mmio_map, reg, val)
-#define I915_READ16(reg)        DRM_READ16(dev_priv->mmio_map, reg)
-#define I915_WRITE16(reg,val)   DRM_WRITE16(dev_priv->mmio_map, reg, val)
 #define I915_VERBOSE 0
@@ -195,6 +194,13 @@ extern int i915_wait_ring(drm_device_t * dev, int n, const char *caller);
 #define PPCR                    0x61204
 #define PPCR_ON                 (1<<0)
+#define DVOB                    0x61140
+#define DVOB_ON                 (1<<31)
+#define DVOC                    0x61160
+#define DVOC_ON                 (1<<31)
+#define LVDS                    0x61180
+#define LVDS_ON                 (1<<31)
 #define ADPA                    0x61100
 #define ADPA_DPMS_MASK          (~(3<<10))
 #define ADPA_DPMS_ON            (0<<10)
@@ -258,4 +264,6 @@ extern int i915_wait_ring(drm_device_t * dev, int n, const char *caller);
 #define CMD_OP_DESTBUFFER_INFO   ((0x3<<29)|(0x1d<<24)|(0x8e<<16)|1)
+#define READ_BREADCRUMB(dev_priv) (((u32 *)(dev_priv->hw_status_page))[5])
 #endif
diff --git a/drivers/char/drm/i915_irq.c b/drivers/char/drm/i915_irq.c
index 4fa448ee846b..a1381c61aa63 100644
--- a/drivers/char/drm/i915_irq.c
+++ b/drivers/char/drm/i915_irq.c
@@ -1,7 +1,6 @@
-/* i915_dma.c -- DMA support for the I915 -*- linux-c -*-
+/* i915_irq.c -- IRQ support for the I915 -*- linux-c -*-
 */
-/**************************************************************************
+/*
- *
 * Copyright 2003 Tungsten Graphics, Inc., Cedar Park, Texas.
 * All Rights Reserved.
 *
@@ -25,16 +24,18 @@
 * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 *
- **************************************************************************/
+ */
 #include "drmP.h"
 #include "drm.h"
 #include "i915_drm.h"
 #include "i915_drv.h"
-#define USER_INT_FLAG 0x2
+#define USER_INT_FLAG (1<<1)
+#define VSYNC_PIPEB_FLAG (1<<5)
+#define VSYNC_PIPEA_FLAG (1<<7)
 #define MAX_NOPID ((u32)~0)
-#define READ_BREADCRUMB(dev_priv)  (((u32*)(dev_priv->hw_status_page))[5])
 irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
 {
@@ -43,7 +44,7 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
        u16 temp;
        temp = I915_READ16(I915REG_INT_IDENTITY_R);
-        temp &= USER_INT_FLAG;
+        temp &= (USER_INT_FLAG | VSYNC_PIPEA_FLAG);
        DRM_DEBUG("%s flag=%08x\n", __FUNCTION__, temp);
@@ -51,7 +52,15 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
                return IRQ_NONE;
        I915_WRITE16(I915REG_INT_IDENTITY_R, temp);
-        DRM_WAKEUP(&dev_priv->irq_queue);
+        if (temp & USER_INT_FLAG)
+                DRM_WAKEUP(&dev_priv->irq_queue);
+        if (temp & VSYNC_PIPEA_FLAG) {
+                atomic_inc(&dev->vbl_received);
+                DRM_WAKEUP(&dev->vbl_queue);
+                drm_vbl_send_signals(dev);
+        }
        return IRQ_HANDLED;
 }
@@ -102,6 +111,27 @@ static int i915_wait_irq(drm_device_t * dev, int irq_nr)
        return ret;
 }
+int i915_driver_vblank_wait(drm_device_t *dev, unsigned int *sequence)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        unsigned int cur_vblank;
+        int ret = 0;
+        if (!dev_priv) {
+                DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
+                return DRM_ERR(EINVAL);
+        }
+        DRM_WAIT_ON(ret, dev->vbl_queue, 3 * DRM_HZ,
+                    (((cur_vblank = atomic_read(&dev->vbl_received))
+                        - *sequence) <= (1<<23)));
+        
+        *sequence = cur_vblank;
+        return ret;
+}
 /* Needs the lock as it touches the ring.
 */
 int i915_irq_emit(DRM_IOCTL_ARGS)
@@ -165,7 +195,7 @@ void i915_driver_irq_postinstall(drm_device_t * dev)
 {
        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
-        I915_WRITE16(I915REG_INT_ENABLE_R, USER_INT_FLAG);
+        I915_WRITE16(I915REG_INT_ENABLE_R, USER_INT_FLAG | VSYNC_PIPEA_FLAG);
        DRM_INIT_WAITQUEUE(&dev_priv->irq_queue);
 }
diff --git a/drivers/char/drm/i915_mem.c b/drivers/char/drm/i915_mem.c
index 13176d136a99..ba87ff17ff64 100644
--- a/drivers/char/drm/i915_mem.c
+++ b/drivers/char/drm/i915_mem.c
@@ -1,7 +1,6 @@
 /* i915_mem.c -- Simple agp/fb memory manager for i915 -*- linux-c -*-
 */
-/**************************************************************************
+/*
- *
 * Copyright 2003 Tungsten Graphics, Inc., Cedar Park, Texas.
 * All Rights Reserved.
 *
@@ -25,7 +24,7 @@
 * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 *
- **************************************************************************/
+ */
 #include "drmP.h"
 #include "drm.h"
diff --git a/drivers/char/drm/mga_dma.c b/drivers/char/drm/mga_dma.c
index 70dc7f64b7b9..c2a4bac14521 100644
--- a/drivers/char/drm/mga_dma.c
+++ b/drivers/char/drm/mga_dma.c
@@ -44,7 +44,9 @@
 #define MGA_DEFAULT_USEC_TIMEOUT        10000
 #define MGA_FREELIST_DEBUG              0
-static int mga_do_cleanup_dma(drm_device_t * dev);
+#define MINIMAL_CLEANUP 0
+#define FULL_CLEANUP 1
+static int mga_do_cleanup_dma(drm_device_t *dev, int full_cleanup);
 /* ================================================================
 * Engine control
@@ -391,7 +393,7 @@ int mga_freelist_put(drm_device_t * dev, drm_buf_t * buf)
 * DMA initialization, cleanup
 */
-int mga_driver_preinit(drm_device_t * dev, unsigned long flags)
+int mga_driver_load(drm_device_t * dev, unsigned long flags)
 {
        drm_mga_private_t *dev_priv;
@@ -405,6 +407,14 @@ int mga_driver_preinit(drm_device_t * dev, unsigned long flags)
        dev_priv->usec_timeout = MGA_DEFAULT_USEC_TIMEOUT;
        dev_priv->chipset = flags;
+        dev_priv->mmio_base = drm_get_resource_start(dev, 1);
+        dev_priv->mmio_size = drm_get_resource_len(dev, 1);
+        dev->counters += 3;
+        dev->types[6] = _DRM_STAT_IRQ;
+        dev->types[7] = _DRM_STAT_PRIMARY;
+        dev->types[8] = _DRM_STAT_SECONDARY;
        return 0;
 }
@@ -438,17 +448,19 @@ static int mga_do_agp_dma_bootstrap(drm_device_t * dev,
        drm_buf_desc_t req;
        drm_agp_mode_t mode;
        drm_agp_info_t info;
+        drm_agp_buffer_t agp_req;
+        drm_agp_binding_t bind_req;
        /* Acquire AGP. */
        err = drm_agp_acquire(dev);
        if (err) {
-                DRM_ERROR("Unable to acquire AGP\n");
+                DRM_ERROR("Unable to acquire AGP: %d\n", err);
                return err;
        }
        err = drm_agp_info(dev, &info);
        if (err) {
-                DRM_ERROR("Unable to get AGP info\n");
+                DRM_ERROR("Unable to get AGP info: %d\n", err);
                return err;
        }
@@ -472,18 +484,24 @@ static int mga_do_agp_dma_bootstrap(drm_device_t * dev,
        }
        /* Allocate and bind AGP memory. */
-        dev_priv->agp_pages = agp_size / PAGE_SIZE;
+        agp_req.size = agp_size;
-        dev_priv->agp_mem = drm_alloc_agp(dev, dev_priv->agp_pages, 0);
+        agp_req.type = 0;
-        if (dev_priv->agp_mem == NULL) {
+        err = drm_agp_alloc(dev, &agp_req);
-                dev_priv->agp_pages = 0;
+        if (err) {
+                dev_priv->agp_size = 0;
                DRM_ERROR("Unable to allocate %uMB AGP memory\n",
                          dma_bs->agp_size);
-                return DRM_ERR(ENOMEM);
+                return err;
        }
+        
+        dev_priv->agp_size = agp_size;
+        dev_priv->agp_handle = agp_req.handle;
-        err = drm_bind_agp(dev_priv->agp_mem, 0);
+        bind_req.handle = agp_req.handle;
+        bind_req.offset = 0;
+        err = drm_agp_bind(dev, &bind_req);
        if (err) {
-                DRM_ERROR("Unable to bind AGP memory\n");
+                DRM_ERROR("Unable to bind AGP memory: %d\n", err);
                return err;
        }
@@ -497,7 +515,7 @@ static int mga_do_agp_dma_bootstrap(drm_device_t * dev,
        err = drm_addmap(dev, offset, warp_size,
                         _DRM_AGP, _DRM_READ_ONLY, &dev_priv->warp);
        if (err) {
-                DRM_ERROR("Unable to map WARP microcode\n");
+                DRM_ERROR("Unable to map WARP microcode: %d\n", err);
                return err;
        }
@@ -505,7 +523,7 @@ static int mga_do_agp_dma_bootstrap(drm_device_t * dev,
        err = drm_addmap(dev, offset, dma_bs->primary_size,
                         _DRM_AGP, _DRM_READ_ONLY, &dev_priv->primary);
        if (err) {
-                DRM_ERROR("Unable to map primary DMA region\n");
+                DRM_ERROR("Unable to map primary DMA region: %d\n", err);
                return err;
        }
@@ -513,7 +531,7 @@ static int mga_do_agp_dma_bootstrap(drm_device_t * dev,
        err = drm_addmap(dev, offset, secondary_size,
                         _DRM_AGP, 0, &dev->agp_buffer_map);
        if (err) {
-                DRM_ERROR("Unable to map secondary DMA region\n");
+                DRM_ERROR("Unable to map secondary DMA region: %d\n", err);
                return err;
        }
@@ -525,15 +543,29 @@ static int mga_do_agp_dma_bootstrap(drm_device_t * dev,
        err = drm_addbufs_agp(dev, &req);
        if (err) {
-                DRM_ERROR("Unable to add secondary DMA buffers\n");
+                DRM_ERROR("Unable to add secondary DMA buffers: %d\n", err);
                return err;
        }
+        {
+                drm_map_list_t *_entry;
+                unsigned long agp_token = 0;
+                
+                list_for_each_entry(_entry, &dev->maplist->head, head) {
+                        if (_entry->map == dev->agp_buffer_map)
+                                agp_token = _entry->user_token;
+                }
+                if (!agp_token)
+                        return -EFAULT;
+                dev->agp_buffer_token = agp_token;
+        }
        offset += secondary_size;
        err = drm_addmap(dev, offset, agp_size - offset,
                         _DRM_AGP, 0, &dev_priv->agp_textures);
        if (err) {
-                DRM_ERROR("Unable to map AGP texture region\n");
+                DRM_ERROR("Unable to map AGP texture region %d\n", err);
                return err;
        }
@@ -603,7 +635,8 @@ static int mga_do_pci_dma_bootstrap(drm_device_t * dev,
        err = drm_addmap(dev, 0, warp_size, _DRM_CONSISTENT,
                         _DRM_READ_ONLY, &dev_priv->warp);
        if (err != 0) {
-                DRM_ERROR("Unable to create mapping for WARP microcode\n");
+                DRM_ERROR("Unable to create mapping for WARP microcode: %d\n",
+                          err);
                return err;
        }
@@ -622,7 +655,7 @@ static int mga_do_pci_dma_bootstrap(drm_device_t * dev,
        }
        if (err != 0) {
-                DRM_ERROR("Unable to allocate primary DMA region\n");
+                DRM_ERROR("Unable to allocate primary DMA region: %d\n", err);
                return DRM_ERR(ENOMEM);
        }
@@ -646,7 +679,7 @@ static int mga_do_pci_dma_bootstrap(drm_device_t * dev,
        }
        if (bin_count == 0) {
-                DRM_ERROR("Unable to add secondary DMA buffers\n");
+                DRM_ERROR("Unable to add secondary DMA buffers: %d\n", err);
                return err;
        }
@@ -682,7 +715,7 @@ static int mga_do_dma_bootstrap(drm_device_t * dev,
        err = drm_addmap(dev, dev_priv->mmio_base, dev_priv->mmio_size,
                         _DRM_REGISTERS, _DRM_READ_ONLY, &dev_priv->mmio);
        if (err) {
-                DRM_ERROR("Unable to map MMIO region\n");
+                DRM_ERROR("Unable to map MMIO region: %d\n", err);
                return err;
        }
@@ -690,7 +723,7 @@ static int mga_do_dma_bootstrap(drm_device_t * dev,
                         _DRM_READ_ONLY | _DRM_LOCKED | _DRM_KERNEL,
                         &dev_priv->status);
        if (err) {
-                DRM_ERROR("Unable to map status region\n");
+                DRM_ERROR("Unable to map status region: %d\n", err);
                return err;
        }
@@ -708,7 +741,7 @@ static int mga_do_dma_bootstrap(drm_device_t * dev,
         */
        if (err) {
-                mga_do_cleanup_dma(dev);
+                mga_do_cleanup_dma(dev, MINIMAL_CLEANUP);
        }
        /* Not only do we want to try and initialized PCI cards for PCI DMA,
@@ -731,35 +764,32 @@ int mga_dma_bootstrap(DRM_IOCTL_ARGS)
        DRM_DEVICE;
        drm_mga_dma_bootstrap_t bootstrap;
        int err;
+        static const int modes[] = { 0, 1, 2, 2, 4, 4, 4, 4 };
+        const drm_mga_private_t *const dev_priv =
+                (drm_mga_private_t *) dev->dev_private;
        DRM_COPY_FROM_USER_IOCTL(bootstrap,
                                 (drm_mga_dma_bootstrap_t __user *) data,
                                 sizeof(bootstrap));
        err = mga_do_dma_bootstrap(dev, &bootstrap);
-        if (!err) {
+        if (err) {
-                static const int modes[] = { 0, 1, 2, 2, 4, 4, 4, 4 };
+                mga_do_cleanup_dma(dev, FULL_CLEANUP);
-                const drm_mga_private_t *const dev_priv =
+                return err;
-                    (drm_mga_private_t *) dev->dev_private;
+        }
-                if (dev_priv->agp_textures != NULL) {
-                        bootstrap.texture_handle =
-                            dev_priv->agp_textures->offset;
-                        bootstrap.texture_size = dev_priv->agp_textures->size;
-                } else {
-                        bootstrap.texture_handle = 0;
-                        bootstrap.texture_size = 0;
-                }
-                bootstrap.agp_mode = modes[bootstrap.agp_mode & 0x07];
+        if (dev_priv->agp_textures != NULL) {
-                if (DRM_COPY_TO_USER((void __user *)data, &bootstrap,
+                bootstrap.texture_handle = dev_priv->agp_textures->offset;
-                                     sizeof(bootstrap))) {
+                bootstrap.texture_size = dev_priv->agp_textures->size;
-                        err = DRM_ERR(EFAULT);
-                }
        } else {
-                mga_do_cleanup_dma(dev);
+                bootstrap.texture_handle = 0;
+                bootstrap.texture_size = 0;
        }
+        bootstrap.agp_mode = modes[bootstrap.agp_mode & 0x07];
+        DRM_COPY_TO_USER_IOCTL((drm_mga_dma_bootstrap_t __user *)data,
+                               bootstrap, sizeof(bootstrap));
        return err;
 }
@@ -853,13 +883,13 @@ static int mga_do_init_dma(drm_device_t * dev, drm_mga_init_t * init)
        ret = mga_warp_install_microcode(dev_priv);
        if (ret < 0) {
-                DRM_ERROR("failed to install WARP ucode!\n");
+                DRM_ERROR("failed to install WARP ucode!: %d\n", ret);
                return ret;
        }
        ret = mga_warp_init(dev_priv);
        if (ret < 0) {
-                DRM_ERROR("failed to init WARP engine!\n");
+                DRM_ERROR("failed to init WARP engine!: %d\n", ret);
                return ret;
        }
@@ -904,7 +934,7 @@ static int mga_do_init_dma(drm_device_t * dev, drm_mga_init_t * init)
        return 0;
 }
-static int mga_do_cleanup_dma(drm_device_t * dev)
+static int mga_do_cleanup_dma(drm_device_t *dev, int full_cleanup)
 {
        int err = 0;
        DRM_DEBUG("\n");
@@ -932,31 +962,39 @@ static int mga_do_cleanup_dma(drm_device_t * dev)
                if (dev_priv->used_new_dma_init) {
 #if __OS_HAS_AGP
-                        if (dev_priv->agp_mem != NULL) {
+                        if (dev_priv->agp_handle != 0) {
-                                dev_priv->agp_textures = NULL;
+                                drm_agp_binding_t unbind_req;
-                                drm_unbind_agp(dev_priv->agp_mem);
+                                drm_agp_buffer_t free_req;
+                                unbind_req.handle = dev_priv->agp_handle;
+                                drm_agp_unbind(dev, &unbind_req);
-                                drm_free_agp(dev_priv->agp_mem,
+                                free_req.handle = dev_priv->agp_handle;
-                                             dev_priv->agp_pages);
+                                drm_agp_free(dev, &free_req);
-                                dev_priv->agp_pages = 0;
+        
-                                dev_priv->agp_mem = NULL;
+                                dev_priv->agp_textures = NULL;
+                                dev_priv->agp_size = 0;
+                                dev_priv->agp_handle = 0;
                        }
                        if ((dev->agp != NULL) && dev->agp->acquired) {
                                err = drm_agp_release(dev);
                        }
 #endif
-                        dev_priv->used_new_dma_init = 0;
                }
                dev_priv->warp = NULL;
                dev_priv->primary = NULL;
-                dev_priv->mmio = NULL;
-                dev_priv->status = NULL;
                dev_priv->sarea = NULL;
                dev_priv->sarea_priv = NULL;
                dev->agp_buffer_map = NULL;
+                if (full_cleanup) {
+                        dev_priv->mmio = NULL;
+                        dev_priv->status = NULL;
+                        dev_priv->used_new_dma_init = 0;
+                }
                memset(&dev_priv->prim, 0, sizeof(dev_priv->prim));
                dev_priv->warp_pipe = 0;
                memset(dev_priv->warp_pipe_phys, 0,
@@ -967,7 +1005,7 @@ static int mga_do_cleanup_dma(drm_device_t * dev)
                }
        }
-        return err;
+        return 0;
 }
 int mga_dma_init(DRM_IOCTL_ARGS)
@@ -985,11 +1023,11 @@ int mga_dma_init(DRM_IOCTL_ARGS)
        case MGA_INIT_DMA:
                err = mga_do_init_dma(dev, &init);
                if (err) {
-                        (void)mga_do_cleanup_dma(dev);
+                        (void)mga_do_cleanup_dma(dev, FULL_CLEANUP);
                }
                return err;
        case MGA_CLEANUP_DMA:
-                return mga_do_cleanup_dma(dev);
+                return mga_do_cleanup_dma(dev, FULL_CLEANUP);
        }
        return DRM_ERR(EINVAL);
@@ -1118,7 +1156,7 @@ int mga_dma_buffers(DRM_IOCTL_ARGS)
 /**
 * Called just before the module is unloaded.
 */
-int mga_driver_postcleanup(drm_device_t * dev)
+int mga_driver_unload(drm_device_t * dev)
 {
        drm_free(dev->dev_private, sizeof(drm_mga_private_t), DRM_MEM_DRIVER);
        dev->dev_private = NULL;
@@ -1129,9 +1167,9 @@ int mga_driver_postcleanup(drm_device_t * dev)
 /**
 * Called when the last opener of the device is closed.
 */
-void mga_driver_pretakedown(drm_device_t * dev)
+void mga_driver_lastclose(drm_device_t * dev)
 {
-        mga_do_cleanup_dma(dev);
+        mga_do_cleanup_dma(dev, FULL_CLEANUP);
 }
 int mga_driver_dma_quiescent(drm_device_t * dev)
diff --git a/drivers/char/drm/mga_drv.c b/drivers/char/drm/mga_drv.c
index 1713451a5cc6..9f7ed0e0351b 100644
--- a/drivers/char/drm/mga_drv.c
+++ b/drivers/char/drm/mga_drv.c
@@ -38,41 +38,6 @@
 #include "drm_pciids.h"
 static int mga_driver_device_is_agp(drm_device_t * dev);
-static int postinit(struct drm_device *dev, unsigned long flags)
-{
-        drm_mga_private_t *const dev_priv =
-            (drm_mga_private_t *) dev->dev_private;
-        dev_priv->mmio_base = pci_resource_start(dev->pdev, 1);
-        dev_priv->mmio_size = pci_resource_len(dev->pdev, 1);
-        dev->counters += 3;
-        dev->types[6] = _DRM_STAT_IRQ;
-        dev->types[7] = _DRM_STAT_PRIMARY;
-        dev->types[8] = _DRM_STAT_SECONDARY;
-        DRM_INFO("Initialized %s %d.%d.%d %s on minor %d: %s\n",
-                 DRIVER_NAME,
-                 DRIVER_MAJOR,
-                 DRIVER_MINOR,
-                 DRIVER_PATCHLEVEL,
-                 DRIVER_DATE, dev->primary.minor, pci_pretty_name(dev->pdev)
-            );
-        return 0;
-}
-static int version(drm_version_t * version)
-{
-        int len;
-        version->version_major = DRIVER_MAJOR;
-        version->version_minor = DRIVER_MINOR;
-        version->version_patchlevel = DRIVER_PATCHLEVEL;
-        DRM_COPY(version->name, DRIVER_NAME);
-        DRM_COPY(version->date, DRIVER_DATE);
-        DRM_COPY(version->desc, DRIVER_DESC);
-        return 0;
-}
 static struct pci_device_id pciidlist[] = {
        mga_PCI_IDS
@@ -80,12 +45,12 @@ static struct pci_device_id pciidlist[] = {
 static struct drm_driver driver = {
        .driver_features =
-            DRIVER_USE_AGP | DRIVER_REQUIRE_AGP | DRIVER_USE_MTRR |
+            DRIVER_USE_AGP | DRIVER_USE_MTRR | DRIVER_PCI_DMA |
            DRIVER_HAVE_DMA | DRIVER_HAVE_IRQ | DRIVER_IRQ_SHARED |
            DRIVER_IRQ_VBL,
-        .preinit = mga_driver_preinit,
+        .load = mga_driver_load,
-        .postcleanup = mga_driver_postcleanup,
+        .unload = mga_driver_unload,
-        .pretakedown = mga_driver_pretakedown,
+        .lastclose = mga_driver_lastclose,
        .dma_quiescent = mga_driver_dma_quiescent,
        .device_is_agp = mga_driver_device_is_agp,
        .vblank_wait = mga_driver_vblank_wait,
@@ -96,8 +61,6 @@ static struct drm_driver driver = {
        .reclaim_buffers = drm_core_reclaim_buffers,
        .get_map_ofs = drm_core_get_map_ofs,
        .get_reg_ofs = drm_core_get_reg_ofs,
-        .postinit = postinit,
-        .version = version,
        .ioctls = mga_ioctls,
        .dma_ioctl = mga_dma_buffers,
        .fops = {
@@ -113,9 +76,16 @@ static struct drm_driver driver = {
 #endif
                 },
        .pci_driver = {
-                       .name = DRIVER_NAME,
+                 .name = DRIVER_NAME,
-                       .id_table = pciidlist,
+                 .id_table = pciidlist,
-                       }
+        },
+        .name = DRIVER_NAME,
+        .desc = DRIVER_DESC,
+        .date = DRIVER_DATE,
+        .major = DRIVER_MAJOR,
+        .minor = DRIVER_MINOR,
+        .patchlevel = DRIVER_PATCHLEVEL,
 };
 static int __init mga_init(void)
diff --git a/drivers/char/drm/mga_drv.h b/drivers/char/drm/mga_drv.h
index 461728e6a58a..6b0c53193506 100644
--- a/drivers/char/drm/mga_drv.h
+++ b/drivers/char/drm/mga_drv.h
@@ -38,11 +38,11 @@
 #define DRIVER_NAME             "mga"
 #define DRIVER_DESC             "Matrox G200/G400"
-#define DRIVER_DATE             "20050607"
+#define DRIVER_DATE             "20051102"
 #define DRIVER_MAJOR            3
 #define DRIVER_MINOR            2
-#define DRIVER_PATCHLEVEL       0
+#define DRIVER_PATCHLEVEL       1
 typedef struct drm_mga_primary_buffer {
        u8 *start;
@@ -144,22 +144,22 @@ typedef struct drm_mga_private {
        drm_local_map_t *primary;
        drm_local_map_t *agp_textures;
-        DRM_AGP_MEM *agp_mem;
+        unsigned long agp_handle;
-        unsigned int agp_pages;
+        unsigned int agp_size;
 } drm_mga_private_t;
 extern drm_ioctl_desc_t mga_ioctls[];
 extern int mga_max_ioctl;
                                /* mga_dma.c */
-extern int mga_driver_preinit(drm_device_t * dev, unsigned long flags);
 extern int mga_dma_bootstrap(DRM_IOCTL_ARGS);
 extern int mga_dma_init(DRM_IOCTL_ARGS);
 extern int mga_dma_flush(DRM_IOCTL_ARGS);
 extern int mga_dma_reset(DRM_IOCTL_ARGS);
 extern int mga_dma_buffers(DRM_IOCTL_ARGS);
-extern int mga_driver_postcleanup(drm_device_t * dev);
+extern int mga_driver_load(drm_device_t *dev, unsigned long flags);
-extern void mga_driver_pretakedown(drm_device_t * dev);
+extern int mga_driver_unload(drm_device_t * dev);
+extern void mga_driver_lastclose(drm_device_t * dev);
 extern int mga_driver_dma_quiescent(drm_device_t * dev);
 extern int mga_do_wait_for_idle(drm_mga_private_t * dev_priv);
diff --git a/drivers/char/drm/mga_state.c b/drivers/char/drm/mga_state.c
index 47f54b5ae956..2837e669183a 100644
--- a/drivers/char/drm/mga_state.c
+++ b/drivers/char/drm/mga_state.c
@@ -1127,19 +1127,19 @@ static int mga_wait_fence(DRM_IOCTL_ARGS)
 }
 drm_ioctl_desc_t mga_ioctls[] = {
-        [DRM_IOCTL_NR(DRM_MGA_INIT)] = {mga_dma_init, 1, 1},
+        [DRM_IOCTL_NR(DRM_MGA_INIT)] = {mga_dma_init, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_MGA_FLUSH)] = {mga_dma_flush, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_FLUSH)] = {mga_dma_flush, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_MGA_RESET)] = {mga_dma_reset, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_RESET)] = {mga_dma_reset, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_MGA_SWAP)] = {mga_dma_swap, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_SWAP)] = {mga_dma_swap, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_MGA_CLEAR)] = {mga_dma_clear, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_CLEAR)] = {mga_dma_clear, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_MGA_VERTEX)] = {mga_dma_vertex, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_VERTEX)] = {mga_dma_vertex, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_MGA_INDICES)] = {mga_dma_indices, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_INDICES)] = {mga_dma_indices, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_MGA_ILOAD)] = {mga_dma_iload, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_ILOAD)] = {mga_dma_iload, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_MGA_BLIT)] = {mga_dma_blit, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_BLIT)] = {mga_dma_blit, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_MGA_GETPARAM)] = {mga_getparam, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_GETPARAM)] = {mga_getparam, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_MGA_SET_FENCE)] = {mga_set_fence, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_SET_FENCE)] = {mga_set_fence, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_MGA_WAIT_FENCE)] = {mga_wait_fence, 1, 0},
+        [DRM_IOCTL_NR(DRM_MGA_WAIT_FENCE)] = {mga_wait_fence, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_MGA_DMA_BOOTSTRAP)] = {mga_dma_bootstrap, 1, 1},
+        [DRM_IOCTL_NR(DRM_MGA_DMA_BOOTSTRAP)] = {mga_dma_bootstrap, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
 };
 int mga_max_ioctl = DRM_ARRAY_SIZE(mga_ioctls);
diff --git a/drivers/char/drm/r128_cce.c b/drivers/char/drm/r128_cce.c
index 7452753d4d01..db5a60450e68 100644
--- a/drivers/char/drm/r128_cce.c
+++ b/drivers/char/drm/r128_cce.c
@@ -1,6 +1,7 @@
-/* r128_cce.c -- ATI Rage 128 driver -*- linux-c -*-
+/* r128_cce.c -- ATI Rage 128 driver -*- linux-c -*- 
 * Created: Wed Apr  5 19:24:19 2000 by kevin@precisioninsight.com
- *
+ */
+/*
 * Copyright 2000 Precision Insight, Inc., Cedar Park, Texas.
 * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
 * All Rights Reserved.
@@ -559,7 +560,8 @@ static int r128_do_init_cce(drm_device_t * dev, drm_r128_init_t * init)
        if (dev_priv->is_pci) {
 #endif
                dev_priv->gart_info.gart_table_location = DRM_ATI_GART_MAIN;
-                dev_priv->gart_info.addr = dev_priv->gart_info.bus_addr = 0;
+                dev_priv->gart_info.addr = NULL;
+                dev_priv->gart_info.bus_addr = 0;
                dev_priv->gart_info.is_pcie = 0;
                if (!drm_ati_pcigart_init(dev, &dev_priv->gart_info)) {
                        DRM_ERROR("failed to init PCI GART!\n");
@@ -601,15 +603,16 @@ int r128_do_cleanup_cce(drm_device_t * dev)
                                drm_core_ioremapfree(dev_priv->cce_ring, dev);
                        if (dev_priv->ring_rptr != NULL)
                                drm_core_ioremapfree(dev_priv->ring_rptr, dev);
-                        if (dev->agp_buffer_map != NULL)
+                        if (dev->agp_buffer_map != NULL) {
                                drm_core_ioremapfree(dev->agp_buffer_map, dev);
+                                dev->agp_buffer_map = NULL;
+                        }
                } else
 #endif
                {
                        if (dev_priv->gart_info.bus_addr)
                                if (!drm_ati_pcigart_cleanup(dev,
-                                                             &dev_priv->
+                                                        &dev_priv->gart_info))
-                                                             gart_info))
                                        DRM_ERROR
                                            ("failed to cleanup PCI GART!\n");
                }
diff --git a/drivers/char/drm/r128_drm.h b/drivers/char/drm/r128_drm.h
index 5ddc03202411..5d835b006f55 100644
--- a/drivers/char/drm/r128_drm.h
+++ b/drivers/char/drm/r128_drm.h
@@ -1,7 +1,7 @@
 /* r128_drm.h -- Public header for the r128 driver -*- linux-c -*-
 * Created: Wed Apr  5 19:24:19 2000 by kevin@precisioninsight.com
- *
+ */
- * Copyright 2000 Precision Insight, Inc., Cedar Park, Texas.
+/* Copyright 2000 Precision Insight, Inc., Cedar Park, Texas.
 * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
 * All rights reserved.
 *
diff --git a/drivers/char/drm/r128_drv.c b/drivers/char/drm/r128_drv.c
index 1661e7351402..e20450ae220e 100644
--- a/drivers/char/drm/r128_drv.c
+++ b/drivers/char/drm/r128_drv.c
@@ -37,31 +37,6 @@
 #include "drm_pciids.h"
-static int postinit(struct drm_device *dev, unsigned long flags)
-{
-        DRM_INFO("Initialized %s %d.%d.%d %s on minor %d: %s\n",
-                 DRIVER_NAME,
-                 DRIVER_MAJOR,
-                 DRIVER_MINOR,
-                 DRIVER_PATCHLEVEL,
-                 DRIVER_DATE, dev->primary.minor, pci_pretty_name(dev->pdev)
-            );
-        return 0;
-}
-static int version(drm_version_t * version)
-{
-        int len;
-        version->version_major = DRIVER_MAJOR;
-        version->version_minor = DRIVER_MINOR;
-        version->version_patchlevel = DRIVER_PATCHLEVEL;
-        DRM_COPY(version->name, DRIVER_NAME);
-        DRM_COPY(version->date, DRIVER_DATE);
-        DRM_COPY(version->desc, DRIVER_DESC);
-        return 0;
-}
 static struct pci_device_id pciidlist[] = {
        r128_PCI_IDS
 };
@@ -72,8 +47,8 @@ static struct drm_driver driver = {
            DRIVER_HAVE_DMA | DRIVER_HAVE_IRQ | DRIVER_IRQ_SHARED |
            DRIVER_IRQ_VBL,
        .dev_priv_size = sizeof(drm_r128_buf_priv_t),
-        .prerelease = r128_driver_prerelease,
+        .preclose = r128_driver_preclose,
-        .pretakedown = r128_driver_pretakedown,
+        .lastclose = r128_driver_lastclose,
        .vblank_wait = r128_driver_vblank_wait,
        .irq_preinstall = r128_driver_irq_preinstall,
        .irq_postinstall = r128_driver_irq_postinstall,
@@ -82,8 +57,6 @@ static struct drm_driver driver = {
        .reclaim_buffers = drm_core_reclaim_buffers,
        .get_map_ofs = drm_core_get_map_ofs,
        .get_reg_ofs = drm_core_get_reg_ofs,
-        .postinit = postinit,
-        .version = version,
        .ioctls = r128_ioctls,
        .dma_ioctl = r128_cce_buffers,
        .fops = {
@@ -97,12 +70,19 @@ static struct drm_driver driver = {
 #ifdef CONFIG_COMPAT
                 .compat_ioctl = r128_compat_ioctl,
 #endif
-                 }
+        },
-        ,
        .pci_driver = {
-                       .name = DRIVER_NAME,
+                 .name = DRIVER_NAME,
-                       .id_table = pciidlist,
+                 .id_table = pciidlist,
-                       }
+        },
+        .name = DRIVER_NAME,
+        .desc = DRIVER_DESC,
+        .date = DRIVER_DATE,
+        .major = DRIVER_MAJOR,
+        .minor = DRIVER_MINOR,
+        .patchlevel = DRIVER_PATCHLEVEL,
 };
 static int __init r128_init(void)
diff --git a/drivers/char/drm/r128_drv.h b/drivers/char/drm/r128_drv.h
index 5c79e40eb88f..94abffb2cca5 100644
--- a/drivers/char/drm/r128_drv.h
+++ b/drivers/char/drm/r128_drv.h
@@ -1,7 +1,7 @@
 /* r128_drv.h -- Private header for r128 driver -*- linux-c -*-
 * Created: Mon Dec 13 09:51:11 1999 by faith@precisioninsight.com
- *
+ */
- * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
+/* Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
 * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
 * All rights reserved.
 *
@@ -154,8 +154,8 @@ extern irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS);
 extern void r128_driver_irq_preinstall(drm_device_t * dev);
 extern void r128_driver_irq_postinstall(drm_device_t * dev);
 extern void r128_driver_irq_uninstall(drm_device_t * dev);
-extern void r128_driver_pretakedown(drm_device_t * dev);
+extern void r128_driver_lastclose(drm_device_t * dev);
-extern void r128_driver_prerelease(drm_device_t * dev, DRMFILE filp);
+extern void r128_driver_preclose(drm_device_t * dev, DRMFILE filp);
 extern long r128_compat_ioctl(struct file *filp, unsigned int cmd,
                              unsigned long arg);
diff --git a/drivers/char/drm/r128_irq.c b/drivers/char/drm/r128_irq.c
index 27eb0e31bd3b..87f8ca2b0685 100644
--- a/drivers/char/drm/r128_irq.c
+++ b/drivers/char/drm/r128_irq.c
@@ -1,5 +1,5 @@
-/* r128_irq.c -- IRQ handling for radeon -*- linux-c -*-
+/* r128_irq.c -- IRQ handling for radeon -*- linux-c -*- */
- *
+/*
 * Copyright (C) The Weather Channel, Inc.  2002.  All Rights Reserved.
 *
 * The Weather Channel (TM) funded Tungsten Graphics to develop the
diff --git a/drivers/char/drm/r128_state.c b/drivers/char/drm/r128_state.c
index 14479cc08a57..caeecc2c36da 100644
--- a/drivers/char/drm/r128_state.c
+++ b/drivers/char/drm/r128_state.c
@@ -1,7 +1,7 @@
 /* r128_state.c -- State support for r128 -*- linux-c -*-
 * Created: Thu Jan 27 02:53:43 2000 by gareth@valinux.com
- *
+ */
- * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
+/* Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
 * All Rights Reserved.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
@@ -1674,7 +1674,7 @@ static int r128_getparam(DRM_IOCTL_ARGS)
        return 0;
 }
-void r128_driver_prerelease(drm_device_t * dev, DRMFILE filp)
+void r128_driver_preclose(drm_device_t * dev, DRMFILE filp)
 {
        if (dev->dev_private) {
                drm_r128_private_t *dev_priv = dev->dev_private;
@@ -1684,29 +1684,29 @@ void r128_driver_prerelease(drm_device_t * dev, DRMFILE filp)
        }
 }
-void r128_driver_pretakedown(drm_device_t * dev)
+void r128_driver_lastclose(drm_device_t * dev)
 {
        r128_do_cleanup_cce(dev);
 }
 drm_ioctl_desc_t r128_ioctls[] = {
-        [DRM_IOCTL_NR(DRM_R128_INIT)] = {r128_cce_init, 1, 1},
+        [DRM_IOCTL_NR(DRM_R128_INIT)] = {r128_cce_init, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_R128_CCE_START)] = {r128_cce_start, 1, 1},
+        [DRM_IOCTL_NR(DRM_R128_CCE_START)] = {r128_cce_start, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_R128_CCE_STOP)] = {r128_cce_stop, 1, 1},
+        [DRM_IOCTL_NR(DRM_R128_CCE_STOP)] = {r128_cce_stop, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_R128_CCE_RESET)] = {r128_cce_reset, 1, 1},
+        [DRM_IOCTL_NR(DRM_R128_CCE_RESET)] = {r128_cce_reset, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_R128_CCE_IDLE)] = {r128_cce_idle, 1, 0},
+        [DRM_IOCTL_NR(DRM_R128_CCE_IDLE)] = {r128_cce_idle, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_R128_RESET)] = {r128_engine_reset, 1, 0},
+        [DRM_IOCTL_NR(DRM_R128_RESET)] = {r128_engine_reset, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_R128_FULLSCREEN)] = {r128_fullscreen, 1, 0},
+        [DRM_IOCTL_NR(DRM_R128_FULLSCREEN)] = {r128_fullscreen, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_R128_SWAP)] = {r128_cce_swap, 1, 0},
+        [DRM_IOCTL_NR(DRM_R128_SWAP)] = {r128_cce_swap, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_R128_FLIP)] = {r128_cce_flip, 1, 0},
+        [DRM_IOCTL_NR(DRM_R128_FLIP)] = {r128_cce_flip, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_R128_CLEAR)] = {r128_cce_clear, 1, 0},
+        [DRM_IOCTL_NR(DRM_R128_CLEAR)] = {r128_cce_clear, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_R128_VERTEX)] = {r128_cce_vertex, 1, 0},
+        [DRM_IOCTL_NR(DRM_R128_VERTEX)] = {r128_cce_vertex, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_R128_INDICES)] = {r128_cce_indices, 1, 0},
+        [DRM_IOCTL_NR(DRM_R128_INDICES)] = {r128_cce_indices, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_R128_BLIT)] = {r128_cce_blit, 1, 0},
+        [DRM_IOCTL_NR(DRM_R128_BLIT)] = {r128_cce_blit, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_R128_DEPTH)] = {r128_cce_depth, 1, 0},
+        [DRM_IOCTL_NR(DRM_R128_DEPTH)] = {r128_cce_depth, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_R128_STIPPLE)] = {r128_cce_stipple, 1, 0},
+        [DRM_IOCTL_NR(DRM_R128_STIPPLE)] = {r128_cce_stipple, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_R128_INDIRECT)] = {r128_cce_indirect, 1, 1},
+        [DRM_IOCTL_NR(DRM_R128_INDIRECT)] = {r128_cce_indirect, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_R128_GETPARAM)] = {r128_getparam, 1, 0},
+        [DRM_IOCTL_NR(DRM_R128_GETPARAM)] = {r128_getparam, DRM_AUTH},
 };
 int r128_max_ioctl = DRM_ARRAY_SIZE(r128_ioctls);
diff --git a/drivers/char/drm/r300_cmdbuf.c b/drivers/char/drm/r300_cmdbuf.c
index 3a1ac5f78b43..291dbf4c8186 100644
--- a/drivers/char/drm/r300_cmdbuf.c
+++ b/drivers/char/drm/r300_cmdbuf.c
@@ -52,8 +52,8 @@ static const int r300_cliprect_cntl[4] = {
 * Emit up to R300_SIMULTANEOUS_CLIPRECTS cliprects from the given command
 * buffer, starting with index n.
 */
-static int r300_emit_cliprects(drm_radeon_private_t * dev_priv,
+static int r300_emit_cliprects(drm_radeon_private_t *dev_priv,
-                               drm_radeon_kcmd_buffer_t * cmdbuf, int n)
+                               drm_radeon_kcmd_buffer_t *cmdbuf, int n)
 {
        drm_clip_rect_t box;
        int nr;
@@ -216,6 +216,7 @@ void r300_init_reg_flags(void)
        ADD_RANGE(R300_TX_UNK1_0, 16);
        ADD_RANGE(R300_TX_SIZE_0, 16);
        ADD_RANGE(R300_TX_FORMAT_0, 16);
+        ADD_RANGE(R300_TX_PITCH_0, 16);
        /* Texture offset is dangerous and needs more checking */
        ADD_RANGE_MARK(R300_TX_OFFSET_0, 16, MARK_CHECK_OFFSET);
        ADD_RANGE(R300_TX_UNK4_0, 16);
@@ -242,7 +243,7 @@ static __inline__ int r300_check_range(unsigned reg, int count)
  /* we expect offsets passed to the framebuffer to be either within video memory or
     within AGP space */
-static __inline__ int r300_check_offset(drm_radeon_private_t * dev_priv,
+static __inline__ int r300_check_offset(drm_radeon_private_t *dev_priv,
                                        u32 offset)
 {
        /* we realy want to check against end of video aperture
@@ -317,8 +318,8 @@ static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t *
 *
 * Note that checks are performed on contents and addresses of the registers
 */
-static __inline__ int r300_emit_packet0(drm_radeon_private_t * dev_priv,
+static __inline__ int r300_emit_packet0(drm_radeon_private_t *dev_priv,
-                                        drm_radeon_kcmd_buffer_t * cmdbuf,
+                                        drm_radeon_kcmd_buffer_t *cmdbuf,
                                        drm_r300_cmd_header_t header)
 {
        int reg;
@@ -363,8 +364,8 @@ static __inline__ int r300_emit_packet0(drm_radeon_private_t * dev_priv,
 * the graphics card.
 * Called by r300_do_cp_cmdbuf.
 */
-static __inline__ int r300_emit_vpu(drm_radeon_private_t * dev_priv,
+static __inline__ int r300_emit_vpu(drm_radeon_private_t *dev_priv,
-                                    drm_radeon_kcmd_buffer_t * cmdbuf,
+                                    drm_radeon_kcmd_buffer_t *cmdbuf,
                                    drm_r300_cmd_header_t header)
 {
        int sz;
@@ -400,8 +401,8 @@ static __inline__ int r300_emit_vpu(drm_radeon_private_t * dev_priv,
 * Emit a clear packet from userspace.
 * Called by r300_emit_packet3.
 */
-static __inline__ int r300_emit_clear(drm_radeon_private_t * dev_priv,
+static __inline__ int r300_emit_clear(drm_radeon_private_t *dev_priv,
-                                      drm_radeon_kcmd_buffer_t * cmdbuf)
+                                      drm_radeon_kcmd_buffer_t *cmdbuf)
 {
        RING_LOCALS;
@@ -421,8 +422,8 @@ static __inline__ int r300_emit_clear(drm_radeon_private_t * dev_priv,
        return 0;
 }
-static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t * dev_priv,
+static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t *dev_priv,
-                                               drm_radeon_kcmd_buffer_t * cmdbuf,
+                                               drm_radeon_kcmd_buffer_t *cmdbuf,
                                               u32 header)
 {
        int count, i, k;
@@ -489,8 +490,8 @@ static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t * dev_priv,
        return 0;
 }
-static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t * dev_priv,
+static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t *dev_priv,
-                                            drm_radeon_kcmd_buffer_t * cmdbuf)
+                                            drm_radeon_kcmd_buffer_t *cmdbuf)
 {
        u32 header;
        int count;
@@ -554,8 +555,8 @@ static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t * dev_priv,
 * Emit a rendering packet3 from userspace.
 * Called by r300_do_cp_cmdbuf.
 */
-static __inline__ int r300_emit_packet3(drm_radeon_private_t * dev_priv,
+static __inline__ int r300_emit_packet3(drm_radeon_private_t *dev_priv,
-                                        drm_radeon_kcmd_buffer_t * cmdbuf,
+                                        drm_radeon_kcmd_buffer_t *cmdbuf,
                                        drm_r300_cmd_header_t header)
 {
        int n;
@@ -623,7 +624,7 @@ static __inline__ int r300_emit_packet3(drm_radeon_private_t * dev_priv,
 /**
 * Emit the sequence to pacify R300.
 */
-static __inline__ void r300_pacify(drm_radeon_private_t * dev_priv)
+static __inline__ void r300_pacify(drm_radeon_private_t *dev_priv)
 {
        RING_LOCALS;
@@ -657,9 +658,10 @@ static void r300_discard_buffer(drm_device_t * dev, drm_buf_t * buf)
 * commands on the DMA ring buffer.
 * Called by the ioctl handler function radeon_cp_cmdbuf.
 */
-int r300_do_cp_cmdbuf(drm_device_t * dev,
+int r300_do_cp_cmdbuf(drm_device_t *dev,
                      DRMFILE filp,
-                      drm_file_t * filp_priv, drm_radeon_kcmd_buffer_t * cmdbuf)
+                      drm_file_t *filp_priv,
+                      drm_radeon_kcmd_buffer_t *cmdbuf)
 {
        drm_radeon_private_t *dev_priv = dev->dev_private;
        drm_device_dma_t *dma = dev->dma;
diff --git a/drivers/char/drm/r300_reg.h b/drivers/char/drm/r300_reg.h
index e5b73c002394..a0ed20e25221 100644
--- a/drivers/char/drm/r300_reg.h
+++ b/drivers/char/drm/r300_reg.h
@@ -797,6 +797,7 @@ I am fairly certain that they are correct unless stated otherwise in comments.
 #       define R300_TX_FORMAT_YUV_MODE          0x00800000
+#define R300_TX_PITCH_0                     0x4500
 #define R300_TX_OFFSET_0                    0x4540
 /* BEGIN: Guess from R200 */
 #       define R300_TXO_ENDIAN_NO_SWAP           (0 << 0)
diff --git a/drivers/char/drm/radeon_cp.c b/drivers/char/drm/radeon_cp.c
index 342302d46743..915665c7fe7c 100644
--- a/drivers/char/drm/radeon_cp.c
+++ b/drivers/char/drm/radeon_cp.c
@@ -1,5 +1,5 @@
-/* radeon_cp.c -- CP support for Radeon -*- linux-c -*-
+/* radeon_cp.c -- CP support for Radeon -*- linux-c -*- */
- *
+/*
 * Copyright 2000 Precision Insight, Inc., Cedar Park, Texas.
 * Copyright 2000 VA Linux Systems, Inc., Fremont, California.
 * All Rights Reserved.
@@ -824,7 +824,7 @@ static int RADEON_READ_PLL(drm_device_t * dev, int addr)
        return RADEON_READ(RADEON_CLOCK_CNTL_DATA);
 }
-static int RADEON_READ_PCIE(drm_radeon_private_t * dev_priv, int addr)
+static int RADEON_READ_PCIE(drm_radeon_private_t *dev_priv, int addr)
 {
        RADEON_WRITE8(RADEON_PCIE_INDEX, addr & 0xff);
        return RADEON_READ(RADEON_PCIE_DATA);
@@ -1125,7 +1125,7 @@ static void radeon_cp_init_ring_buffer(drm_device_t * dev,
                     | (dev_priv->fb_location >> 16));
 #if __OS_HAS_AGP
-        if (!dev_priv->is_pci) {
+        if (dev_priv->flags & CHIP_IS_AGP) {
                RADEON_WRITE(RADEON_MC_AGP_LOCATION,
                             (((dev_priv->gart_vm_start - 1 +
                                dev_priv->gart_size) & 0xffff0000) |
@@ -1152,7 +1152,7 @@ static void radeon_cp_init_ring_buffer(drm_device_t * dev,
        dev_priv->ring.tail = cur_read_ptr;
 #if __OS_HAS_AGP
-        if (!dev_priv->is_pci) {
+        if (dev_priv->flags & CHIP_IS_AGP) {
                /* set RADEON_AGP_BASE here instead of relying on X from user space */
                RADEON_WRITE(RADEON_AGP_BASE, (unsigned int)dev->agp->base);
                RADEON_WRITE(RADEON_CP_RB_RPTR_ADDR,
@@ -1278,13 +1278,15 @@ static void radeon_set_pciegart(drm_radeon_private_t * dev_priv, int on)
 /* Enable or disable PCI GART on the chip */
 static void radeon_set_pcigart(drm_radeon_private_t * dev_priv, int on)
 {
-        u32 tmp = RADEON_READ(RADEON_AIC_CNTL);
+        u32 tmp;
        if (dev_priv->flags & CHIP_IS_PCIE) {
                radeon_set_pciegart(dev_priv, on);
                return;
        }
+        tmp = RADEON_READ(RADEON_AIC_CNTL);
        if (on) {
                RADEON_WRITE(RADEON_AIC_CNTL,
                             tmp | RADEON_PCIGART_TRANSLATE_EN);
@@ -1312,13 +1314,17 @@ static void radeon_set_pcigart(drm_radeon_private_t * dev_priv, int on)
 static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
 {
        drm_radeon_private_t *dev_priv = dev->dev_private;
        DRM_DEBUG("\n");
-        dev_priv->is_pci = init->is_pci;
+        if (init->is_pci && (dev_priv->flags & CHIP_IS_AGP))
+        {
+                DRM_DEBUG("Forcing AGP card to PCI mode\n");
+                dev_priv->flags &= ~CHIP_IS_AGP;
+        }
-        if (dev_priv->is_pci && !dev->sg) {
+        if ((!(dev_priv->flags & CHIP_IS_AGP)) && !dev->sg) {
                DRM_ERROR("PCI GART memory not allocated!\n");
-                dev->dev_private = (void *)dev_priv;
                radeon_do_cleanup_cp(dev);
                return DRM_ERR(EINVAL);
        }
@@ -1327,12 +1333,11 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
        if (dev_priv->usec_timeout < 1 ||
            dev_priv->usec_timeout > RADEON_MAX_USEC_TIMEOUT) {
                DRM_DEBUG("TIMEOUT problem!\n");
-                dev->dev_private = (void *)dev_priv;
                radeon_do_cleanup_cp(dev);
                return DRM_ERR(EINVAL);
        }
-        switch (init->func) {
+        switch(init->func) {
        case RADEON_INIT_R200_CP:
                dev_priv->microcode_version = UCODE_R200;
                break;
@@ -1353,7 +1358,6 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
        if ((init->cp_mode != RADEON_CSQ_PRIBM_INDDIS) &&
            (init->cp_mode != RADEON_CSQ_PRIBM_INDBM)) {
                DRM_DEBUG("BAD cp_mode (%x)!\n", init->cp_mode);
-                dev->dev_private = (void *)dev_priv;
                radeon_do_cleanup_cp(dev);
                return DRM_ERR(EINVAL);
        }
@@ -1416,8 +1420,6 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
        DRM_GETSAREA();
-        dev_priv->fb_offset = init->fb_offset;
-        dev_priv->mmio_offset = init->mmio_offset;
        dev_priv->ring_offset = init->ring_offset;
        dev_priv->ring_rptr_offset = init->ring_rptr_offset;
        dev_priv->buffers_offset = init->buffers_offset;
@@ -1425,29 +1427,19 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
        if (!dev_priv->sarea) {
                DRM_ERROR("could not find sarea!\n");
-                dev->dev_private = (void *)dev_priv;
                radeon_do_cleanup_cp(dev);
                return DRM_ERR(EINVAL);
        }
-        dev_priv->mmio = drm_core_findmap(dev, init->mmio_offset);
-        if (!dev_priv->mmio) {
-                DRM_ERROR("could not find mmio region!\n");
-                dev->dev_private = (void *)dev_priv;
-                radeon_do_cleanup_cp(dev);
-                return DRM_ERR(EINVAL);
-        }
        dev_priv->cp_ring = drm_core_findmap(dev, init->ring_offset);
        if (!dev_priv->cp_ring) {
                DRM_ERROR("could not find cp ring region!\n");
-                dev->dev_private = (void *)dev_priv;
                radeon_do_cleanup_cp(dev);
                return DRM_ERR(EINVAL);
        }
        dev_priv->ring_rptr = drm_core_findmap(dev, init->ring_rptr_offset);
        if (!dev_priv->ring_rptr) {
                DRM_ERROR("could not find ring read pointer!\n");
-                dev->dev_private = (void *)dev_priv;
                radeon_do_cleanup_cp(dev);
                return DRM_ERR(EINVAL);
        }
@@ -1455,7 +1447,6 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
        dev->agp_buffer_map = drm_core_findmap(dev, init->buffers_offset);
        if (!dev->agp_buffer_map) {
                DRM_ERROR("could not find dma buffer region!\n");
-                dev->dev_private = (void *)dev_priv;
                radeon_do_cleanup_cp(dev);
                return DRM_ERR(EINVAL);
        }
@@ -1465,7 +1456,6 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
                    drm_core_findmap(dev, init->gart_textures_offset);
                if (!dev_priv->gart_textures) {
                        DRM_ERROR("could not find GART texture region!\n");
-                        dev->dev_private = (void *)dev_priv;
                        radeon_do_cleanup_cp(dev);
                        return DRM_ERR(EINVAL);
                }
@@ -1476,7 +1466,7 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
                                    init->sarea_priv_offset);
 #if __OS_HAS_AGP
-        if (!dev_priv->is_pci) {
+        if (dev_priv->flags & CHIP_IS_AGP) {
                drm_core_ioremap(dev_priv->cp_ring, dev);
                drm_core_ioremap(dev_priv->ring_rptr, dev);
                drm_core_ioremap(dev->agp_buffer_map, dev);
@@ -1484,7 +1474,6 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
                    !dev_priv->ring_rptr->handle ||
                    !dev->agp_buffer_map->handle) {
                        DRM_ERROR("could not find ioremap agp regions!\n");
-                        dev->dev_private = (void *)dev_priv;
                        radeon_do_cleanup_cp(dev);
                        return DRM_ERR(EINVAL);
                }
@@ -1525,7 +1514,7 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
            + RADEON_READ(RADEON_CONFIG_APER_SIZE);
 #if __OS_HAS_AGP
-        if (!dev_priv->is_pci)
+        if (dev_priv->flags & CHIP_IS_AGP)
                dev_priv->gart_buffers_offset = (dev->agp_buffer_map->offset
                                                 - dev->agp->base
                                                 + dev_priv->gart_vm_start);
@@ -1551,7 +1540,7 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
        dev_priv->ring.high_mark = RADEON_RING_HIGH_MARK;
 #if __OS_HAS_AGP
-        if (!dev_priv->is_pci) {
+        if (dev_priv->flags & CHIP_IS_AGP) {
                /* Turn off PCI GART */
                radeon_set_pcigart(dev_priv, 0);
        } else
@@ -1561,25 +1550,28 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
                if (dev_priv->pcigart_offset) {
                        dev_priv->gart_info.bus_addr =
                            dev_priv->pcigart_offset + dev_priv->fb_location;
+                        dev_priv->gart_info.mapping.offset =
+                            dev_priv->gart_info.bus_addr;
+                        dev_priv->gart_info.mapping.size =
+                            RADEON_PCIGART_TABLE_SIZE;
+                        drm_core_ioremap(&dev_priv->gart_info.mapping, dev);
                        dev_priv->gart_info.addr =
-                            (unsigned long)drm_ioremap(dev_priv->gart_info.
+                            dev_priv->gart_info.mapping.handle;
-                                                       bus_addr,
-                                                       RADEON_PCIGART_TABLE_SIZE,
-                                                       dev);
                        dev_priv->gart_info.is_pcie =
                            !!(dev_priv->flags & CHIP_IS_PCIE);
                        dev_priv->gart_info.gart_table_location =
                            DRM_ATI_GART_FB;
-                        DRM_DEBUG("Setting phys_pci_gart to %08lX %08lX\n",
+                        DRM_DEBUG("Setting phys_pci_gart to %p %08lX\n",
                                  dev_priv->gart_info.addr,
                                  dev_priv->pcigart_offset);
                } else {
                        dev_priv->gart_info.gart_table_location =
                            DRM_ATI_GART_MAIN;
-                        dev_priv->gart_info.addr =
+                        dev_priv->gart_info.addr = NULL;
-                            dev_priv->gart_info.bus_addr = 0;
+                        dev_priv->gart_info.bus_addr = 0;
                        if (dev_priv->flags & CHIP_IS_PCIE) {
                                DRM_ERROR
                                    ("Cannot use PCI Express without GART in FB memory\n");
@@ -1590,7 +1582,6 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
                if (!drm_ati_pcigart_init(dev, &dev_priv->gart_info)) {
                        DRM_ERROR("failed to init PCI GART!\n");
-                        dev->dev_private = (void *)dev_priv;
                        radeon_do_cleanup_cp(dev);
                        return DRM_ERR(ENOMEM);
                }
@@ -1604,8 +1595,6 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
        dev_priv->last_buf = 0;
-        dev->dev_private = (void *)dev_priv;
        radeon_do_engine_reset(dev);
        return 0;
@@ -1624,11 +1613,15 @@ static int radeon_do_cleanup_cp(drm_device_t * dev)
                drm_irq_uninstall(dev);
 #if __OS_HAS_AGP
-        if (!dev_priv->is_pci) {
+        if (dev_priv->flags & CHIP_IS_AGP) {
-                if (dev_priv->cp_ring != NULL)
+                if (dev_priv->cp_ring != NULL) {
                        drm_core_ioremapfree(dev_priv->cp_ring, dev);
-                if (dev_priv->ring_rptr != NULL)
+                        dev_priv->cp_ring = NULL;
+                }
+                if (dev_priv->ring_rptr != NULL) {
                        drm_core_ioremapfree(dev_priv->ring_rptr, dev);
+                        dev_priv->ring_rptr = NULL;
+                }
                if (dev->agp_buffer_map != NULL) {
                        drm_core_ioremapfree(dev->agp_buffer_map, dev);
                        dev->agp_buffer_map = NULL;
@@ -1636,17 +1629,20 @@ static int radeon_do_cleanup_cp(drm_device_t * dev)
        } else
 #endif
        {
-                if (dev_priv->gart_info.bus_addr)
+                if (dev_priv->gart_info.bus_addr) {
+                        /* Turn off PCI GART */
+                        radeon_set_pcigart(dev_priv, 0);
                        if (!drm_ati_pcigart_cleanup(dev, &dev_priv->gart_info))
                                DRM_ERROR("failed to cleanup PCI GART!\n");
+                }
-                if (dev_priv->gart_info.gart_table_location == DRM_ATI_GART_FB) {
+                if (dev_priv->gart_info.gart_table_location == DRM_ATI_GART_FB)
-                        drm_ioremapfree((void *)dev_priv->gart_info.addr,
+                {
-                                        RADEON_PCIGART_TABLE_SIZE, dev);
+                        drm_core_ioremapfree(&dev_priv->gart_info.mapping, dev);
                        dev_priv->gart_info.addr = 0;
                }
        }
        /* only clear to the start of flags */
        memset(dev_priv, 0, offsetof(drm_radeon_private_t, flags));
@@ -1672,7 +1668,7 @@ static int radeon_do_resume_cp(drm_device_t * dev)
        DRM_DEBUG("Starting radeon_do_resume_cp()\n");
 #if __OS_HAS_AGP
-        if (!dev_priv->is_pci) {
+        if (dev_priv->flags & CHIP_IS_AGP) {
                /* Turn off PCI GART */
                radeon_set_pcigart(dev_priv, 0);
        } else
@@ -2103,7 +2099,7 @@ int radeon_cp_buffers(DRM_IOCTL_ARGS)
        return ret;
 }
-int radeon_driver_preinit(struct drm_device *dev, unsigned long flags)
+int radeon_driver_load(struct drm_device *dev, unsigned long flags)
 {
        drm_radeon_private_t *dev_priv;
        int ret = 0;
@@ -2136,11 +2132,14 @@ int radeon_driver_preinit(struct drm_device *dev, unsigned long flags)
                dev_priv->flags |= CHIP_IS_PCIE;
        DRM_DEBUG("%s card detected\n",
-                  ((dev_priv->flags & CHIP_IS_AGP) ? "AGP" : "PCI"));
+                  ((dev_priv->flags & CHIP_IS_AGP) ? "AGP" : (((dev_priv->flags & CHIP_IS_PCIE) ? "PCIE" : "PCI"))));
        return ret;
 }
-int radeon_presetup(struct drm_device *dev)
+/* Create mappings for registers and framebuffer so userland doesn't necessarily
+ * have to find them.
+ */
+int radeon_driver_firstopen(struct drm_device *dev)
 {
        int ret;
        drm_local_map_t *map;
@@ -2161,12 +2160,11 @@ int radeon_presetup(struct drm_device *dev)
        return 0;
 }
-int radeon_driver_postcleanup(struct drm_device *dev)
+int radeon_driver_unload(struct drm_device *dev)
 {
        drm_radeon_private_t *dev_priv = dev->dev_private;
        DRM_DEBUG("\n");
        drm_free(dev_priv, sizeof(*dev_priv), DRM_MEM_DRIVER);
        dev->dev_private = NULL;
diff --git a/drivers/char/drm/radeon_drm.h b/drivers/char/drm/radeon_drm.h
index 1cd81a671a36..9c177a6b2a4c 100644
--- a/drivers/char/drm/radeon_drm.h
+++ b/drivers/char/drm/radeon_drm.h
@@ -624,6 +624,11 @@ typedef struct drm_radeon_indirect {
        int discard;
 } drm_radeon_indirect_t;
+/* enum for card type parameters */
+#define RADEON_CARD_PCI 0
+#define RADEON_CARD_AGP 1
+#define RADEON_CARD_PCIE 2
 /* 1.3: An ioctl to get parameters that aren't available to the 3d
 * client any other way.
 */
@@ -640,6 +645,7 @@ typedef struct drm_radeon_indirect {
 #define RADEON_PARAM_SAREA_HANDLE          9
 #define RADEON_PARAM_GART_TEX_HANDLE       10
 #define RADEON_PARAM_SCRATCH_OFFSET        11
+#define RADEON_PARAM_CARD_TYPE             12
 typedef struct drm_radeon_getparam {
        int param;
diff --git a/drivers/char/drm/radeon_drv.c b/drivers/char/drm/radeon_drv.c
index ee49670d8162..b04ed1b562b9 100644
--- a/drivers/char/drm/radeon_drv.c
+++ b/drivers/char/drm/radeon_drv.c
@@ -42,29 +42,15 @@ int radeon_no_wb;
 MODULE_PARM_DESC(no_wb, "Disable AGP writeback for scratch registers\n");
 module_param_named(no_wb, radeon_no_wb, int, 0444);
-static int postinit(struct drm_device *dev, unsigned long flags)
+static int dri_library_name(struct drm_device *dev, char *buf)
 {
-        DRM_INFO("Initialized %s %d.%d.%d %s on minor %d: %s\n",
+        drm_radeon_private_t *dev_priv = dev->dev_private;
-                 DRIVER_NAME,
+        int family = dev_priv->flags & CHIP_FAMILY_MASK;
-                 DRIVER_MAJOR,
-                 DRIVER_MINOR,
-                 DRIVER_PATCHLEVEL,
-                 DRIVER_DATE, dev->primary.minor, pci_pretty_name(dev->pdev)
-            );
-        return 0;
-}
-static int version(drm_version_t * version)
-{
-        int len;
-        version->version_major = DRIVER_MAJOR;
+        return snprintf(buf, PAGE_SIZE, "%s\n",
-        version->version_minor = DRIVER_MINOR;
+                        (family < CHIP_R200) ? "radeon" :
-        version->version_patchlevel = DRIVER_PATCHLEVEL;
+                        ((family < CHIP_R300) ? "r200" :
-        DRM_COPY(version->name, DRIVER_NAME);
+                        "r300"));
-        DRM_COPY(version->date, DRIVER_DATE);
-        DRM_COPY(version->desc, DRIVER_DESC);
-        return 0;
 }
 static struct pci_device_id pciidlist[] = {
@@ -77,23 +63,22 @@ static struct drm_driver driver = {
            DRIVER_HAVE_IRQ | DRIVER_HAVE_DMA | DRIVER_IRQ_SHARED |
            DRIVER_IRQ_VBL,
        .dev_priv_size = sizeof(drm_radeon_buf_priv_t),
-        .preinit = radeon_driver_preinit,
+        .load = radeon_driver_load,
-        .presetup = radeon_presetup,
+        .firstopen = radeon_driver_firstopen,
-        .postcleanup = radeon_driver_postcleanup,
+        .open = radeon_driver_open,
-        .prerelease = radeon_driver_prerelease,
+        .preclose = radeon_driver_preclose,
-        .pretakedown = radeon_driver_pretakedown,
+        .postclose = radeon_driver_postclose,
-        .open_helper = radeon_driver_open_helper,
+        .lastclose = radeon_driver_lastclose,
+        .unload = radeon_driver_unload,
        .vblank_wait = radeon_driver_vblank_wait,
+        .dri_library_name = dri_library_name,
        .irq_preinstall = radeon_driver_irq_preinstall,
        .irq_postinstall = radeon_driver_irq_postinstall,
        .irq_uninstall = radeon_driver_irq_uninstall,
        .irq_handler = radeon_driver_irq_handler,
-        .free_filp_priv = radeon_driver_free_filp_priv,
        .reclaim_buffers = drm_core_reclaim_buffers,
        .get_map_ofs = drm_core_get_map_ofs,
        .get_reg_ofs = drm_core_get_reg_ofs,
-        .postinit = postinit,
-        .version = version,
        .ioctls = radeon_ioctls,
        .dma_ioctl = radeon_cp_buffers,
        .fops = {
@@ -107,12 +92,19 @@ static struct drm_driver driver = {
 #ifdef CONFIG_COMPAT
                 .compat_ioctl = radeon_compat_ioctl,
 #endif
-                 }
+        },
-        ,
        .pci_driver = {
-                       .name = DRIVER_NAME,
+                 .name = DRIVER_NAME,
-                       .id_table = pciidlist,
+                 .id_table = pciidlist,
-                       }
+        },
+        .name = DRIVER_NAME,
+        .desc = DRIVER_DESC,
+        .date = DRIVER_DATE,
+        .major = DRIVER_MAJOR,
+        .minor = DRIVER_MINOR,
+        .patchlevel = DRIVER_PATCHLEVEL,
 };
 static int __init radeon_init(void)
diff --git a/drivers/char/drm/radeon_drv.h b/drivers/char/drm/radeon_drv.h
index d92ccee3e54c..498b19b1d641 100644
--- a/drivers/char/drm/radeon_drv.h
+++ b/drivers/char/drm/radeon_drv.h
@@ -38,7 +38,7 @@
 #define DRIVER_NAME             "radeon"
 #define DRIVER_DESC             "ATI Radeon"
-#define DRIVER_DATE             "20050911"
+#define DRIVER_DATE             "20051229"
 /* Interface history:
 *
@@ -73,7 +73,7 @@
 * 1.11- Add packet R200_EMIT_RB3D_BLENDCOLOR to support GL_EXT_blend_color
 *       and GL_EXT_blend_[func|equation]_separate on r200
 * 1.12- Add R300 CP microcode support - this just loads the CP on r300
- *       (No 3D support yet - just microcode loading)
+ *       (No 3D support yet - just microcode loading).
 * 1.13- Add packet R200_EMIT_TCL_POINT_SPRITE_CNTL for ARB_point_parameters
 *     - Add hyperz support, add hyperz flags to clear ioctl.
 * 1.14- Add support for color tiling
@@ -88,14 +88,13 @@
 *       R200_EMIT_PP_TXFILTER_0-5, 2 more regs) and R200_EMIT_ATF_TFACTOR
 *       (replaces R200_EMIT_TFACTOR_0 (8 consts instead of 6)
 * 1.19- Add support for gart table in FB memory and PCIE r300
+ * 1.20- Add support for r300 texrect
+ * 1.21- Add support for card type getparam
 */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            19
+#define DRIVER_MINOR            21
 #define DRIVER_PATCHLEVEL       0
-#define GET_RING_HEAD(dev_priv)         DRM_READ32(  (dev_priv)->ring_rptr, 0 )
-#define SET_RING_HEAD(dev_priv,val)     DRM_WRITE32( (dev_priv)->ring_rptr, 0, (val) )
 /*
 * Radeon chip families
 */
@@ -103,8 +102,8 @@ enum radeon_family {
        CHIP_R100,
        CHIP_RS100,
        CHIP_RV100,
-        CHIP_R200,
        CHIP_RV200,
+        CHIP_R200,
        CHIP_RS200,
        CHIP_R250,
        CHIP_RS250,
@@ -138,6 +137,9 @@ enum radeon_chip_flags {
        CHIP_IS_PCIE = 0x00200000UL,
 };
+#define GET_RING_HEAD(dev_priv)         DRM_READ32(  (dev_priv)->ring_rptr, 0 )
+#define SET_RING_HEAD(dev_priv,val)     DRM_WRITE32( (dev_priv)->ring_rptr, 0, (val) )
 typedef struct drm_radeon_freelist {
        unsigned int age;
        drm_buf_t *buf;
@@ -245,8 +247,6 @@ typedef struct drm_radeon_private {
        drm_radeon_depth_clear_t depth_clear;
-        unsigned long fb_offset;
-        unsigned long mmio_offset;
        unsigned long ring_offset;
        unsigned long ring_rptr_offset;
        unsigned long buffers_offset;
@@ -273,7 +273,6 @@ typedef struct drm_radeon_private {
        /* starting from here on, data is preserved accross an open */
        uint32_t flags;         /* see radeon_chip_flags */
-        int is_pci;
 } drm_radeon_private_t;
 typedef struct drm_radeon_buf_priv {
@@ -330,17 +329,14 @@ extern irqreturn_t radeon_driver_irq_handler(DRM_IRQ_ARGS);
 extern void radeon_driver_irq_preinstall(drm_device_t * dev);
 extern void radeon_driver_irq_postinstall(drm_device_t * dev);
 extern void radeon_driver_irq_uninstall(drm_device_t * dev);
-extern void radeon_driver_prerelease(drm_device_t * dev, DRMFILE filp);
-extern void radeon_driver_pretakedown(drm_device_t * dev);
-extern int radeon_driver_open_helper(drm_device_t * dev,
-                                     drm_file_t * filp_priv);
-extern void radeon_driver_free_filp_priv(drm_device_t * dev,
-                                         drm_file_t * filp_priv);
-extern int radeon_preinit(struct drm_device *dev, unsigned long flags);
-extern int radeon_postinit(struct drm_device *dev, unsigned long flags);
-extern int radeon_postcleanup(struct drm_device *dev);
+extern int radeon_driver_load(struct drm_device *dev, unsigned long flags);
+extern int radeon_driver_unload(struct drm_device *dev);
+extern int radeon_driver_firstopen(struct drm_device *dev);
+extern void radeon_driver_preclose(drm_device_t * dev, DRMFILE filp);
+extern void radeon_driver_postclose(drm_device_t * dev, drm_file_t * filp);
+extern void radeon_driver_lastclose(drm_device_t * dev);
+extern int radeon_driver_open(drm_device_t * dev, drm_file_t * filp_priv);
 extern long radeon_compat_ioctl(struct file *filp, unsigned int cmd,
                                unsigned long arg);
@@ -364,6 +360,8 @@ extern int r300_do_cp_cmdbuf(drm_device_t * dev, DRMFILE filp,
 */
 #define RADEON_AGP_COMMAND              0x0f60
+#define RADEON_AGP_COMMAND_PCI_CONFIG   0x0060  /* offset in PCI config */
+#       define RADEON_AGP_ENABLE        (1<<8)
 #define RADEON_AUX_SCISSOR_CNTL         0x26f0
 #       define RADEON_EXCLUSIVE_SCISSOR_0       (1 << 24)
 #       define RADEON_EXCLUSIVE_SCISSOR_1       (1 << 25)
@@ -651,6 +649,8 @@ extern int r300_do_cp_cmdbuf(drm_device_t * dev, DRMFILE filp,
 #define RADEON_WAIT_UNTIL               0x1720
 #       define RADEON_WAIT_CRTC_PFLIP           (1 << 0)
+#       define RADEON_WAIT_2D_IDLE              (1 << 14)
+#       define RADEON_WAIT_3D_IDLE              (1 << 15)
 #       define RADEON_WAIT_2D_IDLECLEAN         (1 << 16)
 #       define RADEON_WAIT_3D_IDLECLEAN         (1 << 17)
 #       define RADEON_WAIT_HOST_IDLECLEAN       (1 << 18)
@@ -1105,7 +1105,6 @@ do {									\
                write = 0;                                      \
                _tab += _i;                                     \
        }                                                       \
-                                                                \
        while (_size > 0) {                                     \
                *(ring + write) = *_tab++;                      \
                write++;                                        \
diff --git a/drivers/char/drm/radeon_state.c b/drivers/char/drm/radeon_state.c
index 231ac1438c69..7bc27516d425 100644
--- a/drivers/char/drm/radeon_state.c
+++ b/drivers/char/drm/radeon_state.c
@@ -1,5 +1,5 @@
-/* radeon_state.c -- State support for Radeon -*- linux-c -*-
+/* radeon_state.c -- State support for Radeon -*- linux-c -*- */
- *
+/*
 * Copyright 2000 VA Linux Systems, Inc., Fremont, California.
 * All Rights Reserved.
 *
@@ -72,10 +72,7 @@ static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
        case RADEON_EMIT_PP_MISC:
                if (radeon_check_and_fixup_offset(dev_priv, filp_priv,
-                                                  &data[(RADEON_RB3D_DEPTHOFFSET
+                    &data[(RADEON_RB3D_DEPTHOFFSET - RADEON_PP_MISC) / 4])) {
-                                                         -
-                                                         RADEON_PP_MISC) /
-                                                        4])) {
                        DRM_ERROR("Invalid depth buffer offset\n");
                        return DRM_ERR(EINVAL);
                }
@@ -83,10 +80,7 @@ static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
        case RADEON_EMIT_PP_CNTL:
                if (radeon_check_and_fixup_offset(dev_priv, filp_priv,
-                                                  &data[(RADEON_RB3D_COLOROFFSET
+                    &data[(RADEON_RB3D_COLOROFFSET - RADEON_PP_CNTL) / 4])) {
-                                                         -
-                                                         RADEON_PP_CNTL) /
-                                                        4])) {
                        DRM_ERROR("Invalid colour buffer offset\n");
                        return DRM_ERR(EINVAL);
                }
@@ -109,10 +103,7 @@ static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
        case RADEON_EMIT_PP_TXFILTER_1:
        case RADEON_EMIT_PP_TXFILTER_2:
                if (radeon_check_and_fixup_offset(dev_priv, filp_priv,
-                                                  &data[(RADEON_PP_TXOFFSET_0
+                    &data[(RADEON_PP_TXOFFSET_0 - RADEON_PP_TXFILTER_0) / 4])) {
-                                                         -
-                                                         RADEON_PP_TXFILTER_0) /
-                                                        4])) {
                        DRM_ERROR("Invalid R100 texture offset\n");
                        return DRM_ERR(EINVAL);
                }
@@ -126,8 +117,9 @@ static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
        case R200_EMIT_PP_CUBIC_OFFSETS_5:{
                        int i;
                        for (i = 0; i < 5; i++) {
-                                if (radeon_check_and_fixup_offset
+                                if (radeon_check_and_fixup_offset(dev_priv,
-                                    (dev_priv, filp_priv, &data[i])) {
+                                                                  filp_priv,
+                                                                  &data[i])) {
                                        DRM_ERROR
                                            ("Invalid R200 cubic texture offset\n");
                                        return DRM_ERR(EINVAL);
@@ -239,8 +231,9 @@ static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
 static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
                                                     dev_priv,
-                                                     drm_file_t * filp_priv,
+                                                     drm_file_t *filp_priv,
-                                                     drm_radeon_kcmd_buffer_t *cmdbuf,
+                                                     drm_radeon_kcmd_buffer_t *
+                                                     cmdbuf,
                                                     unsigned int *cmdsz)
 {
        u32 *cmd = (u32 *) cmdbuf->buf;
@@ -555,7 +548,8 @@ static struct {
        {R200_PP_TXOFFSET_4, 1, "R200_PP_TXOFFSET_4"},
        {R200_PP_TXOFFSET_5, 1, "R200_PP_TXOFFSET_5"},
        {R200_SE_VTE_CNTL, 1, "R200_SE_VTE_CNTL"},
-        {R200_SE_TCL_OUTPUT_VTX_COMP_SEL, 1, "R200_SE_TCL_OUTPUT_VTX_COMP_SEL"},
+        {R200_SE_TCL_OUTPUT_VTX_COMP_SEL, 1,
+         "R200_SE_TCL_OUTPUT_VTX_COMP_SEL"},
        {R200_PP_TAM_DEBUG3, 1, "R200_PP_TAM_DEBUG3"},
        {R200_PP_CNTL_X, 1, "R200_PP_CNTL_X"},
        {R200_RB3D_DEPTHXY_OFFSET, 1, "R200_RB3D_DEPTHXY_OFFSET"},
@@ -569,7 +563,7 @@ static struct {
        {R200_SE_TCL_INPUT_VTX_VECTOR_ADDR_0, 4,
                    "R200_SE_TCL_INPUT_VTX_VECTOR_ADDR_0"},
        {R200_PP_CUBIC_FACES_0, 1, "R200_PP_CUBIC_FACES_0"},    /* 61 */
-        {R200_PP_CUBIC_OFFSET_F1_0, 5, "R200_PP_CUBIC_OFFSET_F1_0"},    /* 62 */
+        {R200_PP_CUBIC_OFFSET_F1_0, 5, "R200_PP_CUBIC_OFFSET_F1_0"}, /* 62 */
        {R200_PP_CUBIC_FACES_1, 1, "R200_PP_CUBIC_FACES_1"},
        {R200_PP_CUBIC_OFFSET_F1_1, 5, "R200_PP_CUBIC_OFFSET_F1_1"},
        {R200_PP_CUBIC_FACES_2, 1, "R200_PP_CUBIC_FACES_2"},
@@ -592,7 +586,7 @@ static struct {
        {RADEON_PP_CUBIC_FACES_2, 1, "RADEON_PP_CUBIC_FACES_2"},
        {RADEON_PP_CUBIC_OFFSET_T2_0, 5, "RADEON_PP_CUBIC_OFFSET_T2_0"},
        {R200_PP_TRI_PERF, 2, "R200_PP_TRI_PERF"},
-        {R200_PP_AFS_0, 32, "R200_PP_AFS_0"},   /* 85 */
+        {R200_PP_AFS_0, 32, "R200_PP_AFS_0"},     /* 85 */
        {R200_PP_AFS_1, 32, "R200_PP_AFS_1"},
        {R200_PP_TFACTOR_0, 8, "R200_ATF_TFACTOR"},
        {R200_PP_TXFILTER_0, 8, "R200_PP_TXCTLALL_0"},
@@ -985,8 +979,8 @@ static void radeon_cp_dispatch_clear(drm_device_t * dev,
         * rendering a quad into just those buffers.  Thus, we have to
         * make sure the 3D engine is configured correctly.
         */
-        if ((dev_priv->microcode_version == UCODE_R200) &&
+        else if ((dev_priv->microcode_version == UCODE_R200) &&
-            (flags & (RADEON_DEPTH | RADEON_STENCIL))) {
+                (flags & (RADEON_DEPTH | RADEON_STENCIL))) {
                int tempPP_CNTL;
                int tempRE_CNTL;
@@ -1637,6 +1631,14 @@ static int radeon_cp_dispatch_texture(DRMFILE filp,
                    (u32 *) ((char *)dev->agp_buffer_map->handle + buf->offset);
                dwords = size / 4;
+#define RADEON_COPY_MT(_buf, _data, _width) \
+        do { \
+                if (DRM_COPY_FROM_USER(_buf, _data, (_width))) {\
+                        DRM_ERROR("EFAULT on pad, %d bytes\n", (_width)); \
+                        return DRM_ERR(EFAULT); \
+                } \
+        } while(0)
                if (microtile) {
                        /* texture micro tiling in use, minimum texture width is thus 16 bytes.
                           however, we cannot use blitter directly for texture width < 64 bytes,
@@ -1648,46 +1650,19 @@ static int radeon_cp_dispatch_texture(DRMFILE filp,
                           from user space. */
                        if (tex->height == 1) {
                                if (tex_width >= 64 || tex_width <= 16) {
-                                        if (DRM_COPY_FROM_USER(buffer, data,
+                                        RADEON_COPY_MT(buffer, data,
-                                                               tex_width *
+                                                (int)(tex_width * sizeof(u32)));
-                                                               sizeof(u32))) {
-                                                DRM_ERROR
-                                                    ("EFAULT on pad, %d bytes\n",
-                                                     tex_width);
-                                                return DRM_ERR(EFAULT);
-                                        }
                                } else if (tex_width == 32) {
-                                        if (DRM_COPY_FROM_USER
+                                        RADEON_COPY_MT(buffer, data, 16);
-                                            (buffer, data, 16)) {
+                                        RADEON_COPY_MT(buffer + 8,
-                                                DRM_ERROR
+                                                       data + 16, 16);
-                                                    ("EFAULT on pad, %d bytes\n",
-                                                     tex_width);
-                                                return DRM_ERR(EFAULT);
-                                        }
-                                        if (DRM_COPY_FROM_USER
-                                            (buffer + 8, data + 16, 16)) {
-                                                DRM_ERROR
-                                                    ("EFAULT on pad, %d bytes\n",
-                                                     tex_width);
-                                                return DRM_ERR(EFAULT);
-                                        }
                                }
                        } else if (tex_width >= 64 || tex_width == 16) {
-                                if (DRM_COPY_FROM_USER(buffer, data,
+                                RADEON_COPY_MT(buffer, data,
-                                                       dwords * sizeof(u32))) {
+                                               (int)(dwords * sizeof(u32)));
-                                        DRM_ERROR("EFAULT on data, %d dwords\n",
-                                                  dwords);
-                                        return DRM_ERR(EFAULT);
-                                }
                        } else if (tex_width < 16) {
                                for (i = 0; i < tex->height; i++) {
-                                        if (DRM_COPY_FROM_USER
+                                        RADEON_COPY_MT(buffer, data, tex_width);
-                                            (buffer, data, tex_width)) {
-                                                DRM_ERROR
-                                                    ("EFAULT on pad, %d bytes\n",
-                                                     tex_width);
-                                                return DRM_ERR(EFAULT);
-                                        }
                                        buffer += 4;
                                        data += tex_width;
                                }
@@ -1695,37 +1670,13 @@ static int radeon_cp_dispatch_texture(DRMFILE filp,
                                /* TODO: make sure this works when not fitting in one buffer
                                   (i.e. 32bytes x 2048...) */
                                for (i = 0; i < tex->height; i += 2) {
-                                        if (DRM_COPY_FROM_USER
+                                        RADEON_COPY_MT(buffer, data, 16);
-                                            (buffer, data, 16)) {
-                                                DRM_ERROR
-                                                    ("EFAULT on pad, %d bytes\n",
-                                                     tex_width);
-                                                return DRM_ERR(EFAULT);
-                                        }
                                        data += 16;
-                                        if (DRM_COPY_FROM_USER
+                                        RADEON_COPY_MT(buffer + 8, data, 16);
-                                            (buffer + 8, data, 16)) {
-                                                DRM_ERROR
-                                                    ("EFAULT on pad, %d bytes\n",
-                                                     tex_width);
-                                                return DRM_ERR(EFAULT);
-                                        }
                                        data += 16;
-                                        if (DRM_COPY_FROM_USER
+                                        RADEON_COPY_MT(buffer + 4, data, 16);
-                                            (buffer + 4, data, 16)) {
-                                                DRM_ERROR
-                                                    ("EFAULT on pad, %d bytes\n",
-                                                     tex_width);
-                                                return DRM_ERR(EFAULT);
-                                        }
                                        data += 16;
-                                        if (DRM_COPY_FROM_USER
+                                        RADEON_COPY_MT(buffer + 12, data, 16);
-                                            (buffer + 12, data, 16)) {
-                                                DRM_ERROR
-                                                    ("EFAULT on pad, %d bytes\n",
-                                                     tex_width);
-                                                return DRM_ERR(EFAULT);
-                                        }
                                        data += 16;
                                        buffer += 16;
                                }
@@ -1735,31 +1686,22 @@ static int radeon_cp_dispatch_texture(DRMFILE filp,
                                /* Texture image width is larger than the minimum, so we
                                 * can upload it directly.
                                 */
-                                if (DRM_COPY_FROM_USER(buffer, data,
+                                RADEON_COPY_MT(buffer, data,
-                                                       dwords * sizeof(u32))) {
+                                               (int)(dwords * sizeof(u32)));
-                                        DRM_ERROR("EFAULT on data, %d dwords\n",
-                                                  dwords);
-                                        return DRM_ERR(EFAULT);
-                                }
                        } else {
                                /* Texture image width is less than the minimum, so we
                                 * need to pad out each image scanline to the minimum
                                 * width.
                                 */
                                for (i = 0; i < tex->height; i++) {
-                                        if (DRM_COPY_FROM_USER
+                                        RADEON_COPY_MT(buffer, data, tex_width);
-                                            (buffer, data, tex_width)) {
-                                                DRM_ERROR
-                                                    ("EFAULT on pad, %d bytes\n",
-                                                     tex_width);
-                                                return DRM_ERR(EFAULT);
-                                        }
                                        buffer += 8;
                                        data += tex_width;
                                }
                        }
                }
+#undef RADEON_COPY_MT
                buf->filp = filp;
                buf->used = size;
                offset = dev_priv->gart_buffers_offset + buf->offset;
@@ -1821,7 +1763,7 @@ static void radeon_cp_dispatch_stipple(drm_device_t * dev, u32 * stipple)
 }
 static void radeon_apply_surface_regs(int surf_index,
-                                      drm_radeon_private_t * dev_priv)
+                                      drm_radeon_private_t *dev_priv)
 {
        if (!dev_priv->mmio)
                return;
@@ -1847,8 +1789,8 @@ static void radeon_apply_surface_regs(int surf_index,
 * freed, we suddenly need two surfaces to store A and C, which might
 * not always be available.
 */
-static int alloc_surface(drm_radeon_surface_alloc_t * new,
+static int alloc_surface(drm_radeon_surface_alloc_t *new,
-                         drm_radeon_private_t * dev_priv, DRMFILE filp)
+                         drm_radeon_private_t *dev_priv, DRMFILE filp)
 {
        struct radeon_virt_surface *s;
        int i;
@@ -2158,6 +2100,11 @@ static int radeon_cp_vertex(DRM_IOCTL_ARGS)
        LOCK_TEST_WITH_RETURN(dev, filp);
+        if (!dev_priv) {
+                DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
+                return DRM_ERR(EINVAL);
+        }
        DRM_GET_PRIV_WITH_RETURN(filp_priv, filp);
        DRM_COPY_FROM_USER_IOCTL(vertex, (drm_radeon_vertex_t __user *) data,
@@ -2596,9 +2543,9 @@ static int radeon_emit_packets(drm_radeon_private_t * dev_priv,
        return 0;
 }
-static __inline__ int radeon_emit_scalars(drm_radeon_private_t * dev_priv,
+static __inline__ int radeon_emit_scalars(drm_radeon_private_t *dev_priv,
                                          drm_radeon_cmd_header_t header,
-                                          drm_radeon_kcmd_buffer_t * cmdbuf)
+                                          drm_radeon_kcmd_buffer_t *cmdbuf)
 {
        int sz = header.scalars.count;
        int start = header.scalars.offset;
@@ -2618,9 +2565,9 @@ static __inline__ int radeon_emit_scalars(drm_radeon_private_t * dev_priv,
 /* God this is ugly
 */
-static __inline__ int radeon_emit_scalars2(drm_radeon_private_t * dev_priv,
+static __inline__ int radeon_emit_scalars2(drm_radeon_private_t *dev_priv,
                                           drm_radeon_cmd_header_t header,
-                                           drm_radeon_kcmd_buffer_t * cmdbuf)
+                                           drm_radeon_kcmd_buffer_t *cmdbuf)
 {
        int sz = header.scalars.count;
        int start = ((unsigned int)header.scalars.offset) + 0x100;
@@ -2638,9 +2585,9 @@ static __inline__ int radeon_emit_scalars2(drm_radeon_private_t * dev_priv,
        return 0;
 }
-static __inline__ int radeon_emit_vectors(drm_radeon_private_t * dev_priv,
+static __inline__ int radeon_emit_vectors(drm_radeon_private_t *dev_priv,
                                          drm_radeon_cmd_header_t header,
-                                          drm_radeon_kcmd_buffer_t * cmdbuf)
+                                          drm_radeon_kcmd_buffer_t *cmdbuf)
 {
        int sz = header.vectors.count;
        int start = header.vectors.offset;
@@ -2685,8 +2632,8 @@ static int radeon_emit_packet3(drm_device_t * dev,
        return 0;
 }
-static int radeon_emit_packet3_cliprect(drm_device_t * dev,
+static int radeon_emit_packet3_cliprect(drm_device_t *dev,
-                                        drm_file_t * filp_priv,
+                                        drm_file_t *filp_priv,
                                        drm_radeon_kcmd_buffer_t *cmdbuf,
                                        int orig_nbox)
 {
@@ -2818,7 +2765,8 @@ static int radeon_cp_cmdbuf(DRM_IOCTL_ARGS)
                kbuf = drm_alloc(cmdbuf.bufsz, DRM_MEM_DRIVER);
                if (kbuf == NULL)
                        return DRM_ERR(ENOMEM);
-                if (DRM_COPY_FROM_USER(kbuf, (void __user *)cmdbuf.buf, cmdbuf.bufsz)) {
+                if (DRM_COPY_FROM_USER(kbuf, (void __user *)cmdbuf.buf,
+                                       cmdbuf.bufsz)) {
                        drm_free(kbuf, orig_bufsz, DRM_MEM_DRIVER);
                        return DRM_ERR(EFAULT);
                }
@@ -2981,7 +2929,7 @@ static int radeon_cp_getparam(DRM_IOCTL_ARGS)
                value = dev_priv->gart_vm_start;
                break;
        case RADEON_PARAM_REGISTER_HANDLE:
-                value = dev_priv->mmio_offset;
+                value = dev_priv->mmio->offset;
                break;
        case RADEON_PARAM_STATUS_HANDLE:
                value = dev_priv->ring_rptr_offset;
@@ -3004,6 +2952,15 @@ static int radeon_cp_getparam(DRM_IOCTL_ARGS)
        case RADEON_PARAM_GART_TEX_HANDLE:
                value = dev_priv->gart_textures_offset;
                break;
+        
+        case RADEON_PARAM_CARD_TYPE:
+                if (dev_priv->flags & CHIP_IS_PCIE)
+                        value = RADEON_CARD_PCIE;
+                else if (dev_priv->flags & CHIP_IS_AGP)
+                        value = RADEON_CARD_AGP;
+                else
+                        value = RADEON_CARD_PCI;
+                break;
        default:
                return DRM_ERR(EINVAL);
        }
@@ -3066,10 +3023,11 @@ static int radeon_cp_setparam(DRM_IOCTL_ARGS)
 /* When a client dies:
 *    - Check for and clean up flipped page state
 *    - Free any alloced GART memory.
+ *    - Free any alloced radeon surfaces.
 *
 * DRM infrastructure takes care of reclaiming dma buffers.
 */
-void radeon_driver_prerelease(drm_device_t * dev, DRMFILE filp)
+void radeon_driver_preclose(drm_device_t * dev, DRMFILE filp)
 {
        if (dev->dev_private) {
                drm_radeon_private_t *dev_priv = dev->dev_private;
@@ -3082,16 +3040,17 @@ void radeon_driver_prerelease(drm_device_t * dev, DRMFILE filp)
        }
 }
-void radeon_driver_pretakedown(drm_device_t * dev)
+void radeon_driver_lastclose(drm_device_t * dev)
 {
        radeon_do_release(dev);
 }
-int radeon_driver_open_helper(drm_device_t * dev, drm_file_t * filp_priv)
+int radeon_driver_open(drm_device_t * dev, drm_file_t * filp_priv)
 {
        drm_radeon_private_t *dev_priv = dev->dev_private;
        struct drm_radeon_driver_file_fields *radeon_priv;
+        DRM_DEBUG("\n");
        radeon_priv =
            (struct drm_radeon_driver_file_fields *)
            drm_alloc(sizeof(*radeon_priv), DRM_MEM_FILES);
@@ -3100,6 +3059,7 @@ int radeon_driver_open_helper(drm_device_t * dev, drm_file_t * filp_priv)
                return -ENOMEM;
        filp_priv->driver_priv = radeon_priv;
        if (dev_priv)
                radeon_priv->radeon_fb_delta = dev_priv->fb_location;
        else
@@ -3107,7 +3067,7 @@ int radeon_driver_open_helper(drm_device_t * dev, drm_file_t * filp_priv)
        return 0;
 }
-void radeon_driver_free_filp_priv(drm_device_t * dev, drm_file_t * filp_priv)
+void radeon_driver_postclose(drm_device_t * dev, drm_file_t * filp_priv)
 {
        struct drm_radeon_driver_file_fields *radeon_priv =
            filp_priv->driver_priv;
@@ -3116,33 +3076,33 @@ void radeon_driver_free_filp_priv(drm_device_t * dev, drm_file_t * filp_priv)
 }
 drm_ioctl_desc_t radeon_ioctls[] = {
-        [DRM_IOCTL_NR(DRM_RADEON_CP_INIT)] = {radeon_cp_init, 1, 1},
+        [DRM_IOCTL_NR(DRM_RADEON_CP_INIT)] = {radeon_cp_init, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_RADEON_CP_START)] = {radeon_cp_start, 1, 1},
+        [DRM_IOCTL_NR(DRM_RADEON_CP_START)] = {radeon_cp_start, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_RADEON_CP_STOP)] = {radeon_cp_stop, 1, 1},
+        [DRM_IOCTL_NR(DRM_RADEON_CP_STOP)] = {radeon_cp_stop, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_RADEON_CP_RESET)] = {radeon_cp_reset, 1, 1},
+        [DRM_IOCTL_NR(DRM_RADEON_CP_RESET)] = {radeon_cp_reset, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_RADEON_CP_IDLE)] = {radeon_cp_idle, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_CP_IDLE)] = {radeon_cp_idle, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_CP_RESUME)] = {radeon_cp_resume, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_CP_RESUME)] = {radeon_cp_resume, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_RESET)] = {radeon_engine_reset, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_RESET)] = {radeon_engine_reset, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_FULLSCREEN)] = {radeon_fullscreen, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_FULLSCREEN)] = {radeon_fullscreen, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_SWAP)] = {radeon_cp_swap, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_SWAP)] = {radeon_cp_swap, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_CLEAR)] = {radeon_cp_clear, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_CLEAR)] = {radeon_cp_clear, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_VERTEX)] = {radeon_cp_vertex, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_VERTEX)] = {radeon_cp_vertex, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_INDICES)] = {radeon_cp_indices, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_INDICES)] = {radeon_cp_indices, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_TEXTURE)] = {radeon_cp_texture, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_TEXTURE)] = {radeon_cp_texture, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_STIPPLE)] = {radeon_cp_stipple, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_STIPPLE)] = {radeon_cp_stipple, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_INDIRECT)] = {radeon_cp_indirect, 1, 1},
+        [DRM_IOCTL_NR(DRM_RADEON_INDIRECT)] = {radeon_cp_indirect, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_RADEON_VERTEX2)] = {radeon_cp_vertex2, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_VERTEX2)] = {radeon_cp_vertex2, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_CMDBUF)] = {radeon_cp_cmdbuf, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_CMDBUF)] = {radeon_cp_cmdbuf, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_GETPARAM)] = {radeon_cp_getparam, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_GETPARAM)] = {radeon_cp_getparam, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_FLIP)] = {radeon_cp_flip, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_FLIP)] = {radeon_cp_flip, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_ALLOC)] = {radeon_mem_alloc, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_ALLOC)] = {radeon_mem_alloc, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_FREE)] = {radeon_mem_free, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_FREE)] = {radeon_mem_free, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_INIT_HEAP)] = {radeon_mem_init_heap, 1, 1},
+        [DRM_IOCTL_NR(DRM_RADEON_INIT_HEAP)] = {radeon_mem_init_heap, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_RADEON_IRQ_EMIT)] = {radeon_irq_emit, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_IRQ_EMIT)] = {radeon_irq_emit, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_IRQ_WAIT)] = {radeon_irq_wait, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_IRQ_WAIT)] = {radeon_irq_wait, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_SETPARAM)] = {radeon_cp_setparam, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_SETPARAM)] = {radeon_cp_setparam, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_SURF_ALLOC)] = {radeon_surface_alloc, 1, 0},
+        [DRM_IOCTL_NR(DRM_RADEON_SURF_ALLOC)] = {radeon_surface_alloc, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_RADEON_SURF_FREE)] = {radeon_surface_free, 1, 0}
+        [DRM_IOCTL_NR(DRM_RADEON_SURF_FREE)] = {radeon_surface_free, DRM_AUTH}
 };
 int radeon_max_ioctl = DRM_ARRAY_SIZE(radeon_ioctls);
diff --git a/drivers/char/drm/savage_bci.c b/drivers/char/drm/savage_bci.c
index 6d10515795cc..0d426deeefec 100644
--- a/drivers/char/drm/savage_bci.c
+++ b/drivers/char/drm/savage_bci.c
@@ -533,16 +533,32 @@ static void savage_fake_dma_flush(drm_savage_private_t * dev_priv)
        dev_priv->first_dma_page = dev_priv->current_dma_page = 0;
 }
+int savage_driver_load(drm_device_t *dev, unsigned long chipset)
+{
+        drm_savage_private_t *dev_priv;
+        dev_priv = drm_alloc(sizeof(drm_savage_private_t), DRM_MEM_DRIVER);
+        if (dev_priv == NULL)
+                return DRM_ERR(ENOMEM);
+        memset(dev_priv, 0, sizeof(drm_savage_private_t));
+        dev->dev_private = (void *)dev_priv;
+        dev_priv->chipset = (enum savage_family)chipset;
+        return 0;
+}
 /*
 * Initalize mappings. On Savage4 and SavageIX the alignment
 * and size of the aperture is not suitable for automatic MTRR setup
- * in drm_addmap. Therefore we do it manually before the maps are
+ * in drm_addmap. Therefore we add them manually before the maps are
- * initialized. We also need to take care of deleting the MTRRs in
+ * initialized, and tear them down on last close.
- * postcleanup.
 */
-int savage_preinit(drm_device_t * dev, unsigned long chipset)
+int savage_driver_firstopen(drm_device_t *dev)
 {
-        drm_savage_private_t *dev_priv;
+        drm_savage_private_t *dev_priv = dev->dev_private;
        unsigned long mmio_base, fb_base, fb_size, aperture_base;
        /* fb_rsrc and aper_rsrc aren't really used currently, but still exist
         * in case we decide we need information on the BAR for BSD in the
@@ -551,14 +567,6 @@ int savage_preinit(drm_device_t * dev, unsigned long chipset)
        unsigned int fb_rsrc, aper_rsrc;
        int ret = 0;
-        dev_priv = drm_alloc(sizeof(drm_savage_private_t), DRM_MEM_DRIVER);
-        if (dev_priv == NULL)
-                return DRM_ERR(ENOMEM);
-        memset(dev_priv, 0, sizeof(drm_savage_private_t));
-        dev->dev_private = (void *)dev_priv;
-        dev_priv->chipset = (enum savage_family)chipset;
        dev_priv->mtrr[0].handle = -1;
        dev_priv->mtrr[1].handle = -1;
        dev_priv->mtrr[2].handle = -1;
@@ -576,26 +584,24 @@ int savage_preinit(drm_device_t * dev, unsigned long chipset)
                        dev_priv->mtrr[0].base = fb_base;
                        dev_priv->mtrr[0].size = 0x01000000;
                        dev_priv->mtrr[0].handle =
-                            mtrr_add(dev_priv->mtrr[0].base,
+                            drm_mtrr_add(dev_priv->mtrr[0].base,
-                                     dev_priv->mtrr[0].size, MTRR_TYPE_WRCOMB,
+                                         dev_priv->mtrr[0].size, DRM_MTRR_WC);
-                                     1);
                        dev_priv->mtrr[1].base = fb_base + 0x02000000;
                        dev_priv->mtrr[1].size = 0x02000000;
                        dev_priv->mtrr[1].handle =
-                            mtrr_add(dev_priv->mtrr[1].base,
+                            drm_mtrr_add(dev_priv->mtrr[1].base,
-                                     dev_priv->mtrr[1].size, MTRR_TYPE_WRCOMB,
+                                         dev_priv->mtrr[1].size, DRM_MTRR_WC);
-                                     1);
                        dev_priv->mtrr[2].base = fb_base + 0x04000000;
                        dev_priv->mtrr[2].size = 0x04000000;
                        dev_priv->mtrr[2].handle =
-                            mtrr_add(dev_priv->mtrr[2].base,
+                            drm_mtrr_add(dev_priv->mtrr[2].base,
-                                     dev_priv->mtrr[2].size, MTRR_TYPE_WRCOMB,
+                                         dev_priv->mtrr[2].size, DRM_MTRR_WC);
-                                     1);
                } else {
                        DRM_ERROR("strange pci_resource_len %08lx\n",
                                  drm_get_resource_len(dev, 0));
                }
-        } else if (chipset != S3_SUPERSAVAGE && chipset != S3_SAVAGE2000) {
+        } else if (dev_priv->chipset != S3_SUPERSAVAGE &&
+                   dev_priv->chipset != S3_SAVAGE2000) {
                mmio_base = drm_get_resource_start(dev, 0);
                fb_rsrc = 1;
                fb_base = drm_get_resource_start(dev, 1);
@@ -609,9 +615,8 @@ int savage_preinit(drm_device_t * dev, unsigned long chipset)
                        dev_priv->mtrr[0].base = fb_base;
                        dev_priv->mtrr[0].size = 0x08000000;
                        dev_priv->mtrr[0].handle =
-                            mtrr_add(dev_priv->mtrr[0].base,
+                            drm_mtrr_add(dev_priv->mtrr[0].base,
-                                     dev_priv->mtrr[0].size, MTRR_TYPE_WRCOMB,
+                                         dev_priv->mtrr[0].size, DRM_MTRR_WC);
-                                     1);
                } else {
                        DRM_ERROR("strange pci_resource_len %08lx\n",
                                  drm_get_resource_len(dev, 1));
@@ -648,16 +653,21 @@ int savage_preinit(drm_device_t * dev, unsigned long chipset)
 /*
 * Delete MTRRs and free device-private data.
 */
-int savage_postcleanup(drm_device_t * dev)
+void savage_driver_lastclose(drm_device_t *dev)
 {
        drm_savage_private_t *dev_priv = dev->dev_private;
        int i;
        for (i = 0; i < 3; ++i)
                if (dev_priv->mtrr[i].handle >= 0)
-                        mtrr_del(dev_priv->mtrr[i].handle,
+                        drm_mtrr_del(dev_priv->mtrr[i].handle,
                                 dev_priv->mtrr[i].base,
-                                 dev_priv->mtrr[i].size);
+                                 dev_priv->mtrr[i].size, DRM_MTRR_WC);
+}
+int savage_driver_unload(drm_device_t *dev)
+{
+        drm_savage_private_t *dev_priv = dev->dev_private;
        drm_free(dev_priv, sizeof(drm_savage_private_t), DRM_MEM_DRIVER);
@@ -994,8 +1004,7 @@ static int savage_bci_event_wait(DRM_IOCTL_ARGS)
 * DMA buffer management
 */
-static int savage_bci_get_buffers(DRMFILE filp, drm_device_t * dev,
+static int savage_bci_get_buffers(DRMFILE filp, drm_device_t *dev, drm_dma_t *d)
-                                  drm_dma_t * d)
 {
        drm_buf_t *buf;
        int i;
@@ -1057,7 +1066,7 @@ int savage_bci_buffers(DRM_IOCTL_ARGS)
        return ret;
 }
-void savage_reclaim_buffers(drm_device_t * dev, DRMFILE filp)
+void savage_reclaim_buffers(drm_device_t *dev, DRMFILE filp)
 {
        drm_device_dma_t *dma = dev->dma;
        drm_savage_private_t *dev_priv = dev->dev_private;
@@ -1090,10 +1099,10 @@ void savage_reclaim_buffers(drm_device_t * dev, DRMFILE filp)
 }
 drm_ioctl_desc_t savage_ioctls[] = {
-        [DRM_IOCTL_NR(DRM_SAVAGE_BCI_INIT)] = {savage_bci_init, 1, 1},
+        [DRM_IOCTL_NR(DRM_SAVAGE_BCI_INIT)] = {savage_bci_init, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_SAVAGE_BCI_CMDBUF)] = {savage_bci_cmdbuf, 1, 0},
+        [DRM_IOCTL_NR(DRM_SAVAGE_BCI_CMDBUF)] = {savage_bci_cmdbuf, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_SAVAGE_BCI_EVENT_EMIT)] = {savage_bci_event_emit, 1, 0},
+        [DRM_IOCTL_NR(DRM_SAVAGE_BCI_EVENT_EMIT)] = {savage_bci_event_emit, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_SAVAGE_BCI_EVENT_WAIT)] = {savage_bci_event_wait, 1, 0},
+        [DRM_IOCTL_NR(DRM_SAVAGE_BCI_EVENT_WAIT)] = {savage_bci_event_wait, DRM_AUTH},
 };
 int savage_max_ioctl = DRM_ARRAY_SIZE(savage_ioctls);
diff --git a/drivers/char/drm/savage_drv.c b/drivers/char/drm/savage_drv.c
index 22d799cde41c..aa6c0d1a82f8 100644
--- a/drivers/char/drm/savage_drv.c
+++ b/drivers/char/drm/savage_drv.c
@@ -30,31 +30,6 @@
 #include "drm_pciids.h"
-static int postinit(struct drm_device *dev, unsigned long flags)
-{
-        DRM_INFO("Initialized %s %d.%d.%d %s on minor %d: %s\n",
-                 DRIVER_NAME,
-                 DRIVER_MAJOR,
-                 DRIVER_MINOR,
-                 DRIVER_PATCHLEVEL,
-                 DRIVER_DATE, dev->primary.minor, pci_pretty_name(dev->pdev)
-            );
-        return 0;
-}
-static int version(drm_version_t * version)
-{
-        int len;
-        version->version_major = DRIVER_MAJOR;
-        version->version_minor = DRIVER_MINOR;
-        version->version_patchlevel = DRIVER_PATCHLEVEL;
-        DRM_COPY(version->name, DRIVER_NAME);
-        DRM_COPY(version->date, DRIVER_DATE);
-        DRM_COPY(version->desc, DRIVER_DESC);
-        return 0;
-}
 static struct pci_device_id pciidlist[] = {
        savage_PCI_IDS
 };
@@ -63,13 +38,13 @@ static struct drm_driver driver = {
        .driver_features =
            DRIVER_USE_AGP | DRIVER_USE_MTRR | DRIVER_HAVE_DMA | DRIVER_PCI_DMA,
        .dev_priv_size = sizeof(drm_savage_buf_priv_t),
-        .preinit = savage_preinit,
+        .load = savage_driver_load,
-        .postinit = postinit,
+        .firstopen = savage_driver_firstopen,
-        .postcleanup = savage_postcleanup,
+        .lastclose = savage_driver_lastclose,
+        .unload = savage_driver_unload,
        .reclaim_buffers = savage_reclaim_buffers,
        .get_map_ofs = drm_core_get_map_ofs,
        .get_reg_ofs = drm_core_get_reg_ofs,
-        .version = version,
        .ioctls = savage_ioctls,
        .dma_ioctl = savage_bci_buffers,
        .fops = {
@@ -80,12 +55,19 @@ static struct drm_driver driver = {
                 .mmap = drm_mmap,
                 .poll = drm_poll,
                 .fasync = drm_fasync,
-                 }
+        },
-        ,
        .pci_driver = {
-                       .name = DRIVER_NAME,
+                 .name = DRIVER_NAME,
-                       .id_table = pciidlist,
+                 .id_table = pciidlist,
-                       }
+        },
+        .name = DRIVER_NAME,
+        .desc = DRIVER_DESC,
+        .date = DRIVER_DATE,
+        .major = DRIVER_MAJOR,
+        .minor = DRIVER_MINOR,
+        .patchlevel = DRIVER_PATCHLEVEL,
 };
 static int __init savage_init(void)
diff --git a/drivers/char/drm/savage_drv.h b/drivers/char/drm/savage_drv.h
index a4b0fa998a95..dd46cb85439c 100644
--- a/drivers/char/drm/savage_drv.h
+++ b/drivers/char/drm/savage_drv.h
@@ -1,5 +1,5 @@
-/* savage_drv.h -- Private header for the savage driver
+/* savage_drv.h -- Private header for the savage driver */
- *
+/*
 * Copyright 2004  Felix Kuehling
 * All Rights Reserved.
 *
@@ -192,7 +192,7 @@ typedef struct drm_savage_private {
        /* Err, there is a macro wait_event in include/linux/wait.h.
         * Avoid unwanted macro expansion. */
        void (*emit_clip_rect) (struct drm_savage_private * dev_priv,
-                                drm_clip_rect_t * pbox);
+                                const drm_clip_rect_t * pbox);
        void (*dma_flush) (struct drm_savage_private * dev_priv);
 } drm_savage_private_t;
@@ -208,16 +208,18 @@ extern void savage_dma_reset(drm_savage_private_t * dev_priv);
 extern void savage_dma_wait(drm_savage_private_t * dev_priv, unsigned int page);
 extern uint32_t *savage_dma_alloc(drm_savage_private_t * dev_priv,
                                  unsigned int n);
-extern int savage_preinit(drm_device_t * dev, unsigned long chipset);
+extern int savage_driver_load(drm_device_t *dev, unsigned long chipset);
-extern int savage_postcleanup(drm_device_t * dev);
+extern int savage_driver_firstopen(drm_device_t *dev);
+extern void savage_driver_lastclose(drm_device_t *dev);
+extern int savage_driver_unload(drm_device_t *dev);
 extern int savage_do_cleanup_bci(drm_device_t * dev);
 extern void savage_reclaim_buffers(drm_device_t * dev, DRMFILE filp);
 /* state functions */
 extern void savage_emit_clip_rect_s3d(drm_savage_private_t * dev_priv,
-                                      drm_clip_rect_t * pbox);
+                                      const drm_clip_rect_t * pbox);
 extern void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv,
-                                     drm_clip_rect_t * pbox);
+                                     const drm_clip_rect_t * pbox);
 #define SAVAGE_FB_SIZE_S3       0x01000000      /*  16MB */
 #define SAVAGE_FB_SIZE_S4       0x02000000      /*  32MB */
@@ -500,15 +502,6 @@ extern void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv,
 #define BCI_WRITE( val ) *bci_ptr++ = (uint32_t)(val)
-#define BCI_COPY_FROM_USER(src,n) do {                          \
-    unsigned int i;                                             \
-    for (i = 0; i < n; ++i) {                                   \
-        uint32_t val;                                           \
-        DRM_GET_USER_UNCHECKED(val, &((uint32_t*)(src))[i]);    \
-        BCI_WRITE(val);                                         \
-    }                                                           \
-} while(0)
 /*
 * command DMA support
 */
@@ -534,8 +527,8 @@ extern void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv,
 #define DMA_WRITE( val ) *dma_ptr++ = (uint32_t)(val)
-#define DMA_COPY_FROM_USER(src,n) do {                          \
+#define DMA_COPY(src, n) do {                                   \
-        DRM_COPY_FROM_USER_UNCHECKED(dma_ptr, (src), (n)*4);    \
+        memcpy(dma_ptr, (src), (n)*4);                          \
        dma_ptr += n;                                           \
 } while(0)
diff --git a/drivers/char/drm/savage_state.c b/drivers/char/drm/savage_state.c
index e87a5d59b99c..ef2581d16146 100644
--- a/drivers/char/drm/savage_state.c
+++ b/drivers/char/drm/savage_state.c
@@ -27,7 +27,7 @@
 #include "savage_drv.h"
 void savage_emit_clip_rect_s3d(drm_savage_private_t * dev_priv,
-                               drm_clip_rect_t * pbox)
+                               const drm_clip_rect_t * pbox)
 {
        uint32_t scstart = dev_priv->state.s3d.new_scstart;
        uint32_t scend = dev_priv->state.s3d.new_scend;
@@ -53,7 +53,7 @@ void savage_emit_clip_rect_s3d(drm_savage_private_t * dev_priv,
 }
 void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv,
-                              drm_clip_rect_t * pbox)
+                              const drm_clip_rect_t * pbox)
 {
        uint32_t drawctrl0 = dev_priv->state.s4.new_drawctrl0;
        uint32_t drawctrl1 = dev_priv->state.s4.new_drawctrl1;
@@ -115,18 +115,19 @@ static int savage_verify_texaddr(drm_savage_private_t * dev_priv, int unit,
 #define SAVE_STATE(reg,where)                   \
        if(start <= reg && start+count > reg)   \
-                DRM_GET_USER_UNCHECKED(dev_priv->state.where, &regs[reg-start])
+                dev_priv->state.where = regs[reg - start]
 #define SAVE_STATE_MASK(reg,where,mask) do {                    \
        if(start <= reg && start+count > reg) {                 \
                uint32_t tmp;                                   \
-                DRM_GET_USER_UNCHECKED(tmp, &regs[reg-start]);  \
+                tmp = regs[reg - start];                        \
                dev_priv->state.where = (tmp & (mask)) |        \
                        (dev_priv->state.where & ~(mask));      \
        }                                                       \
 } while (0)
 static int savage_verify_state_s3d(drm_savage_private_t * dev_priv,
                                   unsigned int start, unsigned int count,
-                                   const uint32_t __user * regs)
+                                   const uint32_t *regs)
 {
        if (start < SAVAGE_TEXPALADDR_S3D ||
            start + count - 1 > SAVAGE_DESTTEXRWWATERMARK_S3D) {
@@ -148,8 +149,7 @@ static int savage_verify_state_s3d(drm_savage_private_t * dev_priv,
                SAVE_STATE(SAVAGE_TEXADDR_S3D, s3d.texaddr);
                if (dev_priv->state.s3d.texctrl & SAVAGE_TEXCTRL_TEXEN_MASK)
                        return savage_verify_texaddr(dev_priv, 0,
-                                                     dev_priv->state.s3d.
+                                                dev_priv->state.s3d.texaddr);
-                                                     texaddr);
        }
        return 0;
@@ -157,7 +157,7 @@ static int savage_verify_state_s3d(drm_savage_private_t * dev_priv,
 static int savage_verify_state_s4(drm_savage_private_t * dev_priv,
                                  unsigned int start, unsigned int count,
-                                  const uint32_t __user * regs)
+                                  const uint32_t *regs)
 {
        int ret = 0;
@@ -174,19 +174,18 @@ static int savage_verify_state_s4(drm_savage_private_t * dev_priv,
                        ~SAVAGE_SCISSOR_MASK_S4);
        /* if any texture regs were changed ... */
-        if (start <= SAVAGE_TEXDESCR_S4 && start + count > SAVAGE_TEXPALADDR_S4) {
+        if (start <= SAVAGE_TEXDESCR_S4 &&
+            start + count > SAVAGE_TEXPALADDR_S4) {
                /* ... check texture state */
                SAVE_STATE(SAVAGE_TEXDESCR_S4, s4.texdescr);
                SAVE_STATE(SAVAGE_TEXADDR0_S4, s4.texaddr0);
                SAVE_STATE(SAVAGE_TEXADDR1_S4, s4.texaddr1);
                if (dev_priv->state.s4.texdescr & SAVAGE_TEXDESCR_TEX0EN_MASK)
-                        ret |=
+                        ret |= savage_verify_texaddr(dev_priv, 0,
-                            savage_verify_texaddr(dev_priv, 0,
+                                                dev_priv->state.s4.texaddr0);
-                                                  dev_priv->state.s4.texaddr0);
                if (dev_priv->state.s4.texdescr & SAVAGE_TEXDESCR_TEX1EN_MASK)
-                        ret |=
+                        ret |= savage_verify_texaddr(dev_priv, 1,
-                            savage_verify_texaddr(dev_priv, 1,
+                                                dev_priv->state.s4.texaddr1);
-                                                  dev_priv->state.s4.texaddr1);
        }
        return ret;
@@ -197,7 +196,7 @@ static int savage_verify_state_s4(drm_savage_private_t * dev_priv,
 static int savage_dispatch_state(drm_savage_private_t * dev_priv,
                                 const drm_savage_cmd_header_t * cmd_header,
-                                 const uint32_t __user * regs)
+                                 const uint32_t *regs)
 {
        unsigned int count = cmd_header->state.count;
        unsigned int start = cmd_header->state.start;
@@ -209,9 +208,6 @@ static int savage_dispatch_state(drm_savage_private_t * dev_priv,
        if (!count)
                return 0;
-        if (DRM_VERIFYAREA_READ(regs, count * 4))
-                return DRM_ERR(EFAULT);
        if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
                ret = savage_verify_state_s3d(dev_priv, start, count, regs);
                if (ret != 0)
@@ -236,8 +232,8 @@ static int savage_dispatch_state(drm_savage_private_t * dev_priv,
                /* scissor regs are emitted in savage_dispatch_draw */
                if (start < SAVAGE_DRAWCTRL0_S4) {
                        if (start + count > SAVAGE_DRAWCTRL1_S4 + 1)
-                                count2 =
+                                count2 = count -
-                                    count - (SAVAGE_DRAWCTRL1_S4 + 1 - start);
+                                         (SAVAGE_DRAWCTRL1_S4 + 1 - start);
                        if (start + count > SAVAGE_DRAWCTRL0_S4)
                                count = SAVAGE_DRAWCTRL0_S4 - start;
                } else if (start <= SAVAGE_DRAWCTRL1_S4) {
@@ -263,7 +259,7 @@ static int savage_dispatch_state(drm_savage_private_t * dev_priv,
                while (count > 0) {
                        unsigned int n = count < 255 ? count : 255;
                        DMA_SET_REGISTERS(start, n);
-                        DMA_COPY_FROM_USER(regs, n);
+                        DMA_COPY(regs, n);
                        count -= n;
                        start += n;
                        regs += n;
@@ -421,8 +417,8 @@ static int savage_dispatch_dma_prim(drm_savage_private_t * dev_priv,
 static int savage_dispatch_vb_prim(drm_savage_private_t * dev_priv,
                                   const drm_savage_cmd_header_t * cmd_header,
-                                   const uint32_t __user * vtxbuf,
+                                   const uint32_t *vtxbuf, unsigned int vb_size,
-                                   unsigned int vb_size, unsigned int vb_stride)
+                                   unsigned int vb_stride)
 {
        unsigned char reorder = 0;
        unsigned int prim = cmd_header->prim.prim;
@@ -507,8 +503,7 @@ static int savage_dispatch_vb_prim(drm_savage_private_t * dev_priv,
                        for (i = start; i < start + count; ++i) {
                                unsigned int j = i + reorder[i % 3];
-                                DMA_COPY_FROM_USER(&vtxbuf[vb_stride * j],
+                                DMA_COPY(&vtxbuf[vb_stride * j], vtx_size);
-                                                   vtx_size);
                        }
                        DMA_COMMIT();
@@ -517,13 +512,12 @@ static int savage_dispatch_vb_prim(drm_savage_private_t * dev_priv,
                        DMA_DRAW_PRIMITIVE(count, prim, skip);
                        if (vb_stride == vtx_size) {
-                                DMA_COPY_FROM_USER(&vtxbuf[vb_stride * start],
+                                DMA_COPY(&vtxbuf[vb_stride * start], 
-                                                   vtx_size * count);
+                                         vtx_size * count);
                        } else {
                                for (i = start; i < start + count; ++i) {
-                                        DMA_COPY_FROM_USER(&vtxbuf
+                                        DMA_COPY(&vtxbuf [vb_stride * i],
-                                                           [vb_stride * i],
+                                                 vtx_size);
-                                                           vtx_size);
                                }
                        }
@@ -541,7 +535,7 @@ static int savage_dispatch_vb_prim(drm_savage_private_t * dev_priv,
 static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
                                   const drm_savage_cmd_header_t * cmd_header,
-                                   const uint16_t __user * usr_idx,
+                                   const uint16_t *idx,
                                   const drm_buf_t * dmabuf)
 {
        unsigned char reorder = 0;
@@ -628,11 +622,8 @@ static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
        while (n != 0) {
                /* Can emit up to 255 indices (85 triangles) at once. */
                unsigned int count = n > 255 ? 255 : n;
-                /* Is it ok to allocate 510 bytes on the stack in an ioctl? */
-                uint16_t idx[255];
-                /* Copy and check indices */
+                /* check indices */
-                DRM_COPY_FROM_USER_UNCHECKED(idx, usr_idx, count * 2);
                for (i = 0; i < count; ++i) {
                        if (idx[i] > dmabuf->total / 32) {
                                DRM_ERROR("idx[%u]=%u out of range (0-%u)\n",
@@ -652,8 +643,8 @@ static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
                        for (i = 1; i + 1 < count; i += 2)
                                BCI_WRITE(idx[i + reorder[i % 3]] |
-                                          (idx[i + 1 + reorder[(i + 1) % 3]] <<
+                                          (idx[i + 1 +
-                                           16));
+                                           reorder[(i + 1) % 3]] << 16));
                        if (i < count)
                                BCI_WRITE(idx[i + reorder[i % 3]]);
                } else if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
@@ -674,7 +665,7 @@ static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
                                BCI_WRITE(idx[i]);
                }
-                usr_idx += count;
+                idx += count;
                n -= count;
                prim |= BCI_CMD_DRAW_CONT;
@@ -685,8 +676,8 @@ static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
 static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv,
                                  const drm_savage_cmd_header_t * cmd_header,
-                                  const uint16_t __user * usr_idx,
+                                  const uint16_t *idx,
-                                  const uint32_t __user * vtxbuf,
+                                  const uint32_t *vtxbuf,
                                  unsigned int vb_size, unsigned int vb_stride)
 {
        unsigned char reorder = 0;
@@ -751,11 +742,8 @@ static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv,
        while (n != 0) {
                /* Can emit up to 255 vertices (85 triangles) at once. */
                unsigned int count = n > 255 ? 255 : n;
-                /* Is it ok to allocate 510 bytes on the stack in an ioctl? */
+                
-                uint16_t idx[255];
+                /* Check indices */
-                /* Copy and check indices */
-                DRM_COPY_FROM_USER_UNCHECKED(idx, usr_idx, count * 2);
                for (i = 0; i < count; ++i) {
                        if (idx[i] > vb_size / (vb_stride * 4)) {
                                DRM_ERROR("idx[%u]=%u out of range (0-%u)\n",
@@ -775,8 +763,7 @@ static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv,
                        for (i = 0; i < count; ++i) {
                                unsigned int j = idx[i + reorder[i % 3]];
-                                DMA_COPY_FROM_USER(&vtxbuf[vb_stride * j],
+                                DMA_COPY(&vtxbuf[vb_stride * j], vtx_size);
-                                                   vtx_size);
                        }
                        DMA_COMMIT();
@@ -786,14 +773,13 @@ static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv,
                        for (i = 0; i < count; ++i) {
                                unsigned int j = idx[i];
-                                DMA_COPY_FROM_USER(&vtxbuf[vb_stride * j],
+                                DMA_COPY(&vtxbuf[vb_stride * j], vtx_size);
-                                                   vtx_size);
                        }
                        DMA_COMMIT();
                }
-                usr_idx += count;
+                idx += count;
                n -= count;
                prim |= BCI_CMD_DRAW_CONT;
@@ -804,11 +790,11 @@ static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv,
 static int savage_dispatch_clear(drm_savage_private_t * dev_priv,
                                 const drm_savage_cmd_header_t * cmd_header,
-                                 const drm_savage_cmd_header_t __user * data,
+                                 const drm_savage_cmd_header_t *data,
                                 unsigned int nbox,
-                                 const drm_clip_rect_t __user * usr_boxes)
+                                 const drm_clip_rect_t *boxes)
 {
-        unsigned int flags = cmd_header->clear0.flags, mask, value;
+        unsigned int flags = cmd_header->clear0.flags;
        unsigned int clear_cmd;
        unsigned int i, nbufs;
        DMA_LOCALS;
@@ -816,9 +802,6 @@ static int savage_dispatch_clear(drm_savage_private_t * dev_priv,
        if (nbox == 0)
                return 0;
-        DRM_GET_USER_UNCHECKED(mask, &data->clear1.mask);
-        DRM_GET_USER_UNCHECKED(value, &data->clear1.value);
        clear_cmd = BCI_CMD_RECT | BCI_CMD_RECT_XP | BCI_CMD_RECT_YP |
            BCI_CMD_SEND_COLOR | BCI_CMD_DEST_PBD_NEW;
        BCI_CMD_SET_ROP(clear_cmd, 0xCC);
@@ -828,21 +811,19 @@ static int savage_dispatch_clear(drm_savage_private_t * dev_priv,
        if (nbufs == 0)
                return 0;
-        if (mask != 0xffffffff) {
+        if (data->clear1.mask != 0xffffffff) {
                /* set mask */
                BEGIN_DMA(2);
                DMA_SET_REGISTERS(SAVAGE_BITPLANEWTMASK, 1);
-                DMA_WRITE(mask);
+                DMA_WRITE(data->clear1.mask);
                DMA_COMMIT();
        }
        for (i = 0; i < nbox; ++i) {
-                drm_clip_rect_t box;
                unsigned int x, y, w, h;
                unsigned int buf;
-                DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box));
+                x = boxes[i].x1, y = boxes[i].y1;
-                x = box.x1, y = box.y1;
+                w = boxes[i].x2 - boxes[i].x1;
-                w = box.x2 - box.x1;
+                h = boxes[i].y2 - boxes[i].y1;
-                h = box.y2 - box.y1;
                BEGIN_DMA(nbufs * 6);
                for (buf = SAVAGE_FRONT; buf <= SAVAGE_DEPTH; buf <<= 1) {
                        if (!(flags & buf))
@@ -862,13 +843,13 @@ static int savage_dispatch_clear(drm_savage_private_t * dev_priv,
                                DMA_WRITE(dev_priv->depth_bd);
                                break;
                        }
-                        DMA_WRITE(value);
+                        DMA_WRITE(data->clear1.value);
                        DMA_WRITE(BCI_X_Y(x, y));
                        DMA_WRITE(BCI_W_H(w, h));
                }
                DMA_COMMIT();
        }
-        if (mask != 0xffffffff) {
+        if (data->clear1.mask != 0xffffffff) {
                /* reset mask */
                BEGIN_DMA(2);
                DMA_SET_REGISTERS(SAVAGE_BITPLANEWTMASK, 1);
@@ -880,8 +861,7 @@ static int savage_dispatch_clear(drm_savage_private_t * dev_priv,
 }
 static int savage_dispatch_swap(drm_savage_private_t * dev_priv,
-                                unsigned int nbox,
+                                unsigned int nbox, const drm_clip_rect_t *boxes)
-                                const drm_clip_rect_t __user * usr_boxes)
 {
        unsigned int swap_cmd;
        unsigned int i;
@@ -895,16 +875,14 @@ static int savage_dispatch_swap(drm_savage_private_t * dev_priv,
        BCI_CMD_SET_ROP(swap_cmd, 0xCC);
        for (i = 0; i < nbox; ++i) {
-                drm_clip_rect_t box;
-                DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box));
                BEGIN_DMA(6);
                DMA_WRITE(swap_cmd);
                DMA_WRITE(dev_priv->back_offset);
                DMA_WRITE(dev_priv->back_bd);
-                DMA_WRITE(BCI_X_Y(box.x1, box.y1));
+                DMA_WRITE(BCI_X_Y(boxes[i].x1, boxes[i].y1));
-                DMA_WRITE(BCI_X_Y(box.x1, box.y1));
+                DMA_WRITE(BCI_X_Y(boxes[i].x1, boxes[i].y1));
-                DMA_WRITE(BCI_W_H(box.x2 - box.x1, box.y2 - box.y1));
+                DMA_WRITE(BCI_W_H(boxes[i].x2 - boxes[i].x1,
+                                  boxes[i].y2 - boxes[i].y1));
                DMA_COMMIT();
        }
@@ -912,68 +890,52 @@ static int savage_dispatch_swap(drm_savage_private_t * dev_priv,
 }
 static int savage_dispatch_draw(drm_savage_private_t * dev_priv,
-                                const drm_savage_cmd_header_t __user * start,
+                                const drm_savage_cmd_header_t *start,
-                                const drm_savage_cmd_header_t __user * end,
+                                const drm_savage_cmd_header_t *end,
                                const drm_buf_t * dmabuf,
-                                const unsigned int __user * usr_vtxbuf,
+                                const unsigned int *vtxbuf,
                                unsigned int vb_size, unsigned int vb_stride,
                                unsigned int nbox,
-                                const drm_clip_rect_t __user * usr_boxes)
+                                const drm_clip_rect_t *boxes)
 {
        unsigned int i, j;
        int ret;
        for (i = 0; i < nbox; ++i) {
-                drm_clip_rect_t box;
+                const drm_savage_cmd_header_t *cmdbuf;
-                const drm_savage_cmd_header_t __user *usr_cmdbuf;
+                dev_priv->emit_clip_rect(dev_priv, &boxes[i]);
-                DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box));
-                dev_priv->emit_clip_rect(dev_priv, &box);
-                usr_cmdbuf = start;
+                cmdbuf = start;
-                while (usr_cmdbuf < end) {
+                while (cmdbuf < end) {
                        drm_savage_cmd_header_t cmd_header;
-                        DRM_COPY_FROM_USER_UNCHECKED(&cmd_header, usr_cmdbuf,
+                        cmd_header = *cmdbuf;
-                                                     sizeof(cmd_header));
+                        cmdbuf++;
-                        usr_cmdbuf++;
                        switch (cmd_header.cmd.cmd) {
                        case SAVAGE_CMD_DMA_PRIM:
-                                ret =
+                                ret = savage_dispatch_dma_prim(
-                                    savage_dispatch_dma_prim(dev_priv,
+                                        dev_priv, &cmd_header, dmabuf);
-                                                             &cmd_header,
-                                                             dmabuf);
                                break;
                        case SAVAGE_CMD_VB_PRIM:
-                                ret =
+                                ret = savage_dispatch_vb_prim(
-                                    savage_dispatch_vb_prim(dev_priv,
+                                        dev_priv, &cmd_header,
-                                                            &cmd_header,
+                                        vtxbuf, vb_size, vb_stride);
-                                                            (const uint32_t
-                                                             __user *)
-                                                            usr_vtxbuf, vb_size,
-                                                            vb_stride);
                                break;
                        case SAVAGE_CMD_DMA_IDX:
                                j = (cmd_header.idx.count + 3) / 4;
                                /* j was check in savage_bci_cmdbuf */
-                                ret =
+                                ret = savage_dispatch_dma_idx(dev_priv,
-                                    savage_dispatch_dma_idx(dev_priv,
+                                        &cmd_header, (const uint16_t *)cmdbuf,
-                                                            &cmd_header,
+                                        dmabuf);
-                                                            (const uint16_t
+                                cmdbuf += j;
-                                                             __user *)
-                                                            usr_cmdbuf, dmabuf);
-                                usr_cmdbuf += j;
                                break;
                        case SAVAGE_CMD_VB_IDX:
                                j = (cmd_header.idx.count + 3) / 4;
                                /* j was check in savage_bci_cmdbuf */
-                                ret =
+                                ret = savage_dispatch_vb_idx(dev_priv,
-                                    savage_dispatch_vb_idx(dev_priv,
+                                        &cmd_header, (const uint16_t *)cmdbuf,
-                                                           &cmd_header,
+                                        (const uint32_t *)vtxbuf, vb_size, 
-                                                           (const uint16_t
+                                        vb_stride);
-                                                            __user *)usr_cmdbuf,
+                                cmdbuf += j;
-                                                           (const uint32_t
-                                                            __user *)usr_vtxbuf,
-                                                           vb_size, vb_stride);
-                                usr_cmdbuf += j;
                                break;
                        default:
                                /* What's the best return code? EFAULT? */
@@ -998,10 +960,10 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
        drm_device_dma_t *dma = dev->dma;
        drm_buf_t *dmabuf;
        drm_savage_cmdbuf_t cmdbuf;
-        drm_savage_cmd_header_t __user *usr_cmdbuf;
+        drm_savage_cmd_header_t *kcmd_addr = NULL;
-        drm_savage_cmd_header_t __user *first_draw_cmd;
+        drm_savage_cmd_header_t *first_draw_cmd;
-        unsigned int __user *usr_vtxbuf;
+        unsigned int *kvb_addr = NULL;
-        drm_clip_rect_t __user *usr_boxes;
+        drm_clip_rect_t *kbox_addr = NULL;
        unsigned int i, j;
        int ret = 0;
@@ -1024,15 +986,53 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
                dmabuf = NULL;
        }
-        usr_cmdbuf = (drm_savage_cmd_header_t __user *) cmdbuf.cmd_addr;
+        /* Copy the user buffers into kernel temporary areas.  This hasn't been
-        usr_vtxbuf = (unsigned int __user *)cmdbuf.vb_addr;
+         * a performance loss compared to VERIFYAREA_READ/
-        usr_boxes = (drm_clip_rect_t __user *) cmdbuf.box_addr;
+         * COPY_FROM_USER_UNCHECKED when done in other drivers, and is correct
-        if ((cmdbuf.size && DRM_VERIFYAREA_READ(usr_cmdbuf, cmdbuf.size * 8)) ||
+         * for locking on FreeBSD.
-            (cmdbuf.vb_size && DRM_VERIFYAREA_READ(usr_vtxbuf, cmdbuf.vb_size))
+         */
-            || (cmdbuf.nbox
+        if (cmdbuf.size) {
-                && DRM_VERIFYAREA_READ(usr_boxes,
+                kcmd_addr = drm_alloc(cmdbuf.size * 8, DRM_MEM_DRIVER);
-                                       cmdbuf.nbox * sizeof(drm_clip_rect_t))))
+                if (kcmd_addr == NULL)
-                return DRM_ERR(EFAULT);
+                        return ENOMEM;
+                if (DRM_COPY_FROM_USER(kcmd_addr, cmdbuf.cmd_addr,
+                                       cmdbuf.size * 8))
+                {
+                        drm_free(kcmd_addr, cmdbuf.size * 8, DRM_MEM_DRIVER);
+                        return DRM_ERR(EFAULT);
+                }
+                cmdbuf.cmd_addr = kcmd_addr;
+        }
+        if (cmdbuf.vb_size) {
+                kvb_addr = drm_alloc(cmdbuf.vb_size, DRM_MEM_DRIVER);
+                if (kvb_addr == NULL) {
+                        ret = DRM_ERR(ENOMEM);
+                        goto done;
+                }
+                if (DRM_COPY_FROM_USER(kvb_addr, cmdbuf.vb_addr,
+                                       cmdbuf.vb_size)) {
+                        ret = DRM_ERR(EFAULT);
+                        goto done;
+                }
+                cmdbuf.vb_addr = kvb_addr;
+        }
+        if (cmdbuf.nbox) {
+                kbox_addr = drm_alloc(cmdbuf.nbox * sizeof(drm_clip_rect_t),
+                                       DRM_MEM_DRIVER);
+                if (kbox_addr == NULL) {
+                        ret = DRM_ERR(ENOMEM);
+                        goto done;
+                }
+                if (DRM_COPY_FROM_USER(kbox_addr, cmdbuf.box_addr,
+                                       cmdbuf.nbox * sizeof(drm_clip_rect_t))) {
+                        ret = DRM_ERR(EFAULT);
+                        goto done;
+                }
+        cmdbuf.box_addr = kbox_addr;
+        }
        /* Make sure writes to DMA buffers are finished before sending
         * DMA commands to the graphics hardware. */
@@ -1046,9 +1046,8 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
        first_draw_cmd = NULL;
        while (i < cmdbuf.size) {
                drm_savage_cmd_header_t cmd_header;
-                DRM_COPY_FROM_USER_UNCHECKED(&cmd_header, usr_cmdbuf,
+                cmd_header = *(drm_savage_cmd_header_t *)cmdbuf.cmd_addr;
-                                             sizeof(cmd_header));
+                cmdbuf.cmd_addr++;
-                usr_cmdbuf++;
                i++;
                /* Group drawing commands with same state to minimize
@@ -1068,21 +1067,18 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
                case SAVAGE_CMD_DMA_PRIM:
                case SAVAGE_CMD_VB_PRIM:
                        if (!first_draw_cmd)
-                                first_draw_cmd = usr_cmdbuf - 1;
+                                first_draw_cmd = cmdbuf.cmd_addr - 1;
-                        usr_cmdbuf += j;
+                        cmdbuf.cmd_addr += j;
                        i += j;
                        break;
                default:
                        if (first_draw_cmd) {
-                                ret =
+                                ret = savage_dispatch_draw(
-                                    savage_dispatch_draw(dev_priv,
+                                      dev_priv, first_draw_cmd,
-                                                         first_draw_cmd,
+                                      cmdbuf.cmd_addr - 1,
-                                                         usr_cmdbuf - 1, dmabuf,
+                                      dmabuf, cmdbuf.vb_addr, cmdbuf.vb_size,
-                                                         usr_vtxbuf,
+                                      cmdbuf.vb_stride,
-                                                         cmdbuf.vb_size,
+                                      cmdbuf.nbox, cmdbuf.box_addr);
-                                                         cmdbuf.vb_stride,
-                                                         cmdbuf.nbox,
-                                                         usr_boxes);
                                if (ret != 0)
                                        return ret;
                                first_draw_cmd = NULL;
@@ -1098,12 +1094,12 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
                                DRM_ERROR("command SAVAGE_CMD_STATE extends "
                                          "beyond end of command buffer\n");
                                DMA_FLUSH();
-                                return DRM_ERR(EINVAL);
+                                ret = DRM_ERR(EINVAL);
+                                goto done;
                        }
                        ret = savage_dispatch_state(dev_priv, &cmd_header,
-                                                    (uint32_t __user *)
+                                (const uint32_t *)cmdbuf.cmd_addr);
-                                                    usr_cmdbuf);
+                        cmdbuf.cmd_addr += j;
-                        usr_cmdbuf += j;
                        i += j;
                        break;
                case SAVAGE_CMD_CLEAR:
@@ -1111,39 +1107,40 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
                                DRM_ERROR("command SAVAGE_CMD_CLEAR extends "
                                          "beyond end of command buffer\n");
                                DMA_FLUSH();
-                                return DRM_ERR(EINVAL);
+                                ret = DRM_ERR(EINVAL);
+                                goto done;
                        }
                        ret = savage_dispatch_clear(dev_priv, &cmd_header,
-                                                    usr_cmdbuf,
+                                                    cmdbuf.cmd_addr,
-                                                    cmdbuf.nbox, usr_boxes);
+                                                    cmdbuf.nbox, cmdbuf.box_addr);
-                        usr_cmdbuf++;
+                        cmdbuf.cmd_addr++;
                        i++;
                        break;
                case SAVAGE_CMD_SWAP:
-                        ret = savage_dispatch_swap(dev_priv,
+                        ret = savage_dispatch_swap(dev_priv, cmdbuf.nbox,
-                                                   cmdbuf.nbox, usr_boxes);
+                                                   cmdbuf.box_addr);
                        break;
                default:
                        DRM_ERROR("invalid command 0x%x\n", cmd_header.cmd.cmd);
                        DMA_FLUSH();
-                        return DRM_ERR(EINVAL);
+                        ret = DRM_ERR(EINVAL);
+                        goto done;
                }
                if (ret != 0) {
                        DMA_FLUSH();
-                        return ret;
+                        goto done;
                }
        }
        if (first_draw_cmd) {
-                ret =
+                ret = savage_dispatch_draw (
-                    savage_dispatch_draw(dev_priv, first_draw_cmd, usr_cmdbuf,
+                        dev_priv, first_draw_cmd, cmdbuf.cmd_addr, dmabuf,
-                                         dmabuf, usr_vtxbuf, cmdbuf.vb_size,
+                        cmdbuf.vb_addr, cmdbuf.vb_size, cmdbuf.vb_stride,
-                                         cmdbuf.vb_stride, cmdbuf.nbox,
+                        cmdbuf.nbox, cmdbuf.box_addr);
-                                         usr_boxes);
                if (ret != 0) {
                        DMA_FLUSH();
-                        return ret;
+                        goto done;
                }
        }
@@ -1157,5 +1154,12 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
                savage_freelist_put(dev, dmabuf);
        }
-        return 0;
+done:
+        /* If we didn't need to allocate them, these'll be NULL */
+        drm_free(kcmd_addr, cmdbuf.size * 8, DRM_MEM_DRIVER);
+        drm_free(kvb_addr, cmdbuf.vb_size, DRM_MEM_DRIVER);
+        drm_free(kbox_addr, cmdbuf.nbox * sizeof(drm_clip_rect_t),
+                 DRM_MEM_DRIVER);
+        return ret;
 }
diff --git a/drivers/char/drm/sis_drm.h b/drivers/char/drm/sis_drm.h
index 8f273da76ddb..30f7b3827466 100644
--- a/drivers/char/drm/sis_drm.h
+++ b/drivers/char/drm/sis_drm.h
@@ -1,3 +1,28 @@
+/* sis_drv.h -- Private header for sis driver -*- linux-c -*- */
+/*
+ * Copyright 2005 Eric Anholt
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
 #ifndef __SIS_DRM_H__
 #define __SIS_DRM_H__
diff --git a/drivers/char/drm/sis_drv.c b/drivers/char/drm/sis_drv.c
index 3cef10643a8f..6f6d7d613ede 100644
--- a/drivers/char/drm/sis_drv.c
+++ b/drivers/char/drm/sis_drv.c
@@ -32,31 +32,6 @@
 #include "drm_pciids.h"
-static int postinit(struct drm_device *dev, unsigned long flags)
-{
-        DRM_INFO("Initialized %s %d.%d.%d %s on minor %d: %s\n",
-                 DRIVER_NAME,
-                 DRIVER_MAJOR,
-                 DRIVER_MINOR,
-                 DRIVER_PATCHLEVEL,
-                 DRIVER_DATE, dev->primary.minor, pci_pretty_name(dev->pdev)
-            );
-        return 0;
-}
-static int version(drm_version_t * version)
-{
-        int len;
-        version->version_major = DRIVER_MAJOR;
-        version->version_minor = DRIVER_MINOR;
-        version->version_patchlevel = DRIVER_PATCHLEVEL;
-        DRM_COPY(version->name, DRIVER_NAME);
-        DRM_COPY(version->date, DRIVER_DATE);
-        DRM_COPY(version->desc, DRIVER_DESC);
-        return 0;
-}
 static struct pci_device_id pciidlist[] = {
        sisdrv_PCI_IDS
 };
@@ -68,8 +43,6 @@ static struct drm_driver driver = {
        .reclaim_buffers = drm_core_reclaim_buffers,
        .get_map_ofs = drm_core_get_map_ofs,
        .get_reg_ofs = drm_core_get_reg_ofs,
-        .postinit = postinit,
-        .version = version,
        .ioctls = sis_ioctls,
        .fops = {
                 .owner = THIS_MODULE,
@@ -79,11 +52,18 @@ static struct drm_driver driver = {
                 .mmap = drm_mmap,
                 .poll = drm_poll,
                 .fasync = drm_fasync,
-                 },
+        },
        .pci_driver = {
-                       .name = DRIVER_NAME,
+                 .name = DRIVER_NAME,
-                       .id_table = pciidlist,
+                 .id_table = pciidlist,
-                       }
+        },
+        .name = DRIVER_NAME,
+        .desc = DRIVER_DESC,
+        .date = DRIVER_DATE,
+        .major = DRIVER_MAJOR,
+        .minor = DRIVER_MINOR,
+        .patchlevel = DRIVER_PATCHLEVEL,
 };
 static int __init sis_init(void)
diff --git a/drivers/char/drm/sis_drv.h b/drivers/char/drm/sis_drv.h
index b1fddad83a93..e218e5269503 100644
--- a/drivers/char/drm/sis_drv.h
+++ b/drivers/char/drm/sis_drv.h
@@ -1,5 +1,5 @@
-/* sis_drv.h -- Private header for sis driver -*- linux-c -*-
+/* sis_drv.h -- Private header for sis driver -*- linux-c -*- */
- *
+/*
 * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
 * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
 * All rights reserved.
diff --git a/drivers/char/drm/sis_ds.h b/drivers/char/drm/sis_ds.h
index da850b4f5440..94f2b4728b63 100644
--- a/drivers/char/drm/sis_ds.h
+++ b/drivers/char/drm/sis_ds.h
@@ -1,6 +1,7 @@
-/* sis_ds.h -- Private header for Direct Rendering Manager -*- linux-c -*-
+/* sis_ds.h -- Private header for Direct Rendering Manager -*- linux-c -*- 
 * Created: Mon Jan  4 10:05:05 1999 by sclin@sis.com.tw
- *
+ */
+/*
 * Copyright 2000 Silicon Integrated Systems Corp, Inc., HsinChu, Taiwan.
 * All rights reserved.
 *
@@ -35,7 +36,7 @@
 #define SET_SIZE 5000
-typedef unsigned int ITEM_TYPE;
+typedef unsigned long ITEM_TYPE;
 typedef struct {
        ITEM_TYPE val;
diff --git a/drivers/char/drm/sis_mm.c b/drivers/char/drm/sis_mm.c
index a8529728fa63..6774d2fe3452 100644
--- a/drivers/char/drm/sis_mm.c
+++ b/drivers/char/drm/sis_mm.c
@@ -86,7 +86,7 @@ static int sis_fb_alloc(DRM_IOCTL_ARGS)
 {
        drm_sis_mem_t fb;
        struct sis_memreq req;
-        drm_sis_mem_t __user *argp = (void __user *)data;
+        drm_sis_mem_t __user *argp = (drm_sis_mem_t __user *)data;
        int retval = 0;
        DRM_COPY_FROM_USER_IOCTL(fb, argp, sizeof(fb));
@@ -110,7 +110,7 @@ static int sis_fb_alloc(DRM_IOCTL_ARGS)
        DRM_COPY_TO_USER_IOCTL(argp, fb, sizeof(fb));
-        DRM_DEBUG("alloc fb, size = %d, offset = %d\n", fb.size, req.offset);
+        DRM_DEBUG("alloc fb, size = %d, offset = %ld\n", fb.size, req.offset);
        return retval;
 }
@@ -127,9 +127,9 @@ static int sis_fb_free(DRM_IOCTL_ARGS)
        if (!del_alloc_set(fb.context, VIDEO_TYPE, fb.free))
                retval = DRM_ERR(EINVAL);
-        sis_free((u32) fb.free);
+        sis_free(fb.free);
-        DRM_DEBUG("free fb, offset = %lu\n", fb.free);
+        DRM_DEBUG("free fb, offset = 0x%lx\n", fb.free);
        return retval;
 }
@@ -176,7 +176,7 @@ static int sis_fb_alloc(DRM_IOCTL_ARGS)
 {
        DRM_DEVICE;
        drm_sis_private_t *dev_priv = dev->dev_private;
-        drm_sis_mem_t __user *argp = (void __user *)data;
+        drm_sis_mem_t __user *argp = (drm_sis_mem_t __user *)data;
        drm_sis_mem_t fb;
        PMemBlock block;
        int retval = 0;
@@ -267,7 +267,7 @@ static int sis_ioctl_agp_alloc(DRM_IOCTL_ARGS)
 {
        DRM_DEVICE;
        drm_sis_private_t *dev_priv = dev->dev_private;
-        drm_sis_mem_t __user *argp = (void __user *)data;
+        drm_sis_mem_t __user *argp = (drm_sis_mem_t __user *)data;
        drm_sis_mem_t agp;
        PMemBlock block;
        int retval = 0;
@@ -367,7 +367,7 @@ int sis_final_context(struct drm_device *dev, int context)
        if (i < MAX_CONTEXT) {
                set_t *set;
-                unsigned int item;
+                ITEM_TYPE item;
                int retval;
                DRM_DEBUG("find socket %d, context = %d\n", i, context);
@@ -376,7 +376,7 @@ int sis_final_context(struct drm_device *dev, int context)
                set = global_ppriv[i].sets[0];
                retval = setFirst(set, &item);
                while (retval) {
-                        DRM_DEBUG("free video memory 0x%x\n", item);
+                        DRM_DEBUG("free video memory 0x%lx\n", item);
 #if defined(__linux__) && defined(CONFIG_FB_SIS)
                        sis_free(item);
 #else
@@ -390,7 +390,7 @@ int sis_final_context(struct drm_device *dev, int context)
                set = global_ppriv[i].sets[1];
                retval = setFirst(set, &item);
                while (retval) {
-                        DRM_DEBUG("free agp memory 0x%x\n", item);
+                        DRM_DEBUG("free agp memory 0x%lx\n", item);
                        mmFreeMem((PMemBlock) item);
                        retval = setNext(set, &item);
                }
@@ -403,12 +403,12 @@ int sis_final_context(struct drm_device *dev, int context)
 }
 drm_ioctl_desc_t sis_ioctls[] = {
-        [DRM_IOCTL_NR(DRM_SIS_FB_ALLOC)] = {sis_fb_alloc, 1, 0},
+        [DRM_IOCTL_NR(DRM_SIS_FB_ALLOC)] = {sis_fb_alloc, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_SIS_FB_FREE)] = {sis_fb_free, 1, 0},
+        [DRM_IOCTL_NR(DRM_SIS_FB_FREE)] = {sis_fb_free, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_SIS_AGP_INIT)] = {sis_ioctl_agp_init, 1, 1},
+        [DRM_IOCTL_NR(DRM_SIS_AGP_INIT)] = {sis_ioctl_agp_init, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_SIS_AGP_ALLOC)] = {sis_ioctl_agp_alloc, 1, 0},
+        [DRM_IOCTL_NR(DRM_SIS_AGP_ALLOC)] = {sis_ioctl_agp_alloc, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_SIS_AGP_FREE)] = {sis_ioctl_agp_free, 1, 0},
+        [DRM_IOCTL_NR(DRM_SIS_AGP_FREE)] = {sis_ioctl_agp_free, DRM_AUTH},
-        [DRM_IOCTL_NR(DRM_SIS_FB_INIT)] = {sis_fb_init, 1, 1}
+        [DRM_IOCTL_NR(DRM_SIS_FB_INIT)] = {sis_fb_init, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY}
 };
 int sis_max_ioctl = DRM_ARRAY_SIZE(sis_ioctls);
diff --git a/drivers/char/drm/tdfx_drv.c b/drivers/char/drm/tdfx_drv.c
index c275cbb6e9ce..baa4416032a8 100644
--- a/drivers/char/drm/tdfx_drv.c
+++ b/drivers/char/drm/tdfx_drv.c
@@ -36,31 +36,6 @@
 #include "drm_pciids.h"
-static int postinit(struct drm_device *dev, unsigned long flags)
-{
-        DRM_INFO("Initialized %s %d.%d.%d %s on minor %d: %s\n",
-                 DRIVER_NAME,
-                 DRIVER_MAJOR,
-                 DRIVER_MINOR,
-                 DRIVER_PATCHLEVEL,
-                 DRIVER_DATE, dev->primary.minor, pci_pretty_name(dev->pdev)
-            );
-        return 0;
-}
-static int version(drm_version_t * version)
-{
-        int len;
-        version->version_major = DRIVER_MAJOR;
-        version->version_minor = DRIVER_MINOR;
-        version->version_patchlevel = DRIVER_PATCHLEVEL;
-        DRM_COPY(version->name, DRIVER_NAME);
-        DRM_COPY(version->date, DRIVER_DATE);
-        DRM_COPY(version->desc, DRIVER_DESC);
-        return 0;
-}
 static struct pci_device_id pciidlist[] = {
        tdfx_PCI_IDS
 };
@@ -70,8 +45,6 @@ static struct drm_driver driver = {
        .reclaim_buffers = drm_core_reclaim_buffers,
        .get_map_ofs = drm_core_get_map_ofs,
        .get_reg_ofs = drm_core_get_reg_ofs,
-        .postinit = postinit,
-        .version = version,
        .fops = {
                 .owner = THIS_MODULE,
                 .open = drm_open,
@@ -80,11 +53,18 @@ static struct drm_driver driver = {
                 .mmap = drm_mmap,
                 .poll = drm_poll,
                 .fasync = drm_fasync,
-                 },
+        },
        .pci_driver = {
-                       .name = DRIVER_NAME,
+                 .name = DRIVER_NAME,
-                       .id_table = pciidlist,
+                 .id_table = pciidlist,
-                       }
+        },
+        .name = DRIVER_NAME,
+        .desc = DRIVER_DESC,
+        .date = DRIVER_DATE,
+        .major = DRIVER_MAJOR,
+        .minor = DRIVER_MINOR,
+        .patchlevel = DRIVER_PATCHLEVEL,
 };
 static int __init tdfx_init(void)
diff --git a/drivers/char/drm/tdfx_drv.h b/drivers/char/drm/tdfx_drv.h
index a582a3db4c75..84204ec1b046 100644
--- a/drivers/char/drm/tdfx_drv.h
+++ b/drivers/char/drm/tdfx_drv.h
@@ -1,6 +1,7 @@
 /* tdfx.h -- 3dfx DRM template customization -*- linux-c -*-
 * Created: Wed Feb 14 12:32:32 2001 by gareth@valinux.com
- *
+ */
+/*
 * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
 * All Rights Reserved.
 *
@@ -30,10 +31,6 @@
 #ifndef __TDFX_H__
 #define __TDFX_H__
-/* This remains constant for all DRM template files.
- */
-#define DRM(x) tdfx_##x
 /* General customization:
 */
diff --git a/drivers/char/drm/via_dma.c b/drivers/char/drm/via_dma.c
index d4b1766608b0..593c0b8f650a 100644
--- a/drivers/char/drm/via_dma.c
+++ b/drivers/char/drm/via_dma.c
@@ -213,7 +213,9 @@ static int via_initialize(drm_device_t * dev,
        dev_priv->dma_wrap = init->size;
        dev_priv->dma_offset = init->offset;
        dev_priv->last_pause_ptr = NULL;
-        dev_priv->hw_addr_ptr = dev_priv->mmio->handle + init->reg_pause_addr;
+        dev_priv->hw_addr_ptr =
+                (volatile uint32_t *)((char *)dev_priv->mmio->handle +
+                init->reg_pause_addr);
        via_cmdbuf_start(dev_priv);
@@ -232,13 +234,13 @@ int via_dma_init(DRM_IOCTL_ARGS)
        switch (init.func) {
        case VIA_INIT_DMA:
-                if (!capable(CAP_SYS_ADMIN))
+                if (!DRM_SUSER(DRM_CURPROC))
                        retcode = DRM_ERR(EPERM);
                else
                        retcode = via_initialize(dev, dev_priv, &init);
                break;
        case VIA_CLEANUP_DMA:
-                if (!capable(CAP_SYS_ADMIN))
+                if (!DRM_SUSER(DRM_CURPROC))
                        retcode = DRM_ERR(EPERM);
                else
                        retcode = via_dma_cleanup(dev);
@@ -349,9 +351,6 @@ int via_cmdbuffer(DRM_IOCTL_ARGS)
        return 0;
 }
-extern int
-via_parse_command_stream(drm_device_t * dev, const uint32_t * buf,
-                         unsigned int size);
 static int via_dispatch_pci_cmdbuffer(drm_device_t * dev,
                                      drm_via_cmdbuffer_t * cmd)
 {
@@ -450,9 +449,9 @@ static int via_hook_segment(drm_via_private_t * dev_priv,
        if ((count <= 8) && (count >= 0)) {
                uint32_t rgtr, ptr;
                rgtr = *(dev_priv->hw_addr_ptr);
-                ptr = ((char *)dev_priv->last_pause_ptr - dev_priv->dma_ptr) +
+                ptr = ((volatile char *)dev_priv->last_pause_ptr -
-                    dev_priv->dma_offset + (uint32_t) dev_priv->agpAddr + 4 -
+                      dev_priv->dma_ptr) + dev_priv->dma_offset +
-                    CMDBUF_ALIGNMENT_SIZE;
+                      (uint32_t) dev_priv->agpAddr + 4 - CMDBUF_ALIGNMENT_SIZE;
                if (rgtr <= ptr) {
                        DRM_ERROR
                            ("Command regulator\npaused at count %d, address %x, "
@@ -472,7 +471,7 @@ static int via_hook_segment(drm_via_private_t * dev_priv,
                       && count--) ;
                rgtr = *(dev_priv->hw_addr_ptr);
-                ptr = ((char *)paused_at - dev_priv->dma_ptr) +
+                ptr = ((volatile char *)paused_at - dev_priv->dma_ptr) +
                    dev_priv->dma_offset + (uint32_t) dev_priv->agpAddr + 4;
                ptr_low = (ptr > 3 * CMDBUF_ALIGNMENT_SIZE) ?
@@ -724,3 +723,22 @@ int via_cmdbuf_size(DRM_IOCTL_ARGS)
                               sizeof(d_siz));
        return ret;
 }
+drm_ioctl_desc_t via_ioctls[] = {
+        [DRM_IOCTL_NR(DRM_VIA_ALLOCMEM)] = {via_mem_alloc, DRM_AUTH},
+        [DRM_IOCTL_NR(DRM_VIA_FREEMEM)] = {via_mem_free, DRM_AUTH},
+        [DRM_IOCTL_NR(DRM_VIA_AGP_INIT)] = {via_agp_init, DRM_AUTH|DRM_MASTER},
+        [DRM_IOCTL_NR(DRM_VIA_FB_INIT)] = {via_fb_init, DRM_AUTH|DRM_MASTER},
+        [DRM_IOCTL_NR(DRM_VIA_MAP_INIT)] = {via_map_init, DRM_AUTH|DRM_MASTER},
+        [DRM_IOCTL_NR(DRM_VIA_DEC_FUTEX)] = {via_decoder_futex, DRM_AUTH},
+        [DRM_IOCTL_NR(DRM_VIA_DMA_INIT)] = {via_dma_init, DRM_AUTH},
+        [DRM_IOCTL_NR(DRM_VIA_CMDBUFFER)] = {via_cmdbuffer, DRM_AUTH},
+        [DRM_IOCTL_NR(DRM_VIA_FLUSH)] = {via_flush_ioctl, DRM_AUTH},
+        [DRM_IOCTL_NR(DRM_VIA_PCICMD)] = {via_pci_cmdbuffer, DRM_AUTH},
+        [DRM_IOCTL_NR(DRM_VIA_CMDBUF_SIZE)] = {via_cmdbuf_size, DRM_AUTH},
+        [DRM_IOCTL_NR(DRM_VIA_WAIT_IRQ)] = {via_wait_irq, DRM_AUTH},
+        [DRM_IOCTL_NR(DRM_VIA_DMA_BLIT)] = {via_dma_blit, DRM_AUTH},
+        [DRM_IOCTL_NR(DRM_VIA_BLIT_SYNC)] = {via_dma_blit_sync, DRM_AUTH}
+};
+int via_max_ioctl = DRM_ARRAY_SIZE(via_ioctls);
diff --git a/drivers/char/drm/via_dmablit.c b/drivers/char/drm/via_dmablit.c
new file mode 100644
index 000000000000..9d5e027dae0e
--- /dev/null
+++ b/drivers/char/drm/via_dmablit.c
@@ -0,0 +1,805 @@
+/* via_dmablit.c -- PCI DMA BitBlt support for the VIA Unichrome/Pro
+ * 
+ * Copyright (C) 2005 Thomas Hellstrom, All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sub license,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, 
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR 
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE 
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: 
+ *    Thomas Hellstrom.
+ *    Partially based on code obtained from Digeo Inc.
+ */
+/*
+ * Unmaps the DMA mappings. 
+ * FIXME: Is this a NoOp on x86? Also 
+ * FIXME: What happens if this one is called and a pending blit has previously done 
+ * the same DMA mappings? 
+ */
+#include "drmP.h"
+#include "via_drm.h"
+#include "via_drv.h"
+#include "via_dmablit.h"
+#include <linux/pagemap.h>
+#define VIA_PGDN(x)             (((unsigned long)(x)) & PAGE_MASK)
+#define VIA_PGOFF(x)            (((unsigned long)(x)) & ~PAGE_MASK)
+#define VIA_PFN(x)              ((unsigned long)(x) >> PAGE_SHIFT)
+typedef struct _drm_via_descriptor {
+        uint32_t mem_addr;
+        uint32_t dev_addr;
+        uint32_t size;
+        uint32_t next;
+} drm_via_descriptor_t;
+/*
+ * Unmap a DMA mapping.
+ */
+static void
+via_unmap_blit_from_device(struct pci_dev *pdev, drm_via_sg_info_t *vsg)
+{
+        int num_desc = vsg->num_desc;
+        unsigned cur_descriptor_page = num_desc / vsg->descriptors_per_page;
+        unsigned descriptor_this_page = num_desc % vsg->descriptors_per_page;
+        drm_via_descriptor_t *desc_ptr = vsg->desc_pages[cur_descriptor_page] + 
+                descriptor_this_page;
+        dma_addr_t next = vsg->chain_start;
+        while(num_desc--) {
+                if (descriptor_this_page-- == 0) {
+                        cur_descriptor_page--;
+                        descriptor_this_page = vsg->descriptors_per_page - 1;
+                        desc_ptr = vsg->desc_pages[cur_descriptor_page] + 
+                                descriptor_this_page;
+                }
+                dma_unmap_single(&pdev->dev, next, sizeof(*desc_ptr), DMA_TO_DEVICE);
+                dma_unmap_page(&pdev->dev, desc_ptr->mem_addr, desc_ptr->size, vsg->direction);
+                next = (dma_addr_t) desc_ptr->next;
+                desc_ptr--;
+        }
+}
+/*
+ * If mode = 0, count how many descriptors are needed.
+ * If mode = 1, Map the DMA pages for the device, put together and map also the descriptors.
+ * Descriptors are run in reverse order by the hardware because we are not allowed to update the
+ * 'next' field without syncing calls when the descriptor is already mapped.
+ */
+static void
+via_map_blit_for_device(struct pci_dev *pdev,
+                   const drm_via_dmablit_t *xfer,
+                   drm_via_sg_info_t *vsg, 
+                   int mode)
+{
+        unsigned cur_descriptor_page = 0;
+        unsigned num_descriptors_this_page = 0;
+        unsigned char *mem_addr = xfer->mem_addr;
+        unsigned char *cur_mem;
+        unsigned char *first_addr = (unsigned char *)VIA_PGDN(mem_addr);
+        uint32_t fb_addr = xfer->fb_addr;
+        uint32_t cur_fb;
+        unsigned long line_len;
+        unsigned remaining_len;
+        int num_desc = 0;
+        int cur_line;
+        dma_addr_t next = 0 | VIA_DMA_DPR_EC;
+        drm_via_descriptor_t *desc_ptr = 0;
+        if (mode == 1) 
+                desc_ptr = vsg->desc_pages[cur_descriptor_page];
+        for (cur_line = 0; cur_line < xfer->num_lines; ++cur_line) {
+                line_len = xfer->line_length;
+                cur_fb = fb_addr;
+                cur_mem = mem_addr;
+                
+                while (line_len > 0) {
+                        remaining_len = min(PAGE_SIZE-VIA_PGOFF(cur_mem), line_len);
+                        line_len -= remaining_len;
+                        if (mode == 1) {
+                                desc_ptr->mem_addr = 
+                                        dma_map_page(&pdev->dev, 
+                                                     vsg->pages[VIA_PFN(cur_mem) - 
+                                                                VIA_PFN(first_addr)],
+                                                     VIA_PGOFF(cur_mem), remaining_len, 
+                                                     vsg->direction);
+                                desc_ptr->dev_addr = cur_fb;
+                                
+                                desc_ptr->size = remaining_len;
+                                desc_ptr->next = (uint32_t) next;
+                                next = dma_map_single(&pdev->dev, desc_ptr, sizeof(*desc_ptr), 
+                                                      DMA_TO_DEVICE);
+                                desc_ptr++;
+                                if (++num_descriptors_this_page >= vsg->descriptors_per_page) {
+                                        num_descriptors_this_page = 0;
+                                        desc_ptr = vsg->desc_pages[++cur_descriptor_page];
+                                }
+                        }
+                        
+                        num_desc++;
+                        cur_mem += remaining_len;
+                        cur_fb += remaining_len;
+                }
+                
+                mem_addr += xfer->mem_stride;
+                fb_addr += xfer->fb_stride;
+        }
+        if (mode == 1) {
+                vsg->chain_start = next;
+                vsg->state = dr_via_device_mapped;
+        }
+        vsg->num_desc = num_desc;
+}
+/*
+ * Function that frees up all resources for a blit. It is usable even if the 
+ * blit info has only be partially built as long as the status enum is consistent
+ * with the actual status of the used resources.
+ */
+void
+via_free_sg_info(struct pci_dev *pdev, drm_via_sg_info_t *vsg) 
+{
+        struct page *page;
+        int i;
+        switch(vsg->state) {
+        case dr_via_device_mapped:
+                via_unmap_blit_from_device(pdev, vsg);
+        case dr_via_desc_pages_alloc:
+                for (i=0; i<vsg->num_desc_pages; ++i) {
+                        if (vsg->desc_pages[i] != NULL)
+                          free_page((unsigned long)vsg->desc_pages[i]);
+                }
+                kfree(vsg->desc_pages);
+        case dr_via_pages_locked:
+                for (i=0; i<vsg->num_pages; ++i) {
+                        if ( NULL != (page = vsg->pages[i])) {
+                                if (! PageReserved(page) && (DMA_FROM_DEVICE == vsg->direction)) 
+                                        SetPageDirty(page);
+                                page_cache_release(page);
+                        }
+                }
+        case dr_via_pages_alloc:
+                vfree(vsg->pages);
+        default:
+                vsg->state = dr_via_sg_init;
+        }
+        if (vsg->bounce_buffer) {
+                vfree(vsg->bounce_buffer);
+                vsg->bounce_buffer = NULL;
+        }
+        vsg->free_on_sequence = 0;
+}               
+/*
+ * Fire a blit engine.
+ */
+static void
+via_fire_dmablit(drm_device_t *dev, drm_via_sg_info_t *vsg, int engine)
+{
+        drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
+        VIA_WRITE(VIA_PCI_DMA_MAR0 + engine*0x10, 0);
+        VIA_WRITE(VIA_PCI_DMA_DAR0 + engine*0x10, 0);
+        VIA_WRITE(VIA_PCI_DMA_CSR0 + engine*0x04, VIA_DMA_CSR_DD | VIA_DMA_CSR_TD | 
+                  VIA_DMA_CSR_DE);
+        VIA_WRITE(VIA_PCI_DMA_MR0  + engine*0x04, VIA_DMA_MR_CM | VIA_DMA_MR_TDIE);
+        VIA_WRITE(VIA_PCI_DMA_BCR0 + engine*0x10, 0);
+        VIA_WRITE(VIA_PCI_DMA_DPR0 + engine*0x10, vsg->chain_start);
+        VIA_WRITE(VIA_PCI_DMA_CSR0 + engine*0x04, VIA_DMA_CSR_DE | VIA_DMA_CSR_TS);
+}
+/*
+ * Obtain a page pointer array and lock all pages into system memory. A segmentation violation will
+ * occur here if the calling user does not have access to the submitted address.
+ */
+static int
+via_lock_all_dma_pages(drm_via_sg_info_t *vsg,  drm_via_dmablit_t *xfer)
+{
+        int ret;
+        unsigned long first_pfn = VIA_PFN(xfer->mem_addr);
+        vsg->num_pages = VIA_PFN(xfer->mem_addr + (xfer->num_lines * xfer->mem_stride -1)) - 
+                first_pfn + 1;
+        
+        if (NULL == (vsg->pages = vmalloc(sizeof(struct page *) * vsg->num_pages)))
+                return DRM_ERR(ENOMEM);
+        memset(vsg->pages, 0, sizeof(struct page *) * vsg->num_pages);
+        down_read(&current->mm->mmap_sem);
+        ret = get_user_pages(current, current->mm, (unsigned long) xfer->mem_addr,
+                             vsg->num_pages, vsg->direction, 0, vsg->pages, NULL);
+        up_read(&current->mm->mmap_sem);
+        if (ret != vsg->num_pages) {
+                if (ret < 0) 
+                        return ret;
+                vsg->state = dr_via_pages_locked;
+                return DRM_ERR(EINVAL);
+        }
+        vsg->state = dr_via_pages_locked;
+        DRM_DEBUG("DMA pages locked\n");
+        return 0;
+}
+/*
+ * Allocate DMA capable memory for the blit descriptor chain, and an array that keeps track of the
+ * pages we allocate. We don't want to use kmalloc for the descriptor chain because it may be
+ * quite large for some blits, and pages don't need to be contingous.
+ */
+static int 
+via_alloc_desc_pages(drm_via_sg_info_t *vsg)
+{
+        int i;
+        
+        vsg->descriptors_per_page = PAGE_SIZE / sizeof( drm_via_descriptor_t);
+        vsg->num_desc_pages = (vsg->num_desc + vsg->descriptors_per_page - 1) / 
+                vsg->descriptors_per_page;
+        if (NULL ==  (vsg->desc_pages = kmalloc(sizeof(void *) * vsg->num_desc_pages, GFP_KERNEL))) 
+                return DRM_ERR(ENOMEM);
+        
+        memset(vsg->desc_pages, 0, sizeof(void *) * vsg->num_desc_pages);
+        vsg->state = dr_via_desc_pages_alloc;
+        for (i=0; i<vsg->num_desc_pages; ++i) {
+                if (NULL == (vsg->desc_pages[i] = 
+                             (drm_via_descriptor_t *) __get_free_page(GFP_KERNEL)))
+                        return DRM_ERR(ENOMEM);
+        }
+        DRM_DEBUG("Allocated %d pages for %d descriptors.\n", vsg->num_desc_pages,
+                  vsg->num_desc);
+        return 0;
+}
+                        
+static void
+via_abort_dmablit(drm_device_t *dev, int engine)
+{
+        drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
+        VIA_WRITE(VIA_PCI_DMA_CSR0 + engine*0x04, VIA_DMA_CSR_TA);
+}
+static void
+via_dmablit_engine_off(drm_device_t *dev, int engine)
+{
+        drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
+        VIA_WRITE(VIA_PCI_DMA_CSR0 + engine*0x04, VIA_DMA_CSR_TD | VIA_DMA_CSR_DD); 
+}
+/*
+ * The dmablit part of the IRQ handler. Trying to do only reasonably fast things here.
+ * The rest, like unmapping and freeing memory for done blits is done in a separate workqueue
+ * task. Basically the task of the interrupt handler is to submit a new blit to the engine, while
+ * the workqueue task takes care of processing associated with the old blit.
+ */
+                
+void
+via_dmablit_handler(drm_device_t *dev, int engine, int from_irq)
+{
+        drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
+        drm_via_blitq_t *blitq = dev_priv->blit_queues + engine;
+        int cur;
+        int done_transfer;
+        unsigned long irqsave=0;
+        uint32_t status = 0;
+        DRM_DEBUG("DMA blit handler called. engine = %d, from_irq = %d, blitq = 0x%lx\n",
+                  engine, from_irq, (unsigned long) blitq);
+        if (from_irq) {
+                spin_lock(&blitq->blit_lock);
+        } else {
+                spin_lock_irqsave(&blitq->blit_lock, irqsave);
+        }
+        done_transfer = blitq->is_active && 
+          (( status = VIA_READ(VIA_PCI_DMA_CSR0 + engine*0x04)) & VIA_DMA_CSR_TD);
+        done_transfer = done_transfer || ( blitq->aborting && !(status & VIA_DMA_CSR_DE)); 
+        cur = blitq->cur;
+        if (done_transfer) {
+                blitq->blits[cur]->aborted = blitq->aborting;
+                blitq->done_blit_handle++;
+                DRM_WAKEUP(blitq->blit_queue + cur);            
+                cur++;
+                if (cur >= VIA_NUM_BLIT_SLOTS) 
+                        cur = 0;
+                blitq->cur = cur;
+                /*
+                 * Clear transfer done flag.
+                 */
+                VIA_WRITE(VIA_PCI_DMA_CSR0 + engine*0x04,  VIA_DMA_CSR_TD);
+                blitq->is_active = 0;
+                blitq->aborting = 0;
+                schedule_work(&blitq->wq);      
+        } else if (blitq->is_active && time_after_eq(jiffies, blitq->end)) {
+                /*
+                 * Abort transfer after one second.
+                 */
+                via_abort_dmablit(dev, engine);
+                blitq->aborting = 1;
+                blitq->end = jiffies + DRM_HZ;
+        }
+                        
+        if (!blitq->is_active) {
+                if (blitq->num_outstanding) {
+                        via_fire_dmablit(dev, blitq->blits[cur], engine);
+                        blitq->is_active = 1;
+                        blitq->cur = cur;
+                        blitq->num_outstanding--;
+                        blitq->end = jiffies + DRM_HZ;
+                        if (!timer_pending(&blitq->poll_timer)) {
+                                blitq->poll_timer.expires = jiffies+1;
+                                add_timer(&blitq->poll_timer);
+                        }
+                } else {
+                        if (timer_pending(&blitq->poll_timer)) {
+                                del_timer(&blitq->poll_timer);
+                        }
+                        via_dmablit_engine_off(dev, engine);
+                }
+        }               
+        if (from_irq) {
+                spin_unlock(&blitq->blit_lock);
+        } else {
+                spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
+        }
+} 
+/*
+ * Check whether this blit is still active, performing necessary locking.
+ */
+static int
+via_dmablit_active(drm_via_blitq_t *blitq, int engine, uint32_t handle, wait_queue_head_t **queue)
+{
+        unsigned long irqsave;
+        uint32_t slot;
+        int active;
+        spin_lock_irqsave(&blitq->blit_lock, irqsave);
+        /*
+         * Allow for handle wraparounds.
+         */
+        active = ((blitq->done_blit_handle - handle) > (1 << 23)) &&
+                ((blitq->cur_blit_handle - handle) <= (1 << 23));
+        if (queue && active) {
+                slot = handle - blitq->done_blit_handle + blitq->cur -1;
+                if (slot >= VIA_NUM_BLIT_SLOTS) {
+                        slot -= VIA_NUM_BLIT_SLOTS;
+                }
+                *queue = blitq->blit_queue + slot;
+        }
+        spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
+        return active;
+}
+        
+/*
+ * Sync. Wait for at least three seconds for the blit to be performed.
+ */
+static int
+via_dmablit_sync(drm_device_t *dev, uint32_t handle, int engine) 
+{
+        drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
+        drm_via_blitq_t *blitq = dev_priv->blit_queues + engine;
+        wait_queue_head_t *queue;
+        int ret = 0;
+        if (via_dmablit_active(blitq, engine, handle, &queue)) {
+                DRM_WAIT_ON(ret, *queue, 3 * DRM_HZ, 
+                            !via_dmablit_active(blitq, engine, handle, NULL));
+        }
+        DRM_DEBUG("DMA blit sync handle 0x%x engine %d returned %d\n",
+                  handle, engine, ret);
+        
+        return ret;
+}
+/*
+ * A timer that regularly polls the blit engine in cases where we don't have interrupts:
+ * a) Broken hardware (typically those that don't have any video capture facility).
+ * b) Blit abort. The hardware doesn't send an interrupt when a blit is aborted.
+ * The timer and hardware IRQ's can and do work in parallel. If the hardware has
+ * irqs, it will shorten the latency somewhat.
+ */
+static void
+via_dmablit_timer(unsigned long data)
+{
+        drm_via_blitq_t *blitq = (drm_via_blitq_t *) data;
+        drm_device_t *dev = blitq->dev;
+        int engine = (int)
+                (blitq - ((drm_via_private_t *)dev->dev_private)->blit_queues);
+                
+        DRM_DEBUG("Polling timer called for engine %d, jiffies %lu\n", engine, 
+                  (unsigned long) jiffies);
+        via_dmablit_handler(dev, engine, 0);
+        
+        if (!timer_pending(&blitq->poll_timer)) {
+                blitq->poll_timer.expires = jiffies+1;
+                add_timer(&blitq->poll_timer);
+        }
+        via_dmablit_handler(dev, engine, 0);
+}
+/*
+ * Workqueue task that frees data and mappings associated with a blit.
+ * Also wakes up waiting processes. Each of these tasks handles one
+ * blit engine only and may not be called on each interrupt.
+ */
+static void 
+via_dmablit_workqueue(void *data)
+{
+        drm_via_blitq_t *blitq = (drm_via_blitq_t *) data;
+        drm_device_t *dev = blitq->dev;
+        unsigned long irqsave;
+        drm_via_sg_info_t *cur_sg;
+        int cur_released;
+        
+        
+        DRM_DEBUG("Workqueue task called for blit engine %ld\n",(unsigned long) 
+                  (blitq - ((drm_via_private_t *)dev->dev_private)->blit_queues));
+        spin_lock_irqsave(&blitq->blit_lock, irqsave);
+        
+        while(blitq->serviced != blitq->cur) {
+                cur_released = blitq->serviced++;
+                DRM_DEBUG("Releasing blit slot %d\n", cur_released);
+                if (blitq->serviced >= VIA_NUM_BLIT_SLOTS) 
+                        blitq->serviced = 0;
+                
+                cur_sg = blitq->blits[cur_released];
+                blitq->num_free++;
+                                
+                spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
+                
+                DRM_WAKEUP(&blitq->busy_queue);
+                
+                via_free_sg_info(dev->pdev, cur_sg);
+                kfree(cur_sg);
+                
+                spin_lock_irqsave(&blitq->blit_lock, irqsave);
+        }
+        spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
+}
+        
+/*
+ * Init all blit engines. Currently we use two, but some hardware have 4.
+ */
+void
+via_init_dmablit(drm_device_t *dev)
+{
+        int i,j;
+        drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
+        drm_via_blitq_t *blitq;
+        pci_set_master(dev->pdev);      
+        
+        for (i=0; i< VIA_NUM_BLIT_ENGINES; ++i) {
+                blitq = dev_priv->blit_queues + i;
+                blitq->dev = dev;
+                blitq->cur_blit_handle = 0;
+                blitq->done_blit_handle = 0;
+                blitq->head = 0;
+                blitq->cur = 0;
+                blitq->serviced = 0;
+                blitq->num_free = VIA_NUM_BLIT_SLOTS;
+                blitq->num_outstanding = 0;
+                blitq->is_active = 0;
+                blitq->aborting = 0;
+                blitq->blit_lock = SPIN_LOCK_UNLOCKED;
+                for (j=0; j<VIA_NUM_BLIT_SLOTS; ++j) {
+                        DRM_INIT_WAITQUEUE(blitq->blit_queue + j);
+                }
+                DRM_INIT_WAITQUEUE(&blitq->busy_queue);
+                INIT_WORK(&blitq->wq, via_dmablit_workqueue, blitq);
+                init_timer(&blitq->poll_timer);
+                blitq->poll_timer.function = &via_dmablit_timer;
+                blitq->poll_timer.data = (unsigned long) blitq;
+        }       
+}
+/*
+ * Build all info and do all mappings required for a blit.
+ */
+                
+static int
+via_build_sg_info(drm_device_t *dev, drm_via_sg_info_t *vsg, drm_via_dmablit_t *xfer)
+{
+        int draw = xfer->to_fb;
+        int ret = 0;
+        
+        vsg->direction = (draw) ? DMA_TO_DEVICE : DMA_FROM_DEVICE;
+        vsg->bounce_buffer = 0;
+        vsg->state = dr_via_sg_init;
+        if (xfer->num_lines <= 0 || xfer->line_length <= 0) {
+                DRM_ERROR("Zero size bitblt.\n");
+                return DRM_ERR(EINVAL);
+        }
+        /*
+         * Below check is a driver limitation, not a hardware one. We
+         * don't want to lock unused pages, and don't want to incoporate the
+         * extra logic of avoiding them. Make sure there are no. 
+         * (Not a big limitation anyway.)
+         */
+        if (((xfer->mem_stride - xfer->line_length) >= PAGE_SIZE) ||
+            (xfer->mem_stride > 2048*4)) {
+                DRM_ERROR("Too large system memory stride. Stride: %d, "
+                          "Length: %d\n", xfer->mem_stride, xfer->line_length);
+                return DRM_ERR(EINVAL);
+        }
+        if (xfer->num_lines > 2048) {
+                DRM_ERROR("Too many PCI DMA bitblt lines.\n");
+                return DRM_ERR(EINVAL);
+        }               
+        /* 
+         * we allow a negative fb stride to allow flipping of images in
+         * transfer. 
+         */
+        if (xfer->mem_stride < xfer->line_length ||
+                abs(xfer->fb_stride) < xfer->line_length) {
+                DRM_ERROR("Invalid frame-buffer / memory stride.\n");
+                return DRM_ERR(EINVAL);
+        }
+        /*
+         * A hardware bug seems to be worked around if system memory addresses start on
+         * 16 byte boundaries. This seems a bit restrictive however. VIA is contacted
+         * about this. Meanwhile, impose the following restrictions:
+         */
+#ifdef VIA_BUGFREE
+        if ((((unsigned long)xfer->mem_addr & 3) != ((unsigned long)xfer->fb_addr & 3)) ||
+            ((xfer->mem_stride & 3) != (xfer->fb_stride & 3))) {
+                DRM_ERROR("Invalid DRM bitblt alignment.\n");
+                return DRM_ERR(EINVAL);
+        }
+#else
+        if ((((unsigned long)xfer->mem_addr & 15) ||
+            ((unsigned long)xfer->fb_addr & 3)) || (xfer->mem_stride & 15) ||
+            (xfer->fb_stride & 3)) {
+                DRM_ERROR("Invalid DRM bitblt alignment.\n");
+                return DRM_ERR(EINVAL);
+        }       
+#endif
+        if (0 != (ret = via_lock_all_dma_pages(vsg, xfer))) {
+                DRM_ERROR("Could not lock DMA pages.\n");
+                via_free_sg_info(dev->pdev, vsg);
+                return ret;
+        }
+        via_map_blit_for_device(dev->pdev, xfer, vsg, 0);
+        if (0 != (ret = via_alloc_desc_pages(vsg))) {
+                DRM_ERROR("Could not allocate DMA descriptor pages.\n");
+                via_free_sg_info(dev->pdev, vsg);
+                return ret;
+        }
+        via_map_blit_for_device(dev->pdev, xfer, vsg, 1);
+        
+        return 0;
+}
+        
+/*
+ * Reserve one free slot in the blit queue. Will wait for one second for one
+ * to become available. Otherwise -EBUSY is returned.
+ */
+static int 
+via_dmablit_grab_slot(drm_via_blitq_t *blitq, int engine)
+{
+        int ret=0;
+        unsigned long irqsave;
+        DRM_DEBUG("Num free is %d\n", blitq->num_free);
+        spin_lock_irqsave(&blitq->blit_lock, irqsave);
+        while(blitq->num_free == 0) {
+                spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
+                DRM_WAIT_ON(ret, blitq->busy_queue, DRM_HZ, blitq->num_free > 0);
+                if (ret) {
+                        return (DRM_ERR(EINTR) == ret) ? DRM_ERR(EAGAIN) : ret;
+                }
+                
+                spin_lock_irqsave(&blitq->blit_lock, irqsave);
+        }
+        
+        blitq->num_free--;
+        spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
+        return 0;
+}
+/*
+ * Hand back a free slot if we changed our mind.
+ */
+static void 
+via_dmablit_release_slot(drm_via_blitq_t *blitq)
+{
+        unsigned long irqsave;
+        spin_lock_irqsave(&blitq->blit_lock, irqsave);
+        blitq->num_free++;
+        spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
+        DRM_WAKEUP( &blitq->busy_queue );
+}
+/*
+ * Grab a free slot. Build blit info and queue a blit.
+ */
+static int 
+via_dmablit(drm_device_t *dev, drm_via_dmablit_t *xfer)  
+{
+        drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
+        drm_via_sg_info_t *vsg;
+        drm_via_blitq_t *blitq;
+        int ret;
+        int engine;
+        unsigned long irqsave;
+        if (dev_priv == NULL) {
+                DRM_ERROR("Called without initialization.\n");
+                return DRM_ERR(EINVAL);
+        }
+        engine = (xfer->to_fb) ? 0 : 1;
+        blitq = dev_priv->blit_queues + engine;
+        if (0 != (ret = via_dmablit_grab_slot(blitq, engine))) {
+                return ret;
+        }
+        if (NULL == (vsg = kmalloc(sizeof(*vsg), GFP_KERNEL))) {
+                via_dmablit_release_slot(blitq);
+                return DRM_ERR(ENOMEM);
+        }
+        if (0 != (ret = via_build_sg_info(dev, vsg, xfer))) {
+                via_dmablit_release_slot(blitq);
+                kfree(vsg);
+                return ret;
+        }
+        spin_lock_irqsave(&blitq->blit_lock, irqsave);
+        blitq->blits[blitq->head++] = vsg;
+        if (blitq->head >= VIA_NUM_BLIT_SLOTS) 
+                blitq->head = 0;
+        blitq->num_outstanding++;
+        xfer->sync.sync_handle = ++blitq->cur_blit_handle; 
+        spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
+        xfer->sync.engine = engine;
+        via_dmablit_handler(dev, engine, 0);
+        return 0;
+}
+/*
+ * Sync on a previously submitted blit. Note that the X server use signals extensively, and
+ * that there is a very big proability that this IOCTL will be interrupted by a signal. In that
+ * case it returns with -EAGAIN for the signal to be delivered. 
+ * The caller should then reissue the IOCTL. This is similar to what is being done for drmGetLock().
+ */
+int
+via_dma_blit_sync( DRM_IOCTL_ARGS )
+{
+        drm_via_blitsync_t sync;
+        int err;
+        DRM_DEVICE;
+        DRM_COPY_FROM_USER_IOCTL(sync, (drm_via_blitsync_t *)data, sizeof(sync));
+        
+        if (sync.engine >= VIA_NUM_BLIT_ENGINES) 
+                return DRM_ERR(EINVAL);
+        err = via_dmablit_sync(dev, sync.sync_handle, sync.engine);
+        if (DRM_ERR(EINTR) == err)
+                err = DRM_ERR(EAGAIN);
+        return err;
+}
+        
+/*
+ * Queue a blit and hand back a handle to be used for sync. This IOCTL may be interrupted by a signal
+ * while waiting for a free slot in the blit queue. In that case it returns with -EAGAIN and should 
+ * be reissued. See the above IOCTL code.
+ */
+int 
+via_dma_blit( DRM_IOCTL_ARGS )
+{
+        drm_via_dmablit_t xfer;
+        int err;
+        DRM_DEVICE;
+        DRM_COPY_FROM_USER_IOCTL(xfer, (drm_via_dmablit_t __user *)data, sizeof(xfer));
+        err = via_dmablit(dev, &xfer);
+        DRM_COPY_TO_USER_IOCTL((void __user *)data, xfer, sizeof(xfer));
+        return err;
+}
diff --git a/drivers/char/drm/via_dmablit.h b/drivers/char/drm/via_dmablit.h
new file mode 100644
index 000000000000..f4036cd5d0e0
--- /dev/null
+++ b/drivers/char/drm/via_dmablit.h
@@ -0,0 +1,140 @@
+/* via_dmablit.h -- PCI DMA BitBlt support for the VIA Unichrome/Pro
+ * 
+ * Copyright 2005 Thomas Hellstrom.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sub license,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, 
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR 
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE 
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: 
+ *    Thomas Hellstrom.
+ *    Register info from Digeo Inc.
+ */
+#ifndef _VIA_DMABLIT_H
+#define _VIA_DMABLIT_H
+#include <linux/dma-mapping.h>
+#define VIA_NUM_BLIT_ENGINES 2
+#define VIA_NUM_BLIT_SLOTS 8
+struct _drm_via_descriptor;
+typedef struct _drm_via_sg_info {
+        struct page **pages;
+        unsigned long num_pages;
+        struct _drm_via_descriptor **desc_pages;
+        int num_desc_pages;
+        int num_desc;
+        enum dma_data_direction direction;
+        unsigned char *bounce_buffer;
+        dma_addr_t chain_start;
+        uint32_t free_on_sequence;
+        unsigned int descriptors_per_page;
+        int aborted;
+        enum {
+                dr_via_device_mapped,
+                dr_via_desc_pages_alloc,
+                dr_via_pages_locked,
+                dr_via_pages_alloc,
+                dr_via_sg_init
+        } state;
+} drm_via_sg_info_t;
+typedef struct _drm_via_blitq {
+        drm_device_t *dev;
+        uint32_t cur_blit_handle;
+        uint32_t done_blit_handle;
+        unsigned serviced;
+        unsigned head;
+        unsigned cur;
+        unsigned num_free;
+        unsigned num_outstanding;
+        unsigned long end;  
+        int aborting;
+        int is_active;
+        drm_via_sg_info_t *blits[VIA_NUM_BLIT_SLOTS];
+        spinlock_t blit_lock;
+        wait_queue_head_t blit_queue[VIA_NUM_BLIT_SLOTS];
+        wait_queue_head_t busy_queue;
+        struct work_struct wq;
+        struct timer_list poll_timer;
+} drm_via_blitq_t;
+        
+/* 
+ *  PCI DMA Registers
+ *  Channels 2 & 3 don't seem to be implemented in hardware.
+ */
+ 
+#define VIA_PCI_DMA_MAR0            0xE40   /* Memory Address Register of Channel 0 */ 
+#define VIA_PCI_DMA_DAR0            0xE44   /* Device Address Register of Channel 0 */ 
+#define VIA_PCI_DMA_BCR0            0xE48   /* Byte Count Register of Channel 0 */ 
+#define VIA_PCI_DMA_DPR0            0xE4C   /* Descriptor Pointer Register of Channel 0 */ 
+#define VIA_PCI_DMA_MAR1            0xE50   /* Memory Address Register of Channel 1 */ 
+#define VIA_PCI_DMA_DAR1            0xE54   /* Device Address Register of Channel 1 */ 
+#define VIA_PCI_DMA_BCR1            0xE58   /* Byte Count Register of Channel 1 */ 
+#define VIA_PCI_DMA_DPR1            0xE5C   /* Descriptor Pointer Register of Channel 1 */ 
+#define VIA_PCI_DMA_MAR2            0xE60   /* Memory Address Register of Channel 2 */ 
+#define VIA_PCI_DMA_DAR2            0xE64   /* Device Address Register of Channel 2 */ 
+#define VIA_PCI_DMA_BCR2            0xE68   /* Byte Count Register of Channel 2 */ 
+#define VIA_PCI_DMA_DPR2            0xE6C   /* Descriptor Pointer Register of Channel 2 */ 
+#define VIA_PCI_DMA_MAR3            0xE70   /* Memory Address Register of Channel 3 */ 
+#define VIA_PCI_DMA_DAR3            0xE74   /* Device Address Register of Channel 3 */ 
+#define VIA_PCI_DMA_BCR3            0xE78   /* Byte Count Register of Channel 3 */ 
+#define VIA_PCI_DMA_DPR3            0xE7C   /* Descriptor Pointer Register of Channel 3 */ 
+#define VIA_PCI_DMA_MR0             0xE80   /* Mode Register of Channel 0 */ 
+#define VIA_PCI_DMA_MR1             0xE84   /* Mode Register of Channel 1 */ 
+#define VIA_PCI_DMA_MR2             0xE88   /* Mode Register of Channel 2 */ 
+#define VIA_PCI_DMA_MR3             0xE8C   /* Mode Register of Channel 3 */ 
+#define VIA_PCI_DMA_CSR0            0xE90   /* Command/Status Register of Channel 0 */ 
+#define VIA_PCI_DMA_CSR1            0xE94   /* Command/Status Register of Channel 1 */ 
+#define VIA_PCI_DMA_CSR2            0xE98   /* Command/Status Register of Channel 2 */ 
+#define VIA_PCI_DMA_CSR3            0xE9C   /* Command/Status Register of Channel 3 */ 
+#define VIA_PCI_DMA_PTR             0xEA0   /* Priority Type Register */ 
+/* Define for DMA engine */ 
+/* DPR */
+#define VIA_DMA_DPR_EC          (1<<1)  /* end of chain */
+#define VIA_DMA_DPR_DDIE        (1<<2)  /* descriptor done interrupt enable */
+#define VIA_DMA_DPR_DT          (1<<3)  /* direction of transfer (RO) */
+/* MR */
+#define VIA_DMA_MR_CM           (1<<0)  /* chaining mode */
+#define VIA_DMA_MR_TDIE         (1<<1)  /* transfer done interrupt enable */
+#define VIA_DMA_MR_HENDMACMD            (1<<7) /* ? */
+/* CSR */
+#define VIA_DMA_CSR_DE          (1<<0)  /* DMA enable */
+#define VIA_DMA_CSR_TS          (1<<1)  /* transfer start */
+#define VIA_DMA_CSR_TA          (1<<2)  /* transfer abort */
+#define VIA_DMA_CSR_TD          (1<<3)  /* transfer done */
+#define VIA_DMA_CSR_DD          (1<<4)  /* descriptor done */
+#define VIA_DMA_DPR_EC          (1<<1)  /* end of chain */
+#endif
diff --git a/drivers/char/drm/via_drm.h b/drivers/char/drm/via_drm.h
index ebde9206115e..47f0b5b26379 100644
--- a/drivers/char/drm/via_drm.h
+++ b/drivers/char/drm/via_drm.h
@@ -75,6 +75,8 @@
 #define DRM_VIA_CMDBUF_SIZE     0x0b
 #define NOT_USED
 #define DRM_VIA_WAIT_IRQ        0x0d
+#define DRM_VIA_DMA_BLIT        0x0e
+#define DRM_VIA_BLIT_SYNC       0x0f
 #define DRM_IOCTL_VIA_ALLOCMEM    DRM_IOWR(DRM_COMMAND_BASE + DRM_VIA_ALLOCMEM, drm_via_mem_t)
 #define DRM_IOCTL_VIA_FREEMEM     DRM_IOW( DRM_COMMAND_BASE + DRM_VIA_FREEMEM, drm_via_mem_t)
@@ -89,6 +91,8 @@
 #define DRM_IOCTL_VIA_CMDBUF_SIZE DRM_IOWR( DRM_COMMAND_BASE + DRM_VIA_CMDBUF_SIZE, \
                                            drm_via_cmdbuf_size_t)
 #define DRM_IOCTL_VIA_WAIT_IRQ    DRM_IOWR( DRM_COMMAND_BASE + DRM_VIA_WAIT_IRQ, drm_via_irqwait_t)
+#define DRM_IOCTL_VIA_DMA_BLIT    DRM_IOW(DRM_COMMAND_BASE + DRM_VIA_DMA_BLIT, drm_via_dmablit_t)
+#define DRM_IOCTL_VIA_BLIT_SYNC   DRM_IOW(DRM_COMMAND_BASE + DRM_VIA_BLIT_SYNC, drm_via_blitsync_t)
 /* Indices into buf.Setup where various bits of state are mirrored per
 * context and per buffer.  These can be fired at the card as a unit,
@@ -103,8 +107,12 @@
 #define VIA_BACK    0x2
 #define VIA_DEPTH   0x4
 #define VIA_STENCIL 0x8
-#define VIDEO 0
+#define VIA_MEM_VIDEO   0       /* matches drm constant */
-#define AGP 1
+#define VIA_MEM_AGP     1       /* matches drm constant */
+#define VIA_MEM_SYSTEM  2
+#define VIA_MEM_MIXED   3
+#define VIA_MEM_UNKNOWN 4
 typedef struct {
        uint32_t offset;
        uint32_t size;
@@ -192,6 +200,9 @@ typedef struct _drm_via_sarea {
        unsigned int XvMCSubPicOn[VIA_NR_XVMC_PORTS];
        unsigned int XvMCCtxNoGrabbed;  /* Last context to hold decoder */
+        /* Used by the 3d driver only at this point, for pageflipping:
+         */
+        unsigned int pfCurrentOffset;
 } drm_via_sarea_t;
 typedef struct _drm_via_cmdbuf_size {
@@ -212,6 +223,16 @@ typedef enum {
 #define VIA_IRQ_FLAGS_MASK 0xF0000000
+enum drm_via_irqs {
+        drm_via_irq_hqv0 = 0,
+        drm_via_irq_hqv1,
+        drm_via_irq_dma0_dd,
+        drm_via_irq_dma0_td,
+        drm_via_irq_dma1_dd,
+        drm_via_irq_dma1_td,
+        drm_via_irq_num
+};
 struct drm_via_wait_irq_request {
        unsigned irq;
        via_irq_seq_type_t type;
@@ -224,20 +245,25 @@ typedef union drm_via_irqwait {
        struct drm_wait_vblank_reply reply;
 } drm_via_irqwait_t;
-#ifdef __KERNEL__
+typedef struct drm_via_blitsync {
+        uint32_t sync_handle;
-int via_fb_init(DRM_IOCTL_ARGS);
+        unsigned engine;
-int via_mem_alloc(DRM_IOCTL_ARGS);
+} drm_via_blitsync_t;
-int via_mem_free(DRM_IOCTL_ARGS);
-int via_agp_init(DRM_IOCTL_ARGS);
+typedef struct drm_via_dmablit {
-int via_map_init(DRM_IOCTL_ARGS);
+        uint32_t num_lines;
-int via_decoder_futex(DRM_IOCTL_ARGS);
+        uint32_t line_length;
-int via_dma_init(DRM_IOCTL_ARGS);
+        
-int via_cmdbuffer(DRM_IOCTL_ARGS);
+        uint32_t fb_addr;
-int via_flush_ioctl(DRM_IOCTL_ARGS);
+        uint32_t fb_stride;
-int via_pci_cmdbuffer(DRM_IOCTL_ARGS);
-int via_cmdbuf_size(DRM_IOCTL_ARGS);
+        unsigned char *mem_addr;
-int via_wait_irq(DRM_IOCTL_ARGS);
+        uint32_t mem_stride;
+        int bounce_buffer;
+        int to_fb;
+        drm_via_blitsync_t sync;
+} drm_via_dmablit_t;
-#endif
 #endif                          /* _VIA_DRM_H_ */
diff --git a/drivers/char/drm/via_drv.c b/drivers/char/drm/via_drv.c
index 016665e0c69f..3f012255d315 100644
--- a/drivers/char/drm/via_drv.c
+++ b/drivers/char/drm/via_drv.c
@@ -29,54 +29,21 @@
 #include "drm_pciids.h"
-static int postinit(struct drm_device *dev, unsigned long flags)
+static int dri_library_name(struct drm_device *dev, char *buf)
 {
-        DRM_INFO("Initialized %s %d.%d.%d %s on minor %d: %s\n",
+        return snprintf(buf, PAGE_SIZE, "unichrome");
-                 DRIVER_NAME,
-                 DRIVER_MAJOR,
-                 DRIVER_MINOR,
-                 DRIVER_PATCHLEVEL,
-                 DRIVER_DATE, dev->primary.minor, pci_pretty_name(dev->pdev)
-            );
-        return 0;
-}
-static int version(drm_version_t * version)
-{
-        int len;
-        version->version_major = DRIVER_MAJOR;
-        version->version_minor = DRIVER_MINOR;
-        version->version_patchlevel = DRIVER_PATCHLEVEL;
-        DRM_COPY(version->name, DRIVER_NAME);
-        DRM_COPY(version->date, DRIVER_DATE);
-        DRM_COPY(version->desc, DRIVER_DESC);
-        return 0;
 }
 static struct pci_device_id pciidlist[] = {
        viadrv_PCI_IDS
 };
-static drm_ioctl_desc_t ioctls[] = {
-        [DRM_IOCTL_NR(DRM_VIA_ALLOCMEM)] = {via_mem_alloc, 1, 0},
-        [DRM_IOCTL_NR(DRM_VIA_FREEMEM)] = {via_mem_free, 1, 0},
-        [DRM_IOCTL_NR(DRM_VIA_AGP_INIT)] = {via_agp_init, 1, 0},
-        [DRM_IOCTL_NR(DRM_VIA_FB_INIT)] = {via_fb_init, 1, 0},
-        [DRM_IOCTL_NR(DRM_VIA_MAP_INIT)] = {via_map_init, 1, 0},
-        [DRM_IOCTL_NR(DRM_VIA_DEC_FUTEX)] = {via_decoder_futex, 1, 0},
-        [DRM_IOCTL_NR(DRM_VIA_DMA_INIT)] = {via_dma_init, 1, 0},
-        [DRM_IOCTL_NR(DRM_VIA_CMDBUFFER)] = {via_cmdbuffer, 1, 0},
-        [DRM_IOCTL_NR(DRM_VIA_FLUSH)] = {via_flush_ioctl, 1, 0},
-        [DRM_IOCTL_NR(DRM_VIA_PCICMD)] = {via_pci_cmdbuffer, 1, 0},
-        [DRM_IOCTL_NR(DRM_VIA_CMDBUF_SIZE)] = {via_cmdbuf_size, 1, 0},
-        [DRM_IOCTL_NR(DRM_VIA_WAIT_IRQ)] = {via_wait_irq, 1, 0}
-};
 static struct drm_driver driver = {
        .driver_features =
            DRIVER_USE_AGP | DRIVER_USE_MTRR | DRIVER_HAVE_IRQ |
            DRIVER_IRQ_SHARED | DRIVER_IRQ_VBL,
+        .load = via_driver_load,
+        .unload = via_driver_unload,
        .context_ctor = via_init_context,
        .context_dtor = via_final_context,
        .vblank_wait = via_driver_vblank_wait,
@@ -85,13 +52,11 @@ static struct drm_driver driver = {
        .irq_uninstall = via_driver_irq_uninstall,
        .irq_handler = via_driver_irq_handler,
        .dma_quiescent = via_driver_dma_quiescent,
+        .dri_library_name = dri_library_name,
        .reclaim_buffers = drm_core_reclaim_buffers,
        .get_map_ofs = drm_core_get_map_ofs,
        .get_reg_ofs = drm_core_get_reg_ofs,
-        .postinit = postinit,
+        .ioctls = via_ioctls,
-        .version = version,
-        .ioctls = ioctls,
-        .num_ioctls = DRM_ARRAY_SIZE(ioctls),
        .fops = {
                 .owner = THIS_MODULE,
                 .open = drm_open,
@@ -100,15 +65,23 @@ static struct drm_driver driver = {
                 .mmap = drm_mmap,
                 .poll = drm_poll,
                 .fasync = drm_fasync,
-                 },
+        },
        .pci_driver = {
-                       .name = DRIVER_NAME,
+                 .name = DRIVER_NAME,
-                       .id_table = pciidlist,
+                 .id_table = pciidlist,
-                       }
+        },
+        
+        .name = DRIVER_NAME,
+        .desc = DRIVER_DESC,
+        .date = DRIVER_DATE,
+        .major = DRIVER_MAJOR,
+        .minor = DRIVER_MINOR,
+        .patchlevel = DRIVER_PATCHLEVEL,
 };
 static int __init via_init(void)
 {
+        driver.num_ioctls = via_max_ioctl;
        via_init_command_verifier();
        return drm_init(&driver);
 }
diff --git a/drivers/char/drm/via_drv.h b/drivers/char/drm/via_drv.h
index 7d5daf43797e..aad4f99f5405 100644
--- a/drivers/char/drm/via_drv.h
+++ b/drivers/char/drm/via_drv.h
@@ -24,24 +24,26 @@
 #ifndef _VIA_DRV_H_
 #define _VIA_DRV_H_
-#define DRIVER_AUTHOR   "VIA"
+#define DRIVER_AUTHOR   "Various"
 #define DRIVER_NAME             "via"
 #define DRIVER_DESC             "VIA Unichrome / Pro"
-#define DRIVER_DATE             "20050523"
+#define DRIVER_DATE             "20051116"
 #define DRIVER_MAJOR            2
-#define DRIVER_MINOR            6
+#define DRIVER_MINOR            7
-#define DRIVER_PATCHLEVEL       3
+#define DRIVER_PATCHLEVEL       4
 #include "via_verifier.h"
+#include "via_dmablit.h"
 #define VIA_PCI_BUF_SIZE 60000
 #define VIA_FIRE_BUF_SIZE  1024
-#define VIA_NUM_IRQS 2
+#define VIA_NUM_IRQS 4
 typedef struct drm_via_ring_buffer {
-        drm_map_t map;
+        drm_local_map_t map;
        char *virtual_start;
 } drm_via_ring_buffer_t;
@@ -56,9 +58,9 @@ typedef struct drm_via_irq {
 typedef struct drm_via_private {
        drm_via_sarea_t *sarea_priv;
-        drm_map_t *sarea;
+        drm_local_map_t *sarea;
-        drm_map_t *fb;
+        drm_local_map_t *fb;
-        drm_map_t *mmio;
+        drm_local_map_t *mmio;
        unsigned long agpAddr;
        wait_queue_head_t decoder_queue[VIA_NR_XVMC_LOCKS];
        char *dma_ptr;
@@ -82,8 +84,15 @@ typedef struct drm_via_private {
        maskarray_t *irq_masks;
        uint32_t irq_enable_mask;
        uint32_t irq_pending_mask;
+        int *irq_map;
+        drm_via_blitq_t blit_queues[VIA_NUM_BLIT_ENGINES];
 } drm_via_private_t;
+enum via_family {
+        VIA_OTHER = 0,
+        VIA_PRO_GROUP_A,
+};
 /* VIA MMIO register access */
 #define VIA_BASE ((dev_priv->mmio))
@@ -92,12 +101,31 @@ typedef struct drm_via_private {
 #define VIA_READ8(reg)          DRM_READ8(VIA_BASE, reg)
 #define VIA_WRITE8(reg,val)     DRM_WRITE8(VIA_BASE, reg, val)
+extern drm_ioctl_desc_t via_ioctls[];
+extern int via_max_ioctl;
+extern int via_fb_init(DRM_IOCTL_ARGS);
+extern int via_mem_alloc(DRM_IOCTL_ARGS);
+extern int via_mem_free(DRM_IOCTL_ARGS);
+extern int via_agp_init(DRM_IOCTL_ARGS);
+extern int via_map_init(DRM_IOCTL_ARGS);
+extern int via_decoder_futex(DRM_IOCTL_ARGS);
+extern int via_dma_init(DRM_IOCTL_ARGS);
+extern int via_cmdbuffer(DRM_IOCTL_ARGS);
+extern int via_flush_ioctl(DRM_IOCTL_ARGS);
+extern int via_pci_cmdbuffer(DRM_IOCTL_ARGS);
+extern int via_cmdbuf_size(DRM_IOCTL_ARGS);
+extern int via_wait_irq(DRM_IOCTL_ARGS);
+extern int via_dma_blit_sync( DRM_IOCTL_ARGS );
+extern int via_dma_blit( DRM_IOCTL_ARGS );
+extern int via_driver_load(drm_device_t *dev, unsigned long chipset);
+extern int via_driver_unload(drm_device_t *dev);
 extern int via_init_context(drm_device_t * dev, int context);
 extern int via_final_context(drm_device_t * dev, int context);
 extern int via_do_cleanup_map(drm_device_t * dev);
-extern int via_map_init(struct inode *inode, struct file *filp,
-                        unsigned int cmd, unsigned long arg);
 extern int via_driver_vblank_wait(drm_device_t * dev, unsigned int *sequence);
 extern irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS);
@@ -111,8 +139,10 @@ extern int via_driver_dma_quiescent(drm_device_t * dev);
 extern void via_init_futex(drm_via_private_t * dev_priv);
 extern void via_cleanup_futex(drm_via_private_t * dev_priv);
 extern void via_release_futex(drm_via_private_t * dev_priv, int context);
+extern int via_driver_irq_wait(drm_device_t * dev, unsigned int irq,
+                               int force_sequence, unsigned int *sequence);
-extern int via_parse_command_stream(drm_device_t * dev, const uint32_t * buf,
+extern void via_dmablit_handler(drm_device_t *dev, int engine, int from_irq);
-                                    unsigned int size);
+extern void via_init_dmablit(drm_device_t *dev);
 #endif
diff --git a/drivers/char/drm/via_ds.c b/drivers/char/drm/via_ds.c
index 5c71e089246c..9429736b3b96 100644
--- a/drivers/char/drm/via_ds.c
+++ b/drivers/char/drm/via_ds.c
@@ -22,14 +22,7 @@
 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 * DEALINGS IN THE SOFTWARE.
 */
-#include <linux/module.h>
+#include "drmP.h"
-#include <linux/delay.h>
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/slab.h>
-#include <linux/poll.h>
-#include <linux/pci.h>
-#include <asm/io.h>
 #include "via_ds.h"
 extern unsigned int VIA_DEBUG;
diff --git a/drivers/char/drm/via_irq.c b/drivers/char/drm/via_irq.c
index d023add1929b..56d7e3daea12 100644
--- a/drivers/char/drm/via_irq.c
+++ b/drivers/char/drm/via_irq.c
@@ -50,6 +50,15 @@
 #define VIA_IRQ_HQV1_ENABLE     (1 << 25)
 #define VIA_IRQ_HQV0_PENDING    (1 << 9)
 #define VIA_IRQ_HQV1_PENDING    (1 << 10)
+#define VIA_IRQ_DMA0_DD_ENABLE  (1 << 20)
+#define VIA_IRQ_DMA0_TD_ENABLE  (1 << 21)
+#define VIA_IRQ_DMA1_DD_ENABLE  (1 << 22)
+#define VIA_IRQ_DMA1_TD_ENABLE  (1 << 23)
+#define VIA_IRQ_DMA0_DD_PENDING (1 << 4)
+#define VIA_IRQ_DMA0_TD_PENDING (1 << 5)
+#define VIA_IRQ_DMA1_DD_PENDING (1 << 6)
+#define VIA_IRQ_DMA1_TD_PENDING (1 << 7)
 /*
 * Device-specific IRQs go here. This type might need to be extended with
@@ -61,13 +70,24 @@ static maskarray_t via_pro_group_a_irqs[] = {
        {VIA_IRQ_HQV0_ENABLE, VIA_IRQ_HQV0_PENDING, 0x000003D0, 0x00008010,
         0x00000000},
        {VIA_IRQ_HQV1_ENABLE, VIA_IRQ_HQV1_PENDING, 0x000013D0, 0x00008010,
-         0x00000000}
+         0x00000000},
+        {VIA_IRQ_DMA0_TD_ENABLE, VIA_IRQ_DMA0_TD_PENDING, VIA_PCI_DMA_CSR0,
+         VIA_DMA_CSR_TA | VIA_DMA_CSR_TD, 0x00000008},
+        {VIA_IRQ_DMA1_TD_ENABLE, VIA_IRQ_DMA1_TD_PENDING, VIA_PCI_DMA_CSR1,
+         VIA_DMA_CSR_TA | VIA_DMA_CSR_TD, 0x00000008},
 };
 static int via_num_pro_group_a =
    sizeof(via_pro_group_a_irqs) / sizeof(maskarray_t);
+static int via_irqmap_pro_group_a[] = {0, 1, -1, 2, -1, 3};
-static maskarray_t via_unichrome_irqs[] = { };
+static maskarray_t via_unichrome_irqs[] = {
+        {VIA_IRQ_DMA0_TD_ENABLE, VIA_IRQ_DMA0_TD_PENDING, VIA_PCI_DMA_CSR0,
+         VIA_DMA_CSR_TA | VIA_DMA_CSR_TD, 0x00000008},
+        {VIA_IRQ_DMA1_TD_ENABLE, VIA_IRQ_DMA1_TD_PENDING, VIA_PCI_DMA_CSR1,
+         VIA_DMA_CSR_TA | VIA_DMA_CSR_TD, 0x00000008}
+};
 static int via_num_unichrome = sizeof(via_unichrome_irqs) / sizeof(maskarray_t);
+static int via_irqmap_unichrome[] = {-1, -1, -1, 0, -1, 1};
 static unsigned time_diff(struct timeval *now, struct timeval *then)
 {
@@ -113,6 +133,11 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
                        atomic_inc(&cur_irq->irq_received);
                        DRM_WAKEUP(&cur_irq->irq_queue);
                        handled = 1;
+                        if (dev_priv->irq_map[drm_via_irq_dma0_td] == i) {
+                                via_dmablit_handler(dev, 0, 1);
+                        } else if (dev_priv->irq_map[drm_via_irq_dma1_td] == i) {
+                                via_dmablit_handler(dev, 1, 1);
+                        }
                }
                cur_irq++;
        }
@@ -165,7 +190,7 @@ int via_driver_vblank_wait(drm_device_t * dev, unsigned int *sequence)
        return ret;
 }
-static int
+int
 via_driver_irq_wait(drm_device_t * dev, unsigned int irq, int force_sequence,
                    unsigned int *sequence)
 {
@@ -174,6 +199,7 @@ via_driver_irq_wait(drm_device_t * dev, unsigned int irq, int force_sequence,
        drm_via_irq_t *cur_irq = dev_priv->via_irqs;
        int ret = 0;
        maskarray_t *masks = dev_priv->irq_masks;
+        int real_irq;
        DRM_DEBUG("%s\n", __FUNCTION__);
@@ -182,15 +208,23 @@ via_driver_irq_wait(drm_device_t * dev, unsigned int irq, int force_sequence,
                return DRM_ERR(EINVAL);
        }
-        if (irq >= dev_priv->num_irqs) {
+        if (irq >= drm_via_irq_num) {
                DRM_ERROR("%s Trying to wait on unknown irq %d\n", __FUNCTION__,
                          irq);
                return DRM_ERR(EINVAL);
        }
-        cur_irq += irq;
+        real_irq = dev_priv->irq_map[irq];
+        if (real_irq < 0) {
+                DRM_ERROR("%s Video IRQ %d not available on this hardware.\n",
+                          __FUNCTION__, irq);
+                return DRM_ERR(EINVAL);
+        }
+        
+        cur_irq += real_irq;
-        if (masks[irq][2] && !force_sequence) {
+        if (masks[real_irq][2] && !force_sequence) {
                DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
                            ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
                             masks[irq][4]));
@@ -226,6 +260,8 @@ void via_driver_irq_preinstall(drm_device_t * dev)
                    via_pro_group_a_irqs : via_unichrome_irqs;
                dev_priv->num_irqs = (dev_priv->pro_group_a) ?
                    via_num_pro_group_a : via_num_unichrome;
+                dev_priv->irq_map = (dev_priv->pro_group_a) ?
+                        via_irqmap_pro_group_a : via_irqmap_unichrome;
                for (i = 0; i < dev_priv->num_irqs; ++i) {
                        atomic_set(&cur_irq->irq_received, 0);
@@ -241,7 +277,7 @@ void via_driver_irq_preinstall(drm_device_t * dev)
                dev_priv->last_vblank_valid = 0;
-                // Clear VSync interrupt regs
+                /* Clear VSync interrupt regs */
                status = VIA_READ(VIA_REG_INTERRUPT);
                VIA_WRITE(VIA_REG_INTERRUPT, status &
                          ~(dev_priv->irq_enable_mask));
@@ -291,8 +327,7 @@ void via_driver_irq_uninstall(drm_device_t * dev)
 int via_wait_irq(DRM_IOCTL_ARGS)
 {
-        drm_file_t *priv = filp->private_data;
+        DRM_DEVICE;
-        drm_device_t *dev = priv->head->dev;
        drm_via_irqwait_t __user *argp = (void __user *)data;
        drm_via_irqwait_t irqwait;
        struct timeval now;
diff --git a/drivers/char/drm/via_map.c b/drivers/char/drm/via_map.c
index 6bd6ac52ad1b..c6a08e96285b 100644
--- a/drivers/char/drm/via_map.c
+++ b/drivers/char/drm/via_map.c
@@ -27,16 +27,10 @@
 static int via_do_init_map(drm_device_t * dev, drm_via_init_t * init)
 {
-        drm_via_private_t *dev_priv;
+        drm_via_private_t *dev_priv = dev->dev_private;
        DRM_DEBUG("%s\n", __FUNCTION__);
-        dev_priv = drm_alloc(sizeof(drm_via_private_t), DRM_MEM_DRIVER);
-        if (dev_priv == NULL)
-                return -ENOMEM;
-        memset(dev_priv, 0, sizeof(drm_via_private_t));
        DRM_GETSAREA();
        if (!dev_priv->sarea) {
                DRM_ERROR("could not find sarea!\n");
@@ -67,7 +61,8 @@ static int via_do_init_map(drm_device_t * dev, drm_via_init_t * init)
        dev_priv->agpAddr = init->agpAddr;
        via_init_futex(dev_priv);
-        dev_priv->pro_group_a = (dev->pdev->device == 0x3118);
+        via_init_dmablit(dev);
        dev->dev_private = (void *)dev_priv;
        return 0;
@@ -75,15 +70,7 @@ static int via_do_init_map(drm_device_t * dev, drm_via_init_t * init)
 int via_do_cleanup_map(drm_device_t * dev)
 {
-        if (dev->dev_private) {
+        via_dma_cleanup(dev);
-                drm_via_private_t *dev_priv = dev->dev_private;
-                via_dma_cleanup(dev);
-                drm_free(dev_priv, sizeof(drm_via_private_t), DRM_MEM_DRIVER);
-                dev->dev_private = NULL;
-        }
        return 0;
 }
@@ -107,3 +94,29 @@ int via_map_init(DRM_IOCTL_ARGS)
        return -EINVAL;
 }
+int via_driver_load(drm_device_t *dev, unsigned long chipset)
+{
+        drm_via_private_t *dev_priv;
+        dev_priv = drm_calloc(1, sizeof(drm_via_private_t), DRM_MEM_DRIVER);
+        if (dev_priv == NULL)
+                return DRM_ERR(ENOMEM);
+        dev->dev_private = (void *)dev_priv;
+        if (chipset == VIA_PRO_GROUP_A)
+                dev_priv->pro_group_a = 1;
+        return 0;
+}
+int via_driver_unload(drm_device_t *dev)
+{
+        drm_via_private_t *dev_priv = dev->dev_private;
+        drm_free(dev_priv, sizeof(drm_via_private_t), DRM_MEM_DRIVER);
+        return 0;
+}
diff --git a/drivers/char/drm/via_mm.c b/drivers/char/drm/via_mm.c
index 3baddacdff26..33e0cb12e4c3 100644
--- a/drivers/char/drm/via_mm.c
+++ b/drivers/char/drm/via_mm.c
@@ -42,7 +42,7 @@ static int via_agp_free(drm_via_mem_t * mem);
 static int via_fb_alloc(drm_via_mem_t * mem);
 static int via_fb_free(drm_via_mem_t * mem);
-static int add_alloc_set(int context, int type, unsigned int val)
+static int add_alloc_set(int context, int type, unsigned long val)
 {
        int i, retval = 0;
@@ -56,7 +56,7 @@ static int add_alloc_set(int context, int type, unsigned int val)
        return retval;
 }
-static int del_alloc_set(int context, int type, unsigned int val)
+static int del_alloc_set(int context, int type, unsigned long val)
 {
        int i, retval = 0;
@@ -199,13 +199,13 @@ int via_mem_alloc(DRM_IOCTL_ARGS)
                                 sizeof(mem));
        switch (mem.type) {
-        case VIDEO:
+        case VIA_MEM_VIDEO:
                if (via_fb_alloc(&mem) < 0)
                        return -EFAULT;
                DRM_COPY_TO_USER_IOCTL((drm_via_mem_t __user *) data, mem,
                                       sizeof(mem));
                return 0;
-        case AGP:
+        case VIA_MEM_AGP:
                if (via_agp_alloc(&mem) < 0)
                        return -EFAULT;
                DRM_COPY_TO_USER_IOCTL((drm_via_mem_t __user *) data, mem,
@@ -232,7 +232,7 @@ static int via_fb_alloc(drm_via_mem_t * mem)
        if (block) {
                fb.offset = block->ofs;
                fb.free = (unsigned long)block;
-                if (!add_alloc_set(fb.context, VIDEO, fb.free)) {
+                if (!add_alloc_set(fb.context, VIA_MEM_VIDEO, fb.free)) {
                        DRM_DEBUG("adding to allocation set fails\n");
                        via_mmFreeMem((PMemBlock) fb.free);
                        retval = -1;
@@ -269,7 +269,7 @@ static int via_agp_alloc(drm_via_mem_t * mem)
        if (block) {
                agp.offset = block->ofs;
                agp.free = (unsigned long)block;
-                if (!add_alloc_set(agp.context, AGP, agp.free)) {
+                if (!add_alloc_set(agp.context, VIA_MEM_AGP, agp.free)) {
                        DRM_DEBUG("adding to allocation set fails\n");
                        via_mmFreeMem((PMemBlock) agp.free);
                        retval = -1;
@@ -297,11 +297,11 @@ int via_mem_free(DRM_IOCTL_ARGS)
        switch (mem.type) {
-        case VIDEO:
+        case VIA_MEM_VIDEO:
                if (via_fb_free(&mem) == 0)
                        return 0;
                break;
-        case AGP:
+        case VIA_MEM_AGP:
                if (via_agp_free(&mem) == 0)
                        return 0;
                break;
@@ -329,7 +329,7 @@ static int via_fb_free(drm_via_mem_t * mem)
        via_mmFreeMem((PMemBlock) fb.free);
-        if (!del_alloc_set(fb.context, VIDEO, fb.free)) {
+        if (!del_alloc_set(fb.context, VIA_MEM_VIDEO, fb.free)) {
                retval = -1;
        }
@@ -352,7 +352,7 @@ static int via_agp_free(drm_via_mem_t * mem)
        via_mmFreeMem((PMemBlock) agp.free);
-        if (!del_alloc_set(agp.context, AGP, agp.free)) {
+        if (!del_alloc_set(agp.context, VIA_MEM_AGP, agp.free)) {
                retval = -1;
        }
diff --git a/drivers/char/drm/via_verifier.c b/drivers/char/drm/via_verifier.c
index 4ac495f297f7..70c897c88766 100644
--- a/drivers/char/drm/via_verifier.c
+++ b/drivers/char/drm/via_verifier.c
@@ -237,7 +237,7 @@ static hazard_t table3[256];
 static __inline__ int
 eat_words(const uint32_t ** buf, const uint32_t * buf_end, unsigned num_words)
 {
-        if ((*buf - buf_end) >= num_words) {
+        if ((buf_end - *buf) >= num_words) {
                *buf += num_words;
                return 0;
        }
@@ -249,14 +249,14 @@ eat_words(const uint32_t ** buf, const uint32_t * buf_end, unsigned num_words)
 * Partially stolen from drm_memory.h
 */
-static __inline__ drm_map_t *via_drm_lookup_agp_map(drm_via_state_t * seq,
+static __inline__ drm_local_map_t *via_drm_lookup_agp_map(drm_via_state_t *seq,
                                                    unsigned long offset,
                                                    unsigned long size,
                                                    drm_device_t * dev)
 {
        struct list_head *list;
        drm_map_list_t *r_list;
-        drm_map_t *map = seq->map_cache;
+        drm_local_map_t *map = seq->map_cache;
        if (map && map->offset <= offset
            && (offset + size) <= (map->offset + map->size)) {
diff --git a/drivers/char/drm/via_verifier.h b/drivers/char/drm/via_verifier.h
index eb4eda344345..256590fcc22a 100644
--- a/drivers/char/drm/via_verifier.h
+++ b/drivers/char/drm/via_verifier.h
@@ -47,7 +47,7 @@ typedef struct {
        int agp_texture;
        int multitex;
        drm_device_t *dev;
-        drm_map_t *map_cache;
+        drm_local_map_t *map_cache;
        uint32_t vertex_count;
        int agp;
        const uint32_t *buf_start;
@@ -55,5 +55,7 @@ typedef struct {
 extern int via_verify_command_stream(const uint32_t * buf, unsigned int size,
                                     drm_device_t * dev, int agp);
+extern int via_parse_command_stream(drm_device_t *dev, const uint32_t *buf,
+                                    unsigned int size);
 #endif
diff --git a/drivers/char/drm/via_video.c b/drivers/char/drm/via_video.c
index 7fab9fbdf424..300ac61b09ed 100644
--- a/drivers/char/drm/via_video.c
+++ b/drivers/char/drm/via_video.c
@@ -50,8 +50,11 @@ void via_release_futex(drm_via_private_t * dev_priv, int context)
        unsigned int i;
        volatile int *lock;
+        if (!dev_priv->sarea_priv)
+                return;
        for (i = 0; i < VIA_NR_XVMC_LOCKS; ++i) {
-                lock = (int *)XVMCLOCKPTR(dev_priv->sarea_priv, i);
+                lock = (volatile int *)XVMCLOCKPTR(dev_priv->sarea_priv, i);
                if ((_DRM_LOCKING_CONTEXT(*lock) == context)) {
                        if (_DRM_LOCK_IS_HELD(*lock)
                            && (*lock & _DRM_LOCK_CONT)) {
@@ -79,7 +82,7 @@ int via_decoder_futex(DRM_IOCTL_ARGS)
        if (fx.lock > VIA_NR_XVMC_LOCKS)
                return -EFAULT;
-        lock = (int *)XVMCLOCKPTR(sAPriv, fx.lock);
+        lock = (volatile int *)XVMCLOCKPTR(sAPriv, fx.lock);
        switch (fx.func) {
        case VIA_FUTEX_WAIT:
diff --git a/drivers/char/dsp56k.c b/drivers/char/dsp56k.c
index 8693835cb2d5..e233cf280bc0 100644
--- a/drivers/char/dsp56k.c
+++ b/drivers/char/dsp56k.c
@@ -165,7 +165,7 @@ static int dsp56k_reset(void)
        return 0;
 }
-static int dsp56k_upload(u_char *bin, int len)
+static int dsp56k_upload(u_char __user *bin, int len)
 {
        int i;
        u_char *p;
@@ -199,7 +199,7 @@ static int dsp56k_upload(u_char *bin, int len)
        return 0;
 }
-static ssize_t dsp56k_read(struct file *file, char *buf, size_t count,
+static ssize_t dsp56k_read(struct file *file, char __user *buf, size_t count,
                           loff_t *ppos)
 {
        struct inode *inode = file->f_dentry->d_inode;
@@ -225,10 +225,10 @@ static ssize_t dsp56k_read(struct file *file, char *buf, size_t count,
                }
                case 2:  /* 16 bit */
                {
-                        short *data;
+                        short __user *data;
                        count /= 2;
-                        data = (short*) buf;
+                        data = (short __user *) buf;
                        handshake(count, dsp56k.maxio, dsp56k.timeout, DSP56K_RECEIVE,
                                  put_user(dsp56k_host_interface.data.w[1], data+n++));
                        return 2*n;
@@ -244,10 +244,10 @@ static ssize_t dsp56k_read(struct file *file, char *buf, size_t count,
                }
                case 4:  /* 32 bit */
                {
-                        long *data;
+                        long __user *data;
                        count /= 4;
-                        data = (long*) buf;
+                        data = (long __user *) buf;
                        handshake(count, dsp56k.maxio, dsp56k.timeout, DSP56K_RECEIVE,
                                  put_user(dsp56k_host_interface.data.l, data+n++));
                        return 4*n;
@@ -262,7 +262,7 @@ static ssize_t dsp56k_read(struct file *file, char *buf, size_t count,
        }
 }
-static ssize_t dsp56k_write(struct file *file, const char *buf, size_t count,
+static ssize_t dsp56k_write(struct file *file, const char __user *buf, size_t count,
                            loff_t *ppos)
 {
        struct inode *inode = file->f_dentry->d_inode;
@@ -287,10 +287,10 @@ static ssize_t dsp56k_write(struct file *file, const char *buf, size_t count,
                }
                case 2:  /* 16 bit */
                {
-                        const short *data;
+                        const short __user *data;
                        count /= 2;
-                        data = (const short *)buf;
+                        data = (const short __user *)buf;
                        handshake(count, dsp56k.maxio, dsp56k.timeout, DSP56K_TRANSMIT,
                                  get_user(dsp56k_host_interface.data.w[1], data+n++));
                        return 2*n;
@@ -306,10 +306,10 @@ static ssize_t dsp56k_write(struct file *file, const char *buf, size_t count,
                }
                case 4:  /* 32 bit */
                {
-                        const long *data;
+                        const long __user *data;
                        count /= 4;
-                        data = (const long *)buf;
+                        data = (const long __user *)buf;
                        handshake(count, dsp56k.maxio, dsp56k.timeout, DSP56K_TRANSMIT,
                                  get_user(dsp56k_host_interface.data.l, data+n++));
                        return 4*n;
@@ -328,6 +328,7 @@ static int dsp56k_ioctl(struct inode *inode, struct file *file,
                        unsigned int cmd, unsigned long arg)
 {
        int dev = iminor(inode) & 0x0f;
+        void __user *argp = (void __user *)arg;
        switch(dev)
        {
@@ -336,9 +337,9 @@ static int dsp56k_ioctl(struct inode *inode, struct file *file,
                switch(cmd) {
                case DSP56K_UPLOAD:
                {
-                        char *bin;
+                        char __user *bin;
                        int r, len;
-                        struct dsp56k_upload *binary = (struct dsp56k_upload *) arg;
+                        struct dsp56k_upload __user *binary = argp;
    
                        if(get_user(len, &binary->len) < 0)
                                return -EFAULT;
@@ -372,7 +373,7 @@ static int dsp56k_ioctl(struct inode *inode, struct file *file,
                case DSP56K_HOST_FLAGS:
                {
                        int dir, out, status;
-                        struct dsp56k_host_flags *hf = (struct dsp56k_host_flags*) arg;
+                        struct dsp56k_host_flags __user *hf = argp;
    
                        if(get_user(dir, &hf->dir) < 0)
                                return -EFAULT;
diff --git a/drivers/char/esp.c b/drivers/char/esp.c
index e469f641c728..dd5dc8fa490d 100644
--- a/drivers/char/esp.c
+++ b/drivers/char/esp.c
@@ -160,7 +160,6 @@ static void rs_wait_until_sent(struct tty_struct *, int);
 * memory if large numbers of serial ports are open.
 */
 static unsigned char *tmp_buf;
-static DECLARE_MUTEX(tmp_buf_sem);
 static inline int serial_paranoia_check(struct esp_struct *info,
                                        char *name, const char *routine)
diff --git a/drivers/char/generic_serial.c b/drivers/char/generic_serial.c
index 204a7302a4a9..e38a5f0e07bb 100644
--- a/drivers/char/generic_serial.c
+++ b/drivers/char/generic_serial.c
@@ -34,7 +34,6 @@
 #define DEBUG 
 static char *                  tmp_buf; 
-static DECLARE_MUTEX(tmp_buf_sem);
 static int gs_debug;
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 704c3c07f0ab..29c41f4418c0 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -534,7 +534,7 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
        return virtr + wrote;
 }
-#if (defined(CONFIG_ISA) || !defined(__mc68000__)) && (!defined(CONFIG_PPC_ISERIES) || defined(CONFIG_PCI))
+#if defined(CONFIG_ISA) || !defined(__mc68000__)
 static ssize_t read_port(struct file * file, char __user * buf,
                         size_t count, loff_t *ppos)
 {
@@ -795,7 +795,7 @@ static struct file_operations null_fops = {
        .write          = write_null,
 };
-#if (defined(CONFIG_ISA) || !defined(__mc68000__)) && (!defined(CONFIG_PPC_ISERIES) || defined(CONFIG_PCI))
+#if defined(CONFIG_ISA) || !defined(__mc68000__)
 static struct file_operations port_fops = {
        .llseek         = memory_lseek,
        .read           = read_port,
@@ -865,7 +865,7 @@ static int memory_open(struct inode * inode, struct file * filp)
                case 3:
                        filp->f_op = &null_fops;
                        break;
-#if (defined(CONFIG_ISA) || !defined(__mc68000__)) && (!defined(CONFIG_PPC_ISERIES) || defined(CONFIG_PCI))
+#if defined(CONFIG_ISA) || !defined(__mc68000__)
                case 4:
                        filp->f_op = &port_fops;
                        break;
@@ -912,7 +912,7 @@ static const struct {
        {1, "mem",     S_IRUSR | S_IWUSR | S_IRGRP, &mem_fops},
        {2, "kmem",    S_IRUSR | S_IWUSR | S_IRGRP, &kmem_fops},
        {3, "null",    S_IRUGO | S_IWUGO,           &null_fops},
-#if (defined(CONFIG_ISA) || !defined(__mc68000__)) && (!defined(CONFIG_PPC_ISERIES) || defined(CONFIG_PCI))
+#if defined(CONFIG_ISA) || !defined(__mc68000__)
        {4, "port",    S_IRUSR | S_IWUSR | S_IRGRP, &port_fops},
 #endif
        {5, "zero",    S_IRUGO | S_IWUGO,           &zero_fops},
diff --git a/drivers/char/riscom8.c b/drivers/char/riscom8.c
index 050e70ee5920..119e629656b7 100644
--- a/drivers/char/riscom8.c
+++ b/drivers/char/riscom8.c
@@ -82,7 +82,6 @@
 static struct riscom_board * IRQ_to_board[16];
 static struct tty_driver *riscom_driver;
 static unsigned char * tmp_buf;
-static DECLARE_MUTEX(tmp_buf_sem);
 static unsigned long baud_table[] =  {
        0, 50, 75, 110, 134, 150, 200, 300, 600, 1200, 1800, 2400, 4800,
diff --git a/drivers/char/scc.h b/drivers/char/scc.h
index 51810f72f1a9..93998f5baff5 100644
--- a/drivers/char/scc.h
+++ b/drivers/char/scc.h
@@ -399,7 +399,7 @@ struct scc_port {
                __asm__ __volatile__ ( "tstb %0" : : "g" (*_scc_del) : "cc" );\
    } while (0)
-extern unsigned char scc_shadow[2][16];
+static unsigned char scc_shadow[2][16];
 /* The following functions should relax the somehow complicated
 * register access of the SCC. _SCCwrite() stores all written values
diff --git a/drivers/char/serial167.c b/drivers/char/serial167.c
index f36342ae8e7e..037c940ac71b 100644
--- a/drivers/char/serial167.c
+++ b/drivers/char/serial167.c
@@ -129,7 +129,6 @@ struct cyclades_port cy_port[] = {
 * memory if large numbers of serial ports are open.
 */
 static unsigned char *tmp_buf = 0;
-DECLARE_MUTEX(tmp_buf_sem);
 /*
 * This is used to look up the divisor speeds and the timeouts
diff --git a/drivers/char/specialix.c b/drivers/char/specialix.c
index 0a574bdbce36..5343e9fc6ab7 100644
--- a/drivers/char/specialix.c
+++ b/drivers/char/specialix.c
@@ -184,7 +184,6 @@ static int sx_poll = HZ;
 static struct tty_driver *specialix_driver;
 static unsigned char * tmp_buf;
-static DECLARE_MUTEX(tmp_buf_sem);
 static unsigned long baud_table[] =  {
        0, 50, 75, 110, 134, 150, 200, 300, 600, 1200, 1800, 2400, 4800,
@@ -2556,8 +2555,6 @@ static int __init specialix_init_module(void)
        func_enter();
-        init_MUTEX(&tmp_buf_sem); /* Init de the semaphore - pvdl */
        if (iobase[0] || iobase[1] || iobase[2] || iobase[3]) {
                for(i = 0; i < SX_NBOARD; i++) {
                        sx_board[i].base = iobase[i];
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index 9f1b466c4f84..ede688a4e141 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -951,7 +951,6 @@ static void* mgsl_get_text_ptr(void)
 * memory if large numbers of serial ports are open.
 */
 static unsigned char *tmp_buf;
-static DECLARE_MUTEX(tmp_buf_sem);
 static inline int mgsl_paranoia_check(struct mgsl_struct *info,
                                        char *name, const char *routine)
diff --git a/drivers/char/viocons.c b/drivers/char/viocons.c
index faee5e7acaf7..4e5360388748 100644
--- a/drivers/char/viocons.c
+++ b/drivers/char/viocons.c
@@ -476,19 +476,19 @@ static struct port_info *get_port_data(struct tty_struct *tty)
 */
 static void initDataEvent(struct viocharlpevent *viochar, HvLpIndex lp)
 {
+        struct HvLpEvent *hev = &viochar->event;
        memset(viochar, 0, sizeof(struct viocharlpevent));
-        viochar->event.xFlags.xValid = 1;
+        hev->flags = HV_LP_EVENT_VALID | HV_LP_EVENT_DEFERRED_ACK |
-        viochar->event.xFlags.xFunction = HvLpEvent_Function_Int;
+                HV_LP_EVENT_INT;
-        viochar->event.xFlags.xAckInd = HvLpEvent_AckInd_NoAck;
+        hev->xType = HvLpEvent_Type_VirtualIo;
-        viochar->event.xFlags.xAckType = HvLpEvent_AckType_DeferredAck;
+        hev->xSubtype = viomajorsubtype_chario | viochardata;
-        viochar->event.xType = HvLpEvent_Type_VirtualIo;
+        hev->xSourceLp = HvLpConfig_getLpIndex();
-        viochar->event.xSubtype = viomajorsubtype_chario | viochardata;
+        hev->xTargetLp = lp;
-        viochar->event.xSourceLp = HvLpConfig_getLpIndex();
+        hev->xSizeMinus1 = sizeof(struct viocharlpevent);
-        viochar->event.xTargetLp = lp;
+        hev->xSourceInstanceId = viopath_sourceinst(lp);
-        viochar->event.xSizeMinus1 = sizeof(struct viocharlpevent);
+        hev->xTargetInstanceId = viopath_targetinst(lp);
-        viochar->event.xSourceInstanceId = viopath_sourceinst(lp);
-        viochar->event.xTargetInstanceId = viopath_targetinst(lp);
 }
 /*
@@ -752,7 +752,7 @@ static void vioHandleOpenEvent(struct HvLpEvent *event)
        struct port_info *pi;
        int reject = 0;
-        if (event->xFlags.xFunction == HvLpEvent_Function_Ack) {
+        if (hvlpevent_is_ack(event)) {
                if (port >= VTTY_PORTS)
                        return;
@@ -788,7 +788,7 @@ static void vioHandleOpenEvent(struct HvLpEvent *event)
        }
        /* This had better require an ack, otherwise complain */
-        if (event->xFlags.xAckInd != HvLpEvent_AckInd_DoAck) {
+        if (!hvlpevent_need_ack(event)) {
                printk(VIOCONS_KERN_WARN "viocharopen without ack bit!\n");
                return;
        }
@@ -856,7 +856,7 @@ static void vioHandleCloseEvent(struct HvLpEvent *event)
        struct viocharlpevent *cevent = (struct viocharlpevent *)event;
        u8 port = cevent->virtual_device;
-        if (event->xFlags.xFunction == HvLpEvent_Function_Int) {
+        if (hvlpevent_is_int(event)) {
                if (port >= VTTY_PORTS) {
                        printk(VIOCONS_KERN_WARN
                                        "close message from invalid virtual device.\n");
@@ -1056,8 +1056,7 @@ static void vioHandleCharEvent(struct HvLpEvent *event)
                vioHandleConfig(event);
                break;
        default:
-                if ((event->xFlags.xFunction == HvLpEvent_Function_Int) &&
+                if (hvlpevent_is_int(event) && hvlpevent_need_ack(event)) {
-                    (event->xFlags.xAckInd == HvLpEvent_AckInd_DoAck)) {
                        event->xRc = HvLpEvent_Rc_InvalidSubtype;
                        HvCallEvent_ackLpEvent(event);
                }
diff --git a/drivers/dio/dio-driver.c b/drivers/dio/dio-driver.c
index ffe6f44ac76f..ca8e69d2f64d 100644
--- a/drivers/dio/dio-driver.c
+++ b/drivers/dio/dio-driver.c
@@ -83,7 +83,6 @@ int dio_register_driver(struct dio_driver *drv)
        /* initialize common driver fields */
        drv->driver.name = drv->name;
        drv->driver.bus = &dio_bus_type;
-        drv->driver.probe = dio_device_probe;
        /* register with core */
        count = driver_register(&drv->driver);
@@ -145,7 +144,8 @@ static int dio_bus_match(struct device *dev, struct device_driver *drv)
 struct bus_type dio_bus_type = {
        .name   = "dio",
-        .match  = dio_bus_match
+        .match  = dio_bus_match,
+        .probe  = dio_device_probe,
 };
diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index 70f7ab829d36..86e2234faf80 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -899,6 +899,12 @@ static int i2c_pxa_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num
        struct pxa_i2c *i2c = adap->algo_data;
        int ret, i;
+        /* If the I2C controller is disabled we need to reset it (probably due
+           to a suspend/resume destroying state). We do this here as we can then
+           avoid worrying about resuming the controller before its users. */
+        if (!(ICR & ICR_IUE))
+                i2c_pxa_reset(i2c);
        for (i = adap->retries; i >= 0; i--) {
                ret = i2c_pxa_do_xfer(i2c, msgs, num);
                if (ret != I2C_RETRY)
@@ -939,7 +945,9 @@ static struct pxa_i2c i2c_pxa = {
 static int i2c_pxa_probe(struct platform_device *dev)
 {
        struct pxa_i2c *i2c = &i2c_pxa;
+#ifdef CONFIG_I2C_PXA_SLAVE
        struct i2c_pxa_platform_data *plat = dev->dev.platform_data;
+#endif
        int ret;
 #ifdef CONFIG_PXA27x
@@ -1024,5 +1032,7 @@ static void i2c_adap_pxa_exit(void)
        return platform_driver_unregister(&i2c_pxa_driver);
 }
+MODULE_LICENSE("GPL");
 module_init(i2c_adap_pxa_init);
 module_exit(i2c_adap_pxa_exit);
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 52b77477df57..0ce58b506046 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -63,13 +63,6 @@ static int i2c_bus_resume(struct device * dev)
        return rc;
 }
-struct bus_type i2c_bus_type = {
-        .name =         "i2c",
-        .match =        i2c_device_match,
-        .suspend =      i2c_bus_suspend,
-        .resume =       i2c_bus_resume,
-};
 static int i2c_device_probe(struct device *dev)
 {
        return -ENODEV;
@@ -80,6 +73,15 @@ static int i2c_device_remove(struct device *dev)
        return 0;
 }
+struct bus_type i2c_bus_type = {
+        .name =         "i2c",
+        .match =        i2c_device_match,
+        .probe =        i2c_device_probe,
+        .remove =       i2c_device_remove,
+        .suspend =      i2c_bus_suspend,
+        .resume =       i2c_bus_resume,
+};
 void i2c_adapter_dev_release(struct device *dev)
 {
        struct i2c_adapter *adap = dev_to_i2c_adapter(dev);
@@ -90,8 +92,6 @@ struct device_driver i2c_adapter_driver = {
        .owner = THIS_MODULE,
        .name = "i2c_adapter",
        .bus = &i2c_bus_type,
-        .probe = i2c_device_probe,
-        .remove = i2c_device_remove,
 };
 static void i2c_adapter_class_dev_release(struct class_device *dev)
@@ -294,8 +294,6 @@ int i2c_register_driver(struct module *owner, struct i2c_driver *driver)
        /* add the driver to the list of i2c drivers in the driver core */
        driver->driver.owner = owner;
        driver->driver.bus = &i2c_bus_type;
-        driver->driver.probe = i2c_device_probe;
-        driver->driver.remove = i2c_device_remove;
        res = driver_register(&driver->driver);
        if (res)
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 9b2ebd219ad0..ef09a7ef2396 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -3256,9 +3256,8 @@ sector_t ide_cdrom_capacity (ide_drive_t *drive)
 }
 #endif
-static int ide_cd_remove(struct device *dev)
+static void ide_cd_remove(ide_drive_t *drive)
 {
-        ide_drive_t *drive = to_ide_device(dev);
        struct cdrom_info *info = drive->driver_data;
        ide_unregister_subdriver(drive, info->driver);
@@ -3266,8 +3265,6 @@ static int ide_cd_remove(struct device *dev)
        del_gendisk(info->disk);
        ide_cd_put(info);
-        return 0;
 }
 static void ide_cd_release(struct kref *kref)
@@ -3291,7 +3288,7 @@ static void ide_cd_release(struct kref *kref)
        kfree(info);
 }
-static int ide_cd_probe(struct device *);
+static int ide_cd_probe(ide_drive_t *);
 #ifdef CONFIG_PROC_FS
 static int proc_idecd_read_capacity
@@ -3317,9 +3314,9 @@ static ide_driver_t ide_cdrom_driver = {
                .owner          = THIS_MODULE,
                .name           = "ide-cdrom",
                .bus            = &ide_bus_type,
-                .probe          = ide_cd_probe,
-                .remove         = ide_cd_remove,
        },
+        .probe                  = ide_cd_probe,
+        .remove                 = ide_cd_remove,
        .version                = IDECD_VERSION,
        .media                  = ide_cdrom,
        .supports_dsc_overlap   = 1,
@@ -3413,9 +3410,8 @@ static char *ignore = NULL;
 module_param(ignore, charp, 0400);
 MODULE_DESCRIPTION("ATAPI CD-ROM Driver");
-static int ide_cd_probe(struct device *dev)
+static int ide_cd_probe(ide_drive_t *drive)
 {
-        ide_drive_t *drive = to_ide_device(dev);
        struct cdrom_info *info;
        struct gendisk *g;
        struct request_sense sense;
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index cab362ea0336..245b508208df 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -997,9 +997,8 @@ static void ide_cacheflush_p(ide_drive_t *drive)
                printk(KERN_INFO "%s: wcache flush failed!\n", drive->name);
 }
-static int ide_disk_remove(struct device *dev)
+static void ide_disk_remove(ide_drive_t *drive)
 {
-        ide_drive_t *drive = to_ide_device(dev);
        struct ide_disk_obj *idkp = drive->driver_data;
        struct gendisk *g = idkp->disk;
@@ -1010,8 +1009,6 @@ static int ide_disk_remove(struct device *dev)
        ide_cacheflush_p(drive);
        ide_disk_put(idkp);
-        return 0;
 }
 static void ide_disk_release(struct kref *kref)
@@ -1027,12 +1024,10 @@ static void ide_disk_release(struct kref *kref)
        kfree(idkp);
 }
-static int ide_disk_probe(struct device *dev);
+static int ide_disk_probe(ide_drive_t *drive);
-static void ide_device_shutdown(struct device *dev)
+static void ide_device_shutdown(ide_drive_t *drive)
 {
-        ide_drive_t *drive = container_of(dev, ide_drive_t, gendev);
 #ifdef  CONFIG_ALPHA
        /* On Alpha, halt(8) doesn't actually turn the machine off,
           it puts you into the sort of firmware monitor. Typically,
@@ -1054,7 +1049,7 @@ static void ide_device_shutdown(struct device *dev)
        }
        printk("Shutdown: %s\n", drive->name);
-        dev->bus->suspend(dev, PMSG_SUSPEND);
+        drive->gendev.bus->suspend(&drive->gendev, PMSG_SUSPEND);
 }
 static ide_driver_t idedisk_driver = {
@@ -1062,10 +1057,10 @@ static ide_driver_t idedisk_driver = {
                .owner          = THIS_MODULE,
                .name           = "ide-disk",
                .bus            = &ide_bus_type,
-                .probe          = ide_disk_probe,
-                .remove         = ide_disk_remove,
-                .shutdown       = ide_device_shutdown,
        },
+        .probe                  = ide_disk_probe,
+        .remove                 = ide_disk_remove,
+        .shutdown               = ide_device_shutdown,
        .version                = IDEDISK_VERSION,
        .media                  = ide_disk,
        .supports_dsc_overlap   = 0,
@@ -1182,9 +1177,8 @@ static struct block_device_operations idedisk_ops = {
 MODULE_DESCRIPTION("ATA DISK Driver");
-static int ide_disk_probe(struct device *dev)
+static int ide_disk_probe(ide_drive_t *drive)
 {
-        ide_drive_t *drive = to_ide_device(dev);
        struct ide_disk_obj *idkp;
        struct gendisk *g;
diff --git a/drivers/ide/ide-floppy.c b/drivers/ide/ide-floppy.c
index 5945f551aaaa..1f8db9ac05d1 100644
--- a/drivers/ide/ide-floppy.c
+++ b/drivers/ide/ide-floppy.c
@@ -1871,9 +1871,8 @@ static void idefloppy_setup (ide_drive_t *drive, idefloppy_floppy_t *floppy)
        idefloppy_add_settings(drive);
 }
-static int ide_floppy_remove(struct device *dev)
+static void ide_floppy_remove(ide_drive_t *drive)
 {
-        ide_drive_t *drive = to_ide_device(dev);
        idefloppy_floppy_t *floppy = drive->driver_data;
        struct gendisk *g = floppy->disk;
@@ -1882,8 +1881,6 @@ static int ide_floppy_remove(struct device *dev)
        del_gendisk(g);
        ide_floppy_put(floppy);
-        return 0;
 }
 static void ide_floppy_release(struct kref *kref)
@@ -1922,16 +1919,16 @@ static ide_proc_entry_t idefloppy_proc[] = {
 #endif  /* CONFIG_PROC_FS */
-static int ide_floppy_probe(struct device *);
+static int ide_floppy_probe(ide_drive_t *);
 static ide_driver_t idefloppy_driver = {
        .gen_driver = {
                .owner          = THIS_MODULE,
                .name           = "ide-floppy",
                .bus            = &ide_bus_type,
-                .probe          = ide_floppy_probe,
-                .remove         = ide_floppy_remove,
        },
+        .probe                  = ide_floppy_probe,
+        .remove                 = ide_floppy_remove,
        .version                = IDEFLOPPY_VERSION,
        .media                  = ide_floppy,
        .supports_dsc_overlap   = 0,
@@ -2136,9 +2133,8 @@ static struct block_device_operations idefloppy_ops = {
        .revalidate_disk= idefloppy_revalidate_disk
 };
-static int ide_floppy_probe(struct device *dev)
+static int ide_floppy_probe(ide_drive_t *drive)
 {
-        ide_drive_t *drive = to_ide_device(dev);
        idefloppy_floppy_t *floppy;
        struct gendisk *g;
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index bcbaeb50bb93..8d50df4526a4 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -55,22 +55,9 @@
 #include <asm/io.h>
 #include <asm/bitops.h>
-void ide_softirq_done(struct request *rq)
-{
-        request_queue_t *q = rq->q;
-        add_disk_randomness(rq->rq_disk);
-        end_that_request_chunk(rq, 1, rq->data_len);
-        spin_lock_irq(q->queue_lock);
-        end_that_request_last(rq, 1);
-        spin_unlock_irq(q->queue_lock);
-}
 int __ide_end_request(ide_drive_t *drive, struct request *rq, int uptodate,
                      int nr_sectors)
 {
-        unsigned int nbytes;
        int ret = 1;
        BUG_ON(!(rq->flags & REQ_STARTED));
@@ -94,27 +81,12 @@ int __ide_end_request(ide_drive_t *drive, struct request *rq, int uptodate,
                HWGROUP(drive)->hwif->ide_dma_on(drive);
        }
-        /*
+        if (!end_that_request_first(rq, uptodate, nr_sectors)) {
-         * For partial completions (or non fs/pc requests), use the regular
+                add_disk_randomness(rq->rq_disk);
-         * direct completion path. Same thing for requests that failed, to
-         * preserve the ->errors value we use the normal completion path
-         * for those
-         */
-        nbytes = nr_sectors << 9;
-        if (!rq->errors && rq_all_done(rq, nbytes)) {
-                rq->data_len = nbytes;
                blkdev_dequeue_request(rq);
                HWGROUP(drive)->rq = NULL;
-                blk_complete_request(rq);
+                end_that_request_last(rq, uptodate);
                ret = 0;
-        } else {
-                if (!end_that_request_first(rq, uptodate, nr_sectors)) {
-                        add_disk_randomness(rq->rq_disk);
-                        blkdev_dequeue_request(rq);
-                        HWGROUP(drive)->rq = NULL;
-                        end_that_request_last(rq, uptodate);
-                        ret = 0;
-                }
        }
        return ret;
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 7cb2d86601db..e7425546b4b1 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1011,8 +1011,6 @@ static int ide_init_queue(ide_drive_t *drive)
        blk_queue_max_hw_segments(q, max_sg_entries);
        blk_queue_max_phys_segments(q, max_sg_entries);
-        blk_queue_softirq_done(q, ide_softirq_done);
        /* assign drive queue */
        drive->queue = q;
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index fab9b2b02504..0101d0def7c5 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -4682,9 +4682,8 @@ static void idetape_setup (ide_drive_t *drive, idetape_tape_t *tape, int minor)
        idetape_add_settings(drive);
 }
-static int ide_tape_remove(struct device *dev)
+static void ide_tape_remove(ide_drive_t *drive)
 {
-        ide_drive_t *drive = to_ide_device(dev);
        idetape_tape_t *tape = drive->driver_data;
        ide_unregister_subdriver(drive, tape->driver);
@@ -4692,8 +4691,6 @@ static int ide_tape_remove(struct device *dev)
        ide_unregister_region(tape->disk);
        ide_tape_put(tape);
-        return 0;
 }
 static void ide_tape_release(struct kref *kref)
@@ -4745,16 +4742,16 @@ static ide_proc_entry_t idetape_proc[] = {
 #endif
-static int ide_tape_probe(struct device *);
+static int ide_tape_probe(ide_drive_t *);
 static ide_driver_t idetape_driver = {
        .gen_driver = {
                .owner          = THIS_MODULE,
                .name           = "ide-tape",
                .bus            = &ide_bus_type,
-                .probe          = ide_tape_probe,
-                .remove         = ide_tape_remove,
        },
+        .probe                  = ide_tape_probe,
+        .remove                 = ide_tape_remove,
        .version                = IDETAPE_VERSION,
        .media                  = ide_tape,
        .supports_dsc_overlap   = 1,
@@ -4825,9 +4822,8 @@ static struct block_device_operations idetape_block_ops = {
        .ioctl          = idetape_ioctl,
 };
-static int ide_tape_probe(struct device *dev)
+static int ide_tape_probe(ide_drive_t *drive)
 {
-        ide_drive_t *drive = to_ide_device(dev);
        idetape_tape_t *tape;
        struct gendisk *g;
        int minor;
@@ -4883,9 +4879,9 @@ static int ide_tape_probe(struct device *dev)
        idetape_setup(drive, tape, minor);
        class_device_create(idetape_sysfs_class, NULL,
-                        MKDEV(IDETAPE_MAJOR, minor), dev, "%s", tape->name);
+                        MKDEV(IDETAPE_MAJOR, minor), &drive->gendev, "%s", tape->name);
        class_device_create(idetape_sysfs_class, NULL,
-                        MKDEV(IDETAPE_MAJOR, minor + 128), dev, "n%s", tape->name);
+                        MKDEV(IDETAPE_MAJOR, minor + 128), &drive->gendev, "n%s", tape->name);
        devfs_mk_cdev(MKDEV(HWIF(drive)->major, minor),
                        S_IFCHR | S_IRUGO | S_IWUGO,
diff --git a/drivers/ide/ide.c b/drivers/ide/ide.c
index ec5a4cb173b0..afeb02bbb722 100644
--- a/drivers/ide/ide.c
+++ b/drivers/ide/ide.c
@@ -1949,10 +1949,41 @@ static int ide_uevent(struct device *dev, char **envp, int num_envp,
        return 0;
 }
+static int generic_ide_probe(struct device *dev)
+{
+        ide_drive_t *drive = to_ide_device(dev);
+        ide_driver_t *drv = to_ide_driver(dev->driver);
+        return drv->probe ? drv->probe(drive) : -ENODEV;
+}
+static int generic_ide_remove(struct device *dev)
+{
+        ide_drive_t *drive = to_ide_device(dev);
+        ide_driver_t *drv = to_ide_driver(dev->driver);
+        if (drv->remove)
+                drv->remove(drive);
+        return 0;
+}
+static void generic_ide_shutdown(struct device *dev)
+{
+        ide_drive_t *drive = to_ide_device(dev);
+        ide_driver_t *drv = to_ide_driver(dev->driver);
+        if (dev->driver && drv->shutdown)
+                drv->shutdown(drive);
+}
 struct bus_type ide_bus_type = {
        .name           = "ide",
        .match          = ide_bus_match,
        .uevent         = ide_uevent,
+        .probe          = generic_ide_probe,
+        .remove         = generic_ide_remove,
+        .shutdown       = generic_ide_shutdown,
        .dev_attrs      = ide_dev_attrs,
        .suspend        = generic_ide_suspend,
        .resume         = generic_ide_resume,
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 3a611fe5497e..c06b18102b6a 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -3163,22 +3163,6 @@ int ib_cm_init_qp_attr(struct ib_cm_id *cm_id,
 }
 EXPORT_SYMBOL(ib_cm_init_qp_attr);
-static __be64 cm_get_ca_guid(struct ib_device *device)
-{
-        struct ib_device_attr *device_attr;
-        __be64 guid;
-        int ret;
-        device_attr = kmalloc(sizeof *device_attr, GFP_KERNEL);
-        if (!device_attr)
-                return 0;
-        ret = ib_query_device(device, device_attr);
-        guid = ret ? 0 : device_attr->node_guid;
-        kfree(device_attr);
-        return guid;
-}
 static void cm_add_one(struct ib_device *device)
 {
        struct cm_device *cm_dev;
@@ -3200,9 +3184,7 @@ static void cm_add_one(struct ib_device *device)
                return;
        cm_dev->device = device;
-        cm_dev->ca_guid = cm_get_ca_guid(device);
+        cm_dev->ca_guid = device->node_guid;
-        if (!cm_dev->ca_guid)
-                goto error1;
        set_bit(IB_MGMT_METHOD_SEND, reg_req.method_mask);
        for (i = 1; i <= device->phys_port_cnt; i++) {
@@ -3217,11 +3199,11 @@ static void cm_add_one(struct ib_device *device)
                                                        cm_recv_handler,
                                                        port);
                if (IS_ERR(port->mad_agent))
-                        goto error2;
+                        goto error1;
                ret = ib_modify_port(device, i, 0, &port_modify);
                if (ret)
-                        goto error3;
+                        goto error2;
        }
        ib_set_client_data(device, &cm_client, cm_dev);
@@ -3230,9 +3212,9 @@ static void cm_add_one(struct ib_device *device)
        write_unlock_irqrestore(&cm.device_lock, flags);
        return;
-error3:
-        ib_unregister_mad_agent(port->mad_agent);
 error2:
+        ib_unregister_mad_agent(port->mad_agent);
+error1:
        port_modify.set_port_cap_mask = 0;
        port_modify.clr_port_cap_mask = IB_PORT_CM_SUP;
        while (--i) {
@@ -3240,7 +3222,6 @@ error2:
                ib_modify_port(device, port->port_num, 0, &port_modify);
                ib_unregister_mad_agent(port->mad_agent);
        }
-error1:
        kfree(cm_dev);
 }
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index e169e798354b..b2f3cb91d9bc 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -38,8 +38,7 @@
 #include <linux/errno.h>
 #include <linux/slab.h>
 #include <linux/init.h>
+#include <linux/mutex.h>
-#include <asm/semaphore.h>
 #include "core_priv.h"
@@ -57,13 +56,13 @@ static LIST_HEAD(device_list);
 static LIST_HEAD(client_list);
 /*
- * device_sem protects access to both device_list and client_list.
+ * device_mutex protects access to both device_list and client_list.
 * There's no real point to using multiple locks or something fancier
 * like an rwsem: we always access both lists, and we're always
 * modifying one list or the other list.  In any case this is not a
 * hot path so there's no point in trying to optimize.
 */
-static DECLARE_MUTEX(device_sem);
+static DEFINE_MUTEX(device_mutex);
 static int ib_device_check_mandatory(struct ib_device *device)
 {
@@ -221,7 +220,7 @@ int ib_register_device(struct ib_device *device)
 {
        int ret;
-        down(&device_sem);
+        mutex_lock(&device_mutex);
        if (strchr(device->name, '%')) {
                ret = alloc_name(device->name);
@@ -259,7 +258,7 @@ int ib_register_device(struct ib_device *device)
        }
 out:
-        up(&device_sem);
+        mutex_unlock(&device_mutex);
        return ret;
 }
 EXPORT_SYMBOL(ib_register_device);
@@ -276,7 +275,7 @@ void ib_unregister_device(struct ib_device *device)
        struct ib_client_data *context, *tmp;
        unsigned long flags;
-        down(&device_sem);
+        mutex_lock(&device_mutex);
        list_for_each_entry_reverse(client, &client_list, list)
                if (client->remove)
@@ -284,7 +283,7 @@ void ib_unregister_device(struct ib_device *device)
        list_del(&device->core_list);
-        up(&device_sem);
+        mutex_unlock(&device_mutex);
        spin_lock_irqsave(&device->client_data_lock, flags);
        list_for_each_entry_safe(context, tmp, &device->client_data_list, list)
@@ -312,14 +311,14 @@ int ib_register_client(struct ib_client *client)
 {
        struct ib_device *device;
-        down(&device_sem);
+        mutex_lock(&device_mutex);
        list_add_tail(&client->list, &client_list);
        list_for_each_entry(device, &device_list, core_list)
                if (client->add && !add_client_context(device, client))
                        client->add(device);
-        up(&device_sem);
+        mutex_unlock(&device_mutex);
        return 0;
 }
@@ -339,7 +338,7 @@ void ib_unregister_client(struct ib_client *client)
        struct ib_device *device;
        unsigned long flags;
-        down(&device_sem);
+        mutex_lock(&device_mutex);
        list_for_each_entry(device, &device_list, core_list) {
                if (client->remove)
@@ -355,7 +354,7 @@ void ib_unregister_client(struct ib_client *client)
        }
        list_del(&client->list);
-        up(&device_sem);
+        mutex_unlock(&device_mutex);
 }
 EXPORT_SYMBOL(ib_unregister_client);
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 1f1743c5c9a3..5982d687a000 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -445,13 +445,7 @@ static int ib_device_uevent(struct class_device *cdev, char **envp,
                return -ENOMEM;
        /*
-         * It might be nice to pass the node GUID with the event, but
+         * It would be nice to pass the node GUID with the event...
-         * right now the only way to get it is to query the device
-         * provider, and this can crash during device removal because
-         * we are will be running after driver removal has started.
-         * We could add a node_guid field to struct ib_device, or we
-         * could just let userspace read the node GUID from sysfs when
-         * devices are added.
         */
        envp[i] = NULL;
@@ -623,21 +617,15 @@ static ssize_t show_sys_image_guid(struct class_device *cdev, char *buf)
 static ssize_t show_node_guid(struct class_device *cdev, char *buf)
 {
        struct ib_device *dev = container_of(cdev, struct ib_device, class_dev);
-        struct ib_device_attr attr;
-        ssize_t ret;
        if (!ibdev_is_alive(dev))
                return -ENODEV;
-        ret = ib_query_device(dev, &attr);
-        if (ret)
-                return ret;
        return sprintf(buf, "%04x:%04x:%04x:%04x\n",
-                       be16_to_cpu(((__be16 *) &attr.node_guid)[0]),
+                       be16_to_cpu(((__be16 *) &dev->node_guid)[0]),
-                       be16_to_cpu(((__be16 *) &attr.node_guid)[1]),
+                       be16_to_cpu(((__be16 *) &dev->node_guid)[1]),
-                       be16_to_cpu(((__be16 *) &attr.node_guid)[2]),
+                       be16_to_cpu(((__be16 *) &dev->node_guid)[2]),
-                       be16_to_cpu(((__be16 *) &attr.node_guid)[3]));
+                       be16_to_cpu(((__be16 *) &dev->node_guid)[3]));
 }
 static CLASS_DEVICE_ATTR(node_type, S_IRUGO, show_node_type, NULL);
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index 6e15787d1de1..e95c4293a496 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -42,6 +42,7 @@
 #include <linux/mount.h>
 #include <linux/cdev.h>
 #include <linux/idr.h>
+#include <linux/mutex.h>
 #include <asm/uaccess.h>
@@ -113,7 +114,7 @@ static struct ib_client ucm_client = {
        .remove = ib_ucm_remove_one
 };
-static DECLARE_MUTEX(ctx_id_mutex);
+static DEFINE_MUTEX(ctx_id_mutex);
 static DEFINE_IDR(ctx_id_table);
 static DECLARE_BITMAP(dev_map, IB_UCM_MAX_DEVICES);
@@ -121,7 +122,7 @@ static struct ib_ucm_context *ib_ucm_ctx_get(struct ib_ucm_file *file, int id)
 {
        struct ib_ucm_context *ctx;
-        down(&ctx_id_mutex);
+        mutex_lock(&ctx_id_mutex);
        ctx = idr_find(&ctx_id_table, id);
        if (!ctx)
                ctx = ERR_PTR(-ENOENT);
@@ -129,7 +130,7 @@ static struct ib_ucm_context *ib_ucm_ctx_get(struct ib_ucm_file *file, int id)
                ctx = ERR_PTR(-EINVAL);
        else
                atomic_inc(&ctx->ref);
-        up(&ctx_id_mutex);
+        mutex_unlock(&ctx_id_mutex);
        return ctx;
 }
@@ -186,9 +187,9 @@ static struct ib_ucm_context *ib_ucm_ctx_alloc(struct ib_ucm_file *file)
                if (!result)
                        goto error;
-                down(&ctx_id_mutex);
+                mutex_lock(&ctx_id_mutex);
                result = idr_get_new(&ctx_id_table, ctx, &ctx->id);
-                up(&ctx_id_mutex);
+                mutex_unlock(&ctx_id_mutex);
        } while (result == -EAGAIN);
        if (result)
@@ -550,9 +551,9 @@ static ssize_t ib_ucm_create_id(struct ib_ucm_file *file,
 err2:
        ib_destroy_cm_id(ctx->cm_id);
 err1:
-        down(&ctx_id_mutex);
+        mutex_lock(&ctx_id_mutex);
        idr_remove(&ctx_id_table, ctx->id);
-        up(&ctx_id_mutex);
+        mutex_unlock(&ctx_id_mutex);
        kfree(ctx);
        return result;
 }
@@ -572,7 +573,7 @@ static ssize_t ib_ucm_destroy_id(struct ib_ucm_file *file,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
-        down(&ctx_id_mutex);
+        mutex_lock(&ctx_id_mutex);
        ctx = idr_find(&ctx_id_table, cmd.id);
        if (!ctx)
                ctx = ERR_PTR(-ENOENT);
@@ -580,7 +581,7 @@ static ssize_t ib_ucm_destroy_id(struct ib_ucm_file *file,
                ctx = ERR_PTR(-EINVAL);
        else
                idr_remove(&ctx_id_table, ctx->id);
-        up(&ctx_id_mutex);
+        mutex_unlock(&ctx_id_mutex);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
@@ -1280,9 +1281,9 @@ static int ib_ucm_close(struct inode *inode, struct file *filp)
                                 struct ib_ucm_context, file_list);
                up(&file->mutex);
-                down(&ctx_id_mutex);
+                mutex_lock(&ctx_id_mutex);
                idr_remove(&ctx_id_table, ctx->id);
-                up(&ctx_id_mutex);
+                mutex_unlock(&ctx_id_mutex);
                ib_destroy_cm_id(ctx->cm_id);
                ib_ucm_cleanup_events(ctx);
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index 7114e3fbab00..f7eecbc6af6c 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -41,6 +41,7 @@
 #include <linux/kref.h>
 #include <linux/idr.h>
+#include <linux/mutex.h>
 #include <rdma/ib_verbs.h>
 #include <rdma/ib_user_verbs.h>
@@ -88,7 +89,7 @@ struct ib_uverbs_event_file {
 struct ib_uverbs_file {
        struct kref                             ref;
-        struct semaphore                        mutex;
+        struct mutex                            mutex;
        struct ib_uverbs_device                *device;
        struct ib_ucontext                     *ucontext;
        struct ib_event_handler                 event_handler;
@@ -131,7 +132,7 @@ struct ib_ucq_object {
        u32                     async_events_reported;
 };
-extern struct semaphore ib_uverbs_idr_mutex;
+extern struct mutex ib_uverbs_idr_mutex;
 extern struct idr ib_uverbs_pd_idr;
 extern struct idr ib_uverbs_mr_idr;
 extern struct idr ib_uverbs_mw_idr;
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index a02c5a05c984..407b6284d7d5 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -67,7 +67,7 @@ ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
        if (copy_from_user(&cmd, buf, sizeof cmd))
                return -EFAULT;
-        down(&file->mutex);
+        mutex_lock(&file->mutex);
        if (file->ucontext) {
                ret = -EINVAL;
@@ -119,7 +119,7 @@ ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
        fd_install(resp.async_fd, filp);
-        up(&file->mutex);
+        mutex_unlock(&file->mutex);
        return in_len;
@@ -131,7 +131,7 @@ err_free:
        ibdev->dealloc_ucontext(ucontext);
 err:
-        up(&file->mutex);
+        mutex_unlock(&file->mutex);
        return ret;
 }
@@ -157,7 +157,7 @@ ssize_t ib_uverbs_query_device(struct ib_uverbs_file *file,
        memset(&resp, 0, sizeof resp);
        resp.fw_ver                    = attr.fw_ver;
-        resp.node_guid                 = attr.node_guid;
+        resp.node_guid                 = file->device->ib_dev->node_guid;
        resp.sys_image_guid            = attr.sys_image_guid;
        resp.max_mr_size               = attr.max_mr_size;
        resp.page_size_cap             = attr.page_size_cap;
@@ -290,7 +290,7 @@ ssize_t ib_uverbs_alloc_pd(struct ib_uverbs_file *file,
        pd->uobject = uobj;
        atomic_set(&pd->usecnt, 0);
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
 retry:
        if (!idr_pre_get(&ib_uverbs_pd_idr, GFP_KERNEL)) {
@@ -314,11 +314,11 @@ retry:
                goto err_idr;
        }
-        down(&file->mutex);
+        mutex_lock(&file->mutex);
        list_add_tail(&uobj->list, &file->ucontext->pd_list);
-        up(&file->mutex);
+        mutex_unlock(&file->mutex);
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return in_len;
@@ -326,7 +326,7 @@ err_idr:
        idr_remove(&ib_uverbs_pd_idr, uobj->id);
 err_up:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        ib_dealloc_pd(pd);
 err:
@@ -346,7 +346,7 @@ ssize_t ib_uverbs_dealloc_pd(struct ib_uverbs_file *file,
        if (copy_from_user(&cmd, buf, sizeof cmd))
                return -EFAULT;
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
        if (!pd || pd->uobject->context != file->ucontext)
@@ -360,14 +360,14 @@ ssize_t ib_uverbs_dealloc_pd(struct ib_uverbs_file *file,
        idr_remove(&ib_uverbs_pd_idr, cmd.pd_handle);
-        down(&file->mutex);
+        mutex_lock(&file->mutex);
        list_del(&uobj->list);
-        up(&file->mutex);
+        mutex_unlock(&file->mutex);
        kfree(uobj);
 out:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return ret ? ret : in_len;
 }
@@ -426,7 +426,7 @@ ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file,
        obj->umem.virt_base = cmd.hca_va;
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
        if (!pd || pd->uobject->context != file->ucontext) {
@@ -476,11 +476,11 @@ retry:
                goto err_idr;
        }
-        down(&file->mutex);
+        mutex_lock(&file->mutex);
        list_add_tail(&obj->uobject.list, &file->ucontext->mr_list);
-        up(&file->mutex);
+        mutex_unlock(&file->mutex);
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return in_len;
@@ -492,7 +492,7 @@ err_unreg:
        atomic_dec(&pd->usecnt);
 err_up:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        ib_umem_release(file->device->ib_dev, &obj->umem);
@@ -513,7 +513,7 @@ ssize_t ib_uverbs_dereg_mr(struct ib_uverbs_file *file,
        if (copy_from_user(&cmd, buf, sizeof cmd))
                return -EFAULT;
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        mr = idr_find(&ib_uverbs_mr_idr, cmd.mr_handle);
        if (!mr || mr->uobject->context != file->ucontext)
@@ -527,15 +527,15 @@ ssize_t ib_uverbs_dereg_mr(struct ib_uverbs_file *file,
        idr_remove(&ib_uverbs_mr_idr, cmd.mr_handle);
-        down(&file->mutex);
+        mutex_lock(&file->mutex);
        list_del(&memobj->uobject.list);
-        up(&file->mutex);
+        mutex_unlock(&file->mutex);
        ib_umem_release(file->device->ib_dev, &memobj->umem);
        kfree(memobj);
 out:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return ret ? ret : in_len;
 }
@@ -628,7 +628,7 @@ ssize_t ib_uverbs_create_cq(struct ib_uverbs_file *file,
        cq->cq_context    = ev_file;
        atomic_set(&cq->usecnt, 0);
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
 retry:
        if (!idr_pre_get(&ib_uverbs_cq_idr, GFP_KERNEL)) {
@@ -653,11 +653,11 @@ retry:
                goto err_idr;
        }
-        down(&file->mutex);
+        mutex_lock(&file->mutex);
        list_add_tail(&uobj->uobject.list, &file->ucontext->cq_list);
-        up(&file->mutex);
+        mutex_unlock(&file->mutex);
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return in_len;
@@ -665,7 +665,7 @@ err_idr:
        idr_remove(&ib_uverbs_cq_idr, uobj->uobject.id);
 err_up:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        ib_destroy_cq(cq);
 err:
@@ -701,7 +701,7 @@ ssize_t ib_uverbs_poll_cq(struct ib_uverbs_file *file,
                goto out_wc;
        }
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
        if (!cq || cq->uobject->context != file->ucontext) {
                ret = -EINVAL;
@@ -731,7 +731,7 @@ ssize_t ib_uverbs_poll_cq(struct ib_uverbs_file *file,
                ret = -EFAULT;
 out:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        kfree(resp);
 out_wc:
@@ -750,14 +750,14 @@ ssize_t ib_uverbs_req_notify_cq(struct ib_uverbs_file *file,
        if (copy_from_user(&cmd, buf, sizeof cmd))
                return -EFAULT;
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
        if (cq && cq->uobject->context == file->ucontext) {
                ib_req_notify_cq(cq, cmd.solicited_only ?
                                        IB_CQ_SOLICITED : IB_CQ_NEXT_COMP);
                ret = in_len;
        }
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return ret;
 }
@@ -779,7 +779,7 @@ ssize_t ib_uverbs_destroy_cq(struct ib_uverbs_file *file,
        memset(&resp, 0, sizeof resp);
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        cq = idr_find(&ib_uverbs_cq_idr, cmd.cq_handle);
        if (!cq || cq->uobject->context != file->ucontext)
@@ -795,9 +795,9 @@ ssize_t ib_uverbs_destroy_cq(struct ib_uverbs_file *file,
        idr_remove(&ib_uverbs_cq_idr, cmd.cq_handle);
-        down(&file->mutex);
+        mutex_lock(&file->mutex);
        list_del(&uobj->uobject.list);
-        up(&file->mutex);
+        mutex_unlock(&file->mutex);
        ib_uverbs_release_ucq(file, ev_file, uobj);
@@ -811,7 +811,7 @@ ssize_t ib_uverbs_destroy_cq(struct ib_uverbs_file *file,
                ret = -EFAULT;
 out:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return ret ? ret : in_len;
 }
@@ -845,7 +845,7 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
        if (!uobj)
                return -ENOMEM;
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        pd  = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
        scq = idr_find(&ib_uverbs_cq_idr, cmd.send_cq_handle);
@@ -930,11 +930,11 @@ retry:
                goto err_idr;
        }
-        down(&file->mutex);
+        mutex_lock(&file->mutex);
        list_add_tail(&uobj->uevent.uobject.list, &file->ucontext->qp_list);
-        up(&file->mutex);
+        mutex_unlock(&file->mutex);
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return in_len;
@@ -950,7 +950,7 @@ err_destroy:
                atomic_dec(&attr.srq->usecnt);
 err_up:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        kfree(uobj);
        return ret;
@@ -972,7 +972,7 @@ ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
        if (!attr)
                return -ENOMEM;
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
        if (!qp || qp->uobject->context != file->ucontext) {
@@ -1033,7 +1033,7 @@ ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
        ret = in_len;
 out:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        kfree(attr);
        return ret;
@@ -1054,7 +1054,7 @@ ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
        memset(&resp, 0, sizeof resp);
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
        if (!qp || qp->uobject->context != file->ucontext)
@@ -1073,9 +1073,9 @@ ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
        idr_remove(&ib_uverbs_qp_idr, cmd.qp_handle);
-        down(&file->mutex);
+        mutex_lock(&file->mutex);
        list_del(&uobj->uevent.uobject.list);
-        up(&file->mutex);
+        mutex_unlock(&file->mutex);
        ib_uverbs_release_uevent(file, &uobj->uevent);
@@ -1088,7 +1088,7 @@ ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
                ret = -EFAULT;
 out:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return ret ? ret : in_len;
 }
@@ -1119,7 +1119,7 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
        if (!user_wr)
                return -ENOMEM;
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
        if (!qp || qp->uobject->context != file->ucontext)
@@ -1224,7 +1224,7 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
                ret = -EFAULT;
 out:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        while (wr) {
                next = wr->next;
@@ -1341,7 +1341,7 @@ ssize_t ib_uverbs_post_recv(struct ib_uverbs_file *file,
        if (IS_ERR(wr))
                return PTR_ERR(wr);
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
        if (!qp || qp->uobject->context != file->ucontext)
@@ -1362,7 +1362,7 @@ ssize_t ib_uverbs_post_recv(struct ib_uverbs_file *file,
                ret = -EFAULT;
 out:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        while (wr) {
                next = wr->next;
@@ -1392,7 +1392,7 @@ ssize_t ib_uverbs_post_srq_recv(struct ib_uverbs_file *file,
        if (IS_ERR(wr))
                return PTR_ERR(wr);
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
        if (!srq || srq->uobject->context != file->ucontext)
@@ -1413,7 +1413,7 @@ ssize_t ib_uverbs_post_srq_recv(struct ib_uverbs_file *file,
                ret = -EFAULT;
 out:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        while (wr) {
                next = wr->next;
@@ -1446,7 +1446,7 @@ ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file,
        if (!uobj)
                return -ENOMEM;
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        pd = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
        if (!pd || pd->uobject->context != file->ucontext) {
@@ -1498,11 +1498,11 @@ retry:
                goto err_idr;
        }
-        down(&file->mutex);
+        mutex_lock(&file->mutex);
        list_add_tail(&uobj->list, &file->ucontext->ah_list);
-        up(&file->mutex);
+        mutex_unlock(&file->mutex);
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return in_len;
@@ -1513,7 +1513,7 @@ err_destroy:
        ib_destroy_ah(ah);
 err_up:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        kfree(uobj);
        return ret;
@@ -1530,7 +1530,7 @@ ssize_t ib_uverbs_destroy_ah(struct ib_uverbs_file *file,
        if (copy_from_user(&cmd, buf, sizeof cmd))
                return -EFAULT;
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        ah = idr_find(&ib_uverbs_ah_idr, cmd.ah_handle);
        if (!ah || ah->uobject->context != file->ucontext)
@@ -1544,14 +1544,14 @@ ssize_t ib_uverbs_destroy_ah(struct ib_uverbs_file *file,
        idr_remove(&ib_uverbs_ah_idr, cmd.ah_handle);
-        down(&file->mutex);
+        mutex_lock(&file->mutex);
        list_del(&uobj->list);
-        up(&file->mutex);
+        mutex_unlock(&file->mutex);
        kfree(uobj);
 out:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return ret ? ret : in_len;
 }
@@ -1569,7 +1569,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
        if (copy_from_user(&cmd, buf, sizeof cmd))
                return -EFAULT;
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
        if (!qp || qp->uobject->context != file->ucontext)
@@ -1602,7 +1602,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
                kfree(mcast);
 out:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return ret ? ret : in_len;
 }
@@ -1620,7 +1620,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
        if (copy_from_user(&cmd, buf, sizeof cmd))
                return -EFAULT;
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        qp = idr_find(&ib_uverbs_qp_idr, cmd.qp_handle);
        if (!qp || qp->uobject->context != file->ucontext)
@@ -1641,7 +1641,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
                }
 out:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return ret ? ret : in_len;
 }
@@ -1673,7 +1673,7 @@ ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file,
        if (!uobj)
                return -ENOMEM;
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        pd  = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);
@@ -1730,11 +1730,11 @@ retry:
                goto err_idr;
        }
-        down(&file->mutex);
+        mutex_lock(&file->mutex);
        list_add_tail(&uobj->uobject.list, &file->ucontext->srq_list);
-        up(&file->mutex);
+        mutex_unlock(&file->mutex);
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return in_len;
@@ -1746,7 +1746,7 @@ err_destroy:
        atomic_dec(&pd->usecnt);
 err_up:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        kfree(uobj);
        return ret;
@@ -1764,7 +1764,7 @@ ssize_t ib_uverbs_modify_srq(struct ib_uverbs_file *file,
        if (copy_from_user(&cmd, buf, sizeof cmd))
                return -EFAULT;
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        srq = idr_find(&ib_uverbs_srq_idr, cmd.srq_handle);
        if (!srq || srq->uobject->context != file->ucontext) {
@@ -1778,7 +1778,7 @@ ssize_t ib_uverbs_modify_srq(struct ib_uverbs_file *file,
        ret = ib_modify_srq(srq, &attr, cmd.attr_mask);
 out:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return ret ? ret : in_len;
 }
@@ -1796,7 +1796,7 @@ ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
        if (copy_from_user(&cmd, buf, sizeof cmd))
                return -EFAULT;
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        memset(&resp, 0, sizeof resp);
@@ -1812,9 +1812,9 @@ ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
        idr_remove(&ib_uverbs_srq_idr, cmd.srq_handle);
-        down(&file->mutex);
+        mutex_lock(&file->mutex);
        list_del(&uobj->uobject.list);
-        up(&file->mutex);
+        mutex_unlock(&file->mutex);
        ib_uverbs_release_uevent(file, uobj);
@@ -1827,7 +1827,7 @@ ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
                ret = -EFAULT;
 out:
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return ret ? ret : in_len;
 }
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 81737bd6faea..96ea79b63df7 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -66,7 +66,7 @@ enum {
 static struct class *uverbs_class;
-DECLARE_MUTEX(ib_uverbs_idr_mutex);
+DEFINE_MUTEX(ib_uverbs_idr_mutex);
 DEFINE_IDR(ib_uverbs_pd_idr);
 DEFINE_IDR(ib_uverbs_mr_idr);
 DEFINE_IDR(ib_uverbs_mw_idr);
@@ -180,7 +180,7 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file,
        if (!context)
                return 0;
-        down(&ib_uverbs_idr_mutex);
+        mutex_lock(&ib_uverbs_idr_mutex);
        list_for_each_entry_safe(uobj, tmp, &context->ah_list, list) {
                struct ib_ah *ah = idr_find(&ib_uverbs_ah_idr, uobj->id);
@@ -250,7 +250,7 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file,
                kfree(uobj);
        }
-        up(&ib_uverbs_idr_mutex);
+        mutex_unlock(&ib_uverbs_idr_mutex);
        return context->device->dealloc_ucontext(context);
 }
@@ -653,7 +653,7 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp)
        file->ucontext   = NULL;
        file->async_file = NULL;
        kref_init(&file->ref);
-        init_MUTEX(&file->mutex);
+        mutex_init(&file->mutex);
        filp->private_data = file;
diff --git a/drivers/infiniband/hw/mthca/mthca_av.c b/drivers/infiniband/hw/mthca/mthca_av.c
index 22fdc446f25c..a14eed08a0fc 100644
--- a/drivers/infiniband/hw/mthca/mthca_av.c
+++ b/drivers/infiniband/hw/mthca/mthca_av.c
@@ -163,6 +163,11 @@ int mthca_destroy_ah(struct mthca_dev *dev, struct mthca_ah *ah)
        return 0;
 }
+int mthca_ah_grh_present(struct mthca_ah *ah)
+{
+        return !!(ah->av->g_slid & 0x80);
+}
 int mthca_read_ah(struct mthca_dev *dev, struct mthca_ah *ah,
                  struct ib_ud_header *header)
 {
@@ -172,8 +177,7 @@ int mthca_read_ah(struct mthca_dev *dev, struct mthca_ah *ah,
        header->lrh.service_level   = be32_to_cpu(ah->av->sl_tclass_flowlabel) >> 28;
        header->lrh.destination_lid = ah->av->dlid;
        header->lrh.source_lid      = cpu_to_be16(ah->av->g_slid & 0x7f);
-        if (ah->av->g_slid & 0x80) {
+        if (mthca_ah_grh_present(ah)) {
-                header->grh_present = 1;
                header->grh.traffic_class =
                        (be32_to_cpu(ah->av->sl_tclass_flowlabel) >> 20) & 0xff;
                header->grh.flow_label    =
@@ -184,8 +188,6 @@ int mthca_read_ah(struct mthca_dev *dev, struct mthca_ah *ah,
                                  &header->grh.source_gid);
                memcpy(header->grh.destination_gid.raw,
                       ah->av->dgid, 16);
-        } else {
-                header->grh_present = 0;
        }
        return 0;
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index 22ac72bc20c3..be1791be627b 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -606,7 +606,7 @@ static int mthca_map_cmd(struct mthca_dev *dev, u16 op, struct mthca_icm *icm,
                        err = -EINVAL;
                        goto out;
                }
-                for (i = 0; i < mthca_icm_size(&iter) / (1 << lg); ++i) {
+                for (i = 0; i < mthca_icm_size(&iter) >> lg; ++i) {
                        if (virt != -1) {
                                pages[nent * 2] = cpu_to_be64(virt);
                                virt += 1 << lg;
@@ -727,8 +727,8 @@ int mthca_QUERY_FW(struct mthca_dev *dev, u8 *status)
                 * system pages needed.
                 */
                dev->fw.arbel.fw_pages =
-                        (dev->fw.arbel.fw_pages + (1 << (PAGE_SHIFT - 12)) - 1) >>
+                        ALIGN(dev->fw.arbel.fw_pages, PAGE_SIZE >> 12) >>
-                        (PAGE_SHIFT - 12);
+                                (PAGE_SHIFT - 12);
                mthca_dbg(dev, "Clear int @ %llx, EQ arm @ %llx, EQ set CI @ %llx\n",
                          (unsigned long long) dev->fw.arbel.clr_int_base,
@@ -1445,6 +1445,7 @@ int mthca_SET_ICM_SIZE(struct mthca_dev *dev, u64 icm_size, u64 *aux_pages,
         * pages needed.
         */
        *aux_pages = (*aux_pages + (1 << (PAGE_SHIFT - 12)) - 1) >> (PAGE_SHIFT - 12);
+        *aux_pages = ALIGN(*aux_pages, PAGE_SIZE >> 12) >> (PAGE_SHIFT - 12);
        return 0;
 }
diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
index 795b379260bf..a104ab041ea3 100644
--- a/drivers/infiniband/hw/mthca/mthca_dev.h
+++ b/drivers/infiniband/hw/mthca/mthca_dev.h
@@ -520,6 +520,7 @@ int mthca_create_ah(struct mthca_dev *dev,
 int mthca_destroy_ah(struct mthca_dev *dev, struct mthca_ah *ah);
 int mthca_read_ah(struct mthca_dev *dev, struct mthca_ah *ah,
                  struct ib_ud_header *header);
+int mthca_ah_grh_present(struct mthca_ah *ah);
 int mthca_multicast_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid);
 int mthca_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid);
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index e8a948f087c0..2eabb27804cd 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -45,6 +45,7 @@
 enum {
        MTHCA_NUM_ASYNC_EQE = 0x80,
        MTHCA_NUM_CMD_EQE   = 0x80,
+        MTHCA_NUM_SPARE_EQE = 0x80,
        MTHCA_EQ_ENTRY_SIZE = 0x20
 };
@@ -277,11 +278,10 @@ static int mthca_eq_int(struct mthca_dev *dev, struct mthca_eq *eq)
 {
        struct mthca_eqe *eqe;
        int disarm_cqn;
-        int  eqes_found = 0;
+        int eqes_found = 0;
+        int set_ci = 0;
        while ((eqe = next_eqe_sw(eq))) {
-                int set_ci = 0;
                /*
                 * Make sure we read EQ entry contents after we've
                 * checked the ownership bit.
@@ -345,12 +345,6 @@ static int mthca_eq_int(struct mthca_dev *dev, struct mthca_eq *eq)
                                        be16_to_cpu(eqe->event.cmd.token),
                                        eqe->event.cmd.status,
                                        be64_to_cpu(eqe->event.cmd.out_param));
-                        /*
-                         * cmd_event() may add more commands.
-                         * The card will think the queue has overflowed if
-                         * we don't tell it we've been processing events.
-                         */
-                        set_ci = 1;
                        break;
                case MTHCA_EVENT_TYPE_PORT_CHANGE:
@@ -385,8 +379,16 @@ static int mthca_eq_int(struct mthca_dev *dev, struct mthca_eq *eq)
                set_eqe_hw(eqe);
                ++eq->cons_index;
                eqes_found = 1;
+                ++set_ci;
-                if (unlikely(set_ci)) {
+                /*
+                 * The HCA will think the queue has overflowed if we
+                 * don't tell it we've been processing events.  We
+                 * create our EQs with MTHCA_NUM_SPARE_EQE extra
+                 * entries, so we must update our consumer index at
+                 * least that often.
+                 */
+                if (unlikely(set_ci >= MTHCA_NUM_SPARE_EQE)) {
                        /*
                         * Conditional on hca_type is OK here because
                         * this is a rare case, not the fast path.
@@ -862,19 +864,19 @@ int __devinit mthca_init_eq_table(struct mthca_dev *dev)
        intr = (dev->mthca_flags & MTHCA_FLAG_MSI) ?
                128 : dev->eq_table.inta_pin;
-        err = mthca_create_eq(dev, dev->limits.num_cqs,
+        err = mthca_create_eq(dev, dev->limits.num_cqs + MTHCA_NUM_SPARE_EQE,
                              (dev->mthca_flags & MTHCA_FLAG_MSI_X) ? 128 : intr,
                              &dev->eq_table.eq[MTHCA_EQ_COMP]);
        if (err)
                goto err_out_unmap;
-        err = mthca_create_eq(dev, MTHCA_NUM_ASYNC_EQE,
+        err = mthca_create_eq(dev, MTHCA_NUM_ASYNC_EQE + MTHCA_NUM_SPARE_EQE,
                              (dev->mthca_flags & MTHCA_FLAG_MSI_X) ? 129 : intr,
                              &dev->eq_table.eq[MTHCA_EQ_ASYNC]);
        if (err)
                goto err_out_comp;
-        err = mthca_create_eq(dev, MTHCA_NUM_CMD_EQE,
+        err = mthca_create_eq(dev, MTHCA_NUM_CMD_EQE + MTHCA_NUM_SPARE_EQE,
                              (dev->mthca_flags & MTHCA_FLAG_MSI_X) ? 130 : intr,
                              &dev->eq_table.eq[MTHCA_EQ_CMD]);
        if (err)
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 4cc7e2846df1..484a7e6b7f8c 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -33,7 +33,7 @@
 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE.
 *
- * $Id: mthca_provider.c 1397 2004-12-28 05:09:00Z roland $
+ * $Id: mthca_provider.c 4859 2006-01-09 21:55:10Z roland $
 */
 #include <rdma/ib_smi.h>
@@ -45,6 +45,14 @@
 #include "mthca_user.h"
 #include "mthca_memfree.h"
+static void init_query_mad(struct ib_smp *mad)
+{
+        mad->base_version  = 1;
+        mad->mgmt_class    = IB_MGMT_CLASS_SUBN_LID_ROUTED;
+        mad->class_version = 1;
+        mad->method        = IB_MGMT_METHOD_GET;
+}
 static int mthca_query_device(struct ib_device *ibdev,
                              struct ib_device_attr *props)
 {
@@ -55,7 +63,7 @@ static int mthca_query_device(struct ib_device *ibdev,
        u8 status;
-        in_mad  = kmalloc(sizeof *in_mad, GFP_KERNEL);
+        in_mad  = kzalloc(sizeof *in_mad, GFP_KERNEL);
        out_mad = kmalloc(sizeof *out_mad, GFP_KERNEL);
        if (!in_mad || !out_mad)
                goto out;
@@ -64,12 +72,8 @@ static int mthca_query_device(struct ib_device *ibdev,
        props->fw_ver              = mdev->fw_ver;
-        memset(in_mad, 0, sizeof *in_mad);
+        init_query_mad(in_mad);
-        in_mad->base_version       = 1;
+        in_mad->attr_id = IB_SMP_ATTR_NODE_INFO;
-        in_mad->mgmt_class         = IB_MGMT_CLASS_SUBN_LID_ROUTED;
-        in_mad->class_version      = 1;
-        in_mad->method             = IB_MGMT_METHOD_GET;
-        in_mad->attr_id            = IB_SMP_ATTR_NODE_INFO;
        err = mthca_MAD_IFC(mdev, 1, 1,
                            1, NULL, NULL, in_mad, out_mad,
@@ -87,7 +91,6 @@ static int mthca_query_device(struct ib_device *ibdev,
        props->vendor_part_id      = be16_to_cpup((__be16 *) (out_mad->data + 30));
        props->hw_ver              = be32_to_cpup((__be32 *) (out_mad->data + 32));
        memcpy(&props->sys_image_guid, out_mad->data +  4, 8);
-        memcpy(&props->node_guid,      out_mad->data + 12, 8);
        props->max_mr_size         = ~0ull;
        props->page_size_cap       = mdev->limits.page_size_cap;
@@ -128,20 +131,16 @@ static int mthca_query_port(struct ib_device *ibdev,
        int err = -ENOMEM;
        u8 status;
-        in_mad  = kmalloc(sizeof *in_mad, GFP_KERNEL);
+        in_mad  = kzalloc(sizeof *in_mad, GFP_KERNEL);
        out_mad = kmalloc(sizeof *out_mad, GFP_KERNEL);
        if (!in_mad || !out_mad)
                goto out;
        memset(props, 0, sizeof *props);
-        memset(in_mad, 0, sizeof *in_mad);
+        init_query_mad(in_mad);
-        in_mad->base_version       = 1;
+        in_mad->attr_id  = IB_SMP_ATTR_PORT_INFO;
-        in_mad->mgmt_class         = IB_MGMT_CLASS_SUBN_LID_ROUTED;
+        in_mad->attr_mod = cpu_to_be32(port);
-        in_mad->class_version      = 1;
-        in_mad->method             = IB_MGMT_METHOD_GET;
-        in_mad->attr_id            = IB_SMP_ATTR_PORT_INFO;
-        in_mad->attr_mod           = cpu_to_be32(port);
        err = mthca_MAD_IFC(to_mdev(ibdev), 1, 1,
                            port, NULL, NULL, in_mad, out_mad,
@@ -220,18 +219,14 @@ static int mthca_query_pkey(struct ib_device *ibdev,
        int err = -ENOMEM;
        u8 status;
-        in_mad  = kmalloc(sizeof *in_mad, GFP_KERNEL);
+        in_mad  = kzalloc(sizeof *in_mad, GFP_KERNEL);
        out_mad = kmalloc(sizeof *out_mad, GFP_KERNEL);
        if (!in_mad || !out_mad)
                goto out;
-        memset(in_mad, 0, sizeof *in_mad);
+        init_query_mad(in_mad);
-        in_mad->base_version       = 1;
+        in_mad->attr_id  = IB_SMP_ATTR_PKEY_TABLE;
-        in_mad->mgmt_class         = IB_MGMT_CLASS_SUBN_LID_ROUTED;
+        in_mad->attr_mod = cpu_to_be32(index / 32);
-        in_mad->class_version      = 1;
-        in_mad->method             = IB_MGMT_METHOD_GET;
-        in_mad->attr_id            = IB_SMP_ATTR_PKEY_TABLE;
-        in_mad->attr_mod           = cpu_to_be32(index / 32);
        err = mthca_MAD_IFC(to_mdev(ibdev), 1, 1,
                            port, NULL, NULL, in_mad, out_mad,
@@ -259,18 +254,14 @@ static int mthca_query_gid(struct ib_device *ibdev, u8 port,
        int err = -ENOMEM;
        u8 status;
-        in_mad  = kmalloc(sizeof *in_mad, GFP_KERNEL);
+        in_mad  = kzalloc(sizeof *in_mad, GFP_KERNEL);
        out_mad = kmalloc(sizeof *out_mad, GFP_KERNEL);
        if (!in_mad || !out_mad)
                goto out;
-        memset(in_mad, 0, sizeof *in_mad);
+        init_query_mad(in_mad);
-        in_mad->base_version       = 1;
+        in_mad->attr_id  = IB_SMP_ATTR_PORT_INFO;
-        in_mad->mgmt_class         = IB_MGMT_CLASS_SUBN_LID_ROUTED;
+        in_mad->attr_mod = cpu_to_be32(port);
-        in_mad->class_version      = 1;
-        in_mad->method             = IB_MGMT_METHOD_GET;
-        in_mad->attr_id            = IB_SMP_ATTR_PORT_INFO;
-        in_mad->attr_mod           = cpu_to_be32(port);
        err = mthca_MAD_IFC(to_mdev(ibdev), 1, 1,
                            port, NULL, NULL, in_mad, out_mad,
@@ -284,13 +275,9 @@ static int mthca_query_gid(struct ib_device *ibdev, u8 port,
        memcpy(gid->raw, out_mad->data + 8, 8);
-        memset(in_mad, 0, sizeof *in_mad);
+        init_query_mad(in_mad);
-        in_mad->base_version       = 1;
+        in_mad->attr_id  = IB_SMP_ATTR_GUID_INFO;
-        in_mad->mgmt_class         = IB_MGMT_CLASS_SUBN_LID_ROUTED;
+        in_mad->attr_mod = cpu_to_be32(index / 8);
-        in_mad->class_version      = 1;
-        in_mad->method             = IB_MGMT_METHOD_GET;
-        in_mad->attr_id            = IB_SMP_ATTR_GUID_INFO;
-        in_mad->attr_mod           = cpu_to_be32(index / 8);
        err = mthca_MAD_IFC(to_mdev(ibdev), 1, 1,
                            port, NULL, NULL, in_mad, out_mad,
@@ -458,8 +445,10 @@ static struct ib_srq *mthca_create_srq(struct ib_pd *pd,
        if (pd->uobject) {
                context = to_mucontext(pd->uobject->context);
-                if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd))
+                if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd)) {
-                        return ERR_PTR(-EFAULT);
+                        err = -EFAULT;
+                        goto err_free;
+                }
                err = mthca_map_user_db(to_mdev(pd->device), &context->uar,
                                        context->db_tab, ucmd.db_index,
@@ -535,8 +524,10 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
                if (pd->uobject) {
                        context = to_mucontext(pd->uobject->context);
-                        if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd))
+                        if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd)) {
+                                kfree(qp);
                                return ERR_PTR(-EFAULT);
+                        }
                        err = mthca_map_user_db(to_mdev(pd->device), &context->uar,
                                                context->db_tab,
@@ -783,24 +774,20 @@ static struct ib_mr *mthca_reg_phys_mr(struct ib_pd       *pd,
        if ((*iova_start & ~PAGE_MASK) != (buffer_list[0].addr & ~PAGE_MASK))
                return ERR_PTR(-EINVAL);
-        if (num_phys_buf > 1 &&
-            ((buffer_list[0].addr + buffer_list[0].size) & ~PAGE_MASK))
-                return ERR_PTR(-EINVAL);
        mask = 0;
        total_size = 0;
        for (i = 0; i < num_phys_buf; ++i) {
-                if (i != 0 && buffer_list[i].addr & ~PAGE_MASK)
+                if (i != 0)
-                        return ERR_PTR(-EINVAL);
+                        mask |= buffer_list[i].addr;
-                if (i != 0 && i != num_phys_buf - 1 &&
+                if (i != num_phys_buf - 1)
-                    (buffer_list[i].size & ~PAGE_MASK))
+                        mask |= buffer_list[i].addr + buffer_list[i].size;
-                        return ERR_PTR(-EINVAL);
                total_size += buffer_list[i].size;
-                if (i > 0)
-                        mask |= buffer_list[i].addr;
        }
+        if (mask & ~PAGE_MASK)
+                return ERR_PTR(-EINVAL);
        /* Find largest page shift we can use to cover buffers */
        for (shift = PAGE_SHIFT; shift < 31; ++shift)
                if (num_phys_buf > 1) {
@@ -1070,11 +1057,48 @@ static struct class_device_attribute *mthca_class_attributes[] = {
        &class_device_attr_board_id
 };
+static int mthca_init_node_data(struct mthca_dev *dev)
+{
+        struct ib_smp *in_mad  = NULL;
+        struct ib_smp *out_mad = NULL;
+        int err = -ENOMEM;
+        u8 status;
+        in_mad  = kzalloc(sizeof *in_mad, GFP_KERNEL);
+        out_mad = kmalloc(sizeof *out_mad, GFP_KERNEL);
+        if (!in_mad || !out_mad)
+                goto out;
+        init_query_mad(in_mad);
+        in_mad->attr_id = IB_SMP_ATTR_NODE_INFO;
+        err = mthca_MAD_IFC(dev, 1, 1,
+                            1, NULL, NULL, in_mad, out_mad,
+                            &status);
+        if (err)
+                goto out;
+        if (status) {
+                err = -EINVAL;
+                goto out;
+        }
+        memcpy(&dev->ib_dev.node_guid, out_mad->data + 12, 8);
+out:
+        kfree(in_mad);
+        kfree(out_mad);
+        return err;
+}
 int mthca_register_device(struct mthca_dev *dev)
 {
        int ret;
        int i;
+        ret = mthca_init_node_data(dev);
+        if (ret)
+                return ret;
        strlcpy(dev->ib_dev.name, "mthca%d", IB_DEVICE_NAME_MAX);
        dev->ib_dev.owner                = THIS_MODULE;
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index 564b6d51c394..fba608ed7df2 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -1434,7 +1434,7 @@ static int build_mlx_header(struct mthca_dev *dev, struct mthca_sqp *sqp,
        u16 pkey;
        ib_ud_header_init(256, /* assume a MAD */
-                          sqp->ud_header.grh_present,
+                          mthca_ah_grh_present(to_mah(wr->wr.ud.ah)),
                          &sqp->ud_header);
        err = mthca_read_ah(dev, to_mah(wr->wr.ud.ah), &sqp->ud_header);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 9923a15a9996..e0a5412b7e68 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -45,11 +45,11 @@
 #include <linux/config.h>
 #include <linux/kref.h>
 #include <linux/if_infiniband.h>
+#include <linux/mutex.h>
 #include <net/neighbour.h>
 #include <asm/atomic.h>
-#include <asm/semaphore.h>
 #include <rdma/ib_verbs.h>
 #include <rdma/ib_pack.h>
@@ -123,8 +123,8 @@ struct ipoib_dev_priv {
        unsigned long flags;
-        struct semaphore mcast_mutex;
+        struct mutex mcast_mutex;
-        struct semaphore vlan_mutex;
+        struct mutex vlan_mutex;
        struct rb_root  path_tree;
        struct list_head path_list;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 23885801b6d2..86bcdd72a107 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -52,7 +52,7 @@ MODULE_PARM_DESC(data_debug_level,
 #define IPOIB_OP_RECV   (1ul << 31)
-static DECLARE_MUTEX(pkey_sem);
+static DEFINE_MUTEX(pkey_mutex);
 struct ipoib_ah *ipoib_create_ah(struct net_device *dev,
                                 struct ib_pd *pd, struct ib_ah_attr *attr)
@@ -445,25 +445,16 @@ int ipoib_ib_dev_down(struct net_device *dev)
        /* Shutdown the P_Key thread if still active */
        if (!test_bit(IPOIB_PKEY_ASSIGNED, &priv->flags)) {
-                down(&pkey_sem);
+                mutex_lock(&pkey_mutex);
                set_bit(IPOIB_PKEY_STOP, &priv->flags);
                cancel_delayed_work(&priv->pkey_task);
-                up(&pkey_sem);
+                mutex_unlock(&pkey_mutex);
                flush_workqueue(ipoib_workqueue);
        }
        ipoib_mcast_stop_thread(dev, 1);
-        /*
-         * Flush the multicast groups first so we stop any multicast joins. The
-         * completion thread may have already died and we may deadlock waiting
-         * for the completion thread to finish some multicast joins.
-         */
        ipoib_mcast_dev_flush(dev);
-        /* Delete broadcast and local addresses since they will be recreated */
-        ipoib_mcast_dev_down(dev);
        ipoib_flush_paths(dev);
        return 0;
@@ -608,13 +599,13 @@ void ipoib_ib_dev_flush(void *_dev)
        if (test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags))
                ipoib_ib_dev_up(dev);
-        down(&priv->vlan_mutex);
+        mutex_lock(&priv->vlan_mutex);
        /* Flush any child interfaces too */
        list_for_each_entry(cpriv, &priv->child_intfs, list)
                ipoib_ib_dev_flush(&cpriv->dev);
-        up(&priv->vlan_mutex);
+        mutex_unlock(&priv->vlan_mutex);
 }
 void ipoib_ib_dev_cleanup(struct net_device *dev)
@@ -624,9 +615,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev)
        ipoib_dbg(priv, "cleaning up ib_dev\n");
        ipoib_mcast_stop_thread(dev, 1);
+        ipoib_mcast_dev_flush(dev);
-        /* Delete the broadcast address and the local address */
-        ipoib_mcast_dev_down(dev);
        ipoib_transport_dev_cleanup(dev);
 }
@@ -662,12 +651,12 @@ void ipoib_pkey_poll(void *dev_ptr)
        if (test_bit(IPOIB_PKEY_ASSIGNED, &priv->flags))
                ipoib_open(dev);
        else {
-                down(&pkey_sem);
+                mutex_lock(&pkey_mutex);
                if (!test_bit(IPOIB_PKEY_STOP, &priv->flags))
                        queue_delayed_work(ipoib_workqueue,
                                           &priv->pkey_task,
                                           HZ);
-                up(&pkey_sem);
+                mutex_unlock(&pkey_mutex);
        }
 }
@@ -681,12 +670,12 @@ int ipoib_pkey_dev_delay_open(struct net_device *dev)
        /* P_Key value not assigned yet - start polling */
        if (!test_bit(IPOIB_PKEY_ASSIGNED, &priv->flags)) {
-                down(&pkey_sem);
+                mutex_lock(&pkey_mutex);
                clear_bit(IPOIB_PKEY_STOP, &priv->flags);
                queue_delayed_work(ipoib_workqueue,
                                   &priv->pkey_task,
                                   HZ);
-                up(&pkey_sem);
+                mutex_unlock(&pkey_mutex);
                return 1;
        }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 780009c7eaa6..fd3f5c862a5d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -105,7 +105,7 @@ int ipoib_open(struct net_device *dev)
                struct ipoib_dev_priv *cpriv;
                /* Bring up any child interfaces too */
-                down(&priv->vlan_mutex);
+                mutex_lock(&priv->vlan_mutex);
                list_for_each_entry(cpriv, &priv->child_intfs, list) {
                        int flags;
@@ -115,7 +115,7 @@ int ipoib_open(struct net_device *dev)
                        dev_change_flags(cpriv->dev, flags | IFF_UP);
                }
-                up(&priv->vlan_mutex);
+                mutex_unlock(&priv->vlan_mutex);
        }
        netif_start_queue(dev);
@@ -140,7 +140,7 @@ static int ipoib_stop(struct net_device *dev)
                struct ipoib_dev_priv *cpriv;
                /* Bring down any child interfaces too */
-                down(&priv->vlan_mutex);
+                mutex_lock(&priv->vlan_mutex);
                list_for_each_entry(cpriv, &priv->child_intfs, list) {
                        int flags;
@@ -150,7 +150,7 @@ static int ipoib_stop(struct net_device *dev)
                        dev_change_flags(cpriv->dev, flags & ~IFF_UP);
                }
-                up(&priv->vlan_mutex);
+                mutex_unlock(&priv->vlan_mutex);
        }
        return 0;
@@ -892,8 +892,8 @@ static void ipoib_setup(struct net_device *dev)
        spin_lock_init(&priv->lock);
        spin_lock_init(&priv->tx_lock);
-        init_MUTEX(&priv->mcast_mutex);
+        mutex_init(&priv->mcast_mutex);
-        init_MUTEX(&priv->vlan_mutex);
+        mutex_init(&priv->vlan_mutex);
        INIT_LIST_HEAD(&priv->path_list);
        INIT_LIST_HEAD(&priv->child_intfs);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index ed0c2ead8bc1..98039da0caf0 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -55,7 +55,7 @@ MODULE_PARM_DESC(mcast_debug_level,
                 "Enable multicast debug tracing if > 0");
 #endif
-static DECLARE_MUTEX(mcast_mutex);
+static DEFINE_MUTEX(mcast_mutex);
 /* Used for all multicast joins (broadcast, IPv4 mcast and IPv6 mcast) */
 struct ipoib_mcast {
@@ -97,8 +97,6 @@ static void ipoib_mcast_free(struct ipoib_mcast *mcast)
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        struct ipoib_neigh *neigh, *tmp;
        unsigned long flags;
-        LIST_HEAD(ah_list);
-        struct ipoib_ah *ah, *tah;
        ipoib_dbg_mcast(netdev_priv(dev),
                        "deleting multicast group " IPOIB_GID_FMT "\n",
@@ -107,8 +105,14 @@ static void ipoib_mcast_free(struct ipoib_mcast *mcast)
        spin_lock_irqsave(&priv->lock, flags);
        list_for_each_entry_safe(neigh, tmp, &mcast->neigh_list, list) {
+                /*
+                 * It's safe to call ipoib_put_ah() inside priv->lock
+                 * here, because we know that mcast->ah will always
+                 * hold one more reference, so ipoib_put_ah() will
+                 * never do more than decrement the ref count.
+                 */
                if (neigh->ah)
-                        list_add_tail(&neigh->ah->list, &ah_list);
+                        ipoib_put_ah(neigh->ah);
                *to_ipoib_neigh(neigh->neighbour) = NULL;
                neigh->neighbour->ops->destructor = NULL;
                kfree(neigh);
@@ -116,9 +120,6 @@ static void ipoib_mcast_free(struct ipoib_mcast *mcast)
        spin_unlock_irqrestore(&priv->lock, flags);
-        list_for_each_entry_safe(ah, tah, &ah_list, list)
-                ipoib_put_ah(ah);
        if (mcast->ah)
                ipoib_put_ah(mcast->ah);
@@ -384,10 +385,10 @@ static void ipoib_mcast_join_complete(int status,
        if (!status && !ipoib_mcast_join_finish(mcast, mcmember)) {
                mcast->backoff = 1;
-                down(&mcast_mutex);
+                mutex_lock(&mcast_mutex);
                if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
                        queue_work(ipoib_workqueue, &priv->mcast_task);
-                up(&mcast_mutex);
+                mutex_unlock(&mcast_mutex);
                complete(&mcast->done);
                return;
        }
@@ -417,7 +418,7 @@ static void ipoib_mcast_join_complete(int status,
        mcast->query = NULL;
-        down(&mcast_mutex);
+        mutex_lock(&mcast_mutex);
        if (test_bit(IPOIB_MCAST_RUN, &priv->flags)) {
                if (status == -ETIMEDOUT)
                        queue_work(ipoib_workqueue, &priv->mcast_task);
@@ -426,7 +427,7 @@ static void ipoib_mcast_join_complete(int status,
                                           mcast->backoff * HZ);
        } else
                complete(&mcast->done);
-        up(&mcast_mutex);
+        mutex_unlock(&mcast_mutex);
        return;
 }
@@ -481,12 +482,12 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast,
                if (mcast->backoff > IPOIB_MAX_BACKOFF_SECONDS)
                        mcast->backoff = IPOIB_MAX_BACKOFF_SECONDS;
-                down(&mcast_mutex);
+                mutex_lock(&mcast_mutex);
                if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
                        queue_delayed_work(ipoib_workqueue,
                                           &priv->mcast_task,
                                           mcast->backoff * HZ);
-                up(&mcast_mutex);
+                mutex_unlock(&mcast_mutex);
        } else
                mcast->query_id = ret;
 }
@@ -519,11 +520,11 @@ void ipoib_mcast_join_task(void *dev_ptr)
                priv->broadcast = ipoib_mcast_alloc(dev, 1);
                if (!priv->broadcast) {
                        ipoib_warn(priv, "failed to allocate broadcast group\n");
-                        down(&mcast_mutex);
+                        mutex_lock(&mcast_mutex);
                        if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
                                queue_delayed_work(ipoib_workqueue,
                                                   &priv->mcast_task, HZ);
-                        up(&mcast_mutex);
+                        mutex_unlock(&mcast_mutex);
                        return;
                }
@@ -579,10 +580,10 @@ int ipoib_mcast_start_thread(struct net_device *dev)
        ipoib_dbg_mcast(priv, "starting multicast thread\n");
-        down(&mcast_mutex);
+        mutex_lock(&mcast_mutex);
        if (!test_and_set_bit(IPOIB_MCAST_RUN, &priv->flags))
                queue_work(ipoib_workqueue, &priv->mcast_task);
-        up(&mcast_mutex);
+        mutex_unlock(&mcast_mutex);
        return 0;
 }
@@ -594,10 +595,10 @@ int ipoib_mcast_stop_thread(struct net_device *dev, int flush)
        ipoib_dbg_mcast(priv, "stopping multicast thread\n");
-        down(&mcast_mutex);
+        mutex_lock(&mcast_mutex);
        clear_bit(IPOIB_MCAST_RUN, &priv->flags);
        cancel_delayed_work(&priv->mcast_task);
-        up(&mcast_mutex);
+        mutex_unlock(&mcast_mutex);
        if (flush)
                flush_workqueue(ipoib_workqueue);
@@ -741,48 +742,23 @@ void ipoib_mcast_dev_flush(struct net_device *dev)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        LIST_HEAD(remove_list);
-        struct ipoib_mcast *mcast, *tmcast, *nmcast;
+        struct ipoib_mcast *mcast, *tmcast;
        unsigned long flags;
        ipoib_dbg_mcast(priv, "flushing multicast list\n");
        spin_lock_irqsave(&priv->lock, flags);
-        list_for_each_entry_safe(mcast, tmcast, &priv->multicast_list, list) {
-                nmcast = ipoib_mcast_alloc(dev, 0);
-                if (nmcast) {
-                        nmcast->flags =
-                                mcast->flags & (1 << IPOIB_MCAST_FLAG_SENDONLY);
-                        nmcast->mcmember.mgid = mcast->mcmember.mgid;
+        list_for_each_entry_safe(mcast, tmcast, &priv->multicast_list, list) {
+                list_del(&mcast->list);
-                        /* Add the new group in before the to-be-destroyed group */
+                rb_erase(&mcast->rb_node, &priv->multicast_tree);
-                        list_add_tail(&nmcast->list, &mcast->list);
+                list_add_tail(&mcast->list, &remove_list);
-                        list_del_init(&mcast->list);
-                        rb_replace_node(&mcast->rb_node, &nmcast->rb_node,
-                                        &priv->multicast_tree);
-                        list_add_tail(&mcast->list, &remove_list);
-                } else {
-                        ipoib_warn(priv, "could not reallocate multicast group "
-                                   IPOIB_GID_FMT "\n",
-                                   IPOIB_GID_ARG(mcast->mcmember.mgid));
-                }
        }
        if (priv->broadcast) {
-                nmcast = ipoib_mcast_alloc(dev, 0);
+                rb_erase(&priv->broadcast->rb_node, &priv->multicast_tree);
-                if (nmcast) {
+                list_add_tail(&priv->broadcast->list, &remove_list);
-                        nmcast->mcmember.mgid = priv->broadcast->mcmember.mgid;
+                priv->broadcast = NULL;
-                        rb_replace_node(&priv->broadcast->rb_node,
-                                        &nmcast->rb_node,
-                                        &priv->multicast_tree);
-                        list_add_tail(&priv->broadcast->list, &remove_list);
-                }
-                priv->broadcast = nmcast;
        }
        spin_unlock_irqrestore(&priv->lock, flags);
@@ -793,24 +769,6 @@ void ipoib_mcast_dev_flush(struct net_device *dev)
        }
 }
-void ipoib_mcast_dev_down(struct net_device *dev)
-{
-        struct ipoib_dev_priv *priv = netdev_priv(dev);
-        unsigned long flags;
-        /* Delete broadcast since it will be recreated */
-        if (priv->broadcast) {
-                ipoib_dbg_mcast(priv, "deleting broadcast group\n");
-                spin_lock_irqsave(&priv->lock, flags);
-                rb_erase(&priv->broadcast->rb_node, &priv->multicast_tree);
-                spin_unlock_irqrestore(&priv->lock, flags);
-                ipoib_mcast_leave(dev, priv->broadcast);
-                ipoib_mcast_free(priv->broadcast);
-                priv->broadcast = NULL;
-        }
-}
 void ipoib_mcast_restart_task(void *dev_ptr)
 {
        struct net_device *dev = dev_ptr;
@@ -824,7 +782,8 @@ void ipoib_mcast_restart_task(void *dev_ptr)
        ipoib_mcast_stop_thread(dev, 0);
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&dev->xmit_lock, flags);
+        spin_lock(&priv->lock);
        /*
         * Unfortunately, the networking core only gives us a list of all of
@@ -896,7 +855,9 @@ void ipoib_mcast_restart_task(void *dev_ptr)
                        list_add_tail(&mcast->list, &remove_list);
                }
        }
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock(&priv->lock);
+        spin_unlock_irqrestore(&dev->xmit_lock, flags);
        /* We have to cancel outside of the spinlock */
        list_for_each_entry_safe(mcast, tmcast, &remove_list, list) {
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
index e829e10400e3..faaf10e5fc7b 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
@@ -65,9 +65,9 @@ int ipoib_mcast_attach(struct net_device *dev, u16 mlid, union ib_gid *mgid)
        }
        /* attach QP to multicast group */
-        down(&priv->mcast_mutex);
+        mutex_lock(&priv->mcast_mutex);
        ret = ib_attach_mcast(priv->qp, mgid, mlid);
-        up(&priv->mcast_mutex);
+        mutex_unlock(&priv->mcast_mutex);
        if (ret)
                ipoib_warn(priv, "failed to attach to multicast group, ret = %d\n", ret);
@@ -81,9 +81,9 @@ int ipoib_mcast_detach(struct net_device *dev, u16 mlid, union ib_gid *mgid)
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        int ret;
-        down(&priv->mcast_mutex);
+        mutex_lock(&priv->mcast_mutex);
        ret = ib_detach_mcast(priv->qp, mgid, mlid);
-        up(&priv->mcast_mutex);
+        mutex_unlock(&priv->mcast_mutex);
        if (ret)
                ipoib_warn(priv, "ib_detach_mcast failed (result = %d)\n", ret);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index d280b341a37f..4ca175553f9f 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -63,7 +63,7 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
        ppriv = netdev_priv(pdev);
-        down(&ppriv->vlan_mutex);
+        mutex_lock(&ppriv->vlan_mutex);
        /*
         * First ensure this isn't a duplicate. We check the parent device and
@@ -124,7 +124,7 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
        list_add_tail(&priv->list, &ppriv->child_intfs);
-        up(&ppriv->vlan_mutex);
+        mutex_unlock(&ppriv->vlan_mutex);
        return 0;
@@ -139,7 +139,7 @@ device_init_failed:
        free_netdev(priv->dev);
 err:
-        up(&ppriv->vlan_mutex);
+        mutex_unlock(&ppriv->vlan_mutex);
        return result;
 }
@@ -153,7 +153,7 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
        ppriv = netdev_priv(pdev);
-        down(&ppriv->vlan_mutex);
+        mutex_lock(&ppriv->vlan_mutex);
        list_for_each_entry_safe(priv, tpriv, &ppriv->child_intfs, list) {
                if (priv->pkey == pkey) {
                        unregister_netdev(priv->dev);
@@ -167,7 +167,7 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
                        break;
                }
        }
-        up(&ppriv->vlan_mutex);
+        mutex_unlock(&ppriv->vlan_mutex);
        return ret;
 }
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index dd488d3cffa9..31207e664148 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1516,8 +1516,7 @@ static ssize_t show_port(struct class_device *class_dev, char *buf)
 static CLASS_DEVICE_ATTR(port, S_IRUGO, show_port, NULL);
-static struct srp_host *srp_add_port(struct ib_device *device,
+static struct srp_host *srp_add_port(struct ib_device *device, u8 port)
-                                     __be64 node_guid, u8 port)
 {
        struct srp_host *host;
@@ -1532,7 +1531,7 @@ static struct srp_host *srp_add_port(struct ib_device *device,
        host->port = port;
        host->initiator_port_id[7] = port;
-        memcpy(host->initiator_port_id + 8, &node_guid, 8);
+        memcpy(host->initiator_port_id + 8, &device->node_guid, 8);
        host->pd   = ib_alloc_pd(device);
        if (IS_ERR(host->pd))
@@ -1580,22 +1579,11 @@ static void srp_add_one(struct ib_device *device)
 {
        struct list_head *dev_list;
        struct srp_host *host;
-        struct ib_device_attr *dev_attr;
        int s, e, p;
-        dev_attr = kmalloc(sizeof *dev_attr, GFP_KERNEL);
-        if (!dev_attr)
-                return;
-        if (ib_query_device(device, dev_attr)) {
-                printk(KERN_WARNING PFX "Couldn't query node GUID for %s.\n",
-                       device->name);
-                goto out;
-        }
        dev_list = kmalloc(sizeof *dev_list, GFP_KERNEL);
        if (!dev_list)
-                goto out;
+                return;
        INIT_LIST_HEAD(dev_list);
@@ -1608,15 +1596,12 @@ static void srp_add_one(struct ib_device *device)
        }
        for (p = s; p <= e; ++p) {
-                host = srp_add_port(device, dev_attr->node_guid, p);
+                host = srp_add_port(device, p);
                if (host)
                        list_add_tail(&host->list, dev_list);
        }
        ib_set_client_data(device, &srp_client, dev_list);
-out:
-        kfree(dev_attr);
 }
 static void srp_remove_one(struct ib_device *device)
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 362b33556b1a..745979f33dc2 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -159,7 +159,7 @@ struct input_event_compat {
 #ifdef CONFIG_X86_64
 #  define COMPAT_TEST is_compat_task()
 #elif defined(CONFIG_IA64)
-#  define COMPAT_TEST IS_IA32_PROCESS(ia64_task_regs(current))
+#  define COMPAT_TEST IS_IA32_PROCESS(task_pt_regs(current))
 #elif defined(CONFIG_S390)
 #  define COMPAT_TEST test_thread_flag(TIF_31BIT)
 #elif defined(CONFIG_MIPS)
diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
index caac6d63d46f..b765a155c008 100644
--- a/drivers/input/gameport/gameport.c
+++ b/drivers/input/gameport/gameport.c
@@ -50,9 +50,7 @@ static DECLARE_MUTEX(gameport_sem);
 static LIST_HEAD(gameport_list);
-static struct bus_type gameport_bus = {
+static struct bus_type gameport_bus;
-        .name = "gameport",
-};
 static void gameport_add_port(struct gameport *gameport);
 static void gameport_destroy_port(struct gameport *gameport);
@@ -703,11 +701,15 @@ static int gameport_driver_remove(struct device *dev)
        return 0;
 }
+static struct bus_type gameport_bus = {
+        .name = "gameport",
+        .probe = gameport_driver_probe,
+        .remove = gameport_driver_remove,
+};
 void __gameport_register_driver(struct gameport_driver *drv, struct module *owner)
 {
        drv->driver.bus = &gameport_bus;
-        drv->driver.probe = gameport_driver_probe;
-        drv->driver.remove = gameport_driver_remove;
        gameport_queue_event(drv, owner, GAMEPORT_REGISTER_DRIVER);
 }
diff --git a/drivers/input/input.c b/drivers/input/input.c
index fe33ff334e27..4fe3da3c667a 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -528,40 +528,56 @@ INPUT_DEV_STRING_ATTR_SHOW(name);
 INPUT_DEV_STRING_ATTR_SHOW(phys);
 INPUT_DEV_STRING_ATTR_SHOW(uniq);
-static int print_modalias_bits(char *buf, char prefix, unsigned long *arr,
+static int print_modalias_bits(char *buf, int size, char prefix, unsigned long *arr,
                               unsigned int min, unsigned int max)
 {
        int len, i;
-        len = sprintf(buf, "%c", prefix);
+        len = snprintf(buf, size, "%c", prefix);
        for (i = min; i < max; i++)
                if (arr[LONG(i)] & BIT(i))
-                        len += sprintf(buf+len, "%X,", i);
+                        len += snprintf(buf + len, size - len, "%X,", i);
        return len;
 }
-static ssize_t input_dev_show_modalias(struct class_device *dev, char *buf)
+static int print_modalias(char *buf, int size, struct input_dev *id)
 {
-        struct input_dev *id = to_input_dev(dev);
+        int len;
-        ssize_t len = 0;
-        len += sprintf(buf+len, "input:b%04Xv%04Xp%04Xe%04X-",
+        len = snprintf(buf, size, "input:b%04Xv%04Xp%04Xe%04X-",
                       id->id.bustype,
                       id->id.vendor,
                       id->id.product,
                       id->id.version);
-        len += print_modalias_bits(buf+len, 'e', id->evbit, 0, EV_MAX);
+        len += print_modalias_bits(buf + len, size - len, 'e', id->evbit,
-        len += print_modalias_bits(buf+len, 'k', id->keybit,
+                                   0, EV_MAX);
+        len += print_modalias_bits(buf + len, size - len, 'k', id->keybit,
                                   KEY_MIN_INTERESTING, KEY_MAX);
-        len += print_modalias_bits(buf+len, 'r', id->relbit, 0, REL_MAX);
+        len += print_modalias_bits(buf + len, size - len, 'r', id->relbit,
-        len += print_modalias_bits(buf+len, 'a', id->absbit, 0, ABS_MAX);
+                                   0, REL_MAX);
-        len += print_modalias_bits(buf+len, 'm', id->mscbit, 0, MSC_MAX);
+        len += print_modalias_bits(buf + len, size - len, 'a', id->absbit,
-        len += print_modalias_bits(buf+len, 'l', id->ledbit, 0, LED_MAX);
+                                   0, ABS_MAX);
-        len += print_modalias_bits(buf+len, 's', id->sndbit, 0, SND_MAX);
+        len += print_modalias_bits(buf + len, size - len, 'm', id->mscbit,
-        len += print_modalias_bits(buf+len, 'f', id->ffbit, 0, FF_MAX);
+                                   0, MSC_MAX);
-        len += print_modalias_bits(buf+len, 'w', id->swbit, 0, SW_MAX);
+        len += print_modalias_bits(buf + len, size - len, 'l', id->ledbit,
-        len += sprintf(buf+len, "\n");
+                                   0, LED_MAX);
+        len += print_modalias_bits(buf + len, size - len, 's', id->sndbit,
+                                   0, SND_MAX);
+        len += print_modalias_bits(buf + len, size - len, 'f', id->ffbit,
+                                   0, FF_MAX);
+        len += print_modalias_bits(buf + len, size - len, 'w', id->swbit,
+                                   0, SW_MAX);
+        return len;
+}
+static ssize_t input_dev_show_modalias(struct class_device *dev, char *buf)
+{
+        struct input_dev *id = to_input_dev(dev);
+        ssize_t len;
+        len = print_modalias(buf, PAGE_SIZE, id);
+        len += snprintf(buf + len, PAGE_SIZE-len, "\n");
        return len;
 }
 static CLASS_DEVICE_ATTR(modalias, S_IRUGO, input_dev_show_modalias, NULL);
@@ -728,8 +744,11 @@ static int input_dev_uevent(struct class_device *cdev, char **envp,
        if (test_bit(EV_SW, dev->evbit))
                INPUT_ADD_HOTPLUG_BM_VAR("SW=", dev->swbit, SW_MAX);
-        envp[i] = NULL;
+        envp[i++] = buffer + len;
+        len += snprintf(buffer + len, buffer_size - len, "MODALIAS=");
+        len += print_modalias(buffer + len, buffer_size - len, dev) + 1;
+        envp[i] = NULL;
        return 0;
 }
diff --git a/drivers/input/joystick/amijoy.c b/drivers/input/joystick/amijoy.c
index 8558a99f6635..ec55a29fc861 100644
--- a/drivers/input/joystick/amijoy.c
+++ b/drivers/input/joystick/amijoy.c
@@ -64,8 +64,8 @@ static irqreturn_t amijoy_interrupt(int irq, void *dummy, struct pt_regs *fp)
                if (amijoy[i]) {
                        switch (i) {
-                                case 0: data = ~custom.joy0dat; button = (~ciaa.pra >> 6) & 1; break;
+                                case 0: data = ~amiga_custom.joy0dat; button = (~ciaa.pra >> 6) & 1; break;
-                                case 1: data = ~custom.joy1dat; button = (~ciaa.pra >> 7) & 1; break;
+                                case 1: data = ~amiga_custom.joy1dat; button = (~ciaa.pra >> 7) & 1; break;
                        }
                        input_regs(amijoy_dev[i], fp);
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 24474335dfd1..2141501e9f2e 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -348,6 +348,40 @@ static int alps_tap_mode(struct psmouse *psmouse, int enable)
        return 0;
 }
+/*
+ * alps_poll() - poll the touchpad for current motion packet.
+ * Used in resync.
+ */
+static int alps_poll(struct psmouse *psmouse)
+{
+        struct alps_data *priv = psmouse->private;
+        unsigned char buf[6];
+        int poll_failed;
+        if (priv->i->flags & ALPS_PASS)
+                alps_passthrough_mode(psmouse, 1);
+        poll_failed = ps2_command(&psmouse->ps2dev, buf,
+                                  PSMOUSE_CMD_POLL | (psmouse->pktsize << 8)) < 0;
+        if (priv->i->flags & ALPS_PASS)
+                alps_passthrough_mode(psmouse, 0);
+        if (poll_failed || (buf[0] & priv->i->mask0) != priv->i->byte0)
+                return -1;
+        if ((psmouse->badbyte & 0xc8) == 0x08) {
+/*
+ * Poll the track stick ...
+ */
+                if (ps2_command(&psmouse->ps2dev, buf, PSMOUSE_CMD_POLL | (3 << 8)))
+                        return -1;
+        }
+        memcpy(psmouse->packet, buf, sizeof(buf));
+        return 0;
+}
 static int alps_reconnect(struct psmouse *psmouse)
 {
        struct alps_data *priv = psmouse->private;
@@ -451,10 +485,14 @@ int alps_init(struct psmouse *psmouse)
        input_register_device(priv->dev2);
        psmouse->protocol_handler = alps_process_byte;
+        psmouse->poll = alps_poll;
        psmouse->disconnect = alps_disconnect;
        psmouse->reconnect = alps_reconnect;
        psmouse->pktsize = 6;
+        /* We are having trouble resyncing ALPS touchpads so disable it for now */
+        psmouse->resync_time = 0;
        return 0;
 init_fail:
diff --git a/drivers/input/mouse/amimouse.c b/drivers/input/mouse/amimouse.c
index d13d4c8fe3c5..c8b2cc9f184c 100644
--- a/drivers/input/mouse/amimouse.c
+++ b/drivers/input/mouse/amimouse.c
@@ -41,7 +41,7 @@ static irqreturn_t amimouse_interrupt(int irq, void *dummy, struct pt_regs *fp)
        unsigned short joy0dat, potgor;
        int nx, ny, dx, dy;
-        joy0dat = custom.joy0dat;
+        joy0dat = amiga_custom.joy0dat;
        nx = joy0dat & 0xff;
        ny = joy0dat >> 8;
@@ -57,7 +57,7 @@ static irqreturn_t amimouse_interrupt(int irq, void *dummy, struct pt_regs *fp)
        amimouse_lastx = nx;
        amimouse_lasty = ny;
-        potgor = custom.potgor;
+        potgor = amiga_custom.potgor;
        input_regs(amimouse_dev, fp);
@@ -77,7 +77,7 @@ static int amimouse_open(struct input_dev *dev)
 {
        unsigned short joy0dat;
-        joy0dat = custom.joy0dat;
+        joy0dat = amiga_custom.joy0dat;
        amimouse_lastx = joy0dat & 0xff;
        amimouse_lasty = joy0dat >> 8;
diff --git a/drivers/input/mouse/logips2pp.c b/drivers/input/mouse/logips2pp.c
index 025a71de5404..c88520d3d13c 100644
--- a/drivers/input/mouse/logips2pp.c
+++ b/drivers/input/mouse/logips2pp.c
@@ -117,7 +117,7 @@ static int ps2pp_cmd(struct psmouse *psmouse, unsigned char *param, unsigned cha
        if (psmouse_sliced_command(psmouse, command))
                return -1;
-        if (ps2_command(&psmouse->ps2dev, param, PSMOUSE_CMD_POLL))
+        if (ps2_command(&psmouse->ps2dev, param, PSMOUSE_CMD_POLL | 0x0300))
                return -1;
        return 0;
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 4d5ecc04c5b6..7665fd9ce559 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -54,10 +54,14 @@ static unsigned int psmouse_smartscroll = 1;
 module_param_named(smartscroll, psmouse_smartscroll, bool, 0644);
 MODULE_PARM_DESC(smartscroll, "Logitech Smartscroll autorepeat, 1 = enabled (default), 0 = disabled.");
-static unsigned int psmouse_resetafter;
+static unsigned int psmouse_resetafter = 5;
 module_param_named(resetafter, psmouse_resetafter, uint, 0644);
 MODULE_PARM_DESC(resetafter, "Reset device after so many bad packets (0 = never).");
+static unsigned int psmouse_resync_time = 5;
+module_param_named(resync_time, psmouse_resync_time, uint, 0644);
+MODULE_PARM_DESC(resync_time, "How long can mouse stay idle before forcing resync (in seconds, 0 = never).");
 PSMOUSE_DEFINE_ATTR(protocol, S_IWUSR | S_IRUGO,
                        NULL,
                        psmouse_attr_show_protocol, psmouse_attr_set_protocol);
@@ -70,12 +74,16 @@ PSMOUSE_DEFINE_ATTR(resolution, S_IWUSR | S_IRUGO,
 PSMOUSE_DEFINE_ATTR(resetafter, S_IWUSR | S_IRUGO,
                        (void *) offsetof(struct psmouse, resetafter),
                        psmouse_show_int_attr, psmouse_set_int_attr);
+PSMOUSE_DEFINE_ATTR(resync_time, S_IWUSR | S_IRUGO,
+                        (void *) offsetof(struct psmouse, resync_time),
+                        psmouse_show_int_attr, psmouse_set_int_attr);
 static struct attribute *psmouse_attributes[] = {
        &psmouse_attr_protocol.dattr.attr,
        &psmouse_attr_rate.dattr.attr,
        &psmouse_attr_resolution.dattr.attr,
        &psmouse_attr_resetafter.dattr.attr,
+        &psmouse_attr_resync_time.dattr.attr,
        NULL
 };
@@ -98,6 +106,8 @@ __obsolete_setup("psmouse_rate=");
 */
 static DECLARE_MUTEX(psmouse_sem);
+static struct workqueue_struct *kpsmoused_wq;
 struct psmouse_protocol {
        enum psmouse_type type;
        char *name;
@@ -178,15 +188,79 @@ static psmouse_ret_t psmouse_process_byte(struct psmouse *psmouse, struct pt_reg
 }
 /*
- * psmouse_interrupt() handles incoming characters, either gathering them into
+ * __psmouse_set_state() sets new psmouse state and resets all flags.
- * packets or passing them to the command routine as command output.
+ */
+static inline void __psmouse_set_state(struct psmouse *psmouse, enum psmouse_state new_state)
+{
+        psmouse->state = new_state;
+        psmouse->pktcnt = psmouse->out_of_sync = 0;
+        psmouse->ps2dev.flags = 0;
+        psmouse->last = jiffies;
+}
+/*
+ * psmouse_set_state() sets new psmouse state and resets all flags and
+ * counters while holding serio lock so fighting with interrupt handler
+ * is not a concern.
+ */
+static void psmouse_set_state(struct psmouse *psmouse, enum psmouse_state new_state)
+{
+        serio_pause_rx(psmouse->ps2dev.serio);
+        __psmouse_set_state(psmouse, new_state);
+        serio_continue_rx(psmouse->ps2dev.serio);
+}
+/*
+ * psmouse_handle_byte() processes one byte of the input data stream
+ * by calling corresponding protocol handler.
+ */
+static int psmouse_handle_byte(struct psmouse *psmouse, struct pt_regs *regs)
+{
+        psmouse_ret_t rc = psmouse->protocol_handler(psmouse, regs);
+        switch (rc) {
+                case PSMOUSE_BAD_DATA:
+                        if (psmouse->state == PSMOUSE_ACTIVATED) {
+                                printk(KERN_WARNING "psmouse.c: %s at %s lost sync at byte %d\n",
+                                        psmouse->name, psmouse->phys, psmouse->pktcnt);
+                                if (++psmouse->out_of_sync == psmouse->resetafter) {
+                                        __psmouse_set_state(psmouse, PSMOUSE_IGNORE);
+                                        printk(KERN_NOTICE "psmouse.c: issuing reconnect request\n");
+                                        serio_reconnect(psmouse->ps2dev.serio);
+                                        return -1;
+                                }
+                        }
+                        psmouse->pktcnt = 0;
+                        break;
+                case PSMOUSE_FULL_PACKET:
+                        psmouse->pktcnt = 0;
+                        if (psmouse->out_of_sync) {
+                                psmouse->out_of_sync = 0;
+                                printk(KERN_NOTICE "psmouse.c: %s at %s - driver resynched.\n",
+                                        psmouse->name, psmouse->phys);
+                        }
+                        break;
+                case PSMOUSE_GOOD_DATA:
+                        break;
+        }
+        return 0;
+}
+/*
+ * psmouse_interrupt() handles incoming characters, either passing them
+ * for normal processing or gathering them as command response.
 */
 static irqreturn_t psmouse_interrupt(struct serio *serio,
                unsigned char data, unsigned int flags, struct pt_regs *regs)
 {
        struct psmouse *psmouse = serio_get_drvdata(serio);
-        psmouse_ret_t rc;
        if (psmouse->state == PSMOUSE_IGNORE)
                goto out;
@@ -208,67 +282,58 @@ static irqreturn_t psmouse_interrupt(struct serio *serio,
                if  (ps2_handle_response(&psmouse->ps2dev, data))
                        goto out;
-        if (psmouse->state == PSMOUSE_INITIALIZING)
+        if (psmouse->state <= PSMOUSE_RESYNCING)
                goto out;
        if (psmouse->state == PSMOUSE_ACTIVATED &&
            psmouse->pktcnt && time_after(jiffies, psmouse->last + HZ/2)) {
-                printk(KERN_WARNING "psmouse.c: %s at %s lost synchronization, throwing %d bytes away.\n",
+                printk(KERN_INFO "psmouse.c: %s at %s lost synchronization, throwing %d bytes away.\n",
                       psmouse->name, psmouse->phys, psmouse->pktcnt);
-                psmouse->pktcnt = 0;
+                psmouse->badbyte = psmouse->packet[0];
+                __psmouse_set_state(psmouse, PSMOUSE_RESYNCING);
+                queue_work(kpsmoused_wq, &psmouse->resync_work);
+                goto out;
        }
-        psmouse->last = jiffies;
        psmouse->packet[psmouse->pktcnt++] = data;
+/*
-        if (psmouse->packet[0] == PSMOUSE_RET_BAT) {
+ * Check if this is a new device announcement (0xAA 0x00)
+ */
+        if (unlikely(psmouse->packet[0] == PSMOUSE_RET_BAT && psmouse->pktcnt <= 2)) {
                if (psmouse->pktcnt == 1)
                        goto out;
-                if (psmouse->pktcnt == 2) {
+                if (psmouse->packet[1] == PSMOUSE_RET_ID) {
-                        if (psmouse->packet[1] == PSMOUSE_RET_ID) {
+                        __psmouse_set_state(psmouse, PSMOUSE_IGNORE);
-                                psmouse->state = PSMOUSE_IGNORE;
+                        serio_reconnect(serio);
-                                serio_reconnect(serio);
+                        goto out;
-                                goto out;
-                        }
-                        if (psmouse->type == PSMOUSE_SYNAPTICS) {
-                                /* neither 0xAA nor 0x00 are valid first bytes
-                                 * for a packet in absolute mode
-                                 */
-                                psmouse->pktcnt = 0;
-                                goto out;
-                        }
                }
-        }
+/*
+ * Not a new device, try processing first byte normally
-        rc = psmouse->protocol_handler(psmouse, regs);
+ */
+                psmouse->pktcnt = 1;
+                if (psmouse_handle_byte(psmouse, regs))
+                        goto out;
-        switch (rc) {
+                psmouse->packet[psmouse->pktcnt++] = data;
-                case PSMOUSE_BAD_DATA:
+        }
-                        printk(KERN_WARNING "psmouse.c: %s at %s lost sync at byte %d\n",
-                                psmouse->name, psmouse->phys, psmouse->pktcnt);
-                        psmouse->pktcnt = 0;
-                        if (++psmouse->out_of_sync == psmouse->resetafter) {
+/*
-                                psmouse->state = PSMOUSE_IGNORE;
+ * See if we need to force resync because mouse was idle for too long
-                                printk(KERN_NOTICE "psmouse.c: issuing reconnect request\n");
+ */
-                                serio_reconnect(psmouse->ps2dev.serio);
+        if (psmouse->state == PSMOUSE_ACTIVATED &&
-                        }
+            psmouse->pktcnt == 1 && psmouse->resync_time &&
-                        break;
+            time_after(jiffies, psmouse->last + psmouse->resync_time * HZ)) {
+                psmouse->badbyte = psmouse->packet[0];
+                __psmouse_set_state(psmouse, PSMOUSE_RESYNCING);
+                queue_work(kpsmoused_wq, &psmouse->resync_work);
+                goto out;
+        }
-                case PSMOUSE_FULL_PACKET:
+        psmouse->last = jiffies;
-                        psmouse->pktcnt = 0;
+        psmouse_handle_byte(psmouse, regs);
-                        if (psmouse->out_of_sync) {
-                                psmouse->out_of_sync = 0;
-                                printk(KERN_NOTICE "psmouse.c: %s at %s - driver resynched.\n",
-                                        psmouse->name, psmouse->phys);
-                        }
-                        break;
-                case PSMOUSE_GOOD_DATA:
+ out:
-                        break;
-        }
-out:
        return IRQ_HANDLED;
 }
@@ -752,21 +817,6 @@ static void psmouse_initialize(struct psmouse *psmouse)
 }
 /*
- * psmouse_set_state() sets new psmouse state and resets all flags and
- * counters while holding serio lock so fighting with interrupt handler
- * is not a concern.
- */
-static void psmouse_set_state(struct psmouse *psmouse, enum psmouse_state new_state)
-{
-        serio_pause_rx(psmouse->ps2dev.serio);
-        psmouse->state = new_state;
-        psmouse->pktcnt = psmouse->out_of_sync = 0;
-        psmouse->ps2dev.flags = 0;
-        serio_continue_rx(psmouse->ps2dev.serio);
-}
-/*
 * psmouse_activate() enables the mouse so that we get motion reports from it.
 */
@@ -794,6 +844,111 @@ static void psmouse_deactivate(struct psmouse *psmouse)
        psmouse_set_state(psmouse, PSMOUSE_CMD_MODE);
 }
+/*
+ * psmouse_poll() - default poll hanlder. Everyone except for ALPS uses it.
+ */
+static int psmouse_poll(struct psmouse *psmouse)
+{
+        return ps2_command(&psmouse->ps2dev, psmouse->packet,
+                           PSMOUSE_CMD_POLL | (psmouse->pktsize << 8));
+}
+/*
+ * psmouse_resync() attempts to re-validate current protocol.
+ */
+static void psmouse_resync(void *p)
+{
+        struct psmouse *psmouse = p, *parent = NULL;
+        struct serio *serio = psmouse->ps2dev.serio;
+        psmouse_ret_t rc = PSMOUSE_GOOD_DATA;
+        int failed = 0, enabled = 0;
+        int i;
+        down(&psmouse_sem);
+        if (psmouse->state != PSMOUSE_RESYNCING)
+                goto out;
+        if (serio->parent && serio->id.type == SERIO_PS_PSTHRU) {
+                parent = serio_get_drvdata(serio->parent);
+                psmouse_deactivate(parent);
+        }
+/*
+ * Some mice don't ACK commands sent while they are in the middle of
+ * transmitting motion packet. To avoid delay we use ps2_sendbyte()
+ * instead of ps2_command() which would wait for 200ms for an ACK
+ * that may never come.
+ * As an additional quirk ALPS touchpads may not only forget to ACK
+ * disable command but will stop reporting taps, so if we see that
+ * mouse at least once ACKs disable we will do full reconnect if ACK
+ * is missing.
+ */
+        psmouse->num_resyncs++;
+        if (ps2_sendbyte(&psmouse->ps2dev, PSMOUSE_CMD_DISABLE, 20)) {
+                if (psmouse->num_resyncs < 3 || psmouse->acks_disable_command)
+                        failed = 1;
+        } else
+                psmouse->acks_disable_command = 1;
+/*
+ * Poll the mouse. If it was reset the packet will be shorter than
+ * psmouse->pktsize and ps2_command will fail. We do not expect and
+ * do not handle scenario when mouse "upgrades" its protocol while
+ * disconnected since it would require additional delay. If we ever
+ * see a mouse that does it we'll adjust the code.
+ */
+        if (!failed) {
+                if (psmouse->poll(psmouse))
+                        failed = 1;
+                else {
+                        psmouse_set_state(psmouse, PSMOUSE_CMD_MODE);
+                        for (i = 0; i < psmouse->pktsize; i++) {
+                                psmouse->pktcnt++;
+                                rc = psmouse->protocol_handler(psmouse, NULL);
+                                if (rc != PSMOUSE_GOOD_DATA)
+                                        break;
+                        }
+                        if (rc != PSMOUSE_FULL_PACKET)
+                                failed = 1;
+                        psmouse_set_state(psmouse, PSMOUSE_RESYNCING);
+                }
+        }
+/*
+ * Now try to enable mouse. We try to do that even if poll failed and also
+ * repeat our attempts 5 times, otherwise we may be left out with disabled
+ * mouse.
+ */
+        for (i = 0; i < 5; i++) {
+                if (!ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_ENABLE)) {
+                        enabled = 1;
+                        break;
+                }
+                msleep(200);
+        }
+        if (!enabled) {
+                printk(KERN_WARNING "psmouse.c: failed to re-enable mouse on %s\n",
+                        psmouse->ps2dev.serio->phys);
+                failed = 1;
+        }
+        if (failed) {
+                psmouse_set_state(psmouse, PSMOUSE_IGNORE);
+                printk(KERN_INFO "psmouse.c: resync failed, issuing reconnect request\n");
+                serio_reconnect(serio);
+        } else
+                psmouse_set_state(psmouse, PSMOUSE_ACTIVATED);
+        if (parent)
+                psmouse_activate(parent);
+ out:
+        up(&psmouse_sem);
+}
 /*
 * psmouse_cleanup() resets the mouse into power-on state.
@@ -822,6 +977,11 @@ static void psmouse_disconnect(struct serio *serio)
        psmouse_set_state(psmouse, PSMOUSE_CMD_MODE);
+        /* make sure we don't have a resync in progress */
+        up(&psmouse_sem);
+        flush_workqueue(kpsmoused_wq);
+        down(&psmouse_sem);
        if (serio->parent && serio->id.type == SERIO_PS_PSTHRU) {
                parent = serio_get_drvdata(serio->parent);
                psmouse_deactivate(parent);
@@ -859,6 +1019,7 @@ static int psmouse_switch_protocol(struct psmouse *psmouse, struct psmouse_proto
        psmouse->set_rate = psmouse_set_rate;
        psmouse->set_resolution = psmouse_set_resolution;
+        psmouse->poll = psmouse_poll;
        psmouse->protocol_handler = psmouse_process_byte;
        psmouse->pktsize = 3;
@@ -874,6 +1035,23 @@ static int psmouse_switch_protocol(struct psmouse *psmouse, struct psmouse_proto
        else
                psmouse->type = psmouse_extensions(psmouse, psmouse_max_proto, 1);
+        /*
+         * If mouse's packet size is 3 there is no point in polling the
+         * device in hopes to detect protocol reset - we won't get less
+         * than 3 bytes response anyhow.
+         */
+        if (psmouse->pktsize == 3)
+                psmouse->resync_time = 0;
+        /*
+         * Some smart KVMs fake response to POLL command returning just
+         * 3 bytes and messing up our resync logic, so if initial poll
+         * fails we won't try polling the device anymore. Hopefully
+         * such KVM will maintain initially selected protocol.
+         */
+        if (psmouse->resync_time && psmouse->poll(psmouse))
+                psmouse->resync_time = 0;
        sprintf(psmouse->devname, "%s %s %s",
                psmouse_protocol_by_type(psmouse->type)->name, psmouse->vendor, psmouse->name);
@@ -914,6 +1092,7 @@ static int psmouse_connect(struct serio *serio, struct serio_driver *drv)
                goto out;
        ps2_init(&psmouse->ps2dev, serio);
+        INIT_WORK(&psmouse->resync_work, psmouse_resync, psmouse);
        psmouse->dev = input_dev;
        sprintf(psmouse->phys, "%s/input0", serio->phys);
@@ -934,6 +1113,7 @@ static int psmouse_connect(struct serio *serio, struct serio_driver *drv)
        psmouse->rate = psmouse_rate;
        psmouse->resolution = psmouse_resolution;
        psmouse->resetafter = psmouse_resetafter;
+        psmouse->resync_time = parent ? 0 : psmouse_resync_time;
        psmouse->smartscroll = psmouse_smartscroll;
        psmouse_switch_protocol(psmouse, NULL);
@@ -1278,13 +1458,21 @@ static int psmouse_get_maxproto(char *buffer, struct kernel_param *kp)
 static int __init psmouse_init(void)
 {
+        kpsmoused_wq = create_singlethread_workqueue("kpsmoused");
+        if (!kpsmoused_wq) {
+                printk(KERN_ERR "psmouse: failed to create kpsmoused workqueue\n");
+                return -ENOMEM;
+        }
        serio_register_driver(&psmouse_drv);
        return 0;
 }
 static void __exit psmouse_exit(void)
 {
        serio_unregister_driver(&psmouse_drv);
+        destroy_workqueue(kpsmoused_wq);
 }
 module_init(psmouse_init);
diff --git a/drivers/input/mouse/psmouse.h b/drivers/input/mouse/psmouse.h
index 7c4192bd1279..4d9107fba6a1 100644
--- a/drivers/input/mouse/psmouse.h
+++ b/drivers/input/mouse/psmouse.h
@@ -7,7 +7,7 @@
 #define PSMOUSE_CMD_GETINFO     0x03e9
 #define PSMOUSE_CMD_SETSTREAM   0x00ea
 #define PSMOUSE_CMD_SETPOLL     0x00f0
-#define PSMOUSE_CMD_POLL        0x03eb
+#define PSMOUSE_CMD_POLL        0x00eb  /* caller sets number of bytes to receive */
 #define PSMOUSE_CMD_GETID       0x02f2
 #define PSMOUSE_CMD_SETRATE     0x10f3
 #define PSMOUSE_CMD_ENABLE      0x00f4
@@ -23,6 +23,7 @@
 enum psmouse_state {
        PSMOUSE_IGNORE,
        PSMOUSE_INITIALIZING,
+        PSMOUSE_RESYNCING,
        PSMOUSE_CMD_MODE,
        PSMOUSE_ACTIVATED,
 };
@@ -38,15 +39,19 @@ struct psmouse {
        void *private;
        struct input_dev *dev;
        struct ps2dev ps2dev;
+        struct work_struct resync_work;
        char *vendor;
        char *name;
        unsigned char packet[8];
+        unsigned char badbyte;
        unsigned char pktcnt;
        unsigned char pktsize;
        unsigned char type;
+        unsigned char acks_disable_command;
        unsigned int model;
        unsigned long last;
        unsigned long out_of_sync;
+        unsigned long num_resyncs;
        enum psmouse_state state;
        char devname[64];
        char phys[32];
@@ -54,6 +59,7 @@ struct psmouse {
        unsigned int rate;
        unsigned int resolution;
        unsigned int resetafter;
+        unsigned int resync_time;
        unsigned int smartscroll;       /* Logitech only */
        psmouse_ret_t (*protocol_handler)(struct psmouse *psmouse, struct pt_regs *regs);
@@ -62,6 +68,7 @@ struct psmouse {
        int (*reconnect)(struct psmouse *psmouse);
        void (*disconnect)(struct psmouse *psmouse);
+        int (*poll)(struct psmouse *psmouse);
        void (*pt_activate)(struct psmouse *psmouse);
        void (*pt_deactivate)(struct psmouse *psmouse);
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 97cdfd6acaca..2051bec2c394 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -652,6 +652,8 @@ int synaptics_init(struct psmouse *psmouse)
        psmouse->disconnect = synaptics_disconnect;
        psmouse->reconnect = synaptics_reconnect;
        psmouse->pktsize = 6;
+        /* Synaptics can usually stay in sync without extra help */
+        psmouse->resync_time = 0;
        if (SYN_CAP_PASS_THROUGH(priv->capabilities))
                synaptics_pt_create(psmouse);
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 2d2f9fb3aded..a4c6f3522723 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -173,6 +173,13 @@ static struct dmi_system_id __initdata i8042_dmi_nomux_table[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "PC-MM20 Series"),
                },
        },
+        {
+                .ident = "Sony Vaio FS-115b",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FS115B"),
+                },
+        },
        { }
 };
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 8e530cc970e1..2f76813c3a64 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -59,9 +59,7 @@ static DECLARE_MUTEX(serio_sem);
 static LIST_HEAD(serio_list);
-static struct bus_type serio_bus = {
+static struct bus_type serio_bus;
-        .name = "serio",
-};
 static void serio_add_port(struct serio *serio);
 static void serio_destroy_port(struct serio *serio);
@@ -750,11 +748,15 @@ static int serio_driver_remove(struct device *dev)
        return 0;
 }
+static struct bus_type serio_bus = {
+        .name = "serio",
+        .probe = serio_driver_probe,
+        .remove = serio_driver_remove,
+};
 void __serio_register_driver(struct serio_driver *drv, struct module *owner)
 {
        drv->driver.bus = &serio_bus;
-        drv->driver.probe = serio_driver_probe;
-        drv->driver.remove = serio_driver_remove;
        serio_queue_event(drv, owner, SERIO_REGISTER_DRIVER);
 }
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 21d55ed4b88a..2c674023a6ac 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -11,6 +11,19 @@ menuconfig INPUT_TOUCHSCREEN
 if INPUT_TOUCHSCREEN
+config TOUCHSCREEN_ADS7846
+        tristate "ADS 7846 based touchscreens"
+        depends on SPI_MASTER
+        help
+          Say Y here if you have a touchscreen interface using the
+          ADS7846 controller, and your board-specific initialization
+          code includes that in its table of SPI devices.
+          If unsure, say N (but it's safe to say "Y").
+          To compile this driver as a module, choose M here: the
+          module will be called ads7846.
 config TOUCHSCREEN_BITSY
        tristate "Compaq iPAQ H3600 (Bitsy) touchscreen"
        depends on SA1100_BITSY
diff --git a/drivers/input/touchscreen/Makefile b/drivers/input/touchscreen/Makefile
index 6842869c9a26..5e5557c43121 100644
--- a/drivers/input/touchscreen/Makefile
+++ b/drivers/input/touchscreen/Makefile
@@ -4,6 +4,7 @@
 # Each configuration option enables a list of files.
+obj-$(CONFIG_TOUCHSCREEN_ADS7846)       += ads7846.o
 obj-$(CONFIG_TOUCHSCREEN_BITSY) += h3600_ts_input.o
 obj-$(CONFIG_TOUCHSCREEN_CORGI) += corgi_ts.o
 obj-$(CONFIG_TOUCHSCREEN_GUNZE) += gunze.o
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
new file mode 100644
index 000000000000..dd8c6a9ffc76
--- /dev/null
+++ b/drivers/input/touchscreen/ads7846.c
@@ -0,0 +1,625 @@
+/*
+ * ADS7846 based touchscreen and sensor driver
+ *
+ * Copyright (c) 2005 David Brownell
+ *
+ * Using code from:
+ *  - corgi_ts.c
+ *      Copyright (C) 2004-2005 Richard Purdie
+ *  - omap_ts.[hc], ads7846.h, ts_osk.c
+ *      Copyright (C) 2002 MontaVista Software
+ *      Copyright (C) 2004 Texas Instruments
+ *      Copyright (C) 2005 Dirk Behme
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ */
+#include <linux/device.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/input.h>
+#include <linux/interrupt.h>
+#include <linux/slab.h>
+#include <linux/spi/spi.h>
+#include <linux/spi/ads7846.h>
+#ifdef  CONFIG_ARM
+#include <asm/mach-types.h>
+#ifdef  CONFIG_ARCH_OMAP
+#include <asm/arch/gpio.h>
+#endif
+#else
+#define set_irq_type(irq,type)  do{}while(0)
+#endif
+/*
+ * This code has been lightly tested on an ads7846.
+ * Support for ads7843 and ads7845 has only been stubbed in.
+ *
+ * Not yet done:  investigate the values reported.  Are x/y/pressure
+ * event values sane enough for X11?  How accurate are the temperature
+ * and voltage readings?  (System-specific calibration should support
+ * accuracy of 0.3 degrees C; otherwise it's 2.0 degrees.)
+ *
+ * app note sbaa036 talks in more detail about accurate sampling...
+ * that ought to help in situations like LCDs inducing noise (which
+ * can also be helped by using synch signals) and more generally.
+ */
+#define TS_POLL_PERIOD  msecs_to_jiffies(10)
+struct ts_event {
+        /* For portability, we can't read 12 bit values using SPI (which
+         * would make the controller deliver them as native byteorder u16
+         * with msbs zeroed).  Instead, we read them as two 8-byte values,
+         * which need byteswapping then range adjustment.
+         */
+        __be16 x;
+        __be16 y;
+        __be16 z1, z2;
+};
+struct ads7846 {
+        struct input_dev        input;
+        char                    phys[32];
+        struct spi_device       *spi;
+        u16                     model;
+        u16                     vref_delay_usecs;
+        u16                     x_plate_ohms;
+        struct ts_event         tc;
+        struct spi_transfer     xfer[8];
+        struct spi_message      msg;
+        spinlock_t              lock;
+        struct timer_list       timer;          /* P: lock */
+        unsigned                pendown:1;      /* P: lock */
+        unsigned                pending:1;      /* P: lock */
+// FIXME remove "irq_disabled"
+        unsigned                irq_disabled:1; /* P: lock */
+};
+/* leave chip selected when we're done, for quicker re-select? */
+#if     0
+#define CS_CHANGE(xfer) ((xfer).cs_change = 1)
+#else
+#define CS_CHANGE(xfer) ((xfer).cs_change = 0)
+#endif
+/*--------------------------------------------------------------------------*/
+/* The ADS7846 has touchscreen and other sensors.
+ * Earlier ads784x chips are somewhat compatible.
+ */
+#define ADS_START               (1 << 7)
+#define ADS_A2A1A0_d_y          (1 << 4)        /* differential */
+#define ADS_A2A1A0_d_z1         (3 << 4)        /* differential */
+#define ADS_A2A1A0_d_z2         (4 << 4)        /* differential */
+#define ADS_A2A1A0_d_x          (5 << 4)        /* differential */
+#define ADS_A2A1A0_temp0        (0 << 4)        /* non-differential */
+#define ADS_A2A1A0_vbatt        (2 << 4)        /* non-differential */
+#define ADS_A2A1A0_vaux         (6 << 4)        /* non-differential */
+#define ADS_A2A1A0_temp1        (7 << 4)        /* non-differential */
+#define ADS_8_BIT               (1 << 3)
+#define ADS_12_BIT              (0 << 3)
+#define ADS_SER                 (1 << 2)        /* non-differential */
+#define ADS_DFR                 (0 << 2)        /* differential */
+#define ADS_PD10_PDOWN          (0 << 0)        /* lowpower mode + penirq */
+#define ADS_PD10_ADC_ON         (1 << 0)        /* ADC on */
+#define ADS_PD10_REF_ON         (2 << 0)        /* vREF on + penirq */
+#define ADS_PD10_ALL_ON         (3 << 0)        /* ADC + vREF on */
+#define MAX_12BIT       ((1<<12)-1)
+/* leave ADC powered up (disables penirq) between differential samples */
+#define READ_12BIT_DFR(x) (ADS_START | ADS_A2A1A0_d_ ## x \
+        | ADS_12_BIT | ADS_DFR)
+static const u8 read_y  = READ_12BIT_DFR(y)  | ADS_PD10_ADC_ON;
+static const u8 read_z1 = READ_12BIT_DFR(z1) | ADS_PD10_ADC_ON;
+static const u8 read_z2 = READ_12BIT_DFR(z2) | ADS_PD10_ADC_ON;
+static const u8 read_x  = READ_12BIT_DFR(x)  | ADS_PD10_PDOWN;  /* LAST */
+/* single-ended samples need to first power up reference voltage;
+ * we leave both ADC and VREF powered
+ */
+#define READ_12BIT_SER(x) (ADS_START | ADS_A2A1A0_ ## x \
+        | ADS_12_BIT | ADS_SER)
+static const u8 ref_on = READ_12BIT_DFR(x) | ADS_PD10_ALL_ON;
+static const u8 ref_off = READ_12BIT_DFR(y) | ADS_PD10_PDOWN;
+/*--------------------------------------------------------------------------*/
+/*
+ * Non-touchscreen sensors only use single-ended conversions.
+ */
+struct ser_req {
+        u8                      command;
+        u16                     scratch;
+        __be16                  sample;
+        struct spi_message      msg;
+        struct spi_transfer     xfer[6];
+};
+static int ads7846_read12_ser(struct device *dev, unsigned command)
+{
+        struct spi_device       *spi = to_spi_device(dev);
+        struct ads7846          *ts = dev_get_drvdata(dev);
+        struct ser_req          *req = kzalloc(sizeof *req, SLAB_KERNEL);
+        int                     status;
+        int                     sample;
+        int                     i;
+        if (!req)
+                return -ENOMEM;
+        INIT_LIST_HEAD(&req->msg.transfers);
+        /* activate reference, so it has time to settle; */
+        req->xfer[0].tx_buf = &ref_on;
+        req->xfer[0].len = 1;
+        req->xfer[1].rx_buf = &req->scratch;
+        req->xfer[1].len = 2;
+        /*
+         * for external VREF, 0 usec (and assume it's always on);
+         * for 1uF, use 800 usec;
+         * no cap, 100 usec.
+         */
+        req->xfer[1].delay_usecs = ts->vref_delay_usecs;
+        /* take sample */
+        req->command = (u8) command;
+        req->xfer[2].tx_buf = &req->command;
+        req->xfer[2].len = 1;
+        req->xfer[3].rx_buf = &req->sample;
+        req->xfer[3].len = 2;
+        /* REVISIT:  take a few more samples, and compare ... */
+        /* turn off reference */
+        req->xfer[4].tx_buf = &ref_off;
+        req->xfer[4].len = 1;
+        req->xfer[5].rx_buf = &req->scratch;
+        req->xfer[5].len = 2;
+        CS_CHANGE(req->xfer[5]);
+        /* group all the transfers together, so we can't interfere with
+         * reading touchscreen state; disable penirq while sampling
+         */
+        for (i = 0; i < 6; i++)
+                spi_message_add_tail(&req->xfer[i], &req->msg);
+        disable_irq(spi->irq);
+        status = spi_sync(spi, &req->msg);
+        enable_irq(spi->irq);
+        if (req->msg.status)
+                status = req->msg.status;
+        sample = be16_to_cpu(req->sample);
+        sample = sample >> 4;
+        kfree(req);
+        return status ? status : sample;
+}
+#define SHOW(name) static ssize_t \
+name ## _show(struct device *dev, struct device_attribute *attr, char *buf) \
+{ \
+        ssize_t v = ads7846_read12_ser(dev, \
+                        READ_12BIT_SER(name) | ADS_PD10_ALL_ON); \
+        if (v < 0) \
+                return v; \
+        return sprintf(buf, "%u\n", (unsigned) v); \
+} \
+static DEVICE_ATTR(name, S_IRUGO, name ## _show, NULL);
+SHOW(temp0)
+SHOW(temp1)
+SHOW(vaux)
+SHOW(vbatt)
+/*--------------------------------------------------------------------------*/
+/*
+ * PENIRQ only kicks the timer.  The timer only reissues the SPI transfer,
+ * to retrieve touchscreen status.
+ *
+ * The SPI transfer completion callback does the real work.  It reports
+ * touchscreen events and reactivates the timer (or IRQ) as appropriate.
+ */
+static void ads7846_rx(void *ads)
+{
+        struct ads7846  *ts = ads;
+        unsigned        Rt;
+        unsigned        sync = 0;
+        u16             x, y, z1, z2;
+        unsigned long   flags;
+        /* adjust:  12 bit samples (left aligned), built from
+         * two 8 bit values writen msb-first.
+         */
+        x = be16_to_cpu(ts->tc.x) >> 4;
+        y = be16_to_cpu(ts->tc.y) >> 4;
+        z1 = be16_to_cpu(ts->tc.z1) >> 4;
+        z2 = be16_to_cpu(ts->tc.z2) >> 4;
+        /* range filtering */
+        if (x == MAX_12BIT)
+                x = 0;
+        if (x && z1 && ts->spi->dev.power.power_state.event == PM_EVENT_ON) {
+                /* compute touch pressure resistance using equation #2 */
+                Rt = z2;
+                Rt -= z1;
+                Rt *= x;
+                Rt *= ts->x_plate_ohms;
+                Rt /= z1;
+                Rt = (Rt + 2047) >> 12;
+        } else
+                Rt = 0;
+        /* NOTE:  "pendown" is inferred from pressure; we don't rely on
+         * being able to check nPENIRQ status, or "friendly" trigger modes
+         * (both-edges is much better than just-falling or low-level).
+         *
+         * REVISIT:  some boards may require reading nPENIRQ; it's
+         * needed on 7843.  and 7845 reads pressure differently...
+         *
+         * REVISIT:  the touchscreen might not be connected; this code
+         * won't notice that, even if nPENIRQ never fires ...
+         */
+        if (!ts->pendown && Rt != 0) {
+                input_report_key(&ts->input, BTN_TOUCH, 1);
+                sync = 1;
+        } else if (ts->pendown && Rt == 0) {
+                input_report_key(&ts->input, BTN_TOUCH, 0);
+                sync = 1;
+        }
+        if (Rt) {
+                input_report_abs(&ts->input, ABS_X, x);
+                input_report_abs(&ts->input, ABS_Y, y);
+                input_report_abs(&ts->input, ABS_PRESSURE, Rt);
+                sync = 1;
+        }
+        if (sync)
+                input_sync(&ts->input);
+#ifdef  VERBOSE
+        if (Rt || ts->pendown)
+                pr_debug("%s: %d/%d/%d%s\n", ts->spi->dev.bus_id,
+                        x, y, Rt, Rt ? "" : " UP");
+#endif
+        /* don't retrigger while we're suspended */
+        spin_lock_irqsave(&ts->lock, flags);
+        ts->pendown = (Rt != 0);
+        ts->pending = 0;
+        if (ts->spi->dev.power.power_state.event == PM_EVENT_ON) {
+                if (ts->pendown)
+                        mod_timer(&ts->timer, jiffies + TS_POLL_PERIOD);
+                else if (ts->irq_disabled) {
+                        ts->irq_disabled = 0;
+                        enable_irq(ts->spi->irq);
+                }
+        }
+        spin_unlock_irqrestore(&ts->lock, flags);
+}
+static void ads7846_timer(unsigned long handle)
+{
+        struct ads7846  *ts = (void *)handle;
+        int             status = 0;
+        unsigned long   flags;
+        spin_lock_irqsave(&ts->lock, flags);
+        if (!ts->pending) {
+                ts->pending = 1;
+                if (!ts->irq_disabled) {
+                        ts->irq_disabled = 1;
+                        disable_irq(ts->spi->irq);
+                }
+                status = spi_async(ts->spi, &ts->msg);
+                if (status)
+                        dev_err(&ts->spi->dev, "spi_async --> %d\n",
+                                        status);
+        }
+        spin_unlock_irqrestore(&ts->lock, flags);
+}
+static irqreturn_t ads7846_irq(int irq, void *handle, struct pt_regs *regs)
+{
+        ads7846_timer((unsigned long) handle);
+        return IRQ_HANDLED;
+}
+/*--------------------------------------------------------------------------*/
+static int
+ads7846_suspend(struct spi_device *spi, pm_message_t message)
+{
+        struct ads7846 *ts = dev_get_drvdata(&spi->dev);
+        unsigned long   flags;
+        spin_lock_irqsave(&ts->lock, flags);
+        spi->dev.power.power_state = message;
+        /* are we waiting for IRQ, or polling? */
+        if (!ts->pendown) {
+                if (!ts->irq_disabled) {
+                        ts->irq_disabled = 1;
+                        disable_irq(ts->spi->irq);
+                }
+        } else {
+                /* polling; force a final SPI completion;
+                 * that will clean things up neatly
+                 */
+                if (!ts->pending)
+                        mod_timer(&ts->timer, jiffies);
+                while (ts->pendown || ts->pending) {
+                        spin_unlock_irqrestore(&ts->lock, flags);
+                        udelay(10);
+                        spin_lock_irqsave(&ts->lock, flags);
+                }
+        }
+        /* we know the chip's in lowpower mode since we always
+         * leave it that way after every request
+         */
+        spin_unlock_irqrestore(&ts->lock, flags);
+        return 0;
+}
+static int ads7846_resume(struct spi_device *spi)
+{
+        struct ads7846 *ts = dev_get_drvdata(&spi->dev);
+        ts->irq_disabled = 0;
+        enable_irq(ts->spi->irq);
+        spi->dev.power.power_state = PMSG_ON;
+        return 0;
+}
+static int __devinit ads7846_probe(struct spi_device *spi)
+{
+        struct ads7846                  *ts;
+        struct ads7846_platform_data    *pdata = spi->dev.platform_data;
+        struct spi_transfer             *x;
+        int                             i;
+        if (!spi->irq) {
+                dev_dbg(&spi->dev, "no IRQ?\n");
+                return -ENODEV;
+        }
+        if (!pdata) {
+                dev_dbg(&spi->dev, "no platform data?\n");
+                return -ENODEV;
+        }
+        /* don't exceed max specified sample rate */
+        if (spi->max_speed_hz > (125000 * 16)) {
+                dev_dbg(&spi->dev, "f(sample) %d KHz?\n",
+                                (spi->max_speed_hz/16)/1000);
+                return -EINVAL;
+        }
+        /* We'd set the wordsize to 12 bits ... except that some controllers
+         * will then treat the 8 bit command words as 12 bits (and drop the
+         * four MSBs of the 12 bit result).  Result: inputs must be shifted
+         * to discard the four garbage LSBs.
+         */
+        if (!(ts = kzalloc(sizeof(struct ads7846), GFP_KERNEL)))
+                return -ENOMEM;
+        dev_set_drvdata(&spi->dev, ts);
+        ts->spi = spi;
+        spi->dev.power.power_state = PMSG_ON;
+        init_timer(&ts->timer);
+        ts->timer.data = (unsigned long) ts;
+        ts->timer.function = ads7846_timer;
+        ts->model = pdata->model ? : 7846;
+        ts->vref_delay_usecs = pdata->vref_delay_usecs ? : 100;
+        ts->x_plate_ohms = pdata->x_plate_ohms ? : 400;
+        init_input_dev(&ts->input);
+        ts->input.dev = &spi->dev;
+        ts->input.name = "ADS784x Touchscreen";
+        snprintf(ts->phys, sizeof ts->phys, "%s/input0", spi->dev.bus_id);
+        ts->input.phys = ts->phys;
+        ts->input.evbit[0] = BIT(EV_KEY) | BIT(EV_ABS);
+        ts->input.keybit[LONG(BTN_TOUCH)] = BIT(BTN_TOUCH);
+        input_set_abs_params(&ts->input, ABS_X,
+                        pdata->x_min ? : 0,
+                        pdata->x_max ? : MAX_12BIT,
+                        0, 0);
+        input_set_abs_params(&ts->input, ABS_Y,
+                        pdata->y_min ? : 0,
+                        pdata->y_max ? : MAX_12BIT,
+                        0, 0);
+        input_set_abs_params(&ts->input, ABS_PRESSURE,
+                        pdata->pressure_min, pdata->pressure_max, 0, 0);
+        input_register_device(&ts->input);
+        /* set up the transfers to read touchscreen state; this assumes we
+         * use formula #2 for pressure, not #3.
+         */
+        x = ts->xfer;
+        /* y- still on; turn on only y+ (and ADC) */
+        x->tx_buf = &read_y;
+        x->len = 1;
+        x++;
+        x->rx_buf = &ts->tc.y;
+        x->len = 2;
+        x++;
+        /* turn y+ off, x- on; we'll use formula #2 */
+        if (ts->model == 7846) {
+                x->tx_buf = &read_z1;
+                x->len = 1;
+                x++;
+                x->rx_buf = &ts->tc.z1;
+                x->len = 2;
+                x++;
+                x->tx_buf = &read_z2;
+                x->len = 1;
+                x++;
+                x->rx_buf = &ts->tc.z2;
+                x->len = 2;
+                x++;
+        }
+        /* turn y- off, x+ on, then leave in lowpower */
+        x->tx_buf = &read_x;
+        x->len = 1;
+        x++;
+        x->rx_buf = &ts->tc.x;
+        x->len = 2;
+        x++;
+        CS_CHANGE(x[-1]);
+        for (i = 0; i < x - ts->xfer; i++)
+                spi_message_add_tail(&ts->xfer[i], &ts->msg);
+        ts->msg.complete = ads7846_rx;
+        ts->msg.context = ts;
+        if (request_irq(spi->irq, ads7846_irq, SA_SAMPLE_RANDOM,
+                                spi->dev.bus_id, ts)) {
+                dev_dbg(&spi->dev, "irq %d busy?\n", spi->irq);
+                input_unregister_device(&ts->input);
+                kfree(ts);
+                return -EBUSY;
+        }
+        set_irq_type(spi->irq, IRQT_FALLING);
+        dev_info(&spi->dev, "touchscreen, irq %d\n", spi->irq);
+        /* take a first sample, leaving nPENIRQ active; avoid
+         * the touchscreen, in case it's not connected.
+         */
+        (void) ads7846_read12_ser(&spi->dev,
+                          READ_12BIT_SER(vaux) | ADS_PD10_ALL_ON);
+        /* ads7843/7845 don't have temperature sensors, and
+         * use the other sensors a bit differently too
+         */
+        if (ts->model == 7846) {
+                device_create_file(&spi->dev, &dev_attr_temp0);
+                device_create_file(&spi->dev, &dev_attr_temp1);
+        }
+        if (ts->model != 7845)
+                device_create_file(&spi->dev, &dev_attr_vbatt);
+        device_create_file(&spi->dev, &dev_attr_vaux);
+        return 0;
+}
+static int __devexit ads7846_remove(struct spi_device *spi)
+{
+        struct ads7846          *ts = dev_get_drvdata(&spi->dev);
+        ads7846_suspend(spi, PMSG_SUSPEND);
+        free_irq(ts->spi->irq, ts);
+        if (ts->irq_disabled)
+                enable_irq(ts->spi->irq);
+        if (ts->model == 7846) {
+                device_remove_file(&spi->dev, &dev_attr_temp0);
+                device_remove_file(&spi->dev, &dev_attr_temp1);
+        }
+        if (ts->model != 7845)
+                device_remove_file(&spi->dev, &dev_attr_vbatt);
+        device_remove_file(&spi->dev, &dev_attr_vaux);
+        input_unregister_device(&ts->input);
+        kfree(ts);
+        dev_dbg(&spi->dev, "unregistered touchscreen\n");
+        return 0;
+}
+static struct spi_driver ads7846_driver = {
+        .driver = {
+                .name   = "ads7846",
+                .bus    = &spi_bus_type,
+                .owner  = THIS_MODULE,
+        },
+        .probe          = ads7846_probe,
+        .remove         = __devexit_p(ads7846_remove),
+        .suspend        = ads7846_suspend,
+        .resume         = ads7846_resume,
+};
+static int __init ads7846_init(void)
+{
+        /* grr, board-specific init should stay out of drivers!! */
+#ifdef  CONFIG_ARCH_OMAP
+        if (machine_is_omap_osk()) {
+                /* GPIO4 = PENIRQ; GPIO6 = BUSY */
+                omap_request_gpio(4);
+                omap_set_gpio_direction(4, 1);
+                omap_request_gpio(6);
+                omap_set_gpio_direction(6, 1);
+        }
+        // also TI 1510 Innovator, bitbanging through FPGA
+        // also Nokia 770
+        // also Palm Tungsten T2
+#endif
+        // PXA:
+        // also Dell Axim X50
+        // also HP iPaq H191x/H192x/H415x/H435x
+        // also Intel Lubbock (additional to UCB1400; as temperature sensor)
+        // also Sharp Zaurus C7xx, C8xx (corgi/sheperd/husky)
+        // Atmel at91sam9261-EK uses ads7843
+        // also various AMD Au1x00 devel boards
+        return spi_register_driver(&ads7846_driver);
+}
+module_init(ads7846_init);
+static void __exit ads7846_exit(void)
+{
+        spi_unregister_driver(&ads7846_driver);
+#ifdef  CONFIG_ARCH_OMAP
+        if (machine_is_omap_osk()) {
+                omap_free_gpio(4);
+                omap_free_gpio(6);
+        }
+#endif
+}
+module_exit(ads7846_exit);
+MODULE_DESCRIPTION("ADS7846 TouchScreen Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/macintosh/adb-iop.c b/drivers/macintosh/adb-iop.c
index 71aeb912ec61..d56d400b6aaa 100644
--- a/drivers/macintosh/adb-iop.c
+++ b/drivers/macintosh/adb-iop.c
@@ -239,7 +239,7 @@ static int adb_iop_write(struct adb_request *req)
        local_irq_save(flags);
-        req->next = 0;
+        req->next = NULL;
        req->sent = 0;
        req->complete = 0;
        req->reply_len = 0;
diff --git a/drivers/macintosh/macio-adb.c b/drivers/macintosh/macio-adb.c
index cf6a6f2248ac..314fc0830d90 100644
--- a/drivers/macintosh/macio-adb.c
+++ b/drivers/macintosh/macio-adb.c
@@ -17,6 +17,7 @@
 #include <asm/irq.h>
 #include <asm/system.h>
 #include <linux/init.h>
+#include <linux/ioport.h>
 struct preg {
        unsigned char r;
@@ -88,24 +89,26 @@ int macio_probe(void)
 int macio_init(void)
 {
        struct device_node *adbs;
+        struct resource r;
        adbs = find_compatible_devices("adb", "chrp,adb0");
        if (adbs == 0)
                return -ENXIO;
 #if 0
-        { int i;
+        { int i = 0;
        printk("macio_adb_init: node = %p, addrs =", adbs->node);
-        for (i = 0; i < adbs->n_addrs; ++i)
+        while(!of_address_to_resource(adbs, i, &r))
-                printk(" %x(%x)", adbs->addrs[i].address, adbs->addrs[i].size);
+                printk(" %x(%x)", r.start, r.end - r.start);
        printk(", intrs =");
        for (i = 0; i < adbs->n_intrs; ++i)
                printk(" %x", adbs->intrs[i].line);
        printk("\n"); }
 #endif
-        
+        if (of_address_to_resource(adbs, 0, &r))
-        adb = ioremap(adbs->addrs->address, sizeof(struct adb_regs));
+                return -ENXIO;
+        adb = ioremap(r.start, sizeof(struct adb_regs));
        out_8(&adb->ctrl.r, 0);
        out_8(&adb->intr.r, 0);
diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
index 2a545ceb523b..ed6d3174d660 100644
--- a/drivers/macintosh/macio_asic.c
+++ b/drivers/macintosh/macio_asic.c
@@ -211,6 +211,9 @@ struct bus_type macio_bus_type = {
       .name    = "macio",
       .match   = macio_bus_match,
       .uevent = macio_uevent,
+       .probe   = macio_device_probe,
+       .remove  = macio_device_remove,
+       .shutdown = macio_device_shutdown,
       .suspend = macio_device_suspend,
       .resume  = macio_device_resume,
       .dev_attrs = macio_dev_attrs,
@@ -528,9 +531,6 @@ int macio_register_driver(struct macio_driver *drv)
        /* initialize common driver fields */
        drv->driver.name = drv->name;
        drv->driver.bus = &macio_bus_type;
-        drv->driver.probe = macio_device_probe;
-        drv->driver.remove = macio_device_remove;
-        drv->driver.shutdown = macio_device_shutdown;
        /* register with core */
        count = driver_register(&drv->driver);
diff --git a/drivers/macintosh/via-macii.c b/drivers/macintosh/via-macii.c
index e9a159ad3022..2a2ffe060169 100644
--- a/drivers/macintosh/via-macii.c
+++ b/drivers/macintosh/via-macii.c
@@ -260,7 +260,7 @@ static int macii_write(struct adb_request *req)
                return -EINVAL;
        }
        
-        req->next = 0;
+        req->next = NULL;
        req->sent = 0;
        req->complete = 0;
        req->reply_len = 0;
@@ -295,7 +295,7 @@ static void macii_poll(void)
        unsigned long flags;
        local_irq_save(flags);
-        if (via[IFR] & SR_INT) macii_interrupt(0, 0, 0);
+        if (via[IFR] & SR_INT) macii_interrupt(0, NULL, NULL);
        local_irq_restore(flags);
 }
diff --git a/drivers/macintosh/via-maciisi.c b/drivers/macintosh/via-maciisi.c
index a1966975d58f..0129fcc3b183 100644
--- a/drivers/macintosh/via-maciisi.c
+++ b/drivers/macintosh/via-maciisi.c
@@ -294,6 +294,24 @@ static void maciisi_sync(struct adb_request *req)
                printk(KERN_ERR "maciisi_send_request: poll timed out!\n");
 }
+int
+maciisi_request(struct adb_request *req, void (*done)(struct adb_request *),
+            int nbytes, ...)
+{
+        va_list list;
+        int i;
+        req->nbytes = nbytes;
+        req->done = done;
+        req->reply_expected = 0;
+        va_start(list, nbytes);
+        for (i = 0; i < nbytes; i++)
+                req->data[i++] = va_arg(list, int);
+        va_end(list);
+        return maciisi_send_request(req, 1);
+}
 /* Enqueue a request, and run the queue if possible */
 static int
 maciisi_write(struct adb_request* req)
@@ -308,7 +326,7 @@ maciisi_write(struct adb_request* req)
                req->complete = 1;
                return -EINVAL;
        }
-        req->next = 0;
+        req->next = NULL;
        req->sent = 0;
        req->complete = 0;
        req->reply_len = 0;
@@ -403,7 +421,7 @@ maciisi_poll(void)
        local_irq_save(flags);
        if (via[IFR] & SR_INT) {
-                maciisi_interrupt(0, 0, 0);
+                maciisi_interrupt(0, NULL, NULL);
        }
        else /* avoid calling this function too quickly in a loop */
                udelay(ADB_DELAY);
diff --git a/drivers/macintosh/via-pmu68k.c b/drivers/macintosh/via-pmu68k.c
index 6f80d76ac17c..f08e52f2107b 100644
--- a/drivers/macintosh/via-pmu68k.c
+++ b/drivers/macintosh/via-pmu68k.c
@@ -493,7 +493,7 @@ pmu_queue_request(struct adb_request *req)
                return -EINVAL;
        }
-        req->next = 0;
+        req->next = NULL;
        req->sent = 0;
        req->complete = 0;
        local_irq_save(flags);
@@ -717,7 +717,7 @@ pmu_handle_data(unsigned char *data, int len, struct pt_regs *regs)
                                printk(KERN_ERR "PMU: extra ADB reply\n");
                                return;
                        }
-                        req_awaiting_reply = 0;
+                        req_awaiting_reply = NULL;
                        if (len <= 2)
                                req->reply_len = 0;
                        else {
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 0302723fa21f..1778104e106c 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1238,6 +1238,7 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev)
        mdk_rdev_t *same_pdev;
        char b[BDEVNAME_SIZE], b2[BDEVNAME_SIZE];
        struct kobject *ko;
+        char *s;
        if (rdev->mddev) {
                MD_BUG();
@@ -1277,6 +1278,8 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev)
        bdevname(rdev->bdev,b);
        if (kobject_set_name(&rdev->kobj, "dev-%s", b) < 0)
                return -ENOMEM;
+        while ( (s=strchr(rdev->kobj.k_name, '/')) != NULL)
+                *s = '!';
                        
        list_add(&rdev->same_set, &mddev->disks);
        rdev->mddev = mddev;
diff --git a/drivers/media/dvb/bt8xx/dvb-bt8xx.c b/drivers/media/dvb/bt8xx/dvb-bt8xx.c
index f65f64b00ff3..44fcbe77c8f9 100644
--- a/drivers/media/dvb/bt8xx/dvb-bt8xx.c
+++ b/drivers/media/dvb/bt8xx/dvb-bt8xx.c
@@ -779,9 +779,8 @@ static int __init dvb_bt8xx_load_card(struct dvb_bt8xx_card *card, u32 type)
        return 0;
 }
-static int dvb_bt8xx_probe(struct device *dev)
+static int dvb_bt8xx_probe(struct bttv_sub_device *sub)
 {
-        struct bttv_sub_device *sub = to_bttv_sub_dev(dev);
        struct dvb_bt8xx_card *card;
        struct pci_dev* bttv_pci_dev;
        int ret;
@@ -890,13 +889,13 @@ static int dvb_bt8xx_probe(struct device *dev)
                return ret;
        }
-        dev_set_drvdata(dev, card);
+        dev_set_drvdata(&sub->dev, card);
        return 0;
 }
-static int dvb_bt8xx_remove(struct device *dev)
+static int dvb_bt8xx_remove(struct bttv_sub_device *sub)
 {
-        struct dvb_bt8xx_card *card = dev_get_drvdata(dev);
+        struct dvb_bt8xx_card *card = dev_get_drvdata(&sub->dev);
        dprintk("dvb_bt8xx: unloading card%d\n", card->bttv_nr);
@@ -919,14 +918,14 @@ static int dvb_bt8xx_remove(struct device *dev)
 static struct bttv_sub_driver driver = {
        .drv = {
                .name           = "dvb-bt8xx",
-                .probe          = dvb_bt8xx_probe,
-                .remove         = dvb_bt8xx_remove,
-                /* FIXME:
-                 * .shutdown    = dvb_bt8xx_shutdown,
-                 * .suspend     = dvb_bt8xx_suspend,
-                 * .resume      = dvb_bt8xx_resume,
-                 */
        },
+        .probe          = dvb_bt8xx_probe,
+        .remove         = dvb_bt8xx_remove,
+        /* FIXME:
+         * .shutdown    = dvb_bt8xx_shutdown,
+         * .suspend     = dvb_bt8xx_suspend,
+         * .resume      = dvb_bt8xx_resume,
+         */
 };
 static int __init dvb_bt8xx_init(void)
diff --git a/drivers/media/video/bttv-gpio.c b/drivers/media/video/bttv-gpio.c
index d64accc17b0e..c4d5e2b70c28 100644
--- a/drivers/media/video/bttv-gpio.c
+++ b/drivers/media/video/bttv-gpio.c
@@ -47,9 +47,29 @@ static int bttv_sub_bus_match(struct device *dev, struct device_driver *drv)
        return 0;
 }
+static int bttv_sub_probe(struct device *dev)
+{
+        struct bttv_sub_device *sdev = to_bttv_sub_dev(dev);
+        struct bttv_sub_driver *sub = to_bttv_sub_drv(dev->driver);
+        return sub->probe ? sub->probe(sdev) : -ENODEV;
+}
+static int bttv_sub_remove(struct device *dev)
+{
+        struct bttv_sub_device *sdev = to_bttv_sub_dev(dev);
+        struct bttv_sub_driver *sub = to_bttv_sub_drv(dev->driver);
+        if (sub->remove)
+                sub->remove(sdev);
+        return 0;
+}
 struct bus_type bttv_sub_bus_type = {
-        .name  = "bttv-sub",
+        .name   = "bttv-sub",
-        .match = &bttv_sub_bus_match,
+        .match  = &bttv_sub_bus_match,
+        .probe  = bttv_sub_probe,
+        .remove = bttv_sub_remove,
 };
 EXPORT_SYMBOL(bttv_sub_bus_type);
diff --git a/drivers/media/video/bttv.h b/drivers/media/video/bttv.h
index e370d74f2a1b..9908c8e0c951 100644
--- a/drivers/media/video/bttv.h
+++ b/drivers/media/video/bttv.h
@@ -365,6 +365,8 @@ struct bttv_sub_device {
 struct bttv_sub_driver {
        struct device_driver   drv;
        char                   wanted[BUS_ID_SIZE];
+        int                    (*probe)(struct bttv_sub_device *sub);
+        void                   (*remove)(struct bttv_sub_device *sub);
        void                   (*gpio_irq)(struct bttv_sub_device *sub);
 };
 #define to_bttv_sub_drv(x) container_of((x), struct bttv_sub_driver, drv)
diff --git a/drivers/mfd/mcp-core.c b/drivers/mfd/mcp-core.c
index 55ba23075c90..75f401d52fda 100644
--- a/drivers/mfd/mcp-core.c
+++ b/drivers/mfd/mcp-core.c
@@ -77,6 +77,8 @@ static int mcp_bus_resume(struct device *dev)
 static struct bus_type mcp_bus_type = {
        .name           = "mcp",
        .match          = mcp_bus_match,
+        .probe          = mcp_bus_probe,
+        .remove         = mcp_bus_remove,
        .suspend        = mcp_bus_suspend,
        .resume         = mcp_bus_resume,
 };
@@ -227,8 +229,6 @@ EXPORT_SYMBOL(mcp_host_unregister);
 int mcp_driver_register(struct mcp_driver *mcpdrv)
 {
        mcpdrv->drv.bus = &mcp_bus_type;
-        mcpdrv->drv.probe = mcp_bus_probe;
-        mcpdrv->drv.remove = mcp_bus_remove;
        return driver_register(&mcpdrv->drv);
 }
 EXPORT_SYMBOL(mcp_driver_register);
diff --git a/drivers/mfd/ucb1x00-core.c b/drivers/mfd/ucb1x00-core.c
index b42e0fbab59b..aff83f966803 100644
--- a/drivers/mfd/ucb1x00-core.c
+++ b/drivers/mfd/ucb1x00-core.c
@@ -24,13 +24,14 @@
 #include <linux/errno.h>
 #include <linux/interrupt.h>
 #include <linux/device.h>
+#include <linux/mutex.h>
 #include <asm/dma.h>
 #include <asm/hardware.h>
 #include "ucb1x00.h"
-static DECLARE_MUTEX(ucb1x00_sem);
+static DEFINE_MUTEX(ucb1x00_mutex);
 static LIST_HEAD(ucb1x00_drivers);
 static LIST_HEAD(ucb1x00_devices);
@@ -521,12 +522,12 @@ static int ucb1x00_probe(struct mcp *mcp)
                goto err_irq;
        INIT_LIST_HEAD(&ucb->devs);
-        down(&ucb1x00_sem);
+        mutex_lock(&ucb1x00_mutex);
        list_add(&ucb->node, &ucb1x00_devices);
        list_for_each_entry(drv, &ucb1x00_drivers, node) {
                ucb1x00_add_dev(ucb, drv);
        }
-        up(&ucb1x00_sem);
+        mutex_unlock(&ucb1x00_mutex);
        goto out;
 err_irq:
@@ -544,13 +545,13 @@ static void ucb1x00_remove(struct mcp *mcp)
        struct ucb1x00 *ucb = mcp_get_drvdata(mcp);
        struct list_head *l, *n;
-        down(&ucb1x00_sem);
+        mutex_lock(&ucb1x00_mutex);
        list_del(&ucb->node);
        list_for_each_safe(l, n, &ucb->devs) {
                struct ucb1x00_dev *dev = list_entry(l, struct ucb1x00_dev, dev_node);
                ucb1x00_remove_dev(dev);
        }
-        up(&ucb1x00_sem);
+        mutex_unlock(&ucb1x00_mutex);
        free_irq(ucb->irq, ucb);
        class_device_unregister(&ucb->cdev);
@@ -561,12 +562,12 @@ int ucb1x00_register_driver(struct ucb1x00_driver *drv)
        struct ucb1x00 *ucb;
        INIT_LIST_HEAD(&drv->devs);
-        down(&ucb1x00_sem);
+        mutex_lock(&ucb1x00_mutex);
        list_add(&drv->node, &ucb1x00_drivers);
        list_for_each_entry(ucb, &ucb1x00_devices, node) {
                ucb1x00_add_dev(ucb, drv);
        }
-        up(&ucb1x00_sem);
+        mutex_unlock(&ucb1x00_mutex);
        return 0;
 }
@@ -574,13 +575,13 @@ void ucb1x00_unregister_driver(struct ucb1x00_driver *drv)
 {
        struct list_head *n, *l;
-        down(&ucb1x00_sem);
+        mutex_lock(&ucb1x00_mutex);
        list_del(&drv->node);
        list_for_each_safe(l, n, &drv->devs) {
                struct ucb1x00_dev *dev = list_entry(l, struct ucb1x00_dev, drv_node);
                ucb1x00_remove_dev(dev);
        }
-        up(&ucb1x00_sem);
+        mutex_unlock(&ucb1x00_mutex);
 }
 static int ucb1x00_suspend(struct mcp *mcp, pm_message_t state)
@@ -588,12 +589,12 @@ static int ucb1x00_suspend(struct mcp *mcp, pm_message_t state)
        struct ucb1x00 *ucb = mcp_get_drvdata(mcp);
        struct ucb1x00_dev *dev;
-        down(&ucb1x00_sem);
+        mutex_lock(&ucb1x00_mutex);
        list_for_each_entry(dev, &ucb->devs, dev_node) {
                if (dev->drv->suspend)
                        dev->drv->suspend(dev, state);
        }
-        up(&ucb1x00_sem);
+        mutex_unlock(&ucb1x00_mutex);
        return 0;
 }
@@ -602,12 +603,12 @@ static int ucb1x00_resume(struct mcp *mcp)
        struct ucb1x00 *ucb = mcp_get_drvdata(mcp);
        struct ucb1x00_dev *dev;
-        down(&ucb1x00_sem);
+        mutex_lock(&ucb1x00_mutex);
        list_for_each_entry(dev, &ucb->devs, dev_node) {
                if (dev->drv->resume)
                        dev->drv->resume(dev);
        }
-        up(&ucb1x00_sem);
+        mutex_unlock(&ucb1x00_mutex);
        return 0;
 }
diff --git a/drivers/mmc/mmc_block.c b/drivers/mmc/mmc_block.c
index f2c42b13945d..9b7c37e0e574 100644
--- a/drivers/mmc/mmc_block.c
+++ b/drivers/mmc/mmc_block.c
@@ -28,6 +28,7 @@
 #include <linux/kdev_t.h>
 #include <linux/blkdev.h>
 #include <linux/devfs_fs_kernel.h>
+#include <linux/mutex.h>
 #include <linux/mmc/card.h>
 #include <linux/mmc/protocol.h>
@@ -57,33 +58,33 @@ struct mmc_blk_data {
        unsigned int    read_only;
 };
-static DECLARE_MUTEX(open_lock);
+static DEFINE_MUTEX(open_lock);
 static struct mmc_blk_data *mmc_blk_get(struct gendisk *disk)
 {
        struct mmc_blk_data *md;
-        down(&open_lock);
+        mutex_lock(&open_lock);
        md = disk->private_data;
        if (md && md->usage == 0)
                md = NULL;
        if (md)
                md->usage++;
-        up(&open_lock);
+        mutex_unlock(&open_lock);
        return md;
 }
 static void mmc_blk_put(struct mmc_blk_data *md)
 {
-        down(&open_lock);
+        mutex_lock(&open_lock);
        md->usage--;
        if (md->usage == 0) {
                put_disk(md->disk);
                mmc_cleanup_queue(&md->queue);
                kfree(md);
        }
-        up(&open_lock);
+        mutex_unlock(&open_lock);
 }
 static int mmc_blk_open(struct inode *inode, struct file *filp)
diff --git a/drivers/mmc/mmc_sysfs.c b/drivers/mmc/mmc_sysfs.c
index ec701667abfc..a2a35fd946ee 100644
--- a/drivers/mmc/mmc_sysfs.c
+++ b/drivers/mmc/mmc_sysfs.c
@@ -136,17 +136,7 @@ static int mmc_bus_resume(struct device *dev)
        return ret;
 }
-static struct bus_type mmc_bus_type = {
+static int mmc_bus_probe(struct device *dev)
-        .name           = "mmc",
-        .dev_attrs      = mmc_dev_attrs,
-        .match          = mmc_bus_match,
-        .uevent         = mmc_bus_uevent,
-        .suspend        = mmc_bus_suspend,
-        .resume         = mmc_bus_resume,
-};
-static int mmc_drv_probe(struct device *dev)
 {
        struct mmc_driver *drv = to_mmc_driver(dev->driver);
        struct mmc_card *card = dev_to_mmc_card(dev);
@@ -154,7 +144,7 @@ static int mmc_drv_probe(struct device *dev)
        return drv->probe(card);
 }
-static int mmc_drv_remove(struct device *dev)
+static int mmc_bus_remove(struct device *dev)
 {
        struct mmc_driver *drv = to_mmc_driver(dev->driver);
        struct mmc_card *card = dev_to_mmc_card(dev);
@@ -164,6 +154,16 @@ static int mmc_drv_remove(struct device *dev)
        return 0;
 }
+static struct bus_type mmc_bus_type = {
+        .name           = "mmc",
+        .dev_attrs      = mmc_dev_attrs,
+        .match          = mmc_bus_match,
+        .uevent         = mmc_bus_uevent,
+        .probe          = mmc_bus_probe,
+        .remove         = mmc_bus_remove,
+        .suspend        = mmc_bus_suspend,
+        .resume         = mmc_bus_resume,
+};
 /**
 *      mmc_register_driver - register a media driver
@@ -172,8 +172,6 @@ static int mmc_drv_remove(struct device *dev)
 int mmc_register_driver(struct mmc_driver *drv)
 {
        drv->drv.bus = &mmc_bus_type;
-        drv->drv.probe = mmc_drv_probe;
-        drv->drv.remove = mmc_drv_remove;
        return driver_register(&drv->drv);
 }
diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig
index 9a2aa4033c6a..5038e90ceb12 100644
--- a/drivers/mtd/devices/Kconfig
+++ b/drivers/mtd/devices/Kconfig
@@ -47,6 +47,22 @@ config MTD_MS02NV
          accelerator.  Say Y here if you have a DECstation 5000/2x0 or a
          DECsystem 5900 equipped with such a module.
+config MTD_DATAFLASH
+        tristate "Support for AT45xxx DataFlash"
+        depends on MTD && SPI_MASTER && EXPERIMENTAL
+        help
+          This enables access to AT45xxx DataFlash chips, using SPI.
+          Sometimes DataFlash chips are packaged inside MMC-format
+          cards; at this writing, the MMC stack won't handle those.
+config MTD_M25P80
+        tristate "Support for M25 SPI Flash"
+        depends on MTD && SPI_MASTER && EXPERIMENTAL
+        help
+          This enables access to ST M25P80 and similar SPI flash chips,
+          used for program and data storage.  Set up your spi devices
+          with the right board-specific platform data.
 config MTD_SLRAM
        tristate "Uncached system RAM"
        depends on MTD
diff --git a/drivers/mtd/devices/Makefile b/drivers/mtd/devices/Makefile
index e38db348057d..7c5ed2178380 100644
--- a/drivers/mtd/devices/Makefile
+++ b/drivers/mtd/devices/Makefile
@@ -23,3 +23,5 @@ obj-$(CONFIG_MTD_MTDRAM)	+= mtdram.o
 obj-$(CONFIG_MTD_LART)          += lart.o
 obj-$(CONFIG_MTD_BLKMTD)        += blkmtd.o
 obj-$(CONFIG_MTD_BLOCK2MTD)     += block2mtd.o
+obj-$(CONFIG_MTD_DATAFLASH)     += mtd_dataflash.o
+obj-$(CONFIG_MTD_M25P80)        += m25p80.o
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
new file mode 100644
index 000000000000..d5f24089be71
--- /dev/null
+++ b/drivers/mtd/devices/m25p80.c
@@ -0,0 +1,582 @@
+/*
+ * MTD SPI driver for ST M25Pxx flash chips
+ *
+ * Author: Mike Lavender, mike@steroidmicros.com
+ *
+ * Copyright (c) 2005, Intec Automation Inc.
+ *
+ * Some parts are based on lart.c by Abraham Van Der Merwe
+ *
+ * Cleaned up and generalized based on mtd_dataflash.c
+ *
+ * This code is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/interrupt.h>
+#include <linux/interrupt.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/spi/spi.h>
+#include <linux/spi/flash.h>
+#include <asm/semaphore.h>
+/* NOTE: AT 25F and SST 25LF series are very similar,
+ * but commands for sector erase and chip id differ...
+ */
+#define FLASH_PAGESIZE          256
+/* Flash opcodes. */
+#define OPCODE_WREN             6       /* Write enable */
+#define OPCODE_RDSR             5       /* Read status register */
+#define OPCODE_READ             3       /* Read data bytes */
+#define OPCODE_PP               2       /* Page program */
+#define OPCODE_SE               0xd8    /* Sector erase */
+#define OPCODE_RES              0xab    /* Read Electronic Signature */
+#define OPCODE_RDID             0x9f    /* Read JEDEC ID */
+/* Status Register bits. */
+#define SR_WIP                  1       /* Write in progress */
+#define SR_WEL                  2       /* Write enable latch */
+#define SR_BP0                  4       /* Block protect 0 */
+#define SR_BP1                  8       /* Block protect 1 */
+#define SR_BP2                  0x10    /* Block protect 2 */
+#define SR_SRWD                 0x80    /* SR write protect */
+/* Define max times to check status register before we give up. */
+#define MAX_READY_WAIT_COUNT    100000
+#ifdef CONFIG_MTD_PARTITIONS
+#define mtd_has_partitions()    (1)
+#else
+#define mtd_has_partitions()    (0)
+#endif
+/****************************************************************************/
+struct m25p {
+        struct spi_device       *spi;
+        struct semaphore        lock;
+        struct mtd_info         mtd;
+        unsigned                partitioned;
+        u8                      command[4];
+};
+static inline struct m25p *mtd_to_m25p(struct mtd_info *mtd)
+{
+        return container_of(mtd, struct m25p, mtd);
+}
+/****************************************************************************/
+/*
+ * Internal helper functions
+ */
+/*
+ * Read the status register, returning its value in the location
+ * Return the status register value.
+ * Returns negative if error occurred.
+ */
+static int read_sr(struct m25p *flash)
+{
+        ssize_t retval;
+        u8 code = OPCODE_RDSR;
+        u8 val;
+        retval = spi_write_then_read(flash->spi, &code, 1, &val, 1);
+        if (retval < 0) {
+                dev_err(&flash->spi->dev, "error %d reading SR\n",
+                                (int) retval);
+                return retval;
+        }
+        return val;
+}
+/*
+ * Set write enable latch with Write Enable command.
+ * Returns negative if error occurred.
+ */
+static inline int write_enable(struct m25p *flash)
+{
+        u8      code = OPCODE_WREN;
+        return spi_write_then_read(flash->spi, &code, 1, NULL, 0);
+}
+/*
+ * Service routine to read status register until ready, or timeout occurs.
+ * Returns non-zero if error.
+ */
+static int wait_till_ready(struct m25p *flash)
+{
+        int count;
+        int sr;
+        /* one chip guarantees max 5 msec wait here after page writes,
+         * but potentially three seconds (!) after page erase.
+         */
+        for (count = 0; count < MAX_READY_WAIT_COUNT; count++) {
+                if ((sr = read_sr(flash)) < 0)
+                        break;
+                else if (!(sr & SR_WIP))
+                        return 0;
+                /* REVISIT sometimes sleeping would be best */
+        }
+        return 1;
+}
+/*
+ * Erase one sector of flash memory at offset ``offset'' which is any
+ * address within the sector which should be erased.
+ *
+ * Returns 0 if successful, non-zero otherwise.
+ */
+static int erase_sector(struct m25p *flash, u32 offset)
+{
+        DEBUG(MTD_DEBUG_LEVEL3, "%s: %s at 0x%08x\n", flash->spi->dev.bus_id,
+                        __FUNCTION__, offset);
+        /* Wait until finished previous write command. */
+        if (wait_till_ready(flash))
+                return 1;
+        /* Send write enable, then erase commands. */
+        write_enable(flash);
+        /* Set up command buffer. */
+        flash->command[0] = OPCODE_SE;
+        flash->command[1] = offset >> 16;
+        flash->command[2] = offset >> 8;
+        flash->command[3] = offset;
+        spi_write(flash->spi, flash->command, sizeof(flash->command));
+        return 0;
+}
+/****************************************************************************/
+/*
+ * MTD implementation
+ */
+/*
+ * Erase an address range on the flash chip.  The address range may extend
+ * one or more erase sectors.  Return an error is there is a problem erasing.
+ */
+static int m25p80_erase(struct mtd_info *mtd, struct erase_info *instr)
+{
+        struct m25p *flash = mtd_to_m25p(mtd);
+        u32 addr,len;
+        DEBUG(MTD_DEBUG_LEVEL2, "%s: %s %s 0x%08x, len %zd\n",
+                        flash->spi->dev.bus_id, __FUNCTION__, "at",
+                        (u32)instr->addr, instr->len);
+        /* sanity checks */
+        if (instr->addr + instr->len > flash->mtd.size)
+                return -EINVAL;
+        if ((instr->addr % mtd->erasesize) != 0
+                        || (instr->len % mtd->erasesize) != 0) {
+                return -EINVAL;
+        }
+        addr = instr->addr;
+        len = instr->len;
+        down(&flash->lock);
+        /* now erase those sectors */
+        while (len) {
+                if (erase_sector(flash, addr)) {
+                        instr->state = MTD_ERASE_FAILED;
+                        up(&flash->lock);
+                        return -EIO;
+                }
+                addr += mtd->erasesize;
+                len -= mtd->erasesize;
+        }
+        up(&flash->lock);
+        instr->state = MTD_ERASE_DONE;
+        mtd_erase_callback(instr);
+        return 0;
+}
+/*
+ * Read an address range from the flash chip.  The address range
+ * may be any size provided it is within the physical boundaries.
+ */
+static int m25p80_read(struct mtd_info *mtd, loff_t from, size_t len,
+        size_t *retlen, u_char *buf)
+{
+        struct m25p *flash = mtd_to_m25p(mtd);
+        struct spi_transfer t[2];
+        struct spi_message m;
+        DEBUG(MTD_DEBUG_LEVEL2, "%s: %s %s 0x%08x, len %zd\n",
+                        flash->spi->dev.bus_id, __FUNCTION__, "from",
+                        (u32)from, len);
+        /* sanity checks */
+        if (!len)
+                return 0;
+        if (from + len > flash->mtd.size)
+                return -EINVAL;
+        spi_message_init(&m);
+        memset(t, 0, (sizeof t));
+        t[0].tx_buf = flash->command;
+        t[0].len = sizeof(flash->command);
+        spi_message_add_tail(&t[0], &m);
+        t[1].rx_buf = buf;
+        t[1].len = len;
+        spi_message_add_tail(&t[1], &m);
+        /* Byte count starts at zero. */
+        if (retlen)
+                *retlen = 0;
+        down(&flash->lock);
+        /* Wait till previous write/erase is done. */
+        if (wait_till_ready(flash)) {
+                /* REVISIT status return?? */
+                up(&flash->lock);
+                return 1;
+        }
+        /* NOTE:  OPCODE_FAST_READ (if available) is faster... */
+        /* Set up the write data buffer. */
+        flash->command[0] = OPCODE_READ;
+        flash->command[1] = from >> 16;
+        flash->command[2] = from >> 8;
+        flash->command[3] = from;
+        spi_sync(flash->spi, &m);
+        *retlen = m.actual_length - sizeof(flash->command);
+        up(&flash->lock);
+        return 0;
+}
+/*
+ * Write an address range to the flash chip.  Data must be written in
+ * FLASH_PAGESIZE chunks.  The address range may be any size provided
+ * it is within the physical boundaries.
+ */
+static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
+        size_t *retlen, const u_char *buf)
+{
+        struct m25p *flash = mtd_to_m25p(mtd);
+        u32 page_offset, page_size;
+        struct spi_transfer t[2];
+        struct spi_message m;
+        DEBUG(MTD_DEBUG_LEVEL2, "%s: %s %s 0x%08x, len %zd\n",
+                        flash->spi->dev.bus_id, __FUNCTION__, "to",
+                        (u32)to, len);
+        if (retlen)
+                *retlen = 0;
+        /* sanity checks */
+        if (!len)
+                return(0);
+        if (to + len > flash->mtd.size)
+                return -EINVAL;
+        spi_message_init(&m);
+        memset(t, 0, (sizeof t));
+        t[0].tx_buf = flash->command;
+        t[0].len = sizeof(flash->command);
+        spi_message_add_tail(&t[0], &m);
+        t[1].tx_buf = buf;
+        spi_message_add_tail(&t[1], &m);
+        down(&flash->lock);
+        /* Wait until finished previous write command. */
+        if (wait_till_ready(flash))
+                return 1;
+        write_enable(flash);
+        /* Set up the opcode in the write buffer. */
+        flash->command[0] = OPCODE_PP;
+        flash->command[1] = to >> 16;
+        flash->command[2] = to >> 8;
+        flash->command[3] = to;
+        /* what page do we start with? */
+        page_offset = to % FLASH_PAGESIZE;
+        /* do all the bytes fit onto one page? */
+        if (page_offset + len <= FLASH_PAGESIZE) {
+                t[1].len = len;
+                spi_sync(flash->spi, &m);
+                *retlen = m.actual_length - sizeof(flash->command);
+        } else {
+                u32 i;
+                /* the size of data remaining on the first page */
+                page_size = FLASH_PAGESIZE - page_offset;
+                t[1].len = page_size;
+                spi_sync(flash->spi, &m);
+                *retlen = m.actual_length - sizeof(flash->command);
+                /* write everything in PAGESIZE chunks */
+                for (i = page_size; i < len; i += page_size) {
+                        page_size = len - i;
+                        if (page_size > FLASH_PAGESIZE)
+                                page_size = FLASH_PAGESIZE;
+                        /* write the next page to flash */
+                        flash->command[1] = (to + i) >> 16;
+                        flash->command[2] = (to + i) >> 8;
+                        flash->command[3] = (to + i);
+                        t[1].tx_buf = buf + i;
+                        t[1].len = page_size;
+                        wait_till_ready(flash);
+                        write_enable(flash);
+                        spi_sync(flash->spi, &m);
+                        if (retlen)
+                                *retlen += m.actual_length
+                                        - sizeof(flash->command);
+                }
+        }
+        up(&flash->lock);
+        return 0;
+}
+/****************************************************************************/
+/*
+ * SPI device driver setup and teardown
+ */
+struct flash_info {
+        char            *name;
+        u8              id;
+        u16             jedec_id;
+        unsigned        sector_size;
+        unsigned        n_sectors;
+};
+static struct flash_info __devinitdata m25p_data [] = {
+        /* REVISIT: fill in JEDEC ids, for parts that have them */
+        { "m25p05", 0x05, 0x0000, 32 * 1024, 2 },
+        { "m25p10", 0x10, 0x0000, 32 * 1024, 4 },
+        { "m25p20", 0x11, 0x0000, 64 * 1024, 4 },
+        { "m25p40", 0x12, 0x0000, 64 * 1024, 8 },
+        { "m25p80", 0x13, 0x0000, 64 * 1024, 16 },
+        { "m25p16", 0x14, 0x0000, 64 * 1024, 32 },
+        { "m25p32", 0x15, 0x0000, 64 * 1024, 64 },
+        { "m25p64", 0x16, 0x2017, 64 * 1024, 128 },
+};
+/*
+ * board specific setup should have ensured the SPI clock used here
+ * matches what the READ command supports, at least until this driver
+ * understands FAST_READ (for clocks over 25 MHz).
+ */
+static int __devinit m25p_probe(struct spi_device *spi)
+{
+        struct flash_platform_data      *data;
+        struct m25p                     *flash;
+        struct flash_info               *info;
+        unsigned                        i;
+        /* Platform data helps sort out which chip type we have, as
+         * well as how this board partitions it.
+         */
+        data = spi->dev.platform_data;
+        if (!data || !data->type) {
+                /* FIXME some chips can identify themselves with RES
+                 * or JEDEC get-id commands.  Try them ...
+                 */
+                DEBUG(MTD_DEBUG_LEVEL1, "%s: no chip id\n",
+                                flash->spi->dev.bus_id);
+                return -ENODEV;
+        }
+        for (i = 0, info = m25p_data; i < ARRAY_SIZE(m25p_data); i++, info++) {
+                if (strcmp(data->type, info->name) == 0)
+                        break;
+        }
+        if (i == ARRAY_SIZE(m25p_data)) {
+                DEBUG(MTD_DEBUG_LEVEL1, "%s: unrecognized id %s\n",
+                                flash->spi->dev.bus_id, data->type);
+                return -ENODEV;
+        }
+        flash = kzalloc(sizeof *flash, SLAB_KERNEL);
+        if (!flash)
+                return -ENOMEM;
+        flash->spi = spi;
+        init_MUTEX(&flash->lock);
+        dev_set_drvdata(&spi->dev, flash);
+        if (data->name)
+                flash->mtd.name = data->name;
+        else
+                flash->mtd.name = spi->dev.bus_id;
+        flash->mtd.type = MTD_NORFLASH;
+        flash->mtd.flags = MTD_CAP_NORFLASH;
+        flash->mtd.size = info->sector_size * info->n_sectors;
+        flash->mtd.erasesize = info->sector_size;
+        flash->mtd.erase = m25p80_erase;
+        flash->mtd.read = m25p80_read;
+        flash->mtd.write = m25p80_write;
+        dev_info(&spi->dev, "%s (%d Kbytes)\n", info->name,
+                        flash->mtd.size / 1024);
+        DEBUG(MTD_DEBUG_LEVEL2,
+                "mtd .name = %s, .size = 0x%.8x (%uM) "
+                        ".erasesize = 0x%.8x (%uK) .numeraseregions = %d\n",
+                flash->mtd.name,
+                flash->mtd.size, flash->mtd.size / (1024*1024),
+                flash->mtd.erasesize, flash->mtd.erasesize / 1024,
+                flash->mtd.numeraseregions);
+        if (flash->mtd.numeraseregions)
+                for (i = 0; i < flash->mtd.numeraseregions; i++)
+                        DEBUG(MTD_DEBUG_LEVEL2,
+                                "mtd.eraseregions[%d] = { .offset = 0x%.8x, "
+                                ".erasesize = 0x%.8x (%uK), "
+                                ".numblocks = %d }\n",
+                                i, flash->mtd.eraseregions[i].offset,
+                                flash->mtd.eraseregions[i].erasesize,
+                                flash->mtd.eraseregions[i].erasesize / 1024,
+                                flash->mtd.eraseregions[i].numblocks);
+        /* partitions should match sector boundaries; and it may be good to
+         * use readonly partitions for writeprotected sectors (BP2..BP0).
+         */
+        if (mtd_has_partitions()) {
+                struct mtd_partition    *parts = NULL;
+                int                     nr_parts = 0;
+#ifdef CONFIG_MTD_CMDLINE_PARTS
+                static const char *part_probes[] = { "cmdlinepart", NULL, };
+                nr_parts = parse_mtd_partitions(&flash->mtd,
+                                part_probes, &parts, 0);
+#endif
+                if (nr_parts <= 0 && data && data->parts) {
+                        parts = data->parts;
+                        nr_parts = data->nr_parts;
+                }
+                if (nr_parts > 0) {
+                        for (i = 0; i < data->nr_parts; i++) {
+                                DEBUG(MTD_DEBUG_LEVEL2, "partitions[%d] = "
+                                        "{.name = %s, .offset = 0x%.8x, "
+                                                ".size = 0x%.8x (%uK) }\n",
+                                        i, data->parts[i].name,
+                                        data->parts[i].offset,
+                                        data->parts[i].size,
+                                        data->parts[i].size / 1024);
+                        }
+                        flash->partitioned = 1;
+                        return add_mtd_partitions(&flash->mtd, parts, nr_parts);
+                }
+        } else if (data->nr_parts)
+                dev_warn(&spi->dev, "ignoring %d default partitions on %s\n",
+                                data->nr_parts, data->name);
+        return add_mtd_device(&flash->mtd) == 1 ? -ENODEV : 0;
+}
+static int __devexit m25p_remove(struct spi_device *spi)
+{
+        struct m25p     *flash = dev_get_drvdata(&spi->dev);
+        int             status;
+        /* Clean up MTD stuff. */
+        if (mtd_has_partitions() && flash->partitioned)
+                status = del_mtd_partitions(&flash->mtd);
+        else
+                status = del_mtd_device(&flash->mtd);
+        if (status == 0)
+                kfree(flash);
+        return 0;
+}
+static struct spi_driver m25p80_driver = {
+        .driver = {
+                .name   = "m25p80",
+                .bus    = &spi_bus_type,
+                .owner  = THIS_MODULE,
+        },
+        .probe  = m25p_probe,
+        .remove = __devexit_p(m25p_remove),
+};
+static int m25p80_init(void)
+{
+        return spi_register_driver(&m25p80_driver);
+}
+static void m25p80_exit(void)
+{
+        spi_unregister_driver(&m25p80_driver);
+}
+module_init(m25p80_init);
+module_exit(m25p80_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Mike Lavender");
+MODULE_DESCRIPTION("MTD SPI driver for ST M25Pxx flash chips");
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
new file mode 100644
index 000000000000..155737e7483f
--- /dev/null
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -0,0 +1,629 @@
+/*
+ * Atmel AT45xxx DataFlash MTD driver for lightweight SPI framework
+ *
+ * Largely derived from at91_dataflash.c:
+ *  Copyright (C) 2003-2005 SAN People (Pty) Ltd
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+*/
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/spi/spi.h>
+#include <linux/spi/flash.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+/*
+ * DataFlash is a kind of SPI flash.  Most AT45 chips have two buffers in
+ * each chip, which may be used for double buffered I/O; but this driver
+ * doesn't (yet) use these for any kind of i/o overlap or prefetching.
+ *
+ * Sometimes DataFlash is packaged in MMC-format cards, although the
+ * MMC stack can't use SPI (yet), or distinguish between MMC and DataFlash
+ * protocols during enumeration.
+ */
+#define CONFIG_DATAFLASH_WRITE_VERIFY
+/* reads can bypass the buffers */
+#define OP_READ_CONTINUOUS      0xE8
+#define OP_READ_PAGE            0xD2
+/* group B requests can run even while status reports "busy" */
+#define OP_READ_STATUS          0xD7    /* group B */
+/* move data between host and buffer */
+#define OP_READ_BUFFER1         0xD4    /* group B */
+#define OP_READ_BUFFER2         0xD6    /* group B */
+#define OP_WRITE_BUFFER1        0x84    /* group B */
+#define OP_WRITE_BUFFER2        0x87    /* group B */
+/* erasing flash */
+#define OP_ERASE_PAGE           0x81
+#define OP_ERASE_BLOCK          0x50
+/* move data between buffer and flash */
+#define OP_TRANSFER_BUF1        0x53
+#define OP_TRANSFER_BUF2        0x55
+#define OP_MREAD_BUFFER1        0xD4
+#define OP_MREAD_BUFFER2        0xD6
+#define OP_MWERASE_BUFFER1      0x83
+#define OP_MWERASE_BUFFER2      0x86
+#define OP_MWRITE_BUFFER1       0x88    /* sector must be pre-erased */
+#define OP_MWRITE_BUFFER2       0x89    /* sector must be pre-erased */
+/* write to buffer, then write-erase to flash */
+#define OP_PROGRAM_VIA_BUF1     0x82
+#define OP_PROGRAM_VIA_BUF2     0x85
+/* compare buffer to flash */
+#define OP_COMPARE_BUF1         0x60
+#define OP_COMPARE_BUF2         0x61
+/* read flash to buffer, then write-erase to flash */
+#define OP_REWRITE_VIA_BUF1     0x58
+#define OP_REWRITE_VIA_BUF2     0x59
+/* newer chips report JEDEC manufacturer and device IDs; chip
+ * serial number and OTP bits; and per-sector writeprotect.
+ */
+#define OP_READ_ID              0x9F
+#define OP_READ_SECURITY        0x77
+#define OP_WRITE_SECURITY       0x9A    /* OTP bits */
+struct dataflash {
+        u8                      command[4];
+        char                    name[24];
+        unsigned                partitioned:1;
+        unsigned short          page_offset;    /* offset in flash address */
+        unsigned int            page_size;      /* of bytes per page */
+        struct semaphore        lock;
+        struct spi_device       *spi;
+        struct mtd_info         mtd;
+};
+#ifdef CONFIG_MTD_PARTITIONS
+#define mtd_has_partitions()    (1)
+#else
+#define mtd_has_partitions()    (0)
+#endif
+/* ......................................................................... */
+/*
+ * Return the status of the DataFlash device.
+ */
+static inline int dataflash_status(struct spi_device *spi)
+{
+        /* NOTE:  at45db321c over 25 MHz wants to write
+         * a dummy byte after the opcode...
+         */
+        return spi_w8r8(spi, OP_READ_STATUS);
+}
+/*
+ * Poll the DataFlash device until it is READY.
+ * This usually takes 5-20 msec or so; more for sector erase.
+ */
+static int dataflash_waitready(struct spi_device *spi)
+{
+        int     status;
+        for (;;) {
+                status = dataflash_status(spi);
+                if (status < 0) {
+                        DEBUG(MTD_DEBUG_LEVEL1, "%s: status %d?\n",
+                                        spi->dev.bus_id, status);
+                        status = 0;
+                }
+                if (status & (1 << 7))  /* RDY/nBSY */
+                        return status;
+                msleep(3);
+        }
+}
+/* ......................................................................... */
+/*
+ * Erase pages of flash.
+ */
+static int dataflash_erase(struct mtd_info *mtd, struct erase_info *instr)
+{
+        struct dataflash        *priv = (struct dataflash *)mtd->priv;
+        struct spi_device       *spi = priv->spi;
+        struct spi_transfer     x = { .tx_dma = 0, };
+        struct spi_message      msg;
+        unsigned                blocksize = priv->page_size << 3;
+        u8                      *command;
+        DEBUG(MTD_DEBUG_LEVEL2, "%s: erase addr=0x%x len 0x%x\n",
+                        spi->dev.bus_id,
+                        instr->addr, instr->len);
+        /* Sanity checks */
+        if ((instr->addr + instr->len) > mtd->size
+                        || (instr->len % priv->page_size) != 0
+                        || (instr->addr % priv->page_size) != 0)
+                return -EINVAL;
+        spi_message_init(&msg);
+        x.tx_buf = command = priv->command;
+        x.len = 4;
+        spi_message_add_tail(&x, &msg);
+        down(&priv->lock);
+        while (instr->len > 0) {
+                unsigned int    pageaddr;
+                int             status;
+                int             do_block;
+                /* Calculate flash page address; use block erase (for speed) if
+                 * we're at a block boundary and need to erase the whole block.
+                 */
+                pageaddr = instr->addr / priv->page_size;
+                do_block = (pageaddr & 0x7) == 0 && instr->len <= blocksize;
+                pageaddr = pageaddr << priv->page_offset;
+                command[0] = do_block ? OP_ERASE_BLOCK : OP_ERASE_PAGE;
+                command[1] = (u8)(pageaddr >> 16);
+                command[2] = (u8)(pageaddr >> 8);
+                command[3] = 0;
+                DEBUG(MTD_DEBUG_LEVEL3, "ERASE %s: (%x) %x %x %x [%i]\n",
+                        do_block ? "block" : "page",
+                        command[0], command[1], command[2], command[3],
+                        pageaddr);
+                status = spi_sync(spi, &msg);
+                (void) dataflash_waitready(spi);
+                if (status < 0) {
+                        printk(KERN_ERR "%s: erase %x, err %d\n",
+                                spi->dev.bus_id, pageaddr, status);
+                        /* REVISIT:  can retry instr->retries times; or
+                         * giveup and instr->fail_addr = instr->addr;
+                         */
+                        continue;
+                }
+                if (do_block) {
+                        instr->addr += blocksize;
+                        instr->len -= blocksize;
+                } else {
+                        instr->addr += priv->page_size;
+                        instr->len -= priv->page_size;
+                }
+        }
+        up(&priv->lock);
+        /* Inform MTD subsystem that erase is complete */
+        instr->state = MTD_ERASE_DONE;
+        mtd_erase_callback(instr);
+        return 0;
+}
+/*
+ * Read from the DataFlash device.
+ *   from   : Start offset in flash device
+ *   len    : Amount to read
+ *   retlen : About of data actually read
+ *   buf    : Buffer containing the data
+ */
+static int dataflash_read(struct mtd_info *mtd, loff_t from, size_t len,
+                               size_t *retlen, u_char *buf)
+{
+        struct dataflash        *priv = (struct dataflash *)mtd->priv;
+        struct spi_transfer     x[2] = { { .tx_dma = 0, }, };
+        struct spi_message      msg;
+        unsigned int            addr;
+        u8                      *command;
+        int                     status;
+        DEBUG(MTD_DEBUG_LEVEL2, "%s: read 0x%x..0x%x\n",
+                priv->spi->dev.bus_id, (unsigned)from, (unsigned)(from + len));
+        *retlen = 0;
+        /* Sanity checks */
+        if (!len)
+                return 0;
+        if (from + len > mtd->size)
+                return -EINVAL;
+        /* Calculate flash page/byte address */
+        addr = (((unsigned)from / priv->page_size) << priv->page_offset)
+                + ((unsigned)from % priv->page_size);
+        command = priv->command;
+        DEBUG(MTD_DEBUG_LEVEL3, "READ: (%x) %x %x %x\n",
+                command[0], command[1], command[2], command[3]);
+        spi_message_init(&msg);
+        x[0].tx_buf = command;
+        x[0].len = 8;
+        spi_message_add_tail(&x[0], &msg);
+        x[1].rx_buf = buf;
+        x[1].len = len;
+        spi_message_add_tail(&x[1], &msg);
+        down(&priv->lock);
+        /* Continuous read, max clock = f(car) which may be less than
+         * the peak rate available.  Some chips support commands with
+         * fewer "don't care" bytes.  Both buffers stay unchanged.
+         */
+        command[0] = OP_READ_CONTINUOUS;
+        command[1] = (u8)(addr >> 16);
+        command[2] = (u8)(addr >> 8);
+        command[3] = (u8)(addr >> 0);
+        /* plus 4 "don't care" bytes */
+        status = spi_sync(priv->spi, &msg);
+        up(&priv->lock);
+        if (status >= 0) {
+                *retlen = msg.actual_length - 8;
+                status = 0;
+        } else
+                DEBUG(MTD_DEBUG_LEVEL1, "%s: read %x..%x --> %d\n",
+                        priv->spi->dev.bus_id,
+                        (unsigned)from, (unsigned)(from + len),
+                        status);
+        return status;
+}
+/*
+ * Write to the DataFlash device.
+ *   to     : Start offset in flash device
+ *   len    : Amount to write
+ *   retlen : Amount of data actually written
+ *   buf    : Buffer containing the data
+ */
+static int dataflash_write(struct mtd_info *mtd, loff_t to, size_t len,
+                                size_t * retlen, const u_char * buf)
+{
+        struct dataflash        *priv = (struct dataflash *)mtd->priv;
+        struct spi_device       *spi = priv->spi;
+        struct spi_transfer     x[2] = { { .tx_dma = 0, }, };
+        struct spi_message      msg;
+        unsigned int            pageaddr, addr, offset, writelen;
+        size_t                  remaining = len;
+        u_char                  *writebuf = (u_char *) buf;
+        int                     status = -EINVAL;
+        u8                      *command;
+        DEBUG(MTD_DEBUG_LEVEL2, "%s: write 0x%x..0x%x\n",
+                spi->dev.bus_id, (unsigned)to, (unsigned)(to + len));
+        *retlen = 0;
+        /* Sanity checks */
+        if (!len)
+                return 0;
+        if ((to + len) > mtd->size)
+                return -EINVAL;
+        spi_message_init(&msg);
+        x[0].tx_buf = command = priv->command;
+        x[0].len = 4;
+        spi_message_add_tail(&x[0], &msg);
+        pageaddr = ((unsigned)to / priv->page_size);
+        offset = ((unsigned)to % priv->page_size);
+        if (offset + len > priv->page_size)
+                writelen = priv->page_size - offset;
+        else
+                writelen = len;
+        down(&priv->lock);
+        while (remaining > 0) {
+                DEBUG(MTD_DEBUG_LEVEL3, "write @ %i:%i len=%i\n",
+                        pageaddr, offset, writelen);
+                /* REVISIT:
+                 * (a) each page in a sector must be rewritten at least
+                 *     once every 10K sibling erase/program operations.
+                 * (b) for pages that are already erased, we could
+                 *     use WRITE+MWRITE not PROGRAM for ~30% speedup.
+                 * (c) WRITE to buffer could be done while waiting for
+                 *     a previous MWRITE/MWERASE to complete ...
+                 * (d) error handling here seems to be mostly missing.
+                 *
+                 * Two persistent bits per page, plus a per-sector counter,
+                 * could support (a) and (b) ... we might consider using
+                 * the second half of sector zero, which is just one block,
+                 * to track that state.  (On AT91, that sector should also
+                 * support boot-from-DataFlash.)
+                 */
+                addr = pageaddr << priv->page_offset;
+                /* (1) Maybe transfer partial page to Buffer1 */
+                if (writelen != priv->page_size) {
+                        command[0] = OP_TRANSFER_BUF1;
+                        command[1] = (addr & 0x00FF0000) >> 16;
+                        command[2] = (addr & 0x0000FF00) >> 8;
+                        command[3] = 0;
+                        DEBUG(MTD_DEBUG_LEVEL3, "TRANSFER: (%x) %x %x %x\n",
+                                command[0], command[1], command[2], command[3]);
+                        status = spi_sync(spi, &msg);
+                        if (status < 0)
+                                DEBUG(MTD_DEBUG_LEVEL1, "%s: xfer %u -> %d \n",
+                                        spi->dev.bus_id, addr, status);
+                        (void) dataflash_waitready(priv->spi);
+                }
+                /* (2) Program full page via Buffer1 */
+                addr += offset;
+                command[0] = OP_PROGRAM_VIA_BUF1;
+                command[1] = (addr & 0x00FF0000) >> 16;
+                command[2] = (addr & 0x0000FF00) >> 8;
+                command[3] = (addr & 0x000000FF);
+                DEBUG(MTD_DEBUG_LEVEL3, "PROGRAM: (%x) %x %x %x\n",
+                        command[0], command[1], command[2], command[3]);
+                x[1].tx_buf = writebuf;
+                x[1].len = writelen;
+                spi_message_add_tail(x + 1, &msg);
+                status = spi_sync(spi, &msg);
+                spi_transfer_del(x + 1);
+                if (status < 0)
+                        DEBUG(MTD_DEBUG_LEVEL1, "%s: pgm %u/%u -> %d \n",
+                                spi->dev.bus_id, addr, writelen, status);
+                (void) dataflash_waitready(priv->spi);
+#ifdef  CONFIG_DATAFLASH_WRITE_VERIFY
+                /* (3) Compare to Buffer1 */
+                addr = pageaddr << priv->page_offset;
+                command[0] = OP_COMPARE_BUF1;
+                command[1] = (addr & 0x00FF0000) >> 16;
+                command[2] = (addr & 0x0000FF00) >> 8;
+                command[3] = 0;
+                DEBUG(MTD_DEBUG_LEVEL3, "COMPARE: (%x) %x %x %x\n",
+                        command[0], command[1], command[2], command[3]);
+                status = spi_sync(spi, &msg);
+                if (status < 0)
+                        DEBUG(MTD_DEBUG_LEVEL1, "%s: compare %u -> %d \n",
+                                spi->dev.bus_id, addr, status);
+                status = dataflash_waitready(priv->spi);
+                /* Check result of the compare operation */
+                if ((status & (1 << 6)) == 1) {
+                        printk(KERN_ERR "%s: compare page %u, err %d\n",
+                                spi->dev.bus_id, pageaddr, status);
+                        remaining = 0;
+                        status = -EIO;
+                        break;
+                } else
+                        status = 0;
+#endif  /* CONFIG_DATAFLASH_WRITE_VERIFY */
+                remaining = remaining - writelen;
+                pageaddr++;
+                offset = 0;
+                writebuf += writelen;
+                *retlen += writelen;
+                if (remaining > priv->page_size)
+                        writelen = priv->page_size;
+                else
+                        writelen = remaining;
+        }
+        up(&priv->lock);
+        return status;
+}
+/* ......................................................................... */
+/*
+ * Register DataFlash device with MTD subsystem.
+ */
+static int __devinit
+add_dataflash(struct spi_device *spi, char *name,
+                int nr_pages, int pagesize, int pageoffset)
+{
+        struct dataflash                *priv;
+        struct mtd_info                 *device;
+        struct flash_platform_data      *pdata = spi->dev.platform_data;
+        priv = (struct dataflash *) kzalloc(sizeof *priv, GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+        init_MUTEX(&priv->lock);
+        priv->spi = spi;
+        priv->page_size = pagesize;
+        priv->page_offset = pageoffset;
+        /* name must be usable with cmdlinepart */
+        sprintf(priv->name, "spi%d.%d-%s",
+                        spi->master->bus_num, spi->chip_select,
+                        name);
+        device = &priv->mtd;
+        device->name = (pdata && pdata->name) ? pdata->name : priv->name;
+        device->size = nr_pages * pagesize;
+        device->erasesize = pagesize;
+        device->owner = THIS_MODULE;
+        device->type = MTD_DATAFLASH;
+        device->flags = MTD_CAP_NORFLASH;
+        device->erase = dataflash_erase;
+        device->read = dataflash_read;
+        device->write = dataflash_write;
+        device->priv = priv;
+        dev_info(&spi->dev, "%s (%d KBytes)\n", name, device->size/1024);
+        dev_set_drvdata(&spi->dev, priv);
+        if (mtd_has_partitions()) {
+                struct mtd_partition    *parts;
+                int                     nr_parts = 0;
+#ifdef CONFIG_MTD_CMDLINE_PARTS
+                static const char *part_probes[] = { "cmdlinepart", NULL, };
+                nr_parts = parse_mtd_partitions(device, part_probes, &parts, 0);
+#endif
+                if (nr_parts <= 0 && pdata && pdata->parts) {
+                        parts = pdata->parts;
+                        nr_parts = pdata->nr_parts;
+                }
+                if (nr_parts > 0) {
+                        priv->partitioned = 1;
+                        return add_mtd_partitions(device, parts, nr_parts);
+                }
+        } else if (pdata && pdata->nr_parts)
+                dev_warn(&spi->dev, "ignoring %d default partitions on %s\n",
+                                pdata->nr_parts, device->name);
+        return add_mtd_device(device) == 1 ? -ENODEV : 0;
+}
+/*
+ * Detect and initialize DataFlash device:
+ *
+ *   Device      Density         ID code          #Pages PageSize  Offset
+ *   AT45DB011B  1Mbit   (128K)  xx0011xx (0x0c)    512    264      9
+ *   AT45DB021B  2Mbit   (256K)  xx0101xx (0x14)   1025    264      9
+ *   AT45DB041B  4Mbit   (512K)  xx0111xx (0x1c)   2048    264      9
+ *   AT45DB081B  8Mbit   (1M)    xx1001xx (0x24)   4096    264      9
+ *   AT45DB0161B 16Mbit  (2M)    xx1011xx (0x2c)   4096    528     10
+ *   AT45DB0321B 32Mbit  (4M)    xx1101xx (0x34)   8192    528     10
+ *   AT45DB0642  64Mbit  (8M)    xx111xxx (0x3c)   8192   1056     11
+ *   AT45DB1282  128Mbit (16M)   xx0100xx (0x10)  16384   1056     11
+ */
+static int __devinit dataflash_probe(struct spi_device *spi)
+{
+        int status;
+        status = dataflash_status(spi);
+        if (status <= 0 || status == 0xff) {
+                DEBUG(MTD_DEBUG_LEVEL1, "%s: status error %d\n",
+                                spi->dev.bus_id, status);
+                if (status == 0xff)
+                        status = -ENODEV;
+                return status;
+        }
+        /* if there's a device there, assume it's dataflash.
+         * board setup should have set spi->max_speed_max to
+         * match f(car) for continuous reads, mode 0 or 3.
+         */
+        switch (status & 0x3c) {
+        case 0x0c:      /* 0 0 1 1 x x */
+                status = add_dataflash(spi, "AT45DB011B", 512, 264, 9);
+                break;
+        case 0x14:      /* 0 1 0 1 x x */
+                status = add_dataflash(spi, "AT45DB021B", 1025, 264, 9);
+                break;
+        case 0x1c:      /* 0 1 1 1 x x */
+                status = add_dataflash(spi, "AT45DB041x", 2048, 264, 9);
+                break;
+        case 0x24:      /* 1 0 0 1 x x */
+                status = add_dataflash(spi, "AT45DB081B", 4096, 264, 9);
+                break;
+        case 0x2c:      /* 1 0 1 1 x x */
+                status = add_dataflash(spi, "AT45DB161x", 4096, 528, 10);
+                break;
+        case 0x34:      /* 1 1 0 1 x x */
+                status = add_dataflash(spi, "AT45DB321x", 8192, 528, 10);
+                break;
+        case 0x38:      /* 1 1 1 x x x */
+        case 0x3c:
+                status = add_dataflash(spi, "AT45DB642x", 8192, 1056, 11);
+                break;
+        /* obsolete AT45DB1282 not (yet?) supported */
+        default:
+                DEBUG(MTD_DEBUG_LEVEL1, "%s: unsupported device (%x)\n",
+                                spi->dev.bus_id, status & 0x3c);
+                status = -ENODEV;
+        }
+        if (status < 0)
+                DEBUG(MTD_DEBUG_LEVEL1, "%s: add_dataflash --> %d\n",
+                                spi->dev.bus_id, status);
+        return status;
+}
+static int __devexit dataflash_remove(struct spi_device *spi)
+{
+        struct dataflash        *flash = dev_get_drvdata(&spi->dev);
+        int                     status;
+        DEBUG(MTD_DEBUG_LEVEL1, "%s: remove\n", spi->dev.bus_id);
+        if (mtd_has_partitions() && flash->partitioned)
+                status = del_mtd_partitions(&flash->mtd);
+        else
+                status = del_mtd_device(&flash->mtd);
+        if (status == 0)
+                kfree(flash);
+        return status;
+}
+static struct spi_driver dataflash_driver = {
+        .driver = {
+                .name           = "mtd_dataflash",
+                .bus            = &spi_bus_type,
+                .owner          = THIS_MODULE,
+        },
+        .probe          = dataflash_probe,
+        .remove         = __devexit_p(dataflash_remove),
+        /* FIXME:  investigate suspend and resume... */
+};
+static int __init dataflash_init(void)
+{
+        return spi_register_driver(&dataflash_driver);
+}
+module_init(dataflash_init);
+static void __exit dataflash_exit(void)
+{
+        spi_unregister_driver(&dataflash_driver);
+}
+module_exit(dataflash_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Andrew Victor, David Brownell");
+MODULE_DESCRIPTION("MTD DataFlash driver");
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 854ddfb90da1..f2a63186ae05 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -169,9 +169,9 @@ static void tlb_clear_slave(struct bonding *bond, struct slave *slave, int save_
                index = next_index;
        }
-        _unlock_tx_hashtbl(bond);
        tlb_init_slave(slave);
+        _unlock_tx_hashtbl(bond);
 }
 /* Must be called before starting the monitor timer */
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index f20bb85c1ea5..3dd78d048c3e 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -22,8 +22,8 @@
 #include "bond_3ad.h"
 #include "bond_alb.h"
-#define DRV_VERSION     "3.0.0"
+#define DRV_VERSION     "3.0.1"
-#define DRV_RELDATE     "November 8, 2005"
+#define DRV_RELDATE     "January 9, 2006"
 #define DRV_NAME        "bonding"
 #define DRV_DESCRIPTION "Ethernet Channel Bonding Driver"
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 22cd04556707..23de22631c64 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -132,6 +132,10 @@
 *      TODO:
 *      o several entry points race with dev->close
 *      o check for tx-no-resources/stop Q races with tx clean/wake Q
+ *
+ *      FIXES:
+ * 2005/12/02 - Michael O'Donnell <Michael.ODonnell at stratus dot com>
+ *      - Stratus87247: protect MDI control register manipulations
 */
 #include <linux/config.h>
@@ -578,6 +582,7 @@ struct nic {
        u16 leds;
        u16 eeprom_wc;
        u16 eeprom[256];
+        spinlock_t mdio_lock;
 };
 static inline void e100_write_flush(struct nic *nic)
@@ -876,15 +881,35 @@ static u16 mdio_ctrl(struct nic *nic, u32 addr, u32 dir, u32 reg, u16 data)
 {
        u32 data_out = 0;
        unsigned int i;
+        unsigned long flags;
+        /*
+         * Stratus87247: we shouldn't be writing the MDI control
+         * register until the Ready bit shows True.  Also, since
+         * manipulation of the MDI control registers is a multi-step
+         * procedure it should be done under lock.
+         */
+        spin_lock_irqsave(&nic->mdio_lock, flags);
+        for (i = 100; i; --i) {
+                if (readl(&nic->csr->mdi_ctrl) & mdi_ready)
+                        break;
+                udelay(20);
+        }
+        if (unlikely(!i)) {
+                printk("e100.mdio_ctrl(%s) won't go Ready\n",
+                        nic->netdev->name );
+                spin_unlock_irqrestore(&nic->mdio_lock, flags);
+                return 0;               /* No way to indicate timeout error */
+        }
        writel((reg << 16) | (addr << 21) | dir | data, &nic->csr->mdi_ctrl);
-        for(i = 0; i < 100; i++) {
+        for (i = 0; i < 100; i++) {
                udelay(20);
-                if((data_out = readl(&nic->csr->mdi_ctrl)) & mdi_ready)
+                if ((data_out = readl(&nic->csr->mdi_ctrl)) & mdi_ready)
                        break;
        }
+        spin_unlock_irqrestore(&nic->mdio_lock, flags);
        DPRINTK(HW, DEBUG,
                "%s:addr=%d, reg=%d, data_in=0x%04X, data_out=0x%04X\n",
                dir == mdi_read ? "READ" : "WRITE", addr, reg, data, data_out);
@@ -2562,6 +2587,7 @@ static int __devinit e100_probe(struct pci_dev *pdev,
        /* locks must be initialized before calling hw_reset */
        spin_lock_init(&nic->cb_lock);
        spin_lock_init(&nic->cmd_lock);
+        spin_lock_init(&nic->mdio_lock);
        /* Reset the device before pci_set_master() in case device is in some
         * funky state and has an interrupt pending - hint: we don't have the
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 146f9513aea5..0c18dbd67d3b 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -84,6 +84,7 @@
 #include <linux/ip.h>
 #include <linux/tcp.h>
 #include <linux/udp.h>
+#include <linux/in.h>
 #include <asm/io.h>
 #include <asm/irq.h>
@@ -398,12 +399,15 @@ static int init_phy(struct net_device *dev)
                priv->einfo->device_flags & FSL_GIANFAR_DEV_HAS_GIGABIT ?
                SUPPORTED_1000baseT_Full : 0;
        struct phy_device *phydev;
+        char phy_id[BUS_ID_SIZE];
        priv->oldlink = 0;
        priv->oldspeed = 0;
        priv->oldduplex = -1;
-        phydev = phy_connect(dev, priv->einfo->bus_id, &adjust_link, 0);
+        snprintf(phy_id, BUS_ID_SIZE, PHY_ID_FMT, priv->einfo->bus_id, priv->einfo->phy_id);
+        phydev = phy_connect(dev, phy_id, &adjust_link, 0);
        if (IS_ERR(phydev)) {
                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
diff --git a/drivers/net/gianfar_mii.c b/drivers/net/gianfar_mii.c
index 04a462c2a5b7..74e52fcbf806 100644
--- a/drivers/net/gianfar_mii.c
+++ b/drivers/net/gianfar_mii.c
@@ -128,6 +128,7 @@ int gfar_mdio_probe(struct device *dev)
        struct gianfar_mdio_data *pdata;
        struct gfar_mii *regs;
        struct mii_bus *new_bus;
+        struct resource *r;
        int err = 0;
        if (NULL == dev)
@@ -151,8 +152,10 @@ int gfar_mdio_probe(struct device *dev)
                return -ENODEV;
        }
+        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        /* Set the PHY base address */
-        regs = (struct gfar_mii *) ioremap(pdata->paddr, 
+        regs = (struct gfar_mii *) ioremap(r->start,
                        sizeof (struct gfar_mii));
        if (NULL == regs) {
diff --git a/drivers/net/hplance.c b/drivers/net/hplance.c
index 08703d6f934c..d8410634bcaf 100644
--- a/drivers/net/hplance.c
+++ b/drivers/net/hplance.c
@@ -150,7 +150,7 @@ static void __init hplance_init(struct net_device *dev, struct dio_dev *d)
        lp->lance.name = (char*)d->name;                /* discards const, shut up gcc */
        lp->lance.base = va;
        lp->lance.init_block = (struct lance_init_block *)(va + HPLANCE_MEMOFF); /* CPU addr */
-        lp->lance.lance_init_block = 0;                 /* LANCE addr of same RAM */
+        lp->lance.lance_init_block = NULL;              /* LANCE addr of same RAM */
        lp->lance.busmaster_regval = LE_C3_BSWP;        /* we're bigendian */
        lp->lance.irq = d->ipl;
        lp->lance.writerap = hplance_writerap;
diff --git a/drivers/net/iseries_veth.c b/drivers/net/iseries_veth.c
index 77eadf84cb2c..f0f04be989d6 100644
--- a/drivers/net/iseries_veth.c
+++ b/drivers/net/iseries_veth.c
@@ -590,9 +590,9 @@ static void veth_handle_event(struct HvLpEvent *event, struct pt_regs *regs)
 {
        struct veth_lpevent *veth_event = (struct veth_lpevent *)event;
-        if (event->xFlags.xFunction == HvLpEvent_Function_Ack)
+        if (hvlpevent_is_ack(event))
                veth_handle_ack(veth_event);
-        else if (event->xFlags.xFunction == HvLpEvent_Function_Int)
+        else
                veth_handle_int(veth_event);
 }
diff --git a/drivers/net/mac8390.c b/drivers/net/mac8390.c
index d8c99f038fa0..06cb460361a8 100644
--- a/drivers/net/mac8390.c
+++ b/drivers/net/mac8390.c
@@ -559,55 +559,52 @@ static void mac8390_no_reset(struct net_device *dev)
 /* directly from daynaport.c by Alan Cox */
 static void dayna_memcpy_fromcard(struct net_device *dev, void *to, int from, int count)
 {
-        volatile unsigned short *ptr;
+        volatile unsigned char *ptr;
-        unsigned short *target=to;
+        unsigned char *target=to;
        from<<=1;       /* word, skip overhead */
-        ptr=(unsigned short *)(dev->mem_start+from);
+        ptr=(unsigned char *)(dev->mem_start+from);
        /* Leading byte? */
        if (from&2) {
-                *((char *)target)++ = *(((char *)ptr++)-1);
+                *target++ = ptr[-1];
+                ptr += 2;
                count--;
        }
        while(count>=2)
        {
-                *target++=*ptr++;       /* Copy and */
+                *(unsigned short *)target = *(unsigned short volatile *)ptr;
-                ptr++;                  /* skip cruft */
+                ptr += 4;                       /* skip cruft */
+                target += 2;
                count-=2;
        }
        /* Trailing byte? */
        if(count)
-        {
+                *target = *ptr;
-                /* Big endian */
-                unsigned short v=*ptr;
-                *((char *)target)=v>>8;
-        }
 }
 static void dayna_memcpy_tocard(struct net_device *dev, int to, const void *from, int count)
 {
        volatile unsigned short *ptr;
-        const unsigned short *src=from;
+        const unsigned char *src=from;
        to<<=1; /* word, skip overhead */
        ptr=(unsigned short *)(dev->mem_start+to);
        /* Leading byte? */
        if (to&2) { /* avoid a byte write (stomps on other data) */
-                ptr[-1] = (ptr[-1]&0xFF00)|*((unsigned char *)src)++;
+                ptr[-1] = (ptr[-1]&0xFF00)|*src++;
                ptr++;
                count--;
        }
        while(count>=2)
        {
-                *ptr++=*src++;          /* Copy and */
+                *ptr++=*(unsigned short *)src;          /* Copy and */
                ptr++;                  /* skip cruft */
+                src += 2;
                count-=2;
        }
        /* Trailing byte? */
        if(count)
        {
-                /* Big endian */
-                unsigned short v=*src;
                /* card doesn't like byte writes */
-                *ptr=(*ptr&0x00FF)|(v&0xFF00);
+                *ptr=(*ptr&0x00FF)|(*src << 8);
        }
 }
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 02940c0fef68..459443b572ce 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -81,7 +81,7 @@ int mdiobus_register(struct mii_bus *bus)
                        phydev->dev.parent = bus->dev;
                        phydev->dev.bus = &mdio_bus_type;
-                        sprintf(phydev->dev.bus_id, "phy%d:%d", bus->id, i);
+                        snprintf(phydev->dev.bus_id, BUS_ID_SIZE, PHY_ID_FMT, bus->id, i);
                        phydev->bus = bus;
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index b8686e47f899..1474b7c5ac0b 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -42,7 +42,7 @@
 */
 void phy_print_status(struct phy_device *phydev)
 {
-        pr_info("%s: Link is %s", phydev->dev.bus_id,
+        pr_info("PHY: %s - Link is %s", phydev->dev.bus_id,
                        phydev->link ? "Up" : "Down");
        if (phydev->link)
                printk(" - %d/%s", phydev->speed,
diff --git a/drivers/net/sun3lance.c b/drivers/net/sun3lance.c
index 5c8fcd40ef4d..01bdb2334058 100644
--- a/drivers/net/sun3lance.c
+++ b/drivers/net/sun3lance.c
@@ -389,7 +389,7 @@ static int __init lance_probe( struct net_device *dev)
        dev->stop = &lance_close;
        dev->get_stats = &lance_get_stats;
        dev->set_multicast_list = &set_multicast_list;
-        dev->set_mac_address = 0;
+        dev->set_mac_address = NULL;
 //      KLUDGE -- REMOVE ME
        set_bit(__LINK_STATE_PRESENT, &dev->state);
diff --git a/drivers/net/tulip/uli526x.c b/drivers/net/tulip/uli526x.c
index 1a4316336256..983981666800 100644
--- a/drivers/net/tulip/uli526x.c
+++ b/drivers/net/tulip/uli526x.c
@@ -1689,9 +1689,9 @@ MODULE_AUTHOR("Peer Chen, peer.chen@uli.com.tw");
 MODULE_DESCRIPTION("ULi M5261/M5263 fast ethernet driver");
 MODULE_LICENSE("GPL");
-MODULE_PARM(debug, "i");
+module_param(debug, int, 0644);
-MODULE_PARM(mode, "i");
+module_param(mode, int, 0);
-MODULE_PARM(cr6set, "i");
+module_param(cr6set, int, 0);
 MODULE_PARM_DESC(debug, "ULi M5261/M5263 enable debugging (0-1)");
 MODULE_PARM_DESC(mode, "ULi M5261/M5263: Bit 0: 10/100Mbps, bit 2: duplex, bit 8: HomePNA");
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index 82c6b757d306..c2d5907dc8e0 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -791,7 +791,7 @@ static int __devinit velocity_found1(struct pci_dev *pdev, const struct pci_devi
 #endif
        if (vptr->flags & VELOCITY_FLAGS_TX_CSUM) {
-                dev->features |= NETIF_F_HW_CSUM;
+                dev->features |= NETIF_F_IP_CSUM;
        }
        ret = register_netdev(dev);
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 24f7967aab67..c1a6e69f7905 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -243,7 +243,7 @@ config IPW2200_DEBUG
 config AIRO
        tristate "Cisco/Aironet 34X/35X/4500/4800 ISA and PCI cards"
-        depends on NET_RADIO && ISA_DMA_API && (PCI || BROKEN)
+        depends on NET_RADIO && ISA_DMA_API && CRYPTO && (PCI || BROKEN)
        ---help---
          This is the standard Linux driver to support Cisco/Aironet ISA and
          PCI 802.11 wireless cards.
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index e4729ddf29fd..f0ccfef66445 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -1407,6 +1407,17 @@ static int atmel_close(struct net_device *dev)
 {
        struct atmel_private *priv = netdev_priv(dev);
+        /* Send event to userspace that we are disassociating */
+        if (priv->station_state == STATION_STATE_READY) {
+                union iwreq_data wrqu;
+                wrqu.data.length = 0;
+                wrqu.data.flags = 0;
+                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
+                wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
+        }
        atmel_enter_state(priv, STATION_STATE_DOWN);
        if (priv->bus_type == BUS_TYPE_PCCARD)
@@ -1780,10 +1791,10 @@ static int atmel_set_encode(struct net_device *dev,
                        priv->wep_is_on = 1;
                        priv->exclude_unencrypted = 1;
                        if (priv->wep_key_len[index] > 5) {
-                                priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
+                                priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
                                priv->encryption_level = 2;
                        } else {
-                                priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
+                                priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
                                priv->encryption_level = 1;
                        }
                }
@@ -1853,6 +1864,181 @@ static int atmel_get_encode(struct net_device *dev,
        return 0;
 }
+static int atmel_set_encodeext(struct net_device *dev,
+                            struct iw_request_info *info,
+                            union iwreq_data *wrqu,
+                            char *extra)
+{
+        struct atmel_private *priv = netdev_priv(dev);
+        struct iw_point *encoding = &wrqu->encoding;
+        struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
+        int idx, key_len;
+        /* Determine and validate the key index */
+        idx = encoding->flags & IW_ENCODE_INDEX;
+        if (idx) {
+                if (idx < 1 || idx > WEP_KEYS)
+                        return -EINVAL;
+                idx--;
+        } else
+                idx = priv->default_key;
+        if ((encoding->flags & IW_ENCODE_DISABLED) ||
+            ext->alg == IW_ENCODE_ALG_NONE) {
+                priv->wep_is_on = 0;
+                priv->encryption_level = 0;
+                priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
+        }
+        if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)
+                priv->default_key = idx;
+        /* Set the requested key */
+        switch (ext->alg) {
+        case IW_ENCODE_ALG_NONE:
+                break;
+        case IW_ENCODE_ALG_WEP:
+                if (ext->key_len > 5) {
+                        priv->wep_key_len[idx] = 13;
+                        priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
+                        priv->encryption_level = 2;
+                } else if (ext->key_len > 0) {
+                        priv->wep_key_len[idx] = 5;
+                        priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
+                        priv->encryption_level = 1;
+                } else {
+                        return -EINVAL;
+                }
+                priv->wep_is_on = 1;
+                memset(priv->wep_keys[idx], 0, 13);
+                key_len = min ((int)ext->key_len, priv->wep_key_len[idx]);
+                memcpy(priv->wep_keys[idx], ext->key, key_len);
+                break;
+        default:
+                return -EINVAL;
+        }
+        return -EINPROGRESS;
+}
+static int atmel_get_encodeext(struct net_device *dev,
+                            struct iw_request_info *info,
+                            union iwreq_data *wrqu,
+                            char *extra)
+{
+        struct atmel_private *priv = netdev_priv(dev);
+        struct iw_point *encoding = &wrqu->encoding;
+        struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
+        int idx, max_key_len;
+        max_key_len = encoding->length - sizeof(*ext);
+        if (max_key_len < 0)
+                return -EINVAL;
+        idx = encoding->flags & IW_ENCODE_INDEX;
+        if (idx) {
+                if (idx < 1 || idx > WEP_KEYS)
+                        return -EINVAL;
+                idx--;
+        } else
+                idx = priv->default_key;
+        encoding->flags = idx + 1;
+        memset(ext, 0, sizeof(*ext));
+        
+        if (!priv->wep_is_on) {
+                ext->alg = IW_ENCODE_ALG_NONE;
+                ext->key_len = 0;
+                encoding->flags |= IW_ENCODE_DISABLED;
+        } else {
+                if (priv->encryption_level > 0)
+                        ext->alg = IW_ENCODE_ALG_WEP;
+                else
+                        return -EINVAL;
+                ext->key_len = priv->wep_key_len[idx];
+                memcpy(ext->key, priv->wep_keys[idx], ext->key_len);
+                encoding->flags |= IW_ENCODE_ENABLED;
+        }
+        return 0;
+}
+static int atmel_set_auth(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+        struct atmel_private *priv = netdev_priv(dev);
+        struct iw_param *param = &wrqu->param;
+        switch (param->flags & IW_AUTH_INDEX) {
+        case IW_AUTH_WPA_VERSION:
+        case IW_AUTH_CIPHER_PAIRWISE:
+        case IW_AUTH_CIPHER_GROUP:
+        case IW_AUTH_KEY_MGMT:
+        case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+        case IW_AUTH_PRIVACY_INVOKED:
+                /*
+                 * atmel does not use these parameters
+                 */
+                break;
+        case IW_AUTH_DROP_UNENCRYPTED:
+                priv->exclude_unencrypted = param->value ? 1 : 0;
+                break;
+        case IW_AUTH_80211_AUTH_ALG: {
+                        if (param->value & IW_AUTH_ALG_SHARED_KEY) {
+                                priv->exclude_unencrypted = 1;
+                        } else if (param->value & IW_AUTH_ALG_OPEN_SYSTEM) {
+                                priv->exclude_unencrypted = 0;
+                        } else
+                                return -EINVAL;
+                        break;
+                }
+        case IW_AUTH_WPA_ENABLED:
+                /* Silently accept disable of WPA */
+                if (param->value > 0)
+                        return -EOPNOTSUPP;
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+        return -EINPROGRESS;
+}
+static int atmel_get_auth(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+        struct atmel_private *priv = netdev_priv(dev);
+        struct iw_param *param = &wrqu->param;
+        switch (param->flags & IW_AUTH_INDEX) {
+        case IW_AUTH_DROP_UNENCRYPTED:
+                param->value = priv->exclude_unencrypted;
+                break;
+        case IW_AUTH_80211_AUTH_ALG:
+                if (priv->exclude_unencrypted == 1)
+                        param->value = IW_AUTH_ALG_SHARED_KEY;
+                else
+                        param->value = IW_AUTH_ALG_OPEN_SYSTEM;
+                break;
+        case IW_AUTH_WPA_ENABLED:
+                param->value = 0;
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+        return 0;
+}
 static int atmel_get_name(struct net_device *dev,
                          struct iw_request_info *info,
                          char *cwrq,
@@ -2289,13 +2475,15 @@ static int atmel_set_wap(struct net_device *dev,
 {
        struct atmel_private *priv = netdev_priv(dev);
        int i;
-        static const u8 bcast[] = { 255, 255, 255, 255, 255, 255 };
+        static const u8 any[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
+        static const u8 off[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
        unsigned long flags;
        if (awrq->sa_family != ARPHRD_ETHER)
                return -EINVAL;
-        if (memcmp(bcast, awrq->sa_data, 6) == 0) {
+        if (!memcmp(any, awrq->sa_data, 6) ||
+            !memcmp(off, awrq->sa_data, 6)) {
                del_timer_sync(&priv->management_timer);
                spin_lock_irqsave(&priv->irqlock, flags);
                atmel_scan(priv, 1);
@@ -2378,6 +2566,15 @@ static const iw_handler atmel_handler[] =
        (iw_handler) atmel_get_encode,          /* SIOCGIWENCODE */
        (iw_handler) atmel_set_power,           /* SIOCSIWPOWER */
        (iw_handler) atmel_get_power,           /* SIOCGIWPOWER */
+        (iw_handler) NULL,                      /* -- hole -- */
+        (iw_handler) NULL,                      /* -- hole -- */
+        (iw_handler) NULL,                      /* SIOCSIWGENIE */
+        (iw_handler) NULL,                      /* SIOCGIWGENIE */
+        (iw_handler) atmel_set_auth,            /* SIOCSIWAUTH */
+        (iw_handler) atmel_get_auth,            /* SIOCGIWAUTH */
+        (iw_handler) atmel_set_encodeext,       /* SIOCSIWENCODEEXT */
+        (iw_handler) atmel_get_encodeext,       /* SIOCGIWENCODEEXT */
+        (iw_handler) NULL,                      /* SIOCSIWPMKSA */
 };
 static const iw_handler atmel_private_handler[] =
@@ -2924,6 +3121,8 @@ static void associate(struct atmel_private *priv, u16 frame_len, u16 subtype)
        u16 ass_id = le16_to_cpu(ass_resp->ass_id);
        u16 rates_len = ass_resp->length > 4 ? 4 : ass_resp->length;
+        union iwreq_data wrqu;
        if (frame_len < 8 + rates_len)
                return;
@@ -2954,6 +3153,14 @@ static void associate(struct atmel_private *priv, u16 frame_len, u16 subtype)
                priv->station_is_associated = 1;
                priv->station_was_associated = 1;
                atmel_enter_state(priv, STATION_STATE_READY);
+                /* Send association event to userspace */
+                wrqu.data.length = 0;
+                wrqu.data.flags = 0;
+                memcpy(wrqu.ap_addr.sa_data, priv->CurrentBSSID, ETH_ALEN);
+                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
                return;
        }
@@ -3632,6 +3839,7 @@ static int reset_atmel_card(struct net_device *dev)
        struct atmel_private *priv = netdev_priv(dev);
        u8 configuration;
+        int old_state = priv->station_state;
        /* data to add to the firmware names, in priority order
           this implemenents firmware versioning */
@@ -3792,6 +4000,17 @@ static int reset_atmel_card(struct net_device *dev)
        else
                build_wep_mib(priv);
+        if (old_state == STATION_STATE_READY)
+        {
+                union iwreq_data wrqu;
+                wrqu.data.length = 0;
+                wrqu.data.flags = 0;
+                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
+                wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
+        }
        return 1;
 }
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 7146b69b812c..0aa14c92b570 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -380,8 +380,6 @@ int __pci_register_driver(struct pci_driver *drv, struct module *owner)
        /* initialize common driver fields */
        drv->driver.name = drv->name;
        drv->driver.bus = &pci_bus_type;
-        drv->driver.probe = pci_device_probe;
-        drv->driver.remove = pci_device_remove;
        /* FIXME, once all of the existing PCI drivers have been fixed to set
         * the pci shutdown function, this test can go away. */
        if (!drv->driver.shutdown)
@@ -513,6 +511,8 @@ struct bus_type pci_bus_type = {
        .name           = "pci",
        .match          = pci_bus_match,
        .uevent         = pci_uevent,
+        .probe          = pci_device_probe,
+        .remove         = pci_device_remove,
        .suspend        = pci_device_suspend,
        .resume         = pci_device_resume,
        .dev_attrs      = pci_dev_attrs,
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 0252582b91cd..0a424a4e8187 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -311,8 +311,6 @@ int pcmcia_register_driver(struct pcmcia_driver *driver)
        /* initialize common fields */
        driver->drv.bus = &pcmcia_bus_type;
        driver->drv.owner = driver->owner;
-        driver->drv.probe = pcmcia_device_probe;
-        driver->drv.remove = pcmcia_device_remove;
        return driver_register(&driver->drv);
 }
@@ -920,6 +918,37 @@ pcmcia_device_stringattr(prod_id2, prod_id[1]);
 pcmcia_device_stringattr(prod_id3, prod_id[2]);
 pcmcia_device_stringattr(prod_id4, prod_id[3]);
+static ssize_t pcmcia_show_pm_state(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
+        if (p_dev->dev.power.power_state.event != PM_EVENT_ON)
+                return sprintf(buf, "off\n");
+        else
+                return sprintf(buf, "on\n");
+}
+static ssize_t pcmcia_store_pm_state(struct device *dev, struct device_attribute *attr,
+                                     const char *buf, size_t count)
+{
+        struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
+        int ret = 0;
+        if (!count)
+                return -EINVAL;
+        if ((p_dev->dev.power.power_state.event == PM_EVENT_ON) &&
+            (!strncmp(buf, "off", 3)))
+                ret = dpm_runtime_suspend(dev, PMSG_SUSPEND);
+        else if ((p_dev->dev.power.power_state.event != PM_EVENT_ON) &&
+                 (!strncmp(buf, "on", 2)))
+                dpm_runtime_resume(dev);
+        return ret ? ret : count;
+}
 static ssize_t modalias_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
        struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
@@ -945,8 +974,9 @@ static ssize_t pcmcia_store_allow_func_id_match(struct device *dev,
                struct device_attribute *attr, const char *buf, size_t count)
 {
        struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
-        if (!count)
-                return -EINVAL;
+        if (!count)
+                return -EINVAL;
        down(&p_dev->socket->skt_sem);
        p_dev->allow_func_id_match = 1;
@@ -959,6 +989,7 @@ static ssize_t pcmcia_store_allow_func_id_match(struct device *dev,
 static struct device_attribute pcmcia_dev_attrs[] = {
        __ATTR(function, 0444, func_show, NULL),
+        __ATTR(pm_state, 0644, pcmcia_show_pm_state, pcmcia_store_pm_state),
        __ATTR_RO(func_id),
        __ATTR_RO(manf_id),
        __ATTR_RO(card_id),
@@ -1167,6 +1198,8 @@ struct bus_type pcmcia_bus_type = {
        .uevent = pcmcia_bus_uevent,
        .match = pcmcia_bus_match,
        .dev_attrs = pcmcia_dev_attrs,
+        .probe = pcmcia_device_probe,
+        .remove = pcmcia_device_remove,
        .suspend = pcmcia_dev_suspend,
        .resume = pcmcia_dev_resume,
 };
diff --git a/drivers/pcmcia/pxa2xx_mainstone.c b/drivers/pcmcia/pxa2xx_mainstone.c
index 5d957dfe23d9..fda06941e730 100644
--- a/drivers/pcmcia/pxa2xx_mainstone.c
+++ b/drivers/pcmcia/pxa2xx_mainstone.c
@@ -171,27 +171,22 @@ static int __init mst_pcmcia_init(void)
 {
        int ret;
-        mst_pcmcia_device = kzalloc(sizeof(*mst_pcmcia_device), GFP_KERNEL);
+        mst_pcmcia_device = platform_device_alloc("pxa2xx-pcmcia", -1);
        if (!mst_pcmcia_device)
                return -ENOMEM;
-        mst_pcmcia_device->name = "pxa2xx-pcmcia";
        mst_pcmcia_device->dev.platform_data = &mst_pcmcia_ops;
-        ret = platform_device_register(mst_pcmcia_device);
+        ret = platform_device_add(mst_pcmcia_device);
        if (ret)
-                kfree(mst_pcmcia_device);
+                platform_device_put(mst_pcmcia_device);
        return ret;
 }
 static void __exit mst_pcmcia_exit(void)
 {
-        /*
-         * This call is supposed to free our mst_pcmcia_device.
-         * Unfortunately platform_device don't have a free method, and
-         * we can't assume it's free of any reference at this point so we
-         * can't free it either.
-         */
        platform_device_unregister(mst_pcmcia_device);
 }
diff --git a/drivers/pcmcia/pxa2xx_sharpsl.c b/drivers/pcmcia/pxa2xx_sharpsl.c
index 12a7244a5ec8..fd3647368955 100644
--- a/drivers/pcmcia/pxa2xx_sharpsl.c
+++ b/drivers/pcmcia/pxa2xx_sharpsl.c
@@ -263,30 +263,25 @@ static int __init sharpsl_pcmcia_init(void)
 {
        int ret;
-        sharpsl_pcmcia_ops.nr=platform_scoop_config->num_devs;
+        sharpsl_pcmcia_ops.nr = platform_scoop_config->num_devs;
-        sharpsl_pcmcia_device = kzalloc(sizeof(*sharpsl_pcmcia_device), GFP_KERNEL);
+        sharpsl_pcmcia_device = platform_device_alloc("pxa2xx-pcmcia", -1);
        if (!sharpsl_pcmcia_device)
                return -ENOMEM;
-        sharpsl_pcmcia_device->name = "pxa2xx-pcmcia";
        sharpsl_pcmcia_device->dev.platform_data = &sharpsl_pcmcia_ops;
-        sharpsl_pcmcia_device->dev.parent=platform_scoop_config->devs[0].dev;
+        sharpsl_pcmcia_device->dev.parent = platform_scoop_config->devs[0].dev;
+        ret = platform_device_add(sharpsl_pcmcia_device);
-        ret = platform_device_register(sharpsl_pcmcia_device);
        if (ret)
-                kfree(sharpsl_pcmcia_device);
+                platform_device_put(sharpsl_pcmcia_device);
        return ret;
 }
 static void __exit sharpsl_pcmcia_exit(void)
 {
-        /*
-         * This call is supposed to free our sharpsl_pcmcia_device.
-         * Unfortunately platform_device don't have a free method, and
-         * we can't assume it's free of any reference at this point so we
-         * can't free it either.
-         */
        platform_device_unregister(sharpsl_pcmcia_device);
 }
diff --git a/drivers/pcmcia/socket_sysfs.c b/drivers/pcmcia/socket_sysfs.c
index 7a7744662d54..5ab1cdef7c48 100644
--- a/drivers/pcmcia/socket_sysfs.c
+++ b/drivers/pcmcia/socket_sysfs.c
@@ -98,6 +98,30 @@ static ssize_t pccard_store_insert(struct class_device *dev, const char *buf, si
 }
 static CLASS_DEVICE_ATTR(card_insert, 0200, NULL, pccard_store_insert);
+static ssize_t pccard_show_card_pm_state(struct class_device *dev, char *buf)
+{
+        struct pcmcia_socket *s = to_socket(dev);
+        return sprintf(buf, "%s\n", s->state & SOCKET_SUSPEND ? "off" : "on");
+}
+static ssize_t pccard_store_card_pm_state(struct class_device *dev, const char *buf, size_t count)
+{
+        ssize_t ret = -EINVAL;
+        struct pcmcia_socket *s = to_socket(dev);
+        if (!count)
+                return -EINVAL;
+        if (!(s->state & SOCKET_SUSPEND) && !strncmp(buf, "off", 3))
+                ret = pcmcia_suspend_card(s);
+        else if ((s->state & SOCKET_SUSPEND) && !strncmp(buf, "on", 2))
+                ret = pcmcia_resume_card(s);
+        return ret ? -ENODEV : count;
+}
+static CLASS_DEVICE_ATTR(card_pm_state, 0644, pccard_show_card_pm_state, pccard_store_card_pm_state);
 static ssize_t pccard_store_eject(struct class_device *dev, const char *buf, size_t count)
 {
        ssize_t ret;
@@ -320,6 +344,7 @@ static struct class_device_attribute *pccard_socket_attributes[] = {
        &class_device_attr_card_vpp,
        &class_device_attr_card_vcc,
        &class_device_attr_card_insert,
+        &class_device_attr_card_pm_state,
        &class_device_attr_card_eject,
        &class_device_attr_card_irq_mask,
        &class_device_attr_available_resources_setup_done,
diff --git a/drivers/pnp/driver.c b/drivers/pnp/driver.c
index 15fb758a9e52..7cafacdd12b0 100644
--- a/drivers/pnp/driver.c
+++ b/drivers/pnp/driver.c
@@ -195,6 +195,8 @@ static int pnp_bus_resume(struct device *dev)
 struct bus_type pnp_bus_type = {
        .name   = "pnp",
        .match  = pnp_bus_match,
+        .probe  = pnp_device_probe,
+        .remove = pnp_device_remove,
        .suspend = pnp_bus_suspend,
        .resume = pnp_bus_resume,
 };
@@ -215,8 +217,6 @@ int pnp_register_driver(struct pnp_driver *drv)
        drv->driver.name = drv->name;
        drv->driver.bus = &pnp_bus_type;
-        drv->driver.probe = pnp_device_probe;
-        drv->driver.remove = pnp_device_remove;
        count = driver_register(&drv->driver);
diff --git a/drivers/rapidio/rio-driver.c b/drivers/rapidio/rio-driver.c
index dc749609699a..5480119ff9d3 100644
--- a/drivers/rapidio/rio-driver.c
+++ b/drivers/rapidio/rio-driver.c
@@ -147,8 +147,6 @@ int rio_register_driver(struct rio_driver *rdrv)
        /* initialize common driver fields */
        rdrv->driver.name = rdrv->name;
        rdrv->driver.bus = &rio_bus_type;
-        rdrv->driver.probe = rio_device_probe;
-        rdrv->driver.remove = rio_device_remove;
        /* register with core */
        return driver_register(&rdrv->driver);
@@ -204,7 +202,9 @@ static struct device rio_bus = {
 struct bus_type rio_bus_type = {
        .name = "rapidio",
        .match = rio_match_bus,
-        .dev_attrs = rio_dev_attrs
+        .dev_attrs = rio_dev_attrs,
+        .probe = rio_device_probe,
+        .remove = rio_device_remove,
 };
 /**
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index e849289d4f3c..503a568e47c3 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -52,11 +52,7 @@ ccwgroup_uevent (struct device *dev, char **envp, int num_envp, char *buffer,
        return 0;
 }
-static struct bus_type ccwgroup_bus_type = {
+static struct bus_type ccwgroup_bus_type;
-        .name    = "ccwgroup",
-        .match   = ccwgroup_bus_match,
-        .uevent = ccwgroup_uevent,
-};
 static inline void
 __ccwgroup_remove_symlinks(struct ccwgroup_device *gdev)
@@ -389,6 +385,14 @@ ccwgroup_remove (struct device *dev)
        return 0;
 }
+static struct bus_type ccwgroup_bus_type = {
+        .name   = "ccwgroup",
+        .match  = ccwgroup_bus_match,
+        .uevent = ccwgroup_uevent,
+        .probe  = ccwgroup_probe,
+        .remove = ccwgroup_remove,
+};
 int
 ccwgroup_driver_register (struct ccwgroup_driver *cdriver)
 {
@@ -396,8 +400,6 @@ ccwgroup_driver_register (struct ccwgroup_driver *cdriver)
        cdriver->driver = (struct device_driver) {
                .bus = &ccwgroup_bus_type,
                .name = cdriver->name,
-                .probe = ccwgroup_probe,
-                .remove = ccwgroup_remove,
        };
        return driver_register(&cdriver->driver);
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index e565193650c7..2d319fb812ca 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -542,9 +542,41 @@ css_bus_match (struct device *dev, struct device_driver *drv)
        return 0;
 }
+static int
+css_probe (struct device *dev)
+{
+        struct subchannel *sch;
+        sch = to_subchannel(dev);
+        sch->driver = container_of (dev->driver, struct css_driver, drv);
+        return (sch->driver->probe ? sch->driver->probe(sch) : 0);
+}
+static int
+css_remove (struct device *dev)
+{
+        struct subchannel *sch;
+        sch = to_subchannel(dev);
+        return (sch->driver->remove ? sch->driver->remove(sch) : 0);
+}
+static void
+css_shutdown (struct device *dev)
+{
+        struct subchannel *sch;
+        sch = to_subchannel(dev);
+        if (sch->driver->shutdown)
+                sch->driver->shutdown(sch);
+}
 struct bus_type css_bus_type = {
-        .name  = "css",
+        .name     = "css",
-        .match = &css_bus_match,
+        .match    = css_bus_match,
+        .probe    = css_probe,
+        .remove   = css_remove,
+        .shutdown = css_shutdown,
 };
 subsys_initcall(init_channel_subsystem);
diff --git a/drivers/s390/cio/css.h b/drivers/s390/cio/css.h
index 251ebd7a7d3a..aa5ab5d4547c 100644
--- a/drivers/s390/cio/css.h
+++ b/drivers/s390/cio/css.h
@@ -115,6 +115,7 @@ struct ccw_device_private {
 * Currently, we only care about I/O subchannels (type 0), these
 * have a ccw_device connected to them.
 */
+struct subchannel;
 struct css_driver {
        unsigned int subchannel_type;
        struct device_driver drv;
@@ -122,6 +123,9 @@ struct css_driver {
        int (*notify)(struct device *, int);
        void (*verify)(struct device *);
        void (*termination)(struct device *);
+        int (*probe)(struct subchannel *);
+        int (*remove)(struct subchannel *);
+        void (*shutdown)(struct subchannel *);
 };
 /*
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index fa3e4c0a2536..eb73605a0527 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -107,33 +107,29 @@ ccw_uevent (struct device *dev, char **envp, int num_envp,
        return 0;
 }
-struct bus_type ccw_bus_type = {
+struct bus_type ccw_bus_type;
-        .name  = "ccw",
-        .match = &ccw_bus_match,
-        .uevent = &ccw_uevent,
-};
-static int io_subchannel_probe (struct device *);
+static int io_subchannel_probe (struct subchannel *);
-static int io_subchannel_remove (struct device *);
+static int io_subchannel_remove (struct subchannel *);
 void io_subchannel_irq (struct device *);
 static int io_subchannel_notify(struct device *, int);
 static void io_subchannel_verify(struct device *);
 static void io_subchannel_ioterm(struct device *);
-static void io_subchannel_shutdown(struct device *);
+static void io_subchannel_shutdown(struct subchannel *);
 struct css_driver io_subchannel_driver = {
        .subchannel_type = SUBCHANNEL_TYPE_IO,
        .drv = {
                .name = "io_subchannel",
                .bus  = &css_bus_type,
-                .probe = &io_subchannel_probe,
-                .remove = &io_subchannel_remove,
-                .shutdown = &io_subchannel_shutdown,
        },
        .irq = io_subchannel_irq,
        .notify = io_subchannel_notify,
        .verify = io_subchannel_verify,
        .termination = io_subchannel_ioterm,
+        .probe = io_subchannel_probe,
+        .remove = io_subchannel_remove,
+        .shutdown = io_subchannel_shutdown,
 };
 struct workqueue_struct *ccw_device_work;
@@ -803,14 +799,12 @@ io_subchannel_recog(struct ccw_device *cdev, struct subchannel *sch)
 }
 static int
-io_subchannel_probe (struct device *pdev)
+io_subchannel_probe (struct subchannel *sch)
 {
-        struct subchannel *sch;
        struct ccw_device *cdev;
        int rc;
        unsigned long flags;
-        sch = to_subchannel(pdev);
        if (sch->dev.driver_data) {
                /*
                 * This subchannel already has an associated ccw_device.
@@ -846,7 +840,7 @@ io_subchannel_probe (struct device *pdev)
        memset(cdev->private, 0, sizeof(struct ccw_device_private));
        atomic_set(&cdev->private->onoff, 0);
        cdev->dev = (struct device) {
-                .parent = pdev,
+                .parent = &sch->dev,
                .release = ccw_device_release,
        };
        INIT_LIST_HEAD(&cdev->private->kick_work.entry);
@@ -859,7 +853,7 @@ io_subchannel_probe (struct device *pdev)
                return -ENODEV;
        }
-        rc = io_subchannel_recog(cdev, to_subchannel(pdev));
+        rc = io_subchannel_recog(cdev, sch);
        if (rc) {
                spin_lock_irqsave(&sch->lock, flags);
                sch->dev.driver_data = NULL;
@@ -883,17 +877,17 @@ ccw_device_unregister(void *data)
 }
 static int
-io_subchannel_remove (struct device *dev)
+io_subchannel_remove (struct subchannel *sch)
 {
        struct ccw_device *cdev;
        unsigned long flags;
-        if (!dev->driver_data)
+        if (!sch->dev.driver_data)
                return 0;
-        cdev = dev->driver_data;
+        cdev = sch->dev.driver_data;
        /* Set ccw device to not operational and drop reference. */
        spin_lock_irqsave(cdev->ccwlock, flags);
-        dev->driver_data = NULL;
+        sch->dev.driver_data = NULL;
        cdev->private->state = DEV_STATE_NOT_OPER;
        spin_unlock_irqrestore(cdev->ccwlock, flags);
        /*
@@ -948,14 +942,12 @@ io_subchannel_ioterm(struct device *dev)
 }
 static void
-io_subchannel_shutdown(struct device *dev)
+io_subchannel_shutdown(struct subchannel *sch)
 {
-        struct subchannel *sch;
        struct ccw_device *cdev;
        int ret;
-        sch = to_subchannel(dev);
+        cdev = sch->dev.driver_data;
-        cdev = dev->driver_data;
        if (cio_is_console(sch->schid))
                return;
@@ -1129,6 +1121,14 @@ ccw_device_remove (struct device *dev)
        return 0;
 }
+struct bus_type ccw_bus_type = {
+        .name   = "ccw",
+        .match  = ccw_bus_match,
+        .uevent = ccw_uevent,
+        .probe  = ccw_device_probe,
+        .remove = ccw_device_remove,
+};
 int
 ccw_driver_register (struct ccw_driver *cdriver)
 {
@@ -1136,8 +1136,6 @@ ccw_driver_register (struct ccw_driver *cdriver)
        drv->bus = &ccw_bus_type;
        drv->name = cdriver->name;
-        drv->probe = ccw_device_probe;
-        drv->remove = ccw_device_remove;
        return driver_register(drv);
 }
diff --git a/drivers/sbus/char/aurora.c b/drivers/sbus/char/aurora.c
index 92e6c5639dd3..015db40ad8a4 100644
--- a/drivers/sbus/char/aurora.c
+++ b/drivers/sbus/char/aurora.c
@@ -92,7 +92,6 @@ static struct Aurora_port aurora_port[AURORA_TNPORTS] =  {
 /* no longer used. static struct Aurora_board * IRQ_to_board[16] = { NULL, } ;*/
 static unsigned char * tmp_buf = NULL;
-static DECLARE_MUTEX(tmp_buf_sem);
 DECLARE_TASK_QUEUE(tq_aurora);
diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
index b9d2bb88787a..320e765fa0cd 100644
--- a/drivers/scsi/Makefile
+++ b/drivers/scsi/Makefile
@@ -45,7 +45,7 @@ obj-$(CONFIG_CYBERSTORMII_SCSI)	+= NCR53C9x.o	cyberstormII.o
 obj-$(CONFIG_BLZ2060_SCSI)      += NCR53C9x.o   blz2060.o
 obj-$(CONFIG_BLZ1230_SCSI)      += NCR53C9x.o   blz1230.o
 obj-$(CONFIG_FASTLANE_SCSI)     += NCR53C9x.o   fastlane.o
-obj-$(CONFIG_OKTAGON_SCSI)      += NCR53C9x.o   oktagon_esp.o   oktagon_io.o
+obj-$(CONFIG_OKTAGON_SCSI)      += NCR53C9x.o   oktagon_esp_mod.o
 obj-$(CONFIG_ATARI_SCSI)        += atari_scsi.o
 obj-$(CONFIG_MAC_SCSI)          += mac_scsi.o
 obj-$(CONFIG_SCSI_MAC_ESP)      += mac_esp.o    NCR53C9x.o
@@ -164,6 +164,7 @@ CFLAGS_ncr53c8xx.o	:= $(ncr53c8xx-flags-y) $(ncr53c8xx-flags-m)
 zalon7xx-objs   := zalon.o ncr53c8xx.o
 NCR_Q720_mod-objs       := NCR_Q720.o ncr53c8xx.o
 libata-objs     := libata-core.o libata-scsi.o
+oktagon_esp_mod-objs    := oktagon_esp.o oktagon_io.o
 # Files generated that shall be removed upon make clean
 clean-files :=  53c7xx_d.h 53c700_d.h   \
diff --git a/drivers/scsi/NCR53C9x.c b/drivers/scsi/NCR53C9x.c
index 640590bd014a..c7dd0154d012 100644
--- a/drivers/scsi/NCR53C9x.c
+++ b/drivers/scsi/NCR53C9x.c
@@ -1799,6 +1799,7 @@ static int esp_do_data(struct NCR_ESP *esp, struct ESP_regs *eregs)
                 */
                int oldphase, i = 0; /* or where we left off last time ?? esp->current_data ?? */
                int fifocnt = 0;
+                unsigned char *p = phys_to_virt((unsigned long)SCptr->SCp.ptr);
                oldphase = esp_read(eregs->esp_status) & ESP_STAT_PMASK;
@@ -1860,7 +1861,7 @@ static int esp_do_data(struct NCR_ESP *esp, struct ESP_regs *eregs)
                                /* read fifo */
                                for(j=0;j<fifocnt;j++)
-                                        SCptr->SCp.ptr[i++] = esp_read(eregs->esp_fdata);
+                                        p[i++] = esp_read(eregs->esp_fdata);
                                ESPDATA(("(%d) ", i));
@@ -1882,7 +1883,7 @@ static int esp_do_data(struct NCR_ESP *esp, struct ESP_regs *eregs)
                                /* fill fifo */
                                for(j=0;j<this_count;j++)
-                                        esp_write(eregs->esp_fdata, SCptr->SCp.ptr[i++]);
+                                        esp_write(eregs->esp_fdata, p[i++]);
                                /* how many left if this goes out ?? */
                                hmuch -= this_count;
diff --git a/drivers/scsi/blz1230.c b/drivers/scsi/blz1230.c
index 763e409a1ff3..3867ac2de4c2 100644
--- a/drivers/scsi/blz1230.c
+++ b/drivers/scsi/blz1230.c
@@ -224,7 +224,7 @@ static int dma_can_transfer(struct NCR_ESP *esp, Scsi_Cmnd *sp)
 static void dma_dump_state(struct NCR_ESP *esp)
 {
        ESPLOG(("intreq:<%04x>, intena:<%04x>\n",
-                custom.intreqr, custom.intenar));
+                amiga_custom.intreqr, amiga_custom.intenar));
 }
 void dma_init_read(struct NCR_ESP *esp, __u32 addr, int length)
@@ -298,7 +298,7 @@ static int dma_irq_p(struct NCR_ESP *esp)
 static int dma_ports_p(struct NCR_ESP *esp)
 {
-        return ((custom.intenar) & IF_PORTS);
+        return ((amiga_custom.intenar) & IF_PORTS);
 }
 static void dma_setup(struct NCR_ESP *esp, __u32 addr, int count, int write)
diff --git a/drivers/scsi/blz2060.c b/drivers/scsi/blz2060.c
index d72d05fffdfa..4ebe69e32756 100644
--- a/drivers/scsi/blz2060.c
+++ b/drivers/scsi/blz2060.c
@@ -190,7 +190,7 @@ static int dma_can_transfer(struct NCR_ESP *esp, Scsi_Cmnd *sp)
 static void dma_dump_state(struct NCR_ESP *esp)
 {
        ESPLOG(("intreq:<%04x>, intena:<%04x>\n",
-                custom.intreqr, custom.intenar));
+                amiga_custom.intreqr, amiga_custom.intenar));
 }
 static void dma_init_read(struct NCR_ESP *esp, __u32 addr, int length)
@@ -251,7 +251,7 @@ static void dma_led_on(struct NCR_ESP *esp)
 static int dma_ports_p(struct NCR_ESP *esp)
 {
-        return ((custom.intenar) & IF_PORTS);
+        return ((amiga_custom.intenar) & IF_PORTS);
 }
 static void dma_setup(struct NCR_ESP *esp, __u32 addr, int count, int write)
diff --git a/drivers/scsi/cyberstorm.c b/drivers/scsi/cyberstorm.c
index f9b940e56430..a4a4fac5c0a1 100644
--- a/drivers/scsi/cyberstorm.c
+++ b/drivers/scsi/cyberstorm.c
@@ -223,7 +223,7 @@ static void dma_dump_state(struct NCR_ESP *esp)
                esp->esp_id, ((struct cyber_dma_registers *)
                              (esp->dregs))->cond_reg));
        ESPLOG(("intreq:<%04x>, intena:<%04x>\n",
-                custom.intreqr, custom.intenar));
+                amiga_custom.intreqr, amiga_custom.intenar));
 }
 static void dma_init_read(struct NCR_ESP *esp, __u32 addr, int length)
@@ -322,7 +322,7 @@ static void dma_led_on(struct NCR_ESP *esp)
 static int dma_ports_p(struct NCR_ESP *esp)
 {
-        return ((custom.intenar) & IF_PORTS);
+        return ((amiga_custom.intenar) & IF_PORTS);
 }
 static void dma_setup(struct NCR_ESP *esp, __u32 addr, int count, int write)
diff --git a/drivers/scsi/cyberstormII.c b/drivers/scsi/cyberstormII.c
index a3caabfd7557..3a803d73bc5f 100644
--- a/drivers/scsi/cyberstormII.c
+++ b/drivers/scsi/cyberstormII.c
@@ -200,7 +200,7 @@ static void dma_dump_state(struct NCR_ESP *esp)
                esp->esp_id, ((struct cyberII_dma_registers *)
                              (esp->dregs))->cond_reg));
        ESPLOG(("intreq:<%04x>, intena:<%04x>\n",
-                custom.intreqr, custom.intenar));
+                amiga_custom.intreqr, amiga_custom.intenar));
 }
 static void dma_init_read(struct NCR_ESP *esp, __u32 addr, int length)
@@ -259,7 +259,7 @@ static void dma_led_on(struct NCR_ESP *esp)
 static int dma_ports_p(struct NCR_ESP *esp)
 {
-        return ((custom.intenar) & IF_PORTS);
+        return ((amiga_custom.intenar) & IF_PORTS);
 }
 static void dma_setup(struct NCR_ESP *esp, __u32 addr, int count, int write)
diff --git a/drivers/scsi/fastlane.c b/drivers/scsi/fastlane.c
index ccee68b52f7e..8ae9c406a83b 100644
--- a/drivers/scsi/fastlane.c
+++ b/drivers/scsi/fastlane.c
@@ -268,7 +268,7 @@ static void dma_dump_state(struct NCR_ESP *esp)
                esp->esp_id, ((struct fastlane_dma_registers *)
                              (esp->dregs))->cond_reg));
        ESPLOG(("intreq:<%04x>, intena:<%04x>\n",
-                custom.intreqr, custom.intenar));
+                amiga_custom.intreqr, amiga_custom.intenar));
 }
 static void dma_init_read(struct NCR_ESP *esp, __u32 addr, int length)
@@ -368,7 +368,7 @@ static void dma_led_on(struct NCR_ESP *esp)
 static int dma_ports_p(struct NCR_ESP *esp)
 {
-        return ((custom.intenar) & IF_PORTS);
+        return ((amiga_custom.intenar) & IF_PORTS);
 }
 static void dma_setup(struct NCR_ESP *esp, __u32 addr, int count, int write)
diff --git a/drivers/scsi/oktagon_esp.c b/drivers/scsi/oktagon_esp.c
index 5d9c9ada814f..dee426f8c07b 100644
--- a/drivers/scsi/oktagon_esp.c
+++ b/drivers/scsi/oktagon_esp.c
@@ -490,7 +490,7 @@ static void dma_led_on(struct NCR_ESP *esp)
 static int dma_ports_p(struct NCR_ESP *esp)
 {
-        return ((custom.intenar) & IF_PORTS);
+        return ((amiga_custom.intenar) & IF_PORTS);
 }
 static void dma_setup(struct NCR_ESP *esp, __u32 addr, int count, int write)
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 3ded9daaf4a0..0e529f8171c4 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -221,8 +221,6 @@ static struct bus_type pseudo_lld_bus;
 static struct device_driver sdebug_driverfs_driver = {
        .name           = sdebug_proc_name,
        .bus            = &pseudo_lld_bus,
-        .probe          = sdebug_driver_probe,
-        .remove         = sdebug_driver_remove,
 };
 static const int check_condition_result =
@@ -1796,6 +1794,8 @@ static int pseudo_lld_bus_match(struct device *dev,
 static struct bus_type pseudo_lld_bus = {
        .name = "pseudo",
        .match = pseudo_lld_bus_match,
+        .probe = sdebug_driver_probe,
+        .remove = sdebug_driver_remove,
 };
 static void sdebug_release_adapter(struct device * dev)
diff --git a/drivers/scsi/wd33c93.c b/drivers/scsi/wd33c93.c
index fd63add6a577..fb53eeaee617 100644
--- a/drivers/scsi/wd33c93.c
+++ b/drivers/scsi/wd33c93.c
@@ -465,7 +465,7 @@ wd33c93_execute(struct Scsi_Host *instance)
         */
        cmd = (struct scsi_cmnd *) hostdata->input_Q;
-        prev = 0;
+        prev = NULL;
        while (cmd) {
                if (!(hostdata->busy[cmd->device->id] & (1 << cmd->device->lun)))
                        break;
@@ -1569,7 +1569,7 @@ wd33c93_abort(struct scsi_cmnd * cmd)
 */
        tmp = (struct scsi_cmnd *) hostdata->input_Q;
-        prev = 0;
+        prev = NULL;
        while (tmp) {
                if (tmp == cmd) {
                        if (prev)
diff --git a/drivers/serial/68328serial.c b/drivers/serial/68328serial.c
index 4dd5c3f98167..8cbf0fc5a225 100644
--- a/drivers/serial/68328serial.c
+++ b/drivers/serial/68328serial.c
@@ -143,7 +143,6 @@ static int m68328_console_cbaud   = DEFAULT_CBAUD;
 * memory if large numbers of serial ports are open.
 */
 static unsigned char tmp_buf[SERIAL_XMIT_SIZE]; /* This is cheating */
-DECLARE_MUTEX(tmp_buf_sem);
 static inline int serial_paranoia_check(struct m68k_serial *info,
                                        char *name, const char *routine)
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 54e5cc0dd5f8..fb610c3634a4 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -41,6 +41,7 @@
 #include <linux/serial.h>
 #include <linux/serial_8250.h>
 #include <linux/nmi.h>
+#include <linux/mutex.h>
 #include <asm/io.h>
 #include <asm/irq.h>
@@ -2467,7 +2468,7 @@ static struct platform_device *serial8250_isa_devs;
 * 16x50 serial ports to be configured at run-time, to support PCMCIA
 * modems and PCI multiport cards.
 */
-static DECLARE_MUTEX(serial_sem);
+static DEFINE_MUTEX(serial_mutex);
 static struct uart_8250_port *serial8250_find_match_or_unused(struct uart_port *port)
 {
@@ -2522,7 +2523,7 @@ int serial8250_register_port(struct uart_port *port)
        if (port->uartclk == 0)
                return -EINVAL;
-        down(&serial_sem);
+        mutex_lock(&serial_mutex);
        uart = serial8250_find_match_or_unused(port);
        if (uart) {
@@ -2544,7 +2545,7 @@ int serial8250_register_port(struct uart_port *port)
                if (ret == 0)
                        ret = uart->port.line;
        }
-        up(&serial_sem);
+        mutex_unlock(&serial_mutex);
        return ret;
 }
@@ -2561,7 +2562,7 @@ void serial8250_unregister_port(int line)
 {
        struct uart_8250_port *uart = &serial8250_ports[line];
-        down(&serial_sem);
+        mutex_lock(&serial_mutex);
        uart_remove_one_port(&serial8250_reg, &uart->port);
        if (serial8250_isa_devs) {
                uart->port.flags &= ~UPF_BOOT_AUTOCONF;
@@ -2571,7 +2572,7 @@ void serial8250_unregister_port(int line)
        } else {
                uart->port.dev = NULL;
        }
-        up(&serial_sem);
+        mutex_unlock(&serial_mutex);
 }
 EXPORT_SYMBOL(serial8250_unregister_port);
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index 698cb76819d9..843717275d49 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -280,6 +280,40 @@ config SERIAL_AMBA_PL011_CONSOLE
          your boot loader (lilo or loadlin) about how to pass options to the
          kernel at boot time.)
+config SERIAL_AT91
+        bool "AT91RM9200 serial port support"
+        depends on ARM && ARCH_AT91RM9200
+        select SERIAL_CORE
+        help
+          This enables the driver for the on-chip UARTs of the AT91RM9200
+          processor.
+config SERIAL_AT91_CONSOLE
+        bool "Support for console on AT91RM9200 serial port"
+        depends on SERIAL_AT91=y
+        select SERIAL_CORE_CONSOLE
+        help
+          Say Y here if you wish to use a UART on the AT91RM9200 as the system
+          console (the system console is the device which receives all kernel
+          messages and warnings and which allows logins in single user mode).
+config SERIAL_AT91_TTYAT
+        bool "Install as device ttyAT0-4 instead of ttyS0-4"
+        depends on SERIAL_AT91=y
+        help
+          Say Y here if you wish to have the five internal AT91RM9200 UARTs
+          appear as /dev/ttyAT0-4 (major 240, minor 0-4) instead of the
+          normal /dev/ttyS0-4 (major 4, minor 64-68). This is necessary if
+          you also want other UARTs, such as external 8250/16C550 compatible
+          UARTs.
+          The ttySn nodes are legally reserved for the 8250 serial driver
+          but are often misused by other serial drivers.
+          To use this, you should create suitable ttyATn device nodes in
+          /dev/, and pass "console=ttyATn" to the kernel.
+          Say Y if you have an external 8250/16C550 UART.  If unsure, say N.
 config SERIAL_CLPS711X
        tristate "CLPS711X serial port support"
        depends on ARM && ARCH_CLPS711X
diff --git a/drivers/serial/Makefile b/drivers/serial/Makefile
index 137148bba4fa..24a583e482bb 100644
--- a/drivers/serial/Makefile
+++ b/drivers/serial/Makefile
@@ -56,3 +56,4 @@ obj-$(CONFIG_SERIAL_JSM) += jsm/
 obj-$(CONFIG_SERIAL_TXX9) += serial_txx9.o
 obj-$(CONFIG_SERIAL_VR41XX) += vr41xx_siu.o
 obj-$(CONFIG_SERIAL_SGI_IOC4) += ioc4_serial.o
+obj-$(CONFIG_SERIAL_AT91) += at91_serial.o
diff --git a/drivers/serial/at91_serial.c b/drivers/serial/at91_serial.c
new file mode 100644
index 000000000000..0e206063d685
--- /dev/null
+++ b/drivers/serial/at91_serial.c
@@ -0,0 +1,894 @@
+/*
+ *  linux/drivers/char/at91_serial.c
+ *
+ *  Driver for Atmel AT91RM9200 Serial ports
+ *
+ *  Copyright (C) 2003 Rick Bronson
+ *
+ *  Based on drivers/char/serial_sa1100.c, by Deep Blue Solutions Ltd.
+ *  Based on drivers/char/serial.c, by Linus Torvalds, Theodore Ts'o.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/tty.h>
+#include <linux/ioport.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+#include <linux/serial.h>
+#include <linux/console.h>
+#include <linux/sysrq.h>
+#include <linux/tty_flip.h>
+#include <asm/io.h>
+#include <asm/arch/at91rm9200_usart.h>
+#include <asm/mach/serial_at91rm9200.h>
+#include <asm/arch/board.h>
+#include <asm/arch/pio.h>
+#if defined(CONFIG_SERIAL_AT91_CONSOLE) && defined(CONFIG_MAGIC_SYSRQ)
+#define SUPPORT_SYSRQ
+#endif
+#include <linux/serial_core.h>
+#ifdef CONFIG_SERIAL_AT91_TTYAT
+/* Use device name ttyAT, major 204 and minor 154-169.  This is necessary if we
+ * should coexist with the 8250 driver, such as if we have an external 16C550
+ * UART. */
+#define SERIAL_AT91_MAJOR       204
+#define MINOR_START             154
+#define AT91_DEVICENAME         "ttyAT"
+#else
+/* Use device name ttyS, major 4, minor 64-68.  This is the usual serial port
+ * name, but it is legally reserved for the 8250 driver. */
+#define SERIAL_AT91_MAJOR       TTY_MAJOR
+#define MINOR_START             64
+#define AT91_DEVICENAME         "ttyS"
+#endif
+#define AT91_VA_BASE_DBGU       ((unsigned long) AT91_VA_BASE_SYS + AT91_DBGU)
+#define AT91_ISR_PASS_LIMIT     256
+#define UART_PUT_CR(port,v)     writel(v, (port)->membase + AT91_US_CR)
+#define UART_GET_MR(port)       readl((port)->membase + AT91_US_MR)
+#define UART_PUT_MR(port,v)     writel(v, (port)->membase + AT91_US_MR)
+#define UART_PUT_IER(port,v)    writel(v, (port)->membase + AT91_US_IER)
+#define UART_PUT_IDR(port,v)    writel(v, (port)->membase + AT91_US_IDR)
+#define UART_GET_IMR(port)      readl((port)->membase + AT91_US_IMR)
+#define UART_GET_CSR(port)      readl((port)->membase + AT91_US_CSR)
+#define UART_GET_CHAR(port)     readl((port)->membase + AT91_US_RHR)
+#define UART_PUT_CHAR(port,v)   writel(v, (port)->membase + AT91_US_THR)
+#define UART_GET_BRGR(port)     readl((port)->membase + AT91_US_BRGR)
+#define UART_PUT_BRGR(port,v)   writel(v, (port)->membase + AT91_US_BRGR)
+#define UART_PUT_RTOR(port,v)   writel(v, (port)->membase + AT91_US_RTOR)
+// #define UART_GET_CR(port)    readl((port)->membase + AT91_US_CR)             // is write-only
+ /* PDC registers */
+#define UART_PUT_PTCR(port,v)   writel(v, (port)->membase + AT91_PDC_PTCR)
+#define UART_PUT_RPR(port,v)    writel(v, (port)->membase + AT91_PDC_RPR)
+#define UART_PUT_RCR(port,v)    writel(v, (port)->membase + AT91_PDC_RCR)
+#define UART_GET_RCR(port)      readl((port)->membase + AT91_PDC_RCR)
+#define UART_PUT_RNPR(port,v)   writel(v, (port)->membase + AT91_PDC_RNPR)
+#define UART_PUT_RNCR(port,v)   writel(v, (port)->membase + AT91_PDC_RNCR)
+static int (*at91_open)(struct uart_port *);
+static void (*at91_close)(struct uart_port *);
+#ifdef SUPPORT_SYSRQ
+static struct console at91_console;
+#endif
+/*
+ * Return TIOCSER_TEMT when transmitter FIFO and Shift register is empty.
+ */
+static u_int at91_tx_empty(struct uart_port *port)
+{
+        return (UART_GET_CSR(port) & AT91_US_TXEMPTY) ? TIOCSER_TEMT : 0;
+}
+/*
+ * Set state of the modem control output lines
+ */
+static void at91_set_mctrl(struct uart_port *port, u_int mctrl)
+{
+        unsigned int control = 0;
+        /*
+         * Errata #39: RTS0 is not internally connected to PA21.  We need to drive
+         *  the pin manually.
+         */
+        if (port->mapbase == AT91_VA_BASE_US0) {
+                if (mctrl & TIOCM_RTS)
+                        at91_sys_write(AT91_PIOA + PIO_CODR, AT91_PA21_RTS0);
+                else
+                        at91_sys_write(AT91_PIOA + PIO_SODR, AT91_PA21_RTS0);
+        }
+        if (mctrl & TIOCM_RTS)
+                control |= AT91_US_RTSEN;
+        else
+                control |= AT91_US_RTSDIS;
+        if (mctrl & TIOCM_DTR)
+                control |= AT91_US_DTREN;
+        else
+                control |= AT91_US_DTRDIS;
+        UART_PUT_CR(port,control);
+}
+/*
+ * Get state of the modem control input lines
+ */
+static u_int at91_get_mctrl(struct uart_port *port)
+{
+        unsigned int status, ret = 0;
+        status = UART_GET_CSR(port);
+        /*
+         * The control signals are active low.
+         */
+        if (!(status & AT91_US_DCD))
+                ret |= TIOCM_CD;
+        if (!(status & AT91_US_CTS))
+                ret |= TIOCM_CTS;
+        if (!(status & AT91_US_DSR))
+                ret |= TIOCM_DSR;
+        if (!(status & AT91_US_RI))
+                ret |= TIOCM_RI;
+        return ret;
+}
+/*
+ * Stop transmitting.
+ */
+static void at91_stop_tx(struct uart_port *port)
+{
+        UART_PUT_IDR(port, AT91_US_TXRDY);
+        port->read_status_mask &= ~AT91_US_TXRDY;
+}
+/*
+ * Start transmitting.
+ */
+static void at91_start_tx(struct uart_port *port)
+{
+        port->read_status_mask |= AT91_US_TXRDY;
+        UART_PUT_IER(port, AT91_US_TXRDY);
+}
+/*
+ * Stop receiving - port is in process of being closed.
+ */
+static void at91_stop_rx(struct uart_port *port)
+{
+        UART_PUT_IDR(port, AT91_US_RXRDY);
+}
+/*
+ * Enable modem status interrupts
+ */
+static void at91_enable_ms(struct uart_port *port)
+{
+        port->read_status_mask |= (AT91_US_RIIC | AT91_US_DSRIC | AT91_US_DCDIC | AT91_US_CTSIC);
+        UART_PUT_IER(port, AT91_US_RIIC | AT91_US_DSRIC | AT91_US_DCDIC | AT91_US_CTSIC);
+}
+/*
+ * Control the transmission of a break signal
+ */
+static void at91_break_ctl(struct uart_port *port, int break_state)
+{
+        if (break_state != 0)
+                UART_PUT_CR(port, AT91_US_STTBRK);      /* start break */
+        else
+                UART_PUT_CR(port, AT91_US_STPBRK);      /* stop break */
+}
+/*
+ * Characters received (called from interrupt handler)
+ */
+static void at91_rx_chars(struct uart_port *port, struct pt_regs *regs)
+{
+        struct tty_struct *tty = port->info->tty;
+        unsigned int status, ch, flg;
+        status = UART_GET_CSR(port) & port->read_status_mask;
+        while (status & (AT91_US_RXRDY)) {
+                ch = UART_GET_CHAR(port);
+                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+                        goto ignore_char;
+                port->icount.rx++;
+                flg = TTY_NORMAL;
+                /*
+                 * note that the error handling code is
+                 * out of the main execution path
+                 */
+                if (unlikely(status & (AT91_US_PARE | AT91_US_FRAME | AT91_US_OVRE))) {
+                        UART_PUT_CR(port, AT91_US_RSTSTA);      /* clear error */
+                        if (status & (AT91_US_PARE))
+                                port->icount.parity++;
+                        if (status & (AT91_US_FRAME))
+                                port->icount.frame++;
+                        if (status & (AT91_US_OVRE))
+                                port->icount.overrun++;
+                        if (status & AT91_US_PARE)
+                                flg = TTY_PARITY;
+                        else if (status & AT91_US_FRAME)
+                                flg = TTY_FRAME;
+                        if (status & AT91_US_OVRE) {
+                                /*
+                                 * overrun does *not* affect the character
+                                 * we read from the FIFO
+                                 */
+                                tty_insert_flip_char(tty, ch, flg);
+                                ch = 0;
+                                flg = TTY_OVERRUN;
+                        }
+#ifdef SUPPORT_SYSRQ
+                        port->sysrq = 0;
+#endif
+                }
+                if (uart_handle_sysrq_char(port, ch, regs))
+                        goto ignore_char;
+                tty_insert_flip_char(tty, ch, flg);
+        ignore_char:
+                status = UART_GET_CSR(port) & port->read_status_mask;
+        }
+        tty_flip_buffer_push(tty);
+}
+/*
+ * Transmit characters (called from interrupt handler)
+ */
+static void at91_tx_chars(struct uart_port *port)
+{
+        struct circ_buf *xmit = &port->info->xmit;
+        if (port->x_char) {
+                UART_PUT_CHAR(port, port->x_char);
+                port->icount.tx++;
+                port->x_char = 0;
+                return;
+        }
+        if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
+                at91_stop_tx(port);
+                return;
+        }
+        while (UART_GET_CSR(port) & AT91_US_TXRDY) {
+                UART_PUT_CHAR(port, xmit->buf[xmit->tail]);
+                xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
+                port->icount.tx++;
+                if (uart_circ_empty(xmit))
+                        break;
+        }
+        if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+                uart_write_wakeup(port);
+        if (uart_circ_empty(xmit))
+                at91_stop_tx(port);
+}
+/*
+ * Interrupt handler
+ */
+static irqreturn_t at91_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct uart_port *port = dev_id;
+        unsigned int status, pending, pass_counter = 0;
+        status = UART_GET_CSR(port);
+        pending = status & port->read_status_mask;
+        if (pending) {
+                do {
+                        if (pending & AT91_US_RXRDY)
+                                at91_rx_chars(port, regs);
+                        /* Clear the relevent break bits */
+                        if (pending & AT91_US_RXBRK) {
+                                UART_PUT_CR(port, AT91_US_RSTSTA);
+                                port->icount.brk++;
+                                uart_handle_break(port);
+                        }
+                        // TODO: All reads to CSR will clear these interrupts!
+                        if (pending & AT91_US_RIIC) port->icount.rng++;
+                        if (pending & AT91_US_DSRIC) port->icount.dsr++;
+                        if (pending & AT91_US_DCDIC)
+                                uart_handle_dcd_change(port, !(status & AT91_US_DCD));
+                        if (pending & AT91_US_CTSIC)
+                                uart_handle_cts_change(port, !(status & AT91_US_CTS));
+                        if (pending & (AT91_US_RIIC | AT91_US_DSRIC | AT91_US_DCDIC | AT91_US_CTSIC))
+                                wake_up_interruptible(&port->info->delta_msr_wait);
+                        if (pending & AT91_US_TXRDY)
+                                at91_tx_chars(port);
+                        if (pass_counter++ > AT91_ISR_PASS_LIMIT)
+                                break;
+                        status = UART_GET_CSR(port);
+                        pending = status & port->read_status_mask;
+                } while (pending);
+        }
+        return IRQ_HANDLED;
+}
+/*
+ * Perform initialization and enable port for reception
+ */
+static int at91_startup(struct uart_port *port)
+{
+        int retval;
+        /*
+         * Ensure that no interrupts are enabled otherwise when
+         * request_irq() is called we could get stuck trying to
+         * handle an unexpected interrupt
+         */
+        UART_PUT_IDR(port, -1);
+        /*
+         * Allocate the IRQ
+         */
+        retval = request_irq(port->irq, at91_interrupt, SA_SHIRQ, "at91_serial", port);
+        if (retval) {
+                printk("at91_serial: at91_startup - Can't get irq\n");
+                return retval;
+        }
+        /*
+         * If there is a specific "open" function (to register
+         * control line interrupts)
+         */
+        if (at91_open) {
+                retval = at91_open(port);
+                if (retval) {
+                        free_irq(port->irq, port);
+                        return retval;
+                }
+        }
+        port->read_status_mask = AT91_US_RXRDY | AT91_US_TXRDY | AT91_US_OVRE
+                        | AT91_US_FRAME | AT91_US_PARE | AT91_US_RXBRK;
+        /*
+         * Finally, enable the serial port
+         */
+        UART_PUT_CR(port, AT91_US_RSTSTA | AT91_US_RSTRX);
+        UART_PUT_CR(port, AT91_US_TXEN | AT91_US_RXEN);         /* enable xmit & rcvr */
+        UART_PUT_IER(port, AT91_US_RXRDY);                      /* do receive only */
+        return 0;
+}
+/*
+ * Disable the port
+ */
+static void at91_shutdown(struct uart_port *port)
+{
+        /*
+         * Disable all interrupts, port and break condition.
+         */
+        UART_PUT_CR(port, AT91_US_RSTSTA);
+        UART_PUT_IDR(port, -1);
+        /*
+         * Free the interrupt
+         */
+        free_irq(port->irq, port);
+        /*
+         * If there is a specific "close" function (to unregister
+         * control line interrupts)
+         */
+        if (at91_close)
+                at91_close(port);
+}
+/*
+ * Power / Clock management.
+ */
+static void at91_serial_pm(struct uart_port *port, unsigned int state, unsigned int oldstate)
+{
+        switch (state) {
+                case 0:
+                        /*
+                         * Enable the peripheral clock for this serial port.
+                         * This is called on uart_open() or a resume event.
+                         */
+                        at91_sys_write(AT91_PMC_PCER, 1 << port->irq);
+                        break;
+                case 3:
+                        /*
+                         * Disable the peripheral clock for this serial port.
+                         * This is called on uart_close() or a suspend event.
+                         */
+                        if (port->irq != AT91_ID_SYS)                   /* is this a shared clock? */
+                                at91_sys_write(AT91_PMC_PCDR, 1 << port->irq);
+                        break;
+                default:
+                        printk(KERN_ERR "at91_serial: unknown pm %d\n", state);
+        }
+}
+/*
+ * Change the port parameters
+ */
+static void at91_set_termios(struct uart_port *port, struct termios * termios, struct termios * old)
+{
+        unsigned long flags;
+        unsigned int mode, imr, quot, baud;
+        baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
+        quot = uart_get_divisor(port, baud);
+        /* Get current mode register */
+        mode = UART_GET_MR(port) & ~(AT91_US_CHRL | AT91_US_NBSTOP | AT91_US_PAR);
+        /* byte size */
+        switch (termios->c_cflag & CSIZE) {
+        case CS5:
+                mode |= AT91_US_CHRL_5;
+                break;
+        case CS6:
+                mode |= AT91_US_CHRL_6;
+                break;
+        case CS7:
+                mode |= AT91_US_CHRL_7;
+                break;
+        default:
+                mode |= AT91_US_CHRL_8;
+                break;
+        }
+        /* stop bits */
+        if (termios->c_cflag & CSTOPB)
+                mode |= AT91_US_NBSTOP_2;
+        /* parity */
+        if (termios->c_cflag & PARENB) {
+                if (termios->c_cflag & CMSPAR) {                        /* Mark or Space parity */
+                        if (termios->c_cflag & PARODD)
+                                mode |= AT91_US_PAR_MARK;
+                        else
+                                mode |= AT91_US_PAR_SPACE;
+                }
+                else if (termios->c_cflag & PARODD)
+                        mode |= AT91_US_PAR_ODD;
+                else
+                        mode |= AT91_US_PAR_EVEN;
+        }
+        else
+                mode |= AT91_US_PAR_NONE;
+        spin_lock_irqsave(&port->lock, flags);
+        port->read_status_mask |= AT91_US_OVRE;
+        if (termios->c_iflag & INPCK)
+                port->read_status_mask |= AT91_US_FRAME | AT91_US_PARE;
+        if (termios->c_iflag & (BRKINT | PARMRK))
+                port->read_status_mask |= AT91_US_RXBRK;
+        /*
+         * Characters to ignore
+         */
+        port->ignore_status_mask = 0;
+        if (termios->c_iflag & IGNPAR)
+                port->ignore_status_mask |= (AT91_US_FRAME | AT91_US_PARE);
+        if (termios->c_iflag & IGNBRK) {
+                port->ignore_status_mask |= AT91_US_RXBRK;
+                /*
+                 * If we're ignoring parity and break indicators,
+                 * ignore overruns too (for real raw support).
+                 */
+                if (termios->c_iflag & IGNPAR)
+                        port->ignore_status_mask |= AT91_US_OVRE;
+        }
+        // TODO: Ignore all characters if CREAD is set.
+        /* update the per-port timeout */
+        uart_update_timeout(port, termios->c_cflag, baud);
+        /* disable interrupts and drain transmitter */
+        imr = UART_GET_IMR(port);       /* get interrupt mask */
+        UART_PUT_IDR(port, -1);         /* disable all interrupts */
+        while (!(UART_GET_CSR(port) & AT91_US_TXEMPTY)) { barrier(); }
+        /* disable receiver and transmitter */
+        UART_PUT_CR(port, AT91_US_TXDIS | AT91_US_RXDIS);
+        /* set the parity, stop bits and data size */
+        UART_PUT_MR(port, mode);
+        /* set the baud rate */
+        UART_PUT_BRGR(port, quot);
+        UART_PUT_CR(port, AT91_US_RSTSTA | AT91_US_RSTRX);
+        UART_PUT_CR(port, AT91_US_TXEN | AT91_US_RXEN);
+        /* restore interrupts */
+        UART_PUT_IER(port, imr);
+        /* CTS flow-control and modem-status interrupts */
+        if (UART_ENABLE_MS(port, termios->c_cflag))
+                port->ops->enable_ms(port);
+        spin_unlock_irqrestore(&port->lock, flags);
+}
+/*
+ * Return string describing the specified port
+ */
+static const char *at91_type(struct uart_port *port)
+{
+        return (port->type == PORT_AT91RM9200) ? "AT91_SERIAL" : NULL;
+}
+/*
+ * Release the memory region(s) being used by 'port'.
+ */
+static void at91_release_port(struct uart_port *port)
+{
+        release_mem_region(port->mapbase,
+                (port->mapbase == AT91_VA_BASE_DBGU) ? 512 : SZ_16K);
+}
+/*
+ * Request the memory region(s) being used by 'port'.
+ */
+static int at91_request_port(struct uart_port *port)
+{
+        return request_mem_region(port->mapbase,
+                (port->mapbase == AT91_VA_BASE_DBGU) ? 512 : SZ_16K,
+                "at91_serial") != NULL ? 0 : -EBUSY;
+}
+/*
+ * Configure/autoconfigure the port.
+ */
+static void at91_config_port(struct uart_port *port, int flags)
+{
+        if (flags & UART_CONFIG_TYPE) {
+                port->type = PORT_AT91RM9200;
+                at91_request_port(port);
+        }
+}
+/*
+ * Verify the new serial_struct (for TIOCSSERIAL).
+ */
+static int at91_verify_port(struct uart_port *port, struct serial_struct *ser)
+{
+        int ret = 0;
+        if (ser->type != PORT_UNKNOWN && ser->type != PORT_AT91RM9200)
+                ret = -EINVAL;
+        if (port->irq != ser->irq)
+                ret = -EINVAL;
+        if (ser->io_type != SERIAL_IO_MEM)
+                ret = -EINVAL;
+        if (port->uartclk / 16 != ser->baud_base)
+                ret = -EINVAL;
+        if ((void *)port->mapbase != ser->iomem_base)
+                ret = -EINVAL;
+        if (port->iobase != ser->port)
+                ret = -EINVAL;
+        if (ser->hub6 != 0)
+                ret = -EINVAL;
+        return ret;
+}
+static struct uart_ops at91_pops = {
+        .tx_empty       = at91_tx_empty,
+        .set_mctrl      = at91_set_mctrl,
+        .get_mctrl      = at91_get_mctrl,
+        .stop_tx        = at91_stop_tx,
+        .start_tx       = at91_start_tx,
+        .stop_rx        = at91_stop_rx,
+        .enable_ms      = at91_enable_ms,
+        .break_ctl      = at91_break_ctl,
+        .startup        = at91_startup,
+        .shutdown       = at91_shutdown,
+        .set_termios    = at91_set_termios,
+        .type           = at91_type,
+        .release_port   = at91_release_port,
+        .request_port   = at91_request_port,
+        .config_port    = at91_config_port,
+        .verify_port    = at91_verify_port,
+        .pm             = at91_serial_pm,
+};
+static struct uart_port at91_ports[AT91_NR_UART];
+void __init at91_init_ports(void)
+{
+        static int first = 1;
+        int i;
+        if (!first)
+                return;
+        first = 0;
+        for (i = 0; i < AT91_NR_UART; i++) {
+                at91_ports[i].iotype    = UPIO_MEM;
+                at91_ports[i].flags     = UPF_BOOT_AUTOCONF;
+                at91_ports[i].uartclk   = at91_master_clock;
+                at91_ports[i].ops       = &at91_pops;
+                at91_ports[i].fifosize  = 1;
+                at91_ports[i].line      = i;
+        }
+}
+void __init at91_register_uart_fns(struct at91rm9200_port_fns *fns)
+{
+        if (fns->enable_ms)
+                at91_pops.enable_ms = fns->enable_ms;
+        if (fns->get_mctrl)
+                at91_pops.get_mctrl = fns->get_mctrl;
+        if (fns->set_mctrl)
+                at91_pops.set_mctrl = fns->set_mctrl;
+        at91_open          = fns->open;
+        at91_close         = fns->close;
+        at91_pops.pm       = fns->pm;
+        at91_pops.set_wake = fns->set_wake;
+}
+/*
+ * Setup ports.
+ */
+void __init at91_register_uart(int idx, int port)
+{
+        if ((idx < 0) || (idx >= AT91_NR_UART)) {
+                printk(KERN_ERR "%s: bad index number %d\n", __FUNCTION__, idx);
+                return;
+        }
+        switch (port) {
+        case 0:
+                at91_ports[idx].membase = (void __iomem *) AT91_VA_BASE_US0;
+                at91_ports[idx].mapbase = AT91_VA_BASE_US0;
+                at91_ports[idx].irq     = AT91_ID_US0;
+                AT91_CfgPIO_USART0();
+                break;
+        case 1:
+                at91_ports[idx].membase = (void __iomem *) AT91_VA_BASE_US1;
+                at91_ports[idx].mapbase = AT91_VA_BASE_US1;
+                at91_ports[idx].irq     = AT91_ID_US1;
+                AT91_CfgPIO_USART1();
+                break;
+        case 2:
+                at91_ports[idx].membase = (void __iomem *) AT91_VA_BASE_US2;
+                at91_ports[idx].mapbase = AT91_VA_BASE_US2;
+                at91_ports[idx].irq     = AT91_ID_US2;
+                AT91_CfgPIO_USART2();
+                break;
+        case 3:
+                at91_ports[idx].membase = (void __iomem *) AT91_VA_BASE_US3;
+                at91_ports[idx].mapbase = AT91_VA_BASE_US3;
+                at91_ports[idx].irq     = AT91_ID_US3;
+                AT91_CfgPIO_USART3();
+                break;
+        case 4:
+                at91_ports[idx].membase = (void __iomem *) AT91_VA_BASE_DBGU;
+                at91_ports[idx].mapbase = AT91_VA_BASE_DBGU;
+                at91_ports[idx].irq     = AT91_ID_SYS;
+                AT91_CfgPIO_DBGU();
+                break;
+        default:
+                printk(KERN_ERR  "%s : bad port number %d\n", __FUNCTION__, port);
+        }
+}
+#ifdef CONFIG_SERIAL_AT91_CONSOLE
+/*
+ * Interrupts are disabled on entering
+ */
+static void at91_console_write(struct console *co, const char *s, u_int count)
+{
+        struct uart_port *port = at91_ports + co->index;
+        unsigned int status, i, imr;
+        /*
+         *      First, save IMR and then disable interrupts
+         */
+        imr = UART_GET_IMR(port);       /* get interrupt mask */
+        UART_PUT_IDR(port, AT91_US_RXRDY | AT91_US_TXRDY);
+        /*
+         *      Now, do each character
+         */
+        for (i = 0; i < count; i++) {
+                do {
+                        status = UART_GET_CSR(port);
+                } while (!(status & AT91_US_TXRDY));
+                UART_PUT_CHAR(port, s[i]);
+                if (s[i] == '\n') {
+                        do {
+                                status = UART_GET_CSR(port);
+                        } while (!(status & AT91_US_TXRDY));
+                        UART_PUT_CHAR(port, '\r');
+                }
+        }
+        /*
+         *      Finally, wait for transmitter to become empty
+         *      and restore IMR
+         */
+        do {
+                status = UART_GET_CSR(port);
+        } while (!(status & AT91_US_TXRDY));
+        UART_PUT_IER(port, imr);        /* set interrupts back the way they were */
+}
+/*
+ * If the port was already initialised (eg, by a boot loader), try to determine
+ * the current setup.
+ */
+static void __init at91_console_get_options(struct uart_port *port, int *baud, int *parity, int *bits)
+{
+        unsigned int mr, quot;
+// TODO: CR is a write-only register
+//      unsigned int cr;
+//
+//      cr = UART_GET_CR(port) & (AT91_US_RXEN | AT91_US_TXEN);
+//      if (cr == (AT91_US_RXEN | AT91_US_TXEN)) {
+//              /* ok, the port was enabled */
+//      }
+        mr = UART_GET_MR(port) & AT91_US_CHRL;
+        if (mr == AT91_US_CHRL_8)
+                *bits = 8;
+        else
+                *bits = 7;
+        mr = UART_GET_MR(port) & AT91_US_PAR;
+        if (mr == AT91_US_PAR_EVEN)
+                *parity = 'e';
+        else if (mr == AT91_US_PAR_ODD)
+                *parity = 'o';
+        quot = UART_GET_BRGR(port);
+        *baud = port->uartclk / (16 * (quot));
+}
+static int __init at91_console_setup(struct console *co, char *options)
+{
+        struct uart_port *port;
+        int baud = 115200;
+        int bits = 8;
+        int parity = 'n';
+        int flow = 'n';
+        /*
+         * Check whether an invalid uart number has been specified, and
+         * if so, search for the first available port that does have
+         * console support.
+         */
+        port = uart_get_console(at91_ports, AT91_NR_UART, co);
+        /*
+         * Enable the serial console, in-case bootloader did not do it.
+         */
+        at91_sys_write(AT91_PMC_PCER, 1 << port->irq);  /* enable clock */
+        UART_PUT_IDR(port, -1);                         /* disable interrupts */
+        UART_PUT_CR(port, AT91_US_RSTSTA | AT91_US_RSTRX);
+        UART_PUT_CR(port, AT91_US_TXEN | AT91_US_RXEN);
+        if (options)
+                uart_parse_options(options, &baud, &parity, &bits, &flow);
+        else
+                at91_console_get_options(port, &baud, &parity, &bits);
+        return uart_set_options(port, co, baud, parity, bits, flow);
+}
+static struct uart_driver at91_uart;
+static struct console at91_console = {
+        .name           = AT91_DEVICENAME,
+        .write          = at91_console_write,
+        .device         = uart_console_device,
+        .setup          = at91_console_setup,
+        .flags          = CON_PRINTBUFFER,
+        .index          = -1,
+        .data           = &at91_uart,
+};
+#define AT91_CONSOLE_DEVICE     &at91_console
+static int  __init at91_console_init(void)
+{
+        at91_init_ports();
+        at91_console.index = at91_console_port;
+        register_console(&at91_console);
+        return 0;
+}
+console_initcall(at91_console_init);
+#else
+#define AT91_CONSOLE_DEVICE     NULL
+#endif
+static struct uart_driver at91_uart = {
+        .owner                  = THIS_MODULE,
+        .driver_name            = AT91_DEVICENAME,
+        .dev_name               = AT91_DEVICENAME,
+        .devfs_name             = AT91_DEVICENAME,
+        .major                  = SERIAL_AT91_MAJOR,
+        .minor                  = MINOR_START,
+        .nr                     = AT91_NR_UART,
+        .cons                   = AT91_CONSOLE_DEVICE,
+};
+static int __init at91_serial_init(void)
+{
+        int ret, i;
+        at91_init_ports();
+        ret = uart_register_driver(&at91_uart);
+        if (ret)
+                return ret;
+        for (i = 0; i < AT91_NR_UART; i++) {
+                if (at91_serial_map[i] >= 0)
+                        uart_add_one_port(&at91_uart, &at91_ports[i]);
+        }
+        return 0;
+}
+static void __exit at91_serial_exit(void)
+{
+        int i;
+        for (i = 0; i < AT91_NR_UART; i++) {
+                if (at91_serial_map[i] >= 0)
+                        uart_remove_one_port(&at91_uart, &at91_ports[i]);
+        }
+        uart_unregister_driver(&at91_uart);
+}
+module_init(at91_serial_init);
+module_exit(at91_serial_exit);
+MODULE_AUTHOR("Rick Bronson");
+MODULE_DESCRIPTION("AT91 generic serial port driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/serial/crisv10.c b/drivers/serial/crisv10.c
index 08c42c000188..be12623d8544 100644
--- a/drivers/serial/crisv10.c
+++ b/drivers/serial/crisv10.c
@@ -442,6 +442,7 @@ static char *serial_version = "$Revision: 1.25 $";
 #include <linux/init.h>
 #include <asm/uaccess.h>
 #include <linux/kernel.h>
+#include <linux/mutex.h>
 #include <asm/io.h>
 #include <asm/irq.h>
@@ -1315,11 +1316,7 @@ static const struct control_pins e100_modem_pins[NR_PORTS] =
 * memory if large numbers of serial ports are open.
 */
 static unsigned char *tmp_buf;
-#ifdef DECLARE_MUTEX
+static DEFINE_MUTEX(tmp_buf_mutex);
-static DECLARE_MUTEX(tmp_buf_sem);
-#else
-static struct semaphore tmp_buf_sem = MUTEX;
-#endif
 /* Calculate the chartime depending on baudrate, numbor of bits etc. */
 static void update_char_time(struct e100_serial * info)
@@ -3661,7 +3658,7 @@ rs_raw_write(struct tty_struct * tty, int from_user,
         * design.
         */
        if (from_user) {
-                down(&tmp_buf_sem);
+                mutex_lock(&tmp_buf_mutex);
                while (1) {
                        int c1;
                        c = CIRC_SPACE_TO_END(info->xmit.head,
@@ -3692,7 +3689,7 @@ rs_raw_write(struct tty_struct * tty, int from_user,
                        count -= c;
                        ret += c;
                }
-                up(&tmp_buf_sem);
+                mutex_unlock(&tmp_buf_mutex);
        } else {
                cli();
                while (count) {
diff --git a/drivers/serial/pmac_zilog.c b/drivers/serial/pmac_zilog.c
index f330d6c0e0df..5f52883e64d2 100644
--- a/drivers/serial/pmac_zilog.c
+++ b/drivers/serial/pmac_zilog.c
@@ -60,6 +60,7 @@
 #include <linux/pmu.h>
 #include <linux/bitops.h>
 #include <linux/sysrq.h>
+#include <linux/mutex.h>
 #include <asm/sections.h>
 #include <asm/io.h>
 #include <asm/irq.h>
@@ -96,7 +97,7 @@ MODULE_LICENSE("GPL");
 */
 static struct uart_pmac_port    pmz_ports[MAX_ZS_PORTS];
 static int                      pmz_ports_count;
-static DECLARE_MUTEX(pmz_irq_sem);
+static DEFINE_MUTEX(pmz_irq_mutex);
 static struct uart_driver pmz_uart_reg = {
        .owner          =       THIS_MODULE,
@@ -922,7 +923,7 @@ static int pmz_startup(struct uart_port *port)
        if (uap->node == NULL)
                return -ENODEV;
-        down(&pmz_irq_sem);
+        mutex_lock(&pmz_irq_mutex);
        uap->flags |= PMACZILOG_FLAG_IS_OPEN;
@@ -940,11 +941,11 @@ static int pmz_startup(struct uart_port *port)
                dev_err(&uap->dev->ofdev.dev,
                        "Unable to register zs interrupt handler.\n");
                pmz_set_scc_power(uap, 0);
-                up(&pmz_irq_sem);
+                mutex_unlock(&pmz_irq_mutex);
                return -ENXIO;
        }
-        up(&pmz_irq_sem);
+        mutex_unlock(&pmz_irq_mutex);
        /* Right now, we deal with delay by blocking here, I'll be
         * smarter later on
@@ -981,7 +982,7 @@ static void pmz_shutdown(struct uart_port *port)
        if (uap->node == NULL)
                return;
-        down(&pmz_irq_sem);
+        mutex_lock(&pmz_irq_mutex);
        /* Release interrupt handler */
        free_irq(uap->port.irq, uap);
@@ -1002,7 +1003,7 @@ static void pmz_shutdown(struct uart_port *port)
        if (ZS_IS_CONS(uap) || ZS_IS_ASLEEP(uap)) {
                spin_unlock_irqrestore(&port->lock, flags);
-                up(&pmz_irq_sem);
+                mutex_unlock(&pmz_irq_mutex);
                return;
        }
@@ -1019,7 +1020,7 @@ static void pmz_shutdown(struct uart_port *port)
        spin_unlock_irqrestore(&port->lock, flags);
-        up(&pmz_irq_sem);
+        mutex_unlock(&pmz_irq_mutex);
        pmz_debug("pmz: shutdown() done.\n");
 }
@@ -1591,7 +1592,7 @@ static int pmz_suspend(struct macio_dev *mdev, pm_message_t pm_state)
        state = pmz_uart_reg.state + uap->port.line;
-        down(&pmz_irq_sem);
+        mutex_lock(&pmz_irq_mutex);
        down(&state->sem);
        spin_lock_irqsave(&uap->port.lock, flags);
@@ -1624,7 +1625,7 @@ static int pmz_suspend(struct macio_dev *mdev, pm_message_t pm_state)
        pmz_set_scc_power(uap, 0);
        up(&state->sem);
-        up(&pmz_irq_sem);
+        mutex_unlock(&pmz_irq_mutex);
        pmz_debug("suspend, switching complete\n");
@@ -1651,7 +1652,7 @@ static int pmz_resume(struct macio_dev *mdev)
        state = pmz_uart_reg.state + uap->port.line;
-        down(&pmz_irq_sem);
+        mutex_lock(&pmz_irq_mutex);
        down(&state->sem);
        spin_lock_irqsave(&uap->port.lock, flags);
@@ -1685,7 +1686,7 @@ static int pmz_resume(struct macio_dev *mdev)
 bail:
        up(&state->sem);
-        up(&pmz_irq_sem);
+        mutex_unlock(&pmz_irq_mutex);
        /* Right now, we deal with delay by blocking here, I'll be
         * smarter later on
diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
index 9589509fc5bd..2ca620900bcc 100644
--- a/drivers/serial/serial_core.c
+++ b/drivers/serial/serial_core.c
@@ -33,6 +33,7 @@
 #include <linux/device.h>
 #include <linux/serial.h> /* for serial_state and serial_icounter_struct */
 #include <linux/delay.h>
+#include <linux/mutex.h>
 #include <asm/irq.h>
 #include <asm/uaccess.h>
@@ -47,7 +48,7 @@
 /*
 * This is used to lock changes in serial line configuration.
 */
-static DECLARE_MUTEX(port_sem);
+static DEFINE_MUTEX(port_mutex);
 #define HIGH_BITS_OFFSET        ((sizeof(long)-sizeof(int))*8)
@@ -1472,7 +1473,7 @@ static struct uart_state *uart_get(struct uart_driver *drv, int line)
 {
        struct uart_state *state;
-        down(&port_sem);
+        mutex_lock(&port_mutex);
        state = drv->state + line;
        if (down_interruptible(&state->sem)) {
                state = ERR_PTR(-ERESTARTSYS);
@@ -1509,7 +1510,7 @@ static struct uart_state *uart_get(struct uart_driver *drv, int line)
        }
 out:
-        up(&port_sem);
+        mutex_unlock(&port_mutex);
        return state;
 }
@@ -2219,7 +2220,7 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *port)
        state = drv->state + port->line;
-        down(&port_sem);
+        mutex_lock(&port_mutex);
        if (state->port) {
                ret = -EINVAL;
                goto out;
@@ -2255,7 +2256,7 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *port)
                register_console(port->cons);
 out:
-        up(&port_sem);
+        mutex_unlock(&port_mutex);
        return ret;
 }
@@ -2279,7 +2280,7 @@ int uart_remove_one_port(struct uart_driver *drv, struct uart_port *port)
                printk(KERN_ALERT "Removing wrong port: %p != %p\n",
                        state->port, port);
-        down(&port_sem);
+        mutex_lock(&port_mutex);
        /*
         * Remove the devices from devfs
@@ -2288,7 +2289,7 @@ int uart_remove_one_port(struct uart_driver *drv, struct uart_port *port)
        uart_unconfigure_port(drv, state);
        state->port = NULL;
-        up(&port_sem);
+        mutex_unlock(&port_mutex);
        return 0;
 }
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index 96969cb960a9..c30333694fde 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -785,6 +785,8 @@ static struct pcmcia_device_id serial_ids[] = {
        PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0101, 0x0035, "3CXEM556.cis"),
        PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0101, 0x003d, "3CXEM556.cis"),
        PCMCIA_DEVICE_CIS_MANF_CARD(0x0192, 0x0710, "SW_7xx_SER.cis"),  /* Sierra Wireless AC710/AC750 GPRS Network Adapter R1 */
+        PCMCIA_DEVICE_CIS_MANF_CARD(0x0192, 0xa555, "SW_555_SER.cis"),  /* Sierra Aircard 555 CDMA 1xrtt Modem -- pre update */
+        PCMCIA_DEVICE_CIS_MANF_CARD(0x013f, 0xa555, "SW_555_SER.cis"),  /* Sierra Aircard 555 CDMA 1xrtt Modem -- post update */
        PCMCIA_DEVICE_CIS_PROD_ID12("MultiTech", "PCMCIA 56K DataFax", 0x842047ee, 0xc2efcf03, "MT5634ZLX.cis"),
        PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-4", 0x96913a85, 0xcec8f102, "COMpad4.cis"),
        PCMCIA_DEVICE_CIS_PROD_ID123("ADVANTECH", "COMpad-32/85", "1.0", 0x96913a85, 0x8fbe92ae, 0x0877b627, "COMpad2.cis"),
diff --git a/drivers/serial/serial_txx9.c b/drivers/serial/serial_txx9.c
index fdd1f1915a42..ee98a867bc6d 100644
--- a/drivers/serial/serial_txx9.c
+++ b/drivers/serial/serial_txx9.c
@@ -52,6 +52,7 @@
 #include <linux/tty_flip.h>
 #include <linux/serial_core.h>
 #include <linux/serial.h>
+#include <linux/mutex.h>
 #include <asm/io.h>
 #include <asm/irq.h>
@@ -1018,7 +1019,7 @@ static void serial_txx9_resume_port(int line)
        uart_resume_port(&serial_txx9_reg, &serial_txx9_ports[line].port);
 }
-static DECLARE_MUTEX(serial_txx9_sem);
+static DEFINE_MUTEX(serial_txx9_mutex);
 /**
 *      serial_txx9_register_port - register a serial port
@@ -1037,7 +1038,7 @@ static int __devinit serial_txx9_register_port(struct uart_port *port)
        struct uart_txx9_port *uart;
        int ret = -ENOSPC;
-        down(&serial_txx9_sem);
+        mutex_lock(&serial_txx9_mutex);
        for (i = 0; i < UART_NR; i++) {
                uart = &serial_txx9_ports[i];
                if (uart->port.type == PORT_UNKNOWN)
@@ -1058,7 +1059,7 @@ static int __devinit serial_txx9_register_port(struct uart_port *port)
                if (ret == 0)
                        ret = uart->port.line;
        }
-        up(&serial_txx9_sem);
+        mutex_unlock(&serial_txx9_mutex);
        return ret;
 }
@@ -1073,7 +1074,7 @@ static void __devexit serial_txx9_unregister_port(int line)
 {
        struct uart_txx9_port *uart = &serial_txx9_ports[line];
-        down(&serial_txx9_sem);
+        mutex_lock(&serial_txx9_mutex);
        uart_remove_one_port(&serial_txx9_reg, &uart->port);
        uart->port.flags = 0;
        uart->port.type = PORT_UNKNOWN;
@@ -1082,7 +1083,7 @@ static void __devexit serial_txx9_unregister_port(int line)
        uart->port.membase = 0;
        uart->port.dev = NULL;
        uart_add_one_port(&serial_txx9_reg, &uart->port);
-        up(&serial_txx9_sem);
+        mutex_unlock(&serial_txx9_mutex);
 }
 /*
diff --git a/drivers/sh/superhyway/superhyway.c b/drivers/sh/superhyway/superhyway.c
index 7bdab2a7f59c..94b229031198 100644
--- a/drivers/sh/superhyway/superhyway.c
+++ b/drivers/sh/superhyway/superhyway.c
@@ -175,8 +175,6 @@ int superhyway_register_driver(struct superhyway_driver *drv)
 {
        drv->drv.name   = drv->name;
        drv->drv.bus    = &superhyway_bus_type;
-        drv->drv.probe  = superhyway_device_probe;
-        drv->drv.remove = superhyway_device_remove;
        return driver_register(&drv->drv);
 }
@@ -213,6 +211,8 @@ struct bus_type superhyway_bus_type = {
 #ifdef CONFIG_SYSFS
        .dev_attrs      = superhyway_dev_attrs,
 #endif
+        .probe          = superhyway_device_probe,
+        .remove         = superhyway_device_remove,
 };
 static int __init superhyway_bus_init(void)
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
new file mode 100644
index 000000000000..b77dbd63e596
--- /dev/null
+++ b/drivers/spi/Kconfig
@@ -0,0 +1,109 @@
+#
+# SPI driver configuration
+#
+# NOTE:  the reason this doesn't show SPI slave support is mostly that
+# nobody's needed a slave side API yet.  The master-role API is not
+# fully appropriate there, so it'd need some thought to do well.
+#
+menu "SPI support"
+config SPI
+        bool "SPI support"
+        help
+          The "Serial Peripheral Interface" is a low level synchronous
+          protocol.  Chips that support SPI can have data transfer rates
+          up to several tens of Mbit/sec.  Chips are addressed with a
+          controller and a chipselect.  Most SPI slaves don't support
+          dynamic device discovery; some are even write-only or read-only.
+          SPI is widely used by microcontollers to talk with sensors,
+          eeprom and flash memory, codecs and various other controller
+          chips, analog to digital (and d-to-a) converters, and more.
+          MMC and SD cards can be accessed using SPI protocol; and for
+          DataFlash cards used in MMC sockets, SPI must always be used.
+          SPI is one of a family of similar protocols using a four wire
+          interface (select, clock, data in, data out) including Microwire
+          (half duplex), SSP, SSI, and PSP.  This driver framework should
+          work with most such devices and controllers.
+config SPI_DEBUG
+        boolean "Debug support for SPI drivers"
+        depends on SPI && DEBUG_KERNEL
+        help
+          Say "yes" to enable debug messaging (like dev_dbg and pr_debug),
+          sysfs, and debugfs support in SPI controller and protocol drivers.
+#
+# MASTER side ... talking to discrete SPI slave chips including microcontrollers
+#
+config SPI_MASTER
+#       boolean "SPI Master Support"
+        boolean
+        default SPI
+        help
+          If your system has an master-capable SPI controller (which
+          provides the clock and chipselect), you can enable that
+          controller and the protocol drivers for the SPI slave chips
+          that are connected.
+comment "SPI Master Controller Drivers"
+        depends on SPI_MASTER
+config SPI_BITBANG
+        tristate "Bitbanging SPI master"
+        depends on SPI_MASTER && EXPERIMENTAL
+        help
+          With a few GPIO pins, your system can bitbang the SPI protocol.
+          Select this to get SPI support through I/O pins (GPIO, parallel
+          port, etc).  Or, some systems' SPI master controller drivers use
+          this code to manage the per-word or per-transfer accesses to the
+          hardware shift registers.
+          This is library code, and is automatically selected by drivers that
+          need it.  You only need to select this explicitly to support driver
+          modules that aren't part of this kernel tree.
+config SPI_BUTTERFLY
+        tristate "Parallel port adapter for AVR Butterfly (DEVELOPMENT)"
+        depends on SPI_MASTER && PARPORT && EXPERIMENTAL
+        select SPI_BITBANG
+        help
+          This uses a custom parallel port cable to connect to an AVR
+          Butterfly <http://www.atmel.com/products/avr/butterfly>, an
+          inexpensive battery powered microcontroller evaluation board.
+          This same cable can be used to flash new firmware.
+config SPI_BUTTERFLY
+        tristate "Parallel port adapter for AVR Butterfly (DEVELOPMENT)"
+        depends on SPI_MASTER && PARPORT && EXPERIMENTAL
+        select SPI_BITBANG
+        help
+          This uses a custom parallel port cable to connect to an AVR
+          Butterfly <http://www.atmel.com/products/avr/butterfly>, an
+          inexpensive battery powered microcontroller evaluation board.
+          This same cable can be used to flash new firmware.
+#
+# Add new SPI master controllers in alphabetical order above this line
+#
+#
+# There are lots of SPI device types, with sensors and memory
+# being probably the most widely used ones.
+#
+comment "SPI Protocol Masters"
+        depends on SPI_MASTER
+#
+# Add new SPI protocol masters in alphabetical order above this line
+#
+# (slave support would go here)
+endmenu # "SPI support"
diff --git a/drivers/spi/Makefile b/drivers/spi/Makefile
new file mode 100644
index 000000000000..c2c87e845abf
--- /dev/null
+++ b/drivers/spi/Makefile
@@ -0,0 +1,25 @@
+#
+# Makefile for kernel SPI drivers.
+#
+ifeq ($(CONFIG_SPI_DEBUG),y)
+EXTRA_CFLAGS += -DDEBUG
+endif
+# small core, mostly translating board-specific
+# config declarations into driver model code
+obj-$(CONFIG_SPI_MASTER)                += spi.o
+# SPI master controller drivers (bus)
+obj-$(CONFIG_SPI_BITBANG)               += spi_bitbang.o
+obj-$(CONFIG_SPI_BUTTERFLY)             += spi_butterfly.o
+#       ... add above this line ...
+# SPI protocol drivers (device/link on bus)
+#       ... add above this line ...
+# SPI slave controller drivers (upstream link)
+#       ... add above this line ...
+# SPI slave drivers (protocol for that link)
+#       ... add above this line ...
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
new file mode 100644
index 000000000000..791c4dc550ae
--- /dev/null
+++ b/drivers/spi/spi.c
@@ -0,0 +1,642 @@
+/*
+ * spi.c - SPI init/core code
+ *
+ * Copyright (C) 2005 David Brownell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+#include <linux/autoconf.h>
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/init.h>
+#include <linux/cache.h>
+#include <linux/spi/spi.h>
+/* SPI bustype and spi_master class are registered after board init code
+ * provides the SPI device tables, ensuring that both are present by the
+ * time controller driver registration causes spi_devices to "enumerate".
+ */
+static void spidev_release(struct device *dev)
+{
+        const struct spi_device *spi = to_spi_device(dev);
+        /* spi masters may cleanup for released devices */
+        if (spi->master->cleanup)
+                spi->master->cleanup(spi);
+        spi_master_put(spi->master);
+        kfree(dev);
+}
+static ssize_t
+modalias_show(struct device *dev, struct device_attribute *a, char *buf)
+{
+        const struct spi_device *spi = to_spi_device(dev);
+        return snprintf(buf, BUS_ID_SIZE + 1, "%s\n", spi->modalias);
+}
+static struct device_attribute spi_dev_attrs[] = {
+        __ATTR_RO(modalias),
+        __ATTR_NULL,
+};
+/* modalias support makes "modprobe $MODALIAS" new-style hotplug work,
+ * and the sysfs version makes coldplug work too.
+ */
+static int spi_match_device(struct device *dev, struct device_driver *drv)
+{
+        const struct spi_device *spi = to_spi_device(dev);
+        return strncmp(spi->modalias, drv->name, BUS_ID_SIZE) == 0;
+}
+static int spi_uevent(struct device *dev, char **envp, int num_envp,
+                char *buffer, int buffer_size)
+{
+        const struct spi_device         *spi = to_spi_device(dev);
+        envp[0] = buffer;
+        snprintf(buffer, buffer_size, "MODALIAS=%s", spi->modalias);
+        envp[1] = NULL;
+        return 0;
+}
+#ifdef  CONFIG_PM
+/*
+ * NOTE:  the suspend() method for an spi_master controller driver
+ * should verify that all its child devices are marked as suspended;
+ * suspend requests delivered through sysfs power/state files don't
+ * enforce such constraints.
+ */
+static int spi_suspend(struct device *dev, pm_message_t message)
+{
+        int                     value;
+        struct spi_driver       *drv = to_spi_driver(dev->driver);
+        if (!drv->suspend)
+                return 0;
+        /* suspend will stop irqs and dma; no more i/o */
+        value = drv->suspend(to_spi_device(dev), message);
+        if (value == 0)
+                dev->power.power_state = message;
+        return value;
+}
+static int spi_resume(struct device *dev)
+{
+        int                     value;
+        struct spi_driver       *drv = to_spi_driver(dev->driver);
+        if (!drv->resume)
+                return 0;
+        /* resume may restart the i/o queue */
+        value = drv->resume(to_spi_device(dev));
+        if (value == 0)
+                dev->power.power_state = PMSG_ON;
+        return value;
+}
+#else
+#define spi_suspend     NULL
+#define spi_resume      NULL
+#endif
+struct bus_type spi_bus_type = {
+        .name           = "spi",
+        .dev_attrs      = spi_dev_attrs,
+        .match          = spi_match_device,
+        .uevent         = spi_uevent,
+        .suspend        = spi_suspend,
+        .resume         = spi_resume,
+};
+EXPORT_SYMBOL_GPL(spi_bus_type);
+static int spi_drv_probe(struct device *dev)
+{
+        const struct spi_driver         *sdrv = to_spi_driver(dev->driver);
+        return sdrv->probe(to_spi_device(dev));
+}
+static int spi_drv_remove(struct device *dev)
+{
+        const struct spi_driver         *sdrv = to_spi_driver(dev->driver);
+        return sdrv->remove(to_spi_device(dev));
+}
+static void spi_drv_shutdown(struct device *dev)
+{
+        const struct spi_driver         *sdrv = to_spi_driver(dev->driver);
+        sdrv->shutdown(to_spi_device(dev));
+}
+int spi_register_driver(struct spi_driver *sdrv)
+{
+        sdrv->driver.bus = &spi_bus_type;
+        if (sdrv->probe)
+                sdrv->driver.probe = spi_drv_probe;
+        if (sdrv->remove)
+                sdrv->driver.remove = spi_drv_remove;
+        if (sdrv->shutdown)
+                sdrv->driver.shutdown = spi_drv_shutdown;
+        return driver_register(&sdrv->driver);
+}
+EXPORT_SYMBOL_GPL(spi_register_driver);
+/*-------------------------------------------------------------------------*/
+/* SPI devices should normally not be created by SPI device drivers; that
+ * would make them board-specific.  Similarly with SPI master drivers.
+ * Device registration normally goes into like arch/.../mach.../board-YYY.c
+ * with other readonly (flashable) information about mainboard devices.
+ */
+struct boardinfo {
+        struct list_head        list;
+        unsigned                n_board_info;
+        struct spi_board_info   board_info[0];
+};
+static LIST_HEAD(board_list);
+static DECLARE_MUTEX(board_lock);
+/* On typical mainboards, this is purely internal; and it's not needed
+ * after board init creates the hard-wired devices.  Some development
+ * platforms may not be able to use spi_register_board_info though, and
+ * this is exported so that for example a USB or parport based adapter
+ * driver could add devices (which it would learn about out-of-band).
+ */
+struct spi_device *__init_or_module
+spi_new_device(struct spi_master *master, struct spi_board_info *chip)
+{
+        struct spi_device       *proxy;
+        struct device           *dev = master->cdev.dev;
+        int                     status;
+        /* NOTE:  caller did any chip->bus_num checks necessary */
+        if (!spi_master_get(master))
+                return NULL;
+        proxy = kzalloc(sizeof *proxy, GFP_KERNEL);
+        if (!proxy) {
+                dev_err(dev, "can't alloc dev for cs%d\n",
+                        chip->chip_select);
+                goto fail;
+        }
+        proxy->master = master;
+        proxy->chip_select = chip->chip_select;
+        proxy->max_speed_hz = chip->max_speed_hz;
+        proxy->irq = chip->irq;
+        proxy->modalias = chip->modalias;
+        snprintf(proxy->dev.bus_id, sizeof proxy->dev.bus_id,
+                        "%s.%u", master->cdev.class_id,
+                        chip->chip_select);
+        proxy->dev.parent = dev;
+        proxy->dev.bus = &spi_bus_type;
+        proxy->dev.platform_data = (void *) chip->platform_data;
+        proxy->controller_data = chip->controller_data;
+        proxy->controller_state = NULL;
+        proxy->dev.release = spidev_release;
+        /* drivers may modify this default i/o setup */
+        status = master->setup(proxy);
+        if (status < 0) {
+                dev_dbg(dev, "can't %s %s, status %d\n",
+                                "setup", proxy->dev.bus_id, status);
+                goto fail;
+        }
+        /* driver core catches callers that misbehave by defining
+         * devices that already exist.
+         */
+        status = device_register(&proxy->dev);
+        if (status < 0) {
+                dev_dbg(dev, "can't %s %s, status %d\n",
+                                "add", proxy->dev.bus_id, status);
+                goto fail;
+        }
+        dev_dbg(dev, "registered child %s\n", proxy->dev.bus_id);
+        return proxy;
+fail:
+        spi_master_put(master);
+        kfree(proxy);
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(spi_new_device);
+/*
+ * Board-specific early init code calls this (probably during arch_initcall)
+ * with segments of the SPI device table.  Any device nodes are created later,
+ * after the relevant parent SPI controller (bus_num) is defined.  We keep
+ * this table of devices forever, so that reloading a controller driver will
+ * not make Linux forget about these hard-wired devices.
+ *
+ * Other code can also call this, e.g. a particular add-on board might provide
+ * SPI devices through its expansion connector, so code initializing that board
+ * would naturally declare its SPI devices.
+ *
+ * The board info passed can safely be __initdata ... but be careful of
+ * any embedded pointers (platform_data, etc), they're copied as-is.
+ */
+int __init
+spi_register_board_info(struct spi_board_info const *info, unsigned n)
+{
+        struct boardinfo        *bi;
+        bi = kmalloc(sizeof(*bi) + n * sizeof *info, GFP_KERNEL);
+        if (!bi)
+                return -ENOMEM;
+        bi->n_board_info = n;
+        memcpy(bi->board_info, info, n * sizeof *info);
+        down(&board_lock);
+        list_add_tail(&bi->list, &board_list);
+        up(&board_lock);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(spi_register_board_info);
+/* FIXME someone should add support for a __setup("spi", ...) that
+ * creates board info from kernel command lines
+ */
+static void __init_or_module
+scan_boardinfo(struct spi_master *master)
+{
+        struct boardinfo        *bi;
+        struct device           *dev = master->cdev.dev;
+        down(&board_lock);
+        list_for_each_entry(bi, &board_list, list) {
+                struct spi_board_info   *chip = bi->board_info;
+                unsigned                n;
+                for (n = bi->n_board_info; n > 0; n--, chip++) {
+                        if (chip->bus_num != master->bus_num)
+                                continue;
+                        /* some controllers only have one chip, so they
+                         * might not use chipselects.  otherwise, the
+                         * chipselects are numbered 0..max.
+                         */
+                        if (chip->chip_select >= master->num_chipselect
+                                        && master->num_chipselect) {
+                                dev_dbg(dev, "cs%d > max %d\n",
+                                        chip->chip_select,
+                                        master->num_chipselect);
+                                continue;
+                        }
+                        (void) spi_new_device(master, chip);
+                }
+        }
+        up(&board_lock);
+}
+/*-------------------------------------------------------------------------*/
+static void spi_master_release(struct class_device *cdev)
+{
+        struct spi_master *master;
+        master = container_of(cdev, struct spi_master, cdev);
+        kfree(master);
+}
+static struct class spi_master_class = {
+        .name           = "spi_master",
+        .owner          = THIS_MODULE,
+        .release        = spi_master_release,
+};
+/**
+ * spi_alloc_master - allocate SPI master controller
+ * @dev: the controller, possibly using the platform_bus
+ * @size: how much driver-private data to preallocate; the pointer to this
+ *      memory is in the class_data field of the returned class_device,
+ *      accessible with spi_master_get_devdata().
+ *
+ * This call is used only by SPI master controller drivers, which are the
+ * only ones directly touching chip registers.  It's how they allocate
+ * an spi_master structure, prior to calling spi_add_master().
+ *
+ * This must be called from context that can sleep.  It returns the SPI
+ * master structure on success, else NULL.
+ *
+ * The caller is responsible for assigning the bus number and initializing
+ * the master's methods before calling spi_add_master(); and (after errors
+ * adding the device) calling spi_master_put() to prevent a memory leak.
+ */
+struct spi_master * __init_or_module
+spi_alloc_master(struct device *dev, unsigned size)
+{
+        struct spi_master       *master;
+        if (!dev)
+                return NULL;
+        master = kzalloc(size + sizeof *master, SLAB_KERNEL);
+        if (!master)
+                return NULL;
+        class_device_initialize(&master->cdev);
+        master->cdev.class = &spi_master_class;
+        master->cdev.dev = get_device(dev);
+        spi_master_set_devdata(master, &master[1]);
+        return master;
+}
+EXPORT_SYMBOL_GPL(spi_alloc_master);
+/**
+ * spi_register_master - register SPI master controller
+ * @master: initialized master, originally from spi_alloc_master()
+ *
+ * SPI master controllers connect to their drivers using some non-SPI bus,
+ * such as the platform bus.  The final stage of probe() in that code
+ * includes calling spi_register_master() to hook up to this SPI bus glue.
+ *
+ * SPI controllers use board specific (often SOC specific) bus numbers,
+ * and board-specific addressing for SPI devices combines those numbers
+ * with chip select numbers.  Since SPI does not directly support dynamic
+ * device identification, boards need configuration tables telling which
+ * chip is at which address.
+ *
+ * This must be called from context that can sleep.  It returns zero on
+ * success, else a negative error code (dropping the master's refcount).
+ * After a successful return, the caller is responsible for calling
+ * spi_unregister_master().
+ */
+int __init_or_module
+spi_register_master(struct spi_master *master)
+{
+        static atomic_t         dyn_bus_id = ATOMIC_INIT(0);
+        struct device           *dev = master->cdev.dev;
+        int                     status = -ENODEV;
+        int                     dynamic = 0;
+        if (!dev)
+                return -ENODEV;
+        /* convention:  dynamically assigned bus IDs count down from the max */
+        if (master->bus_num == 0) {
+                master->bus_num = atomic_dec_return(&dyn_bus_id);
+                dynamic = 1;
+        }
+        /* register the device, then userspace will see it.
+         * registration fails if the bus ID is in use.
+         */
+        snprintf(master->cdev.class_id, sizeof master->cdev.class_id,
+                "spi%u", master->bus_num);
+        status = class_device_add(&master->cdev);
+        if (status < 0)
+                goto done;
+        dev_dbg(dev, "registered master %s%s\n", master->cdev.class_id,
+                        dynamic ? " (dynamic)" : "");
+        /* populate children from any spi device tables */
+        scan_boardinfo(master);
+        status = 0;
+done:
+        return status;
+}
+EXPORT_SYMBOL_GPL(spi_register_master);
+static int __unregister(struct device *dev, void *unused)
+{
+        /* note: before about 2.6.14-rc1 this would corrupt memory: */
+        spi_unregister_device(to_spi_device(dev));
+        return 0;
+}
+/**
+ * spi_unregister_master - unregister SPI master controller
+ * @master: the master being unregistered
+ *
+ * This call is used only by SPI master controller drivers, which are the
+ * only ones directly touching chip registers.
+ *
+ * This must be called from context that can sleep.
+ */
+void spi_unregister_master(struct spi_master *master)
+{
+        (void) device_for_each_child(master->cdev.dev, NULL, __unregister);
+        class_device_unregister(&master->cdev);
+        master->cdev.dev = NULL;
+}
+EXPORT_SYMBOL_GPL(spi_unregister_master);
+/**
+ * spi_busnum_to_master - look up master associated with bus_num
+ * @bus_num: the master's bus number
+ *
+ * This call may be used with devices that are registered after
+ * arch init time.  It returns a refcounted pointer to the relevant
+ * spi_master (which the caller must release), or NULL if there is
+ * no such master registered.
+ */
+struct spi_master *spi_busnum_to_master(u16 bus_num)
+{
+        if (bus_num) {
+                char                    name[8];
+                struct kobject          *bus;
+                snprintf(name, sizeof name, "spi%u", bus_num);
+                bus = kset_find_obj(&spi_master_class.subsys.kset, name);
+                if (bus)
+                        return container_of(bus, struct spi_master, cdev.kobj);
+        }
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(spi_busnum_to_master);
+/*-------------------------------------------------------------------------*/
+static void spi_complete(void *arg)
+{
+        complete(arg);
+}
+/**
+ * spi_sync - blocking/synchronous SPI data transfers
+ * @spi: device with which data will be exchanged
+ * @message: describes the data transfers
+ *
+ * This call may only be used from a context that may sleep.  The sleep
+ * is non-interruptible, and has no timeout.  Low-overhead controller
+ * drivers may DMA directly into and out of the message buffers.
+ *
+ * Note that the SPI device's chip select is active during the message,
+ * and then is normally disabled between messages.  Drivers for some
+ * frequently-used devices may want to minimize costs of selecting a chip,
+ * by leaving it selected in anticipation that the next message will go
+ * to the same chip.  (That may increase power usage.)
+ *
+ * Also, the caller is guaranteeing that the memory associated with the
+ * message will not be freed before this call returns.
+ *
+ * The return value is a negative error code if the message could not be
+ * submitted, else zero.  When the value is zero, then message->status is
+ * also defined:  it's the completion code for the transfer, either zero
+ * or a negative error code from the controller driver.
+ */
+int spi_sync(struct spi_device *spi, struct spi_message *message)
+{
+        DECLARE_COMPLETION(done);
+        int status;
+        message->complete = spi_complete;
+        message->context = &done;
+        status = spi_async(spi, message);
+        if (status == 0)
+                wait_for_completion(&done);
+        message->context = NULL;
+        return status;
+}
+EXPORT_SYMBOL_GPL(spi_sync);
+#define SPI_BUFSIZ      (SMP_CACHE_BYTES)
+static u8       *buf;
+/**
+ * spi_write_then_read - SPI synchronous write followed by read
+ * @spi: device with which data will be exchanged
+ * @txbuf: data to be written (need not be dma-safe)
+ * @n_tx: size of txbuf, in bytes
+ * @rxbuf: buffer into which data will be read
+ * @n_rx: size of rxbuf, in bytes (need not be dma-safe)
+ *
+ * This performs a half duplex MicroWire style transaction with the
+ * device, sending txbuf and then reading rxbuf.  The return value
+ * is zero for success, else a negative errno status code.
+ * This call may only be used from a context that may sleep.
+ *
+ * Parameters to this routine are always copied using a small buffer;
+ * performance-sensitive or bulk transfer code should instead use
+ * spi_{async,sync}() calls with dma-safe buffers.
+ */
+int spi_write_then_read(struct spi_device *spi,
+                const u8 *txbuf, unsigned n_tx,
+                u8 *rxbuf, unsigned n_rx)
+{
+        static DECLARE_MUTEX(lock);
+        int                     status;
+        struct spi_message      message;
+        struct spi_transfer     x[2];
+        u8                      *local_buf;
+        /* Use preallocated DMA-safe buffer.  We can't avoid copying here,
+         * (as a pure convenience thing), but we can keep heap costs
+         * out of the hot path ...
+         */
+        if ((n_tx + n_rx) > SPI_BUFSIZ)
+                return -EINVAL;
+        spi_message_init(&message);
+        memset(x, 0, sizeof x);
+        if (n_tx) {
+                x[0].len = n_tx;
+                spi_message_add_tail(&x[0], &message);
+        }
+        if (n_rx) {
+                x[1].len = n_rx;
+                spi_message_add_tail(&x[1], &message);
+        }
+        /* ... unless someone else is using the pre-allocated buffer */
+        if (down_trylock(&lock)) {
+                local_buf = kmalloc(SPI_BUFSIZ, GFP_KERNEL);
+                if (!local_buf)
+                        return -ENOMEM;
+        } else
+                local_buf = buf;
+        memcpy(local_buf, txbuf, n_tx);
+        x[0].tx_buf = local_buf;
+        x[1].rx_buf = local_buf + n_tx;
+        /* do the i/o */
+        status = spi_sync(spi, &message);
+        if (status == 0) {
+                memcpy(rxbuf, x[1].rx_buf, n_rx);
+                status = message.status;
+        }
+        if (x[0].tx_buf == buf)
+                up(&lock);
+        else
+                kfree(local_buf);
+        return status;
+}
+EXPORT_SYMBOL_GPL(spi_write_then_read);
+/*-------------------------------------------------------------------------*/
+static int __init spi_init(void)
+{
+        int     status;
+        buf = kmalloc(SPI_BUFSIZ, SLAB_KERNEL);
+        if (!buf) {
+                status = -ENOMEM;
+                goto err0;
+        }
+        status = bus_register(&spi_bus_type);
+        if (status < 0)
+                goto err1;
+        status = class_register(&spi_master_class);
+        if (status < 0)
+                goto err2;
+        return 0;
+err2:
+        bus_unregister(&spi_bus_type);
+err1:
+        kfree(buf);
+        buf = NULL;
+err0:
+        return status;
+}
+/* board_info is normally registered in arch_initcall(),
+ * but even essential drivers wait till later
+ *
+ * REVISIT only boardinfo really needs static linking. the rest (device and
+ * driver registration) _could_ be dynamically linked (modular) ... costs
+ * include needing to have boardinfo data structures be much more public.
+ */
+subsys_initcall(spi_init);
diff --git a/drivers/spi/spi_bitbang.c b/drivers/spi/spi_bitbang.c
new file mode 100644
index 000000000000..f037e5593269
--- /dev/null
+++ b/drivers/spi/spi_bitbang.c
@@ -0,0 +1,472 @@
+/*
+ * spi_bitbang.c - polling/bitbanging SPI master controller driver utilities
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+#include <linux/config.h>
+#include <linux/init.h>
+#include <linux/spinlock.h>
+#include <linux/workqueue.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+#include <linux/errno.h>
+#include <linux/platform_device.h>
+#include <linux/spi/spi.h>
+#include <linux/spi/spi_bitbang.h>
+/*----------------------------------------------------------------------*/
+/*
+ * FIRST PART (OPTIONAL):  word-at-a-time spi_transfer support.
+ * Use this for GPIO or shift-register level hardware APIs.
+ *
+ * spi_bitbang_cs is in spi_device->controller_state, which is unavailable
+ * to glue code.  These bitbang setup() and cleanup() routines are always
+ * used, though maybe they're called from controller-aware code.
+ *
+ * chipselect() and friends may use use spi_device->controller_data and
+ * controller registers as appropriate.
+ *
+ *
+ * NOTE:  SPI controller pins can often be used as GPIO pins instead,
+ * which means you could use a bitbang driver either to get hardware
+ * working quickly, or testing for differences that aren't speed related.
+ */
+struct spi_bitbang_cs {
+        unsigned        nsecs;  /* (clock cycle time)/2 */
+        u32             (*txrx_word)(struct spi_device *spi, unsigned nsecs,
+                                        u32 word, u8 bits);
+        unsigned        (*txrx_bufs)(struct spi_device *,
+                                        u32 (*txrx_word)(
+                                                struct spi_device *spi,
+                                                unsigned nsecs,
+                                                u32 word, u8 bits),
+                                        unsigned, struct spi_transfer *);
+};
+static unsigned bitbang_txrx_8(
+        struct spi_device       *spi,
+        u32                     (*txrx_word)(struct spi_device *spi,
+                                        unsigned nsecs,
+                                        u32 word, u8 bits),
+        unsigned                ns,
+        struct spi_transfer     *t
+) {
+        unsigned                bits = spi->bits_per_word;
+        unsigned                count = t->len;
+        const u8                *tx = t->tx_buf;
+        u8                      *rx = t->rx_buf;
+        while (likely(count > 0)) {
+                u8              word = 0;
+                if (tx)
+                        word = *tx++;
+                word = txrx_word(spi, ns, word, bits);
+                if (rx)
+                        *rx++ = word;
+                count -= 1;
+        }
+        return t->len - count;
+}
+static unsigned bitbang_txrx_16(
+        struct spi_device       *spi,
+        u32                     (*txrx_word)(struct spi_device *spi,
+                                        unsigned nsecs,
+                                        u32 word, u8 bits),
+        unsigned                ns,
+        struct spi_transfer     *t
+) {
+        unsigned                bits = spi->bits_per_word;
+        unsigned                count = t->len;
+        const u16               *tx = t->tx_buf;
+        u16                     *rx = t->rx_buf;
+        while (likely(count > 1)) {
+                u16             word = 0;
+                if (tx)
+                        word = *tx++;
+                word = txrx_word(spi, ns, word, bits);
+                if (rx)
+                        *rx++ = word;
+                count -= 2;
+        }
+        return t->len - count;
+}
+static unsigned bitbang_txrx_32(
+        struct spi_device       *spi,
+        u32                     (*txrx_word)(struct spi_device *spi,
+                                        unsigned nsecs,
+                                        u32 word, u8 bits),
+        unsigned                ns,
+        struct spi_transfer     *t
+) {
+        unsigned                bits = spi->bits_per_word;
+        unsigned                count = t->len;
+        const u32               *tx = t->tx_buf;
+        u32                     *rx = t->rx_buf;
+        while (likely(count > 3)) {
+                u32             word = 0;
+                if (tx)
+                        word = *tx++;
+                word = txrx_word(spi, ns, word, bits);
+                if (rx)
+                        *rx++ = word;
+                count -= 4;
+        }
+        return t->len - count;
+}
+/**
+ * spi_bitbang_setup - default setup for per-word I/O loops
+ */
+int spi_bitbang_setup(struct spi_device *spi)
+{
+        struct spi_bitbang_cs   *cs = spi->controller_state;
+        struct spi_bitbang      *bitbang;
+        if (!spi->max_speed_hz)
+                return -EINVAL;
+        if (!cs) {
+                cs = kzalloc(sizeof *cs, SLAB_KERNEL);
+                if (!cs)
+                        return -ENOMEM;
+                spi->controller_state = cs;
+        }
+        bitbang = spi_master_get_devdata(spi->master);
+        if (!spi->bits_per_word)
+                spi->bits_per_word = 8;
+        /* spi_transfer level calls that work per-word */
+        if (spi->bits_per_word <= 8)
+                cs->txrx_bufs = bitbang_txrx_8;
+        else if (spi->bits_per_word <= 16)
+                cs->txrx_bufs = bitbang_txrx_16;
+        else if (spi->bits_per_word <= 32)
+                cs->txrx_bufs = bitbang_txrx_32;
+        else
+                return -EINVAL;
+        /* per-word shift register access, in hardware or bitbanging */
+        cs->txrx_word = bitbang->txrx_word[spi->mode & (SPI_CPOL|SPI_CPHA)];
+        if (!cs->txrx_word)
+                return -EINVAL;
+        /* nsecs = (clock period)/2 */
+        cs->nsecs = (1000000000/2) / (spi->max_speed_hz);
+        if (cs->nsecs > MAX_UDELAY_MS * 1000)
+                return -EINVAL;
+        dev_dbg(&spi->dev, "%s, mode %d, %u bits/w, %u nsec\n",
+                        __FUNCTION__, spi->mode & (SPI_CPOL | SPI_CPHA),
+                        spi->bits_per_word, 2 * cs->nsecs);
+        /* NOTE we _need_ to call chipselect() early, ideally with adapter
+         * setup, unless the hardware defaults cooperate to avoid confusion
+         * between normal (active low) and inverted chipselects.
+         */
+        /* deselect chip (low or high) */
+        spin_lock(&bitbang->lock);
+        if (!bitbang->busy) {
+                bitbang->chipselect(spi, BITBANG_CS_INACTIVE);
+                ndelay(cs->nsecs);
+        }
+        spin_unlock(&bitbang->lock);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(spi_bitbang_setup);
+/**
+ * spi_bitbang_cleanup - default cleanup for per-word I/O loops
+ */
+void spi_bitbang_cleanup(const struct spi_device *spi)
+{
+        kfree(spi->controller_state);
+}
+EXPORT_SYMBOL_GPL(spi_bitbang_cleanup);
+static int spi_bitbang_bufs(struct spi_device *spi, struct spi_transfer *t)
+{
+        struct spi_bitbang_cs   *cs = spi->controller_state;
+        unsigned                nsecs = cs->nsecs;
+        return cs->txrx_bufs(spi, cs->txrx_word, nsecs, t);
+}
+/*----------------------------------------------------------------------*/
+/*
+ * SECOND PART ... simple transfer queue runner.
+ *
+ * This costs a task context per controller, running the queue by
+ * performing each transfer in sequence.  Smarter hardware can queue
+ * several DMA transfers at once, and process several controller queues
+ * in parallel; this driver doesn't match such hardware very well.
+ *
+ * Drivers can provide word-at-a-time i/o primitives, or provide
+ * transfer-at-a-time ones to leverage dma or fifo hardware.
+ */
+static void bitbang_work(void *_bitbang)
+{
+        struct spi_bitbang      *bitbang = _bitbang;
+        unsigned long           flags;
+        spin_lock_irqsave(&bitbang->lock, flags);
+        bitbang->busy = 1;
+        while (!list_empty(&bitbang->queue)) {
+                struct spi_message      *m;
+                struct spi_device       *spi;
+                unsigned                nsecs;
+                struct spi_transfer     *t = NULL;
+                unsigned                tmp;
+                unsigned                cs_change;
+                int                     status;
+                m = container_of(bitbang->queue.next, struct spi_message,
+                                queue);
+                list_del_init(&m->queue);
+                spin_unlock_irqrestore(&bitbang->lock, flags);
+                /* FIXME this is made-up ... the correct value is known to
+                 * word-at-a-time bitbang code, and presumably chipselect()
+                 * should enforce these requirements too?
+                 */
+                nsecs = 100;
+                spi = m->spi;
+                tmp = 0;
+                cs_change = 1;
+                status = 0;
+                list_for_each_entry (t, &m->transfers, transfer_list) {
+                        if (bitbang->shutdown) {
+                                status = -ESHUTDOWN;
+                                break;
+                        }
+                        /* set up default clock polarity, and activate chip;
+                         * this implicitly updates clock and spi modes as
+                         * previously recorded for this device via setup().
+                         * (and also deselects any other chip that might be
+                         * selected ...)
+                         */
+                        if (cs_change) {
+                                bitbang->chipselect(spi, BITBANG_CS_ACTIVE);
+                                ndelay(nsecs);
+                        }
+                        cs_change = t->cs_change;
+                        if (!t->tx_buf && !t->rx_buf && t->len) {
+                                status = -EINVAL;
+                                break;
+                        }
+                        /* transfer data.  the lower level code handles any
+                         * new dma mappings it needs. our caller always gave
+                         * us dma-safe buffers.
+                         */
+                        if (t->len) {
+                                /* REVISIT dma API still needs a designated
+                                 * DMA_ADDR_INVALID; ~0 might be better.
+                                 */
+                                if (!m->is_dma_mapped)
+                                        t->rx_dma = t->tx_dma = 0;
+                                status = bitbang->txrx_bufs(spi, t);
+                        }
+                        if (status != t->len) {
+                                if (status > 0)
+                                        status = -EMSGSIZE;
+                                break;
+                        }
+                        m->actual_length += status;
+                        status = 0;
+                        /* protocol tweaks before next transfer */
+                        if (t->delay_usecs)
+                                udelay(t->delay_usecs);
+                        if (!cs_change)
+                                continue;
+                        if (t->transfer_list.next == &m->transfers)
+                                break;
+                        /* sometimes a short mid-message deselect of the chip
+                         * may be needed to terminate a mode or command
+                         */
+                        ndelay(nsecs);
+                        bitbang->chipselect(spi, BITBANG_CS_INACTIVE);
+                        ndelay(nsecs);
+                }
+                m->status = status;
+                m->complete(m->context);
+                /* normally deactivate chipselect ... unless no error and
+                 * cs_change has hinted that the next message will probably
+                 * be for this chip too.
+                 */
+                if (!(status == 0 && cs_change)) {
+                        ndelay(nsecs);
+                        bitbang->chipselect(spi, BITBANG_CS_INACTIVE);
+                        ndelay(nsecs);
+                }
+                spin_lock_irqsave(&bitbang->lock, flags);
+        }
+        bitbang->busy = 0;
+        spin_unlock_irqrestore(&bitbang->lock, flags);
+}
+/**
+ * spi_bitbang_transfer - default submit to transfer queue
+ */
+int spi_bitbang_transfer(struct spi_device *spi, struct spi_message *m)
+{
+        struct spi_bitbang      *bitbang;
+        unsigned long           flags;
+        m->actual_length = 0;
+        m->status = -EINPROGRESS;
+        bitbang = spi_master_get_devdata(spi->master);
+        if (bitbang->shutdown)
+                return -ESHUTDOWN;
+        spin_lock_irqsave(&bitbang->lock, flags);
+        list_add_tail(&m->queue, &bitbang->queue);
+        queue_work(bitbang->workqueue, &bitbang->work);
+        spin_unlock_irqrestore(&bitbang->lock, flags);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(spi_bitbang_transfer);
+/*----------------------------------------------------------------------*/
+/**
+ * spi_bitbang_start - start up a polled/bitbanging SPI master driver
+ * @bitbang: driver handle
+ *
+ * Caller should have zero-initialized all parts of the structure, and then
+ * provided callbacks for chip selection and I/O loops.  If the master has
+ * a transfer method, its final step should call spi_bitbang_transfer; or,
+ * that's the default if the transfer routine is not initialized.  It should
+ * also set up the bus number and number of chipselects.
+ *
+ * For i/o loops, provide callbacks either per-word (for bitbanging, or for
+ * hardware that basically exposes a shift register) or per-spi_transfer
+ * (which takes better advantage of hardware like fifos or DMA engines).
+ *
+ * Drivers using per-word I/O loops should use (or call) spi_bitbang_setup and
+ * spi_bitbang_cleanup to handle those spi master methods.  Those methods are
+ * the defaults if the bitbang->txrx_bufs routine isn't initialized.
+ *
+ * This routine registers the spi_master, which will process requests in a
+ * dedicated task, keeping IRQs unblocked most of the time.  To stop
+ * processing those requests, call spi_bitbang_stop().
+ */
+int spi_bitbang_start(struct spi_bitbang *bitbang)
+{
+        int     status;
+        if (!bitbang->master || !bitbang->chipselect)
+                return -EINVAL;
+        INIT_WORK(&bitbang->work, bitbang_work, bitbang);
+        spin_lock_init(&bitbang->lock);
+        INIT_LIST_HEAD(&bitbang->queue);
+        if (!bitbang->master->transfer)
+                bitbang->master->transfer = spi_bitbang_transfer;
+        if (!bitbang->txrx_bufs) {
+                bitbang->use_dma = 0;
+                bitbang->txrx_bufs = spi_bitbang_bufs;
+                if (!bitbang->master->setup) {
+                        bitbang->master->setup = spi_bitbang_setup;
+                        bitbang->master->cleanup = spi_bitbang_cleanup;
+                }
+        } else if (!bitbang->master->setup)
+                return -EINVAL;
+        /* this task is the only thing to touch the SPI bits */
+        bitbang->busy = 0;
+        bitbang->workqueue = create_singlethread_workqueue(
+                        bitbang->master->cdev.dev->bus_id);
+        if (bitbang->workqueue == NULL) {
+                status = -EBUSY;
+                goto err1;
+        }
+        /* driver may get busy before register() returns, especially
+         * if someone registered boardinfo for devices
+         */
+        status = spi_register_master(bitbang->master);
+        if (status < 0)
+                goto err2;
+        return status;
+err2:
+        destroy_workqueue(bitbang->workqueue);
+err1:
+        return status;
+}
+EXPORT_SYMBOL_GPL(spi_bitbang_start);
+/**
+ * spi_bitbang_stop - stops the task providing spi communication
+ */
+int spi_bitbang_stop(struct spi_bitbang *bitbang)
+{
+        unsigned        limit = 500;
+        spin_lock_irq(&bitbang->lock);
+        bitbang->shutdown = 0;
+        while (!list_empty(&bitbang->queue) && limit--) {
+                spin_unlock_irq(&bitbang->lock);
+                dev_dbg(bitbang->master->cdev.dev, "wait for queue\n");
+                msleep(10);
+                spin_lock_irq(&bitbang->lock);
+        }
+        spin_unlock_irq(&bitbang->lock);
+        if (!list_empty(&bitbang->queue)) {
+                dev_err(bitbang->master->cdev.dev, "queue didn't empty\n");
+                return -EBUSY;
+        }
+        destroy_workqueue(bitbang->workqueue);
+        spi_unregister_master(bitbang->master);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(spi_bitbang_stop);
+MODULE_LICENSE("GPL");
diff --git a/drivers/spi/spi_butterfly.c b/drivers/spi/spi_butterfly.c
new file mode 100644
index 000000000000..79a3c59615ab
--- /dev/null
+++ b/drivers/spi/spi_butterfly.c
@@ -0,0 +1,423 @@
+/*
+ * spi_butterfly.c - parport-to-butterfly adapter
+ *
+ * Copyright (C) 2005 David Brownell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/platform_device.h>
+#include <linux/parport.h>
+#include <linux/spi/spi.h>
+#include <linux/spi/spi_bitbang.h>
+#include <linux/spi/flash.h>
+#include <linux/mtd/partitions.h>
+/*
+ * This uses SPI to talk with an "AVR Butterfly", which is a $US20 card
+ * with a battery powered AVR microcontroller and lots of goodies.  You
+ * can use GCC to develop firmware for this.
+ *
+ * See Documentation/spi/butterfly for information about how to build
+ * and use this custom parallel port cable.
+ */
+#undef  HAVE_USI        /* nyet */
+/* DATA output bits (pins 2..9 == D0..D7) */
+#define butterfly_nreset (1 << 1)               /* pin 3 */
+#define spi_sck_bit     (1 << 0)                /* pin 2 */
+#define spi_mosi_bit    (1 << 7)                /* pin 9 */
+#define usi_sck_bit     (1 << 3)                /* pin 5 */
+#define usi_mosi_bit    (1 << 4)                /* pin 6 */
+#define vcc_bits        ((1 << 6) | (1 << 5))   /* pins 7, 8 */
+/* STATUS input bits */
+#define spi_miso_bit    PARPORT_STATUS_BUSY     /* pin 11 */
+#define usi_miso_bit    PARPORT_STATUS_PAPEROUT /* pin 12 */
+/* CONTROL output bits */
+#define spi_cs_bit      PARPORT_CONTROL_SELECT  /* pin 17 */
+/* USI uses no chipselect */
+static inline struct butterfly *spidev_to_pp(struct spi_device *spi)
+{
+        return spi->controller_data;
+}
+static inline int is_usidev(struct spi_device *spi)
+{
+#ifdef  HAVE_USI
+        return spi->chip_select != 1;
+#else
+        return 0;
+#endif
+}
+struct butterfly {
+        /* REVISIT ... for now, this must be first */
+        struct spi_bitbang      bitbang;
+        struct parport          *port;
+        struct pardevice        *pd;
+        u8                      lastbyte;
+        struct spi_device       *dataflash;
+        struct spi_device       *butterfly;
+        struct spi_board_info   info[2];
+};
+/*----------------------------------------------------------------------*/
+/*
+ * these routines may be slower than necessary because they're hiding
+ * the fact that there are two different SPI busses on this cable: one
+ * to the DataFlash chip (or AVR SPI controller), the other to the
+ * AVR USI controller.
+ */
+static inline void
+setsck(struct spi_device *spi, int is_on)
+{
+        struct butterfly        *pp = spidev_to_pp(spi);
+        u8                      bit, byte = pp->lastbyte;
+        if (is_usidev(spi))
+                bit = usi_sck_bit;
+        else
+                bit = spi_sck_bit;
+        if (is_on)
+                byte |= bit;
+        else
+                byte &= ~bit;
+        parport_write_data(pp->port, byte);
+        pp->lastbyte = byte;
+}
+static inline void
+setmosi(struct spi_device *spi, int is_on)
+{
+        struct butterfly        *pp = spidev_to_pp(spi);
+        u8                      bit, byte = pp->lastbyte;
+        if (is_usidev(spi))
+                bit = usi_mosi_bit;
+        else
+                bit = spi_mosi_bit;
+        if (is_on)
+                byte |= bit;
+        else
+                byte &= ~bit;
+        parport_write_data(pp->port, byte);
+        pp->lastbyte = byte;
+}
+static inline int getmiso(struct spi_device *spi)
+{
+        struct butterfly        *pp = spidev_to_pp(spi);
+        int                     value;
+        u8                      bit;
+        if (is_usidev(spi))
+                bit = usi_miso_bit;
+        else
+                bit = spi_miso_bit;
+        /* only STATUS_BUSY is NOT negated */
+        value = !(parport_read_status(pp->port) & bit);
+        return (bit == PARPORT_STATUS_BUSY) ? value : !value;
+}
+static void butterfly_chipselect(struct spi_device *spi, int value)
+{
+        struct butterfly        *pp = spidev_to_pp(spi);
+        /* set default clock polarity */
+        if (value)
+                setsck(spi, spi->mode & SPI_CPOL);
+        /* no chipselect on this USI link config */
+        if (is_usidev(spi))
+                return;
+        /* here, value == "activate or not" */
+        /* most PARPORT_CONTROL_* bits are negated */
+        if (spi_cs_bit == PARPORT_CONTROL_INIT)
+                value = !value;
+        /* here, value == "bit value to write in control register"  */
+        parport_frob_control(pp->port, spi_cs_bit, value ? spi_cs_bit : 0);
+}
+/* we only needed to implement one mode here, and choose SPI_MODE_0 */
+#define spidelay(X)     do{}while(0)
+//#define       spidelay        ndelay
+#define EXPAND_BITBANG_TXRX
+#include <linux/spi/spi_bitbang.h>
+static u32
+butterfly_txrx_word_mode0(struct spi_device *spi,
+                unsigned nsecs,
+                u32 word, u8 bits)
+{
+        return bitbang_txrx_be_cpha0(spi, nsecs, 0, word, bits);
+}
+/*----------------------------------------------------------------------*/
+/* override default partitioning with cmdlinepart */
+static struct mtd_partition partitions[] = { {
+        /* JFFS2 wants partitions of 4*N blocks for this device ... */
+        /* sector 0 = 8 pages * 264 bytes/page (1 block)
+         * sector 1 = 248 pages * 264 bytes/page
+         */
+        .name           = "bookkeeping",        // 66 KB
+        .offset         = 0,
+        .size           = (8 + 248) * 264,
+//      .mask_flags     = MTD_WRITEABLE,
+}, {
+        /* sector 2 = 256 pages * 264 bytes/page
+         * sectors 3-5 = 512 pages * 264 bytes/page
+         */
+        .name           = "filesystem",         // 462 KB
+        .offset         = MTDPART_OFS_APPEND,
+        .size           = MTDPART_SIZ_FULL,
+} };
+static struct flash_platform_data flash = {
+        .name           = "butterflash",
+        .parts          = partitions,
+        .nr_parts       = ARRAY_SIZE(partitions),
+};
+/* REVISIT remove this ugly global and its "only one" limitation */
+static struct butterfly *butterfly;
+static void butterfly_attach(struct parport *p)
+{
+        struct pardevice        *pd;
+        int                     status;
+        struct butterfly        *pp;
+        struct spi_master       *master;
+        struct platform_device  *pdev;
+        if (butterfly)
+                return;
+        /* REVISIT:  this just _assumes_ a butterfly is there ... no probe,
+         * and no way to be selective about what it binds to.
+         */
+        /* FIXME where should master->cdev.dev come from?
+         * e.g. /sys/bus/pnp0/00:0b, some PCI thing, etc
+         * setting up a platform device like this is an ugly kluge...
+         */
+        pdev = platform_device_register_simple("butterfly", -1, NULL, 0);
+        master = spi_alloc_master(&pdev->dev, sizeof *pp);
+        if (!master) {
+                status = -ENOMEM;
+                goto done;
+        }
+        pp = spi_master_get_devdata(master);
+        /*
+         * SPI and bitbang hookup
+         *
+         * use default setup(), cleanup(), and transfer() methods; and
+         * only bother implementing mode 0.  Start it later.
+         */
+        master->bus_num = 42;
+        master->num_chipselect = 2;
+        pp->bitbang.master = spi_master_get(master);
+        pp->bitbang.chipselect = butterfly_chipselect;
+        pp->bitbang.txrx_word[SPI_MODE_0] = butterfly_txrx_word_mode0;
+        /*
+         * parport hookup
+         */
+        pp->port = p;
+        pd = parport_register_device(p, "spi_butterfly",
+                        NULL, NULL, NULL,
+                        0 /* FLAGS */, pp);
+        if (!pd) {
+                status = -ENOMEM;
+                goto clean0;
+        }
+        pp->pd = pd;
+        status = parport_claim(pd);
+        if (status < 0)
+                goto clean1;
+        /*
+         * Butterfly reset, powerup, run firmware
+         */
+        pr_debug("%s: powerup/reset Butterfly\n", p->name);
+        /* nCS for dataflash (this bit is inverted on output) */
+        parport_frob_control(pp->port, spi_cs_bit, 0);
+        /* stabilize power with chip in reset (nRESET), and
+         * both spi_sck_bit and usi_sck_bit clear (CPOL=0)
+         */
+        pp->lastbyte |= vcc_bits;
+        parport_write_data(pp->port, pp->lastbyte);
+        msleep(5);
+        /* take it out of reset; assume long reset delay */
+        pp->lastbyte |= butterfly_nreset;
+        parport_write_data(pp->port, pp->lastbyte);
+        msleep(100);
+        /*
+         * Start SPI ... for now, hide that we're two physical busses.
+         */
+        status = spi_bitbang_start(&pp->bitbang);
+        if (status < 0)
+                goto clean2;
+        /* Bus 1 lets us talk to at45db041b (firmware disables AVR)
+         * or AVR (firmware resets at45, acts as spi slave)
+         */
+        pp->info[0].max_speed_hz = 15 * 1000 * 1000;
+        strcpy(pp->info[0].modalias, "mtd_dataflash");
+        pp->info[0].platform_data = &flash;
+        pp->info[0].chip_select = 1;
+        pp->info[0].controller_data = pp;
+        pp->dataflash = spi_new_device(pp->bitbang.master, &pp->info[0]);
+        if (pp->dataflash)
+                pr_debug("%s: dataflash at %s\n", p->name,
+                                pp->dataflash->dev.bus_id);
+#ifdef  HAVE_USI
+        /* even more custom AVR firmware */
+        pp->info[1].max_speed_hz = 10 /* ?? */ * 1000 * 1000;
+        strcpy(pp->info[1].modalias, "butterfly");
+        // pp->info[1].platform_data = ... TBD ... ;
+        pp->info[1].chip_select = 2,
+        pp->info[1].controller_data = pp;
+        pp->butterfly = spi_new_device(pp->bitbang.master, &pp->info[1]);
+        if (pp->butterfly)
+                pr_debug("%s: butterfly at %s\n", p->name,
+                                pp->butterfly->dev.bus_id);
+        /* FIXME setup ACK for the IRQ line ...  */
+#endif
+        // dev_info(_what?_, ...)
+        pr_info("%s: AVR Butterfly\n", p->name);
+        butterfly = pp;
+        return;
+clean2:
+        /* turn off VCC */
+        parport_write_data(pp->port, 0);
+        parport_release(pp->pd);
+clean1:
+        parport_unregister_device(pd);
+clean0:
+        (void) spi_master_put(pp->bitbang.master);
+done:
+        platform_device_unregister(pdev);
+        pr_debug("%s: butterfly probe, fail %d\n", p->name, status);
+}
+static void butterfly_detach(struct parport *p)
+{
+        struct butterfly        *pp;
+        struct platform_device  *pdev;
+        int                     status;
+        /* FIXME this global is ugly ... but, how to quickly get from
+         * the parport to the "struct butterfly" associated with it?
+         * "old school" driver-internal device lists?
+         */
+        if (!butterfly || butterfly->port != p)
+                return;
+        pp = butterfly;
+        butterfly = NULL;
+#ifdef  HAVE_USI
+        spi_unregister_device(pp->butterfly);
+        pp->butterfly = NULL;
+#endif
+        spi_unregister_device(pp->dataflash);
+        pp->dataflash = NULL;
+        status = spi_bitbang_stop(&pp->bitbang);
+        /* turn off VCC */
+        parport_write_data(pp->port, 0);
+        msleep(10);
+        parport_release(pp->pd);
+        parport_unregister_device(pp->pd);
+        pdev = to_platform_device(pp->bitbang.master->cdev.dev);
+        (void) spi_master_put(pp->bitbang.master);
+        platform_device_unregister(pdev);
+}
+static struct parport_driver butterfly_driver = {
+        .name =         "spi_butterfly",
+        .attach =       butterfly_attach,
+        .detach =       butterfly_detach,
+};
+static int __init butterfly_init(void)
+{
+        return parport_register_driver(&butterfly_driver);
+}
+device_initcall(butterfly_init);
+static void __exit butterfly_exit(void)
+{
+        parport_unregister_driver(&butterfly_driver);
+}
+module_exit(butterfly_exit);
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index 8f402f85e1ca..afc84cfb61f9 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -2534,9 +2534,6 @@ static struct usb_gadget_driver eth_driver = {
        .driver         = {
                .name           = (char *) shortname,
                .owner          = THIS_MODULE,
-                // .shutdown = ...
-                // .suspend = ...
-                // .resume = ...
        },
 };
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index c6c279de832e..9a4edc5657aa 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -1738,9 +1738,6 @@ static struct usb_gadget_driver gadgetfs_driver = {
        .driver         = {
                .name           = (char *) shortname,
-                // .shutdown = ...
-                // .suspend = ...
-                // .resume = ...
        },
 };
diff --git a/drivers/usb/gadget/serial.c b/drivers/usb/gadget/serial.c
index 2e6926b33455..ba9acd531024 100644
--- a/drivers/usb/gadget/serial.c
+++ b/drivers/usb/gadget/serial.c
@@ -374,9 +374,6 @@ static struct usb_gadget_driver gs_gadget_driver = {
        .disconnect =           gs_disconnect,
        .driver = {
                .name =         GS_SHORT_NAME,
-                /* .shutdown = ... */
-                /* .suspend = ...  */
-                /* .resume = ...   */
        },
 };
diff --git a/drivers/usb/gadget/zero.c b/drivers/usb/gadget/zero.c
index 6c58636e914b..2fc110d3ad5a 100644
--- a/drivers/usb/gadget/zero.c
+++ b/drivers/usb/gadget/zero.c
@@ -1303,9 +1303,6 @@ static struct usb_gadget_driver zero_driver = {
        .driver         = {
                .name           = (char *) shortname,
                .owner          = THIS_MODULE,
-                // .shutdown = ...
-                // .suspend = ...
-                // .resume = ...
        },
 };
diff --git a/drivers/usb/input/Kconfig b/drivers/usb/input/Kconfig
index 509dd0a04c54..5246b35301de 100644
--- a/drivers/usb/input/Kconfig
+++ b/drivers/usb/input/Kconfig
@@ -37,6 +37,16 @@ config USB_HIDINPUT
          If unsure, say Y.
+config USB_HIDINPUT_POWERBOOK
+        bool "Enable support for iBook/PowerBook special keys"
+        default n
+        depends on USB_HIDINPUT
+        help
+          Say Y here if you want support for the special keys (Fn, Numlock) on
+          Apple iBooks and PowerBooks.
+          If unsure, say N.
 config HID_FF
        bool "Force feedback support (EXPERIMENTAL)"
        depends on USB_HIDINPUT && EXPERIMENTAL
diff --git a/drivers/usb/input/hid-core.c b/drivers/usb/input/hid-core.c
index 5f52979af1c7..a91e72c41415 100644
--- a/drivers/usb/input/hid-core.c
+++ b/drivers/usb/input/hid-core.c
@@ -1450,6 +1450,9 @@ void hid_init_reports(struct hid_device *hid)
 #define USB_VENDOR_ID_APPLE             0x05ac
 #define USB_DEVICE_ID_APPLE_POWERMOUSE  0x0304
+#define USB_VENDOR_ID_CHERRY            0x046a
+#define USB_DEVICE_ID_CHERRY_CYMOTION   0x0023
 /*
 * Alphabetically sorted blacklist by quirk type.
 */
@@ -1580,6 +1583,16 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD, HID_QUIRK_BADPAD },
        { USB_VENDOR_ID_TOPMAX, USB_DEVICE_ID_TOPMAX_COBRAPAD, HID_QUIRK_BADPAD },
+        { USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION, HID_QUIRK_CYMOTION },
+        { USB_VENDOR_ID_APPLE, 0x020E, HID_QUIRK_POWERBOOK_HAS_FN },
+        { USB_VENDOR_ID_APPLE, 0x020F, HID_QUIRK_POWERBOOK_HAS_FN },
+        { USB_VENDOR_ID_APPLE, 0x0214, HID_QUIRK_POWERBOOK_HAS_FN },
+        { USB_VENDOR_ID_APPLE, 0x0215, HID_QUIRK_POWERBOOK_HAS_FN },
+        { USB_VENDOR_ID_APPLE, 0x0216, HID_QUIRK_POWERBOOK_HAS_FN },
+        { USB_VENDOR_ID_APPLE, 0x030A, HID_QUIRK_POWERBOOK_HAS_FN },
+        { USB_VENDOR_ID_APPLE, 0x030B, HID_QUIRK_POWERBOOK_HAS_FN },
        { 0, 0 }
 };
@@ -1626,6 +1639,20 @@ static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid)
                usb_buffer_free(dev, hid->bufsize, hid->ctrlbuf, hid->ctrlbuf_dma);
 }
+/*
+ * Cherry Cymotion keyboard have an invalid HID report descriptor,
+ * that needs fixing before we can parse it.
+ */
+static void hid_fixup_cymotion_descriptor(char *rdesc, int rsize)
+{
+        if (rsize >= 17 && rdesc[11] == 0x3c && rdesc[12] == 0x02) {
+                info("Fixing up Cherry Cymotion report descriptor");
+                rdesc[11] = rdesc[16] = 0xff;
+                rdesc[12] = rdesc[17] = 0x03;
+        }
+}
 static struct hid_device *usb_hid_configure(struct usb_interface *intf)
 {
        struct usb_host_interface *interface = intf->cur_altsetting;
@@ -1673,6 +1700,9 @@ static struct hid_device *usb_hid_configure(struct usb_interface *intf)
                return NULL;
        }
+        if ((quirks & HID_QUIRK_CYMOTION))
+                hid_fixup_cymotion_descriptor(rdesc, rsize);
 #ifdef DEBUG_DATA
        printk(KERN_DEBUG __FILE__ ": report descriptor (size %u, read %d) = ", rsize, n);
        for (n = 0; n < rsize; n++)
diff --git a/drivers/usb/input/hid-input.c b/drivers/usb/input/hid-input.c
index 192a03b28971..cb0d80f49252 100644
--- a/drivers/usb/input/hid-input.c
+++ b/drivers/usb/input/hid-input.c
@@ -73,6 +73,160 @@ static const struct {
 #define map_key_clear(c)        do { map_key(c); clear_bit(c, bit); } while (0)
 #define map_ff_effect(c)        do { set_bit(c, input->ffbit); } while (0)
+#ifdef CONFIG_USB_HIDINPUT_POWERBOOK
+struct hidinput_key_translation {
+        u16 from;
+        u16 to;
+        u8 flags;
+};
+#define POWERBOOK_FLAG_FKEY 0x01
+static struct hidinput_key_translation powerbook_fn_keys[] = {
+        { KEY_BACKSPACE, KEY_DELETE },
+        { KEY_F1,       KEY_BRIGHTNESSDOWN,     POWERBOOK_FLAG_FKEY },
+        { KEY_F2,       KEY_BRIGHTNESSUP,       POWERBOOK_FLAG_FKEY },
+        { KEY_F3,       KEY_MUTE,               POWERBOOK_FLAG_FKEY },
+        { KEY_F4,       KEY_VOLUMEDOWN,         POWERBOOK_FLAG_FKEY },
+        { KEY_F5,       KEY_VOLUMEUP,           POWERBOOK_FLAG_FKEY },
+        { KEY_F6,       KEY_NUMLOCK,            POWERBOOK_FLAG_FKEY },
+        { KEY_F7,       KEY_SWITCHVIDEOMODE,    POWERBOOK_FLAG_FKEY },
+        { KEY_F8,       KEY_KBDILLUMTOGGLE,     POWERBOOK_FLAG_FKEY },
+        { KEY_F9,       KEY_KBDILLUMDOWN,       POWERBOOK_FLAG_FKEY },
+        { KEY_F10,      KEY_KBDILLUMUP,         POWERBOOK_FLAG_FKEY },
+        { KEY_UP,       KEY_PAGEUP },
+        { KEY_DOWN,     KEY_PAGEDOWN },
+        { KEY_LEFT,     KEY_HOME },
+        { KEY_RIGHT,    KEY_END },
+        { }
+};
+static struct hidinput_key_translation powerbook_numlock_keys[] = {
+        { KEY_J,        KEY_KP1 },
+        { KEY_K,        KEY_KP2 },
+        { KEY_L,        KEY_KP3 },
+        { KEY_U,        KEY_KP4 },
+        { KEY_I,        KEY_KP5 },
+        { KEY_O,        KEY_KP6 },
+        { KEY_7,        KEY_KP7 },
+        { KEY_8,        KEY_KP8 },
+        { KEY_9,        KEY_KP9 },
+        { KEY_M,        KEY_KP0 },
+        { KEY_DOT,      KEY_KPDOT },
+        { KEY_SLASH,    KEY_KPPLUS },
+        { KEY_SEMICOLON, KEY_KPMINUS },
+        { KEY_P,        KEY_KPASTERISK },
+        { KEY_MINUS,    KEY_KPEQUAL },
+        { KEY_0,        KEY_KPSLASH },
+        { KEY_F6,       KEY_NUMLOCK },
+        { KEY_KPENTER,  KEY_KPENTER },
+        { KEY_BACKSPACE, KEY_BACKSPACE },
+        { }
+};
+static int usbhid_pb_fnmode = 1;
+module_param_named(pb_fnmode, usbhid_pb_fnmode, int, 0644);
+MODULE_PARM_DESC(pb_fnmode,
+        "Mode of fn key on PowerBooks (0 = disabled, 1 = fkeyslast, 2 = fkeysfirst)");
+static struct hidinput_key_translation *find_translation(struct hidinput_key_translation *table, u16 from)
+{
+        struct hidinput_key_translation *trans;
+        /* Look for the translation */
+        for (trans = table; trans->from; trans++)
+                if (trans->from == from)
+                        return trans;
+        return NULL;
+}
+static int hidinput_pb_event(struct hid_device *hid, struct input_dev *input,
+                             struct hid_usage *usage, __s32 value)
+{
+        struct hidinput_key_translation *trans;
+        if (usage->code == KEY_FN) {
+                if (value) hid->quirks |=  HID_QUIRK_POWERBOOK_FN_ON;
+                else       hid->quirks &= ~HID_QUIRK_POWERBOOK_FN_ON;
+                input_event(input, usage->type, usage->code, value);
+                return 1;
+        }
+        if (usbhid_pb_fnmode) {
+                int do_translate;
+                trans = find_translation(powerbook_fn_keys, usage->code);
+                if (trans) {
+                        if (test_bit(usage->code, hid->pb_pressed_fn))
+                                do_translate = 1;
+                        else if (trans->flags & POWERBOOK_FLAG_FKEY)
+                                do_translate =
+                                        (usbhid_pb_fnmode == 2 &&  (hid->quirks & HID_QUIRK_POWERBOOK_FN_ON)) ||
+                                        (usbhid_pb_fnmode == 1 && !(hid->quirks & HID_QUIRK_POWERBOOK_FN_ON));
+                        else
+                                do_translate = (hid->quirks & HID_QUIRK_POWERBOOK_FN_ON);
+                        if (do_translate) {
+                                if (value)
+                                        set_bit(usage->code, hid->pb_pressed_fn);
+                                else
+                                        clear_bit(usage->code, hid->pb_pressed_fn);
+                                input_event(input, usage->type, trans->to, value);
+                                return 1;
+                        }
+                }
+                if (test_bit(usage->code, hid->pb_pressed_numlock) ||
+                    test_bit(LED_NUML, input->led)) {
+                        trans = find_translation(powerbook_numlock_keys, usage->code);
+                        if (trans) {
+                                if (value)
+                                        set_bit(usage->code, hid->pb_pressed_numlock);
+                                else
+                                        clear_bit(usage->code, hid->pb_pressed_numlock);
+                                input_event(input, usage->type, trans->to, value);
+                        }
+                        return 1;
+                }
+        }
+        return 0;
+}
+static void hidinput_pb_setup(struct input_dev *input)
+{
+        struct hidinput_key_translation *trans;
+        set_bit(KEY_NUMLOCK, input->keybit);
+        /* Enable all needed keys */
+        for (trans = powerbook_fn_keys; trans->from; trans++)
+                set_bit(trans->to, input->keybit);
+        for (trans = powerbook_numlock_keys; trans->from; trans++)
+                set_bit(trans->to, input->keybit);
+}
+#else
+static inline int hidinput_pb_event(struct hid_device *hid, struct input_dev *input,
+                                    struct hid_usage *usage, __s32 value)
+{
+        return 0;
+}
+static inline void hidinput_pb_setup(struct input_dev *input)
+{
+}
+#endif
 static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_field *field,
                                     struct hid_usage *usage)
 {
@@ -135,8 +289,11 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                case HID_UP_SIMULATION:
                        switch (usage->hid & 0xffff) {
-                                case 0xba: map_abs(ABS_RUDDER); break;
+                                case 0xba: map_abs(ABS_RUDDER);   break;
                                case 0xbb: map_abs(ABS_THROTTLE); break;
+                                case 0xc4: map_abs(ABS_GAS);      break;
+                                case 0xc5: map_abs(ABS_BRAKE);    break;
+                                case 0xc8: map_abs(ABS_WHEEL);    break;
                                default:   goto ignore;
                        }
                        break;
@@ -289,11 +446,19 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                                case 0x226: map_key_clear(KEY_STOP);            break;
                                case 0x227: map_key_clear(KEY_REFRESH);         break;
                                case 0x22a: map_key_clear(KEY_BOOKMARKS);       break;
+                                case 0x233: map_key_clear(KEY_SCROLLUP);        break;
+                                case 0x234: map_key_clear(KEY_SCROLLDOWN);      break;
                                case 0x238: map_rel(REL_HWHEEL);                break;
                                case 0x279: map_key_clear(KEY_REDO);            break;
                                case 0x289: map_key_clear(KEY_REPLY);           break;
                                case 0x28b: map_key_clear(KEY_FORWARDMAIL);     break;
                                case 0x28c: map_key_clear(KEY_SEND);            break;
+                                /* Reported on a Cherry Cymotion keyboard */
+                                case 0x301: map_key_clear(KEY_PROG1);           break;
+                                case 0x302: map_key_clear(KEY_PROG2);           break;
+                                case 0x303: map_key_clear(KEY_PROG3);           break;
                                default:    goto ignore;
                        }
                        break;
@@ -325,7 +490,12 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                        set_bit(EV_REP, input->evbit);
                        switch(usage->hid & HID_USAGE) {
-                                case 0x003: map_key_clear(KEY_FN);              break;
+                                case 0x003:
+                                        /* The fn key on Apple PowerBooks */
+                                        map_key_clear(KEY_FN);
+                                        hidinput_pb_setup(input);
+                                        break;
                                default:    goto ignore;
                        }
                        break;
@@ -482,6 +652,9 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
                return;
        }
+        if ((hid->quirks & HID_QUIRK_POWERBOOK_HAS_FN) && hidinput_pb_event(hid, input, usage, value))
+                return;
        if (usage->hat_min < usage->hat_max || usage->hat_dir) {
                int hat_dir = usage->hat_dir;
                if (!hat_dir)
@@ -524,7 +697,7 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
                return;
        }
-        if((usage->type == EV_KEY) && (usage->code == 0)) /* Key 0 is "unassigned", not KEY_UNKNOWN */
+        if ((usage->type == EV_KEY) && (usage->code == 0)) /* Key 0 is "unassigned", not KEY_UNKNOWN */
                return;
        input_event(input, usage->type, usage->code, value);
diff --git a/drivers/usb/input/hid.h b/drivers/usb/input/hid.h
index ee48a2276104..8b0d4346ce9c 100644
--- a/drivers/usb/input/hid.h
+++ b/drivers/usb/input/hid.h
@@ -235,17 +235,20 @@ struct hid_item {
 * HID device quirks.
 */
-#define HID_QUIRK_INVERT                        0x001
+#define HID_QUIRK_INVERT                        0x00000001
-#define HID_QUIRK_NOTOUCH                       0x002
+#define HID_QUIRK_NOTOUCH                       0x00000002
-#define HID_QUIRK_IGNORE                        0x004
+#define HID_QUIRK_IGNORE                        0x00000004
-#define HID_QUIRK_NOGET                         0x008
+#define HID_QUIRK_NOGET                         0x00000008
-#define HID_QUIRK_HIDDEV                        0x010
+#define HID_QUIRK_HIDDEV                        0x00000010
-#define HID_QUIRK_BADPAD                        0x020
+#define HID_QUIRK_BADPAD                        0x00000020
-#define HID_QUIRK_MULTI_INPUT                   0x040
+#define HID_QUIRK_MULTI_INPUT                   0x00000040
-#define HID_QUIRK_2WHEEL_MOUSE_HACK_7           0x080
+#define HID_QUIRK_2WHEEL_MOUSE_HACK_7           0x00000080
-#define HID_QUIRK_2WHEEL_MOUSE_HACK_5           0x100
+#define HID_QUIRK_2WHEEL_MOUSE_HACK_5           0x00000100
-#define HID_QUIRK_2WHEEL_MOUSE_HACK_ON          0x200
+#define HID_QUIRK_2WHEEL_MOUSE_HACK_ON          0x00000200
-#define HID_QUIRK_2WHEEL_POWERMOUSE             0x400
+#define HID_QUIRK_2WHEEL_POWERMOUSE             0x00000400
+#define HID_QUIRK_CYMOTION                      0x00000800
+#define HID_QUIRK_POWERBOOK_HAS_FN              0x00001000
+#define HID_QUIRK_POWERBOOK_FN_ON               0x00002000
 /*
 * This is the global environment of the parser. This information is
@@ -431,6 +434,11 @@ struct hid_device {							/* device report descriptor */
        void (*ff_exit)(struct hid_device*);                            /* Called by hid_exit_ff(hid) */
        int (*ff_event)(struct hid_device *hid, struct input_dev *input,
                        unsigned int type, unsigned int code, int value);
+#ifdef CONFIG_USB_HIDINPUT_POWERBOOK
+        unsigned long pb_pressed_fn[NBITS(KEY_MAX)];
+        unsigned long pb_pressed_numlock[NBITS(KEY_MAX)];
+#endif
 };
 #define HID_GLOBAL_STACK_SIZE 4
diff --git a/drivers/usb/input/pid.c b/drivers/usb/input/pid.c
index 19e015d171aa..d9d9f656b8c9 100644
--- a/drivers/usb/input/pid.c
+++ b/drivers/usb/input/pid.c
@@ -259,7 +259,7 @@ static int hid_pid_upload_effect(struct input_dev *dev,
 int hid_pid_init(struct hid_device *hid)
 {
        struct hid_ff_pid *private;
-        struct hid_input *hidinput = list_entry(&hid->inputs, struct hid_input, list);
+        struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
        struct input_dev *input_dev = hidinput->input;
        private = hid->ff_private = kzalloc(sizeof(struct hid_ff_pid), GFP_KERNEL);
diff --git a/drivers/usb/input/wacom.c b/drivers/usb/input/wacom.c
index 48df4cfd5a42..d3e15df9e815 100644
--- a/drivers/usb/input/wacom.c
+++ b/drivers/usb/input/wacom.c
@@ -95,7 +95,7 @@ MODULE_LICENSE(DRIVER_LICENSE);
 enum {
        PENPARTNER = 0,
        GRAPHIRE,
-        G4,
+        WACOM_G4,
        PL,
        INTUOS,
        INTUOS3,
@@ -373,7 +373,7 @@ static void wacom_graphire_irq(struct urb *urb, struct pt_regs *regs)
                        case 2: /* Mouse with wheel */
                                input_report_key(dev, BTN_MIDDLE, data[1] & 0x04);
-                                if (wacom->features->type == G4) {
+                                if (wacom->features->type == WACOM_G4) {
                                        rw = data[7] & 0x04 ? -(data[7] & 0x03) : (data[7] & 0x03);
                                        input_report_rel(dev, REL_WHEEL, rw);
                                } else
@@ -385,7 +385,7 @@ static void wacom_graphire_irq(struct urb *urb, struct pt_regs *regs)
                                id = CURSOR_DEVICE_ID;
                                input_report_key(dev, BTN_LEFT, data[1] & 0x01);
                                input_report_key(dev, BTN_RIGHT, data[1] & 0x02);
-                                if (wacom->features->type == G4)
+                                if (wacom->features->type == WACOM_G4)
                                        input_report_abs(dev, ABS_DISTANCE, data[6]);
                                else
                                        input_report_abs(dev, ABS_DISTANCE, data[7]);
@@ -410,7 +410,7 @@ static void wacom_graphire_irq(struct urb *urb, struct pt_regs *regs)
        input_sync(dev);
        /* send pad data */
-        if (wacom->features->type == G4) {
+        if (wacom->features->type == WACOM_G4) {
                /* fist time sending pad data */
                if (wacom->tool[1] != BTN_TOOL_FINGER) {
                        wacom->id[1] = 0;
@@ -713,8 +713,8 @@ static struct wacom_features wacom_features[] = {
        { "Wacom Graphire2 5x7", 8,  13918, 10206,  511, 32, GRAPHIRE,   wacom_graphire_irq },
        { "Wacom Graphire3",     8,  10208,  7424,  511, 32, GRAPHIRE,   wacom_graphire_irq },
        { "Wacom Graphire3 6x8", 8,  16704, 12064,  511, 32, GRAPHIRE,   wacom_graphire_irq },
-        { "Wacom Graphire4 4x5", 8,  10208,  7424,  511, 32, G4,         wacom_graphire_irq },
+        { "Wacom Graphire4 4x5", 8,  10208,  7424,  511, 32, WACOM_G4,   wacom_graphire_irq },
-        { "Wacom Graphire4 6x8", 8,  16704, 12064,  511, 32, G4,         wacom_graphire_irq },
+        { "Wacom Graphire4 6x8", 8,  16704, 12064,  511, 32, WACOM_G4,   wacom_graphire_irq },
        { "Wacom Volito",        8,   5104,  3712,  511, 32, GRAPHIRE,   wacom_graphire_irq },
        { "Wacom PenStation2",   8,   3250,  2320,  255, 32, GRAPHIRE,   wacom_graphire_irq },
        { "Wacom Volito2 4x5",   8,   5104,  3712,  511, 32, GRAPHIRE,   wacom_graphire_irq },
@@ -859,7 +859,7 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
        input_set_abs_params(input_dev, ABS_PRESSURE, 0, wacom->features->pressure_max, 0, 0);
        switch (wacom->features->type) {
-                case G4:
+                case WACOM_G4:
                        input_dev->evbit[0] |= BIT(EV_MSC);
                        input_dev->mscbit[0] |= BIT(MSC_SERIAL);
                        input_dev->keybit[LONG(BTN_DIGI)] |= BIT(BTN_TOOL_FINGER);
diff --git a/drivers/usb/serial/bus.c b/drivers/usb/serial/bus.c
index 664139afcfa9..e9f9f4bafa17 100644
--- a/drivers/usb/serial/bus.c
+++ b/drivers/usb/serial/bus.c
@@ -37,11 +37,6 @@ static int usb_serial_device_match (struct device *dev, struct device_driver *dr
        return 0;
 }
-struct bus_type usb_serial_bus_type = {
-        .name =         "usb-serial",
-        .match =        usb_serial_device_match,
-};
 static int usb_serial_device_probe (struct device *dev)
 {
        struct usb_serial_driver *driver;
@@ -109,14 +104,18 @@ exit:
        return retval;
 }
+struct bus_type usb_serial_bus_type = {
+        .name =         "usb-serial",
+        .match =        usb_serial_device_match,
+        .probe =        usb_serial_device_probe,
+        .remove =       usb_serial_device_remove,
+};
 int usb_serial_bus_register(struct usb_serial_driver *driver)
 {
        int retval;
        driver->driver.bus = &usb_serial_bus_type;
-        driver->driver.probe = usb_serial_device_probe;
-        driver->driver.remove = usb_serial_device_remove;
        retval = driver_register(&driver->driver);
        return retval;
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 9ffff1938239..0eb883f44ada 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -43,8 +43,6 @@ static int debug;
 #define PL2303_BUF_SIZE         1024
 #define PL2303_TMP_BUF_SIZE     1024
-static DECLARE_MUTEX(pl2303_tmp_buf_sem);
 struct pl2303_buf {
        unsigned int    buf_size;
        char            *buf_buf;
diff --git a/drivers/video/amifb.c b/drivers/video/amifb.c
index d549e215f3c5..2c42a812655a 100644
--- a/drivers/video/amifb.c
+++ b/drivers/video/amifb.c
@@ -590,6 +590,8 @@ static u_short maxfmode, chipset;
 #define highw(x)        ((u_long)(x)>>16 & 0xffff)
 #define loww(x)         ((u_long)(x) & 0xffff)
+#define custom          amiga_custom
 #define VBlankOn()      custom.intena = IF_SETCLR|IF_COPER
 #define VBlankOff()     custom.intena = IF_COPER
@@ -1164,8 +1166,8 @@ static void ami_update_display(void);
 static void ami_init_display(void);
 static void ami_do_blank(void);
 static int ami_get_fix_cursorinfo(struct fb_fix_cursorinfo *fix);
-static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data);
+static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var, u_char __user *data);
-static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data);
+static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var, u_char __user *data);
 static int ami_get_cursorstate(struct fb_cursorstate *state);
 static int ami_set_cursorstate(struct fb_cursorstate *state);
 static void ami_set_sprite(void);
@@ -2179,6 +2181,7 @@ static int amifb_ioctl(struct inode *inode, struct file *file,
                struct fb_var_cursorinfo var;
                struct fb_cursorstate state;
        } crsr;
+        void __user *argp = (void __user *)arg;
        int i;
        switch (cmd) {
@@ -2186,33 +2189,32 @@ static int amifb_ioctl(struct inode *inode, struct file *file,
                        i = ami_get_fix_cursorinfo(&crsr.fix);
                        if (i)
                                return i;
-                        return copy_to_user((void *)arg, &crsr.fix,
+                        return copy_to_user(argp, &crsr.fix,
                                            sizeof(crsr.fix)) ? -EFAULT : 0;
                case FBIOGET_VCURSORINFO:
                        i = ami_get_var_cursorinfo(&crsr.var,
-                                ((struct fb_var_cursorinfo *)arg)->data);
+                                ((struct fb_var_cursorinfo __user *)arg)->data);
                        if (i)
                                return i;
-                        return copy_to_user((void *)arg, &crsr.var,
+                        return copy_to_user(argp, &crsr.var,
                                            sizeof(crsr.var)) ? -EFAULT : 0;
                case FBIOPUT_VCURSORINFO:
-                        if (copy_from_user(&crsr.var, (void *)arg,
+                        if (copy_from_user(&crsr.var, argp, sizeof(crsr.var)))
-                                           sizeof(crsr.var)))
                                return -EFAULT;
                        return ami_set_var_cursorinfo(&crsr.var,
-                                ((struct fb_var_cursorinfo *)arg)->data);
+                                ((struct fb_var_cursorinfo __user *)arg)->data);
                case FBIOGET_CURSORSTATE:
                        i = ami_get_cursorstate(&crsr.state);
                        if (i)
                                return i;
-                        return copy_to_user((void *)arg, &crsr.state,
+                        return copy_to_user(argp, &crsr.state,
                                            sizeof(crsr.state)) ? -EFAULT : 0;
                case FBIOPUT_CURSORSTATE:
-                        if (copy_from_user(&crsr.state, (void *)arg,
+                        if (copy_from_user(&crsr.state, argp,
                                           sizeof(crsr.state)))
                                return -EFAULT;
                        return ami_set_cursorstate(&crsr.state);
@@ -3325,7 +3327,7 @@ static int ami_get_fix_cursorinfo(struct fb_fix_cursorinfo *fix)
        return 0;
 }
-static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data)
+static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var, u_char __user *data)
 {
        struct amifb_par *par = &currentpar;
        register u_short *lspr, *sspr;
@@ -3347,14 +3349,14 @@ static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data)
        var->yspot = par->crsr.spot_y;
        if (size > var->height*var->width)
                return -ENAMETOOLONG;
-        if (!access_ok(VERIFY_WRITE, (void *)data, size))
+        if (!access_ok(VERIFY_WRITE, data, size))
                return -EFAULT;
        delta = 1<<par->crsr.fmode;
        lspr = lofsprite + (delta<<1);
        if (par->bplcon0 & BPC0_LACE)
                sspr = shfsprite + (delta<<1);
        else
-                sspr = 0;
+                sspr = NULL;
        for (height = (short)var->height-1; height >= 0; height--) {
                bits = 0; words = delta; datawords = 0;
                for (width = (short)var->width-1; width >= 0; width--) {
@@ -3400,7 +3402,7 @@ static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data)
        return 0;
 }
-static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data)
+static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var, u_char __user *data)
 {
        struct amifb_par *par = &currentpar;
        register u_short *lspr, *sspr;
@@ -3427,7 +3429,7 @@ static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data)
                return -EINVAL;
        if (!var->height)
                return -EINVAL;
-        if (!access_ok(VERIFY_READ, (void *)data, var->width*var->height))
+        if (!access_ok(VERIFY_READ, data, var->width*var->height))
                return -EFAULT;
        delta = 1<<fmode;
        lofsprite = shfsprite = (u_short *)spritememory;
@@ -3442,13 +3444,13 @@ static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data)
                if (((var->height+2)<<fmode<<2) > SPRITEMEMSIZE)
                        return -EINVAL;
                memset(lspr, 0, (var->height+2)<<fmode<<2);
-                sspr = 0;
+                sspr = NULL;
        }
        for (height = (short)var->height-1; height >= 0; height--) {
                bits = 16; words = delta; datawords = 0;
                for (width = (short)var->width-1; width >= 0; width--) {
                        unsigned long tdata = 0;
-                        get_user(tdata, (char *)data);
+                        get_user(tdata, data);
                        data++;
 #ifdef __mc68000__
                        asm volatile (
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index e370125e4fbc..ed81005cbdba 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -3501,7 +3501,7 @@ err_release_mem:
 static int __devinit atyfb_atari_probe(void)
 {
-        struct aty_par *par;
+        struct atyfb_par *par;
        struct fb_info *info;
        int m64_num;
        u32 clock_r;
diff --git a/drivers/video/macfb.c b/drivers/video/macfb.c
index cfc748e94272..e6cbd9de944a 100644
--- a/drivers/video/macfb.c
+++ b/drivers/video/macfb.c
@@ -609,18 +609,19 @@ void __init macfb_setup(char *options)
        }
 }
-void __init macfb_init(void)
+static int __init macfb_init(void)
 {
        int video_cmap_len, video_is_nubus = 0;
        struct nubus_dev* ndev = NULL;
        char *option = NULL;
+        int err;
        if (fb_get_options("macfb", &option))
                return -ENODEV;
        macfb_setup(option);
        if (!MACH_IS_MAC) 
-                return;
+                return -ENODEV;
        /* There can only be one internal video controller anyway so
           we're not too worried about this */
@@ -958,11 +959,11 @@ void __init macfb_init(void)
        fb_alloc_cmap(&fb_info.cmap, video_cmap_len, 0);
        
-        if (register_framebuffer(&fb_info) < 0)
+        err = register_framebuffer(&fb_info);
-                return;
+        if (!err)
+                printk("fb%d: %s frame buffer device\n",
-        printk("fb%d: %s frame buffer device\n",
+                       fb_info.node, fb_info.fix.id);
-               fb_info.node, fb_info.fix.id);
+        return err;
 }
 module_init(macfb_init);
diff --git a/drivers/zorro/proc.c b/drivers/zorro/proc.c
index 1a409c2c320c..7aa2d3de6d37 100644
--- a/drivers/zorro/proc.c
+++ b/drivers/zorro/proc.c
@@ -45,7 +45,7 @@ proc_bus_zorro_lseek(struct file *file, loff_t off, int whence)
 }
 static ssize_t
-proc_bus_zorro_read(struct file *file, char *buf, size_t nbytes, loff_t *ppos)
+proc_bus_zorro_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
 {
        struct inode *ino = file->f_dentry->d_inode;
        struct proc_dir_entry *dp = PDE(ino);
diff --git a/drivers/zorro/zorro-driver.c b/drivers/zorro/zorro-driver.c
index ccba227676f2..fcbee748c592 100644
--- a/drivers/zorro/zorro-driver.c
+++ b/drivers/zorro/zorro-driver.c
@@ -77,7 +77,6 @@ int zorro_register_driver(struct zorro_driver *drv)
        /* initialize common driver fields */
        drv->driver.name = drv->name;
        drv->driver.bus = &zorro_bus_type;
-        drv->driver.probe = zorro_device_probe;
        /* register with core */
        count = driver_register(&drv->driver);
@@ -132,7 +131,8 @@ static int zorro_bus_match(struct device *dev, struct device_driver *drv)
 struct bus_type zorro_bus_type = {
        .name   = "zorro",
-        .match  = zorro_bus_match
+        .match  = zorro_bus_match,
+        .probe  = zorro_device_probe,
 };