jacinto6: sgx-bin: bins and src update for ddk1.14

Updating SGX binaries and KM source update for DDK1.14 on k4.4

Change-Id: Ie51645aa42e31c620f2e50cdb1efd570a1ef7227
Signed-off-by: Gowtham Tammana <g-tammana@ti.com>

96 files changed, 4837 insertions, 1817 deletions

diff --git a/jacinto6/README.SGX b/jacinto6/README.SGX
index 5ec452a..639da2c 100644
--- a/jacinto6/README.SGX
+++ b/jacinto6/README.SGX
@@ -1,7 +1,7 @@
 /*
  * TECHNOLOGY AND SOFTWARE PUBLICLY AVAILABLE
  *
- * Copyright (c) 2011, Texas Instruments Incorporated.
+ * Copyright (c) 2016, Texas Instruments Incorporated.
  *
  * All rights reserved.
  *
@@ -14,11 +14,11 @@
 sgx.tgz a set of binaries built for SGX544.
 
 [DDK Version]
-    1.12/2917986
+    1.14/4001660
 [DDK commit ID]
-    ab0b57a tmp: Disable DVFS and SYNC for kernel 4.4
+    036d7d2 (HACK) SGX-UM: Copy pvrsrvctl as pvrsrvinit
 [Branch]
-    android/1.12/2917986_k4.4
+    android/1.14/4001660_k4.4_M
 [Kernel modules built against]
     Kernel Version: 4.4.y with CONFIG_MODVERSIONS=y
 [Build type]
@@ -35,7 +35,7 @@ Make sure kernel is built before building modules
 # export KERNELDIR=path_to_kernel
 # export PATH=<path to kernel toolchain>:$PATH
 
-To build for OMAP5 (SGX 544 multi core):
+To build for Jacinto6 (SGX 544 multi core):
 # make ARCH=arm KERNEL_CROSS_COMPILE=arm-eabi- CROSS_COMPILE=arm-eabi- TARGET_PRODUCT="jacinto6evm" BUILD=release
 
 Once the .ko is built, install it onto device (/system/lib/modules)
diff --git a/jacinto6/sgx.tgz b/jacinto6/sgx.tgz
index e25233e..5f9cd9f 100644
--- a/jacinto6/sgx.tgz
+++ b/jacinto6/sgx.tgz
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/buildvars.mk b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/buildvars.mk
index ce0608c..b93243b 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/buildvars.mk
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/buildvars.mk
@@ -76,7 +76,7 @@ COMMON_USER_FLAGS += -fno-strict-aliasing
 # We always enable debugging. Either the release binaries are stripped
 # and the symbols put in the symbolpackage, or we're building debug.
 #
-COMMON_USER_FLAGS += -g
+COMMON_USER_FLAGS += -g $(ANDROID_FPGA_FORCE_32BIT)
 
 # User C and User C++ warning flags
 #
@@ -167,6 +167,7 @@ TESTED_KBUILD_FLAGS := \
  $(call kernel-cc-option,-Wno-pointer-arith) \
  $(call kernel-cc-option,-Wno-aggregate-return) \
  $(call kernel-cc-option,-Wno-unused-but-set-variable) \
+ $(call kernel-cc-option,-Wno-old-style-declaration) \
  $(call kernel-cc-optional-warning,-Wbad-function-cast) \
  $(call kernel-cc-optional-warning,-Wcast-qual) \
  $(call kernel-cc-optional-warning,-Wcast-align) \
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/commands.mk b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/commands.mk
index 093bb1c..ab7a0e9 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/commands.mk
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/commands.mk
@@ -88,7 +88,7 @@ endef
 define target-executable-from-o
 $(if $(V),,@echo "  LD      " $(call relative-to-top,$@))
 $(CC) \
-        $(SYS_EXE_LDFLAGS) $(MODULE_LDFLAGS) -o $@ \
+        $(SYS_EXE_LDFLAGS) $(SYS_COMMON_LDFLAGS) $(MODULE_LDFLAGS) -o $@ \
         $(SYS_EXE_CRTBEGIN) $(sort $(MODULE_ALL_OBJECTS)) $(SYS_EXE_CRTEND) \
         $(MODULE_LIBRARY_DIR_FLAGS) $(MODULE_LIBRARY_FLAGS) $(LIBGCC)
 endef
@@ -96,7 +96,7 @@ endef
 define target-executable-cxx-from-o
 $(if $(V),,@echo "  LD      " $(call relative-to-top,$@))
 $(CXX) \
-        $(SYS_EXE_LDFLAGS_CXX) $(SYS_EXE_LDFLAGS) $(MODULE_LDFLAGS) -o $@ \
+        $(SYS_EXE_LDFLAGS_CXX) $(SYS_EXE_LDFLAGS) $(SYS_COMMON_LDFLAGS) $(MODULE_LDFLAGS) -o $@ \
         $(SYS_EXE_CRTBEGIN) $(sort $(MODULE_ALL_OBJECTS)) $(SYS_EXE_CRTEND) \
         $(MODULE_LIBRARY_DIR_FLAGS) $(MODULE_LIBRARY_FLAGS) $(LIBGCC)
 endef
@@ -104,7 +104,7 @@ endef
 define target-shared-library-from-o
 $(if $(V),,@echo "  LD      " $(call relative-to-top,$@))
 $(CC) -shared -Wl,-Bsymbolic \
-        $(SYS_LIB_LDFLAGS) $(MODULE_LDFLAGS) -o $@ \
+        $(SYS_LIB_LDFLAGS) $(SYS_COMMON_LDFLAGS) $(MODULE_LDFLAGS) -o $@ \
         $(SYS_LIB_CRTBEGIN) $(sort $(MODULE_ALL_OBJECTS)) $(SYS_LIB_CRTEND) \
         $(MODULE_LIBRARY_DIR_FLAGS) $(MODULE_LIBRARY_FLAGS) $(LIBGCC)
 endef
@@ -114,7 +114,7 @@ endef
 define target-shared-library-cxx-from-o
 $(if $(V),,@echo "  LD      " $(call relative-to-top,$@))
 $(CXX) -shared -Wl,-Bsymbolic \
-        $(SYS_LIB_LDFLAGS_CXX) $(SYS_LIB_LDFLAGS) $(MODULE_LDFLAGS) -o $@ \
+        $(SYS_LIB_LDFLAGS_CXX) $(SYS_LIB_LDFLAGS) $(SYS_COMMON_LDFLAGS) $(MODULE_LDFLAGS) -o $@ \
         $(SYS_LIB_CRTBEGIN) $(sort $(MODULE_ALL_OBJECTS)) $(SYS_LIB_CRTEND) \
         $(MODULE_LIBRARY_DIR_FLAGS) $(MODULE_LIBRARY_FLAGS) $(LIBGCC)
 endef
@@ -183,7 +183,11 @@ define make-directory
 $(MKDIR) -p $@
 endef
 
+define check-exports-from-file
+endef
+
 define check-exports
+$(call check-exports-from-file,$(if $1,$1,$(notdir $@).txt))
 endef
 
 # Programs used in recipes
@@ -197,6 +201,7 @@ JAR ?= jar
 JAVA ?= java
 JAVAC ?= javac
 ZIP ?= zip
+PKG_CONFIG ?= pkg-config
 
 ifeq ($(USE_CCACHE),1)
 CCACHE ?= ccache
@@ -228,10 +233,10 @@ override CC  := $(if $(V),,@)$(CCACHE) $(CC)
 override CXX := $(if $(V),,@)$(CCACHE) $(CXX)
 endif
 
-override AR                             := $(if $(V),,@)$(CROSS_COMPILE)ar
+override AR                     := $(if $(V),,@)$(CROSS_COMPILE)ar
 override BISON                  := $(if $(V),,@)$(BISON)
 override BZIP2                  := $(if $(V),,@)bzip2 -9
-override CP                             := $(if $(V),,@)cp
+override CP                     := $(if $(V),,@)cp
 override ECHO                   := $(if $(V),,@)echo
 override FLEX                   := $(if $(V),,@)flex
 override GAWK                   := $(if $(V),,@)gawk
@@ -244,13 +249,14 @@ override INSTALL		:= $(if $(V),,@)install
 override JAR                    := $(if $(V),,@)$(JAR)
 override JAVA                   := $(if $(V),,@)$(JAVA)
 override JAVAC                  := $(if $(V),,@)$(JAVAC)
-override M4                             := $(if $(V),,@)m4
+override LN                     := $(if $(V),,@)ln -f
+override M4                     := $(if $(V),,@)m4
 override MKDIR                  := $(if $(V),,@)mkdir
-override MV                             := $(if $(V),,@)mv
+override MV                     := $(if $(V),,@)mv
 override OBJCOPY                := $(if $(V),,@)$(CROSS_COMPILE)objcopy
 override PDSASM                 := $(if $(V),,@)$(HOST_OUT)/pdsasm
 override RANLIB                 := $(if $(V),,@)$(CROSS_COMPILE)ranlib
-override RM                             := $(if $(V),,@)rm -f
+override RM                     := $(if $(V),,@)rm -f
 override SED                    := $(if $(V),,@)sed
 override STRIP                  := $(if $(V),,@)$(CROSS_COMPILE)strip
 override TAR                    := $(if $(V),,@)tar
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/arch_common.mk b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/arch_common.mk
index d658679..bf3fe11 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/arch_common.mk
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/arch_common.mk
@@ -56,23 +56,40 @@ SYS_CFLAGS := \
 SYS_INCLUDES := \
  -isystem $(ANDROID_ROOT)/bionic/libc/arch-$(ANDROID_ARCH)/include \
  -isystem $(ANDROID_ROOT)/bionic/libc/include \
- -isystem $(ANDROID_ROOT)/bionic/libc/kernel/common \
- -isystem $(ANDROID_ROOT)/bionic/libc/kernel/arch-$(ANDROID_ARCH) \
+ -isystem $(ANDROID_ROOT)/bionic/libc/kernel/uapi \
+ -isystem $(ANDROID_ROOT)/bionic/libc/kernel/uapi/asm-$(ANDROID_ARCH) \
  -isystem $(ANDROID_ROOT)/bionic/libm/include \
  -isystem $(ANDROID_ROOT)/bionic/libm/include/$(ANDROID_ARCH) \
  -isystem $(ANDROID_ROOT)/bionic/libthread_db/include \
+ -isystem $(ANDROID_ROOT)/external/libunwind/include \
  -isystem $(ANDROID_ROOT)/frameworks/base/include \
- -isystem $(ANDROID_ROOT)/system/core/include \
  -isystem $(ANDROID_ROOT)/hardware/libhardware/include \
- -isystem $(ANDROID_ROOT)/external/openssl/include \
+ -isystem $(ANDROID_ROOT)/hardware/libhardware_legacy/include \
+ -isystem $(ANDROID_ROOT)/system/core/include \
+ -isystem $(ANDROID_ROOT)/system/core/libsync/include \
  -isystem $(ANDROID_ROOT)/system/media/camera/include \
- -isystem $(ANDROID_ROOT)/hardware/libhardware_legacy/include
+ -isystem $(ANDROID_ROOT)/external/libdrm \
+ -isystem $(ANDROID_ROOT)/external/libdrm/include/drm
+
+ifneq ($(wildcard $(ANDROID_ROOT)/external/boringssl/src/include),)
+SYS_INCLUDES += \
+ -isystem $(ANDROID_ROOT)/external/boringssl/src/include
+else
+SYS_INCLUDES += \
+ -isystem $(ANDROID_ROOT)/external/openssl/include
+endif
+
+# Obsolete libc includes
+SYS_INCLUDES += \
+ -isystem $(ANDROID_ROOT)/bionic/libc/kernel/common \
+ -isystem $(ANDROID_ROOT)/bionic/libc/kernel/arch-$(ANDROID_ARCH)
 
 # This is comparing PVR_BUILD_DIR to see if it is omap and adding 
 # includes required for it's HWC
 ifeq ($(notdir $(abspath .)),omap_android)
 SYS_INCLUDES += \
- -isystem $(ANDROID_ROOT)/hardware/ti/omap4xxx/kernel-headers
+ -isystem $(ANDROID_ROOT)/hardware/ti/omap4xxx/kernel-headers \
+ -isystem $(ANDROID_ROOT)/hardware/ti/omap4xxx/ion
 endif
 
 ifeq ($(_CLANG),true)
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/extra_config.mk b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/extra_config.mk
index bb47c8d..b8b97e2 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/extra_config.mk
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/extra_config.mk
@@ -39,8 +39,14 @@
 ### ###########################################################################
 
 
-$(eval $(call BothConfigC,ANDROID,))
+# On versions of Android prior to L, remap the use of libc++ to a combination
+# of stlport and libstdc++. Not every module written in C++ in the DDK needs
+# the STL, but linking it should be harmless (and most modules do need it).
+ifneq ($(is_at_least_lollipop),1)
+endif
+
 
+$(eval $(call BothConfigC,ANDROID,))
 
 
 
@@ -51,4 +57,15 @@ $(eval $(call TunableBothConfigMake,SUPPORT_PVRSRV_ANDROID_SYSTRACE,))
 $(eval $(call TunableBothConfigMake,PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC,))
 $(eval $(call TunableBothConfigC,PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC,))
 
+ifeq ($(NO_HARDWARE),1)
+ override PVR_ANDROID_COMPOSERHAL := null
+endif
+
+ifneq ($(PVR_ANDROID_COMPOSERHAL),drm)
+ ifneq ($(SUPPORT_PVRSRV_DEVICE_CLASS),1)
+  override PVR_ANDROID_COMPOSERHAL := null
+ endif
+endif
+
+
 include ../common/ion.mk
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/features.mk b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/features.mk
index 7697f13..68e8132 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/features.mk
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/features.mk
@@ -44,6 +44,7 @@ include ../common/android/platform_version.mk
 #
 SUPPORT_ANDROID_PLATFORM := 1
 SUPPORT_OPENGLES1_V1_ONLY := 1
+DONT_USE_SONAMES := 1
 
 # Meminfo IDs are required for buffer stamps
 #
@@ -51,8 +52,8 @@ SUPPORT_MEMINFO_IDS := 1
 
 # Enable services ion support by default
 #
-SUPPORT_ION := 0
-SUPPORT_DRM_GEM := 1
+SUPPORT_ION ?= 0
+SUPPORT_DMABUF := 1
 
 # Need multi-process support in PDUMP
 #
@@ -101,6 +102,14 @@ SUPPORT_LARGE_GENERAL_HEAP := 1
 #
 PVR_LINUX_MEM_AREA_POOL_MAX_PAGES ?= 5400
 
+# Unless overridden by the user, assume the RenderScript Compute API level
+# matches that of the SDK API_LEVEL.
+#
+RSC_API_LEVEL ?= $(API_LEVEL)
+ifneq ($(findstring $(RSC_API_LEVEL),21 22),)
+RSC_API_LEVEL := 20
+endif
+
 ##############################################################################
 # Framebuffer target extension is used to find configs compatible with
 # the framebuffer (added in JB MR1).
@@ -112,18 +121,10 @@ EGL_EXTENSION_ANDROID_FRAMEBUFFER_TARGET := 1
 #
 UNITTEST_INCLUDES := \
  eurasiacon/android \
- $(ANDROID_ROOT)/frameworks/base/native/include
-
-ifeq ($(is_at_least_jellybean),1)
-UNITTEST_INCLUDES += \
+ $(ANDROID_ROOT)/frameworks/base/native/include \
  $(ANDROID_ROOT)/frameworks/native/include \
  $(ANDROID_ROOT)/frameworks/native/opengl/include \
  $(ANDROID_ROOT)/libnativehelper/include/nativehelper
-else
-UNITTEST_INCLUDES += \
- $(ANDROID_ROOT)/frameworks/base/opengl/include \
- $(ANDROID_ROOT)/dalvik/libnativehelper/include/nativehelper
-endif
 
 # But it doesn't have OpenVG headers
 #
@@ -140,12 +141,21 @@ DEMO_DESTDIR := /system/vendor/bin
 EGL_DESTDIR := $(SHLIB_DESTDIR)/egl
 
 ##############################################################################
-# We can support OpenCL in the build since Froyo (stlport was added in 2.2)
+# In K and older, augment the libstdc++ includes with stlport includes. Any
+# part of the C++ library not implemented by stlport will be handled by
+# linking in libstdc++ too (see extra_config.mk).
+#
+# On L and newer, don't use stlport OR libstdc++ at all; just use libc++.
 #
 SYS_CXXFLAGS := -fuse-cxa-atexit $(SYS_CFLAGS)
+ifeq ($(is_at_least_lollipop),1)
+SYS_INCLUDES += \
+ -isystem $(ANDROID_ROOT)/external/libcxx/include
+else
 SYS_INCLUDES += \
  -isystem $(ANDROID_ROOT)/bionic \
  -isystem $(ANDROID_ROOT)/external/stlport/stlport
+endif
 
 ##############################################################################
 # Support the OES_EGL_image_external extensions in the client drivers.
@@ -167,122 +177,79 @@ EGL_EXTENSION_ANDROID_RECORDABLE := 1
 EGL_EXTENSION_ANDROID_BLOB_CACHE := 1
 
 ##############################################################################
-# ICS and earlier should rate-limit composition by waiting for 3D renders
-# to complete in the compositor's eglSwapBuffers().
-#
-ifeq ($(is_at_least_jellybean),0)
-PVR_ANDROID_COMPOSITOR_WAIT_FOR_RENDER := 1
-endif
-
-##############################################################################
 # JB added a new corkscrew API for userland backtracing.
 #
-ifeq ($(is_at_least_jellybean),1)
+ifeq ($(is_at_least_lollipop),0)
 PVR_ANDROID_HAS_CORKSCREW_API := 1
 endif
 
 ##############################################################################
-# JB MR1 makes the framebuffer HAL obsolete.
-#
-# We also need to support IMPLEMENTATION_DEFINED so gralloc allocates
-# framebuffers and GPU buffers in a 'preferred' format.
-#
-ifeq ($(is_at_least_jellybean_mr1),0)
-SUPPORT_ANDROID_FRAMEBUFFER_HAL := 1
-else
-PVR_ANDROID_HAS_HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED := 1
-endif
-
-##############################################################################
 # JB MR1 introduces cross-process syncs associated with a fd.
 # This requires a new enough kernel version to have the base/sync driver.
 #
-ifeq ($(is_at_least_jellybean_mr1),1)
-EGL_EXTENSION_ANDROID_NATIVE_FENCE_SYNC := 0
-PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC := 0
-endif
+EGL_EXTENSION_ANDROID_NATIVE_FENCE_SYNC ?= 1
+PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC ?= 1
 
 ##############################################################################
-# JB MR1 introduces new usage bits for the camera HAL and some new formats.
+# Versions of Android between Cupcake and KitKat MR1 required Java 6.
 #
-ifeq ($(is_at_least_jellybean_mr1),1)
-PVR_ANDROID_HAS_GRALLOC_USAGE_HW_CAMERA := 1
-PVR_ANDROID_HAS_HAL_PIXEL_FORMAT_RAW_SENSOR := 1
-PVR_ANDROID_HAS_HAL_PIXEL_FORMAT_BLOB := 1
+ifeq ($(is_at_least_lollipop),0)
+LEGACY_USE_JAVA6 ?= 1
 endif
 
 ##############################################################################
-# JB MR2 adds a new graphics HAL (gralloc) API function, lock_ycbcr(), and
-# a so-called "flexible" YUV format enum.
+# Versions of Android between ICS and KitKat MR1 used ion .heap_mask instead
+# of .heap_id_mask.
 #
-ifeq ($(is_at_least_jellybean_mr2),1)
-PVR_ANDROID_HAS_HAL_PIXEL_FORMAT_YCbCr_420_888 := 1
-PVR_ANDROID_GRALLOC_HAS_0_2_FEATURES := 1
+ifeq ($(is_at_least_lollipop),0)
+PVR_ANDROID_HAS_ION_FIELD_HEAP_MASK := 1
 endif
 
 ##############################################################################
-# In JB MR2 we can use a native helper library for the unittest wrapper.
-# In earlier versions, we must use a less ideal approach.
-#
-ifeq ($(is_at_least_jellybean_mr2),0)
-PVR_ANDROID_SURFACE_FIELD_NAME := \"mNativeSurface\"
-endif
-
-##############################################################################
-# JB MR2 introduces two new camera HAL formats (Y8, Y16)
-#
-ifeq ($(is_at_least_jellybean_mr2),1)
-PVR_ANDROID_HAS_HAL_PIXEL_FORMAT_Y8 := 1
-PVR_ANDROID_HAS_HAL_PIXEL_FORMAT_Y16 := 1
-endif
-
-##############################################################################
-# KK's EGL wrapper remaps EGLConfigs in the BGRA and BGRX formats to RGBA and
-# RGBX respectively, for CpuConsumer compatibility. It does this because the
-# usage bits for the gralloc allocation are not available to EGL.
-#
-# In this newer platform version, gralloc has been redefined to allow the
-# 'format' parameter to gralloc->alloc() to be ignored for non-USAGE_SW
-# allocations, so long as the bits per channel and sRGB-ness are preserved.
+# Lollipop supports 64-bit. Configure BCC to emit both 32-bit and 64-bit LLVM
+# bitcode in the renderscript driver.
 #
-ifeq ($(is_at_least_kitkat),1)
-PVR_ANDROID_REMAP_HW_ONLY_PIXEL_FORMATS := 1
+ifeq ($(is_at_least_lollipop),1)
+PVR_ANDROID_BCC_MULTIARCH_SUPPORT := 1
 endif
 
 ##############################################################################
-# Support newer HWC features in KK
+# Lollipop annotates the cursor allocation with USAGE_CURSOR to enable it to
+# be accelerated with special cursor hardware (rather than wasting an
+# overlay). This flag stops the DDK from blocking the allocation.
 #
-ifeq ($(is_at_least_kitkat),1)
-PVR_ANDROID_HWC_HAS_1_3_FEATURES := 1
+ifeq ($(is_at_least_lollipop),1)
+PVR_ANDROID_HAS_GRALLOC_USAGE_CURSOR := 1
 endif
 
 ##############################################################################
-# KK eliminated egl.cfg. Only create for older versions.
+# Lollipop changed the camera HAL metadata specification to require that
+# CONTROL_MAX_REGIONS specifies 3 integers (instead of 1).
 #
-ifeq ($(is_at_least_kitkat),0)
-PVR_ANDROID_HAS_EGL_CFG := 1
+ifeq ($(is_at_least_lollipop),1)
+PVR_ANDROID_CAMERA_CONTROL_MAX_REGIONS_HAS_THREE := 1
 endif
 
 ##############################################################################
-# KK has a bug in its browser that we need to work around.
+# Marshmallow needs --soname turned on
 #
-ifeq ($(is_at_least_kitkat),1)
-PVR_ANDROID_RELAX_GRALLOC_MODULE_MAP_CHECKS := 1
+ifeq ($(is_at_least_marshmallow),1)
+PVR_ANDROID_NEEDS_SONAME ?= 1
 endif
 
 ##############################################################################
-# KK's Camera HAL requires that ACTIVE_ARRAY_SIZE specify xmin/ymin first
+# Marshmallow replaces RAW_SENSOR with RAW10, RAW12 and RAW16
 #
-ifeq ($(is_at_least_kitkat),1)
-PVR_ANDROID_CAMERA_ACTIVE_ARRAY_SIZE_HAS_XMIN_YMIN := 1
+ifeq ($(is_at_least_marshmallow),1)
+PVR_ANDROID_HAS_HAL_PIXEL_FORMAT_RAWxx := 1
 endif
 
 ##############################################################################
-# KitKat added a new memory tracking HAL. This enables gralloc support for
-# the GRAPHICS/GL memtrack types.
+# Marshmallow onwards DDK stopped render script accleration using GPU.
+# This flag stops device alloction.
 #
-ifeq ($(is_at_least_kitkat),1)
-SUPPORT_ANDROID_MEMTRACK_HAL := 1
+ifeq ($(is_at_least_marshmallow),1)
+PVR_ANDROID_HAS_GRALLOC_USAGE_RENDERSCRIPT := 1
 endif
 
 # Placeholder for future version handling
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/paths.mk b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/paths.mk
index 9717ca9..4309c72 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/paths.mk
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/paths.mk
@@ -54,4 +54,4 @@ endif
 TOOLCHAIN ?= $(TARGET_ROOT)/product/$(TARGET_DEVICE)/obj
 TOOLCHAIN2 ?= $(TARGET_ROOT)/product/$(TARGET_DEVICE)/system
 
-LIBGCC := $(shell $(CROSS_COMPILE)gcc -print-libgcc-file-name)
+LIBGCC := $(shell $(CROSS_COMPILE)gcc -m32 -print-libgcc-file-name 2>/dev/null)
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/platform_version.mk b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/platform_version.mk
index bf43dda..f2a5600 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/platform_version.mk
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/android/platform_version.mk
@@ -38,95 +38,117 @@
 # CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ### ###########################################################################
 
-# Figure out the version of Android we're building against.
+# If there's no build.prop file in the expected location, bail out. Tell the
+# user which file we were trying to read in case TARGET_DEVICE was not set.
 #
-PLATFORM_VERSION := $(shell \
-        if [ -f $(TARGET_ROOT)/product/$(TARGET_DEVICE)/system/build.prop ]; then \
-                cat $(TARGET_ROOT)/product/$(TARGET_DEVICE)/system/build.prop | \
-                        grep ^ro.build.version.release | cut -f2 -d'=' | cut -f1 -d'-'; \
-        else \
-                echo 5.0; \
-        fi)
+BUILD_PROP := $(TARGET_ROOT)/product/$(TARGET_DEVICE)/system/build.prop
+ifeq ($(wildcard $(BUILD_PROP)),)
+$(warning *** Could not determine Android version.  Did you set ANDROID_ROOT,\
+OUT_DIR and TARGET_DEVICE in your environment correctly?)
+$(error Error reading $(BUILD_PROP))
+endif
+
+# Extract version.release and version.codename from the build.prop file.
+# If either of the values aren't in the build.prop, the Make variables won't
+# be defined, and fallback handling will take place.
+#
+define newline
+
+
+endef
+$(eval $(subst #,$(newline),$(shell cat $(BUILD_PROP) | \
+        grep '^ro.build.version.release=\|^ro.build.version.codename=' | \
+        sed -e 's,ro.build.version.release=,PLATFORM_RELEASE=,' \
+            -e 's,ro.build.version.codename=,PLATFORM_CODENAME=,' | tr '\n' '#')))
 
-define version-starts-with
-$(shell echo $(PLATFORM_VERSION) | grep -q ^$(1); \
+define release-starts-with
+$(shell echo $(PLATFORM_RELEASE) | grep -q ^$(1); \
         [ "$$?" = "0" ] && echo 1 || echo 0)
 endef
 
 # ro.build.version.release contains the version number for release builds, or
 # the version codename otherwise. In this case we need to assume that the
 # version of Android we're building against has the features that are in the
-# final release of that version, so we set PLATFORM_VERSION to the
+# final release of that version, so we set PLATFORM_RELEASE to the
 # corresponding release number.
 #
 # NOTE: It's the _string_ ordering that matters here, not the version number
 # ordering. You need to make sure that strings that are sub-strings of other
 # checked strings appear _later_ in this list.
 #
-# e.g. 'JellyBeanMR' starts with 'JellyBean', but it is not JellyBean.
+# e.g. 'KitKatMR' starts with 'KitKat', but it is not KitKat.
+#
+# NOTE: The version codenames for Android stopped after KitKat, don't read
+# too much into the below names. They are mostly placeholders/reminders.
+#
+ifeq ($(call release-starts-with,KitKatMR),1)
+PLATFORM_RELEASE := 4.4.1
+else ifeq ($(call release-starts-with,KitKat),1)
+PLATFORM_RELEASE := 4.4
+else ifeq ($(call release-starts-with,LollipopMR1),1)
+PLATFORM_RELEASE := 5.1
+else ifeq ($(call release-starts-with,Lollipop),1)
+PLATFORM_RELEASE := 5.0
+else ifeq ($(call release-starts-with,Marshmallow),1)
+PLATFORM_RELEASE := 6.0
+else ifeq ($(PLATFORM_CODENAME),AOSP)
+# AOSP (master) will normally have PLATFORM_CODENAME set to AOSP
+PLATFORM_RELEASE := 6.0.60
+else ifeq ($(shell echo $(PLATFORM_RELEASE) | grep -qE "[A-Za-z]+"; echo $$?),0)
+PLATFORM_RELEASE := 6.1
+endif
+
+# Workaround for master. Sometimes there is an AOSP version ahead of
+# the current master version number, but master still has more features.
 #
-ifeq ($(call version-starts-with,JellyBeanMR1),1)
-PLATFORM_VERSION := 4.2
-else ifeq ($(call version-starts-with,JellyBeanMR),1)
-PLATFORM_VERSION := 4.3
-else ifeq ($(call version-starts-with,JellyBean),1)
-PLATFORM_VERSION := 4.1
-else ifeq ($(call version-starts-with,KeyLimePie),1)
-PLATFORM_VERSION := 4.4
-else ifeq ($(call version-starts-with,KitKat),1)
-PLATFORM_VERSION := 4.4
-else ifeq ($(shell echo $(PLATFORM_VERSION) | grep -qE "[A-Za-z]+"; echo $$?),0)
-PLATFORM_VERSION := 5.0
+ifeq ($(PLATFORM_RELEASE),6.0.60)
+PLATFORM_RELEASE := 6.1
+is_aosp_master := 1
 endif
 
-PLATFORM_VERSION_MAJ   := $(shell echo $(PLATFORM_VERSION) | cut -f1 -d'.')
-PLATFORM_VERSION_MIN   := $(shell echo $(PLATFORM_VERSION) | cut -f2 -d'.')
-PLATFORM_VERSION_PATCH := $(shell echo $(PLATFORM_VERSION) | cut -f3 -d'.')
+PLATFORM_RELEASE_MAJ   := $(shell echo $(PLATFORM_RELEASE) | cut -f1 -d'.')
+PLATFORM_RELEASE_MIN   := $(shell echo $(PLATFORM_RELEASE) | cut -f2 -d'.')
+PLATFORM_RELEASE_PATCH := $(shell echo $(PLATFORM_RELEASE) | cut -f3 -d'.')
 
 # Not all versions have a patchlevel; fix that up here
 #
-ifeq ($(PLATFORM_VERSION_PATCH),)
-PLATFORM_VERSION_PATCH := 0
+ifeq ($(PLATFORM_RELEASE_PATCH),)
+PLATFORM_RELEASE_PATCH := 0
 endif
 
 # Macros to help categorize support for features and API_LEVEL for tests.
 #
-is_at_least_jellybean := \
-        $(shell ( test $(PLATFORM_VERSION_MAJ) -gt 4 || \
-                                ( test $(PLATFORM_VERSION_MAJ) -eq 4 && \
-                                  test $(PLATFORM_VERSION_MIN) -ge 1 ) ) && echo 1 || echo 0)
-is_at_least_jellybean_mr1 := \
-        $(shell ( test $(PLATFORM_VERSION_MAJ) -gt 4 || \
-                                ( test $(PLATFORM_VERSION_MAJ) -eq 4 && \
-                                  test $(PLATFORM_VERSION_MIN) -ge 2 ) ) && echo 1 || echo 0)
-is_at_least_jellybean_mr2 := \
-        $(shell ( test $(PLATFORM_VERSION_MAJ) -gt 4 || \
-                                ( test $(PLATFORM_VERSION_MAJ) -eq 4 && \
-                                  test $(PLATFORM_VERSION_MIN) -ge 3 ) ) && echo 1 || echo 0)
-is_at_least_kitkat := \
-        $(shell ( test $(PLATFORM_VERSION_MAJ) -gt 4 || \
-                                ( test $(PLATFORM_VERSION_MAJ) -eq 4 && \
-                                  test $(PLATFORM_VERSION_MIN) -ge 4 ) ) && echo 1 || echo 0)
+is_at_least_lollipop := \
+        $(shell ( test $(PLATFORM_RELEASE_MAJ) -ge 5 ) && echo 1 || echo 0)
+is_at_least_lollipop_mr1 := \
+        $(shell ( test $(PLATFORM_RELEASE_MAJ) -gt 5 || \
+                                ( test $(PLATFORM_RELEASE_MAJ) -eq 5 && \
+                                  test $(PLATFORM_RELEASE_MIN) -gt 0 ) ) && echo 1 || echo 0)
+is_at_least_marshmallow := \
+        $(shell ( test $(PLATFORM_RELEASE_MAJ) -ge 6 ) && echo 1 || echo 0)
 
-# FIXME: Assume "future versions" are >=5.0, but we don't really know
+# Assume "future versions" are >6.0, but we don't really know
 is_future_version := \
-        $(shell ( test $(PLATFORM_VERSION_MAJ) -ge 5 ) && echo 1 || echo 0)
+        $(shell ( test $(PLATFORM_RELEASE_MAJ) -gt 6 || \
+                                ( test $(PLATFORM_RELEASE_MAJ) -eq 6 && \
+                                  test $(PLATFORM_RELEASE_MIN) -gt 0 ) ) && echo 1 || echo 0)
 
 # Picking an exact match of API_LEVEL for the platform we're building
 # against can avoid compatibility theming and affords better integration.
 #
 ifeq ($(is_future_version),1)
-API_LEVEL := 20
+API_LEVEL := 23
+else ifeq ($(is_at_least_marshmallow),1)
+API_LEVEL := 23
+else ifeq ($(is_at_least_lollipop_mr1),1)
+API_LEVEL := 22
+else ifeq ($(is_at_least_lollipop),1)
+API_LEVEL := 21
+#API_LEVEL := 20 was l-preview
 else ifeq ($(is_at_least_kitkat),1)
 API_LEVEL := 19
-else ifeq ($(is_at_least_jellybean_mr2),1)
-API_LEVEL := 18
-else ifeq ($(is_at_least_jellybean_mr1),1)
-API_LEVEL := 17
-else ifeq ($(is_at_least_jellybean),1)
-API_LEVEL := 16
 else
-$(error Must build against Android >= 4.1)
+$(error Must build against Android >= 4.4)
 endif
 
 # Each DDK is tested against only a single version of the platform.
@@ -134,6 +156,6 @@ endif
 #
 ifeq ($(is_future_version),1)
 $(info WARNING: Android version is newer than this DDK supports)
-else ifneq ($(is_at_least_jellybean_mr2),1)
+else ifneq ($(is_at_least_lollipop_mr1),1)
 $(info WARNING: Android version is older than this DDK supports)
 endif
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/apis/xorg.mk b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/apis/xorg.mk
index c779e9d..cdcabd9 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/apis/xorg.mk
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/apis/xorg.mk
@@ -39,9 +39,17 @@
 # CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ### ###########################################################################
 
-ifeq ($(filter xorg,$(EXCLUDED_APIS)),)
- COMPONENTS += xorg pvr_conf pvr_video wsegl_dri2_linux
- -include ../common/apis/xorg_opengl.mk
+ifeq ($(WINDOW_SYSTEM),xorg)
+ SUPPORT_BUILD_LWS := 1
+ COMPONENTS += libudev_stubs
+ ifeq ($(PVR_LWS_NODC),1)
+  COMPONENTS += xorg pvr_conf pvr_video lws_pkgconfig pvr_dri
+ else
+  COMPONENTS += xorg pvr_conf pvr_video wsegl_dri2_linux
+  ifeq ($(filter opengl,$(EXCLUDED_APIS)),)
+   COMPONENTS += pvr_dri
+  endif
+ endif
 ifeq ($(SUPPORT_PVR_REMOTE),1)
  COMPONENTS += pvr_input
 endif
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/dridrm.mk b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/dridrm.mk
index 4097e7a..b6f945f 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/dridrm.mk
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/dridrm.mk
@@ -59,3 +59,20 @@ $(eval $(call TunableBothConfigMake,PVR_DRI_DRM_NOT_PCI))
 
 $(eval $(call TunableKernelConfigC,PVR_DRI_DRM_PLATFORM_DEV,))
 
+
+
+ifeq ($(SUPPORT_DRI_DRM_PLUGIN),1)
+PVR_DRI_CLIENT_DRIVER := pvrsrvkm
+else
+# The X and Wayland window systems derive the client driver name from a
+# display driver DRM device node. The Surfaceless window system derives it
+# from a render node.
+ifeq ($(WINDOW_SYSTEM),surfaceless)
+PVR_DRI_CLIENT_DRIVER := pvr
+else
+PVR_DRI_CLIENT_DRIVER := $(if $(PVR_DRM_MODESET_DRIVER_NAME),$(PVR_DRM_MODESET_DRIVER_NAME),pvr)
+endif
+endif
+
+PVR_DRI_GET_EXTENSIONS_ENTRY_POINT := __driDriverGetExtensions_$(PVR_DRI_CLIENT_DRIVER)
+
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/xorg.mk b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/xorg.mk
index 27c77a3..6867263 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/xorg.mk
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/xorg.mk
@@ -38,11 +38,17 @@
 # CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ### ###########################################################################
 
-PVR_SECURE_DRM_AUTH_EXPORT := 1
+ifeq ($(PVR_DRM_MODESET_DRIVER_NAME),)
+ PVR_SECURE_DRM_AUTH_EXPORT := 1
+endif
 
 $(eval $(call TunableKernelConfigC,XPROC_WORKAROUND_NUM_SHAREABLES,4095))
 
 ifeq ($(SUPPORT_PVR_REMOTE),1)
 else
+ ifeq ($(PVR_LWS_NODC),1)
+ else
+ endif
 endif
 
+
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/xorg_test.mk b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/xorg_test.mk
index fe10742..ea112e7 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/xorg_test.mk
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/common/xorg_test.mk
@@ -38,14 +38,21 @@
 # CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ### ###########################################################################
 
-# FIXME: Will go away when SUPPORT_DRI_DRM is untangled from
-#        the old meaning of SUPPORT_XORG=1.
-
-ifeq ($(filter xorg,$(EXCLUDED_APIS)),)
-ifneq ($(wildcard ../common/apis/xorg.mk),)
-SUPPORT_BUILD_XORG := 1
-ifeq ($(PDUMP),1)
-SUPPORT_PDUMP_MULTI_PROCESS := 1
-endif
+ifeq ($(WINDOW_SYSTEM),)
+ ifeq ($(filter xorg,$(EXCLUDED_APIS)),)
+  ifneq ($(wildcard ../common/apis/xorg.mk),)
+   WINDOW_SYSTEM := xorg
+   WINDOW_SYSTEM_SET_INTERNALLY := 1
+  endif
+ endif
 endif
+
+ifeq ($(WINDOW_SYSTEM),xorg)
+ # Set for the benefit of those platform Makefiles that test for it,
+ # but no longer used by the build system.
+ SUPPORT_BUILD_XORG := 1
+
+ ifeq ($(PDUMP),1)
+  SUPPORT_PDUMP_MULTI_PROCESS := 1
+ endif
 endif
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/config/core.mk b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/config/core.mk
index 1bfce01..5cd7a47 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/config/core.mk
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/config/core.mk
@@ -178,7 +178,11 @@ $(call directory-must-exist,$(TOP)/eurasiacon/build/linux2/$(PVR_BUILD_DIR))
 # final programs/libraries, and install/rc scripts.
 #
 BUILD   ?= release
-OUT             ?= $(TOP)/eurasiacon/binary2_$(PVR_BUILD_DIR)_$(BUILD)
+ifneq ($(WINDOW_SYSTEM),)
+OUT ?= $(TOP)/eurasiacon/binary_$(PVR_BUILD_DIR)_$(WINDOW_SYSTEM)_$(BUILD)
+else
+OUT ?= $(TOP)/eurasiacon/binary2_$(PVR_BUILD_DIR)_$(BUILD)
+endif
 override OUT := $(if $(filter /%,$(OUT)),$(OUT),$(TOP)/$(OUT))
 
 CONFIG_MK                       := $(OUT)/config.mk
@@ -269,7 +273,9 @@ ifeq ($(SUPPORT_LINUX_USING_WORKQUEUES),1)
 override PVR_LINUX_USING_WORKQUEUES := 1
 override PVR_LINUX_MISR_USING_PRIVATE_WORKQUEUE := 1
 override PVR_LINUX_TIMERS_USING_WORKQUEUES := 1
+ifneq ($(SUPPORT_ANDROID_FPGA),1)
 override SYS_CUSTOM_POWERLOCK_WRAP := 1
+endif
 else ifeq ($(SUPPORT_LINUX_USING_SHARED_WORKQUEUES),1)
 override PVR_LINUX_USING_WORKQUEUES := 1
 override PVR_LINUX_MISR_USING_WORKQUEUE := 1
@@ -360,7 +366,7 @@ $$(warning *** Setting $(1) via $$(origin $(1)) is deprecated)
 $$(error If you are trying to disable a component, use e.g. EXCLUDED_APIS="opengles1 opengl")
 endif
 endef
-$(foreach _o,SYS_CFLAGS SYS_CXXFLAGS SYS_INCLUDES SYS_EXE_LDFLAGS SYS_LIB_LDFLAGS SYS_EXE_LDFLAGS_CXX SYS_LIB_LDFLAGS_CXX SUPPORT_EWS SUPPORT_OPENGLES1 SUPPORT_OPENGLES2 SUPPORT_OPENCL SUPPORT_RSCOMPUTE SUPPORT_OPENGL SUPPORT_UNITTESTS SUPPORT_XORG,$(eval $(call sanity-check-support-option-origin,$(_o))))
+$(foreach _o,SYS_CFLAGS SYS_CXXFLAGS SYS_INCLUDES SYS_COMMON_LDFLAGS SYS_EXE_LDFLAGS SYS_LIB_LDFLAGS SYS_EXE_LDFLAGS_CXX SYS_LIB_LDFLAGS_CXX SUPPORT_EWS SUPPORT_OPENGLES1 SUPPORT_OPENGLES2 SUPPORT_OPENCL SUPPORT_RSCOMPUTE SUPPORT_OPENGL SUPPORT_UNITTESTS SUPPORT_XORG,$(eval $(call sanity-check-support-option-origin,$(_o))))
 
 # Check for words in EXCLUDED_APIS that aren't understood by the
 # common/apis/*.mk files. This should be kept in sync with all the tests on
@@ -401,6 +407,31 @@ COMPONENTS += pvrvncsrv
 COMPONENTS += pvrvncinput
 endif
 
+ifeq ($(HAVE_WINDOW_SYSTEM_MAKEFILE),)
+  ifeq ($(WINDOW_SYSTEM_SET_INTERNALLY),)
+   ifneq ($(WINDOW_SYSTEM),)
+    $(error "The WINDOW_SYSTEM build variable is not supported on this platform")
+   endif
+  endif
+  ifneq ($(MESA_EGL),)
+   $(error "The MESA_EGL build variable is not supported on this platform")
+  endif
+  PVR_LWS_NODC :=
+  PVR_LWS_NOBC :=
+endif
+
+ifneq ($(WINDOW_SYSTEM),)
+endif
+ifeq ($(MESA_EGL),1)
+ SUPPORT_OPENGLES1_V1_ONLY := 1
+ GLES1_EXTENSION_EGL_IMAGE_EXTERNAL := 1
+ GLES2_EXTENSION_EGL_IMAGE_EXTERNAL := 1
+else
+ ifeq ($(SUPPORT_BUILD_LWS),1)
+ else
+ endif
+endif
+
 $(if $(filter config,$(D)),$(info Build configuration:))
 
 ################################# CONFIG ####################################
@@ -426,7 +457,7 @@ $(eval $(call TunableBothConfigMake,KERNEL_CROSS_COMPILE,))
 endif
 
 # Check the KERNELDIR has a kernel built.
-VMLINUX := $(strip $(wildcard $(KERNELDIR)/vmlinux))
+VMLINUX := 
 LINUXCFG := $(strip $(wildcard $(KERNELDIR)/.config))
 
 ifneq ($(VMLINUX),)
@@ -437,8 +468,10 @@ VMLINUX_IS_64BIT := $(shell file $(VMLINUX) | grep 64-bit >/dev/null || echo fal
 VMLINUX_HAS_PAE36 := $(shell cat $(LINUXCFG) | grep CONFIG_X86_PAE=y >/dev/null || echo false)
 VMLINUX_HAS_PAE40 := $(shell cat $(LINUXCFG) | grep CONFIG_ARM_LPAE=y >/dev/null || echo false)
 VMLINUX_HAS_DMA32 := $(shell cat $(LINUXCFG) | grep CONFIG_ZONE_DMA32=y >/dev/null || echo false)
+VMLINUX_HAS_DMA := $(shell cat $(LINUXCFG) | grep CONFIG_ZONE_DMA=y >/dev/null || echo false)
 
-# $(error 64BIT=$(VMLINUX_IS_64BIT) PAE36=$(VMLINUX_HAS_PAE36) PAE40=$(VMLINUX_HAS_PAE40) DMA32=$(VMLINUX_HAS_DMA32) MMU36=$(SGX_FEATURE_36BIT_MMU))
+
+# $(error 64BIT=$(VMLINUX_IS_64BIT) PAE36=$(VMLINUX_HAS_PAE36) PAE40=$(VMLINUX_HAS_PAE40) DMA=$(VMLINUX_HAS_DMA) DMA32=$(VMLINUX_HAS_DMA32) MMU36=$(SGX_FEATURE_36BIT_MMU))
 
 ifneq ($(VMLINUX_IS_64BIT),false)
 $(warning $$(KERNELDIR)/vmlinux: Note: vmlinux is 64-bit, which is supported but currently experimental.)
@@ -449,8 +482,8 @@ endif
 endif
 
 ifneq ($(VMLINUX_HAS_PAE40),false)
-ifeq ($(VMLINUX_HAS_DMA32),false)
-$(warning SGX MMUs are currently supported up to only 36 bits max. Your Kernel is built with 40-bit PAE but does not have CONFIG_ZONE_DMA32.)
+ifeq ($(VMLINUX_HAS_DMA),false)
+$(warning SGX MMUs are currently supported up to only 36 bits max. Your Kernel is built with 40-bit PAE but does not have CONFIG_ZONE_DMA.)
 $(warning This means you must ensure the runtime system has <= 4GB of RAM, or there will be BIG problems...)
 endif 
 endif
@@ -465,8 +498,8 @@ endif
 else
  # Kernel is 32-bit
 ifneq ($(VMLINUX_HAS_PAE36),false)
-ifeq ($(VMLINUX_HAS_DMA32),false)
-$(warning SGX is configured with 32-bit MMU. Your Kernel is 32-bit PAE, but does not have CONFIG_ZONE_DMA32. )
+ifeq ($(VMLINUX_HAS_DMA),false)
+$(warning SGX is configured with 32-bit MMU. Your Kernel is 32-bit PAE, but does not have CONFIG_ZONE_DMA. )
 $(warning This means you must ensure the runtime system has <= 4GB of RAM, or there will be BIG problems...)
 endif
 endif
@@ -506,13 +539,16 @@ ifneq ($(DISPLAY_CONTROLLER),)
 $(eval $(call BothConfigC,DISPLAY_CONTROLLER,$(DISPLAY_CONTROLLER)))
 endif
 
+ifneq ($(DRM_DISPLAY_CONTROLLER),)
+endif
+
 ifneq ($(strip $(KERNELDIR)),)
 PVR_LINUX_MEM_AREA_POOL_MAX_PAGES ?= 0
 ifneq ($(PVR_LINUX_MEM_AREA_POOL_MAX_PAGES),0)
 PVR_LINUX_MEM_AREA_USE_VMAP ?= 1
 include ../kernel_version.mk
 ifeq ($(call kernel-version-at-least,3,0),true)
-PVR_LINUX_MEM_AREA_POOL_ALLOW_SHRINK ?= 0
+PVR_LINUX_MEM_AREA_POOL_ALLOW_SHRINK ?= 1
 endif
 endif
 $(eval $(call KernelConfigC,PVR_LINUX_MEM_AREA_POOL_MAX_PAGES,$(PVR_LINUX_MEM_AREA_POOL_MAX_PAGES)))
@@ -537,6 +573,7 @@ $(eval $(call KernelConfigC,DEBUG_BRIDGE_KM,))
 else ifeq ($(BUILD),release)
 $(eval $(call BothConfigC,RELEASE,))
 $(eval $(call TunableBothConfigMake,DEBUGLINK,1))
+$(eval $(call TunableBothConfigC,PVR_DBGPRIV_LEVEL,))
 else ifeq ($(BUILD),timing)
 $(eval $(call BothConfigC,TIMING,))
 $(eval $(call TunableBothConfigMake,DEBUGLINK,1))
@@ -566,6 +603,7 @@ $(eval $(call TunableBothConfigC,SGX_FEATURE_MP_PLUS,))
 $(eval $(call TunableBothConfigC,FPGA,))
 $(eval $(call TunableBothConfigC,PDUMP,))
 $(eval $(call TunableBothConfigC,MEM_TRACK_INFO_DEBUG,))
+$(eval $(call TunableBothConfigC,PVRSRV_DEVMEM_TIME_STATS,))
 $(eval $(call TunableBothConfigC,NO_HARDWARE,))
 $(eval $(call TunableBothConfigC,PDUMP_DEBUG_OUTFILES,))
 $(eval $(call TunableBothConfigC,PVRSRV_USSE_EDM_STATUS_DEBUG,))
@@ -578,7 +616,7 @@ $(eval $(call TunableBothConfigC,PVRSRV_NEED_PVR_ASSERT,))
 $(eval $(call TunableBothConfigC,PVRSRV_NEED_PVR_TRACE,))
 $(eval $(call TunableBothConfigC,SUPPORT_SECURE_33657_FIX,))
 $(eval $(call TunableBothConfigC,SUPPORT_ION,))
-$(eval $(call TunableBothConfigC,SUPPORT_DRM_GEM,))
+$(eval $(call TunableBothConfigC,SUPPORT_DMABUF,))
 $(eval $(call TunableBothConfigC,SUPPORT_HWRECOVERY_TRACE_LIMIT,))
 $(eval $(call TunableBothConfigC,SUPPORT_PVRSRV_DEVICE_CLASS,))
 $(eval $(call TunableBothConfigC,SUPPORT_PVRSRV_GET_DC_SYSTEM_BUFFER,1))
@@ -599,6 +637,7 @@ $(eval $(call TunableKernelConfigC,PVR_LINUX_MISR_USING_PRIVATE_WORKQUEUE,))
 $(eval $(call TunableKernelConfigC,PVR_LINUX_TIMERS_USING_WORKQUEUES,))
 $(eval $(call TunableKernelConfigC,PVR_LINUX_TIMERS_USING_SHARED_WORKQUEUE,))
 $(eval $(call TunableKernelConfigC,LDM_PLATFORM,))
+$(eval $(call TunableKernelConfigC,PVR_LDM_DEVICE_TREE,))
 $(eval $(call TunableKernelConfigC,PVR_LDM_PLATFORM_PRE_REGISTERED,))
 $(eval $(call TunableKernelConfigC,PVR_LDM_PLATFORM_PRE_REGISTERED_DEV,))
 $(eval $(call TunableKernelConfigC,PVR_LDM_DRIVER_REGISTRATION_NAME,"\"$(PVRSRV_MODNAME)\""))
@@ -620,7 +659,7 @@ $(eval $(call TunableKernelConfigC,SUPPORT_FORCE_SYNC_DUMP,))
 
 $(eval $(call TunableBothConfigMake,OPTIM,))
 $(eval $(call TunableBothConfigMake,SUPPORT_ION,))
-$(eval $(call TunableBothConfigMake,SUPPORT_DRM_GEM,))
+$(eval $(call TunableBothConfigMake,SUPPORT_DMABUF,))
 $(eval $(call TunableBothConfigMake,SUPPORT_PVRSRV_DEVICE_CLASS,))
 
 
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/defs.mk b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/defs.mk
index dee740f..311bbb0 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/defs.mk
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/defs.mk
@@ -146,3 +146,8 @@ endef
 define module-info-line
 $(if $(filter modules,$(D)),$(info $(1)),)
 endef
+
+# $(call if-exists,A,B) => A if A is a file which exists, otherwise B
+define if-exists
+$(if $(wildcard $(1)),$(1),$(2))
+endef
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/moduledefs.mk b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/moduledefs.mk
index ef4596c..155d3bb 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/moduledefs.mk
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/moduledefs.mk
@@ -61,12 +61,12 @@ endif
 
 # Only allow cflags that do not affect code generation. This is to ensure
 # proper binary compatibility when LTO (Link-Time Optimization) is enabled.
-# We make exceptions for -fPIC, -fPIE and -m32 which will all fail linkage
-# in non-LTO mode if incorrectly specified.
+# We make exceptions for the below flags which will all fail linkage in
+# non-LTO mode if incorrectly specified.
 #
 # NOTE: Only used by static_library and objects right now. Other module
 # types should not be affected by complex code generation flags w/ LTO.
-MODULE_ALLOWED_CFLAGS := -W% -D% -std=% -fPIC -fPIE -m32
+MODULE_ALLOWED_CFLAGS := -W% -D% -std=% -fPIC -fPIE -pie -m32
 
 # -L flags for library search dirs: these are relative to $(TOP), unless
 # they're absolute paths
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/modules.mk b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/modules.mk
index 1576590..971f21a 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/modules.mk
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/modules.mk
@@ -42,7 +42,6 @@
 # Bits for processing $(modules) after reading in each Linux.mk
 
 #$(info ---- $(modules) ----)
-$(call must-be-nonempty,modules)
 
 $(foreach _m,$(modules),$(if $(filter $(_m),$(ALL_MODULES)),$(error In makefile $(THIS_MAKEFILE): Duplicate module $(_m) (first seen in $(INTERNAL_MAKEFILE_FOR_MODULE_$(_m))) listed in $$(modules)),$(eval $(call register-module,$(_m)))))
 
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/omap_android/Makefile b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/omap_android/Makefile
index 109e405..03efcdb 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/omap_android/Makefile
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/omap_android/Makefile
@@ -63,7 +63,21 @@ SGXCORE						:= 544
 SGX_CORE_REV                            := 112
 HAL_VARIANT                                     := omap4
 endif
-ifneq ($(filter jacinto6evm omap5sevm panda5,$(TARGET_DEVICE)),)
+ifneq ($(filter omap5sevm panda5,$(TARGET_DEVICE)),)
+SGXCORE                                         := 544
+SGX_CORE_REV                            := 105
+SGX_FEATURE_MP                          := 1
+SGX_FEATURE_SYSTEM_CACHE        := 1
+SGX_FEATURE_MP_CORE_COUNT       := 2
+HAL_VARIANT                                     := omap5
+
+# OMAP Product Version
+VS_PRODUCT_VERSION                      := 5
+
+# FIXME: Re-enable this ASAP
+SUPPORT_ACTIVE_POWER_MANAGEMENT := 0
+endif
+ifneq ($(filter jacinto6evm,$(TARGET_DEVICE)),)
 SGXCORE                                         := 544
 SGX_CORE_REV                            := 116
 SGX_FEATURE_MP                          := 1
@@ -72,10 +86,12 @@ SGX_FEATURE_MP_CORE_COUNT	:= 2
 HAL_VARIANT                                     := jacinto6
 
 # OMAP Product Version
+# FIXME: Get rid of this
 VS_PRODUCT_VERSION                      := 5
 
 # FIXME: Re-enable this ASAP
 SUPPORT_ACTIVE_POWER_MANAGEMENT := 0
+
 endif
 
 # Handle any TARGET_DEVICE remapping. Not all DDK TARGET_DEVICEs
@@ -92,15 +108,19 @@ SGX_DYNAMIC_TIMING_INFO := 1
 
 SUPPORT_LINUX_USING_WORKQUEUES := 1
 
-SUPPORT_PVRSRV_ANDROID_SYSTRACE := 0
+SUPPORT_PVRSRV_ANDROID_SYSTRACE := 1
 
-ifneq ($(SUPPORT_PVRSRV_DEVICE_CLASS),0)
+SUPPORT_DMABUF := 1
+
+# TODO: Set SUPPORT_PVRSVR_DEVICE_CLASS to 0
+#DISPLAY_CONTROLLER should not be used for DRM based display controller
+#ifneq ($(SUPPORT_PVRSRV_DEVICE_CLASS),0)
 #DISPLAY_CONTROLLER := omaplfb
-endif
+#endif
 
 PVR_SYSTEM := omap
 
-KERNEL_CROSS_COMPILE ?= arm-none-linux-gnueabi-
+KERNEL_CROSS_COMPILE ?= arm-eabi-
 
 # We have more memory on OMAP platforms, so we can spare to make the
 # pool larger, and have higher resolutions which benefit from it.
@@ -126,6 +146,9 @@ ifneq ($(strip $(KERNELDIR)),)
   SUPPORT_DC_CMDCOMPLETE_WHEN_NO_LONGER_DISPLAYED := 1
   SYS_OMAP_HAS_DVFS_FRAMEWORK := 0
  endif
+ ifeq ($(call kernel-version-at-least,3,8,13),true)
+  PVR_LDM_DEVICE_TREE := 1
+ endif
 else
  $(warning "KERNELDIR is not set, so can't feature check DVFS or dsscomp.")
  $(warning "Assuming we want DVFS and dsscomp support.")
@@ -143,6 +166,7 @@ DISPLAY_CONTROLLER_COMPONENT := linux_framebuffer
 OMAP_NON_FLIP_DISPLAY := 1
 endif
 else # LDM_PLATFORM != 1
+# TODO: we should set DEVICE_CLASS to zero
 ifneq ($(SUPPORT_PVRSRV_DEVICE_CLASS),0)
 #DISPLAY_CONTROLLER_COMPONENT := dc_omapfb3_linux
 endif
@@ -176,7 +200,7 @@ SUPPORT_ANDROID_OMAP_NV12 := 1
 
 PVR_ANDROID_USE_WINDOW_TRANSFORM_HINT := 1
 
-PVR_ANDROID_PLATFORM_HAS_LINUX_FBDEV := 0
+PVR_ANDROID_PLATFORM_HAS_LINUX_FBDEV := 1
 
 # Handle Google's OMAP-based products
 #
@@ -200,6 +224,9 @@ endif
 endif # SUPPORT_DC_CMDCOMPLETE_WHEN_NO_LONGER_DISPLAYED == 1
 endif # NO_HARDWARE == 1
 
+# we are not using PVR composerhal
+#PVR_ANDROID_COMPOSERHAL ?= omap
+
 include ../config/core.mk
 include ../common/android/extra_config.mk
 include ../common/dridrm.mk
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/omap_linux/Makefile b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/omap_linux/Makefile
index 8a65e7d..6c9b932 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/omap_linux/Makefile
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/omap_linux/Makefile
@@ -39,56 +39,69 @@
 # CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ### ###########################################################################
 
-# If a product wasn't specified, we're an OMAP4430 blaze.
+include ../kernel_version.mk
+ifeq ($(call kernel-version-at-least,3,8,13),true)
+ SUPPORT_LWS_WITH_DC ?= 0
+endif
+include ../config/window_system.mk
+
+# If a product wasn't specified, we're a J6 EVM.
 #
 TARGET_PRODUCT ?= jacinto6evm
 
+PVRSRV_NEED_PVR_DPF := 1
+PVRSRV_NEW_PVR_DPF := 1
+
 # Customize this build as per the TARGET_PRODUCT setting
 #
 ifneq ($(filter blaze blaze_tablet panda,$(TARGET_PRODUCT)),)
-SGXCORE                                 := 540
-SGX_CORE_REV                            := 120
+ SGXCORE                                        := 540
+ SGX_CORE_REV                           := 120
 endif
 ifneq ($(filter blaze.4470 blaze_tablet.4470,$(TARGET_PRODUCT)),)
-SGXCORE                                 := 544
-SGX_CORE_REV                            := 112
+ SGXCORE                                        := 544
+ SGX_CORE_REV                           := 112
 endif
 ifneq ($(filter omap5sevm panda5,$(TARGET_PRODUCT)),)
-SGXCORE                                 := 544
-SGX_CORE_REV                            := 105
-SGX_FEATURE_MP                          := 1
-SGX_FEATURE_SYSTEM_CACHE                := 1
-SGX_FEATURE_MP_CORE_COUNT               := 2
-PVR_OMAPLFB_DRM_FB                      := 0
-SYS_OMAP_HAS_DVFS_FRAMEWORK             := 1
-
-# OMAP Product Version
-VS_PRODUCT_VERSION                      := 5
-
-# FIXME: Re-enable this ASAP
-SUPPORT_ACTIVE_POWER_MANAGEMENT         := 0
+ SGXCORE                                        := 544
+ SGX_CORE_REV                           := 105
+ SGX_FEATURE_MP                         := 1
+ SGX_FEATURE_SYSTEM_CACHE               := 1
+ SGX_FEATURE_MP_CORE_COUNT              := 2
+ PVR_OMAPLFB_DRM_FB                     := 0
+ SYS_OMAP_HAS_DVFS_FRAMEWORK            := 1
+
+ # OMAP Product Version
+ VS_PRODUCT_VERSION                     := 5
+
+ # FIXME: Re-enable this ASAP
+ SUPPORT_ACTIVE_POWER_MANAGEMENT        := 0
 endif
 ifneq ($(filter jacinto6evm omap5uevm,$(TARGET_PRODUCT)),)
-SGXCORE                                 := 544
-SGX_CORE_REV                            := 116
-SGX_FEATURE_MP                          := 1
-SGX_FEATURE_SYSTEM_CACHE                := 1
-SGX_FEATURE_MP_CORE_COUNT               := 2
+ SGXCORE                                        := 544
+ SGX_CORE_REV                           := 116
+ SGX_FEATURE_MP                         := 1
+ SGX_FEATURE_SYSTEM_CACHE               := 1
+ SGX_FEATURE_MP_CORE_COUNT              := 2
+ SYS_OMAP_HAS_DVFS_FRAMEWORK            := 1
 
-SYS_OMAP5_UEVM                          := 1
+ SYS_OMAP5_UEVM                         := 1
 
-# OMAP Product Version
-VS_PRODUCT_VERSION                      := 5
+ # OMAP Product Version
+ VS_PRODUCT_VERSION                     := 5
 endif
 
+PVR_NO_OMAP_TIMER := 1
+
 PVR_SYSTEM              := omap
 
-KERNEL_COMPONENTS := srvkm bufferclass_example
+KERNEL_COMPONENTS := srvkm
+ifeq ($(PVR_LWS_NOBC),)
+KERNEL_COMPONENTS += bufferclass_example
+endif
 
 SUPPORT_OLD_ION_API := 1
 
-include ../kernel_version.mk
-
 # Only enable active power management if passive power management is
 # enabled, as indicated by LDM_PLATFORM being set to 1.  On OMAP,
 # the system can suspend in the case where active power management is
@@ -99,8 +112,9 @@ LDM_PLATFORM ?= 1
 
 ifeq ($(LDM_PLATFORM),1)
 SUPPORT_LINUX_USING_WORKQUEUES := 1
-DISPLAY_CONTROLLER_COMPONENT += dc_omapfb3_linux
-DISPLAY_CONTROLLER := omaplfb
+#With DRM EGL and display, omaplfb is not needed
+#DISPLAY_CONTROLLER_COMPONENT += dc_omapfb3_linux
+#DISPLAY_CONTROLLER := omaplfb
 else
 SUPPORT_LINUX_USING_SHARED_WORKQUEUES := 1
 OMAP_NON_FLIP_DISPLAY := 1
@@ -142,16 +156,25 @@ SYS_CUSTOM_POWERLOCK_WRAP := 1
 
 ifeq ($(OMAP_NON_FLIP_DISPLAY),1)
 OPK_DEFAULT := libpvrPVR2D_BLITWSEGL.so
-else
-OPK_DEFAULT := libpvrPVR2D_FLIPWSEGL.so
 endif
 
 ifeq ($(SYS_OMAP5_UEVM),1)
+XORG_EXPLICIT_PVR_SERVICES_LOAD := 1
+ifeq ($(call kernel-version-at-least,3,8,13),true)
+LDM_PLATFORM := 1
+PVR_LDM_DEVICE_TREE := 1
+else
 PVR_LDM_PLATFORM_PRE_REGISTERED := 1
 PVR_LDM_PLATFORM_PRE_REGISTERED_DEV := "\"omapdrm_pvr\""
-XORG_EXPLICIT_PVR_SERVICES_LOAD := 1
+endif
+ifeq ($(PVR_LWS_NODC),1)
+# No display class driver.
+DISPLAY_CONTROLLER_COMPONENT :=
+DISPLAY_CONTROLLER :=
+else
 PVR_OMAPLFB_DRM_FB := 0
 PVR_OMAPLFB_DONT_USE_FB_PAN_DISPLAY := 1
+endif
 else
 ifeq ($(call kernel-version-at-least,2,6,35),true)
 # Work around flipping problems seen with the Taal LCDs on Blaze.
@@ -182,16 +205,17 @@ endif
 endif
 endif
 
-include ../common/xorg_test.mk
-ifeq ($(SUPPORT_BUILD_XORG),1)
-SUPPORT_DRI_DRM := 1
-endif
-
 ifeq ($(SUPPORT_DRI_DRM),1)
 ifeq ($(SYS_OMAP5_UEVM),1)
 PVR_DRI_DRM_PLATFORM_DEV := 1
+ifneq ($(call kernel-version-at-least,3,8,13),true)
 PVR_DRI_DRM_STATIC_BUS_ID := 1
 PVR_DRI_DRM_DEV_BUS_ID := "\"platform:omapdrm_pvr:00"\"
+endif
+ifeq ($(PVR_LWS_NODC),1)
+PVR_DRM_MODESET_DRIVER_NAME := omapdrm
+PVR_DRM_MODESET_MODULE_NAME := dumb
+endif
 else
 ifeq ($(call kernel-version-at-least,2,6,35),true)
 PVR_DRI_DRM_PLATFORM_DEV := 1
@@ -212,6 +236,9 @@ endif	# kernel-version-at-least,2,6,35
 endif   # ($(SYS_OMAP5_UEVM),1)
 endif   # SUPPORT_DRI_DRM
 
+include ../common/xorg_test.mk
+
+ifeq ($(PVR_LWS_NODC),)
 ifeq ($(SUPPORT_BUILD_XORG),1)
 ifeq ($(call kernel-version-at-least,2,6,35,7),true)
 # A client DRI authorisation failure, whilst switched away from the X Server
@@ -222,16 +249,9 @@ PVR_XORG_DONT_DROP_MASTER_IN_LEAVE_VT := 1
 endif
 XORG_PVR_VIDEO ?= omap4
 
-OPK_FALLBACK := libpvrPVR2D_DRIWSEGL.so
-
 ifneq ($(OMAP_NON_FLIP_DISPLAY),1)
 PVR_DISPLAY_CONTROLLER_DRM_IOCTL := 1
 endif
-
-else  # xorg isn't excluded
-
-OPK_FALLBACK := libpvrPVR2D_BLITWSEGL.so
-
 endif # xorg isn't excluded
 
 ifeq ($(SUPPORT_DRI_DRM),1)
@@ -243,6 +263,7 @@ EXTRA_PVRSRVKM_COMPONENTS += $(DISPLAY_CONTROLLER_COMPONENT)
 else
 KERNEL_COMPONENTS += $(DISPLAY_CONTROLLER_COMPONENT)
 endif
+endif
 
 include ../config/core.mk
 include ../common/xorg.mk
diff --git a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/sunxi_android/Makefile b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/sunxi_android/Makefile
index 4473d62..9313a1b 100644
--- a/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/sunxi_android/Makefile
+++ b/jacinto6/sgx_src/eurasia_km/eurasiacon/build/linux2/sunxi_android/Makefile
@@ -76,7 +76,7 @@ PVRSRV_DUMP_MK_TRACE ?= 1
 
 SUPPORT_ANDROID_SUNXI ?= 1
 
-ION_DEFAULT_HEAP_MASK := ION_HEAP_CARVEOUT_MASK
+ION_DEFAULT_HEAP_ID_MASK := ION_HEAP_CARVEOUT_MASK
 
 # We have more memory on the sun6i platform, so we can spare to make
 # the pool larger, and have higher resolutions which benefit from it.
@@ -108,6 +108,8 @@ KERNEL_COMPONENTS += dc_nohw
 endif
 endif
 
+PVR_ANDROID_COMPOSERHAL ?= sunxi
+
 include ../config/core.mk
 include ../common/android/extra_config.mk
 include ../common/opencl.mk
diff --git a/jacinto6/sgx_src/eurasia_km/include4/img_defs.h b/jacinto6/sgx_src/eurasia_km/include4/img_defs.h
index bf0c360..b7447d7 100644
--- a/jacinto6/sgx_src/eurasia_km/include4/img_defs.h
+++ b/jacinto6/sgx_src/eurasia_km/include4/img_defs.h
@@ -211,6 +211,10 @@ typedef char				TCHAR, *PTCHAR, *PTSTR;
         #define IMG_UINT64_FMT "ll" /* May need to be updated as required, for other OSs */
 #endif
 
+/*
+        Some versions of MSVC don't have snprintf, vsnprintf in their CRTs.
+        Remap to the deprecated unix compatibility versions.
+*/
 
 #endif /* #if !defined (__IMG_DEFS_H__) */
 /*****************************************************************************
diff --git a/jacinto6/sgx_src/eurasia_km/include4/pvr_debug.h b/jacinto6/sgx_src/eurasia_km/include4/pvr_debug.h
index fcc0275..be78c77 100644
--- a/jacinto6/sgx_src/eurasia_km/include4/pvr_debug.h
+++ b/jacinto6/sgx_src/eurasia_km/include4/pvr_debug.h
@@ -55,12 +55,12 @@ extern "C" {
 /* These are privately used by pvr_debug, use the PVR_DBG_ defines instead */
 #define DBGPRIV_FATAL                   0x001UL
 #define DBGPRIV_ERROR                   0x002UL
-#define DBGPRIV_WARNING                 0x004UL
-#define DBGPRIV_MESSAGE                 0x008UL
-#define DBGPRIV_VERBOSE                 0x010UL
-#define DBGPRIV_CALLTRACE               0x020UL
-#define DBGPRIV_ALLOC                   0x040UL
-#define DBGPRIV_BUFFERED                0x080UL
+#define DBGPRIV_BUFFERED                0x004UL
+#define DBGPRIV_WARNING                 0x008UL
+#define DBGPRIV_MESSAGE                 0x010UL
+#define DBGPRIV_VERBOSE                 0x020UL
+#define DBGPRIV_CALLTRACE               0x040UL
+#define DBGPRIV_ALLOC                   0x080UL
 #define DBGPRIV_DBGDRV_MESSAGE  0x100UL
 
 #define DBGPRIV_DBGLEVEL_COUNT  9
@@ -139,33 +139,72 @@ IMG_IMPORT IMG_VOID IMG_CALLCONV PVRSRVDebugAssertFail(const IMG_CHAR *pszFile,
         /* New logging mechanism */
         #define PVR_DBG_FATAL           DBGPRIV_FATAL
         #define PVR_DBG_ERROR           DBGPRIV_ERROR
+        #define PVR_DBG_BUFFERED        DBGPRIV_BUFFERED
         #define PVR_DBG_WARNING         DBGPRIV_WARNING
         #define PVR_DBG_MESSAGE         DBGPRIV_MESSAGE
         #define PVR_DBG_VERBOSE         DBGPRIV_VERBOSE
         #define PVR_DBG_CALLTRACE       DBGPRIV_CALLTRACE
         #define PVR_DBG_ALLOC           DBGPRIV_ALLOC
-        #define PVR_DBG_BUFFERED        DBGPRIV_BUFFERED
         #define PVR_DBGDRIV_MESSAGE     DBGPRIV_DBGDRV_MESSAGE
 
         /* These levels are always on with PVRSRV_NEED_PVR_DPF */
         #define __PVR_DPF_0x001UL(x...) PVRSRVDebugPrintf(DBGPRIV_FATAL, x)
         #define __PVR_DPF_0x002UL(x...) PVRSRVDebugPrintf(DBGPRIV_ERROR, x)
-        #define __PVR_DPF_0x080UL(x...) PVRSRVDebugPrintf(DBGPRIV_BUFFERED, x)
+        #define __PVR_DPF_0x004UL(x...) PVRSRVDebugPrintf(DBGPRIV_BUFFERED, x)
 
         /* Some are compiled out completely in release builds */
 #if defined(DEBUG)
-        #define __PVR_DPF_0x004UL(x...) PVRSRVDebugPrintf(DBGPRIV_WARNING, x)
-        #define __PVR_DPF_0x008UL(x...) PVRSRVDebugPrintf(DBGPRIV_MESSAGE, x)
-        #define __PVR_DPF_0x010UL(x...) PVRSRVDebugPrintf(DBGPRIV_VERBOSE, x)
-        #define __PVR_DPF_0x020UL(x...) PVRSRVDebugPrintf(DBGPRIV_CALLTRACE, x)
-        #define __PVR_DPF_0x040UL(x...) PVRSRVDebugPrintf(DBGPRIV_ALLOC, x)
+        #define __PVR_DPF_0x008UL(x...) PVRSRVDebugPrintf(DBGPRIV_WARNING, x)
+        #define __PVR_DPF_0x010UL(x...) PVRSRVDebugPrintf(DBGPRIV_MESSAGE, x)
+        #define __PVR_DPF_0x020UL(x...) PVRSRVDebugPrintf(DBGPRIV_VERBOSE, x)
+        #define __PVR_DPF_0x040UL(x...) PVRSRVDebugPrintf(DBGPRIV_CALLTRACE, x)
+        #define __PVR_DPF_0x080UL(x...) PVRSRVDebugPrintf(DBGPRIV_ALLOC, x)
+        #define __PVR_DPF_0x100UL(x...) PVRSRVDebugPrintf(DBGPRIV_DBGDRV_MESSAGE, x)
+
+#elif defined(PVR_DBGPRIV_LEVEL)
+
+#if (PVR_DBGPRIV_LEVEL >= DBGPRIV_WARNING)
+        #define __PVR_DPF_0x008UL(x...) PVRSRVDebugPrintf(DBGPRIV_WARNING, x)
+#else
+        #define __PVR_DPF_0x008UL(x...)
+#endif
+
+#if (PVR_DBGPRIV_LEVEL >= DBGPRIV_MESSAGE)
+        #define __PVR_DPF_0x010UL(x...) PVRSRVDebugPrintf(DBGPRIV_MESSAGE, x)
+#else
+        #define __PVR_DPF_0x010UL(x...)
+#endif
+
+#if (PVR_DBGPRIV_LEVEL >= DBGPRIV_VERBOSE)
+        #define __PVR_DPF_0x020UL(x...) PVRSRVDebugPrintf(DBGPRIV_VERBOSE, x)
+#else
+        #define __PVR_DPF_0x020UL(x...)
+#endif
+
+#if (PVR_DBGPRIV_LEVEL >= DBGPRIV_CALLTRACE)
+        #define __PVR_DPF_0x040UL(x...) PVRSRVDebugPrintf(DBGPRIV_CALLTRACE, x)
+#else
+        #define __PVR_DPF_0x040UL(x...)
+#endif
+
+#if (PVR_DBGPRIV_LEVEL >= DBGPRIV_ALLOC)
+        #define __PVR_DPF_0x080UL(x...) PVRSRVDebugPrintf(DBGPRIV_ALLOC, x)
+#else
+        #define __PVR_DPF_0x080UL(x...)
+#endif
+
+#if (PVR_DBGPRIV_LEVEL >= DBGPRIV_DBGDRV_MESSAGE)
         #define __PVR_DPF_0x100UL(x...) PVRSRVDebugPrintf(DBGPRIV_DBGDRV_MESSAGE, x)
 #else
-        #define __PVR_DPF_0x004UL(x...)
+        #define __PVR_DPF_0x100UL(x...)
+#endif
+
+#else
         #define __PVR_DPF_0x008UL(x...)
         #define __PVR_DPF_0x010UL(x...)
         #define __PVR_DPF_0x020UL(x...)
         #define __PVR_DPF_0x040UL(x...)
+        #define __PVR_DPF_0x080UL(x...)
         #define __PVR_DPF_0x100UL(x...)
 #endif
 
@@ -204,6 +243,10 @@ IMG_IMPORT IMG_VOID IMG_CALLCONV PVRSRVDebugPrintf(IMG_UINT32 ui32DebugLevel,
                                                                                                    const IMG_CHAR *pszFormat,
                                                                                                    ...) IMG_FORMAT_PRINTF(4, 5);
 
+#if defined(PVR_DBGPRIV_LEVEL) && defined(SUPPORT_ANDROID_PLATFORM)
+IMG_IMPORT IMG_VOID IMG_CALLCONV PVRSRVDebugPrintfSetLevel(IMG_UINT32 ui32DebugLevel);
+#endif
+
 IMG_IMPORT IMG_VOID IMG_CALLCONV PVRSRVDebugPrintfDumpCCB(void);
 
 #else  /* defined(PVRSRV_NEED_PVR_DPF) */
diff --git a/jacinto6/sgx_src/eurasia_km/include4/pvrversion.h b/jacinto6/sgx_src/eurasia_km/include4/pvrversion.h
index a8dbd13..d48838f 100644
--- a/jacinto6/sgx_src/eurasia_km/include4/pvrversion.h
+++ b/jacinto6/sgx_src/eurasia_km/include4/pvrversion.h
@@ -49,20 +49,20 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #define PVR_STR2(X) PVR_STR(X)
 
 #define PVRVERSION_MAJ               1
-#define PVRVERSION_MIN               12
+#define PVRVERSION_MIN               14
 
 #define PVRVERSION_FAMILY           "sgxddk"
-#define PVRVERSION_BRANCHNAME       "1.12"
-#define PVRVERSION_BUILD             2917986
-#define PVRVERSION_BSCONTROL        "SGX_DDK"
+#define PVRVERSION_BRANCHNAME       "1.14"
+#define PVRVERSION_BUILD             4001660
+#define PVRVERSION_BSCONTROL        "SGX_DDK_Linux_XOrg"
 
-#define PVRVERSION_STRING           "SGX_DDK sgxddk 1.12@" PVR_STR2(PVRVERSION_BUILD)
-#define PVRVERSION_STRING_SHORT     "1.12@" PVR_STR2(PVRVERSION_BUILD) ""
+#define PVRVERSION_STRING           "SGX_DDK_Linux_XOrg sgxddk 1.14@" PVR_STR2(PVRVERSION_BUILD)
+#define PVRVERSION_STRING_SHORT     "1.14@" PVR_STR2(PVRVERSION_BUILD) ""
 
 #define COPYRIGHT_TXT               "Copyright (c) Imagination Technologies Ltd. All Rights Reserved."
 
-#define PVRVERSION_BUILD_HI          291
-#define PVRVERSION_BUILD_LO          7986
+#define PVRVERSION_BUILD_HI          400
+#define PVRVERSION_BUILD_LO          1660
 #define PVRVERSION_STRING_NUMERIC    PVR_STR2(PVRVERSION_MAJ) "." PVR_STR2(PVRVERSION_MIN) "." PVR_STR2(PVRVERSION_BUILD_HI) "." PVR_STR2(PVRVERSION_BUILD_LO)
 
 #endif /* _PVRVERSION_H_ */
diff --git a/jacinto6/sgx_src/eurasia_km/include4/services.h b/jacinto6/sgx_src/eurasia_km/include4/services.h
index cca0f7d..a5767cb 100644
--- a/jacinto6/sgx_src/eurasia_km/include4/services.h
+++ b/jacinto6/sgx_src/eurasia_km/include4/services.h
@@ -92,7 +92,6 @@ extern "C" {
 #define PVRSRV_MEM_NO_RESMAN                            (1U<<10)
 #define PVRSRV_MEM_EXPORTED                                     (1U<<11)
 
-
 /*
         Heap Attribute flags
         (bits 12-23)
@@ -169,8 +168,6 @@ extern "C" {
 #define PVRSRV_MISC_INFO_GET_REF_COUNT_PRESENT                  (1U<<7)
 #define PVRSRV_MISC_INFO_GET_PAGE_SIZE_PRESENT                  (1U<<8)
 #define PVRSRV_MISC_INFO_FORCE_SWAP_TO_SYSTEM_PRESENT   (1U<<9)
-#define PVRSRV_MISC_INFO_GET_DRM_FD_PRESENT                             (1U<<10)
-#define PVRSRV_MISC_INFO_SET_DRM_FD_PRESENT                             (1U<<11)
 
 #define PVRSRV_MISC_INFO_RESET_PRESENT                                  (1U<<31)
 
@@ -402,6 +399,26 @@ typedef struct _PVRSRV_MEMBLK_
  ******************************************************************************
  * Memory Management (externel interface)
  *****************************************************************************/
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+typedef struct _DEVMEM_UNMAPPING_TIME_STATS_
+{
+        IMG_UINT32      ui32TimeToCPUUnmap;
+        IMG_UINT32      ui32TimeToDevUnmap;
+} DEVMEM_UNMAPPING_TIME_STATS;
+
+typedef struct _PVRSRV_DEVMEM_TIMING_STATS_
+{
+        /* This struct holds time taken to map/unmap device memory into CPU/GPU in microsec granularity */
+        struct
+        {
+                IMG_UINT32      ui32TimeToCPUMap;
+                IMG_UINT32      ui32TimeToDevMap;
+        } sDevMemMapTimes;
+
+        DEVMEM_UNMAPPING_TIME_STATS *psDevMemUnmapTimes;        /* User supplied space for "unmap" timings */
+} PVRSRV_DEVMEM_TIMING_STATS;
+#endif
+
 typedef struct _PVRSRV_KERNEL_MEM_INFO_ *PPVRSRV_KERNEL_MEM_INFO;
 
 typedef struct _PVRSRV_CLIENT_MEM_INFO_
@@ -446,12 +463,16 @@ typedef struct _PVRSRV_CLIENT_MEM_INFO_
         IMG_UINT32                                                      dummy2;
         #endif /* !defined(USE_CODE) */
 #endif /* defined(SUPPORT_MEMINFO_IDS) */
-#if defined(SUPPORT_DRM_GEM)
-        IMG_SIZE_T                                                      uiDmabufBufferSize;
-#endif /* defined(SUPPORT_DRM_GEM) */
 #if defined(SUPPORT_ION)
         IMG_SIZE_T                                                      uiIonBufferSize;
 #endif /* defined(SUPPORT_ION) */
+#if defined(SUPPORT_DMABUF)
+        IMG_SIZE_T                                                      uiDmaBufSize;
+#endif /* defined(SUPPORT_ION) */
+
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+        PVRSRV_DEVMEM_TIMING_STATS                      sDevMemTimingStats;
+#endif
 
         /*
                 ptr to next mem info
@@ -582,7 +603,6 @@ typedef struct _PVRSRV_MISC_INFO_
         } sGetRefCountCtl;
 
         IMG_UINT32 ui32PageSize;
-        IMG_INT32 iDrmFd;
 } PVRSRV_MISC_INFO;
 
 /*!
@@ -784,21 +804,6 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVMapDeviceMemory2(IMG_CONST PVRSRV_DEV_DATA	*psDe
                                                                                                  PVRSRV_CLIENT_MEM_INFO         **ppsDstMemInfo);
 #endif /* defined(LINUX) */
 
-#if defined(SUPPORT_DRM_GEM)
-PVRSRV_ERROR PVRSRVMapDmabuf(const PVRSRV_DEV_DATA *psDevData,
-                                                                IMG_HANDLE hDevMemHeap,
-                                                                IMG_UINT32 ui32NumFDs,
-                                                                IMG_INT    *paiBufferFDs,
-                                                                IMG_UINT32 ui32ChunkCount,
-                                                                IMG_SIZE_T *pauiOffset,
-                                                                IMG_SIZE_T *pauiSize,
-                                                                IMG_UINT32 ui32Attribs,
-                                                                PVRSRV_CLIENT_MEM_INFO **ppsMemInfo);
-
-PVRSRV_ERROR PVRSRVUnmapDmabuf(const PVRSRV_DEV_DATA *psDevData,
-                                                                  PVRSRV_CLIENT_MEM_INFO *psMemInfo);
-#endif /* defined (SUPPORT_DRM_GEM) */
-
 #if defined(SUPPORT_ION)
 PVRSRV_ERROR PVRSRVMapIonHandle(const PVRSRV_DEV_DATA *psDevData,
                                                                 IMG_HANDLE hDevMemHeap,
@@ -814,6 +819,29 @@ PVRSRV_ERROR PVRSRVUnmapIonHandle(const PVRSRV_DEV_DATA *psDevData,
                                                                   PVRSRV_CLIENT_MEM_INFO *psMemInfo);
 #endif /* defined (SUPPORT_ION) */
 
+#if defined(SUPPORT_DMABUF)
+IMG_IMPORT
+PVRSRV_ERROR PVRSRVMapDmaBufs(const PVRSRV_DEV_DATA *psDevData,
+                                                                const IMG_HANDLE hDevMemHeap,
+                                                                const IMG_UINT32 ui32Attribs,
+                                                                const IMG_UINT32 ui32NumFDs,
+                                                                const IMG_INT *piDmaBufFD,
+                                                                const IMG_SIZE_T *puiDmaBufOffset,
+                                                                const IMG_SIZE_T *puiDmaBufSize,
+                                                                PVRSRV_CLIENT_MEM_INFO **ppsMemInfo,
+                                                                IMG_SIZE_T *puiMemInfoOffset);
+
+IMG_IMPORT
+PVRSRV_ERROR PVRSRVMapDmaBuf(const PVRSRV_DEV_DATA *psDevData,
+                                                                const IMG_HANDLE hDevMemHeap,
+                                                                const IMG_INT iDmaBufFD,
+                                                                const IMG_UINT32 ui32Attribs,
+                                                                PVRSRV_CLIENT_MEM_INFO **ppsMemInfo);
+
+IMG_IMPORT
+PVRSRV_ERROR PVRSRVUnmapDmaBuf(const PVRSRV_DEV_DATA *psDevData,
+                                                                  PVRSRV_CLIENT_MEM_INFO *psMemInfo);
+#endif /* SUPPORT_DMABUF */
 
 IMG_IMPORT
 PVRSRV_ERROR IMG_CALLCONV PVRSRVAllocDeviceMemSparse(const PVRSRV_DEV_DATA *psDevData,
diff --git a/jacinto6/sgx_src/eurasia_km/include4/servicesext.h b/jacinto6/sgx_src/eurasia_km/include4/servicesext.h
index a0aff8c..ffb89b9 100644
--- a/jacinto6/sgx_src/eurasia_km/include4/servicesext.h
+++ b/jacinto6/sgx_src/eurasia_km/include4/servicesext.h
@@ -762,6 +762,9 @@ typedef struct PVRSRV_RESOURCE_TAG
 {
         volatile IMG_UINT32 ui32Lock;
         IMG_UINT32                      ui32ID;
+#if !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__)
+        IMG_VOID                        *pOSSyncPrimitive;
+#endif /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
 }PVRSRV_RESOURCE;
 typedef PVRSRV_RESOURCE PVRSRV_RES_HANDLE;
 
@@ -925,12 +928,17 @@ typedef struct _PVRSRV_REGISTRY_INFO_
 PVRSRV_ERROR IMG_CALLCONV PVRSRVReadRegistryString (PPVRSRV_REGISTRY_INFO psRegInfo);
 PVRSRV_ERROR IMG_CALLCONV PVRSRVWriteRegistryString (PPVRSRV_REGISTRY_INFO psRegInfo);
 
+#define PVRSRV_BC_FLAGS_YUVCSC_RANGE_MASK               (0x01)
+#define PVRSRV_BC_FLAGS_YUVCSC_RANGE_SHIFT              (0x00)
+#define PVRSRV_BC_FLAGS_YUVCSC_CONFORMANT_RANGE (0 << PVRSRV_BC_FLAGS_YUVCSC_RANGE_SHIFT)
+#define PVRSRV_BC_FLAGS_YUVCSC_FULL_RANGE               (1 << PVRSRV_BC_FLAGS_YUVCSC_RANGE_SHIFT)
 
-#define PVRSRV_BC_FLAGS_YUVCSC_CONFORMANT_RANGE (0 << 0)
-#define PVRSRV_BC_FLAGS_YUVCSC_FULL_RANGE               (1 << 0)
+#define PVRSRV_BC_FLAGS_YUVCSC_CS_MASK                  (0x02)
+#define PVRSRV_BC_FLAGS_YUVCSC_CS_SHIFT                 (0x01)
+#define PVRSRV_BC_FLAGS_YUVCSC_BT601                    (0 << PVRSRV_BC_FLAGS_YUVCSC_CS_SHIFT)
+#define PVRSRV_BC_FLAGS_YUVCSC_BT709                    (1 << PVRSRV_BC_FLAGS_YUVCSC_CS_SHIFT)
 
-#define PVRSRV_BC_FLAGS_YUVCSC_BT601                    (0 << 1)
-#define PVRSRV_BC_FLAGS_YUVCSC_BT709                    (1 << 1)
+#define PVRSRV_BC_FLAGS_YUVCSC_MASK                             (PVRSRV_BC_FLAGS_YUVCSC_RANGE_MASK | PVRSRV_BC_FLAGS_YUVCSC_CS_MASK)
 
 #define MAX_BUFFER_DEVICE_NAME_SIZE     (50) /* arbitrary choice! */
 
diff --git a/jacinto6/sgx_src/eurasia_km/include4/sgxapi_km.h b/jacinto6/sgx_src/eurasia_km/include4/sgxapi_km.h
index d001e6f..6453db6 100644
--- a/jacinto6/sgx_src/eurasia_km/include4/sgxapi_km.h
+++ b/jacinto6/sgx_src/eurasia_km/include4/sgxapi_km.h
@@ -84,7 +84,12 @@ extern "C" {
 #define SGX_VPB_TILED_HEAP_ID                   14
 #endif
 
-#define SGX_MAX_HEAP_ID                                                 15
+#if defined(SGX_FEATURE_ADDRESS_SPACE_EXTENSION)
+                #define SGX_TEXTURE_HEAP_ID                     15      
+                #define SGX_MAX_HEAP_ID                         16      
+#else
+                #define SGX_MAX_HEAP_ID                                                 15
+#endif
 
 /*
  * Keep SGX_3DPARAMETERS_HEAP_ID as TQ full custom
@@ -106,20 +111,12 @@ extern "C" {
 #define SGX_MAX_TA_STATUS_VALS  32
 #define SGX_MAX_3D_STATUS_VALS  4
 
-#if defined(SUPPORT_SGX_GENERALISED_SYNCOBJECTS)
-/* sync info structure array size */
-#define SGX_MAX_TA_DST_SYNCS                    1
-#define SGX_MAX_TA_SRC_SYNCS                    1
-#define SGX_MAX_3D_SRC_SYNCS                    4
-/* note: there is implicitly 1 3D Dst Sync */
-#else
 /* sync info structure array size */
 #define SGX_MAX_SRC_SYNCS_TA                            32
 #define SGX_MAX_DST_SYNCS_TA                            1
 /* note: only one dst sync is supported by the 2D paths */
 #define SGX_MAX_SRC_SYNCS_TQ                            6
 #define SGX_MAX_DST_SYNCS_TQ                            2
-#endif
 
 
 #if defined(SGX_FEATURE_EXTENDED_PERF_COUNTERS)
diff --git a/jacinto6/sgx_src/eurasia_km/services4/3rdparty/dc_nohw/dc_nohw_displayclass.c b/jacinto6/sgx_src/eurasia_km/services4/3rdparty/dc_nohw/dc_nohw_displayclass.c
index 5a6f99f..9000e96 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/3rdparty/dc_nohw/dc_nohw_displayclass.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/3rdparty/dc_nohw/dc_nohw_displayclass.c
@@ -353,6 +353,7 @@ static PVRSRV_ERROR CreateDCSwapChain(IMG_HANDLE hDevice,
         DC_NOHW_SWAPCHAIN *psSwapChain;
         DC_NOHW_BUFFER *psBuffer;
         IMG_UINT32 i;
+        PVRSRV_ERROR eError;
 
         UNREFERENCED_PARAMETER(ui32OEMFlags);
         UNREFERENCED_PARAMETER(pui32SwapChainID);
@@ -386,11 +387,11 @@ static PVRSRV_ERROR CreateDCSwapChain(IMG_HANDLE hDevice,
 
         if (ui32BufferCount)
         {
-        
                 /* check the buffer count */
                 if(ui32BufferCount > DC_NOHW_MAX_BACKBUFFERS)
                 {
-                        return (PVRSRV_ERROR_TOOMANYBUFFERS);
+                        eError = PVRSRV_ERROR_TOOMANYBUFFERS;
+                        goto ExitError;
                 }
         
                 /*
@@ -403,7 +404,8 @@ static PVRSRV_ERROR CreateDCSwapChain(IMG_HANDLE hDevice,
                 || psDstSurfAttrib->sDims.ui32Height != psDevInfo->sSysDims.ui32Height)
                 {
                         /* DST doesn't match the current mode */
-                        return (PVRSRV_ERROR_INVALID_PARAMS);
+                        eError = PVRSRV_ERROR_INVALID_PARAMS;
+                        goto ExitError;
                 }
         
                 if(psDstSurfAttrib->pixelformat != psSrcSurfAttrib->pixelformat
@@ -412,19 +414,18 @@ static PVRSRV_ERROR CreateDCSwapChain(IMG_HANDLE hDevice,
                 || psDstSurfAttrib->sDims.ui32Height != psSrcSurfAttrib->sDims.ui32Height)
                 {
                         /* DST doesn't match the SRC */
-                        return (PVRSRV_ERROR_INVALID_PARAMS);
+                        eError = PVRSRV_ERROR_INVALID_PARAMS;
+                        goto ExitError;
                 }
         
                 /* INTEGRATION_POINT: check the flags */
                 UNREFERENCED_PARAMETER(ui32Flags);
         
-        
-        
                 psBuffer = (DC_NOHW_BUFFER*)AllocKernelMem(sizeof(DC_NOHW_BUFFER) * ui32BufferCount);
                 if(!psBuffer)
                 {
-                        FreeKernelMem(psSwapChain);
-                        return (PVRSRV_ERROR_OUT_OF_MEMORY);
+                        eError = PVRSRV_ERROR_OUT_OF_MEMORY;
+                        goto ExitError;
                 }
         
                 /* initialise allocations */
@@ -469,6 +470,10 @@ static PVRSRV_ERROR CreateDCSwapChain(IMG_HANDLE hDevice,
         /* INTEGRATION_POINT: enable Vsync ISR */
 
         return (PVRSRV_OK);
+
+ExitError:
+        FreeKernelMem(psSwapChain);
+        return eError;
 }
 
 
@@ -644,7 +649,7 @@ static IMG_BOOL ProcessFlip(IMG_HANDLE	hCmdCookie,
         /* validate data packet */
         psFlipCmd = (DISPLAYCLASS_FLIP_COMMAND*)pvData;
         /* Under android, this may be a DISPLAYCLASS_FLIP_COMMAND2, but the structs
-         * are compatable for everything used by dc_nohw so it makes no difference */
+         * are compatible for everything used by dc_nohw so it makes no difference */
         if (psFlipCmd == IMG_NULL)
         {
                 return (IMG_FALSE);
diff --git a/jacinto6/sgx_src/eurasia_km/services4/3rdparty/dc_omapfb3_linux/omaplfb_displayclass.c b/jacinto6/sgx_src/eurasia_km/services4/3rdparty/dc_omapfb3_linux/omaplfb_displayclass.c
index 7af5703..be168c3 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/3rdparty/dc_omapfb3_linux/omaplfb_displayclass.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/3rdparty/dc_omapfb3_linux/omaplfb_displayclass.c
@@ -93,11 +93,7 @@ extern struct ion_device *omap_ion_device;
 #error CONFIG_DSSCOMP support requires CONFIG_ION_OMAP
 #endif /* defined(CONFIG_ION_OMAP) */
 #if defined(CONFIG_DRM_OMAP_DMM_TILER)
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,8,0))
-#include <../drivers/gpu/drm/omapdrm/omap_dmm_tiler.h>
-#else
 #include <../drivers/staging/omapdrm/omap_dmm_tiler.h>
-#endif
 #include <../drivers/video/omap2/dsscomp/tiler-utils.h>
 #elif defined(CONFIG_TI_TILER)
 #include <mach/tiler.h>
@@ -972,10 +968,7 @@ void OMAPLFBSwapHandler(OMAPLFB_BUFFER *psBuffer)
                                 if (bPreviouslyNotVSynced || psSwapChain->iBlankEvents != iBlankEvents)
                                 {
                                         psSwapChain->iBlankEvents = iBlankEvents;
-                                        if (eMode == OMAPLFB_UPDATE_MODE_AUTO)
-                                        {
-                                                psSwapChain->bNotVSynced = !WaitForVSyncSettle(psDevInfo);
-                                        }
+                                        psSwapChain->bNotVSynced = !WaitForVSyncSettle(psDevInfo);
                                 } else if (psBuffer->ulSwapInterval != 0)
                                 {
                                         psSwapChain->bNotVSynced = !OMAPLFBWaitForVSync(psDevInfo);
diff --git a/jacinto6/sgx_src/eurasia_km/services4/3rdparty/dc_omapfb3_linux/omaplfb_linux.c b/jacinto6/sgx_src/eurasia_km/services4/3rdparty/dc_omapfb3_linux/omaplfb_linux.c
index 2374784..c8072f5 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/3rdparty/dc_omapfb3_linux/omaplfb_linux.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/3rdparty/dc_omapfb3_linux/omaplfb_linux.c
@@ -106,11 +106,17 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * OmapZoom.org OMAP4 2.6.34 kernel tree        - Needs plat/vrfb.h
  * Sholes 2.6.32 kernel tree                    - Needs plat/vrfb.h
  */
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,8,0))
+#if defined(SYS_OMAP5_UEVM)
+#define PVR_OMAPFB3_OMAP5_UEVM
+#endif
+
+#if defined(PVR_OMAPFB3_OMAP5_UEVM)
 #define PVR_OMAPFB3_NEEDS_VIDEO_OMAPVRFB_H
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,34))
+#else
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,34))
 #define PVR_OMAPFB3_NEEDS_PLAT_VRFB_H
 #endif
+#endif
 
 #if defined(PVR_OMAPFB3_NEEDS_VIDEO_OMAPVRFB_H)
 #include <video/omapvrfb.h>
@@ -141,11 +147,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 #if defined(CONFIG_DSSCOMP)
 #if defined(CONFIG_DRM_OMAP_DMM_TILER)
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,8,0))
-#include <../drivers/gpu/drm/omapdrm/omap_dmm_tiler.h>
-#else
 #include <../drivers/staging/omapdrm/omap_dmm_tiler.h>
-#endif
 #include <../drivers/video/omap2/dsscomp/tiler-utils.h>
 #elif defined(CONFIG_TI_TILER)
 #include <mach/tiler.h>
@@ -179,11 +181,6 @@ MODULE_SUPPORTED_DEVICE(DEVNAME);
 #define OMAP_DSS_MANAGER(man, dev) struct omap_overlay_manager *man = (dev)->output->manager
 #define WAIT_FOR_VSYNC(man)     ((man)->wait_for_vsync)
 #else   /* defined(PVR_OMAPFB3_OMAP5_UEVM) */
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,8,0))
-#define OMAP_DSS_DRIVER(drv, dev) struct omap_dss_driver *drv = (dev)->driver
-#define OMAP_DSS_MANAGER(man, dev) struct omap_overlay_manager *man = (dev)->output->manager
-#define WAIT_FOR_VSYNC(man)     ((man)->wait_for_vsync)
-#else /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3,8,0)) */
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,34))
 #define OMAP_DSS_DRIVER(drv, dev) struct omap_dss_driver *drv = (dev) != NULL ? (dev)->driver : NULL
 #define OMAP_DSS_MANAGER(man, dev) struct omap_overlay_manager *man = (dev) != NULL ? (dev)->manager : NULL
@@ -193,7 +190,6 @@ MODULE_SUPPORTED_DEVICE(DEVNAME);
 #define OMAP_DSS_MANAGER(man, dev) struct omap_dss_device *man = (dev)
 #define WAIT_FOR_VSYNC(man)     ((man)->wait_vsync)
 #endif  /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,34)) */
-#endif  /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3,8,0)) */
 #endif  /* defined(PVR_OMAPFB3_OMAP5_UEVM) */
 #endif  /* !defined(PVR_OMAPLFB_DRM_FB) */
 
diff --git a/jacinto6/sgx_src/eurasia_km/services4/include/ion_sys_private.h b/jacinto6/sgx_src/eurasia_km/services4/include/ion_sys_private.h
new file mode 100644
index 0000000..8b2c467
--- /dev/null
+++ b/jacinto6/sgx_src/eurasia_km/services4/include/ion_sys_private.h
@@ -0,0 +1,50 @@
+/*************************************************************************/ /*!
+@File           ion_sys_private.h
+@Title          System-specific private data for ion support code
+@Copyright      Copyright (c) Imagination Technologies Ltd. All Rights Reserved
+@License        Dual MIT/GPLv2
+
+The contents of this file are subject to the MIT license as set out below.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+Alternatively, the contents of this file may be used under the terms of
+the GNU General Public License Version 2 ("GPL") in which case the provisions
+of GPL are applicable instead of those above.
+
+If you wish to allow use of your version of this file only under the terms of
+GPL, and not to allow others to use your version of this file under the terms
+of the MIT license, indicate your decision by deleting the provisions above
+and replace them with the notice and other provisions required by GPL as set
+out in the file called "GPL-COPYING" included in this distribution. If you do
+not delete the provisions above, a recipient may use your version of this file
+under the terms of either the MIT license or GPL.
+
+This License is also included in this distribution in the file called
+"MIT-COPYING".
+
+EXCEPT AS OTHERWISE STATED IN A NEGOTIATED AGREEMENT: (A) THE SOFTWARE IS
+PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
+BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE AND NONINFRINGEMENT; AND (B) IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/ /**************************************************************************/
+
+#include SUPPORT_ION_HEADER
+
+typedef struct
+{
+        ion_phys_addr_t uiHeapBase;
+        size_t uiHeapSize;
+        IMG_CPU_PHYADDR sPCIAddrRangeStart;
+} ION_TC_PRIVATE_DATA;
diff --git a/jacinto6/sgx_src/eurasia_km/services4/include/kerneldisplay.h b/jacinto6/sgx_src/eurasia_km/services4/include/kerneldisplay.h
index 048cb43..fe6ec15 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/include/kerneldisplay.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/include/kerneldisplay.h
@@ -166,6 +166,9 @@ typedef struct DISPLAYCLASS_FLIP_COMMAND_TAG
         /* Ext SwapChain Handle */
         IMG_HANDLE hExtSwapChain;
 
+        /* number of vsync intervals between successive flips */
+        IMG_UINT32      ui32SwapInterval;
+        
         /* Ext Buffer Handle (Buffer to Flip to) */
         IMG_HANDLE hExtBuffer;
 
@@ -178,9 +181,6 @@ typedef struct DISPLAYCLASS_FLIP_COMMAND_TAG
         /* clip rects */
         IMG_RECT *psClipRect;
 
-        /* number of vsync intervals between successive flips */
-        IMG_UINT32      ui32SwapInterval;
-
 } DISPLAYCLASS_FLIP_COMMAND;
 
 
@@ -192,12 +192,12 @@ typedef struct DISPLAYCLASS_FLIP_COMMAND2_TAG
         /* Ext SwapChain Handle */
         IMG_HANDLE hExtSwapChain;
 
-        /* Unused field, padding for compatibility with above structure */
-        IMG_HANDLE hUnused;
-
         /* number of vsync intervals between successive flips */
         IMG_UINT32 ui32SwapInterval;
 
+        /* Unused field, padding for compatibility with above structure */
+        IMG_HANDLE hUnused;
+
         /* private data from userspace */
         IMG_PVOID  pvPrivData;
 
diff --git a/jacinto6/sgx_src/eurasia_km/services4/include/pvr_bridge.h b/jacinto6/sgx_src/eurasia_km/services4/include/pvr_bridge.h
index f8e1439..8b37e39 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/include/pvr_bridge.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/include/pvr_bridge.h
@@ -121,11 +121,22 @@ extern "C" {
 #define PVRSRV_BRIDGE_CHG_DEV_MEM_ATTRIBS               PVRSRV_IOWR(PVRSRV_BRIDGE_CORE_CMD_FIRST+26)
 #define PVRSRV_BRIDGE_MAP_DEV_MEMORY_2                  PVRSRV_IOWR(PVRSRV_BRIDGE_CORE_CMD_FIRST+27)
 #define PVRSRV_BRIDGE_EXPORT_DEVICEMEM_2                PVRSRV_IOWR(PVRSRV_BRIDGE_CORE_CMD_FIRST+28)
-#define PVRSRV_BRIDGE_MAP_DMABUF                        PVRSRV_IOWR(PVRSRV_BRIDGE_CORE_CMD_FIRST+29)
-#define PVRSRV_BRIDGE_UNMAP_DMABUF                      PVRSRV_IOWR(PVRSRV_BRIDGE_CORE_CMD_FIRST+30)
-#define PVRSRV_BRIDGE_MAP_ION_HANDLE                    PVRSRV_IOWR(PVRSRV_BRIDGE_CORE_CMD_FIRST+31)
-#define PVRSRV_BRIDGE_UNMAP_ION_HANDLE                  PVRSRV_IOWR(PVRSRV_BRIDGE_CORE_CMD_FIRST+32)
-#define PVRSRV_BRIDGE_CORE_CMD_LAST                             (PVRSRV_BRIDGE_CORE_CMD_FIRST+32)
+#if defined (SUPPORT_ION)
+#define PVRSRV_BRIDGE_MAP_ION_HANDLE                    PVRSRV_IOWR(PVRSRV_BRIDGE_CORE_CMD_FIRST+29)
+#define PVRSRV_BRIDGE_UNMAP_ION_HANDLE                  PVRSRV_IOWR(PVRSRV_BRIDGE_CORE_CMD_FIRST+30)
+#define PVRSRV_BRIDGE_ION_CMD_LAST                      (PVRSRV_BRIDGE_CORE_CMD_FIRST+30)
+#else
+#define PVRSRV_BRIDGE_ION_CMD_LAST                      (PVRSRV_BRIDGE_CORE_CMD_FIRST+28)
+#endif
+#if defined (SUPPORT_DMABUF)
+#define PVRSRV_BRIDGE_DMABUF_CMD_FIRST                  (PVRSRV_BRIDGE_ION_CMD_LAST+1)
+#define PVRSRV_BRIDGE_MAP_DMABUF                        PVRSRV_IOWR(PVRSRV_BRIDGE_DMABUF_CMD_FIRST+0)
+#define PVRSRV_BRIDGE_UNMAP_DMABUF                      PVRSRV_IOWR(PVRSRV_BRIDGE_DMABUF_CMD_FIRST+1)
+#define PVRSRV_BRIDGE_DMABUF_CMD_LAST                   (PVRSRV_BRIDGE_DMABUF_CMD_FIRST+1)
+#else
+#define PVRSRV_BRIDGE_DMABUF_CMD_LAST                   PVRSRV_BRIDGE_ION_CMD_LAST
+#endif
+#define PVRSRV_BRIDGE_CORE_CMD_LAST                     PVRSRV_BRIDGE_DMABUF_CMD_LAST
 /* SIM */
 #define PVRSRV_BRIDGE_SIM_CMD_FIRST                             (PVRSRV_BRIDGE_CORE_CMD_LAST+1)
 #define PVRSRV_BRIDGE_PROCESS_SIMISR_EVENT              PVRSRV_IOWR(PVRSRV_BRIDGE_SIM_CMD_FIRST+0)      /*!< RTSIM pseudo ISR */
@@ -531,58 +542,56 @@ typedef struct PVRSRV_BRIDGE_IN_EXPORTDEVICEMEM_TAG
 }PVRSRV_BRIDGE_IN_EXPORTDEVICEMEM;
 
 /******************************************************************************
- *      'bridge in' map dmabuf
+ *      'bridge in' map ion handle
  *****************************************************************************/
-#define DMABUF_IMPORT_MAX_FDS 3
-#define DMABUF_IMPORT_MAX_CHUNK_COUNT 3
-typedef struct _PVRSRV_BRIDGE_IN_MAP_DMABUF_
+#define ION_IMPORT_MAX_FDS 3
+#define ION_IMPORT_MAX_CHUNK_COUNT 3
+typedef struct _PVRSRV_BRIDGE_IN_MAP_ION_HANDLE_
 {
         IMG_UINT32                      ui32BridgeFlags; /* Must be first member of structure */
         IMG_UINT32                      ui32NumFDs;
-        IMG_INT32                       ai32BufferFDs[DMABUF_IMPORT_MAX_FDS];
+        IMG_INT32                       ai32BufferFDs[ION_IMPORT_MAX_FDS];
         IMG_UINT32                      ui32Attribs;
         IMG_UINT32                      ui32ChunkCount;
-        IMG_SIZE_T                      auiOffset[DMABUF_IMPORT_MAX_CHUNK_COUNT];
-        IMG_SIZE_T                      auiSize[DMABUF_IMPORT_MAX_CHUNK_COUNT];
+        IMG_SIZE_T                      auiOffset[ION_IMPORT_MAX_CHUNK_COUNT];
+        IMG_SIZE_T                      auiSize[ION_IMPORT_MAX_CHUNK_COUNT];
         IMG_HANDLE                      hDevCookie;
         IMG_HANDLE                      hDevMemHeap;
-} PVRSRV_BRIDGE_IN_MAP_DMABUF;
+} PVRSRV_BRIDGE_IN_MAP_ION_HANDLE;
 
 /******************************************************************************
- *      'bridge in' unmap dmabuf
+ *      'bridge in' unmap ion handle
  *****************************************************************************/
-typedef struct PVRSRV_BRIDGE_IN_UNMAP_DMABUF_TAG
+typedef struct PVRSRV_BRIDGE_IN_UNMAP_ION_HANDLE_TAG
 {
         IMG_UINT32              ui32BridgeFlags; /* Must be first member of structure */
         PVRSRV_KERNEL_MEM_INFO  *psKernelMemInfo;
-}PVRSRV_BRIDGE_IN_UNMAP_DMABUF;
+}PVRSRV_BRIDGE_IN_UNMAP_ION_HANDLE;
 
+#define DMABUF_IMPORT_MAX_FDS 3
 /******************************************************************************
- *      'bridge in' map ion handle
+ *      'bridge in' map dmabuf
  *****************************************************************************/
-#define ION_IMPORT_MAX_FDS 3
-#define ION_IMPORT_MAX_CHUNK_COUNT 3
-typedef struct _PVRSRV_BRIDGE_IN_MAP_ION_HANDLE_
+typedef struct _PVRSRV_BRIDGE_IN_MAP_DMABUF_
 {
         IMG_UINT32                      ui32BridgeFlags; /* Must be first member of structure */
         IMG_UINT32                      ui32NumFDs;
-        IMG_INT32                       ai32BufferFDs[ION_IMPORT_MAX_FDS];
+        IMG_INT32                       ai32FD[DMABUF_IMPORT_MAX_FDS];
+        IMG_SIZE_T                      auiOffset[DMABUF_IMPORT_MAX_FDS];
+        IMG_SIZE_T                      auiSize[DMABUF_IMPORT_MAX_FDS];
         IMG_UINT32                      ui32Attribs;
-        IMG_UINT32                      ui32ChunkCount;
-        IMG_SIZE_T                      auiOffset[ION_IMPORT_MAX_CHUNK_COUNT];
-        IMG_SIZE_T                      auiSize[ION_IMPORT_MAX_CHUNK_COUNT];
         IMG_HANDLE                      hDevCookie;
         IMG_HANDLE                      hDevMemHeap;
-} PVRSRV_BRIDGE_IN_MAP_ION_HANDLE;
+} PVRSRV_BRIDGE_IN_MAP_DMABUF;
 
 /******************************************************************************
- *      'bridge in' unmap ion handle
+ *      'bridge in' unmap dmabuf
  *****************************************************************************/
-typedef struct PVRSRV_BRIDGE_IN_UNMAP_ION_HANDLE_TAG
+typedef struct PVRSRV_BRIDGE_IN_UNMAP_DMABUF_TAG
 {
         IMG_UINT32              ui32BridgeFlags; /* Must be first member of structure */
         PVRSRV_KERNEL_MEM_INFO  *psKernelMemInfo;
-}PVRSRV_BRIDGE_IN_UNMAP_ION_HANDLE;
+}PVRSRV_BRIDGE_IN_UNMAP_DMABUF;
 
 /******************************************************************************
  *      'bridge in' get free device memory
@@ -1418,6 +1427,19 @@ typedef struct PVRSRV_BRIDGE_OUT_ALLOCDEVICEMEM_TAG
 
 
 /******************************************************************************
+ *      'bridge out' free device memory
+ *****************************************************************************/
+typedef struct PVRSRV_BRIDGE_OUT_FREEDEVICEMEM_TAG
+{
+        PVRSRV_ERROR            eError;
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+        IMG_UINT32                              ui32TimeToDevUnmap;
+#endif
+
+} PVRSRV_BRIDGE_OUT_FREEDEVICEMEM;
+
+
+/******************************************************************************
  *      'bridge out' export device memory
  *****************************************************************************/
 typedef struct PVRSRV_BRIDGE_OUT_EXPORTDEVICEMEM_TAG
@@ -1432,31 +1454,30 @@ typedef struct PVRSRV_BRIDGE_OUT_EXPORTDEVICEMEM_TAG
 
 
 /******************************************************************************
- *      'bridge out' map dmabuf
+ *      'bridge out' map ion handle
  *****************************************************************************/
-typedef struct _PVRSRV_BRIDGE_OUT_MAP_DMABUF_
+typedef struct _PVRSRV_BRIDGE_OUT_MAP_ION_HANDLE_
 {
         PVRSRV_ERROR            eError;
         PVRSRV_KERNEL_MEM_INFO  *psKernelMemInfo;
         PVRSRV_CLIENT_MEM_INFO  sClientMemInfo;
         PVRSRV_CLIENT_SYNC_INFO sClientSyncInfo;
-        IMG_SIZE_T                              uiDmabufBufferSize;
+        IMG_SIZE_T                              uiIonBufferSize;
 
-} PVRSRV_BRIDGE_OUT_MAP_DMABUF;
+} PVRSRV_BRIDGE_OUT_MAP_ION_HANDLE;
 
 /******************************************************************************
- *      'bridge out' map ion handle
+ *      'bridge out' map dmabuf
  *****************************************************************************/
-typedef struct _PVRSRV_BRIDGE_OUT_MAP_ION_HANDLE_
+typedef struct _PVRSRV_BRIDGE_OUT_MAP_DMABUF_
 {
         PVRSRV_ERROR            eError;
         PVRSRV_KERNEL_MEM_INFO  *psKernelMemInfo;
         PVRSRV_CLIENT_MEM_INFO  sClientMemInfo;
         PVRSRV_CLIENT_SYNC_INFO sClientSyncInfo;
-        IMG_SIZE_T                              uiIonBufferSize;
-
-} PVRSRV_BRIDGE_OUT_MAP_ION_HANDLE;
-
+        IMG_SIZE_T              uiSize;
+        IMG_SIZE_T              auiOffset[DMABUF_IMPORT_MAX_FDS];
+} PVRSRV_BRIDGE_OUT_MAP_DMABUF;
 
 /******************************************************************************
  *      'bridge out' map meminfo to user mode
diff --git a/jacinto6/sgx_src/eurasia_km/services4/include/pvr_bridge_km.h b/jacinto6/sgx_src/eurasia_km/services4/include/pvr_bridge_km.h
index 28c1268..d93e530 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/include/pvr_bridge_km.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/include/pvr_bridge_km.h
@@ -145,9 +145,9 @@ IMG_IMPORT
 PVRSRV_ERROR IMG_CALLCONV PVRSRVFreeDeviceMemKM(IMG_HANDLE                      hDevCookie,
                                                                                                 PVRSRV_KERNEL_MEM_INFO  *psMemInfo);
 
-#if defined(SUPPORT_DRM_GEM)
+#if defined(SUPPORT_ION)
 IMG_IMPORT
-PVRSRV_ERROR PVRSRVMapDmabufKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
+PVRSRV_ERROR PVRSRVMapIonHandleKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
                                                                   IMG_HANDLE hDevCookie,
                                                                   IMG_HANDLE hDevMemHeap,
                                                                   IMG_UINT32 ui32NumFDs,
@@ -161,27 +161,27 @@ PVRSRV_ERROR PVRSRVMapDmabufKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
                                                                   IMG_UINT64 *pui64Stamp);
 
 IMG_IMPORT
-PVRSRV_ERROR IMG_CALLCONV PVRSRVUnmapDmabufKM(PVRSRV_KERNEL_MEM_INFO *psMemInfo);
-#endif /* SUPPORT_DRM_GEM */
+PVRSRV_ERROR IMG_CALLCONV PVRSRVUnmapIonHandleKM(PVRSRV_KERNEL_MEM_INFO *psMemInfo);
+#endif /* SUPPORT_ION */
 
-#if defined(SUPPORT_ION)
+#if defined(SUPPORT_DMABUF)
 IMG_IMPORT
-PVRSRV_ERROR PVRSRVMapIonHandleKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
+PVRSRV_ERROR PVRSRVMapDmaBufKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
                                                                   IMG_HANDLE hDevCookie,
                                                                   IMG_HANDLE hDevMemHeap,
-                                                                  IMG_UINT32 ui32NumFDs,
-                                                                  IMG_INT32  *pai32BufferFDs,
                                                                   IMG_UINT32 ui32Flags,
-                                                                  IMG_UINT32 ui32ChunkCount,
-                                                                  IMG_SIZE_T *pauiOffset,
-                                                                  IMG_SIZE_T *pauiSize,
-                                                                  IMG_SIZE_T *puiIonBufferSize,
+                                                                  IMG_UINT32 ui32NumFDs,
+                                                                  IMG_INT32 *pui32DmaBufFD,
+                                                                  IMG_SIZE_T *puiDmaBufOffset,
+                                                                  IMG_SIZE_T *puiDmaBufSize,
                                                                   PVRSRV_KERNEL_MEM_INFO **ppsKernelMemInfo,
+                                                                  IMG_SIZE_T *puiSize,
+                                                                  IMG_SIZE_T *puiMemInfoOffset,
                                                                   IMG_UINT64 *pui64Stamp);
 
 IMG_IMPORT
-PVRSRV_ERROR IMG_CALLCONV PVRSRVUnmapIonHandleKM(PVRSRV_KERNEL_MEM_INFO *psMemInfo);
-#endif /* SUPPORT_ION */
+PVRSRV_ERROR IMG_CALLCONV PVRSRVUnmapDmaBufKM(PVRSRV_KERNEL_MEM_INFO *psMemInfo);
+#endif /* SUPPORT_DMABUF */
 
 IMG_IMPORT
 PVRSRV_ERROR IMG_CALLCONV PVRSRVDissociateDeviceMemKM(IMG_HANDLE                        hDevCookie,
diff --git a/jacinto6/sgx_src/eurasia_km/services4/include/servicesint.h b/jacinto6/sgx_src/eurasia_km/services4/include/servicesint.h
index 4e16475..fa3c0b2 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/include/servicesint.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/include/servicesint.h
@@ -152,7 +152,11 @@ typedef struct _PVRSRV_KERNEL_MEM_INFO_
         /* ptr to associated kernel sync info - NULL if no sync */
         struct _PVRSRV_KERNEL_SYNC_INFO_        *psKernelSyncInfo;
 
-        IMG_HANDLE                              hExternalSyncInfo;
+        IMG_HANDLE                              hIonSyncInfo;
+
+#if defined(SUPPORT_DMABUF)
+        IMG_HANDLE                              hDmaBufSyncInfo;
+#endif
 
         PVRSRV_MEMTYPE                          memType;
 
@@ -186,6 +190,10 @@ typedef struct _PVRSRV_KERNEL_MEM_INFO_
 #if defined (MEM_TRACK_INFO_DEBUG)
         IMG_CHAR heapId[128];
 #endif
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+        IMG_UINT32 ui32TimeToDevMap;
+        IMG_UINT32 *pui32TimeToDevUnmap;        /* API user to provide space for storing "unmap" time */
+#endif
 } PVRSRV_KERNEL_MEM_INFO;
 
 
@@ -220,6 +228,9 @@ typedef struct _PVRSRV_KERNEL_SYNC_INFO_
         /* Unique ID of the sync object */
         IMG_UINT32              ui32UID;
 
+#if defined(SUPPORT_DMABUF)
+        IMG_HANDLE              hFenceContext;
+#endif
         /* Pointer for list manager */
         struct _PVRSRV_KERNEL_SYNC_INFO_ *psNext;
         struct _PVRSRV_KERNEL_SYNC_INFO_ **ppsThis;
diff --git a/jacinto6/sgx_src/eurasia_km/services4/include/sgx_mkif_km.h b/jacinto6/sgx_src/eurasia_km/services4/include/sgx_mkif_km.h
index baab80d..2defa73 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/include/sgx_mkif_km.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/include/sgx_mkif_km.h
@@ -91,7 +91,7 @@ typedef struct _PVRSRV_SGX_KERNEL_CCB_
  *****************************************************************************/
 typedef struct _PVRSRV_SGX_CCB_CTL_
 {
-        IMG_UINT32                              ui32WriteOffset;                /*!< write offset into array of commands (MUST be alligned to 16 bytes!) */
+        IMG_UINT32                              ui32WriteOffset;                /*!< write offset into array of commands (MUST be aligned to 16 bytes!) */
         IMG_UINT32                              ui32ReadOffset;                 /*!< read offset into array of commands */
 } PVRSRV_SGX_CCB_CTL;
 
@@ -177,19 +177,9 @@ typedef struct _SGXMKIF_CMDTA_SHARED_
         /* sync criteria used for TA/3D dependency synchronisation */
         PVRSRV_DEVICE_SYNC_OBJECT       sTA3DDependency;
 
-#if defined(SUPPORT_SGX_GENERALISED_SYNCOBJECTS)
-        /* SRC and DST syncs */
-        IMG_UINT32                                      ui32NumTASrcSyncs;
-        PVRSRV_DEVICE_SYNC_OBJECT       asTASrcSyncs[SGX_MAX_TA_SRC_SYNCS];
-        IMG_UINT32                                      ui32NumTADstSyncs;
-        PVRSRV_DEVICE_SYNC_OBJECT       asTADstSyncs[SGX_MAX_TA_DST_SYNCS];
-        IMG_UINT32                                      ui32Num3DSrcSyncs;
-        PVRSRV_DEVICE_SYNC_OBJECT       as3DSrcSyncs[SGX_MAX_3D_SRC_SYNCS];
-#else
         /* source dependency details */
         IMG_UINT32                      ui32NumSrcSyncs;
         PVRSRV_DEVICE_SYNC_OBJECT       asSrcSyncs[SGX_MAX_SRC_SYNCS_TA];
-#endif
 
         CTL_STATUS                      sCtlTAStatusInfo[SGX_MAX_TA_STATUS_VALS];
         CTL_STATUS                      sCtl3DStatusInfo[SGX_MAX_3D_STATUS_VALS];
@@ -293,8 +283,8 @@ typedef struct _SGXMKIF_HWDEVICE_SYNC_LIST_
  *****************************************************************************/
 #define PVRSRV_USSE_EDM_POWMAN_IDLE_COMPLETE                            (1UL << 2)      /*!< Signal from ukernel->Host indicating SGX is idle */
 #define PVRSRV_USSE_EDM_POWMAN_POWEROFF_COMPLETE                        (1UL << 3)      /*!< Signal from ukernel->Host indicating SGX can be powered down */
-#define PVRSRV_USSE_EDM_POWMAN_POWEROFF_RESTART_IMMEDIATE       (1UL << 4)      /*!< Signal from ukernel->Host indicating there is work to do immediately */
-#define PVRSRV_USSE_EDM_POWMAN_NO_WORK                                          (1UL << 5)      /*!< Signal from ukernel->Host indicating no work to do */
+#define PVRSRV_USSE_EDM_POWMAN_POWEROFF_RESTART_IMMEDIATE       (1UL << 4)      /*!< Signal from ukernel->Host indicating there is work to be done immediately */
+#define PVRSRV_USSE_EDM_POWMAN_NO_WORK                                          (1UL << 5)      /*!< Signal from ukernel->Host indicating nothing to do */
 
 /*!
  *****************************************************************************
diff --git a/jacinto6/sgx_src/eurasia_km/services4/include/sgx_ukernel_status_codes.h b/jacinto6/sgx_src/eurasia_km/services4/include/sgx_ukernel_status_codes.h
index e8c1626..75f186d 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/include/sgx_ukernel_status_codes.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/include/sgx_ukernel_status_codes.h
@@ -261,6 +261,11 @@ MKTC_ST(MKTC_KICKTA_CHKPT_RESET_COMPLETE)
 #define MKTC_KICKTA_CHKPT_CHECK_SWITCH                  0xAD0008A6
 MKTC_ST(MKTC_KICKTA_CHKPT_CHECK_SWITCH)
 
+#define MKTC_KICK_MEM_BURSTER_WA_VDM_START              0xAD0008B1
+MKTC_ST(MKTC_KICK_MEM_BURSTER_WA_VDM_START)
+#define MKTC_TAFINISHED_MEM_BURSTER_WA                  0xAD0008B2
+MKTC_ST(MKTC_TAFINISHED_MEM_BURSTER_WA)
+
 #define MKTC_HOSTKICK_START                                             0xAD000900
 MKTC_ST(MKTC_HOSTKICK_START)
 #define MKTC_HOSTKICK_END                                               0xAD000901
diff --git a/jacinto6/sgx_src/eurasia_km/services4/include/sgxinfo.h b/jacinto6/sgx_src/eurasia_km/services4/include/sgxinfo.h
index 7ffdbc7..513cf3d 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/include/sgxinfo.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/include/sgxinfo.h
@@ -142,6 +142,9 @@ typedef struct _SGX_BRIDGE_INIT_INFO_
         IMG_UINT32 ui32MasterClkGateStatus2Mask;
 #endif /* SGX_FEATURE_MP */
 
+#if defined(SGX_FEATURE_AUTOCLOCKGATING)
+        IMG_BOOL bDisableClockGating;
+#endif
         IMG_UINT32 ui32CacheControl;
 
         IMG_UINT32      asInitDevData[SGX_MAX_DEV_DATA];
@@ -206,19 +209,9 @@ typedef struct _SGX_CCB_KICK_
         /* CCB offset of data structure associated with this kick */
         IMG_UINT32      ui32CCBOffset;
 
-#if defined(SUPPORT_SGX_GENERALISED_SYNCOBJECTS)
-        /* SRC and DST syncs */
-        IMG_UINT32      ui32NumTASrcSyncs;
-        IMG_HANDLE      ahTASrcKernelSyncInfo[SGX_MAX_TA_SRC_SYNCS];
-        IMG_UINT32      ui32NumTADstSyncs;
-        IMG_HANDLE      ahTADstKernelSyncInfo[SGX_MAX_TA_DST_SYNCS];
-        IMG_UINT32      ui32Num3DSrcSyncs;
-        IMG_HANDLE      ah3DSrcKernelSyncInfo[SGX_MAX_3D_SRC_SYNCS];
-#else
         /* SRC syncs */
         IMG_UINT32      ui32NumSrcSyncs;
         IMG_HANDLE      ahSrcKernelSyncInfo[SGX_MAX_SRC_SYNCS_TA];
-#endif
 
         /* TA/3D dependency data */
         IMG_BOOL        bTADependency;
@@ -269,7 +262,6 @@ typedef struct _SGX_CLIENT_INFO_
  *****************************************************************************/
 typedef struct _SGX_INTERNAL_DEVINFO_
 {
-        IMG_UINT32                      ui32Flags;
         IMG_HANDLE                      hHostCtlKernelMemInfoHandle;
         IMG_BOOL                        bForcePTOff;
 } SGX_INTERNAL_DEVINFO;
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/bridged/bridged_pvr_bridge.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/bridged/bridged_pvr_bridge.c
index 40c969c..4a1a758 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/bridged/bridged_pvr_bridge.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/bridged/bridged_pvr_bridge.c
@@ -89,10 +89,8 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
 #if defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC)
+#include <linux/fcntl.h>
 #include <linux/file.h>
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,4,0))
-#include <asm/fcntl.h>
-#endif
 #include <linux/version.h>
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,10,0))
 #include <linux/sync.h>
@@ -667,7 +665,9 @@ PVRSRVAllocDeviceMemBW(IMG_UINT32 ui32BridgeID,
         psAllocDeviceMemOUT->sClientMemInfo.ui32Flags = psMemInfo->ui32Flags;
         psAllocDeviceMemOUT->sClientMemInfo.uAllocSize = psMemInfo->uAllocSize;
         psAllocDeviceMemOUT->sClientMemInfo.hMappingInfo = psMemInfo->sMemBlk.hOSMemHandle;
-
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+        psAllocDeviceMemOUT->sClientMemInfo.sDevMemTimingStats.sDevMemMapTimes.ui32TimeToDevMap = psMemInfo->ui32TimeToDevMap;
+#endif
         PVRSRVAllocHandleNR(psPerProc->psHandleBase,
                                           &psAllocDeviceMemOUT->sClientMemInfo.hKernelMemInfo,
                                           psMemInfo,
@@ -722,43 +722,54 @@ PVRSRVAllocDeviceMemBW(IMG_UINT32 ui32BridgeID,
 static IMG_INT
 PVRSRVFreeDeviceMemBW(IMG_UINT32 ui32BridgeID,
                                           PVRSRV_BRIDGE_IN_FREEDEVICEMEM *psFreeDeviceMemIN,
-                                          PVRSRV_BRIDGE_RETURN *psRetOUT,
+                                          PVRSRV_BRIDGE_OUT_FREEDEVICEMEM *psFreeDeviceMemOUT,
                                           PVRSRV_PER_PROCESS_DATA *psPerProc)
 {
         IMG_HANDLE hDevCookieInt;
-        IMG_VOID *pvKernelMemInfo;
+        PVRSRV_KERNEL_MEM_INFO *psKernelMemInfo;
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+        IMG_UINT32 ui32TimeToDevUnmap;
+#endif
 
         PVRSRV_BRIDGE_ASSERT_CMD(ui32BridgeID, PVRSRV_BRIDGE_FREE_DEVICEMEM);
 
-        psRetOUT->eError =
+        psFreeDeviceMemOUT->eError =
                 PVRSRVLookupHandle(psPerProc->psHandleBase, &hDevCookieInt,
                                                    psFreeDeviceMemIN->hDevCookie,
                                                    PVRSRV_HANDLE_TYPE_DEV_NODE);
 
-        if(psRetOUT->eError != PVRSRV_OK)
+        if(psFreeDeviceMemOUT->eError != PVRSRV_OK)
         {
                 return 0;
         }
 
-        psRetOUT->eError =
+        psFreeDeviceMemOUT->eError =
         PVRSRVLookupHandle(psPerProc->psHandleBase,
-                           &pvKernelMemInfo,
+                           (IMG_PVOID *)&psKernelMemInfo,
                                                    psFreeDeviceMemIN->psKernelMemInfo,
                                                    PVRSRV_HANDLE_TYPE_MEM_INFO);
 
-        if(psRetOUT->eError != PVRSRV_OK)
+        if(psFreeDeviceMemOUT->eError != PVRSRV_OK)
         {
                 return 0;
         }
 
-        psRetOUT->eError = PVRSRVFreeDeviceMemKM(hDevCookieInt, pvKernelMemInfo);
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+        psKernelMemInfo->pui32TimeToDevUnmap = &ui32TimeToDevUnmap;
+#endif
 
-        if(psRetOUT->eError != PVRSRV_OK)
+        psFreeDeviceMemOUT->eError = PVRSRVFreeDeviceMemKM(hDevCookieInt, psKernelMemInfo);
+
+        if(psFreeDeviceMemOUT->eError != PVRSRV_OK)
         {
                 return 0;
         }
 
-        psRetOUT->eError =
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+        psFreeDeviceMemOUT->ui32TimeToDevUnmap = ui32TimeToDevUnmap;
+#endif
+
+        psFreeDeviceMemOUT->eError =
                 PVRSRVReleaseHandle(psPerProc->psHandleBase,
                                                         psFreeDeviceMemIN->psKernelMemInfo,
                                                         PVRSRV_HANDLE_TYPE_MEM_INFO);
@@ -1395,301 +1406,306 @@ PVRSRVUnwrapExtMemoryBW(IMG_UINT32 ui32BridgeID,
         return 0;
 }
 
-#if defined(SUPPORT_DRM_GEM)
+#if defined(SUPPORT_ION)
 static IMG_INT
-PVRSRVMapDmabufBW(IMG_UINT32 ui32BridgeID,
-                                           PVRSRV_BRIDGE_IN_MAP_DMABUF *psMapDmabufIN,
-                                           PVRSRV_BRIDGE_OUT_MAP_DMABUF *psMapDmabufOUT,
+PVRSRVMapIonHandleBW(IMG_UINT32 ui32BridgeID,
+                                           PVRSRV_BRIDGE_IN_MAP_ION_HANDLE *psMapIonIN,
+                                           PVRSRV_BRIDGE_OUT_MAP_ION_HANDLE *psMapIonOUT,
                                            PVRSRV_PER_PROCESS_DATA *psPerProc)
 {
         PVRSRV_KERNEL_MEM_INFO  *psKernelMemInfo;
         IMG_UINT64 ui64Stamp;
 
-        psMapDmabufOUT->eError = PVRSRVLookupHandle(psPerProc->psHandleBase,
-                                                                                         &psMapDmabufIN->hDevCookie,
-                                                                                         psMapDmabufIN->hDevCookie,
+        psMapIonOUT->eError = PVRSRVLookupHandle(psPerProc->psHandleBase,
+                                                                                         &psMapIonIN->hDevCookie,
+                                                                                         psMapIonIN->hDevCookie,
                                                                                          PVRSRV_HANDLE_TYPE_DEV_NODE);
-        if (psMapDmabufOUT->eError != PVRSRV_OK)
+        if (psMapIonOUT->eError != PVRSRV_OK)
         {
                 PVR_DPF((PVR_DBG_ERROR, "%s: Failed to lookup device node handle", __FUNCTION__));
                 return 0;
         }
 
-        psMapDmabufOUT->eError = PVRSRVLookupHandle(psPerProc->psHandleBase,
-                                                                                         &psMapDmabufIN->hDevMemHeap,
-                                                                                         psMapDmabufIN->hDevMemHeap,
+        psMapIonOUT->eError = PVRSRVLookupHandle(psPerProc->psHandleBase,
+                                                                                         &psMapIonIN->hDevMemHeap,
+                                                                                         psMapIonIN->hDevMemHeap,
                                                                                          PVRSRV_HANDLE_TYPE_DEV_MEM_HEAP);
-        if (psMapDmabufOUT->eError != PVRSRV_OK)
+        if (psMapIonOUT->eError != PVRSRV_OK)
         {
                 PVR_DPF((PVR_DBG_ERROR, "%s: Failed to lookup memory context handle", __FUNCTION__));
                 return 0;
         }
 
-        psMapDmabufOUT->eError = PVRSRVMapDmabufKM(psPerProc,
-                                                                                           psMapDmabufIN->hDevCookie,
-                                                                                           psMapDmabufIN->hDevMemHeap,
-                                                                                           psMapDmabufIN->ui32NumFDs,
-                                                                                           psMapDmabufIN->ai32BufferFDs,
-                                                                                           psMapDmabufIN->ui32Attribs,
-                                                                                           psMapDmabufIN->ui32ChunkCount,
-                                                                                           psMapDmabufIN->auiOffset,
-                                                                                           psMapDmabufIN->auiSize,
-                                                                                           &psMapDmabufOUT->uiDmabufBufferSize,
+        psMapIonOUT->eError = PVRSRVMapIonHandleKM(psPerProc,
+                                                                                           psMapIonIN->hDevCookie,
+                                                                                           psMapIonIN->hDevMemHeap,
+                                                                                           psMapIonIN->ui32NumFDs,
+                                                                                           psMapIonIN->ai32BufferFDs,
+                                                                                           psMapIonIN->ui32Attribs,
+                                                                                           psMapIonIN->ui32ChunkCount,
+                                                                                           psMapIonIN->auiOffset,
+                                                                                           psMapIonIN->auiSize,
+                                                                                           &psMapIonOUT->uiIonBufferSize,
                                                                                            &psKernelMemInfo,
                                                                                            &ui64Stamp);
-        if (psMapDmabufOUT->eError != PVRSRV_OK)
+        if (psMapIonOUT->eError != PVRSRV_OK)
         {
                 PVR_DPF((PVR_DBG_ERROR, "%s: Failed to map ion handle", __FUNCTION__));
                 return 0;
         }
 
-        OSMemSet(&psMapDmabufOUT->sClientMemInfo,
+        OSMemSet(&psMapIonOUT->sClientMemInfo,
                          0,
-                         sizeof(psMapDmabufOUT->sClientMemInfo));
+                         sizeof(psMapIonOUT->sClientMemInfo));
 
-        psMapDmabufOUT->sClientMemInfo.pvLinAddrKM =
+        psMapIonOUT->sClientMemInfo.pvLinAddrKM =
                         psKernelMemInfo->pvLinAddrKM;
 
-        psMapDmabufOUT->sClientMemInfo.pvLinAddr = 0;
-        psMapDmabufOUT->sClientMemInfo.sDevVAddr = psKernelMemInfo->sDevVAddr;
-        psMapDmabufOUT->sClientMemInfo.ui32Flags = psKernelMemInfo->ui32Flags;
-        psMapDmabufOUT->sClientMemInfo.uAllocSize = psKernelMemInfo->uAllocSize;
+        psMapIonOUT->sClientMemInfo.pvLinAddr = 0;
+        psMapIonOUT->sClientMemInfo.sDevVAddr = psKernelMemInfo->sDevVAddr;
+        psMapIonOUT->sClientMemInfo.ui32Flags = psKernelMemInfo->ui32Flags;
+        psMapIonOUT->sClientMemInfo.uAllocSize = psKernelMemInfo->uAllocSize;
 
         /* No mapping info, we map through ion */
-        psMapDmabufOUT->sClientMemInfo.hMappingInfo = IMG_NULL;
+        psMapIonOUT->sClientMemInfo.hMappingInfo = IMG_NULL;
 
 #if defined(SUPPORT_MEMINFO_IDS)
-        psMapDmabufOUT->sClientMemInfo.ui64Stamp = ui64Stamp;
+        psMapIonOUT->sClientMemInfo.ui64Stamp = ui64Stamp;
 #endif
 
         PVRSRVAllocHandleNR(psPerProc->psHandleBase,
-                                                &psMapDmabufOUT->sClientMemInfo.hKernelMemInfo,
+                                                &psMapIonOUT->sClientMemInfo.hKernelMemInfo,
                                                 psKernelMemInfo,
                                                 PVRSRV_HANDLE_TYPE_MEM_INFO,
                                                 PVRSRV_HANDLE_ALLOC_FLAG_NONE);
 
-        if(psMapDmabufIN->ui32Attribs & PVRSRV_MEM_NO_SYNCOBJ)
+        if(psMapIonIN->ui32Attribs & PVRSRV_MEM_NO_SYNCOBJ)
         {
                 /* signal no syncinfo */
-                OSMemSet(&psMapDmabufOUT->sClientSyncInfo,
+                OSMemSet(&psMapIonOUT->sClientSyncInfo,
                                  0,
                                  sizeof (PVRSRV_CLIENT_SYNC_INFO));
-                psMapDmabufOUT->sClientMemInfo.psClientSyncInfo = IMG_NULL;
+                psMapIonOUT->sClientMemInfo.psClientSyncInfo = IMG_NULL;
         }
         else
         {
                 /* and setup the sync info */
 #if !defined(PVRSRV_DISABLE_UM_SYNCOBJ_MAPPINGS)
-                psMapDmabufOUT->sClientSyncInfo.psSyncData =
+                psMapIonOUT->sClientSyncInfo.psSyncData =
                         psKernelMemInfo->psKernelSyncInfo->psSyncData;
-                psMapDmabufOUT->sClientSyncInfo.sWriteOpsCompleteDevVAddr =
+                psMapIonOUT->sClientSyncInfo.sWriteOpsCompleteDevVAddr =
                         psKernelMemInfo->psKernelSyncInfo->sWriteOpsCompleteDevVAddr;
-                psMapDmabufOUT->sClientSyncInfo.sReadOpsCompleteDevVAddr =
+                psMapIonOUT->sClientSyncInfo.sReadOpsCompleteDevVAddr =
                         psKernelMemInfo->psKernelSyncInfo->sReadOpsCompleteDevVAddr;
-                psMapDmabufOUT->sClientSyncInfo.sReadOps2CompleteDevVAddr =
+                psMapIonOUT->sClientSyncInfo.sReadOps2CompleteDevVAddr =
                         psKernelMemInfo->psKernelSyncInfo->sReadOps2CompleteDevVAddr;
 
-                psMapDmabufOUT->sClientSyncInfo.hMappingInfo =
+                psMapIonOUT->sClientSyncInfo.hMappingInfo =
                         psKernelMemInfo->psKernelSyncInfo->psSyncDataMemInfoKM->sMemBlk.hOSMemHandle;
 #endif
 
                 PVRSRVAllocSubHandleNR(psPerProc->psHandleBase,
-                                                           &psMapDmabufOUT->sClientSyncInfo.hKernelSyncInfo,
+                                                           &psMapIonOUT->sClientSyncInfo.hKernelSyncInfo,
                                                            psKernelMemInfo->psKernelSyncInfo,
                                                            PVRSRV_HANDLE_TYPE_SYNC_INFO,
                                                            PVRSRV_HANDLE_ALLOC_FLAG_NONE,
-                                                           psMapDmabufOUT->sClientMemInfo.hKernelMemInfo);
+                                                           psMapIonOUT->sClientMemInfo.hKernelMemInfo);
 
-                psMapDmabufOUT->sClientMemInfo.psClientSyncInfo =
-                        &psMapDmabufOUT->sClientSyncInfo;
+                psMapIonOUT->sClientMemInfo.psClientSyncInfo =
+                        &psMapIonOUT->sClientSyncInfo;
         }
         return 0;
 }
 
 static IMG_INT
-PVRSRVUnmapDmabufBW(IMG_UINT32 ui32BridgeID,
-                                           PVRSRV_BRIDGE_IN_UNMAP_DMABUF *psUnmapDmabufIN,
-                                           PVRSRV_BRIDGE_RETURN *psUnmapDmabufOUT,
+PVRSRVUnmapIonHandleBW(IMG_UINT32 ui32BridgeID,
+                                           PVRSRV_BRIDGE_IN_UNMAP_ION_HANDLE *psUnmapIonIN,
+                                           PVRSRV_BRIDGE_RETURN *psUnmapIonOUT,
                                            PVRSRV_PER_PROCESS_DATA *psPerProc)
 {
         IMG_VOID *pvKernelMemInfo;
 
-        PVRSRV_BRIDGE_ASSERT_CMD(ui32BridgeID, PVRSRV_BRIDGE_UNMAP_DMABUF);
+        PVRSRV_BRIDGE_ASSERT_CMD(ui32BridgeID, PVRSRV_BRIDGE_UNMAP_ION_HANDLE);
 
-        psUnmapDmabufOUT->eError =
+        psUnmapIonOUT->eError =
         PVRSRVLookupHandle(psPerProc->psHandleBase,
                            &pvKernelMemInfo,
-                                                   psUnmapDmabufIN->psKernelMemInfo,
+                                                   psUnmapIonIN->psKernelMemInfo,
                                                    PVRSRV_HANDLE_TYPE_MEM_INFO);
 
-        if(psUnmapDmabufOUT->eError != PVRSRV_OK)
+        if(psUnmapIonOUT->eError != PVRSRV_OK)
         {
                 return 0;
         }
 
-        psUnmapDmabufOUT->eError = PVRSRVUnmapDmabufKM(pvKernelMemInfo);
+        psUnmapIonOUT->eError = PVRSRVUnmapIonHandleKM(pvKernelMemInfo);
 
-        if(psUnmapDmabufOUT->eError != PVRSRV_OK)
+        if(psUnmapIonOUT->eError != PVRSRV_OK)
         {
                 return 0;
         }
 
-        psUnmapDmabufOUT->eError =
+        psUnmapIonOUT->eError =
                 PVRSRVReleaseHandle(psPerProc->psHandleBase,
-                                                        psUnmapDmabufIN->psKernelMemInfo,
+                                                        psUnmapIonIN->psKernelMemInfo,
                                                         PVRSRV_HANDLE_TYPE_MEM_INFO);
 
         return 0;
 }
 #endif  /* SUPPORT_ION */
 
-#if defined(SUPPORT_ION)
+#if defined(SUPPORT_DMABUF)
 static IMG_INT
-PVRSRVMapIonHandleBW(IMG_UINT32 ui32BridgeID,
-                                           PVRSRV_BRIDGE_IN_MAP_ION_HANDLE *psMapIonIN,
-                                           PVRSRV_BRIDGE_OUT_MAP_ION_HANDLE *psMapIonOUT,
+PVRSRVMapDmaBufBW(IMG_UINT32 ui32BridgeID,
+                                           PVRSRV_BRIDGE_IN_MAP_DMABUF *psMapDmaBufIN,
+                                           PVRSRV_BRIDGE_OUT_MAP_DMABUF *psMapDmaBufOUT,
                                            PVRSRV_PER_PROCESS_DATA *psPerProc)
 {
         PVRSRV_KERNEL_MEM_INFO  *psKernelMemInfo;
         IMG_UINT64 ui64Stamp;
 
-        psMapIonOUT->eError = PVRSRVLookupHandle(psPerProc->psHandleBase,
-                                                                                         &psMapIonIN->hDevCookie,
-                                                                                         psMapIonIN->hDevCookie,
+        psMapDmaBufOUT->eError = PVRSRVLookupHandle(psPerProc->psHandleBase,
+                                                                                         &psMapDmaBufIN->hDevCookie,
+                                                                                         psMapDmaBufIN->hDevCookie,
                                                                                          PVRSRV_HANDLE_TYPE_DEV_NODE);
-        if (psMapIonOUT->eError != PVRSRV_OK)
+        if (psMapDmaBufOUT->eError != PVRSRV_OK)
         {
                 PVR_DPF((PVR_DBG_ERROR, "%s: Failed to lookup device node handle", __FUNCTION__));
                 return 0;
         }
 
-        psMapIonOUT->eError = PVRSRVLookupHandle(psPerProc->psHandleBase,
-                                                                                         &psMapIonIN->hDevMemHeap,
-                                                                                         psMapIonIN->hDevMemHeap,
+        psMapDmaBufOUT->eError = PVRSRVLookupHandle(psPerProc->psHandleBase,
+                                                                                         &psMapDmaBufIN->hDevMemHeap,
+                                                                                         psMapDmaBufIN->hDevMemHeap,
                                                                                          PVRSRV_HANDLE_TYPE_DEV_MEM_HEAP);
-        if (psMapIonOUT->eError != PVRSRV_OK)
+        if (psMapDmaBufOUT->eError != PVRSRV_OK)
         {
                 PVR_DPF((PVR_DBG_ERROR, "%s: Failed to lookup memory context handle", __FUNCTION__));
                 return 0;
         }
 
-        psMapIonOUT->eError = PVRSRVMapIonHandleKM(psPerProc,
-                                                                                           psMapIonIN->hDevCookie,
-                                                                                           psMapIonIN->hDevMemHeap,
-                                                                                           psMapIonIN->ui32NumFDs,
-                                                                                           psMapIonIN->ai32BufferFDs,
-                                                                                           psMapIonIN->ui32Attribs,
-                                                                                           psMapIonIN->ui32ChunkCount,
-                                                                                           psMapIonIN->auiOffset,
-                                                                                           psMapIonIN->auiSize,
-                                                                                           &psMapIonOUT->uiIonBufferSize,
+        psMapDmaBufOUT->eError = PVRSRVMapDmaBufKM(psPerProc,
+                                                                                           psMapDmaBufIN->hDevCookie,
+                                                                                           psMapDmaBufIN->hDevMemHeap,
+                                                                                           psMapDmaBufIN->ui32Attribs,
+                                                                                           psMapDmaBufIN->ui32NumFDs,
+                                                                                           psMapDmaBufIN->ai32FD,
+                                                                                           psMapDmaBufIN->auiOffset,
+                                                                                           psMapDmaBufIN->auiSize,
                                                                                            &psKernelMemInfo,
+                                                                                           &psMapDmaBufOUT->uiSize,
+                                                                                           psMapDmaBufOUT->auiOffset,
                                                                                            &ui64Stamp);
-        if (psMapIonOUT->eError != PVRSRV_OK)
+        if (psMapDmaBufOUT->eError != PVRSRV_OK)
         {
-                PVR_DPF((PVR_DBG_ERROR, "%s: Failed to map ion handle", __FUNCTION__));
+                PVR_DPF((PVR_DBG_ERROR, "%s: Failed to map dma-buf handle", __FUNCTION__));
                 return 0;
         }
 
-        OSMemSet(&psMapIonOUT->sClientMemInfo,
+        OSMemSet(&psMapDmaBufOUT->sClientMemInfo,
                          0,
-                         sizeof(psMapIonOUT->sClientMemInfo));
+                         sizeof(psMapDmaBufOUT->sClientMemInfo));
 
-        psMapIonOUT->sClientMemInfo.pvLinAddrKM =
+        psMapDmaBufOUT->sClientMemInfo.pvLinAddrKM =
                         psKernelMemInfo->pvLinAddrKM;
 
-        psMapIonOUT->sClientMemInfo.pvLinAddr = 0;
-        psMapIonOUT->sClientMemInfo.sDevVAddr = psKernelMemInfo->sDevVAddr;
-        psMapIonOUT->sClientMemInfo.ui32Flags = psKernelMemInfo->ui32Flags;
-        psMapIonOUT->sClientMemInfo.uAllocSize = psKernelMemInfo->uAllocSize;
+        psMapDmaBufOUT->sClientMemInfo.pvLinAddr = 0;
+        psMapDmaBufOUT->sClientMemInfo.sDevVAddr = psKernelMemInfo->sDevVAddr;
+        psMapDmaBufOUT->sClientMemInfo.ui32Flags = psKernelMemInfo->ui32Flags;
+        psMapDmaBufOUT->sClientMemInfo.uAllocSize = psKernelMemInfo->uAllocSize;
 
-        /* No mapping info, we map through ion */
-        psMapIonOUT->sClientMemInfo.hMappingInfo = IMG_NULL;
+        /* No mapping info, we map through dma_buf */
+        psMapDmaBufOUT->sClientMemInfo.hMappingInfo = IMG_NULL;
 
 #if defined(SUPPORT_MEMINFO_IDS)
-        psMapIonOUT->sClientMemInfo.ui64Stamp = ui64Stamp;
+        psMapDmaBufOUT->sClientMemInfo.ui64Stamp = ui64Stamp;
 #endif
 
         PVRSRVAllocHandleNR(psPerProc->psHandleBase,
-                                                &psMapIonOUT->sClientMemInfo.hKernelMemInfo,
+                                                &psMapDmaBufOUT->sClientMemInfo.hKernelMemInfo,
                                                 psKernelMemInfo,
                                                 PVRSRV_HANDLE_TYPE_MEM_INFO,
                                                 PVRSRV_HANDLE_ALLOC_FLAG_NONE);
 
-        if(psMapIonIN->ui32Attribs & PVRSRV_MEM_NO_SYNCOBJ)
+        if(psMapDmaBufIN->ui32Attribs & PVRSRV_MEM_NO_SYNCOBJ)
         {
                 /* signal no syncinfo */
-                OSMemSet(&psMapIonOUT->sClientSyncInfo,
+                OSMemSet(&psMapDmaBufOUT->sClientSyncInfo,
                                  0,
                                  sizeof (PVRSRV_CLIENT_SYNC_INFO));
-                psMapIonOUT->sClientMemInfo.psClientSyncInfo = IMG_NULL;
+                psMapDmaBufOUT->sClientMemInfo.psClientSyncInfo = IMG_NULL;
         }
         else
         {
                 /* and setup the sync info */
 #if !defined(PVRSRV_DISABLE_UM_SYNCOBJ_MAPPINGS)
-                psMapIonOUT->sClientSyncInfo.psSyncData =
+                psMapDmaBufOUT->sClientSyncInfo.psSyncData =
                         psKernelMemInfo->psKernelSyncInfo->psSyncData;
-                psMapIonOUT->sClientSyncInfo.sWriteOpsCompleteDevVAddr =
+                psMapDmaBufOUT->sClientSyncInfo.sWriteOpsCompleteDevVAddr =
                         psKernelMemInfo->psKernelSyncInfo->sWriteOpsCompleteDevVAddr;
-                psMapIonOUT->sClientSyncInfo.sReadOpsCompleteDevVAddr =
+                psMapDmaBufOUT->sClientSyncInfo.sReadOpsCompleteDevVAddr =
                         psKernelMemInfo->psKernelSyncInfo->sReadOpsCompleteDevVAddr;
-                psMapIonOUT->sClientSyncInfo.sReadOps2CompleteDevVAddr =
+                psMapDmaBufOUT->sClientSyncInfo.sReadOps2CompleteDevVAddr =
                         psKernelMemInfo->psKernelSyncInfo->sReadOps2CompleteDevVAddr;
 
-                psMapIonOUT->sClientSyncInfo.hMappingInfo =
+                psMapDmaBufOUT->sClientSyncInfo.hMappingInfo =
                         psKernelMemInfo->psKernelSyncInfo->psSyncDataMemInfoKM->sMemBlk.hOSMemHandle;
 #endif
 
+                /*
+                 * If the DMA Buffer is imported into the same process that
+                 * exported it, there will be two handles for the same sync
+                 * info, hence the PVRSRV_HANDLE_ALLOC_FLAG_MULTI flag.
+                 */
                 PVRSRVAllocSubHandleNR(psPerProc->psHandleBase,
-                                                           &psMapIonOUT->sClientSyncInfo.hKernelSyncInfo,
+                                                           &psMapDmaBufOUT->sClientSyncInfo.hKernelSyncInfo,
                                                            psKernelMemInfo->psKernelSyncInfo,
                                                            PVRSRV_HANDLE_TYPE_SYNC_INFO,
-                                                           PVRSRV_HANDLE_ALLOC_FLAG_NONE,
-                                                           psMapIonOUT->sClientMemInfo.hKernelMemInfo);
+                                                           PVRSRV_HANDLE_ALLOC_FLAG_MULTI,
+                                                           psMapDmaBufOUT->sClientMemInfo.hKernelMemInfo);
 
-                psMapIonOUT->sClientMemInfo.psClientSyncInfo =
-                        &psMapIonOUT->sClientSyncInfo;
+                psMapDmaBufOUT->sClientMemInfo.psClientSyncInfo =
+                        &psMapDmaBufOUT->sClientSyncInfo;
         }
         return 0;
 }
 
 static IMG_INT
-PVRSRVUnmapIonHandleBW(IMG_UINT32 ui32BridgeID,
-                                           PVRSRV_BRIDGE_IN_UNMAP_ION_HANDLE *psUnmapIonIN,
-                                           PVRSRV_BRIDGE_RETURN *psUnmapIonOUT,
+PVRSRVUnmapDmaBufBW(IMG_UINT32 ui32BridgeID,
+                                           PVRSRV_BRIDGE_IN_UNMAP_DMABUF *psUnmapDmaBufIN,
+                                           PVRSRV_BRIDGE_RETURN *psUnmapDmaBufOUT,
                                            PVRSRV_PER_PROCESS_DATA *psPerProc)
 {
         IMG_VOID *pvKernelMemInfo;
 
-        PVRSRV_BRIDGE_ASSERT_CMD(ui32BridgeID, PVRSRV_BRIDGE_UNMAP_ION_HANDLE);
+        PVRSRV_BRIDGE_ASSERT_CMD(ui32BridgeID, PVRSRV_BRIDGE_UNMAP_DMABUF);
 
-        psUnmapIonOUT->eError =
+        psUnmapDmaBufOUT->eError =
         PVRSRVLookupHandle(psPerProc->psHandleBase,
                            &pvKernelMemInfo,
-                                                   psUnmapIonIN->psKernelMemInfo,
+                                                   psUnmapDmaBufIN->psKernelMemInfo,
                                                    PVRSRV_HANDLE_TYPE_MEM_INFO);
 
-        if(psUnmapIonOUT->eError != PVRSRV_OK)
+        if(psUnmapDmaBufOUT->eError != PVRSRV_OK)
         {
                 return 0;
         }
 
-        psUnmapIonOUT->eError = PVRSRVUnmapIonHandleKM(pvKernelMemInfo);
+        psUnmapDmaBufOUT->eError = PVRSRVUnmapDmaBufKM(pvKernelMemInfo);
 
-        if(psUnmapIonOUT->eError != PVRSRV_OK)
+        if(psUnmapDmaBufOUT->eError != PVRSRV_OK)
         {
                 return 0;
         }
 
-        psUnmapIonOUT->eError =
+        psUnmapDmaBufOUT->eError =
                 PVRSRVReleaseHandle(psPerProc->psHandleBase,
-                                                        psUnmapIonIN->psKernelMemInfo,
+                                                        psUnmapDmaBufIN->psKernelMemInfo,
                                                         PVRSRV_HANDLE_TYPE_MEM_INFO);
 
         return 0;
 }
-#endif  /* SUPPORT_ION */
+#endif  /* SUPPORT_DMABUF */
 
 static IMG_INT
 PVRSRVGetFreeDeviceMemBW(IMG_UINT32 ui32BridgeID,
@@ -2275,15 +2291,6 @@ PVRSRVGetMiscInfoBW(IMG_UINT32 ui32BridgeID,
                 return 0;
         }
 
-        if((psGetMiscInfoIN->sMiscInfo.ui32StateRequest & PVRSRV_MISC_INFO_GET_DRM_FD_PRESENT) != 0)
-        {
-                PVR_DPF((PVR_DBG_ERROR, "Get DRM FD BW"));
-        }
-        if((psGetMiscInfoIN->sMiscInfo.ui32StateRequest & PVRSRV_MISC_INFO_SET_DRM_FD_PRESENT) != 0)
-        {
-                PVR_DPF((PVR_DBG_ERROR, "Set DRM FD BW"));
-        }
-
         if (((psGetMiscInfoIN->sMiscInfo.ui32StateRequest & PVRSRV_MISC_INFO_MEMSTATS_PRESENT) != 0) ||
             ((psGetMiscInfoIN->sMiscInfo.ui32StateRequest & PVRSRV_MISC_INFO_DDKVERSION_PRESENT) != 0) ||
             ((psGetMiscInfoIN->sMiscInfo.ui32StateRequest & PVRSRV_MISC_INFO_FREEMEM_PRESENT) != 0))
@@ -3035,11 +3042,7 @@ PVRSRVSwapToDCBuffer2BW(IMG_UINT32 ui32BridgeID,
         IMG_UINT32 i;
 
 #if defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC)
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,4,0))
         int iReleaseFd = get_unused_fd_flags(O_CLOEXEC);
-#else
-        int iReleaseFd = get_unused_fd();
-#endif
         if(iReleaseFd < 0)
         {
                 PVR_DPF((PVR_DBG_ERROR, "%s: Failed to find unused fd (%d)",
@@ -3126,7 +3129,7 @@ PVRSRVSwapToDCBuffer2BW(IMG_UINT32 ui32BridgeID,
 
         if(psSwapDispClassBufferIN->ui32PrivDataLength > 0)
         {
-                if(OSAllocMem(PVRSRV_OS_PAGEABLE_HEAP,
+                if(OSAllocMem(PVRSRV_OS_PAGEABLE_HEAP | PVRSRV_SWAP_BUFFER_ALLOCATION,
                                           psSwapDispClassBufferIN->ui32PrivDataLength,
                                           (IMG_VOID **)&pvPrivData, IMG_NULL,
                                           "Swap Command Private Data") != PVRSRV_OK)
@@ -3142,7 +3145,7 @@ PVRSRVSwapToDCBuffer2BW(IMG_UINT32 ui32BridgeID,
                                                            psSwapDispClassBufferIN->ui32PrivDataLength) != PVRSRV_OK)
                 {
                         PVR_DPF((PVR_DBG_ERROR, "PVRSRVSwapToDCBuffer2BW: Failed to copy private data"));
-                        OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP,
+                        OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP | PVRSRV_SWAP_BUFFER_ALLOCATION,
                                           psSwapDispClassBufferIN->ui32PrivDataLength,
                                           pvPrivData, IMG_NULL);
                 return -EFAULT;
@@ -4653,14 +4656,14 @@ CommonBridgeInit(IMG_VOID)
     SetDispatchTableEntry(PVRSRV_BRIDGE_CHG_DEV_MEM_ATTRIBS, PVRSRVChangeDeviceMemoryAttributesBW);
     SetDispatchTableEntry(PVRSRV_BRIDGE_MAP_DEV_MEMORY_2, PVRSRVMapDeviceMemoryBW);
     SetDispatchTableEntry(PVRSRV_BRIDGE_EXPORT_DEVICEMEM_2, PVRSRVExportDeviceMemBW);
-#if defined(SUPPORT_DRM_GEM)
-        SetDispatchTableEntry(PVRSRV_BRIDGE_MAP_DMABUF, PVRSRVMapDmabufBW);
-        SetDispatchTableEntry(PVRSRV_BRIDGE_UNMAP_DMABUF, PVRSRVUnmapDmabufBW);
-#endif
 #if defined(SUPPORT_ION)
         SetDispatchTableEntry(PVRSRV_BRIDGE_MAP_ION_HANDLE, PVRSRVMapIonHandleBW);
         SetDispatchTableEntry(PVRSRV_BRIDGE_UNMAP_ION_HANDLE, PVRSRVUnmapIonHandleBW);
 #endif
+#if defined(SUPPORT_DMABUF)
+        SetDispatchTableEntry(PVRSRV_BRIDGE_MAP_DMABUF, PVRSRVMapDmaBufBW);
+        SetDispatchTableEntry(PVRSRV_BRIDGE_UNMAP_DMABUF, PVRSRVUnmapDmaBufBW);
+#endif
 
         /* SIM */
         SetDispatchTableEntry(PVRSRV_BRIDGE_PROCESS_SIMISR_EVENT, DummyBW);
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/bridged/sgx/bridged_sgx_bridge.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/bridged/sgx/bridged_sgx_bridge.c
index f23fd49..31d40e7 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/bridged/sgx/bridged_sgx_bridge.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/bridged/sgx/bridged_sgx_bridge.c
@@ -265,69 +265,6 @@ SGXDoKickBW(IMG_UINT32 ui32BridgeID,
                 }
         }
 
-
-#if defined(SUPPORT_SGX_GENERALISED_SYNCOBJECTS)
-        /* SRC and DST sync details */
-        if (psDoKickIN->sCCBKick.ui32NumTASrcSyncs > SGX_MAX_TA_SRC_SYNCS)
-        {
-                psRetOUT->eError = PVRSRV_ERROR_INVALID_PARAMS;
-                return 0;
-        }
-
-        for(i=0; i<psDoKickIN->sCCBKick.ui32NumTASrcSyncs; i++)
-        {
-                psRetOUT->eError =
-                        PVRSRVLookupHandle(psPerProc->psHandleBase,
-                                                           &psDoKickIN->sCCBKick.ahTASrcKernelSyncInfo[i],
-                                                           psDoKickIN->sCCBKick.ahTASrcKernelSyncInfo[i],
-                                                           PVRSRV_HANDLE_TYPE_SYNC_INFO);
-
-                if(psRetOUT->eError != PVRSRV_OK)
-                {
-                        return 0;
-                }
-        }
-
-        if (psDoKickIN->sCCBKick.ui32NumTADstSyncs > SGX_MAX_TA_DST_SYNCS)
-        {
-                psRetOUT->eError = PVRSRV_ERROR_INVALID_PARAMS;
-                return 0;
-        }
-
-        for(i=0; i<psDoKickIN->sCCBKick.ui32NumTADstSyncs; i++)
-        {
-                psRetOUT->eError =
-                        PVRSRVLookupHandle(psPerProc->psHandleBase,
-                                                           &psDoKickIN->sCCBKick.ahTADstKernelSyncInfo[i],
-                                                           psDoKickIN->sCCBKick.ahTADstKernelSyncInfo[i],
-                                                           PVRSRV_HANDLE_TYPE_SYNC_INFO);
-
-                if(psRetOUT->eError != PVRSRV_OK)
-                {
-                        return 0;
-                }
-        }
-
-        if (psDoKickIN->sCCBKick.ui32Num3DSrcSyncs > SGX_MAX_3D_SRC_SYNCS)
-        {
-                psRetOUT->eError = PVRSRV_ERROR_INVALID_PARAMS;
-                return 0;
-        }
-
-        for(i=0; i<psDoKickIN->sCCBKick.ui32Num3DSrcSyncs; i++)
-        {
-                psRetOUT->eError =
-                        PVRSRVLookupHandle(psPerProc->psHandleBase,
-                                                           &psDoKickIN->sCCBKick.ah3DSrcKernelSyncInfo[i],
-                                                           psDoKickIN->sCCBKick.ah3DSrcKernelSyncInfo[i],
-                                                           PVRSRV_HANDLE_TYPE_SYNC_INFO);
-
-                if(psRetOUT->eError != PVRSRV_OK)
-                {
-                        return 0;
-                }
-        }
-#else/* #if defined(SUPPORT_SGX_GENERALISED_SYNCOBJECTS) */
         /* texture dependency details */
         if (psDoKickIN->sCCBKick.ui32NumSrcSyncs > SGX_MAX_SRC_SYNCS_TA)
         {
@@ -350,7 +287,6 @@ SGXDoKickBW(IMG_UINT32 ui32BridgeID,
                 }
         }
 #endif /* !defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC) */
-#endif /* defined(SUPPORT_SGX_GENERALISED_SYNCOBJECTS) */
 
         if (psDoKickIN->sCCBKick.ui32NumTAStatusVals > SGX_MAX_TA_STATUS_VALS)
         {
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/buffer_manager.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/buffer_manager.c
index 1013542..e33337f 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/buffer_manager.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/buffer_manager.c
@@ -1,5 +1,5 @@
 /*************************************************************************/ /*!
-@Title          Buffer management functions for Linux
+@Title          Buffer management functions
 @Copyright      Copyright (c) Imagination Technologies Ltd. All Rights Reserved
 @Description    Manages buffers mapped into two memory spaces - cpu and device,
                 either of which can be virtual or physical.
@@ -96,6 +96,8 @@ DevMemoryFree (BM_MAPPING *pMapping);
     @Input      pvPrivData - opaque private data passed through to allocator
     @Input      ui32PrivDataLength - length of opaque private data
 
+        @Output         pui32TimeToDevMap - Time taken  in us to map the allocated
+                                        buffer to device MMU. 
         @Output     pBuf - receives a pointer to a descriptor of the allocated
                                          buffer.
         @Return         IMG_TRUE - Success
@@ -115,6 +117,9 @@ AllocMemory (BM_CONTEXT			*pBMContext,
                          IMG_UINT32                     ui32NumVirtChunks,
                          IMG_UINT32                     ui32NumPhysChunks,
                          IMG_BOOL                       *pabMapChunk,
+                         #if defined (PVRSRV_DEVMEM_TIME_STATS)
+                         IMG_UINT32                     *pui32TimeToDevMap,
+                         #endif
                          BM_BUF                         *pBuf)
 {
         BM_MAPPING                      *pMapping;
@@ -126,7 +131,7 @@ AllocMemory (BM_CONTEXT			*pBMContext,
                           uSize, ui32Flags, uDevVAddrAlignment));
 
         /*
-                what to do depends on combination of DevVaddr generation
+                Decision depends on combination of DevVaddr generation
                 and backing RAM requirement
         */
         if(ui32Flags & PVRSRV_MEM_RAM_BACKED_ALLOCATION)
@@ -160,8 +165,11 @@ AllocMemory (BM_CONTEXT			*pBMContext,
                 {
                         IMG_BOOL bSuccess;
                         IMG_SIZE_T uActualSize;
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+                        IMG_UINT64 ui64TimeStart;
+#endif
 
-                        /* Allocate physcial memory */
+                        /* Allocate physical memory */
                         bSuccess = BM_ImportMemory(psBMHeap,
                                                                            ui32ChunkSize * ui32NumPhysChunks,
                                                                            &uActualSize,
@@ -180,7 +188,7 @@ AllocMemory (BM_CONTEXT			*pBMContext,
                         if (uActualSize != ui32ChunkSize * ui32NumPhysChunks)
                         {
                                 /*
-                                        Most likley the chunksize was not host page multiple so
+                                        Most likely the chunksize was not host page multiple so
                                         return with an error
                                 */
                                 PVR_DPF((PVR_DBG_ERROR, "AllocMemory: Failed to allocate memory for sparse allocation"));
@@ -195,6 +203,9 @@ AllocMemory (BM_CONTEXT			*pBMContext,
                         pMapping->ui32NumPhysChunks = ui32NumPhysChunks;
                         pMapping->pabMapChunk = pabMapChunk;
 
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+                        ui64TimeStart = OSClockMonotonicus();
+#endif
                         /* Allocate VA space and map in the physical memory */
                         bSuccess = DevMemoryAlloc (pBMContext,
                                                                                 pMapping,
@@ -209,7 +220,10 @@ AllocMemory (BM_CONTEXT			*pBMContext,
                                 BM_FreeMemory(pArena, IMG_NULL, pMapping);
                                 return IMG_FALSE;
                         }
-                
+
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+                        pMapping->ui32TimeToDevMap = OSClockMonotonicus() - ui64TimeStart;
+#endif
                         /* uDevVAddrAlignment is currently set to zero so QAC generates warning which we override */
                         /* PRQA S 3356,3358 1 */
                         PVR_ASSERT (uDevVAddrAlignment>1?(pMapping->DevVAddr.uiAddr%uDevVAddrAlignment)==0:1);
@@ -340,6 +354,10 @@ AllocMemory (BM_CONTEXT			*pBMContext,
                 pMapping->hOSMemHandle = 0;
         }
 
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+        *pui32TimeToDevMap = pMapping->ui32TimeToDevMap;
+#endif
+
         /* Record the arena pointer in the mapping. */
         pMapping->pArena = pArena;
 
@@ -567,7 +585,7 @@ WrapMemory (BM_HEAP *psBMHeap,
         {
                 if(!ZeroBuf(pBuf, pMapping, uSize, ui32Flags))
                 {
-                        return IMG_FALSE;
+                        goto fail_cleanup;
                 }
         }
 
@@ -588,7 +606,8 @@ fail_cleanup:
                 OSReleaseSubMemHandle(pBuf->hOSMemHandle, ui32Attribs);
         }
 
-        if(pMapping && (pMapping->CpuVAddr || pMapping->hOSMemHandle))
+        /* pMapping must be valid: if the allocation failed, we'd have returned */
+        if(pMapping->CpuVAddr || pMapping->hOSMemHandle)
         {
                 switch(pMapping->eCpuMemoryOrigin)
                 {
@@ -711,12 +730,18 @@ ZeroBuf(BM_BUF *pBuf, BM_MAPPING *pMapping, IMG_SIZE_T uBytes, IMG_UINT32 ui32Fl
         @Input      ui32Flags - flags
         @Input      bFromAllocator - Is this being called by the
                                                          allocator?
+        @Output         pui32TimeToDevUnmap     - When not NULL, this receives time taken in
+                                microseconds to unmap the buffer from Device MMU
 
         @Return         None.
 
  *****************************************************************************/
 static IMG_VOID
-FreeBuf (BM_BUF *pBuf, IMG_UINT32 ui32Flags, IMG_BOOL bFromAllocator)
+FreeBuf (BM_BUF *pBuf, IMG_UINT32 ui32Flags, IMG_BOOL bFromAllocator
+                        #if defined (PVRSRV_DEVMEM_TIME_STATS)
+                        ,IMG_UINT32 *pui32TimeToDevUnmap
+                        #endif
+                )
 {
         BM_MAPPING *pMapping;
         PVRSRV_DEVICE_NODE *psDeviceNode;
@@ -728,6 +753,17 @@ FreeBuf (BM_BUF *pBuf, IMG_UINT32 ui32Flags, IMG_BOOL bFromAllocator)
 
         /* record mapping */
         pMapping = pBuf->pMapping;
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+        /* Pass in the storage where we wish to receive the device "unmap" timing info */
+        pMapping->pui32TimeToDevUnmap = pui32TimeToDevUnmap;
+
+        /* Initialise unmap timing to 'zero'. If the mapping is deleted from Device MMU
+         * we'll get legit value on return */
+        if (pMapping->pui32TimeToDevUnmap)
+        {
+                *(pMapping->pui32TimeToDevUnmap) = 0;
+        }
+#endif
 
         psDeviceNode = pMapping->pBMHeap->pBMContext->psDeviceNode;
         if (psDeviceNode->pfnCacheInvalidate)
@@ -873,7 +909,7 @@ static PVRSRV_ERROR BM_DestroyContext_AnyCb(BM_HEAP *psBMHeap)
         @Function       BM_DestroyContext
 
         @Description    Destroy a buffer manager context. All allocated buffers must be
-                                free'd before calling this function.  This function is called
+                                freed before calling this function.  This function is called
                                 also to perform cleanup during aborted initialisations so it's
                                 fairly careful not to assume any given resource has really been
                                 created/allocated.
@@ -1529,6 +1565,9 @@ BM_Alloc (  IMG_HANDLE			hDevMemHeap,
                         IMG_UINT32                      ui32NumVirtChunks,
                         IMG_UINT32                      ui32NumPhysChunks,
                         IMG_BOOL                        *pabMapChunk,
+                        #if defined (PVRSRV_DEVMEM_TIME_STATS)
+                        IMG_UINT32                      *pui32TimeToDevMap,
+                        #endif
                         BM_HANDLE                       *phBuf)
 {
         BM_BUF *pBuf;
@@ -1588,6 +1627,9 @@ BM_Alloc (  IMG_HANDLE			hDevMemHeap,
                                         ui32NumVirtChunks,
                                         ui32NumPhysChunks,
                                         pabMapChunk,
+                                        #if defined (PVRSRV_DEVMEM_TIME_STATS)
+                                        pui32TimeToDevMap,
+                                        #endif
                                         pBuf) != IMG_TRUE)
         {
                 OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof (BM_BUF), pBuf, IMG_NULL);
@@ -1869,7 +1911,11 @@ BM_Wrap (	IMG_HANDLE hDevMemHeap,
 
                 if (!HASH_Insert (psBMContext->pBufferHash, (IMG_UINTPTR_T)sHashAddress.uiAddr, (IMG_UINTPTR_T)pBuf))
                 {
-                        FreeBuf (pBuf, ui32Flags, IMG_TRUE);
+                        FreeBuf (pBuf, ui32Flags, IMG_TRUE
+                                                #if defined (PVRSRV_DEVMEM_TIME_STATS)
+                                                , IMG_NULL
+                                                #endif
+                                                );
                         PVR_DPF((PVR_DBG_ERROR, "BM_Wrap: HASH_Insert FAILED"));
                         return IMG_FALSE;
                 }
@@ -1917,11 +1963,12 @@ BM_Export (BM_HANDLE hBuf)
 
 /*!
 ******************************************************************************
- @Function              BM_Export
+ @Function              BM_FreeExport
 
- @Description   Export a buffer previously allocated via BM_Alloc.
+ @Description   Free a buffer previously exported via BM_Export.
 
  @Input         hBuf - buffer handle.
+ @Input         ui32Flags - flags
 
  @Return                None.
 **************************************************************************/
@@ -1932,14 +1979,18 @@ BM_FreeExport(BM_HANDLE hBuf,
         BM_BUF *pBuf = (BM_BUF *)hBuf;
 
         PVRSRVBMBufDecExport(pBuf);
-        FreeBuf (pBuf, ui32Flags, IMG_FALSE);
+        FreeBuf (pBuf, ui32Flags, IMG_FALSE
+                        #if defined (PVRSRV_DEVMEM_TIME_STATS)
+                                , IMG_NULL
+                        #endif
+                        );
 }
 
 /*!
 ******************************************************************************
- @Function              BM_FreeExport
+ @Function              BM_Free
 
- @Description   Free a buffer previously exported via BM_Export.
+ @Description   Free a buffer previously allocated via BM_Alloc 
 
  @Input         hBuf - buffer handle.
  @Input         ui32Flags - flags
@@ -1948,7 +1999,11 @@ BM_FreeExport(BM_HANDLE hBuf,
 **************************************************************************/
 IMG_VOID
 BM_Free (BM_HANDLE hBuf,
-                IMG_UINT32 ui32Flags)
+                        IMG_UINT32 ui32Flags
+                        #if defined (PVRSRV_DEVMEM_TIME_STATS)
+                        ,IMG_UINT32 *pui32TimeToDevUnmap
+                        #endif
+                )
 {
         BM_BUF *pBuf = (BM_BUF *)hBuf;
         SYS_DATA *psSysData;
@@ -1974,7 +2029,11 @@ BM_Free (BM_HANDLE hBuf,
 
                         HASH_Remove (pBuf->pMapping->pBMHeap->pBMContext->pBufferHash,  (IMG_UINTPTR_T)sHashAddr.uiAddr);
                 }
-                FreeBuf (pBuf, ui32Flags, IMG_TRUE);
+                FreeBuf (pBuf, ui32Flags, IMG_TRUE
+                                        #if defined(PVRSRV_DEVMEM_TIME_STATS)
+                                        ,pui32TimeToDevUnmap
+                                        #endif
+                                );
         }
 }
 
@@ -1984,7 +2043,7 @@ BM_Free (BM_HANDLE hBuf,
 
         @Function   BM_HandleToCpuVaddr
 
-        @Description    Retreive the cpu virtual address associated with a buffer.
+        @Description    Retrieve the cpu virtual address associated with a buffer.
 
         @Input      buffer handle.
 
@@ -2015,7 +2074,7 @@ BM_HandleToCpuVaddr (BM_HANDLE hBuf)
 
         @Function   BM_HandleToDevVaddr
 
-        @Description    Retreive the device virtual address associated with a buffer.
+        @Description    Retrieve the device virtual address associated with a buffer.
 
         @Input      hBuf - buffer handle.
 
@@ -2045,7 +2104,7 @@ BM_HandleToDevVaddr (BM_HANDLE hBuf)
 
         @Function   BM_HandleToSysPaddr
 
-        @Description    Retreive the system physical address associated with a buffer.
+        @Description    Retrieve the system physical address associated with a buffer.
 
         @Input      hBuf - buffer handle.
 
@@ -2075,7 +2134,7 @@ BM_HandleToSysPaddr (BM_HANDLE hBuf)
 
         @Function   BM_HandleToMemOSHandle
 
-        @Description    Retreive the underlying memory handle associated with a buffer.
+        @Description    Retrieve the underlying memory handle associated with a buffer.
 
         @Input      hBuf - buffer handle.
 
@@ -2746,9 +2805,12 @@ BM_ImportMemory (IMG_VOID *pH,
         }
         pMapping->pBMHeap = pBMHeap;
         pMapping->ui32Flags = ui32Flags;
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+        pMapping->pui32TimeToDevUnmap = IMG_NULL;
+#endif
 
         /*
-         * If anyone want's to know, pass back the actual size of our allocation.
+         * If anyone wants to know, pass back the actual size of our allocation.
          * There could be up to an extra page's worth of memory which will be marked
          * as free in the RA.
          */
@@ -2781,7 +2843,7 @@ BM_ImportMemory (IMG_VOID *pH,
 
                 if (uPSize % uDevVAddrAlignment != 0)
                 {
-                        PVR_DPF((PVR_DBG_ERROR, "Cannot use use this memory sharing workaround with allocations that might be suballocated"));
+                        PVR_DPF((PVR_DBG_ERROR, "Cannot use this memory sharing workaround with allocations that might be suballocated"));
                         goto fail_mapping_alloc;
                 }
                 uDevVAddrAlignment = 0; /* FIXME: find out why it doesn't work if alignment is specified */
@@ -2825,7 +2887,7 @@ BM_ImportMemory (IMG_VOID *pH,
 
             if (uPSize % uDevVAddrAlignment != 0)
             {
-                PVR_DPF((PVR_DBG_ERROR, "Cannot use use this memory sharing workaround with allocations that might be suballocated"));
+                PVR_DPF((PVR_DBG_ERROR, "Cannot use this memory sharing workaround with allocations that might be suballocated"));
                 goto fail_mapping_alloc;
             }
             uDevVAddrAlignment = 0; /* FIXME: find out why it doesn't work if alignment is specified */
@@ -2983,6 +3045,10 @@ BM_ImportMemory (IMG_VOID *pH,
          */
         if ((ui32Flags & PVRSRV_MEM_SPARSE) == 0)
         {
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+                IMG_UINT64 ui64TimeStart;
+                ui64TimeStart = OSClockMonotonicus();
+#endif
                 bResult = DevMemoryAlloc (pBMContext,
                                                                         pMapping,
                                                                         IMG_NULL,
@@ -2996,7 +3062,10 @@ BM_ImportMemory (IMG_VOID *pH,
                                         pMapping->uSize));
                         goto fail_dev_mem_alloc;
                 }
-        
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+                pMapping->ui32TimeToDevMap = OSClockMonotonicus() - ui64TimeStart;
+#endif
+
                 /* uDevVAddrAlignment is currently set to zero so QAC generates warning which we override */
                 /* PRQA S 3356,3358 1 */
                 PVR_ASSERT (uDevVAddrAlignment>1?(pMapping->DevVAddr.uiAddr%uDevVAddrAlignment)==0:1);
@@ -3010,7 +3079,8 @@ BM_ImportMemory (IMG_VOID *pH,
         return IMG_TRUE;
 
 fail_dev_mem_alloc:
-        if (pMapping && (pMapping->CpuVAddr || pMapping->hOSMemHandle))
+        /* pMapping must be valid: if the allocation failed, we'd have jumped to fail_exit */
+        if (pMapping->CpuVAddr || pMapping->hOSMemHandle)
         {
                 /* the size is double the actual size for interleaved allocations */
                 if(pMapping->ui32Flags & PVRSRV_MEM_INTERLEAVED)
@@ -3105,7 +3175,21 @@ BM_FreeMemory (IMG_VOID *h, IMG_UINTPTR_T _base, BM_MAPPING *psMapping)
         */
         if (psMapping->DevVAddr.uiAddr)
         {
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+                unsigned long ulTimeStart = 0;
+                if (psMapping->pui32TimeToDevUnmap)
+                {
+                        /* NON-NULL pointer signifies user has provided space to get timings info in */
+                        ulTimeStart = OSClockMonotonicus();
+                }
+#endif
                 DevMemoryFree (psMapping);
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+                if (psMapping->pui32TimeToDevUnmap)
+                {
+                        *(psMapping->pui32TimeToDevUnmap) = OSClockMonotonicus() - ulTimeStart;
+                }
+#endif
         }
 
         /* the size is double the actual for interleaved */
@@ -3329,8 +3413,8 @@ IMG_UINT32 BM_GetVirtualSize(IMG_HANDLE hBMHandle)
 ******************************************************************************
  @Function      BM_MapPageAtOffset
 
- @Description   utility function check if the specificed offset in a BM mapping
-                is a page that needs tp be mapped
+ @Description   utility function check if the specified offset in a BM mapping
+                is a page that needs to be mapped
 
  @Input     hBMHandle - Handle to BM mapping
 
@@ -3354,10 +3438,10 @@ IMG_BOOL BM_MapPageAtOffset(IMG_HANDLE hBMHandle, IMG_UINT32 ui32Offset)
 
 /*!
 ******************************************************************************
- @Function      BM_VirtOffsetToPhyscial
+ @Function      BM_VirtOffsetToPhysical
 
  @Description   utility function find of physical offset of a sparse allocation
-                from it's virtual offset.
+                from its virtual offset.
 
  @Input     hBMHandle - Handle to BM mapping
 
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/deviceclass.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/deviceclass.c
index 6ae3618..027e982 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/deviceclass.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/deviceclass.c
@@ -338,7 +338,7 @@ PVRSRV_ERROR PVRSRVRegisterDCDeviceKM (PVRSRV_DC_SRV2DISP_KMJTABLE *psFuncTable,
                                                                            IMG_UINT32 *pui32DeviceID)
 {
         PVRSRV_DISPLAYCLASS_INFO        *psDCInfo = IMG_NULL;
-        PVRSRV_DEVICE_NODE                      *psDeviceNode;
+        PVRSRV_DEVICE_NODE                      *psDeviceNode = IMG_NULL;
         SYS_DATA                                        *psSysData;
 
         /*
@@ -439,6 +439,11 @@ ErrorExit:
         OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(PVRSRV_DISPLAYCLASS_INFO), psDCInfo, IMG_NULL);
         /*not nulling pointer, out of scope*/
 
+        if(psDeviceNode)
+        {
+                OSFreeMem(PVRSRV_OS_NON_PAGEABLE_HEAP, sizeof(PVRSRV_DEVICE_NODE), psDeviceNode, IMG_NULL);
+        }
+
         return PVRSRV_ERROR_OUT_OF_MEMORY;
 }
 
@@ -538,7 +543,7 @@ PVRSRV_ERROR PVRSRVRegisterBCDeviceKM (PVRSRV_BC_SRV2BUFFER_KMJTABLE *psFuncTabl
                                                                            IMG_UINT32   *pui32DeviceID)
 {
         PVRSRV_BUFFERCLASS_INFO *psBCInfo = IMG_NULL;
-        PVRSRV_DEVICE_NODE              *psDeviceNode;
+        PVRSRV_DEVICE_NODE              *psDeviceNode = IMG_NULL;
         SYS_DATA                                *psSysData;
         /*
                 IN:
@@ -627,13 +632,18 @@ ErrorExit:
 
         if(psBCInfo->psFuncTable)
         {
-                OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(PPVRSRV_BC_SRV2BUFFER_KMJTABLE), psBCInfo->psFuncTable, IMG_NULL);
+                OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(PVRSRV_BC_SRV2BUFFER_KMJTABLE), psBCInfo->psFuncTable, IMG_NULL);
                 psBCInfo->psFuncTable = IMG_NULL;
         }
 
         OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(PVRSRV_BUFFERCLASS_INFO), psBCInfo, IMG_NULL);
         /*not nulling shared pointer, wasn't allocated to this point*/
 
+        if(psDeviceNode)
+        {
+                OSFreeMem(PVRSRV_OS_NON_PAGEABLE_HEAP, sizeof(PVRSRV_DEVICE_NODE), psDeviceNode, IMG_NULL);
+        }
+
         return PVRSRV_ERROR_OUT_OF_MEMORY;
 }
 
@@ -850,7 +860,6 @@ PVRSRV_ERROR PVRSRVOpenDCDeviceKM (PVRSRV_PER_PROCESS_DATA	*psPerProc,
 
         if(psDCInfo->ui32RefCount++ == 0)
         {
-
                 psDeviceNode = (PVRSRV_DEVICE_NODE *)hDevCookie;
 
                 /* store the device kernel context to map into */
@@ -863,8 +872,7 @@ PVRSRV_ERROR PVRSRVOpenDCDeviceKM (PVRSRV_PER_PROCESS_DATA	*psPerProc,
                 if(eError != PVRSRV_OK)
                 {
                         PVR_DPF((PVR_DBG_ERROR,"PVRSRVOpenDCDeviceKM: Failed sync info alloc"));
-                        psDCInfo->ui32RefCount--;
-                        return eError;
+                        goto ErrorExit;
                 }
 
                 /* open the external device */
@@ -874,9 +882,7 @@ PVRSRV_ERROR PVRSRVOpenDCDeviceKM (PVRSRV_PER_PROCESS_DATA	*psPerProc,
                 if(eError != PVRSRV_OK)
                 {
                         PVR_DPF((PVR_DBG_ERROR,"PVRSRVOpenDCDeviceKM: Failed to open external DC device"));
-                        psDCInfo->ui32RefCount--;
-                        PVRSRVKernelSyncInfoDecRef(psDCInfo->sSystemBuffer.sDeviceClassBuffer.psKernelSyncInfo, IMG_NULL);
-                        return eError;
+                        goto ErrorExitSyncInfo;
                 }
 
                 psDCPerContextInfo->psDCInfo = psDCInfo;
@@ -884,9 +890,7 @@ PVRSRV_ERROR PVRSRVOpenDCDeviceKM (PVRSRV_PER_PROCESS_DATA	*psPerProc,
                 if(eError != PVRSRV_OK)
                 {
                         PVR_DPF((PVR_DBG_ERROR,"PVRSRVOpenDCDeviceKM: Failed to get system buffer"));
-                        psDCInfo->ui32RefCount--;
-                        PVRSRVKernelSyncInfoDecRef(psDCInfo->sSystemBuffer.sDeviceClassBuffer.psKernelSyncInfo, IMG_NULL);
-                        return eError;
+                        goto ErrorExitCloseDevice;
                 }
                 psDCInfo->sSystemBuffer.sDeviceClassBuffer.ui32MemMapRefCount = 0;
         }
@@ -905,6 +909,17 @@ PVRSRV_ERROR PVRSRVOpenDCDeviceKM (PVRSRV_PER_PROCESS_DATA	*psPerProc,
         *phDeviceKM = (IMG_HANDLE)psDCPerContextInfo;
 
         return PVRSRV_OK;
+
+ErrorExitCloseDevice:
+        psDCInfo->psFuncTable->pfnCloseDCDevice(psDCInfo->hExtDevice);
+        
+ErrorExitSyncInfo:
+        PVRSRVKernelSyncInfoDecRef(psDCInfo->sSystemBuffer.sDeviceClassBuffer.psKernelSyncInfo, IMG_NULL);
+
+ErrorExit:
+        OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(PVRSRV_DISPLAYCLASS_PERCONTEXT_INFO), psDCPerContextInfo, IMG_NULL);
+        psDCInfo->ui32RefCount = 0;
+        return eError;
 }
 
 
@@ -1252,6 +1267,12 @@ static PVRSRV_ERROR PVRSRVCreateDCSwapChainRefKM(PVRSRV_PER_PROCESS_DATA	*psPerP
                                                                                                   psSwapChainRef,
                                                                                                   0,
                                                                                                   &DestroyDCSwapChainRefCallBack);
+        if (psSwapChainRef->hResItem == IMG_NULL)
+        {
+                        PVR_DPF ((PVR_DBG_ERROR, "PVRSRVCreateDCSwapChainRefKM: ResManRegisterRes failed"));
+                        OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(PVRSRV_DC_SWAPCHAIN_REF), psSwapChainRef, IMG_NULL);
+                        return PVRSRV_ERROR_INVALID_PARAMS;
+        }
         *ppsSwapChainRef = psSwapChainRef;
 
         return PVRSRV_OK;
@@ -1779,14 +1800,18 @@ static IMG_VOID FreePrivateData(IMG_HANDLE hCallbackData)
 
         if(psCallbackData->ui32PrivDataLength)
         {
-                OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, psCallbackData->ui32PrivDataLength,
+                OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP | PVRSRV_SWAP_BUFFER_ALLOCATION,
+                                  psCallbackData->ui32PrivDataLength,
                                   psCallbackData->pvPrivData, IMG_NULL);
         }
 
-        OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP,
+        OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP | PVRSRV_SWAP_BUFFER_ALLOCATION,
                           sizeof(IMG_VOID *) * psCallbackData->ui32NumMemInfos,
                           psCallbackData->ppvMemInfos, IMG_NULL);
-        OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(CALLBACK_DATA), hCallbackData, IMG_NULL);
+        
+        OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP | PVRSRV_SWAP_BUFFER_ALLOCATION,
+                          sizeof(CALLBACK_DATA),
+                          hCallbackData, IMG_NULL);
 }
 
 IMG_EXPORT
@@ -1813,7 +1838,6 @@ PVRSRV_ERROR PVRSRVSwapToDCBuffer2KM(IMG_HANDLE	hDeviceKM,
         IMG_PVOID *ppvMemInfos;
         PVRSRV_ERROR eError;
         SYS_DATA *psSysData;
-
 #if defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC)
         struct sync_fence *apsFence[SGX_MAX_SRC_SYNCS_TA] = {};
 #endif /* defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC) */
@@ -1836,7 +1860,7 @@ PVRSRV_ERROR PVRSRVSwapToDCBuffer2KM(IMG_HANDLE	hDeviceKM,
                 return PVRSRV_ERROR_INVALID_SWAPINTERVAL;
         }
 
-        eError = OSAllocMem(PVRSRV_OS_PAGEABLE_HEAP,
+        eError = OSAllocMem(PVRSRV_OS_PAGEABLE_HEAP | PVRSRV_SWAP_BUFFER_ALLOCATION,
                                           sizeof(CALLBACK_DATA),
                                           (IMG_VOID **)&psCallbackData, IMG_NULL,
                                           "PVRSRVSwapToDCBuffer2KM callback data");
@@ -1848,9 +1872,9 @@ PVRSRV_ERROR PVRSRVSwapToDCBuffer2KM(IMG_HANDLE	hDeviceKM,
         psCallbackData->pvPrivData = pvPrivData;
         psCallbackData->ui32PrivDataLength = ui32PrivDataLength;
 
-        if(OSAllocMem(PVRSRV_OS_PAGEABLE_HEAP,
-                                  sizeof(IMG_VOID *) * ui32NumMemInfos,
-                                  (IMG_VOID **)&ppvMemInfos, IMG_NULL,
+        if(OSAllocMem(PVRSRV_OS_PAGEABLE_HEAP | PVRSRV_SWAP_BUFFER_ALLOCATION,
+                                  sizeof(void *) * ui32NumMemInfos,
+                                  (void **)&ppvMemInfos, IMG_NULL,
                                   "Swap Command Meminfos") != PVRSRV_OK)
         {
                 PVR_DPF((PVR_DBG_ERROR,"PVRSRVSwapToDCBuffer2KM: Failed to allocate space for meminfo list"));
@@ -2216,11 +2240,11 @@ Exit:
         {
                 if(psCallbackData->ppvMemInfos)
                 {
-                        OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP,
+                        OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP | PVRSRV_SWAP_BUFFER_ALLOCATION,
                                           sizeof(IMG_VOID *) * psCallbackData->ui32NumMemInfos,
                                           psCallbackData->ppvMemInfos, IMG_NULL);
                 }
-                OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(CALLBACK_DATA), psCallbackData, IMG_NULL);
+                OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP | PVRSRV_SWAP_BUFFER_ALLOCATION, sizeof(CALLBACK_DATA), psCallbackData, IMG_NULL);
         }
         if(eError == PVRSRV_ERROR_CANNOT_GET_QUEUE_SPACE)
         {
@@ -2703,7 +2727,7 @@ FoundDevice:
                 if(eError != PVRSRV_OK)
                 {
                         PVR_DPF((PVR_DBG_ERROR,"PVRSRVOpenBCDeviceKM: Failed to open external BC device"));
-                        return eError;
+                        goto ErrorExit;
                 }
 
                 /* get information about the buffers */
@@ -2711,7 +2735,7 @@ FoundDevice:
                 if(eError != PVRSRV_OK)
                 {
                         PVR_DPF((PVR_DBG_ERROR,"PVRSRVOpenBCDeviceKM : Failed to get BC Info"));
-                        return eError;
+                        goto ErrorExitCloseDevice;
                 }
 
                 /* interpret and store info */
@@ -2726,7 +2750,7 @@ FoundDevice:
                 if(eError != PVRSRV_OK)
                 {
                         PVR_DPF((PVR_DBG_ERROR,"PVRSRVOpenBCDeviceKM: Failed to allocate BC buffers"));
-                        return eError;
+                        goto ErrorExitCloseDevice;
                 }
                 OSMemSet (psBCInfo->psBuffer,
                                         0,
@@ -2741,7 +2765,7 @@ FoundDevice:
                         if(eError != PVRSRV_OK)
                         {
                                 PVR_DPF((PVR_DBG_ERROR,"PVRSRVOpenBCDeviceKM: Failed sync info alloc"));
-                                goto ErrorExit;
+                                goto ErrorExitBuffers;
                         }
                         
                         /*
@@ -2755,7 +2779,7 @@ FoundDevice:
                         if(eError != PVRSRV_OK)
                         {
                                 PVR_DPF((PVR_DBG_ERROR,"PVRSRVOpenBCDeviceKM: Failed to get BC buffers"));
-                                goto ErrorExit;
+                                goto ErrorExitBuffers;
                         }
 
                         /* setup common device class info */
@@ -2778,8 +2802,7 @@ FoundDevice:
 
         return PVRSRV_OK;
 
-ErrorExit:
-
+ErrorExitBuffers:
         /* free syncinfos */
         for(i=0; i<psBCInfo->ui32BufferCount; i++)
         {
@@ -2790,12 +2813,15 @@ ErrorExit:
         }
 
         /* free buffers */
-        if(psBCInfo->psBuffer)
-        {
-                OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(PVRSRV_BC_BUFFER), psBCInfo->psBuffer, IMG_NULL);
-                psBCInfo->psBuffer = IMG_NULL;
-        }
+        OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(PVRSRV_BC_BUFFER), psBCInfo->psBuffer, IMG_NULL);
+        psBCInfo->psBuffer = IMG_NULL;
 
+ErrorExitCloseDevice:
+        psBCInfo->psFuncTable->pfnCloseBCDevice(psBCInfo->ui32DeviceID, psBCInfo->hExtDevice);
+
+ErrorExit:
+        OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(PVRSRV_BUFFERCLASS_PERCONTEXT_INFO), psBCPerContextInfo, IMG_NULL);
+        psBCInfo->ui32RefCount = 0;
         return eError;
 }
 
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/devicemem.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/devicemem.c
index d28136f..f6d4463 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/devicemem.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/devicemem.c
@@ -49,21 +49,24 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include "osfunc.h"
 #include "devicemem.h"
 
-#if defined(SUPPORT_DRM_GEM)
-#include "dmabuf.h"
-#endif
-
 #if defined(SUPPORT_ION)
 #include "ion.h"
 #include "env_perproc.h"
+#include "ion_sync.h"
+
+/* Start size of the g_IonSyncHash hash table */
+#define ION_SYNC_HASH_SIZE 20
+HASH_TABLE *g_psIonSyncHash = IMG_NULL;
 #endif
 
-#if defined(SUPPORT_DRM_GEM) || defined(SUPPORT_ION)
-#include "external_sync.h"
+#if defined(SUPPORT_DMABUF)
+#include "dmabuf.h"
+#include "dmabuf_sync.h"
+#include "pvr_linux_fence.h"
 
-/* Start size of the g_ExternalSyncHash hash table */
-#define EXTERNAL_SYNC_HASH_SIZE 20
-HASH_TABLE *g_psExternalSyncHash = IMG_NULL;
+/* Start size of the g_DmaBufSyncHash hash table */
+#define DMABUF_SYNC_HASH_SIZE 20
+HASH_TABLE *g_psDmaBufSyncHash = IMG_NULL;
 #endif
 
 #include "lists.h"
@@ -114,8 +117,8 @@ typedef struct _PVRSRV_DC_MAPINFO_
 
 static IMG_UINT32 g_ui32SyncUID = 0;
 #if defined (MEM_TRACK_INFO_DEBUG)
-PVRSRV_MEM_TRACK_INFO *g_psMemTrackInfoHead = NULL;
-PVRSRV_MEM_TRACK_INFO *g_psMemTrackInfoTail = NULL;
+PVRSRV_MEM_TRACK_INFO *g_psMemTrackInfoHead = IMG_NULL;
+PVRSRV_MEM_TRACK_INFO *g_psMemTrackInfoTail = IMG_NULL;
 IMG_UINT32      g_ui32NumOfOpsRecorded = 0;
 #endif
 
@@ -182,7 +185,7 @@ IMG_EXPORT
 IMG_VOID IMG_CALLCONV PVRSRVPrintMemTrackInfo(IMG_UINT32 ui32FaultAddr)
 {
         PVRSRV_MEM_TRACK_INFO *psMemTrackInfo;
-        const IMG_CHAR *apszMemOpNames[] = {"UNKNOWN", "DEVICE", "DEVICECLASS", "WRAPPED", "MAPPED", "ION", "ALLOC", "FREE"};
+        static const IMG_CHAR * const apszMemOpNames[] = {"UNKNOWN", "DEVICE", "DEVICECLASS", "WRAPPED", "MAPPED", "ION", "DMA-BUF" "ALLOC", "FREE"};
         psMemTrackInfo = g_psMemTrackInfoHead;
 
         PVR_DPF((PVR_DBG_MESSAGE,"PVRSRVMemTrackInfo: Dumping mem tracking info\n"));
@@ -619,6 +622,9 @@ static PVRSRV_ERROR AllocDeviceMem(IMG_HANDLE		hDevCookie,
                                                         ui32NumVirtChunks,
                                                         ui32NumPhysChunks,
                                                         pabMapChunk,
+                                                        #if defined (PVRSRV_DEVMEM_TIME_STATS)
+                                                        &psMemInfo->ui32TimeToDevMap,
+                                                        #endif
                                                         &hBuffer);
 
         if (!bBMError)
@@ -679,7 +685,12 @@ static PVRSRV_ERROR FreeDeviceMem2(PVRSRV_KERNEL_MEM_INFO *psMemInfo, PVRSRV_FRE
         switch(eCallbackOrigin)
         {
                 case PVRSRV_FREE_CALLBACK_ORIGIN_ALLOCATOR:
-                        BM_Free(hBuffer, psMemInfo->ui32Flags);
+                        BM_Free(hBuffer,
+                                        psMemInfo->ui32Flags
+                                        #if defined(PVRSRV_DEVMEM_TIME_STATS)
+                                        ,psMemInfo->pui32TimeToDevUnmap
+                                        #endif
+                                        );
                         break;
                 case PVRSRV_FREE_CALLBACK_ORIGIN_IMPORTER:
                         BM_FreeExport(hBuffer, psMemInfo->ui32Flags);
@@ -712,7 +723,11 @@ static PVRSRV_ERROR FreeDeviceMem(PVRSRV_KERNEL_MEM_INFO *psMemInfo)
 
         hBuffer = psMemInfo->sMemBlk.hBuffer;
 
-        BM_Free(hBuffer, psMemInfo->ui32Flags);
+        BM_Free(hBuffer, psMemInfo->ui32Flags
+                                #if defined(PVRSRV_DEVMEM_TIME_STATS)
+                                , IMG_NULL
+                                #endif
+                                );
 
         if(psMemInfo->pvSysBackupBuffer)
         {
@@ -814,6 +829,10 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVAllocSyncInfoKM(IMG_HANDLE					hDevCookie,
         psSyncData->ui32LastReadOpDumpVal = 0;
         psSyncData->ui64LastWrite = 0;
 
+#if defined(SUPPORT_DMABUF)
+        psKernelSyncInfo->hFenceContext = IMG_NULL;
+#endif
+
 #if defined(SUPPORT_PER_SYNC_DEBUG)
         psKernelSyncInfo->ui32OperationMask = 0;
         memset(psKernelSyncInfo->aui32OpInfo, 0, sizeof(psKernelSyncInfo->aui32OpInfo));
@@ -963,21 +982,21 @@ static IMG_VOID freeExternal(PVRSRV_KERNEL_MEM_INFO *psMemInfo)
                         OSReleasePhysPageAddr(hOSWrapMem);
                 }
         }
-#if defined(SUPPORT_DRM_GEM)
-        else if (psMemInfo->memType == PVRSRV_MEMTYPE_DMABUF)
+#if defined(SUPPORT_ION)
+        else if (psMemInfo->memType == PVRSRV_MEMTYPE_ION)
         {
                 if (hOSWrapMem)
                 {
-                        DmabufUnimportBufferAndReleasePhysAddr(hOSWrapMem);
+                        IonUnimportBufferAndReleasePhysAddr(hOSWrapMem);
                 }
         }
 #endif
-#if defined(SUPPORT_ION)
-        else if (psMemInfo->memType == PVRSRV_MEMTYPE_ION)
+#if defined(SUPPORT_DMABUF)
+        else if (psMemInfo->memType == PVRSRV_MEMTYPE_DMABUF)
         {
                 if (hOSWrapMem)
                 {
-                        IonUnimportBufferAndReleasePhysAddr(hOSWrapMem);
+                        DmaBufUnimportAndReleasePhysAddr(hOSWrapMem);
                 }
         }
 #endif
@@ -1071,14 +1090,21 @@ PVRSRV_ERROR FreeMemCallBackCommon(PVRSRV_KERNEL_MEM_INFO *psMemInfo,
                                 freeExternal(psMemInfo);
                         case PVRSRV_MEMTYPE_DEVICE:
                         case PVRSRV_MEMTYPE_DEVICECLASS:
-#if defined(SUPPORT_DRM_GEM) || defined(SUPPORT_ION)
-                                if (psMemInfo->hExternalSyncInfo)
+#if defined(SUPPORT_ION)
+                                if (psMemInfo->hIonSyncInfo)
                                 {
                                         /*
                                                 For syncs attached to Ion imported buffers we handle
                                                 things a little differently
                                         */
-                                        PVRSRVExternalBufferSyncInfoDecRef(psMemInfo->hExternalSyncInfo, psMemInfo);
+                                        PVRSRVIonBufferSyncInfoDecRef(psMemInfo->hIonSyncInfo, psMemInfo);
+                                }
+                                else
+#endif
+#if defined(SUPPORT_DMABUF)
+                                if (psMemInfo->hDmaBufSyncInfo)
+                                {
+                                        PVRSRVDmaBufSyncInfoDecRef(psMemInfo->hDmaBufSyncInfo, psMemInfo);
                                 }
                                 else
 #endif
@@ -1090,7 +1116,7 @@ PVRSRV_ERROR FreeMemCallBackCommon(PVRSRV_KERNEL_MEM_INFO *psMemInfo,
                                 }
                                 break;
                         default:
-                                PVR_DPF((PVR_DBG_ERROR, "FreeMemCallBackCommon: Unknown memType: %d", psMemInfo->memType));
+                                PVR_DPF((PVR_DBG_ERROR, "FreeMemCallBackCommon: Unknown memType"));
                                 eError = PVRSRV_ERROR_INVALID_MEMINFO;
                 }
         }
@@ -1393,24 +1419,35 @@ free_mainalloc:
         return eError;
 }
 
-#if defined(SUPPORT_DRM_GEM) || defined(SUPPORT_ION)
-PVRSRV_ERROR PVRSRVExternalBufferSyncAcquire(IMG_HANDLE hUnique,
+#if defined(SUPPORT_ION)
+static PVRSRV_ERROR IonUnmapCallback(IMG_PVOID  pvParam,
+                                                                         IMG_UINT32 ui32Param,
+                                                                         IMG_BOOL   bDummy)
+{
+        PVRSRV_KERNEL_MEM_INFO  *psMemInfo = (PVRSRV_KERNEL_MEM_INFO *)pvParam;
+        
+        PVR_UNREFERENCED_PARAMETER(bDummy);
+
+        return FreeMemCallBackCommon(psMemInfo, ui32Param, PVRSRV_FREE_CALLBACK_ORIGIN_ALLOCATOR);
+}
+
+PVRSRV_ERROR PVRSRVIonBufferSyncAcquire(IMG_HANDLE hUnique,
                                                                                 IMG_HANDLE hDevCookie,
                                                                                 IMG_HANDLE hDevMemContext,
-                                                                                PVRSRV_EXTERNAL_SYNC_INFO **ppsExternalSyncInfo)
+                                                                                PVRSRV_ION_SYNC_INFO **ppsIonSyncInfo)
 {
-        PVRSRV_EXTERNAL_SYNC_INFO *psExternalSyncInfo;
+        PVRSRV_ION_SYNC_INFO *psIonSyncInfo;
         PVRSRV_ERROR eError;
         IMG_BOOL bRet;
 
         /* Check the hash to see if we already have a sync for this buffer */
-        psExternalSyncInfo = (PVRSRV_EXTERNAL_SYNC_INFO *) HASH_Retrieve(g_psExternalSyncHash, (IMG_UINTPTR_T) hUnique);
-        if (psExternalSyncInfo == 0)
+        psIonSyncInfo = (PVRSRV_ION_SYNC_INFO *) HASH_Retrieve(g_psIonSyncHash, (IMG_UINTPTR_T) hUnique);
+        if (psIonSyncInfo == 0)
         {
                 /* This buffer is new to us, create the syncinfo for it */
                 eError = OSAllocMem(PVRSRV_PAGEABLE_SELECT,
-                                                        sizeof(PVRSRV_EXTERNAL_SYNC_INFO),
-                                                        (IMG_VOID **)&psExternalSyncInfo, IMG_NULL,
+                                                        sizeof(PVRSRV_ION_SYNC_INFO),
+                                                        (IMG_VOID **)&psIonSyncInfo, IMG_NULL,
                                                         "Ion Synchronization Info");
                 if (eError != PVRSRV_OK)
                 {
@@ -1419,109 +1456,96 @@ PVRSRV_ERROR PVRSRVExternalBufferSyncAcquire(IMG_HANDLE hUnique,
 
                 eError = PVRSRVAllocSyncInfoKM(hDevCookie,
                                                                            hDevMemContext,
-                                                                           &psExternalSyncInfo->psSyncInfo);
+                                                                           &psIonSyncInfo->psSyncInfo);
                 if (eError != PVRSRV_OK)
                 {
                         OSFreeMem(PVRSRV_PAGEABLE_SELECT,
-                                          sizeof(PVRSRV_EXTERNAL_SYNC_INFO),
-                                          psExternalSyncInfo,
+                                          sizeof(PVRSRV_ION_SYNC_INFO),
+                                          psIonSyncInfo,
                                           IMG_NULL);
 
                         return eError;
                 }
 #if defined(SUPPORT_MEMINFO_IDS)
-                psExternalSyncInfo->ui64Stamp = ++g_ui64MemInfoID;
+                psIonSyncInfo->ui64Stamp = ++g_ui64MemInfoID;
 #else
-                psExternalSyncInfo->ui64Stamp = 0;
+                psIonSyncInfo->ui64Stamp = 0;
 #endif
-                bRet = HASH_Insert(g_psExternalSyncHash, (IMG_UINTPTR_T) hUnique, (IMG_UINTPTR_T) psExternalSyncInfo);
+                bRet = HASH_Insert(g_psIonSyncHash, (IMG_UINTPTR_T) hUnique, (IMG_UINTPTR_T) psIonSyncInfo);
                 if (!bRet)
                 {
                         eError = PVRSRV_ERROR_OUT_OF_MEMORY;
 
-                        PVRSRVKernelSyncInfoDecRef(psExternalSyncInfo->psSyncInfo, IMG_NULL);
+                        PVRSRVKernelSyncInfoDecRef(psIonSyncInfo->psSyncInfo, IMG_NULL);
                         OSFreeMem(PVRSRV_PAGEABLE_SELECT,
-                                          sizeof(PVRSRV_EXTERNAL_SYNC_INFO),
-                                          psExternalSyncInfo,
+                                          sizeof(PVRSRV_ION_SYNC_INFO),
+                                          psIonSyncInfo,
                                           IMG_NULL);
 
                         return eError;
                 }
 
-                psExternalSyncInfo->ui32RefCount = 0;
-                psExternalSyncInfo->hUnique = hUnique;
+                psIonSyncInfo->ui32RefCount = 0;
+                psIonSyncInfo->hUnique = hUnique;
         }
 
-        psExternalSyncInfo->ui32RefCount++;
-        *ppsExternalSyncInfo = psExternalSyncInfo;
+        psIonSyncInfo->ui32RefCount++;
+        *ppsIonSyncInfo = psIonSyncInfo;
         return PVRSRV_OK;
 }
 
-IMG_VOID PVRSRVExternalBufferSyncRelease(PVRSRV_EXTERNAL_SYNC_INFO *psExternalSyncInfo)
+IMG_VOID PVRSRVIonBufferSyncRelease(PVRSRV_ION_SYNC_INFO *psIonSyncInfo)
 {
-        psExternalSyncInfo->ui32RefCount--;
+        psIonSyncInfo->ui32RefCount--;
 
-        if (psExternalSyncInfo->ui32RefCount == 0)
+        if (psIonSyncInfo->ui32RefCount == 0)
         {
-                PVRSRV_EXTERNAL_SYNC_INFO *psLookup;
+                PVRSRV_ION_SYNC_INFO *psLookup;
                 /*
                         If we're holding the last reference to the syncinfo
                         then free it
                 */
-                psLookup = (PVRSRV_EXTERNAL_SYNC_INFO *) HASH_Remove(g_psExternalSyncHash, (IMG_UINTPTR_T) psExternalSyncInfo->hUnique);
-                PVR_ASSERT(psLookup == psExternalSyncInfo);
-                PVRSRVKernelSyncInfoDecRef(psExternalSyncInfo->psSyncInfo, IMG_NULL);
+                psLookup = (PVRSRV_ION_SYNC_INFO *) HASH_Remove(g_psIonSyncHash, (IMG_UINTPTR_T) psIonSyncInfo->hUnique);
+                PVR_ASSERT(psLookup == psIonSyncInfo);
+                PVRSRVKernelSyncInfoDecRef(psIonSyncInfo->psSyncInfo, IMG_NULL);
                 OSFreeMem(PVRSRV_PAGEABLE_SELECT,
-                                  sizeof(PVRSRV_EXTERNAL_SYNC_INFO),
-                                  psExternalSyncInfo,
+                                  sizeof(PVRSRV_ION_SYNC_INFO),
+                                  psIonSyncInfo,
                                   IMG_NULL);
         }
 }
-#endif //defined(SUPPORT_DRM_GEM) || defined(SUPPORT_ION)
-
-#if defined(SUPPORT_DRM_GEM)
-static PVRSRV_ERROR DmabufUnmapCallback(IMG_PVOID  pvParam,
-                                                                         IMG_UINT32 ui32Param,
-                                                                         IMG_BOOL   bDummy)
-{
-        PVRSRV_KERNEL_MEM_INFO  *psMemInfo = (PVRSRV_KERNEL_MEM_INFO *)pvParam;
-        
-        PVR_UNREFERENCED_PARAMETER(bDummy);
-
-        return FreeMemCallBackCommon(psMemInfo, ui32Param, PVRSRV_FREE_CALLBACK_ORIGIN_ALLOCATOR);
-}
 
 /*!
 ******************************************************************************
 
- @Function      PVRSRVMapDmabufKM
+ @Function      PVRSRVMapIonHandleKM
 
  @Description
 
- Map a DMABUF buffer into the specified device memory context
+ Map an ION buffer into the specified device memory context
 
  @Input    psPerProc : PerProcess data
  @Input    hDevCookie : Device node cookie
- @Input    hDevMemHeap : Heap dmabuf handles are mapped into
- @Input    ui32NumBuffers : Number of dmabuf handles to map. (If one handle is being
+ @Input    hDevMemHeap : Heap ion handles are mapped into
+ @Input    ui32NumBuffers : Number of ion handles to map. (If one handle is being
                             mapped, this should be 1, not 0.)
- @Input    phDmabuf : Array of ui32NumBuffers dmabuf handles (fds)
+ @Input    phIon : Array of ui32NumBuffers ion handles (fds)
  @Input    ui32Flags : Mapping flags
  @Input    ui32ChunkCount : If ui32NumBuffers is 1, this is the number of
                             "chunks" specified to be mapped into device-virtual
                             address space. If ui32NumBuffers > 1, it is ignored.
  @Input    pauiOffset : Array of offsets in device-virtual address space to map
-                        "chunks" of physical from the dmabuf allocation.
+                        "chunks" of physical from the ion allocation.
  @Input    pauiSize : Array of sizes in bytes of device-virtual address space to
-                      map "chunks" of physical from the dmabuf allocation.
- @Input    puiDmabufBufferSize : Size in bytes of resulting device-virtual mapping.
+                      map "chunks" of physical from the ion allocation.
+ @Input    puiIonBufferSize : Size in bytes of resulting device-virtual mapping.
  @Output   ppsKernelMemInfo: Output kernel meminfo if successful
 
  @Return   PVRSRV_ERROR  :
 
 ******************************************************************************/
 IMG_EXPORT
-PVRSRV_ERROR PVRSRVMapDmabufKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
+PVRSRV_ERROR PVRSRVMapIonHandleKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
                                                                   IMG_HANDLE hDevCookie,
                                                                   IMG_HANDLE hDevMemHeap,
                                                                   IMG_UINT32 ui32NumFDs,
@@ -1530,10 +1554,11 @@ PVRSRV_ERROR PVRSRVMapDmabufKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
                                                                   IMG_UINT32 ui32ChunkCount,
                                                                   IMG_SIZE_T *pauiOffset,
                                                                   IMG_SIZE_T *pauiSize,
-                                                                  IMG_SIZE_T *puiDmabufBufferSize,
+                                                                  IMG_SIZE_T *puiIonBufferSize,
                                                                   PVRSRV_KERNEL_MEM_INFO **ppsKernelMemInfo,
                                                                   IMG_UINT64 *pui64Stamp)
 {
+        PVRSRV_ENV_PER_PROCESS_DATA *psPerProcEnv = PVRSRVProcessPrivateData(psPerProc);
         PVRSRV_DEVICE_NODE *psDeviceNode; 
         PVRSRV_KERNEL_MEM_INFO *psNewKernelMemInfo;
         IMG_SYS_PHYADDR *pasSysPhysAddr;
@@ -1550,7 +1575,8 @@ PVRSRV_ERROR PVRSRVMapDmabufKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
         IMG_BOOL bAllocSync = (ui32Flags & PVRSRV_MEM_NO_SYNCOBJ)?IMG_FALSE:IMG_TRUE;
 
         if ((hDevCookie == IMG_NULL) || (ui32ChunkCount == 0)
-                 || (hDevMemHeap == IMG_NULL) || (ppsKernelMemInfo == IMG_NULL))
+                 || (hDevMemHeap == IMG_NULL) || (ppsKernelMemInfo == IMG_NULL)
+                 || (psPerProcEnv == IMG_NULL))
         {
                 PVR_DPF((PVR_DBG_ERROR, "%s: Invalid params", __FUNCTION__));
                 return PVRSRV_ERROR_INVALID_PARAMS;
@@ -1584,8 +1610,9 @@ PVRSRV_ERROR PVRSRVMapDmabufKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
         }
         OSMemSet(psNewKernelMemInfo, 0, sizeof(PVRSRV_KERNEL_MEM_INFO));
 
-        /* Import the DMABUF buffer into our dmabuf_client and DMA map it */
-        eError = DmabufImportBufferAndAcquirePhysAddr(ui32NumFDs,
+        /* Import the ION buffer into our ion_client and DMA map it */
+        eError = IonImportBufferAndAcquirePhysAddr(psPerProcEnv->psIONClient,
+                                                                                           ui32NumFDs,
                                                                                            pi32BufferFDs,
                                                                                            &ui32PageCount,
                                                                                            &pasSysPhysAddr,
@@ -1594,31 +1621,31 @@ PVRSRV_ERROR PVRSRVMapDmabufKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
                                                                                            &hUnique);
         if (eError != PVRSRV_OK)
         {
-                PVR_DPF((PVR_DBG_ERROR, "%s: Failed to get dmabuf buffer/buffer phys addr", __FUNCTION__));
+                PVR_DPF((PVR_DBG_ERROR, "%s: Failed to get ion buffer/buffer phys addr", __FUNCTION__));
                 goto exitFailedImport;
         }
 
         /*
-                Make sure the number of pages detected by the dmabuf import are at least
+                Make sure the number of pages detected by the ion import are at least
                 the size of the total chunked region
         */
         if(ui32PageCount * PAGE_SIZE < uiMapSize)
         {
-                PVR_DPF((PVR_DBG_ERROR, "%s: dmabuf allocator returned fewer page addresses "
+                PVR_DPF((PVR_DBG_ERROR, "%s: ion allocator returned fewer page addresses "
                                                                 "than specified chunk size(s)", __FUNCTION__));
                 eError = PVRSRV_ERROR_INVALID_PARAMS;
                 goto exitFailedAdjustedAlloc; 
         }
 
         /*
-                An Dmabuf buffer might have a number of "chunks" in it which need to be
+                An Ion buffer might have a number of "chunks" in it which need to be
                 mapped virtually continuous so we need to create a new array of
                 addresses based on this chunk data for the actual wrap
         */
         if(OSAllocMem(PVRSRV_PAGEABLE_SELECT,
                                         sizeof(IMG_SYS_PHYADDR) * (uiMapSize/HOST_PAGESIZE()),
                                         (IMG_VOID **)&pasAdjustedSysPhysAddr, IMG_NULL,
-                                        "Dmabuf adjusted system address array") != PVRSRV_OK)
+                                        "Ion adjusted system address array") != PVRSRV_OK)
         {
                 PVR_DPF((PVR_DBG_ERROR,"%s: Failed to alloc memory for adjusted array", __FUNCTION__));
                 goto exitFailedAdjustedAlloc;
@@ -1644,7 +1671,7 @@ PVRSRV_ERROR PVRSRVMapDmabufKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
                                  &ui32Flags,    /* This function clobbers our bits in ui32Flags */
                                  &hBuffer))
         {
-                PVR_DPF((PVR_DBG_ERROR, "%s: Failed to wrap dmabuf buffer", __FUNCTION__));
+                PVR_DPF((PVR_DBG_ERROR, "%s: Failed to wrap ion buffer", __FUNCTION__));
                 eError = PVRSRV_ERROR_OUT_OF_MEMORY;
                 goto exitFailedWrap;
         }
@@ -1660,7 +1687,7 @@ PVRSRV_ERROR PVRSRVMapDmabufKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
         psNewKernelMemInfo->ui32Flags = ui32Flags;
         psNewKernelMemInfo->sDevVAddr = psMemBlock->sDevVirtAddr;
         psNewKernelMemInfo->uAllocSize = uiMapSize;
-        psNewKernelMemInfo->memType = PVRSRV_MEMTYPE_DMABUF;
+        psNewKernelMemInfo->memType = PVRSRV_MEMTYPE_ION;
         PVRSRVKernelMemInfoIncRef(psNewKernelMemInfo);
 
         /* Clear the Backup buffer pointer as we do not have one at this point. We only allocate this as we are going up/down */
@@ -1672,63 +1699,67 @@ PVRSRV_ERROR PVRSRVMapDmabufKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
         }
         else
         {
-                PVRSRV_EXTERNAL_SYNC_INFO *psExternalSyncInfo;
+                PVRSRV_ION_SYNC_INFO *psIonSyncInfo;
                 BM_HEAP *psBMHeap;
                 IMG_HANDLE hDevMemContext;
 
                 psBMHeap = (BM_HEAP*)hDevMemHeap;
                 hDevMemContext = (IMG_HANDLE)psBMHeap->pBMContext;
 
-                eError = PVRSRVExternalBufferSyncInfoIncRef(hUnique,
+                eError = PVRSRVIonBufferSyncInfoIncRef(hUnique,
                                                                                            hDevCookie,
                                                                                            hDevMemContext,
-                                                                                           &psExternalSyncInfo,
+                                                                                           &psIonSyncInfo,
                                                                                            psNewKernelMemInfo);
                 if(eError != PVRSRV_OK)
                 {
                         goto exitFailedSync;
                 }
-                psNewKernelMemInfo->hExternalSyncInfo = psExternalSyncInfo;
-                psNewKernelMemInfo->psKernelSyncInfo = ExternalBufferSyncGetKernelSyncInfo(psExternalSyncInfo);
-                *pui64Stamp = ExternalBufferSyncGetStamp(psExternalSyncInfo);
+                psNewKernelMemInfo->hIonSyncInfo = psIonSyncInfo;
+                psNewKernelMemInfo->psKernelSyncInfo = IonBufferSyncGetKernelSyncInfo(psIonSyncInfo);
+                *pui64Stamp = IonBufferSyncGetStamp(psIonSyncInfo);
         }
 
         /* register with the resman */
         psNewKernelMemInfo->sMemBlk.hResItem = ResManRegisterRes(psPerProc->hResManContext,
-                                                                                                                         RESMAN_TYPE_DEVICEMEM_DMABUF,
+                                                                                                                         RESMAN_TYPE_DEVICEMEM_ION,
                                                                                                                          psNewKernelMemInfo,
                                                                                                                          0,
-                                                                                                                         &DmabufUnmapCallback);
+                                                                                                                         &IonUnmapCallback);
         if (psNewKernelMemInfo->sMemBlk.hResItem == IMG_NULL)
         {
                 eError = PVRSRV_ERROR_OUT_OF_MEMORY;
                 goto exitFailedResman;
         }
 
-        psNewKernelMemInfo->memType = PVRSRV_MEMTYPE_DMABUF;
+        psNewKernelMemInfo->memType = PVRSRV_MEMTYPE_ION;
 
         /*
                 As the user doesn't tell us the size, just the "chunk" information
-                return actual size of the Dmabuf buffer so we can mmap it.
+                return actual size of the Ion buffer so we can mmap it.
         */
-        *puiDmabufBufferSize = ui32PageCount * HOST_PAGESIZE();
+        *puiIonBufferSize = ui32PageCount * HOST_PAGESIZE();
         *ppsKernelMemInfo = psNewKernelMemInfo;
         return PVRSRV_OK;
 
 exitFailedResman:
         if (psNewKernelMemInfo->psKernelSyncInfo)
         {
-                PVRSRVExternalBufferSyncInfoDecRef(psNewKernelMemInfo->hExternalSyncInfo, psNewKernelMemInfo);
+                PVRSRVIonBufferSyncInfoDecRef(psNewKernelMemInfo->hIonSyncInfo, psNewKernelMemInfo);
         }
 exitFailedSync:
-        BM_Free(hBuffer, ui32Flags);
+        BM_Free(hBuffer, ui32Flags
+                                #if defined (PVRSRV_DEVMEM_TIME_STATS)
+                                        , IMG_NULL
+                                #endif
+                                );
 exitFailedWrap:
         OSFreeMem(PVRSRV_PAGEABLE_SELECT,
                           sizeof(IMG_SYS_PHYADDR) * uiAdjustOffset,
                           pasAdjustedSysPhysAddr,
                           IMG_NULL);
 exitFailedAdjustedAlloc:
-        DmabufUnimportBufferAndReleasePhysAddr(hPriv);
+        IonUnimportBufferAndReleasePhysAddr(hPriv);
 exitFailedImport:
         OSFreeMem(PVRSRV_PAGEABLE_SELECT,
                           sizeof(PVRSRV_KERNEL_MEM_INFO),
@@ -1741,11 +1772,11 @@ exitFailedImport:
 /*!
 ******************************************************************************
 
- @Function      PVRSRVUnmapDmabufKM
+ @Function      PVRSRVUnmapIonHandleKM
 
  @Description
 
- Frees a dmabuf buffer mapped with PVRSRVMapDmabufKM, including the mem_info structure
+ Frees an ion buffer mapped with PVRSRVMapIonHandleKM, including the mem_info structure
 
  @Input    psMemInfo :
 
@@ -1753,7 +1784,7 @@ exitFailedImport:
 
 ******************************************************************************/
 IMG_EXPORT
-PVRSRV_ERROR IMG_CALLCONV PVRSRVUnmapDmabufKM(PVRSRV_KERNEL_MEM_INFO *psMemInfo)
+PVRSRV_ERROR IMG_CALLCONV PVRSRVUnmapIonHandleKM(PVRSRV_KERNEL_MEM_INFO *psMemInfo)
 {
         if (!psMemInfo)
         {
@@ -1762,10 +1793,10 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVUnmapDmabufKM(PVRSRV_KERNEL_MEM_INFO *psMemInfo)
 
         return ResManFreeResByPtr(psMemInfo->sMemBlk.hResItem, CLEANUP_WITH_POLL);
 }
-#endif  /* SUPPORT_DRM_GEM */
+#endif  /* SUPPORT_ION */
 
-#if defined(SUPPORT_ION)
-static PVRSRV_ERROR IonUnmapCallback(IMG_PVOID  pvParam,
+#if defined(SUPPORT_DMABUF)
+static PVRSRV_ERROR DmaBufUnmapCallback(IMG_PVOID  pvParam,
                                                                          IMG_UINT32 ui32Param,
                                                                          IMG_BOOL   bDummy)
 {
@@ -1776,91 +1807,168 @@ static PVRSRV_ERROR IonUnmapCallback(IMG_PVOID  pvParam,
         return FreeMemCallBackCommon(psMemInfo, ui32Param, PVRSRV_FREE_CALLBACK_ORIGIN_ALLOCATOR);
 }
 
+PVRSRV_ERROR PVRSRVDmaBufSyncAcquire(IMG_HANDLE hUnique,
+                                                                                IMG_HANDLE hPriv,
+                                                                                IMG_HANDLE hDevCookie,
+                                                                                IMG_HANDLE hDevMemContext,
+                                                                                PVRSRV_DMABUF_SYNC_INFO **ppsDmaBufSyncInfo)
+{
+        PVRSRV_DMABUF_SYNC_INFO *psDmaBufSyncInfo;
+        PVRSRV_ERROR eError;
+        IMG_BOOL bRet;
+
+        /*
+         * If the import has a unique handle, check the hash to see if we
+         * already have a sync for the buffer.
+         */
+        psDmaBufSyncInfo = hUnique ? (PVRSRV_DMABUF_SYNC_INFO *) HASH_Retrieve(g_psDmaBufSyncHash, (IMG_UINTPTR_T)hUnique) : NULL;
+        if (!psDmaBufSyncInfo)
+        {
+                /* Create the syncinfo for the import */
+                eError = OSAllocMem(PVRSRV_PAGEABLE_SELECT,
+                                                        sizeof(PVRSRV_DMABUF_SYNC_INFO),
+                                                        (IMG_VOID **)&psDmaBufSyncInfo, IMG_NULL,
+                                                        "DMA-BUF Synchronization Info");
+                if (eError != PVRSRV_OK)
+                {
+                        goto ErrorAllocDmaBufSyncInfo;
+                }
+
+                eError = PVRSRVAllocSyncInfoKM(hDevCookie,
+                                                                           hDevMemContext,
+                                                                           &psDmaBufSyncInfo->psSyncInfo);
+                if (eError != PVRSRV_OK)
+                {
+                        goto ErrorAllocSyncInfo;
+                }
+#if defined(SUPPORT_MEMINFO_IDS)
+                psDmaBufSyncInfo->ui64Stamp = ++g_ui64MemInfoID;
+#else
+                psDmaBufSyncInfo->ui64Stamp = 0;
+#endif
+                psDmaBufSyncInfo->ui32RefCount = 0;
+                psDmaBufSyncInfo->hUnique = hUnique;
+
+                psDmaBufSyncInfo->psSyncInfo->hFenceContext = PVRLinuxFenceContextCreate(psDmaBufSyncInfo->psSyncInfo, hPriv);
+                if (!psDmaBufSyncInfo->psSyncInfo->hFenceContext)
+                {
+                        eError = PVRSRV_ERROR_OUT_OF_MEMORY;
+                        goto ErrorCreateFenceContext;
+                }
+
+                if (hUnique)
+                {
+                        bRet = HASH_Insert(g_psDmaBufSyncHash, (IMG_UINTPTR_T)hUnique, (IMG_UINTPTR_T) psDmaBufSyncInfo);
+                        if (!bRet)
+                        {
+                                eError = PVRSRV_ERROR_OUT_OF_MEMORY;
+                                goto ErrorHashInsert;
+                        }
+                }
+        }
+
+        psDmaBufSyncInfo->ui32RefCount++;
+        *ppsDmaBufSyncInfo = psDmaBufSyncInfo;
+        return PVRSRV_OK;
+
+ErrorHashInsert:
+        PVRLinuxFenceContextDestroy(psDmaBufSyncInfo->psSyncInfo->hFenceContext);
+ErrorCreateFenceContext:
+        PVRSRVKernelSyncInfoDecRef(psDmaBufSyncInfo->psSyncInfo, IMG_NULL);
+ErrorAllocSyncInfo:
+        OSFreeMem(PVRSRV_PAGEABLE_SELECT,
+                          sizeof(PVRSRV_DMABUF_SYNC_INFO),
+                          psDmaBufSyncInfo,
+                          IMG_NULL);
+ErrorAllocDmaBufSyncInfo:
+        return eError;
+}
+
+IMG_VOID PVRSRVDmaBufSyncRelease(PVRSRV_DMABUF_SYNC_INFO *psDmaBufSyncInfo)
+{
+        psDmaBufSyncInfo->ui32RefCount--;
+
+        if (psDmaBufSyncInfo->ui32RefCount == 0)
+        {
+                /*
+                        If we're holding the last reference to the syncinfo
+                        then free it
+                */
+                if (psDmaBufSyncInfo->hUnique)
+                {
+                        PVRSRV_DMABUF_SYNC_INFO *psLookup = (PVRSRV_DMABUF_SYNC_INFO *) HASH_Remove(g_psDmaBufSyncHash, (IMG_UINTPTR_T) psDmaBufSyncInfo->hUnique);
+                        (void)psLookup;
+                        PVR_ASSERT(psLookup == psDmaBufSyncInfo);
+                }
+                PVRLinuxFenceContextDestroy(psDmaBufSyncInfo->psSyncInfo->hFenceContext);
+                PVRSRVKernelSyncInfoDecRef(psDmaBufSyncInfo->psSyncInfo, IMG_NULL);
+                OSFreeMem(PVRSRV_PAGEABLE_SELECT,
+                                  sizeof(PVRSRV_DMABUF_SYNC_INFO),
+                                  psDmaBufSyncInfo,
+                                  IMG_NULL);
+        }
+}
+
 /*!
 ******************************************************************************
 
- @Function      PVRSRVMapIonHandleKM
+ @Function      PVRSRVMapDmaBufKM
 
  @Description
 
- Map an ION buffer into the specified device memory context
+ Map a dma_buf into the specified device memory context
 
- @Input    psPerProc : PerProcess data
- @Input    hDevCookie : Device node cookie
- @Input    hDevMemHeap : Heap ion handles are mapped into
- @Input    ui32NumBuffers : Number of ion handles to map. (If one handle is being
-                            mapped, this should be 1, not 0.)
- @Input    phIon : Array of ui32NumBuffers ion handles (fds)
- @Input    ui32Flags : Mapping flags
- @Input    ui32ChunkCount : If ui32NumBuffers is 1, this is the number of
-                            "chunks" specified to be mapped into device-virtual
-                            address space. If ui32NumBuffers > 1, it is ignored.
- @Input    pauiOffset : Array of offsets in device-virtual address space to map
-                        "chunks" of physical from the ion allocation.
- @Input    pauiSize : Array of sizes in bytes of device-virtual address space to
-                      map "chunks" of physical from the ion allocation.
- @Input    puiIonBufferSize : Size in bytes of resulting device-virtual mapping.
- @Output   ppsKernelMemInfo: Output kernel meminfo if successful
+ @Input    psPerProc : PerProcess data.
+ @Input    hDevCookie : Device node cookie.
+ @Input    hDevMemHeap : Heap the buffers are mapped into.
+ @Input    ui32NumFDs : Number of DMA Buf FDs.
+ @Input    pi32DmaBufFD : Array of DMA Buf FDs.
+ @Input    puiDmaBufOffset : Array of offsets into each DMA Buf.
+ @Input    puiSize : Array of sizes of each DMA Buf chunk.
+ @Input    ui32Flags : Mapping flags.
+ @Input    puiDmaBufSize : Size in bytes of resulting device-virtual mapping.
+ @Output   ppsKernelMemInfo: Output kernel meminfo if successful.
+ @Output   puiMemInfoOffset : Array of offsets of each chunk in the meminfo.
 
  @Return   PVRSRV_ERROR  :
 
 ******************************************************************************/
 IMG_EXPORT
-PVRSRV_ERROR PVRSRVMapIonHandleKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
+PVRSRV_ERROR PVRSRVMapDmaBufKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
                                                                   IMG_HANDLE hDevCookie,
                                                                   IMG_HANDLE hDevMemHeap,
-                                                                  IMG_UINT32 ui32NumFDs,
-                                                                  IMG_INT32  *pi32BufferFDs,
                                                                   IMG_UINT32 ui32Flags,
-                                                                  IMG_UINT32 ui32ChunkCount,
-                                                                  IMG_SIZE_T *pauiOffset,
-                                                                  IMG_SIZE_T *pauiSize,
-                                                                  IMG_SIZE_T *puiIonBufferSize,
+                                                                  IMG_UINT32 ui32NumFDs,
+                                                                  IMG_INT32 *pi32DmaBufFD,
+                                                                  IMG_SIZE_T *puiDmaBufOffset,
+                                                                  IMG_SIZE_T *puiDmaBufSize,
                                                                   PVRSRV_KERNEL_MEM_INFO **ppsKernelMemInfo,
+                                                                  IMG_SIZE_T *puiSize,
+                                                                  IMG_SIZE_T *puiMemInfoOffset,
                                                                   IMG_UINT64 *pui64Stamp)
 {
-        PVRSRV_ENV_PER_PROCESS_DATA *psPerProcEnv = PVRSRVProcessPrivateData(psPerProc);
         PVRSRV_DEVICE_NODE *psDeviceNode; 
         PVRSRV_KERNEL_MEM_INFO *psNewKernelMemInfo;
         IMG_SYS_PHYADDR *pasSysPhysAddr;
-        IMG_SYS_PHYADDR *pasAdjustedSysPhysAddr;
         PVRSRV_MEMBLK *psMemBlock;
         PVRSRV_ERROR eError;
         IMG_HANDLE hPriv;
         IMG_HANDLE hUnique;
         BM_HANDLE hBuffer;
         IMG_SIZE_T uiMapSize = 0;
-        IMG_SIZE_T uiAdjustOffset = 0;
         IMG_UINT32 ui32PageCount;
-        IMG_UINT32 i;
-        IMG_BOOL bAllocSync = (ui32Flags & PVRSRV_MEM_NO_SYNCOBJ)?IMG_FALSE:IMG_TRUE;
+        IMG_BOOL bAllocSync = (ui32Flags & PVRSRV_MEM_NO_SYNCOBJ) ? IMG_FALSE : IMG_TRUE;
 
-        if ((hDevCookie == IMG_NULL) || (ui32ChunkCount == 0)
-                 || (hDevMemHeap == IMG_NULL) || (ppsKernelMemInfo == IMG_NULL))
+        if ((hDevCookie == IMG_NULL) || (hDevMemHeap == IMG_NULL)
+                || (ppsKernelMemInfo == IMG_NULL))
         {
                 PVR_DPF((PVR_DBG_ERROR, "%s: Invalid params", __FUNCTION__));
                 return PVRSRV_ERROR_INVALID_PARAMS;
         }
 
-        for (i=0;i<ui32ChunkCount;i++)
-        {
-                if ((pauiOffset[i] & HOST_PAGEMASK) != 0)
-                {
-                        PVR_DPF((PVR_DBG_ERROR,"%s: Chunk offset is not page aligned", __FUNCTION__));
-                        return PVRSRV_ERROR_INVALID_PARAMS;
-                }
-
-                if ((pauiSize[i] & HOST_PAGEMASK) != 0)
-                {
-                        PVR_DPF((PVR_DBG_ERROR,"%s: Chunk size is not page aligned", __FUNCTION__));
-                        return PVRSRV_ERROR_INVALID_PARAMS;
-                }
-                uiMapSize += pauiSize[i];
-        }
-
         psDeviceNode = (PVRSRV_DEVICE_NODE *)hDevCookie;
 
-        if(OSAllocMem(PVRSRV_PAGEABLE_SELECT,
+        if (OSAllocMem(PVRSRV_PAGEABLE_SELECT,
                                         sizeof(PVRSRV_KERNEL_MEM_INFO),
                                         (IMG_VOID **)&psNewKernelMemInfo, IMG_NULL,
                                         "Kernel Memory Info") != PVRSRV_OK)
@@ -1870,68 +1978,36 @@ PVRSRV_ERROR PVRSRVMapIonHandleKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
         }
         OSMemSet(psNewKernelMemInfo, 0, sizeof(PVRSRV_KERNEL_MEM_INFO));
 
-        /* Import the ION buffer into our ion_client and DMA map it */
-        eError = IonImportBufferAndAcquirePhysAddr(psPerProcEnv->psIONClient,
-                                                                                           ui32NumFDs,
-                                                                                           pi32BufferFDs,
+        /* Import the DMA Buffer */
+        eError = DmaBufImportAndAcquirePhysAddr(ui32NumFDs,
+                                                                                           pi32DmaBufFD,
+                                                                                           puiDmaBufOffset,
+                                                                                           puiDmaBufSize,
                                                                                            &ui32PageCount,
                                                                                            &pasSysPhysAddr,
+                                                                                           puiMemInfoOffset,
                                                                                            &psNewKernelMemInfo->pvLinAddrKM,
                                                                                            &hPriv,
                                                                                            &hUnique);
         if (eError != PVRSRV_OK)
         {
-                PVR_DPF((PVR_DBG_ERROR, "%s: Failed to get ion buffer/buffer phys addr", __FUNCTION__));
+                PVR_DPF((PVR_DBG_ERROR, "%s: Failed to get dma-buf phys addr", __FUNCTION__));
                 goto exitFailedImport;
         }
 
-        /*
-                Make sure the number of pages detected by the ion import are at least
-                the size of the total chunked region
-        */
-        if(ui32PageCount * PAGE_SIZE < uiMapSize)
-        {
-                PVR_DPF((PVR_DBG_ERROR, "%s: ion allocator returned fewer page addresses "
-                                                                "than specified chunk size(s)", __FUNCTION__));
-                eError = PVRSRV_ERROR_INVALID_PARAMS;
-                goto exitFailedAdjustedAlloc; 
-        }
-
-        /*
-                An Ion buffer might have a number of "chunks" in it which need to be
-                mapped virtually continuous so we need to create a new array of
-                addresses based on this chunk data for the actual wrap
-        */
-        if(OSAllocMem(PVRSRV_PAGEABLE_SELECT,
-                                        sizeof(IMG_SYS_PHYADDR) * (uiMapSize/HOST_PAGESIZE()),
-                                        (IMG_VOID **)&pasAdjustedSysPhysAddr, IMG_NULL,
-                                        "Ion adjusted system address array") != PVRSRV_OK)
-        {
-                PVR_DPF((PVR_DBG_ERROR,"%s: Failed to alloc memory for adjusted array", __FUNCTION__));
-                goto exitFailedAdjustedAlloc;
-        }
-        OSMemSet(pasAdjustedSysPhysAddr, 0, sizeof(IMG_SYS_PHYADDR) * (uiMapSize/HOST_PAGESIZE()));
-
-        for (i=0;i<ui32ChunkCount;i++)
-        {
-                OSMemCopy(&pasAdjustedSysPhysAddr[uiAdjustOffset],
-                                  &pasSysPhysAddr[pauiOffset[i]/HOST_PAGESIZE()],
-                                  (pauiSize[i]/HOST_PAGESIZE()) * sizeof(IMG_SYS_PHYADDR));
-
-                uiAdjustOffset += pauiSize[i]/HOST_PAGESIZE();
-        }
+        uiMapSize = ui32PageCount * HOST_PAGESIZE();
 
         /* Wrap the returned addresses into our memory context */
         if (!BM_Wrap(hDevMemHeap,
                                  uiMapSize,
                                  0,
                                  IMG_FALSE,
-                                 pasAdjustedSysPhysAddr,
+                                 pasSysPhysAddr,
                                  IMG_NULL,
                                  &ui32Flags,    /* This function clobbers our bits in ui32Flags */
                                  &hBuffer))
         {
-                PVR_DPF((PVR_DBG_ERROR, "%s: Failed to wrap ion buffer", __FUNCTION__));
+                PVR_DPF((PVR_DBG_ERROR, "%s: Failed to wrap dma-buf", __FUNCTION__));
                 eError = PVRSRV_ERROR_OUT_OF_MEMORY;
                 goto exitFailedWrap;
         }
@@ -1942,80 +2018,75 @@ PVRSRV_ERROR PVRSRVMapIonHandleKM(PVRSRV_PER_PROCESS_DATA *psPerProc,
         psMemBlock->hOSMemHandle = BM_HandleToOSMemHandle(hBuffer);
         psMemBlock->hBuffer = (IMG_HANDLE) hBuffer;
         psMemBlock->hOSWrapMem = hPriv;                 /* Saves creating a new element as we know hOSWrapMem will not be used */
-        psMemBlock->psIntSysPAddr = pasAdjustedSysPhysAddr;
+        psMemBlock->psIntSysPAddr = pasSysPhysAddr;
 
         psNewKernelMemInfo->ui32Flags = ui32Flags;
         psNewKernelMemInfo->sDevVAddr = psMemBlock->sDevVirtAddr;
         psNewKernelMemInfo->uAllocSize = uiMapSize;
-        psNewKernelMemInfo->memType = PVRSRV_MEMTYPE_ION;
+        psNewKernelMemInfo->memType = PVRSRV_MEMTYPE_DMABUF;
         PVRSRVKernelMemInfoIncRef(psNewKernelMemInfo);
 
-        /* Clear the Backup buffer pointer as we do not have one at this point. We only allocate this as we are going up/down */
-        psNewKernelMemInfo->pvSysBackupBuffer = IMG_NULL;
-
         if (!bAllocSync)
         {
                 psNewKernelMemInfo->psKernelSyncInfo = IMG_NULL;
         }
         else
         {
-                PVRSRV_EXTERNAL_SYNC_INFO *psExternalSyncInfo;
+                PVRSRV_DMABUF_SYNC_INFO *psDmaBufSyncInfo;
                 BM_HEAP *psBMHeap;
                 IMG_HANDLE hDevMemContext;
 
                 psBMHeap = (BM_HEAP*)hDevMemHeap;
                 hDevMemContext = (IMG_HANDLE)psBMHeap->pBMContext;
 
-                eError = PVRSRVExternalBufferSyncInfoIncRef(hUnique,
+                eError = PVRSRVDmaBufSyncInfoIncRef(hUnique,
+                                                                                           hPriv,
                                                                                            hDevCookie,
                                                                                            hDevMemContext,
-                                                                                           &psExternalSyncInfo,
+                                                                                           &psDmaBufSyncInfo,
                                                                                            psNewKernelMemInfo);
                 if(eError != PVRSRV_OK)
                 {
                         goto exitFailedSync;
                 }
-                psNewKernelMemInfo->hExternalSyncInfo = psExternalSyncInfo;
-                psNewKernelMemInfo->psKernelSyncInfo = ExternalBufferSyncGetKernelSyncInfo(psExternalSyncInfo);
-                *pui64Stamp = ExternalBufferSyncGetStamp(psExternalSyncInfo);
+                psNewKernelMemInfo->hDmaBufSyncInfo = psDmaBufSyncInfo;
+                psNewKernelMemInfo->psKernelSyncInfo = psDmaBufSyncInfo->psSyncInfo;
+                *pui64Stamp = DmaBufSyncGetStamp(psDmaBufSyncInfo);
         }
 
         /* register with the resman */
         psNewKernelMemInfo->sMemBlk.hResItem = ResManRegisterRes(psPerProc->hResManContext,
-                                                                                                                         RESMAN_TYPE_DEVICEMEM_ION,
+                                                                                                                         RESMAN_TYPE_DEVICEMEM_DMABUF,
                                                                                                                          psNewKernelMemInfo,
                                                                                                                          0,
-                                                                                                                         &IonUnmapCallback);
+                                                                                                                         &DmaBufUnmapCallback);
         if (psNewKernelMemInfo->sMemBlk.hResItem == IMG_NULL)
         {
                 eError = PVRSRV_ERROR_OUT_OF_MEMORY;
                 goto exitFailedResman;
         }
 
-        psNewKernelMemInfo->memType = PVRSRV_MEMTYPE_ION;
+        psNewKernelMemInfo->memType = PVRSRV_MEMTYPE_DMABUF;
 
-        /*
-                As the user doesn't tell us the size, just the "chunk" information
-                return actual size of the Ion buffer so we can mmap it.
-        */
-        *puiIonBufferSize = ui32PageCount * HOST_PAGESIZE();
+        /* Return actual size of the imported memory so we can mmap it */
+        *puiSize = uiMapSize;
         *ppsKernelMemInfo = psNewKernelMemInfo;
         return PVRSRV_OK;
 
 exitFailedResman:
         if (psNewKernelMemInfo->psKernelSyncInfo)
         {
-                PVRSRVExternalBufferSyncInfoDecRef(psNewKernelMemInfo->hExternalSyncInfo, psNewKernelMemInfo);
+                PVRSRVDmaBufSyncInfoDecRef(psNewKernelMemInfo->hDmaBufSyncInfo, psNewKernelMemInfo);
         }
 exitFailedSync:
-        BM_Free(hBuffer, ui32Flags);
+        BM_Free(hBuffer, ui32Flags
+                                #if defined (PVRSRV_DEVMEM_TIME_STATS)
+                                        , IMG_NULL
+                                #endif
+                                );
+
 exitFailedWrap:
-        OSFreeMem(PVRSRV_PAGEABLE_SELECT,
-                          sizeof(IMG_SYS_PHYADDR) * uiAdjustOffset,
-                          pasAdjustedSysPhysAddr,
-                          IMG_NULL);
-exitFailedAdjustedAlloc:
-        IonUnimportBufferAndReleasePhysAddr(hPriv);
+        DmaBufUnimportAndReleasePhysAddr(hPriv);
 exitFailedImport:
         OSFreeMem(PVRSRV_PAGEABLE_SELECT,
                           sizeof(PVRSRV_KERNEL_MEM_INFO),
@@ -2028,11 +2099,11 @@ exitFailedImport:
 /*!
 ******************************************************************************
 
- @Function      PVRSRVUnmapIonHandleKM
+ @Function      PVRSRVUnmapDmaBufKM
 
  @Description
 
- Frees an ion buffer mapped with PVRSRVMapIonHandleKM, including the mem_info structure
+ Releases a dma_buf mapped with PVRSRVMapDmaBufKM, including the mem_info structure
 
  @Input    psMemInfo :
 
@@ -2040,7 +2111,7 @@ exitFailedImport:
 
 ******************************************************************************/
 IMG_EXPORT
-PVRSRV_ERROR IMG_CALLCONV PVRSRVUnmapIonHandleKM(PVRSRV_KERNEL_MEM_INFO *psMemInfo)
+PVRSRV_ERROR IMG_CALLCONV PVRSRVUnmapDmaBufKM(PVRSRV_KERNEL_MEM_INFO *psMemInfo)
 {
         if (!psMemInfo)
         {
@@ -2049,7 +2120,7 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVUnmapIonHandleKM(PVRSRV_KERNEL_MEM_INFO *psMemIn
 
         return ResManFreeResByPtr(psMemInfo->sMemBlk.hResItem, CLEANUP_WITH_POLL);
 }
-#endif  /* SUPPORT_ION */
+#endif  /* SUPPORT_DMABUF */
 
 /*!
 ******************************************************************************
@@ -2294,7 +2365,7 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVWrapExtMemoryKM(IMG_HANDLE				hDevCookie,
                 }
                 else
                 {
-                        PVR_DPF((PVR_DBG_ERROR, "PVRSRVWrapExtMemoryKM: invalid parameter, no address specificed"));
+                        PVR_DPF((PVR_DBG_ERROR, "PVRSRVWrapExtMemoryKM: invalid parameter, no address specified"));
                 }
                 return PVRSRV_ERROR_INVALID_PARAMS;
         }
@@ -2404,7 +2475,9 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVWrapExtMemoryKM(IMG_HANDLE				hDevCookie,
                                                                         &psMemInfo->psKernelSyncInfo);
         if(eError != PVRSRV_OK)
         {
-                goto ErrorExitPhase4;
+                FreeDeviceMem(psMemInfo);
+                /*  FreeDeviceMem will free the meminfo so jump straight to ErrorExitPhase2 */
+                goto ErrorExitPhase2;
         }
 
         /* increment the refcount */
@@ -2447,27 +2520,12 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVWrapExtMemoryKM(IMG_HANDLE				hDevCookie,
         return PVRSRV_OK;
 
         /* error handling: */
-
-ErrorExitPhase4:
-        if(psMemInfo)
-        {
-                FreeDeviceMem(psMemInfo);
-                /*
-                        FreeDeviceMem will free the meminfo so set
-                        it to NULL to avoid double free below
-                */
-                psMemInfo = IMG_NULL;
-        }
-
 ErrorExitPhase3:
-        if(psMemInfo)
-        {
-                OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(PVRSRV_KERNEL_MEM_INFO), psMemInfo, IMG_NULL);
-                /*not nulling pointer, out of scope*/
-        }
+        OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(PVRSRV_KERNEL_MEM_INFO), psMemInfo, IMG_NULL);
+        /*not nulling pointer, out of scope*/
 
 ErrorExitPhase2:
-        if(psIntSysPAddr)
+        if(hOSWrapMem)
         {
                 OSReleasePhysPageAddr(hOSWrapMem);
         }
@@ -3116,7 +3174,15 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVMapDeviceClassMemoryKM(PVRSRV_PER_PROCESS_DATA	*
                 if (eError != PVRSRV_OK)
                 {
                         PVR_DPF((PVR_DBG_ERROR,"PVRSRVMapDeviceClassMemoryKM: AllocMemTilingRange failed"));
-                        goto ErrorExitPhase3;
+
+                        if (psMemInfo->psKernelSyncInfo)
+                        {
+                                PVRSRVKernelSyncInfoDecRef(psMemInfo->psKernelSyncInfo, psMemInfo);
+                        }
+                        FreeDeviceMem(psMemInfo);
+
+                        /* FreeDeviceMem will free the meminfo so jump straight to the final exit */
+                        goto ErrorExitPhase1;
                 }
         }
 #endif
@@ -3178,36 +3244,11 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVMapDeviceClassMemoryKM(PVRSRV_PER_PROCESS_DATA	*
 #endif
         return PVRSRV_OK;
 
-#if defined(SUPPORT_MEMORY_TILING)
-ErrorExitPhase3:
-        if(psMemInfo)
-        {
-                if (psMemInfo->psKernelSyncInfo)
-                {
-                        PVRSRVKernelSyncInfoDecRef(psMemInfo->psKernelSyncInfo, psMemInfo);
-                }
-
-                FreeDeviceMem(psMemInfo);
-                /*
-                        FreeDeviceMem will free the meminfo so set
-                        it to NULL to avoid double free below
-                */
-                psMemInfo = IMG_NULL;
-        }
-#endif
-
 ErrorExitPhase2:
-        if(psMemInfo)
-        {
-                OSFreeMem(PVRSRV_PAGEABLE_SELECT, sizeof(PVRSRV_KERNEL_MEM_INFO), psMemInfo, IMG_NULL);
-        }
+        OSFreeMem(PVRSRV_PAGEABLE_SELECT, sizeof(PVRSRV_KERNEL_MEM_INFO), psMemInfo, IMG_NULL);
 
 ErrorExitPhase1:
-        if(psDCMapInfo)
-        {
-                OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(PVRSRV_KERNEL_MEM_INFO), psDCMapInfo, IMG_NULL);
-        }
-
+        OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(PVRSRV_DC_MAPINFO), psDCMapInfo, IMG_NULL);
         return eError;
 }
 
@@ -3241,27 +3282,53 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVInitDeviceMem(IMG_VOID)
 {
         PVRSRV_ERROR eError = PVRSRV_OK;
 
-#if defined(SUPPORT_ION) || defined(SUPPORT_DRM_GEM)
+#if defined(SUPPORT_ION)
         /*
-                For Ion and GEM buffers we need to store which ones we know about so
+                For Ion buffers we need to store which ones we know about so
                 we don't give the same buffer a different sync
         */
-        PVR_DPF((PVR_DBG_ERROR,"PVRSRVInitDeviceMem: Creating external hash"));
-        g_psExternalSyncHash = HASH_Create(EXTERNAL_SYNC_HASH_SIZE);
-        if (g_psExternalSyncHash == IMG_NULL)
+        g_psIonSyncHash = HASH_Create(ION_SYNC_HASH_SIZE);
+        if (!g_psIonSyncHash)
+        {
+                eError = PVRSRV_ERROR_OUT_OF_MEMORY;
+                goto Error;
+        }
+#endif
+#if defined(SUPPORT_DMABUF)
+        g_psDmaBufSyncHash = HASH_Create(DMABUF_SYNC_HASH_SIZE);
+        if (!g_psDmaBufSyncHash)
         {
-        PVR_DPF((PVR_DBG_ERROR,"PVRSRVInitDeviceMem: Creating external hash failed"));
                 eError = PVRSRV_ERROR_OUT_OF_MEMORY;
+                goto Error;
         }
 #endif
 
+#if defined(SUPPORT_ION) || defined(SUPPORT_DMABUF)
+        return PVRSRV_OK;
+Error:
+#endif
+#if defined(SUPPORT_DMABUF)
+        if (g_psDmaBufSyncHash)
+        {
+                HASH_Delete(g_psDmaBufSyncHash);
+        }
+#endif
+#if defined(SUPPORT_ION)
+        if (g_psIonSyncHash)
+        {
+                HASH_Delete(g_psIonSyncHash);
+        }
+#endif
         return eError;
 }
 
 IMG_VOID IMG_CALLCONV PVRSRVDeInitDeviceMem(IMG_VOID)
 {
-#if defined(SUPPORT_ION) || defined(SUPPORT_DRM_GEM)
-        HASH_Delete(g_psExternalSyncHash);
+#if defined(SUPPORT_DMABUF)
+        HASH_Delete(g_psDmaBufSyncHash);
+#endif
+#if defined(SUPPORT_ION)
+        HASH_Delete(g_psIonSyncHash);
 #endif
 }
 
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/handle.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/handle.c
index b9facfd..b1ac749 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/handle.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/handle.c
@@ -48,7 +48,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  * threaded environment.  In particular, it is assumed that the code will
  * never be called from an interrupt handler.
  *
- * The implmentation supports movable handle structures, allowing the address
+ * The implementation supports movable handle structures, allowing the address
  * of a handle structure to change without having to fix up pointers in
  * any of the handle structures.  For example, the linked list mechanism
  * used to link subhandles together uses handle array indices rather than
@@ -1137,7 +1137,7 @@ static PVRSRV_ERROR FreeHandle(PVRSRV_HANDLE_BASE *psBase, struct sHandle *psHan
                 else
                 {
                         /*
-                         * Put the handle pointer on the end of the the free
+                         * Put the handle pointer on the end of the free
                          * handle pointer linked list.
                          */
                         PVR_ASSERT(psBase->ui32LastFreeIndexPlusOne != 0);
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/hash.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/hash.c
index 72432fd..8dcedf9 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/hash.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/hash.c
@@ -285,6 +285,7 @@ _Resize (HASH_TABLE *pHash, IMG_UINT32 uNewSize)
 
         if (_Rehash (pHash, pHash->ppBucketTable, pHash->uSize, ppNewTable, uNewSize) != PVRSRV_OK)
                 {
+                        OSFreeMem (PVRSRV_PAGEABLE_SELECT, sizeof(BUCKET *) * uNewSize, ppNewTable, IMG_NULL);
                         return IMG_FALSE;
                 }
 
@@ -396,7 +397,7 @@ HASH_Delete (HASH_TABLE *pHash)
                 if(pHash->uCount != 0)
                 {
                         PVR_DPF ((PVR_DBG_ERROR, "HASH_Delete: leak detected in hash table!"));
-                        PVR_DPF ((PVR_DBG_ERROR, "Likely Cause: client drivers not freeing alocations before destroying devmemcontext"));
+                        PVR_DPF ((PVR_DBG_ERROR, "Likely Cause: client drivers not freeing allocations before destroying devmemcontext"));
                 }
                 OSFreeMem(PVRSRV_PAGEABLE_SELECT, sizeof(BUCKET *)*pHash->uSize, pHash->ppBucketTable, IMG_NULL);
                 pHash->ppBucketTable = IMG_NULL;
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/pdump_common.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/pdump_common.c
index efedb61..232d19c 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/pdump_common.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/pdump_common.c
@@ -83,10 +83,7 @@ IMG_BOOL _PDumpIsProcessActive(IMG_VOID)
         PVRSRV_PER_PROCESS_DATA* psPerProc = PVRSRVFindPerProcessData();
         if(psPerProc == IMG_NULL)
         {
-                /* FIXME: kernel process logs some comments when kernel module is
-                 * loaded, want to keep those.
-                 */
-                return IMG_TRUE;
+                return IMG_FALSE;
         }
         return psPerProc->bPDumpActive;
 }
@@ -932,6 +929,7 @@ PVRSRV_ERROR PDumpMemPolKM(PVRSRV_KERNEL_MEM_INFO		*psMemInfo,
 static PVRSRV_ERROR _PDumpMemIntKM(IMG_PVOID pvAltLinAddr,
                                                                    PVRSRV_KERNEL_MEM_INFO *psMemInfo,
                                                                    IMG_UINT32 ui32Offset,
+                                                                   IMG_UINT32 ui32PhyOffset,
                                                                    IMG_UINT32 ui32Bytes,
                                                                    IMG_UINT32 ui32Flags,
                                                                    IMG_HANDLE hUniqueTag)
@@ -1043,11 +1041,23 @@ static PVRSRV_ERROR _PDumpMemIntKM(IMG_PVOID pvAltLinAddr,
                 query the buffer manager for the physical pages that back the
                 virtual address
         */
-        PDumpOSCPUVAddrToPhysPages(psMemInfo->sMemBlk.hOSMemHandle,
-                        ui32Offset,
-                        pui8LinAddr,
-                        psMMUAttrib->ui32DataPageMask,
-                        &ui32PageByteOffset);
+
+        if (psMemInfo->ui32Flags & PVRSRV_MEM_SPARSE)
+        {
+                PDumpOSCPUVAddrToPhysPages(psMemInfo->sMemBlk.hOSMemHandle,
+                                ui32PhyOffset,
+                                pui8LinAddr,
+                                psMMUAttrib->ui32DataPageMask,
+                                &ui32PageByteOffset);
+        }
+        else
+        {
+                PDumpOSCPUVAddrToPhysPages(psMemInfo->sMemBlk.hOSMemHandle,
+                                ui32Offset,
+                                pui8LinAddr,
+                                psMMUAttrib->ui32DataPageMask,
+                                &ui32PageByteOffset);
+        }
         ui32DataPageSize = psMMUAttrib->ui32DataPageMask + 1;
         ui32NumPages = (ui32PageByteOffset + ui32Bytes + psMMUAttrib->ui32DataPageMask) / ui32DataPageSize;
 
@@ -1156,6 +1166,7 @@ PVRSRV_ERROR PDumpMemKM(IMG_PVOID pvAltLinAddr,
                 return _PDumpMemIntKM(pvAltLinAddr,
                                                           psMemInfo,
                                                           ui32Offset,
+                                                          0,
                                                           ui32Bytes,
                                                           ui32Flags,
                                                           hUniqueTag);
@@ -2531,13 +2542,30 @@ PVRSRV_ERROR PDumpMemUM(PVRSRV_PER_PROCESS_DATA *psPerProc,
                         if the a page exists at that address
                 */
                 IMG_UINT32 ui32BytesRemain = ui32Bytes;
+                IMG_UINT32 ui32BytesToCopy = 0;
                 IMG_UINT32 ui32InPageStart = ui32Offset & (~HOST_PAGEMASK);
                 IMG_UINT32 ui32PageOffset = ui32Offset & (HOST_PAGEMASK);
-                IMG_UINT32 ui32BytesToCopy = MIN(HOST_PAGESIZE() - ui32InPageStart, ui32BytesRemain);
+                IMG_UINT32 ui32InPhyPageStart = 0;
+
+                if(ui32InPageStart != 0)
+                {
+                        IMG_UINT32 ui32DummyInPageStart = 0;
+                        
+                        while(ui32DummyInPageStart != ui32InPageStart)
+                        {
+                                if (BM_MapPageAtOffset(BM_MappingHandleFromBuffer(psMemInfo->sMemBlk.hBuffer), ui32DummyInPageStart))
+                                {
+                                        ui32InPhyPageStart += HOST_PAGESIZE();
+                                }
+                                ui32DummyInPageStart += HOST_PAGESIZE();
+                        }
+                }
 
                 do
                 {
-                        if (BM_MapPageAtOffset(BM_MappingHandleFromBuffer(psMemInfo->sMemBlk.hBuffer), ui32PageOffset))
+                        ui32BytesToCopy = MIN(HOST_PAGESIZE() - ui32PageOffset, ui32BytesRemain);
+
+                        if (BM_MapPageAtOffset(BM_MappingHandleFromBuffer(psMemInfo->sMemBlk.hBuffer), ui32InPageStart))
                         {
                                 eError = OSCopyFromUser(psPerProc,
                                                            pvAddrKM,
@@ -2556,6 +2584,7 @@ PVRSRV_ERROR PDumpMemUM(PVRSRV_PER_PROCESS_DATA *psPerProc,
                                 eError = _PDumpMemIntKM(pvAddrKM,
                                                                                 psMemInfo,
                                                                                 ui32PageOffset + ui32InPageStart,
+                                                                                ui32PageOffset + ui32InPhyPageStart,
                                                                                 ui32BytesToCopy,
                                                                                 ui32Flags,
                                                                                 hUniqueTag);
@@ -2573,12 +2602,14 @@ PVRSRV_ERROR PDumpMemUM(PVRSRV_PER_PROCESS_DATA *psPerProc,
                                         PVR_ASSERT(ui32BytesToCopy == 0);
                                         return eError;
                                 }
+                                ui32InPhyPageStart += HOST_PAGESIZE();
                         }
 
                         VPTR_INC(pvAddrUM, ui32BytesToCopy);
                         ui32BytesRemain -= ui32BytesToCopy;
-                        ui32InPageStart = 0;
-                        ui32PageOffset += HOST_PAGESIZE();
+                        ui32InPageStart += HOST_PAGESIZE();
+                        ui32PageOffset = 0;
+
                 } while(ui32BytesRemain);
         }
         else
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/pvrsrv.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/pvrsrv.c
index 1ebb95e..28cc574 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/pvrsrv.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/pvrsrv.c
@@ -59,7 +59,6 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include "lists.h"
 
 IMG_UINT32      g_ui32InitFlags;
-IMG_UINT32  g_iDrmFd = -1;
 
 /* mark which parts of Services were initialised */
 #define         INIT_DATA_ENABLE_PDUMPINIT      0x1U
@@ -459,7 +458,7 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVInit(PSYS_DATA psSysData)
         g_ui32InitFlags |= INIT_DATA_ENABLE_PDUMPINIT;
 #endif
 
-#if defined(SUPPORT_ION) || defined(SUPPORT_DRM_GEM)
+#if defined(SUPPORT_ION) || defined(SUPPORT_DMABUF)
         eError = PVRSRVInitDeviceMem();
         if (eError != PVRSRV_OK)
                 goto Error;
@@ -503,7 +502,7 @@ IMG_VOID IMG_CALLCONV PVRSRVDeInit(PSYS_DATA psSysData)
         PERFDEINIT();
 
 
-#if defined(SUPPORT_ION) || defined(SUPPORT_DRM_GEM)
+#if defined(SUPPORT_ION) || defined(SUPPORT_DMABUF)
         if ((g_ui32InitFlags & INIT_DATA_ENABLE_DEVMEM) > 0)
         {
                 PVRSRVDeInitDeviceMem();
@@ -1016,19 +1015,24 @@ PVRSRV_ERROR IMG_CALLCONV PollForValueKM (volatile IMG_UINT32*	pui32LinMemAddr,
                 /* For the Emulator we want the system to stop when a lock-up is detected so the state can be analysed.
                  * Also the Emulator is much slower than real silicon so timeouts are not valid. 
                  */
-                do
+                if((*pui32LinMemAddr & ui32Mask) == ui32Value)
                 {
-                        if((*pui32LinMemAddr & ui32Mask) == ui32Value)
-                        {
-                                return PVRSRV_OK;
-                        }
+                        return PVRSRV_OK;
+                }
 
+                do
+                {
                         #if defined(__linux__)
                         OSWaitus(ui32PollPeriodus);
                         #else
                         OSReleaseThreadQuanta();
                         #endif  
 
+                        if((*pui32LinMemAddr & ui32Mask) == ui32Value)
+                        {
+                                return PVRSRV_OK;
+                        }
+
                 } while (ui32Timeoutus); /* Endless loop only for the Emulator */
         }
 #else
@@ -1040,15 +1044,15 @@ PVRSRV_ERROR IMG_CALLCONV PollForValueKM (volatile IMG_UINT32*	pui32LinMemAddr,
                         PVR_ASSERT(ui32PollPeriodus >= 1000);
                 }
 
+                ui32ActualValue = (*pui32LinMemAddr & ui32Mask);
+                if(ui32ActualValue == ui32Value)
+                {
+                        return PVRSRV_OK;
+                }
+
                 /* PRQA S 3415,4109 1 */ /* macro format critical - leave alone */
                 LOOP_UNTIL_TIMEOUT(ui32Timeoutus)
                 {
-                        ui32ActualValue = (*pui32LinMemAddr & ui32Mask);
-                        if(ui32ActualValue == ui32Value)
-                        {
-                                return PVRSRV_OK;
-                        }
-                        
                         if (bAllowPreemption)
                         {
                                 OSSleepms(ui32PollPeriodus / 1000);
@@ -1057,6 +1061,13 @@ PVRSRV_ERROR IMG_CALLCONV PollForValueKM (volatile IMG_UINT32*	pui32LinMemAddr,
                         {
                                 OSWaitus(ui32PollPeriodus);
                         }
+
+                        ui32ActualValue = (*pui32LinMemAddr & ui32Mask);
+                        if(ui32ActualValue == ui32Value)
+                        {
+                                return PVRSRV_OK;
+                        }
+
                 } END_LOOP_UNTIL_TIMEOUT();
         
                 PVR_DPF((PVR_DBG_ERROR,"PollForValueKM: Timeout. Expected 0x%x but found 0x%x (mask 0x%x).",
@@ -1217,9 +1228,7 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVGetMiscInfoKM(PVRSRV_MISC_INFO *psMiscInfo)
                                                                                 |PVRSRV_MISC_INFO_FREEMEM_PRESENT
                                                                                 |PVRSRV_MISC_INFO_GET_REF_COUNT_PRESENT
                                                                                 |PVRSRV_MISC_INFO_GET_PAGE_SIZE_PRESENT
-                                                                                |PVRSRV_MISC_INFO_FORCE_SWAP_TO_SYSTEM_PRESENT
-                                                                                |PVRSRV_MISC_INFO_GET_DRM_FD_PRESENT
-                                                                                |PVRSRV_MISC_INFO_SET_DRM_FD_PRESENT))
+                                                                                |PVRSRV_MISC_INFO_FORCE_SWAP_TO_SYSTEM_PRESENT))
         {
                 PVR_DPF((PVR_DBG_ERROR,"PVRSRVGetMiscInfoKM: invalid state request flags"));
                 return PVRSRV_ERROR_INVALID_PARAMS;
@@ -1413,12 +1422,15 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVGetMiscInfoKM(PVRSRV_MISC_INFO *psMiscInfo)
 
                         if(psMiscInfo->sCacheOpCtl.eCacheOpType == PVRSRV_MISC_INFO_CPUCACHEOP_FLUSH)
                         {
-                                if(!OSFlushCPUCacheRangeKM(psKernelMemInfo->sMemBlk.hOSMemHandle,
-                                                                                   0,
-                                                                                   psMiscInfo->sCacheOpCtl.pvBaseVAddr,
-                                                                                   psMiscInfo->sCacheOpCtl.ui32Length))
+                                if(psMiscInfo->sCacheOpCtl.ui32Length!=0)
                                 {
-                                        return PVRSRV_ERROR_CACHEOP_FAILED;
+                                        if(!OSFlushCPUCacheRangeKM(psKernelMemInfo->sMemBlk.hOSMemHandle,
+                                                                                           0,
+                                                                                           psMiscInfo->sCacheOpCtl.pvBaseVAddr,
+                                                                                           psMiscInfo->sCacheOpCtl.ui32Length))
+                                        {
+                                                return PVRSRV_ERROR_CACHEOP_FAILED;
+                                        }
                                 }
                         }
                         else if(psMiscInfo->sCacheOpCtl.eCacheOpType == PVRSRV_MISC_INFO_CPUCACHEOP_CLEAN)
@@ -1480,18 +1492,6 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVGetMiscInfoKM(PVRSRV_MISC_INFO *psMiscInfo)
                 psMiscInfo->ui32StatePresent |= PVRSRV_MISC_INFO_FORCE_SWAP_TO_SYSTEM_PRESENT;
         }
 #endif /* defined(SUPPORT_PVRSRV_DEVICE_CLASS) */
-        if ((psMiscInfo->ui32StateRequest & PVRSRV_MISC_INFO_GET_DRM_FD_PRESENT) != 0UL)
-        {
-                PVR_DPF((PVR_DBG_ERROR,"PVRSRVGetMiscInfoKM: GetDrmFD: %d", g_iDrmFd));
-                psMiscInfo->iDrmFd = g_iDrmFd;
-                psMiscInfo->ui32StatePresent |= PVRSRV_MISC_INFO_GET_DRM_FD_PRESENT;
-        }
-        if ((psMiscInfo->ui32StateRequest & PVRSRV_MISC_INFO_SET_DRM_FD_PRESENT) != 0UL)
-        {
-                g_iDrmFd = psMiscInfo->iDrmFd;
-                PVR_DPF((PVR_DBG_ERROR,"PVRSRVGetMiscInfoKM: SetDrmFD: %d", g_iDrmFd));
-                psMiscInfo->ui32StatePresent |= PVRSRV_MISC_INFO_SET_DRM_FD_PRESENT;
-        }
 
         return PVRSRV_OK;
 }
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/queue.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/queue.c
index cddd6f9..1274e5a 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/queue.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/queue.c
@@ -52,6 +52,63 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #else
 #include <../drivers/staging/android/sw_sync.h>
 #endif
+
+#if defined(DEBUG_LINUX_MEMORY_ALLOCATIONS)
+#include <linux/list.h>
+#include <linux/workqueue.h>
+
+typedef struct _PVR_QUEUE_SYNC_KERNEL_SYNC_INFO_
+{
+        /* Base services sync info structure */
+        PVRSRV_KERNEL_SYNC_INFO *psBase;
+
+        struct list_head        sHead;
+} PVR_QUEUE_SYNC_KERNEL_SYNC_INFO;
+
+static IMG_BOOL PVRSyncIsSyncInfoInUse(PVRSRV_KERNEL_SYNC_INFO *psSyncInfo)
+{
+        return !(psSyncInfo->psSyncData->ui32WriteOpsPending == psSyncInfo->psSyncData->ui32WriteOpsComplete &&
+                        psSyncInfo->psSyncData->ui32ReadOpsPending == psSyncInfo->psSyncData->ui32ReadOpsComplete &&
+                        psSyncInfo->psSyncData->ui32ReadOps2Pending == psSyncInfo->psSyncData->ui32ReadOps2Complete);
+}
+
+/* Defer Workqueue for releasing command kernel sync info */
+static struct workqueue_struct *gpsWorkQueue;
+
+/* Linux work struct for workqueue. */
+static struct work_struct gsWork;
+
+/* The "defer-free" sync object list. */
+static LIST_HEAD(gSyncInfoFreeList);
+static DEFINE_SPINLOCK(gSyncInfoFreeListLock);
+
+static void PVRSyncWorkQueueFunction(struct work_struct *data)
+{
+        struct list_head sFreeList, *psEntry, *n;
+        PVR_QUEUE_SYNC_KERNEL_SYNC_INFO *psSyncInfo;
+
+        INIT_LIST_HEAD(&sFreeList);
+        spin_lock(&gSyncInfoFreeListLock);
+        list_for_each_safe(psEntry, n, &gSyncInfoFreeList)
+        {
+                psSyncInfo = container_of(psEntry, PVR_QUEUE_SYNC_KERNEL_SYNC_INFO, sHead);
+
+                if(!PVRSyncIsSyncInfoInUse(psSyncInfo->psBase))
+                        list_move_tail(psEntry, &sFreeList);
+        }
+        spin_unlock(&gSyncInfoFreeListLock);
+
+        list_for_each_safe(psEntry, n, &sFreeList)
+        {
+                psSyncInfo = container_of(psEntry, PVR_QUEUE_SYNC_KERNEL_SYNC_INFO, sHead);
+
+                list_del(psEntry);
+
+                PVRSRVKernelSyncInfoDecRef(psSyncInfo->psBase, IMG_NULL);
+        }
+}
+#endif
+
 static struct sync_fence *AllocQueueFence(struct sw_sync_timeline *psTimeline, IMG_UINT32 ui32FenceValue, const char *szName)
 {
         struct sync_fence *psFence = IMG_NULL;
@@ -425,7 +482,7 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVCreateCommandQueueKM(IMG_SIZE_T uQueueSize,
 
         if (ui32NoOfSwapchainCreated >= DC_NUM_COMMANDS_PER_TYPE)
         {
-                PVR_DPF((PVR_DBG_ERROR,"PVRSRVCreateCommandQueueKM: Swapchain already exists, increament DC_MAX_SUPPORTED_QUEUES to support more than one swapchain"));
+                PVR_DPF((PVR_DBG_ERROR,"PVRSRVCreateCommandQueueKM: Swapchain already exists, increment DC_MAX_SUPPORTED_QUEUES to support more than one swapchain"));
                 return PVRSRV_ERROR_FLIP_CHAIN_EXISTS;
         }
 
@@ -486,8 +543,13 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVCreateCommandQueueKM(IMG_SIZE_T uQueueSize,
         }
 
         /* Ensure we don't corrupt queue list, by blocking access */
+#if !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__)
+        eError = OSLockResourceAndBlockMISR(&psSysData->sQProcessResource,
+                                                        KERNEL_ID);
+#else /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
         eError = OSLockResource(&psSysData->sQProcessResource,
                                                         KERNEL_ID);
+#endif /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
         if (eError != PVRSRV_OK)
         {
                 goto ErrorExit;
@@ -496,7 +558,11 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVCreateCommandQueueKM(IMG_SIZE_T uQueueSize,
         psQueueInfo->psNextKM = psSysData->psQueueList;
         psSysData->psQueueList = psQueueInfo;
 
+#if !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__)
+        eError = OSUnlockResourceAndUnblockMISR(&psSysData->sQProcessResource, KERNEL_ID);
+#else /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
         eError = OSUnlockResource(&psSysData->sQProcessResource, KERNEL_ID);
+#endif /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
         if (eError != PVRSRV_OK)
         {
                 goto ErrorExit;
@@ -504,6 +570,18 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVCreateCommandQueueKM(IMG_SIZE_T uQueueSize,
 
         *ppsQueueInfo = psQueueInfo;
 
+#if defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC) && defined(DEBUG_LINUX_MEMORY_ALLOCATIONS)
+        if(!ui32NoOfSwapchainCreated)
+        {
+                gpsWorkQueue = create_freezable_workqueue("flip_pvr_sync_workqueue");
+                if(!gpsWorkQueue)
+                {
+                        PVR_DPF((PVR_DBG_ERROR, "%s: Failed to create flip_pvr_sync workqueue", __func__));
+                        goto ErrorExit;
+                }
+                INIT_WORK(&gsWork, PVRSyncWorkQueueFunction);
+        }
+#endif
         ui32NoOfSwapchainCreated++;
 
         return PVRSRV_OK;
@@ -577,8 +655,13 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVDestroyCommandQueueKM(PVRSRV_QUEUE_INFO *psQueue
         }
 
         /* Ensure we don't corrupt queue list, by blocking access */
+#if !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__)
+        eError = OSLockResourceAndBlockMISR(&psSysData->sQProcessResource,
+                                                                KERNEL_ID);
+#else /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
         eError = OSLockResource(&psSysData->sQProcessResource,
                                                                 KERNEL_ID);
+#endif /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
         if (eError != PVRSRV_OK)
         {
                 goto ErrorExit;
@@ -632,7 +715,11 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVDestroyCommandQueueKM(PVRSRV_QUEUE_INFO *psQueue
 
                 if(!psQueue)
                 {
+#if !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__)
+                        eError = OSUnlockResourceAndUnblockMISR(&psSysData->sQProcessResource, KERNEL_ID);
+#else /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
                         eError = OSUnlockResource(&psSysData->sQProcessResource, KERNEL_ID);
+#endif /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
                         if (eError != PVRSRV_OK)
                         {
                                 goto ErrorExit;
@@ -643,7 +730,11 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVDestroyCommandQueueKM(PVRSRV_QUEUE_INFO *psQueue
         }
 
         /*  unlock the Q list lock resource */
+#if !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__)
+        eError = OSUnlockResourceAndUnblockMISR(&psSysData->sQProcessResource, KERNEL_ID);
+#else /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
         eError = OSUnlockResource(&psSysData->sQProcessResource, KERNEL_ID);
+#endif /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
         if (eError != PVRSRV_OK)
         {
                 goto ErrorExit;
@@ -659,6 +750,12 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVDestroyCommandQueueKM(PVRSRV_QUEUE_INFO *psQueue
                 }
         }
 
+#if defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC) && defined(DEBUG_LINUX_MEMORY_ALLOCATIONS)
+        if(!ui32NoOfSwapchainCreated && gpsWorkQueue)
+        {
+                destroy_workqueue(gpsWorkQueue);
+        }
+#endif
 ErrorExit:
 
         return eError;
@@ -849,6 +946,13 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVInsertCommandKM(PVRSRV_QUEUE_INFO	*psQueue,
         /* setup dst sync objects and their sync dependencies */
         for (i=0; i<ui32DstSyncCount; i++)
         {
+#if defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC) && defined(DEBUG_LINUX_MEMORY_ALLOCATIONS)
+                PVR_QUEUE_SYNC_KERNEL_SYNC_INFO *psQueueSync = (PVR_QUEUE_SYNC_KERNEL_SYNC_INFO*)kmalloc(sizeof(PVR_QUEUE_SYNC_KERNEL_SYNC_INFO),GFP_KERNEL);
+                psQueueSync->psBase = apsDstSync[i];
+                spin_lock(&gSyncInfoFreeListLock);
+                list_add_tail(&psQueueSync->sHead, &gSyncInfoFreeList);
+                spin_unlock(&gSyncInfoFreeListLock);
+#endif
                 PVR_TTRACE_SYNC_OBJECT(PVRSRV_TRACE_GROUP_QUEUE, QUEUE_TOKEN_DST_SYNC,
                                                 apsDstSync[i], PVRSRV_SYNCOP_SAMPLE);
 
@@ -868,6 +972,14 @@ PVRSRV_ERROR IMG_CALLCONV PVRSRVInsertCommandKM(PVRSRV_QUEUE_INFO	*psQueue,
         /* setup src sync objects and their sync dependencies */
         for (i=0; i<ui32SrcSyncCount; i++)
         {
+#if defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC) && defined(DEBUG_LINUX_MEMORY_ALLOCATIONS)
+                PVR_QUEUE_SYNC_KERNEL_SYNC_INFO *psQueueSync = (PVR_QUEUE_SYNC_KERNEL_SYNC_INFO*)kmalloc(sizeof(PVR_QUEUE_SYNC_KERNEL_SYNC_INFO),GFP_KERNEL);
+                psQueueSync->psBase = apsSrcSync[i];
+                spin_lock(&gSyncInfoFreeListLock);
+                list_add_tail(&psQueueSync->sHead, &gSyncInfoFreeList);
+                spin_unlock(&gSyncInfoFreeListLock);
+#endif
+
                 PVR_TTRACE_SYNC_OBJECT(PVRSRV_TRACE_GROUP_QUEUE, QUEUE_TOKEN_DST_SYNC,
                                                 apsSrcSync[i], PVRSRV_SYNCOP_SAMPLE);
 
@@ -1221,7 +1333,17 @@ PVRSRV_ERROR PVRSRVProcessQueues(IMG_BOOL	bFlush)
         /* Ensure we don't corrupt queue list, by blocking access. This is required for OSs where
             multiple ISR threads may exist simultaneously (eg WinXP DPC routines)
         */
+        if (psSysData->psQueueList == IMG_NULL)
+        {
+                PVR_DPF((PVR_DBG_MESSAGE,"No Queues installed - cannot process commands"));
+                return PVRSRV_OK;
+        }
+
+#if !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__)
+        while (OSLockResourceAndBlockMISR(&psSysData->sQProcessResource, ISR_ID) != PVRSRV_OK)
+#else /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
         while (OSLockResource(&psSysData->sQProcessResource, ISR_ID) != PVRSRV_OK)
+#endif /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
         {
                 OSWaitus(1);
         };
@@ -1265,7 +1387,11 @@ PVRSRV_ERROR PVRSRVProcessQueues(IMG_BOOL	bFlush)
         List_PVRSRV_DEVICE_NODE_ForEach(psSysData->psDeviceNodeList,
                                                                         &PVRSRVProcessQueues_ForEachCb);
 
+#if !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__)
+        OSUnlockResourceAndUnblockMISR(&psSysData->sQProcessResource, ISR_ID);
+#else /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
         OSUnlockResource(&psSysData->sQProcessResource, ISR_ID);
+#endif /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
 
         return PVRSRV_OK;
 }
@@ -1309,7 +1435,9 @@ IMG_VOID PVRSRVCommandCompleteKM(IMG_HANDLE	hCmdCookie,
         {
                 psCmdCompleteData->psDstSync[i].psKernelSyncInfoKM->psSyncData->ui32WriteOpsComplete++;
 
+#if !(defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC) && defined(DEBUG_LINUX_MEMORY_ALLOCATIONS))
                 PVRSRVKernelSyncInfoDecRef(psCmdCompleteData->psDstSync[i].psKernelSyncInfoKM, IMG_NULL);
+#endif
 
                 PVR_TTRACE_SYNC_OBJECT(PVRSRV_TRACE_GROUP_QUEUE, QUEUE_TOKEN_UPDATE_DST,
                                           psCmdCompleteData->psDstSync[i].psKernelSyncInfoKM,
@@ -1327,7 +1455,9 @@ IMG_VOID PVRSRVCommandCompleteKM(IMG_HANDLE	hCmdCookie,
         {
                 psCmdCompleteData->psSrcSync[i].psKernelSyncInfoKM->psSyncData->ui32ReadOps2Complete++;
 
+#if !(defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC) && defined(DEBUG_LINUX_MEMORY_ALLOCATIONS))
                 PVRSRVKernelSyncInfoDecRef(psCmdCompleteData->psSrcSync[i].psKernelSyncInfoKM, IMG_NULL);
+#endif
 
                 PVR_TTRACE_SYNC_OBJECT(PVRSRV_TRACE_GROUP_QUEUE, QUEUE_TOKEN_UPDATE_SRC,
                                           psCmdCompleteData->psSrcSync[i].psKernelSyncInfoKM,
@@ -1340,6 +1470,14 @@ IMG_VOID PVRSRVCommandCompleteKM(IMG_HANDLE	hCmdCookie,
                                 psCmdCompleteData->psSrcSync[i].ui32WriteOpsPending));
         }
 
+#if defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC) && defined(DEBUG_LINUX_MEMORY_ALLOCATIONS)
+        if(psCmdCompleteData->ui32DstSyncCount || psCmdCompleteData->ui32SrcSyncCount)
+        {
+                /* Add work to worker thread for checking and freeing of kernel sync */
+                queue_work(gpsWorkQueue, &gsWork);
+        }
+#endif
+
         PVR_TTRACE(PVRSRV_TRACE_GROUP_QUEUE, PVRSRV_TRACE_CLASS_CMD_COMP_END,
                         QUEUE_TOKEN_COMMAND_COMPLETE);
 
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/ra.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/ra.c
index 37c7176..e05910c 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/ra.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/ra.c
@@ -1294,7 +1294,7 @@ RA_Delete (RA_ARENA *pArena)
                 if (pBT->type != btt_free)
                 {
                         PVR_DPF ((PVR_DBG_ERROR,"RA_Delete: allocations still exist in the arena that is being destroyed"));
-                        PVR_DPF ((PVR_DBG_ERROR,"Likely Cause: client drivers not freeing alocations before destroying devmemcontext"));
+                        PVR_DPF ((PVR_DBG_ERROR,"Likely Cause: client drivers not freeing allocations before destroying devmemcontext"));
                         PVR_DPF ((PVR_DBG_ERROR,"RA_Delete: base = 0x" UINTPTR_FMT " size=0x%" SIZE_T_FMT_LEN "x", pBT->base, pBT->uSize));
                 }
 
@@ -1518,9 +1518,22 @@ RA_Alloc (RA_ARENA *pArena,
                         }
                 }
         }
+#if defined PVRSRV_DEVMEM_TIME_STATS
+        else
+        {
+                /* If sub-allocation succeeded, the allocation was already mapped to Device MMU. So change timing to '0' */
+                if (ppsMapping)
+                {
+                        (*ppsMapping)->ui32TimeToDevMap = 0;
+                }
+        }
+#endif
+
 #ifdef RA_STATS
         if (bResult)
+        {
                 pArena->sStatistics.uCumulativeAllocs++;
+        }
 #endif
 
         PVR_DPF ((PVR_DBG_MESSAGE,
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/refcount.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/refcount.c
index 28f671a..aacb94c 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/refcount.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/refcount.c
@@ -72,10 +72,12 @@ static DEFINE_SPINLOCK(gsCCBLock);
 #define PVRSRV_REFCOUNT_CCB_DEBUG_MMAP          (1U << 16)
 #define PVRSRV_REFCOUNT_CCB_DEBUG_MMAP2         (1U << 17)
 #define PVRSRV_REFCOUNT_CCB_DEBUG_ION_SYNC      (1U << 18)
+#define PVRSRV_REFCOUNT_CCB_DEBUG_DMABUF_SYNC   (1U << 19)
 #else
 #define PVRSRV_REFCOUNT_CCB_DEBUG_MMAP          0
 #define PVRSRV_REFCOUNT_CCB_DEBUG_MMAP2         0
 #define PVRSRV_REFCOUNT_CCB_DEBUG_ION_SYNC      0
+#define PVRSRV_REFCOUNT_CCB_DEBUG_DMABUF_SYNC   0
 #endif
 
 #define PVRSRV_REFCOUNT_CCB_DEBUG_ALL           ~0U
@@ -83,9 +85,12 @@ static DEFINE_SPINLOCK(gsCCBLock);
 /*static const IMG_UINT guiDebugMask = PVRSRV_REFCOUNT_CCB_DEBUG_ALL;*/
 static const IMG_UINT guiDebugMask =
         PVRSRV_REFCOUNT_CCB_DEBUG_SYNCINFO |
-#if defined(SUPPORT_DRM_GEM) || defined(SUPPORT_ION)
+#if defined(SUPPORT_ION)
         PVRSRV_REFCOUNT_CCB_DEBUG_ION_SYNC |
 #endif
+#if defined(SUPPORT_DMABUF)
+        PVRSRV_REFCOUNT_CCB_DEBUG_DMABUF_SYNC |
+#endif
         PVRSRV_REFCOUNT_CCB_DEBUG_MMAP2;
 
 typedef struct
@@ -588,8 +593,8 @@ skip:
         psOffsetStruct->ui32Mapped--;
 }
 
-#if defined(SUPPORT_DRM_GEM) || defined(SUPPORT_ION)
-PVRSRV_ERROR PVRSRVExternalBufferSyncInfoIncRef2(const IMG_CHAR *pszFile, IMG_INT iLine,
+#if defined(SUPPORT_ION)
+PVRSRV_ERROR PVRSRVIonBufferSyncInfoIncRef2(const IMG_CHAR *pszFile, IMG_INT iLine,
                                                                                         IMG_HANDLE hUnique,
                                                                                         IMG_HANDLE hDevCookie,
                                                                                         IMG_HANDLE hDevMemContext,
@@ -601,7 +606,7 @@ PVRSRV_ERROR PVRSRVExternalBufferSyncInfoIncRef2(const IMG_CHAR *pszFile, IMG_IN
         /*
                 We have to do the call 1st as we need to Ion syninfo which it returns
         */
-        eError = PVRSRVExternalBufferSyncAcquire(hUnique,
+        eError = PVRSRVIonBufferSyncAcquire(hUnique,
                                                                                 hDevCookie,
                                                                                 hDevMemContext,
                                                                                 ppsIonSyncInfo);
@@ -637,7 +642,7 @@ skip:
         return eError;
 }
 
-void PVRSRVExternalBufferSyncInfoDecRef2(const IMG_CHAR *pszFile, IMG_INT iLine,
+void PVRSRVIonBufferSyncInfoDecRef2(const IMG_CHAR *pszFile, IMG_INT iLine,
                                                                         PVRSRV_ION_SYNC_INFO *psIonSyncInfo,
                                                                         PVRSRV_KERNEL_MEM_INFO *psKernelMemInfo)
 {
@@ -665,11 +670,91 @@ void PVRSRVExternalBufferSyncInfoDecRef2(const IMG_CHAR *pszFile, IMG_INT iLine,
 
         PVRSRV_UNLOCK_CCB();
 skip:
-        PVRSRVExternalBufferSyncRelease(psIonSyncInfo);
+        PVRSRVIonBufferSyncRelease(psIonSyncInfo);
 }
 
 #endif /* defined (SUPPORT_ION) */
 
+#if defined(SUPPORT_DMABUF)
+PVRSRV_ERROR PVRSRVDmaBufSyncInfoIncRef2(const IMG_CHAR *pszFile, IMG_INT iLine,
+                                                                                        IMG_HANDLE hUnique,
+                                                                                        IMG_HANDLE hPriv,
+                                                                                        IMG_HANDLE hDevCookie,
+                                                                                        IMG_HANDLE hDevMemContext,
+                                                                                        PVRSRV_DMABUF_SYNC_INFO **ppsDmaBufSyncInfo,
+                                                                                        PVRSRV_KERNEL_MEM_INFO *psKernelMemInfo)
+{
+        PVRSRV_ERROR eError;
+
+        eError = PVRSRVDmaBufSyncAcquire(hUnique,
+                                                                                hPriv,
+                                                                                hDevCookie,
+                                                                                hDevMemContext,
+                                                                                ppsDmaBufSyncInfo);
+
+        if (eError == PVRSRV_OK)
+        {
+                if(!(guiDebugMask & PVRSRV_REFCOUNT_CCB_DEBUG_DMABUF_SYNC))
+                        goto skip;
+
+                PVRSRV_LOCK_CCB();
+
+                gsRefCountCCB[giOffset].pszFile = pszFile;
+                gsRefCountCCB[giOffset].iLine = iLine;
+                gsRefCountCCB[giOffset].ui32PID = OSGetCurrentProcessIDKM();
+                snprintf(gsRefCountCCB[giOffset].pcMesg,
+                                 PVRSRV_REFCOUNT_CCB_MESG_MAX - 1,
+                                 PVRSRV_REFCOUNT_CCB_FMT_STRING,
+                                 "DMA-BUF_SYNC",
+                                 (*ppsDmaBufSyncInfo)->psSyncInfo,
+                                 psKernelMemInfo,
+                                 NULL,
+                                 *ppsDmaBufSyncInfo,
+                                 (*ppsDmaBufSyncInfo)->ui32RefCount - 1,
+                                 (*ppsDmaBufSyncInfo)->ui32RefCount,
+                                 0);
+                gsRefCountCCB[giOffset].pcMesg[PVRSRV_REFCOUNT_CCB_MESG_MAX - 1] = 0;
+                giOffset = (giOffset + 1) % PVRSRV_REFCOUNT_CCB_MAX;
+
+                PVRSRV_UNLOCK_CCB();
+        }
+
+skip:
+        return eError;
+}
+
+void PVRSRVDmaBufSyncInfoDecRef2(const IMG_CHAR *pszFile, IMG_INT iLine,
+                                                                        PVRSRV_DMABUF_SYNC_INFO *psDmaBufSyncInfo,
+                                                                        PVRSRV_KERNEL_MEM_INFO *psKernelMemInfo)
+{
+        if(!(guiDebugMask & PVRSRV_REFCOUNT_CCB_DEBUG_DMABUF_SYNC))
+                goto skip;
+
+        PVRSRV_LOCK_CCB();
+
+        gsRefCountCCB[giOffset].pszFile = pszFile;
+        gsRefCountCCB[giOffset].iLine = iLine;
+        gsRefCountCCB[giOffset].ui32PID = OSGetCurrentProcessIDKM();
+        snprintf(gsRefCountCCB[giOffset].pcMesg,
+                         PVRSRV_REFCOUNT_CCB_MESG_MAX - 1,
+                         PVRSRV_REFCOUNT_CCB_FMT_STRING,
+                         "DMA-BUF_SYNC",
+                         psDmaBufSyncInfo->psSyncInfo,
+                         psKernelMemInfo,
+                         NULL,
+                         psDmaBufSyncInfo,
+                         psDmaBufSyncInfo->ui32RefCount,
+                         psDmaBufSyncInfo->ui32RefCount - 1,
+                         0);
+        gsRefCountCCB[giOffset].pcMesg[PVRSRV_REFCOUNT_CCB_MESG_MAX - 1] = 0;
+        giOffset = (giOffset + 1) % PVRSRV_REFCOUNT_CCB_MAX;
+
+        PVRSRV_UNLOCK_CCB();
+skip:
+        PVRSRVDmaBufSyncRelease(psDmaBufSyncInfo);
+}
+#endif /* defined (SUPPORT_DMABUF) */
+
 #endif /* defined(__linux__) */
 
 #endif /* defined(PVRSRV_REFCOUNT_DEBUG) */
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/resman.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/resman.c
index 302efb2..a8b8a2f 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/resman.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/common/resman.c
@@ -359,12 +359,12 @@ IMG_VOID PVRSRVResManDisconnect(PRESMAN_CONTEXT psResManContext,
                 FreeResourceByCriteria(psResManContext, RESMAN_CRITERIA_RESTYPE, RESMAN_TYPE_DEVICEMEM_MAPPING, 0, 0, IMG_TRUE);
                 FreeResourceByCriteria(psResManContext, RESMAN_CRITERIA_RESTYPE, RESMAN_TYPE_KERNEL_DEVICEMEM_ALLOCATION, 0, 0, IMG_TRUE);
                 FreeResourceByCriteria(psResManContext, RESMAN_CRITERIA_RESTYPE, RESMAN_TYPE_DEVICEMEM_ALLOCATION, 0, 0, IMG_TRUE);
-#if defined(SUPPORT_DRM_GEM)
-                FreeResourceByCriteria(psResManContext, RESMAN_CRITERIA_RESTYPE, RESMAN_TYPE_DEVICEMEM_DMABUF, 0, 0, IMG_TRUE);
-#endif
 #if defined(SUPPORT_ION)
                 FreeResourceByCriteria(psResManContext, RESMAN_CRITERIA_RESTYPE, RESMAN_TYPE_DEVICEMEM_ION, 0, 0, IMG_TRUE);
 #endif
+#if defined(SUPPORT_DMABUF)
+                FreeResourceByCriteria(psResManContext, RESMAN_CRITERIA_RESTYPE, RESMAN_TYPE_DEVICEMEM_DMABUF, 0, 0, IMG_TRUE);
+#endif
                 FreeResourceByCriteria(psResManContext, RESMAN_CRITERIA_RESTYPE, RESMAN_TYPE_DEVICEMEM_CONTEXT, 0, 0, IMG_TRUE);
                 FreeResourceByCriteria(psResManContext, RESMAN_CRITERIA_RESTYPE, RESMAN_TYPE_SHARED_MEM_INFO, 0, 0, IMG_TRUE);
 
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/mmu.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/mmu.c
index 8e4f159..b506167 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/mmu.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/mmu.c
@@ -307,8 +307,7 @@ static IMG_VOID DumpPT(MMU_PT_INFO *psPTInfoList)
         /* 1024 entries in a 4K page table */
         for(i = 0; i < 1024; i += 8)
         {
-                PVR_DPF((PVR_DBG_ERROR,
-                                 "%08X %08X %08X %08X %08X %08X %08X %08X\n",
+                PVR_LOG(("%08X %08X %08X %08X %08X %08X %08X %08X",
                                  p[i + 0], p[i + 1], p[i + 2], p[i + 3],
                                  p[i + 4], p[i + 5], p[i + 6], p[i + 7]));
         }
@@ -333,7 +332,7 @@ static IMG_VOID CheckPT(MMU_PT_INFO *psPTInfoList)
 
         if(psPTInfoList->ui32ValidPTECount != ui32Count)
         {
-                PVR_DPF((PVR_DBG_ERROR, "ui32ValidPTECount: %u ui32Count: %u\n",
+                PVR_DPF((PVR_DBG_ERROR, "ui32ValidPTECount: %u ui32Count: %u",
                                  psPTInfoList->ui32ValidPTECount, ui32Count));
                 DumpPT(psPTInfoList);
                 PVR_DBG_BREAK;
@@ -1754,13 +1753,14 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
 {
         IMG_UINT32 *pui32Tmp;
         IMG_UINT32 i;
-        IMG_CPU_VIRTADDR pvPDCpuVAddr;
-        IMG_DEV_PHYADDR sPDDevPAddr;
+        IMG_CPU_VIRTADDR pvPDCpuVAddr = IMG_NULL;
+        IMG_DEV_PHYADDR sPDDevPAddr = {0};
         IMG_CPU_PHYADDR sCpuPAddr;
         MMU_CONTEXT *psMMUContext;
         IMG_HANDLE hPDOSMemHandle = IMG_NULL;
         SYS_DATA *psSysData;
         PVRSRV_SGXDEV_INFO *psDevInfo;
+        PVRSRV_ERROR eError = PVRSRV_OK;
 #if defined(PDUMP)
         PDUMP_MMU_ATTRIB sMMUAttrib;
 #endif
@@ -1806,7 +1806,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                                                  &hPDOSMemHandle) != PVRSRV_OK)
                 {
                         PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR call to OSAllocPages failed"));
-                        return PVRSRV_ERROR_FAILED_TO_ALLOC_PAGES;
+                        eError = PVRSRV_ERROR_FAILED_TO_ALLOC_PAGES;
+                        goto exit_setting_values;
                 }
 
                 if(pvPDCpuVAddr)
@@ -1841,7 +1842,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                                                          &psDevInfo->hDummyPTPageOSMemHandle) != PVRSRV_OK)
                         {
                                 PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR call to OSAllocPages failed"));
-                                return PVRSRV_ERROR_FAILED_TO_ALLOC_PAGES;
+                                eError = PVRSRV_ERROR_FAILED_TO_ALLOC_PAGES;
+                                goto exit_setting_values;
                         }
 
                         if(psDevInfo->pvDummyPTPageCpuVAddr)
@@ -1868,7 +1870,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                                                          &psDevInfo->hDummyDataPageOSMemHandle) != PVRSRV_OK)
                         {
                                 PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR call to OSAllocPages failed"));
-                                return PVRSRV_ERROR_FAILED_TO_ALLOC_PAGES;
+                                eError = PVRSRV_ERROR_FAILED_TO_ALLOC_PAGES;
+                                goto exit_setting_values;
                         }
 
                         if(psDevInfo->pvDummyDataPageCpuVAddr)
@@ -1899,7 +1902,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                                                          &psDevInfo->hBRN31620DummyPageOSMemHandle) != PVRSRV_OK)
                         {
                                 PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR call to OSAllocPages failed"));
-                                return PVRSRV_ERROR_FAILED_TO_ALLOC_PAGES;
+                                eError = PVRSRV_ERROR_FAILED_TO_ALLOC_PAGES;
+                                goto exit_setting_values;
                         }                               
 
                         /* Get a physical address */
@@ -1933,7 +1937,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                                                          &psDevInfo->hBRN31620DummyPTOSMemHandle) != PVRSRV_OK)
                         {
                                 PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR call to OSAllocPages failed"));
-                                return PVRSRV_ERROR_FAILED_TO_ALLOC_PAGES;
+                                eError = PVRSRV_ERROR_FAILED_TO_ALLOC_PAGES;
+                                goto exit_setting_values;
                         }                               
 
                         /* Get a physical address */
@@ -1979,7 +1984,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                                         &uiLocalPAddr)!= IMG_TRUE)
                 {
                         PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR call to RA_Alloc failed"));
-                        return PVRSRV_ERROR_FAILED_TO_ALLOC_VIRT_MEMORY;
+                        eError = PVRSRV_ERROR_FAILED_TO_ALLOC_VIRT_MEMORY;
+                        goto exit_setting_values;
                 }
 
                 /* Munge the local PAddr back into the SysPAddr */
@@ -1995,7 +2001,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                 if(!pvPDCpuVAddr)
                 {
                         PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR failed to map page tables"));
-                        return PVRSRV_ERROR_FAILED_TO_MAP_PAGE_TABLE;
+                        eError = PVRSRV_ERROR_FAILED_TO_MAP_PAGE_TABLE;
+                        goto exit_setting_values;
                 }
 
                 #if PAGE_TEST
@@ -2019,7 +2026,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                                                 &uiLocalPAddr)!= IMG_TRUE)
                         {
                                 PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR call to RA_Alloc failed"));
-                                return PVRSRV_ERROR_FAILED_TO_ALLOC_VIRT_MEMORY;
+                                eError = PVRSRV_ERROR_FAILED_TO_ALLOC_VIRT_MEMORY;
+                                goto exit_setting_values;
                         }
 
                         /* Munge the local PAddr back into the SysPAddr */
@@ -2035,7 +2043,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                         if(!psDevInfo->pvDummyPTPageCpuVAddr)
                         {
                                 PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR failed to map page tables"));
-                                return PVRSRV_ERROR_FAILED_TO_MAP_PAGE_TABLE;
+                                eError = PVRSRV_ERROR_FAILED_TO_MAP_PAGE_TABLE;
+                                goto exit_setting_values;
                         }
 
                         /* Dummy Data page */
@@ -2051,7 +2060,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                                                 &uiLocalPAddr)!= IMG_TRUE)
                         {
                                 PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR call to RA_Alloc failed"));
-                                return PVRSRV_ERROR_FAILED_TO_ALLOC_VIRT_MEMORY;
+                                eError = PVRSRV_ERROR_FAILED_TO_ALLOC_VIRT_MEMORY;
+                                goto exit_setting_values;
                         }
 
                         /* Munge the local PAddr back into the SysPAddr */
@@ -2067,7 +2077,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                         if(!psDevInfo->pvDummyDataPageCpuVAddr)
                         {
                                 PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR failed to map page tables"));
-                                return PVRSRV_ERROR_FAILED_TO_MAP_PAGE_TABLE;
+                                eError = PVRSRV_ERROR_FAILED_TO_MAP_PAGE_TABLE;
+                                goto exit_setting_values;
                         }
                 }
 #endif /* #if defined(SUPPORT_SGX_MMU_DUMMY_PAGE) */
@@ -2089,7 +2100,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                                                 &uiLocalPAddr)!= IMG_TRUE)
                         {
                                 PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR call to RA_Alloc failed"));
-                                return PVRSRV_ERROR_FAILED_TO_ALLOC_VIRT_MEMORY;
+                                eError = PVRSRV_ERROR_FAILED_TO_ALLOC_VIRT_MEMORY;
+                                goto exit_setting_values;
                         }
 
                         /* Munge the local PAddr back into the SysPAddr */
@@ -2105,7 +2117,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                         if(!psDevInfo->pvBRN31620DummyPageCpuVAddr)
                         {
                                 PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR failed to map page tables"));
-                                return PVRSRV_ERROR_FAILED_TO_MAP_PAGE_TABLE;
+                                eError = PVRSRV_ERROR_FAILED_TO_MAP_PAGE_TABLE;
+                                goto exit_setting_values;
                         }
 
                         MakeKernelPageReadWrite(psDevInfo->pvBRN31620DummyPageCpuVAddr);
@@ -2130,7 +2143,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                                                 &uiLocalPAddr)!= IMG_TRUE)
                         {
                                 PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR call to RA_Alloc failed"));
-                                return PVRSRV_ERROR_FAILED_TO_ALLOC_VIRT_MEMORY;
+                                eError = PVRSRV_ERROR_FAILED_TO_ALLOC_VIRT_MEMORY;
+                                goto exit_setting_values;
                         }
 
                         /* Munge the local PAddr back into the SysPAddr */
@@ -2147,7 +2161,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                         if(!psDevInfo->pvBRN31620DummyPTCpuVAddr)
                         {
                                 PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR failed to map page tables"));
-                                return PVRSRV_ERROR_FAILED_TO_MAP_PAGE_TABLE;
+                                eError = PVRSRV_ERROR_FAILED_TO_MAP_PAGE_TABLE;
+                                goto exit_setting_values;
                         }
 
                         OSMemSet(psDevInfo->pvBRN31620DummyPTCpuVAddr,0,SGX_MMU_PAGE_SIZE);             
@@ -2199,7 +2214,8 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
         else
         {
                 PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: pvPDCpuVAddr invalid"));
-                return PVRSRV_ERROR_INVALID_CPU_ADDR;
+                eError = PVRSRV_ERROR_INVALID_CPU_ADDR;
+                goto exit_setting_values;
         }
 
 
@@ -2230,7 +2246,7 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                 MakeKernelPageReadOnly(psDevInfo->pvDummyPTPageCpuVAddr);
                 /* pdump the Dummy PT Page */
                 PDUMPCOMMENT("Dummy Page table contents");
-                PDUMPMEMPTENTRIES(&sMMUAttrib, psDevInfo->hDummyPTOSMemHandle, psDevInfo->pvDummyPTPageCpuVAddr, SGX_MMU_PAGE_SIZE, 0, IMG_TRUE, PDUMP_PD_UNIQUETAG, PDUMP_PT_UNIQUETAG);
+                PDUMPMEMPTENTRIES(&sMMUAttrib, psDevInfo->hDummyPTPageOSMemHandle, psDevInfo->pvDummyPTPageCpuVAddr, SGX_MMU_PAGE_SIZE, 0, IMG_TRUE, PDUMP_PD_UNIQUETAG, PDUMP_PT_UNIQUETAG);
 
                 /*
                         write a signature to the dummy data page
@@ -2244,7 +2260,7 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                 MakeKernelPageReadOnly(psDevInfo->pvDummyDataPageCpuVAddr);
                 /* pdump the Dummy Data Page */
                 PDUMPCOMMENT("Dummy Data Page contents");
-                PDUMPMEMPTENTRIES(PVRSRV_DEVICE_TYPE_SGX, psDevInfo->hDummyDataPageOSMemHandle, psDevInfo->pvDummyDataPageCpuVAddr, SGX_MMU_PAGE_SIZE, 0, IMG_TRUE, PDUMP_PD_UNIQUETAG, PDUMP_PT_UNIQUETAG);
+                PDUMPMEMPTENTRIES(&sMMUAttrib, psDevInfo->hDummyDataPageOSMemHandle, psDevInfo->pvDummyDataPageCpuVAddr, SGX_MMU_PAGE_SIZE, 0, IMG_TRUE, PDUMP_PD_UNIQUETAG, PDUMP_PT_UNIQUETAG);
         }
 #else /* #if defined(SUPPORT_SGX_MMU_DUMMY_PAGE) */
         /* initialise the PD to invalid address state */
@@ -2330,7 +2346,6 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
 #if defined(PDUMP)
         /* pdump set MMU context */
         {
-                PVRSRV_ERROR eError;
                 /* default MMU type is 1, 4k page */
                 IMG_UINT32 ui32MMUType = 1;
 
@@ -2352,7 +2367,7 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                 if (eError != PVRSRV_OK)
                 {
                         PVR_DPF((PVR_DBG_ERROR, "MMU_Initialise: ERROR call to PDumpSetMMUContext failed"));
-                        return eError;
+                        goto exit_setting_values;
                 }
         }
 
@@ -2376,6 +2391,9 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
                 psMMUContext->apsPTInfoListSave[i] = IMG_NULL;
         }
 #endif
+
+exit_setting_values:
+
         /* store PD info in the MMU context */
         psMMUContext->pvPDCpuVAddr = pvPDCpuVAddr;
         psMMUContext->sPDDevPAddr = sPDDevPAddr;
@@ -2401,7 +2419,7 @@ MMU_Initialise (PVRSRV_DEVICE_NODE *psDeviceNode, MMU_CONTEXT **ppsMMUContext, I
         DisableHostAccess(psMMUContext);
 #endif
 
-        return PVRSRV_OK;
+        return eError;
 }
 
 /*!
@@ -2427,31 +2445,37 @@ MMU_Finalise (MMU_CONTEXT *psMMUContext)
         SysAcquireData(&psSysData);
 
 #if defined(PDUMP)
-        /* pdump the MMU context clear */
-        PDUMPCOMMENT("Clear MMU context (MMU Context ID == %u)", psMMUContext->ui32PDumpMMUContextID);
-        PDUMPCLEARMMUCONTEXT(PVRSRV_DEVICE_TYPE_SGX, psMMUContext->psDeviceNode->sDevId.pszPDumpDevName, psMMUContext->ui32PDumpMMUContextID, 2);
+        {
+                IMG_UINT32 ui32Flags = PDUMP_FLAGS_CONTINUOUS;
+                /* pdump the MMU context clear */
+                PDUMPCOMMENT("Clear MMU context (MMU Context ID == %u)", psMMUContext->ui32PDumpMMUContextID);
+                PDUMPCLEARMMUCONTEXT(PVRSRV_DEVICE_TYPE_SGX, psMMUContext->psDeviceNode->sDevId.pszPDumpDevName, psMMUContext->ui32PDumpMMUContextID, 2);
 
-        /* pdump the PD free */
-        PDUMPCOMMENT("Free page directory (PDDevPAddr == 0x" DEVPADDR_FMT ")",
-                        psMMUContext->sPDDevPAddr.uiAddr);
-#endif /* PDUMP */
+                /* pdump the PD free */
+                PDUMPCOMMENT("Free page directory (PDDevPAddr == 0x" DEVPADDR_FMT ")",
+                                psMMUContext->sPDDevPAddr.uiAddr);
 
-        PDUMPFREEPAGETABLE(&psMMUContext->psDeviceNode->sDevId, psMMUContext->hPDOSMemHandle, psMMUContext->pvPDCpuVAddr, SGX_MMU_PAGE_SIZE, 0, PDUMP_PT_UNIQUETAG);
+                PDUMPFREEPAGETABLE(&psMMUContext->psDeviceNode->sDevId, psMMUContext->hPDOSMemHandle, psMMUContext->pvPDCpuVAddr, SGX_MMU_PAGE_SIZE, ui32Flags, PDUMP_PT_UNIQUETAG);
 #if defined(SUPPORT_SGX_MMU_DUMMY_PAGE)
-        PDUMPFREEPAGETABLE(&psMMUContext->psDeviceNode->sDevId, psDevInfo->hDummyPTPageOSMemHandle, psDevInfo->pvDummyPTPageCpuVAddr, SGX_MMU_PAGE_SIZE, 0, PDUMP_PT_UNIQUETAG);
-        PDUMPFREEPAGETABLE(&psMMUContext->psDeviceNode->sDevId, psDevInfo->hDummyDataPageOSMemHandle, psDevInfo->pvDummyDataPageCpuVAddr, SGX_MMU_PAGE_SIZE, 0, PDUMP_PT_UNIQUETAG);
+                PDUMPFREEPAGETABLE(&psMMUContext->psDeviceNode->sDevId, psDevInfo->hDummyPTPageOSMemHandle, psDevInfo->pvDummyPTPageCpuVAddr, SGX_MMU_PAGE_SIZE, ui32Flags, PDUMP_PT_UNIQUETAG);
+                PDUMPFREEPAGETABLE(&psMMUContext->psDeviceNode->sDevId, psDevInfo->hDummyDataPageOSMemHandle, psDevInfo->pvDummyDataPageCpuVAddr, SGX_MMU_PAGE_SIZE, ui32Flags, PDUMP_PT_UNIQUETAG);
 #endif
+        }
+#endif /* PDUMP */
 
         pui32Tmp = (IMG_UINT32 *)psMMUContext->pvPDCpuVAddr;
 
-        MakeKernelPageReadWrite(psMMUContext->pvPDCpuVAddr);
-        /* initialise the PD to invalid address state */
-        for(i=0; i<SGX_MMU_PD_SIZE; i++)
+        if (pui32Tmp)
         {
-                /* invalid, no read, no write, no cache consistency */
-                pui32Tmp[i] = 0;
+                MakeKernelPageReadWrite(psMMUContext->pvPDCpuVAddr);
+                /* initialise the PD to invalid address state */
+                for(i=0; i<SGX_MMU_PD_SIZE; i++)
+                {
+                        /* invalid, no read, no write, no cache consistency */
+                        pui32Tmp[i] = 0;
+                }
+                MakeKernelPageReadOnly(psMMUContext->pvPDCpuVAddr);
         }
-        MakeKernelPageReadOnly(psMMUContext->pvPDCpuVAddr);
 
         /*
                 free the PD:
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxconfig.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxconfig.h
index 632ab51..009a8d7 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxconfig.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxconfig.h
@@ -58,6 +58,94 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
 #if SGX_FEATURE_ADDRESS_SPACE_SIZE == 32
+
+#if defined (SGX_FEATURE_ADDRESS_SPACE_EXTENSION)
+/*
+ * Constraints: (Additional to above ones)
+ *      -GENERAL, PDS, USE_CODE, KERNEL_DATA heaps should be within [0-256MB] range only.
+ *      -(3DPARAMETERS_HEAP_BASE+TADATA_HEAP) <= 256MB, within same 256MB range.
+ *      
+ * BIF_REQ_BASE Setting:
+ *      -PDS_REQ_BASE = USCE_REQ_BASE = VDM_REQ_BASE = 0x00000000 
+ * 3D Task:
+ *      -ISPP_REQ_BASE = ISPZ_REQ_BASE = 3D_REQ_BASE = 3DPARAMETERS_HEAP_BASE
+ * TA Task:
+ *      -TA_COMMON_REQ_BASE = TA_REQ_BASE = 3DPARAMETERS_HEAP_BASE
+ * TQ Task:
+ *      -3D_REQ_BASE = ISPP_REQ_BASE = ISPZ_REQ_BASE = ISP stream CCB base
+ */
+#if defined(SUPPORT_SGX_GENERAL_MAPPING_HEAP)
+        #define SGX_GENERAL_MAPPING_HEAP_BASE            0x00001000
+        #define SGX_GENERAL_MAPPING_HEAP_SIZE           (0x01400000-0x00001000-0x00001000)
+
+        #define SGX_GENERAL_HEAP_BASE                            0x01400000
+        #define SGX_GENERAL_HEAP_SIZE                           (0x07000000-0x00001000)
+
+#else
+        #define SGX_GENERAL_HEAP_BASE                            0x00001000
+        #define SGX_GENERAL_HEAP_SIZE                           (0x08400000-0x00001000-0x00001000)
+#endif
+
+        #define SGX_PDSPIXEL_CODEDATA_HEAP_BASE          0x08400000
+        #define SGX_PDSPIXEL_CODEDATA_HEAP_SIZE         (0x02000000-0x00001000)
+
+        #define SGX_KERNEL_CODE_HEAP_BASE                        0x0A400000
+        #define SGX_KERNEL_CODE_HEAP_SIZE                       (0x00080000-0x00001000)
+
+        #define SGX_PDSVERTEX_CODEDATA_HEAP_BASE         0x0A800000
+        #define SGX_PDSVERTEX_CODEDATA_HEAP_SIZE        (0x01C00000-0x00001000)
+
+        #define SGX_PIXELSHADER_HEAP_BASE                        0x0C400000
+        #define SGX_PIXELSHADER_HEAP_SIZE                       (0x00800000-0x00001000)
+
+        #define SGX_VERTEXSHADER_HEAP_BASE                       0x0CC00000
+        #define SGX_VERTEXSHADER_HEAP_SIZE                      (0x00400000-0x00001000)
+
+        #define SGX_KERNEL_DATA_HEAP_BASE                       (0x0D000000+SGX_KERNEL_DATA_HEAP_OFFSET)
+        #define SGX_KERNEL_DATA_HEAP_SIZE                       (0x02F00000-(0x00001000+SGX_KERNEL_DATA_HEAP_OFFSET))
+
+        /* ==== Heaps 256MB onwards ==== */
+
+        #define SGX_3DPARAMETERS_HEAP_SIZE                      0x04000000
+
+        /* By default we split the PB 50/50 */
+#if !defined(HYBRID_SHARED_PB_SIZE)
+        #define HYBRID_SHARED_PB_SIZE                           (SGX_3DPARAMETERS_HEAP_SIZE >> 1)
+#endif
+#if defined(SUPPORT_HYBRID_PB)
+        #define SGX_SHARED_3DPARAMETERS_SIZE                    (HYBRID_SHARED_PB_SIZE)
+        #define SGX_SHARED_3DPARAMETERS_HEAP_SIZE               (HYBRID_SHARED_PB_SIZE-0x00001000)
+        #define SGX_PERCONTEXT_3DPARAMETERS_HEAP_SIZE           (SGX_3DPARAMETERS_HEAP_SIZE - SGX_SHARED_3DPARAMETERS_SIZE - 0x00001000)
+#else
+#if defined(SUPPORT_PERCONTEXT_PB)
+        #define SGX_SHARED_3DPARAMETERS_SIZE                    0
+        #define SGX_SHARED_3DPARAMETERS_HEAP_SIZE               0
+        #define SGX_PERCONTEXT_3DPARAMETERS_HEAP_SIZE           (SGX_3DPARAMETERS_HEAP_SIZE - 0x00001000)
+#endif
+#if defined(SUPPORT_SHARED_PB)
+        #define SGX_SHARED_3DPARAMETERS_SIZE                    SGX_3DPARAMETERS_HEAP_SIZE
+        #define SGX_SHARED_3DPARAMETERS_HEAP_SIZE               (SGX_3DPARAMETERS_HEAP_SIZE - 0x00001000)
+        #define SGX_PERCONTEXT_3DPARAMETERS_HEAP_SIZE           0
+#endif
+#endif
+
+        #define SGX_SHARED_3DPARAMETERS_HEAP_BASE                0x10000000
+
+        /* Size is defined above */
+
+        #define SGX_PERCONTEXT_3DPARAMETERS_HEAP_BASE            (SGX_SHARED_3DPARAMETERS_HEAP_BASE + SGX_SHARED_3DPARAMETERS_SIZE)
+        /* Size is defined above */
+
+        #define SGX_TADATA_HEAP_BASE                             0x14000000
+        #define SGX_TADATA_HEAP_SIZE                            (0x04000000-0x00001000)
+
+        #define SGX_SYNCINFO_HEAP_BASE                           0x18000000
+        #define SGX_SYNCINFO_HEAP_SIZE                          (0x01000000-0x00001000)
+
+    #define SGX_TEXTURE_HEAP_BASE                0x19000000
+    #define SGX_TEXTURE_HEAP_SIZE               (0xE6000000-0x00001000)
+
+#else /* defined(SGX_FEATURE_ADDRESS_SPACE_EXTENSION) */ 
 #if defined(FIX_HW_BRN_31620)
         #if defined(SGX_FEATURE_2D_HARDWARE)
         #define SGX_2D_HEAP_BASE                                         0x04000000
@@ -233,6 +321,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
         #define SGX_VERTEXSHADER_HEAP_SIZE                      (0x02000000-0x00001000)
 #endif /* FIX_HW_BRN_31620 */
         /* signal we've identified the core by the build */
+#endif /* defined(SGX_FEATURE_ADDRESS_SPACE_EXTENSION) */
         #define SGX_CORE_IDENTIFIED
 #endif /* SGX_FEATURE_ADDRESS_SPACE_SIZE == 32 */
 
@@ -335,6 +424,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
         #error "sgxconfig.h: ERROR: unspecified SGX Core version"
 #endif
 
+#if !defined(SGX_FEATURE_ADDRESS_SPACE_EXTENSION)
 /*********************************************************************************
  *
  * SGX_PDSPIXEL_CODEDATA_HEAP_BASE + 64MB range must include PDSVERTEX_CODEDATA and KERNEL_CODE heaps
@@ -449,7 +539,105 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #if ((SGX_VERTEXSHADER_HEAP_BASE + SGX_VERTEXSHADER_HEAP_SIZE) < SGX_VERTEXSHADER_HEAP_BASE)
         #error "sgxconfig.h: ERROR: SGX_VERTEXSHADER_HEAP_BASE size cause wraparound"
 #endif
+#else   /* !defined(SGX_FEATURE_ADDRESS_SPACE_EXTENSION) */
+
+/*********************************************************************************
+ *
+ * SGX_PDSPIXEL_CODEDATA_HEAP_BASE + 64MB range must include PDSVERTEX_CODEDATA and KERNEL_CODE heaps
+ *
+ ********************************************************************************/
+#if !defined (SGX_FEATURE_EDM_VERTEX_PDSADDR_FULL_RANGE)
+        #if ((SGX_KERNEL_CODE_HEAP_BASE + SGX_KERNEL_CODE_HEAP_SIZE - SGX_PDSPIXEL_CODEDATA_HEAP_BASE) >  0x4000000)
+                #error "sgxconfig.h: ERROR: SGX_KERNEL_CODE_HEAP_BASE out of range of SGX_PDSPIXEL_CODEDATA_HEAP_BASE"
+        #endif
+        
+        #if ((SGX_PDSVERTEX_CODEDATA_HEAP_BASE + SGX_PDSVERTEX_CODEDATA_HEAP_SIZE - SGX_PDSPIXEL_CODEDATA_HEAP_BASE) >  0x4000000)
+                #error "sgxconfig.h: ERROR: SGX_PDSVERTEX_CODEDATA_HEAP_BASE out of range of SGX_PDSPIXEL_CODEDATA_HEAP_BASE"
+        #endif
+#endif  
+
+/*********************************************************************************
+ *
+ * The kernel code heap base must be aligned to a USSE code page
+ *
+ ********************************************************************************/
+#if defined (EURASIA_USE_CODE_PAGE_SIZE)
+        #if ((SGX_KERNEL_CODE_HEAP_BASE & (EURASIA_USE_CODE_PAGE_SIZE - 1)) != 0)
+                #error "sgxconfig.h: ERROR: Kernel code heap base misalignment"
+        #endif
+#endif
+
+/*********************************************************************************
+ *
+ * Heap overlap check
+ *
+ ********************************************************************************/
+#if defined(SUPPORT_SGX_GENERAL_MAPPING_HEAP)
+        #if ((SGX_GENERAL_MAPPING_HEAP_BASE + SGX_GENERAL_MAPPING_HEAP_SIZE) >= SGX_GENERAL_HEAP_BASE)
+                #error "sgxconfig.h: ERROR: SGX_GENERAL_MAPPING_HEAP overlaps SGX_GENERAL_HEAP"
+        #endif
+#endif
+
+#if ((SGX_GENERAL_HEAP_BASE + SGX_GENERAL_HEAP_SIZE) >= SGX_PDSPIXEL_CODEDATA_HEAP_BASE)
+        #error "sgxconfig.h: ERROR: SGX_GENERAL_HEAP overlaps SGX_PDSPIXEL_CODEDATA_HEAP"
+#endif
+
+#if ((SGX_PDSPIXEL_CODEDATA_HEAP_BASE + SGX_PDSPIXEL_CODEDATA_HEAP_SIZE) >= SGX_KERNEL_CODE_HEAP_BASE)
+        #error "sgxconfig.h: ERROR: SGX_PDSPIXEL_CODEDATA_HEAP overlaps SGX_KERNEL_CODE_HEAP"
+#endif
+
+#if ((SGX_KERNEL_CODE_HEAP_BASE + SGX_KERNEL_CODE_HEAP_SIZE) >= SGX_PDSVERTEX_CODEDATA_HEAP_BASE)
+        #error "sgxconfig.h: ERROR: SGX_KERNEL_CODE_HEAP overlaps SGX_PDSVERTEX_CODEDATA_HEAP"
+#endif
+
+#if ((SGX_PDSVERTEX_CODEDATA_HEAP_BASE + SGX_PDSVERTEX_CODEDATA_HEAP_SIZE) >= SGX_PIXELSHADER_HEAP_BASE)
+        #error "sgxconfig.h: ERROR: SGX_PDSVERTEX_CODEDATA_HEAP overlaps SGX_KERNEL_DATA_HEAP"
+#endif
+
+#if ((SGX_PIXELSHADER_HEAP_BASE + SGX_PIXELSHADER_HEAP_SIZE) >= SGX_VERTEXSHADER_HEAP_BASE)
+        #error "sgxconfig.h: ERROR: SGX_PIXELSHADER_HEAP overlaps SGX_VERTEXSHADER_HEAP"
+#endif
+
+#if ((SGX_VERTEXSHADER_HEAP_BASE + SGX_VERTEXSHADER_HEAP_SIZE) >= SGX_KERNEL_DATA_HEAP_BASE)
+        #error "sgxconfig.h: ERROR: SGX_VERTEXSHADER_HEAP_BASE size overlaps SGX_KERNEL_DATA_HEAP"
+#endif
+
+/* check if last heap in 0-256MB spill out of 256MB */
+#if ((SGX_KERNEL_DATA_HEAP_BASE + SGX_KERNEL_DATA_HEAP_SIZE) > 0x0FFFFFFF)
+        #error "sgxconfig.h: ERROR: SGX_KERNEL_DATA_HEAP spill out of 256MB"
+#endif
+
+
+/* check for heaps out 0f 0-256MB range */
+
+
+#if ((SGX_SHARED_3DPARAMETERS_HEAP_BASE < 0x0FFFFFFF))
+        #error "sgxconfig.h: ERROR: put SGX_SHARED_3DPARAMETERS_HEAP out side of 0-256MB"
+#endif
+
+#if defined(SUPPORT_HYBRID_PB)
+        #if ((HYBRID_SHARED_PB_SIZE + 0x000001000) > SGX_3DPARAMETERS_HEAP_SIZE)
+                #error "sgxconfig.h: ERROR: HYBRID_SHARED_PB_SIZE too large"
+        #endif
+#endif
+
+#if (((SGX_PERCONTEXT_3DPARAMETERS_HEAP_BASE + SGX_PERCONTEXT_3DPARAMETERS_HEAP_SIZE) >= SGX_TADATA_HEAP_BASE) && (SGX_PERCONTEXT_3DPARAMETERS_HEAP_SIZE > 0))
+        #error "sgxconfig.h: ERROR: SGX_PERCONTEXT_3DPARAMETERS_HEAP_BASE overlaps SGX_TADATA_HEAP"
+#endif
+
+#if ((SGX_TADATA_HEAP_BASE + SGX_TADATA_HEAP_SIZE) >= SGX_SYNCINFO_HEAP_BASE)
+        #error "sgxconfig.h: ERROR: SGX_TADATA_HEAP overlaps SGX_SYNCINFO_HEAP"
+#endif
+
+#if ((SGX_SYNCINFO_HEAP_BASE + SGX_SYNCINFO_HEAP_SIZE) >= SGX_TEXTURE_HEAP_BASE)
+        #error "sgxconfig.h: ERROR: SGX_SYNCINFO_HEAP overlaps SGX_TEXTURE_HEAP_BASE"
+#endif
+
+#if ((SGX_TEXTURE_HEAP_BASE + SGX_TEXTURE_HEAP_SIZE) < SGX_TEXTURE_HEAP_BASE)
+        #error "sgxconfig.h: ERROR: SGX_TEXTURE_HEAP size cause wraparound"
+#endif
 
+#endif /* !defined(SGX_FEATURE_ADDRESS_SPACE_EXTENSION) */
 #endif /* __SGXCONFIG_H__ */
 
 /*****************************************************************************
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxinfokm.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxinfokm.h
index 9a1ffcd..ce30182 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxinfokm.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxinfokm.h
@@ -220,6 +220,9 @@ typedef struct _PVRSRV_SGXDEV_INFO_
         IMG_UINT32                              ui32MasterClkGateStatus2Reg;
         IMG_UINT32                              ui32MasterClkGateStatus2Mask;
 #endif /* SGX_FEATURE_MP */
+#if defined(SGX_FEATURE_AUTOCLOCKGATING)
+        IMG_BOOL                                bDisableClockGating;
+#endif
         SGX_INIT_SCRIPTS                sScripts;
 
         /* Members associated with dummy PD needed for BIF reset */
@@ -252,8 +255,6 @@ typedef struct _PVRSRV_SGXDEV_INFO_
         PVRSRV_KERNEL_MEM_INFO                  *psKernelSGXPTLAWriteBackMemInfo;
 #endif
 
-        IMG_UINT32                              ui32Flags;
-
         /* memory tiling range usage */
         IMG_UINT32                              ui32MemTilingUsage;
 
@@ -471,19 +472,9 @@ typedef struct _SGX_CCB_KICK_KM_
         /* CCB offset of data structure associated with this kick */
         IMG_UINT32      ui32CCBOffset;
 
-#if defined(SUPPORT_SGX_GENERALISED_SYNCOBJECTS)
-        /* SRC and DST syncs */
-        IMG_UINT32      ui32NumTASrcSyncs;
-        IMG_HANDLE      ahTASrcKernelSyncInfo[SGX_MAX_TA_SRC_SYNCS];
-        IMG_UINT32      ui32NumTADstSyncs;
-        IMG_HANDLE      ahTADstKernelSyncInfo[SGX_MAX_TA_DST_SYNCS];
-        IMG_UINT32      ui32Num3DSrcSyncs;
-        IMG_HANDLE      ah3DSrcKernelSyncInfo[SGX_MAX_3D_SRC_SYNCS];
-#else
         /* SRC syncs */
         IMG_UINT32      ui32NumSrcSyncs;
         IMG_HANDLE      ahSrcKernelSyncInfo[SGX_MAX_SRC_SYNCS_TA];
-#endif
 
         /* TA/3D dependency data */
         IMG_BOOL        bTADependency;
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxinit.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxinit.c
index 8614c45..c6736a1 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxinit.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxinit.c
@@ -298,6 +298,9 @@ static PVRSRV_ERROR InitDevInfo(PVRSRV_PER_PROCESS_DATA *psPerProc,
         psDevInfo->ui32MasterClkGateStatus2Reg = psInitInfo->ui32MasterClkGateStatus2Reg;
         psDevInfo->ui32MasterClkGateStatus2Mask = psInitInfo->ui32MasterClkGateStatus2Mask;
 #endif /* SGX_FEATURE_MP */
+#if defined(SGX_FEATURE_AUTOCLOCKGATING)
+        psDevInfo->bDisableClockGating = psInitInfo->bDisableClockGating;
+#endif
 
 
         /* Initialise Dev Data */
@@ -1377,7 +1380,11 @@ IMG_VOID SGXDumpDebugInfo (PVRSRV_SGXDEV_INFO	*psDevInfo,
                                 host thinks the fault is correct
                         */
                         ui32RegVal = OSReadHWReg(psDevInfo->pvRegsBaseKM, EUR_CR_BIF_INT_STAT);
+                        #if defined(EUR_CR_BIF_INT_STAT_PF_N_RW_MASK)
                         if (ui32RegVal & EUR_CR_BIF_INT_STAT_PF_N_RW_MASK)
+                        #else
+                        if (ui32RegVal & EUR_CR_BIF_INT_STAT_FAULT_TYPE_MASK)   
+                        #endif
                         {
                                 ui32RegVal = OSReadHWReg(psDevInfo->pvRegsBaseKM, EUR_CR_BIF_FAULT);
                                 ui32RegVal &= EUR_CR_BIF_FAULT_ADDR_MASK;
@@ -2102,12 +2109,10 @@ static IMG_VOID SGX_MISRHandler (IMG_VOID *pvData)
                 HWRecoveryResetSGX(psDeviceNode, 0, ISR_ID);
         }
 
-#if defined(OS_SUPPORTS_IN_LISR)
         if (psDeviceNode->bReProcessDeviceCommandComplete)
         {
                 SGXScheduleProcessQueuesKM(psDeviceNode);
         }
-#endif
 
         SGXTestActivePowerEvent(psDeviceNode, ISR_ID);
         
@@ -2307,12 +2312,34 @@ PVRSRV_ERROR SGXRegisterDevice (PVRSRV_DEVICE_NODE *psDeviceNode)
         psDeviceMemoryHeap->DevMemHeapType = DEVICE_MEMORY_HEAP_PERCONTEXT;
         /* set the default (4k). System can override these as required */
         psDeviceMemoryHeap->ui32DataPageSize = SGX_MMU_PAGE_SIZE;
-#if !defined(SUPPORT_SGX_GENERAL_MAPPING_HEAP)
+#if !defined(SUPPORT_SGX_GENERAL_MAPPING_HEAP) && !defined(SGX5300)
         /* specify the mapping heap ID for this device */
         psDevMemoryInfo->ui32MappingHeapID = (IMG_UINT32)(psDeviceMemoryHeap - psDevMemoryInfo->psDeviceMemoryHeap);
 #endif
         psDeviceMemoryHeap++;/* advance to the next heap */
 
+#if defined(SGX_FEATURE_ADDRESS_SPACE_EXTENSION)
+   /************* Texture Heap ***************/
+        psDeviceMemoryHeap->ui32HeapID = HEAP_ID( PVRSRV_DEVICE_TYPE_SGX, SGX_TEXTURE_HEAP_ID);
+        psDeviceMemoryHeap->sDevVAddrBase.uiAddr = SGX_TEXTURE_HEAP_BASE;
+        psDeviceMemoryHeap->ui32HeapSize = SGX_TEXTURE_HEAP_SIZE;
+        psDeviceMemoryHeap->ui32Attribs = PVRSRV_HAP_WRITECOMBINE
+                                        | PVRSRV_MEM_RAM_BACKED_ALLOCATION
+                                        | PVRSRV_HAP_SINGLE_PROCESS;
+ 
+        psDeviceMemoryHeap->pszName = "Texture";
+        psDeviceMemoryHeap->pszBSName = "Texture BS";
+        psDeviceMemoryHeap->DevMemHeapType = DEVICE_MEMORY_HEAP_PERCONTEXT;
+        /* set the default (4k). System can override these as required */
+        psDeviceMemoryHeap->ui32DataPageSize = SGX_MMU_PAGE_SIZE;
+        /* The mapping heap ID should be texture heap for SGX5300 */
+#if !defined(SUPPORT_SGX_GENERAL_MAPPING_HEAP) && defined(SGX5300)
+        /* specify the mapping heap ID for this device */
+        psDevMemoryInfo->ui32MappingHeapID = (IMG_UINT32)(psDeviceMemoryHeap - psDevMemoryInfo->psDeviceMemoryHeap);
+#endif 
+        psDeviceMemoryHeap++;/* advance to the next heap */
+#endif
+
 #if defined(SUPPORT_MEMORY_TILING)
         /************* VPB tiling ***************/
         psDeviceMemoryHeap->ui32HeapID = HEAP_ID( PVRSRV_DEVICE_TYPE_SGX, SGX_VPB_TILED_HEAP_ID);
@@ -2686,16 +2713,16 @@ PVRSRV_ERROR SGXDevInitCompatCheck(PVRSRV_DEVICE_NODE *psDeviceNode)
                 ui32BuildOptionsMismatch = ui32BuildOptions ^ psDevInfo->ui32ClientBuildOptions;
                 if ( (psDevInfo->ui32ClientBuildOptions & ui32BuildOptionsMismatch) != 0)
                 {
-                        PVR_LOG(("(FAIL) SGXInit: Mismatch in client-side and KM driver build options; "
-                                "extra options present in client-side driver: (0x%x). Please check sgx_options.h",
-                                psDevInfo->ui32ClientBuildOptions & ui32BuildOptionsMismatch ));
+                        PVR_LOG(("(FAIL) SGXInit: Mismatch in client-side and KM driver build options."));
+                        PVR_LOG(("Extra options present in client-side driver: (0x%x). Please check sgx_options.h",
+                                         psDevInfo->ui32ClientBuildOptions & ui32BuildOptionsMismatch));
                 }
 
                 if ( (ui32BuildOptions & ui32BuildOptionsMismatch) != 0)
                 {
-                        PVR_LOG(("(FAIL) SGXInit: Mismatch in client-side and KM driver build options; "
-                                "extra options present in KM: (0x%x). Please check sgx_options.h",
-                                ui32BuildOptions & ui32BuildOptionsMismatch ));
+                        PVR_LOG(("(FAIL) SGXInit: Mismatch in client-side and KM driver build options."));
+                        PVR_LOG(("Extra options present in KM: (0x%x). Please check sgx_options.h",
+                                         ui32BuildOptions & ui32BuildOptionsMismatch));
                 }
                 eError = PVRSRV_ERROR_BUILD_MISMATCH;
                 goto chk_exit;
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxkick.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxkick.c
index a03f51a..878cdd6 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxkick.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxkick.c
@@ -61,6 +61,10 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include "systrace.h"
 #endif
 
+#if defined(SUPPORT_DMABUF)
+#include "pvr_linux_fence.h"
+#endif
+
 /*!
 ******************************************************************************
 
@@ -84,6 +88,9 @@ PVRSRV_ERROR SGXDoKickKM(IMG_HANDLE hDevHandle, SGX_CCB_KICK *psCCBKick)
         SGXMKIF_CMDTA_SHARED *psTACmd;
         IMG_UINT32 i;
         IMG_HANDLE hDevMemContext = IMG_NULL;
+#if defined(SUPPORT_DMABUF)
+        IMG_UINT32 ui32FenceTag = 0;
+#endif
 #if  defined(SUPPORT_PVRSRV_ANDROID_SYSTRACE)
         PVRSRV_DEVICE_NODE      *psDeviceNode;
         PVRSRV_SGXDEV_INFO      *psDevInfo;
@@ -210,50 +217,6 @@ PVRSRV_ERROR SGXDoKickKM(IMG_HANDLE hDevHandle, SGX_CCB_KICK *psCCBKick)
         }
 
 
-#if defined(SUPPORT_SGX_GENERALISED_SYNCOBJECTS)
-        /* SRC and DST sync dependencies */
-        psTACmd->ui32NumTASrcSyncs = psCCBKick->ui32NumTASrcSyncs;
-        for (i=0; i<psCCBKick->ui32NumTASrcSyncs; i++)
-        {
-                psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *) psCCBKick->ahTASrcKernelSyncInfo[i];
-
-                psTACmd->asTASrcSyncs[i].sWriteOpsCompleteDevVAddr = psSyncInfo->sWriteOpsCompleteDevVAddr;
-                psTACmd->asTASrcSyncs[i].sReadOpsCompleteDevVAddr = psSyncInfo->sReadOpsCompleteDevVAddr;
-
-                /* Get ui32ReadOpsPending snapshot and copy into the CCB - before incrementing. */
-                psTACmd->asTASrcSyncs[i].ui32ReadOpsPendingVal = SyncTakeReadOp(psSyncInfo, SYNC_OP_CLASS_KICKTA);
-                /* Copy ui32WriteOpsPending snapshot into the CCB. */
-                psTACmd->asTASrcSyncs[i].ui32WriteOpsPendingVal = psSyncInfo->psSyncData->ui32WriteOpsPending;
-        }
-
-        psTACmd->ui32NumTADstSyncs = psCCBKick->ui32NumTADstSyncs;
-        for (i=0; i<psCCBKick->ui32NumTADstSyncs; i++)
-        {
-                psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *) psCCBKick->ahTADstKernelSyncInfo[i];
-
-                psTACmd->asTADstSyncs[i].sWriteOpsCompleteDevVAddr = psSyncInfo->sWriteOpsCompleteDevVAddr;
-                psTACmd->asTADstSyncs[i].sReadOpsCompleteDevVAddr = psSyncInfo->sReadOpsCompleteDevVAddr;
-
-                /* Get ui32ReadOpsPending snapshot and copy into the CCB */
-                psTACmd->asTADstSyncs[i].ui32ReadOpsPendingVal = psSyncInfo->psSyncData->ui32ReadOpsPending;
-                /* Copy ui32WriteOpsPending snapshot into the CCB - before incrementing */
-                psTACmd->asTADstSyncs[i].ui32WriteOpsPendingVal = SyncTakeWriteOp(psSyncInfo, SYNC_OP_CLASS_KICKTA);
-        }
-
-        psTACmd->ui32Num3DSrcSyncs = psCCBKick->ui32Num3DSrcSyncs;
-        for (i=0; i<psCCBKick->ui32Num3DSrcSyncs; i++)
-        {
-                psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *) psCCBKick->ah3DSrcKernelSyncInfo[i];
-
-                psTACmd->as3DSrcSyncs[i].sWriteOpsCompleteDevVAddr = psSyncInfo->sWriteOpsCompleteDevVAddr;
-                psTACmd->as3DSrcSyncs[i].sReadOpsCompleteDevVAddr = psSyncInfo->sReadOpsCompleteDevVAddr;
-
-                /* Get ui32ReadOpsPending snapshot and copy into the CCB - before incrementing. */
-                psTACmd->as3DSrcSyncs[i].ui32ReadOpsPendingVal = SyncTakeReadOp(psSyncInfo, SYNC_OP_CLASS_KICKTA);
-                /* Copy ui32WriteOpsPending snapshot into the CCB. */
-                psTACmd->as3DSrcSyncs[i].ui32WriteOpsPendingVal = psSyncInfo->psSyncData->ui32WriteOpsPending;
-        }
-#else /* SUPPORT_SGX_GENERALISED_SYNCOBJECTS */
         /* texture dependencies */
 #if defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC)
         eError = PVRSyncPatchCCBKickSyncInfos(psCCBKick->ahSrcKernelSyncInfo,
@@ -290,6 +253,19 @@ PVRSRV_ERROR SGXDoKickKM(IMG_HANDLE hDevHandle, SGX_CCB_KICK *psCCBKick)
                 return eError;
         }
 #else /* defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC) */
+#if defined(SUPPORT_DMABUF)
+        eError = PVRLinuxFenceProcess(&ui32FenceTag,
+                        psCCBKick->ui32NumSrcSyncs,
+                        psCCBKick->ahSrcKernelSyncInfo,
+                        NULL,
+                        psCCBKick->bFirstKickOrResume ? psCCBKick->ui32NumDstSyncObjects : 0,
+                        psCCBKick->pahDstSyncHandles,
+                        NULL);
+        if (eError != PVRSRV_OK)
+        {
+                return eError;
+        }
+#endif
         for (i=0; i<psCCBKick->ui32NumSrcSyncs; i++)
         {
                 psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *) psCCBKick->ahSrcKernelSyncInfo[i];
@@ -307,7 +283,6 @@ PVRSRV_ERROR SGXDoKickKM(IMG_HANDLE hDevHandle, SGX_CCB_KICK *psCCBKick)
         }
 #endif /* defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC) */
         psTACmd->ui32NumSrcSyncs = psCCBKick->ui32NumSrcSyncs;
-#endif /* defined(SUPPORT_SGX_GENERALISED_SYNCOBJECTS) */
 
         if (psCCBKick->bFirstKickOrResume && psCCBKick->ui32NumDstSyncObjects > 0)
         {
@@ -451,109 +426,6 @@ PVRSRV_ERROR SGXDoKickKM(IMG_HANDLE hDevHandle, SGX_CCB_KICK *psCCBKick)
                                  0,
                                  MAKEUNIQUETAG(psCCBMemInfo));
 
-#if defined(SUPPORT_SGX_GENERALISED_SYNCOBJECTS)
-                for (i=0; i<psCCBKick->ui32NumTASrcSyncs; i++)
-                {
-                        IMG_UINT32      ui32ModifiedValue;
-                        psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *) psCCBKick->ahTASrcKernelSyncInfo[i];
-
-                        psSyncInfo->psSyncData->ui32LastReadOpDumpVal++;
-
-                        ui32ModifiedValue = psSyncInfo->psSyncData->ui32LastReadOpDumpVal - 1;
-
-                        PDUMPCOMMENT("Modify TA SrcSync %d ROpsPendingVal\r\n", i);
-
-                        PDUMPMEM(&ui32ModifiedValue,
-                                 psCCBMemInfo,
-                                 psCCBKick->ui32CCBDumpWOff + offsetof(SGXMKIF_CMDTA_SHARED, asTASrcSyncs) +
-                                        (i * sizeof(PVRSRV_DEVICE_SYNC_OBJECT)) + offsetof(PVRSRV_DEVICE_SYNC_OBJECT, ui32ReadOpsPendingVal),
-                                 sizeof(IMG_UINT32),
-                                 0,
-                                MAKEUNIQUETAG(psCCBMemInfo));
-
-                        PDUMPCOMMENT("Modify TA SrcSync %d WOpPendingVal\r\n", i);
-
-                        PDUMPMEM(&psSyncInfo->psSyncData->ui32LastOpDumpVal,
-                                psCCBMemInfo,
-                                psCCBKick->ui32CCBDumpWOff + offsetof(SGXMKIF_CMDTA_SHARED, asTASrcSyncs) +
-                                        (i * sizeof(PVRSRV_DEVICE_SYNC_OBJECT)) + offsetof(PVRSRV_DEVICE_SYNC_OBJECT, ui32WriteOpsPendingVal),
-                                sizeof(IMG_UINT32),
-                                0,
-                                MAKEUNIQUETAG(psCCBMemInfo));
-                }
-
-                for (i=0; i<psCCBKick->ui32NumTADstSyncs; i++)
-                {
-                        IMG_UINT32      ui32ModifiedValue;
-                        psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *) psCCBKick->ahTADstKernelSyncInfo[i];
-
-                        psSyncInfo->psSyncData->ui32LastOpDumpVal++;
-
-                        ui32ModifiedValue = psSyncInfo->psSyncData->ui32LastOpDumpVal - 1;
-
-                        PDUMPCOMMENT("Modify TA DstSync %d WOpPendingVal\r\n", i);
-
-#if defined(SUPPORT_PDUMP_SYNC_DEBUG)
-                        PDUMPCOMMENT("TA TADst: PDump sync sample: uiAddr = 0x%08x, ui32LastOpDumpVal = 0x%08x\r\n",
-                                                                        psSyncInfo->sWriteOpsCompleteDevVAddr.uiAddr
-                                                                        ui32ModifiedValue;
-#endif
-
-                        PDUMPMEM(&ui32ModifiedValue,
-                                 psCCBMemInfo,
-                                 psCCBKick->ui32CCBDumpWOff + offsetof(SGXMKIF_CMDTA_SHARED, asTADstSyncs) +
-                                        (i * sizeof(PVRSRV_DEVICE_SYNC_OBJECT)) + offsetof(PVRSRV_DEVICE_SYNC_OBJECT, ui32WriteOpsPendingVal),
-                                 sizeof(IMG_UINT32),
-                                 0,
-                                MAKEUNIQUETAG(psCCBMemInfo));
-
-                        PDUMPCOMMENT("Modify TA DstSync %d ROpsPendingVal\r\n", i);
-
-                        PDUMPMEM(&psSyncInfo->psSyncData->ui32LastReadOpDumpVal,
-                                psCCBMemInfo,
-                                psCCBKick->ui32CCBDumpWOff + offsetof(SGXMKIF_CMDTA_SHARED, asTADstSyncs) +
-                                        (i * sizeof(PVRSRV_DEVICE_SYNC_OBJECT)) + offsetof(PVRSRV_DEVICE_SYNC_OBJECT, ui32ReadOpsPendingVal),
-                                sizeof(IMG_UINT32),
-                                0,
-                                MAKEUNIQUETAG(psCCBMemInfo));
-
-#if defined(SUPPORT_PDUMP_SYNC_DEBUG)
-                        PDUMPCOMMENTWITHFLAGS(PDUMP_FLAGS_PERSISTENT, "TA TADst: PDump sync update: uiAddr = 0x%08x, ui32LastOpDumpVal = 0x%08x\r\n",
-                                                                        psSyncInfo->sWriteOpsCompleteDevVAddr.uiAddr
-                                                                        psSyncInfo->psSyncData->ui32LastOpDumpVal);
-#endif
-                }
-
-                for (i=0; i<psCCBKick->ui32Num3DSrcSyncs; i++)
-                {
-                        IMG_UINT32      ui32ModifiedValue;
-                        psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *) psCCBKick->ah3DSrcKernelSyncInfo[i];
-
-                        psSyncInfo->psSyncData->ui32LastReadOpDumpVal++;
-
-                        ui32ModifiedValue = psSyncInfo->psSyncData->ui32LastReadOpDumpVal - 1;
-
-                        PDUMPCOMMENT("Modify 3D SrcSync %d ROpsPendingVal\r\n", i);
-
-                        PDUMPMEM(&ui32ModifiedValue,
-                                 psCCBMemInfo,
-                                 psCCBKick->ui32CCBDumpWOff + offsetof(SGXMKIF_CMDTA_SHARED, as3DSrcSyncs) +
-                                        (i * sizeof(PVRSRV_DEVICE_SYNC_OBJECT)) + offsetof(PVRSRV_DEVICE_SYNC_OBJECT, ui32ReadOpsPendingVal),
-                                 sizeof(IMG_UINT32),
-                                 0,
-                                MAKEUNIQUETAG(psCCBMemInfo));
-
-                        PDUMPCOMMENT("Modify 3D SrcSync %d WOpPendingVal\r\n", i);
-
-                        PDUMPMEM(&psSyncInfo->psSyncData->ui32LastOpDumpVal,
-                                psCCBMemInfo,
-                                psCCBKick->ui32CCBDumpWOff + offsetof(SGXMKIF_CMDTA_SHARED, as3DSrcSyncs) +
-                                        (i * sizeof(PVRSRV_DEVICE_SYNC_OBJECT)) + offsetof(PVRSRV_DEVICE_SYNC_OBJECT, ui32WriteOpsPendingVal),
-                                sizeof(IMG_UINT32),
-                                0,
-                                MAKEUNIQUETAG(psCCBMemInfo));
-                }
-#else/* SUPPORT_SGX_GENERALISED_SYNCOBJECTS */
                 for (i=0; i<psCCBKick->ui32NumSrcSyncs; i++)
                 {
                         IMG_UINT32      ui32ModifiedValue;
@@ -689,8 +561,6 @@ PVRSRV_ERROR SGXDoKickKM(IMG_HANDLE hDevHandle, SGX_CCB_KICK *psCCBKick)
                         psSyncInfo->psSyncData->ui32LastReadOpDumpVal++;
                 }
 
-#endif/* SUPPORT_SGX_GENERALISED_SYNCOBJECTS */
-
                 for (i = 0; i < psCCBKick->ui32NumTAStatusVals; i++)
                 {
 #if !defined(SUPPORT_SGX_NEW_STATUS_VALS)
@@ -727,6 +597,15 @@ PVRSRV_ERROR SGXDoKickKM(IMG_HANDLE hDevHandle, SGX_CCB_KICK *psCCBKick)
         eError = SGXScheduleCCBCommandKM(hDevHandle, SGXMKIF_CMD_TA, &psCCBKick->sCommand, KERNEL_ID, 0, hDevMemContext, psCCBKick->bLastInScene);
         if (eError == PVRSRV_ERROR_RETRY)
         {
+#if defined(SUPPORT_DMABUF)
+                PVRLinuxFenceRelease(ui32FenceTag,
+                        psCCBKick->ui32NumSrcSyncs,
+                        psCCBKick->ahSrcKernelSyncInfo,
+                        NULL,
+                        psCCBKick->bFirstKickOrResume ? psCCBKick->ui32NumDstSyncObjects : 0,
+                        psCCBKick->pahDstSyncHandles,
+                        NULL);
+#endif
                 if (psCCBKick->bFirstKickOrResume && psCCBKick->ui32NumDstSyncObjects > 0)
                 {
                         for (i=0; i < psCCBKick->ui32NumDstSyncObjects; i++)
@@ -748,33 +627,12 @@ PVRSRV_ERROR SGXDoKickKM(IMG_HANDLE hDevHandle, SGX_CCB_KICK *psCCBKick)
                         }
                 }
 
-#if defined(SUPPORT_SGX_GENERALISED_SYNCOBJECTS)
-                for (i=0; i<psCCBKick->ui32NumTASrcSyncs; i++)
-                {
-                        psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *) psCCBKick->ahTASrcKernelSyncInfo[i];
-                        psSyncInfo->psSyncData->ui32ReadOpsPending--;
-                        SyncRollBackReadOp(psSyncInfo, SYNC_OP_CLASS_KICKTA);
-                }
-                for (i=0; i<psCCBKick->ui32NumTADstSyncs; i++)
-                {
-                        psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *) psCCBKick->ahTADstKernelSyncInfo[i];
-                        psSyncInfo->psSyncData->ui32WriteOpsPending--;
-                        SyncRollBackReadOp(psSyncInfo, SYNC_OP_CLASS_KICKTA);
-                }
-                for (i=0; i<psCCBKick->ui32Num3DSrcSyncs; i++)
-                {
-                        psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *) psCCBKick->ah3DSrcKernelSyncInfo[i];
-                        psSyncInfo->psSyncData->ui32ReadOpsPending--;
-                        SyncRollBackReadOp(psSyncInfo, SYNC_OP_CLASS_KICKTA);
-                }
-#else/* SUPPORT_SGX_GENERALISED_SYNCOBJECTS */
                 for (i=0; i<psCCBKick->ui32NumSrcSyncs; i++)
                 {
                         psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *) psCCBKick->ahSrcKernelSyncInfo[i];
                         psSyncInfo->psSyncData->ui32ReadOpsPending--;
                         SyncRollBackReadOp(psSyncInfo, SYNC_OP_CLASS_KICKTA);
                 }
-#endif/* SUPPORT_SGX_GENERALISED_SYNCOBJECTS */
 
                 if (psCCBKick->hTA3DSyncInfo)
                 {
@@ -806,6 +664,9 @@ PVRSRV_ERROR SGXDoKickKM(IMG_HANDLE hDevHandle, SGX_CCB_KICK *psCCBKick)
                 PVR_DPF((PVR_DBG_ERROR, "SGXDoKickKM: SGXScheduleCCBCommandKM failed."));
                 PVR_TTRACE(PVRSRV_TRACE_GROUP_KICK, PVRSRV_TRACE_CLASS_FUNCTION_EXIT,
                                 KICK_TOKEN_DOKICK);
+#if defined(SUPPORT_DMABUF) && defined(NO_HARDWARE)
+                PVRLinuxFenceCheckAll();
+#endif
                 return eError;
         }
 
@@ -853,31 +714,12 @@ PVRSRV_ERROR SGXDoKickKM(IMG_HANDLE hDevHandle, SGX_CCB_KICK *psCCBKick)
 #endif
         }
 
-#if defined(SUPPORT_SGX_GENERALISED_SYNCOBJECTS)
-        /* SRC and DST dependencies */
-        for (i=0; i<psCCBKick->ui32NumTASrcSyncs; i++)
-        {
-                psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *) psCCBKick->ahTASrcKernelSyncInfo[i];
-                psSyncInfo->psSyncData->ui32ReadOpsComplete =  psSyncInfo->psSyncData->ui32ReadOpsPending;
-        }
-        for (i=0; i<psCCBKick->ui32NumTADstSyncs; i++)
-        {
-                psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *) psCCBKick->ahTADstKernelSyncInfo[i];
-                psSyncInfo->psSyncData->ui32WriteOpsComplete =  psSyncInfo->psSyncData->ui32WriteOpsPending;
-        }
-        for (i=0; i<psCCBKick->ui32Num3DSrcSyncs; i++)
-        {
-                psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *) psCCBKick->ah3DSrcKernelSyncInfo[i];
-                psSyncInfo->psSyncData->ui32ReadOpsComplete =  psSyncInfo->psSyncData->ui32ReadOpsPending;
-        }
-#else/* SUPPORT_SGX_GENERALISED_SYNCOBJECTS */
         /* texture dependencies */
         for (i=0; i<psCCBKick->ui32NumSrcSyncs; i++)
         {
                 psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *) psCCBKick->ahSrcKernelSyncInfo[i];
                 psSyncInfo->psSyncData->ui32ReadOpsComplete =  psSyncInfo->psSyncData->ui32ReadOpsPending;
         }
-#endif/* SUPPORT_SGX_GENERALISED_SYNCOBJECTS */
 
         if (psCCBKick->bTerminateOrAbort)
         {
@@ -910,6 +752,9 @@ PVRSRV_ERROR SGXDoKickKM(IMG_HANDLE hDevHandle, SGX_CCB_KICK *psCCBKick)
 #endif
                 }
         }
+#if defined(SUPPORT_DMABUF)
+        PVRLinuxFenceCheckAll();
+#endif
 #endif
         PVR_TTRACE(PVRSRV_TRACE_GROUP_KICK, PVRSRV_TRACE_CLASS_FUNCTION_EXIT,
                         KICK_TOKEN_DOKICK);
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxpower.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxpower.c
index a4ef276..75cdd06 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxpower.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxpower.c
@@ -227,6 +227,7 @@ static IMG_VOID SGXStartTimer(PVRSRV_SGXDEV_INFO	*psDevInfo)
 }
 
 
+#if defined(SGX_FEATURE_AUTOCLOCKGATING)
 /*!
 ******************************************************************************
 
@@ -274,6 +275,7 @@ static IMG_VOID SGXPollForClockGating (PVRSRV_SGXDEV_INFO	*psDevInfo,
         PDUMPCOMMENT("%s", pszComment);
         PDUMPREGPOL(SGX_PDUMPREG_NAME, ui32Register, 0, ui32RegisterValue, PDUMP_POLL_OPERATOR_EQUAL);
 }
+#endif
 
 
 /*!
@@ -304,8 +306,10 @@ PVRSRV_ERROR SGXPrePowerState (IMG_HANDLE				hDevHandle,
                 PVRSRV_SGXDEV_INFO      *psDevInfo = psDeviceNode->pvDevice;
                 IMG_UINT32                      ui32PowerCmd, ui32CompleteStatus;
                 SGXMKIF_COMMAND         sCommand = {0};
+#if defined(SGX_FEATURE_AUTOCLOCKGATING)
                 IMG_UINT32                      ui32Core;
                 IMG_UINT32                      ui32CoresEnabled;
+#endif
 
                 #if defined(SUPPORT_HW_RECOVERY)
                 /* Disable timer callback for HW recovery */
@@ -387,33 +391,39 @@ PVRSRV_ERROR SGXPrePowerState (IMG_HANDLE				hDevHandle,
                         PVR_DBG_BREAK;
                 }
                 #endif /* NO_HARDWARE && SUPPORT_LISR_MISR_SYNC*/
+                
+#if defined(SGX_FEATURE_AUTOCLOCKGATING)
+                if(psDevInfo->bDisableClockGating == IMG_FALSE)
+                {
 #if defined(SGX_FEATURE_MP)
-                ui32CoresEnabled = ((OSReadHWReg(psDevInfo->pvRegsBaseKM, EUR_CR_MASTER_CORE) & EUR_CR_MASTER_CORE_ENABLE_MASK) >> EUR_CR_MASTER_CORE_ENABLE_SHIFT) + 1;
+                        ui32CoresEnabled = ((OSReadHWReg(psDevInfo->pvRegsBaseKM, EUR_CR_MASTER_CORE) & EUR_CR_MASTER_CORE_ENABLE_MASK) >> EUR_CR_MASTER_CORE_ENABLE_SHIFT) + 1;
 #else
-                ui32CoresEnabled = 1;
+                        ui32CoresEnabled = 1;
 #endif
 
-                for (ui32Core = 0; ui32Core < ui32CoresEnabled; ui32Core++)
-                {
-                        /* Wait for SGX clock gating. */
+                        for (ui32Core = 0; ui32Core < ui32CoresEnabled; ui32Core++)
+                        {
+                                /* Wait for SGX clock gating. */
+                                SGXPollForClockGating(psDevInfo,
+                                                                        SGX_MP_CORE_SELECT(psDevInfo->ui32ClkGateStatusReg, ui32Core),
+                                                                        psDevInfo->ui32ClkGateStatusMask,
+                                                                        "Wait for SGX clock gating");
+                        }
+
+#if defined(SGX_FEATURE_MP)
+                        /* Wait for SGX master clock gating. */
                         SGXPollForClockGating(psDevInfo,
-                                                                  SGX_MP_CORE_SELECT(psDevInfo->ui32ClkGateStatusReg, ui32Core),
-                                                                  psDevInfo->ui32ClkGateStatusMask,
-                                                                  "Wait for SGX clock gating");
-                }
+                                                                psDevInfo->ui32MasterClkGateStatusReg,
+                                                                psDevInfo->ui32MasterClkGateStatusMask,
+                                                                "Wait for SGX master clock gating");
 
-                #if defined(SGX_FEATURE_MP)
-                /* Wait for SGX master clock gating. */
-                SGXPollForClockGating(psDevInfo,
-                                                          psDevInfo->ui32MasterClkGateStatusReg,
-                                                          psDevInfo->ui32MasterClkGateStatusMask,
-                                                          "Wait for SGX master clock gating");
-
-                SGXPollForClockGating(psDevInfo,
-                                                          psDevInfo->ui32MasterClkGateStatus2Reg,
-                                                          psDevInfo->ui32MasterClkGateStatus2Mask,
-                                                          "Wait for SGX master clock gating (2)");
-                #endif /* SGX_FEATURE_MP */
+                        SGXPollForClockGating(psDevInfo,
+                                                                psDevInfo->ui32MasterClkGateStatus2Reg,
+                                                                psDevInfo->ui32MasterClkGateStatus2Mask,
+                                                                "Wait for SGX master clock gating (2)");
+#endif /* SGX_FEATURE_MP */
+                }
+#endif /* defined(SGX_FEATURE_AUTOCLOCKGATING) */
 
                 if (eNewPowerState == PVRSRV_DEV_POWER_STATE_OFF)
                 {
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxreset.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxreset.c
index 2b7aa4c..ecf0e62 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxreset.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxreset.c
@@ -649,6 +649,12 @@ IMG_VOID SGXReset(PVRSRV_SGXDEV_INFO	*psDevInfo,
         PDUMPREGWITHFLAGS(SGX_PDUMPREG_NAME, EUR_CR_BIF_TWOD_REQ_BASE, SGX_2D_HEAP_BASE, ui32PDUMPFlags);
 #endif
 
+#if defined(SGX_FEATURE_ADDRESS_SPACE_EXTENSION)
+        /*TODO: Set up USEC requestor base, here its set to ZERO (hard-coded) */
+        OSWriteHWReg(psDevInfo->pvRegsBaseKM, EUR_CR_BIF_USEC_REQ_BASE, 0);
+        PDUMPREGWITHFLAGS(SGX_PDUMPREG_NAME, EUR_CR_BIF_USEC_REQ_BASE, 0, ui32PDUMPFlags);
+#endif
+
         /* Invalidate BIF Directory cache. */
         SGXResetInvalDC(psDevInfo, ui32PDUMPFlags, IMG_TRUE);
 
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxtransfer.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxtransfer.c
index 74dbc99..430b750 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxtransfer.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxtransfer.c
@@ -62,6 +62,10 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include "pvr_sync.h"
 #endif
 
+#if defined(SUPPORT_DMABUF)
+#include "pvr_linux_fence.h"
+#endif
+
 IMG_EXPORT PVRSRV_ERROR SGXSubmitTransferKM(IMG_HANDLE hDevHandle, PVRSRV_TRANSFER_SGX_KICK *psKick)
 {
         PVRSRV_KERNEL_MEM_INFO          *psCCBMemInfo = (PVRSRV_KERNEL_MEM_INFO *)psKick->hCCBMemInfo;
@@ -76,22 +80,11 @@ IMG_EXPORT PVRSRV_ERROR SGXSubmitTransferKM(IMG_HANDLE hDevHandle, PVRSRV_TRANSF
         IMG_BOOL                                        abDstSyncEnable[SGX_MAX_TRANSFER_SYNC_OPS];
         IMG_UINT32                                      ui32RealDstSyncNum = 0;
 
+#if defined(SUPPORT_DMABUF)
+        IMG_UINT32                                      ui32FenceTag;
+#endif
+
 
-#if defined(PDUMP)
-        IMG_BOOL bPersistentProcess = IMG_FALSE;
-        /*
-         *      For persistent processes, the HW kicks should not go into the
-         *      extended init phase; only keep memory transactions from the
-         *      window system which are necessary to run the client app.
-         */
-        {
-                PVRSRV_PER_PROCESS_DATA* psPerProc = PVRSRVFindPerProcessData();
-                if(psPerProc != IMG_NULL)
-                {
-                        bPersistentProcess = psPerProc->bPDumpPersistent;
-                }
-        }
-#endif /* PDUMP */
 #if defined(FIX_HW_BRN_31620)
         hDevMemContext = psKick->hDevMemContext;
 #endif
@@ -214,6 +207,20 @@ IMG_EXPORT PVRSRV_ERROR SGXSubmitTransferKM(IMG_HANDLE hDevHandle, PVRSRV_TRANSF
         {
                 IMG_UINT32 i = 0;
 
+#if defined(SUPPORT_DMABUF)
+                eError = PVRLinuxFenceProcess(&ui32FenceTag,
+                                psKick->ui32NumSrcSync,
+                                psKick->ahSrcSyncInfo,
+                                abSrcSyncEnable,
+                                psKick->ui32NumDstSync,
+                                psKick->ahDstSyncInfo,
+                                abDstSyncEnable);
+
+                if (eError != PVRSRV_OK)
+                {
+                        return eError;
+                }
+#endif
                 for (loop = 0; loop < psKick->ui32NumSrcSync; loop++)
                 {
                         if (abSrcSyncEnable[loop])
@@ -281,7 +288,7 @@ IMG_EXPORT PVRSRV_ERROR SGXSubmitTransferKM(IMG_HANDLE hDevHandle, PVRSRV_TRANSF
                 }
 
 #if defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC)
-                if (ui32RealDstSyncNum < SGX_MAX_TRANSFER_SYNC_OPS - 2 && psKick->iFenceFd > 0)
+                if (ui32RealDstSyncNum <= (SGX_MAX_DST_SYNCS_TQ - 1) && psKick->iFenceFd > 0)
                 {
                         IMG_HANDLE ahSyncInfo[SGX_MAX_SRC_SYNCS_TA];
                         PVRSRV_DEVICE_SYNC_OBJECT *apsDevSyncs = &psSharedTransferCmd->asDstSyncs[ui32RealDstSyncNum];
@@ -561,6 +568,15 @@ IMG_EXPORT PVRSRV_ERROR SGXSubmitTransferKM(IMG_HANDLE hDevHandle, PVRSRV_TRANSF
                 /* Client will retry, so undo the sync ops pending increment(s) done above. */
                 if ((psKick->ui32Flags & SGXMKIF_TQFLAGS_KEEPPENDING) == 0UL)
                 {
+#if defined(SUPPORT_DMABUF)
+                        PVRLinuxFenceRelease(ui32FenceTag,
+                                                psKick->ui32NumSrcSync,
+                                                psKick->ahSrcSyncInfo,
+                                                abSrcSyncEnable,
+                                                psKick->ui32NumDstSync,
+                                                psKick->ahDstSyncInfo,
+                                                abDstSyncEnable);
+#endif
                         for (loop = 0; loop < psKick->ui32NumSrcSync; loop++)
                         {
                                 if (abSrcSyncEnable[loop])
@@ -607,15 +623,17 @@ IMG_EXPORT PVRSRV_ERROR SGXSubmitTransferKM(IMG_HANDLE hDevHandle, PVRSRV_TRANSF
                         SyncRollBackWriteOp(psSyncInfo, SYNC_OP_CLASS_TQ_3D);
                 }
         }
-
         else if (PVRSRV_OK != eError)
         {
                 PVR_DPF((PVR_DBG_ERROR, "SGXSubmitTransferKM: SGXScheduleCCBCommandKM failed."));
                 PVR_TTRACE(PVRSRV_TRACE_GROUP_TRANSFER, PVRSRV_TRACE_CLASS_FUNCTION_EXIT,
                                 TRANSFER_TOKEN_SUBMIT);
+#if defined(SUPPORT_DMABUF) && defined(NO_HARDWARE)
+                PVRLinuxFenceCheckAll();
+#endif
                 return eError;
         }
-        
+
 
 #if defined(NO_HARDWARE)
         if ((psKick->ui32Flags & SGXMKIF_TQFLAGS_NOSYNCUPDATE) == 0)
@@ -940,6 +958,9 @@ IMG_EXPORT PVRSRV_ERROR SGXSubmit2DKM(IMG_HANDLE hDevHandle, PVRSRV_2D_SGX_KICK
 
                 psSyncInfo->psSyncData->ui32WriteOpsComplete = psSyncInfo->psSyncData->ui32WriteOpsPending;
         }
+#if defined(SUPPORT_DMABUF)
+        PVRLinuxFenceCheckAll();
+#endif
 #endif
 
         return eError;
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxutils.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxutils.c
index b1d2b13..bce7945 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxutils.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/devices/sgx/sgxutils.c
@@ -190,8 +190,10 @@ IMG_VOID SGXTestActivePowerEvent (PVRSRV_DEVICE_NODE	*psDeviceNode,
                         /* Microkernel is idle and is requesting to be powered down. */
                         psSGXHostCtl->ui32InterruptClearFlags |= PVRSRV_USSE_EDM_INTERRUPT_ACTIVE_POWER;
 
-                        /* Suspend pdumping. */
+#if !defined(SUPPORT_PDUMP_MULTI_PROCESS)
+                /* Suspend pdumping. */
                         PDUMPSUSPEND();
+#endif
 
 #if defined(SYS_CUSTOM_POWERDOWN)
                         /*
@@ -207,8 +209,10 @@ IMG_VOID SGXTestActivePowerEvent (PVRSRV_DEVICE_NODE	*psDeviceNode,
                         {
                                 SGXPostActivePowerEvent(psDeviceNode, ui32CallerID);
                         }
+#if !defined(SUPPORT_PDUMP_MULTI_PROCESS)
                         /* Resume pdumping */
                         PDUMPRESUME();
+#endif
                 }
 
                 PVRSRVPowerUnlock(ui32CallerID);
@@ -325,7 +329,7 @@ PVRSRV_ERROR SGXScheduleCCBCommand(PVRSRV_DEVICE_NODE	*psDeviceNode,
 #if defined(FIX_HW_BRN_28889)
         /*
                 If the data cache and bif cache need invalidating there has been a cleanup
-                request. Therefore, we need to send the invalidate seperately and wait
+                request. Therefore, we need to send the invalidate separately and wait
                 for it to complete.
         */
         if ( (eCmdType != SGXMKIF_CMD_PROCESS_QUEUES) &&
@@ -699,6 +703,9 @@ PVRSRV_ERROR SGXScheduleCCBCommandKM(PVRSRV_DEVICE_NODE		*psDeviceNode,
                 return eError;
         }
 
+#if defined(SUPPORT_PDUMP_MULTI_PROCESS)
+        PDUMP_LOCK();
+#endif
         /* Note that a power-up has been dumped in the init phase. */
         PDUMPSUSPEND();
 
@@ -707,6 +714,9 @@ PVRSRV_ERROR SGXScheduleCCBCommandKM(PVRSRV_DEVICE_NODE		*psDeviceNode,
                                                                                  PVRSRV_DEV_POWER_STATE_ON);
 
         PDUMPRESUME();
+#if defined(SUPPORT_PDUMP_MULTI_PROCESS)
+        PDUMP_UNLOCK();
+#endif
 
         if (eError == PVRSRV_OK)
         {
@@ -759,7 +769,7 @@ PVRSRV_ERROR SGXScheduleProcessQueuesKM(PVRSRV_DEVICE_NODE *psDeviceNode)
         ui32PowerStatus = psHostCtl->ui32PowerStatus;
         if ((ui32PowerStatus & PVRSRV_USSE_EDM_POWMAN_NO_WORK) != 0)
         {
-                /* The ukernel has no work to do so don't waste power. */
+                /* The ukernel has no work to be done, so don't waste power. */
                 return PVRSRV_OK;
         }
 
@@ -815,7 +825,6 @@ PVRSRV_ERROR SGXGetInternalDevInfoKM(IMG_HANDLE hDevCookie,
 {
         PVRSRV_SGXDEV_INFO *psDevInfo = (PVRSRV_SGXDEV_INFO *)((PVRSRV_DEVICE_NODE *)hDevCookie)->pvDevice;
 
-        psSGXInternalDevInfo->ui32Flags = psDevInfo->ui32Flags;
         psSGXInternalDevInfo->bForcePTOff = (IMG_BOOL)psDevInfo->bForcePTOff;
 
         /* This should be patched up by OS bridge code */
@@ -888,9 +897,9 @@ PVRSRV_ERROR SGXCleanupRequest(PVRSRV_DEVICE_NODE *psDeviceNode,
                         Pdump the poll as well.
                         Note:
                         We don't expect the cleanup to report busy as the client should have
-                        ensured the the resource has been finished with before requesting
-                        it's cleanup. This isn't true of the abnormal termination case but
-                        we don't expect to PDump that. Unless/until PDump has flow control
+                        ensured the resource has been finished with before requesting it's
+                        cleanup. This isn't true of the abnormal termination case but we
+                        don't expect to PDump that. Unless/until PDump has flow control
                         there isn't anything else we can do.
                 */
                 PDUMPCOMMENTWITHFLAGS(0, "Host Control - Poll for clean-up request to complete");
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/Kbuild.mk b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/Kbuild.mk
index 857206e..36fd164 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/Kbuild.mk
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/Kbuild.mk
@@ -78,14 +78,19 @@ pvrsrvkm-y += \
         services4/srvkm/common/queue.o
 endif
 
-ifeq ($(SUPPORT_DRM_GEM),1)
+ifeq ($(SUPPORT_ION),1)
+pvrsrvkm-y += \
+        services4/srvkm/env/linux/ion.o
+ifeq ($(LMA),1)
 pvrsrvkm-y += \
-        services4/srvkm/env/linux/dmabuf.o
+        services4/srvkm/env/linux/lma_heap_ion.o 
+endif
 endif
 
-ifeq ($(SUPPORT_ION),1)
+ifeq ($(SUPPORT_DMABUF),1)
 pvrsrvkm-y += \
-        services4/srvkm/env/linux/ion.o
+        services4/srvkm/env/linux/dmabuf.o \
+        services4/srvkm/env/linux/pvr_linux_fence.o
 endif
 
 ifeq ($(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC),1)
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/dmabuf.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/dmabuf.c
index 4b9023e..a59ae6f 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/dmabuf.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/dmabuf.c
@@ -1,5 +1,5 @@
 /*************************************************************************/ /*!
-@Title          Ion driver inter-operability code.
+@Title          Dma_buf support code.
 @Copyright      Copyright (c) Imagination Technologies Ltd. All Rights Reserved
 @License        Dual MIT/GPLv2
 
@@ -40,270 +40,348 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 */ /**************************************************************************/
 
 #include "dmabuf.h"
-#include <linux/platform_device.h>
-#include <linux/dma-buf.h>
-#include <linux/dma-direction.h>
-#include <linux/scatterlist.h>
+
+#if defined(SUPPORT_DMABUF)
+
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/err.h>
+#include <linux/dma-buf.h>
+#include <linux/scatterlist.h>
+#if defined(SUPPORT_DRI_DRM)
+#include <drm/drmP.h>
+#endif
 
-extern struct platform_device *gpsPVRLDMDev;
-
-#define MAX_IMPORT_DMABUF_FDS 3
+#include "services_headers.h"
+#include "pvr_debug.h"
+#include "linkage.h"
+#include "pvr_bridge.h"
 
-typedef struct _DMABUF_IMPORT_DATA_
+struct dmabuf_import
 {
-        /* Number of dma_buf handles represented by this import */
-        IMG_UINT32 ui32NumHandles;
+        unsigned num_fds;
 
-        /* Array of dma_buf handles in use by services */
-        struct dma_buf *apsDmaBuf[MAX_IMPORT_DMABUF_FDS];
+        struct dma_buf *dma_buf[DMABUF_IMPORT_MAX_FDS];
+
+        struct dma_buf_attachment *attachment[DMABUF_IMPORT_MAX_FDS];
+
+        struct sg_table *sg_table[DMABUF_IMPORT_MAX_FDS];
+
+#if defined(PDUMP)
+        void *kvaddr;
+#endif /* defined(PDUMP) */
+};
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,17,0))
+struct dmabuf_resvinfo
+{
+        unsigned num_resvs;
 
-        /* Array of dma_buf attachments */
-        struct dma_buf_attachment *apsDmaBufAttachment[MAX_IMPORT_DMABUF_FDS];
+        struct reservation_object *resv[DMABUF_IMPORT_MAX_FDS];
+};
+#endif
 
-        /* Array of sg_tables */
-        struct sg_table *apsSgTable[MAX_IMPORT_DMABUF_FDS];
+IMG_VOID DmaBufUnimportAndReleasePhysAddr(IMG_HANDLE hImport)
+{
+        struct dmabuf_import *import;
+        unsigned buf;
 
-        /* Array of physical addresses represented by these buffers */
-        IMG_SYS_PHYADDR *psSysPhysAddr;
+        import = (struct dmabuf_import *)hImport;
 
 #if defined(PDUMP)
-         /* FIXME: Not sure if this is needed here */
-        IMG_PVOID pvKernAddr0;
+        if (import->kvaddr)
+        {
+                dma_buf_vunmap(import->dma_buf[0], import->kvaddr);
+                dma_buf_end_cpu_access(import->dma_buf[0], 0,
+                                        import->dma_buf[0]->size,
+                                        DMA_BIDIRECTIONAL);
+        }
 #endif /* defined(PDUMP) */
+
+        for (buf = 0; buf < import->num_fds; buf++)
+        {
+                if (!IS_ERR_OR_NULL(import->sg_table[buf]))
+                {
+                        dma_buf_unmap_attachment(import->attachment[buf],
+                                                        import->sg_table[buf],
+                                                        DMA_BIDIRECTIONAL);
+                }
+
+                if (!IS_ERR_OR_NULL(import->attachment[buf]))
+                {
+                        dma_buf_detach(import->dma_buf[buf], import->attachment[buf]);
+                }
+
+                if (!IS_ERR_OR_NULL(import->dma_buf[buf]))
+                {
+                        dma_buf_put(import->dma_buf[buf]);
+                }
+        }
+
+        kfree(import);
 }
-DMABUF_IMPORT_DATA;
 
-PVRSRV_ERROR DmabufImportBufferAndAcquirePhysAddr(IMG_UINT32 ui32NumFDs,
-                                                                                           IMG_INT32  *pai32BufferFDs,
+PVRSRV_ERROR DmaBufImportAndAcquirePhysAddr(const IMG_UINT32 ui32NumFDs,
+                                                                                           const IMG_INT32 *pi32FD,
+                                                                                           const IMG_SIZE_T *puiDmaBufOffset,
+                                                                                           const IMG_SIZE_T *puiSize,
                                                                                            IMG_UINT32 *pui32PageCount,
                                                                                            IMG_SYS_PHYADDR **ppsSysPhysAddr,
-                                                                                           IMG_PVOID  *ppvKernAddr0,
-                                                                                           IMG_HANDLE *phPriv,
+                                                                                           IMG_SIZE_T *puiMemInfoOffset,
+                                                                                           IMG_PVOID  *ppvKernAddr,
+                                                                                           IMG_HANDLE *phImport,
                                                                                            IMG_HANDLE *phUnique)
 {
-        struct scatterlist *psTemp, *psScatterList[MAX_IMPORT_DMABUF_FDS] = {};
-        PVRSRV_ERROR eError = PVRSRV_ERROR_OUT_OF_MEMORY;
-        IMG_UINT32 i, k, ui32PageCount = 0;
-        DMABUF_IMPORT_DATA *psImportData;
-
-        if(ui32NumFDs > MAX_IMPORT_DMABUF_FDS)
+        struct dmabuf_import *import = NULL;
+        struct device *dev = NULL;
+        struct scatterlist *sg;
+        size_t buf_size[DMABUF_IMPORT_MAX_FDS];
+        size_t meminfo_offset;
+        unsigned npages = 0;
+        unsigned pti = 0;
+        IMG_SYS_PHYADDR *spaddr = NULL;
+        unsigned i;
+        unsigned buf;
+        PVRSRV_ERROR eError = PVRSRV_ERROR_INVALID_PARAMS;
+
+        if (ui32NumFDs < 1 || ui32NumFDs > DMABUF_IMPORT_MAX_FDS)
         {
-                printk(KERN_ERR "%s: More passed in than supported "
-                                                "(%d provided, %d max)", __func__, ui32NumFDs,
-                                                MAX_IMPORT_DMABUF_FDS);
-                return PVRSRV_ERROR_INVALID_PARAMS;
+                PVR_DPF((PVR_DBG_ERROR, "%s: Number of FDs is %u", __func__, (unsigned)ui32NumFDs));
+                eError = PVRSRV_ERROR_INVALID_PARAMS;
+                goto error;
         }
 
-        psImportData = kzalloc(sizeof(DMABUF_IMPORT_DATA), GFP_KERNEL);
-        if (psImportData == NULL)
+        import = kzalloc(sizeof(*import), GFP_KERNEL);
+        if (!import)
         {
-                goto exitFailKMallocImportData;
+                PVR_DPF((PVR_DBG_ERROR, "%s: Out of memory", __func__));
+                eError = PVRSRV_ERROR_OUT_OF_MEMORY;
+                goto error;
         }
+        import->num_fds = ui32NumFDs;
 
-        /* Set up import data for free call */
-        psImportData->ui32NumHandles = ui32NumFDs;
-
-        for(i = 0; i < ui32NumFDs; i++)
+        dev = PVRLDMGetDevice();
+        if (!dev)
         {
-                int fd = (int)pai32BufferFDs[i];
+                PVR_DPF((PVR_DBG_ERROR, "%s: Couldn't get device", __func__));
+                eError = PVRSRV_ERROR_NOT_SUPPORTED;
+                goto error;
+        }
 
-                /* connect to the buffer */
-                psImportData->apsDmaBuf[i] = dma_buf_get(fd);
-                if (IS_ERR_OR_NULL(psImportData->apsDmaBuf[i]))
+        for (buf = 0; buf < ui32NumFDs; buf++)
+        {
+                import->dma_buf[buf] = dma_buf_get((int)pi32FD[buf]);
+                if (IS_ERR(import->dma_buf[buf]))
                 {
-                        dev_err(&gpsPVRLDMDev->dev,
-                                   "dma_buf_get() returned bad dma_buf handle\n");
+                        PVR_DPF((PVR_DBG_ERROR, "%s: dma_buf_get failed: %ld", __func__, PTR_ERR(import->dma_buf[buf])));
                         eError = PVRSRV_ERROR_BAD_MAPPING;
-                        goto exitFailImport;
+                        goto error;
                 }
 
-                psImportData->apsDmaBufAttachment[i] = dma_buf_attach(psImportData->apsDmaBuf[i],
-                                                                        &gpsPVRLDMDev->dev);
-        if (IS_ERR_OR_NULL(psImportData->apsDmaBufAttachment[i]))
-        {
-                        dev_err(&gpsPVRLDMDev->dev,
-                                   "dma_buf_attach() returned bad attachment struct\n");
-            eError = PVRSRV_ERROR_BAD_MAPPING;
-            goto exitFailImport;
-        }
+                buf_size[buf] = puiSize[buf] ? puiSize[buf] : import->dma_buf[buf]->size;
 
-                /* requesting access to the buffer */
-                psImportData->apsSgTable[i] = dma_buf_map_attachment(psImportData->apsDmaBufAttachment[i],
-                                                        DMA_BIDIRECTIONAL);
-        if (IS_ERR_OR_NULL(psImportData->apsSgTable[i]))
-        {
-                        dev_err(&gpsPVRLDMDev->dev,
-                                   "dma_buf_map_attachment returned stale sgtable: %d\n",
-                                   (int)psImportData->apsSgTable[i]);
-#if defined(DEBUG)
-            /* lets dump the stack trace here */
-            WARN_ON(true);
-                        /* TODO: print all the current omap bo info */
-#endif
-            dma_buf_detach(psImportData->apsDmaBuf[i],
-                    psImportData->apsDmaBufAttachment[i]);
-            eError = PVRSRV_ERROR_OUT_OF_MEMORY;
-            goto exitFailImport;
-        }
-
-                psScatterList[i] = psImportData->apsSgTable[i]->sgl;
-                if (psScatterList[i] == NULL)
+                if ((puiDmaBufOffset[buf] + buf_size[buf]) > import->dma_buf[buf]->size ||
+                        (size_t)(puiDmaBufOffset[buf] + buf_size[buf]) < buf_size[buf])
                 {
+                        PVR_DPF((PVR_DBG_ERROR, "%s: Bad size and/or offset for FD %u", __func__, buf));
                         eError = PVRSRV_ERROR_INVALID_PARAMS;
-                        goto exitFailImport;
+                        goto error;
                 }
 
-                /* Although all heaps will provide an sg_table, the tables cannot
-                 * always be trusted because sg_lists are just pointers to "struct
-                 * page" values, and some memory e.g. carveout may not have valid
-                 * "struct page" values. In particular, on ARM, carveout is
-                 * generally reserved with memblock_remove(), which leaves the
-                 * "struct page" entries uninitialized when SPARSEMEM is enabled.
-                 * The effect of this is that page_to_pfn(pfn_to_page(pfn)) != pfn.
-                 *
-                 * There's more discussion on this mailing list thread:
-                 * http://lists.linaro.org/pipermail/linaro-mm-sig/2012-August/002440.html
-                 *
-                 * probably a contiguous allocator. If the phys() function is
-                 * implemented, we'll use it to check sg_table->sgl[0]. If we find
-                 * they don't agree, we'll assume phys() is more reliable and use
-                 * that.
-                 *
-                 * Some heaps out there will implement phys() even though they are
-                 * not for physically contiguous allocations (so the sg_table must
-                 * be used). Therefore use the sg_table if the phys() and first
-                 * sg_table entry match. This should be reliable because for most
-                 * contiguous allocators, the sg_table should be a single span
-                 * from 'start' to 'start+size'.
-                 *
-                 * Also, ion prints out an error message if the heap doesn't implement
-                 * ->phys(), which we want to avoid, so only use ->phys() if the
-                 * sg_table contains a single span and therefore could plausibly
-                 * be a contiguous allocator.
-                 */
-                #if 0
-                if(!sg_next(psScatterList[i]))
+                import->attachment[buf] = dma_buf_attach(import->dma_buf[buf], dev);
+                if (IS_ERR(import->attachment[buf]))
                 {
-                        ion_phys_addr_t sPhyAddr;
-                        size_t sLength;
-
-                        if(!ion_phys(psIonClient, psImportData->apsIonHandle[i],
-                                                 &sPhyAddr, &sLength))
-                        {
-                                BUG_ON(sLength & ~PAGE_MASK);
-
-                                if(sg_phys(psScatterList[i]) != sPhyAddr)
-                                {
-                                        psScatterList[i] = IMG_NULL;
-                                        ui32PageCount += sLength / PAGE_SIZE;
-                                }
-                        }
+                        PVR_DPF((PVR_DBG_ERROR, "%s: dma_buf_attach failed: %ld", __func__, PTR_ERR(import->attachment[buf])));
+                        eError = PVRSRV_ERROR_BAD_MAPPING;
+                        goto error;
                 }
-                #endif
-                for(psTemp = psScatterList[i]; psTemp; psTemp = sg_next(psTemp))
+
+                import->sg_table[buf] = dma_buf_map_attachment(import->attachment[buf],
+                                                                DMA_BIDIRECTIONAL);
+                if (IS_ERR(import->sg_table[buf]))
                 {
-                        IMG_UINT32 j;
-                        for (j = 0; j < psTemp->length; j += PAGE_SIZE)
-                        {
-                                ui32PageCount++;
-                        }
+                        PVR_DPF((PVR_DBG_ERROR, "%s: dma_buf_map_attachment failed: %ld", __func__, PTR_ERR(import->sg_table[buf])));
+                        eError = PVRSRV_ERROR_BAD_MAPPING;
+                        goto error;
                 }
         }
 
-        BUG_ON(ui32PageCount == 0);
-
-        psImportData->psSysPhysAddr = kmalloc(sizeof(IMG_SYS_PHYADDR) * ui32PageCount, GFP_KERNEL);
-        if (psImportData->psSysPhysAddr == NULL)
+        for (buf = 0, meminfo_offset = 0; buf < ui32NumFDs; buf++)
         {
-                goto exitFailImport;
+                size_t start_offset = PAGE_MASK & puiDmaBufOffset[buf];
+                size_t end_offset = PAGE_ALIGN(puiDmaBufOffset[buf] + buf_size[buf]);
+
+                puiMemInfoOffset[buf] = meminfo_offset + (puiDmaBufOffset[buf] - start_offset);
+
+                meminfo_offset += (end_offset - start_offset);
         }
+        npages = meminfo_offset >> PAGE_SHIFT;
+
+       /* The following allocation will be freed by the caller */
+        eError = OSAllocMem(PVRSRV_OS_PAGEABLE_HEAP,
+                        npages * sizeof(IMG_SYS_PHYADDR),
+                        (IMG_VOID **)&spaddr, IMG_NULL,
+                        "Array of Page Addresses");
+        if (eError != PVRSRV_OK)
+        {
+                PVR_DPF((PVR_DBG_ERROR, "%s: OSAllocMem failed: %s", __func__, PVRSRVGetErrorStringKM(eError)));
+                goto error;
+        }
 
-        for(i = 0, k = 0; i < ui32NumFDs; i++)
+        for (buf = 0; buf < ui32NumFDs; buf++)
         {
-                if(psScatterList[i])
+                size_t buf_offset = 0;
+                size_t remainder = buf_size[buf];
+                size_t start_offset = PAGE_MASK & puiDmaBufOffset[buf];
+                size_t end_offset = PAGE_ALIGN(puiDmaBufOffset[buf] + buf_size[buf]);
+
+                for_each_sg(import->sg_table[buf]->sgl, sg, import->sg_table[buf]->nents, i)
                 {
-                        for(psTemp = psScatterList[i]; psTemp; psTemp = sg_next(psTemp))
+                        if (buf_offset >= end_offset)
                         {
-                                IMG_UINT32 j;
-                                for (j = 0; j < psTemp->length; j += PAGE_SIZE)
-                                {
-                                        psImportData->psSysPhysAddr[k].uiAddr = sg_phys(psTemp) + j;
-                                        k++;
-                                }
+                                break;
                         }
-                }
-#if 0
-                else
-                {
-                        ion_phys_addr_t sPhyAddr;
-                        size_t sLength, j;
 
-                        ion_phys(psIonClient, psImportData->apsIonHandle[i],
-                                         &sPhyAddr, &sLength);
+                        if ((start_offset >= buf_offset) && (start_offset < buf_offset + sg_dma_len(sg)))
+                        {
+                                size_t sg_start;
+                                size_t sg_pos;
+                                size_t sg_remainder;
+
+                                sg_start = start_offset - buf_offset;
 
-                        for(j = 0; j < sLength; j += PAGE_SIZE)
+                                sg_remainder = MIN(sg_dma_len(sg) - sg_start, remainder);
+
+                                for (sg_pos = sg_start; sg_pos < sg_start + sg_remainder; sg_pos += PAGE_SIZE)
+                                {
+                                        IMG_CPU_PHYADDR cpaddr;
+
+                                        cpaddr.uiAddr = PAGE_MASK & (sg_phys(sg) + sg_pos);
+                                        BUG_ON(pti >= npages);
+
+                                        spaddr[pti++] = SysCpuPAddrToSysPAddr(cpaddr);
+                                }
+
+                                remainder -= sg_remainder;
+                                buf_offset += sg_dma_len(sg);
+                                start_offset = buf_offset;
+                        }
+                        else
                         {
-                                psImportData->psSysPhysAddr[k].uiAddr = sPhyAddr + j;
-                                k++;
+                                buf_offset += sg_dma_len(sg);
                         }
                 }
-#endif
+                BUG_ON(remainder);
         }
 
-        *pui32PageCount = ui32PageCount;
-        *ppsSysPhysAddr = psImportData->psSysPhysAddr;
-
 #if defined(PDUMP)
-        if(ui32NumFDs == 1)
+        if (ui32NumFDs == 1)
         {
-                /*FIXME */
-                /* Need to handle kernel mapping */
+                int err = dma_buf_begin_cpu_access(import->dma_buf[0], 0,
+                                                import->dma_buf[0]->size,
+                                                DMA_BIDIRECTIONAL);
+                if (err)
+                {
+                        PVR_DPF((PVR_DBG_MESSAGE, "%s: dma_buf_begin_cpu_access failed: %d", __func__, err));
+                }
+                else
+                {
+                        import->kvaddr = dma_buf_vmap(import->dma_buf[0]);
+                        *ppvKernAddr = import->kvaddr;
+                }
         }
         else
-#endif /* defined(PDUMP) */
         {
-                *ppvKernAddr0 = NULL;
+                *ppvKernAddr = NULL;
         }
+#else   /* defined(PDUMP) */
+        *ppvKernAddr = NULL;
+#endif  /* defined(PDUMP) */
 
-        *phPriv = psImportData;
-        *phUnique = (IMG_HANDLE)psImportData->psSysPhysAddr[0].uiAddr;
+        *pui32PageCount = pti;
+        *ppsSysPhysAddr = spaddr;
+        *phImport = (IMG_HANDLE)import;
+        *phUnique = (ui32NumFDs == 1) ? (IMG_HANDLE)import->dma_buf[0] : NULL;
 
         return PVRSRV_OK;
+error:
+        if (import)
+        {
+                DmaBufUnimportAndReleasePhysAddr((IMG_HANDLE)import);
+        }
 
-exitFailImport:
-        for(i = 0; psImportData->apsDmaBuf[i] != NULL; i++)
+        if (spaddr)
         {
-                dma_buf_put(psImportData->apsDmaBuf[i]);
+                OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP,
+                                npages * sizeof(IMG_SYS_PHYADDR),
+                                (IMG_VOID **)&spaddr, IMG_NULL);
         }
-        kfree(psImportData);
-exitFailKMallocImportData:
+
         return eError;
 }
 
-IMG_VOID DmabufUnimportBufferAndReleasePhysAddr(IMG_HANDLE hPriv)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,17,0))
+IMG_HANDLE DmaBufGetNativeSyncHandle(IMG_HANDLE hImport)
 {
-        DMABUF_IMPORT_DATA *psImportData = hPriv;
-        IMG_UINT32 i;
+        struct dmabuf_import *import;
+        struct dmabuf_resvinfo *info;
 
-#if defined(PDUMP)
-        if (psImportData->pvKernAddr0)
-        {
-                //FIXME
-        }
-#endif /* defined(PDUMP) */
-        for(i = 0; i < psImportData->ui32NumHandles; i++)
+        import = (struct dmabuf_import *)hImport;
+
+        info = kzalloc(sizeof(*info), GFP_KERNEL);
+
+        if (info)
         {
-                dma_buf_unmap_attachment(psImportData->apsDmaBufAttachment[i],
-                                                psImportData->apsSgTable[i],
-                                                DMA_BIDIRECTIONAL);
-                dma_buf_detach(psImportData->apsDmaBuf[i],
-                                        psImportData->apsDmaBufAttachment[i]);
-                dma_buf_put(psImportData->apsDmaBuf[i]);
+                unsigned i;
+
+                info->num_resvs = import->num_fds;
+
+                for(i = 0; i < info->num_resvs; i++)
+                {
+                        info->resv[i] = import->dma_buf[i]->resv;
+                }
         }
 
-        kfree(psImportData->psSysPhysAddr);
-        kfree(psImportData);
+        return (IMG_HANDLE)info;
 }
+
+void DmaBufFreeNativeSyncHandle(IMG_HANDLE hSync)
+{
+        struct dmabuf_resvinfo *info;
+
+        info = (struct dmabuf_resvinfo *)hSync;
+
+        kfree(info);
+}
+
+void *DmaBufGetReservationObject(IMG_HANDLE hSync, unsigned uIndex)
+{
+        struct dmabuf_resvinfo *info;
+
+        info = (struct dmabuf_resvinfo *)hSync;
+
+        return (uIndex < info->num_resvs) ? info->resv[uIndex] : NULL;
+}
+#else   /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3,17,0)) */
+IMG_HANDLE DmaBufGetNativeSyncHandle(IMG_HANDLE hImport)
+{
+        (void) hImport;
+
+        return IMG_NULL;
+}
+
+void DmaBufFreeNativeSyncHandle(IMG_HANDLE hSync)
+{
+        (void) hSync;
+}
+
+void *DmaBufGetReservationObject(IMG_HANDLE hSync, unsigned uIndex)
+{
+        (void) hSync;
+        (void) uIndex;
+
+        return NULL;
+}
+#endif  /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3,17,0)) */
+
+#endif /* defined(SUPPORT_DMABUF) */
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/dmabuf.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/dmabuf.h
index 4ea3ff1..5447655 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/dmabuf.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/dmabuf.h
@@ -1,5 +1,5 @@
 /*************************************************************************/ /*!
-@Title          Ion driver inter-operability code.
+@Title          DmaBuf driver inter-operability code.
 @Copyright      Copyright (c) Imagination Technologies Ltd. All Rights Reserved
 @License        Dual MIT/GPLv2
 
@@ -42,17 +42,32 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #ifndef __IMG_LINUX_DMABUF_H__
 #define __IMG_LINUX_DMABUF_H__
 
+#if defined(SUPPORT_DMABUF)
+
 #include "img_types.h"
 #include "servicesext.h"
 
-PVRSRV_ERROR DmabufImportBufferAndAcquirePhysAddr(IMG_UINT32 ui32NumFDs,
-                                                                                           IMG_INT32  *pi32BufferFDs,
+PVRSRV_ERROR DmaBufInit(IMG_VOID);
+
+IMG_VOID DmaBufDeinit(IMG_VOID);
+
+PVRSRV_ERROR DmaBufImportAndAcquirePhysAddr(const IMG_UINT32 ui32NumFDs,
+                                                                                           const IMG_INT32 *pi32DmaBufFD,
+                                                                                           const IMG_SIZE_T *puiDmaBufOffset,
+                                                                                           const IMG_SIZE_T *puiSize,
                                                                                            IMG_UINT32 *pui32PageCount,
                                                                                            IMG_SYS_PHYADDR **ppsSysPhysAddr,
-                                                                                           IMG_PVOID *ppvKernAddr0,
-                                                                                           IMG_HANDLE *phPriv,
+                                                                                           IMG_SIZE_T *puiMemInfoOffset,
+                                                                                           IMG_PVOID *ppvKernAddr,
+                                                                                           IMG_HANDLE *phImport,
                                                                                            IMG_HANDLE *phUnique);
 
-IMG_VOID DmabufUnimportBufferAndReleasePhysAddr(IMG_HANDLE hPriv);
+IMG_VOID DmaBufUnimportAndReleasePhysAddr(IMG_HANDLE hImport);
+
+IMG_HANDLE DmaBufGetNativeSyncHandle(IMG_HANDLE hImport);
+void DmaBufFreeNativeSyncHandle(IMG_HANDLE hSync);
+
+void *DmaBufGetReservationObject(IMG_HANDLE hSync, unsigned uIndex);
+#endif /* defined(SUPPORT_DMABUF) */
 
 #endif /* __IMG_LINUX_DMABUF_H__ */
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/ion.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/ion.c
index 2f08f27..8d3ddfa 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/ion.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/ion.c
@@ -140,69 +140,141 @@ IMG_VOID IonDeinit(IMG_VOID)
 
 #else /* defined(CONFIG_ION_INCDHAD1) */
 
-#if defined(CONFIG_ION_DUMMY)
+/* "Reference" ion implementation */
 
-/* Real ion with sharing (dummy) */
+#include SUPPORT_ION_PRIV_HEADER
+#include <linux/version.h>
+#include "ion_sys_private.h"
+#include "lma_heap_ion.h"
 
-extern struct ion_device *idev;
+static struct ion_heap **gapsIonHeaps;
 struct ion_device *gpsIonDev;
 
-PVRSRV_ERROR IonInit(IMG_VOID)
+#if defined(LMA)
+struct ion_platform_data gsTCIonConfig = {
+        .nr = 1,
+        .heaps =
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,4,39))
+#else
+                (struct ion_platform_heap [])
+#endif
+                {
+                        {
+                                /* This heap must be first. The base address and size are filled
+                                   in from data passed down by sysconfig.c. */
+                                .type = ION_HEAP_TYPE_CUSTOM,
+                                .name = "tc_local_mem",
+                                .id = ION_HEAP_TYPE_CUSTOM,
+                                .base = 0,                      /* filled in later */
+                                .size = 0,                      /* filled in later */
+                        }
+                }
+};
+
+PVRSRV_ERROR IonInit(void *pvPrivateData)
 {
-        gpsIonDev = idev;
-        return PVRSRV_OK;
+        PVRSRV_ERROR eError = PVRSRV_OK;
+        int i;
+
+        ION_TC_PRIVATE_DATA sPrivateData = *(ION_TC_PRIVATE_DATA *)pvPrivateData;
+
+        /* Fill in the heap base and size according to the private data. */
+        gsTCIonConfig.heaps[0].base = sPrivateData.uiHeapBase;
+        gsTCIonConfig.heaps[0].size = sPrivateData.uiHeapSize;
+
+        gapsIonHeaps = kzalloc(sizeof(struct ion_heap *) * gsTCIonConfig.nr,
+                                                   GFP_KERNEL);
+        gpsIonDev = ion_device_create(NULL);
+        if (IS_ERR_OR_NULL(gpsIonDev))
+        {
+                kfree(gapsIonHeaps);
+                return PVRSRV_ERROR_OUT_OF_MEMORY;
+        }
+
+        for (i = 0; i < gsTCIonConfig.nr; i++)
+        {
+                struct ion_platform_heap *psPlatHeapData = &gsTCIonConfig.heaps[i];
+
+                switch (psPlatHeapData->type)
+                {
+                        case ION_HEAP_TYPE_CUSTOM:
+                                /* Custom heap: this is used to mean a TC-specific heap,
+                                   which allocates from local memory. */
+                                gapsIonHeaps[i] = lma_heap_create(psPlatHeapData);
+                                break;
+                        default:
+                                /* For any other type of heap, hand this to ion to create as
+                                   appropriate. We don't necessarily need any of these -
+                                   this just gives us the flexibility to have another kind
+                                   of heap if necessary. */
+                                gapsIonHeaps[i] = ion_heap_create(psPlatHeapData);
+                                break;
+                }
+
+                if (IS_ERR_OR_NULL(gapsIonHeaps[i]))
+                {
+                        printk("%s: Failed to create ion heap '%s'", __func__, psPlatHeapData->name);
+                        IonDeinit();
+                        return PVRSRV_ERROR_OUT_OF_MEMORY;
+                }
+
+                ion_device_add_heap(gpsIonDev, gapsIonHeaps[i]);
+        }
+
+        return eError;
 }
 
-
-IMG_VOID IonDeinit(IMG_VOID)
+void IonDeinit(void)
 {
-        gpsIonDev = IMG_NULL;
+        int i;
+        for (i = 0; i < gsTCIonConfig.nr; i++)
+                if (gapsIonHeaps[i])
+                        ion_heap_destroy(gapsIonHeaps[i]);
+        kfree(gapsIonHeaps);
+        ion_device_destroy(gpsIonDev);
 }
 
-#else /* defined(CONFIG_ION_DUMMY) */
-
-
-/* "Reference" ion implementation */
-
-#include SUPPORT_ION_PRIV_HEADER
-#include <linux/version.h>
-
-static struct ion_heap **gapsIonHeaps;
-struct ion_device *gpsIonDev;
-
-#ifndef ION_CARVEOUT_MEM_BASE
-#define ION_CARVEOUT_MEM_BASE 0
-#endif
+#else
 
-#ifndef ION_CARVEOUT_MEM_SIZE
-#define ION_CARVEOUT_MEM_SIZE 0
+#if defined(ION_CARVEOUT_MEM_BASE) && defined(ION_CARVEOUT_MEM_SIZE)
+/* Only define the carveout heap on boards with BASE and SIZE defined,
+ * otherwise crashes may be seen when empty cache flushes are issued
+ * (seen on the MIPS architecture).
+ */
+#define ION_HAS_CARVEOUT_HEAP
 #endif
 
 static struct ion_platform_data gsGenericConfig =
 {
+#if defined(ION_HAS_CARVEOUT_HEAP)
         .nr = 3,
+#else
+        .nr = 2,
+#endif
         .heaps =
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,4,39))
         (struct ion_platform_heap [])
 #endif
         {
                 {
-                        .type = ION_HEAP_TYPE_SYSTEM_CONTIG,
-                        .name = "system_contig",
-                        .id   = ION_HEAP_TYPE_SYSTEM_CONTIG,
-                },
-                {
                         .type = ION_HEAP_TYPE_SYSTEM,
                         .name = "system",
                         .id   = ION_HEAP_TYPE_SYSTEM,
                 },
                 {
+                        .type = ION_HEAP_TYPE_DMA,
+                        .name = "dma",
+                        .id   = ION_HEAP_TYPE_DMA,
+                },
+#if defined(ION_HAS_CARVEOUT_HEAP)
+                {
                         .type = ION_HEAP_TYPE_CARVEOUT,
                         .name = "carveout",
                         .id   = ION_HEAP_TYPE_CARVEOUT,
                         .base = ION_CARVEOUT_MEM_BASE,
                         .size = ION_CARVEOUT_MEM_SIZE,
                 },
+#endif /* defined(ION_HAS_CARVEOUT_HEAP) */
         }
 };
 
@@ -262,7 +334,8 @@ IMG_VOID IonDeinit(IMG_VOID)
         kfree(gapsIonHeaps);
         ion_device_destroy(gpsIonDev);
 }
-#endif /* defined(CONFIG_ION_DUMMY) */
+
+#endif /* defined(LMA) */
 
 #endif /* defined(CONFIG_ION_INCDHAD1) */
 
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/ion.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/ion.h
index b71ecd7..145ae12 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/ion.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/ion.h
@@ -49,7 +49,11 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include "img_types.h"
 #include "servicesext.h"
 
+#if defined(LMA)
+PVRSRV_ERROR IonInit(void *pvPrivateData);
+#else
 PVRSRV_ERROR IonInit(IMG_VOID);
+#endif
 
 IMG_VOID IonDeinit(IMG_VOID);
 
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/linkage.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/linkage.h
index 55cd4f0..99b1ea4 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/linkage.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/linkage.h
@@ -66,6 +66,8 @@ void ProcSeqShowPowerLevel(struct seq_file *sfile,void* el);
 
 #endif  /* DEBUG */
 
+struct device *PVRLDMGetDevice(void);
+
 #endif /* __LINKAGE_H__ */
 /*****************************************************************************
  End of file (linkage.h)
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/lma_heap_ion.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/lma_heap_ion.h
new file mode 100644
index 0000000..c76effb
--- /dev/null
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/lma_heap_ion.h
@@ -0,0 +1,45 @@
+/*************************************************************************/ /*!
+@File           lma_heap_ion.h
+@Title          Ion heap for local memory
+@Copyright      Copyright (c) Imagination Technologies Ltd. All Rights Reserved
+@License        Dual MIT/GPLv2
+
+The contents of this file are subject to the MIT license as set out below.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+Alternatively, the contents of this file may be used under the terms of
+the GNU General Public License Version 2 ("GPL") in which case the provisions
+of GPL are applicable instead of those above.
+
+If you wish to allow use of your version of this file only under the terms of
+GPL, and not to allow others to use your version of this file under the terms
+of the MIT license, indicate your decision by deleting the provisions above
+and replace them with the notice and other provisions required by GPL as set
+out in the file called "GPL-COPYING" included in this distribution. If you do
+not delete the provisions above, a recipient may use your version of this file
+under the terms of either the MIT license or GPL.
+
+This License is also included in this distribution in the file called
+"MIT-COPYING".
+
+EXCEPT AS OTHERWISE STATED IN A NEGOTIATED AGREEMENT: (A) THE SOFTWARE IS
+PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
+BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE AND NONINFRINGEMENT; AND (B) IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/ /**************************************************************************/
+
+#include SUPPORT_ION_HEADER
+
+struct ion_heap *lma_heap_create(struct ion_platform_heap *data);
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mm.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mm.c
index c5a9b9b..8a1b00b 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mm.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mm.c
@@ -91,7 +91,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 /* Decide whether or not DevMem allocs need __GFP_DMA32 */
 #ifndef SGX_FEATURE_36BIT_MMU
-#       ifdef CONFIG_ZONE_DMA32
+#       ifdef CONFIG_ZONE_DMA
 #               if defined CONFIG_X86_PAE || defined CONFIG_ARM_LPAE || defined CONFIG_64BIT
 #                       define PVR_USE_DMA32_FOR_DEVMEM_ALLOCS
 #               endif
@@ -117,6 +117,7 @@ typedef enum {
 #if defined(PVR_LINUX_MEM_AREA_USE_VMAP)
     DEBUG_MEM_ALLOC_TYPE_VMAP,
 #endif
+    DEBUG_MEM_ALLOC_TYPE_SWAP,
     DEBUG_MEM_ALLOC_TYPE_COUNT
 } DEBUG_MEM_ALLOC_TYPE;
 
@@ -144,6 +145,7 @@ static IMPLEMENT_LIST_REMOVE(DEBUG_MEM_ALLOC_REC)
 
 
 static DEBUG_MEM_ALLOC_REC *g_MemoryRecords;
+static DEBUG_MEM_ALLOC_REC *g_SwapMemoryRecords;
 
 static IMG_UINT32 g_WaterMarkData[DEBUG_MEM_ALLOC_TYPE_COUNT];
 static IMG_UINT32 g_HighWaterMarkData[DEBUG_MEM_ALLOC_TYPE_COUNT];
@@ -155,7 +157,7 @@ static IMG_UINT32 g_SysRAMHighWaterMark;	/* *DOES* include page pool */
 static inline IMG_UINT32
 SysRAMTrueWaterMark(void)
 {
-        return g_SysRAMWaterMark + PAGES_TO_BYTES(atomic_read(&g_sPagePoolEntryCount));
+        return g_SysRAMWaterMark + PAGES_TO_BYTES(atomic_read(&g_sPagePoolEntryCount)) + g_WaterMarkData[DEBUG_MEM_ALLOC_TYPE_SWAP];
 }
 
 /* ioremap + io */
@@ -219,6 +221,7 @@ static void* ProcSeqOff2ElementMemArea(struct seq_file *sfile, loff_t off);
 
 #if defined(DEBUG_LINUX_MEM_AREAS) || defined(DEBUG_LINUX_MEMORY_ALLOCATIONS)
 static PVRSRV_LINUX_MUTEX g_sDebugMutex;
+static PVRSRV_LINUX_MUTEX g_sSwapDebugMutex;
 #endif
 
 #if (defined(DEBUG_LINUX_MEM_AREAS) || defined(DEBUG_LINUX_MEMORY_ALLOCATIONS))
@@ -266,7 +269,7 @@ CanFreeToPool(LinuxMemArea *psLinuxMemArea)
 }
 
 IMG_VOID *
-_KMallocWrapper(IMG_SIZE_T uiByteSize, gfp_t uFlags, IMG_CHAR *pszFileName, IMG_UINT32 ui32Line)
+_KMallocWrapper(IMG_SIZE_T uiByteSize, gfp_t uFlags, IMG_CHAR *pszFileName, IMG_UINT32 ui32Line, IMG_BOOL bSwapAlloc)
 {
     IMG_VOID *pvRet;
     pvRet = kmalloc(uiByteSize, uFlags);
@@ -276,7 +279,7 @@ _KMallocWrapper(IMG_SIZE_T uiByteSize, gfp_t uFlags, IMG_CHAR *pszFileName, IMG_
                 IMG_CPU_PHYADDR sCpuPAddr;
                 sCpuPAddr.uiAddr = 0;
 
-        DebugMemAllocRecordAdd(DEBUG_MEM_ALLOC_TYPE_KMALLOC,
+        DebugMemAllocRecordAdd(bSwapAlloc ? DEBUG_MEM_ALLOC_TYPE_SWAP : DEBUG_MEM_ALLOC_TYPE_KMALLOC,
                                (IMG_UINTPTR_T)pvRet,
                                pvRet,
                                sCpuPAddr,
@@ -289,23 +292,24 @@ _KMallocWrapper(IMG_SIZE_T uiByteSize, gfp_t uFlags, IMG_CHAR *pszFileName, IMG_
 #else
     PVR_UNREFERENCED_PARAMETER(pszFileName);
     PVR_UNREFERENCED_PARAMETER(ui32Line);
+    PVR_UNREFERENCED_PARAMETER(bSwapAlloc);
 #endif
     return pvRet;
 }
 
-
-IMG_VOID
-_KFreeWrapper(IMG_VOID *pvCpuVAddr, IMG_CHAR *pszFileName, IMG_UINT32 ui32Line)
+void
+_KFreeWrapper(void *pvCpuVAddr, IMG_CHAR *pszFileName, IMG_UINT32 ui32Line, IMG_BOOL bSwapAlloc)
 {
 #if defined(DEBUG_LINUX_MEMORY_ALLOCATIONS)
     DebugMemAllocRecordRemove(
-                        DEBUG_MEM_ALLOC_TYPE_KMALLOC, 
+                        bSwapAlloc ? DEBUG_MEM_ALLOC_TYPE_SWAP : DEBUG_MEM_ALLOC_TYPE_KMALLOC, 
                         (IMG_UINTPTR_T)pvCpuVAddr, 
                         pszFileName,  
                         ui32Line);
 #else
     PVR_UNREFERENCED_PARAMETER(pszFileName);
     PVR_UNREFERENCED_PARAMETER(ui32Line);
+    PVR_UNREFERENCED_PARAMETER(bSwapAlloc);
 #endif
     kfree(pvCpuVAddr);
 }
@@ -324,8 +328,6 @@ DebugMemAllocRecordAdd(DEBUG_MEM_ALLOC_TYPE eAllocType,
 {
     DEBUG_MEM_ALLOC_REC *psRecord;
 
-    LinuxLockMutexNested(&g_sDebugMutex, PVRSRV_LOCK_CLASS_MM_DEBUG);
-
     psRecord = kmalloc(sizeof(DEBUG_MEM_ALLOC_REC), GFP_KERNEL);
 
     psRecord->eAllocType = eAllocType;
@@ -337,8 +339,25 @@ DebugMemAllocRecordAdd(DEBUG_MEM_ALLOC_TYPE eAllocType,
     psRecord->uiBytes = uiBytes;
     psRecord->pszFileName = pszFileName;
     psRecord->ui32Line = ui32Line;
+  
+    if (eAllocType == DEBUG_MEM_ALLOC_TYPE_SWAP)
+    {
+        LinuxLockMutexNested(&g_sSwapDebugMutex, PVRSRV_LOCK_CLASS_MM_DEBUG);
+
+        List_DEBUG_MEM_ALLOC_REC_Insert(&g_SwapMemoryRecords, psRecord);
+
+        g_WaterMarkData[eAllocType] += uiBytes;
+        if (g_WaterMarkData[eAllocType] > g_HighWaterMarkData[eAllocType])
+        {   
+            g_HighWaterMarkData[eAllocType] = g_WaterMarkData[eAllocType];
+        }
+
+        LinuxUnLockMutex(&g_sSwapDebugMutex);
+        return;
+    }
     
-        List_DEBUG_MEM_ALLOC_REC_Insert(&g_MemoryRecords, psRecord);
+    LinuxLockMutexNested(&g_sDebugMutex, PVRSRV_LOCK_CLASS_MM_DEBUG);
+    List_DEBUG_MEM_ALLOC_REC_Insert(&g_MemoryRecords, psRecord);
     
     g_WaterMarkData[eAllocType] += uiBytes;
     if (g_WaterMarkData[eAllocType] > g_HighWaterMarkData[eAllocType])
@@ -386,7 +405,6 @@ static IMG_BOOL DebugMemAllocRecordRemove_AnyVaCb(DEBUG_MEM_ALLOC_REC *psCurrent
         if (psCurrentRecord->eAllocType == eAllocType
                 && psCurrentRecord->uiKey == uiKey)
         {
-                eAllocType = psCurrentRecord->eAllocType;
                 g_WaterMarkData[eAllocType] -= psCurrentRecord->uiBytes;
                 
                 if (eAllocType == DEBUG_MEM_ALLOC_TYPE_KMALLOC
@@ -419,10 +437,10 @@ DebugMemAllocRecordRemove(DEBUG_MEM_ALLOC_TYPE eAllocType, IMG_UINTPTR_T uiKey,
 {
 /*    DEBUG_MEM_ALLOC_REC **ppsCurrentRecord;*/
 
-    LinuxLockMutexNested(&g_sDebugMutex, PVRSRV_LOCK_CLASS_MM_DEBUG);
+    LinuxLockMutexNested(eAllocType ==  DEBUG_MEM_ALLOC_TYPE_SWAP ? &g_sSwapDebugMutex : &g_sDebugMutex, PVRSRV_LOCK_CLASS_MM_DEBUG);
 
     /* Locate the corresponding allocation entry */
-        if (!List_DEBUG_MEM_ALLOC_REC_IMG_BOOL_Any_va(g_MemoryRecords,
+        if (!List_DEBUG_MEM_ALLOC_REC_IMG_BOOL_Any_va(eAllocType ==  DEBUG_MEM_ALLOC_TYPE_SWAP ? g_SwapMemoryRecords : g_MemoryRecords,
                                                                                                 DebugMemAllocRecordRemove_AnyVaCb,
                                                                                                 eAllocType,
                                                                                                 uiKey))
@@ -432,7 +450,7 @@ DebugMemAllocRecordRemove(DEBUG_MEM_ALLOC_TYPE eAllocType, IMG_UINTPTR_T uiKey,
                 pszFileName, ui32Line));
         }
 
-    LinuxUnLockMutex(&g_sDebugMutex);
+    LinuxUnLockMutex(eAllocType ==  DEBUG_MEM_ALLOC_TYPE_SWAP ? &g_sSwapDebugMutex : &g_sDebugMutex);
 }
 
 
@@ -450,6 +468,7 @@ DebugMemAllocRecordTypeToString(DEBUG_MEM_ALLOC_TYPE eAllocType)
 #if defined(PVR_LINUX_MEM_AREA_USE_VMAP)
                 "VMAP",
 #endif
+        "SWAPALLOC",
     };
     return apszDebugMemoryRecordTypes[eAllocType];
 }
@@ -877,53 +896,59 @@ FreePagePool(IMG_VOID)
 static struct shrinker g_sShrinker;
 #endif
 
-static int
-ShrinkPagePool(struct shrinker *psShrinker, struct shrink_control *psShrinkControl)
+static unsigned long
+CountObjectsInPagePool(struct shrinker *psShrinker, struct shrink_control *psShrinkControl)
+{
+        PVR_ASSERT(psShrinker == &g_sShrinker);
+        (void)psShrinker;
+        (void)psShrinkControl;
+
+        return atomic_read(&g_sPagePoolEntryCount);
+}
+
+static unsigned long
+ScanObjectsInPagePool(struct shrinker *psShrinker, struct shrink_control *psShrinkControl)
 {
         unsigned long uNumToScan = psShrinkControl->nr_to_scan;
+        LinuxPagePoolEntry *psPagePoolEntry, *psTempPoolEntry;
 
         PVR_ASSERT(psShrinker == &g_sShrinker);
         (void)psShrinker;
 
-        if (uNumToScan != 0)
+        PVR_TRACE(("%s: Number to scan: %ld", __FUNCTION__, uNumToScan));
+        PVR_TRACE(("%s: Pages in pool before scan: %d", __FUNCTION__, atomic_read(&g_sPagePoolEntryCount)));
+
+        if (!PagePoolTrylock())
         {
-                LinuxPagePoolEntry *psPagePoolEntry, *psTempPoolEntry;
+                PVR_TRACE(("%s: Couldn't get page pool lock", __FUNCTION__));
+                return -1;
+        }
 
-                PVR_TRACE(("%s: Number to scan: %ld", __FUNCTION__, uNumToScan));
-                PVR_TRACE(("%s: Pages in pool before scan: %d", __FUNCTION__, atomic_read(&g_sPagePoolEntryCount)));
+        list_for_each_entry_safe(psPagePoolEntry, psTempPoolEntry, &g_sPagePoolList, sPagePoolItem)
+        {
+                RemoveEntryFromPool(psPagePoolEntry);
 
-                if (!PagePoolTrylock())
-                {
-                        PVR_TRACE(("%s: Couldn't get page pool lock", __FUNCTION__));
-                        return -1;
-                }
+                FreePageToLinux(psPagePoolEntry->psPage);
+                LinuxPagePoolEntryFree(psPagePoolEntry);
 
-                list_for_each_entry_safe(psPagePoolEntry, psTempPoolEntry, &g_sPagePoolList, sPagePoolItem)
+                if (--uNumToScan == 0)
                 {
-                        RemoveEntryFromPool(psPagePoolEntry);
-
-                        FreePageToLinux(psPagePoolEntry->psPage);
-                        LinuxPagePoolEntryFree(psPagePoolEntry);
-
-                        if (--uNumToScan == 0)
-                        {
-                                break;
-                        }
+                        break;
                 }
+        }
 
-                if (list_empty(&g_sPagePoolList))
-                {
-                        PVR_ASSERT(atomic_read(&g_sPagePoolEntryCount) == 0);
-                }
+        if (list_empty(&g_sPagePoolList))
+        {
+                PVR_ASSERT(atomic_read(&g_sPagePoolEntryCount) == 0);
+        }
 
-                PagePoolUnlock();
+        PagePoolUnlock();
 
-                PVR_TRACE(("%s: Pages in pool after scan: %d", __FUNCTION__, atomic_read(&g_sPagePoolEntryCount)));
-        }
+        PVR_TRACE(("%s: Pages in pool after scan: %d", __FUNCTION__, atomic_read(&g_sPagePoolEntryCount)));
 
         return atomic_read(&g_sPagePoolEntryCount);
 }
-#endif
+#endif /* defined(PVR_LINUX_MEM_AREA_POOL_ALLOW_SHRINK) */
 
 static IMG_BOOL
 AllocPages(IMG_UINT32 ui32AreaFlags, struct page ***pppsPageList, IMG_HANDLE *phBlockPageList, IMG_UINT32 ui32NumPages, IMG_BOOL *pbFromPagePool)
@@ -2207,10 +2232,10 @@ static void ProcSeqShowMemoryRecords(struct seq_file *sfile,void* el)
 
         seq_printf(sfile, "%-60s: %d bytes\n",
                            "Current Water Mark of bytes allocated via kmalloc",
-                           g_WaterMarkData[DEBUG_MEM_ALLOC_TYPE_KMALLOC]);
+                           g_WaterMarkData[DEBUG_MEM_ALLOC_TYPE_KMALLOC] + g_WaterMarkData[DEBUG_MEM_ALLOC_TYPE_SWAP]);
         seq_printf(sfile, "%-60s: %d bytes\n",
                            "Highest Water Mark of bytes allocated via kmalloc",
-                           g_HighWaterMarkData[DEBUG_MEM_ALLOC_TYPE_KMALLOC]);
+                           g_HighWaterMarkData[DEBUG_MEM_ALLOC_TYPE_KMALLOC] + g_HighWaterMarkData[DEBUG_MEM_ALLOC_TYPE_SWAP]);
         seq_printf(sfile, "%-60s: %d bytes\n",
                            "Current Water Mark of bytes allocated via vmalloc",
                            g_WaterMarkData[DEBUG_MEM_ALLOC_TYPE_VMALLOC]);
@@ -2289,10 +2314,10 @@ static void ProcSeqShowMemoryRecords(struct seq_file *sfile,void* el)
                 seq_printf(sfile, "<meminfo>\n<meminfo_header>\n");
                 seq_printf(sfile,
                            "<watermark key=\"mr0\" description=\"kmalloc_current\" bytes=\"%d\"/>\n",
-                           g_WaterMarkData[DEBUG_MEM_ALLOC_TYPE_KMALLOC]);
+                           g_WaterMarkData[DEBUG_MEM_ALLOC_TYPE_KMALLOC] +  g_WaterMarkData[DEBUG_MEM_ALLOC_TYPE_SWAP]);
                 seq_printf(sfile,
                            "<watermark key=\"mr1\" description=\"kmalloc_high\" bytes=\"%d\"/>\n",
-                           g_HighWaterMarkData[DEBUG_MEM_ALLOC_TYPE_KMALLOC]);
+                           g_HighWaterMarkData[DEBUG_MEM_ALLOC_TYPE_KMALLOC] +  g_HighWaterMarkData[DEBUG_MEM_ALLOC_TYPE_SWAP]);
                 seq_printf(sfile,
                            "<watermark key=\"mr2\" description=\"vmalloc_current\" bytes=\"%d\"/>\n",
                            g_WaterMarkData[DEBUG_MEM_ALLOC_TYPE_VMALLOC]);
@@ -2521,6 +2546,9 @@ static IMG_VOID LinuxMMCleanup_MemRecords_ForEachVa(DEBUG_MEM_ALLOC_REC *psCurre
                         psCurrentRecord->ui32Line));
         switch (psCurrentRecord->eAllocType)
         {
+                case DEBUG_MEM_ALLOC_TYPE_SWAP:
+                        _KFreeWrapper(psCurrentRecord->pvCpuVAddr, __FILE__, __LINE__, IMG_TRUE);
+                        break;
                 case DEBUG_MEM_ALLOC_TYPE_KMALLOC:
                         KFreeWrapper(psCurrentRecord->pvCpuVAddr);
                         break;
@@ -2553,11 +2581,34 @@ static IMG_VOID LinuxMMCleanup_MemRecords_ForEachVa(DEBUG_MEM_ALLOC_REC *psCurre
 
 
 #if defined(PVR_LINUX_MEM_AREA_POOL_ALLOW_SHRINK)
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,12,0))
+static int
+ShrinkPagePool(struct shrinker *psShrinker, struct shrink_control *psShrinkControl)
+{
+        if(psShrinkControl->nr_to_scan != 0)
+        {
+                return ScanObjectsInPagePool(psShrinker, psShrinkControl);
+        }
+        else
+        {
+                /* No pages are being reclaimed so just return the page count. */
+                return CountObjectsInPagePool(psShrinker, psShrinkControl);
+        }
+}
+
 static struct shrinker g_sShrinker =
 {
-        .shrink = ShrinkPagePool,
-        .seeks = DEFAULT_SEEKS
+        .shrink = ShrinkPagePool,
+        .seeks = DEFAULT_SEEKS
 };
+#else
+static struct shrinker g_sShrinker = 
+{
+        .count_objects = CountObjectsInPagePool,
+        .scan_objects = ScanObjectsInPagePool,
+        .seeks = DEFAULT_SEEKS 
+};
+#endif
 
 static IMG_BOOL g_bShrinkerRegistered;
 #endif
@@ -2603,6 +2654,7 @@ LinuxMMCleanup(IMG_VOID)
          * report an error, and simply brute force free anything we find.
          */
                 List_DEBUG_MEM_ALLOC_REC_ForEach(g_MemoryRecords, LinuxMMCleanup_MemRecords_ForEachVa);
+                List_DEBUG_MEM_ALLOC_REC_ForEach(g_SwapMemoryRecords, LinuxMMCleanup_MemRecords_ForEachVa);
 
                 if (g_SeqFileMemoryRecords)
                 {
@@ -2627,6 +2679,7 @@ LinuxMMInit(IMG_VOID)
 {
 #if defined(DEBUG_LINUX_MEM_AREAS) || defined(DEBUG_LINUX_MEMORY_ALLOCATIONS)
         LinuxInitMutex(&g_sDebugMutex);
+        LinuxInitMutex(&g_sSwapDebugMutex);
 #endif
 
 #if defined(DEBUG_LINUX_MEM_AREAS)
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mm.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mm.h
index 933420d..4e64dd6 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mm.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mm.h
@@ -236,12 +236,11 @@ IMG_VOID LinuxMMCleanup(IMG_VOID);
  * @return 
  ******************************************************************************/
 #if defined(DEBUG_LINUX_MEMORY_ALLOCATIONS)
-#define KMallocWrapper(uByteSize, uFlags) _KMallocWrapper(uByteSize, uFlags, __FILE__, __LINE__)
+#define KMallocWrapper(uByteSize, uFlags) _KMallocWrapper(uByteSize, uFlags, __FILE__, __LINE__, IMG_FALSE)
 #else
-#define KMallocWrapper(uByteSize, uFlags) _KMallocWrapper(uByteSize, uFlags, NULL, 0)
+#define KMallocWrapper(uByteSize, uFlags) _KMallocWrapper(uByteSize, uFlags, NULL, 0, IMG_FALSE)
 #endif
-IMG_VOID *_KMallocWrapper(IMG_SIZE_T uByteSize, gfp_t uFlags, IMG_CHAR *szFileName, IMG_UINT32 ui32Line);
-
+void *_KMallocWrapper(IMG_SIZE_T uByteSize, gfp_t uFlags, IMG_CHAR *szFileName, IMG_UINT32 ui32Line, IMG_BOOL bSwapAlloc);
 
 /*!
  *******************************************************************************
@@ -252,12 +251,11 @@ IMG_VOID *_KMallocWrapper(IMG_SIZE_T uByteSize, gfp_t uFlags, IMG_CHAR *szFileNa
  * @return 
  ******************************************************************************/
 #if defined(DEBUG_LINUX_MEMORY_ALLOCATIONS)
-#define KFreeWrapper(pvCpuVAddr) _KFreeWrapper(pvCpuVAddr, __FILE__, __LINE__)
+#define KFreeWrapper(pvCpuVAddr) _KFreeWrapper(pvCpuVAddr, __FILE__, __LINE__, IMG_FALSE)
 #else
-#define KFreeWrapper(pvCpuVAddr) _KFreeWrapper(pvCpuVAddr, NULL, 0)
+#define KFreeWrapper(pvCpuVAddr) _KFreeWrapper(pvCpuVAddr, NULL, 0, IMG_FALSE)
 #endif
-IMG_VOID _KFreeWrapper(IMG_VOID *pvCpuVAddr, IMG_CHAR *pszFileName, IMG_UINT32 ui32Line);
-
+void _KFreeWrapper(void *pvCpuVAddr, IMG_CHAR *pszFileName, IMG_UINT32 ui32Line, IMG_BOOL bSwapAlloc);
 
 /*!
  *******************************************************************************
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mmap.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mmap.c
index a0b8211..e7fb667 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mmap.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mmap.c
@@ -67,6 +67,9 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #endif
 #if defined(SUPPORT_DRI_DRM)
 #include <drm/drmP.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
+#include <drm/drm_legacy.h>
+#endif
 #endif
 
 #ifdef CONFIG_ARCH_OMAP5
@@ -95,6 +98,13 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #error "The mmap code requires PVR_SECURE_HANDLES"
 #endif
 
+#if defined(SUPPORT_DRI_DRM) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
+static inline int drm_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+        return drm_legacy_mmap(filp, vma);
+}
+#endif
+
 /* WARNING:
  * The mmap code has its own mutex, to prevent a possible deadlock,
  * when using gPVRSRVLock.
@@ -1167,7 +1177,7 @@ unlock_and_return:
 
     LinuxUnLockMutex(&g_sMMapMutex);
 
-    if(psFlushMemArea)
+    if(psFlushMemArea && uiFlushSize)
     {
         OSInvalidateCPUCacheRangeKM(psFlushMemArea, uiByteOffset, pvBase,
                                                                         uiFlushSize);
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/module.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/module.c
index 4c9cf9e..5ce0a9b 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/module.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/module.c
@@ -73,10 +73,12 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #define PVR_MOD_STATIC  static
 #endif
 
-#if defined(PVR_LDM_PLATFORM_PRE_REGISTERED)
-#if !defined(NO_HARDWARE)
+#if (defined(PVR_LDM_PLATFORM_PRE_REGISTERED) || defined(PVR_LDM_DEVICE_TREE)) && !defined(NO_HARDWARE)
 #define PVR_USE_PRE_REGISTERED_PLATFORM_DEV
 #endif
+
+#if defined(PVR_LDM_DEVICE_TREE) && !defined(NO_HARDWARE)
+#define PVR_USE_DEVICE_TREE
 #endif
 
 #include <linux/init.h>
@@ -84,10 +86,6 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include <linux/module.h>
 #include <linux/fs.h>
 
-#ifdef CONFIG_OF
-#include <linux/of.h>
-#endif
-
 #if defined(SUPPORT_DRI_DRM)
 #include <drm/drmP.h>
 #if defined(PVR_SECURE_DRM_AUTH_EXPORT)
@@ -143,6 +141,11 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #if defined(SUPPORT_DRI_DRM)
 #include "pvr_drm.h"
 #endif
+
+#if defined(SUPPORT_DMABUF)
+#include "pvr_linux_fence.h"
+#endif
+
 /*
  * DRVNAME is the name we use to register our driver.
  * DEVNAME is the name we use to register actual device nodes.
@@ -170,10 +173,18 @@ module_param(gPVRDebugLevel, uint, 0644);
 MODULE_PARM_DESC(gPVRDebugLevel, "Sets the level of debug output (default 0x7)");
 #endif /* defined(PVRSRV_NEED_PVR_DPF) */
 
-/* Newer kernels no longer support __devinitdata */
 #if !defined(__devinitdata)
 #define __devinitdata
 #endif
+#if !defined(__devinit)
+#define __devinit
+#endif
+#if !defined(__devexit)
+#define __devexit
+#endif
+#if !defined(__devexit_p)
+#define __devexit_p(x) (&(x))
+#endif
 
 #if defined(SUPPORT_PVRSRV_DEVICE_CLASS)
 /* PRQA S 3207 2 */ /* ignore 'not used' warning */
@@ -262,34 +273,36 @@ struct pci_device_id powervr_id_table[] __devinitdata = {
 MODULE_DEVICE_TABLE(pci, powervr_id_table);
 #endif
 
+#if defined(PVR_USE_DEVICE_TREE)
+static struct of_device_id powervr_id_table[] = {
+        {
+                .compatible = SYS_SGX_DEV_NAME
+        },
+        {}
+};
+MODULE_DEVICE_TABLE(of, powervr_id_table);
+#else
 #if defined(PVR_USE_PRE_REGISTERED_PLATFORM_DEV)
 static struct platform_device_id powervr_id_table[] __devinitdata = {
         {SYS_SGX_DEV_NAME, 0},
         {}
 };
 #endif
-
-#ifdef CONFIG_OF
-static const struct of_device_id omap_gpu_id_table[] = {
-        { .compatible = "ti,omap4-gpu" },
-        {}
-};
-MODULE_DEVICE_TABLE(of, omap_gpu_id_table);
 #endif
 
 static LDM_DRV powervr_driver = {
 #if defined(PVR_LDM_PLATFORM_MODULE)
         .driver = {
                 .name           = DRVNAME,
-#ifdef CONFIG_OF
-                .of_match_table = of_match_ptr(omap_gpu_id_table),
+#if defined(PVR_USE_DEVICE_TREE)
+                .of_match_table = powervr_id_table,
 #endif
         },
 #endif
 #if defined(PVR_LDM_PCI_MODULE)
         .name           = DRVNAME,
 #endif
-#if defined(PVR_LDM_PCI_MODULE) || defined(PVR_USE_PRE_REGISTERED_PLATFORM_DEV)
+#if (defined(PVR_LDM_PCI_MODULE) || defined(PVR_USE_PRE_REGISTERED_PLATFORM_DEV)) && !defined(PVR_USE_DEVICE_TREE)
         .id_table = powervr_id_table,
 #endif
         .probe          = PVRSRVDriverProbe,
@@ -439,6 +452,16 @@ static void __devexit PVRSRVDriverRemove(LDM_DEV *pDevice)
 }
 #endif /* defined(PVR_LDM_MODULE) */
 
+#if !defined(SUPPORT_DRI_DRM)
+struct device *PVRLDMGetDevice(void)
+{
+#if defined(PVR_LDM_MODULE)
+        return &gpsPVRLDMDev->dev;
+#else
+        return NULL;
+#endif
+}
+#endif
 
 #if defined(PVR_LDM_MODULE) || defined(SUPPORT_DRI_DRM)
 static PVRSRV_LINUX_MUTEX gsPMMutex;
@@ -975,9 +998,16 @@ static int __init PVRCore_Init(void)
                 goto init_failed;
         }
 
+#if defined(SUPPORT_DMABUF)
+        if (PVRLinuxFenceInit())
+        {
+                error = -ENOMEM;
+                goto init_failed;
+        }
+#endif
+
         LinuxBridgeInit();
         
-
         PVRMMapInit();
 
 #if defined(PVR_LDM_MODULE)
@@ -1119,6 +1149,9 @@ init_failed:
         PVRMMapCleanup();
         LinuxMMCleanup();
         LinuxBridgeDeInit();
+#if defined(SUPPORT_DMABUF)
+        PVRLinuxFenceDeInit();
+#endif
         PVROSFuncDeInit();
         RemoveProcEntries();
         return error;
@@ -1224,6 +1257,10 @@ static void __exit PVRCore_Cleanup(void)
 
         LinuxBridgeDeInit();
 
+#if defined(SUPPORT_DMABUF)
+        PVRLinuxFenceDeInit();
+#endif
+
         PVROSFuncDeInit();
 
         RemoveProcEntries();
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mutils.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mutils.c
index 8e57476..9e83d85 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mutils.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mutils.c
@@ -57,6 +57,11 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include "mutils.h"
 
 #if defined(SUPPORT_LINUX_X86_PAT)
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,19,0))
+#define _PAGE_CACHE_WC pgprot_val(cachemode2pgprot(_PAGE_CACHE_MODE_WC))
+#endif
+
 #define PAT_LINUX_X86_WC        1
 
 #define PAT_X86_ENTRY_BITS      8
@@ -113,7 +118,11 @@ PVRLinuxX86PATProbe(IMG_VOID)
                 PVR_TRACE(("%s: Top 32 bits of PAT: 0x%.8x", __FUNCTION__, (IMG_UINT)(pat >> 32)));
                 PVR_TRACE(("%s: Bottom 32 bits of PAT: 0x%.8x", __FUNCTION__, (IMG_UINT)(pat)));
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,0,0))               
+                pat_index = pvr_pat_index(_PAGE_CACHE_MODE_WC);
+#else
                 pat_index = pvr_pat_index(_PAGE_CACHE_WC);
+#endif
                 PVR_TRACE(("%s: PAT index for write combining: %u", __FUNCTION__, pat_index));
 
                 pat_entry = pvr_pat_entry(pat, pat_index);
@@ -152,7 +161,11 @@ pvr_pgprot_writecombine(pgprot_t prot)
      */
     /* PRQA S 0481,0482 2 */ /* scalar expressions */
     return (g_write_combining_available) ?
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,0,0))               
+                __pgprot((pgprot_val(prot) & ~_PAGE_CACHE_MASK) | _PAGE_CACHE_MODE_WC) : pgprot_noncached(prot);
+#else
                 __pgprot((pgprot_val(prot) & ~_PAGE_CACHE_MASK) | _PAGE_CACHE_WC) : pgprot_noncached(prot);
+#endif
 }
 #endif  /* defined(SUPPORT_LINUX_X86_PAT) */
 
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mutils.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mutils.h
index 1fe1eb1..61edf95 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mutils.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/mutils.h
@@ -80,10 +80,14 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
         #define IOREMAP(pa, bytes)      ioremap_cache(pa, bytes)
 #else   
         #if defined(__arm__)
-                #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
-                        #define IOREMAP(pa, bytes)      ioremap_cache(pa, bytes)
-                #elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0))
-                        #define IOREMAP(pa, bytes)      ioremap_cached(pa, bytes)
+                #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,13,0))
+                                #define IOREMAP(pa, bytes)      ioremap_cache(pa, bytes)
+                #else
+                        #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0))
+                                #define IOREMAP(pa, bytes)      ioremap_cached(pa, bytes)
+                        #else
+                                #define IOREMAP(pa, bytes)      ioremap(pa, bytes)
+                        #endif
                 #endif
         #else
                 #define IOREMAP(pa, bytes)      ioremap(pa, bytes)
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/osfunc.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/osfunc.c
index 369c0e1..1302edb 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/osfunc.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/osfunc.c
@@ -66,7 +66,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include <linux/interrupt.h>
 #include <asm/hardirq.h>
 #include <linux/timer.h>
-#if defined(MEM_TRACK_INFO_DEBUG)
+#if defined(MEM_TRACK_INFO_DEBUG) || defined (PVRSRV_DEVMEM_TIME_STATS)
 #include <linux/time.h>
 #endif
 #include <linux/capability.h>
@@ -94,10 +94,12 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #if defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC)
 #include "pvr_sync.h"
 #endif
-
 #if defined (SUPPORT_ION)
 #include "ion.h"
 #endif
+#if defined(SUPPORT_DMABUF)
+#include "pvr_linux_fence.h"
+#endif
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27))
 #define ON_EACH_CPU(func, info, wait) on_each_cpu(func, info, wait)
@@ -146,7 +148,7 @@ PVRSRV_ERROR OSAllocMem_Impl(IMG_UINT32 ui32Flags, IMG_SIZE_T uiSize, IMG_PVOID
     }
 
 #if defined(DEBUG_LINUX_MEMORY_ALLOCATIONS)
-    *ppvCpuVAddr = _KMallocWrapper(uiSize, GFP_KERNEL | __GFP_NOWARN, pszFilename, ui32Line);
+    *ppvCpuVAddr = _KMallocWrapper(uiSize, GFP_KERNEL | __GFP_NOWARN, pszFilename, ui32Line, ui32Flags & PVRSRV_SWAP_BUFFER_ALLOCATION);
 #else
     *ppvCpuVAddr = KMallocWrapper(uiSize, GFP_KERNEL | __GFP_NOWARN);
 #endif
@@ -189,7 +191,7 @@ PVRSRV_ERROR OSFreeMem_Impl(IMG_UINT32 ui32Flags, IMG_SIZE_T uiSize, IMG_PVOID p
     else
     {
 #if defined(DEBUG_LINUX_MEMORY_ALLOCATIONS)
-        _KFreeWrapper(pvCpuVAddr, pszFilename, ui32Line);
+        _KFreeWrapper(pvCpuVAddr, pszFilename, ui32Line, ui32Flags & PVRSRV_SWAP_BUFFER_ALLOCATION);
 #else
         KFreeWrapper(pvCpuVAddr);
 #endif
@@ -562,10 +564,28 @@ IMG_VOID OSBreakResourceLock (PVRSRV_RESOURCE *psResource, IMG_UINT32 ui32ID)
 ******************************************************************************/
 PVRSRV_ERROR OSCreateResource(PVRSRV_RESOURCE *psResource)
 {
+#if !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__)
+        PVRSRV_ERROR eError = PVRSRV_OK;
+#endif
+
     psResource->ui32ID = 0;
     psResource->ui32Lock = 0;
+#if !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__)
+        psResource->pOSSyncPrimitive = IMG_NULL;
 
-    return PVRSRV_OK;
+        eError = OSAllocMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(spinlock_t), (IMG_VOID**)&psResource->pOSSyncPrimitive, IMG_NULL,
+                "Resource Spinlock");
+
+        if (eError != PVRSRV_OK)
+        {
+                PVR_DPF((PVR_DBG_ERROR,"OSCreateResource: Spinlock could not be alloc'd"));
+                return eError;
+        }
+
+        spin_lock_init((spinlock_t*)psResource->pOSSyncPrimitive);
+#endif /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
+
+        return PVRSRV_OK;
 }
 
 
@@ -583,6 +603,13 @@ PVRSRV_ERROR OSCreateResource(PVRSRV_RESOURCE *psResource)
 ******************************************************************************/
 PVRSRV_ERROR OSDestroyResource (PVRSRV_RESOURCE *psResource)
 {
+#if !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__)
+        if (psResource->pOSSyncPrimitive)
+        {
+                OSFreeMem(PVRSRV_OS_PAGEABLE_HEAP, sizeof(spinlock_t), (IMG_VOID*)psResource->pOSSyncPrimitive, IMG_NULL);
+        }
+#endif /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
+
     OSBreakResourceLock (psResource, psResource->ui32ID);
 
     return PVRSRV_OK;
@@ -683,6 +710,30 @@ IMG_VOID OSReleaseThreadQuanta(IMG_VOID)
     schedule();
 }
 
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+/*!
+******************************************************************************
+
+ @Function OSClockMonotonicus
+
+ @Description   This function returns the raw monotonic clock time in microseconds
+                                (i.e. un-affected by NTP or similar changes)
+
+ @Input void
+
+ @Return - monotonic clock time in (us)
+
+******************************************************************************/ 
+IMG_UINT64 OSClockMonotonicus(IMG_VOID)
+{
+        struct timespec ts;
+
+        getrawmonotonic(&ts);
+
+        return ((unsigned long)ts.tv_sec * 1000000ul + (unsigned long)ts.tv_nsec / 1000ul);
+}
+#endif
+
 
 /*!
 ******************************************************************************
@@ -1119,6 +1170,9 @@ static void MISRWrapper(
 #if defined(PVR_ANDROID_NATIVE_WINDOW_HAS_SYNC)
         PVRSyncUpdateAllSyncs();
 #endif
+#if defined(SUPPORT_DMABUF)
+        PVRLinuxFenceCheckAll();
+#endif
 }
 
 
@@ -1550,6 +1604,81 @@ PVRSRV_ERROR OSUnlockResource (PVRSRV_RESOURCE *psResource, IMG_UINT32 ui32ID)
 }
 
 
+#if !defined(PVR_LINUX_USING_WORKQUEUES)
+/*!
+******************************************************************************
+
+ @Function OSLockResourceAndBlockMISR
+
+ @Description locks an OS dependant Resource and blocks MISR interrupts
+
+ @Input phResource - pointer to OS dependent Resource
+ @Input bBlock - do we want to block?
+
+ @Return error status
+
+******************************************************************************/
+PVRSRV_ERROR OSLockResourceAndBlockMISR ( PVRSRV_RESOURCE       *psResource,
+                                                                IMG_UINT32                      ui32ID)
+
+{
+        PVRSRV_ERROR eError = PVRSRV_OK;
+
+        spin_lock_bh(psResource->pOSSyncPrimitive);
+
+        if(!OS_TAS(&psResource->ui32Lock))
+                psResource->ui32ID = ui32ID;
+        else
+                eError = PVRSRV_ERROR_UNABLE_TO_LOCK_RESOURCE;
+
+        return eError;
+}
+
+
+/*!
+******************************************************************************
+
+ @Function OSUnlockResourceAndUnblockMISR
+
+ @Description unlocks an OS dependant resource and unblocks MISR interrupts
+
+ @Input phResource - pointer to OS dependent resource structure
+
+ @Return
+
+******************************************************************************/
+PVRSRV_ERROR OSUnlockResourceAndUnblockMISR (PVRSRV_RESOURCE *psResource, IMG_UINT32 ui32ID)
+{
+        volatile IMG_UINT32 *pui32Access = (volatile IMG_UINT32 *)&psResource->ui32Lock;
+        PVRSRV_ERROR eError = PVRSRV_OK;
+
+        if(*pui32Access)
+        {
+                if(psResource->ui32ID == ui32ID)
+                {
+                        psResource->ui32ID = 0;
+                        smp_mb();
+                        *pui32Access = 0;
+                        spin_unlock_bh(psResource->pOSSyncPrimitive);
+                }
+                else
+                {
+                        PVR_DPF((PVR_DBG_ERROR,"OSUnlockResourceAndUnblockMISR: Resource %p is not locked with expected value.", psResource));
+                        PVR_DPF((PVR_DBG_MESSAGE,"Should be %x is actually %x", ui32ID, psResource->ui32ID));
+                        eError = PVRSRV_ERROR_INVALID_LOCK_ID;
+                }
+        }
+        else
+        {
+                PVR_DPF((PVR_DBG_ERROR,"OSUnlockResourceAndUnblockMISR: Resource %p is not locked", psResource));
+                eError = PVRSRV_ERROR_RESOURCE_NOT_LOCKED;
+        }
+
+        return eError;
+}
+#endif
+
+
 /*!
 ******************************************************************************
 
@@ -2040,7 +2169,7 @@ PVRSRV_ERROR OSBaseAllocContigMemory(IMG_SIZE_T uiSize, IMG_CPU_VIRTADDR *pvLinA
     IMG_VOID *pvKernLinAddr;
 
 #if defined(DEBUG_LINUX_MEMORY_ALLOCATIONS)
-    pvKernLinAddr = _KMallocWrapper(uiSize, GFP_KERNEL, __FILE__, __LINE__);
+    pvKernLinAddr = _KMallocWrapper(uiSize, GFP_KERNEL, __FILE__, __LINE__, IMG_FALSE);
 #else
     pvKernLinAddr = KMallocWrapper(uiSize, GFP_KERNEL);
 #endif
@@ -4634,10 +4763,9 @@ PVRSRV_ERROR PVROSFuncInit(IMG_VOID)
     }
 #endif
 
-#if 0//defined (SUPPORT_ION)
+#if defined(SUPPORT_ION) && !defined(LMA)
         {
                 PVRSRV_ERROR eError;
-
                 eError = IonInit();
                 if (eError != PVRSRV_OK)
                 {
@@ -4654,7 +4782,7 @@ PVRSRV_ERROR PVROSFuncInit(IMG_VOID)
  */
 IMG_VOID PVROSFuncDeInit(IMG_VOID)
 {
-#if 0//defined (SUPPORT_ION)
+#if defined (SUPPORT_ION)
         IonDeinit();
 #endif
 #if defined(PVR_LINUX_TIMERS_USING_WORKQUEUES)
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/osperproc.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/osperproc.c
index 5a79f75..9b014dc 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/osperproc.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/osperproc.c
@@ -47,7 +47,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #if defined (SUPPORT_ION)
 #include <linux/err.h>
 #include "ion.h"
-//extern struct ion_device *gpsIonDev;
+extern struct ion_device *gpsIonDev;
 #endif
 
 extern IMG_UINT32 gui32ReleasePID;
@@ -85,7 +85,7 @@ PVRSRV_ERROR OSPerProcessPrivateDataInit(IMG_HANDLE *phOsPrivateData)
         INIT_LIST_HEAD(&psEnvPerProc->sDRMAuthListHead);
 #endif
 
-#if 0//defined(SUPPORT_ION)
+#if defined(SUPPORT_ION)
         OSSNPrintf(psEnvPerProc->azIonClientName, ION_CLIENT_NAME_SIZE, "pvr_ion_client-%d", OSGetCurrentProcessIDKM());
         psEnvPerProc->psIONClient =
                 ion_client_create(gpsIonDev,
@@ -114,7 +114,7 @@ PVRSRV_ERROR OSPerProcessPrivateDataDeInit(IMG_HANDLE hOsPrivateData)
 
         psEnvPerProc = (PVRSRV_ENV_PER_PROCESS_DATA *)hOsPrivateData;
 
-#if 0//defined(SUPPORT_ION)
+#if defined(SUPPORT_ION)
         if (psEnvPerProc->psIONClient)
         {
                 ion_client_destroy(psEnvPerProc->psIONClient);
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_debug.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_debug.c
index aece908..621a30d 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_debug.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_debug.c
@@ -462,17 +462,18 @@ IMG_VOID PVRSRVDebugPrintf	(
                 }
                 else
                 {
-                        const IMG_CHAR *pszShortName = strrchr(pszFileName, '/') + 1;
-                        if(pszShortName)
-                                pszFileName = pszShortName;
                         if (ui32DebugLevel & DBGPRIV_BUFFERED)
                         {
                                 /* We don't need the full path here */
+                                const IMG_CHAR *pszShortName = strrchr(pszFileName, '/') + 1;
+                                if(pszShortName)
+                                        pszFileName = pszShortName;
+
                                 AddToBufferCCB(pszFileName, ui32Line, pszBuf);
                         }
                         else
                         {
-                                printk(KERN_INFO "%s (File: %s, Line: %d)\n", pszBuf, pszFileName, ui32Line);
+                                printk(KERN_INFO "%s\n", pszBuf);
                         }
                 }
 
@@ -504,7 +505,7 @@ IMG_INT PVRDebugProcSetLevel(struct file *file, const IMG_CHAR *buffer, IMG_UINT
                         return -EINVAL;
                 if (data_buffer[count - 1] != '\n')
                         return -EINVAL;
-                if (sscanf(data_buffer, "%i", &gPVRDebugLevel) == 0)
+                if (sscanf(data_buffer, "%u", &gPVRDebugLevel) == 0)
                         return -EINVAL;
                 gPVRDebugLevel &= (1 << DBGPRIV_DBGLEVEL_COUNT) - 1;
         }
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_drm.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_drm.c
index 3a925ad..8b862a9 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_drm.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_drm.c
@@ -84,7 +84,19 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include "pvr_drm_mod.h"
 #endif
 
-#if (defined(PVR_DRI_DRM_PLATFORM_DEV) && !defined(PVR_LDM_PLATFORM_PRE_REGISTERED)) || defined(NO_HARDWARE)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,16,0))
+#define DRM_ARRAY_SIZE(x) ARRAY_SIZE(x)
+#endif
+
+#if (defined(PVR_LDM_PLATFORM_PRE_REGISTERED) || defined(PVR_LDM_DEVICE_TREE)) && !defined(NO_HARDWARE)
+#define PVR_USE_PRE_REGISTERED_PLATFORM_DEV
+#endif
+
+#if defined(PVR_LDM_DEVICE_TREE) && !defined(NO_HARDWARE)
+#define PVR_USE_DEVICE_TREE
+#endif
+
+#if (defined(PVR_DRI_DRM_PLATFORM_DEV) && !defined(PVR_USE_PRE_REGISTERED_PLATFORM_DEV)) || defined(NO_HARDWARE)
 #define PVR_DRM_NAME    SYS_SGX_DEV_NAME
 #else
 #define PVR_DRM_NAME    PVRSRV_MODNAME
@@ -116,6 +128,14 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #define PVR_DRI_DRM_USE_POST_CLOSE
 #endif
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,12,0))
+#define PVR_DRM_DRIVER_RENDER   DRIVER_RENDER
+#define PVR_DRM_RENDER_ALLOW    DRM_RENDER_ALLOW
+#else
+#define PVR_DRM_DRIVER_RENDER   0
+#define PVR_DRM_RENDER_ALLOW    0
+#endif
+
 DECLARE_WAIT_QUEUE_HEAD(sWaitForInit);
 
 #if defined(SUPPORT_DRM_MODESET)
@@ -128,6 +148,9 @@ IMG_BOOL bInitFailed;
 
 #if !defined(PVR_DRI_DRM_NOT_PCI) && !defined(SUPPORT_DRI_DRM_PLUGIN)
 #if defined(PVR_DRI_DRM_PLATFORM_DEV)
+#if defined(PVR_NEW_STYLE_DRM_PLATFORM_DEV) && !defined(PVR_USE_PRE_REGISTERED_PLATFORM_DEV)
+static struct platform_device *psPlatDev;
+#endif
 struct platform_device *gpsPVRLDMDev;
 #else
 struct pci_dev *gpsPVRLDMDev;
@@ -143,6 +166,15 @@ struct drm_device *gpsPVRDRMDev;
 #define PVR_DRM_FILE struct drm_file *
 
 #if !defined(SUPPORT_DRI_DRM_EXT) && !defined(SUPPORT_DRI_DRM_PLUGIN)
+#if defined(PVR_USE_DEVICE_TREE)
+static struct of_device_id asPlatIdList[] = {
+        {
+                .compatible = SYS_SGX_DEV_NAME
+        },
+        {}
+};
+MODULE_DEVICE_TABLE(of,  asPlatIdList);
+#else
 #if defined(PVR_DRI_DRM_PLATFORM_DEV)
 static struct platform_device_id asPlatIdList[] = {
         {SYS_SGX_DEV_NAME, 0},
@@ -161,8 +193,15 @@ static struct pci_device_id asPciIdList[] = {
         {0}
 };
 #endif  /* defined(PVR_DRI_DRM_PLATFORM_DEV) */
+#endif  /* defined(PVR_DEVICE_TREE) */
 #endif  /* !defined(SUPPORT_DRI_DRM_EXT) */
 
+struct device *
+PVRLDMGetDevice(void)
+{
+        return gpsPVRDRMDev->dev;
+}
+
 DRI_DRM_STATIC int
 PVRSRVDrmLoad(struct drm_device *dev, unsigned long flags)
 {
@@ -418,23 +457,20 @@ PVRSRVPciRemove(struct pci_dev *dev)
 #define PVR_DRM_UNLOCKED        0
 #endif
 
-#if !defined(SUPPORT_DRI_DRM_EXT)
-
-#if defined(DRM_IOCTL_DEF)
-#define PVR_DRM_IOCTL_DEF(ioctl, _func, _flags) DRM_IOCTL_DEF(DRM_##ioctl, _func, _flags)
-#else
-#define PVR_DRM_IOCTL_DEF(ioctl, _func, _flags) DRM_IOCTL_DEF_DRV(ioctl, _func, _flags)
+#if !defined(DRM_IOCTL_DEF_DRV)
+#define DRM_IOCTL_DEF_DRV(ioctl, _func, _flags) DRM_IOCTL_DEF(DRM_##ioctl, _func, _flags)
 #endif
 
+#if !defined(SUPPORT_DRI_DRM_EXT)
 struct drm_ioctl_desc sPVRDrmIoctls[] = {
-        PVR_DRM_IOCTL_DEF(PVR_SRVKM, PVRSRV_BridgeDispatchKM, PVR_DRM_UNLOCKED),
-        PVR_DRM_IOCTL_DEF(PVR_IS_MASTER, PVRDRMIsMaster, DRM_MASTER | PVR_DRM_UNLOCKED),
-        PVR_DRM_IOCTL_DEF(PVR_UNPRIV, PVRDRMUnprivCmd, PVR_DRM_UNLOCKED),
+        DRM_IOCTL_DEF_DRV(PVR_SRVKM, PVRSRV_BridgeDispatchKM, PVR_DRM_RENDER_ALLOW | PVR_DRM_UNLOCKED),
+        DRM_IOCTL_DEF_DRV(PVR_IS_MASTER, PVRDRMIsMaster, PVR_DRM_RENDER_ALLOW | DRM_MASTER | PVR_DRM_UNLOCKED),
+        DRM_IOCTL_DEF_DRV(PVR_UNPRIV, PVRDRMUnprivCmd, PVR_DRM_RENDER_ALLOW | PVR_DRM_UNLOCKED),
 #if defined(PDUMP)
-        PVR_DRM_IOCTL_DEF(PVR_DBGDRV, dbgdrv_ioctl, PVR_DRM_UNLOCKED),
+        DRM_IOCTL_DEF_DRV(PVR_DBGDRV, dbgdrv_ioctl, PVR_DRM_RENDER_ALLOW | PVR_DRM_UNLOCKED),
 #endif
 #if defined(DISPLAY_CONTROLLER) && defined(PVR_DISPLAY_CONTROLLER_DRM_IOCTL)
-        PVR_DRM_IOCTL_DEF(PVR_DISP, PVRDRM_Display_ioctl, DRM_MASTER | PVR_DRM_UNLOCKED)
+        DRM_IOCTL_DEF_DRV(PVR_DISP, PVRDRM_Display_ioctl, DRM_MASTER | PVR_DRM_UNLOCKED)
 #endif
 };
 
@@ -488,11 +524,11 @@ static const struct file_operations sPVRFileOps =
 
 static struct drm_driver sPVRDrmDriver = 
 {
+        .driver_features = PVR_DRM_DRIVER_RENDER
 #if defined(PVR_OLD_STYLE_DRM_PLATFORM_DEV)
-        .driver_features = DRIVER_USE_PLATFORM_DEVICE,
-#else
-        .driver_features = 0,
+                | DRIVER_USE_PLATFORM_DEVICE
 #endif
+                ,
         .dev_priv_size = 0,
         .load = PVRSRVDrmLoad,
         .unload = PVRSRVDrmUnload,
@@ -556,7 +592,19 @@ static struct drm_driver sPVRDrmDriver =
         },
 #endif
 #endif
-        .name = PVR_DRM_NAME,
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
+#if defined(LDM_PLATFORM)
+        .set_busid = drm_platform_set_busid,
+#else
+#if defined(LDM_PCI)
+        .set_busid = drm_pci_set_busid,
+#else
+        #error "LDM_PLATFORM or LDM_PCI must be set"
+#endif
+#endif
+#endif
+        .name = "pvr",
         .desc = PVR_DRM_DESC,
         .date = PVR_DRM_DATE,
         .major = PVRVERSION_MAJ,
@@ -579,26 +627,25 @@ static struct pci_driver sPVRPCIDriver =
 #endif
 
 #if defined(PVR_NEW_STYLE_DRM_PLATFORM_DEV)
-#if !defined(PVR_LDM_PLATFORM_PRE_REGISTERED) || defined(NO_HARDWARE)
-static void PVRSRVDeviceRelease(struct device unref__ *pDevice)
-{
-}
-
-static struct platform_device sPVRPlatDevice = {
+#if !defined(PVR_USE_PRE_REGISTERED_PLATFORM_DEV)
+static struct platform_device_info sPVRPlatDeviceInfo = {
         .name                   = PVR_DRM_NAME,
         .id                     = -1,
-        .dev                    = {
-                .release        = PVRSRVDeviceRelease
-        }
+        .dma_mask = DMA_BIT_MASK(32)
 };
 #endif
 
 static struct platform_driver sPVRPlatDriver =
 {
+#if !defined(PVR_USE_DEVICE_TREE)
         .id_table = asPlatIdList,
+#endif
         .driver =
         {
                 .name = PVR_DRM_NAME,
+#if defined(PVR_USE_DEVICE_TREE)
+                .of_match_table = asPlatIdList,
+#endif
         },
         .probe = PVRSRVDrmProbe,
         .remove = PVRSRVDrmRemove,
@@ -631,7 +678,7 @@ PVRSRVDrmRemove(struct platform_device *pDevice)
 {
         PVR_TRACE(("PVRSRVDrmRemove"));
 
-#if defined(PVR_NEW_STYLE_DRM_PLATFORM_DEV)
+#if defined(PVR_NEW_STYLE_DRM_PLATFORM_DEV) && (LINUX_VERSION_CODE < KERNEL_VERSION(3,14,0))
         drm_platform_exit(&sPVRDrmDriver, gpsPVRLDMDev);
 #else
         drm_put_dev(gpsPVRDRMDev);
@@ -656,12 +703,14 @@ static int __init PVRSRVDrmInit(void)
 
 #if defined(PVR_NEW_STYLE_DRM_PLATFORM_DEV)
         iRes = platform_driver_register(&sPVRPlatDriver);
-#if !defined(PVR_LDM_PLATFORM_PRE_REGISTERED) || defined(NO_HARDWARE)
+#if !defined(PVR_USE_PRE_REGISTERED_PLATFORM_DEV)
         if (iRes == 0)
         {
-                iRes = platform_device_register(&sPVRPlatDevice);
-                if (iRes != 0)
+                psPlatDev = platform_device_register_full(&sPVRPlatDeviceInfo);
+                if (IS_ERR(psPlatDev))
                 {
+                        iRes = PTR_ERR(psPlatDev);
+                        psPlatDev = NULL;
                         platform_driver_unregister(&sPVRPlatDriver);
                 }
         }
@@ -702,8 +751,8 @@ static int __init PVRSRVDrmInit(void)
 static void __exit PVRSRVDrmExit(void)
 {
 #if defined(PVR_NEW_STYLE_DRM_PLATFORM_DEV)
-#if !defined(PVR_LDM_PLATFORM_PRE_REGISTERED) || defined(NO_HARDWARE)
-        platform_device_unregister(&sPVRPlatDevice);
+#if !defined(PVR_USE_PRE_REGISTERED_PLATFORM_DEV)
+        platform_device_unregister(psPlatDev);
 #endif
         platform_driver_unregister(&sPVRPlatDriver);
 #else   /* defined(PVR_NEW_STYLE_DRM_PLATFORM_DEV) */
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_drm.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_drm.h
index c3ed413..1c53755 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_drm.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_drm.h
@@ -142,17 +142,17 @@ typedef struct {
         char dummy[4];
 } drm_pvr_dummy_arg;
 
-/* IOCTL numbers, relative to DRM_COMMAND_BASE */
-#define DRM_IOCTL_PVR_SRVKM     _IOWR(0, DRM_PVR_SRVKM, PVRSRV_BRIDGE_PACKAGE)
-#define DRM_IOCTL_PVR_IS_MASTER _IOW(0, DRM_PVR_IS_MASTER, drm_pvr_dummy_arg)
-#define DRM_IOCTL_PVR_UNPRIV    _IOWR(0, DRM_PVR_UNPRIV, drm_pvr_unpriv_cmd)
+/* IOCTL numbers */
+#define DRM_IOCTL_PVR_SRVKM     DRM_IOWR(DRM_COMMAND_BASE + DRM_PVR_SRVKM, PVRSRV_BRIDGE_PACKAGE)
+#define DRM_IOCTL_PVR_IS_MASTER DRM_IOW(DRM_COMMAND_BASE + DRM_PVR_IS_MASTER, drm_pvr_dummy_arg)
+#define DRM_IOCTL_PVR_UNPRIV    DRM_IOWR(DRM_COMMAND_BASE + DRM_PVR_UNPRIV, drm_pvr_unpriv_cmd)
 
 #if defined(PDUMP)
-#define DRM_IOCTL_PVR_DBGDRV    _IOWR(0, DRM_PVR_DBGDRV, IOCTL_PACKAGE)
+#define DRM_IOCTL_PVR_DBGDRV    DRM_IOWR(DRM_COMMAND_BASE + DRM_PVR_DBGDRV, IOCTL_PACKAGE)
 #endif
 
 #if defined(PVR_DISPLAY_CONTROLLER_DRM_IOCTL)
-#define DRM_IOCTL_PVR_DISP      _IOWR(0, DRM_PVR_DISP, drm_pvr_display_cmd)
+#define DRM_IOCTL_PVR_DISP      DRM_IOWR(DRM_COMMAND_BASE + DRM_PVR_DISP, drm_pvr_display_cmd)
 #endif
 #endif  /* !defined(SUPPORT_DRI_DRM_EXT) */
 
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_linux_fence.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_linux_fence.c
new file mode 100644
index 0000000..0a7c5ae
--- /dev/null
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_linux_fence.c
@@ -0,0 +1,1371 @@
+/*************************************************************************/ /*!
+@File
+@Title          Linux fence interface
+@Copyright      Copyright (c) Imagination Technologies Ltd. All Rights Reserved
+@Description    Linux module setup
+@License        Dual MIT/GPLv2
+
+The contents of this file are subject to the MIT license as set out below.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+Alternatively, the contents of this file may be used under the terms of
+the GNU General Public License Version 2 ("GPL") in which case the provisions
+of GPL are applicable instead of those above.
+
+If you wish to allow use of your version of this file only under the terms of
+GPL, and not to allow others to use your version of this file under the terms
+of the MIT license, indicate your decision by deleting the provisions above
+and replace them with the notice and other provisions required by GPL as set
+out in the file called "GPL-COPYING" included in this distribution. If you do
+not delete the provisions above, a recipient may use your version of this file
+under the terms of either the MIT license or GPL.
+
+This License is also included in this distribution in the file called
+"MIT-COPYING".
+
+EXCEPT AS OTHERWISE STATED IN A NEGOTIATED AGREEMENT: (A) THE SOFTWARE IS
+PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
+BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE AND NONINFRINGEMENT; AND (B) IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/ /**************************************************************************/
+
+#include <linux/version.h>
+
+#include "srvkm.h"
+#include "syscommon.h"
+#include "pvr_linux_fence.h"
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,17,0))
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/workqueue.h>
+#include <linux/mutex.h>
+#include <linux/atomic.h>
+#include <linux/spinlock.h>
+#include <linux/fence.h>
+#include <linux/reservation.h>
+#include <linux/list.h>
+
+#include "dmabuf.h"
+
+#define BLOCKED_ON_READ         1
+#define BLOCKED_ON_WRITE        2
+
+struct pvr_fence_context
+{
+        struct mutex mutex;
+        PVRSRV_KERNEL_SYNC_INFO *psSyncInfo;
+        IMG_HANDLE hNativeSync;
+        struct work_struct fence_work;
+        struct list_head fence_frame_list;
+        struct list_head fence_context_notify_list;
+        struct list_head fence_context_list;
+};
+
+struct pvr_fence_frame;
+
+struct pvr_blocking_fence
+{
+        struct fence *fence;
+        struct fence_cb cb;
+        struct pvr_fence_frame *pvr_fence_frame;
+        bool installed;
+};
+
+struct pvr_fence_frame
+{
+        struct list_head fence_frame_list;
+        struct pvr_fence_context *pvr_fence_context;
+        u32 tag;
+        bool is_dst;
+        IMG_UINT32 ui32ReadOpsPending;
+        IMG_UINT32 ui32ReadOps2Pending;
+        IMG_UINT32 ui32WriteOpsPending;
+        int blocked_on;
+        struct pvr_blocking_fence *blocking_fences;
+        unsigned blocking_fence_count;
+        atomic_t blocking_count;
+        struct fence *fence_to_signal;
+        bool unblock;
+};
+
+struct pvr_fence
+{
+        struct fence fence;
+        spinlock_t lock;
+        struct pvr_fence_context *pvr_fence_context;
+        u32 tag;
+};
+
+static LIST_HEAD(fence_context_list);
+static LIST_HEAD(fence_context_notify_list);
+static DEFINE_MUTEX(pvr_fence_mutex);
+
+static struct workqueue_struct *workqueue;
+static unsigned fence_context;
+static atomic_t fence_seqno = ATOMIC_INIT(0);
+static atomic_t fences_outstanding = ATOMIC_INIT(0);
+
+#if defined(DEBUG)
+static atomic_t fences_allocated = ATOMIC_INIT(0);
+static atomic_t fences_signalled = ATOMIC_INIT(0);
+static atomic_t callbacks_installed = ATOMIC_INIT(0);
+static atomic_t callbacks_called = ATOMIC_INIT(0);
+#endif
+
+#if defined(PVR_DRM_DRIVER_NAME)
+static const char *drvname = PVR_DRM_DRIVER_NAME;
+#else
+static const char *drvname = "pvr";
+#endif
+static const char *timeline_name = "PVR";
+
+static unsigned next_seqno(void)
+{
+        return atomic_inc_return(&fence_seqno) - 1;
+}
+
+static const char *get_driver_name(struct fence *fence)
+{
+        return drvname;
+}
+
+static const char *get_timeline_name(struct fence *fence)
+{
+        return timeline_name;
+}
+
+static bool enable_signaling(struct fence *fence)
+{
+        return true;
+}
+
+static void release_fence(struct fence *fence)
+{
+        struct pvr_fence *pvr_fence = container_of(fence, struct pvr_fence, fence);
+        kfree(pvr_fence);
+
+        atomic_dec(&fences_outstanding);
+}
+
+static struct fence_ops fence_ops = 
+{
+        .get_driver_name = get_driver_name,
+        .get_timeline_name = get_timeline_name,
+        .enable_signaling = enable_signaling,
+        .wait = fence_default_wait,
+        .release = release_fence
+};
+
+static inline bool is_pvr_fence(struct fence *fence)
+{
+        return fence->ops == &fence_ops;
+}
+
+static struct fence *create_fence_to_signal(struct pvr_fence_frame *pvr_fence_frame)
+{
+        struct pvr_fence *pvr_fence;
+        unsigned seqno = next_seqno();
+
+        pvr_fence = kmalloc(sizeof(*pvr_fence), GFP_KERNEL);
+        if (!pvr_fence)
+        {
+                return NULL;
+        }
+
+        spin_lock_init(&pvr_fence->lock);
+
+        fence_init(&pvr_fence->fence, &fence_ops, &pvr_fence->lock, fence_context, seqno);
+
+        pvr_fence->pvr_fence_context = pvr_fence_frame->pvr_fence_context;
+        pvr_fence->tag = pvr_fence_frame->tag;
+
+        pvr_fence_frame->fence_to_signal = &pvr_fence->fence;
+
+#if defined(DEBUG)
+        atomic_inc(&fences_allocated);
+#endif
+        atomic_inc(&fences_outstanding);
+
+        return pvr_fence_frame->fence_to_signal;
+}
+
+static inline bool is_blocking_fence(struct fence *fence, struct pvr_fence_frame *pvr_fence_frame)
+{
+        if (is_pvr_fence(fence))
+        {
+                struct pvr_fence *pvr_fence = container_of(fence, struct pvr_fence, fence);
+
+                return pvr_fence->pvr_fence_context != pvr_fence_frame->pvr_fence_context && pvr_fence->tag != pvr_fence_frame->tag;
+        }
+
+        return true;
+}
+
+static void signal_and_put_fence(struct pvr_fence_frame *pvr_fence_frame)
+{
+        if (pvr_fence_frame->fence_to_signal)
+        {
+                struct pvr_fence_context *pvr_fence_context = pvr_fence_frame->pvr_fence_context;
+
+                fence_signal(pvr_fence_frame->fence_to_signal);
+                fence_put(pvr_fence_frame->fence_to_signal);
+
+                pvr_fence_frame->fence_to_signal = NULL;
+
+                queue_work(workqueue, &pvr_fence_context->fence_work);
+
+#if defined(DEBUG)
+                atomic_inc(&fences_signalled);
+#endif
+        }
+}
+
+static void blocking_fence_signalled(struct fence *fence, struct fence_cb *cb)
+{
+        struct pvr_blocking_fence *pvr_blocking_fence = container_of(cb, struct pvr_blocking_fence, cb);
+        struct pvr_fence_frame *pvr_fence_frame = pvr_blocking_fence->pvr_fence_frame;
+        struct pvr_fence_context *pvr_fence_context = pvr_fence_frame->pvr_fence_context;
+
+        if (atomic_dec_and_test(&pvr_fence_frame->blocking_count))
+        {
+                queue_work(workqueue, &pvr_fence_context->fence_work);
+        }
+#if defined(DEBUG)
+        atomic_inc(&callbacks_called);
+#endif
+}
+
+static bool allocate_blocking_fence_storage(struct pvr_fence_frame *pvr_fence_frame, unsigned count)
+{
+        pvr_fence_frame->blocking_fences = kzalloc(count * sizeof(*pvr_fence_frame->blocking_fences), GFP_KERNEL);
+        if (pvr_fence_frame->blocking_fences)
+        {       
+                pvr_fence_frame->blocking_fence_count = count;
+                return true;
+        }
+        return false;
+}
+
+static void free_blocking_fence_storage(struct pvr_fence_frame *pvr_fence_frame)
+{
+        if (pvr_fence_frame->blocking_fence_count)
+        {
+                kfree(pvr_fence_frame->blocking_fences);
+                pvr_fence_frame->blocking_fence_count = 0;
+        }
+}
+
+static int install_and_get_blocking_fence(struct pvr_fence_frame *pvr_fence_frame, unsigned index, struct fence *fence)
+{
+        struct pvr_blocking_fence *pvr_blocking_fence = &pvr_fence_frame->blocking_fences[index];
+        int ret;
+
+        BUG_ON(index >= pvr_fence_frame->blocking_fence_count);
+
+        pvr_blocking_fence->fence = fence;
+        pvr_blocking_fence->pvr_fence_frame = pvr_fence_frame;
+
+        atomic_inc(&pvr_fence_frame->blocking_count);
+
+        ret = fence_add_callback(pvr_blocking_fence->fence,
+                        &pvr_blocking_fence->cb,
+                        blocking_fence_signalled);
+
+        pvr_blocking_fence->installed = !ret;
+        if (!pvr_blocking_fence->installed)
+        {
+                atomic_dec(&pvr_fence_frame->blocking_count);
+                return 1;
+        }
+        else
+        {
+                fence_get(fence);
+#if defined(DEBUG)
+                atomic_inc(&callbacks_installed);
+#endif
+                return 0;
+        }
+}
+
+static void uninstall_and_put_blocking_fence(struct pvr_fence_frame *pvr_fence_frame, unsigned index)
+{
+        struct pvr_blocking_fence *pvr_blocking_fence = &pvr_fence_frame->blocking_fences[index];
+
+        BUG_ON(index >= pvr_fence_frame->blocking_fence_count);
+
+        if (pvr_blocking_fence->installed)
+        {
+                if (fence_remove_callback(pvr_blocking_fence->fence, &pvr_blocking_fence->cb))
+                {
+                        atomic_dec(&pvr_fence_frame->blocking_count);
+                }
+                fence_put(pvr_blocking_fence->fence);
+        }
+}
+
+static inline int update_reservation_return_value(int ret, bool blocked_on_write)
+{
+        return ret < 0 ? ret : (ret ? 0 : (blocked_on_write ? BLOCKED_ON_WRITE : BLOCKED_ON_READ));
+}
+
+static int update_reservation_object_fences_dst(struct pvr_fence_frame *pvr_fence_frame,
+                                                struct reservation_object *resv)
+{
+        struct reservation_object_list *flist;
+        struct fence *fence_to_signal;
+        unsigned shared_fence_count;
+        unsigned blocking_fence_count;
+        unsigned i;
+        int ret;
+
+        flist = reservation_object_get_list(resv);
+        shared_fence_count = flist ? flist->shared_count : 0;
+
+        fence_to_signal = create_fence_to_signal(pvr_fence_frame);
+        if (!fence_to_signal)
+        {
+                return -ENOMEM;
+        }
+
+        if (!shared_fence_count)
+        {
+                struct fence *fence = reservation_object_get_excl(resv);
+
+                if (fence && is_blocking_fence(fence, pvr_fence_frame))
+                {
+                        if (allocate_blocking_fence_storage(pvr_fence_frame, 1))
+                        {       
+                                ret = install_and_get_blocking_fence(pvr_fence_frame, 0, fence);
+                        }
+                        else
+                        {
+                                fence_put(fence_to_signal);
+                                return -ENOMEM;
+                        }
+                }
+                else
+                {
+                        ret = 1;
+                }
+
+                reservation_object_add_excl_fence(resv, fence_to_signal);
+                return update_reservation_return_value(ret, true);
+        }
+
+        for (i = 0, blocking_fence_count = 0; i < shared_fence_count; i++)
+        {
+
+                struct fence *fence = rcu_dereference_protected(flist->shared[i], reservation_object_held(resv));
+
+                if (is_blocking_fence(fence, pvr_fence_frame))
+                {
+                        blocking_fence_count++;
+                }
+        }
+
+        ret = 1;
+        if (blocking_fence_count)
+        {
+                if (allocate_blocking_fence_storage(pvr_fence_frame, blocking_fence_count))
+                {
+                        for (i = 0; i < blocking_fence_count; i++)
+                        {
+                                struct fence *fence = rcu_dereference_protected(flist->shared[i], reservation_object_held(resv));
+
+                                if (is_blocking_fence(fence, pvr_fence_frame))
+                                {
+                                        if (!install_and_get_blocking_fence(pvr_fence_frame, i, fence))
+                                        {
+                                                ret = 0;
+                                        }
+                                }
+                        }
+                }
+                else
+                {
+                        fence_put(fence_to_signal);
+                        return -ENOMEM;
+                }
+        }
+
+        reservation_object_add_excl_fence(resv, fence_to_signal);
+        return update_reservation_return_value(ret, false);
+}
+
+static int update_reservation_object_fences_src(struct pvr_fence_frame *pvr_fence_frame,
+                                                struct reservation_object *resv)
+{
+        struct reservation_object_list *flist;
+        struct fence *fence_to_signal = NULL;
+        struct fence *blocking_fence = NULL;
+        bool reserve = true;
+        unsigned shared_fence_count;
+        unsigned i;
+        int ret;
+
+        flist = reservation_object_get_list(resv);
+        shared_fence_count = flist ? flist->shared_count : 0;
+
+        /*
+         * There can't be more than one shared fence for a given
+         * fence context, so if a PVR fence is already in the list,
+         * we don't need to reserve space for the new one, but need
+         * to block on it if it isn't ours.
+         */
+        for (i = 0; i < shared_fence_count; i++)
+        {
+                struct fence *fence = rcu_dereference_protected(flist->shared[i], reservation_object_held(resv));
+
+                if (is_pvr_fence(fence))
+                {
+                        reserve = false;
+
+                        if (is_blocking_fence(fence, pvr_fence_frame))
+                        {
+                                blocking_fence = fence;
+                        }
+                        break;
+                }
+        }
+
+        if (reserve)
+        {
+                ret = reservation_object_reserve_shared(resv);
+                if (ret)
+                {
+                        return ret;
+                }
+        }
+
+        fence_to_signal = create_fence_to_signal(pvr_fence_frame);
+        if (!fence_to_signal)
+        {
+                return -ENOMEM;
+        }
+
+        if (!blocking_fence && !shared_fence_count)
+        {
+                struct fence *fence = reservation_object_get_excl(resv);
+
+                if (fence && is_blocking_fence(fence, pvr_fence_frame))
+                {
+                        blocking_fence = fence;
+                }
+        }
+
+        if (blocking_fence)
+        {
+                if (allocate_blocking_fence_storage(pvr_fence_frame, 1))
+                {       
+                        ret = install_and_get_blocking_fence(pvr_fence_frame, 0, blocking_fence);
+                }
+                else
+                {
+                        ret = -ENOMEM;
+                        fence_put(fence_to_signal);
+                        return ret;
+                }
+        }
+        else
+        {
+                ret = 1;
+        }
+
+        reservation_object_add_shared_fence(resv, fence_to_signal);
+
+        return update_reservation_return_value(ret, !shared_fence_count);
+}
+
+/* Must be called with pvr_fence_context mutex held */
+static void destroy_fence_frame(struct pvr_fence_frame *pvr_fence_frame)
+{
+        unsigned i;
+
+        signal_and_put_fence(pvr_fence_frame);
+
+        for (i = 0; i < pvr_fence_frame->blocking_fence_count; i++)
+        {
+                uninstall_and_put_blocking_fence(pvr_fence_frame, i);
+        }
+        free_blocking_fence_storage(pvr_fence_frame);
+
+        list_del(&pvr_fence_frame->fence_frame_list);
+
+        kfree(pvr_fence_frame);
+}
+
+static inline bool sync_GE(const u32 a, const u32 b)
+{
+        return (a - b) < (U32_MAX / 2);
+}
+static inline bool sync_GT(const u32 a, const u32 b)
+{
+        return (a != b) && sync_GE(a, b);
+}
+
+static bool sync_is_ready(struct pvr_fence_frame *pvr_fence_frame)
+{
+        PVRSRV_KERNEL_SYNC_INFO *psSyncInfo = pvr_fence_frame->pvr_fence_context->psSyncInfo;
+
+        return (!pvr_fence_frame->is_dst ||
+                        sync_GE(psSyncInfo->psSyncData->ui32ReadOpsComplete,
+                                        pvr_fence_frame->ui32ReadOpsPending)) &&
+                                sync_GE(psSyncInfo->psSyncData->ui32ReadOps2Complete,
+                                        pvr_fence_frame->ui32ReadOps2Pending) &&
+                                sync_GE(psSyncInfo->psSyncData->ui32WriteOpsComplete,
+                                        pvr_fence_frame->ui32WriteOpsPending);
+}
+
+static bool sync_gpu_read_op_is_complete(struct pvr_fence_frame *pvr_fence_frame)
+{
+        PVRSRV_KERNEL_SYNC_INFO *psSyncInfo = pvr_fence_frame->pvr_fence_context->psSyncInfo;
+
+        return sync_GT(psSyncInfo->psSyncData->ui32ReadOpsComplete,
+                        pvr_fence_frame->ui32ReadOpsPending);
+}
+
+static bool sync_gpu_write_op_is_complete(struct pvr_fence_frame *pvr_fence_frame)
+{
+        PVRSRV_KERNEL_SYNC_INFO *psSyncInfo = pvr_fence_frame->pvr_fence_context->psSyncInfo;
+
+        return sync_GT(psSyncInfo->psSyncData->ui32WriteOpsComplete,
+                        pvr_fence_frame->ui32WriteOpsPending);
+}
+
+static void sync_complete_read_op(struct pvr_fence_frame *pvr_fence_frame)
+{
+        PVRSRV_KERNEL_SYNC_INFO *psSyncInfo = pvr_fence_frame->pvr_fence_context->psSyncInfo;
+
+        psSyncInfo->psSyncData->ui32ReadOps2Complete = ++pvr_fence_frame->ui32ReadOps2Pending;
+}
+
+static void sync_complete_write_op(struct pvr_fence_frame *pvr_fence_frame)
+{
+        PVRSRV_KERNEL_SYNC_INFO *psSyncInfo = pvr_fence_frame->pvr_fence_context->psSyncInfo;
+
+        psSyncInfo->psSyncData->ui32WriteOpsComplete = ++pvr_fence_frame->ui32WriteOpsPending;
+}
+
+static void do_fence_work(struct work_struct *work)
+{
+        struct pvr_fence_context *pvr_fence_context = container_of(work, struct pvr_fence_context, fence_work);
+        bool schedule_device_callbacks = false;
+
+        mutex_lock(&pvr_fence_context->mutex);
+        for(;;)
+        {
+                struct pvr_fence_frame *pvr_fence_frame;
+                bool reprocess = false;
+                bool next_frame = false;
+
+                pvr_fence_frame = list_first_entry_or_null(&pvr_fence_context->fence_frame_list, struct pvr_fence_frame, fence_frame_list);
+
+                if (pvr_fence_frame)
+                {
+                        if (!atomic_read(&pvr_fence_frame->blocking_count) && sync_is_ready(pvr_fence_frame))
+                        {
+                                schedule_device_callbacks = true;
+
+                                switch (pvr_fence_frame->blocked_on)
+                                {
+                                        case BLOCKED_ON_READ:
+                                                sync_complete_read_op(pvr_fence_frame);
+                                                pvr_fence_frame->blocked_on = 0;
+                                                reprocess = true;
+                                                break;
+                                        case BLOCKED_ON_WRITE:
+                                                sync_complete_write_op(pvr_fence_frame);
+                                                pvr_fence_frame->blocked_on = 0;
+                                                reprocess = true;
+                                                break;
+                                        default:
+                                                next_frame = pvr_fence_frame->is_dst ? sync_gpu_write_op_is_complete(pvr_fence_frame) : sync_gpu_read_op_is_complete(pvr_fence_frame);
+                                                break;
+                                }
+
+                                next_frame |= pvr_fence_frame->unblock;
+                        }
+                }
+
+                if (next_frame)
+                {
+                        destroy_fence_frame(pvr_fence_frame);
+                }
+                else
+                {
+                        if (!reprocess)
+                        {
+                                break;
+                        }
+                }
+
+        }
+        mutex_unlock(&pvr_fence_context->mutex);
+
+        if (schedule_device_callbacks)
+        {
+                PVRSRVScheduleDeviceCallbacks();
+        }
+
+}
+
+void PVRLinuxFenceContextDestroy(IMG_HANDLE hFenceContext)
+{
+
+        struct pvr_fence_context *pvr_fence_context = (struct pvr_fence_context *)hFenceContext;
+        struct list_head *entry, *temp;
+
+        mutex_lock(&pvr_fence_mutex);
+        mutex_lock(&pvr_fence_context->mutex);
+
+        list_del(&pvr_fence_context->fence_context_list);
+        if (!list_empty(&pvr_fence_context->fence_context_notify_list))
+        {
+                list_del(&pvr_fence_context->fence_context_notify_list);
+        }
+        mutex_unlock(&pvr_fence_mutex);
+
+        list_for_each_safe(entry, temp, &pvr_fence_context->fence_frame_list)
+        {
+                struct pvr_fence_frame *pvr_fence_frame = list_entry(entry, struct pvr_fence_frame, fence_frame_list);
+ 
+                destroy_fence_frame(pvr_fence_frame);
+        }
+
+        mutex_unlock(&pvr_fence_context->mutex);
+
+        flush_work(&pvr_fence_context->fence_work);
+
+        mutex_destroy(&pvr_fence_context->mutex);
+
+        DmaBufFreeNativeSyncHandle(pvr_fence_context->hNativeSync);
+
+        kfree(pvr_fence_context);
+}
+
+IMG_HANDLE PVRLinuxFenceContextCreate(PVRSRV_KERNEL_SYNC_INFO *psSyncInfo, IMG_HANDLE hImport)
+{
+        struct pvr_fence_context *pvr_fence_context;
+
+        pvr_fence_context = kzalloc(sizeof(*pvr_fence_context), GFP_KERNEL);
+        if (!pvr_fence_context)
+        {
+                return NULL;
+        }
+
+        pvr_fence_context->hNativeSync = DmaBufGetNativeSyncHandle(hImport);
+        if (!pvr_fence_context->hNativeSync)
+        {
+                kfree(pvr_fence_context);
+                return NULL;
+        }
+
+        INIT_LIST_HEAD(&pvr_fence_context->fence_frame_list);
+        INIT_LIST_HEAD(&pvr_fence_context->fence_context_list);
+        INIT_LIST_HEAD(&pvr_fence_context->fence_context_notify_list);
+
+        mutex_init(&pvr_fence_context->mutex);
+        
+        INIT_WORK(&pvr_fence_context->fence_work, do_fence_work);
+
+        pvr_fence_context->psSyncInfo = psSyncInfo;
+        mutex_lock(&pvr_fence_mutex);
+        list_add_tail(&pvr_fence_context->fence_context_list, &fence_context_list);
+        mutex_unlock(&pvr_fence_mutex);
+
+        return (IMG_HANDLE)pvr_fence_context;
+}
+
+static int process_reservation_object(struct pvr_fence_context *pvr_fence_context, struct reservation_object *resv, bool is_dst, u32 tag)
+{
+        PVRSRV_KERNEL_SYNC_INFO *psSyncInfo = pvr_fence_context->psSyncInfo;
+        struct pvr_fence_frame *pvr_fence_frame;
+        int ret;
+
+        pvr_fence_frame = kzalloc(sizeof(*pvr_fence_frame), GFP_KERNEL);
+        if (!pvr_fence_frame)
+        {
+                return -ENOMEM;
+        }
+
+        pvr_fence_frame->is_dst = is_dst;
+        pvr_fence_frame->tag = tag;
+        pvr_fence_frame->pvr_fence_context = pvr_fence_context;
+        INIT_LIST_HEAD(&pvr_fence_frame->fence_frame_list);
+
+        ret = is_dst ?
+                update_reservation_object_fences_dst(pvr_fence_frame, resv) :
+                update_reservation_object_fences_src(pvr_fence_frame, resv);
+        if (ret < 0)
+        {
+                kfree(pvr_fence_frame);
+                return ret;
+        }
+        else
+        {
+                pvr_fence_frame->blocked_on = ret;
+
+                pvr_fence_frame->ui32ReadOpsPending = psSyncInfo->psSyncData->ui32ReadOpsPending;
+
+                pvr_fence_frame->ui32ReadOps2Pending = (pvr_fence_frame->blocked_on == BLOCKED_ON_READ) ? SyncTakeReadOp2(psSyncInfo, SYNC_OP_CLASS_LINUX_FENCE) : psSyncInfo->psSyncData->ui32ReadOps2Pending;
+
+                pvr_fence_frame->ui32WriteOpsPending = (pvr_fence_frame->blocked_on == BLOCKED_ON_WRITE) ? SyncTakeWriteOp(psSyncInfo, SYNC_OP_CLASS_LINUX_FENCE) : psSyncInfo->psSyncData->ui32WriteOpsPending;
+
+                list_add_tail(&pvr_fence_frame->fence_frame_list, &pvr_fence_context->fence_frame_list);
+        }
+
+        return 0;
+}
+
+static int process_syncinfo(PVRSRV_KERNEL_SYNC_INFO *psSyncInfo, bool is_dst, u32 tag)
+{
+        struct pvr_fence_context *pvr_fence_context = (struct pvr_fence_context *)psSyncInfo->hFenceContext;
+        struct reservation_object *resv;
+        unsigned buf = 0;
+        int ret;
+
+        if (!pvr_fence_context)
+        {
+                return 0;
+        }
+
+        mutex_lock(&pvr_fence_context->mutex);
+        while ((resv = DmaBufGetReservationObject(pvr_fence_context->hNativeSync, buf++)))
+        {
+                ret = process_reservation_object(pvr_fence_context, resv, is_dst, tag);
+                if (ret)
+                {
+                        break;
+                }
+        }
+        mutex_unlock(&pvr_fence_context->mutex);
+
+        mutex_lock(&pvr_fence_mutex);
+        mutex_lock(&pvr_fence_context->mutex);
+        if (list_empty(&pvr_fence_context->fence_context_notify_list))
+        {
+                list_add_tail(&pvr_fence_context->fence_context_notify_list, &fence_context_notify_list);
+                queue_work(workqueue, &pvr_fence_context->fence_work);
+        }
+        mutex_unlock(&pvr_fence_context->mutex);
+        mutex_unlock(&pvr_fence_mutex);
+
+        return ret;
+}
+
+
+static inline bool sync_enabled(const IMG_BOOL *pbEnabled,
+                                const IMG_HANDLE *phSyncInfo,
+                                unsigned index)
+{
+        return (!pbEnabled || pbEnabled[index]) && phSyncInfo && phSyncInfo[index];
+}
+
+static unsigned count_reservation_objects(unsigned num_syncs,
+                                        IMG_HANDLE *phSyncInfo,
+                                        const IMG_BOOL *pbEnabled)
+{
+        unsigned i;
+        unsigned count = 0;
+
+        for (i = 0; i < num_syncs; i++)
+        {
+                PVRSRV_KERNEL_SYNC_INFO *psSyncInfo;
+                struct pvr_fence_context *pvr_fence_context;
+
+                if (!sync_enabled(pbEnabled, phSyncInfo, i))
+                {
+                        continue;
+                }
+
+                psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *)phSyncInfo[i];
+                pvr_fence_context = (struct pvr_fence_context *)psSyncInfo->hFenceContext;
+                if (pvr_fence_context)
+                {
+                        unsigned buf = 0;
+
+                        while (DmaBufGetReservationObject(pvr_fence_context->hNativeSync, buf++))
+                        {
+                                count++;
+                        }
+                }
+        }
+
+        return count;
+}
+
+static unsigned count_all_reservation_objects(IMG_UINT32 ui32NumSrcSyncs,
+                                        IMG_HANDLE *phSrcSyncInfo,
+                                        const IMG_BOOL *pbSrcEnabled,
+                                        IMG_UINT32 ui32NumDstSyncs,
+                                        IMG_HANDLE *phDstSyncInfo,
+                                        const IMG_BOOL *pbDstEnabled)
+{
+        return count_reservation_objects(ui32NumSrcSyncs,
+                                        phSrcSyncInfo,
+                                        pbSrcEnabled) +
+                        count_reservation_objects(ui32NumDstSyncs,
+                                                phDstSyncInfo,
+                                                pbDstEnabled);
+}
+
+static unsigned get_reservation_objects(unsigned num_resvs,
+                                        struct reservation_object **resvs,
+                                        unsigned num_syncs,
+                                        IMG_HANDLE *phSyncInfo,
+                                        const IMG_BOOL *pbEnabled)
+{
+        unsigned i;
+        unsigned count = 0;
+
+        for (i = 0; i < num_syncs; i++)
+        {
+                PVRSRV_KERNEL_SYNC_INFO *psSyncInfo;
+                struct pvr_fence_context *pvr_fence_context;
+                
+                if (!sync_enabled(pbEnabled, phSyncInfo, i))
+                {
+                        continue;
+                }
+
+                psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *)phSyncInfo[i];
+                pvr_fence_context = (struct pvr_fence_context *)psSyncInfo->hFenceContext;
+                if (pvr_fence_context)
+                {
+                        struct reservation_object *resv;
+                        unsigned buf = 0;
+
+                        while ((resv = DmaBufGetReservationObject(pvr_fence_context->hNativeSync, buf++)))
+                        {
+                                BUG_ON(count >= num_resvs);
+                                resvs[count++] = resv;
+                        }
+                }
+        }
+
+        return count;
+}
+
+static void get_all_reservation_objects(unsigned num_resvs,
+                                        struct reservation_object **resvs,
+                                        IMG_UINT32 ui32NumSrcSyncs,
+                                        IMG_HANDLE *phSrcSyncInfo,
+                                        const IMG_BOOL *pbSrcEnabled,
+                                        IMG_UINT32 ui32NumDstSyncs,
+                                        IMG_HANDLE *phDstSyncInfo,
+                                        const IMG_BOOL *pbDstEnabled)
+{
+        unsigned num_src_resvs;
+
+        num_src_resvs = get_reservation_objects(num_resvs,
+                                                resvs,
+                                                ui32NumSrcSyncs,
+                                                phSrcSyncInfo,
+                                                pbSrcEnabled);
+
+        get_reservation_objects(num_resvs - num_src_resvs, 
+                                        &resvs[num_src_resvs],
+                                        ui32NumDstSyncs,
+                                        phDstSyncInfo,
+                                        pbDstEnabled);
+}
+
+static void unlock_reservation_objects(unsigned num_resvs,
+                                        struct reservation_object **resvs)
+{
+        unsigned i;
+
+        for (i = 0; i < num_resvs; i++)
+        {
+                if (resvs[i])
+                {
+                        ww_mutex_unlock(&(resvs[i]->lock));
+                }
+        }
+}
+
+static int lock_reservation_objects_no_retry(struct ww_acquire_ctx *ww_acquire_ctx,
+                                                unsigned num_resvs,
+                                                struct reservation_object **resvs,
+                                                struct reservation_object **contended_resv)
+{
+        unsigned i;
+
+        for (i = 0; i < num_resvs; i++)
+        {
+                int ret;
+
+                if (!resvs[i])
+                {
+                        continue;
+                }
+                if (resvs[i] == *contended_resv)
+                {
+                        *contended_resv = NULL;
+                        continue;
+                }
+
+                ret = ww_mutex_lock_interruptible(&(resvs[i]->lock), ww_acquire_ctx);
+                if (ret)
+                {
+                        if (ret == -EALREADY)
+                        {
+                                resvs[i] = NULL;
+                                continue;
+                        }
+
+                        unlock_reservation_objects(i, resvs);
+
+                        if (*contended_resv)
+                        {
+                                ww_mutex_unlock(&((*contended_resv)->lock));
+                                *contended_resv = NULL;
+                        }
+
+                        if (ret == -EDEADLK)
+                        {
+                                *contended_resv = resvs[i];
+                        }
+
+                        return ret;
+                }
+        }
+
+        return 0;
+}
+
+static int lock_reservation_objects(struct ww_acquire_ctx *ww_acquire_ctx,
+                                        unsigned num_resvs,
+                                        struct reservation_object **resvs)
+{
+        int ret;
+        struct reservation_object *contended_resv = NULL;
+
+        do {
+                ret = lock_reservation_objects_no_retry(ww_acquire_ctx,
+                                                        num_resvs,
+                                                        resvs,
+                                                        &contended_resv);
+                if (ret == -EDEADLK)
+                {
+                        int res = ww_mutex_lock_slow_interruptible(&(contended_resv->lock), ww_acquire_ctx);
+                        if (res)
+                        {
+                                return res;
+                        }
+                }
+        } while (ret == -EDEADLK);
+
+        return ret;
+}
+
+static int process_syncinfos(u32 tag,
+                                bool is_dst,
+                                IMG_UINT32 ui32NumSyncs,
+                                IMG_HANDLE *phSyncInfo,
+                                const IMG_BOOL *pbEnabled)
+{
+        unsigned i;
+
+        for (i = 0; i < ui32NumSyncs; i++)
+        {
+                if (sync_enabled(pbEnabled, phSyncInfo, i))
+                {
+                        PVRSRV_KERNEL_SYNC_INFO *psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *)phSyncInfo[i];
+                        int ret;
+                                
+                        ret = process_syncinfo(psSyncInfo, is_dst, tag);
+                        if (ret)
+                        {
+                                break;
+                        }
+                }
+        }
+
+        return 0;
+}
+
+static int process_all_syncinfos(u32 tag,
+                                IMG_UINT32 ui32NumSrcSyncs,
+                                IMG_HANDLE *phSrcSyncInfo,
+                                const IMG_BOOL *pbSrcEnabled,
+                                IMG_UINT32 ui32NumDstSyncs,
+                                IMG_HANDLE *phDstSyncInfo,
+                                const IMG_BOOL *pbDstEnabled)
+{
+        int ret;
+
+        ret = process_syncinfos(tag,
+                                false,
+                                ui32NumSrcSyncs,
+                                phSrcSyncInfo,
+                                pbSrcEnabled);
+
+        if (ret)
+        {
+                return ret;
+        }
+
+        ret = process_syncinfos(tag,
+                                true,
+                                ui32NumDstSyncs,
+                                phDstSyncInfo,
+                                pbDstEnabled);
+
+        return ret;
+}
+
+static void unblock_frames(u32 tag,
+                                IMG_UINT32 ui32NumSyncs,
+                                IMG_HANDLE *phSyncInfo,
+                                const IMG_BOOL *pbEnabled)
+{
+        unsigned i;
+
+        for (i = 0; i < ui32NumSyncs; i++)
+        {
+                PVRSRV_KERNEL_SYNC_INFO *psSyncInfo;
+                struct pvr_fence_context *pvr_fence_context;
+                struct list_head *entry;
+
+                if (!sync_enabled(pbEnabled, phSyncInfo, i))
+                {
+                        continue;
+                }
+
+                psSyncInfo = (PVRSRV_KERNEL_SYNC_INFO *)phSyncInfo[i];
+                pvr_fence_context = (struct pvr_fence_context *)psSyncInfo->hFenceContext;
+                if (!pvr_fence_context)
+                {
+                        continue;
+                }
+
+
+                mutex_lock(&pvr_fence_context->mutex);
+
+                list_for_each(entry, &pvr_fence_context->fence_frame_list)
+                {
+                        struct pvr_fence_frame *pvr_fence_frame = list_entry(entry, struct pvr_fence_frame, fence_frame_list);
+ 
+                        if (pvr_fence_frame->tag == tag)
+                        {
+                                pvr_fence_frame->unblock = true;
+                        }
+                }
+
+                mutex_unlock(&pvr_fence_context->mutex);
+        }
+
+        return;
+}
+
+static void unblock_all_frames(u32 tag,
+                                IMG_UINT32 ui32NumSrcSyncs,
+                                IMG_HANDLE *phSrcSyncInfo,
+                                const IMG_BOOL *pbSrcEnabled,
+                                IMG_UINT32 ui32NumDstSyncs,
+                                IMG_HANDLE *phDstSyncInfo,
+                                const IMG_BOOL *pbDstEnabled)
+{
+        unblock_frames(tag,
+                        ui32NumSrcSyncs,
+                        phSrcSyncInfo,
+                        pbSrcEnabled);
+
+        unblock_frames(tag,
+                        ui32NumDstSyncs,
+                        phDstSyncInfo,
+                        pbDstEnabled);
+}
+
+static PVRSRV_ERROR pvr_error(int error)
+{
+        switch(error)
+        {
+                case 0:
+                        return PVRSRV_OK;
+                case -EINTR:
+                        return PVRSRV_ERROR_RETRY;
+                case -ENOMEM:
+                        return PVRSRV_ERROR_OUT_OF_MEMORY;
+                default:
+                        break;
+        }
+
+        return PVRSRV_ERROR_OUT_OF_MEMORY;
+}
+
+static u32 new_frame_tag(void)
+{
+        static u32 frame_tag;
+
+        return (++frame_tag) ? frame_tag : ++frame_tag;
+}
+
+PVRSRV_ERROR PVRLinuxFenceProcess(IMG_UINT32 *puTag,
+                                IMG_UINT32 ui32NumSrcSyncs,
+                                IMG_HANDLE *phSrcSyncInfo,
+                                const IMG_BOOL *pbSrcEnabled,
+                                IMG_UINT32 ui32NumDstSyncs,
+                                IMG_HANDLE *phDstSyncInfo,
+                                const IMG_BOOL *pbDstEnabled)
+{
+        u32 tag;
+        struct ww_acquire_ctx ww_acquire_ctx;
+        unsigned num_resvs;
+        struct reservation_object **resvs = NULL;
+        int ret;
+
+        num_resvs = count_all_reservation_objects(ui32NumSrcSyncs,
+                                                        phSrcSyncInfo,
+                                                        pbSrcEnabled,
+                                                        ui32NumDstSyncs,
+                                                        phDstSyncInfo,
+                                                        pbDstEnabled);
+        if (!num_resvs)
+        {
+                *puTag = 0;
+                ret = 0;
+                goto exit;
+        }
+        tag = new_frame_tag();
+
+        resvs = kmalloc(num_resvs * sizeof(*resvs), GFP_KERNEL);
+        if (!resvs)
+        {
+                ret = -ENOMEM;
+                goto exit;
+        }
+
+        get_all_reservation_objects(num_resvs,
+                                        resvs,
+                                        ui32NumSrcSyncs,
+                                        phSrcSyncInfo,
+                                        pbSrcEnabled,
+                                        ui32NumDstSyncs,
+                                        phDstSyncInfo,
+                                        pbDstEnabled);
+
+        ww_acquire_init(&ww_acquire_ctx, &reservation_ww_class);
+
+        ret = lock_reservation_objects(&ww_acquire_ctx, num_resvs, resvs);
+        if (ret)
+        {
+                ww_acquire_fini(&ww_acquire_ctx);
+                goto exit;
+        }
+        ww_acquire_done(&ww_acquire_ctx);
+
+        ret = process_all_syncinfos(tag,
+                                        ui32NumSrcSyncs,
+                                        phSrcSyncInfo,
+                                        pbSrcEnabled,
+                                        ui32NumDstSyncs,
+                                        phDstSyncInfo,
+                                        pbDstEnabled);
+
+        unlock_reservation_objects(num_resvs, resvs);
+
+        ww_acquire_fini(&ww_acquire_ctx);
+
+        if (ret)
+        {
+                unblock_all_frames(tag,
+                                        ui32NumSrcSyncs,
+                                        phSrcSyncInfo,
+                                        pbSrcEnabled,
+                                        ui32NumDstSyncs,
+                                        phDstSyncInfo,
+                                        pbDstEnabled);
+        }
+        else
+        {
+                *puTag = tag;
+        }
+
+exit:
+        if (resvs)
+        {
+                kfree(resvs);
+        }
+        return pvr_error(ret);
+
+}
+
+void PVRLinuxFenceRelease(IMG_UINT32 uTag,
+                                IMG_UINT32 ui32NumSrcSyncs,
+                                IMG_HANDLE *phSrcSyncInfo,
+                                const IMG_BOOL *pbSrcEnabled,
+                                IMG_UINT32 ui32NumDstSyncs,
+                                IMG_HANDLE *phDstSyncInfo,
+                                const IMG_BOOL *pbDstEnabled)
+{
+        if (uTag)
+        {
+                unblock_all_frames(uTag,
+                                ui32NumSrcSyncs,
+                                phSrcSyncInfo,
+                                pbSrcEnabled,
+                                ui32NumDstSyncs,
+                                phDstSyncInfo,
+                                pbDstEnabled);
+        }
+}
+
+static void check_frames(struct pvr_fence_context *pvr_fence_context)
+{
+        if (list_empty(&pvr_fence_context->fence_frame_list))
+        {
+                list_del_init(&pvr_fence_context->fence_context_notify_list);
+        }
+        else
+        {
+                queue_work(workqueue, &pvr_fence_context->fence_work);
+        }
+}
+
+void PVRLinuxFenceCheckAll(void)
+{
+        struct list_head *entry, *temp;
+
+        mutex_lock(&pvr_fence_mutex);
+        list_for_each_safe(entry, temp, &fence_context_notify_list)
+        {
+                struct pvr_fence_context *pvr_fence_context = list_entry(entry, struct pvr_fence_context, fence_context_notify_list);
+
+                mutex_lock(&pvr_fence_context->mutex);
+                check_frames(pvr_fence_context);
+                mutex_unlock(&pvr_fence_context->mutex);
+        }
+        mutex_unlock(&pvr_fence_mutex);
+}
+
+void PVRLinuxFenceDeInit(void)
+{
+        unsigned fences_remaining;
+        bool contexts_leaked;
+
+        if (workqueue)
+        {
+                destroy_workqueue(workqueue);
+        }
+
+        fences_remaining = atomic_read(&fences_outstanding);
+        if (fences_remaining)
+        {
+                printk(KERN_WARNING "%s: %u fences leaked\n",
+                                __func__, fences_remaining);
+        }
+
+#if defined(DEBUG)
+        printk(KERN_INFO "%s: %u fences allocated\n",
+                        __func__, atomic_read(&fences_allocated));
+
+        printk(KERN_INFO "%s: %u fences signalled\n",
+                        __func__, atomic_read(&fences_signalled));
+
+        printk(KERN_INFO "%s: %u callbacks installed\n",
+                        __func__, atomic_read(&callbacks_installed));
+
+        printk(KERN_INFO "%s: %u callbacks called\n",
+                        __func__, atomic_read(&callbacks_called));
+#endif
+
+        mutex_lock(&pvr_fence_mutex);
+        contexts_leaked = !list_empty(&fence_context_list);
+        mutex_unlock(&pvr_fence_mutex);
+
+        mutex_destroy(&pvr_fence_mutex);
+
+        BUG_ON(contexts_leaked);
+}
+
+int PVRLinuxFenceInit(void)
+{
+        workqueue = create_workqueue("PVR Linux Fence");
+        if (!workqueue)
+        {
+                return -ENOMEM;
+        }
+
+        fence_context = fence_context_alloc(1);
+
+        return 0;
+}
+#else   /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3,17)) */
+IMG_HANDLE PVRLinuxFenceContextCreate(PVRSRV_KERNEL_SYNC_INFO *psSyncInfo, IMG_HANDLE hImport)
+{
+        (void) psSyncInfo;
+        (void) hImport;
+
+        return (IMG_HANDLE)(IMG_UINTPTR_T)0xbad;
+}
+
+void PVRLinuxFenceContextDestroy(IMG_HANDLE hFenceContext)
+{
+        (void) hFenceContext;
+}
+
+PVRSRV_ERROR PVRLinuxFenceProcess(IMG_UINT32 *puTag,
+                                IMG_UINT32 ui32NumSrcSyncs,
+                                IMG_HANDLE *phSrcSyncInfo,
+                                const IMG_BOOL *pbSrcEnabled,
+                                IMG_UINT32 ui32NumDstSyncs,
+                                IMG_HANDLE *phDstSyncInfo,
+                                const IMG_BOOL *pbDstEnabled)
+{
+        (void) puTag;
+        (void) ui32NumSrcSyncs;
+        (void) phSrcSyncInfo;
+        (void) pbSrcEnabled;
+        (void) ui32NumDstSyncs;
+        (void) phDstSyncInfo;
+        (void) pbDstEnabled;
+
+        return PVRSRV_OK;
+}
+
+void PVRLinuxFenceRelease(IMG_UINT32 uTag,
+                                IMG_UINT32 ui32NumSrcSyncs,
+                                IMG_HANDLE *phSrcSyncInfo,
+                                const IMG_BOOL *pbSrcEnabled,
+                                IMG_UINT32 ui32NumDstSyncs,
+                                IMG_HANDLE *phDstSyncInfo,
+                                const IMG_BOOL *pbDstEnabled)
+{
+        (void) uTag;
+        (void) ui32NumSrcSyncs;
+        (void) phSrcSyncInfo;
+        (void) pbSrcEnabled;
+        (void) ui32NumDstSyncs;
+        (void) phDstSyncInfo;
+        (void) pbDstEnabled;
+}
+
+void PVRLinuxFenceCheckAll(void)
+{
+}
+
+int PVRLinuxFenceInit(void)
+{
+        return 0;
+}
+
+void PVRLinuxFenceDeInit(void)
+{
+}
+#endif  /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3,17)) */
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_linux_fence.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_linux_fence.h
new file mode 100644
index 0000000..156def1
--- /dev/null
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_linux_fence.h
@@ -0,0 +1,71 @@
+/*************************************************************************/ /*!
+@File
+@Title          PowerVR Linux fence interface
+@Copyright      Copyright (c) Imagination Technologies Ltd. All Rights Reserved
+@Description    drm module
+@License        Dual MIT/GPLv2
+
+The contents of this file are subject to the MIT license as set out below.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+Alternatively, the contents of this file may be used under the terms of
+the GNU General Public License Version 2 ("GPL") in which case the provisions
+of GPL are applicable instead of those above.
+
+If you wish to allow use of your version of this file only under the terms of
+GPL, and not to allow others to use your version of this file under the terms
+of the MIT license, indicate your decision by deleting the provisions above
+and replace them with the notice and other provisions required by GPL as set
+out in the file called "GPL-COPYING" included in this distribution. If you do
+not delete the provisions above, a recipient may use your version of this file
+under the terms of either the MIT license or GPL.
+
+This License is also included in this distribution in the file called
+"MIT-COPYING".
+
+EXCEPT AS OTHERWISE STATED IN A NEGOTIATED AGREEMENT: (A) THE SOFTWARE IS
+PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
+BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE AND NONINFRINGEMENT; AND (B) IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/ /**************************************************************************/
+
+#if !defined(__PVR_LINUX_FENCE_H__)
+#define __PVR_LINUX_FENCE_H__
+
+IMG_HANDLE PVRLinuxFenceContextCreate(PVRSRV_KERNEL_SYNC_INFO *psSyncInfo, IMG_HANDLE hImport);
+void PVRLinuxFenceContextDestroy(IMG_HANDLE hFenceContext);
+
+PVRSRV_ERROR PVRLinuxFenceProcess(IMG_UINT32 *puTag,
+                                IMG_UINT32 ui32NumSrcSyncs,
+                                IMG_HANDLE *phSrcSyncInfo,
+                                const IMG_BOOL *pbSrcEnabled,
+                                IMG_UINT32 ui32NumDstSyncs,
+                                IMG_HANDLE *phDstSyncInfo,
+                                const IMG_BOOL *pbDstEnabled);
+
+void PVRLinuxFenceRelease(IMG_UINT32 uTag,
+                                IMG_UINT32 ui32NumSrcSyncs,
+                                IMG_HANDLE *phSrcSyncInfo,
+                                const IMG_BOOL *pbSrcEnabled,
+                                IMG_UINT32 ui32NumDstSyncs,
+                                IMG_HANDLE *phDstSyncInfo,
+                                const IMG_BOOL *pbDstEnabled);
+
+void PVRLinuxFenceCheckAll(void);
+
+int PVRLinuxFenceInit(void);
+void PVRLinuxFenceDeInit(void);
+
+#endif /* !defined(__PVR_LINUX_FENCE_H__) */
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_sync.c b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_sync.c
index 476f0a8..235eaf3 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_sync.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/env/linux/pvr_sync.c
@@ -68,6 +68,26 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #define DPF(fmt, ...) do {} while(0)
 #endif
 
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0))
+
+static inline struct sync_timeline *sync_pt_parent(struct sync_pt *pt)
+{
+                return pt->parent;
+}
+
+#define for_each_sync_pt(s, f, c) \
+                (void)c; \
+list_for_each_entry((s), &(f)->pt_list_head, pt_list)
+
+#else /* (LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0)) */
+
+#define for_each_sync_pt(s, f, c) \
+                for ((c) = 0, (s) = (struct sync_pt *)(f)->cbs[0].sync_pt; \
+                                                (c) < (f)->num_fences; \
+                                                (c)++,   (s) = (struct sync_pt *)(f)->cbs[c].sync_pt)
+
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0)) */
+
 /* We can't support this code when the MISR runs in atomic context because
  * PVRSyncFreeSync() may be called by sync_timeline_signal() which may be
  * scheduled by the MISR. PVRSyncFreeSync() needs to protect the handle
@@ -402,7 +422,7 @@ static struct sync_pt *PVRSyncDup(struct sync_pt *sync_pt)
         struct PVR_SYNC *psPt, *psParentPt = (struct PVR_SYNC *)sync_pt;
 
         psPt = (struct PVR_SYNC *)
-                sync_pt_create(sync_pt->parent, sizeof(struct PVR_SYNC));
+                sync_pt_create(sync_pt_parent(sync_pt), sizeof(struct PVR_SYNC));
         if(!psPt)
         {
                 PVR_DPF((PVR_DBG_ERROR, "%s: sync_pt_create failed", __func__));
@@ -422,7 +442,7 @@ static int PVRSyncHasSignaled(struct sync_pt *sync_pt)
 {
         struct PVR_SYNC *psPt = (struct PVR_SYNC *)sync_pt;
         struct PVR_SYNC_TIMELINE *psTimeline =
-                (struct PVR_SYNC_TIMELINE *) sync_pt->parent;
+                (struct PVR_SYNC_TIMELINE *) sync_pt_parent(sync_pt);
         PVRSRV_SYNC_DATA *psSyncData =
                 psPt->psSyncData->psSyncInfo->psBase->psSyncData;
 
@@ -448,6 +468,7 @@ static int PVRSyncCompare(struct sync_pt *a, struct sync_pt *b)
                 return -1;
 }
 
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0))
 static void PVRSyncPrintTimeline(struct seq_file *s,
                                                                  struct sync_timeline *psObj)
 {
@@ -468,7 +489,7 @@ static void PVRSyncPrint(struct seq_file *s, struct sync_pt *psPt)
                                   psSync->psSyncData->ui64Stamp,
                                   atomic_read(&psSync->psSyncData->sRefcount),
                                   psSync->psSyncData->ui32WOPSnapshot,
-                                  psSync->pt.parent);
+                                  sync_pt_parent(&psSync->pt));
         seq_printf(s, "\n   WOP/WOC=0x%x/0x%x, "
                       "ROP/ROC=0x%x/0x%x, ROP2/ROC2=0x%x/0x%x, "
                       "WOC DevVA=0x%.8x, ROC DevVA=0x%.8x, "
@@ -483,6 +504,42 @@ static void PVRSyncPrint(struct seq_file *s, struct sync_pt *psPt)
                       psSyncInfo->sReadOpsCompleteDevVAddr.uiAddr,
                       psSyncInfo->sReadOps2CompleteDevVAddr.uiAddr);
 }
+#else /* (LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0)) */
+static void PVRSyncPrintTimeline(struct sync_timeline *psObj,
+                                                                        char *str, int size)
+{
+        struct PVR_SYNC_TIMELINE *psTimeline = (struct PVR_SYNC_TIMELINE *)psObj;
+
+        snprintf(str, size, "WOP/WOC=0x%x/0x%x",
+                   psTimeline->psSyncInfo->psBase->psSyncData->ui32WriteOpsPending,
+                   psTimeline->psSyncInfo->psBase->psSyncData->ui32WriteOpsComplete);
+}
+static void PVRSyncPrint(struct sync_pt *psPt, char *str, int size)
+{
+        struct PVR_SYNC *psSync = (struct PVR_SYNC *)psPt;
+        PVRSRV_KERNEL_SYNC_INFO *psSyncInfo =
+                psSync->psSyncData->psSyncInfo->psBase;
+
+        snprintf(str, size, "ID=%llu, refs=%u, WOPSnapshot=0x%x, parent=%p",
+                                  psSync->psSyncData->ui64Stamp,
+                                  atomic_read(&psSync->psSyncData->sRefcount),
+                                  psSync->psSyncData->ui32WOPSnapshot,
+                                  sync_pt_parent(&psSync->pt));//psSync->pt.parent);
+        snprintf(str, size, "\n   WOP/WOC=0x%x/0x%x, "
+                      "ROP/ROC=0x%x/0x%x, ROP2/ROC2=0x%x/0x%x, "
+                      "WOC DevVA=0x%.8x, ROC DevVA=0x%.8x, "
+                      "ROC2 DevVA=0x%.8x",
+                      psSyncInfo->psSyncData->ui32WriteOpsPending,
+                      psSyncInfo->psSyncData->ui32WriteOpsComplete,
+                      psSyncInfo->psSyncData->ui32ReadOpsPending,
+                      psSyncInfo->psSyncData->ui32ReadOpsComplete,
+                      psSyncInfo->psSyncData->ui32ReadOps2Pending,
+                      psSyncInfo->psSyncData->ui32ReadOps2Complete,
+                      psSyncInfo->sWriteOpsCompleteDevVAddr.uiAddr,
+                      psSyncInfo->sReadOpsCompleteDevVAddr.uiAddr,
+                      psSyncInfo->sReadOps2CompleteDevVAddr.uiAddr);
+}
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0)) */
 
 static void PVRSyncReleaseTimeline(struct sync_timeline *psObj)
 {
@@ -606,8 +663,13 @@ static struct sync_timeline_ops gsTimelineOps =
         .has_signaled           = PVRSyncHasSignaled,
         .compare                        = PVRSyncCompare,
         .release_obj            = PVRSyncReleaseTimeline,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0))
         .print_obj                      = PVRSyncPrintTimeline,
         .print_pt                       = PVRSyncPrint,
+#else /* (LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0)) */
+        .timeline_value_str = PVRSyncPrintTimeline,
+        .pt_value_str       = PVRSyncPrint,
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0)) */
         .free_pt                        = PVRSyncFreeSync,
 };
 
@@ -699,7 +761,7 @@ PVRSyncIOCTLCreate(struct PVR_SYNC_TIMELINE *psObj, void __user *pvData)
         struct PVR_SYNC_KERNEL_SYNC_INFO *psProvidedSyncInfo = NULL;
         struct PVR_ALLOC_SYNC_DATA *psAllocSyncData;
         struct PVR_SYNC_CREATE_IOCTL_DATA sData;
-        int err = -EFAULT, iFd = get_unused_fd();
+        int err = -EFAULT, iFd = get_unused_fd_flags(O_CLOEXEC);
         struct sync_fence *psFence;
         struct sync_pt *psPt;
 
@@ -809,8 +871,8 @@ PVRSyncIOCTLDebug(struct PVR_SYNC_TIMELINE *psObj, void __user *pvData)
 {
         struct PVR_SYNC_DEBUG_IOCTL_DATA sData;
         struct sync_fence *psFence;
-        struct list_head *psEntry;
-        int i = 0, err = -EFAULT;
+        struct sync_pt *sync_pt;
+        int i = 0, j, err = -EFAULT;
 
         if(!access_ok(VERIFY_READ, pvData, sizeof(sData)))
                 goto err_out;
@@ -825,7 +887,7 @@ PVRSyncIOCTLDebug(struct PVR_SYNC_TIMELINE *psObj, void __user *pvData)
                 goto err_out;
         }
 
-        list_for_each(psEntry, &psFence->pt_list_head)
+        for_each_sync_pt(sync_pt, psFence, j)
         {
                 PVR_SYNC_DEBUG *psMetaData = &sData.sSync[i].sMetaData;
                 PVRSRV_KERNEL_SYNC_INFO *psKernelSyncInfo;
@@ -840,14 +902,13 @@ PVRSyncIOCTLDebug(struct PVR_SYNC_TIMELINE *psObj, void __user *pvData)
                         break;
                 }
 
-                psPt = (struct PVR_SYNC *)
-                        container_of(psEntry, struct sync_pt, pt_list);
+                psPt = (struct PVR_SYNC *)sync_pt; 
 
                 /* Don't dump foreign points */
-                if(psPt->pt.parent->ops != &gsTimelineOps)
+                if(sync_pt_parent(&psPt->pt)->ops != &gsTimelineOps)
                         continue;
 
-                psTimeline = (struct PVR_SYNC_TIMELINE *)psPt->pt.parent;
+                psTimeline = (struct PVR_SYNC_TIMELINE *)sync_pt_parent(&psPt->pt);
                 psKernelSyncInfo = psPt->psSyncData->psSyncInfo->psBase;
                 PVR_ASSERT(psKernelSyncInfo != NULL);
 
@@ -923,7 +984,7 @@ static long
 PVRSyncIOCTLAlloc(struct PVR_SYNC_TIMELINE *psTimeline, void __user *pvData)
 {
         struct PVR_ALLOC_SYNC_DATA *psAllocSyncData;
-        int err = -EFAULT, iFd = get_unused_fd();
+        int err = -EFAULT, iFd = get_unused_fd_flags(O_CLOEXEC);
         struct PVR_SYNC_ALLOC_IOCTL_DATA sData;
         PVRSRV_SYNC_DATA *psSyncData;
         struct file *psFile;
@@ -1447,14 +1508,12 @@ CopyKernelSyncInfoToDeviceSyncObject(PVRSRV_KERNEL_SYNC_INFO *psSyncInfo,
 
 static IMG_BOOL FenceHasForeignPoints(struct sync_fence *psFence)
 {
-        struct list_head *psEntry;
+        struct sync_pt *psPt;
+        int j;
 
-        list_for_each(psEntry, &psFence->pt_list_head)
+        for_each_sync_pt(psPt, psFence, j)
         {
-                struct sync_pt *psPt =
-                        container_of(psEntry, struct sync_pt, pt_list);
-
-                if(psPt->parent->ops != &gsTimelineOps)
+                if(sync_pt_parent(psPt)->ops != &gsTimelineOps)
                         return IMG_TRUE;
         }
 
@@ -1495,13 +1554,13 @@ ExpandAndDeDuplicateFenceSyncs(IMG_UINT32 ui32NumSyncs,
 {
         IMG_UINT32 i, j, ui32FenceIndex = 0;
         IMG_BOOL bRet = IMG_TRUE;
+        struct sync_pt *psPt;
 
         *pui32NumRealSyncs = 0;
 
         for(i = 0; i < ui32NumSyncs; i++)
         {
                 PVRSRV_KERNEL_SYNC_INFO *psSyncInfo;
-                struct list_head *psEntry;
 
                 /* Skip any invalid fence file descriptors without error */
                 if(aiFenceFds[i] < 0)
@@ -1525,7 +1584,7 @@ ExpandAndDeDuplicateFenceSyncs(IMG_UINT32 ui32NumSyncs,
                  * patched in userspace. That's really a userspace driver bug, so
                  * just fail here instead of not synchronizing.
                  */
-                apsFence[ui32FenceIndex] = sync_fence_fdget(aiFenceFds[i]);
+                apsFence[ui32FenceIndex] = sync_fence_fdget((IMG_INT32)aiFenceFds[i]);
                 if(!apsFence[ui32FenceIndex])
                 {
                         PVR_DPF((PVR_DBG_ERROR, "%s: Failed to get fence from fd=%d",
@@ -1546,7 +1605,7 @@ ExpandAndDeDuplicateFenceSyncs(IMG_UINT32 ui32NumSyncs,
                  */
                 if(FenceHasForeignPoints(apsFence[ui32FenceIndex]))
                 {
-                        psSyncInfo = ForeignSyncPointToSyncInfo(aiFenceFds[i]);
+                        psSyncInfo = ForeignSyncPointToSyncInfo((IMG_INT32)aiFenceFds[i]);
                         if(psSyncInfo)
                         {
                                 if(!AddSyncInfoToArray(psSyncInfo, ui32SyncPointLimit,
@@ -1563,10 +1622,8 @@ ExpandAndDeDuplicateFenceSyncs(IMG_UINT32 ui32NumSyncs,
                 /* FIXME: The ForeignSyncPointToSyncInfo() path optimizes away already
                  *        signalled fences. Consider optimizing this path too.
                  */
-                list_for_each(psEntry, &apsFence[ui32FenceIndex]->pt_list_head)
+                for_each_sync_pt(psPt, apsFence[ui32FenceIndex], j)
                 {
-                        struct sync_pt *psPt =
-                                container_of(psEntry, struct sync_pt, pt_list);
 
                         psSyncInfo =
                                 ((struct PVR_SYNC *)psPt)->psSyncData->psSyncInfo->psBase;
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/hwdefs/sgxdefs.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/hwdefs/sgxdefs.h
index ed24647..7acba79 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/hwdefs/sgxdefs.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/hwdefs/sgxdefs.h
@@ -48,6 +48,9 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #if defined(SGX520)
 #include "sgx520defs.h"
 #else
+#if defined(SGX5300)
+#include "sgx5300defs.h"
+#else
 #if defined(SGX530)
 #include "sgx530defs.h"
 #else
@@ -88,6 +91,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #endif
 #endif
 #endif
+#endif
 
 #if defined(SGX_FEATURE_MP)
 #if defined(SGX554)
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/hwdefs/sgxerrata.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/hwdefs/sgxerrata.h
index 42c1f18..e423d4f 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/hwdefs/sgxerrata.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/hwdefs/sgxerrata.h
@@ -57,16 +57,40 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
         #if SGX_CORE_REV == 111
         #else
+        #if SGX_CORE_REV == 112
+        #else
         #if SGX_CORE_REV == SGX_CORE_REV_HEAD
                 /* RTL head - no BRNs to apply */
         #else
                 #error "sgxerrata.h: SGX520 Core Revision unspecified"
         #endif
         #endif
+        #endif
         /* signal that the Core Version has a valid definition */
         #define SGX_CORE_DEFINED
 #endif
 
+#if defined(SGX5300) && !defined(SGX_CORE_DEFINED)
+        /* define the _current_ SGX5300 RTL head revision */
+        #define SGX_CORE_REV_HEAD       0
+        #if defined(USE_SGX_CORE_REV_HEAD)
+                /* build config selects Core Revision to be the Head */
+                #define SGX_CORE_REV    SGX_CORE_REV_HEAD
+        #endif
+
+        #if SGX_CORE_REV == 112
+        #else
+        #if SGX_CORE_REV == SGX_CORE_REV_HEAD
+                /* RTL head - no BRNs to apply */
+        #else
+                #error "sgxerrata.h: SGX5300 Core Revision unspecified"
+        #endif
+        #endif
+        /* signal that the Core Version has a valid definition */
+        #define SGX_CORE_DEFINED
+
+#endif
+
 #if defined(SGX530) && !defined(SGX_CORE_DEFINED)
         /* define the _current_ SGX530 RTL head revision */
         #define SGX_CORE_REV_HEAD       0
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/hwdefs/sgxfeaturedefs.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/hwdefs/sgxfeaturedefs.h
index 9efce89..de07cc8 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/hwdefs/sgxfeaturedefs.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/hwdefs/sgxfeaturedefs.h
@@ -46,6 +46,16 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
         #define SGX_FEATURE_AUTOCLOCKGATING
         #define SGX_FEATURE_PT_CACHE_ENTRIES_PER_LINE                   (1)
 #else
+#if defined(SGX5300)
+        #define SGX_CORE_FRIENDLY_NAME                                                  "SGX5300"
+        #define SGX_CORE_ID                                                                             SGX_CORE_ID_5300
+        #define SGX_FEATURE_ADDRESS_SPACE_SIZE                                  (32)
+        #define SGX_FEATURE_ADDRESS_SPACE_EXTENSION
+        #define SGX_FEATURE_BIF_NUM_DIRLISTS                                    (16)
+        #define SGX_FEATURE_NUM_USE_PIPES                                               (1)
+        #define SGX_FEATURE_AUTOCLOCKGATING
+        #define SGX_FEATURE_PT_CACHE_ENTRIES_PER_LINE                   (1)
+#else
 #if defined(SGX530)
         #define SGX_CORE_FRIENDLY_NAME                                                  "SGX530"
         #define SGX_CORE_ID                                                                             SGX_CORE_ID_530
@@ -204,6 +214,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #endif
 #endif
 #endif
+#endif
 
 #if defined(SGX_FEATURE_SLAVE_VDM_CONTEXT_SWITCH) \
         || defined(SGX_FEATURE_MASTER_VDM_CONTEXT_SWITCH)
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/buffer_manager.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/buffer_manager.h
index 49d023e..a23529a 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/buffer_manager.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/buffer_manager.h
@@ -71,7 +71,7 @@ struct _BM_MAPPING_
                 hm_wrapped_virtaddr, /*!< wrapped user supplied contiguous with virtual address*/
                 hm_wrapped_scatter_virtaddr, /*!< wrapped user supplied scattered with virtual address*/
                 hm_env,                         /*!< obtained from environment */
-                hm_contiguous           /*!< contigous arena */
+                hm_contiguous           /*!< contiguous arena */
         } eCpuMemoryOrigin;
 
         BM_HEAP                         *pBMHeap;       /* which BM heap */
@@ -83,8 +83,13 @@ struct _BM_MAPPING_
         IMG_SYS_PHYADDR         *psSysAddr;
         IMG_SIZE_T                      uSize;
         IMG_SIZE_T                      uSizeVM;
-    IMG_HANDLE          hOSMemHandle;
+        IMG_HANDLE                      hOSMemHandle;
         IMG_UINT32                      ui32Flags;
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+        IMG_UINT32                      ui32TimeToDevMap;       /* Time taken (in microseconds) to map this memory in device MMU */
+        IMG_UINT32                      *pui32TimeToDevUnmap; /* Time taken (in microseconds) to unmap this memory from Device MMU.
+                                                                                                        NOTE - API user provided address to store this info, if at all  */
+#endif
 
         /* Sparse mapping data */
         IMG_UINT32                      ui32ChunkSize;
@@ -102,7 +107,7 @@ struct _BM_MAPPING_
 typedef struct _BM_BUF_
 {
         IMG_CPU_VIRTADDR        *CpuVAddr;
-    IMG_VOID            *hOSMemHandle;
+        IMG_VOID                        *hOSMemHandle;
         IMG_CPU_PHYADDR         CpuPAddr;
         IMG_DEV_VIRTADDR        DevVAddr;
 
@@ -178,8 +183,8 @@ typedef struct _XPROC_DATA_{
         IMG_UINT32 ui32AllocFlags;
         IMG_UINT32 ui32Size;
         IMG_UINT32 ui32PageSize;
-    RA_ARENA *psArena;
-    IMG_SYS_PHYADDR sSysPAddr;
+        RA_ARENA *psArena;
+        IMG_SYS_PHYADDR sSysPAddr;
         IMG_VOID *pvCpuVAddr;
         IMG_HANDLE hOSMemHandle;
 } XPROC_DATA;
@@ -272,7 +277,7 @@ BM_DestroyHeap (IMG_HANDLE hDevMemHeap);
  *  @Description
  *
  *  Reinitialises the buffer manager after a power event. Calling this
- *  function will reprogram MMU registers and renable the MMU.
+ *  function will reprogram MMU registers and re-enable the MMU.
  *
  *  @Input None
  *  @Return None
@@ -290,7 +295,7 @@ BM_Reinitialise (PVRSRV_DEVICE_NODE *psDeviceNode);
  *  maps.
  *
  *  @Input uSize - require size in bytes of the buffer.
- *  @Input/Output pui32Flags - bit mask of buffer property flags + recieves heap flags.
+ *  @Input/Output pui32Flags - bit mask of buffer property flags + receives heap flags.
  *  @Input uDevVAddrAlignment - required alignment in bytes, or 0.
  *  @Input pvPrivData - private data passed to OS allocator
  *  @Input ui32PrivDataLength - length of private data
@@ -298,6 +303,9 @@ BM_Reinitialise (PVRSRV_DEVICE_NODE *psDeviceNode);
  *  @Input ui32NumVirtChunks - Number of virtual chunks
  *  @Input ui32NumPhysChunks - Number of physical chunks
  *  @Input pabMapChunk - Chunk mapping array
+ *  @Output pui32TimeToDevMap - Available only when PVRSRV_DEVMEM_TIME_STATS defined,
+ *                              contains time taken (in microseconds) to map this buffer
+ *                              to Device MMU.
  *  @Output phBuf - receives the buffer handle.
  *  @Return IMG_TRUE - Success, IMG_FALSE - Failed.
  */
@@ -313,6 +321,9 @@ BM_Alloc (IMG_HANDLE			hDevMemHeap,
                         IMG_UINT32                      ui32NumVirtChunks,
                         IMG_UINT32                      ui32NumPhysChunks,
                         IMG_BOOL                        *pabMapChunk,
+                        #if defined (PVRSRV_DEVMEM_TIME_STATS)
+                        IMG_UINT32                      *pui32TimeToDevMap,
+                        #endif
                         BM_HANDLE                       *phBuf);
 
 /**
@@ -335,7 +346,7 @@ BM_Alloc (IMG_HANDLE			hDevMemHeap,
  */
 IMG_BOOL
 BM_Wrap (       IMG_HANDLE hDevMemHeap,
-                    IMG_SIZE_T uSize,
+                        IMG_SIZE_T uSize,
                         IMG_SIZE_T uOffset,
                         IMG_BOOL bPhysContig,
                         IMG_SYS_PHYADDR *psSysAddr,
@@ -351,11 +362,17 @@ BM_Wrap (	IMG_HANDLE hDevMemHeap,
  *  Free a buffer previously allocated via BM_Alloc.
  *
  *  @Input  hBuf - buffer handle.
+ *  @Output pui32TimeToDevUnmap - Time taken in us to "unmap"
+ *              the memory from Device MMU
  *  @Return None.
  */
 IMG_VOID
 BM_Free (BM_HANDLE hBuf,
-                IMG_UINT32 ui32Flags);
+                IMG_UINT32 ui32Flags
+                #if defined(PVRSRV_DEVMEM_TIME_STATS)
+                , IMG_UINT32 *pui32TimeToDevUnmap
+                #endif
+                );
 
 
 /**
@@ -416,7 +433,7 @@ BM_HandleToOSMemHandle (BM_HANDLE hBuf);
  *
  *  @Description
  *
- *  Retreive physical address backing dev V address
+ *  Retrieve physical address backing dev V address
  *
  *  @Input psMemInfo
  *  @Input sDevVPageAddr
@@ -544,8 +561,8 @@ IMG_UINT32 BM_GetVirtualSize(IMG_HANDLE hBMHandle);
 ******************************************************************************
  @Function      BM_MapPageAtOffset
 
- @Description   utility function check if the specificed offset in a BM mapping
-                is a page that needs tp be mapped
+ @Description   utility function check if the specified offset in a BM mapping
+                is a page that needs to be mapped
 
  @Input     hBMHandle - Handle to BM mapping
 
@@ -557,10 +574,10 @@ IMG_BOOL BM_MapPageAtOffset(IMG_HANDLE hBMHandle, IMG_UINT32 ui32Offset);
 
 /*!
 ******************************************************************************
- @Function      BM_VirtOffsetToPhyscial
+ @Function      BM_VirtOffsetToPhysical
 
  @Description   utility function find of physical offset of a sparse allocation
-                from it's virtual offset.
+                from its virtual offset.
 
  @Input     hBMHandle - Handle to BM mapping
 
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/dmabuf_sync.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/dmabuf_sync.h
new file mode 100644
index 0000000..066bbee
--- /dev/null
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/dmabuf_sync.h
@@ -0,0 +1,69 @@
+/*************************************************************************/ /*!
+@Title          Services dma_buf synchronisation integration
+@Copyright      Copyright (c) Imagination Technologies Ltd. All Rights Reserved
+@License        Dual MIT/GPLv2
+
+The contents of this file are subject to the MIT license as set out below.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+Alternatively, the contents of this file may be used under the terms of
+the GNU General Public License Version 2 ("GPL") in which case the provisions
+of GPL are applicable instead of those above.
+
+If you wish to allow use of your version of this file only under the terms of
+GPL, and not to allow others to use your version of this file under the terms
+of the MIT license, indicate your decision by deleting the provisions above
+and replace them with the notice and other provisions required by GPL as set
+out in the file called "GPL-COPYING" included in this distribution. If you do
+not delete the provisions above, a recipient may use your version of this file
+under the terms of either the MIT license or GPL.
+
+This License is also included in this distribution in the file called
+"MIT-COPYING".
+
+EXCEPT AS OTHERWISE STATED IN A NEGOTIATED AGREEMENT: (A) THE SOFTWARE IS
+PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
+BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE AND NONINFRINGEMENT; AND (B) IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/ /**************************************************************************/
+
+#include "img_defs.h"
+#include "img_types.h"
+#include "servicesint.h"
+
+#ifndef __DMABUF_SYNC_H__
+#define __DMABUF_SYNC_H__
+
+typedef struct _PVRSRV_DMABUF_SYNC_INFO_ {
+        PVRSRV_KERNEL_SYNC_INFO                 *psSyncInfo;
+        IMG_HANDLE                              hUnique;
+        IMG_UINT32                              ui32RefCount;
+        IMG_UINT64                              ui64Stamp;
+} PVRSRV_DMABUF_SYNC_INFO;
+
+PVRSRV_ERROR PVRSRVDmaBufSyncAcquire(IMG_HANDLE hUnique,
+                                                                                IMG_HANDLE hPriv,
+                                                                                IMG_HANDLE hDevCookie,
+                                                                                IMG_HANDLE hDevMemContext,
+                                                                                PVRSRV_DMABUF_SYNC_INFO **ppsDmaBufSyncInfo);
+
+IMG_VOID PVRSRVDmaBufSyncRelease(PVRSRV_DMABUF_SYNC_INFO *psDmaBufSyncInfo);
+
+static INLINE IMG_UINT64 DmaBufSyncGetStamp(PVRSRV_DMABUF_SYNC_INFO *psDmaBufSyncInfo)
+{
+        return psDmaBufSyncInfo->ui64Stamp;
+}
+
+#endif /* __DMABUF_SYNC_H__ */
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/external_sync.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/ion_sync.h
index 9b64d1e..8600a19 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/external_sync.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/ion_sync.h
@@ -43,31 +43,31 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #include "img_types.h"
 #include "servicesint.h"
 
-#ifndef __EXTERNAL_SYNC_H__
-#define __EXTERNAL_SYNC_H__
+#ifndef __ION_SYNC_H__
+#define __ION_SYNC_H__
 
-typedef struct _PVRSRV_EXTERNAL_SYNC_INFO_ {
+typedef struct _PVRSRV_ION_SYNC_INFO_ {
         PVRSRV_KERNEL_SYNC_INFO *psSyncInfo;
         IMG_HANDLE                              hUnique;
         IMG_UINT32                              ui32RefCount;
         IMG_UINT64                              ui64Stamp;
-} PVRSRV_EXTERNAL_SYNC_INFO;
+} PVRSRV_ION_SYNC_INFO;
 
-PVRSRV_ERROR PVRSRVExternalBufferSyncAcquire(IMG_HANDLE hUnique,
+PVRSRV_ERROR PVRSRVIonBufferSyncAcquire(IMG_HANDLE hUnique,
                                                                                 IMG_HANDLE hDevCookie,
                                                                                 IMG_HANDLE hDevMemContext,
-                                                                                PVRSRV_EXTERNAL_SYNC_INFO **ppsExternalSyncInfo);
+                                                                                PVRSRV_ION_SYNC_INFO **ppsIonSyncInfo);
 
-IMG_VOID PVRSRVExternalBufferSyncRelease(PVRSRV_EXTERNAL_SYNC_INFO *psExternalSyncInfo);
+IMG_VOID PVRSRVIonBufferSyncRelease(PVRSRV_ION_SYNC_INFO *psIonSyncInfo);
 
-static INLINE PVRSRV_KERNEL_SYNC_INFO *ExternalBufferSyncGetKernelSyncInfo(PVRSRV_EXTERNAL_SYNC_INFO *psExternalSyncInfo)
+static INLINE PVRSRV_KERNEL_SYNC_INFO *IonBufferSyncGetKernelSyncInfo(PVRSRV_ION_SYNC_INFO *psIonSyncInfo)
 {
-        return psExternalSyncInfo->psSyncInfo;
+        return psIonSyncInfo->psSyncInfo;
 }
 
-static INLINE IMG_UINT64 ExternalBufferSyncGetStamp(PVRSRV_EXTERNAL_SYNC_INFO *psExternalSyncInfo)
+static INLINE IMG_UINT64 IonBufferSyncGetStamp(PVRSRV_ION_SYNC_INFO *psIonSyncInfo)
 {
-        return psExternalSyncInfo->ui64Stamp;
+        return psIonSyncInfo->ui64Stamp;
 }
 
-#endif /* __EXTERNAL_SYNC_H__ */
+#endif /* __ION_SYNC_H__ */
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/osfunc.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/osfunc.h
index 9bb772c..6db5b2e 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/osfunc.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/osfunc.h
@@ -83,8 +83,15 @@ extern "C" {
 #define PVRSRV_OS_HEAP_MASK                     0xf /* host heap flags mask */
 #define PVRSRV_OS_PAGEABLE_HEAP         0x1 /* allocation pageable */
 #define PVRSRV_OS_NON_PAGEABLE_HEAP     0x2 /* allocation non pageable */
+#if defined (__linux__) && defined(DEBUG_LINUX_MEMORY_ALLOCATIONS)
+#define PVRSRV_SWAP_BUFFER_ALLOCATION   0x4 /* allocation for swap buffer */
+#else
+#define PVRSRV_SWAP_BUFFER_ALLOCATION   0x0
+#endif
 
-
+#if defined (PVRSRV_DEVMEM_TIME_STATS)
+IMG_UINT64 OSClockMonotonicus(IMG_VOID);
+#endif
 IMG_UINT32 OSClockus(IMG_VOID);
 IMG_UINT32 OSGetPageSize(IMG_VOID);
 PVRSRV_ERROR OSInstallDeviceLISR(IMG_VOID *pvSysData,
@@ -521,6 +528,12 @@ PVRSRV_ERROR OSUnmapPhysToUserSpace(IMG_HANDLE hDevCookie,
 
 PVRSRV_ERROR OSLockResource(PVRSRV_RESOURCE *psResource, IMG_UINT32 ui32ID);
 PVRSRV_ERROR OSUnlockResource(PVRSRV_RESOURCE *psResource, IMG_UINT32 ui32ID);
+
+#if !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__)
+PVRSRV_ERROR OSLockResourceAndBlockMISR(PVRSRV_RESOURCE *psResource, IMG_UINT32 ui32ID);
+PVRSRV_ERROR OSUnlockResourceAndUnblockMISR(PVRSRV_RESOURCE *psResource, IMG_UINT32 ui32ID);
+#endif /* !defined(PVR_LINUX_USING_WORKQUEUES) && defined(__linux__) */
+
 IMG_BOOL OSIsResourceLocked(PVRSRV_RESOURCE *psResource, IMG_UINT32 ui32ID);
 PVRSRV_ERROR OSCreateResource(PVRSRV_RESOURCE *psResource);
 PVRSRV_ERROR OSDestroyResource(PVRSRV_RESOURCE *psResource);
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/refcount.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/refcount.h
index 0f015b5..95493b7 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/refcount.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/refcount.h
@@ -43,9 +43,12 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #define __REFCOUNT_H__
 
 #include "pvr_bridge_km.h"
-#if defined(SUPPORT_DRM_GEM) || defined(SUPPORT_ION)
-#include "external_sync.h"
-#endif /* defined(SUPPORT_DRM_GEM) || defined(SUPPORT_ION) */
+#if defined(SUPPORT_ION)
+#include "ion_sync.h"
+#endif /* defined(SUPPORT_ION) */
+#if defined(SUPPORT_DMABUF)
+#include "dmabuf_sync.h"
+#endif /* defined(SUPPORT_DMABUF) */
 
 #if defined(PVRSRV_REFCOUNT_DEBUG)
 
@@ -114,23 +117,42 @@ void PVRSRVOffsetStructIncMapped2(const IMG_CHAR *pszFile, IMG_INT iLine,
 void PVRSRVOffsetStructDecMapped2(const IMG_CHAR *pszFile, IMG_INT iLine,
                                                                   PKV_OFFSET_STRUCT psOffsetStruct);
 
-#if defined(SUPPORT_DRM_GEM) || defined(SUPPORT_ION)
-#define PVRSRVExternalBufferSyncInfoIncRef(x...) \
-        PVRSRVExternalBufferSyncInfoIncRef2(__FILE__, __LINE__, x)
-#define PVRSRVExternalBufferSyncInfoDecRef(x...) \
-        PVRSRVExternalBufferSyncInfoDecRef2(__FILE__, __LINE__, x)
+#if defined(SUPPORT_ION)
+#define PVRSRVIonBufferSyncInfoIncRef(x...) \
+        PVRSRVIonBufferSyncInfoIncRef2(__FILE__, __LINE__, x)
+#define PVRSRVIonBufferSyncInfoDecRef(x...) \
+        PVRSRVIonBufferSyncInfoDecRef2(__FILE__, __LINE__, x)
 
-PVRSRV_ERROR PVRSRVExternalBufferSyncInfoIncRef2(const IMG_CHAR *pszFile, IMG_INT iLine,
+PVRSRV_ERROR PVRSRVIonBufferSyncInfoIncRef2(const IMG_CHAR *pszFile, IMG_INT iLine,
                                                                                         IMG_HANDLE hUnique,
                                                                                         IMG_HANDLE hDevCookie,
                                                                                         IMG_HANDLE hDevMemContext,
-                                                                                        PVRSRV_EXTERNAL_SYNC_INFO **ppsIonSyncInfo,
+                                                                                        PVRSRV_ION_SYNC_INFO **ppsIonSyncInfo,
                                                                                         PVRSRV_KERNEL_MEM_INFO *psKernelMemInfo);
-void PVRSRVExternalBufferSyncInfoDecRef2(const IMG_CHAR *pszFile, IMG_INT iLine,
-                                                                        PVRSRV_EXTERNAL_SYNC_INFO *psIonSyncInfo,
+void PVRSRVIonBufferSyncInfoDecRef2(const IMG_CHAR *pszFile, IMG_INT iLine,
+                                                                        PVRSRV_ION_SYNC_INFO *psIonSyncInfo,
                                                                         PVRSRV_KERNEL_MEM_INFO *psKernelMemInfo);
 #endif /* defined (SUPPORT_ION) */
 
+#if defined(SUPPORT_DMABUF)
+#define PVRSRVDmaBufSyncInfoIncRef(x...) \
+        PVRSRVDmaBufSyncInfoIncRef2(__FILE__, __LINE__, x)
+#define PVRSRVDmaBufSyncInfoDecRef(x...) \
+        PVRSRVDmaBufSyncInfoDecRef2(__FILE__, __LINE__, x)
+
+PVRSRV_ERROR PVRSRVDmaBufSyncInfoIncRef2(const IMG_CHAR *pszFile, IMG_INT iLine,
+                                                                                        IMG_HANDLE hUnique,
+                                                                                        IMG_HANDLE hPriv,
+                                                                                        IMG_HANDLE hDevCookie,
+                                                                                        IMG_HANDLE hDevMemContext,
+                                                                                        PVRSRV_DMABUF_SYNC_INFO **ppsDmaBufSyncInfo,
+                                                                                        PVRSRV_KERNEL_MEM_INFO *psKernelMemInfo);
+
+void PVRSRVDmaBufSyncInfoDecRef2(const IMG_CHAR *pszFile, IMG_INT iLine,
+                                                                        PVRSRV_DMABUF_SYNC_INFO *psDmaBufSyncInfo,
+                                                                        PVRSRV_KERNEL_MEM_INFO *psKernelMemInfo);
+#endif /* defined (SUPPORT_DMABUF) */
+
 #endif /* defined(__linux__) */
 
 #else /* defined(PVRSRV_REFCOUNT_DEBUG) */
@@ -216,29 +238,54 @@ static INLINE void PVRSRVOffsetStructDecMapped(PKV_OFFSET_STRUCT psOffsetStruct)
         psOffsetStruct->ui32Mapped--;
 }
 
-#if defined(SUPPORT_DRM_GEM) || defined(SUPPORT_ION)
-static INLINE PVRSRV_ERROR PVRSRVExternalBufferSyncInfoIncRef(IMG_HANDLE hUnique,
+#if defined(SUPPORT_ION)
+static INLINE PVRSRV_ERROR PVRSRVIonBufferSyncInfoIncRef(IMG_HANDLE hUnique,
                                                                                                                  IMG_HANDLE hDevCookie,
                                                                                                                  IMG_HANDLE hDevMemContext,
-                                                                                                                 PVRSRV_EXTERNAL_SYNC_INFO **ppsIonSyncInfo,
+                                                                                                                 PVRSRV_ION_SYNC_INFO **ppsIonSyncInfo,
                                                                                                                  PVRSRV_KERNEL_MEM_INFO *psKernelMemInfo)
 {
         PVR_UNREFERENCED_PARAMETER(psKernelMemInfo);
 
-        return PVRSRVExternalBufferSyncAcquire(hUnique,
+        return PVRSRVIonBufferSyncAcquire(hUnique,
                                                                           hDevCookie,
                                                                           hDevMemContext,
                                                                           ppsIonSyncInfo);
 }
 
-static INLINE void PVRSRVExternalBufferSyncInfoDecRef(PVRSRV_EXTERNAL_SYNC_INFO *psIonSyncInfo,
+static INLINE void PVRSRVIonBufferSyncInfoDecRef(PVRSRV_ION_SYNC_INFO *psIonSyncInfo,
                                                                                    PVRSRV_KERNEL_MEM_INFO *psKernelMemInfo)
 {
         PVR_UNREFERENCED_PARAMETER(psKernelMemInfo);
-        PVRSRVExternalBufferSyncRelease(psIonSyncInfo);
+        PVRSRVIonBufferSyncRelease(psIonSyncInfo);
 }
 #endif  /* defined (SUPPORT_ION) */
 
+#if defined(SUPPORT_DMABUF)
+static INLINE PVRSRV_ERROR PVRSRVDmaBufSyncInfoIncRef(IMG_HANDLE hUnique,
+                                                                                                                 IMG_HANDLE hPriv,
+                                                                                                                 IMG_HANDLE hDevCookie,
+                                                                                                                 IMG_HANDLE hDevMemContext,
+                                                                                                                 PVRSRV_DMABUF_SYNC_INFO **ppsDmaBufSyncInfo,
+                                                                                                                 PVRSRV_KERNEL_MEM_INFO *psKernelMemInfo)
+{
+        PVR_UNREFERENCED_PARAMETER(psKernelMemInfo);
+
+        return PVRSRVDmaBufSyncAcquire(hUnique,
+                                                                          hPriv,
+                                                                          hDevCookie,
+                                                                          hDevMemContext,
+                                                                          ppsDmaBufSyncInfo);
+}
+
+static INLINE void PVRSRVDmaBufSyncInfoDecRef(PVRSRV_DMABUF_SYNC_INFO *psDmaBufSyncInfo,
+                                                                                   PVRSRV_KERNEL_MEM_INFO *psKernelMemInfo)
+{
+        PVR_UNREFERENCED_PARAMETER(psKernelMemInfo);
+        PVRSRVDmaBufSyncRelease(psDmaBufSyncInfo);
+}
+#endif  /* defined (SUPPORT_DMABUF) */
+
 #endif /* defined(__linux__) */
 
 #endif /* defined(PVRSRV_REFCOUNT_DEBUG) */
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/resman.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/resman.h
index 75e09a9..14af110 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/resman.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/resman.h
@@ -80,7 +80,7 @@ enum {
         RESMAN_TYPE_DEVICEMEM_WRAP,                                             /*!< Device Memory Wrap Resource */
         RESMAN_TYPE_DEVICEMEM_ALLOCATION,                               /*!< Device Memory Allocation Resource */
         RESMAN_TYPE_DEVICEMEM_ION,                                              /*!< Device Memory Ion Resource */
-        RESMAN_TYPE_DEVICEMEM_DMABUF,                                   /*!< Device Memory Dmabuf Resource */
+        RESMAN_TYPE_DEVICEMEM_DMABUF,                                           /*!< Device Memory dma-buf Resource */
         RESMAN_TYPE_EVENT_OBJECT,                                               /*!< Event Object */
     RESMAN_TYPE_SHARED_MEM_INFO,                    /*!< Shared system memory meminfo */
     RESMAN_TYPE_MODIFY_SYNC_OPS,                                        /*!< Syncobject synchronisation Resource*/
diff --git a/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/srvkm.h b/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/srvkm.h
index 45ac3b1..723037e 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/srvkm.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/srvkm/include/srvkm.h
@@ -81,7 +81,7 @@ extern "C" {
 #define SYNC_OP_CLASS_KICKTA            (1<<2)
 #define SYNC_OP_CLASS_TQ_3D                     (1<<3)
 #define SYNC_OP_CLASS_TQ_2D                     (1<<4)
-
+#define SYNC_OP_CLASS_LINUX_FENCE               (1<<5)
 #define SYNC_OP_TYPE_MASK                       0x00f0000UL
 #define SYNC_OP_TYPE_SHIFT                      16
 #define SYNC_OP_TYPE_READOP                     (1<<0)
diff --git a/jacinto6/sgx_src/eurasia_km/services4/system/omap/sgxfreq.c b/jacinto6/sgx_src/eurasia_km/services4/system/omap/sgxfreq.c
index 5159fd4..6e5571e 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/system/omap/sgxfreq.c
+++ b/jacinto6/sgx_src/eurasia_km/services4/system/omap/sgxfreq.c
@@ -346,8 +346,8 @@ err1:
 #endif
 #endif
 noerr:
-        return ret;
-    }
+                return ret;
+        }
         return ret;
 }
 
@@ -356,7 +356,7 @@ static struct sgxfreq_governor *__find_governor(const char *name)
         struct sgxfreq_governor *t;
 
         list_for_each_entry(t, &sfd.gov_list, governor_list)
-                if (!strnicmp(name, t->name, SGXFREQ_NAME_LEN))
+                if (!strncasecmp(name, t->name, SGXFREQ_NAME_LEN))
                         return t;
 
         return NULL;
@@ -441,16 +441,16 @@ int sgxfreq_init(struct device *dev)
                 return -EINVAL;
 #endif
 
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
         rcu_read_lock();
 
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
         sfd.freq_cnt = sfd.pdata->opp_get_opp_count(dev);
 #else
-        ret = of_init_opp_table(dev);
-        if (ret) {
-                pr_err("sgxfreq: failed to init OPP table: %d\n", ret);
+        ret = of_init_opp_table(dev);
+        if (ret) {
+                pr_err("sgxfreq: failed to init OPP table: %d\n", ret);
                 return -EINVAL;
-        }
+        }
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,14,0))
         sfd.freq_cnt = opp_get_opp_count(dev);
 #else
@@ -459,9 +459,7 @@ int sgxfreq_init(struct device *dev)
 #endif
         if (sfd.freq_cnt < 1) {
                 pr_err("sgxfreq: failed to get operating frequencies\n");
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
                 rcu_read_unlock();
-#endif
                 return -ENODEV;
         }
 
@@ -487,9 +485,7 @@ int sgxfreq_init(struct device *dev)
 #endif
         sfd.freq_list = kmalloc(sfd.freq_cnt * sizeof(unsigned long), GFP_ATOMIC);
         if (!sfd.freq_list) {
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
                 rcu_read_unlock();
-#endif
                 return -ENOMEM;
         }
 
@@ -504,18 +500,14 @@ int sgxfreq_init(struct device *dev)
                 opp = dev_pm_opp_find_freq_ceil(dev, &freq);
 #endif
                 if (IS_ERR_OR_NULL(opp)) {
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
                         rcu_read_unlock();
-#endif
                         kfree(sfd.freq_list);
                         return -ENODEV;
                 }
                 sfd.freq_list[i] = freq;
                 freq++;
         }
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
         rcu_read_unlock();
-#endif
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,8,0))
         sfd.core_clk = devm_clk_get(dev, "dpll_core_h14x2_ck");
diff --git a/jacinto6/sgx_src/eurasia_km/services4/system/omap/sysconfig.h b/jacinto6/sgx_src/eurasia_km/services4/system/omap/sysconfig.h
index faff7df..cd60ced 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/system/omap/sysconfig.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/system/omap/sysconfig.h
@@ -90,6 +90,9 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #define DEVICE_DISP_INTERRUPT           (1<<2)
 
 #if defined(__linux__)
+#if defined(PVR_LDM_DEVICE_TREE)
+#define SYS_SGX_DEV_NAME        "ti,dra7-sgx544"
+#else
 /*
  * Recent OMAP4 kernels register SGX as platform device "omap_gpu".
  * This device must be used with the Linux power management calls
@@ -100,6 +103,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #else
 #define SYS_SGX_DEV_NAME        "omap_gpu"
 #endif  /* defined(PVR_LDM_PLATFORM_PRE_REGISTERED_DEV) */
+#endif  /* defined(PVR_LDM_DEVICE_TREE) */
 #endif  /* defined(__linux__) */
 
 /*****************************************************************************
diff --git a/jacinto6/sgx_src/eurasia_km/services4/system/omap/syslocal.h b/jacinto6/sgx_src/eurasia_km/services4/system/omap/syslocal.h
index ba312d6..bddbf6f 100644
--- a/jacinto6/sgx_src/eurasia_km/services4/system/omap/syslocal.h
+++ b/jacinto6/sgx_src/eurasia_km/services4/system/omap/syslocal.h
@@ -84,7 +84,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #endif
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,13))
 #include <plat/gpu.h>
 #endif
 #if !defined(PVR_NO_OMAP_TIMER)
@@ -93,10 +93,6 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #endif
 #endif
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,8,0))
-#include <linux/wakelock.h>
-#endif
-
 #if !defined(PVR_NO_OMAP_TIMER)
 #define PVR_OMAP_TIMER_BASE_IN_SYS_SPEC_DATA
 #endif
@@ -193,9 +189,6 @@ typedef struct _SYS_SPECIFIC_DATA_TAG_
 #if defined(PVR_OMAP_USE_DM_TIMER_API)
         struct omap_dm_timer *psGPTimer;
 #endif
-#if defined(CONFIG_HAS_WAKELOCK)
-        struct wake_lock wake_lock;
-#endif /* CONFIG_HAS_WAKELOCK */
 #endif  /* defined(__linux__) */
 } SYS_SPECIFIC_DATA;
 
diff --git a/jacinto6/sgx_src/eurasia_km/tools/intern/debug/dbgdriv/common/dbgdriv.c b/jacinto6/sgx_src/eurasia_km/tools/intern/debug/dbgdriv/common/dbgdriv.c
index 848367a..8450046 100644
--- a/jacinto6/sgx_src/eurasia_km/tools/intern/debug/dbgdriv/common/dbgdriv.c
+++ b/jacinto6/sgx_src/eurasia_km/tools/intern/debug/dbgdriv/common/dbgdriv.c
@@ -864,7 +864,7 @@ static void Write(PDBG_STREAM psStream,IMG_PUINT8 pui8Data,IMG_UINT32 ui32InBuff
  @param         bNewLine - line wrapping
  @return        none
 *****************************************************************************/
-void MonoOut(IMG_CHAR * pszString,IMG_BOOL bNewLine)
+void MonoOut(const IMG_CHAR * pszString,IMG_BOOL bNewLine)
 {
 #if defined (_WIN64)
         PVR_UNREFERENCED_PARAMETER(pszString);
@@ -1054,7 +1054,7 @@ IMG_VOID * IMG_CALLCONV DBGDrivCreateStream(IMG_CHAR *		pszName,
         PDBG_STREAM_CONTROL psCtrl;
         IMG_UINT32              ui32Off;
         IMG_VOID *              pvBase; 
-        static IMG_CHAR pszNameInitSuffix[] = "_Init";
+        static const IMG_CHAR pszNameInitSuffix[] = "_Init";
         IMG_UINT32              ui32OffSuffix;
 
         /*
@@ -1072,18 +1072,31 @@ IMG_VOID * IMG_CALLCONV DBGDrivCreateStream(IMG_CHAR *		pszName,
                 Allocate memory for control structures
         */
         psStream = HostNonPageablePageAlloc(1);
+        if (!psStream)
+        {
+                PVR_DPF((PVR_DBG_ERROR,"DBGDriv: Couldn't alloc Stream\n\r"));
+                goto exit_stream_alloc_failed;
+        }
+        
         psInitStream = HostNonPageablePageAlloc(1);
+        if (!psInitStream)
+        {
+                PVR_DPF((PVR_DBG_ERROR,"DBGDriv: Couldn't alloc InitStream\n\r"));
+                goto exit_stream_init_alloc_failed;
+        }
+
         psLFBuffer = HostNonPageablePageAlloc(1);
+        if (!psLFBuffer)
+        {
+                PVR_DPF((PVR_DBG_ERROR,"DBGDriv: Couldn't alloc LFBuffer\n\r"));
+                goto exit_lfbuffer_alloc_failed;
+        }
+
         psCtrl = HostNonPageablePageAlloc(1);
-        if      (
-                        (!psStream) ||
-                        (!psInitStream) ||
-                        (!psLFBuffer) ||
-                        (!psCtrl)
-                )
+        if (!psCtrl)
         {
-                PVR_DPF((PVR_DBG_ERROR,"DBGDriv: Couldn't alloc control structs\n\r"));
-                return((IMG_VOID *) 0);
+                PVR_DPF((PVR_DBG_ERROR,"DBGDriv: Couldn't alloc Ctrl struct\n\r"));
+                goto exit_ctrl_alloc_failed;
         }
 
         /* Allocate memory for buffer */
@@ -1099,8 +1112,7 @@ IMG_VOID * IMG_CALLCONV DBGDrivCreateStream(IMG_CHAR *		pszName,
         if (!pvBase)
         {
                 PVR_DPF((PVR_DBG_ERROR,"DBGDriv: Couldn't alloc Stream buffer\n\r"));
-                HostNonPageablePageFree(psStream);
-                return((IMG_VOID *) 0);
+                goto exit_stream_buffer_failed;
         }
 
         /* Setup control state */
@@ -1151,8 +1163,7 @@ IMG_VOID * IMG_CALLCONV DBGDrivCreateStream(IMG_CHAR *		pszName,
                 {
                         HostPageablePageFree(psStream->pvBase);
                 }
-                HostNonPageablePageFree(psStream);
-                return((IMG_VOID *) 0);
+                goto exit_stream_buffer_failed;
         }
 
         /* Initialise the stream for the init phase */
@@ -1216,6 +1227,17 @@ IMG_VOID * IMG_CALLCONV DBGDrivCreateStream(IMG_CHAR *		pszName,
         AddSIDEntry(psStream);
         
         return((IMG_VOID *) psStream);
+
+exit_stream_buffer_failed:
+        HostNonPageablePageFree(psCtrl);
+exit_ctrl_alloc_failed:
+        HostNonPageablePageFree(psLFBuffer);
+exit_lfbuffer_alloc_failed:
+        HostNonPageablePageFree(psInitStream);
+exit_stream_init_alloc_failed:
+        HostNonPageablePageFree(psStream);
+exit_stream_alloc_failed:
+        return((IMG_VOID *) 0);
 }
 
 /*!****************************************************************************
@@ -1388,7 +1410,7 @@ IMG_VOID * IMG_CALLCONV DBGDrivFindStream(IMG_CHAR * pszName, IMG_BOOL bResetStr
 
         if(bResetStream && psStream)
         {
-                static IMG_CHAR szComment[] = "-- Init phase terminated\r\n";
+                static const IMG_CHAR szComment[] = "-- Init phase terminated\r\n";
                 psStream->psInitStream->ui32RPtr = 0;
                 psStream->ui32RPtr = 0;
                 psStream->ui32WPtr = 0;
diff --git a/jacinto6/sgx_src/eurasia_km/tools/intern/debug/dbgdriv/common/dbgdriv.h b/jacinto6/sgx_src/eurasia_km/tools/intern/debug/dbgdriv/common/dbgdriv.h
index e56d881..8aaf6d6 100644
--- a/jacinto6/sgx_src/eurasia_km/tools/intern/debug/dbgdriv/common/dbgdriv.h
+++ b/jacinto6/sgx_src/eurasia_km/tools/intern/debug/dbgdriv/common/dbgdriv.h
@@ -103,7 +103,7 @@ IMG_UINT32 AtoI(IMG_CHAR *szIn);
 
 IMG_VOID HostMemSet(IMG_VOID *pvDest,IMG_UINT8 ui8Value,IMG_UINT32 ui32Size);
 IMG_VOID HostMemCopy(IMG_VOID *pvDest,IMG_VOID *pvSrc,IMG_UINT32 ui32Size);
-IMG_VOID MonoOut(IMG_CHAR * pszString,IMG_BOOL bNewLine);
+IMG_VOID MonoOut(const IMG_CHAR * pszString,IMG_BOOL bNewLine);
 
 /*****************************************************************************
  Secure handle Function prototypes
diff --git a/jacinto6/sgx_src/eurasia_km/tools/intern/debug/dbgdriv/linux/main.c b/jacinto6/sgx_src/eurasia_km/tools/intern/debug/dbgdriv/linux/main.c
index b35cac4..2cf310c 100644
--- a/jacinto6/sgx_src/eurasia_km/tools/intern/debug/dbgdriv/linux/main.c
+++ b/jacinto6/sgx_src/eurasia_km/tools/intern/debug/dbgdriv/linux/main.c
@@ -277,6 +277,7 @@ long dbgdrv_ioctl(struct file *file, unsigned int ioctlCmd, unsigned long arg)
                 psStream = SID2PStream(psReadInParams->hStream);
                 if(!psStream)
                 {
+                        vfree(ui8Tmp);
                         goto init_failed;
                 }