Merge branch 'origin' into radeon-ttm

Conflicts:

	shared-core/radeon_drv.h

28 files changed, 433 insertions, 639 deletions

diff --git a/linux-core/Makefile b/linux-core/Makefile
index bca8210d..1758777c 100644
--- a/linux-core/Makefile
+++ b/linux-core/Makefile
@@ -237,6 +237,9 @@ dristat: dristat.c
 drmstat: drmstat.c
 	$(CC) $(PRGCFLAGS) $< -o $@ $(DRMSTATLIBS)
 
+install:
+	make -C $(LINUXDIR) $(GETCONFIG) SUBDIRS=`pwd` DRMSRCDIR=`pwd` modules_install
+
 else
 
 # Check for kernel versions that we don't support.
@@ -280,6 +283,7 @@ CONFIG_DRM_SAVAGE := n
 CONFIG_DRM_VIA := n
 CONFIG_DRM_MACH64 := n
 CONFIG_DRM_NV := n
+CONFIG_DRM_NOUVEAU := n
 
 # Enable module builds for the modules requested/supported.
 
diff --git a/linux-core/ati_pcigart.c b/linux-core/ati_pcigart.c
index ad47ed25..66742bbc 100644
--- a/linux-core/ati_pcigart.c
+++ b/linux-core/ati_pcigart.c
@@ -151,7 +151,8 @@ int drm_ati_pcigart_init(drm_device_t *dev, drm_ati_pcigart_info *gart_info)
 	if (gart_info->gart_table_location == DRM_ATI_GART_MAIN) {
 		DRM_DEBUG("PCI: no table in VRAM: using normal RAM\n");
 
-		order = drm_order((gart_info->table_size + (PAGE_SIZE-1)) / PAGE_SIZE);
+		order = drm_order((gart_info->table_size +
+				   (PAGE_SIZE-1)) / PAGE_SIZE);
 		num_pages = 1 << order;
 		address = drm_ati_alloc_pcigart_table(order);
 		if (!address) {
@@ -169,7 +170,8 @@ int drm_ati_pcigart_init(drm_device_t *dev, drm_ati_pcigart_info *gart_info)
 					     PCI_DMA_TODEVICE);
 		if (bus_address == 0) {
 			DRM_ERROR("unable to map PCIGART pages!\n");
-			order = drm_order((gart_info->table_size + (PAGE_SIZE-1)) / PAGE_SIZE);
+			order = drm_order((gart_info->table_size +
+					   (PAGE_SIZE-1)) / PAGE_SIZE);
 			drm_ati_free_pcigart_table(address, order);
 			address = NULL;
 			goto done;
@@ -205,10 +207,18 @@ int drm_ati_pcigart_init(drm_device_t *dev, drm_ati_pcigart_info *gart_info)
 		page_base = (u32) entry->busaddr[i];
 
 		for (j = 0; j < (PAGE_SIZE / ATI_PCIGART_PAGE_SIZE); j++) {
-			if (gart_info->is_pcie)
+			switch(gart_info->gart_reg_if) {
+			case DRM_ATI_GART_IGP:
+				*pci_gart = cpu_to_le32((page_base) | 0xc);
+				break;
+			case DRM_ATI_GART_PCIE:
 				*pci_gart = cpu_to_le32((page_base >> 8) | 0xc);
-			else
+				break;
+			default:
+			case DRM_ATI_GART_PCI:
 				*pci_gart = cpu_to_le32(page_base);
+				break;
+			}
 			pci_gart++;
 			page_base += ATI_PCIGART_PAGE_SIZE;
 		}
diff --git a/linux-core/drmP.h b/linux-core/drmP.h
index 3ddd405f..ec432b2a 100644
--- a/linux-core/drmP.h
+++ b/linux-core/drmP.h
@@ -76,6 +76,7 @@
 #include <asm/pgalloc.h>
 #include "drm.h"
 #include <linux/slab.h>
+#include <linux/idr.h>
 
 #define __OS_HAS_AGP (defined(CONFIG_AGP) || (defined(CONFIG_AGP_MODULE) && defined(MODULE)))
 #define __OS_HAS_MTRR (defined(CONFIG_MTRR))
@@ -300,19 +301,14 @@ typedef struct drm_devstate {
 } drm_devstate_t;
 
 typedef struct drm_magic_entry {
-	drm_hash_item_t hash_item;
 	struct list_head head;
+	drm_hash_item_t hash_item;
 	struct drm_file *priv;
 } drm_magic_entry_t;
 
-typedef struct drm_magic_head {
-	struct drm_magic_entry *head;
-	struct drm_magic_entry *tail;
-} drm_magic_head_t;
-
 typedef struct drm_vma_entry {
+	struct list_head head;
 	struct vm_area_struct *vma;
-	struct drm_vma_entry *next;
 	pid_t pid;
 } drm_vma_entry_t;
 
@@ -411,8 +407,7 @@ typedef struct drm_file {
 	uid_t uid;
 	drm_magic_t magic;
 	unsigned long ioctl_count;
-	struct drm_file *next;
-	struct drm_file *prev;
+	struct list_head lhead;
 	struct drm_head *head;
 	int remove_auth_on_close;
 	unsigned long lock_count;
@@ -493,8 +488,7 @@ typedef struct drm_agp_mem {
 	DRM_AGP_MEM *memory;
 	unsigned long bound;		/**< address */
 	int pages;
-	struct drm_agp_mem *prev;	/**< previous entry */
-	struct drm_agp_mem *next;	/**< next entry */
+	struct list_head head;
 } drm_agp_mem_t;
 
 /**
@@ -504,7 +498,7 @@ typedef struct drm_agp_mem {
  */
 typedef struct drm_agp_head {
 	DRM_AGP_KERN agp_info;		/**< AGP device information */
-	drm_agp_mem_t *memory;		/**< memory entries */
+	struct list_head memory;
 	unsigned long mode;		/**< AGP mode */
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,11)
 	struct agp_bridge_data  *bridge;
@@ -576,6 +570,12 @@ typedef struct drm_ctx_list {
 	drm_file_t *tag;		/**< associated fd private data */
 } drm_ctx_list_t;
 
+struct drm_ctx_sarea_list {
+	struct list_head head;
+	int ctx_id;
+	drm_map_t *map;
+};
+
 typedef struct drm_vbl_sig {
 	struct list_head head;
 	unsigned int sequence;
@@ -587,15 +587,24 @@ typedef struct drm_vbl_sig {
 #define DRM_ATI_GART_MAIN 1
 #define DRM_ATI_GART_FB   2
 
+#define DRM_ATI_GART_PCI 1
+#define DRM_ATI_GART_PCIE 2
+#define DRM_ATI_GART_IGP 3
+
 typedef struct ati_pcigart_info {
 	int gart_table_location;
-	int is_pcie;
+	int gart_reg_if;
 	void *addr;
 	dma_addr_t bus_addr;
 	drm_local_map_t mapping;
 	int table_size;
 } drm_ati_pcigart_info;
 
+struct drm_drawable_list {
+	struct list_head head;
+	int id;
+	drm_drawable_info_t info;
+};
 
 #include "drm_objects.h"
 
@@ -722,15 +731,14 @@ typedef struct drm_device {
 
 	/** \name Authentication */
 	/*@{ */
-	drm_file_t *file_first;		/**< file list head */
-	drm_file_t *file_last;		/**< file list tail */
+	struct list_head filelist;
 	drm_open_hash_t magiclist;
 	struct list_head magicfree;
 	/*@} */
 
 	/** \name Memory management */
 	/*@{ */
-	drm_map_list_t *maplist;	/**< Linked list of regions */
+	struct list_head maplist;	/**< Linked list of regions */
 	int map_count;			/**< Number of mappable regions */
 	drm_open_hash_t map_hash;       /**< User token hash table for maps */
 	drm_mm_t offset_manager;        /**< User token manager */
@@ -740,14 +748,14 @@ typedef struct drm_device {
 
 	/** \name Context handle management */
 	/*@{ */
-	drm_ctx_list_t *ctxlist;	/**< Linked list of context handles */
+	struct list_head ctxlist;	/**< Linked list of context handles */
 	int ctx_count;			/**< Number of context handles */
 	struct mutex ctxlist_mutex;	/**< For ctxlist */
 
-	drm_map_t **context_sareas;	/**< per-context SAREA's */
-	int max_context;
+	struct idr ctx_idr;
+	struct list_head context_sarealist;
 
-	drm_vma_entry_t *vmalist;	/**< List of vmas (for debugging) */
+	struct list_head vmalist;	/**< List of vmas (for debugging) */
 	drm_lock_data_t lock;		/**< Information on hardware lock */
 	/*@} */
 
@@ -783,8 +791,8 @@ typedef struct drm_device {
 	atomic_t vbl_received;
 	atomic_t vbl_received2;		/**< number of secondary VBLANK interrupts */
 	spinlock_t vbl_lock;
-	drm_vbl_sig_t vbl_sigs;		/**< signal list to send on VBLANK */
-	drm_vbl_sig_t vbl_sigs2;	/**< signals to send on secondary VBLANK */
+	struct list_head vbl_sigs;		/**< signal list to send on VBLANK */
+	struct list_head vbl_sigs2;	/**< signals to send on secondary VBLANK */
 	unsigned int vbl_pending;
 	spinlock_t tasklet_lock;	/**< For drm_locked_tasklet */
 	void (*locked_tasklet_func)(struct drm_device *dev);
@@ -806,7 +814,6 @@ typedef struct drm_device {
 	struct pci_controller *hose;
 #endif
 	drm_sg_mem_t *sg;		/**< Scatter gather memory */
-	unsigned long *ctx_bitmap;	/**< context bitmap */
 	void *dev_private;		/**< device private data */
 	drm_sigdata_t sigdata;		/**< For block_all_signals */
 	sigset_t sigmask;
@@ -822,22 +829,18 @@ typedef struct drm_device {
 	/** \name Drawable information */
 	/*@{ */
 	spinlock_t drw_lock;
-	unsigned int drw_bitfield_length;
-	u32 *drw_bitfield;
-	unsigned int drw_info_length;
-	drm_drawable_info_t **drw_info;
+	struct idr drw_idr;
+	struct list_head drwlist;
 	/*@} */
 } drm_device_t;
 
 #if __OS_HAS_AGP
-typedef struct drm_agp_ttm_priv {
+typedef struct drm_agp_ttm_backend {
+        drm_ttm_backend_t backend;
 	DRM_AGP_MEM *mem;
 	struct agp_bridge_data *bridge;
-	unsigned alloc_type;
-	unsigned cached_type;
-	unsigned uncached_type;
 	int populated;
-} drm_agp_ttm_priv;
+} drm_agp_ttm_backend_t;
 #endif
 
 #define ATI_PCIGART_FLAG_VMALLOC 1
@@ -1125,8 +1128,7 @@ extern DRM_AGP_MEM *drm_agp_allocate_memory(struct agp_bridge_data *bridge, size
 extern int drm_agp_free_memory(DRM_AGP_MEM * handle);
 extern int drm_agp_bind_memory(DRM_AGP_MEM * handle, off_t start);
 extern int drm_agp_unbind_memory(DRM_AGP_MEM * handle);
-extern drm_ttm_backend_t *drm_agp_init_ttm(struct drm_device *dev,
-					   drm_ttm_backend_t *backend);
+extern drm_ttm_backend_t *drm_agp_init_ttm(struct drm_device *dev);
 				/* Stub support (drm_stub.h) */
 extern int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
 		     struct drm_driver *driver);
@@ -1138,6 +1140,8 @@ extern drm_head_t **drm_heads;
 extern struct drm_sysfs_class *drm_class;
 extern struct proc_dir_entry *drm_proc_root;
 
+extern drm_local_map_t *drm_getsarea(struct drm_device *dev);
+
 				/* Proc support (drm_proc.h) */
 extern int drm_proc_init(drm_device_t * dev,
 			 int minor,
@@ -1200,7 +1204,7 @@ static __inline__ struct drm_map *drm_core_findmap(struct drm_device *dev,
 						   unsigned int token)
 {
 	drm_map_list_t *_entry;
-	list_for_each_entry(_entry, &dev->maplist->head, head)
+	list_for_each_entry(_entry, &dev->maplist, head)
 		if (_entry->user_token == token)
 			return _entry->map;
 	return NULL;
diff --git a/linux-core/drm_agpsupport.c b/linux-core/drm_agpsupport.c
index 0f7b1d2e..f134563a 100644
--- a/linux-core/drm_agpsupport.c
+++ b/linux-core/drm_agpsupport.c
@@ -249,11 +249,7 @@ int drm_agp_alloc(drm_device_t *dev, drm_agp_buffer_t *request)
 	entry->memory = memory;
 	entry->bound = 0;
 	entry->pages = pages;
-	entry->prev = NULL;
-	entry->next = dev->agp->memory;
-	if (dev->agp->memory)
-		dev->agp->memory->prev = entry;
-	dev->agp->memory = entry;
+	list_add(&entry->head, &dev->agp->memory);
 
 	request->handle = entry->handle;
 	request->physical = memory->physical;
@@ -280,10 +276,12 @@ int drm_agp_alloc_ioctl(struct inode *inode, struct file *filp,
 		return err;
 
 	if (copy_to_user(argp, &request, sizeof(request))) {
-		drm_agp_mem_t *entry = dev->agp->memory;
-
-		dev->agp->memory = entry->next;
-		dev->agp->memory->prev = NULL;
+		drm_agp_mem_t *entry;
+		list_for_each_entry(entry, &dev->agp->memory, head) {
+			if (entry->handle == request.handle)
+				break;
+		}
+		list_del(&entry->head);
 		drm_free_agp(entry->memory, entry->pages);
 		drm_free(entry, sizeof(*entry), DRM_MEM_AGPLISTS);
 		return -EFAULT;
@@ -306,7 +304,7 @@ static drm_agp_mem_t *drm_agp_lookup_entry(drm_device_t * dev,
 {
 	drm_agp_mem_t *entry;
 
-	for (entry = dev->agp->memory; entry; entry = entry->next) {
+	list_for_each_entry(entry, &dev->agp->memory, head) {
 		if (entry->handle == handle)
 			return entry;
 	}
@@ -435,13 +433,7 @@ int drm_agp_free(drm_device_t *dev, drm_agp_buffer_t *request)
 	if (entry->bound)
 		drm_unbind_agp(entry->memory);
 
-	if (entry->prev)
-		entry->prev->next = entry->next;
-	else
-		dev->agp->memory = entry->next;
-
-	if (entry->next)
-		entry->next->prev = entry->prev;
+	list_del(&entry->head);
 
 	drm_free_agp(entry->memory, entry->pages);
 	drm_free(entry, sizeof(*entry), DRM_MEM_AGPLISTS);
@@ -502,7 +494,7 @@ drm_agp_head_t *drm_agp_init(drm_device_t *dev)
 		drm_free(head, sizeof(*head), DRM_MEM_AGPLISTS);
 		return NULL;
 	}
-	head->memory = NULL;
+	INIT_LIST_HEAD(&head->memory);
 	head->cant_use_aperture = head->agp_info.cant_use_aperture;
 	head->page_mask = head->agp_info.page_mask;
 	return head;
@@ -570,7 +562,8 @@ static int drm_agp_needs_unbind_cache_adjust(drm_ttm_backend_t *backend) {
 static int drm_agp_populate(drm_ttm_backend_t *backend, unsigned long num_pages,
 			    struct page **pages) {
 
-	drm_agp_ttm_priv *agp_priv = (drm_agp_ttm_priv *) backend->private;
+	drm_agp_ttm_backend_t *agp_be = 
+		container_of(backend, drm_agp_ttm_backend_t, backend);
 	struct page **cur_page, **last_page = pages + num_pages;
 	DRM_AGP_MEM *mem;
 
@@ -579,9 +572,9 @@ static int drm_agp_populate(drm_ttm_backend_t *backend, unsigned long num_pages,
 
 	DRM_DEBUG("drm_agp_populate_ttm\n");
 #if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,11)
-	mem = drm_agp_allocate_memory(num_pages, agp_priv->alloc_type);
+	mem = drm_agp_allocate_memory(num_pages, AGP_USER_MEMORY);
 #else
-	mem = drm_agp_allocate_memory(agp_priv->bridge, num_pages, agp_priv->alloc_type);
+	mem = drm_agp_allocate_memory(agp_be->bridge, num_pages, AGP_USER_MEMORY);
 #endif
 	if (!mem) {
 		drm_free_memctl(num_pages *sizeof(void *));
@@ -593,7 +586,7 @@ static int drm_agp_populate(drm_ttm_backend_t *backend, unsigned long num_pages,
 	for (cur_page = pages; cur_page < last_page; ++cur_page) {
 		mem->memory[mem->page_count++] = phys_to_gart(page_to_phys(*cur_page));
 	}
-	agp_priv->mem = mem;
+	agp_be->mem = mem;
 	return 0;
 }
 
@@ -601,76 +594,82 @@ static int drm_agp_bind_ttm(drm_ttm_backend_t *backend,
 			    unsigned long offset,
 			    int cached)
 {
-	drm_agp_ttm_priv *agp_priv = (drm_agp_ttm_priv *) backend->private;
-	DRM_AGP_MEM *mem = agp_priv->mem;
+	drm_agp_ttm_backend_t *agp_be = 
+		container_of(backend, drm_agp_ttm_backend_t, backend);
+	DRM_AGP_MEM *mem = agp_be->mem;
 	int ret;
 
 	DRM_DEBUG("drm_agp_bind_ttm\n");
-	DRM_FLAG_MASKED(backend->flags, (cached) ? DRM_BE_FLAG_BOUND_CACHED : 0,
-			DRM_BE_FLAG_BOUND_CACHED);
 	mem->is_flushed = TRUE;
-	mem->type = (cached) ? agp_priv->cached_type : agp_priv->uncached_type;
+	mem->type = (cached) ? AGP_USER_CACHED_MEMORY : 
+		AGP_USER_MEMORY;
 	ret = drm_agp_bind_memory(mem, offset);
 	if (ret) {
 		DRM_ERROR("AGP Bind memory failed\n");
 	}
+	DRM_FLAG_MASKED(backend->flags, (cached) ? DRM_BE_FLAG_BOUND_CACHED : 0,
+			DRM_BE_FLAG_BOUND_CACHED);
 	return ret;
 }
 
 static int drm_agp_unbind_ttm(drm_ttm_backend_t *backend) {
 
-	drm_agp_ttm_priv *agp_priv = (drm_agp_ttm_priv *) backend->private;
+	drm_agp_ttm_backend_t *agp_be = 
+		container_of(backend, drm_agp_ttm_backend_t, backend);
 
 	DRM_DEBUG("drm_agp_unbind_ttm\n");
-	if (agp_priv->mem->is_bound)
-		return drm_agp_unbind_memory(agp_priv->mem);
+	if (agp_be->mem->is_bound)
+		return drm_agp_unbind_memory(agp_be->mem);
 	else
 		return 0;
 }
 
 static void drm_agp_clear_ttm(drm_ttm_backend_t *backend) {
 
-	drm_agp_ttm_priv *agp_priv = (drm_agp_ttm_priv *) backend->private;
-	DRM_AGP_MEM *mem = agp_priv->mem;
+	drm_agp_ttm_backend_t *agp_be = 
+		container_of(backend, drm_agp_ttm_backend_t, backend);
+	DRM_AGP_MEM *mem = agp_be->mem;
 
 	DRM_DEBUG("drm_agp_clear_ttm\n");
 	if (mem) {
 		unsigned long num_pages = mem->page_count;
-		backend->unbind(backend);
+		backend->func->unbind(backend);
 		agp_free_memory(mem);
 		drm_free_memctl(num_pages *sizeof(void *));
 	}
-
-	agp_priv->mem = NULL;
+	agp_be->mem = NULL;
 }
 
 static void drm_agp_destroy_ttm(drm_ttm_backend_t *backend) {
 
-	drm_agp_ttm_priv *agp_priv;
+	drm_agp_ttm_backend_t *agp_be;
 
 	if (backend) {
 		DRM_DEBUG("drm_agp_destroy_ttm\n");
-		agp_priv = (drm_agp_ttm_priv *) backend->private;
-		if (agp_priv) {
-			if (agp_priv->mem) {
-				backend->clear(backend);
+		agp_be = container_of(backend, drm_agp_ttm_backend_t, backend);
+		if (agp_be) {
+			if (agp_be->mem) {
+				backend->func->clear(backend);
 			}
-			drm_ctl_free(agp_priv, sizeof(*agp_priv), DRM_MEM_MAPPINGS);
-			backend->private = NULL;
-		}
-		if (backend->flags & DRM_BE_FLAG_NEEDS_FREE) {
-			drm_ctl_free(backend, sizeof(*backend), DRM_MEM_MAPPINGS);
+			drm_ctl_free(agp_be, sizeof(*agp_be), DRM_MEM_TTM);
 		}
 	}
 }
 
-
-drm_ttm_backend_t *drm_agp_init_ttm(struct drm_device *dev,
-				    drm_ttm_backend_t *backend)
+static drm_ttm_backend_func_t agp_ttm_backend = 
+{
+	.needs_ub_cache_adjust = drm_agp_needs_unbind_cache_adjust,
+	.populate = drm_agp_populate,
+	.clear = drm_agp_clear_ttm,
+	.bind = drm_agp_bind_ttm,
+	.unbind = drm_agp_unbind_ttm,
+	.destroy =  drm_agp_destroy_ttm,
+};
+
+drm_ttm_backend_t *drm_agp_init_ttm(struct drm_device *dev)
 {
 
-        drm_ttm_backend_t *agp_be;
-	drm_agp_ttm_priv *agp_priv;
+	drm_agp_ttm_backend_t *agp_be;
 	struct agp_kern_info *info;
 
 	if (!dev->agp) {
@@ -690,37 +689,19 @@ drm_ttm_backend_t *drm_agp_init_ttm(struct drm_device *dev,
 		return NULL;
 	}
 
-	agp_be = (backend != NULL) ? backend:
-		drm_ctl_calloc(1, sizeof(*agp_be), DRM_MEM_MAPPINGS);
-
+	
+	agp_be = drm_ctl_calloc(1, sizeof(*agp_be), DRM_MEM_TTM);
 	if (!agp_be)
 		return NULL;
 
-	agp_priv = drm_ctl_calloc(1, sizeof(*agp_priv), DRM_MEM_MAPPINGS);
-
-	if (!agp_priv) {
-		drm_ctl_free(agp_be, sizeof(*agp_be), DRM_MEM_MAPPINGS);
-		return NULL;
-	}
+	agp_be->mem = NULL;
 
+	agp_be->bridge = dev->agp->bridge;
+	agp_be->populated = FALSE;
+	agp_be->backend.func = &agp_ttm_backend;
+	agp_be->backend.mem_type = DRM_BO_MEM_TT;
 
-	agp_priv->mem = NULL;
-	agp_priv->alloc_type = AGP_USER_MEMORY;
-	agp_priv->cached_type = AGP_USER_CACHED_MEMORY;
-	agp_priv->uncached_type = AGP_USER_MEMORY;
-	agp_priv->bridge = dev->agp->bridge;
-	agp_priv->populated = FALSE;
-	agp_be->private = (void *) agp_priv;
-	agp_be->needs_ub_cache_adjust = drm_agp_needs_unbind_cache_adjust;
-	agp_be->populate = drm_agp_populate;
-	agp_be->clear = drm_agp_clear_ttm;
-	agp_be->bind = drm_agp_bind_ttm;
-	agp_be->unbind = drm_agp_unbind_ttm;
-	agp_be->destroy = drm_agp_destroy_ttm;
-	DRM_FLAG_MASKED(agp_be->flags, (backend == NULL) ? DRM_BE_FLAG_NEEDS_FREE : 0,
-			DRM_BE_FLAG_NEEDS_FREE);
-	agp_be->drm_map_type = _DRM_AGP;
-	return agp_be;
+	return &agp_be->backend;
 }
 EXPORT_SYMBOL(drm_agp_init_ttm);
 
diff --git a/linux-core/drm_bo.c b/linux-core/drm_bo.c
index 1bdc6fef..1c7013b3 100644
--- a/linux-core/drm_bo.c
+++ b/linux-core/drm_bo.c
@@ -75,7 +75,8 @@ void drm_bo_add_to_lru(drm_buffer_object_t * bo)
 {
 	drm_mem_type_manager_t *man;
 
-	if (!(bo->mem.mask & (DRM_BO_FLAG_NO_MOVE | DRM_BO_FLAG_NO_EVICT))) {
+	if (!(bo->mem.mask & (DRM_BO_FLAG_NO_MOVE | DRM_BO_FLAG_NO_EVICT))
+	    || bo->mem.mem_type != bo->pinned_mem_type) {
 		man = &bo->dev->bm.man[bo->mem.mem_type];
 		list_add_tail(&bo->lru, &man->lru);
 	} else {
@@ -88,6 +89,9 @@ static int drm_bo_vm_pre_move(drm_buffer_object_t * bo, int old_is_pci)
 #ifdef DRM_ODD_MM_COMPAT
 	int ret;
 
+	if (!bo->map_list.map)
+		return 0;
+
 	ret = drm_bo_lock_kmm(bo);
 	if (ret)
 		return ret;
@@ -95,6 +99,9 @@ static int drm_bo_vm_pre_move(drm_buffer_object_t * bo, int old_is_pci)
 	if (old_is_pci)
 		drm_bo_finish_unmap(bo);
 #else
+	if (!bo->map_list.map)
+		return 0;
+
 	drm_bo_unmap_virtual(bo);
 #endif
 	return 0;
@@ -105,6 +112,9 @@ static void drm_bo_vm_post_move(drm_buffer_object_t * bo)
 #ifdef DRM_ODD_MM_COMPAT
 	int ret;
 
+	if (!bo->map_list.map)
+		return;
+
 	ret = drm_bo_remap_bound(bo);
 	if (ret) {
 		DRM_ERROR("Failed to remap a bound buffer object.\n"
@@ -130,6 +140,11 @@ static int drm_bo_add_ttm(drm_buffer_object_t * bo)
 		if (!bo->ttm)
 			ret = -ENOMEM;
 		break;
+	case drm_bo_type_kernel:
+		bo->ttm = drm_ttm_init(dev, bo->mem.num_pages << PAGE_SHIFT);
+		if (!bo->ttm)
+			ret = -ENOMEM;
+		break;
 	case drm_bo_type_user:
 	case drm_bo_type_fake:
 		break;
@@ -1023,30 +1038,23 @@ static int drm_bo_wait_unfenced(drm_buffer_object_t * bo, int no_wait,
 				int eagain_if_wait)
 {
 	int ret = (bo->priv_flags & _DRM_BO_FLAG_UNFENCED);
-	unsigned long _end = jiffies + 3 * DRM_HZ;
 
 	if (ret && no_wait)
 		return -EBUSY;
 	else if (!ret)
 		return 0;
 
-	do {
-		mutex_unlock(&bo->mutex);
-		DRM_WAIT_ON(ret, bo->event_queue, 3 * DRM_HZ,
-			    !drm_bo_check_unfenced(bo));
-		mutex_lock(&bo->mutex);
-		if (ret == -EINTR)
-			return -EAGAIN;
-		if (ret) {
-			DRM_ERROR
-			    ("Error waiting for buffer to become fenced\n");
-			return ret;
-		}
-		ret = (bo->priv_flags & _DRM_BO_FLAG_UNFENCED);
-	} while (ret && !time_after_eq(jiffies, _end));
+	ret = 0;
+	mutex_unlock(&bo->mutex);
+	DRM_WAIT_ON(ret, bo->event_queue, 3 * DRM_HZ,
+		    !drm_bo_check_unfenced(bo));
+	mutex_lock(&bo->mutex);
+	if (ret == -EINTR)
+		return -EAGAIN;
+	ret = (bo->priv_flags & _DRM_BO_FLAG_UNFENCED);
 	if (ret) {
 		DRM_ERROR("Timeout waiting for buffer to become fenced\n");
-		return ret;
+		return -EBUSY;
 	}
 	if (eagain_if_wait)
 		return -EAGAIN;
@@ -1405,7 +1413,10 @@ static int drm_buffer_object_validate(drm_buffer_object_t * bo,
 	} else if (bo->pinned_node != NULL) {
 
 		mutex_lock(&dev->struct_mutex);
-		drm_mm_put_block(bo->pinned_node);
+
+		if (bo->pinned_node != bo->mem.mm_node)
+			drm_mm_put_block(bo->pinned_node);
+
 		list_del_init(&bo->pinned_lru);
 		bo->pinned_node = NULL;
 		mutex_unlock(&dev->struct_mutex);
@@ -1529,7 +1540,7 @@ static int drm_bo_handle_wait(drm_file_t * priv, uint32_t handle,
 	return ret;
 }
 
-int drm_buffer_object_create(drm_file_t * priv,
+int drm_buffer_object_create(drm_device_t *dev,
 			     unsigned long size,
 			     drm_bo_type_t type,
 			     uint32_t mask,
@@ -1538,7 +1549,6 @@ int drm_buffer_object_create(drm_file_t * priv,
 			     unsigned long buffer_start,
 			     drm_buffer_object_t ** buf_obj)
 {
-	drm_device_t *dev = priv->head->dev;
 	drm_buffer_manager_t *bm = &dev->bm;
 	drm_buffer_object_t *bo;
 	int ret = 0;
@@ -1668,8 +1678,12 @@ int drm_bo_ioctl(DRM_IOCTL_ARGS)
 		rep.ret = 0;
 		switch (req->op) {
 		case drm_bo_create:
+			rep.ret = drm_bo_lock_test(dev, filp);
+			if (rep.ret)
+				break;	
 			rep.ret =
-			    drm_buffer_object_create(priv, req->size,
+			    drm_buffer_object_create(priv->head->dev,
+						     req->size,
 						     req->type,
 						     req->mask,
 						     req->hint,
@@ -1718,16 +1732,8 @@ int drm_bo_ioctl(DRM_IOCTL_ARGS)
 						      drm_buffer_type, &uo);
 			if (rep.ret)
 				break;
-			mutex_lock(&dev->struct_mutex);
-			uo = drm_lookup_user_object(priv, req->handle);
-			entry =
-			    drm_user_object_entry(uo, drm_buffer_object_t,
-						  base);
-			atomic_dec(&entry->usage);
-			mutex_unlock(&dev->struct_mutex);
-			mutex_lock(&entry->mutex);
-			drm_bo_fill_rep_arg(entry, &rep);
-			mutex_unlock(&entry->mutex);
+
+			rep.ret = drm_bo_handle_info(priv, req->handle, &rep);
 			break;
 		case drm_bo_unreference:
 			rep.ret = drm_user_object_unref(priv, req->handle,
@@ -1991,10 +1997,16 @@ static int drm_bo_lock_mm(drm_device_t * dev, unsigned mem_type)
 	drm_mem_type_manager_t *man = &bm->man[mem_type];
 
 	if (mem_type == 0 || mem_type >= DRM_BO_MEM_TYPES) {
-		DRM_ERROR("Illegal memory manager memory type %u,\n", mem_type);
+		DRM_ERROR("Illegal memory manager memory type %u.\n", mem_type);
 		return -EINVAL;
 	}
 
+	if (!man->has_type) {
+		DRM_ERROR("Memory type %u has not been initialized.\n",
+			  mem_type);
+		return 0;
+	}
+
 	drm_bo_clean_unfenced(dev);
 	ret = drm_bo_force_list_clean(dev, &man->lru, mem_type, 0, 1, 0);
 	if (ret)
@@ -2294,6 +2306,9 @@ void drm_bo_unmap_virtual(drm_buffer_object_t * bo)
 	loff_t offset = ((loff_t) bo->map_list.hash.key) << PAGE_SHIFT;
 	loff_t holelen = ((loff_t) bo->mem.num_pages) << PAGE_SHIFT;
 
+	if (!dev->dev_mapping)
+		return;
+
 	unmap_mapping_range(dev->dev_mapping, offset, holelen, 1);
 }
 
diff --git a/linux-core/drm_bufs.c b/linux-core/drm_bufs.c
index 8793ba0e..a2c8a75e 100644
--- a/linux-core/drm_bufs.c
+++ b/linux-core/drm_bufs.c
@@ -51,10 +51,8 @@ EXPORT_SYMBOL(drm_get_resource_len);
 static drm_map_list_t *drm_find_matching_map(drm_device_t *dev,
 					      drm_local_map_t *map)
 {
-	struct list_head *list;
-
-	list_for_each(list, &dev->maplist->head) {
-		drm_map_list_t *entry = list_entry(list, drm_map_list_t, head);
+	drm_map_list_t *entry;
+	list_for_each_entry(entry, &dev->maplist, head) {
 		if (entry->map && map->type == entry->map->type &&
 		    ((entry->map->offset == map->offset) || 
 		     (map->type == _DRM_SHM && map->flags==_DRM_CONTAINS_LOCK))) {
@@ -237,14 +235,14 @@ static int drm_addmap_core(drm_device_t * dev, unsigned int offset,
 		 * skipped and we double check that dev->agp->memory is
 		 * actually set as well as being invalid before EPERM'ing
 		 */
-		for (entry = dev->agp->memory; entry; entry = entry->next) {
+		list_for_each_entry(entry, &dev->agp->memory, head) {
 			if ((map->offset >= entry->bound) &&
 			    (map->offset + map->size <= entry->bound + entry->pages * PAGE_SIZE)) {
 				valid = 1;
 				break;
 			}
 		}
-		if (dev->agp->memory && !valid) {
+		if (!list_empty(&dev->agp->memory) && !valid) {
 			drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 			return -EPERM;
 		}
@@ -288,7 +286,7 @@ static int drm_addmap_core(drm_device_t * dev, unsigned int offset,
 	list->map = map;
 
 	mutex_lock(&dev->struct_mutex);
-	list_add(&list->head, &dev->maplist->head);
+	list_add(&list->head, &dev->maplist);
 
 	/* Assign a 32-bit handle */
 
@@ -380,29 +378,28 @@ int drm_addmap_ioctl(struct inode *inode, struct file *filp,
  */
 int drm_rmmap_locked(drm_device_t *dev, drm_local_map_t *map)
 {
-	struct list_head *list;
-	drm_map_list_t *r_list = NULL;
+	drm_map_list_t *r_list = NULL, *list_t;
 	drm_dma_handle_t dmah;
+	int found = 0;
 
 	/* Find the list entry for the map and remove it */
-	list_for_each(list, &dev->maplist->head) {
-		r_list = list_entry(list, drm_map_list_t, head);
-
+	list_for_each_entry_safe(r_list, list_t, &dev->maplist, head) {
 		if (r_list->map == map) {
-			list_del(list);
+			list_del(&r_list->head);
 			drm_ht_remove_key(&dev->map_hash, 
 					  r_list->user_token >> PAGE_SHIFT);
-			drm_free(list, sizeof(*list), DRM_MEM_MAPS);
+			drm_free(r_list, sizeof(*r_list), DRM_MEM_MAPS);
+			found = 1;
 			break;
 		}
 	}
 
+	if (!found) {
+		return -EINVAL;
+	}
 	/* List has wrapped around to the head pointer, or it's empty and we
 	 * didn't find anything.
 	 */
-	if (list == (&dev->maplist->head)) {
-		return -EINVAL;
-	}
 
 	switch (map->type) {
 	case _DRM_REGISTERS:
@@ -464,7 +461,7 @@ int drm_rmmap_ioctl(struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->head->dev;
 	drm_map_t request;
 	drm_local_map_t *map = NULL;
-	struct list_head *list;
+	drm_map_list_t *r_list;
 	int ret;
 
 	if (copy_from_user(&request, (drm_map_t __user *) arg, sizeof(request))) {
@@ -472,9 +469,7 @@ int drm_rmmap_ioctl(struct inode *inode, struct file *filp,
 	}
 
 	mutex_lock(&dev->struct_mutex);
-	list_for_each(list, &dev->maplist->head) {
-		drm_map_list_t *r_list = list_entry(list, drm_map_list_t, head);
-
+	list_for_each_entry(r_list, &dev->maplist, head) {
 		if (r_list->map &&
 		    r_list->user_token == (unsigned long)request.handle &&
 		    r_list->map->flags & _DRM_REMOVABLE) {
@@ -486,7 +481,7 @@ int drm_rmmap_ioctl(struct inode *inode, struct file *filp,
 	/* List has wrapped around to the head pointer, or its empty we didn't
 	 * find anything.
 	 */
-	if (list == (&dev->maplist->head)) {
+	if (list_empty(&dev->maplist) || !map) {
 		mutex_unlock(&dev->struct_mutex);
 		return -EINVAL;
 	}
@@ -610,14 +605,14 @@ int drm_addbufs_agp(drm_device_t * dev, drm_buf_desc_t * request)
 
 	/* Make sure buffers are located in AGP memory that we own */
 	valid = 0;
-	for (agp_entry = dev->agp->memory; agp_entry; agp_entry = agp_entry->next) {
+	list_for_each_entry(agp_entry, &dev->agp->memory, head) {
 		if ((agp_offset >= agp_entry->bound) &&
 		    (agp_offset + total * count <= agp_entry->bound + agp_entry->pages * PAGE_SIZE)) {
 			valid = 1;
 			break;
 		}
 	}
-	if (dev->agp->memory && !valid) {
+	if (!list_empty(&dev->agp->memory) && !valid) {
 		DRM_DEBUG("zone invalid\n");
 		return -EINVAL;
 	}
diff --git a/linux-core/drm_compat.c b/linux-core/drm_compat.c
index 23441811..9ac5658c 100644
--- a/linux-core/drm_compat.c
+++ b/linux-core/drm_compat.c
@@ -275,12 +275,14 @@ static struct page *drm_bo_vm_fault(struct vm_area_struct *vma,
 			goto out_unlock;
 		}
 		pfn = page_to_pfn(page);
-		vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+		vma->vm_page_prot = (bo->mem.flags & DRM_BO_FLAG_CACHED) ?
+			vm_get_page_prot(vma->vm_flags) :
+			drm_io_prot(_DRM_TTM, vma);
 	}
-	
+
 	err = vm_insert_pfn(vma, address, pfn);
 
-	if (!err || err == -EBUSY) 
+	if (!err || err == -EBUSY)
 		data->type = VM_FAULT_MINOR; 
 	else
 		data->type = VM_FAULT_OOM;
diff --git a/linux-core/drm_context.c b/linux-core/drm_context.c
index 49042272..5cb79b14 100644
--- a/linux-core/drm_context.c
+++ b/linux-core/drm_context.c
@@ -58,20 +58,17 @@
  */
 void drm_ctxbitmap_free(drm_device_t * dev, int ctx_handle)
 {
-	if (ctx_handle < 0)
-		goto failed;
-	if (!dev->ctx_bitmap)
-		goto failed;
-
-	if (ctx_handle < DRM_MAX_CTXBITMAP) {
-		mutex_lock(&dev->struct_mutex);
-		clear_bit(ctx_handle, dev->ctx_bitmap);
-		dev->context_sareas[ctx_handle] = NULL;
-		mutex_unlock(&dev->struct_mutex);
-		return;
-	}
-      failed:
-	DRM_ERROR("Attempt to free invalid context handle: %d\n", ctx_handle);
+	struct drm_ctx_sarea_list *ctx_sarea;
+
+	mutex_lock(&dev->struct_mutex);
+	ctx_sarea = idr_find(&dev->ctx_idr, ctx_handle);
+	if (ctx_sarea) {
+		idr_remove(&dev->ctx_idr, ctx_handle);
+		list_del(&ctx_sarea->head);
+		drm_free(ctx_sarea, sizeof(struct drm_ctx_sarea_list), DRM_MEM_BUFS);
+	} else
+		DRM_ERROR("Attempt to free invalid context handle: %d\n", ctx_handle);
+	mutex_unlock(&dev->struct_mutex);
 	return;
 }
 
@@ -87,56 +84,32 @@ void drm_ctxbitmap_free(drm_device_t * dev, int ctx_handle)
  */
 static int drm_ctxbitmap_next(drm_device_t * dev)
 {
-	int bit;
+	int new_id;
+	int ret;
+	struct drm_ctx_sarea_list *new_ctx;
 
-	if (!dev->ctx_bitmap)
+	new_ctx = drm_calloc(1, sizeof(struct drm_ctx_sarea_list), DRM_MEM_BUFS);
+	if (!new_ctx)
 		return -1;
 
+again:
+	if (idr_pre_get(&dev->ctx_idr, GFP_KERNEL) == 0) {
+		DRM_ERROR("Out of memory expanding drawable idr\n");
+		drm_free(new_ctx, sizeof(struct drm_ctx_sarea_list), DRM_MEM_BUFS);
+		return -ENOMEM;
+	}
 	mutex_lock(&dev->struct_mutex);
-	bit = find_first_zero_bit(dev->ctx_bitmap, DRM_MAX_CTXBITMAP);
-	if (bit < DRM_MAX_CTXBITMAP) {
-		set_bit(bit, dev->ctx_bitmap);
-		DRM_DEBUG("drm_ctxbitmap_next bit : %d\n", bit);
-		if ((bit + 1) > dev->max_context) {
-			dev->max_context = (bit + 1);
-			if (dev->context_sareas) {
-				drm_map_t **ctx_sareas;
-
-				ctx_sareas = drm_realloc(dev->context_sareas,
-							 (dev->max_context -
-							  1) *
-							 sizeof(*dev->
-								context_sareas),
-							 dev->max_context *
-							 sizeof(*dev->
-								context_sareas),
-							 DRM_MEM_MAPS);
-				if (!ctx_sareas) {
-					clear_bit(bit, dev->ctx_bitmap);
-					mutex_unlock(&dev->struct_mutex);
-					return -1;
-				}
-				dev->context_sareas = ctx_sareas;
-				dev->context_sareas[bit] = NULL;
-			} else {
-				/* max_context == 1 at this point */
-				dev->context_sareas =
-				    drm_alloc(dev->max_context *
-					      sizeof(*dev->context_sareas),
-					      DRM_MEM_MAPS);
-				if (!dev->context_sareas) {
-					clear_bit(bit, dev->ctx_bitmap);
-					mutex_unlock(&dev->struct_mutex);
-					return -1;
-				}
-				dev->context_sareas[bit] = NULL;
-			}
-		}
+	ret = idr_get_new_above(&dev->ctx_idr, new_ctx, DRM_RESERVED_CONTEXTS, &new_id);
+	if (ret == -EAGAIN) {
 		mutex_unlock(&dev->struct_mutex);
-		return bit;
+		goto again;
 	}
+	
 	mutex_unlock(&dev->struct_mutex);
-	return -1;
+
+	new_ctx->ctx_id = new_id;
+	list_add(&new_ctx->head, &dev->context_sarealist);
+	return new_id;
 }
 
 /**
@@ -149,25 +122,8 @@ static int drm_ctxbitmap_next(drm_device_t * dev)
  */
 int drm_ctxbitmap_init(drm_device_t * dev)
 {
-	int i;
-	int temp;
-
-	mutex_lock(&dev->struct_mutex);
-	dev->ctx_bitmap = (unsigned long *)drm_alloc(PAGE_SIZE,
-						     DRM_MEM_CTXBITMAP);
-	if (dev->ctx_bitmap == NULL) {
-		mutex_unlock(&dev->struct_mutex);
-		return -ENOMEM;
-	}
-	memset((void *)dev->ctx_bitmap, 0, PAGE_SIZE);
-	dev->context_sareas = NULL;
-	dev->max_context = -1;
-	mutex_unlock(&dev->struct_mutex);
-
-	for (i = 0; i < DRM_RESERVED_CONTEXTS; i++) {
-		temp = drm_ctxbitmap_next(dev);
-		DRM_DEBUG("drm_ctxbitmap_init : %d\n", temp);
-	}
+	idr_init(&dev->ctx_idr);
+	INIT_LIST_HEAD(&dev->context_sarealist);
 
 	return 0;
 }
@@ -182,12 +138,13 @@ int drm_ctxbitmap_init(drm_device_t * dev)
  */
 void drm_ctxbitmap_cleanup(drm_device_t * dev)
 {
+	struct drm_ctx_sarea_list *ctx_entry, *ctx_temp;
+
 	mutex_lock(&dev->struct_mutex);
-	if (dev->context_sareas)
-		drm_free(dev->context_sareas,
-			 sizeof(*dev->context_sareas) *
-			 dev->max_context, DRM_MEM_MAPS);
-	drm_free((void *)dev->ctx_bitmap, PAGE_SIZE, DRM_MEM_CTXBITMAP);
+	list_for_each_entry_safe(ctx_entry, ctx_temp, &dev->context_sarealist, head) {
+		idr_remove(&dev->ctx_idr, ctx_entry->ctx_id);
+		drm_free(ctx_entry, sizeof(struct drm_ctx_sarea_list), DRM_MEM_MAPS);
+	}
 	mutex_unlock(&dev->struct_mutex);
 }
 
@@ -218,22 +175,24 @@ int drm_getsareactx(struct inode *inode, struct file *filp,
 	drm_ctx_priv_map_t request;
 	drm_map_t *map;
 	drm_map_list_t *_entry;
+	struct drm_ctx_sarea_list *ctx_sarea;
 
 	if (copy_from_user(&request, argp, sizeof(request)))
 		return -EFAULT;
 
 	mutex_lock(&dev->struct_mutex);
-	if (dev->max_context < 0
-	    || request.ctx_id >= (unsigned)dev->max_context) {
+
+	ctx_sarea = idr_find(&dev->ctx_idr, request.ctx_id);
+	if (!ctx_sarea) {
 		mutex_unlock(&dev->struct_mutex);
 		return -EINVAL;
 	}
-
-	map = dev->context_sareas[request.ctx_id];
+	
+	map = ctx_sarea->map;
 	mutex_unlock(&dev->struct_mutex);
 
 	request.handle = NULL;
-	list_for_each_entry(_entry, &dev->maplist->head,head) {
+	list_for_each_entry(_entry, &dev->maplist, head) {
 		if (_entry->map == map) {
 			request.handle = 
 			    (void *)(unsigned long)_entry->user_token;
@@ -268,15 +227,14 @@ int drm_setsareactx(struct inode *inode, struct file *filp,
 	drm_ctx_priv_map_t request;
 	drm_map_t *map = NULL;
 	drm_map_list_t *r_list = NULL;
-	struct list_head *list;
+	struct drm_ctx_sarea_list *ctx_sarea;
 
 	if (copy_from_user(&request,
 			   (drm_ctx_priv_map_t __user *) arg, sizeof(request)))
 		return -EFAULT;
 
 	mutex_lock(&dev->struct_mutex);
-	list_for_each(list, &dev->maplist->head) {
-		r_list = list_entry(list, drm_map_list_t, head);
+	list_for_each_entry(r_list, &dev->maplist, head) {
 		if (r_list->map
 		    && r_list->user_token == (unsigned long) request.handle)
 			goto found;
@@ -289,11 +247,15 @@ int drm_setsareactx(struct inode *inode, struct file *filp,
 	map = r_list->map;
 	if (!map)
 		goto bad;
-	if (dev->max_context < 0)
-		goto bad;
-	if (request.ctx_id >= (unsigned)dev->max_context)
+
+	mutex_lock(&dev->struct_mutex);
+
+	ctx_sarea = idr_find(&dev->ctx_idr, request.ctx_id);
+	if (!ctx_sarea) {
 		goto bad;
-	dev->context_sareas[request.ctx_id] = map;
+	}
+	
+	ctx_sarea->map = map;
 	mutex_unlock(&dev->struct_mutex);
 	return 0;
 }
@@ -449,7 +411,7 @@ int drm_addctx(struct inode *inode, struct file *filp,
 	ctx_entry->tag = priv;
 
 	mutex_lock(&dev->ctxlist_mutex);
-	list_add(&ctx_entry->head, &dev->ctxlist->head);
+	list_add(&ctx_entry->head, &dev->ctxlist);
 	++dev->ctx_count;
 	mutex_unlock(&dev->ctxlist_mutex);
 
@@ -575,10 +537,10 @@ int drm_rmctx(struct inode *inode, struct file *filp,
 	}
 
 	mutex_lock(&dev->ctxlist_mutex);
-	if (!list_empty(&dev->ctxlist->head)) {
+	if (!list_empty(&dev->ctxlist)) {
 		drm_ctx_list_t *pos, *n;
 
-		list_for_each_entry_safe(pos, n, &dev->ctxlist->head, head) {
+		list_for_each_entry_safe(pos, n, &dev->ctxlist, head) {
 			if (pos->handle == ctx.handle) {
 				list_del(&pos->head);
 				drm_free(pos, sizeof(*pos), DRM_MEM_CTXLIST);
diff --git a/linux-core/drm_drawable.c b/linux-core/drm_drawable.c
index 0817e321..d599430b 100644
--- a/linux-core/drm_drawable.c
+++ b/linux-core/drm_drawable.c
@@ -44,82 +44,38 @@ int drm_adddraw(DRM_IOCTL_ARGS)
 {
 	DRM_DEVICE;
 	unsigned long irqflags;
-	int i, j;
-	u32 *bitfield = dev->drw_bitfield;
-	unsigned int bitfield_length = dev->drw_bitfield_length;
-	drm_drawable_info_t **info = dev->drw_info;
-	unsigned int info_length = dev->drw_info_length;
+	struct drm_drawable_list *draw_info;
 	drm_draw_t draw;
-
-	for (i = 0, j = 0; i < bitfield_length; i++) {
-		if (bitfield[i] == ~0)
-			continue;
-
-		for (; j < 8 * sizeof(*bitfield); j++)
-			if (!(bitfield[i] & (1 << j)))
-				goto done;
+	int new_id = 0;
+	int ret;
+
+	draw_info = drm_calloc(1, sizeof(struct drm_drawable_list), DRM_MEM_BUFS);
+	if (!draw_info)
+		return -ENOMEM;
+
+again:
+	if (idr_pre_get(&dev->drw_idr, GFP_KERNEL) == 0) {
+		DRM_ERROR("Out of memory expanding drawable idr\n");
+		drm_free(draw_info, sizeof(struct drm_drawable_list), DRM_MEM_BUFS);
+		return -ENOMEM;
 	}
-done:
-
-	if (i == bitfield_length) {
-		bitfield_length++;
-
-		bitfield = drm_alloc(bitfield_length * sizeof(*bitfield),
-				     DRM_MEM_BUFS);
-
-		if (!bitfield) {
-			DRM_ERROR("Failed to allocate new drawable bitfield\n");
-			return DRM_ERR(ENOMEM);
-		}
-
-		if (8 * sizeof(*bitfield) * bitfield_length > info_length) {
-			info_length += 8 * sizeof(*bitfield);
-
-			info = drm_alloc(info_length * sizeof(*info),
-					 DRM_MEM_BUFS);
-
-			if (!info) {
-				DRM_ERROR("Failed to allocate new drawable info"
-					  " array\n");
-
-				drm_free(bitfield,
-					 bitfield_length * sizeof(*bitfield),
-					 DRM_MEM_BUFS);
-				return DRM_ERR(ENOMEM);
-			}
-		}
-
-		bitfield[i] = 0;
-	}
-
-	draw.handle = i * 8 * sizeof(*bitfield) + j + 1;
-	DRM_DEBUG("%d\n", draw.handle);
 
 	spin_lock_irqsave(&dev->drw_lock, irqflags);
-
-	bitfield[i] |= 1 << j;
-	info[draw.handle - 1] = NULL;
-
-	if (bitfield != dev->drw_bitfield) {
-		memcpy(bitfield, dev->drw_bitfield, dev->drw_bitfield_length *
-		       sizeof(*bitfield));
-		drm_free(dev->drw_bitfield, sizeof(*bitfield) *
-			 dev->drw_bitfield_length, DRM_MEM_BUFS);
-		dev->drw_bitfield = bitfield;
-		dev->drw_bitfield_length = bitfield_length;
+	ret = idr_get_new_above(&dev->drw_idr, draw_info, 1, &new_id);
+	if (ret == -EAGAIN) {
+		spin_unlock_irqrestore(&dev->drw_lock, irqflags);
+		goto again;
 	}
 
-	if (info != dev->drw_info) {
-		memcpy(info, dev->drw_info, dev->drw_info_length *
-		       sizeof(*info));
-		drm_free(dev->drw_info, sizeof(*info) * dev->drw_info_length,
-			 DRM_MEM_BUFS);
-		dev->drw_info = info;
-		dev->drw_info_length = info_length;
-	}
+	list_add(&draw_info->head, &dev->drwlist);
 
 	spin_unlock_irqrestore(&dev->drw_lock, irqflags);
 
+	draw_info->id = new_id;
+	draw.handle = new_id;
+
+	DRM_DEBUG("%d\n", draw.handle);
+
 	DRM_COPY_TO_USER_IOCTL((drm_draw_t __user *)data, draw, sizeof(draw));
 
 	return 0;
@@ -132,87 +88,25 @@ int drm_rmdraw(DRM_IOCTL_ARGS)
 {
 	DRM_DEVICE;
 	drm_draw_t draw;
-	int id, idx;
-	unsigned int shift;
 	unsigned long irqflags;
-	u32 *bitfield = dev->drw_bitfield;
-	unsigned int bitfield_length = dev->drw_bitfield_length;
-	drm_drawable_info_t **info = dev->drw_info;
-	unsigned int info_length = dev->drw_info_length;
+	struct drm_drawable_list *draw_info;
 
 	DRM_COPY_FROM_USER_IOCTL(draw, (drm_draw_t __user *) data,
 				 sizeof(draw));
 
-	id = draw.handle - 1;
-	idx = id / (8 * sizeof(*bitfield));
-	shift = id % (8 * sizeof(*bitfield));
-
-	if (idx < 0 || idx >= bitfield_length ||
-	    !(bitfield[idx] & (1 << shift))) {
+	draw_info = idr_find(&dev->drw_idr, draw.handle);
+	if (!draw_info) {
 		DRM_DEBUG("No such drawable %d\n", draw.handle);
-		return 0;
+		return -EINVAL;
 	}
 
 	spin_lock_irqsave(&dev->drw_lock, irqflags);
 
-	bitfield[idx] &= ~(1 << shift);
+	list_del(&draw_info->head);
+	idr_remove(&dev->drw_idr, draw.handle);
+	drm_free(draw_info, sizeof(struct drm_drawable_list), DRM_MEM_BUFS);
 
 	spin_unlock_irqrestore(&dev->drw_lock, irqflags);
-
-	if (info[id]) {
-		drm_free(info[id]->rects, info[id]->num_rects *
-			 sizeof(drm_clip_rect_t), DRM_MEM_BUFS);
-		drm_free(info[id], sizeof(**info), DRM_MEM_BUFS);
-	}
-
-	/* Can we shrink the arrays? */
-	if (idx == bitfield_length - 1) {
-		while (idx >= 0 && !bitfield[idx])
-			--idx;
-
-		bitfield_length = idx + 1;
-
-		if (idx != id / (8 * sizeof(*bitfield)))
-			bitfield = drm_alloc(bitfield_length *
-					     sizeof(*bitfield), DRM_MEM_BUFS);
-
-		if (!bitfield && bitfield_length) {
-			bitfield = dev->drw_bitfield;
-			bitfield_length = dev->drw_bitfield_length;
-		}
-	}
-
-	if (bitfield != dev->drw_bitfield) {
-		info_length = 8 * sizeof(*bitfield) * bitfield_length;
-
-		info = drm_alloc(info_length * sizeof(*info), DRM_MEM_BUFS);
-
-		if (!info && info_length) {
-			info = dev->drw_info;
-			info_length = dev->drw_info_length;
-		}
-
-		spin_lock_irqsave(&dev->drw_lock, irqflags);
-
-		memcpy(bitfield, dev->drw_bitfield, bitfield_length *
-		       sizeof(*bitfield));
-		drm_free(dev->drw_bitfield, sizeof(*bitfield) *
-			 dev->drw_bitfield_length, DRM_MEM_BUFS);
-		dev->drw_bitfield = bitfield;
-		dev->drw_bitfield_length = bitfield_length;
-
-		if (info != dev->drw_info) {
-			memcpy(info, dev->drw_info, info_length *
-			       sizeof(*info));
-			drm_free(dev->drw_info, sizeof(*info) *
-				 dev->drw_info_length, DRM_MEM_BUFS);
-			dev->drw_info = info;
-			dev->drw_info_length = info_length;
-		}
-
-		spin_unlock_irqrestore(&dev->drw_lock, irqflags);
-	}
-
 	DRM_DEBUG("%d\n", draw.handle);
 	return 0;
 }
@@ -220,36 +114,22 @@ int drm_rmdraw(DRM_IOCTL_ARGS)
 int drm_update_drawable_info(DRM_IOCTL_ARGS) {
 	DRM_DEVICE;
 	drm_update_draw_t update;
-	unsigned int id, idx, shift, bitfield_length = dev->drw_bitfield_length;
-	u32 *bitfield = dev->drw_bitfield;
 	unsigned long irqflags;
 	drm_drawable_info_t *info;
 	drm_clip_rect_t *rects;
+	struct drm_drawable_list *draw_info;
 	int err;
 
 	DRM_COPY_FROM_USER_IOCTL(update, (drm_update_draw_t __user *) data,
 				 sizeof(update));
 
-	id = update.handle - 1;
-	idx = id / (8 * sizeof(*bitfield));
-	shift = id % (8 * sizeof(*bitfield));
-
-	if (idx < 0 || idx >= bitfield_length ||
-	    !(bitfield[idx] & (1 << shift))) {
+	draw_info = idr_find(&dev->drw_idr, update.handle);
+	if (!draw_info) {
 		DRM_ERROR("No such drawable %d\n", update.handle);
 		return DRM_ERR(EINVAL);
 	}
 
-	info = dev->drw_info[id];
-
-	if (!info) {
-		info = drm_calloc(1, sizeof(drm_drawable_info_t), DRM_MEM_BUFS);
-
-		if (!info) {
-			DRM_ERROR("Failed to allocate drawable info memory\n");
-			return DRM_ERR(ENOMEM);
-		}
-	}
+	info = &draw_info->info;
 
 	switch (update.type) {
 	case DRM_DRAWABLE_CLIPRECTS:
@@ -284,12 +164,11 @@ int drm_update_drawable_info(DRM_IOCTL_ARGS) {
 
 		info->rects = rects;
 		info->num_rects = update.num;
-		dev->drw_info[id] = info;
 
 		spin_unlock_irqrestore(&dev->drw_lock, irqflags);
 
 		DRM_DEBUG("Updated %d cliprects for drawable %d\n",
-			  info->num_rects, id);
+			  info->num_rects, update.handle);
 		break;
 	default:
 		DRM_ERROR("Invalid update type %d\n", update.type);
@@ -299,11 +178,9 @@ int drm_update_drawable_info(DRM_IOCTL_ARGS) {
 	return 0;
 
 error:
-	if (!dev->drw_info[id])
-		drm_free(info, sizeof(*info), DRM_MEM_BUFS);
-	else if (rects != dev->drw_info[id]->rects)
-		drm_free(rects, update.num *
-			 sizeof(drm_clip_rect_t), DRM_MEM_BUFS);
+	if (rects != info->rects)
+		drm_free(rects, update.num * sizeof(drm_clip_rect_t),
+			 DRM_MEM_BUFS);
 
 	return err;
 }
@@ -312,19 +189,13 @@ error:
  * Caller must hold the drawable spinlock!
  */
 drm_drawable_info_t *drm_get_drawable_info(drm_device_t *dev, drm_drawable_t id) {
-	u32 *bitfield = dev->drw_bitfield;
-	unsigned int idx, shift;
-
-	id--;
-	idx = id / (8 * sizeof(*bitfield));
-	shift = id % (8 * sizeof(*bitfield));
-
-	if (idx < 0 || idx >= dev->drw_bitfield_length ||
-	    !(bitfield[idx] & (1 << shift))) {
+	struct drm_drawable_list *draw_info;
+	draw_info = idr_find(&dev->drw_idr, id);
+	if (!draw_info) {
 		DRM_DEBUG("No such drawable %d\n", id);
 		return NULL;
 	}
 
-	return dev->drw_info[id];
+	return &draw_info->info;
 }
 EXPORT_SYMBOL(drm_get_drawable_info);
diff --git a/linux-core/drm_drv.c b/linux-core/drm_drv.c
index b95f796f..1695a792 100644
--- a/linux-core/drm_drv.c
+++ b/linux-core/drm_drv.c
@@ -140,8 +140,9 @@ static drm_ioctl_desc_t drm_ioctls[] = {
 int drm_lastclose(drm_device_t * dev)
 {
 	drm_magic_entry_t *pt, *next;
-	drm_map_list_t *r_list;
-	drm_vma_entry_t *vma, *vma_next;
+	drm_map_list_t *r_list, *list_t;
+	drm_vma_entry_t *vma, *vma_temp;
+	struct drm_drawable_list *drw_entry, *drw_temp;
 	int i;
 
 	DRM_DEBUG("\n");
@@ -166,15 +167,13 @@ int drm_lastclose(drm_device_t * dev)
 		drm_irq_uninstall(dev);
 
 	/* Free drawable information memory */
-	for (i = 0; i < dev->drw_bitfield_length / sizeof(*dev->drw_bitfield);
-	     i++) {
-		drm_drawable_info_t *info = drm_get_drawable_info(dev, i);
-
-		if (info) {
-			drm_free(info->rects, info->num_rects *
-				 sizeof(drm_clip_rect_t), DRM_MEM_BUFS);
-			drm_free(info, sizeof(*info), DRM_MEM_BUFS);
-		}
+	list_for_each_entry_safe(drw_entry, drw_temp, &dev->drwlist, head) {
+		drm_free(drw_entry->info.rects, drw_entry->info.num_rects *
+			 sizeof(drm_clip_rect_t), DRM_MEM_BUFS);
+
+		idr_remove(&dev->drw_idr, drw_entry->id);
+		list_del(&drw_entry->head);
+		drm_free(drw_entry, sizeof(struct drm_drawable_list), DRM_MEM_BUFS);
 	}
 
 	mutex_lock(&dev->struct_mutex);
@@ -198,19 +197,17 @@ int drm_lastclose(drm_device_t * dev)
 
 	/* Clear AGP information */
 	if (drm_core_has_AGP(dev) && dev->agp) {
-		drm_agp_mem_t *entry;
-		drm_agp_mem_t *nexte;
+		drm_agp_mem_t *entry, *tempe;
 
 		/* Remove AGP resources, but leave dev->agp
 		   intact until drv_cleanup is called. */
-		for (entry = dev->agp->memory; entry; entry = nexte) {
-			nexte = entry->next;
+		list_for_each_entry_safe(entry, tempe, &dev->agp->memory, head) {
 			if (entry->bound)
 				drm_unbind_agp(entry->memory);
 			drm_free_agp(entry->memory, entry->pages);
 			drm_free(entry, sizeof(*entry), DRM_MEM_AGPLISTS);
 		}
-		dev->agp->memory = NULL;
+		INIT_LIST_HEAD(&dev->agp->memory);
 
 		if (dev->agp->acquired)
 			drm_agp_release(dev);
@@ -224,20 +221,14 @@ int drm_lastclose(drm_device_t * dev)
 	}
 
 	/* Clear vma list (only built for debugging) */
-	if (dev->vmalist) {
-		for (vma = dev->vmalist; vma; vma = vma_next) {
-			vma_next = vma->next;
-			drm_ctl_free(vma, sizeof(*vma), DRM_MEM_VMAS);
-		}
-		dev->vmalist = NULL;
+	list_for_each_entry_safe(vma, vma_temp, &dev->vmalist, head) {
+		list_del(&vma->head);
+		drm_ctl_free(vma, sizeof(*vma), DRM_MEM_VMAS);
 	}
-
-	if (dev->maplist) {
-		while (!list_empty(&dev->maplist->head)) {
-			struct list_head *list = dev->maplist->head.next;
-			r_list = list_entry(list, drm_map_list_t, head);
-			drm_rmmap_locked(dev, r_list->map);
-		}
+	
+	list_for_each_entry_safe(r_list, list_t, &dev->maplist, head) {
+		drm_rmmap_locked(dev, r_list->map);
+		r_list = NULL;
 	}
 
 	if (drm_core_check_feature(dev, DRIVER_DMA_QUEUE) && dev->queuelist) {
@@ -372,13 +363,9 @@ static void drm_cleanup(drm_device_t * dev)
 	drm_lastclose(dev);
 	drm_fence_manager_takedown(dev);
 
-	if (dev->maplist) {
-		drm_free(dev->maplist, sizeof(*dev->maplist), DRM_MEM_MAPS);
-		dev->maplist = NULL;
-		drm_ht_remove(&dev->map_hash);
-		drm_mm_takedown(&dev->offset_manager);
-		drm_ht_remove(&dev->object_hash);
-	}
+	drm_ht_remove(&dev->map_hash);
+	drm_mm_takedown(&dev->offset_manager);
+	drm_ht_remove(&dev->object_hash);
 
 	if (!drm_fb_loaded)
 		pci_disable_device(dev->pdev);
@@ -594,7 +581,7 @@ int drm_ioctl(struct inode *inode, struct file *filp,
 		goto err_i1;
 	if ((nr >= DRM_COMMAND_BASE) && (nr < DRM_COMMAND_END)
 		&& (nr < DRM_COMMAND_BASE + dev->driver->num_ioctls))
-			ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
+		ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
 	else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE))
 		ioctl = &drm_ioctls[nr];
 	else
@@ -622,3 +609,17 @@ err_i1:
 	return retcode;
 }
 EXPORT_SYMBOL(drm_ioctl);
+
+drm_local_map_t *drm_getsarea(struct drm_device *dev)
+{
+	drm_map_list_t *entry;
+
+	list_for_each_entry(entry, &dev->maplist, head) {
+		if (entry->map && entry->map->type == _DRM_SHM &&
+		    (entry->map->flags & _DRM_CONTAINS_LOCK)) {
+			return entry->map;
+		}
+	}
+	return NULL;
+}
+EXPORT_SYMBOL(drm_getsarea);
diff --git a/linux-core/drm_fence.c b/linux-core/drm_fence.c
index 6dd04a35..ce161dc3 100644
--- a/linux-core/drm_fence.c
+++ b/linux-core/drm_fence.c
@@ -1,8 +1,8 @@
 /**************************************************************************
- * 
+ *
  * Copyright (c) 2006-2007 Tungsten Graphics, Inc., Cedar Park, TX., USA
  * All Rights Reserved.
- * 
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the
  * "Software"), to deal in the Software without restriction, including
@@ -10,17 +10,17 @@
  * distribute, sub license, and/or sell copies of the Software, and to
  * permit persons to whom the Software is furnished to do so, subject to
  * the following conditions:
- * 
+ *
  * The above copyright notice and this permission notice (including the
  * next paragraph) shall be included in all copies or substantial portions
  * of the Software.
- * 
+ *
  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
  * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
- * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR 
- * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE 
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
  * USE OR OTHER DEALINGS IN THE SOFTWARE.
  *
  **************************************************************************/
@@ -49,8 +49,6 @@ void drm_fence_handler(drm_device_t * dev, uint32_t class,
 	int is_exe = (type & DRM_FENCE_TYPE_EXE);
 	int ge_last_exe;
 
-
-	
 	diff = (sequence - fc->exe_flush_sequence) & driver->sequence_mask;
 
 	if (fc->pending_exe_flush && is_exe && diff < driver->wrap_diff)
@@ -59,13 +57,13 @@ void drm_fence_handler(drm_device_t * dev, uint32_t class,
 	diff = (sequence - fc->last_exe_flush) & driver->sequence_mask;
 	ge_last_exe = diff < driver->wrap_diff;
 
-	if (ge_last_exe) 
+	if (ge_last_exe)
 		fc->pending_flush &= ~type;
 
 	if (is_exe && ge_last_exe) {
 		fc->last_exe_flush = sequence;
 	}
-	
+
 	if (list_empty(&fc->ring))
 		return;
 
@@ -107,9 +105,8 @@ void drm_fence_handler(drm_device_t * dev, uint32_t class,
 				  fence->base.hash.key);
 			list_del_init(&fence->ring);
 		}
-
 	}
-	
+
 	if (wake) {
 		DRM_WAKEUP(&fc->fence_queue);
 	}
@@ -266,7 +263,7 @@ void drm_fence_flush_old(drm_device_t * dev, uint32_t class, uint32_t sequence)
 		fc->exe_flush_sequence = sequence - (driver->flush_diff / 2);
 	}
 	write_unlock_irqrestore(&fm->lock, flags);
-	
+
 	mutex_lock(&dev->struct_mutex);
 	read_lock_irqsave(&fm->lock, flags);
 
@@ -295,17 +292,21 @@ static int drm_fence_lazy_wait(drm_device_t *dev,
 {
 	drm_fence_manager_t *fm = &dev->fm;
 	drm_fence_class_manager_t *fc = &fm->class[fence->class];
-
+	int signaled;
 	unsigned long _end = jiffies + 3*DRM_HZ;
 	int ret = 0;
 
 	do {
 		DRM_WAIT_ON(ret, fc->fence_queue, 3 * DRM_HZ,
-			    fence_signaled(dev, fence, mask, 0));
+			    (signaled = fence_signaled(dev, fence, mask, 1)));
+		if (signaled)
+			return 0;
 		if (time_after_eq(jiffies, _end))
 			break;
 	} while (ret == -EINTR && ignore_signals);
-	if (time_after_eq(jiffies, _end) && (ret != 0))
+	if (fence_signaled(dev, fence, mask, 0))
+		return 0;
+	if (time_after_eq(jiffies, _end))
 		ret = -EBUSY;
 	if (ret) {
 		if (ret == -EBUSY) {
@@ -409,7 +410,7 @@ int drm_fence_object_emit(drm_device_t * dev, drm_fence_object_t * fence,
 	fence->signaled = 0x00;
 	fence->sequence = sequence;
 	fence->native_type = native_type;
-	if (list_empty(&fc->ring)) 
+	if (list_empty(&fc->ring))
 		fc->last_exe_flush = sequence - 1;
 	list_add_tail(&fence->ring, &fc->ring);
 	write_unlock_irqrestore(&fm->lock, flags);
@@ -494,8 +495,7 @@ void drm_fence_manager_init(drm_device_t * dev)
 	drm_fence_driver_t *fed = dev->driver->fence_driver;
 	int i;
 
-
-	fm->lock = RW_LOCK_UNLOCKED;
+	rwlock_init(&fm->lock);
 	write_lock(&fm->lock);
 	fm->initialized = 0;
 	if (!fed)
diff --git a/linux-core/drm_fops.c b/linux-core/drm_fops.c
index d400a4d5..e54d5079 100644
--- a/linux-core/drm_fops.c
+++ b/linux-core/drm_fops.c
@@ -79,13 +79,6 @@ static int drm_setup(drm_device_t * dev)
 	drm_ht_create(&dev->magiclist, DRM_MAGIC_HASH_ORDER);
 	INIT_LIST_HEAD(&dev->magicfree);
 
-	dev->ctxlist = drm_alloc(sizeof(*dev->ctxlist), DRM_MEM_CTXLIST);
-	if (dev->ctxlist == NULL)
-		return -ENOMEM;
-	memset(dev->ctxlist, 0, sizeof(*dev->ctxlist));
-	INIT_LIST_HEAD(&dev->ctxlist->head);
-
-	dev->vmalist = NULL;
 	dev->sigdata.lock = NULL;
 	init_waitqueue_head(&dev->lock.lock_queue);
 	dev->queue_count = 0;
@@ -268,6 +261,7 @@ static int drm_open_helper(struct inode *inode, struct file *filp,
 	priv->authenticated = capable(CAP_SYS_ADMIN);
 	priv->lock_count = 0;
 
+	INIT_LIST_HEAD(&priv->lhead);
 	INIT_LIST_HEAD(&priv->user_objects);
 	INIT_LIST_HEAD(&priv->refd_objects);
 
@@ -291,19 +285,10 @@ static int drm_open_helper(struct inode *inode, struct file *filp,
 	}
 
 	mutex_lock(&dev->struct_mutex);
-	if (!dev->file_last) {
-		priv->next = NULL;
-		priv->prev = NULL;
-		dev->file_first = priv;
-		dev->file_last = priv;
-		/* first opener automatically becomes master */
+	if (list_empty(&dev->filelist))
 		priv->master = 1;
-	} else {
-		priv->next = NULL;
-		priv->prev = dev->file_last;
-		dev->file_last->next = priv;
-		dev->file_last = priv;
-	}
+
+	list_add(&priv->lhead, &dev->filelist);
 	mutex_unlock(&dev->struct_mutex);
 
 #ifdef __alpha__
@@ -480,10 +465,10 @@ int drm_release(struct inode *inode, struct file *filp)
 
 	mutex_lock(&dev->ctxlist_mutex);
 
-	if (dev->ctxlist && (!list_empty(&dev->ctxlist->head))) {
+	if (!list_empty(&dev->ctxlist)) {
 		drm_ctx_list_t *pos, *n;
 
-		list_for_each_entry_safe(pos, n, &dev->ctxlist->head, head) {
+		list_for_each_entry_safe(pos, n, &dev->ctxlist, head) {
 			if (pos->tag == priv &&
 			    pos->handle != DRM_KERNEL_CONTEXT) {
 				if (dev->driver->context_dtor)
@@ -503,22 +488,12 @@ int drm_release(struct inode *inode, struct file *filp)
 	mutex_lock(&dev->struct_mutex);
 	drm_object_release(filp);
 	if (priv->remove_auth_on_close == 1) {
-		drm_file_t *temp = dev->file_first;
-		while (temp) {
+		drm_file_t *temp;
+
+		list_for_each_entry(temp, &dev->filelist, lhead)
 			temp->authenticated = 0;
-			temp = temp->next;
-		}
-	}
-	if (priv->prev) {
-		priv->prev->next = priv->next;
-	} else {
-		dev->file_first = priv->next;
-	}
-	if (priv->next) {
-		priv->next->prev = priv->prev;
-	} else {
-		dev->file_last = priv->prev;
 	}
+	list_del(&priv->lhead);
 	mutex_unlock(&dev->struct_mutex);
 
 	if (dev->driver->postclose)
diff --git a/linux-core/drm_ioctl.c b/linux-core/drm_ioctl.c
index f790a4b3..97df972f 100644
--- a/linux-core/drm_ioctl.c
+++ b/linux-core/drm_ioctl.c
@@ -199,7 +199,7 @@ int drm_getmap(struct inode *inode, struct file *filp,
 	}
 
 	i = 0;
-	list_for_each(list, &dev->maplist->head) {
+	list_for_each(list, &dev->maplist) {
 		if (i == idx) {
 			r_list = list_entry(list, drm_map_list_t, head);
 			break;
@@ -252,12 +252,18 @@ int drm_getclient(struct inode *inode, struct file *filp,
 		return -EFAULT;
 	idx = client.idx;
 	mutex_lock(&dev->struct_mutex);
-	for (i = 0, pt = dev->file_first; i < idx && pt; i++, pt = pt->next) ;
-
-	if (!pt) {
+	
+	if (list_empty(&dev->filelist)) {
 		mutex_unlock(&dev->struct_mutex);
 		return -EINVAL;
 	}
+
+	i = 0;
+	list_for_each_entry(pt, &dev->filelist, lhead) {
+		if (i++ >= idx)
+			break;
+	}
+
 	client.auth = pt->authenticated;
 	client.pid = pt->pid;
 	client.uid = pt->uid;
diff --git a/linux-core/drm_irq.c b/linux-core/drm_irq.c
index b0f6e3e1..88716712 100644
--- a/linux-core/drm_irq.c
+++ b/linux-core/drm_irq.c
@@ -119,8 +119,8 @@ static int drm_irq_install(drm_device_t * dev)
 
 		spin_lock_init(&dev->vbl_lock);
 
-		INIT_LIST_HEAD(&dev->vbl_sigs.head);
-		INIT_LIST_HEAD(&dev->vbl_sigs2.head);
+		INIT_LIST_HEAD(&dev->vbl_sigs);
+		INIT_LIST_HEAD(&dev->vbl_sigs2);
 
 		dev->vbl_pending = 0;
 	}
@@ -290,7 +290,7 @@ int drm_wait_vblank(DRM_IOCTL_ARGS)
 
 	if (flags & _DRM_VBLANK_SIGNAL) {
 		unsigned long irqflags;
-		drm_vbl_sig_t *vbl_sigs = (flags & _DRM_VBLANK_SECONDARY)
+		struct list_head *vbl_sigs = (flags & _DRM_VBLANK_SECONDARY)
 				      ? &dev->vbl_sigs2 : &dev->vbl_sigs;
 		drm_vbl_sig_t *vbl_sig;
 
@@ -300,7 +300,7 @@ int drm_wait_vblank(DRM_IOCTL_ARGS)
 		 * for the same vblank sequence number; nothing to be done in
 		 * that case
 		 */
-		list_for_each_entry(vbl_sig, &vbl_sigs->head, head) {
+		list_for_each_entry(vbl_sig, vbl_sigs, head) {
 			if (vbl_sig->sequence == vblwait.request.sequence
 			    && vbl_sig->info.si_signo == vblwait.request.signal
 			    && vbl_sig->task == current) {
@@ -334,7 +334,7 @@ int drm_wait_vblank(DRM_IOCTL_ARGS)
 
 		spin_lock_irqsave(&dev->vbl_lock, irqflags);
 
-		list_add_tail((struct list_head *)vbl_sig, &vbl_sigs->head);
+		list_add_tail(&vbl_sig->head, vbl_sigs);
 
 		spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
 
@@ -377,20 +377,18 @@ void drm_vbl_send_signals(drm_device_t * dev)
 	spin_lock_irqsave(&dev->vbl_lock, flags);
 
 	for (i = 0; i < 2; i++) {
-		struct list_head *list, *tmp;
-		drm_vbl_sig_t *vbl_sig;
-		drm_vbl_sig_t *vbl_sigs = i ? &dev->vbl_sigs2 : &dev->vbl_sigs;
+		drm_vbl_sig_t *vbl_sig, *tmp;
+		struct list_head *vbl_sigs = i ? &dev->vbl_sigs2 : &dev->vbl_sigs;
 		unsigned int vbl_seq = atomic_read(i ? &dev->vbl_received2 :
 						   &dev->vbl_received);
 
-		list_for_each_safe(list, tmp, &vbl_sigs->head) {
-			vbl_sig = list_entry(list, drm_vbl_sig_t, head);
+		list_for_each_entry_safe(vbl_sig, tmp, vbl_sigs, head) {
 			if ((vbl_seq - vbl_sig->sequence) <= (1 << 23)) {
 				vbl_sig->info.si_code = vbl_seq;
 				send_sig_info(vbl_sig->info.si_signo,
 					      &vbl_sig->info, vbl_sig->task);
 
-				list_del(list);
+				list_del(&vbl_sig->head);
 
 				drm_free(vbl_sig, sizeof(*vbl_sig),
 					 DRM_MEM_DRIVER);
diff --git a/linux-core/drm_memory.c b/linux-core/drm_memory.c
index 86c869f1..b1423c12 100644
--- a/linux-core/drm_memory.c
+++ b/linux-core/drm_memory.c
@@ -47,7 +47,7 @@ static struct {
 
 static inline size_t drm_size_align(size_t size) {
 
-	register size_t tmpSize = 4;
+	size_t tmpSize = 4;
 	if (size > PAGE_SIZE)
 		return PAGE_ALIGN(size);
 
@@ -228,7 +228,7 @@ static void *agp_remap(unsigned long offset, unsigned long size,
 	offset -= dev->hose->mem_space->start;
 #endif
 
-	for (agpmem = dev->agp->memory; agpmem; agpmem = agpmem->next)
+	list_for_each_entry(agpmem, &dev->agp->memory, head)
 		if (agpmem->bound <= offset
 		    && (agpmem->bound + (agpmem->pages << PAGE_SHIFT)) >=
 		    (offset + size))
diff --git a/linux-core/drm_object.c b/linux-core/drm_object.c
index 23412ed0..03906034 100644
--- a/linux-core/drm_object.c
+++ b/linux-core/drm_object.c
@@ -240,11 +240,17 @@ int drm_user_object_ref(drm_file_t * priv, uint32_t user_token,
 {
 	drm_device_t *dev = priv->head->dev;
 	drm_user_object_t *uo;
+	drm_hash_item_t *hash;
 	int ret;
 
 	mutex_lock(&dev->struct_mutex);
-	uo = drm_lookup_user_object(priv, user_token);
-	if (!uo || (uo->type != type)) {
+	ret = drm_ht_find_item(&dev->object_hash, user_token, &hash);
+	if (ret) {
+		DRM_ERROR("Could not find user object to reference.\n");
+		goto out_err;
+	}
+	uo = drm_hash_entry(hash, drm_user_object_t, hash);
+	if (uo->type != type) {
 		ret = -EINVAL;
 		goto out_err;
 	}
@@ -253,7 +259,6 @@ int drm_user_object_ref(drm_file_t * priv, uint32_t user_token,
 		goto out_err;
 	mutex_unlock(&dev->struct_mutex);
 	*object = uo;
-	DRM_ERROR("Referenced an object\n");
 	return 0;
       out_err:
 	mutex_unlock(&dev->struct_mutex);
@@ -281,7 +286,6 @@ int drm_user_object_unref(drm_file_t * priv, uint32_t user_token,
 	}
 	drm_remove_ref_object(priv, ro);
 	mutex_unlock(&dev->struct_mutex);
-	DRM_ERROR("Unreferenced an object\n");
 	return 0;
       out_err:
 	mutex_unlock(&dev->struct_mutex);
diff --git a/linux-core/drm_objects.h b/linux-core/drm_objects.h
index b3155af1..03ea927e 100644
--- a/linux-core/drm_objects.h
+++ b/linux-core/drm_objects.h
@@ -29,8 +29,7 @@
  */
 
 #ifndef _DRM_OBJECTS_H
-#define _DRM_OJBECTS_H
-#define DRM_HAS_TTM
+#define _DRM_OBJECTS_H
 
 struct drm_device;
 
@@ -234,10 +233,8 @@ extern int drm_fence_ioctl(DRM_IOCTL_ARGS);
 #define DRM_BE_FLAG_NEEDS_FREE     0x00000001
 #define DRM_BE_FLAG_BOUND_CACHED   0x00000002
 
-typedef struct drm_ttm_backend {
-	void *private;
-	uint32_t flags;
-	uint32_t drm_map_type;
+struct drm_ttm_backend;
+typedef struct drm_ttm_backend_func {
 	int (*needs_ub_cache_adjust) (struct drm_ttm_backend * backend);
 	int (*populate) (struct drm_ttm_backend * backend,
 			 unsigned long num_pages, struct page ** pages);
@@ -246,6 +243,13 @@ typedef struct drm_ttm_backend {
 		     unsigned long offset, int cached);
 	int (*unbind) (struct drm_ttm_backend * backend);
 	void (*destroy) (struct drm_ttm_backend * backend);
+} drm_ttm_backend_func_t;
+
+
+typedef struct drm_ttm_backend {
+	uint32_t flags;
+	int mem_type;
+	drm_ttm_backend_func_t *func;
 } drm_ttm_backend_t;
 
 typedef struct drm_ttm {
diff --git a/linux-core/drm_os_linux.h b/linux-core/drm_os_linux.h
index 816959e8..2ea105c5 100644
--- a/linux-core/drm_os_linux.h
+++ b/linux-core/drm_os_linux.h
@@ -119,24 +119,6 @@ static __inline__ int mtrr_del(int reg, unsigned long base, unsigned long size)
 
 #define DRM_GET_PRIV_WITH_RETURN(_priv, _filp) _priv = _filp->private_data
 
-/**
- * Get the pointer to the SAREA.
- *
- * Searches the SAREA on the mapping lists and points drm_device::sarea to it.
- */
-#define DRM_GETSAREA()							 \
-do { 									 \
-	drm_map_list_t *entry;						 \
-	list_for_each_entry( entry, &dev->maplist->head, head ) {	 \
-		if ( entry->map &&					 \
-		     entry->map->type == _DRM_SHM &&			 \
-		     (entry->map->flags & _DRM_CONTAINS_LOCK) ) {	 \
-			dev_priv->sarea = entry->map;			 \
- 			break;						 \
- 		}							 \
- 	}								 \
-} while (0)
-
 #define DRM_HZ HZ
 
 #define DRM_WAIT_ON( ret, queue, timeout, condition )		\
diff --git a/linux-core/drm_pci.c b/linux-core/drm_pci.c
index 40a65f3e..76252204 100644
--- a/linux-core/drm_pci.c
+++ b/linux-core/drm_pci.c
@@ -51,10 +51,8 @@ drm_dma_handle_t *drm_pci_alloc(drm_device_t * dev, size_t size, size_t align,
 				dma_addr_t maxaddr)
 {
 	drm_dma_handle_t *dmah;
-#if 1
 	unsigned long addr;
 	size_t sz;
-#endif
 #ifdef DRM_DEBUG_MEMORY
 	int area = DRM_MEM_DMA;
 
diff --git a/linux-core/drm_proc.c b/linux-core/drm_proc.c
index af62c62a..e93a0406 100644
--- a/linux-core/drm_proc.c
+++ b/linux-core/drm_proc.c
@@ -211,7 +211,6 @@ static int drm__vm_info(char *buf, char **start, off_t offset, int request,
 	int len = 0;
 	drm_map_t *map;
 	drm_map_list_t *r_list;
-	struct list_head *list;
 
 	/* Hardcoded from _DRM_FRAME_BUFFER,
 	   _DRM_REGISTERS, _DRM_SHM, _DRM_AGP,
@@ -231,9 +230,7 @@ static int drm__vm_info(char *buf, char **start, off_t offset, int request,
 	DRM_PROC_PRINT("slot	 offset	      size type flags	 "
 		       "address mtrr\n\n");
 	i = 0;
-	if (dev->maplist != NULL)
-		list_for_each(list, &dev->maplist->head) {
-		r_list = list_entry(list, drm_map_list_t, head);
+	list_for_each_entry(r_list, &dev->maplist, head) {
 		map = r_list->map;
 		if (!map)
 			continue;
@@ -242,10 +239,10 @@ static int drm__vm_info(char *buf, char **start, off_t offset, int request,
 		else
 			type = types[map->type];
 		DRM_PROC_PRINT("%4d 0x%08lx 0x%08lx %4.4s  0x%02x 0x%08lx ",
-			       i,
-			       map->offset,
-			       map->size, type, map->flags,
-			       (unsigned long) r_list->user_token);
+		       i,
+		       map->offset,
+		       map->size, type, map->flags,
+		       (unsigned long) r_list->user_token);
 
 		if (map->mtrr < 0) {
 			DRM_PROC_PRINT("none\n");
@@ -253,7 +250,7 @@ static int drm__vm_info(char *buf, char **start, off_t offset, int request,
 			DRM_PROC_PRINT("%4d\n", map->mtrr);
 		}
 		i++;
-		}
+	}
 
 	if (len > request + offset)
 		return request;
@@ -535,7 +532,7 @@ static int drm__clients_info(char *buf, char **start, off_t offset,
 	*eof = 0;
 
 	DRM_PROC_PRINT("a dev	pid    uid	magic	  ioctls\n\n");
-	for (priv = dev->file_first; priv; priv = priv->next) {
+	list_for_each_entry(priv, &dev->filelist, lhead) {
 		DRM_PROC_PRINT("%c %3d %5d %5d %10u %10lu\n",
 			       priv->authenticated ? 'y' : 'n',
 			       priv->minor,
@@ -588,7 +585,7 @@ static int drm__vma_info(char *buf, char **start, off_t offset, int request,
 	DRM_PROC_PRINT("vma use count: %d, high_memory = %p, 0x%08lx\n",
 		       atomic_read(&dev->vma_count),
 		       high_memory, virt_to_phys(high_memory));
-	for (pt = dev->vmalist; pt; pt = pt->next) {
+	list_for_each_entry(pt, &dev->vmalist, head) {
 		if (!(vma = pt->vma))
 			continue;
 		DRM_PROC_PRINT("\n%5d 0x%08lx-0x%08lx %c%c%c%c%c%c 0x%08lx000",
diff --git a/linux-core/drm_stub.c b/linux-core/drm_stub.c
index f4da7dac..7b0a0f97 100644
--- a/linux-core/drm_stub.c
+++ b/linux-core/drm_stub.c
@@ -60,6 +60,12 @@ static int drm_fill_in_dev(drm_device_t * dev, struct pci_dev *pdev,
 {
 	int retcode;
 
+	INIT_LIST_HEAD(&dev->drwlist);
+	INIT_LIST_HEAD(&dev->filelist);
+	INIT_LIST_HEAD(&dev->ctxlist);
+	INIT_LIST_HEAD(&dev->vmalist);
+	INIT_LIST_HEAD(&dev->maplist);
+
 	spin_lock_init(&dev->count_lock);
 	spin_lock_init(&dev->drw_lock);
 	spin_lock_init(&dev->tasklet_lock);
@@ -70,6 +76,8 @@ static int drm_fill_in_dev(drm_device_t * dev, struct pci_dev *pdev,
 	mutex_init(&dev->bm.init_mutex);
 	mutex_init(&dev->bm.evict_mutex);
 
+	idr_init(&dev->drw_idr);
+	
 	dev->pdev = pdev;
 	dev->pci_device = pdev->device;
 	dev->pci_vendor = pdev->vendor;
@@ -80,28 +88,20 @@ static int drm_fill_in_dev(drm_device_t * dev, struct pci_dev *pdev,
 	dev->irq = pdev->irq;
 
 	if (drm_ht_create(&dev->map_hash, DRM_MAP_HASH_ORDER)) {
-		drm_free(dev->maplist, sizeof(*dev->maplist), DRM_MEM_MAPS);
 		return -ENOMEM;
 	}
 	if (drm_mm_init(&dev->offset_manager, DRM_FILE_PAGE_OFFSET_START,
 			DRM_FILE_PAGE_OFFSET_SIZE)) {
-		drm_free(dev->maplist, sizeof(*dev->maplist), DRM_MEM_MAPS);
 		drm_ht_remove(&dev->map_hash);
 		return -ENOMEM;
 	}
 
 	if (drm_ht_create(&dev->object_hash, DRM_OBJECT_HASH_ORDER)) {
-                drm_free(dev->maplist, sizeof(*dev->maplist), DRM_MEM_MAPS);
 		drm_ht_remove(&dev->map_hash);
 		drm_mm_takedown(&dev->offset_manager);
 		return -ENOMEM;
 	}
 
-	dev->maplist = drm_calloc(1, sizeof(*dev->maplist), DRM_MEM_MAPS);
-	if (dev->maplist == NULL)
-		return -ENOMEM;
-	INIT_LIST_HEAD(&dev->maplist->head);
-
 	/* the DRM has 6 counters */
 	dev->counters = 6;
 	dev->types[0] = _DRM_STAT_LOCK;
diff --git a/linux-core/drm_ttm.c b/linux-core/drm_ttm.c
index 25566340..31503c9c 100644
--- a/linux-core/drm_ttm.c
+++ b/linux-core/drm_ttm.c
@@ -154,7 +154,7 @@ int drm_destroy_ttm(drm_ttm_t * ttm)
 
 	be = ttm->be;
 	if (be) {
-		be->destroy(be);
+		be->func->destroy(be);
 		ttm->be = NULL;
 	}
 
@@ -222,7 +222,7 @@ static int drm_ttm_populate(drm_ttm_t * ttm)
 		if (!page)
 			return -ENOMEM;
 	}
-	be->populate(be, ttm->num_pages, ttm->pages);
+	be->func->populate(be, ttm->num_pages, ttm->pages);
 	ttm->state = ttm_unbound;
 	return 0;
 }
@@ -281,7 +281,7 @@ void drm_ttm_evict(drm_ttm_t * ttm)
 	int ret;
 
 	if (ttm->state == ttm_bound) {
-		ret = be->unbind(be);
+		ret = be->func->unbind(be);
 		BUG_ON(ret);
 	}
 
@@ -293,7 +293,7 @@ void drm_ttm_fixup_caching(drm_ttm_t * ttm)
 
 	if (ttm->state == ttm_evicted) {
 		drm_ttm_backend_t *be = ttm->be;
-		if (be->needs_ub_cache_adjust(be)) {
+		if (be->func->needs_ub_cache_adjust(be)) {
 			drm_set_caching(ttm, 0);
 		}
 		ttm->state = ttm_unbound;
@@ -329,7 +329,7 @@ int drm_bind_ttm(drm_ttm_t * ttm, int cached, unsigned long aper_offset)
 		drm_set_caching(ttm, DRM_TTM_PAGE_UNCACHED);
 	}
 
-	if ((ret = be->bind(be, aper_offset, cached))) {
+	if ((ret = be->func->bind(be, aper_offset, cached))) {
 		ttm->state = ttm_evicted;
 		DRM_ERROR("Couldn't bind backend.\n");
 		return ret;
diff --git a/linux-core/drm_vm.c b/linux-core/drm_vm.c
index 54a0849f..f2c43508 100644
--- a/linux-core/drm_vm.c
+++ b/linux-core/drm_vm.c
@@ -122,7 +122,7 @@ static __inline__ struct page *drm_do_vm_nopage(struct vm_area_struct *vma,
 		/*
 		 * It's AGP memory - find the real physical page to map
 		 */
-		for (agpmem = dev->agp->memory; agpmem; agpmem = agpmem->next) {
+		list_for_each_entry(agpmem, &dev->agp->memory, head) {
 			if (agpmem->bound <= baddr &&
 			    agpmem->bound + agpmem->pages * PAGE_SIZE > baddr)
 				break;
@@ -205,10 +205,9 @@ static void drm_vm_shm_close(struct vm_area_struct *vma)
 {
 	drm_file_t *priv = vma->vm_file->private_data;
 	drm_device_t *dev = priv->head->dev;
-	drm_vma_entry_t *pt, *prev, *next;
+	drm_vma_entry_t *pt, *temp;
 	drm_map_t *map;
 	drm_map_list_t *r_list;
-	struct list_head *list;
 	int found_maps = 0;
 
 	DRM_DEBUG("0x%08lx,0x%08lx\n",
@@ -218,19 +217,12 @@ static void drm_vm_shm_close(struct vm_area_struct *vma)
 	map = vma->vm_private_data;
 
 	mutex_lock(&dev->struct_mutex);
-	for (pt = dev->vmalist, prev = NULL; pt; pt = next) {
-		next = pt->next;
+	list_for_each_entry_safe(pt, temp, &dev->vmalist, head) {
 		if (pt->vma->vm_private_data == map)
 			found_maps++;
 		if (pt->vma == vma) {
-			if (prev) {
-				prev->next = pt->next;
-			} else {
-				dev->vmalist = pt->next;
-			}
+			list_del(&pt->head);
 			drm_ctl_free(pt, sizeof(*pt), DRM_MEM_VMAS);
-		} else {
-			prev = pt;
 		}
 	}
 	/* We were the only map that was found */
@@ -239,9 +231,7 @@ static void drm_vm_shm_close(struct vm_area_struct *vma)
 		 * we delete this mappings information.
 		 */
 		found_maps = 0;
-		list = &dev->maplist->head;
-		list_for_each(list, &dev->maplist->head) {
-			r_list = list_entry(list, drm_map_list_t, head);
+		list_for_each_entry(r_list, &dev->maplist, head) {
 			if (r_list->map == map)
 				found_maps++;
 		}
@@ -439,9 +429,8 @@ static void drm_vm_open_locked(struct vm_area_struct *vma)
 	vma_entry = drm_ctl_alloc(sizeof(*vma_entry), DRM_MEM_VMAS);
 	if (vma_entry) {
 		vma_entry->vma = vma;
-		vma_entry->next = dev->vmalist;
 		vma_entry->pid = current->pid;
-		dev->vmalist = vma_entry;
+		list_add(&vma_entry->head, &dev->vmalist);
 	}
 }
 
@@ -467,20 +456,16 @@ static void drm_vm_close(struct vm_area_struct *vma)
 {
 	drm_file_t *priv = vma->vm_file->private_data;
 	drm_device_t *dev = priv->head->dev;
-	drm_vma_entry_t *pt, *prev;
+	drm_vma_entry_t *pt, *temp;
 
 	DRM_DEBUG("0x%08lx,0x%08lx\n",
 		  vma->vm_start, vma->vm_end - vma->vm_start);
 	atomic_dec(&dev->vma_count);
 
 	mutex_lock(&dev->struct_mutex);
-	for (pt = dev->vmalist, prev = NULL; pt; prev = pt, pt = pt->next) {
+	list_for_each_entry_safe(pt, temp, &dev->vmalist, head) {
 		if (pt->vma == vma) {
-			if (prev) {
-				prev->next = pt->next;
-			} else {
-				dev->vmalist = pt->next;
-			}
+			list_del(&pt->head);
 			drm_ctl_free(pt, sizeof(*pt), DRM_MEM_VMAS);
 			break;
 		}
@@ -516,8 +501,7 @@ static int drm_mmap_dma(struct file *filp, struct vm_area_struct *vma)
 		return -EINVAL;
 	}
 
-	if (!capable(CAP_SYS_ADMIN) &&
-	    (dma->flags & _DRM_DMA_USE_PCI_RO)) {
+	if (!capable(CAP_SYS_ADMIN) && (dma->flags & _DRM_DMA_USE_PCI_RO)) {
 		vma->vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
 #if defined(__i386__) || defined(__x86_64__)
 		pgprot_val(vma->vm_page_prot) &= ~_PAGE_RW;
@@ -739,7 +723,7 @@ static unsigned long drm_bo_vm_nopfn(struct vm_area_struct *vma,
 	unsigned long bus_base;
 	unsigned long bus_offset;
 	unsigned long bus_size;
-	int ret = NOPFN_REFAULT;
+	unsigned long ret = NOPFN_REFAULT;
 
 	if (address > vma->vm_end)
 		return NOPFN_SIGBUS;
@@ -796,7 +780,9 @@ static unsigned long drm_bo_vm_nopfn(struct vm_area_struct *vma,
 			goto out_unlock;
 		}
 		pfn = page_to_pfn(page);
-		vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+		vma->vm_page_prot = (bo->mem.flags & DRM_BO_FLAG_CACHED) ?
+			vm_get_page_prot(vma->vm_flags) :
+			drm_io_prot(_DRM_TTM, vma);
 	}
 
 	err = vm_insert_pfn(vma, address, pfn);
diff --git a/linux-core/i810_dma.c b/linux-core/i810_dma.c
index 3f2dad38..49379434 100644
--- a/linux-core/i810_dma.c
+++ b/linux-core/i810_dma.c
@@ -346,12 +346,10 @@ static int i810_dma_initialize(drm_device_t * dev,
 			       drm_i810_private_t * dev_priv,
 			       drm_i810_init_t * init)
 {
-	struct list_head *list;
-
+	drm_map_list_t *r_list;
 	memset(dev_priv, 0, sizeof(drm_i810_private_t));
 
-	list_for_each(list, &dev->maplist->head) {
-		drm_map_list_t *r_list = list_entry(list, drm_map_list_t, head);
+	list_for_each_entry(r_list, &dev->maplist, head) {
 		if (r_list->map &&
 		    r_list->map->type == _DRM_SHM &&
 		    r_list->map->flags & _DRM_CONTAINS_LOCK) {
diff --git a/linux-core/i915_buffer.c b/linux-core/i915_buffer.c
index 8797de89..8589f467 100644
--- a/linux-core/i915_buffer.c
+++ b/linux-core/i915_buffer.c
@@ -35,7 +35,7 @@
 
 drm_ttm_backend_t *i915_create_ttm_backend_entry(drm_device_t * dev)
 {
-	return drm_agp_init_ttm(dev, NULL);
+	return drm_agp_init_ttm(dev);
 }
 
 int i915_fence_types(drm_buffer_object_t *bo, uint32_t * class, uint32_t * type)
diff --git a/linux-core/radeon_drv.c b/linux-core/radeon_drv.c
index 6f63a7c4..d0995b5b 100644
--- a/linux-core/radeon_drv.c
+++ b/linux-core/radeon_drv.c
@@ -93,7 +93,7 @@ static struct drm_driver driver = {
 	.driver_features =
 	    DRIVER_USE_AGP | DRIVER_USE_MTRR | DRIVER_PCI_DMA | DRIVER_SG |
 	    DRIVER_HAVE_IRQ | DRIVER_HAVE_DMA | DRIVER_IRQ_SHARED |
-	    DRIVER_IRQ_VBL,
+	    DRIVER_IRQ_VBL | DRIVER_IRQ_VBL2,
 	.dev_priv_size = sizeof(drm_radeon_buf_priv_t),
 	.load = radeon_driver_load,
 	.firstopen = radeon_driver_firstopen,
@@ -103,6 +103,7 @@ static struct drm_driver driver = {
 	.lastclose = radeon_driver_lastclose,
 	.unload = radeon_driver_unload,
 	.vblank_wait = radeon_driver_vblank_wait,
+	.vblank_wait2 = radeon_driver_vblank_wait2,
 	.dri_library_name = dri_library_name,
 	.irq_preinstall = radeon_driver_irq_preinstall,
 	.irq_postinstall = radeon_driver_irq_postinstall,
diff --git a/linux-core/sis_mm.c b/linux-core/sis_mm.c
index 5efbada4..21c1f2d7 100644
--- a/linux-core/sis_mm.c
+++ b/linux-core/sis_mm.c
@@ -233,7 +233,7 @@ static drm_local_map_t *sis_reg_init(drm_device_t *dev)
 	drm_map_list_t *entry;
 	drm_local_map_t *map;
 
-	list_for_each_entry(entry, &dev->maplist->head, head) {
+	list_for_each_entry(entry, &dev->maplist, head) {
 		map = entry->map;
 		if (!map)
 			continue;
diff --git a/linux-core/via_buffer.c b/linux-core/via_buffer.c
index f156ee6d..ebc8c371 100644
--- a/linux-core/via_buffer.c
+++ b/linux-core/via_buffer.c
@@ -34,7 +34,7 @@
 
 drm_ttm_backend_t *via_create_ttm_backend_entry(drm_device_t * dev)
 {
-	return drm_agp_init_ttm(dev, NULL);
+	return drm_agp_init_ttm(dev);
 }
 
 int via_fence_types(drm_buffer_object_t *bo, uint32_t * class, uint32_t * type)