90 files changed, 9582 insertions, 3796 deletions

diff --git a/drivers/input/keyboard/atakbd.c b/drivers/input/keyboard/atakbd.c
index ded1d6ac6ff3..f948d3a14a93 100644
--- a/drivers/input/keyboard/atakbd.c
+++ b/drivers/input/keyboard/atakbd.c
@@ -55,7 +55,140 @@ MODULE_AUTHOR("Michael Schmitz <schmitz@biophys.uni-duesseldorf.de>");
 MODULE_DESCRIPTION("Atari keyboard driver");
 MODULE_LICENSE("GPL");
 
-static unsigned char atakbd_keycode[0x72];
+/*
+ 0x47: KP_7     71
+ 0x48: KP_8     72
+ 0x49: KP_9     73
+ 0x62: KP_/     98
+ 0x4b: KP_4     75
+ 0x4c: KP_5     76
+ 0x4d: KP_6     77
+ 0x37: KP_*     55
+ 0x4f: KP_1     79
+ 0x50: KP_2     80
+ 0x51: KP_3     81
+ 0x4a: KP_-     74
+ 0x52: KP_0     82
+ 0x53: KP_.     83
+ 0x4e: KP_+     78
+
+ 0x67: Up       103
+ 0x6c: Down     108
+ 0x69: Left     105
+ 0x6a: Right    106
+ */
+
+
+static unsigned char atakbd_keycode[0x72] = {   /* American layout */
+        [0]      = KEY_GRAVE,
+        [1]      = KEY_ESC,
+        [2]      = KEY_1,
+        [3]      = KEY_2,
+        [4]      = KEY_3,
+        [5]      = KEY_4,
+        [6]      = KEY_5,
+        [7]      = KEY_6,
+        [8]      = KEY_7,
+        [9]      = KEY_8,
+        [10]     = KEY_9,
+        [11]     = KEY_0,
+        [12]     = KEY_MINUS,
+        [13]     = KEY_EQUAL,
+        [14]     = KEY_BACKSPACE,
+        [15]     = KEY_TAB,
+        [16]     = KEY_Q,
+        [17]     = KEY_W,
+        [18]     = KEY_E,
+        [19]     = KEY_R,
+        [20]     = KEY_T,
+        [21]     = KEY_Y,
+        [22]     = KEY_U,
+        [23]     = KEY_I,
+        [24]     = KEY_O,
+        [25]     = KEY_P,
+        [26]     = KEY_LEFTBRACE,
+        [27]     = KEY_RIGHTBRACE,
+        [28]     = KEY_ENTER,
+        [29]     = KEY_LEFTCTRL,
+        [30]     = KEY_A,
+        [31]     = KEY_S,
+        [32]     = KEY_D,
+        [33]     = KEY_F,
+        [34]     = KEY_G,
+        [35]     = KEY_H,
+        [36]     = KEY_J,
+        [37]     = KEY_K,
+        [38]     = KEY_L,
+        [39]     = KEY_SEMICOLON,
+        [40]     = KEY_APOSTROPHE,
+        [41]     = KEY_BACKSLASH,       /* FIXME, '#' */
+        [42]     = KEY_LEFTSHIFT,
+        [43]     = KEY_GRAVE,           /* FIXME: '~' */
+        [44]     = KEY_Z,
+        [45]     = KEY_X,
+        [46]     = KEY_C,
+        [47]     = KEY_V,
+        [48]     = KEY_B,
+        [49]     = KEY_N,
+        [50]     = KEY_M,
+        [51]     = KEY_COMMA,
+        [52]     = KEY_DOT,
+        [53]     = KEY_SLASH,
+        [54]     = KEY_RIGHTSHIFT,
+        [55]     = KEY_KPASTERISK,
+        [56]     = KEY_LEFTALT,
+        [57]     = KEY_SPACE,
+        [58]     = KEY_CAPSLOCK,
+        [59]     = KEY_F1,
+        [60]     = KEY_F2,
+        [61]     = KEY_F3,
+        [62]     = KEY_F4,
+        [63]     = KEY_F5,
+        [64]     = KEY_F6,
+        [65]     = KEY_F7,
+        [66]     = KEY_F8,
+        [67]     = KEY_F9,
+        [68]     = KEY_F10,
+        [69]     = KEY_ESC,
+        [70]     = KEY_DELETE,
+        [71]     = KEY_KP7,
+        [72]     = KEY_KP8,
+        [73]     = KEY_KP9,
+        [74]     = KEY_KPMINUS,
+        [75]     = KEY_KP4,
+        [76]     = KEY_KP5,
+        [77]     = KEY_KP6,
+        [78]     = KEY_KPPLUS,
+        [79]     = KEY_KP1,
+        [80]     = KEY_KP2,
+        [81]     = KEY_KP3,
+        [82]     = KEY_KP0,
+        [83]     = KEY_KPDOT,
+        [90]     = KEY_KPLEFTPAREN,
+        [91]     = KEY_KPRIGHTPAREN,
+        [92]     = KEY_KPASTERISK,      /* FIXME */
+        [93]     = KEY_KPASTERISK,
+        [94]     = KEY_KPPLUS,
+        [95]     = KEY_HELP,
+        [96]     = KEY_BACKSLASH,       /* FIXME: '<' */
+        [97]     = KEY_KPASTERISK,      /* FIXME */
+        [98]     = KEY_KPSLASH,
+        [99]     = KEY_KPLEFTPAREN,
+        [100]    = KEY_KPRIGHTPAREN,
+        [101]    = KEY_KPSLASH,
+        [102]    = KEY_KPASTERISK,
+        [103]    = KEY_UP,
+        [104]    = KEY_KPASTERISK,      /* FIXME */
+        [105]    = KEY_LEFT,
+        [106]    = KEY_RIGHT,
+        [107]    = KEY_KPASTERISK,      /* FIXME */
+        [108]    = KEY_DOWN,
+        [109]    = KEY_KPASTERISK,      /* FIXME */
+        [110]    = KEY_KPASTERISK,      /* FIXME */
+        [111]    = KEY_KPASTERISK,      /* FIXME */
+        [112]    = KEY_KPASTERISK,      /* FIXME */
+        [113]    = KEY_KPASTERISK       /* FIXME */
+};
 
 static struct input_dev *atakbd_dev;
 
@@ -86,21 +219,20 @@ static int __init atakbd_init(void)
 {
         int i;
 
-        if (!ATARIHW_PRESENT(ST_MFP))
+        if (!MACH_IS_ATARI || !ATARIHW_PRESENT(ST_MFP))
                 return -EIO;
 
-        // TODO: request_mem_region if not done in arch code
-
-        if (!(atakbd_dev = input_allocate_device()))
-                return -ENOMEM;
-
         // need to init core driver if not already done so
         if (atari_keyb_init())
                 return -ENODEV;
 
+        atakbd_dev = input_allocate_device();
+        if (!atakbd_dev)
+                return -ENOMEM;
+
         atakbd_dev->name = "Atari Keyboard";
         atakbd_dev->phys = "atakbd/input0";
-        atakbd_dev->id.bustype = BUS_ATARI;
+        atakbd_dev->id.bustype = BUS_HOST;
         atakbd_dev->id.vendor = 0x0001;
         atakbd_dev->id.product = 0x0001;
         atakbd_dev->id.version = 0x0100;
@@ -111,16 +243,17 @@ static int __init atakbd_init(void)
         atakbd_dev->keycodemax = ARRAY_SIZE(atakbd_keycode);
 
         for (i = 1; i < 0x72; i++) {
-                atakbd_keycode[i] = i;
                 set_bit(atakbd_keycode[i], atakbd_dev->keybit);
         }
 
-        input_register_device(atakbd_dev);
+        /* error check */
+        if (input_register_device(atakbd_dev)) {
+                input_free_device(atakbd_dev);
+                return -ENOMEM;
+        }
 
         atari_input_keyboard_interrupt_hook = atakbd_interrupt;
 
-        printk(KERN_INFO "input: %s at IKBD ACIA\n", atakbd_dev->name);
-
         return 0;
 }
 
diff --git a/drivers/input/mouse/atarimouse.c b/drivers/input/mouse/atarimouse.c
index 43ab6566fb65..c8c7244b48a1 100644
--- a/drivers/input/mouse/atarimouse.c
+++ b/drivers/input/mouse/atarimouse.c
@@ -73,14 +73,11 @@ static void atamouse_interrupt(char *buf)
 {
         int buttons, dx, dy;
 
-/*      ikbd_mouse_disable(); */
-
         buttons = (buf[0] & 1) | ((buf[0] & 2) << 1);
 #ifdef FIXED_ATARI_JOYSTICK
         buttons |= atari_mouse_buttons & 2;
         atari_mouse_buttons = buttons;
 #endif
-/*      ikbd_mouse_rel_pos(); */
 
         /* only relative events get here */
         dx =  buf[1];
@@ -126,15 +123,16 @@ static int __init atamouse_init(void)
         if (!MACH_IS_ATARI || !ATARIHW_PRESENT(ST_MFP))
                 return -ENODEV;
 
-        if (!(atamouse_dev = input_allocate_device()))
-                return -ENOMEM;
-
         if (!(atari_keyb_init()))
                 return -ENODEV;
 
+        atamouse_dev = input_allocate_device();
+        if (!atamouse_dev)
+                return -ENOMEM;
+
         atamouse_dev->name = "Atari mouse";
         atamouse_dev->phys = "atamouse/input0";
-        atamouse_dev->id.bustype = BUS_ATARI;
+        atamouse_dev->id.bustype = BUS_HOST;
         atamouse_dev->id.vendor = 0x0001;
         atamouse_dev->id.product = 0x0002;
         atamouse_dev->id.version = 0x0100;
@@ -145,9 +143,11 @@ static int __init atamouse_init(void)
         atamouse_dev->open = atamouse_open;
         atamouse_dev->close = atamouse_close;
 
-        input_register_device(atamouse_dev);
+        if (input_register_device(atamouse_dev)) {
+                input_free_device(atamouse_dev);
+                return -ENOMEM;
+        }
 
-        printk(KERN_INFO "input: %s at keyboard ACIA\n", atamouse_dev->name);
         return 0;
 }
 
diff --git a/drivers/kvm/Kconfig b/drivers/kvm/Kconfig
index 0a419a0de603..8749fa4ffcee 100644
--- a/drivers/kvm/Kconfig
+++ b/drivers/kvm/Kconfig
@@ -17,6 +17,7 @@ if VIRTUALIZATION
 config KVM
         tristate "Kernel-based Virtual Machine (KVM) support"
         depends on X86 && EXPERIMENTAL
+        select PREEMPT_NOTIFIERS
         select ANON_INODES
         ---help---
           Support hosting fully virtualized guest machines using hardware
diff --git a/drivers/kvm/Makefile b/drivers/kvm/Makefile
index c0a789fa9d65..e5a8f4d3e973 100644
--- a/drivers/kvm/Makefile
+++ b/drivers/kvm/Makefile
@@ -2,7 +2,7 @@
 # Makefile for Kernel-based Virtual Machine module
 #
 
-kvm-objs := kvm_main.o mmu.o x86_emulate.o
+kvm-objs := kvm_main.o mmu.o x86_emulate.o i8259.o irq.o lapic.o ioapic.o
 obj-$(CONFIG_KVM) += kvm.o
 kvm-intel-objs = vmx.o
 obj-$(CONFIG_KVM_INTEL) += kvm-intel.o
diff --git a/drivers/kvm/i8259.c b/drivers/kvm/i8259.c
new file mode 100644
index 000000000000..a679157bc599
--- /dev/null
+++ b/drivers/kvm/i8259.c
@@ -0,0 +1,450 @@
+/*
+ * 8259 interrupt controller emulation
+ *
+ * Copyright (c) 2003-2004 Fabrice Bellard
+ * Copyright (c) 2007 Intel Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ * Authors:
+ *   Yaozu (Eddie) Dong <Eddie.dong@intel.com>
+ *   Port from Qemu.
+ */
+#include <linux/mm.h>
+#include "irq.h"
+
+/*
+ * set irq level. If an edge is detected, then the IRR is set to 1
+ */
+static inline void pic_set_irq1(struct kvm_kpic_state *s, int irq, int level)
+{
+        int mask;
+        mask = 1 << irq;
+        if (s->elcr & mask)     /* level triggered */
+                if (level) {
+                        s->irr |= mask;
+                        s->last_irr |= mask;
+                } else {
+                        s->irr &= ~mask;
+                        s->last_irr &= ~mask;
+                }
+        else    /* edge triggered */
+                if (level) {
+                        if ((s->last_irr & mask) == 0)
+                                s->irr |= mask;
+                        s->last_irr |= mask;
+                } else
+                        s->last_irr &= ~mask;
+}
+
+/*
+ * return the highest priority found in mask (highest = smallest
+ * number). Return 8 if no irq
+ */
+static inline int get_priority(struct kvm_kpic_state *s, int mask)
+{
+        int priority;
+        if (mask == 0)
+                return 8;
+        priority = 0;
+        while ((mask & (1 << ((priority + s->priority_add) & 7))) == 0)
+                priority++;
+        return priority;
+}
+
+/*
+ * return the pic wanted interrupt. return -1 if none
+ */
+static int pic_get_irq(struct kvm_kpic_state *s)
+{
+        int mask, cur_priority, priority;
+
+        mask = s->irr & ~s->imr;
+        priority = get_priority(s, mask);
+        if (priority == 8)
+                return -1;
+        /*
+         * compute current priority. If special fully nested mode on the
+         * master, the IRQ coming from the slave is not taken into account
+         * for the priority computation.
+         */
+        mask = s->isr;
+        if (s->special_fully_nested_mode && s == &s->pics_state->pics[0])
+                mask &= ~(1 << 2);
+        cur_priority = get_priority(s, mask);
+        if (priority < cur_priority)
+                /*
+                 * higher priority found: an irq should be generated
+                 */
+                return (priority + s->priority_add) & 7;
+        else
+                return -1;
+}
+
+/*
+ * raise irq to CPU if necessary. must be called every time the active
+ * irq may change
+ */
+static void pic_update_irq(struct kvm_pic *s)
+{
+        int irq2, irq;
+
+        irq2 = pic_get_irq(&s->pics[1]);
+        if (irq2 >= 0) {
+                /*
+                 * if irq request by slave pic, signal master PIC
+                 */
+                pic_set_irq1(&s->pics[0], 2, 1);
+                pic_set_irq1(&s->pics[0], 2, 0);
+        }
+        irq = pic_get_irq(&s->pics[0]);
+        if (irq >= 0)
+                s->irq_request(s->irq_request_opaque, 1);
+        else
+                s->irq_request(s->irq_request_opaque, 0);
+}
+
+void kvm_pic_update_irq(struct kvm_pic *s)
+{
+        pic_update_irq(s);
+}
+
+void kvm_pic_set_irq(void *opaque, int irq, int level)
+{
+        struct kvm_pic *s = opaque;
+
+        pic_set_irq1(&s->pics[irq >> 3], irq & 7, level);
+        pic_update_irq(s);
+}
+
+/*
+ * acknowledge interrupt 'irq'
+ */
+static inline void pic_intack(struct kvm_kpic_state *s, int irq)
+{
+        if (s->auto_eoi) {
+                if (s->rotate_on_auto_eoi)
+                        s->priority_add = (irq + 1) & 7;
+        } else
+                s->isr |= (1 << irq);
+        /*
+         * We don't clear a level sensitive interrupt here
+         */
+        if (!(s->elcr & (1 << irq)))
+                s->irr &= ~(1 << irq);
+}
+
+int kvm_pic_read_irq(struct kvm_pic *s)
+{
+        int irq, irq2, intno;
+
+        irq = pic_get_irq(&s->pics[0]);
+        if (irq >= 0) {
+                pic_intack(&s->pics[0], irq);
+                if (irq == 2) {
+                        irq2 = pic_get_irq(&s->pics[1]);
+                        if (irq2 >= 0)
+                                pic_intack(&s->pics[1], irq2);
+                        else
+                                /*
+                                 * spurious IRQ on slave controller
+                                 */
+                                irq2 = 7;
+                        intno = s->pics[1].irq_base + irq2;
+                        irq = irq2 + 8;
+                } else
+                        intno = s->pics[0].irq_base + irq;
+        } else {
+                /*
+                 * spurious IRQ on host controller
+                 */
+                irq = 7;
+                intno = s->pics[0].irq_base + irq;
+        }
+        pic_update_irq(s);
+
+        return intno;
+}
+
+static void pic_reset(void *opaque)
+{
+        struct kvm_kpic_state *s = opaque;
+
+        s->last_irr = 0;
+        s->irr = 0;
+        s->imr = 0;
+        s->isr = 0;
+        s->priority_add = 0;
+        s->irq_base = 0;
+        s->read_reg_select = 0;
+        s->poll = 0;
+        s->special_mask = 0;
+        s->init_state = 0;
+        s->auto_eoi = 0;
+        s->rotate_on_auto_eoi = 0;
+        s->special_fully_nested_mode = 0;
+        s->init4 = 0;
+}
+
+static void pic_ioport_write(void *opaque, u32 addr, u32 val)
+{
+        struct kvm_kpic_state *s = opaque;
+        int priority, cmd, irq;
+
+        addr &= 1;
+        if (addr == 0) {
+                if (val & 0x10) {
+                        pic_reset(s);   /* init */
+                        /*
+                         * deassert a pending interrupt
+                         */
+                        s->pics_state->irq_request(s->pics_state->
+                                                   irq_request_opaque, 0);
+                        s->init_state = 1;
+                        s->init4 = val & 1;
+                        if (val & 0x02)
+                                printk(KERN_ERR "single mode not supported");
+                        if (val & 0x08)
+                                printk(KERN_ERR
+                                       "level sensitive irq not supported");
+                } else if (val & 0x08) {
+                        if (val & 0x04)
+                                s->poll = 1;
+                        if (val & 0x02)
+                                s->read_reg_select = val & 1;
+                        if (val & 0x40)
+                                s->special_mask = (val >> 5) & 1;
+                } else {
+                        cmd = val >> 5;
+                        switch (cmd) {
+                        case 0:
+                        case 4:
+                                s->rotate_on_auto_eoi = cmd >> 2;
+                                break;
+                        case 1: /* end of interrupt */
+                        case 5:
+                                priority = get_priority(s, s->isr);
+                                if (priority != 8) {
+                                        irq = (priority + s->priority_add) & 7;
+                                        s->isr &= ~(1 << irq);
+                                        if (cmd == 5)
+                                                s->priority_add = (irq + 1) & 7;
+                                        pic_update_irq(s->pics_state);
+                                }
+                                break;
+                        case 3:
+                                irq = val & 7;
+                                s->isr &= ~(1 << irq);
+                                pic_update_irq(s->pics_state);
+                                break;
+                        case 6:
+                                s->priority_add = (val + 1) & 7;
+                                pic_update_irq(s->pics_state);
+                                break;
+                        case 7:
+                                irq = val & 7;
+                                s->isr &= ~(1 << irq);
+                                s->priority_add = (irq + 1) & 7;
+                                pic_update_irq(s->pics_state);
+                                break;
+                        default:
+                                break;  /* no operation */
+                        }
+                }
+        } else
+                switch (s->init_state) {
+                case 0:         /* normal mode */
+                        s->imr = val;
+                        pic_update_irq(s->pics_state);
+                        break;
+                case 1:
+                        s->irq_base = val & 0xf8;
+                        s->init_state = 2;
+                        break;
+                case 2:
+                        if (s->init4)
+                                s->init_state = 3;
+                        else
+                                s->init_state = 0;
+                        break;
+                case 3:
+                        s->special_fully_nested_mode = (val >> 4) & 1;
+                        s->auto_eoi = (val >> 1) & 1;
+                        s->init_state = 0;
+                        break;
+                }
+}
+
+static u32 pic_poll_read(struct kvm_kpic_state *s, u32 addr1)
+{
+        int ret;
+
+        ret = pic_get_irq(s);
+        if (ret >= 0) {
+                if (addr1 >> 7) {
+                        s->pics_state->pics[0].isr &= ~(1 << 2);
+                        s->pics_state->pics[0].irr &= ~(1 << 2);
+                }
+                s->irr &= ~(1 << ret);
+                s->isr &= ~(1 << ret);
+                if (addr1 >> 7 || ret != 2)
+                        pic_update_irq(s->pics_state);
+        } else {
+                ret = 0x07;
+                pic_update_irq(s->pics_state);
+        }
+
+        return ret;
+}
+
+static u32 pic_ioport_read(void *opaque, u32 addr1)
+{
+        struct kvm_kpic_state *s = opaque;
+        unsigned int addr;
+        int ret;
+
+        addr = addr1;
+        addr &= 1;
+        if (s->poll) {
+                ret = pic_poll_read(s, addr1);
+                s->poll = 0;
+        } else
+                if (addr == 0)
+                        if (s->read_reg_select)
+                                ret = s->isr;
+                        else
+                                ret = s->irr;
+                else
+                        ret = s->imr;
+        return ret;
+}
+
+static void elcr_ioport_write(void *opaque, u32 addr, u32 val)
+{
+        struct kvm_kpic_state *s = opaque;
+        s->elcr = val & s->elcr_mask;
+}
+
+static u32 elcr_ioport_read(void *opaque, u32 addr1)
+{
+        struct kvm_kpic_state *s = opaque;
+        return s->elcr;
+}
+
+static int picdev_in_range(struct kvm_io_device *this, gpa_t addr)
+{
+        switch (addr) {
+        case 0x20:
+        case 0x21:
+        case 0xa0:
+        case 0xa1:
+        case 0x4d0:
+        case 0x4d1:
+                return 1;
+        default:
+                return 0;
+        }
+}
+
+static void picdev_write(struct kvm_io_device *this,
+                         gpa_t addr, int len, const void *val)
+{
+        struct kvm_pic *s = this->private;
+        unsigned char data = *(unsigned char *)val;
+
+        if (len != 1) {
+                if (printk_ratelimit())
+                        printk(KERN_ERR "PIC: non byte write\n");
+                return;
+        }
+        switch (addr) {
+        case 0x20:
+        case 0x21:
+        case 0xa0:
+        case 0xa1:
+                pic_ioport_write(&s->pics[addr >> 7], addr, data);
+                break;
+        case 0x4d0:
+        case 0x4d1:
+                elcr_ioport_write(&s->pics[addr & 1], addr, data);
+                break;
+        }
+}
+
+static void picdev_read(struct kvm_io_device *this,
+                        gpa_t addr, int len, void *val)
+{
+        struct kvm_pic *s = this->private;
+        unsigned char data = 0;
+
+        if (len != 1) {
+                if (printk_ratelimit())
+                        printk(KERN_ERR "PIC: non byte read\n");
+                return;
+        }
+        switch (addr) {
+        case 0x20:
+        case 0x21:
+        case 0xa0:
+        case 0xa1:
+                data = pic_ioport_read(&s->pics[addr >> 7], addr);
+                break;
+        case 0x4d0:
+        case 0x4d1:
+                data = elcr_ioport_read(&s->pics[addr & 1], addr);
+                break;
+        }
+        *(unsigned char *)val = data;
+}
+
+/*
+ * callback when PIC0 irq status changed
+ */
+static void pic_irq_request(void *opaque, int level)
+{
+        struct kvm *kvm = opaque;
+        struct kvm_vcpu *vcpu = kvm->vcpus[0];
+
+        pic_irqchip(kvm)->output = level;
+        if (vcpu)
+                kvm_vcpu_kick(vcpu);
+}
+
+struct kvm_pic *kvm_create_pic(struct kvm *kvm)
+{
+        struct kvm_pic *s;
+        s = kzalloc(sizeof(struct kvm_pic), GFP_KERNEL);
+        if (!s)
+                return NULL;
+        s->pics[0].elcr_mask = 0xf8;
+        s->pics[1].elcr_mask = 0xde;
+        s->irq_request = pic_irq_request;
+        s->irq_request_opaque = kvm;
+        s->pics[0].pics_state = s;
+        s->pics[1].pics_state = s;
+
+        /*
+         * Initialize PIO device
+         */
+        s->dev.read = picdev_read;
+        s->dev.write = picdev_write;
+        s->dev.in_range = picdev_in_range;
+        s->dev.private = s;
+        kvm_io_bus_register_dev(&kvm->pio_bus, &s->dev);
+        return s;
+}
diff --git a/drivers/kvm/ioapic.c b/drivers/kvm/ioapic.c
new file mode 100644
index 000000000000..c7992e667fdb
--- /dev/null
+++ b/drivers/kvm/ioapic.c
@@ -0,0 +1,388 @@
+/*
+ *  Copyright (C) 2001  MandrakeSoft S.A.
+ *
+ *    MandrakeSoft S.A.
+ *    43, rue d'Aboukir
+ *    75002 Paris - France
+ *    http://www.linux-mandrake.com/
+ *    http://www.mandrakesoft.com/
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+ *
+ *  Yunhong Jiang <yunhong.jiang@intel.com>
+ *  Yaozu (Eddie) Dong <eddie.dong@intel.com>
+ *  Based on Xen 3.1 code.
+ */
+
+#include "kvm.h"
+#include <linux/kvm.h>
+#include <linux/mm.h>
+#include <linux/highmem.h>
+#include <linux/smp.h>
+#include <linux/hrtimer.h>
+#include <linux/io.h>
+#include <asm/processor.h>
+#include <asm/msr.h>
+#include <asm/page.h>
+#include <asm/current.h>
+#include <asm/apicdef.h>
+#include <asm/io_apic.h>
+#include "irq.h"
+/* #define ioapic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
+#define ioapic_debug(fmt, arg...)
+static void ioapic_deliver(struct kvm_ioapic *vioapic, int irq);
+
+static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
+                                          unsigned long addr,
+                                          unsigned long length)
+{
+        unsigned long result = 0;
+
+        switch (ioapic->ioregsel) {
+        case IOAPIC_REG_VERSION:
+                result = ((((IOAPIC_NUM_PINS - 1) & 0xff) << 16)
+                          | (IOAPIC_VERSION_ID & 0xff));
+                break;
+
+        case IOAPIC_REG_APIC_ID:
+        case IOAPIC_REG_ARB_ID:
+                result = ((ioapic->id & 0xf) << 24);
+                break;
+
+        default:
+                {
+                        u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
+                        u64 redir_content;
+
+                        ASSERT(redir_index < IOAPIC_NUM_PINS);
+
+                        redir_content = ioapic->redirtbl[redir_index].bits;
+                        result = (ioapic->ioregsel & 0x1) ?
+                            (redir_content >> 32) & 0xffffffff :
+                            redir_content & 0xffffffff;
+                        break;
+                }
+        }
+
+        return result;
+}
+
+static void ioapic_service(struct kvm_ioapic *ioapic, unsigned int idx)
+{
+        union ioapic_redir_entry *pent;
+
+        pent = &ioapic->redirtbl[idx];
+
+        if (!pent->fields.mask) {
+                ioapic_deliver(ioapic, idx);
+                if (pent->fields.trig_mode == IOAPIC_LEVEL_TRIG)
+                        pent->fields.remote_irr = 1;
+        }
+        if (!pent->fields.trig_mode)
+                ioapic->irr &= ~(1 << idx);
+}
+
+static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
+{
+        unsigned index;
+
+        switch (ioapic->ioregsel) {
+        case IOAPIC_REG_VERSION:
+                /* Writes are ignored. */
+                break;
+
+        case IOAPIC_REG_APIC_ID:
+                ioapic->id = (val >> 24) & 0xf;
+                break;
+
+        case IOAPIC_REG_ARB_ID:
+                break;
+
+        default:
+                index = (ioapic->ioregsel - 0x10) >> 1;
+
+                ioapic_debug("change redir index %x val %x", index, val);
+                if (index >= IOAPIC_NUM_PINS)
+                        return;
+                if (ioapic->ioregsel & 1) {
+                        ioapic->redirtbl[index].bits &= 0xffffffff;
+                        ioapic->redirtbl[index].bits |= (u64) val << 32;
+                } else {
+                        ioapic->redirtbl[index].bits &= ~0xffffffffULL;
+                        ioapic->redirtbl[index].bits |= (u32) val;
+                        ioapic->redirtbl[index].fields.remote_irr = 0;
+                }
+                if (ioapic->irr & (1 << index))
+                        ioapic_service(ioapic, index);
+                break;
+        }
+}
+
+static void ioapic_inj_irq(struct kvm_ioapic *ioapic,
+                           struct kvm_lapic *target,
+                           u8 vector, u8 trig_mode, u8 delivery_mode)
+{
+        ioapic_debug("irq %d trig %d deliv %d", vector, trig_mode,
+                     delivery_mode);
+
+        ASSERT((delivery_mode == dest_Fixed) ||
+               (delivery_mode == dest_LowestPrio));
+
+        kvm_apic_set_irq(target, vector, trig_mode);
+}
+
+static u32 ioapic_get_delivery_bitmask(struct kvm_ioapic *ioapic, u8 dest,
+                                       u8 dest_mode)
+{
+        u32 mask = 0;
+        int i;
+        struct kvm *kvm = ioapic->kvm;
+        struct kvm_vcpu *vcpu;
+
+        ioapic_debug("dest %d dest_mode %d", dest, dest_mode);
+
+        if (dest_mode == 0) {   /* Physical mode. */
+                if (dest == 0xFF) {     /* Broadcast. */
+                        for (i = 0; i < KVM_MAX_VCPUS; ++i)
+                                if (kvm->vcpus[i] && kvm->vcpus[i]->apic)
+                                        mask |= 1 << i;
+                        return mask;
+                }
+                for (i = 0; i < KVM_MAX_VCPUS; ++i) {
+                        vcpu = kvm->vcpus[i];
+                        if (!vcpu)
+                                continue;
+                        if (kvm_apic_match_physical_addr(vcpu->apic, dest)) {
+                                if (vcpu->apic)
+                                        mask = 1 << i;
+                                break;
+                        }
+                }
+        } else if (dest != 0)   /* Logical mode, MDA non-zero. */
+                for (i = 0; i < KVM_MAX_VCPUS; ++i) {
+                        vcpu = kvm->vcpus[i];
+                        if (!vcpu)
+                                continue;
+                        if (vcpu->apic &&
+                            kvm_apic_match_logical_addr(vcpu->apic, dest))
+                                mask |= 1 << vcpu->vcpu_id;
+                }
+        ioapic_debug("mask %x", mask);
+        return mask;
+}
+
+static void ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
+{
+        u8 dest = ioapic->redirtbl[irq].fields.dest_id;
+        u8 dest_mode = ioapic->redirtbl[irq].fields.dest_mode;
+        u8 delivery_mode = ioapic->redirtbl[irq].fields.delivery_mode;
+        u8 vector = ioapic->redirtbl[irq].fields.vector;
+        u8 trig_mode = ioapic->redirtbl[irq].fields.trig_mode;
+        u32 deliver_bitmask;
+        struct kvm_lapic *target;
+        struct kvm_vcpu *vcpu;
+        int vcpu_id;
+
+        ioapic_debug("dest=%x dest_mode=%x delivery_mode=%x "
+                     "vector=%x trig_mode=%x",
+                     dest, dest_mode, delivery_mode, vector, trig_mode);
+
+        deliver_bitmask = ioapic_get_delivery_bitmask(ioapic, dest, dest_mode);
+        if (!deliver_bitmask) {
+                ioapic_debug("no target on destination");
+                return;
+        }
+
+        switch (delivery_mode) {
+        case dest_LowestPrio:
+                target =
+                    kvm_apic_round_robin(ioapic->kvm, vector, deliver_bitmask);
+                if (target != NULL)
+                        ioapic_inj_irq(ioapic, target, vector,
+                                       trig_mode, delivery_mode);
+                else
+                        ioapic_debug("null round robin: "
+                                     "mask=%x vector=%x delivery_mode=%x",
+                                     deliver_bitmask, vector, dest_LowestPrio);
+                break;
+        case dest_Fixed:
+                for (vcpu_id = 0; deliver_bitmask != 0; vcpu_id++) {
+                        if (!(deliver_bitmask & (1 << vcpu_id)))
+                                continue;
+                        deliver_bitmask &= ~(1 << vcpu_id);
+                        vcpu = ioapic->kvm->vcpus[vcpu_id];
+                        if (vcpu) {
+                                target = vcpu->apic;
+                                ioapic_inj_irq(ioapic, target, vector,
+                                               trig_mode, delivery_mode);
+                        }
+                }
+                break;
+
+                /* TODO: NMI */
+        default:
+                printk(KERN_WARNING "Unsupported delivery mode %d\n",
+                       delivery_mode);
+                break;
+        }
+}
+
+void kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int level)
+{
+        u32 old_irr = ioapic->irr;
+        u32 mask = 1 << irq;
+        union ioapic_redir_entry entry;
+
+        if (irq >= 0 && irq < IOAPIC_NUM_PINS) {
+                entry = ioapic->redirtbl[irq];
+                level ^= entry.fields.polarity;
+                if (!level)
+                        ioapic->irr &= ~mask;
+                else {
+                        ioapic->irr |= mask;
+                        if ((!entry.fields.trig_mode && old_irr != ioapic->irr)
+                            || !entry.fields.remote_irr)
+                                ioapic_service(ioapic, irq);
+                }
+        }
+}
+
+static int get_eoi_gsi(struct kvm_ioapic *ioapic, int vector)
+{
+        int i;
+
+        for (i = 0; i < IOAPIC_NUM_PINS; i++)
+                if (ioapic->redirtbl[i].fields.vector == vector)
+                        return i;
+        return -1;
+}
+
+void kvm_ioapic_update_eoi(struct kvm *kvm, int vector)
+{
+        struct kvm_ioapic *ioapic = kvm->vioapic;
+        union ioapic_redir_entry *ent;
+        int gsi;
+
+        gsi = get_eoi_gsi(ioapic, vector);
+        if (gsi == -1) {
+                printk(KERN_WARNING "Can't find redir item for %d EOI\n",
+                       vector);
+                return;
+        }
+
+        ent = &ioapic->redirtbl[gsi];
+        ASSERT(ent->fields.trig_mode == IOAPIC_LEVEL_TRIG);
+
+        ent->fields.remote_irr = 0;
+        if (!ent->fields.mask && (ioapic->irr & (1 << gsi)))
+                ioapic_deliver(ioapic, gsi);
+}
+
+static int ioapic_in_range(struct kvm_io_device *this, gpa_t addr)
+{
+        struct kvm_ioapic *ioapic = (struct kvm_ioapic *)this->private;
+
+        return ((addr >= ioapic->base_address &&
+                 (addr < ioapic->base_address + IOAPIC_MEM_LENGTH)));
+}
+
+static void ioapic_mmio_read(struct kvm_io_device *this, gpa_t addr, int len,
+                             void *val)
+{
+        struct kvm_ioapic *ioapic = (struct kvm_ioapic *)this->private;
+        u32 result;
+
+        ioapic_debug("addr %lx", (unsigned long)addr);
+        ASSERT(!(addr & 0xf));  /* check alignment */
+
+        addr &= 0xff;
+        switch (addr) {
+        case IOAPIC_REG_SELECT:
+                result = ioapic->ioregsel;
+                break;
+
+        case IOAPIC_REG_WINDOW:
+                result = ioapic_read_indirect(ioapic, addr, len);
+                break;
+
+        default:
+                result = 0;
+                break;
+        }
+        switch (len) {
+        case 8:
+                *(u64 *) val = result;
+                break;
+        case 1:
+        case 2:
+        case 4:
+                memcpy(val, (char *)&result, len);
+                break;
+        default:
+                printk(KERN_WARNING "ioapic: wrong length %d\n", len);
+        }
+}
+
+static void ioapic_mmio_write(struct kvm_io_device *this, gpa_t addr, int len,
+                              const void *val)
+{
+        struct kvm_ioapic *ioapic = (struct kvm_ioapic *)this->private;
+        u32 data;
+
+        ioapic_debug("ioapic_mmio_write addr=%lx len=%d val=%p\n",
+                     addr, len, val);
+        ASSERT(!(addr & 0xf));  /* check alignment */
+        if (len == 4 || len == 8)
+                data = *(u32 *) val;
+        else {
+                printk(KERN_WARNING "ioapic: Unsupported size %d\n", len);
+                return;
+        }
+
+        addr &= 0xff;
+        switch (addr) {
+        case IOAPIC_REG_SELECT:
+                ioapic->ioregsel = data;
+                break;
+
+        case IOAPIC_REG_WINDOW:
+                ioapic_write_indirect(ioapic, data);
+                break;
+
+        default:
+                break;
+        }
+}
+
+int kvm_ioapic_init(struct kvm *kvm)
+{
+        struct kvm_ioapic *ioapic;
+        int i;
+
+        ioapic = kzalloc(sizeof(struct kvm_ioapic), GFP_KERNEL);
+        if (!ioapic)
+                return -ENOMEM;
+        kvm->vioapic = ioapic;
+        for (i = 0; i < IOAPIC_NUM_PINS; i++)
+                ioapic->redirtbl[i].fields.mask = 1;
+        ioapic->base_address = IOAPIC_DEFAULT_BASE_ADDRESS;
+        ioapic->dev.read = ioapic_mmio_read;
+        ioapic->dev.write = ioapic_mmio_write;
+        ioapic->dev.in_range = ioapic_in_range;
+        ioapic->dev.private = ioapic;
+        ioapic->kvm = kvm;
+        kvm_io_bus_register_dev(&kvm->mmio_bus, &ioapic->dev);
+        return 0;
+}
diff --git a/drivers/kvm/irq.c b/drivers/kvm/irq.c
new file mode 100644
index 000000000000..7628c7ff628f
--- /dev/null
+++ b/drivers/kvm/irq.c
@@ -0,0 +1,98 @@
+/*
+ * irq.c: API for in kernel interrupt controller
+ * Copyright (c) 2007, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307 USA.
+ * Authors:
+ *   Yaozu (Eddie) Dong <Eddie.dong@intel.com>
+ *
+ */
+
+#include <linux/module.h>
+
+#include "kvm.h"
+#include "irq.h"
+
+/*
+ * check if there is pending interrupt without
+ * intack.
+ */
+int kvm_cpu_has_interrupt(struct kvm_vcpu *v)
+{
+        struct kvm_pic *s;
+
+        if (kvm_apic_has_interrupt(v) == -1) {  /* LAPIC */
+                if (kvm_apic_accept_pic_intr(v)) {
+                        s = pic_irqchip(v->kvm);        /* PIC */
+                        return s->output;
+                } else
+                        return 0;
+        }
+        return 1;
+}
+EXPORT_SYMBOL_GPL(kvm_cpu_has_interrupt);
+
+/*
+ * Read pending interrupt vector and intack.
+ */
+int kvm_cpu_get_interrupt(struct kvm_vcpu *v)
+{
+        struct kvm_pic *s;
+        int vector;
+
+        vector = kvm_get_apic_interrupt(v);     /* APIC */
+        if (vector == -1) {
+                if (kvm_apic_accept_pic_intr(v)) {
+                        s = pic_irqchip(v->kvm);
+                        s->output = 0;          /* PIC */
+                        vector = kvm_pic_read_irq(s);
+                }
+        }
+        return vector;
+}
+EXPORT_SYMBOL_GPL(kvm_cpu_get_interrupt);
+
+static void vcpu_kick_intr(void *info)
+{
+#ifdef DEBUG
+        struct kvm_vcpu *vcpu = (struct kvm_vcpu *)info;
+        printk(KERN_DEBUG "vcpu_kick_intr %p \n", vcpu);
+#endif
+}
+
+void kvm_vcpu_kick(struct kvm_vcpu *vcpu)
+{
+        int ipi_pcpu = vcpu->cpu;
+
+        if (waitqueue_active(&vcpu->wq)) {
+                wake_up_interruptible(&vcpu->wq);
+                ++vcpu->stat.halt_wakeup;
+        }
+        if (vcpu->guest_mode)
+                smp_call_function_single(ipi_pcpu, vcpu_kick_intr, vcpu, 0, 0);
+}
+
+void kvm_inject_pending_timer_irqs(struct kvm_vcpu *vcpu)
+{
+        kvm_inject_apic_timer_irqs(vcpu);
+        /* TODO: PIT, RTC etc. */
+}
+EXPORT_SYMBOL_GPL(kvm_inject_pending_timer_irqs);
+
+void kvm_timer_intr_post(struct kvm_vcpu *vcpu, int vec)
+{
+        kvm_apic_timer_intr_post(vcpu, vec);
+        /* TODO: PIT, RTC etc. */
+}
+EXPORT_SYMBOL_GPL(kvm_timer_intr_post);
diff --git a/drivers/kvm/irq.h b/drivers/kvm/irq.h
new file mode 100644
index 000000000000..11fc014e2b30
--- /dev/null
+++ b/drivers/kvm/irq.h
@@ -0,0 +1,165 @@
+/*
+ * irq.h: in kernel interrupt controller related definitions
+ * Copyright (c) 2007, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307 USA.
+ * Authors:
+ *   Yaozu (Eddie) Dong <Eddie.dong@intel.com>
+ *
+ */
+
+#ifndef __IRQ_H
+#define __IRQ_H
+
+#include "kvm.h"
+
+typedef void irq_request_func(void *opaque, int level);
+
+struct kvm_kpic_state {
+        u8 last_irr;    /* edge detection */
+        u8 irr;         /* interrupt request register */
+        u8 imr;         /* interrupt mask register */
+        u8 isr;         /* interrupt service register */
+        u8 priority_add;        /* highest irq priority */
+        u8 irq_base;
+        u8 read_reg_select;
+        u8 poll;
+        u8 special_mask;
+        u8 init_state;
+        u8 auto_eoi;
+        u8 rotate_on_auto_eoi;
+        u8 special_fully_nested_mode;
+        u8 init4;               /* true if 4 byte init */
+        u8 elcr;                /* PIIX edge/trigger selection */
+        u8 elcr_mask;
+        struct kvm_pic *pics_state;
+};
+
+struct kvm_pic {
+        struct kvm_kpic_state pics[2]; /* 0 is master pic, 1 is slave pic */
+        irq_request_func *irq_request;
+        void *irq_request_opaque;
+        int output;             /* intr from master PIC */
+        struct kvm_io_device dev;
+};
+
+struct kvm_pic *kvm_create_pic(struct kvm *kvm);
+void kvm_pic_set_irq(void *opaque, int irq, int level);
+int kvm_pic_read_irq(struct kvm_pic *s);
+int kvm_cpu_get_interrupt(struct kvm_vcpu *v);
+int kvm_cpu_has_interrupt(struct kvm_vcpu *v);
+void kvm_pic_update_irq(struct kvm_pic *s);
+
+#define IOAPIC_NUM_PINS  KVM_IOAPIC_NUM_PINS
+#define IOAPIC_VERSION_ID 0x11  /* IOAPIC version */
+#define IOAPIC_EDGE_TRIG  0
+#define IOAPIC_LEVEL_TRIG 1
+
+#define IOAPIC_DEFAULT_BASE_ADDRESS  0xfec00000
+#define IOAPIC_MEM_LENGTH            0x100
+
+/* Direct registers. */
+#define IOAPIC_REG_SELECT  0x00
+#define IOAPIC_REG_WINDOW  0x10
+#define IOAPIC_REG_EOI     0x40 /* IA64 IOSAPIC only */
+
+/* Indirect registers. */
+#define IOAPIC_REG_APIC_ID 0x00 /* x86 IOAPIC only */
+#define IOAPIC_REG_VERSION 0x01
+#define IOAPIC_REG_ARB_ID  0x02 /* x86 IOAPIC only */
+
+struct kvm_ioapic {
+        u64 base_address;
+        u32 ioregsel;
+        u32 id;
+        u32 irr;
+        u32 pad;
+        union ioapic_redir_entry {
+                u64 bits;
+                struct {
+                        u8 vector;
+                        u8 delivery_mode:3;
+                        u8 dest_mode:1;
+                        u8 delivery_status:1;
+                        u8 polarity:1;
+                        u8 remote_irr:1;
+                        u8 trig_mode:1;
+                        u8 mask:1;
+                        u8 reserve:7;
+                        u8 reserved[4];
+                        u8 dest_id;
+                } fields;
+        } redirtbl[IOAPIC_NUM_PINS];
+        struct kvm_io_device dev;
+        struct kvm *kvm;
+};
+
+struct kvm_lapic {
+        unsigned long base_address;
+        struct kvm_io_device dev;
+        struct {
+                atomic_t pending;
+                s64 period;     /* unit: ns */
+                u32 divide_count;
+                ktime_t last_update;
+                struct hrtimer dev;
+        } timer;
+        struct kvm_vcpu *vcpu;
+        struct page *regs_page;
+        void *regs;
+};
+
+#ifdef DEBUG
+#define ASSERT(x)                                                       \
+do {                                                                    \
+        if (!(x)) {                                                     \
+                printk(KERN_EMERG "assertion failed %s: %d: %s\n",      \
+                       __FILE__, __LINE__, #x);                         \
+                BUG();                                                  \
+        }                                                               \
+} while (0)
+#else
+#define ASSERT(x) do { } while (0)
+#endif
+
+void kvm_vcpu_kick(struct kvm_vcpu *vcpu);
+int kvm_apic_has_interrupt(struct kvm_vcpu *vcpu);
+int kvm_apic_accept_pic_intr(struct kvm_vcpu *vcpu);
+int kvm_get_apic_interrupt(struct kvm_vcpu *vcpu);
+int kvm_create_lapic(struct kvm_vcpu *vcpu);
+void kvm_lapic_reset(struct kvm_vcpu *vcpu);
+void kvm_free_apic(struct kvm_lapic *apic);
+u64 kvm_lapic_get_cr8(struct kvm_vcpu *vcpu);
+void kvm_lapic_set_tpr(struct kvm_vcpu *vcpu, unsigned long cr8);
+void kvm_lapic_set_base(struct kvm_vcpu *vcpu, u64 value);
+struct kvm_lapic *kvm_apic_round_robin(struct kvm *kvm, u8 vector,
+                                       unsigned long bitmap);
+u64 kvm_get_apic_base(struct kvm_vcpu *vcpu);
+void kvm_set_apic_base(struct kvm_vcpu *vcpu, u64 data);
+int kvm_apic_match_physical_addr(struct kvm_lapic *apic, u16 dest);
+void kvm_ioapic_update_eoi(struct kvm *kvm, int vector);
+int kvm_apic_match_logical_addr(struct kvm_lapic *apic, u8 mda);
+int kvm_apic_set_irq(struct kvm_lapic *apic, u8 vec, u8 trig);
+void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu);
+int kvm_ioapic_init(struct kvm *kvm);
+void kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int level);
+int kvm_lapic_enabled(struct kvm_vcpu *vcpu);
+int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu);
+void kvm_apic_timer_intr_post(struct kvm_vcpu *vcpu, int vec);
+void kvm_timer_intr_post(struct kvm_vcpu *vcpu, int vec);
+void kvm_inject_pending_timer_irqs(struct kvm_vcpu *vcpu);
+void kvm_inject_apic_timer_irqs(struct kvm_vcpu *vcpu);
+void kvm_migrate_apic_timer(struct kvm_vcpu *vcpu);
+
+#endif
diff --git a/drivers/kvm/kvm.h b/drivers/kvm/kvm.h
index 336be86c6f5a..ad0813843adc 100644
--- a/drivers/kvm/kvm.h
+++ b/drivers/kvm/kvm.h
@@ -13,60 +13,38 @@
 #include <linux/signal.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
+#include <linux/preempt.h>
 #include <asm/signal.h>
 
-#include "vmx.h"
 #include <linux/kvm.h>
 #include <linux/kvm_para.h>
 
-#define CR0_PE_MASK (1ULL << 0)
-#define CR0_MP_MASK (1ULL << 1)
-#define CR0_TS_MASK (1ULL << 3)
-#define CR0_NE_MASK (1ULL << 5)
-#define CR0_WP_MASK (1ULL << 16)
-#define CR0_NW_MASK (1ULL << 29)
-#define CR0_CD_MASK (1ULL << 30)
-#define CR0_PG_MASK (1ULL << 31)
-
-#define CR3_WPT_MASK (1ULL << 3)
-#define CR3_PCD_MASK (1ULL << 4)
-
-#define CR3_RESEVED_BITS 0x07ULL
-#define CR3_L_MODE_RESEVED_BITS (~((1ULL << 40) - 1) | 0x0fe7ULL)
-#define CR3_FLAGS_MASK ((1ULL << 5) - 1)
-
-#define CR4_VME_MASK (1ULL << 0)
-#define CR4_PSE_MASK (1ULL << 4)
-#define CR4_PAE_MASK (1ULL << 5)
-#define CR4_PGE_MASK (1ULL << 7)
-#define CR4_VMXE_MASK (1ULL << 13)
+#define CR3_PAE_RESERVED_BITS ((X86_CR3_PWT | X86_CR3_PCD) - 1)
+#define CR3_NONPAE_RESERVED_BITS ((PAGE_SIZE-1) & ~(X86_CR3_PWT | X86_CR3_PCD))
+#define CR3_L_MODE_RESERVED_BITS (CR3_NONPAE_RESERVED_BITS|0xFFFFFF0000000000ULL)
 
 #define KVM_GUEST_CR0_MASK \
-        (CR0_PG_MASK | CR0_PE_MASK | CR0_WP_MASK | CR0_NE_MASK \
-         | CR0_NW_MASK | CR0_CD_MASK)
+        (X86_CR0_PG | X86_CR0_PE | X86_CR0_WP | X86_CR0_NE \
+         | X86_CR0_NW | X86_CR0_CD)
 #define KVM_VM_CR0_ALWAYS_ON \
-        (CR0_PG_MASK | CR0_PE_MASK | CR0_WP_MASK | CR0_NE_MASK | CR0_TS_MASK \
-         | CR0_MP_MASK)
+        (X86_CR0_PG | X86_CR0_PE | X86_CR0_WP | X86_CR0_NE | X86_CR0_TS \
+         | X86_CR0_MP)
 #define KVM_GUEST_CR4_MASK \
-        (CR4_PSE_MASK | CR4_PAE_MASK | CR4_PGE_MASK | CR4_VMXE_MASK | CR4_VME_MASK)
-#define KVM_PMODE_VM_CR4_ALWAYS_ON (CR4_VMXE_MASK | CR4_PAE_MASK)
-#define KVM_RMODE_VM_CR4_ALWAYS_ON (CR4_VMXE_MASK | CR4_PAE_MASK | CR4_VME_MASK)
+        (X86_CR4_VME | X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE | X86_CR4_VMXE)
+#define KVM_PMODE_VM_CR4_ALWAYS_ON (X86_CR4_PAE | X86_CR4_VMXE)
+#define KVM_RMODE_VM_CR4_ALWAYS_ON (X86_CR4_VME | X86_CR4_PAE | X86_CR4_VMXE)
 
 #define INVALID_PAGE (~(hpa_t)0)
 #define UNMAPPED_GVA (~(gpa_t)0)
 
 #define KVM_MAX_VCPUS 4
 #define KVM_ALIAS_SLOTS 4
-#define KVM_MEMORY_SLOTS 4
+#define KVM_MEMORY_SLOTS 8
 #define KVM_NUM_MMU_PAGES 1024
 #define KVM_MIN_FREE_MMU_PAGES 5
 #define KVM_REFILL_PAGES 25
 #define KVM_MAX_CPUID_ENTRIES 40
 
-#define FX_IMAGE_SIZE 512
-#define FX_IMAGE_ALIGN 16
-#define FX_BUF_SIZE (2 * FX_IMAGE_SIZE + FX_IMAGE_ALIGN)
-
 #define DE_VECTOR 0
 #define NM_VECTOR 7
 #define DF_VECTOR 8
@@ -158,15 +136,8 @@ struct kvm_mmu_page {
         };
 };
 
-struct vmcs {
-        u32 revision_id;
-        u32 abort;
-        char data[0];
-};
-
-#define vmx_msr_entry kvm_msr_entry
-
 struct kvm_vcpu;
+extern struct kmem_cache *kvm_vcpu_cache;
 
 /*
  * x86 supports 3 paging modes (4-level 64-bit, 3-level 64-bit, and 2-level
@@ -260,6 +231,7 @@ struct kvm_stat {
         u32 signal_exits;
         u32 irq_window_exits;
         u32 halt_exits;
+        u32 halt_wakeup;
         u32 request_irq_exits;
         u32 irq_exits;
         u32 light_exits;
@@ -328,21 +300,17 @@ void kvm_io_bus_register_dev(struct kvm_io_bus *bus,
 
 struct kvm_vcpu {
         struct kvm *kvm;
-        union {
-                struct vmcs *vmcs;
-                struct vcpu_svm *svm;
-        };
+        struct preempt_notifier preempt_notifier;
+        int vcpu_id;
         struct mutex mutex;
         int   cpu;
-        int   launched;
         u64 host_tsc;
         struct kvm_run *run;
         int interrupt_window_open;
         int guest_mode;
         unsigned long requests;
         unsigned long irq_summary; /* bit vector: 1 per word in irq_pending */
-#define NR_IRQ_WORDS KVM_IRQ_BITMAP_SIZE(unsigned long)
-        unsigned long irq_pending[NR_IRQ_WORDS];
+        DECLARE_BITMAP(irq_pending, KVM_NR_INTERRUPTS);
         unsigned long regs[NR_VCPU_REGS]; /* for rsp: vcpu_load_rsp_rip() */
         unsigned long rip;      /* needs vcpu_load_rsp_rip() */
 
@@ -357,15 +325,15 @@ struct kvm_vcpu {
         u64 pdptrs[4]; /* pae */
         u64 shadow_efer;
         u64 apic_base;
+        struct kvm_lapic *apic;    /* kernel irqchip context */
+#define VCPU_MP_STATE_RUNNABLE          0
+#define VCPU_MP_STATE_UNINITIALIZED     1
+#define VCPU_MP_STATE_INIT_RECEIVED     2
+#define VCPU_MP_STATE_SIPI_RECEIVED     3
+#define VCPU_MP_STATE_HALTED            4
+        int mp_state;
+        int sipi_vector;
         u64 ia32_misc_enable_msr;
-        int nmsrs;
-        int save_nmsrs;
-        int msr_offset_efer;
-#ifdef CONFIG_X86_64
-        int msr_offset_kernel_gs_base;
-#endif
-        struct vmx_msr_entry *guest_msrs;
-        struct vmx_msr_entry *host_msrs;
 
         struct kvm_mmu mmu;
 
@@ -379,16 +347,10 @@ struct kvm_vcpu {
 
         struct kvm_guest_debug guest_debug;
 
-        char fx_buf[FX_BUF_SIZE];
-        char *host_fx_image;
-        char *guest_fx_image;
+        struct i387_fxsave_struct host_fx_image;
+        struct i387_fxsave_struct guest_fx_image;
         int fpu_active;
         int guest_fpu_loaded;
-        struct vmx_host_state {
-                int loaded;
-                u16 fs_sel, gs_sel, ldt_sel;
-                int fs_gs_ldt_reload_needed;
-        } vmx_host_state;
 
         int mmio_needed;
         int mmio_read_completed;
@@ -399,6 +361,7 @@ struct kvm_vcpu {
         gva_t mmio_fault_cr2;
         struct kvm_pio_request pio;
         void *pio_data;
+        wait_queue_head_t wq;
 
         int sigset_active;
         sigset_t sigset;
@@ -436,7 +399,7 @@ struct kvm_memory_slot {
 };
 
 struct kvm {
-        spinlock_t lock; /* protects everything except vcpus */
+        struct mutex lock; /* protects everything except vcpus */
         int naliases;
         struct kvm_mem_alias aliases[KVM_ALIAS_SLOTS];
         int nmemslots;
@@ -447,39 +410,59 @@ struct kvm {
         struct list_head active_mmu_pages;
         int n_free_mmu_pages;
         struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
-        int nvcpus;
-        struct kvm_vcpu vcpus[KVM_MAX_VCPUS];
-        int memory_config_version;
-        int busy;
+        struct kvm_vcpu *vcpus[KVM_MAX_VCPUS];
         unsigned long rmap_overflow;
         struct list_head vm_list;
         struct file *filp;
         struct kvm_io_bus mmio_bus;
         struct kvm_io_bus pio_bus;
+        struct kvm_pic *vpic;
+        struct kvm_ioapic *vioapic;
+        int round_robin_prev_vcpu;
 };
 
+static inline struct kvm_pic *pic_irqchip(struct kvm *kvm)
+{
+        return kvm->vpic;
+}
+
+static inline struct kvm_ioapic *ioapic_irqchip(struct kvm *kvm)
+{
+        return kvm->vioapic;
+}
+
+static inline int irqchip_in_kernel(struct kvm *kvm)
+{
+        return pic_irqchip(kvm) != 0;
+}
+
 struct descriptor_table {
         u16 limit;
         unsigned long base;
 } __attribute__((packed));
 
-struct kvm_arch_ops {
+struct kvm_x86_ops {
         int (*cpu_has_kvm_support)(void);          /* __init */
         int (*disabled_by_bios)(void);             /* __init */
         void (*hardware_enable)(void *dummy);      /* __init */
         void (*hardware_disable)(void *dummy);
+        void (*check_processor_compatibility)(void *rtn);
         int (*hardware_setup)(void);               /* __init */
         void (*hardware_unsetup)(void);            /* __exit */
 
-        int (*vcpu_create)(struct kvm_vcpu *vcpu);
+        /* Create, but do not attach this VCPU */
+        struct kvm_vcpu *(*vcpu_create)(struct kvm *kvm, unsigned id);
         void (*vcpu_free)(struct kvm_vcpu *vcpu);
+        void (*vcpu_reset)(struct kvm_vcpu *vcpu);
 
-        void (*vcpu_load)(struct kvm_vcpu *vcpu);
+        void (*prepare_guest_switch)(struct kvm_vcpu *vcpu);
+        void (*vcpu_load)(struct kvm_vcpu *vcpu, int cpu);
         void (*vcpu_put)(struct kvm_vcpu *vcpu);
         void (*vcpu_decache)(struct kvm_vcpu *vcpu);
 
         int (*set_guest_debug)(struct kvm_vcpu *vcpu,
                                struct kvm_debug_guest *dbg);
+        void (*guest_debug_pre)(struct kvm_vcpu *vcpu);
         int (*get_msr)(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata);
         int (*set_msr)(struct kvm_vcpu *vcpu, u32 msr_index, u64 data);
         u64 (*get_segment_base)(struct kvm_vcpu *vcpu, int seg);
@@ -505,27 +488,43 @@ struct kvm_arch_ops {
         unsigned long (*get_rflags)(struct kvm_vcpu *vcpu);
         void (*set_rflags)(struct kvm_vcpu *vcpu, unsigned long rflags);
 
-        void (*invlpg)(struct kvm_vcpu *vcpu, gva_t addr);
         void (*tlb_flush)(struct kvm_vcpu *vcpu);
         void (*inject_page_fault)(struct kvm_vcpu *vcpu,
                                   unsigned long addr, u32 err_code);
 
         void (*inject_gp)(struct kvm_vcpu *vcpu, unsigned err_code);
 
-        int (*run)(struct kvm_vcpu *vcpu, struct kvm_run *run);
-        int (*vcpu_setup)(struct kvm_vcpu *vcpu);
+        void (*run)(struct kvm_vcpu *vcpu, struct kvm_run *run);
+        int (*handle_exit)(struct kvm_run *run, struct kvm_vcpu *vcpu);
         void (*skip_emulated_instruction)(struct kvm_vcpu *vcpu);
         void (*patch_hypercall)(struct kvm_vcpu *vcpu,
                                 unsigned char *hypercall_addr);
+        int (*get_irq)(struct kvm_vcpu *vcpu);
+        void (*set_irq)(struct kvm_vcpu *vcpu, int vec);
+        void (*inject_pending_irq)(struct kvm_vcpu *vcpu);
+        void (*inject_pending_vectors)(struct kvm_vcpu *vcpu,
+                                       struct kvm_run *run);
 };
 
-extern struct kvm_arch_ops *kvm_arch_ops;
+extern struct kvm_x86_ops *kvm_x86_ops;
+
+/* The guest did something we don't support. */
+#define pr_unimpl(vcpu, fmt, ...)                                       \
+ do {                                                                   \
+        if (printk_ratelimit())                                         \
+                printk(KERN_ERR "kvm: %i: cpu%i " fmt,                  \
+                       current->tgid, (vcpu)->vcpu_id , ## __VA_ARGS__); \
+ } while(0)
 
 #define kvm_printf(kvm, fmt ...) printk(KERN_DEBUG fmt)
 #define vcpu_printf(vcpu, fmt...) kvm_printf(vcpu->kvm, fmt)
 
-int kvm_init_arch(struct kvm_arch_ops *ops, struct module *module);
-void kvm_exit_arch(void);
+int kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id);
+void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
+
+int kvm_init_x86(struct kvm_x86_ops *ops, unsigned int vcpu_size,
+                  struct module *module);
+void kvm_exit_x86(void);
 
 int kvm_mmu_module_init(void);
 void kvm_mmu_module_exit(void);
@@ -545,8 +544,6 @@ static inline int is_error_hpa(hpa_t hpa) { return hpa >> HPA_MSB; }
 hpa_t gva_to_hpa(struct kvm_vcpu *vcpu, gva_t gva);
 struct page *gva_to_page(struct kvm_vcpu *vcpu, gva_t gva);
 
-void kvm_emulator_want_group7_invlpg(void);
-
 extern hpa_t bad_page_address;
 
 struct page *gfn_to_page(struct kvm *kvm, gfn_t gfn);
@@ -561,6 +558,7 @@ enum emulation_result {
 
 int emulate_instruction(struct kvm_vcpu *vcpu, struct kvm_run *run,
                         unsigned long cr2, u16 error_code);
+void kvm_report_emulation_failure(struct kvm_vcpu *cvpu, const char *context);
 void realmode_lgdt(struct kvm_vcpu *vcpu, u16 size, unsigned long address);
 void realmode_lidt(struct kvm_vcpu *vcpu, u16 size, unsigned long address);
 void realmode_lmsw(struct kvm_vcpu *vcpu, unsigned long msw,
@@ -574,9 +572,11 @@ int kvm_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data);
 
 struct x86_emulate_ctxt;
 
-int kvm_setup_pio(struct kvm_vcpu *vcpu, struct kvm_run *run, int in,
-                  int size, unsigned long count, int string, int down,
-                  gva_t address, int rep, unsigned port);
+int kvm_emulate_pio (struct kvm_vcpu *vcpu, struct kvm_run *run, int in,
+                     int size, unsigned port);
+int kvm_emulate_pio_string(struct kvm_vcpu *vcpu, struct kvm_run *run, int in,
+                           int size, unsigned long count, int down,
+                            gva_t address, int rep, unsigned port);
 void kvm_emulate_cpuid(struct kvm_vcpu *vcpu);
 int kvm_emulate_halt(struct kvm_vcpu *vcpu);
 int emulate_invlpg(struct kvm_vcpu *vcpu, gva_t address);
@@ -590,34 +590,33 @@ void set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0);
 void set_cr3(struct kvm_vcpu *vcpu, unsigned long cr0);
 void set_cr4(struct kvm_vcpu *vcpu, unsigned long cr0);
 void set_cr8(struct kvm_vcpu *vcpu, unsigned long cr0);
+unsigned long get_cr8(struct kvm_vcpu *vcpu);
 void lmsw(struct kvm_vcpu *vcpu, unsigned long msw);
+void kvm_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l);
 
 int kvm_get_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata);
 int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data);
 
 void fx_init(struct kvm_vcpu *vcpu);
 
-void load_msrs(struct vmx_msr_entry *e, int n);
-void save_msrs(struct vmx_msr_entry *e, int n);
 void kvm_resched(struct kvm_vcpu *vcpu);
 void kvm_load_guest_fpu(struct kvm_vcpu *vcpu);
 void kvm_put_guest_fpu(struct kvm_vcpu *vcpu);
 void kvm_flush_remote_tlbs(struct kvm *kvm);
 
-int kvm_read_guest(struct kvm_vcpu *vcpu,
-               gva_t addr,
-               unsigned long size,
-               void *dest);
-
-int kvm_write_guest(struct kvm_vcpu *vcpu,
-                gva_t addr,
-                unsigned long size,
-                void *data);
+int emulator_read_std(unsigned long addr,
+                      void *val,
+                      unsigned int bytes,
+                      struct kvm_vcpu *vcpu);
+int emulator_write_emulated(unsigned long addr,
+                            const void *val,
+                            unsigned int bytes,
+                            struct kvm_vcpu *vcpu);
 
 unsigned long segment_base(u16 selector);
 
 void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
-                       const u8 *old, const u8 *new, int bytes);
+                       const u8 *new, int bytes);
 int kvm_mmu_unprotect_page_virt(struct kvm_vcpu *vcpu, gva_t gva);
 void __kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu);
 int kvm_mmu_load(struct kvm_vcpu *vcpu);
@@ -656,17 +655,17 @@ static inline int is_long_mode(struct kvm_vcpu *vcpu)
 
 static inline int is_pae(struct kvm_vcpu *vcpu)
 {
-        return vcpu->cr4 & CR4_PAE_MASK;
+        return vcpu->cr4 & X86_CR4_PAE;
 }
 
 static inline int is_pse(struct kvm_vcpu *vcpu)
 {
-        return vcpu->cr4 & CR4_PSE_MASK;
+        return vcpu->cr4 & X86_CR4_PSE;
 }
 
 static inline int is_paging(struct kvm_vcpu *vcpu)
 {
-        return vcpu->cr0 & CR0_PG_MASK;
+        return vcpu->cr0 & X86_CR0_PG;
 }
 
 static inline int memslot_id(struct kvm *kvm, struct kvm_memory_slot *slot)
@@ -746,12 +745,12 @@ static inline unsigned long read_msr(unsigned long msr)
 }
 #endif
 
-static inline void fx_save(void *image)
+static inline void fx_save(struct i387_fxsave_struct *image)
 {
         asm ("fxsave (%0)":: "r" (image));
 }
 
-static inline void fx_restore(void *image)
+static inline void fx_restore(struct i387_fxsave_struct *image)
 {
         asm ("fxrstor (%0)":: "r" (image));
 }
diff --git a/drivers/kvm/kvm_main.c b/drivers/kvm/kvm_main.c
index cd0557954e50..353e58527d15 100644
--- a/drivers/kvm/kvm_main.c
+++ b/drivers/kvm/kvm_main.c
@@ -18,6 +18,7 @@
 #include "kvm.h"
 #include "x86_emulate.h"
 #include "segment_descriptor.h"
+#include "irq.h"
 
 #include <linux/kvm.h>
 #include <linux/module.h>
@@ -37,6 +38,7 @@
 #include <linux/cpumask.h>
 #include <linux/smp.h>
 #include <linux/anon_inodes.h>
+#include <linux/profile.h>
 
 #include <asm/processor.h>
 #include <asm/msr.h>
@@ -52,9 +54,11 @@ static LIST_HEAD(vm_list);
 
 static cpumask_t cpus_hardware_enabled;
 
-struct kvm_arch_ops *kvm_arch_ops;
+struct kvm_x86_ops *kvm_x86_ops;
+struct kmem_cache *kvm_vcpu_cache;
+EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
 
-static void hardware_disable(void *ignored);
+static __read_mostly struct preempt_ops kvm_preempt_ops;
 
 #define STAT_OFFSET(x) offsetof(struct kvm_vcpu, stat.x)
 
@@ -73,6 +77,7 @@ static struct kvm_stats_debugfs_item {
         { "signal_exits", STAT_OFFSET(signal_exits) },
         { "irq_window", STAT_OFFSET(irq_window_exits) },
         { "halt_exits", STAT_OFFSET(halt_exits) },
+        { "halt_wakeup", STAT_OFFSET(halt_wakeup) },
         { "request_irq", STAT_OFFSET(request_irq_exits) },
         { "irq_exits", STAT_OFFSET(irq_exits) },
         { "light_exits", STAT_OFFSET(light_exits) },
@@ -84,10 +89,17 @@ static struct dentry *debugfs_dir;
 
 #define MAX_IO_MSRS 256
 
-#define CR0_RESEVED_BITS 0xffffffff1ffaffc0ULL
-#define LMSW_GUEST_MASK 0x0eULL
-#define CR4_RESEVED_BITS (~((1ULL << 11) - 1))
-#define CR8_RESEVED_BITS (~0x0fULL)
+#define CR0_RESERVED_BITS                                               \
+        (~(unsigned long)(X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS \
+                          | X86_CR0_ET | X86_CR0_NE | X86_CR0_WP | X86_CR0_AM \
+                          | X86_CR0_NW | X86_CR0_CD | X86_CR0_PG))
+#define CR4_RESERVED_BITS                                               \
+        (~(unsigned long)(X86_CR4_VME | X86_CR4_PVI | X86_CR4_TSD | X86_CR4_DE\
+                          | X86_CR4_PSE | X86_CR4_PAE | X86_CR4_MCE     \
+                          | X86_CR4_PGE | X86_CR4_PCE | X86_CR4_OSFXSR  \
+                          | X86_CR4_OSXMMEXCPT | X86_CR4_VMXE))
+
+#define CR8_RESERVED_BITS (~(unsigned long)X86_CR8_TPR)
 #define EFER_RESERVED_BITS 0xfffffffffffff2fe
 
 #ifdef CONFIG_X86_64
@@ -139,82 +151,14 @@ static inline int valid_vcpu(int n)
         return likely(n >= 0 && n < KVM_MAX_VCPUS);
 }
 
-int kvm_read_guest(struct kvm_vcpu *vcpu, gva_t addr, unsigned long size,
-                   void *dest)
-{
-        unsigned char *host_buf = dest;
-        unsigned long req_size = size;
-
-        while (size) {
-                hpa_t paddr;
-                unsigned now;
-                unsigned offset;
-                hva_t guest_buf;
-
-                paddr = gva_to_hpa(vcpu, addr);
-
-                if (is_error_hpa(paddr))
-                        break;
-
-                guest_buf = (hva_t)kmap_atomic(
-                                        pfn_to_page(paddr >> PAGE_SHIFT),
-                                        KM_USER0);
-                offset = addr & ~PAGE_MASK;
-                guest_buf |= offset;
-                now = min(size, PAGE_SIZE - offset);
-                memcpy(host_buf, (void*)guest_buf, now);
-                host_buf += now;
-                addr += now;
-                size -= now;
-                kunmap_atomic((void *)(guest_buf & PAGE_MASK), KM_USER0);
-        }
-        return req_size - size;
-}
-EXPORT_SYMBOL_GPL(kvm_read_guest);
-
-int kvm_write_guest(struct kvm_vcpu *vcpu, gva_t addr, unsigned long size,
-                    void *data)
-{
-        unsigned char *host_buf = data;
-        unsigned long req_size = size;
-
-        while (size) {
-                hpa_t paddr;
-                unsigned now;
-                unsigned offset;
-                hva_t guest_buf;
-                gfn_t gfn;
-
-                paddr = gva_to_hpa(vcpu, addr);
-
-                if (is_error_hpa(paddr))
-                        break;
-
-                gfn = vcpu->mmu.gva_to_gpa(vcpu, addr) >> PAGE_SHIFT;
-                mark_page_dirty(vcpu->kvm, gfn);
-                guest_buf = (hva_t)kmap_atomic(
-                                pfn_to_page(paddr >> PAGE_SHIFT), KM_USER0);
-                offset = addr & ~PAGE_MASK;
-                guest_buf |= offset;
-                now = min(size, PAGE_SIZE - offset);
-                memcpy((void*)guest_buf, host_buf, now);
-                host_buf += now;
-                addr += now;
-                size -= now;
-                kunmap_atomic((void *)(guest_buf & PAGE_MASK), KM_USER0);
-        }
-        return req_size - size;
-}
-EXPORT_SYMBOL_GPL(kvm_write_guest);
-
 void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
 {
         if (!vcpu->fpu_active || vcpu->guest_fpu_loaded)
                 return;
 
         vcpu->guest_fpu_loaded = 1;
-        fx_save(vcpu->host_fx_image);
-        fx_restore(vcpu->guest_fx_image);
+        fx_save(&vcpu->host_fx_image);
+        fx_restore(&vcpu->guest_fx_image);
 }
 EXPORT_SYMBOL_GPL(kvm_load_guest_fpu);
 
@@ -224,8 +168,8 @@ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu)
                 return;
 
         vcpu->guest_fpu_loaded = 0;
-        fx_save(vcpu->guest_fx_image);
-        fx_restore(vcpu->host_fx_image);
+        fx_save(&vcpu->guest_fx_image);
+        fx_restore(&vcpu->host_fx_image);
 }
 EXPORT_SYMBOL_GPL(kvm_put_guest_fpu);
 
@@ -234,13 +178,21 @@ EXPORT_SYMBOL_GPL(kvm_put_guest_fpu);
  */
 static void vcpu_load(struct kvm_vcpu *vcpu)
 {
+        int cpu;
+
         mutex_lock(&vcpu->mutex);
-        kvm_arch_ops->vcpu_load(vcpu);
+        cpu = get_cpu();
+        preempt_notifier_register(&vcpu->preempt_notifier);
+        kvm_x86_ops->vcpu_load(vcpu, cpu);
+        put_cpu();
 }
 
 static void vcpu_put(struct kvm_vcpu *vcpu)
 {
-        kvm_arch_ops->vcpu_put(vcpu);
+        preempt_disable();
+        kvm_x86_ops->vcpu_put(vcpu);
+        preempt_notifier_unregister(&vcpu->preempt_notifier);
+        preempt_enable();
         mutex_unlock(&vcpu->mutex);
 }
 
@@ -261,8 +213,10 @@ void kvm_flush_remote_tlbs(struct kvm *kvm)
         atomic_set(&completed, 0);
         cpus_clear(cpus);
         needed = 0;
-        for (i = 0; i < kvm->nvcpus; ++i) {
-                vcpu = &kvm->vcpus[i];
+        for (i = 0; i < KVM_MAX_VCPUS; ++i) {
+                vcpu = kvm->vcpus[i];
+                if (!vcpu)
+                        continue;
                 if (test_and_set_bit(KVM_TLB_FLUSH, &vcpu->requests))
                         continue;
                 cpu = vcpu->cpu;
@@ -286,37 +240,79 @@ void kvm_flush_remote_tlbs(struct kvm *kvm)
         }
 }
 
+int kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id)
+{
+        struct page *page;
+        int r;
+
+        mutex_init(&vcpu->mutex);
+        vcpu->cpu = -1;
+        vcpu->mmu.root_hpa = INVALID_PAGE;
+        vcpu->kvm = kvm;
+        vcpu->vcpu_id = id;
+        if (!irqchip_in_kernel(kvm) || id == 0)
+                vcpu->mp_state = VCPU_MP_STATE_RUNNABLE;
+        else
+                vcpu->mp_state = VCPU_MP_STATE_UNINITIALIZED;
+        init_waitqueue_head(&vcpu->wq);
+
+        page = alloc_page(GFP_KERNEL | __GFP_ZERO);
+        if (!page) {
+                r = -ENOMEM;
+                goto fail;
+        }
+        vcpu->run = page_address(page);
+
+        page = alloc_page(GFP_KERNEL | __GFP_ZERO);
+        if (!page) {
+                r = -ENOMEM;
+                goto fail_free_run;
+        }
+        vcpu->pio_data = page_address(page);
+
+        r = kvm_mmu_create(vcpu);
+        if (r < 0)
+                goto fail_free_pio_data;
+
+        return 0;
+
+fail_free_pio_data:
+        free_page((unsigned long)vcpu->pio_data);
+fail_free_run:
+        free_page((unsigned long)vcpu->run);
+fail:
+        return -ENOMEM;
+}
+EXPORT_SYMBOL_GPL(kvm_vcpu_init);
+
+void kvm_vcpu_uninit(struct kvm_vcpu *vcpu)
+{
+        kvm_mmu_destroy(vcpu);
+        if (vcpu->apic)
+                hrtimer_cancel(&vcpu->apic->timer.dev);
+        kvm_free_apic(vcpu->apic);
+        free_page((unsigned long)vcpu->pio_data);
+        free_page((unsigned long)vcpu->run);
+}
+EXPORT_SYMBOL_GPL(kvm_vcpu_uninit);
+
 static struct kvm *kvm_create_vm(void)
 {
         struct kvm *kvm = kzalloc(sizeof(struct kvm), GFP_KERNEL);
-        int i;
 
         if (!kvm)
                 return ERR_PTR(-ENOMEM);
 
         kvm_io_bus_init(&kvm->pio_bus);
-        spin_lock_init(&kvm->lock);
+        mutex_init(&kvm->lock);
         INIT_LIST_HEAD(&kvm->active_mmu_pages);
         kvm_io_bus_init(&kvm->mmio_bus);
-        for (i = 0; i < KVM_MAX_VCPUS; ++i) {
-                struct kvm_vcpu *vcpu = &kvm->vcpus[i];
-
-                mutex_init(&vcpu->mutex);
-                vcpu->cpu = -1;
-                vcpu->kvm = kvm;
-                vcpu->mmu.root_hpa = INVALID_PAGE;
-        }
         spin_lock(&kvm_lock);
         list_add(&kvm->vm_list, &vm_list);
         spin_unlock(&kvm_lock);
         return kvm;
 }
 
-static int kvm_dev_open(struct inode *inode, struct file *filp)
-{
-        return 0;
-}
-
 /*
  * Free any memory in @free but not in @dont.
  */
@@ -353,7 +349,7 @@ static void free_pio_guest_pages(struct kvm_vcpu *vcpu)
 {
         int i;
 
-        for (i = 0; i < 2; ++i)
+        for (i = 0; i < ARRAY_SIZE(vcpu->pio.guest_pages); ++i)
                 if (vcpu->pio.guest_pages[i]) {
                         __free_page(vcpu->pio.guest_pages[i]);
                         vcpu->pio.guest_pages[i] = NULL;
@@ -362,30 +358,11 @@ static void free_pio_guest_pages(struct kvm_vcpu *vcpu)
 
 static void kvm_unload_vcpu_mmu(struct kvm_vcpu *vcpu)
 {
-        if (!vcpu->vmcs)
-                return;
-
         vcpu_load(vcpu);
         kvm_mmu_unload(vcpu);
         vcpu_put(vcpu);
 }
 
-static void kvm_free_vcpu(struct kvm_vcpu *vcpu)
-{
-        if (!vcpu->vmcs)
-                return;
-
-        vcpu_load(vcpu);
-        kvm_mmu_destroy(vcpu);
-        vcpu_put(vcpu);
-        kvm_arch_ops->vcpu_free(vcpu);
-        free_page((unsigned long)vcpu->run);
-        vcpu->run = NULL;
-        free_page((unsigned long)vcpu->pio_data);
-        vcpu->pio_data = NULL;
-        free_pio_guest_pages(vcpu);
-}
-
 static void kvm_free_vcpus(struct kvm *kvm)
 {
         unsigned int i;
@@ -394,14 +371,15 @@ static void kvm_free_vcpus(struct kvm *kvm)
          * Unpin any mmu pages first.
          */
         for (i = 0; i < KVM_MAX_VCPUS; ++i)
-                kvm_unload_vcpu_mmu(&kvm->vcpus[i]);
-        for (i = 0; i < KVM_MAX_VCPUS; ++i)
-                kvm_free_vcpu(&kvm->vcpus[i]);
-}
+                if (kvm->vcpus[i])
+                        kvm_unload_vcpu_mmu(kvm->vcpus[i]);
+        for (i = 0; i < KVM_MAX_VCPUS; ++i) {
+                if (kvm->vcpus[i]) {
+                        kvm_x86_ops->vcpu_free(kvm->vcpus[i]);
+                        kvm->vcpus[i] = NULL;
+                }
+        }
 
-static int kvm_dev_release(struct inode *inode, struct file *filp)
-{
-        return 0;
 }
 
 static void kvm_destroy_vm(struct kvm *kvm)
@@ -411,6 +389,8 @@ static void kvm_destroy_vm(struct kvm *kvm)
         spin_unlock(&kvm_lock);
         kvm_io_bus_destroy(&kvm->pio_bus);
         kvm_io_bus_destroy(&kvm->mmio_bus);
+        kfree(kvm->vpic);
+        kfree(kvm->vioapic);
         kvm_free_vcpus(kvm);
         kvm_free_physmem(kvm);
         kfree(kvm);
@@ -426,7 +406,7 @@ static int kvm_vm_release(struct inode *inode, struct file *filp)
 
 static void inject_gp(struct kvm_vcpu *vcpu)
 {
-        kvm_arch_ops->inject_gp(vcpu, 0);
+        kvm_x86_ops->inject_gp(vcpu, 0);
 }
 
 /*
@@ -437,58 +417,60 @@ static int load_pdptrs(struct kvm_vcpu *vcpu, unsigned long cr3)
         gfn_t pdpt_gfn = cr3 >> PAGE_SHIFT;
         unsigned offset = ((cr3 & (PAGE_SIZE-1)) >> 5) << 2;
         int i;
-        u64 pdpte;
         u64 *pdpt;
         int ret;
         struct page *page;
+        u64 pdpte[ARRAY_SIZE(vcpu->pdptrs)];
 
-        spin_lock(&vcpu->kvm->lock);
+        mutex_lock(&vcpu->kvm->lock);
         page = gfn_to_page(vcpu->kvm, pdpt_gfn);
-        /* FIXME: !page - emulate? 0xff? */
+        if (!page) {
+                ret = 0;
+                goto out;
+        }
+
         pdpt = kmap_atomic(page, KM_USER0);
+        memcpy(pdpte, pdpt+offset, sizeof(pdpte));
+        kunmap_atomic(pdpt, KM_USER0);
 
-        ret = 1;
-        for (i = 0; i < 4; ++i) {
-                pdpte = pdpt[offset + i];
-                if ((pdpte & 1) && (pdpte & 0xfffffff0000001e6ull)) {
+        for (i = 0; i < ARRAY_SIZE(pdpte); ++i) {
+                if ((pdpte[i] & 1) && (pdpte[i] & 0xfffffff0000001e6ull)) {
                         ret = 0;
                         goto out;
                 }
         }
+        ret = 1;
 
-        for (i = 0; i < 4; ++i)
-                vcpu->pdptrs[i] = pdpt[offset + i];
-
+        memcpy(vcpu->pdptrs, pdpte, sizeof(vcpu->pdptrs));
 out:
-        kunmap_atomic(pdpt, KM_USER0);
-        spin_unlock(&vcpu->kvm->lock);
+        mutex_unlock(&vcpu->kvm->lock);
 
         return ret;
 }
 
 void set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
 {
-        if (cr0 & CR0_RESEVED_BITS) {
+        if (cr0 & CR0_RESERVED_BITS) {
                 printk(KERN_DEBUG "set_cr0: 0x%lx #GP, reserved bits 0x%lx\n",
                        cr0, vcpu->cr0);
                 inject_gp(vcpu);
                 return;
         }
 
-        if ((cr0 & CR0_NW_MASK) && !(cr0 & CR0_CD_MASK)) {
+        if ((cr0 & X86_CR0_NW) && !(cr0 & X86_CR0_CD)) {
                 printk(KERN_DEBUG "set_cr0: #GP, CD == 0 && NW == 1\n");
                 inject_gp(vcpu);
                 return;
         }
 
-        if ((cr0 & CR0_PG_MASK) && !(cr0 & CR0_PE_MASK)) {
+        if ((cr0 & X86_CR0_PG) && !(cr0 & X86_CR0_PE)) {
                 printk(KERN_DEBUG "set_cr0: #GP, set PG flag "
                        "and a clear PE flag\n");
                 inject_gp(vcpu);
                 return;
         }
 
-        if (!is_paging(vcpu) && (cr0 & CR0_PG_MASK)) {
+        if (!is_paging(vcpu) && (cr0 & X86_CR0_PG)) {
 #ifdef CONFIG_X86_64
                 if ((vcpu->shadow_efer & EFER_LME)) {
                         int cs_db, cs_l;
@@ -499,7 +481,7 @@ void set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
                                 inject_gp(vcpu);
                                 return;
                         }
-                        kvm_arch_ops->get_cs_db_l_bits(vcpu, &cs_db, &cs_l);
+                        kvm_x86_ops->get_cs_db_l_bits(vcpu, &cs_db, &cs_l);
                         if (cs_l) {
                                 printk(KERN_DEBUG "set_cr0: #GP, start paging "
                                        "in long mode while CS.L == 1\n");
@@ -518,12 +500,12 @@ void set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
 
         }
 
-        kvm_arch_ops->set_cr0(vcpu, cr0);
+        kvm_x86_ops->set_cr0(vcpu, cr0);
         vcpu->cr0 = cr0;
 
-        spin_lock(&vcpu->kvm->lock);
+        mutex_lock(&vcpu->kvm->lock);
         kvm_mmu_reset_context(vcpu);
-        spin_unlock(&vcpu->kvm->lock);
+        mutex_unlock(&vcpu->kvm->lock);
         return;
 }
 EXPORT_SYMBOL_GPL(set_cr0);
@@ -536,62 +518,72 @@ EXPORT_SYMBOL_GPL(lmsw);
 
 void set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
 {
-        if (cr4 & CR4_RESEVED_BITS) {
+        if (cr4 & CR4_RESERVED_BITS) {
                 printk(KERN_DEBUG "set_cr4: #GP, reserved bits\n");
                 inject_gp(vcpu);
                 return;
         }
 
         if (is_long_mode(vcpu)) {
-                if (!(cr4 & CR4_PAE_MASK)) {
+                if (!(cr4 & X86_CR4_PAE)) {
                         printk(KERN_DEBUG "set_cr4: #GP, clearing PAE while "
                                "in long mode\n");
                         inject_gp(vcpu);
                         return;
                 }
-        } else if (is_paging(vcpu) && !is_pae(vcpu) && (cr4 & CR4_PAE_MASK)
+        } else if (is_paging(vcpu) && !is_pae(vcpu) && (cr4 & X86_CR4_PAE)
                    && !load_pdptrs(vcpu, vcpu->cr3)) {
                 printk(KERN_DEBUG "set_cr4: #GP, pdptrs reserved bits\n");
                 inject_gp(vcpu);
+                return;
         }
 
-        if (cr4 & CR4_VMXE_MASK) {
+        if (cr4 & X86_CR4_VMXE) {
                 printk(KERN_DEBUG "set_cr4: #GP, setting VMXE\n");
                 inject_gp(vcpu);
                 return;
         }
-        kvm_arch_ops->set_cr4(vcpu, cr4);
-        spin_lock(&vcpu->kvm->lock);
+        kvm_x86_ops->set_cr4(vcpu, cr4);
+        vcpu->cr4 = cr4;
+        mutex_lock(&vcpu->kvm->lock);
         kvm_mmu_reset_context(vcpu);
-        spin_unlock(&vcpu->kvm->lock);
+        mutex_unlock(&vcpu->kvm->lock);
 }
 EXPORT_SYMBOL_GPL(set_cr4);
 
 void set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
 {
         if (is_long_mode(vcpu)) {
-                if (cr3 & CR3_L_MODE_RESEVED_BITS) {
+                if (cr3 & CR3_L_MODE_RESERVED_BITS) {
                         printk(KERN_DEBUG "set_cr3: #GP, reserved bits\n");
                         inject_gp(vcpu);
                         return;
                 }
         } else {
-                if (cr3 & CR3_RESEVED_BITS) {
-                        printk(KERN_DEBUG "set_cr3: #GP, reserved bits\n");
-                        inject_gp(vcpu);
-                        return;
-                }
-                if (is_paging(vcpu) && is_pae(vcpu) &&
-                    !load_pdptrs(vcpu, cr3)) {
-                        printk(KERN_DEBUG "set_cr3: #GP, pdptrs "
-                               "reserved bits\n");
-                        inject_gp(vcpu);
-                        return;
+                if (is_pae(vcpu)) {
+                        if (cr3 & CR3_PAE_RESERVED_BITS) {
+                                printk(KERN_DEBUG
+                                       "set_cr3: #GP, reserved bits\n");
+                                inject_gp(vcpu);
+                                return;
+                        }
+                        if (is_paging(vcpu) && !load_pdptrs(vcpu, cr3)) {
+                                printk(KERN_DEBUG "set_cr3: #GP, pdptrs "
+                                       "reserved bits\n");
+                                inject_gp(vcpu);
+                                return;
+                        }
+                } else {
+                        if (cr3 & CR3_NONPAE_RESERVED_BITS) {
+                                printk(KERN_DEBUG
+                                       "set_cr3: #GP, reserved bits\n");
+                                inject_gp(vcpu);
+                                return;
+                        }
                 }
         }
 
-        vcpu->cr3 = cr3;
-        spin_lock(&vcpu->kvm->lock);
+        mutex_lock(&vcpu->kvm->lock);
         /*
          * Does the new cr3 value map to physical memory? (Note, we
          * catch an invalid cr3 even in real-mode, because it would
@@ -603,46 +595,73 @@ void set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
          */
         if (unlikely(!gfn_to_memslot(vcpu->kvm, cr3 >> PAGE_SHIFT)))
                 inject_gp(vcpu);
-        else
+        else {
+                vcpu->cr3 = cr3;
                 vcpu->mmu.new_cr3(vcpu);
-        spin_unlock(&vcpu->kvm->lock);
+        }
+        mutex_unlock(&vcpu->kvm->lock);
 }
 EXPORT_SYMBOL_GPL(set_cr3);
 
 void set_cr8(struct kvm_vcpu *vcpu, unsigned long cr8)
 {
-        if ( cr8 & CR8_RESEVED_BITS) {
+        if (cr8 & CR8_RESERVED_BITS) {
                 printk(KERN_DEBUG "set_cr8: #GP, reserved bits 0x%lx\n", cr8);
                 inject_gp(vcpu);
                 return;
         }
-        vcpu->cr8 = cr8;
+        if (irqchip_in_kernel(vcpu->kvm))
+                kvm_lapic_set_tpr(vcpu, cr8);
+        else
+                vcpu->cr8 = cr8;
 }
 EXPORT_SYMBOL_GPL(set_cr8);
 
-void fx_init(struct kvm_vcpu *vcpu)
+unsigned long get_cr8(struct kvm_vcpu *vcpu)
+{
+        if (irqchip_in_kernel(vcpu->kvm))
+                return kvm_lapic_get_cr8(vcpu);
+        else
+                return vcpu->cr8;
+}
+EXPORT_SYMBOL_GPL(get_cr8);
+
+u64 kvm_get_apic_base(struct kvm_vcpu *vcpu)
 {
-        struct __attribute__ ((__packed__)) fx_image_s {
-                u16 control; //fcw
-                u16 status; //fsw
-                u16 tag; // ftw
-                u16 opcode; //fop
-                u64 ip; // fpu ip
-                u64 operand;// fpu dp
-                u32 mxcsr;
-                u32 mxcsr_mask;
+        if (irqchip_in_kernel(vcpu->kvm))
+                return vcpu->apic_base;
+        else
+                return vcpu->apic_base;
+}
+EXPORT_SYMBOL_GPL(kvm_get_apic_base);
 
-        } *fx_image;
+void kvm_set_apic_base(struct kvm_vcpu *vcpu, u64 data)
+{
+        /* TODO: reserve bits check */
+        if (irqchip_in_kernel(vcpu->kvm))
+                kvm_lapic_set_base(vcpu, data);
+        else
+                vcpu->apic_base = data;
+}
+EXPORT_SYMBOL_GPL(kvm_set_apic_base);
+
+void fx_init(struct kvm_vcpu *vcpu)
+{
+        unsigned after_mxcsr_mask;
 
-        fx_save(vcpu->host_fx_image);
+        /* Initialize guest FPU by resetting ours and saving into guest's */
+        preempt_disable();
+        fx_save(&vcpu->host_fx_image);
         fpu_init();
-        fx_save(vcpu->guest_fx_image);
-        fx_restore(vcpu->host_fx_image);
+        fx_save(&vcpu->guest_fx_image);
+        fx_restore(&vcpu->host_fx_image);
+        preempt_enable();
 
-        fx_image = (struct fx_image_s *)vcpu->guest_fx_image;
-        fx_image->mxcsr = 0x1f80;
-        memset(vcpu->guest_fx_image + sizeof(struct fx_image_s),
-               0, FX_IMAGE_SIZE - sizeof(struct fx_image_s));
+        vcpu->cr0 |= X86_CR0_ET;
+        after_mxcsr_mask = offsetof(struct i387_fxsave_struct, st_space);
+        vcpu->guest_fx_image.mxcsr = 0x1f80;
+        memset((void *)&vcpu->guest_fx_image + after_mxcsr_mask,
+               0, sizeof(struct i387_fxsave_struct) - after_mxcsr_mask);
 }
 EXPORT_SYMBOL_GPL(fx_init);
 
@@ -661,7 +680,6 @@ static int kvm_vm_ioctl_set_memory_region(struct kvm *kvm,
         unsigned long i;
         struct kvm_memory_slot *memslot;
         struct kvm_memory_slot old, new;
-        int memory_config_version;
 
         r = -EINVAL;
         /* General sanity checks */
@@ -681,10 +699,8 @@ static int kvm_vm_ioctl_set_memory_region(struct kvm *kvm,
         if (!npages)
                 mem->flags &= ~KVM_MEM_LOG_DIRTY_PAGES;
 
-raced:
-        spin_lock(&kvm->lock);
+        mutex_lock(&kvm->lock);
 
-        memory_config_version = kvm->memory_config_version;
         new = old = *memslot;
 
         new.base_gfn = base_gfn;
@@ -707,11 +723,6 @@ raced:
                       (base_gfn >= s->base_gfn + s->npages)))
                         goto out_unlock;
         }
-        /*
-         * Do memory allocations outside lock.  memory_config_version will
-         * detect any races.
-         */
-        spin_unlock(&kvm->lock);
 
         /* Deallocate if slot is being removed */
         if (!npages)
@@ -728,14 +739,14 @@ raced:
                 new.phys_mem = vmalloc(npages * sizeof(struct page *));
 
                 if (!new.phys_mem)
-                        goto out_free;
+                        goto out_unlock;
 
                 memset(new.phys_mem, 0, npages * sizeof(struct page *));
                 for (i = 0; i < npages; ++i) {
                         new.phys_mem[i] = alloc_page(GFP_HIGHUSER
                                                      | __GFP_ZERO);
                         if (!new.phys_mem[i])
-                                goto out_free;
+                                goto out_unlock;
                         set_page_private(new.phys_mem[i],0);
                 }
         }
@@ -746,39 +757,25 @@ raced:
 
                 new.dirty_bitmap = vmalloc(dirty_bytes);
                 if (!new.dirty_bitmap)
-                        goto out_free;
+                        goto out_unlock;
                 memset(new.dirty_bitmap, 0, dirty_bytes);
         }
 
-        spin_lock(&kvm->lock);
-
-        if (memory_config_version != kvm->memory_config_version) {
-                spin_unlock(&kvm->lock);
-                kvm_free_physmem_slot(&new, &old);
-                goto raced;
-        }
-
-        r = -EAGAIN;
-        if (kvm->busy)
-                goto out_unlock;
-
         if (mem->slot >= kvm->nmemslots)
                 kvm->nmemslots = mem->slot + 1;
 
         *memslot = new;
-        ++kvm->memory_config_version;
 
         kvm_mmu_slot_remove_write_access(kvm, mem->slot);
         kvm_flush_remote_tlbs(kvm);
 
-        spin_unlock(&kvm->lock);
+        mutex_unlock(&kvm->lock);
 
         kvm_free_physmem_slot(&old, &new);
         return 0;
 
 out_unlock:
-        spin_unlock(&kvm->lock);
-out_free:
+        mutex_unlock(&kvm->lock);
         kvm_free_physmem_slot(&new, &old);
 out:
         return r;
@@ -795,14 +792,8 @@ static int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
         int n;
         unsigned long any = 0;
 
-        spin_lock(&kvm->lock);
+        mutex_lock(&kvm->lock);
 
-        /*
-         * Prevent changes to guest memory configuration even while the lock
-         * is not taken.
-         */
-        ++kvm->busy;
-        spin_unlock(&kvm->lock);
         r = -EINVAL;
         if (log->slot >= KVM_MEMORY_SLOTS)
                 goto out;
@@ -821,18 +812,17 @@ static int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
         if (copy_to_user(log->dirty_bitmap, memslot->dirty_bitmap, n))
                 goto out;
 
-        spin_lock(&kvm->lock);
-        kvm_mmu_slot_remove_write_access(kvm, log->slot);
-        kvm_flush_remote_tlbs(kvm);
-        memset(memslot->dirty_bitmap, 0, n);
-        spin_unlock(&kvm->lock);
+        /* If nothing is dirty, don't bother messing with page tables. */
+        if (any) {
+                kvm_mmu_slot_remove_write_access(kvm, log->slot);
+                kvm_flush_remote_tlbs(kvm);
+                memset(memslot->dirty_bitmap, 0, n);
+        }
 
         r = 0;
 
 out:
-        spin_lock(&kvm->lock);
-        --kvm->busy;
-        spin_unlock(&kvm->lock);
+        mutex_unlock(&kvm->lock);
         return r;
 }
 
@@ -862,7 +852,7 @@ static int kvm_vm_ioctl_set_memory_alias(struct kvm *kvm,
             < alias->target_phys_addr)
                 goto out;
 
-        spin_lock(&kvm->lock);
+        mutex_lock(&kvm->lock);
 
         p = &kvm->aliases[alias->slot];
         p->base_gfn = alias->guest_phys_addr >> PAGE_SHIFT;
@@ -876,7 +866,7 @@ static int kvm_vm_ioctl_set_memory_alias(struct kvm *kvm,
 
         kvm_mmu_zap_all(kvm);
 
-        spin_unlock(&kvm->lock);
+        mutex_unlock(&kvm->lock);
 
         return 0;
 
@@ -884,6 +874,63 @@ out:
         return r;
 }
 
+static int kvm_vm_ioctl_get_irqchip(struct kvm *kvm, struct kvm_irqchip *chip)
+{
+        int r;
+
+        r = 0;
+        switch (chip->chip_id) {
+        case KVM_IRQCHIP_PIC_MASTER:
+                memcpy (&chip->chip.pic,
+                        &pic_irqchip(kvm)->pics[0],
+                        sizeof(struct kvm_pic_state));
+                break;
+        case KVM_IRQCHIP_PIC_SLAVE:
+                memcpy (&chip->chip.pic,
+                        &pic_irqchip(kvm)->pics[1],
+                        sizeof(struct kvm_pic_state));
+                break;
+        case KVM_IRQCHIP_IOAPIC:
+                memcpy (&chip->chip.ioapic,
+                        ioapic_irqchip(kvm),
+                        sizeof(struct kvm_ioapic_state));
+                break;
+        default:
+                r = -EINVAL;
+                break;
+        }
+        return r;
+}
+
+static int kvm_vm_ioctl_set_irqchip(struct kvm *kvm, struct kvm_irqchip *chip)
+{
+        int r;
+
+        r = 0;
+        switch (chip->chip_id) {
+        case KVM_IRQCHIP_PIC_MASTER:
+                memcpy (&pic_irqchip(kvm)->pics[0],
+                        &chip->chip.pic,
+                        sizeof(struct kvm_pic_state));
+                break;
+        case KVM_IRQCHIP_PIC_SLAVE:
+                memcpy (&pic_irqchip(kvm)->pics[1],
+                        &chip->chip.pic,
+                        sizeof(struct kvm_pic_state));
+                break;
+        case KVM_IRQCHIP_IOAPIC:
+                memcpy (ioapic_irqchip(kvm),
+                        &chip->chip.ioapic,
+                        sizeof(struct kvm_ioapic_state));
+                break;
+        default:
+                r = -EINVAL;
+                break;
+        }
+        kvm_pic_update_irq(pic_irqchip(kvm));
+        return r;
+}
+
 static gfn_t unalias_gfn(struct kvm *kvm, gfn_t gfn)
 {
         int i;
@@ -930,37 +977,26 @@ struct page *gfn_to_page(struct kvm *kvm, gfn_t gfn)
 }
 EXPORT_SYMBOL_GPL(gfn_to_page);
 
+/* WARNING: Does not work on aliased pages. */
 void mark_page_dirty(struct kvm *kvm, gfn_t gfn)
 {
-        int i;
         struct kvm_memory_slot *memslot;
-        unsigned long rel_gfn;
 
-        for (i = 0; i < kvm->nmemslots; ++i) {
-                memslot = &kvm->memslots[i];
-
-                if (gfn >= memslot->base_gfn
-                    && gfn < memslot->base_gfn + memslot->npages) {
+        memslot = __gfn_to_memslot(kvm, gfn);
+        if (memslot && memslot->dirty_bitmap) {
+                unsigned long rel_gfn = gfn - memslot->base_gfn;
 
-                        if (!memslot->dirty_bitmap)
-                                return;
-
-                        rel_gfn = gfn - memslot->base_gfn;
-
-                        /* avoid RMW */
-                        if (!test_bit(rel_gfn, memslot->dirty_bitmap))
-                                set_bit(rel_gfn, memslot->dirty_bitmap);
-                        return;
-                }
+                /* avoid RMW */
+                if (!test_bit(rel_gfn, memslot->dirty_bitmap))
+                        set_bit(rel_gfn, memslot->dirty_bitmap);
         }
 }
 
-static int emulator_read_std(unsigned long addr,
+int emulator_read_std(unsigned long addr,
                              void *val,
                              unsigned int bytes,
-                             struct x86_emulate_ctxt *ctxt)
+                             struct kvm_vcpu *vcpu)
 {
-        struct kvm_vcpu *vcpu = ctxt->vcpu;
         void *data = val;
 
         while (bytes) {
@@ -990,26 +1026,42 @@ static int emulator_read_std(unsigned long addr,
 
         return X86EMUL_CONTINUE;
 }
+EXPORT_SYMBOL_GPL(emulator_read_std);
 
 static int emulator_write_std(unsigned long addr,
                               const void *val,
                               unsigned int bytes,
-                              struct x86_emulate_ctxt *ctxt)
+                              struct kvm_vcpu *vcpu)
 {
-        printk(KERN_ERR "emulator_write_std: addr %lx n %d\n",
-               addr, bytes);
+        pr_unimpl(vcpu, "emulator_write_std: addr %lx n %d\n", addr, bytes);
         return X86EMUL_UNHANDLEABLE;
 }
 
+/*
+ * Only apic need an MMIO device hook, so shortcut now..
+ */
+static struct kvm_io_device *vcpu_find_pervcpu_dev(struct kvm_vcpu *vcpu,
+                                                gpa_t addr)
+{
+        struct kvm_io_device *dev;
+
+        if (vcpu->apic) {
+                dev = &vcpu->apic->dev;
+                if (dev->in_range(dev, addr))
+                        return dev;
+        }
+        return NULL;
+}
+
 static struct kvm_io_device *vcpu_find_mmio_dev(struct kvm_vcpu *vcpu,
                                                 gpa_t addr)
 {
-        /*
-         * Note that its important to have this wrapper function because
-         * in the very near future we will be checking for MMIOs against
-         * the LAPIC as well as the general MMIO bus
-         */
-        return kvm_io_bus_find_dev(&vcpu->kvm->mmio_bus, addr);
+        struct kvm_io_device *dev;
+
+        dev = vcpu_find_pervcpu_dev(vcpu, addr);
+        if (dev == NULL)
+                dev = kvm_io_bus_find_dev(&vcpu->kvm->mmio_bus, addr);
+        return dev;
 }
 
 static struct kvm_io_device *vcpu_find_pio_dev(struct kvm_vcpu *vcpu,
@@ -1021,9 +1073,8 @@ static struct kvm_io_device *vcpu_find_pio_dev(struct kvm_vcpu *vcpu,
 static int emulator_read_emulated(unsigned long addr,
                                   void *val,
                                   unsigned int bytes,
-                                  struct x86_emulate_ctxt *ctxt)
+                                  struct kvm_vcpu *vcpu)
 {
-        struct kvm_vcpu      *vcpu = ctxt->vcpu;
         struct kvm_io_device *mmio_dev;
         gpa_t                 gpa;
 
@@ -1031,7 +1082,7 @@ static int emulator_read_emulated(unsigned long addr,
                 memcpy(val, vcpu->mmio_data, bytes);
                 vcpu->mmio_read_completed = 0;
                 return X86EMUL_CONTINUE;
-        } else if (emulator_read_std(addr, val, bytes, ctxt)
+        } else if (emulator_read_std(addr, val, bytes, vcpu)
                    == X86EMUL_CONTINUE)
                 return X86EMUL_CONTINUE;
 
@@ -1061,7 +1112,6 @@ static int emulator_write_phys(struct kvm_vcpu *vcpu, gpa_t gpa,
 {
         struct page *page;
         void *virt;
-        unsigned offset = offset_in_page(gpa);
 
         if (((gpa + bytes - 1) >> PAGE_SHIFT) != (gpa >> PAGE_SHIFT))
                 return 0;
@@ -1070,7 +1120,7 @@ static int emulator_write_phys(struct kvm_vcpu *vcpu, gpa_t gpa,
                 return 0;
         mark_page_dirty(vcpu->kvm, gpa >> PAGE_SHIFT);
         virt = kmap_atomic(page, KM_USER0);
-        kvm_mmu_pte_write(vcpu, gpa, virt + offset, val, bytes);
+        kvm_mmu_pte_write(vcpu, gpa, val, bytes);
         memcpy(virt + offset_in_page(gpa), val, bytes);
         kunmap_atomic(virt, KM_USER0);
         return 1;
@@ -1079,14 +1129,13 @@ static int emulator_write_phys(struct kvm_vcpu *vcpu, gpa_t gpa,
 static int emulator_write_emulated_onepage(unsigned long addr,
                                            const void *val,
                                            unsigned int bytes,
-                                           struct x86_emulate_ctxt *ctxt)
+                                           struct kvm_vcpu *vcpu)
 {
-        struct kvm_vcpu      *vcpu = ctxt->vcpu;
         struct kvm_io_device *mmio_dev;
         gpa_t                 gpa = vcpu->mmu.gva_to_gpa(vcpu, addr);
 
         if (gpa == UNMAPPED_GVA) {
-                kvm_arch_ops->inject_page_fault(vcpu, addr, 2);
+                kvm_x86_ops->inject_page_fault(vcpu, addr, 2);
                 return X86EMUL_PROPAGATE_FAULT;
         }
 
@@ -1111,31 +1160,32 @@ static int emulator_write_emulated_onepage(unsigned long addr,
         return X86EMUL_CONTINUE;
 }
 
-static int emulator_write_emulated(unsigned long addr,
+int emulator_write_emulated(unsigned long addr,
                                    const void *val,
                                    unsigned int bytes,
-                                   struct x86_emulate_ctxt *ctxt)
+                                   struct kvm_vcpu *vcpu)
 {
         /* Crossing a page boundary? */
         if (((addr + bytes - 1) ^ addr) & PAGE_MASK) {
                 int rc, now;
 
                 now = -addr & ~PAGE_MASK;
-                rc = emulator_write_emulated_onepage(addr, val, now, ctxt);
+                rc = emulator_write_emulated_onepage(addr, val, now, vcpu);
                 if (rc != X86EMUL_CONTINUE)
                         return rc;
                 addr += now;
                 val += now;
                 bytes -= now;
         }
-        return emulator_write_emulated_onepage(addr, val, bytes, ctxt);
+        return emulator_write_emulated_onepage(addr, val, bytes, vcpu);
 }
+EXPORT_SYMBOL_GPL(emulator_write_emulated);
 
 static int emulator_cmpxchg_emulated(unsigned long addr,
                                      const void *old,
                                      const void *new,
                                      unsigned int bytes,
-                                     struct x86_emulate_ctxt *ctxt)
+                                     struct kvm_vcpu *vcpu)
 {
         static int reported;
 
@@ -1143,12 +1193,12 @@ static int emulator_cmpxchg_emulated(unsigned long addr,
                 reported = 1;
                 printk(KERN_WARNING "kvm: emulating exchange as write\n");
         }
-        return emulator_write_emulated(addr, new, bytes, ctxt);
+        return emulator_write_emulated(addr, new, bytes, vcpu);
 }
 
 static unsigned long get_segment_base(struct kvm_vcpu *vcpu, int seg)
 {
-        return kvm_arch_ops->get_segment_base(vcpu, seg);
+        return kvm_x86_ops->get_segment_base(vcpu, seg);
 }
 
 int emulate_invlpg(struct kvm_vcpu *vcpu, gva_t address)
@@ -1158,10 +1208,8 @@ int emulate_invlpg(struct kvm_vcpu *vcpu, gva_t address)
 
 int emulate_clts(struct kvm_vcpu *vcpu)
 {
-        unsigned long cr0;
-
-        cr0 = vcpu->cr0 & ~CR0_TS_MASK;
-        kvm_arch_ops->set_cr0(vcpu, cr0);
+        vcpu->cr0 &= ~X86_CR0_TS;
+        kvm_x86_ops->set_cr0(vcpu, vcpu->cr0);
         return X86EMUL_CONTINUE;
 }
 
@@ -1171,11 +1219,10 @@ int emulator_get_dr(struct x86_emulate_ctxt* ctxt, int dr, unsigned long *dest)
 
         switch (dr) {
         case 0 ... 3:
-                *dest = kvm_arch_ops->get_dr(vcpu, dr);
+                *dest = kvm_x86_ops->get_dr(vcpu, dr);
                 return X86EMUL_CONTINUE;
         default:
-                printk(KERN_DEBUG "%s: unexpected dr %u\n",
-                       __FUNCTION__, dr);
+                pr_unimpl(vcpu, "%s: unexpected dr %u\n", __FUNCTION__, dr);
                 return X86EMUL_UNHANDLEABLE;
         }
 }
@@ -1185,7 +1232,7 @@ int emulator_set_dr(struct x86_emulate_ctxt *ctxt, int dr, unsigned long value)
         unsigned long mask = (ctxt->mode == X86EMUL_MODE_PROT64) ? ~0ULL : ~0U;
         int exception;
 
-        kvm_arch_ops->set_dr(ctxt->vcpu, dr, value & mask, &exception);
+        kvm_x86_ops->set_dr(ctxt->vcpu, dr, value & mask, &exception);
         if (exception) {
                 /* FIXME: better handling */
                 return X86EMUL_UNHANDLEABLE;
@@ -1193,25 +1240,25 @@ int emulator_set_dr(struct x86_emulate_ctxt *ctxt, int dr, unsigned long value)
         return X86EMUL_CONTINUE;
 }
 
-static void report_emulation_failure(struct x86_emulate_ctxt *ctxt)
+void kvm_report_emulation_failure(struct kvm_vcpu *vcpu, const char *context)
 {
         static int reported;
         u8 opcodes[4];
-        unsigned long rip = ctxt->vcpu->rip;
+        unsigned long rip = vcpu->rip;
         unsigned long rip_linear;
 
-        rip_linear = rip + get_segment_base(ctxt->vcpu, VCPU_SREG_CS);
+        rip_linear = rip + get_segment_base(vcpu, VCPU_SREG_CS);
 
         if (reported)
                 return;
 
-        emulator_read_std(rip_linear, (void *)opcodes, 4, ctxt);
+        emulator_read_std(rip_linear, (void *)opcodes, 4, vcpu);
 
-        printk(KERN_ERR "emulation failed but !mmio_needed?"
-               " rip %lx %02x %02x %02x %02x\n",
-               rip, opcodes[0], opcodes[1], opcodes[2], opcodes[3]);
+        printk(KERN_ERR "emulation failed (%s) rip %lx %02x %02x %02x %02x\n",
+               context, rip, opcodes[0], opcodes[1], opcodes[2], opcodes[3]);
         reported = 1;
 }
+EXPORT_SYMBOL_GPL(kvm_report_emulation_failure);
 
 struct x86_emulate_ops emulate_ops = {
         .read_std            = emulator_read_std,
@@ -1231,12 +1278,12 @@ int emulate_instruction(struct kvm_vcpu *vcpu,
         int cs_db, cs_l;
 
         vcpu->mmio_fault_cr2 = cr2;
-        kvm_arch_ops->cache_regs(vcpu);
+        kvm_x86_ops->cache_regs(vcpu);
 
-        kvm_arch_ops->get_cs_db_l_bits(vcpu, &cs_db, &cs_l);
+        kvm_x86_ops->get_cs_db_l_bits(vcpu, &cs_db, &cs_l);
 
         emulate_ctxt.vcpu = vcpu;
-        emulate_ctxt.eflags = kvm_arch_ops->get_rflags(vcpu);
+        emulate_ctxt.eflags = kvm_x86_ops->get_rflags(vcpu);
         emulate_ctxt.cr2 = cr2;
         emulate_ctxt.mode = (emulate_ctxt.eflags & X86_EFLAGS_VM)
                 ? X86EMUL_MODE_REAL : cs_l
@@ -1259,9 +1306,13 @@ int emulate_instruction(struct kvm_vcpu *vcpu,
         emulate_ctxt.fs_base = get_segment_base(vcpu, VCPU_SREG_FS);
 
         vcpu->mmio_is_write = 0;
+        vcpu->pio.string = 0;
         r = x86_emulate_memop(&emulate_ctxt, &emulate_ops);
+        if (vcpu->pio.string)
+                return EMULATE_DO_MMIO;
 
         if ((r || vcpu->mmio_is_write) && run) {
+                run->exit_reason = KVM_EXIT_MMIO;
                 run->mmio.phys_addr = vcpu->mmio_phys_addr;
                 memcpy(run->mmio.data, vcpu->mmio_data, 8);
                 run->mmio.len = vcpu->mmio_size;
@@ -1272,14 +1323,14 @@ int emulate_instruction(struct kvm_vcpu *vcpu,
                 if (kvm_mmu_unprotect_page_virt(vcpu, cr2))
                         return EMULATE_DONE;
                 if (!vcpu->mmio_needed) {
-                        report_emulation_failure(&emulate_ctxt);
+                        kvm_report_emulation_failure(vcpu, "mmio");
                         return EMULATE_FAIL;
                 }
                 return EMULATE_DO_MMIO;
         }
 
-        kvm_arch_ops->decache_regs(vcpu);
-        kvm_arch_ops->set_rflags(vcpu, emulate_ctxt.eflags);
+        kvm_x86_ops->decache_regs(vcpu);
+        kvm_x86_ops->set_rflags(vcpu, emulate_ctxt.eflags);
 
         if (vcpu->mmio_is_write) {
                 vcpu->mmio_needed = 0;
@@ -1290,14 +1341,45 @@ int emulate_instruction(struct kvm_vcpu *vcpu,
 }
 EXPORT_SYMBOL_GPL(emulate_instruction);
 
-int kvm_emulate_halt(struct kvm_vcpu *vcpu)
+/*
+ * The vCPU has executed a HLT instruction with in-kernel mode enabled.
+ */
+static void kvm_vcpu_block(struct kvm_vcpu *vcpu)
 {
-        if (vcpu->irq_summary)
-                return 1;
+        DECLARE_WAITQUEUE(wait, current);
 
-        vcpu->run->exit_reason = KVM_EXIT_HLT;
+        add_wait_queue(&vcpu->wq, &wait);
+
+        /*
+         * We will block until either an interrupt or a signal wakes us up
+         */
+        while (!kvm_cpu_has_interrupt(vcpu)
+               && !signal_pending(current)
+               && vcpu->mp_state != VCPU_MP_STATE_RUNNABLE
+               && vcpu->mp_state != VCPU_MP_STATE_SIPI_RECEIVED) {
+                set_current_state(TASK_INTERRUPTIBLE);
+                vcpu_put(vcpu);
+                schedule();
+                vcpu_load(vcpu);
+        }
+
+        __set_current_state(TASK_RUNNING);
+        remove_wait_queue(&vcpu->wq, &wait);
+}
+
+int kvm_emulate_halt(struct kvm_vcpu *vcpu)
+{
         ++vcpu->stat.halt_exits;
-        return 0;
+        if (irqchip_in_kernel(vcpu->kvm)) {
+                vcpu->mp_state = VCPU_MP_STATE_HALTED;
+                kvm_vcpu_block(vcpu);
+                if (vcpu->mp_state != VCPU_MP_STATE_RUNNABLE)
+                        return -EINTR;
+                return 1;
+        } else {
+                vcpu->run->exit_reason = KVM_EXIT_HLT;
+                return 0;
+        }
 }
 EXPORT_SYMBOL_GPL(kvm_emulate_halt);
 
@@ -1305,7 +1387,7 @@ int kvm_hypercall(struct kvm_vcpu *vcpu, struct kvm_run *run)
 {
         unsigned long nr, a0, a1, a2, a3, a4, a5, ret;
 
-        kvm_arch_ops->cache_regs(vcpu);
+        kvm_x86_ops->cache_regs(vcpu);
         ret = -KVM_EINVAL;
 #ifdef CONFIG_X86_64
         if (is_long_mode(vcpu)) {
@@ -1329,6 +1411,7 @@ int kvm_hypercall(struct kvm_vcpu *vcpu, struct kvm_run *run)
         }
         switch (nr) {
         default:
+                run->hypercall.nr = nr;
                 run->hypercall.args[0] = a0;
                 run->hypercall.args[1] = a1;
                 run->hypercall.args[2] = a2;
@@ -1337,11 +1420,11 @@ int kvm_hypercall(struct kvm_vcpu *vcpu, struct kvm_run *run)
                 run->hypercall.args[5] = a5;
                 run->hypercall.ret = ret;
                 run->hypercall.longmode = is_long_mode(vcpu);
-                kvm_arch_ops->decache_regs(vcpu);
+                kvm_x86_ops->decache_regs(vcpu);
                 return 0;
         }
         vcpu->regs[VCPU_REGS_RAX] = ret;
-        kvm_arch_ops->decache_regs(vcpu);
+        kvm_x86_ops->decache_regs(vcpu);
         return 1;
 }
 EXPORT_SYMBOL_GPL(kvm_hypercall);
@@ -1355,26 +1438,26 @@ void realmode_lgdt(struct kvm_vcpu *vcpu, u16 limit, unsigned long base)
 {
         struct descriptor_table dt = { limit, base };
 
-        kvm_arch_ops->set_gdt(vcpu, &dt);
+        kvm_x86_ops->set_gdt(vcpu, &dt);
 }
 
 void realmode_lidt(struct kvm_vcpu *vcpu, u16 limit, unsigned long base)
 {
         struct descriptor_table dt = { limit, base };
 
-        kvm_arch_ops->set_idt(vcpu, &dt);
+        kvm_x86_ops->set_idt(vcpu, &dt);
 }
 
 void realmode_lmsw(struct kvm_vcpu *vcpu, unsigned long msw,
                    unsigned long *rflags)
 {
         lmsw(vcpu, msw);
-        *rflags = kvm_arch_ops->get_rflags(vcpu);
+        *rflags = kvm_x86_ops->get_rflags(vcpu);
 }
 
 unsigned long realmode_get_cr(struct kvm_vcpu *vcpu, int cr)
 {
-        kvm_arch_ops->decache_cr4_guest_bits(vcpu);
+        kvm_x86_ops->decache_cr4_guest_bits(vcpu);
         switch (cr) {
         case 0:
                 return vcpu->cr0;
@@ -1396,7 +1479,7 @@ void realmode_set_cr(struct kvm_vcpu *vcpu, int cr, unsigned long val,
         switch (cr) {
         case 0:
                 set_cr0(vcpu, mk_cr_64(vcpu->cr0, val));
-                *rflags = kvm_arch_ops->get_rflags(vcpu);
+                *rflags = kvm_x86_ops->get_rflags(vcpu);
                 break;
         case 2:
                 vcpu->cr2 = val;
@@ -1439,7 +1522,7 @@ static int vcpu_register_para(struct kvm_vcpu *vcpu, gpa_t para_state_gpa)
 
         mark_page_dirty(vcpu->kvm, para_state_gpa >> PAGE_SHIFT);
         para_state_page = pfn_to_page(para_state_hpa >> PAGE_SHIFT);
-        para_state = kmap_atomic(para_state_page, KM_USER0);
+        para_state = kmap(para_state_page);
 
         printk(KERN_DEBUG "....  guest version: %d\n", para_state->guest_version);
         printk(KERN_DEBUG "....           size: %d\n", para_state->size);
@@ -1470,12 +1553,12 @@ static int vcpu_register_para(struct kvm_vcpu *vcpu, gpa_t para_state_gpa)
         mark_page_dirty(vcpu->kvm, hypercall_gpa >> PAGE_SHIFT);
         hypercall = kmap_atomic(pfn_to_page(hypercall_hpa >> PAGE_SHIFT),
                                 KM_USER1) + (hypercall_hpa & ~PAGE_MASK);
-        kvm_arch_ops->patch_hypercall(vcpu, hypercall);
+        kvm_x86_ops->patch_hypercall(vcpu, hypercall);
         kunmap_atomic(hypercall, KM_USER1);
 
         para_state->ret = 0;
 err_kunmap_skip:
-        kunmap_atomic(para_state, KM_USER0);
+        kunmap(para_state_page);
         return 0;
 err_gp:
         return 1;
@@ -1511,7 +1594,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata)
                 data = 3;
                 break;
         case MSR_IA32_APICBASE:
-                data = vcpu->apic_base;
+                data = kvm_get_apic_base(vcpu);
                 break;
         case MSR_IA32_MISC_ENABLE:
                 data = vcpu->ia32_misc_enable_msr;
@@ -1522,7 +1605,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata)
                 break;
 #endif
         default:
-                printk(KERN_ERR "kvm: unhandled rdmsr: 0x%x\n", msr);
+                pr_unimpl(vcpu, "unhandled rdmsr: 0x%x\n", msr);
                 return 1;
         }
         *pdata = data;
@@ -1537,7 +1620,7 @@ EXPORT_SYMBOL_GPL(kvm_get_msr_common);
  */
 int kvm_get_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata)
 {
-        return kvm_arch_ops->get_msr(vcpu, msr_index, pdata);
+        return kvm_x86_ops->get_msr(vcpu, msr_index, pdata);
 }
 
 #ifdef CONFIG_X86_64
@@ -1558,7 +1641,7 @@ static void set_efer(struct kvm_vcpu *vcpu, u64 efer)
                 return;
         }
 
-        kvm_arch_ops->set_efer(vcpu, efer);
+        kvm_x86_ops->set_efer(vcpu, efer);
 
         efer &= ~EFER_LMA;
         efer |= vcpu->shadow_efer & EFER_LMA;
@@ -1577,11 +1660,11 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
                 break;
 #endif
         case MSR_IA32_MC0_STATUS:
-                printk(KERN_WARNING "%s: MSR_IA32_MC0_STATUS 0x%llx, nop\n",
+                pr_unimpl(vcpu, "%s: MSR_IA32_MC0_STATUS 0x%llx, nop\n",
                        __FUNCTION__, data);
                 break;
         case MSR_IA32_MCG_STATUS:
-                printk(KERN_WARNING "%s: MSR_IA32_MCG_STATUS 0x%llx, nop\n",
+                pr_unimpl(vcpu, "%s: MSR_IA32_MCG_STATUS 0x%llx, nop\n",
                         __FUNCTION__, data);
                 break;
         case MSR_IA32_UCODE_REV:
@@ -1589,7 +1672,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
         case 0x200 ... 0x2ff: /* MTRRs */
                 break;
         case MSR_IA32_APICBASE:
-                vcpu->apic_base = data;
+                kvm_set_apic_base(vcpu, data);
                 break;
         case MSR_IA32_MISC_ENABLE:
                 vcpu->ia32_misc_enable_msr = data;
@@ -1601,7 +1684,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
                 return vcpu_register_para(vcpu, data);
 
         default:
-                printk(KERN_ERR "kvm: unhandled wrmsr: 0x%x\n", msr);
+                pr_unimpl(vcpu, "unhandled wrmsr: 0x%x\n", msr);
                 return 1;
         }
         return 0;
@@ -1615,44 +1698,24 @@ EXPORT_SYMBOL_GPL(kvm_set_msr_common);
  */
 int kvm_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
 {
-        return kvm_arch_ops->set_msr(vcpu, msr_index, data);
+        return kvm_x86_ops->set_msr(vcpu, msr_index, data);
 }
 
 void kvm_resched(struct kvm_vcpu *vcpu)
 {
         if (!need_resched())
                 return;
-        vcpu_put(vcpu);
         cond_resched();
-        vcpu_load(vcpu);
 }
 EXPORT_SYMBOL_GPL(kvm_resched);
 
-void load_msrs(struct vmx_msr_entry *e, int n)
-{
-        int i;
-
-        for (i = 0; i < n; ++i)
-                wrmsrl(e[i].index, e[i].data);
-}
-EXPORT_SYMBOL_GPL(load_msrs);
-
-void save_msrs(struct vmx_msr_entry *e, int n)
-{
-        int i;
-
-        for (i = 0; i < n; ++i)
-                rdmsrl(e[i].index, e[i].data);
-}
-EXPORT_SYMBOL_GPL(save_msrs);
-
 void kvm_emulate_cpuid(struct kvm_vcpu *vcpu)
 {
         int i;
         u32 function;
         struct kvm_cpuid_entry *e, *best;
 
-        kvm_arch_ops->cache_regs(vcpu);
+        kvm_x86_ops->cache_regs(vcpu);
         function = vcpu->regs[VCPU_REGS_RAX];
         vcpu->regs[VCPU_REGS_RAX] = 0;
         vcpu->regs[VCPU_REGS_RBX] = 0;
@@ -1678,8 +1741,8 @@ void kvm_emulate_cpuid(struct kvm_vcpu *vcpu)
                 vcpu->regs[VCPU_REGS_RCX] = best->ecx;
                 vcpu->regs[VCPU_REGS_RDX] = best->edx;
         }
-        kvm_arch_ops->decache_regs(vcpu);
-        kvm_arch_ops->skip_emulated_instruction(vcpu);
+        kvm_x86_ops->decache_regs(vcpu);
+        kvm_x86_ops->skip_emulated_instruction(vcpu);
 }
 EXPORT_SYMBOL_GPL(kvm_emulate_cpuid);
 
@@ -1690,11 +1753,9 @@ static int pio_copy_data(struct kvm_vcpu *vcpu)
         unsigned bytes;
         int nr_pages = vcpu->pio.guest_pages[1] ? 2 : 1;
 
-        kvm_arch_ops->vcpu_put(vcpu);
         q = vmap(vcpu->pio.guest_pages, nr_pages, VM_READ|VM_WRITE,
                  PAGE_KERNEL);
         if (!q) {
-                kvm_arch_ops->vcpu_load(vcpu);
                 free_pio_guest_pages(vcpu);
                 return -ENOMEM;
         }
@@ -1706,7 +1767,6 @@ static int pio_copy_data(struct kvm_vcpu *vcpu)
                 memcpy(p, q, bytes);
         q -= vcpu->pio.guest_page_offset;
         vunmap(q);
-        kvm_arch_ops->vcpu_load(vcpu);
         free_pio_guest_pages(vcpu);
         return 0;
 }
@@ -1717,7 +1777,7 @@ static int complete_pio(struct kvm_vcpu *vcpu)
         long delta;
         int r;
 
-        kvm_arch_ops->cache_regs(vcpu);
+        kvm_x86_ops->cache_regs(vcpu);
 
         if (!io->string) {
                 if (io->in)
@@ -1727,7 +1787,7 @@ static int complete_pio(struct kvm_vcpu *vcpu)
                 if (io->in) {
                         r = pio_copy_data(vcpu);
                         if (r) {
-                                kvm_arch_ops->cache_regs(vcpu);
+                                kvm_x86_ops->cache_regs(vcpu);
                                 return r;
                         }
                 }
@@ -1750,79 +1810,109 @@ static int complete_pio(struct kvm_vcpu *vcpu)
                         vcpu->regs[VCPU_REGS_RSI] += delta;
         }
 
-        kvm_arch_ops->decache_regs(vcpu);
+        kvm_x86_ops->decache_regs(vcpu);
 
         io->count -= io->cur_count;
         io->cur_count = 0;
 
-        if (!io->count)
-                kvm_arch_ops->skip_emulated_instruction(vcpu);
         return 0;
 }
 
-void kernel_pio(struct kvm_io_device *pio_dev, struct kvm_vcpu *vcpu)
+static void kernel_pio(struct kvm_io_device *pio_dev,
+                       struct kvm_vcpu *vcpu,
+                       void *pd)
 {
         /* TODO: String I/O for in kernel device */
 
+        mutex_lock(&vcpu->kvm->lock);
         if (vcpu->pio.in)
                 kvm_iodevice_read(pio_dev, vcpu->pio.port,
                                   vcpu->pio.size,
-                                  vcpu->pio_data);
+                                  pd);
         else
                 kvm_iodevice_write(pio_dev, vcpu->pio.port,
                                    vcpu->pio.size,
-                                   vcpu->pio_data);
+                                   pd);
+        mutex_unlock(&vcpu->kvm->lock);
+}
+
+static void pio_string_write(struct kvm_io_device *pio_dev,
+                             struct kvm_vcpu *vcpu)
+{
+        struct kvm_pio_request *io = &vcpu->pio;
+        void *pd = vcpu->pio_data;
+        int i;
+
+        mutex_lock(&vcpu->kvm->lock);
+        for (i = 0; i < io->cur_count; i++) {
+                kvm_iodevice_write(pio_dev, io->port,
+                                   io->size,
+                                   pd);
+                pd += io->size;
+        }
+        mutex_unlock(&vcpu->kvm->lock);
 }
 
-int kvm_setup_pio(struct kvm_vcpu *vcpu, struct kvm_run *run, int in,
-                  int size, unsigned long count, int string, int down,
+int kvm_emulate_pio (struct kvm_vcpu *vcpu, struct kvm_run *run, int in,
+                  int size, unsigned port)
+{
+        struct kvm_io_device *pio_dev;
+
+        vcpu->run->exit_reason = KVM_EXIT_IO;
+        vcpu->run->io.direction = in ? KVM_EXIT_IO_IN : KVM_EXIT_IO_OUT;
+        vcpu->run->io.size = vcpu->pio.size = size;
+        vcpu->run->io.data_offset = KVM_PIO_PAGE_OFFSET * PAGE_SIZE;
+        vcpu->run->io.count = vcpu->pio.count = vcpu->pio.cur_count = 1;
+        vcpu->run->io.port = vcpu->pio.port = port;
+        vcpu->pio.in = in;
+        vcpu->pio.string = 0;
+        vcpu->pio.down = 0;
+        vcpu->pio.guest_page_offset = 0;
+        vcpu->pio.rep = 0;
+
+        kvm_x86_ops->cache_regs(vcpu);
+        memcpy(vcpu->pio_data, &vcpu->regs[VCPU_REGS_RAX], 4);
+        kvm_x86_ops->decache_regs(vcpu);
+
+        kvm_x86_ops->skip_emulated_instruction(vcpu);
+
+        pio_dev = vcpu_find_pio_dev(vcpu, port);
+        if (pio_dev) {
+                kernel_pio(pio_dev, vcpu, vcpu->pio_data);
+                complete_pio(vcpu);
+                return 1;
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(kvm_emulate_pio);
+
+int kvm_emulate_pio_string(struct kvm_vcpu *vcpu, struct kvm_run *run, int in,
+                  int size, unsigned long count, int down,
                   gva_t address, int rep, unsigned port)
 {
         unsigned now, in_page;
-        int i;
+        int i, ret = 0;
         int nr_pages = 1;
         struct page *page;
         struct kvm_io_device *pio_dev;
 
         vcpu->run->exit_reason = KVM_EXIT_IO;
         vcpu->run->io.direction = in ? KVM_EXIT_IO_IN : KVM_EXIT_IO_OUT;
-        vcpu->run->io.size = size;
+        vcpu->run->io.size = vcpu->pio.size = size;
         vcpu->run->io.data_offset = KVM_PIO_PAGE_OFFSET * PAGE_SIZE;
-        vcpu->run->io.count = count;
-        vcpu->run->io.port = port;
-        vcpu->pio.count = count;
-        vcpu->pio.cur_count = count;
-        vcpu->pio.size = size;
+        vcpu->run->io.count = vcpu->pio.count = vcpu->pio.cur_count = count;
+        vcpu->run->io.port = vcpu->pio.port = port;
         vcpu->pio.in = in;
-        vcpu->pio.port = port;
-        vcpu->pio.string = string;
+        vcpu->pio.string = 1;
         vcpu->pio.down = down;
         vcpu->pio.guest_page_offset = offset_in_page(address);
         vcpu->pio.rep = rep;
 
-        pio_dev = vcpu_find_pio_dev(vcpu, port);
-        if (!string) {
-                kvm_arch_ops->cache_regs(vcpu);
-                memcpy(vcpu->pio_data, &vcpu->regs[VCPU_REGS_RAX], 4);
-                kvm_arch_ops->decache_regs(vcpu);
-                if (pio_dev) {
-                        kernel_pio(pio_dev, vcpu);
-                        complete_pio(vcpu);
-                        return 1;
-                }
-                return 0;
-        }
-        /* TODO: String I/O for in kernel device */
-        if (pio_dev)
-                printk(KERN_ERR "kvm_setup_pio: no string io support\n");
-
         if (!count) {
-                kvm_arch_ops->skip_emulated_instruction(vcpu);
+                kvm_x86_ops->skip_emulated_instruction(vcpu);
                 return 1;
         }
 
-        now = min(count, PAGE_SIZE / size);
-
         if (!down)
                 in_page = PAGE_SIZE - offset_in_page(address);
         else
@@ -1841,20 +1931,23 @@ int kvm_setup_pio(struct kvm_vcpu *vcpu, struct kvm_run *run, int in,
                 /*
                  * String I/O in reverse.  Yuck.  Kill the guest, fix later.
                  */
-                printk(KERN_ERR "kvm: guest string pio down\n");
+                pr_unimpl(vcpu, "guest string pio down\n");
                 inject_gp(vcpu);
                 return 1;
         }
         vcpu->run->io.count = now;
         vcpu->pio.cur_count = now;
 
+        if (vcpu->pio.cur_count == vcpu->pio.count)
+                kvm_x86_ops->skip_emulated_instruction(vcpu);
+
         for (i = 0; i < nr_pages; ++i) {
-                spin_lock(&vcpu->kvm->lock);
+                mutex_lock(&vcpu->kvm->lock);
                 page = gva_to_page(vcpu, address + i * PAGE_SIZE);
                 if (page)
                         get_page(page);
                 vcpu->pio.guest_pages[i] = page;
-                spin_unlock(&vcpu->kvm->lock);
+                mutex_unlock(&vcpu->kvm->lock);
                 if (!page) {
                         inject_gp(vcpu);
                         free_pio_guest_pages(vcpu);
@@ -1862,11 +1955,145 @@ int kvm_setup_pio(struct kvm_vcpu *vcpu, struct kvm_run *run, int in,
                 }
         }
 
-        if (!vcpu->pio.in)
-                return pio_copy_data(vcpu);
-        return 0;
+        pio_dev = vcpu_find_pio_dev(vcpu, port);
+        if (!vcpu->pio.in) {
+                /* string PIO write */
+                ret = pio_copy_data(vcpu);
+                if (ret >= 0 && pio_dev) {
+                        pio_string_write(pio_dev, vcpu);
+                        complete_pio(vcpu);
+                        if (vcpu->pio.count == 0)
+                                ret = 1;
+                }
+        } else if (pio_dev)
+                pr_unimpl(vcpu, "no string pio read support yet, "
+                       "port %x size %d count %ld\n",
+                        port, size, count);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(kvm_emulate_pio_string);
+
+/*
+ * Check if userspace requested an interrupt window, and that the
+ * interrupt window is open.
+ *
+ * No need to exit to userspace if we already have an interrupt queued.
+ */
+static int dm_request_for_irq_injection(struct kvm_vcpu *vcpu,
+                                          struct kvm_run *kvm_run)
+{
+        return (!vcpu->irq_summary &&
+                kvm_run->request_interrupt_window &&
+                vcpu->interrupt_window_open &&
+                (kvm_x86_ops->get_rflags(vcpu) & X86_EFLAGS_IF));
+}
+
+static void post_kvm_run_save(struct kvm_vcpu *vcpu,
+                              struct kvm_run *kvm_run)
+{
+        kvm_run->if_flag = (kvm_x86_ops->get_rflags(vcpu) & X86_EFLAGS_IF) != 0;
+        kvm_run->cr8 = get_cr8(vcpu);
+        kvm_run->apic_base = kvm_get_apic_base(vcpu);
+        if (irqchip_in_kernel(vcpu->kvm))
+                kvm_run->ready_for_interrupt_injection = 1;
+        else
+                kvm_run->ready_for_interrupt_injection =
+                                        (vcpu->interrupt_window_open &&
+                                         vcpu->irq_summary == 0);
+}
+
+static int __vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+{
+        int r;
+
+        if (unlikely(vcpu->mp_state == VCPU_MP_STATE_SIPI_RECEIVED)) {
+                printk("vcpu %d received sipi with vector # %x\n",
+                       vcpu->vcpu_id, vcpu->sipi_vector);
+                kvm_lapic_reset(vcpu);
+                kvm_x86_ops->vcpu_reset(vcpu);
+                vcpu->mp_state = VCPU_MP_STATE_RUNNABLE;
+        }
+
+preempted:
+        if (vcpu->guest_debug.enabled)
+                kvm_x86_ops->guest_debug_pre(vcpu);
+
+again:
+        r = kvm_mmu_reload(vcpu);
+        if (unlikely(r))
+                goto out;
+
+        preempt_disable();
+
+        kvm_x86_ops->prepare_guest_switch(vcpu);
+        kvm_load_guest_fpu(vcpu);
+
+        local_irq_disable();
+
+        if (signal_pending(current)) {
+                local_irq_enable();
+                preempt_enable();
+                r = -EINTR;
+                kvm_run->exit_reason = KVM_EXIT_INTR;
+                ++vcpu->stat.signal_exits;
+                goto out;
+        }
+
+        if (irqchip_in_kernel(vcpu->kvm))
+                kvm_x86_ops->inject_pending_irq(vcpu);
+        else if (!vcpu->mmio_read_completed)
+                kvm_x86_ops->inject_pending_vectors(vcpu, kvm_run);
+
+        vcpu->guest_mode = 1;
+
+        if (vcpu->requests)
+                if (test_and_clear_bit(KVM_TLB_FLUSH, &vcpu->requests))
+                        kvm_x86_ops->tlb_flush(vcpu);
+
+        kvm_x86_ops->run(vcpu, kvm_run);
+
+        vcpu->guest_mode = 0;
+        local_irq_enable();
+
+        ++vcpu->stat.exits;
+
+        preempt_enable();
+
+        /*
+         * Profile KVM exit RIPs:
+         */
+        if (unlikely(prof_on == KVM_PROFILING)) {
+                kvm_x86_ops->cache_regs(vcpu);
+                profile_hit(KVM_PROFILING, (void *)vcpu->rip);
+        }
+
+        r = kvm_x86_ops->handle_exit(kvm_run, vcpu);
+
+        if (r > 0) {
+                if (dm_request_for_irq_injection(vcpu, kvm_run)) {
+                        r = -EINTR;
+                        kvm_run->exit_reason = KVM_EXIT_INTR;
+                        ++vcpu->stat.request_irq_exits;
+                        goto out;
+                }
+                if (!need_resched()) {
+                        ++vcpu->stat.light_exits;
+                        goto again;
+                }
+        }
+
+out:
+        if (r > 0) {
+                kvm_resched(vcpu);
+                goto preempted;
+        }
+
+        post_kvm_run_save(vcpu, kvm_run);
+
+        return r;
 }
-EXPORT_SYMBOL_GPL(kvm_setup_pio);
+
 
 static int kvm_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 {
@@ -1875,11 +2102,18 @@ static int kvm_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 
         vcpu_load(vcpu);
 
+        if (unlikely(vcpu->mp_state == VCPU_MP_STATE_UNINITIALIZED)) {
+                kvm_vcpu_block(vcpu);
+                vcpu_put(vcpu);
+                return -EAGAIN;
+        }
+
         if (vcpu->sigset_active)
                 sigprocmask(SIG_SETMASK, &vcpu->sigset, &sigsaved);
 
         /* re-sync apic's tpr */
-        vcpu->cr8 = kvm_run->cr8;
+        if (!irqchip_in_kernel(vcpu->kvm))
+                set_cr8(vcpu, kvm_run->cr8);
 
         if (vcpu->pio.cur_count) {
                 r = complete_pio(vcpu);
@@ -1897,19 +2131,18 @@ static int kvm_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
                         /*
                          * Read-modify-write.  Back to userspace.
                          */
-                        kvm_run->exit_reason = KVM_EXIT_MMIO;
                         r = 0;
                         goto out;
                 }
         }
 
         if (kvm_run->exit_reason == KVM_EXIT_HYPERCALL) {
-                kvm_arch_ops->cache_regs(vcpu);
+                kvm_x86_ops->cache_regs(vcpu);
                 vcpu->regs[VCPU_REGS_RAX] = kvm_run->hypercall.ret;
-                kvm_arch_ops->decache_regs(vcpu);
+                kvm_x86_ops->decache_regs(vcpu);
         }
 
-        r = kvm_arch_ops->run(vcpu, kvm_run);
+        r = __vcpu_run(vcpu, kvm_run);
 
 out:
         if (vcpu->sigset_active)
@@ -1924,7 +2157,7 @@ static int kvm_vcpu_ioctl_get_regs(struct kvm_vcpu *vcpu,
 {
         vcpu_load(vcpu);
 
-        kvm_arch_ops->cache_regs(vcpu);
+        kvm_x86_ops->cache_regs(vcpu);
 
         regs->rax = vcpu->regs[VCPU_REGS_RAX];
         regs->rbx = vcpu->regs[VCPU_REGS_RBX];
@@ -1946,7 +2179,7 @@ static int kvm_vcpu_ioctl_get_regs(struct kvm_vcpu *vcpu,
 #endif
 
         regs->rip = vcpu->rip;
-        regs->rflags = kvm_arch_ops->get_rflags(vcpu);
+        regs->rflags = kvm_x86_ops->get_rflags(vcpu);
 
         /*
          * Don't leak debug flags in case they were set for guest debugging
@@ -1984,9 +2217,9 @@ static int kvm_vcpu_ioctl_set_regs(struct kvm_vcpu *vcpu,
 #endif
 
         vcpu->rip = regs->rip;
-        kvm_arch_ops->set_rflags(vcpu, regs->rflags);
+        kvm_x86_ops->set_rflags(vcpu, regs->rflags);
 
-        kvm_arch_ops->decache_regs(vcpu);
+        kvm_x86_ops->decache_regs(vcpu);
 
         vcpu_put(vcpu);
 
@@ -1996,13 +2229,14 @@ static int kvm_vcpu_ioctl_set_regs(struct kvm_vcpu *vcpu,
 static void get_segment(struct kvm_vcpu *vcpu,
                         struct kvm_segment *var, int seg)
 {
-        return kvm_arch_ops->get_segment(vcpu, var, seg);
+        return kvm_x86_ops->get_segment(vcpu, var, seg);
 }
 
 static int kvm_vcpu_ioctl_get_sregs(struct kvm_vcpu *vcpu,
                                     struct kvm_sregs *sregs)
 {
         struct descriptor_table dt;
+        int pending_vec;
 
         vcpu_load(vcpu);
 
@@ -2016,24 +2250,31 @@ static int kvm_vcpu_ioctl_get_sregs(struct kvm_vcpu *vcpu,
         get_segment(vcpu, &sregs->tr, VCPU_SREG_TR);
         get_segment(vcpu, &sregs->ldt, VCPU_SREG_LDTR);
 
-        kvm_arch_ops->get_idt(vcpu, &dt);
+        kvm_x86_ops->get_idt(vcpu, &dt);
         sregs->idt.limit = dt.limit;
         sregs->idt.base = dt.base;
-        kvm_arch_ops->get_gdt(vcpu, &dt);
+        kvm_x86_ops->get_gdt(vcpu, &dt);
         sregs->gdt.limit = dt.limit;
         sregs->gdt.base = dt.base;
 
-        kvm_arch_ops->decache_cr4_guest_bits(vcpu);
+        kvm_x86_ops->decache_cr4_guest_bits(vcpu);
         sregs->cr0 = vcpu->cr0;
         sregs->cr2 = vcpu->cr2;
         sregs->cr3 = vcpu->cr3;
         sregs->cr4 = vcpu->cr4;
-        sregs->cr8 = vcpu->cr8;
+        sregs->cr8 = get_cr8(vcpu);
         sregs->efer = vcpu->shadow_efer;
-        sregs->apic_base = vcpu->apic_base;
-
-        memcpy(sregs->interrupt_bitmap, vcpu->irq_pending,
-               sizeof sregs->interrupt_bitmap);
+        sregs->apic_base = kvm_get_apic_base(vcpu);
+
+        if (irqchip_in_kernel(vcpu->kvm)) {
+                memset(sregs->interrupt_bitmap, 0,
+                       sizeof sregs->interrupt_bitmap);
+                pending_vec = kvm_x86_ops->get_irq(vcpu);
+                if (pending_vec >= 0)
+                        set_bit(pending_vec, (unsigned long *)sregs->interrupt_bitmap);
+        } else
+                memcpy(sregs->interrupt_bitmap, vcpu->irq_pending,
+                       sizeof sregs->interrupt_bitmap);
 
         vcpu_put(vcpu);
 
@@ -2043,56 +2284,69 @@ static int kvm_vcpu_ioctl_get_sregs(struct kvm_vcpu *vcpu,
 static void set_segment(struct kvm_vcpu *vcpu,
                         struct kvm_segment *var, int seg)
 {
-        return kvm_arch_ops->set_segment(vcpu, var, seg);
+        return kvm_x86_ops->set_segment(vcpu, var, seg);
 }
 
 static int kvm_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
                                     struct kvm_sregs *sregs)
 {
         int mmu_reset_needed = 0;
-        int i;
+        int i, pending_vec, max_bits;
         struct descriptor_table dt;
 
         vcpu_load(vcpu);
 
         dt.limit = sregs->idt.limit;
         dt.base = sregs->idt.base;
-        kvm_arch_ops->set_idt(vcpu, &dt);
+        kvm_x86_ops->set_idt(vcpu, &dt);
         dt.limit = sregs->gdt.limit;
         dt.base = sregs->gdt.base;
-        kvm_arch_ops->set_gdt(vcpu, &dt);
+        kvm_x86_ops->set_gdt(vcpu, &dt);
 
         vcpu->cr2 = sregs->cr2;
         mmu_reset_needed |= vcpu->cr3 != sregs->cr3;
         vcpu->cr3 = sregs->cr3;
 
-        vcpu->cr8 = sregs->cr8;
+        set_cr8(vcpu, sregs->cr8);
 
         mmu_reset_needed |= vcpu->shadow_efer != sregs->efer;
 #ifdef CONFIG_X86_64
-        kvm_arch_ops->set_efer(vcpu, sregs->efer);
+        kvm_x86_ops->set_efer(vcpu, sregs->efer);
 #endif
-        vcpu->apic_base = sregs->apic_base;
+        kvm_set_apic_base(vcpu, sregs->apic_base);
 
-        kvm_arch_ops->decache_cr4_guest_bits(vcpu);
+        kvm_x86_ops->decache_cr4_guest_bits(vcpu);
 
         mmu_reset_needed |= vcpu->cr0 != sregs->cr0;
-        kvm_arch_ops->set_cr0(vcpu, sregs->cr0);
+        vcpu->cr0 = sregs->cr0;
+        kvm_x86_ops->set_cr0(vcpu, sregs->cr0);
 
         mmu_reset_needed |= vcpu->cr4 != sregs->cr4;
-        kvm_arch_ops->set_cr4(vcpu, sregs->cr4);
+        kvm_x86_ops->set_cr4(vcpu, sregs->cr4);
         if (!is_long_mode(vcpu) && is_pae(vcpu))
                 load_pdptrs(vcpu, vcpu->cr3);
 
         if (mmu_reset_needed)
                 kvm_mmu_reset_context(vcpu);
 
-        memcpy(vcpu->irq_pending, sregs->interrupt_bitmap,
-               sizeof vcpu->irq_pending);
-        vcpu->irq_summary = 0;
-        for (i = 0; i < NR_IRQ_WORDS; ++i)
-                if (vcpu->irq_pending[i])
-                        __set_bit(i, &vcpu->irq_summary);
+        if (!irqchip_in_kernel(vcpu->kvm)) {
+                memcpy(vcpu->irq_pending, sregs->interrupt_bitmap,
+                       sizeof vcpu->irq_pending);
+                vcpu->irq_summary = 0;
+                for (i = 0; i < ARRAY_SIZE(vcpu->irq_pending); ++i)
+                        if (vcpu->irq_pending[i])
+                                __set_bit(i, &vcpu->irq_summary);
+        } else {
+                max_bits = (sizeof sregs->interrupt_bitmap) << 3;
+                pending_vec = find_first_bit(
+                        (const unsigned long *)sregs->interrupt_bitmap,
+                        max_bits);
+                /* Only pending external irq is handled here */
+                if (pending_vec < max_bits) {
+                        kvm_x86_ops->set_irq(vcpu, pending_vec);
+                        printk("Set back pending irq %d\n", pending_vec);
+                }
+        }
 
         set_segment(vcpu, &sregs->cs, VCPU_SREG_CS);
         set_segment(vcpu, &sregs->ds, VCPU_SREG_DS);
@@ -2109,6 +2363,16 @@ static int kvm_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
         return 0;
 }
 
+void kvm_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l)
+{
+        struct kvm_segment cs;
+
+        get_segment(vcpu, &cs, VCPU_SREG_CS);
+        *db = cs.db;
+        *l = cs.l;
+}
+EXPORT_SYMBOL_GPL(kvm_get_cs_db_l_bits);
+
 /*
  * List of msr numbers which we expose to userspace through KVM_GET_MSRS
  * and KVM_SET_MSRS, and KVM_GET_MSR_INDEX_LIST.
@@ -2236,13 +2500,13 @@ static int kvm_vcpu_ioctl_translate(struct kvm_vcpu *vcpu,
         gpa_t gpa;
 
         vcpu_load(vcpu);
-        spin_lock(&vcpu->kvm->lock);
+        mutex_lock(&vcpu->kvm->lock);
         gpa = vcpu->mmu.gva_to_gpa(vcpu, vaddr);
         tr->physical_address = gpa;
         tr->valid = gpa != UNMAPPED_GVA;
         tr->writeable = 1;
         tr->usermode = 0;
-        spin_unlock(&vcpu->kvm->lock);
+        mutex_unlock(&vcpu->kvm->lock);
         vcpu_put(vcpu);
 
         return 0;
@@ -2253,6 +2517,8 @@ static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
 {
         if (irq->irq < 0 || irq->irq >= 256)
                 return -EINVAL;
+        if (irqchip_in_kernel(vcpu->kvm))
+                return -ENXIO;
         vcpu_load(vcpu);
 
         set_bit(irq->irq, vcpu->irq_pending);
@@ -2270,7 +2536,7 @@ static int kvm_vcpu_ioctl_debug_guest(struct kvm_vcpu *vcpu,
 
         vcpu_load(vcpu);
 
-        r = kvm_arch_ops->set_guest_debug(vcpu, dbg);
+        r = kvm_x86_ops->set_guest_debug(vcpu, dbg);
 
         vcpu_put(vcpu);
 
@@ -2285,7 +2551,6 @@ static struct page *kvm_vcpu_nopage(struct vm_area_struct *vma,
         unsigned long pgoff;
         struct page *page;
 
-        *type = VM_FAULT_MINOR;
         pgoff = ((address - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
         if (pgoff == 0)
                 page = virt_to_page(vcpu->run);
@@ -2294,6 +2559,9 @@ static struct page *kvm_vcpu_nopage(struct vm_area_struct *vma,
         else
                 return NOPAGE_SIGBUS;
         get_page(page);
+        if (type != NULL)
+                *type = VM_FAULT_MINOR;
+
         return page;
 }
 
@@ -2346,74 +2614,52 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, int n)
 {
         int r;
         struct kvm_vcpu *vcpu;
-        struct page *page;
 
-        r = -EINVAL;
         if (!valid_vcpu(n))
-                goto out;
-
-        vcpu = &kvm->vcpus[n];
-
-        mutex_lock(&vcpu->mutex);
-
-        if (vcpu->vmcs) {
-                mutex_unlock(&vcpu->mutex);
-                return -EEXIST;
-        }
-
-        page = alloc_page(GFP_KERNEL | __GFP_ZERO);
-        r = -ENOMEM;
-        if (!page)
-                goto out_unlock;
-        vcpu->run = page_address(page);
-
-        page = alloc_page(GFP_KERNEL | __GFP_ZERO);
-        r = -ENOMEM;
-        if (!page)
-                goto out_free_run;
-        vcpu->pio_data = page_address(page);
+                return -EINVAL;
 
-        vcpu->host_fx_image = (char*)ALIGN((hva_t)vcpu->fx_buf,
-                                           FX_IMAGE_ALIGN);
-        vcpu->guest_fx_image = vcpu->host_fx_image + FX_IMAGE_SIZE;
-        vcpu->cr0 = 0x10;
+        vcpu = kvm_x86_ops->vcpu_create(kvm, n);
+        if (IS_ERR(vcpu))
+                return PTR_ERR(vcpu);
 
-        r = kvm_arch_ops->vcpu_create(vcpu);
-        if (r < 0)
-                goto out_free_vcpus;
+        preempt_notifier_init(&vcpu->preempt_notifier, &kvm_preempt_ops);
 
-        r = kvm_mmu_create(vcpu);
-        if (r < 0)
-                goto out_free_vcpus;
+        /* We do fxsave: this must be aligned. */
+        BUG_ON((unsigned long)&vcpu->host_fx_image & 0xF);
 
-        kvm_arch_ops->vcpu_load(vcpu);
+        vcpu_load(vcpu);
         r = kvm_mmu_setup(vcpu);
-        if (r >= 0)
-                r = kvm_arch_ops->vcpu_setup(vcpu);
         vcpu_put(vcpu);
-
         if (r < 0)
-                goto out_free_vcpus;
+                goto free_vcpu;
 
+        mutex_lock(&kvm->lock);
+        if (kvm->vcpus[n]) {
+                r = -EEXIST;
+                mutex_unlock(&kvm->lock);
+                goto mmu_unload;
+        }
+        kvm->vcpus[n] = vcpu;
+        mutex_unlock(&kvm->lock);
+
+        /* Now it's all set up, let userspace reach it */
         r = create_vcpu_fd(vcpu);
         if (r < 0)
-                goto out_free_vcpus;
+                goto unlink;
+        return r;
 
-        spin_lock(&kvm_lock);
-        if (n >= kvm->nvcpus)
-                kvm->nvcpus = n + 1;
-        spin_unlock(&kvm_lock);
+unlink:
+        mutex_lock(&kvm->lock);
+        kvm->vcpus[n] = NULL;
+        mutex_unlock(&kvm->lock);
 
-        return r;
+mmu_unload:
+        vcpu_load(vcpu);
+        kvm_mmu_unload(vcpu);
+        vcpu_put(vcpu);
 
-out_free_vcpus:
-        kvm_free_vcpu(vcpu);
-out_free_run:
-        free_page((unsigned long)vcpu->run);
-        vcpu->run = NULL;
-out_unlock:
-        mutex_unlock(&vcpu->mutex);
-out:
+free_vcpu:
+        kvm_x86_ops->vcpu_free(vcpu);
         return r;
 }
 
@@ -2493,7 +2739,7 @@ struct fxsave {
 
 static int kvm_vcpu_ioctl_get_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
 {
-        struct fxsave *fxsave = (struct fxsave *)vcpu->guest_fx_image;
+        struct fxsave *fxsave = (struct fxsave *)&vcpu->guest_fx_image;
 
         vcpu_load(vcpu);
 
@@ -2513,7 +2759,7 @@ static int kvm_vcpu_ioctl_get_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
 
 static int kvm_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
 {
-        struct fxsave *fxsave = (struct fxsave *)vcpu->guest_fx_image;
+        struct fxsave *fxsave = (struct fxsave *)&vcpu->guest_fx_image;
 
         vcpu_load(vcpu);
 
@@ -2531,6 +2777,27 @@ static int kvm_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
         return 0;
 }
 
+static int kvm_vcpu_ioctl_get_lapic(struct kvm_vcpu *vcpu,
+                                    struct kvm_lapic_state *s)
+{
+        vcpu_load(vcpu);
+        memcpy(s->regs, vcpu->apic->regs, sizeof *s);
+        vcpu_put(vcpu);
+
+        return 0;
+}
+
+static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
+                                    struct kvm_lapic_state *s)
+{
+        vcpu_load(vcpu);
+        memcpy(vcpu->apic->regs, s->regs, sizeof *s);
+        kvm_apic_post_state_restore(vcpu);
+        vcpu_put(vcpu);
+
+        return 0;
+}
+
 static long kvm_vcpu_ioctl(struct file *filp,
                            unsigned int ioctl, unsigned long arg)
 {
@@ -2700,6 +2967,31 @@ static long kvm_vcpu_ioctl(struct file *filp,
                 r = 0;
                 break;
         }
+        case KVM_GET_LAPIC: {
+                struct kvm_lapic_state lapic;
+
+                memset(&lapic, 0, sizeof lapic);
+                r = kvm_vcpu_ioctl_get_lapic(vcpu, &lapic);
+                if (r)
+                        goto out;
+                r = -EFAULT;
+                if (copy_to_user(argp, &lapic, sizeof lapic))
+                        goto out;
+                r = 0;
+                break;
+        }
+        case KVM_SET_LAPIC: {
+                struct kvm_lapic_state lapic;
+
+                r = -EFAULT;
+                if (copy_from_user(&lapic, argp, sizeof lapic))
+                        goto out;
+                r = kvm_vcpu_ioctl_set_lapic(vcpu, &lapic);;
+                if (r)
+                        goto out;
+                r = 0;
+                break;
+        }
         default:
                 ;
         }
@@ -2753,6 +3045,75 @@ static long kvm_vm_ioctl(struct file *filp,
                         goto out;
                 break;
         }
+        case KVM_CREATE_IRQCHIP:
+                r = -ENOMEM;
+                kvm->vpic = kvm_create_pic(kvm);
+                if (kvm->vpic) {
+                        r = kvm_ioapic_init(kvm);
+                        if (r) {
+                                kfree(kvm->vpic);
+                                kvm->vpic = NULL;
+                                goto out;
+                        }
+                }
+                else
+                        goto out;
+                break;
+        case KVM_IRQ_LINE: {
+                struct kvm_irq_level irq_event;
+
+                r = -EFAULT;
+                if (copy_from_user(&irq_event, argp, sizeof irq_event))
+                        goto out;
+                if (irqchip_in_kernel(kvm)) {
+                        mutex_lock(&kvm->lock);
+                        if (irq_event.irq < 16)
+                                kvm_pic_set_irq(pic_irqchip(kvm),
+                                        irq_event.irq,
+                                        irq_event.level);
+                        kvm_ioapic_set_irq(kvm->vioapic,
+                                        irq_event.irq,
+                                        irq_event.level);
+                        mutex_unlock(&kvm->lock);
+                        r = 0;
+                }
+                break;
+        }
+        case KVM_GET_IRQCHIP: {
+                /* 0: PIC master, 1: PIC slave, 2: IOAPIC */
+                struct kvm_irqchip chip;
+
+                r = -EFAULT;
+                if (copy_from_user(&chip, argp, sizeof chip))
+                        goto out;
+                r = -ENXIO;
+                if (!irqchip_in_kernel(kvm))
+                        goto out;
+                r = kvm_vm_ioctl_get_irqchip(kvm, &chip);
+                if (r)
+                        goto out;
+                r = -EFAULT;
+                if (copy_to_user(argp, &chip, sizeof chip))
+                        goto out;
+                r = 0;
+                break;
+        }
+        case KVM_SET_IRQCHIP: {
+                /* 0: PIC master, 1: PIC slave, 2: IOAPIC */
+                struct kvm_irqchip chip;
+
+                r = -EFAULT;
+                if (copy_from_user(&chip, argp, sizeof chip))
+                        goto out;
+                r = -ENXIO;
+                if (!irqchip_in_kernel(kvm))
+                        goto out;
+                r = kvm_vm_ioctl_set_irqchip(kvm, &chip);
+                if (r)
+                        goto out;
+                r = 0;
+                break;
+        }
         default:
                 ;
         }
@@ -2768,12 +3129,14 @@ static struct page *kvm_vm_nopage(struct vm_area_struct *vma,
         unsigned long pgoff;
         struct page *page;
 
-        *type = VM_FAULT_MINOR;
         pgoff = ((address - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
         page = gfn_to_page(kvm, pgoff);
         if (!page)
                 return NOPAGE_SIGBUS;
         get_page(page);
+        if (type != NULL)
+                *type = VM_FAULT_MINOR;
+
         return page;
 }
 
@@ -2861,12 +3224,20 @@ static long kvm_dev_ioctl(struct file *filp,
                 r = 0;
                 break;
         }
-        case KVM_CHECK_EXTENSION:
-                /*
-                 * No extensions defined at present.
-                 */
-                r = 0;
+        case KVM_CHECK_EXTENSION: {
+                int ext = (long)argp;
+
+                switch (ext) {
+                case KVM_CAP_IRQCHIP:
+                case KVM_CAP_HLT:
+                        r = 1;
+                        break;
+                default:
+                        r = 0;
+                        break;
+                }
                 break;
+        }
         case KVM_GET_VCPU_MMAP_SIZE:
                 r = -EINVAL;
                 if (arg)
@@ -2881,8 +3252,6 @@ out:
 }
 
 static struct file_operations kvm_chardev_ops = {
-        .open           = kvm_dev_open,
-        .release        = kvm_dev_release,
         .unlocked_ioctl = kvm_dev_ioctl,
         .compat_ioctl   = kvm_dev_ioctl,
 };
@@ -2893,25 +3262,6 @@ static struct miscdevice kvm_dev = {
         &kvm_chardev_ops,
 };
 
-static int kvm_reboot(struct notifier_block *notifier, unsigned long val,
-                       void *v)
-{
-        if (val == SYS_RESTART) {
-                /*
-                 * Some (well, at least mine) BIOSes hang on reboot if
-                 * in vmx root mode.
-                 */
-                printk(KERN_INFO "kvm: exiting hardware virtualization\n");
-                on_each_cpu(hardware_disable, NULL, 0, 1);
-        }
-        return NOTIFY_OK;
-}
-
-static struct notifier_block kvm_reboot_notifier = {
-        .notifier_call = kvm_reboot,
-        .priority = 0,
-};
-
 /*
  * Make sure that a cpu that is being hot-unplugged does not have any vcpus
  * cached on it.
@@ -2925,7 +3275,9 @@ static void decache_vcpus_on_cpu(int cpu)
         spin_lock(&kvm_lock);
         list_for_each_entry(vm, &vm_list, vm_list)
                 for (i = 0; i < KVM_MAX_VCPUS; ++i) {
-                        vcpu = &vm->vcpus[i];
+                        vcpu = vm->vcpus[i];
+                        if (!vcpu)
+                                continue;
                         /*
                          * If the vcpu is locked, then it is running on some
                          * other cpu and therefore it is not cached on the
@@ -2936,7 +3288,7 @@ static void decache_vcpus_on_cpu(int cpu)
                          */
                         if (mutex_trylock(&vcpu->mutex)) {
                                 if (vcpu->cpu == cpu) {
-                                        kvm_arch_ops->vcpu_decache(vcpu);
+                                        kvm_x86_ops->vcpu_decache(vcpu);
                                         vcpu->cpu = -1;
                                 }
                                 mutex_unlock(&vcpu->mutex);
@@ -2952,7 +3304,7 @@ static void hardware_enable(void *junk)
         if (cpu_isset(cpu, cpus_hardware_enabled))
                 return;
         cpu_set(cpu, cpus_hardware_enabled);
-        kvm_arch_ops->hardware_enable(NULL);
+        kvm_x86_ops->hardware_enable(NULL);
 }
 
 static void hardware_disable(void *junk)
@@ -2963,7 +3315,7 @@ static void hardware_disable(void *junk)
                 return;
         cpu_clear(cpu, cpus_hardware_enabled);
         decache_vcpus_on_cpu(cpu);
-        kvm_arch_ops->hardware_disable(NULL);
+        kvm_x86_ops->hardware_disable(NULL);
 }
 
 static int kvm_cpu_hotplug(struct notifier_block *notifier, unsigned long val,
@@ -2994,6 +3346,25 @@ static int kvm_cpu_hotplug(struct notifier_block *notifier, unsigned long val,
         return NOTIFY_OK;
 }
 
+static int kvm_reboot(struct notifier_block *notifier, unsigned long val,
+                       void *v)
+{
+        if (val == SYS_RESTART) {
+                /*
+                 * Some (well, at least mine) BIOSes hang on reboot if
+                 * in vmx root mode.
+                 */
+                printk(KERN_INFO "kvm: exiting hardware virtualization\n");
+                on_each_cpu(hardware_disable, NULL, 0, 1);
+        }
+        return NOTIFY_OK;
+}
+
+static struct notifier_block kvm_reboot_notifier = {
+        .notifier_call = kvm_reboot,
+        .priority = 0,
+};
+
 void kvm_io_bus_init(struct kvm_io_bus *bus)
 {
         memset(bus, 0, sizeof(*bus));
@@ -3047,18 +3418,15 @@ static u64 stat_get(void *_offset)
         spin_lock(&kvm_lock);
         list_for_each_entry(kvm, &vm_list, vm_list)
                 for (i = 0; i < KVM_MAX_VCPUS; ++i) {
-                        vcpu = &kvm->vcpus[i];
-                        total += *(u32 *)((void *)vcpu + offset);
+                        vcpu = kvm->vcpus[i];
+                        if (vcpu)
+                                total += *(u32 *)((void *)vcpu + offset);
                 }
         spin_unlock(&kvm_lock);
         return total;
 }
 
-static void stat_set(void *offset, u64 val)
-{
-}
-
-DEFINE_SIMPLE_ATTRIBUTE(stat_fops, stat_get, stat_set, "%llu\n");
+DEFINE_SIMPLE_ATTRIBUTE(stat_fops, stat_get, NULL, "%llu\n");
 
 static __init void kvm_init_debug(void)
 {
@@ -3105,11 +3473,34 @@ static struct sys_device kvm_sysdev = {
 
 hpa_t bad_page_address;
 
-int kvm_init_arch(struct kvm_arch_ops *ops, struct module *module)
+static inline
+struct kvm_vcpu *preempt_notifier_to_vcpu(struct preempt_notifier *pn)
+{
+        return container_of(pn, struct kvm_vcpu, preempt_notifier);
+}
+
+static void kvm_sched_in(struct preempt_notifier *pn, int cpu)
+{
+        struct kvm_vcpu *vcpu = preempt_notifier_to_vcpu(pn);
+
+        kvm_x86_ops->vcpu_load(vcpu, cpu);
+}
+
+static void kvm_sched_out(struct preempt_notifier *pn,
+                          struct task_struct *next)
+{
+        struct kvm_vcpu *vcpu = preempt_notifier_to_vcpu(pn);
+
+        kvm_x86_ops->vcpu_put(vcpu);
+}
+
+int kvm_init_x86(struct kvm_x86_ops *ops, unsigned int vcpu_size,
+                  struct module *module)
 {
         int r;
+        int cpu;
 
-        if (kvm_arch_ops) {
+        if (kvm_x86_ops) {
                 printk(KERN_ERR "kvm: already loaded the other module\n");
                 return -EEXIST;
         }
@@ -3123,12 +3514,20 @@ int kvm_init_arch(struct kvm_arch_ops *ops, struct module *module)
                 return -EOPNOTSUPP;
         }
 
-        kvm_arch_ops = ops;
+        kvm_x86_ops = ops;
 
-        r = kvm_arch_ops->hardware_setup();
+        r = kvm_x86_ops->hardware_setup();
         if (r < 0)
                 goto out;
 
+        for_each_online_cpu(cpu) {
+                smp_call_function_single(cpu,
+                                kvm_x86_ops->check_processor_compatibility,
+                                &r, 0, 1);
+                if (r < 0)
+                        goto out_free_0;
+        }
+
         on_each_cpu(hardware_enable, NULL, 0, 1);
         r = register_cpu_notifier(&kvm_cpu_notifier);
         if (r)
@@ -3143,6 +3542,14 @@ int kvm_init_arch(struct kvm_arch_ops *ops, struct module *module)
         if (r)
                 goto out_free_3;
 
+        /* A kmem cache lets us meet the alignment requirements of fx_save. */
+        kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size,
+                                           __alignof__(struct kvm_vcpu), 0, 0);
+        if (!kvm_vcpu_cache) {
+                r = -ENOMEM;
+                goto out_free_4;
+        }
+
         kvm_chardev_ops.owner = module;
 
         r = misc_register(&kvm_dev);
@@ -3151,9 +3558,14 @@ int kvm_init_arch(struct kvm_arch_ops *ops, struct module *module)
                 goto out_free;
         }
 
+        kvm_preempt_ops.sched_in = kvm_sched_in;
+        kvm_preempt_ops.sched_out = kvm_sched_out;
+
         return r;
 
 out_free:
+        kmem_cache_destroy(kvm_vcpu_cache);
+out_free_4:
         sysdev_unregister(&kvm_sysdev);
 out_free_3:
         sysdev_class_unregister(&kvm_sysdev_class);
@@ -3162,22 +3574,24 @@ out_free_2:
         unregister_cpu_notifier(&kvm_cpu_notifier);
 out_free_1:
         on_each_cpu(hardware_disable, NULL, 0, 1);
-        kvm_arch_ops->hardware_unsetup();
+out_free_0:
+        kvm_x86_ops->hardware_unsetup();
 out:
-        kvm_arch_ops = NULL;
+        kvm_x86_ops = NULL;
         return r;
 }
 
-void kvm_exit_arch(void)
+void kvm_exit_x86(void)
 {
         misc_deregister(&kvm_dev);
+        kmem_cache_destroy(kvm_vcpu_cache);
         sysdev_unregister(&kvm_sysdev);
         sysdev_class_unregister(&kvm_sysdev_class);
         unregister_reboot_notifier(&kvm_reboot_notifier);
         unregister_cpu_notifier(&kvm_cpu_notifier);
         on_each_cpu(hardware_disable, NULL, 0, 1);
-        kvm_arch_ops->hardware_unsetup();
-        kvm_arch_ops = NULL;
+        kvm_x86_ops->hardware_unsetup();
+        kvm_x86_ops = NULL;
 }
 
 static __init int kvm_init(void)
@@ -3220,5 +3634,5 @@ static __exit void kvm_exit(void)
 module_init(kvm_init)
 module_exit(kvm_exit)
 
-EXPORT_SYMBOL_GPL(kvm_init_arch);
-EXPORT_SYMBOL_GPL(kvm_exit_arch);
+EXPORT_SYMBOL_GPL(kvm_init_x86);
+EXPORT_SYMBOL_GPL(kvm_exit_x86);
diff --git a/drivers/kvm/kvm_svm.h b/drivers/kvm/kvm_svm.h
index a869983d683d..a0e415daef5b 100644
--- a/drivers/kvm/kvm_svm.h
+++ b/drivers/kvm/kvm_svm.h
@@ -20,7 +20,10 @@ static const u32 host_save_user_msrs[] = {
 #define NR_HOST_SAVE_USER_MSRS ARRAY_SIZE(host_save_user_msrs)
 #define NUM_DB_REGS 4
 
+struct kvm_vcpu;
+
 struct vcpu_svm {
+        struct kvm_vcpu vcpu;
         struct vmcb *vmcb;
         unsigned long vmcb_pa;
         struct svm_cpu_data *svm_data;
diff --git a/drivers/kvm/lapic.c b/drivers/kvm/lapic.c
new file mode 100644
index 000000000000..a190587cf6a5
--- /dev/null
+++ b/drivers/kvm/lapic.c
@@ -0,0 +1,1064 @@
+
+/*
+ * Local APIC virtualization
+ *
+ * Copyright (C) 2006 Qumranet, Inc.
+ * Copyright (C) 2007 Novell
+ * Copyright (C) 2007 Intel
+ *
+ * Authors:
+ *   Dor Laor <dor.laor@qumranet.com>
+ *   Gregory Haskins <ghaskins@novell.com>
+ *   Yaozu (Eddie) Dong <eddie.dong@intel.com>
+ *
+ * Based on Xen 3.1 code, Copyright (c) 2004, Intel Corporation.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#include "kvm.h"
+#include <linux/kvm.h>
+#include <linux/mm.h>
+#include <linux/highmem.h>
+#include <linux/smp.h>
+#include <linux/hrtimer.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <asm/processor.h>
+#include <asm/msr.h>
+#include <asm/page.h>
+#include <asm/current.h>
+#include <asm/apicdef.h>
+#include <asm/atomic.h>
+#include <asm/div64.h>
+#include "irq.h"
+
+#define PRId64 "d"
+#define PRIx64 "llx"
+#define PRIu64 "u"
+#define PRIo64 "o"
+
+#define APIC_BUS_CYCLE_NS 1
+
+/* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
+#define apic_debug(fmt, arg...)
+
+#define APIC_LVT_NUM                    6
+/* 14 is the version for Xeon and Pentium 8.4.8*/
+#define APIC_VERSION                    (0x14UL | ((APIC_LVT_NUM - 1) << 16))
+#define LAPIC_MMIO_LENGTH               (1 << 12)
+/* followed define is not in apicdef.h */
+#define APIC_SHORT_MASK                 0xc0000
+#define APIC_DEST_NOSHORT               0x0
+#define APIC_DEST_MASK                  0x800
+#define MAX_APIC_VECTOR                 256
+
+#define VEC_POS(v) ((v) & (32 - 1))
+#define REG_POS(v) (((v) >> 5) << 4)
+static inline u32 apic_get_reg(struct kvm_lapic *apic, int reg_off)
+{
+        return *((u32 *) (apic->regs + reg_off));
+}
+
+static inline void apic_set_reg(struct kvm_lapic *apic, int reg_off, u32 val)
+{
+        *((u32 *) (apic->regs + reg_off)) = val;
+}
+
+static inline int apic_test_and_set_vector(int vec, void *bitmap)
+{
+        return test_and_set_bit(VEC_POS(vec), (bitmap) + REG_POS(vec));
+}
+
+static inline int apic_test_and_clear_vector(int vec, void *bitmap)
+{
+        return test_and_clear_bit(VEC_POS(vec), (bitmap) + REG_POS(vec));
+}
+
+static inline void apic_set_vector(int vec, void *bitmap)
+{
+        set_bit(VEC_POS(vec), (bitmap) + REG_POS(vec));
+}
+
+static inline void apic_clear_vector(int vec, void *bitmap)
+{
+        clear_bit(VEC_POS(vec), (bitmap) + REG_POS(vec));
+}
+
+static inline int apic_hw_enabled(struct kvm_lapic *apic)
+{
+        return (apic)->vcpu->apic_base & MSR_IA32_APICBASE_ENABLE;
+}
+
+static inline int  apic_sw_enabled(struct kvm_lapic *apic)
+{
+        return apic_get_reg(apic, APIC_SPIV) & APIC_SPIV_APIC_ENABLED;
+}
+
+static inline int apic_enabled(struct kvm_lapic *apic)
+{
+        return apic_sw_enabled(apic) && apic_hw_enabled(apic);
+}
+
+#define LVT_MASK        \
+        (APIC_LVT_MASKED | APIC_SEND_PENDING | APIC_VECTOR_MASK)
+
+#define LINT_MASK       \
+        (LVT_MASK | APIC_MODE_MASK | APIC_INPUT_POLARITY | \
+         APIC_LVT_REMOTE_IRR | APIC_LVT_LEVEL_TRIGGER)
+
+static inline int kvm_apic_id(struct kvm_lapic *apic)
+{
+        return (apic_get_reg(apic, APIC_ID) >> 24) & 0xff;
+}
+
+static inline int apic_lvt_enabled(struct kvm_lapic *apic, int lvt_type)
+{
+        return !(apic_get_reg(apic, lvt_type) & APIC_LVT_MASKED);
+}
+
+static inline int apic_lvt_vector(struct kvm_lapic *apic, int lvt_type)
+{
+        return apic_get_reg(apic, lvt_type) & APIC_VECTOR_MASK;
+}
+
+static inline int apic_lvtt_period(struct kvm_lapic *apic)
+{
+        return apic_get_reg(apic, APIC_LVTT) & APIC_LVT_TIMER_PERIODIC;
+}
+
+static unsigned int apic_lvt_mask[APIC_LVT_NUM] = {
+        LVT_MASK | APIC_LVT_TIMER_PERIODIC,     /* LVTT */
+        LVT_MASK | APIC_MODE_MASK,      /* LVTTHMR */
+        LVT_MASK | APIC_MODE_MASK,      /* LVTPC */
+        LINT_MASK, LINT_MASK,   /* LVT0-1 */
+        LVT_MASK                /* LVTERR */
+};
+
+static int find_highest_vector(void *bitmap)
+{
+        u32 *word = bitmap;
+        int word_offset = MAX_APIC_VECTOR >> 5;
+
+        while ((word_offset != 0) && (word[(--word_offset) << 2] == 0))
+                continue;
+
+        if (likely(!word_offset && !word[0]))
+                return -1;
+        else
+                return fls(word[word_offset << 2]) - 1 + (word_offset << 5);
+}
+
+static inline int apic_test_and_set_irr(int vec, struct kvm_lapic *apic)
+{
+        return apic_test_and_set_vector(vec, apic->regs + APIC_IRR);
+}
+
+static inline void apic_clear_irr(int vec, struct kvm_lapic *apic)
+{
+        apic_clear_vector(vec, apic->regs + APIC_IRR);
+}
+
+static inline int apic_find_highest_irr(struct kvm_lapic *apic)
+{
+        int result;
+
+        result = find_highest_vector(apic->regs + APIC_IRR);
+        ASSERT(result == -1 || result >= 16);
+
+        return result;
+}
+
+int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu)
+{
+        struct kvm_lapic *apic = (struct kvm_lapic *)vcpu->apic;
+        int highest_irr;
+
+        if (!apic)
+                return 0;
+        highest_irr = apic_find_highest_irr(apic);
+
+        return highest_irr;
+}
+EXPORT_SYMBOL_GPL(kvm_lapic_find_highest_irr);
+
+int kvm_apic_set_irq(struct kvm_lapic *apic, u8 vec, u8 trig)
+{
+        if (!apic_test_and_set_irr(vec, apic)) {
+                /* a new pending irq is set in IRR */
+                if (trig)
+                        apic_set_vector(vec, apic->regs + APIC_TMR);
+                else
+                        apic_clear_vector(vec, apic->regs + APIC_TMR);
+                kvm_vcpu_kick(apic->vcpu);
+                return 1;
+        }
+        return 0;
+}
+
+static inline int apic_find_highest_isr(struct kvm_lapic *apic)
+{
+        int result;
+
+        result = find_highest_vector(apic->regs + APIC_ISR);
+        ASSERT(result == -1 || result >= 16);
+
+        return result;
+}
+
+static void apic_update_ppr(struct kvm_lapic *apic)
+{
+        u32 tpr, isrv, ppr;
+        int isr;
+
+        tpr = apic_get_reg(apic, APIC_TASKPRI);
+        isr = apic_find_highest_isr(apic);
+        isrv = (isr != -1) ? isr : 0;
+
+        if ((tpr & 0xf0) >= (isrv & 0xf0))
+                ppr = tpr & 0xff;
+        else
+                ppr = isrv & 0xf0;
+
+        apic_debug("vlapic %p, ppr 0x%x, isr 0x%x, isrv 0x%x",
+                   apic, ppr, isr, isrv);
+
+        apic_set_reg(apic, APIC_PROCPRI, ppr);
+}
+
+static void apic_set_tpr(struct kvm_lapic *apic, u32 tpr)
+{
+        apic_set_reg(apic, APIC_TASKPRI, tpr);
+        apic_update_ppr(apic);
+}
+
+int kvm_apic_match_physical_addr(struct kvm_lapic *apic, u16 dest)
+{
+        return kvm_apic_id(apic) == dest;
+}
+
+int kvm_apic_match_logical_addr(struct kvm_lapic *apic, u8 mda)
+{
+        int result = 0;
+        u8 logical_id;
+
+        logical_id = GET_APIC_LOGICAL_ID(apic_get_reg(apic, APIC_LDR));
+
+        switch (apic_get_reg(apic, APIC_DFR)) {
+        case APIC_DFR_FLAT:
+                if (logical_id & mda)
+                        result = 1;
+                break;
+        case APIC_DFR_CLUSTER:
+                if (((logical_id >> 4) == (mda >> 0x4))
+                    && (logical_id & mda & 0xf))
+                        result = 1;
+                break;
+        default:
+                printk(KERN_WARNING "Bad DFR vcpu %d: %08x\n",
+                       apic->vcpu->vcpu_id, apic_get_reg(apic, APIC_DFR));
+                break;
+        }
+
+        return result;
+}
+
+static int apic_match_dest(struct kvm_vcpu *vcpu, struct kvm_lapic *source,
+                           int short_hand, int dest, int dest_mode)
+{
+        int result = 0;
+        struct kvm_lapic *target = vcpu->apic;
+
+        apic_debug("target %p, source %p, dest 0x%x, "
+                   "dest_mode 0x%x, short_hand 0x%x",
+                   target, source, dest, dest_mode, short_hand);
+
+        ASSERT(!target);
+        switch (short_hand) {
+        case APIC_DEST_NOSHORT:
+                if (dest_mode == 0) {
+                        /* Physical mode. */
+                        if ((dest == 0xFF) || (dest == kvm_apic_id(target)))
+                                result = 1;
+                } else
+                        /* Logical mode. */
+                        result = kvm_apic_match_logical_addr(target, dest);
+                break;
+        case APIC_DEST_SELF:
+                if (target == source)
+                        result = 1;
+                break;
+        case APIC_DEST_ALLINC:
+                result = 1;
+                break;
+        case APIC_DEST_ALLBUT:
+                if (target != source)
+                        result = 1;
+                break;
+        default:
+                printk(KERN_WARNING "Bad dest shorthand value %x\n",
+                       short_hand);
+                break;
+        }
+
+        return result;
+}
+
+/*
+ * Add a pending IRQ into lapic.
+ * Return 1 if successfully added and 0 if discarded.
+ */
+static int __apic_accept_irq(struct kvm_lapic *apic, int delivery_mode,
+                             int vector, int level, int trig_mode)
+{
+        int orig_irr, result = 0;
+        struct kvm_vcpu *vcpu = apic->vcpu;
+
+        switch (delivery_mode) {
+        case APIC_DM_FIXED:
+        case APIC_DM_LOWEST:
+                /* FIXME add logic for vcpu on reset */
+                if (unlikely(!apic_enabled(apic)))
+                        break;
+
+                orig_irr = apic_test_and_set_irr(vector, apic);
+                if (orig_irr && trig_mode) {
+                        apic_debug("level trig mode repeatedly for vector %d",
+                                   vector);
+                        break;
+                }
+
+                if (trig_mode) {
+                        apic_debug("level trig mode for vector %d", vector);
+                        apic_set_vector(vector, apic->regs + APIC_TMR);
+                } else
+                        apic_clear_vector(vector, apic->regs + APIC_TMR);
+
+                if (vcpu->mp_state == VCPU_MP_STATE_RUNNABLE)
+                        kvm_vcpu_kick(vcpu);
+                else if (vcpu->mp_state == VCPU_MP_STATE_HALTED) {
+                        vcpu->mp_state = VCPU_MP_STATE_RUNNABLE;
+                        if (waitqueue_active(&vcpu->wq))
+                                wake_up_interruptible(&vcpu->wq);
+                }
+
+                result = (orig_irr == 0);
+                break;
+
+        case APIC_DM_REMRD:
+                printk(KERN_DEBUG "Ignoring delivery mode 3\n");
+                break;
+
+        case APIC_DM_SMI:
+                printk(KERN_DEBUG "Ignoring guest SMI\n");
+                break;
+        case APIC_DM_NMI:
+                printk(KERN_DEBUG "Ignoring guest NMI\n");
+                break;
+
+        case APIC_DM_INIT:
+                if (level) {
+                        if (vcpu->mp_state == VCPU_MP_STATE_RUNNABLE)
+                                printk(KERN_DEBUG
+                                       "INIT on a runnable vcpu %d\n",
+                                       vcpu->vcpu_id);
+                        vcpu->mp_state = VCPU_MP_STATE_INIT_RECEIVED;
+                        kvm_vcpu_kick(vcpu);
+                } else {
+                        printk(KERN_DEBUG
+                               "Ignoring de-assert INIT to vcpu %d\n",
+                               vcpu->vcpu_id);
+                }
+
+                break;
+
+        case APIC_DM_STARTUP:
+                printk(KERN_DEBUG "SIPI to vcpu %d vector 0x%02x\n",
+                       vcpu->vcpu_id, vector);
+                if (vcpu->mp_state == VCPU_MP_STATE_INIT_RECEIVED) {
+                        vcpu->sipi_vector = vector;
+                        vcpu->mp_state = VCPU_MP_STATE_SIPI_RECEIVED;
+                        if (waitqueue_active(&vcpu->wq))
+                                wake_up_interruptible(&vcpu->wq);
+                }
+                break;
+
+        default:
+                printk(KERN_ERR "TODO: unsupported delivery mode %x\n",
+                       delivery_mode);
+                break;
+        }
+        return result;
+}
+
+struct kvm_lapic *kvm_apic_round_robin(struct kvm *kvm, u8 vector,
+                                       unsigned long bitmap)
+{
+        int vcpu_id;
+        int last;
+        int next;
+        struct kvm_lapic *apic;
+
+        last = kvm->round_robin_prev_vcpu;
+        next = last;
+
+        do {
+                if (++next == KVM_MAX_VCPUS)
+                        next = 0;
+                if (kvm->vcpus[next] == NULL || !test_bit(next, &bitmap))
+                        continue;
+                apic = kvm->vcpus[next]->apic;
+                if (apic && apic_enabled(apic))
+                        break;
+                apic = NULL;
+        } while (next != last);
+        kvm->round_robin_prev_vcpu = next;
+
+        if (!apic) {
+                vcpu_id = ffs(bitmap) - 1;
+                if (vcpu_id < 0) {
+                        vcpu_id = 0;
+                        printk(KERN_DEBUG "vcpu not ready for apic_round_robin\n");
+                }
+                apic = kvm->vcpus[vcpu_id]->apic;
+        }
+
+        return apic;
+}
+
+static void apic_set_eoi(struct kvm_lapic *apic)
+{
+        int vector = apic_find_highest_isr(apic);
+
+        /*
+         * Not every write EOI will has corresponding ISR,
+         * one example is when Kernel check timer on setup_IO_APIC
+         */
+        if (vector == -1)
+                return;
+
+        apic_clear_vector(vector, apic->regs + APIC_ISR);
+        apic_update_ppr(apic);
+
+        if (apic_test_and_clear_vector(vector, apic->regs + APIC_TMR))
+                kvm_ioapic_update_eoi(apic->vcpu->kvm, vector);
+}
+
+static void apic_send_ipi(struct kvm_lapic *apic)
+{
+        u32 icr_low = apic_get_reg(apic, APIC_ICR);
+        u32 icr_high = apic_get_reg(apic, APIC_ICR2);
+
+        unsigned int dest = GET_APIC_DEST_FIELD(icr_high);
+        unsigned int short_hand = icr_low & APIC_SHORT_MASK;
+        unsigned int trig_mode = icr_low & APIC_INT_LEVELTRIG;
+        unsigned int level = icr_low & APIC_INT_ASSERT;
+        unsigned int dest_mode = icr_low & APIC_DEST_MASK;
+        unsigned int delivery_mode = icr_low & APIC_MODE_MASK;
+        unsigned int vector = icr_low & APIC_VECTOR_MASK;
+
+        struct kvm_lapic *target;
+        struct kvm_vcpu *vcpu;
+        unsigned long lpr_map = 0;
+        int i;
+
+        apic_debug("icr_high 0x%x, icr_low 0x%x, "
+                   "short_hand 0x%x, dest 0x%x, trig_mode 0x%x, level 0x%x, "
+                   "dest_mode 0x%x, delivery_mode 0x%x, vector 0x%x\n",
+                   icr_high, icr_low, short_hand, dest,
+                   trig_mode, level, dest_mode, delivery_mode, vector);
+
+        for (i = 0; i < KVM_MAX_VCPUS; i++) {
+                vcpu = apic->vcpu->kvm->vcpus[i];
+                if (!vcpu)
+                        continue;
+
+                if (vcpu->apic &&
+                    apic_match_dest(vcpu, apic, short_hand, dest, dest_mode)) {
+                        if (delivery_mode == APIC_DM_LOWEST)
+                                set_bit(vcpu->vcpu_id, &lpr_map);
+                        else
+                                __apic_accept_irq(vcpu->apic, delivery_mode,
+                                                  vector, level, trig_mode);
+                }
+        }
+
+        if (delivery_mode == APIC_DM_LOWEST) {
+                target = kvm_apic_round_robin(vcpu->kvm, vector, lpr_map);
+                if (target != NULL)
+                        __apic_accept_irq(target, delivery_mode,
+                                          vector, level, trig_mode);
+        }
+}
+
+static u32 apic_get_tmcct(struct kvm_lapic *apic)
+{
+        u32 counter_passed;
+        ktime_t passed, now = apic->timer.dev.base->get_time();
+        u32 tmcct = apic_get_reg(apic, APIC_TMICT);
+
+        ASSERT(apic != NULL);
+
+        if (unlikely(ktime_to_ns(now) <=
+                ktime_to_ns(apic->timer.last_update))) {
+                /* Wrap around */
+                passed = ktime_add(( {
+                                    (ktime_t) {
+                                    .tv64 = KTIME_MAX -
+                                    (apic->timer.last_update).tv64}; }
+                                   ), now);
+                apic_debug("time elapsed\n");
+        } else
+                passed = ktime_sub(now, apic->timer.last_update);
+
+        counter_passed = div64_64(ktime_to_ns(passed),
+                                  (APIC_BUS_CYCLE_NS * apic->timer.divide_count));
+        tmcct -= counter_passed;
+
+        if (tmcct <= 0) {
+                if (unlikely(!apic_lvtt_period(apic)))
+                        tmcct = 0;
+                else
+                        do {
+                                tmcct += apic_get_reg(apic, APIC_TMICT);
+                        } while (tmcct <= 0);
+        }
+
+        return tmcct;
+}
+
+static u32 __apic_read(struct kvm_lapic *apic, unsigned int offset)
+{
+        u32 val = 0;
+
+        if (offset >= LAPIC_MMIO_LENGTH)
+                return 0;
+
+        switch (offset) {
+        case APIC_ARBPRI:
+                printk(KERN_WARNING "Access APIC ARBPRI register "
+                       "which is for P6\n");
+                break;
+
+        case APIC_TMCCT:        /* Timer CCR */
+                val = apic_get_tmcct(apic);
+                break;
+
+        default:
+                apic_update_ppr(apic);
+                val = apic_get_reg(apic, offset);
+                break;
+        }
+
+        return val;
+}
+
+static void apic_mmio_read(struct kvm_io_device *this,
+                           gpa_t address, int len, void *data)
+{
+        struct kvm_lapic *apic = (struct kvm_lapic *)this->private;
+        unsigned int offset = address - apic->base_address;
+        unsigned char alignment = offset & 0xf;
+        u32 result;
+
+        if ((alignment + len) > 4) {
+                printk(KERN_ERR "KVM_APIC_READ: alignment error %lx %d",
+                       (unsigned long)address, len);
+                return;
+        }
+        result = __apic_read(apic, offset & ~0xf);
+
+        switch (len) {
+        case 1:
+        case 2:
+        case 4:
+                memcpy(data, (char *)&result + alignment, len);
+                break;
+        default:
+                printk(KERN_ERR "Local APIC read with len = %x, "
+                       "should be 1,2, or 4 instead\n", len);
+                break;
+        }
+}
+
+static void update_divide_count(struct kvm_lapic *apic)
+{
+        u32 tmp1, tmp2, tdcr;
+
+        tdcr = apic_get_reg(apic, APIC_TDCR);
+        tmp1 = tdcr & 0xf;
+        tmp2 = ((tmp1 & 0x3) | ((tmp1 & 0x8) >> 1)) + 1;
+        apic->timer.divide_count = 0x1 << (tmp2 & 0x7);
+
+        apic_debug("timer divide count is 0x%x\n",
+                                   apic->timer.divide_count);
+}
+
+static void start_apic_timer(struct kvm_lapic *apic)
+{
+        ktime_t now = apic->timer.dev.base->get_time();
+
+        apic->timer.last_update = now;
+
+        apic->timer.period = apic_get_reg(apic, APIC_TMICT) *
+                    APIC_BUS_CYCLE_NS * apic->timer.divide_count;
+        atomic_set(&apic->timer.pending, 0);
+        hrtimer_start(&apic->timer.dev,
+                      ktime_add_ns(now, apic->timer.period),
+                      HRTIMER_MODE_ABS);
+
+        apic_debug("%s: bus cycle is %" PRId64 "ns, now 0x%016"
+                           PRIx64 ", "
+                           "timer initial count 0x%x, period %lldns, "
+                           "expire @ 0x%016" PRIx64 ".\n", __FUNCTION__,
+                           APIC_BUS_CYCLE_NS, ktime_to_ns(now),
+                           apic_get_reg(apic, APIC_TMICT),
+                           apic->timer.period,
+                           ktime_to_ns(ktime_add_ns(now,
+                                        apic->timer.period)));
+}
+
+static void apic_mmio_write(struct kvm_io_device *this,
+                            gpa_t address, int len, const void *data)
+{
+        struct kvm_lapic *apic = (struct kvm_lapic *)this->private;
+        unsigned int offset = address - apic->base_address;
+        unsigned char alignment = offset & 0xf;
+        u32 val;
+
+        /*
+         * APIC register must be aligned on 128-bits boundary.
+         * 32/64/128 bits registers must be accessed thru 32 bits.
+         * Refer SDM 8.4.1
+         */
+        if (len != 4 || alignment) {
+                if (printk_ratelimit())
+                        printk(KERN_ERR "apic write: bad size=%d %lx\n",
+                               len, (long)address);
+                return;
+        }
+
+        val = *(u32 *) data;
+
+        /* too common printing */
+        if (offset != APIC_EOI)
+                apic_debug("%s: offset 0x%x with length 0x%x, and value is "
+                           "0x%x\n", __FUNCTION__, offset, len, val);
+
+        offset &= 0xff0;
+
+        switch (offset) {
+        case APIC_ID:           /* Local APIC ID */
+                apic_set_reg(apic, APIC_ID, val);
+                break;
+
+        case APIC_TASKPRI:
+                apic_set_tpr(apic, val & 0xff);
+                break;
+
+        case APIC_EOI:
+                apic_set_eoi(apic);
+                break;
+
+        case APIC_LDR:
+                apic_set_reg(apic, APIC_LDR, val & APIC_LDR_MASK);
+                break;
+
+        case APIC_DFR:
+                apic_set_reg(apic, APIC_DFR, val | 0x0FFFFFFF);
+                break;
+
+        case APIC_SPIV:
+                apic_set_reg(apic, APIC_SPIV, val & 0x3ff);
+                if (!(val & APIC_SPIV_APIC_ENABLED)) {
+                        int i;
+                        u32 lvt_val;
+
+                        for (i = 0; i < APIC_LVT_NUM; i++) {
+                                lvt_val = apic_get_reg(apic,
+                                                       APIC_LVTT + 0x10 * i);
+                                apic_set_reg(apic, APIC_LVTT + 0x10 * i,
+                                             lvt_val | APIC_LVT_MASKED);
+                        }
+                        atomic_set(&apic->timer.pending, 0);
+
+                }
+                break;
+
+        case APIC_ICR:
+                /* No delay here, so we always clear the pending bit */
+                apic_set_reg(apic, APIC_ICR, val & ~(1 << 12));
+                apic_send_ipi(apic);
+                break;
+
+        case APIC_ICR2:
+                apic_set_reg(apic, APIC_ICR2, val & 0xff000000);
+                break;
+
+        case APIC_LVTT:
+        case APIC_LVTTHMR:
+        case APIC_LVTPC:
+        case APIC_LVT0:
+        case APIC_LVT1:
+        case APIC_LVTERR:
+                /* TODO: Check vector */
+                if (!apic_sw_enabled(apic))
+                        val |= APIC_LVT_MASKED;
+
+                val &= apic_lvt_mask[(offset - APIC_LVTT) >> 4];
+                apic_set_reg(apic, offset, val);
+
+                break;
+
+        case APIC_TMICT:
+                hrtimer_cancel(&apic->timer.dev);
+                apic_set_reg(apic, APIC_TMICT, val);
+                start_apic_timer(apic);
+                return;
+
+        case APIC_TDCR:
+                if (val & 4)
+                        printk(KERN_ERR "KVM_WRITE:TDCR %x\n", val);
+                apic_set_reg(apic, APIC_TDCR, val);
+                update_divide_count(apic);
+                break;
+
+        default:
+                apic_debug("Local APIC Write to read-only register %x\n",
+                           offset);
+                break;
+        }
+
+}
+
+static int apic_mmio_range(struct kvm_io_device *this, gpa_t addr)
+{
+        struct kvm_lapic *apic = (struct kvm_lapic *)this->private;
+        int ret = 0;
+
+
+        if (apic_hw_enabled(apic) &&
+            (addr >= apic->base_address) &&
+            (addr < (apic->base_address + LAPIC_MMIO_LENGTH)))
+                ret = 1;
+
+        return ret;
+}
+
+void kvm_free_apic(struct kvm_lapic *apic)
+{
+        if (!apic)
+                return;
+
+        hrtimer_cancel(&apic->timer.dev);
+
+        if (apic->regs_page) {
+                __free_page(apic->regs_page);
+                apic->regs_page = 0;
+        }
+
+        kfree(apic);
+}
+
+/*
+ *----------------------------------------------------------------------
+ * LAPIC interface
+ *----------------------------------------------------------------------
+ */
+
+void kvm_lapic_set_tpr(struct kvm_vcpu *vcpu, unsigned long cr8)
+{
+        struct kvm_lapic *apic = (struct kvm_lapic *)vcpu->apic;
+
+        if (!apic)
+                return;
+        apic_set_tpr(apic, ((cr8 & 0x0f) << 4));
+}
+
+u64 kvm_lapic_get_cr8(struct kvm_vcpu *vcpu)
+{
+        struct kvm_lapic *apic = (struct kvm_lapic *)vcpu->apic;
+        u64 tpr;
+
+        if (!apic)
+                return 0;
+        tpr = (u64) apic_get_reg(apic, APIC_TASKPRI);
+
+        return (tpr & 0xf0) >> 4;
+}
+EXPORT_SYMBOL_GPL(kvm_lapic_get_cr8);
+
+void kvm_lapic_set_base(struct kvm_vcpu *vcpu, u64 value)
+{
+        struct kvm_lapic *apic = (struct kvm_lapic *)vcpu->apic;
+
+        if (!apic) {
+                value |= MSR_IA32_APICBASE_BSP;
+                vcpu->apic_base = value;
+                return;
+        }
+        if (apic->vcpu->vcpu_id)
+                value &= ~MSR_IA32_APICBASE_BSP;
+
+        vcpu->apic_base = value;
+        apic->base_address = apic->vcpu->apic_base &
+                             MSR_IA32_APICBASE_BASE;
+
+        /* with FSB delivery interrupt, we can restart APIC functionality */
+        apic_debug("apic base msr is 0x%016" PRIx64 ", and base address is "
+                   "0x%lx.\n", apic->apic_base, apic->base_address);
+
+}
+
+u64 kvm_lapic_get_base(struct kvm_vcpu *vcpu)
+{
+        return vcpu->apic_base;
+}
+EXPORT_SYMBOL_GPL(kvm_lapic_get_base);
+
+void kvm_lapic_reset(struct kvm_vcpu *vcpu)
+{
+        struct kvm_lapic *apic;
+        int i;
+
+        apic_debug("%s\n", __FUNCTION__);
+
+        ASSERT(vcpu);
+        apic = vcpu->apic;
+        ASSERT(apic != NULL);
+
+        /* Stop the timer in case it's a reset to an active apic */
+        hrtimer_cancel(&apic->timer.dev);
+
+        apic_set_reg(apic, APIC_ID, vcpu->vcpu_id << 24);
+        apic_set_reg(apic, APIC_LVR, APIC_VERSION);
+
+        for (i = 0; i < APIC_LVT_NUM; i++)
+                apic_set_reg(apic, APIC_LVTT + 0x10 * i, APIC_LVT_MASKED);
+        apic_set_reg(apic, APIC_LVT0,
+                     SET_APIC_DELIVERY_MODE(0, APIC_MODE_EXTINT));
+
+        apic_set_reg(apic, APIC_DFR, 0xffffffffU);
+        apic_set_reg(apic, APIC_SPIV, 0xff);
+        apic_set_reg(apic, APIC_TASKPRI, 0);
+        apic_set_reg(apic, APIC_LDR, 0);
+        apic_set_reg(apic, APIC_ESR, 0);
+        apic_set_reg(apic, APIC_ICR, 0);
+        apic_set_reg(apic, APIC_ICR2, 0);
+        apic_set_reg(apic, APIC_TDCR, 0);
+        apic_set_reg(apic, APIC_TMICT, 0);
+        for (i = 0; i < 8; i++) {
+                apic_set_reg(apic, APIC_IRR + 0x10 * i, 0);
+                apic_set_reg(apic, APIC_ISR + 0x10 * i, 0);
+                apic_set_reg(apic, APIC_TMR + 0x10 * i, 0);
+        }
+        apic->timer.divide_count = 0;
+        atomic_set(&apic->timer.pending, 0);
+        if (vcpu->vcpu_id == 0)
+                vcpu->apic_base |= MSR_IA32_APICBASE_BSP;
+        apic_update_ppr(apic);
+
+        apic_debug(KERN_INFO "%s: vcpu=%p, id=%d, base_msr="
+                   "0x%016" PRIx64 ", base_address=0x%0lx.\n", __FUNCTION__,
+                   vcpu, kvm_apic_id(apic),
+                   vcpu->apic_base, apic->base_address);
+}
+EXPORT_SYMBOL_GPL(kvm_lapic_reset);
+
+int kvm_lapic_enabled(struct kvm_vcpu *vcpu)
+{
+        struct kvm_lapic *apic = (struct kvm_lapic *)vcpu->apic;
+        int ret = 0;
+
+        if (!apic)
+                return 0;
+        ret = apic_enabled(apic);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(kvm_lapic_enabled);
+
+/*
+ *----------------------------------------------------------------------
+ * timer interface
+ *----------------------------------------------------------------------
+ */
+
+/* TODO: make sure __apic_timer_fn runs in current pCPU */
+static int __apic_timer_fn(struct kvm_lapic *apic)
+{
+        int result = 0;
+        wait_queue_head_t *q = &apic->vcpu->wq;
+
+        atomic_inc(&apic->timer.pending);
+        if (waitqueue_active(q))
+        {
+                apic->vcpu->mp_state = VCPU_MP_STATE_RUNNABLE;
+                wake_up_interruptible(q);
+        }
+        if (apic_lvtt_period(apic)) {
+                result = 1;
+                apic->timer.dev.expires = ktime_add_ns(
+                                        apic->timer.dev.expires,
+                                        apic->timer.period);
+        }
+        return result;
+}
+
+static int __inject_apic_timer_irq(struct kvm_lapic *apic)
+{
+        int vector;
+
+        vector = apic_lvt_vector(apic, APIC_LVTT);
+        return __apic_accept_irq(apic, APIC_DM_FIXED, vector, 1, 0);
+}
+
+static enum hrtimer_restart apic_timer_fn(struct hrtimer *data)
+{
+        struct kvm_lapic *apic;
+        int restart_timer = 0;
+
+        apic = container_of(data, struct kvm_lapic, timer.dev);
+
+        restart_timer = __apic_timer_fn(apic);
+
+        if (restart_timer)
+                return HRTIMER_RESTART;
+        else
+                return HRTIMER_NORESTART;
+}
+
+int kvm_create_lapic(struct kvm_vcpu *vcpu)
+{
+        struct kvm_lapic *apic;
+
+        ASSERT(vcpu != NULL);
+        apic_debug("apic_init %d\n", vcpu->vcpu_id);
+
+        apic = kzalloc(sizeof(*apic), GFP_KERNEL);
+        if (!apic)
+                goto nomem;
+
+        vcpu->apic = apic;
+
+        apic->regs_page = alloc_page(GFP_KERNEL);
+        if (apic->regs_page == NULL) {
+                printk(KERN_ERR "malloc apic regs error for vcpu %x\n",
+                       vcpu->vcpu_id);
+                goto nomem;
+        }
+        apic->regs = page_address(apic->regs_page);
+        memset(apic->regs, 0, PAGE_SIZE);
+        apic->vcpu = vcpu;
+
+        hrtimer_init(&apic->timer.dev, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+        apic->timer.dev.function = apic_timer_fn;
+        apic->base_address = APIC_DEFAULT_PHYS_BASE;
+        vcpu->apic_base = APIC_DEFAULT_PHYS_BASE;
+
+        kvm_lapic_reset(vcpu);
+        apic->dev.read = apic_mmio_read;
+        apic->dev.write = apic_mmio_write;
+        apic->dev.in_range = apic_mmio_range;
+        apic->dev.private = apic;
+
+        return 0;
+nomem:
+        kvm_free_apic(apic);
+        return -ENOMEM;
+}
+EXPORT_SYMBOL_GPL(kvm_create_lapic);
+
+int kvm_apic_has_interrupt(struct kvm_vcpu *vcpu)
+{
+        struct kvm_lapic *apic = vcpu->apic;
+        int highest_irr;
+
+        if (!apic || !apic_enabled(apic))
+                return -1;
+
+        apic_update_ppr(apic);
+        highest_irr = apic_find_highest_irr(apic);
+        if ((highest_irr == -1) ||
+            ((highest_irr & 0xF0) <= apic_get_reg(apic, APIC_PROCPRI)))
+                return -1;
+        return highest_irr;
+}
+
+int kvm_apic_accept_pic_intr(struct kvm_vcpu *vcpu)
+{
+        u32 lvt0 = apic_get_reg(vcpu->apic, APIC_LVT0);
+        int r = 0;
+
+        if (vcpu->vcpu_id == 0) {
+                if (!apic_hw_enabled(vcpu->apic))
+                        r = 1;
+                if ((lvt0 & APIC_LVT_MASKED) == 0 &&
+                    GET_APIC_DELIVERY_MODE(lvt0) == APIC_MODE_EXTINT)
+                        r = 1;
+        }
+        return r;
+}
+
+void kvm_inject_apic_timer_irqs(struct kvm_vcpu *vcpu)
+{
+        struct kvm_lapic *apic = vcpu->apic;
+
+        if (apic && apic_lvt_enabled(apic, APIC_LVTT) &&
+                atomic_read(&apic->timer.pending) > 0) {
+                if (__inject_apic_timer_irq(apic))
+                        atomic_dec(&apic->timer.pending);
+        }
+}
+
+void kvm_apic_timer_intr_post(struct kvm_vcpu *vcpu, int vec)
+{
+        struct kvm_lapic *apic = vcpu->apic;
+
+        if (apic && apic_lvt_vector(apic, APIC_LVTT) == vec)
+                apic->timer.last_update = ktime_add_ns(
+                                apic->timer.last_update,
+                                apic->timer.period);
+}
+
+int kvm_get_apic_interrupt(struct kvm_vcpu *vcpu)
+{
+        int vector = kvm_apic_has_interrupt(vcpu);
+        struct kvm_lapic *apic = vcpu->apic;
+
+        if (vector == -1)
+                return -1;
+
+        apic_set_vector(vector, apic->regs + APIC_ISR);
+        apic_update_ppr(apic);
+        apic_clear_irr(vector, apic);
+        return vector;
+}
+
+void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu)
+{
+        struct kvm_lapic *apic = vcpu->apic;
+
+        apic->base_address = vcpu->apic_base &
+                             MSR_IA32_APICBASE_BASE;
+        apic_set_reg(apic, APIC_LVR, APIC_VERSION);
+        apic_update_ppr(apic);
+        hrtimer_cancel(&apic->timer.dev);
+        update_divide_count(apic);
+        start_apic_timer(apic);
+}
+
+void kvm_migrate_apic_timer(struct kvm_vcpu *vcpu)
+{
+        struct kvm_lapic *apic = vcpu->apic;
+        struct hrtimer *timer;
+
+        if (!apic)
+                return;
+
+        timer = &apic->timer.dev;
+        if (hrtimer_cancel(timer))
+                hrtimer_start(timer, timer->expires, HRTIMER_MODE_ABS);
+}
+EXPORT_SYMBOL_GPL(kvm_migrate_apic_timer);
diff --git a/drivers/kvm/mmu.c b/drivers/kvm/mmu.c
index 23965aa5ee78..6d84d30f5ed0 100644
--- a/drivers/kvm/mmu.c
+++ b/drivers/kvm/mmu.c
@@ -158,7 +158,7 @@ static struct kmem_cache *mmu_page_header_cache;
 
 static int is_write_protection(struct kvm_vcpu *vcpu)
 {
-        return vcpu->cr0 & CR0_WP_MASK;
+        return vcpu->cr0 & X86_CR0_WP;
 }
 
 static int is_cpuid_PSE36(void)
@@ -202,15 +202,14 @@ static void set_shadow_pte(u64 *sptep, u64 spte)
 }
 
 static int mmu_topup_memory_cache(struct kvm_mmu_memory_cache *cache,
-                                  struct kmem_cache *base_cache, int min,
-                                  gfp_t gfp_flags)
+                                  struct kmem_cache *base_cache, int min)
 {
         void *obj;
 
         if (cache->nobjs >= min)
                 return 0;
         while (cache->nobjs < ARRAY_SIZE(cache->objects)) {
-                obj = kmem_cache_zalloc(base_cache, gfp_flags);
+                obj = kmem_cache_zalloc(base_cache, GFP_KERNEL);
                 if (!obj)
                         return -ENOMEM;
                 cache->objects[cache->nobjs++] = obj;
@@ -225,14 +224,14 @@ static void mmu_free_memory_cache(struct kvm_mmu_memory_cache *mc)
 }
 
 static int mmu_topup_memory_cache_page(struct kvm_mmu_memory_cache *cache,
-                                       int min, gfp_t gfp_flags)
+                                       int min)
 {
         struct page *page;
 
         if (cache->nobjs >= min)
                 return 0;
         while (cache->nobjs < ARRAY_SIZE(cache->objects)) {
-                page = alloc_page(gfp_flags);
+                page = alloc_page(GFP_KERNEL);
                 if (!page)
                         return -ENOMEM;
                 set_page_private(page, 0);
@@ -247,44 +246,28 @@ static void mmu_free_memory_cache_page(struct kvm_mmu_memory_cache *mc)
                 free_page((unsigned long)mc->objects[--mc->nobjs]);
 }
 
-static int __mmu_topup_memory_caches(struct kvm_vcpu *vcpu, gfp_t gfp_flags)
+static int mmu_topup_memory_caches(struct kvm_vcpu *vcpu)
 {
         int r;
 
+        kvm_mmu_free_some_pages(vcpu);
         r = mmu_topup_memory_cache(&vcpu->mmu_pte_chain_cache,
-                                   pte_chain_cache, 4, gfp_flags);
+                                   pte_chain_cache, 4);
         if (r)
                 goto out;
         r = mmu_topup_memory_cache(&vcpu->mmu_rmap_desc_cache,
-                                   rmap_desc_cache, 1, gfp_flags);
+                                   rmap_desc_cache, 1);
         if (r)
                 goto out;
-        r = mmu_topup_memory_cache_page(&vcpu->mmu_page_cache, 4, gfp_flags);
+        r = mmu_topup_memory_cache_page(&vcpu->mmu_page_cache, 4);
         if (r)
                 goto out;
         r = mmu_topup_memory_cache(&vcpu->mmu_page_header_cache,
-                                   mmu_page_header_cache, 4, gfp_flags);
+                                   mmu_page_header_cache, 4);
 out:
         return r;
 }
 
-static int mmu_topup_memory_caches(struct kvm_vcpu *vcpu)
-{
-        int r;
-
-        r = __mmu_topup_memory_caches(vcpu, GFP_NOWAIT);
-        kvm_mmu_free_some_pages(vcpu);
-        if (r < 0) {
-                spin_unlock(&vcpu->kvm->lock);
-                kvm_arch_ops->vcpu_put(vcpu);
-                r = __mmu_topup_memory_caches(vcpu, GFP_KERNEL);
-                kvm_arch_ops->vcpu_load(vcpu);
-                spin_lock(&vcpu->kvm->lock);
-                kvm_mmu_free_some_pages(vcpu);
-        }
-        return r;
-}
-
 static void mmu_free_memory_caches(struct kvm_vcpu *vcpu)
 {
         mmu_free_memory_cache(&vcpu->mmu_pte_chain_cache);
@@ -969,7 +952,7 @@ static int nonpaging_init_context(struct kvm_vcpu *vcpu)
 static void kvm_mmu_flush_tlb(struct kvm_vcpu *vcpu)
 {
         ++vcpu->stat.tlb_flush;
-        kvm_arch_ops->tlb_flush(vcpu);
+        kvm_x86_ops->tlb_flush(vcpu);
 }
 
 static void paging_new_cr3(struct kvm_vcpu *vcpu)
@@ -982,7 +965,7 @@ static void inject_page_fault(struct kvm_vcpu *vcpu,
                               u64 addr,
                               u32 err_code)
 {
-        kvm_arch_ops->inject_page_fault(vcpu, addr, err_code);
+        kvm_x86_ops->inject_page_fault(vcpu, addr, err_code);
 }
 
 static void paging_free(struct kvm_vcpu *vcpu)
@@ -1071,15 +1054,15 @@ int kvm_mmu_load(struct kvm_vcpu *vcpu)
 {
         int r;
 
-        spin_lock(&vcpu->kvm->lock);
+        mutex_lock(&vcpu->kvm->lock);
         r = mmu_topup_memory_caches(vcpu);
         if (r)
                 goto out;
         mmu_alloc_roots(vcpu);
-        kvm_arch_ops->set_cr3(vcpu, vcpu->mmu.root_hpa);
+        kvm_x86_ops->set_cr3(vcpu, vcpu->mmu.root_hpa);
         kvm_mmu_flush_tlb(vcpu);
 out:
-        spin_unlock(&vcpu->kvm->lock);
+        mutex_unlock(&vcpu->kvm->lock);
         return r;
 }
 EXPORT_SYMBOL_GPL(kvm_mmu_load);
@@ -1124,7 +1107,7 @@ static void mmu_pte_write_new_pte(struct kvm_vcpu *vcpu,
 }
 
 void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
-                       const u8 *old, const u8 *new, int bytes)
+                       const u8 *new, int bytes)
 {
         gfn_t gfn = gpa >> PAGE_SHIFT;
         struct kvm_mmu_page *page;
diff --git a/drivers/kvm/paging_tmpl.h b/drivers/kvm/paging_tmpl.h
index 4b5391c717f8..6b094b44f8fb 100644
--- a/drivers/kvm/paging_tmpl.h
+++ b/drivers/kvm/paging_tmpl.h
@@ -58,7 +58,10 @@ struct guest_walker {
         int level;
         gfn_t table_gfn[PT_MAX_FULL_LEVELS];
         pt_element_t *table;
+        pt_element_t pte;
         pt_element_t *ptep;
+        struct page *page;
+        int index;
         pt_element_t inherited_ar;
         gfn_t gfn;
         u32 error_code;
@@ -80,11 +83,14 @@ static int FNAME(walk_addr)(struct guest_walker *walker,
         pgprintk("%s: addr %lx\n", __FUNCTION__, addr);
         walker->level = vcpu->mmu.root_level;
         walker->table = NULL;
+        walker->page = NULL;
+        walker->ptep = NULL;
         root = vcpu->cr3;
 #if PTTYPE == 64
         if (!is_long_mode(vcpu)) {
                 walker->ptep = &vcpu->pdptrs[(addr >> 30) & 3];
                 root = *walker->ptep;
+                walker->pte = root;
                 if (!(root & PT_PRESENT_MASK))
                         goto not_present;
                 --walker->level;
@@ -96,10 +102,11 @@ static int FNAME(walk_addr)(struct guest_walker *walker,
                  walker->level - 1, table_gfn);
         slot = gfn_to_memslot(vcpu->kvm, table_gfn);
         hpa = safe_gpa_to_hpa(vcpu, root & PT64_BASE_ADDR_MASK);
-        walker->table = kmap_atomic(pfn_to_page(hpa >> PAGE_SHIFT), KM_USER0);
+        walker->page = pfn_to_page(hpa >> PAGE_SHIFT);
+        walker->table = kmap_atomic(walker->page, KM_USER0);
 
         ASSERT((!is_long_mode(vcpu) && is_pae(vcpu)) ||
-               (vcpu->cr3 & ~(PAGE_MASK | CR3_FLAGS_MASK)) == 0);
+               (vcpu->cr3 & CR3_NONPAE_RESERVED_BITS) == 0);
 
         walker->inherited_ar = PT_USER_MASK | PT_WRITABLE_MASK;
 
@@ -108,6 +115,7 @@ static int FNAME(walk_addr)(struct guest_walker *walker,
                 hpa_t paddr;
 
                 ptep = &walker->table[index];
+                walker->index = index;
                 ASSERT(((unsigned long)walker->table & PAGE_MASK) ==
                        ((unsigned long)ptep & PAGE_MASK));
 
@@ -148,16 +156,20 @@ static int FNAME(walk_addr)(struct guest_walker *walker,
 
                 walker->inherited_ar &= walker->table[index];
                 table_gfn = (*ptep & PT_BASE_ADDR_MASK) >> PAGE_SHIFT;
-                paddr = safe_gpa_to_hpa(vcpu, *ptep & PT_BASE_ADDR_MASK);
                 kunmap_atomic(walker->table, KM_USER0);
-                walker->table = kmap_atomic(pfn_to_page(paddr >> PAGE_SHIFT),
-                                            KM_USER0);
+                paddr = safe_gpa_to_hpa(vcpu, table_gfn << PAGE_SHIFT);
+                walker->page = pfn_to_page(paddr >> PAGE_SHIFT);
+                walker->table = kmap_atomic(walker->page, KM_USER0);
                 --walker->level;
                 walker->table_gfn[walker->level - 1 ] = table_gfn;
                 pgprintk("%s: table_gfn[%d] %lx\n", __FUNCTION__,
                          walker->level - 1, table_gfn);
         }
-        walker->ptep = ptep;
+        walker->pte = *ptep;
+        if (walker->page)
+                walker->ptep = NULL;
+        if (walker->table)
+                kunmap_atomic(walker->table, KM_USER0);
         pgprintk("%s: pte %llx\n", __FUNCTION__, (u64)*ptep);
         return 1;
 
@@ -175,13 +187,9 @@ err:
                 walker->error_code |= PFERR_USER_MASK;
         if (fetch_fault)
                 walker->error_code |= PFERR_FETCH_MASK;
-        return 0;
-}
-
-static void FNAME(release_walker)(struct guest_walker *walker)
-{
         if (walker->table)
                 kunmap_atomic(walker->table, KM_USER0);
+        return 0;
 }
 
 static void FNAME(mark_pagetable_dirty)(struct kvm *kvm,
@@ -193,7 +201,7 @@ static void FNAME(mark_pagetable_dirty)(struct kvm *kvm,
 static void FNAME(set_pte_common)(struct kvm_vcpu *vcpu,
                                   u64 *shadow_pte,
                                   gpa_t gaddr,
-                                  pt_element_t *gpte,
+                                  pt_element_t gpte,
                                   u64 access_bits,
                                   int user_fault,
                                   int write_fault,
@@ -202,23 +210,34 @@ static void FNAME(set_pte_common)(struct kvm_vcpu *vcpu,
                                   gfn_t gfn)
 {
         hpa_t paddr;
-        int dirty = *gpte & PT_DIRTY_MASK;
+        int dirty = gpte & PT_DIRTY_MASK;
         u64 spte = *shadow_pte;
         int was_rmapped = is_rmap_pte(spte);
 
         pgprintk("%s: spte %llx gpte %llx access %llx write_fault %d"
                  " user_fault %d gfn %lx\n",
-                 __FUNCTION__, spte, (u64)*gpte, access_bits,
+                 __FUNCTION__, spte, (u64)gpte, access_bits,
                  write_fault, user_fault, gfn);
 
         if (write_fault && !dirty) {
-                *gpte |= PT_DIRTY_MASK;
+                pt_element_t *guest_ent, *tmp = NULL;
+
+                if (walker->ptep)
+                        guest_ent = walker->ptep;
+                else {
+                        tmp = kmap_atomic(walker->page, KM_USER0);
+                        guest_ent = &tmp[walker->index];
+                }
+
+                *guest_ent |= PT_DIRTY_MASK;
+                if (!walker->ptep)
+                        kunmap_atomic(tmp, KM_USER0);
                 dirty = 1;
                 FNAME(mark_pagetable_dirty)(vcpu->kvm, walker);
         }
 
         spte |= PT_PRESENT_MASK | PT_ACCESSED_MASK | PT_DIRTY_MASK;
-        spte |= *gpte & PT64_NX_MASK;
+        spte |= gpte & PT64_NX_MASK;
         if (!dirty)
                 access_bits &= ~PT_WRITABLE_MASK;
 
@@ -255,7 +274,7 @@ static void FNAME(set_pte_common)(struct kvm_vcpu *vcpu,
                         access_bits &= ~PT_WRITABLE_MASK;
                         if (is_writeble_pte(spte)) {
                                 spte &= ~PT_WRITABLE_MASK;
-                                kvm_arch_ops->tlb_flush(vcpu);
+                                kvm_x86_ops->tlb_flush(vcpu);
                         }
                         if (write_fault)
                                 *ptwrite = 1;
@@ -273,13 +292,13 @@ unshadowed:
                 rmap_add(vcpu, shadow_pte);
 }
 
-static void FNAME(set_pte)(struct kvm_vcpu *vcpu, pt_element_t *gpte,
+static void FNAME(set_pte)(struct kvm_vcpu *vcpu, pt_element_t gpte,
                            u64 *shadow_pte, u64 access_bits,
                            int user_fault, int write_fault, int *ptwrite,
                            struct guest_walker *walker, gfn_t gfn)
 {
-        access_bits &= *gpte;
-        FNAME(set_pte_common)(vcpu, shadow_pte, *gpte & PT_BASE_ADDR_MASK,
+        access_bits &= gpte;
+        FNAME(set_pte_common)(vcpu, shadow_pte, gpte & PT_BASE_ADDR_MASK,
                               gpte, access_bits, user_fault, write_fault,
                               ptwrite, walker, gfn);
 }
@@ -295,22 +314,22 @@ static void FNAME(update_pte)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *page,
         if (~gpte & (PT_PRESENT_MASK | PT_ACCESSED_MASK))
                 return;
         pgprintk("%s: gpte %llx spte %p\n", __FUNCTION__, (u64)gpte, spte);
-        FNAME(set_pte)(vcpu, &gpte, spte, PT_USER_MASK | PT_WRITABLE_MASK, 0,
+        FNAME(set_pte)(vcpu, gpte, spte, PT_USER_MASK | PT_WRITABLE_MASK, 0,
                        0, NULL, NULL,
                        (gpte & PT_BASE_ADDR_MASK) >> PAGE_SHIFT);
 }
 
-static void FNAME(set_pde)(struct kvm_vcpu *vcpu, pt_element_t *gpde,
+static void FNAME(set_pde)(struct kvm_vcpu *vcpu, pt_element_t gpde,
                            u64 *shadow_pte, u64 access_bits,
                            int user_fault, int write_fault, int *ptwrite,
                            struct guest_walker *walker, gfn_t gfn)
 {
         gpa_t gaddr;
 
-        access_bits &= *gpde;
+        access_bits &= gpde;
         gaddr = (gpa_t)gfn << PAGE_SHIFT;
         if (PTTYPE == 32 && is_cpuid_PSE36())
-                gaddr |= (*gpde & PT32_DIR_PSE36_MASK) <<
+                gaddr |= (gpde & PT32_DIR_PSE36_MASK) <<
                         (32 - PT32_DIR_PSE36_SHIFT);
         FNAME(set_pte_common)(vcpu, shadow_pte, gaddr,
                               gpde, access_bits, user_fault, write_fault,
@@ -328,9 +347,8 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
         int level;
         u64 *shadow_ent;
         u64 *prev_shadow_ent = NULL;
-        pt_element_t *guest_ent = walker->ptep;
 
-        if (!is_present_pte(*guest_ent))
+        if (!is_present_pte(walker->pte))
                 return NULL;
 
         shadow_addr = vcpu->mmu.root_hpa;
@@ -364,12 +382,12 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
                 if (level - 1 == PT_PAGE_TABLE_LEVEL
                     && walker->level == PT_DIRECTORY_LEVEL) {
                         metaphysical = 1;
-                        hugepage_access = *guest_ent;
+                        hugepage_access = walker->pte;
                         hugepage_access &= PT_USER_MASK | PT_WRITABLE_MASK;
-                        if (*guest_ent & PT64_NX_MASK)
+                        if (walker->pte & PT64_NX_MASK)
                                 hugepage_access |= (1 << 2);
                         hugepage_access >>= PT_WRITABLE_SHIFT;
-                        table_gfn = (*guest_ent & PT_BASE_ADDR_MASK)
+                        table_gfn = (walker->pte & PT_BASE_ADDR_MASK)
                                 >> PAGE_SHIFT;
                 } else {
                         metaphysical = 0;
@@ -386,12 +404,12 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
         }
 
         if (walker->level == PT_DIRECTORY_LEVEL) {
-                FNAME(set_pde)(vcpu, guest_ent, shadow_ent,
+                FNAME(set_pde)(vcpu, walker->pte, shadow_ent,
                                walker->inherited_ar, user_fault, write_fault,
                                ptwrite, walker, walker->gfn);
         } else {
                 ASSERT(walker->level == PT_PAGE_TABLE_LEVEL);
-                FNAME(set_pte)(vcpu, guest_ent, shadow_ent,
+                FNAME(set_pte)(vcpu, walker->pte, shadow_ent,
                                walker->inherited_ar, user_fault, write_fault,
                                ptwrite, walker, walker->gfn);
         }
@@ -442,7 +460,6 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
         if (!r) {
                 pgprintk("%s: guest page fault\n", __FUNCTION__);
                 inject_page_fault(vcpu, addr, walker.error_code);
-                FNAME(release_walker)(&walker);
                 vcpu->last_pt_write_count = 0; /* reset fork detector */
                 return 0;
         }
@@ -452,8 +469,6 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
         pgprintk("%s: shadow pte %p %llx ptwrite %d\n", __FUNCTION__,
                  shadow_pte, *shadow_pte, write_pt);
 
-        FNAME(release_walker)(&walker);
-
         if (!write_pt)
                 vcpu->last_pt_write_count = 0; /* reset fork detector */
 
@@ -482,7 +497,6 @@ static gpa_t FNAME(gva_to_gpa)(struct kvm_vcpu *vcpu, gva_t vaddr)
                 gpa |= vaddr & ~PAGE_MASK;
         }
 
-        FNAME(release_walker)(&walker);
         return gpa;
 }
 
diff --git a/drivers/kvm/svm.c b/drivers/kvm/svm.c
index bc818cc126e3..729f1cd93606 100644
--- a/drivers/kvm/svm.c
+++ b/drivers/kvm/svm.c
@@ -16,12 +16,12 @@
 
 #include "kvm_svm.h"
 #include "x86_emulate.h"
+#include "irq.h"
 
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/vmalloc.h>
 #include <linux/highmem.h>
-#include <linux/profile.h>
 #include <linux/sched.h>
 
 #include <asm/desc.h>
@@ -38,7 +38,6 @@ MODULE_LICENSE("GPL");
 
 #define DR7_GD_MASK (1 << 13)
 #define DR6_BD_MASK (1 << 13)
-#define CR4_DE_MASK (1UL << 3)
 
 #define SEG_TYPE_LDT 2
 #define SEG_TYPE_BUSY_TSS16 3
@@ -50,6 +49,13 @@ MODULE_LICENSE("GPL");
 #define SVM_FEATURE_LBRV (1 << 1)
 #define SVM_DEATURE_SVML (1 << 2)
 
+static void kvm_reput_irq(struct vcpu_svm *svm);
+
+static inline struct vcpu_svm *to_svm(struct kvm_vcpu *vcpu)
+{
+        return container_of(vcpu, struct vcpu_svm, vcpu);
+}
+
 unsigned long iopm_base;
 unsigned long msrpm_base;
 
@@ -94,20 +100,6 @@ static inline u32 svm_has(u32 feat)
         return svm_features & feat;
 }
 
-static unsigned get_addr_size(struct kvm_vcpu *vcpu)
-{
-        struct vmcb_save_area *sa = &vcpu->svm->vmcb->save;
-        u16 cs_attrib;
-
-        if (!(sa->cr0 & CR0_PE_MASK) || (sa->rflags & X86_EFLAGS_VM))
-                return 2;
-
-        cs_attrib = sa->cs.attrib;
-
-        return (cs_attrib & SVM_SELECTOR_L_MASK) ? 8 :
-                                (cs_attrib & SVM_SELECTOR_DB_MASK) ? 4 : 2;
-}
-
 static inline u8 pop_irq(struct kvm_vcpu *vcpu)
 {
         int word_index = __ffs(vcpu->irq_summary);
@@ -182,7 +174,7 @@ static inline void write_dr7(unsigned long val)
 
 static inline void force_new_asid(struct kvm_vcpu *vcpu)
 {
-        vcpu->svm->asid_generation--;
+        to_svm(vcpu)->asid_generation--;
 }
 
 static inline void flush_guest_tlb(struct kvm_vcpu *vcpu)
@@ -195,22 +187,24 @@ static void svm_set_efer(struct kvm_vcpu *vcpu, u64 efer)
         if (!(efer & KVM_EFER_LMA))
                 efer &= ~KVM_EFER_LME;
 
-        vcpu->svm->vmcb->save.efer = efer | MSR_EFER_SVME_MASK;
+        to_svm(vcpu)->vmcb->save.efer = efer | MSR_EFER_SVME_MASK;
         vcpu->shadow_efer = efer;
 }
 
 static void svm_inject_gp(struct kvm_vcpu *vcpu, unsigned error_code)
 {
-        vcpu->svm->vmcb->control.event_inj =    SVM_EVTINJ_VALID |
+        struct vcpu_svm *svm = to_svm(vcpu);
+
+        svm->vmcb->control.event_inj =          SVM_EVTINJ_VALID |
                                                 SVM_EVTINJ_VALID_ERR |
                                                 SVM_EVTINJ_TYPE_EXEPT |
                                                 GP_VECTOR;
-        vcpu->svm->vmcb->control.event_inj_err = error_code;
+        svm->vmcb->control.event_inj_err = error_code;
 }
 
 static void inject_ud(struct kvm_vcpu *vcpu)
 {
-        vcpu->svm->vmcb->control.event_inj =    SVM_EVTINJ_VALID |
+        to_svm(vcpu)->vmcb->control.event_inj = SVM_EVTINJ_VALID |
                                                 SVM_EVTINJ_TYPE_EXEPT |
                                                 UD_VECTOR;
 }
@@ -229,19 +223,21 @@ static int is_external_interrupt(u32 info)
 
 static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
 {
-        if (!vcpu->svm->next_rip) {
+        struct vcpu_svm *svm = to_svm(vcpu);
+
+        if (!svm->next_rip) {
                 printk(KERN_DEBUG "%s: NOP\n", __FUNCTION__);
                 return;
         }
-        if (vcpu->svm->next_rip - vcpu->svm->vmcb->save.rip > 15) {
+        if (svm->next_rip - svm->vmcb->save.rip > MAX_INST_SIZE) {
                 printk(KERN_ERR "%s: ip 0x%llx next 0x%llx\n",
                        __FUNCTION__,
-                       vcpu->svm->vmcb->save.rip,
-                       vcpu->svm->next_rip);
+                       svm->vmcb->save.rip,
+                       svm->next_rip);
         }
 
-        vcpu->rip = vcpu->svm->vmcb->save.rip = vcpu->svm->next_rip;
-        vcpu->svm->vmcb->control.int_state &= ~SVM_INTERRUPT_SHADOW_MASK;
+        vcpu->rip = svm->vmcb->save.rip = svm->next_rip;
+        svm->vmcb->control.int_state &= ~SVM_INTERRUPT_SHADOW_MASK;
 
         vcpu->interrupt_window_open = 1;
 }
@@ -351,8 +347,8 @@ err_1:
 
 }
 
-static int set_msr_interception(u32 *msrpm, unsigned msr,
-                                int read, int write)
+static void set_msr_interception(u32 *msrpm, unsigned msr,
+                                 int read, int write)
 {
         int i;
 
@@ -367,11 +363,10 @@ static int set_msr_interception(u32 *msrpm, unsigned msr,
                         u32 mask = ((write) ? 0 : 2) | ((read) ? 0 : 1);
                         *base = (*base & ~(0x3 << msr_shift)) |
                                 (mask << msr_shift);
-                        return 1;
+                        return;
                 }
         }
-        printk(KERN_DEBUG "%s: not found 0x%x\n", __FUNCTION__, msr);
-        return 0;
+        BUG();
 }
 
 static __init int svm_hardware_setup(void)
@@ -382,8 +377,6 @@ static __init int svm_hardware_setup(void)
         void *iopm_va, *msrpm_va;
         int r;
 
-        kvm_emulator_want_group7_invlpg();
-
         iopm_pages = alloc_pages(GFP_KERNEL, IOPM_ALLOC_ORDER);
 
         if (!iopm_pages)
@@ -458,11 +451,6 @@ static void init_sys_seg(struct vmcb_seg *seg, uint32_t type)
         seg->base = 0;
 }
 
-static int svm_vcpu_setup(struct kvm_vcpu *vcpu)
-{
-        return 0;
-}
-
 static void init_vmcb(struct vmcb *vmcb)
 {
         struct vmcb_control_area *control = &vmcb->control;
@@ -563,59 +551,83 @@ static void init_vmcb(struct vmcb *vmcb)
          * cr0 val on cpu init should be 0x60000010, we enable cpu
          * cache by default. the orderly way is to enable cache in bios.
          */
-        save->cr0 = 0x00000010 | CR0_PG_MASK | CR0_WP_MASK;
-        save->cr4 = CR4_PAE_MASK;
+        save->cr0 = 0x00000010 | X86_CR0_PG | X86_CR0_WP;
+        save->cr4 = X86_CR4_PAE;
         /* rdx = ?? */
 }
 
-static int svm_create_vcpu(struct kvm_vcpu *vcpu)
+static void svm_vcpu_reset(struct kvm_vcpu *vcpu)
+{
+        struct vcpu_svm *svm = to_svm(vcpu);
+
+        init_vmcb(svm->vmcb);
+}
+
+static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
 {
+        struct vcpu_svm *svm;
         struct page *page;
-        int r;
+        int err;
+
+        svm = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL);
+        if (!svm) {
+                err = -ENOMEM;
+                goto out;
+        }
+
+        err = kvm_vcpu_init(&svm->vcpu, kvm, id);
+        if (err)
+                goto free_svm;
+
+        if (irqchip_in_kernel(kvm)) {
+                err = kvm_create_lapic(&svm->vcpu);
+                if (err < 0)
+                        goto free_svm;
+        }
 
-        r = -ENOMEM;
-        vcpu->svm = kzalloc(sizeof *vcpu->svm, GFP_KERNEL);
-        if (!vcpu->svm)
-                goto out1;
         page = alloc_page(GFP_KERNEL);
-        if (!page)
-                goto out2;
-
-        vcpu->svm->vmcb = page_address(page);
-        clear_page(vcpu->svm->vmcb);
-        vcpu->svm->vmcb_pa = page_to_pfn(page) << PAGE_SHIFT;
-        vcpu->svm->asid_generation = 0;
-        memset(vcpu->svm->db_regs, 0, sizeof(vcpu->svm->db_regs));
-        init_vmcb(vcpu->svm->vmcb);
-
-        fx_init(vcpu);
-        vcpu->fpu_active = 1;
-        vcpu->apic_base = 0xfee00000 | MSR_IA32_APICBASE_ENABLE;
-        if (vcpu == &vcpu->kvm->vcpus[0])
-                vcpu->apic_base |= MSR_IA32_APICBASE_BSP;
+        if (!page) {
+                err = -ENOMEM;
+                goto uninit;
+        }
 
-        return 0;
+        svm->vmcb = page_address(page);
+        clear_page(svm->vmcb);
+        svm->vmcb_pa = page_to_pfn(page) << PAGE_SHIFT;
+        svm->asid_generation = 0;
+        memset(svm->db_regs, 0, sizeof(svm->db_regs));
+        init_vmcb(svm->vmcb);
 
-out2:
-        kfree(vcpu->svm);
-out1:
-        return r;
+        fx_init(&svm->vcpu);
+        svm->vcpu.fpu_active = 1;
+        svm->vcpu.apic_base = 0xfee00000 | MSR_IA32_APICBASE_ENABLE;
+        if (svm->vcpu.vcpu_id == 0)
+                svm->vcpu.apic_base |= MSR_IA32_APICBASE_BSP;
+
+        return &svm->vcpu;
+
+uninit:
+        kvm_vcpu_uninit(&svm->vcpu);
+free_svm:
+        kmem_cache_free(kvm_vcpu_cache, svm);
+out:
+        return ERR_PTR(err);
 }
 
 static void svm_free_vcpu(struct kvm_vcpu *vcpu)
 {
-        if (!vcpu->svm)
-                return;
-        if (vcpu->svm->vmcb)
-                __free_page(pfn_to_page(vcpu->svm->vmcb_pa >> PAGE_SHIFT));
-        kfree(vcpu->svm);
+        struct vcpu_svm *svm = to_svm(vcpu);
+
+        __free_page(pfn_to_page(svm->vmcb_pa >> PAGE_SHIFT));
+        kvm_vcpu_uninit(vcpu);
+        kmem_cache_free(kvm_vcpu_cache, svm);
 }
 
-static void svm_vcpu_load(struct kvm_vcpu *vcpu)
+static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 {
-        int cpu, i;
+        struct vcpu_svm *svm = to_svm(vcpu);
+        int i;
 
-        cpu = get_cpu();
         if (unlikely(cpu != vcpu->cpu)) {
                 u64 tsc_this, delta;
 
@@ -625,23 +637,24 @@ static void svm_vcpu_load(struct kvm_vcpu *vcpu)
                  */
                 rdtscll(tsc_this);
                 delta = vcpu->host_tsc - tsc_this;
-                vcpu->svm->vmcb->control.tsc_offset += delta;
+                svm->vmcb->control.tsc_offset += delta;
                 vcpu->cpu = cpu;
+                kvm_migrate_apic_timer(vcpu);
         }
 
         for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
-                rdmsrl(host_save_user_msrs[i], vcpu->svm->host_user_msrs[i]);
+                rdmsrl(host_save_user_msrs[i], svm->host_user_msrs[i]);
 }
 
 static void svm_vcpu_put(struct kvm_vcpu *vcpu)
 {
+        struct vcpu_svm *svm = to_svm(vcpu);
         int i;
 
         for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
-                wrmsrl(host_save_user_msrs[i], vcpu->svm->host_user_msrs[i]);
+                wrmsrl(host_save_user_msrs[i], svm->host_user_msrs[i]);
 
         rdtscll(vcpu->host_tsc);
-        put_cpu();
 }
 
 static void svm_vcpu_decache(struct kvm_vcpu *vcpu)
@@ -650,31 +663,34 @@ static void svm_vcpu_decache(struct kvm_vcpu *vcpu)
 
 static void svm_cache_regs(struct kvm_vcpu *vcpu)
 {
-        vcpu->regs[VCPU_REGS_RAX] = vcpu->svm->vmcb->save.rax;
-        vcpu->regs[VCPU_REGS_RSP] = vcpu->svm->vmcb->save.rsp;
-        vcpu->rip = vcpu->svm->vmcb->save.rip;
+        struct vcpu_svm *svm = to_svm(vcpu);
+
+        vcpu->regs[VCPU_REGS_RAX] = svm->vmcb->save.rax;
+        vcpu->regs[VCPU_REGS_RSP] = svm->vmcb->save.rsp;
+        vcpu->rip = svm->vmcb->save.rip;
 }
 
 static void svm_decache_regs(struct kvm_vcpu *vcpu)
 {
-        vcpu->svm->vmcb->save.rax = vcpu->regs[VCPU_REGS_RAX];
-        vcpu->svm->vmcb->save.rsp = vcpu->regs[VCPU_REGS_RSP];
-        vcpu->svm->vmcb->save.rip = vcpu->rip;
+        struct vcpu_svm *svm = to_svm(vcpu);
+        svm->vmcb->save.rax = vcpu->regs[VCPU_REGS_RAX];
+        svm->vmcb->save.rsp = vcpu->regs[VCPU_REGS_RSP];
+        svm->vmcb->save.rip = vcpu->rip;
 }
 
 static unsigned long svm_get_rflags(struct kvm_vcpu *vcpu)
 {
-        return vcpu->svm->vmcb->save.rflags;
+        return to_svm(vcpu)->vmcb->save.rflags;
 }
 
 static void svm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
 {
-        vcpu->svm->vmcb->save.rflags = rflags;
+        to_svm(vcpu)->vmcb->save.rflags = rflags;
 }
 
 static struct vmcb_seg *svm_seg(struct kvm_vcpu *vcpu, int seg)
 {
-        struct vmcb_save_area *save = &vcpu->svm->vmcb->save;
+        struct vmcb_save_area *save = &to_svm(vcpu)->vmcb->save;
 
         switch (seg) {
         case VCPU_SREG_CS: return &save->cs;
@@ -716,36 +732,36 @@ static void svm_get_segment(struct kvm_vcpu *vcpu,
         var->unusable = !var->present;
 }
 
-static void svm_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l)
-{
-        struct vmcb_seg *s = svm_seg(vcpu, VCPU_SREG_CS);
-
-        *db = (s->attrib >> SVM_SELECTOR_DB_SHIFT) & 1;
-        *l = (s->attrib >> SVM_SELECTOR_L_SHIFT) & 1;
-}
-
 static void svm_get_idt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
 {
-        dt->limit = vcpu->svm->vmcb->save.idtr.limit;
-        dt->base = vcpu->svm->vmcb->save.idtr.base;
+        struct vcpu_svm *svm = to_svm(vcpu);
+
+        dt->limit = svm->vmcb->save.idtr.limit;
+        dt->base = svm->vmcb->save.idtr.base;
 }
 
 static void svm_set_idt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
 {
-        vcpu->svm->vmcb->save.idtr.limit = dt->limit;
-        vcpu->svm->vmcb->save.idtr.base = dt->base ;
+        struct vcpu_svm *svm = to_svm(vcpu);
+
+        svm->vmcb->save.idtr.limit = dt->limit;
+        svm->vmcb->save.idtr.base = dt->base ;
 }
 
 static void svm_get_gdt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
 {
-        dt->limit = vcpu->svm->vmcb->save.gdtr.limit;
-        dt->base = vcpu->svm->vmcb->save.gdtr.base;
+        struct vcpu_svm *svm = to_svm(vcpu);
+
+        dt->limit = svm->vmcb->save.gdtr.limit;
+        dt->base = svm->vmcb->save.gdtr.base;
 }
 
 static void svm_set_gdt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
 {
-        vcpu->svm->vmcb->save.gdtr.limit = dt->limit;
-        vcpu->svm->vmcb->save.gdtr.base = dt->base ;
+        struct vcpu_svm *svm = to_svm(vcpu);
+
+        svm->vmcb->save.gdtr.limit = dt->limit;
+        svm->vmcb->save.gdtr.base = dt->base ;
 }
 
 static void svm_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
@@ -754,39 +770,42 @@ static void svm_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
 
 static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
 {
+        struct vcpu_svm *svm = to_svm(vcpu);
+
 #ifdef CONFIG_X86_64
         if (vcpu->shadow_efer & KVM_EFER_LME) {
-                if (!is_paging(vcpu) && (cr0 & CR0_PG_MASK)) {
+                if (!is_paging(vcpu) && (cr0 & X86_CR0_PG)) {
                         vcpu->shadow_efer |= KVM_EFER_LMA;
-                        vcpu->svm->vmcb->save.efer |= KVM_EFER_LMA | KVM_EFER_LME;
+                        svm->vmcb->save.efer |= KVM_EFER_LMA | KVM_EFER_LME;
                 }
 
-                if (is_paging(vcpu) && !(cr0 & CR0_PG_MASK) ) {
+                if (is_paging(vcpu) && !(cr0 & X86_CR0_PG) ) {
                         vcpu->shadow_efer &= ~KVM_EFER_LMA;
-                        vcpu->svm->vmcb->save.efer &= ~(KVM_EFER_LMA | KVM_EFER_LME);
+                        svm->vmcb->save.efer &= ~(KVM_EFER_LMA | KVM_EFER_LME);
                 }
         }
 #endif
-        if ((vcpu->cr0 & CR0_TS_MASK) && !(cr0 & CR0_TS_MASK)) {
-                vcpu->svm->vmcb->control.intercept_exceptions &= ~(1 << NM_VECTOR);
+        if ((vcpu->cr0 & X86_CR0_TS) && !(cr0 & X86_CR0_TS)) {
+                svm->vmcb->control.intercept_exceptions &= ~(1 << NM_VECTOR);
                 vcpu->fpu_active = 1;
         }
 
         vcpu->cr0 = cr0;
-        cr0 |= CR0_PG_MASK | CR0_WP_MASK;
-        cr0 &= ~(CR0_CD_MASK | CR0_NW_MASK);
-        vcpu->svm->vmcb->save.cr0 = cr0;
+        cr0 |= X86_CR0_PG | X86_CR0_WP;
+        cr0 &= ~(X86_CR0_CD | X86_CR0_NW);
+        svm->vmcb->save.cr0 = cr0;
 }
 
 static void svm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
 {
        vcpu->cr4 = cr4;
-       vcpu->svm->vmcb->save.cr4 = cr4 | CR4_PAE_MASK;
+       to_svm(vcpu)->vmcb->save.cr4 = cr4 | X86_CR4_PAE;
 }
 
 static void svm_set_segment(struct kvm_vcpu *vcpu,
                             struct kvm_segment *var, int seg)
 {
+        struct vcpu_svm *svm = to_svm(vcpu);
         struct vmcb_seg *s = svm_seg(vcpu, seg);
 
         s->base = var->base;
@@ -805,16 +824,16 @@ static void svm_set_segment(struct kvm_vcpu *vcpu,
                 s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT;
         }
         if (seg == VCPU_SREG_CS)
-                vcpu->svm->vmcb->save.cpl
-                        = (vcpu->svm->vmcb->save.cs.attrib
+                svm->vmcb->save.cpl
+                        = (svm->vmcb->save.cs.attrib
                            >> SVM_SELECTOR_DPL_SHIFT) & 3;
 
 }
 
 /* FIXME:
 
-        vcpu->svm->vmcb->control.int_ctl &= ~V_TPR_MASK;
-        vcpu->svm->vmcb->control.int_ctl |= (sregs->cr8 & V_TPR_MASK);
+        svm(vcpu)->vmcb->control.int_ctl &= ~V_TPR_MASK;
+        svm(vcpu)->vmcb->control.int_ctl |= (sregs->cr8 & V_TPR_MASK);
 
 */
 
@@ -823,61 +842,68 @@ static int svm_guest_debug(struct kvm_vcpu *vcpu, struct kvm_debug_guest *dbg)
         return -EOPNOTSUPP;
 }
 
+static int svm_get_irq(struct kvm_vcpu *vcpu)
+{
+        struct vcpu_svm *svm = to_svm(vcpu);
+        u32 exit_int_info = svm->vmcb->control.exit_int_info;
+
+        if (is_external_interrupt(exit_int_info))
+                return exit_int_info & SVM_EVTINJ_VEC_MASK;
+        return -1;
+}
+
 static void load_host_msrs(struct kvm_vcpu *vcpu)
 {
 #ifdef CONFIG_X86_64
-        wrmsrl(MSR_GS_BASE, vcpu->svm->host_gs_base);
+        wrmsrl(MSR_GS_BASE, to_svm(vcpu)->host_gs_base);
 #endif
 }
 
 static void save_host_msrs(struct kvm_vcpu *vcpu)
 {
 #ifdef CONFIG_X86_64
-        rdmsrl(MSR_GS_BASE, vcpu->svm->host_gs_base);
+        rdmsrl(MSR_GS_BASE, to_svm(vcpu)->host_gs_base);
 #endif
 }
 
-static void new_asid(struct kvm_vcpu *vcpu, struct svm_cpu_data *svm_data)
+static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *svm_data)
 {
         if (svm_data->next_asid > svm_data->max_asid) {
                 ++svm_data->asid_generation;
                 svm_data->next_asid = 1;
-                vcpu->svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ALL_ASID;
+                svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ALL_ASID;
         }
 
-        vcpu->cpu = svm_data->cpu;
-        vcpu->svm->asid_generation = svm_data->asid_generation;
-        vcpu->svm->vmcb->control.asid = svm_data->next_asid++;
-}
-
-static void svm_invlpg(struct kvm_vcpu *vcpu, gva_t address)
-{
-        invlpga(address, vcpu->svm->vmcb->control.asid); // is needed?
+        svm->vcpu.cpu = svm_data->cpu;
+        svm->asid_generation = svm_data->asid_generation;
+        svm->vmcb->control.asid = svm_data->next_asid++;
 }
 
 static unsigned long svm_get_dr(struct kvm_vcpu *vcpu, int dr)
 {
-        return vcpu->svm->db_regs[dr];
+        return to_svm(vcpu)->db_regs[dr];
 }
 
 static void svm_set_dr(struct kvm_vcpu *vcpu, int dr, unsigned long value,
                        int *exception)
 {
+        struct vcpu_svm *svm = to_svm(vcpu);
+
         *exception = 0;
 
-        if (vcpu->svm->vmcb->save.dr7 & DR7_GD_MASK) {
-                vcpu->svm->vmcb->save.dr7 &= ~DR7_GD_MASK;
-                vcpu->svm->vmcb->save.dr6 |= DR6_BD_MASK;
+        if (svm->vmcb->save.dr7 & DR7_GD_MASK) {
+                svm->vmcb->save.dr7 &= ~DR7_GD_MASK;
+                svm->vmcb->save.dr6 |= DR6_BD_MASK;
                 *exception = DB_VECTOR;
                 return;
         }
 
         switch (dr) {
         case 0 ... 3:
-                vcpu->svm->db_regs[dr] = value;
+                svm->db_regs[dr] = value;
                 return;
         case 4 ... 5:
-                if (vcpu->cr4 & CR4_DE_MASK) {
+                if (vcpu->cr4 & X86_CR4_DE) {
                         *exception = UD_VECTOR;
                         return;
                 }
@@ -886,7 +912,7 @@ static void svm_set_dr(struct kvm_vcpu *vcpu, int dr, unsigned long value,
                         *exception = GP_VECTOR;
                         return;
                 }
-                vcpu->svm->vmcb->save.dr7 = value;
+                svm->vmcb->save.dr7 = value;
                 return;
         }
         default:
@@ -897,42 +923,44 @@ static void svm_set_dr(struct kvm_vcpu *vcpu, int dr, unsigned long value,
         }
 }
 
-static int pf_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static int pf_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
 {
-        u32 exit_int_info = vcpu->svm->vmcb->control.exit_int_info;
+        u32 exit_int_info = svm->vmcb->control.exit_int_info;
+        struct kvm *kvm = svm->vcpu.kvm;
         u64 fault_address;
         u32 error_code;
         enum emulation_result er;
         int r;
 
-        if (is_external_interrupt(exit_int_info))
-                push_irq(vcpu, exit_int_info & SVM_EVTINJ_VEC_MASK);
+        if (!irqchip_in_kernel(kvm) &&
+                is_external_interrupt(exit_int_info))
+                push_irq(&svm->vcpu, exit_int_info & SVM_EVTINJ_VEC_MASK);
 
-        spin_lock(&vcpu->kvm->lock);
+        mutex_lock(&kvm->lock);
 
-        fault_address  = vcpu->svm->vmcb->control.exit_info_2;
-        error_code = vcpu->svm->vmcb->control.exit_info_1;
-        r = kvm_mmu_page_fault(vcpu, fault_address, error_code);
+        fault_address  = svm->vmcb->control.exit_info_2;
+        error_code = svm->vmcb->control.exit_info_1;
+        r = kvm_mmu_page_fault(&svm->vcpu, fault_address, error_code);
         if (r < 0) {
-                spin_unlock(&vcpu->kvm->lock);
+                mutex_unlock(&kvm->lock);
                 return r;
         }
         if (!r) {
-                spin_unlock(&vcpu->kvm->lock);
+                mutex_unlock(&kvm->lock);
                 return 1;
         }
-        er = emulate_instruction(vcpu, kvm_run, fault_address, error_code);
-        spin_unlock(&vcpu->kvm->lock);
+        er = emulate_instruction(&svm->vcpu, kvm_run, fault_address,
+                                 error_code);
+        mutex_unlock(&kvm->lock);
 
         switch (er) {
         case EMULATE_DONE:
                 return 1;
         case EMULATE_DO_MMIO:
-                ++vcpu->stat.mmio_exits;
-                kvm_run->exit_reason = KVM_EXIT_MMIO;
+                ++svm->vcpu.stat.mmio_exits;
                 return 0;
         case EMULATE_FAIL:
-                vcpu_printf(vcpu, "%s: emulate fail\n", __FUNCTION__);
+                kvm_report_emulation_failure(&svm->vcpu, "pagetable");
                 break;
         default:
                 BUG();
@@ -942,252 +970,142 @@ static int pf_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
         return 0;
 }
 
-static int nm_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static int nm_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
 {
-       vcpu->svm->vmcb->control.intercept_exceptions &= ~(1 << NM_VECTOR);
-       if (!(vcpu->cr0 & CR0_TS_MASK))
-               vcpu->svm->vmcb->save.cr0 &= ~CR0_TS_MASK;
-       vcpu->fpu_active = 1;
+        svm->vmcb->control.intercept_exceptions &= ~(1 << NM_VECTOR);
+        if (!(svm->vcpu.cr0 & X86_CR0_TS))
+                svm->vmcb->save.cr0 &= ~X86_CR0_TS;
+        svm->vcpu.fpu_active = 1;
 
-       return 1;
+        return 1;
 }
 
-static int shutdown_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static int shutdown_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
 {
         /*
          * VMCB is undefined after a SHUTDOWN intercept
          * so reinitialize it.
          */
-        clear_page(vcpu->svm->vmcb);
-        init_vmcb(vcpu->svm->vmcb);
+        clear_page(svm->vmcb);
+        init_vmcb(svm->vmcb);
 
         kvm_run->exit_reason = KVM_EXIT_SHUTDOWN;
         return 0;
 }
 
-static int io_get_override(struct kvm_vcpu *vcpu,
-                          struct vmcb_seg **seg,
-                          int *addr_override)
-{
-        u8 inst[MAX_INST_SIZE];
-        unsigned ins_length;
-        gva_t rip;
-        int i;
-
-        rip =  vcpu->svm->vmcb->save.rip;
-        ins_length = vcpu->svm->next_rip - rip;
-        rip += vcpu->svm->vmcb->save.cs.base;
-
-        if (ins_length > MAX_INST_SIZE)
-                printk(KERN_DEBUG
-                       "%s: inst length err, cs base 0x%llx rip 0x%llx "
-                       "next rip 0x%llx ins_length %u\n",
-                       __FUNCTION__,
-                       vcpu->svm->vmcb->save.cs.base,
-                       vcpu->svm->vmcb->save.rip,
-                       vcpu->svm->vmcb->control.exit_info_2,
-                       ins_length);
-
-        if (kvm_read_guest(vcpu, rip, ins_length, inst) != ins_length)
-                /* #PF */
-                return 0;
-
-        *addr_override = 0;
-        *seg = NULL;
-        for (i = 0; i < ins_length; i++)
-                switch (inst[i]) {
-                case 0xf0:
-                case 0xf2:
-                case 0xf3:
-                case 0x66:
-                        continue;
-                case 0x67:
-                        *addr_override = 1;
-                        continue;
-                case 0x2e:
-                        *seg = &vcpu->svm->vmcb->save.cs;
-                        continue;
-                case 0x36:
-                        *seg = &vcpu->svm->vmcb->save.ss;
-                        continue;
-                case 0x3e:
-                        *seg = &vcpu->svm->vmcb->save.ds;
-                        continue;
-                case 0x26:
-                        *seg = &vcpu->svm->vmcb->save.es;
-                        continue;
-                case 0x64:
-                        *seg = &vcpu->svm->vmcb->save.fs;
-                        continue;
-                case 0x65:
-                        *seg = &vcpu->svm->vmcb->save.gs;
-                        continue;
-                default:
-                        return 1;
-                }
-        printk(KERN_DEBUG "%s: unexpected\n", __FUNCTION__);
-        return 0;
-}
-
-static unsigned long io_adress(struct kvm_vcpu *vcpu, int ins, gva_t *address)
+static int io_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
 {
-        unsigned long addr_mask;
-        unsigned long *reg;
-        struct vmcb_seg *seg;
-        int addr_override;
-        struct vmcb_save_area *save_area = &vcpu->svm->vmcb->save;
-        u16 cs_attrib = save_area->cs.attrib;
-        unsigned addr_size = get_addr_size(vcpu);
-
-        if (!io_get_override(vcpu, &seg, &addr_override))
-                return 0;
-
-        if (addr_override)
-                addr_size = (addr_size == 2) ? 4: (addr_size >> 1);
+        u32 io_info = svm->vmcb->control.exit_info_1; //address size bug?
+        int size, down, in, string, rep;
+        unsigned port;
 
-        if (ins) {
-                reg = &vcpu->regs[VCPU_REGS_RDI];
-                seg = &vcpu->svm->vmcb->save.es;
-        } else {
-                reg = &vcpu->regs[VCPU_REGS_RSI];
-                seg = (seg) ? seg : &vcpu->svm->vmcb->save.ds;
-        }
+        ++svm->vcpu.stat.io_exits;
 
-        addr_mask = ~0ULL >> (64 - (addr_size * 8));
+        svm->next_rip = svm->vmcb->control.exit_info_2;
 
-        if ((cs_attrib & SVM_SELECTOR_L_MASK) &&
-            !(vcpu->svm->vmcb->save.rflags & X86_EFLAGS_VM)) {
-                *address = (*reg & addr_mask);
-                return addr_mask;
-        }
+        string = (io_info & SVM_IOIO_STR_MASK) != 0;
 
-        if (!(seg->attrib & SVM_SELECTOR_P_SHIFT)) {
-                svm_inject_gp(vcpu, 0);
-                return 0;
+        if (string) {
+                if (emulate_instruction(&svm->vcpu, kvm_run, 0, 0) == EMULATE_DO_MMIO)
+                        return 0;
+                return 1;
         }
 
-        *address = (*reg & addr_mask) + seg->base;
-        return addr_mask;
-}
-
-static int io_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
-{
-        u32 io_info = vcpu->svm->vmcb->control.exit_info_1; //address size bug?
-        int size, down, in, string, rep;
-        unsigned port;
-        unsigned long count;
-        gva_t address = 0;
-
-        ++vcpu->stat.io_exits;
-
-        vcpu->svm->next_rip = vcpu->svm->vmcb->control.exit_info_2;
-
         in = (io_info & SVM_IOIO_TYPE_MASK) != 0;
         port = io_info >> 16;
         size = (io_info & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT;
-        string = (io_info & SVM_IOIO_STR_MASK) != 0;
         rep = (io_info & SVM_IOIO_REP_MASK) != 0;
-        count = 1;
-        down = (vcpu->svm->vmcb->save.rflags & X86_EFLAGS_DF) != 0;
+        down = (svm->vmcb->save.rflags & X86_EFLAGS_DF) != 0;
 
-        if (string) {
-                unsigned addr_mask;
-
-                addr_mask = io_adress(vcpu, in, &address);
-                if (!addr_mask) {
-                        printk(KERN_DEBUG "%s: get io address failed\n",
-                               __FUNCTION__);
-                        return 1;
-                }
-
-                if (rep)
-                        count = vcpu->regs[VCPU_REGS_RCX] & addr_mask;
-        }
-        return kvm_setup_pio(vcpu, kvm_run, in, size, count, string, down,
-                             address, rep, port);
+        return kvm_emulate_pio(&svm->vcpu, kvm_run, in, size, port);
 }
 
-static int nop_on_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static int nop_on_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
 {
         return 1;
 }
 
-static int halt_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static int halt_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
 {
-        vcpu->svm->next_rip = vcpu->svm->vmcb->save.rip + 1;
-        skip_emulated_instruction(vcpu);
-        return kvm_emulate_halt(vcpu);
+        svm->next_rip = svm->vmcb->save.rip + 1;
+        skip_emulated_instruction(&svm->vcpu);
+        return kvm_emulate_halt(&svm->vcpu);
 }
 
-static int vmmcall_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static int vmmcall_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
 {
-        vcpu->svm->next_rip = vcpu->svm->vmcb->save.rip + 3;
-        skip_emulated_instruction(vcpu);
-        return kvm_hypercall(vcpu, kvm_run);
+        svm->next_rip = svm->vmcb->save.rip + 3;
+        skip_emulated_instruction(&svm->vcpu);
+        return kvm_hypercall(&svm->vcpu, kvm_run);
 }
 
-static int invalid_op_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static int invalid_op_interception(struct vcpu_svm *svm,
+                                   struct kvm_run *kvm_run)
 {
-        inject_ud(vcpu);
+        inject_ud(&svm->vcpu);
         return 1;
 }
 
-static int task_switch_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static int task_switch_interception(struct vcpu_svm *svm,
+                                    struct kvm_run *kvm_run)
 {
-        printk(KERN_DEBUG "%s: task swiche is unsupported\n", __FUNCTION__);
+        pr_unimpl(&svm->vcpu, "%s: task switch is unsupported\n", __FUNCTION__);
         kvm_run->exit_reason = KVM_EXIT_UNKNOWN;
         return 0;
 }
 
-static int cpuid_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static int cpuid_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
 {
-        vcpu->svm->next_rip = vcpu->svm->vmcb->save.rip + 2;
-        kvm_emulate_cpuid(vcpu);
+        svm->next_rip = svm->vmcb->save.rip + 2;
+        kvm_emulate_cpuid(&svm->vcpu);
         return 1;
 }
 
-static int emulate_on_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static int emulate_on_interception(struct vcpu_svm *svm,
+                                   struct kvm_run *kvm_run)
 {
-        if (emulate_instruction(vcpu, NULL, 0, 0) != EMULATE_DONE)
-                printk(KERN_ERR "%s: failed\n", __FUNCTION__);
+        if (emulate_instruction(&svm->vcpu, NULL, 0, 0) != EMULATE_DONE)
+                pr_unimpl(&svm->vcpu, "%s: failed\n", __FUNCTION__);
         return 1;
 }
 
 static int svm_get_msr(struct kvm_vcpu *vcpu, unsigned ecx, u64 *data)
 {
+        struct vcpu_svm *svm = to_svm(vcpu);
+
         switch (ecx) {
         case MSR_IA32_TIME_STAMP_COUNTER: {
                 u64 tsc;
 
                 rdtscll(tsc);
-                *data = vcpu->svm->vmcb->control.tsc_offset + tsc;
+                *data = svm->vmcb->control.tsc_offset + tsc;
                 break;
         }
         case MSR_K6_STAR:
-                *data = vcpu->svm->vmcb->save.star;
+                *data = svm->vmcb->save.star;
                 break;
 #ifdef CONFIG_X86_64
         case MSR_LSTAR:
-                *data = vcpu->svm->vmcb->save.lstar;
+                *data = svm->vmcb->save.lstar;
                 break;
         case MSR_CSTAR:
-                *data = vcpu->svm->vmcb->save.cstar;
+                *data = svm->vmcb->save.cstar;
                 break;
         case MSR_KERNEL_GS_BASE:
-                *data = vcpu->svm->vmcb->save.kernel_gs_base;
+                *data = svm->vmcb->save.kernel_gs_base;
                 break;
         case MSR_SYSCALL_MASK:
-                *data = vcpu->svm->vmcb->save.sfmask;
+                *data = svm->vmcb->save.sfmask;
                 break;
 #endif
         case MSR_IA32_SYSENTER_CS:
-                *data = vcpu->svm->vmcb->save.sysenter_cs;
+                *data = svm->vmcb->save.sysenter_cs;
                 break;
         case MSR_IA32_SYSENTER_EIP:
-                *data = vcpu->svm->vmcb->save.sysenter_eip;
+                *data = svm->vmcb->save.sysenter_eip;
                 break;
         case MSR_IA32_SYSENTER_ESP:
-                *data = vcpu->svm->vmcb->save.sysenter_esp;
+                *data = svm->vmcb->save.sysenter_esp;
                 break;
         default:
                 return kvm_get_msr_common(vcpu, ecx, data);
@@ -1195,57 +1113,59 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, unsigned ecx, u64 *data)
         return 0;
 }
 
-static int rdmsr_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static int rdmsr_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
 {
-        u32 ecx = vcpu->regs[VCPU_REGS_RCX];
+        u32 ecx = svm->vcpu.regs[VCPU_REGS_RCX];
         u64 data;
 
-        if (svm_get_msr(vcpu, ecx, &data))
-                svm_inject_gp(vcpu, 0);
+        if (svm_get_msr(&svm->vcpu, ecx, &data))
+                svm_inject_gp(&svm->vcpu, 0);
         else {
-                vcpu->svm->vmcb->save.rax = data & 0xffffffff;
-                vcpu->regs[VCPU_REGS_RDX] = data >> 32;
-                vcpu->svm->next_rip = vcpu->svm->vmcb->save.rip + 2;
-                skip_emulated_instruction(vcpu);
+                svm->vmcb->save.rax = data & 0xffffffff;
+                svm->vcpu.regs[VCPU_REGS_RDX] = data >> 32;
+                svm->next_rip = svm->vmcb->save.rip + 2;
+                skip_emulated_instruction(&svm->vcpu);
         }
         return 1;
 }
 
 static int svm_set_msr(struct kvm_vcpu *vcpu, unsigned ecx, u64 data)
 {
+        struct vcpu_svm *svm = to_svm(vcpu);
+
         switch (ecx) {
         case MSR_IA32_TIME_STAMP_COUNTER: {
                 u64 tsc;
 
                 rdtscll(tsc);
-                vcpu->svm->vmcb->control.tsc_offset = data - tsc;
+                svm->vmcb->control.tsc_offset = data - tsc;
                 break;
         }
         case MSR_K6_STAR:
-                vcpu->svm->vmcb->save.star = data;
+                svm->vmcb->save.star = data;
                 break;
 #ifdef CONFIG_X86_64
         case MSR_LSTAR:
-                vcpu->svm->vmcb->save.lstar = data;
+                svm->vmcb->save.lstar = data;
                 break;
         case MSR_CSTAR:
-                vcpu->svm->vmcb->save.cstar = data;
+                svm->vmcb->save.cstar = data;
                 break;
         case MSR_KERNEL_GS_BASE:
-                vcpu->svm->vmcb->save.kernel_gs_base = data;
+                svm->vmcb->save.kernel_gs_base = data;
                 break;
         case MSR_SYSCALL_MASK:
-                vcpu->svm->vmcb->save.sfmask = data;
+                svm->vmcb->save.sfmask = data;
                 break;
 #endif
         case MSR_IA32_SYSENTER_CS:
-                vcpu->svm->vmcb->save.sysenter_cs = data;
+                svm->vmcb->save.sysenter_cs = data;
                 break;
         case MSR_IA32_SYSENTER_EIP:
-                vcpu->svm->vmcb->save.sysenter_eip = data;
+                svm->vmcb->save.sysenter_eip = data;
                 break;
         case MSR_IA32_SYSENTER_ESP:
-                vcpu->svm->vmcb->save.sysenter_esp = data;
+                svm->vmcb->save.sysenter_esp = data;
                 break;
         default:
                 return kvm_set_msr_common(vcpu, ecx, data);
@@ -1253,37 +1173,39 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, unsigned ecx, u64 data)
         return 0;
 }
 
-static int wrmsr_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static int wrmsr_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
 {
-        u32 ecx = vcpu->regs[VCPU_REGS_RCX];
-        u64 data = (vcpu->svm->vmcb->save.rax & -1u)
-                | ((u64)(vcpu->regs[VCPU_REGS_RDX] & -1u) << 32);
-        vcpu->svm->next_rip = vcpu->svm->vmcb->save.rip + 2;
-        if (svm_set_msr(vcpu, ecx, data))
-                svm_inject_gp(vcpu, 0);
+        u32 ecx = svm->vcpu.regs[VCPU_REGS_RCX];
+        u64 data = (svm->vmcb->save.rax & -1u)
+                | ((u64)(svm->vcpu.regs[VCPU_REGS_RDX] & -1u) << 32);
+        svm->next_rip = svm->vmcb->save.rip + 2;
+        if (svm_set_msr(&svm->vcpu, ecx, data))
+                svm_inject_gp(&svm->vcpu, 0);
         else
-                skip_emulated_instruction(vcpu);
+                skip_emulated_instruction(&svm->vcpu);
         return 1;
 }
 
-static int msr_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static int msr_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
 {
-        if (vcpu->svm->vmcb->control.exit_info_1)
-                return wrmsr_interception(vcpu, kvm_run);
+        if (svm->vmcb->control.exit_info_1)
+                return wrmsr_interception(svm, kvm_run);
         else
-                return rdmsr_interception(vcpu, kvm_run);
+                return rdmsr_interception(svm, kvm_run);
 }
 
-static int interrupt_window_interception(struct kvm_vcpu *vcpu,
+static int interrupt_window_interception(struct vcpu_svm *svm,
                                    struct kvm_run *kvm_run)
 {
+        svm->vmcb->control.intercept &= ~(1ULL << INTERCEPT_VINTR);
+        svm->vmcb->control.int_ctl &= ~V_IRQ_MASK;
         /*
          * If the user space waits to inject interrupts, exit as soon as
          * possible
          */
         if (kvm_run->request_interrupt_window &&
-            !vcpu->irq_summary) {
-                ++vcpu->stat.irq_window_exits;
+            !svm->vcpu.irq_summary) {
+                ++svm->vcpu.stat.irq_window_exits;
                 kvm_run->exit_reason = KVM_EXIT_IRQ_WINDOW_OPEN;
                 return 0;
         }
@@ -1291,7 +1213,7 @@ static int interrupt_window_interception(struct kvm_vcpu *vcpu,
         return 1;
 }
 
-static int (*svm_exit_handlers[])(struct kvm_vcpu *vcpu,
+static int (*svm_exit_handlers[])(struct vcpu_svm *svm,
                                       struct kvm_run *kvm_run) = {
         [SVM_EXIT_READ_CR0]                     = emulate_on_interception,
         [SVM_EXIT_READ_CR3]                     = emulate_on_interception,
@@ -1338,15 +1260,25 @@ static int (*svm_exit_handlers[])(struct kvm_vcpu *vcpu,
 };
 
 
-static int handle_exit(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static int handle_exit(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
 {
-        u32 exit_code = vcpu->svm->vmcb->control.exit_code;
+        struct vcpu_svm *svm = to_svm(vcpu);
+        u32 exit_code = svm->vmcb->control.exit_code;
+
+        kvm_reput_irq(svm);
 
-        if (is_external_interrupt(vcpu->svm->vmcb->control.exit_int_info) &&
+        if (svm->vmcb->control.exit_code == SVM_EXIT_ERR) {
+                kvm_run->exit_reason = KVM_EXIT_FAIL_ENTRY;
+                kvm_run->fail_entry.hardware_entry_failure_reason
+                        = svm->vmcb->control.exit_code;
+                return 0;
+        }
+
+        if (is_external_interrupt(svm->vmcb->control.exit_int_info) &&
             exit_code != SVM_EXIT_EXCP_BASE + PF_VECTOR)
                 printk(KERN_ERR "%s: unexpected exit_ini_info 0x%x "
                        "exit_code 0x%x\n",
-                       __FUNCTION__, vcpu->svm->vmcb->control.exit_int_info,
+                       __FUNCTION__, svm->vmcb->control.exit_int_info,
                        exit_code);
 
         if (exit_code >= ARRAY_SIZE(svm_exit_handlers)
@@ -1356,7 +1288,7 @@ static int handle_exit(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
                 return 0;
         }
 
-        return svm_exit_handlers[exit_code](vcpu, kvm_run);
+        return svm_exit_handlers[exit_code](svm, kvm_run);
 }
 
 static void reload_tss(struct kvm_vcpu *vcpu)
@@ -1368,93 +1300,126 @@ static void reload_tss(struct kvm_vcpu *vcpu)
         load_TR_desc();
 }
 
-static void pre_svm_run(struct kvm_vcpu *vcpu)
+static void pre_svm_run(struct vcpu_svm *svm)
 {
         int cpu = raw_smp_processor_id();
 
         struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
 
-        vcpu->svm->vmcb->control.tlb_ctl = TLB_CONTROL_DO_NOTHING;
-        if (vcpu->cpu != cpu ||
-            vcpu->svm->asid_generation != svm_data->asid_generation)
-                new_asid(vcpu, svm_data);
+        svm->vmcb->control.tlb_ctl = TLB_CONTROL_DO_NOTHING;
+        if (svm->vcpu.cpu != cpu ||
+            svm->asid_generation != svm_data->asid_generation)
+                new_asid(svm, svm_data);
 }
 
 
-static inline void kvm_do_inject_irq(struct kvm_vcpu *vcpu)
+static inline void svm_inject_irq(struct vcpu_svm *svm, int irq)
 {
         struct vmcb_control_area *control;
 
-        control = &vcpu->svm->vmcb->control;
-        control->int_vector = pop_irq(vcpu);
+        control = &svm->vmcb->control;
+        control->int_vector = irq;
         control->int_ctl &= ~V_INTR_PRIO_MASK;
         control->int_ctl |= V_IRQ_MASK |
                 ((/*control->int_vector >> 4*/ 0xf) << V_INTR_PRIO_SHIFT);
 }
 
-static void kvm_reput_irq(struct kvm_vcpu *vcpu)
+static void svm_set_irq(struct kvm_vcpu *vcpu, int irq)
+{
+        struct vcpu_svm *svm = to_svm(vcpu);
+
+        svm_inject_irq(svm, irq);
+}
+
+static void svm_intr_assist(struct kvm_vcpu *vcpu)
+{
+        struct vcpu_svm *svm = to_svm(vcpu);
+        struct vmcb *vmcb = svm->vmcb;
+        int intr_vector = -1;
+
+        kvm_inject_pending_timer_irqs(vcpu);
+        if ((vmcb->control.exit_int_info & SVM_EVTINJ_VALID) &&
+            ((vmcb->control.exit_int_info & SVM_EVTINJ_TYPE_MASK) == 0)) {
+                intr_vector = vmcb->control.exit_int_info &
+                              SVM_EVTINJ_VEC_MASK;
+                vmcb->control.exit_int_info = 0;
+                svm_inject_irq(svm, intr_vector);
+                return;
+        }
+
+        if (vmcb->control.int_ctl & V_IRQ_MASK)
+                return;
+
+        if (!kvm_cpu_has_interrupt(vcpu))
+                return;
+
+        if (!(vmcb->save.rflags & X86_EFLAGS_IF) ||
+            (vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK) ||
+            (vmcb->control.event_inj & SVM_EVTINJ_VALID)) {
+                /* unable to deliver irq, set pending irq */
+                vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
+                svm_inject_irq(svm, 0x0);
+                return;
+        }
+        /* Okay, we can deliver the interrupt: grab it and update PIC state. */
+        intr_vector = kvm_cpu_get_interrupt(vcpu);
+        svm_inject_irq(svm, intr_vector);
+        kvm_timer_intr_post(vcpu, intr_vector);
+}
+
+static void kvm_reput_irq(struct vcpu_svm *svm)
 {
-        struct vmcb_control_area *control = &vcpu->svm->vmcb->control;
+        struct vmcb_control_area *control = &svm->vmcb->control;
 
-        if (control->int_ctl & V_IRQ_MASK) {
+        if ((control->int_ctl & V_IRQ_MASK)
+            && !irqchip_in_kernel(svm->vcpu.kvm)) {
                 control->int_ctl &= ~V_IRQ_MASK;
-                push_irq(vcpu, control->int_vector);
+                push_irq(&svm->vcpu, control->int_vector);
         }
 
-        vcpu->interrupt_window_open =
+        svm->vcpu.interrupt_window_open =
                 !(control->int_state & SVM_INTERRUPT_SHADOW_MASK);
 }
 
+static void svm_do_inject_vector(struct vcpu_svm *svm)
+{
+        struct kvm_vcpu *vcpu = &svm->vcpu;
+        int word_index = __ffs(vcpu->irq_summary);
+        int bit_index = __ffs(vcpu->irq_pending[word_index]);
+        int irq = word_index * BITS_PER_LONG + bit_index;
+
+        clear_bit(bit_index, &vcpu->irq_pending[word_index]);
+        if (!vcpu->irq_pending[word_index])
+                clear_bit(word_index, &vcpu->irq_summary);
+        svm_inject_irq(svm, irq);
+}
+
 static void do_interrupt_requests(struct kvm_vcpu *vcpu,
                                        struct kvm_run *kvm_run)
 {
-        struct vmcb_control_area *control = &vcpu->svm->vmcb->control;
+        struct vcpu_svm *svm = to_svm(vcpu);
+        struct vmcb_control_area *control = &svm->vmcb->control;
 
-        vcpu->interrupt_window_open =
+        svm->vcpu.interrupt_window_open =
                 (!(control->int_state & SVM_INTERRUPT_SHADOW_MASK) &&
-                 (vcpu->svm->vmcb->save.rflags & X86_EFLAGS_IF));
+                 (svm->vmcb->save.rflags & X86_EFLAGS_IF));
 
-        if (vcpu->interrupt_window_open && vcpu->irq_summary)
+        if (svm->vcpu.interrupt_window_open && svm->vcpu.irq_summary)
                 /*
                  * If interrupts enabled, and not blocked by sti or mov ss. Good.
                  */
-                kvm_do_inject_irq(vcpu);
+                svm_do_inject_vector(svm);
 
         /*
          * Interrupts blocked.  Wait for unblock.
          */
-        if (!vcpu->interrupt_window_open &&
-            (vcpu->irq_summary || kvm_run->request_interrupt_window)) {
+        if (!svm->vcpu.interrupt_window_open &&
+            (svm->vcpu.irq_summary || kvm_run->request_interrupt_window)) {
                 control->intercept |= 1ULL << INTERCEPT_VINTR;
         } else
                 control->intercept &= ~(1ULL << INTERCEPT_VINTR);
 }
 
-static void post_kvm_run_save(struct kvm_vcpu *vcpu,
-                              struct kvm_run *kvm_run)
-{
-        kvm_run->ready_for_interrupt_injection = (vcpu->interrupt_window_open &&
-                                                  vcpu->irq_summary == 0);
-        kvm_run->if_flag = (vcpu->svm->vmcb->save.rflags & X86_EFLAGS_IF) != 0;
-        kvm_run->cr8 = vcpu->cr8;
-        kvm_run->apic_base = vcpu->apic_base;
-}
-
-/*
- * Check if userspace requested an interrupt window, and that the
- * interrupt window is open.
- *
- * No need to exit to userspace if we already have an interrupt queued.
- */
-static int dm_request_for_irq_injection(struct kvm_vcpu *vcpu,
-                                          struct kvm_run *kvm_run)
-{
-        return (!vcpu->irq_summary &&
-                kvm_run->request_interrupt_window &&
-                vcpu->interrupt_window_open &&
-                (vcpu->svm->vmcb->save.rflags & X86_EFLAGS_IF));
-}
-
 static void save_db_regs(unsigned long *db_regs)
 {
         asm volatile ("mov %%dr0, %0" : "=r"(db_regs[0]));
@@ -1476,49 +1441,37 @@ static void svm_flush_tlb(struct kvm_vcpu *vcpu)
         force_new_asid(vcpu);
 }
 
-static int svm_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static void svm_prepare_guest_switch(struct kvm_vcpu *vcpu)
+{
+}
+
+static void svm_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 {
+        struct vcpu_svm *svm = to_svm(vcpu);
         u16 fs_selector;
         u16 gs_selector;
         u16 ldt_selector;
-        int r;
-
-again:
-        r = kvm_mmu_reload(vcpu);
-        if (unlikely(r))
-                return r;
-
-        if (!vcpu->mmio_read_completed)
-                do_interrupt_requests(vcpu, kvm_run);
 
-        clgi();
-
-        vcpu->guest_mode = 1;
-        if (vcpu->requests)
-                if (test_and_clear_bit(KVM_TLB_FLUSH, &vcpu->requests))
-                    svm_flush_tlb(vcpu);
-
-        pre_svm_run(vcpu);
+        pre_svm_run(svm);
 
         save_host_msrs(vcpu);
         fs_selector = read_fs();
         gs_selector = read_gs();
         ldt_selector = read_ldt();
-        vcpu->svm->host_cr2 = kvm_read_cr2();
-        vcpu->svm->host_dr6 = read_dr6();
-        vcpu->svm->host_dr7 = read_dr7();
-        vcpu->svm->vmcb->save.cr2 = vcpu->cr2;
+        svm->host_cr2 = kvm_read_cr2();
+        svm->host_dr6 = read_dr6();
+        svm->host_dr7 = read_dr7();
+        svm->vmcb->save.cr2 = vcpu->cr2;
 
-        if (vcpu->svm->vmcb->save.dr7 & 0xff) {
+        if (svm->vmcb->save.dr7 & 0xff) {
                 write_dr7(0);
-                save_db_regs(vcpu->svm->host_db_regs);
-                load_db_regs(vcpu->svm->db_regs);
+                save_db_regs(svm->host_db_regs);
+                load_db_regs(svm->db_regs);
         }
 
-        if (vcpu->fpu_active) {
-                fx_save(vcpu->host_fx_image);
-                fx_restore(vcpu->guest_fx_image);
-        }
+        clgi();
+
+        local_irq_enable();
 
         asm volatile (
 #ifdef CONFIG_X86_64
@@ -1532,34 +1485,33 @@ again:
 #endif
 
 #ifdef CONFIG_X86_64
-                "mov %c[rbx](%[vcpu]), %%rbx \n\t"
-                "mov %c[rcx](%[vcpu]), %%rcx \n\t"
-                "mov %c[rdx](%[vcpu]), %%rdx \n\t"
-                "mov %c[rsi](%[vcpu]), %%rsi \n\t"
-                "mov %c[rdi](%[vcpu]), %%rdi \n\t"
-                "mov %c[rbp](%[vcpu]), %%rbp \n\t"
-                "mov %c[r8](%[vcpu]),  %%r8  \n\t"
-                "mov %c[r9](%[vcpu]),  %%r9  \n\t"
-                "mov %c[r10](%[vcpu]), %%r10 \n\t"
-                "mov %c[r11](%[vcpu]), %%r11 \n\t"
-                "mov %c[r12](%[vcpu]), %%r12 \n\t"
-                "mov %c[r13](%[vcpu]), %%r13 \n\t"
-                "mov %c[r14](%[vcpu]), %%r14 \n\t"
-                "mov %c[r15](%[vcpu]), %%r15 \n\t"
+                "mov %c[rbx](%[svm]), %%rbx \n\t"
+                "mov %c[rcx](%[svm]), %%rcx \n\t"
+                "mov %c[rdx](%[svm]), %%rdx \n\t"
+                "mov %c[rsi](%[svm]), %%rsi \n\t"
+                "mov %c[rdi](%[svm]), %%rdi \n\t"
+                "mov %c[rbp](%[svm]), %%rbp \n\t"
+                "mov %c[r8](%[svm]),  %%r8  \n\t"
+                "mov %c[r9](%[svm]),  %%r9  \n\t"
+                "mov %c[r10](%[svm]), %%r10 \n\t"
+                "mov %c[r11](%[svm]), %%r11 \n\t"
+                "mov %c[r12](%[svm]), %%r12 \n\t"
+                "mov %c[r13](%[svm]), %%r13 \n\t"
+                "mov %c[r14](%[svm]), %%r14 \n\t"
+                "mov %c[r15](%[svm]), %%r15 \n\t"
 #else
-                "mov %c[rbx](%[vcpu]), %%ebx \n\t"
-                "mov %c[rcx](%[vcpu]), %%ecx \n\t"
-                "mov %c[rdx](%[vcpu]), %%edx \n\t"
-                "mov %c[rsi](%[vcpu]), %%esi \n\t"
-                "mov %c[rdi](%[vcpu]), %%edi \n\t"
-                "mov %c[rbp](%[vcpu]), %%ebp \n\t"
+                "mov %c[rbx](%[svm]), %%ebx \n\t"
+                "mov %c[rcx](%[svm]), %%ecx \n\t"
+                "mov %c[rdx](%[svm]), %%edx \n\t"
+                "mov %c[rsi](%[svm]), %%esi \n\t"
+                "mov %c[rdi](%[svm]), %%edi \n\t"
+                "mov %c[rbp](%[svm]), %%ebp \n\t"
 #endif
 
 #ifdef CONFIG_X86_64
                 /* Enter guest mode */
                 "push %%rax \n\t"
-                "mov %c[svm](%[vcpu]), %%rax \n\t"
-                "mov %c[vmcb](%%rax), %%rax \n\t"
+                "mov %c[vmcb](%[svm]), %%rax \n\t"
                 SVM_VMLOAD "\n\t"
                 SVM_VMRUN "\n\t"
                 SVM_VMSAVE "\n\t"
@@ -1567,8 +1519,7 @@ again:
 #else
                 /* Enter guest mode */
                 "push %%eax \n\t"
-                "mov %c[svm](%[vcpu]), %%eax \n\t"
-                "mov %c[vmcb](%%eax), %%eax \n\t"
+                "mov %c[vmcb](%[svm]), %%eax \n\t"
                 SVM_VMLOAD "\n\t"
                 SVM_VMRUN "\n\t"
                 SVM_VMSAVE "\n\t"
@@ -1577,73 +1528,69 @@ again:
 
                 /* Save guest registers, load host registers */
 #ifdef CONFIG_X86_64
-                "mov %%rbx, %c[rbx](%[vcpu]) \n\t"
-                "mov %%rcx, %c[rcx](%[vcpu]) \n\t"
-                "mov %%rdx, %c[rdx](%[vcpu]) \n\t"
-                "mov %%rsi, %c[rsi](%[vcpu]) \n\t"
-                "mov %%rdi, %c[rdi](%[vcpu]) \n\t"
-                "mov %%rbp, %c[rbp](%[vcpu]) \n\t"
-                "mov %%r8,  %c[r8](%[vcpu]) \n\t"
-                "mov %%r9,  %c[r9](%[vcpu]) \n\t"
-                "mov %%r10, %c[r10](%[vcpu]) \n\t"
-                "mov %%r11, %c[r11](%[vcpu]) \n\t"
-                "mov %%r12, %c[r12](%[vcpu]) \n\t"
-                "mov %%r13, %c[r13](%[vcpu]) \n\t"
-                "mov %%r14, %c[r14](%[vcpu]) \n\t"
-                "mov %%r15, %c[r15](%[vcpu]) \n\t"
+                "mov %%rbx, %c[rbx](%[svm]) \n\t"
+                "mov %%rcx, %c[rcx](%[svm]) \n\t"
+                "mov %%rdx, %c[rdx](%[svm]) \n\t"
+                "mov %%rsi, %c[rsi](%[svm]) \n\t"
+                "mov %%rdi, %c[rdi](%[svm]) \n\t"
+                "mov %%rbp, %c[rbp](%[svm]) \n\t"
+                "mov %%r8,  %c[r8](%[svm]) \n\t"
+                "mov %%r9,  %c[r9](%[svm]) \n\t"
+                "mov %%r10, %c[r10](%[svm]) \n\t"
+                "mov %%r11, %c[r11](%[svm]) \n\t"
+                "mov %%r12, %c[r12](%[svm]) \n\t"
+                "mov %%r13, %c[r13](%[svm]) \n\t"
+                "mov %%r14, %c[r14](%[svm]) \n\t"
+                "mov %%r15, %c[r15](%[svm]) \n\t"
 
                 "pop  %%r15; pop  %%r14; pop  %%r13; pop  %%r12;"
                 "pop  %%r11; pop  %%r10; pop  %%r9;  pop  %%r8;"
                 "pop  %%rbp; pop  %%rdi; pop  %%rsi;"
                 "pop  %%rdx; pop  %%rcx; pop  %%rbx; \n\t"
 #else
-                "mov %%ebx, %c[rbx](%[vcpu]) \n\t"
-                "mov %%ecx, %c[rcx](%[vcpu]) \n\t"
-                "mov %%edx, %c[rdx](%[vcpu]) \n\t"
-                "mov %%esi, %c[rsi](%[vcpu]) \n\t"
-                "mov %%edi, %c[rdi](%[vcpu]) \n\t"
-                "mov %%ebp, %c[rbp](%[vcpu]) \n\t"
+                "mov %%ebx, %c[rbx](%[svm]) \n\t"
+                "mov %%ecx, %c[rcx](%[svm]) \n\t"
+                "mov %%edx, %c[rdx](%[svm]) \n\t"
+                "mov %%esi, %c[rsi](%[svm]) \n\t"
+                "mov %%edi, %c[rdi](%[svm]) \n\t"
+                "mov %%ebp, %c[rbp](%[svm]) \n\t"
 
                 "pop  %%ebp; pop  %%edi; pop  %%esi;"
                 "pop  %%edx; pop  %%ecx; pop  %%ebx; \n\t"
 #endif
                 :
-                : [vcpu]"a"(vcpu),
-                  [svm]"i"(offsetof(struct kvm_vcpu, svm)),
+                : [svm]"a"(svm),
                   [vmcb]"i"(offsetof(struct vcpu_svm, vmcb_pa)),
-                  [rbx]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_RBX])),
-                  [rcx]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_RCX])),
-                  [rdx]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_RDX])),
-                  [rsi]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_RSI])),
-                  [rdi]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_RDI])),
-                  [rbp]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_RBP]))
+                  [rbx]"i"(offsetof(struct vcpu_svm,vcpu.regs[VCPU_REGS_RBX])),
+                  [rcx]"i"(offsetof(struct vcpu_svm,vcpu.regs[VCPU_REGS_RCX])),
+                  [rdx]"i"(offsetof(struct vcpu_svm,vcpu.regs[VCPU_REGS_RDX])),
+                  [rsi]"i"(offsetof(struct vcpu_svm,vcpu.regs[VCPU_REGS_RSI])),
+                  [rdi]"i"(offsetof(struct vcpu_svm,vcpu.regs[VCPU_REGS_RDI])),
+                  [rbp]"i"(offsetof(struct vcpu_svm,vcpu.regs[VCPU_REGS_RBP]))
 #ifdef CONFIG_X86_64
-                  ,[r8 ]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_R8 ])),
-                  [r9 ]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_R9 ])),
-                  [r10]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_R10])),
-                  [r11]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_R11])),
-                  [r12]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_R12])),
-                  [r13]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_R13])),
-                  [r14]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_R14])),
-                  [r15]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_R15]))
+                  ,[r8 ]"i"(offsetof(struct vcpu_svm,vcpu.regs[VCPU_REGS_R8])),
+                  [r9 ]"i"(offsetof(struct vcpu_svm,vcpu.regs[VCPU_REGS_R9 ])),
+                  [r10]"i"(offsetof(struct vcpu_svm,vcpu.regs[VCPU_REGS_R10])),
+                  [r11]"i"(offsetof(struct vcpu_svm,vcpu.regs[VCPU_REGS_R11])),
+                  [r12]"i"(offsetof(struct vcpu_svm,vcpu.regs[VCPU_REGS_R12])),
+                  [r13]"i"(offsetof(struct vcpu_svm,vcpu.regs[VCPU_REGS_R13])),
+                  [r14]"i"(offsetof(struct vcpu_svm,vcpu.regs[VCPU_REGS_R14])),
+                  [r15]"i"(offsetof(struct vcpu_svm,vcpu.regs[VCPU_REGS_R15]))
 #endif
                 : "cc", "memory" );
 
-        vcpu->guest_mode = 0;
+        local_irq_disable();
 
-        if (vcpu->fpu_active) {
-                fx_save(vcpu->guest_fx_image);
-                fx_restore(vcpu->host_fx_image);
-        }
+        stgi();
 
-        if ((vcpu->svm->vmcb->save.dr7 & 0xff))
-                load_db_regs(vcpu->svm->host_db_regs);
+        if ((svm->vmcb->save.dr7 & 0xff))
+                load_db_regs(svm->host_db_regs);
 
-        vcpu->cr2 = vcpu->svm->vmcb->save.cr2;
+        vcpu->cr2 = svm->vmcb->save.cr2;
 
-        write_dr6(vcpu->svm->host_dr6);
-        write_dr7(vcpu->svm->host_dr7);
-        kvm_write_cr2(vcpu->svm->host_cr2);
+        write_dr6(svm->host_dr6);
+        write_dr7(svm->host_dr7);
+        kvm_write_cr2(svm->host_cr2);
 
         load_fs(fs_selector);
         load_gs(gs_selector);
@@ -1652,57 +1599,19 @@ again:
 
         reload_tss(vcpu);
 
-        /*
-         * Profile KVM exit RIPs:
-         */
-        if (unlikely(prof_on == KVM_PROFILING))
-                profile_hit(KVM_PROFILING,
-                        (void *)(unsigned long)vcpu->svm->vmcb->save.rip);
-
-        stgi();
-
-        kvm_reput_irq(vcpu);
-
-        vcpu->svm->next_rip = 0;
-
-        if (vcpu->svm->vmcb->control.exit_code == SVM_EXIT_ERR) {
-                kvm_run->exit_reason = KVM_EXIT_FAIL_ENTRY;
-                kvm_run->fail_entry.hardware_entry_failure_reason
-                        = vcpu->svm->vmcb->control.exit_code;
-                post_kvm_run_save(vcpu, kvm_run);
-                return 0;
-        }
-
-        r = handle_exit(vcpu, kvm_run);
-        if (r > 0) {
-                if (signal_pending(current)) {
-                        ++vcpu->stat.signal_exits;
-                        post_kvm_run_save(vcpu, kvm_run);
-                        kvm_run->exit_reason = KVM_EXIT_INTR;
-                        return -EINTR;
-                }
-
-                if (dm_request_for_irq_injection(vcpu, kvm_run)) {
-                        ++vcpu->stat.request_irq_exits;
-                        post_kvm_run_save(vcpu, kvm_run);
-                        kvm_run->exit_reason = KVM_EXIT_INTR;
-                        return -EINTR;
-                }
-                kvm_resched(vcpu);
-                goto again;
-        }
-        post_kvm_run_save(vcpu, kvm_run);
-        return r;
+        svm->next_rip = 0;
 }
 
 static void svm_set_cr3(struct kvm_vcpu *vcpu, unsigned long root)
 {
-        vcpu->svm->vmcb->save.cr3 = root;
+        struct vcpu_svm *svm = to_svm(vcpu);
+
+        svm->vmcb->save.cr3 = root;
         force_new_asid(vcpu);
 
         if (vcpu->fpu_active) {
-                vcpu->svm->vmcb->control.intercept_exceptions |= (1 << NM_VECTOR);
-                vcpu->svm->vmcb->save.cr0 |= CR0_TS_MASK;
+                svm->vmcb->control.intercept_exceptions |= (1 << NM_VECTOR);
+                svm->vmcb->save.cr0 |= X86_CR0_TS;
                 vcpu->fpu_active = 0;
         }
 }
@@ -1711,26 +1620,27 @@ static void svm_inject_page_fault(struct kvm_vcpu *vcpu,
                                   unsigned long  addr,
                                   uint32_t err_code)
 {
-        uint32_t exit_int_info = vcpu->svm->vmcb->control.exit_int_info;
+        struct vcpu_svm *svm = to_svm(vcpu);
+        uint32_t exit_int_info = svm->vmcb->control.exit_int_info;
 
         ++vcpu->stat.pf_guest;
 
         if (is_page_fault(exit_int_info)) {
 
-                vcpu->svm->vmcb->control.event_inj_err = 0;
-                vcpu->svm->vmcb->control.event_inj =    SVM_EVTINJ_VALID |
-                                                        SVM_EVTINJ_VALID_ERR |
-                                                        SVM_EVTINJ_TYPE_EXEPT |
-                                                        DF_VECTOR;
+                svm->vmcb->control.event_inj_err = 0;
+                svm->vmcb->control.event_inj =  SVM_EVTINJ_VALID |
+                                                SVM_EVTINJ_VALID_ERR |
+                                                SVM_EVTINJ_TYPE_EXEPT |
+                                                DF_VECTOR;
                 return;
         }
         vcpu->cr2 = addr;
-        vcpu->svm->vmcb->save.cr2 = addr;
-        vcpu->svm->vmcb->control.event_inj =    SVM_EVTINJ_VALID |
-                                                SVM_EVTINJ_VALID_ERR |
-                                                SVM_EVTINJ_TYPE_EXEPT |
-                                                PF_VECTOR;
-        vcpu->svm->vmcb->control.event_inj_err = err_code;
+        svm->vmcb->save.cr2 = addr;
+        svm->vmcb->control.event_inj =  SVM_EVTINJ_VALID |
+                                        SVM_EVTINJ_VALID_ERR |
+                                        SVM_EVTINJ_TYPE_EXEPT |
+                                        PF_VECTOR;
+        svm->vmcb->control.event_inj_err = err_code;
 }
 
 
@@ -1757,17 +1667,25 @@ svm_patch_hypercall(struct kvm_vcpu *vcpu, unsigned char *hypercall)
         hypercall[3] = 0xc3;
 }
 
-static struct kvm_arch_ops svm_arch_ops = {
+static void svm_check_processor_compat(void *rtn)
+{
+        *(int *)rtn = 0;
+}
+
+static struct kvm_x86_ops svm_x86_ops = {
         .cpu_has_kvm_support = has_svm,
         .disabled_by_bios = is_disabled,
         .hardware_setup = svm_hardware_setup,
         .hardware_unsetup = svm_hardware_unsetup,
+        .check_processor_compatibility = svm_check_processor_compat,
         .hardware_enable = svm_hardware_enable,
         .hardware_disable = svm_hardware_disable,
 
         .vcpu_create = svm_create_vcpu,
         .vcpu_free = svm_free_vcpu,
+        .vcpu_reset = svm_vcpu_reset,
 
+        .prepare_guest_switch = svm_prepare_guest_switch,
         .vcpu_load = svm_vcpu_load,
         .vcpu_put = svm_vcpu_put,
         .vcpu_decache = svm_vcpu_decache,
@@ -1778,7 +1696,7 @@ static struct kvm_arch_ops svm_arch_ops = {
         .get_segment_base = svm_get_segment_base,
         .get_segment = svm_get_segment,
         .set_segment = svm_set_segment,
-        .get_cs_db_l_bits = svm_get_cs_db_l_bits,
+        .get_cs_db_l_bits = kvm_get_cs_db_l_bits,
         .decache_cr4_guest_bits = svm_decache_cr4_guest_bits,
         .set_cr0 = svm_set_cr0,
         .set_cr3 = svm_set_cr3,
@@ -1795,26 +1713,30 @@ static struct kvm_arch_ops svm_arch_ops = {
         .get_rflags = svm_get_rflags,
         .set_rflags = svm_set_rflags,
 
-        .invlpg = svm_invlpg,
         .tlb_flush = svm_flush_tlb,
         .inject_page_fault = svm_inject_page_fault,
 
         .inject_gp = svm_inject_gp,
 
         .run = svm_vcpu_run,
+        .handle_exit = handle_exit,
         .skip_emulated_instruction = skip_emulated_instruction,
-        .vcpu_setup = svm_vcpu_setup,
         .patch_hypercall = svm_patch_hypercall,
+        .get_irq = svm_get_irq,
+        .set_irq = svm_set_irq,
+        .inject_pending_irq = svm_intr_assist,
+        .inject_pending_vectors = do_interrupt_requests,
 };
 
 static int __init svm_init(void)
 {
-        return kvm_init_arch(&svm_arch_ops, THIS_MODULE);
+        return kvm_init_x86(&svm_x86_ops, sizeof(struct vcpu_svm),
+                              THIS_MODULE);
 }
 
 static void __exit svm_exit(void)
 {
-        kvm_exit_arch();
+        kvm_exit_x86();
 }
 
 module_init(svm_init)
diff --git a/drivers/kvm/vmx.c b/drivers/kvm/vmx.c
index 80628f69916d..4f115a8e45ef 100644
--- a/drivers/kvm/vmx.c
+++ b/drivers/kvm/vmx.c
@@ -16,6 +16,8 @@
  */
 
 #include "kvm.h"
+#include "x86_emulate.h"
+#include "irq.h"
 #include "vmx.h"
 #include "segment_descriptor.h"
 
@@ -23,7 +25,6 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/highmem.h>
-#include <linux/profile.h>
 #include <linux/sched.h>
 
 #include <asm/io.h>
@@ -32,6 +33,39 @@
 MODULE_AUTHOR("Qumranet");
 MODULE_LICENSE("GPL");
 
+struct vmcs {
+        u32 revision_id;
+        u32 abort;
+        char data[0];
+};
+
+struct vcpu_vmx {
+        struct kvm_vcpu       vcpu;
+        int                   launched;
+        u8                    fail;
+        struct kvm_msr_entry *guest_msrs;
+        struct kvm_msr_entry *host_msrs;
+        int                   nmsrs;
+        int                   save_nmsrs;
+        int                   msr_offset_efer;
+#ifdef CONFIG_X86_64
+        int                   msr_offset_kernel_gs_base;
+#endif
+        struct vmcs          *vmcs;
+        struct {
+                int           loaded;
+                u16           fs_sel, gs_sel, ldt_sel;
+                int           gs_ldt_reload_needed;
+                int           fs_reload_needed;
+        }host_state;
+
+};
+
+static inline struct vcpu_vmx *to_vmx(struct kvm_vcpu *vcpu)
+{
+        return container_of(vcpu, struct vcpu_vmx, vcpu);
+}
+
 static int init_rmode_tss(struct kvm *kvm);
 
 static DEFINE_PER_CPU(struct vmcs *, vmxarea);
@@ -40,18 +74,17 @@ static DEFINE_PER_CPU(struct vmcs *, current_vmcs);
 static struct page *vmx_io_bitmap_a;
 static struct page *vmx_io_bitmap_b;
 
-#ifdef CONFIG_X86_64
-#define HOST_IS_64 1
-#else
-#define HOST_IS_64 0
-#endif
 #define EFER_SAVE_RESTORE_BITS ((u64)EFER_SCE)
 
-static struct vmcs_descriptor {
+static struct vmcs_config {
         int size;
         int order;
         u32 revision_id;
-} vmcs_descriptor;
+        u32 pin_based_exec_ctrl;
+        u32 cpu_based_exec_ctrl;
+        u32 vmexit_ctrl;
+        u32 vmentry_ctrl;
+} vmcs_config;
 
 #define VMX_SEGMENT_FIELD(seg)                                  \
         [VCPU_SREG_##seg] = {                                   \
@@ -89,16 +122,32 @@ static const u32 vmx_msr_index[] = {
 };
 #define NR_VMX_MSR ARRAY_SIZE(vmx_msr_index)
 
-static inline u64 msr_efer_save_restore_bits(struct vmx_msr_entry msr)
+static void load_msrs(struct kvm_msr_entry *e, int n)
+{
+        int i;
+
+        for (i = 0; i < n; ++i)
+                wrmsrl(e[i].index, e[i].data);
+}
+
+static void save_msrs(struct kvm_msr_entry *e, int n)
+{
+        int i;
+
+        for (i = 0; i < n; ++i)
+                rdmsrl(e[i].index, e[i].data);
+}
+
+static inline u64 msr_efer_save_restore_bits(struct kvm_msr_entry msr)
 {
         return (u64)msr.data & EFER_SAVE_RESTORE_BITS;
 }
 
-static inline int msr_efer_need_save_restore(struct kvm_vcpu *vcpu)
+static inline int msr_efer_need_save_restore(struct vcpu_vmx *vmx)
 {
-        int efer_offset = vcpu->msr_offset_efer;
-        return msr_efer_save_restore_bits(vcpu->host_msrs[efer_offset]) !=
-                msr_efer_save_restore_bits(vcpu->guest_msrs[efer_offset]);
+        int efer_offset = vmx->msr_offset_efer;
+        return msr_efer_save_restore_bits(vmx->host_msrs[efer_offset]) !=
+                msr_efer_save_restore_bits(vmx->guest_msrs[efer_offset]);
 }
 
 static inline int is_page_fault(u32 intr_info)
@@ -121,23 +170,33 @@ static inline int is_external_interrupt(u32 intr_info)
                 == (INTR_TYPE_EXT_INTR | INTR_INFO_VALID_MASK);
 }
 
-static int __find_msr_index(struct kvm_vcpu *vcpu, u32 msr)
+static inline int cpu_has_vmx_tpr_shadow(void)
+{
+        return (vmcs_config.cpu_based_exec_ctrl & CPU_BASED_TPR_SHADOW);
+}
+
+static inline int vm_need_tpr_shadow(struct kvm *kvm)
+{
+        return ((cpu_has_vmx_tpr_shadow()) && (irqchip_in_kernel(kvm)));
+}
+
+static int __find_msr_index(struct vcpu_vmx *vmx, u32 msr)
 {
         int i;
 
-        for (i = 0; i < vcpu->nmsrs; ++i)
-                if (vcpu->guest_msrs[i].index == msr)
+        for (i = 0; i < vmx->nmsrs; ++i)
+                if (vmx->guest_msrs[i].index == msr)
                         return i;
         return -1;
 }
 
-static struct vmx_msr_entry *find_msr_entry(struct kvm_vcpu *vcpu, u32 msr)
+static struct kvm_msr_entry *find_msr_entry(struct vcpu_vmx *vmx, u32 msr)
 {
         int i;
 
-        i = __find_msr_index(vcpu, msr);
+        i = __find_msr_index(vmx, msr);
         if (i >= 0)
-                return &vcpu->guest_msrs[i];
+                return &vmx->guest_msrs[i];
         return NULL;
 }
 
@@ -156,23 +215,24 @@ static void vmcs_clear(struct vmcs *vmcs)
 
 static void __vcpu_clear(void *arg)
 {
-        struct kvm_vcpu *vcpu = arg;
+        struct vcpu_vmx *vmx = arg;
         int cpu = raw_smp_processor_id();
 
-        if (vcpu->cpu == cpu)
-                vmcs_clear(vcpu->vmcs);
-        if (per_cpu(current_vmcs, cpu) == vcpu->vmcs)
+        if (vmx->vcpu.cpu == cpu)
+                vmcs_clear(vmx->vmcs);
+        if (per_cpu(current_vmcs, cpu) == vmx->vmcs)
                 per_cpu(current_vmcs, cpu) = NULL;
-        rdtscll(vcpu->host_tsc);
+        rdtscll(vmx->vcpu.host_tsc);
 }
 
-static void vcpu_clear(struct kvm_vcpu *vcpu)
+static void vcpu_clear(struct vcpu_vmx *vmx)
 {
-        if (vcpu->cpu != raw_smp_processor_id() && vcpu->cpu != -1)
-                smp_call_function_single(vcpu->cpu, __vcpu_clear, vcpu, 0, 1);
+        if (vmx->vcpu.cpu != raw_smp_processor_id() && vmx->vcpu.cpu != -1)
+                smp_call_function_single(vmx->vcpu.cpu, __vcpu_clear,
+                                         vmx, 0, 1);
         else
-                __vcpu_clear(vcpu);
-        vcpu->launched = 0;
+                __vcpu_clear(vmx);
+        vmx->launched = 0;
 }
 
 static unsigned long vmcs_readl(unsigned long field)
@@ -282,121 +342,122 @@ static void reload_tss(void)
 #endif
 }
 
-static void load_transition_efer(struct kvm_vcpu *vcpu)
+static void load_transition_efer(struct vcpu_vmx *vmx)
 {
         u64 trans_efer;
-        int efer_offset = vcpu->msr_offset_efer;
+        int efer_offset = vmx->msr_offset_efer;
 
-        trans_efer = vcpu->host_msrs[efer_offset].data;
+        trans_efer = vmx->host_msrs[efer_offset].data;
         trans_efer &= ~EFER_SAVE_RESTORE_BITS;
-        trans_efer |= msr_efer_save_restore_bits(
-                                vcpu->guest_msrs[efer_offset]);
+        trans_efer |= msr_efer_save_restore_bits(vmx->guest_msrs[efer_offset]);
         wrmsrl(MSR_EFER, trans_efer);
-        vcpu->stat.efer_reload++;
+        vmx->vcpu.stat.efer_reload++;
 }
 
 static void vmx_save_host_state(struct kvm_vcpu *vcpu)
 {
-        struct vmx_host_state *hs = &vcpu->vmx_host_state;
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
 
-        if (hs->loaded)
+        if (vmx->host_state.loaded)
                 return;
 
-        hs->loaded = 1;
+        vmx->host_state.loaded = 1;
         /*
          * Set host fs and gs selectors.  Unfortunately, 22.2.3 does not
          * allow segment selectors with cpl > 0 or ti == 1.
          */
-        hs->ldt_sel = read_ldt();
-        hs->fs_gs_ldt_reload_needed = hs->ldt_sel;
-        hs->fs_sel = read_fs();
-        if (!(hs->fs_sel & 7))
-                vmcs_write16(HOST_FS_SELECTOR, hs->fs_sel);
-        else {
+        vmx->host_state.ldt_sel = read_ldt();
+        vmx->host_state.gs_ldt_reload_needed = vmx->host_state.ldt_sel;
+        vmx->host_state.fs_sel = read_fs();
+        if (!(vmx->host_state.fs_sel & 7)) {
+                vmcs_write16(HOST_FS_SELECTOR, vmx->host_state.fs_sel);
+                vmx->host_state.fs_reload_needed = 0;
+        } else {
                 vmcs_write16(HOST_FS_SELECTOR, 0);
-                hs->fs_gs_ldt_reload_needed = 1;
+                vmx->host_state.fs_reload_needed = 1;
         }
-        hs->gs_sel = read_gs();
-        if (!(hs->gs_sel & 7))
-                vmcs_write16(HOST_GS_SELECTOR, hs->gs_sel);
+        vmx->host_state.gs_sel = read_gs();
+        if (!(vmx->host_state.gs_sel & 7))
+                vmcs_write16(HOST_GS_SELECTOR, vmx->host_state.gs_sel);
         else {
                 vmcs_write16(HOST_GS_SELECTOR, 0);
-                hs->fs_gs_ldt_reload_needed = 1;
+                vmx->host_state.gs_ldt_reload_needed = 1;
         }
 
 #ifdef CONFIG_X86_64
         vmcs_writel(HOST_FS_BASE, read_msr(MSR_FS_BASE));
         vmcs_writel(HOST_GS_BASE, read_msr(MSR_GS_BASE));
 #else
-        vmcs_writel(HOST_FS_BASE, segment_base(hs->fs_sel));
-        vmcs_writel(HOST_GS_BASE, segment_base(hs->gs_sel));
+        vmcs_writel(HOST_FS_BASE, segment_base(vmx->host_state.fs_sel));
+        vmcs_writel(HOST_GS_BASE, segment_base(vmx->host_state.gs_sel));
 #endif
 
 #ifdef CONFIG_X86_64
-        if (is_long_mode(vcpu)) {
-                save_msrs(vcpu->host_msrs + vcpu->msr_offset_kernel_gs_base, 1);
+        if (is_long_mode(&vmx->vcpu)) {
+                save_msrs(vmx->host_msrs +
+                          vmx->msr_offset_kernel_gs_base, 1);
         }
 #endif
-        load_msrs(vcpu->guest_msrs, vcpu->save_nmsrs);
-        if (msr_efer_need_save_restore(vcpu))
-                load_transition_efer(vcpu);
+        load_msrs(vmx->guest_msrs, vmx->save_nmsrs);
+        if (msr_efer_need_save_restore(vmx))
+                load_transition_efer(vmx);
 }
 
-static void vmx_load_host_state(struct kvm_vcpu *vcpu)
+static void vmx_load_host_state(struct vcpu_vmx *vmx)
 {
-        struct vmx_host_state *hs = &vcpu->vmx_host_state;
+        unsigned long flags;
 
-        if (!hs->loaded)
+        if (!vmx->host_state.loaded)
                 return;
 
-        hs->loaded = 0;
-        if (hs->fs_gs_ldt_reload_needed) {
-                load_ldt(hs->ldt_sel);
-                load_fs(hs->fs_sel);
+        vmx->host_state.loaded = 0;
+        if (vmx->host_state.fs_reload_needed)
+                load_fs(vmx->host_state.fs_sel);
+        if (vmx->host_state.gs_ldt_reload_needed) {
+                load_ldt(vmx->host_state.ldt_sel);
                 /*
                  * If we have to reload gs, we must take care to
                  * preserve our gs base.
                  */
-                local_irq_disable();
-                load_gs(hs->gs_sel);
+                local_irq_save(flags);
+                load_gs(vmx->host_state.gs_sel);
 #ifdef CONFIG_X86_64
                 wrmsrl(MSR_GS_BASE, vmcs_readl(HOST_GS_BASE));
 #endif
-                local_irq_enable();
-
-                reload_tss();
+                local_irq_restore(flags);
         }
-        save_msrs(vcpu->guest_msrs, vcpu->save_nmsrs);
-        load_msrs(vcpu->host_msrs, vcpu->save_nmsrs);
-        if (msr_efer_need_save_restore(vcpu))
-                load_msrs(vcpu->host_msrs + vcpu->msr_offset_efer, 1);
+        reload_tss();
+        save_msrs(vmx->guest_msrs, vmx->save_nmsrs);
+        load_msrs(vmx->host_msrs, vmx->save_nmsrs);
+        if (msr_efer_need_save_restore(vmx))
+                load_msrs(vmx->host_msrs + vmx->msr_offset_efer, 1);
 }
 
 /*
  * Switches to specified vcpu, until a matching vcpu_put(), but assumes
  * vcpu mutex is already taken.
  */
-static void vmx_vcpu_load(struct kvm_vcpu *vcpu)
+static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 {
-        u64 phys_addr = __pa(vcpu->vmcs);
-        int cpu;
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+        u64 phys_addr = __pa(vmx->vmcs);
         u64 tsc_this, delta;
 
-        cpu = get_cpu();
-
-        if (vcpu->cpu != cpu)
-                vcpu_clear(vcpu);
+        if (vcpu->cpu != cpu) {
+                vcpu_clear(vmx);
+                kvm_migrate_apic_timer(vcpu);
+        }
 
-        if (per_cpu(current_vmcs, cpu) != vcpu->vmcs) {
+        if (per_cpu(current_vmcs, cpu) != vmx->vmcs) {
                 u8 error;
 
-                per_cpu(current_vmcs, cpu) = vcpu->vmcs;
+                per_cpu(current_vmcs, cpu) = vmx->vmcs;
                 asm volatile (ASM_VMX_VMPTRLD_RAX "; setna %0"
                               : "=g"(error) : "a"(&phys_addr), "m"(phys_addr)
                               : "cc");
                 if (error)
                         printk(KERN_ERR "kvm: vmptrld %p/%llx fail\n",
-                               vcpu->vmcs, phys_addr);
+                               vmx->vmcs, phys_addr);
         }
 
         if (vcpu->cpu != cpu) {
@@ -426,9 +487,8 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu)
 
 static void vmx_vcpu_put(struct kvm_vcpu *vcpu)
 {
-        vmx_load_host_state(vcpu);
+        vmx_load_host_state(to_vmx(vcpu));
         kvm_put_guest_fpu(vcpu);
-        put_cpu();
 }
 
 static void vmx_fpu_activate(struct kvm_vcpu *vcpu)
@@ -436,9 +496,9 @@ static void vmx_fpu_activate(struct kvm_vcpu *vcpu)
         if (vcpu->fpu_active)
                 return;
         vcpu->fpu_active = 1;
-        vmcs_clear_bits(GUEST_CR0, CR0_TS_MASK);
-        if (vcpu->cr0 & CR0_TS_MASK)
-                vmcs_set_bits(GUEST_CR0, CR0_TS_MASK);
+        vmcs_clear_bits(GUEST_CR0, X86_CR0_TS);
+        if (vcpu->cr0 & X86_CR0_TS)
+                vmcs_set_bits(GUEST_CR0, X86_CR0_TS);
         update_exception_bitmap(vcpu);
 }
 
@@ -447,13 +507,13 @@ static void vmx_fpu_deactivate(struct kvm_vcpu *vcpu)
         if (!vcpu->fpu_active)
                 return;
         vcpu->fpu_active = 0;
-        vmcs_set_bits(GUEST_CR0, CR0_TS_MASK);
+        vmcs_set_bits(GUEST_CR0, X86_CR0_TS);
         update_exception_bitmap(vcpu);
 }
 
 static void vmx_vcpu_decache(struct kvm_vcpu *vcpu)
 {
-        vcpu_clear(vcpu);
+        vcpu_clear(to_vmx(vcpu));
 }
 
 static unsigned long vmx_get_rflags(struct kvm_vcpu *vcpu)
@@ -501,59 +561,62 @@ static void vmx_inject_gp(struct kvm_vcpu *vcpu, unsigned error_code)
 /*
  * Swap MSR entry in host/guest MSR entry array.
  */
-void move_msr_up(struct kvm_vcpu *vcpu, int from, int to)
+#ifdef CONFIG_X86_64
+static void move_msr_up(struct vcpu_vmx *vmx, int from, int to)
 {
-        struct vmx_msr_entry tmp;
-        tmp = vcpu->guest_msrs[to];
-        vcpu->guest_msrs[to] = vcpu->guest_msrs[from];
-        vcpu->guest_msrs[from] = tmp;
-        tmp = vcpu->host_msrs[to];
-        vcpu->host_msrs[to] = vcpu->host_msrs[from];
-        vcpu->host_msrs[from] = tmp;
+        struct kvm_msr_entry tmp;
+
+        tmp = vmx->guest_msrs[to];
+        vmx->guest_msrs[to] = vmx->guest_msrs[from];
+        vmx->guest_msrs[from] = tmp;
+        tmp = vmx->host_msrs[to];
+        vmx->host_msrs[to] = vmx->host_msrs[from];
+        vmx->host_msrs[from] = tmp;
 }
+#endif
 
 /*
  * Set up the vmcs to automatically save and restore system
  * msrs.  Don't touch the 64-bit msrs if the guest is in legacy
  * mode, as fiddling with msrs is very expensive.
  */
-static void setup_msrs(struct kvm_vcpu *vcpu)
+static void setup_msrs(struct vcpu_vmx *vmx)
 {
         int save_nmsrs;
 
         save_nmsrs = 0;
 #ifdef CONFIG_X86_64
-        if (is_long_mode(vcpu)) {
+        if (is_long_mode(&vmx->vcpu)) {
                 int index;
 
-                index = __find_msr_index(vcpu, MSR_SYSCALL_MASK);
+                index = __find_msr_index(vmx, MSR_SYSCALL_MASK);
                 if (index >= 0)
-                        move_msr_up(vcpu, index, save_nmsrs++);
-                index = __find_msr_index(vcpu, MSR_LSTAR);
+                        move_msr_up(vmx, index, save_nmsrs++);
+                index = __find_msr_index(vmx, MSR_LSTAR);
                 if (index >= 0)
-                        move_msr_up(vcpu, index, save_nmsrs++);
-                index = __find_msr_index(vcpu, MSR_CSTAR);
+                        move_msr_up(vmx, index, save_nmsrs++);
+                index = __find_msr_index(vmx, MSR_CSTAR);
                 if (index >= 0)
-                        move_msr_up(vcpu, index, save_nmsrs++);
-                index = __find_msr_index(vcpu, MSR_KERNEL_GS_BASE);
+                        move_msr_up(vmx, index, save_nmsrs++);
+                index = __find_msr_index(vmx, MSR_KERNEL_GS_BASE);
                 if (index >= 0)
-                        move_msr_up(vcpu, index, save_nmsrs++);
+                        move_msr_up(vmx, index, save_nmsrs++);
                 /*
                  * MSR_K6_STAR is only needed on long mode guests, and only
                  * if efer.sce is enabled.
                  */
-                index = __find_msr_index(vcpu, MSR_K6_STAR);
-                if ((index >= 0) && (vcpu->shadow_efer & EFER_SCE))
-                        move_msr_up(vcpu, index, save_nmsrs++);
+                index = __find_msr_index(vmx, MSR_K6_STAR);
+                if ((index >= 0) && (vmx->vcpu.shadow_efer & EFER_SCE))
+                        move_msr_up(vmx, index, save_nmsrs++);
         }
 #endif
-        vcpu->save_nmsrs = save_nmsrs;
+        vmx->save_nmsrs = save_nmsrs;
 
 #ifdef CONFIG_X86_64
-        vcpu->msr_offset_kernel_gs_base =
-                __find_msr_index(vcpu, MSR_KERNEL_GS_BASE);
+        vmx->msr_offset_kernel_gs_base =
+                __find_msr_index(vmx, MSR_KERNEL_GS_BASE);
 #endif
-        vcpu->msr_offset_efer = __find_msr_index(vcpu, MSR_EFER);
+        vmx->msr_offset_efer = __find_msr_index(vmx, MSR_EFER);
 }
 
 /*
@@ -589,7 +652,7 @@ static void guest_write_tsc(u64 guest_tsc)
 static int vmx_get_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata)
 {
         u64 data;
-        struct vmx_msr_entry *msr;
+        struct kvm_msr_entry *msr;
 
         if (!pdata) {
                 printk(KERN_ERR "BUG: get_msr called with NULL pdata\n");
@@ -620,7 +683,7 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata)
                 data = vmcs_readl(GUEST_SYSENTER_ESP);
                 break;
         default:
-                msr = find_msr_entry(vcpu, msr_index);
+                msr = find_msr_entry(to_vmx(vcpu), msr_index);
                 if (msr) {
                         data = msr->data;
                         break;
@@ -639,15 +702,16 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata)
  */
 static int vmx_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
 {
-        struct vmx_msr_entry *msr;
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+        struct kvm_msr_entry *msr;
         int ret = 0;
 
         switch (msr_index) {
 #ifdef CONFIG_X86_64
         case MSR_EFER:
                 ret = kvm_set_msr_common(vcpu, msr_index, data);
-                if (vcpu->vmx_host_state.loaded)
-                        load_transition_efer(vcpu);
+                if (vmx->host_state.loaded)
+                        load_transition_efer(vmx);
                 break;
         case MSR_FS_BASE:
                 vmcs_writel(GUEST_FS_BASE, data);
@@ -669,11 +733,11 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
                 guest_write_tsc(data);
                 break;
         default:
-                msr = find_msr_entry(vcpu, msr_index);
+                msr = find_msr_entry(vmx, msr_index);
                 if (msr) {
                         msr->data = data;
-                        if (vcpu->vmx_host_state.loaded)
-                                load_msrs(vcpu->guest_msrs, vcpu->save_nmsrs);
+                        if (vmx->host_state.loaded)
+                                load_msrs(vmx->guest_msrs, vmx->save_nmsrs);
                         break;
                 }
                 ret = kvm_set_msr_common(vcpu, msr_index, data);
@@ -740,6 +804,20 @@ static int set_guest_debug(struct kvm_vcpu *vcpu, struct kvm_debug_guest *dbg)
         return 0;
 }
 
+static int vmx_get_irq(struct kvm_vcpu *vcpu)
+{
+        u32 idtv_info_field;
+
+        idtv_info_field = vmcs_read32(IDT_VECTORING_INFO_FIELD);
+        if (idtv_info_field & INTR_INFO_VALID_MASK) {
+                if (is_external_interrupt(idtv_info_field))
+                        return idtv_info_field & VECTORING_INFO_VECTOR_MASK;
+                else
+                        printk("pending exception: not handled yet\n");
+        }
+        return -1;
+}
+
 static __init int cpu_has_kvm_support(void)
 {
         unsigned long ecx = cpuid_ecx(1);
@@ -751,7 +829,10 @@ static __init int vmx_disabled_by_bios(void)
         u64 msr;
 
         rdmsrl(MSR_IA32_FEATURE_CONTROL, msr);
-        return (msr & 5) == 1; /* locked but not enabled */
+        return (msr & (MSR_IA32_FEATURE_CONTROL_LOCKED |
+                       MSR_IA32_FEATURE_CONTROL_VMXON_ENABLED))
+            == MSR_IA32_FEATURE_CONTROL_LOCKED;
+        /* locked but not enabled */
 }
 
 static void hardware_enable(void *garbage)
@@ -761,10 +842,15 @@ static void hardware_enable(void *garbage)
         u64 old;
 
         rdmsrl(MSR_IA32_FEATURE_CONTROL, old);
-        if ((old & 5) != 5)
+        if ((old & (MSR_IA32_FEATURE_CONTROL_LOCKED |
+                    MSR_IA32_FEATURE_CONTROL_VMXON_ENABLED))
+            != (MSR_IA32_FEATURE_CONTROL_LOCKED |
+                MSR_IA32_FEATURE_CONTROL_VMXON_ENABLED))
                 /* enable and lock */
-                wrmsrl(MSR_IA32_FEATURE_CONTROL, old | 5);
-        write_cr4(read_cr4() | CR4_VMXE); /* FIXME: not cpu hotplug safe */
+                wrmsrl(MSR_IA32_FEATURE_CONTROL, old |
+                       MSR_IA32_FEATURE_CONTROL_LOCKED |
+                       MSR_IA32_FEATURE_CONTROL_VMXON_ENABLED);
+        write_cr4(read_cr4() | X86_CR4_VMXE); /* FIXME: not cpu hotplug safe */
         asm volatile (ASM_VMX_VMXON_RAX : : "a"(&phys_addr), "m"(phys_addr)
                       : "memory", "cc");
 }
@@ -774,14 +860,102 @@ static void hardware_disable(void *garbage)
         asm volatile (ASM_VMX_VMXOFF : : : "cc");
 }
 
-static __init void setup_vmcs_descriptor(void)
+static __init int adjust_vmx_controls(u32 ctl_min, u32 ctl_opt,
+                                      u32 msr, u32* result)
+{
+        u32 vmx_msr_low, vmx_msr_high;
+        u32 ctl = ctl_min | ctl_opt;
+
+        rdmsr(msr, vmx_msr_low, vmx_msr_high);
+
+        ctl &= vmx_msr_high; /* bit == 0 in high word ==> must be zero */
+        ctl |= vmx_msr_low;  /* bit == 1 in low word  ==> must be one  */
+
+        /* Ensure minimum (required) set of control bits are supported. */
+        if (ctl_min & ~ctl)
+                return -EIO;
+
+        *result = ctl;
+        return 0;
+}
+
+static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf)
 {
         u32 vmx_msr_low, vmx_msr_high;
+        u32 min, opt;
+        u32 _pin_based_exec_control = 0;
+        u32 _cpu_based_exec_control = 0;
+        u32 _vmexit_control = 0;
+        u32 _vmentry_control = 0;
+
+        min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING;
+        opt = 0;
+        if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PINBASED_CTLS,
+                                &_pin_based_exec_control) < 0)
+                return -EIO;
+
+        min = CPU_BASED_HLT_EXITING |
+#ifdef CONFIG_X86_64
+              CPU_BASED_CR8_LOAD_EXITING |
+              CPU_BASED_CR8_STORE_EXITING |
+#endif
+              CPU_BASED_USE_IO_BITMAPS |
+              CPU_BASED_MOV_DR_EXITING |
+              CPU_BASED_USE_TSC_OFFSETING;
+#ifdef CONFIG_X86_64
+        opt = CPU_BASED_TPR_SHADOW;
+#else
+        opt = 0;
+#endif
+        if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PROCBASED_CTLS,
+                                &_cpu_based_exec_control) < 0)
+                return -EIO;
+#ifdef CONFIG_X86_64
+        if ((_cpu_based_exec_control & CPU_BASED_TPR_SHADOW))
+                _cpu_based_exec_control &= ~CPU_BASED_CR8_LOAD_EXITING &
+                                           ~CPU_BASED_CR8_STORE_EXITING;
+#endif
+
+        min = 0;
+#ifdef CONFIG_X86_64
+        min |= VM_EXIT_HOST_ADDR_SPACE_SIZE;
+#endif
+        opt = 0;
+        if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_EXIT_CTLS,
+                                &_vmexit_control) < 0)
+                return -EIO;
+
+        min = opt = 0;
+        if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_ENTRY_CTLS,
+                                &_vmentry_control) < 0)
+                return -EIO;
 
         rdmsr(MSR_IA32_VMX_BASIC, vmx_msr_low, vmx_msr_high);
-        vmcs_descriptor.size = vmx_msr_high & 0x1fff;
-        vmcs_descriptor.order = get_order(vmcs_descriptor.size);
-        vmcs_descriptor.revision_id = vmx_msr_low;
+
+        /* IA-32 SDM Vol 3B: VMCS size is never greater than 4kB. */
+        if ((vmx_msr_high & 0x1fff) > PAGE_SIZE)
+                return -EIO;
+
+#ifdef CONFIG_X86_64
+        /* IA-32 SDM Vol 3B: 64-bit CPUs always have VMX_BASIC_MSR[48]==0. */
+        if (vmx_msr_high & (1u<<16))
+                return -EIO;
+#endif
+
+        /* Require Write-Back (WB) memory type for VMCS accesses. */
+        if (((vmx_msr_high >> 18) & 15) != 6)
+                return -EIO;
+
+        vmcs_conf->size = vmx_msr_high & 0x1fff;
+        vmcs_conf->order = get_order(vmcs_config.size);
+        vmcs_conf->revision_id = vmx_msr_low;
+
+        vmcs_conf->pin_based_exec_ctrl = _pin_based_exec_control;
+        vmcs_conf->cpu_based_exec_ctrl = _cpu_based_exec_control;
+        vmcs_conf->vmexit_ctrl         = _vmexit_control;
+        vmcs_conf->vmentry_ctrl        = _vmentry_control;
+
+        return 0;
 }
 
 static struct vmcs *alloc_vmcs_cpu(int cpu)
@@ -790,12 +964,12 @@ static struct vmcs *alloc_vmcs_cpu(int cpu)
         struct page *pages;
         struct vmcs *vmcs;
 
-        pages = alloc_pages_node(node, GFP_KERNEL, vmcs_descriptor.order);
+        pages = alloc_pages_node(node, GFP_KERNEL, vmcs_config.order);
         if (!pages)
                 return NULL;
         vmcs = page_address(pages);
-        memset(vmcs, 0, vmcs_descriptor.size);
-        vmcs->revision_id = vmcs_descriptor.revision_id; /* vmcs revision id */
+        memset(vmcs, 0, vmcs_config.size);
+        vmcs->revision_id = vmcs_config.revision_id; /* vmcs revision id */
         return vmcs;
 }
 
@@ -806,7 +980,7 @@ static struct vmcs *alloc_vmcs(void)
 
 static void free_vmcs(struct vmcs *vmcs)
 {
-        free_pages((unsigned long)vmcs, vmcs_descriptor.order);
+        free_pages((unsigned long)vmcs, vmcs_config.order);
 }
 
 static void free_kvm_area(void)
@@ -817,8 +991,6 @@ static void free_kvm_area(void)
                 free_vmcs(per_cpu(vmxarea, cpu));
 }
 
-extern struct vmcs *alloc_vmcs_cpu(int cpu);
-
 static __init int alloc_kvm_area(void)
 {
         int cpu;
@@ -839,7 +1011,8 @@ static __init int alloc_kvm_area(void)
 
 static __init int hardware_setup(void)
 {
-        setup_vmcs_descriptor();
+        if (setup_vmcs_config(&vmcs_config) < 0)
+                return -EIO;
         return alloc_kvm_area();
 }
 
@@ -879,8 +1052,8 @@ static void enter_pmode(struct kvm_vcpu *vcpu)
         flags |= (vcpu->rmode.save_iopl << IOPL_SHIFT);
         vmcs_writel(GUEST_RFLAGS, flags);
 
-        vmcs_writel(GUEST_CR4, (vmcs_readl(GUEST_CR4) & ~CR4_VME_MASK) |
-                        (vmcs_readl(CR4_READ_SHADOW) & CR4_VME_MASK));
+        vmcs_writel(GUEST_CR4, (vmcs_readl(GUEST_CR4) & ~X86_CR4_VME) |
+                        (vmcs_readl(CR4_READ_SHADOW) & X86_CR4_VME));
 
         update_exception_bitmap(vcpu);
 
@@ -897,7 +1070,7 @@ static void enter_pmode(struct kvm_vcpu *vcpu)
         vmcs_write32(GUEST_CS_AR_BYTES, 0x9b);
 }
 
-static int rmode_tss_base(struct kvm* kvm)
+static gva_t rmode_tss_base(struct kvm* kvm)
 {
         gfn_t base_gfn = kvm->memslots[0].base_gfn + kvm->memslots[0].npages - 3;
         return base_gfn << PAGE_SHIFT;
@@ -937,7 +1110,7 @@ static void enter_rmode(struct kvm_vcpu *vcpu)
         flags |= IOPL_MASK | X86_EFLAGS_VM;
 
         vmcs_writel(GUEST_RFLAGS, flags);
-        vmcs_writel(GUEST_CR4, vmcs_readl(GUEST_CR4) | CR4_VME_MASK);
+        vmcs_writel(GUEST_CR4, vmcs_readl(GUEST_CR4) | X86_CR4_VME);
         update_exception_bitmap(vcpu);
 
         vmcs_write16(GUEST_SS_SELECTOR, vmcs_readl(GUEST_SS_BASE) >> 4);
@@ -975,10 +1148,10 @@ static void enter_lmode(struct kvm_vcpu *vcpu)
 
         vcpu->shadow_efer |= EFER_LMA;
 
-        find_msr_entry(vcpu, MSR_EFER)->data |= EFER_LMA | EFER_LME;
+        find_msr_entry(to_vmx(vcpu), MSR_EFER)->data |= EFER_LMA | EFER_LME;
         vmcs_write32(VM_ENTRY_CONTROLS,
                      vmcs_read32(VM_ENTRY_CONTROLS)
-                     | VM_ENTRY_CONTROLS_IA32E_MASK);
+                     | VM_ENTRY_IA32E_MODE);
 }
 
 static void exit_lmode(struct kvm_vcpu *vcpu)
@@ -987,7 +1160,7 @@ static void exit_lmode(struct kvm_vcpu *vcpu)
 
         vmcs_write32(VM_ENTRY_CONTROLS,
                      vmcs_read32(VM_ENTRY_CONTROLS)
-                     & ~VM_ENTRY_CONTROLS_IA32E_MASK);
+                     & ~VM_ENTRY_IA32E_MODE);
 }
 
 #endif
@@ -1002,17 +1175,17 @@ static void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
 {
         vmx_fpu_deactivate(vcpu);
 
-        if (vcpu->rmode.active && (cr0 & CR0_PE_MASK))
+        if (vcpu->rmode.active && (cr0 & X86_CR0_PE))
                 enter_pmode(vcpu);
 
-        if (!vcpu->rmode.active && !(cr0 & CR0_PE_MASK))
+        if (!vcpu->rmode.active && !(cr0 & X86_CR0_PE))
                 enter_rmode(vcpu);
 
 #ifdef CONFIG_X86_64
         if (vcpu->shadow_efer & EFER_LME) {
-                if (!is_paging(vcpu) && (cr0 & CR0_PG_MASK))
+                if (!is_paging(vcpu) && (cr0 & X86_CR0_PG))
                         enter_lmode(vcpu);
-                if (is_paging(vcpu) && !(cr0 & CR0_PG_MASK))
+                if (is_paging(vcpu) && !(cr0 & X86_CR0_PG))
                         exit_lmode(vcpu);
         }
 #endif
@@ -1022,14 +1195,14 @@ static void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
                     (cr0 & ~KVM_GUEST_CR0_MASK) | KVM_VM_CR0_ALWAYS_ON);
         vcpu->cr0 = cr0;
 
-        if (!(cr0 & CR0_TS_MASK) || !(cr0 & CR0_PE_MASK))
+        if (!(cr0 & X86_CR0_TS) || !(cr0 & X86_CR0_PE))
                 vmx_fpu_activate(vcpu);
 }
 
 static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
 {
         vmcs_writel(GUEST_CR3, cr3);
-        if (vcpu->cr0 & CR0_PE_MASK)
+        if (vcpu->cr0 & X86_CR0_PE)
                 vmx_fpu_deactivate(vcpu);
 }
 
@@ -1045,23 +1218,24 @@ static void vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
 
 static void vmx_set_efer(struct kvm_vcpu *vcpu, u64 efer)
 {
-        struct vmx_msr_entry *msr = find_msr_entry(vcpu, MSR_EFER);
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+        struct kvm_msr_entry *msr = find_msr_entry(vmx, MSR_EFER);
 
         vcpu->shadow_efer = efer;
         if (efer & EFER_LMA) {
                 vmcs_write32(VM_ENTRY_CONTROLS,
                                      vmcs_read32(VM_ENTRY_CONTROLS) |
-                                     VM_ENTRY_CONTROLS_IA32E_MASK);
+                                     VM_ENTRY_IA32E_MODE);
                 msr->data = efer;
 
         } else {
                 vmcs_write32(VM_ENTRY_CONTROLS,
                                      vmcs_read32(VM_ENTRY_CONTROLS) &
-                                     ~VM_ENTRY_CONTROLS_IA32E_MASK);
+                                     ~VM_ENTRY_IA32E_MODE);
 
                 msr->data = efer & ~EFER_LME;
         }
-        setup_msrs(vcpu);
+        setup_msrs(vmx);
 }
 
 #endif
@@ -1210,17 +1384,6 @@ static int init_rmode_tss(struct kvm* kvm)
         return 1;
 }
 
-static void vmcs_write32_fixedbits(u32 msr, u32 vmcs_field, u32 val)
-{
-        u32 msr_high, msr_low;
-
-        rdmsr(msr, msr_low, msr_high);
-
-        val &= msr_high;
-        val |= msr_low;
-        vmcs_write32(vmcs_field, val);
-}
-
 static void seg_setup(int seg)
 {
         struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
@@ -1234,7 +1397,7 @@ static void seg_setup(int seg)
 /*
  * Sets up the vmcs for emulated real mode.
  */
-static int vmx_vcpu_setup(struct kvm_vcpu *vcpu)
+static int vmx_vcpu_setup(struct vcpu_vmx *vmx)
 {
         u32 host_sysenter_cs;
         u32 junk;
@@ -1243,27 +1406,36 @@ static int vmx_vcpu_setup(struct kvm_vcpu *vcpu)
         int i;
         int ret = 0;
         unsigned long kvm_vmx_return;
+        u64 msr;
+        u32 exec_control;
 
-        if (!init_rmode_tss(vcpu->kvm)) {
+        if (!init_rmode_tss(vmx->vcpu.kvm)) {
                 ret = -ENOMEM;
                 goto out;
         }
 
-        memset(vcpu->regs, 0, sizeof(vcpu->regs));
-        vcpu->regs[VCPU_REGS_RDX] = get_rdx_init_val();
-        vcpu->cr8 = 0;
-        vcpu->apic_base = 0xfee00000 | MSR_IA32_APICBASE_ENABLE;
-        if (vcpu == &vcpu->kvm->vcpus[0])
-                vcpu->apic_base |= MSR_IA32_APICBASE_BSP;
+        vmx->vcpu.rmode.active = 0;
 
-        fx_init(vcpu);
+        vmx->vcpu.regs[VCPU_REGS_RDX] = get_rdx_init_val();
+        set_cr8(&vmx->vcpu, 0);
+        msr = 0xfee00000 | MSR_IA32_APICBASE_ENABLE;
+        if (vmx->vcpu.vcpu_id == 0)
+                msr |= MSR_IA32_APICBASE_BSP;
+        kvm_set_apic_base(&vmx->vcpu, msr);
+
+        fx_init(&vmx->vcpu);
 
         /*
          * GUEST_CS_BASE should really be 0xffff0000, but VT vm86 mode
          * insists on having GUEST_CS_BASE == GUEST_CS_SELECTOR << 4.  Sigh.
          */
-        vmcs_write16(GUEST_CS_SELECTOR, 0xf000);
-        vmcs_writel(GUEST_CS_BASE, 0x000f0000);
+        if (vmx->vcpu.vcpu_id == 0) {
+                vmcs_write16(GUEST_CS_SELECTOR, 0xf000);
+                vmcs_writel(GUEST_CS_BASE, 0x000f0000);
+        } else {
+                vmcs_write16(GUEST_CS_SELECTOR, vmx->vcpu.sipi_vector << 8);
+                vmcs_writel(GUEST_CS_BASE, vmx->vcpu.sipi_vector << 12);
+        }
         vmcs_write32(GUEST_CS_LIMIT, 0xffff);
         vmcs_write32(GUEST_CS_AR_BYTES, 0x9b);
 
@@ -1288,7 +1460,10 @@ static int vmx_vcpu_setup(struct kvm_vcpu *vcpu)
         vmcs_writel(GUEST_SYSENTER_EIP, 0);
 
         vmcs_writel(GUEST_RFLAGS, 0x02);
-        vmcs_writel(GUEST_RIP, 0xfff0);
+        if (vmx->vcpu.vcpu_id == 0)
+                vmcs_writel(GUEST_RIP, 0xfff0);
+        else
+                vmcs_writel(GUEST_RIP, 0);
         vmcs_writel(GUEST_RSP, 0);
 
         //todo: dr0 = dr1 = dr2 = dr3 = 0; dr6 = 0xffff0ff0
@@ -1316,20 +1491,18 @@ static int vmx_vcpu_setup(struct kvm_vcpu *vcpu)
         vmcs_write64(GUEST_IA32_DEBUGCTL, 0);
 
         /* Control */
-        vmcs_write32_fixedbits(MSR_IA32_VMX_PINBASED_CTLS,
-                               PIN_BASED_VM_EXEC_CONTROL,
-                               PIN_BASED_EXT_INTR_MASK   /* 20.6.1 */
-                               | PIN_BASED_NMI_EXITING   /* 20.6.1 */
-                        );
-        vmcs_write32_fixedbits(MSR_IA32_VMX_PROCBASED_CTLS,
-                               CPU_BASED_VM_EXEC_CONTROL,
-                               CPU_BASED_HLT_EXITING         /* 20.6.2 */
-                               | CPU_BASED_CR8_LOAD_EXITING    /* 20.6.2 */
-                               | CPU_BASED_CR8_STORE_EXITING   /* 20.6.2 */
-                               | CPU_BASED_ACTIVATE_IO_BITMAP  /* 20.6.2 */
-                               | CPU_BASED_MOV_DR_EXITING
-                               | CPU_BASED_USE_TSC_OFFSETING   /* 21.3 */
-                        );
+        vmcs_write32(PIN_BASED_VM_EXEC_CONTROL,
+                vmcs_config.pin_based_exec_ctrl);
+
+        exec_control = vmcs_config.cpu_based_exec_ctrl;
+        if (!vm_need_tpr_shadow(vmx->vcpu.kvm)) {
+                exec_control &= ~CPU_BASED_TPR_SHADOW;
+#ifdef CONFIG_X86_64
+                exec_control |= CPU_BASED_CR8_STORE_EXITING |
+                                CPU_BASED_CR8_LOAD_EXITING;
+#endif
+        }
+        vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, exec_control);
 
         vmcs_write32(PAGE_FAULT_ERROR_CODE_MASK, 0);
         vmcs_write32(PAGE_FAULT_ERROR_CODE_MATCH, 0);
@@ -1377,46 +1550,48 @@ static int vmx_vcpu_setup(struct kvm_vcpu *vcpu)
                 u32 index = vmx_msr_index[i];
                 u32 data_low, data_high;
                 u64 data;
-                int j = vcpu->nmsrs;
+                int j = vmx->nmsrs;
 
                 if (rdmsr_safe(index, &data_low, &data_high) < 0)
                         continue;
                 if (wrmsr_safe(index, data_low, data_high) < 0)
                         continue;
                 data = data_low | ((u64)data_high << 32);
-                vcpu->host_msrs[j].index = index;
-                vcpu->host_msrs[j].reserved = 0;
-                vcpu->host_msrs[j].data = data;
-                vcpu->guest_msrs[j] = vcpu->host_msrs[j];
-                ++vcpu->nmsrs;
+                vmx->host_msrs[j].index = index;
+                vmx->host_msrs[j].reserved = 0;
+                vmx->host_msrs[j].data = data;
+                vmx->guest_msrs[j] = vmx->host_msrs[j];
+                ++vmx->nmsrs;
         }
 
-        setup_msrs(vcpu);
+        setup_msrs(vmx);
 
-        vmcs_write32_fixedbits(MSR_IA32_VMX_EXIT_CTLS, VM_EXIT_CONTROLS,
-                               (HOST_IS_64 << 9));  /* 22.2,1, 20.7.1 */
+        vmcs_write32(VM_EXIT_CONTROLS, vmcs_config.vmexit_ctrl);
 
         /* 22.2.1, 20.8.1 */
-        vmcs_write32_fixedbits(MSR_IA32_VMX_ENTRY_CTLS,
-                               VM_ENTRY_CONTROLS, 0);
+        vmcs_write32(VM_ENTRY_CONTROLS, vmcs_config.vmentry_ctrl);
+
         vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, 0);  /* 22.2.1 */
 
 #ifdef CONFIG_X86_64
-        vmcs_writel(VIRTUAL_APIC_PAGE_ADDR, 0);
-        vmcs_writel(TPR_THRESHOLD, 0);
+        vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, 0);
+        if (vm_need_tpr_shadow(vmx->vcpu.kvm))
+                vmcs_write64(VIRTUAL_APIC_PAGE_ADDR,
+                             page_to_phys(vmx->vcpu.apic->regs_page));
+        vmcs_write32(TPR_THRESHOLD, 0);
 #endif
 
         vmcs_writel(CR0_GUEST_HOST_MASK, ~0UL);
         vmcs_writel(CR4_GUEST_HOST_MASK, KVM_GUEST_CR4_MASK);
 
-        vcpu->cr0 = 0x60000010;
-        vmx_set_cr0(vcpu, vcpu->cr0); // enter rmode
-        vmx_set_cr4(vcpu, 0);
+        vmx->vcpu.cr0 = 0x60000010;
+        vmx_set_cr0(&vmx->vcpu, vmx->vcpu.cr0); // enter rmode
+        vmx_set_cr4(&vmx->vcpu, 0);
 #ifdef CONFIG_X86_64
-        vmx_set_efer(vcpu, 0);
+        vmx_set_efer(&vmx->vcpu, 0);
 #endif
-        vmx_fpu_activate(vcpu);
-        update_exception_bitmap(vcpu);
+        vmx_fpu_activate(&vmx->vcpu);
+        update_exception_bitmap(&vmx->vcpu);
 
         return 0;
 
@@ -1424,6 +1599,13 @@ out:
         return ret;
 }
 
+static void vmx_vcpu_reset(struct kvm_vcpu *vcpu)
+{
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+
+        vmx_vcpu_setup(vmx);
+}
+
 static void inject_rmode_irq(struct kvm_vcpu *vcpu, int irq)
 {
         u16 ent[2];
@@ -1443,8 +1625,8 @@ static void inject_rmode_irq(struct kvm_vcpu *vcpu, int irq)
                 return;
         }
 
-        if (kvm_read_guest(vcpu, irq * sizeof(ent), sizeof(ent), &ent) !=
-                                                                sizeof(ent)) {
+        if (emulator_read_std(irq * sizeof(ent), &ent, sizeof(ent), vcpu) !=
+                                                        X86EMUL_CONTINUE) {
                 vcpu_printf(vcpu, "%s: read guest err\n", __FUNCTION__);
                 return;
         }
@@ -1454,9 +1636,9 @@ static void inject_rmode_irq(struct kvm_vcpu *vcpu, int irq)
         ip =  vmcs_readl(GUEST_RIP);
 
 
-        if (kvm_write_guest(vcpu, ss_base + sp - 2, 2, &flags) != 2 ||
-            kvm_write_guest(vcpu, ss_base + sp - 4, 2, &cs) != 2 ||
-            kvm_write_guest(vcpu, ss_base + sp - 6, 2, &ip) != 2) {
+        if (emulator_write_emulated(ss_base + sp - 2, &flags, 2, vcpu) != X86EMUL_CONTINUE ||
+            emulator_write_emulated(ss_base + sp - 4, &cs, 2, vcpu) != X86EMUL_CONTINUE ||
+            emulator_write_emulated(ss_base + sp - 6, &ip, 2, vcpu) != X86EMUL_CONTINUE) {
                 vcpu_printf(vcpu, "%s: write guest err\n", __FUNCTION__);
                 return;
         }
@@ -1469,6 +1651,16 @@ static void inject_rmode_irq(struct kvm_vcpu *vcpu, int irq)
         vmcs_writel(GUEST_RSP, (vmcs_readl(GUEST_RSP) & ~0xffff) | (sp - 6));
 }
 
+static void vmx_inject_irq(struct kvm_vcpu *vcpu, int irq)
+{
+        if (vcpu->rmode.active) {
+                inject_rmode_irq(vcpu, irq);
+                return;
+        }
+        vmcs_write32(VM_ENTRY_INTR_INFO_FIELD,
+                        irq | INTR_TYPE_EXT_INTR | INTR_INFO_VALID_MASK);
+}
+
 static void kvm_do_inject_irq(struct kvm_vcpu *vcpu)
 {
         int word_index = __ffs(vcpu->irq_summary);
@@ -1478,13 +1670,7 @@ static void kvm_do_inject_irq(struct kvm_vcpu *vcpu)
         clear_bit(bit_index, &vcpu->irq_pending[word_index]);
         if (!vcpu->irq_pending[word_index])
                 clear_bit(word_index, &vcpu->irq_summary);
-
-        if (vcpu->rmode.active) {
-                inject_rmode_irq(vcpu, irq);
-                return;
-        }
-        vmcs_write32(VM_ENTRY_INTR_INFO_FIELD,
-                        irq | INTR_TYPE_EXT_INTR | INTR_INFO_VALID_MASK);
+        vmx_inject_irq(vcpu, irq);
 }
 
 
@@ -1568,7 +1754,7 @@ static int handle_exception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
                        "intr info 0x%x\n", __FUNCTION__, vect_info, intr_info);
         }
 
-        if (is_external_interrupt(vect_info)) {
+        if (!irqchip_in_kernel(vcpu->kvm) && is_external_interrupt(vect_info)) {
                 int irq = vect_info & VECTORING_INFO_VECTOR_MASK;
                 set_bit(irq, vcpu->irq_pending);
                 set_bit(irq / BITS_PER_LONG, &vcpu->irq_summary);
@@ -1591,29 +1777,28 @@ static int handle_exception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
         if (is_page_fault(intr_info)) {
                 cr2 = vmcs_readl(EXIT_QUALIFICATION);
 
-                spin_lock(&vcpu->kvm->lock);
+                mutex_lock(&vcpu->kvm->lock);
                 r = kvm_mmu_page_fault(vcpu, cr2, error_code);
                 if (r < 0) {
-                        spin_unlock(&vcpu->kvm->lock);
+                        mutex_unlock(&vcpu->kvm->lock);
                         return r;
                 }
                 if (!r) {
-                        spin_unlock(&vcpu->kvm->lock);
+                        mutex_unlock(&vcpu->kvm->lock);
                         return 1;
                 }
 
                 er = emulate_instruction(vcpu, kvm_run, cr2, error_code);
-                spin_unlock(&vcpu->kvm->lock);
+                mutex_unlock(&vcpu->kvm->lock);
 
                 switch (er) {
                 case EMULATE_DONE:
                         return 1;
                 case EMULATE_DO_MMIO:
                         ++vcpu->stat.mmio_exits;
-                        kvm_run->exit_reason = KVM_EXIT_MMIO;
                         return 0;
                  case EMULATE_FAIL:
-                        vcpu_printf(vcpu, "%s: emulate fail\n", __FUNCTION__);
+                        kvm_report_emulation_failure(vcpu, "pagetable");
                         break;
                 default:
                         BUG();
@@ -1653,80 +1838,29 @@ static int handle_triple_fault(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
         return 0;
 }
 
-static int get_io_count(struct kvm_vcpu *vcpu, unsigned long *count)
-{
-        u64 inst;
-        gva_t rip;
-        int countr_size;
-        int i, n;
-
-        if ((vmcs_readl(GUEST_RFLAGS) & X86_EFLAGS_VM)) {
-                countr_size = 2;
-        } else {
-                u32 cs_ar = vmcs_read32(GUEST_CS_AR_BYTES);
-
-                countr_size = (cs_ar & AR_L_MASK) ? 8:
-                              (cs_ar & AR_DB_MASK) ? 4: 2;
-        }
-
-        rip =  vmcs_readl(GUEST_RIP);
-        if (countr_size != 8)
-                rip += vmcs_readl(GUEST_CS_BASE);
-
-        n = kvm_read_guest(vcpu, rip, sizeof(inst), &inst);
-
-        for (i = 0; i < n; i++) {
-                switch (((u8*)&inst)[i]) {
-                case 0xf0:
-                case 0xf2:
-                case 0xf3:
-                case 0x2e:
-                case 0x36:
-                case 0x3e:
-                case 0x26:
-                case 0x64:
-                case 0x65:
-                case 0x66:
-                        break;
-                case 0x67:
-                        countr_size = (countr_size == 2) ? 4: (countr_size >> 1);
-                default:
-                        goto done;
-                }
-        }
-        return 0;
-done:
-        countr_size *= 8;
-        *count = vcpu->regs[VCPU_REGS_RCX] & (~0ULL >> (64 - countr_size));
-        //printk("cx: %lx\n", vcpu->regs[VCPU_REGS_RCX]);
-        return 1;
-}
-
 static int handle_io(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 {
-        u64 exit_qualification;
+        unsigned long exit_qualification;
         int size, down, in, string, rep;
         unsigned port;
-        unsigned long count;
-        gva_t address;
 
         ++vcpu->stat.io_exits;
-        exit_qualification = vmcs_read64(EXIT_QUALIFICATION);
-        in = (exit_qualification & 8) != 0;
-        size = (exit_qualification & 7) + 1;
+        exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
         string = (exit_qualification & 16) != 0;
+
+        if (string) {
+                if (emulate_instruction(vcpu, kvm_run, 0, 0) == EMULATE_DO_MMIO)
+                        return 0;
+                return 1;
+        }
+
+        size = (exit_qualification & 7) + 1;
+        in = (exit_qualification & 8) != 0;
         down = (vmcs_readl(GUEST_RFLAGS) & X86_EFLAGS_DF) != 0;
-        count = 1;
         rep = (exit_qualification & 32) != 0;
         port = exit_qualification >> 16;
-        address = 0;
-        if (string) {
-                if (rep && !get_io_count(vcpu, &count))
-                        return 1;
-                address = vmcs_readl(GUEST_LINEAR_ADDRESS);
-        }
-        return kvm_setup_pio(vcpu, kvm_run, in, size, count, string, down,
-                             address, rep, port);
+
+        return kvm_emulate_pio(vcpu, kvm_run, in, size, port);
 }
 
 static void
@@ -1743,11 +1877,11 @@ vmx_patch_hypercall(struct kvm_vcpu *vcpu, unsigned char *hypercall)
 
 static int handle_cr(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 {
-        u64 exit_qualification;
+        unsigned long exit_qualification;
         int cr;
         int reg;
 
-        exit_qualification = vmcs_read64(EXIT_QUALIFICATION);
+        exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
         cr = exit_qualification & 15;
         reg = (exit_qualification >> 8) & 15;
         switch ((exit_qualification >> 4) & 3) {
@@ -1772,13 +1906,14 @@ static int handle_cr(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
                         vcpu_load_rsp_rip(vcpu);
                         set_cr8(vcpu, vcpu->regs[reg]);
                         skip_emulated_instruction(vcpu);
-                        return 1;
+                        kvm_run->exit_reason = KVM_EXIT_SET_TPR;
+                        return 0;
                 };
                 break;
         case 2: /* clts */
                 vcpu_load_rsp_rip(vcpu);
                 vmx_fpu_deactivate(vcpu);
-                vcpu->cr0 &= ~CR0_TS_MASK;
+                vcpu->cr0 &= ~X86_CR0_TS;
                 vmcs_writel(CR0_READ_SHADOW, vcpu->cr0);
                 vmx_fpu_activate(vcpu);
                 skip_emulated_instruction(vcpu);
@@ -1793,7 +1928,7 @@ static int handle_cr(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
                         return 1;
                 case 8:
                         vcpu_load_rsp_rip(vcpu);
-                        vcpu->regs[reg] = vcpu->cr8;
+                        vcpu->regs[reg] = get_cr8(vcpu);
                         vcpu_put_rsp_rip(vcpu);
                         skip_emulated_instruction(vcpu);
                         return 1;
@@ -1808,14 +1943,14 @@ static int handle_cr(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
                 break;
         }
         kvm_run->exit_reason = 0;
-        printk(KERN_ERR "kvm: unhandled control register: op %d cr %d\n",
+        pr_unimpl(vcpu, "unhandled control register: op %d cr %d\n",
                (int)(exit_qualification >> 4) & 3, cr);
         return 0;
 }
 
 static int handle_dr(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 {
-        u64 exit_qualification;
+        unsigned long exit_qualification;
         unsigned long val;
         int dr, reg;
 
@@ -1823,7 +1958,7 @@ static int handle_dr(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
          * FIXME: this code assumes the host is debugging the guest.
          *        need to deal with guest debugging itself too.
          */
-        exit_qualification = vmcs_read64(EXIT_QUALIFICATION);
+        exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
         dr = exit_qualification & 7;
         reg = (exit_qualification >> 8) & 15;
         vcpu_load_rsp_rip(vcpu);
@@ -1886,19 +2021,21 @@ static int handle_wrmsr(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
         return 1;
 }
 
-static void post_kvm_run_save(struct kvm_vcpu *vcpu,
-                              struct kvm_run *kvm_run)
+static int handle_tpr_below_threshold(struct kvm_vcpu *vcpu,
+                                      struct kvm_run *kvm_run)
 {
-        kvm_run->if_flag = (vmcs_readl(GUEST_RFLAGS) & X86_EFLAGS_IF) != 0;
-        kvm_run->cr8 = vcpu->cr8;
-        kvm_run->apic_base = vcpu->apic_base;
-        kvm_run->ready_for_interrupt_injection = (vcpu->interrupt_window_open &&
-                                                  vcpu->irq_summary == 0);
+        return 1;
 }
 
 static int handle_interrupt_window(struct kvm_vcpu *vcpu,
                                    struct kvm_run *kvm_run)
 {
+        u32 cpu_based_vm_exec_control;
+
+        /* clear pending irq */
+        cpu_based_vm_exec_control = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
+        cpu_based_vm_exec_control &= ~CPU_BASED_VIRTUAL_INTR_PENDING;
+        vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, cpu_based_vm_exec_control);
         /*
          * If the user space waits to inject interrupts, exit as soon as
          * possible
@@ -1943,6 +2080,7 @@ static int (*kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu,
         [EXIT_REASON_PENDING_INTERRUPT]       = handle_interrupt_window,
         [EXIT_REASON_HLT]                     = handle_halt,
         [EXIT_REASON_VMCALL]                  = handle_vmcall,
+        [EXIT_REASON_TPR_BELOW_THRESHOLD]     = handle_tpr_below_threshold
 };
 
 static const int kvm_vmx_max_exit_handlers =
@@ -1956,6 +2094,14 @@ static int kvm_handle_exit(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
 {
         u32 vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
         u32 exit_reason = vmcs_read32(VM_EXIT_REASON);
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+
+        if (unlikely(vmx->fail)) {
+                kvm_run->exit_reason = KVM_EXIT_FAIL_ENTRY;
+                kvm_run->fail_entry.hardware_entry_failure_reason
+                        = vmcs_read32(VM_INSTRUCTION_ERROR);
+                return 0;
+        }
 
         if ( (vectoring_info & VECTORING_INFO_VALID_MASK) &&
                                 exit_reason != EXIT_REASON_EXCEPTION_NMI )
@@ -1971,57 +2117,91 @@ static int kvm_handle_exit(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
         return 0;
 }
 
-/*
- * Check if userspace requested an interrupt window, and that the
- * interrupt window is open.
- *
- * No need to exit to userspace if we already have an interrupt queued.
- */
-static int dm_request_for_irq_injection(struct kvm_vcpu *vcpu,
-                                          struct kvm_run *kvm_run)
+static void vmx_flush_tlb(struct kvm_vcpu *vcpu)
 {
-        return (!vcpu->irq_summary &&
-                kvm_run->request_interrupt_window &&
-                vcpu->interrupt_window_open &&
-                (vmcs_readl(GUEST_RFLAGS) & X86_EFLAGS_IF));
 }
 
-static void vmx_flush_tlb(struct kvm_vcpu *vcpu)
+static void update_tpr_threshold(struct kvm_vcpu *vcpu)
 {
+        int max_irr, tpr;
+
+        if (!vm_need_tpr_shadow(vcpu->kvm))
+                return;
+
+        if (!kvm_lapic_enabled(vcpu) ||
+            ((max_irr = kvm_lapic_find_highest_irr(vcpu)) == -1)) {
+                vmcs_write32(TPR_THRESHOLD, 0);
+                return;
+        }
+
+        tpr = (kvm_lapic_get_cr8(vcpu) & 0x0f) << 4;
+        vmcs_write32(TPR_THRESHOLD, (max_irr > tpr) ? tpr >> 4 : max_irr >> 4);
 }
 
-static int vmx_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+static void enable_irq_window(struct kvm_vcpu *vcpu)
 {
-        u8 fail;
-        int r;
+        u32 cpu_based_vm_exec_control;
 
-preempted:
-        if (vcpu->guest_debug.enabled)
-                kvm_guest_debug_pre(vcpu);
+        cpu_based_vm_exec_control = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
+        cpu_based_vm_exec_control |= CPU_BASED_VIRTUAL_INTR_PENDING;
+        vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, cpu_based_vm_exec_control);
+}
 
-again:
-        if (!vcpu->mmio_read_completed)
-                do_interrupt_requests(vcpu, kvm_run);
+static void vmx_intr_assist(struct kvm_vcpu *vcpu)
+{
+        u32 idtv_info_field, intr_info_field;
+        int has_ext_irq, interrupt_window_open;
+        int vector;
 
-        vmx_save_host_state(vcpu);
-        kvm_load_guest_fpu(vcpu);
+        kvm_inject_pending_timer_irqs(vcpu);
+        update_tpr_threshold(vcpu);
 
-        r = kvm_mmu_reload(vcpu);
-        if (unlikely(r))
-                goto out;
+        has_ext_irq = kvm_cpu_has_interrupt(vcpu);
+        intr_info_field = vmcs_read32(VM_ENTRY_INTR_INFO_FIELD);
+        idtv_info_field = vmcs_read32(IDT_VECTORING_INFO_FIELD);
+        if (intr_info_field & INTR_INFO_VALID_MASK) {
+                if (idtv_info_field & INTR_INFO_VALID_MASK) {
+                        /* TODO: fault when IDT_Vectoring */
+                        printk(KERN_ERR "Fault when IDT_Vectoring\n");
+                }
+                if (has_ext_irq)
+                        enable_irq_window(vcpu);
+                return;
+        }
+        if (unlikely(idtv_info_field & INTR_INFO_VALID_MASK)) {
+                vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, idtv_info_field);
+                vmcs_write32(VM_ENTRY_INSTRUCTION_LEN,
+                                vmcs_read32(VM_EXIT_INSTRUCTION_LEN));
+
+                if (unlikely(idtv_info_field & INTR_INFO_DELIEVER_CODE_MASK))
+                        vmcs_write32(VM_ENTRY_EXCEPTION_ERROR_CODE,
+                                vmcs_read32(IDT_VECTORING_ERROR_CODE));
+                if (unlikely(has_ext_irq))
+                        enable_irq_window(vcpu);
+                return;
+        }
+        if (!has_ext_irq)
+                return;
+        interrupt_window_open =
+                ((vmcs_readl(GUEST_RFLAGS) & X86_EFLAGS_IF) &&
+                 (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & 3) == 0);
+        if (interrupt_window_open) {
+                vector = kvm_cpu_get_interrupt(vcpu);
+                vmx_inject_irq(vcpu, vector);
+                kvm_timer_intr_post(vcpu, vector);
+        } else
+                enable_irq_window(vcpu);
+}
+
+static void vmx_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+{
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
 
         /*
          * Loading guest fpu may have cleared host cr0.ts
          */
         vmcs_writel(HOST_CR0, read_cr0());
 
-        local_irq_disable();
-
-        vcpu->guest_mode = 1;
-        if (vcpu->requests)
-                if (test_and_clear_bit(KVM_TLB_FLUSH, &vcpu->requests))
-                    vmx_flush_tlb(vcpu);
-
         asm (
                 /* Store host registers */
 #ifdef CONFIG_X86_64
@@ -2115,8 +2295,8 @@ again:
                 "pop %%ecx; popa \n\t"
 #endif
                 "setbe %0 \n\t"
-              : "=q" (fail)
-              : "r"(vcpu->launched), "d"((unsigned long)HOST_RSP),
+              : "=q" (vmx->fail)
+              : "r"(vmx->launched), "d"((unsigned long)HOST_RSP),
                 "c"(vcpu),
                 [rax]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_RAX])),
                 [rbx]"i"(offsetof(struct kvm_vcpu, regs[VCPU_REGS_RBX])),
@@ -2138,59 +2318,10 @@ again:
                 [cr2]"i"(offsetof(struct kvm_vcpu, cr2))
               : "cc", "memory" );
 
-        vcpu->guest_mode = 0;
-        local_irq_enable();
-
-        ++vcpu->stat.exits;
-
         vcpu->interrupt_window_open = (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & 3) == 0;
 
         asm ("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
-
-        if (unlikely(fail)) {
-                kvm_run->exit_reason = KVM_EXIT_FAIL_ENTRY;
-                kvm_run->fail_entry.hardware_entry_failure_reason
-                        = vmcs_read32(VM_INSTRUCTION_ERROR);
-                r = 0;
-                goto out;
-        }
-        /*
-         * Profile KVM exit RIPs:
-         */
-        if (unlikely(prof_on == KVM_PROFILING))
-                profile_hit(KVM_PROFILING, (void *)vmcs_readl(GUEST_RIP));
-
-        vcpu->launched = 1;
-        r = kvm_handle_exit(kvm_run, vcpu);
-        if (r > 0) {
-                /* Give scheduler a change to reschedule. */
-                if (signal_pending(current)) {
-                        r = -EINTR;
-                        kvm_run->exit_reason = KVM_EXIT_INTR;
-                        ++vcpu->stat.signal_exits;
-                        goto out;
-                }
-
-                if (dm_request_for_irq_injection(vcpu, kvm_run)) {
-                        r = -EINTR;
-                        kvm_run->exit_reason = KVM_EXIT_INTR;
-                        ++vcpu->stat.request_irq_exits;
-                        goto out;
-                }
-                if (!need_resched()) {
-                        ++vcpu->stat.light_exits;
-                        goto again;
-                }
-        }
-
-out:
-        if (r > 0) {
-                kvm_resched(vcpu);
-                goto preempted;
-        }
-
-        post_kvm_run_save(vcpu, kvm_run);
-        return r;
+        vmx->launched = 1;
 }
 
 static void vmx_inject_page_fault(struct kvm_vcpu *vcpu,
@@ -2225,67 +2356,118 @@ static void vmx_inject_page_fault(struct kvm_vcpu *vcpu,
 
 static void vmx_free_vmcs(struct kvm_vcpu *vcpu)
 {
-        if (vcpu->vmcs) {
-                on_each_cpu(__vcpu_clear, vcpu, 0, 1);
-                free_vmcs(vcpu->vmcs);
-                vcpu->vmcs = NULL;
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+
+        if (vmx->vmcs) {
+                on_each_cpu(__vcpu_clear, vmx, 0, 1);
+                free_vmcs(vmx->vmcs);
+                vmx->vmcs = NULL;
         }
 }
 
 static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
 {
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+
         vmx_free_vmcs(vcpu);
+        kfree(vmx->host_msrs);
+        kfree(vmx->guest_msrs);
+        kvm_vcpu_uninit(vcpu);
+        kmem_cache_free(kvm_vcpu_cache, vmx);
 }
 
-static int vmx_create_vcpu(struct kvm_vcpu *vcpu)
+static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
 {
-        struct vmcs *vmcs;
+        int err;
+        struct vcpu_vmx *vmx = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL);
+        int cpu;
 
-        vcpu->guest_msrs = kmalloc(PAGE_SIZE, GFP_KERNEL);
-        if (!vcpu->guest_msrs)
-                return -ENOMEM;
+        if (!vmx)
+                return ERR_PTR(-ENOMEM);
 
-        vcpu->host_msrs = kmalloc(PAGE_SIZE, GFP_KERNEL);
-        if (!vcpu->host_msrs)
-                goto out_free_guest_msrs;
+        err = kvm_vcpu_init(&vmx->vcpu, kvm, id);
+        if (err)
+                goto free_vcpu;
 
-        vmcs = alloc_vmcs();
-        if (!vmcs)
-                goto out_free_msrs;
+        if (irqchip_in_kernel(kvm)) {
+                err = kvm_create_lapic(&vmx->vcpu);
+                if (err < 0)
+                        goto free_vcpu;
+        }
 
-        vmcs_clear(vmcs);
-        vcpu->vmcs = vmcs;
-        vcpu->launched = 0;
+        vmx->guest_msrs = kmalloc(PAGE_SIZE, GFP_KERNEL);
+        if (!vmx->guest_msrs) {
+                err = -ENOMEM;
+                goto uninit_vcpu;
+        }
 
-        return 0;
+        vmx->host_msrs = kmalloc(PAGE_SIZE, GFP_KERNEL);
+        if (!vmx->host_msrs)
+                goto free_guest_msrs;
 
-out_free_msrs:
-        kfree(vcpu->host_msrs);
-        vcpu->host_msrs = NULL;
+        vmx->vmcs = alloc_vmcs();
+        if (!vmx->vmcs)
+                goto free_msrs;
 
-out_free_guest_msrs:
-        kfree(vcpu->guest_msrs);
-        vcpu->guest_msrs = NULL;
+        vmcs_clear(vmx->vmcs);
 
-        return -ENOMEM;
+        cpu = get_cpu();
+        vmx_vcpu_load(&vmx->vcpu, cpu);
+        err = vmx_vcpu_setup(vmx);
+        vmx_vcpu_put(&vmx->vcpu);
+        put_cpu();
+        if (err)
+                goto free_vmcs;
+
+        return &vmx->vcpu;
+
+free_vmcs:
+        free_vmcs(vmx->vmcs);
+free_msrs:
+        kfree(vmx->host_msrs);
+free_guest_msrs:
+        kfree(vmx->guest_msrs);
+uninit_vcpu:
+        kvm_vcpu_uninit(&vmx->vcpu);
+free_vcpu:
+        kmem_cache_free(kvm_vcpu_cache, vmx);
+        return ERR_PTR(err);
+}
+
+static void __init vmx_check_processor_compat(void *rtn)
+{
+        struct vmcs_config vmcs_conf;
+
+        *(int *)rtn = 0;
+        if (setup_vmcs_config(&vmcs_conf) < 0)
+                *(int *)rtn = -EIO;
+        if (memcmp(&vmcs_config, &vmcs_conf, sizeof(struct vmcs_config)) != 0) {
+                printk(KERN_ERR "kvm: CPU %d feature inconsistency!\n",
+                                smp_processor_id());
+                *(int *)rtn = -EIO;
+        }
 }
 
-static struct kvm_arch_ops vmx_arch_ops = {
+static struct kvm_x86_ops vmx_x86_ops = {
         .cpu_has_kvm_support = cpu_has_kvm_support,
         .disabled_by_bios = vmx_disabled_by_bios,
         .hardware_setup = hardware_setup,
         .hardware_unsetup = hardware_unsetup,
+        .check_processor_compatibility = vmx_check_processor_compat,
         .hardware_enable = hardware_enable,
         .hardware_disable = hardware_disable,
 
         .vcpu_create = vmx_create_vcpu,
         .vcpu_free = vmx_free_vcpu,
+        .vcpu_reset = vmx_vcpu_reset,
 
+        .prepare_guest_switch = vmx_save_host_state,
         .vcpu_load = vmx_vcpu_load,
         .vcpu_put = vmx_vcpu_put,
         .vcpu_decache = vmx_vcpu_decache,
 
         .set_guest_debug = set_guest_debug,
+        .guest_debug_pre = kvm_guest_debug_pre,
         .get_msr = vmx_get_msr,
         .set_msr = vmx_set_msr,
         .get_segment_base = vmx_get_segment_base,
@@ -2314,9 +2496,13 @@ static struct kvm_arch_ops vmx_arch_ops = {
         .inject_gp = vmx_inject_gp,
 
         .run = vmx_vcpu_run,
+        .handle_exit = kvm_handle_exit,
         .skip_emulated_instruction = skip_emulated_instruction,
-        .vcpu_setup = vmx_vcpu_setup,
         .patch_hypercall = vmx_patch_hypercall,
+        .get_irq = vmx_get_irq,
+        .set_irq = vmx_inject_irq,
+        .inject_pending_irq = vmx_intr_assist,
+        .inject_pending_vectors = do_interrupt_requests,
 };
 
 static int __init vmx_init(void)
@@ -2347,7 +2533,7 @@ static int __init vmx_init(void)
         memset(iova, 0xff, PAGE_SIZE);
         kunmap(vmx_io_bitmap_b);
 
-        r = kvm_init_arch(&vmx_arch_ops, THIS_MODULE);
+        r = kvm_init_x86(&vmx_x86_ops, sizeof(struct vcpu_vmx), THIS_MODULE);
         if (r)
                 goto out1;
 
@@ -2365,7 +2551,7 @@ static void __exit vmx_exit(void)
         __free_page(vmx_io_bitmap_b);
         __free_page(vmx_io_bitmap_a);
 
-        kvm_exit_arch();
+        kvm_exit_x86();
 }
 
 module_init(vmx_init)
diff --git a/drivers/kvm/vmx.h b/drivers/kvm/vmx.h
index d0dc93df411b..fd4e14666088 100644
--- a/drivers/kvm/vmx.h
+++ b/drivers/kvm/vmx.h
@@ -25,29 +25,36 @@
  *
  */
 
-#define CPU_BASED_VIRTUAL_INTR_PENDING  0x00000004
-#define CPU_BASED_USE_TSC_OFFSETING     0x00000008
-#define CPU_BASED_HLT_EXITING           0x00000080
-#define CPU_BASED_INVDPG_EXITING        0x00000200
-#define CPU_BASED_MWAIT_EXITING         0x00000400
-#define CPU_BASED_RDPMC_EXITING         0x00000800
-#define CPU_BASED_RDTSC_EXITING         0x00001000
-#define CPU_BASED_CR8_LOAD_EXITING      0x00080000
-#define CPU_BASED_CR8_STORE_EXITING     0x00100000
-#define CPU_BASED_TPR_SHADOW            0x00200000
-#define CPU_BASED_MOV_DR_EXITING        0x00800000
-#define CPU_BASED_UNCOND_IO_EXITING     0x01000000
-#define CPU_BASED_ACTIVATE_IO_BITMAP    0x02000000
-#define CPU_BASED_MSR_BITMAPS           0x10000000
-#define CPU_BASED_MONITOR_EXITING       0x20000000
-#define CPU_BASED_PAUSE_EXITING         0x40000000
+#define CPU_BASED_VIRTUAL_INTR_PENDING          0x00000004
+#define CPU_BASED_USE_TSC_OFFSETING             0x00000008
+#define CPU_BASED_HLT_EXITING                   0x00000080
+#define CPU_BASED_INVLPG_EXITING                0x00000200
+#define CPU_BASED_MWAIT_EXITING                 0x00000400
+#define CPU_BASED_RDPMC_EXITING                 0x00000800
+#define CPU_BASED_RDTSC_EXITING                 0x00001000
+#define CPU_BASED_CR8_LOAD_EXITING              0x00080000
+#define CPU_BASED_CR8_STORE_EXITING             0x00100000
+#define CPU_BASED_TPR_SHADOW                    0x00200000
+#define CPU_BASED_MOV_DR_EXITING                0x00800000
+#define CPU_BASED_UNCOND_IO_EXITING             0x01000000
+#define CPU_BASED_USE_IO_BITMAPS                0x02000000
+#define CPU_BASED_USE_MSR_BITMAPS               0x10000000
+#define CPU_BASED_MONITOR_EXITING               0x20000000
+#define CPU_BASED_PAUSE_EXITING                 0x40000000
+#define CPU_BASED_ACTIVATE_SECONDARY_CONTROLS   0x80000000
 
-#define PIN_BASED_EXT_INTR_MASK 0x1
-#define PIN_BASED_NMI_EXITING   0x8
+#define PIN_BASED_EXT_INTR_MASK                 0x00000001
+#define PIN_BASED_NMI_EXITING                   0x00000008
+#define PIN_BASED_VIRTUAL_NMIS                  0x00000020
 
-#define VM_EXIT_ACK_INTR_ON_EXIT        0x00008000
-#define VM_EXIT_HOST_ADD_SPACE_SIZE     0x00000200
+#define VM_EXIT_HOST_ADDR_SPACE_SIZE            0x00000200
+#define VM_EXIT_ACK_INTR_ON_EXIT                0x00008000
 
+#define VM_ENTRY_IA32E_MODE                     0x00000200
+#define VM_ENTRY_SMM                            0x00000400
+#define VM_ENTRY_DEACT_DUAL_MONITOR             0x00000800
+
+#define SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES 0x00000001
 
 /* VMCS Encodings */
 enum vmcs_field {
@@ -206,6 +213,7 @@ enum vmcs_field {
 #define EXIT_REASON_MSR_READ            31
 #define EXIT_REASON_MSR_WRITE           32
 #define EXIT_REASON_MWAIT_INSTRUCTION   36
+#define EXIT_REASON_TPR_BELOW_THRESHOLD 43
 
 /*
  * Interruption-information format
@@ -261,9 +269,6 @@ enum vmcs_field {
 /* segment AR */
 #define SEGMENT_AR_L_MASK (1 << 13)
 
-/* entry controls */
-#define VM_ENTRY_CONTROLS_IA32E_MASK (1 << 9)
-
 #define AR_TYPE_ACCESSES_MASK 1
 #define AR_TYPE_READABLE_MASK (1 << 1)
 #define AR_TYPE_WRITEABLE_MASK (1 << 2)
@@ -285,13 +290,21 @@ enum vmcs_field {
 
 #define AR_RESERVD_MASK 0xfffe0f00
 
-#define CR4_VMXE 0x2000
+#define MSR_IA32_VMX_BASIC                      0x480
+#define MSR_IA32_VMX_PINBASED_CTLS              0x481
+#define MSR_IA32_VMX_PROCBASED_CTLS             0x482
+#define MSR_IA32_VMX_EXIT_CTLS                  0x483
+#define MSR_IA32_VMX_ENTRY_CTLS                 0x484
+#define MSR_IA32_VMX_MISC                       0x485
+#define MSR_IA32_VMX_CR0_FIXED0                 0x486
+#define MSR_IA32_VMX_CR0_FIXED1                 0x487
+#define MSR_IA32_VMX_CR4_FIXED0                 0x488
+#define MSR_IA32_VMX_CR4_FIXED1                 0x489
+#define MSR_IA32_VMX_VMCS_ENUM                  0x48a
+#define MSR_IA32_VMX_PROCBASED_CTLS2            0x48b
 
-#define MSR_IA32_VMX_BASIC              0x480
-#define MSR_IA32_FEATURE_CONTROL                0x03a
-#define MSR_IA32_VMX_PINBASED_CTLS              0x481
-#define MSR_IA32_VMX_PROCBASED_CTLS             0x482
-#define MSR_IA32_VMX_EXIT_CTLS          0x483
-#define MSR_IA32_VMX_ENTRY_CTLS         0x484
+#define MSR_IA32_FEATURE_CONTROL                0x3a
+#define MSR_IA32_FEATURE_CONTROL_LOCKED         0x1
+#define MSR_IA32_FEATURE_CONTROL_VMXON_ENABLED  0x4
 
 #endif
diff --git a/drivers/kvm/x86_emulate.c b/drivers/kvm/x86_emulate.c
index 4b8a0cc9665e..9737c3b2f48c 100644
--- a/drivers/kvm/x86_emulate.c
+++ b/drivers/kvm/x86_emulate.c
@@ -6,7 +6,7 @@
  * Copyright (c) 2005 Keir Fraser
  *
  * Linux coding style, mod r/m decoder, segment base fixes, real-mode
- * privieged instructions:
+ * privileged instructions:
  *
  * Copyright (C) 2006 Qumranet
  *
@@ -83,7 +83,7 @@ static u8 opcode_table[256] = {
         /* 0x20 - 0x27 */
         ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
         ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
-        0, 0, 0, 0,
+        SrcImmByte, SrcImm, 0, 0,
         /* 0x28 - 0x2F */
         ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM,
         ByteOp | DstReg | SrcMem | ModRM, DstReg | SrcMem | ModRM,
@@ -99,15 +99,24 @@ static u8 opcode_table[256] = {
         /* 0x40 - 0x4F */
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         /* 0x50 - 0x57 */
-        0, 0, 0, 0, 0, 0, 0, 0,
+        ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
+        ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
         /* 0x58 - 0x5F */
         ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
         ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
-        /* 0x60 - 0x6F */
+        /* 0x60 - 0x67 */
         0, 0, 0, DstReg | SrcMem32 | ModRM | Mov /* movsxd (x86/64) */ ,
-        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-        /* 0x70 - 0x7F */
-        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0,
+        /* 0x68 - 0x6F */
+        0, 0, ImplicitOps|Mov, 0,
+        SrcNone  | ByteOp  | ImplicitOps, SrcNone  | ImplicitOps, /* insb, insw/insd */
+        SrcNone  | ByteOp  | ImplicitOps, SrcNone  | ImplicitOps, /* outsb, outsw/outsd */
+        /* 0x70 - 0x77 */
+        ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
+        ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
+        /* 0x78 - 0x7F */
+        ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
+        ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
         /* 0x80 - 0x87 */
         ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImm | ModRM,
         ByteOp | DstMem | SrcImm | ModRM, DstMem | SrcImmByte | ModRM,
@@ -116,9 +125,9 @@ static u8 opcode_table[256] = {
         /* 0x88 - 0x8F */
         ByteOp | DstMem | SrcReg | ModRM | Mov, DstMem | SrcReg | ModRM | Mov,
         ByteOp | DstReg | SrcMem | ModRM | Mov, DstReg | SrcMem | ModRM | Mov,
-        0, 0, 0, DstMem | SrcNone | ModRM | Mov,
+        0, ModRM | DstReg, 0, DstMem | SrcNone | ModRM | Mov,
         /* 0x90 - 0x9F */
-        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps, ImplicitOps, 0, 0,
         /* 0xA0 - 0xA7 */
         ByteOp | DstReg | SrcMem | Mov, DstReg | SrcMem | Mov,
         ByteOp | DstMem | SrcReg | Mov, DstMem | SrcReg | Mov,
@@ -142,8 +151,10 @@ static u8 opcode_table[256] = {
         0, 0, 0, 0,
         /* 0xD8 - 0xDF */
         0, 0, 0, 0, 0, 0, 0, 0,
-        /* 0xE0 - 0xEF */
-        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 0xE0 - 0xE7 */
+        0, 0, 0, 0, 0, 0, 0, 0,
+        /* 0xE8 - 0xEF */
+        ImplicitOps, SrcImm|ImplicitOps, 0, SrcImmByte|ImplicitOps, 0, 0, 0, 0,
         /* 0xF0 - 0xF7 */
         0, 0, 0, 0,
         ImplicitOps, 0,
@@ -181,7 +192,10 @@ static u16 twobyte_table[256] = {
         /* 0x70 - 0x7F */
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         /* 0x80 - 0x8F */
-        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
+        ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
+        ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
+        ImplicitOps, ImplicitOps, ImplicitOps, ImplicitOps,
         /* 0x90 - 0x9F */
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         /* 0xA0 - 0xA7 */
@@ -207,19 +221,6 @@ static u16 twobyte_table[256] = {
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
 };
 
-/*
- * Tell the emulator that of the Group 7 instructions (sgdt, lidt, etc.) we
- * are interested only in invlpg and not in any of the rest.
- *
- * invlpg is a special instruction in that the data it references may not
- * be mapped.
- */
-void kvm_emulator_want_group7_invlpg(void)
-{
-        twobyte_table[1] &= ~SrcMem;
-}
-EXPORT_SYMBOL_GPL(kvm_emulator_want_group7_invlpg);
-
 /* Type, address-of, and value of an instruction's operand. */
 struct operand {
         enum { OP_REG, OP_MEM, OP_IMM } type;
@@ -420,7 +421,7 @@ struct operand {
 #define insn_fetch(_type, _size, _eip)                                  \
 ({      unsigned long _x;                                               \
         rc = ops->read_std((unsigned long)(_eip) + ctxt->cs_base, &_x,  \
-                                                  (_size), ctxt);       \
+                                                  (_size), ctxt->vcpu); \
         if ( rc != 0 )                                                  \
                 goto done;                                              \
         (_eip) += (_size);                                              \
@@ -428,10 +429,11 @@ struct operand {
 })
 
 /* Access/update address held in a register, based on addressing mode. */
+#define address_mask(reg)                                               \
+        ((ad_bytes == sizeof(unsigned long)) ?                          \
+                (reg) : ((reg) & ((1UL << (ad_bytes << 3)) - 1)))
 #define register_address(base, reg)                                     \
-        ((base) + ((ad_bytes == sizeof(unsigned long)) ? (reg) :        \
-                   ((reg) & ((1UL << (ad_bytes << 3)) - 1))))
-
+        ((base) + address_mask(reg))
 #define register_address_increment(reg, inc)                            \
         do {                                                            \
                 /* signed type ensures sign extension to long */        \
@@ -443,8 +445,19 @@ struct operand {
                            (((reg) + _inc) & ((1UL << (ad_bytes << 3)) - 1)); \
         } while (0)
 
-void *decode_register(u8 modrm_reg, unsigned long *regs,
-                      int highbyte_regs)
+#define JMP_REL(rel)                                                    \
+        do {                                                            \
+                _eip += (int)(rel);                                     \
+                _eip = ((op_bytes == 2) ? (uint16_t)_eip : (uint32_t)_eip); \
+        } while (0)
+
+/*
+ * Given the 'reg' portion of a ModRM byte, and a register block, return a
+ * pointer into the block that addresses the relevant register.
+ * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
+ */
+static void *decode_register(u8 modrm_reg, unsigned long *regs,
+                             int highbyte_regs)
 {
         void *p;
 
@@ -464,13 +477,50 @@ static int read_descriptor(struct x86_emulate_ctxt *ctxt,
         if (op_bytes == 2)
                 op_bytes = 3;
         *address = 0;
-        rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2, ctxt);
+        rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,
+                           ctxt->vcpu);
         if (rc)
                 return rc;
-        rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes, ctxt);
+        rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,
+                           ctxt->vcpu);
         return rc;
 }
 
+static int test_cc(unsigned int condition, unsigned int flags)
+{
+        int rc = 0;
+
+        switch ((condition & 15) >> 1) {
+        case 0: /* o */
+                rc |= (flags & EFLG_OF);
+                break;
+        case 1: /* b/c/nae */
+                rc |= (flags & EFLG_CF);
+                break;
+        case 2: /* z/e */
+                rc |= (flags & EFLG_ZF);
+                break;
+        case 3: /* be/na */
+                rc |= (flags & (EFLG_CF|EFLG_ZF));
+                break;
+        case 4: /* s */
+                rc |= (flags & EFLG_SF);
+                break;
+        case 5: /* p/pe */
+                rc |= (flags & EFLG_PF);
+                break;
+        case 7: /* le/ng */
+                rc |= (flags & EFLG_ZF);
+                /* fall through */
+        case 6: /* l/nge */
+                rc |= (!(flags & EFLG_SF) != !(flags & EFLG_OF));
+                break;
+        }
+
+        /* Odd condition identifiers (lsb == 1) have inverted sense. */
+        return (!!rc ^ (condition & 1));
+}
+
 int
 x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
 {
@@ -771,11 +821,15 @@ done_prefixes:
                 goto srcmem_common;
         case SrcMem:
                 src.bytes = (d & ByteOp) ? 1 : op_bytes;
+                /* Don't fetch the address for invlpg: it could be unmapped. */
+                if (twobyte && b == 0x01 && modrm_reg == 7)
+                        break;
               srcmem_common:
                 src.type = OP_MEM;
                 src.ptr = (unsigned long *)cr2;
+                src.val = 0;
                 if ((rc = ops->read_emulated((unsigned long)src.ptr,
-                                             &src.val, src.bytes, ctxt)) != 0)
+                                             &src.val, src.bytes, ctxt->vcpu)) != 0)
                         goto done;
                 src.orig_val = src.val;
                 break;
@@ -814,7 +868,7 @@ done_prefixes:
         case DstReg:
                 dst.type = OP_REG;
                 if ((d & ByteOp)
-                    && !(twobyte_table && (b == 0xb6 || b == 0xb7))) {
+                    && !(twobyte && (b == 0xb6 || b == 0xb7))) {
                         dst.ptr = decode_register(modrm_reg, _regs,
                                                   (rex_prefix == 0));
                         dst.val = *(u8 *) dst.ptr;
@@ -838,6 +892,7 @@ done_prefixes:
                 dst.type = OP_MEM;
                 dst.ptr = (unsigned long *)cr2;
                 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
+                dst.val = 0;
                 if (d & BitOp) {
                         unsigned long mask = ~(dst.bytes * 8 - 1);
 
@@ -845,7 +900,7 @@ done_prefixes:
                 }
                 if (!(d & Mov) && /* optimisation - avoid slow emulated read */
                     ((rc = ops->read_emulated((unsigned long)dst.ptr,
-                                              &dst.val, dst.bytes, ctxt)) != 0))
+                                              &dst.val, dst.bytes, ctxt->vcpu)) != 0))
                         goto done;
                 break;
         }
@@ -871,10 +926,27 @@ done_prefixes:
               sbb:              /* sbb */
                 emulate_2op_SrcV("sbb", src, dst, _eflags);
                 break;
-        case 0x20 ... 0x25:
+        case 0x20 ... 0x23:
               and:              /* and */
                 emulate_2op_SrcV("and", src, dst, _eflags);
                 break;
+        case 0x24:              /* and al imm8 */
+                dst.type = OP_REG;
+                dst.ptr = &_regs[VCPU_REGS_RAX];
+                dst.val = *(u8 *)dst.ptr;
+                dst.bytes = 1;
+                dst.orig_val = dst.val;
+                goto and;
+        case 0x25:              /* and ax imm16, or eax imm32 */
+                dst.type = OP_REG;
+                dst.bytes = op_bytes;
+                dst.ptr = &_regs[VCPU_REGS_RAX];
+                if (op_bytes == 2)
+                        dst.val = *(u16 *)dst.ptr;
+                else
+                        dst.val = *(u32 *)dst.ptr;
+                dst.orig_val = dst.val;
+                goto and;
         case 0x28 ... 0x2d:
               sub:              /* sub */
                 emulate_2op_SrcV("sub", src, dst, _eflags);
@@ -892,6 +964,17 @@ done_prefixes:
                         goto cannot_emulate;
                 dst.val = (s32) src.val;
                 break;
+        case 0x6a: /* push imm8 */
+                src.val = 0L;
+                src.val = insn_fetch(s8, 1, _eip);
+push:
+                dst.type  = OP_MEM;
+                dst.bytes = op_bytes;
+                dst.val = src.val;
+                register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
+                dst.ptr = (void *) register_address(ctxt->ss_base,
+                                                        _regs[VCPU_REGS_RSP]);
+                break;
         case 0x80 ... 0x83:     /* Grp1 */
                 switch (modrm_reg) {
                 case 0:
@@ -939,18 +1022,10 @@ done_prefixes:
                 dst.val = src.val;
                 lock_prefix = 1;
                 break;
-        case 0xa0 ... 0xa1:     /* mov */
-                dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
-                dst.val = src.val;
-                _eip += ad_bytes;       /* skip src displacement */
-                break;
-        case 0xa2 ... 0xa3:     /* mov */
-                dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
-                _eip += ad_bytes;       /* skip dst displacement */
-                break;
         case 0x88 ... 0x8b:     /* mov */
-        case 0xc6 ... 0xc7:     /* mov (sole member of Grp11) */
-                dst.val = src.val;
+                goto mov;
+        case 0x8d: /* lea r16/r32, m */
+                dst.val = modrm_val;
                 break;
         case 0x8f:              /* pop (sole member of Grp1a) */
                 /* 64-bit mode: POP always pops a 64-bit operand. */
@@ -958,10 +1033,19 @@ done_prefixes:
                         dst.bytes = 8;
                 if ((rc = ops->read_std(register_address(ctxt->ss_base,
                                                          _regs[VCPU_REGS_RSP]),
-                                        &dst.val, dst.bytes, ctxt)) != 0)
+                                        &dst.val, dst.bytes, ctxt->vcpu)) != 0)
                         goto done;
                 register_address_increment(_regs[VCPU_REGS_RSP], dst.bytes);
                 break;
+        case 0xa0 ... 0xa1:     /* mov */
+                dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
+                dst.val = src.val;
+                _eip += ad_bytes;       /* skip src displacement */
+                break;
+        case 0xa2 ... 0xa3:     /* mov */
+                dst.val = (unsigned long)_regs[VCPU_REGS_RAX];
+                _eip += ad_bytes;       /* skip dst displacement */
+                break;
         case 0xc0 ... 0xc1:
               grp2:             /* Grp2 */
                 switch (modrm_reg) {
@@ -989,12 +1073,41 @@ done_prefixes:
                         break;
                 }
                 break;
+        case 0xc6 ... 0xc7:     /* mov (sole member of Grp11) */
+        mov:
+                dst.val = src.val;
+                break;
         case 0xd0 ... 0xd1:     /* Grp2 */
                 src.val = 1;
                 goto grp2;
         case 0xd2 ... 0xd3:     /* Grp2 */
                 src.val = _regs[VCPU_REGS_RCX];
                 goto grp2;
+        case 0xe8: /* call (near) */ {
+                long int rel;
+                switch (op_bytes) {
+                case 2:
+                        rel = insn_fetch(s16, 2, _eip);
+                        break;
+                case 4:
+                        rel = insn_fetch(s32, 4, _eip);
+                        break;
+                case 8:
+                        rel = insn_fetch(s64, 8, _eip);
+                        break;
+                default:
+                        DPRINTF("Call: Invalid op_bytes\n");
+                        goto cannot_emulate;
+                }
+                src.val = (unsigned long) _eip;
+                JMP_REL(rel);
+                goto push;
+        }
+        case 0xe9: /* jmp rel */
+        case 0xeb: /* jmp rel short */
+                JMP_REL(src.val);
+                no_wb = 1; /* Disable writeback. */
+                break;
         case 0xf6 ... 0xf7:     /* Grp3 */
                 switch (modrm_reg) {
                 case 0 ... 1:   /* test */
@@ -1037,13 +1150,19 @@ done_prefixes:
                 case 1: /* dec */
                         emulate_1op("dec", dst, _eflags);
                         break;
+                case 4: /* jmp abs */
+                        if (b == 0xff)
+                                _eip = dst.val;
+                        else
+                                goto cannot_emulate;
+                        break;
                 case 6: /* push */
                         /* 64-bit mode: PUSH always pushes a 64-bit operand. */
                         if (mode == X86EMUL_MODE_PROT64) {
                                 dst.bytes = 8;
                                 if ((rc = ops->read_std((unsigned long)dst.ptr,
                                                         &dst.val, 8,
-                                                        ctxt)) != 0)
+                                                        ctxt->vcpu)) != 0)
                                         goto done;
                         }
                         register_address_increment(_regs[VCPU_REGS_RSP],
@@ -1051,7 +1170,7 @@ done_prefixes:
                         if ((rc = ops->write_std(
                                      register_address(ctxt->ss_base,
                                                       _regs[VCPU_REGS_RSP]),
-                                     &dst.val, dst.bytes, ctxt)) != 0)
+                                     &dst.val, dst.bytes, ctxt->vcpu)) != 0)
                                 goto done;
                         no_wb = 1;
                         break;
@@ -1086,11 +1205,11 @@ writeback:
                                 rc = ops->cmpxchg_emulated((unsigned long)dst.
                                                            ptr, &dst.orig_val,
                                                            &dst.val, dst.bytes,
-                                                           ctxt);
+                                                           ctxt->vcpu);
                         else
                                 rc = ops->write_emulated((unsigned long)dst.ptr,
                                                          &dst.val, dst.bytes,
-                                                         ctxt);
+                                                         ctxt->vcpu);
                         if (rc != 0)
                                 goto done;
                 default:
@@ -1109,6 +1228,81 @@ done:
 special_insn:
         if (twobyte)
                 goto twobyte_special_insn;
+        switch(b) {
+        case 0x50 ... 0x57:  /* push reg */
+                if (op_bytes == 2)
+                        src.val = (u16) _regs[b & 0x7];
+                else
+                        src.val = (u32) _regs[b & 0x7];
+                dst.type  = OP_MEM;
+                dst.bytes = op_bytes;
+                dst.val = src.val;
+                register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
+                dst.ptr = (void *) register_address(
+                        ctxt->ss_base, _regs[VCPU_REGS_RSP]);
+                break;
+        case 0x58 ... 0x5f: /* pop reg */
+                dst.ptr = (unsigned long *)&_regs[b & 0x7];
+        pop_instruction:
+                if ((rc = ops->read_std(register_address(ctxt->ss_base,
+                        _regs[VCPU_REGS_RSP]), dst.ptr, op_bytes, ctxt->vcpu))
+                        != 0)
+                        goto done;
+
+                register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
+                no_wb = 1; /* Disable writeback. */
+                break;
+        case 0x6c:              /* insb */
+        case 0x6d:              /* insw/insd */
+                 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
+                                1,                                      /* in */
+                                (d & ByteOp) ? 1 : op_bytes,            /* size */
+                                rep_prefix ?
+                                address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
+                                (_eflags & EFLG_DF),                    /* down */
+                                register_address(ctxt->es_base,
+                                                 _regs[VCPU_REGS_RDI]), /* address */
+                                rep_prefix,
+                                _regs[VCPU_REGS_RDX]                    /* port */
+                                ) == 0)
+                        return -1;
+                return 0;
+        case 0x6e:              /* outsb */
+        case 0x6f:              /* outsw/outsd */
+                if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
+                                0,                                      /* in */
+                                (d & ByteOp) ? 1 : op_bytes,            /* size */
+                                rep_prefix ?
+                                address_mask(_regs[VCPU_REGS_RCX]) : 1, /* count */
+                                (_eflags & EFLG_DF),                    /* down */
+                                register_address(override_base ?
+                                                 *override_base : ctxt->ds_base,
+                                                 _regs[VCPU_REGS_RSI]), /* address */
+                                rep_prefix,
+                                _regs[VCPU_REGS_RDX]                    /* port */
+                                ) == 0)
+                        return -1;
+                return 0;
+        case 0x70 ... 0x7f: /* jcc (short) */ {
+                int rel = insn_fetch(s8, 1, _eip);
+
+                if (test_cc(b, _eflags))
+                JMP_REL(rel);
+                break;
+        }
+        case 0x9c: /* pushf */
+                src.val =  (unsigned long) _eflags;
+                goto push;
+        case 0x9d: /* popf */
+                dst.ptr = (unsigned long *) &_eflags;
+                goto pop_instruction;
+        case 0xc3: /* ret */
+                dst.ptr = &_eip;
+                goto pop_instruction;
+        case 0xf4:              /* hlt */
+                ctxt->vcpu->halt_request = 1;
+                goto done;
+        }
         if (rep_prefix) {
                 if (_regs[VCPU_REGS_RCX] == 0) {
                         ctxt->vcpu->rip = _eip;
@@ -1125,7 +1319,7 @@ special_insn:
                                                         _regs[VCPU_REGS_RDI]);
                 if ((rc = ops->read_emulated(register_address(
                       override_base ? *override_base : ctxt->ds_base,
-                      _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt)) != 0)
+                      _regs[VCPU_REGS_RSI]), &dst.val, dst.bytes, ctxt->vcpu)) != 0)
                         goto done;
                 register_address_increment(_regs[VCPU_REGS_RSI],
                              (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
@@ -1147,7 +1341,8 @@ special_insn:
                 dst.type = OP_REG;
                 dst.bytes = (d & ByteOp) ? 1 : op_bytes;
                 dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
-                if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes, ctxt)) != 0)
+                if ((rc = ops->read_emulated(cr2, &dst.val, dst.bytes,
+                                             ctxt->vcpu)) != 0)
                         goto done;
                 register_address_increment(_regs[VCPU_REGS_RSI],
                            (_eflags & EFLG_DF) ? -dst.bytes : dst.bytes);
@@ -1155,23 +1350,7 @@ special_insn:
         case 0xae ... 0xaf:     /* scas */
                 DPRINTF("Urk! I don't handle SCAS.\n");
                 goto cannot_emulate;
-        case 0xf4:              /* hlt */
-                ctxt->vcpu->halt_request = 1;
-                goto done;
-        case 0xc3: /* ret */
-                dst.ptr = &_eip;
-                goto pop_instruction;
-        case 0x58 ... 0x5f: /* pop reg */
-                dst.ptr = (unsigned long *)&_regs[b & 0x7];
 
-pop_instruction:
-                if ((rc = ops->read_std(register_address(ctxt->ss_base,
-                        _regs[VCPU_REGS_RSP]), dst.ptr, op_bytes, ctxt)) != 0)
-                        goto done;
-
-                register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
-                no_wb = 1; /* Disable writeback. */
-                break;
         }
         goto writeback;
 
@@ -1230,40 +1409,50 @@ twobyte_insn:
                 break;
         case 0x40 ... 0x4f:     /* cmov */
                 dst.val = dst.orig_val = src.val;
-                d &= ~Mov;      /* default to no move */
+                no_wb = 1;
                 /*
                  * First, assume we're decoding an even cmov opcode
                  * (lsb == 0).
                  */
                 switch ((b & 15) >> 1) {
                 case 0: /* cmovo */
-                        d |= (_eflags & EFLG_OF) ? Mov : 0;
+                        no_wb = (_eflags & EFLG_OF) ? 0 : 1;
                         break;
                 case 1: /* cmovb/cmovc/cmovnae */
-                        d |= (_eflags & EFLG_CF) ? Mov : 0;
+                        no_wb = (_eflags & EFLG_CF) ? 0 : 1;
                         break;
                 case 2: /* cmovz/cmove */
-                        d |= (_eflags & EFLG_ZF) ? Mov : 0;
+                        no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
                         break;
                 case 3: /* cmovbe/cmovna */
-                        d |= (_eflags & (EFLG_CF | EFLG_ZF)) ? Mov : 0;
+                        no_wb = (_eflags & (EFLG_CF | EFLG_ZF)) ? 0 : 1;
                         break;
                 case 4: /* cmovs */
-                        d |= (_eflags & EFLG_SF) ? Mov : 0;
+                        no_wb = (_eflags & EFLG_SF) ? 0 : 1;
                         break;
                 case 5: /* cmovp/cmovpe */
-                        d |= (_eflags & EFLG_PF) ? Mov : 0;
+                        no_wb = (_eflags & EFLG_PF) ? 0 : 1;
                         break;
                 case 7: /* cmovle/cmovng */
-                        d |= (_eflags & EFLG_ZF) ? Mov : 0;
+                        no_wb = (_eflags & EFLG_ZF) ? 0 : 1;
                         /* fall through */
                 case 6: /* cmovl/cmovnge */
-                        d |= (!(_eflags & EFLG_SF) !=
-                              !(_eflags & EFLG_OF)) ? Mov : 0;
+                        no_wb &= (!(_eflags & EFLG_SF) !=
+                              !(_eflags & EFLG_OF)) ? 0 : 1;
                         break;
                 }
                 /* Odd cmov opcodes (lsb == 1) have inverted sense. */
-                d ^= (b & 1) ? Mov : 0;
+                no_wb ^= b & 1;
+                break;
+        case 0xa3:
+              bt:               /* bt */
+                src.val &= (dst.bytes << 3) - 1; /* only subword offset */
+                emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
+                break;
+        case 0xab:
+              bts:              /* bts */
+                src.val &= (dst.bytes << 3) - 1; /* only subword offset */
+                emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
                 break;
         case 0xb0 ... 0xb1:     /* cmpxchg */
                 /*
@@ -1273,8 +1462,6 @@ twobyte_insn:
                 src.orig_val = src.val;
                 src.val = _regs[VCPU_REGS_RAX];
                 emulate_2op_SrcV("cmp", src, dst, _eflags);
-                /* Always write back. The question is: where to? */
-                d |= Mov;
                 if (_eflags & EFLG_ZF) {
                         /* Success: write back to memory. */
                         dst.val = src.orig_val;
@@ -1284,30 +1471,15 @@ twobyte_insn:
                         dst.ptr = (unsigned long *)&_regs[VCPU_REGS_RAX];
                 }
                 break;
-        case 0xa3:
-              bt:               /* bt */
-                src.val &= (dst.bytes << 3) - 1; /* only subword offset */
-                emulate_2op_SrcV_nobyte("bt", src, dst, _eflags);
-                break;
         case 0xb3:
               btr:              /* btr */
                 src.val &= (dst.bytes << 3) - 1; /* only subword offset */
                 emulate_2op_SrcV_nobyte("btr", src, dst, _eflags);
                 break;
-        case 0xab:
-              bts:              /* bts */
-                src.val &= (dst.bytes << 3) - 1; /* only subword offset */
-                emulate_2op_SrcV_nobyte("bts", src, dst, _eflags);
-                break;
         case 0xb6 ... 0xb7:     /* movzx */
                 dst.bytes = op_bytes;
                 dst.val = (d & ByteOp) ? (u8) src.val : (u16) src.val;
                 break;
-        case 0xbb:
-              btc:              /* btc */
-                src.val &= (dst.bytes << 3) - 1; /* only subword offset */
-                emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
-                break;
         case 0xba:              /* Grp8 */
                 switch (modrm_reg & 3) {
                 case 0:
@@ -1320,6 +1492,11 @@ twobyte_insn:
                         goto btc;
                 }
                 break;
+        case 0xbb:
+              btc:              /* btc */
+                src.val &= (dst.bytes << 3) - 1; /* only subword offset */
+                emulate_2op_SrcV_nobyte("btc", src, dst, _eflags);
+                break;
         case 0xbe ... 0xbf:     /* movsx */
                 dst.bytes = op_bytes;
                 dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
@@ -1331,14 +1508,14 @@ twobyte_special_insn:
         /* Disable writeback. */
         no_wb = 1;
         switch (b) {
+        case 0x06:
+                emulate_clts(ctxt->vcpu);
+                break;
         case 0x09:              /* wbinvd */
                 break;
         case 0x0d:              /* GrpP (prefetch) */
         case 0x18:              /* Grp16 (prefetch/nop) */
                 break;
-        case 0x06:
-                emulate_clts(ctxt->vcpu);
-                break;
         case 0x20: /* mov cr, reg */
                 if (modrm_mod != 3)
                         goto cannot_emulate;
@@ -1355,7 +1532,7 @@ twobyte_special_insn:
                         | ((u64)_regs[VCPU_REGS_RDX] << 32);
                 rc = kvm_set_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], msr_data);
                 if (rc) {
-                        kvm_arch_ops->inject_gp(ctxt->vcpu, 0);
+                        kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
                         _eip = ctxt->vcpu->rip;
                 }
                 rc = X86EMUL_CONTINUE;
@@ -1364,7 +1541,7 @@ twobyte_special_insn:
                 /* rdmsr */
                 rc = kvm_get_msr(ctxt->vcpu, _regs[VCPU_REGS_RCX], &msr_data);
                 if (rc) {
-                        kvm_arch_ops->inject_gp(ctxt->vcpu, 0);
+                        kvm_x86_ops->inject_gp(ctxt->vcpu, 0);
                         _eip = ctxt->vcpu->rip;
                 } else {
                         _regs[VCPU_REGS_RAX] = (u32)msr_data;
@@ -1372,10 +1549,32 @@ twobyte_special_insn:
                 }
                 rc = X86EMUL_CONTINUE;
                 break;
+        case 0x80 ... 0x8f: /* jnz rel, etc*/ {
+                long int rel;
+
+                switch (op_bytes) {
+                case 2:
+                        rel = insn_fetch(s16, 2, _eip);
+                        break;
+                case 4:
+                        rel = insn_fetch(s32, 4, _eip);
+                        break;
+                case 8:
+                        rel = insn_fetch(s64, 8, _eip);
+                        break;
+                default:
+                        DPRINTF("jnz: Invalid op_bytes\n");
+                        goto cannot_emulate;
+                }
+                if (test_cc(b, _eflags))
+                        JMP_REL(rel);
+                break;
+        }
         case 0xc7:              /* Grp9 (cmpxchg8b) */
                 {
                         u64 old, new;
-                        if ((rc = ops->read_emulated(cr2, &old, 8, ctxt)) != 0)
+                        if ((rc = ops->read_emulated(cr2, &old, 8, ctxt->vcpu))
+                                                                        != 0)
                                 goto done;
                         if (((u32) (old >> 0) != (u32) _regs[VCPU_REGS_RAX]) ||
                             ((u32) (old >> 32) != (u32) _regs[VCPU_REGS_RDX])) {
@@ -1386,7 +1585,7 @@ twobyte_special_insn:
                                 new = ((u64)_regs[VCPU_REGS_RCX] << 32)
                                         | (u32) _regs[VCPU_REGS_RBX];
                                 if ((rc = ops->cmpxchg_emulated(cr2, &old,
-                                                          &new, 8, ctxt)) != 0)
+                                                          &new, 8, ctxt->vcpu)) != 0)
                                         goto done;
                                 _eflags |= EFLG_ZF;
                         }
diff --git a/drivers/kvm/x86_emulate.h b/drivers/kvm/x86_emulate.h
index ea3407d7feee..92c73aa7f9ac 100644
--- a/drivers/kvm/x86_emulate.h
+++ b/drivers/kvm/x86_emulate.h
@@ -60,7 +60,7 @@ struct x86_emulate_ops {
          *  @bytes: [IN ] Number of bytes to read from memory.
          */
         int (*read_std)(unsigned long addr, void *val,
-                        unsigned int bytes, struct x86_emulate_ctxt * ctxt);
+                        unsigned int bytes, struct kvm_vcpu *vcpu);
 
         /*
          * write_std: Write bytes of standard (non-emulated/special) memory.
@@ -71,7 +71,7 @@ struct x86_emulate_ops {
          *  @bytes: [IN ] Number of bytes to write to memory.
          */
         int (*write_std)(unsigned long addr, const void *val,
-                         unsigned int bytes, struct x86_emulate_ctxt * ctxt);
+                         unsigned int bytes, struct kvm_vcpu *vcpu);
 
         /*
          * read_emulated: Read bytes from emulated/special memory area.
@@ -82,7 +82,7 @@ struct x86_emulate_ops {
         int (*read_emulated) (unsigned long addr,
                               void *val,
                               unsigned int bytes,
-                              struct x86_emulate_ctxt * ctxt);
+                              struct kvm_vcpu *vcpu);
 
         /*
          * write_emulated: Read bytes from emulated/special memory area.
@@ -94,7 +94,7 @@ struct x86_emulate_ops {
         int (*write_emulated) (unsigned long addr,
                                const void *val,
                                unsigned int bytes,
-                               struct x86_emulate_ctxt * ctxt);
+                               struct kvm_vcpu *vcpu);
 
         /*
          * cmpxchg_emulated: Emulate an atomic (LOCKed) CMPXCHG operation on an
@@ -108,12 +108,10 @@ struct x86_emulate_ops {
                                  const void *old,
                                  const void *new,
                                  unsigned int bytes,
-                                 struct x86_emulate_ctxt * ctxt);
+                                 struct kvm_vcpu *vcpu);
 
 };
 
-struct cpu_user_regs;
-
 struct x86_emulate_ctxt {
         /* Register state before/after emulation. */
         struct kvm_vcpu *vcpu;
@@ -154,12 +152,4 @@ struct x86_emulate_ctxt {
 int x86_emulate_memop(struct x86_emulate_ctxt *ctxt,
                       struct x86_emulate_ops *ops);
 
-/*
- * Given the 'reg' portion of a ModRM byte, and a register block, return a
- * pointer into the block that addresses the relevant register.
- * @highbyte_regs specifies whether to decode AH,CH,DH,BH.
- */
-void *decode_register(u8 modrm_reg, unsigned long *regs,
-                      int highbyte_regs);
-
 #endif                          /* __X86_EMULATE_H__ */
diff --git a/drivers/md/dm-emc.c b/drivers/md/dm-emc.c
index a2191a4fcf77..342517261ece 100644
--- a/drivers/md/dm-emc.c
+++ b/drivers/md/dm-emc.c
@@ -54,8 +54,6 @@ static void emc_endio(struct bio *bio, int error)
 
         /* request is freed in block layer */
         free_bio(bio);
-
-        return 0;
 }
 
 static struct bio *get_failover_bio(struct dm_path *path, unsigned data_size)
diff --git a/drivers/media/video/videobuf-core.c b/drivers/media/video/videobuf-core.c
index c606332512b6..5599a36490fc 100644
--- a/drivers/media/video/videobuf-core.c
+++ b/drivers/media/video/videobuf-core.c
@@ -674,7 +674,7 @@ ssize_t videobuf_read_one(struct videobuf_queue *q,
         }
 
         /* Copy to userspace */
-        retval=CALL(q,copy_to_user,q,data,count,nonblocking);
+        retval=CALL(q,video_copy_to_user,q,data,count,nonblocking);
         if (retval<0)
                 goto done;
 
diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
index 8bb7fdd306d6..3eb6123227b2 100644
--- a/drivers/media/video/videobuf-dma-sg.c
+++ b/drivers/media/video/videobuf-dma-sg.c
@@ -670,7 +670,7 @@ static struct videobuf_qtype_ops pci_ops = {
         .sync         = __videobuf_sync,
         .mmap_free    = __videobuf_mmap_free,
         .mmap_mapper  = __videobuf_mmap_mapper,
-        .copy_to_user = __videobuf_copy_to_user,
+        .video_copy_to_user = __videobuf_copy_to_user,
         .copy_stream  = __videobuf_copy_stream,
 };
 
diff --git a/drivers/media/video/videobuf-vmalloc.c b/drivers/media/video/videobuf-vmalloc.c
index 2e3689a12a28..cd74341c984f 100644
--- a/drivers/media/video/videobuf-vmalloc.c
+++ b/drivers/media/video/videobuf-vmalloc.c
@@ -320,7 +320,7 @@ static struct videobuf_qtype_ops qops = {
         .sync         = __videobuf_sync,
         .mmap_free    = __videobuf_mmap_free,
         .mmap_mapper  = __videobuf_mmap_mapper,
-        .copy_to_user = __videobuf_copy_to_user,
+        .video_copy_to_user = __videobuf_copy_to_user,
         .copy_stream  = __videobuf_copy_stream,
 };
 
diff --git a/drivers/mtd/Kconfig b/drivers/mtd/Kconfig
index fbec8cd55e38..8848e8ac705d 100644
--- a/drivers/mtd/Kconfig
+++ b/drivers/mtd/Kconfig
@@ -278,6 +278,14 @@ config SSFDC
           This enables read only access to SmartMedia formatted NAND
           flash. You can mount it with FAT file system.
 
+config MTD_OOPS
+        tristate "Log panic/oops to an MTD buffer"
+        depends on MTD
+        help
+          This enables panic and oops messages to be logged to a circular
+          buffer in a flash partition where it can be read back at some
+          later point.
+
 source "drivers/mtd/chips/Kconfig"
 
 source "drivers/mtd/maps/Kconfig"
diff --git a/drivers/mtd/Makefile b/drivers/mtd/Makefile
index 6d958a4566ff..7f0b04b4caa7 100644
--- a/drivers/mtd/Makefile
+++ b/drivers/mtd/Makefile
@@ -22,6 +22,7 @@ obj-$(CONFIG_NFTL)		+= nftl.o
 obj-$(CONFIG_INFTL)             += inftl.o
 obj-$(CONFIG_RFD_FTL)           += rfd_ftl.o
 obj-$(CONFIG_SSFDC)             += ssfdc.o
+obj-$(CONFIG_MTD_OOPS)          += mtdoops.o
 
 nftl-objs               := nftlcore.o nftlmount.o
 inftl-objs              := inftlcore.o inftlmount.o
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 2f19fa78d24a..3aa3dca56ae6 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -526,7 +526,7 @@ static int cfi_intelext_partition_fixup(struct mtd_info *mtd,
         struct cfi_pri_intelext *extp = cfi->cmdset_priv;
 
         /*
-         * Probing of multi-partition flash ships.
+         * Probing of multi-partition flash chips.
          *
          * To support multiple partitions when available, we simply arrange
          * for each of them to have their own flchip structure even if they
@@ -653,7 +653,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
  resettime:
         timeo = jiffies + HZ;
  retry:
-        if (chip->priv && (mode == FL_WRITING || mode == FL_ERASING || mode == FL_OTP_WRITE)) {
+        if (chip->priv && (mode == FL_WRITING || mode == FL_ERASING || mode == FL_OTP_WRITE || mode == FL_SHUTDOWN)) {
                 /*
                  * OK. We have possibility for contension on the write/erase
                  * operations which are global to the real chip and not per
@@ -798,6 +798,9 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
                 if (mode == FL_READY && chip->oldstate == FL_READY)
                         return 0;
 
+        case FL_SHUTDOWN:
+                /* The machine is rebooting now,so no one can get chip anymore */
+                return -EIO;
         default:
         sleep:
                 set_current_state(TASK_UNINTERRUPTIBLE);
@@ -1166,28 +1169,34 @@ static int cfi_intelext_point (struct mtd_info *mtd, loff_t from, size_t len, si
 {
         struct map_info *map = mtd->priv;
         struct cfi_private *cfi = map->fldrv_priv;
-        unsigned long ofs;
+        unsigned long ofs, last_end = 0;
         int chipnum;
         int ret = 0;
 
         if (!map->virt || (from + len > mtd->size))
                 return -EINVAL;
 
-        *mtdbuf = (void *)map->virt + from;
-        *retlen = 0;
-
         /* Now lock the chip(s) to POINT state */
 
         /* ofs: offset within the first chip that the first read should start */
         chipnum = (from >> cfi->chipshift);
         ofs = from - (chipnum << cfi->chipshift);
 
+        *mtdbuf = (void *)map->virt + cfi->chips[chipnum].start + ofs;
+        *retlen = 0;
+
         while (len) {
                 unsigned long thislen;
 
                 if (chipnum >= cfi->numchips)
                         break;
 
+                /* We cannot point across chips that are virtually disjoint */
+                if (!last_end)
+                        last_end = cfi->chips[chipnum].start;
+                else if (cfi->chips[chipnum].start != last_end)
+                        break;
+
                 if ((len + ofs -1) >> cfi->chipshift)
                         thislen = (1<<cfi->chipshift) - ofs;
                 else
@@ -1201,6 +1210,7 @@ static int cfi_intelext_point (struct mtd_info *mtd, loff_t from, size_t len, si
                 len -= thislen;
 
                 ofs = 0;
+                last_end += 1 << cfi->chipshift;
                 chipnum++;
         }
         return 0;
@@ -1780,7 +1790,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
         return ret;
 }
 
-int cfi_intelext_erase_varsize(struct mtd_info *mtd, struct erase_info *instr)
+static int cfi_intelext_erase_varsize(struct mtd_info *mtd, struct erase_info *instr)
 {
         unsigned long ofs, len;
         int ret;
@@ -1930,7 +1940,7 @@ static int cfi_intelext_lock(struct mtd_info *mtd, loff_t ofs, size_t len)
         printk(KERN_DEBUG "%s: lock status before, ofs=0x%08llx, len=0x%08X\n",
                __FUNCTION__, ofs, len);
         cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
-                ofs, len, 0);
+                ofs, len, NULL);
 #endif
 
         ret = cfi_varsize_frob(mtd, do_xxlock_oneblock,
@@ -1940,7 +1950,7 @@ static int cfi_intelext_lock(struct mtd_info *mtd, loff_t ofs, size_t len)
         printk(KERN_DEBUG "%s: lock status after, ret=%d\n",
                __FUNCTION__, ret);
         cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
-                ofs, len, 0);
+                ofs, len, NULL);
 #endif
 
         return ret;
@@ -1954,7 +1964,7 @@ static int cfi_intelext_unlock(struct mtd_info *mtd, loff_t ofs, size_t len)
         printk(KERN_DEBUG "%s: lock status before, ofs=0x%08llx, len=0x%08X\n",
                __FUNCTION__, ofs, len);
         cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
-                ofs, len, 0);
+                ofs, len, NULL);
 #endif
 
         ret = cfi_varsize_frob(mtd, do_xxlock_oneblock,
@@ -1964,7 +1974,7 @@ static int cfi_intelext_unlock(struct mtd_info *mtd, loff_t ofs, size_t len)
         printk(KERN_DEBUG "%s: lock status after, ret=%d\n",
                __FUNCTION__, ret);
         cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
-                ofs, len, 0);
+                ofs, len, NULL);
 #endif
 
         return ret;
@@ -2255,7 +2265,7 @@ static void cfi_intelext_save_locks(struct mtd_info *mtd)
                         adr = region->offset + block * len;
 
                         status = cfi_varsize_frob(mtd,
-                                        do_getlockstatus_oneblock, adr, len, 0);
+                                        do_getlockstatus_oneblock, adr, len, NULL);
                         if (status)
                                 set_bit(block, region->lockmap);
                         else
@@ -2402,10 +2412,10 @@ static int cfi_intelext_reset(struct mtd_info *mtd)
                    and switch to array mode so any bootloader in
                    flash is accessible for soft reboot. */
                 spin_lock(chip->mutex);
-                ret = get_chip(map, chip, chip->start, FL_SYNCING);
+                ret = get_chip(map, chip, chip->start, FL_SHUTDOWN);
                 if (!ret) {
                         map_write(map, CMD(0xff), chip->start);
-                        chip->state = FL_READY;
+                        chip->state = FL_SHUTDOWN;
                 }
                 spin_unlock(chip->mutex);
         }
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 1f6445840461..389acc600f5e 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -1609,7 +1609,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
 }
 
 
-int cfi_amdstd_erase_varsize(struct mtd_info *mtd, struct erase_info *instr)
+static int cfi_amdstd_erase_varsize(struct mtd_info *mtd, struct erase_info *instr)
 {
         unsigned long ofs, len;
         int ret;
diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c
index 58e561e87699..a67b23b87fc0 100644
--- a/drivers/mtd/chips/jedec_probe.c
+++ b/drivers/mtd/chips/jedec_probe.c
@@ -17,7 +17,6 @@
 #include <linux/errno.h>
 #include <linux/slab.h>
 #include <linux/interrupt.h>
-#include <linux/init.h>
 
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/map.h>
@@ -70,6 +69,7 @@
 
 /* Fujitsu */
 #define MBM29F040C      0x00A4
+#define MBM29F800BA     0x2258
 #define MBM29LV650UE    0x22D7
 #define MBM29LV320TE    0x22F6
 #define MBM29LV320BE    0x22F9
@@ -129,6 +129,7 @@
 #define LH28F640BF      0x00b0
 
 /* ST - www.st.com */
+#define M29F800AB       0x0058
 #define M29W800DT       0x00D7
 #define M29W800DB       0x005B
 #define M29W160DT       0x22C4
@@ -646,6 +647,23 @@ static const struct amd_flash_info jedec_table[] = {
                 }
         }, {
                 .mfr_id         = MANUFACTURER_FUJITSU,
+                .dev_id         = MBM29F800BA,
+                .name           = "Fujitsu MBM29F800BA",
+                .uaddr          = {
+                        [0] = MTD_UADDR_0x0AAA_0x0555,  /* x8 */
+                        [1] = MTD_UADDR_0x0555_0x02AA,  /* x16 */
+                },
+                .DevSize        = SIZE_1MiB,
+                .CmdSet         = P_ID_AMD_STD,
+                .NumEraseRegions= 4,
+                .regions        = {
+                        ERASEINFO(0x04000,1),
+                        ERASEINFO(0x02000,2),
+                        ERASEINFO(0x08000,1),
+                        ERASEINFO(0x10000,15),
+                }
+        }, {
+                .mfr_id         = MANUFACTURER_FUJITSU,
                 .dev_id         = MBM29LV650UE,
                 .name           = "Fujitsu MBM29LV650UE",
                 .uaddr          = {
@@ -1510,6 +1528,23 @@ static const struct amd_flash_info jedec_table[] = {
                        ERASEINFO(0x1000,256)
                }
 
+        }, {
+                .mfr_id         = MANUFACTURER_ST,
+                .dev_id         = M29F800AB,
+                .name           = "ST M29F800AB",
+                .uaddr          = {
+                        [0] = MTD_UADDR_0x0AAA_0x0555,  /* x8 */
+                        [1] = MTD_UADDR_0x0555_0x02AA,  /* x16 */
+                },
+                .DevSize        = SIZE_1MiB,
+                .CmdSet         = P_ID_AMD_STD,
+                .NumEraseRegions= 4,
+                .regions        = {
+                        ERASEINFO(0x04000,1),
+                        ERASEINFO(0x02000,2),
+                        ERASEINFO(0x08000,1),
+                        ERASEINFO(0x10000,15),
+                }
        }, {
                 .mfr_id         = MANUFACTURER_ST,      /* FIXME - CFI device? */
                 .dev_id         = M29W800DT,
diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig
index ff642f8fbee7..811d56fd890f 100644
--- a/drivers/mtd/devices/Kconfig
+++ b/drivers/mtd/devices/Kconfig
@@ -60,21 +60,22 @@ config MTD_DATAFLASH
           Sometimes DataFlash chips are packaged inside MMC-format
           cards; at this writing, the MMC stack won't handle those.
 
-config MTD_DATAFLASH26
-        tristate "AT91RM9200 DataFlash AT26xxx"
-        depends on MTD && ARCH_AT91RM9200 && AT91_SPI
-        help
-          This enables access to the DataFlash chip (AT26xxx) on an
-          AT91RM9200-based board.
-          If you have such a board and such a DataFlash, say 'Y'.
-
 config MTD_M25P80
-        tristate "Support for M25 SPI Flash"
+        tristate "Support most SPI Flash chips (AT26DF, M25P, W25X, ...)"
         depends on SPI_MASTER && EXPERIMENTAL
         help
-          This enables access to ST M25P80 and similar SPI flash chips,
-          used for program and data storage.  Set up your spi devices
-          with the right board-specific platform data.
+          This enables access to most modern SPI flash chips, used for
+          program and data storage.   Series supported include Atmel AT26DF,
+          Spansion S25SL, SST 25VF, ST M25P, and Winbond W25X.  Other chips
+          are supported as well.  See the driver source for the current list,
+          or to add other chips.
+
+          Note that the original DataFlash chips (AT45 series, not AT26DF),
+          need an entirely different driver.
+
+          Set up your spi devices with the right board-specific platform data,
+          if you want to specify device partitioning or to use a device which
+          doesn't support the JEDEC ID instruction.
 
 config MTD_SLRAM
         tristate "Uncached system RAM"
diff --git a/drivers/mtd/devices/Makefile b/drivers/mtd/devices/Makefile
index 8ab568b3f533..0f788d5c4bf8 100644
--- a/drivers/mtd/devices/Makefile
+++ b/drivers/mtd/devices/Makefile
@@ -16,5 +16,4 @@ obj-$(CONFIG_MTD_MTDRAM)	+= mtdram.o
 obj-$(CONFIG_MTD_LART)          += lart.o
 obj-$(CONFIG_MTD_BLOCK2MTD)     += block2mtd.o
 obj-$(CONFIG_MTD_DATAFLASH)     += mtd_dataflash.o
-obj-$(CONFIG_MTD_DATAFLASH26)   += at91_dataflash26.o
 obj-$(CONFIG_MTD_M25P80)        += m25p80.o
diff --git a/drivers/mtd/devices/at91_dataflash26.c b/drivers/mtd/devices/at91_dataflash26.c
deleted file mode 100644
index 64ce37f986fc..000000000000
--- a/drivers/mtd/devices/at91_dataflash26.c
+++ /dev/null
@@ -1,485 +0,0 @@
-/*
- * Atmel DataFlash driver for Atmel AT91RM9200 (Thunder)
- * This is a largely modified version of at91_dataflash.c that
- * supports AT26xxx dataflash chips. The original driver supports
- * AT45xxx chips.
- *
- * Note: This driver was only tested with an AT26F004. It should be
- * easy to make it work with other AT26xxx dataflash devices, though.
- *
- * Copyright (C) 2007 Hans J. Koch <hjk@linutronix.de>
- * original Copyright (C) SAN People (Pty) Ltd
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * version 2 as published by the Free Software Foundation.
-*/
-
-#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/mtd/mtd.h>
-
-#include <asm/arch/at91_spi.h>
-
-#define DATAFLASH_MAX_DEVICES   4       /* max number of dataflash devices */
-
-#define MANUFACTURER_ID_ATMEL           0x1F
-
-/* command codes */
-
-#define AT26_OP_READ_STATUS             0x05
-#define AT26_OP_READ_DEV_ID             0x9F
-#define AT26_OP_ERASE_PAGE_4K           0x20
-#define AT26_OP_READ_ARRAY_FAST         0x0B
-#define AT26_OP_SEQUENTIAL_WRITE        0xAF
-#define AT26_OP_WRITE_ENABLE            0x06
-#define AT26_OP_WRITE_DISABLE           0x04
-#define AT26_OP_SECTOR_PROTECT          0x36
-#define AT26_OP_SECTOR_UNPROTECT        0x39
-
-/* status register bits */
-
-#define AT26_STATUS_BUSY                0x01
-#define AT26_STATUS_WRITE_ENABLE        0x02
-
-struct dataflash_local
-{
-        int spi;                        /* SPI chip-select number */
-        unsigned int page_size;         /* number of bytes per page */
-};
-
-
-/* Detected DataFlash devices */
-static struct mtd_info* mtd_devices[DATAFLASH_MAX_DEVICES];
-static int nr_devices = 0;
-
-/* Allocate a single SPI transfer descriptor.  We're assuming that if multiple
-   SPI transfers occur at the same time, spi_access_bus() will serialize them.
-   If this is not valid, then either (i) each dataflash 'priv' structure
-   needs it's own transfer descriptor, (ii) we lock this one, or (iii) use
-   another mechanism.   */
-static struct spi_transfer_list* spi_transfer_desc;
-
-/*
- * Perform a SPI transfer to access the DataFlash device.
- */
-static int do_spi_transfer(int nr, char* tx, int tx_len, char* rx, int rx_len,
-                char* txnext, int txnext_len, char* rxnext, int rxnext_len)
-{
-        struct spi_transfer_list* list = spi_transfer_desc;
-
-        list->tx[0] = tx;       list->txlen[0] = tx_len;
-        list->rx[0] = rx;       list->rxlen[0] = rx_len;
-
-        list->tx[1] = txnext;   list->txlen[1] = txnext_len;
-        list->rx[1] = rxnext;   list->rxlen[1] = rxnext_len;
-
-        list->nr_transfers = nr;
-        /* Note: spi_transfer() always returns 0, there are no error checks */
-        return spi_transfer(list);
-}
-
-/*
- * Return the status of the DataFlash device.
- */
-static unsigned char at91_dataflash26_status(void)
-{
-        unsigned char command[2];
-
-        command[0] = AT26_OP_READ_STATUS;
-        command[1] = 0;
-
-        do_spi_transfer(1, command, 2, command, 2, NULL, 0, NULL, 0);
-
-        return command[1];
-}
-
-/*
- * Poll the DataFlash device until it is READY.
- */
-static unsigned char at91_dataflash26_waitready(void)
-{
-        unsigned char status;
-
-        while (1) {
-                status = at91_dataflash26_status();
-                if (!(status & AT26_STATUS_BUSY))
-                        return status;
-        }
-}
-
-/*
- * Enable/disable write access
- */
- static void at91_dataflash26_write_enable(int enable)
-{
-        unsigned char cmd[2];
-
-        DEBUG(MTD_DEBUG_LEVEL3, "write_enable: enable=%i\n", enable);
-
-        if (enable)
-                cmd[0] = AT26_OP_WRITE_ENABLE;
-        else
-                cmd[0] = AT26_OP_WRITE_DISABLE;
-        cmd[1] = 0;
-
-        do_spi_transfer(1, cmd, 2, cmd, 2, NULL, 0, NULL, 0);
-}
-
-/*
- * Protect/unprotect sector
- */
- static void at91_dataflash26_sector_protect(loff_t addr, int protect)
-{
-        unsigned char cmd[4];
-
-        DEBUG(MTD_DEBUG_LEVEL3, "sector_protect: addr=0x%06x prot=%d\n",
-               addr, protect);
-
-        if (protect)
-                cmd[0] = AT26_OP_SECTOR_PROTECT;
-        else
-                cmd[0] = AT26_OP_SECTOR_UNPROTECT;
-        cmd[1] = (addr & 0x00FF0000) >> 16;
-        cmd[2] = (addr & 0x0000FF00) >> 8;
-        cmd[3] = (addr & 0x000000FF);
-
-        do_spi_transfer(1, cmd, 4, cmd, 4, NULL, 0, NULL, 0);
-}
-
-/*
- * Erase blocks of flash.
- */
-static int at91_dataflash26_erase(struct mtd_info *mtd,
-                                  struct erase_info *instr)
-{
-        struct dataflash_local *priv = (struct dataflash_local *) mtd->priv;
-        unsigned char cmd[4];
-
-        DEBUG(MTD_DEBUG_LEVEL1, "dataflash_erase: addr=0x%06x len=%i\n",
-               instr->addr, instr->len);
-
-        /* Sanity checks */
-        if (priv->page_size != 4096)
-                return -EINVAL; /* Can't handle other sizes at the moment */
-
-        if (   ((instr->len % mtd->erasesize) != 0)
-            || ((instr->len % priv->page_size) != 0)
-            || ((instr->addr % priv->page_size) != 0)
-            || ((instr->addr + instr->len) > mtd->size))
-                return -EINVAL;
-
-        spi_access_bus(priv->spi);
-
-        while (instr->len > 0) {
-                at91_dataflash26_write_enable(1);
-                at91_dataflash26_sector_protect(instr->addr, 0);
-                at91_dataflash26_write_enable(1);
-                cmd[0] = AT26_OP_ERASE_PAGE_4K;
-                cmd[1] = (instr->addr & 0x00FF0000) >> 16;
-                cmd[2] = (instr->addr & 0x0000FF00) >> 8;
-                cmd[3] = (instr->addr & 0x000000FF);
-
-                DEBUG(MTD_DEBUG_LEVEL3, "ERASE: (0x%02x) 0x%02x 0x%02x"
-                                        "0x%02x\n",
-                        cmd[0], cmd[1], cmd[2], cmd[3]);
-
-                do_spi_transfer(1, cmd, 4, cmd, 4, NULL, 0, NULL, 0);
-                at91_dataflash26_waitready();
-
-                instr->addr += priv->page_size;  /* next page */
-                instr->len -= priv->page_size;
-        }
-
-        at91_dataflash26_write_enable(0);
-        spi_release_bus(priv->spi);
-
-        /* Inform MTD subsystem that erase is complete */
-        instr->state = MTD_ERASE_DONE;
-        if (instr->callback)
-                instr->callback(instr);
-
-        return 0;
-}
-
-/*
- * Read from the DataFlash device.
- *   from   : Start offset in flash device
- *   len    : Number of bytes to read
- *   retlen : Number of bytes actually read
- *   buf    : Buffer that will receive data
- */
-static int at91_dataflash26_read(struct mtd_info *mtd, loff_t from, size_t len,
-                                 size_t *retlen, u_char *buf)
-{
-        struct dataflash_local *priv = (struct dataflash_local *) mtd->priv;
-        unsigned char cmd[5];
-
-        DEBUG(MTD_DEBUG_LEVEL1, "dataflash_read: %lli .. %lli\n",
-              from, from+len);
-
-        *retlen = 0;
-
-        /* Sanity checks */
-        if (!len)
-                return 0;
-        if (from + len > mtd->size)
-                return -EINVAL;
-
-        cmd[0] = AT26_OP_READ_ARRAY_FAST;
-        cmd[1] = (from & 0x00FF0000) >> 16;
-        cmd[2] = (from & 0x0000FF00) >> 8;
-        cmd[3] = (from & 0x000000FF);
-        /* cmd[4] is a "Don't care" byte  */
-
-        DEBUG(MTD_DEBUG_LEVEL3, "READ: (0x%02x) 0x%02x 0x%02x 0x%02x\n",
-               cmd[0], cmd[1], cmd[2], cmd[3]);
-
-        spi_access_bus(priv->spi);
-        do_spi_transfer(2, cmd, 5, cmd, 5, buf, len, buf, len);
-        spi_release_bus(priv->spi);
-
-        *retlen = len;
-        return 0;
-}
-
-/*
- * Write to the DataFlash device.
- *   to     : Start offset in flash device
- *   len    : Number of bytes to write
- *   retlen : Number of bytes actually written
- *   buf    : Buffer containing the data
- */
-static int at91_dataflash26_write(struct mtd_info *mtd, loff_t to, size_t len,
-                                  size_t *retlen, const u_char *buf)
-{
-        struct dataflash_local *priv = (struct dataflash_local *) mtd->priv;
-        unsigned int addr, buf_index = 0;
-        int ret = -EIO, sector, last_sector;
-        unsigned char status, cmd[5];
-
-        DEBUG(MTD_DEBUG_LEVEL1, "dataflash_write: %lli .. %lli\n", to, to+len);
-
-        *retlen = 0;
-
-        /* Sanity checks */
-        if (!len)
-                return 0;
-        if (to + len > mtd->size)
-                return -EINVAL;
-
-        spi_access_bus(priv->spi);
-
-        addr = to;
-        last_sector = -1;
-
-        while (buf_index < len) {
-                sector = addr / priv->page_size;
-                /* Write first byte if a new sector begins */
-                if (sector != last_sector) {
-                        at91_dataflash26_write_enable(1);
-                        at91_dataflash26_sector_protect(addr, 0);
-                        at91_dataflash26_write_enable(1);
-
-                        /* Program first byte of a new sector */
-                        cmd[0] = AT26_OP_SEQUENTIAL_WRITE;
-                        cmd[1] = (addr & 0x00FF0000) >> 16;
-                        cmd[2] = (addr & 0x0000FF00) >> 8;
-                        cmd[3] = (addr & 0x000000FF);
-                        cmd[4] = buf[buf_index++];
-                        do_spi_transfer(1, cmd, 5, cmd, 5, NULL, 0, NULL, 0);
-                        status = at91_dataflash26_waitready();
-                        addr++;
-                        /* On write errors, the chip resets the write enable
-                           flag. This also happens after the last byte of a
-                           sector is successfully programmed. */
-                        if (   ( !(status & AT26_STATUS_WRITE_ENABLE))
-                            && ((addr % priv->page_size) != 0) ) {
-                                DEBUG(MTD_DEBUG_LEVEL1,
-                                        "write error1: addr=0x%06x, "
-                                        "status=0x%02x\n", addr, status);
-                                goto write_err;
-                        }
-                        (*retlen)++;
-                        last_sector = sector;
-                }
-
-                /* Write subsequent bytes in the same sector */
-                cmd[0] = AT26_OP_SEQUENTIAL_WRITE;
-                cmd[1] = buf[buf_index++];
-                do_spi_transfer(1, cmd, 2, cmd, 2, NULL, 0, NULL, 0);
-                status = at91_dataflash26_waitready();
-                addr++;
-
-                if (   ( !(status & AT26_STATUS_WRITE_ENABLE))
-                    && ((addr % priv->page_size) != 0) ) {
-                        DEBUG(MTD_DEBUG_LEVEL1, "write error2: addr=0x%06x, "
-                                "status=0x%02x\n", addr, status);
-                        goto write_err;
-                }
-
-                (*retlen)++;
-        }
-
-        ret = 0;
-        at91_dataflash26_write_enable(0);
-write_err:
-        spi_release_bus(priv->spi);
-        return ret;
-}
-
-/*
- * Initialize and register DataFlash device with MTD subsystem.
- */
-static int __init add_dataflash(int channel, char *name, int nr_pages,
-                                int pagesize)
-{
-        struct mtd_info *device;
-        struct dataflash_local *priv;
-
-        if (nr_devices >= DATAFLASH_MAX_DEVICES) {
-                printk(KERN_ERR "at91_dataflash26: Too many devices "
-                                "detected\n");
-                return 0;
-        }
-
-        device = kzalloc(sizeof(struct mtd_info) + strlen(name) + 8,
-                         GFP_KERNEL);
-        if (!device)
-                return -ENOMEM;
-
-        device->name = (char *)&device[1];
-        sprintf(device->name, "%s.spi%d", name, channel);
-        device->size = nr_pages * pagesize;
-        device->erasesize = pagesize;
-        device->owner = THIS_MODULE;
-        device->type = MTD_DATAFLASH;
-        device->flags = MTD_CAP_NORFLASH;
-        device->erase = at91_dataflash26_erase;
-        device->read = at91_dataflash26_read;
-        device->write = at91_dataflash26_write;
-
-        priv = (struct dataflash_local *)kzalloc(sizeof(struct dataflash_local),
-                GFP_KERNEL);
-        if (!priv) {
-                kfree(device);
-                return -ENOMEM;
-        }
-
-        priv->spi = channel;
-        priv->page_size = pagesize;
-        device->priv = priv;
-
-        mtd_devices[nr_devices] = device;
-        nr_devices++;
-        printk(KERN_INFO "at91_dataflash26: %s detected [spi%i] (%i bytes)\n",
-               name, channel, device->size);
-
-        return add_mtd_device(device);
-}
-
-/*
- * Detect and initialize DataFlash device connected to specified SPI channel.
- *
- */
-
-struct dataflash26_types {
-        unsigned char id0;
-        unsigned char id1;
-        char *name;
-        int pagesize;
-        int nr_pages;
-};
-
-struct dataflash26_types df26_types[] = {
-        {
-                .id0 = 0x04,
-                .id1 = 0x00,
-                .name = "AT26F004",
-                .pagesize = 4096,
-                .nr_pages = 128,
-        },
-        {
-                .id0 = 0x45,
-                .id1 = 0x01,
-                .name = "AT26DF081A", /* Not tested ! */
-                .pagesize = 4096,
-                .nr_pages = 256,
-        },
-};
-
-static int __init at91_dataflash26_detect(int channel)
-{
-        unsigned char status, cmd[5];
-        int i;
-
-        spi_access_bus(channel);
-        status = at91_dataflash26_status();
-
-        if (status == 0 || status == 0xff) {
-                printk(KERN_ERR "at91_dataflash26_detect: status error %d\n",
-                        status);
-                spi_release_bus(channel);
-                return -ENODEV;
-        }
-
-        cmd[0] = AT26_OP_READ_DEV_ID;
-        do_spi_transfer(1, cmd, 5, cmd, 5, NULL, 0, NULL, 0);
-        spi_release_bus(channel);
-
-        if (cmd[1] != MANUFACTURER_ID_ATMEL)
-                return -ENODEV;
-
-        for (i = 0; i < ARRAY_SIZE(df26_types); i++) {
-                if (   cmd[2] == df26_types[i].id0
-                    && cmd[3] == df26_types[i].id1)
-                        return add_dataflash(channel,
-                                                df26_types[i].name,
-                                                df26_types[i].nr_pages,
-                                                df26_types[i].pagesize);
-        }
-
-        printk(KERN_ERR "at91_dataflash26_detect: Unsupported device "
-                        "(0x%02x/0x%02x)\n", cmd[2], cmd[3]);
-        return -ENODEV;
-}
-
-static int __init at91_dataflash26_init(void)
-{
-        spi_transfer_desc = kmalloc(sizeof(struct spi_transfer_list),
-                                    GFP_KERNEL);
-        if (!spi_transfer_desc)
-                return -ENOMEM;
-
-        /* DataFlash (SPI chip select 0) */
-        at91_dataflash26_detect(0);
-
-#ifdef CONFIG_MTD_AT91_DATAFLASH_CARD
-        /* DataFlash card (SPI chip select 3) */
-        at91_dataflash26_detect(3);
-#endif
-        return 0;
-}
-
-static void __exit at91_dataflash26_exit(void)
-{
-        int i;
-
-        for (i = 0; i < DATAFLASH_MAX_DEVICES; i++) {
-                if (mtd_devices[i]) {
-                        del_mtd_device(mtd_devices[i]);
-                        kfree(mtd_devices[i]->priv);
-                        kfree(mtd_devices[i]);
-                }
-        }
-        nr_devices = 0;
-        kfree(spi_transfer_desc);
-}
-
-module_init(at91_dataflash26_init);
-module_exit(at91_dataflash26_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Hans J. Koch");
-MODULE_DESCRIPTION("DataFlash AT26xxx driver for Atmel AT91RM9200");
diff --git a/drivers/mtd/devices/docprobe.c b/drivers/mtd/devices/docprobe.c
index 54aa75907640..d8cc94ec4e50 100644
--- a/drivers/mtd/devices/docprobe.c
+++ b/drivers/mtd/devices/docprobe.c
@@ -81,9 +81,7 @@ static unsigned long __initdata doc_locations[] = {
 #endif /*  CONFIG_MTD_DOCPROBE_HIGH */
 #elif defined(__PPC__)
         0xe4000000,
-#elif defined(CONFIG_MOMENCO_OCELOT_G)
-        0xff000000,
-##else
+#else
 #warning Unknown architecture for DiskOnChip. No default probe locations defined
 #endif
         0xffffffff };
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 78c2511ae9e0..98df5bcc02f3 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -1,5 +1,5 @@
 /*
- * MTD SPI driver for ST M25Pxx flash chips
+ * MTD SPI driver for ST M25Pxx (and similar) serial flash chips
  *
  * Author: Mike Lavender, mike@steroidmicros.com
  *
@@ -19,33 +19,32 @@
 #include <linux/module.h>
 #include <linux/device.h>
 #include <linux/interrupt.h>
-#include <linux/interrupt.h>
+#include <linux/mutex.h>
+
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
+
 #include <linux/spi/spi.h>
 #include <linux/spi/flash.h>
 
-#include <asm/semaphore.h>
-
-
-/* NOTE: AT 25F and SST 25LF series are very similar,
- * but commands for sector erase and chip id differ...
- */
 
 #define FLASH_PAGESIZE          256
 
 /* Flash opcodes. */
-#define OPCODE_WREN             6       /* Write enable */
-#define OPCODE_RDSR             5       /* Read status register */
-#define OPCODE_READ             3       /* Read data bytes */
-#define OPCODE_PP               2       /* Page program */
-#define OPCODE_SE               0xd8    /* Sector erase */
-#define OPCODE_RES              0xab    /* Read Electronic Signature */
+#define OPCODE_WREN             0x06    /* Write enable */
+#define OPCODE_RDSR             0x05    /* Read status register */
+#define OPCODE_READ             0x03    /* Read data bytes (low frequency) */
+#define OPCODE_FAST_READ        0x0b    /* Read data bytes (high frequency) */
+#define OPCODE_PP               0x02    /* Page program (up to 256 bytes) */
+#define OPCODE_BE_4K            0x20    /* Erase 4KiB block */
+#define OPCODE_BE_32K           0x52    /* Erase 32KiB block */
+#define OPCODE_SE               0xd8    /* Sector erase (usually 64KiB) */
 #define OPCODE_RDID             0x9f    /* Read JEDEC ID */
 
 /* Status Register bits. */
 #define SR_WIP                  1       /* Write in progress */
 #define SR_WEL                  2       /* Write enable latch */
+/* meaning of other SR_* bits may differ between vendors */
 #define SR_BP0                  4       /* Block protect 0 */
 #define SR_BP1                  8       /* Block protect 1 */
 #define SR_BP2                  0x10    /* Block protect 2 */
@@ -65,9 +64,10 @@
 
 struct m25p {
         struct spi_device       *spi;
-        struct semaphore        lock;
+        struct mutex            lock;
         struct mtd_info         mtd;
-        unsigned                partitioned;
+        unsigned                partitioned:1;
+        u8                      erase_opcode;
         u8                      command[4];
 };
 
@@ -150,8 +150,9 @@ static int wait_till_ready(struct m25p *flash)
  */
 static int erase_sector(struct m25p *flash, u32 offset)
 {
-        DEBUG(MTD_DEBUG_LEVEL3, "%s: %s at 0x%08x\n", flash->spi->dev.bus_id,
-                        __FUNCTION__, offset);
+        DEBUG(MTD_DEBUG_LEVEL3, "%s: %s %dKiB at 0x%08x\n",
+                        flash->spi->dev.bus_id, __FUNCTION__,
+                        flash->mtd.erasesize / 1024, offset);
 
         /* Wait until finished previous write command. */
         if (wait_till_ready(flash))
@@ -161,7 +162,7 @@ static int erase_sector(struct m25p *flash, u32 offset)
         write_enable(flash);
 
         /* Set up command buffer. */
-        flash->command[0] = OPCODE_SE;
+        flash->command[0] = flash->erase_opcode;
         flash->command[1] = offset >> 16;
         flash->command[2] = offset >> 8;
         flash->command[3] = offset;
@@ -201,13 +202,17 @@ static int m25p80_erase(struct mtd_info *mtd, struct erase_info *instr)
         addr = instr->addr;
         len = instr->len;
 
-        down(&flash->lock);
+        mutex_lock(&flash->lock);
+
+        /* REVISIT in some cases we could speed up erasing large regions
+         * by using OPCODE_SE instead of OPCODE_BE_4K
+         */
 
         /* now erase those sectors */
         while (len) {
                 if (erase_sector(flash, addr)) {
                         instr->state = MTD_ERASE_FAILED;
-                        up(&flash->lock);
+                        mutex_unlock(&flash->lock);
                         return -EIO;
                 }
 
@@ -215,7 +220,7 @@ static int m25p80_erase(struct mtd_info *mtd, struct erase_info *instr)
                 len -= mtd->erasesize;
         }
 
-        up(&flash->lock);
+        mutex_unlock(&flash->lock);
 
         instr->state = MTD_ERASE_DONE;
         mtd_erase_callback(instr);
@@ -260,16 +265,19 @@ static int m25p80_read(struct mtd_info *mtd, loff_t from, size_t len,
         if (retlen)
                 *retlen = 0;
 
-        down(&flash->lock);
+        mutex_lock(&flash->lock);
 
         /* Wait till previous write/erase is done. */
         if (wait_till_ready(flash)) {
                 /* REVISIT status return?? */
-                up(&flash->lock);
+                mutex_unlock(&flash->lock);
                 return 1;
         }
 
-        /* NOTE:  OPCODE_FAST_READ (if available) is faster... */
+        /* FIXME switch to OPCODE_FAST_READ.  It's required for higher
+         * clocks; and at this writing, every chip this driver handles
+         * supports that opcode.
+         */
 
         /* Set up the write data buffer. */
         flash->command[0] = OPCODE_READ;
@@ -281,7 +289,7 @@ static int m25p80_read(struct mtd_info *mtd, loff_t from, size_t len,
 
         *retlen = m.actual_length - sizeof(flash->command);
 
-        up(&flash->lock);
+        mutex_unlock(&flash->lock);
 
         return 0;
 }
@@ -323,7 +331,7 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
         t[1].tx_buf = buf;
         spi_message_add_tail(&t[1], &m);
 
-        down(&flash->lock);
+        mutex_lock(&flash->lock);
 
         /* Wait until finished previous write command. */
         if (wait_till_ready(flash))
@@ -381,10 +389,10 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
                         if (retlen)
                                 *retlen += m.actual_length
                                         - sizeof(flash->command);
-                }
-        }
+                }
+        }
 
-        up(&flash->lock);
+        mutex_unlock(&flash->lock);
 
         return 0;
 }
@@ -398,24 +406,118 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
 
 struct flash_info {
         char            *name;
-        u8              id;
-        u16             jedec_id;
+
+        /* JEDEC id zero means "no ID" (most older chips); otherwise it has
+         * a high byte of zero plus three data bytes: the manufacturer id,
+         * then a two byte device id.
+         */
+        u32             jedec_id;
+
+        /* The size listed here is what works with OPCODE_SE, which isn't
+         * necessarily called a "sector" by the vendor.
+         */
         unsigned        sector_size;
-        unsigned        n_sectors;
+        u16             n_sectors;
+
+        u16             flags;
+#define SECT_4K         0x01            /* OPCODE_BE_4K works uniformly */
 };
 
+
+/* NOTE: double check command sets and memory organization when you add
+ * more flash chips.  This current list focusses on newer chips, which
+ * have been converging on command sets which including JEDEC ID.
+ */
 static struct flash_info __devinitdata m25p_data [] = {
-        /* REVISIT: fill in JEDEC ids, for parts that have them */
-        { "m25p05", 0x05, 0x2010, 32 * 1024, 2 },
-        { "m25p10", 0x10, 0x2011, 32 * 1024, 4 },
-        { "m25p20", 0x11, 0x2012, 64 * 1024, 4 },
-        { "m25p40", 0x12, 0x2013, 64 * 1024, 8 },
-        { "m25p80", 0x13, 0x0000, 64 * 1024, 16 },
-        { "m25p16", 0x14, 0x2015, 64 * 1024, 32 },
-        { "m25p32", 0x15, 0x2016, 64 * 1024, 64 },
-        { "m25p64", 0x16, 0x2017, 64 * 1024, 128 },
+
+        /* Atmel -- some are (confusingly) marketed as "DataFlash" */
+        { "at25fs010",  0x1f6601, 32 * 1024, 4, SECT_4K, },
+        { "at25fs040",  0x1f6604, 64 * 1024, 8, SECT_4K, },
+
+        { "at25df041a", 0x1f4401, 64 * 1024, 8, SECT_4K, },
+
+        { "at26f004",   0x1f0400, 64 * 1024, 8, SECT_4K, },
+        { "at26df081a", 0x1f4501, 64 * 1024, 16, SECT_4K, },
+        { "at26df161a", 0x1f4601, 64 * 1024, 32, SECT_4K, },
+        { "at26df321",  0x1f4701, 64 * 1024, 64, SECT_4K, },
+
+        /* Spansion -- single (large) sector size only, at least
+         * for the chips listed here (without boot sectors).
+         */
+        { "s25sl004a", 0x010212, 64 * 1024, 8, },
+        { "s25sl008a", 0x010213, 64 * 1024, 16, },
+        { "s25sl016a", 0x010214, 64 * 1024, 32, },
+        { "s25sl032a", 0x010215, 64 * 1024, 64, },
+        { "s25sl064a", 0x010216, 64 * 1024, 128, },
+
+        /* SST -- large erase sizes are "overlays", "sectors" are 4K */
+        { "sst25vf040b", 0xbf258d, 64 * 1024, 8, SECT_4K, },
+        { "sst25vf080b", 0xbf258e, 64 * 1024, 16, SECT_4K, },
+        { "sst25vf016b", 0xbf2541, 64 * 1024, 32, SECT_4K, },
+        { "sst25vf032b", 0xbf254a, 64 * 1024, 64, SECT_4K, },
+
+        /* ST Microelectronics -- newer production may have feature updates */
+        { "m25p05",  0x202010,  32 * 1024, 2, },
+        { "m25p10",  0x202011,  32 * 1024, 4, },
+        { "m25p20",  0x202012,  64 * 1024, 4, },
+        { "m25p40",  0x202013,  64 * 1024, 8, },
+        { "m25p80",         0,  64 * 1024, 16, },
+        { "m25p16",  0x202015,  64 * 1024, 32, },
+        { "m25p32",  0x202016,  64 * 1024, 64, },
+        { "m25p64",  0x202017,  64 * 1024, 128, },
+        { "m25p128", 0x202018, 256 * 1024, 64, },
+
+        { "m45pe80", 0x204014,  64 * 1024, 16, },
+        { "m45pe16", 0x204015,  64 * 1024, 32, },
+
+        { "m25pe80", 0x208014,  64 * 1024, 16, },
+        { "m25pe16", 0x208015,  64 * 1024, 32, SECT_4K, },
+
+        /* Winbond -- w25x "blocks" are 64K, "sectors" are 4KiB */
+        { "w25x10", 0xef3011, 64 * 1024, 2, SECT_4K, },
+        { "w25x20", 0xef3012, 64 * 1024, 4, SECT_4K, },
+        { "w25x40", 0xef3013, 64 * 1024, 8, SECT_4K, },
+        { "w25x80", 0xef3014, 64 * 1024, 16, SECT_4K, },
+        { "w25x16", 0xef3015, 64 * 1024, 32, SECT_4K, },
+        { "w25x32", 0xef3016, 64 * 1024, 64, SECT_4K, },
+        { "w25x64", 0xef3017, 64 * 1024, 128, SECT_4K, },
 };
 
+static struct flash_info *__devinit jedec_probe(struct spi_device *spi)
+{
+        int                     tmp;
+        u8                      code = OPCODE_RDID;
+        u8                      id[3];
+        u32                     jedec;
+        struct flash_info       *info;
+
+        /* JEDEC also defines an optional "extended device information"
+         * string for after vendor-specific data, after the three bytes
+         * we use here.  Supporting some chips might require using it.
+         */
+        tmp = spi_write_then_read(spi, &code, 1, id, 3);
+        if (tmp < 0) {
+                DEBUG(MTD_DEBUG_LEVEL0, "%s: error %d reading JEDEC ID\n",
+                        spi->dev.bus_id, tmp);
+                return NULL;
+        }
+        jedec = id[0];
+        jedec = jedec << 8;
+        jedec |= id[1];
+        jedec = jedec << 8;
+        jedec |= id[2];
+
+        for (tmp = 0, info = m25p_data;
+                        tmp < ARRAY_SIZE(m25p_data);
+                        tmp++, info++) {
+                if (info->jedec_id == jedec)
+                        return info;
+        }
+        dev_err(&spi->dev, "unrecognized JEDEC id %06x\n", jedec);
+        return NULL;
+}
+
+
 /*
  * board specific setup should have ensured the SPI clock used here
  * matches what the READ command supports, at least until this driver
@@ -429,37 +531,51 @@ static int __devinit m25p_probe(struct spi_device *spi)
         unsigned                        i;
 
         /* Platform data helps sort out which chip type we have, as
-         * well as how this board partitions it.
+         * well as how this board partitions it.  If we don't have
+         * a chip ID, try the JEDEC id commands; they'll work for most
+         * newer chips, even if we don't recognize the particular chip.
          */
         data = spi->dev.platform_data;
-        if (!data || !data->type) {
-                /* FIXME some chips can identify themselves with RES
-                 * or JEDEC get-id commands.  Try them ...
-                 */
-                DEBUG(MTD_DEBUG_LEVEL1, "%s: no chip id\n",
-                                spi->dev.bus_id);
-                return -ENODEV;
-        }
+        if (data && data->type) {
+                for (i = 0, info = m25p_data;
+                                i < ARRAY_SIZE(m25p_data);
+                                i++, info++) {
+                        if (strcmp(data->type, info->name) == 0)
+                                break;
+                }
 
-        for (i = 0, info = m25p_data; i < ARRAY_SIZE(m25p_data); i++, info++) {
-                if (strcmp(data->type, info->name) == 0)
-                        break;
-        }
-        if (i == ARRAY_SIZE(m25p_data)) {
-                DEBUG(MTD_DEBUG_LEVEL1, "%s: unrecognized id %s\n",
-                                spi->dev.bus_id, data->type);
+                /* unrecognized chip? */
+                if (i == ARRAY_SIZE(m25p_data)) {
+                        DEBUG(MTD_DEBUG_LEVEL0, "%s: unrecognized id %s\n",
+                                        spi->dev.bus_id, data->type);
+                        info = NULL;
+
+                /* recognized; is that chip really what's there? */
+                } else if (info->jedec_id) {
+                        struct flash_info       *chip = jedec_probe(spi);
+
+                        if (!chip || chip != info) {
+                                dev_warn(&spi->dev, "found %s, expected %s\n",
+                                                chip ? chip->name : "UNKNOWN",
+                                                info->name);
+                                info = NULL;
+                        }
+                }
+        } else
+                info = jedec_probe(spi);
+
+        if (!info)
                 return -ENODEV;
-        }
 
         flash = kzalloc(sizeof *flash, GFP_KERNEL);
         if (!flash)
                 return -ENOMEM;
 
         flash->spi = spi;
-        init_MUTEX(&flash->lock);
+        mutex_init(&flash->lock);
         dev_set_drvdata(&spi->dev, flash);
 
-        if (data->name)
+        if (data && data->name)
                 flash->mtd.name = data->name;
         else
                 flash->mtd.name = spi->dev.bus_id;
@@ -468,17 +584,25 @@ static int __devinit m25p_probe(struct spi_device *spi)
         flash->mtd.writesize = 1;
         flash->mtd.flags = MTD_CAP_NORFLASH;
         flash->mtd.size = info->sector_size * info->n_sectors;
-        flash->mtd.erasesize = info->sector_size;
         flash->mtd.erase = m25p80_erase;
         flash->mtd.read = m25p80_read;
         flash->mtd.write = m25p80_write;
 
+        /* prefer "small sector" erase if possible */
+        if (info->flags & SECT_4K) {
+                flash->erase_opcode = OPCODE_BE_4K;
+                flash->mtd.erasesize = 4096;
+        } else {
+                flash->erase_opcode = OPCODE_SE;
+                flash->mtd.erasesize = info->sector_size;
+        }
+
         dev_info(&spi->dev, "%s (%d Kbytes)\n", info->name,
                         flash->mtd.size / 1024);
 
         DEBUG(MTD_DEBUG_LEVEL2,
-                "mtd .name = %s, .size = 0x%.8x (%uM) "
-                        ".erasesize = 0x%.8x (%uK) .numeraseregions = %d\n",
+                "mtd .name = %s, .size = 0x%.8x (%uMiB) "
+                        ".erasesize = 0x%.8x (%uKiB) .numeraseregions = %d\n",
                 flash->mtd.name,
                 flash->mtd.size, flash->mtd.size / (1024*1024),
                 flash->mtd.erasesize, flash->mtd.erasesize / 1024,
@@ -488,7 +612,7 @@ static int __devinit m25p_probe(struct spi_device *spi)
                 for (i = 0; i < flash->mtd.numeraseregions; i++)
                         DEBUG(MTD_DEBUG_LEVEL2,
                                 "mtd.eraseregions[%d] = { .offset = 0x%.8x, "
-                                ".erasesize = 0x%.8x (%uK), "
+                                ".erasesize = 0x%.8x (%uKiB), "
                                 ".numblocks = %d }\n",
                                 i, flash->mtd.eraseregions[i].offset,
                                 flash->mtd.eraseregions[i].erasesize,
@@ -516,14 +640,14 @@ static int __devinit m25p_probe(struct spi_device *spi)
                 }
 
                 if (nr_parts > 0) {
-                        for (i = 0; i < data->nr_parts; i++) {
+                        for (i = 0; i < nr_parts; i++) {
                                 DEBUG(MTD_DEBUG_LEVEL2, "partitions[%d] = "
                                         "{.name = %s, .offset = 0x%.8x, "
-                                                ".size = 0x%.8x (%uK) }\n",
-                                        i, data->parts[i].name,
-                                        data->parts[i].offset,
-                                        data->parts[i].size,
-                                        data->parts[i].size / 1024);
+                                                ".size = 0x%.8x (%uKiB) }\n",
+                                        i, parts[i].name,
+                                        parts[i].offset,
+                                        parts[i].size,
+                                        parts[i].size / 1024);
                         }
                         flash->partitioned = 1;
                         return add_mtd_partitions(&flash->mtd, parts, nr_parts);
@@ -560,6 +684,11 @@ static struct spi_driver m25p80_driver = {
         },
         .probe  = m25p_probe,
         .remove = __devexit_p(m25p_remove),
+
+        /* REVISIT: many of these chips have deep power-down modes, which
+         * should clearly be entered on suspend() to minimize power use.
+         * And also when they're otherwise idle...
+         */
 };
 
 
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index a987e917f4e0..a5ed6d232c35 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -14,6 +14,7 @@
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/device.h>
+#include <linux/mutex.h>
 #include <linux/spi/spi.h>
 #include <linux/spi/flash.h>
 
@@ -89,7 +90,7 @@ struct dataflash {
         unsigned short          page_offset;    /* offset in flash address */
         unsigned int            page_size;      /* of bytes per page */
 
-        struct semaphore        lock;
+        struct mutex            lock;
         struct spi_device       *spi;
 
         struct mtd_info         mtd;
@@ -167,7 +168,7 @@ static int dataflash_erase(struct mtd_info *mtd, struct erase_info *instr)
         x.len = 4;
         spi_message_add_tail(&x, &msg);
 
-        down(&priv->lock);
+        mutex_lock(&priv->lock);
         while (instr->len > 0) {
                 unsigned int    pageaddr;
                 int             status;
@@ -210,7 +211,7 @@ static int dataflash_erase(struct mtd_info *mtd, struct erase_info *instr)
                         instr->len -= priv->page_size;
                 }
         }
-        up(&priv->lock);
+        mutex_unlock(&priv->lock);
 
         /* Inform MTD subsystem that erase is complete */
         instr->state = MTD_ERASE_DONE;
@@ -266,7 +267,7 @@ static int dataflash_read(struct mtd_info *mtd, loff_t from, size_t len,
         x[1].len = len;
         spi_message_add_tail(&x[1], &msg);
 
-        down(&priv->lock);
+        mutex_lock(&priv->lock);
 
         /* Continuous read, max clock = f(car) which may be less than
          * the peak rate available.  Some chips support commands with
@@ -279,7 +280,7 @@ static int dataflash_read(struct mtd_info *mtd, loff_t from, size_t len,
         /* plus 4 "don't care" bytes */
 
         status = spi_sync(priv->spi, &msg);
-        up(&priv->lock);
+        mutex_unlock(&priv->lock);
 
         if (status >= 0) {
                 *retlen = msg.actual_length - 8;
@@ -336,7 +337,7 @@ static int dataflash_write(struct mtd_info *mtd, loff_t to, size_t len,
         else
                 writelen = len;
 
-        down(&priv->lock);
+        mutex_lock(&priv->lock);
         while (remaining > 0) {
                 DEBUG(MTD_DEBUG_LEVEL3, "write @ %i:%i len=%i\n",
                         pageaddr, offset, writelen);
@@ -441,7 +442,7 @@ static int dataflash_write(struct mtd_info *mtd, loff_t to, size_t len,
                 else
                         writelen = remaining;
         }
-        up(&priv->lock);
+        mutex_unlock(&priv->lock);
 
         return status;
 }
@@ -463,7 +464,7 @@ add_dataflash(struct spi_device *spi, char *name,
         if (!priv)
                 return -ENOMEM;
 
-        init_MUTEX(&priv->lock);
+        mutex_init(&priv->lock);
         priv->spi = spi;
         priv->page_size = pagesize;
         priv->page_offset = pageoffset;
diff --git a/drivers/mtd/devices/pmc551.c b/drivers/mtd/devices/pmc551.c
index e8f686f7a357..7060a0895ce2 100644
--- a/drivers/mtd/devices/pmc551.c
+++ b/drivers/mtd/devices/pmc551.c
@@ -30,8 +30,8 @@
  *
  * Notes:
  *      Due to what I assume is more buggy SROM, the 64M PMC551 I
- *      have available claims that all 4 of it's DRAM banks have 64M
- *      of ram configured (making a grand total of 256M onboard).
+ *      have available claims that all 4 of its DRAM banks have 64MiB
+ *      of ram configured (making a grand total of 256MiB onboard).
  *      This is slightly annoying since the BAR0 size reflects the
  *      aperture size, not the dram size, and the V370PDC supplies no
  *      other method for memory size discovery.  This problem is
@@ -70,7 +70,7 @@
  *       made the memory unusable, added a fix to code to touch up
  *       the DRAM some.
  *
- * Bugs/FIXME's:
+ * Bugs/FIXMEs:
  *      * MUST fix the init function to not spin on a register
  *      waiting for it to set .. this does not safely handle busted
  *      devices that never reset the register correctly which will
@@ -562,10 +562,10 @@ static u32 fixup_pmc551(struct pci_dev *dev)
         /*
          * Some screen fun
          */
-        printk(KERN_DEBUG "pmc551: %d%c (0x%x) of %sprefetchable memory at "
+        printk(KERN_DEBUG "pmc551: %d%sB (0x%x) of %sprefetchable memory at "
                 "0x%llx\n", (size < 1024) ? size : (size < 1048576) ?
                 size >> 10 : size >> 20,
-                (size < 1024) ? 'B' : (size < 1048576) ? 'K' : 'M', size,
+                (size < 1024) ? "" : (size < 1048576) ? "Ki" : "Mi", size,
                 ((dcmd & (0x1 << 3)) == 0) ? "non-" : "",
                 (unsigned long long)pci_resource_start(dev, 0));
 
@@ -649,14 +649,10 @@ MODULE_DESCRIPTION(PMC551_VERSION);
  * Stuff these outside the ifdef so as to not bust compiled in driver support
  */
 static int msize = 0;
-#if defined(CONFIG_MTD_PMC551_APERTURE_SIZE)
-static int asize = CONFIG_MTD_PMC551_APERTURE_SIZE;
-#else
 static int asize = 0;
-#endif
 
 module_param(msize, int, 0);
-MODULE_PARM_DESC(msize, "memory size in Megabytes [1 - 1024]");
+MODULE_PARM_DESC(msize, "memory size in MiB [1 - 1024]");
 module_param(asize, int, 0);
 MODULE_PARM_DESC(asize, "aperture size, must be <= memsize [1-1024]");
 
@@ -799,8 +795,7 @@ static int __init init_pmc551(void)
                 mtd->owner = THIS_MODULE;
 
                 if (add_mtd_device(mtd)) {
-                        printk(KERN_NOTICE "pmc551: Failed to register new "
-                                "device\n");
+                        printk(KERN_NOTICE "pmc551: Failed to register new device\n");
                         pci_iounmap(PCI_Device, priv->start);
                         kfree(mtd->priv);
                         kfree(mtd);
@@ -811,13 +806,13 @@ static int __init init_pmc551(void)
                 pci_dev_get(PCI_Device);
 
                 printk(KERN_NOTICE "Registered pmc551 memory device.\n");
-                printk(KERN_NOTICE "Mapped %dM of memory from 0x%p to 0x%p\n",
+                printk(KERN_NOTICE "Mapped %dMiB of memory from 0x%p to 0x%p\n",
                         priv->asize >> 20,
                         priv->start, priv->start + priv->asize);
-                printk(KERN_NOTICE "Total memory is %d%c\n",
+                printk(KERN_NOTICE "Total memory is %d%sB\n",
                         (length < 1024) ? length :
                         (length < 1048576) ? length >> 10 : length >> 20,
-                        (length < 1024) ? 'B' : (length < 1048576) ? 'K' : 'M');
+                        (length < 1024) ? "" : (length < 1048576) ? "Ki" : "Mi");
                 priv->nextpmc551 = pmc551list;
                 pmc551list = mtd;
                 found++;
@@ -850,7 +845,7 @@ static void __exit cleanup_pmc551(void)
                 pmc551list = priv->nextpmc551;
 
                 if (priv->start) {
-                        printk(KERN_DEBUG "pmc551: unmapping %dM starting at "
+                        printk(KERN_DEBUG "pmc551: unmapping %dMiB starting at "
                                 "0x%p\n", priv->asize >> 20, priv->start);
                         pci_iounmap(priv->dev, priv->start);
                 }
diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
index ecac0e438f49..b8917beeb650 100644
--- a/drivers/mtd/inftlmount.c
+++ b/drivers/mtd/inftlmount.c
@@ -580,14 +580,13 @@ int INFTL_mount(struct INFTLrecord *s)
         logical_block = block = BLOCK_NIL;
 
         /* Temporary buffer to store ANAC numbers. */
-        ANACtable = kmalloc(s->nb_blocks * sizeof(u8), GFP_KERNEL);
+        ANACtable = kcalloc(s->nb_blocks, sizeof(u8), GFP_KERNEL);
         if (!ANACtable) {
                 printk(KERN_WARNING "INFTL: allocation of ANACtable "
                                 "failed (%zd bytes)\n",
                                 s->nb_blocks * sizeof(u8));
                 return -ENOMEM;
         }
-        memset(ANACtable, 0, s->nb_blocks);
 
         /*
          * First pass is to explore each physical unit, and construct the
diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig
index 6cd132c75187..2a2a125b0c76 100644
--- a/drivers/mtd/maps/Kconfig
+++ b/drivers/mtd/maps/Kconfig
@@ -163,20 +163,12 @@ config MTD_SBC_GXX
           More info at
           <http://www.arcomcontrols.com/products/icp/pc104/processors/SBC_GX1.htm>.
 
-config MTD_LUBBOCK
-        tristate "CFI Flash device mapped on Intel Lubbock XScale eval board"
-        depends on ARCH_LUBBOCK && MTD_CFI_INTELEXT && MTD_PARTITIONS
-        help
-          This provides a driver for the on-board flash of the Intel
-          'Lubbock' XScale evaluation board.
-
-config MTD_MAINSTONE
-        tristate "CFI Flash device mapped on Intel Mainstone XScale eval board"
-        depends on MACH_MAINSTONE && MTD_CFI_INTELEXT
+config MTD_PXA2XX
+        tristate "CFI Flash device mapped on Intel XScale PXA2xx based boards"
+        depends on (PXA25x || PXA27x) && MTD_CFI_INTELEXT
         select MTD_PARTITIONS
         help
-          This provides a driver for the on-board flash of the Intel
-          'Mainstone PXA27x evaluation board.
+          This provides a driver for the NOR flash attached to a PXA2xx chip.
 
 config MTD_OCTAGON
         tristate "JEDEC Flash device mapped on Octagon 5066 SBC"
@@ -354,7 +346,7 @@ config MTD_CFI_FLAGADM
 
 config MTD_WALNUT
         tristate "Flash device mapped on IBM 405GP Walnut"
-        depends on MTD_JEDECPROBE && WALNUT
+        depends on MTD_JEDECPROBE && WALNUT && !PPC_MERGE
         help
           This enables access routines for the flash chips on the IBM 405GP
           Walnut board. If you have one of these boards and would like to
@@ -370,7 +362,7 @@ config MTD_EBONY
 
 config MTD_OCOTEA
         tristate "Flash devices mapped on IBM 440GX Ocotea"
-        depends on MTD_CFI && OCOTEA
+        depends on MTD_CFI && OCOTEA && !PPC_MERGE
         help
           This enables access routines for the flash chips on the IBM 440GX
           Ocotea board. If you have one of these boards and would like to
@@ -384,22 +376,6 @@ config MTD_REDWOOD
           Redwood board. If you have one of these boards and would like to
           use the flash chips on it, say 'Y'.
 
-config MTD_TQM834x
-        tristate "Flash device mapped on TQ Components TQM834x Boards"
-        depends on MTD_CFI && TQM834x
-        help
-          This enables access routines for the flash chips on the
-          TQ Components TQM834x boards. If you have one of these boards
-          and would like to use the flash chips on it, say 'Y'.
-
-config MTD_OCELOT
-        tristate "Momenco Ocelot boot flash device"
-        depends on MOMENCO_OCELOT
-        help
-          This enables access routines for the boot flash device and for the
-          NVRAM on the Momenco Ocelot board. If you have one of these boards
-          and would like access to either of these, say 'Y'.
-
 config MTD_SOLUTIONENGINE
         tristate "CFI Flash device mapped on Hitachi SolutionEngine"
         depends on SUPERH && MTD_CFI && MTD_REDBOOT_PARTS
@@ -605,6 +581,13 @@ config MTD_SHARP_SL
         help
           This enables access to the flash chip on the Sharp SL Series of PDAs.
 
+config MTD_INTEL_VR_NOR
+        tristate "NOR flash on Intel Vermilion Range Expansion Bus CS0"
+        depends on PCI
+        help
+          Map driver for a NOR flash bank located on the Expansion Bus of the
+          Intel Vermilion Range chipset.
+
 config MTD_PLATRAM
         tristate "Map driver for platform device RAM (mtd-ram)"
         select MTD_RAM
diff --git a/drivers/mtd/maps/Makefile b/drivers/mtd/maps/Makefile
index 970b189271a2..316382a1401b 100644
--- a/drivers/mtd/maps/Makefile
+++ b/drivers/mtd/maps/Makefile
@@ -20,8 +20,7 @@ obj-$(CONFIG_MTD_ESB2ROM)	+= esb2rom.o
 obj-$(CONFIG_MTD_ICHXROM)       += ichxrom.o
 obj-$(CONFIG_MTD_CK804XROM)     += ck804xrom.o
 obj-$(CONFIG_MTD_TSUNAMI)       += tsunami_flash.o
-obj-$(CONFIG_MTD_LUBBOCK)       += lubbock-flash.o
-obj-$(CONFIG_MTD_MAINSTONE)     += mainstone-flash.o
+obj-$(CONFIG_MTD_PXA2XX)        += pxa2xx-flash.o
 obj-$(CONFIG_MTD_MBX860)        += mbx860.o
 obj-$(CONFIG_MTD_CEIVA)         += ceiva.o
 obj-$(CONFIG_MTD_OCTAGON)       += octagon-5066.o
@@ -43,7 +42,6 @@ obj-$(CONFIG_MTD_SUN_UFLASH)	+= sun_uflash.o
 obj-$(CONFIG_MTD_VMAX)          += vmax301.o
 obj-$(CONFIG_MTD_SCx200_DOCFLASH)+= scx200_docflash.o
 obj-$(CONFIG_MTD_DBOX2)         += dbox2-flash.o
-obj-$(CONFIG_MTD_OCELOT)        += ocelot.o
 obj-$(CONFIG_MTD_SOLUTIONENGINE)+= solutionengine.o
 obj-$(CONFIG_MTD_PCI)           += pci.o
 obj-$(CONFIG_MTD_ALCHEMY)       += alchemy-flash.o
@@ -70,4 +68,4 @@ obj-$(CONFIG_MTD_SHARP_SL)	+= sharpsl-flash.o
 obj-$(CONFIG_MTD_PLATRAM)       += plat-ram.o
 obj-$(CONFIG_MTD_OMAP_NOR)      += omap_nor.o
 obj-$(CONFIG_MTD_MTX1)          += mtx-1_flash.o
-obj-$(CONFIG_MTD_TQM834x)       += tqm834x.o
+obj-$(CONFIG_MTD_INTEL_VR_NOR)  += intel_vr_nor.o
diff --git a/drivers/mtd/maps/alchemy-flash.c b/drivers/mtd/maps/alchemy-flash.c
index 84fbe0e8c47e..82811bcb0436 100644
--- a/drivers/mtd/maps/alchemy-flash.c
+++ b/drivers/mtd/maps/alchemy-flash.c
@@ -75,13 +75,6 @@
 #define BOARD_FLASH_WIDTH 2 /* 16-bits */
 #endif
 
-#ifdef CONFIG_MIPS_HYDROGEN3
-#define BOARD_MAP_NAME "Hydrogen3 Flash"
-#define BOARD_FLASH_SIZE 0x02000000 /* 32MB */
-#define BOARD_FLASH_WIDTH 4 /* 32-bits */
-#define USE_LOCAL_ACCESSORS /* why? */
-#endif
-
 #ifdef CONFIG_MIPS_BOSPORUS
 #define BOARD_MAP_NAME "Bosporus Flash"
 #define BOARD_FLASH_SIZE 0x01000000 /* 16MB */
@@ -130,13 +123,6 @@ int __init alchemy_mtd_init(void)
 
         window_addr = 0x20000000 - BOARD_FLASH_SIZE;
         window_size = BOARD_FLASH_SIZE;
-#ifdef CONFIG_MIPS_MIRAGE_WHY
-        /* Boot ROM flash bank only; no user bank */
-        window_addr = 0x1C000000;
-        window_size = 0x04000000;
-        /* USERFS from 0x1C00 0000 to 0x1FC00000 */
-        alchemy_partitions[0].size = 0x03C00000;
-#endif
 
         /*
          * Static partition definition selection
diff --git a/drivers/mtd/maps/intel_vr_nor.c b/drivers/mtd/maps/intel_vr_nor.c
new file mode 100644
index 000000000000..1e7814ae212a
--- /dev/null
+++ b/drivers/mtd/maps/intel_vr_nor.c
@@ -0,0 +1,298 @@
+/*
+ * drivers/mtd/maps/intel_vr_nor.c
+ *
+ * An MTD map driver for a NOR flash bank on the Expansion Bus of the Intel
+ * Vermilion Range chipset.
+ *
+ * The Vermilion Range Expansion Bus supports four chip selects, each of which
+ * has 64MiB of address space.  The 2nd BAR of the Expansion Bus PCI Device
+ * is a 256MiB memory region containing the address spaces for all four of the
+ * chip selects, with start addresses hardcoded on 64MiB boundaries.
+ *
+ * This map driver only supports NOR flash on chip select 0.  The buswidth
+ * (either 8 bits or 16 bits) is determined by reading the Expansion Bus Timing
+ * and Control Register for Chip Select 0 (EXP_TIMING_CS0).  This driver does
+ * not modify the value in the EXP_TIMING_CS0 register except to enable writing
+ * and disable boot acceleration.  The timing parameters in the register are
+ * assumed to have been properly initialized by the BIOS.  The reset default
+ * timing parameters are maximally conservative (slow), so access to the flash
+ * will be slower than it should be if the BIOS has not initialized the timing
+ * parameters.
+ *
+ * Author: Andy Lowe <alowe@mvista.com>
+ *
+ * 2006 (c) MontaVista Software, Inc. This file is licensed under
+ * the terms of the GNU General Public License version 2. This program
+ * is licensed "as is" without any warranty of any kind, whether express
+ * or implied.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/pci.h>
+#include <linux/init.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/map.h>
+#include <linux/mtd/partitions.h>
+#include <linux/mtd/cfi.h>
+#include <linux/mtd/flashchip.h>
+
+#define DRV_NAME "vr_nor"
+
+struct vr_nor_mtd {
+        void __iomem *csr_base;
+        struct map_info map;
+        struct mtd_info *info;
+        int nr_parts;
+        struct pci_dev *dev;
+};
+
+/* Expansion Bus Configuration and Status Registers are in BAR 0 */
+#define EXP_CSR_MBAR 0
+/* Expansion Bus Memory Window is BAR 1 */
+#define EXP_WIN_MBAR 1
+/* Maximum address space for Chip Select 0 is 64MiB */
+#define CS0_SIZE 0x04000000
+/* Chip Select 0 is at offset 0 in the Memory Window */
+#define CS0_START 0x0
+/* Chip Select 0 Timing Register is at offset 0 in CSR */
+#define EXP_TIMING_CS0 0x00
+#define TIMING_CS_EN            (1 << 31)       /* Chip Select Enable */
+#define TIMING_BOOT_ACCEL_DIS   (1 <<  8)       /* Boot Acceleration Disable */
+#define TIMING_WR_EN            (1 <<  1)       /* Write Enable */
+#define TIMING_BYTE_EN          (1 <<  0)       /* 8-bit vs 16-bit bus */
+#define TIMING_MASK             0x3FFF0000
+
+static void __devexit vr_nor_destroy_partitions(struct vr_nor_mtd *p)
+{
+        if (p->nr_parts > 0) {
+#if defined(CONFIG_MTD_PARTITIONS) || defined(CONFIG_MTD_PARTITIONS_MODULE)
+                del_mtd_partitions(p->info);
+#endif
+        } else
+                del_mtd_device(p->info);
+}
+
+static int __devinit vr_nor_init_partitions(struct vr_nor_mtd *p)
+{
+        int err = 0;
+#if defined(CONFIG_MTD_PARTITIONS) || defined(CONFIG_MTD_PARTITIONS_MODULE)
+        struct mtd_partition *parts;
+        static const char *part_probes[] = { "cmdlinepart", NULL };
+#endif
+
+        /* register the flash bank */
+#if defined(CONFIG_MTD_PARTITIONS) || defined(CONFIG_MTD_PARTITIONS_MODULE)
+        /* partition the flash bank */
+        p->nr_parts = parse_mtd_partitions(p->info, part_probes, &parts, 0);
+        if (p->nr_parts > 0)
+                err = add_mtd_partitions(p->info, parts, p->nr_parts);
+#endif
+        if (p->nr_parts <= 0)
+                err = add_mtd_device(p->info);
+
+        return err;
+}
+
+static void __devexit vr_nor_destroy_mtd_setup(struct vr_nor_mtd *p)
+{
+        map_destroy(p->info);
+}
+
+static int __devinit vr_nor_mtd_setup(struct vr_nor_mtd *p)
+{
+        static const char *probe_types[] =
+            { "cfi_probe", "jedec_probe", NULL };
+        const char **type;
+
+        for (type = probe_types; !p->info && *type; type++)
+                p->info = do_map_probe(*type, &p->map);
+        if (!p->info)
+                return -ENODEV;
+
+        p->info->owner = THIS_MODULE;
+
+        return 0;
+}
+
+static void __devexit vr_nor_destroy_maps(struct vr_nor_mtd *p)
+{
+        unsigned int exp_timing_cs0;
+
+        /* write-protect the flash bank */
+        exp_timing_cs0 = readl(p->csr_base + EXP_TIMING_CS0);
+        exp_timing_cs0 &= ~TIMING_WR_EN;
+        writel(exp_timing_cs0, p->csr_base + EXP_TIMING_CS0);
+
+        /* unmap the flash window */
+        iounmap(p->map.virt);
+
+        /* unmap the csr window */
+        iounmap(p->csr_base);
+}
+
+/*
+ * Initialize the map_info structure and map the flash.
+ * Returns 0 on success, nonzero otherwise.
+ */
+static int __devinit vr_nor_init_maps(struct vr_nor_mtd *p)
+{
+        unsigned long csr_phys, csr_len;
+        unsigned long win_phys, win_len;
+        unsigned int exp_timing_cs0;
+        int err;
+
+        csr_phys = pci_resource_start(p->dev, EXP_CSR_MBAR);
+        csr_len = pci_resource_len(p->dev, EXP_CSR_MBAR);
+        win_phys = pci_resource_start(p->dev, EXP_WIN_MBAR);
+        win_len = pci_resource_len(p->dev, EXP_WIN_MBAR);
+
+        if (!csr_phys || !csr_len || !win_phys || !win_len)
+                return -ENODEV;
+
+        if (win_len < (CS0_START + CS0_SIZE))
+                return -ENXIO;
+
+        p->csr_base = ioremap_nocache(csr_phys, csr_len);
+        if (!p->csr_base)
+                return -ENOMEM;
+
+        exp_timing_cs0 = readl(p->csr_base + EXP_TIMING_CS0);
+        if (!(exp_timing_cs0 & TIMING_CS_EN)) {
+                dev_warn(&p->dev->dev, "Expansion Bus Chip Select 0 "
+                       "is disabled.\n");
+                err = -ENODEV;
+                goto release;
+        }
+        if ((exp_timing_cs0 & TIMING_MASK) == TIMING_MASK) {
+                dev_warn(&p->dev->dev, "Expansion Bus Chip Select 0 "
+                       "is configured for maximally slow access times.\n");
+        }
+        p->map.name = DRV_NAME;
+        p->map.bankwidth = (exp_timing_cs0 & TIMING_BYTE_EN) ? 1 : 2;
+        p->map.phys = win_phys + CS0_START;
+        p->map.size = CS0_SIZE;
+        p->map.virt = ioremap_nocache(p->map.phys, p->map.size);
+        if (!p->map.virt) {
+                err = -ENOMEM;
+                goto release;
+        }
+        simple_map_init(&p->map);
+
+        /* Enable writes to flash bank */
+        exp_timing_cs0 |= TIMING_BOOT_ACCEL_DIS | TIMING_WR_EN;
+        writel(exp_timing_cs0, p->csr_base + EXP_TIMING_CS0);
+
+        return 0;
+
+      release:
+        iounmap(p->csr_base);
+        return err;
+}
+
+static struct pci_device_id vr_nor_pci_ids[] = {
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x500D)},
+        {0,}
+};
+
+static void __devexit vr_nor_pci_remove(struct pci_dev *dev)
+{
+        struct vr_nor_mtd *p = pci_get_drvdata(dev);
+
+        pci_set_drvdata(dev, NULL);
+        vr_nor_destroy_partitions(p);
+        vr_nor_destroy_mtd_setup(p);
+        vr_nor_destroy_maps(p);
+        kfree(p);
+        pci_release_regions(dev);
+        pci_disable_device(dev);
+}
+
+static int __devinit
+vr_nor_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+{
+        struct vr_nor_mtd *p = NULL;
+        unsigned int exp_timing_cs0;
+        int err;
+
+        err = pci_enable_device(dev);
+        if (err)
+                goto out;
+
+        err = pci_request_regions(dev, DRV_NAME);
+        if (err)
+                goto disable_dev;
+
+        p = kzalloc(sizeof(*p), GFP_KERNEL);
+        err = -ENOMEM;
+        if (!p)
+                goto release;
+
+        p->dev = dev;
+
+        err = vr_nor_init_maps(p);
+        if (err)
+                goto release;
+
+        err = vr_nor_mtd_setup(p);
+        if (err)
+                goto destroy_maps;
+
+        err = vr_nor_init_partitions(p);
+        if (err)
+                goto destroy_mtd_setup;
+
+        pci_set_drvdata(dev, p);
+
+        return 0;
+
+      destroy_mtd_setup:
+        map_destroy(p->info);
+
+      destroy_maps:
+        /* write-protect the flash bank */
+        exp_timing_cs0 = readl(p->csr_base + EXP_TIMING_CS0);
+        exp_timing_cs0 &= ~TIMING_WR_EN;
+        writel(exp_timing_cs0, p->csr_base + EXP_TIMING_CS0);
+
+        /* unmap the flash window */
+        iounmap(p->map.virt);
+
+        /* unmap the csr window */
+        iounmap(p->csr_base);
+
+      release:
+        kfree(p);
+        pci_release_regions(dev);
+
+      disable_dev:
+        pci_disable_device(dev);
+
+      out:
+        return err;
+}
+
+static struct pci_driver vr_nor_pci_driver = {
+        .name = DRV_NAME,
+        .probe = vr_nor_pci_probe,
+        .remove = __devexit_p(vr_nor_pci_remove),
+        .id_table = vr_nor_pci_ids,
+};
+
+static int __init vr_nor_mtd_init(void)
+{
+        return pci_register_driver(&vr_nor_pci_driver);
+}
+
+static void __exit vr_nor_mtd_exit(void)
+{
+        pci_unregister_driver(&vr_nor_pci_driver);
+}
+
+module_init(vr_nor_mtd_init);
+module_exit(vr_nor_mtd_exit);
+
+MODULE_AUTHOR("Andy Lowe");
+MODULE_DESCRIPTION("MTD map driver for NOR flash on Intel Vermilion Range");
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(pci, vr_nor_pci_ids);
diff --git a/drivers/mtd/maps/lubbock-flash.c b/drivers/mtd/maps/lubbock-flash.c
deleted file mode 100644
index e8560683b973..000000000000
--- a/drivers/mtd/maps/lubbock-flash.c
+++ /dev/null
@@ -1,168 +0,0 @@
-/*
- * $Id: lubbock-flash.c,v 1.21 2005/11/07 11:14:27 gleixner Exp $
- *
- * Map driver for the Lubbock developer platform.
- *
- * Author:      Nicolas Pitre
- * Copyright:   (C) 2001 MontaVista Software Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/partitions.h>
-
-#include <asm/io.h>
-#include <asm/hardware.h>
-#include <asm/arch/pxa-regs.h>
-#include <asm/arch/lubbock.h>
-#include <asm/cacheflush.h>
-
-#define ROM_ADDR        0x00000000
-#define FLASH_ADDR      0x04000000
-
-#define WINDOW_SIZE     64*1024*1024
-
-static void lubbock_map_inval_cache(struct map_info *map, unsigned long from, ssize_t len)
-{
-        flush_ioremap_region(map->phys, map->cached, from, len);
-}
-
-static struct map_info lubbock_maps[2] = { {
-        .size =         WINDOW_SIZE,
-        .phys =         0x00000000,
-        .inval_cache =  lubbock_map_inval_cache,
-}, {
-        .size =         WINDOW_SIZE,
-        .phys =         0x04000000,
-        .inval_cache =  lubbock_map_inval_cache,
-} };
-
-static struct mtd_partition lubbock_partitions[] = {
-        {
-                .name =         "Bootloader",
-                .size =         0x00040000,
-                .offset =       0,
-                .mask_flags =   MTD_WRITEABLE  /* force read-only */
-        },{
-                .name =         "Kernel",
-                .size =         0x00100000,
-                .offset =       0x00040000,
-        },{
-                .name =         "Filesystem",
-                .size =         MTDPART_SIZ_FULL,
-                .offset =       0x00140000
-        }
-};
-
-static struct mtd_info *mymtds[2];
-static struct mtd_partition *parsed_parts[2];
-static int nr_parsed_parts[2];
-
-static const char *probes[] = { "RedBoot", "cmdlinepart", NULL };
-
-static int __init init_lubbock(void)
-{
-        int flashboot = (LUB_CONF_SWITCHES & 1);
-        int ret = 0, i;
-
-        lubbock_maps[0].bankwidth = lubbock_maps[1].bankwidth =
-                (BOOT_DEF & 1) ? 2 : 4;
-
-        /* Compensate for the nROMBT switch which swaps the flash banks */
-        printk(KERN_NOTICE "Lubbock configured to boot from %s (bank %d)\n",
-               flashboot?"Flash":"ROM", flashboot);
-
-        lubbock_maps[flashboot^1].name = "Lubbock Application Flash";
-        lubbock_maps[flashboot].name = "Lubbock Boot ROM";
-
-        for (i = 0; i < 2; i++) {
-                lubbock_maps[i].virt = ioremap(lubbock_maps[i].phys, WINDOW_SIZE);
-                if (!lubbock_maps[i].virt) {
-                        printk(KERN_WARNING "Failed to ioremap %s\n", lubbock_maps[i].name);
-                        if (!ret)
-                                ret = -ENOMEM;
-                        continue;
-                }
-                lubbock_maps[i].cached = ioremap_cached(lubbock_maps[i].phys, WINDOW_SIZE);
-                if (!lubbock_maps[i].cached)
-                        printk(KERN_WARNING "Failed to ioremap cached %s\n", lubbock_maps[i].name);
-                simple_map_init(&lubbock_maps[i]);
-
-                printk(KERN_NOTICE "Probing %s at physical address 0x%08lx (%d-bit bankwidth)\n",
-                       lubbock_maps[i].name, lubbock_maps[i].phys,
-                       lubbock_maps[i].bankwidth * 8);
-
-                mymtds[i] = do_map_probe("cfi_probe", &lubbock_maps[i]);
-
-                if (!mymtds[i]) {
-                        iounmap((void *)lubbock_maps[i].virt);
-                        if (lubbock_maps[i].cached)
-                                iounmap(lubbock_maps[i].cached);
-                        if (!ret)
-                                ret = -EIO;
-                        continue;
-                }
-                mymtds[i]->owner = THIS_MODULE;
-
-                ret = parse_mtd_partitions(mymtds[i], probes,
-                                           &parsed_parts[i], 0);
-
-                if (ret > 0)
-                        nr_parsed_parts[i] = ret;
-        }
-
-        if (!mymtds[0] && !mymtds[1])
-                return ret;
-
-        for (i = 0; i < 2; i++) {
-                if (!mymtds[i]) {
-                        printk(KERN_WARNING "%s is absent. Skipping\n", lubbock_maps[i].name);
-                } else if (nr_parsed_parts[i]) {
-                        add_mtd_partitions(mymtds[i], parsed_parts[i], nr_parsed_parts[i]);
-                } else if (!i) {
-                        printk("Using static partitions on %s\n", lubbock_maps[i].name);
-                        add_mtd_partitions(mymtds[i], lubbock_partitions, ARRAY_SIZE(lubbock_partitions));
-                } else {
-                        printk("Registering %s as whole device\n", lubbock_maps[i].name);
-                        add_mtd_device(mymtds[i]);
-                }
-        }
-        return 0;
-}
-
-static void __exit cleanup_lubbock(void)
-{
-        int i;
-        for (i = 0; i < 2; i++) {
-                if (!mymtds[i])
-                        continue;
-
-                if (nr_parsed_parts[i] || !i)
-                        del_mtd_partitions(mymtds[i]);
-                else
-                        del_mtd_device(mymtds[i]);
-
-                map_destroy(mymtds[i]);
-                iounmap((void *)lubbock_maps[i].virt);
-                if (lubbock_maps[i].cached)
-                        iounmap(lubbock_maps[i].cached);
-
-                kfree(parsed_parts[i]);
-        }
-}
-
-module_init(init_lubbock);
-module_exit(cleanup_lubbock);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Nicolas Pitre <nico@cam.org>");
-MODULE_DESCRIPTION("MTD map driver for Intel Lubbock");
diff --git a/drivers/mtd/maps/mainstone-flash.c b/drivers/mtd/maps/mainstone-flash.c
deleted file mode 100644
index d76487d82dcd..000000000000
--- a/drivers/mtd/maps/mainstone-flash.c
+++ /dev/null
@@ -1,180 +0,0 @@
-/*
- * $Id:  $
- *
- * Map driver for the Mainstone developer platform.
- *
- * Author:      Nicolas Pitre
- * Copyright:   (C) 2001 MontaVista Software Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/partitions.h>
-
-#include <asm/io.h>
-#include <asm/hardware.h>
-#include <asm/arch/pxa-regs.h>
-#include <asm/arch/mainstone.h>
-#include <asm/cacheflush.h>
-
-
-#define ROM_ADDR        0x00000000
-#define FLASH_ADDR      0x04000000
-
-#define WINDOW_SIZE     0x04000000
-
-static void mainstone_map_inval_cache(struct map_info *map, unsigned long from,
-                                      ssize_t len)
-{
-        flush_ioremap_region(map->phys, map->cached, from, len);
-}
-
-static struct map_info mainstone_maps[2] = { {
-        .size =         WINDOW_SIZE,
-        .phys =         PXA_CS0_PHYS,
-        .inval_cache =  mainstone_map_inval_cache,
-}, {
-        .size =         WINDOW_SIZE,
-        .phys =         PXA_CS1_PHYS,
-        .inval_cache =  mainstone_map_inval_cache,
-} };
-
-static struct mtd_partition mainstone_partitions[] = {
-        {
-                .name =         "Bootloader",
-                .size =         0x00040000,
-                .offset =       0,
-                .mask_flags =   MTD_WRITEABLE  /* force read-only */
-        },{
-                .name =         "Kernel",
-                .size =         0x00400000,
-                .offset =       0x00040000,
-        },{
-                .name =         "Filesystem",
-                .size =         MTDPART_SIZ_FULL,
-                .offset =       0x00440000
-        }
-};
-
-static struct mtd_info *mymtds[2];
-static struct mtd_partition *parsed_parts[2];
-static int nr_parsed_parts[2];
-
-static const char *probes[] = { "RedBoot", "cmdlinepart", NULL };
-
-static int __init init_mainstone(void)
-{
-        int SW7 = 0;  /* FIXME: get from SCR (Mst doc section 3.2.1.1) */
-        int ret = 0, i;
-
-        mainstone_maps[0].bankwidth = (BOOT_DEF & 1) ? 2 : 4;
-        mainstone_maps[1].bankwidth = 4;
-
-        /* Compensate for SW7 which swaps the flash banks */
-        mainstone_maps[SW7].name = "processor flash";
-        mainstone_maps[SW7 ^ 1].name = "main board flash";
-
-        printk(KERN_NOTICE "Mainstone configured to boot from %s\n",
-               mainstone_maps[0].name);
-
-        for (i = 0; i < 2; i++) {
-                mainstone_maps[i].virt = ioremap(mainstone_maps[i].phys,
-                                                 WINDOW_SIZE);
-                if (!mainstone_maps[i].virt) {
-                        printk(KERN_WARNING "Failed to ioremap %s\n",
-                               mainstone_maps[i].name);
-                        if (!ret)
-                                ret = -ENOMEM;
-                        continue;
-                }
-                mainstone_maps[i].cached =
-                        ioremap_cached(mainstone_maps[i].phys, WINDOW_SIZE);
-                if (!mainstone_maps[i].cached)
-                        printk(KERN_WARNING "Failed to ioremap cached %s\n",
-                               mainstone_maps[i].name);
-                simple_map_init(&mainstone_maps[i]);
-
-                printk(KERN_NOTICE
-                       "Probing %s at physical address 0x%08lx"
-                       " (%d-bit bankwidth)\n",
-                       mainstone_maps[i].name, mainstone_maps[i].phys,
-                       mainstone_maps[i].bankwidth * 8);
-
-                mymtds[i] = do_map_probe("cfi_probe", &mainstone_maps[i]);
-
-                if (!mymtds[i]) {
-                        iounmap((void *)mainstone_maps[i].virt);
-                        if (mainstone_maps[i].cached)
-                                iounmap(mainstone_maps[i].cached);
-                        if (!ret)
-                                ret = -EIO;
-                        continue;
-                }
-                mymtds[i]->owner = THIS_MODULE;
-
-                ret = parse_mtd_partitions(mymtds[i], probes,
-                                           &parsed_parts[i], 0);
-
-                if (ret > 0)
-                        nr_parsed_parts[i] = ret;
-        }
-
-        if (!mymtds[0] && !mymtds[1])
-                return ret;
-
-        for (i = 0; i < 2; i++) {
-                if (!mymtds[i]) {
-                        printk(KERN_WARNING "%s is absent. Skipping\n",
-                               mainstone_maps[i].name);
-                } else if (nr_parsed_parts[i]) {
-                        add_mtd_partitions(mymtds[i], parsed_parts[i],
-                                           nr_parsed_parts[i]);
-                } else if (!i) {
-                        printk("Using static partitions on %s\n",
-                               mainstone_maps[i].name);
-                        add_mtd_partitions(mymtds[i], mainstone_partitions,
-                                           ARRAY_SIZE(mainstone_partitions));
-                } else {
-                        printk("Registering %s as whole device\n",
-                               mainstone_maps[i].name);
-                        add_mtd_device(mymtds[i]);
-                }
-        }
-        return 0;
-}
-
-static void __exit cleanup_mainstone(void)
-{
-        int i;
-        for (i = 0; i < 2; i++) {
-                if (!mymtds[i])
-                        continue;
-
-                if (nr_parsed_parts[i] || !i)
-                        del_mtd_partitions(mymtds[i]);
-                else
-                        del_mtd_device(mymtds[i]);
-
-                map_destroy(mymtds[i]);
-                iounmap((void *)mainstone_maps[i].virt);
-                if (mainstone_maps[i].cached)
-                        iounmap(mainstone_maps[i].cached);
-                kfree(parsed_parts[i]);
-        }
-}
-
-module_init(init_mainstone);
-module_exit(cleanup_mainstone);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Nicolas Pitre <nico@cam.org>");
-MODULE_DESCRIPTION("MTD map driver for Intel Mainstone");
diff --git a/drivers/mtd/maps/nettel.c b/drivers/mtd/maps/nettel.c
index 7b96cd02f82b..0c9b305a72e0 100644
--- a/drivers/mtd/maps/nettel.c
+++ b/drivers/mtd/maps/nettel.c
@@ -158,68 +158,11 @@ static struct notifier_block nettel_notifier_block = {
         nettel_reboot_notifier, NULL, 0
 };
 
-/*
- *      Erase the configuration file system.
- *      Used to support the software reset button.
- */
-static void nettel_erasecallback(struct erase_info *done)
-{
-        wait_queue_head_t *wait_q = (wait_queue_head_t *)done->priv;
-        wake_up(wait_q);
-}
-
-static struct erase_info nettel_erase;
-
-int nettel_eraseconfig(void)
-{
-        struct mtd_info *mtd;
-        DECLARE_WAITQUEUE(wait, current);
-        wait_queue_head_t wait_q;
-        int ret;
-
-        init_waitqueue_head(&wait_q);
-        mtd = get_mtd_device(NULL, 2);
-        if (!IS_ERR(mtd)) {
-                nettel_erase.mtd = mtd;
-                nettel_erase.callback = nettel_erasecallback;
-                nettel_erase.callback = NULL;
-                nettel_erase.addr = 0;
-                nettel_erase.len = mtd->size;
-                nettel_erase.priv = (u_long) &wait_q;
-                nettel_erase.priv = 0;
-
-                set_current_state(TASK_INTERRUPTIBLE);
-                add_wait_queue(&wait_q, &wait);
-
-                ret = mtd->erase(mtd, &nettel_erase);
-                if (ret) {
-                        set_current_state(TASK_RUNNING);
-                        remove_wait_queue(&wait_q, &wait);
-                        put_mtd_device(mtd);
-                        return(ret);
-                }
-
-                schedule();  /* Wait for erase to finish. */
-                remove_wait_queue(&wait_q, &wait);
-
-                put_mtd_device(mtd);
-        }
-
-        return(0);
-}
-
-#else
-
-int nettel_eraseconfig(void)
-{
-        return(0);
-}
-
 #endif
 
 /****************************************************************************/
 
-int __init nettel_init(void)
+static int __init nettel_init(void)
 {
         volatile unsigned long *amdpar;
         unsigned long amdaddr, maxsize;
@@ -421,10 +364,6 @@ int __init nettel_init(void)
 
         intel_mtd->owner = THIS_MODULE;
 
-#ifndef CONFIG_BLK_DEV_INITRD
-        ROOT_DEV = MKDEV(MTD_BLOCK_MAJOR, 1);
-#endif
-
         num_intel_partitions = sizeof(nettel_intel_partitions) /
                 sizeof(nettel_intel_partitions[0]);
 
@@ -477,7 +416,7 @@ out_unmap2:
 
 /****************************************************************************/
 
-void __exit nettel_cleanup(void)
+static void __exit nettel_cleanup(void)
 {
 #ifdef CONFIG_MTD_CFI_INTELEXT
         unregister_reboot_notifier(&nettel_notifier_block);
diff --git a/drivers/mtd/maps/ocelot.c b/drivers/mtd/maps/ocelot.c
deleted file mode 100644
index 6977963d7897..000000000000
--- a/drivers/mtd/maps/ocelot.c
+++ /dev/null
@@ -1,175 +0,0 @@
-/*
- * $Id: ocelot.c,v 1.17 2005/11/07 11:14:27 gleixner Exp $
- *
- * Flash on Momenco Ocelot
- */
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <asm/io.h>
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/partitions.h>
-
-#define OCELOT_PLD 0x2c000000
-#define FLASH_WINDOW_ADDR 0x2fc00000
-#define FLASH_WINDOW_SIZE 0x00080000
-#define FLASH_BUSWIDTH 1
-#define NVRAM_WINDOW_ADDR 0x2c800000
-#define NVRAM_WINDOW_SIZE 0x00007FF0
-#define NVRAM_BUSWIDTH 1
-
-static unsigned int cacheflush = 0;
-
-static struct mtd_info *flash_mtd;
-static struct mtd_info *nvram_mtd;
-
-static void ocelot_ram_write(struct mtd_info *mtd, loff_t to, size_t len, size_t *retlen, const u_char *buf)
-{
-        struct map_info *map = mtd->priv;
-        size_t done = 0;
-
-        /* If we use memcpy, it does word-wide writes. Even though we told the
-           GT64120A that it's an 8-bit wide region, word-wide writes don't work.
-           We end up just writing the first byte of the four to all four bytes.
-           So we have this loop instead */
-        *retlen = len;
-        while(len) {
-                __raw_writeb(*(unsigned char *) from, map->virt + to);
-                from++;
-                to++;
-                len--;
-        }
-}
-
-static struct mtd_partition *parsed_parts;
-
-struct map_info ocelot_flash_map = {
-        .name = "Ocelot boot flash",
-        .size = FLASH_WINDOW_SIZE,
-        .bankwidth = FLASH_BUSWIDTH,
-        .phys = FLASH_WINDOW_ADDR,
-};
-
-struct map_info ocelot_nvram_map = {
-        .name = "Ocelot NVRAM",
-        .size = NVRAM_WINDOW_SIZE,
-        .bankwidth = NVRAM_BUSWIDTH,
-        .phys = NVRAM_WINDOW_ADDR,
-};
-
-static const char *probes[] = { "RedBoot", NULL };
-
-static int __init init_ocelot_maps(void)
-{
-        void *pld;
-        int nr_parts;
-        unsigned char brd_status;
-
-        printk(KERN_INFO "Momenco Ocelot MTD mappings: Flash 0x%x at 0x%x, NVRAM 0x%x at 0x%x\n",
-               FLASH_WINDOW_SIZE, FLASH_WINDOW_ADDR, NVRAM_WINDOW_SIZE, NVRAM_WINDOW_ADDR);
-
-        /* First check whether the flash jumper is present */
-        pld = ioremap(OCELOT_PLD, 0x10);
-        if (!pld) {
-                printk(KERN_NOTICE "Failed to ioremap Ocelot PLD\n");
-                return -EIO;
-        }
-        brd_status = readb(pld+4);
-        iounmap(pld);
-
-        /* Now ioremap the NVRAM space */
-        ocelot_nvram_map.virt = ioremap_nocache(NVRAM_WINDOW_ADDR, NVRAM_WINDOW_SIZE);
-        if (!ocelot_nvram_map.virt) {
-                printk(KERN_NOTICE "Failed to ioremap Ocelot NVRAM space\n");
-                return -EIO;
-        }
-
-        simple_map_init(&ocelot_nvram_map);
-
-        /* And do the RAM probe on it to get an MTD device */
-        nvram_mtd = do_map_probe("map_ram", &ocelot_nvram_map);
-        if (!nvram_mtd) {
-                printk("NVRAM probe failed\n");
-                goto fail_1;
-        }
-        nvram_mtd->owner = THIS_MODULE;
-        nvram_mtd->erasesize = 16;
-        /* Override the write() method */
-        nvram_mtd->write = ocelot_ram_write;
-
-        /* Now map the flash space */
-        ocelot_flash_map.virt = ioremap_nocache(FLASH_WINDOW_ADDR, FLASH_WINDOW_SIZE);
-        if (!ocelot_flash_map.virt) {
-                printk(KERN_NOTICE "Failed to ioremap Ocelot flash space\n");
-                goto fail_2;
-        }
-        /* Now the cached version */
-        ocelot_flash_map.cached = (unsigned long)__ioremap(FLASH_WINDOW_ADDR, FLASH_WINDOW_SIZE, 0);
-
-        simple_map_init(&ocelot_flash_map);
-
-        /* Only probe for flash if the write jumper is present */
-        if (brd_status & 0x40) {
-                flash_mtd = do_map_probe("jedec", &ocelot_flash_map);
-        } else {
-                printk(KERN_NOTICE "Ocelot flash write jumper not present. Treating as ROM\n");
-        }
-        /* If that failed or the jumper's absent, pretend it's ROM */
-        if (!flash_mtd) {
-                flash_mtd = do_map_probe("map_rom", &ocelot_flash_map);
-                /* If we're treating it as ROM, set the erase size */
-                if (flash_mtd)
-                        flash_mtd->erasesize = 0x10000;
-        }
-        if (!flash_mtd)
-                goto fail3;
-
-        add_mtd_device(nvram_mtd);
-
-        flash_mtd->owner = THIS_MODULE;
-        nr_parts = parse_mtd_partitions(flash_mtd, probes, &parsed_parts, 0);
-
-        if (nr_parts > 0)
-                add_mtd_partitions(flash_mtd, parsed_parts, nr_parts);
-        else
-                add_mtd_device(flash_mtd);
-
-        return 0;
-
- fail3:
-        iounmap((void *)ocelot_flash_map.virt);
-        if (ocelot_flash_map.cached)
-                        iounmap((void *)ocelot_flash_map.cached);
- fail_2:
-        map_destroy(nvram_mtd);
- fail_1:
-        iounmap((void *)ocelot_nvram_map.virt);
-
-        return -ENXIO;
-}
-
-static void __exit cleanup_ocelot_maps(void)
-{
-        del_mtd_device(nvram_mtd);
-        map_destroy(nvram_mtd);
-        iounmap((void *)ocelot_nvram_map.virt);
-
-        if (parsed_parts)
-                del_mtd_partitions(flash_mtd);
-        else
-                del_mtd_device(flash_mtd);
-        map_destroy(flash_mtd);
-        iounmap((void *)ocelot_flash_map.virt);
-        if (ocelot_flash_map.cached)
-                iounmap((void *)ocelot_flash_map.cached);
-}
-
-module_init(init_ocelot_maps);
-module_exit(cleanup_ocelot_maps);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Red Hat, Inc. - David Woodhouse <dwmw2@cambridge.redhat.com>");
-MODULE_DESCRIPTION("MTD map driver for Momenco Ocelot board");
diff --git a/drivers/mtd/maps/physmap_of.c b/drivers/mtd/maps/physmap_of.c
index cf75a566442e..aeed9ea79714 100644
--- a/drivers/mtd/maps/physmap_of.c
+++ b/drivers/mtd/maps/physmap_of.c
@@ -232,7 +232,6 @@ static int __devinit of_flash_probe(struct of_device *dev,
         info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (!info)
                 goto err_out;
-        memset(info, 0, sizeof(*info));
 
         dev_set_drvdata(&dev->dev, info);
 
diff --git a/drivers/mtd/maps/pmcmsp-flash.c b/drivers/mtd/maps/pmcmsp-flash.c
index 7e0377ec1c40..02bde8c982ec 100644
--- a/drivers/mtd/maps/pmcmsp-flash.c
+++ b/drivers/mtd/maps/pmcmsp-flash.c
@@ -73,13 +73,16 @@ int __init init_msp_flash(void)
                 return -ENXIO;
 
         printk(KERN_NOTICE "Found %d PMC flash devices\n", fcnt);
-        msp_flash = (struct mtd_info **)kmalloc(
-                        fcnt * sizeof(struct map_info *), GFP_KERNEL);
-        msp_parts = (struct mtd_partition **)kmalloc(
-                        fcnt * sizeof(struct mtd_partition *), GFP_KERNEL);
-        msp_maps = (struct map_info *)kmalloc(
-                        fcnt * sizeof(struct mtd_info), GFP_KERNEL);
-        memset(msp_maps, 0, fcnt * sizeof(struct mtd_info));
+
+        msp_flash = kmalloc(fcnt * sizeof(struct map_info *), GFP_KERNEL);
+        msp_parts = kmalloc(fcnt * sizeof(struct mtd_partition *), GFP_KERNEL);
+        msp_maps = kcalloc(fcnt, sizeof(struct mtd_info), GFP_KERNEL);
+        if (!msp_flash || !msp_parts || !msp_maps) {
+                kfree(msp_maps);
+                kfree(msp_parts);
+                kfree(msp_flash);
+                return -ENOMEM;
+        }
 
         /* loop over the flash devices, initializing each */
         for (i = 0; i < fcnt; i++) {
@@ -95,9 +98,8 @@ int __init init_msp_flash(void)
                         continue;
                 }
 
-                msp_parts[i] = (struct mtd_partition *)kmalloc(
-                        pcnt * sizeof(struct mtd_partition), GFP_KERNEL);
-                memset(msp_parts[i], 0, pcnt * sizeof(struct mtd_partition));
+                msp_parts[i] = kcalloc(pcnt, sizeof(struct mtd_partition),
+                                       GFP_KERNEL);
 
                 /* now initialize the devices proper */
                 flash_name[5] = '0' + i;
diff --git a/drivers/mtd/maps/pmcmsp-ramroot.c b/drivers/mtd/maps/pmcmsp-ramroot.c
index 18049bceba8d..30de5c0c09a9 100644
--- a/drivers/mtd/maps/pmcmsp-ramroot.c
+++ b/drivers/mtd/maps/pmcmsp-ramroot.c
@@ -79,7 +79,6 @@ static int __init init_rrmap(void)
                 rr_mtd->owner = THIS_MODULE;
 
                 add_mtd_device(rr_mtd);
-                ROOT_DEV = MKDEV(MTD_BLOCK_MAJOR, rr_mtd->index);
 
                 return 0;
         }
diff --git a/drivers/mtd/maps/pq2fads.c b/drivers/mtd/maps/pq2fads.c
deleted file mode 100644
index fb78d87cc130..000000000000
--- a/drivers/mtd/maps/pq2fads.c
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * drivers/mtd/maps/pq2fads.c
- *
- * Mapping for the flash SIMM on 8272ADS and PQ2FADS board
- *
- * Author: Vitaly Bordug <vbordug@ru.mvista.com>
- *
- * 2005 (c) MontaVista Software, Inc. This file is licensed under
- * the terms of the GNU General Public License version 2. This program
- * is licensed "as is" without any warranty of any kind, whether express
- * or implied.
- */
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <asm/io.h>
-#include <asm/ppcboot.h>
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/partitions.h>
-#include <linux/mtd/physmap.h>
-
-/*
-  NOTE: bank width and interleave relative to the installed flash
-  should have been chosen within MTD_CFI_GEOMETRY options.
-  */
-#define PQ2FADS_BANK_WIDTH 4
-
-static struct mtd_partition pq2fads_partitions[] = {
-        {
-#ifdef CONFIG_ADS8272
-                .name           = "HRCW",
-                .size           = 0x40000,
-                .offset         = 0,
-                .mask_flags     = MTD_WRITEABLE,  /* force read-only */
-        }, {
-                .name           = "User FS",
-                .size           = 0x5c0000,
-                .offset         = 0x40000,
-#else
-                .name           = "User FS",
-                .size           = 0x600000,
-                .offset         = 0,
-#endif
-        }, {
-                .name           = "uImage",
-                .size           = 0x100000,
-                .offset         = 0x600000,
-                .mask_flags     = MTD_WRITEABLE,  /* force read-only */
-        }, {
-                .name           = "bootloader",
-                .size           = 0x40000,
-                .offset         = 0x700000,
-                .mask_flags     = MTD_WRITEABLE,  /* force read-only */
-        }, {
-                .name           = "bootloader env",
-                .size           = 0x40000,
-                .offset         = 0x740000,
-                .mask_flags     = MTD_WRITEABLE,  /* force read-only */
-        }
-};
-
-
-/* pointer to MPC885ADS board info data */
-extern unsigned char __res[];
-
-static int __init init_pq2fads_mtd(void)
-{
-        bd_t *bd = (bd_t *)__res;
-        physmap_configure(bd->bi_flashstart, bd->bi_flashsize, PQ2FADS_BANK_WIDTH, NULL);
-
-        physmap_set_partitions(pq2fads_partitions,
-                                sizeof (pq2fads_partitions) /
-                                sizeof (pq2fads_partitions[0]));
-        return 0;
-}
-
-static void __exit cleanup_pq2fads_mtd(void)
-{
-}
-
-module_init(init_pq2fads_mtd);
-module_exit(cleanup_pq2fads_mtd);
-
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("MTD map and partitions for MPC8272ADS boards");
diff --git a/drivers/mtd/maps/pxa2xx-flash.c b/drivers/mtd/maps/pxa2xx-flash.c
new file mode 100644
index 000000000000..cb933ac475d5
--- /dev/null
+++ b/drivers/mtd/maps/pxa2xx-flash.c
@@ -0,0 +1,200 @@
+/*
+ * Map driver for Intel XScale PXA2xx platforms.
+ *
+ * Author:      Nicolas Pitre
+ * Copyright:   (C) 2001 MontaVista Software Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/dma-mapping.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/map.h>
+#include <linux/mtd/partitions.h>
+
+#include <asm/io.h>
+#include <asm/hardware.h>
+
+#include <asm/mach/flash.h>
+
+static void pxa2xx_map_inval_cache(struct map_info *map, unsigned long from,
+                                      ssize_t len)
+{
+        consistent_sync((char *)map->cached + from, len, DMA_FROM_DEVICE);
+}
+
+struct pxa2xx_flash_info {
+        struct mtd_partition    *parts;
+        int                     nr_parts;
+        struct mtd_info         *mtd;
+        struct map_info         map;
+};
+
+
+static const char *probes[] = { "RedBoot", "cmdlinepart", NULL };
+
+
+static int __init pxa2xx_flash_probe(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct flash_platform_data *flash = pdev->dev.platform_data;
+        struct pxa2xx_flash_info *info;
+        struct mtd_partition *parts;
+        struct resource *res;
+        int ret = 0;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -ENODEV;
+
+        info = kmalloc(sizeof(struct pxa2xx_flash_info), GFP_KERNEL);
+        if (!info)
+                return -ENOMEM;
+
+        memset(info, 0, sizeof(struct pxa2xx_flash_info));
+        info->map.name = (char *) flash->name;
+        info->map.bankwidth = flash->width;
+        info->map.phys = res->start;
+        info->map.size = res->end - res->start + 1;
+        info->parts = flash->parts;
+        info->nr_parts = flash->nr_parts;
+
+        info->map.virt = ioremap(info->map.phys, info->map.size);
+        if (!info->map.virt) {
+                printk(KERN_WARNING "Failed to ioremap %s\n",
+                       info->map.name);
+                return -ENOMEM;
+        }
+        info->map.cached =
+                ioremap_cached(info->map.phys, info->map.size);
+        if (!info->map.cached)
+                printk(KERN_WARNING "Failed to ioremap cached %s\n",
+                       info->map.name);
+        info->map.inval_cache = pxa2xx_map_inval_cache;
+        simple_map_init(&info->map);
+
+        printk(KERN_NOTICE
+               "Probing %s at physical address 0x%08lx"
+               " (%d-bit bankwidth)\n",
+               info->map.name, (unsigned long)info->map.phys,
+               info->map.bankwidth * 8);
+
+        info->mtd = do_map_probe(flash->map_name, &info->map);
+
+        if (!info->mtd) {
+                iounmap((void *)info->map.virt);
+                if (info->map.cached)
+                        iounmap(info->map.cached);
+                return -EIO;
+        }
+        info->mtd->owner = THIS_MODULE;
+
+#ifdef CONFIG_MTD_PARTITIONS
+        ret = parse_mtd_partitions(info->mtd, probes, &parts, 0);
+
+        if (ret > 0) {
+                info->nr_parts = ret;
+                info->parts = parts;
+        }
+#endif
+
+        if (info->nr_parts) {
+                add_mtd_partitions(info->mtd, info->parts,
+                                   info->nr_parts);
+        } else {
+                printk("Registering %s as whole device\n",
+                       info->map.name);
+                add_mtd_device(info->mtd);
+        }
+
+        dev_set_drvdata(dev, info);
+        return 0;
+}
+
+static int __exit pxa2xx_flash_remove(struct device *dev)
+{
+        struct pxa2xx_flash_info *info = dev_get_drvdata(dev);
+
+        dev_set_drvdata(dev, NULL);
+
+#ifdef CONFIG_MTD_PARTITIONS
+        if (info->nr_parts)
+                del_mtd_partitions(info->mtd);
+        else
+#endif
+                del_mtd_device(info->mtd);
+
+        map_destroy(info->mtd);
+        iounmap(info->map.virt);
+        if (info->map.cached)
+                iounmap(info->map.cached);
+        kfree(info->parts);
+        kfree(info);
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int pxa2xx_flash_suspend(struct device *dev, pm_message_t state)
+{
+        struct pxa2xx_flash_info *info = dev_get_drvdata(dev);
+        int ret = 0;
+
+        if (info->mtd && info->mtd->suspend)
+                ret = info->mtd->suspend(info->mtd);
+        return ret;
+}
+
+static int pxa2xx_flash_resume(struct device *dev)
+{
+        struct pxa2xx_flash_info *info = dev_get_drvdata(dev);
+
+        if (info->mtd && info->mtd->resume)
+                info->mtd->resume(info->mtd);
+        return 0;
+}
+static void pxa2xx_flash_shutdown(struct device *dev)
+{
+        struct pxa2xx_flash_info *info = dev_get_drvdata(dev);
+
+        if (info && info->mtd->suspend(info->mtd) == 0)
+                info->mtd->resume(info->mtd);
+}
+#else
+#define pxa2xx_flash_suspend NULL
+#define pxa2xx_flash_resume NULL
+#define pxa2xx_flash_shutdown NULL
+#endif
+
+static struct device_driver pxa2xx_flash_driver = {
+        .name           = "pxa2xx-flash",
+        .bus            = &platform_bus_type,
+        .probe          = pxa2xx_flash_probe,
+        .remove         = __exit_p(pxa2xx_flash_remove),
+        .suspend        = pxa2xx_flash_suspend,
+        .resume         = pxa2xx_flash_resume,
+        .shutdown       = pxa2xx_flash_shutdown,
+};
+
+static int __init init_pxa2xx_flash(void)
+{
+        return driver_register(&pxa2xx_flash_driver);
+}
+
+static void __exit cleanup_pxa2xx_flash(void)
+{
+        driver_unregister(&pxa2xx_flash_driver);
+}
+
+module_init(init_pxa2xx_flash);
+module_exit(cleanup_pxa2xx_flash);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Nicolas Pitre <nico@cam.org>");
+MODULE_DESCRIPTION("MTD map driver for Intel XScale PXA2xx");
diff --git a/drivers/mtd/maps/tqm834x.c b/drivers/mtd/maps/tqm834x.c
deleted file mode 100644
index 9adc970e55e6..000000000000
--- a/drivers/mtd/maps/tqm834x.c
+++ /dev/null
@@ -1,286 +0,0 @@
-/*
- * drivers/mtd/maps/tqm834x.c
- *
- * MTD mapping driver for TQM834x boards
- *
- * Copyright 2005 Wolfgang Denk, DENX Software Engineering, <wd@denx.de>.
- *
- * This file is licensed under the terms of the GNU General Public License
- * version 2.  This program is licensed "as is" without any warranty of any
- * kind, whether express or implied.
- *
- */
-
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/slab.h>
-#include <asm/io.h>
-#include <asm/ppcboot.h>
-
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/partitions.h>
-
-#define FLASH_BANK_MAX  2
-
-extern unsigned char __res[];
-
-/* trivial struct to describe partition information */
-struct mtd_part_def
-{
-        int nums;
-        unsigned char *type;
-        struct mtd_partition* mtd_part;
-};
-
-static struct mtd_info* mtd_banks[FLASH_BANK_MAX];
-static struct map_info* map_banks[FLASH_BANK_MAX];
-static struct mtd_part_def part_banks[FLASH_BANK_MAX];
-
-static unsigned long num_banks;
-static unsigned long start_scan_addr;
-
-#ifdef CONFIG_MTD_PARTITIONS
-/*
- * The following defines the partition layout of TQM834x boards.
- *
- * See include/linux/mtd/partitions.h for definition of the
- * mtd_partition structure.
- *
- * Assume minimal initial size of 4 MiB per bank, will be updated
- * later in init_tqm834x_mtd() routine.
- */
-
-/* Partition definition for the first flash bank which is always present. */
-static struct mtd_partition tqm834x_partitions_bank1[] = {
-        {
-                .name   = "u-boot",             /* u-boot firmware      */
-                .offset = 0x00000000,
-                .size   = 0x00040000,           /* 256 KiB              */
-                /*mask_flags: MTD_WRITEABLE,     * force read-only      */
-        },
-        {
-                .name   = "env",                /* u-boot environment   */
-                .offset = 0x00040000,
-                .size   = 0x00020000,           /* 128 KiB              */
-                /*mask_flags: MTD_WRITEABLE,     * force read-only      */
-        },
-        {
-                .name   = "kernel",             /* linux kernel image   */
-                .offset = 0x00060000,
-                .size   = 0x00100000,           /* 1 MiB                */
-                /*mask_flags: MTD_WRITEABLE,     * force read-only      */
-        },
-        {
-                .name   = "initrd",             /* ramdisk image        */
-                .offset = 0x00160000,
-                .size   = 0x00200000,           /* 2 MiB                */
-        },
-        {
-                .name   = "user",               /* user data            */
-                .offset = 0x00360000,
-                .size   = 0x000a0000,           /* remaining space      */
-                /* NOTE: this parttion size is re-calcated in           */
-                /* init_tqm834x_mtd() to cover actual remaining space.  */
-        },
-};
-
-/* Partition definition for the second flash bank which may be present on some
- * TQM834x boards.
- */
-static struct mtd_partition tqm834x_partitions_bank2[] = {
-        {
-                .name   = "jffs2",              /* jffs2 filesystem     */
-                .offset = 0x00000000,
-                .size   = 0x00400000,           /* whole device         */
-                /* NOTE: this parttion size is re-calcated in           */
-                /* init_tqm834x_mtd() to cover actual device size.      */
-        },
-};
-
-#endif  /* CONFIG_MTD_PARTITIONS */
-
-static int __init init_tqm834x_mtd(void)
-{
-        int idx = 0, ret = 0;
-        unsigned long flash_addr, flash_size, mtd_size = 0;
-
-        /* pointer to TQM834x board info data */
-        bd_t *bd = (bd_t *)__res;
-#ifdef CONFIG_MTD_CMDLINE_PARTS
-        int n;
-        char mtdid[4];
-        const char *part_probes[] = { "cmdlinepart", NULL };
-#endif
-
-        flash_addr = bd->bi_flashstart;
-        flash_size = bd->bi_flashsize;
-
-        /* request maximum flash size address space */
-        start_scan_addr = (unsigned long)ioremap(flash_addr, flash_size);
-        if (!start_scan_addr) {
-                printk("%s: Failed to ioremap address: 0x%lx\n",
-                       __FUNCTION__, flash_addr);
-                return -EIO;
-        }
-
-        for(idx = 0 ; idx < FLASH_BANK_MAX ; idx++) {
-                if (mtd_size >= flash_size)
-                        break;
-
-                pr_debug("%s: chip probing count %d\n", __FUNCTION__, idx);
-
-                map_banks[idx] = kzalloc(sizeof(struct map_info), GFP_KERNEL);
-                if (map_banks[idx] == NULL) {
-                        ret = -ENOMEM;
-                        goto error_mem;
-                }
-                map_banks[idx]->name = kzalloc(16, GFP_KERNEL);
-                if (map_banks[idx]->name == NULL) {
-                        ret = -ENOMEM;
-                        goto error_mem;
-                }
-
-                sprintf(map_banks[idx]->name, "TQM834x-%d", idx);
-                map_banks[idx]->size = flash_size;
-                map_banks[idx]->bankwidth = 4;
-
-                simple_map_init(map_banks[idx]);
-
-                map_banks[idx]->virt = (void __iomem *)
-                        (start_scan_addr + ((idx > 0) ?
-                        (mtd_banks[idx-1] ? mtd_banks[idx-1]->size : 0) : 0));
-                map_banks[idx]->phys =
-                        flash_addr + ((idx > 0) ?
-                        (mtd_banks[idx-1] ? mtd_banks[idx-1]->size : 0) : 0);
-
-                /* start to probe flash chips */
-                mtd_banks[idx] = do_map_probe("cfi_probe", map_banks[idx]);
-                if (mtd_banks[idx]) {
-                        mtd_banks[idx]->owner = THIS_MODULE;
-                        mtd_size += mtd_banks[idx]->size;
-                        num_banks++;
-                        pr_debug("%s: bank %ld, name: %s, size: %d bytes \n",
-                                 __FUNCTION__, num_banks,
-                                 mtd_banks[idx]->name, mtd_banks[idx]->size);
-                }
-        }
-
-        /* no supported flash chips found */
-        if (!num_banks) {
-                printk("TQM834x: No supported flash chips found!\n");
-                ret = -ENXIO;
-                goto error_mem;
-        }
-
-#ifdef CONFIG_MTD_PARTITIONS
-        /*
-         * Select static partition definitions
-         */
-        n = ARRAY_SIZE(tqm834x_partitions_bank1);
-        part_banks[0].mtd_part  = tqm834x_partitions_bank1;
-        part_banks[0].type      = "static image bank1";
-        part_banks[0].nums      = n;
-
-        /* update last partition size to cover actual remaining space */
-        tqm834x_partitions_bank1[n - 1].size =
-                mtd_banks[0]->size -
-                tqm834x_partitions_bank1[n - 1].offset;
-
-        /* check if we have second bank? */
-        if (num_banks == 2) {
-                n = ARRAY_SIZE(tqm834x_partitions_bank2);
-                part_banks[1].mtd_part  = tqm834x_partitions_bank2;
-                part_banks[1].type      = "static image bank2";
-                part_banks[1].nums      = n;
-
-                /* update last partition size to cover actual remaining space */
-                tqm834x_partitions_bank2[n - 1].size =
-                        mtd_banks[1]->size -
-                        tqm834x_partitions_bank2[n - 1].offset;
-        }
-
-        for(idx = 0; idx < num_banks ; idx++) {
-#ifdef CONFIG_MTD_CMDLINE_PARTS
-                sprintf(mtdid, "%d", idx);
-                n = parse_mtd_partitions(mtd_banks[idx],
-                                         part_probes,
-                                         &part_banks[idx].mtd_part,
-                                         0);
-                pr_debug("%s: %d command line partitions on bank %s\n",
-                         __FUNCTION__, n, mtdid);
-                if (n > 0) {
-                        part_banks[idx].type = "command line";
-                        part_banks[idx].nums = n;
-                }
-#endif  /* CONFIG_MTD_CMDLINE_PARTS */
-                if (part_banks[idx].nums == 0) {
-                        printk(KERN_NOTICE
-                               "TQM834x flash bank %d: no partition info "
-                               "available, registering whole device\n", idx);
-                        add_mtd_device(mtd_banks[idx]);
-                } else {
-                        printk(KERN_NOTICE
-                               "TQM834x flash bank %d: Using %s partition "
-                               "definition\n", idx, part_banks[idx].type);
-                        add_mtd_partitions(mtd_banks[idx],
-                                           part_banks[idx].mtd_part,
-                                           part_banks[idx].nums);
-                }
-        }
-#else   /* ! CONFIG_MTD_PARTITIONS */
-        printk(KERN_NOTICE "TQM834x flash: registering %d flash banks "
-                        "at once\n", num_banks);
-
-        for(idx = 0 ; idx < num_banks ; idx++)
-                add_mtd_device(mtd_banks[idx]);
-
-#endif  /* CONFIG_MTD_PARTITIONS */
-
-        return 0;
-error_mem:
-        for (idx = 0 ; idx < FLASH_BANK_MAX ; idx++) {
-                if (map_banks[idx] != NULL) {
-                        if (map_banks[idx]->name != NULL) {
-                                kfree(map_banks[idx]->name);
-                                map_banks[idx]->name = NULL;
-                        }
-                        kfree(map_banks[idx]);
-                        map_banks[idx] = NULL;
-                }
-        }
-
-        iounmap((void *)start_scan_addr);
-
-        return ret;
-}
-
-static void __exit cleanup_tqm834x_mtd(void)
-{
-        unsigned int idx = 0;
-        for(idx = 0 ; idx < num_banks ; idx++) {
-                /* destroy mtd_info previously allocated */
-                if (mtd_banks[idx]) {
-                        del_mtd_partitions(mtd_banks[idx]);
-                        map_destroy(mtd_banks[idx]);
-                }
-
-                /* release map_info not used anymore */
-                kfree(map_banks[idx]->name);
-                kfree(map_banks[idx]);
-        }
-
-        if (start_scan_addr) {
-                iounmap((void *)start_scan_addr);
-                start_scan_addr = 0;
-        }
-}
-
-module_init(init_tqm834x_mtd);
-module_exit(cleanup_tqm834x_mtd);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Wolfgang Denk <wd@denx.de>");
-MODULE_DESCRIPTION("MTD map driver for TQM834x boards");
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index ef89780eb9d6..74d9d30edabd 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -24,10 +24,9 @@
 #include <linux/kthread.h>
 #include <asm/uaccess.h>
 
-static LIST_HEAD(blktrans_majors);
+#include "mtdcore.h"
 
-extern struct mutex mtd_table_mutex;
-extern struct mtd_info *mtd_table[];
+static LIST_HEAD(blktrans_majors);
 
 struct mtd_blkcore_priv {
         struct task_struct *thread;
@@ -202,7 +201,7 @@ static int blktrans_ioctl(struct inode *inode, struct file *file,
         }
 }
 
-struct block_device_operations mtd_blktrans_ops = {
+static struct block_device_operations mtd_blktrans_ops = {
         .owner          = THIS_MODULE,
         .open           = blktrans_open,
         .release        = blktrans_release,
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index d091b2430b48..22ed96c4b7bd 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -136,7 +136,8 @@ static int mtd_close(struct inode *inode, struct file *file)
 
         DEBUG(MTD_DEBUG_LEVEL0, "MTD_close\n");
 
-        if (mtd->sync)
+        /* Only sync if opened RW */
+        if ((file->f_mode & 2) && mtd->sync)
                 mtd->sync(mtd);
 
         put_mtd_device(mtd);
diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c
index 41844ea02462..96be7ef62f35 100644
--- a/drivers/mtd/mtdconcat.c
+++ b/drivers/mtd/mtdconcat.c
@@ -178,7 +178,7 @@ concat_writev(struct mtd_info *mtd, const struct kvec *vecs,
 
         /* Check alignment */
         if (mtd->writesize > 1) {
-                loff_t __to = to;
+                uint64_t __to = to;
                 if (do_div(__to, mtd->writesize) || (total_len % mtd->writesize))
                         return -EINVAL;
         }
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index c153b64a8300..6c2645e28371 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -22,6 +22,8 @@
 
 #include <linux/mtd/mtd.h>
 
+#include "mtdcore.h"
+
 /* These are exported solely for the purpose of mtd_blkdevs.c. You
    should not use them for _anything_ else */
 DEFINE_MUTEX(mtd_table_mutex);
diff --git a/drivers/mtd/mtdcore.h b/drivers/mtd/mtdcore.h
new file mode 100644
index 000000000000..a33251f4b872
--- /dev/null
+++ b/drivers/mtd/mtdcore.h
@@ -0,0 +1,11 @@
+/* linux/drivers/mtd/mtdcore.h
+ *
+ * Header file for driver private mtdcore exports
+ *
+ */
+
+/* These are exported solely for the purpose of mtd_blkdevs.c. You
+   should not use them for _anything_ else */
+
+extern struct mutex mtd_table_mutex;
+extern struct mtd_info *mtd_table[MAX_MTD_DEVICES];
diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
new file mode 100644
index 000000000000..f8af627f0b98
--- /dev/null
+++ b/drivers/mtd/mtdoops.c
@@ -0,0 +1,376 @@
+/*
+ * MTD Oops/Panic logger
+ *
+ * Copyright (C) 2007 Nokia Corporation. All rights reserved.
+ *
+ * Author: Richard Purdie <rpurdie@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/console.h>
+#include <linux/vmalloc.h>
+#include <linux/workqueue.h>
+#include <linux/sched.h>
+#include <linux/wait.h>
+#include <linux/mtd/mtd.h>
+
+#define OOPS_PAGE_SIZE 4096
+
+static struct mtdoops_context {
+        int mtd_index;
+        struct work_struct work;
+        struct mtd_info *mtd;
+        int oops_pages;
+        int nextpage;
+        int nextcount;
+
+        void *oops_buf;
+        int ready;
+        int writecount;
+} oops_cxt;
+
+static void mtdoops_erase_callback(struct erase_info *done)
+{
+        wait_queue_head_t *wait_q = (wait_queue_head_t *)done->priv;
+        wake_up(wait_q);
+}
+
+static int mtdoops_erase_block(struct mtd_info *mtd, int offset)
+{
+        struct erase_info erase;
+        DECLARE_WAITQUEUE(wait, current);
+        wait_queue_head_t wait_q;
+        int ret;
+
+        init_waitqueue_head(&wait_q);
+        erase.mtd = mtd;
+        erase.callback = mtdoops_erase_callback;
+        erase.addr = offset;
+        if (mtd->erasesize < OOPS_PAGE_SIZE)
+                erase.len = OOPS_PAGE_SIZE;
+        else
+                erase.len = mtd->erasesize;
+        erase.priv = (u_long)&wait_q;
+
+        set_current_state(TASK_INTERRUPTIBLE);
+        add_wait_queue(&wait_q, &wait);
+
+        ret = mtd->erase(mtd, &erase);
+        if (ret) {
+                set_current_state(TASK_RUNNING);
+                remove_wait_queue(&wait_q, &wait);
+                printk (KERN_WARNING "mtdoops: erase of region [0x%x, 0x%x] "
+                                     "on \"%s\" failed\n",
+                        erase.addr, erase.len, mtd->name);
+                return ret;
+        }
+
+        schedule();  /* Wait for erase to finish. */
+        remove_wait_queue(&wait_q, &wait);
+
+        return 0;
+}
+
+static int mtdoops_inc_counter(struct mtdoops_context *cxt)
+{
+        struct mtd_info *mtd = cxt->mtd;
+        size_t retlen;
+        u32 count;
+        int ret;
+
+        cxt->nextpage++;
+        if (cxt->nextpage > cxt->oops_pages)
+                cxt->nextpage = 0;
+        cxt->nextcount++;
+        if (cxt->nextcount == 0xffffffff)
+                cxt->nextcount = 0;
+
+        ret = mtd->read(mtd, cxt->nextpage * OOPS_PAGE_SIZE, 4,
+                        &retlen, (u_char *) &count);
+        if ((retlen != 4) || (ret < 0)) {
+                printk(KERN_ERR "mtdoops: Read failure at %d (%td of 4 read)"
+                                ", err %d.\n", cxt->nextpage * OOPS_PAGE_SIZE,
+                                retlen, ret);
+                return 1;
+        }
+
+        /* See if we need to erase the next block */
+        if (count != 0xffffffff)
+                return 1;
+
+        printk(KERN_DEBUG "mtdoops: Ready %d, %d (no erase)\n",
+                        cxt->nextpage, cxt->nextcount);
+        cxt->ready = 1;
+        return 0;
+}
+
+static void mtdoops_prepare(struct mtdoops_context *cxt)
+{
+        struct mtd_info *mtd = cxt->mtd;
+        int i = 0, j, ret, mod;
+
+        /* We were unregistered */
+        if (!mtd)
+                return;
+
+        mod = (cxt->nextpage * OOPS_PAGE_SIZE) % mtd->erasesize;
+        if (mod != 0) {
+                cxt->nextpage = cxt->nextpage + ((mtd->erasesize - mod) / OOPS_PAGE_SIZE);
+                if (cxt->nextpage > cxt->oops_pages)
+                        cxt->nextpage = 0;
+        }
+
+        while (mtd->block_isbad &&
+                        mtd->block_isbad(mtd, cxt->nextpage * OOPS_PAGE_SIZE)) {
+badblock:
+                printk(KERN_WARNING "mtdoops: Bad block at %08x\n",
+                                cxt->nextpage * OOPS_PAGE_SIZE);
+                i++;
+                cxt->nextpage = cxt->nextpage + (mtd->erasesize / OOPS_PAGE_SIZE);
+                if (cxt->nextpage > cxt->oops_pages)
+                        cxt->nextpage = 0;
+                if (i == (cxt->oops_pages / (mtd->erasesize / OOPS_PAGE_SIZE))) {
+                        printk(KERN_ERR "mtdoops: All blocks bad!\n");
+                        return;
+                }
+        }
+
+        for (j = 0, ret = -1; (j < 3) && (ret < 0); j++)
+                ret = mtdoops_erase_block(mtd, cxt->nextpage * OOPS_PAGE_SIZE);
+
+        if (ret < 0) {
+                if (mtd->block_markbad)
+                        mtd->block_markbad(mtd, cxt->nextpage * OOPS_PAGE_SIZE);
+                goto badblock;
+        }
+
+        printk(KERN_DEBUG "mtdoops: Ready %d, %d \n", cxt->nextpage, cxt->nextcount);
+
+        cxt->ready = 1;
+}
+
+static void mtdoops_workfunc(struct work_struct *work)
+{
+        struct mtdoops_context *cxt =
+                        container_of(work, struct mtdoops_context, work);
+
+        mtdoops_prepare(cxt);
+}
+
+static int find_next_position(struct mtdoops_context *cxt)
+{
+        struct mtd_info *mtd = cxt->mtd;
+        int page, maxpos = 0;
+        u32 count, maxcount = 0xffffffff;
+        size_t retlen;
+
+        for (page = 0; page < cxt->oops_pages; page++) {
+                mtd->read(mtd, page * OOPS_PAGE_SIZE, 4, &retlen, (u_char *) &count);
+                if (count == 0xffffffff)
+                        continue;
+                if (maxcount == 0xffffffff) {
+                        maxcount = count;
+                        maxpos = page;
+                } else if ((count < 0x40000000) && (maxcount > 0xc0000000)) {
+                        maxcount = count;
+                        maxpos = page;
+                } else if ((count > maxcount) && (count < 0xc0000000)) {
+                        maxcount = count;
+                        maxpos = page;
+                } else if ((count > maxcount) && (count > 0xc0000000)
+                                        && (maxcount > 0x80000000)) {
+                        maxcount = count;
+                        maxpos = page;
+                }
+        }
+        if (maxcount == 0xffffffff) {
+                cxt->nextpage = 0;
+                cxt->nextcount = 1;
+                cxt->ready = 1;
+                printk(KERN_DEBUG "mtdoops: Ready %d, %d (first init)\n",
+                                cxt->nextpage, cxt->nextcount);
+                return 0;
+        }
+
+        cxt->nextpage = maxpos;
+        cxt->nextcount = maxcount;
+
+        return mtdoops_inc_counter(cxt);
+}
+
+
+static void mtdoops_notify_add(struct mtd_info *mtd)
+{
+        struct mtdoops_context *cxt = &oops_cxt;
+        int ret;
+
+        if ((mtd->index != cxt->mtd_index) || cxt->mtd_index < 0)
+                return;
+
+        if (mtd->size < (mtd->erasesize * 2)) {
+                printk(KERN_ERR "MTD partition %d not big enough for mtdoops\n",
+                                mtd->index);
+                return;
+        }
+
+        cxt->mtd = mtd;
+        cxt->oops_pages = mtd->size / OOPS_PAGE_SIZE;
+
+        ret = find_next_position(cxt);
+        if (ret == 1)
+                mtdoops_prepare(cxt);
+
+        printk(KERN_DEBUG "mtdoops: Attached to MTD device %d\n", mtd->index);
+}
+
+static void mtdoops_notify_remove(struct mtd_info *mtd)
+{
+        struct mtdoops_context *cxt = &oops_cxt;
+
+        if ((mtd->index != cxt->mtd_index) || cxt->mtd_index < 0)
+                return;
+
+        cxt->mtd = NULL;
+        flush_scheduled_work();
+}
+
+static void mtdoops_console_sync(void)
+{
+        struct mtdoops_context *cxt = &oops_cxt;
+        struct mtd_info *mtd = cxt->mtd;
+        size_t retlen;
+        int ret;
+
+        if (!cxt->ready || !mtd)
+                return;
+
+        if (cxt->writecount == 0)
+                return;
+
+        if (cxt->writecount < OOPS_PAGE_SIZE)
+                memset(cxt->oops_buf + cxt->writecount, 0xff,
+                                        OOPS_PAGE_SIZE - cxt->writecount);
+
+        ret = mtd->write(mtd, cxt->nextpage * OOPS_PAGE_SIZE,
+                                        OOPS_PAGE_SIZE, &retlen, cxt->oops_buf);
+        cxt->ready = 0;
+        cxt->writecount = 0;
+
+        if ((retlen != OOPS_PAGE_SIZE) || (ret < 0))
+                printk(KERN_ERR "mtdoops: Write failure at %d (%td of %d written), err %d.\n",
+                        cxt->nextpage * OOPS_PAGE_SIZE, retlen, OOPS_PAGE_SIZE, ret);
+
+        ret = mtdoops_inc_counter(cxt);
+        if (ret == 1)
+                schedule_work(&cxt->work);
+}
+
+static void
+mtdoops_console_write(struct console *co, const char *s, unsigned int count)
+{
+        struct mtdoops_context *cxt = co->data;
+        struct mtd_info *mtd = cxt->mtd;
+        int i;
+
+        if (!oops_in_progress) {
+                mtdoops_console_sync();
+                return;
+        }
+
+        if (!cxt->ready || !mtd)
+                return;
+
+        if (cxt->writecount == 0) {
+                u32 *stamp = cxt->oops_buf;
+                *stamp = cxt->nextcount;
+                cxt->writecount = 4;
+        }
+
+        if ((count + cxt->writecount) > OOPS_PAGE_SIZE)
+                count = OOPS_PAGE_SIZE - cxt->writecount;
+
+        for (i = 0; i < count; i++, s++)
+                *((char *)(cxt->oops_buf) + cxt->writecount + i) = *s;
+
+        cxt->writecount = cxt->writecount + count;
+}
+
+static int __init mtdoops_console_setup(struct console *co, char *options)
+{
+        struct mtdoops_context *cxt = co->data;
+
+        if (cxt->mtd_index != -1)
+                return -EBUSY;
+        if (co->index == -1)
+                return -EINVAL;
+
+        cxt->mtd_index = co->index;
+        return 0;
+}
+
+static struct mtd_notifier mtdoops_notifier = {
+        .add    = mtdoops_notify_add,
+        .remove = mtdoops_notify_remove,
+};
+
+static struct console mtdoops_console = {
+        .name           = "ttyMTD",
+        .write          = mtdoops_console_write,
+        .setup          = mtdoops_console_setup,
+        .unblank        = mtdoops_console_sync,
+        .flags          = CON_PRINTBUFFER,
+        .index          = -1,
+        .data           = &oops_cxt,
+};
+
+static int __init mtdoops_console_init(void)
+{
+        struct mtdoops_context *cxt = &oops_cxt;
+
+        cxt->mtd_index = -1;
+        cxt->oops_buf = vmalloc(OOPS_PAGE_SIZE);
+
+        if (!cxt->oops_buf) {
+                printk(KERN_ERR "Failed to allocate oops buffer workspace\n");
+                return -ENOMEM;
+        }
+
+        INIT_WORK(&cxt->work, mtdoops_workfunc);
+
+        register_console(&mtdoops_console);
+        register_mtd_user(&mtdoops_notifier);
+        return 0;
+}
+
+static void __exit mtdoops_console_exit(void)
+{
+        struct mtdoops_context *cxt = &oops_cxt;
+
+        unregister_mtd_user(&mtdoops_notifier);
+        unregister_console(&mtdoops_console);
+        vfree(cxt->oops_buf);
+}
+
+
+subsys_initcall(mtdoops_console_init);
+module_exit(mtdoops_console_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Richard Purdie <rpurdie@openedhand.com>");
+MODULE_DESCRIPTION("MTD Oops/Panic console logger/driver");
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index f1d60b6f048e..8f9c3baeb38e 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -91,6 +91,25 @@ config MTD_NAND_AU1550
           This enables the driver for the NAND flash controller on the
           AMD/Alchemy 1550 SOC.
 
+config MTD_NAND_BF5XX
+        tristate "Blackfin on-chip NAND Flash Controller driver"
+        depends on BF54x && MTD_NAND
+        help
+          This enables the Blackfin on-chip NAND flash controller
+
+          No board specific support is done by this driver, each board
+          must advertise a platform_device for the driver to attach.
+
+          This driver can also be built as a module. If so, the module
+          will be called bf5xx-nand.
+
+config MTD_NAND_BF5XX_HWECC
+        bool "BF5XX NAND Hardware ECC"
+        depends on MTD_NAND_BF5XX
+        help
+          Enable the use of the BF5XX's internal ECC generator when
+          using NAND.
+
 config MTD_NAND_RTC_FROM4
         tristate "Renesas Flash ROM 4-slot interface board (FROM_BOARD4)"
         depends on SH_SOLUTION_ENGINE
@@ -134,10 +153,10 @@ config MTD_NAND_S3C2410_HWECC
 
 config MTD_NAND_NDFC
         tristate "NDFC NanD Flash Controller"
-        depends on 44x
+        depends on 4xx && !PPC_MERGE
         select MTD_NAND_ECC_SMC
         help
-         NDFC Nand Flash Controllers are integrated in EP44x SoCs
+         NDFC Nand Flash Controllers are integrated in IBM/AMCC's 4xx SoCs
 
 config MTD_NAND_S3C2410_CLKSTOP
         bool "S3C2410 NAND IDLE clock stop"
@@ -237,7 +256,7 @@ config MTD_NAND_CAFE
         select REED_SOLOMON
         select REED_SOLOMON_DEC16
         help
-          Use NAND flash attached to the CAFÉ chip designed for the $100
+          Use NAND flash attached to the CAFÉ chip designed for the OLPC
           laptop.
 
 config MTD_NAND_CS553X
@@ -280,5 +299,11 @@ config MTD_NAND_PLATFORM
           devices. You will need to provide platform-specific functions
           via platform_data.
 
+config MTD_ALAUDA
+        tristate "MTD driver for Olympus MAUSB-10 and Fijufilm DPC-R1"
+        depends on MTD_NAND && USB
+        help
+          These two (and possibly other) Alauda-based cardreaders for
+          SmartMedia and xD allow raw flash access.
 
 endif # MTD_NAND
diff --git a/drivers/mtd/nand/Makefile b/drivers/mtd/nand/Makefile
index edba1db14bfa..3ad6c0165da3 100644
--- a/drivers/mtd/nand/Makefile
+++ b/drivers/mtd/nand/Makefile
@@ -13,6 +13,7 @@ obj-$(CONFIG_MTD_NAND_TOTO)		+= toto.o
 obj-$(CONFIG_MTD_NAND_AUTCPU12)         += autcpu12.o
 obj-$(CONFIG_MTD_NAND_EDB7312)          += edb7312.o
 obj-$(CONFIG_MTD_NAND_AU1550)           += au1550nd.o
+obj-$(CONFIG_MTD_NAND_BF5XX)            += bf5xx_nand.o
 obj-$(CONFIG_MTD_NAND_PPCHAMELEONEVB)   += ppchameleonevb.o
 obj-$(CONFIG_MTD_NAND_S3C2410)          += s3c2410.o
 obj-$(CONFIG_MTD_NAND_DISKONCHIP)       += diskonchip.o
@@ -27,5 +28,6 @@ obj-$(CONFIG_MTD_NAND_AT91)		+= at91_nand.o
 obj-$(CONFIG_MTD_NAND_CM_X270)          += cmx270_nand.o
 obj-$(CONFIG_MTD_NAND_BASLER_EXCITE)    += excite_nandflash.o
 obj-$(CONFIG_MTD_NAND_PLATFORM)         += plat_nand.o
+obj-$(CONFIG_MTD_ALAUDA)                += alauda.o
 
 nand-objs := nand_base.o nand_bbt.o
diff --git a/drivers/mtd/nand/alauda.c b/drivers/mtd/nand/alauda.c
new file mode 100644
index 000000000000..257937cd99bf
--- /dev/null
+++ b/drivers/mtd/nand/alauda.c
@@ -0,0 +1,742 @@
+/*
+ * MTD driver for Alauda chips
+ *
+ * Copyright (C) 2007 Joern Engel <joern@logfs.org>
+ *
+ * Based on drivers/usb/usb-skeleton.c which is:
+ * Copyright (C) 2001-2004 Greg Kroah-Hartman (greg@kroah.com)
+ * and on drivers/usb/storage/alauda.c, which is:
+ *   (c) 2005 Daniel Drake <dsd@gentoo.org>
+ *
+ * Idea and initial work by Arnd Bergmann <arnd@arndb.de>
+ */
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kref.h>
+#include <linux/usb.h>
+#include <linux/mutex.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/nand_ecc.h>
+
+/* Control commands */
+#define ALAUDA_GET_XD_MEDIA_STATUS      0x08
+#define ALAUDA_ACK_XD_MEDIA_CHANGE      0x0a
+#define ALAUDA_GET_XD_MEDIA_SIG         0x86
+
+/* Common prefix */
+#define ALAUDA_BULK_CMD                 0x40
+
+/* The two ports */
+#define ALAUDA_PORT_XD                  0x00
+#define ALAUDA_PORT_SM                  0x01
+
+/* Bulk commands */
+#define ALAUDA_BULK_READ_PAGE           0x84
+#define ALAUDA_BULK_READ_OOB            0x85 /* don't use, there's a chip bug */
+#define ALAUDA_BULK_READ_BLOCK          0x94
+#define ALAUDA_BULK_ERASE_BLOCK         0xa3
+#define ALAUDA_BULK_WRITE_PAGE          0xa4
+#define ALAUDA_BULK_WRITE_BLOCK         0xb4
+#define ALAUDA_BULK_RESET_MEDIA         0xe0
+
+/* Address shifting */
+#define PBA_LO(pba) ((pba & 0xF) << 5)
+#define PBA_HI(pba) (pba >> 3)
+#define PBA_ZONE(pba) (pba >> 11)
+
+#define TIMEOUT HZ
+
+static struct usb_device_id alauda_table [] = {
+        { USB_DEVICE(0x0584, 0x0008) }, /* Fujifilm DPC-R1 */
+        { USB_DEVICE(0x07b4, 0x010a) }, /* Olympus MAUSB-10 */
+        { }
+};
+MODULE_DEVICE_TABLE(usb, alauda_table);
+
+struct alauda_card {
+        u8      id;             /* id byte */
+        u8      chipshift;      /* 1<<chipshift total size */
+        u8      pageshift;      /* 1<<pageshift page size */
+        u8      blockshift;     /* 1<<blockshift block size */
+};
+
+struct alauda {
+        struct usb_device       *dev;
+        struct usb_interface    *interface;
+        struct mtd_info         *mtd;
+        struct alauda_card      *card;
+        struct mutex            card_mutex;
+        u32                     pagemask;
+        u32                     bytemask;
+        u32                     blockmask;
+        unsigned int            write_out;
+        unsigned int            bulk_in;
+        unsigned int            bulk_out;
+        u8                      port;
+        struct kref             kref;
+};
+
+static struct alauda_card alauda_card_ids[] = {
+        /* NAND flash */
+        { 0x6e, 20, 8, 12},     /* 1 MB */
+        { 0xe8, 20, 8, 12},     /* 1 MB */
+        { 0xec, 20, 8, 12},     /* 1 MB */
+        { 0x64, 21, 8, 12},     /* 2 MB */
+        { 0xea, 21, 8, 12},     /* 2 MB */
+        { 0x6b, 22, 9, 13},     /* 4 MB */
+        { 0xe3, 22, 9, 13},     /* 4 MB */
+        { 0xe5, 22, 9, 13},     /* 4 MB */
+        { 0xe6, 23, 9, 13},     /* 8 MB */
+        { 0x73, 24, 9, 14},     /* 16 MB */
+        { 0x75, 25, 9, 14},     /* 32 MB */
+        { 0x76, 26, 9, 14},     /* 64 MB */
+        { 0x79, 27, 9, 14},     /* 128 MB */
+        { 0x71, 28, 9, 14},     /* 256 MB */
+
+        /* MASK ROM */
+        { 0x5d, 21, 9, 13},     /* 2 MB */
+        { 0xd5, 22, 9, 13},     /* 4 MB */
+        { 0xd6, 23, 9, 13},     /* 8 MB */
+        { 0x57, 24, 9, 13},     /* 16 MB */
+        { 0x58, 25, 9, 13},     /* 32 MB */
+        { }
+};
+
+static struct alauda_card *get_card(u8 id)
+{
+        struct alauda_card *card;
+
+        for (card = alauda_card_ids; card->id; card++)
+                if (card->id == id)
+                        return card;
+        return NULL;
+}
+
+static void alauda_delete(struct kref *kref)
+{
+        struct alauda *al = container_of(kref, struct alauda, kref);
+
+        if (al->mtd) {
+                del_mtd_device(al->mtd);
+                kfree(al->mtd);
+        }
+        usb_put_dev(al->dev);
+        kfree(al);
+}
+
+static int alauda_get_media_status(struct alauda *al, void *buf)
+{
+        int ret;
+
+        mutex_lock(&al->card_mutex);
+        ret = usb_control_msg(al->dev, usb_rcvctrlpipe(al->dev, 0),
+                        ALAUDA_GET_XD_MEDIA_STATUS, 0xc0, 0, 1, buf, 2, HZ);
+        mutex_unlock(&al->card_mutex);
+        return ret;
+}
+
+static int alauda_ack_media(struct alauda *al)
+{
+        int ret;
+
+        mutex_lock(&al->card_mutex);
+        ret = usb_control_msg(al->dev, usb_sndctrlpipe(al->dev, 0),
+                        ALAUDA_ACK_XD_MEDIA_CHANGE, 0x40, 0, 1, NULL, 0, HZ);
+        mutex_unlock(&al->card_mutex);
+        return ret;
+}
+
+static int alauda_get_media_signatures(struct alauda *al, void *buf)
+{
+        int ret;
+
+        mutex_lock(&al->card_mutex);
+        ret = usb_control_msg(al->dev, usb_rcvctrlpipe(al->dev, 0),
+                        ALAUDA_GET_XD_MEDIA_SIG, 0xc0, 0, 0, buf, 4, HZ);
+        mutex_unlock(&al->card_mutex);
+        return ret;
+}
+
+static void alauda_reset(struct alauda *al)
+{
+        u8 command[] = {
+                ALAUDA_BULK_CMD, ALAUDA_BULK_RESET_MEDIA, 0, 0,
+                0, 0, 0, 0, al->port
+        };
+        mutex_lock(&al->card_mutex);
+        usb_bulk_msg(al->dev, al->bulk_out, command, 9, NULL, HZ);
+        mutex_unlock(&al->card_mutex);
+}
+
+static void correct_data(void *buf, void *read_ecc,
+                int *corrected, int *uncorrected)
+{
+        u8 calc_ecc[3];
+        int err;
+
+        nand_calculate_ecc(NULL, buf, calc_ecc);
+        err = nand_correct_data(NULL, buf, read_ecc, calc_ecc);
+        if (err) {
+                if (err > 0)
+                        (*corrected)++;
+                else
+                        (*uncorrected)++;
+        }
+}
+
+struct alauda_sg_request {
+        struct urb *urb[3];
+        struct completion comp;
+};
+
+static void alauda_complete(struct urb *urb)
+{
+        struct completion *comp = urb->context;
+
+        if (comp)
+                complete(comp);
+}
+
+static int __alauda_read_page(struct mtd_info *mtd, loff_t from, void *buf,
+                void *oob)
+{
+        struct alauda_sg_request sg;
+        struct alauda *al = mtd->priv;
+        u32 pba = from >> al->card->blockshift;
+        u32 page = (from >> al->card->pageshift) & al->pagemask;
+        u8 command[] = {
+                ALAUDA_BULK_CMD, ALAUDA_BULK_READ_PAGE, PBA_HI(pba),
+                PBA_ZONE(pba), 0, PBA_LO(pba) + page, 1, 0, al->port
+        };
+        int i, err;
+
+        for (i=0; i<3; i++)
+                sg.urb[i] = NULL;
+
+        err = -ENOMEM;
+        for (i=0; i<3; i++) {
+                sg.urb[i] = usb_alloc_urb(0, GFP_NOIO);
+                if (!sg.urb[i])
+                        goto out;
+        }
+        init_completion(&sg.comp);
+        usb_fill_bulk_urb(sg.urb[0], al->dev, al->bulk_out, command, 9,
+                        alauda_complete, NULL);
+        usb_fill_bulk_urb(sg.urb[1], al->dev, al->bulk_in, buf, mtd->writesize,
+                        alauda_complete, NULL);
+        usb_fill_bulk_urb(sg.urb[2], al->dev, al->bulk_in, oob, 16,
+                        alauda_complete, &sg.comp);
+
+        mutex_lock(&al->card_mutex);
+        for (i=0; i<3; i++) {
+                err = usb_submit_urb(sg.urb[i], GFP_NOIO);
+                if (err)
+                        goto cancel;
+        }
+        if (!wait_for_completion_timeout(&sg.comp, TIMEOUT)) {
+                err = -ETIMEDOUT;
+cancel:
+                for (i=0; i<3; i++) {
+                        usb_kill_urb(sg.urb[i]);
+                }
+        }
+        mutex_unlock(&al->card_mutex);
+
+out:
+        usb_free_urb(sg.urb[0]);
+        usb_free_urb(sg.urb[1]);
+        usb_free_urb(sg.urb[2]);
+        return err;
+}
+
+static int alauda_read_page(struct mtd_info *mtd, loff_t from,
+                void *buf, u8 *oob, int *corrected, int *uncorrected)
+{
+        int err;
+
+        err = __alauda_read_page(mtd, from, buf, oob);
+        if (err)
+                return err;
+        correct_data(buf, oob+13, corrected, uncorrected);
+        correct_data(buf+256, oob+8, corrected, uncorrected);
+        return 0;
+}
+
+static int alauda_write_page(struct mtd_info *mtd, loff_t to, void *buf,
+                void *oob)
+{
+        struct alauda_sg_request sg;
+        struct alauda *al = mtd->priv;
+        u32 pba = to >> al->card->blockshift;
+        u32 page = (to >> al->card->pageshift) & al->pagemask;
+        u8 command[] = {
+                ALAUDA_BULK_CMD, ALAUDA_BULK_WRITE_PAGE, PBA_HI(pba),
+                PBA_ZONE(pba), 0, PBA_LO(pba) + page, 32, 0, al->port
+        };
+        int i, err;
+
+        for (i=0; i<3; i++)
+                sg.urb[i] = NULL;
+
+        err = -ENOMEM;
+        for (i=0; i<3; i++) {
+                sg.urb[i] = usb_alloc_urb(0, GFP_NOIO);
+                if (!sg.urb[i])
+                        goto out;
+        }
+        init_completion(&sg.comp);
+        usb_fill_bulk_urb(sg.urb[0], al->dev, al->bulk_out, command, 9,
+                        alauda_complete, NULL);
+        usb_fill_bulk_urb(sg.urb[1], al->dev, al->write_out, buf,mtd->writesize,
+                        alauda_complete, NULL);
+        usb_fill_bulk_urb(sg.urb[2], al->dev, al->write_out, oob, 16,
+                        alauda_complete, &sg.comp);
+
+        mutex_lock(&al->card_mutex);
+        for (i=0; i<3; i++) {
+                err = usb_submit_urb(sg.urb[i], GFP_NOIO);
+                if (err)
+                        goto cancel;
+        }
+        if (!wait_for_completion_timeout(&sg.comp, TIMEOUT)) {
+                err = -ETIMEDOUT;
+cancel:
+                for (i=0; i<3; i++) {
+                        usb_kill_urb(sg.urb[i]);
+                }
+        }
+        mutex_unlock(&al->card_mutex);
+
+out:
+        usb_free_urb(sg.urb[0]);
+        usb_free_urb(sg.urb[1]);
+        usb_free_urb(sg.urb[2]);
+        return err;
+}
+
+static int alauda_erase_block(struct mtd_info *mtd, loff_t ofs)
+{
+        struct alauda_sg_request sg;
+        struct alauda *al = mtd->priv;
+        u32 pba = ofs >> al->card->blockshift;
+        u8 command[] = {
+                ALAUDA_BULK_CMD, ALAUDA_BULK_ERASE_BLOCK, PBA_HI(pba),
+                PBA_ZONE(pba), 0, PBA_LO(pba), 0x02, 0, al->port
+        };
+        u8 buf[2];
+        int i, err;
+
+        for (i=0; i<2; i++)
+                sg.urb[i] = NULL;
+
+        err = -ENOMEM;
+        for (i=0; i<2; i++) {
+                sg.urb[i] = usb_alloc_urb(0, GFP_NOIO);
+                if (!sg.urb[i])
+                        goto out;
+        }
+        init_completion(&sg.comp);
+        usb_fill_bulk_urb(sg.urb[0], al->dev, al->bulk_out, command, 9,
+                        alauda_complete, NULL);
+        usb_fill_bulk_urb(sg.urb[1], al->dev, al->bulk_in, buf, 2,
+                        alauda_complete, &sg.comp);
+
+        mutex_lock(&al->card_mutex);
+        for (i=0; i<2; i++) {
+                err = usb_submit_urb(sg.urb[i], GFP_NOIO);
+                if (err)
+                        goto cancel;
+        }
+        if (!wait_for_completion_timeout(&sg.comp, TIMEOUT)) {
+                err = -ETIMEDOUT;
+cancel:
+                for (i=0; i<2; i++) {
+                        usb_kill_urb(sg.urb[i]);
+                }
+        }
+        mutex_unlock(&al->card_mutex);
+
+out:
+        usb_free_urb(sg.urb[0]);
+        usb_free_urb(sg.urb[1]);
+        return err;
+}
+
+static int alauda_read_oob(struct mtd_info *mtd, loff_t from, void *oob)
+{
+        static u8 ignore_buf[512]; /* write only */
+
+        return __alauda_read_page(mtd, from, ignore_buf, oob);
+}
+
+static int popcount8(u8 c)
+{
+        int ret = 0;
+
+        for ( ; c; c>>=1)
+                ret += c & 1;
+        return ret;
+}
+
+static int alauda_isbad(struct mtd_info *mtd, loff_t ofs)
+{
+        u8 oob[16];
+        int err;
+
+        err = alauda_read_oob(mtd, ofs, oob);
+        if (err)
+                return err;
+
+        /* A block is marked bad if two or more bits are zero */
+        return popcount8(oob[5]) >= 7 ? 0 : 1;
+}
+
+static int alauda_bounce_read(struct mtd_info *mtd, loff_t from, size_t len,
+                size_t *retlen, u_char *buf)
+{
+        struct alauda *al = mtd->priv;
+        void *bounce_buf;
+        int err, corrected=0, uncorrected=0;
+
+        bounce_buf = kmalloc(mtd->writesize, GFP_KERNEL);
+        if (!bounce_buf)
+                return -ENOMEM;
+
+        *retlen = len;
+        while (len) {
+                u8 oob[16];
+                size_t byte = from & al->bytemask;
+                size_t cplen = min(len, mtd->writesize - byte);
+
+                err = alauda_read_page(mtd, from, bounce_buf, oob,
+                                &corrected, &uncorrected);
+                if (err)
+                        goto out;
+
+                memcpy(buf, bounce_buf + byte, cplen);
+                buf += cplen;
+                from += cplen;
+                len -= cplen;
+        }
+        err = 0;
+        if (corrected)
+                err = -EUCLEAN;
+        if (uncorrected)
+                err = -EBADMSG;
+out:
+        kfree(bounce_buf);
+        return err;
+}
+
+static int alauda_read(struct mtd_info *mtd, loff_t from, size_t len,
+                size_t *retlen, u_char *buf)
+{
+        struct alauda *al = mtd->priv;
+        int err, corrected=0, uncorrected=0;
+
+        if ((from & al->bytemask) || (len & al->bytemask))
+                return alauda_bounce_read(mtd, from, len, retlen, buf);
+
+        *retlen = len;
+        while (len) {
+                u8 oob[16];
+
+                err = alauda_read_page(mtd, from, buf, oob,
+                                &corrected, &uncorrected);
+                if (err)
+                        return err;
+
+                buf += mtd->writesize;
+                from += mtd->writesize;
+                len -= mtd->writesize;
+        }
+        err = 0;
+        if (corrected)
+                err = -EUCLEAN;
+        if (uncorrected)
+                err = -EBADMSG;
+        return err;
+}
+
+static int alauda_write(struct mtd_info *mtd, loff_t to, size_t len,
+                size_t *retlen, const u_char *buf)
+{
+        struct alauda *al = mtd->priv;
+        int err;
+
+        if ((to & al->bytemask) || (len & al->bytemask))
+                return -EINVAL;
+
+        *retlen = len;
+        while (len) {
+                u32 page = (to >> al->card->pageshift) & al->pagemask;
+                u8 oob[16] = {  'h', 'e', 'l', 'l', 'o', 0xff, 0xff, 0xff,
+                                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
+                /* don't write to bad blocks */
+                if (page == 0) {
+                        err = alauda_isbad(mtd, to);
+                        if (err) {
+                                return -EIO;
+                        }
+                }
+                nand_calculate_ecc(mtd, buf, &oob[13]);
+                nand_calculate_ecc(mtd, buf+256, &oob[8]);
+
+                err = alauda_write_page(mtd, to, (void*)buf, oob);
+                if (err)
+                        return err;
+
+                buf += mtd->writesize;
+                to += mtd->writesize;
+                len -= mtd->writesize;
+        }
+        return 0;
+}
+
+static int __alauda_erase(struct mtd_info *mtd, struct erase_info *instr)
+{
+        struct alauda *al = mtd->priv;
+        u32 ofs = instr->addr;
+        u32 len = instr->len;
+        int err;
+
+        if ((ofs & al->blockmask) || (len & al->blockmask))
+                return -EINVAL;
+
+        while (len) {
+                /* don't erase bad blocks */
+                err = alauda_isbad(mtd, ofs);
+                if (err > 0)
+                        err = -EIO;
+                if (err < 0)
+                        return err;
+
+                err = alauda_erase_block(mtd, ofs);
+                if (err < 0)
+                        return err;
+
+                ofs += mtd->erasesize;
+                len -= mtd->erasesize;
+        }
+        return 0;
+}
+
+static int alauda_erase(struct mtd_info *mtd, struct erase_info *instr)
+{
+        int err;
+
+        err = __alauda_erase(mtd, instr);
+        instr->state = err ? MTD_ERASE_FAILED : MTD_ERASE_DONE;
+        mtd_erase_callback(instr);
+        return err;
+}
+
+static int alauda_init_media(struct alauda *al)
+{
+        u8 buf[4], *b0=buf, *b1=buf+1;
+        struct alauda_card *card;
+        struct mtd_info *mtd;
+        int err;
+
+        mtd = kzalloc(sizeof(*mtd), GFP_KERNEL);
+        if (!mtd)
+                return -ENOMEM;
+
+        for (;;) {
+                err = alauda_get_media_status(al, buf);
+                if (err < 0)
+                        goto error;
+                if (*b0 & 0x10)
+                        break;
+                msleep(20);
+        }
+
+        err = alauda_ack_media(al);
+        if (err)
+                goto error;
+
+        msleep(10);
+
+        err = alauda_get_media_status(al, buf);
+        if (err < 0)
+                goto error;
+
+        if (*b0 != 0x14) {
+                /* media not ready */
+                err = -EIO;
+                goto error;
+        }
+        err = alauda_get_media_signatures(al, buf);
+        if (err < 0)
+                goto error;
+
+        card = get_card(*b1);
+        if (!card) {
+                printk(KERN_ERR"Alauda: unknown card id %02x\n", *b1);
+                err = -EIO;
+                goto error;
+        }
+        printk(KERN_INFO"pagesize=%x\nerasesize=%x\nsize=%xMiB\n",
+                        1<<card->pageshift, 1<<card->blockshift,
+                        1<<(card->chipshift-20));
+        al->card = card;
+        al->pagemask = (1 << (card->blockshift - card->pageshift)) - 1;
+        al->bytemask = (1 << card->pageshift) - 1;
+        al->blockmask = (1 << card->blockshift) - 1;
+
+        mtd->name = "alauda";
+        mtd->size = 1<<card->chipshift;
+        mtd->erasesize = 1<<card->blockshift;
+        mtd->writesize = 1<<card->pageshift;
+        mtd->type = MTD_NANDFLASH;
+        mtd->flags = MTD_CAP_NANDFLASH;
+        mtd->read = alauda_read;
+        mtd->write = alauda_write;
+        mtd->erase = alauda_erase;
+        mtd->block_isbad = alauda_isbad;
+        mtd->priv = al;
+        mtd->owner = THIS_MODULE;
+
+        err = add_mtd_device(mtd);
+        if (err) {
+                err = -ENFILE;
+                goto error;
+        }
+
+        al->mtd = mtd;
+        alauda_reset(al); /* no clue whether this is necessary */
+        return 0;
+error:
+        kfree(mtd);
+        return err;
+}
+
+static int alauda_check_media(struct alauda *al)
+{
+        u8 buf[2], *b0 = buf, *b1 = buf+1;
+        int err;
+
+        err = alauda_get_media_status(al, buf);
+        if (err < 0)
+                return err;
+
+        if ((*b1 & 0x01) == 0) {
+                /* door open */
+                return -EIO;
+        }
+        if ((*b0 & 0x80) || ((*b0 & 0x1F) == 0x10)) {
+                /* no media ? */
+                return -EIO;
+        }
+        if (*b0 & 0x08) {
+                /* media change ? */
+                return alauda_init_media(al);
+        }
+        return 0;
+}
+
+static int alauda_probe(struct usb_interface *interface,
+                const struct usb_device_id *id)
+{
+        struct alauda *al;
+        struct usb_host_interface *iface;
+        struct usb_endpoint_descriptor *ep,
+                        *ep_in=NULL, *ep_out=NULL, *ep_wr=NULL;
+        int i, err = -ENOMEM;
+
+        al = kzalloc(2*sizeof(*al), GFP_KERNEL);
+        if (!al)
+                goto error;
+
+        kref_init(&al->kref);
+        usb_set_intfdata(interface, al);
+
+        al->dev = usb_get_dev(interface_to_usbdev(interface));
+        al->interface = interface;
+
+        iface = interface->cur_altsetting;
+        for (i = 0; i < iface->desc.bNumEndpoints; ++i) {
+                ep = &iface->endpoint[i].desc;
+
+                if (usb_endpoint_is_bulk_in(ep)) {
+                        ep_in = ep;
+                } else if (usb_endpoint_is_bulk_out(ep)) {
+                        if (i==0)
+                                ep_wr = ep;
+                        else
+                                ep_out = ep;
+                }
+        }
+        err = -EIO;
+        if (!ep_wr || !ep_in || !ep_out)
+                goto error;
+
+        al->write_out = usb_sndbulkpipe(al->dev,
+                        ep_wr->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+        al->bulk_in = usb_rcvbulkpipe(al->dev,
+                        ep_in->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+        al->bulk_out = usb_sndbulkpipe(al->dev,
+                        ep_out->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+
+        /* second device is identical up to now */
+        memcpy(al+1, al, sizeof(*al));
+
+        mutex_init(&al[0].card_mutex);
+        mutex_init(&al[1].card_mutex);
+
+        al[0].port = ALAUDA_PORT_XD;
+        al[1].port = ALAUDA_PORT_SM;
+
+        info("alauda probed");
+        alauda_check_media(al);
+        alauda_check_media(al+1);
+
+        return 0;
+
+error:
+        if (al)
+                kref_put(&al->kref, alauda_delete);
+        return err;
+}
+
+static void alauda_disconnect(struct usb_interface *interface)
+{
+        struct alauda *al;
+
+        al = usb_get_intfdata(interface);
+        usb_set_intfdata(interface, NULL);
+
+        /* FIXME: prevent more I/O from starting */
+
+        /* decrement our usage count */
+        if (al)
+                kref_put(&al->kref, alauda_delete);
+
+        info("alauda gone");
+}
+
+static struct usb_driver alauda_driver = {
+        .name =         "alauda",
+        .probe =        alauda_probe,
+        .disconnect =   alauda_disconnect,
+        .id_table =     alauda_table,
+};
+
+static int __init alauda_init(void)
+{
+        return usb_register(&alauda_driver);
+}
+
+static void __exit alauda_exit(void)
+{
+        usb_deregister(&alauda_driver);
+}
+
+module_init(alauda_init);
+module_exit(alauda_exit);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/mtd/nand/bf5xx_nand.c b/drivers/mtd/nand/bf5xx_nand.c
new file mode 100644
index 000000000000..1657ecd74881
--- /dev/null
+++ b/drivers/mtd/nand/bf5xx_nand.c
@@ -0,0 +1,788 @@
+/* linux/drivers/mtd/nand/bf5xx_nand.c
+ *
+ * Copyright 2006-2007 Analog Devices Inc.
+ *      http://blackfin.uclinux.org/
+ *      Bryan Wu <bryan.wu@analog.com>
+ *
+ * Blackfin BF5xx on-chip NAND flash controler driver
+ *
+ * Derived from drivers/mtd/nand/s3c2410.c
+ * Copyright (c) 2007 Ben Dooks <ben@simtec.co.uk>
+ *
+ * Derived from drivers/mtd/nand/cafe.c
+ * Copyright © 2006 Red Hat, Inc.
+ * Copyright © 2006 David Woodhouse <dwmw2@infradead.org>
+ *
+ * Changelog:
+ *      12-Jun-2007  Bryan Wu:  Initial version
+ *      18-Jul-2007  Bryan Wu:
+ *              - ECC_HW and ECC_SW supported
+ *              - DMA supported in ECC_HW
+ *              - YAFFS tested as rootfs in both ECC_HW and ECC_SW
+ *
+ * TODO:
+ *      Enable JFFS2 over NAND as rootfs
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+*/
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/ioport.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/dma-mapping.h>
+#include <linux/err.h>
+#include <linux/slab.h>
+#include <linux/io.h>
+#include <linux/bitops.h>
+
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/nand.h>
+#include <linux/mtd/nand_ecc.h>
+#include <linux/mtd/partitions.h>
+
+#include <asm/blackfin.h>
+#include <asm/dma.h>
+#include <asm/cacheflush.h>
+#include <asm/nand.h>
+#include <asm/portmux.h>
+
+#define DRV_NAME        "bf5xx-nand"
+#define DRV_VERSION     "1.2"
+#define DRV_AUTHOR      "Bryan Wu <bryan.wu@analog.com>"
+#define DRV_DESC        "BF5xx on-chip NAND FLash Controller Driver"
+
+#ifdef CONFIG_MTD_NAND_BF5XX_HWECC
+static int hardware_ecc = 1;
+#else
+static int hardware_ecc;
+#endif
+
+static unsigned short bfin_nfc_pin_req[] = {P_NAND_CE, P_NAND_RB, 0};
+
+/*
+ * Data structures for bf5xx nand flash controller driver
+ */
+
+/* bf5xx nand info */
+struct bf5xx_nand_info {
+        /* mtd info */
+        struct nand_hw_control          controller;
+        struct mtd_info                 mtd;
+        struct nand_chip                chip;
+
+        /* platform info */
+        struct bf5xx_nand_platform      *platform;
+
+        /* device info */
+        struct device                   *device;
+
+        /* DMA stuff */
+        struct completion               dma_completion;
+};
+
+/*
+ * Conversion functions
+ */
+static struct bf5xx_nand_info *mtd_to_nand_info(struct mtd_info *mtd)
+{
+        return container_of(mtd, struct bf5xx_nand_info, mtd);
+}
+
+static struct bf5xx_nand_info *to_nand_info(struct platform_device *pdev)
+{
+        return platform_get_drvdata(pdev);
+}
+
+static struct bf5xx_nand_platform *to_nand_plat(struct platform_device *pdev)
+{
+        return pdev->dev.platform_data;
+}
+
+/*
+ * struct nand_chip interface function pointers
+ */
+
+/*
+ * bf5xx_nand_hwcontrol
+ *
+ * Issue command and address cycles to the chip
+ */
+static void bf5xx_nand_hwcontrol(struct mtd_info *mtd, int cmd,
+                                   unsigned int ctrl)
+{
+        if (cmd == NAND_CMD_NONE)
+                return;
+
+        while (bfin_read_NFC_STAT() & WB_FULL)
+                cpu_relax();
+
+        if (ctrl & NAND_CLE)
+                bfin_write_NFC_CMD(cmd);
+        else
+                bfin_write_NFC_ADDR(cmd);
+        SSYNC();
+}
+
+/*
+ * bf5xx_nand_devready()
+ *
+ * returns 0 if the nand is busy, 1 if it is ready
+ */
+static int bf5xx_nand_devready(struct mtd_info *mtd)
+{
+        unsigned short val = bfin_read_NFC_IRQSTAT();
+
+        if ((val & NBUSYIRQ) == NBUSYIRQ)
+                return 1;
+        else
+                return 0;
+}
+
+/*
+ * ECC functions
+ * These allow the bf5xx to use the controller's ECC
+ * generator block to ECC the data as it passes through
+ */
+
+/*
+ * ECC error correction function
+ */
+static int bf5xx_nand_correct_data_256(struct mtd_info *mtd, u_char *dat,
+                                        u_char *read_ecc, u_char *calc_ecc)
+{
+        struct bf5xx_nand_info *info = mtd_to_nand_info(mtd);
+        u32 syndrome[5];
+        u32 calced, stored;
+        int i;
+        unsigned short failing_bit, failing_byte;
+        u_char data;
+
+        calced = calc_ecc[0] | (calc_ecc[1] << 8) | (calc_ecc[2] << 16);
+        stored = read_ecc[0] | (read_ecc[1] << 8) | (read_ecc[2] << 16);
+
+        syndrome[0] = (calced ^ stored);
+
+        /*
+         * syndrome 0: all zero
+         * No error in data
+         * No action
+         */
+        if (!syndrome[0] || !calced || !stored)
+                return 0;
+
+        /*
+         * sysdrome 0: only one bit is one
+         * ECC data was incorrect
+         * No action
+         */
+        if (hweight32(syndrome[0]) == 1) {
+                dev_err(info->device, "ECC data was incorrect!\n");
+                return 1;
+        }
+
+        syndrome[1] = (calced & 0x7FF) ^ (stored & 0x7FF);
+        syndrome[2] = (calced & 0x7FF) ^ ((calced >> 11) & 0x7FF);
+        syndrome[3] = (stored & 0x7FF) ^ ((stored >> 11) & 0x7FF);
+        syndrome[4] = syndrome[2] ^ syndrome[3];
+
+        for (i = 0; i < 5; i++)
+                dev_info(info->device, "syndrome[%d] 0x%08x\n", i, syndrome[i]);
+
+        dev_info(info->device,
+                "calced[0x%08x], stored[0x%08x]\n",
+                calced, stored);
+
+        /*
+         * sysdrome 0: exactly 11 bits are one, each parity
+         * and parity' pair is 1 & 0 or 0 & 1.
+         * 1-bit correctable error
+         * Correct the error
+         */
+        if (hweight32(syndrome[0]) == 11 && syndrome[4] == 0x7FF) {
+                dev_info(info->device,
+                        "1-bit correctable error, correct it.\n");
+                dev_info(info->device,
+                        "syndrome[1] 0x%08x\n", syndrome[1]);
+
+                failing_bit = syndrome[1] & 0x7;
+                failing_byte = syndrome[1] >> 0x3;
+                data = *(dat + failing_byte);
+                data = data ^ (0x1 << failing_bit);
+                *(dat + failing_byte) = data;
+
+                return 0;
+        }
+
+        /*
+         * sysdrome 0: random data
+         * More than 1-bit error, non-correctable error
+         * Discard data, mark bad block
+         */
+        dev_err(info->device,
+                "More than 1-bit error, non-correctable error.\n");
+        dev_err(info->device,
+                "Please discard data, mark bad block\n");
+
+        return 1;
+}
+
+static int bf5xx_nand_correct_data(struct mtd_info *mtd, u_char *dat,
+                                        u_char *read_ecc, u_char *calc_ecc)
+{
+        struct bf5xx_nand_info *info = mtd_to_nand_info(mtd);
+        struct bf5xx_nand_platform *plat = info->platform;
+        unsigned short page_size = (plat->page_size ? 512 : 256);
+        int ret;
+
+        ret = bf5xx_nand_correct_data_256(mtd, dat, read_ecc, calc_ecc);
+
+        /* If page size is 512, correct second 256 bytes */
+        if (page_size == 512) {
+                dat += 256;
+                read_ecc += 8;
+                calc_ecc += 8;
+                ret = bf5xx_nand_correct_data_256(mtd, dat, read_ecc, calc_ecc);
+        }
+
+        return ret;
+}
+
+static void bf5xx_nand_enable_hwecc(struct mtd_info *mtd, int mode)
+{
+        return;
+}
+
+static int bf5xx_nand_calculate_ecc(struct mtd_info *mtd,
+                const u_char *dat, u_char *ecc_code)
+{
+        struct bf5xx_nand_info *info = mtd_to_nand_info(mtd);
+        struct bf5xx_nand_platform *plat = info->platform;
+        u16 page_size = (plat->page_size ? 512 : 256);
+        u16 ecc0, ecc1;
+        u32 code[2];
+        u8 *p;
+        int bytes = 3, i;
+
+        /* first 4 bytes ECC code for 256 page size */
+        ecc0 = bfin_read_NFC_ECC0();
+        ecc1 = bfin_read_NFC_ECC1();
+
+        code[0] = (ecc0 & 0x3FF) | ((ecc1 & 0x3FF) << 11);
+
+        dev_dbg(info->device, "returning ecc 0x%08x\n", code[0]);
+
+        /* second 4 bytes ECC code for 512 page size */
+        if (page_size == 512) {
+                ecc0 = bfin_read_NFC_ECC2();
+                ecc1 = bfin_read_NFC_ECC3();
+                code[1] = (ecc0 & 0x3FF) | ((ecc1 & 0x3FF) << 11);
+                bytes = 6;
+                dev_dbg(info->device, "returning ecc 0x%08x\n", code[1]);
+        }
+
+        p = (u8 *)code;
+        for (i = 0; i < bytes; i++)
+                ecc_code[i] = p[i];
+
+        return 0;
+}
+
+/*
+ * PIO mode for buffer writing and reading
+ */
+static void bf5xx_nand_read_buf(struct mtd_info *mtd, uint8_t *buf, int len)
+{
+        int i;
+        unsigned short val;
+
+        /*
+         * Data reads are requested by first writing to NFC_DATA_RD
+         * and then reading back from NFC_READ.
+         */
+        for (i = 0; i < len; i++) {
+                while (bfin_read_NFC_STAT() & WB_FULL)
+                        cpu_relax();
+
+                /* Contents do not matter */
+                bfin_write_NFC_DATA_RD(0x0000);
+                SSYNC();
+
+                while ((bfin_read_NFC_IRQSTAT() & RD_RDY) != RD_RDY)
+                        cpu_relax();
+
+                buf[i] = bfin_read_NFC_READ();
+
+                val = bfin_read_NFC_IRQSTAT();
+                val |= RD_RDY;
+                bfin_write_NFC_IRQSTAT(val);
+                SSYNC();
+        }
+}
+
+static uint8_t bf5xx_nand_read_byte(struct mtd_info *mtd)
+{
+        uint8_t val;
+
+        bf5xx_nand_read_buf(mtd, &val, 1);
+
+        return val;
+}
+
+static void bf5xx_nand_write_buf(struct mtd_info *mtd,
+                                const uint8_t *buf, int len)
+{
+        int i;
+
+        for (i = 0; i < len; i++) {
+                while (bfin_read_NFC_STAT() & WB_FULL)
+                        cpu_relax();
+
+                bfin_write_NFC_DATA_WR(buf[i]);
+                SSYNC();
+        }
+}
+
+static void bf5xx_nand_read_buf16(struct mtd_info *mtd, uint8_t *buf, int len)
+{
+        int i;
+        u16 *p = (u16 *) buf;
+        len >>= 1;
+
+        /*
+         * Data reads are requested by first writing to NFC_DATA_RD
+         * and then reading back from NFC_READ.
+         */
+        bfin_write_NFC_DATA_RD(0x5555);
+
+        SSYNC();
+
+        for (i = 0; i < len; i++)
+                p[i] = bfin_read_NFC_READ();
+}
+
+static void bf5xx_nand_write_buf16(struct mtd_info *mtd,
+                                const uint8_t *buf, int len)
+{
+        int i;
+        u16 *p = (u16 *) buf;
+        len >>= 1;
+
+        for (i = 0; i < len; i++)
+                bfin_write_NFC_DATA_WR(p[i]);
+
+        SSYNC();
+}
+
+/*
+ * DMA functions for buffer writing and reading
+ */
+static irqreturn_t bf5xx_nand_dma_irq(int irq, void *dev_id)
+{
+        struct bf5xx_nand_info *info = dev_id;
+
+        clear_dma_irqstat(CH_NFC);
+        disable_dma(CH_NFC);
+        complete(&info->dma_completion);
+
+        return IRQ_HANDLED;
+}
+
+static int bf5xx_nand_dma_rw(struct mtd_info *mtd,
+                                uint8_t *buf, int is_read)
+{
+        struct bf5xx_nand_info *info = mtd_to_nand_info(mtd);
+        struct bf5xx_nand_platform *plat = info->platform;
+        unsigned short page_size = (plat->page_size ? 512 : 256);
+        unsigned short val;
+
+        dev_dbg(info->device, " mtd->%p, buf->%p, is_read %d\n",
+                        mtd, buf, is_read);
+
+        /*
+         * Before starting a dma transfer, be sure to invalidate/flush
+         * the cache over the address range of your DMA buffer to
+         * prevent cache coherency problems. Otherwise very subtle bugs
+         * can be introduced to your driver.
+         */
+        if (is_read)
+                invalidate_dcache_range((unsigned int)buf,
+                                (unsigned int)(buf + page_size));
+        else
+                flush_dcache_range((unsigned int)buf,
+                                (unsigned int)(buf + page_size));
+
+        /*
+         * This register must be written before each page is
+         * transferred to generate the correct ECC register
+         * values.
+         */
+        bfin_write_NFC_RST(0x1);
+        SSYNC();
+
+        disable_dma(CH_NFC);
+        clear_dma_irqstat(CH_NFC);
+
+        /* setup DMA register with Blackfin DMA API */
+        set_dma_config(CH_NFC, 0x0);
+        set_dma_start_addr(CH_NFC, (unsigned long) buf);
+        set_dma_x_count(CH_NFC, (page_size >> 2));
+        set_dma_x_modify(CH_NFC, 4);
+
+        /* setup write or read operation */
+        val = DI_EN | WDSIZE_32;
+        if (is_read)
+                val |= WNR;
+        set_dma_config(CH_NFC, val);
+        enable_dma(CH_NFC);
+
+        /* Start PAGE read/write operation */
+        if (is_read)
+                bfin_write_NFC_PGCTL(0x1);
+        else
+                bfin_write_NFC_PGCTL(0x2);
+        wait_for_completion(&info->dma_completion);
+
+        return 0;
+}
+
+static void bf5xx_nand_dma_read_buf(struct mtd_info *mtd,
+                                        uint8_t *buf, int len)
+{
+        struct bf5xx_nand_info *info = mtd_to_nand_info(mtd);
+        struct bf5xx_nand_platform *plat = info->platform;
+        unsigned short page_size = (plat->page_size ? 512 : 256);
+
+        dev_dbg(info->device, "mtd->%p, buf->%p, int %d\n", mtd, buf, len);
+
+        if (len == page_size)
+                bf5xx_nand_dma_rw(mtd, buf, 1);
+        else
+                bf5xx_nand_read_buf(mtd, buf, len);
+}
+
+static void bf5xx_nand_dma_write_buf(struct mtd_info *mtd,
+                                const uint8_t *buf, int len)
+{
+        struct bf5xx_nand_info *info = mtd_to_nand_info(mtd);
+        struct bf5xx_nand_platform *plat = info->platform;
+        unsigned short page_size = (plat->page_size ? 512 : 256);
+
+        dev_dbg(info->device, "mtd->%p, buf->%p, len %d\n", mtd, buf, len);
+
+        if (len == page_size)
+                bf5xx_nand_dma_rw(mtd, (uint8_t *)buf, 0);
+        else
+                bf5xx_nand_write_buf(mtd, buf, len);
+}
+
+/*
+ * System initialization functions
+ */
+
+static int bf5xx_nand_dma_init(struct bf5xx_nand_info *info)
+{
+        int ret;
+        unsigned short val;
+
+        /* Do not use dma */
+        if (!hardware_ecc)
+                return 0;
+
+        init_completion(&info->dma_completion);
+
+        /* Setup DMAC1 channel mux for NFC which shared with SDH */
+        val = bfin_read_DMAC1_PERIMUX();
+        val &= 0xFFFE;
+        bfin_write_DMAC1_PERIMUX(val);
+        SSYNC();
+
+        /* Request NFC DMA channel */
+        ret = request_dma(CH_NFC, "BF5XX NFC driver");
+        if (ret < 0) {
+                dev_err(info->device, " unable to get DMA channel\n");
+                return ret;
+        }
+
+        set_dma_callback(CH_NFC, (void *) bf5xx_nand_dma_irq, (void *) info);
+
+        /* Turn off the DMA channel first */
+        disable_dma(CH_NFC);
+        return 0;
+}
+
+/*
+ * BF5XX NFC hardware initialization
+ *  - pin mux setup
+ *  - clear interrupt status
+ */
+static int bf5xx_nand_hw_init(struct bf5xx_nand_info *info)
+{
+        int err = 0;
+        unsigned short val;
+        struct bf5xx_nand_platform *plat = info->platform;
+
+        /* setup NFC_CTL register */
+        dev_info(info->device,
+                "page_size=%d, data_width=%d, wr_dly=%d, rd_dly=%d\n",
+                (plat->page_size ? 512 : 256),
+                (plat->data_width ? 16 : 8),
+                plat->wr_dly, plat->rd_dly);
+
+        val = (plat->page_size << NFC_PG_SIZE_OFFSET) |
+                (plat->data_width << NFC_NWIDTH_OFFSET) |
+                (plat->rd_dly << NFC_RDDLY_OFFSET) |
+                (plat->rd_dly << NFC_WRDLY_OFFSET);
+        dev_dbg(info->device, "NFC_CTL is 0x%04x\n", val);
+
+        bfin_write_NFC_CTL(val);
+        SSYNC();
+
+        /* clear interrupt status */
+        bfin_write_NFC_IRQMASK(0x0);
+        SSYNC();
+        val = bfin_read_NFC_IRQSTAT();
+        bfin_write_NFC_IRQSTAT(val);
+        SSYNC();
+
+        if (peripheral_request_list(bfin_nfc_pin_req, DRV_NAME)) {
+                printk(KERN_ERR DRV_NAME
+                ": Requesting Peripherals failed\n");
+                return -EFAULT;
+        }
+
+        /* DMA initialization  */
+        if (bf5xx_nand_dma_init(info))
+                err = -ENXIO;
+
+        return err;
+}
+
+/*
+ * Device management interface
+ */
+static int bf5xx_nand_add_partition(struct bf5xx_nand_info *info)
+{
+        struct mtd_info *mtd = &info->mtd;
+
+#ifdef CONFIG_MTD_PARTITIONS
+        struct mtd_partition *parts = info->platform->partitions;
+        int nr = info->platform->nr_partitions;
+
+        return add_mtd_partitions(mtd, parts, nr);
+#else
+        return add_mtd_device(mtd);
+#endif
+}
+
+static int bf5xx_nand_remove(struct platform_device *pdev)
+{
+        struct bf5xx_nand_info *info = to_nand_info(pdev);
+        struct mtd_info *mtd = NULL;
+
+        platform_set_drvdata(pdev, NULL);
+
+        /* first thing we need to do is release all our mtds
+         * and their partitions, then go through freeing the
+         * resources used
+         */
+        mtd = &info->mtd;
+        if (mtd) {
+                nand_release(mtd);
+                kfree(mtd);
+        }
+
+        peripheral_free_list(bfin_nfc_pin_req);
+
+        /* free the common resources */
+        kfree(info);
+
+        return 0;
+}
+
+/*
+ * bf5xx_nand_probe
+ *
+ * called by device layer when it finds a device matching
+ * one our driver can handled. This code checks to see if
+ * it can allocate all necessary resources then calls the
+ * nand layer to look for devices
+ */
+static int bf5xx_nand_probe(struct platform_device *pdev)
+{
+        struct bf5xx_nand_platform *plat = to_nand_plat(pdev);
+        struct bf5xx_nand_info *info = NULL;
+        struct nand_chip *chip = NULL;
+        struct mtd_info *mtd = NULL;
+        int err = 0;
+
+        dev_dbg(&pdev->dev, "(%p)\n", pdev);
+
+        if (!plat) {
+                dev_err(&pdev->dev, "no platform specific information\n");
+                goto exit_error;
+        }
+
+        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        if (info == NULL) {
+                dev_err(&pdev->dev, "no memory for flash info\n");
+                err = -ENOMEM;
+                goto exit_error;
+        }
+
+        platform_set_drvdata(pdev, info);
+
+        spin_lock_init(&info->controller.lock);
+        init_waitqueue_head(&info->controller.wq);
+
+        info->device     = &pdev->dev;
+        info->platform   = plat;
+
+        /* initialise chip data struct */
+        chip = &info->chip;
+
+        if (plat->data_width)
+                chip->options |= NAND_BUSWIDTH_16;
+
+        chip->options |= NAND_CACHEPRG | NAND_SKIP_BBTSCAN;
+
+        chip->read_buf = (plat->data_width) ?
+                bf5xx_nand_read_buf16 : bf5xx_nand_read_buf;
+        chip->write_buf = (plat->data_width) ?
+                bf5xx_nand_write_buf16 : bf5xx_nand_write_buf;
+
+        chip->read_byte    = bf5xx_nand_read_byte;
+
+        chip->cmd_ctrl     = bf5xx_nand_hwcontrol;
+        chip->dev_ready    = bf5xx_nand_devready;
+
+        chip->priv         = &info->mtd;
+        chip->controller   = &info->controller;
+
+        chip->IO_ADDR_R    = (void __iomem *) NFC_READ;
+        chip->IO_ADDR_W    = (void __iomem *) NFC_DATA_WR;
+
+        chip->chip_delay   = 0;
+
+        /* initialise mtd info data struct */
+        mtd             = &info->mtd;
+        mtd->priv       = chip;
+        mtd->owner      = THIS_MODULE;
+
+        /* initialise the hardware */
+        err = bf5xx_nand_hw_init(info);
+        if (err != 0)
+                goto exit_error;
+
+        /* setup hardware ECC data struct */
+        if (hardware_ecc) {
+                if (plat->page_size == NFC_PG_SIZE_256) {
+                        chip->ecc.bytes = 3;
+                        chip->ecc.size = 256;
+                } else if (plat->page_size == NFC_PG_SIZE_512) {
+                        chip->ecc.bytes = 6;
+                        chip->ecc.size = 512;
+                }
+
+                chip->read_buf      = bf5xx_nand_dma_read_buf;
+                chip->write_buf     = bf5xx_nand_dma_write_buf;
+                chip->ecc.calculate = bf5xx_nand_calculate_ecc;
+                chip->ecc.correct   = bf5xx_nand_correct_data;
+                chip->ecc.mode      = NAND_ECC_HW;
+                chip->ecc.hwctl     = bf5xx_nand_enable_hwecc;
+        } else {
+                chip->ecc.mode      = NAND_ECC_SOFT;
+        }
+
+        /* scan hardware nand chip and setup mtd info data struct */
+        if (nand_scan(mtd, 1)) {
+                err = -ENXIO;
+                goto exit_error;
+        }
+
+        /* add NAND partition */
+        bf5xx_nand_add_partition(info);
+
+        dev_dbg(&pdev->dev, "initialised ok\n");
+        return 0;
+
+exit_error:
+        bf5xx_nand_remove(pdev);
+
+        if (err == 0)
+                err = -EINVAL;
+        return err;
+}
+
+/* PM Support */
+#ifdef CONFIG_PM
+
+static int bf5xx_nand_suspend(struct platform_device *dev, pm_message_t pm)
+{
+        struct bf5xx_nand_info *info = platform_get_drvdata(dev);
+
+        return 0;
+}
+
+static int bf5xx_nand_resume(struct platform_device *dev)
+{
+        struct bf5xx_nand_info *info = platform_get_drvdata(dev);
+
+        if (info)
+                bf5xx_nand_hw_init(info);
+
+        return 0;
+}
+
+#else
+#define bf5xx_nand_suspend NULL
+#define bf5xx_nand_resume NULL
+#endif
+
+/* driver device registration */
+static struct platform_driver bf5xx_nand_driver = {
+        .probe          = bf5xx_nand_probe,
+        .remove         = bf5xx_nand_remove,
+        .suspend        = bf5xx_nand_suspend,
+        .resume         = bf5xx_nand_resume,
+        .driver         = {
+                .name   = DRV_NAME,
+                .owner  = THIS_MODULE,
+        },
+};
+
+static int __init bf5xx_nand_init(void)
+{
+        printk(KERN_INFO "%s, Version %s (c) 2007 Analog Devices, Inc.\n",
+                DRV_DESC, DRV_VERSION);
+
+        return platform_driver_register(&bf5xx_nand_driver);
+}
+
+static void __exit bf5xx_nand_exit(void)
+{
+        platform_driver_unregister(&bf5xx_nand_driver);
+}
+
+module_init(bf5xx_nand_init);
+module_exit(bf5xx_nand_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR(DRV_AUTHOR);
+MODULE_DESCRIPTION(DRV_DESC);
diff --git a/drivers/mtd/nand/cafe_nand.c b/drivers/mtd/nand/cafe_nand.c
index 6f32a35eb106..e2832d0b9899 100644
--- a/drivers/mtd/nand/cafe_nand.c
+++ b/drivers/mtd/nand/cafe_nand.c
@@ -623,6 +623,11 @@ static int __devinit cafe_nand_probe(struct pci_dev *pdev,
         uint32_t ctrl;
         int err = 0;
 
+        /* Very old versions shared the same PCI ident for all three
+           functions on the chip. Verify the class too... */
+        if ((pdev->class >> 8) != PCI_CLASS_MEMORY_FLASH)
+                return -ENODEV;
+
         err = pci_enable_device(pdev);
         if (err)
                 return err;
@@ -816,21 +821,57 @@ static void __devexit cafe_nand_remove(struct pci_dev *pdev)
 }
 
 static struct pci_device_id cafe_nand_tbl[] = {
-        { 0x11ab, 0x4100, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_MEMORY_FLASH << 8, 0xFFFF0 },
-        { 0, }
+        { 0x11ab, 0x4100, PCI_ANY_ID, PCI_ANY_ID },
+        { }
 };
 
 MODULE_DEVICE_TABLE(pci, cafe_nand_tbl);
 
+static int cafe_nand_resume(struct pci_dev *pdev)
+{
+        uint32_t ctrl;
+        struct mtd_info *mtd = pci_get_drvdata(pdev);
+        struct cafe_priv *cafe = mtd->priv;
+
+       /* Start off by resetting the NAND controller completely */
+        cafe_writel(cafe, 1, NAND_RESET);
+        cafe_writel(cafe, 0, NAND_RESET);
+        cafe_writel(cafe, 0xffffffff, NAND_IRQ_MASK);
+
+        /* Restore timing configuration */
+        cafe_writel(cafe, timing[0], NAND_TIMING1);
+        cafe_writel(cafe, timing[1], NAND_TIMING2);
+        cafe_writel(cafe, timing[2], NAND_TIMING3);
+
+        /* Disable master reset, enable NAND clock */
+        ctrl = cafe_readl(cafe, GLOBAL_CTRL);
+        ctrl &= 0xffffeff0;
+        ctrl |= 0x00007000;
+        cafe_writel(cafe, ctrl | 0x05, GLOBAL_CTRL);
+        cafe_writel(cafe, ctrl | 0x0a, GLOBAL_CTRL);
+        cafe_writel(cafe, 0, NAND_DMA_CTRL);
+        cafe_writel(cafe, 0x7006, GLOBAL_CTRL);
+        cafe_writel(cafe, 0x700a, GLOBAL_CTRL);
+
+        /* Set up DMA address */
+        cafe_writel(cafe, cafe->dmaaddr & 0xffffffff, NAND_DMA_ADDR0);
+        if (sizeof(cafe->dmaaddr) > 4)
+        /* Shift in two parts to shut the compiler up */
+                cafe_writel(cafe, (cafe->dmaaddr >> 16) >> 16, NAND_DMA_ADDR1);
+        else
+                cafe_writel(cafe, 0, NAND_DMA_ADDR1);
+
+        /* Enable NAND IRQ in global IRQ mask register */
+        cafe_writel(cafe, 0x80000007, GLOBAL_IRQ_MASK);
+        return 0;
+}
+
 static struct pci_driver cafe_nand_pci_driver = {
         .name = "CAFÉ NAND",
         .id_table = cafe_nand_tbl,
         .probe = cafe_nand_probe,
         .remove = __devexit_p(cafe_nand_remove),
-#ifdef CONFIG_PMx
-        .suspend = cafe_nand_suspend,
         .resume = cafe_nand_resume,
-#endif
 };
 
 static int cafe_nand_init(void)
diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index e96259f22cca..ab9f5c5db38d 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c
@@ -56,8 +56,6 @@ static unsigned long __initdata doc_locations[] = {
 #endif /*  CONFIG_MTD_DOCPROBE_HIGH */
 #elif defined(__PPC__)
         0xe4000000,
-#elif defined(CONFIG_MOMENCO_OCELOT_G)
-        0xff000000,
 #else
 #warning Unknown architecture for DiskOnChip. No default probe locations defined
 #endif
diff --git a/drivers/mtd/nand/excite_nandflash.c b/drivers/mtd/nand/excite_nandflash.c
index 7e9afc4c7757..bed87290decc 100644
--- a/drivers/mtd/nand/excite_nandflash.c
+++ b/drivers/mtd/nand/excite_nandflash.c
@@ -27,7 +27,6 @@
 #include <linux/platform_device.h>
 #include <linux/delay.h>
 #include <linux/err.h>
-#include <linux/kernel.h>
 
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/nand.h>
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 24ac6778b1a8..b4e0e7723894 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -7,7 +7,7 @@
  *   Basic support for AG-AND chips is provided.
  *
  *      Additional technical information is available on
- *      http://www.linux-mtd.infradead.org/tech/nand.html
+ *      http://www.linux-mtd.infradead.org/doc/nand.html
  *
  *  Copyright (C) 2000 Steven J. Hill (sjhill@realitydiluted.com)
  *                2002-2006 Thomas Gleixner (tglx@linutronix.de)
@@ -2069,13 +2069,14 @@ int nand_erase_nand(struct mtd_info *mtd, struct erase_info *instr,
  erase_exit:
 
         ret = instr->state == MTD_ERASE_DONE ? 0 : -EIO;
-        /* Do call back function */
-        if (!ret)
-                mtd_erase_callback(instr);
 
         /* Deselect and wake up anyone waiting on the device */
         nand_release_device(mtd);
 
+        /* Do call back function */
+        if (!ret)
+                mtd_erase_callback(instr);
+
         /*
          * If BBT requires refresh and erase was successful, rewrite any
          * selected bad block tables
diff --git a/drivers/mtd/nand/nand_ids.c b/drivers/mtd/nand/nand_ids.c
index 2fc674a190cf..a3e3ab0185d5 100644
--- a/drivers/mtd/nand/nand_ids.c
+++ b/drivers/mtd/nand/nand_ids.c
@@ -141,6 +141,7 @@ struct nand_manufacturers nand_manuf_ids[] = {
         {NAND_MFR_STMICRO, "ST Micro"},
         {NAND_MFR_HYNIX, "Hynix"},
         {NAND_MFR_MICRON, "Micron"},
+        {NAND_MFR_AMD, "AMD"},
         {0x0, "Unknown"}
 };
 
diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
index 205df0f771fe..a7574807dc46 100644
--- a/drivers/mtd/nand/nandsim.c
+++ b/drivers/mtd/nand/nandsim.c
@@ -1272,7 +1272,13 @@ static int prog_page(struct nandsim *ns, int num)
         mypage = NS_GET_PAGE(ns);
         if (mypage->byte == NULL) {
                 NS_DBG("prog_page: allocating page %d\n", ns->regs.row);
-                mypage->byte = kmalloc(ns->geom.pgszoob, GFP_KERNEL);
+                /*
+                 * We allocate memory with GFP_NOFS because a flash FS may
+                 * utilize this. If it is holding an FS lock, then gets here,
+                 * then kmalloc runs writeback which goes to the FS again
+                 * and deadlocks. This was seen in practice.
+                 */
+                mypage->byte = kmalloc(ns->geom.pgszoob, GFP_NOFS);
                 if (mypage->byte == NULL) {
                         NS_ERR("prog_page: error allocating memory for page %d\n", ns->regs.row);
                         return -1;
diff --git a/drivers/mtd/nand/ndfc.c b/drivers/mtd/nand/ndfc.c
index fd7a8d5ba29a..1c0e89f00e8d 100644
--- a/drivers/mtd/nand/ndfc.c
+++ b/drivers/mtd/nand/ndfc.c
@@ -24,7 +24,11 @@
 #include <linux/platform_device.h>
 
 #include <asm/io.h>
+#ifdef CONFIG_40x
+#include <asm/ibm405.h>
+#else
 #include <asm/ibm44x.h>
+#endif
 
 struct ndfc_nand_mtd {
         struct mtd_info                 mtd;
@@ -230,7 +234,11 @@ static int ndfc_nand_probe(struct platform_device *pdev)
         struct ndfc_controller *ndfc = &ndfc_ctrl;
         unsigned long long phys = settings->ndfc_erpn | res->start;
 
+#ifndef CONFIG_PHYS_64BIT
+        ndfc->ndfcbase = ioremap((phys_addr_t)phys, res->end - res->start + 1);
+#else
         ndfc->ndfcbase = ioremap64(phys, res->end - res->start + 1);
+#endif
         if (!ndfc->ndfcbase) {
                 printk(KERN_ERR "NDFC: ioremap failed\n");
                 return -EIO;
diff --git a/drivers/mtd/nand/s3c2410.c b/drivers/mtd/nand/s3c2410.c
index 5fac4c421a20..b79a9cf2d162 100644
--- a/drivers/mtd/nand/s3c2410.c
+++ b/drivers/mtd/nand/s3c2410.c
@@ -60,8 +60,8 @@
 
 #include <asm/io.h>
 
-#include <asm/arch/regs-nand.h>
-#include <asm/arch/nand.h>
+#include <asm/plat-s3c/regs-nand.h>
+#include <asm/plat-s3c/nand.h>
 
 #ifdef CONFIG_MTD_NAND_S3C2410_HWECC
 static int hardware_ecc = 1;
diff --git a/drivers/mtd/onenand/Kconfig b/drivers/mtd/onenand/Kconfig
index c257d397d08a..cb41cbca64f7 100644
--- a/drivers/mtd/onenand/Kconfig
+++ b/drivers/mtd/onenand/Kconfig
@@ -40,4 +40,27 @@ config MTD_ONENAND_OTP
 
           OTP block is fully-guaranteed to be a valid block.
 
+config MTD_ONENAND_2X_PROGRAM
+        bool "OneNAND 2X program support"
+        help
+          The 2X Program is an extension of Program Operation.
+          Since the device is equipped with two DataRAMs, and two-plane NAND
+          Flash memory array, these two component enables simultaneous program
+          of 4KiB. Plane1 has only even blocks such as block0, block2, block4
+          while Plane2 has only odd blocks such as block1, block3, block5.
+          So MTD regards it as 4KiB page size and 256KiB block size
+
+          Now the following chips support it. (KFXXX16Q2M)
+            Demux: KFG2G16Q2M, KFH4G16Q2M, KFW8G16Q2M,
+            Mux:   KFM2G16Q2M, KFN4G16Q2M,
+
+          And more recent chips
+
+config MTD_ONENAND_SIM
+        tristate "OneNAND simulator support"
+        depends on MTD_PARTITIONS
+        help
+          The simulator may simulate various OneNAND flash chips for the
+          OneNAND MTD layer.
+
 endif # MTD_ONENAND
diff --git a/drivers/mtd/onenand/Makefile b/drivers/mtd/onenand/Makefile
index 269cfe467345..4d2eacfd7e11 100644
--- a/drivers/mtd/onenand/Makefile
+++ b/drivers/mtd/onenand/Makefile
@@ -8,4 +8,7 @@ obj-$(CONFIG_MTD_ONENAND)		+= onenand.o
 # Board specific.
 obj-$(CONFIG_MTD_ONENAND_GENERIC)       += generic.o
 
+# Simulator
+obj-$(CONFIG_MTD_ONENAND_SIM)           += onenand_sim.o
+
 onenand-objs = onenand_base.o onenand_bbt.o
diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
index 0537fac8de74..b2c40f67db83 100644
--- a/drivers/mtd/onenand/onenand_base.c
+++ b/drivers/mtd/onenand/onenand_base.c
@@ -206,6 +206,15 @@ static int onenand_command(struct mtd_info *mtd, int cmd, loff_t addr, size_t le
         default:
                 block = (int) (addr >> this->erase_shift);
                 page = (int) (addr >> this->page_shift);
+
+                if (ONENAND_IS_2PLANE(this)) {
+                        /* Make the even block number */
+                        block &= ~1;
+                        /* Is it the odd plane? */
+                        if (addr & this->writesize)
+                                block++;
+                        page >>= 1;
+                }
                 page &= this->page_mask;
                 break;
         }
@@ -216,8 +225,12 @@ static int onenand_command(struct mtd_info *mtd, int cmd, loff_t addr, size_t le
                 value = onenand_bufferram_address(this, block);
                 this->write_word(value, this->base + ONENAND_REG_START_ADDRESS2);
 
-                /* Switch to the next data buffer */
-                ONENAND_SET_NEXT_BUFFERRAM(this);
+                if (ONENAND_IS_2PLANE(this))
+                        /* It is always BufferRAM0 */
+                        ONENAND_SET_BUFFERRAM0(this);
+                else
+                        /* Switch to the next data buffer */
+                        ONENAND_SET_NEXT_BUFFERRAM(this);
 
                 return 0;
         }
@@ -247,6 +260,8 @@ static int onenand_command(struct mtd_info *mtd, int cmd, loff_t addr, size_t le
                         break;
 
                 default:
+                        if (ONENAND_IS_2PLANE(this) && cmd == ONENAND_CMD_PROG)
+                                cmd = ONENAND_CMD_2X_PROG;
                         dataram = ONENAND_CURRENT_BUFFERRAM(this);
                         break;
                 }
@@ -318,12 +333,14 @@ static int onenand_wait(struct mtd_info *mtd, int state)
         if (interrupt & ONENAND_INT_READ) {
                 int ecc = this->read_word(this->base + ONENAND_REG_ECC_STATUS);
                 if (ecc) {
-                        printk(KERN_ERR "onenand_wait: ECC error = 0x%04x\n", ecc);
                         if (ecc & ONENAND_ECC_2BIT_ALL) {
+                                printk(KERN_ERR "onenand_wait: ECC error = 0x%04x\n", ecc);
                                 mtd->ecc_stats.failed++;
                                 return ecc;
-                        } else if (ecc & ONENAND_ECC_1BIT_ALL)
+                        } else if (ecc & ONENAND_ECC_1BIT_ALL) {
+                                printk(KERN_INFO "onenand_wait: correctable ECC error = 0x%04x\n", ecc);
                                 mtd->ecc_stats.corrected++;
+                        }
                 }
         } else if (state == FL_READING) {
                 printk(KERN_ERR "onenand_wait: read timeout! ctrl=0x%04x intr=0x%04x\n", ctrl, interrupt);
@@ -445,8 +462,9 @@ static inline int onenand_bufferram_offset(struct mtd_info *mtd, int area)
         struct onenand_chip *this = mtd->priv;
 
         if (ONENAND_CURRENT_BUFFERRAM(this)) {
+                /* Note: the 'this->writesize' is a real page size */
                 if (area == ONENAND_DATARAM)
-                        return mtd->writesize;
+                        return this->writesize;
                 if (area == ONENAND_SPARERAM)
                         return mtd->oobsize;
         }
@@ -572,6 +590,30 @@ static int onenand_write_bufferram(struct mtd_info *mtd, int area,
 }
 
 /**
+ * onenand_get_2x_blockpage - [GENERIC] Get blockpage at 2x program mode
+ * @param mtd           MTD data structure
+ * @param addr          address to check
+ * @return              blockpage address
+ *
+ * Get blockpage address at 2x program mode
+ */
+static int onenand_get_2x_blockpage(struct mtd_info *mtd, loff_t addr)
+{
+        struct onenand_chip *this = mtd->priv;
+        int blockpage, block, page;
+
+        /* Calculate the even block number */
+        block = (int) (addr >> this->erase_shift) & ~1;
+        /* Is it the odd plane? */
+        if (addr & this->writesize)
+                block++;
+        page = (int) (addr >> (this->page_shift + 1)) & this->page_mask;
+        blockpage = (block << 7) | page;
+
+        return blockpage;
+}
+
+/**
  * onenand_check_bufferram - [GENERIC] Check BufferRAM information
  * @param mtd           MTD data structure
  * @param addr          address to check
@@ -585,7 +627,10 @@ static int onenand_check_bufferram(struct mtd_info *mtd, loff_t addr)
         int blockpage, found = 0;
         unsigned int i;
 
-        blockpage = (int) (addr >> this->page_shift);
+        if (ONENAND_IS_2PLANE(this))
+                blockpage = onenand_get_2x_blockpage(mtd, addr);
+        else
+                blockpage = (int) (addr >> this->page_shift);
 
         /* Is there valid data? */
         i = ONENAND_CURRENT_BUFFERRAM(this);
@@ -625,7 +670,10 @@ static void onenand_update_bufferram(struct mtd_info *mtd, loff_t addr,
         int blockpage;
         unsigned int i;
 
-        blockpage = (int) (addr >> this->page_shift);
+        if (ONENAND_IS_2PLANE(this))
+                blockpage = onenand_get_2x_blockpage(mtd, addr);
+        else
+                blockpage = (int) (addr >> this->page_shift);
 
         /* Invalidate another BufferRAM */
         i = ONENAND_NEXT_BUFFERRAM(this);
@@ -717,36 +765,86 @@ static void onenand_release_device(struct mtd_info *mtd)
 }
 
 /**
- * onenand_read - [MTD Interface] Read data from flash
+ * onenand_transfer_auto_oob - [Internal] oob auto-placement transfer
+ * @param mtd           MTD device structure
+ * @param buf           destination address
+ * @param column        oob offset to read from
+ * @param thislen       oob length to read
+ */
+static int onenand_transfer_auto_oob(struct mtd_info *mtd, uint8_t *buf, int column,
+                                int thislen)
+{
+        struct onenand_chip *this = mtd->priv;
+        struct nand_oobfree *free;
+        int readcol = column;
+        int readend = column + thislen;
+        int lastgap = 0;
+        unsigned int i;
+        uint8_t *oob_buf = this->oob_buf;
+
+        free = this->ecclayout->oobfree;
+        for (i = 0; i < MTD_MAX_OOBFREE_ENTRIES && free->length; i++, free++) {
+                if (readcol >= lastgap)
+                        readcol += free->offset - lastgap;
+                if (readend >= lastgap)
+                        readend += free->offset - lastgap;
+                lastgap = free->offset + free->length;
+        }
+        this->read_bufferram(mtd, ONENAND_SPARERAM, oob_buf, 0, mtd->oobsize);
+        free = this->ecclayout->oobfree;
+        for (i = 0; i < MTD_MAX_OOBFREE_ENTRIES && free->length; i++, free++) {
+                int free_end = free->offset + free->length;
+                if (free->offset < readend && free_end > readcol) {
+                        int st = max_t(int,free->offset,readcol);
+                        int ed = min_t(int,free_end,readend);
+                        int n = ed - st;
+                        memcpy(buf, oob_buf + st, n);
+                        buf += n;
+                } else if (column == 0)
+                        break;
+        }
+        return 0;
+}
+
+/**
+ * onenand_read_ops_nolock - [OneNAND Interface] OneNAND read main and/or out-of-band
  * @param mtd           MTD device structure
  * @param from          offset to read from
- * @param len           number of bytes to read
- * @param retlen        pointer to variable to store the number of read bytes
- * @param buf           the databuffer to put data
+ * @param ops:          oob operation description structure
  *
- * Read with ecc
-*/
-static int onenand_read(struct mtd_info *mtd, loff_t from, size_t len,
-        size_t *retlen, u_char *buf)
+ * OneNAND read main and/or out-of-band data
+ */
+static int onenand_read_ops_nolock(struct mtd_info *mtd, loff_t from,
+                                struct mtd_oob_ops *ops)
 {
         struct onenand_chip *this = mtd->priv;
         struct mtd_ecc_stats stats;
-        int read = 0, column;
-        int thislen;
+        size_t len = ops->len;
+        size_t ooblen = ops->ooblen;
+        u_char *buf = ops->datbuf;
+        u_char *oobbuf = ops->oobbuf;
+        int read = 0, column, thislen;
+        int oobread = 0, oobcolumn, thisooblen, oobsize;
         int ret = 0, boundary = 0;
+        int writesize = this->writesize;
 
-        DEBUG(MTD_DEBUG_LEVEL3, "onenand_read: from = 0x%08x, len = %i\n", (unsigned int) from, (int) len);
+        DEBUG(MTD_DEBUG_LEVEL3, "onenand_read_ops_nolock: from = 0x%08x, len = %i\n", (unsigned int) from, (int) len);
+
+        if (ops->mode == MTD_OOB_AUTO)
+                oobsize = this->ecclayout->oobavail;
+        else
+                oobsize = mtd->oobsize;
+
+        oobcolumn = from & (mtd->oobsize - 1);
 
         /* Do not allow reads past end of device */
         if ((from + len) > mtd->size) {
-                printk(KERN_ERR "onenand_read: Attempt read beyond end of device\n");
-                *retlen = 0;
+                printk(KERN_ERR "onenand_read_ops_nolock: Attempt read beyond end of device\n");
+                ops->retlen = 0;
+                ops->oobretlen = 0;
                 return -EINVAL;
         }
 
-        /* Grab the lock and see if the device is available */
-        onenand_get_device(mtd, FL_READING);
-
         stats = mtd->ecc_stats;
 
         /* Read-while-load method */
@@ -754,22 +852,22 @@ static int onenand_read(struct mtd_info *mtd, loff_t from, size_t len,
         /* Do first load to bufferRAM */
         if (read < len) {
                 if (!onenand_check_bufferram(mtd, from)) {
-                        this->command(mtd, ONENAND_CMD_READ, from, mtd->writesize);
+                        this->command(mtd, ONENAND_CMD_READ, from, writesize);
                         ret = this->wait(mtd, FL_READING);
                         onenand_update_bufferram(mtd, from, !ret);
                 }
         }
 
-        thislen = min_t(int, mtd->writesize, len - read);
-        column = from & (mtd->writesize - 1);
-        if (column + thislen > mtd->writesize)
-                thislen = mtd->writesize - column;
+        thislen = min_t(int, writesize, len - read);
+        column = from & (writesize - 1);
+        if (column + thislen > writesize)
+                thislen = writesize - column;
 
         while (!ret) {
                 /* If there is more to load then start next load */
                 from += thislen;
                 if (read + thislen < len) {
-                        this->command(mtd, ONENAND_CMD_READ, from, mtd->writesize);
+                        this->command(mtd, ONENAND_CMD_READ, from, writesize);
                         /*
                          * Chip boundary handling in DDP
                          * Now we issued chip 1 read and pointed chip 1
@@ -785,6 +883,21 @@ static int onenand_read(struct mtd_info *mtd, loff_t from, size_t len,
                 }
                 /* While load is going, read from last bufferRAM */
                 this->read_bufferram(mtd, ONENAND_DATARAM, buf, column, thislen);
+
+                /* Read oob area if needed */
+                if (oobbuf) {
+                        thisooblen = oobsize - oobcolumn;
+                        thisooblen = min_t(int, thisooblen, ooblen - oobread);
+
+                        if (ops->mode == MTD_OOB_AUTO)
+                                onenand_transfer_auto_oob(mtd, oobbuf, oobcolumn, thisooblen);
+                        else
+                                this->read_bufferram(mtd, ONENAND_SPARERAM, oobbuf, oobcolumn, thisooblen);
+                        oobread += thisooblen;
+                        oobbuf += thisooblen;
+                        oobcolumn = 0;
+                }
+
                 /* See if we are done */
                 read += thislen;
                 if (read == len)
@@ -794,7 +907,7 @@ static int onenand_read(struct mtd_info *mtd, loff_t from, size_t len,
                         this->write_word(ONENAND_DDP_CHIP1, this->base + ONENAND_REG_START_ADDRESS2);
                 ONENAND_SET_NEXT_BUFFERRAM(this);
                 buf += thislen;
-                thislen = min_t(int, mtd->writesize, len - read);
+                thislen = min_t(int, writesize, len - read);
                 column = 0;
                 cond_resched();
                 /* Now wait for load */
@@ -802,15 +915,13 @@ static int onenand_read(struct mtd_info *mtd, loff_t from, size_t len,
                 onenand_update_bufferram(mtd, from, !ret);
         }
 
-        /* Deselect and wake up anyone waiting on the device */
-        onenand_release_device(mtd);
-
         /*
          * Return success, if no ECC failures, else -EBADMSG
          * fs driver will take care of that, because
          * retlen == desired len and result == -EBADMSG
          */
-        *retlen = read;
+        ops->retlen = read;
+        ops->oobretlen = oobread;
 
         if (mtd->ecc_stats.failed - stats.failed)
                 return -EBADMSG;
@@ -822,69 +933,29 @@ static int onenand_read(struct mtd_info *mtd, loff_t from, size_t len,
 }
 
 /**
- * onenand_transfer_auto_oob - [Internal] oob auto-placement transfer
- * @param mtd           MTD device structure
- * @param buf           destination address
- * @param column        oob offset to read from
- * @param thislen       oob length to read
- */
-static int onenand_transfer_auto_oob(struct mtd_info *mtd, uint8_t *buf, int column,
-                                int thislen)
-{
-        struct onenand_chip *this = mtd->priv;
-        struct nand_oobfree *free;
-        int readcol = column;
-        int readend = column + thislen;
-        int lastgap = 0;
-        unsigned int i;
-        uint8_t *oob_buf = this->oob_buf;
-
-        free = this->ecclayout->oobfree;
-        for (i = 0; i < MTD_MAX_OOBFREE_ENTRIES && free->length; i++, free++) {
-                if (readcol >= lastgap)
-                        readcol += free->offset - lastgap;
-                if (readend >= lastgap)
-                        readend += free->offset - lastgap;
-                lastgap = free->offset + free->length;
-        }
-        this->read_bufferram(mtd, ONENAND_SPARERAM, oob_buf, 0, mtd->oobsize);
-        free = this->ecclayout->oobfree;
-        for (i = 0; i < MTD_MAX_OOBFREE_ENTRIES && free->length; i++, free++) {
-                int free_end = free->offset + free->length;
-                if (free->offset < readend && free_end > readcol) {
-                        int st = max_t(int,free->offset,readcol);
-                        int ed = min_t(int,free_end,readend);
-                        int n = ed - st;
-                        memcpy(buf, oob_buf + st, n);
-                        buf += n;
-                } else if (column == 0)
-                        break;
-        }
-        return 0;
-}
-
-/**
- * onenand_do_read_oob - [MTD Interface] OneNAND read out-of-band
+ * onenand_read_oob_nolock - [MTD Interface] OneNAND read out-of-band
  * @param mtd           MTD device structure
  * @param from          offset to read from
- * @param len           number of bytes to read
- * @param retlen        pointer to variable to store the number of read bytes
- * @param buf           the databuffer to put data
- * @param mode          operation mode
+ * @param ops:          oob operation description structure
  *
  * OneNAND read out-of-band data from the spare area
  */
-static int onenand_do_read_oob(struct mtd_info *mtd, loff_t from, size_t len,
-                        size_t *retlen, u_char *buf, mtd_oob_mode_t mode)
+static int onenand_read_oob_nolock(struct mtd_info *mtd, loff_t from,
+                        struct mtd_oob_ops *ops)
 {
         struct onenand_chip *this = mtd->priv;
         int read = 0, thislen, column, oobsize;
+        size_t len = ops->ooblen;
+        mtd_oob_mode_t mode = ops->mode;
+        u_char *buf = ops->oobbuf;
         int ret = 0;
 
-        DEBUG(MTD_DEBUG_LEVEL3, "onenand_read_oob: from = 0x%08x, len = %i\n", (unsigned int) from, (int) len);
+        from += ops->ooboffs;
+
+        DEBUG(MTD_DEBUG_LEVEL3, "onenand_read_oob_nolock: from = 0x%08x, len = %i\n", (unsigned int) from, (int) len);
 
         /* Initialize return length value */
-        *retlen = 0;
+        ops->oobretlen = 0;
 
         if (mode == MTD_OOB_AUTO)
                 oobsize = this->ecclayout->oobavail;
@@ -894,7 +965,7 @@ static int onenand_do_read_oob(struct mtd_info *mtd, loff_t from, size_t len,
         column = from & (mtd->oobsize - 1);
 
         if (unlikely(column >= oobsize)) {
-                printk(KERN_ERR "onenand_read_oob: Attempted to start read outside oob\n");
+                printk(KERN_ERR "onenand_read_oob_nolock: Attempted to start read outside oob\n");
                 return -EINVAL;
         }
 
@@ -902,13 +973,10 @@ static int onenand_do_read_oob(struct mtd_info *mtd, loff_t from, size_t len,
         if (unlikely(from >= mtd->size ||
                      column + len > ((mtd->size >> this->page_shift) -
                                      (from >> this->page_shift)) * oobsize)) {
-                printk(KERN_ERR "onenand_read_oob: Attempted to read beyond end of device\n");
+                printk(KERN_ERR "onenand_read_oob_nolock: Attempted to read beyond end of device\n");
                 return -EINVAL;
         }
 
-        /* Grab the lock and see if the device is available */
-        onenand_get_device(mtd, FL_READING);
-
         while (read < len) {
                 cond_resched();
 
@@ -928,7 +996,7 @@ static int onenand_do_read_oob(struct mtd_info *mtd, loff_t from, size_t len,
                         this->read_bufferram(mtd, ONENAND_SPARERAM, buf, column, thislen);
 
                 if (ret) {
-                        printk(KERN_ERR "onenand_read_oob: read failed = 0x%x\n", ret);
+                        printk(KERN_ERR "onenand_read_oob_nolock: read failed = 0x%x\n", ret);
                         break;
                 }
 
@@ -947,22 +1015,52 @@ static int onenand_do_read_oob(struct mtd_info *mtd, loff_t from, size_t len,
                 }
         }
 
-        /* Deselect and wake up anyone waiting on the device */
+        ops->oobretlen = read;
+        return ret;
+}
+
+/**
+ * onenand_read - [MTD Interface] Read data from flash
+ * @param mtd           MTD device structure
+ * @param from          offset to read from
+ * @param len           number of bytes to read
+ * @param retlen        pointer to variable to store the number of read bytes
+ * @param buf           the databuffer to put data
+ *
+ * Read with ecc
+*/
+static int onenand_read(struct mtd_info *mtd, loff_t from, size_t len,
+        size_t *retlen, u_char *buf)
+{
+        struct mtd_oob_ops ops = {
+                .len    = len,
+                .ooblen = 0,
+                .datbuf = buf,
+                .oobbuf = NULL,
+        };
+        int ret;
+
+        onenand_get_device(mtd, FL_READING);
+        ret = onenand_read_ops_nolock(mtd, from, &ops);
         onenand_release_device(mtd);
 
-        *retlen = read;
+        *retlen = ops.retlen;
         return ret;
 }
 
 /**
- * onenand_read_oob - [MTD Interface] NAND write data and/or out-of-band
+ * onenand_read_oob - [MTD Interface] Read main and/or out-of-band
  * @param mtd:          MTD device structure
  * @param from:         offset to read from
  * @param ops:          oob operation description structure
+
+ * Read main and/or out-of-band
  */
 static int onenand_read_oob(struct mtd_info *mtd, loff_t from,
                             struct mtd_oob_ops *ops)
 {
+        int ret;
+
         switch (ops->mode) {
         case MTD_OOB_PLACE:
         case MTD_OOB_AUTO:
@@ -972,8 +1070,15 @@ static int onenand_read_oob(struct mtd_info *mtd, loff_t from,
         default:
                 return -EINVAL;
         }
-        return onenand_do_read_oob(mtd, from + ops->ooboffs, ops->ooblen,
-                                   &ops->oobretlen, ops->oobbuf, ops->mode);
+
+        onenand_get_device(mtd, FL_READING);
+        if (ops->datbuf)
+                ret = onenand_read_ops_nolock(mtd, from, ops);
+        else
+                ret = onenand_read_oob_nolock(mtd, from, ops);
+        onenand_release_device(mtd);
+
+        return ret;
 }
 
 /**
@@ -1079,7 +1184,7 @@ int onenand_bbt_read_oob(struct mtd_info *mtd, loff_t from,
                 /* Read more? */
                 if (read < len) {
                         /* Update Page size */
-                        from += mtd->writesize;
+                        from += this->writesize;
                         column = 0;
                 }
         }
@@ -1097,7 +1202,6 @@ int onenand_bbt_read_oob(struct mtd_info *mtd, loff_t from,
  * @param mtd           MTD device structure
  * @param buf           the databuffer to verify
  * @param to            offset to read from
- *
  */
 static int onenand_verify_oob(struct mtd_info *mtd, const u_char *buf, loff_t to)
 {
@@ -1125,7 +1229,6 @@ static int onenand_verify_oob(struct mtd_info *mtd, const u_char *buf, loff_t to
  * @param buf          the databuffer to verify
  * @param addr         offset to read from
  * @param len          number of bytes to read and compare
- *
  */
 static int onenand_verify(struct mtd_info *mtd, const u_char *buf, loff_t addr, size_t len)
 {
@@ -1135,12 +1238,12 @@ static int onenand_verify(struct mtd_info *mtd, const u_char *buf, loff_t addr,
         int thislen, column;
 
         while (len != 0) {
-                thislen = min_t(int, mtd->writesize, len);
-                column = addr & (mtd->writesize - 1);
-                if (column + thislen > mtd->writesize)
-                        thislen = mtd->writesize - column;
+                thislen = min_t(int, this->writesize, len);
+                column = addr & (this->writesize - 1);
+                if (column + thislen > this->writesize)
+                        thislen = this->writesize - column;
 
-                this->command(mtd, ONENAND_CMD_READ, addr, mtd->writesize);
+                this->command(mtd, ONENAND_CMD_READ, addr, this->writesize);
 
                 onenand_update_bufferram(mtd, addr, 0);
 
@@ -1171,50 +1274,101 @@ static int onenand_verify(struct mtd_info *mtd, const u_char *buf, loff_t addr,
 #define NOTALIGNED(x)   ((x & (this->subpagesize - 1)) != 0)
 
 /**
- * onenand_write - [MTD Interface] write buffer to FLASH
+ * onenand_fill_auto_oob - [Internal] oob auto-placement transfer
+ * @param mtd           MTD device structure
+ * @param oob_buf       oob buffer
+ * @param buf           source address
+ * @param column        oob offset to write to
+ * @param thislen       oob length to write
+ */
+static int onenand_fill_auto_oob(struct mtd_info *mtd, u_char *oob_buf,
+                                  const u_char *buf, int column, int thislen)
+{
+        struct onenand_chip *this = mtd->priv;
+        struct nand_oobfree *free;
+        int writecol = column;
+        int writeend = column + thislen;
+        int lastgap = 0;
+        unsigned int i;
+
+        free = this->ecclayout->oobfree;
+        for (i = 0; i < MTD_MAX_OOBFREE_ENTRIES && free->length; i++, free++) {
+                if (writecol >= lastgap)
+                        writecol += free->offset - lastgap;
+                if (writeend >= lastgap)
+                        writeend += free->offset - lastgap;
+                lastgap = free->offset + free->length;
+        }
+        free = this->ecclayout->oobfree;
+        for (i = 0; i < MTD_MAX_OOBFREE_ENTRIES && free->length; i++, free++) {
+                int free_end = free->offset + free->length;
+                if (free->offset < writeend && free_end > writecol) {
+                        int st = max_t(int,free->offset,writecol);
+                        int ed = min_t(int,free_end,writeend);
+                        int n = ed - st;
+                        memcpy(oob_buf + st, buf, n);
+                        buf += n;
+                } else if (column == 0)
+                        break;
+        }
+        return 0;
+}
+
+/**
+ * onenand_write_ops_nolock - [OneNAND Interface] write main and/or out-of-band
  * @param mtd           MTD device structure
  * @param to            offset to write to
- * @param len           number of bytes to write
- * @param retlen        pointer to variable to store the number of written bytes
- * @param buf           the data to write
+ * @param ops           oob operation description structure
  *
- * Write with ECC
+ * Write main and/or oob with ECC
  */
-static int onenand_write(struct mtd_info *mtd, loff_t to, size_t len,
-        size_t *retlen, const u_char *buf)
+static int onenand_write_ops_nolock(struct mtd_info *mtd, loff_t to,
+                                struct mtd_oob_ops *ops)
 {
         struct onenand_chip *this = mtd->priv;
-        int written = 0;
+        int written = 0, column, thislen, subpage;
+        int oobwritten = 0, oobcolumn, thisooblen, oobsize;
+        size_t len = ops->len;
+        size_t ooblen = ops->ooblen;
+        const u_char *buf = ops->datbuf;
+        const u_char *oob = ops->oobbuf;
+        u_char *oobbuf;
         int ret = 0;
-        int column, subpage;
 
-        DEBUG(MTD_DEBUG_LEVEL3, "onenand_write: to = 0x%08x, len = %i\n", (unsigned int) to, (int) len);
+        DEBUG(MTD_DEBUG_LEVEL3, "onenand_write_ops_nolock: to = 0x%08x, len = %i\n", (unsigned int) to, (int) len);
 
         /* Initialize retlen, in case of early exit */
-        *retlen = 0;
+        ops->retlen = 0;
+        ops->oobretlen = 0;
 
         /* Do not allow writes past end of device */
         if (unlikely((to + len) > mtd->size)) {
-                printk(KERN_ERR "onenand_write: Attempt write to past end of device\n");
+                printk(KERN_ERR "onenand_write_ops_nolock: Attempt write to past end of device\n");
                 return -EINVAL;
         }
 
         /* Reject writes, which are not page aligned */
         if (unlikely(NOTALIGNED(to)) || unlikely(NOTALIGNED(len))) {
-                printk(KERN_ERR "onenand_write: Attempt to write not page aligned data\n");
+                printk(KERN_ERR "onenand_write_ops_nolock: Attempt to write not page aligned data\n");
                 return -EINVAL;
         }
 
-        column = to & (mtd->writesize - 1);
+        if (ops->mode == MTD_OOB_AUTO)
+                oobsize = this->ecclayout->oobavail;
+        else
+                oobsize = mtd->oobsize;
 
-        /* Grab the lock and see if the device is available */
-        onenand_get_device(mtd, FL_WRITING);
+        oobcolumn = to & (mtd->oobsize - 1);
+
+        column = to & (mtd->writesize - 1);
 
         /* Loop until all data write */
         while (written < len) {
-                int thislen = min_t(int, mtd->writesize - column, len - written);
                 u_char *wbuf = (u_char *) buf;
 
+                thislen = min_t(int, mtd->writesize - column, len - written);
+                thisooblen = min_t(int, oobsize - oobcolumn, ooblen - oobwritten);
+
                 cond_resched();
 
                 this->command(mtd, ONENAND_CMD_BUFFERRAM, to, thislen);
@@ -1228,7 +1382,25 @@ static int onenand_write(struct mtd_info *mtd, loff_t to, size_t len,
                 }
 
                 this->write_bufferram(mtd, ONENAND_DATARAM, wbuf, 0, mtd->writesize);
-                this->write_bufferram(mtd, ONENAND_SPARERAM, ffchars, 0, mtd->oobsize);
+
+                if (oob) {
+                        oobbuf = this->oob_buf;
+
+                        /* We send data to spare ram with oobsize
+                         * to prevent byte access */
+                        memset(oobbuf, 0xff, mtd->oobsize);
+                        if (ops->mode == MTD_OOB_AUTO)
+                                onenand_fill_auto_oob(mtd, oobbuf, oob, oobcolumn, thisooblen);
+                        else
+                                memcpy(oobbuf + oobcolumn, oob, thisooblen);
+
+                        oobwritten += thisooblen;
+                        oob += thisooblen;
+                        oobcolumn = 0;
+                } else
+                        oobbuf = (u_char *) ffchars;
+
+                this->write_bufferram(mtd, ONENAND_SPARERAM, oobbuf, 0, mtd->oobsize);
 
                 this->command(mtd, ONENAND_CMD_PROG, to, mtd->writesize);
 
@@ -1236,16 +1408,20 @@ static int onenand_write(struct mtd_info *mtd, loff_t to, size_t len,
 
                 /* In partial page write we don't update bufferram */
                 onenand_update_bufferram(mtd, to, !ret && !subpage);
+                if (ONENAND_IS_2PLANE(this)) {
+                        ONENAND_SET_BUFFERRAM1(this);
+                        onenand_update_bufferram(mtd, to + this->writesize, !ret && !subpage);
+                }
 
                 if (ret) {
-                        printk(KERN_ERR "onenand_write: write filaed %d\n", ret);
+                        printk(KERN_ERR "onenand_write_ops_nolock: write filaed %d\n", ret);
                         break;
                 }
 
                 /* Only check verify write turn on */
                 ret = onenand_verify(mtd, (u_char *) wbuf, to, thislen);
                 if (ret) {
-                        printk(KERN_ERR "onenand_write: verify failed %d\n", ret);
+                        printk(KERN_ERR "onenand_write_ops_nolock: verify failed %d\n", ret);
                         break;
                 }
 
@@ -1262,54 +1438,14 @@ static int onenand_write(struct mtd_info *mtd, loff_t to, size_t len,
         /* Deselect and wake up anyone waiting on the device */
         onenand_release_device(mtd);
 
-        *retlen = written;
+        ops->retlen = written;
 
         return ret;
 }
 
-/**
- * onenand_fill_auto_oob - [Internal] oob auto-placement transfer
- * @param mtd           MTD device structure
- * @param oob_buf       oob buffer
- * @param buf           source address
- * @param column        oob offset to write to
- * @param thislen       oob length to write
- */
-static int onenand_fill_auto_oob(struct mtd_info *mtd, u_char *oob_buf,
-                                  const u_char *buf, int column, int thislen)
-{
-        struct onenand_chip *this = mtd->priv;
-        struct nand_oobfree *free;
-        int writecol = column;
-        int writeend = column + thislen;
-        int lastgap = 0;
-        unsigned int i;
-
-        free = this->ecclayout->oobfree;
-        for (i = 0; i < MTD_MAX_OOBFREE_ENTRIES && free->length; i++, free++) {
-                if (writecol >= lastgap)
-                        writecol += free->offset - lastgap;
-                if (writeend >= lastgap)
-                        writeend += free->offset - lastgap;
-                lastgap = free->offset + free->length;
-        }
-        free = this->ecclayout->oobfree;
-        for (i = 0; i < MTD_MAX_OOBFREE_ENTRIES && free->length; i++, free++) {
-                int free_end = free->offset + free->length;
-                if (free->offset < writeend && free_end > writecol) {
-                        int st = max_t(int,free->offset,writecol);
-                        int ed = min_t(int,free_end,writeend);
-                        int n = ed - st;
-                        memcpy(oob_buf + st, buf, n);
-                        buf += n;
-                } else if (column == 0)
-                        break;
-        }
-        return 0;
-}
 
 /**
- * onenand_do_write_oob - [Internal] OneNAND write out-of-band
+ * onenand_write_oob_nolock - [Internal] OneNAND write out-of-band
  * @param mtd           MTD device structure
  * @param to            offset to write to
  * @param len           number of bytes to write
@@ -1319,18 +1455,23 @@ static int onenand_fill_auto_oob(struct mtd_info *mtd, u_char *oob_buf,
  *
  * OneNAND write out-of-band
  */
-static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
-                                size_t *retlen, const u_char *buf, mtd_oob_mode_t mode)
+static int onenand_write_oob_nolock(struct mtd_info *mtd, loff_t to,
+                                    struct mtd_oob_ops *ops)
 {
         struct onenand_chip *this = mtd->priv;
         int column, ret = 0, oobsize;
         int written = 0;
         u_char *oobbuf;
+        size_t len = ops->ooblen;
+        const u_char *buf = ops->oobbuf;
+        mtd_oob_mode_t mode = ops->mode;
 
-        DEBUG(MTD_DEBUG_LEVEL3, "onenand_write_oob: to = 0x%08x, len = %i\n", (unsigned int) to, (int) len);
+        to += ops->ooboffs;
+
+        DEBUG(MTD_DEBUG_LEVEL3, "onenand_write_oob_nolock: to = 0x%08x, len = %i\n", (unsigned int) to, (int) len);
 
         /* Initialize retlen, in case of early exit */
-        *retlen = 0;
+        ops->oobretlen = 0;
 
         if (mode == MTD_OOB_AUTO)
                 oobsize = this->ecclayout->oobavail;
@@ -1340,13 +1481,13 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
         column = to & (mtd->oobsize - 1);
 
         if (unlikely(column >= oobsize)) {
-                printk(KERN_ERR "onenand_write_oob: Attempted to start write outside oob\n");
+                printk(KERN_ERR "onenand_write_oob_nolock: Attempted to start write outside oob\n");
                 return -EINVAL;
         }
 
         /* For compatibility with NAND: Do not allow write past end of page */
         if (unlikely(column + len > oobsize)) {
-                printk(KERN_ERR "onenand_write_oob: "
+                printk(KERN_ERR "onenand_write_oob_nolock: "
                       "Attempt to write past end of page\n");
                 return -EINVAL;
         }
@@ -1355,13 +1496,10 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
         if (unlikely(to >= mtd->size ||
                      column + len > ((mtd->size >> this->page_shift) -
                                      (to >> this->page_shift)) * oobsize)) {
-                printk(KERN_ERR "onenand_write_oob: Attempted to write past end of device\n");
+                printk(KERN_ERR "onenand_write_oob_nolock: Attempted to write past end of device\n");
                 return -EINVAL;
         }
 
-        /* Grab the lock and see if the device is available */
-        onenand_get_device(mtd, FL_WRITING);
-
         oobbuf = this->oob_buf;
 
         /* Loop until all data write */
@@ -1384,16 +1522,20 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
                 this->command(mtd, ONENAND_CMD_PROGOOB, to, mtd->oobsize);
 
                 onenand_update_bufferram(mtd, to, 0);
+                if (ONENAND_IS_2PLANE(this)) {
+                        ONENAND_SET_BUFFERRAM1(this);
+                        onenand_update_bufferram(mtd, to + this->writesize, 0);
+                }
 
                 ret = this->wait(mtd, FL_WRITING);
                 if (ret) {
-                        printk(KERN_ERR "onenand_write_oob: write failed %d\n", ret);
+                        printk(KERN_ERR "onenand_write_oob_nolock: write failed %d\n", ret);
                         break;
                 }
 
                 ret = onenand_verify_oob(mtd, oobbuf, to);
                 if (ret) {
-                        printk(KERN_ERR "onenand_write_oob: verify failed %d\n", ret);
+                        printk(KERN_ERR "onenand_write_oob_nolock: verify failed %d\n", ret);
                         break;
                 }
 
@@ -1406,11 +1548,37 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
                 column = 0;
         }
 
-        /* Deselect and wake up anyone waiting on the device */
-        onenand_release_device(mtd);
+        ops->oobretlen = written;
+
+        return ret;
+}
+
+/**
+ * onenand_write - [MTD Interface] write buffer to FLASH
+ * @param mtd           MTD device structure
+ * @param to            offset to write to
+ * @param len           number of bytes to write
+ * @param retlen        pointer to variable to store the number of written bytes
+ * @param buf           the data to write
+ *
+ * Write with ECC
+ */
+static int onenand_write(struct mtd_info *mtd, loff_t to, size_t len,
+        size_t *retlen, const u_char *buf)
+{
+        struct mtd_oob_ops ops = {
+                .len    = len,
+                .ooblen = 0,
+                .datbuf = (u_char *) buf,
+                .oobbuf = NULL,
+        };
+        int ret;
 
-        *retlen = written;
+        onenand_get_device(mtd, FL_WRITING);
+        ret = onenand_write_ops_nolock(mtd, to, &ops);
+        onenand_release_device(mtd);
 
+        *retlen = ops.retlen;
         return ret;
 }
 
@@ -1423,6 +1591,8 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
 static int onenand_write_oob(struct mtd_info *mtd, loff_t to,
                              struct mtd_oob_ops *ops)
 {
+        int ret;
+
         switch (ops->mode) {
         case MTD_OOB_PLACE:
         case MTD_OOB_AUTO:
@@ -1432,21 +1602,27 @@ static int onenand_write_oob(struct mtd_info *mtd, loff_t to,
         default:
                 return -EINVAL;
         }
-        return onenand_do_write_oob(mtd, to + ops->ooboffs, ops->ooblen,
-                                    &ops->oobretlen, ops->oobbuf, ops->mode);
+
+        onenand_get_device(mtd, FL_WRITING);
+        if (ops->datbuf)
+                ret = onenand_write_ops_nolock(mtd, to, ops);
+        else
+                ret = onenand_write_oob_nolock(mtd, to, ops);
+        onenand_release_device(mtd);
+
+        return ret;
 }
 
 /**
- * onenand_block_checkbad - [GENERIC] Check if a block is marked bad
+ * onenand_block_isbad_nolock - [GENERIC] Check if a block is marked bad
  * @param mtd           MTD device structure
  * @param ofs           offset from device start
- * @param getchip       0, if the chip is already selected
  * @param allowbbt      1, if its allowed to access the bbt area
  *
  * Check, if the block is bad. Either by reading the bad block table or
  * calling of the scan function.
  */
-static int onenand_block_checkbad(struct mtd_info *mtd, loff_t ofs, int getchip, int allowbbt)
+static int onenand_block_isbad_nolock(struct mtd_info *mtd, loff_t ofs, int allowbbt)
 {
         struct onenand_chip *this = mtd->priv;
         struct bbm_info *bbm = this->bbm;
@@ -1507,7 +1683,7 @@ static int onenand_erase(struct mtd_info *mtd, struct erase_info *instr)
                 cond_resched();
 
                 /* Check if we have a bad block, we do not erase bad blocks */
-                if (onenand_block_checkbad(mtd, addr, 0, 0)) {
+                if (onenand_block_isbad_nolock(mtd, addr, 0)) {
                         printk (KERN_WARNING "onenand_erase: attempt to erase a bad block at addr 0x%08x\n", (unsigned int) addr);
                         instr->state = MTD_ERASE_FAILED;
                         goto erase_exit;
@@ -1571,11 +1747,16 @@ static void onenand_sync(struct mtd_info *mtd)
  */
 static int onenand_block_isbad(struct mtd_info *mtd, loff_t ofs)
 {
+        int ret;
+
         /* Check for invalid offset */
         if (ofs > mtd->size)
                 return -EINVAL;
 
-        return onenand_block_checkbad(mtd, ofs, 1, 0);
+        onenand_get_device(mtd, FL_READING);
+        ret = onenand_block_isbad_nolock(mtd, ofs, 0);
+        onenand_release_device(mtd);
+        return ret;
 }
 
 /**
@@ -1591,7 +1772,12 @@ static int onenand_default_block_markbad(struct mtd_info *mtd, loff_t ofs)
         struct onenand_chip *this = mtd->priv;
         struct bbm_info *bbm = this->bbm;
         u_char buf[2] = {0, 0};
-        size_t retlen;
+        struct mtd_oob_ops ops = {
+                .mode = MTD_OOB_PLACE,
+                .ooblen = 2,
+                .oobbuf = buf,
+                .ooboffs = 0,
+        };
         int block;
 
         /* Get block number */
@@ -1601,7 +1787,7 @@ static int onenand_default_block_markbad(struct mtd_info *mtd, loff_t ofs)
 
         /* We write two bytes, so we dont have to mess with 16 bit access */
         ofs += mtd->oobsize + (bbm->badblockpos & ~0x01);
-        return onenand_do_write_oob(mtd, ofs , 2, &retlen, buf, MTD_OOB_PLACE);
+        return onenand_write_oob_nolock(mtd, ofs, &ops);
 }
 
 /**
@@ -1624,7 +1810,10 @@ static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs)
                 return ret;
         }
 
-        return this->block_markbad(mtd, ofs);
+        onenand_get_device(mtd, FL_WRITING);
+        ret = this->block_markbad(mtd, ofs);
+        onenand_release_device(mtd);
+        return ret;
 }
 
 /**
@@ -1823,13 +2012,19 @@ static int do_otp_read(struct mtd_info *mtd, loff_t from, size_t len,
                 size_t *retlen, u_char *buf)
 {
         struct onenand_chip *this = mtd->priv;
+        struct mtd_oob_ops ops = {
+                .len    = len,
+                .ooblen = 0,
+                .datbuf = buf,
+                .oobbuf = NULL,
+        };
         int ret;
 
         /* Enter OTP access mode */
         this->command(mtd, ONENAND_CMD_OTP_ACCESS, 0, 0);
         this->wait(mtd, FL_OTPING);
 
-        ret = mtd->read(mtd, from, len, retlen, buf);
+        ret = onenand_read_ops_nolock(mtd, from, &ops);
 
         /* Exit OTP access mode */
         this->command(mtd, ONENAND_CMD_RESET, 0, 0);
@@ -1841,19 +2036,20 @@ static int do_otp_read(struct mtd_info *mtd, loff_t from, size_t len,
 /**
  * do_otp_write - [DEFAULT] Write OTP block area
  * @param mtd           MTD device structure
- * @param from          The offset to write
+ * @param to            The offset to write
  * @param len           number of bytes to write
  * @param retlen        pointer to variable to store the number of write bytes
  * @param buf           the databuffer to put/get data
  *
  * Write OTP block area.
  */
-static int do_otp_write(struct mtd_info *mtd, loff_t from, size_t len,
+static int do_otp_write(struct mtd_info *mtd, loff_t to, size_t len,
                 size_t *retlen, u_char *buf)
 {
         struct onenand_chip *this = mtd->priv;
         unsigned char *pbuf = buf;
         int ret;
+        struct mtd_oob_ops ops;
 
         /* Force buffer page aligned */
         if (len < mtd->writesize) {
@@ -1867,7 +2063,12 @@ static int do_otp_write(struct mtd_info *mtd, loff_t from, size_t len,
         this->command(mtd, ONENAND_CMD_OTP_ACCESS, 0, 0);
         this->wait(mtd, FL_OTPING);
 
-        ret = mtd->write(mtd, from, len, retlen, pbuf);
+        ops.len = len;
+        ops.ooblen = 0;
+        ops.datbuf = pbuf;
+        ops.oobbuf = NULL;
+        ret = onenand_write_ops_nolock(mtd, to, &ops);
+        *retlen = ops.retlen;
 
         /* Exit OTP access mode */
         this->command(mtd, ONENAND_CMD_RESET, 0, 0);
@@ -1890,13 +2091,21 @@ static int do_otp_lock(struct mtd_info *mtd, loff_t from, size_t len,
                 size_t *retlen, u_char *buf)
 {
         struct onenand_chip *this = mtd->priv;
+        struct mtd_oob_ops ops = {
+                .mode = MTD_OOB_PLACE,
+                .ooblen = len,
+                .oobbuf = buf,
+                .ooboffs = 0,
+        };
         int ret;
 
         /* Enter OTP access mode */
         this->command(mtd, ONENAND_CMD_OTP_ACCESS, 0, 0);
         this->wait(mtd, FL_OTPING);
 
-        ret = onenand_do_write_oob(mtd, from, len, retlen, buf, MTD_OOB_PLACE);
+        ret = onenand_write_oob_nolock(mtd, from, &ops);
+
+        *retlen = ops.oobretlen;
 
         /* Exit OTP access mode */
         this->command(mtd, ONENAND_CMD_RESET, 0, 0);
@@ -1943,13 +2152,16 @@ static int onenand_otp_walk(struct mtd_info *mtd, loff_t from, size_t len,
         if (((mtd->writesize * otp_pages) - (from + len)) < 0)
                 return 0;
 
+        onenand_get_device(mtd, FL_OTPING);
         while (len > 0 && otp_pages > 0) {
                 if (!action) {  /* OTP Info functions */
                         struct otp_info *otpinfo;
 
                         len -= sizeof(struct otp_info);
-                        if (len <= 0)
-                                return -ENOSPC;
+                        if (len <= 0) {
+                                ret = -ENOSPC;
+                                break;
+                        }
 
                         otpinfo = (struct otp_info *) buf;
                         otpinfo->start = from;
@@ -1969,13 +2181,14 @@ static int onenand_otp_walk(struct mtd_info *mtd, loff_t from, size_t len,
                         len -= size;
                         *retlen += size;
 
-                        if (ret < 0)
-                                return ret;
+                        if (ret)
+                                break;
                 }
                 otp_pages--;
         }
+        onenand_release_device(mtd);
 
-        return 0;
+        return ret;
 }
 
 /**
@@ -2107,6 +2320,7 @@ static int onenand_lock_user_prot_reg(struct mtd_info *mtd, loff_t from,
  *
  * Check and set OneNAND features
  * - lock scheme
+ * - two plane
  */
 static void onenand_check_features(struct mtd_info *mtd)
 {
@@ -2118,19 +2332,35 @@ static void onenand_check_features(struct mtd_info *mtd)
         process = this->version_id >> ONENAND_VERSION_PROCESS_SHIFT;
 
         /* Lock scheme */
-        if (density >= ONENAND_DEVICE_DENSITY_1Gb) {
+        switch (density) {
+        case ONENAND_DEVICE_DENSITY_4Gb:
+                this->options |= ONENAND_HAS_2PLANE;
+
+        case ONENAND_DEVICE_DENSITY_2Gb:
+                /* 2Gb DDP don't have 2 plane */
+                if (!ONENAND_IS_DDP(this))
+                        this->options |= ONENAND_HAS_2PLANE;
+                this->options |= ONENAND_HAS_UNLOCK_ALL;
+
+        case ONENAND_DEVICE_DENSITY_1Gb:
                 /* A-Die has all block unlock */
-                if (process) {
-                        printk(KERN_DEBUG "Chip support all block unlock\n");
+                if (process)
                         this->options |= ONENAND_HAS_UNLOCK_ALL;
-                }
-        } else {
-                /* Some OneNAND has continues lock scheme */
-                if (!process) {
-                        printk(KERN_DEBUG "Lock scheme is Continues Lock\n");
+                break;
+
+        default:
+                /* Some OneNAND has continuous lock scheme */
+                if (!process)
                         this->options |= ONENAND_HAS_CONT_LOCK;
-                }
+                break;
         }
+
+        if (this->options & ONENAND_HAS_CONT_LOCK)
+                printk(KERN_DEBUG "Lock scheme is Continuous Lock\n");
+        if (this->options & ONENAND_HAS_UNLOCK_ALL)
+                printk(KERN_DEBUG "Chip support all block unlock\n");
+        if (this->options & ONENAND_HAS_2PLANE)
+                printk(KERN_DEBUG "Chip has 2 plane\n");
 }
 
 /**
@@ -2154,7 +2384,7 @@ static void onenand_print_device_info(int device, int version)
                 (16 << density),
                 vcc ? "2.65/3.3" : "1.8",
                 device);
-        printk(KERN_DEBUG "OneNAND version = 0x%04x\n", version);
+        printk(KERN_INFO "OneNAND version = 0x%04x\n", version);
 }
 
 static const struct onenand_manufacturers onenand_manuf_ids[] = {
@@ -2257,6 +2487,8 @@ static int onenand_probe(struct mtd_info *mtd)
         this->erase_shift = ffs(mtd->erasesize) - 1;
         this->page_shift = ffs(mtd->writesize) - 1;
         this->page_mask = (1 << (this->erase_shift - this->page_shift)) - 1;
+        /* It's real page size */
+        this->writesize = mtd->writesize;
 
         /* REVIST: Multichip handling */
 
@@ -2265,6 +2497,17 @@ static int onenand_probe(struct mtd_info *mtd)
         /* Check OneNAND features */
         onenand_check_features(mtd);
 
+        /*
+         * We emulate the 4KiB page and 256KiB erase block size
+         * But oobsize is still 64 bytes.
+         * It is only valid if you turn on 2X program support,
+         * Otherwise it will be ignored by compiler.
+         */
+        if (ONENAND_IS_2PLANE(this)) {
+                mtd->writesize <<= 1;
+                mtd->erasesize <<= 1;
+        }
+
         return 0;
 }
 
diff --git a/drivers/mtd/onenand/onenand_sim.c b/drivers/mtd/onenand/onenand_sim.c
new file mode 100644
index 000000000000..0d89ad5776fa
--- /dev/null
+++ b/drivers/mtd/onenand/onenand_sim.c
@@ -0,0 +1,495 @@
+/*
+ *  linux/drivers/mtd/onenand/onenand_sim.c
+ *
+ *  The OneNAND simulator
+ *
+ *  Copyright © 2005-2007 Samsung Electronics
+ *  Kyungmin Park <kyungmin.park@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/vmalloc.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/mtd/onenand.h>
+
+#include <linux/io.h>
+
+#ifndef CONFIG_ONENAND_SIM_MANUFACTURER
+#define CONFIG_ONENAND_SIM_MANUFACTURER         0xec
+#endif
+#ifndef CONFIG_ONENAND_SIM_DEVICE_ID
+#define CONFIG_ONENAND_SIM_DEVICE_ID            0x04
+#endif
+#ifndef CONFIG_ONENAND_SIM_VERSION_ID
+#define CONFIG_ONENAND_SIM_VERSION_ID           0x1e
+#endif
+
+static int manuf_id     = CONFIG_ONENAND_SIM_MANUFACTURER;
+static int device_id    = CONFIG_ONENAND_SIM_DEVICE_ID;
+static int version_id   = CONFIG_ONENAND_SIM_VERSION_ID;
+
+struct onenand_flash {
+        void __iomem *base;
+        void __iomem *data;
+};
+
+#define ONENAND_CORE(flash)             (flash->data)
+#define ONENAND_CORE_SPARE(flash, this, offset)                         \
+        ((flash->data) + (this->chipsize) + (offset >> 5))
+
+#define ONENAND_MAIN_AREA(this, offset)                                 \
+        (this->base + ONENAND_DATARAM + offset)
+
+#define ONENAND_SPARE_AREA(this, offset)                                \
+        (this->base + ONENAND_SPARERAM + offset)
+
+#define ONENAND_GET_WP_STATUS(this)                                     \
+        (readw(this->base + ONENAND_REG_WP_STATUS))
+
+#define ONENAND_SET_WP_STATUS(v, this)                                  \
+        (writew(v, this->base + ONENAND_REG_WP_STATUS))
+
+/* It has all 0xff chars */
+#define MAX_ONENAND_PAGESIZE            (2048 + 64)
+static unsigned char *ffchars;
+
+static struct mtd_partition os_partitions[] = {
+        {
+                .name           = "OneNAND simulator partition",
+                .offset         = 0,
+                .size           = MTDPART_SIZ_FULL,
+        },
+};
+
+/*
+ * OneNAND simulator mtd
+ */
+struct onenand_info {
+        struct mtd_info         mtd;
+        struct mtd_partition    *parts;
+        struct onenand_chip     onenand;
+        struct onenand_flash    flash;
+};
+
+static struct onenand_info *info;
+
+#define DPRINTK(format, args...)                                        \
+do {                                                                    \
+        printk(KERN_DEBUG "%s[%d]: " format "\n", __func__,             \
+                           __LINE__, ##args);                           \
+} while (0)
+
+/**
+ * onenand_lock_handle - Handle Lock scheme
+ * @param this          OneNAND device structure
+ * @param cmd           The command to be sent
+ *
+ * Send lock command to OneNAND device.
+ * The lock scheme is depends on chip type.
+ */
+static void onenand_lock_handle(struct onenand_chip *this, int cmd)
+{
+        int block_lock_scheme;
+        int status;
+
+        status = ONENAND_GET_WP_STATUS(this);
+        block_lock_scheme = !(this->options & ONENAND_HAS_CONT_LOCK);
+
+        switch (cmd) {
+        case ONENAND_CMD_UNLOCK:
+                if (block_lock_scheme)
+                        ONENAND_SET_WP_STATUS(ONENAND_WP_US, this);
+                else
+                        ONENAND_SET_WP_STATUS(status | ONENAND_WP_US, this);
+                break;
+
+        case ONENAND_CMD_LOCK:
+                if (block_lock_scheme)
+                        ONENAND_SET_WP_STATUS(ONENAND_WP_LS, this);
+                else
+                        ONENAND_SET_WP_STATUS(status | ONENAND_WP_LS, this);
+                break;
+
+        case ONENAND_CMD_LOCK_TIGHT:
+                if (block_lock_scheme)
+                        ONENAND_SET_WP_STATUS(ONENAND_WP_LTS, this);
+                else
+                        ONENAND_SET_WP_STATUS(status | ONENAND_WP_LTS, this);
+                break;
+
+        default:
+                break;
+        }
+}
+
+/**
+ * onenand_bootram_handle - Handle BootRAM area
+ * @param this          OneNAND device structure
+ * @param cmd           The command to be sent
+ *
+ * Emulate BootRAM area. It is possible to do basic operation using BootRAM.
+ */
+static void onenand_bootram_handle(struct onenand_chip *this, int cmd)
+{
+        switch (cmd) {
+        case ONENAND_CMD_READID:
+                writew(manuf_id, this->base);
+                writew(device_id, this->base + 2);
+                writew(version_id, this->base + 4);
+                break;
+
+        default:
+                /* REVIST: Handle other commands */
+                break;
+        }
+}
+
+/**
+ * onenand_update_interrupt - Set interrupt register
+ * @param this         OneNAND device structure
+ * @param cmd          The command to be sent
+ *
+ * Update interrupt register. The status is depends on command.
+ */
+static void onenand_update_interrupt(struct onenand_chip *this, int cmd)
+{
+        int interrupt = ONENAND_INT_MASTER;
+
+        switch (cmd) {
+        case ONENAND_CMD_READ:
+        case ONENAND_CMD_READOOB:
+                interrupt |= ONENAND_INT_READ;
+                break;
+
+        case ONENAND_CMD_PROG:
+        case ONENAND_CMD_PROGOOB:
+                interrupt |= ONENAND_INT_WRITE;
+                break;
+
+        case ONENAND_CMD_ERASE:
+                interrupt |= ONENAND_INT_ERASE;
+                break;
+
+        case ONENAND_CMD_RESET:
+                interrupt |= ONENAND_INT_RESET;
+                break;
+
+        default:
+                break;
+        }
+
+        writew(interrupt, this->base + ONENAND_REG_INTERRUPT);
+}
+
+/**
+ * onenand_check_overwrite - Check over-write if happend
+ * @param dest          The destination pointer
+ * @param src           The source pointer
+ * @param count         The length to be check
+ * @return              0 on same, otherwise 1
+ *
+ * Compare the source with destination
+ */
+static int onenand_check_overwrite(void *dest, void *src, size_t count)
+{
+        unsigned int *s = (unsigned int *) src;
+        unsigned int *d = (unsigned int *) dest;
+        int i;
+
+        count >>= 2;
+        for (i = 0; i < count; i++)
+                if ((*s++ ^ *d++) != 0)
+                        return 1;
+
+        return 0;
+}
+
+/**
+ * onenand_data_handle - Handle OneNAND Core and DataRAM
+ * @param this          OneNAND device structure
+ * @param cmd           The command to be sent
+ * @param dataram       Which dataram used
+ * @param offset        The offset to OneNAND Core
+ *
+ * Copy data from OneNAND Core to DataRAM (read)
+ * Copy data from DataRAM to OneNAND Core (write)
+ * Erase the OneNAND Core (erase)
+ */
+static void onenand_data_handle(struct onenand_chip *this, int cmd,
+                                int dataram, unsigned int offset)
+{
+        struct mtd_info *mtd = &info->mtd;
+        struct onenand_flash *flash = this->priv;
+        int main_offset, spare_offset;
+        void __iomem *src;
+        void __iomem *dest;
+        unsigned int i;
+
+        if (dataram) {
+                main_offset = mtd->writesize;
+                spare_offset = mtd->oobsize;
+        } else {
+                main_offset = 0;
+                spare_offset = 0;
+        }
+
+        switch (cmd) {
+        case ONENAND_CMD_READ:
+                src = ONENAND_CORE(flash) + offset;
+                dest = ONENAND_MAIN_AREA(this, main_offset);
+                memcpy(dest, src, mtd->writesize);
+                /* Fall through */
+
+        case ONENAND_CMD_READOOB:
+                src = ONENAND_CORE_SPARE(flash, this, offset);
+                dest = ONENAND_SPARE_AREA(this, spare_offset);
+                memcpy(dest, src, mtd->oobsize);
+                break;
+
+        case ONENAND_CMD_PROG:
+                src = ONENAND_MAIN_AREA(this, main_offset);
+                dest = ONENAND_CORE(flash) + offset;
+                /* To handle partial write */
+                for (i = 0; i < (1 << mtd->subpage_sft); i++) {
+                        int off = i * this->subpagesize;
+                        if (!memcmp(src + off, ffchars, this->subpagesize))
+                                continue;
+                        if (memcmp(dest + off, ffchars, this->subpagesize) &&
+                            onenand_check_overwrite(dest + off, src + off, this->subpagesize))
+                                printk(KERN_ERR "over-write happend at 0x%08x\n", offset);
+                        memcpy(dest + off, src + off, this->subpagesize);
+                }
+                /* Fall through */
+
+        case ONENAND_CMD_PROGOOB:
+                src = ONENAND_SPARE_AREA(this, spare_offset);
+                /* Check all data is 0xff chars */
+                if (!memcmp(src, ffchars, mtd->oobsize))
+                        break;
+
+                dest = ONENAND_CORE_SPARE(flash, this, offset);
+                if (memcmp(dest, ffchars, mtd->oobsize) &&
+                    onenand_check_overwrite(dest, src, mtd->oobsize))
+                        printk(KERN_ERR "OOB: over-write happend at 0x%08x\n",
+                               offset);
+                memcpy(dest, src, mtd->oobsize);
+                break;
+
+        case ONENAND_CMD_ERASE:
+                memset(ONENAND_CORE(flash) + offset, 0xff, mtd->erasesize);
+                memset(ONENAND_CORE_SPARE(flash, this, offset), 0xff,
+                       (mtd->erasesize >> 5));
+                break;
+
+        default:
+                break;
+        }
+}
+
+/**
+ * onenand_command_handle - Handle command
+ * @param this          OneNAND device structure
+ * @param cmd           The command to be sent
+ *
+ * Emulate OneNAND command.
+ */
+static void onenand_command_handle(struct onenand_chip *this, int cmd)
+{
+        unsigned long offset = 0;
+        int block = -1, page = -1, bufferram = -1;
+        int dataram = 0;
+
+        switch (cmd) {
+        case ONENAND_CMD_UNLOCK:
+        case ONENAND_CMD_LOCK:
+        case ONENAND_CMD_LOCK_TIGHT:
+        case ONENAND_CMD_UNLOCK_ALL:
+                onenand_lock_handle(this, cmd);
+                break;
+
+        case ONENAND_CMD_BUFFERRAM:
+                /* Do nothing */
+                return;
+
+        default:
+                block = (int) readw(this->base + ONENAND_REG_START_ADDRESS1);
+                if (block & (1 << ONENAND_DDP_SHIFT)) {
+                        block &= ~(1 << ONENAND_DDP_SHIFT);
+                        /* The half of chip block */
+                        block += this->chipsize >> (this->erase_shift + 1);
+                }
+                if (cmd == ONENAND_CMD_ERASE)
+                        break;
+
+                page = (int) readw(this->base + ONENAND_REG_START_ADDRESS8);
+                page = (page >> ONENAND_FPA_SHIFT);
+                bufferram = (int) readw(this->base + ONENAND_REG_START_BUFFER);
+                bufferram >>= ONENAND_BSA_SHIFT;
+                bufferram &= ONENAND_BSA_DATARAM1;
+                dataram = (bufferram == ONENAND_BSA_DATARAM1) ? 1 : 0;
+                break;
+        }
+
+        if (block != -1)
+                offset += block << this->erase_shift;
+
+        if (page != -1)
+                offset += page << this->page_shift;
+
+        onenand_data_handle(this, cmd, dataram, offset);
+
+        onenand_update_interrupt(this, cmd);
+}
+
+/**
+ * onenand_writew - [OneNAND Interface] Emulate write operation
+ * @param value         value to write
+ * @param addr          address to write
+ *
+ * Write OneNAND register with value
+ */
+static void onenand_writew(unsigned short value, void __iomem * addr)
+{
+        struct onenand_chip *this = info->mtd.priv;
+
+        /* BootRAM handling */
+        if (addr < this->base + ONENAND_DATARAM) {
+                onenand_bootram_handle(this, value);
+                return;
+        }
+        /* Command handling */
+        if (addr == this->base + ONENAND_REG_COMMAND)
+                onenand_command_handle(this, value);
+
+        writew(value, addr);
+}
+
+/**
+ * flash_init - Initialize OneNAND simulator
+ * @param flash         OneNAND simulaotr data strucutres
+ *
+ * Initialize OneNAND simulator.
+ */
+static int __init flash_init(struct onenand_flash *flash)
+{
+        int density, size;
+        int buffer_size;
+
+        flash->base = kzalloc(131072, GFP_KERNEL);
+        if (!flash->base) {
+                printk(KERN_ERR "Unable to allocate base address.\n");
+                return -ENOMEM;
+        }
+
+        density = device_id >> ONENAND_DEVICE_DENSITY_SHIFT;
+        size = ((16 << 20) << density);
+
+        ONENAND_CORE(flash) = vmalloc(size + (size >> 5));
+        if (!ONENAND_CORE(flash)) {
+                printk(KERN_ERR "Unable to allocate nand core address.\n");
+                kfree(flash->base);
+                return -ENOMEM;
+        }
+
+        memset(ONENAND_CORE(flash), 0xff, size + (size >> 5));
+
+        /* Setup registers */
+        writew(manuf_id, flash->base + ONENAND_REG_MANUFACTURER_ID);
+        writew(device_id, flash->base + ONENAND_REG_DEVICE_ID);
+        writew(version_id, flash->base + ONENAND_REG_VERSION_ID);
+
+        if (density < 2)
+                buffer_size = 0x0400;   /* 1KiB page */
+        else
+                buffer_size = 0x0800;   /* 2KiB page */
+        writew(buffer_size, flash->base + ONENAND_REG_DATA_BUFFER_SIZE);
+
+        return 0;
+}
+
+/**
+ * flash_exit - Clean up OneNAND simulator
+ * @param flash         OneNAND simulaotr data strucutres
+ *
+ * Clean up OneNAND simulator.
+ */
+static void flash_exit(struct onenand_flash *flash)
+{
+        vfree(ONENAND_CORE(flash));
+        kfree(flash->base);
+        kfree(flash);
+}
+
+static int __init onenand_sim_init(void)
+{
+        /* Allocate all 0xff chars pointer */
+        ffchars = kmalloc(MAX_ONENAND_PAGESIZE, GFP_KERNEL);
+        if (!ffchars) {
+                printk(KERN_ERR "Unable to allocate ff chars.\n");
+                return -ENOMEM;
+        }
+        memset(ffchars, 0xff, MAX_ONENAND_PAGESIZE);
+
+        /* Allocate OneNAND simulator mtd pointer */
+        info = kzalloc(sizeof(struct onenand_info), GFP_KERNEL);
+        if (!info) {
+                printk(KERN_ERR "Unable to allocate core structures.\n");
+                kfree(ffchars);
+                return -ENOMEM;
+        }
+
+        /* Override write_word function */
+        info->onenand.write_word = onenand_writew;
+
+        if (flash_init(&info->flash)) {
+                printk(KERN_ERR "Unable to allocat flash.\n");
+                kfree(ffchars);
+                kfree(info);
+                return -ENOMEM;
+        }
+
+        info->parts = os_partitions;
+
+        info->onenand.base = info->flash.base;
+        info->onenand.priv = &info->flash;
+
+        info->mtd.name = "OneNAND simulator";
+        info->mtd.priv = &info->onenand;
+        info->mtd.owner = THIS_MODULE;
+
+        if (onenand_scan(&info->mtd, 1)) {
+                flash_exit(&info->flash);
+                kfree(ffchars);
+                kfree(info);
+                return -ENXIO;
+        }
+
+        add_mtd_partitions(&info->mtd, info->parts, ARRAY_SIZE(os_partitions));
+
+        return 0;
+}
+
+static void __exit onenand_sim_exit(void)
+{
+        struct onenand_chip *this = info->mtd.priv;
+        struct onenand_flash *flash = this->priv;
+
+        onenand_release(&info->mtd);
+        flash_exit(flash);
+        kfree(ffchars);
+        kfree(info);
+}
+
+module_init(onenand_sim_init);
+module_exit(onenand_sim_exit);
+
+MODULE_AUTHOR("Kyungmin Park <kyungmin.park@samsung.com>");
+MODULE_DESCRIPTION("The OneNAND flash simulator");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mtd/rfd_ftl.c b/drivers/mtd/rfd_ftl.c
index 006c03aacb55..823fba4e6d2f 100644
--- a/drivers/mtd/rfd_ftl.c
+++ b/drivers/mtd/rfd_ftl.c
@@ -779,10 +779,8 @@ static void rfd_ftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
         else {
                 if (!mtd->erasesize) {
                         printk(KERN_WARNING PREFIX "please provide block_size");
-                        kfree(part);
-                        return;
-                }
-                else
+                        goto out;
+                } else
                         part->block_size = mtd->erasesize;
         }
 
@@ -804,7 +802,7 @@ static void rfd_ftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
                 if (!add_mtd_blktrans_dev((void*)part))
                         return;
         }
-
+out:
         kfree(part);
 }
 
diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
index 94ee54934411..29c41eeb09fe 100644
--- a/drivers/mtd/ubi/scan.c
+++ b/drivers/mtd/ubi/scan.c
@@ -1314,11 +1314,10 @@ static int paranoid_check_si(const struct ubi_device *ubi,
          * Make sure that all the physical eraseblocks are in one of the lists
          * or trees.
          */
-        buf = kmalloc(ubi->peb_count, GFP_KERNEL);
+        buf = kzalloc(ubi->peb_count, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
 
-        memset(buf, 1, ubi->peb_count);
         for (pnum = 0; pnum < ubi->peb_count; pnum++) {
                 err = ubi_io_is_bad(ubi, pnum);
                 if (err < 0) {
@@ -1326,28 +1325,28 @@ static int paranoid_check_si(const struct ubi_device *ubi,
                         return err;
                 }
                 else if (err)
-                        buf[pnum] = 0;
+                        buf[pnum] = 1;
         }
 
         ubi_rb_for_each_entry(rb1, sv, &si->volumes, rb)
                 ubi_rb_for_each_entry(rb2, seb, &sv->root, u.rb)
-                        buf[seb->pnum] = 0;
+                        buf[seb->pnum] = 1;
 
         list_for_each_entry(seb, &si->free, u.list)
-                buf[seb->pnum] = 0;
+                buf[seb->pnum] = 1;
 
         list_for_each_entry(seb, &si->corr, u.list)
-                buf[seb->pnum] = 0;
+                buf[seb->pnum] = 1;
 
         list_for_each_entry(seb, &si->erase, u.list)
-                buf[seb->pnum] = 0;
+                buf[seb->pnum] = 1;
 
         list_for_each_entry(seb, &si->alien, u.list)
-                buf[seb->pnum] = 0;
+                buf[seb->pnum] = 1;
 
         err = 0;
         for (pnum = 0; pnum < ubi->peb_count; pnum++)
-                if (buf[pnum]) {
+                if (!buf[pnum]) {
                         ubi_err("PEB %d is not referred", pnum);
                         err = 1;
                 }
diff --git a/drivers/net/atarilance.c b/drivers/net/atarilance.c
index ebf1a3a88e15..b74dbeef8050 100644
--- a/drivers/net/atarilance.c
+++ b/drivers/net/atarilance.c
@@ -1023,7 +1023,7 @@ static int lance_rx( struct net_device *dev )
                                         DECLARE_MAC_BUF(mac);
                                         DECLARE_MAC_BUF(mac2);
 
-                                        printk(KERN_DEBUG "%s: RX pkt type 0x%04x from %s to %s ",
+                                        printk(KERN_DEBUG "%s: RX pkt type 0x%04x from %s to %s "
                                                    "data %02x %02x %02x %02x %02x %02x %02x %02x "
                                                    "len %d\n",
                                                    dev->name, ((u_short *)data)[6],
diff --git a/drivers/net/macmace.c b/drivers/net/macmace.c
index 6589239b79ee..18770527df99 100644
--- a/drivers/net/macmace.c
+++ b/drivers/net/macmace.c
@@ -538,8 +538,9 @@ static void mace_set_multicast(struct net_device *dev)
         local_irq_restore(flags);
 }
 
-static void mace_handle_misc_intrs(struct mace_data *mp, int intr)
+static void mace_handle_misc_intrs(struct net_device *dev, int intr)
 {
+        struct mace_data *mp = netdev_priv(dev);
         volatile struct mace *mb = mp->mace;
         static int mace_babbles, mace_jabbers;
 
@@ -571,7 +572,7 @@ static irqreturn_t mace_interrupt(int irq, void *dev_id)
         local_irq_save(flags);
 
         intr = mb->ir; /* read interrupt register */
-        mace_handle_misc_intrs(mp, intr);
+        mace_handle_misc_intrs(dev, intr);
 
         if (intr & XMTINT) {
                 fs = mb->xmtfs;
@@ -645,7 +646,6 @@ static void mace_tx_timeout(struct net_device *dev)
 
 static void mace_dma_rx_frame(struct net_device *dev, struct mace_frame *mf)
 {
-        struct mace_data *mp = netdev_priv(dev);
         struct sk_buff *skb;
         unsigned int frame_status = mf->rcvsts;
 
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index b33d21f4efff..84f2d6382f1e 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -784,7 +784,6 @@ static int mv643xx_eth_open(struct net_device *dev)
         unsigned int port_num = mp->port_num;
         unsigned int size;
         int err;
-        DECLARE_MAC_BUF(mac);
 
         /* Clear any pending ethernet port interrupts */
         mv_write(MV643XX_ETH_INTERRUPT_CAUSE_REG(port_num), 0);
@@ -1296,6 +1295,7 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
         struct ethtool_cmd cmd;
         int duplex = DUPLEX_HALF;
         int speed = 0;                  /* default to auto-negotiation */
+        DECLARE_MAC_BUF(mac);
 
         pd = pdev->dev.platform_data;
         if (pd == NULL) {
diff --git a/drivers/net/mvme147.c b/drivers/net/mvme147.c
index 86c9c06433cb..06ca4252155f 100644
--- a/drivers/net/mvme147.c
+++ b/drivers/net/mvme147.c
@@ -85,7 +85,6 @@ struct net_device * __init mvme147lance_probe(int unit)
         dev->open = &m147lance_open;
         dev->stop = &m147lance_close;
         dev->hard_start_xmit = &lance_start_xmit;
-        dev->get_stats = &lance_get_stats;
         dev->set_multicast_list = &lance_set_multicast;
         dev->tx_timeout = &lance_tx_timeout;
         dev->dma = 0;
diff --git a/drivers/net/wireless/b43/phy.c b/drivers/net/wireless/b43/phy.c
index 5f7ffa0a76c0..3d4ed647c311 100644
--- a/drivers/net/wireless/b43/phy.c
+++ b/drivers/net/wireless/b43/phy.c
@@ -26,6 +26,7 @@
 */
 
 #include <linux/delay.h>
+#include <linux/io.h>
 #include <linux/types.h>
 
 #include "b43.h"
diff --git a/drivers/net/wireless/b43/pio.h b/drivers/net/wireless/b43/pio.h
index 34a44c1b6314..3488f2447bbf 100644
--- a/drivers/net/wireless/b43/pio.h
+++ b/drivers/net/wireless/b43/pio.h
@@ -4,6 +4,7 @@
 #include "b43.h"
 
 #include <linux/interrupt.h>
+#include <linux/io.h>
 #include <linux/list.h>
 #include <linux/skbuff.h>
 
diff --git a/drivers/net/wireless/b43/sysfs.c b/drivers/net/wireless/b43/sysfs.c
index fcb777383e70..f4faff6a7d6c 100644
--- a/drivers/net/wireless/b43/sysfs.c
+++ b/drivers/net/wireless/b43/sysfs.c
@@ -23,13 +23,14 @@
 
 */
 
+#include <linux/capability.h>
+#include <linux/io.h>
+
 #include "b43.h"
 #include "sysfs.h"
 #include "main.h"
 #include "phy.h"
 
-#include <linux/capability.h>
-
 #define GENERIC_FILESIZE        64
 
 static int get_integer(const char *buf, size_t count)
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
index 93ee05eeaeba..78277a118b67 100644
--- a/drivers/rtc/rtc-sh.c
+++ b/drivers/rtc/rtc-sh.c
@@ -1,7 +1,7 @@
 /*
  * SuperH On-Chip RTC Support
  *
- * Copyright (C) 2006  Paul Mundt
+ * Copyright (C) 2006, 2007  Paul Mundt
  * Copyright (C) 2006  Jamie Lenehan
  *
  * Based on the old arch/sh/kernel/cpu/rtc.c by:
@@ -23,16 +23,19 @@
 #include <linux/interrupt.h>
 #include <linux/spinlock.h>
 #include <linux/io.h>
+#include <asm/rtc.h>
 
 #define DRV_NAME        "sh-rtc"
-#define DRV_VERSION     "0.1.2"
+#define DRV_VERSION     "0.1.3"
 
 #ifdef CONFIG_CPU_SH3
 #define rtc_reg_size            sizeof(u16)
 #define RTC_BIT_INVERTED        0       /* No bug on SH7708, SH7709A */
+#define RTC_DEF_CAPABILITIES    0UL
 #elif defined(CONFIG_CPU_SH4)
 #define rtc_reg_size            sizeof(u32)
 #define RTC_BIT_INVERTED        0x40    /* bug on SH7750, SH7750S */
+#define RTC_DEF_CAPABILITIES    RTC_CAP_4_DIGIT_YEAR
 #endif
 
 #define RTC_REG(r)      ((r) * rtc_reg_size)
@@ -80,6 +83,7 @@ struct sh_rtc {
         struct rtc_device *rtc_dev;
         spinlock_t lock;
         int rearm_aie;
+        unsigned long capabilities;     /* See asm-sh/rtc.h for cap bits */
 };
 
 static irqreturn_t sh_rtc_interrupt(int irq, void *dev_id)
@@ -319,14 +323,14 @@ static int sh_rtc_read_time(struct device *dev, struct rtc_time *tm)
                 tm->tm_mday     = BCD2BIN(readb(rtc->regbase + RDAYCNT));
                 tm->tm_mon      = BCD2BIN(readb(rtc->regbase + RMONCNT)) - 1;
 
-#if defined(CONFIG_CPU_SH4)
-                yr  = readw(rtc->regbase + RYRCNT);
-                yr100 = BCD2BIN(yr >> 8);
-                yr &= 0xff;
-#else
-                yr  = readb(rtc->regbase + RYRCNT);
-                yr100 = BCD2BIN((yr == 0x99) ? 0x19 : 0x20);
-#endif
+                if (rtc->capabilities & RTC_CAP_4_DIGIT_YEAR) {
+                        yr  = readw(rtc->regbase + RYRCNT);
+                        yr100 = BCD2BIN(yr >> 8);
+                        yr &= 0xff;
+                } else {
+                        yr  = readb(rtc->regbase + RYRCNT);
+                        yr100 = BCD2BIN((yr == 0x99) ? 0x19 : 0x20);
+                }
 
                 tm->tm_year = (yr100 * 100 + BCD2BIN(yr)) - 1900;
 
@@ -375,14 +379,14 @@ static int sh_rtc_set_time(struct device *dev, struct rtc_time *tm)
         writeb(BIN2BCD(tm->tm_mday), rtc->regbase + RDAYCNT);
         writeb(BIN2BCD(tm->tm_mon + 1), rtc->regbase + RMONCNT);
 
-#ifdef CONFIG_CPU_SH3
-        year = tm->tm_year % 100;
-        writeb(BIN2BCD(year), rtc->regbase + RYRCNT);
-#else
-        year = (BIN2BCD((tm->tm_year + 1900) / 100) << 8) |
-                BIN2BCD(tm->tm_year % 100);
-        writew(year, rtc->regbase + RYRCNT);
-#endif
+        if (rtc->capabilities & RTC_CAP_4_DIGIT_YEAR) {
+                year = (BIN2BCD((tm->tm_year + 1900) / 100) << 8) |
+                        BIN2BCD(tm->tm_year % 100);
+                writew(year, rtc->regbase + RYRCNT);
+        } else {
+                year = tm->tm_year % 100;
+                writeb(BIN2BCD(year), rtc->regbase + RYRCNT);
+        }
 
         /* Start RTC */
         tmp = readb(rtc->regbase + RCR2);
@@ -589,6 +593,17 @@ static int __devinit sh_rtc_probe(struct platform_device *pdev)
                 goto err_badmap;
         }
 
+        rtc->capabilities = RTC_DEF_CAPABILITIES;
+        if (pdev->dev.platform_data) {
+                struct sh_rtc_platform_info *pinfo = pdev->dev.platform_data;
+
+                /*
+                 * Some CPUs have special capabilities in addition to the
+                 * default set. Add those in here.
+                 */
+                rtc->capabilities |= pinfo->capabilities;
+        }
+
         platform_set_drvdata(pdev, rtc);
 
         return 0;
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index 053fca41b08a..73440e26834b 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -4,6 +4,7 @@
  * SuperH on-chip serial module support.  (SCI with no FIFO / with FIFO)
  *
  *  Copyright (C) 2002 - 2006  Paul Mundt
+ *  Modified to support SH7720 SCIF. Markus Brunner, Mark Jonas (Jul 2007).
  *
  * based off of the old drivers/char/sh-sci.c by:
  *
@@ -301,6 +302,38 @@ static void sci_init_pins_scif(struct uart_port* port, unsigned int cflag)
         }
         sci_out(port, SCFCR, fcr_val);
 }
+#elif defined(CONFIG_CPU_SUBTYPE_SH7720)
+static void sci_init_pins_scif(struct uart_port *port, unsigned int cflag)
+{
+        unsigned int fcr_val = 0;
+        unsigned short data;
+
+        if (cflag & CRTSCTS) {
+                /* enable RTS/CTS */
+                if (port->mapbase == 0xa4430000) { /* SCIF0 */
+                        /* Clear PTCR bit 9-2; enable all scif pins but sck */
+                        data = ctrl_inw(PORT_PTCR);
+                        ctrl_outw((data & 0xfc03), PORT_PTCR);
+                } else if (port->mapbase == 0xa4438000) { /* SCIF1 */
+                        /* Clear PVCR bit 9-2 */
+                        data = ctrl_inw(PORT_PVCR);
+                        ctrl_outw((data & 0xfc03), PORT_PVCR);
+                }
+                fcr_val |= SCFCR_MCE;
+        } else {
+                if (port->mapbase == 0xa4430000) { /* SCIF0 */
+                        /* Clear PTCR bit 5-2; enable only tx and rx  */
+                        data = ctrl_inw(PORT_PTCR);
+                        ctrl_outw((data & 0xffc3), PORT_PTCR);
+                } else if (port->mapbase == 0xa4438000) { /* SCIF1 */
+                        /* Clear PVCR bit 5-2 */
+                        data = ctrl_inw(PORT_PVCR);
+                        ctrl_outw((data & 0xffc3), PORT_PVCR);
+                }
+        }
+        sci_out(port, SCFCR, fcr_val);
+}
+
 #elif defined(CONFIG_CPU_SH3)
 /* For SH7705, SH7706, SH7707, SH7709, SH7709A, SH7729 */
 static void sci_init_pins_scif(struct uart_port *port, unsigned int cflag)
@@ -1276,7 +1309,7 @@ static int __init sci_console_init(void)
 console_initcall(sci_console_init);
 #endif /* CONFIG_SERIAL_SH_SCI_CONSOLE */
 
-#ifdef CONFIG_SH_KGDB
+#ifdef CONFIG_SH_KGDB_CONSOLE
 /*
  * FIXME: Most of this can go away.. at the moment, we rely on
  * arch/sh/kernel/setup.c to do the command line parsing for kgdb, though
@@ -1334,9 +1367,7 @@ int __init kgdb_console_setup(struct console *co, char *options)
 
         return uart_set_options(port, co, baud, parity, bits, flow);
 }
-#endif /* CONFIG_SH_KGDB */
 
-#ifdef CONFIG_SH_KGDB_CONSOLE
 static struct console kgdb_console = {
         .name           = "ttySC",
         .device         = uart_console_device,
@@ -1432,7 +1463,7 @@ static int __devinit sci_probe(struct platform_device *dev)
 
 #ifdef CONFIG_CPU_FREQ
         cpufreq_register_notifier(&sci_nb, CPUFREQ_TRANSITION_NOTIFIER);
-        dev_info(&dev->dev, "sci: CPU frequency notifier registered\n");
+        dev_info(&dev->dev, "CPU frequency notifier registered\n");
 #endif
 
 #ifdef CONFIG_SH_STANDARD_BIOS
diff --git a/drivers/serial/sh-sci.h b/drivers/serial/sh-sci.h
index cf75466ebf57..e89ae29645d6 100644
--- a/drivers/serial/sh-sci.h
+++ b/drivers/serial/sh-sci.h
@@ -10,19 +10,19 @@
  *  Modified to support SH7300(SH-Mobile) SCIF. Takashi Kusuda (Jun 2003).
  *  Modified to support H8/300 Series Yoshinori Sato (Feb 2004).
  *  Removed SH7300 support (Jul 2007).
+ *  Modified to support SH7720 SCIF. Markus Brunner, Mark Jonas (Aug 2007).
  */
 #include <linux/serial_core.h>
 #include <asm/io.h>
 
-#if defined(__H8300H__) || defined(__H8300S__)
 #include <asm/gpio.h>
+
 #if defined(CONFIG_H83007) || defined(CONFIG_H83068)
 #include <asm/regs306x.h>
 #endif
 #if defined(CONFIG_H8S2678)
 #include <asm/regs267x.h>
 #endif
-#endif
 
 #if defined(CONFIG_CPU_SUBTYPE_SH7706) || \
     defined(CONFIG_CPU_SUBTYPE_SH7707) || \
@@ -46,6 +46,10 @@
  */
 # define SCSCR_INIT(port) (port->mapbase == SCIF2) ? 0xF3 : 0xF0
 # define SCIF_ONLY
+#elif defined(CONFIG_CPU_SUBTYPE_SH7720)
+# define SCSCR_INIT(port)  0x0030 /* TIE=0,RIE=0,TE=1,RE=1 */
+# define SCIF_ONLY
+#define SCIF_ORER    0x0200   /* overrun error bit */
 #elif defined(CONFIG_SH_RTS7751R2D)
 # define SCSPTR2 0xFFE80020 /* 16 bit SCIF */
 # define SCIF_ORER 0x0001   /* overrun error bit */
@@ -217,7 +221,8 @@
 #define SCIF_RDF   0x0002 /* 7705 SCIF, 7707 SCIF, 7709 SCIF, 7750 SCIF */
 #define SCIF_DR    0x0001 /* 7705 SCIF, 7707 SCIF, 7709 SCIF, 7750 SCIF */
 
-#if defined(CONFIG_CPU_SUBTYPE_SH7705)
+#if defined(CONFIG_CPU_SUBTYPE_SH7705) || \
+    defined(CONFIG_CPU_SUBTYPE_SH7720)
 #define SCIF_ORER    0x0200
 #define SCIF_ERRORS ( SCIF_PER | SCIF_FER | SCIF_ER | SCIF_BRK | SCIF_ORER)
 #define SCIF_RFDC_MASK 0x007f
@@ -254,7 +259,8 @@
 # define SCxSR_FER(port)                SCIF_FER
 # define SCxSR_PER(port)                SCIF_PER
 # define SCxSR_BRK(port)                SCIF_BRK
-#if defined(CONFIG_CPU_SUBTYPE_SH7705)
+#if defined(CONFIG_CPU_SUBTYPE_SH7705) || \
+    defined(CONFIG_CPU_SUBTYPE_SH7720)
 # define SCxSR_RDxF_CLEAR(port)         (sci_in(port,SCxSR)&0xfffc)
 # define SCxSR_ERROR_CLEAR(port)        (sci_in(port,SCxSR)&0xfd73)
 # define SCxSR_TDxE_CLEAR(port)         (sci_in(port,SCxSR)&0xffdf)
@@ -362,7 +368,8 @@
   CPU_SCIx_FNS(name, sh4_sci_offset, sh4_sci_size, sh4_scif_offset, sh4_scif_size)
 #define SCIF_FNS(name, sh3_scif_offset, sh3_scif_size, sh4_scif_offset, sh4_scif_size) \
           CPU_SCIF_FNS(name, sh4_scif_offset, sh4_scif_size)
-#elif defined(CONFIG_CPU_SUBTYPE_SH7705)
+#elif defined(CONFIG_CPU_SUBTYPE_SH7705) || \
+      defined(CONFIG_CPU_SUBTYPE_SH7720)
 #define SCIF_FNS(name, scif_offset, scif_size) \
   CPU_SCIF_FNS(name, scif_offset, scif_size)
 #else
@@ -388,7 +395,8 @@
   CPU_SCIF_FNS(name, sh4_scif_offset, sh4_scif_size)
 #endif
 
-#if defined(CONFIG_CPU_SUBTYPE_SH7705)
+#if defined(CONFIG_CPU_SUBTYPE_SH7705) || \
+    defined(CONFIG_CPU_SUBTYPE_SH7720)
 
 SCIF_FNS(SCSMR,  0x00, 16)
 SCIF_FNS(SCBRR,  0x04,  8)
@@ -510,7 +518,15 @@ static inline void set_sh771x_scif_pfc(struct uart_port *port)
                 return;
         }
 }
-
+#elif defined(CONFIG_CPU_SUBTYPE_SH7720)
+static inline int sci_rxd_in(struct uart_port *port)
+{
+        if (port->mapbase == 0xa4430000)
+                return sci_in(port, SCxSR) & 0x0003 ? 1 : 0;
+        else if (port->mapbase == 0xa4438000)
+                return sci_in(port, SCxSR) & 0x0003 ? 1 : 0;
+        return 1;
+}
 #elif defined(CONFIG_CPU_SUBTYPE_SH7750)  || \
       defined(CONFIG_CPU_SUBTYPE_SH7751)  || \
       defined(CONFIG_CPU_SUBTYPE_SH7751R) || \
@@ -653,6 +669,7 @@ static inline int sci_rxd_in(struct uart_port *port)
                 return ctrl_inw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
         if (port->mapbase == 0xffc60000)
                 return ctrl_inw(SCSPTR3) & 0x0001 ? 1 : 0; /* SCIF */
+        return 1;
 }
 #endif
 
@@ -691,7 +708,8 @@ static inline int sci_rxd_in(struct uart_port *port)
 #if defined(CONFIG_CPU_SUBTYPE_SH7780) || \
     defined(CONFIG_CPU_SUBTYPE_SH7785)
 #define SCBRR_VALUE(bps, clk) ((clk+16*bps)/(16*bps)-1)
-#elif defined(CONFIG_CPU_SUBTYPE_SH7705)
+#elif defined(CONFIG_CPU_SUBTYPE_SH7705) || \
+      defined(CONFIG_CPU_SUBTYPE_SH7720)
 #define SCBRR_VALUE(bps, clk) (((clk*2)+16*bps)/(32*bps)-1)
 #elif defined(__H8300H__) || defined(__H8300S__)
 #define SCBRR_VALUE(bps) (((CONFIG_CPU_CLOCK*1000/32)/bps)-1)
diff --git a/drivers/sh/Makefile b/drivers/sh/Makefile
index 8a143894e33f..a96f4a8cfeb8 100644
--- a/drivers/sh/Makefile
+++ b/drivers/sh/Makefile
@@ -2,5 +2,5 @@
 # Makefile for the SuperH specific drivers.
 #
 
-obj-$(CONFIG_SUPERHYWAY) += superhyway/
-
+obj-$(CONFIG_SUPERHYWAY)        += superhyway/
+obj-$(CONFIG_MAPLE)             += maple/
diff --git a/drivers/sh/maple/Makefile b/drivers/sh/maple/Makefile
new file mode 100644
index 000000000000..65dfeeb610ef
--- /dev/null
+++ b/drivers/sh/maple/Makefile
@@ -0,0 +1,3 @@
+# Makefile for Maple Bus
+
+obj-$(CONFIG_MAPLE) := maple.o
diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c
new file mode 100644
index 000000000000..161d1021b7eb
--- /dev/null
+++ b/drivers/sh/maple/maple.c
@@ -0,0 +1,735 @@
+/*
+ * Core maple bus functionality
+ *
+ *  Copyright (C) 2007 Adrian McMenamin
+ *
+ * Based on 2.4 code by:
+ *
+ *  Copyright (C) 2000-2001 YAEGASHI Takeshi
+ *  Copyright (C) 2001 M. R. Brown
+ *  Copyright (C) 2001 Paul Mundt
+ *
+ * and others.
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ */
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/list.h>
+#include <linux/io.h>
+#include <linux/slab.h>
+#include <linux/maple.h>
+#include <linux/dma-mapping.h>
+#include <asm/cacheflush.h>
+#include <asm/dma.h>
+#include <asm/io.h>
+#include <asm/mach/dma.h>
+#include <asm/mach/sysasic.h>
+#include <asm/mach/maple.h>
+
+MODULE_AUTHOR("Yaegshi Takeshi, Paul Mundt, M.R. Brown, Adrian McMenamin");
+MODULE_DESCRIPTION("Maple bus driver for Dreamcast");
+MODULE_LICENSE("GPL v2");
+MODULE_SUPPORTED_DEVICE("{{SEGA, Dreamcast/Maple}}");
+
+static void maple_dma_handler(struct work_struct *work);
+static void maple_vblank_handler(struct work_struct *work);
+
+static DECLARE_WORK(maple_dma_process, maple_dma_handler);
+static DECLARE_WORK(maple_vblank_process, maple_vblank_handler);
+
+static LIST_HEAD(maple_waitq);
+static LIST_HEAD(maple_sentq);
+
+static DEFINE_MUTEX(maple_list_lock);
+
+static struct maple_driver maple_dummy_driver;
+static struct device maple_bus;
+static int subdevice_map[MAPLE_PORTS];
+static unsigned long *maple_sendbuf, *maple_sendptr, *maple_lastptr;
+static unsigned long maple_pnp_time;
+static int started, scanning, liststatus;
+static struct kmem_cache *maple_queue_cache;
+
+struct maple_device_specify {
+       int port;
+       int unit;
+};
+
+/**
+ *  maple_driver_register - register a device driver
+ *  automatically makes the driver bus a maple bus
+ *  @drv: the driver to be registered
+ */
+int maple_driver_register(struct device_driver *drv)
+{
+       if (!drv)
+               return -EINVAL;
+       drv->bus = &maple_bus_type;
+       return driver_register(drv);
+}
+EXPORT_SYMBOL_GPL(maple_driver_register);
+
+/* set hardware registers to enable next round of dma */
+static void maplebus_dma_reset(void)
+{
+       ctrl_outl(MAPLE_MAGIC, MAPLE_RESET);
+       /* set trig type to 0 for software trigger, 1 for hardware (VBLANK) */
+       ctrl_outl(1, MAPLE_TRIGTYPE);
+       ctrl_outl(MAPLE_2MBPS | MAPLE_TIMEOUT(50000), MAPLE_SPEED);
+       ctrl_outl(PHYSADDR(maple_sendbuf), MAPLE_DMAADDR);
+       ctrl_outl(1, MAPLE_ENABLE);
+}
+
+/**
+ * maple_getcond_callback - setup handling MAPLE_COMMAND_GETCOND
+ * @dev: device responding
+ * @callback: handler callback
+ * @interval: interval in jiffies between callbacks
+ * @function: the function code for the device
+ */
+void maple_getcond_callback(struct maple_device *dev,
+                           void (*callback) (struct mapleq * mq),
+                           unsigned long interval, unsigned long function)
+{
+       dev->callback = callback;
+       dev->interval = interval;
+       dev->function = cpu_to_be32(function);
+       dev->when = jiffies;
+}
+EXPORT_SYMBOL_GPL(maple_getcond_callback);
+
+static int maple_dma_done(void)
+{
+       return (ctrl_inl(MAPLE_STATE) & 1) == 0;
+}
+
+static void maple_release_device(struct device *dev)
+{
+       if (dev->type) {
+               kfree(dev->type->name);
+               kfree(dev->type);
+       }
+}
+
+/**
+ * maple_add_packet - add a single instruction to the queue
+ * @mq: instruction to add to waiting queue
+ */
+void maple_add_packet(struct mapleq *mq)
+{
+       mutex_lock(&maple_list_lock);
+       list_add(&mq->list, &maple_waitq);
+       mutex_unlock(&maple_list_lock);
+}
+EXPORT_SYMBOL_GPL(maple_add_packet);
+
+static struct mapleq *maple_allocq(struct maple_device *dev)
+{
+       struct mapleq *mq;
+
+       mq = kmalloc(sizeof(*mq), GFP_KERNEL);
+       if (!mq)
+               return NULL;
+
+       mq->dev = dev;
+       mq->recvbufdcsp = kmem_cache_zalloc(maple_queue_cache, GFP_KERNEL);
+       mq->recvbuf = (void *) P2SEGADDR(mq->recvbufdcsp);
+       if (!mq->recvbuf) {
+               kfree(mq);
+               return NULL;
+       }
+
+       return mq;
+}
+
+static struct maple_device *maple_alloc_dev(int port, int unit)
+{
+       struct maple_device *dev;
+
+       dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+       if (!dev)
+               return NULL;
+
+       dev->port = port;
+       dev->unit = unit;
+       dev->mq = maple_allocq(dev);
+
+       if (!dev->mq) {
+               kfree(dev);
+               return NULL;
+       }
+
+       return dev;
+}
+
+static void maple_free_dev(struct maple_device *mdev)
+{
+       if (!mdev)
+               return;
+       if (mdev->mq) {
+               kmem_cache_free(maple_queue_cache, mdev->mq->recvbufdcsp);
+               kfree(mdev->mq);
+       }
+       kfree(mdev);
+}
+
+/* process the command queue into a maple command block
+ * terminating command has bit 32 of first long set to 0
+ */
+static void maple_build_block(struct mapleq *mq)
+{
+       int port, unit, from, to, len;
+       unsigned long *lsendbuf = mq->sendbuf;
+
+       port = mq->dev->port & 3;
+       unit = mq->dev->unit;
+       len = mq->length;
+       from = port << 6;
+       to = (port << 6) | (unit > 0 ? (1 << (unit - 1)) & 0x1f : 0x20);
+
+       *maple_lastptr &= 0x7fffffff;
+       maple_lastptr = maple_sendptr;
+
+       *maple_sendptr++ = (port << 16) | len | 0x80000000;
+       *maple_sendptr++ = PHYSADDR(mq->recvbuf);
+       *maple_sendptr++ =
+           mq->command | (to << 8) | (from << 16) | (len << 24);
+
+       while (len-- > 0)
+               *maple_sendptr++ = *lsendbuf++;
+}
+
+/* build up command queue */
+static void maple_send(void)
+{
+       int i;
+       int maple_packets;
+       struct mapleq *mq, *nmq;
+
+       if (!list_empty(&maple_sentq))
+               return;
+       if (list_empty(&maple_waitq) || !maple_dma_done())
+               return;
+       maple_packets = 0;
+       maple_sendptr = maple_lastptr = maple_sendbuf;
+       list_for_each_entry_safe(mq, nmq, &maple_waitq, list) {
+               maple_build_block(mq);
+               list_move(&mq->list, &maple_sentq);
+               if (maple_packets++ > MAPLE_MAXPACKETS)
+                       break;
+       }
+       if (maple_packets > 0) {
+               for (i = 0; i < (1 << MAPLE_DMA_PAGES); i++)
+                       dma_cache_sync(0, maple_sendbuf + i * PAGE_SIZE,
+                                      PAGE_SIZE, DMA_BIDIRECTIONAL);
+       }
+}
+
+static int attach_matching_maple_driver(struct device_driver *driver,
+                                       void *devptr)
+{
+       struct maple_driver *maple_drv;
+       struct maple_device *mdev;
+
+       mdev = devptr;
+       maple_drv = to_maple_driver(driver);
+       if (mdev->devinfo.function & be32_to_cpu(maple_drv->function)) {
+               if (maple_drv->connect(mdev) == 0) {
+                       mdev->driver = maple_drv;
+                       return 1;
+               }
+       }
+       return 0;
+}
+
+static void maple_detach_driver(struct maple_device *mdev)
+{
+       if (!mdev)
+               return;
+       if (mdev->driver) {
+               if (mdev->driver->disconnect)
+                       mdev->driver->disconnect(mdev);
+       }
+       mdev->driver = NULL;
+       if (mdev->registered) {
+               maple_release_device(&mdev->dev);
+               device_unregister(&mdev->dev);
+       }
+       mdev->registered = 0;
+       maple_free_dev(mdev);
+}
+
+/* process initial MAPLE_COMMAND_DEVINFO for each device or port */
+static void maple_attach_driver(struct maple_device *dev)
+{
+       char *p;
+
+       char *recvbuf;
+       unsigned long function;
+       int matched, retval;
+
+       recvbuf = dev->mq->recvbuf;
+       memcpy(&dev->devinfo, recvbuf + 4, sizeof(dev->devinfo));
+       memcpy(dev->product_name, dev->devinfo.product_name, 30);
+       memcpy(dev->product_licence, dev->devinfo.product_licence, 60);
+       dev->product_name[30] = '\0';
+       dev->product_licence[60] = '\0';
+
+       for (p = dev->product_name + 29; dev->product_name <= p; p--)
+               if (*p == ' ')
+                       *p = '\0';
+               else
+                       break;
+
+       for (p = dev->product_licence + 59; dev->product_licence <= p; p--)
+               if (*p == ' ')
+                       *p = '\0';
+               else
+                       break;
+
+       function = be32_to_cpu(dev->devinfo.function);
+
+       if (function > 0x200) {
+               /* Do this silently - as not a real device */
+               function = 0;
+               dev->driver = &maple_dummy_driver;
+               sprintf(dev->dev.bus_id, "%d:0.port", dev->port);
+       } else {
+               printk(KERN_INFO
+                      "Maple bus at (%d, %d): Connected function 0x%lX\n",
+                      dev->port, dev->unit, function);
+
+               matched =
+                   bus_for_each_drv(&maple_bus_type, NULL, dev,
+                                    attach_matching_maple_driver);
+
+               if (matched == 0) {
+                       /* Driver does not exist yet */
+                       printk(KERN_INFO
+                              "No maple driver found for this device\n");
+                       dev->driver = &maple_dummy_driver;
+               }
+
+               sprintf(dev->dev.bus_id, "%d:0%d.%lX", dev->port,
+                       dev->unit, function);
+       }
+       dev->function = function;
+       dev->dev.bus = &maple_bus_type;
+       dev->dev.parent = &maple_bus;
+       dev->dev.release = &maple_release_device;
+       retval = device_register(&dev->dev);
+       if (retval) {
+               printk(KERN_INFO
+                      "Maple bus: Attempt to register device (%x, %x) failed.\n",
+                      dev->port, dev->unit);
+               maple_free_dev(dev);
+       }
+       dev->registered = 1;
+}
+
+/*
+ * if device has been registered for the given
+ * port and unit then return 1 - allows identification
+ * of which devices need to be attached or detached
+ */
+static int detach_maple_device(struct device *device, void *portptr)
+{
+       struct maple_device_specify *ds;
+       struct maple_device *mdev;
+
+       ds = portptr;
+       mdev = to_maple_dev(device);
+       if (mdev->port == ds->port && mdev->unit == ds->unit)
+               return 1;
+       return 0;
+}
+
+static int setup_maple_commands(struct device *device, void *ignored)
+{
+       struct maple_device *maple_dev = to_maple_dev(device);
+
+       if ((maple_dev->interval > 0)
+           && time_after(jiffies, maple_dev->when)) {
+               maple_dev->when = jiffies + maple_dev->interval;
+               maple_dev->mq->command = MAPLE_COMMAND_GETCOND;
+               maple_dev->mq->sendbuf = &maple_dev->function;
+               maple_dev->mq->length = 1;
+               maple_add_packet(maple_dev->mq);
+               liststatus++;
+       } else {
+               if (time_after(jiffies, maple_pnp_time)) {
+                       maple_dev->mq->command = MAPLE_COMMAND_DEVINFO;
+                       maple_dev->mq->length = 0;
+                       maple_add_packet(maple_dev->mq);
+                       liststatus++;
+               }
+       }
+
+       return 0;
+}
+
+/* VBLANK bottom half - implemented via workqueue */
+static void maple_vblank_handler(struct work_struct *work)
+{
+       if (!maple_dma_done())
+               return;
+       if (!list_empty(&maple_sentq))
+               return;
+       ctrl_outl(0, MAPLE_ENABLE);
+       liststatus = 0;
+       bus_for_each_dev(&maple_bus_type, NULL, NULL,
+                        setup_maple_commands);
+       if (time_after(jiffies, maple_pnp_time))
+               maple_pnp_time = jiffies + MAPLE_PNP_INTERVAL;
+       if (liststatus && list_empty(&maple_sentq)) {
+               INIT_LIST_HEAD(&maple_sentq);
+               maple_send();
+       }
+       maplebus_dma_reset();
+}
+
+/* handle devices added via hotplugs - placing them on queue for DEVINFO*/
+static void maple_map_subunits(struct maple_device *mdev, int submask)
+{
+       int retval, k, devcheck;
+       struct maple_device *mdev_add;
+       struct maple_device_specify ds;
+
+       for (k = 0; k < 5; k++) {
+               ds.port = mdev->port;
+               ds.unit = k + 1;
+               retval =
+                   bus_for_each_dev(&maple_bus_type, NULL, &ds,
+                                    detach_maple_device);
+               if (retval) {
+                       submask = submask >> 1;
+                       continue;
+               }
+               devcheck = submask & 0x01;
+               if (devcheck) {
+                       mdev_add = maple_alloc_dev(mdev->port, k + 1);
+                       if (!mdev_add)
+                               return;
+                       mdev_add->mq->command = MAPLE_COMMAND_DEVINFO;
+                       mdev_add->mq->length = 0;
+                       maple_add_packet(mdev_add->mq);
+                       scanning = 1;
+               }
+               submask = submask >> 1;
+       }
+}
+
+/* mark a device as removed */
+static void maple_clean_submap(struct maple_device *mdev)
+{
+       int killbit;
+
+       killbit = (mdev->unit > 0 ? (1 << (mdev->unit - 1)) & 0x1f : 0x20);
+       killbit = ~killbit;
+       killbit &= 0xFF;
+       subdevice_map[mdev->port] = subdevice_map[mdev->port] & killbit;
+}
+
+/* handle empty port or hotplug removal */
+static void maple_response_none(struct maple_device *mdev,
+                               struct mapleq *mq)
+{
+       if (mdev->unit != 0) {
+               list_del(&mq->list);
+               maple_clean_submap(mdev);
+               printk(KERN_INFO
+                      "Maple bus device detaching at (%d, %d)\n",
+                      mdev->port, mdev->unit);
+               maple_detach_driver(mdev);
+               return;
+       }
+       if (!started) {
+               printk(KERN_INFO "No maple devices attached to port %d\n",
+                      mdev->port);
+               return;
+       }
+       maple_clean_submap(mdev);
+}
+
+/* preprocess hotplugs or scans */
+static void maple_response_devinfo(struct maple_device *mdev,
+                                  char *recvbuf)
+{
+       char submask;
+       if ((!started) || (scanning == 2)) {
+               maple_attach_driver(mdev);
+               return;
+       }
+       if (mdev->unit == 0) {
+               submask = recvbuf[2] & 0x1F;
+               if (submask ^ subdevice_map[mdev->port]) {
+                       maple_map_subunits(mdev, submask);
+                       subdevice_map[mdev->port] = submask;
+               }
+       }
+}
+
+/* maple dma end bottom half - implemented via workqueue */
+static void maple_dma_handler(struct work_struct *work)
+{
+       struct mapleq *mq, *nmq;
+       struct maple_device *dev;
+       char *recvbuf;
+       enum maple_code code;
+
+       if (!maple_dma_done())
+               return;
+       ctrl_outl(0, MAPLE_ENABLE);
+       if (!list_empty(&maple_sentq)) {
+               list_for_each_entry_safe(mq, nmq, &maple_sentq, list) {
+                       recvbuf = mq->recvbuf;
+                       code = recvbuf[0];
+                       dev = mq->dev;
+                       switch (code) {
+                       case MAPLE_RESPONSE_NONE:
+                               maple_response_none(dev, mq);
+                               break;
+
+                       case MAPLE_RESPONSE_DEVINFO:
+                               maple_response_devinfo(dev, recvbuf);
+                               break;
+
+                       case MAPLE_RESPONSE_DATATRF:
+                               if (dev->callback)
+                                       dev->callback(mq);
+                               break;
+
+                       case MAPLE_RESPONSE_FILEERR:
+                       case MAPLE_RESPONSE_AGAIN:
+                       case MAPLE_RESPONSE_BADCMD:
+                       case MAPLE_RESPONSE_BADFUNC:
+                               printk(KERN_DEBUG
+                                      "Maple non-fatal error 0x%X\n",
+                                      code);
+                               break;
+
+                       case MAPLE_RESPONSE_ALLINFO:
+                               printk(KERN_DEBUG
+                                      "Maple - extended device information not supported\n");
+                               break;
+
+                       case MAPLE_RESPONSE_OK:
+                               break;
+
+                       default:
+                               break;
+                       }
+               }
+               INIT_LIST_HEAD(&maple_sentq);
+               if (scanning == 1) {
+                       maple_send();
+                       scanning = 2;
+               } else
+                       scanning = 0;
+
+               if (started == 0)
+                       started = 1;
+       }
+       maplebus_dma_reset();
+}
+
+static irqreturn_t maplebus_dma_interrupt(int irq, void *dev_id)
+{
+       /* Load everything into the bottom half */
+       schedule_work(&maple_dma_process);
+       return IRQ_HANDLED;
+}
+
+static irqreturn_t maplebus_vblank_interrupt(int irq, void *dev_id)
+{
+       schedule_work(&maple_vblank_process);
+       return IRQ_HANDLED;
+}
+
+static struct irqaction maple_dma_irq = {
+       .name = "maple bus DMA handler",
+       .handler = maplebus_dma_interrupt,
+       .flags = IRQF_SHARED,
+};
+
+static struct irqaction maple_vblank_irq = {
+       .name = "maple bus VBLANK handler",
+       .handler = maplebus_vblank_interrupt,
+       .flags = IRQF_SHARED,
+};
+
+static int maple_set_dma_interrupt_handler(void)
+{
+       return setup_irq(HW_EVENT_MAPLE_DMA, &maple_dma_irq);
+}
+
+static int maple_set_vblank_interrupt_handler(void)
+{
+       return setup_irq(HW_EVENT_VSYNC, &maple_vblank_irq);
+}
+
+static int maple_get_dma_buffer(void)
+{
+       maple_sendbuf =
+           (void *) __get_free_pages(GFP_KERNEL | __GFP_ZERO,
+                                     MAPLE_DMA_PAGES);
+       if (!maple_sendbuf)
+               return -ENOMEM;
+       return 0;
+}
+
+static int match_maple_bus_driver(struct device *devptr,
+                                 struct device_driver *drvptr)
+{
+       struct maple_driver *maple_drv;
+       struct maple_device *maple_dev;
+
+       maple_drv = container_of(drvptr, struct maple_driver, drv);
+       maple_dev = container_of(devptr, struct maple_device, dev);
+       /* Trap empty port case */
+       if (maple_dev->devinfo.function == 0xFFFFFFFF)
+               return 0;
+       else if (maple_dev->devinfo.function &
+                be32_to_cpu(maple_drv->function))
+               return 1;
+       return 0;
+}
+
+static int maple_bus_uevent(struct device *dev, char **envp,
+                           int num_envp, char *buffer, int buffer_size)
+{
+       return 0;
+}
+
+static void maple_bus_release(struct device *dev)
+{
+}
+
+static struct maple_driver maple_dummy_driver = {
+       .drv = {
+               .name = "maple_dummy_driver",
+               .bus =  &maple_bus_type,
+       },
+};
+
+struct bus_type maple_bus_type = {
+       .name =         "maple",
+       .match =        match_maple_bus_driver,
+       .uevent =       maple_bus_uevent,
+};
+EXPORT_SYMBOL_GPL(maple_bus_type);
+
+static struct device maple_bus = {
+       .bus_id = "maple",
+       .release = maple_bus_release,
+};
+
+static int __init maple_bus_init(void)
+{
+       int retval, i;
+       struct maple_device *mdev[MAPLE_PORTS];
+       ctrl_outl(0, MAPLE_STATE);
+
+       retval = device_register(&maple_bus);
+       if (retval)
+               goto cleanup;
+
+       retval = bus_register(&maple_bus_type);
+       if (retval)
+               goto cleanup_device;
+
+       retval = driver_register(&maple_dummy_driver.drv);
+
+       if (retval)
+               goto cleanup_bus;
+
+       /* allocate memory for maple bus dma */
+       retval = maple_get_dma_buffer();
+       if (retval) {
+               printk(KERN_INFO
+                      "Maple bus: Failed to allocate Maple DMA buffers\n");
+               goto cleanup_basic;
+       }
+
+       /* set up DMA interrupt handler */
+       retval = maple_set_dma_interrupt_handler();
+       if (retval) {
+               printk(KERN_INFO
+                      "Maple bus: Failed to grab maple DMA IRQ\n");
+               goto cleanup_dma;
+       }
+
+       /* set up VBLANK interrupt handler */
+       retval = maple_set_vblank_interrupt_handler();
+       if (retval) {
+               printk(KERN_INFO "Maple bus: Failed to grab VBLANK IRQ\n");
+               goto cleanup_irq;
+       }
+
+       maple_queue_cache =
+           kmem_cache_create("maple_queue_cache", 0x400, 0,
+                             SLAB_HWCACHE_ALIGN, NULL);
+
+       if (!maple_queue_cache)
+               goto cleanup_bothirqs;
+
+       /* setup maple ports */
+       for (i = 0; i < MAPLE_PORTS; i++) {
+               mdev[i] = maple_alloc_dev(i, 0);
+               if (!mdev[i]) {
+                       while (i-- > 0)
+                               maple_free_dev(mdev[i]);
+                       goto cleanup_cache;
+               }
+               mdev[i]->registered = 0;
+               mdev[i]->mq->command = MAPLE_COMMAND_DEVINFO;
+               mdev[i]->mq->length = 0;
+               maple_attach_driver(mdev[i]);
+               maple_add_packet(mdev[i]->mq);
+               subdevice_map[i] = 0;
+       }
+
+       /* setup maplebus hardware */
+       maplebus_dma_reset();
+
+       /* initial detection */
+       maple_send();
+
+       maple_pnp_time = jiffies;
+
+       printk(KERN_INFO "Maple bus core now registered.\n");
+
+       return 0;
+
+cleanup_cache:
+       kmem_cache_destroy(maple_queue_cache);
+
+cleanup_bothirqs:
+       free_irq(HW_EVENT_VSYNC, 0);
+
+cleanup_irq:
+       free_irq(HW_EVENT_MAPLE_DMA, 0);
+
+cleanup_dma:
+       free_pages((unsigned long) maple_sendbuf, MAPLE_DMA_PAGES);
+
+cleanup_basic:
+       driver_unregister(&maple_dummy_driver.drv);
+
+cleanup_bus:
+       bus_unregister(&maple_bus_type);
+
+cleanup_device:
+       device_unregister(&maple_bus);
+
+cleanup:
+       printk(KERN_INFO "Maple bus registration failed\n");
+       return retval;
+}
+subsys_initcall(maple_bus_init);
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index 74d5182db4b2..cfd13eb866b8 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -11,6 +11,7 @@
 #include "ssb_private.h"
 
 #include <linux/delay.h>
+#include <linux/io.h>
 #include <linux/ssb/ssb.h>
 #include <linux/ssb/ssb_regs.h>
 #include <linux/dma-mapping.h>
diff --git a/drivers/video/backlight/hp680_bl.c b/drivers/video/backlight/hp680_bl.c
index 0899fccbd570..fbea2bd129c7 100644
--- a/drivers/video/backlight/hp680_bl.c
+++ b/drivers/video/backlight/hp680_bl.c
@@ -125,8 +125,8 @@ static int hp680bl_remove(struct platform_device *pdev)
 {
         struct backlight_device *bd = platform_get_drvdata(pdev);
 
-        hp680bl_data.brightness = 0;
-        hp680bl_data.power = 0;
+        bd->props.brightness = 0;
+        bd->props.power = 0;
         hp680bl_send_intensity(bd);
 
         backlight_device_unregister(bd);
diff --git a/drivers/video/pvr2fb.c b/drivers/video/pvr2fb.c
index 7d6c29800d14..06805c9b237b 100644
--- a/drivers/video/pvr2fb.c
+++ b/drivers/video/pvr2fb.c
@@ -667,6 +667,8 @@ static int pvr2_init_cable(void)
           related */
         if (cable_type == CT_COMPOSITE)
                 fb_writel(3 << 8, VOUTC);
+        else if (cable_type == CT_RGB)
+                fb_writel(1 << 9, VOUTC);
         else
                 fb_writel(0, VOUTC);
 
@@ -890,7 +892,7 @@ static int __init pvr2fb_dc_init(void)
         pvr2_fix.mmio_start     = 0xa05f8000;   /* registers start here */
         pvr2_fix.mmio_len       = 0x2000;
 
-        if (request_irq(HW_EVENT_VSYNC, pvr2fb_interrupt, 0,
+        if (request_irq(HW_EVENT_VSYNC, pvr2fb_interrupt, IRQF_SHARED,
                         "pvr2 VBL handler", fb_info)) {
                 return -EBUSY;
         }