Merge commit 'upstream/master'

9 files changed, 1824 insertions, 149 deletions

diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 1921b8dbb242..321eb9134635 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -77,11 +77,13 @@ config IBM_ASM
           for your IBM server.
 
 config PHANTOM
-        tristate "Sensable PHANToM"
+        tristate "Sensable PHANToM (PCI)"
         depends on PCI
         help
           Say Y here if you want to build a driver for Sensable PHANToM device.
 
+          This driver is only for PCI PHANToMs.
+
           If you choose to build module, its name will be phantom. If unsure,
           say N here.
 
@@ -212,6 +214,18 @@ config TC1100_WMI
           This is a driver for the WMI extensions (wireless and bluetooth power
           control) of the HP Compaq TC1100 tablet.
 
+config HP_WMI
+       tristate "HP WMI extras"
+       depends on ACPI_WMI
+       depends on INPUT
+       depends on RFKILL
+       help
+         Say Y here if you want to support WMI-based hotkeys on HP laptops and
+         to read data from WMI such as docking or ambient light sensor state.
+
+         To compile this driver as a module, choose M here: the module will
+         be called hp-wmi.
+
 config MSI_LAPTOP
         tristate "MSI Laptop Extras"
         depends on X86
@@ -279,6 +293,8 @@ config THINKPAD_ACPI
         select INPUT
         select NEW_LEDS
         select LEDS_CLASS
+        select NET
+        select RFKILL
         ---help---
           This is a driver for the IBM and Lenovo ThinkPad laptops. It adds
           support for Fn-Fx key combinations, Bluetooth control, video
@@ -420,4 +436,18 @@ config SGI_XP
           this feature will allow for direct communication between SSIs
           based on a network adapter and DMA messaging.
 
+config HP_ILO
+        tristate "Channel interface driver for HP iLO/iLO2 processor"
+        depends on PCI
+        default n
+        help
+          The channel interface driver allows applications to communicate
+          with iLO/iLO2 management processors present on HP ProLiant
+          servers.  Upon loading, the driver creates /dev/hpilo/dXccbN files,
+          which can be used to gather data from the management processor,
+          via read and write system calls.
+
+          To compile this driver as a module, choose M here: the
+          module will be called hpilo.
+
 endif # MISC_DEVICES
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index a6dac6a2e7e5..f5e273420c09 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -13,6 +13,7 @@ obj-$(CONFIG_ACER_WMI)		+= acer-wmi.o
 obj-$(CONFIG_ATMEL_PWM)         += atmel_pwm.o
 obj-$(CONFIG_ATMEL_SSC)         += atmel-ssc.o
 obj-$(CONFIG_ATMEL_TCLIB)       += atmel_tclib.o
+obj-$(CONFIG_HP_WMI)            += hp-wmi.o
 obj-$(CONFIG_TC1100_WMI)        += tc1100-wmi.o
 obj-$(CONFIG_LKDTM)             += lkdtm.o
 obj-$(CONFIG_TIFM_CORE)         += tifm_core.o
@@ -27,3 +28,4 @@ obj-$(CONFIG_INTEL_MENLOW)	+= intel_menlow.o
 obj-$(CONFIG_ENCLOSURE_SERVICES) += enclosure.o
 obj-$(CONFIG_KGDB_TESTS)        += kgdbts.o
 obj-$(CONFIG_SGI_XP)            += sgi-xp/
+obj-$(CONFIG_HP_ILO)            += hpilo.o
diff --git a/drivers/misc/atmel_pwm.c b/drivers/misc/atmel_pwm.c
index 5b5a14dab3d3..6aa5294dfec4 100644
--- a/drivers/misc/atmel_pwm.c
+++ b/drivers/misc/atmel_pwm.c
@@ -211,8 +211,7 @@ int pwm_clk_alloc(unsigned prescale, unsigned div)
         if ((mr & 0xffff) == 0) {
                 mr |= val;
                 ret = PWM_CPR_CLKA;
-        }
-        if ((mr & (0xffff << 16)) == 0) {
+        } else if ((mr & (0xffff << 16)) == 0) {
                 mr |= val << 16;
                 ret = PWM_CPR_CLKB;
         }
diff --git a/drivers/misc/hp-wmi.c b/drivers/misc/hp-wmi.c
new file mode 100644
index 000000000000..1dbcbcb323a2
--- /dev/null
+++ b/drivers/misc/hp-wmi.c
@@ -0,0 +1,494 @@
+/*
+ * HP WMI hotkeys
+ *
+ * Copyright (C) 2008 Red Hat <mjg@redhat.com>
+ *
+ * Portions based on wistron_btns.c:
+ * Copyright (C) 2005 Miloslav Trmac <mitr@volny.cz>
+ * Copyright (C) 2005 Bernhard Rosenkraenzer <bero@arklinux.org>
+ * Copyright (C) 2005 Dmitry Torokhov <dtor@mail.ru>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/input.h>
+#include <acpi/acpi_drivers.h>
+#include <linux/platform_device.h>
+#include <linux/acpi.h>
+#include <linux/rfkill.h>
+#include <linux/string.h>
+
+MODULE_AUTHOR("Matthew Garrett <mjg59@srcf.ucam.org>");
+MODULE_DESCRIPTION("HP laptop WMI hotkeys driver");
+MODULE_LICENSE("GPL");
+
+MODULE_ALIAS("wmi:95F24279-4D7B-4334-9387-ACCDC67EF61C");
+MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE91-3D44E2C707E4");
+
+#define HPWMI_EVENT_GUID "95F24279-4D7B-4334-9387-ACCDC67EF61C"
+#define HPWMI_BIOS_GUID "5FB7F034-2C63-45e9-BE91-3D44E2C707E4"
+
+#define HPWMI_DISPLAY_QUERY 0x1
+#define HPWMI_HDDTEMP_QUERY 0x2
+#define HPWMI_ALS_QUERY 0x3
+#define HPWMI_DOCK_QUERY 0x4
+#define HPWMI_WIRELESS_QUERY 0x5
+
+static int __init hp_wmi_bios_setup(struct platform_device *device);
+static int __exit hp_wmi_bios_remove(struct platform_device *device);
+
+struct bios_args {
+        u32 signature;
+        u32 command;
+        u32 commandtype;
+        u32 datasize;
+        u32 data;
+};
+
+struct bios_return {
+        u32 sigpass;
+        u32 return_code;
+        u32 value;
+};
+
+struct key_entry {
+        char type;              /* See KE_* below */
+        u8 code;
+        u16 keycode;
+};
+
+enum { KE_KEY, KE_SW, KE_END };
+
+static struct key_entry hp_wmi_keymap[] = {
+        {KE_SW, 0x01, SW_DOCK},
+        {KE_KEY, 0x02, KEY_BRIGHTNESSUP},
+        {KE_KEY, 0x03, KEY_BRIGHTNESSDOWN},
+        {KE_KEY, 0x04, KEY_HELP},
+        {KE_END, 0}
+};
+
+static struct input_dev *hp_wmi_input_dev;
+static struct platform_device *hp_wmi_platform_dev;
+
+static struct rfkill *wifi_rfkill;
+static struct rfkill *bluetooth_rfkill;
+static struct rfkill *wwan_rfkill;
+
+static struct platform_driver hp_wmi_driver = {
+        .driver = {
+                   .name = "hp-wmi",
+                   .owner = THIS_MODULE,
+        },
+        .probe = hp_wmi_bios_setup,
+        .remove = hp_wmi_bios_remove,
+};
+
+static int hp_wmi_perform_query(int query, int write, int value)
+{
+        struct bios_return bios_return;
+        acpi_status status;
+        union acpi_object *obj;
+        struct bios_args args = {
+                .signature = 0x55434553,
+                .command = write ? 0x2 : 0x1,
+                .commandtype = query,
+                .datasize = write ? 0x4 : 0,
+                .data = value,
+        };
+        struct acpi_buffer input = { sizeof(struct bios_args), &args };
+        struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
+
+        status = wmi_evaluate_method(HPWMI_BIOS_GUID, 0, 0x3, &input, &output);
+
+        obj = output.pointer;
+
+        if (!obj || obj->type != ACPI_TYPE_BUFFER)
+                return -EINVAL;
+
+        bios_return = *((struct bios_return *)obj->buffer.pointer);
+        if (bios_return.return_code > 0)
+                return bios_return.return_code * -1;
+        else
+                return bios_return.value;
+}
+
+static int hp_wmi_display_state(void)
+{
+        return hp_wmi_perform_query(HPWMI_DISPLAY_QUERY, 0, 0);
+}
+
+static int hp_wmi_hddtemp_state(void)
+{
+        return hp_wmi_perform_query(HPWMI_HDDTEMP_QUERY, 0, 0);
+}
+
+static int hp_wmi_als_state(void)
+{
+        return hp_wmi_perform_query(HPWMI_ALS_QUERY, 0, 0);
+}
+
+static int hp_wmi_dock_state(void)
+{
+        return hp_wmi_perform_query(HPWMI_DOCK_QUERY, 0, 0);
+}
+
+static int hp_wmi_wifi_set(void *data, enum rfkill_state state)
+{
+        if (state)
+                return hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, 0x101);
+        else
+                return hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, 0x100);
+}
+
+static int hp_wmi_bluetooth_set(void *data, enum rfkill_state state)
+{
+        if (state)
+                return hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, 0x202);
+        else
+                return hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, 0x200);
+}
+
+static int hp_wmi_wwan_set(void *data, enum rfkill_state state)
+{
+        if (state)
+                return hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, 0x404);
+        else
+                return hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, 0x400);
+}
+
+static int hp_wmi_wifi_state(void)
+{
+        int wireless = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 0, 0);
+
+        if (wireless & 0x100)
+                return 1;
+        else
+                return 0;
+}
+
+static int hp_wmi_bluetooth_state(void)
+{
+        int wireless = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 0, 0);
+
+        if (wireless & 0x10000)
+                return 1;
+        else
+                return 0;
+}
+
+static int hp_wmi_wwan_state(void)
+{
+        int wireless = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 0, 0);
+
+        if (wireless & 0x1000000)
+                return 1;
+        else
+                return 0;
+}
+
+static ssize_t show_display(struct device *dev, struct device_attribute *attr,
+                            char *buf)
+{
+        int value = hp_wmi_display_state();
+        if (value < 0)
+                return -EINVAL;
+        return sprintf(buf, "%d\n", value);
+}
+
+static ssize_t show_hddtemp(struct device *dev, struct device_attribute *attr,
+                            char *buf)
+{
+        int value = hp_wmi_hddtemp_state();
+        if (value < 0)
+                return -EINVAL;
+        return sprintf(buf, "%d\n", value);
+}
+
+static ssize_t show_als(struct device *dev, struct device_attribute *attr,
+                        char *buf)
+{
+        int value = hp_wmi_als_state();
+        if (value < 0)
+                return -EINVAL;
+        return sprintf(buf, "%d\n", value);
+}
+
+static ssize_t show_dock(struct device *dev, struct device_attribute *attr,
+                         char *buf)
+{
+        int value = hp_wmi_dock_state();
+        if (value < 0)
+                return -EINVAL;
+        return sprintf(buf, "%d\n", value);
+}
+
+static ssize_t set_als(struct device *dev, struct device_attribute *attr,
+                       const char *buf, size_t count)
+{
+        u32 tmp = simple_strtoul(buf, NULL, 10);
+        hp_wmi_perform_query(HPWMI_ALS_QUERY, 1, tmp);
+        return count;
+}
+
+static DEVICE_ATTR(display, S_IRUGO, show_display, NULL);
+static DEVICE_ATTR(hddtemp, S_IRUGO, show_hddtemp, NULL);
+static DEVICE_ATTR(als, S_IRUGO | S_IWUSR, show_als, set_als);
+static DEVICE_ATTR(dock, S_IRUGO, show_dock, NULL);
+
+static struct key_entry *hp_wmi_get_entry_by_scancode(int code)
+{
+        struct key_entry *key;
+
+        for (key = hp_wmi_keymap; key->type != KE_END; key++)
+                if (code == key->code)
+                        return key;
+
+        return NULL;
+}
+
+static struct key_entry *hp_wmi_get_entry_by_keycode(int keycode)
+{
+        struct key_entry *key;
+
+        for (key = hp_wmi_keymap; key->type != KE_END; key++)
+                if (key->type == KE_KEY && keycode == key->keycode)
+                        return key;
+
+        return NULL;
+}
+
+static int hp_wmi_getkeycode(struct input_dev *dev, int scancode, int *keycode)
+{
+        struct key_entry *key = hp_wmi_get_entry_by_scancode(scancode);
+
+        if (key && key->type == KE_KEY) {
+                *keycode = key->keycode;
+                return 0;
+        }
+
+        return -EINVAL;
+}
+
+static int hp_wmi_setkeycode(struct input_dev *dev, int scancode, int keycode)
+{
+        struct key_entry *key;
+        int old_keycode;
+
+        if (keycode < 0 || keycode > KEY_MAX)
+                return -EINVAL;
+
+        key = hp_wmi_get_entry_by_scancode(scancode);
+        if (key && key->type == KE_KEY) {
+                old_keycode = key->keycode;
+                key->keycode = keycode;
+                set_bit(keycode, dev->keybit);
+                if (!hp_wmi_get_entry_by_keycode(old_keycode))
+                        clear_bit(old_keycode, dev->keybit);
+                return 0;
+        }
+
+        return -EINVAL;
+}
+
+void hp_wmi_notify(u32 value, void *context)
+{
+        struct acpi_buffer response = { ACPI_ALLOCATE_BUFFER, NULL };
+        static struct key_entry *key;
+        union acpi_object *obj;
+
+        wmi_get_event_data(value, &response);
+
+        obj = (union acpi_object *)response.pointer;
+
+        if (obj && obj->type == ACPI_TYPE_BUFFER && obj->buffer.length == 8) {
+                int eventcode = *((u8 *) obj->buffer.pointer);
+                key = hp_wmi_get_entry_by_scancode(eventcode);
+                if (key) {
+                        switch (key->type) {
+                        case KE_KEY:
+                                input_report_key(hp_wmi_input_dev,
+                                                 key->keycode, 1);
+                                input_sync(hp_wmi_input_dev);
+                                input_report_key(hp_wmi_input_dev,
+                                                 key->keycode, 0);
+                                input_sync(hp_wmi_input_dev);
+                                break;
+                        case KE_SW:
+                                input_report_switch(hp_wmi_input_dev,
+                                                    key->keycode,
+                                                    hp_wmi_dock_state());
+                                input_sync(hp_wmi_input_dev);
+                                break;
+                        }
+                } else if (eventcode == 0x5) {
+                        if (wifi_rfkill)
+                                wifi_rfkill->state = hp_wmi_wifi_state();
+                        if (bluetooth_rfkill)
+                                bluetooth_rfkill->state =
+                                    hp_wmi_bluetooth_state();
+                        if (wwan_rfkill)
+                                wwan_rfkill->state = hp_wmi_wwan_state();
+                } else
+                        printk(KERN_INFO "HP WMI: Unknown key pressed - %x\n",
+                               eventcode);
+        } else
+                printk(KERN_INFO "HP WMI: Unknown response received\n");
+}
+
+static int __init hp_wmi_input_setup(void)
+{
+        struct key_entry *key;
+        int err;
+
+        hp_wmi_input_dev = input_allocate_device();
+
+        hp_wmi_input_dev->name = "HP WMI hotkeys";
+        hp_wmi_input_dev->phys = "wmi/input0";
+        hp_wmi_input_dev->id.bustype = BUS_HOST;
+        hp_wmi_input_dev->getkeycode = hp_wmi_getkeycode;
+        hp_wmi_input_dev->setkeycode = hp_wmi_setkeycode;
+
+        for (key = hp_wmi_keymap; key->type != KE_END; key++) {
+                switch (key->type) {
+                case KE_KEY:
+                        set_bit(EV_KEY, hp_wmi_input_dev->evbit);
+                        set_bit(key->keycode, hp_wmi_input_dev->keybit);
+                        break;
+                case KE_SW:
+                        set_bit(EV_SW, hp_wmi_input_dev->evbit);
+                        set_bit(key->keycode, hp_wmi_input_dev->swbit);
+                        break;
+                }
+        }
+
+        err = input_register_device(hp_wmi_input_dev);
+
+        if (err) {
+                input_free_device(hp_wmi_input_dev);
+                return err;
+        }
+
+        return 0;
+}
+
+static void cleanup_sysfs(struct platform_device *device)
+{
+        device_remove_file(&device->dev, &dev_attr_display);
+        device_remove_file(&device->dev, &dev_attr_hddtemp);
+        device_remove_file(&device->dev, &dev_attr_als);
+        device_remove_file(&device->dev, &dev_attr_dock);
+}
+
+static int __init hp_wmi_bios_setup(struct platform_device *device)
+{
+        int err;
+
+        err = device_create_file(&device->dev, &dev_attr_display);
+        if (err)
+                goto add_sysfs_error;
+        err = device_create_file(&device->dev, &dev_attr_hddtemp);
+        if (err)
+                goto add_sysfs_error;
+        err = device_create_file(&device->dev, &dev_attr_als);
+        if (err)
+                goto add_sysfs_error;
+        err = device_create_file(&device->dev, &dev_attr_dock);
+        if (err)
+                goto add_sysfs_error;
+
+        wifi_rfkill = rfkill_allocate(&device->dev, RFKILL_TYPE_WLAN);
+        wifi_rfkill->name = "hp-wifi";
+        wifi_rfkill->state = hp_wmi_wifi_state();
+        wifi_rfkill->toggle_radio = hp_wmi_wifi_set;
+        wifi_rfkill->user_claim_unsupported = 1;
+
+        bluetooth_rfkill = rfkill_allocate(&device->dev,
+                                           RFKILL_TYPE_BLUETOOTH);
+        bluetooth_rfkill->name = "hp-bluetooth";
+        bluetooth_rfkill->state = hp_wmi_bluetooth_state();
+        bluetooth_rfkill->toggle_radio = hp_wmi_bluetooth_set;
+        bluetooth_rfkill->user_claim_unsupported = 1;
+
+        wwan_rfkill = rfkill_allocate(&device->dev, RFKILL_TYPE_WIMAX);
+        wwan_rfkill->name = "hp-wwan";
+        wwan_rfkill->state = hp_wmi_wwan_state();
+        wwan_rfkill->toggle_radio = hp_wmi_wwan_set;
+        wwan_rfkill->user_claim_unsupported = 1;
+
+        rfkill_register(wifi_rfkill);
+        rfkill_register(bluetooth_rfkill);
+        rfkill_register(wwan_rfkill);
+
+        return 0;
+add_sysfs_error:
+        cleanup_sysfs(device);
+        return err;
+}
+
+static int __exit hp_wmi_bios_remove(struct platform_device *device)
+{
+        cleanup_sysfs(device);
+
+        rfkill_unregister(wifi_rfkill);
+        rfkill_unregister(bluetooth_rfkill);
+        rfkill_unregister(wwan_rfkill);
+
+        return 0;
+}
+
+static int __init hp_wmi_init(void)
+{
+        int err;
+
+        if (wmi_has_guid(HPWMI_EVENT_GUID)) {
+                err = wmi_install_notify_handler(HPWMI_EVENT_GUID,
+                                                 hp_wmi_notify, NULL);
+                if (!err)
+                        hp_wmi_input_setup();
+        }
+
+        if (wmi_has_guid(HPWMI_BIOS_GUID)) {
+                err = platform_driver_register(&hp_wmi_driver);
+                if (err)
+                        return 0;
+                hp_wmi_platform_dev = platform_device_alloc("hp-wmi", -1);
+                if (!hp_wmi_platform_dev) {
+                        platform_driver_unregister(&hp_wmi_driver);
+                        return 0;
+                }
+                platform_device_add(hp_wmi_platform_dev);
+        }
+
+        return 0;
+}
+
+static void __exit hp_wmi_exit(void)
+{
+        if (wmi_has_guid(HPWMI_EVENT_GUID)) {
+                wmi_remove_notify_handler(HPWMI_EVENT_GUID);
+                input_unregister_device(hp_wmi_input_dev);
+        }
+        if (hp_wmi_platform_dev) {
+                platform_device_del(hp_wmi_platform_dev);
+                platform_driver_unregister(&hp_wmi_driver);
+        }
+}
+
+module_init(hp_wmi_init);
+module_exit(hp_wmi_exit);
diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
new file mode 100644
index 000000000000..05e298289238
--- /dev/null
+++ b/drivers/misc/hpilo.c
@@ -0,0 +1,768 @@
+/*
+ * Driver for HP iLO/iLO2 management processor.
+ *
+ * Copyright (C) 2008 Hewlett-Packard Development Company, L.P.
+ *      David Altobelli <david.altobelli@hp.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/pci.h>
+#include <linux/ioport.h>
+#include <linux/device.h>
+#include <linux/file.h>
+#include <linux/cdev.h>
+#include <linux/spinlock.h>
+#include <linux/delay.h>
+#include <linux/uaccess.h>
+#include <linux/io.h>
+#include "hpilo.h"
+
+static struct class *ilo_class;
+static unsigned int ilo_major;
+static char ilo_hwdev[MAX_ILO_DEV];
+
+static inline int get_entry_id(int entry)
+{
+        return (entry & ENTRY_MASK_DESCRIPTOR) >> ENTRY_BITPOS_DESCRIPTOR;
+}
+
+static inline int get_entry_len(int entry)
+{
+        return ((entry & ENTRY_MASK_QWORDS) >> ENTRY_BITPOS_QWORDS) << 3;
+}
+
+static inline int mk_entry(int id, int len)
+{
+        int qlen = len & 7 ? (len >> 3) + 1 : len >> 3;
+        return id << ENTRY_BITPOS_DESCRIPTOR | qlen << ENTRY_BITPOS_QWORDS;
+}
+
+static inline int desc_mem_sz(int nr_entry)
+{
+        return nr_entry << L2_QENTRY_SZ;
+}
+
+/*
+ * FIFO queues, shared with hardware.
+ *
+ * If a queue has empty slots, an entry is added to the queue tail,
+ * and that entry is marked as occupied.
+ * Entries can be dequeued from the head of the list, when the device
+ * has marked the entry as consumed.
+ *
+ * Returns true on successful queue/dequeue, false on failure.
+ */
+static int fifo_enqueue(struct ilo_hwinfo *hw, char *fifobar, int entry)
+{
+        struct fifo *fifo_q = FIFOBARTOHANDLE(fifobar);
+        int ret = 0;
+
+        spin_lock(&hw->fifo_lock);
+        if (!(fifo_q->fifobar[(fifo_q->tail + 1) & fifo_q->imask]
+              & ENTRY_MASK_O)) {
+                fifo_q->fifobar[fifo_q->tail & fifo_q->imask] |=
+                                (entry & ENTRY_MASK_NOSTATE) | fifo_q->merge;
+                fifo_q->tail += 1;
+                ret = 1;
+        }
+        spin_unlock(&hw->fifo_lock);
+
+        return ret;
+}
+
+static int fifo_dequeue(struct ilo_hwinfo *hw, char *fifobar, int *entry)
+{
+        struct fifo *fifo_q = FIFOBARTOHANDLE(fifobar);
+        int ret = 0;
+        u64 c;
+
+        spin_lock(&hw->fifo_lock);
+        c = fifo_q->fifobar[fifo_q->head & fifo_q->imask];
+        if (c & ENTRY_MASK_C) {
+                if (entry)
+                        *entry = c & ENTRY_MASK_NOSTATE;
+
+                fifo_q->fifobar[fifo_q->head & fifo_q->imask] =
+                                                        (c | ENTRY_MASK) + 1;
+                fifo_q->head += 1;
+                ret = 1;
+        }
+        spin_unlock(&hw->fifo_lock);
+
+        return ret;
+}
+
+static int ilo_pkt_enqueue(struct ilo_hwinfo *hw, struct ccb *ccb,
+                           int dir, int id, int len)
+{
+        char *fifobar;
+        int entry;
+
+        if (dir == SENDQ)
+                fifobar = ccb->ccb_u1.send_fifobar;
+        else
+                fifobar = ccb->ccb_u3.recv_fifobar;
+
+        entry = mk_entry(id, len);
+        return fifo_enqueue(hw, fifobar, entry);
+}
+
+static int ilo_pkt_dequeue(struct ilo_hwinfo *hw, struct ccb *ccb,
+                           int dir, int *id, int *len, void **pkt)
+{
+        char *fifobar, *desc;
+        int entry = 0, pkt_id = 0;
+        int ret;
+
+        if (dir == SENDQ) {
+                fifobar = ccb->ccb_u1.send_fifobar;
+                desc = ccb->ccb_u2.send_desc;
+        } else {
+                fifobar = ccb->ccb_u3.recv_fifobar;
+                desc = ccb->ccb_u4.recv_desc;
+        }
+
+        ret = fifo_dequeue(hw, fifobar, &entry);
+        if (ret) {
+                pkt_id = get_entry_id(entry);
+                if (id)
+                        *id = pkt_id;
+                if (len)
+                        *len = get_entry_len(entry);
+                if (pkt)
+                        *pkt = (void *)(desc + desc_mem_sz(pkt_id));
+        }
+
+        return ret;
+}
+
+static inline void doorbell_set(struct ccb *ccb)
+{
+        iowrite8(1, ccb->ccb_u5.db_base);
+}
+
+static inline void doorbell_clr(struct ccb *ccb)
+{
+        iowrite8(2, ccb->ccb_u5.db_base);
+}
+static inline int ctrl_set(int l2sz, int idxmask, int desclim)
+{
+        int active = 0, go = 1;
+        return l2sz << CTRL_BITPOS_L2SZ |
+               idxmask << CTRL_BITPOS_FIFOINDEXMASK |
+               desclim << CTRL_BITPOS_DESCLIMIT |
+               active << CTRL_BITPOS_A |
+               go << CTRL_BITPOS_G;
+}
+static void ctrl_setup(struct ccb *ccb, int nr_desc, int l2desc_sz)
+{
+        /* for simplicity, use the same parameters for send and recv ctrls */
+        ccb->send_ctrl = ctrl_set(l2desc_sz, nr_desc-1, nr_desc-1);
+        ccb->recv_ctrl = ctrl_set(l2desc_sz, nr_desc-1, nr_desc-1);
+}
+
+static inline int fifo_sz(int nr_entry)
+{
+        /* size of a fifo is determined by the number of entries it contains */
+        return (nr_entry * sizeof(u64)) + FIFOHANDLESIZE;
+}
+
+static void fifo_setup(void *base_addr, int nr_entry)
+{
+        struct fifo *fifo_q = base_addr;
+        int i;
+
+        /* set up an empty fifo */
+        fifo_q->head = 0;
+        fifo_q->tail = 0;
+        fifo_q->reset = 0;
+        fifo_q->nrents = nr_entry;
+        fifo_q->imask = nr_entry - 1;
+        fifo_q->merge = ENTRY_MASK_O;
+
+        for (i = 0; i < nr_entry; i++)
+                fifo_q->fifobar[i] = 0;
+}
+
+static void ilo_ccb_close(struct pci_dev *pdev, struct ccb_data *data)
+{
+        struct ccb *driver_ccb;
+        struct ccb __iomem *device_ccb;
+        int retries;
+
+        driver_ccb = &data->driver_ccb;
+        device_ccb = data->mapped_ccb;
+
+        /* complicated dance to tell the hw we are stopping */
+        doorbell_clr(driver_ccb);
+        iowrite32(ioread32(&device_ccb->send_ctrl) & ~(1 << CTRL_BITPOS_G),
+                  &device_ccb->send_ctrl);
+        iowrite32(ioread32(&device_ccb->recv_ctrl) & ~(1 << CTRL_BITPOS_G),
+                  &device_ccb->recv_ctrl);
+
+        /* give iLO some time to process stop request */
+        for (retries = 1000; retries > 0; retries--) {
+                doorbell_set(driver_ccb);
+                udelay(1);
+                if (!(ioread32(&device_ccb->send_ctrl) & (1 << CTRL_BITPOS_A))
+                    &&
+                    !(ioread32(&device_ccb->recv_ctrl) & (1 << CTRL_BITPOS_A)))
+                        break;
+        }
+        if (retries == 0)
+                dev_err(&pdev->dev, "Closing, but controller still active\n");
+
+        /* clear the hw ccb */
+        memset_io(device_ccb, 0, sizeof(struct ccb));
+
+        /* free resources used to back send/recv queues */
+        pci_free_consistent(pdev, data->dma_size, data->dma_va, data->dma_pa);
+}
+
+static int ilo_ccb_open(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
+{
+        char *dma_va, *dma_pa;
+        int pkt_id, pkt_sz, i, error;
+        struct ccb *driver_ccb, *ilo_ccb;
+        struct pci_dev *pdev;
+
+        driver_ccb = &data->driver_ccb;
+        ilo_ccb = &data->ilo_ccb;
+        pdev = hw->ilo_dev;
+
+        data->dma_size = 2 * fifo_sz(NR_QENTRY) +
+                         2 * desc_mem_sz(NR_QENTRY) +
+                         ILO_START_ALIGN + ILO_CACHE_SZ;
+
+        error = -ENOMEM;
+        data->dma_va = pci_alloc_consistent(pdev, data->dma_size,
+                                            &data->dma_pa);
+        if (!data->dma_va)
+                goto out;
+
+        dma_va = (char *)data->dma_va;
+        dma_pa = (char *)data->dma_pa;
+
+        memset(dma_va, 0, data->dma_size);
+
+        dma_va = (char *)roundup((unsigned long)dma_va, ILO_START_ALIGN);
+        dma_pa = (char *)roundup((unsigned long)dma_pa, ILO_START_ALIGN);
+
+        /*
+         * Create two ccb's, one with virt addrs, one with phys addrs.
+         * Copy the phys addr ccb to device shared mem.
+         */
+        ctrl_setup(driver_ccb, NR_QENTRY, L2_QENTRY_SZ);
+        ctrl_setup(ilo_ccb, NR_QENTRY, L2_QENTRY_SZ);
+
+        fifo_setup(dma_va, NR_QENTRY);
+        driver_ccb->ccb_u1.send_fifobar = dma_va + FIFOHANDLESIZE;
+        ilo_ccb->ccb_u1.send_fifobar = dma_pa + FIFOHANDLESIZE;
+        dma_va += fifo_sz(NR_QENTRY);
+        dma_pa += fifo_sz(NR_QENTRY);
+
+        dma_va = (char *)roundup((unsigned long)dma_va, ILO_CACHE_SZ);
+        dma_pa = (char *)roundup((unsigned long)dma_pa, ILO_CACHE_SZ);
+
+        fifo_setup(dma_va, NR_QENTRY);
+        driver_ccb->ccb_u3.recv_fifobar = dma_va + FIFOHANDLESIZE;
+        ilo_ccb->ccb_u3.recv_fifobar = dma_pa + FIFOHANDLESIZE;
+        dma_va += fifo_sz(NR_QENTRY);
+        dma_pa += fifo_sz(NR_QENTRY);
+
+        driver_ccb->ccb_u2.send_desc = dma_va;
+        ilo_ccb->ccb_u2.send_desc = dma_pa;
+        dma_pa += desc_mem_sz(NR_QENTRY);
+        dma_va += desc_mem_sz(NR_QENTRY);
+
+        driver_ccb->ccb_u4.recv_desc = dma_va;
+        ilo_ccb->ccb_u4.recv_desc = dma_pa;
+
+        driver_ccb->channel = slot;
+        ilo_ccb->channel = slot;
+
+        driver_ccb->ccb_u5.db_base = hw->db_vaddr + (slot << L2_DB_SIZE);
+        ilo_ccb->ccb_u5.db_base = NULL; /* hw ccb's doorbell is not used */
+
+        /* copy the ccb with physical addrs to device memory */
+        data->mapped_ccb = (struct ccb __iomem *)
+                                (hw->ram_vaddr + (slot * ILOHW_CCB_SZ));
+        memcpy_toio(data->mapped_ccb, ilo_ccb, sizeof(struct ccb));
+
+        /* put packets on the send and receive queues */
+        pkt_sz = 0;
+        for (pkt_id = 0; pkt_id < NR_QENTRY; pkt_id++) {
+                ilo_pkt_enqueue(hw, driver_ccb, SENDQ, pkt_id, pkt_sz);
+                doorbell_set(driver_ccb);
+        }
+
+        pkt_sz = desc_mem_sz(1);
+        for (pkt_id = 0; pkt_id < NR_QENTRY; pkt_id++)
+                ilo_pkt_enqueue(hw, driver_ccb, RECVQ, pkt_id, pkt_sz);
+
+        doorbell_clr(driver_ccb);
+
+        /* make sure iLO is really handling requests */
+        for (i = 1000; i > 0; i--) {
+                if (ilo_pkt_dequeue(hw, driver_ccb, SENDQ, &pkt_id, NULL, NULL))
+                        break;
+                udelay(1);
+        }
+
+        if (i) {
+                ilo_pkt_enqueue(hw, driver_ccb, SENDQ, pkt_id, 0);
+                doorbell_set(driver_ccb);
+        } else {
+                dev_err(&pdev->dev, "Open could not dequeue a packet\n");
+                error = -EBUSY;
+                goto free;
+        }
+
+        return 0;
+free:
+        pci_free_consistent(pdev, data->dma_size, data->dma_va, data->dma_pa);
+out:
+        return error;
+}
+
+static inline int is_channel_reset(struct ccb *ccb)
+{
+        /* check for this particular channel needing a reset */
+        return FIFOBARTOHANDLE(ccb->ccb_u1.send_fifobar)->reset;
+}
+
+static inline void set_channel_reset(struct ccb *ccb)
+{
+        /* set a flag indicating this channel needs a reset */
+        FIFOBARTOHANDLE(ccb->ccb_u1.send_fifobar)->reset = 1;
+}
+
+static inline int is_device_reset(struct ilo_hwinfo *hw)
+{
+        /* check for global reset condition */
+        return ioread32(&hw->mmio_vaddr[DB_OUT]) & (1 << DB_RESET);
+}
+
+static inline void clear_device(struct ilo_hwinfo *hw)
+{
+        /* clear the device (reset bits, pending channel entries) */
+        iowrite32(-1, &hw->mmio_vaddr[DB_OUT]);
+}
+
+static void ilo_locked_reset(struct ilo_hwinfo *hw)
+{
+        int slot;
+
+        /*
+         * Mapped memory is zeroed on ilo reset, so set a per ccb flag
+         * to indicate that this ccb needs to be closed and reopened.
+         */
+        for (slot = 0; slot < MAX_CCB; slot++) {
+                if (!hw->ccb_alloc[slot])
+                        continue;
+                set_channel_reset(&hw->ccb_alloc[slot]->driver_ccb);
+        }
+
+        clear_device(hw);
+}
+
+static void ilo_reset(struct ilo_hwinfo *hw)
+{
+        spin_lock(&hw->alloc_lock);
+
+        /* reset might have been handled after lock was taken */
+        if (is_device_reset(hw))
+                ilo_locked_reset(hw);
+
+        spin_unlock(&hw->alloc_lock);
+}
+
+static ssize_t ilo_read(struct file *fp, char __user *buf,
+                        size_t len, loff_t *off)
+{
+        int err, found, cnt, pkt_id, pkt_len;
+        struct ccb_data *data;
+        struct ccb *driver_ccb;
+        struct ilo_hwinfo *hw;
+        void *pkt;
+
+        data = fp->private_data;
+        driver_ccb = &data->driver_ccb;
+        hw = data->ilo_hw;
+
+        if (is_device_reset(hw) || is_channel_reset(driver_ccb)) {
+                /*
+                 * If the device has been reset, applications
+                 * need to close and reopen all ccbs.
+                 */
+                ilo_reset(hw);
+                return -ENODEV;
+        }
+
+        /*
+         * This function is to be called when data is expected
+         * in the channel, and will return an error if no packet is found
+         * during the loop below.  The sleep/retry logic is to allow
+         * applications to call read() immediately post write(),
+         * and give iLO some time to process the sent packet.
+         */
+        cnt = 20;
+        do {
+                /* look for a received packet */
+                found = ilo_pkt_dequeue(hw, driver_ccb, RECVQ, &pkt_id,
+                                        &pkt_len, &pkt);
+                if (found)
+                        break;
+                cnt--;
+                msleep(100);
+        } while (!found && cnt);
+
+        if (!found)
+                return -EAGAIN;
+
+        /* only copy the length of the received packet */
+        if (pkt_len < len)
+                len = pkt_len;
+
+        err = copy_to_user(buf, pkt, len);
+
+        /* return the received packet to the queue */
+        ilo_pkt_enqueue(hw, driver_ccb, RECVQ, pkt_id, desc_mem_sz(1));
+
+        return err ? -EFAULT : len;
+}
+
+static ssize_t ilo_write(struct file *fp, const char __user *buf,
+                         size_t len, loff_t *off)
+{
+        int err, pkt_id, pkt_len;
+        struct ccb_data *data;
+        struct ccb *driver_ccb;
+        struct ilo_hwinfo *hw;
+        void *pkt;
+
+        data = fp->private_data;
+        driver_ccb = &data->driver_ccb;
+        hw = data->ilo_hw;
+
+        if (is_device_reset(hw) || is_channel_reset(driver_ccb)) {
+                /*
+                 * If the device has been reset, applications
+                 * need to close and reopen all ccbs.
+                 */
+                ilo_reset(hw);
+                return -ENODEV;
+        }
+
+        /* get a packet to send the user command */
+        if (!ilo_pkt_dequeue(hw, driver_ccb, SENDQ, &pkt_id, &pkt_len, &pkt))
+                return -EBUSY;
+
+        /* limit the length to the length of the packet */
+        if (pkt_len < len)
+                len = pkt_len;
+
+        /* on failure, set the len to 0 to return empty packet to the device */
+        err = copy_from_user(pkt, buf, len);
+        if (err)
+                len = 0;
+
+        /* send the packet */
+        ilo_pkt_enqueue(hw, driver_ccb, SENDQ, pkt_id, len);
+        doorbell_set(driver_ccb);
+
+        return err ? -EFAULT : len;
+}
+
+static int ilo_close(struct inode *ip, struct file *fp)
+{
+        int slot;
+        struct ccb_data *data;
+        struct ilo_hwinfo *hw;
+
+        slot = iminor(ip) % MAX_CCB;
+        hw = container_of(ip->i_cdev, struct ilo_hwinfo, cdev);
+
+        spin_lock(&hw->alloc_lock);
+
+        if (is_device_reset(hw))
+                ilo_locked_reset(hw);
+
+        if (hw->ccb_alloc[slot]->ccb_cnt == 1) {
+
+                data = fp->private_data;
+
+                ilo_ccb_close(hw->ilo_dev, data);
+
+                kfree(data);
+                hw->ccb_alloc[slot] = NULL;
+        } else
+                hw->ccb_alloc[slot]->ccb_cnt--;
+
+        spin_unlock(&hw->alloc_lock);
+
+        return 0;
+}
+
+static int ilo_open(struct inode *ip, struct file *fp)
+{
+        int slot, error;
+        struct ccb_data *data;
+        struct ilo_hwinfo *hw;
+
+        slot = iminor(ip) % MAX_CCB;
+        hw = container_of(ip->i_cdev, struct ilo_hwinfo, cdev);
+
+        /* new ccb allocation */
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+
+        spin_lock(&hw->alloc_lock);
+
+        if (is_device_reset(hw))
+                ilo_locked_reset(hw);
+
+        /* each fd private_data holds sw/hw view of ccb */
+        if (hw->ccb_alloc[slot] == NULL) {
+                /* create a channel control block for this minor */
+                error = ilo_ccb_open(hw, data, slot);
+                if (!error) {
+                        hw->ccb_alloc[slot] = data;
+                        hw->ccb_alloc[slot]->ccb_cnt = 1;
+                        hw->ccb_alloc[slot]->ccb_excl = fp->f_flags & O_EXCL;
+                        hw->ccb_alloc[slot]->ilo_hw = hw;
+                } else
+                        kfree(data);
+        } else {
+                kfree(data);
+                if (fp->f_flags & O_EXCL || hw->ccb_alloc[slot]->ccb_excl) {
+                        /*
+                         * The channel exists, and either this open
+                         * or a previous open of this channel wants
+                         * exclusive access.
+                         */
+                        error = -EBUSY;
+                } else {
+                        hw->ccb_alloc[slot]->ccb_cnt++;
+                        error = 0;
+                }
+        }
+        spin_unlock(&hw->alloc_lock);
+
+        if (!error)
+                fp->private_data = hw->ccb_alloc[slot];
+
+        return error;
+}
+
+static const struct file_operations ilo_fops = {
+        .owner          = THIS_MODULE,
+        .read           = ilo_read,
+        .write          = ilo_write,
+        .open           = ilo_open,
+        .release        = ilo_close,
+};
+
+static void ilo_unmap_device(struct pci_dev *pdev, struct ilo_hwinfo *hw)
+{
+        pci_iounmap(pdev, hw->db_vaddr);
+        pci_iounmap(pdev, hw->ram_vaddr);
+        pci_iounmap(pdev, hw->mmio_vaddr);
+}
+
+static int __devinit ilo_map_device(struct pci_dev *pdev, struct ilo_hwinfo *hw)
+{
+        int error = -ENOMEM;
+
+        /* map the memory mapped i/o registers */
+        hw->mmio_vaddr = pci_iomap(pdev, 1, 0);
+        if (hw->mmio_vaddr == NULL) {
+                dev_err(&pdev->dev, "Error mapping mmio\n");
+                goto out;
+        }
+
+        /* map the adapter shared memory region */
+        hw->ram_vaddr = pci_iomap(pdev, 2, MAX_CCB * ILOHW_CCB_SZ);
+        if (hw->ram_vaddr == NULL) {
+                dev_err(&pdev->dev, "Error mapping shared mem\n");
+                goto mmio_free;
+        }
+
+        /* map the doorbell aperture */
+        hw->db_vaddr = pci_iomap(pdev, 3, MAX_CCB * ONE_DB_SIZE);
+        if (hw->db_vaddr == NULL) {
+                dev_err(&pdev->dev, "Error mapping doorbell\n");
+                goto ram_free;
+        }
+
+        return 0;
+ram_free:
+        pci_iounmap(pdev, hw->ram_vaddr);
+mmio_free:
+        pci_iounmap(pdev, hw->mmio_vaddr);
+out:
+        return error;
+}
+
+static void ilo_remove(struct pci_dev *pdev)
+{
+        int i, minor;
+        struct ilo_hwinfo *ilo_hw = pci_get_drvdata(pdev);
+
+        clear_device(ilo_hw);
+
+        minor = MINOR(ilo_hw->cdev.dev);
+        for (i = minor; i < minor + MAX_CCB; i++)
+                device_destroy(ilo_class, MKDEV(ilo_major, i));
+
+        cdev_del(&ilo_hw->cdev);
+        ilo_unmap_device(pdev, ilo_hw);
+        pci_release_regions(pdev);
+        pci_disable_device(pdev);
+        kfree(ilo_hw);
+        ilo_hwdev[(minor / MAX_CCB)] = 0;
+}
+
+static int __devinit ilo_probe(struct pci_dev *pdev,
+                               const struct pci_device_id *ent)
+{
+        int devnum, minor, start, error;
+        struct ilo_hwinfo *ilo_hw;
+
+        /* find a free range for device files */
+        for (devnum = 0; devnum < MAX_ILO_DEV; devnum++) {
+                if (ilo_hwdev[devnum] == 0) {
+                        ilo_hwdev[devnum] = 1;
+                        break;
+                }
+        }
+
+        if (devnum == MAX_ILO_DEV) {
+                dev_err(&pdev->dev, "Error finding free device\n");
+                return -ENODEV;
+        }
+
+        /* track global allocations for this device */
+        error = -ENOMEM;
+        ilo_hw = kzalloc(sizeof(*ilo_hw), GFP_KERNEL);
+        if (!ilo_hw)
+                goto out;
+
+        ilo_hw->ilo_dev = pdev;
+        spin_lock_init(&ilo_hw->alloc_lock);
+        spin_lock_init(&ilo_hw->fifo_lock);
+
+        error = pci_enable_device(pdev);
+        if (error)
+                goto free;
+
+        pci_set_master(pdev);
+
+        error = pci_request_regions(pdev, ILO_NAME);
+        if (error)
+                goto disable;
+
+        error = ilo_map_device(pdev, ilo_hw);
+        if (error)
+                goto free_regions;
+
+        pci_set_drvdata(pdev, ilo_hw);
+        clear_device(ilo_hw);
+
+        cdev_init(&ilo_hw->cdev, &ilo_fops);
+        ilo_hw->cdev.owner = THIS_MODULE;
+        start = devnum * MAX_CCB;
+        error = cdev_add(&ilo_hw->cdev, MKDEV(ilo_major, start), MAX_CCB);
+        if (error) {
+                dev_err(&pdev->dev, "Could not add cdev\n");
+                goto unmap;
+        }
+
+        for (minor = 0 ; minor < MAX_CCB; minor++) {
+                struct device *dev;
+                dev = device_create(ilo_class, &pdev->dev,
+                                    MKDEV(ilo_major, minor), NULL,
+                                    "hpilo!d%dccb%d", devnum, minor);
+                if (IS_ERR(dev))
+                        dev_err(&pdev->dev, "Could not create files\n");
+        }
+
+        return 0;
+unmap:
+        ilo_unmap_device(pdev, ilo_hw);
+free_regions:
+        pci_release_regions(pdev);
+disable:
+        pci_disable_device(pdev);
+free:
+        kfree(ilo_hw);
+out:
+        ilo_hwdev[devnum] = 0;
+        return error;
+}
+
+static struct pci_device_id ilo_devices[] = {
+        { PCI_DEVICE(PCI_VENDOR_ID_COMPAQ, 0xB204) },
+        { }
+};
+MODULE_DEVICE_TABLE(pci, ilo_devices);
+
+static struct pci_driver ilo_driver = {
+        .name     = ILO_NAME,
+        .id_table = ilo_devices,
+        .probe    = ilo_probe,
+        .remove   = __devexit_p(ilo_remove),
+};
+
+static int __init ilo_init(void)
+{
+        int error;
+        dev_t dev;
+
+        ilo_class = class_create(THIS_MODULE, "iLO");
+        if (IS_ERR(ilo_class)) {
+                error = PTR_ERR(ilo_class);
+                goto out;
+        }
+
+        error = alloc_chrdev_region(&dev, 0, MAX_OPEN, ILO_NAME);
+        if (error)
+                goto class_destroy;
+
+        ilo_major = MAJOR(dev);
+
+        error = pci_register_driver(&ilo_driver);
+        if (error)
+                goto chr_remove;
+
+        return 0;
+chr_remove:
+        unregister_chrdev_region(dev, MAX_OPEN);
+class_destroy:
+        class_destroy(ilo_class);
+out:
+        return error;
+}
+
+static void __exit ilo_exit(void)
+{
+        pci_unregister_driver(&ilo_driver);
+        unregister_chrdev_region(MKDEV(ilo_major, 0), MAX_OPEN);
+        class_destroy(ilo_class);
+}
+
+MODULE_VERSION("0.05");
+MODULE_ALIAS(ILO_NAME);
+MODULE_DESCRIPTION(ILO_NAME);
+MODULE_AUTHOR("David Altobelli <david.altobelli@hp.com>");
+MODULE_LICENSE("GPL v2");
+
+module_init(ilo_init);
+module_exit(ilo_exit);
diff --git a/drivers/misc/hpilo.h b/drivers/misc/hpilo.h
new file mode 100644
index 000000000000..a281207696c1
--- /dev/null
+++ b/drivers/misc/hpilo.h
@@ -0,0 +1,189 @@
+/*
+ * linux/drivers/char/hpilo.h
+ *
+ * Copyright (C) 2008 Hewlett-Packard Development Company, L.P.
+ *      David Altobelli <david.altobelli@hp.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef __HPILO_H
+#define __HPILO_H
+
+#define ILO_NAME "hpilo"
+
+/* max number of open channel control blocks per device, hw limited to 32 */
+#define MAX_CCB         8
+/* max number of supported devices */
+#define MAX_ILO_DEV     1
+/* max number of files */
+#define MAX_OPEN        (MAX_CCB * MAX_ILO_DEV)
+
+/*
+ * Per device, used to track global memory allocations.
+ */
+struct ilo_hwinfo {
+        /* mmio registers on device */
+        char __iomem *mmio_vaddr;
+
+        /* doorbell registers on device */
+        char __iomem *db_vaddr;
+
+        /* shared memory on device used for channel control blocks */
+        char __iomem *ram_vaddr;
+
+        /* files corresponding to this device */
+        struct ccb_data *ccb_alloc[MAX_CCB];
+
+        struct pci_dev *ilo_dev;
+
+        spinlock_t alloc_lock;
+        spinlock_t fifo_lock;
+
+        struct cdev cdev;
+};
+
+/* offset from mmio_vaddr */
+#define DB_OUT          0xD4
+/* DB_OUT reset bit */
+#define DB_RESET        26
+
+/*
+ * Channel control block. Used to manage hardware queues.
+ * The format must match hw's version.  The hw ccb is 128 bytes,
+ * but the context area shouldn't be touched by the driver.
+ */
+#define ILOSW_CCB_SZ    64
+#define ILOHW_CCB_SZ    128
+struct ccb {
+        union {
+                char *send_fifobar;
+                u64 padding1;
+        } ccb_u1;
+        union {
+                char *send_desc;
+                u64 padding2;
+        } ccb_u2;
+        u64 send_ctrl;
+
+        union {
+                char *recv_fifobar;
+                u64 padding3;
+        } ccb_u3;
+        union {
+                char *recv_desc;
+                u64 padding4;
+        } ccb_u4;
+        u64 recv_ctrl;
+
+        union {
+                char __iomem *db_base;
+                u64 padding5;
+        } ccb_u5;
+
+        u64 channel;
+
+        /* unused context area (64 bytes) */
+};
+
+/* ccb queue parameters */
+#define SENDQ           1
+#define RECVQ           2
+#define NR_QENTRY       4
+#define L2_QENTRY_SZ    12
+
+/* ccb ctrl bitfields */
+#define CTRL_BITPOS_L2SZ             0
+#define CTRL_BITPOS_FIFOINDEXMASK    4
+#define CTRL_BITPOS_DESCLIMIT        18
+#define CTRL_BITPOS_A                30
+#define CTRL_BITPOS_G                31
+
+/* ccb doorbell macros */
+#define L2_DB_SIZE              14
+#define ONE_DB_SIZE             (1 << L2_DB_SIZE)
+
+/*
+ * Per fd structure used to track the ccb allocated to that dev file.
+ */
+struct ccb_data {
+        /* software version of ccb, using virtual addrs */
+        struct ccb  driver_ccb;
+
+        /* hardware version of ccb, using physical addrs */
+        struct ccb  ilo_ccb;
+
+        /* hardware ccb is written to this shared mapped device memory */
+        struct ccb __iomem *mapped_ccb;
+
+        /* dma'able memory used for send/recv queues */
+        void       *dma_va;
+        dma_addr_t  dma_pa;
+        size_t      dma_size;
+
+        /* pointer to hardware device info */
+        struct ilo_hwinfo *ilo_hw;
+
+        /* usage count, to allow for shared ccb's */
+        int         ccb_cnt;
+
+        /* open wanted exclusive access to this ccb */
+        int         ccb_excl;
+};
+
+/*
+ * FIFO queue structure, shared with hw.
+ */
+#define ILO_START_ALIGN 4096
+#define ILO_CACHE_SZ     128
+struct fifo {
+    u64 nrents; /* user requested number of fifo entries */
+    u64 imask;  /* mask to extract valid fifo index */
+    u64 merge;  /*  O/C bits to merge in during enqueue operation */
+    u64 reset;  /* set to non-zero when the target device resets */
+    u8  pad_0[ILO_CACHE_SZ - (sizeof(u64) * 4)];
+
+    u64 head;
+    u8  pad_1[ILO_CACHE_SZ - (sizeof(u64))];
+
+    u64 tail;
+    u8  pad_2[ILO_CACHE_SZ - (sizeof(u64))];
+
+    u64 fifobar[1];
+};
+
+/* convert between struct fifo, and the fifobar, which is saved in the ccb */
+#define FIFOHANDLESIZE (sizeof(struct fifo) - sizeof(u64))
+#define FIFOBARTOHANDLE(_fifo) \
+        ((struct fifo *)(((char *)(_fifo)) - FIFOHANDLESIZE))
+
+/* the number of qwords to consume from the entry descriptor */
+#define ENTRY_BITPOS_QWORDS      0
+/* descriptor index number (within a specified queue) */
+#define ENTRY_BITPOS_DESCRIPTOR  10
+/* state bit, fifo entry consumed by consumer */
+#define ENTRY_BITPOS_C           22
+/* state bit, fifo entry is occupied */
+#define ENTRY_BITPOS_O           23
+
+#define ENTRY_BITS_QWORDS        10
+#define ENTRY_BITS_DESCRIPTOR    12
+#define ENTRY_BITS_C             1
+#define ENTRY_BITS_O             1
+#define ENTRY_BITS_TOTAL        \
+        (ENTRY_BITS_C + ENTRY_BITS_O + \
+         ENTRY_BITS_QWORDS + ENTRY_BITS_DESCRIPTOR)
+
+/* extract various entry fields */
+#define ENTRY_MASK ((1 << ENTRY_BITS_TOTAL) - 1)
+#define ENTRY_MASK_C (((1 << ENTRY_BITS_C) - 1) << ENTRY_BITPOS_C)
+#define ENTRY_MASK_O (((1 << ENTRY_BITS_O) - 1) << ENTRY_BITPOS_O)
+#define ENTRY_MASK_QWORDS \
+        (((1 << ENTRY_BITS_QWORDS) - 1) << ENTRY_BITPOS_QWORDS)
+#define ENTRY_MASK_DESCRIPTOR \
+        (((1 << ENTRY_BITS_DESCRIPTOR) - 1) << ENTRY_BITPOS_DESCRIPTOR)
+
+#define ENTRY_MASK_NOSTATE (ENTRY_MASK >> (ENTRY_BITS_C + ENTRY_BITS_O))
+
+#endif /* __HPILO_H */
diff --git a/drivers/misc/phantom.c b/drivers/misc/phantom.c
index 186162470090..daf585689ce3 100644
--- a/drivers/misc/phantom.c
+++ b/drivers/misc/phantom.c
@@ -399,8 +399,9 @@ static int __devinit phantom_probe(struct pci_dev *pdev,
                 goto err_irq;
         }
 
-        if (IS_ERR(device_create(phantom_class, &pdev->dev, MKDEV(phantom_major,
-                        minor), "phantom%u", minor)))
+        if (IS_ERR(device_create_drvdata(phantom_class, &pdev->dev,
+                                         MKDEV(phantom_major, minor),
+                                         NULL, "phantom%u", minor)))
                 dev_err(&pdev->dev, "can't create device\n");
 
         pci_set_drvdata(pdev, pht);
@@ -562,6 +563,6 @@ module_init(phantom_init);
 module_exit(phantom_exit);
 
 MODULE_AUTHOR("Jiri Slaby <jirislaby@gmail.com>");
-MODULE_DESCRIPTION("Sensable Phantom driver");
+MODULE_DESCRIPTION("Sensable Phantom driver (PCI devices)");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(PHANTOM_VERSION);
diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
index 08256ed0d9a6..579b01ff82d4 100644
--- a/drivers/misc/sgi-xp/xpc_main.c
+++ b/drivers/misc/sgi-xp/xpc_main.c
@@ -229,10 +229,11 @@ xpc_hb_checker(void *ignore)
         int last_IRQ_count = 0;
         int new_IRQ_count;
         int force_IRQ = 0;
+        cpumask_of_cpu_ptr(cpumask, XPC_HB_CHECK_CPU);
 
         /* this thread was marked active by xpc_hb_init() */
 
-        set_cpus_allowed(current, cpumask_of_cpu(XPC_HB_CHECK_CPU));
+        set_cpus_allowed_ptr(current, cpumask);
 
         /* set our heartbeating to other partitions into motion */
         xpc_hb_check_timeout = jiffies + (xpc_hb_check_interval * HZ);
diff --git a/drivers/misc/thinkpad_acpi.c b/drivers/misc/thinkpad_acpi.c
index b5969298f3d3..d3eb7903c346 100644
--- a/drivers/misc/thinkpad_acpi.c
+++ b/drivers/misc/thinkpad_acpi.c
@@ -21,7 +21,7 @@
  *  02110-1301, USA.
  */
 
-#define TPACPI_VERSION "0.20"
+#define TPACPI_VERSION "0.21"
 #define TPACPI_SYSFS_VERSION 0x020200
 
 /*
@@ -68,6 +68,7 @@
 #include <linux/hwmon-sysfs.h>
 #include <linux/input.h>
 #include <linux/leds.h>
+#include <linux/rfkill.h>
 #include <asm/uaccess.h>
 
 #include <linux/dmi.h>
@@ -144,6 +145,12 @@ enum {
 
 #define TPACPI_MAX_ACPI_ARGS 3
 
+/* rfkill switches */
+enum {
+        TPACPI_RFK_BLUETOOTH_SW_ID = 0,
+        TPACPI_RFK_WWAN_SW_ID,
+};
+
 /* Debugging */
 #define TPACPI_LOG TPACPI_FILE ": "
 #define TPACPI_ERR         KERN_ERR    TPACPI_LOG
@@ -905,6 +912,43 @@ static int __init tpacpi_check_std_acpi_brightness_support(void)
         return 0;
 }
 
+static int __init tpacpi_new_rfkill(const unsigned int id,
+                        struct rfkill **rfk,
+                        const enum rfkill_type rfktype,
+                        const char *name,
+                        int (*toggle_radio)(void *, enum rfkill_state),
+                        int (*get_state)(void *, enum rfkill_state *))
+{
+        int res;
+        enum rfkill_state initial_state;
+
+        *rfk = rfkill_allocate(&tpacpi_pdev->dev, rfktype);
+        if (!*rfk) {
+                printk(TPACPI_ERR
+                        "failed to allocate memory for rfkill class\n");
+                return -ENOMEM;
+        }
+
+        (*rfk)->name = name;
+        (*rfk)->get_state = get_state;
+        (*rfk)->toggle_radio = toggle_radio;
+
+        if (!get_state(NULL, &initial_state))
+                (*rfk)->state = initial_state;
+
+        res = rfkill_register(*rfk);
+        if (res < 0) {
+                printk(TPACPI_ERR
+                        "failed to register %s rfkill switch: %d\n",
+                        name, res);
+                rfkill_free(*rfk);
+                *rfk = NULL;
+                return res;
+        }
+
+        return 0;
+}
+
 /*************************************************************************
  * thinkpad-acpi driver attributes
  */
@@ -1285,21 +1329,6 @@ static int hotkey_status_set(int status)
         return 0;
 }
 
-static void tpacpi_input_send_radiosw(void)
-{
-        int wlsw;
-
-        if (tp_features.hotkey_wlsw && !hotkey_get_wlsw(&wlsw)) {
-                mutex_lock(&tpacpi_inputdev_send_mutex);
-
-                input_report_switch(tpacpi_inputdev,
-                                    SW_RFKILL_ALL, !!wlsw);
-                input_sync(tpacpi_inputdev);
-
-                mutex_unlock(&tpacpi_inputdev_send_mutex);
-        }
-}
-
 static void tpacpi_input_send_tabletsw(void)
 {
         int state;
@@ -1921,6 +1950,30 @@ static struct attribute *hotkey_mask_attributes[] __initdata = {
         &dev_attr_hotkey_wakeup_hotunplug_complete.attr,
 };
 
+static void bluetooth_update_rfk(void);
+static void wan_update_rfk(void);
+static void tpacpi_send_radiosw_update(void)
+{
+        int wlsw;
+
+        /* Sync these BEFORE sending any rfkill events */
+        if (tp_features.bluetooth)
+                bluetooth_update_rfk();
+        if (tp_features.wan)
+                wan_update_rfk();
+
+        if (tp_features.hotkey_wlsw && !hotkey_get_wlsw(&wlsw)) {
+                mutex_lock(&tpacpi_inputdev_send_mutex);
+
+                input_report_switch(tpacpi_inputdev,
+                                    SW_RFKILL_ALL, !!wlsw);
+                input_sync(tpacpi_inputdev);
+
+                mutex_unlock(&tpacpi_inputdev_send_mutex);
+        }
+        hotkey_radio_sw_notify_change();
+}
+
 static void hotkey_exit(void)
 {
 #ifdef CONFIG_THINKPAD_ACPI_HOTKEY_POLL
@@ -2167,9 +2220,10 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
                 printk(TPACPI_INFO
                         "radio switch found; radios are %s\n",
                         enabled(status, 0));
+        }
+        if (tp_features.hotkey_wlsw)
                 res = add_to_attr_set(hotkey_dev_attributes,
                                 &dev_attr_hotkey_radio_sw.attr);
-        }
 
         /* For X41t, X60t, X61t Tablets... */
         if (!res && acpi_evalf(hkey_handle, &status, "MHKG", "qd")) {
@@ -2287,7 +2341,7 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
         tpacpi_inputdev->close = &hotkey_inputdev_close;
 
         hotkey_poll_setup_safe(1);
-        tpacpi_input_send_radiosw();
+        tpacpi_send_radiosw_update();
         tpacpi_input_send_tabletsw();
 
         return 0;
@@ -2419,8 +2473,7 @@ static void hotkey_notify(struct ibm_struct *ibm, u32 event)
                 case 7:
                         /* 0x7000-0x7FFF: misc */
                         if (tp_features.hotkey_wlsw && hkey == 0x7000) {
-                                tpacpi_input_send_radiosw();
-                                hotkey_radio_sw_notify_change();
+                                tpacpi_send_radiosw_update();
                                 send_acpi_ev = 0;
                                 break;
                         }
@@ -2463,8 +2516,7 @@ static void hotkey_resume(void)
                 printk(TPACPI_ERR
                        "error while trying to read hot key mask "
                        "from firmware\n");
-        tpacpi_input_send_radiosw();
-        hotkey_radio_sw_notify_change();
+        tpacpi_send_radiosw_update();
         hotkey_tablet_mode_notify_change();
         hotkey_wakeup_reason_notify_change();
         hotkey_wakeup_hotunplug_complete_notify_change();
@@ -2581,8 +2633,66 @@ enum {
         TP_ACPI_BLUETOOTH_UNK           = 0x04, /* unknown function */
 };
 
-static int bluetooth_get_radiosw(void);
-static int bluetooth_set_radiosw(int radio_on);
+static struct rfkill *tpacpi_bluetooth_rfkill;
+
+static int bluetooth_get_radiosw(void)
+{
+        int status;
+
+        if (!tp_features.bluetooth)
+                return -ENODEV;
+
+        /* WLSW overrides bluetooth in firmware/hardware, reflect that */
+        if (tp_features.hotkey_wlsw && !hotkey_get_wlsw(&status) && !status)
+                return RFKILL_STATE_HARD_BLOCKED;
+
+        if (!acpi_evalf(hkey_handle, &status, "GBDC", "d"))
+                return -EIO;
+
+        return ((status & TP_ACPI_BLUETOOTH_RADIOSSW) != 0) ?
+                RFKILL_STATE_UNBLOCKED : RFKILL_STATE_SOFT_BLOCKED;
+}
+
+static void bluetooth_update_rfk(void)
+{
+        int status;
+
+        if (!tpacpi_bluetooth_rfkill)
+                return;
+
+        status = bluetooth_get_radiosw();
+        if (status < 0)
+                return;
+        rfkill_force_state(tpacpi_bluetooth_rfkill, status);
+}
+
+static int bluetooth_set_radiosw(int radio_on, int update_rfk)
+{
+        int status;
+
+        if (!tp_features.bluetooth)
+                return -ENODEV;
+
+        /* WLSW overrides bluetooth in firmware/hardware, but there is no
+         * reason to risk weird behaviour. */
+        if (tp_features.hotkey_wlsw && !hotkey_get_wlsw(&status) && !status
+            && radio_on)
+                return -EPERM;
+
+        if (!acpi_evalf(hkey_handle, &status, "GBDC", "d"))
+                return -EIO;
+        if (radio_on)
+                status |= TP_ACPI_BLUETOOTH_RADIOSSW;
+        else
+                status &= ~TP_ACPI_BLUETOOTH_RADIOSSW;
+        if (!acpi_evalf(hkey_handle, NULL, "SBDC", "vd", status))
+                return -EIO;
+
+        if (update_rfk)
+                bluetooth_update_rfk();
+
+        return 0;
+}
 
 /* sysfs bluetooth enable ---------------------------------------------- */
 static ssize_t bluetooth_enable_show(struct device *dev,
@@ -2595,7 +2705,8 @@ static ssize_t bluetooth_enable_show(struct device *dev,
         if (status < 0)
                 return status;
 
-        return snprintf(buf, PAGE_SIZE, "%d\n", status ? 1 : 0);
+        return snprintf(buf, PAGE_SIZE, "%d\n",
+                        (status == RFKILL_STATE_UNBLOCKED) ? 1 : 0);
 }
 
 static ssize_t bluetooth_enable_store(struct device *dev,
@@ -2608,7 +2719,7 @@ static ssize_t bluetooth_enable_store(struct device *dev,
         if (parse_strtoul(buf, 1, &t))
                 return -EINVAL;
 
-        res = bluetooth_set_radiosw(t);
+        res = bluetooth_set_radiosw(t, 1);
 
         return (res) ? res : count;
 }
@@ -2628,6 +2739,31 @@ static const struct attribute_group bluetooth_attr_group = {
         .attrs = bluetooth_attributes,
 };
 
+static int tpacpi_bluetooth_rfk_get(void *data, enum rfkill_state *state)
+{
+        int bts = bluetooth_get_radiosw();
+
+        if (bts < 0)
+                return bts;
+
+        *state = bts;
+        return 0;
+}
+
+static int tpacpi_bluetooth_rfk_set(void *data, enum rfkill_state state)
+{
+        return bluetooth_set_radiosw((state == RFKILL_STATE_UNBLOCKED), 0);
+}
+
+static void bluetooth_exit(void)
+{
+        if (tpacpi_bluetooth_rfkill)
+                rfkill_unregister(tpacpi_bluetooth_rfkill);
+
+        sysfs_remove_group(&tpacpi_pdev->dev.kobj,
+                        &bluetooth_attr_group);
+}
+
 static int __init bluetooth_init(struct ibm_init_struct *iibm)
 {
         int res;
@@ -2646,57 +2782,32 @@ static int __init bluetooth_init(struct ibm_init_struct *iibm)
                 str_supported(tp_features.bluetooth),
                 status);
 
-        if (tp_features.bluetooth) {
-                if (!(status & TP_ACPI_BLUETOOTH_HWPRESENT)) {
-                        /* no bluetooth hardware present in system */
-                        tp_features.bluetooth = 0;
-                        dbg_printk(TPACPI_DBG_INIT,
-                                   "bluetooth hardware not installed\n");
-                } else {
-                        res = sysfs_create_group(&tpacpi_pdev->dev.kobj,
-                                        &bluetooth_attr_group);
-                        if (res)
-                                return res;
-                }
+        if (tp_features.bluetooth &&
+            !(status & TP_ACPI_BLUETOOTH_HWPRESENT)) {
+                /* no bluetooth hardware present in system */
+                tp_features.bluetooth = 0;
+                dbg_printk(TPACPI_DBG_INIT,
+                           "bluetooth hardware not installed\n");
         }
 
-        return (tp_features.bluetooth)? 0 : 1;
-}
-
-static void bluetooth_exit(void)
-{
-        sysfs_remove_group(&tpacpi_pdev->dev.kobj,
-                        &bluetooth_attr_group);
-}
-
-static int bluetooth_get_radiosw(void)
-{
-        int status;
-
         if (!tp_features.bluetooth)
-                return -ENODEV;
-
-        if (!acpi_evalf(hkey_handle, &status, "GBDC", "d"))
-                return -EIO;
-
-        return ((status & TP_ACPI_BLUETOOTH_RADIOSSW) != 0);
-}
-
-static int bluetooth_set_radiosw(int radio_on)
-{
-        int status;
+                return 1;
 
-        if (!tp_features.bluetooth)
-                return -ENODEV;
+        res = sysfs_create_group(&tpacpi_pdev->dev.kobj,
+                                &bluetooth_attr_group);
+        if (res)
+                return res;
 
-        if (!acpi_evalf(hkey_handle, &status, "GBDC", "d"))
-                return -EIO;
-        if (radio_on)
-                status |= TP_ACPI_BLUETOOTH_RADIOSSW;
-        else
-                status &= ~TP_ACPI_BLUETOOTH_RADIOSSW;
-        if (!acpi_evalf(hkey_handle, NULL, "SBDC", "vd", status))
-                return -EIO;
+        res = tpacpi_new_rfkill(TPACPI_RFK_BLUETOOTH_SW_ID,
+                                &tpacpi_bluetooth_rfkill,
+                                RFKILL_TYPE_BLUETOOTH,
+                                "tpacpi_bluetooth_sw",
+                                tpacpi_bluetooth_rfk_set,
+                                tpacpi_bluetooth_rfk_get);
+        if (res) {
+                bluetooth_exit();
+                return res;
+        }
 
         return 0;
 }
@@ -2711,7 +2822,8 @@ static int bluetooth_read(char *p)
                 len += sprintf(p + len, "status:\t\tnot supported\n");
         else {
                 len += sprintf(p + len, "status:\t\t%s\n",
-                                (status)? "enabled" : "disabled");
+                                (status == RFKILL_STATE_UNBLOCKED) ?
+                                        "enabled" : "disabled");
                 len += sprintf(p + len, "commands:\tenable, disable\n");
         }
 
@@ -2727,9 +2839,9 @@ static int bluetooth_write(char *buf)
 
         while ((cmd = next_cmd(&buf))) {
                 if (strlencmp(cmd, "enable") == 0) {
-                        bluetooth_set_radiosw(1);
+                        bluetooth_set_radiosw(1, 1);
                 } else if (strlencmp(cmd, "disable") == 0) {
-                        bluetooth_set_radiosw(0);
+                        bluetooth_set_radiosw(0, 1);
                 } else
                         return -EINVAL;
         }
@@ -2755,8 +2867,66 @@ enum {
         TP_ACPI_WANCARD_UNK             = 0x04, /* unknown function */
 };
 
-static int wan_get_radiosw(void);
-static int wan_set_radiosw(int radio_on);
+static struct rfkill *tpacpi_wan_rfkill;
+
+static int wan_get_radiosw(void)
+{
+        int status;
+
+        if (!tp_features.wan)
+                return -ENODEV;
+
+        /* WLSW overrides WWAN in firmware/hardware, reflect that */
+        if (tp_features.hotkey_wlsw && !hotkey_get_wlsw(&status) && !status)
+                return RFKILL_STATE_HARD_BLOCKED;
+
+        if (!acpi_evalf(hkey_handle, &status, "GWAN", "d"))
+                return -EIO;
+
+        return ((status & TP_ACPI_WANCARD_RADIOSSW) != 0) ?
+                RFKILL_STATE_UNBLOCKED : RFKILL_STATE_SOFT_BLOCKED;
+}
+
+static void wan_update_rfk(void)
+{
+        int status;
+
+        if (!tpacpi_wan_rfkill)
+                return;
+
+        status = wan_get_radiosw();
+        if (status < 0)
+                return;
+        rfkill_force_state(tpacpi_wan_rfkill, status);
+}
+
+static int wan_set_radiosw(int radio_on, int update_rfk)
+{
+        int status;
+
+        if (!tp_features.wan)
+                return -ENODEV;
+
+        /* WLSW overrides bluetooth in firmware/hardware, but there is no
+         * reason to risk weird behaviour. */
+        if (tp_features.hotkey_wlsw && !hotkey_get_wlsw(&status) && !status
+            && radio_on)
+                return -EPERM;
+
+        if (!acpi_evalf(hkey_handle, &status, "GWAN", "d"))
+                return -EIO;
+        if (radio_on)
+                status |= TP_ACPI_WANCARD_RADIOSSW;
+        else
+                status &= ~TP_ACPI_WANCARD_RADIOSSW;
+        if (!acpi_evalf(hkey_handle, NULL, "SWAN", "vd", status))
+                return -EIO;
+
+        if (update_rfk)
+                wan_update_rfk();
+
+        return 0;
+}
 
 /* sysfs wan enable ---------------------------------------------------- */
 static ssize_t wan_enable_show(struct device *dev,
@@ -2769,7 +2939,8 @@ static ssize_t wan_enable_show(struct device *dev,
         if (status < 0)
                 return status;
 
-        return snprintf(buf, PAGE_SIZE, "%d\n", status ? 1 : 0);
+        return snprintf(buf, PAGE_SIZE, "%d\n",
+                        (status == RFKILL_STATE_UNBLOCKED) ? 1 : 0);
 }
 
 static ssize_t wan_enable_store(struct device *dev,
@@ -2782,7 +2953,7 @@ static ssize_t wan_enable_store(struct device *dev,
         if (parse_strtoul(buf, 1, &t))
                 return -EINVAL;
 
-        res = wan_set_radiosw(t);
+        res = wan_set_radiosw(t, 1);
 
         return (res) ? res : count;
 }
@@ -2802,6 +2973,31 @@ static const struct attribute_group wan_attr_group = {
         .attrs = wan_attributes,
 };
 
+static int tpacpi_wan_rfk_get(void *data, enum rfkill_state *state)
+{
+        int wans = wan_get_radiosw();
+
+        if (wans < 0)
+                return wans;
+
+        *state = wans;
+        return 0;
+}
+
+static int tpacpi_wan_rfk_set(void *data, enum rfkill_state state)
+{
+        return wan_set_radiosw((state == RFKILL_STATE_UNBLOCKED), 0);
+}
+
+static void wan_exit(void)
+{
+        if (tpacpi_wan_rfkill)
+                rfkill_unregister(tpacpi_wan_rfkill);
+
+        sysfs_remove_group(&tpacpi_pdev->dev.kobj,
+                &wan_attr_group);
+}
+
 static int __init wan_init(struct ibm_init_struct *iibm)
 {
         int res;
@@ -2818,57 +3014,32 @@ static int __init wan_init(struct ibm_init_struct *iibm)
                 str_supported(tp_features.wan),
                 status);
 
-        if (tp_features.wan) {
-                if (!(status & TP_ACPI_WANCARD_HWPRESENT)) {
-                        /* no wan hardware present in system */
-                        tp_features.wan = 0;
-                        dbg_printk(TPACPI_DBG_INIT,
-                                   "wan hardware not installed\n");
-                } else {
-                        res = sysfs_create_group(&tpacpi_pdev->dev.kobj,
-                                        &wan_attr_group);
-                        if (res)
-                                return res;
-                }
+        if (tp_features.wan &&
+            !(status & TP_ACPI_WANCARD_HWPRESENT)) {
+                /* no wan hardware present in system */
+                tp_features.wan = 0;
+                dbg_printk(TPACPI_DBG_INIT,
+                           "wan hardware not installed\n");
         }
 
-        return (tp_features.wan)? 0 : 1;
-}
-
-static void wan_exit(void)
-{
-        sysfs_remove_group(&tpacpi_pdev->dev.kobj,
-                &wan_attr_group);
-}
-
-static int wan_get_radiosw(void)
-{
-        int status;
-
         if (!tp_features.wan)
-                return -ENODEV;
-
-        if (!acpi_evalf(hkey_handle, &status, "GWAN", "d"))
-                return -EIO;
-
-        return ((status & TP_ACPI_WANCARD_RADIOSSW) != 0);
-}
-
-static int wan_set_radiosw(int radio_on)
-{
-        int status;
+                return 1;
 
-        if (!tp_features.wan)
-                return -ENODEV;
+        res = sysfs_create_group(&tpacpi_pdev->dev.kobj,
+                                &wan_attr_group);
+        if (res)
+                return res;
 
-        if (!acpi_evalf(hkey_handle, &status, "GWAN", "d"))
-                return -EIO;
-        if (radio_on)
-                status |= TP_ACPI_WANCARD_RADIOSSW;
-        else
-                status &= ~TP_ACPI_WANCARD_RADIOSSW;
-        if (!acpi_evalf(hkey_handle, NULL, "SWAN", "vd", status))
-                return -EIO;
+        res = tpacpi_new_rfkill(TPACPI_RFK_WWAN_SW_ID,
+                                &tpacpi_wan_rfkill,
+                                RFKILL_TYPE_WWAN,
+                                "tpacpi_wwan_sw",
+                                tpacpi_wan_rfk_set,
+                                tpacpi_wan_rfk_get);
+        if (res) {
+                wan_exit();
+                return res;
+        }
 
         return 0;
 }
@@ -2883,7 +3054,8 @@ static int wan_read(char *p)
                 len += sprintf(p + len, "status:\t\tnot supported\n");
         else {
                 len += sprintf(p + len, "status:\t\t%s\n",
-                                (status)? "enabled" : "disabled");
+                                (status == RFKILL_STATE_UNBLOCKED) ?
+                                        "enabled" : "disabled");
                 len += sprintf(p + len, "commands:\tenable, disable\n");
         }
 
@@ -2899,9 +3071,9 @@ static int wan_write(char *buf)
 
         while ((cmd = next_cmd(&buf))) {
                 if (strlencmp(cmd, "enable") == 0) {
-                        wan_set_radiosw(1);
+                        wan_set_radiosw(1, 1);
                 } else if (strlencmp(cmd, "disable") == 0) {
-                        wan_set_radiosw(0);
+                        wan_set_radiosw(0, 1);
                 } else
                         return -EINVAL;
         }
@@ -6168,13 +6340,18 @@ err_out:
 
 /* Probing */
 
-static void __init get_thinkpad_model_data(struct thinkpad_id_data *tp)
+/* returns 0 - probe ok, or < 0 - probe error.
+ * Probe ok doesn't mean thinkpad found.
+ * On error, kfree() cleanup on tp->* is not performed, caller must do it */
+static int __must_check __init get_thinkpad_model_data(
+                                                struct thinkpad_id_data *tp)
 {
         const struct dmi_device *dev = NULL;
         char ec_fw_string[18];
+        char const *s;
 
         if (!tp)
-                return;
+                return -EINVAL;
 
         memset(tp, 0, sizeof(*tp));
 
@@ -6183,12 +6360,14 @@ static void __init get_thinkpad_model_data(struct thinkpad_id_data *tp)
         else if (dmi_name_in_vendors("LENOVO"))
                 tp->vendor = PCI_VENDOR_ID_LENOVO;
         else
-                return;
+                return 0;
 
-        tp->bios_version_str = kstrdup(dmi_get_system_info(DMI_BIOS_VERSION),
-                                        GFP_KERNEL);
+        s = dmi_get_system_info(DMI_BIOS_VERSION);
+        tp->bios_version_str = kstrdup(s, GFP_KERNEL);
+        if (s && !tp->bios_version_str)
+                return -ENOMEM;
         if (!tp->bios_version_str)
-                return;
+                return 0;
         tp->bios_model = tp->bios_version_str[0]
                          | (tp->bios_version_str[1] << 8);
 
@@ -6207,21 +6386,27 @@ static void __init get_thinkpad_model_data(struct thinkpad_id_data *tp)
                         ec_fw_string[strcspn(ec_fw_string, " ]")] = 0;
 
                         tp->ec_version_str = kstrdup(ec_fw_string, GFP_KERNEL);
+                        if (!tp->ec_version_str)
+                                return -ENOMEM;
                         tp->ec_model = ec_fw_string[0]
                                         | (ec_fw_string[1] << 8);
                         break;
                 }
         }
 
-        tp->model_str = kstrdup(dmi_get_system_info(DMI_PRODUCT_VERSION),
-                                        GFP_KERNEL);
-        if (tp->model_str && strnicmp(tp->model_str, "ThinkPad", 8) != 0) {
-                kfree(tp->model_str);
-                tp->model_str = NULL;
+        s = dmi_get_system_info(DMI_PRODUCT_VERSION);
+        if (s && !strnicmp(s, "ThinkPad", 8)) {
+                tp->model_str = kstrdup(s, GFP_KERNEL);
+                if (!tp->model_str)
+                        return -ENOMEM;
         }
 
-        tp->nummodel_str = kstrdup(dmi_get_system_info(DMI_PRODUCT_NAME),
-                                        GFP_KERNEL);
+        s = dmi_get_system_info(DMI_PRODUCT_NAME);
+        tp->nummodel_str = kstrdup(s, GFP_KERNEL);
+        if (s && !tp->nummodel_str)
+                return -ENOMEM;
+
+        return 0;
 }
 
 static int __init probe_for_thinkpad(void)
@@ -6484,7 +6669,13 @@ static int __init thinkpad_acpi_module_init(void)
 
         /* Driver-level probe */
 
-        get_thinkpad_model_data(&thinkpad_id);
+        ret = get_thinkpad_model_data(&thinkpad_id);
+        if (ret) {
+                printk(TPACPI_ERR
+                        "unable to get DMI data: %d\n", ret);
+                thinkpad_acpi_module_exit();
+                return ret;
+        }
         ret = probe_for_thinkpad();
         if (ret) {
                 thinkpad_acpi_module_exit();