Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: (151 commits)
  powerpc: Fix usage of 64-bit instruction in 32-bit altivec code
  MAINTAINERS: Add PowerPC patterns
  powerpc/pseries: Track previous CPPR values to correctly EOI interrupts
  powerpc/pseries: Correct pseries/dlpar.c build break without CONFIG_SMP
  powerpc: Make "intspec" pointers in irq_host->xlate() const
  powerpc/8xx: DTLB Miss cleanup
  powerpc/8xx: Remove DIRTY pte handling in DTLB Error.
  powerpc/8xx: Start using dcbX instructions in various copy routines
  powerpc/8xx: Restore _PAGE_WRITETHRU
  powerpc/8xx: Add missing Guarded setting in DTLB Error.
  powerpc/8xx: Fixup DAR from buggy dcbX instructions.
  powerpc/8xx: Tag DAR with 0x00f0 to catch buggy instructions.
  powerpc/8xx: Update TLB asm so it behaves as linux mm expects.
  powerpc/8xx: Invalidate non present TLBs
  powerpc/pseries: Serialize cpu hotplug operations during deactivate Vs deallocate
  pseries/pseries: Add code to online/offline CPUs of a DLPAR node
  powerpc: stop_this_cpu: remove the cpu from the online map.
  powerpc/pseries: Add kernel based CPU DLPAR handling
  sysfs/cpu: Add probe/release files
  powerpc/pseries: Kernel DLPAR Infrastructure
  ...

6 files changed, 1085 insertions, 93 deletions

diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 4b6f7cba3b3d..28fce65b8594 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -133,6 +133,14 @@ config SPI_LM70_LLP
           which interfaces to an LM70 temperature sensor using
           a parallel port.
 
+config SPI_MPC52xx
+        tristate "Freescale MPC52xx SPI (non-PSC) controller support"
+        depends on PPC_MPC52xx && SPI
+        select SPI_MASTER_OF
+        help
+          This drivers supports the MPC52xx SPI controller in master SPI
+          mode.
+
 config SPI_MPC52xx_PSC
         tristate "Freescale MPC52xx PSC SPI controller"
         depends on PPC_MPC52xx && EXPERIMENTAL
@@ -147,9 +155,6 @@ config SPI_MPC8xxx
           This enables using the Freescale MPC8xxx SPI controllers in master
           mode.
 
-          This driver uses a simple set of shift registers for data (opposed
-          to the CPM based descriptor model).
-
 config SPI_OMAP_UWIRE
         tristate "OMAP1 MicroWire"
         depends on ARCH_OMAP1
diff --git a/drivers/spi/Makefile b/drivers/spi/Makefile
index 21a118269cac..e3f092a9afa5 100644
--- a/drivers/spi/Makefile
+++ b/drivers/spi/Makefile
@@ -25,6 +25,7 @@ obj-$(CONFIG_SPI_OMAP24XX)		+= omap2_mcspi.o
 obj-$(CONFIG_SPI_ORION)                 += orion_spi.o
 obj-$(CONFIG_SPI_PL022)                 += amba-pl022.o
 obj-$(CONFIG_SPI_MPC52xx_PSC)           += mpc52xx_psc_spi.o
+obj-$(CONFIG_SPI_MPC52xx)               += mpc52xx_spi.o
 obj-$(CONFIG_SPI_MPC8xxx)               += spi_mpc8xxx.o
 obj-$(CONFIG_SPI_PPC4xx)                += spi_ppc4xx.o
 obj-$(CONFIG_SPI_S3C24XX_GPIO)          += spi_s3c24xx_gpio.o
diff --git a/drivers/spi/mpc52xx_psc_spi.c b/drivers/spi/mpc52xx_psc_spi.c
index 1b74d5ca03f3..f50c81df336a 100644
--- a/drivers/spi/mpc52xx_psc_spi.c
+++ b/drivers/spi/mpc52xx_psc_spi.c
@@ -17,6 +17,7 @@
 #include <linux/errno.h>
 #include <linux/interrupt.h>
 #include <linux/of_platform.h>
+#include <linux/of_spi.h>
 #include <linux/workqueue.h>
 #include <linux/completion.h>
 #include <linux/io.h>
@@ -313,11 +314,13 @@ static int mpc52xx_psc_spi_port_config(int psc_id, struct mpc52xx_psc_spi *mps)
         struct mpc52xx_psc __iomem *psc = mps->psc;
         struct mpc52xx_psc_fifo __iomem *fifo = mps->fifo;
         u32 mclken_div;
-        int ret = 0;
+        int ret;
 
         /* default sysclk is 512MHz */
         mclken_div = (mps->sysclk ? mps->sysclk : 512000000) / MCLK;
-        mpc52xx_set_psc_clkdiv(psc_id, mclken_div);
+        ret = mpc52xx_set_psc_clkdiv(psc_id, mclken_div);
+        if (ret)
+                return ret;
 
         /* Reset the PSC into a known state */
         out_8(&psc->command, MPC52xx_PSC_RST_RX);
@@ -341,7 +344,7 @@ static int mpc52xx_psc_spi_port_config(int psc_id, struct mpc52xx_psc_spi *mps)
 
         mps->bits_per_word = 8;
 
-        return ret;
+        return 0;
 }
 
 static irqreturn_t mpc52xx_psc_spi_isr(int irq, void *dev_id)
@@ -410,8 +413,10 @@ static int __init mpc52xx_psc_spi_do_probe(struct device *dev, u32 regaddr,
                 goto free_master;
 
         ret = mpc52xx_psc_spi_port_config(master->bus_num, mps);
-        if (ret < 0)
+        if (ret < 0) {
+                dev_err(dev, "can't configure PSC! Is it capable of SPI?\n");
                 goto free_irq;
+        }
 
         spin_lock_init(&mps->lock);
         init_completion(&mps->done);
@@ -464,10 +469,11 @@ static int __init mpc52xx_psc_spi_of_probe(struct of_device *op,
         const u32 *regaddr_p;
         u64 regaddr64, size64;
         s16 id = -1;
+        int rc;
 
         regaddr_p = of_get_address(op->node, 0, &size64, NULL);
         if (!regaddr_p) {
-                printk(KERN_ERR "Invalid PSC address\n");
+                dev_err(&op->dev, "Invalid PSC address\n");
                 return -EINVAL;
         }
         regaddr64 = of_translate_address(op->node, regaddr_p);
@@ -478,15 +484,18 @@ static int __init mpc52xx_psc_spi_of_probe(struct of_device *op,
 
                 psc_nump = of_get_property(op->node, "cell-index", NULL);
                 if (!psc_nump || *psc_nump > 5) {
-                        printk(KERN_ERR "mpc52xx_psc_spi: Device node %s has invalid "
-                                        "cell-index property\n", op->node->full_name);
+                        dev_err(&op->dev, "Invalid cell-index property\n");
                         return -EINVAL;
                 }
                 id = *psc_nump + 1;
         }
 
-        return mpc52xx_psc_spi_do_probe(&op->dev, (u32)regaddr64, (u32)size64,
+        rc = mpc52xx_psc_spi_do_probe(&op->dev, (u32)regaddr64, (u32)size64,
                                         irq_of_parse_and_map(op->node, 0), id);
+        if (rc == 0)
+                of_register_spi_devices(dev_get_drvdata(&op->dev), op->node);
+
+        return rc;
 }
 
 static int __exit mpc52xx_psc_spi_of_remove(struct of_device *op)
diff --git a/drivers/spi/mpc52xx_spi.c b/drivers/spi/mpc52xx_spi.c
new file mode 100644
index 000000000000..ef8379b2c172
--- /dev/null
+++ b/drivers/spi/mpc52xx_spi.c
@@ -0,0 +1,520 @@
+/*
+ * MPC52xx SPI bus driver.
+ *
+ * Copyright (C) 2008 Secret Lab Technologies Ltd.
+ *
+ * This file is released under the GPLv2
+ *
+ * This is the driver for the MPC5200's dedicated SPI controller.
+ *
+ * Note: this driver does not support the MPC5200 PSC in SPI mode.  For
+ * that driver see drivers/spi/mpc52xx_psc_spi.c
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/of_platform.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+#include <linux/spi/spi.h>
+#include <linux/spi/mpc52xx_spi.h>
+#include <linux/of_spi.h>
+#include <linux/io.h>
+#include <asm/time.h>
+#include <asm/mpc52xx.h>
+
+MODULE_AUTHOR("Grant Likely <grant.likely@secretlab.ca>");
+MODULE_DESCRIPTION("MPC52xx SPI (non-PSC) Driver");
+MODULE_LICENSE("GPL");
+
+/* Register offsets */
+#define SPI_CTRL1       0x00
+#define SPI_CTRL1_SPIE          (1 << 7)
+#define SPI_CTRL1_SPE           (1 << 6)
+#define SPI_CTRL1_MSTR          (1 << 4)
+#define SPI_CTRL1_CPOL          (1 << 3)
+#define SPI_CTRL1_CPHA          (1 << 2)
+#define SPI_CTRL1_SSOE          (1 << 1)
+#define SPI_CTRL1_LSBFE         (1 << 0)
+
+#define SPI_CTRL2       0x01
+#define SPI_BRR         0x04
+
+#define SPI_STATUS      0x05
+#define SPI_STATUS_SPIF         (1 << 7)
+#define SPI_STATUS_WCOL         (1 << 6)
+#define SPI_STATUS_MODF         (1 << 4)
+
+#define SPI_DATA        0x09
+#define SPI_PORTDATA    0x0d
+#define SPI_DATADIR     0x10
+
+/* FSM state return values */
+#define FSM_STOP        0       /* Nothing more for the state machine to */
+                                /* do.  If something interesting happens */
+                                /* then and IRQ will be received */
+#define FSM_POLL        1       /* need to poll for completion, an IRQ is */
+                                /* not expected */
+#define FSM_CONTINUE    2       /* Keep iterating the state machine */
+
+/* Driver internal data */
+struct mpc52xx_spi {
+        struct spi_master *master;
+        u32 sysclk;
+        void __iomem *regs;
+        int irq0;       /* MODF irq */
+        int irq1;       /* SPIF irq */
+        int ipb_freq;
+
+        /* Statistics */
+        int msg_count;
+        int wcol_count;
+        int wcol_ticks;
+        u32 wcol_tx_timestamp;
+        int modf_count;
+        int byte_count;
+
+        struct list_head queue;         /* queue of pending messages */
+        spinlock_t lock;
+        struct work_struct work;
+
+
+        /* Details of current transfer (length, and buffer pointers) */
+        struct spi_message *message;    /* current message */
+        struct spi_transfer *transfer;  /* current transfer */
+        int (*state)(int irq, struct mpc52xx_spi *ms, u8 status, u8 data);
+        int len;
+        int timestamp;
+        u8 *rx_buf;
+        const u8 *tx_buf;
+        int cs_change;
+};
+
+/*
+ * CS control function
+ */
+static void mpc52xx_spi_chipsel(struct mpc52xx_spi *ms, int value)
+{
+        out_8(ms->regs + SPI_PORTDATA, value ? 0 : 0x08);
+}
+
+/*
+ * Start a new transfer.  This is called both by the idle state
+ * for the first transfer in a message, and by the wait state when the
+ * previous transfer in a message is complete.
+ */
+static void mpc52xx_spi_start_transfer(struct mpc52xx_spi *ms)
+{
+        ms->rx_buf = ms->transfer->rx_buf;
+        ms->tx_buf = ms->transfer->tx_buf;
+        ms->len = ms->transfer->len;
+
+        /* Activate the chip select */
+        if (ms->cs_change)
+                mpc52xx_spi_chipsel(ms, 1);
+        ms->cs_change = ms->transfer->cs_change;
+
+        /* Write out the first byte */
+        ms->wcol_tx_timestamp = get_tbl();
+        if (ms->tx_buf)
+                out_8(ms->regs + SPI_DATA, *ms->tx_buf++);
+        else
+                out_8(ms->regs + SPI_DATA, 0);
+}
+
+/* Forward declaration of state handlers */
+static int mpc52xx_spi_fsmstate_transfer(int irq, struct mpc52xx_spi *ms,
+                                         u8 status, u8 data);
+static int mpc52xx_spi_fsmstate_wait(int irq, struct mpc52xx_spi *ms,
+                                     u8 status, u8 data);
+
+/*
+ * IDLE state
+ *
+ * No transfers are in progress; if another transfer is pending then retrieve
+ * it and kick it off.  Otherwise, stop processing the state machine
+ */
+static int
+mpc52xx_spi_fsmstate_idle(int irq, struct mpc52xx_spi *ms, u8 status, u8 data)
+{
+        struct spi_device *spi;
+        int spr, sppr;
+        u8 ctrl1;
+
+        if (status && (irq != NO_IRQ))
+                dev_err(&ms->master->dev, "spurious irq, status=0x%.2x\n",
+                        status);
+
+        /* Check if there is another transfer waiting. */
+        if (list_empty(&ms->queue))
+                return FSM_STOP;
+
+        /* get the head of the queue */
+        ms->message = list_first_entry(&ms->queue, struct spi_message, queue);
+        list_del_init(&ms->message->queue);
+
+        /* Setup the controller parameters */
+        ctrl1 = SPI_CTRL1_SPIE | SPI_CTRL1_SPE | SPI_CTRL1_MSTR;
+        spi = ms->message->spi;
+        if (spi->mode & SPI_CPHA)
+                ctrl1 |= SPI_CTRL1_CPHA;
+        if (spi->mode & SPI_CPOL)
+                ctrl1 |= SPI_CTRL1_CPOL;
+        if (spi->mode & SPI_LSB_FIRST)
+                ctrl1 |= SPI_CTRL1_LSBFE;
+        out_8(ms->regs + SPI_CTRL1, ctrl1);
+
+        /* Setup the controller speed */
+        /* minimum divider is '2'.  Also, add '1' to force rounding the
+         * divider up. */
+        sppr = ((ms->ipb_freq / ms->message->spi->max_speed_hz) + 1) >> 1;
+        spr = 0;
+        if (sppr < 1)
+                sppr = 1;
+        while (((sppr - 1) & ~0x7) != 0) {
+                sppr = (sppr + 1) >> 1; /* add '1' to force rounding up */
+                spr++;
+        }
+        sppr--;         /* sppr quantity in register is offset by 1 */
+        if (spr > 7) {
+                /* Don't overrun limits of SPI baudrate register */
+                spr = 7;
+                sppr = 7;
+        }
+        out_8(ms->regs + SPI_BRR, sppr << 4 | spr); /* Set speed */
+
+        ms->cs_change = 1;
+        ms->transfer = container_of(ms->message->transfers.next,
+                                    struct spi_transfer, transfer_list);
+
+        mpc52xx_spi_start_transfer(ms);
+        ms->state = mpc52xx_spi_fsmstate_transfer;
+
+        return FSM_CONTINUE;
+}
+
+/*
+ * TRANSFER state
+ *
+ * In the middle of a transfer.  If the SPI core has completed processing
+ * a byte, then read out the received data and write out the next byte
+ * (unless this transfer is finished; in which case go on to the wait
+ * state)
+ */
+static int mpc52xx_spi_fsmstate_transfer(int irq, struct mpc52xx_spi *ms,
+                                         u8 status, u8 data)
+{
+        if (!status)
+                return ms->irq0 ? FSM_STOP : FSM_POLL;
+
+        if (status & SPI_STATUS_WCOL) {
+                /* The SPI controller is stoopid.  At slower speeds, it may
+                 * raise the SPIF flag before the state machine is actually
+                 * finished, which causes a collision (internal to the state
+                 * machine only).  The manual recommends inserting a delay
+                 * between receiving the interrupt and sending the next byte,
+                 * but it can also be worked around simply by retrying the
+                 * transfer which is what we do here. */
+                ms->wcol_count++;
+                ms->wcol_ticks += get_tbl() - ms->wcol_tx_timestamp;
+                ms->wcol_tx_timestamp = get_tbl();
+                data = 0;
+                if (ms->tx_buf)
+                        data = *(ms->tx_buf-1);
+                out_8(ms->regs + SPI_DATA, data); /* try again */
+                return FSM_CONTINUE;
+        } else if (status & SPI_STATUS_MODF) {
+                ms->modf_count++;
+                dev_err(&ms->master->dev, "mode fault\n");
+                mpc52xx_spi_chipsel(ms, 0);
+                ms->message->status = -EIO;
+                ms->message->complete(ms->message->context);
+                ms->state = mpc52xx_spi_fsmstate_idle;
+                return FSM_CONTINUE;
+        }
+
+        /* Read data out of the spi device */
+        ms->byte_count++;
+        if (ms->rx_buf)
+                *ms->rx_buf++ = data;
+
+        /* Is the transfer complete? */
+        ms->len--;
+        if (ms->len == 0) {
+                ms->timestamp = get_tbl();
+                ms->timestamp += ms->transfer->delay_usecs * tb_ticks_per_usec;
+                ms->state = mpc52xx_spi_fsmstate_wait;
+                return FSM_CONTINUE;
+        }
+
+        /* Write out the next byte */
+        ms->wcol_tx_timestamp = get_tbl();
+        if (ms->tx_buf)
+                out_8(ms->regs + SPI_DATA, *ms->tx_buf++);
+        else
+                out_8(ms->regs + SPI_DATA, 0);
+
+        return FSM_CONTINUE;
+}
+
+/*
+ * WAIT state
+ *
+ * A transfer has completed; need to wait for the delay period to complete
+ * before starting the next transfer
+ */
+static int
+mpc52xx_spi_fsmstate_wait(int irq, struct mpc52xx_spi *ms, u8 status, u8 data)
+{
+        if (status && irq)
+                dev_err(&ms->master->dev, "spurious irq, status=0x%.2x\n",
+                        status);
+
+        if (((int)get_tbl()) - ms->timestamp < 0)
+                return FSM_POLL;
+
+        ms->message->actual_length += ms->transfer->len;
+
+        /* Check if there is another transfer in this message.  If there
+         * aren't then deactivate CS, notify sender, and drop back to idle
+         * to start the next message. */
+        if (ms->transfer->transfer_list.next == &ms->message->transfers) {
+                ms->msg_count++;
+                mpc52xx_spi_chipsel(ms, 0);
+                ms->message->status = 0;
+                ms->message->complete(ms->message->context);
+                ms->state = mpc52xx_spi_fsmstate_idle;
+                return FSM_CONTINUE;
+        }
+
+        /* There is another transfer; kick it off */
+
+        if (ms->cs_change)
+                mpc52xx_spi_chipsel(ms, 0);
+
+        ms->transfer = container_of(ms->transfer->transfer_list.next,
+                                    struct spi_transfer, transfer_list);
+        mpc52xx_spi_start_transfer(ms);
+        ms->state = mpc52xx_spi_fsmstate_transfer;
+        return FSM_CONTINUE;
+}
+
+/**
+ * mpc52xx_spi_fsm_process - Finite State Machine iteration function
+ * @irq: irq number that triggered the FSM or 0 for polling
+ * @ms: pointer to mpc52xx_spi driver data
+ */
+static void mpc52xx_spi_fsm_process(int irq, struct mpc52xx_spi *ms)
+{
+        int rc = FSM_CONTINUE;
+        u8 status, data;
+
+        while (rc == FSM_CONTINUE) {
+                /* Interrupt cleared by read of STATUS followed by
+                 * read of DATA registers */
+                status = in_8(ms->regs + SPI_STATUS);
+                data = in_8(ms->regs + SPI_DATA);
+                rc = ms->state(irq, ms, status, data);
+        }
+
+        if (rc == FSM_POLL)
+                schedule_work(&ms->work);
+}
+
+/**
+ * mpc52xx_spi_irq - IRQ handler
+ */
+static irqreturn_t mpc52xx_spi_irq(int irq, void *_ms)
+{
+        struct mpc52xx_spi *ms = _ms;
+        spin_lock(&ms->lock);
+        mpc52xx_spi_fsm_process(irq, ms);
+        spin_unlock(&ms->lock);
+        return IRQ_HANDLED;
+}
+
+/**
+ * mpc52xx_spi_wq - Workqueue function for polling the state machine
+ */
+static void mpc52xx_spi_wq(struct work_struct *work)
+{
+        struct mpc52xx_spi *ms = container_of(work, struct mpc52xx_spi, work);
+        unsigned long flags;
+
+        spin_lock_irqsave(&ms->lock, flags);
+        mpc52xx_spi_fsm_process(0, ms);
+        spin_unlock_irqrestore(&ms->lock, flags);
+}
+
+/*
+ * spi_master ops
+ */
+
+static int mpc52xx_spi_setup(struct spi_device *spi)
+{
+        if (spi->bits_per_word % 8)
+                return -EINVAL;
+
+        if (spi->mode & ~(SPI_CPOL | SPI_CPHA | SPI_LSB_FIRST))
+                return -EINVAL;
+
+        if (spi->chip_select >= spi->master->num_chipselect)
+                return -EINVAL;
+
+        return 0;
+}
+
+static int mpc52xx_spi_transfer(struct spi_device *spi, struct spi_message *m)
+{
+        struct mpc52xx_spi *ms = spi_master_get_devdata(spi->master);
+        unsigned long flags;
+
+        m->actual_length = 0;
+        m->status = -EINPROGRESS;
+
+        spin_lock_irqsave(&ms->lock, flags);
+        list_add_tail(&m->queue, &ms->queue);
+        spin_unlock_irqrestore(&ms->lock, flags);
+        schedule_work(&ms->work);
+
+        return 0;
+}
+
+/*
+ * OF Platform Bus Binding
+ */
+static int __devinit mpc52xx_spi_probe(struct of_device *op,
+                                       const struct of_device_id *match)
+{
+        struct spi_master *master;
+        struct mpc52xx_spi *ms;
+        void __iomem *regs;
+        int rc;
+
+        /* MMIO registers */
+        dev_dbg(&op->dev, "probing mpc5200 SPI device\n");
+        regs = of_iomap(op->node, 0);
+        if (!regs)
+                return -ENODEV;
+
+        /* initialize the device */
+        out_8(regs+SPI_CTRL1, SPI_CTRL1_SPIE | SPI_CTRL1_SPE | SPI_CTRL1_MSTR);
+        out_8(regs + SPI_CTRL2, 0x0);
+        out_8(regs + SPI_DATADIR, 0xe); /* Set output pins */
+        out_8(regs + SPI_PORTDATA, 0x8);        /* Deassert /SS signal */
+
+        /* Clear the status register and re-read it to check for a MODF
+         * failure.  This driver cannot currently handle multiple masters
+         * on the SPI bus.  This fault will also occur if the SPI signals
+         * are not connected to any pins (port_config setting) */
+        in_8(regs + SPI_STATUS);
+        in_8(regs + SPI_DATA);
+        if (in_8(regs + SPI_STATUS) & SPI_STATUS_MODF) {
+                dev_err(&op->dev, "mode fault; is port_config correct?\n");
+                rc = -EIO;
+                goto err_init;
+        }
+
+        dev_dbg(&op->dev, "allocating spi_master struct\n");
+        master = spi_alloc_master(&op->dev, sizeof *ms);
+        if (!master) {
+                rc = -ENOMEM;
+                goto err_alloc;
+        }
+        master->bus_num = -1;
+        master->num_chipselect = 1;
+        master->setup = mpc52xx_spi_setup;
+        master->transfer = mpc52xx_spi_transfer;
+        dev_set_drvdata(&op->dev, master);
+
+        ms = spi_master_get_devdata(master);
+        ms->master = master;
+        ms->regs = regs;
+        ms->irq0 = irq_of_parse_and_map(op->node, 0);
+        ms->irq1 = irq_of_parse_and_map(op->node, 1);
+        ms->state = mpc52xx_spi_fsmstate_idle;
+        ms->ipb_freq = mpc5xxx_get_bus_frequency(op->node);
+        spin_lock_init(&ms->lock);
+        INIT_LIST_HEAD(&ms->queue);
+        INIT_WORK(&ms->work, mpc52xx_spi_wq);
+
+        /* Decide if interrupts can be used */
+        if (ms->irq0 && ms->irq1) {
+                rc = request_irq(ms->irq0, mpc52xx_spi_irq, IRQF_SAMPLE_RANDOM,
+                                  "mpc5200-spi-modf", ms);
+                rc |= request_irq(ms->irq1, mpc52xx_spi_irq, IRQF_SAMPLE_RANDOM,
+                                  "mpc5200-spi-spiF", ms);
+                if (rc) {
+                        free_irq(ms->irq0, ms);
+                        free_irq(ms->irq1, ms);
+                        ms->irq0 = ms->irq1 = 0;
+                }
+        } else {
+                /* operate in polled mode */
+                ms->irq0 = ms->irq1 = 0;
+        }
+
+        if (!ms->irq0)
+                dev_info(&op->dev, "using polled mode\n");
+
+        dev_dbg(&op->dev, "registering spi_master struct\n");
+        rc = spi_register_master(master);
+        if (rc)
+                goto err_register;
+
+        of_register_spi_devices(master, op->node);
+        dev_info(&ms->master->dev, "registered MPC5200 SPI bus\n");
+
+        return rc;
+
+ err_register:
+        dev_err(&ms->master->dev, "initialization failed\n");
+        spi_master_put(master);
+ err_alloc:
+ err_init:
+        iounmap(regs);
+        return rc;
+}
+
+static int __devexit mpc52xx_spi_remove(struct of_device *op)
+{
+        struct spi_master *master = dev_get_drvdata(&op->dev);
+        struct mpc52xx_spi *ms = spi_master_get_devdata(master);
+
+        free_irq(ms->irq0, ms);
+        free_irq(ms->irq1, ms);
+
+        spi_unregister_master(master);
+        spi_master_put(master);
+        iounmap(ms->regs);
+
+        return 0;
+}
+
+static struct of_device_id mpc52xx_spi_match[] __devinitdata = {
+        { .compatible = "fsl,mpc5200-spi", },
+        {}
+};
+MODULE_DEVICE_TABLE(of, mpc52xx_spi_match);
+
+static struct of_platform_driver mpc52xx_spi_of_driver = {
+        .owner = THIS_MODULE,
+        .name = "mpc52xx-spi",
+        .match_table = mpc52xx_spi_match,
+        .probe = mpc52xx_spi_probe,
+        .remove = __exit_p(mpc52xx_spi_remove),
+};
+
+static int __init mpc52xx_spi_init(void)
+{
+        return of_register_platform_driver(&mpc52xx_spi_of_driver);
+}
+module_init(mpc52xx_spi_init);
+
+static void __exit mpc52xx_spi_exit(void)
+{
+        of_unregister_platform_driver(&mpc52xx_spi_of_driver);
+}
+module_exit(mpc52xx_spi_exit);
+
diff --git a/drivers/spi/spi_mpc8xxx.c b/drivers/spi/spi_mpc8xxx.c
index 0fd0ec4d3a7d..930135dc73ba 100644
--- a/drivers/spi/spi_mpc8xxx.c
+++ b/drivers/spi/spi_mpc8xxx.c
@@ -5,6 +5,10 @@
  *
  * Copyright (C) 2006 Polycom, Inc.
  *
+ * CPM SPI and QE buffer descriptors mode support:
+ * Copyright (c) 2009  MontaVista Software, Inc.
+ * Author: Anton Vorontsov <avorontsov@ru.mvista.com>
+ *
  * This program is free software; you can redistribute  it and/or modify it
  * under  the terms of  the GNU General  Public License as published by the
  * Free Software Foundation;  either version 2 of the  License, or (at your
@@ -27,6 +31,9 @@
 #include <linux/spi/spi_bitbang.h>
 #include <linux/platform_device.h>
 #include <linux/fsl_devices.h>
+#include <linux/dma-mapping.h>
+#include <linux/mm.h>
+#include <linux/mutex.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
 #include <linux/gpio.h>
@@ -34,8 +41,19 @@
 #include <linux/of_spi.h>
 
 #include <sysdev/fsl_soc.h>
+#include <asm/cpm.h>
+#include <asm/qe.h>
 #include <asm/irq.h>
 
+/* CPM1 and CPM2 are mutually exclusive. */
+#ifdef CONFIG_CPM1
+#include <asm/cpm1.h>
+#define CPM_SPI_CMD mk_cr_cmd(CPM_CR_CH_SPI, 0)
+#else
+#include <asm/cpm2.h>
+#define CPM_SPI_CMD mk_cr_cmd(CPM_CR_SPI_PAGE, CPM_CR_SPI_SBLOCK, 0, 0)
+#endif
+
 /* SPI Controller registers */
 struct mpc8xxx_spi_reg {
         u8 res1[0x20];
@@ -47,6 +65,28 @@ struct mpc8xxx_spi_reg {
         __be32 receive;
 };
 
+/* SPI Parameter RAM */
+struct spi_pram {
+        __be16  rbase;  /* Rx Buffer descriptor base address */
+        __be16  tbase;  /* Tx Buffer descriptor base address */
+        u8      rfcr;   /* Rx function code */
+        u8      tfcr;   /* Tx function code */
+        __be16  mrblr;  /* Max receive buffer length */
+        __be32  rstate; /* Internal */
+        __be32  rdp;    /* Internal */
+        __be16  rbptr;  /* Internal */
+        __be16  rbc;    /* Internal */
+        __be32  rxtmp;  /* Internal */
+        __be32  tstate; /* Internal */
+        __be32  tdp;    /* Internal */
+        __be16  tbptr;  /* Internal */
+        __be16  tbc;    /* Internal */
+        __be32  txtmp;  /* Internal */
+        __be32  res;    /* Tx temp. */
+        __be16  rpbase; /* Relocation pointer (CPM1 only) */
+        __be16  res1;   /* Reserved */
+};
+
 /* SPI Controller mode register definitions */
 #define SPMODE_LOOP             (1 << 30)
 #define SPMODE_CI_INACTIVEHIGH  (1 << 29)
@@ -75,14 +115,40 @@ struct mpc8xxx_spi_reg {
 #define SPIM_NE         0x00000200      /* Not empty */
 #define SPIM_NF         0x00000100      /* Not full */
 
+#define SPIE_TXB        0x00000200      /* Last char is written to tx fifo */
+#define SPIE_RXB        0x00000100      /* Last char is written to rx buf */
+
+/* SPCOM register values */
+#define SPCOM_STR       (1 << 23)       /* Start transmit */
+
+#define SPI_PRAM_SIZE   0x100
+#define SPI_MRBLR       ((unsigned int)PAGE_SIZE)
+
 /* SPI Controller driver's private data. */
 struct mpc8xxx_spi {
+        struct device *dev;
         struct mpc8xxx_spi_reg __iomem *base;
 
         /* rx & tx bufs from the spi_transfer */
         const void *tx;
         void *rx;
 
+        int subblock;
+        struct spi_pram __iomem *pram;
+        struct cpm_buf_desc __iomem *tx_bd;
+        struct cpm_buf_desc __iomem *rx_bd;
+
+        struct spi_transfer *xfer_in_progress;
+
+        /* dma addresses for CPM transfers */
+        dma_addr_t tx_dma;
+        dma_addr_t rx_dma;
+        bool map_tx_dma;
+        bool map_rx_dma;
+
+        dma_addr_t dma_dummy_tx;
+        dma_addr_t dma_dummy_rx;
+
         /* functions to deal with different sized buffers */
         void (*get_rx) (u32 rx_data, struct mpc8xxx_spi *);
         u32(*get_tx) (struct mpc8xxx_spi *);
@@ -96,7 +162,7 @@ struct mpc8xxx_spi {
         u32 rx_shift;           /* RX data reg shift when in qe mode */
         u32 tx_shift;           /* TX data reg shift when in qe mode */
 
-        bool qe_mode;
+        unsigned int flags;
 
         struct workqueue_struct *workqueue;
         struct work_struct work;
@@ -107,6 +173,10 @@ struct mpc8xxx_spi {
         struct completion done;
 };
 
+static void *mpc8xxx_dummy_rx;
+static DEFINE_MUTEX(mpc8xxx_dummy_rx_lock);
+static int mpc8xxx_dummy_rx_refcnt;
+
 struct spi_mpc8xxx_cs {
         /* functions to deal with different sized buffers */
         void (*get_rx) (u32 rx_data, struct mpc8xxx_spi *);
@@ -155,6 +225,42 @@ MPC83XX_SPI_TX_BUF(u8)
 MPC83XX_SPI_TX_BUF(u16)
 MPC83XX_SPI_TX_BUF(u32)
 
+static void mpc8xxx_spi_change_mode(struct spi_device *spi)
+{
+        struct mpc8xxx_spi *mspi = spi_master_get_devdata(spi->master);
+        struct spi_mpc8xxx_cs *cs = spi->controller_state;
+        __be32 __iomem *mode = &mspi->base->mode;
+        unsigned long flags;
+
+        if (cs->hw_mode == mpc8xxx_spi_read_reg(mode))
+                return;
+
+        /* Turn off IRQs locally to minimize time that SPI is disabled. */
+        local_irq_save(flags);
+
+        /* Turn off SPI unit prior changing mode */
+        mpc8xxx_spi_write_reg(mode, cs->hw_mode & ~SPMODE_ENABLE);
+        mpc8xxx_spi_write_reg(mode, cs->hw_mode);
+
+        /* When in CPM mode, we need to reinit tx and rx. */
+        if (mspi->flags & SPI_CPM_MODE) {
+                if (mspi->flags & SPI_QE) {
+                        qe_issue_cmd(QE_INIT_TX_RX, mspi->subblock,
+                                     QE_CR_PROTOCOL_UNSPECIFIED, 0);
+                } else {
+                        cpm_command(CPM_SPI_CMD, CPM_CR_INIT_TRX);
+                        if (mspi->flags & SPI_CPM1) {
+                                out_be16(&mspi->pram->rbptr,
+                                         in_be16(&mspi->pram->rbase));
+                                out_be16(&mspi->pram->tbptr,
+                                         in_be16(&mspi->pram->tbase));
+                        }
+                }
+        }
+
+        local_irq_restore(flags);
+}
+
 static void mpc8xxx_spi_chipselect(struct spi_device *spi, int value)
 {
         struct mpc8xxx_spi *mpc8xxx_spi = spi_master_get_devdata(spi->master);
@@ -168,27 +274,13 @@ static void mpc8xxx_spi_chipselect(struct spi_device *spi, int value)
         }
 
         if (value == BITBANG_CS_ACTIVE) {
-                u32 regval = mpc8xxx_spi_read_reg(&mpc8xxx_spi->base->mode);
-
                 mpc8xxx_spi->rx_shift = cs->rx_shift;
                 mpc8xxx_spi->tx_shift = cs->tx_shift;
                 mpc8xxx_spi->get_rx = cs->get_rx;
                 mpc8xxx_spi->get_tx = cs->get_tx;
 
-                if (cs->hw_mode != regval) {
-                        unsigned long flags;
-                        __be32 __iomem *mode = &mpc8xxx_spi->base->mode;
-
-                        regval = cs->hw_mode;
-                        /* Turn off IRQs locally to minimize time that
-                         * SPI is disabled
-                         */
-                        local_irq_save(flags);
-                        /* Turn off SPI unit prior changing mode */
-                        mpc8xxx_spi_write_reg(mode, regval & ~SPMODE_ENABLE);
-                        mpc8xxx_spi_write_reg(mode, regval);
-                        local_irq_restore(flags);
-                }
+                mpc8xxx_spi_change_mode(spi);
+
                 if (pdata->cs_control)
                         pdata->cs_control(spi, pol);
         }
@@ -198,7 +290,6 @@ static
 int mpc8xxx_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
 {
         struct mpc8xxx_spi *mpc8xxx_spi;
-        u32 regval;
         u8 bits_per_word, pm;
         u32 hz;
         struct spi_mpc8xxx_cs   *cs = spi->controller_state;
@@ -230,14 +321,14 @@ int mpc8xxx_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
         if (bits_per_word <= 8) {
                 cs->get_rx = mpc8xxx_spi_rx_buf_u8;
                 cs->get_tx = mpc8xxx_spi_tx_buf_u8;
-                if (mpc8xxx_spi->qe_mode) {
+                if (mpc8xxx_spi->flags & SPI_QE_CPU_MODE) {
                         cs->rx_shift = 16;
                         cs->tx_shift = 24;
                 }
         } else if (bits_per_word <= 16) {
                 cs->get_rx = mpc8xxx_spi_rx_buf_u16;
                 cs->get_tx = mpc8xxx_spi_tx_buf_u16;
-                if (mpc8xxx_spi->qe_mode) {
+                if (mpc8xxx_spi->flags & SPI_QE_CPU_MODE) {
                         cs->rx_shift = 16;
                         cs->tx_shift = 16;
                 }
@@ -247,7 +338,8 @@ int mpc8xxx_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
         } else
                 return -EINVAL;
 
-        if (mpc8xxx_spi->qe_mode && spi->mode & SPI_LSB_FIRST) {
+        if (mpc8xxx_spi->flags & SPI_QE_CPU_MODE &&
+                        spi->mode & SPI_LSB_FIRST) {
                 cs->tx_shift = 0;
                 if (bits_per_word <= 8)
                         cs->rx_shift = 8;
@@ -286,37 +378,138 @@ int mpc8xxx_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
                 pm--;
 
         cs->hw_mode |= SPMODE_PM(pm);
-        regval =  mpc8xxx_spi_read_reg(&mpc8xxx_spi->base->mode);
-        if (cs->hw_mode != regval) {
-                unsigned long flags;
-                __be32 __iomem *mode = &mpc8xxx_spi->base->mode;
-
-                regval = cs->hw_mode;
-                /* Turn off IRQs locally to minimize time
-                 * that SPI is disabled
-                 */
-                local_irq_save(flags);
-                /* Turn off SPI unit prior changing mode */
-                mpc8xxx_spi_write_reg(mode, regval & ~SPMODE_ENABLE);
-                mpc8xxx_spi_write_reg(mode, regval);
-                local_irq_restore(flags);
+
+        mpc8xxx_spi_change_mode(spi);
+        return 0;
+}
+
+static void mpc8xxx_spi_cpm_bufs_start(struct mpc8xxx_spi *mspi)
+{
+        struct cpm_buf_desc __iomem *tx_bd = mspi->tx_bd;
+        struct cpm_buf_desc __iomem *rx_bd = mspi->rx_bd;
+        unsigned int xfer_len = min(mspi->count, SPI_MRBLR);
+        unsigned int xfer_ofs;
+
+        xfer_ofs = mspi->xfer_in_progress->len - mspi->count;
+
+        out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs);
+        out_be16(&rx_bd->cbd_datlen, 0);
+        out_be16(&rx_bd->cbd_sc, BD_SC_EMPTY | BD_SC_INTRPT | BD_SC_WRAP);
+
+        out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs);
+        out_be16(&tx_bd->cbd_datlen, xfer_len);
+        out_be16(&tx_bd->cbd_sc, BD_SC_READY | BD_SC_INTRPT | BD_SC_WRAP |
+                                 BD_SC_LAST);
+
+        /* start transfer */
+        mpc8xxx_spi_write_reg(&mspi->base->command, SPCOM_STR);
+}
+
+static int mpc8xxx_spi_cpm_bufs(struct mpc8xxx_spi *mspi,
+                                struct spi_transfer *t, bool is_dma_mapped)
+{
+        struct device *dev = mspi->dev;
+
+        if (is_dma_mapped) {
+                mspi->map_tx_dma = 0;
+                mspi->map_rx_dma = 0;
+        } else {
+                mspi->map_tx_dma = 1;
+                mspi->map_rx_dma = 1;
+        }
+
+        if (!t->tx_buf) {
+                mspi->tx_dma = mspi->dma_dummy_tx;
+                mspi->map_tx_dma = 0;
+        }
+
+        if (!t->rx_buf) {
+                mspi->rx_dma = mspi->dma_dummy_rx;
+                mspi->map_rx_dma = 0;
         }
+
+        if (mspi->map_tx_dma) {
+                void *nonconst_tx = (void *)mspi->tx; /* shut up gcc */
+
+                mspi->tx_dma = dma_map_single(dev, nonconst_tx, t->len,
+                                              DMA_TO_DEVICE);
+                if (dma_mapping_error(dev, mspi->tx_dma)) {
+                        dev_err(dev, "unable to map tx dma\n");
+                        return -ENOMEM;
+                }
+        } else {
+                mspi->tx_dma = t->tx_dma;
+        }
+
+        if (mspi->map_rx_dma) {
+                mspi->rx_dma = dma_map_single(dev, mspi->rx, t->len,
+                                              DMA_FROM_DEVICE);
+                if (dma_mapping_error(dev, mspi->rx_dma)) {
+                        dev_err(dev, "unable to map rx dma\n");
+                        goto err_rx_dma;
+                }
+        } else {
+                mspi->rx_dma = t->rx_dma;
+        }
+
+        /* enable rx ints */
+        mpc8xxx_spi_write_reg(&mspi->base->mask, SPIE_RXB);
+
+        mspi->xfer_in_progress = t;
+        mspi->count = t->len;
+
+        /* start CPM transfers */
+        mpc8xxx_spi_cpm_bufs_start(mspi);
+
         return 0;
+
+err_rx_dma:
+        if (mspi->map_tx_dma)
+                dma_unmap_single(dev, mspi->tx_dma, t->len, DMA_TO_DEVICE);
+        return -ENOMEM;
 }
 
-static int mpc8xxx_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
+static void mpc8xxx_spi_cpm_bufs_complete(struct mpc8xxx_spi *mspi)
 {
-        struct mpc8xxx_spi *mpc8xxx_spi;
-        u32 word, len, bits_per_word;
+        struct device *dev = mspi->dev;
+        struct spi_transfer *t = mspi->xfer_in_progress;
+
+        if (mspi->map_tx_dma)
+                dma_unmap_single(dev, mspi->tx_dma, t->len, DMA_TO_DEVICE);
+        if (mspi->map_tx_dma)
+                dma_unmap_single(dev, mspi->rx_dma, t->len, DMA_FROM_DEVICE);
+        mspi->xfer_in_progress = NULL;
+}
 
-        mpc8xxx_spi = spi_master_get_devdata(spi->master);
+static int mpc8xxx_spi_cpu_bufs(struct mpc8xxx_spi *mspi,
+                                struct spi_transfer *t, unsigned int len)
+{
+        u32 word;
+
+        mspi->count = len;
+
+        /* enable rx ints */
+        mpc8xxx_spi_write_reg(&mspi->base->mask, SPIM_NE);
+
+        /* transmit word */
+        word = mspi->get_tx(mspi);
+        mpc8xxx_spi_write_reg(&mspi->base->transmit, word);
+
+        return 0;
+}
+
+static int mpc8xxx_spi_bufs(struct spi_device *spi, struct spi_transfer *t,
+                            bool is_dma_mapped)
+{
+        struct mpc8xxx_spi *mpc8xxx_spi = spi_master_get_devdata(spi->master);
+        unsigned int len = t->len;
+        u8 bits_per_word;
+        int ret;
 
-        mpc8xxx_spi->tx = t->tx_buf;
-        mpc8xxx_spi->rx = t->rx_buf;
         bits_per_word = spi->bits_per_word;
         if (t->bits_per_word)
                 bits_per_word = t->bits_per_word;
-        len = t->len;
+
         if (bits_per_word > 8) {
                 /* invalid length? */
                 if (len & 1)
@@ -329,22 +522,27 @@ static int mpc8xxx_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
                         return -EINVAL;
                 len /= 2;
         }
-        mpc8xxx_spi->count = len;
 
-        INIT_COMPLETION(mpc8xxx_spi->done);
+        mpc8xxx_spi->tx = t->tx_buf;
+        mpc8xxx_spi->rx = t->rx_buf;
 
-        /* enable rx ints */
-        mpc8xxx_spi_write_reg(&mpc8xxx_spi->base->mask, SPIM_NE);
+        INIT_COMPLETION(mpc8xxx_spi->done);
 
-        /* transmit word */
-        word = mpc8xxx_spi->get_tx(mpc8xxx_spi);
-        mpc8xxx_spi_write_reg(&mpc8xxx_spi->base->transmit, word);
+        if (mpc8xxx_spi->flags & SPI_CPM_MODE)
+                ret = mpc8xxx_spi_cpm_bufs(mpc8xxx_spi, t, is_dma_mapped);
+        else
+                ret = mpc8xxx_spi_cpu_bufs(mpc8xxx_spi, t, len);
+        if (ret)
+                return ret;
 
         wait_for_completion(&mpc8xxx_spi->done);
 
         /* disable rx ints */
         mpc8xxx_spi_write_reg(&mpc8xxx_spi->base->mask, 0);
 
+        if (mpc8xxx_spi->flags & SPI_CPM_MODE)
+                mpc8xxx_spi_cpm_bufs_complete(mpc8xxx_spi);
+
         return mpc8xxx_spi->count;
 }
 
@@ -375,7 +573,7 @@ static void mpc8xxx_spi_do_one_msg(struct spi_message *m)
                 }
                 cs_change = t->cs_change;
                 if (t->len)
-                        status = mpc8xxx_spi_bufs(spi, t);
+                        status = mpc8xxx_spi_bufs(spi, t, m->is_dma_mapped);
                 if (status) {
                         status = -EMSGSIZE;
                         break;
@@ -464,45 +662,80 @@ static int mpc8xxx_spi_setup(struct spi_device *spi)
         return 0;
 }
 
-static irqreturn_t mpc8xxx_spi_irq(s32 irq, void *context_data)
+static void mpc8xxx_spi_cpm_irq(struct mpc8xxx_spi *mspi, u32 events)
 {
-        struct mpc8xxx_spi *mpc8xxx_spi = context_data;
-        u32 event;
-        irqreturn_t ret = IRQ_NONE;
+        u16 len;
 
-        /* Get interrupt events(tx/rx) */
-        event = mpc8xxx_spi_read_reg(&mpc8xxx_spi->base->event);
+        dev_dbg(mspi->dev, "%s: bd datlen %d, count %d\n", __func__,
+                in_be16(&mspi->rx_bd->cbd_datlen), mspi->count);
 
-        /* We need handle RX first */
-        if (event & SPIE_NE) {
-                u32 rx_data = mpc8xxx_spi_read_reg(&mpc8xxx_spi->base->receive);
+        len = in_be16(&mspi->rx_bd->cbd_datlen);
+        if (len > mspi->count) {
+                WARN_ON(1);
+                len = mspi->count;
+        }
 
-                if (mpc8xxx_spi->rx)
-                        mpc8xxx_spi->get_rx(rx_data, mpc8xxx_spi);
+        /* Clear the events */
+        mpc8xxx_spi_write_reg(&mspi->base->event, events);
 
-                ret = IRQ_HANDLED;
+        mspi->count -= len;
+        if (mspi->count)
+                mpc8xxx_spi_cpm_bufs_start(mspi);
+        else
+                complete(&mspi->done);
+}
+
+static void mpc8xxx_spi_cpu_irq(struct mpc8xxx_spi *mspi, u32 events)
+{
+        /* We need handle RX first */
+        if (events & SPIE_NE) {
+                u32 rx_data = mpc8xxx_spi_read_reg(&mspi->base->receive);
+
+                if (mspi->rx)
+                        mspi->get_rx(rx_data, mspi);
         }
 
-        if ((event & SPIE_NF) == 0)
+        if ((events & SPIE_NF) == 0)
                 /* spin until TX is done */
-                while (((event =
-                         mpc8xxx_spi_read_reg(&mpc8xxx_spi->base->event)) &
+                while (((events =
+                        mpc8xxx_spi_read_reg(&mspi->base->event)) &
                                                 SPIE_NF) == 0)
                         cpu_relax();
 
-        mpc8xxx_spi->count -= 1;
-        if (mpc8xxx_spi->count) {
-                u32 word = mpc8xxx_spi->get_tx(mpc8xxx_spi);
-                mpc8xxx_spi_write_reg(&mpc8xxx_spi->base->transmit, word);
+        /* Clear the events */
+        mpc8xxx_spi_write_reg(&mspi->base->event, events);
+
+        mspi->count -= 1;
+        if (mspi->count) {
+                u32 word = mspi->get_tx(mspi);
+
+                mpc8xxx_spi_write_reg(&mspi->base->transmit, word);
         } else {
-                complete(&mpc8xxx_spi->done);
+                complete(&mspi->done);
         }
+}
 
-        /* Clear the events */
-        mpc8xxx_spi_write_reg(&mpc8xxx_spi->base->event, event);
+static irqreturn_t mpc8xxx_spi_irq(s32 irq, void *context_data)
+{
+        struct mpc8xxx_spi *mspi = context_data;
+        irqreturn_t ret = IRQ_NONE;
+        u32 events;
+
+        /* Get interrupt events(tx/rx) */
+        events = mpc8xxx_spi_read_reg(&mspi->base->event);
+        if (events)
+                ret = IRQ_HANDLED;
+
+        dev_dbg(mspi->dev, "%s: events %x\n", __func__, events);
+
+        if (mspi->flags & SPI_CPM_MODE)
+                mpc8xxx_spi_cpm_irq(mspi, events);
+        else
+                mpc8xxx_spi_cpu_irq(mspi, events);
 
         return ret;
 }
+
 static int mpc8xxx_spi_transfer(struct spi_device *spi,
                                 struct spi_message *m)
 {
@@ -526,6 +759,215 @@ static void mpc8xxx_spi_cleanup(struct spi_device *spi)
         kfree(spi->controller_state);
 }
 
+static void *mpc8xxx_spi_alloc_dummy_rx(void)
+{
+        mutex_lock(&mpc8xxx_dummy_rx_lock);
+
+        if (!mpc8xxx_dummy_rx)
+                mpc8xxx_dummy_rx = kmalloc(SPI_MRBLR, GFP_KERNEL);
+        if (mpc8xxx_dummy_rx)
+                mpc8xxx_dummy_rx_refcnt++;
+
+        mutex_unlock(&mpc8xxx_dummy_rx_lock);
+
+        return mpc8xxx_dummy_rx;
+}
+
+static void mpc8xxx_spi_free_dummy_rx(void)
+{
+        mutex_lock(&mpc8xxx_dummy_rx_lock);
+
+        switch (mpc8xxx_dummy_rx_refcnt) {
+        case 0:
+                WARN_ON(1);
+                break;
+        case 1:
+                kfree(mpc8xxx_dummy_rx);
+                mpc8xxx_dummy_rx = NULL;
+                /* fall through */
+        default:
+                mpc8xxx_dummy_rx_refcnt--;
+                break;
+        }
+
+        mutex_unlock(&mpc8xxx_dummy_rx_lock);
+}
+
+static unsigned long mpc8xxx_spi_cpm_get_pram(struct mpc8xxx_spi *mspi)
+{
+        struct device *dev = mspi->dev;
+        struct device_node *np = dev_archdata_get_node(&dev->archdata);
+        const u32 *iprop;
+        int size;
+        unsigned long spi_base_ofs;
+        unsigned long pram_ofs = -ENOMEM;
+
+        /* Can't use of_address_to_resource(), QE muram isn't at 0. */
+        iprop = of_get_property(np, "reg", &size);
+
+        /* QE with a fixed pram location? */
+        if (mspi->flags & SPI_QE && iprop && size == sizeof(*iprop) * 4)
+                return cpm_muram_alloc_fixed(iprop[2], SPI_PRAM_SIZE);
+
+        /* QE but with a dynamic pram location? */
+        if (mspi->flags & SPI_QE) {
+                pram_ofs = cpm_muram_alloc(SPI_PRAM_SIZE, 64);
+                qe_issue_cmd(QE_ASSIGN_PAGE_TO_DEVICE, mspi->subblock,
+                                QE_CR_PROTOCOL_UNSPECIFIED, pram_ofs);
+                return pram_ofs;
+        }
+
+        /* CPM1 and CPM2 pram must be at a fixed addr. */
+        if (!iprop || size != sizeof(*iprop) * 4)
+                return -ENOMEM;
+
+        spi_base_ofs = cpm_muram_alloc_fixed(iprop[2], 2);
+        if (IS_ERR_VALUE(spi_base_ofs))
+                return -ENOMEM;
+
+        if (mspi->flags & SPI_CPM2) {
+                pram_ofs = cpm_muram_alloc(SPI_PRAM_SIZE, 64);
+                if (!IS_ERR_VALUE(pram_ofs)) {
+                        u16 __iomem *spi_base = cpm_muram_addr(spi_base_ofs);
+
+                        out_be16(spi_base, pram_ofs);
+                }
+        } else {
+                struct spi_pram __iomem *pram = cpm_muram_addr(spi_base_ofs);
+                u16 rpbase = in_be16(&pram->rpbase);
+
+                /* Microcode relocation patch applied? */
+                if (rpbase)
+                        pram_ofs = rpbase;
+                else
+                        return spi_base_ofs;
+        }
+
+        cpm_muram_free(spi_base_ofs);
+        return pram_ofs;
+}
+
+static int mpc8xxx_spi_cpm_init(struct mpc8xxx_spi *mspi)
+{
+        struct device *dev = mspi->dev;
+        struct device_node *np = dev_archdata_get_node(&dev->archdata);
+        const u32 *iprop;
+        int size;
+        unsigned long pram_ofs;
+        unsigned long bds_ofs;
+
+        if (!(mspi->flags & SPI_CPM_MODE))
+                return 0;
+
+        if (!mpc8xxx_spi_alloc_dummy_rx())
+                return -ENOMEM;
+
+        if (mspi->flags & SPI_QE) {
+                iprop = of_get_property(np, "cell-index", &size);
+                if (iprop && size == sizeof(*iprop))
+                        mspi->subblock = *iprop;
+
+                switch (mspi->subblock) {
+                default:
+                        dev_warn(dev, "cell-index unspecified, assuming SPI1");
+                        /* fall through */
+                case 0:
+                        mspi->subblock = QE_CR_SUBBLOCK_SPI1;
+                        break;
+                case 1:
+                        mspi->subblock = QE_CR_SUBBLOCK_SPI2;
+                        break;
+                }
+        }
+
+        pram_ofs = mpc8xxx_spi_cpm_get_pram(mspi);
+        if (IS_ERR_VALUE(pram_ofs)) {
+                dev_err(dev, "can't allocate spi parameter ram\n");
+                goto err_pram;
+        }
+
+        bds_ofs = cpm_muram_alloc(sizeof(*mspi->tx_bd) +
+                                  sizeof(*mspi->rx_bd), 8);
+        if (IS_ERR_VALUE(bds_ofs)) {
+                dev_err(dev, "can't allocate bds\n");
+                goto err_bds;
+        }
+
+        mspi->dma_dummy_tx = dma_map_single(dev, empty_zero_page, PAGE_SIZE,
+                                            DMA_TO_DEVICE);
+        if (dma_mapping_error(dev, mspi->dma_dummy_tx)) {
+                dev_err(dev, "unable to map dummy tx buffer\n");
+                goto err_dummy_tx;
+        }
+
+        mspi->dma_dummy_rx = dma_map_single(dev, mpc8xxx_dummy_rx, SPI_MRBLR,
+                                            DMA_FROM_DEVICE);
+        if (dma_mapping_error(dev, mspi->dma_dummy_rx)) {
+                dev_err(dev, "unable to map dummy rx buffer\n");
+                goto err_dummy_rx;
+        }
+
+        mspi->pram = cpm_muram_addr(pram_ofs);
+
+        mspi->tx_bd = cpm_muram_addr(bds_ofs);
+        mspi->rx_bd = cpm_muram_addr(bds_ofs + sizeof(*mspi->tx_bd));
+
+        /* Initialize parameter ram. */
+        out_be16(&mspi->pram->tbase, cpm_muram_offset(mspi->tx_bd));
+        out_be16(&mspi->pram->rbase, cpm_muram_offset(mspi->rx_bd));
+        out_8(&mspi->pram->tfcr, CPMFCR_EB | CPMFCR_GBL);
+        out_8(&mspi->pram->rfcr, CPMFCR_EB | CPMFCR_GBL);
+        out_be16(&mspi->pram->mrblr, SPI_MRBLR);
+        out_be32(&mspi->pram->rstate, 0);
+        out_be32(&mspi->pram->rdp, 0);
+        out_be16(&mspi->pram->rbptr, 0);
+        out_be16(&mspi->pram->rbc, 0);
+        out_be32(&mspi->pram->rxtmp, 0);
+        out_be32(&mspi->pram->tstate, 0);
+        out_be32(&mspi->pram->tdp, 0);
+        out_be16(&mspi->pram->tbptr, 0);
+        out_be16(&mspi->pram->tbc, 0);
+        out_be32(&mspi->pram->txtmp, 0);
+
+        return 0;
+
+err_dummy_rx:
+        dma_unmap_single(dev, mspi->dma_dummy_tx, PAGE_SIZE, DMA_TO_DEVICE);
+err_dummy_tx:
+        cpm_muram_free(bds_ofs);
+err_bds:
+        cpm_muram_free(pram_ofs);
+err_pram:
+        mpc8xxx_spi_free_dummy_rx();
+        return -ENOMEM;
+}
+
+static void mpc8xxx_spi_cpm_free(struct mpc8xxx_spi *mspi)
+{
+        struct device *dev = mspi->dev;
+
+        dma_unmap_single(dev, mspi->dma_dummy_rx, SPI_MRBLR, DMA_FROM_DEVICE);
+        dma_unmap_single(dev, mspi->dma_dummy_tx, PAGE_SIZE, DMA_TO_DEVICE);
+        cpm_muram_free(cpm_muram_offset(mspi->tx_bd));
+        cpm_muram_free(cpm_muram_offset(mspi->pram));
+        mpc8xxx_spi_free_dummy_rx();
+}
+
+static const char *mpc8xxx_spi_strmode(unsigned int flags)
+{
+        if (flags & SPI_QE_CPU_MODE) {
+                return "QE CPU";
+        } else if (flags & SPI_CPM_MODE) {
+                if (flags & SPI_QE)
+                        return "QE";
+                else if (flags & SPI_CPM2)
+                        return "CPM2";
+                else
+                        return "CPM1";
+        }
+        return "CPU";
+}
+
 static struct spi_master * __devinit
 mpc8xxx_spi_probe(struct device *dev, struct resource *mem, unsigned int irq)
 {
@@ -552,14 +994,19 @@ mpc8xxx_spi_probe(struct device *dev, struct resource *mem, unsigned int irq)
         master->cleanup = mpc8xxx_spi_cleanup;
 
         mpc8xxx_spi = spi_master_get_devdata(master);
-        mpc8xxx_spi->qe_mode = pdata->qe_mode;
+        mpc8xxx_spi->dev = dev;
         mpc8xxx_spi->get_rx = mpc8xxx_spi_rx_buf_u8;
         mpc8xxx_spi->get_tx = mpc8xxx_spi_tx_buf_u8;
+        mpc8xxx_spi->flags = pdata->flags;
         mpc8xxx_spi->spibrg = pdata->sysclk;
 
+        ret = mpc8xxx_spi_cpm_init(mpc8xxx_spi);
+        if (ret)
+                goto err_cpm_init;
+
         mpc8xxx_spi->rx_shift = 0;
         mpc8xxx_spi->tx_shift = 0;
-        if (mpc8xxx_spi->qe_mode) {
+        if (mpc8xxx_spi->flags & SPI_QE_CPU_MODE) {
                 mpc8xxx_spi->rx_shift = 16;
                 mpc8xxx_spi->tx_shift = 24;
         }
@@ -569,7 +1016,7 @@ mpc8xxx_spi_probe(struct device *dev, struct resource *mem, unsigned int irq)
         mpc8xxx_spi->base = ioremap(mem->start, mem->end - mem->start + 1);
         if (mpc8xxx_spi->base == NULL) {
                 ret = -ENOMEM;
-                goto put_master;
+                goto err_ioremap;
         }
 
         mpc8xxx_spi->irq = irq;
@@ -592,7 +1039,7 @@ mpc8xxx_spi_probe(struct device *dev, struct resource *mem, unsigned int irq)
 
         /* Enable SPI interface */
         regval = pdata->initial_spmode | SPMODE_INIT_VAL | SPMODE_ENABLE;
-        if (pdata->qe_mode)
+        if (mpc8xxx_spi->flags & SPI_QE_CPU_MODE)
                 regval |= SPMODE_OP;
 
         mpc8xxx_spi_write_reg(&mpc8xxx_spi->base->mode, regval);
@@ -612,9 +1059,8 @@ mpc8xxx_spi_probe(struct device *dev, struct resource *mem, unsigned int irq)
         if (ret < 0)
                 goto unreg_master;
 
-        printk(KERN_INFO
-               "%s: MPC8xxx SPI Controller driver at 0x%p (irq = %d)\n",
-               dev_name(dev), mpc8xxx_spi->base, mpc8xxx_spi->irq);
+        dev_info(dev, "at 0x%p (irq = %d), %s mode\n", mpc8xxx_spi->base,
+                 mpc8xxx_spi->irq, mpc8xxx_spi_strmode(mpc8xxx_spi->flags));
 
         return master;
 
@@ -624,7 +1070,9 @@ free_irq:
         free_irq(mpc8xxx_spi->irq, mpc8xxx_spi);
 unmap_io:
         iounmap(mpc8xxx_spi->base);
-put_master:
+err_ioremap:
+        mpc8xxx_spi_cpm_free(mpc8xxx_spi);
+err_cpm_init:
         spi_master_put(master);
 err:
         return ERR_PTR(ret);
@@ -644,6 +1092,7 @@ static int __devexit mpc8xxx_spi_remove(struct device *dev)
 
         free_irq(mpc8xxx_spi->irq, mpc8xxx_spi);
         iounmap(mpc8xxx_spi->base);
+        mpc8xxx_spi_cpm_free(mpc8xxx_spi);
 
         return 0;
 }
@@ -709,6 +1158,7 @@ static int of_mpc8xxx_spi_get_chipselects(struct device *dev)
                 gpio = of_get_gpio_flags(np, i, &flags);
                 if (!gpio_is_valid(gpio)) {
                         dev_err(dev, "invalid gpio #%d: %d\n", i, gpio);
+                        ret = gpio;
                         goto err_loop;
                 }
 
@@ -804,7 +1254,13 @@ static int __devinit of_mpc8xxx_spi_probe(struct of_device *ofdev,
 
         prop = of_get_property(np, "mode", NULL);
         if (prop && !strcmp(prop, "cpu-qe"))
-                pdata->qe_mode = 1;
+                pdata->flags = SPI_QE_CPU_MODE;
+        else if (prop && !strcmp(prop, "qe"))
+                pdata->flags = SPI_CPM_MODE | SPI_QE;
+        else if (of_device_is_compatible(np, "fsl,cpm2-spi"))
+                pdata->flags = SPI_CPM_MODE | SPI_CPM2;
+        else if (of_device_is_compatible(np, "fsl,cpm1-spi"))
+                pdata->flags = SPI_CPM_MODE | SPI_CPM1;
 
         ret = of_mpc8xxx_spi_get_chipselects(dev);
         if (ret)
diff --git a/drivers/spi/xilinx_spi.c b/drivers/spi/xilinx_spi.c
index 46b8c5c2f45e..5a143b9f6361 100644
--- a/drivers/spi/xilinx_spi.c
+++ b/drivers/spi/xilinx_spi.c
@@ -148,7 +148,8 @@ static int xilinx_spi_setup_transfer(struct spi_device *spi,
 {
         u8 bits_per_word;
 
-        bits_per_word = (t) ? t->bits_per_word : spi->bits_per_word;
+        bits_per_word = (t && t->bits_per_word)
+                         ? t->bits_per_word : spi->bits_per_word;
         if (bits_per_word != 8) {
                 dev_err(&spi->dev, "%s, unsupported bits_per_word=%d\n",
                         __func__, bits_per_word);