12 files changed, 306 insertions, 156 deletions

diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 158eed4d5161..29b7a648cc6e 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -49,7 +49,6 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/kthread.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/spinlock.h>
 #include <linux/file.h>
@@ -2798,14 +2797,9 @@ out_mem:
         return ret;
 }
 
-static long pkt_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+static int pkt_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
 {
-        struct inode *inode = file->f_path.dentry->d_inode;
-        struct pktcdvd_device *pd;
-        long ret;
-
-        lock_kernel();
-        pd = inode->i_bdev->bd_disk->private_data;
+        struct pktcdvd_device *pd = inode->i_bdev->bd_disk->private_data;
 
         VPRINTK("pkt_ioctl: cmd %x, dev %d:%d\n", cmd, imajor(inode), iminor(inode));
 
@@ -2818,8 +2812,7 @@ static long pkt_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         case CDROM_LAST_WRITTEN:
         case CDROM_SEND_PACKET:
         case SCSI_IOCTL_SEND_COMMAND:
-                ret = blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
-                break;
+                return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
 
         case CDROMEJECT:
                 /*
@@ -2828,15 +2821,14 @@ static long pkt_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                  */
                 if (pd->refcnt == 1)
                         pkt_lock_door(pd, 0);
-                ret = blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
-                break;
+                return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
 
         default:
                 VPRINTK(DRIVER_NAME": Unknown ioctl for %s (%x)\n", pd->name, cmd);
-                ret = -ENOTTY;
+                return -ENOTTY;
         }
-        unlock_kernel();
-        return ret;
+
+        return 0;
 }
 
 static int pkt_media_changed(struct gendisk *disk)
@@ -2858,7 +2850,7 @@ static struct block_device_operations pktcdvd_ops = {
         .owner =                THIS_MODULE,
         .open =                 pkt_open,
         .release =              pkt_close,
-        .unlocked_ioctl =       pkt_ioctl,
+        .ioctl =                pkt_ioctl,
         .media_changed =        pkt_media_changed,
 };
 
@@ -3023,8 +3015,7 @@ static void pkt_get_status(struct pkt_ctrl_command *ctrl_cmd)
         mutex_unlock(&ctl_mutex);
 }
 
-static long pkt_ctl_ioctl(struct file *file, unsigned int cmd,
-                                                unsigned long arg)
+static int pkt_ctl_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
 {
         void __user *argp = (void __user *)arg;
         struct pkt_ctrl_command ctrl_cmd;
@@ -3041,22 +3032,16 @@ static long pkt_ctl_ioctl(struct file *file, unsigned int cmd,
         case PKT_CTRL_CMD_SETUP:
                 if (!capable(CAP_SYS_ADMIN))
                         return -EPERM;
-                lock_kernel();
                 ret = pkt_setup_dev(new_decode_dev(ctrl_cmd.dev), &pkt_dev);
                 ctrl_cmd.pkt_dev = new_encode_dev(pkt_dev);
-                unlock_kernel();
                 break;
         case PKT_CTRL_CMD_TEARDOWN:
                 if (!capable(CAP_SYS_ADMIN))
                         return -EPERM;
-                lock_kernel();
                 ret = pkt_remove_dev(new_decode_dev(ctrl_cmd.pkt_dev));
-                unlock_kernel();
                 break;
         case PKT_CTRL_CMD_STATUS:
-                lock_kernel();
                 pkt_get_status(&ctrl_cmd);
-                unlock_kernel();
                 break;
         default:
                 return -ENOTTY;
@@ -3069,7 +3054,7 @@ static long pkt_ctl_ioctl(struct file *file, unsigned int cmd,
 
 
 static const struct file_operations pkt_ctl_fops = {
-        .unlocked_ioctl  = pkt_ctl_ioctl,
+        .ioctl   = pkt_ctl_ioctl,
         .owner   = THIS_MODULE,
 };
 
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index a27160ba21d7..daeb8f766971 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -2498,7 +2498,7 @@ static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
 /**
  *      tty_do_resize           -       resize event
  *      @tty: tty being resized
- *      @real_tty: real tty (if using a pty/tty pair)
+ *      @real_tty: real tty (not the same as tty if using a pty/tty pair)
  *      @rows: rows (character)
  *      @cols: cols (character)
  *
@@ -2512,7 +2512,8 @@ int tty_do_resize(struct tty_struct *tty, struct tty_struct *real_tty,
         struct pid *pgrp, *rpgrp;
         unsigned long flags;
 
-        mutex_lock(&tty->termios_mutex);
+        /* For a PTY we need to lock the tty side */
+        mutex_lock(&real_tty->termios_mutex);
         if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
                 goto done;
         /* Get the PID values and reference them so we can
@@ -2533,7 +2534,7 @@ int tty_do_resize(struct tty_struct *tty, struct tty_struct *real_tty,
         tty->winsize = *ws;
         real_tty->winsize = *ws;
 done:
-        mutex_unlock(&tty->termios_mutex);
+        mutex_unlock(&real_tty->termios_mutex);
         return 0;
 }
 
diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index ea9fc5d03b99..bf34e4597421 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -937,12 +937,14 @@ int tty_mode_ioctl(struct tty_struct *tty, struct file *file,
                         return 0;
 #endif
         case TIOCGSOFTCAR:
-                return put_user(C_CLOCAL(tty) ? 1 : 0,
+                /* FIXME: for correctness we may need to take the termios
+                   lock here - review */
+                return put_user(C_CLOCAL(real_tty) ? 1 : 0,
                                                 (int __user *)arg);
         case TIOCSSOFTCAR:
                 if (get_user(arg, (unsigned int __user *) arg))
                         return -EFAULT;
-                return tty_change_softcar(tty, arg);
+                return tty_change_softcar(real_tty, arg);
         default:
                 return -ENOIOCTLCMD;
         }
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 089c015c01d1..53f0e5af1cc8 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -400,27 +400,31 @@ static void drm_locked_tasklet_func(unsigned long data)
 {
         struct drm_device *dev = (struct drm_device *)data;
         unsigned long irqflags;
-
+        void (*tasklet_func)(struct drm_device *);
+        
         spin_lock_irqsave(&dev->tasklet_lock, irqflags);
+        tasklet_func = dev->locked_tasklet_func;
+        spin_unlock_irqrestore(&dev->tasklet_lock, irqflags);
 
-        if (!dev->locked_tasklet_func ||
+        if (!tasklet_func ||
             !drm_lock_take(&dev->lock,
                            DRM_KERNEL_CONTEXT)) {
-                spin_unlock_irqrestore(&dev->tasklet_lock, irqflags);
                 return;
         }
 
         dev->lock.lock_time = jiffies;
         atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
 
-        dev->locked_tasklet_func(dev);
+        spin_lock_irqsave(&dev->tasklet_lock, irqflags);
+        tasklet_func = dev->locked_tasklet_func;
+        dev->locked_tasklet_func = NULL;
+        spin_unlock_irqrestore(&dev->tasklet_lock, irqflags);
+        
+        if (tasklet_func != NULL)
+                tasklet_func(dev);
 
         drm_lock_free(&dev->lock,
                       DRM_KERNEL_CONTEXT);
-
-        dev->locked_tasklet_func = NULL;
-
-        spin_unlock_irqrestore(&dev->tasklet_lock, irqflags);
 }
 
 /**
diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c
index 0998723cde79..a4caf95485d7 100644
--- a/drivers/gpu/drm/drm_lock.c
+++ b/drivers/gpu/drm/drm_lock.c
@@ -105,14 +105,19 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv)
                   ret ? "interrupted" : "has lock");
         if (ret) return ret;
 
-        sigemptyset(&dev->sigmask);
-        sigaddset(&dev->sigmask, SIGSTOP);
-        sigaddset(&dev->sigmask, SIGTSTP);
-        sigaddset(&dev->sigmask, SIGTTIN);
-        sigaddset(&dev->sigmask, SIGTTOU);
-        dev->sigdata.context = lock->context;
-        dev->sigdata.lock = dev->lock.hw_lock;
-        block_all_signals(drm_notifier, &dev->sigdata, &dev->sigmask);
+        /* don't set the block all signals on the master process for now 
+         * really probably not the correct answer but lets us debug xkb
+         * xserver for now */
+        if (!file_priv->master) {
+                sigemptyset(&dev->sigmask);
+                sigaddset(&dev->sigmask, SIGSTOP);
+                sigaddset(&dev->sigmask, SIGTSTP);
+                sigaddset(&dev->sigmask, SIGTTIN);
+                sigaddset(&dev->sigmask, SIGTTOU);
+                dev->sigdata.context = lock->context;
+                dev->sigdata.lock = dev->lock.hw_lock;
+                block_all_signals(drm_notifier, &dev->sigdata, &dev->sigmask);
+        }
 
         if (dev->driver->dma_ready && (lock->flags & _DRM_LOCK_READY))
                 dev->driver->dma_ready(dev);
@@ -150,6 +155,7 @@ int drm_unlock(struct drm_device *dev, void *data, struct drm_file *file_priv)
 {
         struct drm_lock *lock = data;
         unsigned long irqflags;
+        void (*tasklet_func)(struct drm_device *);
 
         if (lock->context == DRM_KERNEL_CONTEXT) {
                 DRM_ERROR("Process %d using kernel context %d\n",
@@ -158,14 +164,11 @@ int drm_unlock(struct drm_device *dev, void *data, struct drm_file *file_priv)
         }
 
         spin_lock_irqsave(&dev->tasklet_lock, irqflags);
-
-        if (dev->locked_tasklet_func) {
-                dev->locked_tasklet_func(dev);
-
-                dev->locked_tasklet_func = NULL;
-        }
-
+        tasklet_func = dev->locked_tasklet_func;
+        dev->locked_tasklet_func = NULL;
         spin_unlock_irqrestore(&dev->tasklet_lock, irqflags);
+        if (tasklet_func != NULL)
+                tasklet_func(dev);
 
         atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
 
diff --git a/drivers/gpu/drm/radeon/r300_cmdbuf.c b/drivers/gpu/drm/radeon/r300_cmdbuf.c
index 702df45320f7..4b27d9abb7bc 100644
--- a/drivers/gpu/drm/radeon/r300_cmdbuf.c
+++ b/drivers/gpu/drm/radeon/r300_cmdbuf.c
@@ -77,6 +77,9 @@ static int r300_emit_cliprects(drm_radeon_private_t *dev_priv,
                                 return -EFAULT;
                         }
 
+                        box.x2--; /* Hardware expects inclusive bottom-right corner */
+                        box.y2--;
+
                         if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_RV515) {
                                 box.x1 = (box.x1) &
                                         R300_CLIPRECT_MASK;
@@ -95,8 +98,8 @@ static int r300_emit_cliprects(drm_radeon_private_t *dev_priv,
                                         R300_CLIPRECT_MASK;
                                 box.y2 = (box.y2 + R300_CLIPRECT_OFFSET) &
                                         R300_CLIPRECT_MASK;
-
                         }
+
                         OUT_RING((box.x1 << R300_CLIPRECT_X_SHIFT) |
                                  (box.y1 << R300_CLIPRECT_Y_SHIFT));
                         OUT_RING((box.x2 << R300_CLIPRECT_X_SHIFT) |
@@ -136,6 +139,18 @@ static int r300_emit_cliprects(drm_radeon_private_t *dev_priv,
                 ADVANCE_RING();
         }
 
+        /* flus cache and wait idle clean after cliprect change */
+        BEGIN_RING(2);
+        OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
+        OUT_RING(R300_RB3D_DC_FLUSH);
+        ADVANCE_RING();
+        BEGIN_RING(2);
+        OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
+        OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
+        ADVANCE_RING();
+        /* set flush flag */
+        dev_priv->track_flush |= RADEON_FLUSH_EMITED;
+
         return 0;
 }
 
@@ -166,13 +181,13 @@ void r300_init_reg_flags(struct drm_device *dev)
         ADD_RANGE(0x21DC, 1);
         ADD_RANGE(R300_VAP_UNKNOWN_221C, 1);
         ADD_RANGE(R300_VAP_CLIP_X_0, 4);
-        ADD_RANGE(R300_VAP_PVS_WAITIDLE, 1);
+        ADD_RANGE(R300_VAP_PVS_STATE_FLUSH_REG, 1);
         ADD_RANGE(R300_VAP_UNKNOWN_2288, 1);
         ADD_RANGE(R300_VAP_OUTPUT_VTX_FMT_0, 2);
         ADD_RANGE(R300_VAP_PVS_CNTL_1, 3);
         ADD_RANGE(R300_GB_ENABLE, 1);
         ADD_RANGE(R300_GB_MSPOS0, 5);
-        ADD_RANGE(R300_TX_CNTL, 1);
+        ADD_RANGE(R300_TX_INVALTAGS, 1);
         ADD_RANGE(R300_TX_ENABLE, 1);
         ADD_RANGE(0x4200, 4);
         ADD_RANGE(0x4214, 1);
@@ -388,15 +403,28 @@ static __inline__ int r300_emit_vpu(drm_radeon_private_t *dev_priv,
         if (sz * 16 > cmdbuf->bufsz)
                 return -EINVAL;
 
-        BEGIN_RING(5 + sz * 4);
-        /* Wait for VAP to come to senses.. */
-        /* there is no need to emit it multiple times, (only once before VAP is programmed,
-           but this optimization is for later */
-        OUT_RING_REG(R300_VAP_PVS_WAITIDLE, 0);
+        /* VAP is very sensitive so we purge cache before we program it
+         * and we also flush its state before & after */
+        BEGIN_RING(6);
+        OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
+        OUT_RING(R300_RB3D_DC_FLUSH);
+        OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
+        OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
+        OUT_RING(CP_PACKET0(R300_VAP_PVS_STATE_FLUSH_REG, 0));
+        OUT_RING(0);
+        ADVANCE_RING();
+        /* set flush flag */
+        dev_priv->track_flush |= RADEON_FLUSH_EMITED;
+
+        BEGIN_RING(3 + sz * 4);
         OUT_RING_REG(R300_VAP_PVS_UPLOAD_ADDRESS, addr);
         OUT_RING(CP_PACKET0_TABLE(R300_VAP_PVS_UPLOAD_DATA, sz * 4 - 1));
         OUT_RING_TABLE((int *)cmdbuf->buf, sz * 4);
+        ADVANCE_RING();
 
+        BEGIN_RING(2);
+        OUT_RING(CP_PACKET0(R300_VAP_PVS_STATE_FLUSH_REG, 0));
+        OUT_RING(0);
         ADVANCE_RING();
 
         cmdbuf->buf += sz * 16;
@@ -424,6 +452,15 @@ static __inline__ int r300_emit_clear(drm_radeon_private_t *dev_priv,
         OUT_RING_TABLE((int *)cmdbuf->buf, 8);
         ADVANCE_RING();
 
+        BEGIN_RING(4);
+        OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
+        OUT_RING(R300_RB3D_DC_FLUSH);
+        OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
+        OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
+        ADVANCE_RING();
+        /* set flush flag */
+        dev_priv->track_flush |= RADEON_FLUSH_EMITED;
+
         cmdbuf->buf += 8 * 4;
         cmdbuf->bufsz -= 8 * 4;
 
@@ -543,22 +580,23 @@ static __inline__ int r300_emit_bitblt_multi(drm_radeon_private_t *dev_priv,
         return 0;
 }
 
-static __inline__ int r300_emit_indx_buffer(drm_radeon_private_t *dev_priv,
-                                             drm_radeon_kcmd_buffer_t *cmdbuf)
+static __inline__ int r300_emit_draw_indx_2(drm_radeon_private_t *dev_priv,
+                                            drm_radeon_kcmd_buffer_t *cmdbuf)
 {
-        u32 *cmd = (u32 *) cmdbuf->buf;
-        int count, ret;
+        u32 *cmd;
+        int count;
+        int expected_count;
         RING_LOCALS;
 
-        count=(cmd[0]>>16) & 0x3fff;
+        cmd = (u32 *) cmdbuf->buf;
+        count = (cmd[0]>>16) & 0x3fff;
+        expected_count = cmd[1] >> 16;
+        if (!(cmd[1] & R300_VAP_VF_CNTL__INDEX_SIZE_32bit))
+                expected_count = (expected_count+1)/2;
 
-        if ((cmd[1] & 0x8000ffff) != 0x80000810) {
-                DRM_ERROR("Invalid indx_buffer reg address %08X\n", cmd[1]);
-                return -EINVAL;
-        }
-        ret = !radeon_check_offset(dev_priv, cmd[2]);
-        if (ret) {
-                DRM_ERROR("Invalid indx_buffer offset is %08X\n", cmd[2]);
+        if (count && count != expected_count) {
+                DRM_ERROR("3D_DRAW_INDX_2: packet size %i, expected %i\n",
+                        count, expected_count);
                 return -EINVAL;
         }
 
@@ -570,6 +608,50 @@ static __inline__ int r300_emit_indx_buffer(drm_radeon_private_t *dev_priv,
         cmdbuf->buf += (count+2)*4;
         cmdbuf->bufsz -= (count+2)*4;
 
+        if (!count) {
+                drm_r300_cmd_header_t header;
+
+                if (cmdbuf->bufsz < 4*4 + sizeof(header)) {
+                        DRM_ERROR("3D_DRAW_INDX_2: expect subsequent INDX_BUFFER, but stream is too short.\n");
+                        return -EINVAL;
+                }
+
+                header.u = *(unsigned int *)cmdbuf->buf;
+
+                cmdbuf->buf += sizeof(header);
+                cmdbuf->bufsz -= sizeof(header);
+                cmd = (u32 *) cmdbuf->buf;
+
+                if (header.header.cmd_type != R300_CMD_PACKET3 ||
+                    header.packet3.packet != R300_CMD_PACKET3_RAW ||
+                    cmd[0] != CP_PACKET3(RADEON_CP_INDX_BUFFER, 2)) {
+                        DRM_ERROR("3D_DRAW_INDX_2: expect subsequent INDX_BUFFER.\n");
+                        return -EINVAL;
+                }
+
+                if ((cmd[1] & 0x8000ffff) != 0x80000810) {
+                        DRM_ERROR("Invalid indx_buffer reg address %08X\n", cmd[1]);
+                        return -EINVAL;
+                }
+                if (!radeon_check_offset(dev_priv, cmd[2])) {
+                        DRM_ERROR("Invalid indx_buffer offset is %08X\n", cmd[2]);
+                        return -EINVAL;
+                }
+                if (cmd[3] != expected_count) {
+                        DRM_ERROR("INDX_BUFFER: buffer size %i, expected %i\n",
+                                cmd[3], expected_count);
+                        return -EINVAL;
+                }
+
+                BEGIN_RING(4);
+                OUT_RING(cmd[0]);
+                OUT_RING_TABLE((int *)(cmdbuf->buf + 4), 3);
+                ADVANCE_RING();
+
+                cmdbuf->buf += 4*4;
+                cmdbuf->bufsz -= 4*4;
+        }
+
         return 0;
 }
 
@@ -613,11 +695,22 @@ static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t *dev_priv,
         case RADEON_CNTL_BITBLT_MULTI:
                 return r300_emit_bitblt_multi(dev_priv, cmdbuf);
 
-        case RADEON_CP_INDX_BUFFER:     /* DRAW_INDX_2 without INDX_BUFFER seems to lock up the gpu */
-                return r300_emit_indx_buffer(dev_priv, cmdbuf);
-        case RADEON_CP_3D_DRAW_IMMD_2:  /* triggers drawing using in-packet vertex data */
-        case RADEON_CP_3D_DRAW_VBUF_2:  /* triggers drawing of vertex buffers setup elsewhere */
-        case RADEON_CP_3D_DRAW_INDX_2:  /* triggers drawing using indices to vertex buffer */
+        case RADEON_CP_INDX_BUFFER:
+                DRM_ERROR("packet3 INDX_BUFFER without preceding 3D_DRAW_INDX_2 is illegal.\n");
+                return -EINVAL;
+        case RADEON_CP_3D_DRAW_IMMD_2:
+                /* triggers drawing using in-packet vertex data */
+        case RADEON_CP_3D_DRAW_VBUF_2:
+                /* triggers drawing of vertex buffers setup elsewhere */
+                dev_priv->track_flush &= ~(RADEON_FLUSH_EMITED |
+                                           RADEON_PURGE_EMITED);
+                break;
+        case RADEON_CP_3D_DRAW_INDX_2:
+                /* triggers drawing using indices to vertex buffer */
+                /* whenever we send vertex we clear flush & purge */
+                dev_priv->track_flush &= ~(RADEON_FLUSH_EMITED |
+                                           RADEON_PURGE_EMITED);
+                return r300_emit_draw_indx_2(dev_priv, cmdbuf);
         case RADEON_WAIT_FOR_IDLE:
         case RADEON_CP_NOP:
                 /* these packets are safe */
@@ -713,17 +806,53 @@ static __inline__ int r300_emit_packet3(drm_radeon_private_t *dev_priv,
  */
 static __inline__ void r300_pacify(drm_radeon_private_t *dev_priv)
 {
+        uint32_t cache_z, cache_3d, cache_2d;
         RING_LOCALS;
 
-        BEGIN_RING(6);
-        OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
-        OUT_RING(R300_RB3D_DSTCACHE_UNKNOWN_0A);
+        cache_z = R300_ZC_FLUSH;
+        cache_2d = R300_RB2D_DC_FLUSH;
+        cache_3d = R300_RB3D_DC_FLUSH;
+        if (!(dev_priv->track_flush & RADEON_PURGE_EMITED)) {
+                /* we can purge, primitive where draw since last purge */
+                cache_z |= R300_ZC_FREE;
+                cache_2d |= R300_RB2D_DC_FREE;
+                cache_3d |= R300_RB3D_DC_FREE;
+        }
+
+        /* flush & purge zbuffer */
+        BEGIN_RING(2);
         OUT_RING(CP_PACKET0(R300_ZB_ZCACHE_CTLSTAT, 0));
-        OUT_RING(R300_ZB_ZCACHE_CTLSTAT_ZC_FLUSH_FLUSH_AND_FREE|
-                 R300_ZB_ZCACHE_CTLSTAT_ZC_FREE_FREE);
-        OUT_RING(CP_PACKET3(RADEON_CP_NOP, 0));
-        OUT_RING(0x0);
+        OUT_RING(cache_z);
+        ADVANCE_RING();
+        /* flush & purge 3d */
+        BEGIN_RING(2);
+        OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
+        OUT_RING(cache_3d);
+        ADVANCE_RING();
+        /* flush & purge texture */
+        BEGIN_RING(2);
+        OUT_RING(CP_PACKET0(R300_TX_INVALTAGS, 0));
+        OUT_RING(0);
+        ADVANCE_RING();
+        /* FIXME: is this one really needed ? */
+        BEGIN_RING(2);
+        OUT_RING(CP_PACKET0(R300_RB3D_AARESOLVE_CTL, 0));
+        OUT_RING(0);
+        ADVANCE_RING();
+        BEGIN_RING(2);
+        OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
+        OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
+        ADVANCE_RING();
+        /* flush & purge 2d through E2 as RB2D will trigger lockup */
+        BEGIN_RING(4);
+        OUT_RING(CP_PACKET0(R300_DSTCACHE_CTLSTAT, 0));
+        OUT_RING(cache_2d);
+        OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
+        OUT_RING(RADEON_WAIT_2D_IDLECLEAN |
+                 RADEON_WAIT_HOST_IDLECLEAN);
         ADVANCE_RING();
+        /* set flush & purge flags */
+        dev_priv->track_flush |= RADEON_FLUSH_EMITED | RADEON_PURGE_EMITED;
 }
 
 /**
@@ -905,8 +1034,7 @@ int r300_do_cp_cmdbuf(struct drm_device *dev,
 
         DRM_DEBUG("\n");
 
-        /* See the comment above r300_emit_begin3d for why this call must be here,
-         * and what the cleanup gotos are for. */
+        /* pacify */
         r300_pacify(dev_priv);
 
         if (cmdbuf->nbox <= R300_SIMULTANEOUS_CLIPRECTS) {
diff --git a/drivers/gpu/drm/radeon/r300_reg.h b/drivers/gpu/drm/radeon/r300_reg.h
index a6802f26afc4..ee6f811599a3 100644
--- a/drivers/gpu/drm/radeon/r300_reg.h
+++ b/drivers/gpu/drm/radeon/r300_reg.h
@@ -317,7 +317,7 @@ USE OR OTHER DEALINGS IN THE SOFTWARE.
  * Therefore, I suspect writing zero to 0x2284 synchronizes the engine and
  * avoids bugs caused by still running shaders reading bad data from memory.
  */
-#define R300_VAP_PVS_WAITIDLE               0x2284 /* GUESS */
+#define R300_VAP_PVS_STATE_FLUSH_REG        0x2284
 
 /* Absolutely no clue what this register is about. */
 #define R300_VAP_UNKNOWN_2288               0x2288
@@ -513,7 +513,7 @@ USE OR OTHER DEALINGS IN THE SOFTWARE.
 /* gap */
 
 /* Zero to flush caches. */
-#define R300_TX_CNTL                        0x4100
+#define R300_TX_INVALTAGS                   0x4100
 #define R300_TX_FLUSH                       0x0
 
 /* The upper enable bits are guessed, based on fglrx reported limits. */
@@ -1362,6 +1362,7 @@ USE OR OTHER DEALINGS IN THE SOFTWARE.
 #define R300_RB3D_COLORPITCH2               0x4E40 /* GUESS */
 #define R300_RB3D_COLORPITCH3               0x4E44 /* GUESS */
 
+#define R300_RB3D_AARESOLVE_CTL             0x4E88
 /* gap */
 
 /* Guess by Vladimir.
diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index f0de81a5689d..3331f88dcfb6 100644
--- a/drivers/gpu/drm/radeon/radeon_cp.c
+++ b/drivers/gpu/drm/radeon/radeon_cp.c
@@ -40,6 +40,7 @@
 #define RADEON_FIFO_DEBUG       0
 
 static int radeon_do_cleanup_cp(struct drm_device * dev);
+static void radeon_do_cp_start(drm_radeon_private_t * dev_priv);
 
 static u32 R500_READ_MCIND(drm_radeon_private_t *dev_priv, int addr)
 {
@@ -198,23 +199,8 @@ static int radeon_do_pixcache_flush(drm_radeon_private_t * dev_priv)
                         DRM_UDELAY(1);
                 }
         } else {
-                /* 3D */
-                tmp = RADEON_READ(R300_RB3D_DSTCACHE_CTLSTAT);
-                tmp |= RADEON_RB3D_DC_FLUSH_ALL;
-                RADEON_WRITE(R300_RB3D_DSTCACHE_CTLSTAT, tmp);
-
-                /* 2D */
-                tmp = RADEON_READ(R300_DSTCACHE_CTLSTAT);
-                tmp |= RADEON_RB3D_DC_FLUSH_ALL;
-                RADEON_WRITE(R300_DSTCACHE_CTLSTAT, tmp);
-
-                for (i = 0; i < dev_priv->usec_timeout; i++) {
-                        if (!(RADEON_READ(R300_DSTCACHE_CTLSTAT)
-                          & RADEON_RB3D_DC_BUSY)) {
-                                return 0;
-                        }
-                        DRM_UDELAY(1);
-                }
+                /* don't flush or purge cache here or lockup */
+                return 0;
         }
 
 #if RADEON_FIFO_DEBUG
@@ -237,6 +223,9 @@ static int radeon_do_wait_for_fifo(drm_radeon_private_t * dev_priv, int entries)
                         return 0;
                 DRM_UDELAY(1);
         }
+        DRM_INFO("wait for fifo failed status : 0x%08X 0x%08X\n",
+                 RADEON_READ(RADEON_RBBM_STATUS),
+                 RADEON_READ(R300_VAP_CNTL_STATUS));
 
 #if RADEON_FIFO_DEBUG
         DRM_ERROR("failed!\n");
@@ -263,6 +252,9 @@ static int radeon_do_wait_for_idle(drm_radeon_private_t * dev_priv)
                 }
                 DRM_UDELAY(1);
         }
+        DRM_INFO("wait idle failed status : 0x%08X 0x%08X\n",
+                 RADEON_READ(RADEON_RBBM_STATUS),
+                 RADEON_READ(R300_VAP_CNTL_STATUS));
 
 #if RADEON_FIFO_DEBUG
         DRM_ERROR("failed!\n");
@@ -443,14 +435,20 @@ static void radeon_do_cp_start(drm_radeon_private_t * dev_priv)
 
         dev_priv->cp_running = 1;
 
-        BEGIN_RING(6);
-
+        BEGIN_RING(8);
+        /* isync can only be written through cp on r5xx write it here */
+        OUT_RING(CP_PACKET0(RADEON_ISYNC_CNTL, 0));
+        OUT_RING(RADEON_ISYNC_ANY2D_IDLE3D |
+                 RADEON_ISYNC_ANY3D_IDLE2D |
+                 RADEON_ISYNC_WAIT_IDLEGUI |
+                 RADEON_ISYNC_CPSCRATCH_IDLEGUI);
         RADEON_PURGE_CACHE();
         RADEON_PURGE_ZCACHE();
         RADEON_WAIT_UNTIL_IDLE();
-
         ADVANCE_RING();
         COMMIT_RING();
+
+        dev_priv->track_flush |= RADEON_FLUSH_EMITED | RADEON_PURGE_EMITED;
 }
 
 /* Reset the Command Processor.  This will not flush any pending
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index 3f0eca957aa7..099381693175 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -220,6 +220,9 @@ struct radeon_virt_surface {
         struct drm_file *file_priv;
 };
 
+#define RADEON_FLUSH_EMITED     (1 < 0)
+#define RADEON_PURGE_EMITED     (1 < 1)
+
 typedef struct drm_radeon_private {
         drm_radeon_ring_buffer_t ring;
         drm_radeon_sarea_t *sarea_priv;
@@ -311,6 +314,7 @@ typedef struct drm_radeon_private {
         unsigned long fb_aper_offset;
 
         int num_gb_pipes;
+        int track_flush;
 } drm_radeon_private_t;
 
 typedef struct drm_radeon_buf_priv {
@@ -693,7 +697,6 @@ extern int r300_do_cp_cmdbuf(struct drm_device * dev,
 #define R300_ZB_ZCACHE_CTLSTAT                  0x4f18
 #       define R300_ZC_FLUSH                    (1 << 0)
 #       define R300_ZC_FREE                     (1 << 1)
-#       define R300_ZC_FLUSH_ALL                0x3
 #       define R300_ZC_BUSY                     (1 << 31)
 #define RADEON_RB3D_DSTCACHE_CTLSTAT    0x325c
 #       define RADEON_RB3D_DC_FLUSH             (3 << 0)
@@ -701,6 +704,8 @@ extern int r300_do_cp_cmdbuf(struct drm_device * dev,
 #       define RADEON_RB3D_DC_FLUSH_ALL         0xf
 #       define RADEON_RB3D_DC_BUSY              (1 << 31)
 #define R300_RB3D_DSTCACHE_CTLSTAT              0x4e4c
+#       define R300_RB3D_DC_FLUSH               (2 << 0)
+#       define R300_RB3D_DC_FREE                (2 << 2)
 #       define R300_RB3D_DC_FINISH              (1 << 4)
 #define RADEON_RB3D_ZSTENCILCNTL        0x1c2c
 #       define RADEON_Z_TEST_MASK               (7 << 4)
@@ -1246,17 +1251,17 @@ do {									\
                 OUT_RING(RADEON_RB3D_DC_FLUSH);                         \
         } else {                                                        \
                 OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));    \
-                OUT_RING(RADEON_RB3D_DC_FLUSH);                         \
+                OUT_RING(R300_RB3D_DC_FLUSH);                           \
         }                                                               \
 } while (0)
 
 #define RADEON_PURGE_CACHE() do {                                       \
         if ((dev_priv->flags & RADEON_FAMILY_MASK) <= CHIP_RV280) {     \
                 OUT_RING(CP_PACKET0(RADEON_RB3D_DSTCACHE_CTLSTAT, 0));  \
-                OUT_RING(RADEON_RB3D_DC_FLUSH_ALL);                     \
+                OUT_RING(RADEON_RB3D_DC_FLUSH | RADEON_RB3D_DC_FREE);   \
         } else {                                                        \
                 OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));    \
-                OUT_RING(RADEON_RB3D_DC_FLUSH_ALL);                     \
+                OUT_RING(R300_RB3D_DC_FLUSH | R300_RB3D_DC_FREE);       \
         }                                                               \
 } while (0)
 
@@ -1273,10 +1278,10 @@ do {									\
 #define RADEON_PURGE_ZCACHE() do {                                      \
         if ((dev_priv->flags & RADEON_FAMILY_MASK) <= CHIP_RV280) {     \
                 OUT_RING(CP_PACKET0(RADEON_RB3D_ZCACHE_CTLSTAT, 0));    \
-                OUT_RING(RADEON_RB3D_ZC_FLUSH_ALL);                     \
+                OUT_RING(RADEON_RB3D_ZC_FLUSH | RADEON_RB3D_ZC_FREE);                   \
         } else {                                                        \
-                OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));    \
-                OUT_RING(R300_ZC_FLUSH_ALL);                            \
+                OUT_RING(CP_PACKET0(R300_ZB_ZCACHE_CTLSTAT, 0));        \
+                OUT_RING(R300_ZC_FLUSH | R300_ZC_FREE);                         \
         }                                                               \
 } while (0)
 
diff --git a/drivers/net/e1000/e1000_param.c b/drivers/net/e1000/e1000_param.c
index b9f90a5d3d4d..213437d13154 100644
--- a/drivers/net/e1000/e1000_param.c
+++ b/drivers/net/e1000/e1000_param.c
@@ -208,7 +208,7 @@ struct e1000_option {
                 } r;
                 struct { /* list_option info */
                         int nr;
-                        struct e1000_opt_list { int i; char *str; } *p;
+                        const struct e1000_opt_list { int i; char *str; } *p;
                 } l;
         } arg;
 };
@@ -242,7 +242,7 @@ static int __devinit e1000_validate_option(unsigned int *value,
                 break;
         case list_option: {
                 int i;
-                struct e1000_opt_list *ent;
+                const struct e1000_opt_list *ent;
 
                 for (i = 0; i < opt->arg.l.nr; i++) {
                         ent = &opt->arg.l.p[i];
@@ -279,7 +279,9 @@ static void e1000_check_copper_options(struct e1000_adapter *adapter);
 
 void __devinit e1000_check_options(struct e1000_adapter *adapter)
 {
+        struct e1000_option opt;
         int bd = adapter->bd_number;
+
         if (bd >= E1000_MAX_NIC) {
                 DPRINTK(PROBE, NOTICE,
                        "Warning: no configuration for board #%i\n", bd);
@@ -287,19 +289,21 @@ void __devinit e1000_check_options(struct e1000_adapter *adapter)
         }
 
         { /* Transmit Descriptor Count */
-                struct e1000_option opt = {
+                struct e1000_tx_ring *tx_ring = adapter->tx_ring;
+                int i;
+                e1000_mac_type mac_type = adapter->hw.mac_type;
+
+                opt = (struct e1000_option) {
                         .type = range_option,
                         .name = "Transmit Descriptors",
                         .err  = "using default of "
                                 __MODULE_STRING(E1000_DEFAULT_TXD),
                         .def  = E1000_DEFAULT_TXD,
-                        .arg  = { .r = { .min = E1000_MIN_TXD }}
+                        .arg  = { .r = {
+                                .min = E1000_MIN_TXD,
+                                .max = mac_type < e1000_82544 ? E1000_MAX_TXD : E1000_MAX_82544_TXD
+                                }}
                 };
-                struct e1000_tx_ring *tx_ring = adapter->tx_ring;
-                int i;
-                e1000_mac_type mac_type = adapter->hw.mac_type;
-                opt.arg.r.max = mac_type < e1000_82544 ?
-                        E1000_MAX_TXD : E1000_MAX_82544_TXD;
 
                 if (num_TxDescriptors > bd) {
                         tx_ring->count = TxDescriptors[bd];
@@ -313,19 +317,21 @@ void __devinit e1000_check_options(struct e1000_adapter *adapter)
                         tx_ring[i].count = tx_ring->count;
         }
         { /* Receive Descriptor Count */
-                struct e1000_option opt = {
+                struct e1000_rx_ring *rx_ring = adapter->rx_ring;
+                int i;
+                e1000_mac_type mac_type = adapter->hw.mac_type;
+
+                opt = (struct e1000_option) {
                         .type = range_option,
                         .name = "Receive Descriptors",
                         .err  = "using default of "
                                 __MODULE_STRING(E1000_DEFAULT_RXD),
                         .def  = E1000_DEFAULT_RXD,
-                        .arg  = { .r = { .min = E1000_MIN_RXD }}
+                        .arg  = { .r = {
+                                .min = E1000_MIN_RXD,
+                                .max = mac_type < e1000_82544 ? E1000_MAX_RXD : E1000_MAX_82544_RXD
+                        }}
                 };
-                struct e1000_rx_ring *rx_ring = adapter->rx_ring;
-                int i;
-                e1000_mac_type mac_type = adapter->hw.mac_type;
-                opt.arg.r.max = mac_type < e1000_82544 ? E1000_MAX_RXD :
-                        E1000_MAX_82544_RXD;
 
                 if (num_RxDescriptors > bd) {
                         rx_ring->count = RxDescriptors[bd];
@@ -339,7 +345,7 @@ void __devinit e1000_check_options(struct e1000_adapter *adapter)
                         rx_ring[i].count = rx_ring->count;
         }
         { /* Checksum Offload Enable/Disable */
-                struct e1000_option opt = {
+                opt = (struct e1000_option) {
                         .type = enable_option,
                         .name = "Checksum Offload",
                         .err  = "defaulting to Enabled",
@@ -363,7 +369,7 @@ void __devinit e1000_check_options(struct e1000_adapter *adapter)
                          { E1000_FC_FULL,    "Flow Control Enabled" },
                          { E1000_FC_DEFAULT, "Flow Control Hardware Default" }};
 
-                struct e1000_option opt = {
+                opt = (struct e1000_option) {
                         .type = list_option,
                         .name = "Flow Control",
                         .err  = "reading default settings from EEPROM",
@@ -381,7 +387,7 @@ void __devinit e1000_check_options(struct e1000_adapter *adapter)
                 }
         }
         { /* Transmit Interrupt Delay */
-                struct e1000_option opt = {
+                opt = (struct e1000_option) {
                         .type = range_option,
                         .name = "Transmit Interrupt Delay",
                         .err  = "using default of " __MODULE_STRING(DEFAULT_TIDV),
@@ -399,7 +405,7 @@ void __devinit e1000_check_options(struct e1000_adapter *adapter)
                 }
         }
         { /* Transmit Absolute Interrupt Delay */
-                struct e1000_option opt = {
+                opt = (struct e1000_option) {
                         .type = range_option,
                         .name = "Transmit Absolute Interrupt Delay",
                         .err  = "using default of " __MODULE_STRING(DEFAULT_TADV),
@@ -417,7 +423,7 @@ void __devinit e1000_check_options(struct e1000_adapter *adapter)
                 }
         }
         { /* Receive Interrupt Delay */
-                struct e1000_option opt = {
+                opt = (struct e1000_option) {
                         .type = range_option,
                         .name = "Receive Interrupt Delay",
                         .err  = "using default of " __MODULE_STRING(DEFAULT_RDTR),
@@ -435,7 +441,7 @@ void __devinit e1000_check_options(struct e1000_adapter *adapter)
                 }
         }
         { /* Receive Absolute Interrupt Delay */
-                struct e1000_option opt = {
+                opt = (struct e1000_option) {
                         .type = range_option,
                         .name = "Receive Absolute Interrupt Delay",
                         .err  = "using default of " __MODULE_STRING(DEFAULT_RADV),
@@ -453,7 +459,7 @@ void __devinit e1000_check_options(struct e1000_adapter *adapter)
                 }
         }
         { /* Interrupt Throttling Rate */
-                struct e1000_option opt = {
+                opt = (struct e1000_option) {
                         .type = range_option,
                         .name = "Interrupt Throttling Rate (ints/sec)",
                         .err  = "using default of " __MODULE_STRING(DEFAULT_ITR),
@@ -497,7 +503,7 @@ void __devinit e1000_check_options(struct e1000_adapter *adapter)
                 }
         }
         { /* Smart Power Down */
-                struct e1000_option opt = {
+                opt = (struct e1000_option) {
                         .type = enable_option,
                         .name = "PHY Smart Power Down",
                         .err  = "defaulting to Disabled",
@@ -513,7 +519,7 @@ void __devinit e1000_check_options(struct e1000_adapter *adapter)
                 }
         }
         { /* Kumeran Lock Loss Workaround */
-                struct e1000_option opt = {
+                opt = (struct e1000_option) {
                         .type = enable_option,
                         .name = "Kumeran Lock Loss Workaround",
                         .err  = "defaulting to Enabled",
@@ -578,16 +584,18 @@ static void __devinit e1000_check_fiber_options(struct e1000_adapter *adapter)
 
 static void __devinit e1000_check_copper_options(struct e1000_adapter *adapter)
 {
+        struct e1000_option opt;
         unsigned int speed, dplx, an;
         int bd = adapter->bd_number;
 
         { /* Speed */
-                struct e1000_opt_list speed_list[] = {{          0, "" },
-                                                      {   SPEED_10, "" },
-                                                      {  SPEED_100, "" },
-                                                      { SPEED_1000, "" }};
+                static const struct e1000_opt_list speed_list[] = {
+                        {          0, "" },
+                        {   SPEED_10, "" },
+                        {  SPEED_100, "" },
+                        { SPEED_1000, "" }};
 
-                struct e1000_option opt = {
+                opt = (struct e1000_option) {
                         .type = list_option,
                         .name = "Speed",
                         .err  = "parameter ignored",
@@ -604,11 +612,12 @@ static void __devinit e1000_check_copper_options(struct e1000_adapter *adapter)
                 }
         }
         { /* Duplex */
-                struct e1000_opt_list dplx_list[] = {{           0, "" },
-                                                     { HALF_DUPLEX, "" },
-                                                     { FULL_DUPLEX, "" }};
+                static const struct e1000_opt_list dplx_list[] = {
+                        {           0, "" },
+                        { HALF_DUPLEX, "" },
+                        { FULL_DUPLEX, "" }};
 
-                struct e1000_option opt = {
+                opt = (struct e1000_option) {
                         .type = list_option,
                         .name = "Duplex",
                         .err  = "parameter ignored",
@@ -637,7 +646,7 @@ static void __devinit e1000_check_copper_options(struct e1000_adapter *adapter)
                        "parameter ignored\n");
                 adapter->hw.autoneg_advertised = AUTONEG_ADV_DEFAULT;
         } else { /* Autoneg */
-                struct e1000_opt_list an_list[] =
+                static const struct e1000_opt_list an_list[] =
                         #define AA "AutoNeg advertising "
                         {{ 0x01, AA "10/HD" },
                          { 0x02, AA "10/FD" },
@@ -671,7 +680,7 @@ static void __devinit e1000_check_copper_options(struct e1000_adapter *adapter)
                          { 0x2e, AA "1000/FD, 100/FD, 100/HD, 10/FD" },
                          { 0x2f, AA "1000/FD, 100/FD, 100/HD, 10/FD, 10/HD" }};
 
-                struct e1000_option opt = {
+                opt = (struct e1000_option) {
                         .type = list_option,
                         .name = "AutoNeg",
                         .err  = "parameter ignored",
diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
index db85f1fb131e..711b3004b3e6 100644
--- a/drivers/s390/block/dcssblk.c
+++ b/drivers/s390/block/dcssblk.c
@@ -384,9 +384,10 @@ dcssblk_add_store(struct device *dev, struct device_attribute *attr, const char
          * get minor, add to list
          */
         down_write(&dcssblk_devices_sem);
-        if (dcssblk_get_segment_by_name(local_buf)) {
+        if (dcssblk_get_device_by_name(local_buf)) {
+                up_write(&dcssblk_devices_sem);
                 rc = -EEXIST;
-                goto release_gd;
+                goto unload_seg;
         }
         rc = dcssblk_assign_free_minor(dev_info);
         if (rc) {
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 3d36270a8b4d..661f9f21650a 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -217,6 +217,18 @@ static int sg_last_dev(void);
 #define SZ_SG_IOVEC sizeof(sg_iovec_t)
 #define SZ_SG_REQ_INFO sizeof(sg_req_info_t)
 
+static int sg_allow_access(struct file *filp, unsigned char *cmd)
+{
+        struct sg_fd *sfp = (struct sg_fd *)filp->private_data;
+        struct request_queue *q = sfp->parentdp->device->request_queue;
+
+        if (sfp->parentdp->device->type == TYPE_SCANNER)
+                return 0;
+
+        return blk_verify_command(&q->cmd_filter,
+                                  cmd, filp->f_mode & FMODE_WRITE);
+}
+
 static int
 sg_open(struct inode *inode, struct file *filp)
 {
@@ -689,7 +701,7 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
                 sg_remove_request(sfp, srp);
                 return -EFAULT;
         }
-        if (read_only && !blk_verify_command(file, cmnd)) {
+        if (read_only && sg_allow_access(file, cmnd)) {
                 sg_remove_request(sfp, srp);
                 return -EPERM;
         }
@@ -793,6 +805,7 @@ sg_ioctl(struct inode *inode, struct file *filp,
 
         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
                 return -ENXIO;
+
         SCSI_LOG_TIMEOUT(3, printk("sg_ioctl: %s, cmd=0x%x\n",
                                    sdp->disk->disk_name, (int) cmd_in));
         read_only = (O_RDWR != (filp->f_flags & O_ACCMODE));
@@ -1061,7 +1074,7 @@ sg_ioctl(struct inode *inode, struct file *filp,
 
                         if (copy_from_user(&opcode, siocp->data, 1))
                                 return -EFAULT;
-                        if (!blk_verify_command(filp, &opcode))
+                        if (sg_allow_access(filp, &opcode))
                                 return -EPERM;
                 }
                 return sg_scsi_ioctl(filp, sdp->device->request_queue, NULL, p);