89 files changed, 15862 insertions, 1455 deletions

diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 68ab39d7cb35..4d073f1e4502 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -4,7 +4,6 @@
 
 menuconfig MISC_DEVICES
         bool "Misc devices"
-        default y
         ---help---
           Say Y here to get to see options for device drivers from various
           different categories. This option alone does not add any kernel code.
@@ -13,6 +12,47 @@ menuconfig MISC_DEVICES
 
 if MISC_DEVICES
 
+config AD525X_DPOT
+        tristate "Analog Devices Digital Potentiometers"
+        depends on (I2C || SPI) && SYSFS
+        help
+          If you say yes here, you get support for the Analog Devices
+          AD5258, AD5259, AD5251, AD5252, AD5253, AD5254, AD5255
+          AD5160, AD5161, AD5162, AD5165, AD5200, AD5201, AD5203,
+          AD5204, AD5206, AD5207, AD5231, AD5232, AD5233, AD5235,
+          AD5260, AD5262, AD5263, AD5290, AD5291, AD5292, AD5293,
+          AD7376, AD8400, AD8402, AD8403, ADN2850, AD5241, AD5242,
+          AD5243, AD5245, AD5246, AD5247, AD5248, AD5280, AD5282,
+          ADN2860, AD5273, AD5171, AD5170, AD5172, AD5173, AD5270,
+          AD5271, AD5272, AD5274
+          digital potentiometer chips.
+
+          See Documentation/misc-devices/ad525x_dpot.txt for the
+          userspace interface.
+
+          This driver can also be built as a module.  If so, the module
+          will be called ad525x_dpot.
+
+config AD525X_DPOT_I2C
+        tristate "support I2C bus connection"
+        depends on AD525X_DPOT && I2C
+        help
+          Say Y here if you have a digital potentiometers hooked to an I2C bus.
+
+          To compile this driver as a module, choose M here: the
+          module will be called ad525x_dpot-i2c.
+
+config AD525X_DPOT_SPI
+        tristate "support SPI bus connection"
+        depends on AD525X_DPOT && SPI_MASTER
+        help
+          Say Y here if you have a digital potentiometers hooked to an SPI bus.
+
+          If unsure, say N (but it's safe to say "Y").
+
+          To compile this driver as a module, choose M here: the
+          module will be called ad525x_dpot-spi.
+
 config ATMEL_PWM
         tristate "Atmel AT32/AT91 PWM support"
         depends on AVR32 || ARCH_AT91SAM9263 || ARCH_AT91SAM9RL || ARCH_AT91CAP9
@@ -22,6 +62,15 @@ config ATMEL_PWM
           purposes including software controlled power-efficient backlights
           on LCD displays, motor control, and waveform generation.
 
+config AB8500_PWM
+        bool "AB8500 PWM support"
+        depends on AB8500_CORE
+        select HAVE_PWM
+        help
+          This driver exports functions to enable/disble/config/free Pulse
+          Width Modulation in the Analog Baseband Chip AB8500.
+          It is used by led and backlight driver to control the intensity.
+
 config ATMEL_TCLIB
         bool "Atmel AT32/AT91 Timer/Counter Library"
         depends on (AVR32 || ARCH_AT91)
@@ -32,7 +81,7 @@ config ATMEL_TCLIB
 
 config ATMEL_TCB_CLKSRC
         bool "TC Block Clocksource"
-        depends on ATMEL_TCLIB && GENERIC_TIME
+        depends on ATMEL_TCLIB
         default y
         help
           Select this to get a high precision clocksource based on a
@@ -72,8 +121,8 @@ config IBM_ASM
 
           WARNING: This software may not be supported or function
           correctly on your IBM server. Please consult the IBM ServerProven
-          website <http://www.pc.ibm.com/ww/eserver/xseries/serverproven> for
-          information on the specific driver level and support statement
+          website <http://www-03.ibm.com/systems/info/x86servers/serverproven/compat/us/>
+          for information on the specific driver level and support statement
           for your IBM server.
 
 config PHANTOM
@@ -173,16 +222,50 @@ config SGI_XP
           this feature will allow for direct communication between SSIs
           based on a network adapter and DMA messaging.
 
+config CS5535_MFGPT
+        tristate "CS5535/CS5536 Geode Multi-Function General Purpose Timer (MFGPT) support"
+        depends on PCI
+        depends on X86
+        default n
+        help
+          This driver provides access to MFGPT functionality for other
+          drivers that need timers.  MFGPTs are available in the CS5535 and
+          CS5536 companion chips that are found in AMD Geode and several
+          other platforms.  They have a better resolution and max interval
+          than the generic PIT, and are suitable for use as high-res timers.
+          You probably don't want to enable this manually; other drivers that
+          make use of it should enable it.
+
+config CS5535_MFGPT_DEFAULT_IRQ
+        int
+        depends on CS5535_MFGPT
+        default 7
+        help
+          MFGPTs on the CS5535 require an interrupt.  The selected IRQ
+          can be overridden as a module option as well as by driver that
+          use the cs5535_mfgpt_ API; however, different architectures might
+          want to use a different IRQ by default.  This is here for
+          architectures to set as necessary.
+
+config CS5535_CLOCK_EVENT_SRC
+        tristate "CS5535/CS5536 high-res timer (MFGPT) events"
+        depends on GENERIC_CLOCKEVENTS && CS5535_MFGPT
+        help
+          This driver provides a clock event source based on the MFGPT
+          timer(s) in the CS5535 and CS5536 companion chips.
+          MFGPTs have a better resolution and max interval than the
+          generic PIT, and are suitable for use as high-res timers.
+
 config HP_ILO
-        tristate "Channel interface driver for HP iLO/iLO2 processor"
+        tristate "Channel interface driver for the HP iLO processor"
         depends on PCI
         default n
         help
           The channel interface driver allows applications to communicate
-          with iLO/iLO2 management processors present on HP ProLiant
-          servers.  Upon loading, the driver creates /dev/hpilo/dXccbN files,
-          which can be used to gather data from the management processor,
-          via read and write system calls.
+          with iLO management processors present on HP ProLiant servers.
+          Upon loading, the driver creates /dev/hpilo/dXccbN files, which
+          can be used to gather data from the management processor, via
+          read and write system calls.
 
           To compile this driver as a module, choose M here: the
           module will be called hpilo.
@@ -210,18 +293,15 @@ config SGI_GRU_DEBUG
         This option enables addition debugging code for the SGI GRU driver. If
         you are unsure, say N.
 
-config DELL_LAPTOP
-        tristate "Dell Laptop Extras (EXPERIMENTAL)"
-        depends on X86
-        depends on DCDBAS
-        depends on EXPERIMENTAL
-        depends on BACKLIGHT_CLASS_DEVICE
-        depends on RFKILL
-        depends on POWER_SUPPLY
-        default n
-        ---help---
-        This driver adds support for rfkill and backlight control to Dell
-        laptops.
+config APDS9802ALS
+        tristate "Medfield Avago APDS9802 ALS Sensor module"
+        depends on I2C
+        help
+          If you say yes here you get support for the ALS APDS9802 ambient
+          light sensor.
+
+          This driver can also be built as a module.  If so, the module
+          will be called apds9802als.
 
 config ISL29003
         tristate "Intersil ISL29003 ambient light sensor"
@@ -233,8 +313,149 @@ config ISL29003
           This driver can also be built as a module.  If so, the module
           will be called isl29003.
 
+config ISL29020
+        tristate "Intersil ISL29020 ambient light sensor"
+        depends on I2C
+        help
+          If you say yes here you get support for the Intersil ISL29020
+          ambient light sensor.
+
+          This driver can also be built as a module.  If so, the module
+          will be called isl29020.
+
+config SENSORS_TSL2550
+        tristate "Taos TSL2550 ambient light sensor"
+        depends on I2C && SYSFS
+        help
+          If you say yes here you get support for the Taos TSL2550
+          ambient light sensor.
+
+          This driver can also be built as a module.  If so, the module
+          will be called tsl2550.
+
+config SENSORS_BH1780
+        tristate "ROHM BH1780GLI ambient light sensor"
+        depends on I2C && SYSFS
+        help
+          If you say yes here you get support for the ROHM BH1780GLI
+          ambient light sensor.
+
+          This driver can also be built as a module.  If so, the module
+          will be called bh1780gli.
+
+config SENSORS_BH1770
+         tristate "BH1770GLC / SFH7770 combined ALS - Proximity sensor"
+         depends on I2C
+         ---help---
+           Say Y here if you want to build a driver for BH1770GLC (ROHM) or
+           SFH7770 (Osram) combined ambient light and proximity sensor chip.
+
+           To compile this driver as a module, choose M here: the
+           module will be called bh1770glc. If unsure, say N here.
+
+config SENSORS_APDS990X
+         tristate "APDS990X combined als and proximity sensors"
+         depends on I2C
+         default n
+         ---help---
+           Say Y here if you want to build a driver for Avago APDS990x
+           combined ambient light and proximity sensor chip.
+
+           To compile this driver as a module, choose M here: the
+           module will be called apds990x. If unsure, say N here.
+
+config HMC6352
+        tristate "Honeywell HMC6352 compass"
+        depends on I2C
+        help
+          This driver provides support for the Honeywell HMC6352 compass,
+          providing configuration and heading data via sysfs.
+
+config EP93XX_PWM
+        tristate "EP93xx PWM support"
+        depends on ARCH_EP93XX
+        help
+          This option enables device driver support for the PWM channels
+          on the Cirrus EP93xx processors.  The EP9307 chip only has one
+          PWM channel all the others have two, the second channel is an
+          alternate function of the EGPIO14 pin.  A sysfs interface is
+          provided to control the PWM channels.
+
+          To compile this driver as a module, choose M here: the module will
+          be called ep93xx_pwm.
+
+config DS1682
+        tristate "Dallas DS1682 Total Elapsed Time Recorder with Alarm"
+        depends on I2C && EXPERIMENTAL
+        help
+          If you say yes here you get support for Dallas Semiconductor
+          DS1682 Total Elapsed Time Recorder.
+
+          This driver can also be built as a module.  If so, the module
+          will be called ds1682.
+
+config TI_DAC7512
+        tristate "Texas Instruments DAC7512"
+        depends on SPI && SYSFS
+        help
+          If you say yes here you get support for the Texas Instruments
+          DAC7512 16-bit digital-to-analog converter.
+
+          This driver can also be built as a module. If so, the module
+          will be calles ti_dac7512.
+
+config VMWARE_BALLOON
+        tristate "VMware Balloon Driver"
+        depends on X86
+        help
+          This is VMware physical memory management driver which acts
+          like a "balloon" that can be inflated to reclaim physical pages
+          by reserving them in the guest and invalidating them in the
+          monitor, freeing up the underlying machine pages so they can
+          be allocated to other guests. The balloon can also be deflated
+          to allow the guest to use more physical memory.
+
+          If unsure, say N.
+
+          To compile this driver as a module, choose M here: the
+          module will be called vmw_balloon.
+
+config ARM_CHARLCD
+        bool "ARM Ltd. Character LCD Driver"
+        depends on PLAT_VERSATILE
+        help
+          This is a driver for the character LCD found on the ARM Ltd.
+          Versatile and RealView Platform Baseboards. It doesn't do
+          very much more than display the text "ARM Linux" on the first
+          line and the Linux version on the second line, but that's
+          still useful.
+
+config BMP085
+        tristate "BMP085 digital pressure sensor"
+        depends on I2C && SYSFS
+        help
+          If you say yes here you get support for the Bosch Sensortec
+          BMP085 digital pressure sensor.
+
+          To compile this driver as a module, choose M here: the
+          module will be called bmp085.
+
+config PCH_PHUB
+        tristate "PCH Packet Hub of Intel Topcliff"
+        depends on PCI
+        help
+          This driver is for PCH(Platform controller Hub) PHUB(Packet Hub) of
+          Intel Topcliff which is an IOH(Input/Output Hub) for x86 embedded
+          processor. The Topcliff has MAC address and Option ROM data in SROM.
+          This driver can access MAC address and Option ROM data in SROM.
+
+          To compile this driver as a module, choose M here: the module will
+          be called pch_phub.
+
 source "drivers/misc/c2port/Kconfig"
 source "drivers/misc/eeprom/Kconfig"
 source "drivers/misc/cb710/Kconfig"
+source "drivers/misc/iwmc3200top/Kconfig"
+source "drivers/misc/ti-st/Kconfig"
 
 endif # MISC_DEVICES
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 36f733cd60e6..98009cc20cb9 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -3,22 +3,42 @@
 #
 
 obj-$(CONFIG_IBM_ASM)           += ibmasm/
-obj-$(CONFIG_HDPU_FEATURES)     += hdpuftrs/
+obj-$(CONFIG_AD525X_DPOT)       += ad525x_dpot.o
+obj-$(CONFIG_AD525X_DPOT_I2C)   += ad525x_dpot-i2c.o
+obj-$(CONFIG_AD525X_DPOT_SPI)   += ad525x_dpot-spi.o
 obj-$(CONFIG_ATMEL_PWM)         += atmel_pwm.o
 obj-$(CONFIG_ATMEL_SSC)         += atmel-ssc.o
 obj-$(CONFIG_ATMEL_TCLIB)       += atmel_tclib.o
+obj-$(CONFIG_BMP085)            += bmp085.o
 obj-$(CONFIG_ICS932S401)        += ics932s401.o
 obj-$(CONFIG_LKDTM)             += lkdtm.o
 obj-$(CONFIG_TIFM_CORE)         += tifm_core.o
 obj-$(CONFIG_TIFM_7XX1)         += tifm_7xx1.o
 obj-$(CONFIG_PHANTOM)           += phantom.o
+obj-$(CONFIG_SENSORS_BH1780)    += bh1780gli.o
+obj-$(CONFIG_SENSORS_BH1770)    += bh1770glc.o
+obj-$(CONFIG_SENSORS_APDS990X)  += apds990x.o
 obj-$(CONFIG_SGI_IOC4)          += ioc4.o
 obj-$(CONFIG_ENCLOSURE_SERVICES) += enclosure.o
 obj-$(CONFIG_KGDB_TESTS)        += kgdbts.o
 obj-$(CONFIG_SGI_XP)            += sgi-xp/
 obj-$(CONFIG_SGI_GRU)           += sgi-gru/
+obj-$(CONFIG_CS5535_MFGPT)      += cs5535-mfgpt.o
 obj-$(CONFIG_HP_ILO)            += hpilo.o
+obj-$(CONFIG_APDS9802ALS)       += apds9802als.o
 obj-$(CONFIG_ISL29003)          += isl29003.o
+obj-$(CONFIG_ISL29020)          += isl29020.o
+obj-$(CONFIG_SENSORS_TSL2550)   += tsl2550.o
+obj-$(CONFIG_EP93XX_PWM)        += ep93xx_pwm.o
+obj-$(CONFIG_DS1682)            += ds1682.o
+obj-$(CONFIG_TI_DAC7512)        += ti_dac7512.o
 obj-$(CONFIG_C2PORT)            += c2port/
+obj-$(CONFIG_IWMC3200TOP)      += iwmc3200top/
+obj-$(CONFIG_HMC6352)           += hmc6352.o
 obj-y                           += eeprom/
 obj-y                           += cb710/
+obj-$(CONFIG_VMWARE_BALLOON)    += vmw_balloon.o
+obj-$(CONFIG_ARM_CHARLCD)       += arm-charlcd.o
+obj-$(CONFIG_PCH_PHUB)          += pch_phub.o
+obj-y                           += ti-st/
+obj-$(CONFIG_AB8500_PWM)        += ab8500-pwm.o
diff --git a/drivers/misc/ab8500-pwm.c b/drivers/misc/ab8500-pwm.c
new file mode 100644
index 000000000000..54e3d05b63cc
--- /dev/null
+++ b/drivers/misc/ab8500-pwm.c
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) ST-Ericsson SA 2010
+ *
+ * Author: Arun R Murthy <arun.murthy@stericsson.com>
+ * License terms: GNU General Public License (GPL) version 2
+ */
+#include <linux/err.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/pwm.h>
+#include <linux/mfd/ab8500.h>
+#include <linux/mfd/abx500.h>
+
+/*
+ * PWM Out generators
+ * Bank: 0x10
+ */
+#define AB8500_PWM_OUT_CTRL1_REG        0x60
+#define AB8500_PWM_OUT_CTRL2_REG        0x61
+#define AB8500_PWM_OUT_CTRL7_REG        0x66
+
+/* backlight driver constants */
+#define ENABLE_PWM                      1
+#define DISABLE_PWM                     0
+
+struct pwm_device {
+        struct device *dev;
+        struct list_head node;
+        const char *label;
+        unsigned int pwm_id;
+};
+
+static LIST_HEAD(pwm_list);
+
+int pwm_config(struct pwm_device *pwm, int duty_ns, int period_ns)
+{
+        int ret = 0;
+        unsigned int higher_val, lower_val;
+        u8 reg;
+
+        /*
+         * get the first 8 bits that are be written to
+         * AB8500_PWM_OUT_CTRL1_REG[0:7]
+         */
+        lower_val = duty_ns & 0x00FF;
+        /*
+         * get bits [9:10] that are to be written to
+         * AB8500_PWM_OUT_CTRL2_REG[0:1]
+         */
+        higher_val = ((duty_ns & 0x0300) >> 8);
+
+        reg = AB8500_PWM_OUT_CTRL1_REG + ((pwm->pwm_id - 1) * 2);
+
+        ret = abx500_set_register_interruptible(pwm->dev, AB8500_MISC,
+                        reg, (u8)lower_val);
+        if (ret < 0)
+                return ret;
+        ret = abx500_set_register_interruptible(pwm->dev, AB8500_MISC,
+                        (reg + 1), (u8)higher_val);
+
+        return ret;
+}
+EXPORT_SYMBOL(pwm_config);
+
+int pwm_enable(struct pwm_device *pwm)
+{
+        int ret;
+
+        ret = abx500_mask_and_set_register_interruptible(pwm->dev,
+                                AB8500_MISC, AB8500_PWM_OUT_CTRL7_REG,
+                                1 << (pwm->pwm_id-1), ENABLE_PWM);
+        if (ret < 0)
+                dev_err(pwm->dev, "%s: Failed to disable PWM, Error %d\n",
+                                                        pwm->label, ret);
+        return ret;
+}
+EXPORT_SYMBOL(pwm_enable);
+
+void pwm_disable(struct pwm_device *pwm)
+{
+        int ret;
+
+        ret = abx500_mask_and_set_register_interruptible(pwm->dev,
+                                AB8500_MISC, AB8500_PWM_OUT_CTRL7_REG,
+                                1 << (pwm->pwm_id-1), DISABLE_PWM);
+        if (ret < 0)
+                dev_err(pwm->dev, "%s: Failed to disable PWM, Error %d\n",
+                                                        pwm->label, ret);
+        return;
+}
+EXPORT_SYMBOL(pwm_disable);
+
+struct pwm_device *pwm_request(int pwm_id, const char *label)
+{
+        struct pwm_device *pwm;
+
+        list_for_each_entry(pwm, &pwm_list, node) {
+                if (pwm->pwm_id == pwm_id) {
+                        pwm->label = label;
+                        pwm->pwm_id = pwm_id;
+                        return pwm;
+                }
+        }
+
+        return ERR_PTR(-ENOENT);
+}
+EXPORT_SYMBOL(pwm_request);
+
+void pwm_free(struct pwm_device *pwm)
+{
+        pwm_disable(pwm);
+}
+EXPORT_SYMBOL(pwm_free);
+
+static int __devinit ab8500_pwm_probe(struct platform_device *pdev)
+{
+        struct pwm_device *pwm;
+        /*
+         * Nothing to be done in probe, this is required to get the
+         * device which is required for ab8500 read and write
+         */
+        pwm = kzalloc(sizeof(struct pwm_device), GFP_KERNEL);
+        if (pwm == NULL) {
+                dev_err(&pdev->dev, "failed to allocate memory\n");
+                return -ENOMEM;
+        }
+        pwm->dev = &pdev->dev;
+        pwm->pwm_id = pdev->id;
+        list_add_tail(&pwm->node, &pwm_list);
+        platform_set_drvdata(pdev, pwm);
+        dev_dbg(pwm->dev, "pwm probe successful\n");
+        return 0;
+}
+
+static int __devexit ab8500_pwm_remove(struct platform_device *pdev)
+{
+        struct pwm_device *pwm = platform_get_drvdata(pdev);
+        list_del(&pwm->node);
+        dev_dbg(&pdev->dev, "pwm driver removed\n");
+        kfree(pwm);
+        return 0;
+}
+
+static struct platform_driver ab8500_pwm_driver = {
+        .driver = {
+                .name = "ab8500-pwm",
+                .owner = THIS_MODULE,
+        },
+        .probe = ab8500_pwm_probe,
+        .remove = __devexit_p(ab8500_pwm_remove),
+};
+
+static int __init ab8500_pwm_init(void)
+{
+        return platform_driver_register(&ab8500_pwm_driver);
+}
+
+static void __exit ab8500_pwm_exit(void)
+{
+        platform_driver_unregister(&ab8500_pwm_driver);
+}
+
+subsys_initcall(ab8500_pwm_init);
+module_exit(ab8500_pwm_exit);
+MODULE_AUTHOR("Arun MURTHY <arun.murthy@stericsson.com>");
+MODULE_DESCRIPTION("AB8500 Pulse Width Modulation Driver");
+MODULE_ALIAS("AB8500 PWM driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/misc/ad525x_dpot-i2c.c b/drivers/misc/ad525x_dpot-i2c.c
new file mode 100644
index 000000000000..4ff73c215746
--- /dev/null
+++ b/drivers/misc/ad525x_dpot-i2c.c
@@ -0,0 +1,136 @@
+/*
+ * Driver for the Analog Devices digital potentiometers (I2C bus)
+ *
+ * Copyright (C) 2010 Michael Hennerich, Analog Devices Inc.
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/i2c.h>
+#include <linux/module.h>
+
+#include "ad525x_dpot.h"
+
+/* ------------------------------------------------------------------------- */
+/* I2C bus functions */
+static int write_d8(void *client, u8 val)
+{
+        return i2c_smbus_write_byte(client, val);
+}
+
+static int write_r8d8(void *client, u8 reg, u8 val)
+{
+        return i2c_smbus_write_byte_data(client, reg, val);
+}
+
+static int write_r8d16(void *client, u8 reg, u16 val)
+{
+        return i2c_smbus_write_word_data(client, reg, val);
+}
+
+static int read_d8(void *client)
+{
+        return i2c_smbus_read_byte(client);
+}
+
+static int read_r8d8(void *client, u8 reg)
+{
+        return i2c_smbus_read_byte_data(client, reg);
+}
+
+static int read_r8d16(void *client, u8 reg)
+{
+        return i2c_smbus_read_word_data(client, reg);
+}
+
+static const struct ad_dpot_bus_ops bops = {
+        .read_d8        = read_d8,
+        .read_r8d8      = read_r8d8,
+        .read_r8d16     = read_r8d16,
+        .write_d8       = write_d8,
+        .write_r8d8     = write_r8d8,
+        .write_r8d16    = write_r8d16,
+};
+
+static int __devinit ad_dpot_i2c_probe(struct i2c_client *client,
+                                      const struct i2c_device_id *id)
+{
+        struct ad_dpot_bus_data bdata = {
+                .client = client,
+                .bops = &bops,
+        };
+
+        struct ad_dpot_id dpot_id = {
+                .name = (char *) &id->name,
+                .devid = id->driver_data,
+        };
+
+        if (!i2c_check_functionality(client->adapter,
+                                     I2C_FUNC_SMBUS_WORD_DATA)) {
+                dev_err(&client->dev, "SMBUS Word Data not Supported\n");
+                return -EIO;
+        }
+
+        return ad_dpot_probe(&client->dev, &bdata, &dpot_id);
+}
+
+static int __devexit ad_dpot_i2c_remove(struct i2c_client *client)
+{
+        return ad_dpot_remove(&client->dev);
+}
+
+static const struct i2c_device_id ad_dpot_id[] = {
+        {"ad5258", AD5258_ID},
+        {"ad5259", AD5259_ID},
+        {"ad5251", AD5251_ID},
+        {"ad5252", AD5252_ID},
+        {"ad5253", AD5253_ID},
+        {"ad5254", AD5254_ID},
+        {"ad5255", AD5255_ID},
+        {"ad5241", AD5241_ID},
+        {"ad5242", AD5242_ID},
+        {"ad5243", AD5243_ID},
+        {"ad5245", AD5245_ID},
+        {"ad5246", AD5246_ID},
+        {"ad5247", AD5247_ID},
+        {"ad5248", AD5248_ID},
+        {"ad5280", AD5280_ID},
+        {"ad5282", AD5282_ID},
+        {"adn2860", ADN2860_ID},
+        {"ad5273", AD5273_ID},
+        {"ad5171", AD5171_ID},
+        {"ad5170", AD5170_ID},
+        {"ad5172", AD5172_ID},
+        {"ad5173", AD5173_ID},
+        {"ad5272", AD5272_ID},
+        {"ad5274", AD5274_ID},
+        {}
+};
+MODULE_DEVICE_TABLE(i2c, ad_dpot_id);
+
+static struct i2c_driver ad_dpot_i2c_driver = {
+        .driver = {
+                .name   = "ad_dpot",
+                .owner  = THIS_MODULE,
+        },
+        .probe          = ad_dpot_i2c_probe,
+        .remove         = __devexit_p(ad_dpot_i2c_remove),
+        .id_table       = ad_dpot_id,
+};
+
+static int __init ad_dpot_i2c_init(void)
+{
+        return i2c_add_driver(&ad_dpot_i2c_driver);
+}
+module_init(ad_dpot_i2c_init);
+
+static void __exit ad_dpot_i2c_exit(void)
+{
+        i2c_del_driver(&ad_dpot_i2c_driver);
+}
+module_exit(ad_dpot_i2c_exit);
+
+MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
+MODULE_DESCRIPTION("digital potentiometer I2C bus driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("i2c:ad_dpot");
diff --git a/drivers/misc/ad525x_dpot-spi.c b/drivers/misc/ad525x_dpot-spi.c
new file mode 100644
index 000000000000..7f9a55afe05d
--- /dev/null
+++ b/drivers/misc/ad525x_dpot-spi.c
@@ -0,0 +1,174 @@
+/*
+ * Driver for the Analog Devices digital potentiometers (SPI bus)
+ *
+ * Copyright (C) 2010 Michael Hennerich, Analog Devices Inc.
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/spi/spi.h>
+#include <linux/module.h>
+
+#include "ad525x_dpot.h"
+
+static const struct ad_dpot_id ad_dpot_spi_devlist[] = {
+        {.name = "ad5160", .devid = AD5160_ID},
+        {.name = "ad5161", .devid = AD5161_ID},
+        {.name = "ad5162", .devid = AD5162_ID},
+        {.name = "ad5165", .devid = AD5165_ID},
+        {.name = "ad5200", .devid = AD5200_ID},
+        {.name = "ad5201", .devid = AD5201_ID},
+        {.name = "ad5203", .devid = AD5203_ID},
+        {.name = "ad5204", .devid = AD5204_ID},
+        {.name = "ad5206", .devid = AD5206_ID},
+        {.name = "ad5207", .devid = AD5207_ID},
+        {.name = "ad5231", .devid = AD5231_ID},
+        {.name = "ad5232", .devid = AD5232_ID},
+        {.name = "ad5233", .devid = AD5233_ID},
+        {.name = "ad5235", .devid = AD5235_ID},
+        {.name = "ad5260", .devid = AD5260_ID},
+        {.name = "ad5262", .devid = AD5262_ID},
+        {.name = "ad5263", .devid = AD5263_ID},
+        {.name = "ad5290", .devid = AD5290_ID},
+        {.name = "ad5291", .devid = AD5291_ID},
+        {.name = "ad5292", .devid = AD5292_ID},
+        {.name = "ad5293", .devid = AD5293_ID},
+        {.name = "ad7376", .devid = AD7376_ID},
+        {.name = "ad8400", .devid = AD8400_ID},
+        {.name = "ad8402", .devid = AD8402_ID},
+        {.name = "ad8403", .devid = AD8403_ID},
+        {.name = "adn2850", .devid = ADN2850_ID},
+        {.name = "ad5270", .devid = AD5270_ID},
+        {.name = "ad5271", .devid = AD5271_ID},
+        {}
+};
+
+/* ------------------------------------------------------------------------- */
+
+/* SPI bus functions */
+static int write8(void *client, u8 val)
+{
+        u8 data = val;
+        return spi_write(client, &data, 1);
+}
+
+static int write16(void *client, u8 reg, u8 val)
+{
+        u8 data[2] = {reg, val};
+        return spi_write(client, data, 2);
+}
+
+static int write24(void *client, u8 reg, u16 val)
+{
+        u8 data[3] = {reg, val >> 8, val};
+        return spi_write(client, data, 3);
+}
+
+static int read8(void *client)
+{
+        int ret;
+        u8 data;
+        ret = spi_read(client, &data, 1);
+        if (ret < 0)
+                return ret;
+
+        return data;
+}
+
+static int read16(void *client, u8 reg)
+{
+        int ret;
+        u8 buf_rx[2];
+
+        write16(client, reg, 0);
+        ret = spi_read(client, buf_rx, 2);
+        if (ret < 0)
+                return ret;
+
+        return (buf_rx[0] << 8) |  buf_rx[1];
+}
+
+static int read24(void *client, u8 reg)
+{
+        int ret;
+        u8 buf_rx[3];
+
+        write24(client, reg, 0);
+        ret = spi_read(client, buf_rx, 3);
+        if (ret < 0)
+                return ret;
+
+        return (buf_rx[1] << 8) |  buf_rx[2];
+}
+
+static const struct ad_dpot_bus_ops bops = {
+        .read_d8        = read8,
+        .read_r8d8      = read16,
+        .read_r8d16     = read24,
+        .write_d8       = write8,
+        .write_r8d8     = write16,
+        .write_r8d16    = write24,
+};
+
+static const struct ad_dpot_id *dpot_match_id(const struct ad_dpot_id *id,
+                                                char *name)
+{
+        while (id->name && id->name[0]) {
+                if (strcmp(name, id->name) == 0)
+                        return id;
+                id++;
+        }
+        return NULL;
+}
+
+static int __devinit ad_dpot_spi_probe(struct spi_device *spi)
+{
+        char *name = spi->dev.platform_data;
+        const struct ad_dpot_id *dpot_id;
+
+        struct ad_dpot_bus_data bdata = {
+                .client = spi,
+                .bops = &bops,
+        };
+
+        dpot_id = dpot_match_id(ad_dpot_spi_devlist, name);
+
+        if (dpot_id == NULL) {
+                dev_err(&spi->dev, "%s not in supported device list", name);
+                return -ENODEV;
+        }
+
+        return ad_dpot_probe(&spi->dev, &bdata, dpot_id);
+}
+
+static int __devexit ad_dpot_spi_remove(struct spi_device *spi)
+{
+        return ad_dpot_remove(&spi->dev);
+}
+
+static struct spi_driver ad_dpot_spi_driver = {
+        .driver = {
+                .name   = "ad_dpot",
+                .bus    = &spi_bus_type,
+                .owner  = THIS_MODULE,
+        },
+        .probe          = ad_dpot_spi_probe,
+        .remove         = __devexit_p(ad_dpot_spi_remove),
+};
+
+static int __init ad_dpot_spi_init(void)
+{
+        return spi_register_driver(&ad_dpot_spi_driver);
+}
+module_init(ad_dpot_spi_init);
+
+static void __exit ad_dpot_spi_exit(void)
+{
+        spi_unregister_driver(&ad_dpot_spi_driver);
+}
+module_exit(ad_dpot_spi_exit);
+
+MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
+MODULE_DESCRIPTION("digital potentiometer SPI bus driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("spi:ad_dpot");
diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c
new file mode 100644
index 000000000000..7cb911028d09
--- /dev/null
+++ b/drivers/misc/ad525x_dpot.c
@@ -0,0 +1,773 @@
+/*
+ * ad525x_dpot: Driver for the Analog Devices digital potentiometers
+ * Copyright (c) 2009-2010 Analog Devices, Inc.
+ * Author: Michael Hennerich <hennerich@blackfin.uclinux.org>
+ *
+ * DEVID                #Wipers         #Positions      Resistor Options (kOhm)
+ * AD5258               1               64              1, 10, 50, 100
+ * AD5259               1               256             5, 10, 50, 100
+ * AD5251               2               64              1, 10, 50, 100
+ * AD5252               2               256             1, 10, 50, 100
+ * AD5255               3               512             25, 250
+ * AD5253               4               64              1, 10, 50, 100
+ * AD5254               4               256             1, 10, 50, 100
+ * AD5160               1               256             5, 10, 50, 100
+ * AD5161               1               256             5, 10, 50, 100
+ * AD5162               2               256             2.5, 10, 50, 100
+ * AD5165               1               256             100
+ * AD5200               1               256             10, 50
+ * AD5201               1               33              10, 50
+ * AD5203               4               64              10, 100
+ * AD5204               4               256             10, 50, 100
+ * AD5206               6               256             10, 50, 100
+ * AD5207               2               256             10, 50, 100
+ * AD5231               1               1024            10, 50, 100
+ * AD5232               2               256             10, 50, 100
+ * AD5233               4               64              10, 50, 100
+ * AD5235               2               1024            25, 250
+ * AD5260               1               256             20, 50, 200
+ * AD5262               2               256             20, 50, 200
+ * AD5263               4               256             20, 50, 200
+ * AD5290               1               256             10, 50, 100
+ * AD5291               1               256             20, 50, 100  (20-TP)
+ * AD5292               1               1024            20, 50, 100  (20-TP)
+ * AD5293               1               1024            20, 50, 100
+ * AD7376               1               128             10, 50, 100, 1M
+ * AD8400               1               256             1, 10, 50, 100
+ * AD8402               2               256             1, 10, 50, 100
+ * AD8403               4               256             1, 10, 50, 100
+ * ADN2850              3               512             25, 250
+ * AD5241               1               256             10, 100, 1M
+ * AD5246               1               128             5, 10, 50, 100
+ * AD5247               1               128             5, 10, 50, 100
+ * AD5245               1               256             5, 10, 50, 100
+ * AD5243               2               256             2.5, 10, 50, 100
+ * AD5248               2               256             2.5, 10, 50, 100
+ * AD5242               2               256             20, 50, 200
+ * AD5280               1               256             20, 50, 200
+ * AD5282               2               256             20, 50, 200
+ * ADN2860              3               512             25, 250
+ * AD5273               1               64              1, 10, 50, 100 (OTP)
+ * AD5171               1               64              5, 10, 50, 100 (OTP)
+ * AD5170               1               256             2.5, 10, 50, 100 (OTP)
+ * AD5172               2               256             2.5, 10, 50, 100 (OTP)
+ * AD5173               2               256             2.5, 10, 50, 100 (OTP)
+ * AD5270               1               1024            20, 50, 100 (50-TP)
+ * AD5271               1               256             20, 50, 100 (50-TP)
+ * AD5272               1               1024            20, 50, 100 (50-TP)
+ * AD5274               1               256             20, 50, 100 (50-TP)
+ *
+ * See Documentation/misc-devices/ad525x_dpot.txt for more info.
+ *
+ * derived from ad5258.c
+ * Copyright (c) 2009 Cyber Switching, Inc.
+ * Author: Chris Verges <chrisv@cyberswitching.com>
+ *
+ * derived from ad5252.c
+ * Copyright (c) 2006 Michael Hennerich <hennerich@blackfin.uclinux.org>
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+
+#define DRIVER_VERSION                  "0.2"
+
+#include "ad525x_dpot.h"
+
+/*
+ * Client data (each client gets its own)
+ */
+
+struct dpot_data {
+        struct ad_dpot_bus_data bdata;
+        struct mutex update_lock;
+        unsigned rdac_mask;
+        unsigned max_pos;
+        unsigned long devid;
+        unsigned uid;
+        unsigned feat;
+        unsigned wipers;
+        u16 rdac_cache[MAX_RDACS];
+        DECLARE_BITMAP(otp_en_mask, MAX_RDACS);
+};
+
+static inline int dpot_read_d8(struct dpot_data *dpot)
+{
+        return dpot->bdata.bops->read_d8(dpot->bdata.client);
+}
+
+static inline int dpot_read_r8d8(struct dpot_data *dpot, u8 reg)
+{
+        return dpot->bdata.bops->read_r8d8(dpot->bdata.client, reg);
+}
+
+static inline int dpot_read_r8d16(struct dpot_data *dpot, u8 reg)
+{
+        return dpot->bdata.bops->read_r8d16(dpot->bdata.client, reg);
+}
+
+static inline int dpot_write_d8(struct dpot_data *dpot, u8 val)
+{
+        return dpot->bdata.bops->write_d8(dpot->bdata.client, val);
+}
+
+static inline int dpot_write_r8d8(struct dpot_data *dpot, u8 reg, u16 val)
+{
+        return dpot->bdata.bops->write_r8d8(dpot->bdata.client, reg, val);
+}
+
+static inline int dpot_write_r8d16(struct dpot_data *dpot, u8 reg, u16 val)
+{
+        return dpot->bdata.bops->write_r8d16(dpot->bdata.client, reg, val);
+}
+
+static s32 dpot_read_spi(struct dpot_data *dpot, u8 reg)
+{
+        unsigned ctrl = 0;
+        int value;
+
+        if (!(reg & (DPOT_ADDR_EEPROM | DPOT_ADDR_CMD))) {
+
+                if (dpot->feat & F_RDACS_WONLY)
+                        return dpot->rdac_cache[reg & DPOT_RDAC_MASK];
+                if (dpot->uid == DPOT_UID(AD5291_ID) ||
+                        dpot->uid == DPOT_UID(AD5292_ID) ||
+                        dpot->uid == DPOT_UID(AD5293_ID)) {
+
+                        value = dpot_read_r8d8(dpot,
+                                DPOT_AD5291_READ_RDAC << 2);
+
+                        if (dpot->uid == DPOT_UID(AD5291_ID))
+                                value = value >> 2;
+
+                        return value;
+                } else if (dpot->uid == DPOT_UID(AD5270_ID) ||
+                        dpot->uid == DPOT_UID(AD5271_ID)) {
+
+                        value = dpot_read_r8d8(dpot,
+                                DPOT_AD5270_1_2_4_READ_RDAC << 2);
+
+                        if (value < 0)
+                                return value;
+
+                        if (dpot->uid == DPOT_UID(AD5271_ID))
+                                value = value >> 2;
+
+                        return value;
+                }
+
+                ctrl = DPOT_SPI_READ_RDAC;
+        } else if (reg & DPOT_ADDR_EEPROM) {
+                ctrl = DPOT_SPI_READ_EEPROM;
+        }
+
+        if (dpot->feat & F_SPI_16BIT)
+                return dpot_read_r8d8(dpot, ctrl);
+        else if (dpot->feat & F_SPI_24BIT)
+                return dpot_read_r8d16(dpot, ctrl);
+
+        return -EFAULT;
+}
+
+static s32 dpot_read_i2c(struct dpot_data *dpot, u8 reg)
+{
+        int value;
+        unsigned ctrl = 0;
+        switch (dpot->uid) {
+        case DPOT_UID(AD5246_ID):
+        case DPOT_UID(AD5247_ID):
+                return dpot_read_d8(dpot);
+        case DPOT_UID(AD5245_ID):
+        case DPOT_UID(AD5241_ID):
+        case DPOT_UID(AD5242_ID):
+        case DPOT_UID(AD5243_ID):
+        case DPOT_UID(AD5248_ID):
+        case DPOT_UID(AD5280_ID):
+        case DPOT_UID(AD5282_ID):
+                ctrl = ((reg & DPOT_RDAC_MASK) == DPOT_RDAC0) ?
+                        0 : DPOT_AD5282_RDAC_AB;
+                return dpot_read_r8d8(dpot, ctrl);
+        case DPOT_UID(AD5170_ID):
+        case DPOT_UID(AD5171_ID):
+        case DPOT_UID(AD5273_ID):
+                        return dpot_read_d8(dpot);
+        case DPOT_UID(AD5172_ID):
+        case DPOT_UID(AD5173_ID):
+                ctrl = ((reg & DPOT_RDAC_MASK) == DPOT_RDAC0) ?
+                        0 : DPOT_AD5172_3_A0;
+                return dpot_read_r8d8(dpot, ctrl);
+        case DPOT_UID(AD5272_ID):
+        case DPOT_UID(AD5274_ID):
+                        dpot_write_r8d8(dpot,
+                                (DPOT_AD5270_1_2_4_READ_RDAC << 2), 0);
+
+                        value = dpot_read_r8d16(dpot,
+                                DPOT_AD5270_1_2_4_RDAC << 2);
+
+                        if (value < 0)
+                                return value;
+                        /*
+                         * AD5272/AD5274 returns high byte first, however
+                         * underling smbus expects low byte first.
+                         */
+                        value = swab16(value);
+
+                        if (dpot->uid == DPOT_UID(AD5271_ID))
+                                value = value >> 2;
+                return value;
+        default:
+                if ((reg & DPOT_REG_TOL) || (dpot->max_pos > 256))
+                        return dpot_read_r8d16(dpot, (reg & 0xF8) |
+                                        ((reg & 0x7) << 1));
+                else
+                        return dpot_read_r8d8(dpot, reg);
+        }
+}
+
+static s32 dpot_read(struct dpot_data *dpot, u8 reg)
+{
+        if (dpot->feat & F_SPI)
+                return dpot_read_spi(dpot, reg);
+        else
+                return dpot_read_i2c(dpot, reg);
+}
+
+static s32 dpot_write_spi(struct dpot_data *dpot, u8 reg, u16 value)
+{
+        unsigned val = 0;
+
+        if (!(reg & (DPOT_ADDR_EEPROM | DPOT_ADDR_CMD | DPOT_ADDR_OTP))) {
+                if (dpot->feat & F_RDACS_WONLY)
+                        dpot->rdac_cache[reg & DPOT_RDAC_MASK] = value;
+
+                if (dpot->feat & F_AD_APPDATA) {
+                        if (dpot->feat & F_SPI_8BIT) {
+                                val = ((reg & DPOT_RDAC_MASK) <<
+                                        DPOT_MAX_POS(dpot->devid)) |
+                                        value;
+                                return dpot_write_d8(dpot, val);
+                        } else if (dpot->feat & F_SPI_16BIT) {
+                                val = ((reg & DPOT_RDAC_MASK) <<
+                                        DPOT_MAX_POS(dpot->devid)) |
+                                        value;
+                                return dpot_write_r8d8(dpot, val >> 8,
+                                        val & 0xFF);
+                        } else
+                                BUG();
+                } else {
+                        if (dpot->uid == DPOT_UID(AD5291_ID) ||
+                                dpot->uid == DPOT_UID(AD5292_ID) ||
+                                dpot->uid == DPOT_UID(AD5293_ID)) {
+
+                                dpot_write_r8d8(dpot, DPOT_AD5291_CTRLREG << 2,
+                                                DPOT_AD5291_UNLOCK_CMD);
+
+                                if (dpot->uid == DPOT_UID(AD5291_ID))
+                                        value = value << 2;
+
+                                return dpot_write_r8d8(dpot,
+                                        (DPOT_AD5291_RDAC << 2) |
+                                        (value >> 8), value & 0xFF);
+                        } else if (dpot->uid == DPOT_UID(AD5270_ID) ||
+                                dpot->uid == DPOT_UID(AD5271_ID)) {
+                                dpot_write_r8d8(dpot,
+                                                DPOT_AD5270_1_2_4_CTRLREG << 2,
+                                                DPOT_AD5270_1_2_4_UNLOCK_CMD);
+
+                                if (dpot->uid == DPOT_UID(AD5271_ID))
+                                        value = value << 2;
+
+                                return dpot_write_r8d8(dpot,
+                                        (DPOT_AD5270_1_2_4_RDAC << 2) |
+                                        (value >> 8), value & 0xFF);
+                        }
+                        val = DPOT_SPI_RDAC | (reg & DPOT_RDAC_MASK);
+                }
+        } else if (reg & DPOT_ADDR_EEPROM) {
+                val = DPOT_SPI_EEPROM | (reg & DPOT_RDAC_MASK);
+        } else if (reg & DPOT_ADDR_CMD) {
+                switch (reg) {
+                case DPOT_DEC_ALL_6DB:
+                        val = DPOT_SPI_DEC_ALL_6DB;
+                        break;
+                case DPOT_INC_ALL_6DB:
+                        val = DPOT_SPI_INC_ALL_6DB;
+                        break;
+                case DPOT_DEC_ALL:
+                        val = DPOT_SPI_DEC_ALL;
+                        break;
+                case DPOT_INC_ALL:
+                        val = DPOT_SPI_INC_ALL;
+                        break;
+                }
+        } else if (reg & DPOT_ADDR_OTP) {
+                if (dpot->uid == DPOT_UID(AD5291_ID) ||
+                        dpot->uid == DPOT_UID(AD5292_ID)) {
+                        return dpot_write_r8d8(dpot,
+                                DPOT_AD5291_STORE_XTPM << 2, 0);
+                } else if (dpot->uid == DPOT_UID(AD5270_ID) ||
+                        dpot->uid == DPOT_UID(AD5271_ID)) {
+                        return dpot_write_r8d8(dpot,
+                                DPOT_AD5270_1_2_4_STORE_XTPM << 2, 0);
+                }
+        } else
+                BUG();
+
+        if (dpot->feat & F_SPI_16BIT)
+                return dpot_write_r8d8(dpot, val, value);
+        else if (dpot->feat & F_SPI_24BIT)
+                return dpot_write_r8d16(dpot, val, value);
+
+        return -EFAULT;
+}
+
+static s32 dpot_write_i2c(struct dpot_data *dpot, u8 reg, u16 value)
+{
+        /* Only write the instruction byte for certain commands */
+        unsigned tmp = 0, ctrl = 0;
+
+        switch (dpot->uid) {
+        case DPOT_UID(AD5246_ID):
+        case DPOT_UID(AD5247_ID):
+                return dpot_write_d8(dpot, value);
+                break;
+
+        case DPOT_UID(AD5245_ID):
+        case DPOT_UID(AD5241_ID):
+        case DPOT_UID(AD5242_ID):
+        case DPOT_UID(AD5243_ID):
+        case DPOT_UID(AD5248_ID):
+        case DPOT_UID(AD5280_ID):
+        case DPOT_UID(AD5282_ID):
+                ctrl = ((reg & DPOT_RDAC_MASK) == DPOT_RDAC0) ?
+                        0 : DPOT_AD5282_RDAC_AB;
+                return dpot_write_r8d8(dpot, ctrl, value);
+                break;
+        case DPOT_UID(AD5171_ID):
+        case DPOT_UID(AD5273_ID):
+                if (reg & DPOT_ADDR_OTP) {
+                        tmp = dpot_read_d8(dpot);
+                        if (tmp >> 6) /* Ready to Program? */
+                                return -EFAULT;
+                        ctrl = DPOT_AD5273_FUSE;
+                }
+                return dpot_write_r8d8(dpot, ctrl, value);
+                break;
+        case DPOT_UID(AD5172_ID):
+        case DPOT_UID(AD5173_ID):
+                ctrl = ((reg & DPOT_RDAC_MASK) == DPOT_RDAC0) ?
+                        0 : DPOT_AD5172_3_A0;
+                if (reg & DPOT_ADDR_OTP) {
+                        tmp = dpot_read_r8d16(dpot, ctrl);
+                        if (tmp >> 14) /* Ready to Program? */
+                                return -EFAULT;
+                        ctrl |= DPOT_AD5170_2_3_FUSE;
+                }
+                return dpot_write_r8d8(dpot, ctrl, value);
+                break;
+        case DPOT_UID(AD5170_ID):
+                if (reg & DPOT_ADDR_OTP) {
+                        tmp = dpot_read_r8d16(dpot, tmp);
+                        if (tmp >> 14) /* Ready to Program? */
+                                return -EFAULT;
+                        ctrl = DPOT_AD5170_2_3_FUSE;
+                }
+                return dpot_write_r8d8(dpot, ctrl, value);
+                break;
+        case DPOT_UID(AD5272_ID):
+        case DPOT_UID(AD5274_ID):
+                dpot_write_r8d8(dpot, DPOT_AD5270_1_2_4_CTRLREG << 2,
+                                DPOT_AD5270_1_2_4_UNLOCK_CMD);
+
+                if (reg & DPOT_ADDR_OTP)
+                        return dpot_write_r8d8(dpot,
+                                        DPOT_AD5270_1_2_4_STORE_XTPM << 2, 0);
+
+                if (dpot->uid == DPOT_UID(AD5274_ID))
+                        value = value << 2;
+
+                return dpot_write_r8d8(dpot, (DPOT_AD5270_1_2_4_RDAC << 2) |
+                                       (value >> 8), value & 0xFF);
+                break;
+        default:
+                if (reg & DPOT_ADDR_CMD)
+                        return dpot_write_d8(dpot, reg);
+
+                if (dpot->max_pos > 256)
+                        return dpot_write_r8d16(dpot, (reg & 0xF8) |
+                                                ((reg & 0x7) << 1), value);
+                else
+                        /* All other registers require instruction + data bytes */
+                        return dpot_write_r8d8(dpot, reg, value);
+        }
+}
+
+static s32 dpot_write(struct dpot_data *dpot, u8 reg, u16 value)
+{
+        if (dpot->feat & F_SPI)
+                return dpot_write_spi(dpot, reg, value);
+        else
+                return dpot_write_i2c(dpot, reg, value);
+}
+
+/* sysfs functions */
+
+static ssize_t sysfs_show_reg(struct device *dev,
+                              struct device_attribute *attr,
+                              char *buf, u32 reg)
+{
+        struct dpot_data *data = dev_get_drvdata(dev);
+        s32 value;
+
+        if (reg & DPOT_ADDR_OTP_EN)
+                return sprintf(buf, "%s\n",
+                        test_bit(DPOT_RDAC_MASK & reg, data->otp_en_mask) ?
+                        "enabled" : "disabled");
+
+
+        mutex_lock(&data->update_lock);
+        value = dpot_read(data, reg);
+        mutex_unlock(&data->update_lock);
+
+        if (value < 0)
+                return -EINVAL;
+        /*
+         * Let someone else deal with converting this ...
+         * the tolerance is a two-byte value where the MSB
+         * is a sign + integer value, and the LSB is a
+         * decimal value.  See page 18 of the AD5258
+         * datasheet (Rev. A) for more details.
+         */
+
+        if (reg & DPOT_REG_TOL)
+                return sprintf(buf, "0x%04x\n", value & 0xFFFF);
+        else
+                return sprintf(buf, "%u\n", value & data->rdac_mask);
+}
+
+static ssize_t sysfs_set_reg(struct device *dev,
+                             struct device_attribute *attr,
+                             const char *buf, size_t count, u32 reg)
+{
+        struct dpot_data *data = dev_get_drvdata(dev);
+        unsigned long value;
+        int err;
+
+        if (reg & DPOT_ADDR_OTP_EN) {
+                if (!strncmp(buf, "enabled", sizeof("enabled")))
+                        set_bit(DPOT_RDAC_MASK & reg, data->otp_en_mask);
+                else
+                        clear_bit(DPOT_RDAC_MASK & reg, data->otp_en_mask);
+
+                return count;
+        }
+
+        if ((reg & DPOT_ADDR_OTP) &&
+                !test_bit(DPOT_RDAC_MASK & reg, data->otp_en_mask))
+                return -EPERM;
+
+        err = strict_strtoul(buf, 10, &value);
+        if (err)
+                return err;
+
+        if (value > data->rdac_mask)
+                value = data->rdac_mask;
+
+        mutex_lock(&data->update_lock);
+        dpot_write(data, reg, value);
+        if (reg & DPOT_ADDR_EEPROM)
+                msleep(26);     /* Sleep while the EEPROM updates */
+        else if (reg & DPOT_ADDR_OTP)
+                msleep(400);    /* Sleep while the OTP updates */
+        mutex_unlock(&data->update_lock);
+
+        return count;
+}
+
+static ssize_t sysfs_do_cmd(struct device *dev,
+                            struct device_attribute *attr,
+                            const char *buf, size_t count, u32 reg)
+{
+        struct dpot_data *data = dev_get_drvdata(dev);
+
+        mutex_lock(&data->update_lock);
+        dpot_write(data, reg, 0);
+        mutex_unlock(&data->update_lock);
+
+        return count;
+}
+
+/* ------------------------------------------------------------------------- */
+
+#define DPOT_DEVICE_SHOW(_name, _reg) static ssize_t \
+show_##_name(struct device *dev, \
+                          struct device_attribute *attr, char *buf) \
+{ \
+        return sysfs_show_reg(dev, attr, buf, _reg); \
+}
+
+#define DPOT_DEVICE_SET(_name, _reg) static ssize_t \
+set_##_name(struct device *dev, \
+                         struct device_attribute *attr, \
+                         const char *buf, size_t count) \
+{ \
+        return sysfs_set_reg(dev, attr, buf, count, _reg); \
+}
+
+#define DPOT_DEVICE_SHOW_SET(name, reg) \
+DPOT_DEVICE_SHOW(name, reg) \
+DPOT_DEVICE_SET(name, reg) \
+static DEVICE_ATTR(name, S_IWUSR | S_IRUGO, show_##name, set_##name);
+
+#define DPOT_DEVICE_SHOW_ONLY(name, reg) \
+DPOT_DEVICE_SHOW(name, reg) \
+static DEVICE_ATTR(name, S_IWUSR | S_IRUGO, show_##name, NULL);
+
+DPOT_DEVICE_SHOW_SET(rdac0, DPOT_ADDR_RDAC | DPOT_RDAC0);
+DPOT_DEVICE_SHOW_SET(eeprom0, DPOT_ADDR_EEPROM | DPOT_RDAC0);
+DPOT_DEVICE_SHOW_ONLY(tolerance0, DPOT_ADDR_EEPROM | DPOT_TOL_RDAC0);
+DPOT_DEVICE_SHOW_SET(otp0, DPOT_ADDR_OTP | DPOT_RDAC0);
+DPOT_DEVICE_SHOW_SET(otp0en, DPOT_ADDR_OTP_EN | DPOT_RDAC0);
+
+DPOT_DEVICE_SHOW_SET(rdac1, DPOT_ADDR_RDAC | DPOT_RDAC1);
+DPOT_DEVICE_SHOW_SET(eeprom1, DPOT_ADDR_EEPROM | DPOT_RDAC1);
+DPOT_DEVICE_SHOW_ONLY(tolerance1, DPOT_ADDR_EEPROM | DPOT_TOL_RDAC1);
+DPOT_DEVICE_SHOW_SET(otp1, DPOT_ADDR_OTP | DPOT_RDAC1);
+DPOT_DEVICE_SHOW_SET(otp1en, DPOT_ADDR_OTP_EN | DPOT_RDAC1);
+
+DPOT_DEVICE_SHOW_SET(rdac2, DPOT_ADDR_RDAC | DPOT_RDAC2);
+DPOT_DEVICE_SHOW_SET(eeprom2, DPOT_ADDR_EEPROM | DPOT_RDAC2);
+DPOT_DEVICE_SHOW_ONLY(tolerance2, DPOT_ADDR_EEPROM | DPOT_TOL_RDAC2);
+DPOT_DEVICE_SHOW_SET(otp2, DPOT_ADDR_OTP | DPOT_RDAC2);
+DPOT_DEVICE_SHOW_SET(otp2en, DPOT_ADDR_OTP_EN | DPOT_RDAC2);
+
+DPOT_DEVICE_SHOW_SET(rdac3, DPOT_ADDR_RDAC | DPOT_RDAC3);
+DPOT_DEVICE_SHOW_SET(eeprom3, DPOT_ADDR_EEPROM | DPOT_RDAC3);
+DPOT_DEVICE_SHOW_ONLY(tolerance3, DPOT_ADDR_EEPROM | DPOT_TOL_RDAC3);
+DPOT_DEVICE_SHOW_SET(otp3, DPOT_ADDR_OTP | DPOT_RDAC3);
+DPOT_DEVICE_SHOW_SET(otp3en, DPOT_ADDR_OTP_EN | DPOT_RDAC3);
+
+DPOT_DEVICE_SHOW_SET(rdac4, DPOT_ADDR_RDAC | DPOT_RDAC4);
+DPOT_DEVICE_SHOW_SET(eeprom4, DPOT_ADDR_EEPROM | DPOT_RDAC4);
+DPOT_DEVICE_SHOW_ONLY(tolerance4, DPOT_ADDR_EEPROM | DPOT_TOL_RDAC4);
+DPOT_DEVICE_SHOW_SET(otp4, DPOT_ADDR_OTP | DPOT_RDAC4);
+DPOT_DEVICE_SHOW_SET(otp4en, DPOT_ADDR_OTP_EN | DPOT_RDAC4);
+
+DPOT_DEVICE_SHOW_SET(rdac5, DPOT_ADDR_RDAC | DPOT_RDAC5);
+DPOT_DEVICE_SHOW_SET(eeprom5, DPOT_ADDR_EEPROM | DPOT_RDAC5);
+DPOT_DEVICE_SHOW_ONLY(tolerance5, DPOT_ADDR_EEPROM | DPOT_TOL_RDAC5);
+DPOT_DEVICE_SHOW_SET(otp5, DPOT_ADDR_OTP | DPOT_RDAC5);
+DPOT_DEVICE_SHOW_SET(otp5en, DPOT_ADDR_OTP_EN | DPOT_RDAC5);
+
+static const struct attribute *dpot_attrib_wipers[] = {
+        &dev_attr_rdac0.attr,
+        &dev_attr_rdac1.attr,
+        &dev_attr_rdac2.attr,
+        &dev_attr_rdac3.attr,
+        &dev_attr_rdac4.attr,
+        &dev_attr_rdac5.attr,
+        NULL
+};
+
+static const struct attribute *dpot_attrib_eeprom[] = {
+        &dev_attr_eeprom0.attr,
+        &dev_attr_eeprom1.attr,
+        &dev_attr_eeprom2.attr,
+        &dev_attr_eeprom3.attr,
+        &dev_attr_eeprom4.attr,
+        &dev_attr_eeprom5.attr,
+        NULL
+};
+
+static const struct attribute *dpot_attrib_otp[] = {
+        &dev_attr_otp0.attr,
+        &dev_attr_otp1.attr,
+        &dev_attr_otp2.attr,
+        &dev_attr_otp3.attr,
+        &dev_attr_otp4.attr,
+        &dev_attr_otp5.attr,
+        NULL
+};
+
+static const struct attribute *dpot_attrib_otp_en[] = {
+        &dev_attr_otp0en.attr,
+        &dev_attr_otp1en.attr,
+        &dev_attr_otp2en.attr,
+        &dev_attr_otp3en.attr,
+        &dev_attr_otp4en.attr,
+        &dev_attr_otp5en.attr,
+        NULL
+};
+
+static const struct attribute *dpot_attrib_tolerance[] = {
+        &dev_attr_tolerance0.attr,
+        &dev_attr_tolerance1.attr,
+        &dev_attr_tolerance2.attr,
+        &dev_attr_tolerance3.attr,
+        &dev_attr_tolerance4.attr,
+        &dev_attr_tolerance5.attr,
+        NULL
+};
+
+/* ------------------------------------------------------------------------- */
+
+#define DPOT_DEVICE_DO_CMD(_name, _cmd) static ssize_t \
+set_##_name(struct device *dev, \
+                         struct device_attribute *attr, \
+                         const char *buf, size_t count) \
+{ \
+        return sysfs_do_cmd(dev, attr, buf, count, _cmd); \
+} \
+static DEVICE_ATTR(_name, S_IWUSR | S_IRUGO, NULL, set_##_name);
+
+DPOT_DEVICE_DO_CMD(inc_all, DPOT_INC_ALL);
+DPOT_DEVICE_DO_CMD(dec_all, DPOT_DEC_ALL);
+DPOT_DEVICE_DO_CMD(inc_all_6db, DPOT_INC_ALL_6DB);
+DPOT_DEVICE_DO_CMD(dec_all_6db, DPOT_DEC_ALL_6DB);
+
+static struct attribute *ad525x_attributes_commands[] = {
+        &dev_attr_inc_all.attr,
+        &dev_attr_dec_all.attr,
+        &dev_attr_inc_all_6db.attr,
+        &dev_attr_dec_all_6db.attr,
+        NULL
+};
+
+static const struct attribute_group ad525x_group_commands = {
+        .attrs = ad525x_attributes_commands,
+};
+
+__devinit int ad_dpot_add_files(struct device *dev,
+                unsigned features, unsigned rdac)
+{
+        int err = sysfs_create_file(&dev->kobj,
+                dpot_attrib_wipers[rdac]);
+        if (features & F_CMD_EEP)
+                err |= sysfs_create_file(&dev->kobj,
+                        dpot_attrib_eeprom[rdac]);
+        if (features & F_CMD_TOL)
+                err |= sysfs_create_file(&dev->kobj,
+                        dpot_attrib_tolerance[rdac]);
+        if (features & F_CMD_OTP) {
+                err |= sysfs_create_file(&dev->kobj,
+                        dpot_attrib_otp_en[rdac]);
+                err |= sysfs_create_file(&dev->kobj,
+                        dpot_attrib_otp[rdac]);
+        }
+
+        if (err)
+                dev_err(dev, "failed to register sysfs hooks for RDAC%d\n",
+                        rdac);
+
+        return err;
+}
+
+inline void ad_dpot_remove_files(struct device *dev,
+                unsigned features, unsigned rdac)
+{
+        sysfs_remove_file(&dev->kobj,
+                dpot_attrib_wipers[rdac]);
+        if (features & F_CMD_EEP)
+                sysfs_remove_file(&dev->kobj,
+                        dpot_attrib_eeprom[rdac]);
+        if (features & F_CMD_TOL)
+                sysfs_remove_file(&dev->kobj,
+                        dpot_attrib_tolerance[rdac]);
+        if (features & F_CMD_OTP) {
+                sysfs_remove_file(&dev->kobj,
+                        dpot_attrib_otp_en[rdac]);
+                sysfs_remove_file(&dev->kobj,
+                        dpot_attrib_otp[rdac]);
+        }
+}
+
+__devinit int ad_dpot_probe(struct device *dev,
+                struct ad_dpot_bus_data *bdata, const struct ad_dpot_id *id)
+{
+
+        struct dpot_data *data;
+        int i, err = 0;
+
+        data = kzalloc(sizeof(struct dpot_data), GFP_KERNEL);
+        if (!data) {
+                err = -ENOMEM;
+                goto exit;
+        }
+
+        dev_set_drvdata(dev, data);
+        mutex_init(&data->update_lock);
+
+        data->bdata = *bdata;
+        data->devid = id->devid;
+
+        data->max_pos = 1 << DPOT_MAX_POS(data->devid);
+        data->rdac_mask = data->max_pos - 1;
+        data->feat = DPOT_FEAT(data->devid);
+        data->uid = DPOT_UID(data->devid);
+        data->wipers = DPOT_WIPERS(data->devid);
+
+        for (i = DPOT_RDAC0; i < MAX_RDACS; i++)
+                if (data->wipers & (1 << i)) {
+                        err = ad_dpot_add_files(dev, data->feat, i);
+                        if (err)
+                                goto exit_remove_files;
+                        /* power-up midscale */
+                        if (data->feat & F_RDACS_WONLY)
+                                data->rdac_cache[i] = data->max_pos / 2;
+                }
+
+        if (data->feat & F_CMD_INC)
+                err = sysfs_create_group(&dev->kobj, &ad525x_group_commands);
+
+        if (err) {
+                dev_err(dev, "failed to register sysfs hooks\n");
+                goto exit_free;
+        }
+
+        dev_info(dev, "%s %d-Position Digital Potentiometer registered\n",
+                 id->name, data->max_pos);
+
+        return 0;
+
+exit_remove_files:
+        for (i = DPOT_RDAC0; i < MAX_RDACS; i++)
+                if (data->wipers & (1 << i))
+                        ad_dpot_remove_files(dev, data->feat, i);
+
+exit_free:
+        kfree(data);
+        dev_set_drvdata(dev, NULL);
+exit:
+        dev_err(dev, "failed to create client for %s ID 0x%lX\n",
+                        id->name, id->devid);
+        return err;
+}
+EXPORT_SYMBOL(ad_dpot_probe);
+
+__devexit int ad_dpot_remove(struct device *dev)
+{
+        struct dpot_data *data = dev_get_drvdata(dev);
+        int i;
+
+        for (i = DPOT_RDAC0; i < MAX_RDACS; i++)
+                if (data->wipers & (1 << i))
+                        ad_dpot_remove_files(dev, data->feat, i);
+
+        kfree(data);
+
+        return 0;
+}
+EXPORT_SYMBOL(ad_dpot_remove);
+
+
+MODULE_AUTHOR("Chris Verges <chrisv@cyberswitching.com>, "
+              "Michael Hennerich <hennerich@blackfin.uclinux.org>");
+MODULE_DESCRIPTION("Digital potentiometer driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRIVER_VERSION);
diff --git a/drivers/misc/ad525x_dpot.h b/drivers/misc/ad525x_dpot.h
new file mode 100644
index 000000000000..a662f5987b68
--- /dev/null
+++ b/drivers/misc/ad525x_dpot.h
@@ -0,0 +1,219 @@
+/*
+ * Driver for the Analog Devices digital potentiometers
+ *
+ * Copyright (C) 2010 Michael Hennerich, Analog Devices Inc.
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#ifndef _AD_DPOT_H_
+#define _AD_DPOT_H_
+
+#include <linux/types.h>
+
+#define DPOT_CONF(features, wipers, max_pos, uid) \
+                (((features) << 18) | (((wipers) & 0xFF) << 10) | \
+                ((max_pos & 0xF) << 6) | (uid & 0x3F))
+
+#define DPOT_UID(conf)          (conf & 0x3F)
+#define DPOT_MAX_POS(conf)      ((conf >> 6) & 0xF)
+#define DPOT_WIPERS(conf)       ((conf >> 10) & 0xFF)
+#define DPOT_FEAT(conf)         (conf >> 18)
+
+#define BRDAC0                  (1 << 0)
+#define BRDAC1                  (1 << 1)
+#define BRDAC2                  (1 << 2)
+#define BRDAC3                  (1 << 3)
+#define BRDAC4                  (1 << 4)
+#define BRDAC5                  (1 << 5)
+#define MAX_RDACS               6
+
+#define F_CMD_INC               (1 << 0)        /* Features INC/DEC ALL, 6dB */
+#define F_CMD_EEP               (1 << 1)        /* Features EEPROM */
+#define F_CMD_OTP               (1 << 2)        /* Features OTP */
+#define F_CMD_TOL               (1 << 3)        /* RDACS feature Tolerance REG */
+#define F_RDACS_RW              (1 << 4)        /* RDACS are Read/Write  */
+#define F_RDACS_WONLY           (1 << 5)        /* RDACS are Write only */
+#define F_AD_APPDATA            (1 << 6)        /* RDAC Address append to data */
+#define F_SPI_8BIT              (1 << 7)        /* All SPI XFERS are 8-bit */
+#define F_SPI_16BIT             (1 << 8)        /* All SPI XFERS are 16-bit */
+#define F_SPI_24BIT             (1 << 9)        /* All SPI XFERS are 24-bit */
+
+#define F_RDACS_RW_TOL  (F_RDACS_RW | F_CMD_EEP | F_CMD_TOL)
+#define F_RDACS_RW_EEP  (F_RDACS_RW | F_CMD_EEP)
+#define F_SPI           (F_SPI_8BIT | F_SPI_16BIT | F_SPI_24BIT)
+
+enum dpot_devid {
+        AD5258_ID = DPOT_CONF(F_RDACS_RW_TOL, BRDAC0, 6, 0), /* I2C */
+        AD5259_ID = DPOT_CONF(F_RDACS_RW_TOL, BRDAC0, 8, 1),
+        AD5251_ID = DPOT_CONF(F_RDACS_RW_TOL | F_CMD_INC,
+                        BRDAC1 | BRDAC3, 6, 2),
+        AD5252_ID = DPOT_CONF(F_RDACS_RW_TOL | F_CMD_INC,
+                        BRDAC1 | BRDAC3, 8, 3),
+        AD5253_ID = DPOT_CONF(F_RDACS_RW_TOL | F_CMD_INC,
+                        BRDAC0 | BRDAC1 | BRDAC2 | BRDAC3, 6, 4),
+        AD5254_ID = DPOT_CONF(F_RDACS_RW_TOL | F_CMD_INC,
+                        BRDAC0 | BRDAC1 | BRDAC2 | BRDAC3, 8, 5),
+        AD5255_ID = DPOT_CONF(F_RDACS_RW_TOL | F_CMD_INC,
+                        BRDAC0 | BRDAC1 | BRDAC2, 9, 6),
+        AD5160_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 8, 7), /* SPI */
+        AD5161_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 8, 8),
+        AD5162_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1, 8, 9),
+        AD5165_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 8, 10),
+        AD5200_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 8, 11),
+        AD5201_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 5, 12),
+        AD5203_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0 | BRDAC1 | BRDAC2 | BRDAC3, 6, 13),
+        AD5204_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1 | BRDAC2 | BRDAC3, 8, 14),
+        AD5206_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1 | BRDAC2 | BRDAC3 | BRDAC4 | BRDAC5,
+                        8, 15),
+        AD5207_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1, 8, 16),
+        AD5231_ID = DPOT_CONF(F_RDACS_RW_EEP | F_CMD_INC | F_SPI_24BIT,
+                        BRDAC0, 10, 17),
+        AD5232_ID = DPOT_CONF(F_RDACS_RW_EEP | F_CMD_INC | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1, 8, 18),
+        AD5233_ID = DPOT_CONF(F_RDACS_RW_EEP | F_CMD_INC | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1 | BRDAC2 | BRDAC3, 6, 19),
+        AD5235_ID = DPOT_CONF(F_RDACS_RW_EEP | F_CMD_INC | F_SPI_24BIT,
+                        BRDAC0 | BRDAC1, 10, 20),
+        AD5260_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 8, 21),
+        AD5262_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1, 8, 22),
+        AD5263_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1 | BRDAC2 | BRDAC3, 8, 23),
+        AD5290_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 8, 24),
+        AD5291_ID = DPOT_CONF(F_RDACS_RW | F_SPI_16BIT | F_CMD_OTP,
+                        BRDAC0, 8, 25),
+        AD5292_ID = DPOT_CONF(F_RDACS_RW | F_SPI_16BIT | F_CMD_OTP,
+                        BRDAC0, 10, 26),
+        AD5293_ID = DPOT_CONF(F_RDACS_RW | F_SPI_16BIT, BRDAC0, 10, 27),
+        AD7376_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 7, 28),
+        AD8400_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_8BIT,
+                        BRDAC0, 8, 29),
+        AD8402_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1, 8, 30),
+        AD8403_ID = DPOT_CONF(F_RDACS_WONLY | F_AD_APPDATA | F_SPI_16BIT,
+                        BRDAC0 | BRDAC1 | BRDAC2, 8, 31),
+        ADN2850_ID = DPOT_CONF(F_RDACS_RW_EEP | F_CMD_INC | F_SPI_24BIT,
+                        BRDAC0 | BRDAC1, 10, 32),
+        AD5241_ID = DPOT_CONF(F_RDACS_RW, BRDAC0, 8, 33),
+        AD5242_ID = DPOT_CONF(F_RDACS_RW, BRDAC0 | BRDAC1, 8, 34),
+        AD5243_ID = DPOT_CONF(F_RDACS_RW, BRDAC0 | BRDAC1, 8, 35),
+        AD5245_ID = DPOT_CONF(F_RDACS_RW, BRDAC0, 8, 36),
+        AD5246_ID = DPOT_CONF(F_RDACS_RW, BRDAC0, 7, 37),
+        AD5247_ID = DPOT_CONF(F_RDACS_RW, BRDAC0, 7, 38),
+        AD5248_ID = DPOT_CONF(F_RDACS_RW, BRDAC0 | BRDAC1, 8, 39),
+        AD5280_ID = DPOT_CONF(F_RDACS_RW, BRDAC0, 8, 40),
+        AD5282_ID = DPOT_CONF(F_RDACS_RW, BRDAC0 | BRDAC1, 8, 41),
+        ADN2860_ID = DPOT_CONF(F_RDACS_RW_TOL | F_CMD_INC,
+                        BRDAC0 | BRDAC1 | BRDAC2, 9, 42),
+        AD5273_ID = DPOT_CONF(F_RDACS_RW | F_CMD_OTP, BRDAC0, 6, 43),
+        AD5171_ID = DPOT_CONF(F_RDACS_RW | F_CMD_OTP, BRDAC0, 6, 44),
+        AD5170_ID = DPOT_CONF(F_RDACS_RW | F_CMD_OTP, BRDAC0, 8, 45),
+        AD5172_ID = DPOT_CONF(F_RDACS_RW | F_CMD_OTP, BRDAC0 | BRDAC1, 8, 46),
+        AD5173_ID = DPOT_CONF(F_RDACS_RW | F_CMD_OTP, BRDAC0 | BRDAC1, 8, 47),
+        AD5270_ID = DPOT_CONF(F_RDACS_RW | F_CMD_OTP | F_SPI_16BIT,
+                        BRDAC0, 10, 48),
+        AD5271_ID = DPOT_CONF(F_RDACS_RW | F_CMD_OTP | F_SPI_16BIT,
+                        BRDAC0, 8, 49),
+        AD5272_ID = DPOT_CONF(F_RDACS_RW | F_CMD_OTP, BRDAC0, 10, 50),
+        AD5274_ID = DPOT_CONF(F_RDACS_RW | F_CMD_OTP, BRDAC0, 8, 51),
+};
+
+#define DPOT_RDAC0              0
+#define DPOT_RDAC1              1
+#define DPOT_RDAC2              2
+#define DPOT_RDAC3              3
+#define DPOT_RDAC4              4
+#define DPOT_RDAC5              5
+
+#define DPOT_RDAC_MASK          0x1F
+
+#define DPOT_REG_TOL            0x18
+#define DPOT_TOL_RDAC0          (DPOT_REG_TOL | DPOT_RDAC0)
+#define DPOT_TOL_RDAC1          (DPOT_REG_TOL | DPOT_RDAC1)
+#define DPOT_TOL_RDAC2          (DPOT_REG_TOL | DPOT_RDAC2)
+#define DPOT_TOL_RDAC3          (DPOT_REG_TOL | DPOT_RDAC3)
+#define DPOT_TOL_RDAC4          (DPOT_REG_TOL | DPOT_RDAC4)
+#define DPOT_TOL_RDAC5          (DPOT_REG_TOL | DPOT_RDAC5)
+
+/* RDAC-to-EEPROM Interface Commands */
+#define DPOT_ADDR_RDAC          (0x0 << 5)
+#define DPOT_ADDR_EEPROM        (0x1 << 5)
+#define DPOT_ADDR_OTP           (0x1 << 6)
+#define DPOT_ADDR_CMD           (0x1 << 7)
+#define DPOT_ADDR_OTP_EN        (0x1 << 9)
+
+#define DPOT_DEC_ALL_6DB        (DPOT_ADDR_CMD | (0x4 << 3))
+#define DPOT_INC_ALL_6DB        (DPOT_ADDR_CMD | (0x9 << 3))
+#define DPOT_DEC_ALL            (DPOT_ADDR_CMD | (0x6 << 3))
+#define DPOT_INC_ALL            (DPOT_ADDR_CMD | (0xB << 3))
+
+#define DPOT_SPI_RDAC           0xB0
+#define DPOT_SPI_EEPROM         0x30
+#define DPOT_SPI_READ_RDAC      0xA0
+#define DPOT_SPI_READ_EEPROM    0x90
+#define DPOT_SPI_DEC_ALL_6DB    0x50
+#define DPOT_SPI_INC_ALL_6DB    0xD0
+#define DPOT_SPI_DEC_ALL        0x70
+#define DPOT_SPI_INC_ALL        0xF0
+
+/* AD5291/2/3 use special commands */
+#define DPOT_AD5291_RDAC        0x01
+#define DPOT_AD5291_READ_RDAC   0x02
+#define DPOT_AD5291_STORE_XTPM  0x03
+#define DPOT_AD5291_CTRLREG     0x06
+#define DPOT_AD5291_UNLOCK_CMD  0x03
+
+/* AD5270/1/2/4 use special commands */
+#define DPOT_AD5270_1_2_4_RDAC          0x01
+#define DPOT_AD5270_1_2_4_READ_RDAC     0x02
+#define DPOT_AD5270_1_2_4_STORE_XTPM    0x03
+#define DPOT_AD5270_1_2_4_CTRLREG       0x07
+#define DPOT_AD5270_1_2_4_UNLOCK_CMD    0x03
+
+#define DPOT_AD5282_RDAC_AB     0x80
+
+#define DPOT_AD5273_FUSE        0x80
+#define DPOT_AD5170_2_3_FUSE    0x20
+#define DPOT_AD5170_2_3_OW      0x08
+#define DPOT_AD5172_3_A0        0x08
+#define DPOT_AD5170_2FUSE       0x80
+
+struct dpot_data;
+
+struct ad_dpot_bus_ops {
+        int (*read_d8) (void *client);
+        int (*read_r8d8) (void *client, u8 reg);
+        int (*read_r8d16) (void *client, u8 reg);
+        int (*write_d8) (void *client, u8 val);
+        int (*write_r8d8) (void *client, u8 reg, u8 val);
+        int (*write_r8d16) (void *client, u8 reg, u16 val);
+};
+
+struct ad_dpot_bus_data {
+        void *client;
+        const struct ad_dpot_bus_ops *bops;
+};
+
+struct ad_dpot_id {
+        char *name;
+        unsigned long devid;
+};
+
+int ad_dpot_probe(struct device *dev, struct ad_dpot_bus_data *bdata, const struct ad_dpot_id *id);
+int ad_dpot_remove(struct device *dev);
+
+#endif
diff --git a/drivers/misc/apds9802als.c b/drivers/misc/apds9802als.c
new file mode 100644
index 000000000000..644d4cd071cc
--- /dev/null
+++ b/drivers/misc/apds9802als.c
@@ -0,0 +1,346 @@
+/*
+ * apds9802als.c - apds9802  ALS Driver
+ *
+ * Copyright (C) 2009 Intel Corp
+ *
+ *  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/err.h>
+#include <linux/delay.h>
+#include <linux/mutex.h>
+#include <linux/sysfs.h>
+#include <linux/pm_runtime.h>
+
+#define ALS_MIN_RANGE_VAL 1
+#define ALS_MAX_RANGE_VAL 2
+#define POWER_STA_ENABLE 1
+#define POWER_STA_DISABLE 0
+
+#define DRIVER_NAME "apds9802als"
+
+struct als_data {
+        struct mutex mutex;
+};
+
+static ssize_t als_sensing_range_show(struct device *dev,
+                        struct device_attribute *attr,  char *buf)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        int  val;
+
+        val = i2c_smbus_read_byte_data(client, 0x81);
+        if (val < 0)
+                return val;
+        if (val & 1)
+                return sprintf(buf, "4095\n");
+        else
+                return sprintf(buf, "65535\n");
+}
+
+static int als_wait_for_data_ready(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        int ret;
+        int retry = 10;
+
+        do {
+                msleep(30);
+                ret = i2c_smbus_read_byte_data(client, 0x86);
+        } while (!(ret & 0x80) && retry--);
+
+        if (!retry) {
+                dev_warn(dev, "timeout waiting for data ready\n");
+                return -ETIMEDOUT;
+        }
+
+        return 0;
+}
+
+static ssize_t als_lux0_input_data_show(struct device *dev,
+                        struct device_attribute *attr, char *buf)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct als_data *data = i2c_get_clientdata(client);
+        int ret_val;
+        int temp;
+
+        /* Protect against parallel reads */
+        pm_runtime_get_sync(dev);
+        mutex_lock(&data->mutex);
+
+        /* clear EOC interrupt status */
+        i2c_smbus_write_byte(client, 0x40);
+        /* start measurement */
+        temp = i2c_smbus_read_byte_data(client, 0x81);
+        i2c_smbus_write_byte_data(client, 0x81, temp | 0x08);
+
+        ret_val = als_wait_for_data_ready(dev);
+        if (ret_val < 0)
+                goto failed;
+
+        temp = i2c_smbus_read_byte_data(client, 0x8C); /* LSB data */
+        if (temp < 0) {
+                ret_val = temp;
+                goto failed;
+        }
+        ret_val = i2c_smbus_read_byte_data(client, 0x8D); /* MSB data */
+        if (ret_val < 0)
+                goto failed;
+
+        mutex_unlock(&data->mutex);
+        pm_runtime_put_sync(dev);
+
+        temp = (ret_val << 8) | temp;
+        return sprintf(buf, "%d\n", temp);
+failed:
+        mutex_unlock(&data->mutex);
+        pm_runtime_put_sync(dev);
+        return ret_val;
+}
+
+static ssize_t als_sensing_range_store(struct device *dev,
+                struct device_attribute *attr, const  char *buf, size_t count)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct als_data *data = i2c_get_clientdata(client);
+        int ret_val;
+        unsigned long val;
+
+        if (strict_strtoul(buf, 10, &val))
+                return -EINVAL;
+
+        if (val < 4096)
+                val = 1;
+        else if (val < 65536)
+                val = 2;
+        else
+                return -ERANGE;
+
+        pm_runtime_get_sync(dev);
+
+        /* Make sure nobody else reads/modifies/writes 0x81 while we
+           are active */
+        mutex_lock(&data->mutex);
+
+        ret_val = i2c_smbus_read_byte_data(client, 0x81);
+        if (ret_val < 0)
+                goto fail;
+
+        /* Reset the bits before setting them */
+        ret_val = ret_val & 0xFA;
+
+        if (val == 1) /* Setting detection range up to 4k LUX */
+                ret_val = (ret_val | 0x01);
+        else /* Setting detection range up to 64k LUX*/
+                ret_val = (ret_val | 0x00);
+
+        ret_val = i2c_smbus_write_byte_data(client, 0x81, ret_val);
+
+        if (ret_val >= 0) {
+                /* All OK */
+                mutex_unlock(&data->mutex);
+                pm_runtime_put_sync(dev);
+                return count;
+        }
+fail:
+        mutex_unlock(&data->mutex);
+        pm_runtime_put_sync(dev);
+        return ret_val;
+}
+
+static int als_set_power_state(struct i2c_client *client, bool on_off)
+{
+        int ret_val;
+        struct als_data *data = i2c_get_clientdata(client);
+
+        mutex_lock(&data->mutex);
+        ret_val = i2c_smbus_read_byte_data(client, 0x80);
+        if (ret_val < 0)
+                goto fail;
+        if (on_off)
+                ret_val = ret_val | 0x01;
+        else
+                ret_val = ret_val & 0xFE;
+        ret_val = i2c_smbus_write_byte_data(client, 0x80, ret_val);
+fail:
+        mutex_unlock(&data->mutex);
+        return ret_val;
+}
+
+static DEVICE_ATTR(lux0_sensor_range, S_IRUGO | S_IWUSR,
+        als_sensing_range_show, als_sensing_range_store);
+static DEVICE_ATTR(lux0_input, S_IRUGO, als_lux0_input_data_show, NULL);
+
+static struct attribute *mid_att_als[] = {
+        &dev_attr_lux0_sensor_range.attr,
+        &dev_attr_lux0_input.attr,
+        NULL
+};
+
+static struct attribute_group m_als_gr = {
+        .name = "apds9802als",
+        .attrs = mid_att_als
+};
+
+static int als_set_default_config(struct i2c_client *client)
+{
+        int ret_val;
+        /* Write the command and then switch on */
+        ret_val = i2c_smbus_write_byte_data(client, 0x80, 0x01);
+        if (ret_val < 0) {
+                dev_err(&client->dev, "failed default switch on write\n");
+                return ret_val;
+        }
+        /* detection range: 1~64K Lux, maunal measurement */
+        ret_val = i2c_smbus_write_byte_data(client, 0x81, 0x08);
+        if (ret_val < 0)
+                dev_err(&client->dev, "failed default LUX on write\n");
+
+        /*  We always get 0 for the 1st measurement after system power on,
+         *  so make sure it is finished before user asks for data.
+         */
+        als_wait_for_data_ready(&client->dev);
+
+        return ret_val;
+}
+
+static int apds9802als_probe(struct i2c_client *client,
+                             const struct i2c_device_id *id)
+{
+        int res;
+        struct als_data *data;
+
+        data = kzalloc(sizeof(struct als_data), GFP_KERNEL);
+        if (data == NULL) {
+                dev_err(&client->dev, "Memory allocation failed\n");
+                return -ENOMEM;
+        }
+        i2c_set_clientdata(client, data);
+        res = sysfs_create_group(&client->dev.kobj, &m_als_gr);
+        if (res) {
+                dev_err(&client->dev, "device create file failed\n");
+                goto als_error1;
+        }
+        dev_info(&client->dev, "ALS chip found\n");
+        als_set_default_config(client);
+        mutex_init(&data->mutex);
+
+        pm_runtime_enable(&client->dev);
+        pm_runtime_get(&client->dev);
+        pm_runtime_put(&client->dev);
+
+        return res;
+als_error1:
+        kfree(data);
+        return res;
+}
+
+static int apds9802als_remove(struct i2c_client *client)
+{
+        struct als_data *data = i2c_get_clientdata(client);
+
+        als_set_power_state(client, false);
+        sysfs_remove_group(&client->dev.kobj, &m_als_gr);
+        kfree(data);
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int apds9802als_suspend(struct i2c_client *client, pm_message_t mesg)
+{
+        als_set_power_state(client, false);
+        return 0;
+}
+
+static int apds9802als_resume(struct i2c_client *client)
+{
+        als_set_default_config(client);
+
+        pm_runtime_get(&client->dev);
+        pm_runtime_put(&client->dev);
+        return 0;
+}
+
+static int apds9802als_runtime_suspend(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+
+        als_set_power_state(client, false);
+        return 0;
+}
+
+static int apds9802als_runtime_resume(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+
+        als_set_power_state(client, true);
+        return 0;
+}
+
+static const struct dev_pm_ops apds9802als_pm_ops = {
+        .runtime_suspend = apds9802als_runtime_suspend,
+        .runtime_resume = apds9802als_runtime_resume,
+};
+
+#define APDS9802ALS_PM_OPS (&apds9802als_pm_ops)
+
+#else   /* CONFIG_PM */
+#define apds9802als_suspend NULL
+#define apds9802als_resume NULL
+#define APDS9802ALS_PM_OPS NULL
+#endif  /* CONFIG_PM */
+
+static struct i2c_device_id apds9802als_id[] = {
+        { DRIVER_NAME, 0 },
+        { }
+};
+
+MODULE_DEVICE_TABLE(i2c, apds9802als_id);
+
+static struct i2c_driver apds9802als_driver = {
+        .driver = {
+                .name = DRIVER_NAME,
+                .pm = APDS9802ALS_PM_OPS,
+        },
+        .probe = apds9802als_probe,
+        .remove = apds9802als_remove,
+        .suspend = apds9802als_suspend,
+        .resume = apds9802als_resume,
+        .id_table = apds9802als_id,
+};
+
+static int __init sensor_apds9802als_init(void)
+{
+        return i2c_add_driver(&apds9802als_driver);
+}
+
+static void  __exit sensor_apds9802als_exit(void)
+{
+        i2c_del_driver(&apds9802als_driver);
+}
+module_init(sensor_apds9802als_init);
+module_exit(sensor_apds9802als_exit);
+
+MODULE_AUTHOR("Anantha Narayanan <Anantha.Narayanan@intel.com");
+MODULE_DESCRIPTION("Avago apds9802als ALS Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/misc/apds990x.c b/drivers/misc/apds990x.c
new file mode 100644
index 000000000000..200311fea369
--- /dev/null
+++ b/drivers/misc/apds990x.c
@@ -0,0 +1,1295 @@
+/*
+ * This file is part of the APDS990x sensor driver.
+ * Chip is combined proximity and ambient light sensor.
+ *
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+ *
+ * Contact: Samu Onkalo <samu.p.onkalo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/i2c.h>
+#include <linux/interrupt.h>
+#include <linux/mutex.h>
+#include <linux/regulator/consumer.h>
+#include <linux/pm_runtime.h>
+#include <linux/delay.h>
+#include <linux/wait.h>
+#include <linux/slab.h>
+#include <linux/i2c/apds990x.h>
+
+/* Register map */
+#define APDS990X_ENABLE  0x00 /* Enable of states and interrupts */
+#define APDS990X_ATIME   0x01 /* ALS ADC time  */
+#define APDS990X_PTIME   0x02 /* Proximity ADC time  */
+#define APDS990X_WTIME   0x03 /* Wait time  */
+#define APDS990X_AILTL   0x04 /* ALS interrupt low threshold low byte */
+#define APDS990X_AILTH   0x05 /* ALS interrupt low threshold hi byte */
+#define APDS990X_AIHTL   0x06 /* ALS interrupt hi threshold low byte */
+#define APDS990X_AIHTH   0x07 /* ALS interrupt hi threshold hi byte */
+#define APDS990X_PILTL   0x08 /* Proximity interrupt low threshold low byte */
+#define APDS990X_PILTH   0x09 /* Proximity interrupt low threshold hi byte */
+#define APDS990X_PIHTL   0x0a /* Proximity interrupt hi threshold low byte */
+#define APDS990X_PIHTH   0x0b /* Proximity interrupt hi threshold hi byte */
+#define APDS990X_PERS    0x0c /* Interrupt persistence filters */
+#define APDS990X_CONFIG  0x0d /* Configuration */
+#define APDS990X_PPCOUNT 0x0e /* Proximity pulse count */
+#define APDS990X_CONTROL 0x0f /* Gain control register */
+#define APDS990X_REV     0x11 /* Revision Number */
+#define APDS990X_ID      0x12 /* Device ID */
+#define APDS990X_STATUS  0x13 /* Device status */
+#define APDS990X_CDATAL  0x14 /* Clear ADC low data register */
+#define APDS990X_CDATAH  0x15 /* Clear ADC high data register */
+#define APDS990X_IRDATAL 0x16 /* IR ADC low data register */
+#define APDS990X_IRDATAH 0x17 /* IR ADC high data register */
+#define APDS990X_PDATAL  0x18 /* Proximity ADC low data register */
+#define APDS990X_PDATAH  0x19 /* Proximity ADC high data register */
+
+/* Control */
+#define APDS990X_MAX_AGAIN      3
+
+/* Enable register */
+#define APDS990X_EN_PIEN        (0x1 << 5)
+#define APDS990X_EN_AIEN        (0x1 << 4)
+#define APDS990X_EN_WEN         (0x1 << 3)
+#define APDS990X_EN_PEN         (0x1 << 2)
+#define APDS990X_EN_AEN         (0x1 << 1)
+#define APDS990X_EN_PON         (0x1 << 0)
+#define APDS990X_EN_DISABLE_ALL 0
+
+/* Status register */
+#define APDS990X_ST_PINT        (0x1 << 5)
+#define APDS990X_ST_AINT        (0x1 << 4)
+
+/* I2C access types */
+#define APDS990x_CMD_TYPE_MASK  (0x03 << 5)
+#define APDS990x_CMD_TYPE_RB    (0x00 << 5) /* Repeated byte */
+#define APDS990x_CMD_TYPE_INC   (0x01 << 5) /* Auto increment */
+#define APDS990x_CMD_TYPE_SPE   (0x03 << 5) /* Special function */
+
+#define APDS990x_ADDR_SHIFT     0
+#define APDS990x_CMD            0x80
+
+/* Interrupt ack commands */
+#define APDS990X_INT_ACK_ALS    0x6
+#define APDS990X_INT_ACK_PS     0x5
+#define APDS990X_INT_ACK_BOTH   0x7
+
+/* ptime */
+#define APDS990X_PTIME_DEFAULT  0xff /* Recommended conversion time 2.7ms*/
+
+/* wtime */
+#define APDS990X_WTIME_DEFAULT  0xee /* ~50ms wait time */
+
+#define APDS990X_TIME_TO_ADC    1024 /* One timetick as ADC count value */
+
+/* Persistence */
+#define APDS990X_APERS_SHIFT    0
+#define APDS990X_PPERS_SHIFT    4
+
+/* Supported ID:s */
+#define APDS990X_ID_0           0x0
+#define APDS990X_ID_4           0x4
+#define APDS990X_ID_29          0x29
+
+/* pgain and pdiode settings */
+#define APDS_PGAIN_1X          0x0
+#define APDS_PDIODE_IR         0x2
+
+#define APDS990X_LUX_OUTPUT_SCALE 10
+
+/* Reverse chip factors for threshold calculation */
+struct reverse_factors {
+        u32 afactor;
+        int cf1;
+        int irf1;
+        int cf2;
+        int irf2;
+};
+
+struct apds990x_chip {
+        struct apds990x_platform_data   *pdata;
+        struct i2c_client               *client;
+        struct mutex                    mutex; /* avoid parallel access */
+        struct regulator_bulk_data      regs[2];
+        wait_queue_head_t               wait;
+
+        int     prox_en;
+        bool    prox_continuous_mode;
+        bool    lux_wait_fresh_res;
+
+        /* Chip parameters */
+        struct  apds990x_chip_factors   cf;
+        struct  reverse_factors         rcf;
+        u16     atime;          /* als integration time */
+        u16     arate;          /* als reporting rate */
+        u16     a_max_result;   /* Max possible ADC value with current atime */
+        u8      again_meas;     /* Gain used in last measurement */
+        u8      again_next;     /* Next calculated gain */
+        u8      pgain;
+        u8      pdiode;
+        u8      pdrive;
+        u8      lux_persistence;
+        u8      prox_persistence;
+
+        u32     lux_raw;
+        u32     lux;
+        u16     lux_clear;
+        u16     lux_ir;
+        u16     lux_calib;
+        u32     lux_thres_hi;
+        u32     lux_thres_lo;
+
+        u32     prox_thres;
+        u16     prox_data;
+        u16     prox_calib;
+
+        char    chipname[10];
+        u8      revision;
+};
+
+#define APDS_CALIB_SCALER               8192
+#define APDS_LUX_NEUTRAL_CALIB_VALUE    (1 * APDS_CALIB_SCALER)
+#define APDS_PROX_NEUTRAL_CALIB_VALUE   (1 * APDS_CALIB_SCALER)
+
+#define APDS_PROX_DEF_THRES             600
+#define APDS_PROX_HYSTERESIS            50
+#define APDS_LUX_DEF_THRES_HI           101
+#define APDS_LUX_DEF_THRES_LO           100
+#define APDS_DEFAULT_PROX_PERS          1
+
+#define APDS_TIMEOUT                    2000
+#define APDS_STARTUP_DELAY              25000 /* us */
+#define APDS_RANGE                      65535
+#define APDS_PROX_RANGE                 1023
+#define APDS_LUX_GAIN_LO_LIMIT          100
+#define APDS_LUX_GAIN_LO_LIMIT_STRICT   25
+
+#define TIMESTEP                        87 /* 2.7ms is about 87 / 32 */
+#define TIME_STEP_SCALER                32
+
+#define APDS_LUX_AVERAGING_TIME         50 /* tolerates 50/60Hz ripple */
+#define APDS_LUX_DEFAULT_RATE           200
+
+static const u8 again[] = {1, 8, 16, 120}; /* ALS gain steps */
+static const u8 ir_currents[]   = {100, 50, 25, 12}; /* IRled currents in mA */
+
+/* Following two tables must match i.e 10Hz rate means 1 as persistence value */
+static const u16 arates_hz[] = {10, 5, 2, 1};
+static const u8 apersis[] = {1, 2, 4, 5};
+
+/* Regulators */
+static const char reg_vcc[] = "Vdd";
+static const char reg_vled[] = "Vled";
+
+static int apds990x_read_byte(struct apds990x_chip *chip, u8 reg, u8 *data)
+{
+        struct i2c_client *client = chip->client;
+        s32 ret;
+
+        reg &= ~APDS990x_CMD_TYPE_MASK;
+        reg |= APDS990x_CMD | APDS990x_CMD_TYPE_RB;
+
+        ret = i2c_smbus_read_byte_data(client, reg);
+        *data = ret;
+        return (int)ret;
+}
+
+static int apds990x_read_word(struct apds990x_chip *chip, u8 reg, u16 *data)
+{
+        struct i2c_client *client = chip->client;
+        s32 ret;
+
+        reg &= ~APDS990x_CMD_TYPE_MASK;
+        reg |= APDS990x_CMD | APDS990x_CMD_TYPE_INC;
+
+        ret = i2c_smbus_read_word_data(client, reg);
+        *data = ret;
+        return (int)ret;
+}
+
+static int apds990x_write_byte(struct apds990x_chip *chip, u8 reg, u8 data)
+{
+        struct i2c_client *client = chip->client;
+        s32 ret;
+
+        reg &= ~APDS990x_CMD_TYPE_MASK;
+        reg |= APDS990x_CMD | APDS990x_CMD_TYPE_RB;
+
+        ret = i2c_smbus_write_byte_data(client, reg, data);
+        return (int)ret;
+}
+
+static int apds990x_write_word(struct apds990x_chip *chip, u8 reg, u16 data)
+{
+        struct i2c_client *client = chip->client;
+        s32 ret;
+
+        reg &= ~APDS990x_CMD_TYPE_MASK;
+        reg |= APDS990x_CMD | APDS990x_CMD_TYPE_INC;
+
+        ret = i2c_smbus_write_word_data(client, reg, data);
+        return (int)ret;
+}
+
+static int apds990x_mode_on(struct apds990x_chip *chip)
+{
+        /* ALS is mandatory, proximity optional */
+        u8 reg = APDS990X_EN_AIEN | APDS990X_EN_PON | APDS990X_EN_AEN |
+                APDS990X_EN_WEN;
+
+        if (chip->prox_en)
+                reg |= APDS990X_EN_PIEN | APDS990X_EN_PEN;
+
+        return apds990x_write_byte(chip, APDS990X_ENABLE, reg);
+}
+
+static u16 apds990x_lux_to_threshold(struct apds990x_chip *chip, u32 lux)
+{
+        u32 thres;
+        u32 cpl;
+        u32 ir;
+
+        if (lux == 0)
+                return 0;
+        else if (lux == APDS_RANGE)
+                return APDS_RANGE;
+
+        /*
+         * Reported LUX value is a combination of the IR and CLEAR channel
+         * values. However, interrupt threshold is only for clear channel.
+         * This function approximates needed HW threshold value for a given
+         * LUX value in the current lightning type.
+         * IR level compared to visible light varies heavily depending on the
+         * source of the light
+         *
+         * Calculate threshold value for the next measurement period.
+         * Math: threshold = lux * cpl where
+         * cpl = atime * again / (glass_attenuation * device_factor)
+         * (count-per-lux)
+         *
+         * First remove calibration. Division by four is to avoid overflow
+         */
+        lux = lux * (APDS_CALIB_SCALER / 4) / (chip->lux_calib / 4);
+
+        /* Multiplication by 64 is to increase accuracy */
+        cpl = ((u32)chip->atime * (u32)again[chip->again_next] *
+                APDS_PARAM_SCALE * 64) / (chip->cf.ga * chip->cf.df);
+
+        thres = lux * cpl / 64;
+        /*
+         * Convert IR light from the latest result to match with
+         * new gain step. This helps to adapt with the current
+         * source of light.
+         */
+        ir = (u32)chip->lux_ir * (u32)again[chip->again_next] /
+                (u32)again[chip->again_meas];
+
+        /*
+         * Compensate count with IR light impact
+         * IAC1 > IAC2 (see apds990x_get_lux for formulas)
+         */
+        if (chip->lux_clear * APDS_PARAM_SCALE >=
+                chip->rcf.afactor * chip->lux_ir)
+                thres = (chip->rcf.cf1 * thres + chip->rcf.irf1 * ir) /
+                        APDS_PARAM_SCALE;
+        else
+                thres = (chip->rcf.cf2 * thres + chip->rcf.irf2 * ir) /
+                        APDS_PARAM_SCALE;
+
+        if (thres >= chip->a_max_result)
+                thres = chip->a_max_result - 1;
+        return thres;
+}
+
+static inline int apds990x_set_atime(struct apds990x_chip *chip, u32 time_ms)
+{
+        u8 reg_value;
+
+        chip->atime = time_ms;
+        /* Formula is specified in the data sheet */
+        reg_value = 256 - ((time_ms * TIME_STEP_SCALER) / TIMESTEP);
+        /* Calculate max ADC value for given integration time */
+        chip->a_max_result = (u16)(256 - reg_value) * APDS990X_TIME_TO_ADC;
+        return apds990x_write_byte(chip, APDS990X_ATIME, reg_value);
+}
+
+/* Called always with mutex locked */
+static int apds990x_refresh_pthres(struct apds990x_chip *chip, int data)
+{
+        int ret, lo, hi;
+
+        /* If the chip is not in use, don't try to access it */
+        if (pm_runtime_suspended(&chip->client->dev))
+                return 0;
+
+        if (data < chip->prox_thres) {
+                lo = 0;
+                hi = chip->prox_thres;
+        } else {
+                lo = chip->prox_thres - APDS_PROX_HYSTERESIS;
+                if (chip->prox_continuous_mode)
+                        hi = chip->prox_thres;
+                else
+                        hi = APDS_RANGE;
+        }
+
+        ret = apds990x_write_word(chip, APDS990X_PILTL, lo);
+        ret |= apds990x_write_word(chip, APDS990X_PIHTL, hi);
+        return ret;
+}
+
+/* Called always with mutex locked */
+static int apds990x_refresh_athres(struct apds990x_chip *chip)
+{
+        int ret;
+        /* If the chip is not in use, don't try to access it */
+        if (pm_runtime_suspended(&chip->client->dev))
+                return 0;
+
+        ret = apds990x_write_word(chip, APDS990X_AILTL,
+                        apds990x_lux_to_threshold(chip, chip->lux_thres_lo));
+        ret |= apds990x_write_word(chip, APDS990X_AIHTL,
+                        apds990x_lux_to_threshold(chip, chip->lux_thres_hi));
+
+        return ret;
+}
+
+/* Called always with mutex locked */
+static void apds990x_force_a_refresh(struct apds990x_chip *chip)
+{
+        /* This will force ALS interrupt after the next measurement. */
+        apds990x_write_word(chip, APDS990X_AILTL, APDS_LUX_DEF_THRES_LO);
+        apds990x_write_word(chip, APDS990X_AIHTL, APDS_LUX_DEF_THRES_HI);
+}
+
+/* Called always with mutex locked */
+static void apds990x_force_p_refresh(struct apds990x_chip *chip)
+{
+        /* This will force proximity interrupt after the next measurement. */
+        apds990x_write_word(chip, APDS990X_PILTL, APDS_PROX_DEF_THRES - 1);
+        apds990x_write_word(chip, APDS990X_PIHTL, APDS_PROX_DEF_THRES);
+}
+
+/* Called always with mutex locked */
+static int apds990x_calc_again(struct apds990x_chip *chip)
+{
+        int curr_again = chip->again_meas;
+        int next_again = chip->again_meas;
+        int ret = 0;
+
+        /* Calculate suitable als gain */
+        if (chip->lux_clear == chip->a_max_result)
+                next_again -= 2; /* ALS saturated. Decrease gain by 2 steps */
+        else if (chip->lux_clear > chip->a_max_result / 2)
+                next_again--;
+        else if (chip->lux_clear < APDS_LUX_GAIN_LO_LIMIT_STRICT)
+                next_again += 2; /* Too dark. Increase gain by 2 steps */
+        else if (chip->lux_clear < APDS_LUX_GAIN_LO_LIMIT)
+                next_again++;
+
+        /* Limit gain to available range */
+        if (next_again < 0)
+                next_again = 0;
+        else if (next_again > APDS990X_MAX_AGAIN)
+                next_again = APDS990X_MAX_AGAIN;
+
+        /* Let's check can we trust the measured result */
+        if (chip->lux_clear == chip->a_max_result)
+                /* Result can be totally garbage due to saturation */
+                ret = -ERANGE;
+        else if (next_again != curr_again &&
+                chip->lux_clear < APDS_LUX_GAIN_LO_LIMIT_STRICT)
+                /*
+                 * Gain is changed and measurement result is very small.
+                 * Result can be totally garbage due to underflow
+                 */
+                ret = -ERANGE;
+
+        chip->again_next = next_again;
+        apds990x_write_byte(chip, APDS990X_CONTROL,
+                        (chip->pdrive << 6) |
+                        (chip->pdiode << 4) |
+                        (chip->pgain << 2) |
+                        (chip->again_next << 0));
+
+        /*
+         * Error means bad result -> re-measurement is needed. The forced
+         * refresh uses fastest possible persistence setting to get result
+         * as soon as possible.
+         */
+        if (ret < 0)
+                apds990x_force_a_refresh(chip);
+        else
+                apds990x_refresh_athres(chip);
+
+        return ret;
+}
+
+/* Called always with mutex locked */
+static int apds990x_get_lux(struct apds990x_chip *chip, int clear, int ir)
+{
+        int iac, iac1, iac2; /* IR adjusted counts */
+        u32 lpc; /* Lux per count */
+
+        /* Formulas:
+         * iac1 = CF1 * CLEAR_CH - IRF1 * IR_CH
+         * iac2 = CF2 * CLEAR_CH - IRF2 * IR_CH
+         */
+        iac1 = (chip->cf.cf1 * clear - chip->cf.irf1 * ir) / APDS_PARAM_SCALE;
+        iac2 = (chip->cf.cf2 * clear - chip->cf.irf2 * ir) / APDS_PARAM_SCALE;
+
+        iac = max(iac1, iac2);
+        iac = max(iac, 0);
+
+        lpc = APDS990X_LUX_OUTPUT_SCALE * (chip->cf.df * chip->cf.ga) /
+                (u32)(again[chip->again_meas] * (u32)chip->atime);
+
+        return (iac * lpc) / APDS_PARAM_SCALE;
+}
+
+static int apds990x_ack_int(struct apds990x_chip *chip, u8 mode)
+{
+        struct i2c_client *client = chip->client;
+        s32 ret;
+        u8 reg = APDS990x_CMD | APDS990x_CMD_TYPE_SPE;
+
+        switch (mode & (APDS990X_ST_AINT | APDS990X_ST_PINT)) {
+        case APDS990X_ST_AINT:
+                reg |= APDS990X_INT_ACK_ALS;
+                break;
+        case APDS990X_ST_PINT:
+                reg |= APDS990X_INT_ACK_PS;
+                break;
+        default:
+                reg |= APDS990X_INT_ACK_BOTH;
+                break;
+        }
+
+        ret = i2c_smbus_read_byte_data(client, reg);
+        return (int)ret;
+}
+
+static irqreturn_t apds990x_irq(int irq, void *data)
+{
+        struct apds990x_chip *chip = data;
+        u8 status;
+
+        apds990x_read_byte(chip, APDS990X_STATUS, &status);
+        apds990x_ack_int(chip, status);
+
+        mutex_lock(&chip->mutex);
+        if (!pm_runtime_suspended(&chip->client->dev)) {
+                if (status & APDS990X_ST_AINT) {
+                        apds990x_read_word(chip, APDS990X_CDATAL,
+                                        &chip->lux_clear);
+                        apds990x_read_word(chip, APDS990X_IRDATAL,
+                                        &chip->lux_ir);
+                        /* Store used gain for calculations */
+                        chip->again_meas = chip->again_next;
+
+                        chip->lux_raw = apds990x_get_lux(chip,
+                                                        chip->lux_clear,
+                                                        chip->lux_ir);
+
+                        if (apds990x_calc_again(chip) == 0) {
+                                /* Result is valid */
+                                chip->lux = chip->lux_raw;
+                                chip->lux_wait_fresh_res = false;
+                                wake_up(&chip->wait);
+                                sysfs_notify(&chip->client->dev.kobj,
+                                        NULL, "lux0_input");
+                        }
+                }
+
+                if ((status & APDS990X_ST_PINT) && chip->prox_en) {
+                        u16 clr_ch;
+
+                        apds990x_read_word(chip, APDS990X_CDATAL, &clr_ch);
+                        /*
+                         * If ALS channel is saturated at min gain,
+                         * proximity gives false posivite values.
+                         * Just ignore them.
+                         */
+                        if (chip->again_meas == 0 &&
+                                clr_ch == chip->a_max_result)
+                                chip->prox_data = 0;
+                        else
+                                apds990x_read_word(chip,
+                                                APDS990X_PDATAL,
+                                                &chip->prox_data);
+
+                        apds990x_refresh_pthres(chip, chip->prox_data);
+                        if (chip->prox_data < chip->prox_thres)
+                                chip->prox_data = 0;
+                        else if (!chip->prox_continuous_mode)
+                                chip->prox_data = APDS_PROX_RANGE;
+                        sysfs_notify(&chip->client->dev.kobj,
+                                NULL, "prox0_raw");
+                }
+        }
+        mutex_unlock(&chip->mutex);
+        return IRQ_HANDLED;
+}
+
+static int apds990x_configure(struct apds990x_chip *chip)
+{
+        /* It is recommended to use disabled mode during these operations */
+        apds990x_write_byte(chip, APDS990X_ENABLE, APDS990X_EN_DISABLE_ALL);
+
+        /* conversion and wait times for different state machince states */
+        apds990x_write_byte(chip, APDS990X_PTIME, APDS990X_PTIME_DEFAULT);
+        apds990x_write_byte(chip, APDS990X_WTIME, APDS990X_WTIME_DEFAULT);
+        apds990x_set_atime(chip, APDS_LUX_AVERAGING_TIME);
+
+        apds990x_write_byte(chip, APDS990X_CONFIG, 0);
+
+        /* Persistence levels */
+        apds990x_write_byte(chip, APDS990X_PERS,
+                        (chip->lux_persistence << APDS990X_APERS_SHIFT) |
+                        (chip->prox_persistence << APDS990X_PPERS_SHIFT));
+
+        apds990x_write_byte(chip, APDS990X_PPCOUNT, chip->pdata->ppcount);
+
+        /* Start with relatively small gain */
+        chip->again_meas = 1;
+        chip->again_next = 1;
+        apds990x_write_byte(chip, APDS990X_CONTROL,
+                        (chip->pdrive << 6) |
+                        (chip->pdiode << 4) |
+                        (chip->pgain << 2) |
+                        (chip->again_next << 0));
+        return 0;
+}
+
+static int apds990x_detect(struct apds990x_chip *chip)
+{
+        struct i2c_client *client = chip->client;
+        int ret;
+        u8 id;
+
+        ret = apds990x_read_byte(chip, APDS990X_ID, &id);
+        if (ret < 0) {
+                dev_err(&client->dev, "ID read failed\n");
+                return ret;
+        }
+
+        ret = apds990x_read_byte(chip, APDS990X_REV, &chip->revision);
+        if (ret < 0) {
+                dev_err(&client->dev, "REV read failed\n");
+                return ret;
+        }
+
+        switch (id) {
+        case APDS990X_ID_0:
+        case APDS990X_ID_4:
+        case APDS990X_ID_29:
+                snprintf(chip->chipname, sizeof(chip->chipname), "APDS-990x");
+                break;
+        default:
+                ret = -ENODEV;
+                break;
+        }
+        return ret;
+}
+
+static int apds990x_chip_on(struct apds990x_chip *chip)
+{
+        int err  = regulator_bulk_enable(ARRAY_SIZE(chip->regs),
+                                        chip->regs);
+        if (err < 0)
+                return err;
+
+        usleep_range(APDS_STARTUP_DELAY, 2 * APDS_STARTUP_DELAY);
+
+        /* Refresh all configs in case of regulators were off */
+        chip->prox_data = 0;
+        apds990x_configure(chip);
+        apds990x_mode_on(chip);
+        return 0;
+}
+
+static int apds990x_chip_off(struct apds990x_chip *chip)
+{
+        apds990x_write_byte(chip, APDS990X_ENABLE, APDS990X_EN_DISABLE_ALL);
+        regulator_bulk_disable(ARRAY_SIZE(chip->regs), chip->regs);
+        return 0;
+}
+
+static ssize_t apds990x_lux_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        struct apds990x_chip *chip = dev_get_drvdata(dev);
+        ssize_t ret;
+        u32 result;
+        long timeout;
+
+        if (pm_runtime_suspended(dev))
+                return -EIO;
+
+        timeout = wait_event_interruptible_timeout(chip->wait,
+                                                !chip->lux_wait_fresh_res,
+                                                msecs_to_jiffies(APDS_TIMEOUT));
+        if (!timeout)
+                return -EIO;
+
+        mutex_lock(&chip->mutex);
+        result = (chip->lux * chip->lux_calib) / APDS_CALIB_SCALER;
+        if (result > (APDS_RANGE * APDS990X_LUX_OUTPUT_SCALE))
+                result = APDS_RANGE * APDS990X_LUX_OUTPUT_SCALE;
+
+        ret = sprintf(buf, "%d.%d\n",
+                result / APDS990X_LUX_OUTPUT_SCALE,
+                result % APDS990X_LUX_OUTPUT_SCALE);
+        mutex_unlock(&chip->mutex);
+        return ret;
+}
+
+static DEVICE_ATTR(lux0_input, S_IRUGO, apds990x_lux_show, NULL);
+
+static ssize_t apds990x_lux_range_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%u\n", APDS_RANGE);
+}
+
+static DEVICE_ATTR(lux0_sensor_range, S_IRUGO, apds990x_lux_range_show, NULL);
+
+static ssize_t apds990x_lux_calib_format_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%u\n", APDS_CALIB_SCALER);
+}
+
+static DEVICE_ATTR(lux0_calibscale_default, S_IRUGO,
+                apds990x_lux_calib_format_show, NULL);
+
+static ssize_t apds990x_lux_calib_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        struct apds990x_chip *chip = dev_get_drvdata(dev);
+
+        return sprintf(buf, "%u\n", chip->lux_calib);
+}
+
+static ssize_t apds990x_lux_calib_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t len)
+{
+        struct apds990x_chip *chip = dev_get_drvdata(dev);
+        unsigned long value;
+
+        if (strict_strtoul(buf, 0, &value))
+                return -EINVAL;
+
+        if (chip->lux_calib > APDS_RANGE)
+                return -EINVAL;
+
+        chip->lux_calib = value;
+
+        return len;
+}
+
+static DEVICE_ATTR(lux0_calibscale, S_IRUGO | S_IWUSR, apds990x_lux_calib_show,
+                apds990x_lux_calib_store);
+
+static ssize_t apds990x_rate_avail(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        int i;
+        int pos = 0;
+        for (i = 0; i < ARRAY_SIZE(arates_hz); i++)
+                pos += sprintf(buf + pos, "%d ", arates_hz[i]);
+        sprintf(buf + pos - 1, "\n");
+        return pos;
+}
+
+static ssize_t apds990x_rate_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct apds990x_chip *chip =  dev_get_drvdata(dev);
+        return sprintf(buf, "%d\n", chip->arate);
+}
+
+static int apds990x_set_arate(struct apds990x_chip *chip, int rate)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(arates_hz); i++)
+                if (rate >= arates_hz[i])
+                        break;
+
+        if (i == ARRAY_SIZE(arates_hz))
+                return -EINVAL;
+
+        /* Pick up corresponding persistence value */
+        chip->lux_persistence = apersis[i];
+        chip->arate = arates_hz[i];
+
+        /* If the chip is not in use, don't try to access it */
+        if (pm_runtime_suspended(&chip->client->dev))
+                return 0;
+
+        /* Persistence levels */
+        return apds990x_write_byte(chip, APDS990X_PERS,
+                        (chip->lux_persistence << APDS990X_APERS_SHIFT) |
+                        (chip->prox_persistence << APDS990X_PPERS_SHIFT));
+}
+
+static ssize_t apds990x_rate_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t len)
+{
+        struct apds990x_chip *chip =  dev_get_drvdata(dev);
+        unsigned long value;
+        int ret;
+
+        if (strict_strtoul(buf, 0, &value))
+                return -EINVAL;
+
+        mutex_lock(&chip->mutex);
+        ret = apds990x_set_arate(chip, value);
+        mutex_unlock(&chip->mutex);
+
+        if (ret < 0)
+                return ret;
+        return len;
+}
+
+static DEVICE_ATTR(lux0_rate_avail, S_IRUGO, apds990x_rate_avail, NULL);
+
+static DEVICE_ATTR(lux0_rate, S_IRUGO | S_IWUSR, apds990x_rate_show,
+                                                 apds990x_rate_store);
+
+static ssize_t apds990x_prox_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        ssize_t ret;
+        struct apds990x_chip *chip =  dev_get_drvdata(dev);
+        if (pm_runtime_suspended(dev) || !chip->prox_en)
+                return -EIO;
+
+        mutex_lock(&chip->mutex);
+        ret = sprintf(buf, "%d\n", chip->prox_data);
+        mutex_unlock(&chip->mutex);
+        return ret;
+}
+
+static DEVICE_ATTR(prox0_raw, S_IRUGO, apds990x_prox_show, NULL);
+
+static ssize_t apds990x_prox_range_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%u\n", APDS_PROX_RANGE);
+}
+
+static DEVICE_ATTR(prox0_sensor_range, S_IRUGO, apds990x_prox_range_show, NULL);
+
+static ssize_t apds990x_prox_enable_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct apds990x_chip *chip =  dev_get_drvdata(dev);
+        return sprintf(buf, "%d\n", chip->prox_en);
+}
+
+static ssize_t apds990x_prox_enable_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t len)
+{
+        struct apds990x_chip *chip =  dev_get_drvdata(dev);
+        unsigned long value;
+
+        if (strict_strtoul(buf, 0, &value))
+                return -EINVAL;
+
+        mutex_lock(&chip->mutex);
+
+        if (!chip->prox_en)
+                chip->prox_data = 0;
+
+        if (value)
+                chip->prox_en++;
+        else if (chip->prox_en > 0)
+                chip->prox_en--;
+
+        if (!pm_runtime_suspended(dev))
+                apds990x_mode_on(chip);
+        mutex_unlock(&chip->mutex);
+        return len;
+}
+
+static DEVICE_ATTR(prox0_raw_en, S_IRUGO | S_IWUSR, apds990x_prox_enable_show,
+                                                   apds990x_prox_enable_store);
+
+static const char reporting_modes[][9] = {"trigger", "periodic"};
+
+static ssize_t apds990x_prox_reporting_mode_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct apds990x_chip *chip =  dev_get_drvdata(dev);
+        return sprintf(buf, "%s\n",
+                reporting_modes[!!chip->prox_continuous_mode]);
+}
+
+static ssize_t apds990x_prox_reporting_mode_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t len)
+{
+        struct apds990x_chip *chip =  dev_get_drvdata(dev);
+
+        if (sysfs_streq(buf, reporting_modes[0]))
+                chip->prox_continuous_mode = 0;
+        else if (sysfs_streq(buf, reporting_modes[1]))
+                chip->prox_continuous_mode = 1;
+        else
+                return -EINVAL;
+        return len;
+}
+
+static DEVICE_ATTR(prox0_reporting_mode, S_IRUGO | S_IWUSR,
+                apds990x_prox_reporting_mode_show,
+                apds990x_prox_reporting_mode_store);
+
+static ssize_t apds990x_prox_reporting_avail_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%s %s\n", reporting_modes[0], reporting_modes[1]);
+}
+
+static DEVICE_ATTR(prox0_reporting_mode_avail, S_IRUGO | S_IWUSR,
+                apds990x_prox_reporting_avail_show, NULL);
+
+
+static ssize_t apds990x_lux_thresh_above_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct apds990x_chip *chip =  dev_get_drvdata(dev);
+        return sprintf(buf, "%d\n", chip->lux_thres_hi);
+}
+
+static ssize_t apds990x_lux_thresh_below_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct apds990x_chip *chip =  dev_get_drvdata(dev);
+        return sprintf(buf, "%d\n", chip->lux_thres_lo);
+}
+
+static ssize_t apds990x_set_lux_thresh(struct apds990x_chip *chip, u32 *target,
+                                const char *buf)
+{
+        int ret = 0;
+        unsigned long thresh;
+
+        if (strict_strtoul(buf, 0, &thresh))
+                return -EINVAL;
+
+        if (thresh > APDS_RANGE)
+                return -EINVAL;
+
+        mutex_lock(&chip->mutex);
+        *target = thresh;
+        /*
+         * Don't update values in HW if we are still waiting for
+         * first interrupt to come after device handle open call.
+         */
+        if (!chip->lux_wait_fresh_res)
+                apds990x_refresh_athres(chip);
+        mutex_unlock(&chip->mutex);
+        return ret;
+
+}
+
+static ssize_t apds990x_lux_thresh_above_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t len)
+{
+        struct apds990x_chip *chip =  dev_get_drvdata(dev);
+        int ret = apds990x_set_lux_thresh(chip, &chip->lux_thres_hi, buf);
+        if (ret < 0)
+                return ret;
+        return len;
+}
+
+static ssize_t apds990x_lux_thresh_below_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t len)
+{
+        struct apds990x_chip *chip =  dev_get_drvdata(dev);
+        int ret = apds990x_set_lux_thresh(chip, &chip->lux_thres_lo, buf);
+        if (ret < 0)
+                return ret;
+        return len;
+}
+
+static DEVICE_ATTR(lux0_thresh_above_value, S_IRUGO | S_IWUSR,
+                apds990x_lux_thresh_above_show,
+                apds990x_lux_thresh_above_store);
+
+static DEVICE_ATTR(lux0_thresh_below_value, S_IRUGO | S_IWUSR,
+                apds990x_lux_thresh_below_show,
+                apds990x_lux_thresh_below_store);
+
+static ssize_t apds990x_prox_threshold_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct apds990x_chip *chip =  dev_get_drvdata(dev);
+        return sprintf(buf, "%d\n", chip->prox_thres);
+}
+
+static ssize_t apds990x_prox_threshold_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t len)
+{
+        struct apds990x_chip *chip =  dev_get_drvdata(dev);
+        unsigned long value;
+
+        if (strict_strtoul(buf, 0, &value))
+                return -EINVAL;
+
+        if ((value > APDS_RANGE) || (value == 0) ||
+                (value < APDS_PROX_HYSTERESIS))
+                return -EINVAL;
+
+        mutex_lock(&chip->mutex);
+        chip->prox_thres = value;
+
+        apds990x_force_p_refresh(chip);
+        mutex_unlock(&chip->mutex);
+        return len;
+}
+
+static DEVICE_ATTR(prox0_thresh_above_value, S_IRUGO | S_IWUSR,
+                apds990x_prox_threshold_show,
+                apds990x_prox_threshold_store);
+
+static ssize_t apds990x_power_state_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%d\n", !pm_runtime_suspended(dev));
+        return 0;
+}
+
+static ssize_t apds990x_power_state_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t len)
+{
+        struct apds990x_chip *chip =  dev_get_drvdata(dev);
+        unsigned long value;
+
+        if (strict_strtoul(buf, 0, &value))
+                return -EINVAL;
+        if (value) {
+                pm_runtime_get_sync(dev);
+                mutex_lock(&chip->mutex);
+                chip->lux_wait_fresh_res = true;
+                apds990x_force_a_refresh(chip);
+                apds990x_force_p_refresh(chip);
+                mutex_unlock(&chip->mutex);
+        } else {
+                if (!pm_runtime_suspended(dev))
+                        pm_runtime_put(dev);
+        }
+        return len;
+}
+
+static DEVICE_ATTR(power_state, S_IRUGO | S_IWUSR,
+                apds990x_power_state_show,
+                apds990x_power_state_store);
+
+static ssize_t apds990x_chip_id_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct apds990x_chip *chip =  dev_get_drvdata(dev);
+        return sprintf(buf, "%s %d\n", chip->chipname, chip->revision);
+}
+
+static DEVICE_ATTR(chip_id, S_IRUGO, apds990x_chip_id_show, NULL);
+
+static struct attribute *sysfs_attrs_ctrl[] = {
+        &dev_attr_lux0_calibscale.attr,
+        &dev_attr_lux0_calibscale_default.attr,
+        &dev_attr_lux0_input.attr,
+        &dev_attr_lux0_sensor_range.attr,
+        &dev_attr_lux0_rate.attr,
+        &dev_attr_lux0_rate_avail.attr,
+        &dev_attr_lux0_thresh_above_value.attr,
+        &dev_attr_lux0_thresh_below_value.attr,
+        &dev_attr_prox0_raw_en.attr,
+        &dev_attr_prox0_raw.attr,
+        &dev_attr_prox0_sensor_range.attr,
+        &dev_attr_prox0_thresh_above_value.attr,
+        &dev_attr_prox0_reporting_mode.attr,
+        &dev_attr_prox0_reporting_mode_avail.attr,
+        &dev_attr_chip_id.attr,
+        &dev_attr_power_state.attr,
+        NULL
+};
+
+static struct attribute_group apds990x_attribute_group[] = {
+        {.attrs = sysfs_attrs_ctrl },
+};
+
+static int __devinit apds990x_probe(struct i2c_client *client,
+                                const struct i2c_device_id *id)
+{
+        struct apds990x_chip *chip;
+        int err;
+
+        chip = kzalloc(sizeof *chip, GFP_KERNEL);
+        if (!chip)
+                return -ENOMEM;
+
+        i2c_set_clientdata(client, chip);
+        chip->client  = client;
+
+        init_waitqueue_head(&chip->wait);
+        mutex_init(&chip->mutex);
+        chip->pdata     = client->dev.platform_data;
+
+        if (chip->pdata == NULL) {
+                dev_err(&client->dev, "platform data is mandatory\n");
+                err = -EINVAL;
+                goto fail1;
+        }
+
+        if (chip->pdata->cf.ga == 0) {
+                /* set uncovered sensor default parameters */
+                chip->cf.ga = 1966; /* 0.48 * APDS_PARAM_SCALE */
+                chip->cf.cf1 = 4096; /* 1.00 * APDS_PARAM_SCALE */
+                chip->cf.irf1 = 9134; /* 2.23 * APDS_PARAM_SCALE */
+                chip->cf.cf2 = 2867; /* 0.70 * APDS_PARAM_SCALE */
+                chip->cf.irf2 = 5816; /* 1.42 * APDS_PARAM_SCALE */
+                chip->cf.df = 52;
+        } else {
+                chip->cf = chip->pdata->cf;
+        }
+
+        /* precalculate inverse chip factors for threshold control */
+        chip->rcf.afactor =
+                (chip->cf.irf1 - chip->cf.irf2) * APDS_PARAM_SCALE /
+                (chip->cf.cf1 - chip->cf.cf2);
+        chip->rcf.cf1 = APDS_PARAM_SCALE * APDS_PARAM_SCALE /
+                chip->cf.cf1;
+        chip->rcf.irf1 = chip->cf.irf1 * APDS_PARAM_SCALE /
+                chip->cf.cf1;
+        chip->rcf.cf2 = APDS_PARAM_SCALE * APDS_PARAM_SCALE /
+                chip->cf.cf2;
+        chip->rcf.irf2 = chip->cf.irf2 * APDS_PARAM_SCALE /
+                chip->cf.cf2;
+
+        /* Set something to start with */
+        chip->lux_thres_hi = APDS_LUX_DEF_THRES_HI;
+        chip->lux_thres_lo = APDS_LUX_DEF_THRES_LO;
+        chip->lux_calib = APDS_LUX_NEUTRAL_CALIB_VALUE;
+
+        chip->prox_thres = APDS_PROX_DEF_THRES;
+        chip->pdrive = chip->pdata->pdrive;
+        chip->pdiode = APDS_PDIODE_IR;
+        chip->pgain = APDS_PGAIN_1X;
+        chip->prox_calib = APDS_PROX_NEUTRAL_CALIB_VALUE;
+        chip->prox_persistence = APDS_DEFAULT_PROX_PERS;
+        chip->prox_continuous_mode = false;
+
+        chip->regs[0].supply = reg_vcc;
+        chip->regs[1].supply = reg_vled;
+
+        err = regulator_bulk_get(&client->dev,
+                                 ARRAY_SIZE(chip->regs), chip->regs);
+        if (err < 0) {
+                dev_err(&client->dev, "Cannot get regulators\n");
+                goto fail1;
+        }
+
+        err = regulator_bulk_enable(ARRAY_SIZE(chip->regs), chip->regs);
+        if (err < 0) {
+                dev_err(&client->dev, "Cannot enable regulators\n");
+                goto fail2;
+        }
+
+        usleep_range(APDS_STARTUP_DELAY, 2 * APDS_STARTUP_DELAY);
+
+        err = apds990x_detect(chip);
+        if (err < 0) {
+                dev_err(&client->dev, "APDS990X not found\n");
+                goto fail3;
+        }
+
+        pm_runtime_set_active(&client->dev);
+
+        apds990x_configure(chip);
+        apds990x_set_arate(chip, APDS_LUX_DEFAULT_RATE);
+        apds990x_mode_on(chip);
+
+        pm_runtime_enable(&client->dev);
+
+        if (chip->pdata->setup_resources) {
+                err = chip->pdata->setup_resources();
+                if (err) {
+                        err = -EINVAL;
+                        goto fail3;
+                }
+        }
+
+        err = sysfs_create_group(&chip->client->dev.kobj,
+                                apds990x_attribute_group);
+        if (err < 0) {
+                dev_err(&chip->client->dev, "Sysfs registration failed\n");
+                goto fail4;
+        }
+
+        err = request_threaded_irq(client->irq, NULL,
+                                apds990x_irq,
+                                IRQF_TRIGGER_FALLING | IRQF_TRIGGER_LOW |
+                                IRQF_ONESHOT,
+                                "apds990x", chip);
+        if (err) {
+                dev_err(&client->dev, "could not get IRQ %d\n",
+                        client->irq);
+                goto fail5;
+        }
+        return err;
+fail5:
+        sysfs_remove_group(&chip->client->dev.kobj,
+                        &apds990x_attribute_group[0]);
+fail4:
+        if (chip->pdata && chip->pdata->release_resources)
+                chip->pdata->release_resources();
+fail3:
+        regulator_bulk_disable(ARRAY_SIZE(chip->regs), chip->regs);
+fail2:
+        regulator_bulk_free(ARRAY_SIZE(chip->regs), chip->regs);
+fail1:
+        kfree(chip);
+        return err;
+}
+
+static int __devexit apds990x_remove(struct i2c_client *client)
+{
+        struct apds990x_chip *chip = i2c_get_clientdata(client);
+
+        free_irq(client->irq, chip);
+        sysfs_remove_group(&chip->client->dev.kobj,
+                        apds990x_attribute_group);
+
+        if (chip->pdata && chip->pdata->release_resources)
+                chip->pdata->release_resources();
+
+        if (!pm_runtime_suspended(&client->dev))
+                apds990x_chip_off(chip);
+
+        pm_runtime_disable(&client->dev);
+        pm_runtime_set_suspended(&client->dev);
+
+        regulator_bulk_free(ARRAY_SIZE(chip->regs), chip->regs);
+
+        kfree(chip);
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int apds990x_suspend(struct device *dev)
+{
+        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct apds990x_chip *chip = i2c_get_clientdata(client);
+
+        apds990x_chip_off(chip);
+        return 0;
+}
+
+static int apds990x_resume(struct device *dev)
+{
+        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct apds990x_chip *chip = i2c_get_clientdata(client);
+
+        /*
+         * If we were enabled at suspend time, it is expected
+         * everything works nice and smoothly. Chip_on is enough
+         */
+        apds990x_chip_on(chip);
+
+        return 0;
+}
+#else
+#define apds990x_suspend  NULL
+#define apds990x_resume   NULL
+#define apds990x_shutdown NULL
+#endif
+
+#ifdef CONFIG_PM_RUNTIME
+static int apds990x_runtime_suspend(struct device *dev)
+{
+        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct apds990x_chip *chip = i2c_get_clientdata(client);
+
+        apds990x_chip_off(chip);
+        return 0;
+}
+
+static int apds990x_runtime_resume(struct device *dev)
+{
+        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct apds990x_chip *chip = i2c_get_clientdata(client);
+
+        apds990x_chip_on(chip);
+        return 0;
+}
+
+#endif
+
+static const struct i2c_device_id apds990x_id[] = {
+        {"apds990x", 0 },
+        {}
+};
+
+MODULE_DEVICE_TABLE(i2c, apds990x_id);
+
+static const struct dev_pm_ops apds990x_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(apds990x_suspend, apds990x_resume)
+        SET_RUNTIME_PM_OPS(apds990x_runtime_suspend,
+                        apds990x_runtime_resume,
+                        NULL)
+};
+
+static struct i2c_driver apds990x_driver = {
+        .driver  = {
+                .name   = "apds990x",
+                .owner  = THIS_MODULE,
+                .pm     = &apds990x_pm_ops,
+        },
+        .probe    = apds990x_probe,
+        .remove   = __devexit_p(apds990x_remove),
+        .id_table = apds990x_id,
+};
+
+static int __init apds990x_init(void)
+{
+        return i2c_add_driver(&apds990x_driver);
+}
+
+static void __exit apds990x_exit(void)
+{
+        i2c_del_driver(&apds990x_driver);
+}
+
+MODULE_DESCRIPTION("APDS990X combined ALS and proximity sensor");
+MODULE_AUTHOR("Samu Onkalo, Nokia Corporation");
+MODULE_LICENSE("GPL v2");
+
+module_init(apds990x_init);
+module_exit(apds990x_exit);
diff --git a/drivers/misc/arm-charlcd.c b/drivers/misc/arm-charlcd.c
new file mode 100644
index 000000000000..9e3879ef58f2
--- /dev/null
+++ b/drivers/misc/arm-charlcd.c
@@ -0,0 +1,396 @@
+/*
+ * Driver for the on-board character LCD found on some ARM reference boards
+ * This is basically an Hitachi HD44780 LCD with a custom IP block to drive it
+ * http://en.wikipedia.org/wiki/HD44780_Character_LCD
+ * Currently it will just display the text "ARM Linux" and the linux version
+ *
+ * License terms: GNU General Public License (GPL) version 2
+ * Author: Linus Walleij <triad@df.lth.se>
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/slab.h>
+#include <linux/workqueue.h>
+#include <generated/utsrelease.h>
+
+#define DRIVERNAME "arm-charlcd"
+#define CHARLCD_TIMEOUT (msecs_to_jiffies(1000))
+
+/* Offsets to registers */
+#define CHAR_COM        0x00U
+#define CHAR_DAT        0x04U
+#define CHAR_RD         0x08U
+#define CHAR_RAW        0x0CU
+#define CHAR_MASK       0x10U
+#define CHAR_STAT       0x14U
+
+#define CHAR_RAW_CLEAR  0x00000000U
+#define CHAR_RAW_VALID  0x00000100U
+
+/* Hitachi HD44780 display commands */
+#define HD_CLEAR                        0x01U
+#define HD_HOME                         0x02U
+#define HD_ENTRYMODE                    0x04U
+#define HD_ENTRYMODE_INCREMENT          0x02U
+#define HD_ENTRYMODE_SHIFT              0x01U
+#define HD_DISPCTRL                     0x08U
+#define HD_DISPCTRL_ON                  0x04U
+#define HD_DISPCTRL_CURSOR_ON           0x02U
+#define HD_DISPCTRL_CURSOR_BLINK        0x01U
+#define HD_CRSR_SHIFT                   0x10U
+#define HD_CRSR_SHIFT_DISPLAY           0x08U
+#define HD_CRSR_SHIFT_DISPLAY_RIGHT     0x04U
+#define HD_FUNCSET                      0x20U
+#define HD_FUNCSET_8BIT                 0x10U
+#define HD_FUNCSET_2_LINES              0x08U
+#define HD_FUNCSET_FONT_5X10            0x04U
+#define HD_SET_CGRAM                    0x40U
+#define HD_SET_DDRAM                    0x80U
+#define HD_BUSY_FLAG                    0x80U
+
+/**
+ * @dev: a pointer back to containing device
+ * @phybase: the offset to the controller in physical memory
+ * @physize: the size of the physical page
+ * @virtbase: the offset to the controller in virtual memory
+ * @irq: reserved interrupt number
+ * @complete: completion structure for the last LCD command
+ */
+struct charlcd {
+        struct device *dev;
+        u32 phybase;
+        u32 physize;
+        void __iomem *virtbase;
+        int irq;
+        struct completion complete;
+        struct delayed_work init_work;
+};
+
+static irqreturn_t charlcd_interrupt(int irq, void *data)
+{
+        struct charlcd *lcd = data;
+        u8 status;
+
+        status = readl(lcd->virtbase + CHAR_STAT) & 0x01;
+        /* Clear IRQ */
+        writel(CHAR_RAW_CLEAR, lcd->virtbase + CHAR_RAW);
+        if (status)
+                complete(&lcd->complete);
+        else
+                dev_info(lcd->dev, "Spurious IRQ (%02x)\n", status);
+        return IRQ_HANDLED;
+}
+
+
+static void charlcd_wait_complete_irq(struct charlcd *lcd)
+{
+        int ret;
+
+        ret = wait_for_completion_interruptible_timeout(&lcd->complete,
+                                                        CHARLCD_TIMEOUT);
+        /* Disable IRQ after completion */
+        writel(0x00, lcd->virtbase + CHAR_MASK);
+
+        if (ret < 0) {
+                dev_err(lcd->dev,
+                        "wait_for_completion_interruptible_timeout() "
+                        "returned %d waiting for ready\n", ret);
+                return;
+        }
+
+        if (ret == 0) {
+                dev_err(lcd->dev, "charlcd controller timed out "
+                        "waiting for ready\n");
+                return;
+        }
+}
+
+static u8 charlcd_4bit_read_char(struct charlcd *lcd)
+{
+        u8 data;
+        u32 val;
+        int i;
+
+        /* If we can, use an IRQ to wait for the data, else poll */
+        if (lcd->irq >= 0)
+                charlcd_wait_complete_irq(lcd);
+        else {
+                i = 0;
+                val = 0;
+                while (!(val & CHAR_RAW_VALID) && i < 10) {
+                        udelay(100);
+                        val = readl(lcd->virtbase + CHAR_RAW);
+                        i++;
+                }
+
+                writel(CHAR_RAW_CLEAR, lcd->virtbase + CHAR_RAW);
+        }
+        msleep(1);
+
+        /* Read the 4 high bits of the data */
+        data = readl(lcd->virtbase + CHAR_RD) & 0xf0;
+
+        /*
+         * The second read for the low bits does not trigger an IRQ
+         * so in this case we have to poll for the 4 lower bits
+         */
+        i = 0;
+        val = 0;
+        while (!(val & CHAR_RAW_VALID) && i < 10) {
+                udelay(100);
+                val = readl(lcd->virtbase + CHAR_RAW);
+                i++;
+        }
+        writel(CHAR_RAW_CLEAR, lcd->virtbase + CHAR_RAW);
+        msleep(1);
+
+        /* Read the 4 low bits of the data */
+        data |= (readl(lcd->virtbase + CHAR_RD) >> 4) & 0x0f;
+
+        return data;
+}
+
+static bool charlcd_4bit_read_bf(struct charlcd *lcd)
+{
+        if (lcd->irq >= 0) {
+                /*
+                 * If we'll use IRQs to wait for the busyflag, clear any
+                 * pending flag and enable IRQ
+                 */
+                writel(CHAR_RAW_CLEAR, lcd->virtbase + CHAR_RAW);
+                init_completion(&lcd->complete);
+                writel(0x01, lcd->virtbase + CHAR_MASK);
+        }
+        readl(lcd->virtbase + CHAR_COM);
+        return charlcd_4bit_read_char(lcd) & HD_BUSY_FLAG ? true : false;
+}
+
+static void charlcd_4bit_wait_busy(struct charlcd *lcd)
+{
+        int retries = 50;
+
+        udelay(100);
+        while (charlcd_4bit_read_bf(lcd) && retries)
+                retries--;
+        if (!retries)
+                dev_err(lcd->dev, "timeout waiting for busyflag\n");
+}
+
+static void charlcd_4bit_command(struct charlcd *lcd, u8 cmd)
+{
+        u32 cmdlo = (cmd << 4) & 0xf0;
+        u32 cmdhi = (cmd & 0xf0);
+
+        writel(cmdhi, lcd->virtbase + CHAR_COM);
+        udelay(10);
+        writel(cmdlo, lcd->virtbase + CHAR_COM);
+        charlcd_4bit_wait_busy(lcd);
+}
+
+static void charlcd_4bit_char(struct charlcd *lcd, u8 ch)
+{
+        u32 chlo = (ch << 4) & 0xf0;
+        u32 chhi = (ch & 0xf0);
+
+        writel(chhi, lcd->virtbase + CHAR_DAT);
+        udelay(10);
+        writel(chlo, lcd->virtbase + CHAR_DAT);
+        charlcd_4bit_wait_busy(lcd);
+}
+
+static void charlcd_4bit_print(struct charlcd *lcd, int line, const char *str)
+{
+        u8 offset;
+        int i;
+
+        /*
+         * We support line 0, 1
+         * Line 1 runs from 0x00..0x27
+         * Line 2 runs from 0x28..0x4f
+         */
+        if (line == 0)
+                offset = 0;
+        else if (line == 1)
+                offset = 0x28;
+        else
+                return;
+
+        /* Set offset */
+        charlcd_4bit_command(lcd, HD_SET_DDRAM | offset);
+
+        /* Send string */
+        for (i = 0; i < strlen(str) && i < 0x28; i++)
+                charlcd_4bit_char(lcd, str[i]);
+}
+
+static void charlcd_4bit_init(struct charlcd *lcd)
+{
+        /* These commands cannot be checked with the busy flag */
+        writel(HD_FUNCSET | HD_FUNCSET_8BIT, lcd->virtbase + CHAR_COM);
+        msleep(5);
+        writel(HD_FUNCSET | HD_FUNCSET_8BIT, lcd->virtbase + CHAR_COM);
+        udelay(100);
+        writel(HD_FUNCSET | HD_FUNCSET_8BIT, lcd->virtbase + CHAR_COM);
+        udelay(100);
+        /* Go to 4bit mode */
+        writel(HD_FUNCSET, lcd->virtbase + CHAR_COM);
+        udelay(100);
+        /*
+         * 4bit mode, 2 lines, 5x8 font, after this the number of lines
+         * and the font cannot be changed until the next initialization sequence
+         */
+        charlcd_4bit_command(lcd, HD_FUNCSET | HD_FUNCSET_2_LINES);
+        charlcd_4bit_command(lcd, HD_DISPCTRL | HD_DISPCTRL_ON);
+        charlcd_4bit_command(lcd, HD_ENTRYMODE | HD_ENTRYMODE_INCREMENT);
+        charlcd_4bit_command(lcd, HD_CLEAR);
+        charlcd_4bit_command(lcd, HD_HOME);
+        /* Put something useful in the display */
+        charlcd_4bit_print(lcd, 0, "ARM Linux");
+        charlcd_4bit_print(lcd, 1, UTS_RELEASE);
+}
+
+static void charlcd_init_work(struct work_struct *work)
+{
+        struct charlcd *lcd =
+                container_of(work, struct charlcd, init_work.work);
+
+        charlcd_4bit_init(lcd);
+}
+
+static int __init charlcd_probe(struct platform_device *pdev)
+{
+        int ret;
+        struct charlcd *lcd;
+        struct resource *res;
+
+        lcd = kzalloc(sizeof(struct charlcd), GFP_KERNEL);
+        if (!lcd)
+                return -ENOMEM;
+
+        lcd->dev = &pdev->dev;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                ret = -ENOENT;
+                goto out_no_resource;
+        }
+        lcd->phybase = res->start;
+        lcd->physize = resource_size(res);
+
+        if (request_mem_region(lcd->phybase, lcd->physize,
+                               DRIVERNAME) == NULL) {
+                ret = -EBUSY;
+                goto out_no_memregion;
+        }
+
+        lcd->virtbase = ioremap(lcd->phybase, lcd->physize);
+        if (!lcd->virtbase) {
+                ret = -ENOMEM;
+                goto out_no_remap;
+        }
+
+        lcd->irq = platform_get_irq(pdev, 0);
+        /* If no IRQ is supplied, we'll survive without it */
+        if (lcd->irq >= 0) {
+                if (request_irq(lcd->irq, charlcd_interrupt, IRQF_DISABLED,
+                                DRIVERNAME, lcd)) {
+                        ret = -EIO;
+                        goto out_no_irq;
+                }
+        }
+
+        platform_set_drvdata(pdev, lcd);
+
+        /*
+         * Initialize the display in a delayed work, because
+         * it is VERY slow and would slow down the boot of the system.
+         */
+        INIT_DELAYED_WORK(&lcd->init_work, charlcd_init_work);
+        schedule_delayed_work(&lcd->init_work, 0);
+
+        dev_info(&pdev->dev, "initalized ARM character LCD at %08x\n",
+                lcd->phybase);
+
+        return 0;
+
+out_no_irq:
+        iounmap(lcd->virtbase);
+out_no_remap:
+        platform_set_drvdata(pdev, NULL);
+out_no_memregion:
+        release_mem_region(lcd->phybase, SZ_4K);
+out_no_resource:
+        kfree(lcd);
+        return ret;
+}
+
+static int __exit charlcd_remove(struct platform_device *pdev)
+{
+        struct charlcd *lcd = platform_get_drvdata(pdev);
+
+        if (lcd) {
+                free_irq(lcd->irq, lcd);
+                iounmap(lcd->virtbase);
+                release_mem_region(lcd->phybase, lcd->physize);
+                platform_set_drvdata(pdev, NULL);
+                kfree(lcd);
+        }
+
+        return 0;
+}
+
+static int charlcd_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct charlcd *lcd = platform_get_drvdata(pdev);
+
+        /* Power the display off */
+        charlcd_4bit_command(lcd, HD_DISPCTRL);
+        return 0;
+}
+
+static int charlcd_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct charlcd *lcd = platform_get_drvdata(pdev);
+
+        /* Turn the display back on */
+        charlcd_4bit_command(lcd, HD_DISPCTRL | HD_DISPCTRL_ON);
+        return 0;
+}
+
+static const struct dev_pm_ops charlcd_pm_ops = {
+        .suspend = charlcd_suspend,
+        .resume = charlcd_resume,
+};
+
+static struct platform_driver charlcd_driver = {
+        .driver = {
+                .name = DRIVERNAME,
+                .owner = THIS_MODULE,
+                .pm = &charlcd_pm_ops,
+        },
+        .remove = __exit_p(charlcd_remove),
+};
+
+static int __init charlcd_init(void)
+{
+        return platform_driver_probe(&charlcd_driver, charlcd_probe);
+}
+
+static void __exit charlcd_exit(void)
+{
+        platform_driver_unregister(&charlcd_driver);
+}
+
+module_init(charlcd_init);
+module_exit(charlcd_exit);
+
+MODULE_AUTHOR("Linus Walleij <triad@df.lth.se>");
+MODULE_DESCRIPTION("ARM Character LCD Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
index 558bf3f2c276..4afffe610f99 100644
--- a/drivers/misc/atmel-ssc.c
+++ b/drivers/misc/atmel-ssc.c
@@ -15,6 +15,7 @@
 #include <linux/io.h>
 #include <linux/spinlock.h>
 #include <linux/atmel-ssc.h>
+#include <linux/slab.h>
 
 /* Serialize access to ssc_list and user count */
 static DEFINE_SPINLOCK(user_lock);
diff --git a/drivers/misc/atmel_pwm.c b/drivers/misc/atmel_pwm.c
index 6aa5294dfec4..0f3fb4f03bdf 100644
--- a/drivers/misc/atmel_pwm.c
+++ b/drivers/misc/atmel_pwm.c
@@ -1,6 +1,7 @@
 #include <linux/module.h>
 #include <linux/clk.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <linux/io.h>
 #include <linux/interrupt.h>
 #include <linux/platform_device.h>
diff --git a/drivers/misc/atmel_tclib.c b/drivers/misc/atmel_tclib.c
index 05dc8a31f280..3891124001f2 100644
--- a/drivers/misc/atmel_tclib.c
+++ b/drivers/misc/atmel_tclib.c
@@ -6,6 +6,7 @@
 #include <linux/ioport.h>
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
+#include <linux/slab.h>
 
 /* Number of bytes to reserve for the iomem resource */
 #define ATMEL_TC_IOMEM_SIZE     256
diff --git a/drivers/misc/bh1770glc.c b/drivers/misc/bh1770glc.c
new file mode 100644
index 000000000000..d79a972f2c79
--- /dev/null
+++ b/drivers/misc/bh1770glc.c
@@ -0,0 +1,1417 @@
+/*
+ * This file is part of the ROHM BH1770GLC / OSRAM SFH7770 sensor driver.
+ * Chip is combined proximity and ambient light sensor.
+ *
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+ *
+ * Contact: Samu Onkalo <samu.p.onkalo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/i2c.h>
+#include <linux/interrupt.h>
+#include <linux/mutex.h>
+#include <linux/i2c/bh1770glc.h>
+#include <linux/regulator/consumer.h>
+#include <linux/pm_runtime.h>
+#include <linux/workqueue.h>
+#include <linux/delay.h>
+#include <linux/wait.h>
+#include <linux/slab.h>
+
+#define BH1770_ALS_CONTROL      0x80 /* ALS operation mode control */
+#define BH1770_PS_CONTROL       0x81 /* PS operation mode control */
+#define BH1770_I_LED            0x82 /* active LED and LED1, LED2 current */
+#define BH1770_I_LED3           0x83 /* LED3 current setting */
+#define BH1770_ALS_PS_MEAS      0x84 /* Forced mode trigger */
+#define BH1770_PS_MEAS_RATE     0x85 /* PS meas. rate at stand alone mode */
+#define BH1770_ALS_MEAS_RATE    0x86 /* ALS meas. rate at stand alone mode */
+#define BH1770_PART_ID          0x8a /* Part number and revision ID */
+#define BH1770_MANUFACT_ID      0x8b /* Manufacturerer ID */
+#define BH1770_ALS_DATA_0       0x8c /* ALS DATA low byte */
+#define BH1770_ALS_DATA_1       0x8d /* ALS DATA high byte */
+#define BH1770_ALS_PS_STATUS    0x8e /* Measurement data and int status */
+#define BH1770_PS_DATA_LED1     0x8f /* PS data from LED1 */
+#define BH1770_PS_DATA_LED2     0x90 /* PS data from LED2 */
+#define BH1770_PS_DATA_LED3     0x91 /* PS data from LED3 */
+#define BH1770_INTERRUPT        0x92 /* Interrupt setting */
+#define BH1770_PS_TH_LED1       0x93 /* PS interrupt threshold for LED1 */
+#define BH1770_PS_TH_LED2       0x94 /* PS interrupt threshold for LED2 */
+#define BH1770_PS_TH_LED3       0x95 /* PS interrupt threshold for LED3 */
+#define BH1770_ALS_TH_UP_0      0x96 /* ALS upper threshold low byte */
+#define BH1770_ALS_TH_UP_1      0x97 /* ALS upper threshold high byte */
+#define BH1770_ALS_TH_LOW_0     0x98 /* ALS lower threshold low byte */
+#define BH1770_ALS_TH_LOW_1     0x99 /* ALS lower threshold high byte */
+
+/* MANUFACT_ID */
+#define BH1770_MANUFACT_ROHM    0x01
+#define BH1770_MANUFACT_OSRAM   0x03
+
+/* PART_ID */
+#define BH1770_PART             0x90
+#define BH1770_PART_MASK        0xf0
+#define BH1770_REV_MASK         0x0f
+#define BH1770_REV_SHIFT        0
+#define BH1770_REV_0            0x00
+#define BH1770_REV_1            0x01
+
+/* Operating modes for both */
+#define BH1770_STANDBY          0x00
+#define BH1770_FORCED           0x02
+#define BH1770_STANDALONE       0x03
+#define BH1770_SWRESET          (0x01 << 2)
+
+#define BH1770_PS_TRIG_MEAS     (1 << 0)
+#define BH1770_ALS_TRIG_MEAS    (1 << 1)
+
+/* Interrupt control */
+#define BH1770_INT_OUTPUT_MODE  (1 << 3) /* 0 = latched */
+#define BH1770_INT_POLARITY     (1 << 2) /* 1 = active high */
+#define BH1770_INT_ALS_ENA      (1 << 1)
+#define BH1770_INT_PS_ENA       (1 << 0)
+
+/* Interrupt status */
+#define BH1770_INT_LED1_DATA    (1 << 0)
+#define BH1770_INT_LED1_INT     (1 << 1)
+#define BH1770_INT_LED2_DATA    (1 << 2)
+#define BH1770_INT_LED2_INT     (1 << 3)
+#define BH1770_INT_LED3_DATA    (1 << 4)
+#define BH1770_INT_LED3_INT     (1 << 5)
+#define BH1770_INT_LEDS_INT     ((1 << 1) | (1 << 3) | (1 << 5))
+#define BH1770_INT_ALS_DATA     (1 << 6)
+#define BH1770_INT_ALS_INT      (1 << 7)
+
+/* Led channels */
+#define BH1770_LED1             0x00
+
+#define BH1770_DISABLE          0
+#define BH1770_ENABLE           1
+#define BH1770_PROX_CHANNELS    1
+
+#define BH1770_LUX_DEFAULT_RATE 1 /* Index to lux rate table */
+#define BH1770_PROX_DEFAULT_RATE 1 /* Direct HW value =~ 50Hz */
+#define BH1770_PROX_DEF_RATE_THRESH 6 /* Direct HW value =~ 5 Hz */
+#define BH1770_STARTUP_DELAY    50
+#define BH1770_RESET_TIME       10
+#define BH1770_TIMEOUT          2100 /* Timeout in 2.1 seconds */
+
+#define BH1770_LUX_RANGE        65535
+#define BH1770_PROX_RANGE       255
+#define BH1770_COEF_SCALER      1024
+#define BH1770_CALIB_SCALER     8192
+#define BH1770_LUX_NEUTRAL_CALIB_VALUE (1 * BH1770_CALIB_SCALER)
+#define BH1770_LUX_DEF_THRES    1000
+#define BH1770_PROX_DEF_THRES   70
+#define BH1770_PROX_DEF_ABS_THRES   100
+#define BH1770_DEFAULT_PERSISTENCE  10
+#define BH1770_PROX_MAX_PERSISTENCE 50
+#define BH1770_LUX_GA_SCALE     16384
+#define BH1770_LUX_CF_SCALE     2048 /* CF ChipFactor */
+#define BH1770_NEUTRAL_CF       BH1770_LUX_CF_SCALE
+#define BH1770_LUX_CORR_SCALE   4096
+
+#define PROX_ABOVE_THRESHOLD    1
+#define PROX_BELOW_THRESHOLD    0
+
+#define PROX_IGNORE_LUX_LIMIT   500
+
+struct bh1770_chip {
+        struct bh1770_platform_data     *pdata;
+        char                            chipname[10];
+        u8                              revision;
+        struct i2c_client               *client;
+        struct regulator_bulk_data      regs[2];
+        struct mutex                    mutex; /* avoid parallel access */
+        wait_queue_head_t               wait;
+
+        bool                    int_mode_prox;
+        bool                    int_mode_lux;
+        struct delayed_work     prox_work;
+        u32     lux_cf; /* Chip specific factor */
+        u32     lux_ga;
+        u32     lux_calib;
+        int     lux_rate_index;
+        u32     lux_corr;
+        u16     lux_data_raw;
+        u16     lux_threshold_hi;
+        u16     lux_threshold_lo;
+        u16     lux_thres_hi_onchip;
+        u16     lux_thres_lo_onchip;
+        bool    lux_wait_result;
+
+        int     prox_enable_count;
+        u16     prox_coef;
+        u16     prox_const;
+        int     prox_rate;
+        int     prox_rate_threshold;
+        u8      prox_persistence;
+        u8      prox_persistence_counter;
+        u8      prox_data;
+        u8      prox_threshold;
+        u8      prox_threshold_hw;
+        bool    prox_force_update;
+        u8      prox_abs_thres;
+        u8      prox_led;
+};
+
+static const char reg_vcc[] = "Vcc";
+static const char reg_vleds[] = "Vleds";
+
+/*
+ * Supported stand alone rates in ms from chip data sheet
+ * {10, 20, 30, 40, 70, 100, 200, 500, 1000, 2000};
+ */
+static const s16 prox_rates_hz[] = {100, 50, 33, 25, 14, 10, 5, 2};
+static const s16 prox_rates_ms[] = {10, 20, 30, 40, 70, 100, 200, 500};
+
+/* Supported IR-led currents in mA */
+static const u8 prox_curr_ma[] = {5, 10, 20, 50, 100, 150, 200};
+
+/*
+ * Supported stand alone rates in ms from chip data sheet
+ * {100, 200, 500, 1000, 2000};
+ */
+static const s16 lux_rates_hz[] = {10, 5, 2, 1, 0};
+
+/*
+ * interrupt control functions are called while keeping chip->mutex
+ * excluding module probe / remove
+ */
+static inline int bh1770_lux_interrupt_control(struct bh1770_chip *chip,
+                                        int lux)
+{
+        chip->int_mode_lux = lux;
+        /* Set interrupt modes, interrupt active low, latched */
+        return i2c_smbus_write_byte_data(chip->client,
+                                        BH1770_INTERRUPT,
+                                        (lux << 1) | chip->int_mode_prox);
+}
+
+static inline int bh1770_prox_interrupt_control(struct bh1770_chip *chip,
+                                        int ps)
+{
+        chip->int_mode_prox = ps;
+        return i2c_smbus_write_byte_data(chip->client,
+                                        BH1770_INTERRUPT,
+                                        (chip->int_mode_lux << 1) | (ps << 0));
+}
+
+/* chip->mutex is always kept here */
+static int bh1770_lux_rate(struct bh1770_chip *chip, int rate_index)
+{
+        /* sysfs may call this when the chip is powered off */
+        if (pm_runtime_suspended(&chip->client->dev))
+                return 0;
+
+        /* Proper proximity response needs fastest lux rate (100ms) */
+        if (chip->prox_enable_count)
+                rate_index = 0;
+
+        return i2c_smbus_write_byte_data(chip->client,
+                                        BH1770_ALS_MEAS_RATE,
+                                        rate_index);
+}
+
+static int bh1770_prox_rate(struct bh1770_chip *chip, int mode)
+{
+        int rate;
+
+        rate = (mode == PROX_ABOVE_THRESHOLD) ?
+                chip->prox_rate_threshold : chip->prox_rate;
+
+        return i2c_smbus_write_byte_data(chip->client,
+                                        BH1770_PS_MEAS_RATE,
+                                        rate);
+}
+
+/* InfraredLED is controlled by the chip during proximity scanning */
+static inline int bh1770_led_cfg(struct bh1770_chip *chip)
+{
+        /* LED cfg, current for leds 1 and 2 */
+        return i2c_smbus_write_byte_data(chip->client,
+                                        BH1770_I_LED,
+                                        (BH1770_LED1 << 6) |
+                                        (BH1770_LED_5mA << 3) |
+                                        chip->prox_led);
+}
+
+/*
+ * Following two functions converts raw ps values from HW to normalized
+ * values. Purpose is to compensate differences between different sensor
+ * versions and variants so that result means about the same between
+ * versions.
+ */
+static inline u8 bh1770_psraw_to_adjusted(struct bh1770_chip *chip, u8 psraw)
+{
+        u16 adjusted;
+        adjusted = (u16)(((u32)(psraw + chip->prox_const) * chip->prox_coef) /
+                BH1770_COEF_SCALER);
+        if (adjusted > BH1770_PROX_RANGE)
+                adjusted = BH1770_PROX_RANGE;
+        return adjusted;
+}
+
+static inline u8 bh1770_psadjusted_to_raw(struct bh1770_chip *chip, u8 ps)
+{
+        u16 raw;
+
+        raw = (((u32)ps * BH1770_COEF_SCALER) / chip->prox_coef);
+        if (raw > chip->prox_const)
+                raw = raw - chip->prox_const;
+        else
+                raw = 0;
+        return raw;
+}
+
+/*
+ * Following two functions converts raw lux values from HW to normalized
+ * values. Purpose is to compensate differences between different sensor
+ * versions and variants so that result means about the same between
+ * versions. Chip->mutex is kept when this is called.
+ */
+static int bh1770_prox_set_threshold(struct bh1770_chip *chip)
+{
+        u8 tmp = 0;
+
+        /* sysfs may call this when the chip is powered off */
+        if (pm_runtime_suspended(&chip->client->dev))
+                return 0;
+
+        tmp = bh1770_psadjusted_to_raw(chip, chip->prox_threshold);
+        chip->prox_threshold_hw = tmp;
+
+        return  i2c_smbus_write_byte_data(chip->client, BH1770_PS_TH_LED1,
+                                        tmp);
+}
+
+static inline u16 bh1770_lux_raw_to_adjusted(struct bh1770_chip *chip, u16 raw)
+{
+        u32 lux;
+        lux = ((u32)raw * chip->lux_corr) / BH1770_LUX_CORR_SCALE;
+        return min(lux, (u32)BH1770_LUX_RANGE);
+}
+
+static inline u16 bh1770_lux_adjusted_to_raw(struct bh1770_chip *chip,
+                                        u16 adjusted)
+{
+        return (u32)adjusted * BH1770_LUX_CORR_SCALE / chip->lux_corr;
+}
+
+/* chip->mutex is kept when this is called */
+static int bh1770_lux_update_thresholds(struct bh1770_chip *chip,
+                                        u16 threshold_hi, u16 threshold_lo)
+{
+        u8 data[4];
+        int ret;
+
+        /* sysfs may call this when the chip is powered off */
+        if (pm_runtime_suspended(&chip->client->dev))
+                return 0;
+
+        /*
+         * Compensate threshold values with the correction factors if not
+         * set to minimum or maximum.
+         * Min & max values disables interrupts.
+         */
+        if (threshold_hi != BH1770_LUX_RANGE && threshold_hi != 0)
+                threshold_hi = bh1770_lux_adjusted_to_raw(chip, threshold_hi);
+
+        if (threshold_lo != BH1770_LUX_RANGE && threshold_lo != 0)
+                threshold_lo = bh1770_lux_adjusted_to_raw(chip, threshold_lo);
+
+        if (chip->lux_thres_hi_onchip == threshold_hi &&
+            chip->lux_thres_lo_onchip == threshold_lo)
+                return 0;
+
+        chip->lux_thres_hi_onchip = threshold_hi;
+        chip->lux_thres_lo_onchip = threshold_lo;
+
+        data[0] = threshold_hi;
+        data[1] = threshold_hi >> 8;
+        data[2] = threshold_lo;
+        data[3] = threshold_lo >> 8;
+
+        ret = i2c_smbus_write_i2c_block_data(chip->client,
+                                        BH1770_ALS_TH_UP_0,
+                                        ARRAY_SIZE(data),
+                                        data);
+        return ret;
+}
+
+static int bh1770_lux_get_result(struct bh1770_chip *chip)
+{
+        u16 data;
+        int ret;
+
+        ret = i2c_smbus_read_byte_data(chip->client, BH1770_ALS_DATA_0);
+        if (ret < 0)
+                return ret;
+
+        data = ret & 0xff;
+        ret = i2c_smbus_read_byte_data(chip->client, BH1770_ALS_DATA_1);
+        if (ret < 0)
+                return ret;
+
+        chip->lux_data_raw = data | ((ret & 0xff) << 8);
+
+        return 0;
+}
+
+/* Calculate correction value which contains chip and device specific parts */
+static u32 bh1770_get_corr_value(struct bh1770_chip *chip)
+{
+        u32 tmp;
+        /* Impact of glass attenuation correction */
+        tmp = (BH1770_LUX_CORR_SCALE * chip->lux_ga) / BH1770_LUX_GA_SCALE;
+        /* Impact of chip factor correction */
+        tmp = (tmp * chip->lux_cf) / BH1770_LUX_CF_SCALE;
+        /* Impact of Device specific calibration correction */
+        tmp = (tmp * chip->lux_calib) / BH1770_CALIB_SCALER;
+        return tmp;
+}
+
+static int bh1770_lux_read_result(struct bh1770_chip *chip)
+{
+        bh1770_lux_get_result(chip);
+        return bh1770_lux_raw_to_adjusted(chip, chip->lux_data_raw);
+}
+
+/*
+ * Chip on / off functions are called while keeping mutex except probe
+ * or remove phase
+ */
+static int bh1770_chip_on(struct bh1770_chip *chip)
+{
+        int ret = regulator_bulk_enable(ARRAY_SIZE(chip->regs),
+                                        chip->regs);
+        if (ret < 0)
+                return ret;
+
+        usleep_range(BH1770_STARTUP_DELAY, BH1770_STARTUP_DELAY * 2);
+
+        /* Reset the chip */
+        i2c_smbus_write_byte_data(chip->client, BH1770_ALS_CONTROL,
+                                BH1770_SWRESET);
+        usleep_range(BH1770_RESET_TIME, BH1770_RESET_TIME * 2);
+
+        /*
+         * ALS is started always since proximity needs als results
+         * for realibility estimation.
+         * Let's assume dark until the first ALS measurement is ready.
+         */
+        chip->lux_data_raw = 0;
+        chip->prox_data = 0;
+        ret = i2c_smbus_write_byte_data(chip->client,
+                                        BH1770_ALS_CONTROL, BH1770_STANDALONE);
+
+        /* Assume reset defaults */
+        chip->lux_thres_hi_onchip = BH1770_LUX_RANGE;
+        chip->lux_thres_lo_onchip = 0;
+
+        return ret;
+}
+
+static void bh1770_chip_off(struct bh1770_chip *chip)
+{
+        i2c_smbus_write_byte_data(chip->client,
+                                        BH1770_INTERRUPT, BH1770_DISABLE);
+        i2c_smbus_write_byte_data(chip->client,
+                                BH1770_ALS_CONTROL, BH1770_STANDBY);
+        i2c_smbus_write_byte_data(chip->client,
+                                BH1770_PS_CONTROL, BH1770_STANDBY);
+        regulator_bulk_disable(ARRAY_SIZE(chip->regs), chip->regs);
+}
+
+/* chip->mutex is kept when this is called */
+static int bh1770_prox_mode_control(struct bh1770_chip *chip)
+{
+        if (chip->prox_enable_count) {
+                chip->prox_force_update = true; /* Force immediate update */
+
+                bh1770_lux_rate(chip, chip->lux_rate_index);
+                bh1770_prox_set_threshold(chip);
+                bh1770_led_cfg(chip);
+                bh1770_prox_rate(chip, PROX_BELOW_THRESHOLD);
+                bh1770_prox_interrupt_control(chip, BH1770_ENABLE);
+                i2c_smbus_write_byte_data(chip->client,
+                                        BH1770_PS_CONTROL, BH1770_STANDALONE);
+        } else {
+                chip->prox_data = 0;
+                bh1770_lux_rate(chip, chip->lux_rate_index);
+                bh1770_prox_interrupt_control(chip, BH1770_DISABLE);
+                i2c_smbus_write_byte_data(chip->client,
+                                        BH1770_PS_CONTROL, BH1770_STANDBY);
+        }
+        return 0;
+}
+
+/* chip->mutex is kept when this is called */
+static int bh1770_prox_read_result(struct bh1770_chip *chip)
+{
+        int ret;
+        bool above;
+        u8 mode;
+
+        ret = i2c_smbus_read_byte_data(chip->client, BH1770_PS_DATA_LED1);
+        if (ret < 0)
+                goto out;
+
+        if (ret > chip->prox_threshold_hw)
+                above = true;
+        else
+                above = false;
+
+        /*
+         * when ALS levels goes above limit, proximity result may be
+         * false proximity. Thus ignore the result. With real proximity
+         * there is a shadow causing low als levels.
+         */
+        if (chip->lux_data_raw > PROX_IGNORE_LUX_LIMIT)
+                ret = 0;
+
+        chip->prox_data = bh1770_psraw_to_adjusted(chip, ret);
+
+        /* Strong proximity level or force mode requires immediate response */
+        if (chip->prox_data >= chip->prox_abs_thres ||
+            chip->prox_force_update)
+                chip->prox_persistence_counter = chip->prox_persistence;
+
+        chip->prox_force_update = false;
+
+        /* Persistence filttering to reduce false proximity events */
+        if (likely(above)) {
+                if (chip->prox_persistence_counter < chip->prox_persistence) {
+                        chip->prox_persistence_counter++;
+                        ret = -ENODATA;
+                } else {
+                        mode = PROX_ABOVE_THRESHOLD;
+                        ret = 0;
+                }
+        } else {
+                chip->prox_persistence_counter = 0;
+                mode = PROX_BELOW_THRESHOLD;
+                chip->prox_data = 0;
+                ret = 0;
+        }
+
+        /* Set proximity detection rate based on above or below value */
+        if (ret == 0) {
+                bh1770_prox_rate(chip, mode);
+                sysfs_notify(&chip->client->dev.kobj, NULL, "prox0_raw");
+        }
+out:
+        return ret;
+}
+
+static int bh1770_detect(struct bh1770_chip *chip)
+{
+        struct i2c_client *client = chip->client;
+        s32 ret;
+        u8 manu, part;
+
+        ret = i2c_smbus_read_byte_data(client, BH1770_MANUFACT_ID);
+        if (ret < 0)
+                goto error;
+        manu = (u8)ret;
+
+        ret = i2c_smbus_read_byte_data(client, BH1770_PART_ID);
+        if (ret < 0)
+                goto error;
+        part = (u8)ret;
+
+        chip->revision = (part & BH1770_REV_MASK) >> BH1770_REV_SHIFT;
+        chip->prox_coef = BH1770_COEF_SCALER;
+        chip->prox_const = 0;
+        chip->lux_cf = BH1770_NEUTRAL_CF;
+
+        if ((manu == BH1770_MANUFACT_ROHM) &&
+            ((part & BH1770_PART_MASK) == BH1770_PART)) {
+                snprintf(chip->chipname, sizeof(chip->chipname), "BH1770GLC");
+                return 0;
+        }
+
+        if ((manu == BH1770_MANUFACT_OSRAM) &&
+            ((part & BH1770_PART_MASK) == BH1770_PART)) {
+                snprintf(chip->chipname, sizeof(chip->chipname), "SFH7770");
+                /* Values selected by comparing different versions */
+                chip->prox_coef = 819; /* 0.8 * BH1770_COEF_SCALER */
+                chip->prox_const = 40;
+                return 0;
+        }
+
+        ret = -ENODEV;
+error:
+        dev_dbg(&client->dev, "BH1770 or SFH7770 not found\n");
+
+        return ret;
+}
+
+/*
+ * This work is re-scheduled at every proximity interrupt.
+ * If this work is running, it means that there hasn't been any
+ * proximity interrupt in time. Situation is handled as no-proximity.
+ * It would be nice to have low-threshold interrupt or interrupt
+ * when measurement and hi-threshold are both 0. But neither of those exists.
+ * This is a workaroud for missing HW feature.
+ */
+
+static void bh1770_prox_work(struct work_struct *work)
+{
+        struct bh1770_chip *chip =
+                container_of(work, struct bh1770_chip, prox_work.work);
+
+        mutex_lock(&chip->mutex);
+        bh1770_prox_read_result(chip);
+        mutex_unlock(&chip->mutex);
+}
+
+/* This is threaded irq handler */
+static irqreturn_t bh1770_irq(int irq, void *data)
+{
+        struct bh1770_chip *chip = data;
+        int status;
+        int rate = 0;
+
+        mutex_lock(&chip->mutex);
+        status = i2c_smbus_read_byte_data(chip->client, BH1770_ALS_PS_STATUS);
+
+        /* Acknowledge interrupt by reading this register */
+        i2c_smbus_read_byte_data(chip->client, BH1770_INTERRUPT);
+
+        /*
+         * Check if there is fresh data available for als.
+         * If this is the very first data, update thresholds after that.
+         */
+        if (status & BH1770_INT_ALS_DATA) {
+                bh1770_lux_get_result(chip);
+                if (unlikely(chip->lux_wait_result)) {
+                        chip->lux_wait_result = false;
+                        wake_up(&chip->wait);
+                        bh1770_lux_update_thresholds(chip,
+                                                chip->lux_threshold_hi,
+                                                chip->lux_threshold_lo);
+                }
+        }
+
+        /* Disable interrupt logic to guarantee acknowledgement */
+        i2c_smbus_write_byte_data(chip->client, BH1770_INTERRUPT,
+                                  (0 << 1) | (0 << 0));
+
+        if ((status & BH1770_INT_ALS_INT))
+                sysfs_notify(&chip->client->dev.kobj, NULL, "lux0_input");
+
+        if (chip->int_mode_prox && (status & BH1770_INT_LEDS_INT)) {
+                rate = prox_rates_ms[chip->prox_rate_threshold];
+                bh1770_prox_read_result(chip);
+        }
+
+        /* Re-enable interrupt logic */
+        i2c_smbus_write_byte_data(chip->client, BH1770_INTERRUPT,
+                                  (chip->int_mode_lux << 1) |
+                                  (chip->int_mode_prox << 0));
+        mutex_unlock(&chip->mutex);
+
+        /*
+         * Can't cancel work while keeping mutex since the work uses the
+         * same mutex.
+         */
+        if (rate) {
+                /*
+                 * Simulate missing no-proximity interrupt 50ms after the
+                 * next expected interrupt time.
+                 */
+                cancel_delayed_work_sync(&chip->prox_work);
+                schedule_delayed_work(&chip->prox_work,
+                                msecs_to_jiffies(rate + 50));
+        }
+        return IRQ_HANDLED;
+}
+
+static ssize_t bh1770_power_state_store(struct device *dev,
+                                      struct device_attribute *attr,
+                                      const char *buf, size_t count)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        unsigned long value;
+        ssize_t ret;
+
+        if (strict_strtoul(buf, 0, &value))
+                return -EINVAL;
+
+        mutex_lock(&chip->mutex);
+        if (value) {
+                pm_runtime_get_sync(dev);
+
+                ret = bh1770_lux_rate(chip, chip->lux_rate_index);
+                if (ret < 0) {
+                        pm_runtime_put(dev);
+                        goto leave;
+                }
+
+                ret = bh1770_lux_interrupt_control(chip, BH1770_ENABLE);
+                if (ret < 0) {
+                        pm_runtime_put(dev);
+                        goto leave;
+                }
+
+                /* This causes interrupt after the next measurement cycle */
+                bh1770_lux_update_thresholds(chip, BH1770_LUX_DEF_THRES,
+                                        BH1770_LUX_DEF_THRES);
+                /* Inform that we are waiting for a result from ALS */
+                chip->lux_wait_result = true;
+                bh1770_prox_mode_control(chip);
+        } else if (!pm_runtime_suspended(dev)) {
+                pm_runtime_put(dev);
+        }
+        ret = count;
+leave:
+        mutex_unlock(&chip->mutex);
+        return ret;
+}
+
+static ssize_t bh1770_power_state_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%d\n", !pm_runtime_suspended(dev));
+}
+
+static ssize_t bh1770_lux_result_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        ssize_t ret;
+        long timeout;
+
+        if (pm_runtime_suspended(dev))
+                return -EIO; /* Chip is not enabled at all */
+
+        timeout = wait_event_interruptible_timeout(chip->wait,
+                                        !chip->lux_wait_result,
+                                        msecs_to_jiffies(BH1770_TIMEOUT));
+        if (!timeout)
+                return -EIO;
+
+        mutex_lock(&chip->mutex);
+        ret = sprintf(buf, "%d\n", bh1770_lux_read_result(chip));
+        mutex_unlock(&chip->mutex);
+
+        return ret;
+}
+
+static ssize_t bh1770_lux_range_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%d\n", BH1770_LUX_RANGE);
+}
+
+static ssize_t bh1770_prox_enable_store(struct device *dev,
+                                      struct device_attribute *attr,
+                                      const char *buf, size_t count)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        unsigned long value;
+
+        if (strict_strtoul(buf, 0, &value))
+                return -EINVAL;
+
+        mutex_lock(&chip->mutex);
+        /* Assume no proximity. Sensor will tell real state soon */
+        if (!chip->prox_enable_count)
+                chip->prox_data = 0;
+
+        if (value)
+                chip->prox_enable_count++;
+        else if (chip->prox_enable_count > 0)
+                chip->prox_enable_count--;
+        else
+                goto leave;
+
+        /* Run control only when chip is powered on */
+        if (!pm_runtime_suspended(dev))
+                bh1770_prox_mode_control(chip);
+leave:
+        mutex_unlock(&chip->mutex);
+        return count;
+}
+
+static ssize_t bh1770_prox_enable_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        ssize_t len;
+
+        mutex_lock(&chip->mutex);
+        len = sprintf(buf, "%d\n", chip->prox_enable_count);
+        mutex_unlock(&chip->mutex);
+        return len;
+}
+
+static ssize_t bh1770_prox_result_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        ssize_t ret;
+
+        mutex_lock(&chip->mutex);
+        if (chip->prox_enable_count && !pm_runtime_suspended(dev))
+                ret = sprintf(buf, "%d\n", chip->prox_data);
+        else
+                ret = -EIO;
+        mutex_unlock(&chip->mutex);
+        return ret;
+}
+
+static ssize_t bh1770_prox_range_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%d\n", BH1770_PROX_RANGE);
+}
+
+static ssize_t bh1770_get_prox_rate_avail(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        int i;
+        int pos = 0;
+        for (i = 0; i < ARRAY_SIZE(prox_rates_hz); i++)
+                pos += sprintf(buf + pos, "%d ", prox_rates_hz[i]);
+        sprintf(buf + pos - 1, "\n");
+        return pos;
+}
+
+static ssize_t bh1770_get_prox_rate_above(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        return sprintf(buf, "%d\n", prox_rates_hz[chip->prox_rate_threshold]);
+}
+
+static ssize_t bh1770_get_prox_rate_below(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        return sprintf(buf, "%d\n", prox_rates_hz[chip->prox_rate]);
+}
+
+static int bh1770_prox_rate_validate(int rate)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(prox_rates_hz) - 1; i++)
+                if (rate >= prox_rates_hz[i])
+                        break;
+        return i;
+}
+
+static ssize_t bh1770_set_prox_rate_above(struct device *dev,
+                                        struct device_attribute *attr,
+                                        const char *buf, size_t count)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        unsigned long value;
+
+        if (strict_strtoul(buf, 0, &value))
+                return -EINVAL;
+
+        mutex_lock(&chip->mutex);
+        chip->prox_rate_threshold = bh1770_prox_rate_validate(value);
+        mutex_unlock(&chip->mutex);
+        return count;
+}
+
+static ssize_t bh1770_set_prox_rate_below(struct device *dev,
+                                        struct device_attribute *attr,
+                                        const char *buf, size_t count)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        unsigned long value;
+
+        if (strict_strtoul(buf, 0, &value))
+                return -EINVAL;
+
+        mutex_lock(&chip->mutex);
+        chip->prox_rate = bh1770_prox_rate_validate(value);
+        mutex_unlock(&chip->mutex);
+        return count;
+}
+
+static ssize_t bh1770_get_prox_thres(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        return sprintf(buf, "%d\n", chip->prox_threshold);
+}
+
+static ssize_t bh1770_set_prox_thres(struct device *dev,
+                                      struct device_attribute *attr,
+                                      const char *buf, size_t count)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        unsigned long value;
+        int ret;
+
+        if (strict_strtoul(buf, 0, &value))
+                return -EINVAL;
+        if (value > BH1770_PROX_RANGE)
+                return -EINVAL;
+
+        mutex_lock(&chip->mutex);
+        chip->prox_threshold = value;
+        ret = bh1770_prox_set_threshold(chip);
+        mutex_unlock(&chip->mutex);
+        if (ret < 0)
+                return ret;
+        return count;
+}
+
+static ssize_t bh1770_prox_persistence_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        struct bh1770_chip *chip = dev_get_drvdata(dev);
+
+        return sprintf(buf, "%u\n", chip->prox_persistence);
+}
+
+static ssize_t bh1770_prox_persistence_store(struct device *dev,
+                                struct device_attribute *attr,
+                                const char *buf, size_t len)
+{
+        struct bh1770_chip *chip = dev_get_drvdata(dev);
+        unsigned long value;
+
+        if (strict_strtoul(buf, 0, &value))
+                return -EINVAL;
+
+        if (value > BH1770_PROX_MAX_PERSISTENCE)
+                return -EINVAL;
+
+        chip->prox_persistence = value;
+
+        return len;
+}
+
+static ssize_t bh1770_prox_abs_thres_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        struct bh1770_chip *chip = dev_get_drvdata(dev);
+        return sprintf(buf, "%u\n", chip->prox_abs_thres);
+}
+
+static ssize_t bh1770_prox_abs_thres_store(struct device *dev,
+                                struct device_attribute *attr,
+                                const char *buf, size_t len)
+{
+        struct bh1770_chip *chip = dev_get_drvdata(dev);
+        unsigned long value;
+
+        if (strict_strtoul(buf, 0, &value))
+                return -EINVAL;
+
+        if (value > BH1770_PROX_RANGE)
+                return -EINVAL;
+
+        chip->prox_abs_thres = value;
+
+        return len;
+}
+
+static ssize_t bh1770_chip_id_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        return sprintf(buf, "%s rev %d\n", chip->chipname, chip->revision);
+}
+
+static ssize_t bh1770_lux_calib_default_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%u\n", BH1770_CALIB_SCALER);
+}
+
+static ssize_t bh1770_lux_calib_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        struct bh1770_chip *chip = dev_get_drvdata(dev);
+        ssize_t len;
+
+        mutex_lock(&chip->mutex);
+        len = sprintf(buf, "%u\n", chip->lux_calib);
+        mutex_unlock(&chip->mutex);
+        return len;
+}
+
+static ssize_t bh1770_lux_calib_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t len)
+{
+        struct bh1770_chip *chip = dev_get_drvdata(dev);
+        unsigned long value;
+        u32 old_calib;
+        u32 new_corr;
+
+        if (strict_strtoul(buf, 0, &value))
+                return -EINVAL;
+
+        mutex_lock(&chip->mutex);
+        old_calib = chip->lux_calib;
+        chip->lux_calib = value;
+        new_corr = bh1770_get_corr_value(chip);
+        if (new_corr == 0) {
+                chip->lux_calib = old_calib;
+                mutex_unlock(&chip->mutex);
+                return -EINVAL;
+        }
+        chip->lux_corr = new_corr;
+        /* Refresh thresholds on HW after changing correction value */
+        bh1770_lux_update_thresholds(chip, chip->lux_threshold_hi,
+                                chip->lux_threshold_lo);
+
+        mutex_unlock(&chip->mutex);
+
+        return len;
+}
+
+static ssize_t bh1770_get_lux_rate_avail(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        int i;
+        int pos = 0;
+        for (i = 0; i < ARRAY_SIZE(lux_rates_hz); i++)
+                pos += sprintf(buf + pos, "%d ", lux_rates_hz[i]);
+        sprintf(buf + pos - 1, "\n");
+        return pos;
+}
+
+static ssize_t bh1770_get_lux_rate(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        return sprintf(buf, "%d\n", lux_rates_hz[chip->lux_rate_index]);
+}
+
+static ssize_t bh1770_set_lux_rate(struct device *dev,
+                                      struct device_attribute *attr,
+                                      const char *buf, size_t count)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        unsigned long rate_hz;
+        int ret, i;
+
+        if (strict_strtoul(buf, 0, &rate_hz))
+                return -EINVAL;
+
+        for (i = 0; i < ARRAY_SIZE(lux_rates_hz) - 1; i++)
+                if (rate_hz >= lux_rates_hz[i])
+                        break;
+
+        mutex_lock(&chip->mutex);
+        chip->lux_rate_index = i;
+        ret = bh1770_lux_rate(chip, i);
+        mutex_unlock(&chip->mutex);
+
+        if (ret < 0)
+                return ret;
+
+        return count;
+}
+
+static ssize_t bh1770_get_lux_thresh_above(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        return sprintf(buf, "%d\n", chip->lux_threshold_hi);
+}
+
+static ssize_t bh1770_get_lux_thresh_below(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        return sprintf(buf, "%d\n", chip->lux_threshold_lo);
+}
+
+static ssize_t bh1770_set_lux_thresh(struct bh1770_chip *chip, u16 *target,
+                                const char *buf)
+{
+        int ret = 0;
+        unsigned long thresh;
+
+        if (strict_strtoul(buf, 0, &thresh))
+                return -EINVAL;
+
+        if (thresh > BH1770_LUX_RANGE)
+                return -EINVAL;
+
+        mutex_lock(&chip->mutex);
+        *target = thresh;
+        /*
+         * Don't update values in HW if we are still waiting for
+         * first interrupt to come after device handle open call.
+         */
+        if (!chip->lux_wait_result)
+                ret = bh1770_lux_update_thresholds(chip,
+                                                chip->lux_threshold_hi,
+                                                chip->lux_threshold_lo);
+        mutex_unlock(&chip->mutex);
+        return ret;
+
+}
+
+static ssize_t bh1770_set_lux_thresh_above(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t len)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        int ret = bh1770_set_lux_thresh(chip, &chip->lux_threshold_hi, buf);
+        if (ret < 0)
+                return ret;
+        return len;
+}
+
+static ssize_t bh1770_set_lux_thresh_below(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t len)
+{
+        struct bh1770_chip *chip =  dev_get_drvdata(dev);
+        int ret = bh1770_set_lux_thresh(chip, &chip->lux_threshold_lo, buf);
+        if (ret < 0)
+                return ret;
+        return len;
+}
+
+static DEVICE_ATTR(prox0_raw_en, S_IRUGO | S_IWUSR, bh1770_prox_enable_show,
+                                                bh1770_prox_enable_store);
+static DEVICE_ATTR(prox0_thresh_above1_value, S_IRUGO | S_IWUSR,
+                                                bh1770_prox_abs_thres_show,
+                                                bh1770_prox_abs_thres_store);
+static DEVICE_ATTR(prox0_thresh_above0_value, S_IRUGO | S_IWUSR,
+                                                bh1770_get_prox_thres,
+                                                bh1770_set_prox_thres);
+static DEVICE_ATTR(prox0_raw, S_IRUGO, bh1770_prox_result_show, NULL);
+static DEVICE_ATTR(prox0_sensor_range, S_IRUGO, bh1770_prox_range_show, NULL);
+static DEVICE_ATTR(prox0_thresh_above_count, S_IRUGO | S_IWUSR,
+                                                bh1770_prox_persistence_show,
+                                                bh1770_prox_persistence_store);
+static DEVICE_ATTR(prox0_rate_above, S_IRUGO | S_IWUSR,
+                                                bh1770_get_prox_rate_above,
+                                                bh1770_set_prox_rate_above);
+static DEVICE_ATTR(prox0_rate_below, S_IRUGO | S_IWUSR,
+                                                bh1770_get_prox_rate_below,
+                                                bh1770_set_prox_rate_below);
+static DEVICE_ATTR(prox0_rate_avail, S_IRUGO, bh1770_get_prox_rate_avail, NULL);
+
+static DEVICE_ATTR(lux0_calibscale, S_IRUGO | S_IWUSR, bh1770_lux_calib_show,
+                                                bh1770_lux_calib_store);
+static DEVICE_ATTR(lux0_calibscale_default, S_IRUGO,
+                                                bh1770_lux_calib_default_show,
+                                                NULL);
+static DEVICE_ATTR(lux0_input, S_IRUGO, bh1770_lux_result_show, NULL);
+static DEVICE_ATTR(lux0_sensor_range, S_IRUGO, bh1770_lux_range_show, NULL);
+static DEVICE_ATTR(lux0_rate, S_IRUGO | S_IWUSR, bh1770_get_lux_rate,
+                                                bh1770_set_lux_rate);
+static DEVICE_ATTR(lux0_rate_avail, S_IRUGO, bh1770_get_lux_rate_avail, NULL);
+static DEVICE_ATTR(lux0_thresh_above_value, S_IRUGO | S_IWUSR,
+                                                bh1770_get_lux_thresh_above,
+                                                bh1770_set_lux_thresh_above);
+static DEVICE_ATTR(lux0_thresh_below_value, S_IRUGO | S_IWUSR,
+                                                bh1770_get_lux_thresh_below,
+                                                bh1770_set_lux_thresh_below);
+static DEVICE_ATTR(chip_id, S_IRUGO, bh1770_chip_id_show, NULL);
+static DEVICE_ATTR(power_state, S_IRUGO | S_IWUSR, bh1770_power_state_show,
+                                                 bh1770_power_state_store);
+
+
+static struct attribute *sysfs_attrs[] = {
+        &dev_attr_lux0_calibscale.attr,
+        &dev_attr_lux0_calibscale_default.attr,
+        &dev_attr_lux0_input.attr,
+        &dev_attr_lux0_sensor_range.attr,
+        &dev_attr_lux0_rate.attr,
+        &dev_attr_lux0_rate_avail.attr,
+        &dev_attr_lux0_thresh_above_value.attr,
+        &dev_attr_lux0_thresh_below_value.attr,
+        &dev_attr_prox0_raw.attr,
+        &dev_attr_prox0_sensor_range.attr,
+        &dev_attr_prox0_raw_en.attr,
+        &dev_attr_prox0_thresh_above_count.attr,
+        &dev_attr_prox0_rate_above.attr,
+        &dev_attr_prox0_rate_below.attr,
+        &dev_attr_prox0_rate_avail.attr,
+        &dev_attr_prox0_thresh_above0_value.attr,
+        &dev_attr_prox0_thresh_above1_value.attr,
+        &dev_attr_chip_id.attr,
+        &dev_attr_power_state.attr,
+        NULL
+};
+
+static struct attribute_group bh1770_attribute_group = {
+        .attrs = sysfs_attrs
+};
+
+static int __devinit bh1770_probe(struct i2c_client *client,
+                                const struct i2c_device_id *id)
+{
+        struct bh1770_chip *chip;
+        int err;
+
+        chip = kzalloc(sizeof *chip, GFP_KERNEL);
+        if (!chip)
+                return -ENOMEM;
+
+        i2c_set_clientdata(client, chip);
+        chip->client  = client;
+
+        mutex_init(&chip->mutex);
+        init_waitqueue_head(&chip->wait);
+        INIT_DELAYED_WORK(&chip->prox_work, bh1770_prox_work);
+
+        if (client->dev.platform_data == NULL) {
+                dev_err(&client->dev, "platform data is mandatory\n");
+                err = -EINVAL;
+                goto fail1;
+        }
+
+        chip->pdata             = client->dev.platform_data;
+        chip->lux_calib         = BH1770_LUX_NEUTRAL_CALIB_VALUE;
+        chip->lux_rate_index    = BH1770_LUX_DEFAULT_RATE;
+        chip->lux_threshold_lo  = BH1770_LUX_DEF_THRES;
+        chip->lux_threshold_hi  = BH1770_LUX_DEF_THRES;
+
+        if (chip->pdata->glass_attenuation == 0)
+                chip->lux_ga = BH1770_NEUTRAL_GA;
+        else
+                chip->lux_ga = chip->pdata->glass_attenuation;
+
+        chip->prox_threshold    = BH1770_PROX_DEF_THRES;
+        chip->prox_led          = chip->pdata->led_def_curr;
+        chip->prox_abs_thres    = BH1770_PROX_DEF_ABS_THRES;
+        chip->prox_persistence  = BH1770_DEFAULT_PERSISTENCE;
+        chip->prox_rate_threshold = BH1770_PROX_DEF_RATE_THRESH;
+        chip->prox_rate         = BH1770_PROX_DEFAULT_RATE;
+        chip->prox_data         = 0;
+
+        chip->regs[0].supply = reg_vcc;
+        chip->regs[1].supply = reg_vleds;
+
+        err = regulator_bulk_get(&client->dev,
+                                 ARRAY_SIZE(chip->regs), chip->regs);
+        if (err < 0) {
+                dev_err(&client->dev, "Cannot get regulators\n");
+                goto fail1;
+        }
+
+        err = regulator_bulk_enable(ARRAY_SIZE(chip->regs),
+                                chip->regs);
+        if (err < 0) {
+                dev_err(&client->dev, "Cannot enable regulators\n");
+                goto fail2;
+        }
+
+        usleep_range(BH1770_STARTUP_DELAY, BH1770_STARTUP_DELAY * 2);
+        err = bh1770_detect(chip);
+        if (err < 0)
+                goto fail3;
+
+        /* Start chip */
+        bh1770_chip_on(chip);
+        pm_runtime_set_active(&client->dev);
+        pm_runtime_enable(&client->dev);
+
+        chip->lux_corr = bh1770_get_corr_value(chip);
+        if (chip->lux_corr == 0) {
+                dev_err(&client->dev, "Improper correction values\n");
+                err = -EINVAL;
+                goto fail3;
+        }
+
+        if (chip->pdata->setup_resources) {
+                err = chip->pdata->setup_resources();
+                if (err) {
+                        err = -EINVAL;
+                        goto fail3;
+                }
+        }
+
+        err = sysfs_create_group(&chip->client->dev.kobj,
+                                &bh1770_attribute_group);
+        if (err < 0) {
+                dev_err(&chip->client->dev, "Sysfs registration failed\n");
+                goto fail4;
+        }
+
+        /*
+         * Chip needs level triggered interrupt to work. However,
+         * level triggering doesn't work always correctly with power
+         * management. Select both
+         */
+        err = request_threaded_irq(client->irq, NULL,
+                                bh1770_irq,
+                                IRQF_TRIGGER_FALLING | IRQF_ONESHOT |
+                                IRQF_TRIGGER_LOW,
+                                "bh1770", chip);
+        if (err) {
+                dev_err(&client->dev, "could not get IRQ %d\n",
+                        client->irq);
+                goto fail5;
+        }
+        regulator_bulk_disable(ARRAY_SIZE(chip->regs), chip->regs);
+        return err;
+fail5:
+        sysfs_remove_group(&chip->client->dev.kobj,
+                        &bh1770_attribute_group);
+fail4:
+        if (chip->pdata->release_resources)
+                chip->pdata->release_resources();
+fail3:
+        regulator_bulk_disable(ARRAY_SIZE(chip->regs), chip->regs);
+fail2:
+        regulator_bulk_free(ARRAY_SIZE(chip->regs), chip->regs);
+fail1:
+        kfree(chip);
+        return err;
+}
+
+static int __devexit bh1770_remove(struct i2c_client *client)
+{
+        struct bh1770_chip *chip = i2c_get_clientdata(client);
+
+        free_irq(client->irq, chip);
+
+        sysfs_remove_group(&chip->client->dev.kobj,
+                        &bh1770_attribute_group);
+
+        if (chip->pdata->release_resources)
+                chip->pdata->release_resources();
+
+        cancel_delayed_work_sync(&chip->prox_work);
+
+        if (!pm_runtime_suspended(&client->dev))
+                bh1770_chip_off(chip);
+
+        pm_runtime_disable(&client->dev);
+        pm_runtime_set_suspended(&client->dev);
+
+        regulator_bulk_free(ARRAY_SIZE(chip->regs), chip->regs);
+        kfree(chip);
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int bh1770_suspend(struct device *dev)
+{
+        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct bh1770_chip *chip = i2c_get_clientdata(client);
+
+        bh1770_chip_off(chip);
+
+        return 0;
+}
+
+static int bh1770_resume(struct device *dev)
+{
+        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct bh1770_chip *chip = i2c_get_clientdata(client);
+        int ret = 0;
+
+        bh1770_chip_on(chip);
+
+        if (!pm_runtime_suspended(dev)) {
+                /*
+                 * If we were enabled at suspend time, it is expected
+                 * everything works nice and smoothly
+                 */
+                ret = bh1770_lux_rate(chip, chip->lux_rate_index);
+                ret |= bh1770_lux_interrupt_control(chip, BH1770_ENABLE);
+
+                /* This causes interrupt after the next measurement cycle */
+                bh1770_lux_update_thresholds(chip, BH1770_LUX_DEF_THRES,
+                                        BH1770_LUX_DEF_THRES);
+                /* Inform that we are waiting for a result from ALS */
+                chip->lux_wait_result = true;
+                bh1770_prox_mode_control(chip);
+        }
+        return ret;
+}
+
+#else
+#define bh1770_suspend  NULL
+#define bh1770_shutdown NULL
+#define bh1770_resume   NULL
+#endif
+
+#ifdef CONFIG_PM_RUNTIME
+static int bh1770_runtime_suspend(struct device *dev)
+{
+        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct bh1770_chip *chip = i2c_get_clientdata(client);
+
+        bh1770_chip_off(chip);
+
+        return 0;
+}
+
+static int bh1770_runtime_resume(struct device *dev)
+{
+        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct bh1770_chip *chip = i2c_get_clientdata(client);
+
+        bh1770_chip_on(chip);
+
+        return 0;
+}
+#endif
+
+static const struct i2c_device_id bh1770_id[] = {
+        {"bh1770glc", 0 },
+        {"sfh7770", 0 },
+        {}
+};
+
+MODULE_DEVICE_TABLE(i2c, bh1770_id);
+
+static const struct dev_pm_ops bh1770_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(bh1770_suspend, bh1770_resume)
+        SET_RUNTIME_PM_OPS(bh1770_runtime_suspend, bh1770_runtime_resume, NULL)
+};
+
+static struct i2c_driver bh1770_driver = {
+        .driver  = {
+                .name   = "bh1770glc",
+                .owner  = THIS_MODULE,
+                .pm     = &bh1770_pm_ops,
+        },
+        .probe    = bh1770_probe,
+        .remove   = __devexit_p(bh1770_remove),
+        .id_table = bh1770_id,
+};
+
+static int __init bh1770_init(void)
+{
+        return i2c_add_driver(&bh1770_driver);
+}
+
+static void __exit bh1770_exit(void)
+{
+        i2c_del_driver(&bh1770_driver);
+}
+
+MODULE_DESCRIPTION("BH1770GLC / SFH7770 combined ALS and proximity sensor");
+MODULE_AUTHOR("Samu Onkalo, Nokia Corporation");
+MODULE_LICENSE("GPL v2");
+
+module_init(bh1770_init);
+module_exit(bh1770_exit);
diff --git a/drivers/misc/bh1780gli.c b/drivers/misc/bh1780gli.c
new file mode 100644
index 000000000000..d5f3a3fd2319
--- /dev/null
+++ b/drivers/misc/bh1780gli.c
@@ -0,0 +1,272 @@
+/*
+ * bh1780gli.c
+ * ROHM Ambient Light Sensor Driver
+ *
+ * Copyright (C) 2010 Texas Instruments
+ * Author: Hemanth V <hemanthv@ti.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/i2c.h>
+#include <linux/slab.h>
+#include <linux/mutex.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+
+#define BH1780_REG_CONTROL      0x80
+#define BH1780_REG_PARTID       0x8A
+#define BH1780_REG_MANFID       0x8B
+#define BH1780_REG_DLOW 0x8C
+#define BH1780_REG_DHIGH        0x8D
+
+#define BH1780_REVMASK          (0xf)
+#define BH1780_POWMASK          (0x3)
+#define BH1780_POFF             (0x0)
+#define BH1780_PON              (0x3)
+
+/* power on settling time in ms */
+#define BH1780_PON_DELAY        2
+
+struct bh1780_data {
+        struct i2c_client *client;
+        int power_state;
+        /* lock for sysfs operations */
+        struct mutex lock;
+};
+
+static int bh1780_write(struct bh1780_data *ddata, u8 reg, u8 val, char *msg)
+{
+        int ret = i2c_smbus_write_byte_data(ddata->client, reg, val);
+        if (ret < 0)
+                dev_err(&ddata->client->dev,
+                        "i2c_smbus_write_byte_data failed error %d\
+                        Register (%s)\n", ret, msg);
+        return ret;
+}
+
+static int bh1780_read(struct bh1780_data *ddata, u8 reg, char *msg)
+{
+        int ret = i2c_smbus_read_byte_data(ddata->client, reg);
+        if (ret < 0)
+                dev_err(&ddata->client->dev,
+                        "i2c_smbus_read_byte_data failed error %d\
+                         Register (%s)\n", ret, msg);
+        return ret;
+}
+
+static ssize_t bh1780_show_lux(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct bh1780_data *ddata = platform_get_drvdata(pdev);
+        int lsb, msb;
+
+        lsb = bh1780_read(ddata, BH1780_REG_DLOW, "DLOW");
+        if (lsb < 0)
+                return lsb;
+
+        msb = bh1780_read(ddata, BH1780_REG_DHIGH, "DHIGH");
+        if (msb < 0)
+                return msb;
+
+        return sprintf(buf, "%d\n", (msb << 8) | lsb);
+}
+
+static ssize_t bh1780_show_power_state(struct device *dev,
+                                        struct device_attribute *attr,
+                                        char *buf)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct bh1780_data *ddata = platform_get_drvdata(pdev);
+        int state;
+
+        state = bh1780_read(ddata, BH1780_REG_CONTROL, "CONTROL");
+        if (state < 0)
+                return state;
+
+        return sprintf(buf, "%d\n", state & BH1780_POWMASK);
+}
+
+static ssize_t bh1780_store_power_state(struct device *dev,
+                                        struct device_attribute *attr,
+                                        const char *buf, size_t count)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct bh1780_data *ddata = platform_get_drvdata(pdev);
+        unsigned long val;
+        int error;
+
+        error = strict_strtoul(buf, 0, &val);
+        if (error)
+                return error;
+
+        if (val < BH1780_POFF || val > BH1780_PON)
+                return -EINVAL;
+
+        mutex_lock(&ddata->lock);
+
+        error = bh1780_write(ddata, BH1780_REG_CONTROL, val, "CONTROL");
+        if (error < 0) {
+                mutex_unlock(&ddata->lock);
+                return error;
+        }
+
+        msleep(BH1780_PON_DELAY);
+        ddata->power_state = val;
+        mutex_unlock(&ddata->lock);
+
+        return count;
+}
+
+static DEVICE_ATTR(lux, S_IRUGO, bh1780_show_lux, NULL);
+
+static DEVICE_ATTR(power_state, S_IWUSR | S_IRUGO,
+                bh1780_show_power_state, bh1780_store_power_state);
+
+static struct attribute *bh1780_attributes[] = {
+        &dev_attr_power_state.attr,
+        &dev_attr_lux.attr,
+        NULL
+};
+
+static const struct attribute_group bh1780_attr_group = {
+        .attrs = bh1780_attributes,
+};
+
+static int __devinit bh1780_probe(struct i2c_client *client,
+                                                const struct i2c_device_id *id)
+{
+        int ret;
+        struct bh1780_data *ddata = NULL;
+        struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
+
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE)) {
+                ret = -EIO;
+                goto err_op_failed;
+        }
+
+        ddata = kzalloc(sizeof(struct bh1780_data), GFP_KERNEL);
+        if (ddata == NULL) {
+                ret = -ENOMEM;
+                goto err_op_failed;
+        }
+
+        ddata->client = client;
+        i2c_set_clientdata(client, ddata);
+
+        ret = bh1780_read(ddata, BH1780_REG_PARTID, "PART ID");
+        if (ret < 0)
+                goto err_op_failed;
+
+        dev_info(&client->dev, "Ambient Light Sensor, Rev : %d\n",
+                        (ret & BH1780_REVMASK));
+
+        mutex_init(&ddata->lock);
+
+        ret = sysfs_create_group(&client->dev.kobj, &bh1780_attr_group);
+        if (ret)
+                goto err_op_failed;
+
+        return 0;
+
+err_op_failed:
+        kfree(ddata);
+        return ret;
+}
+
+static int __devexit bh1780_remove(struct i2c_client *client)
+{
+        struct bh1780_data *ddata;
+
+        ddata = i2c_get_clientdata(client);
+        sysfs_remove_group(&client->dev.kobj, &bh1780_attr_group);
+        kfree(ddata);
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int bh1780_suspend(struct i2c_client *client, pm_message_t mesg)
+{
+        struct bh1780_data *ddata;
+        int state, ret;
+
+        ddata = i2c_get_clientdata(client);
+        state = bh1780_read(ddata, BH1780_REG_CONTROL, "CONTROL");
+        if (state < 0)
+                return state;
+
+        ddata->power_state = state & BH1780_POWMASK;
+
+        ret = bh1780_write(ddata, BH1780_REG_CONTROL, BH1780_POFF,
+                                "CONTROL");
+
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+static int bh1780_resume(struct i2c_client *client)
+{
+        struct bh1780_data *ddata;
+        int state, ret;
+
+        ddata = i2c_get_clientdata(client);
+        state = ddata->power_state;
+
+        ret = bh1780_write(ddata, BH1780_REG_CONTROL, state,
+                                "CONTROL");
+
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+#else
+#define bh1780_suspend NULL
+#define bh1780_resume NULL
+#endif /* CONFIG_PM */
+
+static const struct i2c_device_id bh1780_id[] = {
+        { "bh1780", 0 },
+        { },
+};
+
+static struct i2c_driver bh1780_driver = {
+        .probe          = bh1780_probe,
+        .remove         = bh1780_remove,
+        .id_table       = bh1780_id,
+        .suspend        = bh1780_suspend,
+        .resume         = bh1780_resume,
+        .driver = {
+                .name = "bh1780"
+        },
+};
+
+static int __init bh1780_init(void)
+{
+        return i2c_add_driver(&bh1780_driver);
+}
+
+static void __exit bh1780_exit(void)
+{
+        i2c_del_driver(&bh1780_driver);
+}
+
+module_init(bh1780_init)
+module_exit(bh1780_exit)
+
+MODULE_DESCRIPTION("BH1780GLI Ambient Light Sensor Driver");
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Hemanth V <hemanthv@ti.com>");
diff --git a/drivers/misc/bmp085.c b/drivers/misc/bmp085.c
new file mode 100644
index 000000000000..63ee4c1a5315
--- /dev/null
+++ b/drivers/misc/bmp085.c
@@ -0,0 +1,482 @@
+/*  Copyright (c) 2010  Christoph Mair <christoph.mair@gmail.com>
+
+    This driver supports the bmp085 digital barometric pressure
+    and temperature sensor from Bosch Sensortec. The datasheet
+    is avaliable from their website:
+    http://www.bosch-sensortec.com/content/language1/downloads/BST-BMP085-DS000-05.pdf
+
+    A pressure measurement is issued by reading from pressure0_input.
+    The return value ranges from 30000 to 110000 pascal with a resulution
+    of 1 pascal (0.01 millibar) which enables measurements from 9000m above
+    to 500m below sea level.
+
+    The temperature can be read from temp0_input. Values range from
+    -400 to 850 representing the ambient temperature in degree celsius
+    multiplied by 10.The resolution is 0.1 celsius.
+
+    Because ambient pressure is temperature dependent, a temperature
+    measurement will be executed automatically even if the user is reading
+    from pressure0_input. This happens if the last temperature measurement
+    has been executed more then one second ago.
+
+    To decrease RMS noise from pressure measurements, the bmp085 can
+    autonomously calculate the average of up to eight samples. This is
+    set up by writing to the oversampling sysfs file. Accepted values
+    are 0, 1, 2 and 3. 2^x when x is the value written to this file
+    specifies the number of samples used to calculate the ambient pressure.
+    RMS noise is specified with six pascal (without averaging) and decreases
+    down to 3 pascal when using an oversampling setting of 3.
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/i2c.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+
+
+#define BMP085_I2C_ADDRESS              0x77
+#define BMP085_CHIP_ID                  0x55
+
+#define BMP085_CALIBRATION_DATA_START   0xAA
+#define BMP085_CALIBRATION_DATA_LENGTH  11      /* 16 bit values */
+#define BMP085_CHIP_ID_REG              0xD0
+#define BMP085_VERSION_REG              0xD1
+#define BMP085_CTRL_REG                 0xF4
+#define BMP085_TEMP_MEASUREMENT         0x2E
+#define BMP085_PRESSURE_MEASUREMENT     0x34
+#define BMP085_CONVERSION_REGISTER_MSB  0xF6
+#define BMP085_CONVERSION_REGISTER_LSB  0xF7
+#define BMP085_CONVERSION_REGISTER_XLSB 0xF8
+#define BMP085_TEMP_CONVERSION_TIME     5
+
+#define BMP085_CLIENT_NAME              "bmp085"
+
+
+static const unsigned short normal_i2c[] = { BMP085_I2C_ADDRESS,
+                                                        I2C_CLIENT_END };
+
+struct bmp085_calibration_data {
+        s16 AC1, AC2, AC3;
+        u16 AC4, AC5, AC6;
+        s16 B1, B2;
+        s16 MB, MC, MD;
+};
+
+
+/* Each client has this additional data */
+struct bmp085_data {
+        struct i2c_client *client;
+        struct mutex lock;
+        struct bmp085_calibration_data calibration;
+        u32 raw_temperature;
+        u32 raw_pressure;
+        unsigned char oversampling_setting;
+        u32 last_temp_measurement;
+        s32 b6; /* calculated temperature correction coefficient */
+};
+
+
+static s32 bmp085_read_calibration_data(struct i2c_client *client)
+{
+        u16 tmp[BMP085_CALIBRATION_DATA_LENGTH];
+        struct bmp085_data *data = i2c_get_clientdata(client);
+        struct bmp085_calibration_data *cali = &(data->calibration);
+        s32 status = i2c_smbus_read_i2c_block_data(client,
+                                BMP085_CALIBRATION_DATA_START,
+                                BMP085_CALIBRATION_DATA_LENGTH*sizeof(u16),
+                                (u8 *)tmp);
+        if (status < 0)
+                return status;
+
+        if (status != BMP085_CALIBRATION_DATA_LENGTH*sizeof(u16))
+                return -EIO;
+
+        cali->AC1 =  be16_to_cpu(tmp[0]);
+        cali->AC2 =  be16_to_cpu(tmp[1]);
+        cali->AC3 =  be16_to_cpu(tmp[2]);
+        cali->AC4 =  be16_to_cpu(tmp[3]);
+        cali->AC5 =  be16_to_cpu(tmp[4]);
+        cali->AC6 = be16_to_cpu(tmp[5]);
+        cali->B1 = be16_to_cpu(tmp[6]);
+        cali->B2 = be16_to_cpu(tmp[7]);
+        cali->MB = be16_to_cpu(tmp[8]);
+        cali->MC = be16_to_cpu(tmp[9]);
+        cali->MD = be16_to_cpu(tmp[10]);
+        return 0;
+}
+
+
+static s32 bmp085_update_raw_temperature(struct bmp085_data *data)
+{
+        u16 tmp;
+        s32 status;
+
+        mutex_lock(&data->lock);
+        status = i2c_smbus_write_byte_data(data->client, BMP085_CTRL_REG,
+                                                BMP085_TEMP_MEASUREMENT);
+        if (status != 0) {
+                dev_err(&data->client->dev,
+                        "Error while requesting temperature measurement.\n");
+                goto exit;
+        }
+        msleep(BMP085_TEMP_CONVERSION_TIME);
+
+        status = i2c_smbus_read_i2c_block_data(data->client,
+                BMP085_CONVERSION_REGISTER_MSB, sizeof(tmp), (u8 *)&tmp);
+        if (status < 0)
+                goto exit;
+        if (status != sizeof(tmp)) {
+                dev_err(&data->client->dev,
+                        "Error while reading temperature measurement result\n");
+                status = -EIO;
+                goto exit;
+        }
+        data->raw_temperature = be16_to_cpu(tmp);
+        data->last_temp_measurement = jiffies;
+        status = 0;     /* everything ok, return 0 */
+
+exit:
+        mutex_unlock(&data->lock);
+        return status;
+}
+
+static s32 bmp085_update_raw_pressure(struct bmp085_data *data)
+{
+        u32 tmp = 0;
+        s32 status;
+
+        mutex_lock(&data->lock);
+        status = i2c_smbus_write_byte_data(data->client, BMP085_CTRL_REG,
+                BMP085_PRESSURE_MEASUREMENT + (data->oversampling_setting<<6));
+        if (status != 0) {
+                dev_err(&data->client->dev,
+                        "Error while requesting pressure measurement.\n");
+                goto exit;
+        }
+
+        /* wait for the end of conversion */
+        msleep(2+(3 << data->oversampling_setting));
+
+        /* copy data into a u32 (4 bytes), but skip the first byte. */
+        status = i2c_smbus_read_i2c_block_data(data->client,
+                        BMP085_CONVERSION_REGISTER_MSB, 3, ((u8 *)&tmp)+1);
+        if (status < 0)
+                goto exit;
+        if (status != 3) {
+                dev_err(&data->client->dev,
+                        "Error while reading pressure measurement results\n");
+                status = -EIO;
+                goto exit;
+        }
+        data->raw_pressure = be32_to_cpu((tmp));
+        data->raw_pressure >>= (8-data->oversampling_setting);
+        status = 0;     /* everything ok, return 0 */
+
+exit:
+        mutex_unlock(&data->lock);
+        return status;
+}
+
+
+/*
+ * This function starts the temperature measurement and returns the value
+ * in tenth of a degree celsius.
+ */
+static s32 bmp085_get_temperature(struct bmp085_data *data, int *temperature)
+{
+        struct bmp085_calibration_data *cali = &data->calibration;
+        long x1, x2;
+        int status;
+
+        status = bmp085_update_raw_temperature(data);
+        if (status != 0)
+                goto exit;
+
+        x1 = ((data->raw_temperature - cali->AC6) * cali->AC5) >> 15;
+        x2 = (cali->MC << 11) / (x1 + cali->MD);
+        data->b6 = x1 + x2 - 4000;
+        /* if NULL just update b6. Used for pressure only measurements */
+        if (temperature != NULL)
+                *temperature = (x1+x2+8) >> 4;
+
+exit:
+        return status;;
+}
+
+/*
+ * This function starts the pressure measurement and returns the value
+ * in millibar. Since the pressure depends on the ambient temperature,
+ * a temperature measurement is executed if the last known value is older
+ * than one second.
+ */
+static s32 bmp085_get_pressure(struct bmp085_data *data, int *pressure)
+{
+        struct bmp085_calibration_data *cali = &data->calibration;
+        s32 x1, x2, x3, b3;
+        u32 b4, b7;
+        s32 p;
+        int status;
+
+        /* alt least every second force an update of the ambient temperature */
+        if (data->last_temp_measurement + 1*HZ < jiffies) {
+                status = bmp085_get_temperature(data, NULL);
+                if (status != 0)
+                        goto exit;
+        }
+
+        status = bmp085_update_raw_pressure(data);
+        if (status != 0)
+                goto exit;
+
+        x1 = (data->b6 * data->b6) >> 12;
+        x1 *= cali->B2;
+        x1 >>= 11;
+
+        x2 = cali->AC2 * data->b6;
+        x2 >>= 11;
+
+        x3 = x1 + x2;
+
+        b3 = (((((s32)cali->AC1) * 4 + x3) << data->oversampling_setting) + 2);
+        b3 >>= 2;
+
+        x1 = (cali->AC3 * data->b6) >> 13;
+        x2 = (cali->B1 * ((data->b6 * data->b6) >> 12)) >> 16;
+        x3 = (x1 + x2 + 2) >> 2;
+        b4 = (cali->AC4 * (u32)(x3 + 32768)) >> 15;
+
+        b7 = ((u32)data->raw_pressure - b3) *
+                                        (50000 >> data->oversampling_setting);
+        p = ((b7 < 0x80000000) ? ((b7 << 1) / b4) : ((b7 / b4) * 2));
+
+        x1 = p >> 8;
+        x1 *= x1;
+        x1 = (x1 * 3038) >> 16;
+        x2 = (-7357 * p) >> 16;
+        p += (x1 + x2 + 3791) >> 4;
+
+        *pressure = p;
+
+exit:
+        return status;
+}
+
+/*
+ * This function sets the chip-internal oversampling. Valid values are 0..3.
+ * The chip will use 2^oversampling samples for internal averaging.
+ * This influences the measurement time and the accuracy; larger values
+ * increase both. The datasheet gives on overview on how measurement time,
+ * accuracy and noise correlate.
+ */
+static void bmp085_set_oversampling(struct bmp085_data *data,
+                                                unsigned char oversampling)
+{
+        if (oversampling > 3)
+                oversampling = 3;
+        data->oversampling_setting = oversampling;
+}
+
+/*
+ * Returns the currently selected oversampling. Range: 0..3
+ */
+static unsigned char bmp085_get_oversampling(struct bmp085_data *data)
+{
+        return data->oversampling_setting;
+}
+
+/* sysfs callbacks */
+static ssize_t set_oversampling(struct device *dev,
+                                struct device_attribute *attr,
+                                const char *buf, size_t count)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct bmp085_data *data = i2c_get_clientdata(client);
+        unsigned long oversampling;
+        int success = strict_strtoul(buf, 10, &oversampling);
+        if (success == 0) {
+                bmp085_set_oversampling(data, oversampling);
+                return count;
+        }
+        return success;
+}
+
+static ssize_t show_oversampling(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct bmp085_data *data = i2c_get_clientdata(client);
+        return sprintf(buf, "%u\n", bmp085_get_oversampling(data));
+}
+static DEVICE_ATTR(oversampling, S_IWUSR | S_IRUGO,
+                                        show_oversampling, set_oversampling);
+
+
+static ssize_t show_temperature(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        int temperature;
+        int status;
+        struct i2c_client *client = to_i2c_client(dev);
+        struct bmp085_data *data = i2c_get_clientdata(client);
+
+        status = bmp085_get_temperature(data, &temperature);
+        if (status != 0)
+                return status;
+        else
+                return sprintf(buf, "%d\n", temperature);
+}
+static DEVICE_ATTR(temp0_input, S_IRUGO, show_temperature, NULL);
+
+
+static ssize_t show_pressure(struct device *dev,
+                             struct device_attribute *attr, char *buf)
+{
+        int pressure;
+        int status;
+        struct i2c_client *client = to_i2c_client(dev);
+        struct bmp085_data *data = i2c_get_clientdata(client);
+
+        status = bmp085_get_pressure(data, &pressure);
+        if (status != 0)
+                return status;
+        else
+                return sprintf(buf, "%d\n", pressure);
+}
+static DEVICE_ATTR(pressure0_input, S_IRUGO, show_pressure, NULL);
+
+
+static struct attribute *bmp085_attributes[] = {
+        &dev_attr_temp0_input.attr,
+        &dev_attr_pressure0_input.attr,
+        &dev_attr_oversampling.attr,
+        NULL
+};
+
+static const struct attribute_group bmp085_attr_group = {
+        .attrs = bmp085_attributes,
+};
+
+static int bmp085_detect(struct i2c_client *client, struct i2c_board_info *info)
+{
+        if (client->addr != BMP085_I2C_ADDRESS)
+                return -ENODEV;
+
+        if (i2c_smbus_read_byte_data(client, BMP085_CHIP_ID_REG) != BMP085_CHIP_ID)
+                return -ENODEV;
+
+        return 0;
+}
+
+static int bmp085_init_client(struct i2c_client *client)
+{
+        unsigned char version;
+        int status;
+        struct bmp085_data *data = i2c_get_clientdata(client);
+        data->client = client;
+        status = bmp085_read_calibration_data(client);
+        if (status != 0)
+                goto exit;
+        version = i2c_smbus_read_byte_data(client, BMP085_VERSION_REG);
+        data->last_temp_measurement = 0;
+        data->oversampling_setting = 3;
+        mutex_init(&data->lock);
+        dev_info(&data->client->dev, "BMP085 ver. %d.%d found.\n",
+                        (version & 0x0F), (version & 0xF0) >> 4);
+exit:
+        return status;
+}
+
+static int bmp085_probe(struct i2c_client *client,
+                         const struct i2c_device_id *id)
+{
+        struct bmp085_data *data;
+        int err = 0;
+
+        data = kzalloc(sizeof(struct bmp085_data), GFP_KERNEL);
+        if (!data) {
+                err = -ENOMEM;
+                goto exit;
+        }
+
+        /* default settings after POR */
+        data->oversampling_setting = 0x00;
+
+        i2c_set_clientdata(client, data);
+
+        /* Initialize the BMP085 chip */
+        err = bmp085_init_client(client);
+        if (err != 0)
+                goto exit_free;
+
+        /* Register sysfs hooks */
+        err = sysfs_create_group(&client->dev.kobj, &bmp085_attr_group);
+        if (err)
+                goto exit_free;
+
+        dev_info(&data->client->dev, "Succesfully initialized bmp085!\n");
+        goto exit;
+
+exit_free:
+        kfree(data);
+exit:
+        return err;
+}
+
+static int bmp085_remove(struct i2c_client *client)
+{
+        sysfs_remove_group(&client->dev.kobj, &bmp085_attr_group);
+        kfree(i2c_get_clientdata(client));
+        return 0;
+}
+
+static const struct i2c_device_id bmp085_id[] = {
+        { "bmp085", 0 },
+        { }
+};
+
+static struct i2c_driver bmp085_driver = {
+        .driver = {
+                .owner = THIS_MODULE,
+                .name   = "bmp085"
+        },
+        .id_table       = bmp085_id,
+        .probe          = bmp085_probe,
+        .remove         = bmp085_remove,
+
+        .detect         = bmp085_detect,
+        .address_list   = normal_i2c
+};
+
+static int __init bmp085_init(void)
+{
+        return i2c_add_driver(&bmp085_driver);
+}
+
+static void __exit bmp085_exit(void)
+{
+        i2c_del_driver(&bmp085_driver);
+}
+
+
+MODULE_AUTHOR("Christoph Mair <christoph.mair@gmail.com");
+MODULE_DESCRIPTION("BMP085 driver");
+MODULE_LICENSE("GPL");
+
+module_init(bmp085_init);
+module_exit(bmp085_exit);
diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
index b5346b4db91a..19fc7c1cb428 100644
--- a/drivers/misc/c2port/core.c
+++ b/drivers/misc/c2port/core.c
@@ -20,6 +20,7 @@
 #include <linux/delay.h>
 #include <linux/idr.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 
 #include <linux/c2port.h>
 
@@ -706,7 +707,7 @@ static ssize_t __c2port_read_flash_data(struct c2port_device *dev,
         return nread;
 }
 
-static ssize_t c2port_read_flash_data(struct kobject *kobj,
+static ssize_t c2port_read_flash_data(struct file *filp, struct kobject *kobj,
                                 struct bin_attribute *attr,
                                 char *buffer, loff_t offset, size_t count)
 {
@@ -823,7 +824,7 @@ static ssize_t __c2port_write_flash_data(struct c2port_device *dev,
         return nwrite;
 }
 
-static ssize_t c2port_write_flash_data(struct kobject *kobj,
+static ssize_t c2port_write_flash_data(struct file *filp, struct kobject *kobj,
                                 struct bin_attribute *attr,
                                 char *buffer, loff_t offset, size_t count)
 {
@@ -912,8 +913,8 @@ struct c2port_device *c2port_device_register(char *name,
 
         c2dev->dev = device_create(c2port_class, NULL, 0, c2dev,
                                         "c2port%d", id);
-        if (unlikely(!c2dev->dev)) {
-                ret = -ENOMEM;
+        if (unlikely(IS_ERR(c2dev->dev))) {
+                ret = PTR_ERR(c2dev->dev);
                 goto error_device_create;
         }
         dev_set_drvdata(c2dev->dev, c2dev);
diff --git a/drivers/misc/cb710/core.c b/drivers/misc/cb710/core.c
index b14eab0f2ba5..efec4139c3f6 100644
--- a/drivers/misc/cb710/core.c
+++ b/drivers/misc/cb710/core.c
@@ -9,11 +9,11 @@
  */
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/slab.h>
 #include <linux/pci.h>
 #include <linux/spinlock.h>
 #include <linux/idr.h>
 #include <linux/cb710.h>
+#include <linux/gfp.h>
 
 static DEFINE_IDA(cb710_ida);
 static DEFINE_SPINLOCK(cb710_ida_lock);
diff --git a/drivers/misc/cb710/debug.c b/drivers/misc/cb710/debug.c
index 02358d086e03..fcb3b8e30c52 100644
--- a/drivers/misc/cb710/debug.c
+++ b/drivers/misc/cb710/debug.c
@@ -10,7 +10,6 @@
 #include <linux/cb710.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/slab.h>
 
 #define CB710_REG_COUNT         0x80
 
diff --git a/drivers/misc/cb710/sgbuf2.c b/drivers/misc/cb710/sgbuf2.c
index d38a7acdb6ec..d019746551f3 100644
--- a/drivers/misc/cb710/sgbuf2.c
+++ b/drivers/misc/cb710/sgbuf2.c
@@ -114,7 +114,6 @@ static void sg_dwiter_write_slow(struct sg_mapping_iter *miter, uint32_t data)
                 if (!left)
                         return;
                 addr += len;
-                flush_kernel_dcache_page(miter->page);
         } while (sg_dwiter_next(miter));
 }
 
@@ -142,9 +141,6 @@ void cb710_sg_dwiter_write_next_block(struct sg_mapping_iter *miter, uint32_t da
                         return;
         } else
                 sg_dwiter_write_slow(miter, data);
-
-        if (miter->length == miter->consumed)
-                flush_kernel_dcache_page(miter->page);
 }
 EXPORT_SYMBOL_GPL(cb710_sg_dwiter_write_next_block);
 
diff --git a/drivers/misc/cs5535-mfgpt.c b/drivers/misc/cs5535-mfgpt.c
new file mode 100644
index 000000000000..6f6218061b0d
--- /dev/null
+++ b/drivers/misc/cs5535-mfgpt.c
@@ -0,0 +1,382 @@
+/*
+ * Driver for the CS5535/CS5536 Multi-Function General Purpose Timers (MFGPT)
+ *
+ * Copyright (C) 2006, Advanced Micro Devices, Inc.
+ * Copyright (C) 2007  Andres Salomon <dilinger@debian.org>
+ * Copyright (C) 2009  Andres Salomon <dilinger@collabora.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public License
+ * as published by the Free Software Foundation.
+ *
+ * The MFGPTs are documented in AMD Geode CS5536 Companion Device Data Book.
+ */
+
+#include <linux/kernel.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/cs5535.h>
+#include <linux/slab.h>
+
+#define DRV_NAME "cs5535-mfgpt"
+#define MFGPT_BAR 2
+
+static int mfgpt_reset_timers;
+module_param_named(mfgptfix, mfgpt_reset_timers, int, 0644);
+MODULE_PARM_DESC(mfgptfix, "Reset the MFGPT timers during init; "
+                "required by some broken BIOSes (ie, TinyBIOS < 0.99).");
+
+struct cs5535_mfgpt_timer {
+        struct cs5535_mfgpt_chip *chip;
+        int nr;
+};
+
+static struct cs5535_mfgpt_chip {
+        DECLARE_BITMAP(avail, MFGPT_MAX_TIMERS);
+        resource_size_t base;
+
+        struct pci_dev *pdev;
+        spinlock_t lock;
+        int initialized;
+} cs5535_mfgpt_chip;
+
+int cs5535_mfgpt_toggle_event(struct cs5535_mfgpt_timer *timer, int cmp,
+                int event, int enable)
+{
+        uint32_t msr, mask, value, dummy;
+        int shift = (cmp == MFGPT_CMP1) ? 0 : 8;
+
+        if (!timer) {
+                WARN_ON(1);
+                return -EIO;
+        }
+
+        /*
+         * The register maps for these are described in sections 6.17.1.x of
+         * the AMD Geode CS5536 Companion Device Data Book.
+         */
+        switch (event) {
+        case MFGPT_EVENT_RESET:
+                /*
+                 * XXX: According to the docs, we cannot reset timers above
+                 * 6; that is, resets for 7 and 8 will be ignored.  Is this
+                 * a problem?   -dilinger
+                 */
+                msr = MSR_MFGPT_NR;
+                mask = 1 << (timer->nr + 24);
+                break;
+
+        case MFGPT_EVENT_NMI:
+                msr = MSR_MFGPT_NR;
+                mask = 1 << (timer->nr + shift);
+                break;
+
+        case MFGPT_EVENT_IRQ:
+                msr = MSR_MFGPT_IRQ;
+                mask = 1 << (timer->nr + shift);
+                break;
+
+        default:
+                return -EIO;
+        }
+
+        rdmsr(msr, value, dummy);
+
+        if (enable)
+                value |= mask;
+        else
+                value &= ~mask;
+
+        wrmsr(msr, value, dummy);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_toggle_event);
+
+int cs5535_mfgpt_set_irq(struct cs5535_mfgpt_timer *timer, int cmp, int *irq,
+                int enable)
+{
+        uint32_t zsel, lpc, dummy;
+        int shift;
+
+        if (!timer) {
+                WARN_ON(1);
+                return -EIO;
+        }
+
+        /*
+         * Unfortunately, MFGPTs come in pairs sharing their IRQ lines. If VSA
+         * is using the same CMP of the timer's Siamese twin, the IRQ is set to
+         * 2, and we mustn't use nor change it.
+         * XXX: Likewise, 2 Linux drivers might clash if the 2nd overwrites the
+         * IRQ of the 1st. This can only happen if forcing an IRQ, calling this
+         * with *irq==0 is safe. Currently there _are_ no 2 drivers.
+         */
+        rdmsr(MSR_PIC_ZSEL_LOW, zsel, dummy);
+        shift = ((cmp == MFGPT_CMP1 ? 0 : 4) + timer->nr % 4) * 4;
+        if (((zsel >> shift) & 0xF) == 2)
+                return -EIO;
+
+        /* Choose IRQ: if none supplied, keep IRQ already set or use default */
+        if (!*irq)
+                *irq = (zsel >> shift) & 0xF;
+        if (!*irq)
+                *irq = CONFIG_CS5535_MFGPT_DEFAULT_IRQ;
+
+        /* Can't use IRQ if it's 0 (=disabled), 2, or routed to LPC */
+        if (*irq < 1 || *irq == 2 || *irq > 15)
+                return -EIO;
+        rdmsr(MSR_PIC_IRQM_LPC, lpc, dummy);
+        if (lpc & (1 << *irq))
+                return -EIO;
+
+        /* All chosen and checked - go for it */
+        if (cs5535_mfgpt_toggle_event(timer, cmp, MFGPT_EVENT_IRQ, enable))
+                return -EIO;
+        if (enable) {
+                zsel = (zsel & ~(0xF << shift)) | (*irq << shift);
+                wrmsr(MSR_PIC_ZSEL_LOW, zsel, dummy);
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_set_irq);
+
+struct cs5535_mfgpt_timer *cs5535_mfgpt_alloc_timer(int timer_nr, int domain)
+{
+        struct cs5535_mfgpt_chip *mfgpt = &cs5535_mfgpt_chip;
+        struct cs5535_mfgpt_timer *timer = NULL;
+        unsigned long flags;
+        int max;
+
+        if (!mfgpt->initialized)
+                goto done;
+
+        /* only allocate timers from the working domain if requested */
+        if (domain == MFGPT_DOMAIN_WORKING)
+                max = 6;
+        else
+                max = MFGPT_MAX_TIMERS;
+
+        if (timer_nr >= max) {
+                /* programmer error.  silly programmers! */
+                WARN_ON(1);
+                goto done;
+        }
+
+        spin_lock_irqsave(&mfgpt->lock, flags);
+        if (timer_nr < 0) {
+                unsigned long t;
+
+                /* try to find any available timer */
+                t = find_first_bit(mfgpt->avail, max);
+                /* set timer_nr to -1 if no timers available */
+                timer_nr = t < max ? (int) t : -1;
+        } else {
+                /* check if the requested timer's available */
+                if (test_bit(timer_nr, mfgpt->avail))
+                        timer_nr = -1;
+        }
+
+        if (timer_nr >= 0)
+                /* if timer_nr is not -1, it's an available timer */
+                __clear_bit(timer_nr, mfgpt->avail);
+        spin_unlock_irqrestore(&mfgpt->lock, flags);
+
+        if (timer_nr < 0)
+                goto done;
+
+        timer = kmalloc(sizeof(*timer), GFP_KERNEL);
+        if (!timer) {
+                /* aw hell */
+                spin_lock_irqsave(&mfgpt->lock, flags);
+                __set_bit(timer_nr, mfgpt->avail);
+                spin_unlock_irqrestore(&mfgpt->lock, flags);
+                goto done;
+        }
+        timer->chip = mfgpt;
+        timer->nr = timer_nr;
+        dev_info(&mfgpt->pdev->dev, "registered timer %d\n", timer_nr);
+
+done:
+        return timer;
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_alloc_timer);
+
+/*
+ * XXX: This frees the timer memory, but never resets the actual hardware
+ * timer.  The old geode_mfgpt code did this; it would be good to figure
+ * out a way to actually release the hardware timer.  See comments below.
+ */
+void cs5535_mfgpt_free_timer(struct cs5535_mfgpt_timer *timer)
+{
+        unsigned long flags;
+        uint16_t val;
+
+        /* timer can be made available again only if never set up */
+        val = cs5535_mfgpt_read(timer, MFGPT_REG_SETUP);
+        if (!(val & MFGPT_SETUP_SETUP)) {
+                spin_lock_irqsave(&timer->chip->lock, flags);
+                __set_bit(timer->nr, timer->chip->avail);
+                spin_unlock_irqrestore(&timer->chip->lock, flags);
+        }
+
+        kfree(timer);
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_free_timer);
+
+uint16_t cs5535_mfgpt_read(struct cs5535_mfgpt_timer *timer, uint16_t reg)
+{
+        return inw(timer->chip->base + reg + (timer->nr * 8));
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_read);
+
+void cs5535_mfgpt_write(struct cs5535_mfgpt_timer *timer, uint16_t reg,
+                uint16_t value)
+{
+        outw(value, timer->chip->base + reg + (timer->nr * 8));
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_write);
+
+/*
+ * This is a sledgehammer that resets all MFGPT timers. This is required by
+ * some broken BIOSes which leave the system in an unstable state
+ * (TinyBIOS 0.98, for example; fixed in 0.99).  It's uncertain as to
+ * whether or not this secret MSR can be used to release individual timers.
+ * Jordan tells me that he and Mitch once played w/ it, but it's unclear
+ * what the results of that were (and they experienced some instability).
+ */
+static void __init reset_all_timers(void)
+{
+        uint32_t val, dummy;
+
+        /* The following undocumented bit resets the MFGPT timers */
+        val = 0xFF; dummy = 0;
+        wrmsr(MSR_MFGPT_SETUP, val, dummy);
+}
+
+/*
+ * Check whether any MFGPTs are available for the kernel to use.  In most
+ * cases, firmware that uses AMD's VSA code will claim all timers during
+ * bootup; we certainly don't want to take them if they're already in use.
+ * In other cases (such as with VSAless OpenFirmware), the system firmware
+ * leaves timers available for us to use.
+ */
+static int __init scan_timers(struct cs5535_mfgpt_chip *mfgpt)
+{
+        struct cs5535_mfgpt_timer timer = { .chip = mfgpt };
+        unsigned long flags;
+        int timers = 0;
+        uint16_t val;
+        int i;
+
+        /* bios workaround */
+        if (mfgpt_reset_timers)
+                reset_all_timers();
+
+        /* just to be safe, protect this section w/ lock */
+        spin_lock_irqsave(&mfgpt->lock, flags);
+        for (i = 0; i < MFGPT_MAX_TIMERS; i++) {
+                timer.nr = i;
+                val = cs5535_mfgpt_read(&timer, MFGPT_REG_SETUP);
+                if (!(val & MFGPT_SETUP_SETUP)) {
+                        __set_bit(i, mfgpt->avail);
+                        timers++;
+                }
+        }
+        spin_unlock_irqrestore(&mfgpt->lock, flags);
+
+        return timers;
+}
+
+static int __init cs5535_mfgpt_probe(struct pci_dev *pdev,
+                const struct pci_device_id *pci_id)
+{
+        int err, t;
+
+        /* There are two ways to get the MFGPT base address; one is by
+         * fetching it from MSR_LBAR_MFGPT, the other is by reading the
+         * PCI BAR info.  The latter method is easier (especially across
+         * different architectures), so we'll stick with that for now.  If
+         * it turns out to be unreliable in the face of crappy BIOSes, we
+         * can always go back to using MSRs.. */
+
+        err = pci_enable_device_io(pdev);
+        if (err) {
+                dev_err(&pdev->dev, "can't enable device IO\n");
+                goto done;
+        }
+
+        err = pci_request_region(pdev, MFGPT_BAR, DRV_NAME);
+        if (err) {
+                dev_err(&pdev->dev, "can't alloc PCI BAR #%d\n", MFGPT_BAR);
+                goto done;
+        }
+
+        /* set up the driver-specific struct */
+        cs5535_mfgpt_chip.base = pci_resource_start(pdev, MFGPT_BAR);
+        cs5535_mfgpt_chip.pdev = pdev;
+        spin_lock_init(&cs5535_mfgpt_chip.lock);
+
+        dev_info(&pdev->dev, "allocated PCI BAR #%d: base 0x%llx\n", MFGPT_BAR,
+                        (unsigned long long) cs5535_mfgpt_chip.base);
+
+        /* detect the available timers */
+        t = scan_timers(&cs5535_mfgpt_chip);
+        dev_info(&pdev->dev, DRV_NAME ": %d MFGPT timers available\n", t);
+        cs5535_mfgpt_chip.initialized = 1;
+        return 0;
+
+done:
+        return err;
+}
+
+static struct pci_device_id cs5535_mfgpt_pci_tbl[] = {
+        { PCI_DEVICE(PCI_VENDOR_ID_NS, PCI_DEVICE_ID_NS_CS5535_ISA) },
+        { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA) },
+        { 0, },
+};
+MODULE_DEVICE_TABLE(pci, cs5535_mfgpt_pci_tbl);
+
+/*
+ * Just like with the cs5535-gpio driver, we can't use the standard PCI driver
+ * registration stuff.  It only allows only one driver to bind to each PCI
+ * device, and we want the GPIO and MFGPT drivers to be able to share a PCI
+ * device.  Instead, we manually scan for the PCI device, request a single
+ * region, and keep track of the devices that we're using.
+ */
+
+static int __init cs5535_mfgpt_scan_pci(void)
+{
+        struct pci_dev *pdev;
+        int err = -ENODEV;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(cs5535_mfgpt_pci_tbl); i++) {
+                pdev = pci_get_device(cs5535_mfgpt_pci_tbl[i].vendor,
+                                cs5535_mfgpt_pci_tbl[i].device, NULL);
+                if (pdev) {
+                        err = cs5535_mfgpt_probe(pdev,
+                                        &cs5535_mfgpt_pci_tbl[i]);
+                        if (err)
+                                pci_dev_put(pdev);
+
+                        /* we only support a single CS5535/6 southbridge */
+                        break;
+                }
+        }
+
+        return err;
+}
+
+static int __init cs5535_mfgpt_init(void)
+{
+        return cs5535_mfgpt_scan_pci();
+}
+
+module_init(cs5535_mfgpt_init);
+
+MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
+MODULE_DESCRIPTION("CS5535/CS5536 MFGPT timer driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/misc/ds1682.c b/drivers/misc/ds1682.c
new file mode 100644
index 000000000000..a513f0aa6432
--- /dev/null
+++ b/drivers/misc/ds1682.c
@@ -0,0 +1,268 @@
+/*
+ * Dallas Semiconductor DS1682 Elapsed Time Recorder device driver
+ *
+ * Written by: Grant Likely <grant.likely@secretlab.ca>
+ *
+ * Copyright (C) 2007 Secret Lab Technologies Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * The DS1682 elapsed timer recorder is a simple device that implements
+ * one elapsed time counter, one event counter, an alarm signal and 10
+ * bytes of general purpose EEPROM.
+ *
+ * This driver provides access to the DS1682 counters and user data via
+ * the sysfs.  The following attributes are added to the device node:
+ *     elapsed_time (u32): Total elapsed event time in ms resolution
+ *     alarm_time (u32): When elapsed time exceeds the value in alarm_time,
+ *                       then the alarm pin is asserted.
+ *     event_count (u16): number of times the event pin has gone low.
+ *     eeprom (u8[10]): general purpose EEPROM
+ *
+ * Counter registers and user data are both read/write unless the device
+ * has been write protected.  This driver does not support turning off write
+ * protection.  Once write protection is turned on, it is impossible to
+ * turn it off again, so I have left the feature out of this driver to avoid
+ * accidental enabling, but it is trivial to add write protect support.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/i2c.h>
+#include <linux/string.h>
+#include <linux/list.h>
+#include <linux/sysfs.h>
+#include <linux/ctype.h>
+#include <linux/hwmon-sysfs.h>
+
+/* Device registers */
+#define DS1682_REG_CONFIG               0x00
+#define DS1682_REG_ALARM                0x01
+#define DS1682_REG_ELAPSED              0x05
+#define DS1682_REG_EVT_CNTR             0x09
+#define DS1682_REG_EEPROM               0x0b
+#define DS1682_REG_RESET                0x1d
+#define DS1682_REG_WRITE_DISABLE        0x1e
+#define DS1682_REG_WRITE_MEM_DISABLE    0x1f
+
+#define DS1682_EEPROM_SIZE              10
+
+/*
+ * Generic counter attributes
+ */
+static ssize_t ds1682_show(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        struct i2c_client *client = to_i2c_client(dev);
+        __le32 val = 0;
+        int rc;
+
+        dev_dbg(dev, "ds1682_show() called on %s\n", attr->attr.name);
+
+        /* Read the register */
+        rc = i2c_smbus_read_i2c_block_data(client, sattr->index, sattr->nr,
+                                           (u8 *) & val);
+        if (rc < 0)
+                return -EIO;
+
+        /* Special case: the 32 bit regs are time values with 1/4s
+         * resolution, scale them up to milliseconds */
+        if (sattr->nr == 4)
+                return sprintf(buf, "%llu\n",
+                        ((unsigned long long)le32_to_cpu(val)) * 250);
+
+        /* Format the output string and return # of bytes */
+        return sprintf(buf, "%li\n", (long)le32_to_cpu(val));
+}
+
+static ssize_t ds1682_store(struct device *dev, struct device_attribute *attr,
+                            const char *buf, size_t count)
+{
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        struct i2c_client *client = to_i2c_client(dev);
+        char *endp;
+        u64 val;
+        __le32 val_le;
+        int rc;
+
+        dev_dbg(dev, "ds1682_store() called on %s\n", attr->attr.name);
+
+        /* Decode input */
+        val = simple_strtoull(buf, &endp, 0);
+        if (buf == endp) {
+                dev_dbg(dev, "input string not a number\n");
+                return -EINVAL;
+        }
+
+        /* Special case: the 32 bit regs are time values with 1/4s
+         * resolution, scale input down to quarter-seconds */
+        if (sattr->nr == 4)
+                do_div(val, 250);
+
+        /* write out the value */
+        val_le = cpu_to_le32(val);
+        rc = i2c_smbus_write_i2c_block_data(client, sattr->index, sattr->nr,
+                                            (u8 *) & val_le);
+        if (rc < 0) {
+                dev_err(dev, "register write failed; reg=0x%x, size=%i\n",
+                        sattr->index, sattr->nr);
+                return -EIO;
+        }
+
+        return count;
+}
+
+/*
+ * Simple register attributes
+ */
+static SENSOR_DEVICE_ATTR_2(elapsed_time, S_IRUGO | S_IWUSR, ds1682_show,
+                            ds1682_store, 4, DS1682_REG_ELAPSED);
+static SENSOR_DEVICE_ATTR_2(alarm_time, S_IRUGO | S_IWUSR, ds1682_show,
+                            ds1682_store, 4, DS1682_REG_ALARM);
+static SENSOR_DEVICE_ATTR_2(event_count, S_IRUGO | S_IWUSR, ds1682_show,
+                            ds1682_store, 2, DS1682_REG_EVT_CNTR);
+
+static const struct attribute_group ds1682_group = {
+        .attrs = (struct attribute *[]) {
+                &sensor_dev_attr_elapsed_time.dev_attr.attr,
+                &sensor_dev_attr_alarm_time.dev_attr.attr,
+                &sensor_dev_attr_event_count.dev_attr.attr,
+                NULL,
+        },
+};
+
+/*
+ * User data attribute
+ */
+static ssize_t ds1682_eeprom_read(struct file *filp, struct kobject *kobj,
+                                  struct bin_attribute *attr,
+                                  char *buf, loff_t off, size_t count)
+{
+        struct i2c_client *client = kobj_to_i2c_client(kobj);
+        int rc;
+
+        dev_dbg(&client->dev, "ds1682_eeprom_read(p=%p, off=%lli, c=%zi)\n",
+                buf, off, count);
+
+        if (off >= DS1682_EEPROM_SIZE)
+                return 0;
+
+        if (off + count > DS1682_EEPROM_SIZE)
+                count = DS1682_EEPROM_SIZE - off;
+
+        rc = i2c_smbus_read_i2c_block_data(client, DS1682_REG_EEPROM + off,
+                                           count, buf);
+        if (rc < 0)
+                return -EIO;
+
+        return count;
+}
+
+static ssize_t ds1682_eeprom_write(struct file *filp, struct kobject *kobj,
+                                   struct bin_attribute *attr,
+                                   char *buf, loff_t off, size_t count)
+{
+        struct i2c_client *client = kobj_to_i2c_client(kobj);
+
+        dev_dbg(&client->dev, "ds1682_eeprom_write(p=%p, off=%lli, c=%zi)\n",
+                buf, off, count);
+
+        if (off >= DS1682_EEPROM_SIZE)
+                return -ENOSPC;
+
+        if (off + count > DS1682_EEPROM_SIZE)
+                count = DS1682_EEPROM_SIZE - off;
+
+        /* Write out to the device */
+        if (i2c_smbus_write_i2c_block_data(client, DS1682_REG_EEPROM + off,
+                                           count, buf) < 0)
+                return -EIO;
+
+        return count;
+}
+
+static struct bin_attribute ds1682_eeprom_attr = {
+        .attr = {
+                .name = "eeprom",
+                .mode = S_IRUGO | S_IWUSR,
+        },
+        .size = DS1682_EEPROM_SIZE,
+        .read = ds1682_eeprom_read,
+        .write = ds1682_eeprom_write,
+};
+
+/*
+ * Called when a ds1682 device is matched with this driver
+ */
+static int ds1682_probe(struct i2c_client *client,
+                        const struct i2c_device_id *id)
+{
+        int rc;
+
+        if (!i2c_check_functionality(client->adapter,
+                                     I2C_FUNC_SMBUS_I2C_BLOCK)) {
+                dev_err(&client->dev, "i2c bus does not support the ds1682\n");
+                rc = -ENODEV;
+                goto exit;
+        }
+
+        rc = sysfs_create_group(&client->dev.kobj, &ds1682_group);
+        if (rc)
+                goto exit;
+
+        rc = sysfs_create_bin_file(&client->dev.kobj, &ds1682_eeprom_attr);
+        if (rc)
+                goto exit_bin_attr;
+
+        return 0;
+
+ exit_bin_attr:
+        sysfs_remove_group(&client->dev.kobj, &ds1682_group);
+ exit:
+        return rc;
+}
+
+static int ds1682_remove(struct i2c_client *client)
+{
+        sysfs_remove_bin_file(&client->dev.kobj, &ds1682_eeprom_attr);
+        sysfs_remove_group(&client->dev.kobj, &ds1682_group);
+        return 0;
+}
+
+static const struct i2c_device_id ds1682_id[] = {
+        { "ds1682", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, ds1682_id);
+
+static struct i2c_driver ds1682_driver = {
+        .driver = {
+                .name = "ds1682",
+        },
+        .probe = ds1682_probe,
+        .remove = ds1682_remove,
+        .id_table = ds1682_id,
+};
+
+static int __init ds1682_init(void)
+{
+        return i2c_add_driver(&ds1682_driver);
+}
+
+static void __exit ds1682_exit(void)
+{
+        i2c_del_driver(&ds1682_driver);
+}
+
+MODULE_AUTHOR("Grant Likely <grant.likely@secretlab.ca>");
+MODULE_DESCRIPTION("DS1682 Elapsed Time Indicator driver");
+MODULE_LICENSE("GPL");
+
+module_init(ds1682_init);
+module_exit(ds1682_exit);
diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index db39f4a52f53..ab1ad41786d1 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -20,6 +20,7 @@
 #include <linux/log2.h>
 #include <linux/bitops.h>
 #include <linux/jiffies.h>
+#include <linux/of.h>
 #include <linux/i2c.h>
 #include <linux/i2c/at24.h>
 
@@ -54,7 +55,7 @@
 struct at24_data {
         struct at24_platform_data chip;
         struct memory_accessor macc;
-        bool use_smbus;
+        int use_smbus;
 
         /*
          * Lock protects against activities from other Linux tasks,
@@ -158,6 +159,7 @@ static ssize_t at24_eeprom_read(struct at24_data *at24, char *buf,
         struct i2c_msg msg[2];
         u8 msgbuf[2];
         struct i2c_client *client;
+        unsigned long timeout, read_time;
         int status, i;
 
         memset(msg, 0, sizeof(msg));
@@ -183,47 +185,85 @@ static ssize_t at24_eeprom_read(struct at24_data *at24, char *buf,
         if (count > io_limit)
                 count = io_limit;
 
-        /* Smaller eeproms can work given some SMBus extension calls */
-        if (at24->use_smbus) {
+        switch (at24->use_smbus) {
+        case I2C_SMBUS_I2C_BLOCK_DATA:
+                /* Smaller eeproms can work given some SMBus extension calls */
                 if (count > I2C_SMBUS_BLOCK_MAX)
                         count = I2C_SMBUS_BLOCK_MAX;
-                status = i2c_smbus_read_i2c_block_data(client, offset,
-                                count, buf);
-                dev_dbg(&client->dev, "smbus read %zu@%d --> %d\n",
-                                count, offset, status);
-                return (status < 0) ? -EIO : status;
+                break;
+        case I2C_SMBUS_WORD_DATA:
+                count = 2;
+                break;
+        case I2C_SMBUS_BYTE_DATA:
+                count = 1;
+                break;
+        default:
+                /*
+                 * When we have a better choice than SMBus calls, use a
+                 * combined I2C message. Write address; then read up to
+                 * io_limit data bytes. Note that read page rollover helps us
+                 * here (unlike writes). msgbuf is u8 and will cast to our
+                 * needs.
+                 */
+                i = 0;
+                if (at24->chip.flags & AT24_FLAG_ADDR16)
+                        msgbuf[i++] = offset >> 8;
+                msgbuf[i++] = offset;
+
+                msg[0].addr = client->addr;
+                msg[0].buf = msgbuf;
+                msg[0].len = i;
+
+                msg[1].addr = client->addr;
+                msg[1].flags = I2C_M_RD;
+                msg[1].buf = buf;
+                msg[1].len = count;
         }
 
         /*
-         * When we have a better choice than SMBus calls, use a combined
-         * I2C message. Write address; then read up to io_limit data bytes.
-         * Note that read page rollover helps us here (unlike writes).
-         * msgbuf is u8 and will cast to our needs.
+         * Reads fail if the previous write didn't complete yet. We may
+         * loop a few times until this one succeeds, waiting at least
+         * long enough for one entire page write to work.
          */
-        i = 0;
-        if (at24->chip.flags & AT24_FLAG_ADDR16)
-                msgbuf[i++] = offset >> 8;
-        msgbuf[i++] = offset;
-
-        msg[0].addr = client->addr;
-        msg[0].buf = msgbuf;
-        msg[0].len = i;
+        timeout = jiffies + msecs_to_jiffies(write_timeout);
+        do {
+                read_time = jiffies;
+                switch (at24->use_smbus) {
+                case I2C_SMBUS_I2C_BLOCK_DATA:
+                        status = i2c_smbus_read_i2c_block_data(client, offset,
+                                        count, buf);
+                        break;
+                case I2C_SMBUS_WORD_DATA:
+                        status = i2c_smbus_read_word_data(client, offset);
+                        if (status >= 0) {
+                                buf[0] = status & 0xff;
+                                buf[1] = status >> 8;
+                                status = count;
+                        }
+                        break;
+                case I2C_SMBUS_BYTE_DATA:
+                        status = i2c_smbus_read_byte_data(client, offset);
+                        if (status >= 0) {
+                                buf[0] = status;
+                                status = count;
+                        }
+                        break;
+                default:
+                        status = i2c_transfer(client->adapter, msg, 2);
+                        if (status == 2)
+                                status = count;
+                }
+                dev_dbg(&client->dev, "read %zu@%d --> %d (%ld)\n",
+                                count, offset, status, jiffies);
 
-        msg[1].addr = client->addr;
-        msg[1].flags = I2C_M_RD;
-        msg[1].buf = buf;
-        msg[1].len = count;
+                if (status == count)
+                        return count;
 
-        status = i2c_transfer(client->adapter, msg, 2);
-        dev_dbg(&client->dev, "i2c read %zu@%d --> %d\n",
-                        count, offset, status);
+                /* REVISIT: at HZ=100, this is sloooow */
+                msleep(1);
+        } while (time_before(read_time, timeout));
 
-        if (status == 2)
-                return count;
-        else if (status >= 0)
-                return -EIO;
-        else
-                return status;
+        return -ETIMEDOUT;
 }
 
 static ssize_t at24_read(struct at24_data *at24,
@@ -260,7 +300,8 @@ static ssize_t at24_read(struct at24_data *at24,
         return retval;
 }
 
-static ssize_t at24_bin_read(struct kobject *kobj, struct bin_attribute *attr,
+static ssize_t at24_bin_read(struct file *filp, struct kobject *kobj,
+                struct bin_attribute *attr,
                 char *buf, loff_t off, size_t count)
 {
         struct at24_data *at24;
@@ -381,7 +422,8 @@ static ssize_t at24_write(struct at24_data *at24, const char *buf, loff_t off,
         return retval;
 }
 
-static ssize_t at24_bin_write(struct kobject *kobj, struct bin_attribute *attr,
+static ssize_t at24_bin_write(struct file *filp, struct kobject *kobj,
+                struct bin_attribute *attr,
                 char *buf, loff_t off, size_t count)
 {
         struct at24_data *at24;
@@ -416,11 +458,32 @@ static ssize_t at24_macc_write(struct memory_accessor *macc, const char *buf,
 
 /*-------------------------------------------------------------------------*/
 
+#ifdef CONFIG_OF
+static void at24_get_ofdata(struct i2c_client *client,
+                struct at24_platform_data *chip)
+{
+        const __be32 *val;
+        struct device_node *node = client->dev.of_node;
+
+        if (node) {
+                if (of_get_property(node, "read-only", NULL))
+                        chip->flags |= AT24_FLAG_READONLY;
+                val = of_get_property(node, "pagesize", NULL);
+                if (val)
+                        chip->page_size = be32_to_cpup(val);
+        }
+}
+#else
+static void at24_get_ofdata(struct i2c_client *client,
+                struct at24_platform_data *chip)
+{ }
+#endif /* CONFIG_OF */
+
 static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
 {
         struct at24_platform_data chip;
         bool writable;
-        bool use_smbus = false;
+        int use_smbus = 0;
         struct at24_data *at24;
         int err;
         unsigned i, num_addresses;
@@ -444,6 +507,9 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
                  */
                 chip.page_size = 1;
 
+                /* update chipdata if OF is present */
+                at24_get_ofdata(client, &chip);
+
                 chip.setup = NULL;
                 chip.context = NULL;
         }
@@ -451,6 +517,11 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
         if (!is_power_of_2(chip.byte_len))
                 dev_warn(&client->dev,
                         "byte_len looks suspicious (no power of 2)!\n");
+        if (!chip.page_size) {
+                dev_err(&client->dev, "page_size must not be 0!\n");
+                err = -EINVAL;
+                goto err_out;
+        }
         if (!is_power_of_2(chip.page_size))
                 dev_warn(&client->dev,
                         "page_size looks suspicious (no power of 2)!\n");
@@ -461,12 +532,19 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
                         err = -EPFNOSUPPORT;
                         goto err_out;
                 }
-                if (!i2c_check_functionality(client->adapter,
+                if (i2c_check_functionality(client->adapter,
                                 I2C_FUNC_SMBUS_READ_I2C_BLOCK)) {
+                        use_smbus = I2C_SMBUS_I2C_BLOCK_DATA;
+                } else if (i2c_check_functionality(client->adapter,
+                                I2C_FUNC_SMBUS_READ_WORD_DATA)) {
+                        use_smbus = I2C_SMBUS_WORD_DATA;
+                } else if (i2c_check_functionality(client->adapter,
+                                I2C_FUNC_SMBUS_READ_BYTE_DATA)) {
+                        use_smbus = I2C_SMBUS_BYTE_DATA;
+                } else {
                         err = -EPFNOSUPPORT;
                         goto err_out;
                 }
-                use_smbus = true;
         }
 
         if (chip.flags & AT24_FLAG_TAKE8ADDR)
@@ -491,6 +569,7 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
          * Export the EEPROM bytes through sysfs, since that's convenient.
          * By default, only root should see the data (maybe passwords etc)
          */
+        sysfs_bin_attr_init(&at24->bin);
         at24->bin.attr.name = "eeprom";
         at24->bin.attr.mode = chip.flags & AT24_FLAG_IRUGO ? S_IRUGO : S_IRUSR;
         at24->bin.read = at24_bin_read;
@@ -548,14 +627,15 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
 
         i2c_set_clientdata(client, at24);
 
-        dev_info(&client->dev, "%zu byte %s EEPROM %s\n",
+        dev_info(&client->dev, "%zu byte %s EEPROM, %s, %u bytes/write\n",
                 at24->bin.size, client->name,
-                writable ? "(writable)" : "(read-only)");
-        dev_dbg(&client->dev,
-                "page_size %d, num_addresses %d, write_max %d%s\n",
-                chip.page_size, num_addresses,
-                at24->write_max,
-                use_smbus ? ", use_smbus" : "");
+                writable ? "writable" : "read-only", at24->write_max);
+        if (use_smbus == I2C_SMBUS_WORD_DATA ||
+            use_smbus == I2C_SMBUS_BYTE_DATA) {
+                dev_notice(&client->dev, "Falling back to %s reads, "
+                           "performance will suffer\n", use_smbus ==
+                           I2C_SMBUS_WORD_DATA ? "word" : "byte");
+        }
 
         /* export data to kernel code */
         if (chip.setup)
@@ -589,7 +669,6 @@ static int __devexit at24_remove(struct i2c_client *client)
 
         kfree(at24->writebuf);
         kfree(at24);
-        i2c_set_clientdata(client, NULL);
         return 0;
 }
 
@@ -607,6 +686,11 @@ static struct i2c_driver at24_driver = {
 
 static int __init at24_init(void)
 {
+        if (!io_limit) {
+                pr_err("at24: io_limit must not be 0!\n");
+                return -EINVAL;
+        }
+
         io_limit = rounddown_pow_of_two(io_limit);
         return i2c_add_driver(&at24_driver);
 }
diff --git a/drivers/misc/eeprom/at25.c b/drivers/misc/eeprom/at25.c
index b34cb5f79eea..c627e4174ccd 100644
--- a/drivers/misc/eeprom/at25.c
+++ b/drivers/misc/eeprom/at25.c
@@ -126,7 +126,8 @@ at25_ee_read(
 }
 
 static ssize_t
-at25_bin_read(struct kobject *kobj, struct bin_attribute *bin_attr,
+at25_bin_read(struct file *filp, struct kobject *kobj,
+              struct bin_attribute *bin_attr,
               char *buf, loff_t off, size_t count)
 {
         struct device           *dev;
@@ -173,6 +174,7 @@ at25_ee_write(struct at25_data *at25, const char *buf, loff_t off,
                 unsigned        segment;
                 unsigned        offset = (unsigned) off;
                 u8              *cp = bounce + 1;
+                int             sr;
 
                 *cp = AT25_WREN;
                 status = spi_write(at25->spi, cp, 1);
@@ -214,7 +216,6 @@ at25_ee_write(struct at25_data *at25, const char *buf, loff_t off,
                 timeout = jiffies + msecs_to_jiffies(EE_TIMEOUT);
                 retries = 0;
                 do {
-                        int     sr;
 
                         sr = spi_w8r8(at25->spi, AT25_RDSR);
                         if (sr < 0 || (sr & AT25_SR_nRDY)) {
@@ -228,7 +229,7 @@ at25_ee_write(struct at25_data *at25, const char *buf, loff_t off,
                                 break;
                 } while (retries++ < 3 || time_before_eq(jiffies, timeout));
 
-                if (time_after(jiffies, timeout)) {
+                if ((sr < 0) || (sr & AT25_SR_nRDY)) {
                         dev_err(&at25->spi->dev,
                                 "write %d bytes offset %d, "
                                 "timeout after %u msecs\n",
@@ -253,7 +254,8 @@ at25_ee_write(struct at25_data *at25, const char *buf, loff_t off,
 }
 
 static ssize_t
-at25_bin_write(struct kobject *kobj, struct bin_attribute *bin_attr,
+at25_bin_write(struct file *filp, struct kobject *kobj,
+               struct bin_attribute *bin_attr,
                char *buf, loff_t off, size_t count)
 {
         struct device           *dev;
@@ -347,6 +349,7 @@ static int at25_probe(struct spi_device *spi)
          * that's sensitive for read and/or write, like ethernet addresses,
          * security codes, board-specific manufacturing calibrations, etc.
          */
+        sysfs_bin_attr_init(&at25->bin);
         at25->bin.attr.name = "eeprom";
         at25->bin.attr.mode = S_IRUSR;
         at25->bin.read = at25_bin_read;
@@ -417,4 +420,4 @@ module_exit(at25_exit);
 MODULE_DESCRIPTION("Driver for most SPI EEPROMs");
 MODULE_AUTHOR("David Brownell");
 MODULE_LICENSE("GPL");
-
+MODULE_ALIAS("spi:at25");
diff --git a/drivers/misc/eeprom/eeprom.c b/drivers/misc/eeprom/eeprom.c
index 2c27193aeaa0..45060ddc4e59 100644
--- a/drivers/misc/eeprom/eeprom.c
+++ b/drivers/misc/eeprom/eeprom.c
@@ -1,24 +1,20 @@
 /*
-    Copyright (C) 1998, 1999  Frodo Looijaard <frodol@dds.nl> and
-                               Philip Edelbrock <phil@netroedge.com>
-    Copyright (C) 2003 Greg Kroah-Hartman <greg@kroah.com>
-    Copyright (C) 2003 IBM Corp.
-    Copyright (C) 2004 Jean Delvare <khali@linux-fr.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
+ * Copyright (C) 1998, 1999  Frodo Looijaard <frodol@dds.nl> and
+ *                           Philip Edelbrock <phil@netroedge.com>
+ * Copyright (C) 2003 Greg Kroah-Hartman <greg@kroah.com>
+ * Copyright (C) 2003 IBM Corp.
+ * Copyright (C) 2004 Jean Delvare <khali@linux-fr.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
 
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -32,9 +28,6 @@
 static const unsigned short normal_i2c[] = { 0x50, 0x51, 0x52, 0x53, 0x54,
                                         0x55, 0x56, 0x57, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(eeprom);
-
 
 /* Size of EEPROM in bytes */
 #define EEPROM_SIZE             256
@@ -88,7 +81,8 @@ exit:
         mutex_unlock(&data->update_lock);
 }
 
-static ssize_t eeprom_read(struct kobject *kobj, struct bin_attribute *bin_attr,
+static ssize_t eeprom_read(struct file *filp, struct kobject *kobj,
+                           struct bin_attribute *bin_attr,
                            char *buf, loff_t off, size_t count)
 {
         struct i2c_client *client = to_i2c_client(container_of(kobj, struct device, kobj));
@@ -135,8 +129,7 @@ static struct bin_attribute eeprom_attr = {
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int eeprom_detect(struct i2c_client *client, int kind,
-                         struct i2c_board_info *info)
+static int eeprom_detect(struct i2c_client *client, struct i2c_board_info *info)
 {
         struct i2c_adapter *adapter = client->adapter;
 
@@ -233,7 +226,7 @@ static struct i2c_driver eeprom_driver = {
 
         .class          = I2C_CLASS_DDC | I2C_CLASS_SPD,
         .detect         = eeprom_detect,
-        .address_data   = &addr_data,
+        .address_list   = normal_i2c,
 };
 
 static int __init eeprom_init(void)
diff --git a/drivers/misc/eeprom/eeprom_93cx6.c b/drivers/misc/eeprom/eeprom_93cx6.c
index 15b1780025c8..7b33de95c4bf 100644
--- a/drivers/misc/eeprom/eeprom_93cx6.c
+++ b/drivers/misc/eeprom/eeprom_93cx6.c
@@ -1,27 +1,20 @@
 /*
-        Copyright (C) 2004 - 2006 rt2x00 SourceForge Project
-        <http://rt2x00.serialmonkey.com>
-
-        This program is free software; you can redistribute it and/or modify
-        it under the terms of the GNU General Public License as published by
-        the Free Software Foundation; either version 2 of the License, or
-        (at your option) any later version.
-
-        This program is distributed in the hope that it will be useful,
-        but WITHOUT ANY WARRANTY; without even the implied warranty of
-        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-        GNU General Public License for more details.
-
-        You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
- */
-
-/*
-        Module: eeprom_93cx6
-        Abstract: EEPROM reader routines for 93cx6 chipsets.
-        Supported chipsets: 93c46 & 93c66.
+ * Copyright (C) 2004 - 2006 rt2x00 SourceForge Project
+ * <http://rt2x00.serialmonkey.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * Module: eeprom_93cx6
+ * Abstract: EEPROM reader routines for 93cx6 chipsets.
+ * Supported chipsets: 93c46 & 93c66.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/misc/eeprom/max6875.c b/drivers/misc/eeprom/max6875.c
index 3c0c58eed347..5653a3ce0517 100644
--- a/drivers/misc/eeprom/max6875.c
+++ b/drivers/misc/eeprom/max6875.c
@@ -1,30 +1,30 @@
 /*
-    max6875.c - driver for MAX6874/MAX6875
-
-    Copyright (C) 2005 Ben Gardner <bgardner@wabtec.com>
-
-    Based on eeprom.c
-
-    The MAX6875 has a bank of registers and two banks of EEPROM.
-    Address ranges are defined as follows:
-     * 0x0000 - 0x0046 = configuration registers
-     * 0x8000 - 0x8046 = configuration EEPROM
-     * 0x8100 - 0x82FF = user EEPROM
-
-    This driver makes the user EEPROM available for read.
-
-    The registers & config EEPROM should be accessed via i2c-dev.
-
-    The MAX6875 ignores the lowest address bit, so each chip responds to
-    two addresses - 0x50/0x51 and 0x52/0x53.
-
-    Note that the MAX6875 uses i2c_smbus_write_byte_data() to set the read
-    address, so this driver is destructive if loaded for the wrong EEPROM chip.
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; version 2 of the License.
-*/
+ * max6875.c - driver for MAX6874/MAX6875
+ *
+ * Copyright (C) 2005 Ben Gardner <bgardner@wabtec.com>
+ *
+ * Based on eeprom.c
+ *
+ * The MAX6875 has a bank of registers and two banks of EEPROM.
+ * Address ranges are defined as follows:
+ *  * 0x0000 - 0x0046 = configuration registers
+ *  * 0x8000 - 0x8046 = configuration EEPROM
+ *  * 0x8100 - 0x82FF = user EEPROM
+ *
+ * This driver makes the user EEPROM available for read.
+ *
+ * The registers & config EEPROM should be accessed via i2c-dev.
+ *
+ * The MAX6875 ignores the lowest address bit, so each chip responds to
+ * two addresses - 0x50/0x51 and 0x52/0x53.
+ *
+ * Note that the MAX6875 uses i2c_smbus_write_byte_data() to set the read
+ * address, so this driver is destructive if loaded for the wrong EEPROM chip.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ */
 
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -33,12 +33,6 @@
 #include <linux/i2c.h>
 #include <linux/mutex.h>
 
-/* Do not scan - the MAX6875 access method will write to some EEPROM chips */
-static const unsigned short normal_i2c[] = { I2C_CLIENT_END };
-
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(max6875);
-
 /* The MAX6875 can only read/write 16 bytes at a time */
 #define SLICE_SIZE                      16
 #define SLICE_BITS                      4
@@ -113,7 +107,7 @@ exit_up:
         mutex_unlock(&data->update_lock);
 }
 
-static ssize_t max6875_read(struct kobject *kobj,
+static ssize_t max6875_read(struct file *filp, struct kobject *kobj,
                             struct bin_attribute *bin_attr,
                             char *buf, loff_t off, size_t count)
 {
@@ -146,31 +140,21 @@ static struct bin_attribute user_eeprom_attr = {
         .read = max6875_read,
 };
 
-/* Return 0 if detection is successful, -ENODEV otherwise */
-static int max6875_detect(struct i2c_client *client, int kind,
-                          struct i2c_board_info *info)
+static int max6875_probe(struct i2c_client *client,
+                         const struct i2c_device_id *id)
 {
         struct i2c_adapter *adapter = client->adapter;
+        struct max6875_data *data;
+        int err;
 
         if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_WRITE_BYTE_DATA
                                      | I2C_FUNC_SMBUS_READ_BYTE))
                 return -ENODEV;
 
-        /* Only check even addresses */
+        /* Only bind to even addresses */
         if (client->addr & 1)
                 return -ENODEV;
 
-        strlcpy(info->type, "max6875", I2C_NAME_SIZE);
-
-        return 0;
-}
-
-static int max6875_probe(struct i2c_client *client,
-                         const struct i2c_device_id *id)
-{
-        struct max6875_data *data;
-        int err;
-
         if (!(data = kzalloc(sizeof(struct max6875_data), GFP_KERNEL)))
                 return -ENOMEM;
 
@@ -222,9 +206,6 @@ static struct i2c_driver max6875_driver = {
         .probe          = max6875_probe,
         .remove         = max6875_remove,
         .id_table       = max6875_id,
-
-        .detect         = max6875_detect,
-        .address_data   = &addr_data,
 };
 
 static int __init max6875_init(void)
diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c
index 348443bdb23b..00e5fcac8fdf 100644
--- a/drivers/misc/enclosure.c
+++ b/drivers/misc/enclosure.c
@@ -27,30 +27,51 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 
 static LIST_HEAD(container_list);
 static DEFINE_MUTEX(container_list_lock);
 static struct class enclosure_class;
 
 /**
- * enclosure_find - find an enclosure given a device
- * @dev:        the device to find for
+ * enclosure_find - find an enclosure given a parent device
+ * @dev:        the parent to match against
+ * @start:      Optional enclosure device to start from (NULL if none)
  *
- * Looks through the list of registered enclosures to see
- * if it can find a match for a device.  Returns NULL if no
- * enclosure is found. Obtains a reference to the enclosure class
- * device which must be released with device_put().
+ * Looks through the list of registered enclosures to find all those
+ * with @dev as a parent.  Returns NULL if no enclosure is
+ * found. @start can be used as a starting point to obtain multiple
+ * enclosures per parent (should begin with NULL and then be set to
+ * each returned enclosure device). Obtains a reference to the
+ * enclosure class device which must be released with device_put().
+ * If @start is not NULL, a reference must be taken on it which is
+ * released before returning (this allows a loop through all
+ * enclosures to exit with only the reference on the enclosure of
+ * interest held).  Note that the @dev may correspond to the actual
+ * device housing the enclosure, in which case no iteration via @start
+ * is required.
  */
-struct enclosure_device *enclosure_find(struct device *dev)
+struct enclosure_device *enclosure_find(struct device *dev,
+                                        struct enclosure_device *start)
 {
         struct enclosure_device *edev;
 
         mutex_lock(&container_list_lock);
-        list_for_each_entry(edev, &container_list, node) {
-                if (edev->edev.parent == dev) {
-                        get_device(&edev->edev);
-                        mutex_unlock(&container_list_lock);
-                        return edev;
+        edev = list_prepare_entry(start, &container_list, node);
+        if (start)
+                put_device(&start->edev);
+
+        list_for_each_entry_continue(edev, &container_list, node) {
+                struct device *parent = edev->edev.parent;
+                /* parent might not be immediate, so iterate up to
+                 * the root of the tree if necessary */
+                while (parent) {
+                        if (parent == dev) {
+                                get_device(&edev->edev);
+                                mutex_unlock(&container_list_lock);
+                                return edev;
+                        }
+                        parent = parent->parent;
                 }
         }
         mutex_unlock(&container_list_lock);
@@ -218,7 +239,7 @@ static void enclosure_component_release(struct device *dev)
         put_device(dev->parent);
 }
 
-static struct attribute_group *enclosure_groups[];
+static const struct attribute_group *enclosure_groups[];
 
 /**
  * enclosure_component_register - add a particular component to an enclosure
@@ -264,8 +285,11 @@ enclosure_component_register(struct enclosure_device *edev,
         cdev->groups = enclosure_groups;
 
         err = device_register(cdev);
-        if (err)
-                ERR_PTR(err);
+        if (err) {
+                ecomp->number = -1;
+                put_device(cdev);
+                return ERR_PTR(err);
+        }
 
         return ecomp;
 }
@@ -295,6 +319,9 @@ int enclosure_add_device(struct enclosure_device *edev, int component,
 
         cdev = &edev->component[component];
 
+        if (cdev->dev == dev)
+                return -EEXIST;
+
         if (cdev->dev)
                 enclosure_remove_links(cdev);
 
@@ -312,19 +339,25 @@ EXPORT_SYMBOL_GPL(enclosure_add_device);
  * Returns zero on success or an error.
  *
  */
-int enclosure_remove_device(struct enclosure_device *edev, int component)
+int enclosure_remove_device(struct enclosure_device *edev, struct device *dev)
 {
         struct enclosure_component *cdev;
+        int i;
 
-        if (!edev || component >= edev->components)
+        if (!edev || !dev)
                 return -EINVAL;
 
-        cdev = &edev->component[component];
-
-        device_del(&cdev->cdev);
-        put_device(cdev->dev);
-        cdev->dev = NULL;
-        return device_add(&cdev->cdev);
+        for (i = 0; i < edev->components; i++) {
+                cdev = &edev->component[i];
+                if (cdev->dev == dev) {
+                        enclosure_remove_links(cdev);
+                        device_del(&cdev->cdev);
+                        put_device(dev);
+                        cdev->dev = NULL;
+                        return device_add(&cdev->cdev);
+                }
+        }
+        return -ENODEV;
 }
 EXPORT_SYMBOL_GPL(enclosure_remove_device);
 
@@ -362,6 +395,7 @@ static const char *const enclosure_status [] = {
         [ENCLOSURE_STATUS_NOT_INSTALLED] = "not installed",
         [ENCLOSURE_STATUS_UNKNOWN] = "unknown",
         [ENCLOSURE_STATUS_UNAVAILABLE] = "unavailable",
+        [ENCLOSURE_STATUS_MAX] = NULL,
 };
 
 static const char *const enclosure_type [] = {
@@ -507,7 +541,7 @@ static struct attribute_group enclosure_group = {
         .attrs = enclosure_component_attrs,
 };
 
-static struct attribute_group *enclosure_groups[] = {
+static const struct attribute_group *enclosure_groups[] = {
         &enclosure_group,
         NULL
 };
diff --git a/drivers/misc/ep93xx_pwm.c b/drivers/misc/ep93xx_pwm.c
new file mode 100644
index 000000000000..46b3439673e9
--- /dev/null
+++ b/drivers/misc/ep93xx_pwm.c
@@ -0,0 +1,385 @@
+/*
+ *  Simple PWM driver for EP93XX
+ *
+ *      (c) Copyright 2009  Matthieu Crapet <mcrapet@gmail.com>
+ *      (c) Copyright 2009  H Hartley Sweeten <hsweeten@visionengravers.com>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ *  EP9307 has only one channel:
+ *    - PWMOUT
+ *
+ *  EP9301/02/12/15 have two channels:
+ *    - PWMOUT
+ *    - PWMOUT1 (alternate function for EGPIO14)
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/io.h>
+
+#include <mach/platform.h>
+
+#define EP93XX_PWMx_TERM_COUNT  0x00
+#define EP93XX_PWMx_DUTY_CYCLE  0x04
+#define EP93XX_PWMx_ENABLE      0x08
+#define EP93XX_PWMx_INVERT      0x0C
+
+#define EP93XX_PWM_MAX_COUNT    0xFFFF
+
+struct ep93xx_pwm {
+        void __iomem    *mmio_base;
+        struct clk      *clk;
+        u32             duty_percent;
+};
+
+static inline void ep93xx_pwm_writel(struct ep93xx_pwm *pwm,
+                unsigned int val, unsigned int off)
+{
+        __raw_writel(val, pwm->mmio_base + off);
+}
+
+static inline unsigned int ep93xx_pwm_readl(struct ep93xx_pwm *pwm,
+                unsigned int off)
+{
+        return __raw_readl(pwm->mmio_base + off);
+}
+
+static inline void ep93xx_pwm_write_tc(struct ep93xx_pwm *pwm, u16 value)
+{
+        ep93xx_pwm_writel(pwm, value, EP93XX_PWMx_TERM_COUNT);
+}
+
+static inline u16 ep93xx_pwm_read_tc(struct ep93xx_pwm *pwm)
+{
+        return ep93xx_pwm_readl(pwm, EP93XX_PWMx_TERM_COUNT);
+}
+
+static inline void ep93xx_pwm_write_dc(struct ep93xx_pwm *pwm, u16 value)
+{
+        ep93xx_pwm_writel(pwm, value, EP93XX_PWMx_DUTY_CYCLE);
+}
+
+static inline void ep93xx_pwm_enable(struct ep93xx_pwm *pwm)
+{
+        ep93xx_pwm_writel(pwm, 0x1, EP93XX_PWMx_ENABLE);
+}
+
+static inline void ep93xx_pwm_disable(struct ep93xx_pwm *pwm)
+{
+        ep93xx_pwm_writel(pwm, 0x0, EP93XX_PWMx_ENABLE);
+}
+
+static inline int ep93xx_pwm_is_enabled(struct ep93xx_pwm *pwm)
+{
+        return ep93xx_pwm_readl(pwm, EP93XX_PWMx_ENABLE) & 0x1;
+}
+
+static inline void ep93xx_pwm_invert(struct ep93xx_pwm *pwm)
+{
+        ep93xx_pwm_writel(pwm, 0x1, EP93XX_PWMx_INVERT);
+}
+
+static inline void ep93xx_pwm_normal(struct ep93xx_pwm *pwm)
+{
+        ep93xx_pwm_writel(pwm, 0x0, EP93XX_PWMx_INVERT);
+}
+
+static inline int ep93xx_pwm_is_inverted(struct ep93xx_pwm *pwm)
+{
+        return ep93xx_pwm_readl(pwm, EP93XX_PWMx_INVERT) & 0x1;
+}
+
+/*
+ * /sys/devices/platform/ep93xx-pwm.N
+ *   /min_freq      read-only   minimum pwm output frequency
+ *   /max_req       read-only   maximum pwm output frequency
+ *   /freq          read-write  pwm output frequency (0 = disable output)
+ *   /duty_percent  read-write  pwm duty cycle percent (1..99)
+ *   /invert        read-write  invert pwm output
+ */
+
+static ssize_t ep93xx_pwm_get_min_freq(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct ep93xx_pwm *pwm = platform_get_drvdata(pdev);
+        unsigned long rate = clk_get_rate(pwm->clk);
+
+        return sprintf(buf, "%ld\n", rate / (EP93XX_PWM_MAX_COUNT + 1));
+}
+
+static ssize_t ep93xx_pwm_get_max_freq(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct ep93xx_pwm *pwm = platform_get_drvdata(pdev);
+        unsigned long rate = clk_get_rate(pwm->clk);
+
+        return sprintf(buf, "%ld\n", rate / 2);
+}
+
+static ssize_t ep93xx_pwm_get_freq(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct ep93xx_pwm *pwm = platform_get_drvdata(pdev);
+
+        if (ep93xx_pwm_is_enabled(pwm)) {
+                unsigned long rate = clk_get_rate(pwm->clk);
+                u16 term = ep93xx_pwm_read_tc(pwm);
+
+                return sprintf(buf, "%ld\n", rate / (term + 1));
+        } else {
+                return sprintf(buf, "disabled\n");
+        }
+}
+
+static ssize_t ep93xx_pwm_set_freq(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct ep93xx_pwm *pwm = platform_get_drvdata(pdev);
+        long val;
+        int err;
+
+        err = strict_strtol(buf, 10, &val);
+        if (err)
+                return -EINVAL;
+
+        if (val == 0) {
+                ep93xx_pwm_disable(pwm);
+        } else if (val <= (clk_get_rate(pwm->clk) / 2)) {
+                u32 term, duty;
+
+                val = (clk_get_rate(pwm->clk) / val) - 1;
+                if (val > EP93XX_PWM_MAX_COUNT)
+                        val = EP93XX_PWM_MAX_COUNT;
+                if (val < 1)
+                        val = 1;
+
+                term = ep93xx_pwm_read_tc(pwm);
+                duty = ((val + 1) * pwm->duty_percent / 100) - 1;
+
+                /* If pwm is running, order is important */
+                if (val > term) {
+                        ep93xx_pwm_write_tc(pwm, val);
+                        ep93xx_pwm_write_dc(pwm, duty);
+                } else {
+                        ep93xx_pwm_write_dc(pwm, duty);
+                        ep93xx_pwm_write_tc(pwm, val);
+                }
+
+                if (!ep93xx_pwm_is_enabled(pwm))
+                        ep93xx_pwm_enable(pwm);
+        } else {
+                return -EINVAL;
+        }
+
+        return count;
+}
+
+static ssize_t ep93xx_pwm_get_duty_percent(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct ep93xx_pwm *pwm = platform_get_drvdata(pdev);
+
+        return sprintf(buf, "%d\n", pwm->duty_percent);
+}
+
+static ssize_t ep93xx_pwm_set_duty_percent(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct ep93xx_pwm *pwm = platform_get_drvdata(pdev);
+        long val;
+        int err;
+
+        err = strict_strtol(buf, 10, &val);
+        if (err)
+                return -EINVAL;
+
+        if (val > 0 && val < 100) {
+                u32 term = ep93xx_pwm_read_tc(pwm);
+                ep93xx_pwm_write_dc(pwm, ((term + 1) * val / 100) - 1);
+                pwm->duty_percent = val;
+                return count;
+        }
+
+        return -EINVAL;
+}
+
+static ssize_t ep93xx_pwm_get_invert(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct ep93xx_pwm *pwm = platform_get_drvdata(pdev);
+
+        return sprintf(buf, "%d\n", ep93xx_pwm_is_inverted(pwm));
+}
+
+static ssize_t ep93xx_pwm_set_invert(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct ep93xx_pwm *pwm = platform_get_drvdata(pdev);
+        long val;
+        int err;
+
+        err = strict_strtol(buf, 10, &val);
+        if (err)
+                return -EINVAL;
+
+        if (val == 0)
+                ep93xx_pwm_normal(pwm);
+        else if (val == 1)
+                ep93xx_pwm_invert(pwm);
+        else
+                return -EINVAL;
+
+        return count;
+}
+
+static DEVICE_ATTR(min_freq, S_IRUGO, ep93xx_pwm_get_min_freq, NULL);
+static DEVICE_ATTR(max_freq, S_IRUGO, ep93xx_pwm_get_max_freq, NULL);
+static DEVICE_ATTR(freq, S_IWUGO | S_IRUGO,
+                   ep93xx_pwm_get_freq, ep93xx_pwm_set_freq);
+static DEVICE_ATTR(duty_percent, S_IWUGO | S_IRUGO,
+                   ep93xx_pwm_get_duty_percent, ep93xx_pwm_set_duty_percent);
+static DEVICE_ATTR(invert, S_IWUGO | S_IRUGO,
+                   ep93xx_pwm_get_invert, ep93xx_pwm_set_invert);
+
+static struct attribute *ep93xx_pwm_attrs[] = {
+        &dev_attr_min_freq.attr,
+        &dev_attr_max_freq.attr,
+        &dev_attr_freq.attr,
+        &dev_attr_duty_percent.attr,
+        &dev_attr_invert.attr,
+        NULL
+};
+
+static const struct attribute_group ep93xx_pwm_sysfs_files = {
+        .attrs  = ep93xx_pwm_attrs,
+};
+
+static int __init ep93xx_pwm_probe(struct platform_device *pdev)
+{
+        struct ep93xx_pwm *pwm;
+        struct resource *res;
+        int err;
+
+        err = ep93xx_pwm_acquire_gpio(pdev);
+        if (err)
+                return err;
+
+        pwm = kzalloc(sizeof(struct ep93xx_pwm), GFP_KERNEL);
+        if (!pwm) {
+                err = -ENOMEM;
+                goto fail_no_mem;
+        }
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (res == NULL) {
+                err = -ENXIO;
+                goto fail_no_mem_resource;
+        }
+
+        res = request_mem_region(res->start, resource_size(res), pdev->name);
+        if (res == NULL) {
+                err = -EBUSY;
+                goto fail_no_mem_resource;
+        }
+
+        pwm->mmio_base = ioremap(res->start, resource_size(res));
+        if (pwm->mmio_base == NULL) {
+                err = -ENXIO;
+                goto fail_no_ioremap;
+        }
+
+        err = sysfs_create_group(&pdev->dev.kobj, &ep93xx_pwm_sysfs_files);
+        if (err)
+                goto fail_no_sysfs;
+
+        pwm->clk = clk_get(&pdev->dev, "pwm_clk");
+        if (IS_ERR(pwm->clk)) {
+                err = PTR_ERR(pwm->clk);
+                goto fail_no_clk;
+        }
+
+        pwm->duty_percent = 50;
+
+        platform_set_drvdata(pdev, pwm);
+
+        /* disable pwm at startup. Avoids zero value. */
+        ep93xx_pwm_disable(pwm);
+        ep93xx_pwm_write_tc(pwm, EP93XX_PWM_MAX_COUNT);
+        ep93xx_pwm_write_dc(pwm, EP93XX_PWM_MAX_COUNT / 2);
+
+        clk_enable(pwm->clk);
+
+        return 0;
+
+fail_no_clk:
+        sysfs_remove_group(&pdev->dev.kobj, &ep93xx_pwm_sysfs_files);
+fail_no_sysfs:
+        iounmap(pwm->mmio_base);
+fail_no_ioremap:
+        release_mem_region(res->start, resource_size(res));
+fail_no_mem_resource:
+        kfree(pwm);
+fail_no_mem:
+        ep93xx_pwm_release_gpio(pdev);
+        return err;
+}
+
+static int __exit ep93xx_pwm_remove(struct platform_device *pdev)
+{
+        struct ep93xx_pwm *pwm = platform_get_drvdata(pdev);
+        struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+
+        ep93xx_pwm_disable(pwm);
+        clk_disable(pwm->clk);
+        clk_put(pwm->clk);
+        platform_set_drvdata(pdev, NULL);
+        sysfs_remove_group(&pdev->dev.kobj, &ep93xx_pwm_sysfs_files);
+        iounmap(pwm->mmio_base);
+        release_mem_region(res->start, resource_size(res));
+        kfree(pwm);
+        ep93xx_pwm_release_gpio(pdev);
+
+        return 0;
+}
+
+static struct platform_driver ep93xx_pwm_driver = {
+        .driver         = {
+                .name   = "ep93xx-pwm",
+                .owner  = THIS_MODULE,
+        },
+        .remove         = __exit_p(ep93xx_pwm_remove),
+};
+
+static int __init ep93xx_pwm_init(void)
+{
+        return platform_driver_probe(&ep93xx_pwm_driver, ep93xx_pwm_probe);
+}
+
+static void __exit ep93xx_pwm_exit(void)
+{
+        platform_driver_unregister(&ep93xx_pwm_driver);
+}
+
+module_init(ep93xx_pwm_init);
+module_exit(ep93xx_pwm_exit);
+
+MODULE_AUTHOR("Matthieu Crapet <mcrapet@gmail.com>, "
+              "H Hartley Sweeten <hsweeten@visionengravers.com>");
+MODULE_DESCRIPTION("EP93xx PWM driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:ep93xx-pwm");
diff --git a/drivers/misc/hdpuftrs/Makefile b/drivers/misc/hdpuftrs/Makefile
deleted file mode 100644
index ac74ae679230..000000000000
--- a/drivers/misc/hdpuftrs/Makefile
+++ /dev/null
@@ -1 +0,0 @@
-obj-$(CONFIG_HDPU_FEATURES) := hdpu_cpustate.o hdpu_nexus.o
diff --git a/drivers/misc/hdpuftrs/hdpu_cpustate.c b/drivers/misc/hdpuftrs/hdpu_cpustate.c
deleted file mode 100644
index 176fe4e09d3f..000000000000
--- a/drivers/misc/hdpuftrs/hdpu_cpustate.c
+++ /dev/null
@@ -1,256 +0,0 @@
-/*
- *      Sky CPU State Driver
- *
- *      Copyright (C) 2002 Brian Waite
- *
- *      This driver allows use of the CPU state bits
- *      It exports the /dev/sky_cpustate and also
- *      /proc/sky_cpustate pseudo-file for status information.
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- *
- */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/spinlock.h>
-#include <linux/smp_lock.h>
-#include <linux/miscdevice.h>
-#include <linux/proc_fs.h>
-#include <linux/hdpu_features.h>
-#include <linux/platform_device.h>
-#include <asm/uaccess.h>
-#include <linux/seq_file.h>
-#include <asm/io.h>
-
-#define SKY_CPUSTATE_VERSION            "1.1"
-
-static int hdpu_cpustate_probe(struct platform_device *pdev);
-static int hdpu_cpustate_remove(struct platform_device *pdev);
-
-static unsigned char cpustate_get_state(void);
-static int cpustate_proc_open(struct inode *inode, struct file *file);
-static int cpustate_proc_read(struct seq_file *seq, void *offset);
-
-static struct cpustate_t cpustate;
-
-static const struct file_operations proc_cpustate = {
-        .open = cpustate_proc_open,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-        .owner = THIS_MODULE,
-};
-
-static int cpustate_proc_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, cpustate_proc_read, NULL);
-}
-
-static int cpustate_proc_read(struct seq_file *seq, void *offset)
-{
-        seq_printf(seq, "CPU State: %04x\n", cpustate_get_state());
-        return 0;
-}
-
-static int cpustate_get_ref(int excl)
-{
-
-        int retval = -EBUSY;
-
-        spin_lock(&cpustate.lock);
-
-        if (cpustate.excl)
-                goto out_busy;
-
-        if (excl) {
-                if (cpustate.open_count)
-                        goto out_busy;
-                cpustate.excl = 1;
-        }
-
-        cpustate.open_count++;
-        retval = 0;
-
-      out_busy:
-        spin_unlock(&cpustate.lock);
-        return retval;
-}
-
-static int cpustate_free_ref(void)
-{
-
-        spin_lock(&cpustate.lock);
-
-        cpustate.excl = 0;
-        cpustate.open_count--;
-
-        spin_unlock(&cpustate.lock);
-        return 0;
-}
-
-static unsigned char cpustate_get_state(void)
-{
-
-        return cpustate.cached_val;
-}
-
-static void cpustate_set_state(unsigned char new_state)
-{
-        unsigned int state = (new_state << 21);
-
-#ifdef DEBUG_CPUSTATE
-        printk("CPUSTATE -> 0x%x\n", new_state);
-#endif
-        spin_lock(&cpustate.lock);
-        cpustate.cached_val = new_state;
-        writel((0xff << 21), cpustate.clr_addr);
-        writel(state, cpustate.set_addr);
-        spin_unlock(&cpustate.lock);
-}
-
-/*
- *      Now all the various file operations that we export.
- */
-
-static ssize_t cpustate_read(struct file *file, char *buf,
-                             size_t count, loff_t * ppos)
-{
-        unsigned char data;
-
-        if (count < 0)
-                return -EFAULT;
-        if (count == 0)
-                return 0;
-
-        data = cpustate_get_state();
-        if (copy_to_user(buf, &data, sizeof(unsigned char)))
-                return -EFAULT;
-        return sizeof(unsigned char);
-}
-
-static ssize_t cpustate_write(struct file *file, const char *buf,
-                              size_t count, loff_t * ppos)
-{
-        unsigned char data;
-
-        if (count < 0)
-                return -EFAULT;
-
-        if (count == 0)
-                return 0;
-
-        if (copy_from_user((unsigned char *)&data, buf, sizeof(unsigned char)))
-                return -EFAULT;
-
-        cpustate_set_state(data);
-        return sizeof(unsigned char);
-}
-
-static int cpustate_open(struct inode *inode, struct file *file)
-{
-        int ret;
-
-        lock_kernel();
-        ret = cpustate_get_ref((file->f_flags & O_EXCL));
-        unlock_kernel();
-
-        return ret;
-}
-
-static int cpustate_release(struct inode *inode, struct file *file)
-{
-        return cpustate_free_ref();
-}
-
-static struct platform_driver hdpu_cpustate_driver = {
-        .probe = hdpu_cpustate_probe,
-        .remove = hdpu_cpustate_remove,
-        .driver = {
-                .name = HDPU_CPUSTATE_NAME,
-                .owner = THIS_MODULE,
-        },
-};
-
-/*
- *      The various file operations we support.
- */
-static const struct file_operations cpustate_fops = {
-      .owner    = THIS_MODULE,
-      .open     = cpustate_open,
-      .release  = cpustate_release,
-      .read     = cpustate_read,
-      .write    = cpustate_write,
-      .llseek   = no_llseek,
-};
-
-static struct miscdevice cpustate_dev = {
-        .minor  = MISC_DYNAMIC_MINOR,
-        .name   = "sky_cpustate",
-        .fops   = &cpustate_fops,
-};
-
-static int hdpu_cpustate_probe(struct platform_device *pdev)
-{
-        struct resource *res;
-        struct proc_dir_entry *proc_de;
-        int ret;
-
-        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                printk(KERN_ERR "sky_cpustate: "
-                       "Invalid memory resource.\n");
-                return -EINVAL;
-        }
-        cpustate.set_addr = (unsigned long *)res->start;
-        cpustate.clr_addr = (unsigned long *)res->end - 1;
-
-        ret = misc_register(&cpustate_dev);
-        if (ret) {
-                printk(KERN_WARNING "sky_cpustate: "
-                       "Unable to register misc device.\n");
-                cpustate.set_addr = NULL;
-                cpustate.clr_addr = NULL;
-                return ret;
-        }
-
-        proc_de = proc_create("sky_cpustate", 0666, NULL, &proc_cpustate);
-        if (!proc_de) {
-                printk(KERN_WARNING "sky_cpustate: "
-                       "Unable to create proc entry\n");
-        }
-
-        printk(KERN_INFO "Sky CPU State Driver v" SKY_CPUSTATE_VERSION "\n");
-        return 0;
-}
-
-static int hdpu_cpustate_remove(struct platform_device *pdev)
-{
-        cpustate.set_addr = NULL;
-        cpustate.clr_addr = NULL;
-
-        remove_proc_entry("sky_cpustate", NULL);
-        misc_deregister(&cpustate_dev);
-
-        return 0;
-}
-
-static int __init cpustate_init(void)
-{
-        return platform_driver_register(&hdpu_cpustate_driver);
-}
-
-static void __exit cpustate_exit(void)
-{
-        platform_driver_unregister(&hdpu_cpustate_driver);
-}
-
-module_init(cpustate_init);
-module_exit(cpustate_exit);
-
-MODULE_AUTHOR("Brian Waite");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:" HDPU_CPUSTATE_NAME);
diff --git a/drivers/misc/hdpuftrs/hdpu_nexus.c b/drivers/misc/hdpuftrs/hdpu_nexus.c
deleted file mode 100644
index ce39fa54949b..000000000000
--- a/drivers/misc/hdpuftrs/hdpu_nexus.c
+++ /dev/null
@@ -1,149 +0,0 @@
-/*
- *      Sky Nexus Register Driver
- *
- *      Copyright (C) 2002 Brian Waite
- *
- *      This driver allows reading the Nexus register
- *      It exports the /proc/sky_chassis_id and also
- *      /proc/sky_slot_id pseudo-file for status information.
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- *
- */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/proc_fs.h>
-#include <linux/hdpu_features.h>
-#include <linux/platform_device.h>
-#include <linux/seq_file.h>
-#include <asm/io.h>
-
-static int hdpu_nexus_probe(struct platform_device *pdev);
-static int hdpu_nexus_remove(struct platform_device *pdev);
-static int hdpu_slot_id_open(struct inode *inode, struct file *file);
-static int hdpu_slot_id_read(struct seq_file *seq, void *offset);
-static int hdpu_chassis_id_open(struct inode *inode, struct file *file);
-static int hdpu_chassis_id_read(struct seq_file *seq, void *offset);
-
-static struct proc_dir_entry *hdpu_slot_id;
-static struct proc_dir_entry *hdpu_chassis_id;
-static int slot_id = -1;
-static int chassis_id = -1;
-
-static const struct file_operations proc_slot_id = {
-        .open = hdpu_slot_id_open,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-        .owner = THIS_MODULE,
-};
-
-static const struct file_operations proc_chassis_id = {
-        .open = hdpu_chassis_id_open,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-        .owner = THIS_MODULE,
-};
-
-static struct platform_driver hdpu_nexus_driver = {
-        .probe = hdpu_nexus_probe,
-        .remove = hdpu_nexus_remove,
-        .driver = {
-                .name = HDPU_NEXUS_NAME,
-                .owner = THIS_MODULE,
-        },
-};
-
-static int hdpu_slot_id_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, hdpu_slot_id_read, NULL);
-}
-
-static int hdpu_slot_id_read(struct seq_file *seq, void *offset)
-{
-        seq_printf(seq, "%d\n", slot_id);
-        return 0;
-}
-
-static int hdpu_chassis_id_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, hdpu_chassis_id_read, NULL);
-}
-
-static int hdpu_chassis_id_read(struct seq_file *seq, void *offset)
-{
-        seq_printf(seq, "%d\n", chassis_id);
-        return 0;
-}
-
-static int hdpu_nexus_probe(struct platform_device *pdev)
-{
-        struct resource *res;
-        int *nexus_id_addr;
-
-        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                printk(KERN_ERR "sky_nexus: "
-                       "Invalid memory resource.\n");
-                return -EINVAL;
-        }
-        nexus_id_addr = ioremap(res->start,
-                                (unsigned long)(res->end - res->start));
-        if (nexus_id_addr) {
-                slot_id = (*nexus_id_addr >> 8) & 0x1f;
-                chassis_id = *nexus_id_addr & 0xff;
-                iounmap(nexus_id_addr);
-        } else {
-                printk(KERN_ERR "sky_nexus: Could not map slot id\n");
-        }
-
-        hdpu_slot_id = proc_create("sky_slot_id", 0666, NULL, &proc_slot_id);
-        if (!hdpu_slot_id) {
-                printk(KERN_WARNING "sky_nexus: "
-                       "Unable to create proc dir entry: sky_slot_id\n");
-        }
-
-        hdpu_chassis_id = proc_create("sky_chassis_id", 0666, NULL,
-                                      &proc_chassis_id);
-        if (!hdpu_chassis_id)
-                printk(KERN_WARNING "sky_nexus: "
-                       "Unable to create proc dir entry: sky_chassis_id\n");
-
-        return 0;
-}
-
-static int hdpu_nexus_remove(struct platform_device *pdev)
-{
-        slot_id = -1;
-        chassis_id = -1;
-
-        remove_proc_entry("sky_slot_id", NULL);
-        remove_proc_entry("sky_chassis_id", NULL);
-
-        hdpu_slot_id = 0;
-        hdpu_chassis_id = 0;
-
-        return 0;
-}
-
-static int __init nexus_init(void)
-{
-        return platform_driver_register(&hdpu_nexus_driver);
-}
-
-static void __exit nexus_exit(void)
-{
-        platform_driver_unregister(&hdpu_nexus_driver);
-}
-
-module_init(nexus_init);
-module_exit(nexus_exit);
-
-MODULE_AUTHOR("Brian Waite");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:" HDPU_NEXUS_NAME);
diff --git a/drivers/misc/hmc6352.c b/drivers/misc/hmc6352.c
new file mode 100644
index 000000000000..234bfcaf2099
--- /dev/null
+++ b/drivers/misc/hmc6352.c
@@ -0,0 +1,166 @@
+/*
+ * hmc6352.c - Honeywell Compass Driver
+ *
+ * Copyright (C) 2009 Intel Corp
+ *
+ *  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/err.h>
+#include <linux/delay.h>
+#include <linux/sysfs.h>
+
+static DEFINE_MUTEX(compass_mutex);
+
+static int compass_command(struct i2c_client *c, u8 cmd)
+{
+        int ret = i2c_master_send(c, &cmd, 1);
+        if (ret < 0)
+                dev_warn(&c->dev, "command '%c' failed.\n", cmd);
+        return ret;
+}
+
+static int compass_store(struct device *dev, const char *buf, size_t count,
+                        const char *map)
+{
+        struct i2c_client *c = to_i2c_client(dev);
+        int ret;
+        unsigned long val;
+
+        if (strict_strtoul(buf, 10, &val))
+                return -EINVAL;
+        if (val >= strlen(map))
+                return -EINVAL;
+        mutex_lock(&compass_mutex);
+        ret = compass_command(c, map[val]);
+        mutex_unlock(&compass_mutex);
+        if (ret < 0)
+                return ret;
+        return count;
+}
+
+static ssize_t compass_calibration_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        return compass_store(dev, buf, count, "EC");
+}
+
+static ssize_t compass_power_mode_store(struct device *dev,
+                struct device_attribute *attr, const  char *buf, size_t count)
+{
+        return compass_store(dev, buf, count, "SW");
+}
+
+static ssize_t compass_heading_data_show(struct device *dev,
+                        struct device_attribute *attr, char *buf)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        unsigned char i2c_data[2];
+        unsigned int ret;
+
+        mutex_lock(&compass_mutex);
+        ret = compass_command(client, 'A');
+        if (ret != 1) {
+                mutex_unlock(&compass_mutex);
+                return ret;
+        }
+        msleep(10); /* sending 'A' cmd we need to wait for 7-10 millisecs */
+        ret = i2c_master_recv(client, i2c_data, 2);
+        mutex_unlock(&compass_mutex);
+        if (ret != 1) {
+                dev_warn(dev, "i2c read data cmd failed\n");
+                return ret;
+        }
+        ret = (i2c_data[0] << 8) | i2c_data[1];
+        return sprintf(buf, "%d.%d\n", ret/10, ret%10);
+}
+
+
+static DEVICE_ATTR(heading0_input, S_IRUGO, compass_heading_data_show, NULL);
+static DEVICE_ATTR(calibration, S_IWUSR, NULL, compass_calibration_store);
+static DEVICE_ATTR(power_state, S_IWUSR, NULL, compass_power_mode_store);
+
+static struct attribute *mid_att_compass[] = {
+        &dev_attr_heading0_input.attr,
+        &dev_attr_calibration.attr,
+        &dev_attr_power_state.attr,
+        NULL
+};
+
+static const struct attribute_group m_compass_gr = {
+        .name = "hmc6352",
+        .attrs = mid_att_compass
+};
+
+static int hmc6352_probe(struct i2c_client *client,
+                                        const struct i2c_device_id *id)
+{
+        int res;
+
+        res = sysfs_create_group(&client->dev.kobj, &m_compass_gr);
+        if (res) {
+                dev_err(&client->dev, "device_create_file failed\n");
+                return res;
+        }
+        dev_info(&client->dev, "%s HMC6352 compass chip found\n",
+                                                        client->name);
+        return 0;
+}
+
+static int hmc6352_remove(struct i2c_client *client)
+{
+        sysfs_remove_group(&client->dev.kobj, &m_compass_gr);
+        return 0;
+}
+
+static struct i2c_device_id hmc6352_id[] = {
+        { "hmc6352", 0 },
+        { }
+};
+
+MODULE_DEVICE_TABLE(i2c, hmc6352_id);
+
+static struct i2c_driver hmc6352_driver = {
+        .driver = {
+                .name = "hmc6352",
+        },
+        .probe = hmc6352_probe,
+        .remove = hmc6352_remove,
+        .id_table = hmc6352_id,
+};
+
+static int __init sensor_hmc6352_init(void)
+{
+        return i2c_add_driver(&hmc6352_driver);
+}
+
+static void  __exit sensor_hmc6352_exit(void)
+{
+        i2c_del_driver(&hmc6352_driver);
+}
+
+module_init(sensor_hmc6352_init);
+module_exit(sensor_hmc6352_exit);
+
+MODULE_AUTHOR("Kalhan Trisal <kalhan.trisal@intel.com");
+MODULE_DESCRIPTION("hmc6352 Compass Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
index 880ccf39e23b..fffc227181b0 100644
--- a/drivers/misc/hpilo.c
+++ b/drivers/misc/hpilo.c
@@ -1,5 +1,5 @@
 /*
- * Driver for HP iLO/iLO2 management processor.
+ * Driver for the HP iLO management processor.
  *
  * Copyright (C) 2008 Hewlett-Packard Development Company, L.P.
  *      David Altobelli <david.altobelli@hp.com>
@@ -13,14 +13,19 @@
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/pci.h>
+#include <linux/interrupt.h>
 #include <linux/ioport.h>
 #include <linux/device.h>
 #include <linux/file.h>
 #include <linux/cdev.h>
+#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/delay.h>
 #include <linux/uaccess.h>
 #include <linux/io.h>
+#include <linux/wait.h>
+#include <linux/poll.h>
+#include <linux/slab.h>
 #include "hpilo.h"
 
 static struct class *ilo_class;
@@ -61,9 +66,10 @@ static inline int desc_mem_sz(int nr_entry)
 static int fifo_enqueue(struct ilo_hwinfo *hw, char *fifobar, int entry)
 {
         struct fifo *fifo_q = FIFOBARTOHANDLE(fifobar);
+        unsigned long flags;
         int ret = 0;
 
-        spin_lock(&hw->fifo_lock);
+        spin_lock_irqsave(&hw->fifo_lock, flags);
         if (!(fifo_q->fifobar[(fifo_q->tail + 1) & fifo_q->imask]
               & ENTRY_MASK_O)) {
                 fifo_q->fifobar[fifo_q->tail & fifo_q->imask] |=
@@ -71,7 +77,7 @@ static int fifo_enqueue(struct ilo_hwinfo *hw, char *fifobar, int entry)
                 fifo_q->tail += 1;
                 ret = 1;
         }
-        spin_unlock(&hw->fifo_lock);
+        spin_unlock_irqrestore(&hw->fifo_lock, flags);
 
         return ret;
 }
@@ -79,10 +85,11 @@ static int fifo_enqueue(struct ilo_hwinfo *hw, char *fifobar, int entry)
 static int fifo_dequeue(struct ilo_hwinfo *hw, char *fifobar, int *entry)
 {
         struct fifo *fifo_q = FIFOBARTOHANDLE(fifobar);
+        unsigned long flags;
         int ret = 0;
         u64 c;
 
-        spin_lock(&hw->fifo_lock);
+        spin_lock_irqsave(&hw->fifo_lock, flags);
         c = fifo_q->fifobar[fifo_q->head & fifo_q->imask];
         if (c & ENTRY_MASK_C) {
                 if (entry)
@@ -93,7 +100,23 @@ static int fifo_dequeue(struct ilo_hwinfo *hw, char *fifobar, int *entry)
                 fifo_q->head += 1;
                 ret = 1;
         }
-        spin_unlock(&hw->fifo_lock);
+        spin_unlock_irqrestore(&hw->fifo_lock, flags);
+
+        return ret;
+}
+
+static int fifo_check_recv(struct ilo_hwinfo *hw, char *fifobar)
+{
+        struct fifo *fifo_q = FIFOBARTOHANDLE(fifobar);
+        unsigned long flags;
+        int ret = 0;
+        u64 c;
+
+        spin_lock_irqsave(&hw->fifo_lock, flags);
+        c = fifo_q->fifobar[fifo_q->head & fifo_q->imask];
+        if (c & ENTRY_MASK_C)
+                ret = 1;
+        spin_unlock_irqrestore(&hw->fifo_lock, flags);
 
         return ret;
 }
@@ -142,6 +165,13 @@ static int ilo_pkt_dequeue(struct ilo_hwinfo *hw, struct ccb *ccb,
         return ret;
 }
 
+static int ilo_pkt_recv(struct ilo_hwinfo *hw, struct ccb *ccb)
+{
+        char *fifobar = ccb->ccb_u3.recv_fifobar;
+
+        return fifo_check_recv(hw, fifobar);
+}
+
 static inline void doorbell_set(struct ccb *ccb)
 {
         iowrite8(1, ccb->ccb_u5.db_base);
@@ -151,6 +181,7 @@ static inline void doorbell_clr(struct ccb *ccb)
 {
         iowrite8(2, ccb->ccb_u5.db_base);
 }
+
 static inline int ctrl_set(int l2sz, int idxmask, int desclim)
 {
         int active = 0, go = 1;
@@ -160,6 +191,7 @@ static inline int ctrl_set(int l2sz, int idxmask, int desclim)
                active << CTRL_BITPOS_A |
                go << CTRL_BITPOS_G;
 }
+
 static void ctrl_setup(struct ccb *ccb, int nr_desc, int l2desc_sz)
 {
         /* for simplicity, use the same parameters for send and recv ctrls */
@@ -192,13 +224,10 @@ static void fifo_setup(void *base_addr, int nr_entry)
 
 static void ilo_ccb_close(struct pci_dev *pdev, struct ccb_data *data)
 {
-        struct ccb *driver_ccb;
-        struct ccb __iomem *device_ccb;
+        struct ccb *driver_ccb = &data->driver_ccb;
+        struct ccb __iomem *device_ccb = data->mapped_ccb;
         int retries;
 
-        driver_ccb = &data->driver_ccb;
-        device_ccb = data->mapped_ccb;
-
         /* complicated dance to tell the hw we are stopping */
         doorbell_clr(driver_ccb);
         iowrite32(ioread32(&device_ccb->send_ctrl) & ~(1 << CTRL_BITPOS_G),
@@ -225,34 +254,31 @@ static void ilo_ccb_close(struct pci_dev *pdev, struct ccb_data *data)
         pci_free_consistent(pdev, data->dma_size, data->dma_va, data->dma_pa);
 }
 
-static int ilo_ccb_open(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
+static int ilo_ccb_setup(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
 {
-        char *dma_va, *dma_pa;
-        int pkt_id, pkt_sz, i, error;
+        char *dma_va;
+        dma_addr_t dma_pa;
         struct ccb *driver_ccb, *ilo_ccb;
-        struct pci_dev *pdev;
 
         driver_ccb = &data->driver_ccb;
         ilo_ccb = &data->ilo_ccb;
-        pdev = hw->ilo_dev;
 
         data->dma_size = 2 * fifo_sz(NR_QENTRY) +
                          2 * desc_mem_sz(NR_QENTRY) +
                          ILO_START_ALIGN + ILO_CACHE_SZ;
 
-        error = -ENOMEM;
-        data->dma_va = pci_alloc_consistent(pdev, data->dma_size,
+        data->dma_va = pci_alloc_consistent(hw->ilo_dev, data->dma_size,
                                             &data->dma_pa);
         if (!data->dma_va)
-                goto out;
+                return -ENOMEM;
 
         dma_va = (char *)data->dma_va;
-        dma_pa = (char *)data->dma_pa;
+        dma_pa = data->dma_pa;
 
         memset(dma_va, 0, data->dma_size);
 
         dma_va = (char *)roundup((unsigned long)dma_va, ILO_START_ALIGN);
-        dma_pa = (char *)roundup((unsigned long)dma_pa, ILO_START_ALIGN);
+        dma_pa = roundup(dma_pa, ILO_START_ALIGN);
 
         /*
          * Create two ccb's, one with virt addrs, one with phys addrs.
@@ -263,26 +289,26 @@ static int ilo_ccb_open(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
 
         fifo_setup(dma_va, NR_QENTRY);
         driver_ccb->ccb_u1.send_fifobar = dma_va + FIFOHANDLESIZE;
-        ilo_ccb->ccb_u1.send_fifobar = dma_pa + FIFOHANDLESIZE;
+        ilo_ccb->ccb_u1.send_fifobar_pa = dma_pa + FIFOHANDLESIZE;
         dma_va += fifo_sz(NR_QENTRY);
         dma_pa += fifo_sz(NR_QENTRY);
 
         dma_va = (char *)roundup((unsigned long)dma_va, ILO_CACHE_SZ);
-        dma_pa = (char *)roundup((unsigned long)dma_pa, ILO_CACHE_SZ);
+        dma_pa = roundup(dma_pa, ILO_CACHE_SZ);
 
         fifo_setup(dma_va, NR_QENTRY);
         driver_ccb->ccb_u3.recv_fifobar = dma_va + FIFOHANDLESIZE;
-        ilo_ccb->ccb_u3.recv_fifobar = dma_pa + FIFOHANDLESIZE;
+        ilo_ccb->ccb_u3.recv_fifobar_pa = dma_pa + FIFOHANDLESIZE;
         dma_va += fifo_sz(NR_QENTRY);
         dma_pa += fifo_sz(NR_QENTRY);
 
         driver_ccb->ccb_u2.send_desc = dma_va;
-        ilo_ccb->ccb_u2.send_desc = dma_pa;
+        ilo_ccb->ccb_u2.send_desc_pa = dma_pa;
         dma_pa += desc_mem_sz(NR_QENTRY);
         dma_va += desc_mem_sz(NR_QENTRY);
 
         driver_ccb->ccb_u4.recv_desc = dma_va;
-        ilo_ccb->ccb_u4.recv_desc = dma_pa;
+        ilo_ccb->ccb_u4.recv_desc_pa = dma_pa;
 
         driver_ccb->channel = slot;
         ilo_ccb->channel = slot;
@@ -290,10 +316,18 @@ static int ilo_ccb_open(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
         driver_ccb->ccb_u5.db_base = hw->db_vaddr + (slot << L2_DB_SIZE);
         ilo_ccb->ccb_u5.db_base = NULL; /* hw ccb's doorbell is not used */
 
+        return 0;
+}
+
+static void ilo_ccb_open(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
+{
+        int pkt_id, pkt_sz;
+        struct ccb *driver_ccb = &data->driver_ccb;
+
         /* copy the ccb with physical addrs to device memory */
         data->mapped_ccb = (struct ccb __iomem *)
                                 (hw->ram_vaddr + (slot * ILOHW_CCB_SZ));
-        memcpy_toio(data->mapped_ccb, ilo_ccb, sizeof(struct ccb));
+        memcpy_toio(data->mapped_ccb, &data->ilo_ccb, sizeof(struct ccb));
 
         /* put packets on the send and receive queues */
         pkt_sz = 0;
@@ -306,7 +340,14 @@ static int ilo_ccb_open(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
         for (pkt_id = 0; pkt_id < NR_QENTRY; pkt_id++)
                 ilo_pkt_enqueue(hw, driver_ccb, RECVQ, pkt_id, pkt_sz);
 
+        /* the ccb is ready to use */
         doorbell_clr(driver_ccb);
+}
+
+static int ilo_ccb_verify(struct ilo_hwinfo *hw, struct ccb_data *data)
+{
+        int pkt_id, i;
+        struct ccb *driver_ccb = &data->driver_ccb;
 
         /* make sure iLO is really handling requests */
         for (i = MAX_WAIT; i > 0; i--) {
@@ -315,20 +356,14 @@ static int ilo_ccb_open(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
                 udelay(WAIT_TIME);
         }
 
-        if (i) {
-                ilo_pkt_enqueue(hw, driver_ccb, SENDQ, pkt_id, 0);
-                doorbell_set(driver_ccb);
-        } else {
-                dev_err(&pdev->dev, "Open could not dequeue a packet\n");
-                error = -EBUSY;
-                goto free;
+        if (i == 0) {
+                dev_err(&hw->ilo_dev->dev, "Open could not dequeue a packet\n");
+                return -EBUSY;
         }
 
+        ilo_pkt_enqueue(hw, driver_ccb, SENDQ, pkt_id, 0);
+        doorbell_set(driver_ccb);
         return 0;
-free:
-        ilo_ccb_close(pdev, data);
-out:
-        return error;
 }
 
 static inline int is_channel_reset(struct ccb *ccb)
@@ -343,19 +378,45 @@ static inline void set_channel_reset(struct ccb *ccb)
         FIFOBARTOHANDLE(ccb->ccb_u1.send_fifobar)->reset = 1;
 }
 
+static inline int get_device_outbound(struct ilo_hwinfo *hw)
+{
+        return ioread32(&hw->mmio_vaddr[DB_OUT]);
+}
+
+static inline int is_db_reset(int db_out)
+{
+        return db_out & (1 << DB_RESET);
+}
+
 static inline int is_device_reset(struct ilo_hwinfo *hw)
 {
         /* check for global reset condition */
-        return ioread32(&hw->mmio_vaddr[DB_OUT]) & (1 << DB_RESET);
+        return is_db_reset(get_device_outbound(hw));
+}
+
+static inline void clear_pending_db(struct ilo_hwinfo *hw, int clr)
+{
+        iowrite32(clr, &hw->mmio_vaddr[DB_OUT]);
 }
 
 static inline void clear_device(struct ilo_hwinfo *hw)
 {
         /* clear the device (reset bits, pending channel entries) */
-        iowrite32(-1, &hw->mmio_vaddr[DB_OUT]);
+        clear_pending_db(hw, -1);
+}
+
+static inline void ilo_enable_interrupts(struct ilo_hwinfo *hw)
+{
+        iowrite8(ioread8(&hw->mmio_vaddr[DB_IRQ]) | 1, &hw->mmio_vaddr[DB_IRQ]);
 }
 
-static void ilo_locked_reset(struct ilo_hwinfo *hw)
+static inline void ilo_disable_interrupts(struct ilo_hwinfo *hw)
+{
+        iowrite8(ioread8(&hw->mmio_vaddr[DB_IRQ]) & ~1,
+                 &hw->mmio_vaddr[DB_IRQ]);
+}
+
+static void ilo_set_reset(struct ilo_hwinfo *hw)
 {
         int slot;
 
@@ -368,40 +429,22 @@ static void ilo_locked_reset(struct ilo_hwinfo *hw)
                         continue;
                 set_channel_reset(&hw->ccb_alloc[slot]->driver_ccb);
         }
-
-        clear_device(hw);
-}
-
-static void ilo_reset(struct ilo_hwinfo *hw)
-{
-        spin_lock(&hw->alloc_lock);
-
-        /* reset might have been handled after lock was taken */
-        if (is_device_reset(hw))
-                ilo_locked_reset(hw);
-
-        spin_unlock(&hw->alloc_lock);
 }
 
 static ssize_t ilo_read(struct file *fp, char __user *buf,
                         size_t len, loff_t *off)
 {
         int err, found, cnt, pkt_id, pkt_len;
-        struct ccb_data *data;
-        struct ccb *driver_ccb;
-        struct ilo_hwinfo *hw;
+        struct ccb_data *data = fp->private_data;
+        struct ccb *driver_ccb = &data->driver_ccb;
+        struct ilo_hwinfo *hw = data->ilo_hw;
         void *pkt;
 
-        data = fp->private_data;
-        driver_ccb = &data->driver_ccb;
-        hw = data->ilo_hw;
-
-        if (is_device_reset(hw) || is_channel_reset(driver_ccb)) {
+        if (is_channel_reset(driver_ccb)) {
                 /*
                  * If the device has been reset, applications
                  * need to close and reopen all ccbs.
                  */
-                ilo_reset(hw);
                 return -ENODEV;
         }
 
@@ -442,23 +485,13 @@ static ssize_t ilo_write(struct file *fp, const char __user *buf,
                          size_t len, loff_t *off)
 {
         int err, pkt_id, pkt_len;
-        struct ccb_data *data;
-        struct ccb *driver_ccb;
-        struct ilo_hwinfo *hw;
+        struct ccb_data *data = fp->private_data;
+        struct ccb *driver_ccb = &data->driver_ccb;
+        struct ilo_hwinfo *hw = data->ilo_hw;
         void *pkt;
 
-        data = fp->private_data;
-        driver_ccb = &data->driver_ccb;
-        hw = data->ilo_hw;
-
-        if (is_device_reset(hw) || is_channel_reset(driver_ccb)) {
-                /*
-                 * If the device has been reset, applications
-                 * need to close and reopen all ccbs.
-                 */
-                ilo_reset(hw);
+        if (is_channel_reset(driver_ccb))
                 return -ENODEV;
-        }
 
         /* get a packet to send the user command */
         if (!ilo_pkt_dequeue(hw, driver_ccb, SENDQ, &pkt_id, &pkt_len, &pkt))
@@ -480,32 +513,48 @@ static ssize_t ilo_write(struct file *fp, const char __user *buf,
         return err ? -EFAULT : len;
 }
 
+static unsigned int ilo_poll(struct file *fp, poll_table *wait)
+{
+        struct ccb_data *data = fp->private_data;
+        struct ccb *driver_ccb = &data->driver_ccb;
+
+        poll_wait(fp, &data->ccb_waitq, wait);
+
+        if (is_channel_reset(driver_ccb))
+                return POLLERR;
+        else if (ilo_pkt_recv(data->ilo_hw, driver_ccb))
+                return POLLIN | POLLRDNORM;
+
+        return 0;
+}
+
 static int ilo_close(struct inode *ip, struct file *fp)
 {
         int slot;
         struct ccb_data *data;
         struct ilo_hwinfo *hw;
+        unsigned long flags;
 
         slot = iminor(ip) % MAX_CCB;
         hw = container_of(ip->i_cdev, struct ilo_hwinfo, cdev);
 
-        spin_lock(&hw->alloc_lock);
-
-        if (is_device_reset(hw))
-                ilo_locked_reset(hw);
+        spin_lock(&hw->open_lock);
 
         if (hw->ccb_alloc[slot]->ccb_cnt == 1) {
 
                 data = fp->private_data;
 
+                spin_lock_irqsave(&hw->alloc_lock, flags);
+                hw->ccb_alloc[slot] = NULL;
+                spin_unlock_irqrestore(&hw->alloc_lock, flags);
+
                 ilo_ccb_close(hw->ilo_dev, data);
 
                 kfree(data);
-                hw->ccb_alloc[slot] = NULL;
         } else
                 hw->ccb_alloc[slot]->ccb_cnt--;
 
-        spin_unlock(&hw->alloc_lock);
+        spin_unlock(&hw->open_lock);
 
         return 0;
 }
@@ -515,6 +564,7 @@ static int ilo_open(struct inode *ip, struct file *fp)
         int slot, error;
         struct ccb_data *data;
         struct ilo_hwinfo *hw;
+        unsigned long flags;
 
         slot = iminor(ip) % MAX_CCB;
         hw = container_of(ip->i_cdev, struct ilo_hwinfo, cdev);
@@ -524,22 +574,42 @@ static int ilo_open(struct inode *ip, struct file *fp)
         if (!data)
                 return -ENOMEM;
 
-        spin_lock(&hw->alloc_lock);
-
-        if (is_device_reset(hw))
-                ilo_locked_reset(hw);
+        spin_lock(&hw->open_lock);
 
         /* each fd private_data holds sw/hw view of ccb */
         if (hw->ccb_alloc[slot] == NULL) {
                 /* create a channel control block for this minor */
-                error = ilo_ccb_open(hw, data, slot);
-                if (!error) {
-                        hw->ccb_alloc[slot] = data;
-                        hw->ccb_alloc[slot]->ccb_cnt = 1;
-                        hw->ccb_alloc[slot]->ccb_excl = fp->f_flags & O_EXCL;
-                        hw->ccb_alloc[slot]->ilo_hw = hw;
-                } else
+                error = ilo_ccb_setup(hw, data, slot);
+                if (error) {
                         kfree(data);
+                        goto out;
+                }
+
+                data->ccb_cnt = 1;
+                data->ccb_excl = fp->f_flags & O_EXCL;
+                data->ilo_hw = hw;
+                init_waitqueue_head(&data->ccb_waitq);
+
+                /* write the ccb to hw */
+                spin_lock_irqsave(&hw->alloc_lock, flags);
+                ilo_ccb_open(hw, data, slot);
+                hw->ccb_alloc[slot] = data;
+                spin_unlock_irqrestore(&hw->alloc_lock, flags);
+
+                /* make sure the channel is functional */
+                error = ilo_ccb_verify(hw, data);
+                if (error) {
+
+                        spin_lock_irqsave(&hw->alloc_lock, flags);
+                        hw->ccb_alloc[slot] = NULL;
+                        spin_unlock_irqrestore(&hw->alloc_lock, flags);
+
+                        ilo_ccb_close(hw->ilo_dev, data);
+
+                        kfree(data);
+                        goto out;
+                }
+
         } else {
                 kfree(data);
                 if (fp->f_flags & O_EXCL || hw->ccb_alloc[slot]->ccb_excl) {
@@ -554,7 +624,8 @@ static int ilo_open(struct inode *ip, struct file *fp)
                         error = 0;
                 }
         }
-        spin_unlock(&hw->alloc_lock);
+out:
+        spin_unlock(&hw->open_lock);
 
         if (!error)
                 fp->private_data = hw->ccb_alloc[slot];
@@ -566,10 +637,47 @@ static const struct file_operations ilo_fops = {
         .owner          = THIS_MODULE,
         .read           = ilo_read,
         .write          = ilo_write,
+        .poll           = ilo_poll,
         .open           = ilo_open,
         .release        = ilo_close,
+        .llseek         = noop_llseek,
 };
 
+static irqreturn_t ilo_isr(int irq, void *data)
+{
+        struct ilo_hwinfo *hw = data;
+        int pending, i;
+
+        spin_lock(&hw->alloc_lock);
+
+        /* check for ccbs which have data */
+        pending = get_device_outbound(hw);
+        if (!pending) {
+                spin_unlock(&hw->alloc_lock);
+                return IRQ_NONE;
+        }
+
+        if (is_db_reset(pending)) {
+                /* wake up all ccbs if the device was reset */
+                pending = -1;
+                ilo_set_reset(hw);
+        }
+
+        for (i = 0; i < MAX_CCB; i++) {
+                if (!hw->ccb_alloc[i])
+                        continue;
+                if (pending & (1 << i))
+                        wake_up_interruptible(&hw->ccb_alloc[i]->ccb_waitq);
+        }
+
+        /* clear the device of the channels that have been handled */
+        clear_pending_db(hw, pending);
+
+        spin_unlock(&hw->alloc_lock);
+
+        return IRQ_HANDLED;
+}
+
 static void ilo_unmap_device(struct pci_dev *pdev, struct ilo_hwinfo *hw)
 {
         pci_iounmap(pdev, hw->db_vaddr);
@@ -623,6 +731,8 @@ static void ilo_remove(struct pci_dev *pdev)
                 device_destroy(ilo_class, MKDEV(ilo_major, i));
 
         cdev_del(&ilo_hw->cdev);
+        ilo_disable_interrupts(ilo_hw);
+        free_irq(pdev->irq, ilo_hw);
         ilo_unmap_device(pdev, ilo_hw);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
@@ -658,6 +768,7 @@ static int __devinit ilo_probe(struct pci_dev *pdev,
         ilo_hw->ilo_dev = pdev;
         spin_lock_init(&ilo_hw->alloc_lock);
         spin_lock_init(&ilo_hw->fifo_lock);
+        spin_lock_init(&ilo_hw->open_lock);
 
         error = pci_enable_device(pdev);
         if (error)
@@ -676,13 +787,19 @@ static int __devinit ilo_probe(struct pci_dev *pdev,
         pci_set_drvdata(pdev, ilo_hw);
         clear_device(ilo_hw);
 
+        error = request_irq(pdev->irq, ilo_isr, IRQF_SHARED, "hpilo", ilo_hw);
+        if (error)
+                goto unmap;
+
+        ilo_enable_interrupts(ilo_hw);
+
         cdev_init(&ilo_hw->cdev, &ilo_fops);
         ilo_hw->cdev.owner = THIS_MODULE;
         start = devnum * MAX_CCB;
         error = cdev_add(&ilo_hw->cdev, MKDEV(ilo_major, start), MAX_CCB);
         if (error) {
                 dev_err(&pdev->dev, "Could not add cdev\n");
-                goto unmap;
+                goto remove_isr;
         }
 
         for (minor = 0 ; minor < MAX_CCB; minor++) {
@@ -695,6 +812,9 @@ static int __devinit ilo_probe(struct pci_dev *pdev,
         }
 
         return 0;
+remove_isr:
+        ilo_disable_interrupts(ilo_hw);
+        free_irq(pdev->irq, ilo_hw);
 unmap:
         ilo_unmap_device(pdev, ilo_hw);
 free_regions:
@@ -759,7 +879,7 @@ static void __exit ilo_exit(void)
         class_destroy(ilo_class);
 }
 
-MODULE_VERSION("1.1");
+MODULE_VERSION("1.2");
 MODULE_ALIAS(ILO_NAME);
 MODULE_DESCRIPTION(ILO_NAME);
 MODULE_AUTHOR("David Altobelli <david.altobelli@hp.com>");
diff --git a/drivers/misc/hpilo.h b/drivers/misc/hpilo.h
index 03a14c82aad9..54e43adbdea1 100644
--- a/drivers/misc/hpilo.h
+++ b/drivers/misc/hpilo.h
@@ -44,13 +44,27 @@ struct ilo_hwinfo {
 
         struct pci_dev *ilo_dev;
 
+        /*
+         * open_lock      serializes ccb_cnt during open and close
+         * [ irq disabled ]
+         * -> alloc_lock  used when adding/removing/searching ccb_alloc,
+         *                which represents all ccbs open on the device
+         * --> fifo_lock  controls access to fifo queues shared with hw
+         *
+         * Locks must be taken in this order, but open_lock and alloc_lock
+         * are optional, they do not need to be held in order to take a
+         * lower level lock.
+         */
+        spinlock_t open_lock;
         spinlock_t alloc_lock;
         spinlock_t fifo_lock;
 
         struct cdev cdev;
 };
 
-/* offset from mmio_vaddr */
+/* offset from mmio_vaddr for enabling doorbell interrupts */
+#define DB_IRQ          0xB2
+/* offset from mmio_vaddr for outbound communications */
 #define DB_OUT          0xD4
 /* DB_OUT reset bit */
 #define DB_RESET        26
@@ -65,21 +79,21 @@ struct ilo_hwinfo {
 struct ccb {
         union {
                 char *send_fifobar;
-                u64 padding1;
+                u64 send_fifobar_pa;
         } ccb_u1;
         union {
                 char *send_desc;
-                u64 padding2;
+                u64 send_desc_pa;
         } ccb_u2;
         u64 send_ctrl;
 
         union {
                 char *recv_fifobar;
-                u64 padding3;
+                u64 recv_fifobar_pa;
         } ccb_u3;
         union {
                 char *recv_desc;
-                u64 padding4;
+                u64 recv_desc_pa;
         } ccb_u4;
         u64 recv_ctrl;
 
@@ -131,6 +145,9 @@ struct ccb_data {
         /* pointer to hardware device info */
         struct ilo_hwinfo *ilo_hw;
 
+        /* queue for this ccb to wait for recv data */
+        wait_queue_head_t ccb_waitq;
+
         /* usage count, to allow for shared ccb's */
         int         ccb_cnt;
 
diff --git a/drivers/misc/ibmasm/command.c b/drivers/misc/ibmasm/command.c
index 276d3fb68094..5c766b4fb238 100644
--- a/drivers/misc/ibmasm/command.c
+++ b/drivers/misc/ibmasm/command.c
@@ -22,6 +22,8 @@
  *
  */
 
+#include <linux/sched.h>
+#include <linux/slab.h>
 #include "ibmasm.h"
 #include "lowlevel.h"
 
diff --git a/drivers/misc/ibmasm/event.c b/drivers/misc/ibmasm/event.c
index 68a0a5b94795..76bfda1ffaa9 100644
--- a/drivers/misc/ibmasm/event.c
+++ b/drivers/misc/ibmasm/event.c
@@ -22,6 +22,8 @@
  *
  */
 
+#include <linux/sched.h>
+#include <linux/slab.h>
 #include "ibmasm.h"
 #include "lowlevel.h"
 
diff --git a/drivers/misc/ibmasm/ibmasmfs.c b/drivers/misc/ibmasm/ibmasmfs.c
index de966a6fb7e6..d2d5d23416dd 100644
--- a/drivers/misc/ibmasm/ibmasmfs.c
+++ b/drivers/misc/ibmasm/ibmasmfs.c
@@ -75,6 +75,7 @@
 
 #include <linux/fs.h>
 #include <linux/pagemap.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include "ibmasm.h"
@@ -90,14 +91,13 @@ static void ibmasmfs_create_files (struct super_block *sb, struct dentry *root);
 static int ibmasmfs_fill_super (struct super_block *sb, void *data, int silent);
 
 
-static int ibmasmfs_get_super(struct file_system_type *fst,
-                        int flags, const char *name, void *data,
-                        struct vfsmount *mnt)
+static struct dentry *ibmasmfs_mount(struct file_system_type *fst,
+                        int flags, const char *name, void *data)
 {
-        return get_sb_single(fst, flags, data, ibmasmfs_fill_super, mnt);
+        return mount_single(fst, flags, data, ibmasmfs_fill_super);
 }
 
-static struct super_operations ibmasmfs_s_ops = {
+static const struct super_operations ibmasmfs_s_ops = {
         .statfs         = simple_statfs,
         .drop_inode     = generic_delete_inode,
 };
@@ -107,7 +107,7 @@ static const struct file_operations *ibmasmfs_dir_ops = &simple_dir_operations;
 static struct file_system_type ibmasmfs_type = {
         .owner          = THIS_MODULE,
         .name           = "ibmasmfs",
-        .get_sb         = ibmasmfs_get_super,
+        .mount          = ibmasmfs_mount,
         .kill_sb        = kill_litter_super,
 };
 
@@ -145,6 +145,7 @@ static struct inode *ibmasmfs_make_inode(struct super_block *sb, int mode)
         struct inode *ret = new_inode(sb);
 
         if (ret) {
+                ret->i_ino = get_next_ino();
                 ret->i_mode = mode;
                 ret->i_atime = ret->i_mtime = ret->i_ctime = CURRENT_TIME;
         }
@@ -583,6 +584,7 @@ static const struct file_operations command_fops = {
         .release =      command_file_close,
         .read =         command_file_read,
         .write =        command_file_write,
+        .llseek =       generic_file_llseek,
 };
 
 static const struct file_operations event_fops = {
@@ -590,6 +592,7 @@ static const struct file_operations event_fops = {
         .release =      event_file_close,
         .read =         event_file_read,
         .write =        event_file_write,
+        .llseek =       generic_file_llseek,
 };
 
 static const struct file_operations r_heartbeat_fops = {
@@ -597,6 +600,7 @@ static const struct file_operations r_heartbeat_fops = {
         .release =      r_heartbeat_file_close,
         .read =         r_heartbeat_file_read,
         .write =        r_heartbeat_file_write,
+        .llseek =       generic_file_llseek,
 };
 
 static const struct file_operations remote_settings_fops = {
@@ -604,6 +608,7 @@ static const struct file_operations remote_settings_fops = {
         .release =      remote_settings_file_close,
         .read =         remote_settings_file_read,
         .write =        remote_settings_file_write,
+        .llseek =       generic_file_llseek,
 };
 
 
diff --git a/drivers/misc/ibmasm/module.c b/drivers/misc/ibmasm/module.c
index dc14b0b9cbfa..a234d965243b 100644
--- a/drivers/misc/ibmasm/module.c
+++ b/drivers/misc/ibmasm/module.c
@@ -52,6 +52,7 @@
 
 #include <linux/pci.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include "ibmasm.h"
 #include "lowlevel.h"
 #include "remote.h"
diff --git a/drivers/misc/ibmasm/r_heartbeat.c b/drivers/misc/ibmasm/r_heartbeat.c
index bec9e2c44bef..2de487ac788c 100644
--- a/drivers/misc/ibmasm/r_heartbeat.c
+++ b/drivers/misc/ibmasm/r_heartbeat.c
@@ -20,6 +20,7 @@
  *
  */
 
+#include <linux/sched.h>
 #include "ibmasm.h"
 #include "dot_command.h"
 
diff --git a/drivers/misc/ics932s401.c b/drivers/misc/ics932s401.c
index 6e43ab4231ae..152e9d93eecb 100644
--- a/drivers/misc/ics932s401.c
+++ b/drivers/misc/ics932s401.c
@@ -26,13 +26,11 @@
 #include <linux/mutex.h>
 #include <linux/delay.h>
 #include <linux/log2.h>
+#include <linux/slab.h>
 
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x69, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(ics932s401);
-
 /* ICS932S401 registers */
 #define ICS932S401_REG_CFG2                     0x01
 #define         ICS932S401_CFG1_SPREAD          0x01
@@ -106,12 +104,12 @@ struct ics932s401_data {
 
 static int ics932s401_probe(struct i2c_client *client,
                          const struct i2c_device_id *id);
-static int ics932s401_detect(struct i2c_client *client, int kind,
+static int ics932s401_detect(struct i2c_client *client,
                           struct i2c_board_info *info);
 static int ics932s401_remove(struct i2c_client *client);
 
 static const struct i2c_device_id ics932s401_id[] = {
-        { "ics932s401", ics932s401 },
+        { "ics932s401", 0 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, ics932s401_id);
@@ -125,7 +123,7 @@ static struct i2c_driver ics932s401_driver = {
         .remove         = ics932s401_remove,
         .id_table       = ics932s401_id,
         .detect         = ics932s401_detect,
-        .address_data   = &addr_data,
+        .address_list   = normal_i2c,
 };
 
 static struct ics932s401_data *ics932s401_update_device(struct device *dev)
@@ -413,36 +411,29 @@ static ssize_t show_spread(struct device *dev,
 }
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int ics932s401_detect(struct i2c_client *client, int kind,
+static int ics932s401_detect(struct i2c_client *client,
                           struct i2c_board_info *info)
 {
         struct i2c_adapter *adapter = client->adapter;
+        int vendor, device, revision;
 
         if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
                 return -ENODEV;
 
-        if (kind <= 0) {
-                int vendor, device, revision;
-
-                vendor = i2c_smbus_read_word_data(client,
-                                                  ICS932S401_REG_VENDOR_REV);
-                vendor >>= 8;
-                revision = vendor >> ICS932S401_REV_SHIFT;
-                vendor &= ICS932S401_VENDOR_MASK;
-                if (vendor != ICS932S401_VENDOR)
-                        return -ENODEV;
-
-                device = i2c_smbus_read_word_data(client,
-                                                  ICS932S401_REG_DEVICE);
-                device >>= 8;
-                if (device != ICS932S401_DEVICE)
-                        return -ENODEV;
-
-                if (revision != ICS932S401_REV)
-                        dev_info(&adapter->dev, "Unknown revision %d\n",
-                                 revision);
-        } else
-                dev_dbg(&adapter->dev, "detection forced\n");
+        vendor = i2c_smbus_read_word_data(client, ICS932S401_REG_VENDOR_REV);
+        vendor >>= 8;
+        revision = vendor >> ICS932S401_REV_SHIFT;
+        vendor &= ICS932S401_VENDOR_MASK;
+        if (vendor != ICS932S401_VENDOR)
+                return -ENODEV;
+
+        device = i2c_smbus_read_word_data(client, ICS932S401_REG_DEVICE);
+        device >>= 8;
+        if (device != ICS932S401_DEVICE)
+                return -ENODEV;
+
+        if (revision != ICS932S401_REV)
+                dev_info(&adapter->dev, "Unknown revision %d\n", revision);
 
         strlcpy(info->type, "ics932s401", I2C_NAME_SIZE);
 
diff --git a/drivers/misc/ioc4.c b/drivers/misc/ioc4.c
index 60b0b1a4fb3a..668d41e594a9 100644
--- a/drivers/misc/ioc4.c
+++ b/drivers/misc/ioc4.c
@@ -30,6 +30,7 @@
 #include <linux/pci.h>
 #include <linux/ioc4.h>
 #include <linux/ktime.h>
+#include <linux/slab.h>
 #include <linux/mutex.h>
 #include <linux/time.h>
 #include <asm/io.h>
@@ -138,7 +139,7 @@ ioc4_unregister_submodule(struct ioc4_submodule *is)
  * even though the following code utilizes external interrupt registers
  * to perform the speed calculation.
  */
-static void
+static void __devinit
 ioc4_clock_calibrate(struct ioc4_driver_data *idd)
 {
         union ioc4_int_out int_out;
@@ -230,7 +231,7 @@ ioc4_clock_calibrate(struct ioc4_driver_data *idd)
  * on the same PCI bus at slot number 3 to differentiate IO9 from IO10.
  * If neither is present, it's a PCI-RT.
  */
-static unsigned int
+static unsigned int __devinit
 ioc4_variant(struct ioc4_driver_data *idd)
 {
         struct pci_dev *pdev = NULL;
@@ -269,18 +270,16 @@ ioc4_variant(struct ioc4_driver_data *idd)
         return IOC4_VARIANT_PCI_RT;
 }
 
-static void
+static void __devinit
 ioc4_load_modules(struct work_struct *work)
 {
-        /* arg just has to be freed */
-
         request_module("sgiioc4");
-
-        kfree(work);
 }
 
+static DECLARE_WORK(ioc4_load_modules_work, ioc4_load_modules);
+
 /* Adds a new instance of an IOC4 card */
-static int
+static int __devinit
 ioc4_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
 {
         struct ioc4_driver_data *idd;
@@ -395,21 +394,12 @@ ioc4_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
          * PCI device.
          */
         if (idd->idd_variant != IOC4_VARIANT_PCI_RT) {
-                struct work_struct *work;
-                work = kzalloc(sizeof(struct work_struct), GFP_KERNEL);
-                if (!work) {
-                        printk(KERN_WARNING
-                               "%s: IOC4 unable to allocate memory for "
-                               "load of sub-modules.\n", __func__);
-                } else {
-                        /* Request the module from a work procedure as the
-                         * modprobe goes out to a userland helper and that
-                         * will hang if done directly from ioc4_probe().
-                         */
-                        printk(KERN_INFO "IOC4 loading sgiioc4 submodule\n");
-                        INIT_WORK(work, ioc4_load_modules);
-                        schedule_work(work);
-                }
+                /* Request the module from a work procedure as the modprobe
+                 * goes out to a userland helper and that will hang if done
+                 * directly from ioc4_probe().
+                 */
+                printk(KERN_INFO "IOC4 loading sgiioc4 submodule\n");
+                schedule_work(&ioc4_load_modules_work);
         }
 
         return 0;
@@ -425,7 +415,7 @@ out:
 }
 
 /* Removes a particular instance of an IOC4 card. */
-static void
+static void __devexit
 ioc4_remove(struct pci_dev *pdev)
 {
         struct ioc4_submodule *is;
@@ -476,7 +466,7 @@ static struct pci_driver ioc4_driver = {
         .name = "IOC4",
         .id_table = ioc4_id_table,
         .probe = ioc4_probe,
-        .remove = ioc4_remove,
+        .remove = __devexit_p(ioc4_remove),
 };
 
 MODULE_DEVICE_TABLE(pci, ioc4_id_table);
@@ -486,18 +476,18 @@ MODULE_DEVICE_TABLE(pci, ioc4_id_table);
  *********************/
 
 /* Module load */
-static int __devinit
+static int __init
 ioc4_init(void)
 {
         return pci_register_driver(&ioc4_driver);
 }
 
 /* Module unload */
-static void __devexit
+static void __exit
 ioc4_exit(void)
 {
         /* Ensure ioc4_load_modules() has completed before exiting */
-        flush_scheduled_work();
+        flush_work_sync(&ioc4_load_modules_work);
         pci_unregister_driver(&ioc4_driver);
 }
 
diff --git a/drivers/misc/isl29020.c b/drivers/misc/isl29020.c
new file mode 100644
index 000000000000..307aada5fffe
--- /dev/null
+++ b/drivers/misc/isl29020.c
@@ -0,0 +1,248 @@
+/*
+ * isl29020.c - Intersil  ALS Driver
+ *
+ * Copyright (C) 2008 Intel Corp
+ *
+ *  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ * Data sheet at: http://www.intersil.com/data/fn/fn6505.pdf
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/err.h>
+#include <linux/delay.h>
+#include <linux/sysfs.h>
+#include <linux/pm_runtime.h>
+
+static DEFINE_MUTEX(mutex);
+
+static ssize_t als_sensing_range_show(struct device *dev,
+                        struct device_attribute *attr,  char *buf)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        int  val;
+
+        val = i2c_smbus_read_byte_data(client, 0x00);
+
+        if (val < 0)
+                return val;
+        return sprintf(buf, "%d000\n", 1 << (2 * (val & 3)));
+
+}
+
+static ssize_t als_lux_input_data_show(struct device *dev,
+                        struct device_attribute *attr, char *buf)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        int ret_val, val;
+        unsigned long int lux;
+        int temp;
+
+        pm_runtime_get_sync(dev);
+        msleep(100);
+
+        mutex_lock(&mutex);
+        temp = i2c_smbus_read_byte_data(client, 0x02); /* MSB data */
+        if (temp < 0) {
+                pm_runtime_put_sync(dev);
+                mutex_unlock(&mutex);
+                return temp;
+        }
+
+        ret_val = i2c_smbus_read_byte_data(client, 0x01); /* LSB data */
+        mutex_unlock(&mutex);
+
+        if (ret_val < 0) {
+                pm_runtime_put_sync(dev);
+                return ret_val;
+        }
+
+        ret_val |= temp << 8;
+        val = i2c_smbus_read_byte_data(client, 0x00);
+        pm_runtime_put_sync(dev);
+        if (val < 0)
+                return val;
+        lux = ((((1 << (2 * (val & 3))))*1000) * ret_val) / 65536;
+        return sprintf(buf, "%ld\n", lux);
+}
+
+static ssize_t als_sensing_range_store(struct device *dev,
+                struct device_attribute *attr, const  char *buf, size_t count)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        int ret_val;
+        unsigned long val;
+
+        if (strict_strtoul(buf, 10, &val))
+                return -EINVAL;
+        if (val < 1 || val > 64000)
+                return -EINVAL;
+
+        /* Pick the smallest sensor range that will meet our requirements */
+        if (val <= 1000)
+                val = 1;
+        else if (val <= 4000)
+                val = 2;
+        else if (val <= 16000)
+                val = 3;
+        else
+                val = 4;
+
+        ret_val = i2c_smbus_read_byte_data(client, 0x00);
+        if (ret_val < 0)
+                return ret_val;
+
+        ret_val &= 0xFC; /*reset the bit before setting them */
+        ret_val |= val - 1;
+        ret_val = i2c_smbus_write_byte_data(client, 0x00, ret_val);
+
+        if (ret_val < 0)
+                return ret_val;
+        return count;
+}
+
+static void als_set_power_state(struct i2c_client *client, int enable)
+{
+        int ret_val;
+
+        ret_val = i2c_smbus_read_byte_data(client, 0x00);
+        if (ret_val < 0)
+                return;
+
+        if (enable)
+                ret_val |= 0x80;
+        else
+                ret_val &= 0x7F;
+
+        i2c_smbus_write_byte_data(client, 0x00, ret_val);
+}
+
+static DEVICE_ATTR(lux0_sensor_range, S_IRUGO | S_IWUSR,
+        als_sensing_range_show, als_sensing_range_store);
+static DEVICE_ATTR(lux0_input, S_IRUGO, als_lux_input_data_show, NULL);
+
+static struct attribute *mid_att_als[] = {
+        &dev_attr_lux0_sensor_range.attr,
+        &dev_attr_lux0_input.attr,
+        NULL
+};
+
+static struct attribute_group m_als_gr = {
+        .name = "isl29020",
+        .attrs = mid_att_als
+};
+
+static int als_set_default_config(struct i2c_client *client)
+{
+        int retval;
+
+        retval = i2c_smbus_write_byte_data(client, 0x00, 0xc0);
+        if (retval < 0) {
+                dev_err(&client->dev, "default write failed.");
+                return retval;
+        }
+        return 0;;
+}
+
+static int  isl29020_probe(struct i2c_client *client,
+                                        const struct i2c_device_id *id)
+{
+        int res;
+
+        res = als_set_default_config(client);
+        if (res <  0)
+                return res;
+
+        res = sysfs_create_group(&client->dev.kobj, &m_als_gr);
+        if (res) {
+                dev_err(&client->dev, "isl29020: device create file failed\n");
+                return res;
+        }
+        dev_info(&client->dev, "%s isl29020: ALS chip found\n", client->name);
+        als_set_power_state(client, 0);
+        pm_runtime_enable(&client->dev);
+        return res;
+}
+
+static int isl29020_remove(struct i2c_client *client)
+{
+        sysfs_remove_group(&client->dev.kobj, &m_als_gr);
+        return 0;
+}
+
+static struct i2c_device_id isl29020_id[] = {
+        { "isl29020", 0 },
+        { }
+};
+
+MODULE_DEVICE_TABLE(i2c, isl29020_id);
+
+#ifdef CONFIG_PM
+
+static int isl29020_runtime_suspend(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        als_set_power_state(client, 0);
+        return 0;
+}
+
+static int isl29020_runtime_resume(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        als_set_power_state(client, 1);
+        return 0;
+}
+
+static const struct dev_pm_ops isl29020_pm_ops = {
+        .runtime_suspend = isl29020_runtime_suspend,
+        .runtime_resume = isl29020_runtime_resume,
+};
+
+#define ISL29020_PM_OPS (&isl29020_pm_ops)
+#else   /* CONFIG_PM */
+#define ISL29020_PM_OPS NULL
+#endif  /* CONFIG_PM */
+
+static struct i2c_driver isl29020_driver = {
+        .driver = {
+                .name = "isl29020",
+                .pm = ISL29020_PM_OPS,
+        },
+        .probe = isl29020_probe,
+        .remove = isl29020_remove,
+        .id_table = isl29020_id,
+};
+
+static int __init sensor_isl29020_init(void)
+{
+        return i2c_add_driver(&isl29020_driver);
+}
+
+static void  __exit sensor_isl29020_exit(void)
+{
+        i2c_del_driver(&isl29020_driver);
+}
+
+module_init(sensor_isl29020_init);
+module_exit(sensor_isl29020_exit);
+
+MODULE_AUTHOR("Kalhan Trisal <kalhan.trisal@intel.com>");
+MODULE_DESCRIPTION("Intersil isl29020 ALS Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/misc/iwmc3200top/Kconfig b/drivers/misc/iwmc3200top/Kconfig
new file mode 100644
index 000000000000..9e4b88fb57f1
--- /dev/null
+++ b/drivers/misc/iwmc3200top/Kconfig
@@ -0,0 +1,20 @@
+config IWMC3200TOP
+        tristate "Intel Wireless MultiCom Top Driver"
+        depends on MMC && EXPERIMENTAL
+        select FW_LOADER
+        ---help---
+          Intel Wireless MultiCom 3200 Top driver is responsible for
+          for firmware load and enabled coms enumeration
+
+config IWMC3200TOP_DEBUG
+        bool "Enable full debug output of iwmc3200top Driver"
+        depends on IWMC3200TOP
+        ---help---
+          Enable full debug output of iwmc3200top Driver
+
+config IWMC3200TOP_DEBUGFS
+        bool "Enable Debugfs debugging interface for iwmc3200top"
+        depends on IWMC3200TOP
+        ---help---
+          Enable creation of debugfs files for iwmc3200top
+
diff --git a/drivers/misc/iwmc3200top/Makefile b/drivers/misc/iwmc3200top/Makefile
new file mode 100644
index 000000000000..fbf53fb4634e
--- /dev/null
+++ b/drivers/misc/iwmc3200top/Makefile
@@ -0,0 +1,29 @@
+# iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+# drivers/misc/iwmc3200top/Makefile
+#
+# Copyright (C) 2009 Intel Corporation. All rights reserved.
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version
+# 2 as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+# 02110-1301, USA.
+#
+#
+# Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+#  -
+#
+#
+
+obj-$(CONFIG_IWMC3200TOP)       += iwmc3200top.o
+iwmc3200top-objs        := main.o fw-download.o
+iwmc3200top-$(CONFIG_IWMC3200TOP_DEBUG) += log.o
+iwmc3200top-$(CONFIG_IWMC3200TOP_DEBUGFS) += debugfs.o
diff --git a/drivers/misc/iwmc3200top/debugfs.c b/drivers/misc/iwmc3200top/debugfs.c
new file mode 100644
index 000000000000..62fbaec48207
--- /dev/null
+++ b/drivers/misc/iwmc3200top/debugfs.c
@@ -0,0 +1,137 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/debufs.c
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/ctype.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio.h>
+#include <linux/debugfs.h>
+
+#include "iwmc3200top.h"
+#include "fw-msg.h"
+#include "log.h"
+#include "debugfs.h"
+
+
+
+/*      Constants definition        */
+#define HEXADECIMAL_RADIX       16
+
+/*      Functions definition        */
+
+
+#define DEBUGFS_ADD(name, parent) do {                                  \
+        dbgfs->dbgfs_##parent##_files.file_##name =                     \
+        debugfs_create_file(#name, 0644, dbgfs->dir_##parent, priv,     \
+                                &iwmct_dbgfs_##name##_ops);             \
+} while (0)
+
+#define DEBUGFS_RM(name)  do {          \
+        debugfs_remove(name);           \
+        name = NULL;                    \
+} while (0)
+
+#define DEBUGFS_READ_FUNC(name)                                         \
+ssize_t iwmct_dbgfs_##name##_read(struct file *file,                    \
+                                  char __user *user_buf,                \
+                                  size_t count, loff_t *ppos);
+
+#define DEBUGFS_WRITE_FUNC(name)                                        \
+ssize_t iwmct_dbgfs_##name##_write(struct file *file,                   \
+                                   const char __user *user_buf,         \
+                                   size_t count, loff_t *ppos);
+
+#define DEBUGFS_READ_FILE_OPS(name)                                     \
+        DEBUGFS_READ_FUNC(name)                                         \
+        static const struct file_operations iwmct_dbgfs_##name##_ops = {  \
+                .read = iwmct_dbgfs_##name##_read,                      \
+                .open = iwmct_dbgfs_open_file_generic,                  \
+                .llseek = generic_file_llseek,                          \
+        };
+
+#define DEBUGFS_WRITE_FILE_OPS(name)                                    \
+        DEBUGFS_WRITE_FUNC(name)                                        \
+        static const struct file_operations iwmct_dbgfs_##name##_ops = {  \
+                .write = iwmct_dbgfs_##name##_write,                    \
+                .open = iwmct_dbgfs_open_file_generic,                  \
+                .llseek = generic_file_llseek,                          \
+        };
+
+#define DEBUGFS_READ_WRITE_FILE_OPS(name)                               \
+        DEBUGFS_READ_FUNC(name)                                         \
+        DEBUGFS_WRITE_FUNC(name)                                        \
+        static const struct file_operations iwmct_dbgfs_##name##_ops = {\
+                .write = iwmct_dbgfs_##name##_write,                    \
+                .read = iwmct_dbgfs_##name##_read,                      \
+                .open = iwmct_dbgfs_open_file_generic,                  \
+                .llseek = generic_file_llseek,                          \
+        };
+
+
+/*      Debugfs file ops definitions        */
+
+/*
+ * Create the debugfs files and directories
+ *
+ */
+void iwmct_dbgfs_register(struct iwmct_priv *priv, const char *name)
+{
+        struct iwmct_debugfs *dbgfs;
+
+        dbgfs = kzalloc(sizeof(struct iwmct_debugfs), GFP_KERNEL);
+        if (!dbgfs) {
+                LOG_ERROR(priv, DEBUGFS, "failed to allocate %zd bytes\n",
+                                        sizeof(struct iwmct_debugfs));
+                return;
+        }
+
+        priv->dbgfs = dbgfs;
+        dbgfs->name = name;
+        dbgfs->dir_drv = debugfs_create_dir(name, NULL);
+        if (!dbgfs->dir_drv) {
+                LOG_ERROR(priv, DEBUGFS, "failed to create debugfs dir\n");
+                return;
+        }
+
+        return;
+}
+
+/**
+ * Remove the debugfs files and directories
+ *
+ */
+void iwmct_dbgfs_unregister(struct iwmct_debugfs *dbgfs)
+{
+        if (!dbgfs)
+                return;
+
+        DEBUGFS_RM(dbgfs->dir_drv);
+        kfree(dbgfs);
+        dbgfs = NULL;
+}
+
diff --git a/drivers/misc/iwmc3200top/debugfs.h b/drivers/misc/iwmc3200top/debugfs.h
new file mode 100644
index 000000000000..71d45759b40f
--- /dev/null
+++ b/drivers/misc/iwmc3200top/debugfs.h
@@ -0,0 +1,58 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/debufs.h
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#ifndef __DEBUGFS_H__
+#define __DEBUGFS_H__
+
+
+#ifdef CONFIG_IWMC3200TOP_DEBUGFS
+
+struct iwmct_debugfs {
+        const char *name;
+        struct dentry *dir_drv;
+        struct dir_drv_files {
+        } dbgfs_drv_files;
+};
+
+void iwmct_dbgfs_register(struct iwmct_priv *priv, const char *name);
+void iwmct_dbgfs_unregister(struct iwmct_debugfs *dbgfs);
+
+#else /* CONFIG_IWMC3200TOP_DEBUGFS */
+
+struct iwmct_debugfs;
+
+static inline void
+iwmct_dbgfs_register(struct iwmct_priv *priv, const char *name)
+{}
+
+static inline void
+iwmct_dbgfs_unregister(struct iwmct_debugfs *dbgfs)
+{}
+
+#endif /* CONFIG_IWMC3200TOP_DEBUGFS */
+
+#endif /* __DEBUGFS_H__ */
+
diff --git a/drivers/misc/iwmc3200top/fw-download.c b/drivers/misc/iwmc3200top/fw-download.c
new file mode 100644
index 000000000000..e27afde6e99f
--- /dev/null
+++ b/drivers/misc/iwmc3200top/fw-download.c
@@ -0,0 +1,358 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/fw-download.c
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#include <linux/firmware.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/slab.h>
+#include <asm/unaligned.h>
+
+#include "iwmc3200top.h"
+#include "log.h"
+#include "fw-msg.h"
+
+#define CHECKSUM_BYTES_NUM sizeof(u32)
+
+/**
+  init parser struct with file
+ */
+static int iwmct_fw_parser_init(struct iwmct_priv *priv, const u8 *file,
+                              size_t file_size, size_t block_size)
+{
+        struct iwmct_parser *parser = &priv->parser;
+        struct iwmct_fw_hdr *fw_hdr = &parser->versions;
+
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
+
+        LOG_INFO(priv, FW_DOWNLOAD, "file_size=%zd\n", file_size);
+
+        parser->file = file;
+        parser->file_size = file_size;
+        parser->cur_pos = 0;
+        parser->entry_point = 0;
+        parser->buf = kzalloc(block_size, GFP_KERNEL);
+        if (!parser->buf) {
+                LOG_ERROR(priv, FW_DOWNLOAD, "kzalloc error\n");
+                return -ENOMEM;
+        }
+        parser->buf_size = block_size;
+
+        /* extract fw versions */
+        memcpy(fw_hdr, parser->file, sizeof(struct iwmct_fw_hdr));
+        LOG_INFO(priv, FW_DOWNLOAD, "fw versions are:\n"
+                "top %u.%u.%u gps %u.%u.%u bt %u.%u.%u tic %s\n",
+                fw_hdr->top_major, fw_hdr->top_minor, fw_hdr->top_revision,
+                fw_hdr->gps_major, fw_hdr->gps_minor, fw_hdr->gps_revision,
+                fw_hdr->bt_major, fw_hdr->bt_minor, fw_hdr->bt_revision,
+                fw_hdr->tic_name);
+
+        parser->cur_pos += sizeof(struct iwmct_fw_hdr);
+
+        LOG_TRACE(priv, FW_DOWNLOAD, "<--\n");
+        return 0;
+}
+
+static bool iwmct_checksum(struct iwmct_priv *priv)
+{
+        struct iwmct_parser *parser = &priv->parser;
+        __le32 *file = (__le32 *)parser->file;
+        int i, pad, steps;
+        u32 accum = 0;
+        u32 checksum;
+        u32 mask = 0xffffffff;
+
+        pad = (parser->file_size - CHECKSUM_BYTES_NUM) % 4;
+        steps =  (parser->file_size - CHECKSUM_BYTES_NUM) / 4;
+
+        LOG_INFO(priv, FW_DOWNLOAD, "pad=%d steps=%d\n", pad, steps);
+
+        for (i = 0; i < steps; i++)
+                accum += le32_to_cpu(file[i]);
+
+        if (pad) {
+                mask <<= 8 * (4 - pad);
+                accum += le32_to_cpu(file[steps]) & mask;
+        }
+
+        checksum = get_unaligned_le32((__le32 *)(parser->file +
+                        parser->file_size - CHECKSUM_BYTES_NUM));
+
+        LOG_INFO(priv, FW_DOWNLOAD,
+                "compare checksum accum=0x%x to checksum=0x%x\n",
+                accum, checksum);
+
+        return checksum == accum;
+}
+
+static int iwmct_parse_next_section(struct iwmct_priv *priv, const u8 **p_sec,
+                                  size_t *sec_size, __le32 *sec_addr)
+{
+        struct iwmct_parser *parser = &priv->parser;
+        struct iwmct_dbg *dbg = &priv->dbg;
+        struct iwmct_fw_sec_hdr *sec_hdr;
+
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
+
+        while (parser->cur_pos + sizeof(struct iwmct_fw_sec_hdr)
+                <= parser->file_size) {
+
+                sec_hdr = (struct iwmct_fw_sec_hdr *)
+                                (parser->file + parser->cur_pos);
+                parser->cur_pos += sizeof(struct iwmct_fw_sec_hdr);
+
+                LOG_INFO(priv, FW_DOWNLOAD,
+                        "sec hdr: type=%s addr=0x%x size=%d\n",
+                        sec_hdr->type, sec_hdr->target_addr,
+                        sec_hdr->data_size);
+
+                if (strcmp(sec_hdr->type, "ENT") == 0)
+                        parser->entry_point = le32_to_cpu(sec_hdr->target_addr);
+                else if (strcmp(sec_hdr->type, "LBL") == 0)
+                        strcpy(dbg->label_fw, parser->file + parser->cur_pos);
+                else if (((strcmp(sec_hdr->type, "TOP") == 0) &&
+                          (priv->barker & BARKER_DNLOAD_TOP_MSK)) ||
+                         ((strcmp(sec_hdr->type, "GPS") == 0) &&
+                          (priv->barker & BARKER_DNLOAD_GPS_MSK)) ||
+                         ((strcmp(sec_hdr->type, "BTH") == 0) &&
+                          (priv->barker & BARKER_DNLOAD_BT_MSK))) {
+                        *sec_addr = sec_hdr->target_addr;
+                        *sec_size = le32_to_cpu(sec_hdr->data_size);
+                        *p_sec = parser->file + parser->cur_pos;
+                        parser->cur_pos += le32_to_cpu(sec_hdr->data_size);
+                        return 1;
+                } else if (strcmp(sec_hdr->type, "LOG") != 0)
+                        LOG_WARNING(priv, FW_DOWNLOAD,
+                                    "skipping section type %s\n",
+                                    sec_hdr->type);
+
+                parser->cur_pos += le32_to_cpu(sec_hdr->data_size);
+                LOG_INFO(priv, FW_DOWNLOAD,
+                        "finished with section cur_pos=%zd\n", parser->cur_pos);
+        }
+
+        LOG_TRACE(priv, INIT, "<--\n");
+        return 0;
+}
+
+static int iwmct_download_section(struct iwmct_priv *priv, const u8 *p_sec,
+                                size_t sec_size, __le32 addr)
+{
+        struct iwmct_parser *parser = &priv->parser;
+        struct iwmct_fw_load_hdr *hdr = (struct iwmct_fw_load_hdr *)parser->buf;
+        const u8 *cur_block = p_sec;
+        size_t sent = 0;
+        int cnt = 0;
+        int ret = 0;
+        u32 cmd = 0;
+
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
+        LOG_INFO(priv, FW_DOWNLOAD, "Download address 0x%x size 0x%zx\n",
+                                addr, sec_size);
+
+        while (sent < sec_size) {
+                int i;
+                u32 chksm = 0;
+                u32 reset = atomic_read(&priv->reset);
+                /* actual FW data */
+                u32 data_size = min(parser->buf_size - sizeof(*hdr),
+                                    sec_size - sent);
+                /* Pad to block size */
+                u32 trans_size = (data_size + sizeof(*hdr) +
+                                  IWMC_SDIO_BLK_SIZE - 1) &
+                                  ~(IWMC_SDIO_BLK_SIZE - 1);
+                ++cnt;
+
+                /* in case of reset, interrupt FW DOWNLAOD */
+                if (reset) {
+                        LOG_INFO(priv, FW_DOWNLOAD,
+                                 "Reset detected. Abort FW download!!!");
+                        ret = -ECANCELED;
+                        goto exit;
+                }
+
+                memset(parser->buf, 0, parser->buf_size);
+                cmd |= IWMC_OPCODE_WRITE << CMD_HDR_OPCODE_POS;
+                cmd |= IWMC_CMD_SIGNATURE << CMD_HDR_SIGNATURE_POS;
+                cmd |= (priv->dbg.direct ? 1 : 0) << CMD_HDR_DIRECT_ACCESS_POS;
+                cmd |= (priv->dbg.checksum ? 1 : 0) << CMD_HDR_USE_CHECKSUM_POS;
+                hdr->data_size = cpu_to_le32(data_size);
+                hdr->target_addr = addr;
+
+                /* checksum is allowed for sizes divisible by 4 */
+                if (data_size & 0x3)
+                        cmd &= ~CMD_HDR_USE_CHECKSUM_MSK;
+
+                memcpy(hdr->data, cur_block, data_size);
+
+
+                if (cmd & CMD_HDR_USE_CHECKSUM_MSK) {
+
+                        chksm = data_size + le32_to_cpu(addr) + cmd;
+                        for (i = 0; i < data_size >> 2; i++)
+                                chksm += ((u32 *)cur_block)[i];
+
+                        hdr->block_chksm = cpu_to_le32(chksm);
+                        LOG_INFO(priv, FW_DOWNLOAD, "Checksum = 0x%X\n",
+                                 hdr->block_chksm);
+                }
+
+                LOG_INFO(priv, FW_DOWNLOAD, "trans#%d, len=%d, sent=%zd, "
+                                "sec_size=%zd, startAddress 0x%X\n",
+                                cnt, trans_size, sent, sec_size, addr);
+
+                if (priv->dbg.dump)
+                        LOG_HEXDUMP(FW_DOWNLOAD, parser->buf, trans_size);
+
+
+                hdr->cmd = cpu_to_le32(cmd);
+                /* send it down */
+                /* TODO: add more proper sending and error checking */
+                ret = iwmct_tx(priv, parser->buf, trans_size);
+                if (ret != 0) {
+                        LOG_INFO(priv, FW_DOWNLOAD,
+                                "iwmct_tx returned %d\n", ret);
+                        goto exit;
+                }
+
+                addr = cpu_to_le32(le32_to_cpu(addr) + data_size);
+                sent += data_size;
+                cur_block = p_sec + sent;
+
+                if (priv->dbg.blocks && (cnt + 1) >= priv->dbg.blocks) {
+                        LOG_INFO(priv, FW_DOWNLOAD,
+                                "Block number limit is reached [%d]\n",
+                                priv->dbg.blocks);
+                        break;
+                }
+        }
+
+        if (sent < sec_size)
+                ret = -EINVAL;
+exit:
+        LOG_TRACE(priv, FW_DOWNLOAD, "<--\n");
+        return ret;
+}
+
+static int iwmct_kick_fw(struct iwmct_priv *priv, bool jump)
+{
+        struct iwmct_parser *parser = &priv->parser;
+        struct iwmct_fw_load_hdr *hdr = (struct iwmct_fw_load_hdr *)parser->buf;
+        int ret;
+        u32 cmd;
+
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
+
+        memset(parser->buf, 0, parser->buf_size);
+        cmd = IWMC_CMD_SIGNATURE << CMD_HDR_SIGNATURE_POS;
+        if (jump) {
+                cmd |= IWMC_OPCODE_JUMP << CMD_HDR_OPCODE_POS;
+                hdr->target_addr = cpu_to_le32(parser->entry_point);
+                LOG_INFO(priv, FW_DOWNLOAD, "jump address 0x%x\n",
+                                parser->entry_point);
+        } else {
+                cmd |= IWMC_OPCODE_LAST_COMMAND << CMD_HDR_OPCODE_POS;
+                LOG_INFO(priv, FW_DOWNLOAD, "last command\n");
+        }
+
+        hdr->cmd = cpu_to_le32(cmd);
+
+        LOG_HEXDUMP(FW_DOWNLOAD, parser->buf, sizeof(*hdr));
+        /* send it down */
+        /* TODO: add more proper sending and error checking */
+        ret = iwmct_tx(priv, parser->buf, IWMC_SDIO_BLK_SIZE);
+        if (ret)
+                LOG_INFO(priv, FW_DOWNLOAD, "iwmct_tx returned %d", ret);
+
+        LOG_TRACE(priv, FW_DOWNLOAD, "<--\n");
+        return 0;
+}
+
+int iwmct_fw_load(struct iwmct_priv *priv)
+{
+        const u8 *fw_name = FW_NAME(FW_API_VER);
+        const struct firmware *raw;
+        const u8 *pdata;
+        size_t len;
+        __le32 addr;
+        int ret;
+
+
+        LOG_INFO(priv, FW_DOWNLOAD, "barker download request 0x%x is:\n",
+                        priv->barker);
+        LOG_INFO(priv, FW_DOWNLOAD, "*******  Top FW %s requested ********\n",
+                        (priv->barker & BARKER_DNLOAD_TOP_MSK) ? "was" : "not");
+        LOG_INFO(priv, FW_DOWNLOAD, "*******  GPS FW %s requested ********\n",
+                        (priv->barker & BARKER_DNLOAD_GPS_MSK) ? "was" : "not");
+        LOG_INFO(priv, FW_DOWNLOAD, "*******  BT FW %s requested ********\n",
+                        (priv->barker & BARKER_DNLOAD_BT_MSK) ? "was" : "not");
+
+
+        /* get the firmware */
+        ret = request_firmware(&raw, fw_name, &priv->func->dev);
+        if (ret < 0) {
+                LOG_ERROR(priv, FW_DOWNLOAD, "%s request_firmware failed %d\n",
+                          fw_name, ret);
+                goto exit;
+        }
+
+        if (raw->size < sizeof(struct iwmct_fw_sec_hdr)) {
+                LOG_ERROR(priv, FW_DOWNLOAD, "%s smaller then (%zd) (%zd)\n",
+                          fw_name, sizeof(struct iwmct_fw_sec_hdr), raw->size);
+                goto exit;
+        }
+
+        LOG_INFO(priv, FW_DOWNLOAD, "Read firmware '%s'\n", fw_name);
+
+        /* clear parser struct */
+        ret = iwmct_fw_parser_init(priv, raw->data, raw->size, priv->trans_len);
+        if (ret < 0) {
+                LOG_ERROR(priv, FW_DOWNLOAD,
+                          "iwmct_parser_init failed: Reason %d\n", ret);
+                goto exit;
+        }
+
+        if (!iwmct_checksum(priv)) {
+                LOG_ERROR(priv, FW_DOWNLOAD, "checksum error\n");
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        /* download firmware to device */
+        while (iwmct_parse_next_section(priv, &pdata, &len, &addr)) {
+                ret = iwmct_download_section(priv, pdata, len, addr);
+                if (ret) {
+                        LOG_ERROR(priv, FW_DOWNLOAD,
+                                  "%s download section failed\n", fw_name);
+                        goto exit;
+                }
+        }
+
+        ret = iwmct_kick_fw(priv, !!(priv->barker & BARKER_DNLOAD_JUMP_MSK));
+
+exit:
+        kfree(priv->parser.buf);
+        release_firmware(raw);
+        return ret;
+}
diff --git a/drivers/misc/iwmc3200top/fw-msg.h b/drivers/misc/iwmc3200top/fw-msg.h
new file mode 100644
index 000000000000..9e26b75bd482
--- /dev/null
+++ b/drivers/misc/iwmc3200top/fw-msg.h
@@ -0,0 +1,113 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/fw-msg.h
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#ifndef __FWMSG_H__
+#define __FWMSG_H__
+
+#define COMM_TYPE_D2H                   0xFF
+#define COMM_TYPE_H2D                   0xEE
+
+#define COMM_CATEGORY_OPERATIONAL       0x00
+#define COMM_CATEGORY_DEBUG             0x01
+#define COMM_CATEGORY_TESTABILITY       0x02
+#define COMM_CATEGORY_DIAGNOSTICS       0x03
+
+#define OP_DBG_ZSTR_MSG                 cpu_to_le16(0x1A)
+
+#define FW_LOG_SRC_MAX                  32
+#define FW_LOG_SRC_ALL                  255
+
+#define FW_STRING_TABLE_ADDR            cpu_to_le32(0x0C000000)
+
+#define CMD_DBG_LOG_LEVEL               cpu_to_le16(0x0001)
+#define CMD_TST_DEV_RESET               cpu_to_le16(0x0060)
+#define CMD_TST_FUNC_RESET              cpu_to_le16(0x0062)
+#define CMD_TST_IFACE_RESET             cpu_to_le16(0x0064)
+#define CMD_TST_CPU_UTILIZATION         cpu_to_le16(0x0065)
+#define CMD_TST_TOP_DEEP_SLEEP          cpu_to_le16(0x0080)
+#define CMD_TST_WAKEUP                  cpu_to_le16(0x0081)
+#define CMD_TST_FUNC_WAKEUP             cpu_to_le16(0x0082)
+#define CMD_TST_FUNC_DEEP_SLEEP_REQUEST cpu_to_le16(0x0083)
+#define CMD_TST_GET_MEM_DUMP            cpu_to_le16(0x0096)
+
+#define OP_OPR_ALIVE                    cpu_to_le16(0x0010)
+#define OP_OPR_CMD_ACK                  cpu_to_le16(0x001F)
+#define OP_OPR_CMD_NACK                 cpu_to_le16(0x0020)
+#define OP_TST_MEM_DUMP                 cpu_to_le16(0x0043)
+
+#define CMD_FLAG_PADDING_256            0x80
+
+#define FW_HCMD_BLOCK_SIZE              256
+
+struct msg_hdr {
+        u8 type;
+        u8 category;
+        __le16 opcode;
+        u8 seqnum;
+        u8 flags;
+        __le16 length;
+} __attribute__((__packed__));
+
+struct log_hdr {
+        __le32 timestamp;
+        u8 severity;
+        u8 logsource;
+        __le16 reserved;
+} __attribute__((__packed__));
+
+struct mdump_hdr {
+        u8 dmpid;
+        u8 frag;
+        __le16 size;
+        __le32 addr;
+} __attribute__((__packed__));
+
+struct top_msg {
+        struct msg_hdr hdr;
+        union {
+                /* D2H messages */
+                struct {
+                        struct log_hdr log_hdr;
+                        u8 data[1];
+                } __attribute__((__packed__)) log;
+
+                struct {
+                        struct log_hdr log_hdr;
+                        struct mdump_hdr md_hdr;
+                        u8 data[1];
+                } __attribute__((__packed__)) mdump;
+
+                /* H2D messages */
+                struct {
+                        u8 logsource;
+                        u8 sevmask;
+                } __attribute__((__packed__)) logdefs[FW_LOG_SRC_MAX];
+                struct mdump_hdr mdump_req;
+        } u;
+} __attribute__((__packed__));
+
+
+#endif /* __FWMSG_H__ */
diff --git a/drivers/misc/iwmc3200top/iwmc3200top.h b/drivers/misc/iwmc3200top/iwmc3200top.h
new file mode 100644
index 000000000000..740ff0738ea8
--- /dev/null
+++ b/drivers/misc/iwmc3200top/iwmc3200top.h
@@ -0,0 +1,207 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/iwmc3200top.h
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#ifndef __IWMC3200TOP_H__
+#define __IWMC3200TOP_H__
+
+#include <linux/workqueue.h>
+
+#define DRV_NAME "iwmc3200top"
+#define FW_API_VER 1
+#define _FW_NAME(api) DRV_NAME "." #api ".fw"
+#define FW_NAME(api) _FW_NAME(api)
+
+#define IWMC_SDIO_BLK_SIZE                      256
+#define IWMC_DEFAULT_TR_BLK                     64
+#define IWMC_SDIO_DATA_ADDR                     0x0
+#define IWMC_SDIO_INTR_ENABLE_ADDR              0x14
+#define IWMC_SDIO_INTR_STATUS_ADDR              0x13
+#define IWMC_SDIO_INTR_CLEAR_ADDR               0x13
+#define IWMC_SDIO_INTR_GET_SIZE_ADDR            0x2C
+
+#define COMM_HUB_HEADER_LENGTH 16
+#define LOGGER_HEADER_LENGTH   10
+
+
+#define BARKER_DNLOAD_BT_POS            0
+#define BARKER_DNLOAD_BT_MSK            BIT(BARKER_DNLOAD_BT_POS)
+#define BARKER_DNLOAD_GPS_POS           1
+#define BARKER_DNLOAD_GPS_MSK           BIT(BARKER_DNLOAD_GPS_POS)
+#define BARKER_DNLOAD_TOP_POS           2
+#define BARKER_DNLOAD_TOP_MSK           BIT(BARKER_DNLOAD_TOP_POS)
+#define BARKER_DNLOAD_RESERVED1_POS     3
+#define BARKER_DNLOAD_RESERVED1_MSK     BIT(BARKER_DNLOAD_RESERVED1_POS)
+#define BARKER_DNLOAD_JUMP_POS          4
+#define BARKER_DNLOAD_JUMP_MSK          BIT(BARKER_DNLOAD_JUMP_POS)
+#define BARKER_DNLOAD_SYNC_POS          5
+#define BARKER_DNLOAD_SYNC_MSK          BIT(BARKER_DNLOAD_SYNC_POS)
+#define BARKER_DNLOAD_RESERVED2_POS     6
+#define BARKER_DNLOAD_RESERVED2_MSK     (0x3 << BARKER_DNLOAD_RESERVED2_POS)
+#define BARKER_DNLOAD_BARKER_POS        8
+#define BARKER_DNLOAD_BARKER_MSK        (0xffffff << BARKER_DNLOAD_BARKER_POS)
+
+#define IWMC_BARKER_REBOOT      (0xdeadbe << BARKER_DNLOAD_BARKER_POS)
+/* whole field barker */
+#define IWMC_BARKER_ACK         0xfeedbabe
+
+#define IWMC_CMD_SIGNATURE      0xcbbc
+
+#define CMD_HDR_OPCODE_POS              0
+#define CMD_HDR_OPCODE_MSK_MSK          (0xf << CMD_HDR_OPCODE_MSK_POS)
+#define CMD_HDR_RESPONSE_CODE_POS       4
+#define CMD_HDR_RESPONSE_CODE_MSK       (0xf << CMD_HDR_RESPONSE_CODE_POS)
+#define CMD_HDR_USE_CHECKSUM_POS        8
+#define CMD_HDR_USE_CHECKSUM_MSK        BIT(CMD_HDR_USE_CHECKSUM_POS)
+#define CMD_HDR_RESPONSE_REQUIRED_POS   9
+#define CMD_HDR_RESPONSE_REQUIRED_MSK   BIT(CMD_HDR_RESPONSE_REQUIRED_POS)
+#define CMD_HDR_DIRECT_ACCESS_POS       10
+#define CMD_HDR_DIRECT_ACCESS_MSK       BIT(CMD_HDR_DIRECT_ACCESS_POS)
+#define CMD_HDR_RESERVED_POS            11
+#define CMD_HDR_RESERVED_MSK            BIT(0x1f << CMD_HDR_RESERVED_POS)
+#define CMD_HDR_SIGNATURE_POS           16
+#define CMD_HDR_SIGNATURE_MSK           BIT(0xffff << CMD_HDR_SIGNATURE_POS)
+
+enum {
+        IWMC_OPCODE_PING = 0,
+        IWMC_OPCODE_READ = 1,
+        IWMC_OPCODE_WRITE = 2,
+        IWMC_OPCODE_JUMP = 3,
+        IWMC_OPCODE_REBOOT = 4,
+        IWMC_OPCODE_PERSISTENT_WRITE = 5,
+        IWMC_OPCODE_PERSISTENT_READ = 6,
+        IWMC_OPCODE_READ_MODIFY_WRITE = 7,
+        IWMC_OPCODE_LAST_COMMAND = 15
+};
+
+struct iwmct_fw_load_hdr {
+        __le32 cmd;
+        __le32 target_addr;
+        __le32 data_size;
+        __le32 block_chksm;
+        u8 data[0];
+};
+
+/**
+ * struct iwmct_fw_hdr
+ * holds all sw components versions
+ */
+struct iwmct_fw_hdr {
+        u8 top_major;
+        u8 top_minor;
+        u8 top_revision;
+        u8 gps_major;
+        u8 gps_minor;
+        u8 gps_revision;
+        u8 bt_major;
+        u8 bt_minor;
+        u8 bt_revision;
+        u8 tic_name[31];
+};
+
+/**
+ * struct iwmct_fw_sec_hdr
+ * @type: function type
+ * @data_size: section's data size
+ * @target_addr: download address
+ */
+struct iwmct_fw_sec_hdr {
+        u8 type[4];
+        __le32 data_size;
+        __le32 target_addr;
+};
+
+/**
+ * struct iwmct_parser
+ * @file: fw image
+ * @file_size: fw size
+ * @cur_pos: position in file
+ * @buf: temp buf for download
+ * @buf_size: size of buf
+ * @entry_point: address to jump in fw kick-off
+ */
+struct iwmct_parser {
+        const u8 *file;
+        size_t file_size;
+        size_t cur_pos;
+        u8 *buf;
+        size_t buf_size;
+        u32 entry_point;
+        struct iwmct_fw_hdr versions;
+};
+
+
+struct iwmct_work_struct {
+        struct list_head list;
+        ssize_t iosize;
+};
+
+struct iwmct_dbg {
+        int blocks;
+        bool dump;
+        bool jump;
+        bool direct;
+        bool checksum;
+        bool fw_download;
+        int block_size;
+        int download_trans_blks;
+
+        char label_fw[256];
+};
+
+struct iwmct_debugfs;
+
+struct iwmct_priv {
+        struct sdio_func *func;
+        struct iwmct_debugfs *dbgfs;
+        struct iwmct_parser parser;
+        atomic_t reset;
+        atomic_t dev_sync;
+        u32 trans_len;
+        u32 barker;
+        struct iwmct_dbg dbg;
+
+        /* drivers work queue */
+        struct workqueue_struct *wq;
+        struct workqueue_struct *bus_rescan_wq;
+        struct work_struct bus_rescan_worker;
+        struct work_struct isr_worker;
+
+        /* drivers wait queue */
+        wait_queue_head_t wait_q;
+
+        /* rx request list */
+        struct list_head read_req_list;
+};
+
+extern int iwmct_tx(struct iwmct_priv *priv, void *src, int count);
+extern int iwmct_fw_load(struct iwmct_priv *priv);
+
+extern void iwmct_dbg_init_params(struct iwmct_priv *drv);
+extern void iwmct_dbg_init_drv_attrs(struct device_driver *drv);
+extern void iwmct_dbg_remove_drv_attrs(struct device_driver *drv);
+extern int iwmct_send_hcmd(struct iwmct_priv *priv, u8 *cmd, u16 len);
+
+#endif  /*  __IWMC3200TOP_H__  */
diff --git a/drivers/misc/iwmc3200top/log.c b/drivers/misc/iwmc3200top/log.c
new file mode 100644
index 000000000000..a36a55a49cac
--- /dev/null
+++ b/drivers/misc/iwmc3200top/log.c
@@ -0,0 +1,348 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/log.c
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/slab.h>
+#include <linux/ctype.h>
+#include "fw-msg.h"
+#include "iwmc3200top.h"
+#include "log.h"
+
+/* Maximal hexadecimal string size of the FW memdump message */
+#define LOG_MSG_SIZE_MAX                12400
+
+/* iwmct_logdefs is a global used by log macros */
+u8 iwmct_logdefs[LOG_SRC_MAX];
+static u8 iwmct_fw_logdefs[FW_LOG_SRC_MAX];
+
+
+static int _log_set_log_filter(u8 *logdefs, int size, u8 src, u8 logmask)
+{
+        int i;
+
+        if (src < size)
+                logdefs[src] = logmask;
+        else if (src == LOG_SRC_ALL)
+                for (i = 0; i < size; i++)
+                        logdefs[i] = logmask;
+        else
+                return -1;
+
+        return 0;
+}
+
+
+int iwmct_log_set_filter(u8 src, u8 logmask)
+{
+        return _log_set_log_filter(iwmct_logdefs, LOG_SRC_MAX, src, logmask);
+}
+
+
+int iwmct_log_set_fw_filter(u8 src, u8 logmask)
+{
+        return _log_set_log_filter(iwmct_fw_logdefs,
+                                   FW_LOG_SRC_MAX, src, logmask);
+}
+
+
+static int log_msg_format_hex(char *str, int slen, u8 *ibuf,
+                              int ilen, char *pref)
+{
+        int pos = 0;
+        int i;
+        int len;
+
+        for (pos = 0, i = 0; pos < slen - 2 && pref[i] != '\0'; i++, pos++)
+                str[pos] = pref[i];
+
+        for (i = 0; pos < slen - 2 && i < ilen; pos += len, i++)
+                len = snprintf(&str[pos], slen - pos - 1, " %2.2X", ibuf[i]);
+
+        if (i < ilen)
+                return -1;
+
+        return 0;
+}
+
+/*      NOTE: This function is not thread safe.
+        Currently it's called only from sdio rx worker - no race there
+*/
+void iwmct_log_top_message(struct iwmct_priv *priv, u8 *buf, int len)
+{
+        struct top_msg *msg;
+        static char logbuf[LOG_MSG_SIZE_MAX];
+
+        msg = (struct top_msg *)buf;
+
+        if (len < sizeof(msg->hdr) + sizeof(msg->u.log.log_hdr)) {
+                LOG_ERROR(priv, FW_MSG, "Log message from TOP "
+                          "is too short %d (expected %zd)\n",
+                          len, sizeof(msg->hdr) + sizeof(msg->u.log.log_hdr));
+                return;
+        }
+
+        if (!(iwmct_fw_logdefs[msg->u.log.log_hdr.logsource] &
+                BIT(msg->u.log.log_hdr.severity)) ||
+            !(iwmct_logdefs[LOG_SRC_FW_MSG] & BIT(msg->u.log.log_hdr.severity)))
+                return;
+
+        switch (msg->hdr.category) {
+        case COMM_CATEGORY_TESTABILITY:
+                if (!(iwmct_logdefs[LOG_SRC_TST] &
+                      BIT(msg->u.log.log_hdr.severity)))
+                        return;
+                if (log_msg_format_hex(logbuf, LOG_MSG_SIZE_MAX, buf,
+                                       le16_to_cpu(msg->hdr.length) +
+                                       sizeof(msg->hdr), "<TST>"))
+                        LOG_WARNING(priv, TST,
+                                  "TOP TST message is too long, truncating...");
+                LOG_WARNING(priv, TST, "%s\n", logbuf);
+                break;
+        case COMM_CATEGORY_DEBUG:
+                if (msg->hdr.opcode == OP_DBG_ZSTR_MSG)
+                        LOG_INFO(priv, FW_MSG, "%s %s", "<DBG>",
+                                       ((u8 *)msg) + sizeof(msg->hdr)
+                                        + sizeof(msg->u.log.log_hdr));
+                else {
+                        if (log_msg_format_hex(logbuf, LOG_MSG_SIZE_MAX, buf,
+                                        le16_to_cpu(msg->hdr.length)
+                                                + sizeof(msg->hdr),
+                                        "<DBG>"))
+                                LOG_WARNING(priv, FW_MSG,
+                                        "TOP DBG message is too long,"
+                                        "truncating...");
+                        LOG_WARNING(priv, FW_MSG, "%s\n", logbuf);
+                }
+                break;
+        default:
+                break;
+        }
+}
+
+static int _log_get_filter_str(u8 *logdefs, int logdefsz, char *buf, int size)
+{
+        int i, pos, len;
+        for (i = 0, pos = 0; (pos < size-1) && (i < logdefsz); i++) {
+                len = snprintf(&buf[pos], size - pos - 1, "0x%02X%02X,",
+                                i, logdefs[i]);
+                pos += len;
+        }
+        buf[pos-1] = '\n';
+        buf[pos] = '\0';
+
+        if (i < logdefsz)
+                return -1;
+        return 0;
+}
+
+int log_get_filter_str(char *buf, int size)
+{
+        return _log_get_filter_str(iwmct_logdefs, LOG_SRC_MAX, buf, size);
+}
+
+int log_get_fw_filter_str(char *buf, int size)
+{
+        return _log_get_filter_str(iwmct_fw_logdefs, FW_LOG_SRC_MAX, buf, size);
+}
+
+#define HEXADECIMAL_RADIX       16
+#define LOG_SRC_FORMAT          7 /* log level is in format of "0xXXXX," */
+
+ssize_t show_iwmct_log_level(struct device *d,
+                                struct device_attribute *attr, char *buf)
+{
+        struct iwmct_priv *priv = dev_get_drvdata(d);
+        char *str_buf;
+        int buf_size;
+        ssize_t ret;
+
+        buf_size = (LOG_SRC_FORMAT * LOG_SRC_MAX) + 1;
+        str_buf = kzalloc(buf_size, GFP_KERNEL);
+        if (!str_buf) {
+                LOG_ERROR(priv, DEBUGFS,
+                        "failed to allocate %d bytes\n", buf_size);
+                ret = -ENOMEM;
+                goto exit;
+        }
+
+        if (log_get_filter_str(str_buf, buf_size) < 0) {
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        ret = sprintf(buf, "%s", str_buf);
+
+exit:
+        kfree(str_buf);
+        return ret;
+}
+
+ssize_t store_iwmct_log_level(struct device *d,
+                        struct device_attribute *attr,
+                        const char *buf, size_t count)
+{
+        struct iwmct_priv *priv = dev_get_drvdata(d);
+        char *token, *str_buf = NULL;
+        long val;
+        ssize_t ret = count;
+        u8 src, mask;
+
+        if (!count)
+                goto exit;
+
+        str_buf = kzalloc(count, GFP_KERNEL);
+        if (!str_buf) {
+                LOG_ERROR(priv, DEBUGFS,
+                        "failed to allocate %zd bytes\n", count);
+                ret = -ENOMEM;
+                goto exit;
+        }
+
+        memcpy(str_buf, buf, count);
+
+        while ((token = strsep(&str_buf, ",")) != NULL) {
+                while (isspace(*token))
+                        ++token;
+                if (strict_strtol(token, HEXADECIMAL_RADIX, &val)) {
+                        LOG_ERROR(priv, DEBUGFS,
+                                  "failed to convert string to long %s\n",
+                                  token);
+                        ret = -EINVAL;
+                        goto exit;
+                }
+
+                mask  = val & 0xFF;
+                src = (val & 0XFF00) >> 8;
+                iwmct_log_set_filter(src, mask);
+        }
+
+exit:
+        kfree(str_buf);
+        return ret;
+}
+
+ssize_t show_iwmct_log_level_fw(struct device *d,
+                        struct device_attribute *attr, char *buf)
+{
+        struct iwmct_priv *priv = dev_get_drvdata(d);
+        char *str_buf;
+        int buf_size;
+        ssize_t ret;
+
+        buf_size = (LOG_SRC_FORMAT * FW_LOG_SRC_MAX) + 2;
+
+        str_buf = kzalloc(buf_size, GFP_KERNEL);
+        if (!str_buf) {
+                LOG_ERROR(priv, DEBUGFS,
+                        "failed to allocate %d bytes\n", buf_size);
+                ret = -ENOMEM;
+                goto exit;
+        }
+
+        if (log_get_fw_filter_str(str_buf, buf_size) < 0) {
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        ret = sprintf(buf, "%s", str_buf);
+
+exit:
+        kfree(str_buf);
+        return ret;
+}
+
+ssize_t store_iwmct_log_level_fw(struct device *d,
+                        struct device_attribute *attr,
+                        const char *buf, size_t count)
+{
+        struct iwmct_priv *priv = dev_get_drvdata(d);
+        struct top_msg cmd;
+        char *token, *str_buf = NULL;
+        ssize_t ret = count;
+        u16 cmdlen = 0;
+        int i;
+        long val;
+        u8 src, mask;
+
+        if (!count)
+                goto exit;
+
+        str_buf = kzalloc(count, GFP_KERNEL);
+        if (!str_buf) {
+                LOG_ERROR(priv, DEBUGFS,
+                        "failed to allocate %zd bytes\n", count);
+                ret = -ENOMEM;
+                goto exit;
+        }
+
+        memcpy(str_buf, buf, count);
+
+        cmd.hdr.type = COMM_TYPE_H2D;
+        cmd.hdr.category = COMM_CATEGORY_DEBUG;
+        cmd.hdr.opcode = CMD_DBG_LOG_LEVEL;
+
+        for (i = 0; ((token = strsep(&str_buf, ",")) != NULL) &&
+                     (i < FW_LOG_SRC_MAX); i++) {
+
+                while (isspace(*token))
+                        ++token;
+
+                if (strict_strtol(token, HEXADECIMAL_RADIX, &val)) {
+                        LOG_ERROR(priv, DEBUGFS,
+                                  "failed to convert string to long %s\n",
+                                  token);
+                        ret = -EINVAL;
+                        goto exit;
+                }
+
+                mask  = val & 0xFF; /* LSB */
+                src = (val & 0XFF00) >> 8; /* 2nd least significant byte. */
+                iwmct_log_set_fw_filter(src, mask);
+
+                cmd.u.logdefs[i].logsource = src;
+                cmd.u.logdefs[i].sevmask = mask;
+        }
+
+        cmd.hdr.length = cpu_to_le16(i * sizeof(cmd.u.logdefs[0]));
+        cmdlen = (i * sizeof(cmd.u.logdefs[0]) + sizeof(cmd.hdr));
+
+        ret = iwmct_send_hcmd(priv, (u8 *)&cmd, cmdlen);
+        if (ret) {
+                LOG_ERROR(priv, DEBUGFS,
+                          "Failed to send %d bytes of fwcmd, ret=%zd\n",
+                          cmdlen, ret);
+                goto exit;
+        } else
+                LOG_INFO(priv, DEBUGFS, "fwcmd sent (%d bytes)\n", cmdlen);
+
+        ret = count;
+
+exit:
+        kfree(str_buf);
+        return ret;
+}
+
diff --git a/drivers/misc/iwmc3200top/log.h b/drivers/misc/iwmc3200top/log.h
new file mode 100644
index 000000000000..4434bb16cea7
--- /dev/null
+++ b/drivers/misc/iwmc3200top/log.h
@@ -0,0 +1,171 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/log.h
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#ifndef __LOG_H__
+#define __LOG_H__
+
+
+/* log severity:
+ * The log levels here match FW log levels
+ * so values need to stay as is */
+#define LOG_SEV_CRITICAL                0
+#define LOG_SEV_ERROR                   1
+#define LOG_SEV_WARNING                 2
+#define LOG_SEV_INFO                    3
+#define LOG_SEV_INFOEX                  4
+
+/* Log levels not defined for FW */
+#define LOG_SEV_TRACE                   5
+#define LOG_SEV_DUMP                    6
+
+#define LOG_SEV_FW_FILTER_ALL           \
+        (BIT(LOG_SEV_CRITICAL)  |       \
+         BIT(LOG_SEV_ERROR)     |       \
+         BIT(LOG_SEV_WARNING)   |       \
+         BIT(LOG_SEV_INFO)      |       \
+         BIT(LOG_SEV_INFOEX))
+
+#define LOG_SEV_FILTER_ALL              \
+        (BIT(LOG_SEV_CRITICAL)  |       \
+         BIT(LOG_SEV_ERROR)     |       \
+         BIT(LOG_SEV_WARNING)   |       \
+         BIT(LOG_SEV_INFO)      |       \
+         BIT(LOG_SEV_INFOEX)    |       \
+         BIT(LOG_SEV_TRACE)     |       \
+         BIT(LOG_SEV_DUMP))
+
+/* log source */
+#define LOG_SRC_INIT                    0
+#define LOG_SRC_DEBUGFS                 1
+#define LOG_SRC_FW_DOWNLOAD             2
+#define LOG_SRC_FW_MSG                  3
+#define LOG_SRC_TST                     4
+#define LOG_SRC_IRQ                     5
+
+#define LOG_SRC_MAX                     6
+#define LOG_SRC_ALL                     0xFF
+
+/**
+ * Default intitialization runtime log level
+ */
+#ifndef LOG_SEV_FILTER_RUNTIME
+#define LOG_SEV_FILTER_RUNTIME                  \
+        (BIT(LOG_SEV_CRITICAL)  |               \
+         BIT(LOG_SEV_ERROR)     |               \
+         BIT(LOG_SEV_WARNING))
+#endif
+
+#ifndef FW_LOG_SEV_FILTER_RUNTIME
+#define FW_LOG_SEV_FILTER_RUNTIME       LOG_SEV_FILTER_ALL
+#endif
+
+#ifdef CONFIG_IWMC3200TOP_DEBUG
+/**
+ * Log macros
+ */
+
+#define priv2dev(priv) (&(priv->func)->dev)
+
+#define LOG_CRITICAL(priv, src, fmt, args...)                           \
+do {                                                                    \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_CRITICAL))     \
+                dev_crit(priv2dev(priv), "%s %d: " fmt,                 \
+                        __func__, __LINE__, ##args);                    \
+} while (0)
+
+#define LOG_ERROR(priv, src, fmt, args...)                              \
+do {                                                                    \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_ERROR))        \
+                dev_err(priv2dev(priv), "%s %d: " fmt,                  \
+                        __func__, __LINE__, ##args);                    \
+} while (0)
+
+#define LOG_WARNING(priv, src, fmt, args...)                            \
+do {                                                                    \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_WARNING))      \
+                dev_warn(priv2dev(priv), "%s %d: " fmt,                 \
+                         __func__, __LINE__, ##args);                   \
+} while (0)
+
+#define LOG_INFO(priv, src, fmt, args...)                               \
+do {                                                                    \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_INFO))         \
+                dev_info(priv2dev(priv), "%s %d: " fmt,                 \
+                         __func__, __LINE__, ##args);                   \
+} while (0)
+
+#define LOG_TRACE(priv, src, fmt, args...)                              \
+do {                                                                    \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_TRACE))        \
+                dev_dbg(priv2dev(priv), "%s %d: " fmt,                  \
+                         __func__, __LINE__, ##args);                   \
+} while (0)
+
+#define LOG_HEXDUMP(src, ptr, len)                                      \
+do {                                                                    \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_DUMP)) \
+                print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_NONE,        \
+                                16, 1, ptr, len, false);                \
+} while (0)
+
+void iwmct_log_top_message(struct iwmct_priv *priv, u8 *buf, int len);
+
+extern u8 iwmct_logdefs[];
+
+int iwmct_log_set_filter(u8 src, u8 logmask);
+int iwmct_log_set_fw_filter(u8 src, u8 logmask);
+
+ssize_t show_iwmct_log_level(struct device *d,
+                        struct device_attribute *attr, char *buf);
+ssize_t store_iwmct_log_level(struct device *d,
+                        struct device_attribute *attr,
+                        const char *buf, size_t count);
+ssize_t show_iwmct_log_level_fw(struct device *d,
+                        struct device_attribute *attr, char *buf);
+ssize_t store_iwmct_log_level_fw(struct device *d,
+                        struct device_attribute *attr,
+                        const char *buf, size_t count);
+
+#else
+
+#define LOG_CRITICAL(priv, src, fmt, args...)
+#define LOG_ERROR(priv, src, fmt, args...)
+#define LOG_WARNING(priv, src, fmt, args...)
+#define LOG_INFO(priv, src, fmt, args...)
+#define LOG_TRACE(priv, src, fmt, args...)
+#define LOG_HEXDUMP(src, ptr, len)
+
+static inline void iwmct_log_top_message(struct iwmct_priv *priv,
+                                         u8 *buf, int len) {}
+static inline int iwmct_log_set_filter(u8 src, u8 logmask) { return 0; }
+static inline int iwmct_log_set_fw_filter(u8 src, u8 logmask) { return 0; }
+
+#endif /* CONFIG_IWMC3200TOP_DEBUG */
+
+int log_get_filter_str(char *buf, int size);
+int log_get_fw_filter_str(char *buf, int size);
+
+#endif /* __LOG_H__ */
diff --git a/drivers/misc/iwmc3200top/main.c b/drivers/misc/iwmc3200top/main.c
new file mode 100644
index 000000000000..c73cef2c3c5e
--- /dev/null
+++ b/drivers/misc/iwmc3200top/main.c
@@ -0,0 +1,666 @@
+/*
+ * iwmc3200top - Intel Wireless MultiCom 3200 Top Driver
+ * drivers/misc/iwmc3200top/main.c
+ *
+ * Copyright (C) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ *
+ * Author Name: Maxim Grabarnik <maxim.grabarnink@intel.com>
+ *  -
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/debugfs.h>
+#include <linux/mmc/sdio_ids.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio.h>
+
+#include "iwmc3200top.h"
+#include "log.h"
+#include "fw-msg.h"
+#include "debugfs.h"
+
+
+#define DRIVER_DESCRIPTION "Intel(R) IWMC 3200 Top Driver"
+#define DRIVER_COPYRIGHT "Copyright (c) 2008 Intel Corporation."
+
+#define DRIVER_VERSION  "0.1.62"
+
+MODULE_DESCRIPTION(DRIVER_DESCRIPTION);
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR(DRIVER_COPYRIGHT);
+MODULE_FIRMWARE(FW_NAME(FW_API_VER));
+
+
+static inline int __iwmct_tx(struct iwmct_priv *priv, void *src, int count)
+{
+        return sdio_memcpy_toio(priv->func, IWMC_SDIO_DATA_ADDR, src, count);
+
+}
+int iwmct_tx(struct iwmct_priv *priv, void *src, int count)
+{
+        int ret;
+        sdio_claim_host(priv->func);
+        ret =  __iwmct_tx(priv, src, count);
+        sdio_release_host(priv->func);
+        return ret;
+}
+/*
+ * This workers main task is to wait for OP_OPR_ALIVE
+ * from TOP FW until ALIVE_MSG_TIMOUT timeout is elapsed.
+ * When OP_OPR_ALIVE received it will issue
+ * a call to "bus_rescan_devices".
+ */
+static void iwmct_rescan_worker(struct work_struct *ws)
+{
+        struct iwmct_priv *priv;
+        int ret;
+
+        priv = container_of(ws, struct iwmct_priv, bus_rescan_worker);
+
+        LOG_INFO(priv, FW_MSG, "Calling bus_rescan\n");
+
+        ret = bus_rescan_devices(priv->func->dev.bus);
+        if (ret < 0)
+                LOG_INFO(priv, INIT, "bus_rescan_devices FAILED!!!\n");
+}
+
+static void op_top_message(struct iwmct_priv *priv, struct top_msg *msg)
+{
+        switch (msg->hdr.opcode) {
+        case OP_OPR_ALIVE:
+                LOG_INFO(priv, FW_MSG, "Got ALIVE from device, wake rescan\n");
+                queue_work(priv->bus_rescan_wq, &priv->bus_rescan_worker);
+                break;
+        default:
+                LOG_INFO(priv, FW_MSG, "Received msg opcode 0x%X\n",
+                        msg->hdr.opcode);
+                break;
+        }
+}
+
+
+static void handle_top_message(struct iwmct_priv *priv, u8 *buf, int len)
+{
+        struct top_msg *msg;
+
+        msg = (struct top_msg *)buf;
+
+        if (msg->hdr.type != COMM_TYPE_D2H) {
+                LOG_ERROR(priv, FW_MSG,
+                        "Message from TOP with invalid message type 0x%X\n",
+                        msg->hdr.type);
+                return;
+        }
+
+        if (len < sizeof(msg->hdr)) {
+                LOG_ERROR(priv, FW_MSG,
+                        "Message from TOP is too short for message header "
+                        "received %d bytes, expected at least %zd bytes\n",
+                        len, sizeof(msg->hdr));
+                return;
+        }
+
+        if (len < le16_to_cpu(msg->hdr.length) + sizeof(msg->hdr)) {
+                LOG_ERROR(priv, FW_MSG,
+                        "Message length (%d bytes) is shorter than "
+                        "in header (%d bytes)\n",
+                        len, le16_to_cpu(msg->hdr.length));
+                return;
+        }
+
+        switch (msg->hdr.category) {
+        case COMM_CATEGORY_OPERATIONAL:
+                op_top_message(priv, (struct top_msg *)buf);
+                break;
+
+        case COMM_CATEGORY_DEBUG:
+        case COMM_CATEGORY_TESTABILITY:
+        case COMM_CATEGORY_DIAGNOSTICS:
+                iwmct_log_top_message(priv, buf, len);
+                break;
+
+        default:
+                LOG_ERROR(priv, FW_MSG,
+                        "Message from TOP with unknown category 0x%X\n",
+                        msg->hdr.category);
+                break;
+        }
+}
+
+int iwmct_send_hcmd(struct iwmct_priv *priv, u8 *cmd, u16 len)
+{
+        int ret;
+        u8 *buf;
+
+        LOG_TRACE(priv, FW_MSG, "Sending hcmd:\n");
+
+        /* add padding to 256 for IWMC */
+        ((struct top_msg *)cmd)->hdr.flags |= CMD_FLAG_PADDING_256;
+
+        LOG_HEXDUMP(FW_MSG, cmd, len);
+
+        if (len > FW_HCMD_BLOCK_SIZE) {
+                LOG_ERROR(priv, FW_MSG, "size %d exceeded hcmd max size %d\n",
+                          len, FW_HCMD_BLOCK_SIZE);
+                return -1;
+        }
+
+        buf = kzalloc(FW_HCMD_BLOCK_SIZE, GFP_KERNEL);
+        if (!buf) {
+                LOG_ERROR(priv, FW_MSG, "kzalloc error, buf size %d\n",
+                          FW_HCMD_BLOCK_SIZE);
+                return -1;
+        }
+
+        memcpy(buf, cmd, len);
+        ret = iwmct_tx(priv, buf, FW_HCMD_BLOCK_SIZE);
+
+        kfree(buf);
+        return ret;
+}
+
+
+static void iwmct_irq_read_worker(struct work_struct *ws)
+{
+        struct iwmct_priv *priv;
+        struct iwmct_work_struct *read_req;
+        __le32 *buf = NULL;
+        int ret;
+        int iosize;
+        u32 barker;
+        bool is_barker;
+
+        priv = container_of(ws, struct iwmct_priv, isr_worker);
+
+        LOG_TRACE(priv, IRQ, "enter iwmct_irq_read_worker %p\n", ws);
+
+        /* --------------------- Handshake with device -------------------- */
+        sdio_claim_host(priv->func);
+
+        /* all list manipulations have to be protected by
+         * sdio_claim_host/sdio_release_host */
+        if (list_empty(&priv->read_req_list)) {
+                LOG_ERROR(priv, IRQ, "read_req_list empty in read worker\n");
+                goto exit_release;
+        }
+
+        read_req = list_entry(priv->read_req_list.next,
+                              struct iwmct_work_struct, list);
+
+        list_del(&read_req->list);
+        iosize = read_req->iosize;
+        kfree(read_req);
+
+        buf = kzalloc(iosize, GFP_KERNEL);
+        if (!buf) {
+                LOG_ERROR(priv, IRQ, "kzalloc error, buf size %d\n", iosize);
+                goto exit_release;
+        }
+
+        LOG_INFO(priv, IRQ, "iosize=%d, buf=%p, func=%d\n",
+                                iosize, buf, priv->func->num);
+
+        /* read from device */
+        ret = sdio_memcpy_fromio(priv->func, buf, IWMC_SDIO_DATA_ADDR, iosize);
+        if (ret) {
+                LOG_ERROR(priv, IRQ, "error %d reading buffer\n", ret);
+                goto exit_release;
+        }
+
+        LOG_HEXDUMP(IRQ, (u8 *)buf, iosize);
+
+        barker = le32_to_cpu(buf[0]);
+
+        /* Verify whether it's a barker and if not - treat as regular Rx */
+        if (barker == IWMC_BARKER_ACK ||
+            (barker & BARKER_DNLOAD_BARKER_MSK) == IWMC_BARKER_REBOOT) {
+
+                /* Valid Barker is equal on first 4 dwords */
+                is_barker = (buf[1] == buf[0]) &&
+                            (buf[2] == buf[0]) &&
+                            (buf[3] == buf[0]);
+
+                if (!is_barker) {
+                        LOG_WARNING(priv, IRQ,
+                                "Potentially inconsistent barker "
+                                "%08X_%08X_%08X_%08X\n",
+                                le32_to_cpu(buf[0]), le32_to_cpu(buf[1]),
+                                le32_to_cpu(buf[2]), le32_to_cpu(buf[3]));
+                }
+        } else {
+                is_barker = false;
+        }
+
+        /* Handle Top CommHub message */
+        if (!is_barker) {
+                sdio_release_host(priv->func);
+                handle_top_message(priv, (u8 *)buf, iosize);
+                goto exit;
+        } else if (barker == IWMC_BARKER_ACK) { /* Handle barkers */
+                if (atomic_read(&priv->dev_sync) == 0) {
+                        LOG_ERROR(priv, IRQ,
+                                  "ACK barker arrived out-of-sync\n");
+                        goto exit_release;
+                }
+
+                /* Continuing to FW download (after Sync is completed)*/
+                atomic_set(&priv->dev_sync, 0);
+                LOG_INFO(priv, IRQ, "ACK barker arrived "
+                                "- starting FW download\n");
+        } else { /* REBOOT barker */
+                LOG_INFO(priv, IRQ, "Recieved reboot barker: %x\n", barker);
+                priv->barker = barker;
+
+                if (barker & BARKER_DNLOAD_SYNC_MSK) {
+                        /* Send the same barker back */
+                        ret = __iwmct_tx(priv, buf, iosize);
+                        if (ret) {
+                                LOG_ERROR(priv, IRQ,
+                                         "error %d echoing barker\n", ret);
+                                goto exit_release;
+                        }
+                        LOG_INFO(priv, IRQ, "Echoing barker to device\n");
+                        atomic_set(&priv->dev_sync, 1);
+                        goto exit_release;
+                }
+
+                /* Continuing to FW download (without Sync) */
+                LOG_INFO(priv, IRQ, "No sync requested "
+                                    "- starting FW download\n");
+        }
+
+        sdio_release_host(priv->func);
+
+        if (priv->dbg.fw_download)
+                iwmct_fw_load(priv);
+        else
+                LOG_ERROR(priv, IRQ, "FW download not allowed\n");
+
+        goto exit;
+
+exit_release:
+        sdio_release_host(priv->func);
+exit:
+        kfree(buf);
+        LOG_TRACE(priv, IRQ, "exit iwmct_irq_read_worker\n");
+}
+
+static void iwmct_irq(struct sdio_func *func)
+{
+        struct iwmct_priv *priv;
+        int val, ret;
+        int iosize;
+        int addr = IWMC_SDIO_INTR_GET_SIZE_ADDR;
+        struct iwmct_work_struct *read_req;
+
+        priv = sdio_get_drvdata(func);
+
+        LOG_TRACE(priv, IRQ, "enter iwmct_irq\n");
+
+        /* read the function's status register */
+        val = sdio_readb(func, IWMC_SDIO_INTR_STATUS_ADDR, &ret);
+
+        LOG_TRACE(priv, IRQ, "iir value = %d, ret=%d\n", val, ret);
+
+        if (!val) {
+                LOG_ERROR(priv, IRQ, "iir = 0, exiting ISR\n");
+                goto exit_clear_intr;
+        }
+
+
+        /*
+         * read 2 bytes of the transaction size
+         * IMPORTANT: sdio transaction size has to be read before clearing
+         * sdio interrupt!!!
+         */
+        val = sdio_readb(priv->func, addr++, &ret);
+        iosize = val;
+        val = sdio_readb(priv->func, addr++, &ret);
+        iosize += val << 8;
+
+        LOG_INFO(priv, IRQ, "READ size %d\n", iosize);
+
+        if (iosize == 0) {
+                LOG_ERROR(priv, IRQ, "READ size %d, exiting ISR\n", iosize);
+                goto exit_clear_intr;
+        }
+
+        /* allocate a work structure to pass iosize to the worker */
+        read_req = kzalloc(sizeof(struct iwmct_work_struct), GFP_KERNEL);
+        if (!read_req) {
+                LOG_ERROR(priv, IRQ, "failed to allocate read_req, exit ISR\n");
+                goto exit_clear_intr;
+        }
+
+        INIT_LIST_HEAD(&read_req->list);
+        read_req->iosize = iosize;
+
+        list_add_tail(&priv->read_req_list, &read_req->list);
+
+        /* clear the function's interrupt request bit (write 1 to clear) */
+        sdio_writeb(func, 1, IWMC_SDIO_INTR_CLEAR_ADDR, &ret);
+
+        queue_work(priv->wq, &priv->isr_worker);
+
+        LOG_TRACE(priv, IRQ, "exit iwmct_irq\n");
+
+        return;
+
+exit_clear_intr:
+        /* clear the function's interrupt request bit (write 1 to clear) */
+        sdio_writeb(func, 1, IWMC_SDIO_INTR_CLEAR_ADDR, &ret);
+}
+
+
+static int blocks;
+module_param(blocks, int, 0604);
+MODULE_PARM_DESC(blocks, "max_blocks_to_send");
+
+static int dump;
+module_param(dump, bool, 0604);
+MODULE_PARM_DESC(dump, "dump_hex_content");
+
+static int jump = 1;
+module_param(jump, bool, 0604);
+
+static int direct = 1;
+module_param(direct, bool, 0604);
+
+static int checksum = 1;
+module_param(checksum, bool, 0604);
+
+static int fw_download = 1;
+module_param(fw_download, bool, 0604);
+
+static int block_size = IWMC_SDIO_BLK_SIZE;
+module_param(block_size, int, 0404);
+
+static int download_trans_blks = IWMC_DEFAULT_TR_BLK;
+module_param(download_trans_blks, int, 0604);
+
+static int rubbish_barker;
+module_param(rubbish_barker, bool, 0604);
+
+#ifdef CONFIG_IWMC3200TOP_DEBUG
+static int log_level[LOG_SRC_MAX];
+static unsigned int log_level_argc;
+module_param_array(log_level, int, &log_level_argc, 0604);
+MODULE_PARM_DESC(log_level, "log_level");
+
+static int log_level_fw[FW_LOG_SRC_MAX];
+static unsigned int log_level_fw_argc;
+module_param_array(log_level_fw, int, &log_level_fw_argc, 0604);
+MODULE_PARM_DESC(log_level_fw, "log_level_fw");
+#endif
+
+void iwmct_dbg_init_params(struct iwmct_priv *priv)
+{
+#ifdef CONFIG_IWMC3200TOP_DEBUG
+        int i;
+
+        for (i = 0; i < log_level_argc; i++) {
+                dev_notice(&priv->func->dev, "log_level[%d]=0x%X\n",
+                                                i, log_level[i]);
+                iwmct_log_set_filter((log_level[i] >> 8) & 0xFF,
+                               log_level[i] & 0xFF);
+        }
+        for (i = 0; i < log_level_fw_argc; i++) {
+                dev_notice(&priv->func->dev, "log_level_fw[%d]=0x%X\n",
+                                                i, log_level_fw[i]);
+                iwmct_log_set_fw_filter((log_level_fw[i] >> 8) & 0xFF,
+                                  log_level_fw[i] & 0xFF);
+        }
+#endif
+
+        priv->dbg.blocks = blocks;
+        LOG_INFO(priv, INIT, "blocks=%d\n", blocks);
+        priv->dbg.dump = (bool)dump;
+        LOG_INFO(priv, INIT, "dump=%d\n", dump);
+        priv->dbg.jump = (bool)jump;
+        LOG_INFO(priv, INIT, "jump=%d\n", jump);
+        priv->dbg.direct = (bool)direct;
+        LOG_INFO(priv, INIT, "direct=%d\n", direct);
+        priv->dbg.checksum = (bool)checksum;
+        LOG_INFO(priv, INIT, "checksum=%d\n", checksum);
+        priv->dbg.fw_download = (bool)fw_download;
+        LOG_INFO(priv, INIT, "fw_download=%d\n", fw_download);
+        priv->dbg.block_size = block_size;
+        LOG_INFO(priv, INIT, "block_size=%d\n", block_size);
+        priv->dbg.download_trans_blks = download_trans_blks;
+        LOG_INFO(priv, INIT, "download_trans_blks=%d\n", download_trans_blks);
+}
+
+/*****************************************************************************
+ *
+ * sysfs attributes
+ *
+ *****************************************************************************/
+static ssize_t show_iwmct_fw_version(struct device *d,
+                                  struct device_attribute *attr, char *buf)
+{
+        struct iwmct_priv *priv = dev_get_drvdata(d);
+        return sprintf(buf, "%s\n", priv->dbg.label_fw);
+}
+static DEVICE_ATTR(cc_label_fw, S_IRUGO, show_iwmct_fw_version, NULL);
+
+#ifdef CONFIG_IWMC3200TOP_DEBUG
+static DEVICE_ATTR(log_level, S_IWUSR | S_IRUGO,
+                   show_iwmct_log_level, store_iwmct_log_level);
+static DEVICE_ATTR(log_level_fw, S_IWUSR | S_IRUGO,
+                   show_iwmct_log_level_fw, store_iwmct_log_level_fw);
+#endif
+
+static struct attribute *iwmct_sysfs_entries[] = {
+        &dev_attr_cc_label_fw.attr,
+#ifdef CONFIG_IWMC3200TOP_DEBUG
+        &dev_attr_log_level.attr,
+        &dev_attr_log_level_fw.attr,
+#endif
+        NULL
+};
+
+static struct attribute_group iwmct_attribute_group = {
+        .name = NULL,           /* put in device directory */
+        .attrs = iwmct_sysfs_entries,
+};
+
+
+static int iwmct_probe(struct sdio_func *func,
+                           const struct sdio_device_id *id)
+{
+        struct iwmct_priv *priv;
+        int ret;
+        int val = 1;
+        int addr = IWMC_SDIO_INTR_ENABLE_ADDR;
+
+        dev_dbg(&func->dev, "enter iwmct_probe\n");
+
+        dev_dbg(&func->dev, "IRQ polling period id %u msecs, HZ is %d\n",
+                jiffies_to_msecs(2147483647), HZ);
+
+        priv = kzalloc(sizeof(struct iwmct_priv), GFP_KERNEL);
+        if (!priv) {
+                dev_err(&func->dev, "kzalloc error\n");
+                return -ENOMEM;
+        }
+        priv->func = func;
+        sdio_set_drvdata(func, priv);
+
+
+        /* create drivers work queue */
+        priv->wq = create_workqueue(DRV_NAME "_wq");
+        priv->bus_rescan_wq = create_workqueue(DRV_NAME "_rescan_wq");
+        INIT_WORK(&priv->bus_rescan_worker, iwmct_rescan_worker);
+        INIT_WORK(&priv->isr_worker, iwmct_irq_read_worker);
+
+        init_waitqueue_head(&priv->wait_q);
+
+        sdio_claim_host(func);
+        /* FIXME: Remove after it is fixed in the Boot ROM upgrade */
+        func->enable_timeout = 10;
+
+        /* In our HW, setting the block size also wakes up the boot rom. */
+        ret = sdio_set_block_size(func, priv->dbg.block_size);
+        if (ret) {
+                LOG_ERROR(priv, INIT,
+                        "sdio_set_block_size() failure: %d\n", ret);
+                goto error_sdio_enable;
+        }
+
+        ret = sdio_enable_func(func);
+        if (ret) {
+                LOG_ERROR(priv, INIT, "sdio_enable_func() failure: %d\n", ret);
+                goto error_sdio_enable;
+        }
+
+        /* init reset and dev_sync states */
+        atomic_set(&priv->reset, 0);
+        atomic_set(&priv->dev_sync, 0);
+
+        /* init read req queue */
+        INIT_LIST_HEAD(&priv->read_req_list);
+
+        /* process configurable parameters */
+        iwmct_dbg_init_params(priv);
+        ret = sysfs_create_group(&func->dev.kobj, &iwmct_attribute_group);
+        if (ret) {
+                LOG_ERROR(priv, INIT, "Failed to register attributes and "
+                         "initialize module_params\n");
+                goto error_dev_attrs;
+        }
+
+        iwmct_dbgfs_register(priv, DRV_NAME);
+
+        if (!priv->dbg.direct && priv->dbg.download_trans_blks > 8) {
+                LOG_INFO(priv, INIT,
+                         "Reducing transaction to 8 blocks = 2K (from %d)\n",
+                         priv->dbg.download_trans_blks);
+                priv->dbg.download_trans_blks = 8;
+        }
+        priv->trans_len = priv->dbg.download_trans_blks * priv->dbg.block_size;
+        LOG_INFO(priv, INIT, "Transaction length = %d\n", priv->trans_len);
+
+        ret = sdio_claim_irq(func, iwmct_irq);
+        if (ret) {
+                LOG_ERROR(priv, INIT, "sdio_claim_irq() failure: %d\n", ret);
+                goto error_claim_irq;
+        }
+
+
+        /* Enable function's interrupt */
+        sdio_writeb(priv->func, val, addr, &ret);
+        if (ret) {
+                LOG_ERROR(priv, INIT, "Failure writing to "
+                          "Interrupt Enable Register (%d): %d\n", addr, ret);
+                goto error_enable_int;
+        }
+
+        sdio_release_host(func);
+
+        LOG_INFO(priv, INIT, "exit iwmct_probe\n");
+
+        return ret;
+
+error_enable_int:
+        sdio_release_irq(func);
+error_claim_irq:
+        sdio_disable_func(func);
+error_dev_attrs:
+        iwmct_dbgfs_unregister(priv->dbgfs);
+        sysfs_remove_group(&func->dev.kobj, &iwmct_attribute_group);
+error_sdio_enable:
+        sdio_release_host(func);
+        return ret;
+}
+
+static void iwmct_remove(struct sdio_func *func)
+{
+        struct iwmct_work_struct *read_req;
+        struct iwmct_priv *priv = sdio_get_drvdata(func);
+
+        LOG_INFO(priv, INIT, "enter\n");
+
+        sdio_claim_host(func);
+        sdio_release_irq(func);
+        sdio_release_host(func);
+
+        /* Safely destroy osc workqueue */
+        destroy_workqueue(priv->bus_rescan_wq);
+        destroy_workqueue(priv->wq);
+
+        sdio_claim_host(func);
+        sdio_disable_func(func);
+        sysfs_remove_group(&func->dev.kobj, &iwmct_attribute_group);
+        iwmct_dbgfs_unregister(priv->dbgfs);
+        sdio_release_host(func);
+
+        /* free read requests */
+        while (!list_empty(&priv->read_req_list)) {
+                read_req = list_entry(priv->read_req_list.next,
+                        struct iwmct_work_struct, list);
+
+                list_del(&read_req->list);
+                kfree(read_req);
+        }
+
+        kfree(priv);
+}
+
+
+static const struct sdio_device_id iwmct_ids[] = {
+        /* Intel Wireless MultiCom 3200 Top Driver */
+        { SDIO_DEVICE(SDIO_VENDOR_ID_INTEL, 0x1404)},
+        { },    /* Terminating entry */
+};
+
+MODULE_DEVICE_TABLE(sdio, iwmct_ids);
+
+static struct sdio_driver iwmct_driver = {
+        .probe          = iwmct_probe,
+        .remove         = iwmct_remove,
+        .name           = DRV_NAME,
+        .id_table       = iwmct_ids,
+};
+
+static int __init iwmct_init(void)
+{
+        int rc;
+
+        /* Default log filter settings */
+        iwmct_log_set_filter(LOG_SRC_ALL, LOG_SEV_FILTER_RUNTIME);
+        iwmct_log_set_filter(LOG_SRC_FW_MSG, LOG_SEV_FW_FILTER_ALL);
+        iwmct_log_set_fw_filter(LOG_SRC_ALL, FW_LOG_SEV_FILTER_RUNTIME);
+
+        rc = sdio_register_driver(&iwmct_driver);
+
+        return rc;
+}
+
+static void __exit iwmct_exit(void)
+{
+        sdio_unregister_driver(&iwmct_driver);
+}
+
+module_init(iwmct_init);
+module_exit(iwmct_exit);
+
diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
index e4ff50b95a5e..59c118c19a91 100644
--- a/drivers/misc/kgdbts.c
+++ b/drivers/misc/kgdbts.c
@@ -295,6 +295,10 @@ static int check_and_rewind_pc(char *put_str, char *arg)
         /* On x86 a breakpoint stop requires it to be decremented */
         if (addr + 1 == kgdbts_regs.ip)
                 offset = -1;
+#elif defined(CONFIG_SUPERH)
+        /* On SUPERH a breakpoint stop requires it to be decremented */
+        if (addr + 2 == kgdbts_regs.pc)
+                offset = -2;
 #endif
         if (strcmp(arg, "silent") &&
                 instruction_pointer(&kgdbts_regs) + offset != addr) {
@@ -305,6 +309,8 @@ static int check_and_rewind_pc(char *put_str, char *arg)
 #ifdef CONFIG_X86
         /* On x86 adjust the instruction pointer if needed */
         kgdbts_regs.ip += offset;
+#elif defined(CONFIG_SUPERH)
+        kgdbts_regs.pc += offset;
 #endif
         return 0;
 }
@@ -712,6 +718,12 @@ static int run_simple_test(int is_get_char, int chr)
 
         /* End of packet == #XX so look for the '#' */
         if (put_buf_cnt > 3 && put_buf[put_buf_cnt - 3] == '#') {
+                if (put_buf_cnt >= BUFMAX) {
+                        eprintk("kgdbts: ERROR: put buffer overflow on"
+                                " '%s' line %i\n", ts.name, ts.idx);
+                        put_buf_cnt = 0;
+                        return 0;
+                }
                 put_buf[put_buf_cnt] = '\0';
                 v2printk("put%i: %s\n", ts.idx, put_buf);
                 /* Trigger check here */
@@ -885,16 +897,16 @@ static void kgdbts_run_tests(void)
         int nmi_sleep = 0;
         int i;
 
-        ptr = strstr(config, "F");
+        ptr = strchr(config, 'F');
         if (ptr)
                 fork_test = simple_strtol(ptr + 1, NULL, 10);
-        ptr = strstr(config, "S");
+        ptr = strchr(config, 'S');
         if (ptr)
                 do_sys_open_test = simple_strtol(ptr + 1, NULL, 10);
-        ptr = strstr(config, "N");
+        ptr = strchr(config, 'N');
         if (ptr)
                 nmi_sleep = simple_strtol(ptr+1, NULL, 10);
-        ptr = strstr(config, "I");
+        ptr = strchr(config, 'I');
         if (ptr)
                 sstep_test = simple_strtol(ptr+1, NULL, 10);
 
@@ -1032,12 +1044,6 @@ static int __init init_kgdbts(void)
         return configure_kgdbts();
 }
 
-static void cleanup_kgdbts(void)
-{
-        if (configured == 1)
-                kgdb_unregister_io_module(&kgdbts_io_ops);
-}
-
 static int kgdbts_get_char(void)
 {
         int val = 0;
@@ -1069,10 +1075,8 @@ static int param_set_kgdbts_var(const char *kmessage, struct kernel_param *kp)
                 return 0;
         }
 
-        if (kgdb_connected) {
-                printk(KERN_ERR
-               "kgdbts: Cannot reconfigure while KGDB is connected.\n");
-
+        if (configured == 1) {
+                printk(KERN_ERR "kgdbts: ERROR: Already configured and running.\n");
                 return -EBUSY;
         }
 
@@ -1081,9 +1085,6 @@ static int param_set_kgdbts_var(const char *kmessage, struct kernel_param *kp)
         if (config[len - 1] == '\n')
                 config[len - 1] = '\0';
 
-        if (configured == 1)
-                cleanup_kgdbts();
-
         /* Go and configure with the new params. */
         return configure_kgdbts();
 }
@@ -1111,7 +1112,6 @@ static struct kgdb_io kgdbts_io_ops = {
 };
 
 module_init(init_kgdbts);
-module_exit(cleanup_kgdbts);
 module_param_call(kgdbts, param_set_kgdbts_var, param_get_string, &kps, 0644);
 MODULE_PARM_DESC(kgdbts, "<A|V1|V2>[F#|S#][N#]");
 MODULE_DESCRIPTION("KGDB Test Suite");
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index 1bfe5d16963b..81d7fa4ec0db 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -26,21 +26,9 @@
  * It is adapted from the Linux Kernel Dump Test Tool by
  * Fernando Luis Vazquez Cao <http://lkdtt.sourceforge.net>
  *
- * Usage :  insmod lkdtm.ko [recur_count={>0}] cpoint_name=<> cpoint_type=<>
- *                                                      [cpoint_count={>0}]
+ * Debugfs support added by Simon Kagstrom <simon.kagstrom@netinsight.net>
  *
- * recur_count : Recursion level for the stack overflow test. Default is 10.
- *
- * cpoint_name : Crash point where the kernel is to be crashed. It can be
- *               one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
- *               FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_DISPATCH_CMD,
- *               IDE_CORE_CP
- *
- * cpoint_type : Indicates the action to be taken on hitting the crash point.
- *               It can be one of PANIC, BUG, EXCEPTION, LOOP, OVERFLOW
- *
- * cpoint_count : Indicates the number of times the crash point is to be hit
- *                to trigger an action. The default is 10.
+ * See Documentation/fault-injection/provoke-crashes.txt for instructions
  */
 
 #include <linux/kernel.h>
@@ -52,36 +40,44 @@
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/hrtimer.h>
+#include <linux/slab.h>
 #include <scsi/scsi_cmnd.h>
+#include <linux/debugfs.h>
 
 #ifdef CONFIG_IDE
 #include <linux/ide.h>
 #endif
 
-#define NUM_CPOINTS 8
-#define NUM_CPOINT_TYPES 5
 #define DEFAULT_COUNT 10
 #define REC_NUM_DEFAULT 10
 
 enum cname {
-        INVALID,
-        INT_HARDWARE_ENTRY,
-        INT_HW_IRQ_EN,
-        INT_TASKLET_ENTRY,
-        FS_DEVRW,
-        MEM_SWAPOUT,
-        TIMERADD,
-        SCSI_DISPATCH_CMD,
-        IDE_CORE_CP
+        CN_INVALID,
+        CN_INT_HARDWARE_ENTRY,
+        CN_INT_HW_IRQ_EN,
+        CN_INT_TASKLET_ENTRY,
+        CN_FS_DEVRW,
+        CN_MEM_SWAPOUT,
+        CN_TIMERADD,
+        CN_SCSI_DISPATCH_CMD,
+        CN_IDE_CORE_CP,
+        CN_DIRECT,
 };
 
 enum ctype {
-        NONE,
-        PANIC,
-        BUG,
-        EXCEPTION,
-        LOOP,
-        OVERFLOW
+        CT_NONE,
+        CT_PANIC,
+        CT_BUG,
+        CT_EXCEPTION,
+        CT_LOOP,
+        CT_OVERFLOW,
+        CT_CORRUPT_STACK,
+        CT_UNALIGNED_LOAD_STORE_WRITE,
+        CT_OVERWRITE_ALLOCATION,
+        CT_WRITE_AFTER_FREE,
+        CT_SOFTLOCKUP,
+        CT_HARDLOCKUP,
+        CT_HUNG_TASK,
 };
 
 static char* cp_name[] = {
@@ -92,7 +88,8 @@ static char* cp_name[] = {
         "MEM_SWAPOUT",
         "TIMERADD",
         "SCSI_DISPATCH_CMD",
-        "IDE_CORE_CP"
+        "IDE_CORE_CP",
+        "DIRECT",
 };
 
 static char* cp_type[] = {
@@ -100,7 +97,14 @@ static char* cp_type[] = {
         "BUG",
         "EXCEPTION",
         "LOOP",
-        "OVERFLOW"
+        "OVERFLOW",
+        "CORRUPT_STACK",
+        "UNALIGNED_LOAD_STORE_WRITE",
+        "OVERWRITE_ALLOCATION",
+        "WRITE_AFTER_FREE",
+        "SOFTLOCKUP",
+        "HARDLOCKUP",
+        "HUNG_TASK",
 };
 
 static struct jprobe lkdtm;
@@ -113,16 +117,16 @@ static char* cpoint_type;
 static int cpoint_count = DEFAULT_COUNT;
 static int recur_count = REC_NUM_DEFAULT;
 
-static enum cname cpoint = INVALID;
-static enum ctype cptype = NONE;
+static enum cname cpoint = CN_INVALID;
+static enum ctype cptype = CT_NONE;
 static int count = DEFAULT_COUNT;
 
 module_param(recur_count, int, 0644);
 MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test, "\
                                  "default is 10");
-module_param(cpoint_name, charp, 0644);
+module_param(cpoint_name, charp, 0444);
 MODULE_PARM_DESC(cpoint_name, " Crash Point, where kernel is to be crashed");
-module_param(cpoint_type, charp, 0644);
+module_param(cpoint_type, charp, 0444);
 MODULE_PARM_DESC(cpoint_type, " Crash Point Type, action to be taken on "\
                                 "hitting the crash point");
 module_param(cpoint_count, int, 0644);
@@ -193,34 +197,66 @@ int jp_generic_ide_ioctl(ide_drive_t *drive, struct file *file,
 }
 #endif
 
+/* Return the crashpoint number or NONE if the name is invalid */
+static enum ctype parse_cp_type(const char *what, size_t count)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(cp_type); i++) {
+                if (!strcmp(what, cp_type[i]))
+                        return i + 1;
+        }
+
+        return CT_NONE;
+}
+
+static const char *cp_type_to_str(enum ctype type)
+{
+        if (type == CT_NONE || type < 0 || type > ARRAY_SIZE(cp_type))
+                return "None";
+
+        return cp_type[type - 1];
+}
+
+static const char *cp_name_to_str(enum cname name)
+{
+        if (name == CN_INVALID || name < 0 || name > ARRAY_SIZE(cp_name))
+                return "INVALID";
+
+        return cp_name[name - 1];
+}
+
+
 static int lkdtm_parse_commandline(void)
 {
         int i;
 
-        if (cpoint_name == NULL || cpoint_type == NULL ||
-                                        cpoint_count < 1 || recur_count < 1)
+        if (cpoint_count < 1 || recur_count < 1)
                 return -EINVAL;
 
-        for (i = 0; i < NUM_CPOINTS; ++i) {
+        count = cpoint_count;
+
+        /* No special parameters */
+        if (!cpoint_type && !cpoint_name)
+                return 0;
+
+        /* Neither or both of these need to be set */
+        if (!cpoint_type || !cpoint_name)
+                return -EINVAL;
+
+        cptype = parse_cp_type(cpoint_type, strlen(cpoint_type));
+        if (cptype == CT_NONE)
+                return -EINVAL;
+
+        for (i = 0; i < ARRAY_SIZE(cp_name); i++) {
                 if (!strcmp(cpoint_name, cp_name[i])) {
                         cpoint = i + 1;
-                        break;
-                }
-        }
-
-        for (i = 0; i < NUM_CPOINT_TYPES; ++i) {
-                if (!strcmp(cpoint_type, cp_type[i])) {
-                        cptype = i + 1;
-                        break;
+                        return 0;
                 }
         }
 
-        if (cpoint == INVALID || cptype == NONE)
-                return -EINVAL;
-
-        count = cpoint_count;
-
-        return 0;
+        /* Could not find a valid crash point */
+        return -EINVAL;
 }
 
 static int recursive_loop(int a)
@@ -235,108 +271,410 @@ static int recursive_loop(int a)
                 return recursive_loop(a);
 }
 
-void lkdtm_handler(void)
+static void lkdtm_do_action(enum ctype which)
+{
+        switch (which) {
+        case CT_PANIC:
+                panic("dumptest");
+                break;
+        case CT_BUG:
+                BUG();
+                break;
+        case CT_EXCEPTION:
+                *((int *) 0) = 0;
+                break;
+        case CT_LOOP:
+                for (;;)
+                        ;
+                break;
+        case CT_OVERFLOW:
+                (void) recursive_loop(0);
+                break;
+        case CT_CORRUPT_STACK: {
+                volatile u32 data[8];
+                volatile u32 *p = data;
+
+                p[12] = 0x12345678;
+                break;
+        }
+        case CT_UNALIGNED_LOAD_STORE_WRITE: {
+                static u8 data[5] __attribute__((aligned(4))) = {1, 2,
+                                3, 4, 5};
+                u32 *p;
+                u32 val = 0x12345678;
+
+                p = (u32 *)(data + 1);
+                if (*p == 0)
+                        val = 0x87654321;
+                *p = val;
+                 break;
+        }
+        case CT_OVERWRITE_ALLOCATION: {
+                size_t len = 1020;
+                u32 *data = kmalloc(len, GFP_KERNEL);
+
+                data[1024 / sizeof(u32)] = 0x12345678;
+                kfree(data);
+                break;
+        }
+        case CT_WRITE_AFTER_FREE: {
+                size_t len = 1024;
+                u32 *data = kmalloc(len, GFP_KERNEL);
+
+                kfree(data);
+                schedule();
+                memset(data, 0x78, len);
+                break;
+        }
+        case CT_SOFTLOCKUP:
+                preempt_disable();
+                for (;;)
+                        cpu_relax();
+                break;
+        case CT_HARDLOCKUP:
+                local_irq_disable();
+                for (;;)
+                        cpu_relax();
+                break;
+        case CT_HUNG_TASK:
+                set_current_state(TASK_UNINTERRUPTIBLE);
+                schedule();
+                break;
+        case CT_NONE:
+        default:
+                break;
+        }
+
+}
+
+static void lkdtm_handler(void)
 {
-        printk(KERN_INFO "lkdtm : Crash point %s of type %s hit\n",
-                                         cpoint_name, cpoint_type);
-        --count;
+        count--;
+        printk(KERN_INFO "lkdtm: Crash point %s of type %s hit, trigger in %d rounds\n",
+                        cp_name_to_str(cpoint), cp_type_to_str(cptype), count);
 
         if (count == 0) {
-                switch (cptype) {
-                case NONE:
-                        break;
-                case PANIC:
-                        printk(KERN_INFO "lkdtm : PANIC\n");
-                        panic("dumptest");
-                        break;
-                case BUG:
-                        printk(KERN_INFO "lkdtm : BUG\n");
-                        BUG();
-                        break;
-                case EXCEPTION:
-                        printk(KERN_INFO "lkdtm : EXCEPTION\n");
-                        *((int *) 0) = 0;
-                        break;
-                case LOOP:
-                        printk(KERN_INFO "lkdtm : LOOP\n");
-                        for (;;);
-                        break;
-                case OVERFLOW:
-                        printk(KERN_INFO "lkdtm : OVERFLOW\n");
-                        (void) recursive_loop(0);
-                        break;
-                default:
-                        break;
-                }
+                lkdtm_do_action(cptype);
                 count = cpoint_count;
         }
 }
 
-static int __init lkdtm_module_init(void)
+static int lkdtm_register_cpoint(enum cname which)
 {
         int ret;
 
-        if (lkdtm_parse_commandline() == -EINVAL) {
-                printk(KERN_INFO "lkdtm : Invalid command\n");
-                return -EINVAL;
-        }
+        cpoint = CN_INVALID;
+        if (lkdtm.entry != NULL)
+                unregister_jprobe(&lkdtm);
 
-        switch (cpoint) {
-        case INT_HARDWARE_ENTRY:
-                lkdtm.kp.symbol_name = "__do_IRQ";
+        switch (which) {
+        case CN_DIRECT:
+                lkdtm_do_action(cptype);
+                return 0;
+        case CN_INT_HARDWARE_ENTRY:
+                lkdtm.kp.symbol_name = "do_IRQ";
                 lkdtm.entry = (kprobe_opcode_t*) jp_do_irq;
                 break;
-        case INT_HW_IRQ_EN:
+        case CN_INT_HW_IRQ_EN:
                 lkdtm.kp.symbol_name = "handle_IRQ_event";
                 lkdtm.entry = (kprobe_opcode_t*) jp_handle_irq_event;
                 break;
-        case INT_TASKLET_ENTRY:
+        case CN_INT_TASKLET_ENTRY:
                 lkdtm.kp.symbol_name = "tasklet_action";
                 lkdtm.entry = (kprobe_opcode_t*) jp_tasklet_action;
                 break;
-        case FS_DEVRW:
+        case CN_FS_DEVRW:
                 lkdtm.kp.symbol_name = "ll_rw_block";
                 lkdtm.entry = (kprobe_opcode_t*) jp_ll_rw_block;
                 break;
-        case MEM_SWAPOUT:
+        case CN_MEM_SWAPOUT:
                 lkdtm.kp.symbol_name = "shrink_inactive_list";
                 lkdtm.entry = (kprobe_opcode_t*) jp_shrink_inactive_list;
                 break;
-        case TIMERADD:
+        case CN_TIMERADD:
                 lkdtm.kp.symbol_name = "hrtimer_start";
                 lkdtm.entry = (kprobe_opcode_t*) jp_hrtimer_start;
                 break;
-        case SCSI_DISPATCH_CMD:
+        case CN_SCSI_DISPATCH_CMD:
                 lkdtm.kp.symbol_name = "scsi_dispatch_cmd";
                 lkdtm.entry = (kprobe_opcode_t*) jp_scsi_dispatch_cmd;
                 break;
-        case IDE_CORE_CP:
+        case CN_IDE_CORE_CP:
 #ifdef CONFIG_IDE
                 lkdtm.kp.symbol_name = "generic_ide_ioctl";
                 lkdtm.entry = (kprobe_opcode_t*) jp_generic_ide_ioctl;
 #else
-                printk(KERN_INFO "lkdtm : Crash point not available\n");
+                printk(KERN_INFO "lkdtm: Crash point not available\n");
+                return -EINVAL;
 #endif
                 break;
         default:
-                printk(KERN_INFO "lkdtm : Invalid Crash Point\n");
-                break;
+                printk(KERN_INFO "lkdtm: Invalid Crash Point\n");
+                return -EINVAL;
         }
 
+        cpoint = which;
         if ((ret = register_jprobe(&lkdtm)) < 0) {
-                printk(KERN_INFO "lkdtm : Couldn't register jprobe\n");
-                return ret;
+                printk(KERN_INFO "lkdtm: Couldn't register jprobe\n");
+                cpoint = CN_INVALID;
+        }
+
+        return ret;
+}
+
+static ssize_t do_register_entry(enum cname which, struct file *f,
+                const char __user *user_buf, size_t count, loff_t *off)
+{
+        char *buf;
+        int err;
+
+        if (count >= PAGE_SIZE)
+                return -EINVAL;
+
+        buf = (char *)__get_free_page(GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        if (copy_from_user(buf, user_buf, count)) {
+                free_page((unsigned long) buf);
+                return -EFAULT;
+        }
+        /* NULL-terminate and remove enter */
+        buf[count] = '\0';
+        strim(buf);
+
+        cptype = parse_cp_type(buf, count);
+        free_page((unsigned long) buf);
+
+        if (cptype == CT_NONE)
+                return -EINVAL;
+
+        err = lkdtm_register_cpoint(which);
+        if (err < 0)
+                return err;
+
+        *off += count;
+
+        return count;
+}
+
+/* Generic read callback that just prints out the available crash types */
+static ssize_t lkdtm_debugfs_read(struct file *f, char __user *user_buf,
+                size_t count, loff_t *off)
+{
+        char *buf;
+        int i, n, out;
+
+        buf = (char *)__get_free_page(GFP_KERNEL);
+
+        n = snprintf(buf, PAGE_SIZE, "Available crash types:\n");
+        for (i = 0; i < ARRAY_SIZE(cp_type); i++)
+                n += snprintf(buf + n, PAGE_SIZE - n, "%s\n", cp_type[i]);
+        buf[n] = '\0';
+
+        out = simple_read_from_buffer(user_buf, count, off,
+                                      buf, n);
+        free_page((unsigned long) buf);
+
+        return out;
+}
+
+static int lkdtm_debugfs_open(struct inode *inode, struct file *file)
+{
+        return 0;
+}
+
+
+static ssize_t int_hardware_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(CN_INT_HARDWARE_ENTRY, f, buf, count, off);
+}
+
+static ssize_t int_hw_irq_en(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(CN_INT_HW_IRQ_EN, f, buf, count, off);
+}
+
+static ssize_t int_tasklet_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(CN_INT_TASKLET_ENTRY, f, buf, count, off);
+}
+
+static ssize_t fs_devrw_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(CN_FS_DEVRW, f, buf, count, off);
+}
+
+static ssize_t mem_swapout_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(CN_MEM_SWAPOUT, f, buf, count, off);
+}
+
+static ssize_t timeradd_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(CN_TIMERADD, f, buf, count, off);
+}
+
+static ssize_t scsi_dispatch_cmd_entry(struct file *f,
+                const char __user *buf, size_t count, loff_t *off)
+{
+        return do_register_entry(CN_SCSI_DISPATCH_CMD, f, buf, count, off);
+}
+
+static ssize_t ide_core_cp_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(CN_IDE_CORE_CP, f, buf, count, off);
+}
+
+/* Special entry to just crash directly. Available without KPROBEs */
+static ssize_t direct_entry(struct file *f, const char __user *user_buf,
+                size_t count, loff_t *off)
+{
+        enum ctype type;
+        char *buf;
+
+        if (count >= PAGE_SIZE)
+                return -EINVAL;
+        if (count < 1)
+                return -EINVAL;
+
+        buf = (char *)__get_free_page(GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        if (copy_from_user(buf, user_buf, count)) {
+                free_page((unsigned long) buf);
+                return -EFAULT;
+        }
+        /* NULL-terminate and remove enter */
+        buf[count] = '\0';
+        strim(buf);
+
+        type = parse_cp_type(buf, count);
+        free_page((unsigned long) buf);
+        if (type == CT_NONE)
+                return -EINVAL;
+
+        printk(KERN_INFO "lkdtm: Performing direct entry %s\n",
+                        cp_type_to_str(type));
+        lkdtm_do_action(type);
+        *off += count;
+
+        return count;
+}
+
+struct crash_entry {
+        const char *name;
+        const struct file_operations fops;
+};
+
+static const struct crash_entry crash_entries[] = {
+        {"DIRECT", {.read = lkdtm_debugfs_read,
+                        .llseek = generic_file_llseek,
+                        .open = lkdtm_debugfs_open,
+                        .write = direct_entry} },
+        {"INT_HARDWARE_ENTRY", {.read = lkdtm_debugfs_read,
+                        .llseek = generic_file_llseek,
+                        .open = lkdtm_debugfs_open,
+                        .write = int_hardware_entry} },
+        {"INT_HW_IRQ_EN", {.read = lkdtm_debugfs_read,
+                        .llseek = generic_file_llseek,
+                        .open = lkdtm_debugfs_open,
+                        .write = int_hw_irq_en} },
+        {"INT_TASKLET_ENTRY", {.read = lkdtm_debugfs_read,
+                        .llseek = generic_file_llseek,
+                        .open = lkdtm_debugfs_open,
+                        .write = int_tasklet_entry} },
+        {"FS_DEVRW", {.read = lkdtm_debugfs_read,
+                        .llseek = generic_file_llseek,
+                        .open = lkdtm_debugfs_open,
+                        .write = fs_devrw_entry} },
+        {"MEM_SWAPOUT", {.read = lkdtm_debugfs_read,
+                        .llseek = generic_file_llseek,
+                        .open = lkdtm_debugfs_open,
+                        .write = mem_swapout_entry} },
+        {"TIMERADD", {.read = lkdtm_debugfs_read,
+                        .llseek = generic_file_llseek,
+                        .open = lkdtm_debugfs_open,
+                        .write = timeradd_entry} },
+        {"SCSI_DISPATCH_CMD", {.read = lkdtm_debugfs_read,
+                        .llseek = generic_file_llseek,
+                        .open = lkdtm_debugfs_open,
+                        .write = scsi_dispatch_cmd_entry} },
+        {"IDE_CORE_CP", {.read = lkdtm_debugfs_read,
+                        .llseek = generic_file_llseek,
+                        .open = lkdtm_debugfs_open,
+                        .write = ide_core_cp_entry} },
+};
+
+static struct dentry *lkdtm_debugfs_root;
+
+static int __init lkdtm_module_init(void)
+{
+        int ret = -EINVAL;
+        int n_debugfs_entries = 1; /* Assume only the direct entry */
+        int i;
+
+        /* Register debugfs interface */
+        lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL);
+        if (!lkdtm_debugfs_root) {
+                printk(KERN_ERR "lkdtm: creating root dir failed\n");
+                return -ENODEV;
+        }
+
+#ifdef CONFIG_KPROBES
+        n_debugfs_entries = ARRAY_SIZE(crash_entries);
+#endif
+
+        for (i = 0; i < n_debugfs_entries; i++) {
+                const struct crash_entry *cur = &crash_entries[i];
+                struct dentry *de;
+
+                de = debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root,
+                                NULL, &cur->fops);
+                if (de == NULL) {
+                        printk(KERN_ERR "lkdtm: could not create %s\n",
+                                        cur->name);
+                        goto out_err;
+                }
+        }
+
+        if (lkdtm_parse_commandline() == -EINVAL) {
+                printk(KERN_INFO "lkdtm: Invalid command\n");
+                goto out_err;
+        }
+
+        if (cpoint != CN_INVALID && cptype != CT_NONE) {
+                ret = lkdtm_register_cpoint(cpoint);
+                if (ret < 0) {
+                        printk(KERN_INFO "lkdtm: Invalid crash point %d\n",
+                                        cpoint);
+                        goto out_err;
+                }
+                printk(KERN_INFO "lkdtm: Crash point %s of type %s registered\n",
+                                cpoint_name, cpoint_type);
+        } else {
+                printk(KERN_INFO "lkdtm: No crash points registered, enable through debugfs\n");
         }
 
-        printk(KERN_INFO "lkdtm : Crash point %s of type %s registered\n",
-                                                cpoint_name, cpoint_type);
         return 0;
+
+out_err:
+        debugfs_remove_recursive(lkdtm_debugfs_root);
+        return ret;
 }
 
 static void __exit lkdtm_module_exit(void)
 {
-        unregister_jprobe(&lkdtm);
-        printk(KERN_INFO "lkdtm : Crash point unregistered\n");
+        debugfs_remove_recursive(lkdtm_debugfs_root);
+
+        unregister_jprobe(&lkdtm);
+        printk(KERN_INFO "lkdtm: Crash point unregistered\n");
 }
 
 module_init(lkdtm_module_init);
diff --git a/drivers/misc/pch_phub.c b/drivers/misc/pch_phub.c
new file mode 100644
index 000000000000..744b804aca15
--- /dev/null
+++ b/drivers/misc/pch_phub.c
@@ -0,0 +1,717 @@
+/*
+ * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/fs.h>
+#include <linux/uaccess.h>
+#include <linux/string.h>
+#include <linux/pci.h>
+#include <linux/io.h>
+#include <linux/delay.h>
+#include <linux/mutex.h>
+#include <linux/if_ether.h>
+#include <linux/ctype.h>
+
+#define PHUB_STATUS 0x00                /* Status Register offset */
+#define PHUB_CONTROL 0x04               /* Control Register offset */
+#define PHUB_TIMEOUT 0x05               /* Time out value for Status Register */
+#define PCH_PHUB_ROM_WRITE_ENABLE 0x01  /* Enabling for writing ROM */
+#define PCH_PHUB_ROM_WRITE_DISABLE 0x00 /* Disabling for writing ROM */
+#define PCH_PHUB_ROM_START_ADDR 0x14    /* ROM data area start address offset */
+
+/* MAX number of INT_REDUCE_CONTROL registers */
+#define MAX_NUM_INT_REDUCE_CONTROL_REG 128
+#define PCI_DEVICE_ID_PCH1_PHUB 0x8801
+#define PCH_MINOR_NOS 1
+#define CLKCFG_CAN_50MHZ 0x12000000
+#define CLKCFG_CANCLK_MASK 0xFF000000
+
+/* SROM ACCESS Macro */
+#define PCH_WORD_ADDR_MASK (~((1 << 2) - 1))
+
+/* Registers address offset */
+#define PCH_PHUB_ID_REG                         0x0000
+#define PCH_PHUB_QUEUE_PRI_VAL_REG              0x0004
+#define PCH_PHUB_RC_QUEUE_MAXSIZE_REG           0x0008
+#define PCH_PHUB_BRI_QUEUE_MAXSIZE_REG          0x000C
+#define PCH_PHUB_COMP_RESP_TIMEOUT_REG          0x0010
+#define PCH_PHUB_BUS_SLAVE_CONTROL_REG          0x0014
+#define PCH_PHUB_DEADLOCK_AVOID_TYPE_REG        0x0018
+#define PCH_PHUB_INTPIN_REG_WPERMIT_REG0        0x0020
+#define PCH_PHUB_INTPIN_REG_WPERMIT_REG1        0x0024
+#define PCH_PHUB_INTPIN_REG_WPERMIT_REG2        0x0028
+#define PCH_PHUB_INTPIN_REG_WPERMIT_REG3        0x002C
+#define PCH_PHUB_INT_REDUCE_CONTROL_REG_BASE    0x0040
+#define CLKCFG_REG_OFFSET                       0x500
+
+#define PCH_PHUB_OROM_SIZE 15360
+
+/**
+ * struct pch_phub_reg - PHUB register structure
+ * @phub_id_reg:                        PHUB_ID register val
+ * @q_pri_val_reg:                      QUEUE_PRI_VAL register val
+ * @rc_q_maxsize_reg:                   RC_QUEUE_MAXSIZE register val
+ * @bri_q_maxsize_reg:                  BRI_QUEUE_MAXSIZE register val
+ * @comp_resp_timeout_reg:              COMP_RESP_TIMEOUT register val
+ * @bus_slave_control_reg:              BUS_SLAVE_CONTROL_REG register val
+ * @deadlock_avoid_type_reg:            DEADLOCK_AVOID_TYPE register val
+ * @intpin_reg_wpermit_reg0:            INTPIN_REG_WPERMIT register 0 val
+ * @intpin_reg_wpermit_reg1:            INTPIN_REG_WPERMIT register 1 val
+ * @intpin_reg_wpermit_reg2:            INTPIN_REG_WPERMIT register 2 val
+ * @intpin_reg_wpermit_reg3:            INTPIN_REG_WPERMIT register 3 val
+ * @int_reduce_control_reg:             INT_REDUCE_CONTROL registers val
+ * @clkcfg_reg:                         CLK CFG register val
+ * @pch_phub_base_address:              Register base address
+ * @pch_phub_extrom_base_address:       external rom base address
+ */
+struct pch_phub_reg {
+        u32 phub_id_reg;
+        u32 q_pri_val_reg;
+        u32 rc_q_maxsize_reg;
+        u32 bri_q_maxsize_reg;
+        u32 comp_resp_timeout_reg;
+        u32 bus_slave_control_reg;
+        u32 deadlock_avoid_type_reg;
+        u32 intpin_reg_wpermit_reg0;
+        u32 intpin_reg_wpermit_reg1;
+        u32 intpin_reg_wpermit_reg2;
+        u32 intpin_reg_wpermit_reg3;
+        u32 int_reduce_control_reg[MAX_NUM_INT_REDUCE_CONTROL_REG];
+        u32 clkcfg_reg;
+        void __iomem *pch_phub_base_address;
+        void __iomem *pch_phub_extrom_base_address;
+};
+
+/* SROM SPEC for MAC address assignment offset */
+static const int pch_phub_mac_offset[ETH_ALEN] = {0x3, 0x2, 0x1, 0x0, 0xb, 0xa};
+
+static DEFINE_MUTEX(pch_phub_mutex);
+
+/**
+ * pch_phub_read_modify_write_reg() - Reading modifying and writing register
+ * @reg_addr_offset:    Register offset address value.
+ * @data:               Writing value.
+ * @mask:               Mask value.
+ */
+static void pch_phub_read_modify_write_reg(struct pch_phub_reg *chip,
+                                           unsigned int reg_addr_offset,
+                                           unsigned int data, unsigned int mask)
+{
+        void __iomem *reg_addr = chip->pch_phub_base_address + reg_addr_offset;
+        iowrite32(((ioread32(reg_addr) & ~mask)) | data, reg_addr);
+}
+
+/* pch_phub_save_reg_conf - saves register configuration */
+static void pch_phub_save_reg_conf(struct pci_dev *pdev)
+{
+        unsigned int i;
+        struct pch_phub_reg *chip = pci_get_drvdata(pdev);
+
+        void __iomem *p = chip->pch_phub_base_address;
+
+        chip->phub_id_reg = ioread32(p + PCH_PHUB_ID_REG);
+        chip->q_pri_val_reg = ioread32(p + PCH_PHUB_QUEUE_PRI_VAL_REG);
+        chip->rc_q_maxsize_reg = ioread32(p + PCH_PHUB_RC_QUEUE_MAXSIZE_REG);
+        chip->bri_q_maxsize_reg = ioread32(p + PCH_PHUB_BRI_QUEUE_MAXSIZE_REG);
+        chip->comp_resp_timeout_reg =
+                                ioread32(p + PCH_PHUB_COMP_RESP_TIMEOUT_REG);
+        chip->bus_slave_control_reg =
+                                ioread32(p + PCH_PHUB_BUS_SLAVE_CONTROL_REG);
+        chip->deadlock_avoid_type_reg =
+                                ioread32(p + PCH_PHUB_DEADLOCK_AVOID_TYPE_REG);
+        chip->intpin_reg_wpermit_reg0 =
+                                ioread32(p + PCH_PHUB_INTPIN_REG_WPERMIT_REG0);
+        chip->intpin_reg_wpermit_reg1 =
+                                ioread32(p + PCH_PHUB_INTPIN_REG_WPERMIT_REG1);
+        chip->intpin_reg_wpermit_reg2 =
+                                ioread32(p + PCH_PHUB_INTPIN_REG_WPERMIT_REG2);
+        chip->intpin_reg_wpermit_reg3 =
+                                ioread32(p + PCH_PHUB_INTPIN_REG_WPERMIT_REG3);
+        dev_dbg(&pdev->dev, "%s : "
+                "chip->phub_id_reg=%x, "
+                "chip->q_pri_val_reg=%x, "
+                "chip->rc_q_maxsize_reg=%x, "
+                "chip->bri_q_maxsize_reg=%x, "
+                "chip->comp_resp_timeout_reg=%x, "
+                "chip->bus_slave_control_reg=%x, "
+                "chip->deadlock_avoid_type_reg=%x, "
+                "chip->intpin_reg_wpermit_reg0=%x, "
+                "chip->intpin_reg_wpermit_reg1=%x, "
+                "chip->intpin_reg_wpermit_reg2=%x, "
+                "chip->intpin_reg_wpermit_reg3=%x\n", __func__,
+                chip->phub_id_reg,
+                chip->q_pri_val_reg,
+                chip->rc_q_maxsize_reg,
+                chip->bri_q_maxsize_reg,
+                chip->comp_resp_timeout_reg,
+                chip->bus_slave_control_reg,
+                chip->deadlock_avoid_type_reg,
+                chip->intpin_reg_wpermit_reg0,
+                chip->intpin_reg_wpermit_reg1,
+                chip->intpin_reg_wpermit_reg2,
+                chip->intpin_reg_wpermit_reg3);
+        for (i = 0; i < MAX_NUM_INT_REDUCE_CONTROL_REG; i++) {
+                chip->int_reduce_control_reg[i] =
+                    ioread32(p + PCH_PHUB_INT_REDUCE_CONTROL_REG_BASE + 4 * i);
+                dev_dbg(&pdev->dev, "%s : "
+                        "chip->int_reduce_control_reg[%d]=%x\n",
+                        __func__, i, chip->int_reduce_control_reg[i]);
+        }
+        chip->clkcfg_reg = ioread32(p + CLKCFG_REG_OFFSET);
+}
+
+/* pch_phub_restore_reg_conf - restore register configuration */
+static void pch_phub_restore_reg_conf(struct pci_dev *pdev)
+{
+        unsigned int i;
+        struct pch_phub_reg *chip = pci_get_drvdata(pdev);
+        void __iomem *p;
+        p = chip->pch_phub_base_address;
+
+        iowrite32(chip->phub_id_reg, p + PCH_PHUB_ID_REG);
+        iowrite32(chip->q_pri_val_reg, p + PCH_PHUB_QUEUE_PRI_VAL_REG);
+        iowrite32(chip->rc_q_maxsize_reg, p + PCH_PHUB_RC_QUEUE_MAXSIZE_REG);
+        iowrite32(chip->bri_q_maxsize_reg, p + PCH_PHUB_BRI_QUEUE_MAXSIZE_REG);
+        iowrite32(chip->comp_resp_timeout_reg,
+                                        p + PCH_PHUB_COMP_RESP_TIMEOUT_REG);
+        iowrite32(chip->bus_slave_control_reg,
+                                        p + PCH_PHUB_BUS_SLAVE_CONTROL_REG);
+        iowrite32(chip->deadlock_avoid_type_reg,
+                                        p + PCH_PHUB_DEADLOCK_AVOID_TYPE_REG);
+        iowrite32(chip->intpin_reg_wpermit_reg0,
+                                        p + PCH_PHUB_INTPIN_REG_WPERMIT_REG0);
+        iowrite32(chip->intpin_reg_wpermit_reg1,
+                                        p + PCH_PHUB_INTPIN_REG_WPERMIT_REG1);
+        iowrite32(chip->intpin_reg_wpermit_reg2,
+                                        p + PCH_PHUB_INTPIN_REG_WPERMIT_REG2);
+        iowrite32(chip->intpin_reg_wpermit_reg3,
+                                        p + PCH_PHUB_INTPIN_REG_WPERMIT_REG3);
+        dev_dbg(&pdev->dev, "%s : "
+                "chip->phub_id_reg=%x, "
+                "chip->q_pri_val_reg=%x, "
+                "chip->rc_q_maxsize_reg=%x, "
+                "chip->bri_q_maxsize_reg=%x, "
+                "chip->comp_resp_timeout_reg=%x, "
+                "chip->bus_slave_control_reg=%x, "
+                "chip->deadlock_avoid_type_reg=%x, "
+                "chip->intpin_reg_wpermit_reg0=%x, "
+                "chip->intpin_reg_wpermit_reg1=%x, "
+                "chip->intpin_reg_wpermit_reg2=%x, "
+                "chip->intpin_reg_wpermit_reg3=%x\n", __func__,
+                chip->phub_id_reg,
+                chip->q_pri_val_reg,
+                chip->rc_q_maxsize_reg,
+                chip->bri_q_maxsize_reg,
+                chip->comp_resp_timeout_reg,
+                chip->bus_slave_control_reg,
+                chip->deadlock_avoid_type_reg,
+                chip->intpin_reg_wpermit_reg0,
+                chip->intpin_reg_wpermit_reg1,
+                chip->intpin_reg_wpermit_reg2,
+                chip->intpin_reg_wpermit_reg3);
+        for (i = 0; i < MAX_NUM_INT_REDUCE_CONTROL_REG; i++) {
+                iowrite32(chip->int_reduce_control_reg[i],
+                        p + PCH_PHUB_INT_REDUCE_CONTROL_REG_BASE + 4 * i);
+                dev_dbg(&pdev->dev, "%s : "
+                        "chip->int_reduce_control_reg[%d]=%x\n",
+                        __func__, i, chip->int_reduce_control_reg[i]);
+        }
+
+        iowrite32(chip->clkcfg_reg, p + CLKCFG_REG_OFFSET);
+}
+
+/**
+ * pch_phub_read_serial_rom() - Reading Serial ROM
+ * @offset_address:     Serial ROM offset address to read.
+ * @data:               Read buffer for specified Serial ROM value.
+ */
+static void pch_phub_read_serial_rom(struct pch_phub_reg *chip,
+                                     unsigned int offset_address, u8 *data)
+{
+        void __iomem *mem_addr = chip->pch_phub_extrom_base_address +
+                                                                offset_address;
+
+        *data = ioread8(mem_addr);
+}
+
+/**
+ * pch_phub_write_serial_rom() - Writing Serial ROM
+ * @offset_address:     Serial ROM offset address.
+ * @data:               Serial ROM value to write.
+ */
+static int pch_phub_write_serial_rom(struct pch_phub_reg *chip,
+                                     unsigned int offset_address, u8 data)
+{
+        void __iomem *mem_addr = chip->pch_phub_extrom_base_address +
+                                        (offset_address & PCH_WORD_ADDR_MASK);
+        int i;
+        unsigned int word_data;
+        unsigned int pos;
+        unsigned int mask;
+        pos = (offset_address % 4) * 8;
+        mask = ~(0xFF << pos);
+
+        iowrite32(PCH_PHUB_ROM_WRITE_ENABLE,
+                        chip->pch_phub_extrom_base_address + PHUB_CONTROL);
+
+        word_data = ioread32(mem_addr);
+        iowrite32((word_data & mask) | (u32)data << pos, mem_addr);
+
+        i = 0;
+        while (ioread8(chip->pch_phub_extrom_base_address +
+                                                PHUB_STATUS) != 0x00) {
+                msleep(1);
+                if (i == PHUB_TIMEOUT)
+                        return -ETIMEDOUT;
+                i++;
+        }
+
+        iowrite32(PCH_PHUB_ROM_WRITE_DISABLE,
+                        chip->pch_phub_extrom_base_address + PHUB_CONTROL);
+
+        return 0;
+}
+
+/**
+ * pch_phub_read_serial_rom_val() - Read Serial ROM value
+ * @offset_address:     Serial ROM address offset value.
+ * @data:               Serial ROM value to read.
+ */
+static void pch_phub_read_serial_rom_val(struct pch_phub_reg *chip,
+                                         unsigned int offset_address, u8 *data)
+{
+        unsigned int mem_addr;
+
+        mem_addr = PCH_PHUB_ROM_START_ADDR +
+                        pch_phub_mac_offset[offset_address];
+
+        pch_phub_read_serial_rom(chip, mem_addr, data);
+}
+
+/**
+ * pch_phub_write_serial_rom_val() - writing Serial ROM value
+ * @offset_address:     Serial ROM address offset value.
+ * @data:               Serial ROM value.
+ */
+static int pch_phub_write_serial_rom_val(struct pch_phub_reg *chip,
+                                         unsigned int offset_address, u8 data)
+{
+        int retval;
+        unsigned int mem_addr;
+
+        mem_addr = PCH_PHUB_ROM_START_ADDR +
+                        pch_phub_mac_offset[offset_address];
+
+        retval = pch_phub_write_serial_rom(chip, mem_addr, data);
+
+        return retval;
+}
+
+/* pch_phub_gbe_serial_rom_conf - makes Serial ROM header format configuration
+ * for Gigabit Ethernet MAC address
+ */
+static int pch_phub_gbe_serial_rom_conf(struct pch_phub_reg *chip)
+{
+        int retval;
+
+        retval = pch_phub_write_serial_rom(chip, 0x0b, 0xbc);
+        retval |= pch_phub_write_serial_rom(chip, 0x0a, 0x10);
+        retval |= pch_phub_write_serial_rom(chip, 0x09, 0x01);
+        retval |= pch_phub_write_serial_rom(chip, 0x08, 0x02);
+
+        retval |= pch_phub_write_serial_rom(chip, 0x0f, 0x00);
+        retval |= pch_phub_write_serial_rom(chip, 0x0e, 0x00);
+        retval |= pch_phub_write_serial_rom(chip, 0x0d, 0x00);
+        retval |= pch_phub_write_serial_rom(chip, 0x0c, 0x80);
+
+        retval |= pch_phub_write_serial_rom(chip, 0x13, 0xbc);
+        retval |= pch_phub_write_serial_rom(chip, 0x12, 0x10);
+        retval |= pch_phub_write_serial_rom(chip, 0x11, 0x01);
+        retval |= pch_phub_write_serial_rom(chip, 0x10, 0x18);
+
+        retval |= pch_phub_write_serial_rom(chip, 0x1b, 0xbc);
+        retval |= pch_phub_write_serial_rom(chip, 0x1a, 0x10);
+        retval |= pch_phub_write_serial_rom(chip, 0x19, 0x01);
+        retval |= pch_phub_write_serial_rom(chip, 0x18, 0x19);
+
+        retval |= pch_phub_write_serial_rom(chip, 0x23, 0xbc);
+        retval |= pch_phub_write_serial_rom(chip, 0x22, 0x10);
+        retval |= pch_phub_write_serial_rom(chip, 0x21, 0x01);
+        retval |= pch_phub_write_serial_rom(chip, 0x20, 0x3a);
+
+        retval |= pch_phub_write_serial_rom(chip, 0x27, 0x01);
+        retval |= pch_phub_write_serial_rom(chip, 0x26, 0x00);
+        retval |= pch_phub_write_serial_rom(chip, 0x25, 0x00);
+        retval |= pch_phub_write_serial_rom(chip, 0x24, 0x00);
+
+        return retval;
+}
+
+/**
+ * pch_phub_read_gbe_mac_addr() - Read Gigabit Ethernet MAC address
+ * @offset_address:     Gigabit Ethernet MAC address offset value.
+ * @data:               Buffer of the Gigabit Ethernet MAC address value.
+ */
+static void pch_phub_read_gbe_mac_addr(struct pch_phub_reg *chip, u8 *data)
+{
+        int i;
+        for (i = 0; i < ETH_ALEN; i++)
+                pch_phub_read_serial_rom_val(chip, i, &data[i]);
+}
+
+/**
+ * pch_phub_write_gbe_mac_addr() - Write MAC address
+ * @offset_address:     Gigabit Ethernet MAC address offset value.
+ * @data:               Gigabit Ethernet MAC address value.
+ */
+static int pch_phub_write_gbe_mac_addr(struct pch_phub_reg *chip, u8 *data)
+{
+        int retval;
+        int i;
+
+        retval = pch_phub_gbe_serial_rom_conf(chip);
+        if (retval)
+                return retval;
+
+        for (i = 0; i < ETH_ALEN; i++) {
+                retval = pch_phub_write_serial_rom_val(chip, i, data[i]);
+                if (retval)
+                        return retval;
+        }
+
+        return retval;
+}
+
+static ssize_t pch_phub_bin_read(struct file *filp, struct kobject *kobj,
+                                 struct bin_attribute *attr, char *buf,
+                                 loff_t off, size_t count)
+{
+        unsigned int rom_signature;
+        unsigned char rom_length;
+        unsigned int tmp;
+        unsigned int addr_offset;
+        unsigned int orom_size;
+        int ret;
+        int err;
+
+        struct pch_phub_reg *chip =
+                dev_get_drvdata(container_of(kobj, struct device, kobj));
+
+        ret = mutex_lock_interruptible(&pch_phub_mutex);
+        if (ret) {
+                err = -ERESTARTSYS;
+                goto return_err_nomutex;
+        }
+
+        /* Get Rom signature */
+        pch_phub_read_serial_rom(chip, 0x80, (unsigned char *)&rom_signature);
+        rom_signature &= 0xff;
+        pch_phub_read_serial_rom(chip, 0x81, (unsigned char *)&tmp);
+        rom_signature |= (tmp & 0xff) << 8;
+        if (rom_signature == 0xAA55) {
+                pch_phub_read_serial_rom(chip, 0x82, &rom_length);
+                orom_size = rom_length * 512;
+                if (orom_size < off) {
+                        addr_offset = 0;
+                        goto return_ok;
+                }
+                if (orom_size < count) {
+                        addr_offset = 0;
+                        goto return_ok;
+                }
+
+                for (addr_offset = 0; addr_offset < count; addr_offset++) {
+                        pch_phub_read_serial_rom(chip, 0x80 + addr_offset + off,
+                                                         &buf[addr_offset]);
+                }
+        } else {
+                err = -ENODATA;
+                goto return_err;
+        }
+return_ok:
+        mutex_unlock(&pch_phub_mutex);
+        return addr_offset;
+
+return_err:
+        mutex_unlock(&pch_phub_mutex);
+return_err_nomutex:
+        return err;
+}
+
+static ssize_t pch_phub_bin_write(struct file *filp, struct kobject *kobj,
+                                  struct bin_attribute *attr,
+                                  char *buf, loff_t off, size_t count)
+{
+        int err;
+        unsigned int addr_offset;
+        int ret;
+        struct pch_phub_reg *chip =
+                dev_get_drvdata(container_of(kobj, struct device, kobj));
+
+        ret = mutex_lock_interruptible(&pch_phub_mutex);
+        if (ret)
+                return -ERESTARTSYS;
+
+        if (off > PCH_PHUB_OROM_SIZE) {
+                addr_offset = 0;
+                goto return_ok;
+        }
+        if (count > PCH_PHUB_OROM_SIZE) {
+                addr_offset = 0;
+                goto return_ok;
+        }
+
+        for (addr_offset = 0; addr_offset < count; addr_offset++) {
+                if (PCH_PHUB_OROM_SIZE < off + addr_offset)
+                        goto return_ok;
+
+                ret = pch_phub_write_serial_rom(chip, 0x80 + addr_offset + off,
+                                                       buf[addr_offset]);
+                if (ret) {
+                        err = ret;
+                        goto return_err;
+                }
+        }
+
+return_ok:
+        mutex_unlock(&pch_phub_mutex);
+        return addr_offset;
+
+return_err:
+        mutex_unlock(&pch_phub_mutex);
+        return err;
+}
+
+static ssize_t show_pch_mac(struct device *dev, struct device_attribute *attr,
+                            char *buf)
+{
+        u8 mac[8];
+        struct pch_phub_reg *chip = dev_get_drvdata(dev);
+
+        pch_phub_read_gbe_mac_addr(chip, mac);
+
+        return sprintf(buf, "%02x:%02x:%02x:%02x:%02x:%02x\n",
+                                mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
+}
+
+static ssize_t store_pch_mac(struct device *dev, struct device_attribute *attr,
+                             const char *buf, size_t count)
+{
+        u8 mac[6];
+        struct pch_phub_reg *chip = dev_get_drvdata(dev);
+
+        if (count != 18)
+                return -EINVAL;
+
+        sscanf(buf, "%02x:%02x:%02x:%02x:%02x:%02x",
+                (u32 *)&mac[0], (u32 *)&mac[1], (u32 *)&mac[2], (u32 *)&mac[3],
+                (u32 *)&mac[4], (u32 *)&mac[5]);
+
+        pch_phub_write_gbe_mac_addr(chip, mac);
+
+        return count;
+}
+
+static DEVICE_ATTR(pch_mac, S_IRUGO | S_IWUSR, show_pch_mac, store_pch_mac);
+
+static struct bin_attribute pch_bin_attr = {
+        .attr = {
+                .name = "pch_firmware",
+                .mode = S_IRUGO | S_IWUSR,
+        },
+        .size = PCH_PHUB_OROM_SIZE + 1,
+        .read = pch_phub_bin_read,
+        .write = pch_phub_bin_write,
+};
+
+static int __devinit pch_phub_probe(struct pci_dev *pdev,
+                                    const struct pci_device_id *id)
+{
+        int retval;
+
+        int ret;
+        ssize_t rom_size;
+        struct pch_phub_reg *chip;
+
+        chip = kzalloc(sizeof(struct pch_phub_reg), GFP_KERNEL);
+        if (chip == NULL)
+                return -ENOMEM;
+
+        ret = pci_enable_device(pdev);
+        if (ret) {
+                dev_err(&pdev->dev,
+                "%s : pci_enable_device FAILED(ret=%d)", __func__, ret);
+                goto err_pci_enable_dev;
+        }
+        dev_dbg(&pdev->dev, "%s : pci_enable_device returns %d\n", __func__,
+                ret);
+
+        ret = pci_request_regions(pdev, KBUILD_MODNAME);
+        if (ret) {
+                dev_err(&pdev->dev,
+                "%s : pci_request_regions FAILED(ret=%d)", __func__, ret);
+                goto err_req_regions;
+        }
+        dev_dbg(&pdev->dev, "%s : "
+                "pci_request_regions returns %d\n", __func__, ret);
+
+        chip->pch_phub_base_address = pci_iomap(pdev, 1, 0);
+
+
+        if (chip->pch_phub_base_address == 0) {
+                dev_err(&pdev->dev, "%s : pci_iomap FAILED", __func__);
+                ret = -ENOMEM;
+                goto err_pci_iomap;
+        }
+        dev_dbg(&pdev->dev, "%s : pci_iomap SUCCESS and value "
+                "in pch_phub_base_address variable is %p\n", __func__,
+                chip->pch_phub_base_address);
+        chip->pch_phub_extrom_base_address = pci_map_rom(pdev, &rom_size);
+
+        if (chip->pch_phub_extrom_base_address == 0) {
+                dev_err(&pdev->dev, "%s : pci_map_rom FAILED", __func__);
+                ret = -ENOMEM;
+                goto err_pci_map;
+        }
+        dev_dbg(&pdev->dev, "%s : "
+                "pci_map_rom SUCCESS and value in "
+                "pch_phub_extrom_base_address variable is %p\n", __func__,
+                chip->pch_phub_extrom_base_address);
+
+        pci_set_drvdata(pdev, chip);
+
+        retval = sysfs_create_file(&pdev->dev.kobj, &dev_attr_pch_mac.attr);
+        if (retval)
+                goto err_sysfs_create;
+
+        retval = sysfs_create_bin_file(&pdev->dev.kobj, &pch_bin_attr);
+        if (retval)
+                goto exit_bin_attr;
+
+        pch_phub_read_modify_write_reg(chip, (unsigned int)CLKCFG_REG_OFFSET,
+                                        CLKCFG_CAN_50MHZ, CLKCFG_CANCLK_MASK);
+
+        /* set the prefech value */
+        iowrite32(0x000affaa, chip->pch_phub_base_address + 0x14);
+        /* set the interrupt delay value */
+        iowrite32(0x25, chip->pch_phub_base_address + 0x44);
+
+        return 0;
+exit_bin_attr:
+        sysfs_remove_file(&pdev->dev.kobj, &dev_attr_pch_mac.attr);
+
+err_sysfs_create:
+        pci_unmap_rom(pdev, chip->pch_phub_extrom_base_address);
+err_pci_map:
+        pci_iounmap(pdev, chip->pch_phub_base_address);
+err_pci_iomap:
+        pci_release_regions(pdev);
+err_req_regions:
+        pci_disable_device(pdev);
+err_pci_enable_dev:
+        kfree(chip);
+        dev_err(&pdev->dev, "%s returns %d\n", __func__, ret);
+        return ret;
+}
+
+static void __devexit pch_phub_remove(struct pci_dev *pdev)
+{
+        struct pch_phub_reg *chip = pci_get_drvdata(pdev);
+
+        sysfs_remove_file(&pdev->dev.kobj, &dev_attr_pch_mac.attr);
+        sysfs_remove_bin_file(&pdev->dev.kobj, &pch_bin_attr);
+        pci_unmap_rom(pdev, chip->pch_phub_extrom_base_address);
+        pci_iounmap(pdev, chip->pch_phub_base_address);
+        pci_release_regions(pdev);
+        pci_disable_device(pdev);
+        kfree(chip);
+}
+
+#ifdef CONFIG_PM
+
+static int pch_phub_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        int ret;
+
+        pch_phub_save_reg_conf(pdev);
+        ret = pci_save_state(pdev);
+        if (ret) {
+                dev_err(&pdev->dev,
+                        " %s -pci_save_state returns %d\n", __func__, ret);
+                return ret;
+        }
+        pci_enable_wake(pdev, PCI_D3hot, 0);
+        pci_disable_device(pdev);
+        pci_set_power_state(pdev, pci_choose_state(pdev, state));
+
+        return 0;
+}
+
+static int pch_phub_resume(struct pci_dev *pdev)
+{
+        int ret;
+
+        pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
+        ret = pci_enable_device(pdev);
+        if (ret) {
+                dev_err(&pdev->dev,
+                "%s-pci_enable_device failed(ret=%d) ", __func__, ret);
+                return ret;
+        }
+
+        pci_enable_wake(pdev, PCI_D3hot, 0);
+        pch_phub_restore_reg_conf(pdev);
+
+        return 0;
+}
+#else
+#define pch_phub_suspend NULL
+#define pch_phub_resume NULL
+#endif /* CONFIG_PM */
+
+static struct pci_device_id pch_phub_pcidev_id[] = {
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_PCH1_PHUB)},
+        {0,}
+};
+
+static struct pci_driver pch_phub_driver = {
+        .name = "pch_phub",
+        .id_table = pch_phub_pcidev_id,
+        .probe = pch_phub_probe,
+        .remove = __devexit_p(pch_phub_remove),
+        .suspend = pch_phub_suspend,
+        .resume = pch_phub_resume
+};
+
+static int __init pch_phub_pci_init(void)
+{
+        return pci_register_driver(&pch_phub_driver);
+}
+
+static void __exit pch_phub_pci_exit(void)
+{
+        pci_unregister_driver(&pch_phub_driver);
+}
+
+module_init(pch_phub_pci_init);
+module_exit(pch_phub_pci_exit);
+
+MODULE_DESCRIPTION("PCH Packet Hub PCI Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/misc/phantom.c b/drivers/misc/phantom.c
index fa57b67593ae..b05db55c8c8e 100644
--- a/drivers/misc/phantom.c
+++ b/drivers/misc/phantom.c
@@ -21,8 +21,10 @@
 #include <linux/poll.h>
 #include <linux/interrupt.h>
 #include <linux/cdev.h>
+#include <linux/slab.h>
 #include <linux/phantom.h>
-#include <linux/smp_lock.h>
+#include <linux/sched.h>
+#include <linux/mutex.h>
 
 #include <asm/atomic.h>
 #include <asm/io.h>
@@ -36,6 +38,7 @@
 #define PHB_RUNNING             1
 #define PHB_NOT_OH              2
 
+static DEFINE_MUTEX(phantom_mutex);
 static struct class *phantom_class;
 static int phantom_major;
 
@@ -213,17 +216,17 @@ static int phantom_open(struct inode *inode, struct file *file)
         struct phantom_device *dev = container_of(inode->i_cdev,
                         struct phantom_device, cdev);
 
-        lock_kernel();
+        mutex_lock(&phantom_mutex);
         nonseekable_open(inode, file);
 
         if (mutex_lock_interruptible(&dev->open_lock)) {
-                unlock_kernel();
+                mutex_unlock(&phantom_mutex);
                 return -ERESTARTSYS;
         }
 
         if (dev->opened) {
                 mutex_unlock(&dev->open_lock);
-                unlock_kernel();
+                mutex_unlock(&phantom_mutex);
                 return -EINVAL;
         }
 
@@ -234,7 +237,7 @@ static int phantom_open(struct inode *inode, struct file *file)
         atomic_set(&dev->counter, 0);
         dev->opened++;
         mutex_unlock(&dev->open_lock);
-        unlock_kernel();
+        mutex_unlock(&phantom_mutex);
         return 0;
 }
 
@@ -271,12 +274,13 @@ static unsigned int phantom_poll(struct file *file, poll_table *wait)
         return mask;
 }
 
-static struct file_operations phantom_file_ops = {
+static const struct file_operations phantom_file_ops = {
         .open = phantom_open,
         .release = phantom_release,
         .unlocked_ioctl = phantom_ioctl,
         .compat_ioctl = phantom_compat_ioctl,
         .poll = phantom_poll,
+        .llseek = no_llseek,
 };
 
 static irqreturn_t phantom_isr(int irq, void *data)
@@ -339,8 +343,10 @@ static int __devinit phantom_probe(struct pci_dev *pdev,
         int retval;
 
         retval = pci_enable_device(pdev);
-        if (retval)
+        if (retval) {
+                dev_err(&pdev->dev, "pci_enable_device failed!\n");
                 goto err;
+        }
 
         minor = phantom_get_free();
         if (minor == PHANTOM_MAX_MINORS) {
@@ -352,8 +358,10 @@ static int __devinit phantom_probe(struct pci_dev *pdev,
         phantom_devices[minor] = 1;
 
         retval = pci_request_regions(pdev, "phantom");
-        if (retval)
+        if (retval) {
+                dev_err(&pdev->dev, "pci_request_regions failed!\n");
                 goto err_null;
+        }
 
         retval = -ENOMEM;
         pht = kzalloc(sizeof(*pht), GFP_KERNEL);
@@ -496,12 +504,7 @@ static struct pci_driver phantom_pci_driver = {
         .resume = phantom_resume
 };
 
-static ssize_t phantom_show_version(struct class *cls, char *buf)
-{
-        return sprintf(buf, PHANTOM_VERSION "\n");
-}
-
-static CLASS_ATTR(version, 0444, phantom_show_version, NULL);
+static CLASS_ATTR_STRING(version, 0444, PHANTOM_VERSION);
 
 static int __init phantom_init(void)
 {
@@ -514,7 +517,7 @@ static int __init phantom_init(void)
                 printk(KERN_ERR "phantom: can't register phantom class\n");
                 goto err;
         }
-        retval = class_create_file(phantom_class, &class_attr_version);
+        retval = class_create_file(phantom_class, &class_attr_version.attr);
         if (retval) {
                 printk(KERN_ERR "phantom: can't create sysfs version file\n");
                 goto err_class;
@@ -540,7 +543,7 @@ static int __init phantom_init(void)
 err_unchr:
         unregister_chrdev_region(dev, PHANTOM_MAX_MINORS);
 err_attr:
-        class_remove_file(phantom_class, &class_attr_version);
+        class_remove_file(phantom_class, &class_attr_version.attr);
 err_class:
         class_destroy(phantom_class);
 err:
@@ -553,7 +556,7 @@ static void __exit phantom_exit(void)
 
         unregister_chrdev_region(MKDEV(phantom_major, 0), PHANTOM_MAX_MINORS);
 
-        class_remove_file(phantom_class, &class_attr_version);
+        class_remove_file(phantom_class, &class_attr_version.attr);
         class_destroy(phantom_class);
 
         pr_debug("phantom: module successfully removed\n");
diff --git a/drivers/misc/sgi-gru/gru.h b/drivers/misc/sgi-gru/gru.h
index f93f03a9e6e9..3ad76cd18b4b 100644
--- a/drivers/misc/sgi-gru/gru.h
+++ b/drivers/misc/sgi-gru/gru.h
@@ -53,6 +53,17 @@ struct gru_chiplet_info {
         int     free_user_cbr;
 };
 
+/*
+ * Statictics kept for each context.
+ */
+struct gru_gseg_statistics {
+        unsigned long   fmm_tlbmiss;
+        unsigned long   upm_tlbmiss;
+        unsigned long   tlbdropin;
+        unsigned long   context_stolen;
+        unsigned long   reserved[10];
+};
+
 /* Flags for GRU options on the gru_create_context() call */
 /* Select one of the follow 4 options to specify how TLB misses are handled */
 #define GRU_OPT_MISS_DEFAULT    0x0000  /* Use default mode */
diff --git a/drivers/misc/sgi-gru/gru_instructions.h b/drivers/misc/sgi-gru/gru_instructions.h
index 3c9c06618e6a..d95587cc794c 100644
--- a/drivers/misc/sgi-gru/gru_instructions.h
+++ b/drivers/misc/sgi-gru/gru_instructions.h
@@ -34,17 +34,17 @@ extern void gru_wait_abort_proc(void *cb);
 #include <asm/intrinsics.h>
 #define __flush_cache(p)                ia64_fc((unsigned long)p)
 /* Use volatile on IA64 to ensure ordering via st4.rel */
-#define gru_ordered_store_int(p, v)                                     \
+#define gru_ordered_store_ulong(p, v)                                   \
                 do {                                                    \
                         barrier();                                      \
-                        *((volatile int *)(p)) = v; /* force st.rel */  \
+                        *((volatile unsigned long *)(p)) = v; /* force st.rel */        \
                 } while (0)
 #elif defined(CONFIG_X86_64)
 #define __flush_cache(p)                clflush(p)
-#define gru_ordered_store_int(p, v)                                     \
+#define gru_ordered_store_ulong(p, v)                                   \
                 do {                                                    \
                         barrier();                                      \
-                        *(int *)p = v;                                  \
+                        *(unsigned long *)p = v;                        \
                 } while (0)
 #else
 #error "Unsupported architecture"
@@ -129,8 +129,13 @@ struct gru_instruction_bits {
  */
 struct gru_instruction {
     /* DW 0 */
-    unsigned int                op32;    /* icmd,xtype,iaa0,ima,opc */
-    unsigned int                tri0;
+    union {
+        unsigned long           op64;    /* icmd,xtype,iaa0,ima,opc,tri0 */
+        struct {
+                unsigned int    op32;
+                unsigned int    tri0;
+        };
+    };
     unsigned long               tri1_bufsize;           /* DW 1 */
     unsigned long               baddr0;                 /* DW 2 */
     unsigned long               nelem;                  /* DW 3 */
@@ -140,7 +145,7 @@ struct gru_instruction {
     unsigned long               avalue;                 /* DW 7 */
 };
 
-/* Some shifts and masks for the low 32 bits of a GRU command */
+/* Some shifts and masks for the low 64 bits of a GRU command */
 #define GRU_CB_ICMD_SHFT        0
 #define GRU_CB_ICMD_MASK        0x1
 #define GRU_CB_XTYPE_SHFT       8
@@ -155,6 +160,10 @@ struct gru_instruction {
 #define GRU_CB_OPC_MASK         0xff
 #define GRU_CB_EXOPC_SHFT       24
 #define GRU_CB_EXOPC_MASK       0xff
+#define GRU_IDEF2_SHFT          32
+#define GRU_IDEF2_MASK          0x3ffff
+#define GRU_ISTATUS_SHFT        56
+#define GRU_ISTATUS_MASK        0x3
 
 /* GRU instruction opcodes (opc field) */
 #define OP_NOP          0x00
@@ -256,6 +265,7 @@ struct gru_instruction {
 #define CBE_CAUSE_PROTOCOL_STATE_DATA_ERROR     (1 << 16)
 #define CBE_CAUSE_RA_RESPONSE_DATA_ERROR        (1 << 17)
 #define CBE_CAUSE_HA_RESPONSE_DATA_ERROR        (1 << 18)
+#define CBE_CAUSE_FORCED_ERROR                  (1 << 19)
 
 /* CBE cbrexecstatus bits */
 #define CBR_EXS_ABORT_OCC_BIT                   0
@@ -264,13 +274,15 @@ struct gru_instruction {
 #define CBR_EXS_QUEUED_BIT                      3
 #define CBR_EXS_TLB_INVAL_BIT                   4
 #define CBR_EXS_EXCEPTION_BIT                   5
+#define CBR_EXS_CB_INT_PENDING_BIT              6
 
 #define CBR_EXS_ABORT_OCC                       (1 << CBR_EXS_ABORT_OCC_BIT)
 #define CBR_EXS_INT_OCC                         (1 << CBR_EXS_INT_OCC_BIT)
 #define CBR_EXS_PENDING                         (1 << CBR_EXS_PENDING_BIT)
 #define CBR_EXS_QUEUED                          (1 << CBR_EXS_QUEUED_BIT)
-#define CBR_TLB_INVAL                           (1 << CBR_EXS_TLB_INVAL_BIT)
+#define CBR_EXS_TLB_INVAL                       (1 << CBR_EXS_TLB_INVAL_BIT)
 #define CBR_EXS_EXCEPTION                       (1 << CBR_EXS_EXCEPTION_BIT)
+#define CBR_EXS_CB_INT_PENDING                  (1 << CBR_EXS_CB_INT_PENDING_BIT)
 
 /*
  * Exceptions are retried for the following cases. If any OTHER bits are set
@@ -296,12 +308,14 @@ union gru_mesqhead {
 
 
 /* Generate the low word of a GRU instruction */
-static inline unsigned int
-__opword(unsigned char opcode, unsigned char exopc, unsigned char xtype,
+static inline unsigned long
+__opdword(unsigned char opcode, unsigned char exopc, unsigned char xtype,
        unsigned char iaa0, unsigned char iaa1,
-       unsigned char ima)
+       unsigned long idef2, unsigned char ima)
 {
     return (1 << GRU_CB_ICMD_SHFT) |
+           ((unsigned long)CBS_ACTIVE << GRU_ISTATUS_SHFT) |
+           (idef2<< GRU_IDEF2_SHFT) |
            (iaa0 << GRU_CB_IAA0_SHFT) |
            (iaa1 << GRU_CB_IAA1_SHFT) |
            (ima << GRU_CB_IMA_SHFT) |
@@ -319,12 +333,13 @@ static inline void gru_flush_cache(void *p)
 }
 
 /*
- * Store the lower 32 bits of the command including the "start" bit. Then
+ * Store the lower 64 bits of the command including the "start" bit. Then
  * start the instruction executing.
  */
-static inline void gru_start_instruction(struct gru_instruction *ins, int op32)
+static inline void gru_start_instruction(struct gru_instruction *ins, unsigned long op64)
 {
-        gru_ordered_store_int(ins, op32);
+        gru_ordered_store_ulong(ins, op64);
+        mb();
         gru_flush_cache(ins);
 }
 
@@ -340,6 +355,30 @@ static inline void gru_start_instruction(struct gru_instruction *ins, int op32)
  *      - nelem and stride are in elements
  *      - tri0/tri1 is in bytes for the beginning of the data segment.
  */
+static inline void gru_vload_phys(void *cb, unsigned long gpa,
+                unsigned int tri0, int iaa, unsigned long hints)
+{
+        struct gru_instruction *ins = (struct gru_instruction *)cb;
+
+        ins->baddr0 = (long)gpa | ((unsigned long)iaa << 62);
+        ins->nelem = 1;
+        ins->op1_stride = 1;
+        gru_start_instruction(ins, __opdword(OP_VLOAD, 0, XTYPE_DW, iaa, 0,
+                                        (unsigned long)tri0, CB_IMA(hints)));
+}
+
+static inline void gru_vstore_phys(void *cb, unsigned long gpa,
+                unsigned int tri0, int iaa, unsigned long hints)
+{
+        struct gru_instruction *ins = (struct gru_instruction *)cb;
+
+        ins->baddr0 = (long)gpa | ((unsigned long)iaa << 62);
+        ins->nelem = 1;
+        ins->op1_stride = 1;
+        gru_start_instruction(ins, __opdword(OP_VSTORE, 0, XTYPE_DW, iaa, 0,
+                                        (unsigned long)tri0, CB_IMA(hints)));
+}
+
 static inline void gru_vload(void *cb, unsigned long mem_addr,
                 unsigned int tri0, unsigned char xtype, unsigned long nelem,
                 unsigned long stride, unsigned long hints)
@@ -348,10 +387,9 @@ static inline void gru_vload(void *cb, unsigned long mem_addr,
 
         ins->baddr0 = (long)mem_addr;
         ins->nelem = nelem;
-        ins->tri0 = tri0;
         ins->op1_stride = stride;
-        gru_start_instruction(ins, __opword(OP_VLOAD, 0, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_VLOAD, 0, xtype, IAA_RAM, 0,
+                                        (unsigned long)tri0, CB_IMA(hints)));
 }
 
 static inline void gru_vstore(void *cb, unsigned long mem_addr,
@@ -362,10 +400,9 @@ static inline void gru_vstore(void *cb, unsigned long mem_addr,
 
         ins->baddr0 = (long)mem_addr;
         ins->nelem = nelem;
-        ins->tri0 = tri0;
         ins->op1_stride = stride;
-        gru_start_instruction(ins, __opword(OP_VSTORE, 0, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_VSTORE, 0, xtype, IAA_RAM, 0,
+                                        tri0, CB_IMA(hints)));
 }
 
 static inline void gru_ivload(void *cb, unsigned long mem_addr,
@@ -376,10 +413,9 @@ static inline void gru_ivload(void *cb, unsigned long mem_addr,
 
         ins->baddr0 = (long)mem_addr;
         ins->nelem = nelem;
-        ins->tri0 = tri0;
         ins->tri1_bufsize = tri1;
-        gru_start_instruction(ins, __opword(OP_IVLOAD, 0, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_IVLOAD, 0, xtype, IAA_RAM, 0,
+                                        tri0, CB_IMA(hints)));
 }
 
 static inline void gru_ivstore(void *cb, unsigned long mem_addr,
@@ -390,10 +426,9 @@ static inline void gru_ivstore(void *cb, unsigned long mem_addr,
 
         ins->baddr0 = (long)mem_addr;
         ins->nelem = nelem;
-        ins->tri0 = tri0;
         ins->tri1_bufsize = tri1;
-        gru_start_instruction(ins, __opword(OP_IVSTORE, 0, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_IVSTORE, 0, xtype, IAA_RAM, 0,
+                                        tri0, CB_IMA(hints)));
 }
 
 static inline void gru_vset(void *cb, unsigned long mem_addr,
@@ -406,8 +441,8 @@ static inline void gru_vset(void *cb, unsigned long mem_addr,
         ins->op2_value_baddr1 = value;
         ins->nelem = nelem;
         ins->op1_stride = stride;
-        gru_start_instruction(ins, __opword(OP_VSET, 0, xtype, IAA_RAM, 0,
-                                         CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_VSET, 0, xtype, IAA_RAM, 0,
+                                         0, CB_IMA(hints)));
 }
 
 static inline void gru_ivset(void *cb, unsigned long mem_addr,
@@ -420,8 +455,8 @@ static inline void gru_ivset(void *cb, unsigned long mem_addr,
         ins->op2_value_baddr1 = value;
         ins->nelem = nelem;
         ins->tri1_bufsize = tri1;
-        gru_start_instruction(ins, __opword(OP_IVSET, 0, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_IVSET, 0, xtype, IAA_RAM, 0,
+                                        0, CB_IMA(hints)));
 }
 
 static inline void gru_vflush(void *cb, unsigned long mem_addr,
@@ -433,15 +468,15 @@ static inline void gru_vflush(void *cb, unsigned long mem_addr,
         ins->baddr0 = (long)mem_addr;
         ins->op1_stride = stride;
         ins->nelem = nelem;
-        gru_start_instruction(ins, __opword(OP_VFLUSH, 0, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_VFLUSH, 0, xtype, IAA_RAM, 0,
+                                        0, CB_IMA(hints)));
 }
 
 static inline void gru_nop(void *cb, int hints)
 {
         struct gru_instruction *ins = (void *)cb;
 
-        gru_start_instruction(ins, __opword(OP_NOP, 0, 0, 0, 0, CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_NOP, 0, 0, 0, 0, 0, CB_IMA(hints)));
 }
 
 
@@ -455,10 +490,9 @@ static inline void gru_bcopy(void *cb, const unsigned long src,
         ins->baddr0 = (long)src;
         ins->op2_value_baddr1 = (long)dest;
         ins->nelem = nelem;
-        ins->tri0 = tri0;
         ins->tri1_bufsize = bufsize;
-        gru_start_instruction(ins, __opword(OP_BCOPY, 0, xtype, IAA_RAM,
-                                        IAA_RAM, CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_BCOPY, 0, xtype, IAA_RAM,
+                                        IAA_RAM, tri0, CB_IMA(hints)));
 }
 
 static inline void gru_bstore(void *cb, const unsigned long src,
@@ -470,9 +504,8 @@ static inline void gru_bstore(void *cb, const unsigned long src,
         ins->baddr0 = (long)src;
         ins->op2_value_baddr1 = (long)dest;
         ins->nelem = nelem;
-        ins->tri0 = tri0;
-        gru_start_instruction(ins, __opword(OP_BSTORE, 0, xtype, 0, IAA_RAM,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_BSTORE, 0, xtype, 0, IAA_RAM,
+                                        tri0, CB_IMA(hints)));
 }
 
 static inline void gru_gamir(void *cb, int exopc, unsigned long src,
@@ -481,8 +514,8 @@ static inline void gru_gamir(void *cb, int exopc, unsigned long src,
         struct gru_instruction *ins = (void *)cb;
 
         ins->baddr0 = (long)src;
-        gru_start_instruction(ins, __opword(OP_GAMIR, exopc, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_GAMIR, exopc, xtype, IAA_RAM, 0,
+                                        0, CB_IMA(hints)));
 }
 
 static inline void gru_gamirr(void *cb, int exopc, unsigned long src,
@@ -491,8 +524,8 @@ static inline void gru_gamirr(void *cb, int exopc, unsigned long src,
         struct gru_instruction *ins = (void *)cb;
 
         ins->baddr0 = (long)src;
-        gru_start_instruction(ins, __opword(OP_GAMIRR, exopc, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_GAMIRR, exopc, xtype, IAA_RAM, 0,
+                                        0, CB_IMA(hints)));
 }
 
 static inline void gru_gamer(void *cb, int exopc, unsigned long src,
@@ -505,8 +538,8 @@ static inline void gru_gamer(void *cb, int exopc, unsigned long src,
         ins->baddr0 = (long)src;
         ins->op1_stride = operand1;
         ins->op2_value_baddr1 = operand2;
-        gru_start_instruction(ins, __opword(OP_GAMER, exopc, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_GAMER, exopc, xtype, IAA_RAM, 0,
+                                        0, CB_IMA(hints)));
 }
 
 static inline void gru_gamerr(void *cb, int exopc, unsigned long src,
@@ -518,8 +551,8 @@ static inline void gru_gamerr(void *cb, int exopc, unsigned long src,
         ins->baddr0 = (long)src;
         ins->op1_stride = operand1;
         ins->op2_value_baddr1 = operand2;
-        gru_start_instruction(ins, __opword(OP_GAMERR, exopc, xtype, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_GAMERR, exopc, xtype, IAA_RAM, 0,
+                                        0, CB_IMA(hints)));
 }
 
 static inline void gru_gamxr(void *cb, unsigned long src,
@@ -529,8 +562,8 @@ static inline void gru_gamxr(void *cb, unsigned long src,
 
         ins->baddr0 = (long)src;
         ins->nelem = 4;
-        gru_start_instruction(ins, __opword(OP_GAMXR, EOP_XR_CSWAP, XTYPE_DW,
-                                 IAA_RAM, 0, CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_GAMXR, EOP_XR_CSWAP, XTYPE_DW,
+                                 IAA_RAM, 0, 0, CB_IMA(hints)));
 }
 
 static inline void gru_mesq(void *cb, unsigned long queue,
@@ -541,9 +574,8 @@ static inline void gru_mesq(void *cb, unsigned long queue,
 
         ins->baddr0 = (long)queue;
         ins->nelem = nelem;
-        ins->tri0 = tri0;
-        gru_start_instruction(ins, __opword(OP_MESQ, 0, XTYPE_CL, IAA_RAM, 0,
-                                        CB_IMA(hints)));
+        gru_start_instruction(ins, __opdword(OP_MESQ, 0, XTYPE_CL, IAA_RAM, 0,
+                                        tri0, CB_IMA(hints)));
 }
 
 static inline unsigned long gru_get_amo_value(void *cb)
@@ -662,6 +694,14 @@ static inline void gru_wait_abort(void *cb)
         gru_wait_abort_proc(cb);
 }
 
+/*
+ * Get a pointer to the start of a gseg
+ *      p       - Any valid pointer within the gseg
+ */
+static inline void *gru_get_gseg_pointer (void *p)
+{
+        return (void *)((unsigned long)p & ~(GRU_GSEG_PAGESIZE - 1));
+}
 
 /*
  * Get a pointer to a control block
diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c
index 679e01778286..38657cdaf54d 100644
--- a/drivers/misc/sgi-gru/grufault.c
+++ b/drivers/misc/sgi-gru/grufault.c
@@ -40,6 +40,12 @@
 #include "gru_instructions.h"
 #include <asm/uv/uv_hub.h>
 
+/* Return codes for vtop functions */
+#define VTOP_SUCCESS               0
+#define VTOP_INVALID               -1
+#define VTOP_RETRY                 -2
+
+
 /*
  * Test if a physical address is a valid GRU GSEG address
  */
@@ -90,19 +96,22 @@ static struct gru_thread_state *gru_alloc_locked_gts(unsigned long vaddr)
 {
         struct mm_struct *mm = current->mm;
         struct vm_area_struct *vma;
-        struct gru_thread_state *gts = NULL;
+        struct gru_thread_state *gts = ERR_PTR(-EINVAL);
 
         down_write(&mm->mmap_sem);
         vma = gru_find_vma(vaddr);
-        if (vma)
-                gts = gru_alloc_thread_state(vma, TSID(vaddr, vma));
-        if (gts) {
-                mutex_lock(&gts->ts_ctxlock);
-                downgrade_write(&mm->mmap_sem);
-        } else {
-                up_write(&mm->mmap_sem);
-        }
+        if (!vma)
+                goto err;
 
+        gts = gru_alloc_thread_state(vma, TSID(vaddr, vma));
+        if (IS_ERR(gts))
+                goto err;
+        mutex_lock(&gts->ts_ctxlock);
+        downgrade_write(&mm->mmap_sem);
+        return gts;
+
+err:
+        up_write(&mm->mmap_sem);
         return gts;
 }
 
@@ -122,39 +131,15 @@ static void gru_unlock_gts(struct gru_thread_state *gts)
  * is necessary to prevent the user from seeing a stale cb.istatus that will
  * change as soon as the TFH restart is complete. Races may cause an
  * occasional failure to clear the cb.istatus, but that is ok.
- *
- * If the cb address is not valid (should not happen, but...), nothing
- * bad will happen.. The get_user()/put_user() will fail but there
- * are no bad side-effects.
  */
-static void gru_cb_set_istatus_active(unsigned long __user *cb)
+static void gru_cb_set_istatus_active(struct gru_instruction_bits *cbk)
 {
-        union {
-                struct gru_instruction_bits bits;
-                unsigned long dw;
-        } u;
-
-        if (cb) {
-                get_user(u.dw, cb);
-                u.bits.istatus = CBS_ACTIVE;
-                put_user(u.dw, cb);
+        if (cbk) {
+                cbk->istatus = CBS_ACTIVE;
         }
 }
 
 /*
- * Convert a interrupt IRQ to a pointer to the GRU GTS that caused the
- * interrupt. Interrupts are always sent to a cpu on the blade that contains the
- * GRU (except for headless blades which are not currently supported). A blade
- * has N grus; a block of N consecutive IRQs is assigned to the GRUs. The IRQ
- * number uniquely identifies the GRU chiplet on the local blade that caused the
- * interrupt. Always called in interrupt context.
- */
-static inline struct gru_state *irq_to_gru(int irq)
-{
-        return &gru_base[uv_numa_blade_id()]->bs_grus[irq - IRQ_GRU];
-}
-
-/*
  * Read & clear a TFM
  *
  * The GRU has an array of fault maps. A map is private to a cpu
@@ -207,10 +192,11 @@ static int non_atomic_pte_lookup(struct vm_area_struct *vma,
 {
         struct page *page;
 
-        /* ZZZ Need to handle HUGE pages */
-        if (is_vm_hugetlb_page(vma))
-                return -EFAULT;
+#ifdef CONFIG_HUGETLB_PAGE
+        *pageshift = is_vm_hugetlb_page(vma) ? HPAGE_SHIFT : PAGE_SHIFT;
+#else
         *pageshift = PAGE_SHIFT;
+#endif
         if (get_user_pages
             (current, current->mm, vaddr, 1, write, 0, &page, NULL) <= 0)
                 return -EFAULT;
@@ -268,7 +254,6 @@ static int atomic_pte_lookup(struct vm_area_struct *vma, unsigned long vaddr,
         return 0;
 
 err:
-        local_irq_enable();
         return 1;
 }
 
@@ -301,14 +286,69 @@ static int gru_vtop(struct gru_thread_state *gts, unsigned long vaddr,
         paddr = paddr & ~((1UL << ps) - 1);
         *gpa = uv_soc_phys_ram_to_gpa(paddr);
         *pageshift = ps;
-        return 0;
+        return VTOP_SUCCESS;
 
 inval:
-        return -1;
+        return VTOP_INVALID;
 upm:
-        return -2;
+        return VTOP_RETRY;
+}
+
+
+/*
+ * Flush a CBE from cache. The CBE is clean in the cache. Dirty the
+ * CBE cacheline so that the line will be written back to home agent.
+ * Otherwise the line may be silently dropped. This has no impact
+ * except on performance.
+ */
+static void gru_flush_cache_cbe(struct gru_control_block_extended *cbe)
+{
+        if (unlikely(cbe)) {
+                cbe->cbrexecstatus = 0;         /* make CL dirty */
+                gru_flush_cache(cbe);
+        }
 }
 
+/*
+ * Preload the TLB with entries that may be required. Currently, preloading
+ * is implemented only for BCOPY. Preload  <tlb_preload_count> pages OR to
+ * the end of the bcopy tranfer, whichever is smaller.
+ */
+static void gru_preload_tlb(struct gru_state *gru,
+                        struct gru_thread_state *gts, int atomic,
+                        unsigned long fault_vaddr, int asid, int write,
+                        unsigned char tlb_preload_count,
+                        struct gru_tlb_fault_handle *tfh,
+                        struct gru_control_block_extended *cbe)
+{
+        unsigned long vaddr = 0, gpa;
+        int ret, pageshift;
+
+        if (cbe->opccpy != OP_BCOPY)
+                return;
+
+        if (fault_vaddr == cbe->cbe_baddr0)
+                vaddr = fault_vaddr + GRU_CACHE_LINE_BYTES * cbe->cbe_src_cl - 1;
+        else if (fault_vaddr == cbe->cbe_baddr1)
+                vaddr = fault_vaddr + (1 << cbe->xtypecpy) * cbe->cbe_nelemcur - 1;
+
+        fault_vaddr &= PAGE_MASK;
+        vaddr &= PAGE_MASK;
+        vaddr = min(vaddr, fault_vaddr + tlb_preload_count * PAGE_SIZE);
+
+        while (vaddr > fault_vaddr) {
+                ret = gru_vtop(gts, vaddr, write, atomic, &gpa, &pageshift);
+                if (ret || tfh_write_only(tfh, gpa, GAA_RAM, vaddr, asid, write,
+                                          GRU_PAGESIZE(pageshift)))
+                        return;
+                gru_dbg(grudev,
+                        "%s: gid %d, gts 0x%p, tfh 0x%p, vaddr 0x%lx, asid 0x%x, rw %d, ps %d, gpa 0x%lx\n",
+                        atomic ? "atomic" : "non-atomic", gru->gs_gid, gts, tfh,
+                        vaddr, asid, write, pageshift, gpa);
+                vaddr -= PAGE_SIZE;
+                STAT(tlb_preload_page);
+        }
+}
 
 /*
  * Drop a TLB entry into the GRU. The fault is described by info in an TFH.
@@ -320,11 +360,14 @@ upm:
  *              < 0 = error code
  *
  */
-static int gru_try_dropin(struct gru_thread_state *gts,
+static int gru_try_dropin(struct gru_state *gru,
+                          struct gru_thread_state *gts,
                           struct gru_tlb_fault_handle *tfh,
-                          unsigned long __user *cb)
+                          struct gru_instruction_bits *cbk)
 {
-        int pageshift = 0, asid, write, ret, atomic = !cb;
+        struct gru_control_block_extended *cbe = NULL;
+        unsigned char tlb_preload_count = gts->ts_tlb_preload_count;
+        int pageshift = 0, asid, write, ret, atomic = !cbk, indexway;
         unsigned long gpa = 0, vaddr = 0;
 
         /*
@@ -335,24 +378,34 @@ static int gru_try_dropin(struct gru_thread_state *gts,
          */
 
         /*
+         * Prefetch the CBE if doing TLB preloading
+         */
+        if (unlikely(tlb_preload_count)) {
+                cbe = gru_tfh_to_cbe(tfh);
+                prefetchw(cbe);
+        }
+
+        /*
          * Error if TFH state is IDLE or FMM mode & the user issuing a UPM call.
          * Might be a hardware race OR a stupid user. Ignore FMM because FMM
          * is a transient state.
          */
         if (tfh->status != TFHSTATUS_EXCEPTION) {
                 gru_flush_cache(tfh);
+                sync_core();
                 if (tfh->status != TFHSTATUS_EXCEPTION)
                         goto failnoexception;
                 STAT(tfh_stale_on_fault);
         }
         if (tfh->state == TFHSTATE_IDLE)
                 goto failidle;
-        if (tfh->state == TFHSTATE_MISS_FMM && cb)
+        if (tfh->state == TFHSTATE_MISS_FMM && cbk)
                 goto failfmm;
 
         write = (tfh->cause & TFHCAUSE_TLB_MOD) != 0;
         vaddr = tfh->missvaddr;
         asid = tfh->missasid;
+        indexway = tfh->indexway;
         if (asid == 0)
                 goto failnoasid;
 
@@ -366,41 +419,51 @@ static int gru_try_dropin(struct gru_thread_state *gts,
                 goto failactive;
 
         ret = gru_vtop(gts, vaddr, write, atomic, &gpa, &pageshift);
-        if (ret == -1)
+        if (ret == VTOP_INVALID)
                 goto failinval;
-        if (ret == -2)
+        if (ret == VTOP_RETRY)
                 goto failupm;
 
         if (!(gts->ts_sizeavail & GRU_SIZEAVAIL(pageshift))) {
                 gts->ts_sizeavail |= GRU_SIZEAVAIL(pageshift);
-                if (atomic || !gru_update_cch(gts, 0)) {
+                if (atomic || !gru_update_cch(gts)) {
                         gts->ts_force_cch_reload = 1;
                         goto failupm;
                 }
         }
-        gru_cb_set_istatus_active(cb);
+
+        if (unlikely(cbe) && pageshift == PAGE_SHIFT) {
+                gru_preload_tlb(gru, gts, atomic, vaddr, asid, write, tlb_preload_count, tfh, cbe);
+                gru_flush_cache_cbe(cbe);
+        }
+
+        gru_cb_set_istatus_active(cbk);
+        gts->ustats.tlbdropin++;
         tfh_write_restart(tfh, gpa, GAA_RAM, vaddr, asid, write,
                           GRU_PAGESIZE(pageshift));
-        STAT(tlb_dropin);
         gru_dbg(grudev,
-                "%s: tfh 0x%p, vaddr 0x%lx, asid 0x%x, ps %d, gpa 0x%lx\n",
-                ret ? "non-atomic" : "atomic", tfh, vaddr, asid,
-                pageshift, gpa);
+                "%s: gid %d, gts 0x%p, tfh 0x%p, vaddr 0x%lx, asid 0x%x, indexway 0x%x,"
+                " rw %d, ps %d, gpa 0x%lx\n",
+                atomic ? "atomic" : "non-atomic", gru->gs_gid, gts, tfh, vaddr, asid,
+                indexway, write, pageshift, gpa);
+        STAT(tlb_dropin);
         return 0;
 
 failnoasid:
         /* No asid (delayed unload). */
         STAT(tlb_dropin_fail_no_asid);
         gru_dbg(grudev, "FAILED no_asid tfh: 0x%p, vaddr 0x%lx\n", tfh, vaddr);
-        if (!cb)
+        if (!cbk)
                 tfh_user_polling_mode(tfh);
         else
                 gru_flush_cache(tfh);
+        gru_flush_cache_cbe(cbe);
         return -EAGAIN;
 
 failupm:
         /* Atomic failure switch CBR to UPM */
         tfh_user_polling_mode(tfh);
+        gru_flush_cache_cbe(cbe);
         STAT(tlb_dropin_fail_upm);
         gru_dbg(grudev, "FAILED upm tfh: 0x%p, vaddr 0x%lx\n", tfh, vaddr);
         return 1;
@@ -408,6 +471,7 @@ failupm:
 failfmm:
         /* FMM state on UPM call */
         gru_flush_cache(tfh);
+        gru_flush_cache_cbe(cbe);
         STAT(tlb_dropin_fail_fmm);
         gru_dbg(grudev, "FAILED fmm tfh: 0x%p, state %d\n", tfh, tfh->state);
         return 0;
@@ -415,17 +479,20 @@ failfmm:
 failnoexception:
         /* TFH status did not show exception pending */
         gru_flush_cache(tfh);
-        if (cb)
-                gru_flush_cache(cb);
+        gru_flush_cache_cbe(cbe);
+        if (cbk)
+                gru_flush_cache(cbk);
         STAT(tlb_dropin_fail_no_exception);
-        gru_dbg(grudev, "FAILED non-exception tfh: 0x%p, status %d, state %d\n", tfh, tfh->status, tfh->state);
+        gru_dbg(grudev, "FAILED non-exception tfh: 0x%p, status %d, state %d\n",
+                tfh, tfh->status, tfh->state);
         return 0;
 
 failidle:
         /* TFH state was idle  - no miss pending */
         gru_flush_cache(tfh);
-        if (cb)
-                gru_flush_cache(cb);
+        gru_flush_cache_cbe(cbe);
+        if (cbk)
+                gru_flush_cache(cbk);
         STAT(tlb_dropin_fail_idle);
         gru_dbg(grudev, "FAILED idle tfh: 0x%p, state %d\n", tfh, tfh->state);
         return 0;
@@ -433,16 +500,18 @@ failidle:
 failinval:
         /* All errors (atomic & non-atomic) switch CBR to EXCEPTION state */
         tfh_exception(tfh);
+        gru_flush_cache_cbe(cbe);
         STAT(tlb_dropin_fail_invalid);
         gru_dbg(grudev, "FAILED inval tfh: 0x%p, vaddr 0x%lx\n", tfh, vaddr);
         return -EFAULT;
 
 failactive:
         /* Range invalidate active. Switch to UPM iff atomic */
-        if (!cb)
+        if (!cbk)
                 tfh_user_polling_mode(tfh);
         else
                 gru_flush_cache(tfh);
+        gru_flush_cache_cbe(cbe);
         STAT(tlb_dropin_fail_range_active);
         gru_dbg(grudev, "FAILED range active: tfh 0x%p, vaddr 0x%lx\n",
                 tfh, vaddr);
@@ -455,31 +524,41 @@ failactive:
  * Note that this is the interrupt handler that is registered with linux
  * interrupt handlers.
  */
-irqreturn_t gru_intr(int irq, void *dev_id)
+static irqreturn_t gru_intr(int chiplet, int blade)
 {
         struct gru_state *gru;
         struct gru_tlb_fault_map imap, dmap;
         struct gru_thread_state *gts;
         struct gru_tlb_fault_handle *tfh = NULL;
+        struct completion *cmp;
         int cbrnum, ctxnum;
 
         STAT(intr);
 
-        gru = irq_to_gru(irq);
+        gru = &gru_base[blade]->bs_grus[chiplet];
         if (!gru) {
-                dev_err(grudev, "GRU: invalid interrupt: cpu %d, irq %d\n",
-                        raw_smp_processor_id(), irq);
+                dev_err(grudev, "GRU: invalid interrupt: cpu %d, chiplet %d\n",
+                        raw_smp_processor_id(), chiplet);
                 return IRQ_NONE;
         }
         get_clear_fault_map(gru, &imap, &dmap);
+        gru_dbg(grudev,
+                "cpu %d, chiplet %d, gid %d, imap %016lx %016lx, dmap %016lx %016lx\n",
+                smp_processor_id(), chiplet, gru->gs_gid,
+                imap.fault_bits[0], imap.fault_bits[1],
+                dmap.fault_bits[0], dmap.fault_bits[1]);
 
         for_each_cbr_in_tfm(cbrnum, dmap.fault_bits) {
-                complete(gru->gs_blade->bs_async_wq);
+                STAT(intr_cbr);
+                cmp = gru->gs_blade->bs_async_wq;
+                if (cmp)
+                        complete(cmp);
                 gru_dbg(grudev, "gid %d, cbr_done %d, done %d\n",
-                        gru->gs_gid, cbrnum, gru->gs_blade->bs_async_wq->done);
+                        gru->gs_gid, cbrnum, cmp ? cmp->done : -1);
         }
 
         for_each_cbr_in_tfm(cbrnum, imap.fault_bits) {
+                STAT(intr_tfh);
                 tfh = get_tfh_by_index(gru, cbrnum);
                 prefetchw(tfh); /* Helps on hdw, required for emulator */
 
@@ -492,14 +571,20 @@ irqreturn_t gru_intr(int irq, void *dev_id)
                 ctxnum = tfh->ctxnum;
                 gts = gru->gs_gts[ctxnum];
 
+                /* Spurious interrupts can cause this. Ignore. */
+                if (!gts) {
+                        STAT(intr_spurious);
+                        continue;
+                }
+
                 /*
                  * This is running in interrupt context. Trylock the mmap_sem.
                  * If it fails, retry the fault in user context.
                  */
+                gts->ustats.fmm_tlbmiss++;
                 if (!gts->ts_force_cch_reload &&
                                         down_read_trylock(&gts->ts_mm->mmap_sem)) {
-                        gts->ustats.fmm_tlbdropin++;
-                        gru_try_dropin(gts, tfh, NULL);
+                        gru_try_dropin(gru, gts, tfh, NULL);
                         up_read(&gts->ts_mm->mmap_sem);
                 } else {
                         tfh_user_polling_mode(tfh);
@@ -509,20 +594,43 @@ irqreturn_t gru_intr(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
+irqreturn_t gru0_intr(int irq, void *dev_id)
+{
+        return gru_intr(0, uv_numa_blade_id());
+}
+
+irqreturn_t gru1_intr(int irq, void *dev_id)
+{
+        return gru_intr(1, uv_numa_blade_id());
+}
+
+irqreturn_t gru_intr_mblade(int irq, void *dev_id)
+{
+        int blade;
+
+        for_each_possible_blade(blade) {
+                if (uv_blade_nr_possible_cpus(blade))
+                        continue;
+                 gru_intr(0, blade);
+                 gru_intr(1, blade);
+        }
+        return IRQ_HANDLED;
+}
+
 
 static int gru_user_dropin(struct gru_thread_state *gts,
                            struct gru_tlb_fault_handle *tfh,
-                           unsigned long __user *cb)
+                           void *cb)
 {
         struct gru_mm_struct *gms = gts->ts_gms;
         int ret;
 
-        gts->ustats.upm_tlbdropin++;
+        gts->ustats.upm_tlbmiss++;
         while (1) {
                 wait_event(gms->ms_wait_queue,
                            atomic_read(&gms->ms_range_active) == 0);
                 prefetchw(tfh); /* Helps on hdw, required for emulator */
-                ret = gru_try_dropin(gts, tfh, cb);
+                ret = gru_try_dropin(gts->ts_gru, gts, tfh, cb);
                 if (ret <= 0)
                         return ret;
                 STAT(call_os_wait_queue);
@@ -538,52 +646,41 @@ int gru_handle_user_call_os(unsigned long cb)
 {
         struct gru_tlb_fault_handle *tfh;
         struct gru_thread_state *gts;
-        unsigned long __user *cbp;
+        void *cbk;
         int ucbnum, cbrnum, ret = -EINVAL;
 
         STAT(call_os);
-        gru_dbg(grudev, "address 0x%lx\n", cb);
 
         /* sanity check the cb pointer */
         ucbnum = get_cb_number((void *)cb);
         if ((cb & (GRU_HANDLE_STRIDE - 1)) || ucbnum >= GRU_NUM_CB)
                 return -EINVAL;
-        cbp = (unsigned long *)cb;
 
         gts = gru_find_lock_gts(cb);
         if (!gts)
                 return -EINVAL;
+        gru_dbg(grudev, "address 0x%lx, gid %d, gts 0x%p\n", cb, gts->ts_gru ? gts->ts_gru->gs_gid : -1, gts);
 
         if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE)
                 goto exit;
 
-        /*
-         * If force_unload is set, the UPM TLB fault is phony. The task
-         * has migrated to another node and the GSEG must be moved. Just
-         * unload the context. The task will page fault and assign a new
-         * context.
-         */
-        if (gts->ts_tgid_owner == current->tgid && gts->ts_blade >= 0 &&
-                                gts->ts_blade != uv_numa_blade_id()) {
-                STAT(call_os_offnode_reference);
-                gts->ts_force_unload = 1;
-        }
+        gru_check_context_placement(gts);
 
         /*
          * CCH may contain stale data if ts_force_cch_reload is set.
          */
         if (gts->ts_gru && gts->ts_force_cch_reload) {
                 gts->ts_force_cch_reload = 0;
-                gru_update_cch(gts, 0);
+                gru_update_cch(gts);
         }
 
         ret = -EAGAIN;
         cbrnum = thread_cbr_number(gts, ucbnum);
-        if (gts->ts_force_unload) {
-                gru_unload_context(gts, 1);
-        } else if (gts->ts_gru) {
+        if (gts->ts_gru) {
                 tfh = get_tfh_by_index(gts->ts_gru, cbrnum);
-                ret = gru_user_dropin(gts, tfh, cbp);
+                cbk = get_gseg_base_address_cb(gts->ts_gru->gs_gru_base_vaddr,
+                                gts->ts_ctxnum, ucbnum);
+                ret = gru_user_dropin(gts, tfh, cbk);
         }
 exit:
         gru_unlock_gts(gts);
@@ -605,11 +702,11 @@ int gru_get_exception_detail(unsigned long arg)
         if (copy_from_user(&excdet, (void __user *)arg, sizeof(excdet)))
                 return -EFAULT;
 
-        gru_dbg(grudev, "address 0x%lx\n", excdet.cb);
         gts = gru_find_lock_gts(excdet.cb);
         if (!gts)
                 return -EINVAL;
 
+        gru_dbg(grudev, "address 0x%lx, gid %d, gts 0x%p\n", excdet.cb, gts->ts_gru ? gts->ts_gru->gs_gid : -1, gts);
         ucbnum = get_cb_number((void *)excdet.cb);
         if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE) {
                 ret = -EINVAL;
@@ -617,6 +714,7 @@ int gru_get_exception_detail(unsigned long arg)
                 cbrnum = thread_cbr_number(gts, ucbnum);
                 cbe = get_cbe_by_index(gts->ts_gru, cbrnum);
                 gru_flush_cache(cbe);   /* CBE not coherent */
+                sync_core();            /* make sure we are have current data */
                 excdet.opc = cbe->opccpy;
                 excdet.exopc = cbe->exopccpy;
                 excdet.ecause = cbe->ecause;
@@ -624,7 +722,7 @@ int gru_get_exception_detail(unsigned long arg)
                 excdet.exceptdet1 = cbe->idef3upd;
                 excdet.cbrstate = cbe->cbrstate;
                 excdet.cbrexecstatus = cbe->cbrexecstatus;
-                gru_flush_cache(cbe);
+                gru_flush_cache_cbe(cbe);
                 ret = 0;
         } else {
                 ret = -EAGAIN;
@@ -733,6 +831,11 @@ long gru_get_gseg_statistics(unsigned long arg)
         if (copy_from_user(&req, (void __user *)arg, sizeof(req)))
                 return -EFAULT;
 
+        /*
+         * The library creates arrays of contexts for threaded programs.
+         * If no gts exists in the array, the context has never been used & all
+         * statistics are implicitly 0.
+         */
         gts = gru_find_lock_gts(req.gseg);
         if (gts) {
                 memcpy(&req.stats, &gts->ustats, sizeof(gts->ustats));
@@ -762,11 +865,25 @@ int gru_set_context_option(unsigned long arg)
                 return -EFAULT;
         gru_dbg(grudev, "op %d, gseg 0x%lx, value1 0x%lx\n", req.op, req.gseg, req.val1);
 
-        gts = gru_alloc_locked_gts(req.gseg);
-        if (!gts)
-                return -EINVAL;
+        gts = gru_find_lock_gts(req.gseg);
+        if (!gts) {
+                gts = gru_alloc_locked_gts(req.gseg);
+                if (IS_ERR(gts))
+                        return PTR_ERR(gts);
+        }
 
         switch (req.op) {
+        case sco_blade_chiplet:
+                /* Select blade/chiplet for GRU context */
+                if (req.val1 < -1 || req.val1 >= GRU_MAX_BLADES || !gru_base[req.val1] ||
+                    req.val0 < -1 || req.val0 >= GRU_CHIPLETS_PER_HUB) {
+                        ret = -EINVAL;
+                } else {
+                        gts->ts_user_blade_id = req.val1;
+                        gts->ts_user_chiplet_id = req.val0;
+                        gru_check_context_placement(gts);
+                }
+                break;
         case sco_gseg_owner:
                 /* Register the current task as the GSEG owner */
                 gts->ts_tgid_owner = current->tgid;
diff --git a/drivers/misc/sgi-gru/grufile.c b/drivers/misc/sgi-gru/grufile.c
index fa2d93a9fb8d..28852dfa310d 100644
--- a/drivers/misc/sgi-gru/grufile.c
+++ b/drivers/misc/sgi-gru/grufile.c
@@ -29,13 +29,15 @@
 #include <linux/slab.h>
 #include <linux/mm.h>
 #include <linux/io.h>
-#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 #include <linux/device.h>
 #include <linux/miscdevice.h>
 #include <linux/interrupt.h>
 #include <linux/proc_fs.h>
 #include <linux/uaccess.h>
+#ifdef CONFIG_X86_64
+#include <asm/uv/uv_irq.h>
+#endif
 #include <asm/uv/uv.h>
 #include "gru.h"
 #include "grulib.h"
@@ -54,7 +56,6 @@ struct gru_stats_s gru_stats;
 /* Guaranteed user available resources on each node */
 static int max_user_cbrs, max_user_dsr_bytes;
 
-static struct file_operations gru_fops;
 static struct miscdevice gru_miscdev;
 
 
@@ -94,7 +95,7 @@ static void gru_vma_close(struct vm_area_struct *vma)
 /*
  * gru_file_mmap
  *
- * Called when mmaping the device.  Initializes the vma with a fault handler
+ * Called when mmapping the device.  Initializes the vma with a fault handler
  * and private data structure necessary to allocate, track, and free the
  * underlying pages.
  */
@@ -132,7 +133,6 @@ static int gru_create_new_context(unsigned long arg)
         struct gru_vma_data *vdata;
         int ret = -EINVAL;
 
-
         if (copy_from_user(&req, (void __user *)arg, sizeof(req)))
                 return -EFAULT;
 
@@ -152,6 +152,7 @@ static int gru_create_new_context(unsigned long arg)
                 vdata->vd_dsr_au_count =
                     GRU_DS_BYTES_TO_AU(req.data_segment_bytes);
                 vdata->vd_cbr_au_count = GRU_CB_COUNT_TO_AU(req.control_blocks);
+                vdata->vd_tlb_preload_count = req.tlb_preload_count;
                 ret = 0;
         }
         up_write(&current->mm->mmap_sem);
@@ -192,7 +193,7 @@ static long gru_file_unlocked_ioctl(struct file *file, unsigned int req,
 {
         int err = -EBADRQC;
 
-        gru_dbg(grudev, "file %p\n", file);
+        gru_dbg(grudev, "file %p, req 0x%x, 0x%lx\n", file, req, arg);
 
         switch (req) {
         case GRU_CREATE_CONTEXT:
@@ -234,23 +235,24 @@ static long gru_file_unlocked_ioctl(struct file *file, unsigned int req,
  * system.
  */
 static void gru_init_chiplet(struct gru_state *gru, unsigned long paddr,
-                             void *vaddr, int nid, int bid, int grunum)
+                             void *vaddr, int blade_id, int chiplet_id)
 {
         spin_lock_init(&gru->gs_lock);
         spin_lock_init(&gru->gs_asid_lock);
         gru->gs_gru_base_paddr = paddr;
         gru->gs_gru_base_vaddr = vaddr;
-        gru->gs_gid = bid * GRU_CHIPLETS_PER_BLADE + grunum;
-        gru->gs_blade = gru_base[bid];
-        gru->gs_blade_id = bid;
+        gru->gs_gid = blade_id * GRU_CHIPLETS_PER_BLADE + chiplet_id;
+        gru->gs_blade = gru_base[blade_id];
+        gru->gs_blade_id = blade_id;
+        gru->gs_chiplet_id = chiplet_id;
         gru->gs_cbr_map = (GRU_CBR_AU == 64) ? ~0 : (1UL << GRU_CBR_AU) - 1;
         gru->gs_dsr_map = (1UL << GRU_DSR_AU) - 1;
         gru->gs_asid_limit = MAX_ASID;
         gru_tgh_flush_init(gru);
         if (gru->gs_gid >= gru_max_gids)
                 gru_max_gids = gru->gs_gid + 1;
-        gru_dbg(grudev, "bid %d, nid %d, gid %d, vaddr %p (0x%lx)\n",
-                bid, nid, gru->gs_gid, gru->gs_gru_base_vaddr,
+        gru_dbg(grudev, "bid %d, gid %d, vaddr %p (0x%lx)\n",
+                blade_id, gru->gs_gid, gru->gs_gru_base_vaddr,
                 gru->gs_gru_base_paddr);
 }
 
@@ -266,12 +268,10 @@ static int gru_init_tables(unsigned long gru_base_paddr, void *gru_base_vaddr)
 
         max_user_cbrs = GRU_NUM_CB;
         max_user_dsr_bytes = GRU_NUM_DSR_BYTES;
-        for_each_online_node(nid) {
-                bid = uv_node_to_blade_id(nid);
-                pnode = uv_node_to_pnode(nid);
-                if (bid < 0 || gru_base[bid])
-                        continue;
-                page = alloc_pages_exact_node(nid, GFP_KERNEL, order);
+        for_each_possible_blade(bid) {
+                pnode = uv_blade_to_pnode(bid);
+                nid = uv_blade_to_memory_nid(bid);/* -1 if no memory on blade */
+                page = alloc_pages_node(nid, GFP_KERNEL, order);
                 if (!page)
                         goto fail;
                 gru_base[bid] = page_address(page);
@@ -287,7 +287,7 @@ static int gru_init_tables(unsigned long gru_base_paddr, void *gru_base_vaddr)
                                 chip++, gru++) {
                         paddr = gru_chiplet_paddr(gru_base_paddr, pnode, chip);
                         vaddr = gru_chiplet_vaddr(gru_base_vaddr, pnode, chip);
-                        gru_init_chiplet(gru, paddr, vaddr, nid, bid, chip);
+                        gru_init_chiplet(gru, paddr, vaddr, bid, chip);
                         n = hweight64(gru->gs_cbr_map) * GRU_CBR_AU_SIZE;
                         cbrs = max(cbrs, n);
                         n = hweight64(gru->gs_dsr_map) * GRU_DSR_AU_BYTES;
@@ -300,39 +300,215 @@ static int gru_init_tables(unsigned long gru_base_paddr, void *gru_base_vaddr)
         return 0;
 
 fail:
-        for (nid--; nid >= 0; nid--)
-                free_pages((unsigned long)gru_base[nid], order);
+        for (bid--; bid >= 0; bid--)
+                free_pages((unsigned long)gru_base[bid], order);
         return -ENOMEM;
 }
 
-#ifdef CONFIG_IA64
+static void gru_free_tables(void)
+{
+        int bid;
+        int order = get_order(sizeof(struct gru_state) *
+                              GRU_CHIPLETS_PER_BLADE);
 
-static int get_base_irq(void)
+        for (bid = 0; bid < GRU_MAX_BLADES; bid++)
+                free_pages((unsigned long)gru_base[bid], order);
+}
+
+static unsigned long gru_chiplet_cpu_to_mmr(int chiplet, int cpu, int *corep)
 {
-        return IRQ_GRU;
+        unsigned long mmr = 0;
+        int core;
+
+        /*
+         * We target the cores of a blade and not the hyperthreads themselves.
+         * There is a max of 8 cores per socket and 2 sockets per blade,
+         * making for a max total of 16 cores (i.e., 16 CPUs without
+         * hyperthreading and 32 CPUs with hyperthreading).
+         */
+        core = uv_cpu_core_number(cpu) + UV_MAX_INT_CORES * uv_cpu_socket_number(cpu);
+        if (core >= GRU_NUM_TFM || uv_cpu_ht_number(cpu))
+                return 0;
+
+        if (chiplet == 0) {
+                mmr = UVH_GR0_TLB_INT0_CONFIG +
+                    core * (UVH_GR0_TLB_INT1_CONFIG - UVH_GR0_TLB_INT0_CONFIG);
+        } else if (chiplet == 1) {
+                mmr = UVH_GR1_TLB_INT0_CONFIG +
+                    core * (UVH_GR1_TLB_INT1_CONFIG - UVH_GR1_TLB_INT0_CONFIG);
+        } else {
+                BUG();
+        }
+
+        *corep = core;
+        return mmr;
 }
 
-#elif defined CONFIG_X86_64
+#ifdef CONFIG_IA64
 
-static void noop(unsigned int irq)
+static int gru_irq_count[GRU_CHIPLETS_PER_BLADE];
+
+static void gru_noop(unsigned int irq)
 {
 }
 
-static struct irq_chip gru_chip = {
-        .name           = "gru",
-        .mask           = noop,
-        .unmask         = noop,
-        .ack            = noop,
+static struct irq_chip gru_chip[GRU_CHIPLETS_PER_BLADE] = {
+        [0 ... GRU_CHIPLETS_PER_BLADE - 1] {
+                .mask           = gru_noop,
+                .unmask         = gru_noop,
+                .ack            = gru_noop
+        }
 };
 
-static int get_base_irq(void)
+static int gru_chiplet_setup_tlb_irq(int chiplet, char *irq_name,
+                        irq_handler_t irq_handler, int cpu, int blade)
+{
+        unsigned long mmr;
+        int irq = IRQ_GRU + chiplet;
+        int ret, core;
+
+        mmr = gru_chiplet_cpu_to_mmr(chiplet, cpu, &core);
+        if (mmr == 0)
+                return 0;
+
+        if (gru_irq_count[chiplet] == 0) {
+                gru_chip[chiplet].name = irq_name;
+                ret = set_irq_chip(irq, &gru_chip[chiplet]);
+                if (ret) {
+                        printk(KERN_ERR "%s: set_irq_chip failed, errno=%d\n",
+                               GRU_DRIVER_ID_STR, -ret);
+                        return ret;
+                }
+
+                ret = request_irq(irq, irq_handler, 0, irq_name, NULL);
+                if (ret) {
+                        printk(KERN_ERR "%s: request_irq failed, errno=%d\n",
+                               GRU_DRIVER_ID_STR, -ret);
+                        return ret;
+                }
+        }
+        gru_irq_count[chiplet]++;
+
+        return 0;
+}
+
+static void gru_chiplet_teardown_tlb_irq(int chiplet, int cpu, int blade)
+{
+        unsigned long mmr;
+        int core, irq = IRQ_GRU + chiplet;
+
+        if (gru_irq_count[chiplet] == 0)
+                return;
+
+        mmr = gru_chiplet_cpu_to_mmr(chiplet, cpu, &core);
+        if (mmr == 0)
+                return;
+
+        if (--gru_irq_count[chiplet] == 0)
+                free_irq(irq, NULL);
+}
+
+#elif defined CONFIG_X86_64
+
+static int gru_chiplet_setup_tlb_irq(int chiplet, char *irq_name,
+                        irq_handler_t irq_handler, int cpu, int blade)
+{
+        unsigned long mmr;
+        int irq, core;
+        int ret;
+
+        mmr = gru_chiplet_cpu_to_mmr(chiplet, cpu, &core);
+        if (mmr == 0)
+                return 0;
+
+        irq = uv_setup_irq(irq_name, cpu, blade, mmr, UV_AFFINITY_CPU);
+        if (irq < 0) {
+                printk(KERN_ERR "%s: uv_setup_irq failed, errno=%d\n",
+                       GRU_DRIVER_ID_STR, -irq);
+                return irq;
+        }
+
+        ret = request_irq(irq, irq_handler, 0, irq_name, NULL);
+        if (ret) {
+                uv_teardown_irq(irq);
+                printk(KERN_ERR "%s: request_irq failed, errno=%d\n",
+                       GRU_DRIVER_ID_STR, -ret);
+                return ret;
+        }
+        gru_base[blade]->bs_grus[chiplet].gs_irq[core] = irq;
+        return 0;
+}
+
+static void gru_chiplet_teardown_tlb_irq(int chiplet, int cpu, int blade)
 {
-        set_irq_chip(IRQ_GRU, &gru_chip);
-        set_irq_chip(IRQ_GRU + 1, &gru_chip);
-        return IRQ_GRU;
+        int irq, core;
+        unsigned long mmr;
+
+        mmr = gru_chiplet_cpu_to_mmr(chiplet, cpu, &core);
+        if (mmr) {
+                irq = gru_base[blade]->bs_grus[chiplet].gs_irq[core];
+                if (irq) {
+                        free_irq(irq, NULL);
+                        uv_teardown_irq(irq);
+                }
+        }
 }
+
 #endif
 
+static void gru_teardown_tlb_irqs(void)
+{
+        int blade;
+        int cpu;
+
+        for_each_online_cpu(cpu) {
+                blade = uv_cpu_to_blade_id(cpu);
+                gru_chiplet_teardown_tlb_irq(0, cpu, blade);
+                gru_chiplet_teardown_tlb_irq(1, cpu, blade);
+        }
+        for_each_possible_blade(blade) {
+                if (uv_blade_nr_possible_cpus(blade))
+                        continue;
+                gru_chiplet_teardown_tlb_irq(0, 0, blade);
+                gru_chiplet_teardown_tlb_irq(1, 0, blade);
+        }
+}
+
+static int gru_setup_tlb_irqs(void)
+{
+        int blade;
+        int cpu;
+        int ret;
+
+        for_each_online_cpu(cpu) {
+                blade = uv_cpu_to_blade_id(cpu);
+                ret = gru_chiplet_setup_tlb_irq(0, "GRU0_TLB", gru0_intr, cpu, blade);
+                if (ret != 0)
+                        goto exit1;
+
+                ret = gru_chiplet_setup_tlb_irq(1, "GRU1_TLB", gru1_intr, cpu, blade);
+                if (ret != 0)
+                        goto exit1;
+        }
+        for_each_possible_blade(blade) {
+                if (uv_blade_nr_possible_cpus(blade))
+                        continue;
+                ret = gru_chiplet_setup_tlb_irq(0, "GRU0_TLB", gru_intr_mblade, 0, blade);
+                if (ret != 0)
+                        goto exit1;
+
+                ret = gru_chiplet_setup_tlb_irq(1, "GRU1_TLB", gru_intr_mblade, 0, blade);
+                if (ret != 0)
+                        goto exit1;
+        }
+
+        return 0;
+
+exit1:
+        gru_teardown_tlb_irqs();
+        return ret;
+}
+
 /*
  * gru_init
  *
@@ -340,8 +516,7 @@ static int get_base_irq(void)
  */
 static int __init gru_init(void)
 {
-        int ret, irq, chip;
-        char id[10];
+        int ret;
 
         if (!is_uv_system())
                 return 0;
@@ -356,41 +531,29 @@ static int __init gru_init(void)
         gru_end_paddr = gru_start_paddr + GRU_MAX_BLADES * GRU_SIZE;
         printk(KERN_INFO "GRU space: 0x%lx - 0x%lx\n",
                gru_start_paddr, gru_end_paddr);
-        irq = get_base_irq();
-        for (chip = 0; chip < GRU_CHIPLETS_PER_BLADE; chip++) {
-                ret = request_irq(irq + chip, gru_intr, 0, id, NULL);
-                /* TODO: fix irq handling on x86. For now ignore failure because
-                 * interrupts are not required & not yet fully supported */
-                if (ret) {
-                        printk(KERN_WARNING
-                               "!!!WARNING: GRU ignoring request failure!!!\n");
-                        ret = 0;
-                }
-                if (ret) {
-                        printk(KERN_ERR "%s: request_irq failed\n",
-                               GRU_DRIVER_ID_STR);
-                        goto exit1;
-                }
-        }
-
         ret = misc_register(&gru_miscdev);
         if (ret) {
                 printk(KERN_ERR "%s: misc_register failed\n",
                        GRU_DRIVER_ID_STR);
-                goto exit1;
+                goto exit0;
         }
 
         ret = gru_proc_init();
         if (ret) {
                 printk(KERN_ERR "%s: proc init failed\n", GRU_DRIVER_ID_STR);
-                goto exit2;
+                goto exit1;
         }
 
         ret = gru_init_tables(gru_start_paddr, gru_start_vaddr);
         if (ret) {
                 printk(KERN_ERR "%s: init tables failed\n", GRU_DRIVER_ID_STR);
-                goto exit3;
+                goto exit2;
         }
+
+        ret = gru_setup_tlb_irqs();
+        if (ret != 0)
+                goto exit3;
+
         gru_kservices_init();
 
         printk(KERN_INFO "%s: v%s\n", GRU_DRIVER_ID_STR,
@@ -398,39 +561,33 @@ static int __init gru_init(void)
         return 0;
 
 exit3:
-        gru_proc_exit();
+        gru_free_tables();
 exit2:
-        misc_deregister(&gru_miscdev);
+        gru_proc_exit();
 exit1:
-        for (--chip; chip >= 0; chip--)
-                free_irq(irq + chip, NULL);
+        misc_deregister(&gru_miscdev);
+exit0:
         return ret;
 
 }
 
 static void __exit gru_exit(void)
 {
-        int i, bid;
-        int order = get_order(sizeof(struct gru_state) *
-                              GRU_CHIPLETS_PER_BLADE);
-
         if (!is_uv_system())
                 return;
 
-        for (i = 0; i < GRU_CHIPLETS_PER_BLADE; i++)
-                free_irq(IRQ_GRU + i, NULL);
+        gru_teardown_tlb_irqs();
         gru_kservices_exit();
-        for (bid = 0; bid < GRU_MAX_BLADES; bid++)
-                free_pages((unsigned long)gru_base[bid], order);
-
+        gru_free_tables();
         misc_deregister(&gru_miscdev);
         gru_proc_exit();
 }
 
-static struct file_operations gru_fops = {
+static const struct file_operations gru_fops = {
         .owner          = THIS_MODULE,
         .unlocked_ioctl = gru_file_unlocked_ioctl,
         .mmap           = gru_file_mmap,
+        .llseek         = noop_llseek,
 };
 
 static struct miscdevice gru_miscdev = {
@@ -439,7 +596,7 @@ static struct miscdevice gru_miscdev = {
         .fops           = &gru_fops,
 };
 
-struct vm_operations_struct gru_vm_ops = {
+const struct vm_operations_struct gru_vm_ops = {
         .close          = gru_vma_close,
         .fault          = gru_fault,
 };
diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
index 37e7cfc53b9c..2f30badc6ffd 100644
--- a/drivers/misc/sgi-gru/gruhandles.c
+++ b/drivers/misc/sgi-gru/gruhandles.c
@@ -27,9 +27,11 @@
 #ifdef CONFIG_IA64
 #include <asm/processor.h>
 #define GRU_OPERATION_TIMEOUT   (((cycles_t) local_cpu_data->itc_freq)*10)
+#define CLKS2NSEC(c)            ((c) *1000000000 / local_cpu_data->itc_freq)
 #else
 #include <asm/tsc.h>
 #define GRU_OPERATION_TIMEOUT   ((cycles_t) tsc_khz*10*1000)
+#define CLKS2NSEC(c)            ((c) * 1000000 / tsc_khz)
 #endif
 
 /* Extract the status field from a kernel handle */
@@ -39,21 +41,39 @@ struct mcs_op_statistic mcs_op_statistics[mcsop_last];
 
 static void update_mcs_stats(enum mcs_op op, unsigned long clks)
 {
+        unsigned long nsec;
+
+        nsec = CLKS2NSEC(clks);
         atomic_long_inc(&mcs_op_statistics[op].count);
-        atomic_long_add(clks, &mcs_op_statistics[op].total);
-        if (mcs_op_statistics[op].max < clks)
-                mcs_op_statistics[op].max = clks;
+        atomic_long_add(nsec, &mcs_op_statistics[op].total);
+        if (mcs_op_statistics[op].max < nsec)
+                mcs_op_statistics[op].max = nsec;
 }
 
 static void start_instruction(void *h)
 {
         unsigned long *w0 = h;
 
-        wmb();          /* setting CMD bit must be last */
-        *w0 = *w0 | 1;
+        wmb();          /* setting CMD/STATUS bits must be last */
+        *w0 = *w0 | 0x20001;
         gru_flush_cache(h);
 }
 
+static void report_instruction_timeout(void *h)
+{
+        unsigned long goff = GSEGPOFF((unsigned long)h);
+        char *id = "???";
+
+        if (TYPE_IS(CCH, goff))
+                id = "CCH";
+        else if (TYPE_IS(TGH, goff))
+                id = "TGH";
+        else if (TYPE_IS(TFH, goff))
+                id = "TFH";
+
+        panic(KERN_ALERT "GRU %p (%s) is malfunctioning\n", h, id);
+}
+
 static int wait_instruction_complete(void *h, enum mcs_op opc)
 {
         int status;
@@ -64,9 +84,10 @@ static int wait_instruction_complete(void *h, enum mcs_op opc)
                 status = GET_MSEG_HANDLE_STATUS(h);
                 if (status != CCHSTATUS_ACTIVE)
                         break;
-                if (GRU_OPERATION_TIMEOUT < (get_cycles() - start_time))
-                        panic("GRU %p is malfunctioning: start %ld, end %ld\n",
-                              h, start_time, (unsigned long)get_cycles());
+                if (GRU_OPERATION_TIMEOUT < (get_cycles() - start_time)) {
+                        report_instruction_timeout(h);
+                        start_time = get_cycles();
+                }
         }
         if (gru_options & OPT_STATS)
                 update_mcs_stats(opc, get_cycles() - start_time);
@@ -75,9 +96,18 @@ static int wait_instruction_complete(void *h, enum mcs_op opc)
 
 int cch_allocate(struct gru_context_configuration_handle *cch)
 {
+        int ret;
+
         cch->opc = CCHOP_ALLOCATE;
         start_instruction(cch);
-        return wait_instruction_complete(cch, cchop_allocate);
+        ret = wait_instruction_complete(cch, cchop_allocate);
+
+        /*
+         * Stop speculation into the GSEG being mapped by the previous ALLOCATE.
+         * The GSEG memory does not exist until the ALLOCATE completes.
+         */
+        sync_core();
+        return ret;
 }
 
 int cch_start(struct gru_context_configuration_handle *cch)
@@ -96,9 +126,18 @@ int cch_interrupt(struct gru_context_configuration_handle *cch)
 
 int cch_deallocate(struct gru_context_configuration_handle *cch)
 {
+        int ret;
+
         cch->opc = CCHOP_DEALLOCATE;
         start_instruction(cch);
-        return wait_instruction_complete(cch, cchop_deallocate);
+        ret = wait_instruction_complete(cch, cchop_deallocate);
+
+        /*
+         * Stop speculation into the GSEG being unmapped by the previous
+         * DEALLOCATE.
+         */
+        sync_core();
+        return ret;
 }
 
 int cch_interrupt_sync(struct gru_context_configuration_handle
@@ -126,17 +165,20 @@ int tgh_invalidate(struct gru_tlb_global_handle *tgh,
         return wait_instruction_complete(tgh, tghop_invalidate);
 }
 
-void tfh_write_only(struct gru_tlb_fault_handle *tfh,
-                                  unsigned long pfn, unsigned long vaddr,
-                                  int asid, int dirty, int pagesize)
+int tfh_write_only(struct gru_tlb_fault_handle *tfh,
+                                  unsigned long paddr, int gaa,
+                                  unsigned long vaddr, int asid, int dirty,
+                                  int pagesize)
 {
         tfh->fillasid = asid;
         tfh->fillvaddr = vaddr;
-        tfh->pfn = pfn;
+        tfh->pfn = paddr >> GRU_PADDR_SHIFT;
+        tfh->gaa = gaa;
         tfh->dirty = dirty;
         tfh->pagesize = pagesize;
         tfh->opc = TFHOP_WRITE_ONLY;
         start_instruction(tfh);
+        return wait_instruction_complete(tfh, tfhop_write_only);
 }
 
 void tfh_write_restart(struct gru_tlb_fault_handle *tfh,
diff --git a/drivers/misc/sgi-gru/gruhandles.h b/drivers/misc/sgi-gru/gruhandles.h
index f44112242d00..3f998b924d8f 100644
--- a/drivers/misc/sgi-gru/gruhandles.h
+++ b/drivers/misc/sgi-gru/gruhandles.h
@@ -91,6 +91,12 @@
 /* Convert an arbitrary handle address to the beginning of the GRU segment */
 #define GRUBASE(h)              ((void *)((unsigned long)(h) & ~(GRU_SIZE - 1)))
 
+/* Test a valid handle address to determine the type */
+#define TYPE_IS(hn, h)          ((h) >= GRU_##hn##_BASE && (h) <        \
+                GRU_##hn##_BASE + GRU_NUM_##hn * GRU_HANDLE_STRIDE &&   \
+                (((h) & (GRU_HANDLE_STRIDE - 1)) == 0))
+
+
 /* General addressing macros. */
 static inline void *get_gseg_base_address(void *base, int ctxnum)
 {
@@ -158,6 +164,16 @@ static inline void *gru_chiplet_vaddr(void *vaddr, int pnode, int chiplet)
         return vaddr + GRU_SIZE * (2 * pnode  + chiplet);
 }
 
+static inline struct gru_control_block_extended *gru_tfh_to_cbe(
+                                        struct gru_tlb_fault_handle *tfh)
+{
+        unsigned long cbe;
+
+        cbe = (unsigned long)tfh - GRU_TFH_BASE + GRU_CBE_BASE;
+        return (struct gru_control_block_extended*)cbe;
+}
+
+
 
 
 /*
@@ -236,6 +252,17 @@ enum gru_tgh_state {
         TGHSTATE_RESTART_CTX,
 };
 
+enum gru_tgh_cause {
+        TGHCAUSE_RR_ECC,
+        TGHCAUSE_TLB_ECC,
+        TGHCAUSE_LRU_ECC,
+        TGHCAUSE_PS_ECC,
+        TGHCAUSE_MUL_ERR,
+        TGHCAUSE_DATA_ERR,
+        TGHCAUSE_SW_FORCE
+};
+
+
 /*
  * TFH - TLB Global Handle
  *      Used for TLB dropins into the GRU TLB.
@@ -440,6 +467,12 @@ struct gru_control_block_extended {
         unsigned int cbrexecstatus:8;
 };
 
+/* CBE fields for active BCOPY instructions */
+#define cbe_baddr0      idef1upd
+#define cbe_baddr1      idef3upd
+#define cbe_src_cl      idef6cpy
+#define cbe_nelemcur    idef5upd
+
 enum gru_cbr_state {
         CBRSTATE_INACTIVE,
         CBRSTATE_IDLE,
@@ -487,8 +520,8 @@ int cch_interrupt_sync(struct gru_context_configuration_handle *cch);
 int tgh_invalidate(struct gru_tlb_global_handle *tgh, unsigned long vaddr,
         unsigned long vaddrmask, int asid, int pagesize, int global, int n,
         unsigned short ctxbitmap);
-void tfh_write_only(struct gru_tlb_fault_handle *tfh, unsigned long pfn,
-        unsigned long vaddr, int asid, int dirty, int pagesize);
+int tfh_write_only(struct gru_tlb_fault_handle *tfh, unsigned long paddr,
+        int gaa, unsigned long vaddr, int asid, int dirty, int pagesize);
 void tfh_write_restart(struct gru_tlb_fault_handle *tfh, unsigned long paddr,
         int gaa, unsigned long vaddr, int asid, int dirty, int pagesize);
 void tfh_restart(struct gru_tlb_fault_handle *tfh);
diff --git a/drivers/misc/sgi-gru/grukdump.c b/drivers/misc/sgi-gru/grukdump.c
index 55eabfa85585..9b2062d17327 100644
--- a/drivers/misc/sgi-gru/grukdump.c
+++ b/drivers/misc/sgi-gru/grukdump.c
@@ -44,7 +44,8 @@ static int gru_user_copy_handle(void __user **dp, void *s)
 
 static int gru_dump_context_data(void *grubase,
                         struct gru_context_configuration_handle *cch,
-                        void __user *ubuf, int ctxnum, int dsrcnt)
+                        void __user *ubuf, int ctxnum, int dsrcnt,
+                        int flush_cbrs)
 {
         void *cb, *cbe, *tfh, *gseg;
         int i, scr;
@@ -55,6 +56,8 @@ static int gru_dump_context_data(void *grubase,
         tfh = grubase + GRU_TFH_BASE;
 
         for_each_cbr_in_allocation_map(i, &cch->cbr_allocation_map, scr) {
+                if (flush_cbrs)
+                        gru_flush_cache(cb);
                 if (gru_user_copy_handle(&ubuf, cb))
                         goto fail;
                 if (gru_user_copy_handle(&ubuf, tfh + i * GRU_HANDLE_STRIDE))
@@ -115,7 +118,7 @@ fail:
 
 static int gru_dump_context(struct gru_state *gru, int ctxnum,
                 void __user *ubuf, void __user *ubufend, char data_opt,
-                char lock_cch)
+                char lock_cch, char flush_cbrs)
 {
         struct gru_dump_context_header hdr;
         struct gru_dump_context_header __user *uhdr = ubuf;
@@ -159,8 +162,7 @@ static int gru_dump_context(struct gru_state *gru, int ctxnum,
                         ret = -EFBIG;
                 else
                         ret = gru_dump_context_data(grubase, cch, ubuf, ctxnum,
-                                                        dsrcnt);
-
+                                                        dsrcnt, flush_cbrs);
         }
         if (cch_locked)
                 unlock_cch_handle(cch);
@@ -215,7 +217,8 @@ int gru_dump_chiplet_request(unsigned long arg)
         for (ctxnum = 0; ctxnum < GRU_NUM_CCH; ctxnum++) {
                 if (req.ctxnum == ctxnum || req.ctxnum < 0) {
                         ret = gru_dump_context(gru, ctxnum, ubuf, ubufend,
-                                                req.data_opt, req.lock_cch);
+                                                req.data_opt, req.lock_cch,
+                                                req.flush_cbrs);
                         if (ret < 0)
                                 goto fail;
                         ubuf += ret;
diff --git a/drivers/misc/sgi-gru/grukservices.c b/drivers/misc/sgi-gru/grukservices.c
index eedbf9c32760..34749ee88dfa 100644
--- a/drivers/misc/sgi-gru/grukservices.c
+++ b/drivers/misc/sgi-gru/grukservices.c
@@ -24,7 +24,6 @@
 #include <linux/errno.h>
 #include <linux/slab.h>
 #include <linux/mm.h>
-#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 #include <linux/device.h>
 #include <linux/miscdevice.h>
@@ -32,6 +31,7 @@
 #include <linux/interrupt.h>
 #include <linux/uaccess.h>
 #include <linux/delay.h>
+#include <asm/io_apic.h>
 #include "gru.h"
 #include "grulib.h"
 #include "grutables.h"
@@ -98,9 +98,6 @@
 #define ASYNC_HAN_TO_BID(h)     ((h) - 1)
 #define ASYNC_BID_TO_HAN(b)     ((b) + 1)
 #define ASYNC_HAN_TO_BS(h)      gru_base[ASYNC_HAN_TO_BID(h)]
-#define KCB_TO_GID(cb)          ((cb - gru_start_vaddr) /               \
-                                        (GRU_SIZE * GRU_CHIPLETS_PER_BLADE))
-#define KCB_TO_BS(cb)           gru_base[KCB_TO_GID(cb)]
 
 #define GRU_NUM_KERNEL_CBR      1
 #define GRU_NUM_KERNEL_DSR_BYTES 256
@@ -161,8 +158,10 @@ static void gru_load_kernel_context(struct gru_blade_state *bs, int blade_id)
         up_read(&bs->bs_kgts_sema);
         down_write(&bs->bs_kgts_sema);
 
-        if (!bs->bs_kgts)
-                bs->bs_kgts = gru_alloc_gts(NULL, 0, 0, 0, 0);
+        if (!bs->bs_kgts) {
+                bs->bs_kgts = gru_alloc_gts(NULL, 0, 0, 0, 0, 0);
+                bs->bs_kgts->ts_user_blade_id = blade_id;
+        }
         kgts = bs->bs_kgts;
 
         if (!kgts->ts_gru) {
@@ -173,9 +172,9 @@ static void gru_load_kernel_context(struct gru_blade_state *bs, int blade_id)
                 kgts->ts_dsr_au_count = GRU_DS_BYTES_TO_AU(
                         GRU_NUM_KERNEL_DSR_BYTES * ncpus +
                                 bs->bs_async_dsr_bytes);
-                while (!gru_assign_gru_context(kgts, blade_id)) {
+                while (!gru_assign_gru_context(kgts)) {
                         msleep(1);
-                        gru_steal_context(kgts, blade_id);
+                        gru_steal_context(kgts);
                 }
                 gru_load_context(kgts);
                 gru = bs->bs_kgts->ts_gru;
@@ -201,13 +200,15 @@ static int gru_free_kernel_contexts(void)
                 bs = gru_base[bid];
                 if (!bs)
                         continue;
+
+                /* Ignore busy contexts. Don't want to block here.  */
                 if (down_write_trylock(&bs->bs_kgts_sema)) {
                         kgts = bs->bs_kgts;
                         if (kgts && kgts->ts_gru)
                                 gru_unload_context(kgts, 0);
-                        kfree(kgts);
                         bs->bs_kgts = NULL;
                         up_write(&bs->bs_kgts_sema);
+                        kfree(kgts);
                 } else {
                         ret++;
                 }
@@ -221,13 +222,21 @@ static int gru_free_kernel_contexts(void)
 static struct gru_blade_state *gru_lock_kernel_context(int blade_id)
 {
         struct gru_blade_state *bs;
+        int bid;
 
         STAT(lock_kernel_context);
-        bs = gru_base[blade_id];
+again:
+        bid = blade_id < 0 ? uv_numa_blade_id() : blade_id;
+        bs = gru_base[bid];
 
+        /* Handle the case where migration occured while waiting for the sema */
         down_read(&bs->bs_kgts_sema);
+        if (blade_id < 0 && bid != uv_numa_blade_id()) {
+                up_read(&bs->bs_kgts_sema);
+                goto again;
+        }
         if (!bs->bs_kgts || !bs->bs_kgts->ts_gru)
-                gru_load_kernel_context(bs, blade_id);
+                gru_load_kernel_context(bs, bid);
         return bs;
 
 }
@@ -256,7 +265,7 @@ static int gru_get_cpu_resources(int dsr_bytes, void **cb, void **dsr)
 
         BUG_ON(dsr_bytes > GRU_NUM_KERNEL_DSR_BYTES);
         preempt_disable();
-        bs = gru_lock_kernel_context(uv_numa_blade_id());
+        bs = gru_lock_kernel_context(-1);
         lcpu = uv_blade_processor_id();
         *cb = bs->kernel_cb + lcpu * GRU_HANDLE_STRIDE;
         *dsr = bs->kernel_dsr + lcpu * GRU_NUM_KERNEL_DSR_BYTES;
@@ -385,13 +394,31 @@ int gru_get_cb_exception_detail(void *cb,
                 struct control_block_extended_exc_detail *excdet)
 {
         struct gru_control_block_extended *cbe;
-        struct gru_blade_state *bs;
-        int cbrnum;
-
-        bs = KCB_TO_BS(cb);
-        cbrnum = thread_cbr_number(bs->bs_kgts, get_cb_number(cb));
+        struct gru_thread_state *kgts = NULL;
+        unsigned long off;
+        int cbrnum, bid;
+
+        /*
+         * Locate kgts for cb. This algorithm is SLOW but
+         * this function is rarely called (ie., almost never).
+         * Performance does not matter.
+         */
+        for_each_possible_blade(bid) {
+                if (!gru_base[bid])
+                        break;
+                kgts = gru_base[bid]->bs_kgts;
+                if (!kgts || !kgts->ts_gru)
+                        continue;
+                off = cb - kgts->ts_gru->gs_gru_base_vaddr;
+                if (off < GRU_SIZE)
+                        break;
+                kgts = NULL;
+        }
+        BUG_ON(!kgts);
+        cbrnum = thread_cbr_number(kgts, get_cb_number(cb));
         cbe = get_cbe(GRUBASE(cb), cbrnum);
         gru_flush_cache(cbe);   /* CBE not coherent */
+        sync_core();
         excdet->opc = cbe->opccpy;
         excdet->exopc = cbe->exopccpy;
         excdet->ecause = cbe->ecause;
@@ -410,8 +437,8 @@ char *gru_get_cb_exception_detail_str(int ret, void *cb,
         if (ret > 0 && gen->istatus == CBS_EXCEPTION) {
                 gru_get_cb_exception_detail(cb, &excdet);
                 snprintf(buf, size,
-                        "GRU exception: cb %p, opc %d, exopc %d, ecause 0x%x,"
-                        "excdet0 0x%lx, excdet1 0x%x",
+                        "GRU:%d exception: cb %p, opc %d, exopc %d, ecause 0x%x,"
+                        "excdet0 0x%lx, excdet1 0x%x", smp_processor_id(),
                         gen, excdet.opc, excdet.exopc, excdet.ecause,
                         excdet.exceptdet0, excdet.exceptdet1);
         } else {
@@ -458,9 +485,10 @@ int gru_check_status_proc(void *cb)
         int ret;
 
         ret = gen->istatus;
-        if (ret != CBS_EXCEPTION)
-                return ret;
-        return gru_retry_exception(cb);
+        if (ret == CBS_EXCEPTION)
+                ret = gru_retry_exception(cb);
+        rmb();
+        return ret;
 
 }
 
@@ -472,7 +500,7 @@ int gru_wait_proc(void *cb)
         ret = gru_wait_idle_or_exception(gen);
         if (ret == CBS_EXCEPTION)
                 ret = gru_retry_exception(cb);
-
+        rmb();
         return ret;
 }
 
@@ -539,7 +567,7 @@ int gru_create_message_queue(struct gru_message_queue_desc *mqd,
         mqd->mq = mq;
         mqd->mq_gpa = uv_gpa(mq);
         mqd->qlines = qlines;
-        mqd->interrupt_pnode = UV_NASID_TO_PNODE(nasid);
+        mqd->interrupt_pnode = nasid >> 1;
         mqd->interrupt_vector = vector;
         mqd->interrupt_apicid = apicid;
         return 0;
@@ -599,6 +627,8 @@ static int send_noop_message(void *cb, struct gru_message_queue_desc *mqd,
                                 ret = MQE_UNEXPECTED_CB_ERR;
                         break;
                 case CBSS_PAGE_OVERFLOW:
+                        STAT(mesq_noop_page_overflow);
+                        /* fallthru */
                 default:
                         BUG();
                 }
@@ -674,18 +704,6 @@ cberr:
 }
 
 /*
- * Send a cross-partition interrupt to the SSI that contains the target
- * message queue. Normally, the interrupt is automatically delivered by hardware
- * but some error conditions require explicit delivery.
- */
-static void send_message_queue_interrupt(struct gru_message_queue_desc *mqd)
-{
-        if (mqd->interrupt_vector)
-                uv_hub_send_ipi(mqd->interrupt_pnode, mqd->interrupt_apicid,
-                                mqd->interrupt_vector);
-}
-
-/*
  * Handle a PUT failure. Note: if message was a 2-line message, one of the
  * lines might have successfully have been written. Before sending the
  * message, "present" must be cleared in BOTH lines to prevent the receiver
@@ -694,7 +712,8 @@ static void send_message_queue_interrupt(struct gru_message_queue_desc *mqd)
 static int send_message_put_nacked(void *cb, struct gru_message_queue_desc *mqd,
                         void *mesg, int lines)
 {
-        unsigned long m;
+        unsigned long m, *val = mesg, gpa, save;
+        int ret;
 
         m = mqd->mq_gpa + (gru_get_amo_value_head(cb) << 6);
         if (lines == 2) {
@@ -705,7 +724,26 @@ static int send_message_put_nacked(void *cb, struct gru_message_queue_desc *mqd,
         gru_vstore(cb, m, gru_get_tri(mesg), XTYPE_CL, lines, 1, IMA);
         if (gru_wait(cb) != CBS_IDLE)
                 return MQE_UNEXPECTED_CB_ERR;
-        send_message_queue_interrupt(mqd);
+
+        if (!mqd->interrupt_vector)
+                return MQE_OK;
+
+        /*
+         * Send a cross-partition interrupt to the SSI that contains the target
+         * message queue. Normally, the interrupt is automatically delivered by
+         * hardware but some error conditions require explicit delivery.
+         * Use the GRU to deliver the interrupt. Otherwise partition failures
+         * could cause unrecovered errors.
+         */
+        gpa = uv_global_gru_mmr_address(mqd->interrupt_pnode, UVH_IPI_INT);
+        save = *val;
+        *val = uv_hub_ipi_value(mqd->interrupt_apicid, mqd->interrupt_vector,
+                                dest_Fixed);
+        gru_vstore_phys(cb, gpa, gru_get_tri(mesg), IAA_REGISTER, IMA);
+        ret = gru_wait(cb);
+        *val = save;
+        if (ret != CBS_IDLE)
+                return MQE_UNEXPECTED_CB_ERR;
         return MQE_OK;
 }
 
@@ -740,6 +778,9 @@ static int send_message_failure(void *cb, struct gru_message_queue_desc *mqd,
                 STAT(mesq_send_put_nacked);
                 ret = send_message_put_nacked(cb, mqd, mesg, lines);
                 break;
+        case CBSS_PAGE_OVERFLOW:
+                STAT(mesq_page_overflow);
+                /* fallthru */
         default:
                 BUG();
         }
@@ -832,7 +873,6 @@ void *gru_get_next_message(struct gru_message_queue_desc *mqd)
         int present = mhdr->present;
 
         /* skip NOOP messages */
-        STAT(mesq_receive);
         while (present == MQS_NOOP) {
                 gru_free_message(mqd, mhdr);
                 mhdr = mq->next;
@@ -852,6 +892,7 @@ void *gru_get_next_message(struct gru_message_queue_desc *mqd)
         if (mhdr->lines == 2)
                 restore_present2(mhdr, mhdr->present2);
 
+        STAT(mesq_receive);
         return mhdr;
 }
 EXPORT_SYMBOL_GPL(gru_get_next_message);
@@ -859,6 +900,29 @@ EXPORT_SYMBOL_GPL(gru_get_next_message);
 /* ---------------------- GRU DATA COPY FUNCTIONS ---------------------------*/
 
 /*
+ * Load a DW from a global GPA. The GPA can be a memory or MMR address.
+ */
+int gru_read_gpa(unsigned long *value, unsigned long gpa)
+{
+        void *cb;
+        void *dsr;
+        int ret, iaa;
+
+        STAT(read_gpa);
+        if (gru_get_cpu_resources(GRU_NUM_KERNEL_DSR_BYTES, &cb, &dsr))
+                return MQE_BUG_NO_RESOURCES;
+        iaa = gpa >> 62;
+        gru_vload_phys(cb, gpa, gru_get_tri(dsr), iaa, IMA);
+        ret = gru_wait(cb);
+        if (ret == CBS_IDLE)
+                *value = *(unsigned long *)dsr;
+        gru_free_cpu_resources(cb, dsr);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(gru_read_gpa);
+
+
+/*
  * Copy a block of data using the GRU resources
  */
 int gru_copy_gpa(unsigned long dest_gpa, unsigned long src_gpa,
@@ -899,24 +963,24 @@ static int quicktest0(unsigned long arg)
 
         gru_vload(cb, uv_gpa(&word0), gru_get_tri(dsr), XTYPE_DW, 1, 1, IMA);
         if (gru_wait(cb) != CBS_IDLE) {
-                printk(KERN_DEBUG "GRU quicktest0: CBR failure 1\n");
+                printk(KERN_DEBUG "GRU:%d quicktest0: CBR failure 1\n", smp_processor_id());
                 goto done;
         }
 
         if (*p != MAGIC) {
-                printk(KERN_DEBUG "GRU: quicktest0 bad magic 0x%lx\n", *p);
+                printk(KERN_DEBUG "GRU:%d quicktest0 bad magic 0x%lx\n", smp_processor_id(), *p);
                 goto done;
         }
         gru_vstore(cb, uv_gpa(&word1), gru_get_tri(dsr), XTYPE_DW, 1, 1, IMA);
         if (gru_wait(cb) != CBS_IDLE) {
-                printk(KERN_DEBUG "GRU quicktest0: CBR failure 2\n");
+                printk(KERN_DEBUG "GRU:%d quicktest0: CBR failure 2\n", smp_processor_id());
                 goto done;
         }
 
         if (word0 != word1 || word1 != MAGIC) {
                 printk(KERN_DEBUG
-                       "GRU quicktest0 err: found 0x%lx, expected 0x%lx\n",
-                     word1, MAGIC);
+                       "GRU:%d quicktest0 err: found 0x%lx, expected 0x%lx\n",
+                     smp_processor_id(), word1, MAGIC);
                 goto done;
         }
         ret = 0;
@@ -938,6 +1002,8 @@ static int quicktest1(unsigned long arg)
 
         /* Need  1K cacheline aligned that does not cross page boundary */
         p = kmalloc(4096, 0);
+        if (p == NULL)
+                return -ENOMEM;
         mq = ALIGNUP(p, 1024);
         memset(mes, 0xee, sizeof(mes));
         dw = mq;
@@ -951,8 +1017,11 @@ static int quicktest1(unsigned long arg)
                 if (ret)
                         break;
         }
-        if (ret != MQE_QUEUE_FULL || i != 4)
+        if (ret != MQE_QUEUE_FULL || i != 4) {
+                printk(KERN_DEBUG "GRU:%d quicktest1: unexpect status %d, i %d\n",
+                       smp_processor_id(), ret, i);
                 goto done;
+        }
 
         for (i = 0; i < 6; i++) {
                 m = gru_get_next_message(&mqd);
@@ -960,7 +1029,12 @@ static int quicktest1(unsigned long arg)
                         break;
                 gru_free_message(&mqd, m);
         }
-        ret = (i == 4) ? 0 : -EIO;
+        if (i != 4) {
+                printk(KERN_DEBUG "GRU:%d quicktest2: bad message, i %d, m %p, m8 %d\n",
+                        smp_processor_id(), i, m, m ? m[8] : -1);
+                goto done;
+        }
+        ret = 0;
 
 done:
         kfree(p);
@@ -976,6 +1050,7 @@ static int quicktest2(unsigned long arg)
         int ret = 0;
         unsigned long *buf;
         void *cb0, *cb;
+        struct gru_control_block_status *gen;
         int i, k, istatus, bytes;
 
         bytes = numcb * 4 * 8;
@@ -995,20 +1070,30 @@ static int quicktest2(unsigned long arg)
                                 XTYPE_DW, 4, 1, IMA_INTERRUPT);
 
         ret = 0;
-        for (k = 0; k < numcb; k++) {
+        k = numcb;
+        do {
                 gru_wait_async_cbr(han);
                 for (i = 0; i < numcb; i++) {
                         cb = cb0 + i * GRU_HANDLE_STRIDE;
                         istatus = gru_check_status(cb);
-                        if (istatus == CBS_ACTIVE)
-                                continue;
-                        if (istatus == CBS_EXCEPTION)
-                                ret = -EFAULT;
-                        else if (buf[i] || buf[i + 1] || buf[i + 2] ||
-                                        buf[i + 3])
-                                ret = -EIO;
+                        if (istatus != CBS_ACTIVE && istatus != CBS_CALL_OS)
+                                break;
                 }
-        }
+                if (i == numcb)
+                        continue;
+                if (istatus != CBS_IDLE) {
+                        printk(KERN_DEBUG "GRU:%d quicktest2: cb %d, exception\n", smp_processor_id(), i);
+                        ret = -EFAULT;
+                } else if (buf[4 * i] || buf[4 * i + 1] || buf[4 * i + 2] ||
+                                buf[4 * i + 3]) {
+                        printk(KERN_DEBUG "GRU:%d quicktest2:cb %d,  buf 0x%lx, 0x%lx, 0x%lx, 0x%lx\n",
+                               smp_processor_id(), i, buf[4 * i], buf[4 * i + 1], buf[4 * i + 2], buf[4 * i + 3]);
+                        ret = -EIO;
+                }
+                k--;
+                gen = cb;
+                gen->istatus = CBS_CALL_OS; /* don't handle this CBR again */
+        } while (k);
         BUG_ON(cmp.done);
 
         gru_unlock_async_resource(han);
@@ -1018,6 +1103,22 @@ done:
         return ret;
 }
 
+#define BUFSIZE 200
+static int quicktest3(unsigned long arg)
+{
+        char buf1[BUFSIZE], buf2[BUFSIZE];
+        int ret = 0;
+
+        memset(buf2, 0, sizeof(buf2));
+        memset(buf1, get_cycles() & 255, sizeof(buf1));
+        gru_copy_gpa(uv_gpa(buf2), uv_gpa(buf1), BUFSIZE);
+        if (memcmp(buf1, buf2, BUFSIZE)) {
+                printk(KERN_DEBUG "GRU:%d quicktest3 error\n", smp_processor_id());
+                ret = -EIO;
+        }
+        return ret;
+}
+
 /*
  * Debugging only. User hook for various kernel tests
  * of driver & gru.
@@ -1036,6 +1137,9 @@ int gru_ktest(unsigned long arg)
         case 2:
                 ret = quicktest2(arg);
                 break;
+        case 3:
+                ret = quicktest3(arg);
+                break;
         case 99:
                 ret = gru_free_kernel_contexts();
                 break;
diff --git a/drivers/misc/sgi-gru/grukservices.h b/drivers/misc/sgi-gru/grukservices.h
index d60d34bca44d..02aa94d8484a 100644
--- a/drivers/misc/sgi-gru/grukservices.h
+++ b/drivers/misc/sgi-gru/grukservices.h
@@ -131,6 +131,20 @@ extern void *gru_get_next_message(struct gru_message_queue_desc *mqd);
 
 
 /*
+ * Read a GRU global GPA. Source can be located in a remote partition.
+ *
+ *    Input:
+ *      value           memory address where MMR value is returned
+ *      gpa             source numalink physical address of GPA
+ *
+ *    Output:
+ *      0               OK
+ *      >0              error
+ */
+int gru_read_gpa(unsigned long *value, unsigned long gpa);
+
+
+/*
  * Copy data using the GRU. Source or destination can be located in a remote
  * partition.
  *
diff --git a/drivers/misc/sgi-gru/grulib.h b/drivers/misc/sgi-gru/grulib.h
index 889bc442a3e8..e77d1b1f9d05 100644
--- a/drivers/misc/sgi-gru/grulib.h
+++ b/drivers/misc/sgi-gru/grulib.h
@@ -63,18 +63,9 @@
 #define THREAD_POINTER(p, th)           (p + GRU_GSEG_PAGESIZE * (th))
 #define GSEG_START(cb)                  ((void *)((unsigned long)(cb) & ~(GRU_GSEG_PAGESIZE - 1)))
 
-/*
- * Statictics kept on a per-GTS basis.
- */
-struct gts_statistics {
-        unsigned long   fmm_tlbdropin;
-        unsigned long   upm_tlbdropin;
-        unsigned long   context_stolen;
-};
-
 struct gru_get_gseg_statistics_req {
-        unsigned long           gseg;
-        struct gts_statistics   stats;
+        unsigned long                   gseg;
+        struct gru_gseg_statistics      stats;
 };
 
 /*
@@ -86,6 +77,7 @@ struct gru_create_context_req {
         unsigned int            control_blocks;
         unsigned int            maximum_thread_count;
         unsigned int            options;
+        unsigned char           tlb_preload_count;
 };
 
 /*
@@ -98,11 +90,12 @@ struct gru_unload_context_req {
 /*
  * Structure used to set context options
  */
-enum {sco_gseg_owner, sco_cch_req_slice};
+enum {sco_gseg_owner, sco_cch_req_slice, sco_blade_chiplet};
 struct gru_set_context_option_req {
         unsigned long   gseg;
         int             op;
-        unsigned long   val1;
+        int             val0;
+        long            val1;
 };
 
 /*
@@ -124,6 +117,8 @@ struct gru_dump_chiplet_state_req {
         int             ctxnum;
         char            data_opt;
         char            lock_cch;
+        char            flush_cbrs;
+        char            fill[10];
         pid_t           pid;
         void            *buf;
         size_t          buflen;
diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c
index 3bc643dad606..f8538bbd0bfa 100644
--- a/drivers/misc/sgi-gru/grumain.c
+++ b/drivers/misc/sgi-gru/grumain.c
@@ -27,6 +27,7 @@
 #include <linux/sched.h>
 #include <linux/device.h>
 #include <linux/list.h>
+#include <linux/err.h>
 #include <asm/uv/uv_hub.h>
 #include "gru.h"
 #include "grutables.h"
@@ -48,12 +49,20 @@ struct device *grudev = &gru_device;
 /*
  * Select a gru fault map to be used by the current cpu. Note that
  * multiple cpus may be using the same map.
- *      ZZZ should "shift" be used?? Depends on HT cpu numbering
  *      ZZZ should be inline but did not work on emulator
  */
 int gru_cpu_fault_map_id(void)
 {
+#ifdef CONFIG_IA64
         return uv_blade_processor_id() % GRU_NUM_TFM;
+#else
+        int cpu = smp_processor_id();
+        int id, core;
+
+        core = uv_cpu_core_number(cpu);
+        id = core + UV_MAX_INT_CORES * uv_cpu_socket_number(cpu);
+        return id;
+#endif
 }
 
 /*--------- ASID Management -------------------------------------------
@@ -286,7 +295,8 @@ static void gru_unload_mm_tracker(struct gru_state *gru,
 void gts_drop(struct gru_thread_state *gts)
 {
         if (gts && atomic_dec_return(&gts->ts_refcnt) == 0) {
-                gru_drop_mmu_notifier(gts->ts_gms);
+                if (gts->ts_gms)
+                        gru_drop_mmu_notifier(gts->ts_gms);
                 kfree(gts);
                 STAT(gts_free);
         }
@@ -310,16 +320,18 @@ static struct gru_thread_state *gru_find_current_gts_nolock(struct gru_vma_data
  * Allocate a thread state structure.
  */
 struct gru_thread_state *gru_alloc_gts(struct vm_area_struct *vma,
-                int cbr_au_count, int dsr_au_count, int options, int tsid)
+                int cbr_au_count, int dsr_au_count,
+                unsigned char tlb_preload_count, int options, int tsid)
 {
         struct gru_thread_state *gts;
+        struct gru_mm_struct *gms;
         int bytes;
 
         bytes = DSR_BYTES(dsr_au_count) + CBR_BYTES(cbr_au_count);
         bytes += sizeof(struct gru_thread_state);
         gts = kmalloc(bytes, GFP_KERNEL);
         if (!gts)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         STAT(gts_alloc);
         memset(gts, 0, sizeof(struct gru_thread_state)); /* zero out header */
@@ -327,7 +339,10 @@ struct gru_thread_state *gru_alloc_gts(struct vm_area_struct *vma,
         mutex_init(&gts->ts_ctxlock);
         gts->ts_cbr_au_count = cbr_au_count;
         gts->ts_dsr_au_count = dsr_au_count;
+        gts->ts_tlb_preload_count = tlb_preload_count;
         gts->ts_user_options = options;
+        gts->ts_user_blade_id = -1;
+        gts->ts_user_chiplet_id = -1;
         gts->ts_tsid = tsid;
         gts->ts_ctxnum = NULLCTX;
         gts->ts_tlb_int_select = -1;
@@ -336,9 +351,10 @@ struct gru_thread_state *gru_alloc_gts(struct vm_area_struct *vma,
         if (vma) {
                 gts->ts_mm = current->mm;
                 gts->ts_vma = vma;
-                gts->ts_gms = gru_register_mmu_notifier();
-                if (!gts->ts_gms)
+                gms = gru_register_mmu_notifier();
+                if (IS_ERR(gms))
                         goto err;
+                gts->ts_gms = gms;
         }
 
         gru_dbg(grudev, "alloc gts %p\n", gts);
@@ -346,7 +362,7 @@ struct gru_thread_state *gru_alloc_gts(struct vm_area_struct *vma,
 
 err:
         gts_drop(gts);
-        return NULL;
+        return ERR_CAST(gms);
 }
 
 /*
@@ -360,6 +376,7 @@ struct gru_vma_data *gru_alloc_vma_data(struct vm_area_struct *vma, int tsid)
         if (!vdata)
                 return NULL;
 
+        STAT(vdata_alloc);
         INIT_LIST_HEAD(&vdata->vd_head);
         spin_lock_init(&vdata->vd_lock);
         gru_dbg(grudev, "alloc vdata %p\n", vdata);
@@ -392,10 +409,12 @@ struct gru_thread_state *gru_alloc_thread_state(struct vm_area_struct *vma,
         struct gru_vma_data *vdata = vma->vm_private_data;
         struct gru_thread_state *gts, *ngts;
 
-        gts = gru_alloc_gts(vma, vdata->vd_cbr_au_count, vdata->vd_dsr_au_count,
+        gts = gru_alloc_gts(vma, vdata->vd_cbr_au_count,
+                            vdata->vd_dsr_au_count,
+                            vdata->vd_tlb_preload_count,
                             vdata->vd_user_options, tsid);
-        if (!gts)
-                return NULL;
+        if (IS_ERR(gts))
+                return gts;
 
         spin_lock(&vdata->vd_lock);
         ngts = gru_find_current_gts_nolock(vdata, tsid);
@@ -493,6 +512,9 @@ static void gru_load_context_data(void *save, void *grubase, int ctxnum,
                         memset(cbe + i * GRU_HANDLE_STRIDE, 0,
                                                 GRU_CACHE_LINE_BYTES);
                 }
+                /* Flush CBE to hide race in context restart */
+                mb();
+                gru_flush_cache(cbe + i * GRU_HANDLE_STRIDE);
                 cb += GRU_HANDLE_STRIDE;
         }
 
@@ -513,6 +535,12 @@ static void gru_unload_context_data(void *save, void *grubase, int ctxnum,
         cb = gseg + GRU_CB_BASE;
         cbe = grubase + GRU_CBE_BASE;
         length = hweight64(dsrmap) * GRU_DSR_AU_BYTES;
+
+        /* CBEs may not be coherent. Flush them from cache */
+        for_each_cbr_in_allocation_map(i, &cbrmap, scr)
+                gru_flush_cache(cbe + i * GRU_HANDLE_STRIDE);
+        mb();           /* Let the CL flush complete */
+
         gru_prefetch_context(gseg, cb, cbe, cbrmap, length);
 
         for_each_cbr_in_allocation_map(i, &cbrmap, scr) {
@@ -533,7 +561,8 @@ void gru_unload_context(struct gru_thread_state *gts, int savestate)
                 zap_vma_ptes(gts->ts_vma, UGRUADDR(gts), GRU_GSEG_PAGESIZE);
         cch = get_cch(gru->gs_gru_base_vaddr, ctxnum);
 
-        gru_dbg(grudev, "gts %p\n", gts);
+        gru_dbg(grudev, "gts %p, cbrmap 0x%lx, dsrmap 0x%lx\n",
+                gts, gts->ts_cbr_map, gts->ts_dsr_map);
         lock_cch_handle(cch);
         if (cch_interrupt_sync(cch))
                 BUG();
@@ -549,7 +578,6 @@ void gru_unload_context(struct gru_thread_state *gts, int savestate)
 
         if (cch_deallocate(cch))
                 BUG();
-        gts->ts_force_unload = 0;       /* ts_force_unload locked by CCH lock */
         unlock_cch_handle(cch);
 
         gru_free_gru_context(gts);
@@ -565,9 +593,7 @@ void gru_load_context(struct gru_thread_state *gts)
         struct gru_context_configuration_handle *cch;
         int i, err, asid, ctxnum = gts->ts_ctxnum;
 
-        gru_dbg(grudev, "gts %p\n", gts);
         cch = get_cch(gru->gs_gru_base_vaddr, ctxnum);
-
         lock_cch_handle(cch);
         cch->tfm_fault_bit_enable =
             (gts->ts_user_options == GRU_OPT_MISS_FMM_POLL
@@ -591,6 +617,7 @@ void gru_load_context(struct gru_thread_state *gts)
                 cch->unmap_enable = 1;
                 cch->tfm_done_bit_enable = 1;
                 cch->cb_int_enable = 1;
+                cch->tlb_int_select = 0;        /* For now, ints go to cpu 0 */
         } else {
                 cch->unmap_enable = 0;
                 cch->tfm_done_bit_enable = 0;
@@ -616,17 +643,18 @@ void gru_load_context(struct gru_thread_state *gts)
         if (cch_start(cch))
                 BUG();
         unlock_cch_handle(cch);
+
+        gru_dbg(grudev, "gid %d, gts %p, cbrmap 0x%lx, dsrmap 0x%lx, tie %d, tis %d\n",
+                gts->ts_gru->gs_gid, gts, gts->ts_cbr_map, gts->ts_dsr_map,
+                (gts->ts_user_options == GRU_OPT_MISS_FMM_INTR), gts->ts_tlb_int_select);
 }
 
 /*
  * Update fields in an active CCH:
  *      - retarget interrupts on local blade
  *      - update sizeavail mask
- *      - force a delayed context unload by clearing the CCH asids. This
- *        forces TLB misses for new GRU instructions. The context is unloaded
- *        when the next TLB miss occurs.
  */
-int gru_update_cch(struct gru_thread_state *gts, int force_unload)
+int gru_update_cch(struct gru_thread_state *gts)
 {
         struct gru_context_configuration_handle *cch;
         struct gru_state *gru = gts->ts_gru;
@@ -640,21 +668,13 @@ int gru_update_cch(struct gru_thread_state *gts, int force_unload)
                         goto exit;
                 if (cch_interrupt(cch))
                         BUG();
-                if (!force_unload) {
-                        for (i = 0; i < 8; i++)
-                                cch->sizeavail[i] = gts->ts_sizeavail;
-                        gts->ts_tlb_int_select = gru_cpu_fault_map_id();
-                        cch->tlb_int_select = gru_cpu_fault_map_id();
-                        cch->tfm_fault_bit_enable =
-                          (gts->ts_user_options == GRU_OPT_MISS_FMM_POLL
-                            || gts->ts_user_options == GRU_OPT_MISS_FMM_INTR);
-                } else {
-                        for (i = 0; i < 8; i++)
-                                cch->asid[i] = 0;
-                        cch->tfm_fault_bit_enable = 0;
-                        cch->tlb_int_enable = 0;
-                        gts->ts_force_unload = 1;
-                }
+                for (i = 0; i < 8; i++)
+                        cch->sizeavail[i] = gts->ts_sizeavail;
+                gts->ts_tlb_int_select = gru_cpu_fault_map_id();
+                cch->tlb_int_select = gru_cpu_fault_map_id();
+                cch->tfm_fault_bit_enable =
+                  (gts->ts_user_options == GRU_OPT_MISS_FMM_POLL
+                    || gts->ts_user_options == GRU_OPT_MISS_FMM_INTR);
                 if (cch_start(cch))
                         BUG();
                 ret = 1;
@@ -679,7 +699,54 @@ static int gru_retarget_intr(struct gru_thread_state *gts)
 
         gru_dbg(grudev, "retarget from %d to %d\n", gts->ts_tlb_int_select,
                 gru_cpu_fault_map_id());
-        return gru_update_cch(gts, 0);
+        return gru_update_cch(gts);
+}
+
+/*
+ * Check if a GRU context is allowed to use a specific chiplet. By default
+ * a context is assigned to any blade-local chiplet. However, users can
+ * override this.
+ *      Returns 1 if assignment allowed, 0 otherwise
+ */
+static int gru_check_chiplet_assignment(struct gru_state *gru,
+                                        struct gru_thread_state *gts)
+{
+        int blade_id;
+        int chiplet_id;
+
+        blade_id = gts->ts_user_blade_id;
+        if (blade_id < 0)
+                blade_id = uv_numa_blade_id();
+
+        chiplet_id = gts->ts_user_chiplet_id;
+        return gru->gs_blade_id == blade_id &&
+                (chiplet_id < 0 || chiplet_id == gru->gs_chiplet_id);
+}
+
+/*
+ * Unload the gru context if it is not assigned to the correct blade or
+ * chiplet. Misassignment can occur if the process migrates to a different
+ * blade or if the user changes the selected blade/chiplet.
+ */
+void gru_check_context_placement(struct gru_thread_state *gts)
+{
+        struct gru_state *gru;
+
+        /*
+         * If the current task is the context owner, verify that the
+         * context is correctly placed. This test is skipped for non-owner
+         * references. Pthread apps use non-owner references to the CBRs.
+         */
+        gru = gts->ts_gru;
+        if (!gru || gts->ts_tgid_owner != current->tgid)
+                return;
+
+        if (!gru_check_chiplet_assignment(gru, gts)) {
+                STAT(check_context_unload);
+                gru_unload_context(gts, 1);
+        } else if (gru_retarget_intr(gts)) {
+                STAT(check_context_retarget_intr);
+        }
 }
 
 
@@ -712,13 +779,17 @@ static void gts_stolen(struct gru_thread_state *gts,
         }
 }
 
-void gru_steal_context(struct gru_thread_state *gts, int blade_id)
+void gru_steal_context(struct gru_thread_state *gts)
 {
         struct gru_blade_state *blade;
         struct gru_state *gru, *gru0;
         struct gru_thread_state *ngts = NULL;
         int ctxnum, ctxnum0, flag = 0, cbr, dsr;
+        int blade_id;
 
+        blade_id = gts->ts_user_blade_id;
+        if (blade_id < 0)
+                blade_id = uv_numa_blade_id();
         cbr = gts->ts_cbr_au_count;
         dsr = gts->ts_dsr_au_count;
 
@@ -729,35 +800,39 @@ void gru_steal_context(struct gru_thread_state *gts, int blade_id)
         gru = blade->bs_lru_gru;
         if (ctxnum == 0)
                 gru = next_gru(blade, gru);
+        blade->bs_lru_gru = gru;
+        blade->bs_lru_ctxnum = ctxnum;
         ctxnum0 = ctxnum;
         gru0 = gru;
         while (1) {
-                if (check_gru_resources(gru, cbr, dsr, GRU_NUM_CCH))
-                        break;
-                spin_lock(&gru->gs_lock);
-                for (; ctxnum < GRU_NUM_CCH; ctxnum++) {
-                        if (flag && gru == gru0 && ctxnum == ctxnum0)
+                if (gru_check_chiplet_assignment(gru, gts)) {
+                        if (check_gru_resources(gru, cbr, dsr, GRU_NUM_CCH))
                                 break;
-                        ngts = gru->gs_gts[ctxnum];
-                        /*
-                         * We are grabbing locks out of order, so trylock is
-                         * needed. GTSs are usually not locked, so the odds of
-                         * success are high. If trylock fails, try to steal a
-                         * different GSEG.
-                         */
-                        if (ngts && is_gts_stealable(ngts, blade))
+                        spin_lock(&gru->gs_lock);
+                        for (; ctxnum < GRU_NUM_CCH; ctxnum++) {
+                                if (flag && gru == gru0 && ctxnum == ctxnum0)
+                                        break;
+                                ngts = gru->gs_gts[ctxnum];
+                                /*
+                                * We are grabbing locks out of order, so trylock is
+                                * needed. GTSs are usually not locked, so the odds of
+                                * success are high. If trylock fails, try to steal a
+                                * different GSEG.
+                                */
+                                if (ngts && is_gts_stealable(ngts, blade))
+                                        break;
+                                ngts = NULL;
+                        }
+                        spin_unlock(&gru->gs_lock);
+                        if (ngts || (flag && gru == gru0 && ctxnum == ctxnum0))
                                 break;
-                        ngts = NULL;
-                        flag = 1;
                 }
-                spin_unlock(&gru->gs_lock);
-                if (ngts || (flag && gru == gru0 && ctxnum == ctxnum0))
+                if (flag && gru == gru0)
                         break;
+                flag = 1;
                 ctxnum = 0;
                 gru = next_gru(blade, gru);
         }
-        blade->bs_lru_gru = gru;
-        blade->bs_lru_ctxnum = ctxnum;
         spin_unlock(&blade->bs_lock);
 
         if (ngts) {
@@ -776,19 +851,34 @@ void gru_steal_context(struct gru_thread_state *gts, int blade_id)
 }
 
 /*
+ * Assign a gru context.
+ */
+static int gru_assign_context_number(struct gru_state *gru)
+{
+        int ctxnum;
+
+        ctxnum = find_first_zero_bit(&gru->gs_context_map, GRU_NUM_CCH);
+        __set_bit(ctxnum, &gru->gs_context_map);
+        return ctxnum;
+}
+
+/*
  * Scan the GRUs on the local blade & assign a GRU context.
  */
-struct gru_state *gru_assign_gru_context(struct gru_thread_state *gts,
-                                                int blade)
+struct gru_state *gru_assign_gru_context(struct gru_thread_state *gts)
 {
         struct gru_state *gru, *grux;
         int i, max_active_contexts;
+        int blade_id = gts->ts_user_blade_id;
 
-
+        if (blade_id < 0)
+                blade_id = uv_numa_blade_id();
 again:
         gru = NULL;
         max_active_contexts = GRU_NUM_CCH;
-        for_each_gru_on_blade(grux, blade, i) {
+        for_each_gru_on_blade(grux, blade_id, i) {
+                if (!gru_check_chiplet_assignment(grux, gts))
+                        continue;
                 if (check_gru_resources(grux, gts->ts_cbr_au_count,
                                         gts->ts_dsr_au_count,
                                         max_active_contexts)) {
@@ -809,12 +899,9 @@ again:
                 reserve_gru_resources(gru, gts);
                 gts->ts_gru = gru;
                 gts->ts_blade = gru->gs_blade_id;
-                gts->ts_ctxnum =
-                    find_first_zero_bit(&gru->gs_context_map, GRU_NUM_CCH);
-                BUG_ON(gts->ts_ctxnum == GRU_NUM_CCH);
+                gts->ts_ctxnum = gru_assign_context_number(gru);
                 atomic_inc(&gts->ts_refcnt);
                 gru->gs_gts[gts->ts_ctxnum] = gts;
-                __set_bit(gts->ts_ctxnum, &gru->gs_context_map);
                 spin_unlock(&gru->gs_lock);
 
                 STAT(assign_context);
@@ -842,7 +929,6 @@ int gru_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
         struct gru_thread_state *gts;
         unsigned long paddr, vaddr;
-        int blade_id;
 
         vaddr = (unsigned long)vmf->virtual_address;
         gru_dbg(grudev, "vma %p, vaddr 0x%lx (0x%lx)\n",
@@ -857,28 +943,18 @@ int gru_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 again:
         mutex_lock(&gts->ts_ctxlock);
         preempt_disable();
-        blade_id = uv_numa_blade_id();
 
-        if (gts->ts_gru) {
-                if (gts->ts_gru->gs_blade_id != blade_id) {
-                        STAT(migrated_nopfn_unload);
-                        gru_unload_context(gts, 1);
-                } else {
-                        if (gru_retarget_intr(gts))
-                                STAT(migrated_nopfn_retarget);
-                }
-        }
+        gru_check_context_placement(gts);
 
         if (!gts->ts_gru) {
                 STAT(load_user_context);
-                if (!gru_assign_gru_context(gts, blade_id)) {
+                if (!gru_assign_gru_context(gts)) {
                         preempt_enable();
                         mutex_unlock(&gts->ts_ctxlock);
                         set_current_state(TASK_INTERRUPTIBLE);
                         schedule_timeout(GRU_ASSIGN_DELAY);  /* true hack ZZZ */
-                        blade_id = uv_numa_blade_id();
                         if (gts->ts_steal_jiffies + GRU_STEAL_DELAY < jiffies)
-                                gru_steal_context(gts, blade_id);
+                                gru_steal_context(gts);
                         goto again;
                 }
                 gru_load_context(gts);
diff --git a/drivers/misc/sgi-gru/gruprocfs.c b/drivers/misc/sgi-gru/gruprocfs.c
index 9cbf95bedce6..7768b87d995b 100644
--- a/drivers/misc/sgi-gru/gruprocfs.c
+++ b/drivers/misc/sgi-gru/gruprocfs.c
@@ -36,8 +36,7 @@ static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
 {
         unsigned long val = atomic_long_read(v);
 
-        if (val)
-                seq_printf(s, "%16lu %s\n", val, id);
+        seq_printf(s, "%16lu %s\n", val, id);
 }
 
 static int statistics_show(struct seq_file *s, void *p)
@@ -46,7 +45,8 @@ static int statistics_show(struct seq_file *s, void *p)
         printstat(s, vdata_free);
         printstat(s, gts_alloc);
         printstat(s, gts_free);
-        printstat(s, vdata_double_alloc);
+        printstat(s, gms_alloc);
+        printstat(s, gms_free);
         printstat(s, gts_double_allocate);
         printstat(s, assign_context);
         printstat(s, assign_context_failed);
@@ -59,28 +59,25 @@ static int statistics_show(struct seq_file *s, void *p)
         printstat(s, steal_kernel_context);
         printstat(s, steal_context_failed);
         printstat(s, nopfn);
-        printstat(s, break_cow);
         printstat(s, asid_new);
         printstat(s, asid_next);
         printstat(s, asid_wrap);
         printstat(s, asid_reuse);
         printstat(s, intr);
+        printstat(s, intr_cbr);
+        printstat(s, intr_tfh);
+        printstat(s, intr_spurious);
         printstat(s, intr_mm_lock_failed);
         printstat(s, call_os);
-        printstat(s, call_os_offnode_reference);
-        printstat(s, call_os_check_for_bug);
         printstat(s, call_os_wait_queue);
         printstat(s, user_flush_tlb);
         printstat(s, user_unload_context);
         printstat(s, user_exception);
         printstat(s, set_context_option);
-        printstat(s, migrate_check);
-        printstat(s, migrated_retarget);
-        printstat(s, migrated_unload);
-        printstat(s, migrated_unload_delay);
-        printstat(s, migrated_nopfn_retarget);
-        printstat(s, migrated_nopfn_unload);
+        printstat(s, check_context_retarget_intr);
+        printstat(s, check_context_unload);
         printstat(s, tlb_dropin);
+        printstat(s, tlb_preload_page);
         printstat(s, tlb_dropin_fail_no_asid);
         printstat(s, tlb_dropin_fail_upm);
         printstat(s, tlb_dropin_fail_invalid);
@@ -88,16 +85,15 @@ static int statistics_show(struct seq_file *s, void *p)
         printstat(s, tlb_dropin_fail_idle);
         printstat(s, tlb_dropin_fail_fmm);
         printstat(s, tlb_dropin_fail_no_exception);
-        printstat(s, tlb_dropin_fail_no_exception_war);
         printstat(s, tfh_stale_on_fault);
         printstat(s, mmu_invalidate_range);
         printstat(s, mmu_invalidate_page);
-        printstat(s, mmu_clear_flush_young);
         printstat(s, flush_tlb);
         printstat(s, flush_tlb_gru);
         printstat(s, flush_tlb_gru_tgh);
         printstat(s, flush_tlb_gru_zero_asid);
         printstat(s, copy_gpa);
+        printstat(s, read_gpa);
         printstat(s, mesq_receive);
         printstat(s, mesq_receive_none);
         printstat(s, mesq_send);
@@ -108,7 +104,6 @@ static int statistics_show(struct seq_file *s, void *p)
         printstat(s, mesq_send_qlimit_reached);
         printstat(s, mesq_send_amo_nacked);
         printstat(s, mesq_send_put_nacked);
-        printstat(s, mesq_qf_not_full);
         printstat(s, mesq_qf_locked);
         printstat(s, mesq_qf_noop_not_full);
         printstat(s, mesq_qf_switch_head_failed);
@@ -118,6 +113,7 @@ static int statistics_show(struct seq_file *s, void *p)
         printstat(s, mesq_noop_qlimit_reached);
         printstat(s, mesq_noop_amo_nacked);
         printstat(s, mesq_noop_put_nacked);
+        printstat(s, mesq_noop_page_overflow);
         return 0;
 }
 
@@ -133,8 +129,10 @@ static int mcs_statistics_show(struct seq_file *s, void *p)
         int op;
         unsigned long total, count, max;
         static char *id[] = {"cch_allocate", "cch_start", "cch_interrupt",
-                "cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
+                "cch_interrupt_sync", "cch_deallocate", "tfh_write_only",
+                "tfh_write_restart", "tgh_invalidate"};
 
+        seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
         for (op = 0; op < mcsop_last; op++) {
                 count = atomic_long_read(&mcs_op_statistics[op].count);
                 total = atomic_long_read(&mcs_op_statistics[op].total);
@@ -154,6 +152,7 @@ static ssize_t mcs_statistics_write(struct file *file,
 
 static int options_show(struct seq_file *s, void *p)
 {
+        seq_printf(s, "#bitmask: 1=trace, 2=statistics\n");
         seq_printf(s, "0x%lx\n", gru_options);
         return 0;
 }
@@ -161,14 +160,15 @@ static int options_show(struct seq_file *s, void *p)
 static ssize_t options_write(struct file *file, const char __user *userbuf,
                              size_t count, loff_t *data)
 {
-        unsigned long val;
-        char buf[80];
+        char buf[20];
 
-        if (strncpy_from_user(buf, userbuf, sizeof(buf) - 1) < 0)
+        if (count >= sizeof(buf))
+                return -EINVAL;
+        if (copy_from_user(buf, userbuf, count))
                 return -EFAULT;
-        buf[count - 1] = '\0';
-        if (!strict_strtoul(buf, 10, &val))
-                gru_options = val;
+        buf[count] = '\0';
+        if (strict_strtoul(buf, 0, &gru_options))
+                return -EINVAL;
 
         return count;
 }
@@ -182,16 +182,17 @@ static int cch_seq_show(struct seq_file *file, void *data)
         const char *mode[] = { "??", "UPM", "INTR", "OS_POLL" };
 
         if (gid == 0)
-                seq_printf(file, "#%5s%5s%6s%9s%6s%8s%8s\n", "gid", "bid",
-                           "ctx#", "pid", "cbrs", "dsbytes", "mode");
+                seq_printf(file, "#%5s%5s%6s%7s%9s%6s%8s%8s\n", "gid", "bid",
+                           "ctx#", "asid", "pid", "cbrs", "dsbytes", "mode");
         if (gru)
                 for (i = 0; i < GRU_NUM_CCH; i++) {
                         ts = gru->gs_gts[i];
                         if (!ts)
                                 continue;
-                        seq_printf(file, " %5d%5d%6d%9d%6d%8d%8s\n",
+                        seq_printf(file, " %5d%5d%6d%7d%9d%6d%8d%8s\n",
                                    gru->gs_gid, gru->gs_blade_id, i,
-                                   ts->ts_tgid_owner,
+                                   is_kernel_context(ts) ? 0 : ts->ts_gms->ms_asids[gid].mt_asid,
+                                   is_kernel_context(ts) ? 0 : ts->ts_tgid_owner,
                                    ts->ts_cbr_au_count * GRU_CBR_AU_SIZE,
                                    ts->ts_cbr_au_count * GRU_DSR_AU_BYTES,
                                    mode[ts->ts_user_options &
@@ -340,10 +341,9 @@ static struct proc_dir_entry *proc_gru __read_mostly;
 
 static int create_proc_file(struct proc_entry *p)
 {
-        p->entry = create_proc_entry(p->name, p->mode, proc_gru);
+        p->entry = proc_create(p->name, p->mode, proc_gru, p->fops);
         if (!p->entry)
                 return -1;
-        p->entry->proc_fops = p->fops;
         return 0;
 }
 
@@ -355,7 +355,7 @@ static void delete_proc_files(void)
                 for (p = proc_files; p->name; p++)
                         if (p->entry)
                                 remove_proc_entry(p->name, proc_gru);
-                remove_proc_entry("gru", NULL);
+                remove_proc_entry("gru", proc_gru->parent);
         }
 }
 
diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
index 34ab3d453919..7a8b9068ea03 100644
--- a/drivers/misc/sgi-gru/grutables.h
+++ b/drivers/misc/sgi-gru/grutables.h
@@ -161,7 +161,7 @@ extern unsigned int gru_max_gids;
 #define GRU_MAX_GRUS            (GRU_MAX_BLADES * GRU_CHIPLETS_PER_BLADE)
 
 #define GRU_DRIVER_ID_STR       "SGI GRU Device Driver"
-#define GRU_DRIVER_VERSION_STR  "0.80"
+#define GRU_DRIVER_VERSION_STR  "0.85"
 
 /*
  * GRU statistics.
@@ -171,7 +171,8 @@ struct gru_stats_s {
         atomic_long_t vdata_free;
         atomic_long_t gts_alloc;
         atomic_long_t gts_free;
-        atomic_long_t vdata_double_alloc;
+        atomic_long_t gms_alloc;
+        atomic_long_t gms_free;
         atomic_long_t gts_double_allocate;
         atomic_long_t assign_context;
         atomic_long_t assign_context_failed;
@@ -184,28 +185,25 @@ struct gru_stats_s {
         atomic_long_t steal_kernel_context;
         atomic_long_t steal_context_failed;
         atomic_long_t nopfn;
-        atomic_long_t break_cow;
         atomic_long_t asid_new;
         atomic_long_t asid_next;
         atomic_long_t asid_wrap;
         atomic_long_t asid_reuse;
         atomic_long_t intr;
+        atomic_long_t intr_cbr;
+        atomic_long_t intr_tfh;
+        atomic_long_t intr_spurious;
         atomic_long_t intr_mm_lock_failed;
         atomic_long_t call_os;
-        atomic_long_t call_os_offnode_reference;
-        atomic_long_t call_os_check_for_bug;
         atomic_long_t call_os_wait_queue;
         atomic_long_t user_flush_tlb;
         atomic_long_t user_unload_context;
         atomic_long_t user_exception;
         atomic_long_t set_context_option;
-        atomic_long_t migrate_check;
-        atomic_long_t migrated_retarget;
-        atomic_long_t migrated_unload;
-        atomic_long_t migrated_unload_delay;
-        atomic_long_t migrated_nopfn_retarget;
-        atomic_long_t migrated_nopfn_unload;
+        atomic_long_t check_context_retarget_intr;
+        atomic_long_t check_context_unload;
         atomic_long_t tlb_dropin;
+        atomic_long_t tlb_preload_page;
         atomic_long_t tlb_dropin_fail_no_asid;
         atomic_long_t tlb_dropin_fail_upm;
         atomic_long_t tlb_dropin_fail_invalid;
@@ -213,17 +211,16 @@ struct gru_stats_s {
         atomic_long_t tlb_dropin_fail_idle;
         atomic_long_t tlb_dropin_fail_fmm;
         atomic_long_t tlb_dropin_fail_no_exception;
-        atomic_long_t tlb_dropin_fail_no_exception_war;
         atomic_long_t tfh_stale_on_fault;
         atomic_long_t mmu_invalidate_range;
         atomic_long_t mmu_invalidate_page;
-        atomic_long_t mmu_clear_flush_young;
         atomic_long_t flush_tlb;
         atomic_long_t flush_tlb_gru;
         atomic_long_t flush_tlb_gru_tgh;
         atomic_long_t flush_tlb_gru_zero_asid;
 
         atomic_long_t copy_gpa;
+        atomic_long_t read_gpa;
 
         atomic_long_t mesq_receive;
         atomic_long_t mesq_receive_none;
@@ -235,7 +232,7 @@ struct gru_stats_s {
         atomic_long_t mesq_send_qlimit_reached;
         atomic_long_t mesq_send_amo_nacked;
         atomic_long_t mesq_send_put_nacked;
-        atomic_long_t mesq_qf_not_full;
+        atomic_long_t mesq_page_overflow;
         atomic_long_t mesq_qf_locked;
         atomic_long_t mesq_qf_noop_not_full;
         atomic_long_t mesq_qf_switch_head_failed;
@@ -245,11 +242,13 @@ struct gru_stats_s {
         atomic_long_t mesq_noop_qlimit_reached;
         atomic_long_t mesq_noop_amo_nacked;
         atomic_long_t mesq_noop_put_nacked;
+        atomic_long_t mesq_noop_page_overflow;
 
 };
 
 enum mcs_op {cchop_allocate, cchop_start, cchop_interrupt, cchop_interrupt_sync,
-        cchop_deallocate, tghop_invalidate, mcsop_last};
+        cchop_deallocate, tfhop_write_only, tfhop_write_restart,
+        tghop_invalidate, mcsop_last};
 
 struct mcs_op_statistic {
         atomic_long_t   count;
@@ -259,8 +258,8 @@ struct mcs_op_statistic {
 
 extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
 
-#define OPT_DPRINT      1
-#define OPT_STATS       2
+#define OPT_DPRINT              1
+#define OPT_STATS               2
 
 
 #define IRQ_GRU                 110     /* Starting IRQ number for interrupts */
@@ -283,7 +282,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
 #define gru_dbg(dev, fmt, x...)                                         \
         do {                                                            \
                 if (gru_options & OPT_DPRINT)                           \
-                        dev_dbg(dev, "%s: " fmt, __func__, x);          \
+                        printk(KERN_DEBUG "GRU:%d %s: " fmt, smp_processor_id(), __func__, x);\
         } while (0)
 #else
 #define gru_dbg(x...)
@@ -297,13 +296,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
 #define ASID_INC        8       /* number of regions */
 
 /* Generate a GRU asid value from a GRU base asid & a virtual address. */
-#if defined CONFIG_IA64
 #define VADDR_HI_BIT            64
-#elif defined CONFIG_X86_64
-#define VADDR_HI_BIT            48
-#else
-#error "Unsupported architecture"
-#endif
 #define GRUREGION(addr)         ((addr) >> (VADDR_HI_BIT - 3) & 3)
 #define GRUASID(asid, addr)     ((asid) + GRUREGION(addr))
 
@@ -345,6 +338,7 @@ struct gru_vma_data {
         long                    vd_user_options;/* misc user option flags */
         int                     vd_cbr_au_count;
         int                     vd_dsr_au_count;
+        unsigned char           vd_tlb_preload_count;
 };
 
 /*
@@ -360,6 +354,7 @@ struct gru_thread_state {
         struct gru_state        *ts_gru;        /* GRU where the context is
                                                    loaded */
         struct gru_mm_struct    *ts_gms;        /* asid & ioproc struct */
+        unsigned char           ts_tlb_preload_count; /* TLB preload pages */
         unsigned long           ts_cbr_map;     /* map of allocated CBRs */
         unsigned long           ts_dsr_map;     /* map of allocated DATA
                                                    resources */
@@ -368,6 +363,8 @@ struct gru_thread_state {
         long                    ts_user_options;/* misc user option flags */
         pid_t                   ts_tgid_owner;  /* task that is using the
                                                    context - for migration */
+        short                   ts_user_blade_id;/* user selected blade */
+        char                    ts_user_chiplet_id;/* user selected chiplet */
         unsigned short          ts_sizeavail;   /* Pagesizes in use */
         int                     ts_tsid;        /* thread that owns the
                                                    structure */
@@ -384,13 +381,11 @@ struct gru_thread_state {
         char                    ts_blade;       /* If >= 0, migrate context if
                                                    ref from diferent blade */
         char                    ts_force_cch_reload;
-        char                    ts_force_unload;/* force context to be unloaded
-                                                   after migration */
         char                    ts_cbr_idx[GRU_CBR_AU];/* CBR numbers of each
                                                           allocated CB */
         int                     ts_data_valid;  /* Indicates if ts_gdata has
                                                    valid data */
-        struct gts_statistics   ustats;         /* User statistics */
+        struct gru_gseg_statistics ustats;      /* User statistics */
         unsigned long           ts_gdata[0];    /* save area for GRU data (CB,
                                                    DS, CBE) */
 };
@@ -422,6 +417,7 @@ struct gru_state {
                                                            gru segments (64) */
         unsigned short          gs_gid;                 /* unique GRU number */
         unsigned short          gs_blade_id;            /* blade of GRU */
+        unsigned char           gs_chiplet_id;          /* blade chiplet of GRU */
         unsigned char           gs_tgh_local_shift;     /* used to pick TGH for
                                                            local flush */
         unsigned char           gs_tgh_first_remote;    /* starting TGH# for
@@ -453,6 +449,7 @@ struct gru_state {
                                                            in use */
         struct gru_thread_state *gs_gts[GRU_NUM_CCH];   /* GTS currently using
                                                            the context */
+        int                     gs_irq[GRU_NUM_TFM];    /* Interrupt irqs */
 };
 
 /*
@@ -519,8 +516,7 @@ struct gru_blade_state {
 
 /* Scan all active GRUs in a GRU bitmap */
 #define for_each_gru_in_bitmap(gid, map)                                \
-        for ((gid) = find_first_bit((map), GRU_MAX_GRUS); (gid) < GRU_MAX_GRUS;\
-                (gid)++, (gid) = find_next_bit((map), GRU_MAX_GRUS, (gid)))
+        for_each_set_bit((gid), (map), GRU_MAX_GRUS)
 
 /* Scan all active GRUs on a specific blade */
 #define for_each_gru_on_blade(gru, nid, i)                              \
@@ -539,23 +535,17 @@ struct gru_blade_state {
 
 /* Scan each CBR whose bit is set in a TFM (or copy of) */
 #define for_each_cbr_in_tfm(i, map)                                     \
-        for ((i) = find_first_bit(map, GRU_NUM_CBE);                    \
-                        (i) < GRU_NUM_CBE;                              \
-                        (i)++, (i) = find_next_bit(map, GRU_NUM_CBE, i))
+        for_each_set_bit((i), (map), GRU_NUM_CBE)
 
 /* Scan each CBR in a CBR bitmap. Note: multiple CBRs in an allocation unit */
 #define for_each_cbr_in_allocation_map(i, map, k)                       \
-        for ((k) = find_first_bit(map, GRU_CBR_AU); (k) < GRU_CBR_AU;   \
-                        (k) = find_next_bit(map, GRU_CBR_AU, (k) + 1))  \
+        for_each_set_bit((k), (map), GRU_CBR_AU)                        \
                 for ((i) = (k)*GRU_CBR_AU_SIZE;                         \
                                 (i) < ((k) + 1) * GRU_CBR_AU_SIZE; (i)++)
 
 /* Scan each DSR in a DSR bitmap. Note: multiple DSRs in an allocation unit */
 #define for_each_dsr_in_allocation_map(i, map, k)                       \
-        for ((k) = find_first_bit((const unsigned long *)map, GRU_DSR_AU);\
-                        (k) < GRU_DSR_AU;                               \
-                        (k) = find_next_bit((const unsigned long *)map, \
-                                          GRU_DSR_AU, (k) + 1))         \
+        for_each_set_bit((k), (const unsigned long *)(map), GRU_DSR_AU) \
                 for ((i) = (k) * GRU_DSR_AU_CL;                         \
                                 (i) < ((k) + 1) * GRU_DSR_AU_CL; (i)++)
 
@@ -619,12 +609,21 @@ static inline int is_kernel_context(struct gru_thread_state *gts)
         return !gts->ts_mm;
 }
 
+/*
+ * The following are for Nehelem-EX. A more general scheme is needed for
+ * future processors.
+ */
+#define UV_MAX_INT_CORES                8
+#define uv_cpu_socket_number(p)         ((cpu_physical_id(p) >> 5) & 1)
+#define uv_cpu_ht_number(p)             (cpu_physical_id(p) & 1)
+#define uv_cpu_core_number(p)           (((cpu_physical_id(p) >> 2) & 4) |      \
+                                        ((cpu_physical_id(p) >> 1) & 3))
 /*-----------------------------------------------------------------------------
  * Function prototypes & externs
  */
 struct gru_unload_context_req;
 
-extern struct vm_operations_struct gru_vm_ops;
+extern const struct vm_operations_struct gru_vm_ops;
 extern struct device *grudev;
 
 extern struct gru_vma_data *gru_alloc_vma_data(struct vm_area_struct *vma,
@@ -633,24 +632,26 @@ extern struct gru_thread_state *gru_find_thread_state(struct vm_area_struct
                                 *vma, int tsid);
 extern struct gru_thread_state *gru_alloc_thread_state(struct vm_area_struct
                                 *vma, int tsid);
-extern struct gru_state *gru_assign_gru_context(struct gru_thread_state *gts,
-                int blade);
+extern struct gru_state *gru_assign_gru_context(struct gru_thread_state *gts);
 extern void gru_load_context(struct gru_thread_state *gts);
-extern void gru_steal_context(struct gru_thread_state *gts, int blade_id);
+extern void gru_steal_context(struct gru_thread_state *gts);
 extern void gru_unload_context(struct gru_thread_state *gts, int savestate);
-extern int gru_update_cch(struct gru_thread_state *gts, int force_unload);
+extern int gru_update_cch(struct gru_thread_state *gts);
 extern void gts_drop(struct gru_thread_state *gts);
 extern void gru_tgh_flush_init(struct gru_state *gru);
 extern int gru_kservices_init(void);
 extern void gru_kservices_exit(void);
+extern irqreturn_t gru0_intr(int irq, void *dev_id);
+extern irqreturn_t gru1_intr(int irq, void *dev_id);
+extern irqreturn_t gru_intr_mblade(int irq, void *dev_id);
 extern int gru_dump_chiplet_request(unsigned long arg);
 extern long gru_get_gseg_statistics(unsigned long arg);
-extern irqreturn_t gru_intr(int irq, void *dev_id);
 extern int gru_handle_user_call_os(unsigned long address);
 extern int gru_user_flush_tlb(unsigned long arg);
 extern int gru_user_unload_context(unsigned long arg);
 extern int gru_get_exception_detail(unsigned long arg);
 extern int gru_set_context_option(unsigned long address);
+extern void gru_check_context_placement(struct gru_thread_state *gts);
 extern int gru_cpu_fault_map_id(void);
 extern struct vm_area_struct *gru_find_vma(unsigned long vaddr);
 extern void gru_flush_all_tlb(struct gru_state *gru);
@@ -658,7 +659,8 @@ extern int gru_proc_init(void);
 extern void gru_proc_exit(void);
 
 extern struct gru_thread_state *gru_alloc_gts(struct vm_area_struct *vma,
-                int cbr_au_count, int dsr_au_count, int options, int tsid);
+                int cbr_au_count, int dsr_au_count,
+                unsigned char tlb_preload_count, int options, int tsid);
 extern unsigned long gru_reserve_cb_resources(struct gru_state *gru,
                 int cbr_au_count, char *cbmap);
 extern unsigned long gru_reserve_ds_resources(struct gru_state *gru,
diff --git a/drivers/misc/sgi-gru/grutlbpurge.c b/drivers/misc/sgi-gru/grutlbpurge.c
index 1d125091f5e7..240a6d361665 100644
--- a/drivers/misc/sgi-gru/grutlbpurge.c
+++ b/drivers/misc/sgi-gru/grutlbpurge.c
@@ -184,8 +184,8 @@ void gru_flush_tlb_range(struct gru_mm_struct *gms, unsigned long start,
                         STAT(flush_tlb_gru_tgh);
                         asid = GRUASID(asid, start);
                         gru_dbg(grudev,
-        "  FLUSH gruid %d, asid 0x%x, num %ld, cbmap 0x%x\n",
-                                gid, asid, num, asids->mt_ctxbitmap);
+        "  FLUSH gruid %d, asid 0x%x, vaddr 0x%lx, vamask 0x%x, num %ld, cbmap 0x%x\n",
+                              gid, asid, start, grupagesize, num, asids->mt_ctxbitmap);
                         tgh = get_lock_tgh_handle(gru);
                         tgh_invalidate(tgh, start, ~0, asid, grupagesize, 0,
                                        num - 1, asids->mt_ctxbitmap);
@@ -299,6 +299,7 @@ struct gru_mm_struct *gru_register_mmu_notifier(void)
 {
         struct gru_mm_struct *gms;
         struct mmu_notifier *mn;
+        int err;
 
         mn = mmu_find_ops(current->mm, &gru_mmuops);
         if (mn) {
@@ -307,16 +308,22 @@ struct gru_mm_struct *gru_register_mmu_notifier(void)
         } else {
                 gms = kzalloc(sizeof(*gms), GFP_KERNEL);
                 if (gms) {
+                        STAT(gms_alloc);
                         spin_lock_init(&gms->ms_asid_lock);
                         gms->ms_notifier.ops = &gru_mmuops;
                         atomic_set(&gms->ms_refcnt, 1);
                         init_waitqueue_head(&gms->ms_wait_queue);
-                        __mmu_notifier_register(&gms->ms_notifier, current->mm);
+                        err = __mmu_notifier_register(&gms->ms_notifier, current->mm);
+                        if (err)
+                                goto error;
                 }
         }
         gru_dbg(grudev, "gms %p, refcnt %d\n", gms,
                 atomic_read(&gms->ms_refcnt));
         return gms;
+error:
+        kfree(gms);
+        return ERR_PTR(err);
 }
 
 void gru_drop_mmu_notifier(struct gru_mm_struct *gms)
@@ -327,6 +334,7 @@ void gru_drop_mmu_notifier(struct gru_mm_struct *gms)
                 if (!gms->ms_released)
                         mmu_notifier_unregister(&gms->ms_notifier, current->mm);
                 kfree(gms);
+                STAT(gms_free);
         }
 }
 
diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
index 2275126cb334..851b2f25ce0e 100644
--- a/drivers/misc/sgi-xp/xp.h
+++ b/drivers/misc/sgi-xp/xp.h
@@ -339,6 +339,7 @@ extern short xp_partition_id;
 extern u8 xp_region_size;
 
 extern unsigned long (*xp_pa) (void *);
+extern unsigned long (*xp_socket_pa) (unsigned long);
 extern enum xp_retval (*xp_remote_memcpy) (unsigned long, const unsigned long,
                        size_t);
 extern int (*xp_cpu_to_nasid) (int);
diff --git a/drivers/misc/sgi-xp/xp_main.c b/drivers/misc/sgi-xp/xp_main.c
index 7896849b16dc..01be66d02ca8 100644
--- a/drivers/misc/sgi-xp/xp_main.c
+++ b/drivers/misc/sgi-xp/xp_main.c
@@ -44,6 +44,9 @@ EXPORT_SYMBOL_GPL(xp_region_size);
 unsigned long (*xp_pa) (void *addr);
 EXPORT_SYMBOL_GPL(xp_pa);
 
+unsigned long (*xp_socket_pa) (unsigned long gpa);
+EXPORT_SYMBOL_GPL(xp_socket_pa);
+
 enum xp_retval (*xp_remote_memcpy) (unsigned long dst_gpa,
                                     const unsigned long src_gpa, size_t len);
 EXPORT_SYMBOL_GPL(xp_remote_memcpy);
diff --git a/drivers/misc/sgi-xp/xp_sn2.c b/drivers/misc/sgi-xp/xp_sn2.c
index fb3ec9d735a9..d8e463f87241 100644
--- a/drivers/misc/sgi-xp/xp_sn2.c
+++ b/drivers/misc/sgi-xp/xp_sn2.c
@@ -84,6 +84,15 @@ xp_pa_sn2(void *addr)
 }
 
 /*
+ * Convert a global physical to a socket physical address.
+ */
+static unsigned long
+xp_socket_pa_sn2(unsigned long gpa)
+{
+        return gpa;
+}
+
+/*
  * Wrapper for bte_copy().
  *
  *      dst_pa - physical address of the destination of the transfer.
@@ -162,6 +171,7 @@ xp_init_sn2(void)
         xp_region_size = sn_region_size;
 
         xp_pa = xp_pa_sn2;
+        xp_socket_pa = xp_socket_pa_sn2;
         xp_remote_memcpy = xp_remote_memcpy_sn2;
         xp_cpu_to_nasid = xp_cpu_to_nasid_sn2;
         xp_expand_memprotect = xp_expand_memprotect_sn2;
diff --git a/drivers/misc/sgi-xp/xp_uv.c b/drivers/misc/sgi-xp/xp_uv.c
index d238576b26fa..a0d093274dc0 100644
--- a/drivers/misc/sgi-xp/xp_uv.c
+++ b/drivers/misc/sgi-xp/xp_uv.c
@@ -32,12 +32,44 @@ xp_pa_uv(void *addr)
         return uv_gpa(addr);
 }
 
+/*
+ * Convert a global physical to socket physical address.
+ */
+static unsigned long
+xp_socket_pa_uv(unsigned long gpa)
+{
+        return uv_gpa_to_soc_phys_ram(gpa);
+}
+
+static enum xp_retval
+xp_remote_mmr_read(unsigned long dst_gpa, const unsigned long src_gpa,
+                   size_t len)
+{
+        int ret;
+        unsigned long *dst_va = __va(uv_gpa_to_soc_phys_ram(dst_gpa));
+
+        BUG_ON(!uv_gpa_in_mmr_space(src_gpa));
+        BUG_ON(len != 8);
+
+        ret = gru_read_gpa(dst_va, src_gpa);
+        if (ret == 0)
+                return xpSuccess;
+
+        dev_err(xp, "gru_read_gpa() failed, dst_gpa=0x%016lx src_gpa=0x%016lx "
+                "len=%ld\n", dst_gpa, src_gpa, len);
+        return xpGruCopyError;
+}
+
+
 static enum xp_retval
 xp_remote_memcpy_uv(unsigned long dst_gpa, const unsigned long src_gpa,
                     size_t len)
 {
         int ret;
 
+        if (uv_gpa_in_mmr_space(src_gpa))
+                return xp_remote_mmr_read(dst_gpa, src_gpa, len);
+
         ret = gru_copy_gpa(dst_gpa, src_gpa, len);
         if (ret == 0)
                 return xpSuccess;
@@ -123,6 +155,7 @@ xp_init_uv(void)
         xp_region_size = sn_region_size;
 
         xp_pa = xp_pa_uv;
+        xp_socket_pa = xp_socket_pa_uv;
         xp_remote_memcpy = xp_remote_memcpy_uv;
         xp_cpu_to_nasid = xp_cpu_to_nasid_uv;
         xp_expand_memprotect = xp_expand_memprotect_uv;
diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
index fd3688a3e23f..8d082b46426b 100644
--- a/drivers/misc/sgi-xp/xpc_main.c
+++ b/drivers/misc/sgi-xp/xpc_main.c
@@ -44,6 +44,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/sysctl.h>
 #include <linux/device.h>
 #include <linux/delay.h>
@@ -89,48 +90,40 @@ static int xpc_disengage_max_timelimit = 120;
 
 static ctl_table xpc_sys_xpc_hb_dir[] = {
         {
-         .ctl_name = CTL_UNNUMBERED,
          .procname = "hb_interval",
          .data = &xpc_hb_interval,
          .maxlen = sizeof(int),
          .mode = 0644,
-         .proc_handler = &proc_dointvec_minmax,
-         .strategy = &sysctl_intvec,
+         .proc_handler = proc_dointvec_minmax,
          .extra1 = &xpc_hb_min_interval,
          .extra2 = &xpc_hb_max_interval},
         {
-         .ctl_name = CTL_UNNUMBERED,
          .procname = "hb_check_interval",
          .data = &xpc_hb_check_interval,
          .maxlen = sizeof(int),
          .mode = 0644,
-         .proc_handler = &proc_dointvec_minmax,
-         .strategy = &sysctl_intvec,
+         .proc_handler = proc_dointvec_minmax,
          .extra1 = &xpc_hb_check_min_interval,
          .extra2 = &xpc_hb_check_max_interval},
         {}
 };
 static ctl_table xpc_sys_xpc_dir[] = {
         {
-         .ctl_name = CTL_UNNUMBERED,
          .procname = "hb",
          .mode = 0555,
          .child = xpc_sys_xpc_hb_dir},
         {
-         .ctl_name = CTL_UNNUMBERED,
          .procname = "disengage_timelimit",
          .data = &xpc_disengage_timelimit,
          .maxlen = sizeof(int),
          .mode = 0644,
-         .proc_handler = &proc_dointvec_minmax,
-         .strategy = &sysctl_intvec,
+         .proc_handler = proc_dointvec_minmax,
          .extra1 = &xpc_disengage_min_timelimit,
          .extra2 = &xpc_disengage_max_timelimit},
         {}
 };
 static ctl_table xpc_sys_dir[] = {
         {
-         .ctl_name = CTL_UNNUMBERED,
          .procname = "xpc",
          .mode = 0555,
          .child = xpc_sys_xpc_dir},
diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
index 65877bc5edaa..6956f7e7d439 100644
--- a/drivers/misc/sgi-xp/xpc_partition.c
+++ b/drivers/misc/sgi-xp/xpc_partition.c
@@ -17,7 +17,9 @@
 
 #include <linux/device.h>
 #include <linux/hardirq.h>
+#include <linux/slab.h>
 #include "xpc.h"
+#include <asm/uv/uv_hub.h>
 
 /* XPC is exiting flag */
 int xpc_exiting;
@@ -92,8 +94,12 @@ xpc_get_rsvd_page_pa(int nasid)
                         break;
 
                 /* !!! L1_CACHE_ALIGN() is only a sn2-bte_copy requirement */
-                if (L1_CACHE_ALIGN(len) > buf_len) {
-                        kfree(buf_base);
+                if (is_shub())
+                        len = L1_CACHE_ALIGN(len);
+
+                if (len > buf_len) {
+                        if (buf_base != NULL)
+                                kfree(buf_base);
                         buf_len = L1_CACHE_ALIGN(len);
                         buf = xpc_kmalloc_cacheline_aligned(buf_len, GFP_KERNEL,
                                                             &buf_base);
@@ -105,7 +111,7 @@ xpc_get_rsvd_page_pa(int nasid)
                         }
                 }
 
-                ret = xp_remote_memcpy(xp_pa(buf), rp_pa, buf_len);
+                ret = xp_remote_memcpy(xp_pa(buf), rp_pa, len);
                 if (ret != xpSuccess) {
                         dev_dbg(xpc_part, "xp_remote_memcpy failed %d\n", ret);
                         break;
@@ -143,7 +149,7 @@ xpc_setup_rsvd_page(void)
                 dev_err(xpc_part, "SAL failed to locate the reserved page\n");
                 return -ESRCH;
         }
-        rp = (struct xpc_rsvd_page *)__va(rp_pa);
+        rp = (struct xpc_rsvd_page *)__va(xp_socket_pa(rp_pa));
 
         if (rp->SAL_version < 3) {
                 /* SAL_versions < 3 had a SAL_partid defined as a u8 */
@@ -433,18 +439,23 @@ xpc_discovery(void)
          * nodes that can comprise an access protection grouping. The access
          * protection is in regards to memory, IOI and IPI.
          */
-        max_regions = 64;
         region_size = xp_region_size;
 
-        switch (region_size) {
-        case 128:
-                max_regions *= 2;
-        case 64:
-                max_regions *= 2;
-        case 32:
-                max_regions *= 2;
-                region_size = 16;
-                DBUG_ON(!is_shub2());
+        if (is_uv())
+                max_regions = 256;
+        else {
+                max_regions = 64;
+
+                switch (region_size) {
+                case 128:
+                        max_regions *= 2;
+                case 64:
+                        max_regions *= 2;
+                case 32:
+                        max_regions *= 2;
+                        region_size = 16;
+                        DBUG_ON(!is_shub2());
+                }
         }
 
         for (region = 0; region < max_regions; region++) {
diff --git a/drivers/misc/sgi-xp/xpc_sn2.c b/drivers/misc/sgi-xp/xpc_sn2.c
index 915a3b495da5..7d71c04fc938 100644
--- a/drivers/misc/sgi-xp/xpc_sn2.c
+++ b/drivers/misc/sgi-xp/xpc_sn2.c
@@ -14,6 +14,7 @@
  */
 
 #include <linux/delay.h>
+#include <linux/slab.h>
 #include <asm/uncached.h>
 #include <asm/sn/mspec.h>
 #include <asm/sn/sn_sal.h>
@@ -279,7 +280,7 @@ xpc_check_for_sent_chctl_flags_sn2(struct xpc_partition *part)
         spin_unlock_irqrestore(&part->chctl_lock, irq_flags);
 
         dev_dbg(xpc_chan, "received notify IRQ from partid=%d, chctl.all_flags="
-                "0x%lx\n", XPC_PARTID(part), chctl.all_flags);
+                "0x%llx\n", XPC_PARTID(part), chctl.all_flags);
 
         xpc_wakeup_channel_mgr(part);
 }
@@ -615,7 +616,8 @@ xpc_get_partition_rsvd_page_pa_sn2(void *buf, u64 *cookie, unsigned long *rp_pa,
         s64 status;
         enum xp_retval ret;
 
-        status = sn_partition_reserved_page_pa((u64)buf, cookie, rp_pa, len);
+        status = sn_partition_reserved_page_pa((u64)buf, cookie,
+                        (u64 *)rp_pa, (u64 *)len);
         if (status == SALRET_OK)
                 ret = xpSuccess;
         else if (status == SALRET_MORE_PASSES)
@@ -777,8 +779,8 @@ xpc_get_remote_heartbeat_sn2(struct xpc_partition *part)
         if (ret != xpSuccess)
                 return ret;
 
-        dev_dbg(xpc_part, "partid=%d, heartbeat=%ld, last_heartbeat=%ld, "
-                "heartbeat_offline=%ld, HB_mask[0]=0x%lx\n", XPC_PARTID(part),
+        dev_dbg(xpc_part, "partid=%d, heartbeat=%lld, last_heartbeat=%lld, "
+                "heartbeat_offline=%lld, HB_mask[0]=0x%lx\n", XPC_PARTID(part),
                 remote_vars->heartbeat, part->last_heartbeat,
                 remote_vars->heartbeat_offline,
                 remote_vars->heartbeating_to_mask[0]);
@@ -940,7 +942,7 @@ xpc_update_partition_info_sn2(struct xpc_partition *part, u8 remote_rp_version,
                 part_sn2->remote_vars_pa);
 
         part->last_heartbeat = remote_vars->heartbeat - 1;
-        dev_dbg(xpc_part, "  last_heartbeat = 0x%016lx\n",
+        dev_dbg(xpc_part, "  last_heartbeat = 0x%016llx\n",
                 part->last_heartbeat);
 
         part_sn2->remote_vars_part_pa = remote_vars->vars_part_pa;
@@ -1029,7 +1031,8 @@ xpc_identify_activate_IRQ_req_sn2(int nasid)
         part->activate_IRQ_rcvd++;
 
         dev_dbg(xpc_part, "partid for nasid %d is %d; IRQs = %d; HB = "
-                "%ld:0x%lx\n", (int)nasid, (int)partid, part->activate_IRQ_rcvd,
+                "%lld:0x%lx\n", (int)nasid, (int)partid,
+                part->activate_IRQ_rcvd,
                 remote_vars->heartbeat, remote_vars->heartbeating_to_mask[0]);
 
         if (xpc_partition_disengaged(part) &&
@@ -1129,7 +1132,7 @@ xpc_identify_activate_IRQ_sender_sn2(void)
                 do {
                         n_IRQs_detected++;
                         nasid = (l * BITS_PER_LONG + b) * 2;
-                        dev_dbg(xpc_part, "interrupt from nasid %ld\n", nasid);
+                        dev_dbg(xpc_part, "interrupt from nasid %lld\n", nasid);
                         xpc_identify_activate_IRQ_req_sn2(nasid);
 
                         b = find_next_bit(&nasid_mask_long, BITS_PER_LONG,
@@ -1386,7 +1389,7 @@ xpc_pull_remote_vars_part_sn2(struct xpc_partition *part)
 
                 if (pulled_entry->magic != 0) {
                         dev_dbg(xpc_chan, "partition %d's XPC vars_part for "
-                                "partition %d has bad magic value (=0x%lx)\n",
+                                "partition %d has bad magic value (=0x%llx)\n",
                                 partid, sn_partition_id, pulled_entry->magic);
                         return xpBadMagic;
                 }
@@ -1730,14 +1733,14 @@ xpc_notify_senders_sn2(struct xpc_channel *ch, enum xp_retval reason, s64 put)
 
                 if (notify->func != NULL) {
                         dev_dbg(xpc_chan, "notify->func() called, notify=0x%p "
-                                "msg_number=%ld partid=%d channel=%d\n",
+                                "msg_number=%lld partid=%d channel=%d\n",
                                 (void *)notify, get, ch->partid, ch->number);
 
                         notify->func(reason, ch->partid, ch->number,
                                      notify->key);
 
                         dev_dbg(xpc_chan, "notify->func() returned, notify=0x%p"
-                                " msg_number=%ld partid=%d channel=%d\n",
+                                " msg_number=%lld partid=%d channel=%d\n",
                                 (void *)notify, get, ch->partid, ch->number);
                 }
         }
@@ -1858,7 +1861,7 @@ xpc_process_msg_chctl_flags_sn2(struct xpc_partition *part, int ch_number)
 
                 ch_sn2->w_remote_GP.get = ch_sn2->remote_GP.get;
 
-                dev_dbg(xpc_chan, "w_remote_GP.get changed to %ld, partid=%d, "
+                dev_dbg(xpc_chan, "w_remote_GP.get changed to %lld, partid=%d, "
                         "channel=%d\n", ch_sn2->w_remote_GP.get, ch->partid,
                         ch->number);
 
@@ -1885,7 +1888,7 @@ xpc_process_msg_chctl_flags_sn2(struct xpc_partition *part, int ch_number)
                 smp_wmb(); /* ensure flags have been cleared before bte_copy */
                 ch_sn2->w_remote_GP.put = ch_sn2->remote_GP.put;
 
-                dev_dbg(xpc_chan, "w_remote_GP.put changed to %ld, partid=%d, "
+                dev_dbg(xpc_chan, "w_remote_GP.put changed to %lld, partid=%d, "
                         "channel=%d\n", ch_sn2->w_remote_GP.put, ch->partid,
                         ch->number);
 
@@ -1943,7 +1946,7 @@ xpc_pull_remote_msg_sn2(struct xpc_channel *ch, s64 get)
                 if (ret != xpSuccess) {
 
                         dev_dbg(xpc_chan, "failed to pull %d msgs starting with"
-                                " msg %ld from partition %d, channel=%d, "
+                                " msg %lld from partition %d, channel=%d, "
                                 "ret=%d\n", nmsgs, ch_sn2->next_msg_to_pull,
                                 ch->partid, ch->number, ret);
 
@@ -1995,7 +1998,7 @@ xpc_get_deliverable_payload_sn2(struct xpc_channel *ch)
                 if (cmpxchg(&ch_sn2->w_local_GP.get, get, get + 1) == get) {
                         /* we got the entry referenced by get */
 
-                        dev_dbg(xpc_chan, "w_local_GP.get changed to %ld, "
+                        dev_dbg(xpc_chan, "w_local_GP.get changed to %lld, "
                                 "partid=%d, channel=%d\n", get + 1,
                                 ch->partid, ch->number);
 
@@ -2062,7 +2065,7 @@ xpc_send_msgs_sn2(struct xpc_channel *ch, s64 initial_put)
 
                 /* we just set the new value of local_GP->put */
 
-                dev_dbg(xpc_chan, "local_GP->put changed to %ld, partid=%d, "
+                dev_dbg(xpc_chan, "local_GP->put changed to %lld, partid=%d, "
                         "channel=%d\n", put, ch->partid, ch->number);
 
                 send_msgrequest = 1;
@@ -2147,8 +2150,8 @@ xpc_allocate_msg_sn2(struct xpc_channel *ch, u32 flags,
         DBUG_ON(msg->flags != 0);
         msg->number = put;
 
-        dev_dbg(xpc_chan, "w_local_GP.put changed to %ld; msg=0x%p, "
-                "msg_number=%ld, partid=%d, channel=%d\n", put + 1,
+        dev_dbg(xpc_chan, "w_local_GP.put changed to %lld; msg=0x%p, "
+                "msg_number=%lld, partid=%d, channel=%d\n", put + 1,
                 (void *)msg, msg->number, ch->partid, ch->number);
 
         *address_of_msg = msg;
@@ -2296,7 +2299,7 @@ xpc_acknowledge_msgs_sn2(struct xpc_channel *ch, s64 initial_get, u8 msg_flags)
 
                 /* we just set the new value of local_GP->get */
 
-                dev_dbg(xpc_chan, "local_GP->get changed to %ld, partid=%d, "
+                dev_dbg(xpc_chan, "local_GP->get changed to %lld, partid=%d, "
                         "channel=%d\n", get, ch->partid, ch->number);
 
                 send_msgrequest = (msg_flags & XPC_M_SN2_INTERRUPT);
@@ -2323,7 +2326,7 @@ xpc_received_payload_sn2(struct xpc_channel *ch, void *payload)
         msg = container_of(payload, struct xpc_msg_sn2, payload);
         msg_number = msg->number;
 
-        dev_dbg(xpc_chan, "msg=0x%p, msg_number=%ld, partid=%d, channel=%d\n",
+        dev_dbg(xpc_chan, "msg=0x%p, msg_number=%lld, partid=%d, channel=%d\n",
                 (void *)msg, msg_number, ch->partid, ch->number);
 
         DBUG_ON((((u64)msg - (u64)ch->sn.sn2.remote_msgqueue) / ch->entry_size) !=
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index c76677afda1b..17bbacb1b4b1 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -19,6 +19,7 @@
 #include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <asm/uv/uv_hub.h>
 #if defined CONFIG_X86_64
 #include <asm/uv/bios.h>
@@ -106,7 +107,8 @@ xpc_get_gru_mq_irq_uv(struct xpc_gru_mq_uv *mq, int cpu, char *irq_name)
         int mmr_pnode = uv_blade_to_pnode(mq->mmr_blade);
 
 #if defined CONFIG_X86_64
-        mq->irq = uv_setup_irq(irq_name, cpu, mq->mmr_blade, mq->mmr_offset);
+        mq->irq = uv_setup_irq(irq_name, cpu, mq->mmr_blade, mq->mmr_offset,
+                        UV_AFFINITY_CPU);
         if (mq->irq < 0) {
                 dev_err(xpc_part, "uv_setup_irq() returned error=%d\n",
                         -mq->irq);
@@ -136,7 +138,7 @@ static void
 xpc_release_gru_mq_irq_uv(struct xpc_gru_mq_uv *mq)
 {
 #if defined CONFIG_X86_64
-        uv_teardown_irq(mq->irq, mq->mmr_blade, mq->mmr_offset);
+        uv_teardown_irq(mq->irq);
 
 #elif defined CONFIG_IA64_GENERIC || defined CONFIG_IA64_SGI_UV
         int mmr_pnode;
@@ -156,22 +158,24 @@ xpc_gru_mq_watchlist_alloc_uv(struct xpc_gru_mq_uv *mq)
 {
         int ret;
 
-#if defined CONFIG_X86_64
-        ret = uv_bios_mq_watchlist_alloc(mq->mmr_blade, uv_gpa(mq->address),
-                                         mq->order, &mq->mmr_offset);
-        if (ret < 0) {
-                dev_err(xpc_part, "uv_bios_mq_watchlist_alloc() failed, "
-                        "ret=%d\n", ret);
-                return ret;
-        }
-#elif defined CONFIG_IA64_GENERIC || defined CONFIG_IA64_SGI_UV
-        ret = sn_mq_watchlist_alloc(mq->mmr_blade, (void *)uv_gpa(mq->address),
+#if defined CONFIG_IA64_GENERIC || defined CONFIG_IA64_SGI_UV
+        int mmr_pnode = uv_blade_to_pnode(mq->mmr_blade);
+
+        ret = sn_mq_watchlist_alloc(mmr_pnode, (void *)uv_gpa(mq->address),
                                     mq->order, &mq->mmr_offset);
         if (ret < 0) {
                 dev_err(xpc_part, "sn_mq_watchlist_alloc() failed, ret=%d\n",
                         ret);
                 return -EBUSY;
         }
+#elif defined CONFIG_X86_64
+        ret = uv_bios_mq_watchlist_alloc(uv_gpa(mq->address),
+                                         mq->order, &mq->mmr_offset);
+        if (ret < 0) {
+                dev_err(xpc_part, "uv_bios_mq_watchlist_alloc() failed, "
+                        "ret=%d\n", ret);
+                return ret;
+        }
 #else
         #error not a supported configuration
 #endif
@@ -184,12 +188,13 @@ static void
 xpc_gru_mq_watchlist_free_uv(struct xpc_gru_mq_uv *mq)
 {
         int ret;
+        int mmr_pnode = uv_blade_to_pnode(mq->mmr_blade);
 
 #if defined CONFIG_X86_64
-        ret = uv_bios_mq_watchlist_free(mq->mmr_blade, mq->watchlist_num);
+        ret = uv_bios_mq_watchlist_free(mmr_pnode, mq->watchlist_num);
         BUG_ON(ret != BIOS_STATUS_SUCCESS);
 #elif defined CONFIG_IA64_GENERIC || defined CONFIG_IA64_SGI_UV
-        ret = sn_mq_watchlist_free(mq->mmr_blade, mq->watchlist_num);
+        ret = sn_mq_watchlist_free(mmr_pnode, mq->watchlist_num);
         BUG_ON(ret != SALRET_OK);
 #else
         #error not a supported configuration
@@ -203,6 +208,7 @@ xpc_create_gru_mq_uv(unsigned int mq_size, int cpu, char *irq_name,
         enum xp_retval xp_ret;
         int ret;
         int nid;
+        int nasid;
         int pg_order;
         struct page *page;
         struct xpc_gru_mq_uv *mq;
@@ -258,9 +264,11 @@ xpc_create_gru_mq_uv(unsigned int mq_size, int cpu, char *irq_name,
                 goto out_5;
         }
 
+        nasid = UV_PNODE_TO_NASID(uv_cpu_to_pnode(cpu));
+
         mmr_value = (struct uv_IO_APIC_route_entry *)&mq->mmr_value;
         ret = gru_create_message_queue(mq->gru_mq_desc, mq->address, mq_size,
-                                       nid, mmr_value->vector, mmr_value->dest);
+                                     nasid, mmr_value->vector, mmr_value->dest);
         if (ret != 0) {
                 dev_err(xpc_part, "gru_create_message_queue() returned "
                         "error=%d\n", ret);
@@ -409,6 +417,7 @@ xpc_process_activate_IRQ_rcvd_uv(void)
 static void
 xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
                               struct xpc_activate_mq_msghdr_uv *msg_hdr,
+                              int part_setup,
                               int *wakeup_hb_checker)
 {
         unsigned long irq_flags;
@@ -473,6 +482,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
         case XPC_ACTIVATE_MQ_MSG_CHCTL_CLOSEREQUEST_UV: {
                 struct xpc_activate_mq_msg_chctl_closerequest_uv *msg;
 
+                if (!part_setup)
+                        break;
+
                 msg = container_of(msg_hdr, struct
                                    xpc_activate_mq_msg_chctl_closerequest_uv,
                                    hdr);
@@ -489,6 +501,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
         case XPC_ACTIVATE_MQ_MSG_CHCTL_CLOSEREPLY_UV: {
                 struct xpc_activate_mq_msg_chctl_closereply_uv *msg;
 
+                if (!part_setup)
+                        break;
+
                 msg = container_of(msg_hdr, struct
                                    xpc_activate_mq_msg_chctl_closereply_uv,
                                    hdr);
@@ -503,6 +518,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
         case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENREQUEST_UV: {
                 struct xpc_activate_mq_msg_chctl_openrequest_uv *msg;
 
+                if (!part_setup)
+                        break;
+
                 msg = container_of(msg_hdr, struct
                                    xpc_activate_mq_msg_chctl_openrequest_uv,
                                    hdr);
@@ -520,6 +538,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
         case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENREPLY_UV: {
                 struct xpc_activate_mq_msg_chctl_openreply_uv *msg;
 
+                if (!part_setup)
+                        break;
+
                 msg = container_of(msg_hdr, struct
                                    xpc_activate_mq_msg_chctl_openreply_uv, hdr);
                 args = &part->remote_openclose_args[msg->ch_number];
@@ -537,6 +558,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
         case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENCOMPLETE_UV: {
                 struct xpc_activate_mq_msg_chctl_opencomplete_uv *msg;
 
+                if (!part_setup)
+                        break;
+
                 msg = container_of(msg_hdr, struct
                                 xpc_activate_mq_msg_chctl_opencomplete_uv, hdr);
                 spin_lock_irqsave(&part->chctl_lock, irq_flags);
@@ -613,6 +637,7 @@ xpc_handle_activate_IRQ_uv(int irq, void *dev_id)
 
                         part_referenced = xpc_part_ref(part);
                         xpc_handle_activate_mq_msg_uv(part, msg_hdr,
+                                                      part_referenced,
                                                       &wakeup_hb_checker);
                         if (part_referenced)
                                 xpc_part_deref(part);
@@ -945,11 +970,13 @@ xpc_get_fifo_entry_uv(struct xpc_fifo_head_uv *head)
                 head->first = first->next;
                 if (head->first == NULL)
                         head->last = NULL;
+
+                head->n_entries--;
+                BUG_ON(head->n_entries < 0);
+
+                first->next = NULL;
         }
-        head->n_entries--;
-        BUG_ON(head->n_entries < 0);
         spin_unlock_irqrestore(&head->lock, irq_flags);
-        first->next = NULL;
         return first;
 }
 
@@ -1018,7 +1045,8 @@ xpc_make_first_contact_uv(struct xpc_partition *part)
         xpc_send_activate_IRQ_part_uv(part, &msg, sizeof(msg),
                                       XPC_ACTIVATE_MQ_MSG_SYNC_ACT_STATE_UV);
 
-        while (part->sn.uv.remote_act_state != XPC_P_AS_ACTIVATING) {
+        while (!((part->sn.uv.remote_act_state == XPC_P_AS_ACTIVATING) ||
+                 (part->sn.uv.remote_act_state == XPC_P_AS_ACTIVE))) {
 
                 dev_dbg(xpc_part, "waiting to make first contact with "
                         "partition %d\n", XPC_PARTID(part));
@@ -1421,7 +1449,6 @@ xpc_handle_notify_mq_msg_uv(struct xpc_partition *part,
         msg_slot = ch_uv->recv_msg_slots +
             (msg->hdr.msg_slot_number % ch->remote_nentries) * ch->entry_size;
 
-        BUG_ON(msg->hdr.msg_slot_number != msg_slot->hdr.msg_slot_number);
         BUG_ON(msg_slot->hdr.size != 0);
 
         memcpy(msg_slot, msg, msg->hdr.size);
@@ -1645,8 +1672,6 @@ xpc_received_payload_uv(struct xpc_channel *ch, void *payload)
                                sizeof(struct xpc_notify_mq_msghdr_uv));
         if (ret != xpSuccess)
                 XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
-
-        msg->hdr.msg_slot_number += ch->remote_nentries;
 }
 
 static struct xpc_arch_operations xpc_arch_ops_uv = {
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index 8d1c60a3f0df..ee5109a3cd98 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c
@@ -20,6 +20,7 @@
  *
  */
 
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
@@ -235,12 +236,11 @@ xpnet_receive(short partid, int channel, struct xpnet_message *msg)
         skb->ip_summed = CHECKSUM_UNNECESSARY;
 
         dev_dbg(xpnet, "passing skb to network layer\n"
-                KERN_DEBUG "\tskb->head=0x%p skb->data=0x%p skb->tail=0x%p "
+                "\tskb->head=0x%p skb->data=0x%p skb->tail=0x%p "
                 "skb->end=0x%p skb->len=%d\n",
                 (void *)skb->head, (void *)skb->data, skb_tail_pointer(skb),
                 skb_end_pointer(skb), skb->len);
 
-        xpnet_device->last_rx = jiffies;
         xpnet_device->stats.rx_packets++;
         xpnet_device->stats.rx_bytes += skb->len + ETH_HLEN;
 
@@ -399,7 +399,7 @@ xpnet_send(struct sk_buff *skb, struct xpnet_pending_msg *queued_msg,
         msg->buf_pa = xp_pa((void *)start_addr);
 
         dev_dbg(xpnet, "sending XPC message to %d:%d\n"
-                KERN_DEBUG "msg->buf_pa=0x%lx, msg->size=%u, "
+                "msg->buf_pa=0x%lx, msg->size=%u, "
                 "msg->leadin_ignore=%u, msg->tailout_ignore=%u\n",
                 dest_partid, XPC_NET_CHANNEL, msg->buf_pa, msg->size,
                 msg->leadin_ignore, msg->tailout_ignore);
@@ -436,7 +436,7 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         if (skb->data[0] == 0x33) {
                 dev_kfree_skb(skb);
-                return 0;       /* nothing needed to be done */
+                return NETDEV_TX_OK;    /* nothing needed to be done */
         }
 
         /*
@@ -476,7 +476,7 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         if (skb->data[0] == 0xff) {
                 /* we are being asked to broadcast to all partitions */
-                for_each_bit(dest_partid, xpnet_broadcast_partitions,
+                for_each_set_bit(dest_partid, xpnet_broadcast_partitions,
                              xp_max_npartitions) {
 
                         xpnet_send(skb, queued_msg, start_addr, end_addr,
@@ -503,7 +503,7 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
         dev->stats.tx_packets++;
         dev->stats.tx_bytes += skb->len;
 
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 /*
diff --git a/drivers/misc/ti-st/Kconfig b/drivers/misc/ti-st/Kconfig
new file mode 100644
index 000000000000..2c8c3f39710d
--- /dev/null
+++ b/drivers/misc/ti-st/Kconfig
@@ -0,0 +1,17 @@
+#
+# TI's shared transport line discipline and the protocol
+# drivers (BT, FM and GPS)
+#
+menu "Texas Instruments shared transport line discipline"
+config TI_ST
+        tristate "Shared transport core driver"
+        depends on RFKILL
+        select FW_LOADER
+        help
+          This enables the shared transport core driver for TI
+          BT / FM and GPS combo chips. This enables protocol drivers
+          to register themselves with core and send data, the responses
+          are returned to relevant protocol drivers based on their
+          packet types.
+
+endmenu
diff --git a/drivers/misc/ti-st/Makefile b/drivers/misc/ti-st/Makefile
new file mode 100644
index 000000000000..78d7ebb14749
--- /dev/null
+++ b/drivers/misc/ti-st/Makefile
@@ -0,0 +1,6 @@
+#
+# Makefile for TI's shared transport line discipline
+# and its protocol drivers (BT, FM, GPS)
+#
+obj-$(CONFIG_TI_ST)             += st_drv.o
+st_drv-objs                     := st_core.o st_kim.o st_ll.o
diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
new file mode 100644
index 000000000000..f9aad06d1ae5
--- /dev/null
+++ b/drivers/misc/ti-st/st_core.c
@@ -0,0 +1,992 @@
+/*
+ *  Shared Transport Line discipline driver Core
+ *      This hooks up ST KIM driver and ST LL driver
+ *  Copyright (C) 2009-2010 Texas Instruments
+ *  Author: Pavan Savoy <pavan_savoy@ti.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#define pr_fmt(fmt)     "(stc): " fmt
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/tty.h>
+
+/* understand BT, FM and GPS for now */
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/hci.h>
+#include <linux/ti_wilink_st.h>
+
+/* function pointer pointing to either,
+ * st_kim_recv during registration to receive fw download responses
+ * st_int_recv after registration to receive proto stack responses
+ */
+void (*st_recv) (void*, const unsigned char*, long);
+
+/********************************************************************/
+#if 0
+/* internal misc functions */
+bool is_protocol_list_empty(void)
+{
+        unsigned char i = 0;
+        pr_debug(" %s ", __func__);
+        for (i = 0; i < ST_MAX; i++) {
+                if (st_gdata->list[i] != NULL)
+                        return ST_NOTEMPTY;
+                /* not empty */
+        }
+        /* list empty */
+        return ST_EMPTY;
+}
+#endif
+
+/* can be called in from
+ * -- KIM (during fw download)
+ * -- ST Core (during st_write)
+ *
+ *  This is the internal write function - a wrapper
+ *  to tty->ops->write
+ */
+int st_int_write(struct st_data_s *st_gdata,
+        const unsigned char *data, int count)
+{
+        struct tty_struct *tty;
+        if (unlikely(st_gdata == NULL || st_gdata->tty == NULL)) {
+                pr_err("tty unavailable to perform write");
+                return -1;
+        }
+        tty = st_gdata->tty;
+#ifdef VERBOSE
+        print_hex_dump(KERN_DEBUG, "<out<", DUMP_PREFIX_NONE,
+                16, 1, data, count, 0);
+#endif
+        return tty->ops->write(tty, data, count);
+
+}
+
+/*
+ * push the skb received to relevant
+ * protocol stacks
+ */
+void st_send_frame(enum proto_type protoid, struct st_data_s *st_gdata)
+{
+        pr_info(" %s(prot:%d) ", __func__, protoid);
+
+        if (unlikely
+            (st_gdata == NULL || st_gdata->rx_skb == NULL
+             || st_gdata->list[protoid] == NULL)) {
+                pr_err("protocol %d not registered, no data to send?",
+                           protoid);
+                kfree_skb(st_gdata->rx_skb);
+                return;
+        }
+        /* this cannot fail
+         * this shouldn't take long
+         * - should be just skb_queue_tail for the
+         *   protocol stack driver
+         */
+        if (likely(st_gdata->list[protoid]->recv != NULL)) {
+                if (unlikely
+                        (st_gdata->list[protoid]->recv
+                        (st_gdata->list[protoid]->priv_data, st_gdata->rx_skb)
+                             != 0)) {
+                        pr_err(" proto stack %d's ->recv failed", protoid);
+                        kfree_skb(st_gdata->rx_skb);
+                        return;
+                }
+        } else {
+                pr_err(" proto stack %d's ->recv null", protoid);
+                kfree_skb(st_gdata->rx_skb);
+        }
+        return;
+}
+
+/**
+ * st_reg_complete -
+ * to call registration complete callbacks
+ * of all protocol stack drivers
+ */
+void st_reg_complete(struct st_data_s *st_gdata, char err)
+{
+        unsigned char i = 0;
+        pr_info(" %s ", __func__);
+        for (i = 0; i < ST_MAX; i++) {
+                if (likely(st_gdata != NULL && st_gdata->list[i] != NULL &&
+                           st_gdata->list[i]->reg_complete_cb != NULL))
+                        st_gdata->list[i]->reg_complete_cb
+                                (st_gdata->list[i]->priv_data, err);
+        }
+}
+
+static inline int st_check_data_len(struct st_data_s *st_gdata,
+        int protoid, int len)
+{
+        int room = skb_tailroom(st_gdata->rx_skb);
+
+        pr_debug("len %d room %d", len, room);
+
+        if (!len) {
+                /* Received packet has only packet header and
+                 * has zero length payload. So, ask ST CORE to
+                 * forward the packet to protocol driver (BT/FM/GPS)
+                 */
+                st_send_frame(protoid, st_gdata);
+
+        } else if (len > room) {
+                /* Received packet's payload length is larger.
+                 * We can't accommodate it in created skb.
+                 */
+                pr_err("Data length is too large len %d room %d", len,
+                           room);
+                kfree_skb(st_gdata->rx_skb);
+        } else {
+                /* Packet header has non-zero payload length and
+                 * we have enough space in created skb. Lets read
+                 * payload data */
+                st_gdata->rx_state = ST_BT_W4_DATA;
+                st_gdata->rx_count = len;
+                return len;
+        }
+
+        /* Change ST state to continue to process next
+         * packet */
+        st_gdata->rx_state = ST_W4_PACKET_TYPE;
+        st_gdata->rx_skb = NULL;
+        st_gdata->rx_count = 0;
+
+        return 0;
+}
+
+/**
+ * st_wakeup_ack - internal function for action when wake-up ack
+ *      received
+ */
+static inline void st_wakeup_ack(struct st_data_s *st_gdata,
+        unsigned char cmd)
+{
+        struct sk_buff *waiting_skb;
+        unsigned long flags = 0;
+
+        spin_lock_irqsave(&st_gdata->lock, flags);
+        /* de-Q from waitQ and Q in txQ now that the
+         * chip is awake
+         */
+        while ((waiting_skb = skb_dequeue(&st_gdata->tx_waitq)))
+                skb_queue_tail(&st_gdata->txq, waiting_skb);
+
+        /* state forwarded to ST LL */
+        st_ll_sleep_state(st_gdata, (unsigned long)cmd);
+        spin_unlock_irqrestore(&st_gdata->lock, flags);
+
+        /* wake up to send the recently copied skbs from waitQ */
+        st_tx_wakeup(st_gdata);
+}
+
+/**
+ * st_int_recv - ST's internal receive function.
+ *      Decodes received RAW data and forwards to corresponding
+ *      client drivers (Bluetooth,FM,GPS..etc).
+ *      This can receive various types of packets,
+ *      HCI-Events, ACL, SCO, 4 types of HCI-LL PM packets
+ *      CH-8 packets from FM, CH-9 packets from GPS cores.
+ */
+void st_int_recv(void *disc_data,
+        const unsigned char *data, long count)
+{
+        char *ptr;
+        struct hci_event_hdr *eh;
+        struct hci_acl_hdr *ah;
+        struct hci_sco_hdr *sh;
+        struct fm_event_hdr *fm;
+        struct gps_event_hdr *gps;
+        int len = 0, type = 0, dlen = 0;
+        static enum proto_type protoid = ST_MAX;
+        struct st_data_s *st_gdata = (struct st_data_s *)disc_data;
+
+        ptr = (char *)data;
+        /* tty_receive sent null ? */
+        if (unlikely(ptr == NULL) || (st_gdata == NULL)) {
+                pr_err(" received null from TTY ");
+                return;
+        }
+
+        pr_info("count %ld rx_state %ld"
+                   "rx_count %ld", count, st_gdata->rx_state,
+                   st_gdata->rx_count);
+
+        /* Decode received bytes here */
+        while (count) {
+                if (st_gdata->rx_count) {
+                        len = min_t(unsigned int, st_gdata->rx_count, count);
+                        memcpy(skb_put(st_gdata->rx_skb, len), ptr, len);
+                        st_gdata->rx_count -= len;
+                        count -= len;
+                        ptr += len;
+
+                        if (st_gdata->rx_count)
+                                continue;
+
+                        /* Check ST RX state machine , where are we? */
+                        switch (st_gdata->rx_state) {
+
+                                /* Waiting for complete packet ? */
+                        case ST_BT_W4_DATA:
+                                pr_debug("Complete pkt received");
+
+                                /* Ask ST CORE to forward
+                                 * the packet to protocol driver */
+                                st_send_frame(protoid, st_gdata);
+
+                                st_gdata->rx_state = ST_W4_PACKET_TYPE;
+                                st_gdata->rx_skb = NULL;
+                                protoid = ST_MAX;       /* is this required ? */
+                                continue;
+
+                                /* Waiting for Bluetooth event header ? */
+                        case ST_BT_W4_EVENT_HDR:
+                                eh = (struct hci_event_hdr *)st_gdata->rx_skb->
+                                    data;
+
+                                pr_debug("Event header: evt 0x%2.2x"
+                                           "plen %d", eh->evt, eh->plen);
+
+                                st_check_data_len(st_gdata, protoid, eh->plen);
+                                continue;
+
+                                /* Waiting for Bluetooth acl header ? */
+                        case ST_BT_W4_ACL_HDR:
+                                ah = (struct hci_acl_hdr *)st_gdata->rx_skb->
+                                    data;
+                                dlen = __le16_to_cpu(ah->dlen);
+
+                                pr_info("ACL header: dlen %d", dlen);
+
+                                st_check_data_len(st_gdata, protoid, dlen);
+                                continue;
+
+                                /* Waiting for Bluetooth sco header ? */
+                        case ST_BT_W4_SCO_HDR:
+                                sh = (struct hci_sco_hdr *)st_gdata->rx_skb->
+                                    data;
+
+                                pr_info("SCO header: dlen %d", sh->dlen);
+
+                                st_check_data_len(st_gdata, protoid, sh->dlen);
+                                continue;
+                        case ST_FM_W4_EVENT_HDR:
+                                fm = (struct fm_event_hdr *)st_gdata->rx_skb->
+                                    data;
+                                pr_info("FM Header: ");
+                                st_check_data_len(st_gdata, ST_FM, fm->plen);
+                                continue;
+                                /* TODO : Add GPS packet machine logic here */
+                        case ST_GPS_W4_EVENT_HDR:
+                                /* [0x09 pkt hdr][R/W byte][2 byte len] */
+                                gps = (struct gps_event_hdr *)st_gdata->rx_skb->
+                                     data;
+                                pr_info("GPS Header: ");
+                                st_check_data_len(st_gdata, ST_GPS, gps->plen);
+                                continue;
+                        }       /* end of switch rx_state */
+                }
+
+                /* end of if rx_count */
+                /* Check first byte of packet and identify module
+                 * owner (BT/FM/GPS) */
+                switch (*ptr) {
+
+                        /* Bluetooth event packet? */
+                case HCI_EVENT_PKT:
+                        pr_info("Event packet");
+                        st_gdata->rx_state = ST_BT_W4_EVENT_HDR;
+                        st_gdata->rx_count = HCI_EVENT_HDR_SIZE;
+                        type = HCI_EVENT_PKT;
+                        protoid = ST_BT;
+                        break;
+
+                        /* Bluetooth acl packet? */
+                case HCI_ACLDATA_PKT:
+                        pr_info("ACL packet");
+                        st_gdata->rx_state = ST_BT_W4_ACL_HDR;
+                        st_gdata->rx_count = HCI_ACL_HDR_SIZE;
+                        type = HCI_ACLDATA_PKT;
+                        protoid = ST_BT;
+                        break;
+
+                        /* Bluetooth sco packet? */
+                case HCI_SCODATA_PKT:
+                        pr_info("SCO packet");
+                        st_gdata->rx_state = ST_BT_W4_SCO_HDR;
+                        st_gdata->rx_count = HCI_SCO_HDR_SIZE;
+                        type = HCI_SCODATA_PKT;
+                        protoid = ST_BT;
+                        break;
+
+                        /* Channel 8(FM) packet? */
+                case ST_FM_CH8_PKT:
+                        pr_info("FM CH8 packet");
+                        type = ST_FM_CH8_PKT;
+                        st_gdata->rx_state = ST_FM_W4_EVENT_HDR;
+                        st_gdata->rx_count = FM_EVENT_HDR_SIZE;
+                        protoid = ST_FM;
+                        break;
+
+                        /* Channel 9(GPS) packet? */
+                case 0x9:       /*ST_LL_GPS_CH9_PKT */
+                        pr_info("GPS CH9 packet");
+                        type = 0x9;     /* ST_LL_GPS_CH9_PKT; */
+                        protoid = ST_GPS;
+                        st_gdata->rx_state = ST_GPS_W4_EVENT_HDR;
+                        st_gdata->rx_count = 3; /* GPS_EVENT_HDR_SIZE -1*/
+                        break;
+                case LL_SLEEP_IND:
+                case LL_SLEEP_ACK:
+                case LL_WAKE_UP_IND:
+                        pr_info("PM packet");
+                        /* this takes appropriate action based on
+                         * sleep state received --
+                         */
+                        st_ll_sleep_state(st_gdata, *ptr);
+                        ptr++;
+                        count--;
+                        continue;
+                case LL_WAKE_UP_ACK:
+                        pr_info("PM packet");
+                        /* wake up ack received */
+                        st_wakeup_ack(st_gdata, *ptr);
+                        ptr++;
+                        count--;
+                        continue;
+                        /* Unknow packet? */
+                default:
+                        pr_err("Unknown packet type %2.2x", (__u8) *ptr);
+                        ptr++;
+                        count--;
+                        continue;
+                };
+                ptr++;
+                count--;
+
+                switch (protoid) {
+                case ST_BT:
+                        /* Allocate new packet to hold received data */
+                        st_gdata->rx_skb =
+                            bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
+                        if (!st_gdata->rx_skb) {
+                                pr_err("Can't allocate mem for new packet");
+                                st_gdata->rx_state = ST_W4_PACKET_TYPE;
+                                st_gdata->rx_count = 0;
+                                return;
+                        }
+                        bt_cb(st_gdata->rx_skb)->pkt_type = type;
+                        break;
+                case ST_FM:     /* for FM */
+                        st_gdata->rx_skb =
+                            alloc_skb(FM_MAX_FRAME_SIZE, GFP_ATOMIC);
+                        if (!st_gdata->rx_skb) {
+                                pr_err("Can't allocate mem for new packet");
+                                st_gdata->rx_state = ST_W4_PACKET_TYPE;
+                                st_gdata->rx_count = 0;
+                                return;
+                        }
+                        /* place holder 0x08 */
+                        skb_reserve(st_gdata->rx_skb, 1);
+                        st_gdata->rx_skb->cb[0] = ST_FM_CH8_PKT;
+                        break;
+                case ST_GPS:
+                        /* for GPS */
+                        st_gdata->rx_skb =
+                            alloc_skb(100 /*GPS_MAX_FRAME_SIZE */ , GFP_ATOMIC);
+                        if (!st_gdata->rx_skb) {
+                                pr_err("Can't allocate mem for new packet");
+                                st_gdata->rx_state = ST_W4_PACKET_TYPE;
+                                st_gdata->rx_count = 0;
+                                return;
+                        }
+                        /* place holder 0x09 */
+                        skb_reserve(st_gdata->rx_skb, 1);
+                        st_gdata->rx_skb->cb[0] = 0x09; /*ST_GPS_CH9_PKT; */
+                        break;
+                case ST_MAX:
+                        break;
+                }
+        }
+        pr_debug("done %s", __func__);
+        return;
+}
+
+/**
+ * st_int_dequeue - internal de-Q function.
+ *      If the previous data set was not written
+ *      completely, return that skb which has the pending data.
+ *      In normal cases, return top of txq.
+ */
+struct sk_buff *st_int_dequeue(struct st_data_s *st_gdata)
+{
+        struct sk_buff *returning_skb;
+
+        pr_debug("%s", __func__);
+        if (st_gdata->tx_skb != NULL) {
+                returning_skb = st_gdata->tx_skb;
+                st_gdata->tx_skb = NULL;
+                return returning_skb;
+        }
+        return skb_dequeue(&st_gdata->txq);
+}
+
+/**
+ * st_int_enqueue - internal Q-ing function.
+ *      Will either Q the skb to txq or the tx_waitq
+ *      depending on the ST LL state.
+ *      If the chip is asleep, then Q it onto waitq and
+ *      wakeup the chip.
+ *      txq and waitq needs protection since the other contexts
+ *      may be sending data, waking up chip.
+ */
+void st_int_enqueue(struct st_data_s *st_gdata, struct sk_buff *skb)
+{
+        unsigned long flags = 0;
+
+        pr_debug("%s", __func__);
+        spin_lock_irqsave(&st_gdata->lock, flags);
+
+        switch (st_ll_getstate(st_gdata)) {
+        case ST_LL_AWAKE:
+                pr_info("ST LL is AWAKE, sending normally");
+                skb_queue_tail(&st_gdata->txq, skb);
+                break;
+        case ST_LL_ASLEEP_TO_AWAKE:
+                skb_queue_tail(&st_gdata->tx_waitq, skb);
+                break;
+        case ST_LL_AWAKE_TO_ASLEEP:
+                pr_err("ST LL is illegal state(%ld),"
+                           "purging received skb.", st_ll_getstate(st_gdata));
+                kfree_skb(skb);
+                break;
+        case ST_LL_ASLEEP:
+                skb_queue_tail(&st_gdata->tx_waitq, skb);
+                st_ll_wakeup(st_gdata);
+                break;
+        default:
+                pr_err("ST LL is illegal state(%ld),"
+                           "purging received skb.", st_ll_getstate(st_gdata));
+                kfree_skb(skb);
+                break;
+        }
+
+        spin_unlock_irqrestore(&st_gdata->lock, flags);
+        pr_debug("done %s", __func__);
+        return;
+}
+
+/*
+ * internal wakeup function
+ * called from either
+ * - TTY layer when write's finished
+ * - st_write (in context of the protocol stack)
+ */
+void st_tx_wakeup(struct st_data_s *st_data)
+{
+        struct sk_buff *skb;
+        unsigned long flags;    /* for irq save flags */
+        pr_debug("%s", __func__);
+        /* check for sending & set flag sending here */
+        if (test_and_set_bit(ST_TX_SENDING, &st_data->tx_state)) {
+                pr_info("ST already sending");
+                /* keep sending */
+                set_bit(ST_TX_WAKEUP, &st_data->tx_state);
+                return;
+                /* TX_WAKEUP will be checked in another
+                 * context
+                 */
+        }
+        do {                    /* come back if st_tx_wakeup is set */
+                /* woke-up to write */
+                clear_bit(ST_TX_WAKEUP, &st_data->tx_state);
+                while ((skb = st_int_dequeue(st_data))) {
+                        int len;
+                        spin_lock_irqsave(&st_data->lock, flags);
+                        /* enable wake-up from TTY */
+                        set_bit(TTY_DO_WRITE_WAKEUP, &st_data->tty->flags);
+                        len = st_int_write(st_data, skb->data, skb->len);
+                        skb_pull(skb, len);
+                        /* if skb->len = len as expected, skb->len=0 */
+                        if (skb->len) {
+                                /* would be the next skb to be sent */
+                                st_data->tx_skb = skb;
+                                spin_unlock_irqrestore(&st_data->lock, flags);
+                                break;
+                        }
+                        kfree_skb(skb);
+                        spin_unlock_irqrestore(&st_data->lock, flags);
+                }
+                /* if wake-up is set in another context- restart sending */
+        } while (test_bit(ST_TX_WAKEUP, &st_data->tx_state));
+
+        /* clear flag sending */
+        clear_bit(ST_TX_SENDING, &st_data->tx_state);
+}
+
+/********************************************************************/
+/* functions called from ST KIM
+*/
+void kim_st_list_protocols(struct st_data_s *st_gdata, void *buf)
+{
+        seq_printf(buf, "[%d]\nBT=%c\nFM=%c\nGPS=%c\n",
+                        st_gdata->protos_registered,
+                        st_gdata->list[ST_BT] != NULL ? 'R' : 'U',
+                        st_gdata->list[ST_FM] != NULL ? 'R' : 'U',
+                        st_gdata->list[ST_GPS] != NULL ? 'R' : 'U');
+}
+
+/********************************************************************/
+/*
+ * functions called from protocol stack drivers
+ * to be EXPORT-ed
+ */
+long st_register(struct st_proto_s *new_proto)
+{
+        struct st_data_s        *st_gdata;
+        long err = 0;
+        unsigned long flags = 0;
+
+        st_kim_ref(&st_gdata, 0);
+        pr_info("%s(%d) ", __func__, new_proto->type);
+        if (st_gdata == NULL || new_proto == NULL || new_proto->recv == NULL
+            || new_proto->reg_complete_cb == NULL) {
+                pr_err("gdata/new_proto/recv or reg_complete_cb not ready");
+                return -1;
+        }
+
+        if (new_proto->type < ST_BT || new_proto->type >= ST_MAX) {
+                pr_err("protocol %d not supported", new_proto->type);
+                return -EPROTONOSUPPORT;
+        }
+
+        if (st_gdata->list[new_proto->type] != NULL) {
+                pr_err("protocol %d already registered", new_proto->type);
+                return -EALREADY;
+        }
+
+        /* can be from process context only */
+        spin_lock_irqsave(&st_gdata->lock, flags);
+
+        if (test_bit(ST_REG_IN_PROGRESS, &st_gdata->st_state)) {
+                pr_info(" ST_REG_IN_PROGRESS:%d ", new_proto->type);
+                /* fw download in progress */
+                st_kim_chip_toggle(new_proto->type, KIM_GPIO_ACTIVE);
+
+                st_gdata->list[new_proto->type] = new_proto;
+                st_gdata->protos_registered++;
+                new_proto->write = st_write;
+
+                set_bit(ST_REG_PENDING, &st_gdata->st_state);
+                spin_unlock_irqrestore(&st_gdata->lock, flags);
+                return -EINPROGRESS;
+        } else if (st_gdata->protos_registered == ST_EMPTY) {
+                pr_info(" protocol list empty :%d ", new_proto->type);
+                set_bit(ST_REG_IN_PROGRESS, &st_gdata->st_state);
+                st_recv = st_kim_recv;
+
+                /* release lock previously held - re-locked below */
+                spin_unlock_irqrestore(&st_gdata->lock, flags);
+
+                /* enable the ST LL - to set default chip state */
+                st_ll_enable(st_gdata);
+                /* this may take a while to complete
+                 * since it involves BT fw download
+                 */
+                err = st_kim_start(st_gdata->kim_data);
+                if (err != 0) {
+                        clear_bit(ST_REG_IN_PROGRESS, &st_gdata->st_state);
+                        if ((st_gdata->protos_registered != ST_EMPTY) &&
+                            (test_bit(ST_REG_PENDING, &st_gdata->st_state))) {
+                                pr_err(" KIM failure complete callback ");
+                                st_reg_complete(st_gdata, -1);
+                        }
+
+                        return -1;
+                }
+
+                /* the protocol might require other gpios to be toggled
+                 */
+                st_kim_chip_toggle(new_proto->type, KIM_GPIO_ACTIVE);
+
+                clear_bit(ST_REG_IN_PROGRESS, &st_gdata->st_state);
+                st_recv = st_int_recv;
+
+                /* this is where all pending registration
+                 * are signalled to be complete by calling callback functions
+                 */
+                if ((st_gdata->protos_registered != ST_EMPTY) &&
+                    (test_bit(ST_REG_PENDING, &st_gdata->st_state))) {
+                        pr_debug(" call reg complete callback ");
+                        st_reg_complete(st_gdata, 0);
+                }
+                clear_bit(ST_REG_PENDING, &st_gdata->st_state);
+
+                /* check for already registered once more,
+                 * since the above check is old
+                 */
+                if (st_gdata->list[new_proto->type] != NULL) {
+                        pr_err(" proto %d already registered ",
+                                   new_proto->type);
+                        return -EALREADY;
+                }
+
+                spin_lock_irqsave(&st_gdata->lock, flags);
+                st_gdata->list[new_proto->type] = new_proto;
+                st_gdata->protos_registered++;
+                new_proto->write = st_write;
+                spin_unlock_irqrestore(&st_gdata->lock, flags);
+                return err;
+        }
+        /* if fw is already downloaded & new stack registers protocol */
+        else {
+                switch (new_proto->type) {
+                case ST_BT:
+                        /* do nothing */
+                        break;
+                case ST_FM:
+                case ST_GPS:
+                        st_kim_chip_toggle(new_proto->type, KIM_GPIO_ACTIVE);
+                        break;
+                case ST_MAX:
+                default:
+                        pr_err("%d protocol not supported",
+                                   new_proto->type);
+                        spin_unlock_irqrestore(&st_gdata->lock, flags);
+                        return -EPROTONOSUPPORT;
+                }
+                st_gdata->list[new_proto->type] = new_proto;
+                st_gdata->protos_registered++;
+                new_proto->write = st_write;
+
+                /* lock already held before entering else */
+                spin_unlock_irqrestore(&st_gdata->lock, flags);
+                return err;
+        }
+        pr_debug("done %s(%d) ", __func__, new_proto->type);
+}
+EXPORT_SYMBOL_GPL(st_register);
+
+/* to unregister a protocol -
+ * to be called from protocol stack driver
+ */
+long st_unregister(enum proto_type type)
+{
+        long err = 0;
+        unsigned long flags = 0;
+        struct st_data_s        *st_gdata;
+
+        pr_debug("%s: %d ", __func__, type);
+
+        st_kim_ref(&st_gdata, 0);
+        if (type < ST_BT || type >= ST_MAX) {
+                pr_err(" protocol %d not supported", type);
+                return -EPROTONOSUPPORT;
+        }
+
+        spin_lock_irqsave(&st_gdata->lock, flags);
+
+        if (st_gdata->list[type] == NULL) {
+                pr_err(" protocol %d not registered", type);
+                spin_unlock_irqrestore(&st_gdata->lock, flags);
+                return -EPROTONOSUPPORT;
+        }
+
+        st_gdata->protos_registered--;
+        st_gdata->list[type] = NULL;
+
+        /* kim ignores BT in the below function
+         * and handles the rest, BT is toggled
+         * only in kim_start and kim_stop
+         */
+        st_kim_chip_toggle(type, KIM_GPIO_INACTIVE);
+        spin_unlock_irqrestore(&st_gdata->lock, flags);
+
+        if ((st_gdata->protos_registered == ST_EMPTY) &&
+            (!test_bit(ST_REG_PENDING, &st_gdata->st_state))) {
+                pr_info(" all protocols unregistered ");
+
+                /* stop traffic on tty */
+                if (st_gdata->tty) {
+                        tty_ldisc_flush(st_gdata->tty);
+                        stop_tty(st_gdata->tty);
+                }
+
+                /* all protocols now unregistered */
+                st_kim_stop(st_gdata->kim_data);
+                /* disable ST LL */
+                st_ll_disable(st_gdata);
+        }
+        return err;
+}
+
+/*
+ * called in protocol stack drivers
+ * via the write function pointer
+ */
+long st_write(struct sk_buff *skb)
+{
+        struct st_data_s *st_gdata;
+#ifdef DEBUG
+        enum proto_type protoid = ST_MAX;
+#endif
+        long len;
+
+        st_kim_ref(&st_gdata, 0);
+        if (unlikely(skb == NULL || st_gdata == NULL
+                || st_gdata->tty == NULL)) {
+                pr_err("data/tty unavailable to perform write");
+                return -1;
+        }
+#ifdef DEBUG                    /* open-up skb to read the 1st byte */
+        switch (skb->data[0]) {
+        case HCI_COMMAND_PKT:
+        case HCI_ACLDATA_PKT:
+        case HCI_SCODATA_PKT:
+                protoid = ST_BT;
+                break;
+        case ST_FM_CH8_PKT:
+                protoid = ST_FM;
+                break;
+        case 0x09:
+                protoid = ST_GPS;
+                break;
+        }
+        if (unlikely(st_gdata->list[protoid] == NULL)) {
+                pr_err(" protocol %d not registered, and writing? ",
+                           protoid);
+                return -1;
+        }
+#endif
+        pr_debug("%d to be written", skb->len);
+        len = skb->len;
+
+        /* st_ll to decide where to enqueue the skb */
+        st_int_enqueue(st_gdata, skb);
+        /* wake up */
+        st_tx_wakeup(st_gdata);
+
+        /* return number of bytes written */
+        return len;
+}
+
+/* for protocols making use of shared transport */
+EXPORT_SYMBOL_GPL(st_unregister);
+
+/********************************************************************/
+/*
+ * functions called from TTY layer
+ */
+static int st_tty_open(struct tty_struct *tty)
+{
+        int err = 0;
+        struct st_data_s *st_gdata;
+        pr_info("%s ", __func__);
+
+        st_kim_ref(&st_gdata, 0);
+        st_gdata->tty = tty;
+        tty->disc_data = st_gdata;
+
+        /* don't do an wakeup for now */
+        clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+
+        /* mem already allocated
+         */
+        tty->receive_room = 65536;
+        /* Flush any pending characters in the driver and discipline. */
+        tty_ldisc_flush(tty);
+        tty_driver_flush_buffer(tty);
+        /*
+         * signal to UIM via KIM that -
+         * installation of N_TI_WL ldisc is complete
+         */
+        st_kim_complete(st_gdata->kim_data);
+        pr_debug("done %s", __func__);
+        return err;
+}
+
+static void st_tty_close(struct tty_struct *tty)
+{
+        unsigned char i = ST_MAX;
+        unsigned long flags = 0;
+        struct  st_data_s *st_gdata = tty->disc_data;
+
+        pr_info("%s ", __func__);
+
+        /* TODO:
+         * if a protocol has been registered & line discipline
+         * un-installed for some reason - what should be done ?
+         */
+        spin_lock_irqsave(&st_gdata->lock, flags);
+        for (i = ST_BT; i < ST_MAX; i++) {
+                if (st_gdata->list[i] != NULL)
+                        pr_err("%d not un-registered", i);
+                st_gdata->list[i] = NULL;
+        }
+        st_gdata->protos_registered = 0;
+        spin_unlock_irqrestore(&st_gdata->lock, flags);
+        /*
+         * signal to UIM via KIM that -
+         * N_TI_WL ldisc is un-installed
+         */
+        st_kim_complete(st_gdata->kim_data);
+        st_gdata->tty = NULL;
+        /* Flush any pending characters in the driver and discipline. */
+        tty_ldisc_flush(tty);
+        tty_driver_flush_buffer(tty);
+
+        spin_lock_irqsave(&st_gdata->lock, flags);
+        /* empty out txq and tx_waitq */
+        skb_queue_purge(&st_gdata->txq);
+        skb_queue_purge(&st_gdata->tx_waitq);
+        /* reset the TTY Rx states of ST */
+        st_gdata->rx_count = 0;
+        st_gdata->rx_state = ST_W4_PACKET_TYPE;
+        kfree_skb(st_gdata->rx_skb);
+        st_gdata->rx_skb = NULL;
+        spin_unlock_irqrestore(&st_gdata->lock, flags);
+
+        pr_debug("%s: done ", __func__);
+}
+
+static void st_tty_receive(struct tty_struct *tty, const unsigned char *data,
+                           char *tty_flags, int count)
+{
+
+#ifdef VERBOSE
+        print_hex_dump(KERN_DEBUG, ">in>", DUMP_PREFIX_NONE,
+                16, 1, data, count, 0);
+#endif
+
+        /*
+         * if fw download is in progress then route incoming data
+         * to KIM for validation
+         */
+        st_recv(tty->disc_data, data, count);
+        pr_debug("done %s", __func__);
+}
+
+/* wake-up function called in from the TTY layer
+ * inside the internal wakeup function will be called
+ */
+static void st_tty_wakeup(struct tty_struct *tty)
+{
+        struct  st_data_s *st_gdata = tty->disc_data;
+        pr_debug("%s ", __func__);
+        /* don't do an wakeup for now */
+        clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+
+        /* call our internal wakeup */
+        st_tx_wakeup((void *)st_gdata);
+}
+
+static void st_tty_flush_buffer(struct tty_struct *tty)
+{
+        struct  st_data_s *st_gdata = tty->disc_data;
+        pr_debug("%s ", __func__);
+
+        kfree_skb(st_gdata->tx_skb);
+        st_gdata->tx_skb = NULL;
+
+        tty->ops->flush_buffer(tty);
+        return;
+}
+
+static struct tty_ldisc_ops st_ldisc_ops = {
+        .magic = TTY_LDISC_MAGIC,
+        .name = "n_st",
+        .open = st_tty_open,
+        .close = st_tty_close,
+        .receive_buf = st_tty_receive,
+        .write_wakeup = st_tty_wakeup,
+        .flush_buffer = st_tty_flush_buffer,
+        .owner = THIS_MODULE
+};
+
+/********************************************************************/
+int st_core_init(struct st_data_s **core_data)
+{
+        struct st_data_s *st_gdata;
+        long err;
+
+        err = tty_register_ldisc(N_TI_WL, &st_ldisc_ops);
+        if (err) {
+                pr_err("error registering %d line discipline %ld",
+                           N_TI_WL, err);
+                return err;
+        }
+        pr_debug("registered n_shared line discipline");
+
+        st_gdata = kzalloc(sizeof(struct st_data_s), GFP_KERNEL);
+        if (!st_gdata) {
+                pr_err("memory allocation failed");
+                err = tty_unregister_ldisc(N_TI_WL);
+                if (err)
+                        pr_err("unable to un-register ldisc %ld", err);
+                err = -ENOMEM;
+                return err;
+        }
+
+        /* Initialize ST TxQ and Tx waitQ queue head. All BT/FM/GPS module skb's
+         * will be pushed in this queue for actual transmission.
+         */
+        skb_queue_head_init(&st_gdata->txq);
+        skb_queue_head_init(&st_gdata->tx_waitq);
+
+        /* Locking used in st_int_enqueue() to avoid multiple execution */
+        spin_lock_init(&st_gdata->lock);
+
+        err = st_ll_init(st_gdata);
+        if (err) {
+                pr_err("error during st_ll initialization(%ld)", err);
+                kfree(st_gdata);
+                err = tty_unregister_ldisc(N_TI_WL);
+                if (err)
+                        pr_err("unable to un-register ldisc");
+                return -1;
+        }
+        *core_data = st_gdata;
+        return 0;
+}
+
+void st_core_exit(struct st_data_s *st_gdata)
+{
+        long err;
+        /* internal module cleanup */
+        err = st_ll_deinit(st_gdata);
+        if (err)
+                pr_err("error during deinit of ST LL %ld", err);
+
+        if (st_gdata != NULL) {
+                /* Free ST Tx Qs and skbs */
+                skb_queue_purge(&st_gdata->txq);
+                skb_queue_purge(&st_gdata->tx_waitq);
+                kfree_skb(st_gdata->rx_skb);
+                kfree_skb(st_gdata->tx_skb);
+                /* TTY ldisc cleanup */
+                err = tty_unregister_ldisc(N_TI_WL);
+                if (err)
+                        pr_err("unable to un-register ldisc %ld", err);
+                /* free the global data pointer */
+                kfree(st_gdata);
+        }
+}
+
+
diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
new file mode 100644
index 000000000000..73b6c8b0e869
--- /dev/null
+++ b/drivers/misc/ti-st/st_kim.c
@@ -0,0 +1,799 @@
+/*
+ *  Shared Transport Line discipline driver Core
+ *      Init Manager module responsible for GPIO control
+ *      and firmware download
+ *  Copyright (C) 2009-2010 Texas Instruments
+ *  Author: Pavan Savoy <pavan_savoy@ti.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#define pr_fmt(fmt) "(stk) :" fmt
+#include <linux/platform_device.h>
+#include <linux/jiffies.h>
+#include <linux/firmware.h>
+#include <linux/delay.h>
+#include <linux/wait.h>
+#include <linux/gpio.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include <linux/sched.h>
+#include <linux/rfkill.h>
+
+/* understand BT events for fw response */
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/hci.h>
+
+#include <linux/ti_wilink_st.h>
+
+
+static int kim_probe(struct platform_device *pdev);
+static int kim_remove(struct platform_device *pdev);
+
+/* KIM platform device driver structure */
+static struct platform_driver kim_platform_driver = {
+        .probe = kim_probe,
+        .remove = kim_remove,
+        /* TODO: ST driver power management during suspend/resume ?
+         */
+#if 0
+        .suspend = kim_suspend,
+        .resume = kim_resume,
+#endif
+        .driver = {
+                   .name = "kim",
+                   .owner = THIS_MODULE,
+                   },
+};
+
+static int kim_toggle_radio(void*, bool);
+static const struct rfkill_ops kim_rfkill_ops = {
+        .set_block = kim_toggle_radio,
+};
+
+/* strings to be used for rfkill entries and by
+ * ST Core to be used for sysfs debug entry
+ */
+#define PROTO_ENTRY(type, name) name
+const unsigned char *protocol_names[] = {
+        PROTO_ENTRY(ST_BT, "Bluetooth"),
+        PROTO_ENTRY(ST_FM, "FM"),
+        PROTO_ENTRY(ST_GPS, "GPS"),
+};
+
+#define MAX_ST_DEVICES  3       /* Imagine 1 on each UART for now */
+static struct platform_device *st_kim_devices[MAX_ST_DEVICES];
+
+/**********************************************************************/
+/* internal functions */
+
+/**
+ * st_get_plat_device -
+ *      function which returns the reference to the platform device
+ *      requested by id. As of now only 1 such device exists (id=0)
+ *      the context requesting for reference can get the id to be
+ *      requested by a. The protocol driver which is registering or
+ *      b. the tty device which is opened.
+ */
+static struct platform_device *st_get_plat_device(int id)
+{
+        return st_kim_devices[id];
+}
+
+/**
+ * validate_firmware_response -
+ *      function to return whether the firmware response was proper
+ *      in case of error don't complete so that waiting for proper
+ *      response times out
+ */
+void validate_firmware_response(struct kim_data_s *kim_gdata)
+{
+        struct sk_buff *skb = kim_gdata->rx_skb;
+        if (unlikely(skb->data[5] != 0)) {
+                pr_err("no proper response during fw download");
+                pr_err("data6 %x", skb->data[5]);
+                return;         /* keep waiting for the proper response */
+        }
+        /* becos of all the script being downloaded */
+        complete_all(&kim_gdata->kim_rcvd);
+        kfree_skb(skb);
+}
+
+/* check for data len received inside kim_int_recv
+ * most often hit the last case to update state to waiting for data
+ */
+static inline int kim_check_data_len(struct kim_data_s *kim_gdata, int len)
+{
+        register int room = skb_tailroom(kim_gdata->rx_skb);
+
+        pr_debug("len %d room %d", len, room);
+
+        if (!len) {
+                validate_firmware_response(kim_gdata);
+        } else if (len > room) {
+                /* Received packet's payload length is larger.
+                 * We can't accommodate it in created skb.
+                 */
+                pr_err("Data length is too large len %d room %d", len,
+                           room);
+                kfree_skb(kim_gdata->rx_skb);
+        } else {
+                /* Packet header has non-zero payload length and
+                 * we have enough space in created skb. Lets read
+                 * payload data */
+                kim_gdata->rx_state = ST_BT_W4_DATA;
+                kim_gdata->rx_count = len;
+                return len;
+        }
+
+        /* Change ST LL state to continue to process next
+         * packet */
+        kim_gdata->rx_state = ST_W4_PACKET_TYPE;
+        kim_gdata->rx_skb = NULL;
+        kim_gdata->rx_count = 0;
+
+        return 0;
+}
+
+/**
+ * kim_int_recv - receive function called during firmware download
+ *      firmware download responses on different UART drivers
+ *      have been observed to come in bursts of different
+ *      tty_receive and hence the logic
+ */
+void kim_int_recv(struct kim_data_s *kim_gdata,
+        const unsigned char *data, long count)
+{
+        const unsigned char *ptr;
+        struct hci_event_hdr *eh;
+        int len = 0, type = 0;
+
+        pr_debug("%s", __func__);
+        /* Decode received bytes here */
+        ptr = data;
+        if (unlikely(ptr == NULL)) {
+                pr_err(" received null from TTY ");
+                return;
+        }
+
+        while (count) {
+                if (kim_gdata->rx_count) {
+                        len = min_t(unsigned int, kim_gdata->rx_count, count);
+                        memcpy(skb_put(kim_gdata->rx_skb, len), ptr, len);
+                        kim_gdata->rx_count -= len;
+                        count -= len;
+                        ptr += len;
+
+                        if (kim_gdata->rx_count)
+                                continue;
+
+                        /* Check ST RX state machine , where are we? */
+                        switch (kim_gdata->rx_state) {
+                                /* Waiting for complete packet ? */
+                        case ST_BT_W4_DATA:
+                                pr_debug("Complete pkt received");
+                                validate_firmware_response(kim_gdata);
+                                kim_gdata->rx_state = ST_W4_PACKET_TYPE;
+                                kim_gdata->rx_skb = NULL;
+                                continue;
+                                /* Waiting for Bluetooth event header ? */
+                        case ST_BT_W4_EVENT_HDR:
+                                eh = (struct hci_event_hdr *)kim_gdata->
+                                    rx_skb->data;
+                                pr_debug("Event header: evt 0x%2.2x"
+                                           "plen %d", eh->evt, eh->plen);
+                                kim_check_data_len(kim_gdata, eh->plen);
+                                continue;
+                        }       /* end of switch */
+                }               /* end of if rx_state */
+                switch (*ptr) {
+                        /* Bluetooth event packet? */
+                case HCI_EVENT_PKT:
+                        pr_info("Event packet");
+                        kim_gdata->rx_state = ST_BT_W4_EVENT_HDR;
+                        kim_gdata->rx_count = HCI_EVENT_HDR_SIZE;
+                        type = HCI_EVENT_PKT;
+                        break;
+                default:
+                        pr_info("unknown packet");
+                        ptr++;
+                        count--;
+                        continue;
+                }
+                ptr++;
+                count--;
+                kim_gdata->rx_skb =
+                    bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
+                if (!kim_gdata->rx_skb) {
+                        pr_err("can't allocate mem for new packet");
+                        kim_gdata->rx_state = ST_W4_PACKET_TYPE;
+                        kim_gdata->rx_count = 0;
+                        return;
+                }
+                bt_cb(kim_gdata->rx_skb)->pkt_type = type;
+        }
+        pr_info("done %s", __func__);
+        return;
+}
+
+static long read_local_version(struct kim_data_s *kim_gdata, char *bts_scr_name)
+{
+        unsigned short version = 0, chip = 0, min_ver = 0, maj_ver = 0;
+        const char read_ver_cmd[] = { 0x01, 0x01, 0x10, 0x00 };
+
+        pr_debug("%s", __func__);
+
+        INIT_COMPLETION(kim_gdata->kim_rcvd);
+        if (4 != st_int_write(kim_gdata->core_data, read_ver_cmd, 4)) {
+                pr_err("kim: couldn't write 4 bytes");
+                return -1;
+        }
+
+        if (!wait_for_completion_timeout
+            (&kim_gdata->kim_rcvd, msecs_to_jiffies(CMD_RESP_TIME))) {
+                pr_err(" waiting for ver info- timed out ");
+                return -1;
+        }
+
+        version =
+                MAKEWORD(kim_gdata->resp_buffer[13],
+                                kim_gdata->resp_buffer[14]);
+        chip = (version & 0x7C00) >> 10;
+        min_ver = (version & 0x007F);
+        maj_ver = (version & 0x0380) >> 7;
+
+        if (version & 0x8000)
+                maj_ver |= 0x0008;
+
+        sprintf(bts_scr_name, "TIInit_%d.%d.%d.bts", chip, maj_ver, min_ver);
+
+        /* to be accessed later via sysfs entry */
+        kim_gdata->version.full = version;
+        kim_gdata->version.chip = chip;
+        kim_gdata->version.maj_ver = maj_ver;
+        kim_gdata->version.min_ver = min_ver;
+
+        pr_info("%s", bts_scr_name);
+        return 0;
+}
+
+/**
+ * download_firmware -
+ *      internal function which parses through the .bts firmware
+ *      script file intreprets SEND, DELAY actions only as of now
+ */
+static long download_firmware(struct kim_data_s *kim_gdata)
+{
+        long err = 0;
+        long len = 0;
+        unsigned char *ptr = NULL;
+        unsigned char *action_ptr = NULL;
+        unsigned char bts_scr_name[30] = { 0 }; /* 30 char long bts scr name? */
+
+        err = read_local_version(kim_gdata, bts_scr_name);
+        if (err != 0) {
+                pr_err("kim: failed to read local ver");
+                return err;
+        }
+        err =
+            request_firmware(&kim_gdata->fw_entry, bts_scr_name,
+                             &kim_gdata->kim_pdev->dev);
+        if (unlikely((err != 0) || (kim_gdata->fw_entry->data == NULL) ||
+                     (kim_gdata->fw_entry->size == 0))) {
+                pr_err(" request_firmware failed(errno %ld) for %s", err,
+                           bts_scr_name);
+                return -1;
+        }
+        ptr = (void *)kim_gdata->fw_entry->data;
+        len = kim_gdata->fw_entry->size;
+        /* bts_header to remove out magic number and
+         * version
+         */
+        ptr += sizeof(struct bts_header);
+        len -= sizeof(struct bts_header);
+
+        while (len > 0 && ptr) {
+                pr_debug(" action size %d, type %d ",
+                           ((struct bts_action *)ptr)->size,
+                           ((struct bts_action *)ptr)->type);
+
+                switch (((struct bts_action *)ptr)->type) {
+                case ACTION_SEND_COMMAND:       /* action send */
+                        action_ptr = &(((struct bts_action *)ptr)->data[0]);
+                        if (unlikely
+                            (((struct hci_command *)action_ptr)->opcode ==
+                             0xFF36)) {
+                                /* ignore remote change
+                                 * baud rate HCI VS command */
+                                pr_err
+                                    (" change remote baud"
+                                    " rate command in firmware");
+                                break;
+                        }
+
+                        INIT_COMPLETION(kim_gdata->kim_rcvd);
+                        err = st_int_write(kim_gdata->core_data,
+                        ((struct bts_action_send *)action_ptr)->data,
+                                           ((struct bts_action *)ptr)->size);
+                        if (unlikely(err < 0)) {
+                                release_firmware(kim_gdata->fw_entry);
+                                return -1;
+                        }
+                        if (!wait_for_completion_timeout
+                            (&kim_gdata->kim_rcvd,
+                             msecs_to_jiffies(CMD_RESP_TIME))) {
+                                pr_err
+                                    (" response timeout during fw download ");
+                                /* timed out */
+                                release_firmware(kim_gdata->fw_entry);
+                                return -1;
+                        }
+                        break;
+                case ACTION_DELAY:      /* sleep */
+                        pr_info("sleep command in scr");
+                        action_ptr = &(((struct bts_action *)ptr)->data[0]);
+                        mdelay(((struct bts_action_delay *)action_ptr)->msec);
+                        break;
+                }
+                len =
+                    len - (sizeof(struct bts_action) +
+                           ((struct bts_action *)ptr)->size);
+                ptr =
+                    ptr + sizeof(struct bts_action) +
+                    ((struct bts_action *)ptr)->size;
+        }
+        /* fw download complete */
+        release_firmware(kim_gdata->fw_entry);
+        return 0;
+}
+
+/**********************************************************************/
+/* functions called from ST core */
+/* function to toggle the GPIO
+ * needs to know whether the GPIO is active high or active low
+ */
+void st_kim_chip_toggle(enum proto_type type, enum kim_gpio_state state)
+{
+        struct platform_device  *kim_pdev;
+        struct kim_data_s       *kim_gdata;
+        pr_info(" %s ", __func__);
+
+        kim_pdev = st_get_plat_device(0);
+        kim_gdata = dev_get_drvdata(&kim_pdev->dev);
+
+        if (kim_gdata->gpios[type] == -1) {
+                pr_info(" gpio not requested for protocol %s",
+                           protocol_names[type]);
+                return;
+        }
+        switch (type) {
+        case ST_BT:
+                /*Do Nothing */
+                break;
+
+        case ST_FM:
+                if (state == KIM_GPIO_ACTIVE)
+                        gpio_set_value(kim_gdata->gpios[ST_FM], GPIO_LOW);
+                else
+                        gpio_set_value(kim_gdata->gpios[ST_FM], GPIO_HIGH);
+                break;
+
+        case ST_GPS:
+                if (state == KIM_GPIO_ACTIVE)
+                        gpio_set_value(kim_gdata->gpios[ST_GPS], GPIO_HIGH);
+                else
+                        gpio_set_value(kim_gdata->gpios[ST_GPS], GPIO_LOW);
+                break;
+
+        case ST_MAX:
+        default:
+                break;
+        }
+
+        return;
+}
+
+/* called from ST Core, when REG_IN_PROGRESS (registration in progress)
+ * can be because of
+ * 1. response to read local version
+ * 2. during send/recv's of firmware download
+ */
+void st_kim_recv(void *disc_data, const unsigned char *data, long count)
+{
+        struct st_data_s        *st_gdata = (struct st_data_s *)disc_data;
+        struct kim_data_s       *kim_gdata = st_gdata->kim_data;
+
+        pr_info(" %s ", __func__);
+        /* copy to local buffer */
+        if (unlikely(data[4] == 0x01 && data[5] == 0x10 && data[0] == 0x04)) {
+                /* must be the read_ver_cmd */
+                memcpy(kim_gdata->resp_buffer, data, count);
+                complete_all(&kim_gdata->kim_rcvd);
+                return;
+        } else {
+                kim_int_recv(kim_gdata, data, count);
+                /* either completes or times out */
+        }
+        return;
+}
+
+/* to signal completion of line discipline installation
+ * called from ST Core, upon tty_open
+ */
+void st_kim_complete(void *kim_data)
+{
+        struct kim_data_s       *kim_gdata = (struct kim_data_s *)kim_data;
+        complete(&kim_gdata->ldisc_installed);
+}
+
+/**
+ * st_kim_start - called from ST Core upon 1st registration
+ *      This involves toggling the chip enable gpio, reading
+ *      the firmware version from chip, forming the fw file name
+ *      based on the chip version, requesting the fw, parsing it
+ *      and perform download(send/recv).
+ */
+long st_kim_start(void *kim_data)
+{
+        long err = 0;
+        long retry = POR_RETRY_COUNT;
+        struct kim_data_s       *kim_gdata = (struct kim_data_s *)kim_data;
+
+        pr_info(" %s", __func__);
+
+        do {
+                /* TODO: this is only because rfkill sub-system
+                 * doesn't send events to user-space if the state
+                 * isn't changed
+                 */
+                rfkill_set_hw_state(kim_gdata->rfkill[ST_BT], 1);
+                /* Configure BT nShutdown to HIGH state */
+                gpio_set_value(kim_gdata->gpios[ST_BT], GPIO_LOW);
+                mdelay(5);      /* FIXME: a proper toggle */
+                gpio_set_value(kim_gdata->gpios[ST_BT], GPIO_HIGH);
+                mdelay(100);
+                /* re-initialize the completion */
+                INIT_COMPLETION(kim_gdata->ldisc_installed);
+#if 0 /* older way of signalling user-space UIM */
+                /* send signal to UIM */
+                err = kill_pid(find_get_pid(kim_gdata->uim_pid), SIGUSR2, 0);
+                if (err != 0) {
+                        pr_info(" sending SIGUSR2 to uim failed %ld", err);
+                        err = -1;
+                        continue;
+                }
+#endif
+                /* unblock and send event to UIM via /dev/rfkill */
+                rfkill_set_hw_state(kim_gdata->rfkill[ST_BT], 0);
+                /* wait for ldisc to be installed */
+                err = wait_for_completion_timeout(&kim_gdata->ldisc_installed,
+                                msecs_to_jiffies(LDISC_TIME));
+                if (!err) {     /* timeout */
+                        pr_err("line disc installation timed out ");
+                        err = -1;
+                        continue;
+                } else {
+                        /* ldisc installed now */
+                        pr_info(" line discipline installed ");
+                        err = download_firmware(kim_gdata);
+                        if (err != 0) {
+                                pr_err("download firmware failed");
+                                continue;
+                        } else {        /* on success don't retry */
+                                break;
+                        }
+                }
+        } while (retry--);
+        return err;
+}
+
+/**
+ * st_kim_stop - called from ST Core, on the last un-registration
+ *      toggle low the chip enable gpio
+ */
+long st_kim_stop(void *kim_data)
+{
+        long err = 0;
+        struct kim_data_s       *kim_gdata = (struct kim_data_s *)kim_data;
+
+        INIT_COMPLETION(kim_gdata->ldisc_installed);
+#if 0 /* older way of signalling user-space UIM */
+        /* send signal to UIM */
+        err = kill_pid(find_get_pid(kim_gdata->uim_pid), SIGUSR2, 1);
+        if (err != 0) {
+                pr_err("sending SIGUSR2 to uim failed %ld", err);
+                return -1;
+        }
+#endif
+        /* set BT rfkill to be blocked */
+        err = rfkill_set_hw_state(kim_gdata->rfkill[ST_BT], 1);
+
+        /* wait for ldisc to be un-installed */
+        err = wait_for_completion_timeout(&kim_gdata->ldisc_installed,
+                        msecs_to_jiffies(LDISC_TIME));
+        if (!err) {             /* timeout */
+                pr_err(" timed out waiting for ldisc to be un-installed");
+                return -1;
+        }
+
+        /* By default configure BT nShutdown to LOW state */
+        gpio_set_value(kim_gdata->gpios[ST_BT], GPIO_LOW);
+        mdelay(1);
+        gpio_set_value(kim_gdata->gpios[ST_BT], GPIO_HIGH);
+        mdelay(1);
+        gpio_set_value(kim_gdata->gpios[ST_BT], GPIO_LOW);
+        return err;
+}
+
+/**********************************************************************/
+/* functions called from subsystems */
+/* called when debugfs entry is read from */
+
+static int show_version(struct seq_file *s, void *unused)
+{
+        struct kim_data_s *kim_gdata = (struct kim_data_s *)s->private;
+        seq_printf(s, "%04X %d.%d.%d\n", kim_gdata->version.full,
+                        kim_gdata->version.chip, kim_gdata->version.maj_ver,
+                        kim_gdata->version.min_ver);
+        return 0;
+}
+
+static int show_list(struct seq_file *s, void *unused)
+{
+        struct kim_data_s *kim_gdata = (struct kim_data_s *)s->private;
+        kim_st_list_protocols(kim_gdata->core_data, s);
+        return 0;
+}
+
+/* function called from rfkill subsystem, when someone from
+ * user space would write 0/1 on the sysfs entry
+ * /sys/class/rfkill/rfkill0,1,3/state
+ */
+static int kim_toggle_radio(void *data, bool blocked)
+{
+        enum proto_type type = *((enum proto_type *)data);
+        pr_debug(" %s: %d ", __func__, type);
+
+        switch (type) {
+        case ST_BT:
+                /* do nothing */
+        break;
+        case ST_FM:
+        case ST_GPS:
+                if (blocked)
+                        st_kim_chip_toggle(type, KIM_GPIO_INACTIVE);
+                else
+                        st_kim_chip_toggle(type, KIM_GPIO_ACTIVE);
+        break;
+        case ST_MAX:
+                pr_err(" wrong proto type ");
+        break;
+        }
+        return 0;
+}
+
+/**
+ * st_kim_ref - reference the core's data
+ *      This references the per-ST platform device in the arch/xx/
+ *      board-xx.c file.
+ *      This would enable multiple such platform devices to exist
+ *      on a given platform
+ */
+void st_kim_ref(struct st_data_s **core_data, int id)
+{
+        struct platform_device  *pdev;
+        struct kim_data_s       *kim_gdata;
+        /* get kim_gdata reference from platform device */
+        pdev = st_get_plat_device(id);
+        kim_gdata = dev_get_drvdata(&pdev->dev);
+        *core_data = kim_gdata->core_data;
+}
+
+static int kim_version_open(struct inode *i, struct file *f)
+{
+        return single_open(f, show_version, i->i_private);
+}
+
+static int kim_list_open(struct inode *i, struct file *f)
+{
+        return single_open(f, show_list, i->i_private);
+}
+
+static const struct file_operations version_debugfs_fops = {
+        /* version info */
+        .open = kim_version_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+};
+static const struct file_operations list_debugfs_fops = {
+        /* protocols info */
+        .open = kim_list_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+};
+
+/**********************************************************************/
+/* functions called from platform device driver subsystem
+ * need to have a relevant platform device entry in the platform's
+ * board-*.c file
+ */
+
+struct dentry *kim_debugfs_dir;
+static int kim_probe(struct platform_device *pdev)
+{
+        long status;
+        long proto;
+        long *gpios = pdev->dev.platform_data;
+        struct kim_data_s       *kim_gdata;
+
+        if ((pdev->id != -1) && (pdev->id < MAX_ST_DEVICES)) {
+                /* multiple devices could exist */
+                st_kim_devices[pdev->id] = pdev;
+        } else {
+                /* platform's sure about existance of 1 device */
+                st_kim_devices[0] = pdev;
+        }
+
+        kim_gdata = kzalloc(sizeof(struct kim_data_s), GFP_ATOMIC);
+        if (!kim_gdata) {
+                pr_err("no mem to allocate");
+                return -ENOMEM;
+        }
+        dev_set_drvdata(&pdev->dev, kim_gdata);
+
+        status = st_core_init(&kim_gdata->core_data);
+        if (status != 0) {
+                pr_err(" ST core init failed");
+                return -1;
+        }
+        /* refer to itself */
+        kim_gdata->core_data->kim_data = kim_gdata;
+
+        for (proto = 0; proto < ST_MAX; proto++) {
+                kim_gdata->gpios[proto] = gpios[proto];
+                pr_info(" %ld gpio to be requested", gpios[proto]);
+        }
+
+        for (proto = 0; (proto < ST_MAX) && (gpios[proto] != -1); proto++) {
+                /* Claim the Bluetooth/FM/GPIO
+                 * nShutdown gpio from the system
+                 */
+                status = gpio_request(gpios[proto], "kim");
+                if (unlikely(status)) {
+                        pr_err(" gpio %ld request failed ", gpios[proto]);
+                        proto -= 1;
+                        while (proto >= 0) {
+                                if (gpios[proto] != -1)
+                                        gpio_free(gpios[proto]);
+                        }
+                        return status;
+                }
+
+                /* Configure nShutdown GPIO as output=0 */
+                status =
+                    gpio_direction_output(gpios[proto], 0);
+                if (unlikely(status)) {
+                        pr_err(" unable to configure gpio %ld",
+                                   gpios[proto]);
+                        proto -= 1;
+                        while (proto >= 0) {
+                                if (gpios[proto] != -1)
+                                        gpio_free(gpios[proto]);
+                        }
+                        return status;
+                }
+        }
+        /* get reference of pdev for request_firmware
+         */
+        kim_gdata->kim_pdev = pdev;
+        init_completion(&kim_gdata->kim_rcvd);
+        init_completion(&kim_gdata->ldisc_installed);
+
+        for (proto = 0; (proto < ST_MAX) && (gpios[proto] != -1); proto++) {
+                /* TODO: should all types be rfkill_type_bt ? */
+                kim_gdata->rf_protos[proto] = proto;
+                kim_gdata->rfkill[proto] = rfkill_alloc(protocol_names[proto],
+                        &pdev->dev, RFKILL_TYPE_BLUETOOTH,
+                        &kim_rfkill_ops, &kim_gdata->rf_protos[proto]);
+                if (kim_gdata->rfkill[proto] == NULL) {
+                        pr_err("cannot create rfkill entry for gpio %ld",
+                                   gpios[proto]);
+                        continue;
+                }
+                /* block upon creation */
+                rfkill_init_sw_state(kim_gdata->rfkill[proto], 1);
+                status = rfkill_register(kim_gdata->rfkill[proto]);
+                if (unlikely(status)) {
+                        pr_err("rfkill registration failed for gpio %ld",
+                                   gpios[proto]);
+                        rfkill_unregister(kim_gdata->rfkill[proto]);
+                        continue;
+                }
+                pr_info("rfkill entry created for %ld", gpios[proto]);
+        }
+
+        kim_debugfs_dir = debugfs_create_dir("ti-st", NULL);
+        if (IS_ERR(kim_debugfs_dir)) {
+                pr_err(" debugfs entries creation failed ");
+                kim_debugfs_dir = NULL;
+                return -1;
+        }
+
+        debugfs_create_file("version", S_IRUGO, kim_debugfs_dir,
+                                kim_gdata, &version_debugfs_fops);
+        debugfs_create_file("protocols", S_IRUGO, kim_debugfs_dir,
+                                kim_gdata, &list_debugfs_fops);
+        pr_info(" debugfs entries created ");
+        return 0;
+}
+
+static int kim_remove(struct platform_device *pdev)
+{
+        /* free the GPIOs requested
+         */
+        long *gpios = pdev->dev.platform_data;
+        long proto;
+        struct kim_data_s       *kim_gdata;
+
+        kim_gdata = dev_get_drvdata(&pdev->dev);
+
+        for (proto = 0; (proto < ST_MAX) && (gpios[proto] != -1); proto++) {
+                /* Claim the Bluetooth/FM/GPIO
+                 * nShutdown gpio from the system
+                 */
+                gpio_free(gpios[proto]);
+                rfkill_unregister(kim_gdata->rfkill[proto]);
+                rfkill_destroy(kim_gdata->rfkill[proto]);
+                kim_gdata->rfkill[proto] = NULL;
+        }
+        pr_info("kim: GPIO Freed");
+        debugfs_remove_recursive(kim_debugfs_dir);
+        kim_gdata->kim_pdev = NULL;
+        st_core_exit(kim_gdata->core_data);
+
+        kfree(kim_gdata);
+        kim_gdata = NULL;
+        return 0;
+}
+
+/**********************************************************************/
+/* entry point for ST KIM module, called in from ST Core */
+
+static int __init st_kim_init(void)
+{
+        long ret = 0;
+        ret = platform_driver_register(&kim_platform_driver);
+        if (ret != 0) {
+                pr_err("platform drv registration failed");
+                return -1;
+        }
+        return 0;
+}
+
+static void __exit st_kim_deinit(void)
+{
+        /* the following returns void */
+        platform_driver_unregister(&kim_platform_driver);
+}
+
+
+module_init(st_kim_init);
+module_exit(st_kim_deinit);
+MODULE_AUTHOR("Pavan Savoy <pavan_savoy@ti.com>");
+MODULE_DESCRIPTION("Shared Transport Driver for TI BT/FM/GPS combo chips ");
+MODULE_LICENSE("GPL");
diff --git a/drivers/misc/ti-st/st_ll.c b/drivers/misc/ti-st/st_ll.c
new file mode 100644
index 000000000000..2bda8dea15b0
--- /dev/null
+++ b/drivers/misc/ti-st/st_ll.c
@@ -0,0 +1,150 @@
+/*
+ *  Shared Transport driver
+ *      HCI-LL module responsible for TI proprietary HCI_LL protocol
+ *  Copyright (C) 2009-2010 Texas Instruments
+ *  Author: Pavan Savoy <pavan_savoy@ti.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#define pr_fmt(fmt) "(stll) :" fmt
+#include <linux/skbuff.h>
+#include <linux/module.h>
+#include <linux/ti_wilink_st.h>
+
+/**********************************************************************/
+/* internal functions */
+static void send_ll_cmd(struct st_data_s *st_data,
+        unsigned char cmd)
+{
+
+        pr_info("%s: writing %x", __func__, cmd);
+        st_int_write(st_data, &cmd, 1);
+        return;
+}
+
+static void ll_device_want_to_sleep(struct st_data_s *st_data)
+{
+        pr_debug("%s", __func__);
+        /* sanity check */
+        if (st_data->ll_state != ST_LL_AWAKE)
+                pr_err("ERR hcill: ST_LL_GO_TO_SLEEP_IND"
+                          "in state %ld", st_data->ll_state);
+
+        send_ll_cmd(st_data, LL_SLEEP_ACK);
+        /* update state */
+        st_data->ll_state = ST_LL_ASLEEP;
+}
+
+static void ll_device_want_to_wakeup(struct st_data_s *st_data)
+{
+        /* diff actions in diff states */
+        switch (st_data->ll_state) {
+        case ST_LL_ASLEEP:
+                send_ll_cmd(st_data, LL_WAKE_UP_ACK);   /* send wake_ack */
+                break;
+        case ST_LL_ASLEEP_TO_AWAKE:
+                /* duplicate wake_ind */
+                pr_err("duplicate wake_ind while waiting for Wake ack");
+                break;
+        case ST_LL_AWAKE:
+                /* duplicate wake_ind */
+                pr_err("duplicate wake_ind already AWAKE");
+                break;
+        case ST_LL_AWAKE_TO_ASLEEP:
+                /* duplicate wake_ind */
+                pr_err("duplicate wake_ind");
+                break;
+        }
+        /* update state */
+        st_data->ll_state = ST_LL_AWAKE;
+}
+
+/**********************************************************************/
+/* functions invoked by ST Core */
+
+/* called when ST Core wants to
+ * enable ST LL */
+void st_ll_enable(struct st_data_s *ll)
+{
+        ll->ll_state = ST_LL_AWAKE;
+}
+
+/* called when ST Core /local module wants to
+ * disable ST LL */
+void st_ll_disable(struct st_data_s *ll)
+{
+        ll->ll_state = ST_LL_INVALID;
+}
+
+/* called when ST Core wants to update the state */
+void st_ll_wakeup(struct st_data_s *ll)
+{
+        if (likely(ll->ll_state != ST_LL_AWAKE)) {
+                send_ll_cmd(ll, LL_WAKE_UP_IND);        /* WAKE_IND */
+                ll->ll_state = ST_LL_ASLEEP_TO_AWAKE;
+        } else {
+                /* don't send the duplicate wake_indication */
+                pr_err(" Chip already AWAKE ");
+        }
+}
+
+/* called when ST Core wants the state */
+unsigned long st_ll_getstate(struct st_data_s *ll)
+{
+        pr_debug(" returning state %ld", ll->ll_state);
+        return ll->ll_state;
+}
+
+/* called from ST Core, when a PM related packet arrives */
+unsigned long st_ll_sleep_state(struct st_data_s *st_data,
+        unsigned char cmd)
+{
+        switch (cmd) {
+        case LL_SLEEP_IND:      /* sleep ind */
+                pr_info("sleep indication recvd");
+                ll_device_want_to_sleep(st_data);
+                break;
+        case LL_SLEEP_ACK:      /* sleep ack */
+                pr_err("sleep ack rcvd: host shouldn't");
+                break;
+        case LL_WAKE_UP_IND:    /* wake ind */
+                pr_info("wake indication recvd");
+                ll_device_want_to_wakeup(st_data);
+                break;
+        case LL_WAKE_UP_ACK:    /* wake ack */
+                pr_info("wake ack rcvd");
+                st_data->ll_state = ST_LL_AWAKE;
+                break;
+        default:
+                pr_err(" unknown input/state ");
+                return -1;
+        }
+        return 0;
+}
+
+/* Called from ST CORE to initialize ST LL */
+long st_ll_init(struct st_data_s *ll)
+{
+        /* set state to invalid */
+        ll->ll_state = ST_LL_INVALID;
+        return 0;
+}
+
+/* Called from ST CORE to de-initialize ST LL */
+long st_ll_deinit(struct st_data_s *ll)
+{
+        return 0;
+}
diff --git a/drivers/misc/ti_dac7512.c b/drivers/misc/ti_dac7512.c
new file mode 100644
index 000000000000..d3f229a3a77e
--- /dev/null
+++ b/drivers/misc/ti_dac7512.c
@@ -0,0 +1,101 @@
+/*
+ *  dac7512.c - Linux kernel module for
+ *      Texas Instruments DAC7512
+ *
+ *  Copyright (c) 2009 Daniel Mack <daniel@caiaq.de>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/spi/spi.h>
+
+#define DAC7512_DRV_NAME        "dac7512"
+#define DRIVER_VERSION          "1.0"
+
+static ssize_t dac7512_store_val(struct device *dev,
+                                 struct device_attribute *attr,
+                                 const char *buf, size_t count)
+{
+        struct spi_device *spi = to_spi_device(dev);
+        unsigned char tmp[2];
+        unsigned long val;
+
+        if (strict_strtoul(buf, 10, &val) < 0)
+                return -EINVAL;
+
+        tmp[0] = val >> 8;
+        tmp[1] = val & 0xff;
+        spi_write(spi, tmp, sizeof(tmp));
+        return count;
+}
+
+static DEVICE_ATTR(value, S_IWUSR, NULL, dac7512_store_val);
+
+static struct attribute *dac7512_attributes[] = {
+        &dev_attr_value.attr,
+        NULL
+};
+
+static const struct attribute_group dac7512_attr_group = {
+        .attrs = dac7512_attributes,
+};
+
+static int __devinit dac7512_probe(struct spi_device *spi)
+{
+        int ret;
+
+        spi->bits_per_word = 8;
+        spi->mode = SPI_MODE_0;
+        ret = spi_setup(spi);
+        if (ret < 0)
+                return ret;
+
+        return sysfs_create_group(&spi->dev.kobj, &dac7512_attr_group);
+}
+
+static int __devexit dac7512_remove(struct spi_device *spi)
+{
+        sysfs_remove_group(&spi->dev.kobj, &dac7512_attr_group);
+        return 0;
+}
+
+static struct spi_driver dac7512_driver = {
+        .driver = {
+                .name   = DAC7512_DRV_NAME,
+                .owner  = THIS_MODULE,
+        },
+        .probe  = dac7512_probe,
+        .remove = __devexit_p(dac7512_remove),
+};
+
+static int __init dac7512_init(void)
+{
+        return spi_register_driver(&dac7512_driver);
+}
+
+static void __exit dac7512_exit(void)
+{
+        spi_unregister_driver(&dac7512_driver);
+}
+
+MODULE_AUTHOR("Daniel Mack <daniel@caiaq.de>");
+MODULE_DESCRIPTION("DAC7512 16-bit DAC");
+MODULE_LICENSE("GPL v2");
+MODULE_VERSION(DRIVER_VERSION);
+
+module_init(dac7512_init);
+module_exit(dac7512_exit);
diff --git a/drivers/misc/tifm_core.c b/drivers/misc/tifm_core.c
index 98bcba521da2..5f6852dff40b 100644
--- a/drivers/misc/tifm_core.c
+++ b/drivers/misc/tifm_core.c
@@ -10,6 +10,7 @@
  */
 
 #include <linux/tifm.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/idr.h>
 
diff --git a/drivers/misc/tsl2550.c b/drivers/misc/tsl2550.c
new file mode 100644
index 000000000000..483ae5f7f68e
--- /dev/null
+++ b/drivers/misc/tsl2550.c
@@ -0,0 +1,473 @@
+/*
+ *  tsl2550.c - Linux kernel modules for ambient light sensor
+ *
+ *  Copyright (C) 2007 Rodolfo Giometti <giometti@linux.it>
+ *  Copyright (C) 2007 Eurotech S.p.A. <info@eurotech.it>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/mutex.h>
+
+#define TSL2550_DRV_NAME        "tsl2550"
+#define DRIVER_VERSION          "1.2"
+
+/*
+ * Defines
+ */
+
+#define TSL2550_POWER_DOWN              0x00
+#define TSL2550_POWER_UP                0x03
+#define TSL2550_STANDARD_RANGE          0x18
+#define TSL2550_EXTENDED_RANGE          0x1d
+#define TSL2550_READ_ADC0               0x43
+#define TSL2550_READ_ADC1               0x83
+
+/*
+ * Structs
+ */
+
+struct tsl2550_data {
+        struct i2c_client *client;
+        struct mutex update_lock;
+
+        unsigned int power_state:1;
+        unsigned int operating_mode:1;
+};
+
+/*
+ * Global data
+ */
+
+static const u8 TSL2550_MODE_RANGE[2] = {
+        TSL2550_STANDARD_RANGE, TSL2550_EXTENDED_RANGE,
+};
+
+/*
+ * Management functions
+ */
+
+static int tsl2550_set_operating_mode(struct i2c_client *client, int mode)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+
+        int ret = i2c_smbus_write_byte(client, TSL2550_MODE_RANGE[mode]);
+
+        data->operating_mode = mode;
+
+        return ret;
+}
+
+static int tsl2550_set_power_state(struct i2c_client *client, int state)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        int ret;
+
+        if (state == 0)
+                ret = i2c_smbus_write_byte(client, TSL2550_POWER_DOWN);
+        else {
+                ret = i2c_smbus_write_byte(client, TSL2550_POWER_UP);
+
+                /* On power up we should reset operating mode also... */
+                tsl2550_set_operating_mode(client, data->operating_mode);
+        }
+
+        data->power_state = state;
+
+        return ret;
+}
+
+static int tsl2550_get_adc_value(struct i2c_client *client, u8 cmd)
+{
+        int ret;
+
+        ret = i2c_smbus_read_byte_data(client, cmd);
+        if (ret < 0)
+                return ret;
+        if (!(ret & 0x80))
+                return -EAGAIN;
+        return ret & 0x7f;      /* remove the "valid" bit */
+}
+
+/*
+ * LUX calculation
+ */
+
+#define TSL2550_MAX_LUX         1846
+
+static const u8 ratio_lut[] = {
+        100, 100, 100, 100, 100, 100, 100, 100,
+        100, 100, 100, 100, 100, 100, 99, 99,
+        99, 99, 99, 99, 99, 99, 99, 99,
+        99, 99, 99, 98, 98, 98, 98, 98,
+        98, 98, 97, 97, 97, 97, 97, 96,
+        96, 96, 96, 95, 95, 95, 94, 94,
+        93, 93, 93, 92, 92, 91, 91, 90,
+        89, 89, 88, 87, 87, 86, 85, 84,
+        83, 82, 81, 80, 79, 78, 77, 75,
+        74, 73, 71, 69, 68, 66, 64, 62,
+        60, 58, 56, 54, 52, 49, 47, 44,
+        42, 41, 40, 40, 39, 39, 38, 38,
+        37, 37, 37, 36, 36, 36, 35, 35,
+        35, 35, 34, 34, 34, 34, 33, 33,
+        33, 33, 32, 32, 32, 32, 32, 31,
+        31, 31, 31, 31, 30, 30, 30, 30,
+        30,
+};
+
+static const u16 count_lut[] = {
+        0, 1, 2, 3, 4, 5, 6, 7,
+        8, 9, 10, 11, 12, 13, 14, 15,
+        16, 18, 20, 22, 24, 26, 28, 30,
+        32, 34, 36, 38, 40, 42, 44, 46,
+        49, 53, 57, 61, 65, 69, 73, 77,
+        81, 85, 89, 93, 97, 101, 105, 109,
+        115, 123, 131, 139, 147, 155, 163, 171,
+        179, 187, 195, 203, 211, 219, 227, 235,
+        247, 263, 279, 295, 311, 327, 343, 359,
+        375, 391, 407, 423, 439, 455, 471, 487,
+        511, 543, 575, 607, 639, 671, 703, 735,
+        767, 799, 831, 863, 895, 927, 959, 991,
+        1039, 1103, 1167, 1231, 1295, 1359, 1423, 1487,
+        1551, 1615, 1679, 1743, 1807, 1871, 1935, 1999,
+        2095, 2223, 2351, 2479, 2607, 2735, 2863, 2991,
+        3119, 3247, 3375, 3503, 3631, 3759, 3887, 4015,
+};
+
+/*
+ * This function is described into Taos TSL2550 Designer's Notebook
+ * pages 2, 3.
+ */
+static int tsl2550_calculate_lux(u8 ch0, u8 ch1)
+{
+        unsigned int lux;
+
+        /* Look up count from channel values */
+        u16 c0 = count_lut[ch0];
+        u16 c1 = count_lut[ch1];
+
+        /*
+         * Calculate ratio.
+         * Note: the "128" is a scaling factor
+         */
+        u8 r = 128;
+
+        /* Avoid division by 0 and count 1 cannot be greater than count 0 */
+        if (c1 <= c0)
+                if (c0) {
+                        r = c1 * 128 / c0;
+
+                        /* Calculate LUX */
+                        lux = ((c0 - c1) * ratio_lut[r]) / 256;
+                } else
+                        lux = 0;
+        else
+                return -EAGAIN;
+
+        /* LUX range check */
+        return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux;
+}
+
+/*
+ * SysFS support
+ */
+
+static ssize_t tsl2550_show_power_state(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(to_i2c_client(dev));
+
+        return sprintf(buf, "%u\n", data->power_state);
+}
+
+static ssize_t tsl2550_store_power_state(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        unsigned long val = simple_strtoul(buf, NULL, 10);
+        int ret;
+
+        if (val < 0 || val > 1)
+                return -EINVAL;
+
+        mutex_lock(&data->update_lock);
+        ret = tsl2550_set_power_state(client, val);
+        mutex_unlock(&data->update_lock);
+
+        if (ret < 0)
+                return ret;
+
+        return count;
+}
+
+static DEVICE_ATTR(power_state, S_IWUSR | S_IRUGO,
+                   tsl2550_show_power_state, tsl2550_store_power_state);
+
+static ssize_t tsl2550_show_operating_mode(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(to_i2c_client(dev));
+
+        return sprintf(buf, "%u\n", data->operating_mode);
+}
+
+static ssize_t tsl2550_store_operating_mode(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        unsigned long val = simple_strtoul(buf, NULL, 10);
+        int ret;
+
+        if (val < 0 || val > 1)
+                return -EINVAL;
+
+        if (data->power_state == 0)
+                return -EBUSY;
+
+        mutex_lock(&data->update_lock);
+        ret = tsl2550_set_operating_mode(client, val);
+        mutex_unlock(&data->update_lock);
+
+        if (ret < 0)
+                return ret;
+
+        return count;
+}
+
+static DEVICE_ATTR(operating_mode, S_IWUSR | S_IRUGO,
+                   tsl2550_show_operating_mode, tsl2550_store_operating_mode);
+
+static ssize_t __tsl2550_show_lux(struct i2c_client *client, char *buf)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        u8 ch0, ch1;
+        int ret;
+
+        ret = tsl2550_get_adc_value(client, TSL2550_READ_ADC0);
+        if (ret < 0)
+                return ret;
+        ch0 = ret;
+
+        ret = tsl2550_get_adc_value(client, TSL2550_READ_ADC1);
+        if (ret < 0)
+                return ret;
+        ch1 = ret;
+
+        /* Do the job */
+        ret = tsl2550_calculate_lux(ch0, ch1);
+        if (ret < 0)
+                return ret;
+        if (data->operating_mode == 1)
+                ret *= 5;
+
+        return sprintf(buf, "%d\n", ret);
+}
+
+static ssize_t tsl2550_show_lux1_input(struct device *dev,
+                        struct device_attribute *attr, char *buf)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        int ret;
+
+        /* No LUX data if not operational */
+        if (!data->power_state)
+                return -EBUSY;
+
+        mutex_lock(&data->update_lock);
+        ret = __tsl2550_show_lux(client, buf);
+        mutex_unlock(&data->update_lock);
+
+        return ret;
+}
+
+static DEVICE_ATTR(lux1_input, S_IRUGO,
+                   tsl2550_show_lux1_input, NULL);
+
+static struct attribute *tsl2550_attributes[] = {
+        &dev_attr_power_state.attr,
+        &dev_attr_operating_mode.attr,
+        &dev_attr_lux1_input.attr,
+        NULL
+};
+
+static const struct attribute_group tsl2550_attr_group = {
+        .attrs = tsl2550_attributes,
+};
+
+/*
+ * Initialization function
+ */
+
+static int tsl2550_init_client(struct i2c_client *client)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        int err;
+
+        /*
+         * Probe the chip. To do so we try to power up the device and then to
+         * read back the 0x03 code
+         */
+        err = i2c_smbus_read_byte_data(client, TSL2550_POWER_UP);
+        if (err < 0)
+                return err;
+        if (err != TSL2550_POWER_UP)
+                return -ENODEV;
+        data->power_state = 1;
+
+        /* Set the default operating mode */
+        err = i2c_smbus_write_byte(client,
+                                   TSL2550_MODE_RANGE[data->operating_mode]);
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
+/*
+ * I2C init/probing/exit functions
+ */
+
+static struct i2c_driver tsl2550_driver;
+static int __devinit tsl2550_probe(struct i2c_client *client,
+                                   const struct i2c_device_id *id)
+{
+        struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
+        struct tsl2550_data *data;
+        int *opmode, err = 0;
+
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_WRITE_BYTE
+                                            | I2C_FUNC_SMBUS_READ_BYTE_DATA)) {
+                err = -EIO;
+                goto exit;
+        }
+
+        data = kzalloc(sizeof(struct tsl2550_data), GFP_KERNEL);
+        if (!data) {
+                err = -ENOMEM;
+                goto exit;
+        }
+        data->client = client;
+        i2c_set_clientdata(client, data);
+
+        /* Check platform data */
+        opmode = client->dev.platform_data;
+        if (opmode) {
+                if (*opmode < 0 || *opmode > 1) {
+                        dev_err(&client->dev, "invalid operating_mode (%d)\n",
+                                        *opmode);
+                        err = -EINVAL;
+                        goto exit_kfree;
+                }
+                data->operating_mode = *opmode;
+        } else
+                data->operating_mode = 0;       /* default mode is standard */
+        dev_info(&client->dev, "%s operating mode\n",
+                        data->operating_mode ? "extended" : "standard");
+
+        mutex_init(&data->update_lock);
+
+        /* Initialize the TSL2550 chip */
+        err = tsl2550_init_client(client);
+        if (err)
+                goto exit_kfree;
+
+        /* Register sysfs hooks */
+        err = sysfs_create_group(&client->dev.kobj, &tsl2550_attr_group);
+        if (err)
+                goto exit_kfree;
+
+        dev_info(&client->dev, "support ver. %s enabled\n", DRIVER_VERSION);
+
+        return 0;
+
+exit_kfree:
+        kfree(data);
+exit:
+        return err;
+}
+
+static int __devexit tsl2550_remove(struct i2c_client *client)
+{
+        sysfs_remove_group(&client->dev.kobj, &tsl2550_attr_group);
+
+        /* Power down the device */
+        tsl2550_set_power_state(client, 0);
+
+        kfree(i2c_get_clientdata(client));
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+
+static int tsl2550_suspend(struct i2c_client *client, pm_message_t mesg)
+{
+        return tsl2550_set_power_state(client, 0);
+}
+
+static int tsl2550_resume(struct i2c_client *client)
+{
+        return tsl2550_set_power_state(client, 1);
+}
+
+#else
+
+#define tsl2550_suspend         NULL
+#define tsl2550_resume          NULL
+
+#endif /* CONFIG_PM */
+
+static const struct i2c_device_id tsl2550_id[] = {
+        { "tsl2550", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, tsl2550_id);
+
+static struct i2c_driver tsl2550_driver = {
+        .driver = {
+                .name   = TSL2550_DRV_NAME,
+                .owner  = THIS_MODULE,
+        },
+        .suspend = tsl2550_suspend,
+        .resume = tsl2550_resume,
+        .probe  = tsl2550_probe,
+        .remove = __devexit_p(tsl2550_remove),
+        .id_table = tsl2550_id,
+};
+
+static int __init tsl2550_init(void)
+{
+        return i2c_add_driver(&tsl2550_driver);
+}
+
+static void __exit tsl2550_exit(void)
+{
+        i2c_del_driver(&tsl2550_driver);
+}
+
+MODULE_AUTHOR("Rodolfo Giometti <giometti@linux.it>");
+MODULE_DESCRIPTION("TSL2550 ambient light sensor driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRIVER_VERSION);
+
+module_init(tsl2550_init);
+module_exit(tsl2550_exit);
diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c
new file mode 100644
index 000000000000..2a1e804a71aa
--- /dev/null
+++ b/drivers/misc/vmw_balloon.c
@@ -0,0 +1,844 @@
+/*
+ * VMware Balloon driver.
+ *
+ * Copyright (C) 2000-2010, VMware, Inc. All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ * NON INFRINGEMENT.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Maintained by: Dmitry Torokhov <dtor@vmware.com>
+ */
+
+/*
+ * This is VMware physical memory management driver for Linux. The driver
+ * acts like a "balloon" that can be inflated to reclaim physical pages by
+ * reserving them in the guest and invalidating them in the monitor,
+ * freeing up the underlying machine pages so they can be allocated to
+ * other guests.  The balloon can also be deflated to allow the guest to
+ * use more physical memory. Higher level policies can control the sizes
+ * of balloons in VMs in order to manage physical memory resources.
+ */
+
+//#define DEBUG
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/sched.h>
+#include <linux/module.h>
+#include <linux/workqueue.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include <asm/hypervisor.h>
+
+MODULE_AUTHOR("VMware, Inc.");
+MODULE_DESCRIPTION("VMware Memory Control (Balloon) Driver");
+MODULE_VERSION("1.2.1.1-k");
+MODULE_ALIAS("dmi:*:svnVMware*:*");
+MODULE_ALIAS("vmware_vmmemctl");
+MODULE_LICENSE("GPL");
+
+/*
+ * Various constants controlling rate of inflaint/deflating balloon,
+ * measured in pages.
+ */
+
+/*
+ * Rate of allocating memory when there is no memory pressure
+ * (driver performs non-sleeping allocations).
+ */
+#define VMW_BALLOON_NOSLEEP_ALLOC_MAX   16384U
+
+/*
+ * Rates of memory allocaton when guest experiences memory pressure
+ * (driver performs sleeping allocations).
+ */
+#define VMW_BALLOON_RATE_ALLOC_MIN      512U
+#define VMW_BALLOON_RATE_ALLOC_MAX      2048U
+#define VMW_BALLOON_RATE_ALLOC_INC      16U
+
+/*
+ * Rates for releasing pages while deflating balloon.
+ */
+#define VMW_BALLOON_RATE_FREE_MIN       512U
+#define VMW_BALLOON_RATE_FREE_MAX       16384U
+#define VMW_BALLOON_RATE_FREE_INC       16U
+
+/*
+ * When guest is under memory pressure, use a reduced page allocation
+ * rate for next several cycles.
+ */
+#define VMW_BALLOON_SLOW_CYCLES         4
+
+/*
+ * Use __GFP_HIGHMEM to allow pages from HIGHMEM zone. We don't
+ * allow wait (__GFP_WAIT) for NOSLEEP page allocations. Use
+ * __GFP_NOWARN, to suppress page allocation failure warnings.
+ */
+#define VMW_PAGE_ALLOC_NOSLEEP          (__GFP_HIGHMEM|__GFP_NOWARN)
+
+/*
+ * Use GFP_HIGHUSER when executing in a separate kernel thread
+ * context and allocation can sleep.  This is less stressful to
+ * the guest memory system, since it allows the thread to block
+ * while memory is reclaimed, and won't take pages from emergency
+ * low-memory pools.
+ */
+#define VMW_PAGE_ALLOC_CANSLEEP         (GFP_HIGHUSER)
+
+/* Maximum number of page allocations without yielding processor */
+#define VMW_BALLOON_YIELD_THRESHOLD     1024
+
+/* Maximum number of refused pages we accumulate during inflation cycle */
+#define VMW_BALLOON_MAX_REFUSED         16
+
+/*
+ * Hypervisor communication port definitions.
+ */
+#define VMW_BALLOON_HV_PORT             0x5670
+#define VMW_BALLOON_HV_MAGIC            0x456c6d6f
+#define VMW_BALLOON_PROTOCOL_VERSION    2
+#define VMW_BALLOON_GUEST_ID            1       /* Linux */
+
+#define VMW_BALLOON_CMD_START           0
+#define VMW_BALLOON_CMD_GET_TARGET      1
+#define VMW_BALLOON_CMD_LOCK            2
+#define VMW_BALLOON_CMD_UNLOCK          3
+#define VMW_BALLOON_CMD_GUEST_ID        4
+
+/* error codes */
+#define VMW_BALLOON_SUCCESS             0
+#define VMW_BALLOON_FAILURE             -1
+#define VMW_BALLOON_ERROR_CMD_INVALID   1
+#define VMW_BALLOON_ERROR_PPN_INVALID   2
+#define VMW_BALLOON_ERROR_PPN_LOCKED    3
+#define VMW_BALLOON_ERROR_PPN_UNLOCKED  4
+#define VMW_BALLOON_ERROR_PPN_PINNED    5
+#define VMW_BALLOON_ERROR_PPN_NOTNEEDED 6
+#define VMW_BALLOON_ERROR_RESET         7
+#define VMW_BALLOON_ERROR_BUSY          8
+
+#define VMWARE_BALLOON_CMD(cmd, data, result)           \
+({                                                      \
+        unsigned long __stat, __dummy1, __dummy2;       \
+        __asm__ __volatile__ ("inl (%%dx)" :            \
+                "=a"(__stat),                           \
+                "=c"(__dummy1),                         \
+                "=d"(__dummy2),                         \
+                "=b"(result) :                          \
+                "0"(VMW_BALLOON_HV_MAGIC),              \
+                "1"(VMW_BALLOON_CMD_##cmd),             \
+                "2"(VMW_BALLOON_HV_PORT),               \
+                "3"(data) :                             \
+                "memory");                              \
+        result &= -1UL;                                 \
+        __stat & -1UL;                                  \
+})
+
+#ifdef CONFIG_DEBUG_FS
+struct vmballoon_stats {
+        unsigned int timer;
+
+        /* allocation statustics */
+        unsigned int alloc;
+        unsigned int alloc_fail;
+        unsigned int sleep_alloc;
+        unsigned int sleep_alloc_fail;
+        unsigned int refused_alloc;
+        unsigned int refused_free;
+        unsigned int free;
+
+        /* monitor operations */
+        unsigned int lock;
+        unsigned int lock_fail;
+        unsigned int unlock;
+        unsigned int unlock_fail;
+        unsigned int target;
+        unsigned int target_fail;
+        unsigned int start;
+        unsigned int start_fail;
+        unsigned int guest_type;
+        unsigned int guest_type_fail;
+};
+
+#define STATS_INC(stat) (stat)++
+#else
+#define STATS_INC(stat)
+#endif
+
+struct vmballoon {
+
+        /* list of reserved physical pages */
+        struct list_head pages;
+
+        /* transient list of non-balloonable pages */
+        struct list_head refused_pages;
+        unsigned int n_refused_pages;
+
+        /* balloon size in pages */
+        unsigned int size;
+        unsigned int target;
+
+        /* reset flag */
+        bool reset_required;
+
+        /* adjustment rates (pages per second) */
+        unsigned int rate_alloc;
+        unsigned int rate_free;
+
+        /* slowdown page allocations for next few cycles */
+        unsigned int slow_allocation_cycles;
+
+#ifdef CONFIG_DEBUG_FS
+        /* statistics */
+        struct vmballoon_stats stats;
+
+        /* debugfs file exporting statistics */
+        struct dentry *dbg_entry;
+#endif
+
+        struct sysinfo sysinfo;
+
+        struct delayed_work dwork;
+};
+
+static struct vmballoon balloon;
+static struct workqueue_struct *vmballoon_wq;
+
+/*
+ * Send "start" command to the host, communicating supported version
+ * of the protocol.
+ */
+static bool vmballoon_send_start(struct vmballoon *b)
+{
+        unsigned long status, dummy;
+
+        STATS_INC(b->stats.start);
+
+        status = VMWARE_BALLOON_CMD(START, VMW_BALLOON_PROTOCOL_VERSION, dummy);
+        if (status == VMW_BALLOON_SUCCESS)
+                return true;
+
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.start_fail);
+        return false;
+}
+
+static bool vmballoon_check_status(struct vmballoon *b, unsigned long status)
+{
+        switch (status) {
+        case VMW_BALLOON_SUCCESS:
+                return true;
+
+        case VMW_BALLOON_ERROR_RESET:
+                b->reset_required = true;
+                /* fall through */
+
+        default:
+                return false;
+        }
+}
+
+/*
+ * Communicate guest type to the host so that it can adjust ballooning
+ * algorithm to the one most appropriate for the guest. This command
+ * is normally issued after sending "start" command and is part of
+ * standard reset sequence.
+ */
+static bool vmballoon_send_guest_id(struct vmballoon *b)
+{
+        unsigned long status, dummy;
+
+        status = VMWARE_BALLOON_CMD(GUEST_ID, VMW_BALLOON_GUEST_ID, dummy);
+
+        STATS_INC(b->stats.guest_type);
+
+        if (vmballoon_check_status(b, status))
+                return true;
+
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.guest_type_fail);
+        return false;
+}
+
+/*
+ * Retrieve desired balloon size from the host.
+ */
+static bool vmballoon_send_get_target(struct vmballoon *b, u32 *new_target)
+{
+        unsigned long status;
+        unsigned long target;
+        unsigned long limit;
+        u32 limit32;
+
+        /*
+         * si_meminfo() is cheap. Moreover, we want to provide dynamic
+         * max balloon size later. So let us call si_meminfo() every
+         * iteration.
+         */
+        si_meminfo(&b->sysinfo);
+        limit = b->sysinfo.totalram;
+
+        /* Ensure limit fits in 32-bits */
+        limit32 = (u32)limit;
+        if (limit != limit32)
+                return false;
+
+        /* update stats */
+        STATS_INC(b->stats.target);
+
+        status = VMWARE_BALLOON_CMD(GET_TARGET, limit, target);
+        if (vmballoon_check_status(b, status)) {
+                *new_target = target;
+                return true;
+        }
+
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.target_fail);
+        return false;
+}
+
+/*
+ * Notify the host about allocated page so that host can use it without
+ * fear that guest will need it. Host may reject some pages, we need to
+ * check the return value and maybe submit a different page.
+ */
+static bool vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn)
+{
+        unsigned long status, dummy;
+        u32 pfn32;
+
+        pfn32 = (u32)pfn;
+        if (pfn32 != pfn)
+                return false;
+
+        STATS_INC(b->stats.lock);
+
+        status = VMWARE_BALLOON_CMD(LOCK, pfn, dummy);
+        if (vmballoon_check_status(b, status))
+                return true;
+
+        pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
+        STATS_INC(b->stats.lock_fail);
+        return false;
+}
+
+/*
+ * Notify the host that guest intends to release given page back into
+ * the pool of available (to the guest) pages.
+ */
+static bool vmballoon_send_unlock_page(struct vmballoon *b, unsigned long pfn)
+{
+        unsigned long status, dummy;
+        u32 pfn32;
+
+        pfn32 = (u32)pfn;
+        if (pfn32 != pfn)
+                return false;
+
+        STATS_INC(b->stats.unlock);
+
+        status = VMWARE_BALLOON_CMD(UNLOCK, pfn, dummy);
+        if (vmballoon_check_status(b, status))
+                return true;
+
+        pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
+        STATS_INC(b->stats.unlock_fail);
+        return false;
+}
+
+/*
+ * Quickly release all pages allocated for the balloon. This function is
+ * called when host decides to "reset" balloon for one reason or another.
+ * Unlike normal "deflate" we do not (shall not) notify host of the pages
+ * being released.
+ */
+static void vmballoon_pop(struct vmballoon *b)
+{
+        struct page *page, *next;
+        unsigned int count = 0;
+
+        list_for_each_entry_safe(page, next, &b->pages, lru) {
+                list_del(&page->lru);
+                __free_page(page);
+                STATS_INC(b->stats.free);
+                b->size--;
+
+                if (++count >= b->rate_free) {
+                        count = 0;
+                        cond_resched();
+                }
+        }
+}
+
+/*
+ * Perform standard reset sequence by popping the balloon (in case it
+ * is not  empty) and then restarting protocol. This operation normally
+ * happens when host responds with VMW_BALLOON_ERROR_RESET to a command.
+ */
+static void vmballoon_reset(struct vmballoon *b)
+{
+        /* free all pages, skipping monitor unlock */
+        vmballoon_pop(b);
+
+        if (vmballoon_send_start(b)) {
+                b->reset_required = false;
+                if (!vmballoon_send_guest_id(b))
+                        pr_err("failed to send guest ID to the host\n");
+        }
+}
+
+/*
+ * Allocate (or reserve) a page for the balloon and notify the host.  If host
+ * refuses the page put it on "refuse" list and allocate another one until host
+ * is satisfied. "Refused" pages are released at the end of inflation cycle
+ * (when we allocate b->rate_alloc pages).
+ */
+static int vmballoon_reserve_page(struct vmballoon *b, bool can_sleep)
+{
+        struct page *page;
+        gfp_t flags;
+        bool locked = false;
+
+        do {
+                if (!can_sleep)
+                        STATS_INC(b->stats.alloc);
+                else
+                        STATS_INC(b->stats.sleep_alloc);
+
+                flags = can_sleep ? VMW_PAGE_ALLOC_CANSLEEP : VMW_PAGE_ALLOC_NOSLEEP;
+                page = alloc_page(flags);
+                if (!page) {
+                        if (!can_sleep)
+                                STATS_INC(b->stats.alloc_fail);
+                        else
+                                STATS_INC(b->stats.sleep_alloc_fail);
+                        return -ENOMEM;
+                }
+
+                /* inform monitor */
+                locked = vmballoon_send_lock_page(b, page_to_pfn(page));
+                if (!locked) {
+                        STATS_INC(b->stats.refused_alloc);
+
+                        if (b->reset_required) {
+                                __free_page(page);
+                                return -EIO;
+                        }
+
+                        /*
+                         * Place page on the list of non-balloonable pages
+                         * and retry allocation, unless we already accumulated
+                         * too many of them, in which case take a breather.
+                         */
+                        list_add(&page->lru, &b->refused_pages);
+                        if (++b->n_refused_pages >= VMW_BALLOON_MAX_REFUSED)
+                                return -EIO;
+                }
+        } while (!locked);
+
+        /* track allocated page */
+        list_add(&page->lru, &b->pages);
+
+        /* update balloon size */
+        b->size++;
+
+        return 0;
+}
+
+/*
+ * Release the page allocated for the balloon. Note that we first notify
+ * the host so it can make sure the page will be available for the guest
+ * to use, if needed.
+ */
+static int vmballoon_release_page(struct vmballoon *b, struct page *page)
+{
+        if (!vmballoon_send_unlock_page(b, page_to_pfn(page)))
+                return -EIO;
+
+        list_del(&page->lru);
+
+        /* deallocate page */
+        __free_page(page);
+        STATS_INC(b->stats.free);
+
+        /* update balloon size */
+        b->size--;
+
+        return 0;
+}
+
+/*
+ * Release pages that were allocated while attempting to inflate the
+ * balloon but were refused by the host for one reason or another.
+ */
+static void vmballoon_release_refused_pages(struct vmballoon *b)
+{
+        struct page *page, *next;
+
+        list_for_each_entry_safe(page, next, &b->refused_pages, lru) {
+                list_del(&page->lru);
+                __free_page(page);
+                STATS_INC(b->stats.refused_free);
+        }
+
+        b->n_refused_pages = 0;
+}
+
+/*
+ * Inflate the balloon towards its target size. Note that we try to limit
+ * the rate of allocation to make sure we are not choking the rest of the
+ * system.
+ */
+static void vmballoon_inflate(struct vmballoon *b)
+{
+        unsigned int goal;
+        unsigned int rate;
+        unsigned int i;
+        unsigned int allocations = 0;
+        int error = 0;
+        bool alloc_can_sleep = false;
+
+        pr_debug("%s - size: %d, target %d\n", __func__, b->size, b->target);
+
+        /*
+         * First try NOSLEEP page allocations to inflate balloon.
+         *
+         * If we do not throttle nosleep allocations, we can drain all
+         * free pages in the guest quickly (if the balloon target is high).
+         * As a side-effect, draining free pages helps to inform (force)
+         * the guest to start swapping if balloon target is not met yet,
+         * which is a desired behavior. However, balloon driver can consume
+         * all available CPU cycles if too many pages are allocated in a
+         * second. Therefore, we throttle nosleep allocations even when
+         * the guest is not under memory pressure. OTOH, if we have already
+         * predicted that the guest is under memory pressure, then we
+         * slowdown page allocations considerably.
+         */
+
+        goal = b->target - b->size;
+        /*
+         * Start with no sleep allocation rate which may be higher
+         * than sleeping allocation rate.
+         */
+        rate = b->slow_allocation_cycles ?
+                        b->rate_alloc : VMW_BALLOON_NOSLEEP_ALLOC_MAX;
+
+        pr_debug("%s - goal: %d, no-sleep rate: %d, sleep rate: %d\n",
+                 __func__, goal, rate, b->rate_alloc);
+
+        for (i = 0; i < goal; i++) {
+
+                error = vmballoon_reserve_page(b, alloc_can_sleep);
+                if (error) {
+                        if (error != -ENOMEM) {
+                                /*
+                                 * Not a page allocation failure, stop this
+                                 * cycle. Maybe we'll get new target from
+                                 * the host soon.
+                                 */
+                                break;
+                        }
+
+                        if (alloc_can_sleep) {
+                                /*
+                                 * CANSLEEP page allocation failed, so guest
+                                 * is under severe memory pressure. Quickly
+                                 * decrease allocation rate.
+                                 */
+                                b->rate_alloc = max(b->rate_alloc / 2,
+                                                    VMW_BALLOON_RATE_ALLOC_MIN);
+                                break;
+                        }
+
+                        /*
+                         * NOSLEEP page allocation failed, so the guest is
+                         * under memory pressure. Let us slow down page
+                         * allocations for next few cycles so that the guest
+                         * gets out of memory pressure. Also, if we already
+                         * allocated b->rate_alloc pages, let's pause,
+                         * otherwise switch to sleeping allocations.
+                         */
+                        b->slow_allocation_cycles = VMW_BALLOON_SLOW_CYCLES;
+
+                        if (i >= b->rate_alloc)
+                                break;
+
+                        alloc_can_sleep = true;
+                        /* Lower rate for sleeping allocations. */
+                        rate = b->rate_alloc;
+                }
+
+                if (++allocations > VMW_BALLOON_YIELD_THRESHOLD) {
+                        cond_resched();
+                        allocations = 0;
+                }
+
+                if (i >= rate) {
+                        /* We allocated enough pages, let's take a break. */
+                        break;
+                }
+        }
+
+        /*
+         * We reached our goal without failures so try increasing
+         * allocation rate.
+         */
+        if (error == 0 && i >= b->rate_alloc) {
+                unsigned int mult = i / b->rate_alloc;
+
+                b->rate_alloc =
+                        min(b->rate_alloc + mult * VMW_BALLOON_RATE_ALLOC_INC,
+                            VMW_BALLOON_RATE_ALLOC_MAX);
+        }
+
+        vmballoon_release_refused_pages(b);
+}
+
+/*
+ * Decrease the size of the balloon allowing guest to use more memory.
+ */
+static void vmballoon_deflate(struct vmballoon *b)
+{
+        struct page *page, *next;
+        unsigned int i = 0;
+        unsigned int goal;
+        int error;
+
+        pr_debug("%s - size: %d, target %d\n", __func__, b->size, b->target);
+
+        /* limit deallocation rate */
+        goal = min(b->size - b->target, b->rate_free);
+
+        pr_debug("%s - goal: %d, rate: %d\n", __func__, goal, b->rate_free);
+
+        /* free pages to reach target */
+        list_for_each_entry_safe(page, next, &b->pages, lru) {
+                error = vmballoon_release_page(b, page);
+                if (error) {
+                        /* quickly decrease rate in case of error */
+                        b->rate_free = max(b->rate_free / 2,
+                                           VMW_BALLOON_RATE_FREE_MIN);
+                        return;
+                }
+
+                if (++i >= goal)
+                        break;
+        }
+
+        /* slowly increase rate if there were no errors */
+        b->rate_free = min(b->rate_free + VMW_BALLOON_RATE_FREE_INC,
+                           VMW_BALLOON_RATE_FREE_MAX);
+}
+
+/*
+ * Balloon work function: reset protocol, if needed, get the new size and
+ * adjust balloon as needed. Repeat in 1 sec.
+ */
+static void vmballoon_work(struct work_struct *work)
+{
+        struct delayed_work *dwork = to_delayed_work(work);
+        struct vmballoon *b = container_of(dwork, struct vmballoon, dwork);
+        unsigned int target;
+
+        STATS_INC(b->stats.timer);
+
+        if (b->reset_required)
+                vmballoon_reset(b);
+
+        if (b->slow_allocation_cycles > 0)
+                b->slow_allocation_cycles--;
+
+        if (vmballoon_send_get_target(b, &target)) {
+                /* update target, adjust size */
+                b->target = target;
+
+                if (b->size < target)
+                        vmballoon_inflate(b);
+                else if (b->size > target)
+                        vmballoon_deflate(b);
+        }
+
+        queue_delayed_work(vmballoon_wq, dwork, round_jiffies_relative(HZ));
+}
+
+/*
+ * DEBUGFS Interface
+ */
+#ifdef CONFIG_DEBUG_FS
+
+static int vmballoon_debug_show(struct seq_file *f, void *offset)
+{
+        struct vmballoon *b = f->private;
+        struct vmballoon_stats *stats = &b->stats;
+
+        /* format size info */
+        seq_printf(f,
+                   "target:             %8d pages\n"
+                   "current:            %8d pages\n",
+                   b->target, b->size);
+
+        /* format rate info */
+        seq_printf(f,
+                   "rateNoSleepAlloc:   %8d pages/sec\n"
+                   "rateSleepAlloc:     %8d pages/sec\n"
+                   "rateFree:           %8d pages/sec\n",
+                   VMW_BALLOON_NOSLEEP_ALLOC_MAX,
+                   b->rate_alloc, b->rate_free);
+
+        seq_printf(f,
+                   "\n"
+                   "timer:              %8u\n"
+                   "start:              %8u (%4u failed)\n"
+                   "guestType:          %8u (%4u failed)\n"
+                   "lock:               %8u (%4u failed)\n"
+                   "unlock:             %8u (%4u failed)\n"
+                   "target:             %8u (%4u failed)\n"
+                   "primNoSleepAlloc:   %8u (%4u failed)\n"
+                   "primCanSleepAlloc:  %8u (%4u failed)\n"
+                   "primFree:           %8u\n"
+                   "errAlloc:           %8u\n"
+                   "errFree:            %8u\n",
+                   stats->timer,
+                   stats->start, stats->start_fail,
+                   stats->guest_type, stats->guest_type_fail,
+                   stats->lock,  stats->lock_fail,
+                   stats->unlock, stats->unlock_fail,
+                   stats->target, stats->target_fail,
+                   stats->alloc, stats->alloc_fail,
+                   stats->sleep_alloc, stats->sleep_alloc_fail,
+                   stats->free,
+                   stats->refused_alloc, stats->refused_free);
+
+        return 0;
+}
+
+static int vmballoon_debug_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, vmballoon_debug_show, inode->i_private);
+}
+
+static const struct file_operations vmballoon_debug_fops = {
+        .owner          = THIS_MODULE,
+        .open           = vmballoon_debug_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int __init vmballoon_debugfs_init(struct vmballoon *b)
+{
+        int error;
+
+        b->dbg_entry = debugfs_create_file("vmmemctl", S_IRUGO, NULL, b,
+                                           &vmballoon_debug_fops);
+        if (IS_ERR(b->dbg_entry)) {
+                error = PTR_ERR(b->dbg_entry);
+                pr_err("failed to create debugfs entry, error: %d\n", error);
+                return error;
+        }
+
+        return 0;
+}
+
+static void __exit vmballoon_debugfs_exit(struct vmballoon *b)
+{
+        debugfs_remove(b->dbg_entry);
+}
+
+#else
+
+static inline int vmballoon_debugfs_init(struct vmballoon *b)
+{
+        return 0;
+}
+
+static inline void vmballoon_debugfs_exit(struct vmballoon *b)
+{
+}
+
+#endif  /* CONFIG_DEBUG_FS */
+
+static int __init vmballoon_init(void)
+{
+        int error;
+
+        /*
+         * Check if we are running on VMware's hypervisor and bail out
+         * if we are not.
+         */
+        if (x86_hyper != &x86_hyper_vmware)
+                return -ENODEV;
+
+        vmballoon_wq = create_freezeable_workqueue("vmmemctl");
+        if (!vmballoon_wq) {
+                pr_err("failed to create workqueue\n");
+                return -ENOMEM;
+        }
+
+        INIT_LIST_HEAD(&balloon.pages);
+        INIT_LIST_HEAD(&balloon.refused_pages);
+
+        /* initialize rates */
+        balloon.rate_alloc = VMW_BALLOON_RATE_ALLOC_MAX;
+        balloon.rate_free = VMW_BALLOON_RATE_FREE_MAX;
+
+        INIT_DELAYED_WORK(&balloon.dwork, vmballoon_work);
+
+        /*
+         * Start balloon.
+         */
+        if (!vmballoon_send_start(&balloon)) {
+                pr_err("failed to send start command to the host\n");
+                error = -EIO;
+                goto fail;
+        }
+
+        if (!vmballoon_send_guest_id(&balloon)) {
+                pr_err("failed to send guest ID to the host\n");
+                error = -EIO;
+                goto fail;
+        }
+
+        error = vmballoon_debugfs_init(&balloon);
+        if (error)
+                goto fail;
+
+        queue_delayed_work(vmballoon_wq, &balloon.dwork, 0);
+
+        return 0;
+
+fail:
+        destroy_workqueue(vmballoon_wq);
+        return error;
+}
+module_init(vmballoon_init);
+
+static void __exit vmballoon_exit(void)
+{
+        cancel_delayed_work_sync(&balloon.dwork);
+        destroy_workqueue(vmballoon_wq);
+
+        vmballoon_debugfs_exit(&balloon);
+
+        /*
+         * Deallocate all reserved memory, and reset connection with monitor.
+         * Reset connection before deallocating memory to avoid potential for
+         * additional spurious resets from guest touching deallocated pages.
+         */
+        vmballoon_send_start(&balloon);
+        vmballoon_pop(&balloon);
+}
+module_exit(vmballoon_exit);