Merge commit 'v2.6.35' into kbuild/kconfig

Conflicts:
	scripts/kconfig/Makefile

49 files changed, 3064 insertions, 1181 deletions

diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index e3551d20464f..26386a92f5aa 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -14,11 +14,17 @@ menuconfig MISC_DEVICES
 if MISC_DEVICES
 
 config AD525X_DPOT
-        tristate "Analog Devices AD525x Digital Potentiometers"
-        depends on I2C && SYSFS
+        tristate "Analog Devices Digital Potentiometers"
+        depends on (I2C || SPI) && SYSFS
         help
           If you say yes here, you get support for the Analog Devices
-          AD5258, AD5259, AD5251, AD5252, AD5253, AD5254 and AD5255
+          AD5258, AD5259, AD5251, AD5252, AD5253, AD5254, AD5255
+          AD5160, AD5161, AD5162, AD5165, AD5200, AD5201, AD5203,
+          AD5204, AD5206, AD5207, AD5231, AD5232, AD5233, AD5235,
+          AD5260, AD5262, AD5263, AD5290, AD5291, AD5292, AD5293,
+          AD7376, AD8400, AD8402, AD8403, ADN2850, AD5241, AD5242,
+          AD5243, AD5245, AD5246, AD5247, AD5248, AD5280, AD5282,
+          ADN2860, AD5273, AD5171, AD5170, AD5172, AD5173
           digital potentiometer chips.
 
           See Documentation/misc-devices/ad525x_dpot.txt for the
@@ -27,6 +33,26 @@ config AD525X_DPOT
           This driver can also be built as a module.  If so, the module
           will be called ad525x_dpot.
 
+config AD525X_DPOT_I2C
+        tristate "support I2C bus connection"
+        depends on AD525X_DPOT && I2C
+        help
+          Say Y here if you have a digital potentiometers hooked to an I2C bus.
+
+          To compile this driver as a module, choose M here: the
+          module will be called ad525x_dpot-i2c.
+
+config AD525X_DPOT_SPI
+        tristate "support SPI bus connection"
+        depends on AD525X_DPOT && SPI_MASTER
+        help
+          Say Y here if you have a digital potentiometers hooked to an SPI bus.
+
+          If unsure, say N (but it's safe to say "Y").
+
+          To compile this driver as a module, choose M here: the
+          module will be called ad525x_dpot-spi.
+
 config ATMEL_PWM
         tristate "Atmel AT32/AT91 PWM support"
         depends on AVR32 || ARCH_AT91SAM9263 || ARCH_AT91SAM9RL || ARCH_AT91CAP9
@@ -212,6 +238,15 @@ config CS5535_MFGPT_DEFAULT_IRQ
           want to use a different IRQ by default.  This is here for
           architectures to set as necessary.
 
+config CS5535_CLOCK_EVENT_SRC
+        tristate "CS5535/CS5536 high-res timer (MFGPT) events"
+        depends on GENERIC_TIME && GENERIC_CLOCKEVENTS && CS5535_MFGPT
+        help
+          This driver provides a clock event source based on the MFGPT
+          timer(s) in the CS5535 and CS5536 companion chips.
+          MFGPTs have a better resolution and max interval than the
+          generic PIT, and are suitable for use as high-res timers.
+
 config HP_ILO
         tristate "Channel interface driver for HP iLO/iLO2 processor"
         depends on PCI
@@ -259,6 +294,16 @@ config ISL29003
           This driver can also be built as a module.  If so, the module
           will be called isl29003.
 
+config SENSORS_TSL2550
+        tristate "Taos TSL2550 ambient light sensor"
+        depends on I2C && SYSFS
+        help
+          If you say yes here you get support for the Taos TSL2550
+          ambient light sensor.
+
+          This driver can also be built as a module.  If so, the module
+          will be called tsl2550.
+
 config EP93XX_PWM
         tristate "EP93xx PWM support"
         depends on ARCH_EP93XX
@@ -292,6 +337,22 @@ config TI_DAC7512
           This driver can also be built as a module. If so, the module
           will be calles ti_dac7512.
 
+config VMWARE_BALLOON
+        tristate "VMware Balloon Driver"
+        depends on X86
+        help
+          This is VMware physical memory management driver which acts
+          like a "balloon" that can be inflated to reclaim physical pages
+          by reserving them in the guest and invalidating them in the
+          monitor, freeing up the underlying machine pages so they can
+          be allocated to other guests. The balloon can also be deflated
+          to allow the guest to use more physical memory.
+
+          If unsure, say N.
+
+          To compile this driver as a module, choose M here: the
+          module will be called vmware_balloon.
+
 source "drivers/misc/c2port/Kconfig"
 source "drivers/misc/eeprom/Kconfig"
 source "drivers/misc/cb710/Kconfig"
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 049ff2482f30..6ed06a19474a 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -3,8 +3,9 @@
 #
 
 obj-$(CONFIG_IBM_ASM)           += ibmasm/
-obj-$(CONFIG_HDPU_FEATURES)     += hdpuftrs/
 obj-$(CONFIG_AD525X_DPOT)       += ad525x_dpot.o
+obj-$(CONFIG_AD525X_DPOT_I2C)   += ad525x_dpot-i2c.o
+obj-$(CONFIG_AD525X_DPOT_SPI)   += ad525x_dpot-spi.o
 obj-$(CONFIG_ATMEL_PWM)         += atmel_pwm.o
 obj-$(CONFIG_ATMEL_SSC)         += atmel-ssc.o
 obj-$(CONFIG_ATMEL_TCLIB)       += atmel_tclib.o
@@ -21,6 +22,7 @@ obj-$(CONFIG_SGI_GRU)		+= sgi-gru/
 obj-$(CONFIG_CS5535_MFGPT)      += cs5535-mfgpt.o
 obj-$(CONFIG_HP_ILO)            += hpilo.o
 obj-$(CONFIG_ISL29003)          += isl29003.o
+obj-$(CONFIG_SENSORS_TSL2550)   += tsl2550.o
 obj-$(CONFIG_EP93XX_PWM)        += ep93xx_pwm.o
 obj-$(CONFIG_DS1682)            += ds1682.o
 obj-$(CONFIG_TI_DAC7512)        += ti_dac7512.o
@@ -28,3 +30,4 @@ obj-$(CONFIG_C2PORT)		+= c2port/
 obj-$(CONFIG_IWMC3200TOP)      += iwmc3200top/
 obj-y                           += eeprom/
 obj-y                           += cb710/
+obj-$(CONFIG_VMWARE_BALLOON)    += vmware_balloon.o
diff --git a/drivers/misc/ad525x_dpot-i2c.c b/drivers/misc/ad525x_dpot-i2c.c
new file mode 100644
index 000000000000..374352af7979
--- /dev/null
+++ b/drivers/misc/ad525x_dpot-i2c.c
@@ -0,0 +1,134 @@
+/*
+ * Driver for the Analog Devices digital potentiometers (I2C bus)
+ *
+ * Copyright (C) 2010 Michael Hennerich, Analog Devices Inc.
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/i2c.h>
+#include <linux/module.h>
+
+#include "ad525x_dpot.h"
+
+/* ------------------------------------------------------------------------- */
+/* I2C bus functions */
+static int write_d8(void *client, u8 val)
+{
+        return i2c_smbus_write_byte(client, val);
+}
+
+static int write_r8d8(void *client, u8 reg, u8 val)
+{
+        return i2c_smbus_write_byte_data(client, reg, val);
+}
+
+static int write_r8d16(void *client, u8 reg, u16 val)
+{
+        return i2c_smbus_write_word_data(client, reg, val);
+}
+
+static int read_d8(void *client)
+{
+        return i2c_smbus_read_byte(client);
+}
+
+static int read_r8d8(void *client, u8 reg)
+{
+        return i2c_smbus_read_byte_data(client, reg);
+}
+
+static int read_r8d16(void *client, u8 reg)
+{
+        return i2c_smbus_read_word_data(client, reg);
+}
+
+static const struct ad_dpot_bus_ops bops = {
+        .read_d8        = read_d8,
+        .read_r8d8      = read_r8d8,
+        .read_r8d16     = read_r8d16,
+        .write_d8       = write_d8,
+        .write_r8d8     = write_r8d8,
+        .write_r8d16    = write_r8d16,
+};
+
+static int __devinit ad_dpot_i2c_probe(struct i2c_client *client,
+                                      const struct i2c_device_id *id)
+{
+        struct ad_dpot_bus_data bdata = {
+                .client = client,
+                .bops = &bops,
+        };
+
+        struct ad_dpot_id dpot_id = {
+                .name = (char *) &id->name,
+                .devid = id->driver_data,
+        };
+
+        if (!i2c_check_functionality(client->adapter,
+                                     I2C_FUNC_SMBUS_WORD_DATA)) {
+                dev_err(&client->dev, "SMBUS Word Data not Supported\n");
+                return -EIO;
+        }
+
+        return ad_dpot_probe(&client->dev, &bdata, &dpot_id);
+}
+
+static int __devexit ad_dpot_i2c_remove(struct i2c_client *client)
+{
+        return ad_dpot_remove(&client->dev);
+}
+
+static const struct i2c_device_id ad_dpot_id[] = {
+        {"ad5258", AD5258_ID},
+        {"ad5259", AD5259_ID},
+        {"ad5251", AD5251_ID},
+        {"ad5252", AD5252_ID},
+        {"ad5253", AD5253_ID},
+        {"ad5254", AD5254_ID},
+        {"ad5255", AD5255_ID},
+        {"ad5241", AD5241_ID},
+        {"ad5242", AD5242_ID},
+        {"ad5243", AD5243_ID},
+        {"ad5245", AD5245_ID},
+        {"ad5246", AD5246_ID},
+        {"ad5247", AD5247_ID},
+        {"ad5248", AD5248_ID},
+        {"ad5280", AD5280_ID},
+        {"ad5282", AD5282_ID},
+        {"adn2860", ADN2860_ID},
+        {"ad5273", AD5273_ID},
+        {"ad5171", AD5171_ID},
+        {"ad5170", AD5170_ID},
+        {"ad5172", AD5172_ID},
+        {"ad5173", AD5173_ID},
+        {}
+};
+MODULE_DEVICE_TABLE(i2c, ad_dpot_id);
+
+static struct i2c_driver ad_dpot_i2c_driver = {
+        .driver = {
+                .name   = "ad_dpot",
+                .owner  = THIS_MODULE,
+        },
+        .probe          = ad_dpot_i2c_probe,
+        .remove         = __devexit_p(ad_dpot_i2c_remove),
+        .id_table       = ad_dpot_id,
+};
+
+static int __init ad_dpot_i2c_init(void)
+{
+        return i2c_add_driver(&ad_dpot_i2c_driver);
+}
+module_init(ad_dpot_i2c_init);
+
+static void __exit ad_dpot_i2c_exit(void)
+{
+        i2c_del_driver(&ad_dpot_i2c_driver);
+}
+module_exit(ad_dpot_i2c_exit);
+
+MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
+MODULE_DESCRIPTION("digital potentiometer I2C bus driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("i2c:ad_dpot");
diff --git a/drivers/misc/ad525x_dpot-spi.c b/drivers/misc/ad525x_dpot-spi.c
new file mode 100644
index 000000000000..b8c6df9c8437
--- /dev/null
+++ b/drivers/misc/ad525x_dpot-spi.c
@@ -0,0 +1,172 @@
+/*
+ * Driver for the Analog Devices digital potentiometers (SPI bus)
+ *
+ * Copyright (C) 2010 Michael Hennerich, Analog Devices Inc.
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/spi/spi.h>
+#include <linux/module.h>
+
+#include "ad525x_dpot.h"
+
+static const struct ad_dpot_id ad_dpot_spi_devlist[] = {
+        {.name = "ad5160", .devid = AD5160_ID},
+        {.name = "ad5161", .devid = AD5161_ID},
+        {.name = "ad5162", .devid = AD5162_ID},
+        {.name = "ad5165", .devid = AD5165_ID},
+        {.name = "ad5200", .devid = AD5200_ID},
+        {.name = "ad5201", .devid = AD5201_ID},
+        {.name = "ad5203", .devid = AD5203_ID},
+        {.name = "ad5204", .devid = AD5204_ID},
+        {.name = "ad5206", .devid = AD5206_ID},
+        {.name = "ad5207", .devid = AD5207_ID},
+        {.name = "ad5231", .devid = AD5231_ID},
+        {.name = "ad5232", .devid = AD5232_ID},
+        {.name = "ad5233", .devid = AD5233_ID},
+        {.name = "ad5235", .devid = AD5235_ID},
+        {.name = "ad5260", .devid = AD5260_ID},
+        {.name = "ad5262", .devid = AD5262_ID},
+        {.name = "ad5263", .devid = AD5263_ID},
+        {.name = "ad5290", .devid = AD5290_ID},
+        {.name = "ad5291", .devid = AD5291_ID},
+        {.name = "ad5292", .devid = AD5292_ID},
+        {.name = "ad5293", .devid = AD5293_ID},
+        {.name = "ad7376", .devid = AD7376_ID},
+        {.name = "ad8400", .devid = AD8400_ID},
+        {.name = "ad8402", .devid = AD8402_ID},
+        {.name = "ad8403", .devid = AD8403_ID},
+        {.name = "adn2850", .devid = ADN2850_ID},
+        {}
+};
+
+/* ------------------------------------------------------------------------- */
+
+/* SPI bus functions */
+static int write8(void *client, u8 val)
+{
+        u8 data = val;
+        return spi_write(client, &data, 1);
+}
+
+static int write16(void *client, u8 reg, u8 val)
+{
+        u8 data[2] = {reg, val};
+        return spi_write(client, data, 1);
+}
+
+static int write24(void *client, u8 reg, u16 val)
+{
+        u8 data[3] = {reg, val >> 8, val};
+        return spi_write(client, data, 1);
+}
+
+static int read8(void *client)
+{
+        int ret;
+        u8 data;
+        ret = spi_read(client, &data, 1);
+        if (ret < 0)
+                return ret;
+
+        return data;
+}
+
+static int read16(void *client, u8 reg)
+{
+        int ret;
+        u8 buf_rx[2];
+
+        write16(client, reg, 0);
+        ret = spi_read(client, buf_rx, 2);
+        if (ret < 0)
+                return ret;
+
+        return (buf_rx[0] << 8) |  buf_rx[1];
+}
+
+static int read24(void *client, u8 reg)
+{
+        int ret;
+        u8 buf_rx[3];
+
+        write24(client, reg, 0);
+        ret = spi_read(client, buf_rx, 3);
+        if (ret < 0)
+                return ret;
+
+        return (buf_rx[1] << 8) |  buf_rx[2];
+}
+
+static const struct ad_dpot_bus_ops bops = {
+        .read_d8        = read8,
+        .read_r8d8      = read16,
+        .read_r8d16     = read24,
+        .write_d8       = write8,
+        .write_r8d8     = write16,
+        .write_r8d16    = write24,
+};
+
+static const struct ad_dpot_id *dpot_match_id(const struct ad_dpot_id *id,
+                                                char *name)
+{
+        while (id->name && id->name[0]) {
+                if (strcmp(name, id->name) == 0)
+                        return id;
+                id++;
+        }
+        return NULL;
+}
+
+static int __devinit ad_dpot_spi_probe(struct spi_device *spi)
+{
+        char *name = spi->dev.platform_data;
+        const struct ad_dpot_id *dpot_id;
+
+        struct ad_dpot_bus_data bdata = {
+                .client = spi,
+                .bops = &bops,
+        };
+
+        dpot_id = dpot_match_id(ad_dpot_spi_devlist, name);
+
+        if (dpot_id == NULL) {
+                dev_err(&spi->dev, "%s not in supported device list", name);
+                return -ENODEV;
+        }
+
+        return ad_dpot_probe(&spi->dev, &bdata, dpot_id);
+}
+
+static int __devexit ad_dpot_spi_remove(struct spi_device *spi)
+{
+        return ad_dpot_remove(&spi->dev);
+}
+
+static struct spi_driver ad_dpot_spi_driver = {
+        .driver = {
+                .name   = "ad_dpot",
+                .bus    = &spi_bus_type,
+                .owner  = THIS_MODULE,
+        },
+        .probe          = ad_dpot_spi_probe,
+        .remove         = __devexit_p(ad_dpot_spi_remove),
+};
+
+static int __init ad_dpot_spi_init(void)
+{
+        return spi_register_driver(&ad_dpot_spi_driver);
+}
+module_init(ad_dpot_spi_init);
+
+static void __exit ad_dpot_spi_exit(void)
+{
+        spi_unregister_driver(&ad_dpot_spi_driver);
+}
+module_exit(ad_dpot_spi_exit);
+
+MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
+MODULE_DESCRIPTION("digital potentiometer SPI bus driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("spi:ad_dpot");
diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c
index 30a59f2bacd2..5e6fa8449e8b 100644
--- a/drivers/misc/ad525x_dpot.c
+++ b/drivers/misc/ad525x_dpot.c
@@ -1,6 +1,6 @@
 /*
- * ad525x_dpot: Driver for the Analog Devices AD525x digital potentiometers
- * Copyright (c) 2009 Analog Devices, Inc.
+ * ad525x_dpot: Driver for the Analog Devices digital potentiometers
+ * Copyright (c) 2009-2010 Analog Devices, Inc.
  * Author: Michael Hennerich <hennerich@blackfin.uclinux.org>
  *
  * DEVID                #Wipers         #Positions      Resistor Options (kOhm)
@@ -11,6 +11,47 @@
  * AD5255               3               512             25, 250
  * AD5253               4               64              1, 10, 50, 100
  * AD5254               4               256             1, 10, 50, 100
+ * AD5160               1               256             5, 10, 50, 100
+ * AD5161               1               256             5, 10, 50, 100
+ * AD5162               2               256             2.5, 10, 50, 100
+ * AD5165               1               256             100
+ * AD5200               1               256             10, 50
+ * AD5201               1               33              10, 50
+ * AD5203               4               64              10, 100
+ * AD5204               4               256             10, 50, 100
+ * AD5206               6               256             10, 50, 100
+ * AD5207               2               256             10, 50, 100
+ * AD5231               1               1024            10, 50, 100
+ * AD5232               2               256             10, 50, 100
+ * AD5233               4               64              10, 50, 100
+ * AD5235               2               1024            25, 250
+ * AD5260               1               256             20, 50, 200
+ * AD5262               2               256             20, 50, 200
+ * AD5263               4               256             20, 50, 200
+ * AD5290               1               256             10, 50, 100
+ * AD5291               1               256             20
+ * AD5292               1               1024            20
+ * AD5293               1               1024            20
+ * AD7376               1               128             10, 50, 100, 1M
+ * AD8400               1               256             1, 10, 50, 100
+ * AD8402               2               256             1, 10, 50, 100
+ * AD8403               4               256             1, 10, 50, 100
+ * ADN2850              3               512             25, 250
+ * AD5241               1               256             10, 100, 1M
+ * AD5246               1               128             5, 10, 50, 100
+ * AD5247               1               128             5, 10, 50, 100
+ * AD5245               1               256             5, 10, 50, 100
+ * AD5243               2               256             2.5, 10, 50, 100
+ * AD5248               2               256             2.5, 10, 50, 100
+ * AD5242               2               256             20, 50, 200
+ * AD5280               1               256             20, 50, 200
+ * AD5282               2               256             20, 50, 200
+ * ADN2860              3               512             25, 250
+ * AD5273               1               64              1, 10, 50, 100 (OTP)
+ * AD5171               1               64              5, 10, 50, 100 (OTP)
+ * AD5170               1               256             2.5, 10, 50, 100 (OTP)
+ * AD5172               2               256             2.5, 10, 50, 100 (OTP)
+ * AD5173               2               256             2.5, 10, 50, 100 (OTP)
  *
  * See Documentation/misc-devices/ad525x_dpot.txt for more info.
  *
@@ -28,77 +69,283 @@
 #include <linux/device.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
-#include <linux/slab.h>
-#include <linux/i2c.h>
 #include <linux/delay.h>
+#include <linux/slab.h>
 
-#define DRIVER_NAME                     "ad525x_dpot"
-#define DRIVER_VERSION                  "0.1"
-
-enum dpot_devid {
-        AD5258_ID,
-        AD5259_ID,
-        AD5251_ID,
-        AD5252_ID,
-        AD5253_ID,
-        AD5254_ID,
-        AD5255_ID,
-};
+#define DRIVER_VERSION                  "0.2"
 
-#define AD5258_MAX_POSITION             64
-#define AD5259_MAX_POSITION             256
-#define AD5251_MAX_POSITION             64
-#define AD5252_MAX_POSITION             256
-#define AD5253_MAX_POSITION             64
-#define AD5254_MAX_POSITION             256
-#define AD5255_MAX_POSITION             512
-
-#define AD525X_RDAC0            0
-#define AD525X_RDAC1            1
-#define AD525X_RDAC2            2
-#define AD525X_RDAC3            3
-
-#define AD525X_REG_TOL          0x18
-#define AD525X_TOL_RDAC0        (AD525X_REG_TOL | AD525X_RDAC0)
-#define AD525X_TOL_RDAC1        (AD525X_REG_TOL | AD525X_RDAC1)
-#define AD525X_TOL_RDAC2        (AD525X_REG_TOL | AD525X_RDAC2)
-#define AD525X_TOL_RDAC3        (AD525X_REG_TOL | AD525X_RDAC3)
-
-/* RDAC-to-EEPROM Interface Commands */
-#define AD525X_I2C_RDAC         (0x00 << 5)
-#define AD525X_I2C_EEPROM       (0x01 << 5)
-#define AD525X_I2C_CMD          (0x80)
-
-#define AD525X_DEC_ALL_6DB      (AD525X_I2C_CMD | (0x4 << 3))
-#define AD525X_INC_ALL_6DB      (AD525X_I2C_CMD | (0x9 << 3))
-#define AD525X_DEC_ALL          (AD525X_I2C_CMD | (0x6 << 3))
-#define AD525X_INC_ALL          (AD525X_I2C_CMD | (0xB << 3))
-
-static s32 ad525x_read(struct i2c_client *client, u8 reg);
-static s32 ad525x_write(struct i2c_client *client, u8 reg, u8 value);
+#include "ad525x_dpot.h"
 
 /*
  * Client data (each client gets its own)
  */
 
 struct dpot_data {
+        struct ad_dpot_bus_data bdata;
         struct mutex update_lock;
         unsigned rdac_mask;
         unsigned max_pos;
-        unsigned devid;
+        unsigned long devid;
+        unsigned uid;
+        unsigned feat;
+        unsigned wipers;
+        u16 rdac_cache[MAX_RDACS];
+        DECLARE_BITMAP(otp_en_mask, MAX_RDACS);
 };
 
+static inline int dpot_read_d8(struct dpot_data *dpot)
+{
+        return dpot->bdata.bops->read_d8(dpot->bdata.client);
+}
+
+static inline int dpot_read_r8d8(struct dpot_data *dpot, u8 reg)
+{
+        return dpot->bdata.bops->read_r8d8(dpot->bdata.client, reg);
+}
+
+static inline int dpot_read_r8d16(struct dpot_data *dpot, u8 reg)
+{
+        return dpot->bdata.bops->read_r8d16(dpot->bdata.client, reg);
+}
+
+static inline int dpot_write_d8(struct dpot_data *dpot, u8 val)
+{
+        return dpot->bdata.bops->write_d8(dpot->bdata.client, val);
+}
+
+static inline int dpot_write_r8d8(struct dpot_data *dpot, u8 reg, u16 val)
+{
+        return dpot->bdata.bops->write_r8d8(dpot->bdata.client, reg, val);
+}
+
+static inline int dpot_write_r8d16(struct dpot_data *dpot, u8 reg, u16 val)
+{
+        return dpot->bdata.bops->write_r8d16(dpot->bdata.client, reg, val);
+}
+
+static s32 dpot_read_spi(struct dpot_data *dpot, u8 reg)
+{
+        unsigned ctrl = 0;
+
+        if (!(reg & (DPOT_ADDR_EEPROM | DPOT_ADDR_CMD))) {
+
+                if (dpot->feat & F_RDACS_WONLY)
+                        return dpot->rdac_cache[reg & DPOT_RDAC_MASK];
+
+                if (dpot->uid == DPOT_UID(AD5291_ID) ||
+                        dpot->uid == DPOT_UID(AD5292_ID) ||
+                        dpot->uid == DPOT_UID(AD5293_ID))
+                        return dpot_read_r8d8(dpot,
+                                DPOT_AD5291_READ_RDAC << 2);
+
+                ctrl = DPOT_SPI_READ_RDAC;
+        } else if (reg & DPOT_ADDR_EEPROM) {
+                ctrl = DPOT_SPI_READ_EEPROM;
+        }
+
+        if (dpot->feat & F_SPI_16BIT)
+                return dpot_read_r8d8(dpot, ctrl);
+        else if (dpot->feat & F_SPI_24BIT)
+                return dpot_read_r8d16(dpot, ctrl);
+
+        return -EFAULT;
+}
+
+static s32 dpot_read_i2c(struct dpot_data *dpot, u8 reg)
+{
+        unsigned ctrl = 0;
+        switch (dpot->uid) {
+        case DPOT_UID(AD5246_ID):
+        case DPOT_UID(AD5247_ID):
+                return dpot_read_d8(dpot);
+        case DPOT_UID(AD5245_ID):
+        case DPOT_UID(AD5241_ID):
+        case DPOT_UID(AD5242_ID):
+        case DPOT_UID(AD5243_ID):
+        case DPOT_UID(AD5248_ID):
+        case DPOT_UID(AD5280_ID):
+        case DPOT_UID(AD5282_ID):
+                ctrl = ((reg & DPOT_RDAC_MASK) == DPOT_RDAC0) ?
+                        0 : DPOT_AD5291_RDAC_AB;
+                return dpot_read_r8d8(dpot, ctrl);
+        case DPOT_UID(AD5170_ID):
+        case DPOT_UID(AD5171_ID):
+        case DPOT_UID(AD5273_ID):
+                        return dpot_read_d8(dpot);
+        case DPOT_UID(AD5172_ID):
+        case DPOT_UID(AD5173_ID):
+                ctrl = ((reg & DPOT_RDAC_MASK) == DPOT_RDAC0) ?
+                        0 : DPOT_AD5272_3_A0;
+                return dpot_read_r8d8(dpot, ctrl);
+        default:
+                if ((reg & DPOT_REG_TOL) || (dpot->max_pos > 256))
+                        return dpot_read_r8d16(dpot, (reg & 0xF8) |
+                                        ((reg & 0x7) << 1));
+                else
+                        return dpot_read_r8d8(dpot, reg);
+        }
+}
+
+static s32 dpot_read(struct dpot_data *dpot, u8 reg)
+{
+        if (dpot->feat & F_SPI)
+                return dpot_read_spi(dpot, reg);
+        else
+                return dpot_read_i2c(dpot, reg);
+}
+
+static s32 dpot_write_spi(struct dpot_data *dpot, u8 reg, u16 value)
+{
+        unsigned val = 0;
+
+        if (!(reg & (DPOT_ADDR_EEPROM | DPOT_ADDR_CMD))) {
+                if (dpot->feat & F_RDACS_WONLY)
+                        dpot->rdac_cache[reg & DPOT_RDAC_MASK] = value;
+
+                if (dpot->feat & F_AD_APPDATA) {
+                        if (dpot->feat & F_SPI_8BIT) {
+                                val = ((reg & DPOT_RDAC_MASK) <<
+                                        DPOT_MAX_POS(dpot->devid)) |
+                                        value;
+                                return dpot_write_d8(dpot, val);
+                        } else if (dpot->feat & F_SPI_16BIT) {
+                                val = ((reg & DPOT_RDAC_MASK) <<
+                                        DPOT_MAX_POS(dpot->devid)) |
+                                        value;
+                                return dpot_write_r8d8(dpot, val >> 8,
+                                        val & 0xFF);
+                        } else
+                                BUG();
+                } else {
+                        if (dpot->uid == DPOT_UID(AD5291_ID) ||
+                                dpot->uid == DPOT_UID(AD5292_ID) ||
+                                dpot->uid == DPOT_UID(AD5293_ID))
+                                return dpot_write_r8d8(dpot,
+                                        (DPOT_AD5291_RDAC << 2) |
+                                        (value >> 8), value & 0xFF);
+
+                        val = DPOT_SPI_RDAC | (reg & DPOT_RDAC_MASK);
+                }
+        } else if (reg & DPOT_ADDR_EEPROM) {
+                val = DPOT_SPI_EEPROM | (reg & DPOT_RDAC_MASK);
+        } else if (reg & DPOT_ADDR_CMD) {
+                switch (reg) {
+                case DPOT_DEC_ALL_6DB:
+                        val = DPOT_SPI_DEC_ALL_6DB;
+                        break;
+                case DPOT_INC_ALL_6DB:
+                        val = DPOT_SPI_INC_ALL_6DB;
+                        break;
+                case DPOT_DEC_ALL:
+                        val = DPOT_SPI_DEC_ALL;
+                        break;
+                case DPOT_INC_ALL:
+                        val = DPOT_SPI_INC_ALL;
+                        break;
+                }
+        } else
+                BUG();
+
+        if (dpot->feat & F_SPI_16BIT)
+                return dpot_write_r8d8(dpot, val, value);
+        else if (dpot->feat & F_SPI_24BIT)
+                return dpot_write_r8d16(dpot, val, value);
+
+        return -EFAULT;
+}
+
+static s32 dpot_write_i2c(struct dpot_data *dpot, u8 reg, u16 value)
+{
+        /* Only write the instruction byte for certain commands */
+        unsigned tmp = 0, ctrl = 0;
+
+        switch (dpot->uid) {
+        case DPOT_UID(AD5246_ID):
+        case DPOT_UID(AD5247_ID):
+                return dpot_write_d8(dpot, value);
+                break;
+
+        case DPOT_UID(AD5245_ID):
+        case DPOT_UID(AD5241_ID):
+        case DPOT_UID(AD5242_ID):
+        case DPOT_UID(AD5243_ID):
+        case DPOT_UID(AD5248_ID):
+        case DPOT_UID(AD5280_ID):
+        case DPOT_UID(AD5282_ID):
+                ctrl = ((reg & DPOT_RDAC_MASK) == DPOT_RDAC0) ?
+                        0 : DPOT_AD5291_RDAC_AB;
+                return dpot_write_r8d8(dpot, ctrl, value);
+                break;
+        case DPOT_UID(AD5171_ID):
+        case DPOT_UID(AD5273_ID):
+                if (reg & DPOT_ADDR_OTP) {
+                        tmp = dpot_read_d8(dpot);
+                        if (tmp >> 6) /* Ready to Program? */
+                                return -EFAULT;
+                        ctrl = DPOT_AD5273_FUSE;
+                }
+                return dpot_write_r8d8(dpot, ctrl, value);
+                break;
+        case DPOT_UID(AD5172_ID):
+        case DPOT_UID(AD5173_ID):
+                ctrl = ((reg & DPOT_RDAC_MASK) == DPOT_RDAC0) ?
+                        0 : DPOT_AD5272_3_A0;
+                if (reg & DPOT_ADDR_OTP) {
+                        tmp = dpot_read_r8d16(dpot, ctrl);
+                        if (tmp >> 14) /* Ready to Program? */
+                                return -EFAULT;
+                        ctrl |= DPOT_AD5270_2_3_FUSE;
+                }
+                return dpot_write_r8d8(dpot, ctrl, value);
+                break;
+        case DPOT_UID(AD5170_ID):
+                if (reg & DPOT_ADDR_OTP) {
+                        tmp = dpot_read_r8d16(dpot, tmp);
+                        if (tmp >> 14) /* Ready to Program? */
+                                return -EFAULT;
+                        ctrl = DPOT_AD5270_2_3_FUSE;
+                }
+                return dpot_write_r8d8(dpot, ctrl, value);
+                break;
+        default:
+                if (reg & DPOT_ADDR_CMD)
+                        return dpot_write_d8(dpot, reg);
+
+                if (dpot->max_pos > 256)
+                        return dpot_write_r8d16(dpot, (reg & 0xF8) |
+                                                ((reg & 0x7) << 1), value);
+                else
+                        /* All other registers require instruction + data bytes */
+                        return dpot_write_r8d8(dpot, reg, value);
+        }
+}
+
+
+static s32 dpot_write(struct dpot_data *dpot, u8 reg, u16 value)
+{
+        if (dpot->feat & F_SPI)
+                return dpot_write_spi(dpot, reg, value);
+        else
+                return dpot_write_i2c(dpot, reg, value);
+}
+
 /* sysfs functions */
 
 static ssize_t sysfs_show_reg(struct device *dev,
-                              struct device_attribute *attr, char *buf, u32 reg)
+                              struct device_attribute *attr,
+                              char *buf, u32 reg)
 {
-        struct i2c_client *client = to_i2c_client(dev);
-        struct dpot_data *data = i2c_get_clientdata(client);
+        struct dpot_data *data = dev_get_drvdata(dev);
         s32 value;
 
+        if (reg & DPOT_ADDR_OTP_EN)
+                return sprintf(buf, "%s\n",
+                        test_bit(DPOT_RDAC_MASK & reg, data->otp_en_mask) ?
+                        "enabled" : "disabled");
+
+
         mutex_lock(&data->update_lock);
-        value = ad525x_read(client, reg);
+        value = dpot_read(data, reg);
         mutex_unlock(&data->update_lock);
 
         if (value < 0)
@@ -111,7 +358,7 @@ static ssize_t sysfs_show_reg(struct device *dev,
          * datasheet (Rev. A) for more details.
          */
 
-        if (reg & AD525X_REG_TOL)
+        if (reg & DPOT_REG_TOL)
                 return sprintf(buf, "0x%04x\n", value & 0xFFFF);
         else
                 return sprintf(buf, "%u\n", value & data->rdac_mask);
@@ -121,11 +368,23 @@ static ssize_t sysfs_set_reg(struct device *dev,
                              struct device_attribute *attr,
                              const char *buf, size_t count, u32 reg)
 {
-        struct i2c_client *client = to_i2c_client(dev);
-        struct dpot_data *data = i2c_get_clientdata(client);
+        struct dpot_data *data = dev_get_drvdata(dev);
         unsigned long value;
         int err;
 
+        if (reg & DPOT_ADDR_OTP_EN) {
+                if (!strncmp(buf, "enabled", sizeof("enabled")))
+                        set_bit(DPOT_RDAC_MASK & reg, data->otp_en_mask);
+                else
+                        clear_bit(DPOT_RDAC_MASK & reg, data->otp_en_mask);
+
+                return count;
+        }
+
+        if ((reg & DPOT_ADDR_OTP) &&
+                !test_bit(DPOT_RDAC_MASK & reg, data->otp_en_mask))
+                return -EPERM;
+
         err = strict_strtoul(buf, 10, &value);
         if (err)
                 return err;
@@ -134,9 +393,11 @@ static ssize_t sysfs_set_reg(struct device *dev,
                 value = data->rdac_mask;
 
         mutex_lock(&data->update_lock);
-        ad525x_write(client, reg, value);
-        if (reg & AD525X_I2C_EEPROM)
+        dpot_write(data, reg, value);
+        if (reg & DPOT_ADDR_EEPROM)
                 msleep(26);     /* Sleep while the EEPROM updates */
+        else if (reg & DPOT_ADDR_OTP)
+                msleep(400);    /* Sleep while the OTP updates */
         mutex_unlock(&data->update_lock);
 
         return count;
@@ -146,11 +407,10 @@ static ssize_t sysfs_do_cmd(struct device *dev,
                             struct device_attribute *attr,
                             const char *buf, size_t count, u32 reg)
 {
-        struct i2c_client *client = to_i2c_client(dev);
-        struct dpot_data *data = i2c_get_clientdata(client);
+        struct dpot_data *data = dev_get_drvdata(dev);
 
         mutex_lock(&data->update_lock);
-        ad525x_write(client, reg, 0);
+        dpot_write(data, reg, 0);
         mutex_unlock(&data->update_lock);
 
         return count;
@@ -158,244 +418,131 @@ static ssize_t sysfs_do_cmd(struct device *dev,
 
 /* ------------------------------------------------------------------------- */
 
-static ssize_t show_rdac0(struct device *dev,
-                          struct device_attribute *attr, char *buf)
-{
-        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_RDAC | AD525X_RDAC0);
-}
-
-static ssize_t set_rdac0(struct device *dev,
-                         struct device_attribute *attr,
-                         const char *buf, size_t count)
-{
-        return sysfs_set_reg(dev, attr, buf, count,
-                             AD525X_I2C_RDAC | AD525X_RDAC0);
-}
-
-static DEVICE_ATTR(rdac0, S_IWUSR | S_IRUGO, show_rdac0, set_rdac0);
-
-static ssize_t show_eeprom0(struct device *dev,
-                            struct device_attribute *attr, char *buf)
-{
-        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_EEPROM | AD525X_RDAC0);
-}
-
-static ssize_t set_eeprom0(struct device *dev,
-                           struct device_attribute *attr,
-                           const char *buf, size_t count)
-{
-        return sysfs_set_reg(dev, attr, buf, count,
-                             AD525X_I2C_EEPROM | AD525X_RDAC0);
-}
-
-static DEVICE_ATTR(eeprom0, S_IWUSR | S_IRUGO, show_eeprom0, set_eeprom0);
-
-static ssize_t show_tolerance0(struct device *dev,
-                               struct device_attribute *attr, char *buf)
-{
-        return sysfs_show_reg(dev, attr, buf,
-                              AD525X_I2C_EEPROM | AD525X_TOL_RDAC0);
-}
-
-static DEVICE_ATTR(tolerance0, S_IRUGO, show_tolerance0, NULL);
-
-/* ------------------------------------------------------------------------- */
-
-static ssize_t show_rdac1(struct device *dev,
-                          struct device_attribute *attr, char *buf)
-{
-        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_RDAC | AD525X_RDAC1);
-}
-
-static ssize_t set_rdac1(struct device *dev,
-                         struct device_attribute *attr,
-                         const char *buf, size_t count)
-{
-        return sysfs_set_reg(dev, attr, buf, count,
-                             AD525X_I2C_RDAC | AD525X_RDAC1);
-}
-
-static DEVICE_ATTR(rdac1, S_IWUSR | S_IRUGO, show_rdac1, set_rdac1);
-
-static ssize_t show_eeprom1(struct device *dev,
-                            struct device_attribute *attr, char *buf)
-{
-        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_EEPROM | AD525X_RDAC1);
-}
-
-static ssize_t set_eeprom1(struct device *dev,
-                           struct device_attribute *attr,
-                           const char *buf, size_t count)
-{
-        return sysfs_set_reg(dev, attr, buf, count,
-                             AD525X_I2C_EEPROM | AD525X_RDAC1);
-}
-
-static DEVICE_ATTR(eeprom1, S_IWUSR | S_IRUGO, show_eeprom1, set_eeprom1);
-
-static ssize_t show_tolerance1(struct device *dev,
-                               struct device_attribute *attr, char *buf)
-{
-        return sysfs_show_reg(dev, attr, buf,
-                              AD525X_I2C_EEPROM | AD525X_TOL_RDAC1);
-}
-
-static DEVICE_ATTR(tolerance1, S_IRUGO, show_tolerance1, NULL);
-
-/* ------------------------------------------------------------------------- */
-
-static ssize_t show_rdac2(struct device *dev,
-                          struct device_attribute *attr, char *buf)
-{
-        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_RDAC | AD525X_RDAC2);
-}
-
-static ssize_t set_rdac2(struct device *dev,
-                         struct device_attribute *attr,
-                         const char *buf, size_t count)
-{
-        return sysfs_set_reg(dev, attr, buf, count,
-                             AD525X_I2C_RDAC | AD525X_RDAC2);
-}
-
-static DEVICE_ATTR(rdac2, S_IWUSR | S_IRUGO, show_rdac2, set_rdac2);
-
-static ssize_t show_eeprom2(struct device *dev,
-                            struct device_attribute *attr, char *buf)
-{
-        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_EEPROM | AD525X_RDAC2);
-}
-
-static ssize_t set_eeprom2(struct device *dev,
-                           struct device_attribute *attr,
-                           const char *buf, size_t count)
-{
-        return sysfs_set_reg(dev, attr, buf, count,
-                             AD525X_I2C_EEPROM | AD525X_RDAC2);
-}
-
-static DEVICE_ATTR(eeprom2, S_IWUSR | S_IRUGO, show_eeprom2, set_eeprom2);
-
-static ssize_t show_tolerance2(struct device *dev,
-                               struct device_attribute *attr, char *buf)
-{
-        return sysfs_show_reg(dev, attr, buf,
-                              AD525X_I2C_EEPROM | AD525X_TOL_RDAC2);
-}
-
-static DEVICE_ATTR(tolerance2, S_IRUGO, show_tolerance2, NULL);
-
-/* ------------------------------------------------------------------------- */
-
-static ssize_t show_rdac3(struct device *dev,
-                          struct device_attribute *attr, char *buf)
-{
-        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_RDAC | AD525X_RDAC3);
-}
-
-static ssize_t set_rdac3(struct device *dev,
-                         struct device_attribute *attr,
-                         const char *buf, size_t count)
-{
-        return sysfs_set_reg(dev, attr, buf, count,
-                             AD525X_I2C_RDAC | AD525X_RDAC3);
-}
-
-static DEVICE_ATTR(rdac3, S_IWUSR | S_IRUGO, show_rdac3, set_rdac3);
-
-static ssize_t show_eeprom3(struct device *dev,
-                            struct device_attribute *attr, char *buf)
-{
-        return sysfs_show_reg(dev, attr, buf, AD525X_I2C_EEPROM | AD525X_RDAC3);
-}
-
-static ssize_t set_eeprom3(struct device *dev,
-                           struct device_attribute *attr,
-                           const char *buf, size_t count)
-{
-        return sysfs_set_reg(dev, attr, buf, count,
-                             AD525X_I2C_EEPROM | AD525X_RDAC3);
-}
+#define DPOT_DEVICE_SHOW(_name, _reg) static ssize_t \
+show_##_name(struct device *dev, \
+                          struct device_attribute *attr, char *buf) \
+{ \
+        return sysfs_show_reg(dev, attr, buf, _reg); \
+}
+
+#define DPOT_DEVICE_SET(_name, _reg) static ssize_t \
+set_##_name(struct device *dev, \
+                         struct device_attribute *attr, \
+                         const char *buf, size_t count) \
+{ \
+        return sysfs_set_reg(dev, attr, buf, count, _reg); \
+}
+
+#define DPOT_DEVICE_SHOW_SET(name, reg) \
+DPOT_DEVICE_SHOW(name, reg) \
+DPOT_DEVICE_SET(name, reg) \
+static DEVICE_ATTR(name, S_IWUSR | S_IRUGO, show_##name, set_##name);
+
+#define DPOT_DEVICE_SHOW_ONLY(name, reg) \
+DPOT_DEVICE_SHOW(name, reg) \
+static DEVICE_ATTR(name, S_IWUSR | S_IRUGO, show_##name, NULL);
+
+DPOT_DEVICE_SHOW_SET(rdac0, DPOT_ADDR_RDAC | DPOT_RDAC0);
+DPOT_DEVICE_SHOW_SET(eeprom0, DPOT_ADDR_EEPROM | DPOT_RDAC0);
+DPOT_DEVICE_SHOW_ONLY(tolerance0, DPOT_ADDR_EEPROM | DPOT_TOL_RDAC0);
+DPOT_DEVICE_SHOW_SET(otp0, DPOT_ADDR_OTP | DPOT_RDAC0);
+DPOT_DEVICE_SHOW_SET(otp0en, DPOT_ADDR_OTP_EN | DPOT_RDAC0);
+
+DPOT_DEVICE_SHOW_SET(rdac1, DPOT_ADDR_RDAC | DPOT_RDAC1);
+DPOT_DEVICE_SHOW_SET(eeprom1, DPOT_ADDR_EEPROM | DPOT_RDAC1);
+DPOT_DEVICE_SHOW_ONLY(tolerance1, DPOT_ADDR_EEPROM | DPOT_TOL_RDAC1);
+DPOT_DEVICE_SHOW_SET(otp1, DPOT_ADDR_OTP | DPOT_RDAC1);
+DPOT_DEVICE_SHOW_SET(otp1en, DPOT_ADDR_OTP_EN | DPOT_RDAC1);
+
+DPOT_DEVICE_SHOW_SET(rdac2, DPOT_ADDR_RDAC | DPOT_RDAC2);
+DPOT_DEVICE_SHOW_SET(eeprom2, DPOT_ADDR_EEPROM | DPOT_RDAC2);
+DPOT_DEVICE_SHOW_ONLY(tolerance2, DPOT_ADDR_EEPROM | DPOT_TOL_RDAC2);
+DPOT_DEVICE_SHOW_SET(otp2, DPOT_ADDR_OTP | DPOT_RDAC2);
+DPOT_DEVICE_SHOW_SET(otp2en, DPOT_ADDR_OTP_EN | DPOT_RDAC2);
+
+DPOT_DEVICE_SHOW_SET(rdac3, DPOT_ADDR_RDAC | DPOT_RDAC3);
+DPOT_DEVICE_SHOW_SET(eeprom3, DPOT_ADDR_EEPROM | DPOT_RDAC3);
+DPOT_DEVICE_SHOW_ONLY(tolerance3, DPOT_ADDR_EEPROM | DPOT_TOL_RDAC3);
+DPOT_DEVICE_SHOW_SET(otp3, DPOT_ADDR_OTP | DPOT_RDAC3);
+DPOT_DEVICE_SHOW_SET(otp3en, DPOT_ADDR_OTP_EN | DPOT_RDAC3);
+
+DPOT_DEVICE_SHOW_SET(rdac4, DPOT_ADDR_RDAC | DPOT_RDAC4);
+DPOT_DEVICE_SHOW_SET(eeprom4, DPOT_ADDR_EEPROM | DPOT_RDAC4);
+DPOT_DEVICE_SHOW_ONLY(tolerance4, DPOT_ADDR_EEPROM | DPOT_TOL_RDAC4);
+DPOT_DEVICE_SHOW_SET(otp4, DPOT_ADDR_OTP | DPOT_RDAC4);
+DPOT_DEVICE_SHOW_SET(otp4en, DPOT_ADDR_OTP_EN | DPOT_RDAC4);
+
+DPOT_DEVICE_SHOW_SET(rdac5, DPOT_ADDR_RDAC | DPOT_RDAC5);
+DPOT_DEVICE_SHOW_SET(eeprom5, DPOT_ADDR_EEPROM | DPOT_RDAC5);
+DPOT_DEVICE_SHOW_ONLY(tolerance5, DPOT_ADDR_EEPROM | DPOT_TOL_RDAC5);
+DPOT_DEVICE_SHOW_SET(otp5, DPOT_ADDR_OTP | DPOT_RDAC5);
+DPOT_DEVICE_SHOW_SET(otp5en, DPOT_ADDR_OTP_EN | DPOT_RDAC5);
+
+static const struct attribute *dpot_attrib_wipers[] = {
+        &dev_attr_rdac0.attr,
+        &dev_attr_rdac1.attr,
+        &dev_attr_rdac2.attr,
+        &dev_attr_rdac3.attr,
+        &dev_attr_rdac4.attr,
+        &dev_attr_rdac5.attr,
+        NULL
+};
 
-static DEVICE_ATTR(eeprom3, S_IWUSR | S_IRUGO, show_eeprom3, set_eeprom3);
+static const struct attribute *dpot_attrib_eeprom[] = {
+        &dev_attr_eeprom0.attr,
+        &dev_attr_eeprom1.attr,
+        &dev_attr_eeprom2.attr,
+        &dev_attr_eeprom3.attr,
+        &dev_attr_eeprom4.attr,
+        &dev_attr_eeprom5.attr,
+        NULL
+};
 
-static ssize_t show_tolerance3(struct device *dev,
-                               struct device_attribute *attr, char *buf)
-{
-        return sysfs_show_reg(dev, attr, buf,
-                              AD525X_I2C_EEPROM | AD525X_TOL_RDAC3);
-}
+static const struct attribute *dpot_attrib_otp[] = {
+        &dev_attr_otp0.attr,
+        &dev_attr_otp1.attr,
+        &dev_attr_otp2.attr,
+        &dev_attr_otp3.attr,
+        &dev_attr_otp4.attr,
+        &dev_attr_otp5.attr,
+        NULL
+};
 
-static DEVICE_ATTR(tolerance3, S_IRUGO, show_tolerance3, NULL);
-
-static struct attribute *ad525x_attributes_wipers[4][4] = {
-        {
-                &dev_attr_rdac0.attr,
-                &dev_attr_eeprom0.attr,
-                &dev_attr_tolerance0.attr,
-                NULL
-        }, {
-                &dev_attr_rdac1.attr,
-                &dev_attr_eeprom1.attr,
-                &dev_attr_tolerance1.attr,
-                NULL
-        }, {
-                &dev_attr_rdac2.attr,
-                &dev_attr_eeprom2.attr,
-                &dev_attr_tolerance2.attr,
-                NULL
-        }, {
-                &dev_attr_rdac3.attr,
-                &dev_attr_eeprom3.attr,
-                &dev_attr_tolerance3.attr,
-                NULL
-        }
+static const struct attribute *dpot_attrib_otp_en[] = {
+        &dev_attr_otp0en.attr,
+        &dev_attr_otp1en.attr,
+        &dev_attr_otp2en.attr,
+        &dev_attr_otp3en.attr,
+        &dev_attr_otp4en.attr,
+        &dev_attr_otp5en.attr,
+        NULL
 };
 
-static const struct attribute_group ad525x_group_wipers[] = {
-        {.attrs = ad525x_attributes_wipers[AD525X_RDAC0]},
-        {.attrs = ad525x_attributes_wipers[AD525X_RDAC1]},
-        {.attrs = ad525x_attributes_wipers[AD525X_RDAC2]},
-        {.attrs = ad525x_attributes_wipers[AD525X_RDAC3]},
+static const struct attribute *dpot_attrib_tolerance[] = {
+        &dev_attr_tolerance0.attr,
+        &dev_attr_tolerance1.attr,
+        &dev_attr_tolerance2.attr,
+        &dev_attr_tolerance3.attr,
+        &dev_attr_tolerance4.attr,
+        &dev_attr_tolerance5.attr,
+        NULL
 };
 
 /* ------------------------------------------------------------------------- */
 
-static ssize_t set_inc_all(struct device *dev,
-                           struct device_attribute *attr,
-                           const char *buf, size_t count)
-{
-        return sysfs_do_cmd(dev, attr, buf, count, AD525X_INC_ALL);
-}
+#define DPOT_DEVICE_DO_CMD(_name, _cmd) static ssize_t \
+set_##_name(struct device *dev, \
+                         struct device_attribute *attr, \
+                         const char *buf, size_t count) \
+{ \
+        return sysfs_do_cmd(dev, attr, buf, count, _cmd); \
+} \
+static DEVICE_ATTR(_name, S_IWUSR | S_IRUGO, NULL, set_##_name);
 
-static DEVICE_ATTR(inc_all, S_IWUSR, NULL, set_inc_all);
-
-static ssize_t set_dec_all(struct device *dev,
-                           struct device_attribute *attr,
-                           const char *buf, size_t count)
-{
-        return sysfs_do_cmd(dev, attr, buf, count, AD525X_DEC_ALL);
-}
-
-static DEVICE_ATTR(dec_all, S_IWUSR, NULL, set_dec_all);
-
-static ssize_t set_inc_all_6db(struct device *dev,
-                               struct device_attribute *attr,
-                               const char *buf, size_t count)
-{
-        return sysfs_do_cmd(dev, attr, buf, count, AD525X_INC_ALL_6DB);
-}
-
-static DEVICE_ATTR(inc_all_6db, S_IWUSR, NULL, set_inc_all_6db);
-
-static ssize_t set_dec_all_6db(struct device *dev,
-                               struct device_attribute *attr,
-                               const char *buf, size_t count)
-{
-        return sysfs_do_cmd(dev, attr, buf, count, AD525X_DEC_ALL_6DB);
-}
-
-static DEVICE_ATTR(dec_all_6db, S_IWUSR, NULL, set_dec_all_6db);
+DPOT_DEVICE_DO_CMD(inc_all, DPOT_INC_ALL);
+DPOT_DEVICE_DO_CMD(dec_all, DPOT_DEC_ALL);
+DPOT_DEVICE_DO_CMD(inc_all_6db, DPOT_INC_ALL_6DB);
+DPOT_DEVICE_DO_CMD(dec_all_6db, DPOT_DEC_ALL_6DB);
 
 static struct attribute *ad525x_attributes_commands[] = {
         &dev_attr_inc_all.attr,
@@ -409,74 +556,56 @@ static const struct attribute_group ad525x_group_commands = {
         .attrs = ad525x_attributes_commands,
 };
 
-/* ------------------------------------------------------------------------- */
-
-/* i2c device functions */
+__devinit int ad_dpot_add_files(struct device *dev,
+                unsigned features, unsigned rdac)
+{
+        int err = sysfs_create_file(&dev->kobj,
+                dpot_attrib_wipers[rdac]);
+        if (features & F_CMD_EEP)
+                err |= sysfs_create_file(&dev->kobj,
+                        dpot_attrib_eeprom[rdac]);
+        if (features & F_CMD_TOL)
+                err |= sysfs_create_file(&dev->kobj,
+                        dpot_attrib_tolerance[rdac]);
+        if (features & F_CMD_OTP) {
+                err |= sysfs_create_file(&dev->kobj,
+                        dpot_attrib_otp_en[rdac]);
+                err |= sysfs_create_file(&dev->kobj,
+                        dpot_attrib_otp[rdac]);
+        }
 
-/**
- * ad525x_read - return the value contained in the specified register
- * on the AD5258 device.
- * @client: value returned from i2c_new_device()
- * @reg: the register to read
- *
- * If the tolerance register is specified, 2 bytes are returned.
- * Otherwise, 1 byte is returned.  A negative value indicates an error
- * occurred while reading the register.
- */
-static s32 ad525x_read(struct i2c_client *client, u8 reg)
-{
-        struct dpot_data *data = i2c_get_clientdata(client);
+        if (err)
+                dev_err(dev, "failed to register sysfs hooks for RDAC%d\n",
+                        rdac);
 
-        if ((reg & AD525X_REG_TOL) || (data->max_pos > 256))
-                return i2c_smbus_read_word_data(client, (reg & 0xF8) |
-                                                ((reg & 0x7) << 1));
-        else
-                return i2c_smbus_read_byte_data(client, reg);
+        return err;
 }
 
-/**
- * ad525x_write - store the given value in the specified register on
- * the AD5258 device.
- * @client: value returned from i2c_new_device()
- * @reg: the register to write
- * @value: the byte to store in the register
- *
- * For certain instructions that do not require a data byte, "NULL"
- * should be specified for the "value" parameter.  These instructions
- * include NOP, RESTORE_FROM_EEPROM, and STORE_TO_EEPROM.
- *
- * A negative return value indicates an error occurred while reading
- * the register.
- */
-static s32 ad525x_write(struct i2c_client *client, u8 reg, u8 value)
-{
-        struct dpot_data *data = i2c_get_clientdata(client);
-
-        /* Only write the instruction byte for certain commands */
-        if (reg & AD525X_I2C_CMD)
-                return i2c_smbus_write_byte(client, reg);
-
-        if (data->max_pos > 256)
-                return i2c_smbus_write_word_data(client, (reg & 0xF8) |
-                                                ((reg & 0x7) << 1), value);
-        else
-                /* All other registers require instruction + data bytes */
-                return i2c_smbus_write_byte_data(client, reg, value);
+inline void ad_dpot_remove_files(struct device *dev,
+                unsigned features, unsigned rdac)
+{
+        sysfs_remove_file(&dev->kobj,
+                dpot_attrib_wipers[rdac]);
+        if (features & F_CMD_EEP)
+                sysfs_remove_file(&dev->kobj,
+                        dpot_attrib_eeprom[rdac]);
+        if (features & F_CMD_TOL)
+                sysfs_remove_file(&dev->kobj,
+                        dpot_attrib_tolerance[rdac]);
+        if (features & F_CMD_OTP) {
+                sysfs_remove_file(&dev->kobj,
+                        dpot_attrib_otp_en[rdac]);
+                sysfs_remove_file(&dev->kobj,
+                        dpot_attrib_otp[rdac]);
+        }
 }
 
-static int ad525x_probe(struct i2c_client *client,
-                        const struct i2c_device_id *id)
+__devinit int ad_dpot_probe(struct device *dev,
+                struct ad_dpot_bus_data *bdata, const struct ad_dpot_id *id)
 {
-        struct device *dev = &client->dev;
-        struct dpot_data *data;
-        int err = 0;
 
-        dev_dbg(dev, "%s\n", __func__);
-
-        if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE)) {
-                dev_err(dev, "missing I2C functionality for this driver\n");
-                goto exit;
-        }
+        struct dpot_data *data;
+        int i, err = 0;
 
         data = kzalloc(sizeof(struct dpot_data), GFP_KERNEL);
         if (!data) {
@@ -484,183 +613,74 @@ static int ad525x_probe(struct i2c_client *client,
                 goto exit;
         }
 
-        i2c_set_clientdata(client, data);
+        dev_set_drvdata(dev, data);
         mutex_init(&data->update_lock);
 
-        switch (id->driver_data) {
-        case AD5258_ID:
-                data->max_pos = AD5258_MAX_POSITION;
-                err = sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC0]);
-                break;
-        case AD5259_ID:
-                data->max_pos = AD5259_MAX_POSITION;
-                err = sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC0]);
-                break;
-        case AD5251_ID:
-                data->max_pos = AD5251_MAX_POSITION;
-                err = sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC1]);
-                err |= sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC3]);
-                err |= sysfs_create_group(&dev->kobj, &ad525x_group_commands);
-                break;
-        case AD5252_ID:
-                data->max_pos = AD5252_MAX_POSITION;
-                err = sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC1]);
-                err |= sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC3]);
-                err |= sysfs_create_group(&dev->kobj, &ad525x_group_commands);
-                break;
-        case AD5253_ID:
-                data->max_pos = AD5253_MAX_POSITION;
-                err = sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC0]);
-                err |= sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC1]);
-                err |= sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC2]);
-                err |= sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC3]);
-                err |= sysfs_create_group(&dev->kobj, &ad525x_group_commands);
-                break;
-        case AD5254_ID:
-                data->max_pos = AD5254_MAX_POSITION;
-                err = sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC0]);
-                err |= sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC1]);
-                err |= sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC2]);
-                err |= sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC3]);
-                err |= sysfs_create_group(&dev->kobj, &ad525x_group_commands);
-                break;
-        case AD5255_ID:
-                data->max_pos = AD5255_MAX_POSITION;
-                err = sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC0]);
-                err |= sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC1]);
-                err |= sysfs_create_group(&dev->kobj,
-                                       &ad525x_group_wipers[AD525X_RDAC2]);
-                err |= sysfs_create_group(&dev->kobj, &ad525x_group_commands);
-                break;
-        default:
-                err = -ENODEV;
-                goto exit_free;
-        }
+        data->bdata = *bdata;
+        data->devid = id->devid;
+
+        data->max_pos = 1 << DPOT_MAX_POS(data->devid);
+        data->rdac_mask = data->max_pos - 1;
+        data->feat = DPOT_FEAT(data->devid);
+        data->uid = DPOT_UID(data->devid);
+        data->wipers = DPOT_WIPERS(data->devid);
+
+        for (i = DPOT_RDAC0; i < MAX_RDACS; i++)
+                if (data->wipers & (1 << i)) {
+                        err = ad_dpot_add_files(dev, data->feat, i);
+                        if (err)
+                                goto exit_remove_files;
+                        /* power-up midscale */
+                        if (data->feat & F_RDACS_WONLY)
+                                data->rdac_cache[i] = data->max_pos / 2;
+                }
+
+        if (data->feat & F_CMD_INC)
+                err = sysfs_create_group(&dev->kobj, &ad525x_group_commands);
 
         if (err) {
                 dev_err(dev, "failed to register sysfs hooks\n");
                 goto exit_free;
         }
 
-        data->devid = id->driver_data;
-        data->rdac_mask = data->max_pos - 1;
-
         dev_info(dev, "%s %d-Position Digital Potentiometer registered\n",
                  id->name, data->max_pos);
 
         return 0;
 
+exit_remove_files:
+        for (i = DPOT_RDAC0; i < MAX_RDACS; i++)
+                if (data->wipers & (1 << i))
+                        ad_dpot_remove_files(dev, data->feat, i);
+
 exit_free:
         kfree(data);
-        i2c_set_clientdata(client, NULL);
+        dev_set_drvdata(dev, NULL);
 exit:
-        dev_err(dev, "failed to create client\n");
+        dev_err(dev, "failed to create client for %s ID 0x%lX\n",
+                        id->name, id->devid);
         return err;
 }
+EXPORT_SYMBOL(ad_dpot_probe);
 
-static int __devexit ad525x_remove(struct i2c_client *client)
+__devexit int ad_dpot_remove(struct device *dev)
 {
-        struct dpot_data *data = i2c_get_clientdata(client);
-        struct device *dev = &client->dev;
-
-        switch (data->devid) {
-        case AD5258_ID:
-        case AD5259_ID:
-                sysfs_remove_group(&dev->kobj,
-                                   &ad525x_group_wipers[AD525X_RDAC0]);
-                break;
-        case AD5251_ID:
-        case AD5252_ID:
-                sysfs_remove_group(&dev->kobj,
-                                   &ad525x_group_wipers[AD525X_RDAC1]);
-                sysfs_remove_group(&dev->kobj,
-                                   &ad525x_group_wipers[AD525X_RDAC3]);
-                sysfs_remove_group(&dev->kobj, &ad525x_group_commands);
-                break;
-        case AD5253_ID:
-        case AD5254_ID:
-                sysfs_remove_group(&dev->kobj,
-                                   &ad525x_group_wipers[AD525X_RDAC0]);
-                sysfs_remove_group(&dev->kobj,
-                                   &ad525x_group_wipers[AD525X_RDAC1]);
-                sysfs_remove_group(&dev->kobj,
-                                   &ad525x_group_wipers[AD525X_RDAC2]);
-                sysfs_remove_group(&dev->kobj,
-                                   &ad525x_group_wipers[AD525X_RDAC3]);
-                sysfs_remove_group(&dev->kobj, &ad525x_group_commands);
-                break;
-        case AD5255_ID:
-                sysfs_remove_group(&dev->kobj,
-                                   &ad525x_group_wipers[AD525X_RDAC0]);
-                sysfs_remove_group(&dev->kobj,
-                                   &ad525x_group_wipers[AD525X_RDAC1]);
-                sysfs_remove_group(&dev->kobj,
-                                   &ad525x_group_wipers[AD525X_RDAC2]);
-                sysfs_remove_group(&dev->kobj, &ad525x_group_commands);
-                break;
-        }
+        struct dpot_data *data = dev_get_drvdata(dev);
+        int i;
+
+        for (i = DPOT_RDAC0; i < MAX_RDACS; i++)
+                if (data->wipers & (1 << i))
+                        ad_dpot_remove_files(dev, data->feat, i);
 
-        i2c_set_clientdata(client, NULL);
         kfree(data);
 
         return 0;
 }
+EXPORT_SYMBOL(ad_dpot_remove);
 
-static const struct i2c_device_id ad525x_idtable[] = {
-        {"ad5258", AD5258_ID},
-        {"ad5259", AD5259_ID},
-        {"ad5251", AD5251_ID},
-        {"ad5252", AD5252_ID},
-        {"ad5253", AD5253_ID},
-        {"ad5254", AD5254_ID},
-        {"ad5255", AD5255_ID},
-        {}
-};
-
-MODULE_DEVICE_TABLE(i2c, ad525x_idtable);
-
-static struct i2c_driver ad525x_driver = {
-        .driver = {
-                   .owner = THIS_MODULE,
-                   .name = DRIVER_NAME,
-                   },
-        .id_table = ad525x_idtable,
-        .probe = ad525x_probe,
-        .remove = __devexit_p(ad525x_remove),
-};
-
-static int __init ad525x_init(void)
-{
-        return i2c_add_driver(&ad525x_driver);
-}
-
-module_init(ad525x_init);
-
-static void __exit ad525x_exit(void)
-{
-        i2c_del_driver(&ad525x_driver);
-}
-
-module_exit(ad525x_exit);
 
 MODULE_AUTHOR("Chris Verges <chrisv@cyberswitching.com>, "
-              "Michael Hennerich <hennerich@blackfin.uclinux.org>, ");
-MODULE_DESCRIPTION("AD5258/9 digital potentiometer driver");
+              "Michael Hennerich <hennerich@blackfin.uclinux.org>");
+MODULE_DESCRIPTION("Digital potentiometer driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRIVER_VERSION);
diff --git a/drivers/misc/ad525x_dpot.h b/drivers/misc/ad525x_dpot.h
new file mode 100644
index 000000000000..78b89fd2e2fd
--- /dev/null
+++ b/drivers/misc/ad525x_dpot.h
@@ -0,0 +1,202 @@
+/*
+ * Driver for the Analog Devices digital potentiometers
+ *
+ * Copyright (C) 2010 Michael Hennerich, Analog Devices Inc.
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#ifndef _AD_DPOT_H_
+#define _AD_DPOT_H_
+
+#include <linux/types.h>
+
+#define DPOT_CONF(features, wipers, max_pos, uid) \
+                (((features) << 18) | (((wipers) & 0xFF) << 10) | \
+                ((max_pos & 0xF) << 6) | (uid & 0x3F))
+
+#define DPOT_UID(conf)          (conf & 0x3F)
+#define DPOT_MAX_POS(conf)      ((conf >> 6) & 0xF)
+#define DPOT_WIPERS(conf)       ((conf >> 10) & 0xFF)
+#define DPOT_FEAT(conf)         (conf >> 18)
+
+#define BRDAC0                  (1 << 0)
+#define BRDAC1                  (1 << 1)
+#define BRDAC2                  (1 << 2)
+#define BRDAC3                  (1 << 3)
+#define BRDAC4                  (1 << 4)
+#define BRDAC5                  (1 << 5)
+#define MAX_RDACS               6
+
+#define F_CMD_INC               (1 << 0)        /* Features INC/DEC ALL, 6dB */
+#define F_CMD_EEP               (1 << 1)        /* Features EEPROM */
+#define F_CMD_OTP               (1 << 2)        /* Features OTP */
+#define F_CMD_TOL               (1 << 3)        /* RDACS feature Tolerance REG */
+#define F_RDACS_RW              (1 << 4)        /* RDACS are Read/Write  */
+#define F_RDACS_WONLY           (1 << 5)        /* RDACS are Write only */
+#define F_AD_APPDATA            (1 << 6)        /* RDAC Address append to data */
+#define F_SPI_8BIT              (1 << 7)        /* All SPI XFERS are 8-bit */
+#define F_SPI_16BIT             (1 << 8)        /* All SPI XFERS are 16-bit */
+#define F_SPI_24BIT             (1 << 9)        /* All SPI XFERS are 24-bit */
+
+#define F_RDACS_RW_TOL  (F_RDACS_RW | F_CMD_EEP | F_CMD_TOL)
+#define F_RDACS_RW_EEP  (F_RDACS_RW | F_CMD_EEP)
+#define F_SPI           (F_SPI_8BIT | F_SPI_16BIT | F_SPI_24BIT)
+
+enum dpot_devid {
+        AD5258_ID = DPOT_CONF(F_RDACS_RW_TOL, BRDAC0, 6, 0), /* I2C */
+        AD5259_ID = DPOT_CONF(F_RDACS_RW_TOL, BRDAC0, 8, 1),
+        AD5251_ID = DPOT_CONF(F_RDACS_RW_TOL | F_CMD_INC,
+                        BRDAC0 | BRDAC3, 6, 2),
+        AD5252_ID = DPOT_CONF(F_RDACS_RW_TOL | F_CMD_INC,
+                        BRDAC0 | BRDAC3, 8, 3),
+        AD5253_ID = DPOT_CONF(F_RDACS_RW_TOL | F_CMD_INC,
+                        BRDAC0 | BRDAC1 | BRDAC2 | BRDAC3, 6, 4),
+        AD5254_ID = DPOT_CONF(F_RDACS_RW_TOL | F_CMD_INC,
+                        BRDAC0 | BRDAC1 | BRDAC2 | BRDAC3, 8, 5),
+        AD5255_ID = DPOT_CONF(F_RDACS_RW_TOL | F_CMD_INC,
+                        BRDAC0 | BRDAC1 | BRDAC2, 9, 6),
+        AD5160_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 8, 7), /* SPI */
+        AD5161_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 8, 8),
+        AD5162_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1, 8, 9),
+        AD5165_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 8, 10),
+        AD5200_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 8, 11),
+        AD5201_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 5, 12),
+        AD5203_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0 | BRDAC1 | BRDAC2 | BRDAC3, 6, 13),
+        AD5204_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1 | BRDAC2 | BRDAC3, 8, 14),
+        AD5206_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1 | BRDAC2 | BRDAC3 | BRDAC4 | BRDAC5,
+                        8, 15),
+        AD5207_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1, 8, 16),
+        AD5231_ID = DPOT_CONF(F_RDACS_RW_EEP | F_CMD_INC | F_SPI_24BIT,
+                        BRDAC0, 10, 17),
+        AD5232_ID = DPOT_CONF(F_RDACS_RW_EEP | F_CMD_INC | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1, 8, 18),
+        AD5233_ID = DPOT_CONF(F_RDACS_RW_EEP | F_CMD_INC | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1 | BRDAC2 | BRDAC3, 6, 19),
+        AD5235_ID = DPOT_CONF(F_RDACS_RW_EEP | F_CMD_INC | F_SPI_24BIT,
+                        BRDAC0 | BRDAC1, 10, 20),
+        AD5260_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 8, 21),
+        AD5262_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1, 8, 22),
+        AD5263_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1 | BRDAC2 | BRDAC3, 8, 23),
+        AD5290_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 8, 24),
+        AD5291_ID = DPOT_CONF(F_RDACS_RW | F_SPI_16BIT, BRDAC0, 8, 25),
+        AD5292_ID = DPOT_CONF(F_RDACS_RW | F_SPI_16BIT, BRDAC0, 10, 26),
+        AD5293_ID = DPOT_CONF(F_RDACS_RW | F_SPI_16BIT, BRDAC0, 10, 27),
+        AD7376_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 7, 28),
+        AD8400_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 8, 29),
+        AD8402_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1, 8, 30),
+        AD8403_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1 | BRDAC2, 8, 31),
+        ADN2850_ID = DPOT_CONF(F_RDACS_RW_EEP | F_CMD_INC | F_SPI_24BIT,
+                        BRDAC0 | BRDAC1, 10, 32),
+        AD5241_ID = DPOT_CONF(F_RDACS_RW, BRDAC0, 8, 33),
+        AD5242_ID = DPOT_CONF(F_RDACS_RW, BRDAC0 | BRDAC1, 8, 34),
+        AD5243_ID = DPOT_CONF(F_RDACS_RW, BRDAC0 | BRDAC1, 8, 35),
+        AD5245_ID = DPOT_CONF(F_RDACS_RW, BRDAC0, 8, 36),
+        AD5246_ID = DPOT_CONF(F_RDACS_RW, BRDAC0, 7, 37),
+        AD5247_ID = DPOT_CONF(F_RDACS_RW, BRDAC0, 7, 38),
+        AD5248_ID = DPOT_CONF(F_RDACS_RW, BRDAC0 | BRDAC1, 8, 39),
+        AD5280_ID = DPOT_CONF(F_RDACS_RW, BRDAC0, 8, 40),
+        AD5282_ID = DPOT_CONF(F_RDACS_RW, BRDAC0 | BRDAC1, 8, 41),
+        ADN2860_ID = DPOT_CONF(F_RDACS_RW_TOL | F_CMD_INC,
+                        BRDAC0 | BRDAC1 | BRDAC2, 9, 42),
+        AD5273_ID = DPOT_CONF(F_RDACS_RW | F_CMD_OTP, BRDAC0, 6, 43),
+        AD5171_ID = DPOT_CONF(F_RDACS_RW | F_CMD_OTP, BRDAC0, 6, 44),
+        AD5170_ID = DPOT_CONF(F_RDACS_RW | F_CMD_OTP, BRDAC0, 8, 45),
+        AD5172_ID = DPOT_CONF(F_RDACS_RW | F_CMD_OTP, BRDAC0 | BRDAC1, 8, 46),
+        AD5173_ID = DPOT_CONF(F_RDACS_RW | F_CMD_OTP, BRDAC0 | BRDAC1, 8, 47),
+};
+
+#define DPOT_RDAC0              0
+#define DPOT_RDAC1              1
+#define DPOT_RDAC2              2
+#define DPOT_RDAC3              3
+#define DPOT_RDAC4              4
+#define DPOT_RDAC5              5
+
+#define DPOT_RDAC_MASK          0x1F
+
+#define DPOT_REG_TOL            0x18
+#define DPOT_TOL_RDAC0          (DPOT_REG_TOL | DPOT_RDAC0)
+#define DPOT_TOL_RDAC1          (DPOT_REG_TOL | DPOT_RDAC1)
+#define DPOT_TOL_RDAC2          (DPOT_REG_TOL | DPOT_RDAC2)
+#define DPOT_TOL_RDAC3          (DPOT_REG_TOL | DPOT_RDAC3)
+#define DPOT_TOL_RDAC4          (DPOT_REG_TOL | DPOT_RDAC4)
+#define DPOT_TOL_RDAC5          (DPOT_REG_TOL | DPOT_RDAC5)
+
+/* RDAC-to-EEPROM Interface Commands */
+#define DPOT_ADDR_RDAC          (0x0 << 5)
+#define DPOT_ADDR_EEPROM        (0x1 << 5)
+#define DPOT_ADDR_OTP           (0x1 << 6)
+#define DPOT_ADDR_CMD           (0x1 << 7)
+#define DPOT_ADDR_OTP_EN        (0x1 << 9)
+
+#define DPOT_DEC_ALL_6DB        (DPOT_ADDR_CMD | (0x4 << 3))
+#define DPOT_INC_ALL_6DB        (DPOT_ADDR_CMD | (0x9 << 3))
+#define DPOT_DEC_ALL            (DPOT_ADDR_CMD | (0x6 << 3))
+#define DPOT_INC_ALL            (DPOT_ADDR_CMD | (0xB << 3))
+
+#define DPOT_SPI_RDAC           0xB0
+#define DPOT_SPI_EEPROM         0x30
+#define DPOT_SPI_READ_RDAC      0xA0
+#define DPOT_SPI_READ_EEPROM    0x90
+#define DPOT_SPI_DEC_ALL_6DB    0x50
+#define DPOT_SPI_INC_ALL_6DB    0xD0
+#define DPOT_SPI_DEC_ALL        0x70
+#define DPOT_SPI_INC_ALL        0xF0
+
+/* AD5291/2/3 use special commands */
+#define DPOT_AD5291_RDAC        0x01
+#define DPOT_AD5291_READ_RDAC   0x02
+
+/* AD524x use special commands */
+#define DPOT_AD5291_RDAC_AB     0x80
+
+#define DPOT_AD5273_FUSE        0x80
+#define DPOT_AD5270_2_3_FUSE    0x20
+#define DPOT_AD5270_2_3_OW      0x08
+#define DPOT_AD5272_3_A0        0x08
+#define DPOT_AD5270_2FUSE       0x80
+
+struct dpot_data;
+
+struct ad_dpot_bus_ops {
+        int (*read_d8) (void *client);
+        int (*read_r8d8) (void *client, u8 reg);
+        int (*read_r8d16) (void *client, u8 reg);
+        int (*write_d8) (void *client, u8 val);
+        int (*write_r8d8) (void *client, u8 reg, u8 val);
+        int (*write_r8d16) (void *client, u8 reg, u16 val);
+};
+
+struct ad_dpot_bus_data {
+        void *client;
+        const struct ad_dpot_bus_ops *bops;
+};
+
+struct ad_dpot_id {
+        char *name;
+        unsigned long devid;
+};
+
+int ad_dpot_probe(struct device *dev, struct ad_dpot_bus_data *bdata, const struct ad_dpot_id *id);
+int ad_dpot_remove(struct device *dev);
+
+#endif
diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
index 558bf3f2c276..4afffe610f99 100644
--- a/drivers/misc/atmel-ssc.c
+++ b/drivers/misc/atmel-ssc.c
@@ -15,6 +15,7 @@
 #include <linux/io.h>
 #include <linux/spinlock.h>
 #include <linux/atmel-ssc.h>
+#include <linux/slab.h>
 
 /* Serialize access to ssc_list and user count */
 static DEFINE_SPINLOCK(user_lock);
diff --git a/drivers/misc/atmel_pwm.c b/drivers/misc/atmel_pwm.c
index 6aa5294dfec4..0f3fb4f03bdf 100644
--- a/drivers/misc/atmel_pwm.c
+++ b/drivers/misc/atmel_pwm.c
@@ -1,6 +1,7 @@
 #include <linux/module.h>
 #include <linux/clk.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <linux/io.h>
 #include <linux/interrupt.h>
 #include <linux/platform_device.h>
diff --git a/drivers/misc/atmel_tclib.c b/drivers/misc/atmel_tclib.c
index 05dc8a31f280..3891124001f2 100644
--- a/drivers/misc/atmel_tclib.c
+++ b/drivers/misc/atmel_tclib.c
@@ -6,6 +6,7 @@
 #include <linux/ioport.h>
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
+#include <linux/slab.h>
 
 /* Number of bytes to reserve for the iomem resource */
 #define ATMEL_TC_IOMEM_SIZE     256
diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
index b5346b4db91a..19fc7c1cb428 100644
--- a/drivers/misc/c2port/core.c
+++ b/drivers/misc/c2port/core.c
@@ -20,6 +20,7 @@
 #include <linux/delay.h>
 #include <linux/idr.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 
 #include <linux/c2port.h>
 
@@ -706,7 +707,7 @@ static ssize_t __c2port_read_flash_data(struct c2port_device *dev,
         return nread;
 }
 
-static ssize_t c2port_read_flash_data(struct kobject *kobj,
+static ssize_t c2port_read_flash_data(struct file *filp, struct kobject *kobj,
                                 struct bin_attribute *attr,
                                 char *buffer, loff_t offset, size_t count)
 {
@@ -823,7 +824,7 @@ static ssize_t __c2port_write_flash_data(struct c2port_device *dev,
         return nwrite;
 }
 
-static ssize_t c2port_write_flash_data(struct kobject *kobj,
+static ssize_t c2port_write_flash_data(struct file *filp, struct kobject *kobj,
                                 struct bin_attribute *attr,
                                 char *buffer, loff_t offset, size_t count)
 {
@@ -912,8 +913,8 @@ struct c2port_device *c2port_device_register(char *name,
 
         c2dev->dev = device_create(c2port_class, NULL, 0, c2dev,
                                         "c2port%d", id);
-        if (unlikely(!c2dev->dev)) {
-                ret = -ENOMEM;
+        if (unlikely(IS_ERR(c2dev->dev))) {
+                ret = PTR_ERR(c2dev->dev);
                 goto error_device_create;
         }
         dev_set_drvdata(c2dev->dev, c2dev);
diff --git a/drivers/misc/cb710/core.c b/drivers/misc/cb710/core.c
index b14eab0f2ba5..efec4139c3f6 100644
--- a/drivers/misc/cb710/core.c
+++ b/drivers/misc/cb710/core.c
@@ -9,11 +9,11 @@
  */
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/slab.h>
 #include <linux/pci.h>
 #include <linux/spinlock.h>
 #include <linux/idr.h>
 #include <linux/cb710.h>
+#include <linux/gfp.h>
 
 static DEFINE_IDA(cb710_ida);
 static DEFINE_SPINLOCK(cb710_ida_lock);
diff --git a/drivers/misc/cb710/debug.c b/drivers/misc/cb710/debug.c
index 02358d086e03..fcb3b8e30c52 100644
--- a/drivers/misc/cb710/debug.c
+++ b/drivers/misc/cb710/debug.c
@@ -10,7 +10,6 @@
 #include <linux/cb710.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/slab.h>
 
 #define CB710_REG_COUNT         0x80
 
diff --git a/drivers/misc/cs5535-mfgpt.c b/drivers/misc/cs5535-mfgpt.c
index 8110460558ff..2d44b3300104 100644
--- a/drivers/misc/cs5535-mfgpt.c
+++ b/drivers/misc/cs5535-mfgpt.c
@@ -18,6 +18,7 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/cs5535.h>
+#include <linux/slab.h>
 
 #define DRV_NAME "cs5535-mfgpt"
 #define MFGPT_BAR 2
@@ -365,6 +366,6 @@ static int __init cs5535_mfgpt_init(void)
 
 module_init(cs5535_mfgpt_init);
 
-MODULE_AUTHOR("Andres Salomon <dilinger@collabora.co.uk>");
+MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
 MODULE_DESCRIPTION("CS5535/CS5536 MFGPT timer driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/misc/ds1682.c b/drivers/misc/ds1682.c
index f3ee4a1abb77..a513f0aa6432 100644
--- a/drivers/misc/ds1682.c
+++ b/drivers/misc/ds1682.c
@@ -33,7 +33,6 @@
 
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/slab.h>
 #include <linux/i2c.h>
 #include <linux/string.h>
 #include <linux/list.h>
@@ -141,7 +140,8 @@ static const struct attribute_group ds1682_group = {
 /*
  * User data attribute
  */
-static ssize_t ds1682_eeprom_read(struct kobject *kobj, struct bin_attribute *attr,
+static ssize_t ds1682_eeprom_read(struct file *filp, struct kobject *kobj,
+                                  struct bin_attribute *attr,
                                   char *buf, loff_t off, size_t count)
 {
         struct i2c_client *client = kobj_to_i2c_client(kobj);
@@ -164,7 +164,8 @@ static ssize_t ds1682_eeprom_read(struct kobject *kobj, struct bin_attribute *at
         return count;
 }
 
-static ssize_t ds1682_eeprom_write(struct kobject *kobj, struct bin_attribute *attr,
+static ssize_t ds1682_eeprom_write(struct file *filp, struct kobject *kobj,
+                                   struct bin_attribute *attr,
                                    char *buf, loff_t off, size_t count)
 {
         struct i2c_client *client = kobj_to_i2c_client(kobj);
diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index 2cb2736d65aa..559b0b3c16c3 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -54,7 +54,7 @@
 struct at24_data {
         struct at24_platform_data chip;
         struct memory_accessor macc;
-        bool use_smbus;
+        int use_smbus;
 
         /*
          * Lock protects against activities from other Linux tasks,
@@ -184,11 +184,19 @@ static ssize_t at24_eeprom_read(struct at24_data *at24, char *buf,
         if (count > io_limit)
                 count = io_limit;
 
-        if (at24->use_smbus) {
+        switch (at24->use_smbus) {
+        case I2C_SMBUS_I2C_BLOCK_DATA:
                 /* Smaller eeproms can work given some SMBus extension calls */
                 if (count > I2C_SMBUS_BLOCK_MAX)
                         count = I2C_SMBUS_BLOCK_MAX;
-        } else {
+                break;
+        case I2C_SMBUS_WORD_DATA:
+                count = 2;
+                break;
+        case I2C_SMBUS_BYTE_DATA:
+                count = 1;
+                break;
+        default:
                 /*
                  * When we have a better choice than SMBus calls, use a
                  * combined I2C message. Write address; then read up to
@@ -219,10 +227,27 @@ static ssize_t at24_eeprom_read(struct at24_data *at24, char *buf,
         timeout = jiffies + msecs_to_jiffies(write_timeout);
         do {
                 read_time = jiffies;
-                if (at24->use_smbus) {
+                switch (at24->use_smbus) {
+                case I2C_SMBUS_I2C_BLOCK_DATA:
                         status = i2c_smbus_read_i2c_block_data(client, offset,
                                         count, buf);
-                } else {
+                        break;
+                case I2C_SMBUS_WORD_DATA:
+                        status = i2c_smbus_read_word_data(client, offset);
+                        if (status >= 0) {
+                                buf[0] = status & 0xff;
+                                buf[1] = status >> 8;
+                                status = count;
+                        }
+                        break;
+                case I2C_SMBUS_BYTE_DATA:
+                        status = i2c_smbus_read_byte_data(client, offset);
+                        if (status >= 0) {
+                                buf[0] = status;
+                                status = count;
+                        }
+                        break;
+                default:
                         status = i2c_transfer(client->adapter, msg, 2);
                         if (status == 2)
                                 status = count;
@@ -274,7 +299,8 @@ static ssize_t at24_read(struct at24_data *at24,
         return retval;
 }
 
-static ssize_t at24_bin_read(struct kobject *kobj, struct bin_attribute *attr,
+static ssize_t at24_bin_read(struct file *filp, struct kobject *kobj,
+                struct bin_attribute *attr,
                 char *buf, loff_t off, size_t count)
 {
         struct at24_data *at24;
@@ -395,7 +421,8 @@ static ssize_t at24_write(struct at24_data *at24, const char *buf, loff_t off,
         return retval;
 }
 
-static ssize_t at24_bin_write(struct kobject *kobj, struct bin_attribute *attr,
+static ssize_t at24_bin_write(struct file *filp, struct kobject *kobj,
+                struct bin_attribute *attr,
                 char *buf, loff_t off, size_t count)
 {
         struct at24_data *at24;
@@ -434,7 +461,7 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
 {
         struct at24_platform_data chip;
         bool writable;
-        bool use_smbus = false;
+        int use_smbus = 0;
         struct at24_data *at24;
         int err;
         unsigned i, num_addresses;
@@ -475,12 +502,19 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
                         err = -EPFNOSUPPORT;
                         goto err_out;
                 }
-                if (!i2c_check_functionality(client->adapter,
+                if (i2c_check_functionality(client->adapter,
                                 I2C_FUNC_SMBUS_READ_I2C_BLOCK)) {
+                        use_smbus = I2C_SMBUS_I2C_BLOCK_DATA;
+                } else if (i2c_check_functionality(client->adapter,
+                                I2C_FUNC_SMBUS_READ_WORD_DATA)) {
+                        use_smbus = I2C_SMBUS_WORD_DATA;
+                } else if (i2c_check_functionality(client->adapter,
+                                I2C_FUNC_SMBUS_READ_BYTE_DATA)) {
+                        use_smbus = I2C_SMBUS_BYTE_DATA;
+                } else {
                         err = -EPFNOSUPPORT;
                         goto err_out;
                 }
-                use_smbus = true;
         }
 
         if (chip.flags & AT24_FLAG_TAKE8ADDR)
@@ -505,6 +539,7 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
          * Export the EEPROM bytes through sysfs, since that's convenient.
          * By default, only root should see the data (maybe passwords etc)
          */
+        sysfs_bin_attr_init(&at24->bin);
         at24->bin.attr.name = "eeprom";
         at24->bin.attr.mode = chip.flags & AT24_FLAG_IRUGO ? S_IRUGO : S_IRUSR;
         at24->bin.read = at24_bin_read;
@@ -565,11 +600,16 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
         dev_info(&client->dev, "%zu byte %s EEPROM %s\n",
                 at24->bin.size, client->name,
                 writable ? "(writable)" : "(read-only)");
+        if (use_smbus == I2C_SMBUS_WORD_DATA ||
+            use_smbus == I2C_SMBUS_BYTE_DATA) {
+                dev_notice(&client->dev, "Falling back to %s reads, "
+                           "performance will suffer\n", use_smbus ==
+                           I2C_SMBUS_WORD_DATA ? "word" : "byte");
+        }
         dev_dbg(&client->dev,
-                "page_size %d, num_addresses %d, write_max %d%s\n",
+                "page_size %d, num_addresses %d, write_max %d, use_smbus %d\n",
                 chip.page_size, num_addresses,
-                at24->write_max,
-                use_smbus ? ", use_smbus" : "");
+                at24->write_max, use_smbus);
 
         /* export data to kernel code */
         if (chip.setup)
@@ -603,7 +643,6 @@ static int __devexit at24_remove(struct i2c_client *client)
 
         kfree(at24->writebuf);
         kfree(at24);
-        i2c_set_clientdata(client, NULL);
         return 0;
 }
 
diff --git a/drivers/misc/eeprom/at25.c b/drivers/misc/eeprom/at25.c
index d902d81dde39..c627e4174ccd 100644
--- a/drivers/misc/eeprom/at25.c
+++ b/drivers/misc/eeprom/at25.c
@@ -126,7 +126,8 @@ at25_ee_read(
 }
 
 static ssize_t
-at25_bin_read(struct kobject *kobj, struct bin_attribute *bin_attr,
+at25_bin_read(struct file *filp, struct kobject *kobj,
+              struct bin_attribute *bin_attr,
               char *buf, loff_t off, size_t count)
 {
         struct device           *dev;
@@ -253,7 +254,8 @@ at25_ee_write(struct at25_data *at25, const char *buf, loff_t off,
 }
 
 static ssize_t
-at25_bin_write(struct kobject *kobj, struct bin_attribute *bin_attr,
+at25_bin_write(struct file *filp, struct kobject *kobj,
+               struct bin_attribute *bin_attr,
                char *buf, loff_t off, size_t count)
 {
         struct device           *dev;
@@ -347,6 +349,7 @@ static int at25_probe(struct spi_device *spi)
          * that's sensitive for read and/or write, like ethernet addresses,
          * security codes, board-specific manufacturing calibrations, etc.
          */
+        sysfs_bin_attr_init(&at25->bin);
         at25->bin.attr.name = "eeprom";
         at25->bin.attr.mode = S_IRUSR;
         at25->bin.read = at25_bin_read;
diff --git a/drivers/misc/eeprom/eeprom.c b/drivers/misc/eeprom/eeprom.c
index f939ebc2507c..45060ddc4e59 100644
--- a/drivers/misc/eeprom/eeprom.c
+++ b/drivers/misc/eeprom/eeprom.c
@@ -1,24 +1,20 @@
 /*
-    Copyright (C) 1998, 1999  Frodo Looijaard <frodol@dds.nl> and
-                               Philip Edelbrock <phil@netroedge.com>
-    Copyright (C) 2003 Greg Kroah-Hartman <greg@kroah.com>
-    Copyright (C) 2003 IBM Corp.
-    Copyright (C) 2004 Jean Delvare <khali@linux-fr.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
+ * Copyright (C) 1998, 1999  Frodo Looijaard <frodol@dds.nl> and
+ *                           Philip Edelbrock <phil@netroedge.com>
+ * Copyright (C) 2003 Greg Kroah-Hartman <greg@kroah.com>
+ * Copyright (C) 2003 IBM Corp.
+ * Copyright (C) 2004 Jean Delvare <khali@linux-fr.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
 
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -85,7 +81,8 @@ exit:
         mutex_unlock(&data->update_lock);
 }
 
-static ssize_t eeprom_read(struct kobject *kobj, struct bin_attribute *bin_attr,
+static ssize_t eeprom_read(struct file *filp, struct kobject *kobj,
+                           struct bin_attribute *bin_attr,
                            char *buf, loff_t off, size_t count)
 {
         struct i2c_client *client = to_i2c_client(container_of(kobj, struct device, kobj));
diff --git a/drivers/misc/eeprom/eeprom_93cx6.c b/drivers/misc/eeprom/eeprom_93cx6.c
index 15b1780025c8..7b33de95c4bf 100644
--- a/drivers/misc/eeprom/eeprom_93cx6.c
+++ b/drivers/misc/eeprom/eeprom_93cx6.c
@@ -1,27 +1,20 @@
 /*
-        Copyright (C) 2004 - 2006 rt2x00 SourceForge Project
-        <http://rt2x00.serialmonkey.com>
-
-        This program is free software; you can redistribute it and/or modify
-        it under the terms of the GNU General Public License as published by
-        the Free Software Foundation; either version 2 of the License, or
-        (at your option) any later version.
-
-        This program is distributed in the hope that it will be useful,
-        but WITHOUT ANY WARRANTY; without even the implied warranty of
-        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-        GNU General Public License for more details.
-
-        You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
- */
-
-/*
-        Module: eeprom_93cx6
-        Abstract: EEPROM reader routines for 93cx6 chipsets.
-        Supported chipsets: 93c46 & 93c66.
+ * Copyright (C) 2004 - 2006 rt2x00 SourceForge Project
+ * <http://rt2x00.serialmonkey.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * Module: eeprom_93cx6
+ * Abstract: EEPROM reader routines for 93cx6 chipsets.
+ * Supported chipsets: 93c46 & 93c66.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/misc/eeprom/max6875.c b/drivers/misc/eeprom/max6875.c
index 5a6b2bce8ad5..5653a3ce0517 100644
--- a/drivers/misc/eeprom/max6875.c
+++ b/drivers/misc/eeprom/max6875.c
@@ -1,30 +1,30 @@
 /*
-    max6875.c - driver for MAX6874/MAX6875
-
-    Copyright (C) 2005 Ben Gardner <bgardner@wabtec.com>
-
-    Based on eeprom.c
-
-    The MAX6875 has a bank of registers and two banks of EEPROM.
-    Address ranges are defined as follows:
-     * 0x0000 - 0x0046 = configuration registers
-     * 0x8000 - 0x8046 = configuration EEPROM
-     * 0x8100 - 0x82FF = user EEPROM
-
-    This driver makes the user EEPROM available for read.
-
-    The registers & config EEPROM should be accessed via i2c-dev.
-
-    The MAX6875 ignores the lowest address bit, so each chip responds to
-    two addresses - 0x50/0x51 and 0x52/0x53.
-
-    Note that the MAX6875 uses i2c_smbus_write_byte_data() to set the read
-    address, so this driver is destructive if loaded for the wrong EEPROM chip.
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; version 2 of the License.
-*/
+ * max6875.c - driver for MAX6874/MAX6875
+ *
+ * Copyright (C) 2005 Ben Gardner <bgardner@wabtec.com>
+ *
+ * Based on eeprom.c
+ *
+ * The MAX6875 has a bank of registers and two banks of EEPROM.
+ * Address ranges are defined as follows:
+ *  * 0x0000 - 0x0046 = configuration registers
+ *  * 0x8000 - 0x8046 = configuration EEPROM
+ *  * 0x8100 - 0x82FF = user EEPROM
+ *
+ * This driver makes the user EEPROM available for read.
+ *
+ * The registers & config EEPROM should be accessed via i2c-dev.
+ *
+ * The MAX6875 ignores the lowest address bit, so each chip responds to
+ * two addresses - 0x50/0x51 and 0x52/0x53.
+ *
+ * Note that the MAX6875 uses i2c_smbus_write_byte_data() to set the read
+ * address, so this driver is destructive if loaded for the wrong EEPROM chip.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ */
 
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -107,7 +107,7 @@ exit_up:
         mutex_unlock(&data->update_lock);
 }
 
-static ssize_t max6875_read(struct kobject *kobj,
+static ssize_t max6875_read(struct file *filp, struct kobject *kobj,
                             struct bin_attribute *bin_attr,
                             char *buf, loff_t off, size_t count)
 {
diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c
index 1eac626e710a..48c84a58163e 100644
--- a/drivers/misc/enclosure.c
+++ b/drivers/misc/enclosure.c
@@ -27,6 +27,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 
 static LIST_HEAD(container_list);
 static DEFINE_MUTEX(container_list_lock);
diff --git a/drivers/misc/ep93xx_pwm.c b/drivers/misc/ep93xx_pwm.c
index ba4694169d79..46b3439673e9 100644
--- a/drivers/misc/ep93xx_pwm.c
+++ b/drivers/misc/ep93xx_pwm.c
@@ -19,6 +19,7 @@
 
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/slab.h>
 #include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/io.h>
diff --git a/drivers/misc/hdpuftrs/Makefile b/drivers/misc/hdpuftrs/Makefile
deleted file mode 100644
index ac74ae679230..000000000000
--- a/drivers/misc/hdpuftrs/Makefile
+++ /dev/null
@@ -1 +0,0 @@
-obj-$(CONFIG_HDPU_FEATURES) := hdpu_cpustate.o hdpu_nexus.o
diff --git a/drivers/misc/hdpuftrs/hdpu_cpustate.c b/drivers/misc/hdpuftrs/hdpu_cpustate.c
deleted file mode 100644
index 176fe4e09d3f..000000000000
--- a/drivers/misc/hdpuftrs/hdpu_cpustate.c
+++ /dev/null
@@ -1,256 +0,0 @@
-/*
- *      Sky CPU State Driver
- *
- *      Copyright (C) 2002 Brian Waite
- *
- *      This driver allows use of the CPU state bits
- *      It exports the /dev/sky_cpustate and also
- *      /proc/sky_cpustate pseudo-file for status information.
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- *
- */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/spinlock.h>
-#include <linux/smp_lock.h>
-#include <linux/miscdevice.h>
-#include <linux/proc_fs.h>
-#include <linux/hdpu_features.h>
-#include <linux/platform_device.h>
-#include <asm/uaccess.h>
-#include <linux/seq_file.h>
-#include <asm/io.h>
-
-#define SKY_CPUSTATE_VERSION            "1.1"
-
-static int hdpu_cpustate_probe(struct platform_device *pdev);
-static int hdpu_cpustate_remove(struct platform_device *pdev);
-
-static unsigned char cpustate_get_state(void);
-static int cpustate_proc_open(struct inode *inode, struct file *file);
-static int cpustate_proc_read(struct seq_file *seq, void *offset);
-
-static struct cpustate_t cpustate;
-
-static const struct file_operations proc_cpustate = {
-        .open = cpustate_proc_open,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-        .owner = THIS_MODULE,
-};
-
-static int cpustate_proc_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, cpustate_proc_read, NULL);
-}
-
-static int cpustate_proc_read(struct seq_file *seq, void *offset)
-{
-        seq_printf(seq, "CPU State: %04x\n", cpustate_get_state());
-        return 0;
-}
-
-static int cpustate_get_ref(int excl)
-{
-
-        int retval = -EBUSY;
-
-        spin_lock(&cpustate.lock);
-
-        if (cpustate.excl)
-                goto out_busy;
-
-        if (excl) {
-                if (cpustate.open_count)
-                        goto out_busy;
-                cpustate.excl = 1;
-        }
-
-        cpustate.open_count++;
-        retval = 0;
-
-      out_busy:
-        spin_unlock(&cpustate.lock);
-        return retval;
-}
-
-static int cpustate_free_ref(void)
-{
-
-        spin_lock(&cpustate.lock);
-
-        cpustate.excl = 0;
-        cpustate.open_count--;
-
-        spin_unlock(&cpustate.lock);
-        return 0;
-}
-
-static unsigned char cpustate_get_state(void)
-{
-
-        return cpustate.cached_val;
-}
-
-static void cpustate_set_state(unsigned char new_state)
-{
-        unsigned int state = (new_state << 21);
-
-#ifdef DEBUG_CPUSTATE
-        printk("CPUSTATE -> 0x%x\n", new_state);
-#endif
-        spin_lock(&cpustate.lock);
-        cpustate.cached_val = new_state;
-        writel((0xff << 21), cpustate.clr_addr);
-        writel(state, cpustate.set_addr);
-        spin_unlock(&cpustate.lock);
-}
-
-/*
- *      Now all the various file operations that we export.
- */
-
-static ssize_t cpustate_read(struct file *file, char *buf,
-                             size_t count, loff_t * ppos)
-{
-        unsigned char data;
-
-        if (count < 0)
-                return -EFAULT;
-        if (count == 0)
-                return 0;
-
-        data = cpustate_get_state();
-        if (copy_to_user(buf, &data, sizeof(unsigned char)))
-                return -EFAULT;
-        return sizeof(unsigned char);
-}
-
-static ssize_t cpustate_write(struct file *file, const char *buf,
-                              size_t count, loff_t * ppos)
-{
-        unsigned char data;
-
-        if (count < 0)
-                return -EFAULT;
-
-        if (count == 0)
-                return 0;
-
-        if (copy_from_user((unsigned char *)&data, buf, sizeof(unsigned char)))
-                return -EFAULT;
-
-        cpustate_set_state(data);
-        return sizeof(unsigned char);
-}
-
-static int cpustate_open(struct inode *inode, struct file *file)
-{
-        int ret;
-
-        lock_kernel();
-        ret = cpustate_get_ref((file->f_flags & O_EXCL));
-        unlock_kernel();
-
-        return ret;
-}
-
-static int cpustate_release(struct inode *inode, struct file *file)
-{
-        return cpustate_free_ref();
-}
-
-static struct platform_driver hdpu_cpustate_driver = {
-        .probe = hdpu_cpustate_probe,
-        .remove = hdpu_cpustate_remove,
-        .driver = {
-                .name = HDPU_CPUSTATE_NAME,
-                .owner = THIS_MODULE,
-        },
-};
-
-/*
- *      The various file operations we support.
- */
-static const struct file_operations cpustate_fops = {
-      .owner    = THIS_MODULE,
-      .open     = cpustate_open,
-      .release  = cpustate_release,
-      .read     = cpustate_read,
-      .write    = cpustate_write,
-      .llseek   = no_llseek,
-};
-
-static struct miscdevice cpustate_dev = {
-        .minor  = MISC_DYNAMIC_MINOR,
-        .name   = "sky_cpustate",
-        .fops   = &cpustate_fops,
-};
-
-static int hdpu_cpustate_probe(struct platform_device *pdev)
-{
-        struct resource *res;
-        struct proc_dir_entry *proc_de;
-        int ret;
-
-        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                printk(KERN_ERR "sky_cpustate: "
-                       "Invalid memory resource.\n");
-                return -EINVAL;
-        }
-        cpustate.set_addr = (unsigned long *)res->start;
-        cpustate.clr_addr = (unsigned long *)res->end - 1;
-
-        ret = misc_register(&cpustate_dev);
-        if (ret) {
-                printk(KERN_WARNING "sky_cpustate: "
-                       "Unable to register misc device.\n");
-                cpustate.set_addr = NULL;
-                cpustate.clr_addr = NULL;
-                return ret;
-        }
-
-        proc_de = proc_create("sky_cpustate", 0666, NULL, &proc_cpustate);
-        if (!proc_de) {
-                printk(KERN_WARNING "sky_cpustate: "
-                       "Unable to create proc entry\n");
-        }
-
-        printk(KERN_INFO "Sky CPU State Driver v" SKY_CPUSTATE_VERSION "\n");
-        return 0;
-}
-
-static int hdpu_cpustate_remove(struct platform_device *pdev)
-{
-        cpustate.set_addr = NULL;
-        cpustate.clr_addr = NULL;
-
-        remove_proc_entry("sky_cpustate", NULL);
-        misc_deregister(&cpustate_dev);
-
-        return 0;
-}
-
-static int __init cpustate_init(void)
-{
-        return platform_driver_register(&hdpu_cpustate_driver);
-}
-
-static void __exit cpustate_exit(void)
-{
-        platform_driver_unregister(&hdpu_cpustate_driver);
-}
-
-module_init(cpustate_init);
-module_exit(cpustate_exit);
-
-MODULE_AUTHOR("Brian Waite");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:" HDPU_CPUSTATE_NAME);
diff --git a/drivers/misc/hdpuftrs/hdpu_nexus.c b/drivers/misc/hdpuftrs/hdpu_nexus.c
deleted file mode 100644
index ce39fa54949b..000000000000
--- a/drivers/misc/hdpuftrs/hdpu_nexus.c
+++ /dev/null
@@ -1,149 +0,0 @@
-/*
- *      Sky Nexus Register Driver
- *
- *      Copyright (C) 2002 Brian Waite
- *
- *      This driver allows reading the Nexus register
- *      It exports the /proc/sky_chassis_id and also
- *      /proc/sky_slot_id pseudo-file for status information.
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- *
- */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/proc_fs.h>
-#include <linux/hdpu_features.h>
-#include <linux/platform_device.h>
-#include <linux/seq_file.h>
-#include <asm/io.h>
-
-static int hdpu_nexus_probe(struct platform_device *pdev);
-static int hdpu_nexus_remove(struct platform_device *pdev);
-static int hdpu_slot_id_open(struct inode *inode, struct file *file);
-static int hdpu_slot_id_read(struct seq_file *seq, void *offset);
-static int hdpu_chassis_id_open(struct inode *inode, struct file *file);
-static int hdpu_chassis_id_read(struct seq_file *seq, void *offset);
-
-static struct proc_dir_entry *hdpu_slot_id;
-static struct proc_dir_entry *hdpu_chassis_id;
-static int slot_id = -1;
-static int chassis_id = -1;
-
-static const struct file_operations proc_slot_id = {
-        .open = hdpu_slot_id_open,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-        .owner = THIS_MODULE,
-};
-
-static const struct file_operations proc_chassis_id = {
-        .open = hdpu_chassis_id_open,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-        .owner = THIS_MODULE,
-};
-
-static struct platform_driver hdpu_nexus_driver = {
-        .probe = hdpu_nexus_probe,
-        .remove = hdpu_nexus_remove,
-        .driver = {
-                .name = HDPU_NEXUS_NAME,
-                .owner = THIS_MODULE,
-        },
-};
-
-static int hdpu_slot_id_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, hdpu_slot_id_read, NULL);
-}
-
-static int hdpu_slot_id_read(struct seq_file *seq, void *offset)
-{
-        seq_printf(seq, "%d\n", slot_id);
-        return 0;
-}
-
-static int hdpu_chassis_id_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, hdpu_chassis_id_read, NULL);
-}
-
-static int hdpu_chassis_id_read(struct seq_file *seq, void *offset)
-{
-        seq_printf(seq, "%d\n", chassis_id);
-        return 0;
-}
-
-static int hdpu_nexus_probe(struct platform_device *pdev)
-{
-        struct resource *res;
-        int *nexus_id_addr;
-
-        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                printk(KERN_ERR "sky_nexus: "
-                       "Invalid memory resource.\n");
-                return -EINVAL;
-        }
-        nexus_id_addr = ioremap(res->start,
-                                (unsigned long)(res->end - res->start));
-        if (nexus_id_addr) {
-                slot_id = (*nexus_id_addr >> 8) & 0x1f;
-                chassis_id = *nexus_id_addr & 0xff;
-                iounmap(nexus_id_addr);
-        } else {
-                printk(KERN_ERR "sky_nexus: Could not map slot id\n");
-        }
-
-        hdpu_slot_id = proc_create("sky_slot_id", 0666, NULL, &proc_slot_id);
-        if (!hdpu_slot_id) {
-                printk(KERN_WARNING "sky_nexus: "
-                       "Unable to create proc dir entry: sky_slot_id\n");
-        }
-
-        hdpu_chassis_id = proc_create("sky_chassis_id", 0666, NULL,
-                                      &proc_chassis_id);
-        if (!hdpu_chassis_id)
-                printk(KERN_WARNING "sky_nexus: "
-                       "Unable to create proc dir entry: sky_chassis_id\n");
-
-        return 0;
-}
-
-static int hdpu_nexus_remove(struct platform_device *pdev)
-{
-        slot_id = -1;
-        chassis_id = -1;
-
-        remove_proc_entry("sky_slot_id", NULL);
-        remove_proc_entry("sky_chassis_id", NULL);
-
-        hdpu_slot_id = 0;
-        hdpu_chassis_id = 0;
-
-        return 0;
-}
-
-static int __init nexus_init(void)
-{
-        return platform_driver_register(&hdpu_nexus_driver);
-}
-
-static void __exit nexus_exit(void)
-{
-        platform_driver_unregister(&hdpu_nexus_driver);
-}
-
-module_init(nexus_init);
-module_exit(nexus_exit);
-
-MODULE_AUTHOR("Brian Waite");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:" HDPU_NEXUS_NAME);
diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
index a92a3a742b43..98ad0120aa9b 100644
--- a/drivers/misc/hpilo.c
+++ b/drivers/misc/hpilo.c
@@ -25,6 +25,7 @@
 #include <linux/io.h>
 #include <linux/wait.h>
 #include <linux/poll.h>
+#include <linux/slab.h>
 #include "hpilo.h"
 
 static struct class *ilo_class;
diff --git a/drivers/misc/ibmasm/command.c b/drivers/misc/ibmasm/command.c
index e2031739aa29..5c766b4fb238 100644
--- a/drivers/misc/ibmasm/command.c
+++ b/drivers/misc/ibmasm/command.c
@@ -23,6 +23,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include "ibmasm.h"
 #include "lowlevel.h"
 
diff --git a/drivers/misc/ibmasm/event.c b/drivers/misc/ibmasm/event.c
index 572d41ffc186..76bfda1ffaa9 100644
--- a/drivers/misc/ibmasm/event.c
+++ b/drivers/misc/ibmasm/event.c
@@ -23,6 +23,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include "ibmasm.h"
 #include "lowlevel.h"
 
diff --git a/drivers/misc/ibmasm/ibmasmfs.c b/drivers/misc/ibmasm/ibmasmfs.c
index aecf40ecb3a4..8844a3f45381 100644
--- a/drivers/misc/ibmasm/ibmasmfs.c
+++ b/drivers/misc/ibmasm/ibmasmfs.c
@@ -75,6 +75,7 @@
 
 #include <linux/fs.h>
 #include <linux/pagemap.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include "ibmasm.h"
diff --git a/drivers/misc/ibmasm/module.c b/drivers/misc/ibmasm/module.c
index dc14b0b9cbfa..a234d965243b 100644
--- a/drivers/misc/ibmasm/module.c
+++ b/drivers/misc/ibmasm/module.c
@@ -52,6 +52,7 @@
 
 #include <linux/pci.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include "ibmasm.h"
 #include "lowlevel.h"
 #include "remote.h"
diff --git a/drivers/misc/ics932s401.c b/drivers/misc/ics932s401.c
index 395a4ea64e9c..152e9d93eecb 100644
--- a/drivers/misc/ics932s401.c
+++ b/drivers/misc/ics932s401.c
@@ -26,6 +26,7 @@
 #include <linux/mutex.h>
 #include <linux/delay.h>
 #include <linux/log2.h>
+#include <linux/slab.h>
 
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x69, I2C_CLIENT_END };
diff --git a/drivers/misc/ioc4.c b/drivers/misc/ioc4.c
index 09dcb699e667..193206602d88 100644
--- a/drivers/misc/ioc4.c
+++ b/drivers/misc/ioc4.c
@@ -30,6 +30,7 @@
 #include <linux/pci.h>
 #include <linux/ioc4.h>
 #include <linux/ktime.h>
+#include <linux/slab.h>
 #include <linux/mutex.h>
 #include <linux/time.h>
 #include <asm/io.h>
diff --git a/drivers/misc/iwmc3200top/debugfs.c b/drivers/misc/iwmc3200top/debugfs.c
index 0c8ea0a1c8a3..e9eda471f6e0 100644
--- a/drivers/misc/iwmc3200top/debugfs.c
+++ b/drivers/misc/iwmc3200top/debugfs.c
@@ -25,6 +25,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/ctype.h>
 #include <linux/mmc/sdio_func.h>
diff --git a/drivers/misc/iwmc3200top/fw-download.c b/drivers/misc/iwmc3200top/fw-download.c
index 50d431e469f5..e27afde6e99f 100644
--- a/drivers/misc/iwmc3200top/fw-download.c
+++ b/drivers/misc/iwmc3200top/fw-download.c
@@ -26,6 +26,7 @@
 
 #include <linux/firmware.h>
 #include <linux/mmc/sdio_func.h>
+#include <linux/slab.h>
 #include <asm/unaligned.h>
 
 #include "iwmc3200top.h"
@@ -43,15 +44,14 @@ static int iwmct_fw_parser_init(struct iwmct_priv *priv, const u8 *file,
         struct iwmct_parser *parser = &priv->parser;
         struct iwmct_fw_hdr *fw_hdr = &parser->versions;
 
-        LOG_INFOEX(priv, INIT, "-->\n");
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
 
         LOG_INFO(priv, FW_DOWNLOAD, "file_size=%zd\n", file_size);
 
         parser->file = file;
         parser->file_size = file_size;
         parser->cur_pos = 0;
-        parser->buf = NULL;
-
+        parser->entry_point = 0;
         parser->buf = kzalloc(block_size, GFP_KERNEL);
         if (!parser->buf) {
                 LOG_ERROR(priv, FW_DOWNLOAD, "kzalloc error\n");
@@ -70,7 +70,7 @@ static int iwmct_fw_parser_init(struct iwmct_priv *priv, const u8 *file,
 
         parser->cur_pos += sizeof(struct iwmct_fw_hdr);
 
-        LOG_INFOEX(priv, INIT, "<--\n");
+        LOG_TRACE(priv, FW_DOWNLOAD, "<--\n");
         return 0;
 }
 
@@ -113,7 +113,7 @@ static int iwmct_parse_next_section(struct iwmct_priv *priv, const u8 **p_sec,
         struct iwmct_dbg *dbg = &priv->dbg;
         struct iwmct_fw_sec_hdr *sec_hdr;
 
-        LOG_INFOEX(priv, INIT, "-->\n");
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
 
         while (parser->cur_pos + sizeof(struct iwmct_fw_sec_hdr)
                 <= parser->file_size) {
@@ -152,7 +152,7 @@ static int iwmct_parse_next_section(struct iwmct_priv *priv, const u8 **p_sec,
                         "finished with section cur_pos=%zd\n", parser->cur_pos);
         }
 
-        LOG_INFOEX(priv, INIT, "<--\n");
+        LOG_TRACE(priv, INIT, "<--\n");
         return 0;
 }
 
@@ -167,7 +167,7 @@ static int iwmct_download_section(struct iwmct_priv *priv, const u8 *p_sec,
         int ret = 0;
         u32 cmd = 0;
 
-        LOG_INFOEX(priv, INIT, "-->\n");
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
         LOG_INFO(priv, FW_DOWNLOAD, "Download address 0x%x size 0x%zx\n",
                                 addr, sec_size);
 
@@ -229,7 +229,7 @@ static int iwmct_download_section(struct iwmct_priv *priv, const u8 *p_sec,
                 hdr->cmd = cpu_to_le32(cmd);
                 /* send it down */
                 /* TODO: add more proper sending and error checking */
-                ret = iwmct_tx(priv, 0, parser->buf, trans_size);
+                ret = iwmct_tx(priv, parser->buf, trans_size);
                 if (ret != 0) {
                         LOG_INFO(priv, FW_DOWNLOAD,
                                 "iwmct_tx returned %d\n", ret);
@@ -251,7 +251,7 @@ static int iwmct_download_section(struct iwmct_priv *priv, const u8 *p_sec,
         if (sent < sec_size)
                 ret = -EINVAL;
 exit:
-        LOG_INFOEX(priv, INIT, "<--\n");
+        LOG_TRACE(priv, FW_DOWNLOAD, "<--\n");
         return ret;
 }
 
@@ -262,7 +262,7 @@ static int iwmct_kick_fw(struct iwmct_priv *priv, bool jump)
         int ret;
         u32 cmd;
 
-        LOG_INFOEX(priv, INIT, "-->\n");
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
 
         memset(parser->buf, 0, parser->buf_size);
         cmd = IWMC_CMD_SIGNATURE << CMD_HDR_SIGNATURE_POS;
@@ -281,11 +281,11 @@ static int iwmct_kick_fw(struct iwmct_priv *priv, bool jump)
         LOG_HEXDUMP(FW_DOWNLOAD, parser->buf, sizeof(*hdr));
         /* send it down */
         /* TODO: add more proper sending and error checking */
-        ret = iwmct_tx(priv, 0, parser->buf, IWMC_SDIO_BLK_SIZE);
+        ret = iwmct_tx(priv, parser->buf, IWMC_SDIO_BLK_SIZE);
         if (ret)
                 LOG_INFO(priv, FW_DOWNLOAD, "iwmct_tx returned %d", ret);
 
-        LOG_INFOEX(priv, INIT, "<--\n");
+        LOG_TRACE(priv, FW_DOWNLOAD, "<--\n");
         return 0;
 }
 
@@ -298,8 +298,16 @@ int iwmct_fw_load(struct iwmct_priv *priv)
         __le32 addr;
         int ret;
 
-        /* clear parser struct */
-        memset(&priv->parser, 0, sizeof(struct iwmct_parser));
+
+        LOG_INFO(priv, FW_DOWNLOAD, "barker download request 0x%x is:\n",
+                        priv->barker);
+        LOG_INFO(priv, FW_DOWNLOAD, "*******  Top FW %s requested ********\n",
+                        (priv->barker & BARKER_DNLOAD_TOP_MSK) ? "was" : "not");
+        LOG_INFO(priv, FW_DOWNLOAD, "*******  GPS FW %s requested ********\n",
+                        (priv->barker & BARKER_DNLOAD_GPS_MSK) ? "was" : "not");
+        LOG_INFO(priv, FW_DOWNLOAD, "*******  BT FW %s requested ********\n",
+                        (priv->barker & BARKER_DNLOAD_BT_MSK) ? "was" : "not");
+
 
         /* get the firmware */
         ret = request_firmware(&raw, fw_name, &priv->func->dev);
@@ -317,6 +325,7 @@ int iwmct_fw_load(struct iwmct_priv *priv)
 
         LOG_INFO(priv, FW_DOWNLOAD, "Read firmware '%s'\n", fw_name);
 
+        /* clear parser struct */
         ret = iwmct_fw_parser_init(priv, raw->data, raw->size, priv->trans_len);
         if (ret < 0) {
                 LOG_ERROR(priv, FW_DOWNLOAD,
@@ -324,7 +333,6 @@ int iwmct_fw_load(struct iwmct_priv *priv)
                 goto exit;
         }
 
-        /* checksum  */
         if (!iwmct_checksum(priv)) {
                 LOG_ERROR(priv, FW_DOWNLOAD, "checksum error\n");
                 ret = -EINVAL;
@@ -333,23 +341,18 @@ int iwmct_fw_load(struct iwmct_priv *priv)
 
         /* download firmware to device */
         while (iwmct_parse_next_section(priv, &pdata, &len, &addr)) {
-                if (iwmct_download_section(priv, pdata, len, addr)) {
+                ret = iwmct_download_section(priv, pdata, len, addr);
+                if (ret) {
                         LOG_ERROR(priv, FW_DOWNLOAD,
                                   "%s download section failed\n", fw_name);
-                        ret = -EIO;
                         goto exit;
                 }
         }
 
-        iwmct_kick_fw(priv, !!(priv->barker & BARKER_DNLOAD_JUMP_MSK));
+        ret = iwmct_kick_fw(priv, !!(priv->barker & BARKER_DNLOAD_JUMP_MSK));
 
 exit:
         kfree(priv->parser.buf);
-
-        if (raw)
-                release_firmware(raw);
-
-        raw = NULL;
-
+        release_firmware(raw);
         return ret;
 }
diff --git a/drivers/misc/iwmc3200top/iwmc3200top.h b/drivers/misc/iwmc3200top/iwmc3200top.h
index 43bd510e1872..740ff0738ea8 100644
--- a/drivers/misc/iwmc3200top/iwmc3200top.h
+++ b/drivers/misc/iwmc3200top/iwmc3200top.h
@@ -196,9 +196,7 @@ struct iwmct_priv {
         struct list_head read_req_list;
 };
 
-extern int iwmct_tx(struct iwmct_priv *priv, unsigned int addr,
-                void *src, int count);
-
+extern int iwmct_tx(struct iwmct_priv *priv, void *src, int count);
 extern int iwmct_fw_load(struct iwmct_priv *priv);
 
 extern void iwmct_dbg_init_params(struct iwmct_priv *drv);
diff --git a/drivers/misc/iwmc3200top/log.c b/drivers/misc/iwmc3200top/log.c
index d569279698f6..a36a55a49cac 100644
--- a/drivers/misc/iwmc3200top/log.c
+++ b/drivers/misc/iwmc3200top/log.c
@@ -26,6 +26,7 @@
 
 #include <linux/kernel.h>
 #include <linux/mmc/sdio_func.h>
+#include <linux/slab.h>
 #include <linux/ctype.h>
 #include "fw-msg.h"
 #include "iwmc3200top.h"
diff --git a/drivers/misc/iwmc3200top/log.h b/drivers/misc/iwmc3200top/log.h
index aba8121f978c..4434bb16cea7 100644
--- a/drivers/misc/iwmc3200top/log.h
+++ b/drivers/misc/iwmc3200top/log.h
@@ -37,13 +37,26 @@
 #define LOG_SEV_INFO                    3
 #define LOG_SEV_INFOEX                  4
 
-#define LOG_SEV_FILTER_ALL              \
-        (BIT(LOG_SEV_CRITICAL) |        \
-         BIT(LOG_SEV_ERROR)    |        \
-         BIT(LOG_SEV_WARNING)  |        \
-         BIT(LOG_SEV_INFO)     |        \
+/* Log levels not defined for FW */
+#define LOG_SEV_TRACE                   5
+#define LOG_SEV_DUMP                    6
+
+#define LOG_SEV_FW_FILTER_ALL           \
+        (BIT(LOG_SEV_CRITICAL)  |       \
+         BIT(LOG_SEV_ERROR)     |       \
+         BIT(LOG_SEV_WARNING)   |       \
+         BIT(LOG_SEV_INFO)      |       \
          BIT(LOG_SEV_INFOEX))
 
+#define LOG_SEV_FILTER_ALL              \
+        (BIT(LOG_SEV_CRITICAL)  |       \
+         BIT(LOG_SEV_ERROR)     |       \
+         BIT(LOG_SEV_WARNING)   |       \
+         BIT(LOG_SEV_INFO)      |       \
+         BIT(LOG_SEV_INFOEX)    |       \
+         BIT(LOG_SEV_TRACE)     |       \
+         BIT(LOG_SEV_DUMP))
+
 /* log source */
 #define LOG_SRC_INIT                    0
 #define LOG_SRC_DEBUGFS                 1
@@ -104,16 +117,16 @@ do {									\
                          __func__, __LINE__, ##args);                   \
 } while (0)
 
-#define LOG_INFOEX(priv, src, fmt, args...)                             \
+#define LOG_TRACE(priv, src, fmt, args...)                              \
 do {                                                                    \
-        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_INFOEX))       \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_TRACE))        \
                 dev_dbg(priv2dev(priv), "%s %d: " fmt,                  \
                          __func__, __LINE__, ##args);                   \
 } while (0)
 
 #define LOG_HEXDUMP(src, ptr, len)                                      \
 do {                                                                    \
-        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_INFOEX))       \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_DUMP)) \
                 print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_NONE,        \
                                 16, 1, ptr, len, false);                \
 } while (0)
@@ -142,7 +155,7 @@ ssize_t store_iwmct_log_level_fw(struct device *d,
 #define LOG_ERROR(priv, src, fmt, args...)
 #define LOG_WARNING(priv, src, fmt, args...)
 #define LOG_INFO(priv, src, fmt, args...)
-#define LOG_INFOEX(priv, src, fmt, args...)
+#define LOG_TRACE(priv, src, fmt, args...)
 #define LOG_HEXDUMP(src, ptr, len)
 
 static inline void iwmct_log_top_message(struct iwmct_priv *priv,
diff --git a/drivers/misc/iwmc3200top/main.c b/drivers/misc/iwmc3200top/main.c
index fafcaa481d74..c73cef2c3c5e 100644
--- a/drivers/misc/iwmc3200top/main.c
+++ b/drivers/misc/iwmc3200top/main.c
@@ -25,6 +25,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/debugfs.h>
@@ -49,6 +50,20 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR(DRIVER_COPYRIGHT);
 MODULE_FIRMWARE(FW_NAME(FW_API_VER));
 
+
+static inline int __iwmct_tx(struct iwmct_priv *priv, void *src, int count)
+{
+        return sdio_memcpy_toio(priv->func, IWMC_SDIO_DATA_ADDR, src, count);
+
+}
+int iwmct_tx(struct iwmct_priv *priv, void *src, int count)
+{
+        int ret;
+        sdio_claim_host(priv->func);
+        ret =  __iwmct_tx(priv, src, count);
+        sdio_release_host(priv->func);
+        return ret;
+}
 /*
  * This workers main task is to wait for OP_OPR_ALIVE
  * from TOP FW until ALIVE_MSG_TIMOUT timeout is elapsed.
@@ -66,7 +81,7 @@ static void iwmct_rescan_worker(struct work_struct *ws)
 
         ret = bus_rescan_devices(priv->func->dev.bus);
         if (ret < 0)
-                LOG_INFO(priv, FW_DOWNLOAD, "bus_rescan_devices FAILED!!!\n");
+                LOG_INFO(priv, INIT, "bus_rescan_devices FAILED!!!\n");
 }
 
 static void op_top_message(struct iwmct_priv *priv, struct top_msg *msg)
@@ -137,7 +152,7 @@ int iwmct_send_hcmd(struct iwmct_priv *priv, u8 *cmd, u16 len)
         int ret;
         u8 *buf;
 
-        LOG_INFOEX(priv, FW_MSG, "Sending hcmd:\n");
+        LOG_TRACE(priv, FW_MSG, "Sending hcmd:\n");
 
         /* add padding to 256 for IWMC */
         ((struct top_msg *)cmd)->hdr.flags |= CMD_FLAG_PADDING_256;
@@ -158,27 +173,12 @@ int iwmct_send_hcmd(struct iwmct_priv *priv, u8 *cmd, u16 len)
         }
 
         memcpy(buf, cmd, len);
-
-        sdio_claim_host(priv->func);
-        ret = sdio_memcpy_toio(priv->func, IWMC_SDIO_DATA_ADDR, buf,
-                               FW_HCMD_BLOCK_SIZE);
-        sdio_release_host(priv->func);
+        ret = iwmct_tx(priv, buf, FW_HCMD_BLOCK_SIZE);
 
         kfree(buf);
         return ret;
 }
 
-int iwmct_tx(struct iwmct_priv *priv, unsigned int addr,
-        void *src, int count)
-{
-        int ret;
-
-        sdio_claim_host(priv->func);
-        ret = sdio_memcpy_toio(priv->func, addr, src, count);
-        sdio_release_host(priv->func);
-
-        return ret;
-}
 
 static void iwmct_irq_read_worker(struct work_struct *ws)
 {
@@ -192,7 +192,7 @@ static void iwmct_irq_read_worker(struct work_struct *ws)
 
         priv = container_of(ws, struct iwmct_priv, isr_worker);
 
-        LOG_INFO(priv, IRQ, "enter iwmct_irq_read_worker %p\n", ws);
+        LOG_TRACE(priv, IRQ, "enter iwmct_irq_read_worker %p\n", ws);
 
         /* --------------------- Handshake with device -------------------- */
         sdio_claim_host(priv->func);
@@ -273,8 +273,7 @@ static void iwmct_irq_read_worker(struct work_struct *ws)
 
                 if (barker & BARKER_DNLOAD_SYNC_MSK) {
                         /* Send the same barker back */
-                        ret = sdio_memcpy_toio(priv->func, IWMC_SDIO_DATA_ADDR,
-                                               buf, iosize);
+                        ret = __iwmct_tx(priv, buf, iosize);
                         if (ret) {
                                 LOG_ERROR(priv, IRQ,
                                          "error %d echoing barker\n", ret);
@@ -292,15 +291,6 @@ static void iwmct_irq_read_worker(struct work_struct *ws)
 
         sdio_release_host(priv->func);
 
-
-        LOG_INFO(priv, IRQ, "barker download request 0x%x is:\n", priv->barker);
-        LOG_INFO(priv, IRQ, "*******  Top FW %s requested ********\n",
-                        (priv->barker & BARKER_DNLOAD_TOP_MSK) ? "was" : "not");
-        LOG_INFO(priv, IRQ, "*******  GPS FW %s requested ********\n",
-                        (priv->barker & BARKER_DNLOAD_GPS_MSK) ? "was" : "not");
-        LOG_INFO(priv, IRQ, "*******  BT FW %s requested ********\n",
-                        (priv->barker & BARKER_DNLOAD_BT_MSK) ? "was" : "not");
-
         if (priv->dbg.fw_download)
                 iwmct_fw_load(priv);
         else
@@ -312,7 +302,7 @@ exit_release:
         sdio_release_host(priv->func);
 exit:
         kfree(buf);
-        LOG_INFO(priv, IRQ, "exit iwmct_irq_read_worker\n");
+        LOG_TRACE(priv, IRQ, "exit iwmct_irq_read_worker\n");
 }
 
 static void iwmct_irq(struct sdio_func *func)
@@ -325,12 +315,12 @@ static void iwmct_irq(struct sdio_func *func)
 
         priv = sdio_get_drvdata(func);
 
-        LOG_INFO(priv, IRQ, "enter iwmct_irq\n");
+        LOG_TRACE(priv, IRQ, "enter iwmct_irq\n");
 
         /* read the function's status register */
         val = sdio_readb(func, IWMC_SDIO_INTR_STATUS_ADDR, &ret);
 
-        LOG_INFO(priv, IRQ, "iir value = %d, ret=%d\n", val, ret);
+        LOG_TRACE(priv, IRQ, "iir value = %d, ret=%d\n", val, ret);
 
         if (!val) {
                 LOG_ERROR(priv, IRQ, "iir = 0, exiting ISR\n");
@@ -372,7 +362,7 @@ static void iwmct_irq(struct sdio_func *func)
 
         queue_work(priv->wq, &priv->isr_worker);
 
-        LOG_INFO(priv, IRQ, "exit iwmct_irq\n");
+        LOG_TRACE(priv, IRQ, "exit iwmct_irq\n");
 
         return;
 
@@ -608,8 +598,6 @@ static void iwmct_remove(struct sdio_func *func)
         struct iwmct_work_struct *read_req;
         struct iwmct_priv *priv = sdio_get_drvdata(func);
 
-        priv = sdio_get_drvdata(func);
-
         LOG_INFO(priv, INIT, "enter\n");
 
         sdio_claim_host(func);
@@ -660,7 +648,7 @@ static int __init iwmct_init(void)
 
         /* Default log filter settings */
         iwmct_log_set_filter(LOG_SRC_ALL, LOG_SEV_FILTER_RUNTIME);
-        iwmct_log_set_filter(LOG_SRC_FW_MSG, LOG_SEV_FILTER_ALL);
+        iwmct_log_set_filter(LOG_SRC_FW_MSG, LOG_SEV_FW_FILTER_ALL);
         iwmct_log_set_fw_filter(LOG_SRC_ALL, FW_LOG_SEV_FILTER_RUNTIME);
 
         rc = sdio_register_driver(&iwmct_driver);
diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
index fcb6ec1af173..72450237a0f4 100644
--- a/drivers/misc/kgdbts.c
+++ b/drivers/misc/kgdbts.c
@@ -295,6 +295,10 @@ static int check_and_rewind_pc(char *put_str, char *arg)
         /* On x86 a breakpoint stop requires it to be decremented */
         if (addr + 1 == kgdbts_regs.ip)
                 offset = -1;
+#elif defined(CONFIG_SUPERH)
+        /* On SUPERH a breakpoint stop requires it to be decremented */
+        if (addr + 2 == kgdbts_regs.pc)
+                offset = -2;
 #endif
         if (strcmp(arg, "silent") &&
                 instruction_pointer(&kgdbts_regs) + offset != addr) {
@@ -305,6 +309,8 @@ static int check_and_rewind_pc(char *put_str, char *arg)
 #ifdef CONFIG_X86
         /* On x86 adjust the instruction pointer if needed */
         kgdbts_regs.ip += offset;
+#elif defined(CONFIG_SUPERH)
+        kgdbts_regs.pc += offset;
 #endif
         return 0;
 }
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index 3648b23d5c92..5bfb2a2041b8 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -26,21 +26,9 @@
  * It is adapted from the Linux Kernel Dump Test Tool by
  * Fernando Luis Vazquez Cao <http://lkdtt.sourceforge.net>
  *
- * Usage :  insmod lkdtm.ko [recur_count={>0}] cpoint_name=<> cpoint_type=<>
- *                                                      [cpoint_count={>0}]
+ * Debugfs support added by Simon Kagstrom <simon.kagstrom@netinsight.net>
  *
- * recur_count : Recursion level for the stack overflow test. Default is 10.
- *
- * cpoint_name : Crash point where the kernel is to be crashed. It can be
- *               one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
- *               FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_DISPATCH_CMD,
- *               IDE_CORE_CP
- *
- * cpoint_type : Indicates the action to be taken on hitting the crash point.
- *               It can be one of PANIC, BUG, EXCEPTION, LOOP, OVERFLOW
- *
- * cpoint_count : Indicates the number of times the crash point is to be hit
- *                to trigger an action. The default is 10.
+ * See Documentation/fault-injection/provoke-crashes.txt for instructions
  */
 
 #include <linux/kernel.h>
@@ -52,14 +40,14 @@
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/hrtimer.h>
+#include <linux/slab.h>
 #include <scsi/scsi_cmnd.h>
+#include <linux/debugfs.h>
 
 #ifdef CONFIG_IDE
 #include <linux/ide.h>
 #endif
 
-#define NUM_CPOINTS 8
-#define NUM_CPOINT_TYPES 5
 #define DEFAULT_COUNT 10
 #define REC_NUM_DEFAULT 10
 
@@ -72,7 +60,8 @@ enum cname {
         MEM_SWAPOUT,
         TIMERADD,
         SCSI_DISPATCH_CMD,
-        IDE_CORE_CP
+        IDE_CORE_CP,
+        DIRECT,
 };
 
 enum ctype {
@@ -81,7 +70,14 @@ enum ctype {
         BUG,
         EXCEPTION,
         LOOP,
-        OVERFLOW
+        OVERFLOW,
+        CORRUPT_STACK,
+        UNALIGNED_LOAD_STORE_WRITE,
+        OVERWRITE_ALLOCATION,
+        WRITE_AFTER_FREE,
+        SOFTLOCKUP,
+        HARDLOCKUP,
+        HUNG_TASK,
 };
 
 static char* cp_name[] = {
@@ -92,7 +88,8 @@ static char* cp_name[] = {
         "MEM_SWAPOUT",
         "TIMERADD",
         "SCSI_DISPATCH_CMD",
-        "IDE_CORE_CP"
+        "IDE_CORE_CP",
+        "DIRECT",
 };
 
 static char* cp_type[] = {
@@ -100,7 +97,14 @@ static char* cp_type[] = {
         "BUG",
         "EXCEPTION",
         "LOOP",
-        "OVERFLOW"
+        "OVERFLOW",
+        "CORRUPT_STACK",
+        "UNALIGNED_LOAD_STORE_WRITE",
+        "OVERWRITE_ALLOCATION",
+        "WRITE_AFTER_FREE",
+        "SOFTLOCKUP",
+        "HARDLOCKUP",
+        "HUNG_TASK",
 };
 
 static struct jprobe lkdtm;
@@ -193,34 +197,66 @@ int jp_generic_ide_ioctl(ide_drive_t *drive, struct file *file,
 }
 #endif
 
+/* Return the crashpoint number or NONE if the name is invalid */
+static enum ctype parse_cp_type(const char *what, size_t count)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(cp_type); i++) {
+                if (!strcmp(what, cp_type[i]))
+                        return i + 1;
+        }
+
+        return NONE;
+}
+
+static const char *cp_type_to_str(enum ctype type)
+{
+        if (type == NONE || type < 0 || type > ARRAY_SIZE(cp_type))
+                return "None";
+
+        return cp_type[type - 1];
+}
+
+static const char *cp_name_to_str(enum cname name)
+{
+        if (name == INVALID || name < 0 || name > ARRAY_SIZE(cp_name))
+                return "INVALID";
+
+        return cp_name[name - 1];
+}
+
+
 static int lkdtm_parse_commandline(void)
 {
         int i;
 
-        if (cpoint_name == NULL || cpoint_type == NULL ||
-                                        cpoint_count < 1 || recur_count < 1)
+        if (cpoint_count < 1 || recur_count < 1)
                 return -EINVAL;
 
-        for (i = 0; i < NUM_CPOINTS; ++i) {
+        count = cpoint_count;
+
+        /* No special parameters */
+        if (!cpoint_type && !cpoint_name)
+                return 0;
+
+        /* Neither or both of these need to be set */
+        if (!cpoint_type || !cpoint_name)
+                return -EINVAL;
+
+        cptype = parse_cp_type(cpoint_type, strlen(cpoint_type));
+        if (cptype == NONE)
+                return -EINVAL;
+
+        for (i = 0; i < ARRAY_SIZE(cp_name); i++) {
                 if (!strcmp(cpoint_name, cp_name[i])) {
                         cpoint = i + 1;
-                        break;
-                }
-        }
-
-        for (i = 0; i < NUM_CPOINT_TYPES; ++i) {
-                if (!strcmp(cpoint_type, cp_type[i])) {
-                        cptype = i + 1;
-                        break;
+                        return 0;
                 }
         }
 
-        if (cpoint == INVALID || cptype == NONE)
-                return -EINVAL;
-
-        count = cpoint_count;
-
-        return 0;
+        /* Could not find a valid crash point */
+        return -EINVAL;
 }
 
 static int recursive_loop(int a)
@@ -235,53 +271,106 @@ static int recursive_loop(int a)
                 return recursive_loop(a);
 }
 
-void lkdtm_handler(void)
+static void lkdtm_do_action(enum ctype which)
+{
+        switch (which) {
+        case PANIC:
+                panic("dumptest");
+                break;
+        case BUG:
+                BUG();
+                break;
+        case EXCEPTION:
+                *((int *) 0) = 0;
+                break;
+        case LOOP:
+                for (;;)
+                        ;
+                break;
+        case OVERFLOW:
+                (void) recursive_loop(0);
+                break;
+        case CORRUPT_STACK: {
+                volatile u32 data[8];
+                volatile u32 *p = data;
+
+                p[12] = 0x12345678;
+                break;
+        }
+        case UNALIGNED_LOAD_STORE_WRITE: {
+                static u8 data[5] __attribute__((aligned(4))) = {1, 2,
+                                3, 4, 5};
+                u32 *p;
+                u32 val = 0x12345678;
+
+                p = (u32 *)(data + 1);
+                if (*p == 0)
+                        val = 0x87654321;
+                *p = val;
+                 break;
+        }
+        case OVERWRITE_ALLOCATION: {
+                size_t len = 1020;
+                u32 *data = kmalloc(len, GFP_KERNEL);
+
+                data[1024 / sizeof(u32)] = 0x12345678;
+                kfree(data);
+                break;
+        }
+        case WRITE_AFTER_FREE: {
+                size_t len = 1024;
+                u32 *data = kmalloc(len, GFP_KERNEL);
+
+                kfree(data);
+                schedule();
+                memset(data, 0x78, len);
+                break;
+        }
+        case SOFTLOCKUP:
+                preempt_disable();
+                for (;;)
+                        cpu_relax();
+                break;
+        case HARDLOCKUP:
+                local_irq_disable();
+                for (;;)
+                        cpu_relax();
+                break;
+        case HUNG_TASK:
+                set_current_state(TASK_UNINTERRUPTIBLE);
+                schedule();
+                break;
+        case NONE:
+        default:
+                break;
+        }
+
+}
+
+static void lkdtm_handler(void)
 {
-        printk(KERN_INFO "lkdtm : Crash point %s of type %s hit\n",
-                                         cpoint_name, cpoint_type);
-        --count;
+        count--;
+        printk(KERN_INFO "lkdtm: Crash point %s of type %s hit, trigger in %d rounds\n",
+                        cp_name_to_str(cpoint), cp_type_to_str(cptype), count);
 
         if (count == 0) {
-                switch (cptype) {
-                case NONE:
-                        break;
-                case PANIC:
-                        printk(KERN_INFO "lkdtm : PANIC\n");
-                        panic("dumptest");
-                        break;
-                case BUG:
-                        printk(KERN_INFO "lkdtm : BUG\n");
-                        BUG();
-                        break;
-                case EXCEPTION:
-                        printk(KERN_INFO "lkdtm : EXCEPTION\n");
-                        *((int *) 0) = 0;
-                        break;
-                case LOOP:
-                        printk(KERN_INFO "lkdtm : LOOP\n");
-                        for (;;);
-                        break;
-                case OVERFLOW:
-                        printk(KERN_INFO "lkdtm : OVERFLOW\n");
-                        (void) recursive_loop(0);
-                        break;
-                default:
-                        break;
-                }
+                lkdtm_do_action(cptype);
                 count = cpoint_count;
         }
 }
 
-static int __init lkdtm_module_init(void)
+static int lkdtm_register_cpoint(enum cname which)
 {
         int ret;
 
-        if (lkdtm_parse_commandline() == -EINVAL) {
-                printk(KERN_INFO "lkdtm : Invalid command\n");
-                return -EINVAL;
-        }
+        cpoint = INVALID;
+        if (lkdtm.entry != NULL)
+                unregister_jprobe(&lkdtm);
 
-        switch (cpoint) {
+        switch (which) {
+        case DIRECT:
+                lkdtm_do_action(cptype);
+                return 0;
         case INT_HARDWARE_ENTRY:
                 lkdtm.kp.symbol_name = "do_IRQ";
                 lkdtm.entry = (kprobe_opcode_t*) jp_do_irq;
@@ -315,28 +404,268 @@ static int __init lkdtm_module_init(void)
                 lkdtm.kp.symbol_name = "generic_ide_ioctl";
                 lkdtm.entry = (kprobe_opcode_t*) jp_generic_ide_ioctl;
 #else
-                printk(KERN_INFO "lkdtm : Crash point not available\n");
+                printk(KERN_INFO "lkdtm: Crash point not available\n");
+                return -EINVAL;
 #endif
                 break;
         default:
-                printk(KERN_INFO "lkdtm : Invalid Crash Point\n");
-                break;
+                printk(KERN_INFO "lkdtm: Invalid Crash Point\n");
+                return -EINVAL;
         }
 
+        cpoint = which;
         if ((ret = register_jprobe(&lkdtm)) < 0) {
-                printk(KERN_INFO "lkdtm : Couldn't register jprobe\n");
-                return ret;
+                printk(KERN_INFO "lkdtm: Couldn't register jprobe\n");
+                cpoint = INVALID;
+        }
+
+        return ret;
+}
+
+static ssize_t do_register_entry(enum cname which, struct file *f,
+                const char __user *user_buf, size_t count, loff_t *off)
+{
+        char *buf;
+        int err;
+
+        if (count >= PAGE_SIZE)
+                return -EINVAL;
+
+        buf = (char *)__get_free_page(GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        if (copy_from_user(buf, user_buf, count)) {
+                free_page((unsigned long) buf);
+                return -EFAULT;
+        }
+        /* NULL-terminate and remove enter */
+        buf[count] = '\0';
+        strim(buf);
+
+        cptype = parse_cp_type(buf, count);
+        free_page((unsigned long) buf);
+
+        if (cptype == NONE)
+                return -EINVAL;
+
+        err = lkdtm_register_cpoint(which);
+        if (err < 0)
+                return err;
+
+        *off += count;
+
+        return count;
+}
+
+/* Generic read callback that just prints out the available crash types */
+static ssize_t lkdtm_debugfs_read(struct file *f, char __user *user_buf,
+                size_t count, loff_t *off)
+{
+        char *buf;
+        int i, n, out;
+
+        buf = (char *)__get_free_page(GFP_KERNEL);
+
+        n = snprintf(buf, PAGE_SIZE, "Available crash types:\n");
+        for (i = 0; i < ARRAY_SIZE(cp_type); i++)
+                n += snprintf(buf + n, PAGE_SIZE - n, "%s\n", cp_type[i]);
+        buf[n] = '\0';
+
+        out = simple_read_from_buffer(user_buf, count, off,
+                                      buf, n);
+        free_page((unsigned long) buf);
+
+        return out;
+}
+
+static int lkdtm_debugfs_open(struct inode *inode, struct file *file)
+{
+        return 0;
+}
+
+
+static ssize_t int_hardware_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(INT_HARDWARE_ENTRY, f, buf, count, off);
+}
+
+static ssize_t int_hw_irq_en(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(INT_HW_IRQ_EN, f, buf, count, off);
+}
+
+static ssize_t int_tasklet_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(INT_TASKLET_ENTRY, f, buf, count, off);
+}
+
+static ssize_t fs_devrw_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(FS_DEVRW, f, buf, count, off);
+}
+
+static ssize_t mem_swapout_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(MEM_SWAPOUT, f, buf, count, off);
+}
+
+static ssize_t timeradd_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(TIMERADD, f, buf, count, off);
+}
+
+static ssize_t scsi_dispatch_cmd_entry(struct file *f,
+                const char __user *buf, size_t count, loff_t *off)
+{
+        return do_register_entry(SCSI_DISPATCH_CMD, f, buf, count, off);
+}
+
+static ssize_t ide_core_cp_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(IDE_CORE_CP, f, buf, count, off);
+}
+
+/* Special entry to just crash directly. Available without KPROBEs */
+static ssize_t direct_entry(struct file *f, const char __user *user_buf,
+                size_t count, loff_t *off)
+{
+        enum ctype type;
+        char *buf;
+
+        if (count >= PAGE_SIZE)
+                return -EINVAL;
+        if (count < 1)
+                return -EINVAL;
+
+        buf = (char *)__get_free_page(GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        if (copy_from_user(buf, user_buf, count)) {
+                free_page((unsigned long) buf);
+                return -EFAULT;
+        }
+        /* NULL-terminate and remove enter */
+        buf[count] = '\0';
+        strim(buf);
+
+        type = parse_cp_type(buf, count);
+        free_page((unsigned long) buf);
+        if (type == NONE)
+                return -EINVAL;
+
+        printk(KERN_INFO "lkdtm: Performing direct entry %s\n",
+                        cp_type_to_str(type));
+        lkdtm_do_action(type);
+        *off += count;
+
+        return count;
+}
+
+struct crash_entry {
+        const char *name;
+        const struct file_operations fops;
+};
+
+static const struct crash_entry crash_entries[] = {
+        {"DIRECT", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = direct_entry} },
+        {"INT_HARDWARE_ENTRY", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = int_hardware_entry} },
+        {"INT_HW_IRQ_EN", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = int_hw_irq_en} },
+        {"INT_TASKLET_ENTRY", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = int_tasklet_entry} },
+        {"FS_DEVRW", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = fs_devrw_entry} },
+        {"MEM_SWAPOUT", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = mem_swapout_entry} },
+        {"TIMERADD", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = timeradd_entry} },
+        {"SCSI_DISPATCH_CMD", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = scsi_dispatch_cmd_entry} },
+        {"IDE_CORE_CP", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = ide_core_cp_entry} },
+};
+
+static struct dentry *lkdtm_debugfs_root;
+
+static int __init lkdtm_module_init(void)
+{
+        int ret = -EINVAL;
+        int n_debugfs_entries = 1; /* Assume only the direct entry */
+        int i;
+
+        /* Register debugfs interface */
+        lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL);
+        if (!lkdtm_debugfs_root) {
+                printk(KERN_ERR "lkdtm: creating root dir failed\n");
+                return -ENODEV;
+        }
+
+#ifdef CONFIG_KPROBES
+        n_debugfs_entries = ARRAY_SIZE(crash_entries);
+#endif
+
+        for (i = 0; i < n_debugfs_entries; i++) {
+                const struct crash_entry *cur = &crash_entries[i];
+                struct dentry *de;
+
+                de = debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root,
+                                NULL, &cur->fops);
+                if (de == NULL) {
+                        printk(KERN_ERR "lkdtm: could not create %s\n",
+                                        cur->name);
+                        goto out_err;
+                }
+        }
+
+        if (lkdtm_parse_commandline() == -EINVAL) {
+                printk(KERN_INFO "lkdtm: Invalid command\n");
+                goto out_err;
+        }
+
+        if (cpoint != INVALID && cptype != NONE) {
+                ret = lkdtm_register_cpoint(cpoint);
+                if (ret < 0) {
+                        printk(KERN_INFO "lkdtm: Invalid crash point %d\n",
+                                        cpoint);
+                        goto out_err;
+                }
+                printk(KERN_INFO "lkdtm: Crash point %s of type %s registered\n",
+                                cpoint_name, cpoint_type);
+        } else {
+                printk(KERN_INFO "lkdtm: No crash points registered, enable through debugfs\n");
         }
 
-        printk(KERN_INFO "lkdtm : Crash point %s of type %s registered\n",
-                                                cpoint_name, cpoint_type);
         return 0;
+
+out_err:
+        debugfs_remove_recursive(lkdtm_debugfs_root);
+        return ret;
 }
 
 static void __exit lkdtm_module_exit(void)
 {
-        unregister_jprobe(&lkdtm);
-        printk(KERN_INFO "lkdtm : Crash point unregistered\n");
+        debugfs_remove_recursive(lkdtm_debugfs_root);
+
+        unregister_jprobe(&lkdtm);
+        printk(KERN_INFO "lkdtm: Crash point unregistered\n");
 }
 
 module_init(lkdtm_module_init);
diff --git a/drivers/misc/phantom.c b/drivers/misc/phantom.c
index 04c27266f567..75ee0d3f6f45 100644
--- a/drivers/misc/phantom.c
+++ b/drivers/misc/phantom.c
@@ -21,6 +21,7 @@
 #include <linux/poll.h>
 #include <linux/interrupt.h>
 #include <linux/cdev.h>
+#include <linux/slab.h>
 #include <linux/phantom.h>
 #include <linux/sched.h>
 #include <linux/smp_lock.h>
@@ -497,12 +498,7 @@ static struct pci_driver phantom_pci_driver = {
         .resume = phantom_resume
 };
 
-static ssize_t phantom_show_version(struct class *cls, char *buf)
-{
-        return sprintf(buf, PHANTOM_VERSION "\n");
-}
-
-static CLASS_ATTR(version, 0444, phantom_show_version, NULL);
+static CLASS_ATTR_STRING(version, 0444, PHANTOM_VERSION);
 
 static int __init phantom_init(void)
 {
@@ -515,7 +511,7 @@ static int __init phantom_init(void)
                 printk(KERN_ERR "phantom: can't register phantom class\n");
                 goto err;
         }
-        retval = class_create_file(phantom_class, &class_attr_version);
+        retval = class_create_file(phantom_class, &class_attr_version.attr);
         if (retval) {
                 printk(KERN_ERR "phantom: can't create sysfs version file\n");
                 goto err_class;
@@ -541,7 +537,7 @@ static int __init phantom_init(void)
 err_unchr:
         unregister_chrdev_region(dev, PHANTOM_MAX_MINORS);
 err_attr:
-        class_remove_file(phantom_class, &class_attr_version);
+        class_remove_file(phantom_class, &class_attr_version.attr);
 err_class:
         class_destroy(phantom_class);
 err:
@@ -554,7 +550,7 @@ static void __exit phantom_exit(void)
 
         unregister_chrdev_region(MKDEV(phantom_major, 0), PHANTOM_MAX_MINORS);
 
-        class_remove_file(phantom_class, &class_attr_version);
+        class_remove_file(phantom_class, &class_attr_version.attr);
         class_destroy(phantom_class);
 
         pr_debug("phantom: module successfully removed\n");
diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
index 02a77b8b8eef..7a8b9068ea03 100644
--- a/drivers/misc/sgi-gru/grutables.h
+++ b/drivers/misc/sgi-gru/grutables.h
@@ -516,8 +516,7 @@ struct gru_blade_state {
 
 /* Scan all active GRUs in a GRU bitmap */
 #define for_each_gru_in_bitmap(gid, map)                                \
-        for ((gid) = find_first_bit((map), GRU_MAX_GRUS); (gid) < GRU_MAX_GRUS;\
-                (gid)++, (gid) = find_next_bit((map), GRU_MAX_GRUS, (gid)))
+        for_each_set_bit((gid), (map), GRU_MAX_GRUS)
 
 /* Scan all active GRUs on a specific blade */
 #define for_each_gru_on_blade(gru, nid, i)                              \
@@ -536,23 +535,17 @@ struct gru_blade_state {
 
 /* Scan each CBR whose bit is set in a TFM (or copy of) */
 #define for_each_cbr_in_tfm(i, map)                                     \
-        for ((i) = find_first_bit(map, GRU_NUM_CBE);                    \
-                        (i) < GRU_NUM_CBE;                              \
-                        (i)++, (i) = find_next_bit(map, GRU_NUM_CBE, i))
+        for_each_set_bit((i), (map), GRU_NUM_CBE)
 
 /* Scan each CBR in a CBR bitmap. Note: multiple CBRs in an allocation unit */
 #define for_each_cbr_in_allocation_map(i, map, k)                       \
-        for ((k) = find_first_bit(map, GRU_CBR_AU); (k) < GRU_CBR_AU;   \
-                        (k) = find_next_bit(map, GRU_CBR_AU, (k) + 1))  \
+        for_each_set_bit((k), (map), GRU_CBR_AU)                        \
                 for ((i) = (k)*GRU_CBR_AU_SIZE;                         \
                                 (i) < ((k) + 1) * GRU_CBR_AU_SIZE; (i)++)
 
 /* Scan each DSR in a DSR bitmap. Note: multiple DSRs in an allocation unit */
 #define for_each_dsr_in_allocation_map(i, map, k)                       \
-        for ((k) = find_first_bit((const unsigned long *)map, GRU_DSR_AU);\
-                        (k) < GRU_DSR_AU;                               \
-                        (k) = find_next_bit((const unsigned long *)map, \
-                                          GRU_DSR_AU, (k) + 1))         \
+        for_each_set_bit((k), (const unsigned long *)(map), GRU_DSR_AU) \
                 for ((i) = (k) * GRU_DSR_AU_CL;                         \
                                 (i) < ((k) + 1) * GRU_DSR_AU_CL; (i)++)
 
diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
index 832ed4c88cf7..8d082b46426b 100644
--- a/drivers/misc/sgi-xp/xpc_main.c
+++ b/drivers/misc/sgi-xp/xpc_main.c
@@ -44,6 +44,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/sysctl.h>
 #include <linux/device.h>
 #include <linux/delay.h>
diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
index 9a6268c89fdd..d551f09ccb79 100644
--- a/drivers/misc/sgi-xp/xpc_partition.c
+++ b/drivers/misc/sgi-xp/xpc_partition.c
@@ -17,6 +17,7 @@
 
 #include <linux/device.h>
 #include <linux/hardirq.h>
+#include <linux/slab.h>
 #include "xpc.h"
 #include <asm/uv/uv_hub.h>
 
diff --git a/drivers/misc/sgi-xp/xpc_sn2.c b/drivers/misc/sgi-xp/xpc_sn2.c
index 8b70e03f939f..7d71c04fc938 100644
--- a/drivers/misc/sgi-xp/xpc_sn2.c
+++ b/drivers/misc/sgi-xp/xpc_sn2.c
@@ -14,6 +14,7 @@
  */
 
 #include <linux/delay.h>
+#include <linux/slab.h>
 #include <asm/uncached.h>
 #include <asm/sn/mspec.h>
 #include <asm/sn/sn_sal.h>
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index 8725d5e8ab0c..1f59ee2226ca 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -19,6 +19,7 @@
 #include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <asm/uv/uv_hub.h>
 #if defined CONFIG_X86_64
 #include <asm/uv/bios.h>
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index 16f0abda1423..ee5109a3cd98 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c
@@ -20,6 +20,7 @@
  *
  */
 
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
@@ -475,7 +476,7 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         if (skb->data[0] == 0xff) {
                 /* we are being asked to broadcast to all partitions */
-                for_each_bit(dest_partid, xpnet_broadcast_partitions,
+                for_each_set_bit(dest_partid, xpnet_broadcast_partitions,
                              xp_max_npartitions) {
 
                         xpnet_send(skb, queued_msg, start_addr, end_addr,
diff --git a/drivers/misc/tifm_core.c b/drivers/misc/tifm_core.c
index 98bcba521da2..5f6852dff40b 100644
--- a/drivers/misc/tifm_core.c
+++ b/drivers/misc/tifm_core.c
@@ -10,6 +10,7 @@
  */
 
 #include <linux/tifm.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/idr.h>
 
diff --git a/drivers/misc/tsl2550.c b/drivers/misc/tsl2550.c
new file mode 100644
index 000000000000..483ae5f7f68e
--- /dev/null
+++ b/drivers/misc/tsl2550.c
@@ -0,0 +1,473 @@
+/*
+ *  tsl2550.c - Linux kernel modules for ambient light sensor
+ *
+ *  Copyright (C) 2007 Rodolfo Giometti <giometti@linux.it>
+ *  Copyright (C) 2007 Eurotech S.p.A. <info@eurotech.it>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/mutex.h>
+
+#define TSL2550_DRV_NAME        "tsl2550"
+#define DRIVER_VERSION          "1.2"
+
+/*
+ * Defines
+ */
+
+#define TSL2550_POWER_DOWN              0x00
+#define TSL2550_POWER_UP                0x03
+#define TSL2550_STANDARD_RANGE          0x18
+#define TSL2550_EXTENDED_RANGE          0x1d
+#define TSL2550_READ_ADC0               0x43
+#define TSL2550_READ_ADC1               0x83
+
+/*
+ * Structs
+ */
+
+struct tsl2550_data {
+        struct i2c_client *client;
+        struct mutex update_lock;
+
+        unsigned int power_state:1;
+        unsigned int operating_mode:1;
+};
+
+/*
+ * Global data
+ */
+
+static const u8 TSL2550_MODE_RANGE[2] = {
+        TSL2550_STANDARD_RANGE, TSL2550_EXTENDED_RANGE,
+};
+
+/*
+ * Management functions
+ */
+
+static int tsl2550_set_operating_mode(struct i2c_client *client, int mode)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+
+        int ret = i2c_smbus_write_byte(client, TSL2550_MODE_RANGE[mode]);
+
+        data->operating_mode = mode;
+
+        return ret;
+}
+
+static int tsl2550_set_power_state(struct i2c_client *client, int state)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        int ret;
+
+        if (state == 0)
+                ret = i2c_smbus_write_byte(client, TSL2550_POWER_DOWN);
+        else {
+                ret = i2c_smbus_write_byte(client, TSL2550_POWER_UP);
+
+                /* On power up we should reset operating mode also... */
+                tsl2550_set_operating_mode(client, data->operating_mode);
+        }
+
+        data->power_state = state;
+
+        return ret;
+}
+
+static int tsl2550_get_adc_value(struct i2c_client *client, u8 cmd)
+{
+        int ret;
+
+        ret = i2c_smbus_read_byte_data(client, cmd);
+        if (ret < 0)
+                return ret;
+        if (!(ret & 0x80))
+                return -EAGAIN;
+        return ret & 0x7f;      /* remove the "valid" bit */
+}
+
+/*
+ * LUX calculation
+ */
+
+#define TSL2550_MAX_LUX         1846
+
+static const u8 ratio_lut[] = {
+        100, 100, 100, 100, 100, 100, 100, 100,
+        100, 100, 100, 100, 100, 100, 99, 99,
+        99, 99, 99, 99, 99, 99, 99, 99,
+        99, 99, 99, 98, 98, 98, 98, 98,
+        98, 98, 97, 97, 97, 97, 97, 96,
+        96, 96, 96, 95, 95, 95, 94, 94,
+        93, 93, 93, 92, 92, 91, 91, 90,
+        89, 89, 88, 87, 87, 86, 85, 84,
+        83, 82, 81, 80, 79, 78, 77, 75,
+        74, 73, 71, 69, 68, 66, 64, 62,
+        60, 58, 56, 54, 52, 49, 47, 44,
+        42, 41, 40, 40, 39, 39, 38, 38,
+        37, 37, 37, 36, 36, 36, 35, 35,
+        35, 35, 34, 34, 34, 34, 33, 33,
+        33, 33, 32, 32, 32, 32, 32, 31,
+        31, 31, 31, 31, 30, 30, 30, 30,
+        30,
+};
+
+static const u16 count_lut[] = {
+        0, 1, 2, 3, 4, 5, 6, 7,
+        8, 9, 10, 11, 12, 13, 14, 15,
+        16, 18, 20, 22, 24, 26, 28, 30,
+        32, 34, 36, 38, 40, 42, 44, 46,
+        49, 53, 57, 61, 65, 69, 73, 77,
+        81, 85, 89, 93, 97, 101, 105, 109,
+        115, 123, 131, 139, 147, 155, 163, 171,
+        179, 187, 195, 203, 211, 219, 227, 235,
+        247, 263, 279, 295, 311, 327, 343, 359,
+        375, 391, 407, 423, 439, 455, 471, 487,
+        511, 543, 575, 607, 639, 671, 703, 735,
+        767, 799, 831, 863, 895, 927, 959, 991,
+        1039, 1103, 1167, 1231, 1295, 1359, 1423, 1487,
+        1551, 1615, 1679, 1743, 1807, 1871, 1935, 1999,
+        2095, 2223, 2351, 2479, 2607, 2735, 2863, 2991,
+        3119, 3247, 3375, 3503, 3631, 3759, 3887, 4015,
+};
+
+/*
+ * This function is described into Taos TSL2550 Designer's Notebook
+ * pages 2, 3.
+ */
+static int tsl2550_calculate_lux(u8 ch0, u8 ch1)
+{
+        unsigned int lux;
+
+        /* Look up count from channel values */
+        u16 c0 = count_lut[ch0];
+        u16 c1 = count_lut[ch1];
+
+        /*
+         * Calculate ratio.
+         * Note: the "128" is a scaling factor
+         */
+        u8 r = 128;
+
+        /* Avoid division by 0 and count 1 cannot be greater than count 0 */
+        if (c1 <= c0)
+                if (c0) {
+                        r = c1 * 128 / c0;
+
+                        /* Calculate LUX */
+                        lux = ((c0 - c1) * ratio_lut[r]) / 256;
+                } else
+                        lux = 0;
+        else
+                return -EAGAIN;
+
+        /* LUX range check */
+        return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux;
+}
+
+/*
+ * SysFS support
+ */
+
+static ssize_t tsl2550_show_power_state(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(to_i2c_client(dev));
+
+        return sprintf(buf, "%u\n", data->power_state);
+}
+
+static ssize_t tsl2550_store_power_state(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        unsigned long val = simple_strtoul(buf, NULL, 10);
+        int ret;
+
+        if (val < 0 || val > 1)
+                return -EINVAL;
+
+        mutex_lock(&data->update_lock);
+        ret = tsl2550_set_power_state(client, val);
+        mutex_unlock(&data->update_lock);
+
+        if (ret < 0)
+                return ret;
+
+        return count;
+}
+
+static DEVICE_ATTR(power_state, S_IWUSR | S_IRUGO,
+                   tsl2550_show_power_state, tsl2550_store_power_state);
+
+static ssize_t tsl2550_show_operating_mode(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(to_i2c_client(dev));
+
+        return sprintf(buf, "%u\n", data->operating_mode);
+}
+
+static ssize_t tsl2550_store_operating_mode(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        unsigned long val = simple_strtoul(buf, NULL, 10);
+        int ret;
+
+        if (val < 0 || val > 1)
+                return -EINVAL;
+
+        if (data->power_state == 0)
+                return -EBUSY;
+
+        mutex_lock(&data->update_lock);
+        ret = tsl2550_set_operating_mode(client, val);
+        mutex_unlock(&data->update_lock);
+
+        if (ret < 0)
+                return ret;
+
+        return count;
+}
+
+static DEVICE_ATTR(operating_mode, S_IWUSR | S_IRUGO,
+                   tsl2550_show_operating_mode, tsl2550_store_operating_mode);
+
+static ssize_t __tsl2550_show_lux(struct i2c_client *client, char *buf)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        u8 ch0, ch1;
+        int ret;
+
+        ret = tsl2550_get_adc_value(client, TSL2550_READ_ADC0);
+        if (ret < 0)
+                return ret;
+        ch0 = ret;
+
+        ret = tsl2550_get_adc_value(client, TSL2550_READ_ADC1);
+        if (ret < 0)
+                return ret;
+        ch1 = ret;
+
+        /* Do the job */
+        ret = tsl2550_calculate_lux(ch0, ch1);
+        if (ret < 0)
+                return ret;
+        if (data->operating_mode == 1)
+                ret *= 5;
+
+        return sprintf(buf, "%d\n", ret);
+}
+
+static ssize_t tsl2550_show_lux1_input(struct device *dev,
+                        struct device_attribute *attr, char *buf)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        int ret;
+
+        /* No LUX data if not operational */
+        if (!data->power_state)
+                return -EBUSY;
+
+        mutex_lock(&data->update_lock);
+        ret = __tsl2550_show_lux(client, buf);
+        mutex_unlock(&data->update_lock);
+
+        return ret;
+}
+
+static DEVICE_ATTR(lux1_input, S_IRUGO,
+                   tsl2550_show_lux1_input, NULL);
+
+static struct attribute *tsl2550_attributes[] = {
+        &dev_attr_power_state.attr,
+        &dev_attr_operating_mode.attr,
+        &dev_attr_lux1_input.attr,
+        NULL
+};
+
+static const struct attribute_group tsl2550_attr_group = {
+        .attrs = tsl2550_attributes,
+};
+
+/*
+ * Initialization function
+ */
+
+static int tsl2550_init_client(struct i2c_client *client)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        int err;
+
+        /*
+         * Probe the chip. To do so we try to power up the device and then to
+         * read back the 0x03 code
+         */
+        err = i2c_smbus_read_byte_data(client, TSL2550_POWER_UP);
+        if (err < 0)
+                return err;
+        if (err != TSL2550_POWER_UP)
+                return -ENODEV;
+        data->power_state = 1;
+
+        /* Set the default operating mode */
+        err = i2c_smbus_write_byte(client,
+                                   TSL2550_MODE_RANGE[data->operating_mode]);
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
+/*
+ * I2C init/probing/exit functions
+ */
+
+static struct i2c_driver tsl2550_driver;
+static int __devinit tsl2550_probe(struct i2c_client *client,
+                                   const struct i2c_device_id *id)
+{
+        struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
+        struct tsl2550_data *data;
+        int *opmode, err = 0;
+
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_WRITE_BYTE
+                                            | I2C_FUNC_SMBUS_READ_BYTE_DATA)) {
+                err = -EIO;
+                goto exit;
+        }
+
+        data = kzalloc(sizeof(struct tsl2550_data), GFP_KERNEL);
+        if (!data) {
+                err = -ENOMEM;
+                goto exit;
+        }
+        data->client = client;
+        i2c_set_clientdata(client, data);
+
+        /* Check platform data */
+        opmode = client->dev.platform_data;
+        if (opmode) {
+                if (*opmode < 0 || *opmode > 1) {
+                        dev_err(&client->dev, "invalid operating_mode (%d)\n",
+                                        *opmode);
+                        err = -EINVAL;
+                        goto exit_kfree;
+                }
+                data->operating_mode = *opmode;
+        } else
+                data->operating_mode = 0;       /* default mode is standard */
+        dev_info(&client->dev, "%s operating mode\n",
+                        data->operating_mode ? "extended" : "standard");
+
+        mutex_init(&data->update_lock);
+
+        /* Initialize the TSL2550 chip */
+        err = tsl2550_init_client(client);
+        if (err)
+                goto exit_kfree;
+
+        /* Register sysfs hooks */
+        err = sysfs_create_group(&client->dev.kobj, &tsl2550_attr_group);
+        if (err)
+                goto exit_kfree;
+
+        dev_info(&client->dev, "support ver. %s enabled\n", DRIVER_VERSION);
+
+        return 0;
+
+exit_kfree:
+        kfree(data);
+exit:
+        return err;
+}
+
+static int __devexit tsl2550_remove(struct i2c_client *client)
+{
+        sysfs_remove_group(&client->dev.kobj, &tsl2550_attr_group);
+
+        /* Power down the device */
+        tsl2550_set_power_state(client, 0);
+
+        kfree(i2c_get_clientdata(client));
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+
+static int tsl2550_suspend(struct i2c_client *client, pm_message_t mesg)
+{
+        return tsl2550_set_power_state(client, 0);
+}
+
+static int tsl2550_resume(struct i2c_client *client)
+{
+        return tsl2550_set_power_state(client, 1);
+}
+
+#else
+
+#define tsl2550_suspend         NULL
+#define tsl2550_resume          NULL
+
+#endif /* CONFIG_PM */
+
+static const struct i2c_device_id tsl2550_id[] = {
+        { "tsl2550", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, tsl2550_id);
+
+static struct i2c_driver tsl2550_driver = {
+        .driver = {
+                .name   = TSL2550_DRV_NAME,
+                .owner  = THIS_MODULE,
+        },
+        .suspend = tsl2550_suspend,
+        .resume = tsl2550_resume,
+        .probe  = tsl2550_probe,
+        .remove = __devexit_p(tsl2550_remove),
+        .id_table = tsl2550_id,
+};
+
+static int __init tsl2550_init(void)
+{
+        return i2c_add_driver(&tsl2550_driver);
+}
+
+static void __exit tsl2550_exit(void)
+{
+        i2c_del_driver(&tsl2550_driver);
+}
+
+MODULE_AUTHOR("Rodolfo Giometti <giometti@linux.it>");
+MODULE_DESCRIPTION("TSL2550 ambient light sensor driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRIVER_VERSION);
+
+module_init(tsl2550_init);
+module_exit(tsl2550_exit);
diff --git a/drivers/misc/vmware_balloon.c b/drivers/misc/vmware_balloon.c
new file mode 100644
index 000000000000..2a1e804a71aa
--- /dev/null
+++ b/drivers/misc/vmware_balloon.c
@@ -0,0 +1,844 @@
+/*
+ * VMware Balloon driver.
+ *
+ * Copyright (C) 2000-2010, VMware, Inc. All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ * NON INFRINGEMENT.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Maintained by: Dmitry Torokhov <dtor@vmware.com>
+ */
+
+/*
+ * This is VMware physical memory management driver for Linux. The driver
+ * acts like a "balloon" that can be inflated to reclaim physical pages by
+ * reserving them in the guest and invalidating them in the monitor,
+ * freeing up the underlying machine pages so they can be allocated to
+ * other guests.  The balloon can also be deflated to allow the guest to
+ * use more physical memory. Higher level policies can control the sizes
+ * of balloons in VMs in order to manage physical memory resources.
+ */
+
+//#define DEBUG
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/sched.h>
+#include <linux/module.h>
+#include <linux/workqueue.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include <asm/hypervisor.h>
+
+MODULE_AUTHOR("VMware, Inc.");
+MODULE_DESCRIPTION("VMware Memory Control (Balloon) Driver");
+MODULE_VERSION("1.2.1.1-k");
+MODULE_ALIAS("dmi:*:svnVMware*:*");
+MODULE_ALIAS("vmware_vmmemctl");
+MODULE_LICENSE("GPL");
+
+/*
+ * Various constants controlling rate of inflaint/deflating balloon,
+ * measured in pages.
+ */
+
+/*
+ * Rate of allocating memory when there is no memory pressure
+ * (driver performs non-sleeping allocations).
+ */
+#define VMW_BALLOON_NOSLEEP_ALLOC_MAX   16384U
+
+/*
+ * Rates of memory allocaton when guest experiences memory pressure
+ * (driver performs sleeping allocations).
+ */
+#define VMW_BALLOON_RATE_ALLOC_MIN      512U
+#define VMW_BALLOON_RATE_ALLOC_MAX      2048U
+#define VMW_BALLOON_RATE_ALLOC_INC      16U
+
+/*
+ * Rates for releasing pages while deflating balloon.
+ */
+#define VMW_BALLOON_RATE_FREE_MIN       512U
+#define VMW_BALLOON_RATE_FREE_MAX       16384U
+#define VMW_BALLOON_RATE_FREE_INC       16U
+
+/*
+ * When guest is under memory pressure, use a reduced page allocation
+ * rate for next several cycles.
+ */
+#define VMW_BALLOON_SLOW_CYCLES         4
+
+/*
+ * Use __GFP_HIGHMEM to allow pages from HIGHMEM zone. We don't
+ * allow wait (__GFP_WAIT) for NOSLEEP page allocations. Use
+ * __GFP_NOWARN, to suppress page allocation failure warnings.
+ */
+#define VMW_PAGE_ALLOC_NOSLEEP          (__GFP_HIGHMEM|__GFP_NOWARN)
+
+/*
+ * Use GFP_HIGHUSER when executing in a separate kernel thread
+ * context and allocation can sleep.  This is less stressful to
+ * the guest memory system, since it allows the thread to block
+ * while memory is reclaimed, and won't take pages from emergency
+ * low-memory pools.
+ */
+#define VMW_PAGE_ALLOC_CANSLEEP         (GFP_HIGHUSER)
+
+/* Maximum number of page allocations without yielding processor */
+#define VMW_BALLOON_YIELD_THRESHOLD     1024
+
+/* Maximum number of refused pages we accumulate during inflation cycle */
+#define VMW_BALLOON_MAX_REFUSED         16
+
+/*
+ * Hypervisor communication port definitions.
+ */
+#define VMW_BALLOON_HV_PORT             0x5670
+#define VMW_BALLOON_HV_MAGIC            0x456c6d6f
+#define VMW_BALLOON_PROTOCOL_VERSION    2
+#define VMW_BALLOON_GUEST_ID            1       /* Linux */
+
+#define VMW_BALLOON_CMD_START           0
+#define VMW_BALLOON_CMD_GET_TARGET      1
+#define VMW_BALLOON_CMD_LOCK            2
+#define VMW_BALLOON_CMD_UNLOCK          3
+#define VMW_BALLOON_CMD_GUEST_ID        4
+
+/* error codes */
+#define VMW_BALLOON_SUCCESS             0
+#define VMW_BALLOON_FAILURE             -1
+#define VMW_BALLOON_ERROR_CMD_INVALID   1
+#define VMW_BALLOON_ERROR_PPN_INVALID   2
+#define VMW_BALLOON_ERROR_PPN_LOCKED    3
+#define VMW_BALLOON_ERROR_PPN_UNLOCKED  4
+#define VMW_BALLOON_ERROR_PPN_PINNED    5
+#define VMW_BALLOON_ERROR_PPN_NOTNEEDED 6
+#define VMW_BALLOON_ERROR_RESET         7
+#define VMW_BALLOON_ERROR_BUSY          8
+
+#define VMWARE_BALLOON_CMD(cmd, data, result)           \
+({                                                      \
+        unsigned long __stat, __dummy1, __dummy2;       \
+        __asm__ __volatile__ ("inl (%%dx)" :            \
+                "=a"(__stat),                           \
+                "=c"(__dummy1),                         \
+                "=d"(__dummy2),                         \
+                "=b"(result) :                          \
+                "0"(VMW_BALLOON_HV_MAGIC),              \
+                "1"(VMW_BALLOON_CMD_##cmd),             \
+                "2"(VMW_BALLOON_HV_PORT),               \
+                "3"(data) :                             \
+                "memory");                              \
+        result &= -1UL;                                 \
+        __stat & -1UL;                                  \
+})
+
+#ifdef CONFIG_DEBUG_FS
+struct vmballoon_stats {
+        unsigned int timer;
+
+        /* allocation statustics */
+        unsigned int alloc;
+        unsigned int alloc_fail;
+        unsigned int sleep_alloc;
+        unsigned int sleep_alloc_fail;
+        unsigned int refused_alloc;
+        unsigned int refused_free;
+        unsigned int free;
+
+        /* monitor operations */
+        unsigned int lock;
+        unsigned int lock_fail;
+        unsigned int unlock;
+        unsigned int unlock_fail;
+        unsigned int target;
+        unsigned int target_fail;
+        unsigned int start;
+        unsigned int start_fail;
+        unsigned int guest_type;
+        unsigned int guest_type_fail;
+};
+
+#define STATS_INC(stat) (stat)++
+#else
+#define STATS_INC(stat)
+#endif
+
+struct vmballoon {
+
+        /* list of reserved physical pages */
+        struct list_head pages;
+
+        /* transient list of non-balloonable pages */
+        struct list_head refused_pages;
+        unsigned int n_refused_pages;
+
+        /* balloon size in pages */
+        unsigned int size;
+        unsigned int target;
+
+        /* reset flag */
+        bool reset_required;
+
+        /* adjustment rates (pages per second) */
+        unsigned int rate_alloc;
+        unsigned int rate_free;
+
+        /* slowdown page allocations for next few cycles */
+        unsigned int slow_allocation_cycles;
+
+#ifdef CONFIG_DEBUG_FS
+        /* statistics */
+        struct vmballoon_stats stats;
+
+        /* debugfs file exporting statistics */
+        struct dentry *dbg_entry;
+#endif
+
+        struct sysinfo sysinfo;
+
+        struct delayed_work dwork;
+};
+
+static struct vmballoon balloon;
+static struct workqueue_struct *vmballoon_wq;
+
+/*
+ * Send "start" command to the host, communicating supported version
+ * of the protocol.
+ */
+static bool vmballoon_send_start(struct vmballoon *b)
+{
+        unsigned long status, dummy;
+
+        STATS_INC(b->stats.start);
+
+        status = VMWARE_BALLOON_CMD(START, VMW_BALLOON_PROTOCOL_VERSION, dummy);
+        if (status == VMW_BALLOON_SUCCESS)
+                return true;
+
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.start_fail);
+        return false;
+}
+
+static bool vmballoon_check_status(struct vmballoon *b, unsigned long status)
+{
+        switch (status) {
+        case VMW_BALLOON_SUCCESS:
+                return true;
+
+        case VMW_BALLOON_ERROR_RESET:
+                b->reset_required = true;
+                /* fall through */
+
+        default:
+                return false;
+        }
+}
+
+/*
+ * Communicate guest type to the host so that it can adjust ballooning
+ * algorithm to the one most appropriate for the guest. This command
+ * is normally issued after sending "start" command and is part of
+ * standard reset sequence.
+ */
+static bool vmballoon_send_guest_id(struct vmballoon *b)
+{
+        unsigned long status, dummy;
+
+        status = VMWARE_BALLOON_CMD(GUEST_ID, VMW_BALLOON_GUEST_ID, dummy);
+
+        STATS_INC(b->stats.guest_type);
+
+        if (vmballoon_check_status(b, status))
+                return true;
+
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.guest_type_fail);
+        return false;
+}
+
+/*
+ * Retrieve desired balloon size from the host.
+ */
+static bool vmballoon_send_get_target(struct vmballoon *b, u32 *new_target)
+{
+        unsigned long status;
+        unsigned long target;
+        unsigned long limit;
+        u32 limit32;
+
+        /*
+         * si_meminfo() is cheap. Moreover, we want to provide dynamic
+         * max balloon size later. So let us call si_meminfo() every
+         * iteration.
+         */
+        si_meminfo(&b->sysinfo);
+        limit = b->sysinfo.totalram;
+
+        /* Ensure limit fits in 32-bits */
+        limit32 = (u32)limit;
+        if (limit != limit32)
+                return false;
+
+        /* update stats */
+        STATS_INC(b->stats.target);
+
+        status = VMWARE_BALLOON_CMD(GET_TARGET, limit, target);
+        if (vmballoon_check_status(b, status)) {
+                *new_target = target;
+                return true;
+        }
+
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.target_fail);
+        return false;
+}
+
+/*
+ * Notify the host about allocated page so that host can use it without
+ * fear that guest will need it. Host may reject some pages, we need to
+ * check the return value and maybe submit a different page.
+ */
+static bool vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn)
+{
+        unsigned long status, dummy;
+        u32 pfn32;
+
+        pfn32 = (u32)pfn;
+        if (pfn32 != pfn)
+                return false;
+
+        STATS_INC(b->stats.lock);
+
+        status = VMWARE_BALLOON_CMD(LOCK, pfn, dummy);
+        if (vmballoon_check_status(b, status))
+                return true;
+
+        pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
+        STATS_INC(b->stats.lock_fail);
+        return false;
+}
+
+/*
+ * Notify the host that guest intends to release given page back into
+ * the pool of available (to the guest) pages.
+ */
+static bool vmballoon_send_unlock_page(struct vmballoon *b, unsigned long pfn)
+{
+        unsigned long status, dummy;
+        u32 pfn32;
+
+        pfn32 = (u32)pfn;
+        if (pfn32 != pfn)
+                return false;
+
+        STATS_INC(b->stats.unlock);
+
+        status = VMWARE_BALLOON_CMD(UNLOCK, pfn, dummy);
+        if (vmballoon_check_status(b, status))
+                return true;
+
+        pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
+        STATS_INC(b->stats.unlock_fail);
+        return false;
+}
+
+/*
+ * Quickly release all pages allocated for the balloon. This function is
+ * called when host decides to "reset" balloon for one reason or another.
+ * Unlike normal "deflate" we do not (shall not) notify host of the pages
+ * being released.
+ */
+static void vmballoon_pop(struct vmballoon *b)
+{
+        struct page *page, *next;
+        unsigned int count = 0;
+
+        list_for_each_entry_safe(page, next, &b->pages, lru) {
+                list_del(&page->lru);
+                __free_page(page);
+                STATS_INC(b->stats.free);
+                b->size--;
+
+                if (++count >= b->rate_free) {
+                        count = 0;
+                        cond_resched();
+                }
+        }
+}
+
+/*
+ * Perform standard reset sequence by popping the balloon (in case it
+ * is not  empty) and then restarting protocol. This operation normally
+ * happens when host responds with VMW_BALLOON_ERROR_RESET to a command.
+ */
+static void vmballoon_reset(struct vmballoon *b)
+{
+        /* free all pages, skipping monitor unlock */
+        vmballoon_pop(b);
+
+        if (vmballoon_send_start(b)) {
+                b->reset_required = false;
+                if (!vmballoon_send_guest_id(b))
+                        pr_err("failed to send guest ID to the host\n");
+        }
+}
+
+/*
+ * Allocate (or reserve) a page for the balloon and notify the host.  If host
+ * refuses the page put it on "refuse" list and allocate another one until host
+ * is satisfied. "Refused" pages are released at the end of inflation cycle
+ * (when we allocate b->rate_alloc pages).
+ */
+static int vmballoon_reserve_page(struct vmballoon *b, bool can_sleep)
+{
+        struct page *page;
+        gfp_t flags;
+        bool locked = false;
+
+        do {
+                if (!can_sleep)
+                        STATS_INC(b->stats.alloc);
+                else
+                        STATS_INC(b->stats.sleep_alloc);
+
+                flags = can_sleep ? VMW_PAGE_ALLOC_CANSLEEP : VMW_PAGE_ALLOC_NOSLEEP;
+                page = alloc_page(flags);
+                if (!page) {
+                        if (!can_sleep)
+                                STATS_INC(b->stats.alloc_fail);
+                        else
+                                STATS_INC(b->stats.sleep_alloc_fail);
+                        return -ENOMEM;
+                }
+
+                /* inform monitor */
+                locked = vmballoon_send_lock_page(b, page_to_pfn(page));
+                if (!locked) {
+                        STATS_INC(b->stats.refused_alloc);
+
+                        if (b->reset_required) {
+                                __free_page(page);
+                                return -EIO;
+                        }
+
+                        /*
+                         * Place page on the list of non-balloonable pages
+                         * and retry allocation, unless we already accumulated
+                         * too many of them, in which case take a breather.
+                         */
+                        list_add(&page->lru, &b->refused_pages);
+                        if (++b->n_refused_pages >= VMW_BALLOON_MAX_REFUSED)
+                                return -EIO;
+                }
+        } while (!locked);
+
+        /* track allocated page */
+        list_add(&page->lru, &b->pages);
+
+        /* update balloon size */
+        b->size++;
+
+        return 0;
+}
+
+/*
+ * Release the page allocated for the balloon. Note that we first notify
+ * the host so it can make sure the page will be available for the guest
+ * to use, if needed.
+ */
+static int vmballoon_release_page(struct vmballoon *b, struct page *page)
+{
+        if (!vmballoon_send_unlock_page(b, page_to_pfn(page)))
+                return -EIO;
+
+        list_del(&page->lru);
+
+        /* deallocate page */
+        __free_page(page);
+        STATS_INC(b->stats.free);
+
+        /* update balloon size */
+        b->size--;
+
+        return 0;
+}
+
+/*
+ * Release pages that were allocated while attempting to inflate the
+ * balloon but were refused by the host for one reason or another.
+ */
+static void vmballoon_release_refused_pages(struct vmballoon *b)
+{
+        struct page *page, *next;
+
+        list_for_each_entry_safe(page, next, &b->refused_pages, lru) {
+                list_del(&page->lru);
+                __free_page(page);
+                STATS_INC(b->stats.refused_free);
+        }
+
+        b->n_refused_pages = 0;
+}
+
+/*
+ * Inflate the balloon towards its target size. Note that we try to limit
+ * the rate of allocation to make sure we are not choking the rest of the
+ * system.
+ */
+static void vmballoon_inflate(struct vmballoon *b)
+{
+        unsigned int goal;
+        unsigned int rate;
+        unsigned int i;
+        unsigned int allocations = 0;
+        int error = 0;
+        bool alloc_can_sleep = false;
+
+        pr_debug("%s - size: %d, target %d\n", __func__, b->size, b->target);
+
+        /*
+         * First try NOSLEEP page allocations to inflate balloon.
+         *
+         * If we do not throttle nosleep allocations, we can drain all
+         * free pages in the guest quickly (if the balloon target is high).
+         * As a side-effect, draining free pages helps to inform (force)
+         * the guest to start swapping if balloon target is not met yet,
+         * which is a desired behavior. However, balloon driver can consume
+         * all available CPU cycles if too many pages are allocated in a
+         * second. Therefore, we throttle nosleep allocations even when
+         * the guest is not under memory pressure. OTOH, if we have already
+         * predicted that the guest is under memory pressure, then we
+         * slowdown page allocations considerably.
+         */
+
+        goal = b->target - b->size;
+        /*
+         * Start with no sleep allocation rate which may be higher
+         * than sleeping allocation rate.
+         */
+        rate = b->slow_allocation_cycles ?
+                        b->rate_alloc : VMW_BALLOON_NOSLEEP_ALLOC_MAX;
+
+        pr_debug("%s - goal: %d, no-sleep rate: %d, sleep rate: %d\n",
+                 __func__, goal, rate, b->rate_alloc);
+
+        for (i = 0; i < goal; i++) {
+
+                error = vmballoon_reserve_page(b, alloc_can_sleep);
+                if (error) {
+                        if (error != -ENOMEM) {
+                                /*
+                                 * Not a page allocation failure, stop this
+                                 * cycle. Maybe we'll get new target from
+                                 * the host soon.
+                                 */
+                                break;
+                        }
+
+                        if (alloc_can_sleep) {
+                                /*
+                                 * CANSLEEP page allocation failed, so guest
+                                 * is under severe memory pressure. Quickly
+                                 * decrease allocation rate.
+                                 */
+                                b->rate_alloc = max(b->rate_alloc / 2,
+                                                    VMW_BALLOON_RATE_ALLOC_MIN);
+                                break;
+                        }
+
+                        /*
+                         * NOSLEEP page allocation failed, so the guest is
+                         * under memory pressure. Let us slow down page
+                         * allocations for next few cycles so that the guest
+                         * gets out of memory pressure. Also, if we already
+                         * allocated b->rate_alloc pages, let's pause,
+                         * otherwise switch to sleeping allocations.
+                         */
+                        b->slow_allocation_cycles = VMW_BALLOON_SLOW_CYCLES;
+
+                        if (i >= b->rate_alloc)
+                                break;
+
+                        alloc_can_sleep = true;
+                        /* Lower rate for sleeping allocations. */
+                        rate = b->rate_alloc;
+                }
+
+                if (++allocations > VMW_BALLOON_YIELD_THRESHOLD) {
+                        cond_resched();
+                        allocations = 0;
+                }
+
+                if (i >= rate) {
+                        /* We allocated enough pages, let's take a break. */
+                        break;
+                }
+        }
+
+        /*
+         * We reached our goal without failures so try increasing
+         * allocation rate.
+         */
+        if (error == 0 && i >= b->rate_alloc) {
+                unsigned int mult = i / b->rate_alloc;
+
+                b->rate_alloc =
+                        min(b->rate_alloc + mult * VMW_BALLOON_RATE_ALLOC_INC,
+                            VMW_BALLOON_RATE_ALLOC_MAX);
+        }
+
+        vmballoon_release_refused_pages(b);
+}
+
+/*
+ * Decrease the size of the balloon allowing guest to use more memory.
+ */
+static void vmballoon_deflate(struct vmballoon *b)
+{
+        struct page *page, *next;
+        unsigned int i = 0;
+        unsigned int goal;
+        int error;
+
+        pr_debug("%s - size: %d, target %d\n", __func__, b->size, b->target);
+
+        /* limit deallocation rate */
+        goal = min(b->size - b->target, b->rate_free);
+
+        pr_debug("%s - goal: %d, rate: %d\n", __func__, goal, b->rate_free);
+
+        /* free pages to reach target */
+        list_for_each_entry_safe(page, next, &b->pages, lru) {
+                error = vmballoon_release_page(b, page);
+                if (error) {
+                        /* quickly decrease rate in case of error */
+                        b->rate_free = max(b->rate_free / 2,
+                                           VMW_BALLOON_RATE_FREE_MIN);
+                        return;
+                }
+
+                if (++i >= goal)
+                        break;
+        }
+
+        /* slowly increase rate if there were no errors */
+        b->rate_free = min(b->rate_free + VMW_BALLOON_RATE_FREE_INC,
+                           VMW_BALLOON_RATE_FREE_MAX);
+}
+
+/*
+ * Balloon work function: reset protocol, if needed, get the new size and
+ * adjust balloon as needed. Repeat in 1 sec.
+ */
+static void vmballoon_work(struct work_struct *work)
+{
+        struct delayed_work *dwork = to_delayed_work(work);
+        struct vmballoon *b = container_of(dwork, struct vmballoon, dwork);
+        unsigned int target;
+
+        STATS_INC(b->stats.timer);
+
+        if (b->reset_required)
+                vmballoon_reset(b);
+
+        if (b->slow_allocation_cycles > 0)
+                b->slow_allocation_cycles--;
+
+        if (vmballoon_send_get_target(b, &target)) {
+                /* update target, adjust size */
+                b->target = target;
+
+                if (b->size < target)
+                        vmballoon_inflate(b);
+                else if (b->size > target)
+                        vmballoon_deflate(b);
+        }
+
+        queue_delayed_work(vmballoon_wq, dwork, round_jiffies_relative(HZ));
+}
+
+/*
+ * DEBUGFS Interface
+ */
+#ifdef CONFIG_DEBUG_FS
+
+static int vmballoon_debug_show(struct seq_file *f, void *offset)
+{
+        struct vmballoon *b = f->private;
+        struct vmballoon_stats *stats = &b->stats;
+
+        /* format size info */
+        seq_printf(f,
+                   "target:             %8d pages\n"
+                   "current:            %8d pages\n",
+                   b->target, b->size);
+
+        /* format rate info */
+        seq_printf(f,
+                   "rateNoSleepAlloc:   %8d pages/sec\n"
+                   "rateSleepAlloc:     %8d pages/sec\n"
+                   "rateFree:           %8d pages/sec\n",
+                   VMW_BALLOON_NOSLEEP_ALLOC_MAX,
+                   b->rate_alloc, b->rate_free);
+
+        seq_printf(f,
+                   "\n"
+                   "timer:              %8u\n"
+                   "start:              %8u (%4u failed)\n"
+                   "guestType:          %8u (%4u failed)\n"
+                   "lock:               %8u (%4u failed)\n"
+                   "unlock:             %8u (%4u failed)\n"
+                   "target:             %8u (%4u failed)\n"
+                   "primNoSleepAlloc:   %8u (%4u failed)\n"
+                   "primCanSleepAlloc:  %8u (%4u failed)\n"
+                   "primFree:           %8u\n"
+                   "errAlloc:           %8u\n"
+                   "errFree:            %8u\n",
+                   stats->timer,
+                   stats->start, stats->start_fail,
+                   stats->guest_type, stats->guest_type_fail,
+                   stats->lock,  stats->lock_fail,
+                   stats->unlock, stats->unlock_fail,
+                   stats->target, stats->target_fail,
+                   stats->alloc, stats->alloc_fail,
+                   stats->sleep_alloc, stats->sleep_alloc_fail,
+                   stats->free,
+                   stats->refused_alloc, stats->refused_free);
+
+        return 0;
+}
+
+static int vmballoon_debug_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, vmballoon_debug_show, inode->i_private);
+}
+
+static const struct file_operations vmballoon_debug_fops = {
+        .owner          = THIS_MODULE,
+        .open           = vmballoon_debug_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int __init vmballoon_debugfs_init(struct vmballoon *b)
+{
+        int error;
+
+        b->dbg_entry = debugfs_create_file("vmmemctl", S_IRUGO, NULL, b,
+                                           &vmballoon_debug_fops);
+        if (IS_ERR(b->dbg_entry)) {
+                error = PTR_ERR(b->dbg_entry);
+                pr_err("failed to create debugfs entry, error: %d\n", error);
+                return error;
+        }
+
+        return 0;
+}
+
+static void __exit vmballoon_debugfs_exit(struct vmballoon *b)
+{
+        debugfs_remove(b->dbg_entry);
+}
+
+#else
+
+static inline int vmballoon_debugfs_init(struct vmballoon *b)
+{
+        return 0;
+}
+
+static inline void vmballoon_debugfs_exit(struct vmballoon *b)
+{
+}
+
+#endif  /* CONFIG_DEBUG_FS */
+
+static int __init vmballoon_init(void)
+{
+        int error;
+
+        /*
+         * Check if we are running on VMware's hypervisor and bail out
+         * if we are not.
+         */
+        if (x86_hyper != &x86_hyper_vmware)
+                return -ENODEV;
+
+        vmballoon_wq = create_freezeable_workqueue("vmmemctl");
+        if (!vmballoon_wq) {
+                pr_err("failed to create workqueue\n");
+                return -ENOMEM;
+        }
+
+        INIT_LIST_HEAD(&balloon.pages);
+        INIT_LIST_HEAD(&balloon.refused_pages);
+
+        /* initialize rates */
+        balloon.rate_alloc = VMW_BALLOON_RATE_ALLOC_MAX;
+        balloon.rate_free = VMW_BALLOON_RATE_FREE_MAX;
+
+        INIT_DELAYED_WORK(&balloon.dwork, vmballoon_work);
+
+        /*
+         * Start balloon.
+         */
+        if (!vmballoon_send_start(&balloon)) {
+                pr_err("failed to send start command to the host\n");
+                error = -EIO;
+                goto fail;
+        }
+
+        if (!vmballoon_send_guest_id(&balloon)) {
+                pr_err("failed to send guest ID to the host\n");
+                error = -EIO;
+                goto fail;
+        }
+
+        error = vmballoon_debugfs_init(&balloon);
+        if (error)
+                goto fail;
+
+        queue_delayed_work(vmballoon_wq, &balloon.dwork, 0);
+
+        return 0;
+
+fail:
+        destroy_workqueue(vmballoon_wq);
+        return error;
+}
+module_init(vmballoon_init);
+
+static void __exit vmballoon_exit(void)
+{
+        cancel_delayed_work_sync(&balloon.dwork);
+        destroy_workqueue(vmballoon_wq);
+
+        vmballoon_debugfs_exit(&balloon);
+
+        /*
+         * Deallocate all reserved memory, and reset connection with monitor.
+         * Reset connection before deallocating memory to avoid potential for
+         * additional spurious resets from guest touching deallocated pages.
+         */
+        vmballoon_send_start(&balloon);
+        vmballoon_pop(&balloon);
+}
+module_exit(vmballoon_exit);