Merge branch 'wip-2.6.34' into old-private-masterarchived-private-master

64 files changed, 6532 insertions, 642 deletions

diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index df1f86b5c83e..0d0d625fece2 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -13,6 +13,20 @@ menuconfig MISC_DEVICES
 
 if MISC_DEVICES
 
+config AD525X_DPOT
+        tristate "Analog Devices AD525x Digital Potentiometers"
+        depends on I2C && SYSFS
+        help
+          If you say yes here, you get support for the Analog Devices
+          AD5258, AD5259, AD5251, AD5252, AD5253, AD5254 and AD5255
+          digital potentiometer chips.
+
+          See Documentation/misc-devices/ad525x_dpot.txt for the
+          userspace interface.
+
+          This driver can also be built as a module.  If so, the module
+          will be called ad525x_dpot.
+
 config ATMEL_PWM
         tristate "Atmel AT32/AT91 PWM support"
         depends on AVR32 || ARCH_AT91SAM9263 || ARCH_AT91SAM9RL || ARCH_AT91CAP9
@@ -173,6 +187,40 @@ config SGI_XP
           this feature will allow for direct communication between SSIs
           based on a network adapter and DMA messaging.
 
+config CS5535_MFGPT
+        tristate "CS5535/CS5536 Geode Multi-Function General Purpose Timer (MFGPT) support"
+        depends on PCI
+        depends on X86
+        default n
+        help
+          This driver provides access to MFGPT functionality for other
+          drivers that need timers.  MFGPTs are available in the CS5535 and
+          CS5536 companion chips that are found in AMD Geode and several
+          other platforms.  They have a better resolution and max interval
+          than the generic PIT, and are suitable for use as high-res timers.
+          You probably don't want to enable this manually; other drivers that
+          make use of it should enable it.
+
+config CS5535_MFGPT_DEFAULT_IRQ
+        int
+        depends on CS5535_MFGPT
+        default 7
+        help
+          MFGPTs on the CS5535 require an interrupt.  The selected IRQ
+          can be overridden as a module option as well as by driver that
+          use the cs5535_mfgpt_ API; however, different architectures might
+          want to use a different IRQ by default.  This is here for
+          architectures to set as necessary.
+
+config CS5535_CLOCK_EVENT_SRC
+        tristate "CS5535/CS5536 high-res timer (MFGPT) events"
+        depends on GENERIC_TIME && GENERIC_CLOCKEVENTS && CS5535_MFGPT
+        help
+          This driver provides a clock event source based on the MFGPT
+          timer(s) in the CS5535 and CS5536 companion chips.
+          MFGPTs have a better resolution and max interval than the
+          generic PIT, and are suitable for use as high-res timers.
+
 config HP_ILO
         tristate "Channel interface driver for HP iLO/iLO2 processor"
         depends on PCI
@@ -210,19 +258,6 @@ config SGI_GRU_DEBUG
         This option enables addition debugging code for the SGI GRU driver. If
         you are unsure, say N.
 
-config DELL_LAPTOP
-        tristate "Dell Laptop Extras (EXPERIMENTAL)"
-        depends on X86
-        depends on DCDBAS
-        depends on EXPERIMENTAL
-        depends on BACKLIGHT_CLASS_DEVICE
-        depends on RFKILL
-        depends on POWER_SUPPLY
-        default n
-        ---help---
-        This driver adds support for rfkill and backlight control to Dell
-        laptops.
-
 config ISL29003
         tristate "Intersil ISL29003 ambient light sensor"
         depends on I2C && SYSFS
@@ -233,6 +268,16 @@ config ISL29003
           This driver can also be built as a module.  If so, the module
           will be called isl29003.
 
+config SENSORS_TSL2550
+        tristate "Taos TSL2550 ambient light sensor"
+        depends on I2C && SYSFS
+        help
+          If you say yes here you get support for the Taos TSL2550
+          ambient light sensor.
+
+          This driver can also be built as a module.  If so, the module
+          will be called tsl2550.
+
 config EP93XX_PWM
         tristate "EP93xx PWM support"
         depends on ARCH_EP93XX
@@ -246,8 +291,45 @@ config EP93XX_PWM
           To compile this driver as a module, choose M here: the module will
           be called ep93xx_pwm.
 
+config DS1682
+        tristate "Dallas DS1682 Total Elapsed Time Recorder with Alarm"
+        depends on I2C && EXPERIMENTAL
+        help
+          If you say yes here you get support for Dallas Semiconductor
+          DS1682 Total Elapsed Time Recorder.
+
+          This driver can also be built as a module.  If so, the module
+          will be called ds1682.
+
+config TI_DAC7512
+        tristate "Texas Instruments DAC7512"
+        depends on SPI && SYSFS
+        help
+          If you say yes here you get support for the Texas Instruments
+          DAC7512 16-bit digital-to-analog converter.
+
+          This driver can also be built as a module. If so, the module
+          will be calles ti_dac7512.
+
+config VMWARE_BALLOON
+        tristate "VMware Balloon Driver"
+        depends on X86
+        help
+          This is VMware physical memory management driver which acts
+          like a "balloon" that can be inflated to reclaim physical pages
+          by reserving them in the guest and invalidating them in the
+          monitor, freeing up the underlying machine pages so they can
+          be allocated to other guests. The balloon can also be deflated
+          to allow the guest to use more physical memory.
+
+          If unsure, say N.
+
+          To compile this driver as a module, choose M here: the
+          module will be called vmware_balloon.
+
 source "drivers/misc/c2port/Kconfig"
 source "drivers/misc/eeprom/Kconfig"
 source "drivers/misc/cb710/Kconfig"
+source "drivers/misc/iwmc3200top/Kconfig"
 
 endif # MISC_DEVICES
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index f982d2ecfde7..7b6f7eefdf8d 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -4,6 +4,7 @@
 
 obj-$(CONFIG_IBM_ASM)           += ibmasm/
 obj-$(CONFIG_HDPU_FEATURES)     += hdpuftrs/
+obj-$(CONFIG_AD525X_DPOT)       += ad525x_dpot.o
 obj-$(CONFIG_ATMEL_PWM)         += atmel_pwm.o
 obj-$(CONFIG_ATMEL_SSC)         += atmel-ssc.o
 obj-$(CONFIG_ATMEL_TCLIB)       += atmel_tclib.o
@@ -17,9 +18,15 @@ obj-$(CONFIG_ENCLOSURE_SERVICES) += enclosure.o
 obj-$(CONFIG_KGDB_TESTS)        += kgdbts.o
 obj-$(CONFIG_SGI_XP)            += sgi-xp/
 obj-$(CONFIG_SGI_GRU)           += sgi-gru/
+obj-$(CONFIG_CS5535_MFGPT)      += cs5535-mfgpt.o
 obj-$(CONFIG_HP_ILO)            += hpilo.o
 obj-$(CONFIG_ISL29003)          += isl29003.o
+obj-$(CONFIG_SENSORS_TSL2550)   += tsl2550.o
 obj-$(CONFIG_EP93XX_PWM)        += ep93xx_pwm.o
+obj-$(CONFIG_DS1682)            += ds1682.o
+obj-$(CONFIG_TI_DAC7512)        += ti_dac7512.o
 obj-$(CONFIG_C2PORT)            += c2port/
+obj-$(CONFIG_IWMC3200TOP)      += iwmc3200top/
 obj-y                           += eeprom/
 obj-y                           += cb710/
+obj-$(CONFIG_VMWARE_BALLOON)    += vmware_balloon.o
diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c
new file mode 100644
index 000000000000..30a59f2bacd2
--- /dev/null
+++ b/drivers/misc/ad525x_dpot.c
@@ -0,0 +1,666 @@
+/*
+ * ad525x_dpot: Driver for the Analog Devices AD525x digital potentiometers
+ * Copyright (c) 2009 Analog Devices, Inc.
+ * Author: Michael Hennerich <hennerich@blackfin.uclinux.org>
+ *
+ * DEVID                #Wipers         #Positions      Resistor Options (kOhm)
+ * AD5258               1               64              1, 10, 50, 100
+ * AD5259               1               256             5, 10, 50, 100
+ * AD5251               2               64              1, 10, 50, 100
+ * AD5252               2               256             1, 10, 50, 100
+ * AD5255               3               512             25, 250
+ * AD5253               4               64              1, 10, 50, 100
+ * AD5254               4               256             1, 10, 50, 100
+ *
+ * See Documentation/misc-devices/ad525x_dpot.txt for more info.
+ *
+ * derived from ad5258.c
+ * Copyright (c) 2009 Cyber Switching, Inc.
+ * Author: Chris Verges <chrisv@cyberswitching.com>
+ *
+ * derived from ad5252.c
+ * Copyright (c) 2006 Michael Hennerich <hennerich@blackfin.uclinux.org>
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/delay.h>
+
+#define DRIVER_NAME                     "ad525x_dpot"
+#define DRIVER_VERSION                  "0.1"
+
+enum dpot_devid {
+        AD5258_ID,
+        AD5259_ID,
+        AD5251_ID,
+        AD5252_ID,
+        AD5253_ID,
+        AD5254_ID,
+        AD5255_ID,
+};
+
+#define AD5258_MAX_POSITION             64
+#define AD5259_MAX_POSITION             256
+#define AD5251_MAX_POSITION             64
+#define AD5252_MAX_POSITION             256
+#define AD5253_MAX_POSITION             64
+#define AD5254_MAX_POSITION             256
+#define AD5255_MAX_POSITION             512
+
+#define AD525X_RDAC0            0
+#define AD525X_RDAC1            1
+#define AD525X_RDAC2            2
+#define AD525X_RDAC3            3
+
+#define AD525X_REG_TOL          0x18
+#define AD525X_TOL_RDAC0        (AD525X_REG_TOL | AD525X_RDAC0)
+#define AD525X_TOL_RDAC1        (AD525X_REG_TOL | AD525X_RDAC1)
+#define AD525X_TOL_RDAC2        (AD525X_REG_TOL | AD525X_RDAC2)
+#define AD525X_TOL_RDAC3        (AD525X_REG_TOL | AD525X_RDAC3)
+
+/* RDAC-to-EEPROM Interface Commands */
+#define AD525X_I2C_RDAC         (0x00 << 5)
+#define AD525X_I2C_EEPROM       (0x01 << 5)
+#define AD525X_I2C_CMD          (0x80)
+
+#define AD525X_DEC_ALL_6DB      (AD525X_I2C_CMD | (0x4 << 3))
+#define AD525X_INC_ALL_6DB      (AD525X_I2C_CMD | (0x9 << 3))
+#define AD525X_DEC_ALL          (AD525X_I2C_CMD | (0x6 << 3))
+#define AD525X_INC_ALL          (AD525X_I2C_CMD | (0xB << 3))
+
+static s32 ad525x_read(struct i2c_client *client, u8 reg);
+static s32 ad525x_write(struct i2c_client *client, u8 reg, u8 value);
+
+/*
+ * Client data (each client gets its own)
+ */
+
+struct dpot_data {
+        struct mutex update_lock;
+        unsigned rdac_mask;
+        unsigned max_pos;
+        unsigned devid;
+};
+
+/* sysfs functions */
+
+static ssize_t sysfs_show_reg(struct device *dev,
+                              struct device_attribute *attr, char *buf, u32 reg)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct dpot_data *data = i2c_get_clientdata(client);
+        s32 value;
+
+        mutex_lock(&data->update_lock);
+        value = ad525x_read(client, reg);
+        mutex_unlock(&data->update_lock);
+
+        if (value < 0)
+                return -EINVAL;
+        /*
+         * Let someone else deal with converting this ...
+         * the tolerance is a two-byte value where the MSB
+         * is a sign + integer value, and the LSB is a
+         * decimal value.  See page 18 of the AD5258
+         * datasheet (Rev. A) for more details.
+         */
+
+        if (reg & AD525X_REG_TOL)
+                return sprintf(buf, "0x%04x\n", value & 0xFFFF);
+        else
+                return sprintf(buf, "%u\n", value & data->rdac_mask);
+}
+
+static ssize_t sysfs_set_reg(struct device *dev,
+                             struct device_attribute *attr,
+                             const char *buf, size_t count, u32 reg)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct dpot_data *data = i2c_get_clientdata(client);
+        unsigned long value;
+        int err;
+
+        err = strict_strtoul(buf, 10, &value);
+        if (err)
+                return err;
+
+        if (value > data->rdac_mask)
+                value = data->rdac_mask;
+
+        mutex_lock(&data->update_lock);
+        ad525x_write(client, reg, value);
+        if (reg & AD525X_I2C_EEPROM)
+                msleep(26);     /* Sleep while the EEPROM updates */
+        mutex_unlock(&data->update_lock);
+
+        return count;
+}
+
+static ssize_t sysfs_do_cmd(struct device *dev,
+                            struct device_attribute *attr,
+                            const char *buf, size_t count, u32 reg)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct dpot_data *data = i2c_get_clientdata(client);
+
+        mutex_lock(&data->update_lock);
+        ad525x_write(client, reg, 0);
+        mutex_unlock(&data->update_lock);
+
+        return count;
+}
+
+/* ------------------------------------------------------------------------- */
+
+static ssize_t show_rdac0(struct device *dev,
+                          struct device_attribute *attr, char *buf)
+{
+        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_RDAC | AD525X_RDAC0);
+}
+
+static ssize_t set_rdac0(struct device *dev,
+                         struct device_attribute *attr,
+                         const char *buf, size_t count)
+{
+        return sysfs_set_reg(dev, attr, buf, count,
+                             AD525X_I2C_RDAC | AD525X_RDAC0);
+}
+
+static DEVICE_ATTR(rdac0, S_IWUSR | S_IRUGO, show_rdac0, set_rdac0);
+
+static ssize_t show_eeprom0(struct device *dev,
+                            struct device_attribute *attr, char *buf)
+{
+        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_EEPROM | AD525X_RDAC0);
+}
+
+static ssize_t set_eeprom0(struct device *dev,
+                           struct device_attribute *attr,
+                           const char *buf, size_t count)
+{
+        return sysfs_set_reg(dev, attr, buf, count,
+                             AD525X_I2C_EEPROM | AD525X_RDAC0);
+}
+
+static DEVICE_ATTR(eeprom0, S_IWUSR | S_IRUGO, show_eeprom0, set_eeprom0);
+
+static ssize_t show_tolerance0(struct device *dev,
+                               struct device_attribute *attr, char *buf)
+{
+        return sysfs_show_reg(dev, attr, buf,
+                              AD525X_I2C_EEPROM | AD525X_TOL_RDAC0);
+}
+
+static DEVICE_ATTR(tolerance0, S_IRUGO, show_tolerance0, NULL);
+
+/* ------------------------------------------------------------------------- */
+
+static ssize_t show_rdac1(struct device *dev,
+                          struct device_attribute *attr, char *buf)
+{
+        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_RDAC | AD525X_RDAC1);
+}
+
+static ssize_t set_rdac1(struct device *dev,
+                         struct device_attribute *attr,
+                         const char *buf, size_t count)
+{
+        return sysfs_set_reg(dev, attr, buf, count,
+                             AD525X_I2C_RDAC | AD525X_RDAC1);
+}
+
+static DEVICE_ATTR(rdac1, S_IWUSR | S_IRUGO, show_rdac1, set_rdac1);
+
+static ssize_t show_eeprom1(struct device *dev,
+                            struct device_attribute *attr, char *buf)
+{
+        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_EEPROM | AD525X_RDAC1);
+}
+
+static ssize_t set_eeprom1(struct device *dev,
+                           struct device_attribute *attr,
+                           const char *buf, size_t count)
+{
+        return sysfs_set_reg(dev, attr, buf, count,
+                             AD525X_I2C_EEPROM | AD525X_RDAC1);
+}
+
+static DEVICE_ATTR(eeprom1, S_IWUSR | S_IRUGO, show_eeprom1, set_eeprom1);
+
+static ssize_t show_tolerance1(struct device *dev,
+                               struct device_attribute *attr, char *buf)
+{
+        return sysfs_show_reg(dev, attr, buf,
+                              AD525X_I2C_EEPROM | AD525X_TOL_RDAC1);
+}
+
+static DEVICE_ATTR(tolerance1, S_IRUGO, show_tolerance1, NULL);
+
+/* ------------------------------------------------------------------------- */
+
+static ssize_t show_rdac2(struct device *dev,
+                          struct device_attribute *attr, char *buf)
+{
+        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_RDAC | AD525X_RDAC2);
+}
+
+static ssize_t set_rdac2(struct device *dev,
+                         struct device_attribute *attr,
+                         const char *buf, size_t count)
+{
+        return sysfs_set_reg(dev, attr, buf, count,
+                             AD525X_I2C_RDAC | AD525X_RDAC2);
+}
+
+static DEVICE_ATTR(rdac2, S_IWUSR | S_IRUGO, show_rdac2, set_rdac2);
+
+static ssize_t show_eeprom2(struct device *dev,
+                            struct device_attribute *attr, char *buf)
+{
+        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_EEPROM | AD525X_RDAC2);
+}
+
+static ssize_t set_eeprom2(struct device *dev,
+                           struct device_attribute *attr,
+                           const char *buf, size_t count)
+{
+        return sysfs_set_reg(dev, attr, buf, count,
+                             AD525X_I2C_EEPROM | AD525X_RDAC2);
+}
+
+static DEVICE_ATTR(eeprom2, S_IWUSR | S_IRUGO, show_eeprom2, set_eeprom2);
+
+static ssize_t show_tolerance2(struct device *dev,
+                               struct device_attribute *attr, char *buf)
+{
+        return sysfs_show_reg(dev, attr, buf,
+                              AD525X_I2C_EEPROM | AD525X_TOL_RDAC2);
+}
+
+static DEVICE_ATTR(tolerance2, S_IRUGO, show_tolerance2, NULL);
+
+/* ------------------------------------------------------------------------- */
+
+static ssize_t show_rdac3(struct device *dev,
+                          struct device_attribute *attr, char *buf)
+{
+        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_RDAC | AD525X_RDAC3);
+}
+
+static ssize_t set_rdac3(struct device *dev,
+                         struct device_attribute *attr,
+                         const char *buf, size_t count)
+{
+        return sysfs_set_reg(dev, attr, buf, count,
+                             AD525X_I2C_RDAC | AD525X_RDAC3);
+}
+
+static DEVICE_ATTR(rdac3, S_IWUSR | S_IRUGO, show_rdac3, set_rdac3);
+
+static ssize_t show_eeprom3(struct device *dev,
+                            struct device_attribute *attr, char *buf)
+{
+        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_EEPROM | AD525X_RDAC3);
+}
+
+static ssize_t set_eeprom3(struct device *dev,
+                           struct device_attribute *attr,
+                           const char *buf, size_t count)
+{
+        return sysfs_set_reg(dev, attr, buf, count,
+                             AD525X_I2C_EEPROM | AD525X_RDAC3);
+}
+
+static DEVICE_ATTR(eeprom3, S_IWUSR | S_IRUGO, show_eeprom3, set_eeprom3);
+
+static ssize_t show_tolerance3(struct device *dev,
+                               struct device_attribute *attr, char *buf)
+{
+        return sysfs_show_reg(dev, attr, buf,
+                              AD525X_I2C_EEPROM | AD525X_TOL_RDAC3);
+}
+
+static DEVICE_ATTR(tolerance3, S_IRUGO, show_tolerance3, NULL);
+
+static struct attribute *ad525x_attributes_wipers[4][4] = {
+        {
+                &dev_attr_rdac0.attr,
+                &dev_attr_eeprom0.attr,
+                &dev_attr_tolerance0.attr,
+                NULL
+        }, {
+                &dev_attr_rdac1.attr,
+                &dev_attr_eeprom1.attr,
+                &dev_attr_tolerance1.attr,
+                NULL
+        }, {
+                &dev_attr_rdac2.attr,
+                &dev_attr_eeprom2.attr,
+                &dev_attr_tolerance2.attr,
+                NULL
+        }, {
+                &dev_attr_rdac3.attr,
+                &dev_attr_eeprom3.attr,
+                &dev_attr_tolerance3.attr,
+                NULL
+        }
+};
+
+static const struct attribute_group ad525x_group_wipers[] = {
+        {.attrs = ad525x_attributes_wipers[AD525X_RDAC0]},
+        {.attrs = ad525x_attributes_wipers[AD525X_RDAC1]},
+        {.attrs = ad525x_attributes_wipers[AD525X_RDAC2]},
+        {.attrs = ad525x_attributes_wipers[AD525X_RDAC3]},
+};
+
+/* ------------------------------------------------------------------------- */
+
+static ssize_t set_inc_all(struct device *dev,
+                           struct device_attribute *attr,
+                           const char *buf, size_t count)
+{
+        return sysfs_do_cmd(dev, attr, buf, count, AD525X_INC_ALL);
+}
+
+static DEVICE_ATTR(inc_all, S_IWUSR, NULL, set_inc_all);
+
+static ssize_t set_dec_all(struct device *dev,
+                           struct device_attribute *attr,
+                           const char *buf, size_t count)
+{
+        return sysfs_do_cmd(dev, attr, buf, count, AD525X_DEC_ALL);
+}
+
+static DEVICE_ATTR(dec_all, S_IWUSR, NULL, set_dec_all);
+
+static ssize_t set_inc_all_6db(struct device *dev,
+                               struct device_attribute *attr,
+                               const char *buf, size_t count)
+{
+        return sysfs_do_cmd(dev, attr, buf, count, AD525X_INC_ALL_6DB);
+}
+
+static DEVICE_ATTR(inc_all_6db, S_IWUSR, NULL, set_inc_all_6db);
+
+static ssize_t set_dec_all_6db(struct device *dev,
+                               struct device_attribute *attr,
+                               const char *buf, size_t count)
+{
+        return sysfs_do_cmd(dev, attr, buf, count, AD525X_DEC_ALL_6DB);
+}
+
+static DEVICE_ATTR(dec_all_6db, S_IWUSR, NULL, set_dec_all_6db);
+
+static struct attribute *ad525x_attributes_commands[] = {
+        &dev_attr_inc_all.attr,
+        &dev_attr_dec_all.attr,
+        &dev_attr_inc_all_6db.attr,
+        &dev_attr_dec_all_6db.attr,
+        NULL
+};
+
+static const struct attribute_group ad525x_group_commands = {
+        .attrs = ad525x_attributes_commands,
+};
+
+/* ------------------------------------------------------------------------- */
+
+/* i2c device functions */
+
+/**
+ * ad525x_read - return the value contained in the specified register
+ * on the AD5258 device.
+ * @client: value returned from i2c_new_device()
+ * @reg: the register to read
+ *
+ * If the tolerance register is specified, 2 bytes are returned.
+ * Otherwise, 1 byte is returned.  A negative value indicates an error
+ * occurred while reading the register.
+ */
+static s32 ad525x_read(struct i2c_client *client, u8 reg)
+{
+        struct dpot_data *data = i2c_get_clientdata(client);
+
+        if ((reg & AD525X_REG_TOL) || (data->max_pos > 256))
+                return i2c_smbus_read_word_data(client, (reg & 0xF8) |
+                                                ((reg & 0x7) << 1));
+        else
+                return i2c_smbus_read_byte_data(client, reg);
+}
+
+/**
+ * ad525x_write - store the given value in the specified register on
+ * the AD5258 device.
+ * @client: value returned from i2c_new_device()
+ * @reg: the register to write
+ * @value: the byte to store in the register
+ *
+ * For certain instructions that do not require a data byte, "NULL"
+ * should be specified for the "value" parameter.  These instructions
+ * include NOP, RESTORE_FROM_EEPROM, and STORE_TO_EEPROM.
+ *
+ * A negative return value indicates an error occurred while reading
+ * the register.
+ */
+static s32 ad525x_write(struct i2c_client *client, u8 reg, u8 value)
+{
+        struct dpot_data *data = i2c_get_clientdata(client);
+
+        /* Only write the instruction byte for certain commands */
+        if (reg & AD525X_I2C_CMD)
+                return i2c_smbus_write_byte(client, reg);
+
+        if (data->max_pos > 256)
+                return i2c_smbus_write_word_data(client, (reg & 0xF8) |
+                                                ((reg & 0x7) << 1), value);
+        else
+                /* All other registers require instruction + data bytes */
+                return i2c_smbus_write_byte_data(client, reg, value);
+}
+
+static int ad525x_probe(struct i2c_client *client,
+                        const struct i2c_device_id *id)
+{
+        struct device *dev = &client->dev;
+        struct dpot_data *data;
+        int err = 0;
+
+        dev_dbg(dev, "%s\n", __func__);
+
+        if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE)) {
+                dev_err(dev, "missing I2C functionality for this driver\n");
+                goto exit;
+        }
+
+        data = kzalloc(sizeof(struct dpot_data), GFP_KERNEL);
+        if (!data) {
+                err = -ENOMEM;
+                goto exit;
+        }
+
+        i2c_set_clientdata(client, data);
+        mutex_init(&data->update_lock);
+
+        switch (id->driver_data) {
+        case AD5258_ID:
+                data->max_pos = AD5258_MAX_POSITION;
+                err = sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC0]);
+                break;
+        case AD5259_ID:
+                data->max_pos = AD5259_MAX_POSITION;
+                err = sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC0]);
+                break;
+        case AD5251_ID:
+                data->max_pos = AD5251_MAX_POSITION;
+                err = sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC1]);
+                err |= sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC3]);
+                err |= sysfs_create_group(&dev->kobj, &ad525x_group_commands);
+                break;
+        case AD5252_ID:
+                data->max_pos = AD5252_MAX_POSITION;
+                err = sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC1]);
+                err |= sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC3]);
+                err |= sysfs_create_group(&dev->kobj, &ad525x_group_commands);
+                break;
+        case AD5253_ID:
+                data->max_pos = AD5253_MAX_POSITION;
+                err = sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC0]);
+                err |= sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC1]);
+                err |= sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC2]);
+                err |= sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC3]);
+                err |= sysfs_create_group(&dev->kobj, &ad525x_group_commands);
+                break;
+        case AD5254_ID:
+                data->max_pos = AD5254_MAX_POSITION;
+                err = sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC0]);
+                err |= sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC1]);
+                err |= sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC2]);
+                err |= sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC3]);
+                err |= sysfs_create_group(&dev->kobj, &ad525x_group_commands);
+                break;
+        case AD5255_ID:
+                data->max_pos = AD5255_MAX_POSITION;
+                err = sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC0]);
+                err |= sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC1]);
+                err |= sysfs_create_group(&dev->kobj,
+                                       &ad525x_group_wipers[AD525X_RDAC2]);
+                err |= sysfs_create_group(&dev->kobj, &ad525x_group_commands);
+                break;
+        default:
+                err = -ENODEV;
+                goto exit_free;
+        }
+
+        if (err) {
+                dev_err(dev, "failed to register sysfs hooks\n");
+                goto exit_free;
+        }
+
+        data->devid = id->driver_data;
+        data->rdac_mask = data->max_pos - 1;
+
+        dev_info(dev, "%s %d-Position Digital Potentiometer registered\n",
+                 id->name, data->max_pos);
+
+        return 0;
+
+exit_free:
+        kfree(data);
+        i2c_set_clientdata(client, NULL);
+exit:
+        dev_err(dev, "failed to create client\n");
+        return err;
+}
+
+static int __devexit ad525x_remove(struct i2c_client *client)
+{
+        struct dpot_data *data = i2c_get_clientdata(client);
+        struct device *dev = &client->dev;
+
+        switch (data->devid) {
+        case AD5258_ID:
+        case AD5259_ID:
+                sysfs_remove_group(&dev->kobj,
+                                   &ad525x_group_wipers[AD525X_RDAC0]);
+                break;
+        case AD5251_ID:
+        case AD5252_ID:
+                sysfs_remove_group(&dev->kobj,
+                                   &ad525x_group_wipers[AD525X_RDAC1]);
+                sysfs_remove_group(&dev->kobj,
+                                   &ad525x_group_wipers[AD525X_RDAC3]);
+                sysfs_remove_group(&dev->kobj, &ad525x_group_commands);
+                break;
+        case AD5253_ID:
+        case AD5254_ID:
+                sysfs_remove_group(&dev->kobj,
+                                   &ad525x_group_wipers[AD525X_RDAC0]);
+                sysfs_remove_group(&dev->kobj,
+                                   &ad525x_group_wipers[AD525X_RDAC1]);
+                sysfs_remove_group(&dev->kobj,
+                                   &ad525x_group_wipers[AD525X_RDAC2]);
+                sysfs_remove_group(&dev->kobj,
+                                   &ad525x_group_wipers[AD525X_RDAC3]);
+                sysfs_remove_group(&dev->kobj, &ad525x_group_commands);
+                break;
+        case AD5255_ID:
+                sysfs_remove_group(&dev->kobj,
+                                   &ad525x_group_wipers[AD525X_RDAC0]);
+                sysfs_remove_group(&dev->kobj,
+                                   &ad525x_group_wipers[AD525X_RDAC1]);
+                sysfs_remove_group(&dev->kobj,
+                                   &ad525x_group_wipers[AD525X_RDAC2]);
+                sysfs_remove_group(&dev->kobj, &ad525x_group_commands);
+                break;
+        }
+
+        i2c_set_clientdata(client, NULL);
+        kfree(data);
+
+        return 0;
+}
+
+static const struct i2c_device_id ad525x_idtable[] = {
+        {"ad5258", AD5258_ID},
+        {"ad5259", AD5259_ID},
+        {"ad5251", AD5251_ID},
+        {"ad5252", AD5252_ID},
+        {"ad5253", AD5253_ID},
+        {"ad5254", AD5254_ID},
+        {"ad5255", AD5255_ID},
+        {}
+};
+
+MODULE_DEVICE_TABLE(i2c, ad525x_idtable);
+
+static struct i2c_driver ad525x_driver = {
+        .driver = {
+                   .owner = THIS_MODULE,
+                   .name = DRIVER_NAME,
+                   },
+        .id_table = ad525x_idtable,
+        .probe = ad525x_probe,
+        .remove = __devexit_p(ad525x_remove),
+};
+
+static int __init ad525x_init(void)
+{
+        return i2c_add_driver(&ad525x_driver);
+}
+
+module_init(ad525x_init);
+
+static void __exit ad525x_exit(void)
+{
+        i2c_del_driver(&ad525x_driver);
+}
+
+module_exit(ad525x_exit);
+
+MODULE_AUTHOR("Chris Verges <chrisv@cyberswitching.com>, "
+              "Michael Hennerich <hennerich@blackfin.uclinux.org>, ");
+MODULE_DESCRIPTION("AD5258/9 digital potentiometer driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRIVER_VERSION);
diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
index 558bf3f2c276..4afffe610f99 100644
--- a/drivers/misc/atmel-ssc.c
+++ b/drivers/misc/atmel-ssc.c
@@ -15,6 +15,7 @@
 #include <linux/io.h>
 #include <linux/spinlock.h>
 #include <linux/atmel-ssc.h>
+#include <linux/slab.h>
 
 /* Serialize access to ssc_list and user count */
 static DEFINE_SPINLOCK(user_lock);
diff --git a/drivers/misc/atmel_pwm.c b/drivers/misc/atmel_pwm.c
index 6aa5294dfec4..0f3fb4f03bdf 100644
--- a/drivers/misc/atmel_pwm.c
+++ b/drivers/misc/atmel_pwm.c
@@ -1,6 +1,7 @@
 #include <linux/module.h>
 #include <linux/clk.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <linux/io.h>
 #include <linux/interrupt.h>
 #include <linux/platform_device.h>
diff --git a/drivers/misc/atmel_tclib.c b/drivers/misc/atmel_tclib.c
index 05dc8a31f280..3891124001f2 100644
--- a/drivers/misc/atmel_tclib.c
+++ b/drivers/misc/atmel_tclib.c
@@ -6,6 +6,7 @@
 #include <linux/ioport.h>
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
+#include <linux/slab.h>
 
 /* Number of bytes to reserve for the iomem resource */
 #define ATMEL_TC_IOMEM_SIZE     256
diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
index b5346b4db91a..ed090e77c9cd 100644
--- a/drivers/misc/c2port/core.c
+++ b/drivers/misc/c2port/core.c
@@ -20,6 +20,7 @@
 #include <linux/delay.h>
 #include <linux/idr.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 
 #include <linux/c2port.h>
 
@@ -912,8 +913,8 @@ struct c2port_device *c2port_device_register(char *name,
 
         c2dev->dev = device_create(c2port_class, NULL, 0, c2dev,
                                         "c2port%d", id);
-        if (unlikely(!c2dev->dev)) {
-                ret = -ENOMEM;
+        if (unlikely(IS_ERR(c2dev->dev))) {
+                ret = PTR_ERR(c2dev->dev);
                 goto error_device_create;
         }
         dev_set_drvdata(c2dev->dev, c2dev);
diff --git a/drivers/misc/cb710/core.c b/drivers/misc/cb710/core.c
index b14eab0f2ba5..efec4139c3f6 100644
--- a/drivers/misc/cb710/core.c
+++ b/drivers/misc/cb710/core.c
@@ -9,11 +9,11 @@
  */
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/slab.h>
 #include <linux/pci.h>
 #include <linux/spinlock.h>
 #include <linux/idr.h>
 #include <linux/cb710.h>
+#include <linux/gfp.h>
 
 static DEFINE_IDA(cb710_ida);
 static DEFINE_SPINLOCK(cb710_ida_lock);
diff --git a/drivers/misc/cb710/debug.c b/drivers/misc/cb710/debug.c
index 02358d086e03..fcb3b8e30c52 100644
--- a/drivers/misc/cb710/debug.c
+++ b/drivers/misc/cb710/debug.c
@@ -10,7 +10,6 @@
 #include <linux/cb710.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/slab.h>
 
 #define CB710_REG_COUNT         0x80
 
diff --git a/drivers/misc/cs5535-mfgpt.c b/drivers/misc/cs5535-mfgpt.c
new file mode 100644
index 000000000000..9bec24db4d41
--- /dev/null
+++ b/drivers/misc/cs5535-mfgpt.c
@@ -0,0 +1,371 @@
+/*
+ * Driver for the CS5535/CS5536 Multi-Function General Purpose Timers (MFGPT)
+ *
+ * Copyright (C) 2006, Advanced Micro Devices, Inc.
+ * Copyright (C) 2007  Andres Salomon <dilinger@debian.org>
+ * Copyright (C) 2009  Andres Salomon <dilinger@collabora.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public License
+ * as published by the Free Software Foundation.
+ *
+ * The MFGPTs are documented in AMD Geode CS5536 Companion Device Data Book.
+ */
+
+#include <linux/kernel.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/cs5535.h>
+#include <linux/slab.h>
+
+#define DRV_NAME "cs5535-mfgpt"
+#define MFGPT_BAR 2
+
+static int mfgpt_reset_timers;
+module_param_named(mfgptfix, mfgpt_reset_timers, int, 0644);
+MODULE_PARM_DESC(mfgptfix, "Reset the MFGPT timers during init; "
+                "required by some broken BIOSes (ie, TinyBIOS < 0.99).");
+
+struct cs5535_mfgpt_timer {
+        struct cs5535_mfgpt_chip *chip;
+        int nr;
+};
+
+static struct cs5535_mfgpt_chip {
+        DECLARE_BITMAP(avail, MFGPT_MAX_TIMERS);
+        resource_size_t base;
+
+        struct pci_dev *pdev;
+        spinlock_t lock;
+        int initialized;
+} cs5535_mfgpt_chip;
+
+int cs5535_mfgpt_toggle_event(struct cs5535_mfgpt_timer *timer, int cmp,
+                int event, int enable)
+{
+        uint32_t msr, mask, value, dummy;
+        int shift = (cmp == MFGPT_CMP1) ? 0 : 8;
+
+        if (!timer) {
+                WARN_ON(1);
+                return -EIO;
+        }
+
+        /*
+         * The register maps for these are described in sections 6.17.1.x of
+         * the AMD Geode CS5536 Companion Device Data Book.
+         */
+        switch (event) {
+        case MFGPT_EVENT_RESET:
+                /*
+                 * XXX: According to the docs, we cannot reset timers above
+                 * 6; that is, resets for 7 and 8 will be ignored.  Is this
+                 * a problem?   -dilinger
+                 */
+                msr = MSR_MFGPT_NR;
+                mask = 1 << (timer->nr + 24);
+                break;
+
+        case MFGPT_EVENT_NMI:
+                msr = MSR_MFGPT_NR;
+                mask = 1 << (timer->nr + shift);
+                break;
+
+        case MFGPT_EVENT_IRQ:
+                msr = MSR_MFGPT_IRQ;
+                mask = 1 << (timer->nr + shift);
+                break;
+
+        default:
+                return -EIO;
+        }
+
+        rdmsr(msr, value, dummy);
+
+        if (enable)
+                value |= mask;
+        else
+                value &= ~mask;
+
+        wrmsr(msr, value, dummy);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_toggle_event);
+
+int cs5535_mfgpt_set_irq(struct cs5535_mfgpt_timer *timer, int cmp, int *irq,
+                int enable)
+{
+        uint32_t zsel, lpc, dummy;
+        int shift;
+
+        if (!timer) {
+                WARN_ON(1);
+                return -EIO;
+        }
+
+        /*
+         * Unfortunately, MFGPTs come in pairs sharing their IRQ lines. If VSA
+         * is using the same CMP of the timer's Siamese twin, the IRQ is set to
+         * 2, and we mustn't use nor change it.
+         * XXX: Likewise, 2 Linux drivers might clash if the 2nd overwrites the
+         * IRQ of the 1st. This can only happen if forcing an IRQ, calling this
+         * with *irq==0 is safe. Currently there _are_ no 2 drivers.
+         */
+        rdmsr(MSR_PIC_ZSEL_LOW, zsel, dummy);
+        shift = ((cmp == MFGPT_CMP1 ? 0 : 4) + timer->nr % 4) * 4;
+        if (((zsel >> shift) & 0xF) == 2)
+                return -EIO;
+
+        /* Choose IRQ: if none supplied, keep IRQ already set or use default */
+        if (!*irq)
+                *irq = (zsel >> shift) & 0xF;
+        if (!*irq)
+                *irq = CONFIG_CS5535_MFGPT_DEFAULT_IRQ;
+
+        /* Can't use IRQ if it's 0 (=disabled), 2, or routed to LPC */
+        if (*irq < 1 || *irq == 2 || *irq > 15)
+                return -EIO;
+        rdmsr(MSR_PIC_IRQM_LPC, lpc, dummy);
+        if (lpc & (1 << *irq))
+                return -EIO;
+
+        /* All chosen and checked - go for it */
+        if (cs5535_mfgpt_toggle_event(timer, cmp, MFGPT_EVENT_IRQ, enable))
+                return -EIO;
+        if (enable) {
+                zsel = (zsel & ~(0xF << shift)) | (*irq << shift);
+                wrmsr(MSR_PIC_ZSEL_LOW, zsel, dummy);
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_set_irq);
+
+struct cs5535_mfgpt_timer *cs5535_mfgpt_alloc_timer(int timer_nr, int domain)
+{
+        struct cs5535_mfgpt_chip *mfgpt = &cs5535_mfgpt_chip;
+        struct cs5535_mfgpt_timer *timer = NULL;
+        unsigned long flags;
+        int max;
+
+        if (!mfgpt->initialized)
+                goto done;
+
+        /* only allocate timers from the working domain if requested */
+        if (domain == MFGPT_DOMAIN_WORKING)
+                max = 6;
+        else
+                max = MFGPT_MAX_TIMERS;
+
+        if (timer_nr >= max) {
+                /* programmer error.  silly programmers! */
+                WARN_ON(1);
+                goto done;
+        }
+
+        spin_lock_irqsave(&mfgpt->lock, flags);
+        if (timer_nr < 0) {
+                unsigned long t;
+
+                /* try to find any available timer */
+                t = find_first_bit(mfgpt->avail, max);
+                /* set timer_nr to -1 if no timers available */
+                timer_nr = t < max ? (int) t : -1;
+        } else {
+                /* check if the requested timer's available */
+                if (test_bit(timer_nr, mfgpt->avail))
+                        timer_nr = -1;
+        }
+
+        if (timer_nr >= 0)
+                /* if timer_nr is not -1, it's an available timer */
+                __clear_bit(timer_nr, mfgpt->avail);
+        spin_unlock_irqrestore(&mfgpt->lock, flags);
+
+        if (timer_nr < 0)
+                goto done;
+
+        timer = kmalloc(sizeof(*timer), GFP_KERNEL);
+        if (!timer) {
+                /* aw hell */
+                spin_lock_irqsave(&mfgpt->lock, flags);
+                __set_bit(timer_nr, mfgpt->avail);
+                spin_unlock_irqrestore(&mfgpt->lock, flags);
+                goto done;
+        }
+        timer->chip = mfgpt;
+        timer->nr = timer_nr;
+        dev_info(&mfgpt->pdev->dev, "registered timer %d\n", timer_nr);
+
+done:
+        return timer;
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_alloc_timer);
+
+/*
+ * XXX: This frees the timer memory, but never resets the actual hardware
+ * timer.  The old geode_mfgpt code did this; it would be good to figure
+ * out a way to actually release the hardware timer.  See comments below.
+ */
+void cs5535_mfgpt_free_timer(struct cs5535_mfgpt_timer *timer)
+{
+        kfree(timer);
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_free_timer);
+
+uint16_t cs5535_mfgpt_read(struct cs5535_mfgpt_timer *timer, uint16_t reg)
+{
+        return inw(timer->chip->base + reg + (timer->nr * 8));
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_read);
+
+void cs5535_mfgpt_write(struct cs5535_mfgpt_timer *timer, uint16_t reg,
+                uint16_t value)
+{
+        outw(value, timer->chip->base + reg + (timer->nr * 8));
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_write);
+
+/*
+ * This is a sledgehammer that resets all MFGPT timers. This is required by
+ * some broken BIOSes which leave the system in an unstable state
+ * (TinyBIOS 0.98, for example; fixed in 0.99).  It's uncertain as to
+ * whether or not this secret MSR can be used to release individual timers.
+ * Jordan tells me that he and Mitch once played w/ it, but it's unclear
+ * what the results of that were (and they experienced some instability).
+ */
+static void __init reset_all_timers(void)
+{
+        uint32_t val, dummy;
+
+        /* The following undocumented bit resets the MFGPT timers */
+        val = 0xFF; dummy = 0;
+        wrmsr(MSR_MFGPT_SETUP, val, dummy);
+}
+
+/*
+ * Check whether any MFGPTs are available for the kernel to use.  In most
+ * cases, firmware that uses AMD's VSA code will claim all timers during
+ * bootup; we certainly don't want to take them if they're already in use.
+ * In other cases (such as with VSAless OpenFirmware), the system firmware
+ * leaves timers available for us to use.
+ */
+static int __init scan_timers(struct cs5535_mfgpt_chip *mfgpt)
+{
+        struct cs5535_mfgpt_timer timer = { .chip = mfgpt };
+        unsigned long flags;
+        int timers = 0;
+        uint16_t val;
+        int i;
+
+        /* bios workaround */
+        if (mfgpt_reset_timers)
+                reset_all_timers();
+
+        /* just to be safe, protect this section w/ lock */
+        spin_lock_irqsave(&mfgpt->lock, flags);
+        for (i = 0; i < MFGPT_MAX_TIMERS; i++) {
+                timer.nr = i;
+                val = cs5535_mfgpt_read(&timer, MFGPT_REG_SETUP);
+                if (!(val & MFGPT_SETUP_SETUP)) {
+                        __set_bit(i, mfgpt->avail);
+                        timers++;
+                }
+        }
+        spin_unlock_irqrestore(&mfgpt->lock, flags);
+
+        return timers;
+}
+
+static int __init cs5535_mfgpt_probe(struct pci_dev *pdev,
+                const struct pci_device_id *pci_id)
+{
+        int err, t;
+
+        /* There are two ways to get the MFGPT base address; one is by
+         * fetching it from MSR_LBAR_MFGPT, the other is by reading the
+         * PCI BAR info.  The latter method is easier (especially across
+         * different architectures), so we'll stick with that for now.  If
+         * it turns out to be unreliable in the face of crappy BIOSes, we
+         * can always go back to using MSRs.. */
+
+        err = pci_enable_device_io(pdev);
+        if (err) {
+                dev_err(&pdev->dev, "can't enable device IO\n");
+                goto done;
+        }
+
+        err = pci_request_region(pdev, MFGPT_BAR, DRV_NAME);
+        if (err) {
+                dev_err(&pdev->dev, "can't alloc PCI BAR #%d\n", MFGPT_BAR);
+                goto done;
+        }
+
+        /* set up the driver-specific struct */
+        cs5535_mfgpt_chip.base = pci_resource_start(pdev, MFGPT_BAR);
+        cs5535_mfgpt_chip.pdev = pdev;
+        spin_lock_init(&cs5535_mfgpt_chip.lock);
+
+        dev_info(&pdev->dev, "allocated PCI BAR #%d: base 0x%llx\n", MFGPT_BAR,
+                        (unsigned long long) cs5535_mfgpt_chip.base);
+
+        /* detect the available timers */
+        t = scan_timers(&cs5535_mfgpt_chip);
+        dev_info(&pdev->dev, DRV_NAME ": %d MFGPT timers available\n", t);
+        cs5535_mfgpt_chip.initialized = 1;
+        return 0;
+
+done:
+        return err;
+}
+
+static struct pci_device_id cs5535_mfgpt_pci_tbl[] = {
+        { PCI_DEVICE(PCI_VENDOR_ID_NS, PCI_DEVICE_ID_NS_CS5535_ISA) },
+        { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA) },
+        { 0, },
+};
+MODULE_DEVICE_TABLE(pci, cs5535_mfgpt_pci_tbl);
+
+/*
+ * Just like with the cs5535-gpio driver, we can't use the standard PCI driver
+ * registration stuff.  It only allows only one driver to bind to each PCI
+ * device, and we want the GPIO and MFGPT drivers to be able to share a PCI
+ * device.  Instead, we manually scan for the PCI device, request a single
+ * region, and keep track of the devices that we're using.
+ */
+
+static int __init cs5535_mfgpt_scan_pci(void)
+{
+        struct pci_dev *pdev;
+        int err = -ENODEV;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(cs5535_mfgpt_pci_tbl); i++) {
+                pdev = pci_get_device(cs5535_mfgpt_pci_tbl[i].vendor,
+                                cs5535_mfgpt_pci_tbl[i].device, NULL);
+                if (pdev) {
+                        err = cs5535_mfgpt_probe(pdev,
+                                        &cs5535_mfgpt_pci_tbl[i]);
+                        if (err)
+                                pci_dev_put(pdev);
+
+                        /* we only support a single CS5535/6 southbridge */
+                        break;
+                }
+        }
+
+        return err;
+}
+
+static int __init cs5535_mfgpt_init(void)
+{
+        return cs5535_mfgpt_scan_pci();
+}
+
+module_init(cs5535_mfgpt_init);
+
+MODULE_AUTHOR("Andres Salomon <dilinger@collabora.co.uk>");
+MODULE_DESCRIPTION("CS5535/CS5536 MFGPT timer driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/misc/ds1682.c b/drivers/misc/ds1682.c
new file mode 100644
index 000000000000..9197cfc55015
--- /dev/null
+++ b/drivers/misc/ds1682.c
@@ -0,0 +1,266 @@
+/*
+ * Dallas Semiconductor DS1682 Elapsed Time Recorder device driver
+ *
+ * Written by: Grant Likely <grant.likely@secretlab.ca>
+ *
+ * Copyright (C) 2007 Secret Lab Technologies Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * The DS1682 elapsed timer recorder is a simple device that implements
+ * one elapsed time counter, one event counter, an alarm signal and 10
+ * bytes of general purpose EEPROM.
+ *
+ * This driver provides access to the DS1682 counters and user data via
+ * the sysfs.  The following attributes are added to the device node:
+ *     elapsed_time (u32): Total elapsed event time in ms resolution
+ *     alarm_time (u32): When elapsed time exceeds the value in alarm_time,
+ *                       then the alarm pin is asserted.
+ *     event_count (u16): number of times the event pin has gone low.
+ *     eeprom (u8[10]): general purpose EEPROM
+ *
+ * Counter registers and user data are both read/write unless the device
+ * has been write protected.  This driver does not support turning off write
+ * protection.  Once write protection is turned on, it is impossible to
+ * turn it off again, so I have left the feature out of this driver to avoid
+ * accidental enabling, but it is trivial to add write protect support.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/i2c.h>
+#include <linux/string.h>
+#include <linux/list.h>
+#include <linux/sysfs.h>
+#include <linux/ctype.h>
+#include <linux/hwmon-sysfs.h>
+
+/* Device registers */
+#define DS1682_REG_CONFIG               0x00
+#define DS1682_REG_ALARM                0x01
+#define DS1682_REG_ELAPSED              0x05
+#define DS1682_REG_EVT_CNTR             0x09
+#define DS1682_REG_EEPROM               0x0b
+#define DS1682_REG_RESET                0x1d
+#define DS1682_REG_WRITE_DISABLE        0x1e
+#define DS1682_REG_WRITE_MEM_DISABLE    0x1f
+
+#define DS1682_EEPROM_SIZE              10
+
+/*
+ * Generic counter attributes
+ */
+static ssize_t ds1682_show(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        struct i2c_client *client = to_i2c_client(dev);
+        __le32 val = 0;
+        int rc;
+
+        dev_dbg(dev, "ds1682_show() called on %s\n", attr->attr.name);
+
+        /* Read the register */
+        rc = i2c_smbus_read_i2c_block_data(client, sattr->index, sattr->nr,
+                                           (u8 *) & val);
+        if (rc < 0)
+                return -EIO;
+
+        /* Special case: the 32 bit regs are time values with 1/4s
+         * resolution, scale them up to milliseconds */
+        if (sattr->nr == 4)
+                return sprintf(buf, "%llu\n",
+                        ((unsigned long long)le32_to_cpu(val)) * 250);
+
+        /* Format the output string and return # of bytes */
+        return sprintf(buf, "%li\n", (long)le32_to_cpu(val));
+}
+
+static ssize_t ds1682_store(struct device *dev, struct device_attribute *attr,
+                            const char *buf, size_t count)
+{
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        struct i2c_client *client = to_i2c_client(dev);
+        char *endp;
+        u64 val;
+        __le32 val_le;
+        int rc;
+
+        dev_dbg(dev, "ds1682_store() called on %s\n", attr->attr.name);
+
+        /* Decode input */
+        val = simple_strtoull(buf, &endp, 0);
+        if (buf == endp) {
+                dev_dbg(dev, "input string not a number\n");
+                return -EINVAL;
+        }
+
+        /* Special case: the 32 bit regs are time values with 1/4s
+         * resolution, scale input down to quarter-seconds */
+        if (sattr->nr == 4)
+                do_div(val, 250);
+
+        /* write out the value */
+        val_le = cpu_to_le32(val);
+        rc = i2c_smbus_write_i2c_block_data(client, sattr->index, sattr->nr,
+                                            (u8 *) & val_le);
+        if (rc < 0) {
+                dev_err(dev, "register write failed; reg=0x%x, size=%i\n",
+                        sattr->index, sattr->nr);
+                return -EIO;
+        }
+
+        return count;
+}
+
+/*
+ * Simple register attributes
+ */
+static SENSOR_DEVICE_ATTR_2(elapsed_time, S_IRUGO | S_IWUSR, ds1682_show,
+                            ds1682_store, 4, DS1682_REG_ELAPSED);
+static SENSOR_DEVICE_ATTR_2(alarm_time, S_IRUGO | S_IWUSR, ds1682_show,
+                            ds1682_store, 4, DS1682_REG_ALARM);
+static SENSOR_DEVICE_ATTR_2(event_count, S_IRUGO | S_IWUSR, ds1682_show,
+                            ds1682_store, 2, DS1682_REG_EVT_CNTR);
+
+static const struct attribute_group ds1682_group = {
+        .attrs = (struct attribute *[]) {
+                &sensor_dev_attr_elapsed_time.dev_attr.attr,
+                &sensor_dev_attr_alarm_time.dev_attr.attr,
+                &sensor_dev_attr_event_count.dev_attr.attr,
+                NULL,
+        },
+};
+
+/*
+ * User data attribute
+ */
+static ssize_t ds1682_eeprom_read(struct kobject *kobj, struct bin_attribute *attr,
+                                  char *buf, loff_t off, size_t count)
+{
+        struct i2c_client *client = kobj_to_i2c_client(kobj);
+        int rc;
+
+        dev_dbg(&client->dev, "ds1682_eeprom_read(p=%p, off=%lli, c=%zi)\n",
+                buf, off, count);
+
+        if (off >= DS1682_EEPROM_SIZE)
+                return 0;
+
+        if (off + count > DS1682_EEPROM_SIZE)
+                count = DS1682_EEPROM_SIZE - off;
+
+        rc = i2c_smbus_read_i2c_block_data(client, DS1682_REG_EEPROM + off,
+                                           count, buf);
+        if (rc < 0)
+                return -EIO;
+
+        return count;
+}
+
+static ssize_t ds1682_eeprom_write(struct kobject *kobj, struct bin_attribute *attr,
+                                   char *buf, loff_t off, size_t count)
+{
+        struct i2c_client *client = kobj_to_i2c_client(kobj);
+
+        dev_dbg(&client->dev, "ds1682_eeprom_write(p=%p, off=%lli, c=%zi)\n",
+                buf, off, count);
+
+        if (off >= DS1682_EEPROM_SIZE)
+                return -ENOSPC;
+
+        if (off + count > DS1682_EEPROM_SIZE)
+                count = DS1682_EEPROM_SIZE - off;
+
+        /* Write out to the device */
+        if (i2c_smbus_write_i2c_block_data(client, DS1682_REG_EEPROM + off,
+                                           count, buf) < 0)
+                return -EIO;
+
+        return count;
+}
+
+static struct bin_attribute ds1682_eeprom_attr = {
+        .attr = {
+                .name = "eeprom",
+                .mode = S_IRUGO | S_IWUSR,
+        },
+        .size = DS1682_EEPROM_SIZE,
+        .read = ds1682_eeprom_read,
+        .write = ds1682_eeprom_write,
+};
+
+/*
+ * Called when a ds1682 device is matched with this driver
+ */
+static int ds1682_probe(struct i2c_client *client,
+                        const struct i2c_device_id *id)
+{
+        int rc;
+
+        if (!i2c_check_functionality(client->adapter,
+                                     I2C_FUNC_SMBUS_I2C_BLOCK)) {
+                dev_err(&client->dev, "i2c bus does not support the ds1682\n");
+                rc = -ENODEV;
+                goto exit;
+        }
+
+        rc = sysfs_create_group(&client->dev.kobj, &ds1682_group);
+        if (rc)
+                goto exit;
+
+        rc = sysfs_create_bin_file(&client->dev.kobj, &ds1682_eeprom_attr);
+        if (rc)
+                goto exit_bin_attr;
+
+        return 0;
+
+ exit_bin_attr:
+        sysfs_remove_group(&client->dev.kobj, &ds1682_group);
+ exit:
+        return rc;
+}
+
+static int ds1682_remove(struct i2c_client *client)
+{
+        sysfs_remove_bin_file(&client->dev.kobj, &ds1682_eeprom_attr);
+        sysfs_remove_group(&client->dev.kobj, &ds1682_group);
+        return 0;
+}
+
+static const struct i2c_device_id ds1682_id[] = {
+        { "ds1682", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, ds1682_id);
+
+static struct i2c_driver ds1682_driver = {
+        .driver = {
+                .name = "ds1682",
+        },
+        .probe = ds1682_probe,
+        .remove = ds1682_remove,
+        .id_table = ds1682_id,
+};
+
+static int __init ds1682_init(void)
+{
+        return i2c_add_driver(&ds1682_driver);
+}
+
+static void __exit ds1682_exit(void)
+{
+        i2c_del_driver(&ds1682_driver);
+}
+
+MODULE_AUTHOR("Grant Likely <grant.likely@secretlab.ca>");
+MODULE_DESCRIPTION("DS1682 Elapsed Time Indicator driver");
+MODULE_LICENSE("GPL");
+
+module_init(ds1682_init);
+module_exit(ds1682_exit);
diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index 2cb2736d65aa..db7d0f21b65d 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -505,6 +505,7 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
          * Export the EEPROM bytes through sysfs, since that's convenient.
          * By default, only root should see the data (maybe passwords etc)
          */
+        sysfs_bin_attr_init(&at24->bin);
         at24->bin.attr.name = "eeprom";
         at24->bin.attr.mode = chip.flags & AT24_FLAG_IRUGO ? S_IRUGO : S_IRUSR;
         at24->bin.read = at24_bin_read;
diff --git a/drivers/misc/eeprom/at25.c b/drivers/misc/eeprom/at25.c
index d902d81dde39..d194212a41f6 100644
--- a/drivers/misc/eeprom/at25.c
+++ b/drivers/misc/eeprom/at25.c
@@ -347,6 +347,7 @@ static int at25_probe(struct spi_device *spi)
          * that's sensitive for read and/or write, like ethernet addresses,
          * security codes, board-specific manufacturing calibrations, etc.
          */
+        sysfs_bin_attr_init(&at25->bin);
         at25->bin.attr.name = "eeprom";
         at25->bin.attr.mode = S_IRUSR;
         at25->bin.read = at25_bin_read;
diff --git a/drivers/misc/eeprom/eeprom.c b/drivers/misc/eeprom/eeprom.c
index 2c27193aeaa0..f939ebc2507c 100644
--- a/drivers/misc/eeprom/eeprom.c
+++ b/drivers/misc/eeprom/eeprom.c
@@ -32,9 +32,6 @@
 static const unsigned short normal_i2c[] = { 0x50, 0x51, 0x52, 0x53, 0x54,
                                         0x55, 0x56, 0x57, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(eeprom);
-
 
 /* Size of EEPROM in bytes */
 #define EEPROM_SIZE             256
@@ -135,8 +132,7 @@ static struct bin_attribute eeprom_attr = {
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int eeprom_detect(struct i2c_client *client, int kind,
-                         struct i2c_board_info *info)
+static int eeprom_detect(struct i2c_client *client, struct i2c_board_info *info)
 {
         struct i2c_adapter *adapter = client->adapter;
 
@@ -233,7 +229,7 @@ static struct i2c_driver eeprom_driver = {
 
         .class          = I2C_CLASS_DDC | I2C_CLASS_SPD,
         .detect         = eeprom_detect,
-        .address_data   = &addr_data,
+        .address_list   = normal_i2c,
 };
 
 static int __init eeprom_init(void)
diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c
index e9eae4a78402..48c84a58163e 100644
--- a/drivers/misc/enclosure.c
+++ b/drivers/misc/enclosure.c
@@ -27,6 +27,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 
 static LIST_HEAD(container_list);
 static DEFINE_MUTEX(container_list_lock);
@@ -391,6 +392,7 @@ static const char *const enclosure_status [] = {
         [ENCLOSURE_STATUS_NOT_INSTALLED] = "not installed",
         [ENCLOSURE_STATUS_UNKNOWN] = "unknown",
         [ENCLOSURE_STATUS_UNAVAILABLE] = "unavailable",
+        [ENCLOSURE_STATUS_MAX] = NULL,
 };
 
 static const char *const enclosure_type [] = {
diff --git a/drivers/misc/ep93xx_pwm.c b/drivers/misc/ep93xx_pwm.c
index ba4694169d79..46b3439673e9 100644
--- a/drivers/misc/ep93xx_pwm.c
+++ b/drivers/misc/ep93xx_pwm.c
@@ -19,6 +19,7 @@
 
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/slab.h>
 #include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/io.h>
diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
index a92a3a742b43..98ad0120aa9b 100644
--- a/drivers/misc/hpilo.c
+++ b/drivers/misc/hpilo.c
@@ -25,6 +25,7 @@
 #include <linux/io.h>
 #include <linux/wait.h>
 #include <linux/poll.h>
+#include <linux/slab.h>
 #include "hpilo.h"
 
 static struct class *ilo_class;
diff --git a/drivers/misc/hpilo.h b/drivers/misc/hpilo.h
index 38576050776a..247eb386a973 100644
--- a/drivers/misc/hpilo.h
+++ b/drivers/misc/hpilo.h
@@ -44,9 +44,20 @@ struct ilo_hwinfo {
 
         struct pci_dev *ilo_dev;
 
+        /*
+         * open_lock      serializes ccb_cnt during open and close
+         * [ irq disabled ]
+         * -> alloc_lock  used when adding/removing/searching ccb_alloc,
+         *                which represents all ccbs open on the device
+         * --> fifo_lock  controls access to fifo queues shared with hw
+         *
+         * Locks must be taken in this order, but open_lock and alloc_lock
+         * are optional, they do not need to be held in order to take a
+         * lower level lock.
+         */
+        spinlock_t open_lock;
         spinlock_t alloc_lock;
         spinlock_t fifo_lock;
-        spinlock_t open_lock;
 
         struct cdev cdev;
 };
diff --git a/drivers/misc/ibmasm/command.c b/drivers/misc/ibmasm/command.c
index e2031739aa29..5c766b4fb238 100644
--- a/drivers/misc/ibmasm/command.c
+++ b/drivers/misc/ibmasm/command.c
@@ -23,6 +23,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include "ibmasm.h"
 #include "lowlevel.h"
 
diff --git a/drivers/misc/ibmasm/event.c b/drivers/misc/ibmasm/event.c
index 572d41ffc186..76bfda1ffaa9 100644
--- a/drivers/misc/ibmasm/event.c
+++ b/drivers/misc/ibmasm/event.c
@@ -23,6 +23,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include "ibmasm.h"
 #include "lowlevel.h"
 
diff --git a/drivers/misc/ibmasm/ibmasmfs.c b/drivers/misc/ibmasm/ibmasmfs.c
index aecf40ecb3a4..8844a3f45381 100644
--- a/drivers/misc/ibmasm/ibmasmfs.c
+++ b/drivers/misc/ibmasm/ibmasmfs.c
@@ -75,6 +75,7 @@
 
 #include <linux/fs.h>
 #include <linux/pagemap.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include "ibmasm.h"
diff --git a/drivers/misc/ibmasm/module.c b/drivers/misc/ibmasm/module.c
index dc14b0b9cbfa..a234d965243b 100644
--- a/drivers/misc/ibmasm/module.c
+++ b/drivers/misc/ibmasm/module.c
@@ -52,6 +52,7 @@
 
 #include <linux/pci.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include "ibmasm.h"
 #include "lowlevel.h"
 #include "remote.h"
diff --git a/drivers/misc/ics932s401.c b/drivers/misc/ics932s401.c
index 6e43ab4231ae..152e9d93eecb 100644
--- a/drivers/misc/ics932s401.c
+++ b/drivers/misc/ics932s401.c
@@ -26,13 +26,11 @@
 #include <linux/mutex.h>
 #include <linux/delay.h>
 #include <linux/log2.h>
+#include <linux/slab.h>
 
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x69, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(ics932s401);
-
 /* ICS932S401 registers */
 #define ICS932S401_REG_CFG2                     0x01
 #define         ICS932S401_CFG1_SPREAD          0x01
@@ -106,12 +104,12 @@ struct ics932s401_data {
 
 static int ics932s401_probe(struct i2c_client *client,
                          const struct i2c_device_id *id);
-static int ics932s401_detect(struct i2c_client *client, int kind,
+static int ics932s401_detect(struct i2c_client *client,
                           struct i2c_board_info *info);
 static int ics932s401_remove(struct i2c_client *client);
 
 static const struct i2c_device_id ics932s401_id[] = {
-        { "ics932s401", ics932s401 },
+        { "ics932s401", 0 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, ics932s401_id);
@@ -125,7 +123,7 @@ static struct i2c_driver ics932s401_driver = {
         .remove         = ics932s401_remove,
         .id_table       = ics932s401_id,
         .detect         = ics932s401_detect,
-        .address_data   = &addr_data,
+        .address_list   = normal_i2c,
 };
 
 static struct ics932s401_data *ics932s401_update_device(struct device *dev)
@@ -413,36 +411,29 @@ static ssize_t show_spread(struct device *dev,
 }
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int ics932s401_detect(struct i2c_client *client, int kind,
+static int ics932s401_detect(struct i2c_client *client,
                           struct i2c_board_info *info)
 {
         struct i2c_adapter *adapter = client->adapter;
+        int vendor, device, revision;
 
         if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
                 return -ENODEV;
 
-        if (kind <= 0) {
-                int vendor, device, revision;
-
-                vendor = i2c_smbus_read_word_data(client,
-                                                  ICS932S401_REG_VENDOR_REV);
-                vendor >>= 8;
-                revision = vendor >> ICS932S401_REV_SHIFT;
-                vendor &= ICS932S401_VENDOR_MASK;
-                if (vendor != ICS932S401_VENDOR)
-                        return -ENODEV;
-
-                device = i2c_smbus_read_word_data(client,
-                                                  ICS932S401_REG_DEVICE);
-                device >>= 8;
-                if (device != ICS932S401_DEVICE)
-                        return -ENODEV;
-
-                if (revision != ICS932S401_REV)
-                        dev_info(&adapter->dev, "Unknown revision %d\n",
-                                 revision);
-        } else
-                dev_dbg(&adapter->dev, "detection forced\n");
+        vendor = i2c_smbus_read_word_data(client, ICS932S401_REG_VENDOR_REV);
+        vendor >>= 8;
+        revision = vendor >> ICS932S401_REV_SHIFT;
+        vendor &= ICS932S401_VENDOR_MASK;
+        if (vendor != ICS932S401_VENDOR)
+                return -ENODEV;
+
+        device = i2c_smbus_read_word_data(client, ICS932S401_REG_DEVICE);
+        device >>= 8;
+        if (device != ICS932S401_DEVICE)
+                return -ENODEV;
+
+        if (revision != ICS932S401_REV)
+                dev_info(&adapter->dev, "Unknown revision %d\n", revision);
 
         strlcpy(info->type, "ics932s401", I2C_NAME_SIZE);
 
diff --git a/drivers/misc/ioc4.c b/drivers/misc/ioc4.c
index 60b0b1a4fb3a..193206602d88 100644
--- a/drivers/misc/ioc4.c
+++ b/drivers/misc/ioc4.c
@@ -30,6 +30,7 @@
 #include <linux/pci.h>
 #include <linux/ioc4.h>
 #include <linux/ktime.h>
+#include <linux/slab.h>
 #include <linux/mutex.h>
 #include <linux/time.h>
 #include <asm/io.h>
@@ -138,7 +139,7 @@ ioc4_unregister_submodule(struct ioc4_submodule *is)
  * even though the following code utilizes external interrupt registers
  * to perform the speed calculation.
  */
-static void
+static void __devinit
 ioc4_clock_calibrate(struct ioc4_driver_data *idd)
 {
         union ioc4_int_out int_out;
@@ -230,7 +231,7 @@ ioc4_clock_calibrate(struct ioc4_driver_data *idd)
  * on the same PCI bus at slot number 3 to differentiate IO9 from IO10.
  * If neither is present, it's a PCI-RT.
  */
-static unsigned int
+static unsigned int __devinit
 ioc4_variant(struct ioc4_driver_data *idd)
 {
         struct pci_dev *pdev = NULL;
@@ -269,7 +270,7 @@ ioc4_variant(struct ioc4_driver_data *idd)
         return IOC4_VARIANT_PCI_RT;
 }
 
-static void
+static void __devinit
 ioc4_load_modules(struct work_struct *work)
 {
         /* arg just has to be freed */
@@ -280,7 +281,7 @@ ioc4_load_modules(struct work_struct *work)
 }
 
 /* Adds a new instance of an IOC4 card */
-static int
+static int __devinit
 ioc4_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
 {
         struct ioc4_driver_data *idd;
@@ -425,7 +426,7 @@ out:
 }
 
 /* Removes a particular instance of an IOC4 card. */
-static void
+static void __devexit
 ioc4_remove(struct pci_dev *pdev)
 {
         struct ioc4_submodule *is;
@@ -476,7 +477,7 @@ static struct pci_driver ioc4_driver = {
         .name = "IOC4",
         .id_table = ioc4_id_table,
         .probe = ioc4_probe,
-        .remove = ioc4_remove,
+        .remove = __devexit_p(ioc4_remove),
 };
 
 MODULE_DEVICE_TABLE(pci, ioc4_id_table);
@@ -486,14 +487,14 @@ MODULE_DEVICE_TABLE(pci, ioc4_id_table);
  *********************/
 
 /* Module load */
-static int __devinit
+static int __init
 ioc4_init(void)
 {
         return pci_register_driver(&ioc4_driver);
 }
 
 /* Module unload */
-static void __devexit
+static void __exit
 ioc4_exit(void)
 {
         /* Ensure ioc4_load_modules() has completed before exiting */
diff --git a/drivers/misc/iwmc3200top/Kconfig b/drivers/misc/iwmc3200top/Kconfig
new file mode 100644
index 000000000000..9e4b88fb57f1
--- /dev/null
+++ b/drivers/misc/iwmc3200top/Kconfig
@@ -0,0 +1,20 @@
+config IWMC3200TOP
+        tristate "Intel Wireless MultiCom Top Driver"
+        depends on MMC && EXPERIMENTAL
+        select FW_LOADER
+        ---help---
+          Intel Wireless MultiCom 3200 Top driver is responsible for
+          for firmware load and enabled coms enumeration
+
+config IWMC3200TOP_DEBUG
+        bool "Enable full debug output of iwmc3200top Driver"
+        depends on IWMC3200TOP
+        ---help---
+          Enable full debug output of iwmc3200top Driver
+
+config IWMC3200TOP_DEBUGFS
+        bool "Enable Debugfs debugging interface for iwmc3200top"
+        depends on IWMC3200TOP
+        ---help---
+          Enable creation of debugfs files for iwmc3200top
+
diff --git a/drivers/misc/iwmc3200top/Makefile b/drivers/misc/iwmc3200top/Makefile
new file mode 100644
index 000000000000..fbf53fb4634e
--- /dev/null
+++ b/drivers/misc/iwmc3200top/Makefile
@@ -0,0 +1,29 @@
+# iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+# drivers/misc/iwmc3200top/Makefile
+#
+# Copyright (C) 2009 Intel Corporation. All rights reserved.
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version
+# 2 as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+# 02110-1301, USA.
+#
+#
+# Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+#  -
+#
+#
+
+obj-$(CONFIG_IWMC3200TOP)       += iwmc3200top.o
+iwmc3200top-objs        := main.o fw-download.o
+iwmc3200top-$(CONFIG_IWMC3200TOP_DEBUG) += log.o
+iwmc3200top-$(CONFIG_IWMC3200TOP_DEBUGFS) += debugfs.o
diff --git a/drivers/misc/iwmc3200top/debugfs.c b/drivers/misc/iwmc3200top/debugfs.c
new file mode 100644
index 000000000000..e9eda471f6e0
--- /dev/null
+++ b/drivers/misc/iwmc3200top/debugfs.c
@@ -0,0 +1,134 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/debufs.c
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/ctype.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio.h>
+#include <linux/debugfs.h>
+
+#include "iwmc3200top.h"
+#include "fw-msg.h"
+#include "log.h"
+#include "debugfs.h"
+
+
+
+/*      Constants definition        */
+#define HEXADECIMAL_RADIX       16
+
+/*      Functions definition        */
+
+
+#define DEBUGFS_ADD(name, parent) do {                                  \
+        dbgfs->dbgfs_##parent##_files.file_##name =                     \
+        debugfs_create_file(#name, 0644, dbgfs->dir_##parent, priv,     \
+                                &iwmct_dbgfs_##name##_ops);             \
+} while (0)
+
+#define DEBUGFS_RM(name)  do {          \
+        debugfs_remove(name);           \
+        name = NULL;                    \
+} while (0)
+
+#define DEBUGFS_READ_FUNC(name)                                         \
+ssize_t iwmct_dbgfs_##name##_read(struct file *file,                    \
+                                  char __user *user_buf,                \
+                                  size_t count, loff_t *ppos);
+
+#define DEBUGFS_WRITE_FUNC(name)                                        \
+ssize_t iwmct_dbgfs_##name##_write(struct file *file,                   \
+                                   const char __user *user_buf,         \
+                                   size_t count, loff_t *ppos);
+
+#define DEBUGFS_READ_FILE_OPS(name)                                     \
+        DEBUGFS_READ_FUNC(name)                                         \
+        static const struct file_operations iwmct_dbgfs_##name##_ops = {  \
+                .read = iwmct_dbgfs_##name##_read,                      \
+                .open = iwmct_dbgfs_open_file_generic,                  \
+        };
+
+#define DEBUGFS_WRITE_FILE_OPS(name)                                    \
+        DEBUGFS_WRITE_FUNC(name)                                        \
+        static const struct file_operations iwmct_dbgfs_##name##_ops = {  \
+                .write = iwmct_dbgfs_##name##_write,                    \
+                .open = iwmct_dbgfs_open_file_generic,                  \
+        };
+
+#define DEBUGFS_READ_WRITE_FILE_OPS(name)                               \
+        DEBUGFS_READ_FUNC(name)                                         \
+        DEBUGFS_WRITE_FUNC(name)                                        \
+        static const struct file_operations iwmct_dbgfs_##name##_ops = {\
+                .write = iwmct_dbgfs_##name##_write,                    \
+                .read = iwmct_dbgfs_##name##_read,                      \
+                .open = iwmct_dbgfs_open_file_generic,                  \
+        };
+
+
+/*      Debugfs file ops definitions        */
+
+/*
+ * Create the debugfs files and directories
+ *
+ */
+void iwmct_dbgfs_register(struct iwmct_priv *priv, const char *name)
+{
+        struct iwmct_debugfs *dbgfs;
+
+        dbgfs = kzalloc(sizeof(struct iwmct_debugfs), GFP_KERNEL);
+        if (!dbgfs) {
+                LOG_ERROR(priv, DEBUGFS, "failed to allocate %zd bytes\n",
+                                        sizeof(struct iwmct_debugfs));
+                return;
+        }
+
+        priv->dbgfs = dbgfs;
+        dbgfs->name = name;
+        dbgfs->dir_drv = debugfs_create_dir(name, NULL);
+        if (!dbgfs->dir_drv) {
+                LOG_ERROR(priv, DEBUGFS, "failed to create debugfs dir\n");
+                return;
+        }
+
+        return;
+}
+
+/**
+ * Remove the debugfs files and directories
+ *
+ */
+void iwmct_dbgfs_unregister(struct iwmct_debugfs *dbgfs)
+{
+        if (!dbgfs)
+                return;
+
+        DEBUGFS_RM(dbgfs->dir_drv);
+        kfree(dbgfs);
+        dbgfs = NULL;
+}
+
diff --git a/drivers/misc/iwmc3200top/debugfs.h b/drivers/misc/iwmc3200top/debugfs.h
new file mode 100644
index 000000000000..71d45759b40f
--- /dev/null
+++ b/drivers/misc/iwmc3200top/debugfs.h
@@ -0,0 +1,58 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/debufs.h
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#ifndef __DEBUGFS_H__
+#define __DEBUGFS_H__
+
+
+#ifdef CONFIG_IWMC3200TOP_DEBUGFS
+
+struct iwmct_debugfs {
+        const char *name;
+        struct dentry *dir_drv;
+        struct dir_drv_files {
+        } dbgfs_drv_files;
+};
+
+void iwmct_dbgfs_register(struct iwmct_priv *priv, const char *name);
+void iwmct_dbgfs_unregister(struct iwmct_debugfs *dbgfs);
+
+#else /* CONFIG_IWMC3200TOP_DEBUGFS */
+
+struct iwmct_debugfs;
+
+static inline void
+iwmct_dbgfs_register(struct iwmct_priv *priv, const char *name)
+{}
+
+static inline void
+iwmct_dbgfs_unregister(struct iwmct_debugfs *dbgfs)
+{}
+
+#endif /* CONFIG_IWMC3200TOP_DEBUGFS */
+
+#endif /* __DEBUGFS_H__ */
+
diff --git a/drivers/misc/iwmc3200top/fw-download.c b/drivers/misc/iwmc3200top/fw-download.c
new file mode 100644
index 000000000000..e27afde6e99f
--- /dev/null
+++ b/drivers/misc/iwmc3200top/fw-download.c
@@ -0,0 +1,358 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/fw-download.c
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#include <linux/firmware.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/slab.h>
+#include <asm/unaligned.h>
+
+#include "iwmc3200top.h"
+#include "log.h"
+#include "fw-msg.h"
+
+#define CHECKSUM_BYTES_NUM sizeof(u32)
+
+/**
+  init parser struct with file
+ */
+static int iwmct_fw_parser_init(struct iwmct_priv *priv, const u8 *file,
+                              size_t file_size, size_t block_size)
+{
+        struct iwmct_parser *parser = &priv->parser;
+        struct iwmct_fw_hdr *fw_hdr = &parser->versions;
+
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
+
+        LOG_INFO(priv, FW_DOWNLOAD, "file_size=%zd\n", file_size);
+
+        parser->file = file;
+        parser->file_size = file_size;
+        parser->cur_pos = 0;
+        parser->entry_point = 0;
+        parser->buf = kzalloc(block_size, GFP_KERNEL);
+        if (!parser->buf) {
+                LOG_ERROR(priv, FW_DOWNLOAD, "kzalloc error\n");
+                return -ENOMEM;
+        }
+        parser->buf_size = block_size;
+
+        /* extract fw versions */
+        memcpy(fw_hdr, parser->file, sizeof(struct iwmct_fw_hdr));
+        LOG_INFO(priv, FW_DOWNLOAD, "fw versions are:\n"
+                "top %u.%u.%u gps %u.%u.%u bt %u.%u.%u tic %s\n",
+                fw_hdr->top_major, fw_hdr->top_minor, fw_hdr->top_revision,
+                fw_hdr->gps_major, fw_hdr->gps_minor, fw_hdr->gps_revision,
+                fw_hdr->bt_major, fw_hdr->bt_minor, fw_hdr->bt_revision,
+                fw_hdr->tic_name);
+
+        parser->cur_pos += sizeof(struct iwmct_fw_hdr);
+
+        LOG_TRACE(priv, FW_DOWNLOAD, "<--\n");
+        return 0;
+}
+
+static bool iwmct_checksum(struct iwmct_priv *priv)
+{
+        struct iwmct_parser *parser = &priv->parser;
+        __le32 *file = (__le32 *)parser->file;
+        int i, pad, steps;
+        u32 accum = 0;
+        u32 checksum;
+        u32 mask = 0xffffffff;
+
+        pad = (parser->file_size - CHECKSUM_BYTES_NUM) % 4;
+        steps =  (parser->file_size - CHECKSUM_BYTES_NUM) / 4;
+
+        LOG_INFO(priv, FW_DOWNLOAD, "pad=%d steps=%d\n", pad, steps);
+
+        for (i = 0; i < steps; i++)
+                accum += le32_to_cpu(file[i]);
+
+        if (pad) {
+                mask <<= 8 * (4 - pad);
+                accum += le32_to_cpu(file[steps]) & mask;
+        }
+
+        checksum = get_unaligned_le32((__le32 *)(parser->file +
+                        parser->file_size - CHECKSUM_BYTES_NUM));
+
+        LOG_INFO(priv, FW_DOWNLOAD,
+                "compare checksum accum=0x%x to checksum=0x%x\n",
+                accum, checksum);
+
+        return checksum == accum;
+}
+
+static int iwmct_parse_next_section(struct iwmct_priv *priv, const u8 **p_sec,
+                                  size_t *sec_size, __le32 *sec_addr)
+{
+        struct iwmct_parser *parser = &priv->parser;
+        struct iwmct_dbg *dbg = &priv->dbg;
+        struct iwmct_fw_sec_hdr *sec_hdr;
+
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
+
+        while (parser->cur_pos + sizeof(struct iwmct_fw_sec_hdr)
+                <= parser->file_size) {
+
+                sec_hdr = (struct iwmct_fw_sec_hdr *)
+                                (parser->file + parser->cur_pos);
+                parser->cur_pos += sizeof(struct iwmct_fw_sec_hdr);
+
+                LOG_INFO(priv, FW_DOWNLOAD,
+                        "sec hdr: type=%s addr=0x%x size=%d\n",
+                        sec_hdr->type, sec_hdr->target_addr,
+                        sec_hdr->data_size);
+
+                if (strcmp(sec_hdr->type, "ENT") == 0)
+                        parser->entry_point = le32_to_cpu(sec_hdr->target_addr);
+                else if (strcmp(sec_hdr->type, "LBL") == 0)
+                        strcpy(dbg->label_fw, parser->file + parser->cur_pos);
+                else if (((strcmp(sec_hdr->type, "TOP") == 0) &&
+                          (priv->barker & BARKER_DNLOAD_TOP_MSK)) ||
+                         ((strcmp(sec_hdr->type, "GPS") == 0) &&
+                          (priv->barker & BARKER_DNLOAD_GPS_MSK)) ||
+                         ((strcmp(sec_hdr->type, "BTH") == 0) &&
+                          (priv->barker & BARKER_DNLOAD_BT_MSK))) {
+                        *sec_addr = sec_hdr->target_addr;
+                        *sec_size = le32_to_cpu(sec_hdr->data_size);
+                        *p_sec = parser->file + parser->cur_pos;
+                        parser->cur_pos += le32_to_cpu(sec_hdr->data_size);
+                        return 1;
+                } else if (strcmp(sec_hdr->type, "LOG") != 0)
+                        LOG_WARNING(priv, FW_DOWNLOAD,
+                                    "skipping section type %s\n",
+                                    sec_hdr->type);
+
+                parser->cur_pos += le32_to_cpu(sec_hdr->data_size);
+                LOG_INFO(priv, FW_DOWNLOAD,
+                        "finished with section cur_pos=%zd\n", parser->cur_pos);
+        }
+
+        LOG_TRACE(priv, INIT, "<--\n");
+        return 0;
+}
+
+static int iwmct_download_section(struct iwmct_priv *priv, const u8 *p_sec,
+                                size_t sec_size, __le32 addr)
+{
+        struct iwmct_parser *parser = &priv->parser;
+        struct iwmct_fw_load_hdr *hdr = (struct iwmct_fw_load_hdr *)parser->buf;
+        const u8 *cur_block = p_sec;
+        size_t sent = 0;
+        int cnt = 0;
+        int ret = 0;
+        u32 cmd = 0;
+
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
+        LOG_INFO(priv, FW_DOWNLOAD, "Download address 0x%x size 0x%zx\n",
+                                addr, sec_size);
+
+        while (sent < sec_size) {
+                int i;
+                u32 chksm = 0;
+                u32 reset = atomic_read(&priv->reset);
+                /* actual FW data */
+                u32 data_size = min(parser->buf_size - sizeof(*hdr),
+                                    sec_size - sent);
+                /* Pad to block size */
+                u32 trans_size = (data_size + sizeof(*hdr) +
+                                  IWMC_SDIO_BLK_SIZE - 1) &
+                                  ~(IWMC_SDIO_BLK_SIZE - 1);
+                ++cnt;
+
+                /* in case of reset, interrupt FW DOWNLAOD */
+                if (reset) {
+                        LOG_INFO(priv, FW_DOWNLOAD,
+                                 "Reset detected. Abort FW download!!!");
+                        ret = -ECANCELED;
+                        goto exit;
+                }
+
+                memset(parser->buf, 0, parser->buf_size);
+                cmd |= IWMC_OPCODE_WRITE << CMD_HDR_OPCODE_POS;
+                cmd |= IWMC_CMD_SIGNATURE << CMD_HDR_SIGNATURE_POS;
+                cmd |= (priv->dbg.direct ? 1 : 0) << CMD_HDR_DIRECT_ACCESS_POS;
+                cmd |= (priv->dbg.checksum ? 1 : 0) << CMD_HDR_USE_CHECKSUM_POS;
+                hdr->data_size = cpu_to_le32(data_size);
+                hdr->target_addr = addr;
+
+                /* checksum is allowed for sizes divisible by 4 */
+                if (data_size & 0x3)
+                        cmd &= ~CMD_HDR_USE_CHECKSUM_MSK;
+
+                memcpy(hdr->data, cur_block, data_size);
+
+
+                if (cmd & CMD_HDR_USE_CHECKSUM_MSK) {
+
+                        chksm = data_size + le32_to_cpu(addr) + cmd;
+                        for (i = 0; i < data_size >> 2; i++)
+                                chksm += ((u32 *)cur_block)[i];
+
+                        hdr->block_chksm = cpu_to_le32(chksm);
+                        LOG_INFO(priv, FW_DOWNLOAD, "Checksum = 0x%X\n",
+                                 hdr->block_chksm);
+                }
+
+                LOG_INFO(priv, FW_DOWNLOAD, "trans#%d, len=%d, sent=%zd, "
+                                "sec_size=%zd, startAddress 0x%X\n",
+                                cnt, trans_size, sent, sec_size, addr);
+
+                if (priv->dbg.dump)
+                        LOG_HEXDUMP(FW_DOWNLOAD, parser->buf, trans_size);
+
+
+                hdr->cmd = cpu_to_le32(cmd);
+                /* send it down */
+                /* TODO: add more proper sending and error checking */
+                ret = iwmct_tx(priv, parser->buf, trans_size);
+                if (ret != 0) {
+                        LOG_INFO(priv, FW_DOWNLOAD,
+                                "iwmct_tx returned %d\n", ret);
+                        goto exit;
+                }
+
+                addr = cpu_to_le32(le32_to_cpu(addr) + data_size);
+                sent += data_size;
+                cur_block = p_sec + sent;
+
+                if (priv->dbg.blocks && (cnt + 1) >= priv->dbg.blocks) {
+                        LOG_INFO(priv, FW_DOWNLOAD,
+                                "Block number limit is reached [%d]\n",
+                                priv->dbg.blocks);
+                        break;
+                }
+        }
+
+        if (sent < sec_size)
+                ret = -EINVAL;
+exit:
+        LOG_TRACE(priv, FW_DOWNLOAD, "<--\n");
+        return ret;
+}
+
+static int iwmct_kick_fw(struct iwmct_priv *priv, bool jump)
+{
+        struct iwmct_parser *parser = &priv->parser;
+        struct iwmct_fw_load_hdr *hdr = (struct iwmct_fw_load_hdr *)parser->buf;
+        int ret;
+        u32 cmd;
+
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
+
+        memset(parser->buf, 0, parser->buf_size);
+        cmd = IWMC_CMD_SIGNATURE << CMD_HDR_SIGNATURE_POS;
+        if (jump) {
+                cmd |= IWMC_OPCODE_JUMP << CMD_HDR_OPCODE_POS;
+                hdr->target_addr = cpu_to_le32(parser->entry_point);
+                LOG_INFO(priv, FW_DOWNLOAD, "jump address 0x%x\n",
+                                parser->entry_point);
+        } else {
+                cmd |= IWMC_OPCODE_LAST_COMMAND << CMD_HDR_OPCODE_POS;
+                LOG_INFO(priv, FW_DOWNLOAD, "last command\n");
+        }
+
+        hdr->cmd = cpu_to_le32(cmd);
+
+        LOG_HEXDUMP(FW_DOWNLOAD, parser->buf, sizeof(*hdr));
+        /* send it down */
+        /* TODO: add more proper sending and error checking */
+        ret = iwmct_tx(priv, parser->buf, IWMC_SDIO_BLK_SIZE);
+        if (ret)
+                LOG_INFO(priv, FW_DOWNLOAD, "iwmct_tx returned %d", ret);
+
+        LOG_TRACE(priv, FW_DOWNLOAD, "<--\n");
+        return 0;
+}
+
+int iwmct_fw_load(struct iwmct_priv *priv)
+{
+        const u8 *fw_name = FW_NAME(FW_API_VER);
+        const struct firmware *raw;
+        const u8 *pdata;
+        size_t len;
+        __le32 addr;
+        int ret;
+
+
+        LOG_INFO(priv, FW_DOWNLOAD, "barker download request 0x%x is:\n",
+                        priv->barker);
+        LOG_INFO(priv, FW_DOWNLOAD, "*******  Top FW %s requested ********\n",
+                        (priv->barker & BARKER_DNLOAD_TOP_MSK) ? "was" : "not");
+        LOG_INFO(priv, FW_DOWNLOAD, "*******  GPS FW %s requested ********\n",
+                        (priv->barker & BARKER_DNLOAD_GPS_MSK) ? "was" : "not");
+        LOG_INFO(priv, FW_DOWNLOAD, "*******  BT FW %s requested ********\n",
+                        (priv->barker & BARKER_DNLOAD_BT_MSK) ? "was" : "not");
+
+
+        /* get the firmware */
+        ret = request_firmware(&raw, fw_name, &priv->func->dev);
+        if (ret < 0) {
+                LOG_ERROR(priv, FW_DOWNLOAD, "%s request_firmware failed %d\n",
+                          fw_name, ret);
+                goto exit;
+        }
+
+        if (raw->size < sizeof(struct iwmct_fw_sec_hdr)) {
+                LOG_ERROR(priv, FW_DOWNLOAD, "%s smaller then (%zd) (%zd)\n",
+                          fw_name, sizeof(struct iwmct_fw_sec_hdr), raw->size);
+                goto exit;
+        }
+
+        LOG_INFO(priv, FW_DOWNLOAD, "Read firmware '%s'\n", fw_name);
+
+        /* clear parser struct */
+        ret = iwmct_fw_parser_init(priv, raw->data, raw->size, priv->trans_len);
+        if (ret < 0) {
+                LOG_ERROR(priv, FW_DOWNLOAD,
+                          "iwmct_parser_init failed: Reason %d\n", ret);
+                goto exit;
+        }
+
+        if (!iwmct_checksum(priv)) {
+                LOG_ERROR(priv, FW_DOWNLOAD, "checksum error\n");
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        /* download firmware to device */
+        while (iwmct_parse_next_section(priv, &pdata, &len, &addr)) {
+                ret = iwmct_download_section(priv, pdata, len, addr);
+                if (ret) {
+                        LOG_ERROR(priv, FW_DOWNLOAD,
+                                  "%s download section failed\n", fw_name);
+                        goto exit;
+                }
+        }
+
+        ret = iwmct_kick_fw(priv, !!(priv->barker & BARKER_DNLOAD_JUMP_MSK));
+
+exit:
+        kfree(priv->parser.buf);
+        release_firmware(raw);
+        return ret;
+}
diff --git a/drivers/misc/iwmc3200top/fw-msg.h b/drivers/misc/iwmc3200top/fw-msg.h
new file mode 100644
index 000000000000..9e26b75bd482
--- /dev/null
+++ b/drivers/misc/iwmc3200top/fw-msg.h
@@ -0,0 +1,113 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/fw-msg.h
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#ifndef __FWMSG_H__
+#define __FWMSG_H__
+
+#define COMM_TYPE_D2H                   0xFF
+#define COMM_TYPE_H2D                   0xEE
+
+#define COMM_CATEGORY_OPERATIONAL       0x00
+#define COMM_CATEGORY_DEBUG             0x01
+#define COMM_CATEGORY_TESTABILITY       0x02
+#define COMM_CATEGORY_DIAGNOSTICS       0x03
+
+#define OP_DBG_ZSTR_MSG                 cpu_to_le16(0x1A)
+
+#define FW_LOG_SRC_MAX                  32
+#define FW_LOG_SRC_ALL                  255
+
+#define FW_STRING_TABLE_ADDR            cpu_to_le32(0x0C000000)
+
+#define CMD_DBG_LOG_LEVEL               cpu_to_le16(0x0001)
+#define CMD_TST_DEV_RESET               cpu_to_le16(0x0060)
+#define CMD_TST_FUNC_RESET              cpu_to_le16(0x0062)
+#define CMD_TST_IFACE_RESET             cpu_to_le16(0x0064)
+#define CMD_TST_CPU_UTILIZATION         cpu_to_le16(0x0065)
+#define CMD_TST_TOP_DEEP_SLEEP          cpu_to_le16(0x0080)
+#define CMD_TST_WAKEUP                  cpu_to_le16(0x0081)
+#define CMD_TST_FUNC_WAKEUP             cpu_to_le16(0x0082)
+#define CMD_TST_FUNC_DEEP_SLEEP_REQUEST cpu_to_le16(0x0083)
+#define CMD_TST_GET_MEM_DUMP            cpu_to_le16(0x0096)
+
+#define OP_OPR_ALIVE                    cpu_to_le16(0x0010)
+#define OP_OPR_CMD_ACK                  cpu_to_le16(0x001F)
+#define OP_OPR_CMD_NACK                 cpu_to_le16(0x0020)
+#define OP_TST_MEM_DUMP                 cpu_to_le16(0x0043)
+
+#define CMD_FLAG_PADDING_256            0x80
+
+#define FW_HCMD_BLOCK_SIZE              256
+
+struct msg_hdr {
+        u8 type;
+        u8 category;
+        __le16 opcode;
+        u8 seqnum;
+        u8 flags;
+        __le16 length;
+} __attribute__((__packed__));
+
+struct log_hdr {
+        __le32 timestamp;
+        u8 severity;
+        u8 logsource;
+        __le16 reserved;
+} __attribute__((__packed__));
+
+struct mdump_hdr {
+        u8 dmpid;
+        u8 frag;
+        __le16 size;
+        __le32 addr;
+} __attribute__((__packed__));
+
+struct top_msg {
+        struct msg_hdr hdr;
+        union {
+                /* D2H messages */
+                struct {
+                        struct log_hdr log_hdr;
+                        u8 data[1];
+                } __attribute__((__packed__)) log;
+
+                struct {
+                        struct log_hdr log_hdr;
+                        struct mdump_hdr md_hdr;
+                        u8 data[1];
+                } __attribute__((__packed__)) mdump;
+
+                /* H2D messages */
+                struct {
+                        u8 logsource;
+                        u8 sevmask;
+                } __attribute__((__packed__)) logdefs[FW_LOG_SRC_MAX];
+                struct mdump_hdr mdump_req;
+        } u;
+} __attribute__((__packed__));
+
+
+#endif /* __FWMSG_H__ */
diff --git a/drivers/misc/iwmc3200top/iwmc3200top.h b/drivers/misc/iwmc3200top/iwmc3200top.h
new file mode 100644
index 000000000000..740ff0738ea8
--- /dev/null
+++ b/drivers/misc/iwmc3200top/iwmc3200top.h
@@ -0,0 +1,207 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/iwmc3200top.h
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#ifndef __IWMC3200TOP_H__
+#define __IWMC3200TOP_H__
+
+#include <linux/workqueue.h>
+
+#define DRV_NAME "iwmc3200top"
+#define FW_API_VER 1
+#define _FW_NAME(api) DRV_NAME "." #api ".fw"
+#define FW_NAME(api) _FW_NAME(api)
+
+#define IWMC_SDIO_BLK_SIZE                      256
+#define IWMC_DEFAULT_TR_BLK                     64
+#define IWMC_SDIO_DATA_ADDR                     0x0
+#define IWMC_SDIO_INTR_ENABLE_ADDR              0x14
+#define IWMC_SDIO_INTR_STATUS_ADDR              0x13
+#define IWMC_SDIO_INTR_CLEAR_ADDR               0x13
+#define IWMC_SDIO_INTR_GET_SIZE_ADDR            0x2C
+
+#define COMM_HUB_HEADER_LENGTH 16
+#define LOGGER_HEADER_LENGTH   10
+
+
+#define BARKER_DNLOAD_BT_POS            0
+#define BARKER_DNLOAD_BT_MSK            BIT(BARKER_DNLOAD_BT_POS)
+#define BARKER_DNLOAD_GPS_POS           1
+#define BARKER_DNLOAD_GPS_MSK           BIT(BARKER_DNLOAD_GPS_POS)
+#define BARKER_DNLOAD_TOP_POS           2
+#define BARKER_DNLOAD_TOP_MSK           BIT(BARKER_DNLOAD_TOP_POS)
+#define BARKER_DNLOAD_RESERVED1_POS     3
+#define BARKER_DNLOAD_RESERVED1_MSK     BIT(BARKER_DNLOAD_RESERVED1_POS)
+#define BARKER_DNLOAD_JUMP_POS          4
+#define BARKER_DNLOAD_JUMP_MSK          BIT(BARKER_DNLOAD_JUMP_POS)
+#define BARKER_DNLOAD_SYNC_POS          5
+#define BARKER_DNLOAD_SYNC_MSK          BIT(BARKER_DNLOAD_SYNC_POS)
+#define BARKER_DNLOAD_RESERVED2_POS     6
+#define BARKER_DNLOAD_RESERVED2_MSK     (0x3 << BARKER_DNLOAD_RESERVED2_POS)
+#define BARKER_DNLOAD_BARKER_POS        8
+#define BARKER_DNLOAD_BARKER_MSK        (0xffffff << BARKER_DNLOAD_BARKER_POS)
+
+#define IWMC_BARKER_REBOOT      (0xdeadbe << BARKER_DNLOAD_BARKER_POS)
+/* whole field barker */
+#define IWMC_BARKER_ACK         0xfeedbabe
+
+#define IWMC_CMD_SIGNATURE      0xcbbc
+
+#define CMD_HDR_OPCODE_POS              0
+#define CMD_HDR_OPCODE_MSK_MSK          (0xf << CMD_HDR_OPCODE_MSK_POS)
+#define CMD_HDR_RESPONSE_CODE_POS       4
+#define CMD_HDR_RESPONSE_CODE_MSK       (0xf << CMD_HDR_RESPONSE_CODE_POS)
+#define CMD_HDR_USE_CHECKSUM_POS        8
+#define CMD_HDR_USE_CHECKSUM_MSK        BIT(CMD_HDR_USE_CHECKSUM_POS)
+#define CMD_HDR_RESPONSE_REQUIRED_POS   9
+#define CMD_HDR_RESPONSE_REQUIRED_MSK   BIT(CMD_HDR_RESPONSE_REQUIRED_POS)
+#define CMD_HDR_DIRECT_ACCESS_POS       10
+#define CMD_HDR_DIRECT_ACCESS_MSK       BIT(CMD_HDR_DIRECT_ACCESS_POS)
+#define CMD_HDR_RESERVED_POS            11
+#define CMD_HDR_RESERVED_MSK            BIT(0x1f << CMD_HDR_RESERVED_POS)
+#define CMD_HDR_SIGNATURE_POS           16
+#define CMD_HDR_SIGNATURE_MSK           BIT(0xffff << CMD_HDR_SIGNATURE_POS)
+
+enum {
+        IWMC_OPCODE_PING = 0,
+        IWMC_OPCODE_READ = 1,
+        IWMC_OPCODE_WRITE = 2,
+        IWMC_OPCODE_JUMP = 3,
+        IWMC_OPCODE_REBOOT = 4,
+        IWMC_OPCODE_PERSISTENT_WRITE = 5,
+        IWMC_OPCODE_PERSISTENT_READ = 6,
+        IWMC_OPCODE_READ_MODIFY_WRITE = 7,
+        IWMC_OPCODE_LAST_COMMAND = 15
+};
+
+struct iwmct_fw_load_hdr {
+        __le32 cmd;
+        __le32 target_addr;
+        __le32 data_size;
+        __le32 block_chksm;
+        u8 data[0];
+};
+
+/**
+ * struct iwmct_fw_hdr
+ * holds all sw components versions
+ */
+struct iwmct_fw_hdr {
+        u8 top_major;
+        u8 top_minor;
+        u8 top_revision;
+        u8 gps_major;
+        u8 gps_minor;
+        u8 gps_revision;
+        u8 bt_major;
+        u8 bt_minor;
+        u8 bt_revision;
+        u8 tic_name[31];
+};
+
+/**
+ * struct iwmct_fw_sec_hdr
+ * @type: function type
+ * @data_size: section's data size
+ * @target_addr: download address
+ */
+struct iwmct_fw_sec_hdr {
+        u8 type[4];
+        __le32 data_size;
+        __le32 target_addr;
+};
+
+/**
+ * struct iwmct_parser
+ * @file: fw image
+ * @file_size: fw size
+ * @cur_pos: position in file
+ * @buf: temp buf for download
+ * @buf_size: size of buf
+ * @entry_point: address to jump in fw kick-off
+ */
+struct iwmct_parser {
+        const u8 *file;
+        size_t file_size;
+        size_t cur_pos;
+        u8 *buf;
+        size_t buf_size;
+        u32 entry_point;
+        struct iwmct_fw_hdr versions;
+};
+
+
+struct iwmct_work_struct {
+        struct list_head list;
+        ssize_t iosize;
+};
+
+struct iwmct_dbg {
+        int blocks;
+        bool dump;
+        bool jump;
+        bool direct;
+        bool checksum;
+        bool fw_download;
+        int block_size;
+        int download_trans_blks;
+
+        char label_fw[256];
+};
+
+struct iwmct_debugfs;
+
+struct iwmct_priv {
+        struct sdio_func *func;
+        struct iwmct_debugfs *dbgfs;
+        struct iwmct_parser parser;
+        atomic_t reset;
+        atomic_t dev_sync;
+        u32 trans_len;
+        u32 barker;
+        struct iwmct_dbg dbg;
+
+        /* drivers work queue */
+        struct workqueue_struct *wq;
+        struct workqueue_struct *bus_rescan_wq;
+        struct work_struct bus_rescan_worker;
+        struct work_struct isr_worker;
+
+        /* drivers wait queue */
+        wait_queue_head_t wait_q;
+
+        /* rx request list */
+        struct list_head read_req_list;
+};
+
+extern int iwmct_tx(struct iwmct_priv *priv, void *src, int count);
+extern int iwmct_fw_load(struct iwmct_priv *priv);
+
+extern void iwmct_dbg_init_params(struct iwmct_priv *drv);
+extern void iwmct_dbg_init_drv_attrs(struct device_driver *drv);
+extern void iwmct_dbg_remove_drv_attrs(struct device_driver *drv);
+extern int iwmct_send_hcmd(struct iwmct_priv *priv, u8 *cmd, u16 len);
+
+#endif  /*  __IWMC3200TOP_H__  */
diff --git a/drivers/misc/iwmc3200top/log.c b/drivers/misc/iwmc3200top/log.c
new file mode 100644
index 000000000000..a36a55a49cac
--- /dev/null
+++ b/drivers/misc/iwmc3200top/log.c
@@ -0,0 +1,348 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/log.c
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/slab.h>
+#include <linux/ctype.h>
+#include "fw-msg.h"
+#include "iwmc3200top.h"
+#include "log.h"
+
+/* Maximal hexadecimal string size of the FW memdump message */
+#define LOG_MSG_SIZE_MAX                12400
+
+/* iwmct_logdefs is a global used by log macros */
+u8 iwmct_logdefs[LOG_SRC_MAX];
+static u8 iwmct_fw_logdefs[FW_LOG_SRC_MAX];
+
+
+static int _log_set_log_filter(u8 *logdefs, int size, u8 src, u8 logmask)
+{
+        int i;
+
+        if (src < size)
+                logdefs[src] = logmask;
+        else if (src == LOG_SRC_ALL)
+                for (i = 0; i < size; i++)
+                        logdefs[i] = logmask;
+        else
+                return -1;
+
+        return 0;
+}
+
+
+int iwmct_log_set_filter(u8 src, u8 logmask)
+{
+        return _log_set_log_filter(iwmct_logdefs, LOG_SRC_MAX, src, logmask);
+}
+
+
+int iwmct_log_set_fw_filter(u8 src, u8 logmask)
+{
+        return _log_set_log_filter(iwmct_fw_logdefs,
+                                   FW_LOG_SRC_MAX, src, logmask);
+}
+
+
+static int log_msg_format_hex(char *str, int slen, u8 *ibuf,
+                              int ilen, char *pref)
+{
+        int pos = 0;
+        int i;
+        int len;
+
+        for (pos = 0, i = 0; pos < slen - 2 && pref[i] != '\0'; i++, pos++)
+                str[pos] = pref[i];
+
+        for (i = 0; pos < slen - 2 && i < ilen; pos += len, i++)
+                len = snprintf(&str[pos], slen - pos - 1, " %2.2X", ibuf[i]);
+
+        if (i < ilen)
+                return -1;
+
+        return 0;
+}
+
+/*      NOTE: This function is not thread safe.
+        Currently it's called only from sdio rx worker - no race there
+*/
+void iwmct_log_top_message(struct iwmct_priv *priv, u8 *buf, int len)
+{
+        struct top_msg *msg;
+        static char logbuf[LOG_MSG_SIZE_MAX];
+
+        msg = (struct top_msg *)buf;
+
+        if (len < sizeof(msg->hdr) + sizeof(msg->u.log.log_hdr)) {
+                LOG_ERROR(priv, FW_MSG, "Log message from TOP "
+                          "is too short %d (expected %zd)\n",
+                          len, sizeof(msg->hdr) + sizeof(msg->u.log.log_hdr));
+                return;
+        }
+
+        if (!(iwmct_fw_logdefs[msg->u.log.log_hdr.logsource] &
+                BIT(msg->u.log.log_hdr.severity)) ||
+            !(iwmct_logdefs[LOG_SRC_FW_MSG] & BIT(msg->u.log.log_hdr.severity)))
+                return;
+
+        switch (msg->hdr.category) {
+        case COMM_CATEGORY_TESTABILITY:
+                if (!(iwmct_logdefs[LOG_SRC_TST] &
+                      BIT(msg->u.log.log_hdr.severity)))
+                        return;
+                if (log_msg_format_hex(logbuf, LOG_MSG_SIZE_MAX, buf,
+                                       le16_to_cpu(msg->hdr.length) +
+                                       sizeof(msg->hdr), "<TST>"))
+                        LOG_WARNING(priv, TST,
+                                  "TOP TST message is too long, truncating...");
+                LOG_WARNING(priv, TST, "%s\n", logbuf);
+                break;
+        case COMM_CATEGORY_DEBUG:
+                if (msg->hdr.opcode == OP_DBG_ZSTR_MSG)
+                        LOG_INFO(priv, FW_MSG, "%s %s", "<DBG>",
+                                       ((u8 *)msg) + sizeof(msg->hdr)
+                                        + sizeof(msg->u.log.log_hdr));
+                else {
+                        if (log_msg_format_hex(logbuf, LOG_MSG_SIZE_MAX, buf,
+                                        le16_to_cpu(msg->hdr.length)
+                                                + sizeof(msg->hdr),
+                                        "<DBG>"))
+                                LOG_WARNING(priv, FW_MSG,
+                                        "TOP DBG message is too long,"
+                                        "truncating...");
+                        LOG_WARNING(priv, FW_MSG, "%s\n", logbuf);
+                }
+                break;
+        default:
+                break;
+        }
+}
+
+static int _log_get_filter_str(u8 *logdefs, int logdefsz, char *buf, int size)
+{
+        int i, pos, len;
+        for (i = 0, pos = 0; (pos < size-1) && (i < logdefsz); i++) {
+                len = snprintf(&buf[pos], size - pos - 1, "0x%02X%02X,",
+                                i, logdefs[i]);
+                pos += len;
+        }
+        buf[pos-1] = '\n';
+        buf[pos] = '\0';
+
+        if (i < logdefsz)
+                return -1;
+        return 0;
+}
+
+int log_get_filter_str(char *buf, int size)
+{
+        return _log_get_filter_str(iwmct_logdefs, LOG_SRC_MAX, buf, size);
+}
+
+int log_get_fw_filter_str(char *buf, int size)
+{
+        return _log_get_filter_str(iwmct_fw_logdefs, FW_LOG_SRC_MAX, buf, size);
+}
+
+#define HEXADECIMAL_RADIX       16
+#define LOG_SRC_FORMAT          7 /* log level is in format of "0xXXXX," */
+
+ssize_t show_iwmct_log_level(struct device *d,
+                                struct device_attribute *attr, char *buf)
+{
+        struct iwmct_priv *priv = dev_get_drvdata(d);
+        char *str_buf;
+        int buf_size;
+        ssize_t ret;
+
+        buf_size = (LOG_SRC_FORMAT * LOG_SRC_MAX) + 1;
+        str_buf = kzalloc(buf_size, GFP_KERNEL);
+        if (!str_buf) {
+                LOG_ERROR(priv, DEBUGFS,
+                        "failed to allocate %d bytes\n", buf_size);
+                ret = -ENOMEM;
+                goto exit;
+        }
+
+        if (log_get_filter_str(str_buf, buf_size) < 0) {
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        ret = sprintf(buf, "%s", str_buf);
+
+exit:
+        kfree(str_buf);
+        return ret;
+}
+
+ssize_t store_iwmct_log_level(struct device *d,
+                        struct device_attribute *attr,
+                        const char *buf, size_t count)
+{
+        struct iwmct_priv *priv = dev_get_drvdata(d);
+        char *token, *str_buf = NULL;
+        long val;
+        ssize_t ret = count;
+        u8 src, mask;
+
+        if (!count)
+                goto exit;
+
+        str_buf = kzalloc(count, GFP_KERNEL);
+        if (!str_buf) {
+                LOG_ERROR(priv, DEBUGFS,
+                        "failed to allocate %zd bytes\n", count);
+                ret = -ENOMEM;
+                goto exit;
+        }
+
+        memcpy(str_buf, buf, count);
+
+        while ((token = strsep(&str_buf, ",")) != NULL) {
+                while (isspace(*token))
+                        ++token;
+                if (strict_strtol(token, HEXADECIMAL_RADIX, &val)) {
+                        LOG_ERROR(priv, DEBUGFS,
+                                  "failed to convert string to long %s\n",
+                                  token);
+                        ret = -EINVAL;
+                        goto exit;
+                }
+
+                mask  = val & 0xFF;
+                src = (val & 0XFF00) >> 8;
+                iwmct_log_set_filter(src, mask);
+        }
+
+exit:
+        kfree(str_buf);
+        return ret;
+}
+
+ssize_t show_iwmct_log_level_fw(struct device *d,
+                        struct device_attribute *attr, char *buf)
+{
+        struct iwmct_priv *priv = dev_get_drvdata(d);
+        char *str_buf;
+        int buf_size;
+        ssize_t ret;
+
+        buf_size = (LOG_SRC_FORMAT * FW_LOG_SRC_MAX) + 2;
+
+        str_buf = kzalloc(buf_size, GFP_KERNEL);
+        if (!str_buf) {
+                LOG_ERROR(priv, DEBUGFS,
+                        "failed to allocate %d bytes\n", buf_size);
+                ret = -ENOMEM;
+                goto exit;
+        }
+
+        if (log_get_fw_filter_str(str_buf, buf_size) < 0) {
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        ret = sprintf(buf, "%s", str_buf);
+
+exit:
+        kfree(str_buf);
+        return ret;
+}
+
+ssize_t store_iwmct_log_level_fw(struct device *d,
+                        struct device_attribute *attr,
+                        const char *buf, size_t count)
+{
+        struct iwmct_priv *priv = dev_get_drvdata(d);
+        struct top_msg cmd;
+        char *token, *str_buf = NULL;
+        ssize_t ret = count;
+        u16 cmdlen = 0;
+        int i;
+        long val;
+        u8 src, mask;
+
+        if (!count)
+                goto exit;
+
+        str_buf = kzalloc(count, GFP_KERNEL);
+        if (!str_buf) {
+                LOG_ERROR(priv, DEBUGFS,
+                        "failed to allocate %zd bytes\n", count);
+                ret = -ENOMEM;
+                goto exit;
+        }
+
+        memcpy(str_buf, buf, count);
+
+        cmd.hdr.type = COMM_TYPE_H2D;
+        cmd.hdr.category = COMM_CATEGORY_DEBUG;
+        cmd.hdr.opcode = CMD_DBG_LOG_LEVEL;
+
+        for (i = 0; ((token = strsep(&str_buf, ",")) != NULL) &&
+                     (i < FW_LOG_SRC_MAX); i++) {
+
+                while (isspace(*token))
+                        ++token;
+
+                if (strict_strtol(token, HEXADECIMAL_RADIX, &val)) {
+                        LOG_ERROR(priv, DEBUGFS,
+                                  "failed to convert string to long %s\n",
+                                  token);
+                        ret = -EINVAL;
+                        goto exit;
+                }
+
+                mask  = val & 0xFF; /* LSB */
+                src = (val & 0XFF00) >> 8; /* 2nd least significant byte. */
+                iwmct_log_set_fw_filter(src, mask);
+
+                cmd.u.logdefs[i].logsource = src;
+                cmd.u.logdefs[i].sevmask = mask;
+        }
+
+        cmd.hdr.length = cpu_to_le16(i * sizeof(cmd.u.logdefs[0]));
+        cmdlen = (i * sizeof(cmd.u.logdefs[0]) + sizeof(cmd.hdr));
+
+        ret = iwmct_send_hcmd(priv, (u8 *)&cmd, cmdlen);
+        if (ret) {
+                LOG_ERROR(priv, DEBUGFS,
+                          "Failed to send %d bytes of fwcmd, ret=%zd\n",
+                          cmdlen, ret);
+                goto exit;
+        } else
+                LOG_INFO(priv, DEBUGFS, "fwcmd sent (%d bytes)\n", cmdlen);
+
+        ret = count;
+
+exit:
+        kfree(str_buf);
+        return ret;
+}
+
diff --git a/drivers/misc/iwmc3200top/log.h b/drivers/misc/iwmc3200top/log.h
new file mode 100644
index 000000000000..4434bb16cea7
--- /dev/null
+++ b/drivers/misc/iwmc3200top/log.h
@@ -0,0 +1,171 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/log.h
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#ifndef __LOG_H__
+#define __LOG_H__
+
+
+/* log severity:
+ * The log levels here match FW log levels
+ * so values need to stay as is */
+#define LOG_SEV_CRITICAL                0
+#define LOG_SEV_ERROR                   1
+#define LOG_SEV_WARNING                 2
+#define LOG_SEV_INFO                    3
+#define LOG_SEV_INFOEX                  4
+
+/* Log levels not defined for FW */
+#define LOG_SEV_TRACE                   5
+#define LOG_SEV_DUMP                    6
+
+#define LOG_SEV_FW_FILTER_ALL           \
+        (BIT(LOG_SEV_CRITICAL)  |       \
+         BIT(LOG_SEV_ERROR)     |       \
+         BIT(LOG_SEV_WARNING)   |       \
+         BIT(LOG_SEV_INFO)      |       \
+         BIT(LOG_SEV_INFOEX))
+
+#define LOG_SEV_FILTER_ALL              \
+        (BIT(LOG_SEV_CRITICAL)  |       \
+         BIT(LOG_SEV_ERROR)     |       \
+         BIT(LOG_SEV_WARNING)   |       \
+         BIT(LOG_SEV_INFO)      |       \
+         BIT(LOG_SEV_INFOEX)    |       \
+         BIT(LOG_SEV_TRACE)     |       \
+         BIT(LOG_SEV_DUMP))
+
+/* log source */
+#define LOG_SRC_INIT                    0
+#define LOG_SRC_DEBUGFS                 1
+#define LOG_SRC_FW_DOWNLOAD             2
+#define LOG_SRC_FW_MSG                  3
+#define LOG_SRC_TST                     4
+#define LOG_SRC_IRQ                     5
+
+#define LOG_SRC_MAX                     6
+#define LOG_SRC_ALL                     0xFF
+
+/**
+ * Default intitialization runtime log level
+ */
+#ifndef LOG_SEV_FILTER_RUNTIME
+#define LOG_SEV_FILTER_RUNTIME                  \
+        (BIT(LOG_SEV_CRITICAL)  |               \
+         BIT(LOG_SEV_ERROR)     |               \
+         BIT(LOG_SEV_WARNING))
+#endif
+
+#ifndef FW_LOG_SEV_FILTER_RUNTIME
+#define FW_LOG_SEV_FILTER_RUNTIME       LOG_SEV_FILTER_ALL
+#endif
+
+#ifdef CONFIG_IWMC3200TOP_DEBUG
+/**
+ * Log macros
+ */
+
+#define priv2dev(priv) (&(priv->func)->dev)
+
+#define LOG_CRITICAL(priv, src, fmt, args...)                           \
+do {                                                                    \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_CRITICAL))     \
+                dev_crit(priv2dev(priv), "%s %d: " fmt,                 \
+                        __func__, __LINE__, ##args);                    \
+} while (0)
+
+#define LOG_ERROR(priv, src, fmt, args...)                              \
+do {                                                                    \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_ERROR))        \
+                dev_err(priv2dev(priv), "%s %d: " fmt,                  \
+                        __func__, __LINE__, ##args);                    \
+} while (0)
+
+#define LOG_WARNING(priv, src, fmt, args...)                            \
+do {                                                                    \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_WARNING))      \
+                dev_warn(priv2dev(priv), "%s %d: " fmt,                 \
+                         __func__, __LINE__, ##args);                   \
+} while (0)
+
+#define LOG_INFO(priv, src, fmt, args...)                               \
+do {                                                                    \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_INFO))         \
+                dev_info(priv2dev(priv), "%s %d: " fmt,                 \
+                         __func__, __LINE__, ##args);                   \
+} while (0)
+
+#define LOG_TRACE(priv, src, fmt, args...)                              \
+do {                                                                    \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_TRACE))        \
+                dev_dbg(priv2dev(priv), "%s %d: " fmt,                  \
+                         __func__, __LINE__, ##args);                   \
+} while (0)
+
+#define LOG_HEXDUMP(src, ptr, len)                                      \
+do {                                                                    \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_DUMP)) \
+                print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_NONE,        \
+                                16, 1, ptr, len, false);                \
+} while (0)
+
+void iwmct_log_top_message(struct iwmct_priv *priv, u8 *buf, int len);
+
+extern u8 iwmct_logdefs[];
+
+int iwmct_log_set_filter(u8 src, u8 logmask);
+int iwmct_log_set_fw_filter(u8 src, u8 logmask);
+
+ssize_t show_iwmct_log_level(struct device *d,
+                        struct device_attribute *attr, char *buf);
+ssize_t store_iwmct_log_level(struct device *d,
+                        struct device_attribute *attr,
+                        const char *buf, size_t count);
+ssize_t show_iwmct_log_level_fw(struct device *d,
+                        struct device_attribute *attr, char *buf);
+ssize_t store_iwmct_log_level_fw(struct device *d,
+                        struct device_attribute *attr,
+                        const char *buf, size_t count);
+
+#else
+
+#define LOG_CRITICAL(priv, src, fmt, args...)
+#define LOG_ERROR(priv, src, fmt, args...)
+#define LOG_WARNING(priv, src, fmt, args...)
+#define LOG_INFO(priv, src, fmt, args...)
+#define LOG_TRACE(priv, src, fmt, args...)
+#define LOG_HEXDUMP(src, ptr, len)
+
+static inline void iwmct_log_top_message(struct iwmct_priv *priv,
+                                         u8 *buf, int len) {}
+static inline int iwmct_log_set_filter(u8 src, u8 logmask) { return 0; }
+static inline int iwmct_log_set_fw_filter(u8 src, u8 logmask) { return 0; }
+
+#endif /* CONFIG_IWMC3200TOP_DEBUG */
+
+int log_get_filter_str(char *buf, int size);
+int log_get_fw_filter_str(char *buf, int size);
+
+#endif /* __LOG_H__ */
diff --git a/drivers/misc/iwmc3200top/main.c b/drivers/misc/iwmc3200top/main.c
new file mode 100644
index 000000000000..c73cef2c3c5e
--- /dev/null
+++ b/drivers/misc/iwmc3200top/main.c
@@ -0,0 +1,666 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/main.c
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/debugfs.h>
+#include <linux/mmc/sdio_ids.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio.h>
+
+#include "iwmc3200top.h"
+#include "log.h"
+#include "fw-msg.h"
+#include "debugfs.h"
+
+
+#define DRIVER_DESCRIPTION "Intel(R) IWMC 3200 Top Driver"
+#define DRIVER_COPYRIGHT "Copyright (c) 2008 Intel Corporation."
+
+#define DRIVER_VERSION  "0.1.62"
+
+MODULE_DESCRIPTION(DRIVER_DESCRIPTION);
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR(DRIVER_COPYRIGHT);
+MODULE_FIRMWARE(FW_NAME(FW_API_VER));
+
+
+static inline int __iwmct_tx(struct iwmct_priv *priv, void *src, int count)
+{
+        return sdio_memcpy_toio(priv->func, IWMC_SDIO_DATA_ADDR, src, count);
+
+}
+int iwmct_tx(struct iwmct_priv *priv, void *src, int count)
+{
+        int ret;
+        sdio_claim_host(priv->func);
+        ret =  __iwmct_tx(priv, src, count);
+        sdio_release_host(priv->func);
+        return ret;
+}
+/*
+ * This workers main task is to wait for OP_OPR_ALIVE
+ * from TOP FW until ALIVE_MSG_TIMOUT timeout is elapsed.
+ * When OP_OPR_ALIVE received it will issue
+ * a call to "bus_rescan_devices".
+ */
+static void iwmct_rescan_worker(struct work_struct *ws)
+{
+        struct iwmct_priv *priv;
+        int ret;
+
+        priv = container_of(ws, struct iwmct_priv, bus_rescan_worker);
+
+        LOG_INFO(priv, FW_MSG, "Calling bus_rescan\n");
+
+        ret = bus_rescan_devices(priv->func->dev.bus);
+        if (ret < 0)
+                LOG_INFO(priv, INIT, "bus_rescan_devices FAILED!!!\n");
+}
+
+static void op_top_message(struct iwmct_priv *priv, struct top_msg *msg)
+{
+        switch (msg->hdr.opcode) {
+        case OP_OPR_ALIVE:
+                LOG_INFO(priv, FW_MSG, "Got ALIVE from device, wake rescan\n");
+                queue_work(priv->bus_rescan_wq, &priv->bus_rescan_worker);
+                break;
+        default:
+                LOG_INFO(priv, FW_MSG, "Received msg opcode 0x%X\n",
+                        msg->hdr.opcode);
+                break;
+        }
+}
+
+
+static void handle_top_message(struct iwmct_priv *priv, u8 *buf, int len)
+{
+        struct top_msg *msg;
+
+        msg = (struct top_msg *)buf;
+
+        if (msg->hdr.type != COMM_TYPE_D2H) {
+                LOG_ERROR(priv, FW_MSG,
+                        "Message from TOP with invalid message type 0x%X\n",
+                        msg->hdr.type);
+                return;
+        }
+
+        if (len < sizeof(msg->hdr)) {
+                LOG_ERROR(priv, FW_MSG,
+                        "Message from TOP is too short for message header "
+                        "received %d bytes, expected at least %zd bytes\n",
+                        len, sizeof(msg->hdr));
+                return;
+        }
+
+        if (len < le16_to_cpu(msg->hdr.length) + sizeof(msg->hdr)) {
+                LOG_ERROR(priv, FW_MSG,
+                        "Message length (%d bytes) is shorter than "
+                        "in header (%d bytes)\n",
+                        len, le16_to_cpu(msg->hdr.length));
+                return;
+        }
+
+        switch (msg->hdr.category) {
+        case COMM_CATEGORY_OPERATIONAL:
+                op_top_message(priv, (struct top_msg *)buf);
+                break;
+
+        case COMM_CATEGORY_DEBUG:
+        case COMM_CATEGORY_TESTABILITY:
+        case COMM_CATEGORY_DIAGNOSTICS:
+                iwmct_log_top_message(priv, buf, len);
+                break;
+
+        default:
+                LOG_ERROR(priv, FW_MSG,
+                        "Message from TOP with unknown category 0x%X\n",
+                        msg->hdr.category);
+                break;
+        }
+}
+
+int iwmct_send_hcmd(struct iwmct_priv *priv, u8 *cmd, u16 len)
+{
+        int ret;
+        u8 *buf;
+
+        LOG_TRACE(priv, FW_MSG, "Sending hcmd:\n");
+
+        /* add padding to 256 for IWMC */
+        ((struct top_msg *)cmd)->hdr.flags |= CMD_FLAG_PADDING_256;
+
+        LOG_HEXDUMP(FW_MSG, cmd, len);
+
+        if (len > FW_HCMD_BLOCK_SIZE) {
+                LOG_ERROR(priv, FW_MSG, "size %d exceeded hcmd max size %d\n",
+                          len, FW_HCMD_BLOCK_SIZE);
+                return -1;
+        }
+
+        buf = kzalloc(FW_HCMD_BLOCK_SIZE, GFP_KERNEL);
+        if (!buf) {
+                LOG_ERROR(priv, FW_MSG, "kzalloc error, buf size %d\n",
+                          FW_HCMD_BLOCK_SIZE);
+                return -1;
+        }
+
+        memcpy(buf, cmd, len);
+        ret = iwmct_tx(priv, buf, FW_HCMD_BLOCK_SIZE);
+
+        kfree(buf);
+        return ret;
+}
+
+
+static void iwmct_irq_read_worker(struct work_struct *ws)
+{
+        struct iwmct_priv *priv;
+        struct iwmct_work_struct *read_req;
+        __le32 *buf = NULL;
+        int ret;
+        int iosize;
+        u32 barker;
+        bool is_barker;
+
+        priv = container_of(ws, struct iwmct_priv, isr_worker);
+
+        LOG_TRACE(priv, IRQ, "enter iwmct_irq_read_worker %p\n", ws);
+
+        /* --------------------- Handshake with device -------------------- */
+        sdio_claim_host(priv->func);
+
+        /* all list manipulations have to be protected by
+         * sdio_claim_host/sdio_release_host */
+        if (list_empty(&priv->read_req_list)) {
+                LOG_ERROR(priv, IRQ, "read_req_list empty in read worker\n");
+                goto exit_release;
+        }
+
+        read_req = list_entry(priv->read_req_list.next,
+                              struct iwmct_work_struct, list);
+
+        list_del(&read_req->list);
+        iosize = read_req->iosize;
+        kfree(read_req);
+
+        buf = kzalloc(iosize, GFP_KERNEL);
+        if (!buf) {
+                LOG_ERROR(priv, IRQ, "kzalloc error, buf size %d\n", iosize);
+                goto exit_release;
+        }
+
+        LOG_INFO(priv, IRQ, "iosize=%d, buf=%p, func=%d\n",
+                                iosize, buf, priv->func->num);
+
+        /* read from device */
+        ret = sdio_memcpy_fromio(priv->func, buf, IWMC_SDIO_DATA_ADDR, iosize);
+        if (ret) {
+                LOG_ERROR(priv, IRQ, "error %d reading buffer\n", ret);
+                goto exit_release;
+        }
+
+        LOG_HEXDUMP(IRQ, (u8 *)buf, iosize);
+
+        barker = le32_to_cpu(buf[0]);
+
+        /* Verify whether it's a barker and if not - treat as regular Rx */
+        if (barker == IWMC_BARKER_ACK ||
+            (barker & BARKER_DNLOAD_BARKER_MSK) == IWMC_BARKER_REBOOT) {
+
+                /* Valid Barker is equal on first 4 dwords */
+                is_barker = (buf[1] == buf[0]) &&
+                            (buf[2] == buf[0]) &&
+                            (buf[3] == buf[0]);
+
+                if (!is_barker) {
+                        LOG_WARNING(priv, IRQ,
+                                "Potentially inconsistent barker "
+                                "%08X_%08X_%08X_%08X\n",
+                                le32_to_cpu(buf[0]), le32_to_cpu(buf[1]),
+                                le32_to_cpu(buf[2]), le32_to_cpu(buf[3]));
+                }
+        } else {
+                is_barker = false;
+        }
+
+        /* Handle Top CommHub message */
+        if (!is_barker) {
+                sdio_release_host(priv->func);
+                handle_top_message(priv, (u8 *)buf, iosize);
+                goto exit;
+        } else if (barker == IWMC_BARKER_ACK) { /* Handle barkers */
+                if (atomic_read(&priv->dev_sync) == 0) {
+                        LOG_ERROR(priv, IRQ,
+                                  "ACK barker arrived out-of-sync\n");
+                        goto exit_release;
+                }
+
+                /* Continuing to FW download (after Sync is completed)*/
+                atomic_set(&priv->dev_sync, 0);
+                LOG_INFO(priv, IRQ, "ACK barker arrived "
+                                "- starting FW download\n");
+        } else { /* REBOOT barker */
+                LOG_INFO(priv, IRQ, "Recieved reboot barker: %x\n", barker);
+                priv->barker = barker;
+
+                if (barker & BARKER_DNLOAD_SYNC_MSK) {
+                        /* Send the same barker back */
+                        ret = __iwmct_tx(priv, buf, iosize);
+                        if (ret) {
+                                LOG_ERROR(priv, IRQ,
+                                         "error %d echoing barker\n", ret);
+                                goto exit_release;
+                        }
+                        LOG_INFO(priv, IRQ, "Echoing barker to device\n");
+                        atomic_set(&priv->dev_sync, 1);
+                        goto exit_release;
+                }
+
+                /* Continuing to FW download (without Sync) */
+                LOG_INFO(priv, IRQ, "No sync requested "
+                                    "- starting FW download\n");
+        }
+
+        sdio_release_host(priv->func);
+
+        if (priv->dbg.fw_download)
+                iwmct_fw_load(priv);
+        else
+                LOG_ERROR(priv, IRQ, "FW download not allowed\n");
+
+        goto exit;
+
+exit_release:
+        sdio_release_host(priv->func);
+exit:
+        kfree(buf);
+        LOG_TRACE(priv, IRQ, "exit iwmct_irq_read_worker\n");
+}
+
+static void iwmct_irq(struct sdio_func *func)
+{
+        struct iwmct_priv *priv;
+        int val, ret;
+        int iosize;
+        int addr = IWMC_SDIO_INTR_GET_SIZE_ADDR;
+        struct iwmct_work_struct *read_req;
+
+        priv = sdio_get_drvdata(func);
+
+        LOG_TRACE(priv, IRQ, "enter iwmct_irq\n");
+
+        /* read the function's status register */
+        val = sdio_readb(func, IWMC_SDIO_INTR_STATUS_ADDR, &ret);
+
+        LOG_TRACE(priv, IRQ, "iir value = %d, ret=%d\n", val, ret);
+
+        if (!val) {
+                LOG_ERROR(priv, IRQ, "iir = 0, exiting ISR\n");
+                goto exit_clear_intr;
+        }
+
+
+        /*
+         * read 2 bytes of the transaction size
+         * IMPORTANT: sdio transaction size has to be read before clearing
+         * sdio interrupt!!!
+         */
+        val = sdio_readb(priv->func, addr++, &ret);
+        iosize = val;
+        val = sdio_readb(priv->func, addr++, &ret);
+        iosize += val << 8;
+
+        LOG_INFO(priv, IRQ, "READ size %d\n", iosize);
+
+        if (iosize == 0) {
+                LOG_ERROR(priv, IRQ, "READ size %d, exiting ISR\n", iosize);
+                goto exit_clear_intr;
+        }
+
+        /* allocate a work structure to pass iosize to the worker */
+        read_req = kzalloc(sizeof(struct iwmct_work_struct), GFP_KERNEL);
+        if (!read_req) {
+                LOG_ERROR(priv, IRQ, "failed to allocate read_req, exit ISR\n");
+                goto exit_clear_intr;
+        }
+
+        INIT_LIST_HEAD(&read_req->list);
+        read_req->iosize = iosize;
+
+        list_add_tail(&priv->read_req_list, &read_req->list);
+
+        /* clear the function's interrupt request bit (write 1 to clear) */
+        sdio_writeb(func, 1, IWMC_SDIO_INTR_CLEAR_ADDR, &ret);
+
+        queue_work(priv->wq, &priv->isr_worker);
+
+        LOG_TRACE(priv, IRQ, "exit iwmct_irq\n");
+
+        return;
+
+exit_clear_intr:
+        /* clear the function's interrupt request bit (write 1 to clear) */
+        sdio_writeb(func, 1, IWMC_SDIO_INTR_CLEAR_ADDR, &ret);
+}
+
+
+static int blocks;
+module_param(blocks, int, 0604);
+MODULE_PARM_DESC(blocks, "max_blocks_to_send");
+
+static int dump;
+module_param(dump, bool, 0604);
+MODULE_PARM_DESC(dump, "dump_hex_content");
+
+static int jump = 1;
+module_param(jump, bool, 0604);
+
+static int direct = 1;
+module_param(direct, bool, 0604);
+
+static int checksum = 1;
+module_param(checksum, bool, 0604);
+
+static int fw_download = 1;
+module_param(fw_download, bool, 0604);
+
+static int block_size = IWMC_SDIO_BLK_SIZE;
+module_param(block_size, int, 0404);
+
+static int download_trans_blks = IWMC_DEFAULT_TR_BLK;
+module_param(download_trans_blks, int, 0604);
+
+static int rubbish_barker;
+module_param(rubbish_barker, bool, 0604);
+
+#ifdef CONFIG_IWMC3200TOP_DEBUG
+static int log_level[LOG_SRC_MAX];
+static unsigned int log_level_argc;
+module_param_array(log_level, int, &log_level_argc, 0604);
+MODULE_PARM_DESC(log_level, "log_level");
+
+static int log_level_fw[FW_LOG_SRC_MAX];
+static unsigned int log_level_fw_argc;
+module_param_array(log_level_fw, int, &log_level_fw_argc, 0604);
+MODULE_PARM_DESC(log_level_fw, "log_level_fw");
+#endif
+
+void iwmct_dbg_init_params(struct iwmct_priv *priv)
+{
+#ifdef CONFIG_IWMC3200TOP_DEBUG
+        int i;
+
+        for (i = 0; i < log_level_argc; i++) {
+                dev_notice(&priv->func->dev, "log_level[%d]=0x%X\n",
+                                                i, log_level[i]);
+                iwmct_log_set_filter((log_level[i] >> 8) & 0xFF,
+                               log_level[i] & 0xFF);
+        }
+        for (i = 0; i < log_level_fw_argc; i++) {
+                dev_notice(&priv->func->dev, "log_level_fw[%d]=0x%X\n",
+                                                i, log_level_fw[i]);
+                iwmct_log_set_fw_filter((log_level_fw[i] >> 8) & 0xFF,
+                                  log_level_fw[i] & 0xFF);
+        }
+#endif
+
+        priv->dbg.blocks = blocks;
+        LOG_INFO(priv, INIT, "blocks=%d\n", blocks);
+        priv->dbg.dump = (bool)dump;
+        LOG_INFO(priv, INIT, "dump=%d\n", dump);
+        priv->dbg.jump = (bool)jump;
+        LOG_INFO(priv, INIT, "jump=%d\n", jump);
+        priv->dbg.direct = (bool)direct;
+        LOG_INFO(priv, INIT, "direct=%d\n", direct);
+        priv->dbg.checksum = (bool)checksum;
+        LOG_INFO(priv, INIT, "checksum=%d\n", checksum);
+        priv->dbg.fw_download = (bool)fw_download;
+        LOG_INFO(priv, INIT, "fw_download=%d\n", fw_download);
+        priv->dbg.block_size = block_size;
+        LOG_INFO(priv, INIT, "block_size=%d\n", block_size);
+        priv->dbg.download_trans_blks = download_trans_blks;
+        LOG_INFO(priv, INIT, "download_trans_blks=%d\n", download_trans_blks);
+}
+
+/*****************************************************************************
+ *
+ * sysfs attributes
+ *
+ *****************************************************************************/
+static ssize_t show_iwmct_fw_version(struct device *d,
+                                  struct device_attribute *attr, char *buf)
+{
+        struct iwmct_priv *priv = dev_get_drvdata(d);
+        return sprintf(buf, "%s\n", priv->dbg.label_fw);
+}
+static DEVICE_ATTR(cc_label_fw, S_IRUGO, show_iwmct_fw_version, NULL);
+
+#ifdef CONFIG_IWMC3200TOP_DEBUG
+static DEVICE_ATTR(log_level, S_IWUSR | S_IRUGO,
+                   show_iwmct_log_level, store_iwmct_log_level);
+static DEVICE_ATTR(log_level_fw, S_IWUSR | S_IRUGO,
+                   show_iwmct_log_level_fw, store_iwmct_log_level_fw);
+#endif
+
+static struct attribute *iwmct_sysfs_entries[] = {
+        &dev_attr_cc_label_fw.attr,
+#ifdef CONFIG_IWMC3200TOP_DEBUG
+        &dev_attr_log_level.attr,
+        &dev_attr_log_level_fw.attr,
+#endif
+        NULL
+};
+
+static struct attribute_group iwmct_attribute_group = {
+        .name = NULL,           /* put in device directory */
+        .attrs = iwmct_sysfs_entries,
+};
+
+
+static int iwmct_probe(struct sdio_func *func,
+                           const struct sdio_device_id *id)
+{
+        struct iwmct_priv *priv;
+        int ret;
+        int val = 1;
+        int addr = IWMC_SDIO_INTR_ENABLE_ADDR;
+
+        dev_dbg(&func->dev, "enter iwmct_probe\n");
+
+        dev_dbg(&func->dev, "IRQ polling period id %u msecs, HZ is %d\n",
+                jiffies_to_msecs(2147483647), HZ);
+
+        priv = kzalloc(sizeof(struct iwmct_priv), GFP_KERNEL);
+        if (!priv) {
+                dev_err(&func->dev, "kzalloc error\n");
+                return -ENOMEM;
+        }
+        priv->func = func;
+        sdio_set_drvdata(func, priv);
+
+
+        /* create drivers work queue */
+        priv->wq = create_workqueue(DRV_NAME "_wq");
+        priv->bus_rescan_wq = create_workqueue(DRV_NAME "_rescan_wq");
+        INIT_WORK(&priv->bus_rescan_worker, iwmct_rescan_worker);
+        INIT_WORK(&priv->isr_worker, iwmct_irq_read_worker);
+
+        init_waitqueue_head(&priv->wait_q);
+
+        sdio_claim_host(func);
+        /* FIXME: Remove after it is fixed in the Boot ROM upgrade */
+        func->enable_timeout = 10;
+
+        /* In our HW, setting the block size also wakes up the boot rom. */
+        ret = sdio_set_block_size(func, priv->dbg.block_size);
+        if (ret) {
+                LOG_ERROR(priv, INIT,
+                        "sdio_set_block_size() failure: %d\n", ret);
+                goto error_sdio_enable;
+        }
+
+        ret = sdio_enable_func(func);
+        if (ret) {
+                LOG_ERROR(priv, INIT, "sdio_enable_func() failure: %d\n", ret);
+                goto error_sdio_enable;
+        }
+
+        /* init reset and dev_sync states */
+        atomic_set(&priv->reset, 0);
+        atomic_set(&priv->dev_sync, 0);
+
+        /* init read req queue */
+        INIT_LIST_HEAD(&priv->read_req_list);
+
+        /* process configurable parameters */
+        iwmct_dbg_init_params(priv);
+        ret = sysfs_create_group(&func->dev.kobj, &iwmct_attribute_group);
+        if (ret) {
+                LOG_ERROR(priv, INIT, "Failed to register attributes and "
+                         "initialize module_params\n");
+                goto error_dev_attrs;
+        }
+
+        iwmct_dbgfs_register(priv, DRV_NAME);
+
+        if (!priv->dbg.direct && priv->dbg.download_trans_blks > 8) {
+                LOG_INFO(priv, INIT,
+                         "Reducing transaction to 8 blocks = 2K (from %d)\n",
+                         priv->dbg.download_trans_blks);
+                priv->dbg.download_trans_blks = 8;
+        }
+        priv->trans_len = priv->dbg.download_trans_blks * priv->dbg.block_size;
+        LOG_INFO(priv, INIT, "Transaction length = %d\n", priv->trans_len);
+
+        ret = sdio_claim_irq(func, iwmct_irq);
+        if (ret) {
+                LOG_ERROR(priv, INIT, "sdio_claim_irq() failure: %d\n", ret);
+                goto error_claim_irq;
+        }
+
+
+        /* Enable function's interrupt */
+        sdio_writeb(priv->func, val, addr, &ret);
+        if (ret) {
+                LOG_ERROR(priv, INIT, "Failure writing to "
+                          "Interrupt Enable Register (%d): %d\n", addr, ret);
+                goto error_enable_int;
+        }
+
+        sdio_release_host(func);
+
+        LOG_INFO(priv, INIT, "exit iwmct_probe\n");
+
+        return ret;
+
+error_enable_int:
+        sdio_release_irq(func);
+error_claim_irq:
+        sdio_disable_func(func);
+error_dev_attrs:
+        iwmct_dbgfs_unregister(priv->dbgfs);
+        sysfs_remove_group(&func->dev.kobj, &iwmct_attribute_group);
+error_sdio_enable:
+        sdio_release_host(func);
+        return ret;
+}
+
+static void iwmct_remove(struct sdio_func *func)
+{
+        struct iwmct_work_struct *read_req;
+        struct iwmct_priv *priv = sdio_get_drvdata(func);
+
+        LOG_INFO(priv, INIT, "enter\n");
+
+        sdio_claim_host(func);
+        sdio_release_irq(func);
+        sdio_release_host(func);
+
+        /* Safely destroy osc workqueue */
+        destroy_workqueue(priv->bus_rescan_wq);
+        destroy_workqueue(priv->wq);
+
+        sdio_claim_host(func);
+        sdio_disable_func(func);
+        sysfs_remove_group(&func->dev.kobj, &iwmct_attribute_group);
+        iwmct_dbgfs_unregister(priv->dbgfs);
+        sdio_release_host(func);
+
+        /* free read requests */
+        while (!list_empty(&priv->read_req_list)) {
+                read_req = list_entry(priv->read_req_list.next,
+                        struct iwmct_work_struct, list);
+
+                list_del(&read_req->list);
+                kfree(read_req);
+        }
+
+        kfree(priv);
+}
+
+
+static const struct sdio_device_id iwmct_ids[] = {
+        /* Intel Wireless MultiCom 3200 Top Driver */
+        { SDIO_DEVICE(SDIO_VENDOR_ID_INTEL, 0x1404)},
+        { },    /* Terminating entry */
+};
+
+MODULE_DEVICE_TABLE(sdio, iwmct_ids);
+
+static struct sdio_driver iwmct_driver = {
+        .probe          = iwmct_probe,
+        .remove         = iwmct_remove,
+        .name           = DRV_NAME,
+        .id_table       = iwmct_ids,
+};
+
+static int __init iwmct_init(void)
+{
+        int rc;
+
+        /* Default log filter settings */
+        iwmct_log_set_filter(LOG_SRC_ALL, LOG_SEV_FILTER_RUNTIME);
+        iwmct_log_set_filter(LOG_SRC_FW_MSG, LOG_SEV_FW_FILTER_ALL);
+        iwmct_log_set_fw_filter(LOG_SRC_ALL, FW_LOG_SEV_FILTER_RUNTIME);
+
+        rc = sdio_register_driver(&iwmct_driver);
+
+        return rc;
+}
+
+static void __exit iwmct_exit(void)
+{
+        sdio_unregister_driver(&iwmct_driver);
+}
+
+module_init(iwmct_init);
+module_exit(iwmct_exit);
+
diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
index e4ff50b95a5e..72450237a0f4 100644
--- a/drivers/misc/kgdbts.c
+++ b/drivers/misc/kgdbts.c
@@ -295,6 +295,10 @@ static int check_and_rewind_pc(char *put_str, char *arg)
         /* On x86 a breakpoint stop requires it to be decremented */
         if (addr + 1 == kgdbts_regs.ip)
                 offset = -1;
+#elif defined(CONFIG_SUPERH)
+        /* On SUPERH a breakpoint stop requires it to be decremented */
+        if (addr + 2 == kgdbts_regs.pc)
+                offset = -2;
 #endif
         if (strcmp(arg, "silent") &&
                 instruction_pointer(&kgdbts_regs) + offset != addr) {
@@ -305,6 +309,8 @@ static int check_and_rewind_pc(char *put_str, char *arg)
 #ifdef CONFIG_X86
         /* On x86 adjust the instruction pointer if needed */
         kgdbts_regs.ip += offset;
+#elif defined(CONFIG_SUPERH)
+        kgdbts_regs.pc += offset;
 #endif
         return 0;
 }
@@ -712,6 +718,12 @@ static int run_simple_test(int is_get_char, int chr)
 
         /* End of packet == #XX so look for the '#' */
         if (put_buf_cnt > 3 && put_buf[put_buf_cnt - 3] == '#') {
+                if (put_buf_cnt >= BUFMAX) {
+                        eprintk("kgdbts: ERROR: put buffer overflow on"
+                                " '%s' line %i\n", ts.name, ts.idx);
+                        put_buf_cnt = 0;
+                        return 0;
+                }
                 put_buf[put_buf_cnt] = '\0';
                 v2printk("put%i: %s\n", ts.idx, put_buf);
                 /* Trigger check here */
@@ -885,16 +897,16 @@ static void kgdbts_run_tests(void)
         int nmi_sleep = 0;
         int i;
 
-        ptr = strstr(config, "F");
+        ptr = strchr(config, 'F');
         if (ptr)
                 fork_test = simple_strtol(ptr + 1, NULL, 10);
-        ptr = strstr(config, "S");
+        ptr = strchr(config, 'S');
         if (ptr)
                 do_sys_open_test = simple_strtol(ptr + 1, NULL, 10);
-        ptr = strstr(config, "N");
+        ptr = strchr(config, 'N');
         if (ptr)
                 nmi_sleep = simple_strtol(ptr+1, NULL, 10);
-        ptr = strstr(config, "I");
+        ptr = strchr(config, 'I');
         if (ptr)
                 sstep_test = simple_strtol(ptr+1, NULL, 10);
 
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index 3648b23d5c92..31a991161f0a 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -26,21 +26,9 @@
  * It is adapted from the Linux Kernel Dump Test Tool by
  * Fernando Luis Vazquez Cao <http://lkdtt.sourceforge.net>
  *
- * Usage :  insmod lkdtm.ko [recur_count={>0}] cpoint_name=<> cpoint_type=<>
- *                                                      [cpoint_count={>0}]
+ * Debugfs support added by Simon Kagstrom <simon.kagstrom@netinsight.net>
  *
- * recur_count : Recursion level for the stack overflow test. Default is 10.
- *
- * cpoint_name : Crash point where the kernel is to be crashed. It can be
- *               one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
- *               FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_DISPATCH_CMD,
- *               IDE_CORE_CP
- *
- * cpoint_type : Indicates the action to be taken on hitting the crash point.
- *               It can be one of PANIC, BUG, EXCEPTION, LOOP, OVERFLOW
- *
- * cpoint_count : Indicates the number of times the crash point is to be hit
- *                to trigger an action. The default is 10.
+ * See Documentation/fault-injection/provoke-crashes.txt for instructions
  */
 
 #include <linux/kernel.h>
@@ -52,14 +40,14 @@
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/hrtimer.h>
+#include <linux/slab.h>
 #include <scsi/scsi_cmnd.h>
+#include <linux/debugfs.h>
 
 #ifdef CONFIG_IDE
 #include <linux/ide.h>
 #endif
 
-#define NUM_CPOINTS 8
-#define NUM_CPOINT_TYPES 5
 #define DEFAULT_COUNT 10
 #define REC_NUM_DEFAULT 10
 
@@ -72,7 +60,8 @@ enum cname {
         MEM_SWAPOUT,
         TIMERADD,
         SCSI_DISPATCH_CMD,
-        IDE_CORE_CP
+        IDE_CORE_CP,
+        DIRECT,
 };
 
 enum ctype {
@@ -81,7 +70,11 @@ enum ctype {
         BUG,
         EXCEPTION,
         LOOP,
-        OVERFLOW
+        OVERFLOW,
+        CORRUPT_STACK,
+        UNALIGNED_LOAD_STORE_WRITE,
+        OVERWRITE_ALLOCATION,
+        WRITE_AFTER_FREE,
 };
 
 static char* cp_name[] = {
@@ -92,7 +85,8 @@ static char* cp_name[] = {
         "MEM_SWAPOUT",
         "TIMERADD",
         "SCSI_DISPATCH_CMD",
-        "IDE_CORE_CP"
+        "IDE_CORE_CP",
+        "DIRECT",
 };
 
 static char* cp_type[] = {
@@ -100,7 +94,11 @@ static char* cp_type[] = {
         "BUG",
         "EXCEPTION",
         "LOOP",
-        "OVERFLOW"
+        "OVERFLOW",
+        "CORRUPT_STACK",
+        "UNALIGNED_LOAD_STORE_WRITE",
+        "OVERWRITE_ALLOCATION",
+        "WRITE_AFTER_FREE",
 };
 
 static struct jprobe lkdtm;
@@ -193,34 +191,66 @@ int jp_generic_ide_ioctl(ide_drive_t *drive, struct file *file,
 }
 #endif
 
+/* Return the crashpoint number or NONE if the name is invalid */
+static enum ctype parse_cp_type(const char *what, size_t count)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(cp_type); i++) {
+                if (!strcmp(what, cp_type[i]))
+                        return i + 1;
+        }
+
+        return NONE;
+}
+
+static const char *cp_type_to_str(enum ctype type)
+{
+        if (type == NONE || type < 0 || type > ARRAY_SIZE(cp_type))
+                return "None";
+
+        return cp_type[type - 1];
+}
+
+static const char *cp_name_to_str(enum cname name)
+{
+        if (name == INVALID || name < 0 || name > ARRAY_SIZE(cp_name))
+                return "INVALID";
+
+        return cp_name[name - 1];
+}
+
+
 static int lkdtm_parse_commandline(void)
 {
         int i;
 
-        if (cpoint_name == NULL || cpoint_type == NULL ||
-                                        cpoint_count < 1 || recur_count < 1)
+        if (cpoint_count < 1 || recur_count < 1)
                 return -EINVAL;
 
-        for (i = 0; i < NUM_CPOINTS; ++i) {
+        count = cpoint_count;
+
+        /* No special parameters */
+        if (!cpoint_type && !cpoint_name)
+                return 0;
+
+        /* Neither or both of these need to be set */
+        if (!cpoint_type || !cpoint_name)
+                return -EINVAL;
+
+        cptype = parse_cp_type(cpoint_type, strlen(cpoint_type));
+        if (cptype == NONE)
+                return -EINVAL;
+
+        for (i = 0; i < ARRAY_SIZE(cp_name); i++) {
                 if (!strcmp(cpoint_name, cp_name[i])) {
                         cpoint = i + 1;
-                        break;
-                }
-        }
-
-        for (i = 0; i < NUM_CPOINT_TYPES; ++i) {
-                if (!strcmp(cpoint_type, cp_type[i])) {
-                        cptype = i + 1;
-                        break;
+                        return 0;
                 }
         }
 
-        if (cpoint == INVALID || cptype == NONE)
-                return -EINVAL;
-
-        count = cpoint_count;
-
-        return 0;
+        /* Could not find a valid crash point */
+        return -EINVAL;
 }
 
 static int recursive_loop(int a)
@@ -235,53 +265,92 @@ static int recursive_loop(int a)
                 return recursive_loop(a);
 }
 
-void lkdtm_handler(void)
+static void lkdtm_do_action(enum ctype which)
 {
-        printk(KERN_INFO "lkdtm : Crash point %s of type %s hit\n",
-                                         cpoint_name, cpoint_type);
-        --count;
+        switch (which) {
+        case PANIC:
+                panic("dumptest");
+                break;
+        case BUG:
+                BUG();
+                break;
+        case EXCEPTION:
+                *((int *) 0) = 0;
+                break;
+        case LOOP:
+                for (;;)
+                        ;
+                break;
+        case OVERFLOW:
+                (void) recursive_loop(0);
+                break;
+        case CORRUPT_STACK: {
+                volatile u32 data[8];
+                volatile u32 *p = data;
+
+                p[12] = 0x12345678;
+                break;
+        }
+        case UNALIGNED_LOAD_STORE_WRITE: {
+                static u8 data[5] __attribute__((aligned(4))) = {1, 2,
+                                3, 4, 5};
+                u32 *p;
+                u32 val = 0x12345678;
+
+                p = (u32 *)(data + 1);
+                if (*p == 0)
+                        val = 0x87654321;
+                *p = val;
+                 break;
+        }
+        case OVERWRITE_ALLOCATION: {
+                size_t len = 1020;
+                u32 *data = kmalloc(len, GFP_KERNEL);
+
+                data[1024 / sizeof(u32)] = 0x12345678;
+                kfree(data);
+                break;
+        }
+        case WRITE_AFTER_FREE: {
+                size_t len = 1024;
+                u32 *data = kmalloc(len, GFP_KERNEL);
+
+                kfree(data);
+                schedule();
+                memset(data, 0x78, len);
+                break;
+        }
+        case NONE:
+        default:
+                break;
+        }
+
+}
+
+static void lkdtm_handler(void)
+{
+        count--;
+        printk(KERN_INFO "lkdtm: Crash point %s of type %s hit, trigger in %d rounds\n",
+                        cp_name_to_str(cpoint), cp_type_to_str(cptype), count);
 
         if (count == 0) {
-                switch (cptype) {
-                case NONE:
-                        break;
-                case PANIC:
-                        printk(KERN_INFO "lkdtm : PANIC\n");
-                        panic("dumptest");
-                        break;
-                case BUG:
-                        printk(KERN_INFO "lkdtm : BUG\n");
-                        BUG();
-                        break;
-                case EXCEPTION:
-                        printk(KERN_INFO "lkdtm : EXCEPTION\n");
-                        *((int *) 0) = 0;
-                        break;
-                case LOOP:
-                        printk(KERN_INFO "lkdtm : LOOP\n");
-                        for (;;);
-                        break;
-                case OVERFLOW:
-                        printk(KERN_INFO "lkdtm : OVERFLOW\n");
-                        (void) recursive_loop(0);
-                        break;
-                default:
-                        break;
-                }
+                lkdtm_do_action(cptype);
                 count = cpoint_count;
         }
 }
 
-static int __init lkdtm_module_init(void)
+static int lkdtm_register_cpoint(enum cname which)
 {
         int ret;
 
-        if (lkdtm_parse_commandline() == -EINVAL) {
-                printk(KERN_INFO "lkdtm : Invalid command\n");
-                return -EINVAL;
-        }
+        cpoint = INVALID;
+        if (lkdtm.entry != NULL)
+                unregister_jprobe(&lkdtm);
 
-        switch (cpoint) {
+        switch (which) {
+        case DIRECT:
+                lkdtm_do_action(cptype);
+                return 0;
         case INT_HARDWARE_ENTRY:
                 lkdtm.kp.symbol_name = "do_IRQ";
                 lkdtm.entry = (kprobe_opcode_t*) jp_do_irq;
@@ -315,28 +384,268 @@ static int __init lkdtm_module_init(void)
                 lkdtm.kp.symbol_name = "generic_ide_ioctl";
                 lkdtm.entry = (kprobe_opcode_t*) jp_generic_ide_ioctl;
 #else
-                printk(KERN_INFO "lkdtm : Crash point not available\n");
+                printk(KERN_INFO "lkdtm: Crash point not available\n");
+                return -EINVAL;
 #endif
                 break;
         default:
-                printk(KERN_INFO "lkdtm : Invalid Crash Point\n");
-                break;
+                printk(KERN_INFO "lkdtm: Invalid Crash Point\n");
+                return -EINVAL;
         }
 
+        cpoint = which;
         if ((ret = register_jprobe(&lkdtm)) < 0) {
-                printk(KERN_INFO "lkdtm : Couldn't register jprobe\n");
-                return ret;
+                printk(KERN_INFO "lkdtm: Couldn't register jprobe\n");
+                cpoint = INVALID;
+        }
+
+        return ret;
+}
+
+static ssize_t do_register_entry(enum cname which, struct file *f,
+                const char __user *user_buf, size_t count, loff_t *off)
+{
+        char *buf;
+        int err;
+
+        if (count >= PAGE_SIZE)
+                return -EINVAL;
+
+        buf = (char *)__get_free_page(GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        if (copy_from_user(buf, user_buf, count)) {
+                free_page((unsigned long) buf);
+                return -EFAULT;
+        }
+        /* NULL-terminate and remove enter */
+        buf[count] = '\0';
+        strim(buf);
+
+        cptype = parse_cp_type(buf, count);
+        free_page((unsigned long) buf);
+
+        if (cptype == NONE)
+                return -EINVAL;
+
+        err = lkdtm_register_cpoint(which);
+        if (err < 0)
+                return err;
+
+        *off += count;
+
+        return count;
+}
+
+/* Generic read callback that just prints out the available crash types */
+static ssize_t lkdtm_debugfs_read(struct file *f, char __user *user_buf,
+                size_t count, loff_t *off)
+{
+        char *buf;
+        int i, n, out;
+
+        buf = (char *)__get_free_page(GFP_KERNEL);
+
+        n = snprintf(buf, PAGE_SIZE, "Available crash types:\n");
+        for (i = 0; i < ARRAY_SIZE(cp_type); i++)
+                n += snprintf(buf + n, PAGE_SIZE - n, "%s\n", cp_type[i]);
+        buf[n] = '\0';
+
+        out = simple_read_from_buffer(user_buf, count, off,
+                                      buf, n);
+        free_page((unsigned long) buf);
+
+        return out;
+}
+
+static int lkdtm_debugfs_open(struct inode *inode, struct file *file)
+{
+        return 0;
+}
+
+
+static ssize_t int_hardware_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(INT_HARDWARE_ENTRY, f, buf, count, off);
+}
+
+static ssize_t int_hw_irq_en(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(INT_HW_IRQ_EN, f, buf, count, off);
+}
+
+static ssize_t int_tasklet_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(INT_TASKLET_ENTRY, f, buf, count, off);
+}
+
+static ssize_t fs_devrw_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(FS_DEVRW, f, buf, count, off);
+}
+
+static ssize_t mem_swapout_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(MEM_SWAPOUT, f, buf, count, off);
+}
+
+static ssize_t timeradd_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(TIMERADD, f, buf, count, off);
+}
+
+static ssize_t scsi_dispatch_cmd_entry(struct file *f,
+                const char __user *buf, size_t count, loff_t *off)
+{
+        return do_register_entry(SCSI_DISPATCH_CMD, f, buf, count, off);
+}
+
+static ssize_t ide_core_cp_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(IDE_CORE_CP, f, buf, count, off);
+}
+
+/* Special entry to just crash directly. Available without KPROBEs */
+static ssize_t direct_entry(struct file *f, const char __user *user_buf,
+                size_t count, loff_t *off)
+{
+        enum ctype type;
+        char *buf;
+
+        if (count >= PAGE_SIZE)
+                return -EINVAL;
+        if (count < 1)
+                return -EINVAL;
+
+        buf = (char *)__get_free_page(GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        if (copy_from_user(buf, user_buf, count)) {
+                free_page((unsigned long) buf);
+                return -EFAULT;
+        }
+        /* NULL-terminate and remove enter */
+        buf[count] = '\0';
+        strim(buf);
+
+        type = parse_cp_type(buf, count);
+        free_page((unsigned long) buf);
+        if (type == NONE)
+                return -EINVAL;
+
+        printk(KERN_INFO "lkdtm: Performing direct entry %s\n",
+                        cp_type_to_str(type));
+        lkdtm_do_action(type);
+        *off += count;
+
+        return count;
+}
+
+struct crash_entry {
+        const char *name;
+        const struct file_operations fops;
+};
+
+static const struct crash_entry crash_entries[] = {
+        {"DIRECT", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = direct_entry} },
+        {"INT_HARDWARE_ENTRY", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = int_hardware_entry} },
+        {"INT_HW_IRQ_EN", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = int_hw_irq_en} },
+        {"INT_TASKLET_ENTRY", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = int_tasklet_entry} },
+        {"FS_DEVRW", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = fs_devrw_entry} },
+        {"MEM_SWAPOUT", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = mem_swapout_entry} },
+        {"TIMERADD", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = timeradd_entry} },
+        {"SCSI_DISPATCH_CMD", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = scsi_dispatch_cmd_entry} },
+        {"IDE_CORE_CP", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = ide_core_cp_entry} },
+};
+
+static struct dentry *lkdtm_debugfs_root;
+
+static int __init lkdtm_module_init(void)
+{
+        int ret = -EINVAL;
+        int n_debugfs_entries = 1; /* Assume only the direct entry */
+        int i;
+
+        /* Register debugfs interface */
+        lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL);
+        if (!lkdtm_debugfs_root) {
+                printk(KERN_ERR "lkdtm: creating root dir failed\n");
+                return -ENODEV;
+        }
+
+#ifdef CONFIG_KPROBES
+        n_debugfs_entries = ARRAY_SIZE(crash_entries);
+#endif
+
+        for (i = 0; i < n_debugfs_entries; i++) {
+                const struct crash_entry *cur = &crash_entries[i];
+                struct dentry *de;
+
+                de = debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root,
+                                NULL, &cur->fops);
+                if (de == NULL) {
+                        printk(KERN_ERR "lkdtm: could not create %s\n",
+                                        cur->name);
+                        goto out_err;
+                }
+        }
+
+        if (lkdtm_parse_commandline() == -EINVAL) {
+                printk(KERN_INFO "lkdtm: Invalid command\n");
+                goto out_err;
+        }
+
+        if (cpoint != INVALID && cptype != NONE) {
+                ret = lkdtm_register_cpoint(cpoint);
+                if (ret < 0) {
+                        printk(KERN_INFO "lkdtm: Invalid crash point %d\n",
+                                        cpoint);
+                        goto out_err;
+                }
+                printk(KERN_INFO "lkdtm: Crash point %s of type %s registered\n",
+                                cpoint_name, cpoint_type);
+        } else {
+                printk(KERN_INFO "lkdtm: No crash points registered, enable through debugfs\n");
         }
 
-        printk(KERN_INFO "lkdtm : Crash point %s of type %s registered\n",
-                                                cpoint_name, cpoint_type);
         return 0;
+
+out_err:
+        debugfs_remove_recursive(lkdtm_debugfs_root);
+        return ret;
 }
 
 static void __exit lkdtm_module_exit(void)
 {
-        unregister_jprobe(&lkdtm);
-        printk(KERN_INFO "lkdtm : Crash point unregistered\n");
+        debugfs_remove_recursive(lkdtm_debugfs_root);
+
+        unregister_jprobe(&lkdtm);
+        printk(KERN_INFO "lkdtm: Crash point unregistered\n");
 }
 
 module_init(lkdtm_module_init);
diff --git a/drivers/misc/phantom.c b/drivers/misc/phantom.c
index 04c27266f567..75ee0d3f6f45 100644
--- a/drivers/misc/phantom.c
+++ b/drivers/misc/phantom.c
@@ -21,6 +21,7 @@
 #include <linux/poll.h>
 #include <linux/interrupt.h>
 #include <linux/cdev.h>
+#include <linux/slab.h>
 #include <linux/phantom.h>
 #include <linux/sched.h>
 #include <linux/smp_lock.h>
@@ -497,12 +498,7 @@ static struct pci_driver phantom_pci_driver = {
         .resume = phantom_resume
 };
 
-static ssize_t phantom_show_version(struct class *cls, char *buf)
-{
-        return sprintf(buf, PHANTOM_VERSION "\n");
-}
-
-static CLASS_ATTR(version, 0444, phantom_show_version, NULL);
+static CLASS_ATTR_STRING(version, 0444, PHANTOM_VERSION);
 
 static int __init phantom_init(void)
 {
@@ -515,7 +511,7 @@ static int __init phantom_init(void)
                 printk(KERN_ERR "phantom: can't register phantom class\n");
                 goto err;
         }
-        retval = class_create_file(phantom_class, &class_attr_version);
+        retval = class_create_file(phantom_class, &class_attr_version.attr);
         if (retval) {
                 printk(KERN_ERR "phantom: can't create sysfs version file\n");
                 goto err_class;
@@ -541,7 +537,7 @@ static int __init phantom_init(void)
 err_unchr:
         unregister_chrdev_region(dev, PHANTOM_MAX_MINORS);
 err_attr:
-        class_remove_file(phantom_class, &class_attr_version);
+        class_remove_file(phantom_class, &class_attr_version.attr);
 err_class:
         class_destroy(phantom_class);
 err:
@@ -554,7 +550,7 @@ static void __exit phantom_exit(void)
 
         unregister_chrdev_region(MKDEV(phantom_major, 0), PHANTOM_MAX_MINORS);
 
-        class_remove_file(phantom_class, &class_attr_version);
+        class_remove_file(phantom_class, &class_attr_version.attr);
         class_destroy(phantom_class);
 
         pr_debug("phantom: module successfully removed\n");
diff --git a/drivers/misc/sgi-gru/gru.h b/drivers/misc/sgi-gru/gru.h
index f93f03a9e6e9..3ad76cd18b4b 100644
--- a/drivers/misc/sgi-gru/gru.h
+++ b/drivers/misc/sgi-gru/gru.h
@@ -53,6 +53,17 @@ struct gru_chiplet_info {
         int     free_user_cbr;
 };
 
+/*
+ * Statictics kept for each context.
+ */
+struct gru_gseg_statistics {
+        unsigned long   fmm_tlbmiss;
+        unsigned long   upm_tlbmiss;
+        unsigned long   tlbdropin;
+        unsigned long   context_stolen;
+        unsigned long   reserved[10];
+};
+
 /* Flags for GRU options on the gru_create_context() call */
 /* Select one of the follow 4 options to specify how TLB misses are handled */
 #define GRU_OPT_MISS_DEFAULT    0x0000  /* Use default mode */
diff --git a/drivers/misc/sgi-gru/gru_instructions.h b/drivers/misc/sgi-gru/gru_instructions.h
index 3c9c06618e6a..d95587cc794c 100644
--- a/drivers/misc/sgi-gru/gru_instructions.h
+++ b/drivers/misc/sgi-gru/gru_instructions.h
@@ -34,17 +34,17 @@ extern void gru_wait_abort_proc(void *cb);
 #include <asm/intrinsics.h>
 #define __flush_cache(p)                ia64_fc((unsigned long)p)
 /* Use volatile on IA64 to ensure ordering via st4.rel */
-#define gru_ordered_store_int(p, v)                                     \
+#define gru_ordered_store_ulong(p, v)                                   \
                 do {                                                    \
                         barrier();                                      \
-                        *((volatile int *)(p)) = v; /* force st.rel */  \
+                        *((volatile unsigned long *)(p)) = v; /* force st.rel */        \
                 } while (0)
 #elif defined(CONFIG_X86_64)
 #define __flush_cache(p)                clflush(p)
-#define gru_ordered_store_int(p, v)                                     \
+#define gru_ordered_store_ulong(p, v)                                   \
                 do {                                                    \
                         barrier();                                      \
-                        *(int *)p = v;                                  \
+                        *(unsigned long *)p = v;                        \
                 } while (0)
 #else
 #error "Unsupported architecture"
@@ -129,8 +129,13 @@ struct gru_instruction_bits {
  */
 struct gru_instruction {
     /* DW 0 */
-    unsigned int                op32;    /* icmd,xtype,iaa0,ima,opc */
-    unsigned int                tri0;
+    union {
+        unsigned long           op64;    /* icmd,xtype,iaa0,ima,opc,tri0 */
+        struct {
+                unsigned int    op32;
+                unsigned int    tri0;
+        };
+    };
     unsigned long               tri1_bufsize;           /* DW 1 */
     unsigned long               baddr0;                 /* DW 2 */
     unsigned long               nelem;                  /* DW 3 */
@@ -140,7 +145,7 @@ struct gru_instruction {
     unsigned long               avalue;                 /* DW 7 */
 };
 
-/* Some shifts and masks for the low 32 bits of a GRU command */
+/* Some shifts and masks for the low 64 bits of a GRU command */
 #define GRU_CB_ICMD_SHFT        0
 #define GRU_CB_ICMD_MASK        0x1
 #define GRU_CB_XTYPE_SHFT       8
@@ -155,6 +160,10 @@ struct gru_instruction {
 #define GRU_CB_OPC_MASK         0xff
 #define GRU_CB_EXOPC_SHFT       24
 #define GRU_CB_EXOPC_MASK       0xff
+#define GRU_IDEF2_SHFT          32
+#define GRU_IDEF2_MASK          0x3ffff
+#define GRU_ISTATUS_SHFT        56
+#define GRU_ISTATUS_MASK        0x3
 
 /* GRU instruction opcodes (opc field) */
 #define OP_NOP          0x00
@@ -256,6 +265,7 @@ struct gru_instruction {
 #define CBE_CAUSE_PROTOCOL_STATE_DATA_ERROR     (1 << 16)
 #define CBE_CAUSE_RA_RESPONSE_DATA_ERROR        (1 << 17)
 #define CBE_CAUSE_HA_RESPONSE_DATA_ERROR        (1 << 18)
+#define CBE_CAUSE_FORCED_ERROR                  (1 << 19)
 
 /* CBE cbrexecstatus bits */
 #define CBR_EXS_ABORT_OCC_BIT                   0
@@ -264,13 +274,15 @@ struct gru_instruction {
 #define CBR_EXS_QUEUED_BIT                      3
 #define CBR_EXS_TLB_INVAL_BIT                   4
 #define CBR_EXS_EXCEPTION_BIT                   5
+#define CBR_EXS_CB_INT_PENDING_BIT              6
 
 #define CBR_EXS_ABORT_OCC                       (1 << CBR_EXS_ABORT_OCC_BIT)
 #define CBR_EXS_INT_OCC                         (1 << CBR_EXS_INT_OCC_BIT)
 #define CBR_EXS_PENDING                         (1 << CBR_EXS_PENDING_BIT)
 #define CBR_EXS_QUEUED                          (1 << CBR_EXS_QUEUED_BIT)
-#define CBR_TLB_INVAL                           (1 << CBR_EXS_TLB_INVAL_BIT)
+#define CBR_EXS_TLB_INVAL                       (1 << CBR_EXS_TLB_INVAL_BIT)
 #define CBR_EXS_EXCEPTION                       (1 << CBR_EXS_EXCEPTION_BIT)
+#define CBR_EXS_CB_INT_PENDING                  (1 << CBR_EXS_CB_INT_PENDING_BIT)
 
 /*
  * Exceptions are retried for the following cases. If any OTHER bits are set
@@ -296,12 +308,14 @@ union gru_mesqhead {
 
 
 /* Generate the low word of a GRU instruction */
-static inline unsigned int
-__opword(unsigned char opcode, unsigned char exopc, unsigned char xtype,
+static inline unsigned long
+__opdword(unsigned char opcode, unsigned char exopc, unsigned char xtype,
        unsigned char iaa0, unsigned char iaa1,
-       unsigned char ima)
+       unsigned long idef2, unsigned char ima)
 {
     return (1 << GRU_CB_ICMD_SHFT) |
+           ((unsigned long)CBS_ACTIVE << GRU_ISTATUS_SHFT) |
+           (idef2<< GRU_IDEF2_SHFT) |
            (iaa0 << GRU_CB_IAA0_SHFT) |
            (iaa1 << GRU_CB_IAA1_SHFT) |
            (ima << GRU_CB_IMA_SHFT) |
@@ -319,12 +333,13 @@ static inline void gru_flush_cache(void *p)
 }
 
 /*
- * Store the lower 32 bits of the command including the "start" bit. Then
+ * Store the lower 64 bits of the command including the "start" bit. Then
  * start the instruction executing.
  */
-static inline void gru_start_instruction(struct gru_instruction *ins, int op32)
+static inline void gru_start_instruction(struct gru_instruction *ins, unsigned long op64)
 {
-        gru_ordered_store_int(ins, op32);
+        gru_ordered_store_ulong(ins, op64);
+        mb();
         gru_flush_cache(ins);
 }
 
@@ -340,6 +355,30 @@ static inline void gru_start_instruction(struct gru_instruction *ins, int op32)
  *      - nelem and stride are in elements
  *      - tri0/tri1 is in bytes for the beginning of the data segment.
  */
+static inline void gru_vload_phys(void *cb, unsigned long gpa,
+                unsigned int tri0, int iaa, unsigned long hints)
+{
+        struct gru_instruction *ins = (struct gru_instruction *)cb;
+
+        ins->baddr0 = (long)gpa | ((unsigned long)iaa << 62);
+        ins->nelem = 1;
+        ins->op1_stride = 1;
+        gru_start_instruction(ins, __opdword(OP_VLOAD, 0, XTYPE_DW, iaa, 0,
+                                        (unsigned long)tri0, CB_IMA(hints)));
+}
+
+static inline void gru_vstore_phys(void *cb, unsigned long gpa,
+                unsigned int tri0, int iaa, unsigned long hints)
+{
+        struct gru_instruction *ins = (struct gru_instruction *)cb;
+
+        ins->baddr0 = (long)gpa | ((unsigned long)iaa << 62);
+        ins->nelem = 1;
+        ins->op1_stride = 1;
+        gru_start_instruction(ins, __opdword(OP_VSTORE, 0, XTYPE_DW, iaa, 0,
+                                        (unsigned long)tri0, CB_IMA(hints)));
+}
+
 static inline void gru_vload(void *cb, unsigned long mem_addr,
                 unsigned int tri0, unsigned char xtype, unsigned long nelem,
                 unsigned long stride, unsigned long hints)
@@ -348,10 +387,9 @@ static inline void gru_vload(void *cb, unsigned long mem_addr,
 
         ins->baddr0 = (long)mem_addr;
         ins->nelem = nelem;
-        ins->tri0 = tri0;
         ins->op1_stride = stride;
-        gru_start_instruction(ins, __opword(OP_VLOAD, 0, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_VLOAD, 0, xtype, IAA_RAM, 0,
+                                        (unsigned long)tri0, CB_IMA(hints)));
 }
 
 static inline void gru_vstore(void *cb, unsigned long mem_addr,
@@ -362,10 +400,9 @@ static inline void gru_vstore(void *cb, unsigned long mem_addr,
 
         ins->baddr0 = (long)mem_addr;
         ins->nelem = nelem;
-        ins->tri0 = tri0;
         ins->op1_stride = stride;
-        gru_start_instruction(ins, __opword(OP_VSTORE, 0, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_VSTORE, 0, xtype, IAA_RAM, 0,
+                                        tri0, CB_IMA(hints)));
 }
 
 static inline void gru_ivload(void *cb, unsigned long mem_addr,
@@ -376,10 +413,9 @@ static inline void gru_ivload(void *cb, unsigned long mem_addr,
 
         ins->baddr0 = (long)mem_addr;
         ins->nelem = nelem;
-        ins->tri0 = tri0;
         ins->tri1_bufsize = tri1;
-        gru_start_instruction(ins, __opword(OP_IVLOAD, 0, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_IVLOAD, 0, xtype, IAA_RAM, 0,
+                                        tri0, CB_IMA(hints)));
 }
 
 static inline void gru_ivstore(void *cb, unsigned long mem_addr,
@@ -390,10 +426,9 @@ static inline void gru_ivstore(void *cb, unsigned long mem_addr,
 
         ins->baddr0 = (long)mem_addr;
         ins->nelem = nelem;
-        ins->tri0 = tri0;
         ins->tri1_bufsize = tri1;
-        gru_start_instruction(ins, __opword(OP_IVSTORE, 0, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_IVSTORE, 0, xtype, IAA_RAM, 0,
+                                        tri0, CB_IMA(hints)));
 }
 
 static inline void gru_vset(void *cb, unsigned long mem_addr,
@@ -406,8 +441,8 @@ static inline void gru_vset(void *cb, unsigned long mem_addr,
         ins->op2_value_baddr1 = value;
         ins->nelem = nelem;
         ins->op1_stride = stride;
-        gru_start_instruction(ins, __opword(OP_VSET, 0, xtype, IAA_RAM, 0,
-                                         CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_VSET, 0, xtype, IAA_RAM, 0,
+                                         0, CB_IMA(hints)));
 }
 
 static inline void gru_ivset(void *cb, unsigned long mem_addr,
@@ -420,8 +455,8 @@ static inline void gru_ivset(void *cb, unsigned long mem_addr,
         ins->op2_value_baddr1 = value;
         ins->nelem = nelem;
         ins->tri1_bufsize = tri1;
-        gru_start_instruction(ins, __opword(OP_IVSET, 0, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_IVSET, 0, xtype, IAA_RAM, 0,
+                                        0, CB_IMA(hints)));
 }
 
 static inline void gru_vflush(void *cb, unsigned long mem_addr,
@@ -433,15 +468,15 @@ static inline void gru_vflush(void *cb, unsigned long mem_addr,
         ins->baddr0 = (long)mem_addr;
         ins->op1_stride = stride;
         ins->nelem = nelem;
-        gru_start_instruction(ins, __opword(OP_VFLUSH, 0, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_VFLUSH, 0, xtype, IAA_RAM, 0,
+                                        0, CB_IMA(hints)));
 }
 
 static inline void gru_nop(void *cb, int hints)
 {
         struct gru_instruction *ins = (void *)cb;
 
-        gru_start_instruction(ins, __opword(OP_NOP, 0, 0, 0, 0, CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_NOP, 0, 0, 0, 0, 0, CB_IMA(hints)));
 }
 
 
@@ -455,10 +490,9 @@ static inline void gru_bcopy(void *cb, const unsigned long src,
         ins->baddr0 = (long)src;
         ins->op2_value_baddr1 = (long)dest;
         ins->nelem = nelem;
-        ins->tri0 = tri0;
         ins->tri1_bufsize = bufsize;
-        gru_start_instruction(ins, __opword(OP_BCOPY, 0, xtype, IAA_RAM,
-                                        IAA_RAM, CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_BCOPY, 0, xtype, IAA_RAM,
+                                        IAA_RAM, tri0, CB_IMA(hints)));
 }
 
 static inline void gru_bstore(void *cb, const unsigned long src,
@@ -470,9 +504,8 @@ static inline void gru_bstore(void *cb, const unsigned long src,
         ins->baddr0 = (long)src;
         ins->op2_value_baddr1 = (long)dest;
         ins->nelem = nelem;
-        ins->tri0 = tri0;
-        gru_start_instruction(ins, __opword(OP_BSTORE, 0, xtype, 0, IAA_RAM,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_BSTORE, 0, xtype, 0, IAA_RAM,
+                                        tri0, CB_IMA(hints)));
 }
 
 static inline void gru_gamir(void *cb, int exopc, unsigned long src,
@@ -481,8 +514,8 @@ static inline void gru_gamir(void *cb, int exopc, unsigned long src,
         struct gru_instruction *ins = (void *)cb;
 
         ins->baddr0 = (long)src;
-        gru_start_instruction(ins, __opword(OP_GAMIR, exopc, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_GAMIR, exopc, xtype, IAA_RAM, 0,
+                                        0, CB_IMA(hints)));
 }
 
 static inline void gru_gamirr(void *cb, int exopc, unsigned long src,
@@ -491,8 +524,8 @@ static inline void gru_gamirr(void *cb, int exopc, unsigned long src,
         struct gru_instruction *ins = (void *)cb;
 
         ins->baddr0 = (long)src;
-        gru_start_instruction(ins, __opword(OP_GAMIRR, exopc, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_GAMIRR, exopc, xtype, IAA_RAM, 0,
+                                        0, CB_IMA(hints)));
 }
 
 static inline void gru_gamer(void *cb, int exopc, unsigned long src,
@@ -505,8 +538,8 @@ static inline void gru_gamer(void *cb, int exopc, unsigned long src,
         ins->baddr0 = (long)src;
         ins->op1_stride = operand1;
         ins->op2_value_baddr1 = operand2;
-        gru_start_instruction(ins, __opword(OP_GAMER, exopc, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_GAMER, exopc, xtype, IAA_RAM, 0,
+                                        0, CB_IMA(hints)));
 }
 
 static inline void gru_gamerr(void *cb, int exopc, unsigned long src,
@@ -518,8 +551,8 @@ static inline void gru_gamerr(void *cb, int exopc, unsigned long src,
         ins->baddr0 = (long)src;
         ins->op1_stride = operand1;
         ins->op2_value_baddr1 = operand2;
-        gru_start_instruction(ins, __opword(OP_GAMERR, exopc, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_GAMERR, exopc, xtype, IAA_RAM, 0,
+                                        0, CB_IMA(hints)));
 }
 
 static inline void gru_gamxr(void *cb, unsigned long src,
@@ -529,8 +562,8 @@ static inline void gru_gamxr(void *cb, unsigned long src,
 
         ins->baddr0 = (long)src;
         ins->nelem = 4;
-        gru_start_instruction(ins, __opword(OP_GAMXR, EOP_XR_CSWAP, XTYPE_DW,
-                                 IAA_RAM, 0, CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_GAMXR, EOP_XR_CSWAP, XTYPE_DW,
+                                 IAA_RAM, 0, 0, CB_IMA(hints)));
 }
 
 static inline void gru_mesq(void *cb, unsigned long queue,
@@ -541,9 +574,8 @@ static inline void gru_mesq(void *cb, unsigned long queue,
 
         ins->baddr0 = (long)queue;
         ins->nelem = nelem;
-        ins->tri0 = tri0;
-        gru_start_instruction(ins, __opword(OP_MESQ, 0, XTYPE_CL, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_MESQ, 0, XTYPE_CL, IAA_RAM, 0,
+                                        tri0, CB_IMA(hints)));
 }
 
 static inline unsigned long gru_get_amo_value(void *cb)
@@ -662,6 +694,14 @@ static inline void gru_wait_abort(void *cb)
         gru_wait_abort_proc(cb);
 }
 
+/*
+ * Get a pointer to the start of a gseg
+ *      p       - Any valid pointer within the gseg
+ */
+static inline void *gru_get_gseg_pointer (void *p)
+{
+        return (void *)((unsigned long)p & ~(GRU_GSEG_PAGESIZE - 1));
+}
 
 /*
  * Get a pointer to a control block
diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c
index 679e01778286..38657cdaf54d 100644
--- a/drivers/misc/sgi-gru/grufault.c
+++ b/drivers/misc/sgi-gru/grufault.c
@@ -40,6 +40,12 @@
 #include "gru_instructions.h"
 #include <asm/uv/uv_hub.h>
 
+/* Return codes for vtop functions */
+#define VTOP_SUCCESS               0
+#define VTOP_INVALID               -1
+#define VTOP_RETRY                 -2
+
+
 /*
  * Test if a physical address is a valid GRU GSEG address
  */
@@ -90,19 +96,22 @@ static struct gru_thread_state *gru_alloc_locked_gts(unsigned long vaddr)
 {
         struct mm_struct *mm = current->mm;
         struct vm_area_struct *vma;
-        struct gru_thread_state *gts = NULL;
+        struct gru_thread_state *gts = ERR_PTR(-EINVAL);
 
         down_write(&mm->mmap_sem);
         vma = gru_find_vma(vaddr);
-        if (vma)
-                gts = gru_alloc_thread_state(vma, TSID(vaddr, vma));
-        if (gts) {
-                mutex_lock(&gts->ts_ctxlock);
-                downgrade_write(&mm->mmap_sem);
-        } else {
-                up_write(&mm->mmap_sem);
-        }
+        if (!vma)
+                goto err;
 
+        gts = gru_alloc_thread_state(vma, TSID(vaddr, vma));
+        if (IS_ERR(gts))
+                goto err;
+        mutex_lock(&gts->ts_ctxlock);
+        downgrade_write(&mm->mmap_sem);
+        return gts;
+
+err:
+        up_write(&mm->mmap_sem);
         return gts;
 }
 
@@ -122,39 +131,15 @@ static void gru_unlock_gts(struct gru_thread_state *gts)
  * is necessary to prevent the user from seeing a stale cb.istatus that will
  * change as soon as the TFH restart is complete. Races may cause an
  * occasional failure to clear the cb.istatus, but that is ok.
- *
- * If the cb address is not valid (should not happen, but...), nothing
- * bad will happen.. The get_user()/put_user() will fail but there
- * are no bad side-effects.
  */
-static void gru_cb_set_istatus_active(unsigned long __user *cb)
+static void gru_cb_set_istatus_active(struct gru_instruction_bits *cbk)
 {
-        union {
-                struct gru_instruction_bits bits;
-                unsigned long dw;
-        } u;
-
-        if (cb) {
-                get_user(u.dw, cb);
-                u.bits.istatus = CBS_ACTIVE;
-                put_user(u.dw, cb);
+        if (cbk) {
+                cbk->istatus = CBS_ACTIVE;
         }
 }
 
 /*
- * Convert a interrupt IRQ to a pointer to the GRU GTS that caused the
- * interrupt. Interrupts are always sent to a cpu on the blade that contains the
- * GRU (except for headless blades which are not currently supported). A blade
- * has N grus; a block of N consecutive IRQs is assigned to the GRUs. The IRQ
- * number uniquely identifies the GRU chiplet on the local blade that caused the
- * interrupt. Always called in interrupt context.
- */
-static inline struct gru_state *irq_to_gru(int irq)
-{
-        return &gru_base[uv_numa_blade_id()]->bs_grus[irq - IRQ_GRU];
-}
-
-/*
  * Read & clear a TFM
  *
  * The GRU has an array of fault maps. A map is private to a cpu
@@ -207,10 +192,11 @@ static int non_atomic_pte_lookup(struct vm_area_struct *vma,
 {
         struct page *page;
 
-        /* ZZZ Need to handle HUGE pages */
-        if (is_vm_hugetlb_page(vma))
-                return -EFAULT;
+#ifdef CONFIG_HUGETLB_PAGE
+        *pageshift = is_vm_hugetlb_page(vma) ? HPAGE_SHIFT : PAGE_SHIFT;
+#else
         *pageshift = PAGE_SHIFT;
+#endif
         if (get_user_pages
             (current, current->mm, vaddr, 1, write, 0, &page, NULL) <= 0)
                 return -EFAULT;
@@ -268,7 +254,6 @@ static int atomic_pte_lookup(struct vm_area_struct *vma, unsigned long vaddr,
         return 0;
 
 err:
-        local_irq_enable();
         return 1;
 }
 
@@ -301,14 +286,69 @@ static int gru_vtop(struct gru_thread_state *gts, unsigned long vaddr,
         paddr = paddr & ~((1UL << ps) - 1);
         *gpa = uv_soc_phys_ram_to_gpa(paddr);
         *pageshift = ps;
-        return 0;
+        return VTOP_SUCCESS;
 
 inval:
-        return -1;
+        return VTOP_INVALID;
 upm:
-        return -2;
+        return VTOP_RETRY;
+}
+
+
+/*
+ * Flush a CBE from cache. The CBE is clean in the cache. Dirty the
+ * CBE cacheline so that the line will be written back to home agent.
+ * Otherwise the line may be silently dropped. This has no impact
+ * except on performance.
+ */
+static void gru_flush_cache_cbe(struct gru_control_block_extended *cbe)
+{
+        if (unlikely(cbe)) {
+                cbe->cbrexecstatus = 0;         /* make CL dirty */
+                gru_flush_cache(cbe);
+        }
 }
 
+/*
+ * Preload the TLB with entries that may be required. Currently, preloading
+ * is implemented only for BCOPY. Preload  <tlb_preload_count> pages OR to
+ * the end of the bcopy tranfer, whichever is smaller.
+ */
+static void gru_preload_tlb(struct gru_state *gru,
+                        struct gru_thread_state *gts, int atomic,
+                        unsigned long fault_vaddr, int asid, int write,
+                        unsigned char tlb_preload_count,
+                        struct gru_tlb_fault_handle *tfh,
+                        struct gru_control_block_extended *cbe)
+{
+        unsigned long vaddr = 0, gpa;
+        int ret, pageshift;
+
+        if (cbe->opccpy != OP_BCOPY)
+                return;
+
+        if (fault_vaddr == cbe->cbe_baddr0)
+                vaddr = fault_vaddr + GRU_CACHE_LINE_BYTES * cbe->cbe_src_cl - 1;
+        else if (fault_vaddr == cbe->cbe_baddr1)
+                vaddr = fault_vaddr + (1 << cbe->xtypecpy) * cbe->cbe_nelemcur - 1;
+
+        fault_vaddr &= PAGE_MASK;
+        vaddr &= PAGE_MASK;
+        vaddr = min(vaddr, fault_vaddr + tlb_preload_count * PAGE_SIZE);
+
+        while (vaddr > fault_vaddr) {
+                ret = gru_vtop(gts, vaddr, write, atomic, &gpa, &pageshift);
+                if (ret || tfh_write_only(tfh, gpa, GAA_RAM, vaddr, asid, write,
+                                          GRU_PAGESIZE(pageshift)))
+                        return;
+                gru_dbg(grudev,
+                        "%s: gid %d, gts 0x%p, tfh 0x%p, vaddr 0x%lx, asid 0x%x, rw %d, ps %d, gpa 0x%lx\n",
+                        atomic ? "atomic" : "non-atomic", gru->gs_gid, gts, tfh,
+                        vaddr, asid, write, pageshift, gpa);
+                vaddr -= PAGE_SIZE;
+                STAT(tlb_preload_page);
+        }
+}
 
 /*
  * Drop a TLB entry into the GRU. The fault is described by info in an TFH.
@@ -320,11 +360,14 @@ upm:
  *              < 0 = error code
  *
  */
-static int gru_try_dropin(struct gru_thread_state *gts,
+static int gru_try_dropin(struct gru_state *gru,
+                          struct gru_thread_state *gts,
                           struct gru_tlb_fault_handle *tfh,
-                          unsigned long __user *cb)
+                          struct gru_instruction_bits *cbk)
 {
-        int pageshift = 0, asid, write, ret, atomic = !cb;
+        struct gru_control_block_extended *cbe = NULL;
+        unsigned char tlb_preload_count = gts->ts_tlb_preload_count;
+        int pageshift = 0, asid, write, ret, atomic = !cbk, indexway;
         unsigned long gpa = 0, vaddr = 0;
 
         /*
@@ -335,24 +378,34 @@ static int gru_try_dropin(struct gru_thread_state *gts,
          */
 
         /*
+         * Prefetch the CBE if doing TLB preloading
+         */
+        if (unlikely(tlb_preload_count)) {
+                cbe = gru_tfh_to_cbe(tfh);
+                prefetchw(cbe);
+        }
+
+        /*
          * Error if TFH state is IDLE or FMM mode & the user issuing a UPM call.
          * Might be a hardware race OR a stupid user. Ignore FMM because FMM
          * is a transient state.
          */
         if (tfh->status != TFHSTATUS_EXCEPTION) {
                 gru_flush_cache(tfh);
+                sync_core();
                 if (tfh->status != TFHSTATUS_EXCEPTION)
                         goto failnoexception;
                 STAT(tfh_stale_on_fault);
         }
         if (tfh->state == TFHSTATE_IDLE)
                 goto failidle;
-        if (tfh->state == TFHSTATE_MISS_FMM && cb)
+        if (tfh->state == TFHSTATE_MISS_FMM && cbk)
                 goto failfmm;
 
         write = (tfh->cause & TFHCAUSE_TLB_MOD) != 0;
         vaddr = tfh->missvaddr;
         asid = tfh->missasid;
+        indexway = tfh->indexway;
         if (asid == 0)
                 goto failnoasid;
 
@@ -366,41 +419,51 @@ static int gru_try_dropin(struct gru_thread_state *gts,
                 goto failactive;
 
         ret = gru_vtop(gts, vaddr, write, atomic, &gpa, &pageshift);
-        if (ret == -1)
+        if (ret == VTOP_INVALID)
                 goto failinval;
-        if (ret == -2)
+        if (ret == VTOP_RETRY)
                 goto failupm;
 
         if (!(gts->ts_sizeavail & GRU_SIZEAVAIL(pageshift))) {
                 gts->ts_sizeavail |= GRU_SIZEAVAIL(pageshift);
-                if (atomic || !gru_update_cch(gts, 0)) {
+                if (atomic || !gru_update_cch(gts)) {
                         gts->ts_force_cch_reload = 1;
                         goto failupm;
                 }
         }
-        gru_cb_set_istatus_active(cb);
+
+        if (unlikely(cbe) && pageshift == PAGE_SHIFT) {
+                gru_preload_tlb(gru, gts, atomic, vaddr, asid, write, tlb_preload_count, tfh, cbe);
+                gru_flush_cache_cbe(cbe);
+        }
+
+        gru_cb_set_istatus_active(cbk);
+        gts->ustats.tlbdropin++;
         tfh_write_restart(tfh, gpa, GAA_RAM, vaddr, asid, write,
                           GRU_PAGESIZE(pageshift));
-        STAT(tlb_dropin);
         gru_dbg(grudev,
-                "%s: tfh 0x%p, vaddr 0x%lx, asid 0x%x, ps %d, gpa 0x%lx\n",
-                ret ? "non-atomic" : "atomic", tfh, vaddr, asid,
-                pageshift, gpa);
+                "%s: gid %d, gts 0x%p, tfh 0x%p, vaddr 0x%lx, asid 0x%x, indexway 0x%x,"
+                " rw %d, ps %d, gpa 0x%lx\n",
+                atomic ? "atomic" : "non-atomic", gru->gs_gid, gts, tfh, vaddr, asid,
+                indexway, write, pageshift, gpa);
+        STAT(tlb_dropin);
         return 0;
 
 failnoasid:
         /* No asid (delayed unload). */
         STAT(tlb_dropin_fail_no_asid);
         gru_dbg(grudev, "FAILED no_asid tfh: 0x%p, vaddr 0x%lx\n", tfh, vaddr);
-        if (!cb)
+        if (!cbk)
                 tfh_user_polling_mode(tfh);
         else
                 gru_flush_cache(tfh);
+        gru_flush_cache_cbe(cbe);
         return -EAGAIN;
 
 failupm:
         /* Atomic failure switch CBR to UPM */
         tfh_user_polling_mode(tfh);
+        gru_flush_cache_cbe(cbe);
         STAT(tlb_dropin_fail_upm);
         gru_dbg(grudev, "FAILED upm tfh: 0x%p, vaddr 0x%lx\n", tfh, vaddr);
         return 1;
@@ -408,6 +471,7 @@ failupm:
 failfmm:
         /* FMM state on UPM call */
         gru_flush_cache(tfh);
+        gru_flush_cache_cbe(cbe);
         STAT(tlb_dropin_fail_fmm);
         gru_dbg(grudev, "FAILED fmm tfh: 0x%p, state %d\n", tfh, tfh->state);
         return 0;
@@ -415,17 +479,20 @@ failfmm:
 failnoexception:
         /* TFH status did not show exception pending */
         gru_flush_cache(tfh);
-        if (cb)
-                gru_flush_cache(cb);
+        gru_flush_cache_cbe(cbe);
+        if (cbk)
+                gru_flush_cache(cbk);
         STAT(tlb_dropin_fail_no_exception);
-        gru_dbg(grudev, "FAILED non-exception tfh: 0x%p, status %d, state %d\n", tfh, tfh->status, tfh->state);
+        gru_dbg(grudev, "FAILED non-exception tfh: 0x%p, status %d, state %d\n",
+                tfh, tfh->status, tfh->state);
         return 0;
 
 failidle:
         /* TFH state was idle  - no miss pending */
         gru_flush_cache(tfh);
-        if (cb)
-                gru_flush_cache(cb);
+        gru_flush_cache_cbe(cbe);
+        if (cbk)
+                gru_flush_cache(cbk);
         STAT(tlb_dropin_fail_idle);
         gru_dbg(grudev, "FAILED idle tfh: 0x%p, state %d\n", tfh, tfh->state);
         return 0;
@@ -433,16 +500,18 @@ failidle:
 failinval:
         /* All errors (atomic & non-atomic) switch CBR to EXCEPTION state */
         tfh_exception(tfh);
+        gru_flush_cache_cbe(cbe);
         STAT(tlb_dropin_fail_invalid);
         gru_dbg(grudev, "FAILED inval tfh: 0x%p, vaddr 0x%lx\n", tfh, vaddr);
         return -EFAULT;
 
 failactive:
         /* Range invalidate active. Switch to UPM iff atomic */
-        if (!cb)
+        if (!cbk)
                 tfh_user_polling_mode(tfh);
         else
                 gru_flush_cache(tfh);
+        gru_flush_cache_cbe(cbe);
         STAT(tlb_dropin_fail_range_active);
         gru_dbg(grudev, "FAILED range active: tfh 0x%p, vaddr 0x%lx\n",
                 tfh, vaddr);
@@ -455,31 +524,41 @@ failactive:
  * Note that this is the interrupt handler that is registered with linux
  * interrupt handlers.
  */
-irqreturn_t gru_intr(int irq, void *dev_id)
+static irqreturn_t gru_intr(int chiplet, int blade)
 {
         struct gru_state *gru;
         struct gru_tlb_fault_map imap, dmap;
         struct gru_thread_state *gts;
         struct gru_tlb_fault_handle *tfh = NULL;
+        struct completion *cmp;
         int cbrnum, ctxnum;
 
         STAT(intr);
 
-        gru = irq_to_gru(irq);
+        gru = &gru_base[blade]->bs_grus[chiplet];
         if (!gru) {
-                dev_err(grudev, "GRU: invalid interrupt: cpu %d, irq %d\n",
-                        raw_smp_processor_id(), irq);
+                dev_err(grudev, "GRU: invalid interrupt: cpu %d, chiplet %d\n",
+                        raw_smp_processor_id(), chiplet);
                 return IRQ_NONE;
         }
         get_clear_fault_map(gru, &imap, &dmap);
+        gru_dbg(grudev,
+                "cpu %d, chiplet %d, gid %d, imap %016lx %016lx, dmap %016lx %016lx\n",
+                smp_processor_id(), chiplet, gru->gs_gid,
+                imap.fault_bits[0], imap.fault_bits[1],
+                dmap.fault_bits[0], dmap.fault_bits[1]);
 
         for_each_cbr_in_tfm(cbrnum, dmap.fault_bits) {
-                complete(gru->gs_blade->bs_async_wq);
+                STAT(intr_cbr);
+                cmp = gru->gs_blade->bs_async_wq;
+                if (cmp)
+                        complete(cmp);
                 gru_dbg(grudev, "gid %d, cbr_done %d, done %d\n",
-                        gru->gs_gid, cbrnum, gru->gs_blade->bs_async_wq->done);
+                        gru->gs_gid, cbrnum, cmp ? cmp->done : -1);
         }
 
         for_each_cbr_in_tfm(cbrnum, imap.fault_bits) {
+                STAT(intr_tfh);
                 tfh = get_tfh_by_index(gru, cbrnum);
                 prefetchw(tfh); /* Helps on hdw, required for emulator */
 
@@ -492,14 +571,20 @@ irqreturn_t gru_intr(int irq, void *dev_id)
                 ctxnum = tfh->ctxnum;
                 gts = gru->gs_gts[ctxnum];
 
+                /* Spurious interrupts can cause this. Ignore. */
+                if (!gts) {
+                        STAT(intr_spurious);
+                        continue;
+                }
+
                 /*
                  * This is running in interrupt context. Trylock the mmap_sem.
                  * If it fails, retry the fault in user context.
                  */
+                gts->ustats.fmm_tlbmiss++;
                 if (!gts->ts_force_cch_reload &&
                                         down_read_trylock(&gts->ts_mm->mmap_sem)) {
-                        gts->ustats.fmm_tlbdropin++;
-                        gru_try_dropin(gts, tfh, NULL);
+                        gru_try_dropin(gru, gts, tfh, NULL);
                         up_read(&gts->ts_mm->mmap_sem);
                 } else {
                         tfh_user_polling_mode(tfh);
@@ -509,20 +594,43 @@ irqreturn_t gru_intr(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
+irqreturn_t gru0_intr(int irq, void *dev_id)
+{
+        return gru_intr(0, uv_numa_blade_id());
+}
+
+irqreturn_t gru1_intr(int irq, void *dev_id)
+{
+        return gru_intr(1, uv_numa_blade_id());
+}
+
+irqreturn_t gru_intr_mblade(int irq, void *dev_id)
+{
+        int blade;
+
+        for_each_possible_blade(blade) {
+                if (uv_blade_nr_possible_cpus(blade))
+                        continue;
+                 gru_intr(0, blade);
+                 gru_intr(1, blade);
+        }
+        return IRQ_HANDLED;
+}
+
 
 static int gru_user_dropin(struct gru_thread_state *gts,
                            struct gru_tlb_fault_handle *tfh,
-                           unsigned long __user *cb)
+                           void *cb)
 {
         struct gru_mm_struct *gms = gts->ts_gms;
         int ret;
 
-        gts->ustats.upm_tlbdropin++;
+        gts->ustats.upm_tlbmiss++;
         while (1) {
                 wait_event(gms->ms_wait_queue,
                            atomic_read(&gms->ms_range_active) == 0);
                 prefetchw(tfh); /* Helps on hdw, required for emulator */
-                ret = gru_try_dropin(gts, tfh, cb);
+                ret = gru_try_dropin(gts->ts_gru, gts, tfh, cb);
                 if (ret <= 0)
                         return ret;
                 STAT(call_os_wait_queue);
@@ -538,52 +646,41 @@ int gru_handle_user_call_os(unsigned long cb)
 {
         struct gru_tlb_fault_handle *tfh;
         struct gru_thread_state *gts;
-        unsigned long __user *cbp;
+        void *cbk;
         int ucbnum, cbrnum, ret = -EINVAL;
 
         STAT(call_os);
-        gru_dbg(grudev, "address 0x%lx\n", cb);
 
         /* sanity check the cb pointer */
         ucbnum = get_cb_number((void *)cb);
         if ((cb & (GRU_HANDLE_STRIDE - 1)) || ucbnum >= GRU_NUM_CB)
                 return -EINVAL;
-        cbp = (unsigned long *)cb;
 
         gts = gru_find_lock_gts(cb);
         if (!gts)
                 return -EINVAL;
+        gru_dbg(grudev, "address 0x%lx, gid %d, gts 0x%p\n", cb, gts->ts_gru ? gts->ts_gru->gs_gid : -1, gts);
 
         if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE)
                 goto exit;
 
-        /*
-         * If force_unload is set, the UPM TLB fault is phony. The task
-         * has migrated to another node and the GSEG must be moved. Just
-         * unload the context. The task will page fault and assign a new
-         * context.
-         */
-        if (gts->ts_tgid_owner == current->tgid && gts->ts_blade >= 0 &&
-                                gts->ts_blade != uv_numa_blade_id()) {
-                STAT(call_os_offnode_reference);
-                gts->ts_force_unload = 1;
-        }
+        gru_check_context_placement(gts);
 
         /*
          * CCH may contain stale data if ts_force_cch_reload is set.
          */
         if (gts->ts_gru && gts->ts_force_cch_reload) {
                 gts->ts_force_cch_reload = 0;
-                gru_update_cch(gts, 0);
+                gru_update_cch(gts);
         }
 
         ret = -EAGAIN;
         cbrnum = thread_cbr_number(gts, ucbnum);
-        if (gts->ts_force_unload) {
-                gru_unload_context(gts, 1);
-        } else if (gts->ts_gru) {
+        if (gts->ts_gru) {
                 tfh = get_tfh_by_index(gts->ts_gru, cbrnum);
-                ret = gru_user_dropin(gts, tfh, cbp);
+                cbk = get_gseg_base_address_cb(gts->ts_gru->gs_gru_base_vaddr,
+                                gts->ts_ctxnum, ucbnum);
+                ret = gru_user_dropin(gts, tfh, cbk);
         }
 exit:
         gru_unlock_gts(gts);
@@ -605,11 +702,11 @@ int gru_get_exception_detail(unsigned long arg)
         if (copy_from_user(&excdet, (void __user *)arg, sizeof(excdet)))
                 return -EFAULT;
 
-        gru_dbg(grudev, "address 0x%lx\n", excdet.cb);
         gts = gru_find_lock_gts(excdet.cb);
         if (!gts)
                 return -EINVAL;
 
+        gru_dbg(grudev, "address 0x%lx, gid %d, gts 0x%p\n", excdet.cb, gts->ts_gru ? gts->ts_gru->gs_gid : -1, gts);
         ucbnum = get_cb_number((void *)excdet.cb);
         if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE) {
                 ret = -EINVAL;
@@ -617,6 +714,7 @@ int gru_get_exception_detail(unsigned long arg)
                 cbrnum = thread_cbr_number(gts, ucbnum);
                 cbe = get_cbe_by_index(gts->ts_gru, cbrnum);
                 gru_flush_cache(cbe);   /* CBE not coherent */
+                sync_core();            /* make sure we are have current data */
                 excdet.opc = cbe->opccpy;
                 excdet.exopc = cbe->exopccpy;
                 excdet.ecause = cbe->ecause;
@@ -624,7 +722,7 @@ int gru_get_exception_detail(unsigned long arg)
                 excdet.exceptdet1 = cbe->idef3upd;
                 excdet.cbrstate = cbe->cbrstate;
                 excdet.cbrexecstatus = cbe->cbrexecstatus;
-                gru_flush_cache(cbe);
+                gru_flush_cache_cbe(cbe);
                 ret = 0;
         } else {
                 ret = -EAGAIN;
@@ -733,6 +831,11 @@ long gru_get_gseg_statistics(unsigned long arg)
         if (copy_from_user(&req, (void __user *)arg, sizeof(req)))
                 return -EFAULT;
 
+        /*
+         * The library creates arrays of contexts for threaded programs.
+         * If no gts exists in the array, the context has never been used & all
+         * statistics are implicitly 0.
+         */
         gts = gru_find_lock_gts(req.gseg);
         if (gts) {
                 memcpy(&req.stats, &gts->ustats, sizeof(gts->ustats));
@@ -762,11 +865,25 @@ int gru_set_context_option(unsigned long arg)
                 return -EFAULT;
         gru_dbg(grudev, "op %d, gseg 0x%lx, value1 0x%lx\n", req.op, req.gseg, req.val1);
 
-        gts = gru_alloc_locked_gts(req.gseg);
-        if (!gts)
-                return -EINVAL;
+        gts = gru_find_lock_gts(req.gseg);
+        if (!gts) {
+                gts = gru_alloc_locked_gts(req.gseg);
+                if (IS_ERR(gts))
+                        return PTR_ERR(gts);
+        }
 
         switch (req.op) {
+        case sco_blade_chiplet:
+                /* Select blade/chiplet for GRU context */
+                if (req.val1 < -1 || req.val1 >= GRU_MAX_BLADES || !gru_base[req.val1] ||
+                    req.val0 < -1 || req.val0 >= GRU_CHIPLETS_PER_HUB) {
+                        ret = -EINVAL;
+                } else {
+                        gts->ts_user_blade_id = req.val1;
+                        gts->ts_user_chiplet_id = req.val0;
+                        gru_check_context_placement(gts);
+                }
+                break;
         case sco_gseg_owner:
                 /* Register the current task as the GSEG owner */
                 gts->ts_tgid_owner = current->tgid;
diff --git a/drivers/misc/sgi-gru/grufile.c b/drivers/misc/sgi-gru/grufile.c
index 41c8fe2a928c..cb3b4d228475 100644
--- a/drivers/misc/sgi-gru/grufile.c
+++ b/drivers/misc/sgi-gru/grufile.c
@@ -35,6 +35,9 @@
 #include <linux/interrupt.h>
 #include <linux/proc_fs.h>
 #include <linux/uaccess.h>
+#ifdef CONFIG_X86_64
+#include <asm/uv/uv_irq.h>
+#endif
 #include <asm/uv/uv.h>
 #include "gru.h"
 #include "grulib.h"
@@ -92,7 +95,7 @@ static void gru_vma_close(struct vm_area_struct *vma)
 /*
  * gru_file_mmap
  *
- * Called when mmaping the device.  Initializes the vma with a fault handler
+ * Called when mmapping the device.  Initializes the vma with a fault handler
  * and private data structure necessary to allocate, track, and free the
  * underlying pages.
  */
@@ -130,7 +133,6 @@ static int gru_create_new_context(unsigned long arg)
         struct gru_vma_data *vdata;
         int ret = -EINVAL;
 
-
         if (copy_from_user(&req, (void __user *)arg, sizeof(req)))
                 return -EFAULT;
 
@@ -150,6 +152,7 @@ static int gru_create_new_context(unsigned long arg)
                 vdata->vd_dsr_au_count =
                     GRU_DS_BYTES_TO_AU(req.data_segment_bytes);
                 vdata->vd_cbr_au_count = GRU_CB_COUNT_TO_AU(req.control_blocks);
+                vdata->vd_tlb_preload_count = req.tlb_preload_count;
                 ret = 0;
         }
         up_write(&current->mm->mmap_sem);
@@ -190,7 +193,7 @@ static long gru_file_unlocked_ioctl(struct file *file, unsigned int req,
 {
         int err = -EBADRQC;
 
-        gru_dbg(grudev, "file %p\n", file);
+        gru_dbg(grudev, "file %p, req 0x%x, 0x%lx\n", file, req, arg);
 
         switch (req) {
         case GRU_CREATE_CONTEXT:
@@ -232,23 +235,24 @@ static long gru_file_unlocked_ioctl(struct file *file, unsigned int req,
  * system.
  */
 static void gru_init_chiplet(struct gru_state *gru, unsigned long paddr,
-                             void *vaddr, int nid, int bid, int grunum)
+                             void *vaddr, int blade_id, int chiplet_id)
 {
         spin_lock_init(&gru->gs_lock);
         spin_lock_init(&gru->gs_asid_lock);
         gru->gs_gru_base_paddr = paddr;
         gru->gs_gru_base_vaddr = vaddr;
-        gru->gs_gid = bid * GRU_CHIPLETS_PER_BLADE + grunum;
-        gru->gs_blade = gru_base[bid];
-        gru->gs_blade_id = bid;
+        gru->gs_gid = blade_id * GRU_CHIPLETS_PER_BLADE + chiplet_id;
+        gru->gs_blade = gru_base[blade_id];
+        gru->gs_blade_id = blade_id;
+        gru->gs_chiplet_id = chiplet_id;
         gru->gs_cbr_map = (GRU_CBR_AU == 64) ? ~0 : (1UL << GRU_CBR_AU) - 1;
         gru->gs_dsr_map = (1UL << GRU_DSR_AU) - 1;
         gru->gs_asid_limit = MAX_ASID;
         gru_tgh_flush_init(gru);
         if (gru->gs_gid >= gru_max_gids)
                 gru_max_gids = gru->gs_gid + 1;
-        gru_dbg(grudev, "bid %d, nid %d, gid %d, vaddr %p (0x%lx)\n",
-                bid, nid, gru->gs_gid, gru->gs_gru_base_vaddr,
+        gru_dbg(grudev, "bid %d, gid %d, vaddr %p (0x%lx)\n",
+                blade_id, gru->gs_gid, gru->gs_gru_base_vaddr,
                 gru->gs_gru_base_paddr);
 }
 
@@ -264,12 +268,10 @@ static int gru_init_tables(unsigned long gru_base_paddr, void *gru_base_vaddr)
 
         max_user_cbrs = GRU_NUM_CB;
         max_user_dsr_bytes = GRU_NUM_DSR_BYTES;
-        for_each_online_node(nid) {
-                bid = uv_node_to_blade_id(nid);
-                pnode = uv_node_to_pnode(nid);
-                if (bid < 0 || gru_base[bid])
-                        continue;
-                page = alloc_pages_exact_node(nid, GFP_KERNEL, order);
+        for_each_possible_blade(bid) {
+                pnode = uv_blade_to_pnode(bid);
+                nid = uv_blade_to_memory_nid(bid);/* -1 if no memory on blade */
+                page = alloc_pages_node(nid, GFP_KERNEL, order);
                 if (!page)
                         goto fail;
                 gru_base[bid] = page_address(page);
@@ -285,7 +287,7 @@ static int gru_init_tables(unsigned long gru_base_paddr, void *gru_base_vaddr)
                                 chip++, gru++) {
                         paddr = gru_chiplet_paddr(gru_base_paddr, pnode, chip);
                         vaddr = gru_chiplet_vaddr(gru_base_vaddr, pnode, chip);
-                        gru_init_chiplet(gru, paddr, vaddr, nid, bid, chip);
+                        gru_init_chiplet(gru, paddr, vaddr, bid, chip);
                         n = hweight64(gru->gs_cbr_map) * GRU_CBR_AU_SIZE;
                         cbrs = max(cbrs, n);
                         n = hweight64(gru->gs_dsr_map) * GRU_DSR_AU_BYTES;
@@ -298,39 +300,215 @@ static int gru_init_tables(unsigned long gru_base_paddr, void *gru_base_vaddr)
         return 0;
 
 fail:
-        for (nid--; nid >= 0; nid--)
-                free_pages((unsigned long)gru_base[nid], order);
+        for (bid--; bid >= 0; bid--)
+                free_pages((unsigned long)gru_base[bid], order);
         return -ENOMEM;
 }
 
-#ifdef CONFIG_IA64
+static void gru_free_tables(void)
+{
+        int bid;
+        int order = get_order(sizeof(struct gru_state) *
+                              GRU_CHIPLETS_PER_BLADE);
 
-static int get_base_irq(void)
+        for (bid = 0; bid < GRU_MAX_BLADES; bid++)
+                free_pages((unsigned long)gru_base[bid], order);
+}
+
+static unsigned long gru_chiplet_cpu_to_mmr(int chiplet, int cpu, int *corep)
 {
-        return IRQ_GRU;
+        unsigned long mmr = 0;
+        int core;
+
+        /*
+         * We target the cores of a blade and not the hyperthreads themselves.
+         * There is a max of 8 cores per socket and 2 sockets per blade,
+         * making for a max total of 16 cores (i.e., 16 CPUs without
+         * hyperthreading and 32 CPUs with hyperthreading).
+         */
+        core = uv_cpu_core_number(cpu) + UV_MAX_INT_CORES * uv_cpu_socket_number(cpu);
+        if (core >= GRU_NUM_TFM || uv_cpu_ht_number(cpu))
+                return 0;
+
+        if (chiplet == 0) {
+                mmr = UVH_GR0_TLB_INT0_CONFIG +
+                    core * (UVH_GR0_TLB_INT1_CONFIG - UVH_GR0_TLB_INT0_CONFIG);
+        } else if (chiplet == 1) {
+                mmr = UVH_GR1_TLB_INT0_CONFIG +
+                    core * (UVH_GR1_TLB_INT1_CONFIG - UVH_GR1_TLB_INT0_CONFIG);
+        } else {
+                BUG();
+        }
+
+        *corep = core;
+        return mmr;
 }
 
-#elif defined CONFIG_X86_64
+#ifdef CONFIG_IA64
 
-static void noop(unsigned int irq)
+static int gru_irq_count[GRU_CHIPLETS_PER_BLADE];
+
+static void gru_noop(unsigned int irq)
 {
 }
 
-static struct irq_chip gru_chip = {
-        .name           = "gru",
-        .mask           = noop,
-        .unmask         = noop,
-        .ack            = noop,
+static struct irq_chip gru_chip[GRU_CHIPLETS_PER_BLADE] = {
+        [0 ... GRU_CHIPLETS_PER_BLADE - 1] {
+                .mask           = gru_noop,
+                .unmask         = gru_noop,
+                .ack            = gru_noop
+        }
 };
 
-static int get_base_irq(void)
+static int gru_chiplet_setup_tlb_irq(int chiplet, char *irq_name,
+                        irq_handler_t irq_handler, int cpu, int blade)
+{
+        unsigned long mmr;
+        int irq = IRQ_GRU + chiplet;
+        int ret, core;
+
+        mmr = gru_chiplet_cpu_to_mmr(chiplet, cpu, &core);
+        if (mmr == 0)
+                return 0;
+
+        if (gru_irq_count[chiplet] == 0) {
+                gru_chip[chiplet].name = irq_name;
+                ret = set_irq_chip(irq, &gru_chip[chiplet]);
+                if (ret) {
+                        printk(KERN_ERR "%s: set_irq_chip failed, errno=%d\n",
+                               GRU_DRIVER_ID_STR, -ret);
+                        return ret;
+                }
+
+                ret = request_irq(irq, irq_handler, 0, irq_name, NULL);
+                if (ret) {
+                        printk(KERN_ERR "%s: request_irq failed, errno=%d\n",
+                               GRU_DRIVER_ID_STR, -ret);
+                        return ret;
+                }
+        }
+        gru_irq_count[chiplet]++;
+
+        return 0;
+}
+
+static void gru_chiplet_teardown_tlb_irq(int chiplet, int cpu, int blade)
+{
+        unsigned long mmr;
+        int core, irq = IRQ_GRU + chiplet;
+
+        if (gru_irq_count[chiplet] == 0)
+                return;
+
+        mmr = gru_chiplet_cpu_to_mmr(chiplet, cpu, &core);
+        if (mmr == 0)
+                return;
+
+        if (--gru_irq_count[chiplet] == 0)
+                free_irq(irq, NULL);
+}
+
+#elif defined CONFIG_X86_64
+
+static int gru_chiplet_setup_tlb_irq(int chiplet, char *irq_name,
+                        irq_handler_t irq_handler, int cpu, int blade)
+{
+        unsigned long mmr;
+        int irq, core;
+        int ret;
+
+        mmr = gru_chiplet_cpu_to_mmr(chiplet, cpu, &core);
+        if (mmr == 0)
+                return 0;
+
+        irq = uv_setup_irq(irq_name, cpu, blade, mmr, UV_AFFINITY_CPU);
+        if (irq < 0) {
+                printk(KERN_ERR "%s: uv_setup_irq failed, errno=%d\n",
+                       GRU_DRIVER_ID_STR, -irq);
+                return irq;
+        }
+
+        ret = request_irq(irq, irq_handler, 0, irq_name, NULL);
+        if (ret) {
+                uv_teardown_irq(irq);
+                printk(KERN_ERR "%s: request_irq failed, errno=%d\n",
+                       GRU_DRIVER_ID_STR, -ret);
+                return ret;
+        }
+        gru_base[blade]->bs_grus[chiplet].gs_irq[core] = irq;
+        return 0;
+}
+
+static void gru_chiplet_teardown_tlb_irq(int chiplet, int cpu, int blade)
 {
-        set_irq_chip(IRQ_GRU, &gru_chip);
-        set_irq_chip(IRQ_GRU + 1, &gru_chip);
-        return IRQ_GRU;
+        int irq, core;
+        unsigned long mmr;
+
+        mmr = gru_chiplet_cpu_to_mmr(chiplet, cpu, &core);
+        if (mmr) {
+                irq = gru_base[blade]->bs_grus[chiplet].gs_irq[core];
+                if (irq) {
+                        free_irq(irq, NULL);
+                        uv_teardown_irq(irq);
+                }
+        }
 }
+
 #endif
 
+static void gru_teardown_tlb_irqs(void)
+{
+        int blade;
+        int cpu;
+
+        for_each_online_cpu(cpu) {
+                blade = uv_cpu_to_blade_id(cpu);
+                gru_chiplet_teardown_tlb_irq(0, cpu, blade);
+                gru_chiplet_teardown_tlb_irq(1, cpu, blade);
+        }
+        for_each_possible_blade(blade) {
+                if (uv_blade_nr_possible_cpus(blade))
+                        continue;
+                gru_chiplet_teardown_tlb_irq(0, 0, blade);
+                gru_chiplet_teardown_tlb_irq(1, 0, blade);
+        }
+}
+
+static int gru_setup_tlb_irqs(void)
+{
+        int blade;
+        int cpu;
+        int ret;
+
+        for_each_online_cpu(cpu) {
+                blade = uv_cpu_to_blade_id(cpu);
+                ret = gru_chiplet_setup_tlb_irq(0, "GRU0_TLB", gru0_intr, cpu, blade);
+                if (ret != 0)
+                        goto exit1;
+
+                ret = gru_chiplet_setup_tlb_irq(1, "GRU1_TLB", gru1_intr, cpu, blade);
+                if (ret != 0)
+                        goto exit1;
+        }
+        for_each_possible_blade(blade) {
+                if (uv_blade_nr_possible_cpus(blade))
+                        continue;
+                ret = gru_chiplet_setup_tlb_irq(0, "GRU0_TLB", gru_intr_mblade, 0, blade);
+                if (ret != 0)
+                        goto exit1;
+
+                ret = gru_chiplet_setup_tlb_irq(1, "GRU1_TLB", gru_intr_mblade, 0, blade);
+                if (ret != 0)
+                        goto exit1;
+        }
+
+        return 0;
+
+exit1:
+        gru_teardown_tlb_irqs();
+        return ret;
+}
+
 /*
  * gru_init
  *
@@ -338,8 +516,7 @@ static int get_base_irq(void)
  */
 static int __init gru_init(void)
 {
-        int ret, irq, chip;
-        char id[10];
+        int ret;
 
         if (!is_uv_system())
                 return 0;
@@ -354,41 +531,29 @@ static int __init gru_init(void)
         gru_end_paddr = gru_start_paddr + GRU_MAX_BLADES * GRU_SIZE;
         printk(KERN_INFO "GRU space: 0x%lx - 0x%lx\n",
                gru_start_paddr, gru_end_paddr);
-        irq = get_base_irq();
-        for (chip = 0; chip < GRU_CHIPLETS_PER_BLADE; chip++) {
-                ret = request_irq(irq + chip, gru_intr, 0, id, NULL);
-                /* TODO: fix irq handling on x86. For now ignore failure because
-                 * interrupts are not required & not yet fully supported */
-                if (ret) {
-                        printk(KERN_WARNING
-                               "!!!WARNING: GRU ignoring request failure!!!\n");
-                        ret = 0;
-                }
-                if (ret) {
-                        printk(KERN_ERR "%s: request_irq failed\n",
-                               GRU_DRIVER_ID_STR);
-                        goto exit1;
-                }
-        }
-
         ret = misc_register(&gru_miscdev);
         if (ret) {
                 printk(KERN_ERR "%s: misc_register failed\n",
                        GRU_DRIVER_ID_STR);
-                goto exit1;
+                goto exit0;
         }
 
         ret = gru_proc_init();
         if (ret) {
                 printk(KERN_ERR "%s: proc init failed\n", GRU_DRIVER_ID_STR);
-                goto exit2;
+                goto exit1;
         }
 
         ret = gru_init_tables(gru_start_paddr, gru_start_vaddr);
         if (ret) {
                 printk(KERN_ERR "%s: init tables failed\n", GRU_DRIVER_ID_STR);
-                goto exit3;
+                goto exit2;
         }
+
+        ret = gru_setup_tlb_irqs();
+        if (ret != 0)
+                goto exit3;
+
         gru_kservices_init();
 
         printk(KERN_INFO "%s: v%s\n", GRU_DRIVER_ID_STR,
@@ -396,31 +561,24 @@ static int __init gru_init(void)
         return 0;
 
 exit3:
-        gru_proc_exit();
+        gru_free_tables();
 exit2:
-        misc_deregister(&gru_miscdev);
+        gru_proc_exit();
 exit1:
-        for (--chip; chip >= 0; chip--)
-                free_irq(irq + chip, NULL);
+        misc_deregister(&gru_miscdev);
+exit0:
         return ret;
 
 }
 
 static void __exit gru_exit(void)
 {
-        int i, bid;
-        int order = get_order(sizeof(struct gru_state) *
-                              GRU_CHIPLETS_PER_BLADE);
-
         if (!is_uv_system())
                 return;
 
-        for (i = 0; i < GRU_CHIPLETS_PER_BLADE; i++)
-                free_irq(IRQ_GRU + i, NULL);
+        gru_teardown_tlb_irqs();
         gru_kservices_exit();
-        for (bid = 0; bid < GRU_MAX_BLADES; bid++)
-                free_pages((unsigned long)gru_base[bid], order);
-
+        gru_free_tables();
         misc_deregister(&gru_miscdev);
         gru_proc_exit();
 }
diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
index 37e7cfc53b9c..2f30badc6ffd 100644
--- a/drivers/misc/sgi-gru/gruhandles.c
+++ b/drivers/misc/sgi-gru/gruhandles.c
@@ -27,9 +27,11 @@
 #ifdef CONFIG_IA64
 #include <asm/processor.h>
 #define GRU_OPERATION_TIMEOUT   (((cycles_t) local_cpu_data->itc_freq)*10)
+#define CLKS2NSEC(c)            ((c) *1000000000 / local_cpu_data->itc_freq)
 #else
 #include <asm/tsc.h>
 #define GRU_OPERATION_TIMEOUT   ((cycles_t) tsc_khz*10*1000)
+#define CLKS2NSEC(c)            ((c) * 1000000 / tsc_khz)
 #endif
 
 /* Extract the status field from a kernel handle */
@@ -39,21 +41,39 @@ struct mcs_op_statistic mcs_op_statistics[mcsop_last];
 
 static void update_mcs_stats(enum mcs_op op, unsigned long clks)
 {
+        unsigned long nsec;
+
+        nsec = CLKS2NSEC(clks);
         atomic_long_inc(&mcs_op_statistics[op].count);
-        atomic_long_add(clks, &mcs_op_statistics[op].total);
-        if (mcs_op_statistics[op].max < clks)
-                mcs_op_statistics[op].max = clks;
+        atomic_long_add(nsec, &mcs_op_statistics[op].total);
+        if (mcs_op_statistics[op].max < nsec)
+                mcs_op_statistics[op].max = nsec;
 }
 
 static void start_instruction(void *h)
 {
         unsigned long *w0 = h;
 
-        wmb();          /* setting CMD bit must be last */
-        *w0 = *w0 | 1;
+        wmb();          /* setting CMD/STATUS bits must be last */
+        *w0 = *w0 | 0x20001;
         gru_flush_cache(h);
 }
 
+static void report_instruction_timeout(void *h)
+{
+        unsigned long goff = GSEGPOFF((unsigned long)h);
+        char *id = "???";
+
+        if (TYPE_IS(CCH, goff))
+                id = "CCH";
+        else if (TYPE_IS(TGH, goff))
+                id = "TGH";
+        else if (TYPE_IS(TFH, goff))
+                id = "TFH";
+
+        panic(KERN_ALERT "GRU %p (%s) is malfunctioning\n", h, id);
+}
+
 static int wait_instruction_complete(void *h, enum mcs_op opc)
 {
         int status;
@@ -64,9 +84,10 @@ static int wait_instruction_complete(void *h, enum mcs_op opc)
                 status = GET_MSEG_HANDLE_STATUS(h);
                 if (status != CCHSTATUS_ACTIVE)
                         break;
-                if (GRU_OPERATION_TIMEOUT < (get_cycles() - start_time))
-                        panic("GRU %p is malfunctioning: start %ld, end %ld\n",
-                              h, start_time, (unsigned long)get_cycles());
+                if (GRU_OPERATION_TIMEOUT < (get_cycles() - start_time)) {
+                        report_instruction_timeout(h);
+                        start_time = get_cycles();
+                }
         }
         if (gru_options & OPT_STATS)
                 update_mcs_stats(opc, get_cycles() - start_time);
@@ -75,9 +96,18 @@ static int wait_instruction_complete(void *h, enum mcs_op opc)
 
 int cch_allocate(struct gru_context_configuration_handle *cch)
 {
+        int ret;
+
         cch->opc = CCHOP_ALLOCATE;
         start_instruction(cch);
-        return wait_instruction_complete(cch, cchop_allocate);
+        ret = wait_instruction_complete(cch, cchop_allocate);
+
+        /*
+         * Stop speculation into the GSEG being mapped by the previous ALLOCATE.
+         * The GSEG memory does not exist until the ALLOCATE completes.
+         */
+        sync_core();
+        return ret;
 }
 
 int cch_start(struct gru_context_configuration_handle *cch)
@@ -96,9 +126,18 @@ int cch_interrupt(struct gru_context_configuration_handle *cch)
 
 int cch_deallocate(struct gru_context_configuration_handle *cch)
 {
+        int ret;
+
         cch->opc = CCHOP_DEALLOCATE;
         start_instruction(cch);
-        return wait_instruction_complete(cch, cchop_deallocate);
+        ret = wait_instruction_complete(cch, cchop_deallocate);
+
+        /*
+         * Stop speculation into the GSEG being unmapped by the previous
+         * DEALLOCATE.
+         */
+        sync_core();
+        return ret;
 }
 
 int cch_interrupt_sync(struct gru_context_configuration_handle
@@ -126,17 +165,20 @@ int tgh_invalidate(struct gru_tlb_global_handle *tgh,
         return wait_instruction_complete(tgh, tghop_invalidate);
 }
 
-void tfh_write_only(struct gru_tlb_fault_handle *tfh,
-                                  unsigned long pfn, unsigned long vaddr,
-                                  int asid, int dirty, int pagesize)
+int tfh_write_only(struct gru_tlb_fault_handle *tfh,
+                                  unsigned long paddr, int gaa,
+                                  unsigned long vaddr, int asid, int dirty,
+                                  int pagesize)
 {
         tfh->fillasid = asid;
         tfh->fillvaddr = vaddr;
-        tfh->pfn = pfn;
+        tfh->pfn = paddr >> GRU_PADDR_SHIFT;
+        tfh->gaa = gaa;
         tfh->dirty = dirty;
         tfh->pagesize = pagesize;
         tfh->opc = TFHOP_WRITE_ONLY;
         start_instruction(tfh);
+        return wait_instruction_complete(tfh, tfhop_write_only);
 }
 
 void tfh_write_restart(struct gru_tlb_fault_handle *tfh,
diff --git a/drivers/misc/sgi-gru/gruhandles.h b/drivers/misc/sgi-gru/gruhandles.h
index f44112242d00..3f998b924d8f 100644
--- a/drivers/misc/sgi-gru/gruhandles.h
+++ b/drivers/misc/sgi-gru/gruhandles.h
@@ -91,6 +91,12 @@
 /* Convert an arbitrary handle address to the beginning of the GRU segment */
 #define GRUBASE(h)              ((void *)((unsigned long)(h) & ~(GRU_SIZE - 1)))
 
+/* Test a valid handle address to determine the type */
+#define TYPE_IS(hn, h)          ((h) >= GRU_##hn##_BASE && (h) <        \
+                GRU_##hn##_BASE + GRU_NUM_##hn * GRU_HANDLE_STRIDE &&   \
+                (((h) & (GRU_HANDLE_STRIDE - 1)) == 0))
+
+
 /* General addressing macros. */
 static inline void *get_gseg_base_address(void *base, int ctxnum)
 {
@@ -158,6 +164,16 @@ static inline void *gru_chiplet_vaddr(void *vaddr, int pnode, int chiplet)
         return vaddr + GRU_SIZE * (2 * pnode  + chiplet);
 }
 
+static inline struct gru_control_block_extended *gru_tfh_to_cbe(
+                                        struct gru_tlb_fault_handle *tfh)
+{
+        unsigned long cbe;
+
+        cbe = (unsigned long)tfh - GRU_TFH_BASE + GRU_CBE_BASE;
+        return (struct gru_control_block_extended*)cbe;
+}
+
+
 
 
 /*
@@ -236,6 +252,17 @@ enum gru_tgh_state {
         TGHSTATE_RESTART_CTX,
 };
 
+enum gru_tgh_cause {
+        TGHCAUSE_RR_ECC,
+        TGHCAUSE_TLB_ECC,
+        TGHCAUSE_LRU_ECC,
+        TGHCAUSE_PS_ECC,
+        TGHCAUSE_MUL_ERR,
+        TGHCAUSE_DATA_ERR,
+        TGHCAUSE_SW_FORCE
+};
+
+
 /*
  * TFH - TLB Global Handle
  *      Used for TLB dropins into the GRU TLB.
@@ -440,6 +467,12 @@ struct gru_control_block_extended {
         unsigned int cbrexecstatus:8;
 };
 
+/* CBE fields for active BCOPY instructions */
+#define cbe_baddr0      idef1upd
+#define cbe_baddr1      idef3upd
+#define cbe_src_cl      idef6cpy
+#define cbe_nelemcur    idef5upd
+
 enum gru_cbr_state {
         CBRSTATE_INACTIVE,
         CBRSTATE_IDLE,
@@ -487,8 +520,8 @@ int cch_interrupt_sync(struct gru_context_configuration_handle *cch);
 int tgh_invalidate(struct gru_tlb_global_handle *tgh, unsigned long vaddr,
         unsigned long vaddrmask, int asid, int pagesize, int global, int n,
         unsigned short ctxbitmap);
-void tfh_write_only(struct gru_tlb_fault_handle *tfh, unsigned long pfn,
-        unsigned long vaddr, int asid, int dirty, int pagesize);
+int tfh_write_only(struct gru_tlb_fault_handle *tfh, unsigned long paddr,
+        int gaa, unsigned long vaddr, int asid, int dirty, int pagesize);
 void tfh_write_restart(struct gru_tlb_fault_handle *tfh, unsigned long paddr,
         int gaa, unsigned long vaddr, int asid, int dirty, int pagesize);
 void tfh_restart(struct gru_tlb_fault_handle *tfh);
diff --git a/drivers/misc/sgi-gru/grukdump.c b/drivers/misc/sgi-gru/grukdump.c
index 55eabfa85585..9b2062d17327 100644
--- a/drivers/misc/sgi-gru/grukdump.c
+++ b/drivers/misc/sgi-gru/grukdump.c
@@ -44,7 +44,8 @@ static int gru_user_copy_handle(void __user **dp, void *s)
 
 static int gru_dump_context_data(void *grubase,
                         struct gru_context_configuration_handle *cch,
-                        void __user *ubuf, int ctxnum, int dsrcnt)
+                        void __user *ubuf, int ctxnum, int dsrcnt,
+                        int flush_cbrs)
 {
         void *cb, *cbe, *tfh, *gseg;
         int i, scr;
@@ -55,6 +56,8 @@ static int gru_dump_context_data(void *grubase,
         tfh = grubase + GRU_TFH_BASE;
 
         for_each_cbr_in_allocation_map(i, &cch->cbr_allocation_map, scr) {
+                if (flush_cbrs)
+                        gru_flush_cache(cb);
                 if (gru_user_copy_handle(&ubuf, cb))
                         goto fail;
                 if (gru_user_copy_handle(&ubuf, tfh + i * GRU_HANDLE_STRIDE))
@@ -115,7 +118,7 @@ fail:
 
 static int gru_dump_context(struct gru_state *gru, int ctxnum,
                 void __user *ubuf, void __user *ubufend, char data_opt,
-                char lock_cch)
+                char lock_cch, char flush_cbrs)
 {
         struct gru_dump_context_header hdr;
         struct gru_dump_context_header __user *uhdr = ubuf;
@@ -159,8 +162,7 @@ static int gru_dump_context(struct gru_state *gru, int ctxnum,
                         ret = -EFBIG;
                 else
                         ret = gru_dump_context_data(grubase, cch, ubuf, ctxnum,
-                                                        dsrcnt);
-
+                                                        dsrcnt, flush_cbrs);
         }
         if (cch_locked)
                 unlock_cch_handle(cch);
@@ -215,7 +217,8 @@ int gru_dump_chiplet_request(unsigned long arg)
         for (ctxnum = 0; ctxnum < GRU_NUM_CCH; ctxnum++) {
                 if (req.ctxnum == ctxnum || req.ctxnum < 0) {
                         ret = gru_dump_context(gru, ctxnum, ubuf, ubufend,
-                                                req.data_opt, req.lock_cch);
+                                                req.data_opt, req.lock_cch,
+                                                req.flush_cbrs);
                         if (ret < 0)
                                 goto fail;
                         ubuf += ret;
diff --git a/drivers/misc/sgi-gru/grukservices.c b/drivers/misc/sgi-gru/grukservices.c
index 766e21e15574..34749ee88dfa 100644
--- a/drivers/misc/sgi-gru/grukservices.c
+++ b/drivers/misc/sgi-gru/grukservices.c
@@ -31,6 +31,7 @@
 #include <linux/interrupt.h>
 #include <linux/uaccess.h>
 #include <linux/delay.h>
+#include <asm/io_apic.h>
 #include "gru.h"
 #include "grulib.h"
 #include "grutables.h"
@@ -97,9 +98,6 @@
 #define ASYNC_HAN_TO_BID(h)     ((h) - 1)
 #define ASYNC_BID_TO_HAN(b)     ((b) + 1)
 #define ASYNC_HAN_TO_BS(h)      gru_base[ASYNC_HAN_TO_BID(h)]
-#define KCB_TO_GID(cb)          ((cb - gru_start_vaddr) /               \
-                                        (GRU_SIZE * GRU_CHIPLETS_PER_BLADE))
-#define KCB_TO_BS(cb)           gru_base[KCB_TO_GID(cb)]
 
 #define GRU_NUM_KERNEL_CBR      1
 #define GRU_NUM_KERNEL_DSR_BYTES 256
@@ -160,8 +158,10 @@ static void gru_load_kernel_context(struct gru_blade_state *bs, int blade_id)
         up_read(&bs->bs_kgts_sema);
         down_write(&bs->bs_kgts_sema);
 
-        if (!bs->bs_kgts)
-                bs->bs_kgts = gru_alloc_gts(NULL, 0, 0, 0, 0);
+        if (!bs->bs_kgts) {
+                bs->bs_kgts = gru_alloc_gts(NULL, 0, 0, 0, 0, 0);
+                bs->bs_kgts->ts_user_blade_id = blade_id;
+        }
         kgts = bs->bs_kgts;
 
         if (!kgts->ts_gru) {
@@ -172,9 +172,9 @@ static void gru_load_kernel_context(struct gru_blade_state *bs, int blade_id)
                 kgts->ts_dsr_au_count = GRU_DS_BYTES_TO_AU(
                         GRU_NUM_KERNEL_DSR_BYTES * ncpus +
                                 bs->bs_async_dsr_bytes);
-                while (!gru_assign_gru_context(kgts, blade_id)) {
+                while (!gru_assign_gru_context(kgts)) {
                         msleep(1);
-                        gru_steal_context(kgts, blade_id);
+                        gru_steal_context(kgts);
                 }
                 gru_load_context(kgts);
                 gru = bs->bs_kgts->ts_gru;
@@ -200,13 +200,15 @@ static int gru_free_kernel_contexts(void)
                 bs = gru_base[bid];
                 if (!bs)
                         continue;
+
+                /* Ignore busy contexts. Don't want to block here.  */
                 if (down_write_trylock(&bs->bs_kgts_sema)) {
                         kgts = bs->bs_kgts;
                         if (kgts && kgts->ts_gru)
                                 gru_unload_context(kgts, 0);
-                        kfree(kgts);
                         bs->bs_kgts = NULL;
                         up_write(&bs->bs_kgts_sema);
+                        kfree(kgts);
                 } else {
                         ret++;
                 }
@@ -220,13 +222,21 @@ static int gru_free_kernel_contexts(void)
 static struct gru_blade_state *gru_lock_kernel_context(int blade_id)
 {
         struct gru_blade_state *bs;
+        int bid;
 
         STAT(lock_kernel_context);
-        bs = gru_base[blade_id];
+again:
+        bid = blade_id < 0 ? uv_numa_blade_id() : blade_id;
+        bs = gru_base[bid];
 
+        /* Handle the case where migration occured while waiting for the sema */
         down_read(&bs->bs_kgts_sema);
+        if (blade_id < 0 && bid != uv_numa_blade_id()) {
+                up_read(&bs->bs_kgts_sema);
+                goto again;
+        }
         if (!bs->bs_kgts || !bs->bs_kgts->ts_gru)
-                gru_load_kernel_context(bs, blade_id);
+                gru_load_kernel_context(bs, bid);
         return bs;
 
 }
@@ -255,7 +265,7 @@ static int gru_get_cpu_resources(int dsr_bytes, void **cb, void **dsr)
 
         BUG_ON(dsr_bytes > GRU_NUM_KERNEL_DSR_BYTES);
         preempt_disable();
-        bs = gru_lock_kernel_context(uv_numa_blade_id());
+        bs = gru_lock_kernel_context(-1);
         lcpu = uv_blade_processor_id();
         *cb = bs->kernel_cb + lcpu * GRU_HANDLE_STRIDE;
         *dsr = bs->kernel_dsr + lcpu * GRU_NUM_KERNEL_DSR_BYTES;
@@ -384,13 +394,31 @@ int gru_get_cb_exception_detail(void *cb,
                 struct control_block_extended_exc_detail *excdet)
 {
         struct gru_control_block_extended *cbe;
-        struct gru_blade_state *bs;
-        int cbrnum;
-
-        bs = KCB_TO_BS(cb);
-        cbrnum = thread_cbr_number(bs->bs_kgts, get_cb_number(cb));
+        struct gru_thread_state *kgts = NULL;
+        unsigned long off;
+        int cbrnum, bid;
+
+        /*
+         * Locate kgts for cb. This algorithm is SLOW but
+         * this function is rarely called (ie., almost never).
+         * Performance does not matter.
+         */
+        for_each_possible_blade(bid) {
+                if (!gru_base[bid])
+                        break;
+                kgts = gru_base[bid]->bs_kgts;
+                if (!kgts || !kgts->ts_gru)
+                        continue;
+                off = cb - kgts->ts_gru->gs_gru_base_vaddr;
+                if (off < GRU_SIZE)
+                        break;
+                kgts = NULL;
+        }
+        BUG_ON(!kgts);
+        cbrnum = thread_cbr_number(kgts, get_cb_number(cb));
         cbe = get_cbe(GRUBASE(cb), cbrnum);
         gru_flush_cache(cbe);   /* CBE not coherent */
+        sync_core();
         excdet->opc = cbe->opccpy;
         excdet->exopc = cbe->exopccpy;
         excdet->ecause = cbe->ecause;
@@ -409,8 +437,8 @@ char *gru_get_cb_exception_detail_str(int ret, void *cb,
         if (ret > 0 && gen->istatus == CBS_EXCEPTION) {
                 gru_get_cb_exception_detail(cb, &excdet);
                 snprintf(buf, size,
-                        "GRU exception: cb %p, opc %d, exopc %d, ecause 0x%x,"
-                        "excdet0 0x%lx, excdet1 0x%x",
+                        "GRU:%d exception: cb %p, opc %d, exopc %d, ecause 0x%x,"
+                        "excdet0 0x%lx, excdet1 0x%x", smp_processor_id(),
                         gen, excdet.opc, excdet.exopc, excdet.ecause,
                         excdet.exceptdet0, excdet.exceptdet1);
         } else {
@@ -457,9 +485,10 @@ int gru_check_status_proc(void *cb)
         int ret;
 
         ret = gen->istatus;
-        if (ret != CBS_EXCEPTION)
-                return ret;
-        return gru_retry_exception(cb);
+        if (ret == CBS_EXCEPTION)
+                ret = gru_retry_exception(cb);
+        rmb();
+        return ret;
 
 }
 
@@ -471,7 +500,7 @@ int gru_wait_proc(void *cb)
         ret = gru_wait_idle_or_exception(gen);
         if (ret == CBS_EXCEPTION)
                 ret = gru_retry_exception(cb);
-
+        rmb();
         return ret;
 }
 
@@ -538,7 +567,7 @@ int gru_create_message_queue(struct gru_message_queue_desc *mqd,
         mqd->mq = mq;
         mqd->mq_gpa = uv_gpa(mq);
         mqd->qlines = qlines;
-        mqd->interrupt_pnode = UV_NASID_TO_PNODE(nasid);
+        mqd->interrupt_pnode = nasid >> 1;
         mqd->interrupt_vector = vector;
         mqd->interrupt_apicid = apicid;
         return 0;
@@ -598,6 +627,8 @@ static int send_noop_message(void *cb, struct gru_message_queue_desc *mqd,
                                 ret = MQE_UNEXPECTED_CB_ERR;
                         break;
                 case CBSS_PAGE_OVERFLOW:
+                        STAT(mesq_noop_page_overflow);
+                        /* fallthru */
                 default:
                         BUG();
                 }
@@ -673,18 +704,6 @@ cberr:
 }
 
 /*
- * Send a cross-partition interrupt to the SSI that contains the target
- * message queue. Normally, the interrupt is automatically delivered by hardware
- * but some error conditions require explicit delivery.
- */
-static void send_message_queue_interrupt(struct gru_message_queue_desc *mqd)
-{
-        if (mqd->interrupt_vector)
-                uv_hub_send_ipi(mqd->interrupt_pnode, mqd->interrupt_apicid,
-                                mqd->interrupt_vector);
-}
-
-/*
  * Handle a PUT failure. Note: if message was a 2-line message, one of the
  * lines might have successfully have been written. Before sending the
  * message, "present" must be cleared in BOTH lines to prevent the receiver
@@ -693,7 +712,8 @@ static void send_message_queue_interrupt(struct gru_message_queue_desc *mqd)
 static int send_message_put_nacked(void *cb, struct gru_message_queue_desc *mqd,
                         void *mesg, int lines)
 {
-        unsigned long m;
+        unsigned long m, *val = mesg, gpa, save;
+        int ret;
 
         m = mqd->mq_gpa + (gru_get_amo_value_head(cb) << 6);
         if (lines == 2) {
@@ -704,7 +724,26 @@ static int send_message_put_nacked(void *cb, struct gru_message_queue_desc *mqd,
         gru_vstore(cb, m, gru_get_tri(mesg), XTYPE_CL, lines, 1, IMA);
         if (gru_wait(cb) != CBS_IDLE)
                 return MQE_UNEXPECTED_CB_ERR;
-        send_message_queue_interrupt(mqd);
+
+        if (!mqd->interrupt_vector)
+                return MQE_OK;
+
+        /*
+         * Send a cross-partition interrupt to the SSI that contains the target
+         * message queue. Normally, the interrupt is automatically delivered by
+         * hardware but some error conditions require explicit delivery.
+         * Use the GRU to deliver the interrupt. Otherwise partition failures
+         * could cause unrecovered errors.
+         */
+        gpa = uv_global_gru_mmr_address(mqd->interrupt_pnode, UVH_IPI_INT);
+        save = *val;
+        *val = uv_hub_ipi_value(mqd->interrupt_apicid, mqd->interrupt_vector,
+                                dest_Fixed);
+        gru_vstore_phys(cb, gpa, gru_get_tri(mesg), IAA_REGISTER, IMA);
+        ret = gru_wait(cb);
+        *val = save;
+        if (ret != CBS_IDLE)
+                return MQE_UNEXPECTED_CB_ERR;
         return MQE_OK;
 }
 
@@ -739,6 +778,9 @@ static int send_message_failure(void *cb, struct gru_message_queue_desc *mqd,
                 STAT(mesq_send_put_nacked);
                 ret = send_message_put_nacked(cb, mqd, mesg, lines);
                 break;
+        case CBSS_PAGE_OVERFLOW:
+                STAT(mesq_page_overflow);
+                /* fallthru */
         default:
                 BUG();
         }
@@ -831,7 +873,6 @@ void *gru_get_next_message(struct gru_message_queue_desc *mqd)
         int present = mhdr->present;
 
         /* skip NOOP messages */
-        STAT(mesq_receive);
         while (present == MQS_NOOP) {
                 gru_free_message(mqd, mhdr);
                 mhdr = mq->next;
@@ -851,6 +892,7 @@ void *gru_get_next_message(struct gru_message_queue_desc *mqd)
         if (mhdr->lines == 2)
                 restore_present2(mhdr, mhdr->present2);
 
+        STAT(mesq_receive);
         return mhdr;
 }
 EXPORT_SYMBOL_GPL(gru_get_next_message);
@@ -858,6 +900,29 @@ EXPORT_SYMBOL_GPL(gru_get_next_message);
 /* ---------------------- GRU DATA COPY FUNCTIONS ---------------------------*/
 
 /*
+ * Load a DW from a global GPA. The GPA can be a memory or MMR address.
+ */
+int gru_read_gpa(unsigned long *value, unsigned long gpa)
+{
+        void *cb;
+        void *dsr;
+        int ret, iaa;
+
+        STAT(read_gpa);
+        if (gru_get_cpu_resources(GRU_NUM_KERNEL_DSR_BYTES, &cb, &dsr))
+                return MQE_BUG_NO_RESOURCES;
+        iaa = gpa >> 62;
+        gru_vload_phys(cb, gpa, gru_get_tri(dsr), iaa, IMA);
+        ret = gru_wait(cb);
+        if (ret == CBS_IDLE)
+                *value = *(unsigned long *)dsr;
+        gru_free_cpu_resources(cb, dsr);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(gru_read_gpa);
+
+
+/*
  * Copy a block of data using the GRU resources
  */
 int gru_copy_gpa(unsigned long dest_gpa, unsigned long src_gpa,
@@ -898,24 +963,24 @@ static int quicktest0(unsigned long arg)
 
         gru_vload(cb, uv_gpa(&word0), gru_get_tri(dsr), XTYPE_DW, 1, 1, IMA);
         if (gru_wait(cb) != CBS_IDLE) {
-                printk(KERN_DEBUG "GRU quicktest0: CBR failure 1\n");
+                printk(KERN_DEBUG "GRU:%d quicktest0: CBR failure 1\n", smp_processor_id());
                 goto done;
         }
 
         if (*p != MAGIC) {
-                printk(KERN_DEBUG "GRU: quicktest0 bad magic 0x%lx\n", *p);
+                printk(KERN_DEBUG "GRU:%d quicktest0 bad magic 0x%lx\n", smp_processor_id(), *p);
                 goto done;
         }
         gru_vstore(cb, uv_gpa(&word1), gru_get_tri(dsr), XTYPE_DW, 1, 1, IMA);
         if (gru_wait(cb) != CBS_IDLE) {
-                printk(KERN_DEBUG "GRU quicktest0: CBR failure 2\n");
+                printk(KERN_DEBUG "GRU:%d quicktest0: CBR failure 2\n", smp_processor_id());
                 goto done;
         }
 
         if (word0 != word1 || word1 != MAGIC) {
                 printk(KERN_DEBUG
-                       "GRU quicktest0 err: found 0x%lx, expected 0x%lx\n",
-                     word1, MAGIC);
+                       "GRU:%d quicktest0 err: found 0x%lx, expected 0x%lx\n",
+                     smp_processor_id(), word1, MAGIC);
                 goto done;
         }
         ret = 0;
@@ -952,8 +1017,11 @@ static int quicktest1(unsigned long arg)
                 if (ret)
                         break;
         }
-        if (ret != MQE_QUEUE_FULL || i != 4)
+        if (ret != MQE_QUEUE_FULL || i != 4) {
+                printk(KERN_DEBUG "GRU:%d quicktest1: unexpect status %d, i %d\n",
+                       smp_processor_id(), ret, i);
                 goto done;
+        }
 
         for (i = 0; i < 6; i++) {
                 m = gru_get_next_message(&mqd);
@@ -961,7 +1029,12 @@ static int quicktest1(unsigned long arg)
                         break;
                 gru_free_message(&mqd, m);
         }
-        ret = (i == 4) ? 0 : -EIO;
+        if (i != 4) {
+                printk(KERN_DEBUG "GRU:%d quicktest2: bad message, i %d, m %p, m8 %d\n",
+                        smp_processor_id(), i, m, m ? m[8] : -1);
+                goto done;
+        }
+        ret = 0;
 
 done:
         kfree(p);
@@ -977,6 +1050,7 @@ static int quicktest2(unsigned long arg)
         int ret = 0;
         unsigned long *buf;
         void *cb0, *cb;
+        struct gru_control_block_status *gen;
         int i, k, istatus, bytes;
 
         bytes = numcb * 4 * 8;
@@ -996,20 +1070,30 @@ static int quicktest2(unsigned long arg)
                                 XTYPE_DW, 4, 1, IMA_INTERRUPT);
 
         ret = 0;
-        for (k = 0; k < numcb; k++) {
+        k = numcb;
+        do {
                 gru_wait_async_cbr(han);
                 for (i = 0; i < numcb; i++) {
                         cb = cb0 + i * GRU_HANDLE_STRIDE;
                         istatus = gru_check_status(cb);
-                        if (istatus == CBS_ACTIVE)
-                                continue;
-                        if (istatus == CBS_EXCEPTION)
-                                ret = -EFAULT;
-                        else if (buf[i] || buf[i + 1] || buf[i + 2] ||
-                                        buf[i + 3])
-                                ret = -EIO;
+                        if (istatus != CBS_ACTIVE && istatus != CBS_CALL_OS)
+                                break;
                 }
-        }
+                if (i == numcb)
+                        continue;
+                if (istatus != CBS_IDLE) {
+                        printk(KERN_DEBUG "GRU:%d quicktest2: cb %d, exception\n", smp_processor_id(), i);
+                        ret = -EFAULT;
+                } else if (buf[4 * i] || buf[4 * i + 1] || buf[4 * i + 2] ||
+                                buf[4 * i + 3]) {
+                        printk(KERN_DEBUG "GRU:%d quicktest2:cb %d,  buf 0x%lx, 0x%lx, 0x%lx, 0x%lx\n",
+                               smp_processor_id(), i, buf[4 * i], buf[4 * i + 1], buf[4 * i + 2], buf[4 * i + 3]);
+                        ret = -EIO;
+                }
+                k--;
+                gen = cb;
+                gen->istatus = CBS_CALL_OS; /* don't handle this CBR again */
+        } while (k);
         BUG_ON(cmp.done);
 
         gru_unlock_async_resource(han);
@@ -1019,6 +1103,22 @@ done:
         return ret;
 }
 
+#define BUFSIZE 200
+static int quicktest3(unsigned long arg)
+{
+        char buf1[BUFSIZE], buf2[BUFSIZE];
+        int ret = 0;
+
+        memset(buf2, 0, sizeof(buf2));
+        memset(buf1, get_cycles() & 255, sizeof(buf1));
+        gru_copy_gpa(uv_gpa(buf2), uv_gpa(buf1), BUFSIZE);
+        if (memcmp(buf1, buf2, BUFSIZE)) {
+                printk(KERN_DEBUG "GRU:%d quicktest3 error\n", smp_processor_id());
+                ret = -EIO;
+        }
+        return ret;
+}
+
 /*
  * Debugging only. User hook for various kernel tests
  * of driver & gru.
@@ -1037,6 +1137,9 @@ int gru_ktest(unsigned long arg)
         case 2:
                 ret = quicktest2(arg);
                 break;
+        case 3:
+                ret = quicktest3(arg);
+                break;
         case 99:
                 ret = gru_free_kernel_contexts();
                 break;
diff --git a/drivers/misc/sgi-gru/grukservices.h b/drivers/misc/sgi-gru/grukservices.h
index d60d34bca44d..02aa94d8484a 100644
--- a/drivers/misc/sgi-gru/grukservices.h
+++ b/drivers/misc/sgi-gru/grukservices.h
@@ -131,6 +131,20 @@ extern void *gru_get_next_message(struct gru_message_queue_desc *mqd);
 
 
 /*
+ * Read a GRU global GPA. Source can be located in a remote partition.
+ *
+ *    Input:
+ *      value           memory address where MMR value is returned
+ *      gpa             source numalink physical address of GPA
+ *
+ *    Output:
+ *      0               OK
+ *      >0              error
+ */
+int gru_read_gpa(unsigned long *value, unsigned long gpa);
+
+
+/*
  * Copy data using the GRU. Source or destination can be located in a remote
  * partition.
  *
diff --git a/drivers/misc/sgi-gru/grulib.h b/drivers/misc/sgi-gru/grulib.h
index 889bc442a3e8..e77d1b1f9d05 100644
--- a/drivers/misc/sgi-gru/grulib.h
+++ b/drivers/misc/sgi-gru/grulib.h
@@ -63,18 +63,9 @@
 #define THREAD_POINTER(p, th)           (p + GRU_GSEG_PAGESIZE * (th))
 #define GSEG_START(cb)                  ((void *)((unsigned long)(cb) & ~(GRU_GSEG_PAGESIZE - 1)))
 
-/*
- * Statictics kept on a per-GTS basis.
- */
-struct gts_statistics {
-        unsigned long   fmm_tlbdropin;
-        unsigned long   upm_tlbdropin;
-        unsigned long   context_stolen;
-};
-
 struct gru_get_gseg_statistics_req {
-        unsigned long           gseg;
-        struct gts_statistics   stats;
+        unsigned long                   gseg;
+        struct gru_gseg_statistics      stats;
 };
 
 /*
@@ -86,6 +77,7 @@ struct gru_create_context_req {
         unsigned int            control_blocks;
         unsigned int            maximum_thread_count;
         unsigned int            options;
+        unsigned char           tlb_preload_count;
 };
 
 /*
@@ -98,11 +90,12 @@ struct gru_unload_context_req {
 /*
  * Structure used to set context options
  */
-enum {sco_gseg_owner, sco_cch_req_slice};
+enum {sco_gseg_owner, sco_cch_req_slice, sco_blade_chiplet};
 struct gru_set_context_option_req {
         unsigned long   gseg;
         int             op;
-        unsigned long   val1;
+        int             val0;
+        long            val1;
 };
 
 /*
@@ -124,6 +117,8 @@ struct gru_dump_chiplet_state_req {
         int             ctxnum;
         char            data_opt;
         char            lock_cch;
+        char            flush_cbrs;
+        char            fill[10];
         pid_t           pid;
         void            *buf;
         size_t          buflen;
diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c
index 3bc643dad606..f8538bbd0bfa 100644
--- a/drivers/misc/sgi-gru/grumain.c
+++ b/drivers/misc/sgi-gru/grumain.c
@@ -27,6 +27,7 @@
 #include <linux/sched.h>
 #include <linux/device.h>
 #include <linux/list.h>
+#include <linux/err.h>
 #include <asm/uv/uv_hub.h>
 #include "gru.h"
 #include "grutables.h"
@@ -48,12 +49,20 @@ struct device *grudev = &gru_device;
 /*
  * Select a gru fault map to be used by the current cpu. Note that
  * multiple cpus may be using the same map.
- *      ZZZ should "shift" be used?? Depends on HT cpu numbering
  *      ZZZ should be inline but did not work on emulator
  */
 int gru_cpu_fault_map_id(void)
 {
+#ifdef CONFIG_IA64
         return uv_blade_processor_id() % GRU_NUM_TFM;
+#else
+        int cpu = smp_processor_id();
+        int id, core;
+
+        core = uv_cpu_core_number(cpu);
+        id = core + UV_MAX_INT_CORES * uv_cpu_socket_number(cpu);
+        return id;
+#endif
 }
 
 /*--------- ASID Management -------------------------------------------
@@ -286,7 +295,8 @@ static void gru_unload_mm_tracker(struct gru_state *gru,
 void gts_drop(struct gru_thread_state *gts)
 {
         if (gts && atomic_dec_return(&gts->ts_refcnt) == 0) {
-                gru_drop_mmu_notifier(gts->ts_gms);
+                if (gts->ts_gms)
+                        gru_drop_mmu_notifier(gts->ts_gms);
                 kfree(gts);
                 STAT(gts_free);
         }
@@ -310,16 +320,18 @@ static struct gru_thread_state *gru_find_current_gts_nolock(struct gru_vma_data
  * Allocate a thread state structure.
  */
 struct gru_thread_state *gru_alloc_gts(struct vm_area_struct *vma,
-                int cbr_au_count, int dsr_au_count, int options, int tsid)
+                int cbr_au_count, int dsr_au_count,
+                unsigned char tlb_preload_count, int options, int tsid)
 {
         struct gru_thread_state *gts;
+        struct gru_mm_struct *gms;
         int bytes;
 
         bytes = DSR_BYTES(dsr_au_count) + CBR_BYTES(cbr_au_count);
         bytes += sizeof(struct gru_thread_state);
         gts = kmalloc(bytes, GFP_KERNEL);
         if (!gts)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         STAT(gts_alloc);
         memset(gts, 0, sizeof(struct gru_thread_state)); /* zero out header */
@@ -327,7 +339,10 @@ struct gru_thread_state *gru_alloc_gts(struct vm_area_struct *vma,
         mutex_init(&gts->ts_ctxlock);
         gts->ts_cbr_au_count = cbr_au_count;
         gts->ts_dsr_au_count = dsr_au_count;
+        gts->ts_tlb_preload_count = tlb_preload_count;
         gts->ts_user_options = options;
+        gts->ts_user_blade_id = -1;
+        gts->ts_user_chiplet_id = -1;
         gts->ts_tsid = tsid;
         gts->ts_ctxnum = NULLCTX;
         gts->ts_tlb_int_select = -1;
@@ -336,9 +351,10 @@ struct gru_thread_state *gru_alloc_gts(struct vm_area_struct *vma,
         if (vma) {
                 gts->ts_mm = current->mm;
                 gts->ts_vma = vma;
-                gts->ts_gms = gru_register_mmu_notifier();
-                if (!gts->ts_gms)
+                gms = gru_register_mmu_notifier();
+                if (IS_ERR(gms))
                         goto err;
+                gts->ts_gms = gms;
         }
 
         gru_dbg(grudev, "alloc gts %p\n", gts);
@@ -346,7 +362,7 @@ struct gru_thread_state *gru_alloc_gts(struct vm_area_struct *vma,
 
 err:
         gts_drop(gts);
-        return NULL;
+        return ERR_CAST(gms);
 }
 
 /*
@@ -360,6 +376,7 @@ struct gru_vma_data *gru_alloc_vma_data(struct vm_area_struct *vma, int tsid)
         if (!vdata)
                 return NULL;
 
+        STAT(vdata_alloc);
         INIT_LIST_HEAD(&vdata->vd_head);
         spin_lock_init(&vdata->vd_lock);
         gru_dbg(grudev, "alloc vdata %p\n", vdata);
@@ -392,10 +409,12 @@ struct gru_thread_state *gru_alloc_thread_state(struct vm_area_struct *vma,
         struct gru_vma_data *vdata = vma->vm_private_data;
         struct gru_thread_state *gts, *ngts;
 
-        gts = gru_alloc_gts(vma, vdata->vd_cbr_au_count, vdata->vd_dsr_au_count,
+        gts = gru_alloc_gts(vma, vdata->vd_cbr_au_count,
+                            vdata->vd_dsr_au_count,
+                            vdata->vd_tlb_preload_count,
                             vdata->vd_user_options, tsid);
-        if (!gts)
-                return NULL;
+        if (IS_ERR(gts))
+                return gts;
 
         spin_lock(&vdata->vd_lock);
         ngts = gru_find_current_gts_nolock(vdata, tsid);
@@ -493,6 +512,9 @@ static void gru_load_context_data(void *save, void *grubase, int ctxnum,
                         memset(cbe + i * GRU_HANDLE_STRIDE, 0,
                                                 GRU_CACHE_LINE_BYTES);
                 }
+                /* Flush CBE to hide race in context restart */
+                mb();
+                gru_flush_cache(cbe + i * GRU_HANDLE_STRIDE);
                 cb += GRU_HANDLE_STRIDE;
         }
 
@@ -513,6 +535,12 @@ static void gru_unload_context_data(void *save, void *grubase, int ctxnum,
         cb = gseg + GRU_CB_BASE;
         cbe = grubase + GRU_CBE_BASE;
         length = hweight64(dsrmap) * GRU_DSR_AU_BYTES;
+
+        /* CBEs may not be coherent. Flush them from cache */
+        for_each_cbr_in_allocation_map(i, &cbrmap, scr)
+                gru_flush_cache(cbe + i * GRU_HANDLE_STRIDE);
+        mb();           /* Let the CL flush complete */
+
         gru_prefetch_context(gseg, cb, cbe, cbrmap, length);
 
         for_each_cbr_in_allocation_map(i, &cbrmap, scr) {
@@ -533,7 +561,8 @@ void gru_unload_context(struct gru_thread_state *gts, int savestate)
                 zap_vma_ptes(gts->ts_vma, UGRUADDR(gts), GRU_GSEG_PAGESIZE);
         cch = get_cch(gru->gs_gru_base_vaddr, ctxnum);
 
-        gru_dbg(grudev, "gts %p\n", gts);
+        gru_dbg(grudev, "gts %p, cbrmap 0x%lx, dsrmap 0x%lx\n",
+                gts, gts->ts_cbr_map, gts->ts_dsr_map);
         lock_cch_handle(cch);
         if (cch_interrupt_sync(cch))
                 BUG();
@@ -549,7 +578,6 @@ void gru_unload_context(struct gru_thread_state *gts, int savestate)
 
         if (cch_deallocate(cch))
                 BUG();
-        gts->ts_force_unload = 0;       /* ts_force_unload locked by CCH lock */
         unlock_cch_handle(cch);
 
         gru_free_gru_context(gts);
@@ -565,9 +593,7 @@ void gru_load_context(struct gru_thread_state *gts)
         struct gru_context_configuration_handle *cch;
         int i, err, asid, ctxnum = gts->ts_ctxnum;
 
-        gru_dbg(grudev, "gts %p\n", gts);
         cch = get_cch(gru->gs_gru_base_vaddr, ctxnum);
-
         lock_cch_handle(cch);
         cch->tfm_fault_bit_enable =
             (gts->ts_user_options == GRU_OPT_MISS_FMM_POLL
@@ -591,6 +617,7 @@ void gru_load_context(struct gru_thread_state *gts)
                 cch->unmap_enable = 1;
                 cch->tfm_done_bit_enable = 1;
                 cch->cb_int_enable = 1;
+                cch->tlb_int_select = 0;        /* For now, ints go to cpu 0 */
         } else {
                 cch->unmap_enable = 0;
                 cch->tfm_done_bit_enable = 0;
@@ -616,17 +643,18 @@ void gru_load_context(struct gru_thread_state *gts)
         if (cch_start(cch))
                 BUG();
         unlock_cch_handle(cch);
+
+        gru_dbg(grudev, "gid %d, gts %p, cbrmap 0x%lx, dsrmap 0x%lx, tie %d, tis %d\n",
+                gts->ts_gru->gs_gid, gts, gts->ts_cbr_map, gts->ts_dsr_map,
+                (gts->ts_user_options == GRU_OPT_MISS_FMM_INTR), gts->ts_tlb_int_select);
 }
 
 /*
  * Update fields in an active CCH:
  *      - retarget interrupts on local blade
  *      - update sizeavail mask
- *      - force a delayed context unload by clearing the CCH asids. This
- *        forces TLB misses for new GRU instructions. The context is unloaded
- *        when the next TLB miss occurs.
  */
-int gru_update_cch(struct gru_thread_state *gts, int force_unload)
+int gru_update_cch(struct gru_thread_state *gts)
 {
         struct gru_context_configuration_handle *cch;
         struct gru_state *gru = gts->ts_gru;
@@ -640,21 +668,13 @@ int gru_update_cch(struct gru_thread_state *gts, int force_unload)
                         goto exit;
                 if (cch_interrupt(cch))
                         BUG();
-                if (!force_unload) {
-                        for (i = 0; i < 8; i++)
-                                cch->sizeavail[i] = gts->ts_sizeavail;
-                        gts->ts_tlb_int_select = gru_cpu_fault_map_id();
-                        cch->tlb_int_select = gru_cpu_fault_map_id();
-                        cch->tfm_fault_bit_enable =
-                          (gts->ts_user_options == GRU_OPT_MISS_FMM_POLL
-                            || gts->ts_user_options == GRU_OPT_MISS_FMM_INTR);
-                } else {
-                        for (i = 0; i < 8; i++)
-                                cch->asid[i] = 0;
-                        cch->tfm_fault_bit_enable = 0;
-                        cch->tlb_int_enable = 0;
-                        gts->ts_force_unload = 1;
-                }
+                for (i = 0; i < 8; i++)
+                        cch->sizeavail[i] = gts->ts_sizeavail;
+                gts->ts_tlb_int_select = gru_cpu_fault_map_id();
+                cch->tlb_int_select = gru_cpu_fault_map_id();
+                cch->tfm_fault_bit_enable =
+                  (gts->ts_user_options == GRU_OPT_MISS_FMM_POLL
+                    || gts->ts_user_options == GRU_OPT_MISS_FMM_INTR);
                 if (cch_start(cch))
                         BUG();
                 ret = 1;
@@ -679,7 +699,54 @@ static int gru_retarget_intr(struct gru_thread_state *gts)
 
         gru_dbg(grudev, "retarget from %d to %d\n", gts->ts_tlb_int_select,
                 gru_cpu_fault_map_id());
-        return gru_update_cch(gts, 0);
+        return gru_update_cch(gts);
+}
+
+/*
+ * Check if a GRU context is allowed to use a specific chiplet. By default
+ * a context is assigned to any blade-local chiplet. However, users can
+ * override this.
+ *      Returns 1 if assignment allowed, 0 otherwise
+ */
+static int gru_check_chiplet_assignment(struct gru_state *gru,
+                                        struct gru_thread_state *gts)
+{
+        int blade_id;
+        int chiplet_id;
+
+        blade_id = gts->ts_user_blade_id;
+        if (blade_id < 0)
+                blade_id = uv_numa_blade_id();
+
+        chiplet_id = gts->ts_user_chiplet_id;
+        return gru->gs_blade_id == blade_id &&
+                (chiplet_id < 0 || chiplet_id == gru->gs_chiplet_id);
+}
+
+/*
+ * Unload the gru context if it is not assigned to the correct blade or
+ * chiplet. Misassignment can occur if the process migrates to a different
+ * blade or if the user changes the selected blade/chiplet.
+ */
+void gru_check_context_placement(struct gru_thread_state *gts)
+{
+        struct gru_state *gru;
+
+        /*
+         * If the current task is the context owner, verify that the
+         * context is correctly placed. This test is skipped for non-owner
+         * references. Pthread apps use non-owner references to the CBRs.
+         */
+        gru = gts->ts_gru;
+        if (!gru || gts->ts_tgid_owner != current->tgid)
+                return;
+
+        if (!gru_check_chiplet_assignment(gru, gts)) {
+                STAT(check_context_unload);
+                gru_unload_context(gts, 1);
+        } else if (gru_retarget_intr(gts)) {
+                STAT(check_context_retarget_intr);
+        }
 }
 
 
@@ -712,13 +779,17 @@ static void gts_stolen(struct gru_thread_state *gts,
         }
 }
 
-void gru_steal_context(struct gru_thread_state *gts, int blade_id)
+void gru_steal_context(struct gru_thread_state *gts)
 {
         struct gru_blade_state *blade;
         struct gru_state *gru, *gru0;
         struct gru_thread_state *ngts = NULL;
         int ctxnum, ctxnum0, flag = 0, cbr, dsr;
+        int blade_id;
 
+        blade_id = gts->ts_user_blade_id;
+        if (blade_id < 0)
+                blade_id = uv_numa_blade_id();
         cbr = gts->ts_cbr_au_count;
         dsr = gts->ts_dsr_au_count;
 
@@ -729,35 +800,39 @@ void gru_steal_context(struct gru_thread_state *gts, int blade_id)
         gru = blade->bs_lru_gru;
         if (ctxnum == 0)
                 gru = next_gru(blade, gru);
+        blade->bs_lru_gru = gru;
+        blade->bs_lru_ctxnum = ctxnum;
         ctxnum0 = ctxnum;
         gru0 = gru;
         while (1) {
-                if (check_gru_resources(gru, cbr, dsr, GRU_NUM_CCH))
-                        break;
-                spin_lock(&gru->gs_lock);
-                for (; ctxnum < GRU_NUM_CCH; ctxnum++) {
-                        if (flag && gru == gru0 && ctxnum == ctxnum0)
+                if (gru_check_chiplet_assignment(gru, gts)) {
+                        if (check_gru_resources(gru, cbr, dsr, GRU_NUM_CCH))
                                 break;
-                        ngts = gru->gs_gts[ctxnum];
-                        /*
-                         * We are grabbing locks out of order, so trylock is
-                         * needed. GTSs are usually not locked, so the odds of
-                         * success are high. If trylock fails, try to steal a
-                         * different GSEG.
-                         */
-                        if (ngts && is_gts_stealable(ngts, blade))
+                        spin_lock(&gru->gs_lock);
+                        for (; ctxnum < GRU_NUM_CCH; ctxnum++) {
+                                if (flag && gru == gru0 && ctxnum == ctxnum0)
+                                        break;
+                                ngts = gru->gs_gts[ctxnum];
+                                /*
+                                * We are grabbing locks out of order, so trylock is
+                                * needed. GTSs are usually not locked, so the odds of
+                                * success are high. If trylock fails, try to steal a
+                                * different GSEG.
+                                */
+                                if (ngts && is_gts_stealable(ngts, blade))
+                                        break;
+                                ngts = NULL;
+                        }
+                        spin_unlock(&gru->gs_lock);
+                        if (ngts || (flag && gru == gru0 && ctxnum == ctxnum0))
                                 break;
-                        ngts = NULL;
-                        flag = 1;
                 }
-                spin_unlock(&gru->gs_lock);
-                if (ngts || (flag && gru == gru0 && ctxnum == ctxnum0))
+                if (flag && gru == gru0)
                         break;
+                flag = 1;
                 ctxnum = 0;
                 gru = next_gru(blade, gru);
         }
-        blade->bs_lru_gru = gru;
-        blade->bs_lru_ctxnum = ctxnum;
         spin_unlock(&blade->bs_lock);
 
         if (ngts) {
@@ -776,19 +851,34 @@ void gru_steal_context(struct gru_thread_state *gts, int blade_id)
 }
 
 /*
+ * Assign a gru context.
+ */
+static int gru_assign_context_number(struct gru_state *gru)
+{
+        int ctxnum;
+
+        ctxnum = find_first_zero_bit(&gru->gs_context_map, GRU_NUM_CCH);
+        __set_bit(ctxnum, &gru->gs_context_map);
+        return ctxnum;
+}
+
+/*
  * Scan the GRUs on the local blade & assign a GRU context.
  */
-struct gru_state *gru_assign_gru_context(struct gru_thread_state *gts,
-                                                int blade)
+struct gru_state *gru_assign_gru_context(struct gru_thread_state *gts)
 {
         struct gru_state *gru, *grux;
         int i, max_active_contexts;
+        int blade_id = gts->ts_user_blade_id;
 
-
+        if (blade_id < 0)
+                blade_id = uv_numa_blade_id();
 again:
         gru = NULL;
         max_active_contexts = GRU_NUM_CCH;
-        for_each_gru_on_blade(grux, blade, i) {
+        for_each_gru_on_blade(grux, blade_id, i) {
+                if (!gru_check_chiplet_assignment(grux, gts))
+                        continue;
                 if (check_gru_resources(grux, gts->ts_cbr_au_count,
                                         gts->ts_dsr_au_count,
                                         max_active_contexts)) {
@@ -809,12 +899,9 @@ again:
                 reserve_gru_resources(gru, gts);
                 gts->ts_gru = gru;
                 gts->ts_blade = gru->gs_blade_id;
-                gts->ts_ctxnum =
-                    find_first_zero_bit(&gru->gs_context_map, GRU_NUM_CCH);
-                BUG_ON(gts->ts_ctxnum == GRU_NUM_CCH);
+                gts->ts_ctxnum = gru_assign_context_number(gru);
                 atomic_inc(&gts->ts_refcnt);
                 gru->gs_gts[gts->ts_ctxnum] = gts;
-                __set_bit(gts->ts_ctxnum, &gru->gs_context_map);
                 spin_unlock(&gru->gs_lock);
 
                 STAT(assign_context);
@@ -842,7 +929,6 @@ int gru_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
         struct gru_thread_state *gts;
         unsigned long paddr, vaddr;
-        int blade_id;
 
         vaddr = (unsigned long)vmf->virtual_address;
         gru_dbg(grudev, "vma %p, vaddr 0x%lx (0x%lx)\n",
@@ -857,28 +943,18 @@ int gru_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 again:
         mutex_lock(&gts->ts_ctxlock);
         preempt_disable();
-        blade_id = uv_numa_blade_id();
 
-        if (gts->ts_gru) {
-                if (gts->ts_gru->gs_blade_id != blade_id) {
-                        STAT(migrated_nopfn_unload);
-                        gru_unload_context(gts, 1);
-                } else {
-                        if (gru_retarget_intr(gts))
-                                STAT(migrated_nopfn_retarget);
-                }
-        }
+        gru_check_context_placement(gts);
 
         if (!gts->ts_gru) {
                 STAT(load_user_context);
-                if (!gru_assign_gru_context(gts, blade_id)) {
+                if (!gru_assign_gru_context(gts)) {
                         preempt_enable();
                         mutex_unlock(&gts->ts_ctxlock);
                         set_current_state(TASK_INTERRUPTIBLE);
                         schedule_timeout(GRU_ASSIGN_DELAY);  /* true hack ZZZ */
-                        blade_id = uv_numa_blade_id();
                         if (gts->ts_steal_jiffies + GRU_STEAL_DELAY < jiffies)
-                                gru_steal_context(gts, blade_id);
+                                gru_steal_context(gts);
                         goto again;
                 }
                 gru_load_context(gts);
diff --git a/drivers/misc/sgi-gru/gruprocfs.c b/drivers/misc/sgi-gru/gruprocfs.c
index 3f2375c5ba5b..7768b87d995b 100644
--- a/drivers/misc/sgi-gru/gruprocfs.c
+++ b/drivers/misc/sgi-gru/gruprocfs.c
@@ -36,8 +36,7 @@ static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
 {
         unsigned long val = atomic_long_read(v);
 
-        if (val)
-                seq_printf(s, "%16lu %s\n", val, id);
+        seq_printf(s, "%16lu %s\n", val, id);
 }
 
 static int statistics_show(struct seq_file *s, void *p)
@@ -46,7 +45,8 @@ static int statistics_show(struct seq_file *s, void *p)
         printstat(s, vdata_free);
         printstat(s, gts_alloc);
         printstat(s, gts_free);
-        printstat(s, vdata_double_alloc);
+        printstat(s, gms_alloc);
+        printstat(s, gms_free);
         printstat(s, gts_double_allocate);
         printstat(s, assign_context);
         printstat(s, assign_context_failed);
@@ -59,28 +59,25 @@ static int statistics_show(struct seq_file *s, void *p)
         printstat(s, steal_kernel_context);
         printstat(s, steal_context_failed);
         printstat(s, nopfn);
-        printstat(s, break_cow);
         printstat(s, asid_new);
         printstat(s, asid_next);
         printstat(s, asid_wrap);
         printstat(s, asid_reuse);
         printstat(s, intr);
+        printstat(s, intr_cbr);
+        printstat(s, intr_tfh);
+        printstat(s, intr_spurious);
         printstat(s, intr_mm_lock_failed);
         printstat(s, call_os);
-        printstat(s, call_os_offnode_reference);
-        printstat(s, call_os_check_for_bug);
         printstat(s, call_os_wait_queue);
         printstat(s, user_flush_tlb);
         printstat(s, user_unload_context);
         printstat(s, user_exception);
         printstat(s, set_context_option);
-        printstat(s, migrate_check);
-        printstat(s, migrated_retarget);
-        printstat(s, migrated_unload);
-        printstat(s, migrated_unload_delay);
-        printstat(s, migrated_nopfn_retarget);
-        printstat(s, migrated_nopfn_unload);
+        printstat(s, check_context_retarget_intr);
+        printstat(s, check_context_unload);
         printstat(s, tlb_dropin);
+        printstat(s, tlb_preload_page);
         printstat(s, tlb_dropin_fail_no_asid);
         printstat(s, tlb_dropin_fail_upm);
         printstat(s, tlb_dropin_fail_invalid);
@@ -88,16 +85,15 @@ static int statistics_show(struct seq_file *s, void *p)
         printstat(s, tlb_dropin_fail_idle);
         printstat(s, tlb_dropin_fail_fmm);
         printstat(s, tlb_dropin_fail_no_exception);
-        printstat(s, tlb_dropin_fail_no_exception_war);
         printstat(s, tfh_stale_on_fault);
         printstat(s, mmu_invalidate_range);
         printstat(s, mmu_invalidate_page);
-        printstat(s, mmu_clear_flush_young);
         printstat(s, flush_tlb);
         printstat(s, flush_tlb_gru);
         printstat(s, flush_tlb_gru_tgh);
         printstat(s, flush_tlb_gru_zero_asid);
         printstat(s, copy_gpa);
+        printstat(s, read_gpa);
         printstat(s, mesq_receive);
         printstat(s, mesq_receive_none);
         printstat(s, mesq_send);
@@ -108,7 +104,6 @@ static int statistics_show(struct seq_file *s, void *p)
         printstat(s, mesq_send_qlimit_reached);
         printstat(s, mesq_send_amo_nacked);
         printstat(s, mesq_send_put_nacked);
-        printstat(s, mesq_qf_not_full);
         printstat(s, mesq_qf_locked);
         printstat(s, mesq_qf_noop_not_full);
         printstat(s, mesq_qf_switch_head_failed);
@@ -118,6 +113,7 @@ static int statistics_show(struct seq_file *s, void *p)
         printstat(s, mesq_noop_qlimit_reached);
         printstat(s, mesq_noop_amo_nacked);
         printstat(s, mesq_noop_put_nacked);
+        printstat(s, mesq_noop_page_overflow);
         return 0;
 }
 
@@ -133,8 +129,10 @@ static int mcs_statistics_show(struct seq_file *s, void *p)
         int op;
         unsigned long total, count, max;
         static char *id[] = {"cch_allocate", "cch_start", "cch_interrupt",
-                "cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
+                "cch_interrupt_sync", "cch_deallocate", "tfh_write_only",
+                "tfh_write_restart", "tgh_invalidate"};
 
+        seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
         for (op = 0; op < mcsop_last; op++) {
                 count = atomic_long_read(&mcs_op_statistics[op].count);
                 total = atomic_long_read(&mcs_op_statistics[op].total);
@@ -154,6 +152,7 @@ static ssize_t mcs_statistics_write(struct file *file,
 
 static int options_show(struct seq_file *s, void *p)
 {
+        seq_printf(s, "#bitmask: 1=trace, 2=statistics\n");
         seq_printf(s, "0x%lx\n", gru_options);
         return 0;
 }
@@ -183,16 +182,17 @@ static int cch_seq_show(struct seq_file *file, void *data)
         const char *mode[] = { "??", "UPM", "INTR", "OS_POLL" };
 
         if (gid == 0)
-                seq_printf(file, "#%5s%5s%6s%9s%6s%8s%8s\n", "gid", "bid",
-                           "ctx#", "pid", "cbrs", "dsbytes", "mode");
+                seq_printf(file, "#%5s%5s%6s%7s%9s%6s%8s%8s\n", "gid", "bid",
+                           "ctx#", "asid", "pid", "cbrs", "dsbytes", "mode");
         if (gru)
                 for (i = 0; i < GRU_NUM_CCH; i++) {
                         ts = gru->gs_gts[i];
                         if (!ts)
                                 continue;
-                        seq_printf(file, " %5d%5d%6d%9d%6d%8d%8s\n",
+                        seq_printf(file, " %5d%5d%6d%7d%9d%6d%8d%8s\n",
                                    gru->gs_gid, gru->gs_blade_id, i,
-                                   ts->ts_tgid_owner,
+                                   is_kernel_context(ts) ? 0 : ts->ts_gms->ms_asids[gid].mt_asid,
+                                   is_kernel_context(ts) ? 0 : ts->ts_tgid_owner,
                                    ts->ts_cbr_au_count * GRU_CBR_AU_SIZE,
                                    ts->ts_cbr_au_count * GRU_DSR_AU_BYTES,
                                    mode[ts->ts_user_options &
@@ -355,7 +355,7 @@ static void delete_proc_files(void)
                 for (p = proc_files; p->name; p++)
                         if (p->entry)
                                 remove_proc_entry(p->name, proc_gru);
-                remove_proc_entry("gru", NULL);
+                remove_proc_entry("gru", proc_gru->parent);
         }
 }
 
diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
index 46990bcfa536..7a8b9068ea03 100644
--- a/drivers/misc/sgi-gru/grutables.h
+++ b/drivers/misc/sgi-gru/grutables.h
@@ -161,7 +161,7 @@ extern unsigned int gru_max_gids;
 #define GRU_MAX_GRUS            (GRU_MAX_BLADES * GRU_CHIPLETS_PER_BLADE)
 
 #define GRU_DRIVER_ID_STR       "SGI GRU Device Driver"
-#define GRU_DRIVER_VERSION_STR  "0.80"
+#define GRU_DRIVER_VERSION_STR  "0.85"
 
 /*
  * GRU statistics.
@@ -171,7 +171,8 @@ struct gru_stats_s {
         atomic_long_t vdata_free;
         atomic_long_t gts_alloc;
         atomic_long_t gts_free;
-        atomic_long_t vdata_double_alloc;
+        atomic_long_t gms_alloc;
+        atomic_long_t gms_free;
         atomic_long_t gts_double_allocate;
         atomic_long_t assign_context;
         atomic_long_t assign_context_failed;
@@ -184,28 +185,25 @@ struct gru_stats_s {
         atomic_long_t steal_kernel_context;
         atomic_long_t steal_context_failed;
         atomic_long_t nopfn;
-        atomic_long_t break_cow;
         atomic_long_t asid_new;
         atomic_long_t asid_next;
         atomic_long_t asid_wrap;
         atomic_long_t asid_reuse;
         atomic_long_t intr;
+        atomic_long_t intr_cbr;
+        atomic_long_t intr_tfh;
+        atomic_long_t intr_spurious;
         atomic_long_t intr_mm_lock_failed;
         atomic_long_t call_os;
-        atomic_long_t call_os_offnode_reference;
-        atomic_long_t call_os_check_for_bug;
         atomic_long_t call_os_wait_queue;
         atomic_long_t user_flush_tlb;
         atomic_long_t user_unload_context;
         atomic_long_t user_exception;
         atomic_long_t set_context_option;
-        atomic_long_t migrate_check;
-        atomic_long_t migrated_retarget;
-        atomic_long_t migrated_unload;
-        atomic_long_t migrated_unload_delay;
-        atomic_long_t migrated_nopfn_retarget;
-        atomic_long_t migrated_nopfn_unload;
+        atomic_long_t check_context_retarget_intr;
+        atomic_long_t check_context_unload;
         atomic_long_t tlb_dropin;
+        atomic_long_t tlb_preload_page;
         atomic_long_t tlb_dropin_fail_no_asid;
         atomic_long_t tlb_dropin_fail_upm;
         atomic_long_t tlb_dropin_fail_invalid;
@@ -213,17 +211,16 @@ struct gru_stats_s {
         atomic_long_t tlb_dropin_fail_idle;
         atomic_long_t tlb_dropin_fail_fmm;
         atomic_long_t tlb_dropin_fail_no_exception;
-        atomic_long_t tlb_dropin_fail_no_exception_war;
         atomic_long_t tfh_stale_on_fault;
         atomic_long_t mmu_invalidate_range;
         atomic_long_t mmu_invalidate_page;
-        atomic_long_t mmu_clear_flush_young;
         atomic_long_t flush_tlb;
         atomic_long_t flush_tlb_gru;
         atomic_long_t flush_tlb_gru_tgh;
         atomic_long_t flush_tlb_gru_zero_asid;
 
         atomic_long_t copy_gpa;
+        atomic_long_t read_gpa;
 
         atomic_long_t mesq_receive;
         atomic_long_t mesq_receive_none;
@@ -235,7 +232,7 @@ struct gru_stats_s {
         atomic_long_t mesq_send_qlimit_reached;
         atomic_long_t mesq_send_amo_nacked;
         atomic_long_t mesq_send_put_nacked;
-        atomic_long_t mesq_qf_not_full;
+        atomic_long_t mesq_page_overflow;
         atomic_long_t mesq_qf_locked;
         atomic_long_t mesq_qf_noop_not_full;
         atomic_long_t mesq_qf_switch_head_failed;
@@ -245,11 +242,13 @@ struct gru_stats_s {
         atomic_long_t mesq_noop_qlimit_reached;
         atomic_long_t mesq_noop_amo_nacked;
         atomic_long_t mesq_noop_put_nacked;
+        atomic_long_t mesq_noop_page_overflow;
 
 };
 
 enum mcs_op {cchop_allocate, cchop_start, cchop_interrupt, cchop_interrupt_sync,
-        cchop_deallocate, tghop_invalidate, mcsop_last};
+        cchop_deallocate, tfhop_write_only, tfhop_write_restart,
+        tghop_invalidate, mcsop_last};
 
 struct mcs_op_statistic {
         atomic_long_t   count;
@@ -259,8 +258,8 @@ struct mcs_op_statistic {
 
 extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
 
-#define OPT_DPRINT      1
-#define OPT_STATS       2
+#define OPT_DPRINT              1
+#define OPT_STATS               2
 
 
 #define IRQ_GRU                 110     /* Starting IRQ number for interrupts */
@@ -283,7 +282,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
 #define gru_dbg(dev, fmt, x...)                                         \
         do {                                                            \
                 if (gru_options & OPT_DPRINT)                           \
-                        dev_dbg(dev, "%s: " fmt, __func__, x);          \
+                        printk(KERN_DEBUG "GRU:%d %s: " fmt, smp_processor_id(), __func__, x);\
         } while (0)
 #else
 #define gru_dbg(x...)
@@ -297,13 +296,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
 #define ASID_INC        8       /* number of regions */
 
 /* Generate a GRU asid value from a GRU base asid & a virtual address. */
-#if defined CONFIG_IA64
 #define VADDR_HI_BIT            64
-#elif defined CONFIG_X86_64
-#define VADDR_HI_BIT            48
-#else
-#error "Unsupported architecture"
-#endif
 #define GRUREGION(addr)         ((addr) >> (VADDR_HI_BIT - 3) & 3)
 #define GRUASID(asid, addr)     ((asid) + GRUREGION(addr))
 
@@ -345,6 +338,7 @@ struct gru_vma_data {
         long                    vd_user_options;/* misc user option flags */
         int                     vd_cbr_au_count;
         int                     vd_dsr_au_count;
+        unsigned char           vd_tlb_preload_count;
 };
 
 /*
@@ -360,6 +354,7 @@ struct gru_thread_state {
         struct gru_state        *ts_gru;        /* GRU where the context is
                                                    loaded */
         struct gru_mm_struct    *ts_gms;        /* asid & ioproc struct */
+        unsigned char           ts_tlb_preload_count; /* TLB preload pages */
         unsigned long           ts_cbr_map;     /* map of allocated CBRs */
         unsigned long           ts_dsr_map;     /* map of allocated DATA
                                                    resources */
@@ -368,6 +363,8 @@ struct gru_thread_state {
         long                    ts_user_options;/* misc user option flags */
         pid_t                   ts_tgid_owner;  /* task that is using the
                                                    context - for migration */
+        short                   ts_user_blade_id;/* user selected blade */
+        char                    ts_user_chiplet_id;/* user selected chiplet */
         unsigned short          ts_sizeavail;   /* Pagesizes in use */
         int                     ts_tsid;        /* thread that owns the
                                                    structure */
@@ -384,13 +381,11 @@ struct gru_thread_state {
         char                    ts_blade;       /* If >= 0, migrate context if
                                                    ref from diferent blade */
         char                    ts_force_cch_reload;
-        char                    ts_force_unload;/* force context to be unloaded
-                                                   after migration */
         char                    ts_cbr_idx[GRU_CBR_AU];/* CBR numbers of each
                                                           allocated CB */
         int                     ts_data_valid;  /* Indicates if ts_gdata has
                                                    valid data */
-        struct gts_statistics   ustats;         /* User statistics */
+        struct gru_gseg_statistics ustats;      /* User statistics */
         unsigned long           ts_gdata[0];    /* save area for GRU data (CB,
                                                    DS, CBE) */
 };
@@ -422,6 +417,7 @@ struct gru_state {
                                                            gru segments (64) */
         unsigned short          gs_gid;                 /* unique GRU number */
         unsigned short          gs_blade_id;            /* blade of GRU */
+        unsigned char           gs_chiplet_id;          /* blade chiplet of GRU */
         unsigned char           gs_tgh_local_shift;     /* used to pick TGH for
                                                            local flush */
         unsigned char           gs_tgh_first_remote;    /* starting TGH# for
@@ -453,6 +449,7 @@ struct gru_state {
                                                            in use */
         struct gru_thread_state *gs_gts[GRU_NUM_CCH];   /* GTS currently using
                                                            the context */
+        int                     gs_irq[GRU_NUM_TFM];    /* Interrupt irqs */
 };
 
 /*
@@ -519,8 +516,7 @@ struct gru_blade_state {
 
 /* Scan all active GRUs in a GRU bitmap */
 #define for_each_gru_in_bitmap(gid, map)                                \
-        for ((gid) = find_first_bit((map), GRU_MAX_GRUS); (gid) < GRU_MAX_GRUS;\
-                (gid)++, (gid) = find_next_bit((map), GRU_MAX_GRUS, (gid)))
+        for_each_set_bit((gid), (map), GRU_MAX_GRUS)
 
 /* Scan all active GRUs on a specific blade */
 #define for_each_gru_on_blade(gru, nid, i)                              \
@@ -539,23 +535,17 @@ struct gru_blade_state {
 
 /* Scan each CBR whose bit is set in a TFM (or copy of) */
 #define for_each_cbr_in_tfm(i, map)                                     \
-        for ((i) = find_first_bit(map, GRU_NUM_CBE);                    \
-                        (i) < GRU_NUM_CBE;                              \
-                        (i)++, (i) = find_next_bit(map, GRU_NUM_CBE, i))
+        for_each_set_bit((i), (map), GRU_NUM_CBE)
 
 /* Scan each CBR in a CBR bitmap. Note: multiple CBRs in an allocation unit */
 #define for_each_cbr_in_allocation_map(i, map, k)                       \
-        for ((k) = find_first_bit(map, GRU_CBR_AU); (k) < GRU_CBR_AU;   \
-                        (k) = find_next_bit(map, GRU_CBR_AU, (k) + 1))  \
+        for_each_set_bit((k), (map), GRU_CBR_AU)                        \
                 for ((i) = (k)*GRU_CBR_AU_SIZE;                         \
                                 (i) < ((k) + 1) * GRU_CBR_AU_SIZE; (i)++)
 
 /* Scan each DSR in a DSR bitmap. Note: multiple DSRs in an allocation unit */
 #define for_each_dsr_in_allocation_map(i, map, k)                       \
-        for ((k) = find_first_bit((const unsigned long *)map, GRU_DSR_AU);\
-                        (k) < GRU_DSR_AU;                               \
-                        (k) = find_next_bit((const unsigned long *)map, \
-                                          GRU_DSR_AU, (k) + 1))         \
+        for_each_set_bit((k), (const unsigned long *)(map), GRU_DSR_AU) \
                 for ((i) = (k) * GRU_DSR_AU_CL;                         \
                                 (i) < ((k) + 1) * GRU_DSR_AU_CL; (i)++)
 
@@ -619,6 +609,15 @@ static inline int is_kernel_context(struct gru_thread_state *gts)
         return !gts->ts_mm;
 }
 
+/*
+ * The following are for Nehelem-EX. A more general scheme is needed for
+ * future processors.
+ */
+#define UV_MAX_INT_CORES                8
+#define uv_cpu_socket_number(p)         ((cpu_physical_id(p) >> 5) & 1)
+#define uv_cpu_ht_number(p)             (cpu_physical_id(p) & 1)
+#define uv_cpu_core_number(p)           (((cpu_physical_id(p) >> 2) & 4) |      \
+                                        ((cpu_physical_id(p) >> 1) & 3))
 /*-----------------------------------------------------------------------------
  * Function prototypes & externs
  */
@@ -633,24 +632,26 @@ extern struct gru_thread_state *gru_find_thread_state(struct vm_area_struct
                                 *vma, int tsid);
 extern struct gru_thread_state *gru_alloc_thread_state(struct vm_area_struct
                                 *vma, int tsid);
-extern struct gru_state *gru_assign_gru_context(struct gru_thread_state *gts,
-                int blade);
+extern struct gru_state *gru_assign_gru_context(struct gru_thread_state *gts);
 extern void gru_load_context(struct gru_thread_state *gts);
-extern void gru_steal_context(struct gru_thread_state *gts, int blade_id);
+extern void gru_steal_context(struct gru_thread_state *gts);
 extern void gru_unload_context(struct gru_thread_state *gts, int savestate);
-extern int gru_update_cch(struct gru_thread_state *gts, int force_unload);
+extern int gru_update_cch(struct gru_thread_state *gts);
 extern void gts_drop(struct gru_thread_state *gts);
 extern void gru_tgh_flush_init(struct gru_state *gru);
 extern int gru_kservices_init(void);
 extern void gru_kservices_exit(void);
+extern irqreturn_t gru0_intr(int irq, void *dev_id);
+extern irqreturn_t gru1_intr(int irq, void *dev_id);
+extern irqreturn_t gru_intr_mblade(int irq, void *dev_id);
 extern int gru_dump_chiplet_request(unsigned long arg);
 extern long gru_get_gseg_statistics(unsigned long arg);
-extern irqreturn_t gru_intr(int irq, void *dev_id);
 extern int gru_handle_user_call_os(unsigned long address);
 extern int gru_user_flush_tlb(unsigned long arg);
 extern int gru_user_unload_context(unsigned long arg);
 extern int gru_get_exception_detail(unsigned long arg);
 extern int gru_set_context_option(unsigned long address);
+extern void gru_check_context_placement(struct gru_thread_state *gts);
 extern int gru_cpu_fault_map_id(void);
 extern struct vm_area_struct *gru_find_vma(unsigned long vaddr);
 extern void gru_flush_all_tlb(struct gru_state *gru);
@@ -658,7 +659,8 @@ extern int gru_proc_init(void);
 extern void gru_proc_exit(void);
 
 extern struct gru_thread_state *gru_alloc_gts(struct vm_area_struct *vma,
-                int cbr_au_count, int dsr_au_count, int options, int tsid);
+                int cbr_au_count, int dsr_au_count,
+                unsigned char tlb_preload_count, int options, int tsid);
 extern unsigned long gru_reserve_cb_resources(struct gru_state *gru,
                 int cbr_au_count, char *cbmap);
 extern unsigned long gru_reserve_ds_resources(struct gru_state *gru,
diff --git a/drivers/misc/sgi-gru/grutlbpurge.c b/drivers/misc/sgi-gru/grutlbpurge.c
index 1d125091f5e7..240a6d361665 100644
--- a/drivers/misc/sgi-gru/grutlbpurge.c
+++ b/drivers/misc/sgi-gru/grutlbpurge.c
@@ -184,8 +184,8 @@ void gru_flush_tlb_range(struct gru_mm_struct *gms, unsigned long start,
                         STAT(flush_tlb_gru_tgh);
                         asid = GRUASID(asid, start);
                         gru_dbg(grudev,
-        "  FLUSH gruid %d, asid 0x%x, num %ld, cbmap 0x%x\n",
-                                gid, asid, num, asids->mt_ctxbitmap);
+        "  FLUSH gruid %d, asid 0x%x, vaddr 0x%lx, vamask 0x%x, num %ld, cbmap 0x%x\n",
+                              gid, asid, start, grupagesize, num, asids->mt_ctxbitmap);
                         tgh = get_lock_tgh_handle(gru);
                         tgh_invalidate(tgh, start, ~0, asid, grupagesize, 0,
                                        num - 1, asids->mt_ctxbitmap);
@@ -299,6 +299,7 @@ struct gru_mm_struct *gru_register_mmu_notifier(void)
 {
         struct gru_mm_struct *gms;
         struct mmu_notifier *mn;
+        int err;
 
         mn = mmu_find_ops(current->mm, &gru_mmuops);
         if (mn) {
@@ -307,16 +308,22 @@ struct gru_mm_struct *gru_register_mmu_notifier(void)
         } else {
                 gms = kzalloc(sizeof(*gms), GFP_KERNEL);
                 if (gms) {
+                        STAT(gms_alloc);
                         spin_lock_init(&gms->ms_asid_lock);
                         gms->ms_notifier.ops = &gru_mmuops;
                         atomic_set(&gms->ms_refcnt, 1);
                         init_waitqueue_head(&gms->ms_wait_queue);
-                        __mmu_notifier_register(&gms->ms_notifier, current->mm);
+                        err = __mmu_notifier_register(&gms->ms_notifier, current->mm);
+                        if (err)
+                                goto error;
                 }
         }
         gru_dbg(grudev, "gms %p, refcnt %d\n", gms,
                 atomic_read(&gms->ms_refcnt));
         return gms;
+error:
+        kfree(gms);
+        return ERR_PTR(err);
 }
 
 void gru_drop_mmu_notifier(struct gru_mm_struct *gms)
@@ -327,6 +334,7 @@ void gru_drop_mmu_notifier(struct gru_mm_struct *gms)
                 if (!gms->ms_released)
                         mmu_notifier_unregister(&gms->ms_notifier, current->mm);
                 kfree(gms);
+                STAT(gms_free);
         }
 }
 
diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
index 2275126cb334..851b2f25ce0e 100644
--- a/drivers/misc/sgi-xp/xp.h
+++ b/drivers/misc/sgi-xp/xp.h
@@ -339,6 +339,7 @@ extern short xp_partition_id;
 extern u8 xp_region_size;
 
 extern unsigned long (*xp_pa) (void *);
+extern unsigned long (*xp_socket_pa) (unsigned long);
 extern enum xp_retval (*xp_remote_memcpy) (unsigned long, const unsigned long,
                        size_t);
 extern int (*xp_cpu_to_nasid) (int);
diff --git a/drivers/misc/sgi-xp/xp_main.c b/drivers/misc/sgi-xp/xp_main.c
index 7896849b16dc..01be66d02ca8 100644
--- a/drivers/misc/sgi-xp/xp_main.c
+++ b/drivers/misc/sgi-xp/xp_main.c
@@ -44,6 +44,9 @@ EXPORT_SYMBOL_GPL(xp_region_size);
 unsigned long (*xp_pa) (void *addr);
 EXPORT_SYMBOL_GPL(xp_pa);
 
+unsigned long (*xp_socket_pa) (unsigned long gpa);
+EXPORT_SYMBOL_GPL(xp_socket_pa);
+
 enum xp_retval (*xp_remote_memcpy) (unsigned long dst_gpa,
                                     const unsigned long src_gpa, size_t len);
 EXPORT_SYMBOL_GPL(xp_remote_memcpy);
diff --git a/drivers/misc/sgi-xp/xp_sn2.c b/drivers/misc/sgi-xp/xp_sn2.c
index fb3ec9d735a9..d8e463f87241 100644
--- a/drivers/misc/sgi-xp/xp_sn2.c
+++ b/drivers/misc/sgi-xp/xp_sn2.c
@@ -84,6 +84,15 @@ xp_pa_sn2(void *addr)
 }
 
 /*
+ * Convert a global physical to a socket physical address.
+ */
+static unsigned long
+xp_socket_pa_sn2(unsigned long gpa)
+{
+        return gpa;
+}
+
+/*
  * Wrapper for bte_copy().
  *
  *      dst_pa - physical address of the destination of the transfer.
@@ -162,6 +171,7 @@ xp_init_sn2(void)
         xp_region_size = sn_region_size;
 
         xp_pa = xp_pa_sn2;
+        xp_socket_pa = xp_socket_pa_sn2;
         xp_remote_memcpy = xp_remote_memcpy_sn2;
         xp_cpu_to_nasid = xp_cpu_to_nasid_sn2;
         xp_expand_memprotect = xp_expand_memprotect_sn2;
diff --git a/drivers/misc/sgi-xp/xp_uv.c b/drivers/misc/sgi-xp/xp_uv.c
index d238576b26fa..a0d093274dc0 100644
--- a/drivers/misc/sgi-xp/xp_uv.c
+++ b/drivers/misc/sgi-xp/xp_uv.c
@@ -32,12 +32,44 @@ xp_pa_uv(void *addr)
         return uv_gpa(addr);
 }
 
+/*
+ * Convert a global physical to socket physical address.
+ */
+static unsigned long
+xp_socket_pa_uv(unsigned long gpa)
+{
+        return uv_gpa_to_soc_phys_ram(gpa);
+}
+
+static enum xp_retval
+xp_remote_mmr_read(unsigned long dst_gpa, const unsigned long src_gpa,
+                   size_t len)
+{
+        int ret;
+        unsigned long *dst_va = __va(uv_gpa_to_soc_phys_ram(dst_gpa));
+
+        BUG_ON(!uv_gpa_in_mmr_space(src_gpa));
+        BUG_ON(len != 8);
+
+        ret = gru_read_gpa(dst_va, src_gpa);
+        if (ret == 0)
+                return xpSuccess;
+
+        dev_err(xp, "gru_read_gpa() failed, dst_gpa=0x%016lx src_gpa=0x%016lx "
+                "len=%ld\n", dst_gpa, src_gpa, len);
+        return xpGruCopyError;
+}
+
+
 static enum xp_retval
 xp_remote_memcpy_uv(unsigned long dst_gpa, const unsigned long src_gpa,
                     size_t len)
 {
         int ret;
 
+        if (uv_gpa_in_mmr_space(src_gpa))
+                return xp_remote_mmr_read(dst_gpa, src_gpa, len);
+
         ret = gru_copy_gpa(dst_gpa, src_gpa, len);
         if (ret == 0)
                 return xpSuccess;
@@ -123,6 +155,7 @@ xp_init_uv(void)
         xp_region_size = sn_region_size;
 
         xp_pa = xp_pa_uv;
+        xp_socket_pa = xp_socket_pa_uv;
         xp_remote_memcpy = xp_remote_memcpy_uv;
         xp_cpu_to_nasid = xp_cpu_to_nasid_uv;
         xp_expand_memprotect = xp_expand_memprotect_uv;
diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
index fd3688a3e23f..8d082b46426b 100644
--- a/drivers/misc/sgi-xp/xpc_main.c
+++ b/drivers/misc/sgi-xp/xpc_main.c
@@ -44,6 +44,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/sysctl.h>
 #include <linux/device.h>
 #include <linux/delay.h>
@@ -89,48 +90,40 @@ static int xpc_disengage_max_timelimit = 120;
 
 static ctl_table xpc_sys_xpc_hb_dir[] = {
         {
-         .ctl_name = CTL_UNNUMBERED,
          .procname = "hb_interval",
          .data = &xpc_hb_interval,
          .maxlen = sizeof(int),
          .mode = 0644,
-         .proc_handler = &proc_dointvec_minmax,
-         .strategy = &sysctl_intvec,
+         .proc_handler = proc_dointvec_minmax,
          .extra1 = &xpc_hb_min_interval,
          .extra2 = &xpc_hb_max_interval},
         {
-         .ctl_name = CTL_UNNUMBERED,
          .procname = "hb_check_interval",
          .data = &xpc_hb_check_interval,
          .maxlen = sizeof(int),
          .mode = 0644,
-         .proc_handler = &proc_dointvec_minmax,
-         .strategy = &sysctl_intvec,
+         .proc_handler = proc_dointvec_minmax,
          .extra1 = &xpc_hb_check_min_interval,
          .extra2 = &xpc_hb_check_max_interval},
         {}
 };
 static ctl_table xpc_sys_xpc_dir[] = {
         {
-         .ctl_name = CTL_UNNUMBERED,
          .procname = "hb",
          .mode = 0555,
          .child = xpc_sys_xpc_hb_dir},
         {
-         .ctl_name = CTL_UNNUMBERED,
          .procname = "disengage_timelimit",
          .data = &xpc_disengage_timelimit,
          .maxlen = sizeof(int),
          .mode = 0644,
-         .proc_handler = &proc_dointvec_minmax,
-         .strategy = &sysctl_intvec,
+         .proc_handler = proc_dointvec_minmax,
          .extra1 = &xpc_disengage_min_timelimit,
          .extra2 = &xpc_disengage_max_timelimit},
         {}
 };
 static ctl_table xpc_sys_dir[] = {
         {
-         .ctl_name = CTL_UNNUMBERED,
          .procname = "xpc",
          .mode = 0555,
          .child = xpc_sys_xpc_dir},
diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
index 65877bc5edaa..d551f09ccb79 100644
--- a/drivers/misc/sgi-xp/xpc_partition.c
+++ b/drivers/misc/sgi-xp/xpc_partition.c
@@ -17,7 +17,9 @@
 
 #include <linux/device.h>
 #include <linux/hardirq.h>
+#include <linux/slab.h>
 #include "xpc.h"
+#include <asm/uv/uv_hub.h>
 
 /* XPC is exiting flag */
 int xpc_exiting;
@@ -92,8 +94,12 @@ xpc_get_rsvd_page_pa(int nasid)
                         break;
 
                 /* !!! L1_CACHE_ALIGN() is only a sn2-bte_copy requirement */
-                if (L1_CACHE_ALIGN(len) > buf_len) {
-                        kfree(buf_base);
+                if (is_shub())
+                        len = L1_CACHE_ALIGN(len);
+
+                if (len > buf_len) {
+                        if (buf_base != NULL)
+                                kfree(buf_base);
                         buf_len = L1_CACHE_ALIGN(len);
                         buf = xpc_kmalloc_cacheline_aligned(buf_len, GFP_KERNEL,
                                                             &buf_base);
@@ -105,7 +111,7 @@ xpc_get_rsvd_page_pa(int nasid)
                         }
                 }
 
-                ret = xp_remote_memcpy(xp_pa(buf), rp_pa, buf_len);
+                ret = xp_remote_memcpy(xp_pa(buf), rp_pa, len);
                 if (ret != xpSuccess) {
                         dev_dbg(xpc_part, "xp_remote_memcpy failed %d\n", ret);
                         break;
@@ -143,7 +149,7 @@ xpc_setup_rsvd_page(void)
                 dev_err(xpc_part, "SAL failed to locate the reserved page\n");
                 return -ESRCH;
         }
-        rp = (struct xpc_rsvd_page *)__va(rp_pa);
+        rp = (struct xpc_rsvd_page *)__va(xp_socket_pa(rp_pa));
 
         if (rp->SAL_version < 3) {
                 /* SAL_versions < 3 had a SAL_partid defined as a u8 */
diff --git a/drivers/misc/sgi-xp/xpc_sn2.c b/drivers/misc/sgi-xp/xpc_sn2.c
index 8b70e03f939f..7d71c04fc938 100644
--- a/drivers/misc/sgi-xp/xpc_sn2.c
+++ b/drivers/misc/sgi-xp/xpc_sn2.c
@@ -14,6 +14,7 @@
  */
 
 #include <linux/delay.h>
+#include <linux/slab.h>
 #include <asm/uncached.h>
 #include <asm/sn/mspec.h>
 #include <asm/sn/sn_sal.h>
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index c76677afda1b..1f59ee2226ca 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -19,6 +19,7 @@
 #include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <asm/uv/uv_hub.h>
 #if defined CONFIG_X86_64
 #include <asm/uv/bios.h>
@@ -106,7 +107,8 @@ xpc_get_gru_mq_irq_uv(struct xpc_gru_mq_uv *mq, int cpu, char *irq_name)
         int mmr_pnode = uv_blade_to_pnode(mq->mmr_blade);
 
 #if defined CONFIG_X86_64
-        mq->irq = uv_setup_irq(irq_name, cpu, mq->mmr_blade, mq->mmr_offset);
+        mq->irq = uv_setup_irq(irq_name, cpu, mq->mmr_blade, mq->mmr_offset,
+                        UV_AFFINITY_CPU);
         if (mq->irq < 0) {
                 dev_err(xpc_part, "uv_setup_irq() returned error=%d\n",
                         -mq->irq);
@@ -136,7 +138,7 @@ static void
 xpc_release_gru_mq_irq_uv(struct xpc_gru_mq_uv *mq)
 {
 #if defined CONFIG_X86_64
-        uv_teardown_irq(mq->irq, mq->mmr_blade, mq->mmr_offset);
+        uv_teardown_irq(mq->irq);
 
 #elif defined CONFIG_IA64_GENERIC || defined CONFIG_IA64_SGI_UV
         int mmr_pnode;
@@ -156,22 +158,24 @@ xpc_gru_mq_watchlist_alloc_uv(struct xpc_gru_mq_uv *mq)
 {
         int ret;
 
-#if defined CONFIG_X86_64
-        ret = uv_bios_mq_watchlist_alloc(mq->mmr_blade, uv_gpa(mq->address),
-                                         mq->order, &mq->mmr_offset);
-        if (ret < 0) {
-                dev_err(xpc_part, "uv_bios_mq_watchlist_alloc() failed, "
-                        "ret=%d\n", ret);
-                return ret;
-        }
-#elif defined CONFIG_IA64_GENERIC || defined CONFIG_IA64_SGI_UV
-        ret = sn_mq_watchlist_alloc(mq->mmr_blade, (void *)uv_gpa(mq->address),
+#if defined CONFIG_IA64_GENERIC || defined CONFIG_IA64_SGI_UV
+        int mmr_pnode = uv_blade_to_pnode(mq->mmr_blade);
+
+        ret = sn_mq_watchlist_alloc(mmr_pnode, (void *)uv_gpa(mq->address),
                                     mq->order, &mq->mmr_offset);
         if (ret < 0) {
                 dev_err(xpc_part, "sn_mq_watchlist_alloc() failed, ret=%d\n",
                         ret);
                 return -EBUSY;
         }
+#elif defined CONFIG_X86_64
+        ret = uv_bios_mq_watchlist_alloc(uv_gpa(mq->address),
+                                         mq->order, &mq->mmr_offset);
+        if (ret < 0) {
+                dev_err(xpc_part, "uv_bios_mq_watchlist_alloc() failed, "
+                        "ret=%d\n", ret);
+                return ret;
+        }
 #else
         #error not a supported configuration
 #endif
@@ -184,12 +188,13 @@ static void
 xpc_gru_mq_watchlist_free_uv(struct xpc_gru_mq_uv *mq)
 {
         int ret;
+        int mmr_pnode = uv_blade_to_pnode(mq->mmr_blade);
 
 #if defined CONFIG_X86_64
-        ret = uv_bios_mq_watchlist_free(mq->mmr_blade, mq->watchlist_num);
+        ret = uv_bios_mq_watchlist_free(mmr_pnode, mq->watchlist_num);
         BUG_ON(ret != BIOS_STATUS_SUCCESS);
 #elif defined CONFIG_IA64_GENERIC || defined CONFIG_IA64_SGI_UV
-        ret = sn_mq_watchlist_free(mq->mmr_blade, mq->watchlist_num);
+        ret = sn_mq_watchlist_free(mmr_pnode, mq->watchlist_num);
         BUG_ON(ret != SALRET_OK);
 #else
         #error not a supported configuration
@@ -203,6 +208,7 @@ xpc_create_gru_mq_uv(unsigned int mq_size, int cpu, char *irq_name,
         enum xp_retval xp_ret;
         int ret;
         int nid;
+        int nasid;
         int pg_order;
         struct page *page;
         struct xpc_gru_mq_uv *mq;
@@ -258,9 +264,11 @@ xpc_create_gru_mq_uv(unsigned int mq_size, int cpu, char *irq_name,
                 goto out_5;
         }
 
+        nasid = UV_PNODE_TO_NASID(uv_cpu_to_pnode(cpu));
+
         mmr_value = (struct uv_IO_APIC_route_entry *)&mq->mmr_value;
         ret = gru_create_message_queue(mq->gru_mq_desc, mq->address, mq_size,
-                                       nid, mmr_value->vector, mmr_value->dest);
+                                     nasid, mmr_value->vector, mmr_value->dest);
         if (ret != 0) {
                 dev_err(xpc_part, "gru_create_message_queue() returned "
                         "error=%d\n", ret);
@@ -945,11 +953,13 @@ xpc_get_fifo_entry_uv(struct xpc_fifo_head_uv *head)
                 head->first = first->next;
                 if (head->first == NULL)
                         head->last = NULL;
+
+                head->n_entries--;
+                BUG_ON(head->n_entries < 0);
+
+                first->next = NULL;
         }
-        head->n_entries--;
-        BUG_ON(head->n_entries < 0);
         spin_unlock_irqrestore(&head->lock, irq_flags);
-        first->next = NULL;
         return first;
 }
 
@@ -1018,7 +1028,8 @@ xpc_make_first_contact_uv(struct xpc_partition *part)
         xpc_send_activate_IRQ_part_uv(part, &msg, sizeof(msg),
                                       XPC_ACTIVATE_MQ_MSG_SYNC_ACT_STATE_UV);
 
-        while (part->sn.uv.remote_act_state != XPC_P_AS_ACTIVATING) {
+        while (!((part->sn.uv.remote_act_state == XPC_P_AS_ACTIVATING) ||
+                 (part->sn.uv.remote_act_state == XPC_P_AS_ACTIVE))) {
 
                 dev_dbg(xpc_part, "waiting to make first contact with "
                         "partition %d\n", XPC_PARTID(part));
@@ -1421,7 +1432,6 @@ xpc_handle_notify_mq_msg_uv(struct xpc_partition *part,
         msg_slot = ch_uv->recv_msg_slots +
             (msg->hdr.msg_slot_number % ch->remote_nentries) * ch->entry_size;
 
-        BUG_ON(msg->hdr.msg_slot_number != msg_slot->hdr.msg_slot_number);
         BUG_ON(msg_slot->hdr.size != 0);
 
         memcpy(msg_slot, msg, msg->hdr.size);
@@ -1645,8 +1655,6 @@ xpc_received_payload_uv(struct xpc_channel *ch, void *payload)
                                sizeof(struct xpc_notify_mq_msghdr_uv));
         if (ret != xpSuccess)
                 XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
-
-        msg->hdr.msg_slot_number += ch->remote_nentries;
 }
 
 static struct xpc_arch_operations xpc_arch_ops_uv = {
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index 16f0abda1423..ee5109a3cd98 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c
@@ -20,6 +20,7 @@
  *
  */
 
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
@@ -475,7 +476,7 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         if (skb->data[0] == 0xff) {
                 /* we are being asked to broadcast to all partitions */
-                for_each_bit(dest_partid, xpnet_broadcast_partitions,
+                for_each_set_bit(dest_partid, xpnet_broadcast_partitions,
                              xp_max_npartitions) {
 
                         xpnet_send(skb, queued_msg, start_addr, end_addr,
diff --git a/drivers/misc/ti_dac7512.c b/drivers/misc/ti_dac7512.c
new file mode 100644
index 000000000000..d3f229a3a77e
--- /dev/null
+++ b/drivers/misc/ti_dac7512.c
@@ -0,0 +1,101 @@
+/*
+ *  dac7512.c - Linux kernel module for
+ *      Texas Instruments DAC7512
+ *
+ *  Copyright (c) 2009 Daniel Mack <daniel@caiaq.de>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/spi/spi.h>
+
+#define DAC7512_DRV_NAME        "dac7512"
+#define DRIVER_VERSION          "1.0"
+
+static ssize_t dac7512_store_val(struct device *dev,
+                                 struct device_attribute *attr,
+                                 const char *buf, size_t count)
+{
+        struct spi_device *spi = to_spi_device(dev);
+        unsigned char tmp[2];
+        unsigned long val;
+
+        if (strict_strtoul(buf, 10, &val) < 0)
+                return -EINVAL;
+
+        tmp[0] = val >> 8;
+        tmp[1] = val & 0xff;
+        spi_write(spi, tmp, sizeof(tmp));
+        return count;
+}
+
+static DEVICE_ATTR(value, S_IWUSR, NULL, dac7512_store_val);
+
+static struct attribute *dac7512_attributes[] = {
+        &dev_attr_value.attr,
+        NULL
+};
+
+static const struct attribute_group dac7512_attr_group = {
+        .attrs = dac7512_attributes,
+};
+
+static int __devinit dac7512_probe(struct spi_device *spi)
+{
+        int ret;
+
+        spi->bits_per_word = 8;
+        spi->mode = SPI_MODE_0;
+        ret = spi_setup(spi);
+        if (ret < 0)
+                return ret;
+
+        return sysfs_create_group(&spi->dev.kobj, &dac7512_attr_group);
+}
+
+static int __devexit dac7512_remove(struct spi_device *spi)
+{
+        sysfs_remove_group(&spi->dev.kobj, &dac7512_attr_group);
+        return 0;
+}
+
+static struct spi_driver dac7512_driver = {
+        .driver = {
+                .name   = DAC7512_DRV_NAME,
+                .owner  = THIS_MODULE,
+        },
+        .probe  = dac7512_probe,
+        .remove = __devexit_p(dac7512_remove),
+};
+
+static int __init dac7512_init(void)
+{
+        return spi_register_driver(&dac7512_driver);
+}
+
+static void __exit dac7512_exit(void)
+{
+        spi_unregister_driver(&dac7512_driver);
+}
+
+MODULE_AUTHOR("Daniel Mack <daniel@caiaq.de>");
+MODULE_DESCRIPTION("DAC7512 16-bit DAC");
+MODULE_LICENSE("GPL v2");
+MODULE_VERSION(DRIVER_VERSION);
+
+module_init(dac7512_init);
+module_exit(dac7512_exit);
diff --git a/drivers/misc/tifm_core.c b/drivers/misc/tifm_core.c
index 98bcba521da2..5f6852dff40b 100644
--- a/drivers/misc/tifm_core.c
+++ b/drivers/misc/tifm_core.c
@@ -10,6 +10,7 @@
  */
 
 #include <linux/tifm.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/idr.h>
 
diff --git a/drivers/misc/tsl2550.c b/drivers/misc/tsl2550.c
new file mode 100644
index 000000000000..483ae5f7f68e
--- /dev/null
+++ b/drivers/misc/tsl2550.c
@@ -0,0 +1,473 @@
+/*
+ *  tsl2550.c - Linux kernel modules for ambient light sensor
+ *
+ *  Copyright (C) 2007 Rodolfo Giometti <giometti@linux.it>
+ *  Copyright (C) 2007 Eurotech S.p.A. <info@eurotech.it>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/mutex.h>
+
+#define TSL2550_DRV_NAME        "tsl2550"
+#define DRIVER_VERSION          "1.2"
+
+/*
+ * Defines
+ */
+
+#define TSL2550_POWER_DOWN              0x00
+#define TSL2550_POWER_UP                0x03
+#define TSL2550_STANDARD_RANGE          0x18
+#define TSL2550_EXTENDED_RANGE          0x1d
+#define TSL2550_READ_ADC0               0x43
+#define TSL2550_READ_ADC1               0x83
+
+/*
+ * Structs
+ */
+
+struct tsl2550_data {
+        struct i2c_client *client;
+        struct mutex update_lock;
+
+        unsigned int power_state:1;
+        unsigned int operating_mode:1;
+};
+
+/*
+ * Global data
+ */
+
+static const u8 TSL2550_MODE_RANGE[2] = {
+        TSL2550_STANDARD_RANGE, TSL2550_EXTENDED_RANGE,
+};
+
+/*
+ * Management functions
+ */
+
+static int tsl2550_set_operating_mode(struct i2c_client *client, int mode)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+
+        int ret = i2c_smbus_write_byte(client, TSL2550_MODE_RANGE[mode]);
+
+        data->operating_mode = mode;
+
+        return ret;
+}
+
+static int tsl2550_set_power_state(struct i2c_client *client, int state)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        int ret;
+
+        if (state == 0)
+                ret = i2c_smbus_write_byte(client, TSL2550_POWER_DOWN);
+        else {
+                ret = i2c_smbus_write_byte(client, TSL2550_POWER_UP);
+
+                /* On power up we should reset operating mode also... */
+                tsl2550_set_operating_mode(client, data->operating_mode);
+        }
+
+        data->power_state = state;
+
+        return ret;
+}
+
+static int tsl2550_get_adc_value(struct i2c_client *client, u8 cmd)
+{
+        int ret;
+
+        ret = i2c_smbus_read_byte_data(client, cmd);
+        if (ret < 0)
+                return ret;
+        if (!(ret & 0x80))
+                return -EAGAIN;
+        return ret & 0x7f;      /* remove the "valid" bit */
+}
+
+/*
+ * LUX calculation
+ */
+
+#define TSL2550_MAX_LUX         1846
+
+static const u8 ratio_lut[] = {
+        100, 100, 100, 100, 100, 100, 100, 100,
+        100, 100, 100, 100, 100, 100, 99, 99,
+        99, 99, 99, 99, 99, 99, 99, 99,
+        99, 99, 99, 98, 98, 98, 98, 98,
+        98, 98, 97, 97, 97, 97, 97, 96,
+        96, 96, 96, 95, 95, 95, 94, 94,
+        93, 93, 93, 92, 92, 91, 91, 90,
+        89, 89, 88, 87, 87, 86, 85, 84,
+        83, 82, 81, 80, 79, 78, 77, 75,
+        74, 73, 71, 69, 68, 66, 64, 62,
+        60, 58, 56, 54, 52, 49, 47, 44,
+        42, 41, 40, 40, 39, 39, 38, 38,
+        37, 37, 37, 36, 36, 36, 35, 35,
+        35, 35, 34, 34, 34, 34, 33, 33,
+        33, 33, 32, 32, 32, 32, 32, 31,
+        31, 31, 31, 31, 30, 30, 30, 30,
+        30,
+};
+
+static const u16 count_lut[] = {
+        0, 1, 2, 3, 4, 5, 6, 7,
+        8, 9, 10, 11, 12, 13, 14, 15,
+        16, 18, 20, 22, 24, 26, 28, 30,
+        32, 34, 36, 38, 40, 42, 44, 46,
+        49, 53, 57, 61, 65, 69, 73, 77,
+        81, 85, 89, 93, 97, 101, 105, 109,
+        115, 123, 131, 139, 147, 155, 163, 171,
+        179, 187, 195, 203, 211, 219, 227, 235,
+        247, 263, 279, 295, 311, 327, 343, 359,
+        375, 391, 407, 423, 439, 455, 471, 487,
+        511, 543, 575, 607, 639, 671, 703, 735,
+        767, 799, 831, 863, 895, 927, 959, 991,
+        1039, 1103, 1167, 1231, 1295, 1359, 1423, 1487,
+        1551, 1615, 1679, 1743, 1807, 1871, 1935, 1999,
+        2095, 2223, 2351, 2479, 2607, 2735, 2863, 2991,
+        3119, 3247, 3375, 3503, 3631, 3759, 3887, 4015,
+};
+
+/*
+ * This function is described into Taos TSL2550 Designer's Notebook
+ * pages 2, 3.
+ */
+static int tsl2550_calculate_lux(u8 ch0, u8 ch1)
+{
+        unsigned int lux;
+
+        /* Look up count from channel values */
+        u16 c0 = count_lut[ch0];
+        u16 c1 = count_lut[ch1];
+
+        /*
+         * Calculate ratio.
+         * Note: the "128" is a scaling factor
+         */
+        u8 r = 128;
+
+        /* Avoid division by 0 and count 1 cannot be greater than count 0 */
+        if (c1 <= c0)
+                if (c0) {
+                        r = c1 * 128 / c0;
+
+                        /* Calculate LUX */
+                        lux = ((c0 - c1) * ratio_lut[r]) / 256;
+                } else
+                        lux = 0;
+        else
+                return -EAGAIN;
+
+        /* LUX range check */
+        return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux;
+}
+
+/*
+ * SysFS support
+ */
+
+static ssize_t tsl2550_show_power_state(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(to_i2c_client(dev));
+
+        return sprintf(buf, "%u\n", data->power_state);
+}
+
+static ssize_t tsl2550_store_power_state(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        unsigned long val = simple_strtoul(buf, NULL, 10);
+        int ret;
+
+        if (val < 0 || val > 1)
+                return -EINVAL;
+
+        mutex_lock(&data->update_lock);
+        ret = tsl2550_set_power_state(client, val);
+        mutex_unlock(&data->update_lock);
+
+        if (ret < 0)
+                return ret;
+
+        return count;
+}
+
+static DEVICE_ATTR(power_state, S_IWUSR | S_IRUGO,
+                   tsl2550_show_power_state, tsl2550_store_power_state);
+
+static ssize_t tsl2550_show_operating_mode(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(to_i2c_client(dev));
+
+        return sprintf(buf, "%u\n", data->operating_mode);
+}
+
+static ssize_t tsl2550_store_operating_mode(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        unsigned long val = simple_strtoul(buf, NULL, 10);
+        int ret;
+
+        if (val < 0 || val > 1)
+                return -EINVAL;
+
+        if (data->power_state == 0)
+                return -EBUSY;
+
+        mutex_lock(&data->update_lock);
+        ret = tsl2550_set_operating_mode(client, val);
+        mutex_unlock(&data->update_lock);
+
+        if (ret < 0)
+                return ret;
+
+        return count;
+}
+
+static DEVICE_ATTR(operating_mode, S_IWUSR | S_IRUGO,
+                   tsl2550_show_operating_mode, tsl2550_store_operating_mode);
+
+static ssize_t __tsl2550_show_lux(struct i2c_client *client, char *buf)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        u8 ch0, ch1;
+        int ret;
+
+        ret = tsl2550_get_adc_value(client, TSL2550_READ_ADC0);
+        if (ret < 0)
+                return ret;
+        ch0 = ret;
+
+        ret = tsl2550_get_adc_value(client, TSL2550_READ_ADC1);
+        if (ret < 0)
+                return ret;
+        ch1 = ret;
+
+        /* Do the job */
+        ret = tsl2550_calculate_lux(ch0, ch1);
+        if (ret < 0)
+                return ret;
+        if (data->operating_mode == 1)
+                ret *= 5;
+
+        return sprintf(buf, "%d\n", ret);
+}
+
+static ssize_t tsl2550_show_lux1_input(struct device *dev,
+                        struct device_attribute *attr, char *buf)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        int ret;
+
+        /* No LUX data if not operational */
+        if (!data->power_state)
+                return -EBUSY;
+
+        mutex_lock(&data->update_lock);
+        ret = __tsl2550_show_lux(client, buf);
+        mutex_unlock(&data->update_lock);
+
+        return ret;
+}
+
+static DEVICE_ATTR(lux1_input, S_IRUGO,
+                   tsl2550_show_lux1_input, NULL);
+
+static struct attribute *tsl2550_attributes[] = {
+        &dev_attr_power_state.attr,
+        &dev_attr_operating_mode.attr,
+        &dev_attr_lux1_input.attr,
+        NULL
+};
+
+static const struct attribute_group tsl2550_attr_group = {
+        .attrs = tsl2550_attributes,
+};
+
+/*
+ * Initialization function
+ */
+
+static int tsl2550_init_client(struct i2c_client *client)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        int err;
+
+        /*
+         * Probe the chip. To do so we try to power up the device and then to
+         * read back the 0x03 code
+         */
+        err = i2c_smbus_read_byte_data(client, TSL2550_POWER_UP);
+        if (err < 0)
+                return err;
+        if (err != TSL2550_POWER_UP)
+                return -ENODEV;
+        data->power_state = 1;
+
+        /* Set the default operating mode */
+        err = i2c_smbus_write_byte(client,
+                                   TSL2550_MODE_RANGE[data->operating_mode]);
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
+/*
+ * I2C init/probing/exit functions
+ */
+
+static struct i2c_driver tsl2550_driver;
+static int __devinit tsl2550_probe(struct i2c_client *client,
+                                   const struct i2c_device_id *id)
+{
+        struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
+        struct tsl2550_data *data;
+        int *opmode, err = 0;
+
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_WRITE_BYTE
+                                            | I2C_FUNC_SMBUS_READ_BYTE_DATA)) {
+                err = -EIO;
+                goto exit;
+        }
+
+        data = kzalloc(sizeof(struct tsl2550_data), GFP_KERNEL);
+        if (!data) {
+                err = -ENOMEM;
+                goto exit;
+        }
+        data->client = client;
+        i2c_set_clientdata(client, data);
+
+        /* Check platform data */
+        opmode = client->dev.platform_data;
+        if (opmode) {
+                if (*opmode < 0 || *opmode > 1) {
+                        dev_err(&client->dev, "invalid operating_mode (%d)\n",
+                                        *opmode);
+                        err = -EINVAL;
+                        goto exit_kfree;
+                }
+                data->operating_mode = *opmode;
+        } else
+                data->operating_mode = 0;       /* default mode is standard */
+        dev_info(&client->dev, "%s operating mode\n",
+                        data->operating_mode ? "extended" : "standard");
+
+        mutex_init(&data->update_lock);
+
+        /* Initialize the TSL2550 chip */
+        err = tsl2550_init_client(client);
+        if (err)
+                goto exit_kfree;
+
+        /* Register sysfs hooks */
+        err = sysfs_create_group(&client->dev.kobj, &tsl2550_attr_group);
+        if (err)
+                goto exit_kfree;
+
+        dev_info(&client->dev, "support ver. %s enabled\n", DRIVER_VERSION);
+
+        return 0;
+
+exit_kfree:
+        kfree(data);
+exit:
+        return err;
+}
+
+static int __devexit tsl2550_remove(struct i2c_client *client)
+{
+        sysfs_remove_group(&client->dev.kobj, &tsl2550_attr_group);
+
+        /* Power down the device */
+        tsl2550_set_power_state(client, 0);
+
+        kfree(i2c_get_clientdata(client));
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+
+static int tsl2550_suspend(struct i2c_client *client, pm_message_t mesg)
+{
+        return tsl2550_set_power_state(client, 0);
+}
+
+static int tsl2550_resume(struct i2c_client *client)
+{
+        return tsl2550_set_power_state(client, 1);
+}
+
+#else
+
+#define tsl2550_suspend         NULL
+#define tsl2550_resume          NULL
+
+#endif /* CONFIG_PM */
+
+static const struct i2c_device_id tsl2550_id[] = {
+        { "tsl2550", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, tsl2550_id);
+
+static struct i2c_driver tsl2550_driver = {
+        .driver = {
+                .name   = TSL2550_DRV_NAME,
+                .owner  = THIS_MODULE,
+        },
+        .suspend = tsl2550_suspend,
+        .resume = tsl2550_resume,
+        .probe  = tsl2550_probe,
+        .remove = __devexit_p(tsl2550_remove),
+        .id_table = tsl2550_id,
+};
+
+static int __init tsl2550_init(void)
+{
+        return i2c_add_driver(&tsl2550_driver);
+}
+
+static void __exit tsl2550_exit(void)
+{
+        i2c_del_driver(&tsl2550_driver);
+}
+
+MODULE_AUTHOR("Rodolfo Giometti <giometti@linux.it>");
+MODULE_DESCRIPTION("TSL2550 ambient light sensor driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRIVER_VERSION);
+
+module_init(tsl2550_init);
+module_exit(tsl2550_exit);
diff --git a/drivers/misc/vmware_balloon.c b/drivers/misc/vmware_balloon.c
new file mode 100644
index 000000000000..e7161c4e3798
--- /dev/null
+++ b/drivers/misc/vmware_balloon.c
@@ -0,0 +1,832 @@
+/*
+ * VMware Balloon driver.
+ *
+ * Copyright (C) 2000-2010, VMware, Inc. All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ * NON INFRINGEMENT.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Maintained by: Dmitry Torokhov <dtor@vmware.com>
+ */
+
+/*
+ * This is VMware physical memory management driver for Linux. The driver
+ * acts like a "balloon" that can be inflated to reclaim physical pages by
+ * reserving them in the guest and invalidating them in the monitor,
+ * freeing up the underlying machine pages so they can be allocated to
+ * other guests.  The balloon can also be deflated to allow the guest to
+ * use more physical memory. Higher level policies can control the sizes
+ * of balloons in VMs in order to manage physical memory resources.
+ */
+
+//#define DEBUG
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/sched.h>
+#include <linux/module.h>
+#include <linux/workqueue.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include <asm/vmware.h>
+
+MODULE_AUTHOR("VMware, Inc.");
+MODULE_DESCRIPTION("VMware Memory Control (Balloon) Driver");
+MODULE_VERSION("1.2.1.0-K");
+MODULE_ALIAS("dmi:*:svnVMware*:*");
+MODULE_ALIAS("vmware_vmmemctl");
+MODULE_LICENSE("GPL");
+
+/*
+ * Various constants controlling rate of inflaint/deflating balloon,
+ * measured in pages.
+ */
+
+/*
+ * Rate of allocating memory when there is no memory pressure
+ * (driver performs non-sleeping allocations).
+ */
+#define VMW_BALLOON_NOSLEEP_ALLOC_MAX   16384U
+
+/*
+ * Rates of memory allocaton when guest experiences memory pressure
+ * (driver performs sleeping allocations).
+ */
+#define VMW_BALLOON_RATE_ALLOC_MIN      512U
+#define VMW_BALLOON_RATE_ALLOC_MAX      2048U
+#define VMW_BALLOON_RATE_ALLOC_INC      16U
+
+/*
+ * Rates for releasing pages while deflating balloon.
+ */
+#define VMW_BALLOON_RATE_FREE_MIN       512U
+#define VMW_BALLOON_RATE_FREE_MAX       16384U
+#define VMW_BALLOON_RATE_FREE_INC       16U
+
+/*
+ * When guest is under memory pressure, use a reduced page allocation
+ * rate for next several cycles.
+ */
+#define VMW_BALLOON_SLOW_CYCLES         4
+
+/*
+ * Use __GFP_HIGHMEM to allow pages from HIGHMEM zone. We don't
+ * allow wait (__GFP_WAIT) for NOSLEEP page allocations. Use
+ * __GFP_NOWARN, to suppress page allocation failure warnings.
+ */
+#define VMW_PAGE_ALLOC_NOSLEEP          (__GFP_HIGHMEM|__GFP_NOWARN)
+
+/*
+ * Use GFP_HIGHUSER when executing in a separate kernel thread
+ * context and allocation can sleep.  This is less stressful to
+ * the guest memory system, since it allows the thread to block
+ * while memory is reclaimed, and won't take pages from emergency
+ * low-memory pools.
+ */
+#define VMW_PAGE_ALLOC_CANSLEEP         (GFP_HIGHUSER)
+
+/* Maximum number of page allocations without yielding processor */
+#define VMW_BALLOON_YIELD_THRESHOLD     1024
+
+
+/*
+ * Hypervisor communication port definitions.
+ */
+#define VMW_BALLOON_HV_PORT             0x5670
+#define VMW_BALLOON_HV_MAGIC            0x456c6d6f
+#define VMW_BALLOON_PROTOCOL_VERSION    2
+#define VMW_BALLOON_GUEST_ID            1       /* Linux */
+
+#define VMW_BALLOON_CMD_START           0
+#define VMW_BALLOON_CMD_GET_TARGET      1
+#define VMW_BALLOON_CMD_LOCK            2
+#define VMW_BALLOON_CMD_UNLOCK          3
+#define VMW_BALLOON_CMD_GUEST_ID        4
+
+/* error codes */
+#define VMW_BALLOON_SUCCESS             0
+#define VMW_BALLOON_FAILURE             -1
+#define VMW_BALLOON_ERROR_CMD_INVALID   1
+#define VMW_BALLOON_ERROR_PPN_INVALID   2
+#define VMW_BALLOON_ERROR_PPN_LOCKED    3
+#define VMW_BALLOON_ERROR_PPN_UNLOCKED  4
+#define VMW_BALLOON_ERROR_PPN_PINNED    5
+#define VMW_BALLOON_ERROR_PPN_NOTNEEDED 6
+#define VMW_BALLOON_ERROR_RESET         7
+#define VMW_BALLOON_ERROR_BUSY          8
+
+#define VMWARE_BALLOON_CMD(cmd, data, result)           \
+({                                                      \
+        unsigned long __stat, __dummy1, __dummy2;       \
+        __asm__ __volatile__ ("inl (%%dx)" :            \
+                "=a"(__stat),                           \
+                "=c"(__dummy1),                         \
+                "=d"(__dummy2),                         \
+                "=b"(result) :                          \
+                "0"(VMW_BALLOON_HV_MAGIC),              \
+                "1"(VMW_BALLOON_CMD_##cmd),             \
+                "2"(VMW_BALLOON_HV_PORT),               \
+                "3"(data) :                             \
+                "memory");                              \
+        result &= -1UL;                                 \
+        __stat & -1UL;                                  \
+})
+
+#ifdef CONFIG_DEBUG_FS
+struct vmballoon_stats {
+        unsigned int timer;
+
+        /* allocation statustics */
+        unsigned int alloc;
+        unsigned int alloc_fail;
+        unsigned int sleep_alloc;
+        unsigned int sleep_alloc_fail;
+        unsigned int refused_alloc;
+        unsigned int refused_free;
+        unsigned int free;
+
+        /* monitor operations */
+        unsigned int lock;
+        unsigned int lock_fail;
+        unsigned int unlock;
+        unsigned int unlock_fail;
+        unsigned int target;
+        unsigned int target_fail;
+        unsigned int start;
+        unsigned int start_fail;
+        unsigned int guest_type;
+        unsigned int guest_type_fail;
+};
+
+#define STATS_INC(stat) (stat)++
+#else
+#define STATS_INC(stat)
+#endif
+
+struct vmballoon {
+
+        /* list of reserved physical pages */
+        struct list_head pages;
+
+        /* transient list of non-balloonable pages */
+        struct list_head refused_pages;
+
+        /* balloon size in pages */
+        unsigned int size;
+        unsigned int target;
+
+        /* reset flag */
+        bool reset_required;
+
+        /* adjustment rates (pages per second) */
+        unsigned int rate_alloc;
+        unsigned int rate_free;
+
+        /* slowdown page allocations for next few cycles */
+        unsigned int slow_allocation_cycles;
+
+#ifdef CONFIG_DEBUG_FS
+        /* statistics */
+        struct vmballoon_stats stats;
+
+        /* debugfs file exporting statistics */
+        struct dentry *dbg_entry;
+#endif
+
+        struct sysinfo sysinfo;
+
+        struct delayed_work dwork;
+};
+
+static struct vmballoon balloon;
+static struct workqueue_struct *vmballoon_wq;
+
+/*
+ * Send "start" command to the host, communicating supported version
+ * of the protocol.
+ */
+static bool vmballoon_send_start(struct vmballoon *b)
+{
+        unsigned long status, dummy;
+
+        STATS_INC(b->stats.start);
+
+        status = VMWARE_BALLOON_CMD(START, VMW_BALLOON_PROTOCOL_VERSION, dummy);
+        if (status == VMW_BALLOON_SUCCESS)
+                return true;
+
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.start_fail);
+        return false;
+}
+
+static bool vmballoon_check_status(struct vmballoon *b, unsigned long status)
+{
+        switch (status) {
+        case VMW_BALLOON_SUCCESS:
+                return true;
+
+        case VMW_BALLOON_ERROR_RESET:
+                b->reset_required = true;
+                /* fall through */
+
+        default:
+                return false;
+        }
+}
+
+/*
+ * Communicate guest type to the host so that it can adjust ballooning
+ * algorithm to the one most appropriate for the guest. This command
+ * is normally issued after sending "start" command and is part of
+ * standard reset sequence.
+ */
+static bool vmballoon_send_guest_id(struct vmballoon *b)
+{
+        unsigned long status, dummy;
+
+        status = VMWARE_BALLOON_CMD(GUEST_ID, VMW_BALLOON_GUEST_ID, dummy);
+
+        STATS_INC(b->stats.guest_type);
+
+        if (vmballoon_check_status(b, status))
+                return true;
+
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.guest_type_fail);
+        return false;
+}
+
+/*
+ * Retrieve desired balloon size from the host.
+ */
+static bool vmballoon_send_get_target(struct vmballoon *b, u32 *new_target)
+{
+        unsigned long status;
+        unsigned long target;
+        unsigned long limit;
+        u32 limit32;
+
+        /*
+         * si_meminfo() is cheap. Moreover, we want to provide dynamic
+         * max balloon size later. So let us call si_meminfo() every
+         * iteration.
+         */
+        si_meminfo(&b->sysinfo);
+        limit = b->sysinfo.totalram;
+
+        /* Ensure limit fits in 32-bits */
+        limit32 = (u32)limit;
+        if (limit != limit32)
+                return false;
+
+        /* update stats */
+        STATS_INC(b->stats.target);
+
+        status = VMWARE_BALLOON_CMD(GET_TARGET, limit, target);
+        if (vmballoon_check_status(b, status)) {
+                *new_target = target;
+                return true;
+        }
+
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.target_fail);
+        return false;
+}
+
+/*
+ * Notify the host about allocated page so that host can use it without
+ * fear that guest will need it. Host may reject some pages, we need to
+ * check the return value and maybe submit a different page.
+ */
+static bool vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn)
+{
+        unsigned long status, dummy;
+        u32 pfn32;
+
+        pfn32 = (u32)pfn;
+        if (pfn32 != pfn)
+                return false;
+
+        STATS_INC(b->stats.lock);
+
+        status = VMWARE_BALLOON_CMD(LOCK, pfn, dummy);
+        if (vmballoon_check_status(b, status))
+                return true;
+
+        pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
+        STATS_INC(b->stats.lock_fail);
+        return false;
+}
+
+/*
+ * Notify the host that guest intends to release given page back into
+ * the pool of available (to the guest) pages.
+ */
+static bool vmballoon_send_unlock_page(struct vmballoon *b, unsigned long pfn)
+{
+        unsigned long status, dummy;
+        u32 pfn32;
+
+        pfn32 = (u32)pfn;
+        if (pfn32 != pfn)
+                return false;
+
+        STATS_INC(b->stats.unlock);
+
+        status = VMWARE_BALLOON_CMD(UNLOCK, pfn, dummy);
+        if (vmballoon_check_status(b, status))
+                return true;
+
+        pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
+        STATS_INC(b->stats.unlock_fail);
+        return false;
+}
+
+/*
+ * Quickly release all pages allocated for the balloon. This function is
+ * called when host decides to "reset" balloon for one reason or another.
+ * Unlike normal "deflate" we do not (shall not) notify host of the pages
+ * being released.
+ */
+static void vmballoon_pop(struct vmballoon *b)
+{
+        struct page *page, *next;
+        unsigned int count = 0;
+
+        list_for_each_entry_safe(page, next, &b->pages, lru) {
+                list_del(&page->lru);
+                __free_page(page);
+                STATS_INC(b->stats.free);
+                b->size--;
+
+                if (++count >= b->rate_free) {
+                        count = 0;
+                        cond_resched();
+                }
+        }
+}
+
+/*
+ * Perform standard reset sequence by popping the balloon (in case it
+ * is not  empty) and then restarting protocol. This operation normally
+ * happens when host responds with VMW_BALLOON_ERROR_RESET to a command.
+ */
+static void vmballoon_reset(struct vmballoon *b)
+{
+        /* free all pages, skipping monitor unlock */
+        vmballoon_pop(b);
+
+        if (vmballoon_send_start(b)) {
+                b->reset_required = false;
+                if (!vmballoon_send_guest_id(b))
+                        pr_err("failed to send guest ID to the host\n");
+        }
+}
+
+/*
+ * Allocate (or reserve) a page for the balloon and notify the host.  If host
+ * refuses the page put it on "refuse" list and allocate another one until host
+ * is satisfied. "Refused" pages are released at the end of inflation cycle
+ * (when we allocate b->rate_alloc pages).
+ */
+static int vmballoon_reserve_page(struct vmballoon *b, bool can_sleep)
+{
+        struct page *page;
+        gfp_t flags;
+        bool locked = false;
+
+        do {
+                if (!can_sleep)
+                        STATS_INC(b->stats.alloc);
+                else
+                        STATS_INC(b->stats.sleep_alloc);
+
+                flags = can_sleep ? VMW_PAGE_ALLOC_CANSLEEP : VMW_PAGE_ALLOC_NOSLEEP;
+                page = alloc_page(flags);
+                if (!page) {
+                        if (!can_sleep)
+                                STATS_INC(b->stats.alloc_fail);
+                        else
+                                STATS_INC(b->stats.sleep_alloc_fail);
+                        return -ENOMEM;
+                }
+
+                /* inform monitor */
+                locked = vmballoon_send_lock_page(b, page_to_pfn(page));
+                if (!locked) {
+                        if (b->reset_required) {
+                                __free_page(page);
+                                return -EIO;
+                        }
+
+                        /* place on list of non-balloonable pages, retry allocation */
+                        list_add(&page->lru, &b->refused_pages);
+                        STATS_INC(b->stats.refused_alloc);
+                }
+        } while (!locked);
+
+        /* track allocated page */
+        list_add(&page->lru, &b->pages);
+
+        /* update balloon size */
+        b->size++;
+
+        return 0;
+}
+
+/*
+ * Release the page allocated for the balloon. Note that we first notify
+ * the host so it can make sure the page will be available for the guest
+ * to use, if needed.
+ */
+static int vmballoon_release_page(struct vmballoon *b, struct page *page)
+{
+        if (!vmballoon_send_unlock_page(b, page_to_pfn(page)))
+                return -EIO;
+
+        list_del(&page->lru);
+
+        /* deallocate page */
+        __free_page(page);
+        STATS_INC(b->stats.free);
+
+        /* update balloon size */
+        b->size--;
+
+        return 0;
+}
+
+/*
+ * Release pages that were allocated while attempting to inflate the
+ * balloon but were refused by the host for one reason or another.
+ */
+static void vmballoon_release_refused_pages(struct vmballoon *b)
+{
+        struct page *page, *next;
+
+        list_for_each_entry_safe(page, next, &b->refused_pages, lru) {
+                list_del(&page->lru);
+                __free_page(page);
+                STATS_INC(b->stats.refused_free);
+        }
+}
+
+/*
+ * Inflate the balloon towards its target size. Note that we try to limit
+ * the rate of allocation to make sure we are not choking the rest of the
+ * system.
+ */
+static void vmballoon_inflate(struct vmballoon *b)
+{
+        unsigned int goal;
+        unsigned int rate;
+        unsigned int i;
+        unsigned int allocations = 0;
+        int error = 0;
+        bool alloc_can_sleep = false;
+
+        pr_debug("%s - size: %d, target %d\n", __func__, b->size, b->target);
+
+        /*
+         * First try NOSLEEP page allocations to inflate balloon.
+         *
+         * If we do not throttle nosleep allocations, we can drain all
+         * free pages in the guest quickly (if the balloon target is high).
+         * As a side-effect, draining free pages helps to inform (force)
+         * the guest to start swapping if balloon target is not met yet,
+         * which is a desired behavior. However, balloon driver can consume
+         * all available CPU cycles if too many pages are allocated in a
+         * second. Therefore, we throttle nosleep allocations even when
+         * the guest is not under memory pressure. OTOH, if we have already
+         * predicted that the guest is under memory pressure, then we
+         * slowdown page allocations considerably.
+         */
+
+        goal = b->target - b->size;
+        /*
+         * Start with no sleep allocation rate which may be higher
+         * than sleeping allocation rate.
+         */
+        rate = b->slow_allocation_cycles ?
+                        b->rate_alloc : VMW_BALLOON_NOSLEEP_ALLOC_MAX;
+
+        pr_debug("%s - goal: %d, no-sleep rate: %d, sleep rate: %d\n",
+                 __func__, goal, rate, b->rate_alloc);
+
+        for (i = 0; i < goal; i++) {
+
+                error = vmballoon_reserve_page(b, alloc_can_sleep);
+                if (error) {
+                        if (error != -ENOMEM) {
+                                /*
+                                 * Not a page allocation failure, stop this
+                                 * cycle. Maybe we'll get new target from
+                                 * the host soon.
+                                 */
+                                break;
+                        }
+
+                        if (alloc_can_sleep) {
+                                /*
+                                 * CANSLEEP page allocation failed, so guest
+                                 * is under severe memory pressure. Quickly
+                                 * decrease allocation rate.
+                                 */
+                                b->rate_alloc = max(b->rate_alloc / 2,
+                                                    VMW_BALLOON_RATE_ALLOC_MIN);
+                                break;
+                        }
+
+                        /*
+                         * NOSLEEP page allocation failed, so the guest is
+                         * under memory pressure. Let us slow down page
+                         * allocations for next few cycles so that the guest
+                         * gets out of memory pressure. Also, if we already
+                         * allocated b->rate_alloc pages, let's pause,
+                         * otherwise switch to sleeping allocations.
+                         */
+                        b->slow_allocation_cycles = VMW_BALLOON_SLOW_CYCLES;
+
+                        if (i >= b->rate_alloc)
+                                break;
+
+                        alloc_can_sleep = true;
+                        /* Lower rate for sleeping allocations. */
+                        rate = b->rate_alloc;
+                }
+
+                if (++allocations > VMW_BALLOON_YIELD_THRESHOLD) {
+                        cond_resched();
+                        allocations = 0;
+                }
+
+                if (i >= rate) {
+                        /* We allocated enough pages, let's take a break. */
+                        break;
+                }
+        }
+
+        /*
+         * We reached our goal without failures so try increasing
+         * allocation rate.
+         */
+        if (error == 0 && i >= b->rate_alloc) {
+                unsigned int mult = i / b->rate_alloc;
+
+                b->rate_alloc =
+                        min(b->rate_alloc + mult * VMW_BALLOON_RATE_ALLOC_INC,
+                            VMW_BALLOON_RATE_ALLOC_MAX);
+        }
+
+        vmballoon_release_refused_pages(b);
+}
+
+/*
+ * Decrease the size of the balloon allowing guest to use more memory.
+ */
+static void vmballoon_deflate(struct vmballoon *b)
+{
+        struct page *page, *next;
+        unsigned int i = 0;
+        unsigned int goal;
+        int error;
+
+        pr_debug("%s - size: %d, target %d\n", __func__, b->size, b->target);
+
+        /* limit deallocation rate */
+        goal = min(b->size - b->target, b->rate_free);
+
+        pr_debug("%s - goal: %d, rate: %d\n", __func__, goal, b->rate_free);
+
+        /* free pages to reach target */
+        list_for_each_entry_safe(page, next, &b->pages, lru) {
+                error = vmballoon_release_page(b, page);
+                if (error) {
+                        /* quickly decrease rate in case of error */
+                        b->rate_free = max(b->rate_free / 2,
+                                           VMW_BALLOON_RATE_FREE_MIN);
+                        return;
+                }
+
+                if (++i >= goal)
+                        break;
+        }
+
+        /* slowly increase rate if there were no errors */
+        b->rate_free = min(b->rate_free + VMW_BALLOON_RATE_FREE_INC,
+                           VMW_BALLOON_RATE_FREE_MAX);
+}
+
+/*
+ * Balloon work function: reset protocol, if needed, get the new size and
+ * adjust balloon as needed. Repeat in 1 sec.
+ */
+static void vmballoon_work(struct work_struct *work)
+{
+        struct delayed_work *dwork = to_delayed_work(work);
+        struct vmballoon *b = container_of(dwork, struct vmballoon, dwork);
+        unsigned int target;
+
+        STATS_INC(b->stats.timer);
+
+        if (b->reset_required)
+                vmballoon_reset(b);
+
+        if (b->slow_allocation_cycles > 0)
+                b->slow_allocation_cycles--;
+
+        if (vmballoon_send_get_target(b, &target)) {
+                /* update target, adjust size */
+                b->target = target;
+
+                if (b->size < target)
+                        vmballoon_inflate(b);
+                else if (b->size > target)
+                        vmballoon_deflate(b);
+        }
+
+        queue_delayed_work(vmballoon_wq, dwork, round_jiffies_relative(HZ));
+}
+
+/*
+ * DEBUGFS Interface
+ */
+#ifdef CONFIG_DEBUG_FS
+
+static int vmballoon_debug_show(struct seq_file *f, void *offset)
+{
+        struct vmballoon *b = f->private;
+        struct vmballoon_stats *stats = &b->stats;
+
+        /* format size info */
+        seq_printf(f,
+                   "target:             %8d pages\n"
+                   "current:            %8d pages\n",
+                   b->target, b->size);
+
+        /* format rate info */
+        seq_printf(f,
+                   "rateNoSleepAlloc:   %8d pages/sec\n"
+                   "rateSleepAlloc:     %8d pages/sec\n"
+                   "rateFree:           %8d pages/sec\n",
+                   VMW_BALLOON_NOSLEEP_ALLOC_MAX,
+                   b->rate_alloc, b->rate_free);
+
+        seq_printf(f,
+                   "\n"
+                   "timer:              %8u\n"
+                   "start:              %8u (%4u failed)\n"
+                   "guestType:          %8u (%4u failed)\n"
+                   "lock:               %8u (%4u failed)\n"
+                   "unlock:             %8u (%4u failed)\n"
+                   "target:             %8u (%4u failed)\n"
+                   "primNoSleepAlloc:   %8u (%4u failed)\n"
+                   "primCanSleepAlloc:  %8u (%4u failed)\n"
+                   "primFree:           %8u\n"
+                   "errAlloc:           %8u\n"
+                   "errFree:            %8u\n",
+                   stats->timer,
+                   stats->start, stats->start_fail,
+                   stats->guest_type, stats->guest_type_fail,
+                   stats->lock,  stats->lock_fail,
+                   stats->unlock, stats->unlock_fail,
+                   stats->target, stats->target_fail,
+                   stats->alloc, stats->alloc_fail,
+                   stats->sleep_alloc, stats->sleep_alloc_fail,
+                   stats->free,
+                   stats->refused_alloc, stats->refused_free);
+
+        return 0;
+}
+
+static int vmballoon_debug_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, vmballoon_debug_show, inode->i_private);
+}
+
+static const struct file_operations vmballoon_debug_fops = {
+        .owner          = THIS_MODULE,
+        .open           = vmballoon_debug_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int __init vmballoon_debugfs_init(struct vmballoon *b)
+{
+        int error;
+
+        b->dbg_entry = debugfs_create_file("vmmemctl", S_IRUGO, NULL, b,
+                                           &vmballoon_debug_fops);
+        if (IS_ERR(b->dbg_entry)) {
+                error = PTR_ERR(b->dbg_entry);
+                pr_err("failed to create debugfs entry, error: %d\n", error);
+                return error;
+        }
+
+        return 0;
+}
+
+static void __exit vmballoon_debugfs_exit(struct vmballoon *b)
+{
+        debugfs_remove(b->dbg_entry);
+}
+
+#else
+
+static inline int vmballoon_debugfs_init(struct vmballoon *b)
+{
+        return 0;
+}
+
+static inline void vmballoon_debugfs_exit(struct vmballoon *b)
+{
+}
+
+#endif  /* CONFIG_DEBUG_FS */
+
+static int __init vmballoon_init(void)
+{
+        int error;
+
+        /*
+         * Check if we are running on VMware's hypervisor and bail out
+         * if we are not.
+         */
+        if (!vmware_platform())
+                return -ENODEV;
+
+        vmballoon_wq = create_freezeable_workqueue("vmmemctl");
+        if (!vmballoon_wq) {
+                pr_err("failed to create workqueue\n");
+                return -ENOMEM;
+        }
+
+        INIT_LIST_HEAD(&balloon.pages);
+        INIT_LIST_HEAD(&balloon.refused_pages);
+
+        /* initialize rates */
+        balloon.rate_alloc = VMW_BALLOON_RATE_ALLOC_MAX;
+        balloon.rate_free = VMW_BALLOON_RATE_FREE_MAX;
+
+        INIT_DELAYED_WORK(&balloon.dwork, vmballoon_work);
+
+        /*
+         * Start balloon.
+         */
+        if (!vmballoon_send_start(&balloon)) {
+                pr_err("failed to send start command to the host\n");
+                error = -EIO;
+                goto fail;
+        }
+
+        if (!vmballoon_send_guest_id(&balloon)) {
+                pr_err("failed to send guest ID to the host\n");
+                error = -EIO;
+                goto fail;
+        }
+
+        error = vmballoon_debugfs_init(&balloon);
+        if (error)
+                goto fail;
+
+        queue_delayed_work(vmballoon_wq, &balloon.dwork, 0);
+
+        return 0;
+
+fail:
+        destroy_workqueue(vmballoon_wq);
+        return error;
+}
+module_init(vmballoon_init);
+
+static void __exit vmballoon_exit(void)
+{
+        cancel_delayed_work_sync(&balloon.dwork);
+        destroy_workqueue(vmballoon_wq);
+
+        vmballoon_debugfs_exit(&balloon);
+
+        /*
+         * Deallocate all reserved memory, and reset connection with monitor.
+         * Reset connection before deallocating memory to avoid potential for
+         * additional spurious resets from guest touching deallocated pages.
+         */
+        vmballoon_send_start(&balloon);
+        vmballoon_pop(&balloon);
+}
+module_exit(vmballoon_exit);